2262 files changed, 88792 insertions, 32409 deletions

diff --git a/ChangeLog b/ChangeLog
index 5039c4f72..fc8012c36 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -11,6 +11,329 @@
 
         * .qmake.conf:
 
+2012-11-06  Keishi Hattori  <keishi@webkit.org>
+
+        Implement month picking to calendar picker
+        https://bugs.webkit.org/show_bug.cgi?id=101333
+
+        Reviewed by Kent Tamura.
+
+        * ManualTests/forms/calendar-picker.html: Added test for month picker.
+
+2012-11-06  Laszlo Gombos  <l.gombos@samsung.com>
+
+        [EFL] Simplify the build system
+        https://bugs.webkit.org/show_bug.cgi?id=101392
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Remove unused cmake variables. In addition there is no longer a need to define 
+        WTF_USE_TEXTURE_MAPPER_GL in the build system as that is now handled in Platform.h
+        (see r133623).
+
+        * Source/cmake/OptionsEfl.cmake:
+
+2012-11-05  Simon Hausmann  <simon.hausmann@digia.com>
+
+        [Qt] Trivial unreviewed: Add missing module dependencies for builds in Qt CI system.
+
+        These fields aren't used by anyone except some perl scripts in the Qt CI builds.
+
+        * Source/sync.profile:
+
+2012-11-02  Adam Barth  <abarth@webkit.org>
+
+        ENABLE(UNDO_MANAGER) is disabled everywhere and is not under active development
+        https://bugs.webkit.org/show_bug.cgi?id=100711
+
+        Reviewed by Eric Seidel.
+
+        * Source/cmake/WebKitFeatures.cmake:
+        * Source/cmakeconfig.h.cmake:
+
+2012-11-02  Martin Robinson  <mrobinson@igalia.com>
+
+        [GTK] Remove dependency on SoupPasswordManager
+        https://bugs.webkit.org/show_bug.cgi?id=100775
+
+        Reviewed by Carlos Garcia Campos.
+
+        Add a libsecret dependency to the build. This is necessary so that we can remove
+        a dependency on SoupPasswordManager.
+
+        * configure.ac: Look for libsecret using the pkg-config configuration macro.
+
+2012-11-02  Michael Brüning  <michael.bruning@digia.com>
+
+        [Qt][WK2] ASSERT hit for every mouse click
+        https://bugs.webkit.org/show_bug.cgi?id=100607
+
+        Reviewed by Jocelyn Turcotte.
+
+        Added a test with a link that contains an <em> tag surrounding the entire inner text.
+        The test should be run on an assert enabled build and the assert should not be
+        triggered when tapping the link.
+
+        * ManualTests/tap-gesture-on-em-link-tap-highlight-assert.html: Added.
+
+2012-11-01  Ami Fischman  <fischman@chromium.org>
+
+        HTMLMediaPlayer should free m_player when src is set/changed
+        https://bugs.webkit.org/show_bug.cgi?id=99647
+
+        Reviewed by Eric Carlson.
+
+        * ManualTests/media-players-are-dropped-on-error.html: Added.
+            Various scenarios are tested to make sure players aren't
+            leaked in different ways for each of them.
+
+2012-11-01  Beth Dakin  <bdakin@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=100917
+        There should be a way to dump the scrolling tree from the layout tests
+
+        Reviewed by Simon Fraser.
+
+        * Source/autotools/symbols.filter:
+
+2012-10-31  Thiago Marcos P. Santos  <thiago.santos@intel.com>
+
+        Added viewport at-rule to the CSS parser and tokenizer
+        https://bugs.webkit.org/show_bug.cgi?id=95961
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Enable CSS Device Adaptation by default on EFL.
+
+        * Source/cmake/OptionsEfl.cmake:
+
+2012-10-31  Ian Vollick  <vollick@chromium.org>
+
+        Add support for text-based repaint testing
+        https://bugs.webkit.org/show_bug.cgi?id=100584
+
+        Reviewed by Simon Fraser.
+
+        Allows tracked repaint rects to be dumped as text.
+
+        * Source/autotools/symbols.filter:
+          Exports for:
+            FrameView::setTracksRepaints(bool)
+            Frame::trackedRepaintRectsAsText() const
+
+
+2012-10-30  Vivek Galatage  <vivekgalatage@gmail.com>
+
+        Add files generated by Windows to ignore list for git repository
+        https://bugs.webkit.org/show_bug.cgi?id=100729
+
+        Reviewed by Gyuyoung Kim.
+
+        Adding the additional files generated by windows port to the ignore list
+
+        * .gitignore:
+
+2012-10-30  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        [GTK] Add a configure option to build with -g1
+        https://bugs.webkit.org/show_bug.cgi?id=100670
+
+        Reviewed by Martin Robinson.
+
+        Add min and full options to the --enable-debug-symbols configure
+        option. Using --enable-debug-symbols=min will use -g1 instead of
+        -g (which is actually -g2). The first level is enough for most of
+        the cases, like getting a backtrace, and it's the only way to
+        build WebKit with debug symbols in a 32 bit system. The option
+        full is actually the same than yes for backwards compatibility.
+
+        * configure.ac:
+
+2012-10-26  Rob Buis  <rbuis@rim.com>
+
+        [BlackBerry] Platform Abstraction for WebKit Resource/Image Loading
+        https://bugs.webkit.org/show_bug.cgi?id=100518
+
+        PR 231732
+
+        Reviewed by Yong Li.
+
+        Remove RESOURCE_PATH from webkit, this is now abstracted in our platform layer.
+
+        * Source/cmake/OptionsBlackBerry.cmake:
+
+2012-10-26  Regina Chung  <heejin.r.chung@samsung.com>
+
+        [EFL][WK2] Enable WebGL
+        https://bugs.webkit.org/show_bug.cgi?id=97652
+
+        Reviewed by Gyuyoung Kim.
+
+        Use Graphics Surface to enable WebGL for WebKit2 EFL.
+
+        * Source/cmake/OptionsEfl.cmake:
+
+2012-10-26  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r132601.
+        http://trac.webkit.org/changeset/132601
+        https://bugs.webkit.org/show_bug.cgi?id=100494
+
+        It broke the Qt build (Requested by Ossy on #webkit).
+
+        * Source/cmake/OptionsEfl.cmake:
+
+2012-10-26  Regina Chung  <heejin.r.chung@samsung.com>
+
+        [EFL][WK2] Enable WebGL
+        https://bugs.webkit.org/show_bug.cgi?id=97652
+
+        Reviewed by Gyuyoung Kim.
+
+        Use Graphics Surface to enable WebGL for WebKit2 EFL.
+
+        * Source/cmake/OptionsEfl.cmake:
+
+2012-10-26  Thiago Marcos P. Santos  <thiago.santos@intel.com>
+
+        Add feature flags for CSS Device Adaptation
+        https://bugs.webkit.org/show_bug.cgi?id=95960
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        * Source/cmake/WebKitFeatures.cmake:
+        * Source/cmakeconfig.h.cmake:
+        * configure.ac:
+
+2012-10-25  Yael Aharon  <yael.aharon@intel.com>
+
+        [EFL][WK2][AC] Enable 3D_RENDERING flag
+        https://bugs.webkit.org/show_bug.cgi?id=99535
+
+        Reviewed by Laszlo Gombos.
+
+        Turn on the flag ENABLE_3D_RENDERING when WTF_USE_TILE_BACKING_STORE flag is on.
+        This flag controls perspective and preserves-3d behavior.
+
+        * Source/cmake/OptionsEfl.cmake:
+
+2012-10-25  Dominik Röttsches  <dominik.rottsches@intel.com>
+
+        Adding feature for XHR_TIMEOUT
+
+        Conditionalize XHR timeout support
+        https://bugs.webkit.org/show_bug.cgi?id=100356
+
+        Reviewed by Adam Barth.
+
+        Adding feature for XHR_TIMEOUT to disable it on ports that don't have
+        network backend support for setTimeoutInterval.
+
+        * Source/cmake/OptionsEfl.cmake: Default ON on EFL.
+        * Source/cmake/WebKitFeatures.cmake: Default OFF for any CMAKE based port.
+        * Source/cmakeconfig.h.cmake: Adding define.
+        * configure.ac: Make autogen.sh support the --enable/--disable-xhr-timeout parameter.
+
+2012-10-25  Mikhail Pozdnyakov  <mikhail.pozdnyakov@intel.com>
+
+        Add setMediaTypeOverride to window.internals.settings
+        https://bugs.webkit.org/show_bug.cgi?id=100249
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Exported WebCore::Settings::setMediaTypeOverride(WTF::String const&) for GTK port.
+
+        * Source/autotools/symbols.filter:
+
+2012-10-24  Michael Carmody  <mcarmody@rim.com>
+
+        [BlackBerry] change CMAKE_<CCXX|C>_FLAGS_<RELEASE|DEBUG> from enviroment flags
+        https://bugs.webkit.org/show_bug.cgi?id=100256
+
+        Reviewed by Rob Buis.
+
+        This allow override of compile flags without having to edit CMake files.
+
+        * Source/cmake/OptionsBlackBerry.cmake:
+
+2012-10-24  Priit Laes  <plaes@plaes.org>
+
+        [GTK] ./configure output for CSS Shaders is broken
+        https://bugs.webkit.org/show_bug.cgi?id=100217
+
+        Reviewed by Martin Robinson.
+
+        Reformat CSS Filters / Shaders check to clean configure output.
+
+        * configure.ac:
+
+2012-10-24  Thiago Marcos P. Santos  <thiago.santos@intel.com>
+
+        [EFL] run-webkit-tests writes garbage on stderr when running on Xvfb
+        https://bugs.webkit.org/show_bug.cgi?id=100243
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Search for X11 development libraries (and thus Xext), necessary to
+        disable the X extensions error reporting.
+
+        * Source/cmake/OptionsEfl.cmake:
+
+2012-10-24  Mario Sanchez Prada  <mario@webkit.org>
+
+        [WK2] [GTK] TestWebKitAccessibility is not being run
+        https://bugs.webkit.org/show_bug.cgi?id=100102
+
+        Reviewed by Carlos Garcia Campos.
+
+        Moved check for at-spi2 after the definition of enable_webkit2,
+        since it's only needed for WebKit2GTK API tests.
+
+        * configure.ac: Moved the check for at-spi2 down in the file.
+
+2012-10-23  Martin Robinson  <mrobinson@igalia.com>
+
+        POTFILES.in/.skip need updates for translators
+        https://bugs.webkit.org/show_bug.cgi?id=67580
+
+        Reviewed by Xan Lopez.
+
+        Now process POTFILES.in during configuration.
+
+        * configure.ac:
+
+2012-10-23  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Add support for resolution media query
+        https://bugs.webkit.org/show_bug.cgi?id=99077
+
+        Reviewed by Antti Koivisto.
+
+        * Source/cmake/OptionsEfl.cmake:
+        * Source/cmake/WebKitFeatures.cmake:
+        * Source/cmakeconfig.h.cmake:
+
+            Add support for the RESOLUTION_MEDIA_QUERY feature flag.
+
+        * Source/autotools/symbols.filter:
+
+            Export the WebCore::Settings setting.
+
+2012-10-23  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        Unreviewed. Update NEWS and configure.ac for 1.11.1 release
+
+        * configure.ac: Bump version numbers.
+
+2012-10-23  Ryuan Choi  <ryuan.choi@samsung.com>
+
+        [EFL][WK2] Add support for IMF composition
+        https://bugs.webkit.org/show_bug.cgi?id=89552
+
+        Reviewed by Gyuyoung Kim.
+
+        * Source/cmake/FindEcore.cmake: Checked Ecore_IMF.
+
 2012-10-23  Andras Becsi  <andras.becsi@digia.com>
 
         Remove devicePixelRatio from ViewportAttributes
diff --git a/Source/JavaScriptCore/API/JSStringRef.cpp b/Source/JavaScriptCore/API/JSStringRef.cpp
index da1a3057a..7f2168dc2 100644
--- a/Source/JavaScriptCore/API/JSStringRef.cpp
+++ b/Source/JavaScriptCore/API/JSStringRef.cpp
@@ -47,9 +47,10 @@ JSStringRef JSStringCreateWithUTF8CString(const char* string)
         Vector<UChar, 1024> buffer(length);
         UChar* p = buffer.data();
         bool sourceIsAllASCII;
+        const LChar* stringStart = reinterpret_cast<const LChar*>(string);
         if (conversionOK == convertUTF8ToUTF16(&string, string + length, &p, p + length, &sourceIsAllASCII)) {
             if (sourceIsAllASCII)
-                return OpaqueJSString::create(reinterpret_cast<const LChar*>(string), length).leakRef();
+                return OpaqueJSString::create(stringStart, length).leakRef();
             return OpaqueJSString::create(buffer.data(), p - buffer.data()).leakRef();
         }
     }
diff --git a/Source/JavaScriptCore/API/JSStringRefCF.cpp b/Source/JavaScriptCore/API/JSStringRefCF.cpp
index 69cf3f8c4..fd72a593c 100644
--- a/Source/JavaScriptCore/API/JSStringRefCF.cpp
+++ b/Source/JavaScriptCore/API/JSStringRefCF.cpp
@@ -41,6 +41,12 @@ JSStringRef JSStringCreateWithCFString(CFStringRef string)
     // it can hold.  (<rdar://problem/6806478>)
     size_t length = CFStringGetLength(string);
     if (length) {
+        Vector<LChar, 1024> lcharBuffer(length);
+        CFIndex usedBufferLength;
+        CFIndex convertedSize = CFStringGetBytes(string, CFRangeMake(0, length), kCFStringEncodingISOLatin1, 0, false, lcharBuffer.data(), length, &usedBufferLength);
+        if (static_cast<size_t>(convertedSize) == length && static_cast<size_t>(usedBufferLength) == length)
+            return OpaqueJSString::create(lcharBuffer.data(), length).leakRef();
+
         OwnArrayPtr<UniChar> buffer = adoptArrayPtr(new UniChar[length]);
         CFStringGetCharacters(string, CFRangeMake(0, length), buffer.get());
         COMPILE_ASSERT(sizeof(UniChar) == sizeof(UChar), unichar_and_uchar_must_be_same_size);
diff --git a/Source/JavaScriptCore/API/JSValueRef.cpp b/Source/JavaScriptCore/API/JSValueRef.cpp
index de84508c1..5ff7c03c6 100644
--- a/Source/JavaScriptCore/API/JSValueRef.cpp
+++ b/Source/JavaScriptCore/API/JSValueRef.cpp
@@ -217,7 +217,7 @@ JSValueRef JSValueMakeNumber(JSContextRef ctx, double value)
     // generated internally to JavaScriptCore naturally have that representation,
     // but an external NaN might not.
     if (isnan(value))
-        value = std::numeric_limits<double>::quiet_NaN();
+        value = QNaN;
 
     return toRef(exec, jsNumber(value));
 }
@@ -282,7 +282,7 @@ double JSValueToNumber(JSContextRef ctx, JSValueRef value, JSValueRef* exception
         if (exception)
             *exception = toRef(exec, exec->exception());
         exec->clearException();
-        number = std::numeric_limits<double>::quiet_NaN();
+        number = QNaN;
     }
     return number;
 }
diff --git a/Source/JavaScriptCore/API/tests/minidom.c b/Source/JavaScriptCore/API/tests/minidom.c
index bd3e119e5..43ae2c1a8 100644
--- a/Source/JavaScriptCore/API/tests/minidom.c
+++ b/Source/JavaScriptCore/API/tests/minidom.c
@@ -30,7 +30,6 @@
 #include "JSStringRef.h"
 #include <stdio.h>
 #include <stdlib.h>
-#include <wtf/Platform.h>
 #include <wtf/Assertions.h>
 #include <wtf/UnusedParam.h>
 
diff --git a/Source/JavaScriptCore/API/tests/testapi.c b/Source/JavaScriptCore/API/tests/testapi.c
index b52a2b440..c2400f7ec 100644
--- a/Source/JavaScriptCore/API/tests/testapi.c
+++ b/Source/JavaScriptCore/API/tests/testapi.c
@@ -29,7 +29,6 @@
 #include "JSObjectRefPrivate.h"
 #include <math.h>
 #define ASSERT_DISABLED 0
-#include <wtf/Platform.h>
 #include <wtf/Assertions.h>
 #include <wtf/UnusedParam.h>
 
diff --git a/Source/JavaScriptCore/CMakeLists.txt b/Source/JavaScriptCore/CMakeLists.txt
index c706f65e9..393db67c3 100644
--- a/Source/JavaScriptCore/CMakeLists.txt
+++ b/Source/JavaScriptCore/CMakeLists.txt
@@ -49,8 +49,6 @@ SET(JavaScriptCore_SOURCES
     bytecode/GetByIdStatus.cpp
     bytecode/JumpTable.cpp
     bytecode/LazyOperandValueProfile.cpp
-    bytecode/MethodCallLinkInfo.cpp
-    bytecode/MethodCallLinkStatus.cpp
     bytecode/MethodOfGettingAValueProfile.cpp
     bytecode/Opcode.cpp
     bytecode/PolymorphicPutByIdList.cpp
@@ -61,6 +59,7 @@ SET(JavaScriptCore_SOURCES
     bytecode/SpecialPointer.cpp
     bytecode/StructureStubClearingWatchpoint.cpp
     bytecode/StructureStubInfo.cpp
+    bytecode/UnlinkedCodeBlock.cpp
     bytecode/Watchpoint.cpp
 
     bytecompiler/BytecodeGenerator.cpp
@@ -176,6 +175,7 @@ SET(JavaScriptCore_SOURCES
     runtime/BooleanObject.cpp
     runtime/BooleanPrototype.cpp
     runtime/CallData.cpp
+    runtime/CodeCache.cpp
     runtime/CommonIdentifiers.cpp
     runtime/Completion.cpp
     runtime/ConstructData.cpp
diff --git a/Source/JavaScriptCore/ChangeLog b/Source/JavaScriptCore/ChangeLog
index b2c4299ce..8479ac599 100644
--- a/Source/JavaScriptCore/ChangeLog
+++ b/Source/JavaScriptCore/ChangeLog
@@ -1,3 +1,570 @@
+2012-11-06  Oliver Hunt  <oliver@apple.com>
+
+        Reduce parser overhead in JSC
+        https://bugs.webkit.org/show_bug.cgi?id=101127
+
+        Reviewed by Filip Pizlo.
+
+        An exciting journey into the world of architecture in which our hero
+        adds yet another layer to JSC codegeneration.
+
+        This patch adds a marginally more compact form of bytecode that is
+        free from any data specific to a given execution context, and that
+        does store any data structures necessary for execution.  To actually
+        execute this UnlinkedBytecode we still need to instantiate a real
+        CodeBlock, but this is a much faster linear time operation than any
+        of the earlier parsing or code generation passes.
+
+        As the unlinked code is context free we can then simply use a cache
+        from source to unlinked code mapping to completely avoid all of the
+        old parser overhead.  The cache is currently very simple and memory
+        heavy, using the complete source text as a key (rather than SourceCode
+        or equivalent), and a random eviction policy.
+
+        This seems to produce a substantial win when loading identical content
+        in different contexts.
+
+        * API/tests/testapi.c:
+        (main):
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/CodeBlock.cpp:
+        * bytecode/CodeBlock.h:
+            Moved a number of fields, and a bunch of logic to UnlinkedCodeBlock.h/cpp
+        * bytecode/Opcode.h:
+            Added a global const init no op instruction needed to get correct
+            behaviour without any associated semantics.
+        * bytecode/UnlinkedCodeBlock.cpp: Added.
+        * bytecode/UnlinkedCodeBlock.h: Added.
+            A fairly shallow, GC allocated version of the old CodeBlock
+            classes with a 32bit instruction size, and just metadata
+            size tracking.
+        * bytecompiler/BytecodeGenerator.cpp:
+        * bytecompiler/BytecodeGenerator.h:
+            Replace direct access to m_symbolTable with access through
+            symbolTable().  ProgramCode no longer has a symbol table at
+            all so some previously unconditional (and pointless) uses
+            of symbolTable get null checks.
+            A few other changes to deal with type changes due to us generating
+            unlinked code (eg. pointer free, so profile indices rather than
+            pointers).
+        * dfg/DFGByteCodeParser.cpp:
+        * dfg/DFGCapabilities.h:
+            Support global_init_nop        
+        * interpreter/Interpreter.cpp:
+            Now get the ProgramExecutable to initialise new global properties
+            before starting execution.        
+        * jit/JIT.cpp:
+        * jit/JITDriver.h:
+        * jit/JITStubs.cpp:
+        * llint/LLIntData.cpp:
+        * llint/LLIntSlowPaths.cpp:
+        * llint/LowLevelInterpreter.asm:
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+            Adding init_global_const_nop everywhere else
+        * parser/Parser.h:
+        * parser/ParserModes.h: Added.
+        * parser/ParserTokens.h:
+            Parser no longer needs a global object or callframe to function        
+        * runtime/CodeCache.cpp: Added.
+        * runtime/CodeCache.h: Added.
+            A simple, random eviction, Source->UnlinkedCode cache        
+        * runtime/Executable.cpp:
+        * runtime/Executable.h:
+            Executables now reference their unlinked counterparts, and
+            request code specifically for the target global object.        
+        * runtime/JSGlobalData.cpp:
+        * runtime/JSGlobalData.h:
+            GlobalData now owns a CodeCache and a set of new structures
+            for the unlinked code types.  
+        * runtime/JSGlobalObject.cpp:
+        * runtime/JSGlobalObject.h:
+            Utility functions used by executables to perform compilation
+ 
+        * runtime/JSType.h:
+          Add new JSTypes for unlinked code
+
+2012-11-06  Michael Saboff  <msaboff@apple.com>
+
+        JSStringCreateWithCFString() Should create an 8 bit String if possible
+        https://bugs.webkit.org/show_bug.cgi?id=101104
+
+        Reviewed by Darin Adler.
+
+        Try converting the CFString to an 8 bit string using CFStringGetBytes(...,
+        kCFStringEncodingISOLatin1, ...) and return the 8 bit string if successful.
+        If not proceed with 16 bit conversion.
+
+        * API/JSStringRefCF.cpp:
+        (JSStringCreateWithCFString):
+
+2012-11-06  Oliver Hunt  <oliver@apple.com>
+
+        Reduce direct m_symbolTable usage in CodeBlock
+        https://bugs.webkit.org/show_bug.cgi?id=101391
+
+        Reviewed by Sam Weinig.
+
+        Simple refactoring.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        (JSC::CodeBlock::dumpStatistics):
+        (JSC::CodeBlock::nameForRegister):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::isCaptured):
+
+2012-11-06  Michael Saboff  <msaboff@apple.com>
+
+        Lexer::scanRegExp, create 8 bit pattern and flag Identifiers from 16 bit source when possible
+        https://bugs.webkit.org/show_bug.cgi?id=101013
+
+        Reviewed by Darin Adler.
+
+        Changed scanRegExp so that it will create 8 bit identifiers from 8 bit sources and from 16 bit sources
+        whan all the characters are 8 bit.  Using two templated helpers, the "is all 8 bit" check is only performed
+        on 16 bit sources.  The first helper is orCharacter() that will accumulate the or value of all characters
+        only for 16 bit sources.  Replaced the helper Lexer::makeIdentifierSameType() with Lexer::makeRightSizedIdentifier().
+
+        * parser/Lexer.cpp:
+        (JSC::orCharacter<LChar>): Explicit template that serves as a placeholder.
+        (JSC::orCharacter<UChar>): Explicit template that actually or accumulates characters.
+        (JSC::Lexer::scanRegExp):
+        * parser/Lexer.h:
+        (Lexer):
+        (JSC::Lexer::makeRightSizedIdentifier<LChar>): New template that always creates an 8 bit Identifier.
+        (JSC::Lexer::makeRightSizedIdentifier<UChar>): New template that creates an 8 bit Identifier for 8 bit
+        data in a 16 bit source.
+
+2012-11-06  Filip Pizlo  <fpizlo@apple.com>
+
+        Indentation of JSCell.h is wrong
+        https://bugs.webkit.org/show_bug.cgi?id=101379
+
+        Rubber stamped by Alexey Proskuryakov.
+
+        Just removed four spaces on a bunch of lines.
+
+        * runtime/JSCell.h:
+
+2012-11-05  Filip Pizlo  <fpizlo@apple.com>
+
+        Indentation of JSObject.h is wrong
+        https://bugs.webkit.org/show_bug.cgi?id=101313
+
+        Rubber stamped by Alexey Proskuryakov.
+
+        Just unindented code, since namespace bodies shouldn't be indented.
+
+        * runtime/JSObject.h:
+
+2012-11-05  Filip Pizlo  <fpizlo@apple.com>
+
+        Indentation of JSArray.h is wrong
+        https://bugs.webkit.org/show_bug.cgi?id=101314
+
+        Rubber stamped by Alexey Proskuryakov.
+
+        Just removing the indentation inside the namespace body.
+
+        * runtime/JSArray.h:
+
+2012-11-05  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG should not fall down to patchable GetById just because a prototype had things added to it
+        https://bugs.webkit.org/show_bug.cgi?id=101299
+
+        Reviewed by Geoffrey Garen.
+
+        This looks like a slight win on V8v7 and SunSpider.
+
+        * bytecode/DFGExitProfile.h:
+        (JSC::DFG::exitKindToString):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2012-11-05  Filip Pizlo  <fpizlo@apple.com>
+
+        Get rid of method_check
+        https://bugs.webkit.org/show_bug.cgi?id=101147
+
+        Reviewed by Geoffrey Garen.
+
+        op_method_check no longer buys us anything, since get_by_id proto caching
+        gives just as much profiling information and the DFG inlines monomorphic
+        proto accesses anyway.
+        
+        This also has the potential for a speed-up since it makes parsing of
+        profiling data easier. No longer do we have to deal with the confusion of
+        the get_by_id portion of a method_check appearing monomorphic even though
+        we're really dealing with a bimorphic access (method_check specializes for
+        one case and get_by_id for another).
+
+        This looks like a 1% speed-up on both SunSpider and V8v7.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * Target.pri:
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::printGetByIdCacheStatus):
+        (JSC::CodeBlock::dump):
+        (JSC::CodeBlock::finalizeUnconditionally):
+        (JSC::CodeBlock::shrinkToFit):
+        (JSC::CodeBlock::unlinkCalls):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::getCallLinkInfo):
+        (JSC::CodeBlock::callLinkInfo):
+        (CodeBlock):
+        * bytecode/GetByIdStatus.cpp:
+        (JSC::GetByIdStatus::computeFromLLInt):
+        * bytecode/MethodCallLinkInfo.cpp: Removed.
+        * bytecode/MethodCallLinkInfo.h: Removed.
+        * bytecode/MethodCallLinkStatus.cpp: Removed.
+        * bytecode/MethodCallLinkStatus.h: Removed.
+        * bytecode/Opcode.h:
+        (JSC):
+        (JSC::padOpcodeName):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC):
+        * bytecompiler/BytecodeGenerator.h:
+        (BytecodeGenerator):
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::FunctionCallDotNode::emitBytecode):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGCapabilities.h:
+        (JSC::DFG::canCompileOpcode):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileSlowCases):
+        (JSC::PropertyStubCompilationInfo::copyToStubInfo):
+        (JSC::JIT::privateCompile):
+        * jit/JIT.h:
+        (JSC::PropertyStubCompilationInfo::slowCaseInfo):
+        (PropertyStubCompilationInfo):
+        (JSC):
+        (JIT):
+        * jit/JITPropertyAccess.cpp:
+        (JSC):
+        (JSC::JIT::emitSlow_op_get_by_id):
+        (JSC::JIT::compileGetByIdSlowCase):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC):
+        (JSC::JIT::compileGetByIdSlowCase):
+        * jit/JITStubs.cpp:
+        (JSC):
+        * jit/JITStubs.h:
+        * llint/LowLevelInterpreter.asm:
+
+2012-11-05  Yuqiang Xian  <yuqiang.xian@intel.com>
+
+        Refactor LLInt64 to distinguish the pointer operations from the 64-bit integer operations
+        https://bugs.webkit.org/show_bug.cgi?id=100321
+
+        Reviewed by Filip Pizlo.
+
+        We have refactored the MacroAssembler and JIT compilers to distinguish
+        the pointer operations from the 64-bit integer operations (see bug #99154).
+        Now we want to do the similar work for LLInt, and the goal is same as
+        the one mentioned in 99154.
+
+        This is the second part of the modification: in the low level interpreter,
+        changing the operations on 64-bit integers to use the "<foo>q" instructions.
+        This also removes some unused/meaningless "<foo>p" instructions.
+
+        * llint/LowLevelInterpreter.asm:
+        * llint/LowLevelInterpreter.cpp:
+        (JSC::CLoop::execute):
+        * llint/LowLevelInterpreter64.asm:
+        * offlineasm/armv7.rb:
+        * offlineasm/cloop.rb:
+        * offlineasm/instructions.rb:
+        * offlineasm/x86.rb:
+
+2012-11-05  Filip Pizlo  <fpizlo@apple.com>
+
+        Prototype chain caching should check that the path from the base object to the slot base involves prototype hops only
+        https://bugs.webkit.org/show_bug.cgi?id=101276
+
+        Reviewed by Gavin Barraclough.
+
+        Changed normalizePrototypeChain() to report an invalid prototype chain if any object is a proxy.
+        This catches cases where our prototype chain checks would have been insufficient to guard against
+        newly introduced properties, despecialized properties, or deleted properties in the chain of
+        objects involved in the access.
+
+        * dfg/DFGRepatch.cpp:
+        (JSC::DFG::tryCacheGetByID):
+        (JSC::DFG::tryBuildGetByIDProtoList):
+        (JSC::DFG::tryCachePutByID):
+        (JSC::DFG::tryBuildPutByIdList):
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::tryCachePutByID):
+        (JSC::JITThunks::tryCacheGetByID):
+        (JSC::DEFINE_STUB_FUNCTION):
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * runtime/Operations.h:
+        (JSC):
+        (JSC::normalizePrototypeChain):
+
+2012-11-05  Dima Gorbik  <dgorbik@apple.com>
+
+        Back out controversial changes from Bug 98665.
+        https://bugs.webkit.org/show_bug.cgi?id=101244
+
+        Reviewed by David Kilzer.
+
+        Backing out changes from Bug 98665 until further discussions take place on rules for including Platform.h in Assertions.h.
+
+        * API/tests/minidom.c:
+        * API/tests/testapi.c:
+
+2012-11-04  Filip Pizlo  <fpizlo@apple.com>
+
+        Reduce the verbosity of referring to QNaN in JavaScriptCore
+        https://bugs.webkit.org/show_bug.cgi?id=101174
+
+        Reviewed by Geoffrey Garen.
+
+        Introduces a #define QNaN in JSValue.h, and replaces all previous uses of
+        std::numeric_limits<double>::quiet_NaN() with QNaN.
+
+        * API/JSValueRef.cpp:
+        (JSValueMakeNumber):
+        (JSValueToNumber):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileGetByValOnFloatTypedArray):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emitFloatTypedArrayGetByVal):
+        * runtime/CachedTranscendentalFunction.h:
+        (JSC::CachedTranscendentalFunction::initialize):
+        * runtime/DateConstructor.cpp:
+        (JSC::constructDate):
+        * runtime/DateInstanceCache.h:
+        (JSC::DateInstanceData::DateInstanceData):
+        (JSC::DateInstanceCache::reset):
+        * runtime/ExceptionHelpers.cpp:
+        (JSC::InterruptedExecutionError::defaultValue):
+        (JSC::TerminatedExecutionError::defaultValue):
+        * runtime/JSCell.h:
+        (JSC::JSValue::getPrimitiveNumber):
+        * runtime/JSDateMath.cpp:
+        (JSC::parseDateFromNullTerminatedCharacters):
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        (JSC::JSGlobalData::resetDateCache):
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::parseInt):
+        (JSC::jsStrDecimalLiteral):
+        (JSC::toDouble):
+        (JSC::jsToNumber):
+        (JSC::parseFloat):
+        * runtime/JSValue.cpp:
+        (JSC::JSValue::toNumberSlowCase):
+        * runtime/JSValue.h:
+        (JSC):
+        * runtime/JSValueInlineMethods.h:
+        (JSC::jsNaN):
+        * runtime/MathObject.cpp:
+        (JSC::mathProtoFuncMax):
+        (JSC::mathProtoFuncMin):
+
+2012-11-03  Filip Pizlo  <fpizlo@apple.com>
+
+        Baseline JIT should use structure watchpoints whenever possible
+        https://bugs.webkit.org/show_bug.cgi?id=101146
+
+        Reviewed by Sam Weinig.
+
+        No speed-up yet except on toy programs. I think that it will start to show
+        speed-ups with https://bugs.webkit.org/show_bug.cgi?id=101147, which this is
+        a step towards.
+
+        * jit/JIT.h:
+        (JIT):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::privateCompilePutByIdTransition):
+        (JSC::JIT::privateCompileGetByIdProto):
+        (JSC::JIT::privateCompileGetByIdProtoList):
+        (JSC::JIT::privateCompileGetByIdChainList):
+        (JSC::JIT::privateCompileGetByIdChain):
+        (JSC::JIT::addStructureTransitionCheck):
+        (JSC):
+        (JSC::JIT::testPrototype):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::privateCompilePutByIdTransition):
+        (JSC::JIT::privateCompileGetByIdProto):
+        (JSC::JIT::privateCompileGetByIdProtoList):
+        (JSC::JIT::privateCompileGetByIdChainList):
+        (JSC::JIT::privateCompileGetByIdChain):
+
+2012-11-04  Csaba Osztrogonác  <ossy@webkit.org>
+
+        [Qt] udis86_itab.c is always regenerated
+        https://bugs.webkit.org/show_bug.cgi?id=100756
+
+        Reviewed by Simon Hausmann.
+
+        * DerivedSources.pri: Generate sources to the generated directory.
+        * disassembler/udis86/differences.txt:
+        * disassembler/udis86/itab.py: Add --outputDir option.
+        (UdItabGenerator.__init__):
+        (genItabH):
+        (genItabC):
+        (main):
+
+2012-11-02  Filip Pizlo  <fpizlo@apple.com>
+
+        LLInt 32-bit put_by_val ArrayStorage case should use the right register (t3, not t2) for the index in the publicLength updating path
+        https://bugs.webkit.org/show_bug.cgi?id=101118
+
+        Reviewed by Gavin Barraclough.
+
+        * llint/LowLevelInterpreter32_64.asm:
+
+2012-11-02  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG::Node::converToStructureTransitionWatchpoint should take kindly to ArrayifyToStructure
+        https://bugs.webkit.org/show_bug.cgi?id=101117
+
+        Reviewed by Gavin Barraclough.
+
+        We have logic to convert ArrayifyToStructure to StructureTransitionWatchpoint, which is awesome, except
+        that previously convertToStructureTransitionWatchpoint was (a) asserting that it never saw an
+        ArrayifyToStructure and (b) would incorrectly create a ForwardStructureTransitionWatchpoint if it did.
+
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::convertToStructureTransitionWatchpoint):
+
+2012-11-02  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG::SpeculativeJIT::typedArrayDescriptor should use the Float64Array descriptor for Float64Arrays
+        https://bugs.webkit.org/show_bug.cgi?id=101114
+
+        Reviewed by Gavin Barraclough.
+
+        As in https://bugs.webkit.org/show_bug.cgi?id=101112, this was only wrong when Float64Array descriptors
+        hadn't been initialized yet. That happens rarely, but when it does happen, we would crash.
+        
+        This would also become much more wrong if we ever put type size info (num bytes, etc) in the descriptor
+        and used that directly. So it's good to fix it.
+
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::typedArrayDescriptor):
+
+2012-11-02  Filip Pizlo  <fpizlo@apple.com>
+
+        JIT::privateCompileGetByVal should use the uint8ClampedArrayDescriptor for compiling accesses to Uint8ClampedArrays
+        https://bugs.webkit.org/show_bug.cgi?id=101112
+
+        Reviewed by Gavin Barraclough.
+
+        The only reason why the code was wrong to use uint8ArrayDescriptor instead is that if we're just using
+        Uint8ClampedArrays then the descriptor for Uint8Array may not have been initialized.
+
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::privateCompileGetByVal):
+
+2012-11-02  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        MarkedBlocks should use something other than the mark bits to indicate liveness for newly allocated objects
+        https://bugs.webkit.org/show_bug.cgi?id=100877
+
+        Reviewed by Filip Pizlo.
+
+        Currently when we canonicalize cell liveness data in MarkedBlocks, we set the mark bit for every cell in the 
+        block except for those in the free list. This allows us to consider objects that were allocated since the 
+        previous collection to be considered live until they have a chance to be properly marked by the collector.
+
+        If we want to use the mark bits to signify other types of information, e.g. using sticky mark bits for generational 
+        collection, we will have to keep track of newly allocated objects in a different fashion when we canonicalize cell liveness.
+
+        One method would be to allocate a separate set of bits while canonicalizing liveness data. These bits would 
+        track the newly allocated objects in the block separately from those objects who had already been marked. We would 
+        then check these bits, along with the mark bits, when determining liveness. 
+
+        * heap/Heap.h:
+        (Heap):
+        (JSC::Heap::isLive): We now check for the presence of the newlyAllocated Bitmap.
+        (JSC):
+        * heap/MarkedBlock.cpp:
+        (JSC::MarkedBlock::specializedSweep): We clear the newlyAllocated Bitmap if we're creating a free list. This 
+        will happen if we canonicalize liveness data for some other reason than collection (e.g. forEachCell) and 
+        then start allocating again.
+        (JSC::SetNewlyAllocatedFunctor::SetNewlyAllocatedFunctor): 
+        (SetNewlyAllocatedFunctor):
+        (JSC::SetNewlyAllocatedFunctor::operator()): We set the newlyAllocated bits for all the objects 
+        that aren't already marked. We undo the bits for the objects in the free list later in canonicalizeCellLivenessData.
+        (JSC::MarkedBlock::canonicalizeCellLivenessData): We should never have a FreeListed block with a newlyAllocated Bitmap.
+        We allocate the new Bitmap, set the bits for all the objects that aren't already marked, and then unset all of the 
+        bits for the items currently in the FreeList.
+        * heap/MarkedBlock.h:
+        (JSC::MarkedBlock::clearMarks): We clear the newlyAllocated bitmap if it exists because at this point we don't need it
+        any more.
+        (JSC::MarkedBlock::isEmpty): If we have some objects that are newlyAllocated, we are not empty.
+        (JSC::MarkedBlock::isNewlyAllocated): 
+        (JSC):
+        (JSC::MarkedBlock::setNewlyAllocated):
+        (JSC::MarkedBlock::clearNewlyAllocated):
+        (JSC::MarkedBlock::isLive): We now check the newlyAllocated Bitmap, if it exists, when determining liveness of a cell in 
+        a block that is Marked.
+        * heap/WeakBlock.cpp:
+        (JSC::WeakBlock::visit): We need to make sure we don't finalize objects that are in the newlyAllocated Bitmap.
+        (JSC::WeakBlock::reap): Ditto.
+
+2012-11-02  Filip Pizlo  <fpizlo@apple.com>
+
+        JIT::privateCompileGetByVal should use MacroAssemblerCodePtr::createFromExecutableAddress like JIT::privateCompilePutByVal
+        https://bugs.webkit.org/show_bug.cgi?id=101109
+
+        Reviewed by Gavin Barraclough.
+
+        This fixes crashes on ARMv7 resulting from the return address already being tagged with the THUMB2 bit.
+
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::privateCompileGetByVal):
+
+2012-11-02  Simon Fraser  <simon.fraser@apple.com>
+
+        Enable SUBPIXEL_LAYOUT on Mac
+        https://bugs.webkit.org/show_bug.cgi?id=101076
+
+        Reviewed by Dave Hyatt.
+
+        Define ENABLE_SUBPIXEL_LAYOUT and include it in FEATURE_DEFINES.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2012-11-02  Michael Saboff  <msaboff@apple.com>
+
+        RegExp.prototype.toString Should Produce an 8 bit JSString if possible.
+        https://bugs.webkit.org/show_bug.cgi?id=101003
+
+        Reviewed by Geoffrey Garen.
+
+        Took the logic of regExpObjectSource() and created two templated helpers that uses the
+        source character type when appending to the StringBuilder.
+
+        * runtime/RegExpObject.cpp:
+        (JSC::appendLineTerminatorEscape): Checks line terminate type to come up with escaped version.
+        (JSC::regExpObjectSourceInternal): Templated version of original.
+        (JSC::regExpObjectSource): Wrapper function.
+
+2012-11-02  Adam Barth  <abarth@webkit.org>
+
+        ENABLE(UNDO_MANAGER) is disabled everywhere and is not under active development
+        https://bugs.webkit.org/show_bug.cgi?id=100711
+
+        Reviewed by Eric Seidel.
+
+        * Configurations/FeatureDefines.xcconfig:
+
 2012-11-02  Simon Hausmann  <simon.hausmann@digia.com>
 
         [Qt] Fix build on Windows when Qt is configured with -release
@@ -13,12 +580,610 @@
 
         * LLIntOffsetsExtractor.pro:
 
-2012-10-25  Simon Hausmann  <simon.hausmann@digia.com>
+2012-11-01  Mark Lam  <mark.lam@apple.com>
+
+        A llint workaround for a toolchain issue.
+        https://bugs.webkit.org/show_bug.cgi?id=101012.
+
+        Reviewed by Michael Saboff.
+
+        * llint/LowLevelInterpreter.asm:
+          - use a local label to workaround the toolchain issue with undeclared
+            global labels.
+
+2012-11-01  Oliver Hunt  <oliver@apple.com>
+
+        Remove GlobalObject constant register that is typically unused
+        https://bugs.webkit.org/show_bug.cgi?id=101005
+
+        Reviewed by Geoffrey Garen.
+
+        The GlobalObject constant register is frequently allocated even when it
+        is not used, it is also getting in the way of some other optimisations.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::CodeBlock):
+        * bytecode/CodeBlock.h:
+        (CodeBlock):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseResolveOperations):
+
+2012-10-31  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG optimized string access code should be enabled
+        https://bugs.webkit.org/show_bug.cgi?id=100825
+
+        Reviewed by Oliver Hunt.
+
+        - Removes prediction checks from the parser.
+        
+        - Fixes the handling of array mode refinement for strings. I.e. we don't do
+          any refinement - we already know it's going to be a string. We could
+          revisit this in the future, but for now the DFG lacks the ability to
+          handle any array modes other than Array::String for string intrinsics, so
+          this is as good as it gets.
+        
+        - Removes uses of isBlahSpeculation for checking if a mode is already
+          checked. isBlahSpeculation implicitly checks if the SpeculatedType is not
+          BOTTOM ("empty"), which breaks for checking if a mode is already checked
+          since a mode may already be "checked" in the sense that we've proven that
+          the code is unreachable.
+        
+        ~1% speed-up on V8v7, mostly from a speed-up on crypto, which uses string
+        intrinsics in one of the hot functions.
+
+        * bytecode/SpeculatedType.h:
+        (JSC::speculationChecked):
+        (JSC):
+        * dfg/DFGArrayMode.cpp:
+        (JSC::DFG::ArrayMode::alreadyChecked):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::handleIntrinsic):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileGetCharCodeAt):
+
+2012-10-31  Filip Pizlo  <fpizlo@apple.com>
+
+        Sparse array size threshold should be increased to 100000
+        https://bugs.webkit.org/show_bug.cgi?id=100827
+
+        Reviewed by Oliver Hunt.
+
+        This enables the use of contiguous arrays in programs that previously
+        couldn't use them. And I so far can't see any examples of this being
+        a downside. To the extent that there is a downside, it ought to be
+        addressed by GC: https://bugs.webkit.org/show_bug.cgi?id=100828
+
+        * runtime/ArrayConventions.h:
+        (JSC):
+
+2012-10-31  Mark Lam  <mark.lam@apple.com>
+
+        C++ llint 64-bit backend needs to zero extend results of int32 operations.
+        https://bugs.webkit.org/show_bug.cgi?id=100899.
+
+        Reviewed by Filip Pizlo.
+
+        llint asm instructions ending in "i" for a 64-bit machine expects the
+        high 32-bit of registers to be zero'ed out when a 32-bit instruction
+        writes into a register. Fixed the C++ llint to honor this.
+
+        Fixed the index register used in BaseIndex addressing to be of size
+        intptr_t as expected.
+
+        Updated CLoopRegister to handle different endiannesss configurations.
+
+        * llint/LowLevelInterpreter.cpp:
+        (JSC::CLoopRegister::clearHighWord):
+          - new method to clear the high 32-bit of a 64-bit register.
+            It's a no-op for the 32-bit build. 
+        (CLoopRegister):
+          - CLoopRegister now takes care of packing and byte endianness order.
+        (JSC::CLoop::execute): - Added an assert.
+        * offlineasm/cloop.rb:
+          - Add calls to clearHighWord() wherever needed.
+
+2012-10-31  Mark Lam  <mark.lam@apple.com>
+
+        A JSC printf (support for %J+s and %b).
+        https://bugs.webkit.org/show_bug.cgi?id=100566.
+
+        Reviewed by Michael Saboff.
+
+        Added VMInspector::printf(), fprintf(), sprintf(), and snprintf().
+        - %b prints ints as boolean TRUE (non-zero) or FALSE (zero).
+        - %Js prints a WTF::String* like a %s prints a char*.
+          Also works for 16bit WTF::Strings (prints wchar_t* using %S).
+        - '+' is a modifier meaning 'use verbose mode', and %J+s is an example
+          of its use.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * interpreter/VMInspector.cpp:
+        (FormatPrinter):
+        (JSC::FormatPrinter::~FormatPrinter):
+        (JSC::FormatPrinter::print):
+        (JSC::FormatPrinter::printArg):
+        (JSC::FormatPrinter::printWTFString):
+        (JSC::FileFormatPrinter::FileFormatPrinter):
+        (JSC::FileFormatPrinter::printArg):
+        (JSC::StringFormatPrinter::StringFormatPrinter):
+        (JSC::StringFormatPrinter::printArg):
+        (JSC::StringNFormatPrinter::StringNFormatPrinter):
+        (JSC::StringNFormatPrinter::printArg):
+        (JSC::VMInspector::fprintf):
+        (JSC::VMInspector::printf):
+        (JSC::VMInspector::sprintf):
+        (JSC::VMInspector::snprintf):
+        * interpreter/VMInspector.h:
+        (VMInspector):
+
+2012-10-31  Mark Lam  <mark.lam@apple.com>
+
+        64-bit llint PC offset can be negative: using an unsigned shift is a bug.
+        https://bugs.webkit.org/show_bug.cgi?id=100896.
+
+        Reviewed by Filip Pizlo.
+
+        Fixed the PC offset divisions in the 64-bit llint asm to use rshift instead of urshift.
+
+        * llint/LowLevelInterpreter64.asm:
+
+2012-10-30  Yuqiang Xian  <yuqiang.xian@intel.com>
+
+        glsl-function-atan.html WebGL conformance test fails after https://bugs.webkit.org/show_bug.cgi?id=99154
+        https://bugs.webkit.org/show_bug.cgi?id=100789
+
+        Reviewed by Filip Pizlo.
+
+        We accidently missed a bitwise double to int64 conversion.
+
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::silentFill):
+
+2012-10-30  Joseph Pecoraro  <pecoraro@apple.com>
+
+        [Mac] Sync up FeatureDefine Configuration Files
+        https://bugs.webkit.org/show_bug.cgi?id=100171
+
+        Reviewed by David Kilzer.
+
+        Follow up to better coordinate with iOS feature defines. Make:
+
+          - ENABLE_FILTERS always on
+          - ENABLE_INPUT_* iphonesimulator values point to the iphoneos values
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2012-10-30  Joseph Pecoraro  <pecoraro@apple.com>
+
+        [Mac] Sync up FeatureDefine Configuration Files
+        https://bugs.webkit.org/show_bug.cgi?id=100171
+
+        Reviewed by David Kilzer.
+
+        Ensure an identical FeatureDefine files across all projects. Changes:
+
+          - ENABLE_CSS_BOX_DECORATION_BREAK should be in all
+          - ENABLE_PDFKIT_PLUGIN should be in all
+          - ENABLE_RESOLUTION_MEDIA_QUERY should be in all
+          - ENABLE_ENCRYPTED_MEDIA should be in all
+          - ENABLE_HIDDEN_PAGE_DOM_TIMER_THROTTLING with corrected value
+          - Some alphabetical ordering cleanup
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2012-10-30  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Arrays can change IndexingType in the middle of sorting
+        https://bugs.webkit.org/show_bug.cgi?id=100773
+
+        Reviewed by Filip Pizlo.
+
+        Instead of giving up, we just fetch the appropriate vector based on the current 
+        IndexingType of the array.
+
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::sortVector):
+        * runtime/JSObject.h:
+        (JSObject):
+        (JSC::JSObject::currentIndexingData):
+        (JSC::JSObject::currentRelevantLength):
+
+2012-10-29  Anders Carlsson  <andersca@apple.com>
+
+        Build WebKit as C++11 on Mac
+        https://bugs.webkit.org/show_bug.cgi?id=100720
+
+        Reviewed by Daniel Bates.
+
+        * Configurations/Base.xcconfig:
+        Add CLANG_CXX_LANGUAGE_STANDARD=gnu++0x.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::generate):
+        (JSC::BytecodeGenerator::pushFinallyContext):
+        (JSC::BytecodeGenerator::beginSwitch):
+        * llint/LLIntOffsetsExtractor.cpp:
+        * runtime/Identifier.cpp:
+        (JSC::Identifier::add8):
+        * runtime/Identifier.h:
+        (JSC::Identifier::add):
+        * runtime/JSONObject.cpp:
+        (JSC::appendStringToStringBuilder):
+        * runtime/StringPrototype.cpp:
+        (JSC::replaceUsingStringSearch):
+        Add static_casts to prevent implicit type conversions in non-constant initializer lists.
+
+2012-10-28  Mark Rowe  <mrowe@apple.com>
+
+        Simplify Xcode configuration settings that used to vary between OS versions.
+
+        Reviewed by Dan Bernstein.
+
+        * Configurations/Base.xcconfig:
+        * Configurations/DebugRelease.xcconfig:
+        * Configurations/JavaScriptCore.xcconfig:
+
+2012-10-28  Mark Rowe  <mrowe@apple.com>
+
+        Remove references to unsupported OS and Xcode versions.
+
+        Reviewed by Anders Carlsson.
+
+        * Configurations/Base.xcconfig:
+        * Configurations/CompilerVersion.xcconfig: Removed.
+        * Configurations/DebugRelease.xcconfig:
+        * Configurations/Version.xcconfig:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2012-10-29  Michael Saboff  <msaboff@apple.com>
+
+        Non-special escape character sequences cause JSC::Lexer::parseString to create 16 bit strings
+        https://bugs.webkit.org/show_bug.cgi?id=100576
+
+        Reviewed by Darin Adler.
+
+        Changed singleEscape() processing to be based on a lookup of a static table.  The table
+        covers ASCII characters SPACE through DEL.  If a character can be a single character escape,
+        then the table provides the non-zero result of that escape.  Updated the result of
+        singleEscape to be an LChar to make the table as small as possible.
+        Added a new test fast/js/normal-character-escapes-in-string-literals.html to validated
+        the behavior.
+
+        * parser/Lexer.cpp:
+        (JSC::singleEscape):
+        (JSC::Lexer::parseString):
+        (JSC::Lexer::parseStringSlowCase):
+
+2012-10-29  Enrica Casucci  <enrica@apple.com>
+
+        Add ENABLE_USERSELECT_ALL feature flag.
+        https://bugs.webkit.org/show_bug.cgi?id=100559
+
+        Reviewed by Eric Seidel.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2012-10-28  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG should be able to emit effectful structure checks
+        https://bugs.webkit.org/show_bug.cgi?id=99260
+
+        Reviewed by Oliver Hunt.
+
+        This change allows us to find out if an array access that has gone polymorphic
+        is operating over known structures - i.e. the primordial array structures of the
+        global object that the code block containing the array access belongs to. We
+        term this state "OriginalArray" for short. The fact that the access has gone
+        polymorphic means that the array profile will not be able to report the set of
+        structures it had seen - but if it can tell us that all of the structures were
+        primordial then it just so happens that we can deduce what the structure set
+        would have been by just querying the code block's global object. This allows us
+        to emit an ArrayifyToStructure instead of an Arrayify if we find that we need to
+        do conversions. The fast path of an ArrayifyToStructure is exactly like the fast
+        path of a CheckStructure and is mostly subject to the same optimizations. It
+        also burns one fewer registers.
+        
+        Essentially the notion of OriginalArray is a super cheap way of getting the
+        array profile to tell us a structure set instead of a singleton structure.
+        Currently, the array profile can only tell us the structure seen at an array
+        access if there was exactly one structure. If there were multiple structures, it
+        won't tell us anything other than the array modes and other auxiliary profiling
+        data (whether there were stores to holes, for example). With OriginalArray, we
+        cheaply get a structure set if all of the structures were primordial for the
+        code block's global object, since in that case the array mode set (ArrayModes)
+        can directly tell us the structure set. In the future, we might consider adding
+        complete structure sets to the array profiles, but I suspect that we would hit
+        diminishing returns if we did so - it would only help if we have array accesses
+        that are both polymorphic and are cross-global-object accesses (rare) or if the
+        arrays had named properties or other structure transitions that are unrelated to
+        indexing type (also rare).
+        
+        This also does away with Arrayify (and the new ArrayifyToStructure) returning
+        the butterfly pointer. This turns out to be faster and easier to CSE.
+        
+        And, this also changes constant folding to be able to eliminate CheckStructure,
+        ForwardCheckStructure, and ArrayifyToStructure in addition to being able to
+        transform them into structure transition watchpoints. This is great for
+        ArrayifyToStructure because then CSE and CFA know that there is no side effect.
+        Converting CheckStructure and ForwardCheckStructure to also behave this way is
+        just a matter of elegance.
+        
+        This has no performance impact right now. It's intended to alleviate some of the
+        regressions seen in the early implementation of
+        https://bugs.webkit.org/show_bug.cgi?id=98606.
+
+        * bytecode/ArrayProfile.cpp:
+        (JSC::ArrayProfile::computeUpdatedPrediction):
+        * bytecode/ArrayProfile.h:
+        (JSC):
+        (JSC::ArrayProfile::ArrayProfile):
+        (ArrayProfile):
+        (JSC::ArrayProfile::usesOriginalArrayStructures):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::updateAllPredictionsAndCountLiveness):
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::execute):
+        * dfg/DFGArrayMode.cpp:
+        (JSC::DFG::ArrayMode::fromObserved):
+        (JSC::DFG::ArrayMode::alreadyChecked):
+        (JSC::DFG::arrayClassToString):
+        * dfg/DFGArrayMode.h:
+        (JSC::DFG::ArrayMode::withProfile):
+        (JSC::DFG::ArrayMode::isJSArray):
+        (ArrayMode):
+        (JSC::DFG::ArrayMode::isJSArrayWithOriginalStructure):
+        (JSC::DFG::ArrayMode::supportsLength):
+        (JSC::DFG::ArrayMode::arrayModesWithIndexingShape):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::getArrayMode):
+        (JSC::DFG::ByteCodeParser::getArrayModeAndEmitChecks):
+        (JSC::DFG::ByteCodeParser::handleGetByOffset):
+        * dfg/DFGCSEPhase.cpp:
+        (JSC::DFG::CSEPhase::checkStructureElimination):
+        (JSC::DFG::CSEPhase::structureTransitionWatchpointElimination):
+        (JSC::DFG::CSEPhase::getPropertyStorageLoadElimination):
+        (JSC::DFG::CSEPhase::checkArrayElimination):
+        (JSC::DFG::CSEPhase::getScopeRegistersLoadElimination):
+        * dfg/DFGConstantFoldingPhase.cpp:
+        (JSC::DFG::ConstantFoldingPhase::foldConstants):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        (JSC::DFG::FixupPhase::checkArray):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::hasStructure):
+        (JSC::DFG::Node::hasArrayMode):
+        (JSC::DFG::Node::arrayMode):
+        * dfg/DFGNodeType.h:
+        (DFG):
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::jumpSlowForUnwantedArrayMode):
+        (JSC::DFG::SpeculativeJIT::arrayify):
+        * dfg/DFGSpeculativeJIT.h:
+        (SpeculativeJIT):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::isOriginalArrayStructure):
+        * runtime/Structure.cpp:
+        (JSC::Structure::nonPropertyTransition):
+
+2012-10-28  Filip Pizlo  <fpizlo@apple.com>
+
+        There should not be blind spots in array length array profiling
+        https://bugs.webkit.org/show_bug.cgi?id=100620
+
+        Reviewed by Oliver Hunt.
+
+        I don't think this has any performance impact. But it's good to not have random
+        programs occasionally emit a GetById for array length accesses.
+
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::compileGetByIdHotPath):
+        (JSC::JIT::privateCompilePatchGetArrayLength):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::compileGetByIdHotPath):
+        (JSC::JIT::privateCompilePatchGetArrayLength):
+
+2012-10-28  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, make always-true enum-to-int comparisons use casts.
+
+        * dfg/DFGFPRInfo.h:
+        (JSC::DFG::FPRInfo::debugName):
+        * dfg/DFGGPRInfo.h:
+        (JSC::DFG::JSValueSource::tagGPR):
+        (JSC::DFG::GPRInfo::toIndex):
+        (JSC::DFG::GPRInfo::debugName):
+        * runtime/JSTypeInfo.h:
+        (JSC::TypeInfo::TypeInfo):
+
+2012-10-27  Filip Pizlo  <fpizlo@apple.com>
+
+        OSR exit compilation should defend against argument recoveries from code blocks that are no longer on the inline stack
+        https://bugs.webkit.org/show_bug.cgi?id=100601
+
+        Reviewed by Oliver Hunt.
+
+        This happened to me while I was fixing bugs for https://bugs.webkit.org/show_bug.cgi?id=100599.
+        I'm not sure how to reproduce this.
+
+        * dfg/DFGAssemblyHelpers.h:
+        (JSC::DFG::AssemblyHelpers::baselineCodeBlockFor):
+        (AssemblyHelpers):
+        * dfg/DFGOSRExitCompiler32_64.cpp:
+        (JSC::DFG::OSRExitCompiler::compileExit):
+        * dfg/DFGOSRExitCompiler64.cpp:
+        (JSC::DFG::OSRExitCompiler::compileExit):
+
+2012-10-27  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG::Array::Mode needs to be cleaned up
+        https://bugs.webkit.org/show_bug.cgi?id=100599
+
+        Reviewed by Oliver Hunt.
+
+        Turn the previous massive Array::Mode enum into a class that contains four
+        fields, the type, whether it's a JSArray, the level of speculation, and the
+        kind of conversion to perform.
+        
+        No performance or behavioral change.
+
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::execute):
+        * dfg/DFGArgumentsSimplificationPhase.cpp:
+        (JSC::DFG::ArgumentsSimplificationPhase::run):
+        * dfg/DFGArrayMode.cpp:
+        (JSC::DFG::ArrayMode::fromObserved):
+        (JSC::DFG::ArrayMode::refine):
+        (JSC::DFG::ArrayMode::alreadyChecked):
+        (JSC::DFG::arrayTypeToString):
+        (JSC::DFG::arrayClassToString):
+        (DFG):
+        (JSC::DFG::arraySpeculationToString):
+        (JSC::DFG::arrayConversionToString):
+        (JSC::DFG::ArrayMode::toString):
+        * dfg/DFGArrayMode.h:
+        (DFG):
+        (ArrayMode):
+        (JSC::DFG::ArrayMode::ArrayMode):
+        (JSC::DFG::ArrayMode::type):
+        (JSC::DFG::ArrayMode::arrayClass):
+        (JSC::DFG::ArrayMode::speculation):
+        (JSC::DFG::ArrayMode::conversion):
+        (JSC::DFG::ArrayMode::asWord):
+        (JSC::DFG::ArrayMode::fromWord):
+        (JSC::DFG::ArrayMode::withSpeculation):
+        (JSC::DFG::ArrayMode::usesButterfly):
+        (JSC::DFG::ArrayMode::isJSArray):
+        (JSC::DFG::ArrayMode::isInBounds):
+        (JSC::DFG::ArrayMode::mayStoreToHole):
+        (JSC::DFG::ArrayMode::isOutOfBounds):
+        (JSC::DFG::ArrayMode::isSlowPut):
+        (JSC::DFG::ArrayMode::canCSEStorage):
+        (JSC::DFG::ArrayMode::lengthNeedsStorage):
+        (JSC::DFG::ArrayMode::modeForPut):
+        (JSC::DFG::ArrayMode::isSpecific):
+        (JSC::DFG::ArrayMode::supportsLength):
+        (JSC::DFG::ArrayMode::benefitsFromStructureCheck):
+        (JSC::DFG::ArrayMode::doesConversion):
+        (JSC::DFG::ArrayMode::arrayModesThatPassFiltering):
+        (JSC::DFG::ArrayMode::operator==):
+        (JSC::DFG::ArrayMode::operator!=):
+        (JSC::DFG::ArrayMode::arrayModesWithIndexingShape):
+        (JSC::DFG::canCSEStorage):
+        (JSC::DFG::lengthNeedsStorage):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::getArrayMode):
+        (JSC::DFG::ByteCodeParser::getArrayModeAndEmitChecks):
+        (JSC::DFG::ByteCodeParser::handleIntrinsic):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGCSEPhase.cpp:
+        (JSC::DFG::CSEPhase::getArrayLengthElimination):
+        (JSC::DFG::CSEPhase::checkArrayElimination):
+        (JSC::DFG::CSEPhase::getIndexedPropertyStorageLoadElimination):
+        (JSC::DFG::CSEPhase::performNodeCSE):
+        * dfg/DFGConstantFoldingPhase.cpp:
+        (JSC::DFG::ConstantFoldingPhase::foldConstants):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        (JSC::DFG::FixupPhase::checkArray):
+        (JSC::DFG::FixupPhase::blessArrayOperation):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::dump):
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::byValIsPure):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::arrayMode):
+        (JSC::DFG::Node::setArrayMode):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::typedArrayDescriptor):
+        (JSC::DFG::SpeculativeJIT::jumpSlowForUnwantedArrayMode):
+        (JSC::DFG::SpeculativeJIT::checkArray):
+        (JSC::DFG::SpeculativeJIT::arrayify):
+        (JSC::DFG::SpeculativeJIT::compileGetByValOnString):
+        (JSC::DFG::SpeculativeJIT::compileGetByValOnIntTypedArray):
+        (JSC::DFG::SpeculativeJIT::compileGetByValOnFloatTypedArray):
+        (JSC::DFG::SpeculativeJIT::compilePutByValForFloatTypedArray):
+        (JSC::DFG::SpeculativeJIT::compileGetIndexedPropertyStorage):
+        (JSC::DFG::SpeculativeJIT::compileGetByValOnArguments):
+        (JSC::DFG::SpeculativeJIT::compileGetArgumentsLength):
+        (JSC::DFG::SpeculativeJIT::compileGetArrayLength):
+        (JSC::DFG::SpeculativeJIT::temporaryRegisterForPutByVal):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::putByValWillNeedExtraRegister):
+        (SpeculativeJIT):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2012-10-27  Dan Bernstein  <mitz@apple.com>
+
+        REAL_PLATFORM_NAME build setting is no longer needed
+        https://bugs.webkit.org/show_bug.cgi?id=100587
+
+        Reviewed by Mark Rowe.
+
+        Removed the definition of REAL_PLATFORM_NAME and replaced references to it with references
+        to PLATFORM_NAME.
+
+        * Configurations/Base.xcconfig:
+        * Configurations/CompilerVersion.xcconfig:
+        * Configurations/DebugRelease.xcconfig:
+        * Configurations/FeatureDefines.xcconfig:
+        * Configurations/JSC.xcconfig:
+        * Configurations/JavaScriptCore.xcconfig:
+        * Configurations/ToolExecutable.xcconfig:
+
+2012-10-25  Filip Pizlo  <fpizlo@apple.com>
+
+        Forward OSR calculation is wrong in the presence of multiple SetLocals, or a mix of SetLocals and Phantoms
+        https://bugs.webkit.org/show_bug.cgi?id=100461
+
+        Reviewed by Oliver Hunt and Gavin Barraclough.
+
+        This does a couple of things. First, it removes the part of the change in r131822 that made the forward
+        OSR exit calculator capable of handling multiple SetLocals. That change was wrong, because it would
+        blindly assume that all SetLocals had the same ValueRecovery, and would ignore the possibility that if
+        there is no value recovery then a ForwardCheckStructure on the first SetLocal would not know how to
+        recover the state associated with the second SetLocal. Then, it introduces the invariant that any bytecode
+        op that decomposes into multiple SetLocals must first emit dead SetLocals as hints and then emit a second
+        set of SetLocals to actually do the setting of the locals. This means that if a ForwardCheckStructure (or
+        any other hoisted forward speculation) is inserted, it will always be inserted on the second set of
+        SetLocals (since hoisting only touches the live ones), at which point OSR will already know about the
+        mov hints implied by the first set of (dead) SetLocals. This gives us the behavior we wanted, namely, that
+        a ForwardCheckStructure applied to a variant set by a resolve_with_base-like operation can correctly do a
+        forward exit while also ensuring that prior to exiting we set the appropriate locals.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGOSRExit.cpp:
+        (JSC::DFG::OSRExit::OSRExit):
+        * dfg/DFGOSRExit.h:
+        (OSRExit):
+        * dfg/DFGOSRExitCompiler.cpp:
+        * dfg/DFGOSRExitCompiler32_64.cpp:
+        (JSC::DFG::OSRExitCompiler::compileExit):
+        * dfg/DFGOSRExitCompiler64.cpp:
+        (JSC::DFG::OSRExitCompiler::compileExit):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::convertLastOSRExitToForward):
+
+2012-10-26  Simon Hausmann  <simon.hausmann@digia.com>
 
         [Qt] Fix the LLInt build on Windows
         https://bugs.webkit.org/show_bug.cgi?id=97648
 
-        Reviewed by NOBODY (OOPS!).
+        Reviewed by Tor Arne Vestbø.
 
         The main change for the port on Windows is changing the way offsets are extracted
         and the LLIntAssembly.h is generated to accomodate release and debug configurations.
@@ -38,21 +1203,45 @@
         In Target.pri we have to also make sure that those directories are in the include
         path according to the release or debug configuration.
 
-        Lastly a small tweak in the LLIntOffsetsExtractor build was needed to make sure that
-        we include JavaScriptCore/config.h instead of WTF/config.h, required to fix the build
-        issues originally pasted in bug #97648.
+        Lastly a small tweak - swapping WTF.pri and JSC.pri inclusions - in the
+        LLIntOffsetsExtractor build was needed to make sure that we include
+        JavaScriptCore/config.h instead of WTF/config.h, required to fix the
+        build issues originally pasted in bug #97648.
 
         * DerivedSources.pri:
         * JavaScriptCore.pro:
         * LLIntOffsetsExtractor.pro:
         * Target.pri:
 
-2012-10-25  Simon Hausmann  <simon.hausmann@digia.com>
+2012-10-26  Gabor Ballabas  <gaborb@inf.u-szeged.hu>
+
+        [Qt] Enable JSC's disassembler on x86, x86_64 Linux
+        https://bugs.webkit.org/show_bug.cgi?id=100386
+
+        Reviewed by Simon Hausmann.
+
+        It works fine on Linux x86, x86_64 just needs to be enabled in the
+        QtWebKit build system.
+
+        * DerivedSources.pri:
+        * JavaScriptCore.pri:
+        * Target.pri:
+
+2012-10-26  Thiago Marcos P. Santos  <thiago.santos@intel.com>
+
+        Add feature flags for CSS Device Adaptation
+        https://bugs.webkit.org/show_bug.cgi?id=95960
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2012-10-26  Simon Hausmann  <simon.hausmann@digia.com>
 
         [WIN] Make LLInt offsets extractor work on Windows
         https://bugs.webkit.org/show_bug.cgi?id=100369
 
-        Reviewed by NOBODY (OOPS!).
+        Reviewed by Kenneth Rohde Christiansen.
 
         Open the input file explicitly in binary mode to prevent ruby/Windows from thinking that
         it's a text mode file that needs even new line conversions. The binary mode parameter is
@@ -60,6 +1249,194 @@
 
         * offlineasm/offsets.rb:
 
+2012-10-25  Michael Saboff  <msaboff@apple.com>
+
+        SymbolTableIndexHashTraits::needsDestruction should be set to true
+        https://bugs.webkit.org/show_bug.cgi?id=100437
+
+        Reviewed by Mark Hahnenberg.
+
+        For correctness, set SymbolTableIndexHashTraits::needsDestruction to true since SymbolTableEntry's do
+        need to have their destructor called due to the possibility of rare data.
+
+        * runtime/SymbolTable.h:
+        (SymbolTableIndexHashTraits):
+
+2012-10-25  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG Arrayify elimination should replace it with GetButterfly rather than Phantom
+        https://bugs.webkit.org/show_bug.cgi?id=100441
+
+        Reviewed by Oliver Hunt and Gavin Barraclough.
+
+        Made array profiler's to-string helper behave correctly.
+        
+        Made Arrayify elimination do the right thing (convert to GetButterfly).
+        
+        Made CFA's interference analysis track clobbered array modes correctly, mostly by
+        simplifying the machinery.
+
+        * bytecode/ArrayProfile.cpp:
+        (JSC::arrayModesToString):
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::execute):
+        * dfg/DFGAbstractValue.h:
+        (JSC::DFG::AbstractValue::clobberArrayModes):
+        (AbstractValue):
+        * dfg/DFGConstantFoldingPhase.cpp:
+        (JSC::DFG::ConstantFoldingPhase::foldConstants):
+
+2012-10-25  Filip Pizlo  <fpizlo@apple.com>
+
+        REGRESSION (r131793-r131826): Crash going to wikifonia.org
+        https://bugs.webkit.org/show_bug.cgi?id=100281
+
+        Reviewed by Oliver Hunt.
+
+        Restore something that got lost in the resolve refactoring: the ability to give up on life if
+        we see a resolve of 'arguments'.
+
+        * runtime/JSScope.cpp:
+        (JSC::JSScope::resolveContainingScopeInternal):
+
+2012-10-25  Dominik Röttsches  <dominik.rottsches@intel.com>
+
+        Conditionalize XHR timeout support
+        https://bugs.webkit.org/show_bug.cgi?id=100356
+
+        Reviewed by Adam Barth.
+
+        Adding XHR_TIMEOUT feature to conditionalize this on ports without network backend support.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2012-10-25  Michael Saboff  <msaboff@apple.com>
+
+        REGRESSION (r131836): failures in list styles tests on EFL, GTK
+        https://bugs.webkit.org/show_bug.cgi?id=99824
+
+        Reviewed by Oliver Hunt.
+
+        Saved start of string since it is modified by call convertUTF8ToUTF16().
+
+        * API/JSStringRef.cpp:
+        (JSStringCreateWithUTF8CString):
+
+2012-10-24  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG NewArrayBuffer node should keep its data in a structure on the side to free up one of the opInfos
+        https://bugs.webkit.org/show_bug.cgi?id=100328
+
+        Reviewed by Oliver Hunt.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGGraph.h:
+        (Graph):
+        * dfg/DFGNode.h:
+        (NewArrayBufferData):
+        (DFG):
+        (JSC::DFG::Node::newArrayBufferData):
+        (Node):
+        (JSC::DFG::Node::startConstant):
+        (JSC::DFG::Node::numConstants):
+
+2012-10-25  Mark Lam  <mark.lam@apple.com>
+
+        Update the C++ llint to work with the latest op_resolve... changes.
+        https://bugs.webkit.org/show_bug.cgi?id=100345.
+
+        Reviewed by Oliver Hunt.
+
+        * llint/LowLevelInterpreter.cpp:
+        (JSC::CLoop::execute):
+        - emit opcode name as label when not using COMPUTED_GOTOs. The new op_resolve
+          opcodes have jumps to these labels.
+        - declare all opcode labels as UNUSED_LABEL()s to keep the compiler happy
+          for opcodes that are not referenced by anyone.
+        * offlineasm/asm.rb:
+        - strip llint_ prefix from opcode names used as labels.
+
+2012-10-24  Yuqiang Xian  <yuqiang.xian@intel.com>
+
+        Refactor LLInt64 to distinguish the pointer operations from the 64-bit integer operations
+        https://bugs.webkit.org/show_bug.cgi?id=100321
+
+        Reviewed by Filip Pizlo.
+
+        We have refactored the MacroAssembler and JIT compilers to distinguish
+        the pointer operations from the 64-bit integer operations (see bug #99154).
+        Now we want to do the similar work for LLInt, and the goal is same as
+        the one mentioned in 99154.
+
+        This is the first part of the modification: in the offline assembler,
+        adding the support of the "<foo>q" instructions which will be used for
+        64-bit integer operations.
+
+        * llint/LowLevelInterpreter.cpp:
+        (JSC::CLoop::execute):
+        * offlineasm/cloop.rb:
+        * offlineasm/instructions.rb:
+        * offlineasm/x86.rb:
+
+2012-10-24  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG compileBlahBlahByVal methods for Contiguous and ArrayStorage have only one caller and should be removed
+        https://bugs.webkit.org/show_bug.cgi?id=100311
+
+        Reviewed by Mark Hahnenberg.
+
+        Just trying to simplify things before I make them more complicated again.
+
+        * dfg/DFGSpeculativeJIT.h:
+        (SpeculativeJIT):
+        (JSC::DFG::SpeculativeJIT::temporaryRegisterForPutByVal):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (DFG):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (DFG):
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2012-10-23  Andreas Kling  <kling@webkit.org>
+
+        CodeBlock: Give m_putToBaseOperations an inline capacity.
+        <http://webkit.org/b/100190>
+        <rdar://problem/12562466>
+
+        Reviewed by Oliver Hunt.
+
+        Since the CodeBlock constructor always inserts a single PutToBaseOperation, but there's no
+        guarantee that more will follow, give the m_putToBaseOperations vector an inline capacity of 1.
+        There are 4009 of these Vectors on Membuster3, and only 126 of them have more than a single entry.
+
+        This change yields a 1.90MB reduction in memory usage.
+
+        * bytecode/CodeBlock.h:
+        (CodeBlock):
+
+2012-10-23  Christophe Dumez  <christophe.dumez@intel.com>
+
+        Regression(r132143): Assertion hit in JSC::Interpreter::StackPolicy::StackPolicy(JSC::Interpreter&, const WTF::StackBounds&)
+        https://bugs.webkit.org/show_bug.cgi?id=100109
+
+        Reviewed by Oliver Hunt.
+
+        Fix possible integer overflow in StackPolicy constructor by
+        using size_t type instead of int for stack sizes. The value
+        returned by StackBounds::size() is of type size_t but was
+        assigned to an int, which may overflow.
+
+        * interpreter/Interpreter.cpp:
+        (JSC):
+        (JSC::Interpreter::StackPolicy::StackPolicy):
+
+2012-10-23  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        Unreviewed. Fix make distcheck.
+
+        * GNUmakefile.list.am: Add missing header file.
+
 2012-10-23  Mark Lam  <mark.lam@apple.com>
 
         Make topCallFrame reliable.
@@ -729,7 +2106,7 @@
         (JSC::JIT::emit_op_next_pname):
         (JSC::JIT::compileOpStrictEq):
         (JSC::JIT::emit_op_catch):
-        (JSC::JIT::emit_op_throw_reference_error):
+        (JSC::JIT::emit_op_throw_static_error):
         (JSC::JIT::emit_op_eq_null):
         (JSC::JIT::emit_op_neq_null):
         (JSC::JIT::emit_op_create_activation):
diff --git a/Source/JavaScriptCore/Configurations/Base.xcconfig b/Source/JavaScriptCore/Configurations/Base.xcconfig
index 47c8f7382..2de8597d7 100644
--- a/Source/JavaScriptCore/Configurations/Base.xcconfig
+++ b/Source/JavaScriptCore/Configurations/Base.xcconfig
@@ -21,11 +21,8 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 
-#include "CompilerVersion.xcconfig"
-
-COMPILER_SPECIFIC_WARNING_CFLAGS = $(COMPILER_SPECIFIC_WARNING_CFLAGS_$(TARGET_GCC_VERSION));
-COMPILER_SPECIFIC_WARNING_CFLAGS_LLVM_COMPILER = -Wexit-time-destructors -Wglobal-constructors -Wtautological-compare;
-
+CLANG_CXX_LANGUAGE_STANDARD = gnu++0x;
+CLANG_CXX_LIBRARY = libc++;
 CLANG_WARN_CXX0X_EXTENSIONS = NO;
 DEBUG_INFORMATION_FORMAT = dwarf-with-dsym;
 GCC_C_LANGUAGE_STANDARD = gnu99;
@@ -34,7 +31,7 @@ GCC_DYNAMIC_NO_PIC = NO;
 GCC_ENABLE_CPP_EXCEPTIONS = NO;
 GCC_ENABLE_CPP_RTTI = NO;
 GCC_ENABLE_OBJC_EXCEPTIONS = YES;
-GCC_ENABLE_OBJC_GC = $(GCC_ENABLE_OBJC_GC_$(REAL_PLATFORM_NAME));
+GCC_ENABLE_OBJC_GC = $(GCC_ENABLE_OBJC_GC_$(PLATFORM_NAME));
 GCC_ENABLE_OBJC_GC_iphoneos = NO;
 GCC_ENABLE_OBJC_GC_iphonesimulator = NO;
 GCC_ENABLE_OBJC_GC_macosx = supported;
@@ -42,7 +39,7 @@ GCC_ENABLE_SYMBOL_SEPARATION = NO;
 GCC_FAST_OBJC_DISPATCH = YES;
 GCC_GENERATE_DEBUGGING_SYMBOLS = YES;
 GCC_INLINES_ARE_PRIVATE_EXTERN = YES;
-GCC_MODEL_TUNING = $(GCC_MODEL_TUNING_$(REAL_PLATFORM_NAME));
+GCC_MODEL_TUNING = $(GCC_MODEL_TUNING_$(PLATFORM_NAME));
 GCC_MODEL_TUNING_macosx = G5;
 GCC_OBJC_CALL_CXX_CDTORS = YES;
 GCC_PRECOMPILE_PREFIX_HEADER = YES;
@@ -50,6 +47,7 @@ GCC_PREPROCESSOR_DEFINITIONS = $(DEBUG_DEFINES) HAVE_DTRACE=$(HAVE_DTRACE) WEBKI
 GCC_STRICT_ALIASING = YES;
 GCC_THREADSAFE_STATICS = NO;
 GCC_TREAT_WARNINGS_AS_ERRORS = YES;
+GCC_VERSION = com.apple.compilers.llvm.clang.1_0;
 GCC_WARN_ABOUT_DEPRECATED_FUNCTIONS = NO;
 GCC_WARN_ABOUT_MISSING_NEWLINE = YES;
 GCC_WARN_ABOUT_MISSING_PROTOTYPES = YES;
@@ -57,12 +55,12 @@ GCC_WARN_NON_VIRTUAL_DESTRUCTOR = YES;
 GCC_WARN_SIGN_COMPARE = YES;
 LINKER_DISPLAYS_MANGLED_NAMES = YES;
 PREBINDING = NO;
-VALID_ARCHS = $(VALID_ARCHS_$(REAL_PLATFORM_NAME));
+VALID_ARCHS = $(VALID_ARCHS_$(PLATFORM_NAME));
 VALID_ARCHS_iphoneos = $(ARCHS_STANDARD_32_BIT);
 VALID_ARCHS_iphonesimulator = $(ARCHS_STANDARD_32_BIT);
 VALID_ARCHS_macosx = i386 ppc x86_64 ppc64 $(ARCHS_UNIVERSAL_IPHONE_OS);
-WARNING_CFLAGS_BASE = -Wall -Wextra -Wcast-qual -Wchar-subscripts -Wextra-tokens -Wformat=2 -Winit-self -Wmissing-format-attribute -Wmissing-noreturn -Wpacked -Wpointer-arith -Wredundant-decls -Wundef -Wwrite-strings;
-WARNING_CFLAGS = $(WARNING_CFLAGS_$(REAL_PLATFORM_NAME)) $(COMPILER_SPECIFIC_WARNING_CFLAGS);
+WARNING_CFLAGS_BASE = -Wall -Wextra -Wcast-qual -Wchar-subscripts -Wextra-tokens -Wformat=2 -Winit-self -Wmissing-format-attribute -Wmissing-noreturn -Wpacked -Wpointer-arith -Wredundant-decls -Wundef -Wwrite-strings -Wexit-time-destructors -Wglobal-constructors -Wtautological-compare;
+WARNING_CFLAGS = $(WARNING_CFLAGS_$(PLATFORM_NAME));
 WARNING_CFLAGS_iphoneos = $(WARNING_CFLAGS_BASE) -Wshorten-64-to-32;
 WARNING_CFLAGS_iphonesimulator = $(WARNING_CFLAGS_BASE) -Wshorten-64-to-32;
 WARNING_CFLAGS_macosx = $(WARNING_CFLAGS_macosx_$(CURRENT_ARCH));
@@ -70,22 +68,9 @@ WARNING_CFLAGS_macosx_ = $(WARNING_CFLAGS_BASE) -Wshorten-64-to-32;
 WARNING_CFLAGS_macosx_i386 = $(WARNING_CFLAGS_BASE) -Wshorten-64-to-32;
 WARNING_CFLAGS_macosx_ppc = $(WARNING_CFLAGS_BASE) -Wshorten-64-to-32;
 // FIXME: JavaScriptCore 64-bit builds should build with -Wshorten-64-to-32
-WARNING_CFLAGS_macosx_ppc64 = $(WARNING_CFLAGS_BASE);
 WARNING_CFLAGS_macosx_x86_64 = $(WARNING_CFLAGS_BASE);
 HEADER_SEARCH_PATHS = . icu "${BUILT_PRODUCTS_DIR}/usr/local/include" $(HEADER_SEARCH_PATHS);
 
-CLANG_CXX_LIBRARY = $(CLANG_CXX_LIBRARY_$(TARGET_MAC_OS_X_VERSION_MAJOR));
-CLANG_CXX_LIBRARY_1060 = libstdc++;
-CLANG_CXX_LIBRARY_1070 = libc++;
-CLANG_CXX_LIBRARY_1080 = libc++;
-CLANG_CXX_LIBRARY_1090 = libc++;
-
-REAL_PLATFORM_NAME = $(REAL_PLATFORM_NAME_$(PLATFORM_NAME));
-REAL_PLATFORM_NAME_ = $(REAL_PLATFORM_NAME_macosx);
-REAL_PLATFORM_NAME_iphoneos = iphoneos;
-REAL_PLATFORM_NAME_iphonesimulator = iphonesimulator;
-REAL_PLATFORM_NAME_macosx = macosx;
-
 TARGET_MAC_OS_X_VERSION_MAJOR = $(MAC_OS_X_VERSION_MAJOR);
 
 FRAMEWORK_SEARCH_PATHS = $(STAGED_FRAMEWORKS_SEARCH_PATH);
@@ -93,12 +78,12 @@ FRAMEWORK_SEARCH_PATHS = $(STAGED_FRAMEWORKS_SEARCH_PATH);
 STAGED_FRAMEWORKS_SEARCH_PATH = $(STAGED_FRAMEWORKS_SEARCH_PATH_$(USE_STAGING_INSTALL_PATH));
 STAGED_FRAMEWORKS_SEARCH_PATH_YES = $(NEXT_ROOT)$(SYSTEM_LIBRARY_DIR)/StagedFrameworks/Safari;
 
-NORMAL_JAVASCRIPTCORE_FRAMEWORKS_DIR = $(NORMAL_JAVASCRIPTCORE_FRAMEWORKS_DIR_$(REAL_PLATFORM_NAME));
+NORMAL_JAVASCRIPTCORE_FRAMEWORKS_DIR = $(NORMAL_JAVASCRIPTCORE_FRAMEWORKS_DIR_$(PLATFORM_NAME));
 NORMAL_JAVASCRIPTCORE_FRAMEWORKS_DIR_iphoneos = $(SYSTEM_LIBRARY_DIR)/PrivateFrameworks;
 NORMAL_JAVASCRIPTCORE_FRAMEWORKS_DIR_iphonesimulator = $(NORMAL_JAVASCRIPTCORE_FRAMEWORKS_DIR_iphoneos);
 NORMAL_JAVASCRIPTCORE_FRAMEWORKS_DIR_macosx = $(SYSTEM_LIBRARY_DIR)/Frameworks;
 
-JAVASCRIPTCORE_FRAMEWORKS_DIR = $(JAVASCRIPTCORE_FRAMEWORKS_DIR_$(REAL_PLATFORM_NAME));
+JAVASCRIPTCORE_FRAMEWORKS_DIR = $(JAVASCRIPTCORE_FRAMEWORKS_DIR_$(PLATFORM_NAME));
 JAVASCRIPTCORE_FRAMEWORKS_DIR_iphoneos = $(NORMAL_JAVASCRIPTCORE_FRAMEWORKS_DIR_iphoneos);
 JAVASCRIPTCORE_FRAMEWORKS_DIR_iphonesimulator = $(JAVASCRIPTCORE_FRAMEWORKS_DIR_iphoneos);
 
@@ -128,7 +113,6 @@ DEAD_CODE_STRIPPING = $(DEAD_CODE_STRIPPING_$(CURRENT_VARIANT));
 SECTORDER_FLAGS = -Wl,-order_file,JavaScriptCore.order;
 
 TARGETING_SAME_OS_X_VERSION = $(TARGETING_SAME_OS_X_VERSION_$(MAC_OS_X_VERSION_MAJOR)_$(TARGET_MAC_OS_X_VERSION_MAJOR));
-TARGETING_SAME_OS_X_VERSION_1060_1060 = YES;
 TARGETING_SAME_OS_X_VERSION_1070_1070 = YES;
 TARGETING_SAME_OS_X_VERSION_1080_1080 = YES;
 TARGETING_SAME_OS_X_VERSION_1090_1090 = YES;
@@ -137,14 +121,4 @@ TARGETING_SAME_OS_X_VERSION_1090_1090 = YES;
 SDKROOT = $(SDKROOT_TARGETING_SAME_OS_X_VERSION_$(TARGETING_SAME_OS_X_VERSION));
 SDKROOT_TARGETING_SAME_OS_X_VERSION_ = macosx;
 
-
-// HAVE_DTRACE is disabled on Leopard due to <rdar://problem/5628149>
-HAVE_DTRACE = $(HAVE_DTRACE_$(REAL_PLATFORM_NAME));
-HAVE_DTRACE_iphoneos = 1;
-HAVE_DTRACE_iphonesimulator = 1;
-HAVE_DTRACE_macosx = $(HAVE_DTRACE_macosx_$(TARGET_MAC_OS_X_VERSION_MAJOR));
-HAVE_DTRACE_macosx_1050 = 0;
-HAVE_DTRACE_macosx_1060 = 1;
-HAVE_DTRACE_macosx_1070 = 1;
-HAVE_DTRACE_macosx_1080 = 1;
-HAVE_DTRACE_macosx_1090 = 1;
+HAVE_DTRACE = 1;
diff --git a/Source/JavaScriptCore/Configurations/CompilerVersion.xcconfig b/Source/JavaScriptCore/Configurations/CompilerVersion.xcconfig
deleted file mode 100644
index 1d959fe9d..000000000
--- a/Source/JavaScriptCore/Configurations/CompilerVersion.xcconfig
+++ /dev/null
@@ -1,82 +0,0 @@
-// Copyright (C) 2009, 2010, 2011 Apple Inc. All rights reserved.
-//
-// Redistribution and use in source and binary forms, with or without
-// modification, are permitted provided that the following conditions
-// are met:
-// 1. Redistributions of source code must retain the above copyright
-//    notice, this list of conditions and the following disclaimer.
-// 2. Redistributions in binary form must reproduce the above copyright
-//    notice, this list of conditions and the following disclaimer in the
-//    documentation and/or other materials provided with the distribution.
-//
-// THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
-// EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
-// IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
-// PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
-// CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
-// EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
-// PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
-// PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
-// OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
-
-IS_XCODE_0400 = $(IS_XCODE_0400_$(XCODE_VERSION_MINOR));
-IS_XCODE_0400_0400 = YES;
-
-IS_XCODE_0400_OR_0410 = $(IS_XCODE_0400_OR_0410_$(XCODE_VERSION_MINOR));
-IS_XCODE_0400_OR_0410_0400 = YES;
-IS_XCODE_0400_OR_0410_0410 = YES;
-
-// The version of the LLVM Compiler in Xcode 4.0 and earlier have difficulty compiling our code.
-LLVM_COMPILER_UNSUITABLE_FOR_DEBUG_BUILDS = $(LLVM_COMPILER_UNSUITABLE_FOR_DEBUG_BUILDS_$(XCODE_VERSION_MAJOR));
-LLVM_COMPILER_UNSUITABLE_FOR_DEBUG_BUILDS_0300 = YES;
-LLVM_COMPILER_UNSUITABLE_FOR_DEBUG_BUILDS_0400 = $(LLVM_COMPILER_UNSUITABLE_FOR_DEBUG_BUILDS_IS_XCODE_0400_$(IS_XCODE_0400));
-LLVM_COMPILER_UNSUITABLE_FOR_DEBUG_BUILDS_IS_XCODE_0400_YES = YES;
-
-// The version of the LLVM Compiler in Xcode 4.1 and earlier do not generate fast enough code.
-LLVM_COMPILER_UNSUITABLE_FOR_OPTIMIZED_BUILDS = $(LLVM_COMPILER_UNSUITABLE_FOR_OPTIMIZED_BUILDS_$(XCODE_VERSION_MAJOR));
-LLVM_COMPILER_UNSUITABLE_FOR_OPTIMIZED_BUILDS_0300 = YES;
-LLVM_COMPILER_UNSUITABLE_FOR_OPTIMIZED_BUILDS_0400 = $(LLVM_COMPILER_UNSUITABLE_FOR_OPTIMIZED_BUILDS_IS_XCODE_0400_OR_0410_$(IS_XCODE_0400_OR_0410));
-LLVM_COMPILER_UNSUITABLE_FOR_OPTIMIZED_BUILDS_IS_XCODE_0400_OR_0410_YES = YES;
-
-LLVM_COMPILER_SUITABLE_FOR_DEBUG_BUILDS = $(LLVM_COMPILER_SUITABLE_FOR_DEBUG_BUILDS_$(LLVM_COMPILER_UNSUITABLE_FOR_DEBUG_BUILDS));
-LLVM_COMPILER_SUITABLE_FOR_DEBUG_BUILDS_ = YES;
-LLVM_COMPILER_SUITABLE_FOR_DEBUG_BUILDS_YES = NO;
-
-LLVM_COMPILER_SUITABLE_FOR_OPTIMIZED_BUILDS = $(LLVM_COMPILER_SUITABLE_FOR_OPTIMIZED_BUILDS_$(LLVM_COMPILER_UNSUITABLE_FOR_OPTIMIZED_BUILDS));
-LLVM_COMPILER_SUITABLE_FOR_OPTIMIZED_BUILDS_ = YES;
-LLVM_COMPILER_SUITABLE_FOR_OPTIMIZED_BUILDS_YES = NO;
-
-
-// Use GCC 4.2 with Xcode 3.1, which includes GCC 4.2 but defaults to GCC 4.0.
-// Note that Xcode versions as new as 3.1.2 use XCODE_VERSION_ACTUAL for the minor version
-// number.  Newer versions of Xcode use XCODE_VERSION_MINOR for the minor version, and
-// XCODE_VERSION_ACTUAL for the full version number.
-TARGET_GCC_VERSION = $(TARGET_GCC_VERSION_$(REAL_PLATFORM_NAME));
-TARGET_GCC_VERSION_iphoneos = LLVM_COMPILER;
-TARGET_GCC_VERSION_iphonesimulator = $(TARGET_GCC_VERSION_iphoneos);
-TARGET_GCC_VERSION_macosx = $(TARGET_GCC_VERSION_macosx_$(TARGET_MAC_OS_X_VERSION_MAJOR));
-
-TARGET_GCC_VERSION_macosx_1050 = $(TARGET_GCC_VERSION_macosx_1050_$(XCODE_VERSION_MINOR));
-TARGET_GCC_VERSION_macosx_1050_ = $(TARGET_GCC_VERSION_macosx_1050_$(XCODE_VERSION_ACTUAL));
-TARGET_GCC_VERSION_macosx_1050_0310 = GCC_42;
-TARGET_GCC_VERSION_macosx_1050_0320 = GCC_42;
-
-TARGET_GCC_VERSION_macosx_1060 = $(TARGET_GCC_VERSION_macosx_1060_AND_1070_$(CONFIGURATION));
-TARGET_GCC_VERSION_macosx_1070 = $(TARGET_GCC_VERSION_macosx_1060_AND_1070_$(CONFIGURATION));
-TARGET_GCC_VERSION_macosx_1060_AND_1070_Debug = $(TARGET_GCC_VERSION_macosx_USE_LLVM_COMPILER_$(LLVM_COMPILER_SUITABLE_FOR_DEBUG_BUILDS));
-TARGET_GCC_VERSION_macosx_1060_AND_1070_Release = $(TARGET_GCC_VERSION_macosx_USE_LLVM_COMPILER_$(LLVM_COMPILER_SUITABLE_FOR_OPTIMIZED_BUILDS));
-TARGET_GCC_VERSION_macosx_1060_AND_1070_Production = $(TARGET_GCC_VERSION_macosx_USE_LLVM_COMPILER_$(LLVM_COMPILER_SUITABLE_FOR_OPTIMIZED_BUILDS));
-
-TARGET_GCC_VERSION_macosx_USE_LLVM_COMPILER_YES = LLVM_COMPILER;
-TARGET_GCC_VERSION_macosx_USE_LLVM_COMPILER_NO = GCC_42;
-
-TARGET_GCC_VERSION_macosx_1080 = LLVM_COMPILER;
-TARGET_GCC_VERSION_macosx_1090 = LLVM_COMPILER;
-
-GCC_VERSION = $(GCC_VERSION_$(TARGET_GCC_VERSION));
-GCC_VERSION_GCC_40 = 4.0;
-GCC_VERSION_GCC_42 = 4.2;
-GCC_VERSION_LLVM_GCC_42 = com.apple.compilers.llvmgcc42;
-GCC_VERSION_LLVM_COMPILER = com.apple.compilers.llvm.clang.1_0;
diff --git a/Source/JavaScriptCore/Configurations/DebugRelease.xcconfig b/Source/JavaScriptCore/Configurations/DebugRelease.xcconfig
index 5fb574367..bf2c8d19a 100644
--- a/Source/JavaScriptCore/Configurations/DebugRelease.xcconfig
+++ b/Source/JavaScriptCore/Configurations/DebugRelease.xcconfig
@@ -23,24 +23,17 @@
 
 #include "Base.xcconfig"
 
-ARCHS = $(ARCHS_$(REAL_PLATFORM_NAME));
+ARCHS = $(ARCHS_$(PLATFORM_NAME));
 ARCHS_iphoneos = $(ARCHS_UNIVERSAL_IPHONE_OS);
 ARCHS_iphonesimulator = $(NATIVE_ARCH);
-ARCHS_macosx = $(ARCHS_macosx_$(TARGET_MAC_OS_X_VERSION_MAJOR));
-ARCHS_macosx_1050 = $(NATIVE_ARCH);
-ARCHS_macosx_1060 = $(ARCHS_STANDARD_32_64_BIT);
-ARCHS_macosx_1070 = $(ARCHS_STANDARD_32_64_BIT);
-ARCHS_macosx_1080 = $(ARCHS_STANDARD_32_64_BIT);
-ARCHS_macosx_1090 = $(ARCHS_STANDARD_32_64_BIT);
+ARCHS_macosx = $(ARCHS_STANDARD_32_64_BIT);
 
 ONLY_ACTIVE_ARCH = YES;
 
-MACOSX_DEPLOYMENT_TARGET = $(MACOSX_DEPLOYMENT_TARGET_$(REAL_PLATFORM_NAME));
+MACOSX_DEPLOYMENT_TARGET = $(MACOSX_DEPLOYMENT_TARGET_$(PLATFORM_NAME));
 MACOSX_DEPLOYMENT_TARGET_iphoneos = 10.5;
 MACOSX_DEPLOYMENT_TARGET_iphonesimulator = 10.5;
 MACOSX_DEPLOYMENT_TARGET_macosx = $(MACOSX_DEPLOYMENT_TARGET_macosx_$(TARGET_MAC_OS_X_VERSION_MAJOR));
-MACOSX_DEPLOYMENT_TARGET_macosx_1050 = 10.5;
-MACOSX_DEPLOYMENT_TARGET_macosx_1060 = 10.6;
 MACOSX_DEPLOYMENT_TARGET_macosx_1070 = 10.7;
 MACOSX_DEPLOYMENT_TARGET_macosx_1080 = 10.8;
 MACOSX_DEPLOYMENT_TARGET_macosx_1090 = 10.9;
diff --git a/Source/JavaScriptCore/Configurations/FeatureDefines.xcconfig b/Source/JavaScriptCore/Configurations/FeatureDefines.xcconfig
index 79a458eca..a4f8ca0c0 100644
--- a/Source/JavaScriptCore/Configurations/FeatureDefines.xcconfig
+++ b/Source/JavaScriptCore/Configurations/FeatureDefines.xcconfig
@@ -37,6 +37,9 @@ ENABLE_ANIMATION_API = ;
 ENABLE_BLOB = ENABLE_BLOB;
 ENABLE_CHANNEL_MESSAGING = ENABLE_CHANNEL_MESSAGING;
 ENABLE_CSP_NEXT = ;
+ENABLE_CSS_BOX_DECORATION_BREAK = ENABLE_CSS_BOX_DECORATION_BREAK;
+ENABLE_CSS_COMPOSITING = ENABLE_CSS_COMPOSITING;
+ENABLE_CSS_DEVICE_ADAPTATION = ;
 ENABLE_CSS_EXCLUSIONS = ENABLE_CSS_EXCLUSIONS;
 ENABLE_CSS_FILTERS = ENABLE_CSS_FILTERS;
 ENABLE_CSS_HIERARCHIES = ;
@@ -44,13 +47,12 @@ ENABLE_CSS_IMAGE_ORIENTATION = ;
 ENABLE_CSS_IMAGE_RESOLUTION = ;
 ENABLE_CSS_REGIONS = ENABLE_CSS_REGIONS;
 ENABLE_CSS_SHADERS = ENABLE_CSS_SHADERS;
-ENABLE_CSS_COMPOSITING = ENABLE_CSS_COMPOSITING;
 ENABLE_CSS_STICKY_POSITION = ENABLE_CSS_STICKY_POSITION;
 ENABLE_CSS_VARIABLES = ;
 ENABLE_CSS3_CONDITIONAL_RULES = ;
 ENABLE_CSS3_TEXT = ;
 ENABLE_CUSTOM_SCHEME_HANDLER = ;
-ENABLE_DASHBOARD_SUPPORT = $(ENABLE_DASHBOARD_SUPPORT_$(REAL_PLATFORM_NAME));
+ENABLE_DASHBOARD_SUPPORT = $(ENABLE_DASHBOARD_SUPPORT_$(PLATFORM_NAME));
 ENABLE_DASHBOARD_SUPPORT_macosx = ENABLE_DASHBOARD_SUPPORT;
 ENABLE_DATALIST_ELEMENT = ;
 ENABLE_DATA_TRANSFER_ITEMS = ;
@@ -59,47 +61,46 @@ ENABLE_DEVICE_ORIENTATION = ;
 ENABLE_DIALOG_ELEMENT = ;
 ENABLE_DIRECTORY_UPLOAD = ;
 ENABLE_DRAGGABLE_REGION = ;
-ENABLE_ENCRYPTED_MEDIA = $(ENABLE_ENCRYPTED_MEDIA_$(REAL_PLATFORM_NAME));
+ENABLE_ENCRYPTED_MEDIA = $(ENABLE_ENCRYPTED_MEDIA_$(PLATFORM_NAME));
 ENABLE_ENCRYPTED_MEDIA_macosx = $(ENABLE_ENCRYPTED_MEDIA_macosx_$(TARGET_MAC_OS_X_VERSION_MAJOR));
 ENABLE_ENCRYPTED_MEDIA_macosx_1070 = ;
 ENABLE_ENCRYPTED_MEDIA_macosx_1080 = ;
 ENABLE_ENCRYPTED_MEDIA_macosx_1090 = ENABLE_ENCRYPTED_MEDIA;
 ENABLE_FILE_SYSTEM = ;
-ENABLE_FILTERS = $(ENABLE_FILTERS_$(REAL_PLATFORM_NAME));
-ENABLE_FILTERS_macosx = ENABLE_FILTERS;
+ENABLE_FILTERS = ENABLE_FILTERS;
 ENABLE_FULLSCREEN_API = ENABLE_FULLSCREEN_API;
 ENABLE_GAMEPAD = ;
 ENABLE_GEOLOCATION = ENABLE_GEOLOCATION;
-ENABLE_HIDDEN_PAGE_DOM_TIMER_THROTTLING = $(HIDDEN_PAGE_DOM_TIMER_THROTTLING_$(REAL_PLATFORM_NAME));
-ENABLE_HIDDEN_PAGE_DOM_TIMER_THROTTLING_macosx = HIDDEN_PAGE_DOM_TIMER_THROTTLING;
+ENABLE_HIDDEN_PAGE_DOM_TIMER_THROTTLING = $(ENABLE_HIDDEN_PAGE_DOM_TIMER_THROTTLING_$(PLATFORM_NAME));
+ENABLE_HIDDEN_PAGE_DOM_TIMER_THROTTLING_macosx = ENABLE_HIDDEN_PAGE_DOM_TIMER_THROTTLING;
 ENABLE_HIGH_DPI_CANVAS = ENABLE_HIGH_DPI_CANVAS;
-ENABLE_ICONDATABASE = $(ENABLE_ICONDATABASE_$(REAL_PLATFORM_NAME));
+ENABLE_ICONDATABASE = $(ENABLE_ICONDATABASE_$(PLATFORM_NAME));
 ENABLE_ICONDATABASE_macosx = ENABLE_ICONDATABASE;
 ENABLE_IFRAME_SEAMLESS = ENABLE_IFRAME_SEAMLESS;
 ENABLE_INDEXED_DATABASE = ;
 ENABLE_INPUT_SPEECH = ;
 ENABLE_INPUT_TYPE_COLOR = ;
-ENABLE_INPUT_TYPE_DATE = $(ENABLE_INPUT_TYPE_DATE_$(REAL_PLATFORM_NAME));
+ENABLE_INPUT_TYPE_DATE = $(ENABLE_INPUT_TYPE_DATE_$(PLATFORM_NAME));
 ENABLE_INPUT_TYPE_DATE_iphoneos = ENABLE_INPUT_TYPE_DATE;
-ENABLE_INPUT_TYPE_DATE_iphonesimulator = ENABLE_INPUT_TYPE_DATE;
-ENABLE_INPUT_TYPE_DATETIME = $(ENABLE_INPUT_TYPE_DATETIME_$(REAL_PLATFORM_NAME));
+ENABLE_INPUT_TYPE_DATE_iphonesimulator = $(ENABLE_INPUT_TYPE_DATE_iphoneos);
+ENABLE_INPUT_TYPE_DATETIME = $(ENABLE_INPUT_TYPE_DATETIME_$(PLATFORM_NAME));
 ENABLE_INPUT_TYPE_DATETIME_iphoneos = ENABLE_INPUT_TYPE_DATETIME;
-ENABLE_INPUT_TYPE_DATETIME_iphonesimulator = ENABLE_INPUT_TYPE_DATETIME;
-ENABLE_INPUT_TYPE_DATETIMELOCAL = $(ENABLE_INPUT_TYPE_DATETIMELOCAL_$(REAL_PLATFORM_NAME));
+ENABLE_INPUT_TYPE_DATETIME_iphonesimulator = $(ENABLE_INPUT_TYPE_DATETIME_iphoneos);
+ENABLE_INPUT_TYPE_DATETIMELOCAL = $(ENABLE_INPUT_TYPE_DATETIMELOCAL_$(PLATFORM_NAME));
 ENABLE_INPUT_TYPE_DATETIMELOCAL_iphoneos = ENABLE_INPUT_TYPE_DATETIMELOCAL;
-ENABLE_INPUT_TYPE_DATETIMELOCAL_iphonesimulator = ENABLE_INPUT_TYPE_DATETIMELOCAL;
-ENABLE_INPUT_TYPE_MONTH = $(ENABLE_INPUT_TYPE_MONTH_$(REAL_PLATFORM_NAME));
+ENABLE_INPUT_TYPE_DATETIMELOCAL_iphonesimulator = $(ENABLE_INPUT_TYPE_DATETIMELOCAL_iphoneos);
+ENABLE_INPUT_TYPE_MONTH = $(ENABLE_INPUT_TYPE_MONTH_$(PLATFORM_NAME));
 ENABLE_INPUT_TYPE_MONTH_iphoneos = ENABLE_INPUT_TYPE_MONTH;
-ENABLE_INPUT_TYPE_MONTH_iphonesimulator = ENABLE_INPUT_TYPE_MONTH;
-ENABLE_INPUT_TYPE_TIME = $(ENABLE_INPUT_TYPE_TIME_$(REAL_PLATFORM_NAME));
+ENABLE_INPUT_TYPE_MONTH_iphonesimulator = $(ENABLE_INPUT_TYPE_MONTH_iphoneos);
+ENABLE_INPUT_TYPE_TIME = $(ENABLE_INPUT_TYPE_TIME_$(PLATFORM_NAME));
 ENABLE_INPUT_TYPE_TIME_iphoneos = ENABLE_INPUT_TYPE_TIME;
-ENABLE_INPUT_TYPE_TIME_iphonesimulator = ENABLE_INPUT_TYPE_TIME;
-ENABLE_INPUT_TYPE_WEEK = $(ENABLE_INPUT_TYPE_WEEK_$(REAL_PLATFORM_NAME));
+ENABLE_INPUT_TYPE_TIME_iphonesimulator = $(ENABLE_INPUT_TYPE_TIME_iphoneos);
+ENABLE_INPUT_TYPE_WEEK = $(ENABLE_INPUT_TYPE_WEEK_$(PLATFORM_NAME));
 ENABLE_INPUT_TYPE_WEEK_iphoneos = ENABLE_INPUT_TYPE_WEEK;
-ENABLE_INPUT_TYPE_WEEK_iphonesimulator = ENABLE_INPUT_TYPE_WEEK;
+ENABLE_INPUT_TYPE_WEEK_iphonesimulator = $(ENABLE_INPUT_TYPE_WEEK_iphoneos);
 ENABLE_JAVASCRIPT_DEBUGGER = ENABLE_JAVASCRIPT_DEBUGGER;
 ENABLE_LEGACY_CSS_VENDOR_PREFIXES = ENABLE_LEGACY_CSS_VENDOR_PREFIXES;
-ENABLE_LEGACY_NOTIFICATIONS = $(ENABLE_LEGACY_NOTIFICATIONS_$(REAL_PLATFORM_NAME));
+ENABLE_LEGACY_NOTIFICATIONS = $(ENABLE_LEGACY_NOTIFICATIONS_$(PLATFORM_NAME));
 ENABLE_LEGACY_NOTIFICATIONS_macosx = $(ENABLE_LEGACY_NOTIFICATIONS_macosx_$(TARGET_MAC_OS_X_VERSION_MAJOR));
 ENABLE_LEGACY_NOTIFICATIONS_macosx_1070 = ;
 ENABLE_LEGACY_NOTIFICATIONS_macosx_1080 = ENABLE_LEGACY_NOTIFICATIONS;
@@ -116,36 +117,44 @@ ENABLE_MHTML = ;
 ENABLE_MICRODATA = ;
 ENABLE_MUTATION_OBSERVERS = ENABLE_MUTATION_OBSERVERS;
 ENABLE_NAVIGATOR_CONTENT_UTILS = ;
-ENABLE_NOTIFICATIONS = $(ENABLE_NOTIFICATIONS_$(REAL_PLATFORM_NAME));
+ENABLE_NOTIFICATIONS = $(ENABLE_NOTIFICATIONS_$(PLATFORM_NAME));
 ENABLE_NOTIFICATIONS_macosx = $(ENABLE_NOTIFICATIONS_macosx_$(TARGET_MAC_OS_X_VERSION_MAJOR));
 ENABLE_NOTIFICATIONS_macosx_1070 = ;
 ENABLE_NOTIFICATIONS_macosx_1080 = ENABLE_NOTIFICATIONS;
 ENABLE_NOTIFICATIONS_macosx_1090 = ENABLE_NOTIFICATIONS;
 ENABLE_PAGE_VISIBILITY_API = ;
+ENABLE_PDFKIT_PLUGIN = $(ENABLE_PDFKIT_PLUGIN_$(PLATFORM_NAME));
+ENABLE_PDFKIT_PLUGIN_macosx = $(ENABLE_PDFKIT_PLUGIN_macosx_$(TARGET_MAC_OS_X_VERSION_MAJOR));
+ENABLE_PDFKIT_PLUGIN_macosx_1070 = ;
+ENABLE_PDFKIT_PLUGIN_macosx_1080 = ;
+ENABLE_PDFKIT_PLUGIN_macosx_1090 = ENABLE_PDFKIT_PLUGIN;
 ENABLE_PROGRESS_ELEMENT = ENABLE_PROGRESS_ELEMENT;
 ENABLE_QUOTA = ;
 ENABLE_REQUEST_ANIMATION_FRAME = ENABLE_REQUEST_ANIMATION_FRAME;
+ENABLE_RESOLUTION_MEDIA_QUERY = ;
 ENABLE_SCRIPTED_SPEECH = ;
 ENABLE_SHADOW_DOM = ;
 ENABLE_SHARED_WORKERS = ENABLE_SHARED_WORKERS;
 ENABLE_SQL_DATABASE = ENABLE_SQL_DATABASE;
 ENABLE_STYLE_SCOPED = ;
+ENABLE_SUBPIXEL_LAYOUT = ENABLE_SUBPIXEL_LAYOUT;
 ENABLE_SVG = ENABLE_SVG;
-ENABLE_SVG_DOM_OBJC_BINDINGS = $(ENABLE_SVG_DOM_OBJC_BINDINGS_$(REAL_PLATFORM_NAME));
+ENABLE_SVG_DOM_OBJC_BINDINGS = $(ENABLE_SVG_DOM_OBJC_BINDINGS_$(PLATFORM_NAME));
 ENABLE_SVG_DOM_OBJC_BINDINGS_macosx = ENABLE_SVG_DOM_OBJC_BINDINGS;
 ENABLE_SVG_FONTS = ENABLE_SVG_FONTS;
 ENABLE_TEXT_AUTOSIZING = ;
 ENABLE_TEXT_NOTIFICATIONS_ONLY = ENABLE_TEXT_NOTIFICATIONS_ONLY;
 ENABLE_TOUCH_ICON_LOADING = ;
-ENABLE_UNDO_MANAGER = ;
+ENABLE_USERSELECT_ALL = ENABLE_USERSELECT_ALL;
 ENABLE_VIDEO = ENABLE_VIDEO;
-ENABLE_VIDEO_TRACK = $(ENABLE_VIDEO_TRACK_$(REAL_PLATFORM_NAME));
+ENABLE_VIDEO_TRACK = $(ENABLE_VIDEO_TRACK_$(PLATFORM_NAME));
 ENABLE_VIDEO_TRACK_macosx = ENABLE_VIDEO_TRACK;
 ENABLE_WEBGL = ENABLE_WEBGL;
 ENABLE_WEB_AUDIO = ENABLE_WEB_AUDIO;
 ENABLE_WEB_SOCKETS = ENABLE_WEB_SOCKETS;
 ENABLE_WEB_TIMING = ;
 ENABLE_WORKERS = ENABLE_WORKERS;
+ENABLE_XHR_TIMEOUT = ENABLE_XHR_TIMEOUT;
 ENABLE_XSLT = ENABLE_XSLT;
 
-FEATURE_DEFINES = $(ENABLE_3D_RENDERING) $(ENABLE_ACCELERATED_2D_CANVAS) $(ENABLE_ANIMATION_API) $(ENABLE_BLOB) $(ENABLE_CHANNEL_MESSAGING) $(ENABLE_CSP_NEXT) $(ENABLE_CSS_BOX_DECORATION_BREAK) $(ENABLE_CSS_EXCLUSIONS) $(ENABLE_CSS_FILTERS) $(ENABLE_CSS_HIERARCHIES) $(ENABLE_CSS_IMAGE_ORIENTATION) $(ENABLE_CSS_IMAGE_RESOLUTION) $(ENABLE_CSS_REGIONS) $(ENABLE_CSS_SHADERS) $(ENABLE_CSS_COMPOSITING) $(ENABLE_CSS_STICKY_POSITION) $(ENABLE_CSS_VARIABLES) $(ENABLE_CSS3_CONDITIONAL_RULES) $(ENABLE_CSS3_TEXT) $(ENABLE_CUSTOM_SCHEME_HANDLER) $(ENABLE_DASHBOARD_SUPPORT) $(ENABLE_DATALIST_ELEMENT) $(ENABLE_DATA_TRANSFER_ITEMS) $(ENABLE_DETAILS_ELEMENT) $(ENABLE_DEVICE_ORIENTATION) $(ENABLE_DIALOG_ELEMENT) $(ENABLE_DIRECTORY_UPLOAD) $(ENABLE_DRAGGABLE_REGION) $(ENABLE_ENCRYPTED_MEDIA) $(ENABLE_FILE_SYSTEM) $(ENABLE_FILTERS) $(ENABLE_FULLSCREEN_API) $(ENABLE_GAMEPAD) $(ENABLE_GEOLOCATION) $(ENABLE_HIDDEN_PAGE_DOM_TIMER_THROTTLING) $(ENABLE_HIGH_DPI_CANVAS) $(ENABLE_ICONDATABASE) $(ENABLE_IFRAME_SEAMLESS) $(ENABLE_INDEXED_DATABASE) $(ENABLE_INPUT_SPEECH) $(ENABLE_INPUT_TYPE_COLOR) $(ENABLE_INPUT_TYPE_DATE) $(ENABLE_INPUT_TYPE_DATETIME) $(ENABLE_INPUT_TYPE_DATETIMELOCAL) $(ENABLE_INPUT_TYPE_MONTH) $(ENABLE_INPUT_TYPE_TIME) $(ENABLE_INPUT_TYPE_WEEK) $(ENABLE_JAVASCRIPT_DEBUGGER) $(ENABLE_LEGACY_CSS_VENDOR_PREFIXES) $(ENABLE_LEGACY_NOTIFICATIONS) $(ENABLE_LEGACY_VENDOR_PREFIXES) $(ENABLE_LEGACY_WEB_AUDIO) $(ENABLE_LINK_PREFETCH) $(ENABLE_LINK_PRERENDER) $(ENABLE_MATHML) $(ENABLE_MEDIA_SOURCE) $(ENABLE_MEDIA_STATISTICS) $(ENABLE_METER_ELEMENT) $(ENABLE_MHTML) $(ENABLE_MICRODATA) $(ENABLE_MUTATION_OBSERVERS) $(ENABLE_NAVIGATOR_CONTENT_UTILS) $(ENABLE_NOTIFICATIONS) $(ENABLE_PAGE_VISIBILITY_API) $(ENABLE_PROGRESS_ELEMENT) $(ENABLE_QUOTA) $(ENABLE_REQUEST_ANIMATION_FRAME) $(ENABLE_SCRIPTED_SPEECH) $(ENABLE_SHADOW_DOM) $(ENABLE_SHARED_WORKERS) $(ENABLE_SQL_DATABASE) $(ENABLE_STYLE_SCOPED) $(ENABLE_SVG) $(ENABLE_SVG_DOM_OBJC_BINDINGS) $(ENABLE_SVG_FONTS) $(ENABLE_TEXT_AUTOSIZING) $(ENABLE_TEXT_NOTIFICATIONS_ONLY) $(ENABLE_TOUCH_ICON_LOADING) $(ENABLE_UNDO_MANAGER) $(ENABLE_VIDEO) $(ENABLE_VIDEO_TRACK) $(ENABLE_WEBGL) $(ENABLE_WEB_AUDIO) $(ENABLE_WEB_SOCKETS) $(ENABLE_WEB_TIMING) $(ENABLE_WORKERS) $(ENABLE_XSLT);
+FEATURE_DEFINES = $(ENABLE_3D_RENDERING) $(ENABLE_ACCELERATED_2D_CANVAS) $(ENABLE_ANIMATION_API) $(ENABLE_BLOB) $(ENABLE_CHANNEL_MESSAGING) $(ENABLE_CSP_NEXT) $(ENABLE_CSS_BOX_DECORATION_BREAK) $(ENABLE_CSS_DEVICE_ADAPTATION) $(ENABLE_CSS_EXCLUSIONS) $(ENABLE_CSS_FILTERS) $(ENABLE_CSS_HIERARCHIES) $(ENABLE_CSS_IMAGE_ORIENTATION) $(ENABLE_CSS_IMAGE_RESOLUTION) $(ENABLE_CSS_REGIONS) $(ENABLE_CSS_SHADERS) $(ENABLE_CSS_COMPOSITING) $(ENABLE_CSS_STICKY_POSITION) $(ENABLE_CSS_VARIABLES) $(ENABLE_CSS3_CONDITIONAL_RULES) $(ENABLE_CSS3_TEXT) $(ENABLE_CUSTOM_SCHEME_HANDLER) $(ENABLE_DASHBOARD_SUPPORT) $(ENABLE_DATALIST_ELEMENT) $(ENABLE_DATA_TRANSFER_ITEMS) $(ENABLE_DETAILS_ELEMENT) $(ENABLE_DEVICE_ORIENTATION) $(ENABLE_DIALOG_ELEMENT) $(ENABLE_DIRECTORY_UPLOAD) $(ENABLE_DRAGGABLE_REGION) $(ENABLE_ENCRYPTED_MEDIA) $(ENABLE_FILE_SYSTEM) $(ENABLE_FILTERS) $(ENABLE_FULLSCREEN_API) $(ENABLE_GAMEPAD) $(ENABLE_GEOLOCATION) $(ENABLE_HIDDEN_PAGE_DOM_TIMER_THROTTLING) $(ENABLE_HIGH_DPI_CANVAS) $(ENABLE_ICONDATABASE) $(ENABLE_IFRAME_SEAMLESS) $(ENABLE_INDEXED_DATABASE) $(ENABLE_INPUT_SPEECH) $(ENABLE_INPUT_TYPE_COLOR) $(ENABLE_INPUT_TYPE_DATE) $(ENABLE_INPUT_TYPE_DATETIME) $(ENABLE_INPUT_TYPE_DATETIMELOCAL) $(ENABLE_INPUT_TYPE_MONTH) $(ENABLE_INPUT_TYPE_TIME) $(ENABLE_INPUT_TYPE_WEEK) $(ENABLE_JAVASCRIPT_DEBUGGER) $(ENABLE_LEGACY_CSS_VENDOR_PREFIXES) $(ENABLE_LEGACY_NOTIFICATIONS) $(ENABLE_LEGACY_VENDOR_PREFIXES) $(ENABLE_LEGACY_WEB_AUDIO) $(ENABLE_LINK_PREFETCH) $(ENABLE_LINK_PRERENDER) $(ENABLE_MATHML) $(ENABLE_MEDIA_SOURCE) $(ENABLE_MEDIA_STATISTICS) $(ENABLE_METER_ELEMENT) $(ENABLE_MHTML) $(ENABLE_MICRODATA) $(ENABLE_MUTATION_OBSERVERS) $(ENABLE_NAVIGATOR_CONTENT_UTILS) $(ENABLE_NOTIFICATIONS) $(ENABLE_PAGE_VISIBILITY_API) $(ENABLE_PDFKIT_PLUGIN) $(ENABLE_PROGRESS_ELEMENT) $(ENABLE_QUOTA) $(ENABLE_REQUEST_ANIMATION_FRAME) $(ENABLE_RESOLUTION_MEDIA_QUERY) $(ENABLE_SCRIPTED_SPEECH) $(ENABLE_SHADOW_DOM) $(ENABLE_SHARED_WORKERS) $(ENABLE_SQL_DATABASE) $(ENABLE_STYLE_SCOPED) $(ENABLE_SUBPIXEL_LAYOUT) $(ENABLE_SVG) $(ENABLE_SVG_DOM_OBJC_BINDINGS) $(ENABLE_SVG_FONTS) $(ENABLE_TEXT_AUTOSIZING) $(ENABLE_TEXT_NOTIFICATIONS_ONLY) $(ENABLE_TOUCH_ICON_LOADING) $(ENABLE_USERSELECT_ALL) $(ENABLE_VIDEO) $(ENABLE_VIDEO_TRACK) $(ENABLE_WEBGL) $(ENABLE_WEB_AUDIO) $(ENABLE_WEB_SOCKETS) $(ENABLE_WEB_TIMING) $(ENABLE_WORKERS) $(ENABLE_XHR_TIMEOUT) $(ENABLE_XSLT);
diff --git a/Source/JavaScriptCore/Configurations/JSC.xcconfig b/Source/JavaScriptCore/Configurations/JSC.xcconfig
index 8330d3f27..d596596e8 100644
--- a/Source/JavaScriptCore/Configurations/JSC.xcconfig
+++ b/Source/JavaScriptCore/Configurations/JSC.xcconfig
@@ -23,5 +23,5 @@
 
 INSTALL_PATH = $(JAVASCRIPTCORE_FRAMEWORKS_DIR)/JavaScriptCore.framework/Versions/A/Resources
 PRODUCT_NAME = jsc;
-CODE_SIGN_ENTITLEMENTS = $(CODE_SIGN_ENTITLEMENTS_$(REAL_PLATFORM_NAME));
+CODE_SIGN_ENTITLEMENTS = $(CODE_SIGN_ENTITLEMENTS_$(PLATFORM_NAME));
 CODE_SIGN_ENTITLEMENTS_iphoneos = entitlements.plist;
diff --git a/Source/JavaScriptCore/Configurations/JavaScriptCore.xcconfig b/Source/JavaScriptCore/Configurations/JavaScriptCore.xcconfig
index 28ce60770..d5101d3b0 100644
--- a/Source/JavaScriptCore/Configurations/JavaScriptCore.xcconfig
+++ b/Source/JavaScriptCore/Configurations/JavaScriptCore.xcconfig
@@ -30,19 +30,15 @@ JSVALUE_MODEL_armv6 = 32_64;
 JSVALUE_MODEL_armv7 = 32_64;
 JSVALUE_MODEL_i386 = 32_64;
 JSVALUE_MODEL_ppc = 32_64;
-JSVALUE_MODEL_ppc64 = 64;
 JSVALUE_MODEL_x86_64 = 64;
 
 // Prevent C++ standard library operator new, delete and their related exception types from being exported as weak symbols.
 OTHER_LDFLAGS_HIDE_SYMBOLS = -Wl,-unexported_symbol -Wl,__ZTISt9bad_alloc -Wl,-unexported_symbol -Wl,__ZTISt9exception -Wl,-unexported_symbol -Wl,__ZTSSt9bad_alloc -Wl,-unexported_symbol -Wl,__ZTSSt9exception -Wl,-unexported_symbol -Wl,__ZdlPvS_ -Wl,-unexported_symbol -Wl,__ZnwmPv -Wl,-all_load;
 OTHER_LDFLAGS_BASE = -lobjc -Wl,-Y,3 $(OTHER_LDFLAGS_HIDE_SYMBOLS);
-OTHER_LDFLAGS = $(OTHER_LDFLAGS_$(REAL_PLATFORM_NAME));
+OTHER_LDFLAGS = $(OTHER_LDFLAGS_$(PLATFORM_NAME));
 OTHER_LDFLAGS_iphoneos = $(OTHER_LDFLAGS_BASE);
 OTHER_LDFLAGS_iphonesimulator = $(OTHER_LDFLAGS_iphoneos);
-OTHER_LDFLAGS_macosx = $(OTHER_LDFLAGS_BASE) -sub_library libobjc -framework CoreServices $(OTHER_LDFLAGS_macosx_$(TARGET_MAC_OS_X_VERSION_MAJOR));
-OTHER_LDFLAGS_macosx_1070 = -Xlinker -objc_gc_compaction;
-OTHER_LDFLAGS_macosx_1080 = $(OTHER_LDFLAGS_macosx_1070);
-OTHER_LDFLAGS_macosx_1090 = $(OTHER_LDFLAGS_macosx_1070);
+OTHER_LDFLAGS_macosx = $(OTHER_LDFLAGS_BASE) -sub_library libobjc -framework CoreServices;
 GCC_PREFIX_HEADER = JavaScriptCorePrefix.h;
 GCC_SYMBOLS_PRIVATE_EXTERN = YES;
 HEADER_SEARCH_PATHS = "${BUILT_PRODUCTS_DIR}/DerivedSources/JavaScriptCore" $(HEADER_SEARCH_PATHS);
diff --git a/Source/JavaScriptCore/Configurations/ToolExecutable.xcconfig b/Source/JavaScriptCore/Configurations/ToolExecutable.xcconfig
index 65f9ad5ac..bd733d4a2 100644
--- a/Source/JavaScriptCore/Configurations/ToolExecutable.xcconfig
+++ b/Source/JavaScriptCore/Configurations/ToolExecutable.xcconfig
@@ -21,7 +21,7 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 
-INSTALL_PATH = $(INSTALL_PATH_$(REAL_PLATFORM_NAME));
+INSTALL_PATH = $(INSTALL_PATH_$(PLATFORM_NAME));
 INSTALL_PATH_iphoneos = $(JAVASCRIPTCORE_FRAMEWORKS_DIR)/JavaScriptCore.framework/Resources;
 INSTALL_PATH_iphonesimulator = $(INSTALL_PATH_iphoneos);
 INSTALL_PATH_macosx = $(JAVASCRIPTCORE_FRAMEWORKS_DIR)/JavaScriptCore.framework/Versions/A/Resources;
diff --git a/Source/JavaScriptCore/Configurations/Version.xcconfig b/Source/JavaScriptCore/Configurations/Version.xcconfig
index f0f18d9e1..3d24fe85a 100644
--- a/Source/JavaScriptCore/Configurations/Version.xcconfig
+++ b/Source/JavaScriptCore/Configurations/Version.xcconfig
@@ -22,7 +22,7 @@
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 
 MAJOR_VERSION = 537;
-MINOR_VERSION = 16;
+MINOR_VERSION = 18;
 TINY_VERSION = 0;
 FULL_VERSION = $(MAJOR_VERSION).$(MINOR_VERSION);
 
@@ -32,8 +32,6 @@ SHORT_VERSION_STRING = $(SHORT_VERSION_STRING_$(CONFIGURATION))
 
 // The system version prefix is based on the current system version.
 SYSTEM_VERSION_PREFIX = $(SYSTEM_VERSION_PREFIX_$(TARGET_MAC_OS_X_VERSION_MAJOR));
-SYSTEM_VERSION_PREFIX_1050 = 5;
-SYSTEM_VERSION_PREFIX_1060 = 6;
 SYSTEM_VERSION_PREFIX_1070 = 7;
 SYSTEM_VERSION_PREFIX_1080 = 8;
 SYSTEM_VERSION_PREFIX_1090 = 9;
diff --git a/Source/JavaScriptCore/DerivedSources.pri b/Source/JavaScriptCore/DerivedSources.pri
index cf44aefe1..03a935575 100644
--- a/Source/JavaScriptCore/DerivedSources.pri
+++ b/Source/JavaScriptCore/DerivedSources.pri
@@ -40,6 +40,13 @@ LLINT_DEPENDENCY = \
     $$PWD/llint/LowLevelInterpreter64.asm \
     $$LLINT_ASSEMBLER
 
+DISASSEMBLER_FILES = \
+    disassembler/udis86/optable.xml
+
+DISASSEMBLER_DEPENDENCY = \
+    $$PWD/disassembler/udis86/ud_opcode.py \
+    $$PWD/disassembler/udis86/ud_optable.py
+
 # GENERATOR 1-A: LUT creator
 lut.output = ${QMAKE_FILE_BASE}.lut.h
 lut.input = LUT_FILES
@@ -88,7 +95,7 @@ klgen.input = KEYWORDLUT_FILES
 klgen.commands = python $$klgen.script ${QMAKE_FILE_NAME} > ${QMAKE_FILE_OUT}
 GENERATORS += klgen
 
-EXTRACTOR_BINARY = LLIntOffsetsExtractor$$EXEEXT
+EXTRACTOR_BINARY = LLIntOffsetsExtractor$$BIN_EXTENSION
 DIRS = $$OUT_PWD $$OUT_PWD/debug $$OUT_PWD/release
 for(dir, DIRS) {
     file = $$dir/$$EXTRACTOR_BINARY
@@ -104,3 +111,14 @@ if(linux-*|win32):!equals(QT_ARCH, "arm") {
     llint.commands = ruby $$llint.script $$LLINT_ASSEMBLER ${QMAKE_FILE_IN} ${QMAKE_FILE_OUT}
     GENERATORS += llint
 }
+
+linux-*:if(isEqual(QT_ARCH, "i386")|isEqual(QT_ARCH, "x86_64")) {
+    # GENERATOR: disassembler
+    disassembler.output = udis86_itab.c
+    disassembler.input = DISASSEMBLER_FILES
+    disassembler.script = $$PWD/disassembler/udis86/itab.py
+    disassembler.depends = $$DISASSEMBLER_DEPENDENCY
+    disassembler.commands = python $$disassembler.script ${QMAKE_FILE_NAME} --outputDir ${QMAKE_FUNC_FILE_OUT_PATH}
+    disassembler.CONFIG += no_link
+    GENERATORS += disassembler
+}
diff --git a/Source/JavaScriptCore/GNUmakefile.list.am b/Source/JavaScriptCore/GNUmakefile.list.am
index 243894d39..d68a22b9f 100644
--- a/Source/JavaScriptCore/GNUmakefile.list.am
+++ b/Source/JavaScriptCore/GNUmakefile.list.am
@@ -114,10 +114,6 @@ javascriptcore_sources += \
 	Source/JavaScriptCore/bytecode/LazyOperandValueProfile.cpp \
 	Source/JavaScriptCore/bytecode/LazyOperandValueProfile.h \
 	Source/JavaScriptCore/bytecode/LineInfo.h \
-	Source/JavaScriptCore/bytecode/MethodCallLinkInfo.cpp \
-	Source/JavaScriptCore/bytecode/MethodCallLinkInfo.h \
-	Source/JavaScriptCore/bytecode/MethodCallLinkStatus.cpp \
-	Source/JavaScriptCore/bytecode/MethodCallLinkStatus.h \
 	Source/JavaScriptCore/bytecode/MethodOfGettingAValueProfile.cpp \
 	Source/JavaScriptCore/bytecode/MethodOfGettingAValueProfile.h \
 	Source/JavaScriptCore/bytecode/Opcode.cpp \
@@ -142,6 +138,8 @@ javascriptcore_sources += \
 	Source/JavaScriptCore/bytecode/StructureStubInfo.h \
 	Source/JavaScriptCore/bytecode/StructureStubClearingWatchpoint.cpp \
 	Source/JavaScriptCore/bytecode/StructureStubClearingWatchpoint.h \
+	Source/JavaScriptCore/bytecode/UnlinkedCodeBlock.cpp \
+	Source/JavaScriptCore/bytecode/UnlinkedCodeBlock.h \
 	Source/JavaScriptCore/bytecode/ValueProfile.h \
 	Source/JavaScriptCore/bytecode/ValueRecovery.h \
 	Source/JavaScriptCore/bytecode/VirtualRegister.h \
@@ -377,6 +375,7 @@ javascriptcore_sources += \
 	Source/JavaScriptCore/interpreter/Interpreter.h \
 	Source/JavaScriptCore/interpreter/JSStack.cpp \
 	Source/JavaScriptCore/interpreter/JSStack.h \
+	Source/JavaScriptCore/interpreter/JSStackInlines.h \
 	Source/JavaScriptCore/interpreter/Register.h \
 	Source/JavaScriptCore/interpreter/VMInspector.cpp \
 	Source/JavaScriptCore/interpreter/VMInspector.h \
@@ -447,6 +446,7 @@ javascriptcore_sources += \
 	Source/JavaScriptCore/parser/ParserTokens.h \
 	Source/JavaScriptCore/parser/Parser.cpp \
 	Source/JavaScriptCore/parser/Parser.h \
+	Source/JavaScriptCore/parser/ParserModes.h \
 	Source/JavaScriptCore/parser/ResultType.h \
 	Source/JavaScriptCore/parser/SourceCode.h \
 	Source/JavaScriptCore/parser/SourceProvider.h \
@@ -487,6 +487,8 @@ javascriptcore_sources += \
 	Source/JavaScriptCore/runtime/CallData.cpp \
 	Source/JavaScriptCore/runtime/CallData.h \
 	Source/JavaScriptCore/runtime/ClassInfo.h \
+	Source/JavaScriptCore/runtime/CodeCache.cpp \
+	Source/JavaScriptCore/runtime/CodeCache.h \
 	Source/JavaScriptCore/runtime/CodeSpecializationKind.h \
 	Source/JavaScriptCore/runtime/CommonIdentifiers.cpp \
 	Source/JavaScriptCore/runtime/CommonIdentifiers.h \
diff --git a/Source/JavaScriptCore/JavaScriptCore.pri b/Source/JavaScriptCore/JavaScriptCore.pri
index fad36c974..d465bcfea 100644
--- a/Source/JavaScriptCore/JavaScriptCore.pri
+++ b/Source/JavaScriptCore/JavaScriptCore.pri
@@ -38,3 +38,7 @@ wince* {
     INCLUDEPATH += $$QT.core.sources/../3rdparty/ce-compat
     INCLUDEPATH += $$SOURCE_DIR/os-win32
 }
+
+linux-*:if(isEqual(QT_ARCH, "i386")|isEqual(QT_ARCH, "x86_64")) {
+    INCLUDEPATH += $$SOURCE_DIR/disassembler/udis86
+}
diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj
index a21dcf1e8..b1567e2cd 100644
--- a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj
@@ -638,6 +638,14 @@
 				>

 			</File>

 			<File

+				RelativePath="..\..\runtime\CodeCache.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\CodeCache.h"

+				>

+			</File>

+			<File

 				RelativePath="..\..\runtime\CommonIdentifiers.cpp"

 				>

 			</File>

@@ -1678,22 +1686,6 @@
 				>

 			</File>

 			<File

-				RelativePath="..\..\bytecode\MethodCallLinkInfo.cpp"

-				>

-			</File>

-			<File

-				RelativePath="..\..\bytecode\MethodCallLinkInfo.h"

-				>

-			</File>

-			<File

-				RelativePath="..\..\bytecode\MethodCallLinkStatus.cpp"

-				>

-			</File>

-			<File

-				RelativePath="..\..\bytecode\MethodCallLinkStatus.h"

-				>

-			</File>

-			<File

 				RelativePath="..\..\bytecode\MethodOfGettingAValueProfile.cpp"

 				>

 			</File>

@@ -1762,6 +1754,14 @@
 				>

 			</File>

 			<File

+				RelativePath="..\..\bytecode\UnlinkedCodeBlock.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\bytecode\UnlinkedCodeBlock.h"

+				>

+			</File>

+			<File

 				RelativePath="..\..\bytecode\ValueProfile.h"

 				>

 			</File>

@@ -2246,6 +2246,10 @@
 				>

 			</File>

 			<File

+				RelativePath="..\..\parser\ParserModes.h"

+				>

+			</File>

+			<File

 				RelativePath="..\..\parser\ParserArena.cpp"

 				>

 			</File>

diff --git a/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj b/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj
index 1cf109a0b..3cada1cd7 100644
--- a/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj
+++ b/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj
@@ -69,8 +69,6 @@
 		0F0B83AD14BCF60400885B4F /* LineInfo.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F0B83AC14BCF60200885B4F /* LineInfo.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		0F0B83B014BCF71600885B4F /* CallLinkInfo.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F0B83AE14BCF71400885B4F /* CallLinkInfo.cpp */; };
 		0F0B83B114BCF71800885B4F /* CallLinkInfo.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F0B83AF14BCF71400885B4F /* CallLinkInfo.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		0F0B83B414BCF86000885B4F /* MethodCallLinkInfo.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F0B83B214BCF85E00885B4F /* MethodCallLinkInfo.cpp */; };
-		0F0B83B514BCF86200885B4F /* MethodCallLinkInfo.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F0B83B314BCF85E00885B4F /* MethodCallLinkInfo.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		0F0B83B914BCF95F00885B4F /* CallReturnOffsetToBytecodeOffset.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F0B83B814BCF95B00885B4F /* CallReturnOffsetToBytecodeOffset.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		0F0CD4C215F1A6070032F1C0 /* PutDirectIndexMode.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F0CD4C015F1A6040032F1C0 /* PutDirectIndexMode.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		0F0CD4C415F6B6BB0032F1C0 /* SparseArrayValueMap.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F0CD4C315F6B6B50032F1C0 /* SparseArrayValueMap.cpp */; };
@@ -178,8 +176,6 @@
 		0F93329E14CA7DC50085F3C6 /* CallLinkStatus.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F93329414CA7DC10085F3C6 /* CallLinkStatus.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		0F93329F14CA7DCA0085F3C6 /* GetByIdStatus.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F93329514CA7DC10085F3C6 /* GetByIdStatus.cpp */; };
 		0F9332A014CA7DCD0085F3C6 /* GetByIdStatus.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F93329614CA7DC10085F3C6 /* GetByIdStatus.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		0F9332A114CA7DD10085F3C6 /* MethodCallLinkStatus.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F93329714CA7DC10085F3C6 /* MethodCallLinkStatus.cpp */; };
-		0F9332A214CA7DD30085F3C6 /* MethodCallLinkStatus.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F93329814CA7DC10085F3C6 /* MethodCallLinkStatus.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		0F9332A314CA7DD70085F3C6 /* PutByIdStatus.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F93329914CA7DC10085F3C6 /* PutByIdStatus.cpp */; };
 		0F9332A414CA7DD90085F3C6 /* PutByIdStatus.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F93329A14CA7DC10085F3C6 /* PutByIdStatus.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		0F9332A514CA7DDD0085F3C6 /* StructureSet.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F93329B14CA7DC10085F3C6 /* StructureSet.h */; settings = {ATTRIBUTES = (Private, ); }; };
@@ -584,12 +580,17 @@
 		A75706DE118A2BCF0057F88F /* JITArithmetic32_64.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A75706DD118A2BCF0057F88F /* JITArithmetic32_64.cpp */; };
 		A766B44F0EE8DCD1009518CA /* ExecutableAllocator.h in Headers */ = {isa = PBXBuildFile; fileRef = A7B48DB50EE74CFC00DCBDB6 /* ExecutableAllocator.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		A76C51761182748D00715B05 /* JSInterfaceJIT.h in Headers */ = {isa = PBXBuildFile; fileRef = A76C51741182748D00715B05 /* JSInterfaceJIT.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		A76F279415F13C9600517D67 /* UnlinkedCodeBlock.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A79E781E15EECBA80047C855 /* UnlinkedCodeBlock.cpp */; };
 		A76F54A313B28AAB00EF2BCE /* JITWriteBarrier.h in Headers */ = {isa = PBXBuildFile; fileRef = A76F54A213B28AAB00EF2BCE /* JITWriteBarrier.h */; };
+		A77F1821164088B200640A47 /* CodeCache.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A77F181F164088B200640A47 /* CodeCache.cpp */; };
+		A77F1822164088B200640A47 /* CodeCache.h in Headers */ = {isa = PBXBuildFile; fileRef = A77F1820164088B200640A47 /* CodeCache.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		A77F1825164192C700640A47 /* ParserModes.h in Headers */ = {isa = PBXBuildFile; fileRef = A77F18241641925400640A47 /* ParserModes.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		A784A26111D16622005776AC /* ASTBuilder.h in Headers */ = {isa = PBXBuildFile; fileRef = A7A7EE7411B98B8D0065A14F /* ASTBuilder.h */; };
 		A784A26411D16622005776AC /* SyntaxChecker.h in Headers */ = {isa = PBXBuildFile; fileRef = A7A7EE7711B98B8D0065A14F /* SyntaxChecker.h */; };
 		A7AFC17915F7EFE30048F57B /* ResolveOperation.h in Headers */ = {isa = PBXBuildFile; fileRef = A7AFC17715F7EFE30048F57B /* ResolveOperation.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		A7B48F490EE8936F00DCBDB6 /* ExecutableAllocator.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A7B48DB60EE74CFC00DCBDB6 /* ExecutableAllocator.cpp */; };
 		A7B4ACAF1484C9CE00B38A36 /* JSExportMacros.h in Headers */ = {isa = PBXBuildFile; fileRef = A7B4ACAE1484C9CE00B38A36 /* JSExportMacros.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		A7B601821639FD2A00372BA3 /* UnlinkedCodeBlock.h in Headers */ = {isa = PBXBuildFile; fileRef = A79E781F15EECBA80047C855 /* UnlinkedCodeBlock.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		A7C1E8E4112E72EF00A37F98 /* JITPropertyAccess32_64.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A7C1E8C8112E701C00A37F98 /* JITPropertyAccess32_64.cpp */; };
 		A7DCB97312E5193F00911940 /* WriteBarrier.h in Headers */ = {isa = PBXBuildFile; fileRef = A7DCB77912E3D90500911940 /* WriteBarrier.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		A7E2EA6B0FB460CF00601F06 /* LiteralParser.h in Headers */ = {isa = PBXBuildFile; fileRef = A7E2EA690FB460CF00601F06 /* LiteralParser.h */; };
@@ -746,7 +747,7 @@
 		FE20CE9D15F04A9500DF3430 /* LLIntCLoop.cpp in Sources */ = {isa = PBXBuildFile; fileRef = FE20CE9B15F04A9500DF3430 /* LLIntCLoop.cpp */; };
 		FE20CE9E15F04A9500DF3430 /* LLIntCLoop.h in Headers */ = {isa = PBXBuildFile; fileRef = FE20CE9C15F04A9500DF3430 /* LLIntCLoop.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		FE4A331F15BD2E07006F54F3 /* VMInspector.cpp in Sources */ = {isa = PBXBuildFile; fileRef = FE4A331D15BD2E07006F54F3 /* VMInspector.cpp */; };
-		FE4A332015BD2E07006F54F3 /* VMInspector.h in Headers */ = {isa = PBXBuildFile; fileRef = FE4A331E15BD2E07006F54F3 /* VMInspector.h */; };
+		FE4A332015BD2E07006F54F3 /* VMInspector.h in Headers */ = {isa = PBXBuildFile; fileRef = FE4A331E15BD2E07006F54F3 /* VMInspector.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		FED287B215EC9A5700DA8161 /* LLIntOpcode.h in Headers */ = {isa = PBXBuildFile; fileRef = FED287B115EC9A5700DA8161 /* LLIntOpcode.h */; settings = {ATTRIBUTES = (Private, ); }; };
 /* End PBXBuildFile section */
 
@@ -853,8 +854,6 @@
 		0F0B83AC14BCF60200885B4F /* LineInfo.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = LineInfo.h; sourceTree = "<group>"; };
 		0F0B83AE14BCF71400885B4F /* CallLinkInfo.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = CallLinkInfo.cpp; sourceTree = "<group>"; };
 		0F0B83AF14BCF71400885B4F /* CallLinkInfo.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CallLinkInfo.h; sourceTree = "<group>"; };
-		0F0B83B214BCF85E00885B4F /* MethodCallLinkInfo.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = MethodCallLinkInfo.cpp; sourceTree = "<group>"; };
-		0F0B83B314BCF85E00885B4F /* MethodCallLinkInfo.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = MethodCallLinkInfo.h; sourceTree = "<group>"; };
 		0F0B83B814BCF95B00885B4F /* CallReturnOffsetToBytecodeOffset.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CallReturnOffsetToBytecodeOffset.h; sourceTree = "<group>"; };
 		0F0CD4C015F1A6040032F1C0 /* PutDirectIndexMode.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PutDirectIndexMode.h; sourceTree = "<group>"; };
 		0F0CD4C315F6B6B50032F1C0 /* SparseArrayValueMap.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SparseArrayValueMap.cpp; sourceTree = "<group>"; };
@@ -963,8 +962,6 @@
 		0F93329414CA7DC10085F3C6 /* CallLinkStatus.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CallLinkStatus.h; sourceTree = "<group>"; };
 		0F93329514CA7DC10085F3C6 /* GetByIdStatus.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = GetByIdStatus.cpp; sourceTree = "<group>"; };
 		0F93329614CA7DC10085F3C6 /* GetByIdStatus.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = GetByIdStatus.h; sourceTree = "<group>"; };
-		0F93329714CA7DC10085F3C6 /* MethodCallLinkStatus.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = MethodCallLinkStatus.cpp; sourceTree = "<group>"; };
-		0F93329814CA7DC10085F3C6 /* MethodCallLinkStatus.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = MethodCallLinkStatus.h; sourceTree = "<group>"; };
 		0F93329914CA7DC10085F3C6 /* PutByIdStatus.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = PutByIdStatus.cpp; sourceTree = "<group>"; };
 		0F93329A14CA7DC10085F3C6 /* PutByIdStatus.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PutByIdStatus.h; sourceTree = "<group>"; };
 		0F93329B14CA7DC10085F3C6 /* StructureSet.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = StructureSet.h; sourceTree = "<group>"; };
@@ -1386,6 +1383,11 @@
 		A767FF9F14F4502900789059 /* JSCTypedArrayStubs.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSCTypedArrayStubs.h; sourceTree = "<group>"; };
 		A76C51741182748D00715B05 /* JSInterfaceJIT.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSInterfaceJIT.h; sourceTree = "<group>"; };
 		A76F54A213B28AAB00EF2BCE /* JITWriteBarrier.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JITWriteBarrier.h; sourceTree = "<group>"; };
+		A77F181F164088B200640A47 /* CodeCache.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = CodeCache.cpp; sourceTree = "<group>"; };
+		A77F1820164088B200640A47 /* CodeCache.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CodeCache.h; sourceTree = "<group>"; };
+		A77F18241641925400640A47 /* ParserModes.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; path = ParserModes.h; sourceTree = "<group>"; };
+		A79E781E15EECBA80047C855 /* UnlinkedCodeBlock.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = UnlinkedCodeBlock.cpp; sourceTree = "<group>"; };
+		A79E781F15EECBA80047C855 /* UnlinkedCodeBlock.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = UnlinkedCodeBlock.h; sourceTree = "<group>"; };
 		A79EDB0811531CD60019E912 /* JSObjectRefPrivate.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSObjectRefPrivate.h; sourceTree = "<group>"; };
 		A7A7EE7411B98B8D0065A14F /* ASTBuilder.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ASTBuilder.h; sourceTree = "<group>"; };
 		A7A7EE7711B98B8D0065A14F /* SyntaxChecker.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SyntaxChecker.h; sourceTree = "<group>"; };
@@ -1408,7 +1410,6 @@
 		A8A4748D151A8306004123FF /* libWTF.a */ = {isa = PBXFileReference; lastKnownFileType = archive.ar; path = libWTF.a; sourceTree = BUILT_PRODUCTS_DIR; };
 		A8E894310CD0602400367179 /* JSCallbackObjectFunctions.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSCallbackObjectFunctions.h; sourceTree = "<group>"; };
 		A8E894330CD0603F00367179 /* JSGlobalObject.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSGlobalObject.h; sourceTree = "<group>"; };
-		BC021BF1136900C300FC5467 /* CompilerVersion.xcconfig */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.xcconfig; path = CompilerVersion.xcconfig; sourceTree = "<group>"; };
 		BC021BF2136900C300FC5467 /* ToolExecutable.xcconfig */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.xcconfig; path = ToolExecutable.xcconfig; sourceTree = "<group>"; };
 		BC02E9040E1839DB000F9297 /* ErrorConstructor.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ErrorConstructor.cpp; sourceTree = "<group>"; };
 		BC02E9050E1839DB000F9297 /* ErrorConstructor.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ErrorConstructor.h; sourceTree = "<group>"; };
@@ -2001,7 +2002,6 @@
 			isa = PBXGroup;
 			children = (
 				1C9051450BA9E8A70081E9D0 /* Base.xcconfig */,
-				BC021BF1136900C300FC5467 /* CompilerVersion.xcconfig */,
 				1C9051440BA9E8A70081E9D0 /* DebugRelease.xcconfig */,
 				449097EE0F8F81B50076A327 /* FeatureDefines.xcconfig */,
 				5DAFD6CB146B686300FBEFB4 /* JSC.xcconfig */,
@@ -2073,6 +2073,7 @@
 				E49DC15112EF272200184A1F /* SourceProviderCache.h */,
 				E49DC14912EF261A00184A1F /* SourceProviderCacheItem.h */,
 				A7A7EE7711B98B8D0065A14F /* SyntaxChecker.h */,
+				A77F18241641925400640A47 /* ParserModes.h */,
 			);
 			path = parser;
 			sourceTree = "<group>";
@@ -2307,6 +2308,8 @@
 				1420BE7A10AA6DDB00F455D2 /* WeakRandom.h */,
 				A7DCB77912E3D90500911940 /* WriteBarrier.h */,
 				C2D58C3315912FEE0021A844 /* GCActivityCallback.cpp */,
+				A77F181F164088B200640A47 /* CodeCache.cpp */,
+				A77F1820164088B200640A47 /* CodeCache.h */,
 			);
 			path = runtime;
 			sourceTree = "<group>";
@@ -2520,14 +2523,6 @@
 				0F0B83AF14BCF71400885B4F /* CallLinkInfo.h */,
 				0F93329314CA7DC10085F3C6 /* CallLinkStatus.cpp */,
 				0F93329414CA7DC10085F3C6 /* CallLinkStatus.h */,
-				0F93329514CA7DC10085F3C6 /* GetByIdStatus.cpp */,
-				0F93329614CA7DC10085F3C6 /* GetByIdStatus.h */,
-				0F93329714CA7DC10085F3C6 /* MethodCallLinkStatus.cpp */,
-				0F93329814CA7DC10085F3C6 /* MethodCallLinkStatus.h */,
-				0F93329914CA7DC10085F3C6 /* PutByIdStatus.cpp */,
-				0F93329A14CA7DC10085F3C6 /* PutByIdStatus.h */,
-				A7AFC17715F7EFE30048F57B /* ResolveOperation.h */,
-				0F93329B14CA7DC10085F3C6 /* StructureSet.h */,
 				0F0B83B814BCF95B00885B4F /* CallReturnOffsetToBytecodeOffset.h */,
 				969A07900ED1D3AE00F1F681 /* CodeBlock.cpp */,
 				969A07910ED1D3AE00F1F681 /* CodeBlock.h */,
@@ -2551,10 +2546,6 @@
 				0FB5467614F59AD1002C2989 /* LazyOperandValueProfile.h */,
 				0F0B83AC14BCF60200885B4F /* LineInfo.h */,
 				0F0FC45814BD15F100B81154 /* LLIntCallLinkInfo.h */,
-				0F0B83B214BCF85E00885B4F /* MethodCallLinkInfo.cpp */,
-				0F0B83B314BCF85E00885B4F /* MethodCallLinkInfo.h */,
-				0F93329714CA7DC10085F3C6 /* MethodCallLinkStatus.cpp */,
-				0F93329814CA7DC10085F3C6 /* MethodCallLinkStatus.h */,
 				0FB5467C14F5CFD3002C2989 /* MethodOfGettingAValueProfile.cpp */,
 				0FB5467A14F5C7D4002C2989 /* MethodOfGettingAValueProfile.h */,
 				969A07940ED1D3AE00F1F681 /* Opcode.cpp */,
@@ -2567,6 +2558,7 @@
 				0F9FC8C114E1B5FB00D52AE0 /* PutKind.h */,
 				0FF4276E159275D2004CB9FF /* ResolveGlobalStatus.cpp */,
 				0FF4276F159275D2004CB9FF /* ResolveGlobalStatus.h */,
+				A7AFC17715F7EFE30048F57B /* ResolveOperation.h */,
 				1429D8830ED21C3D00B89619 /* SamplingTool.cpp */,
 				1429D8840ED21C3D00B89619 /* SamplingTool.h */,
 				0F5541AF1613C1FB00CE3E25 /* SpecialPointer.cpp */,
@@ -2574,6 +2566,7 @@
 				0FD82E84141F3FDA00179C94 /* SpeculatedType.cpp */,
 				0FD82E4F141DAEA100179C94 /* SpeculatedType.h */,
 				0F93329B14CA7DC10085F3C6 /* StructureSet.h */,
+				0F93329514CA7DC10085F3C6 /* GetByIdStatus.cpp */,
 				0F766D3615AE4A1A008F363E /* StructureStubClearingWatchpoint.cpp */,
 				0F766D3715AE4A1A008F363E /* StructureStubClearingWatchpoint.h */,
 				BCCF0D0B0EF0B8A500413C8F /* StructureStubInfo.cpp */,
@@ -2583,6 +2576,12 @@
 				0F426A461460CBAB00131F8F /* VirtualRegister.h */,
 				0F919D2215853CDE004A4E7D /* Watchpoint.cpp */,
 				0F919D2315853CDE004A4E7D /* Watchpoint.h */,
+				0F93329614CA7DC10085F3C6 /* GetByIdStatus.h */,
+				0F93329914CA7DC10085F3C6 /* PutByIdStatus.cpp */,
+				0F93329A14CA7DC10085F3C6 /* PutByIdStatus.h */,
+				0F93329B14CA7DC10085F3C6 /* StructureSet.h */,
+				A79E781E15EECBA80047C855 /* UnlinkedCodeBlock.cpp */,
+				A79E781F15EECBA80047C855 /* UnlinkedCodeBlock.h */,
 			);
 			path = bytecode;
 			sourceTree = "<group>";
@@ -2615,6 +2614,7 @@
 				86ADD1450FDDEA980006EEC2 /* ARMv7Assembler.h in Headers */,
 				C2EAD2FC14F0249800A4B159 /* CopiedAllocator.h in Headers */,
 				C2B916C214DA014E00CBAC86 /* MarkedAllocator.h in Headers */,
+				FE4A332015BD2E07006F54F3 /* VMInspector.h in Headers */,
 				C2239D1816262BDD005AC5FD /* CopyVisitor.h in Headers */,
 				C2239D1916262BDD005AC5FD /* CopyVisitorInlineMethods.h in Headers */,
 				C24D31E3161CD695002AA4DB /* HeapStatistics.h in Headers */,
@@ -2900,7 +2900,6 @@
 				0F0B83AB14BCF5BB00885B4F /* ExpressionRangeInfo.h in Headers */,
 				0F0B83AD14BCF60400885B4F /* LineInfo.h in Headers */,
 				0F0B83B114BCF71800885B4F /* CallLinkInfo.h in Headers */,
-				0F0B83B514BCF86200885B4F /* MethodCallLinkInfo.h in Headers */,
 				0F0B83B914BCF95F00885B4F /* CallReturnOffsetToBytecodeOffset.h in Headers */,
 				0F0FC45A14BD15F500B81154 /* LLIntCallLinkInfo.h in Headers */,
 				0F21C26814BE5F6800ADC64B /* JITDriver.h in Headers */,
@@ -2914,7 +2913,6 @@
 				0F7B294D14C3CD4C007C3DB1 /* DFGCommon.h in Headers */,
 				0F93329E14CA7DC50085F3C6 /* CallLinkStatus.h in Headers */,
 				0F9332A014CA7DCD0085F3C6 /* GetByIdStatus.h in Headers */,
-				0F9332A214CA7DD30085F3C6 /* MethodCallLinkStatus.h in Headers */,
 				0F9332A414CA7DD90085F3C6 /* PutByIdStatus.h in Headers */,
 				0F9332A514CA7DDD0085F3C6 /* StructureSet.h in Headers */,
 				0F55F0F514D1063C00AC7649 /* AbstractPC.h in Headers */,
@@ -2984,7 +2982,6 @@
 				0F766D3915AE4A1F008F363E /* StructureStubClearingWatchpoint.h in Headers */,
 				0F766D4415B2A3C0008F363E /* DFGRegisterSet.h in Headers */,
 				0F766D4615B3701F008F363E /* DFGScratchRegisterAllocator.h in Headers */,
-				FE4A332015BD2E07006F54F3 /* VMInspector.h in Headers */,
 				0F63943F15C75F19006A597C /* DFGStructureCheckHoistingPhase.h in Headers */,
 				0F63945515D07057006A597C /* ArrayProfile.h in Headers */,
 				0F63948515E4811B006A597C /* DFGArrayMode.h in Headers */,
@@ -3009,8 +3006,11 @@
 				862553D216136E1A009F17D0 /* JSProxy.h in Headers */,
 				0F5541B21613C1FB00CE3E25 /* SpecialPointer.h in Headers */,
 				0FEB3ECD16237F4D00AB67AD /* TypedArrayDescriptor.h in Headers */,
- 				0F256C361627B0AD007F2783 /* DFGCallArrayAllocatorSlowPathGenerator.h in Headers */,
+				0F256C361627B0AD007F2783 /* DFGCallArrayAllocatorSlowPathGenerator.h in Headers */,
 				C2239D1B16262BDD005AC5FD /* GCThread.h in Headers */,
+				A7B601821639FD2A00372BA3 /* UnlinkedCodeBlock.h in Headers */,
+				A77F1822164088B200640A47 /* CodeCache.h in Headers */,
+				A77F1825164192C700640A47 /* ParserModes.h in Headers */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
@@ -3096,8 +3096,6 @@
 				932F5B3F0822A1C700736975 /* Headers */,
 				932F5B910822A1C700736975 /* Sources */,
 				932F5BD20822A1C700736975 /* Frameworks */,
-				9319586B09D9F91A00A56FD4 /* Check For Global Initializers */,
-				933457200EBFDC3F00B80894 /* Check For Exit Time Destructors */,
 				5D29D8BE0E9860B400C3D2D0 /* Check For Weak VTables and Externals */,
 				3713F014142905240036387F /* Check For Inappropriate Objective-C Class Names */,
 			);
@@ -3292,36 +3290,6 @@
 			shellPath = /bin/sh;
 			shellScript = "mkdir -p \"${BUILT_PRODUCTS_DIR}/DerivedSources/JavaScriptCore/docs\"\ncd \"${BUILT_PRODUCTS_DIR}/DerivedSources/JavaScriptCore\"\n\n/bin/ln -sfh \"${SRCROOT}\" JavaScriptCore\nexport JavaScriptCore=\"JavaScriptCore\"\nexport BUILT_PRODUCTS_DIR=\"../..\"\n\nmake --no-builtin-rules -f \"JavaScriptCore/DerivedSources.make\" -j `/usr/sbin/sysctl -n hw.ncpu` || exit 1\n\n/usr/bin/env ruby JavaScriptCore/offlineasm/asm.rb JavaScriptCore/llint/LowLevelInterpreter.asm ${BUILT_PRODUCTS_DIR}/JSCLLIntOffsetsExtractor LLIntAssembly.h || exit 1\n";
 		};
-		9319586B09D9F91A00A56FD4 /* Check For Global Initializers */ = {
-			isa = PBXShellScriptBuildPhase;
-			buildActionMask = 2147483647;
-			files = (
-			);
-			inputPaths = (
-				"$(TARGET_BUILD_DIR)/$(EXECUTABLE_PATH)",
-			);
-			name = "Check For Global Initializers";
-			outputPaths = (
-			);
-			runOnlyForDeploymentPostprocessing = 0;
-			shellPath = /bin/sh;
-			shellScript = "if [ \"${TARGET_GCC_VERSION}\" = \"LLVM_COMPILER\" ]; then\n    exit 0;\nfi\n\nif [ -f ../../Tools/Scripts/check-for-global-initializers ]; then\n    ../../Tools/Scripts/check-for-global-initializers || exit $?\nfi";
-		};
-		933457200EBFDC3F00B80894 /* Check For Exit Time Destructors */ = {
-			isa = PBXShellScriptBuildPhase;
-			buildActionMask = 2147483647;
-			files = (
-			);
-			inputPaths = (
-				"$(TARGET_BUILD_DIR)/$(EXECUTABLE_PATH)",
-			);
-			name = "Check For Exit Time Destructors";
-			outputPaths = (
-			);
-			runOnlyForDeploymentPostprocessing = 0;
-			shellPath = /bin/sh;
-			shellScript = "if [ \"${TARGET_GCC_VERSION}\" = \"LLVM_COMPILER\" ]; then\n    exit 0;\nfi\n\nif [ -f ../../Tools/Scripts/check-for-exit-time-destructors ]; then\n    ../../Tools/Scripts/check-for-exit-time-destructors || exit $?\nfi";
-		};
 /* End PBXShellScriptBuildPhase section */
 
 /* Begin PBXSourcesBuildPhase section */
@@ -3541,10 +3509,8 @@
 				0F0B839A14BCF45D00885B4F /* LLIntEntrypoints.cpp in Sources */,
 				0F0B839C14BCF46300885B4F /* LLIntThunks.cpp in Sources */,
 				0F0B83B014BCF71600885B4F /* CallLinkInfo.cpp in Sources */,
-				0F0B83B414BCF86000885B4F /* MethodCallLinkInfo.cpp in Sources */,
 				0F93329D14CA7DC30085F3C6 /* CallLinkStatus.cpp in Sources */,
 				0F93329F14CA7DCA0085F3C6 /* GetByIdStatus.cpp in Sources */,
-				0F9332A114CA7DD10085F3C6 /* MethodCallLinkStatus.cpp in Sources */,
 				0F9332A314CA7DD70085F3C6 /* PutByIdStatus.cpp in Sources */,
 				0F55F0F414D1063900AC7649 /* AbstractPC.cpp in Sources */,
 				86B5826714D2796C00A9C306 /* CodeProfile.cpp in Sources */,
@@ -3621,6 +3587,8 @@
 				C24D31E2161CD695002AA4DB /* HeapStatistics.cpp in Sources */,
 				C2239D1716262BDD005AC5FD /* CopyVisitor.cpp in Sources */,
 				C2239D1A16262BDD005AC5FD /* GCThread.cpp in Sources */,
+				A76F279415F13C9600517D67 /* UnlinkedCodeBlock.cpp in Sources */,
+				A77F1821164088B200640A47 /* CodeCache.cpp in Sources */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
diff --git a/Source/JavaScriptCore/LLIntOffsetsExtractor.pro b/Source/JavaScriptCore/LLIntOffsetsExtractor.pro
index 1fc6c1d7c..ae635c1b5 100644
--- a/Source/JavaScriptCore/LLIntOffsetsExtractor.pro
+++ b/Source/JavaScriptCore/LLIntOffsetsExtractor.pro
@@ -22,18 +22,14 @@ LIBS =
 
 defineTest(addIncludePaths) {
     # Just needed for include paths
-    include(../WTF/WTF.pri)
     include(JavaScriptCore.pri)
+    include(../WTF/WTF.pri)
 
     export(INCLUDEPATH)
 }
 
 addIncludePaths()
 
-# To make sure we include JavaScriptCore/config.h and not
-# the WTF one.
-INCLUDEPATH = $$PWD $$INCLUDEPATH
-
 LLINT_DEPENDENCY = \
     $$PWD/llint/LowLevelInterpreter.asm \
     $$PWD/llint/LowLevelInterpreter32_64.asm \
diff --git a/Source/JavaScriptCore/Target.pri b/Source/JavaScriptCore/Target.pri
index ffd295a41..b0fcc16e7 100644
--- a/Source/JavaScriptCore/Target.pri
+++ b/Source/JavaScriptCore/Target.pri
@@ -30,8 +30,7 @@ include(yarr/yarr.pri)
 
 INSTALLDEPS += all
 
-CONFIG(debug, debug|release): INCLUDEPATH += $$JAVASCRIPTCORE_GENERATED_SOURCES_DIR\debug
-CONFIG(release, debug|release): INCLUDEPATH += $$JAVASCRIPTCORE_GENERATED_SOURCES_DIR\release
+debug_and_release: INCLUDEPATH += $$JAVASCRIPTCORE_GENERATED_SOURCES_DIR/$$activeBuildConfig()
 
 SOURCES += \
     API/JSBase.cpp \
@@ -60,8 +59,6 @@ SOURCES += \
     bytecode/GetByIdStatus.cpp \
     bytecode/JumpTable.cpp \
     bytecode/LazyOperandValueProfile.cpp \
-    bytecode/MethodCallLinkInfo.cpp \
-    bytecode/MethodCallLinkStatus.cpp \
     bytecode/MethodOfGettingAValueProfile.cpp \
     bytecode/Opcode.cpp \
     bytecode/PolymorphicPutByIdList.cpp \
@@ -72,6 +69,7 @@ SOURCES += \
     bytecode/SpeculatedType.cpp \
     bytecode/StructureStubClearingWatchpoint.cpp \
     bytecode/StructureStubInfo.cpp \
+    bytecode/UnlinkedCodeBlock.cpp \
     bytecode/Watchpoint.cpp \
     bytecompiler/BytecodeGenerator.cpp \
     bytecompiler/NodesCodegen.cpp \
@@ -187,6 +185,7 @@ SOURCES += \
     runtime/BooleanObject.cpp \
     runtime/BooleanPrototype.cpp \
     runtime/CallData.cpp \
+    runtime/CodeCache.cpp \
     runtime/CommonIdentifiers.cpp \
     runtime/Completion.cpp \
     runtime/ConstructData.cpp \
@@ -276,6 +275,18 @@ SOURCES += \
     tools/CodeProfiling.cpp \
     yarr/YarrJIT.cpp \
 
+linux-*:if(isEqual(QT_ARCH, "i386")|isEqual(QT_ARCH, "x86_64")) {
+    SOURCES += \
+        disassembler/UDis86Disassembler.cpp \
+        disassembler/udis86/udis86.c \
+        disassembler/udis86/udis86_decode.c \
+        disassembler/udis86/udis86_input.c \
+        disassembler/udis86/udis86_itab_holder.c \
+        disassembler/udis86/udis86_syn-att.c \
+        disassembler/udis86/udis86_syn-intel.c \
+        disassembler/udis86/udis86_syn.c \
+}
+
 HEADERS += $$files(*.h, true)
 
 *sh4* {
diff --git a/Source/JavaScriptCore/bytecode/ArrayProfile.cpp b/Source/JavaScriptCore/bytecode/ArrayProfile.cpp
index de7f67887..5a87380fd 100644
--- a/Source/JavaScriptCore/bytecode/ArrayProfile.cpp
+++ b/Source/JavaScriptCore/bytecode/ArrayProfile.cpp
@@ -26,6 +26,7 @@
 #include "config.h"
 #include "ArrayProfile.h"
 
+#include "CodeBlock.h"
 #include <wtf/StringExtras.h>
 
 namespace JSC {
@@ -38,14 +39,14 @@ const char* arrayModesToString(ArrayModes arrayModes)
     if (arrayModes == ALL_ARRAY_MODES)
         return "TOP";
 
-    bool isNonArray = !!(arrayModes & NonArray);
-    bool isNonArrayWithContiguous = !!(arrayModes & NonArrayWithContiguous);
-    bool isNonArrayWithArrayStorage = !!(arrayModes & NonArrayWithArrayStorage);
-    bool isNonArrayWithSlowPutArrayStorage = !!(arrayModes & NonArrayWithSlowPutArrayStorage);
-    bool isArray = !!(arrayModes & ArrayClass);
-    bool isArrayWithContiguous = !!(arrayModes & ArrayWithContiguous);
-    bool isArrayWithArrayStorage = !!(arrayModes & ArrayWithArrayStorage);
-    bool isArrayWithSlowPutArrayStorage = !!(arrayModes & ArrayWithSlowPutArrayStorage);
+    bool isNonArray = !!(arrayModes & asArrayModes(NonArray));
+    bool isNonArrayWithContiguous = !!(arrayModes & asArrayModes(NonArrayWithContiguous));
+    bool isNonArrayWithArrayStorage = !!(arrayModes & asArrayModes(NonArrayWithArrayStorage));
+    bool isNonArrayWithSlowPutArrayStorage = !!(arrayModes & asArrayModes(NonArrayWithSlowPutArrayStorage));
+    bool isArray = !!(arrayModes & asArrayModes(ArrayClass));
+    bool isArrayWithContiguous = !!(arrayModes & asArrayModes(ArrayWithContiguous));
+    bool isArrayWithArrayStorage = !!(arrayModes & asArrayModes(ArrayWithArrayStorage));
+    bool isArrayWithSlowPutArrayStorage = !!(arrayModes & asArrayModes(ArrayWithSlowPutArrayStorage));
     
     static char result[256];
     snprintf(
@@ -64,12 +65,14 @@ const char* arrayModesToString(ArrayModes arrayModes)
     return result;
 }
 
-void ArrayProfile::computeUpdatedPrediction(OperationInProgress operation)
+void ArrayProfile::computeUpdatedPrediction(CodeBlock* codeBlock, OperationInProgress operation)
 {
     if (m_lastSeenStructure) {
         m_observedArrayModes |= arrayModeFromStructure(m_lastSeenStructure);
         m_mayInterceptIndexedAccesses |=
             m_lastSeenStructure->typeInfo().interceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero();
+        if (!codeBlock->globalObject()->isOriginalArrayStructure(m_lastSeenStructure))
+            m_usesOriginalArrayStructures = false;
         if (!m_structureIsPolymorphic) {
             if (!m_expectedStructure)
                 m_expectedStructure = m_lastSeenStructure;
diff --git a/Source/JavaScriptCore/bytecode/ArrayProfile.h b/Source/JavaScriptCore/bytecode/ArrayProfile.h
index ffc136258..376684fc1 100644
--- a/Source/JavaScriptCore/bytecode/ArrayProfile.h
+++ b/Source/JavaScriptCore/bytecode/ArrayProfile.h
@@ -33,6 +33,7 @@
 
 namespace JSC {
 
+class CodeBlock;
 class LLIntOffsetsExtractor;
 
 // This is a bitfield where each bit represents an IndexingType that we have seen.
@@ -87,6 +88,7 @@ public:
         , m_structureIsPolymorphic(false)
         , m_mayStoreToHole(false)
         , m_mayInterceptIndexedAccesses(false)
+        , m_usesOriginalArrayStructures(true)
         , m_observedArrayModes(0)
     {
     }
@@ -98,6 +100,7 @@ public:
         , m_structureIsPolymorphic(false)
         , m_mayStoreToHole(false)
         , m_mayInterceptIndexedAccesses(false)
+        , m_usesOriginalArrayStructures(true)
         , m_observedArrayModes(0)
     {
     }
@@ -113,7 +116,7 @@ public:
         m_lastSeenStructure = structure;
     }
     
-    void computeUpdatedPrediction(OperationInProgress operation = NoOperation);
+    void computeUpdatedPrediction(CodeBlock*, OperationInProgress = NoOperation);
     
     Structure* expectedStructure() const { return m_expectedStructure; }
     bool structureIsPolymorphic() const
@@ -129,6 +132,8 @@ public:
     
     bool mayStoreToHole() const { return m_mayStoreToHole; }
     
+    bool usesOriginalArrayStructures() const { return m_usesOriginalArrayStructures; }
+    
 private:
     friend class LLIntOffsetsExtractor;
     
@@ -138,6 +143,7 @@ private:
     bool m_structureIsPolymorphic;
     bool m_mayStoreToHole; // This flag may become overloaded to indicate other special cases that were encountered during array access, as it depends on indexing type. Since we currently have basically just one indexing type (two variants of ArrayStorage), this flag for now just means exactly what its name implies.
     bool m_mayInterceptIndexedAccesses;
+    bool m_usesOriginalArrayStructures;
     ArrayModes m_observedArrayModes;
 };
 
diff --git a/Source/JavaScriptCore/bytecode/CodeBlock.cpp b/Source/JavaScriptCore/bytecode/CodeBlock.cpp
index 7f86186a0..ceae3fcb2 100644
--- a/Source/JavaScriptCore/bytecode/CodeBlock.cpp
+++ b/Source/JavaScriptCore/bytecode/CodeBlock.cpp
@@ -43,7 +43,6 @@
 #include "JSNameScope.h"
 #include "JSValue.h"
 #include "LowLevelInterpreter.h"
-#include "MethodCallLinkStatus.h"
 #include "RepatchBuffer.h"
 #include "SlotVisitorInlineMethods.h"
 #include <stdio.h>
@@ -283,9 +282,6 @@ void CodeBlock::printGetByIdCacheStatus(ExecState* exec, int location)
 {
     Instruction* instruction = instructions().begin() + location;
 
-    if (exec->interpreter()->getOpcodeID(instruction[0].u.opcode) == op_method_check)
-        instruction++;
-    
     Identifier& ident = identifier(instruction[3].u.operand);
     
     UNUSED_PARAM(ident); // tell the compiler to shut up in certain platform configurations.
@@ -496,8 +492,8 @@ void CodeBlock::dump(ExecState* exec)
         static_cast<unsigned long>(instructions().size() * sizeof(Instruction)),
         this, codeTypeToString(codeType()), m_numParameters, m_numCalleeRegisters,
         m_numVars);
-    if (m_symbolTable->captureCount())
-        dataLog("; %d captured var(s)", m_symbolTable->captureCount());
+    if (symbolTable()->captureCount())
+        dataLog("; %d captured var(s)", symbolTable()->captureCount());
     if (usesArguments()) {
         dataLog(
             "; uses arguments, in r%d, r%d",
@@ -531,13 +527,13 @@ void CodeBlock::dump(ExecState* exec)
         } while (i < m_constantRegisters.size());
     }
 
-    if (m_rareData && !m_rareData->m_regexps.isEmpty()) {
+    if (size_t count = m_unlinkedCode->numberOfRegExps()) {
         dataLog("\nm_regexps:\n");
         size_t i = 0;
         do {
-            dataLog("  re%u = %s\n", static_cast<unsigned>(i), regexpToSourceString(m_rareData->m_regexps[i].get()).utf8().data());
+            dataLog("  re%u = %s\n", static_cast<unsigned>(i), regexpToSourceString(m_unlinkedCode->regexp(i)).utf8().data());
             ++i;
-        } while (i < m_rareData->m_regexps.size());
+        } while (i < count);
     }
 
 #if ENABLE(JIT)
@@ -671,7 +667,7 @@ void CodeBlock::dump(ExecState* exec, const Vector<Instruction>::const_iterator&
             int dst = (++it)->u.operand;
             int argv = (++it)->u.operand;
             int argc = (++it)->u.operand;
-            dataLog("[%4d] new_array_buffer %s, %d, %d", location, registerName(exec, dst).data(), argv, argc);
+            dataLog("[%4d] new_array_buffer\t %s, %d, %d", location, registerName(exec, dst).data(), argv, argc);
             dumpBytecodeCommentAndNewLine(location);
             break;
         }
@@ -679,7 +675,7 @@ void CodeBlock::dump(ExecState* exec, const Vector<Instruction>::const_iterator&
             int r0 = (++it)->u.operand;
             int re0 = (++it)->u.operand;
             dataLog("[%4d] new_regexp\t %s, ", location, registerName(exec, r0).data());
-            if (r0 >=0 && r0 < (int)numberOfRegExps())
+            if (r0 >=0 && r0 < (int)m_unlinkedCode->numberOfRegExps())
                 dataLog("%s", regexpName(re0, regexp(re0)).data());
             else
                 dataLog("bad_regexp(%d)", re0);
@@ -889,11 +885,22 @@ void CodeBlock::dump(ExecState* exec, const Vector<Instruction>::const_iterator&
             it++;
             break;
         }
+        case op_init_global_const_nop: {
+            dataLog("[%4d] init_global_const_nop\t", location);
+            dumpBytecodeCommentAndNewLine(location);
+            it++;
+            it++;
+            it++;
+            it++;
+            break;
+        }
         case op_init_global_const: {
             WriteBarrier<Unknown>* registerPointer = (++it)->u.registerPointer;
             int r0 = (++it)->u.operand;
             dataLog("[%4d] init_global_const\t g%d(%p), %s", location, m_globalObject->findRegisterIndex(registerPointer), registerPointer, registerName(exec, r0).data());
             dumpBytecodeCommentAndNewLine(location);
+            it++;
+            it++;
             break;
         }
         case op_init_global_const_check: {
@@ -1017,42 +1024,6 @@ void CodeBlock::dump(ExecState* exec, const Vector<Instruction>::const_iterator&
             dumpBytecodeCommentAndNewLine(location);
             break;
         }
-        case op_method_check: {
-            dataLog("[%4d] method_check", location);
-#if ENABLE(JIT)
-            if (numberOfMethodCallLinkInfos()) {
-                MethodCallLinkInfo& methodCall = getMethodCallLinkInfo(location);
-                dataLog(" jit(");
-                if (!methodCall.seen)
-                    dataLog("not seen");
-                else {
-                    // Use the fact that MethodCallLinkStatus already does smart things
-                    // for decoding seen method calls.
-                    MethodCallLinkStatus status = MethodCallLinkStatus::computeFor(this, location);
-                    if (!status)
-                        dataLog("not set");
-                    else {
-                        dataLog("function = %p (executable = ", status.function());
-                        JSCell* functionAsCell = getJSFunction(status.function());
-                        if (functionAsCell)
-                            dataLog("%p", jsCast<JSFunction*>(functionAsCell)->executable());
-                        else
-                            dataLog("N/A");
-                        dataLog("), struct = %p", status.structure());
-                        if (status.needsPrototypeCheck())
-                            dataLog(", prototype = %p, struct = %p", status.prototype(), status.prototypeStructure());
-                    }
-                }
-                dataLog(")");
-            }
-#endif
-            dumpBytecodeCommentAndNewLine(location);
-            ++it;
-            printGetByIdOp(exec, location, it);
-            printGetByIdCacheStatus(exec, location);
-            dataLog("\n");
-            break;
-        }
         case op_del_by_id: {
             int r0 = (++it)->u.operand;
             int r1 = (++it)->u.operand;
@@ -1431,9 +1402,10 @@ void CodeBlock::dump(ExecState* exec, const Vector<Instruction>::const_iterator&
             dumpBytecodeCommentAndNewLine(location);
             break;
         }
-        case op_throw_reference_error: {
+        case op_throw_static_error: {
             int k0 = (++it)->u.operand;
-            dataLog("[%4d] throw_reference_error\t %s", location, constantName(exec, k0, getConstant(k0)).data());
+            int k1 = (++it)->u.operand;
+            dataLog("[%4d] throw_static_error\t %s, %s", location, constantName(exec, k0, getConstant(k0)).data(), k1 ? "true" : "false");
             dumpBytecodeCommentAndNewLine(location);
             break;
         }
@@ -1531,9 +1503,9 @@ void CodeBlock::dumpStatistics()
             FOR_EACH_MEMBER_VECTOR(GET_STATS)
         #undef GET_STATS
 
-        if (!codeBlock->m_symbolTable.isEmpty()) {
+        if (codeBlock->symbolTable() && !codeBlock->symbolTable()->isEmpty()) {
             symbolTableIsNotEmpty++;
-            symbolTableTotalSize += (codeBlock->m_symbolTable.capacity() * (sizeof(SymbolTable::KeyType) + sizeof(SymbolTable::MappedType)));
+            symbolTableTotalSize += (codeBlock->symbolTable()->capacity() * (sizeof(SymbolTable::KeyType) + sizeof(SymbolTable::MappedType)));
         }
 
         if (codeBlock->m_rareData) {
@@ -1601,34 +1573,26 @@ CodeBlock::CodeBlock(CopyParsedBlockTag, CodeBlock& other)
     , m_numCalleeRegisters(other.m_numCalleeRegisters)
     , m_numVars(other.m_numVars)
     , m_isConstructor(other.m_isConstructor)
+    , m_unlinkedCode(*other.m_globalData, other.m_ownerExecutable.get(), other.m_unlinkedCode.get())
     , m_ownerExecutable(*other.m_globalData, other.m_ownerExecutable.get(), other.m_ownerExecutable.get())
     , m_globalData(other.m_globalData)
     , m_instructions(other.m_instructions)
     , m_thisRegister(other.m_thisRegister)
     , m_argumentsRegister(other.m_argumentsRegister)
     , m_activationRegister(other.m_activationRegister)
-    , m_globalObjectConstant(other.m_globalObjectConstant)
-    , m_needsFullScopeChain(other.m_needsFullScopeChain)
-    , m_usesEval(other.m_usesEval)
-    , m_isNumericCompareFunction(other.m_isNumericCompareFunction)
     , m_isStrictMode(other.m_isStrictMode)
-    , m_codeType(other.m_codeType)
     , m_source(other.m_source)
     , m_sourceOffset(other.m_sourceOffset)
 #if ENABLE(VALUE_PROFILER)
     , m_executionEntryCount(0)
 #endif
-    , m_jumpTargets(other.m_jumpTargets)
-    , m_loopTargets(other.m_loopTargets)
     , m_identifiers(other.m_identifiers)
     , m_constantRegisters(other.m_constantRegisters)
     , m_functionDecls(other.m_functionDecls)
     , m_functionExprs(other.m_functionExprs)
-    , m_symbolTable(*other.m_globalData, other.m_ownerExecutable.get(), other.symbolTable())
     , m_osrExitCounter(0)
     , m_optimizationDelayCounter(0)
     , m_reoptimizationRetryCounter(0)
-    , m_lineInfo(other.m_lineInfo)
     , m_resolveOperations(other.m_resolveOperations)
     , m_putToBaseOperations(other.m_putToBaseOperations)
 #if ENABLE(BYTECODE_COMMENTS)
@@ -1646,36 +1610,31 @@ CodeBlock::CodeBlock(CopyParsedBlockTag, CodeBlock& other)
         createRareDataIfNecessary();
         
         m_rareData->m_exceptionHandlers = other.m_rareData->m_exceptionHandlers;
-        m_rareData->m_regexps = other.m_rareData->m_regexps;
         m_rareData->m_constantBuffers = other.m_rareData->m_constantBuffers;
         m_rareData->m_immediateSwitchJumpTables = other.m_rareData->m_immediateSwitchJumpTables;
         m_rareData->m_characterSwitchJumpTables = other.m_rareData->m_characterSwitchJumpTables;
         m_rareData->m_stringSwitchJumpTables = other.m_rareData->m_stringSwitchJumpTables;
-        m_rareData->m_expressionInfo = other.m_rareData->m_expressionInfo;
     }
 }
 
-CodeBlock::CodeBlock(ScriptExecutable* ownerExecutable, CodeType codeType, JSGlobalObject *globalObject, PassRefPtr<SourceProvider> sourceProvider, unsigned sourceOffset, bool isConstructor, PassOwnPtr<CodeBlock> alternative)
+CodeBlock::CodeBlock(ScriptExecutable* ownerExecutable, UnlinkedCodeBlock* unlinkedCodeBlock, JSGlobalObject* globalObject, unsigned baseScopeDepth, PassRefPtr<SourceProvider> sourceProvider, unsigned sourceOffset, PassOwnPtr<CodeBlock> alternative)
     : m_globalObject(globalObject->globalData(), ownerExecutable, globalObject)
     , m_heap(&m_globalObject->globalData().heap)
-    , m_numCalleeRegisters(0)
-    , m_numVars(0)
-    , m_isConstructor(isConstructor)
-    , m_numParameters(0)
+    , m_numCalleeRegisters(unlinkedCodeBlock->m_numCalleeRegisters)
+    , m_numVars(unlinkedCodeBlock->m_numVars)
+    , m_isConstructor(unlinkedCodeBlock->isConstructor())
+    , m_unlinkedCode(globalObject->globalData(), ownerExecutable, unlinkedCodeBlock)
     , m_ownerExecutable(globalObject->globalData(), ownerExecutable, ownerExecutable)
-    , m_globalData(0)
-    , m_argumentsRegister(-1)
-    , m_needsFullScopeChain(ownerExecutable->needsActivation())
-    , m_usesEval(ownerExecutable->usesEval())
-    , m_isNumericCompareFunction(false)
-    , m_isStrictMode(ownerExecutable->isStrictMode())
-    , m_codeType(codeType)
+    , m_globalData(unlinkedCodeBlock->globalData())
+    , m_thisRegister(unlinkedCodeBlock->thisRegister())
+    , m_argumentsRegister(unlinkedCodeBlock->argumentsRegister())
+    , m_activationRegister(unlinkedCodeBlock->activationRegister())
+    , m_isStrictMode(unlinkedCodeBlock->isStrictMode())
     , m_source(sourceProvider)
     , m_sourceOffset(sourceOffset)
 #if ENABLE(VALUE_PROFILER)
     , m_executionEntryCount(0)
 #endif
-    , m_symbolTable(globalObject->globalData(), ownerExecutable, SharedSymbolTable::create(globalObject->globalData()))
     , m_alternative(alternative)
     , m_osrExitCounter(0)
     , m_optimizationDelayCounter(0)
@@ -1684,7 +1643,10 @@ CodeBlock::CodeBlock(ScriptExecutable* ownerExecutable, CodeType codeType, JSGlo
     , m_bytecodeCommentIterator(0)
 #endif
 {
+    m_globalData->startedCompiling(this);
+
     ASSERT(m_source);
+    setNumParameters(unlinkedCodeBlock->numParameters());
 
     optimizeAfterWarmUp();
     jitAfterWarmUp();
@@ -1692,9 +1654,208 @@ CodeBlock::CodeBlock(ScriptExecutable* ownerExecutable, CodeType codeType, JSGlo
 #if DUMP_CODE_BLOCK_STATISTICS
     liveCodeBlockSet.add(this);
 #endif
-    // We have a stub putToBase operation to allow resolve_base to
-    // remain branchless
-    m_putToBaseOperations.append(PutToBaseOperation(isStrictMode()));
+    setIdentifiers(unlinkedCodeBlock->identifiers());
+    setConstantRegisters(unlinkedCodeBlock->constantRegisters());
+
+    m_functionDecls.grow(unlinkedCodeBlock->numberOfFunctionDecls());
+    for (size_t count = unlinkedCodeBlock->numberOfFunctionDecls(), i = 0; i < count; ++i) {
+        UnlinkedFunctionExecutable* unlinkedExecutable = unlinkedCodeBlock->functionDecl(i);
+        unsigned lineCount = unlinkedExecutable->lineCount();
+        unsigned firstLine = ownerExecutable->lineNo() + unlinkedExecutable->firstLineOffset();
+        unsigned startOffset = sourceOffset + unlinkedExecutable->startOffset();
+        unsigned sourceLength = unlinkedExecutable->sourceLength();
+        SourceCode code(m_source, startOffset, startOffset + sourceLength, firstLine);
+        FunctionExecutable* executable = FunctionExecutable::create(*m_globalData, code, unlinkedExecutable, firstLine, firstLine + lineCount);
+        m_functionDecls[i].set(*m_globalData, ownerExecutable, executable);
+    }
+
+    m_functionExprs.grow(unlinkedCodeBlock->numberOfFunctionExprs());
+    for (size_t count = unlinkedCodeBlock->numberOfFunctionExprs(), i = 0; i < count; ++i) {
+        UnlinkedFunctionExecutable* unlinkedExecutable = unlinkedCodeBlock->functionExpr(i);
+        unsigned lineCount = unlinkedExecutable->lineCount();
+        unsigned firstLine = ownerExecutable->lineNo() + unlinkedExecutable->firstLineOffset();
+        unsigned startOffset = sourceOffset + unlinkedExecutable->startOffset();
+        unsigned sourceLength = unlinkedExecutable->sourceLength();
+        SourceCode code(m_source, startOffset, startOffset + sourceLength, firstLine);
+        FunctionExecutable* executable = FunctionExecutable::create(*m_globalData, code, unlinkedExecutable, firstLine, firstLine + lineCount);
+        m_functionExprs[i].set(*m_globalData, ownerExecutable, executable);
+    }
+
+    if (unlinkedCodeBlock->hasRareData()) {
+        createRareDataIfNecessary();
+        if (size_t count = unlinkedCodeBlock->constantBufferCount()) {
+            m_rareData->m_constantBuffers.grow(count);
+            for (size_t i = 0; i < count; i++) {
+                const UnlinkedCodeBlock::ConstantBuffer& buffer = unlinkedCodeBlock->constantBuffer(i);
+                m_rareData->m_constantBuffers[i] = buffer;
+            }
+        }
+        if (size_t count = unlinkedCodeBlock->numberOfExceptionHandlers()) {
+            m_rareData->m_exceptionHandlers.grow(count);
+            for (size_t i = 0; i < count; i++) {
+                const UnlinkedHandlerInfo& handler = unlinkedCodeBlock->exceptionHandler(i);
+                m_rareData->m_exceptionHandlers[i].start = handler.start;
+                m_rareData->m_exceptionHandlers[i].end = handler.end;
+                m_rareData->m_exceptionHandlers[i].target = handler.target;
+                m_rareData->m_exceptionHandlers[i].scopeDepth = handler.scopeDepth + baseScopeDepth;
+#if ENABLE(JIT) && ENABLE(LLINT)
+                m_rareData->m_exceptionHandlers[i].nativeCode = CodeLocationLabel(MacroAssemblerCodePtr::createFromExecutableAddress(LLInt::getCodePtr(llint_op_catch)));
+#endif
+            }
+        }
+
+        if (size_t count = unlinkedCodeBlock->numberOfStringSwitchJumpTables()) {
+            m_rareData->m_stringSwitchJumpTables.grow(count);
+            for (size_t i = 0; i < count; i++) {
+                UnlinkedStringJumpTable::StringOffsetTable::iterator ptr = unlinkedCodeBlock->stringSwitchJumpTable(i).offsetTable.begin();
+                UnlinkedStringJumpTable::StringOffsetTable::iterator end = unlinkedCodeBlock->stringSwitchJumpTable(i).offsetTable.end();
+                for (; ptr != end; ++ptr) {
+                    OffsetLocation offset;
+                    offset.branchOffset = ptr->value;
+                    m_rareData->m_stringSwitchJumpTables[i].offsetTable.add(ptr->key, offset);
+                }
+            }
+        }
+
+        if (size_t count = unlinkedCodeBlock->numberOfImmediateSwitchJumpTables()) {
+            m_rareData->m_immediateSwitchJumpTables.grow(count);
+            for (size_t i = 0; i < count; i++) {
+                UnlinkedSimpleJumpTable& sourceTable = unlinkedCodeBlock->immediateSwitchJumpTable(i);
+                SimpleJumpTable& destTable = m_rareData->m_immediateSwitchJumpTables[i];
+                destTable.branchOffsets = sourceTable.branchOffsets;
+                destTable.min = sourceTable.min;
+            }
+        }
+
+        if (size_t count = unlinkedCodeBlock->numberOfCharacterSwitchJumpTables()) {
+            m_rareData->m_characterSwitchJumpTables.grow(count);
+            for (size_t i = 0; i < count; i++) {
+                UnlinkedSimpleJumpTable& sourceTable = unlinkedCodeBlock->characterSwitchJumpTable(i);
+                SimpleJumpTable& destTable = m_rareData->m_characterSwitchJumpTables[i];
+                destTable.branchOffsets = sourceTable.branchOffsets;
+                destTable.min = sourceTable.min;
+            }
+        }
+    }
+
+    // Allocate metadata buffers for the bytecode
+#if ENABLE(LLINT)
+    if (size_t size = unlinkedCodeBlock->numberOfLLintCallLinkInfos())
+        m_llintCallLinkInfos.grow(size);
+#endif
+#if ENABLE(DFG_JIT)
+    if (size_t size = unlinkedCodeBlock->numberOfArrayProfiles())
+        m_arrayProfiles.grow(size);
+    if (size_t size = unlinkedCodeBlock->numberOfValueProfiles())
+        m_valueProfiles.grow(size);
+#endif
+    if (size_t size = unlinkedCodeBlock->numberOfResolveOperations())
+        m_resolveOperations.grow(size);
+    size_t putToBaseCount = unlinkedCodeBlock->numberOfPutToBaseOperations();
+    m_putToBaseOperations.reserveCapacity(putToBaseCount);
+    for (size_t i = 0; i < putToBaseCount; ++i)
+        m_putToBaseOperations.append(PutToBaseOperation(isStrictMode()));
+
+    ASSERT(m_putToBaseOperations.capacity() == putToBaseCount);
+
+    // Copy and translate the UnlinkedInstructions
+    size_t instructionCount = unlinkedCodeBlock->instructions().size();
+    UnlinkedInstruction* pc = unlinkedCodeBlock->instructions().data();
+    Vector<Instruction> instructions(instructionCount);
+    for (size_t i = 0; i < unlinkedCodeBlock->instructions().size(); ) {
+        unsigned opLength = opcodeLength(pc[i].u.opcode);
+        instructions[i] = globalData()->interpreter->getOpcode(pc[i].u.opcode);
+        for (size_t j = 1; j < opLength; ++j) {
+            if (sizeof(int32_t) != sizeof(intptr_t))
+                instructions[i + j].u.pointer = 0;
+            instructions[i + j].u.operand = pc[i + j].u.operand;
+        }
+        switch (pc[i].u.opcode) {
+#if ENABLE(DFG_JIT)
+        case op_get_by_val:
+        case op_get_argument_by_val: {
+            int arrayProfileIndex = pc[i + opLength - 2].u.operand;
+            m_arrayProfiles[arrayProfileIndex] = ArrayProfile(i);
+
+            instructions[i + opLength - 2] = &m_arrayProfiles[arrayProfileIndex];
+            // fallthrough
+        }
+        case op_convert_this:
+        case op_resolve:
+        case op_resolve_base:
+        case op_resolve_with_base:
+        case op_resolve_with_this:
+        case op_get_by_id:
+        case op_call_put_result: {
+            ValueProfile* profile = &m_valueProfiles[pc[i + opLength - 1].u.operand];
+            ASSERT(profile->m_bytecodeOffset == -1);
+            profile->m_bytecodeOffset = i;
+            instructions[i + opLength - 1] = profile;
+            break;
+        }
+        case op_put_by_val: {
+            int arrayProfileIndex = pc[i + opLength - 1].u.operand;
+            m_arrayProfiles[arrayProfileIndex] = ArrayProfile(i);
+            instructions[i + opLength - 1] = &m_arrayProfiles[arrayProfileIndex];
+            break;
+        }
+
+        case op_call:
+        case op_call_eval: {
+            int arrayProfileIndex = pc[i + opLength - 1].u.operand;
+            m_arrayProfiles[arrayProfileIndex] = ArrayProfile(i);
+            instructions[i + opLength - 1] = &m_arrayProfiles[arrayProfileIndex];
+            // fallthrough
+        }
+#endif
+#if ENABLE(LLINT)
+        case op_construct:
+            instructions[i + 4] = &m_llintCallLinkInfos[pc[i + 4].u.operand];
+            break;
+#endif
+        case op_get_by_id_out_of_line:
+        case op_get_by_id_self:
+        case op_get_by_id_proto:
+        case op_get_by_id_chain:
+        case op_get_by_id_getter_self:
+        case op_get_by_id_getter_proto:
+        case op_get_by_id_getter_chain:
+        case op_get_by_id_custom_self:
+        case op_get_by_id_custom_proto:
+        case op_get_by_id_custom_chain:
+        case op_get_by_id_generic:
+        case op_get_array_length:
+        case op_get_string_length:
+            CRASH();
+
+        case op_init_global_const_nop: {
+            ASSERT(codeType() == GlobalCode);
+            Identifier ident = identifier(pc[i + 4].u.operand);
+            SymbolTableEntry entry = globalObject->symbolTable()->get(ident.impl());
+            if (entry.isNull())
+                break;
+
+            if (entry.couldBeWatched()) {
+                instructions[i + 0] = globalData()->interpreter->getOpcode(op_init_global_const_check);
+                instructions[i + 1] = &globalObject->registerAt(entry.getIndex());
+                instructions[i + 3] = entry.addressOfIsWatched();
+                break;
+            }
+
+            instructions[i + 0] = globalData()->interpreter->getOpcode(op_init_global_const);
+            instructions[i + 1] = &globalObject->registerAt(entry.getIndex());
+            break;
+        }
+        default:
+            break;
+        }
+        i += opLength;
+    }
+    m_instructions = WTF::RefCountedArray<Instruction>(instructions);
+
+    if (BytecodeGenerator::dumpsGeneratedCode())
+        dump(m_globalObject->globalExec());
+    m_globalData->finishedCompiling(this);
 }
 
 CodeBlock::~CodeBlock()
@@ -1745,15 +1906,6 @@ void CodeBlock::setNumParameters(int newValue)
 #endif
 }
 
-void CodeBlock::addParameter()
-{
-    m_numParameters++;
-
-#if ENABLE(VALUE_PROFILER)
-    m_argumentValueProfiles.append(ValueProfile());
-#endif
-}
-
 void CodeBlock::visitStructures(SlotVisitor& visitor, Instruction* vPC)
 {
     Interpreter* interpreter = m_globalData->interpreter;
@@ -1836,6 +1988,8 @@ void CodeBlock::visitAggregate(SlotVisitor& visitor)
     if (!!m_alternative)
         m_alternative->visitAggregate(visitor);
 
+    visitor.append(&m_unlinkedCode);
+
     // There are three things that may use unconditional finalizers: lazy bytecode freeing,
     // inline cache clearing, and jettisoning. The probability of us wanting to do at
     // least one of those things is probably quite close to 1. So we add one no matter what
@@ -1950,8 +2104,9 @@ void CodeBlock::finalizeUnconditionally()
 #if ENABLE(LLINT)
     Interpreter* interpreter = m_globalData->interpreter;
     if (!!numberOfInstructions()) {
-        for (size_t size = m_propertyAccessInstructions.size(), i = 0; i < size; ++i) {
-            Instruction* curInstruction = &instructions()[m_propertyAccessInstructions[i]];
+        const Vector<unsigned>& propertyAccessInstructions = m_unlinkedCode->propertyAccessInstructions();
+        for (size_t size = propertyAccessInstructions.size(), i = 0; i < size; ++i) {
+            Instruction* curInstruction = &instructions()[propertyAccessInstructions[i]];
             switch (interpreter->getOpcodeID(curInstruction[0].u.opcode)) {
             case op_get_by_id:
             case op_get_by_id_out_of_line:
@@ -2061,36 +2216,6 @@ void CodeBlock::finalizeUnconditionally()
             
             resetStubInternal(repatchBuffer, stubInfo);
         }
-
-        for (size_t size = m_methodCallLinkInfos.size(), i = 0; i < size; ++i) {
-            if (!m_methodCallLinkInfos[i].cachedStructure)
-                continue;
-            
-            ASSERT(m_methodCallLinkInfos[i].seenOnce());
-            ASSERT(!!m_methodCallLinkInfos[i].cachedPrototypeStructure);
-
-            if (!Heap::isMarked(m_methodCallLinkInfos[i].cachedStructure.get())
-                || !Heap::isMarked(m_methodCallLinkInfos[i].cachedPrototypeStructure.get())
-                || !Heap::isMarked(m_methodCallLinkInfos[i].cachedFunction.get())
-                || !Heap::isMarked(m_methodCallLinkInfos[i].cachedPrototype.get())) {
-                if (verboseUnlinking)
-                    dataLog("Clearing method call in %p.\n", this);
-                m_methodCallLinkInfos[i].reset(repatchBuffer, getJITType());
-
-                StructureStubInfo& stubInfo = getStubInfo(m_methodCallLinkInfos[i].bytecodeIndex);
-
-                AccessType accessType = static_cast<AccessType>(stubInfo.accessType);
-
-                if (accessType != access_unset) {
-                    ASSERT(isGetByIdAccess(accessType));
-                    if (getJITCode().jitType() == JITCode::DFGJIT)
-                        DFG::dfgResetGetByID(repatchBuffer, stubInfo);
-                    else
-                        JIT::resetPatchGetById(repatchBuffer, &stubInfo);
-                    stubInfo.reset();
-                }
-            }
-        }
     }
 #endif
 }
@@ -2133,14 +2258,9 @@ void CodeBlock::stronglyVisitStrongReferences(SlotVisitor& visitor)
 {
     visitor.append(&m_globalObject);
     visitor.append(&m_ownerExecutable);
-    visitor.append(&m_symbolTable);
-    if (m_rareData) {
+    visitor.append(&m_unlinkedCode);
+    if (m_rareData)
         m_rareData->m_evalCodeCache.visitAggregate(visitor);
-        size_t regExpCount = m_rareData->m_regexps.size();
-        WriteBarrier<RegExp>* regexps = m_rareData->m_regexps.data();
-        for (size_t i = 0; i < regExpCount; i++)
-            visitor.append(regexps + i);
-    }
     visitor.appendValues(m_constantRegisters.data(), m_constantRegisters.size());
     for (size_t i = 0; i < m_functionExprs.size(); ++i)
         visitor.append(&m_functionExprs[i]);
@@ -2267,76 +2387,27 @@ HandlerInfo* CodeBlock::handlerForBytecodeOffset(unsigned bytecodeOffset)
 int CodeBlock::lineNumberForBytecodeOffset(unsigned bytecodeOffset)
 {
     ASSERT(bytecodeOffset < instructions().size());
-
-    Vector<LineInfo>& lineInfo = m_lineInfo;
-
-    int low = 0;
-    int high = lineInfo.size();
-    while (low < high) {
-        int mid = low + (high - low) / 2;
-        if (lineInfo[mid].instructionOffset <= bytecodeOffset)
-            low = mid + 1;
-        else
-            high = mid;
-    }
-
-    if (!low)
-        return m_ownerExecutable->source().firstLine();
-    return lineInfo[low - 1].lineNumber;
+    return m_ownerExecutable->lineNo() + m_unlinkedCode->lineNumberForBytecodeOffset(bytecodeOffset);
 }
 
 void CodeBlock::expressionRangeForBytecodeOffset(unsigned bytecodeOffset, int& divot, int& startOffset, int& endOffset)
 {
-    ASSERT(bytecodeOffset < instructions().size());
-
-    if (!m_rareData) {
-        startOffset = 0;
-        endOffset = 0;
-        divot = 0;
-        return;
-    }
-
-    Vector<ExpressionRangeInfo>& expressionInfo = m_rareData->m_expressionInfo;
-
-    int low = 0;
-    int high = expressionInfo.size();
-    while (low < high) {
-        int mid = low + (high - low) / 2;
-        if (expressionInfo[mid].instructionOffset <= bytecodeOffset)
-            low = mid + 1;
-        else
-            high = mid;
-    }
-
-    ASSERT(low);
-    if (!low) {
-        startOffset = 0;
-        endOffset = 0;
-        divot = 0;
-        return;
-    }
-
-    startOffset = expressionInfo[low - 1].startOffset;
-    endOffset = expressionInfo[low - 1].endOffset;
-    divot = expressionInfo[low - 1].divotPoint + m_sourceOffset;
-    return;
+    m_unlinkedCode->expressionRangeForBytecodeOffset(bytecodeOffset, divot, startOffset, endOffset);
+    divot += m_sourceOffset;
 }
 
 void CodeBlock::shrinkToFit(ShrinkMode shrinkMode)
 {
-    m_propertyAccessInstructions.shrinkToFit();
 #if ENABLE(LLINT)
     m_llintCallLinkInfos.shrinkToFit();
 #endif
 #if ENABLE(JIT)
     m_structureStubInfos.shrinkToFit();
     m_callLinkInfos.shrinkToFit();
-    m_methodCallLinkInfos.shrinkToFit();
 #endif
 #if ENABLE(VALUE_PROFILER)
     if (shrinkMode == EarlyShrink)
         m_argumentValueProfiles.shrinkToFit();
-    m_valueProfiles.shrinkToFit();
     m_rareCaseProfiles.shrinkToFit();
     m_specialFastCaseProfiles.shrinkToFit();
 #endif
@@ -2348,15 +2419,11 @@ void CodeBlock::shrinkToFit(ShrinkMode shrinkMode)
         m_constantRegisters.shrinkToFit();
     } // else don't shrink these, because we would have already pointed pointers into these tables.
 
-    m_resolveOperations.shrinkToFit();
-    m_lineInfo.shrinkToFit();
     if (m_rareData) {
         m_rareData->m_exceptionHandlers.shrinkToFit();
-        m_rareData->m_regexps.shrinkToFit();
         m_rareData->m_immediateSwitchJumpTables.shrinkToFit();
         m_rareData->m_characterSwitchJumpTables.shrinkToFit();
         m_rareData->m_stringSwitchJumpTables.shrinkToFit();
-        m_rareData->m_expressionInfo.shrinkToFit();
 #if ENABLE(JIT)
         m_rareData->m_callReturnIndexVector.shrinkToFit();
 #endif
@@ -2384,7 +2451,7 @@ void CodeBlock::createActivation(CallFrame* callFrame)
     ASSERT(codeType() == FunctionCode);
     ASSERT(needsFullScopeChain());
     ASSERT(!callFrame->uncheckedR(activationRegister()).jsValue());
-    JSActivation* activation = JSActivation::create(callFrame->globalData(), callFrame, static_cast<FunctionExecutable*>(ownerExecutable()));
+    JSActivation* activation = JSActivation::create(callFrame->globalData(), callFrame, this);
     callFrame->uncheckedR(activationRegister()) = JSValue(activation);
     callFrame->setScope(activation);
 }
@@ -2410,7 +2477,7 @@ void CodeBlock::unlinkCalls()
             m_llintCallLinkInfos[i].unlink();
     }
 #endif
-    if (!(m_callLinkInfos.size() || m_methodCallLinkInfos.size()))
+    if (!m_callLinkInfos.size())
         return;
     if (!m_globalData->canUseJIT())
         return;
@@ -2725,7 +2792,7 @@ void CodeBlock::updateAllPredictionsAndCountLiveness(
     // site also has a value profile site - so we already know whether or not it's
     // live.
     for (unsigned i = m_arrayProfiles.size(); i--;)
-        m_arrayProfiles[i].computeUpdatedPrediction(operation);
+        m_arrayProfiles[i].computeUpdatedPrediction(this, operation);
 }
 
 void CodeBlock::updateAllPredictions(OperationInProgress operation)
@@ -2879,8 +2946,8 @@ bool CodeBlock::usesOpcode(OpcodeID opcodeID)
 
 String CodeBlock::nameForRegister(int registerNumber)
 {
-    SymbolTable::iterator end = m_symbolTable->end();
-    for (SymbolTable::iterator ptr = m_symbolTable->begin(); ptr != end; ++ptr) {
+    SymbolTable::iterator end = symbolTable()->end();
+    for (SymbolTable::iterator ptr = symbolTable()->begin(); ptr != end; ++ptr) {
         if (ptr->value.getIndex() == registerNumber)
             return String(ptr->key);
     }
diff --git a/Source/JavaScriptCore/bytecode/CodeBlock.h b/Source/JavaScriptCore/bytecode/CodeBlock.h
index fe588c787..a28064940 100644
--- a/Source/JavaScriptCore/bytecode/CodeBlock.h
+++ b/Source/JavaScriptCore/bytecode/CodeBlock.h
@@ -50,7 +50,6 @@
 #include "ExecutionCounter.h"
 #include "ExpressionRangeInfo.h"
 #include "HandlerInfo.h"
-#include "MethodCallLinkInfo.h"
 #include "Options.h"
 #include "Instruction.h"
 #include "JITCode.h"
@@ -121,7 +120,7 @@ namespace JSC {
     protected:
         CodeBlock(CopyParsedBlockTag, CodeBlock& other);
         
-        CodeBlock(ScriptExecutable* ownerExecutable, CodeType, JSGlobalObject*, PassRefPtr<SourceProvider>, unsigned sourceOffset, bool isConstructor, PassOwnPtr<CodeBlock> alternative);
+        CodeBlock(ScriptExecutable* ownerExecutable, UnlinkedCodeBlock*, JSGlobalObject*, unsigned baseScopeDepth, PassRefPtr<SourceProvider>, unsigned sourceOffset, PassOwnPtr<CodeBlock> alternative);
 
         WriteBarrier<JSGlobalObject> m_globalObject;
         Heap* m_heap;
@@ -131,7 +130,6 @@ namespace JSC {
         
         int numParameters() const { return m_numParameters; }
         void setNumParameters(int newValue);
-        void addParameter();
         
         int* addressOfNumParameters() { return &m_numParameters; }
         static ptrdiff_t offsetOfNumParameters() { return OBJECT_OFFSETOF(CodeBlock, m_numParameters); }
@@ -249,16 +247,6 @@ namespace JSC {
         {
             return *(binarySearch<CallLinkInfo, unsigned, getCallLinkInfoBytecodeIndex>(m_callLinkInfos.begin(), m_callLinkInfos.size(), bytecodeIndex));
         }
-
-        MethodCallLinkInfo& getMethodCallLinkInfo(ReturnAddressPtr returnAddress)
-        {
-            return *(binarySearch<MethodCallLinkInfo, void*, getMethodCallLinkInfoReturnLocation>(m_methodCallLinkInfos.begin(), m_methodCallLinkInfos.size(), returnAddress.value()));
-        }
-
-        MethodCallLinkInfo& getMethodCallLinkInfo(unsigned bytecodeIndex)
-        {
-            return *(binarySearch<MethodCallLinkInfo, unsigned, getMethodCallLinkInfoBytecodeIndex>(m_methodCallLinkInfos.begin(), m_methodCallLinkInfos.size(), bytecodeIndex));
-        }
 #endif // ENABLE(JIT)
 
 #if ENABLE(LLINT)
@@ -445,8 +433,7 @@ namespace JSC {
             return static_cast<Instruction*>(returnAddress) - instructions().begin();
         }
 
-        void setIsNumericCompareFunction(bool isNumericCompareFunction) { m_isNumericCompareFunction = isNumericCompareFunction; }
-        bool isNumericCompareFunction() { return m_isNumericCompareFunction; }
+        bool isNumericCompareFunction() { return m_unlinkedCode->isNumericCompareFunction(); }
 
         unsigned numberOfInstructions() const { return m_instructions.size(); }
         RefCountedArray<Instruction>& instructions() { return m_instructions; }
@@ -535,10 +522,8 @@ namespace JSC {
         void setThisRegister(int thisRegister) { m_thisRegister = thisRegister; }
         int thisRegister() const { return m_thisRegister; }
 
-        void setNeedsFullScopeChain(bool needsFullScopeChain) { m_needsFullScopeChain = needsFullScopeChain; }
-        bool needsFullScopeChain() const { return m_needsFullScopeChain; }
-        void setUsesEval(bool usesEval) { m_usesEval = usesEval; }
-        bool usesEval() const { return m_usesEval; }
+        bool needsFullScopeChain() const { return m_unlinkedCode->needsFullScopeChain(); }
+        bool usesEval() const { return m_unlinkedCode->usesEval(); }
         
         void setArgumentsRegister(int argumentsRegister)
         {
@@ -600,37 +585,28 @@ namespace JSC {
             if (usesArguments() && operand == unmodifiedArgumentsRegister(argumentsRegister()))
                 return true;
 
-            return operand >= m_symbolTable->captureStart() 
-                && operand < m_symbolTable->captureEnd();
+            // We're in global code so there are no locals to capture
+            if (!symbolTable())
+                return false;
+
+            return operand >= symbolTable()->captureStart()
+                && operand < symbolTable()->captureEnd();
         }
 
-        CodeType codeType() const { return m_codeType; }
+        CodeType codeType() const { return m_unlinkedCode->codeType(); }
 
         SourceProvider* source() const { return m_source.get(); }
         unsigned sourceOffset() const { return m_sourceOffset; }
 
-        size_t numberOfJumpTargets() const { return m_jumpTargets.size(); }
-        void addJumpTarget(unsigned jumpTarget) { m_jumpTargets.append(jumpTarget); }
-        unsigned jumpTarget(int index) const { return m_jumpTargets[index]; }
-        unsigned lastJumpTarget() const { return m_jumpTargets.last(); }
+        size_t numberOfJumpTargets() const { return m_unlinkedCode->numberOfJumpTargets(); }
+        unsigned jumpTarget(int index) const { return m_unlinkedCode->jumpTarget(index); }
 
         void createActivation(CallFrame*);
 
         void clearEvalCache();
         
         String nameForRegister(int registerNumber);
-        
-        void addPropertyAccessInstruction(unsigned propertyAccessInstruction)
-        {
-            m_propertyAccessInstructions.append(propertyAccessInstruction);
-        }
-#if ENABLE(LLINT)
-        LLIntCallLinkInfo* addLLIntCallLinkInfo()
-        {
-            m_llintCallLinkInfos.append(LLIntCallLinkInfo());
-            return &m_llintCallLinkInfos.last();
-        }
-#endif
+
 #if ENABLE(JIT)
         void setNumberOfStructureStubInfos(size_t size) { m_structureStubInfos.grow(size); }
         size_t numberOfStructureStubInfos() const { return m_structureStubInfos.size(); }
@@ -643,10 +619,6 @@ namespace JSC {
         void setNumberOfCallLinkInfos(size_t size) { m_callLinkInfos.grow(size); }
         size_t numberOfCallLinkInfos() const { return m_callLinkInfos.size(); }
         CallLinkInfo& callLinkInfo(int index) { return m_callLinkInfos[index]; }
-
-        void addMethodCallLinkInfos(unsigned n) { ASSERT(m_globalData->canUseJIT()); m_methodCallLinkInfos.grow(n); }
-        MethodCallLinkInfo& methodCallLinkInfo(int index) { return m_methodCallLinkInfos[index]; }
-        size_t numberOfMethodCallLinkInfos() { return m_methodCallLinkInfos.size(); }
 #endif
         
 #if ENABLE(VALUE_PROFILER)
@@ -662,14 +634,7 @@ namespace JSC {
             ASSERT(result->m_bytecodeOffset == -1);
             return result;
         }
-        
-        ValueProfile* addValueProfile(int bytecodeOffset)
-        {
-            ASSERT(bytecodeOffset != -1);
-            ASSERT(m_valueProfiles.isEmpty() || m_valueProfiles.last().m_bytecodeOffset < bytecodeOffset);
-            m_valueProfiles.append(ValueProfile(bytecodeOffset));
-            return &m_valueProfiles.last();
-        }
+
         unsigned numberOfValueProfiles() { return m_valueProfiles.size(); }
         ValueProfile* valueProfile(int index)
         {
@@ -795,25 +760,24 @@ namespace JSC {
         // Exception handling support
 
         size_t numberOfExceptionHandlers() const { return m_rareData ? m_rareData->m_exceptionHandlers.size() : 0; }
-        void addExceptionHandler(const HandlerInfo& hanler) { createRareDataIfNecessary(); return m_rareData->m_exceptionHandlers.append(hanler); }
-        HandlerInfo& exceptionHandler(int index) { ASSERT(m_rareData); return m_rareData->m_exceptionHandlers[index]; }
-
-        void addExpressionInfo(const ExpressionRangeInfo& expressionInfo)
+        void allocateHandlers(const Vector<UnlinkedHandlerInfo>& unlinkedHandlers)
         {
+            size_t count = unlinkedHandlers.size();
+            if (!count)
+                return;
             createRareDataIfNecessary();
-            m_rareData->m_expressionInfo.append(expressionInfo);
-        }
-
-        void addLineInfo(unsigned bytecodeOffset, int lineNo)
-        {
-            Vector<LineInfo>& lineInfo = m_lineInfo;
-            if (!lineInfo.size() || lineInfo.last().lineNumber != lineNo) {
-                LineInfo info = { bytecodeOffset, lineNo };
-                lineInfo.append(info);
+            m_rareData->m_exceptionHandlers.resize(count);
+            for (size_t i = 0; i < count; ++i) {
+                m_rareData->m_exceptionHandlers[i].start = unlinkedHandlers[i].start;
+                m_rareData->m_exceptionHandlers[i].end = unlinkedHandlers[i].end;
+                m_rareData->m_exceptionHandlers[i].target = unlinkedHandlers[i].target;
+                m_rareData->m_exceptionHandlers[i].scopeDepth = unlinkedHandlers[i].scopeDepth;
             }
+
         }
+        HandlerInfo& exceptionHandler(int index) { ASSERT(m_rareData); return m_rareData->m_exceptionHandlers[index]; }
 
-        bool hasExpressionInfo() { return m_rareData && m_rareData->m_expressionInfo.size(); }
+        bool hasExpressionInfo() { return m_unlinkedCode->hasExpressionInfo(); }
 
 #if ENABLE(JIT)
         Vector<CallReturnOffsetToBytecodeOffset>& callReturnIndexVector()
@@ -888,6 +852,8 @@ namespace JSC {
             m_constantRegisters.last().set(m_globalObject->globalData(), m_ownerExecutable.get(), v);
             return result;
         }
+
+
         unsigned addOrFindConstant(JSValue);
         WriteBarrier<Unknown>& constantRegister(int index) { return m_constantRegisters[index - FirstConstantRegisterIndex]; }
         ALWAYS_INLINE bool isConstantRegisterIndex(int index) const { return index >= FirstConstantRegisterIndex; }
@@ -911,20 +877,7 @@ namespace JSC {
         }
         FunctionExecutable* functionExpr(int index) { return m_functionExprs[index].get(); }
 
-        unsigned addRegExp(RegExp* r)
-        {
-            createRareDataIfNecessary();
-            unsigned size = m_rareData->m_regexps.size();
-            m_rareData->m_regexps.append(WriteBarrier<RegExp>(*m_globalData, ownerExecutable(), r));
-            return size;
-        }
-        unsigned numberOfRegExps() const
-        {
-            if (!m_rareData)
-                return 0;
-            return m_rareData->m_regexps.size();
-        }
-        RegExp* regexp(int index) const { ASSERT(m_rareData); return m_rareData->m_regexps[index].get(); }
+        RegExp* regexp(int index) const { return m_unlinkedCode->regexp(index); }
 
         unsigned numberOfConstantBuffers() const
         {
@@ -939,10 +892,6 @@ namespace JSC {
             m_rareData->m_constantBuffers.append(buffer);
             return size;
         }
-        unsigned addConstantBuffer(unsigned length)
-        {
-            return addConstantBuffer(Vector<JSValue>(length));
-        }
 
         Vector<JSValue>& constantBufferAsVector(unsigned index)
         {
@@ -979,7 +928,7 @@ namespace JSC {
         StringJumpTable& stringSwitchJumpTable(int tableIndex) { ASSERT(m_rareData); return m_rareData->m_stringSwitchJumpTables[tableIndex]; }
 
 
-        SharedSymbolTable* symbolTable() { return m_symbolTable.get(); }
+        SharedSymbolTable* symbolTable() const { return m_unlinkedCode->symbolTable(); }
 
         EvalCodeCache& evalCodeCache() { createRareDataIfNecessary(); return m_rareData->m_evalCodeCache; }
 
@@ -1216,9 +1165,6 @@ namespace JSC {
         int m_numVars;
         bool m_isConstructor;
 
-        int globalObjectConstant() const { return m_globalObjectConstant; }
-        void setGlobalObjectConstant(int globalRegister) { m_globalObjectConstant = globalRegister; }
-
     protected:
 #if ENABLE(JIT)
         virtual bool jitCompileImpl(ExecState*) = 0;
@@ -1226,6 +1172,8 @@ namespace JSC {
         virtual void visitWeakReferences(SlotVisitor&);
         virtual void finalizeUnconditionally();
 
+        UnlinkedCodeBlock* unlinkedCodeBlock() const { return m_unlinkedCode.get(); }
+
     private:
         friend class DFGCodeBlocks;
         
@@ -1237,7 +1185,21 @@ namespace JSC {
 #if ENABLE(VALUE_PROFILER)
         void updateAllPredictionsAndCountLiveness(OperationInProgress, unsigned& numberOfLiveNonArgumentValueProfiles, unsigned& numberOfSamplesInProfiles);
 #endif
-        
+
+        void setIdentifiers(const Vector<Identifier>& identifiers)
+        {
+            ASSERT(m_identifiers.isEmpty());
+            m_identifiers.appendVector(identifiers);
+        }
+
+        void setConstantRegisters(const Vector<WriteBarrier<Unknown> >& constants)
+        {
+            size_t count = constants.size();
+            m_constantRegisters.resize(count);
+            for (size_t i = 0; i < count; i++)
+                m_constantRegisters[i].set(*m_globalData, ownerExecutable(), constants[i].get());
+        }
+
         void dump(ExecState*, const Vector<Instruction>::const_iterator& begin, Vector<Instruction>::const_iterator&);
 
         CString registerName(ExecState*, int r) const;
@@ -1287,30 +1249,21 @@ namespace JSC {
 #if ENABLE(JIT)
         void resetStubInternal(RepatchBuffer&, StructureStubInfo&);
 #endif
-        
+        WriteBarrier<UnlinkedCodeBlock> m_unlinkedCode;
         int m_numParameters;
-
         WriteBarrier<ScriptExecutable> m_ownerExecutable;
         JSGlobalData* m_globalData;
 
         RefCountedArray<Instruction> m_instructions;
-
         int m_thisRegister;
         int m_argumentsRegister;
         int m_activationRegister;
-        int m_globalObjectConstant;
 
-        bool m_needsFullScopeChain;
-        bool m_usesEval;
-        bool m_isNumericCompareFunction;
         bool m_isStrictMode;
 
-        CodeType m_codeType;
-
         RefPtr<SourceProvider> m_source;
         unsigned m_sourceOffset;
 
-        Vector<unsigned> m_propertyAccessInstructions;
 #if ENABLE(LLINT)
         SegmentedVector<LLIntCallLinkInfo, 8> m_llintCallLinkInfos;
         SentinelLinkedList<LLIntCallLinkInfo, BasicRawSentinelNode<LLIntCallLinkInfo> > m_incomingLLIntCalls;
@@ -1319,7 +1272,6 @@ namespace JSC {
         Vector<StructureStubInfo> m_structureStubInfos;
         Vector<ByValInfo> m_byValInfos;
         Vector<CallLinkInfo> m_callLinkInfos;
-        Vector<MethodCallLinkInfo> m_methodCallLinkInfos;
         JITCode m_jitCode;
         MacroAssemblerCodePtr m_jitCodeWithArityCheck;
         SentinelLinkedList<CallLinkInfo, BasicRawSentinelNode<CallLinkInfo> > m_incomingCalls;
@@ -1382,18 +1334,15 @@ namespace JSC {
         unsigned m_executionEntryCount;
 #endif
 
-        Vector<unsigned> m_jumpTargets;
-        Vector<unsigned> m_loopTargets;
-
         // Constant Pool
         Vector<Identifier> m_identifiers;
         COMPILE_ASSERT(sizeof(Register) == sizeof(WriteBarrier<Unknown>), Register_must_be_same_size_as_WriteBarrier_Unknown);
+        // TODO: This could just be a pointer to m_unlinkedCodeBlock's data, but the DFG mutates
+        // it, so we're stuck with it for now.
         Vector<WriteBarrier<Unknown> > m_constantRegisters;
         Vector<WriteBarrier<FunctionExecutable> > m_functionDecls;
         Vector<WriteBarrier<FunctionExecutable> > m_functionExprs;
 
-        WriteBarrier<SharedSymbolTable> m_symbolTable;
-
         OwnPtr<CodeBlock> m_alternative;
         
         ExecutionCounter m_llintExecuteCounter;
@@ -1404,22 +1353,14 @@ namespace JSC {
         uint16_t m_optimizationDelayCounter;
         uint16_t m_reoptimizationRetryCounter;
 
-        Vector<LineInfo> m_lineInfo;
-#if ENABLE(BYTECODE_COMMENTS)
-        Vector<Comment>  m_bytecodeComments;
-        size_t m_bytecodeCommentIterator;
-#endif
         Vector<ResolveOperations> m_resolveOperations;
-        Vector<PutToBaseOperation> m_putToBaseOperations;
+        Vector<PutToBaseOperation, 1> m_putToBaseOperations;
 
         struct RareData {
            WTF_MAKE_FAST_ALLOCATED;
         public:
             Vector<HandlerInfo> m_exceptionHandlers;
 
-            // Rare Constants
-            Vector<WriteBarrier<RegExp> > m_regexps;
-
             // Buffers used for large array literals
             Vector<Vector<JSValue> > m_constantBuffers;
             
@@ -1430,9 +1371,6 @@ namespace JSC {
 
             EvalCodeCache m_evalCodeCache;
 
-            // Expression info - present if debugging.
-            Vector<ExpressionRangeInfo> m_expressionInfo;
-            // Line info - present if profiling or debugging.
 #if ENABLE(JIT)
             Vector<CallReturnOffsetToBytecodeOffset> m_callReturnIndexVector;
 #endif
@@ -1460,8 +1398,8 @@ namespace JSC {
         {
         }
         
-        GlobalCodeBlock(ScriptExecutable* ownerExecutable, CodeType codeType, JSGlobalObject* globalObject, PassRefPtr<SourceProvider> sourceProvider, unsigned sourceOffset, PassOwnPtr<CodeBlock> alternative)
-            : CodeBlock(ownerExecutable, codeType, globalObject, sourceProvider, sourceOffset, false, alternative)
+        GlobalCodeBlock(ScriptExecutable* ownerExecutable, UnlinkedCodeBlock* unlinkedCodeBlock, JSGlobalObject* globalObject, unsigned baseScopeDepth, PassRefPtr<SourceProvider> sourceProvider, unsigned sourceOffset, PassOwnPtr<CodeBlock> alternative)
+            : CodeBlock(ownerExecutable, unlinkedCodeBlock, globalObject, baseScopeDepth, sourceProvider, sourceOffset, alternative)
         {
         }
     };
@@ -1473,11 +1411,11 @@ namespace JSC {
         {
         }
 
-        ProgramCodeBlock(ProgramExecutable* ownerExecutable, CodeType codeType, JSGlobalObject* globalObject, PassRefPtr<SourceProvider> sourceProvider, PassOwnPtr<CodeBlock> alternative)
-            : GlobalCodeBlock(ownerExecutable, codeType, globalObject, sourceProvider, 0, alternative)
+        ProgramCodeBlock(ProgramExecutable* ownerExecutable, UnlinkedProgramCodeBlock* unlinkedCodeBlock, JSGlobalObject* globalObject, PassRefPtr<SourceProvider> sourceProvider, PassOwnPtr<CodeBlock> alternative)
+            : GlobalCodeBlock(ownerExecutable, unlinkedCodeBlock, globalObject, 0, sourceProvider, 0, alternative)
         {
         }
-        
+
 #if ENABLE(JIT)
     protected:
         virtual JSObject* compileOptimized(ExecState*, JSScope*, unsigned bytecodeIndex);
@@ -1492,26 +1430,16 @@ namespace JSC {
     public:
         EvalCodeBlock(CopyParsedBlockTag, EvalCodeBlock& other)
             : GlobalCodeBlock(CopyParsedBlock, other)
-            , m_baseScopeDepth(other.m_baseScopeDepth)
-            , m_variables(other.m_variables)
         {
         }
         
-        EvalCodeBlock(EvalExecutable* ownerExecutable, JSGlobalObject* globalObject, PassRefPtr<SourceProvider> sourceProvider, int baseScopeDepth, PassOwnPtr<CodeBlock> alternative)
-            : GlobalCodeBlock(ownerExecutable, EvalCode, globalObject, sourceProvider, 0, alternative)
-            , m_baseScopeDepth(baseScopeDepth)
+        EvalCodeBlock(EvalExecutable* ownerExecutable, UnlinkedEvalCodeBlock* unlinkedCodeBlock, JSGlobalObject* globalObject, PassRefPtr<SourceProvider> sourceProvider, int baseScopeDepth, PassOwnPtr<CodeBlock> alternative)
+            : GlobalCodeBlock(ownerExecutable, unlinkedCodeBlock, globalObject, baseScopeDepth, sourceProvider, 0, alternative)
         {
         }
 
-        int baseScopeDepth() const { return m_baseScopeDepth; }
-
-        const Identifier& variable(unsigned index) { return m_variables[index]; }
-        unsigned numVariables() { return m_variables.size(); }
-        void adoptVariables(Vector<Identifier>& variables)
-        {
-            ASSERT(m_variables.isEmpty());
-            m_variables.swap(variables);
-        }
+        const Identifier& variable(unsigned index) { return unlinkedEvalCodeBlock()->variable(index); }
+        unsigned numVariables() { return unlinkedEvalCodeBlock()->numVariables(); }
         
 #if ENABLE(JIT)
     protected:
@@ -1523,8 +1451,7 @@ namespace JSC {
 #endif
 
     private:
-        int m_baseScopeDepth;
-        Vector<Identifier> m_variables;
+        UnlinkedEvalCodeBlock* unlinkedEvalCodeBlock() const { return jsCast<UnlinkedEvalCodeBlock*>(unlinkedCodeBlock()); }
     };
 
     class FunctionCodeBlock : public CodeBlock {
@@ -1534,8 +1461,8 @@ namespace JSC {
         {
         }
 
-        FunctionCodeBlock(FunctionExecutable* ownerExecutable, CodeType codeType, JSGlobalObject* globalObject, PassRefPtr<SourceProvider> sourceProvider, unsigned sourceOffset, bool isConstructor, PassOwnPtr<CodeBlock> alternative = nullptr)
-            : CodeBlock(ownerExecutable, codeType, globalObject, sourceProvider, sourceOffset, isConstructor, alternative)
+        FunctionCodeBlock(FunctionExecutable* ownerExecutable, UnlinkedFunctionCodeBlock* unlinkedCodeBlock, JSGlobalObject* globalObject, PassRefPtr<SourceProvider> sourceProvider, unsigned sourceOffset, PassOwnPtr<CodeBlock> alternative = nullptr)
+            : CodeBlock(ownerExecutable, unlinkedCodeBlock, globalObject, 0, sourceProvider, sourceOffset, alternative)
         {
         }
         
diff --git a/Source/JavaScriptCore/bytecode/DFGExitProfile.h b/Source/JavaScriptCore/bytecode/DFGExitProfile.h
index 57fb06bda..60d313ad4 100644
--- a/Source/JavaScriptCore/bytecode/DFGExitProfile.h
+++ b/Source/JavaScriptCore/bytecode/DFGExitProfile.h
@@ -36,6 +36,7 @@ enum ExitKind {
     ExitKindUnset,
     BadType, // We exited because a type prediction was wrong.
     BadCache, // We exited because an inline cache was wrong.
+    BadWeakConstantCache, // We exited because a cache on a weak constant (usually a prototype) was wrong.
     BadIndexingType, // We exited because an indexing type was wrong.
     Overflow, // We exited because of overflow.
     NegativeZero, // We exited because we encountered negative zero.
@@ -55,6 +56,8 @@ inline const char* exitKindToString(ExitKind kind)
         return "BadType";
     case BadCache:
         return "BadCache";
+    case BadWeakConstantCache:
+        return "BadWeakConstantCache";
     case Overflow:
         return "Overflow";
     case NegativeZero:
diff --git a/Source/JavaScriptCore/bytecode/GetByIdStatus.cpp b/Source/JavaScriptCore/bytecode/GetByIdStatus.cpp
index e44568a26..605a81c2f 100644
--- a/Source/JavaScriptCore/bytecode/GetByIdStatus.cpp
+++ b/Source/JavaScriptCore/bytecode/GetByIdStatus.cpp
@@ -41,9 +41,6 @@ GetByIdStatus GetByIdStatus::computeFromLLInt(CodeBlock* profiledBlock, unsigned
 #if ENABLE(LLINT)
     Instruction* instruction = profiledBlock->instructions().begin() + bytecodeIndex;
     
-    if (instruction[0].u.opcode == LLInt::getOpcode(llint_op_method_check))
-        instruction++;
-    
     if (instruction[0].u.opcode == LLInt::getOpcode(llint_op_get_array_length))
         return GetByIdStatus(NoInformation, false);
 
diff --git a/Source/JavaScriptCore/bytecode/MethodCallLinkStatus.cpp b/Source/JavaScriptCore/bytecode/MethodCallLinkStatus.cpp
deleted file mode 100644
index 795b41b69..000000000
--- a/Source/JavaScriptCore/bytecode/MethodCallLinkStatus.cpp
+++ /dev/null
@@ -1,66 +0,0 @@
-/*
- * Copyright (C) 2012 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#include "config.h"
-#include "MethodCallLinkStatus.h"
-
-#include "CodeBlock.h"
-
-namespace JSC {
-
-MethodCallLinkStatus MethodCallLinkStatus::computeFor(CodeBlock* profiledBlock, unsigned bytecodeIndex)
-{
-    UNUSED_PARAM(profiledBlock);
-    UNUSED_PARAM(bytecodeIndex);
-#if ENABLE(JIT) && ENABLE(VALUE_PROFILER)
-    // NOTE: This does not have an LLInt fall-back because LLInt does not do any method
-    // call link caching.
-    if (!profiledBlock->numberOfMethodCallLinkInfos())
-        return MethodCallLinkStatus();
-    
-    MethodCallLinkInfo& methodCall = profiledBlock->getMethodCallLinkInfo(bytecodeIndex);
-    
-    if (!methodCall.seen || !methodCall.cachedStructure)
-        return MethodCallLinkStatus();
-    
-    if (methodCall.cachedPrototype.get() == profiledBlock->globalObject()->methodCallDummy()) {
-        return MethodCallLinkStatus(
-            methodCall.cachedStructure.get(),
-            0,
-            methodCall.cachedFunction.get(),
-            0);
-    }
-    
-    return MethodCallLinkStatus(
-        methodCall.cachedStructure.get(),
-        methodCall.cachedPrototypeStructure.get(),
-        methodCall.cachedFunction.get(),
-        methodCall.cachedPrototype.get());
-#else // ENABLE(JIT)
-    return MethodCallLinkStatus();
-#endif // ENABLE(JIT)
-}
-
-} // namespace JSC
diff --git a/Source/JavaScriptCore/bytecode/MethodCallLinkStatus.h b/Source/JavaScriptCore/bytecode/MethodCallLinkStatus.h
deleted file mode 100644
index c3d11a1d8..000000000
--- a/Source/JavaScriptCore/bytecode/MethodCallLinkStatus.h
+++ /dev/null
@@ -1,87 +0,0 @@
-/*
- * Copyright (C) 2012 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#ifndef MethodCallLinkStatus_h
-#define MethodCallLinkStatus_h
-
-namespace JSC {
-
-class CodeBlock;
-class JSObject;
-class Structure;
-
-class MethodCallLinkStatus {
-public:
-    MethodCallLinkStatus()
-        : m_structure(0)
-        , m_prototypeStructure(0)
-        , m_function(0)
-        , m_prototype(0)
-    {
-    }
-    
-    MethodCallLinkStatus(
-        Structure* structure,
-        Structure* prototypeStructure,
-        JSObject* function,
-        JSObject* prototype)
-        : m_structure(structure)
-        , m_prototypeStructure(prototypeStructure)
-        , m_function(function)
-        , m_prototype(prototype)
-    {
-        if (!m_function) {
-            ASSERT(!m_structure);
-            ASSERT(!m_prototypeStructure);
-            ASSERT(!m_prototype);
-        } else
-            ASSERT(m_structure);
-        
-        ASSERT(!m_prototype == !m_prototypeStructure);
-    }
-    
-    static MethodCallLinkStatus computeFor(CodeBlock*, unsigned bytecodeIndex);
-
-    bool isSet() const { return !!m_function; }
-    bool operator!() const { return !m_function; }
-    
-    bool needsPrototypeCheck() const { return !!m_prototype; }
-    
-    Structure* structure() { return m_structure; }
-    Structure* prototypeStructure() { return m_prototypeStructure; }
-    JSObject* function() const { return m_function; }
-    JSObject* prototype() const { return m_prototype; }
-    
-private:
-    Structure* m_structure;
-    Structure* m_prototypeStructure;
-    JSObject* m_function;
-    JSObject* m_prototype;
-};
-
-} // namespace JSC
-
-#endif // MethodCallLinkStatus_h
-
diff --git a/Source/JavaScriptCore/bytecode/Opcode.h b/Source/JavaScriptCore/bytecode/Opcode.h
index 3ce56c80e..8979d0b7b 100644
--- a/Source/JavaScriptCore/bytecode/Opcode.h
+++ b/Source/JavaScriptCore/bytecode/Opcode.h
@@ -118,7 +118,8 @@ namespace JSC {
         macro(op_put_to_base, 5) \
         macro(op_put_to_base_variable, 5) \
         \
-        macro(op_init_global_const, 3) \
+        macro(op_init_global_const_nop, 5) \
+        macro(op_init_global_const, 5) \
         macro(op_init_global_const_check, 5) \
         macro(op_get_by_id, 9) /* has value profiling */ \
         macro(op_get_by_id_out_of_line, 9) /* has value profiling */ \
@@ -190,7 +191,6 @@ namespace JSC {
         macro(op_ret, 2) \
         macro(op_call_put_result, 3) /* has value profiling */ \
         macro(op_ret_object_or_this, 3) \
-        macro(op_method_check, 1) \
         \
         macro(op_construct, 6) \
         macro(op_strcat, 4) \
@@ -205,7 +205,7 @@ namespace JSC {
         \
         macro(op_catch, 2) \
         macro(op_throw, 2) \
-        macro(op_throw_reference_error, 2) \
+        macro(op_throw_static_error, 3) \
         \
         macro(op_debug, 5) \
         macro(op_profile_will_call, 2) \
diff --git a/Source/JavaScriptCore/bytecode/SpeculatedType.h b/Source/JavaScriptCore/bytecode/SpeculatedType.h
index 9d2c61ae8..09ba9fdfa 100644
--- a/Source/JavaScriptCore/bytecode/SpeculatedType.h
+++ b/Source/JavaScriptCore/bytecode/SpeculatedType.h
@@ -284,6 +284,11 @@ inline bool mergeSpeculation(T& left, SpeculatedType right)
     return result;
 }
 
+inline bool speculationChecked(SpeculatedType actual, SpeculatedType desired)
+{
+    return (actual | desired) == desired;
+}
+
 SpeculatedType speculationFromClassInfo(const ClassInfo*);
 SpeculatedType speculationFromStructure(Structure*);
 SpeculatedType speculationFromCell(JSCell*);
diff --git a/Source/JavaScriptCore/bytecode/UnlinkedCodeBlock.cpp b/Source/JavaScriptCore/bytecode/UnlinkedCodeBlock.cpp
new file mode 100644
index 000000000..8aa48404a
--- /dev/null
+++ b/Source/JavaScriptCore/bytecode/UnlinkedCodeBlock.cpp
@@ -0,0 +1,294 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#include "UnlinkedCodeBlock.h"
+
+#include "BytecodeGenerator.h"
+#include "ClassInfo.h"
+#include "CodeCache.h"
+#include "Executable.h"
+#include "JSString.h"
+#include "SourceProvider.h"
+#include "Structure.h"
+#include "SymbolTable.h"
+
+namespace JSC {
+
+const ClassInfo UnlinkedFunctionExecutable::s_info = { "UnlinkedFunctionExecutable", 0, 0, 0, CREATE_METHOD_TABLE(UnlinkedFunctionExecutable) };
+const ClassInfo UnlinkedCodeBlock::s_info = { "UnlinkedCodeBlock", 0, 0, 0, CREATE_METHOD_TABLE(UnlinkedCodeBlock) };
+const ClassInfo UnlinkedGlobalCodeBlock::s_info = { "UnlinkedGlobalCodeBlock", &Base::s_info, 0, 0, CREATE_METHOD_TABLE(UnlinkedGlobalCodeBlock) };
+const ClassInfo UnlinkedProgramCodeBlock::s_info = { "UnlinkedProgramCodeBlock", &Base::s_info, 0, 0, CREATE_METHOD_TABLE(UnlinkedProgramCodeBlock) };
+const ClassInfo UnlinkedEvalCodeBlock::s_info = { "UnlinkedEvalCodeBlock", &Base::s_info, 0, 0, CREATE_METHOD_TABLE(UnlinkedEvalCodeBlock) };
+const ClassInfo UnlinkedFunctionCodeBlock::s_info = { "UnlinkedFunctionCodeBlock", &Base::s_info, 0, 0, CREATE_METHOD_TABLE(UnlinkedFunctionCodeBlock) };
+
+unsigned UnlinkedCodeBlock::addOrFindConstant(JSValue v)
+{
+    unsigned numberOfConstants = numberOfConstantRegisters();
+    for (unsigned i = 0; i < numberOfConstants; ++i) {
+        if (getConstant(FirstConstantRegisterIndex + i) == v)
+            return i;
+    }
+    return addConstant(v);
+}
+
+UnlinkedFunctionExecutable::UnlinkedFunctionExecutable(JSGlobalData* globalData, Structure* structure, const SourceCode& source, FunctionBodyNode* node)
+    : Base(*globalData, structure)
+    , m_numCapturedVariables(node->capturedVariableCount())
+    , m_forceUsesArguments(node->usesArguments())
+    , m_isInStrictContext(node->isStrictMode())
+    , m_hasCapturedVariables(node->hasCapturedVariables())
+    , m_name(node->ident())
+    , m_inferredName(node->inferredName())
+    , m_parameters(node->parameters())
+    , m_firstLineOffset(node->firstLine() - source.firstLine())
+    , m_lineCount(node->lastLine() - node->firstLine())
+    , m_startOffset(node->source().startOffset() - source.startOffset())
+    , m_sourceLength(node->source().length())
+    , m_features(node->features())
+    , m_functionNameIsInScopeToggle(node->functionNameIsInScopeToggle())
+{
+}
+
+void UnlinkedFunctionExecutable::visitChildren(JSCell* cell, SlotVisitor& visitor)
+{
+    UnlinkedFunctionExecutable* thisObject = jsCast<UnlinkedFunctionExecutable*>(cell);
+    ASSERT_GC_OBJECT_INHERITS(thisObject, &s_info);
+    COMPILE_ASSERT(StructureFlags & OverridesVisitChildren, OverridesVisitChildrenWithoutSettingFlag);
+    ASSERT(thisObject->structure()->typeInfo().overridesVisitChildren());
+    Base::visitChildren(thisObject, visitor);
+    visitor.append(&thisObject->m_codeBlockForCall);
+    visitor.append(&thisObject->m_codeBlockForConstruct);
+    visitor.append(&thisObject->m_nameValue);
+    visitor.append(&thisObject->m_symbolTableForCall);
+    visitor.append(&thisObject->m_symbolTableForConstruct);
+}
+
+FunctionExecutable* UnlinkedFunctionExecutable::link(JSGlobalData& globalData, const SourceCode& source, size_t lineOffset, size_t sourceOffset)
+{
+    unsigned firstLine = lineOffset + m_firstLineOffset;
+    unsigned startOffset = sourceOffset + m_startOffset;
+    SourceCode code(source.provider(), startOffset, startOffset + m_sourceLength, firstLine);
+    return FunctionExecutable::create(globalData, code, this, firstLine, firstLine + m_lineCount);
+}
+
+UnlinkedFunctionExecutable* UnlinkedFunctionExecutable::fromGlobalCode(const Identifier& name, ExecState* exec, Debugger*, const SourceCode& source, JSObject** exception)
+{
+    ParserError error;
+    CodeCache* codeCache = exec->globalData().codeCache();
+    UnlinkedFunctionExecutable* executable = codeCache->getFunctionExecutableFromGlobalCode(exec->globalData(), name, source, error);
+    if (error.m_type != ParserError::ErrorNone) {
+        *exception = error.toErrorObject(exec->lexicalGlobalObject(), source);
+        return 0;
+    }
+
+    return executable;
+}
+
+UnlinkedFunctionCodeBlock* UnlinkedFunctionExecutable::codeBlockFor(JSGlobalData& globalData, const SourceCode& source, CodeSpecializationKind specializationKind, DebuggerMode debuggerMode, ProfilerMode profilerMode, ParserError& error)
+{
+    switch (specializationKind) {
+    case CodeForCall:
+        if (m_codeBlockForCall)
+            return m_codeBlockForCall.get();
+        break;
+    case CodeForConstruct:
+        if (m_codeBlockForConstruct)
+            return m_codeBlockForConstruct.get();
+        break;
+    }
+
+    UnlinkedFunctionCodeBlock* result = globalData.codeCache()->getFunctionCodeBlock(globalData, this, source, specializationKind, debuggerMode, profilerMode, error);
+    
+    if (error.m_type != ParserError::ErrorNone)
+        return 0;
+
+    switch (specializationKind) {
+    case CodeForCall:
+        m_codeBlockForCall.set(globalData, this, result);
+        m_symbolTableForCall.set(globalData, this, result->symbolTable());
+        break;
+    case CodeForConstruct:
+        m_codeBlockForConstruct.set(globalData, this, result);
+        m_symbolTableForConstruct.set(globalData, this, result->symbolTable());
+        break;
+    }
+    return result;
+}
+
+String UnlinkedFunctionExecutable::paramString() const
+{
+    FunctionParameters& parameters = *m_parameters;
+    StringBuilder builder;
+    for (size_t pos = 0; pos < parameters.size(); ++pos) {
+        if (!builder.isEmpty())
+            builder.appendLiteral(", ");
+        builder.append(parameters[pos].string());
+    }
+    return builder.toString();
+}
+
+UnlinkedCodeBlock::UnlinkedCodeBlock(JSGlobalData* globalData, Structure* structure, CodeType codeType, const ExecutableInfo& info)
+    : Base(*globalData, structure)
+    , m_numVars(0)
+    , m_numCalleeRegisters(0)
+    , m_numParameters(0)
+    , m_globalData(globalData)
+    , m_argumentsRegister(-1)
+    , m_needsFullScopeChain(info.m_needsActivation)
+    , m_usesEval(info.m_usesEval)
+    , m_isNumericCompareFunction(false)
+    , m_isStrictMode(info.m_isStrictMode)
+    , m_isConstructor(info.m_isConstructor)
+    , m_hasCapturedVariables(false)
+    , m_firstLine(0)
+    , m_lineCount(0)
+    , m_features(0)
+    , m_codeType(codeType)
+    , m_resolveOperationCount(0)
+    , m_putToBaseOperationCount(1)
+    , m_arrayProfileCount(0)
+    , m_valueProfileCount(0)
+    , m_llintCallLinkInfoCount(0)
+#if ENABLE(BYTECODE_COMMENTS)
+    , m_bytecodeCommentIterator(0)
+#endif
+{
+
+}
+
+void UnlinkedCodeBlock::visitChildren(JSCell* cell, SlotVisitor& visitor)
+{
+    UnlinkedCodeBlock* thisObject = jsCast<UnlinkedCodeBlock*>(cell);
+    ASSERT_GC_OBJECT_INHERITS(thisObject, &s_info);
+    COMPILE_ASSERT(StructureFlags & OverridesVisitChildren, OverridesVisitChildrenWithoutSettingFlag);
+    ASSERT(thisObject->structure()->typeInfo().overridesVisitChildren());
+    Base::visitChildren(thisObject, visitor);
+    visitor.append(&thisObject->m_symbolTable);
+    for (FunctionExpressionVector::iterator ptr = thisObject->m_functionDecls.begin(), end = thisObject->m_functionDecls.end(); ptr != end; ++ptr)
+        visitor.append(ptr);
+    for (FunctionExpressionVector::iterator ptr = thisObject->m_functionExprs.begin(), end = thisObject->m_functionExprs.end(); ptr != end; ++ptr)
+        visitor.append(ptr);
+    visitor.appendValues(thisObject->m_constantRegisters.data(), thisObject->m_constantRegisters.size());
+    if (thisObject->m_rareData) {
+        for (size_t i = 0, end = thisObject->m_rareData->m_regexps.size(); i != end; i++)
+            visitor.append(&thisObject->m_rareData->m_regexps[i]);
+    }
+}
+
+int UnlinkedCodeBlock::lineNumberForBytecodeOffset(unsigned bytecodeOffset)
+{
+    ASSERT(bytecodeOffset < instructions().size());
+    Vector<LineInfo>& lineInfo = m_lineInfo;
+    
+    int low = 0;
+    int high = lineInfo.size();
+    while (low < high) {
+        int mid = low + (high - low) / 2;
+        if (lineInfo[mid].instructionOffset <= bytecodeOffset)
+            low = mid + 1;
+        else
+            high = mid;
+    }
+    
+    if (!low)
+        return 0;
+    return lineInfo[low - 1].lineNumber;
+}
+
+void UnlinkedCodeBlock::expressionRangeForBytecodeOffset(unsigned bytecodeOffset, int& divot, int& startOffset, int& endOffset)
+{
+    ASSERT(bytecodeOffset < instructions().size());
+
+    if (!m_expressionInfo.size()) {
+        startOffset = 0;
+        endOffset = 0;
+        divot = 0;
+        return;
+    }
+
+    Vector<ExpressionRangeInfo>& expressionInfo = m_expressionInfo;
+
+    int low = 0;
+    int high = expressionInfo.size();
+    while (low < high) {
+        int mid = low + (high - low) / 2;
+        if (expressionInfo[mid].instructionOffset <= bytecodeOffset)
+            low = mid + 1;
+        else
+            high = mid;
+    }
+
+    ASSERT(low);
+    if (!low) {
+        startOffset = 0;
+        endOffset = 0;
+        divot = 0;
+        return;
+    }
+
+    startOffset = expressionInfo[low - 1].startOffset;
+    endOffset = expressionInfo[low - 1].endOffset;
+    divot = expressionInfo[low - 1].divotPoint;
+}
+
+void UnlinkedProgramCodeBlock::visitChildren(JSCell* cell, SlotVisitor& visitor)
+{
+    UnlinkedProgramCodeBlock* thisObject = jsCast<UnlinkedProgramCodeBlock*>(cell);
+    ASSERT_GC_OBJECT_INHERITS(thisObject, &s_info);
+    COMPILE_ASSERT(StructureFlags & OverridesVisitChildren, OverridesVisitChildrenWithoutSettingFlag);
+    ASSERT(thisObject->structure()->typeInfo().overridesVisitChildren());
+    Base::visitChildren(thisObject, visitor);
+    for (size_t i = 0, end = thisObject->m_functionDeclarations.size(); i != end; i++)
+        visitor.append(&thisObject->m_functionDeclarations[i].second);
+}
+
+UnlinkedCodeBlock::~UnlinkedCodeBlock()
+{
+}
+
+void UnlinkedProgramCodeBlock::destroy(JSCell* cell)
+{
+    jsCast<UnlinkedProgramCodeBlock*>(cell)->~UnlinkedProgramCodeBlock();
+}
+
+void UnlinkedEvalCodeBlock::destroy(JSCell* cell)
+{
+    jsCast<UnlinkedEvalCodeBlock*>(cell)->~UnlinkedEvalCodeBlock();
+}
+
+void UnlinkedFunctionCodeBlock::destroy(JSCell* cell)
+{
+    jsCast<UnlinkedFunctionCodeBlock*>(cell)->~UnlinkedFunctionCodeBlock();
+}
+
+void UnlinkedFunctionExecutable::destroy(JSCell* cell)
+{
+    jsCast<UnlinkedFunctionExecutable*>(cell)->~UnlinkedFunctionExecutable();
+}
+
+}
+
diff --git a/Source/JavaScriptCore/bytecode/UnlinkedCodeBlock.h b/Source/JavaScriptCore/bytecode/UnlinkedCodeBlock.h
new file mode 100644
index 000000000..bf3f5fdff
--- /dev/null
+++ b/Source/JavaScriptCore/bytecode/UnlinkedCodeBlock.h
@@ -0,0 +1,700 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef UnlinkedCodeBlock_h
+#define UnlinkedCodeBlock_h
+
+#include "BytecodeConventions.h"
+#include "CodeSpecializationKind.h"
+#include "CodeType.h"
+#include "ExpressionRangeInfo.h"
+#include "Identifier.h"
+#include "JSCell.h"
+#include "LineInfo.h"
+#include "Nodes.h"
+#include "RegExp.h"
+#include "SpecialPointer.h"
+
+#include <wtf/RefCountedArray.h>
+#include <wtf/Vector.h>
+
+namespace JSC {
+
+class Debugger;
+class FunctionBodyNode;
+class FunctionExecutable;
+class FunctionParameters;
+struct ParserError;
+class ScriptExecutable;
+class SourceCode;
+class SourceProvider;
+class SharedSymbolTable;
+class UnlinkedCodeBlock;
+class UnlinkedFunctionCodeBlock;
+
+typedef unsigned UnlinkedValueProfile;
+typedef unsigned UnlinkedArrayProfile;
+typedef unsigned UnlinkedLLIntCallLinkInfo;
+
+struct ExecutableInfo {
+    ExecutableInfo(bool needsActivation, bool usesEval, bool isStrictMode, bool isConstructor)
+        : m_needsActivation(needsActivation)
+        , m_usesEval(usesEval)
+        , m_isStrictMode(isStrictMode)
+        , m_isConstructor(isConstructor)
+    {
+    }
+    bool m_needsActivation;
+    bool m_usesEval;
+    bool m_isStrictMode;
+    bool m_isConstructor;
+};
+
+class UnlinkedFunctionExecutable : public JSCell {
+public:
+    friend class CodeCache;
+    typedef JSCell Base;
+    static UnlinkedFunctionExecutable* create(JSGlobalData* globalData, const SourceCode& source, FunctionBodyNode* node)
+    {
+        UnlinkedFunctionExecutable* instance = new (NotNull, allocateCell<UnlinkedFunctionExecutable>(globalData->heap)) UnlinkedFunctionExecutable(globalData, globalData->unlinkedFunctionExecutableStructure.get(), source, node);
+        instance->finishCreation(*globalData);
+        return instance;
+    }
+
+    const Identifier& name() const { return m_name; }
+    const Identifier& inferredName() const { return m_inferredName; }
+    JSString* nameValue() const { return m_nameValue.get(); }
+    SharedSymbolTable* symbolTable(CodeSpecializationKind kind)
+    {
+        return (kind == CodeForCall) ? m_symbolTableForCall.get() : m_symbolTableForConstruct.get();
+    }
+    size_t parameterCount() const { return m_parameters->size(); }
+    bool isInStrictContext() const { return m_isInStrictContext; }
+    FunctionNameIsInScopeToggle functionNameIsInScopeToggle() const { return m_functionNameIsInScopeToggle; }
+
+    unsigned firstLineOffset() const { return m_firstLineOffset; }
+    unsigned lineCount() const { return m_lineCount; }
+    unsigned startOffset() const { return m_startOffset; }
+    unsigned sourceLength() { return m_sourceLength; }
+
+    String paramString() const;
+
+    UnlinkedFunctionCodeBlock* codeBlockFor(JSGlobalData&, const SourceCode&, CodeSpecializationKind, DebuggerMode, ProfilerMode, ParserError&);
+
+    static UnlinkedFunctionExecutable* fromGlobalCode(const Identifier&, ExecState*, Debugger*, const SourceCode&, JSObject** exception);
+
+    FunctionExecutable* link(JSGlobalData&, const SourceCode&, size_t lineOffset, size_t sourceOffset);
+
+    void clearCode()
+    {
+        m_symbolTableForCall.clear();
+        m_symbolTableForConstruct.clear();
+        m_codeBlockForCall.clear();
+        m_codeBlockForConstruct.clear();
+    }
+
+    FunctionParameters* parameters() { return m_parameters.get(); }
+
+    void recordParse(CodeFeatures features, bool hasCapturedVariables, int firstLine, int lastLine)
+    {
+        m_features = features;
+        m_hasCapturedVariables = hasCapturedVariables;
+        m_lineCount = lastLine - firstLine;
+    }
+
+    bool forceUsesArguments() const { return m_forceUsesArguments; }
+
+    CodeFeatures features() const { return m_features; }
+    bool hasCapturedVariables() const { return m_hasCapturedVariables; }
+
+    static const bool needsDestruction = true;
+    static const bool hasImmortalStructure = true;
+    static void destroy(JSCell*);
+
+private:
+    UnlinkedFunctionExecutable(JSGlobalData*, Structure*, const SourceCode&, FunctionBodyNode*);
+    WriteBarrier<UnlinkedFunctionCodeBlock> m_codeBlockForCall;
+    WriteBarrier<UnlinkedFunctionCodeBlock> m_codeBlockForConstruct;
+
+    unsigned m_numCapturedVariables : 29;
+    bool m_forceUsesArguments : 1;
+    bool m_isInStrictContext : 1;
+    bool m_hasCapturedVariables : 1;
+
+    Identifier m_name;
+    Identifier m_inferredName;
+    WriteBarrier<JSString> m_nameValue;
+    WriteBarrier<SharedSymbolTable> m_symbolTableForCall;
+    WriteBarrier<SharedSymbolTable> m_symbolTableForConstruct;
+    RefPtr<FunctionParameters> m_parameters;
+    unsigned m_firstLineOffset;
+    unsigned m_lineCount;
+    unsigned m_startOffset;
+    unsigned m_sourceLength;
+
+    CodeFeatures m_features;
+
+    FunctionNameIsInScopeToggle m_functionNameIsInScopeToggle;
+
+protected:
+    void finishCreation(JSGlobalData& globalData)
+    {
+        Base::finishCreation(globalData);
+        m_nameValue.set(globalData, this, jsString(&globalData, name().string()));
+    }
+
+    static void visitChildren(JSCell*, SlotVisitor&);
+
+public:
+    static Structure* createStructure(JSGlobalData& globalData, JSGlobalObject* globalObject, JSValue proto)
+    {
+        return Structure::create(globalData, globalObject, proto, TypeInfo(UnlinkedFunctionExecutableType, StructureFlags), &s_info);
+    }
+
+    static const unsigned StructureFlags = OverridesVisitChildren | JSCell::StructureFlags;
+
+    static const ClassInfo s_info;
+};
+
+struct UnlinkedStringJumpTable {
+    typedef HashMap<RefPtr<StringImpl>, int32_t> StringOffsetTable;
+    StringOffsetTable offsetTable;
+
+    inline int32_t offsetForValue(StringImpl* value, int32_t defaultOffset)
+    {
+        StringOffsetTable::const_iterator end = offsetTable.end();
+        StringOffsetTable::const_iterator loc = offsetTable.find(value);
+        if (loc == end)
+            return defaultOffset;
+        return loc->value;
+    }
+
+};
+
+struct UnlinkedSimpleJumpTable {
+    Vector<int32_t> branchOffsets;
+    int32_t min;
+
+    int32_t offsetForValue(int32_t value, int32_t defaultOffset);
+    void add(int32_t key, int32_t offset)
+    {
+        if (!branchOffsets[key])
+            branchOffsets[key] = offset;
+    }
+};
+
+struct UnlinkedHandlerInfo {
+    uint32_t start;
+    uint32_t end;
+    uint32_t target;
+    uint32_t scopeDepth;
+};
+
+struct UnlinkedInstruction {
+    UnlinkedInstruction() { u.operand = 0; }
+    UnlinkedInstruction(OpcodeID opcode) { u.opcode = opcode; }
+    UnlinkedInstruction(int operand) { u.operand = operand; }
+    union {
+        OpcodeID opcode;
+        int32_t operand;
+    } u;
+};
+
+class UnlinkedCodeBlock : public JSCell {
+public:
+    typedef JSCell Base;
+    static const bool needsDestruction = true;
+    static const bool hasImmortalStructure = true;
+
+    enum { CallFunction, ApplyFunction };
+
+    bool isConstructor() const { return m_isConstructor; }
+    bool isStrictMode() const { return m_isStrictMode; }
+    bool usesEval() const { return m_usesEval; }
+
+    bool needsFullScopeChain() const { return m_needsFullScopeChain; }
+    void setNeedsFullScopeChain(bool needsFullScopeChain) { m_needsFullScopeChain = needsFullScopeChain; }
+
+    void addExpressionInfo(const ExpressionRangeInfo& expressionInfo)
+    {
+        m_expressionInfo.append(expressionInfo);
+    }
+
+    void addLineInfo(unsigned bytecodeOffset, int lineNo)
+    {
+        Vector<LineInfo>& lineInfo = m_lineInfo;
+        if (!lineInfo.size() || lineInfo.last().lineNumber != lineNo) {
+            LineInfo info = { bytecodeOffset, lineNo };
+            lineInfo.append(info);
+        }
+    }
+
+    bool hasExpressionInfo() { return m_expressionInfo.size(); }
+
+    // Special registers
+    void setThisRegister(int thisRegister) { m_thisRegister = thisRegister; }
+    void setActivationRegister(int activationRegister) { m_activationRegister = activationRegister; }
+
+    void setArgumentsRegister(int argumentsRegister) { m_argumentsRegister = argumentsRegister; }
+    bool usesArguments() const { return m_argumentsRegister != -1; }
+    int argumentsRegister() const { return m_argumentsRegister; }
+
+    // Parameter information
+    void setNumParameters(int newValue) { m_numParameters = newValue; }
+    void addParameter() { m_numParameters++; }
+    unsigned numParameters() const { return m_numParameters; }
+
+    unsigned addRegExp(RegExp* r)
+    {
+        createRareDataIfNecessary();
+        unsigned size = m_rareData->m_regexps.size();
+        m_rareData->m_regexps.append(WriteBarrier<RegExp>(*m_globalData, this, r));
+        return size;
+    }
+    unsigned numberOfRegExps() const
+    {
+        if (!m_rareData)
+            return 0;
+        return m_rareData->m_regexps.size();
+    }
+    RegExp* regexp(int index) const { ASSERT(m_rareData); return m_rareData->m_regexps[index].get(); }
+
+    // Constant Pools
+
+    size_t numberOfIdentifiers() const { return m_identifiers.size(); }
+    void addIdentifier(const Identifier& i) { return m_identifiers.append(i); }
+    const Identifier& identifier(int index) const { return m_identifiers[index]; }
+    const Vector<Identifier>& identifiers() const { return m_identifiers; }
+
+    size_t numberOfConstantRegisters() const { return m_constantRegisters.size(); }
+    unsigned addConstant(JSValue v)
+    {
+        unsigned result = m_constantRegisters.size();
+        m_constantRegisters.append(WriteBarrier<Unknown>());
+        m_constantRegisters.last().set(*m_globalData, this, v);
+        return result;
+    }
+    unsigned addOrFindConstant(JSValue);
+    const Vector<WriteBarrier<Unknown> >& constantRegisters() { return m_constantRegisters; }
+    const WriteBarrier<Unknown>& constantRegister(int index) const { return m_constantRegisters[index - FirstConstantRegisterIndex]; }
+    ALWAYS_INLINE bool isConstantRegisterIndex(int index) const { return index >= FirstConstantRegisterIndex; }
+    ALWAYS_INLINE JSValue getConstant(int index) const { return m_constantRegisters[index - FirstConstantRegisterIndex].get(); }
+
+    // Jumps
+    size_t numberOfJumpTargets() const { return m_jumpTargets.size(); }
+    void addJumpTarget(unsigned jumpTarget) { m_jumpTargets.append(jumpTarget); }
+    unsigned jumpTarget(int index) const { return m_jumpTargets[index]; }
+    unsigned lastJumpTarget() const { return m_jumpTargets.last(); }
+
+    void setIsNumericCompareFunction(bool isNumericCompareFunction) { m_isNumericCompareFunction = isNumericCompareFunction; }
+    bool isNumericCompareFunction() const { return m_isNumericCompareFunction; }
+
+    void shrinkToFit()
+    {
+        m_jumpTargets.shrinkToFit();
+        m_identifiers.shrinkToFit();
+        m_constantRegisters.shrinkToFit();
+        m_functionDecls.shrinkToFit();
+        m_functionExprs.shrinkToFit();
+        m_lineInfo.shrinkToFit();
+        m_propertyAccessInstructions.shrinkToFit();
+        m_expressionInfo.shrinkToFit();
+
+#if ENABLE(BYTECODE_COMMENTS)
+        m_bytecodeComments.shrinkToFit();
+#endif
+        if (m_rareData) {
+            m_rareData->m_exceptionHandlers.shrinkToFit();
+            m_rareData->m_regexps.shrinkToFit();
+            m_rareData->m_constantBuffers.shrinkToFit();
+            m_rareData->m_immediateSwitchJumpTables.shrinkToFit();
+            m_rareData->m_characterSwitchJumpTables.shrinkToFit();
+            m_rareData->m_stringSwitchJumpTables.shrinkToFit();
+        }
+    }
+
+    unsigned numberOfInstructions() const { return m_unlinkedInstructions.size(); }
+    RefCountedArray<UnlinkedInstruction>& instructions() { return m_unlinkedInstructions; }
+    const RefCountedArray<UnlinkedInstruction>& instructions() const { return m_unlinkedInstructions; }
+
+    int m_numVars;
+    int m_numCapturedVars;
+    int m_numCalleeRegisters;
+
+    // Jump Tables
+
+    size_t numberOfImmediateSwitchJumpTables() const { return m_rareData ? m_rareData->m_immediateSwitchJumpTables.size() : 0; }
+    UnlinkedSimpleJumpTable& addImmediateSwitchJumpTable() { createRareDataIfNecessary(); m_rareData->m_immediateSwitchJumpTables.append(UnlinkedSimpleJumpTable()); return m_rareData->m_immediateSwitchJumpTables.last(); }
+    UnlinkedSimpleJumpTable& immediateSwitchJumpTable(int tableIndex) { ASSERT(m_rareData); return m_rareData->m_immediateSwitchJumpTables[tableIndex]; }
+
+    size_t numberOfCharacterSwitchJumpTables() const { return m_rareData ? m_rareData->m_characterSwitchJumpTables.size() : 0; }
+    UnlinkedSimpleJumpTable& addCharacterSwitchJumpTable() { createRareDataIfNecessary(); m_rareData->m_characterSwitchJumpTables.append(UnlinkedSimpleJumpTable()); return m_rareData->m_characterSwitchJumpTables.last(); }
+    UnlinkedSimpleJumpTable& characterSwitchJumpTable(int tableIndex) { ASSERT(m_rareData); return m_rareData->m_characterSwitchJumpTables[tableIndex]; }
+
+    size_t numberOfStringSwitchJumpTables() const { return m_rareData ? m_rareData->m_stringSwitchJumpTables.size() : 0; }
+    UnlinkedStringJumpTable& addStringSwitchJumpTable() { createRareDataIfNecessary(); m_rareData->m_stringSwitchJumpTables.append(UnlinkedStringJumpTable()); return m_rareData->m_stringSwitchJumpTables.last(); }
+    UnlinkedStringJumpTable& stringSwitchJumpTable(int tableIndex) { ASSERT(m_rareData); return m_rareData->m_stringSwitchJumpTables[tableIndex]; }
+
+    unsigned addFunctionDecl(UnlinkedFunctionExecutable* n)
+    {
+        unsigned size = m_functionDecls.size();
+        m_functionDecls.append(WriteBarrier<UnlinkedFunctionExecutable>());
+        m_functionDecls.last().set(*m_globalData, this, n);
+        return size;
+    }
+    UnlinkedFunctionExecutable* functionDecl(int index) { return m_functionDecls[index].get(); }
+    size_t numberOfFunctionDecls() { return m_functionDecls.size(); }
+    unsigned addFunctionExpr(UnlinkedFunctionExecutable* n)
+    {
+        unsigned size = m_functionExprs.size();
+        m_functionExprs.append(WriteBarrier<UnlinkedFunctionExecutable>());
+        m_functionExprs.last().set(*m_globalData, this, n);
+        return size;
+    }
+    UnlinkedFunctionExecutable* functionExpr(int index) { return m_functionExprs[index].get(); }
+    size_t numberOfFunctionExprs() { return m_functionExprs.size(); }
+
+    // Exception handling support
+    size_t numberOfExceptionHandlers() const { return m_rareData ? m_rareData->m_exceptionHandlers.size() : 0; }
+    void addExceptionHandler(const UnlinkedHandlerInfo& hanler) { createRareDataIfNecessary(); return m_rareData->m_exceptionHandlers.append(hanler); }
+    UnlinkedHandlerInfo& exceptionHandler(int index) { ASSERT(m_rareData); return m_rareData->m_exceptionHandlers[index]; }
+
+    SharedSymbolTable* symbolTable() const { return m_symbolTable.get(); }
+
+    JSGlobalData* globalData() const { return m_globalData; }
+
+    unsigned addResolve() { return m_resolveOperationCount++; }
+    unsigned numberOfResolveOperations() const { return m_resolveOperationCount; }
+    unsigned addPutToBase() { return m_putToBaseOperationCount++; }
+    unsigned numberOfPutToBaseOperations() const { return m_putToBaseOperationCount; }
+
+    UnlinkedArrayProfile addArrayProfile() { return m_arrayProfileCount++; }
+    unsigned numberOfArrayProfiles() { return m_arrayProfileCount; }
+    UnlinkedValueProfile addValueProfile() { return m_valueProfileCount++; }
+    unsigned numberOfValueProfiles() { return m_valueProfileCount; }
+
+    UnlinkedLLIntCallLinkInfo addLLIntCallLinkInfo() { return m_llintCallLinkInfoCount++; }
+    unsigned numberOfLLintCallLinkInfos() { return m_llintCallLinkInfoCount; }
+
+    CodeType codeType() const { return m_codeType; }
+
+    int thisRegister() const { return m_thisRegister; }
+    int activationRegister() const { return m_activationRegister; }
+
+
+    void addPropertyAccessInstruction(unsigned propertyAccessInstruction)
+    {
+        m_propertyAccessInstructions.append(propertyAccessInstruction);
+    }
+
+    size_t numberOfPropertyAccessInstructions() const { return m_propertyAccessInstructions.size(); }
+    const Vector<unsigned>& propertyAccessInstructions() const { return m_propertyAccessInstructions; }
+
+    typedef Vector<JSValue> ConstantBuffer;
+
+    size_t constantBufferCount() { ASSERT(m_rareData); return m_rareData->m_constantBuffers.size(); }
+    unsigned addConstantBuffer(unsigned length)
+    {
+        createRareDataIfNecessary();
+        unsigned size = m_rareData->m_constantBuffers.size();
+        m_rareData->m_constantBuffers.append(Vector<JSValue>(length));
+        return size;
+    }
+
+    const ConstantBuffer& constantBuffer(unsigned index) const
+    {
+        ASSERT(m_rareData);
+        return m_rareData->m_constantBuffers[index];
+    }
+
+    ConstantBuffer& constantBuffer(unsigned index)
+    {
+        ASSERT(m_rareData);
+        return m_rareData->m_constantBuffers[index];
+    }
+
+    bool hasRareData() const { return m_rareData; }
+
+    int lineNumberForBytecodeOffset(unsigned bytecodeOffset);
+
+    void expressionRangeForBytecodeOffset(unsigned bytecodeOffset, int& divot, int& startOffset, int& endOffset);
+
+    void recordParse(CodeFeatures features, bool hasCapturedVariables, unsigned firstLine, unsigned lineCount)
+    {
+        m_features = features;
+        m_hasCapturedVariables = hasCapturedVariables;
+        m_firstLine = firstLine;
+        m_lineCount = lineCount;
+    }
+
+    CodeFeatures codeFeatures() const { return m_features; }
+    bool hasCapturedVariables() const { return m_hasCapturedVariables; }
+    unsigned firstLine() const { return m_firstLine; }
+    unsigned lineCount() const { return m_lineCount; }
+
+protected:
+    UnlinkedCodeBlock(JSGlobalData*, Structure*, CodeType, const ExecutableInfo&);
+    ~UnlinkedCodeBlock();
+
+    void finishCreation(JSGlobalData& globalData)
+    {
+        Base::finishCreation(globalData);
+        if (codeType() == GlobalCode)
+            return;
+        m_symbolTable.set(globalData, this, SharedSymbolTable::create(globalData));
+    }
+
+private:
+
+    void createRareDataIfNecessary()
+    {
+        if (!m_rareData)
+            m_rareData = adoptPtr(new RareData);
+    }
+
+    RefCountedArray<UnlinkedInstruction> m_unlinkedInstructions;
+
+    int m_numParameters;
+    JSGlobalData* m_globalData;
+
+    int m_thisRegister;
+    int m_argumentsRegister;
+    int m_activationRegister;
+
+    bool m_needsFullScopeChain : 1;
+    bool m_usesEval : 1;
+    bool m_isNumericCompareFunction : 1;
+    bool m_isStrictMode : 1;
+    bool m_isConstructor : 1;
+    bool m_hasCapturedVariables : 1;
+    unsigned m_firstLine;
+    unsigned m_lineCount;
+
+    CodeFeatures m_features;
+    CodeType m_codeType;
+
+    Vector<unsigned> m_jumpTargets;
+
+    // Constant Pools
+    Vector<Identifier> m_identifiers;
+    Vector<WriteBarrier<Unknown> > m_constantRegisters;
+    typedef Vector<WriteBarrier<UnlinkedFunctionExecutable> > FunctionExpressionVector;
+    FunctionExpressionVector m_functionDecls;
+    FunctionExpressionVector m_functionExprs;
+
+    WriteBarrier<SharedSymbolTable> m_symbolTable;
+
+    Vector<LineInfo> m_lineInfo;
+
+    Vector<unsigned> m_propertyAccessInstructions;
+
+#if ENABLE(BYTECODE_COMMENTS)
+    Vector<Comment>  m_bytecodeComments;
+    size_t m_bytecodeCommentIterator;
+#endif
+
+    unsigned m_resolveOperationCount;
+    unsigned m_putToBaseOperationCount;
+    unsigned m_arrayProfileCount;
+    unsigned m_valueProfileCount;
+    unsigned m_llintCallLinkInfoCount;
+
+public:
+    struct RareData {
+        WTF_MAKE_FAST_ALLOCATED;
+    public:
+        Vector<UnlinkedHandlerInfo> m_exceptionHandlers;
+
+        // Rare Constants
+        Vector<WriteBarrier<RegExp> > m_regexps;
+
+        // Buffers used for large array literals
+        Vector<ConstantBuffer> m_constantBuffers;
+
+        // Jump Tables
+        Vector<UnlinkedSimpleJumpTable> m_immediateSwitchJumpTables;
+        Vector<UnlinkedSimpleJumpTable> m_characterSwitchJumpTables;
+        Vector<UnlinkedStringJumpTable> m_stringSwitchJumpTables;
+
+        // Expression info - present if debugging.
+    };
+
+private:
+    OwnPtr<RareData> m_rareData;
+    Vector<ExpressionRangeInfo> m_expressionInfo;
+
+protected:
+
+    static const unsigned StructureFlags = OverridesVisitChildren | Base::StructureFlags;
+    static void visitChildren(JSCell*, SlotVisitor&);
+
+public:
+    static const ClassInfo s_info;
+};
+
+class UnlinkedGlobalCodeBlock : public UnlinkedCodeBlock {
+public:
+    typedef UnlinkedCodeBlock Base;
+
+protected:
+    UnlinkedGlobalCodeBlock(JSGlobalData* globalData, Structure* structure, CodeType codeType, const ExecutableInfo& info)
+        : Base(globalData, structure, codeType, info)
+    {
+    }
+
+    static const unsigned StructureFlags = OverridesVisitChildren | Base::StructureFlags;
+
+    static const ClassInfo s_info;
+};
+
+class UnlinkedProgramCodeBlock : public UnlinkedGlobalCodeBlock {
+private:
+    friend class CodeCache;
+    static UnlinkedProgramCodeBlock* create(JSGlobalData* globalData, const ExecutableInfo& info)
+    {
+        UnlinkedProgramCodeBlock* instance = new (NotNull, allocateCell<UnlinkedProgramCodeBlock>(globalData->heap)) UnlinkedProgramCodeBlock(globalData, globalData->unlinkedProgramCodeBlockStructure.get(), info);
+        instance->finishCreation(*globalData);
+        return instance;
+    }
+
+public:
+    typedef UnlinkedGlobalCodeBlock Base;
+    static void destroy(JSCell*);
+
+    void addFunctionDeclaration(JSGlobalData& globalData, const Identifier& name, UnlinkedFunctionExecutable* functionExecutable)
+    {
+        m_functionDeclarations.append(std::make_pair(name, WriteBarrier<UnlinkedFunctionExecutable>(globalData, this, functionExecutable)));
+    }
+
+    void addVariableDeclaration(const Identifier& name, bool isConstant)
+    {
+        m_varDeclarations.append(std::make_pair(name, isConstant));
+    }
+
+    typedef Vector<std::pair<Identifier, bool> > VariableDeclations;
+    typedef Vector<std::pair<Identifier, WriteBarrier<UnlinkedFunctionExecutable> > > FunctionDeclations;
+
+    const VariableDeclations& variableDeclarations() const { return m_varDeclarations; }
+    const FunctionDeclations& functionDeclarations() const { return m_functionDeclarations; }
+
+    static void visitChildren(JSCell*, SlotVisitor&);
+
+private:
+    UnlinkedProgramCodeBlock(JSGlobalData* globalData, Structure* structure, const ExecutableInfo& info)
+        : Base(globalData, structure, GlobalCode, info)
+    {
+    }
+
+    VariableDeclations m_varDeclarations;
+    FunctionDeclations m_functionDeclarations;
+
+public:
+    static Structure* createStructure(JSGlobalData& globalData, JSGlobalObject* globalObject, JSValue proto)
+    {
+        return Structure::create(globalData, globalObject, proto, TypeInfo(UnlinkedProgramCodeBlockType, StructureFlags), &s_info);
+    }
+
+    static const unsigned StructureFlags = OverridesVisitChildren | Base::StructureFlags;
+
+    static const ClassInfo s_info;
+};
+
+class UnlinkedEvalCodeBlock : public UnlinkedGlobalCodeBlock {
+private:
+    friend class CodeCache;
+
+    static UnlinkedEvalCodeBlock* create(JSGlobalData* globalData, const ExecutableInfo& info)
+    {
+        UnlinkedEvalCodeBlock* instance = new (NotNull, allocateCell<UnlinkedEvalCodeBlock>(globalData->heap)) UnlinkedEvalCodeBlock(globalData, globalData->unlinkedEvalCodeBlockStructure.get(), info);
+        instance->finishCreation(*globalData);
+        return instance;
+    }
+
+public:
+    typedef UnlinkedGlobalCodeBlock Base;
+    static void destroy(JSCell*);
+
+    const Identifier& variable(unsigned index) { return m_variables[index]; }
+    unsigned numVariables() { return m_variables.size(); }
+    void adoptVariables(Vector<Identifier>& variables)
+    {
+        ASSERT(m_variables.isEmpty());
+        m_variables.swap(variables);
+    }
+
+private:
+    UnlinkedEvalCodeBlock(JSGlobalData* globalData, Structure* structure, const ExecutableInfo& info)
+        : Base(globalData, structure, EvalCode, info)
+    {
+    }
+
+    Vector<Identifier> m_variables;
+
+public:
+    static Structure* createStructure(JSGlobalData& globalData, JSGlobalObject* globalObject, JSValue proto)
+    {
+        return Structure::create(globalData, globalObject, proto, TypeInfo(UnlinkedEvalCodeBlockType, StructureFlags), &s_info);
+    }
+
+    static const unsigned StructureFlags = OverridesVisitChildren | Base::StructureFlags;
+
+    static const ClassInfo s_info;
+};
+
+class UnlinkedFunctionCodeBlock : public UnlinkedCodeBlock {
+private:
+    friend class CodeCache;
+
+    static UnlinkedFunctionCodeBlock* create(JSGlobalData* globalData, CodeType codeType, const ExecutableInfo& info)
+    {
+        UnlinkedFunctionCodeBlock* instance = new (NotNull, allocateCell<UnlinkedFunctionCodeBlock>(globalData->heap)) UnlinkedFunctionCodeBlock(globalData, globalData->unlinkedFunctionCodeBlockStructure.get(), codeType, info);
+        instance->finishCreation(*globalData);
+        return instance;
+    }
+
+public:
+    typedef UnlinkedCodeBlock Base;
+    static void destroy(JSCell*);
+
+private:
+    UnlinkedFunctionCodeBlock(JSGlobalData* globalData, Structure* structure, CodeType codeType, const ExecutableInfo& info)
+        : Base(globalData, structure, codeType, info)
+    {
+    }
+    
+public:
+    static Structure* createStructure(JSGlobalData& globalData, JSGlobalObject* globalObject, JSValue proto)
+    {
+        return Structure::create(globalData, globalObject, proto, TypeInfo(UnlinkedFunctionCodeBlockType, StructureFlags), &s_info);
+    }
+
+    static const unsigned StructureFlags = OverridesVisitChildren | Base::StructureFlags;
+
+    static const ClassInfo s_info;
+};
+
+}
+
+#endif // UnlinkedCodeBlock_h
diff --git a/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp b/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp
index 228277328..b11872551 100644
--- a/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp
+++ b/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp
@@ -158,7 +158,7 @@ bool BytecodeGenerator::dumpsGeneratedCode()
     return s_dumpsGeneratedCode;
 }
 
-JSObject* BytecodeGenerator::generate()
+ParserError BytecodeGenerator::generate()
 {
     SamplingRegion samplingRegion("Bytecode Generation");
     
@@ -169,36 +169,21 @@ JSObject* BytecodeGenerator::generate()
     for (unsigned i = 0; i < m_tryRanges.size(); ++i) {
         TryRange& range = m_tryRanges[i];
         ASSERT(range.tryData->targetScopeDepth != UINT_MAX);
-        HandlerInfo info = {
-            range.start->bind(0, 0), range.end->bind(0, 0),
-            range.tryData->target->bind(0, 0), range.tryData->targetScopeDepth
-#if ENABLE(JIT)
-            ,
-#if ENABLE(LLINT)
-            CodeLocationLabel(MacroAssemblerCodePtr::createFromExecutableAddress(LLInt::getCodePtr(llint_op_catch)))
-#else
-            CodeLocationLabel()
-#endif
-#endif
+        UnlinkedHandlerInfo info = {
+            static_cast<uint32_t>(range.start->bind(0, 0)), static_cast<uint32_t>(range.end->bind(0, 0)),
+            static_cast<uint32_t>(range.tryData->target->bind(0, 0)),
+            range.tryData->targetScopeDepth
         };
         m_codeBlock->addExceptionHandler(info);
     }
     
-    m_codeBlock->instructions() = RefCountedArray<Instruction>(m_instructions);
-
-    if (s_dumpsGeneratedCode)
-        m_codeBlock->dump(m_scope->globalObject()->globalExec());
-
-#ifdef NDEBUG
-    if ((m_codeType == FunctionCode && !m_codeBlock->needsFullScopeChain() && !m_codeBlock->usesArguments()) || m_codeType == EvalCode)
-        symbolTable().clear();
-#endif
+    m_codeBlock->instructions() = RefCountedArray<UnlinkedInstruction>(m_instructions);
 
-    m_codeBlock->shrinkToFit(CodeBlock::EarlyShrink);
+    m_codeBlock->shrinkToFit();
 
     if (m_expressionTooDeep)
-        return createOutOfMemoryError(m_scope->globalObject());
-    return 0;
+        return ParserError::OutOfMemory;
+    return ParserError::ErrorNone;
 }
 
 bool BytecodeGenerator::addVar(const Identifier& ident, bool isConstant, RegisterID*& r0)
@@ -216,51 +201,32 @@ bool BytecodeGenerator::addVar(const Identifier& ident, bool isConstant, Registe
     return true;
 }
 
-int BytecodeGenerator::addGlobalVar(
-    const Identifier& ident, ConstantMode constantMode, FunctionMode functionMode)
-{
-    UNUSED_PARAM(functionMode);
-    int index = symbolTable().size();
-    SymbolTableEntry newEntry(index, (constantMode == IsConstant) ? ReadOnly : 0);
-    if (functionMode == IsFunctionToSpecialize)
-        newEntry.attemptToWatch();
-    SymbolTable::AddResult result = symbolTable().add(ident.impl(), newEntry);
-    if (!result.isNewEntry) {
-        result.iterator->value.notifyWrite();
-        index = result.iterator->value.getIndex();
-    }
-    return index;
-}
-
 void BytecodeGenerator::preserveLastVar()
 {
     if ((m_firstConstantIndex = m_calleeRegisters.size()) != 0)
         m_lastVar = &m_calleeRegisters.last();
 }
 
-BytecodeGenerator::BytecodeGenerator(ProgramNode* programNode, JSScope* scope, SharedSymbolTable* symbolTable, ProgramCodeBlock* codeBlock, CompilationKind compilationKind)
-    : m_shouldEmitDebugHooks(scope->globalObject()->debugger())
-    , m_shouldEmitProfileHooks(scope->globalObject()->globalObjectMethodTable()->supportsProfiling(scope->globalObject()))
-    , m_shouldEmitRichSourceInfo(scope->globalObject()->globalObjectMethodTable()->supportsRichSourceInfo(scope->globalObject()))
-    , m_scope(*scope->globalData(), scope)
-    , m_symbolTable(symbolTable)
+BytecodeGenerator::BytecodeGenerator(JSGlobalData& globalData, ProgramNode* programNode, UnlinkedProgramCodeBlock* codeBlock, DebuggerMode debuggerMode, ProfilerMode profilerMode)
+    : m_shouldEmitDebugHooks(debuggerMode == DebuggerOn)
+    , m_shouldEmitProfileHooks(profilerMode == ProfilerOn)
 #if ENABLE(BYTECODE_COMMENTS)
     , m_currentCommentString(0)
 #endif
+    , m_symbolTable(0)
     , m_scopeNode(programNode)
-    , m_codeBlock(codeBlock)
+    , m_codeBlock(globalData, codeBlock)
     , m_thisRegister(CallFrame::thisArgumentOffset())
     , m_emptyValueRegister(0)
     , m_finallyDepth(0)
     , m_dynamicScopeDepth(0)
-    , m_baseScopeDepth(0)
     , m_codeType(GlobalCode)
     , m_nextConstantOffset(0)
     , m_globalConstantIndex(0)
     , m_hasCreatedActivation(true)
     , m_firstLazyFunction(0)
     , m_lastLazyFunction(0)
-    , m_globalData(scope->globalData())
+    , m_globalData(&globalData)
     , m_lastOpcodeID(op_end)
 #ifndef NDEBUG
     , m_lastOpcodePosition(0)
@@ -269,82 +235,48 @@ BytecodeGenerator::BytecodeGenerator(ProgramNode* programNode, JSScope* scope, S
     , m_usesExceptions(false)
     , m_expressionTooDeep(false)
 {
-    m_globalData->startedCompiling(m_codeBlock);
-    m_codeBlock->setGlobalObjectConstant(emitLoad(0, JSValue(m_codeBlock->globalObject()))->index());
-    
     if (m_shouldEmitDebugHooks)
         m_codeBlock->setNeedsFullScopeChain(true);
 
-    codeBlock->setGlobalData(m_globalData);
-    symbolTable->setUsesNonStrictEval(codeBlock->usesEval() && !codeBlock->isStrictMode());    
     m_codeBlock->setNumParameters(1); // Allocate space for "this"
 
     prependComment("entering Program block");
     emitOpcode(op_enter);
 
-    // FIXME: Move code that modifies the global object to Interpreter::execute.
-    
-    if (compilationKind == OptimizingCompilation)
-        return;
-
-    JSGlobalObject* globalObject = scope->globalObject();
-    ExecState* exec = globalObject->globalExec();
-    
-    BatchedTransitionOptimizer optimizer(*m_globalData, globalObject);
-
     const VarStack& varStack = programNode->varStack();
     const FunctionStack& functionStack = programNode->functionStack();
 
-    size_t newGlobals = varStack.size() + functionStack.size();
-    if (!newGlobals)
-        return;
-    globalObject->addRegisters(newGlobals);
-
     for (size_t i = 0; i < functionStack.size(); ++i) {
         FunctionBodyNode* function = functionStack[i];
-        bool propertyDidExist = 
-            globalObject->removeDirect(*m_globalData, function->ident()); // Newly declared functions overwrite existing properties.
-
-        JSValue value = JSFunction::create(exec, FunctionExecutable::create(*m_globalData, function), scope);
-        int index = addGlobalVar(
-            function->ident(), IsVariable,
-            !propertyDidExist ? IsFunctionToSpecialize : NotFunctionOrNotSpecializable);
-        globalObject->registerAt(index).set(*m_globalData, globalObject, value);
+        UnlinkedFunctionExecutable* unlinkedFunction = makeFunction(function);
+        codeBlock->addFunctionDeclaration(*m_globalData, function->ident(), unlinkedFunction);
     }
 
-    for (size_t i = 0; i < varStack.size(); ++i) {
-        if (globalObject->hasProperty(exec, *varStack[i].first))
-            continue;
-        addGlobalVar(
-            *varStack[i].first,
-            (varStack[i].second & DeclarationStacks::IsConstant) ? IsConstant : IsVariable,
-            NotFunctionOrNotSpecializable);
-    }
+    for (size_t i = 0; i < varStack.size(); ++i)
+        codeBlock->addVariableDeclaration(*varStack[i].first, !!(varStack[i].second & DeclarationStacks::IsConstant));
+
 }
 
-BytecodeGenerator::BytecodeGenerator(FunctionBodyNode* functionBody, JSScope* scope, SharedSymbolTable* symbolTable, CodeBlock* codeBlock, CompilationKind)
-    : m_shouldEmitDebugHooks(scope->globalObject()->debugger())
-    , m_shouldEmitProfileHooks(scope->globalObject()->globalObjectMethodTable()->supportsProfiling(scope->globalObject()))
-    , m_shouldEmitRichSourceInfo(scope->globalObject()->globalObjectMethodTable()->supportsRichSourceInfo(scope->globalObject()))
-    , m_scope(*scope->globalData(), scope)
-    , m_symbolTable(symbolTable)
+BytecodeGenerator::BytecodeGenerator(JSGlobalData& globalData, FunctionBodyNode* functionBody, UnlinkedFunctionCodeBlock* codeBlock, DebuggerMode debuggerMode, ProfilerMode profilerMode)
+    : m_shouldEmitDebugHooks(debuggerMode == DebuggerOn)
+    , m_shouldEmitProfileHooks(profilerMode == ProfilerOn)
+    , m_symbolTable(codeBlock->symbolTable())
 #if ENABLE(BYTECODE_COMMENTS)
     , m_currentCommentString(0)
 #endif
     , m_scopeNode(functionBody)
-    , m_codeBlock(codeBlock)
+    , m_codeBlock(globalData, codeBlock)
     , m_activationRegister(0)
     , m_emptyValueRegister(0)
     , m_finallyDepth(0)
     , m_dynamicScopeDepth(0)
-    , m_baseScopeDepth(0)
     , m_codeType(FunctionCode)
     , m_nextConstantOffset(0)
     , m_globalConstantIndex(0)
     , m_hasCreatedActivation(false)
     , m_firstLazyFunction(0)
     , m_lastLazyFunction(0)
-    , m_globalData(scope->globalData())
+    , m_globalData(&globalData)
     , m_lastOpcodeID(op_end)
 #ifndef NDEBUG
     , m_lastOpcodePosition(0)
@@ -353,15 +285,11 @@ BytecodeGenerator::BytecodeGenerator(FunctionBodyNode* functionBody, JSScope* sc
     , m_usesExceptions(false)
     , m_expressionTooDeep(false)
 {
-    m_globalData->startedCompiling(m_codeBlock);
-    m_codeBlock->setGlobalObjectConstant(emitLoad(0, JSValue(m_codeBlock->globalObject()))->index());
-
     if (m_shouldEmitDebugHooks)
         m_codeBlock->setNeedsFullScopeChain(true);
 
-    codeBlock->setGlobalData(m_globalData);
-    symbolTable->setUsesNonStrictEval(codeBlock->usesEval() && !codeBlock->isStrictMode());
-    symbolTable->setParameterCountIncludingThis(functionBody->parameters()->size() + 1);
+    m_symbolTable->setUsesNonStrictEval(codeBlock->usesEval() && !codeBlock->isStrictMode());
+    m_symbolTable->setParameterCountIncludingThis(functionBody->parameters()->size() + 1);
 
     prependComment("entering Function block");
     emitOpcode(op_enter);
@@ -372,7 +300,7 @@ BytecodeGenerator::BytecodeGenerator(FunctionBodyNode* functionBody, JSScope* sc
         m_codeBlock->setActivationRegister(m_activationRegister->index());
     }
 
-    symbolTable->setCaptureStart(m_codeBlock->m_numVars);
+    m_symbolTable->setCaptureStart(m_codeBlock->m_numVars);
 
     if (functionBody->usesArguments() || codeBlock->usesEval() || m_shouldEmitDebugHooks) { // May reify arguments object.
         RegisterID* unmodifiedArgumentsRegister = addVar(); // Anonymous, so it can't be modified by user code.
@@ -422,7 +350,7 @@ BytecodeGenerator::BytecodeGenerator(FunctionBodyNode* functionBody, JSScope* sc
     }
 
     if (capturesAnyArgumentByName && !codeBlock->isStrictMode()) {
-        size_t parameterCount = symbolTable->parameterCount();
+        size_t parameterCount = m_symbolTable->parameterCount();
         OwnArrayPtr<SlowArgument> slowArguments = adoptArrayPtr(new SlowArgument[parameterCount]);
         for (size_t i = 0; i < parameterCount; ++i) {
             if (!capturedArguments[i]) {
@@ -433,7 +361,7 @@ BytecodeGenerator::BytecodeGenerator(FunctionBodyNode* functionBody, JSScope* sc
             slowArguments[i].status = SlowArgument::Captured;
             slowArguments[i].index = capturedArguments[i]->index();
         }
-        symbolTable->setSlowArguments(slowArguments.release());
+        m_symbolTable->setSlowArguments(slowArguments.release());
     }
 
     RegisterID* calleeRegister = resolveCallee(functionBody); // May push to the scope chain and/or add a captured var.
@@ -474,7 +402,7 @@ BytecodeGenerator::BytecodeGenerator(FunctionBodyNode* functionBody, JSScope* sc
         instructions().append(m_activationRegister->index());
     }
 
-    symbolTable->setCaptureEnd(codeBlock->m_numVars);
+    m_symbolTable->setCaptureEnd(codeBlock->m_numVars);
 
     m_firstLazyFunction = codeBlock->m_numVars;
     for (size_t i = 0; i < functionStack.size(); ++i) {
@@ -502,7 +430,7 @@ BytecodeGenerator::BytecodeGenerator(FunctionBodyNode* functionBody, JSScope* sc
     }
 
     if (shouldCaptureAllTheThings)
-        symbolTable->setCaptureEnd(codeBlock->m_numVars);
+        m_symbolTable->setCaptureEnd(codeBlock->m_numVars);
 
     FunctionParameters& parameters = *functionBody->parameters();
     m_parameters.grow(parameters.size() + 1); // reserve space for "this"
@@ -532,35 +460,32 @@ BytecodeGenerator::BytecodeGenerator(FunctionBodyNode* functionBody, JSScope* sc
         emitOpcode(op_create_this);
         instructions().append(m_thisRegister.index());
     } else if (!codeBlock->isStrictMode() && (functionBody->usesThis() || codeBlock->usesEval() || m_shouldEmitDebugHooks)) {
-        ValueProfile* profile = emitProfiledOpcode(op_convert_this);
+        UnlinkedValueProfile profile = emitProfiledOpcode(op_convert_this);
         instructions().append(m_thisRegister.index());
         instructions().append(profile);
     }
 }
 
-BytecodeGenerator::BytecodeGenerator(EvalNode* evalNode, JSScope* scope, SharedSymbolTable* symbolTable, EvalCodeBlock* codeBlock, CompilationKind)
-    : m_shouldEmitDebugHooks(scope->globalObject()->debugger())
-    , m_shouldEmitProfileHooks(scope->globalObject()->globalObjectMethodTable()->supportsProfiling(scope->globalObject()))
-    , m_shouldEmitRichSourceInfo(scope->globalObject()->globalObjectMethodTable()->supportsRichSourceInfo(scope->globalObject()))
-    , m_scope(*scope->globalData(), scope)
-    , m_symbolTable(symbolTable)
+BytecodeGenerator::BytecodeGenerator(JSGlobalData& globalData, EvalNode* evalNode, UnlinkedEvalCodeBlock* codeBlock, DebuggerMode debuggerMode, ProfilerMode profilerMode)
+    : m_shouldEmitDebugHooks(debuggerMode == DebuggerOn)
+    , m_shouldEmitProfileHooks(profilerMode == ProfilerOn)
+    , m_symbolTable(codeBlock->symbolTable())
 #if ENABLE(BYTECODE_COMMENTS)
     , m_currentCommentString(0)
 #endif
     , m_scopeNode(evalNode)
-    , m_codeBlock(codeBlock)
+    , m_codeBlock(globalData, codeBlock)
     , m_thisRegister(CallFrame::thisArgumentOffset())
     , m_emptyValueRegister(0)
     , m_finallyDepth(0)
     , m_dynamicScopeDepth(0)
-    , m_baseScopeDepth(codeBlock->baseScopeDepth())
     , m_codeType(EvalCode)
     , m_nextConstantOffset(0)
     , m_globalConstantIndex(0)
     , m_hasCreatedActivation(true)
     , m_firstLazyFunction(0)
     , m_lastLazyFunction(0)
-    , m_globalData(scope->globalData())
+    , m_globalData(&globalData)
     , m_lastOpcodeID(op_end)
 #ifndef NDEBUG
     , m_lastOpcodePosition(0)
@@ -569,14 +494,9 @@ BytecodeGenerator::BytecodeGenerator(EvalNode* evalNode, JSScope* scope, SharedS
     , m_usesExceptions(false)
     , m_expressionTooDeep(false)
 {
-    m_globalData->startedCompiling(m_codeBlock);
-    m_codeBlock->setGlobalObjectConstant(emitLoad(0, JSValue(m_codeBlock->globalObject()))->index());
-
-    if (m_shouldEmitDebugHooks || m_baseScopeDepth)
-        m_codeBlock->setNeedsFullScopeChain(true);
+    m_codeBlock->setNeedsFullScopeChain(true);
 
-    codeBlock->setGlobalData(m_globalData);
-    symbolTable->setUsesNonStrictEval(codeBlock->usesEval() && !codeBlock->isStrictMode());    
+    m_symbolTable->setUsesNonStrictEval(codeBlock->usesEval() && !codeBlock->isStrictMode());
     m_codeBlock->setNumParameters(1);
 
     prependComment("entering Eval block");
@@ -584,7 +504,7 @@ BytecodeGenerator::BytecodeGenerator(EvalNode* evalNode, JSScope* scope, SharedS
 
     const DeclarationStacks::FunctionStack& functionStack = evalNode->functionStack();
     for (size_t i = 0; i < functionStack.size(); ++i)
-        m_codeBlock->addFunctionDecl(FunctionExecutable::create(*m_globalData, functionStack[i]));
+        m_codeBlock->addFunctionDecl(makeFunction(functionStack[i]));
 
     const DeclarationStacks::VarStack& varStack = evalNode->varStack();
     unsigned numVariables = varStack.size();
@@ -598,7 +518,6 @@ BytecodeGenerator::BytecodeGenerator(EvalNode* evalNode, JSScope* scope, SharedS
 
 BytecodeGenerator::~BytecodeGenerator()
 {
-    m_globalData->finishedCompiling(m_codeBlock);
 }
 
 RegisterID* BytecodeGenerator::emitInitLazyRegister(RegisterID* reg)
@@ -621,17 +540,6 @@ RegisterID* BytecodeGenerator::resolveCallee(FunctionBodyNode* functionBodyNode)
         instructions().append(addConstant(functionBodyNode->ident()));
         instructions().append(m_calleeRegister.index());
         instructions().append(ReadOnly | DontDelete);
-
-        // Put a mirror object in compilation scope, so compile-time variable resolution sees the property name we'll see at runtime.
-        m_scope.set(*globalData(),
-            JSNameScope::create(
-                m_scope->globalObject()->globalExec(),
-                functionBodyNode->ident(),
-                jsUndefined(),
-                ReadOnly | DontDelete,
-                m_scope.get()
-            )
-        );
         return 0;
     }
 
@@ -775,7 +683,7 @@ void BytecodeGenerator::emitOpcode(OpcodeID opcodeID)
     m_lastOpcodePosition = opcodePosition;
 #endif
     emitComment();
-    instructions().append(globalData()->interpreter->getOpcode(opcodeID));
+    instructions().append(opcodeID);
     m_lastOpcodeID = opcodeID;
 }
 
@@ -799,21 +707,21 @@ void BytecodeGenerator::prependComment(const char* string)
 }
 #endif
 
-ArrayProfile* BytecodeGenerator::newArrayProfile()
+UnlinkedArrayProfile BytecodeGenerator::newArrayProfile()
 {
 #if ENABLE(VALUE_PROFILER)
-    return m_codeBlock->addArrayProfile(instructions().size());
+    return m_codeBlock->addArrayProfile();
 #else
     return 0;
 #endif
 }
 
-ValueProfile* BytecodeGenerator::emitProfiledOpcode(OpcodeID opcodeID)
+UnlinkedValueProfile BytecodeGenerator::emitProfiledOpcode(OpcodeID opcodeID)
 {
 #if ENABLE(VALUE_PROFILER)
-    ValueProfile* result = m_codeBlock->addValueProfile(instructions().size());
+    UnlinkedValueProfile result = m_codeBlock->addValueProfile();
 #else
-    ValueProfile* result = 0;
+    UnlinkedValueProfile result = 0;
 #endif
     emitOpcode(opcodeID);
     return result;
@@ -843,14 +751,6 @@ void BytecodeGenerator::retrieveLastUnaryOp(int& dstIndex, int& srcIndex)
     srcIndex = instructions().at(size - 1).u.operand;
 }
 
-void BytecodeGenerator::retrieveLastUnaryOp(WriteBarrier<Unknown>*& dstPointer, int& srcIndex)
-{
-    ASSERT(instructions().size() >= 3);
-    size_t size = instructions().size();
-    dstPointer = instructions().at(size - 2).u.registerPointer;
-    srcIndex = instructions().at(size - 1).u.operand;
-}
-
 void ALWAYS_INLINE BytecodeGenerator::rewindBinaryOp()
 {
     ASSERT(instructions().size() >= 4);
@@ -1339,7 +1239,7 @@ ResolveResult BytecodeGenerator::resolve(const Identifier& property)
         return ResolveResult::registerResolve(thisRegister(), ResolveResult::ReadOnlyFlag);
 
     // Check if the property should be allocated in a register.
-    if (m_codeType != GlobalCode && shouldOptimizeLocals()) {
+    if (m_codeType != GlobalCode && shouldOptimizeLocals() && m_symbolTable) {
         SymbolTableEntry entry = symbolTable().get(property.impl());
         if (!entry.isNull()) {
             if (property == propertyNames().arguments)
@@ -1355,7 +1255,7 @@ ResolveResult BytecodeGenerator::resolve(const Identifier& property)
 ResolveResult BytecodeGenerator::resolveConstDecl(const Identifier& property)
 {
     // Register-allocated const declarations.
-    if (m_codeType != EvalCode && m_codeType != GlobalCode) {
+    if (m_codeType != EvalCode && m_codeType != GlobalCode && m_symbolTable) {
         SymbolTableEntry entry = symbolTable().get(property.impl());
         if (!entry.isNull()) {
             unsigned flags = entry.isReadOnly() ? ResolveResult::ReadOnlyFlag : 0;
@@ -1397,7 +1297,7 @@ RegisterID* BytecodeGenerator::emitResolve(RegisterID* dst, const ResolveResult&
     if (resolveResult.isRegister())
         return emitGetLocalVar(dst, resolveResult, property);
 
-    ValueProfile* profile = emitProfiledOpcode(op_resolve);
+    UnlinkedValueProfile profile = emitProfiledOpcode(op_resolve);
     instructions().append(dst->index());
     instructions().append(addConstant(property));
     instructions().append(getResolveOperations(property));
@@ -1409,7 +1309,7 @@ RegisterID* BytecodeGenerator::emitResolveBase(RegisterID* dst, const ResolveRes
 {
     ASSERT_UNUSED(resolveResult, !resolveResult.isRegister());
     // We can't optimise at all :-(
-    ValueProfile* profile = emitProfiledOpcode(op_resolve_base);
+    UnlinkedValueProfile profile = emitProfiledOpcode(op_resolve_base);
     instructions().append(dst->index());
     instructions().append(addConstant(property));
     instructions().append(false);
@@ -1423,7 +1323,7 @@ RegisterID* BytecodeGenerator::emitResolveBaseForPut(RegisterID* dst, const Reso
 {
     ASSERT_UNUSED(resolveResult, !resolveResult.isRegister());
     // We can't optimise at all :-(
-    ValueProfile* profile = emitProfiledOpcode(op_resolve_base);
+    UnlinkedValueProfile profile = emitProfiledOpcode(op_resolve_base);
     instructions().append(dst->index());
     instructions().append(addConstant(property));
     instructions().append(m_codeBlock->isStrictMode());
@@ -1438,7 +1338,7 @@ RegisterID* BytecodeGenerator::emitResolveBaseForPut(RegisterID* dst, const Reso
 RegisterID* BytecodeGenerator::emitResolveWithBaseForPut(RegisterID* baseDst, RegisterID* propDst, const ResolveResult& resolveResult, const Identifier& property, NonlocalResolveInfo& verifier)
 {
     ASSERT_UNUSED(resolveResult, !resolveResult.isRegister());
-    ValueProfile* profile = emitProfiledOpcode(op_resolve_with_base);
+    UnlinkedValueProfile profile = emitProfiledOpcode(op_resolve_with_base);
     instructions().append(baseDst->index());
     instructions().append(propDst->index());
     instructions().append(addConstant(property));
@@ -1458,7 +1358,7 @@ RegisterID* BytecodeGenerator::emitResolveWithThis(RegisterID* baseDst, Register
         return baseDst;
     }
 
-    ValueProfile* profile = emitProfiledOpcode(op_resolve_with_this);
+    UnlinkedValueProfile profile = emitProfiledOpcode(op_resolve_with_this);
     instructions().append(baseDst->index());
     instructions().append(propDst->index());
     instructions().append(addConstant(property));
@@ -1485,36 +1385,19 @@ RegisterID* BytecodeGenerator::emitGetLocalVar(RegisterID* dst, const ResolveRes
 RegisterID* BytecodeGenerator::emitInitGlobalConst(const Identifier& identifier, RegisterID* value)
 {
     ASSERT(m_codeType == GlobalCode);
-    JSGlobalObject* globalObject = m_codeBlock->globalObject();
-    SymbolTableEntry entry = globalObject->symbolTable()->get(identifier.impl());
-    if (entry.isNull())
-        return 0;
-    
-    if (entry.couldBeWatched()) {
-        emitOpcode(op_init_global_const_check);
-        instructions().append(&globalObject->registerAt(entry.getIndex()));
-        instructions().append(value->index());
-        instructions().append(entry.addressOfIsWatched());
-        instructions().append(addConstant(identifier));
-        return value;
-    }
-    
-    emitOpcode(op_init_global_const);
-    instructions().append(&globalObject->registerAt(entry.getIndex()));
+    emitOpcode(op_init_global_const_nop);
+    instructions().append(0);
     instructions().append(value->index());
+    instructions().append(0);
+    instructions().append(addConstant(identifier));
     return value;
 }
 
-void BytecodeGenerator::emitMethodCheck()
-{
-    emitOpcode(op_method_check);
-}
-
 RegisterID* BytecodeGenerator::emitGetById(RegisterID* dst, RegisterID* base, const Identifier& property)
 {
     m_codeBlock->addPropertyAccessInstruction(instructions().size());
 
-    ValueProfile* profile = emitProfiledOpcode(op_get_by_id);
+    UnlinkedValueProfile profile = emitProfiledOpcode(op_get_by_id);
     instructions().append(dst->index());
     instructions().append(base->index());
     instructions().append(addConstant(property));
@@ -1600,8 +1483,8 @@ RegisterID* BytecodeGenerator::emitDeleteById(RegisterID* dst, RegisterID* base,
 
 RegisterID* BytecodeGenerator::emitGetArgumentByVal(RegisterID* dst, RegisterID* base, RegisterID* property)
 {
-    ArrayProfile* arrayProfile = newArrayProfile();
-    ValueProfile* profile = emitProfiledOpcode(op_get_argument_by_val);
+    UnlinkedArrayProfile arrayProfile = newArrayProfile();
+    UnlinkedValueProfile profile = emitProfiledOpcode(op_get_argument_by_val);
     instructions().append(dst->index());
     ASSERT(base->index() == m_codeBlock->argumentsRegister());
     instructions().append(base->index());
@@ -1626,8 +1509,8 @@ RegisterID* BytecodeGenerator::emitGetByVal(RegisterID* dst, RegisterID* base, R
             return dst;
         }
     }
-    ArrayProfile* arrayProfile = newArrayProfile();
-    ValueProfile* profile = emitProfiledOpcode(op_get_by_val);
+    UnlinkedArrayProfile arrayProfile = newArrayProfile();
+    UnlinkedValueProfile profile = emitProfiledOpcode(op_get_by_val);
     instructions().append(dst->index());
     instructions().append(base->index());
     instructions().append(property->index());
@@ -1638,7 +1521,7 @@ RegisterID* BytecodeGenerator::emitGetByVal(RegisterID* dst, RegisterID* base, R
 
 RegisterID* BytecodeGenerator::emitPutByVal(RegisterID* base, RegisterID* property, RegisterID* value)
 {
-    ArrayProfile* arrayProfile = newArrayProfile();
+    UnlinkedArrayProfile arrayProfile = newArrayProfile();
     emitOpcode(op_put_by_val);
     instructions().append(base->index());
     instructions().append(property->index());
@@ -1708,7 +1591,7 @@ RegisterID* BytecodeGenerator::emitNewArray(RegisterID* dst, ElementNode* elemen
         if (!hadVariableExpression) {
             ASSERT(length == checkLength);
             unsigned constantBufferIndex = addConstantBuffer(length);
-            JSValue* constantBuffer = m_codeBlock->constantBuffer(constantBufferIndex);
+            JSValue* constantBuffer = m_codeBlock->constantBuffer(constantBufferIndex).data();
             unsigned index = 0;
             for (ElementNode* n = elements; index < length; n = n->next()) {
                 if (n->value()->isNumber())
@@ -1744,14 +1627,14 @@ RegisterID* BytecodeGenerator::emitNewArray(RegisterID* dst, ElementNode* elemen
 
 RegisterID* BytecodeGenerator::emitNewFunction(RegisterID* dst, FunctionBodyNode* function)
 {
-    return emitNewFunctionInternal(dst, m_codeBlock->addFunctionDecl(FunctionExecutable::create(*m_globalData, function)), false);
+    return emitNewFunctionInternal(dst, m_codeBlock->addFunctionDecl(makeFunction(function)), false);
 }
 
 RegisterID* BytecodeGenerator::emitLazyNewFunction(RegisterID* dst, FunctionBodyNode* function)
 {
     FunctionOffsetMap::AddResult ptr = m_functionOffsets.add(function, 0);
     if (ptr.isNewEntry)
-        ptr.iterator->value = m_codeBlock->addFunctionDecl(FunctionExecutable::create(*m_globalData, function));
+        ptr.iterator->value = m_codeBlock->addFunctionDecl(makeFunction(function));
     return emitNewFunctionInternal(dst, ptr.iterator->value, true);
 }
 
@@ -1776,7 +1659,7 @@ RegisterID* BytecodeGenerator::emitNewRegExp(RegisterID* dst, RegExp* regExp)
 RegisterID* BytecodeGenerator::emitNewFunctionExpression(RegisterID* r0, FuncExprNode* n)
 {
     FunctionBodyNode* function = n->body();
-    unsigned index = m_codeBlock->addFunctionExpr(FunctionExecutable::create(*m_globalData, function));
+    unsigned index = m_codeBlock->addFunctionExpr(makeFunction(function));
     
     createActivationIfNecessary();
     emitOpcode(op_new_func_exp);
@@ -1927,7 +1810,7 @@ RegisterID* BytecodeGenerator::emitCall(OpcodeID opcodeID, RegisterID* dst, Regi
     expectedFunction = emitExpectedFunctionSnippet(dst, func, expectedFunction, callArguments, done.get());
     
     // Emit call.
-    ArrayProfile* arrayProfile = newArrayProfile();
+    UnlinkedArrayProfile arrayProfile = newArrayProfile();
     emitOpcode(opcodeID);
     instructions().append(func->index()); // func
     instructions().append(callArguments.argumentCountIncludingThis()); // argCount
@@ -1939,7 +1822,7 @@ RegisterID* BytecodeGenerator::emitCall(OpcodeID opcodeID, RegisterID* dst, Regi
 #endif
     instructions().append(arrayProfile);
     if (dst != ignoredResult()) {
-        ValueProfile* profile = emitProfiledOpcode(op_call_put_result);
+        UnlinkedValueProfile profile = emitProfiledOpcode(op_call_put_result);
         instructions().append(dst->index()); // dst
         instructions().append(profile);
     }
@@ -1972,7 +1855,7 @@ RegisterID* BytecodeGenerator::emitCallVarargs(RegisterID* dst, RegisterID* func
     instructions().append(arguments->index());
     instructions().append(firstFreeRegister->index());
     if (dst != ignoredResult()) {
-        ValueProfile* profile = emitProfiledOpcode(op_call_put_result);
+        UnlinkedValueProfile profile = emitProfiledOpcode(op_call_put_result);
         instructions().append(dst->index());
         instructions().append(profile);
     }
@@ -2055,7 +1938,7 @@ RegisterID* BytecodeGenerator::emitConstruct(RegisterID* dst, RegisterID* func,
 #endif
     instructions().append(0);
     if (dst != ignoredResult()) {
-        ValueProfile* profile = emitProfiledOpcode(op_call_put_result);
+        UnlinkedValueProfile profile = emitProfiledOpcode(op_call_put_result);
         instructions().append(dst->index()); // dst
         instructions().append(profile);
     }
@@ -2131,11 +2014,11 @@ void BytecodeGenerator::pushFinallyContext(StatementNode* finallyBlock)
     scope.isFinallyBlock = true;
     FinallyContext context = {
         finallyBlock,
-        m_scopeContextStack.size(),
-        m_switchContextStack.size(),
-        m_forInContextStack.size(),
-        m_tryContextStack.size(),
-        m_labelScopes.size(),
+        static_cast<unsigned>(m_scopeContextStack.size()),
+        static_cast<unsigned>(m_switchContextStack.size()),
+        static_cast<unsigned>(m_forInContextStack.size()),
+        static_cast<unsigned>(m_tryContextStack.size()),
+        static_cast<unsigned>(m_labelScopes.size()),
         m_finallyDepth,
         m_dynamicScopeDepth
     };
@@ -2434,7 +2317,7 @@ RegisterID* BytecodeGenerator::popTryAndEmitCatch(TryData* tryData, RegisterID*
     m_tryContextStack.removeLast();
     
     emitLabel(tryRange.tryData->target.get());
-    tryRange.tryData->targetScopeDepth = m_dynamicScopeDepth + m_baseScopeDepth;
+    tryRange.tryData->targetScopeDepth = m_dynamicScopeDepth;
 
     emitOpcode(op_catch);
     instructions().append(targetRegister->index());
@@ -2443,8 +2326,9 @@ RegisterID* BytecodeGenerator::popTryAndEmitCatch(TryData* tryData, RegisterID*
 
 void BytecodeGenerator::emitThrowReferenceError(const String& message)
 {
-    emitOpcode(op_throw_reference_error);
+    emitOpcode(op_throw_static_error);
     instructions().append(addConstantValue(jsString(globalData(), message))->index());
+    instructions().append(true);
 }
 
 void BytecodeGenerator::emitPushNameScope(const Identifier& property, RegisterID* value, unsigned attributes)
@@ -2462,7 +2346,7 @@ void BytecodeGenerator::emitPushNameScope(const Identifier& property, RegisterID
 
 void BytecodeGenerator::beginSwitch(RegisterID* scrutineeRegister, SwitchInfo::SwitchType type)
 {
-    SwitchInfo info = { instructions().size(), type };
+    SwitchInfo info = { static_cast<uint32_t>(instructions().size()), type };
     switch (type) {
         case SwitchInfo::SwitchImmediate:
             emitOpcode(op_switch_imm);
@@ -2495,7 +2379,7 @@ static int32_t keyForImmediateSwitch(ExpressionNode* node, int32_t min, int32_t
     return key - min;
 }
 
-static void prepareJumpTableForImmediateSwitch(SimpleJumpTable& jumpTable, int32_t switchAddress, uint32_t clauseCount, RefPtr<Label>* labels, ExpressionNode** nodes, int32_t min, int32_t max)
+static void prepareJumpTableForImmediateSwitch(UnlinkedSimpleJumpTable& jumpTable, int32_t switchAddress, uint32_t clauseCount, RefPtr<Label>* labels, ExpressionNode** nodes, int32_t min, int32_t max)
 {
     jumpTable.min = min;
     jumpTable.branchOffsets.resize(max - min + 1);
@@ -2521,7 +2405,7 @@ static int32_t keyForCharacterSwitch(ExpressionNode* node, int32_t min, int32_t
     return key - min;
 }
 
-static void prepareJumpTableForCharacterSwitch(SimpleJumpTable& jumpTable, int32_t switchAddress, uint32_t clauseCount, RefPtr<Label>* labels, ExpressionNode** nodes, int32_t min, int32_t max)
+static void prepareJumpTableForCharacterSwitch(UnlinkedSimpleJumpTable& jumpTable, int32_t switchAddress, uint32_t clauseCount, RefPtr<Label>* labels, ExpressionNode** nodes, int32_t min, int32_t max)
 {
     jumpTable.min = min;
     jumpTable.branchOffsets.resize(max - min + 1);
@@ -2534,7 +2418,7 @@ static void prepareJumpTableForCharacterSwitch(SimpleJumpTable& jumpTable, int32
     }
 }
 
-static void prepareJumpTableForStringSwitch(StringJumpTable& jumpTable, int32_t switchAddress, uint32_t clauseCount, RefPtr<Label>* labels, ExpressionNode** nodes)
+static void prepareJumpTableForStringSwitch(UnlinkedStringJumpTable& jumpTable, int32_t switchAddress, uint32_t clauseCount, RefPtr<Label>* labels, ExpressionNode** nodes)
 {
     for (uint32_t i = 0; i < clauseCount; ++i) {
         // We're emitting this after the clause labels should have been fixed, so 
@@ -2543,9 +2427,7 @@ static void prepareJumpTableForStringSwitch(StringJumpTable& jumpTable, int32_t
         
         ASSERT(nodes[i]->isString());
         StringImpl* clause = static_cast<StringNode*>(nodes[i])->value().impl();
-        OffsetLocation location;
-        location.branchOffset = labels[i]->bind(switchAddress, switchAddress + 3);
-        jumpTable.offsetTable.add(clause, location);
+        jumpTable.offsetTable.add(clause, labels[i]->bind(switchAddress, switchAddress + 3));
     }
 }
 
@@ -2557,20 +2439,20 @@ void BytecodeGenerator::endSwitch(uint32_t clauseCount, RefPtr<Label>* labels, E
         instructions()[switchInfo.bytecodeOffset + 1] = m_codeBlock->numberOfImmediateSwitchJumpTables();
         instructions()[switchInfo.bytecodeOffset + 2] = defaultLabel->bind(switchInfo.bytecodeOffset, switchInfo.bytecodeOffset + 3);
 
-        SimpleJumpTable& jumpTable = m_codeBlock->addImmediateSwitchJumpTable();
+        UnlinkedSimpleJumpTable& jumpTable = m_codeBlock->addImmediateSwitchJumpTable();
         prepareJumpTableForImmediateSwitch(jumpTable, switchInfo.bytecodeOffset, clauseCount, labels, nodes, min, max);
     } else if (switchInfo.switchType == SwitchInfo::SwitchCharacter) {
         instructions()[switchInfo.bytecodeOffset + 1] = m_codeBlock->numberOfCharacterSwitchJumpTables();
         instructions()[switchInfo.bytecodeOffset + 2] = defaultLabel->bind(switchInfo.bytecodeOffset, switchInfo.bytecodeOffset + 3);
         
-        SimpleJumpTable& jumpTable = m_codeBlock->addCharacterSwitchJumpTable();
+        UnlinkedSimpleJumpTable& jumpTable = m_codeBlock->addCharacterSwitchJumpTable();
         prepareJumpTableForCharacterSwitch(jumpTable, switchInfo.bytecodeOffset, clauseCount, labels, nodes, min, max);
     } else {
         ASSERT(switchInfo.switchType == SwitchInfo::SwitchString);
         instructions()[switchInfo.bytecodeOffset + 1] = m_codeBlock->numberOfStringSwitchJumpTables();
         instructions()[switchInfo.bytecodeOffset + 2] = defaultLabel->bind(switchInfo.bytecodeOffset, switchInfo.bytecodeOffset + 3);
 
-        StringJumpTable& jumpTable = m_codeBlock->addStringSwitchJumpTable();
+        UnlinkedStringJumpTable& jumpTable = m_codeBlock->addStringSwitchJumpTable();
         prepareJumpTableForStringSwitch(jumpTable, switchInfo.bytecodeOffset, clauseCount, labels, nodes);
     }
 }
@@ -2602,9 +2484,9 @@ void BytecodeGenerator::emitReadOnlyExceptionIfNeeded()
 {
     if (!isStrictMode())
         return;
-
-    RefPtr<RegisterID> error = emitLoad(newTemporary(), JSValue(createTypeError(scope()->globalObject()->globalExec(), StrictModeReadonlyPropertyWriteError)));
-    emitThrow(error.get());
+    emitOpcode(op_throw_static_error);
+    instructions().append(addConstantValue(jsString(globalData(), StrictModeReadonlyPropertyWriteError))->index());
+    instructions().append(false);
 }
 
 } // namespace JSC
diff --git a/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.h b/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.h
index 246530ab2..828726dee 100644
--- a/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.h
+++ b/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.h
@@ -41,6 +41,7 @@
 #include "SymbolTable.h"
 #include "Debugger.h"
 #include "Nodes.h"
+#include "UnlinkedCodeBlock.h"
 #include <wtf/PassRefPtr.h>
 #include <wtf/SegmentedVector.h>
 #include <wtf/Vector.h>
@@ -211,18 +212,18 @@ namespace JSC {
         JS_EXPORT_PRIVATE static void setDumpsGeneratedCode(bool dumpsGeneratedCode);
         static bool dumpsGeneratedCode();
 
-        BytecodeGenerator(ProgramNode*, JSScope*, SharedSymbolTable*, ProgramCodeBlock*, CompilationKind);
-        BytecodeGenerator(FunctionBodyNode*, JSScope*, SharedSymbolTable*, CodeBlock*, CompilationKind);
-        BytecodeGenerator(EvalNode*, JSScope*, SharedSymbolTable*, EvalCodeBlock*, CompilationKind);
+        BytecodeGenerator(JSGlobalData&, ProgramNode*, UnlinkedProgramCodeBlock*, DebuggerMode, ProfilerMode);
+        BytecodeGenerator(JSGlobalData&, FunctionBodyNode*, UnlinkedFunctionCodeBlock*, DebuggerMode, ProfilerMode);
+        BytecodeGenerator(JSGlobalData&, EvalNode*, UnlinkedEvalCodeBlock*, DebuggerMode, ProfilerMode);
 
         ~BytecodeGenerator();
         
         JSGlobalData* globalData() const { return m_globalData; }
         const CommonIdentifiers& propertyNames() const { return *m_globalData->propertyNames; }
 
-        bool isConstructor() { return m_codeBlock->m_isConstructor; }
+        bool isConstructor() { return m_codeBlock->isConstructor(); }
 
-        JSObject* generate();
+        ParserError generate();
 
         bool isArgumentNumber(const Identifier&, int);
 
@@ -332,10 +333,7 @@ namespace JSC {
 
         void emitExpressionInfo(unsigned divot, unsigned startOffset, unsigned endOffset)
         {
-            if (!m_shouldEmitRichSourceInfo)
-                return;
-
-            divot -= m_codeBlock->sourceOffset();
+            divot -= m_scopeNode->source().startOffset();
             if (divot > ExpressionRangeInfo::MaxDivot) {
                 // Overflow has occurred, we can only give line number info for errors for this region
                 divot = 0;
@@ -421,8 +419,6 @@ namespace JSC {
 
         RegisterID* emitPutToBase(RegisterID* base, const Identifier&, RegisterID* value, NonlocalResolveInfo&);
 
-        void emitMethodCheck();
-
         RegisterID* emitGetById(RegisterID* dst, RegisterID* base, const Identifier& property);
         RegisterID* emitGetArgumentsLength(RegisterID* dst, RegisterID* base);
         RegisterID* emitPutById(RegisterID* base, const Identifier& property, RegisterID* value);
@@ -510,8 +506,6 @@ namespace JSC {
         bool shouldEmitProfileHooks() { return m_shouldEmitProfileHooks; }
         
         bool isStrictMode() const { return m_codeBlock->isStrictMode(); }
-        
-        JSScope* scope() const { return m_scope.get(); }
 
     private:
         friend class Label;
@@ -529,11 +523,10 @@ namespace JSC {
 #endif
 
         void emitOpcode(OpcodeID);
-        ArrayProfile* newArrayProfile();
-        ValueProfile* emitProfiledOpcode(OpcodeID);
+        UnlinkedArrayProfile newArrayProfile();
+        UnlinkedValueProfile emitProfiledOpcode(OpcodeID);
         void retrieveLastBinaryOp(int& dstIndex, int& src1Index, int& src2Index);
         void retrieveLastUnaryOp(int& dstIndex, int& srcIndex);
-        void retrieveLastUnaryOp(WriteBarrier<Unknown>*& dstPointer, int& srcIndex);
         ALWAYS_INLINE void rewindBinaryOp();
         ALWAYS_INLINE void rewindUnaryOp();
 
@@ -576,10 +569,6 @@ namespace JSC {
         }
 
         // Returns the index of the added var.
-        enum ConstantMode { IsConstant, IsVariable };
-        enum FunctionMode { IsFunctionToSpecialize, NotFunctionOrNotSpecializable };
-        int addGlobalVar(const Identifier&, ConstantMode, FunctionMode);
-
         void addParameter(const Identifier&, int parameterIndex);
         RegisterID* resolveCallee(FunctionBodyNode*);
         void addCallee(FunctionBodyNode*, RegisterID*);
@@ -606,17 +595,22 @@ namespace JSC {
 
         unsigned addConstantBuffer(unsigned length);
         
+        UnlinkedFunctionExecutable* makeFunction(FunctionBodyNode* body)
+        {
+            return UnlinkedFunctionExecutable::create(m_globalData, m_scopeNode->source(), body);
+        }
+
         JSString* addStringConstant(const Identifier&);
 
         void addLineInfo(unsigned lineNo)
         {
-            m_codeBlock->addLineInfo(instructions().size(), lineNo);
+            m_codeBlock->addLineInfo(instructions().size(), lineNo - m_scopeNode->firstLine());
         }
 
         RegisterID* emitInitLazyRegister(RegisterID*);
 
     public:
-        Vector<Instruction>& instructions() { return m_instructions; }
+        Vector<UnlinkedInstruction>& instructions() { return m_instructions; }
 
         SharedSymbolTable& symbolTable() { return *m_symbolTable; }
 #if ENABLE(BYTECODE_COMMENTS)
@@ -654,13 +648,11 @@ namespace JSC {
         void createActivationIfNecessary();
         RegisterID* createLazyRegisterIfNecessary(RegisterID*);
         
-        Vector<Instruction> m_instructions;
+        Vector<UnlinkedInstruction> m_instructions;
 
         bool m_shouldEmitDebugHooks;
         bool m_shouldEmitProfileHooks;
-        bool m_shouldEmitRichSourceInfo;
 
-        Strong<JSScope> m_scope;
         SharedSymbolTable* m_symbolTable;
 
 #if ENABLE(BYTECODE_COMMENTS)
@@ -669,7 +661,7 @@ namespace JSC {
 #endif
 
         ScopeNode* m_scopeNode;
-        CodeBlock* m_codeBlock;
+        Strong<UnlinkedCodeBlock> m_codeBlock;
 
         // Some of these objects keep pointers to one another. They are arranged
         // to ensure a sane destruction order that avoids references to freed memory.
@@ -687,7 +679,6 @@ namespace JSC {
         RefPtr<RegisterID> m_lastVar;
         int m_finallyDepth;
         int m_dynamicScopeDepth;
-        int m_baseScopeDepth;
         CodeType m_codeType;
 
         Vector<ControlFlowContext> m_scopeContextStack;
diff --git a/Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp b/Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp
index 68811955f..85da1f4eb 100644
--- a/Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp
+++ b/Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp
@@ -469,7 +469,6 @@ RegisterID* FunctionCallDotNode::emitBytecode(BytecodeGenerator& generator, Regi
     CallArguments callArguments(generator, m_args);
     generator.emitNode(callArguments.thisRegister(), m_base);
     generator.emitExpressionInfo(divot() - m_subexpressionDivotOffset, startOffset() - m_subexpressionDivotOffset, m_subexpressionEndOffset);
-    generator.emitMethodCheck();
     generator.emitGetById(function.get(), callArguments.thisRegister(), m_ident);
     return generator.emitCall(generator.finalDestinationOrIgnored(dst, function.get()), function.get(), NoExpectedFunction, callArguments, divot(), startOffset(), endOffset());
 }
diff --git a/Source/JavaScriptCore/debugger/Debugger.cpp b/Source/JavaScriptCore/debugger/Debugger.cpp
index 3731b0473..b14729146 100644
--- a/Source/JavaScriptCore/debugger/Debugger.cpp
+++ b/Source/JavaScriptCore/debugger/Debugger.cpp
@@ -80,6 +80,7 @@ inline void Recompiler::operator()(JSCell* cell)
 
     ExecState* exec = function->scope()->globalObject()->JSGlobalObject::globalExec();
     executable->clearCodeIfNotCompiling();
+    executable->clearUnlinkedCodeIfNotCompiling();
     if (m_debugger == function->scope()->globalObject()->debugger())
         m_sourceProviders.add(executable->source().provider(), exec);
 }
diff --git a/Source/JavaScriptCore/dfg/DFGAbstractState.cpp b/Source/JavaScriptCore/dfg/DFGAbstractState.cpp
index 58ff7d23c..e518c24a8 100644
--- a/Source/JavaScriptCore/dfg/DFGAbstractState.cpp
+++ b/Source/JavaScriptCore/dfg/DFGAbstractState.cpp
@@ -839,7 +839,7 @@ bool AbstractState::execute(unsigned indexInBlock)
             
     case GetByVal: {
         node.setCanExit(true);
-        switch (node.arrayMode()) {
+        switch (node.arrayMode().type()) {
         case Array::SelectUsingPredictions:
         case Array::Unprofiled:
             ASSERT_NOT_REACHED();
@@ -859,18 +859,12 @@ bool AbstractState::execute(unsigned indexInBlock)
             forNode(node.child2()).filter(SpecInt32);
             forNode(nodeIndex).makeTop();
             break;
-        case IN_BOUNDS_CONTIGUOUS_MODES:
-        case IN_BOUNDS_ARRAY_STORAGE_MODES:
+        case Array::Contiguous:
+        case Array::ArrayStorage:
+        case Array::SlowPutArrayStorage:
             forNode(node.child2()).filter(SpecInt32);
-            forNode(nodeIndex).makeTop();
-            break;
-        case OUT_OF_BOUNDS_CONTIGUOUS_MODES:
-        case OUT_OF_BOUNDS_ARRAY_STORAGE_MODES:
-        case SLOW_PUT_ARRAY_STORAGE_MODES:
-        case ALL_EFFECTFUL_MODES:
-            forNode(node.child1()).filter(SpecCell);
-            forNode(node.child2()).filter(SpecInt32);
-            clobberWorld(node.codeOrigin, indexInBlock);
+            if (node.arrayMode().isOutOfBounds())
+                clobberWorld(node.codeOrigin, indexInBlock);
             forNode(nodeIndex).makeTop();
             break;
         case Array::Int8Array:
@@ -925,31 +919,32 @@ bool AbstractState::execute(unsigned indexInBlock)
         Edge child1 = m_graph.varArgChild(node, 0);
         Edge child2 = m_graph.varArgChild(node, 1);
         Edge child3 = m_graph.varArgChild(node, 2);
-        switch (modeForPut(node.arrayMode())) {
+        switch (node.arrayMode().modeForPut().type()) {
         case Array::ForceExit:
             m_isValid = false;
             break;
         case Array::Generic:
             clobberWorld(node.codeOrigin, indexInBlock);
             break;
-        case IN_BOUNDS_CONTIGUOUS_MODES:
-        case CONTIGUOUS_TO_TAIL_MODES:
-        case IN_BOUNDS_ARRAY_STORAGE_MODES:
+        case Array::Contiguous:
+        case Array::ArrayStorage:
+            forNode(child1).filter(SpecCell);
             forNode(child2).filter(SpecInt32);
+            if (node.arrayMode().isOutOfBounds())
+                clobberWorld(node.codeOrigin, indexInBlock);
             break;
-        case OUT_OF_BOUNDS_CONTIGUOUS_MODES:
-        case ARRAY_STORAGE_TO_HOLE_MODES:
-        case OUT_OF_BOUNDS_ARRAY_STORAGE_MODES:
-        case SLOW_PUT_ARRAY_STORAGE_MODES:
-        case ALL_EFFECTFUL_MODES:
+        case Array::SlowPutArrayStorage:
             forNode(child1).filter(SpecCell);
             forNode(child2).filter(SpecInt32);
-            clobberWorld(node.codeOrigin, indexInBlock);
+            if (node.arrayMode().mayStoreToHole())
+                clobberWorld(node.codeOrigin, indexInBlock);
             break;
         case Array::Arguments:
+            forNode(child1).filter(SpecCell);
             forNode(child2).filter(SpecInt32);
             break;
         case Array::Int8Array:
+            forNode(child1).filter(SpecCell);
             forNode(child2).filter(SpecInt32);
             if (m_graph[child3].shouldSpeculateInteger())
                 forNode(child3).filter(SpecInt32);
@@ -957,6 +952,7 @@ bool AbstractState::execute(unsigned indexInBlock)
                 forNode(child3).filter(SpecNumber);
             break;
         case Array::Int16Array:
+            forNode(child1).filter(SpecCell);
             forNode(child2).filter(SpecInt32);
             if (m_graph[child3].shouldSpeculateInteger())
                 forNode(child3).filter(SpecInt32);
@@ -964,6 +960,7 @@ bool AbstractState::execute(unsigned indexInBlock)
                 forNode(child3).filter(SpecNumber);
             break;
         case Array::Int32Array:
+            forNode(child1).filter(SpecCell);
             forNode(child2).filter(SpecInt32);
             if (m_graph[child3].shouldSpeculateInteger())
                 forNode(child3).filter(SpecInt32);
@@ -971,6 +968,7 @@ bool AbstractState::execute(unsigned indexInBlock)
                 forNode(child3).filter(SpecNumber);
             break;
         case Array::Uint8Array:
+            forNode(child1).filter(SpecCell);
             forNode(child2).filter(SpecInt32);
             if (m_graph[child3].shouldSpeculateInteger())
                 forNode(child3).filter(SpecInt32);
@@ -978,6 +976,7 @@ bool AbstractState::execute(unsigned indexInBlock)
                 forNode(child3).filter(SpecNumber);
             break;
         case Array::Uint8ClampedArray:
+            forNode(child1).filter(SpecCell);
             forNode(child2).filter(SpecInt32);
             if (m_graph[child3].shouldSpeculateInteger())
                 forNode(child3).filter(SpecInt32);
@@ -985,6 +984,7 @@ bool AbstractState::execute(unsigned indexInBlock)
                 forNode(child3).filter(SpecNumber);
             break;
         case Array::Uint16Array:
+            forNode(child1).filter(SpecCell);
             forNode(child2).filter(SpecInt32);
             if (m_graph[child3].shouldSpeculateInteger())
                 forNode(child3).filter(SpecInt32);
@@ -992,6 +992,7 @@ bool AbstractState::execute(unsigned indexInBlock)
                 forNode(child3).filter(SpecNumber);
             break;
         case Array::Uint32Array:
+            forNode(child1).filter(SpecCell);
             forNode(child2).filter(SpecInt32);
             if (m_graph[child3].shouldSpeculateInteger())
                 forNode(child3).filter(SpecInt32);
@@ -999,15 +1000,17 @@ bool AbstractState::execute(unsigned indexInBlock)
                 forNode(child3).filter(SpecNumber);
             break;
         case Array::Float32Array:
+            forNode(child1).filter(SpecCell);
             forNode(child2).filter(SpecInt32);
             forNode(child3).filter(SpecNumber);
             break;
         case Array::Float64Array:
+            forNode(child1).filter(SpecCell);
             forNode(child2).filter(SpecInt32);
             forNode(child3).filter(SpecNumber);
             break;
         default:
-            ASSERT_NOT_REACHED();
+            CRASH();
             break;
         }
         break;
@@ -1324,7 +1327,8 @@ bool AbstractState::execute(unsigned indexInBlock)
         // the futurePossibleStructure set then the constant folding phase should
         // turn this into a watchpoint instead.
         StructureSet& set = node.structureSet();
-        if (value.m_futurePossibleStructure.isSubsetOf(set))
+        if (value.m_futurePossibleStructure.isSubsetOf(set)
+            || value.m_currentKnownStructure.isSubsetOf(set))
             m_foundConstants = true;
         node.setCanExit(
             !value.m_currentKnownStructure.isSubsetOf(set)
@@ -1365,23 +1369,24 @@ bool AbstractState::execute(unsigned indexInBlock)
     case GetButterfly:
     case AllocatePropertyStorage:
     case ReallocatePropertyStorage:
-        node.setCanExit(false);
+        node.setCanExit(!isCellSpeculation(forNode(node.child1()).m_type));
         forNode(node.child1()).filter(SpecCell);
         forNode(nodeIndex).clear(); // The result is not a JS value.
         break;
     case CheckArray: {
-        if (modeAlreadyChecked(forNode(node.child1()), node.arrayMode())) {
+        if (node.arrayMode().alreadyChecked(forNode(node.child1()))) {
             m_foundConstants = true;
             node.setCanExit(false);
             break;
         }
         node.setCanExit(true); // Lies, but this is followed by operations (like GetByVal) that always exit, so there is no point in us trying to be clever here.
-        switch (node.arrayMode()) {
+        switch (node.arrayMode().type()) {
         case Array::String:
             forNode(node.child1()).filter(SpecString);
             break;
-        case ALL_CONTIGUOUS_MODES:
-        case ALL_ARRAY_STORAGE_MODES:
+        case Array::Contiguous:
+        case Array::ArrayStorage:
+        case Array::SlowPutArrayStorage:
             // This doesn't filter anything meaningful right now. We may want to add
             // CFA tracking of array mode speculations, but we don't have that, yet.
             forNode(node.child1()).filter(SpecCell);
@@ -1420,33 +1425,40 @@ bool AbstractState::execute(unsigned indexInBlock)
             ASSERT_NOT_REACHED();
             break;
         }
-        forNode(node.child1()).filterArrayModes(arrayModesFor(node.arrayMode()));
+        forNode(node.child1()).filterArrayModes(node.arrayMode().arrayModesThatPassFiltering());
+        m_haveStructures = true;
         break;
     }
     case Arrayify: {
-        if (modeAlreadyChecked(forNode(node.child1()), node.arrayMode())) {
+        if (node.arrayMode().alreadyChecked(forNode(node.child1()))) {
             m_foundConstants = true;
             node.setCanExit(false);
             break;
         }
-        switch (node.arrayMode()) {
-        case ALL_EFFECTFUL_MODES:
-            node.setCanExit(true);
-            forNode(node.child1()).filter(SpecCell);
-            if (node.child2())
-                forNode(node.child2()).filter(SpecInt32);
-            forNode(nodeIndex).clear();
-            clobberStructures(indexInBlock);
-            forNode(node.child1()).filterArrayModes(arrayModesFor(node.arrayMode()));
-            break;
-        default:
-            CRASH();
-            break;
-        }
+        ASSERT(node.arrayMode().conversion() == Array::Convert);
+        node.setCanExit(true);
+        forNode(node.child1()).filter(SpecCell);
+        if (node.child2())
+            forNode(node.child2()).filter(SpecInt32);
+        clobberStructures(indexInBlock);
+        forNode(node.child1()).filterArrayModes(node.arrayMode().arrayModesThatPassFiltering());
+        m_haveStructures = true;
+        break;
+    }
+    case ArrayifyToStructure: {
+        AbstractValue& value = forNode(node.child1());
+        StructureSet set = node.structure();
+        if (value.m_futurePossibleStructure.isSubsetOf(set)
+            || value.m_currentKnownStructure.isSubsetOf(set))
+            m_foundConstants = true;
+        node.setCanExit(true);
+        clobberStructures(indexInBlock);
+        value.filter(set);
+        m_haveStructures = true;
         break;
     }
     case GetIndexedPropertyStorage: {
-        switch (node.arrayMode()) {
+        switch (node.arrayMode().type()) {
         case Array::String:
             // Strings are weird - we may spec fail if the string was a rope. That is of course
             // stupid, and we should fix that, but for now let's at least be honest about it.
@@ -1460,13 +1472,13 @@ bool AbstractState::execute(unsigned indexInBlock)
         break; 
     }
     case GetByOffset:
-        node.setCanExit(false);
+        node.setCanExit(!isCellSpeculation(forNode(node.child1()).m_type));
         forNode(node.child1()).filter(SpecCell);
         forNode(nodeIndex).makeTop();
         break;
             
     case PutByOffset:
-        node.setCanExit(false);
+        node.setCanExit(!isCellSpeculation(forNode(node.child1()).m_type));
         forNode(node.child1()).filter(SpecCell);
         break;
             
diff --git a/Source/JavaScriptCore/dfg/DFGAbstractValue.h b/Source/JavaScriptCore/dfg/DFGAbstractValue.h
index 5382cd3ad..c198b5e52 100644
--- a/Source/JavaScriptCore/dfg/DFGAbstractValue.h
+++ b/Source/JavaScriptCore/dfg/DFGAbstractValue.h
@@ -458,29 +458,11 @@ struct AbstractValue {
 private:
     void clobberArrayModes()
     {
-        if (m_arrayModes == ALL_ARRAY_MODES)
-            return;
-        
-        if (LIKELY(m_arrayModes & asArrayModes(NonArray)))
-            m_arrayModes = ALL_ARRAY_MODES;
-        else
-            clobberArrayModesSlow();
+        // FIXME: We could make this try to predict the set of array modes that this object
+        // could have in the future. For now, just do the simple thing.
+        m_arrayModes = ALL_ARRAY_MODES;
     }
     
-    void clobberArrayModesSlow()
-    {
-        if (m_arrayModes & asArrayModes(ArrayClass))
-            m_arrayModes = ALL_ARRAY_MODES;
-        else if (m_arrayModes & asArrayModes(NonArrayWithContiguous))
-            m_arrayModes |= asArrayModes(NonArrayWithArrayStorage) | asArrayModes(NonArrayWithSlowPutArrayStorage);
-        else if (m_arrayModes & asArrayModes(ArrayWithContiguous))
-            m_arrayModes |= asArrayModes(ArrayWithArrayStorage) | asArrayModes(ArrayWithSlowPutArrayStorage);
-        else if (m_arrayModes & asArrayModes(NonArrayWithArrayStorage))
-            m_arrayModes |= asArrayModes(NonArrayWithSlowPutArrayStorage);
-        else if (m_arrayModes & asArrayModes(ArrayWithArrayStorage))
-            m_arrayModes |= asArrayModes(ArrayWithArrayStorage);
-    }
-
     void setFuturePossibleStructure(Structure* structure)
     {
         if (structure->transitionWatchpointSetIsStillValid())
diff --git a/Source/JavaScriptCore/dfg/DFGArgumentsSimplificationPhase.cpp b/Source/JavaScriptCore/dfg/DFGArgumentsSimplificationPhase.cpp
index bb61a59e6..00b1109f6 100644
--- a/Source/JavaScriptCore/dfg/DFGArgumentsSimplificationPhase.cpp
+++ b/Source/JavaScriptCore/dfg/DFGArgumentsSimplificationPhase.cpp
@@ -273,7 +273,7 @@ public:
                 }
                     
                 case GetByVal: {
-                    if (node.arrayMode() != Array::Arguments) {
+                    if (node.arrayMode().type() != Array::Arguments) {
                         observeBadArgumentsUses(node);
                         break;
                     }
@@ -287,7 +287,7 @@ public:
                 }
                     
                 case GetArrayLength: {
-                    if (node.arrayMode() != Array::Arguments) {
+                    if (node.arrayMode().type() != Array::Arguments) {
                         observeBadArgumentsUses(node);
                         break;
                     }
@@ -476,7 +476,7 @@ public:
                 }
                     
                 case GetByVal: {
-                    if (node.arrayMode() != Array::Arguments)
+                    if (node.arrayMode().type() != Array::Arguments)
                         break;
 
                     // This can be simplified to GetMyArgumentByVal if we know that
@@ -499,7 +499,7 @@ public:
                 }
                     
                 case GetArrayLength: {
-                    if (node.arrayMode() != Array::Arguments)
+                    if (node.arrayMode().type() != Array::Arguments)
                         break;
                     
                     if (!isOKToOptimize(m_graph[node.child1()]))
diff --git a/Source/JavaScriptCore/dfg/DFGArrayMode.cpp b/Source/JavaScriptCore/dfg/DFGArrayMode.cpp
index a3aafde01..699902a16 100644
--- a/Source/JavaScriptCore/dfg/DFGArrayMode.cpp
+++ b/Source/JavaScriptCore/dfg/DFGArrayMode.cpp
@@ -32,126 +32,126 @@
 
 namespace JSC { namespace DFG {
 
-Array::Mode fromObserved(ArrayProfile* profile, Array::Action action, bool makeSafe)
+ArrayMode ArrayMode::fromObserved(ArrayProfile* profile, Array::Action action, bool makeSafe)
 {
     switch (profile->observedArrayModes()) {
     case 0:
-        return Array::Unprofiled;
+        return ArrayMode(Array::Unprofiled);
     case asArrayModes(NonArray):
         if (action == Array::Write && !profile->mayInterceptIndexedAccesses())
-            return Array::ToContiguous; // FIXME: we don't know whether to go to contiguous or array storage. We're making a static guess here. In future we should use exit profiling for this.
-        return Array::SelectUsingPredictions;
+            return ArrayMode(Array::Contiguous, Array::NonArray, Array::OutOfBounds, Array::Convert); // FIXME: we don't know whether to go to contiguous or array storage. We're making a static guess here. In future we should use exit profiling for this.
+        return ArrayMode(Array::SelectUsingPredictions);
     case asArrayModes(NonArrayWithContiguous):
-        return makeSafe ? Array::ContiguousOutOfBounds : (profile->mayStoreToHole() ? Array::ContiguousToTail : Array::Contiguous);
+        return ArrayMode(Array::Contiguous, Array::NonArray, Array::AsIs).withProfile(profile, makeSafe);
     case asArrayModes(ArrayWithContiguous):
-        return makeSafe ? Array::ArrayWithContiguousOutOfBounds : (profile->mayStoreToHole() ? Array::ArrayWithContiguousToTail : Array::ArrayWithContiguous);
+        return ArrayMode(Array::Contiguous, Array::Array, Array::AsIs).withProfile(profile, makeSafe);
     case asArrayModes(NonArrayWithContiguous) | asArrayModes(ArrayWithContiguous):
-        return makeSafe ? Array::PossiblyArrayWithContiguousOutOfBounds : (profile->mayStoreToHole() ? Array::PossiblyArrayWithContiguousToTail : Array::PossiblyArrayWithContiguous);
+        return ArrayMode(Array::Contiguous, Array::PossiblyArray, Array::AsIs).withProfile(profile, makeSafe);
     case asArrayModes(NonArrayWithArrayStorage):
-        return makeSafe ? Array::ArrayStorageOutOfBounds : (profile->mayStoreToHole() ? Array::ArrayStorageToHole : Array::ArrayStorage);
+        return ArrayMode(Array::ArrayStorage, Array::NonArray, Array::AsIs).withProfile(profile, makeSafe);
     case asArrayModes(NonArrayWithSlowPutArrayStorage):
     case asArrayModes(NonArrayWithArrayStorage) | asArrayModes(NonArrayWithSlowPutArrayStorage):
-        return Array::SlowPutArrayStorage;
+        return ArrayMode(Array::SlowPutArrayStorage, Array::NonArray, Array::AsIs).withProfile(profile, makeSafe);
     case asArrayModes(ArrayWithArrayStorage):
-        return makeSafe ? Array::ArrayWithArrayStorageOutOfBounds : (profile->mayStoreToHole() ? Array::ArrayWithArrayStorageToHole : Array::ArrayWithArrayStorage);
+        return ArrayMode(Array::ArrayStorage, Array::Array, Array::AsIs).withProfile(profile, makeSafe);
     case asArrayModes(ArrayWithSlowPutArrayStorage):
     case asArrayModes(ArrayWithArrayStorage) | asArrayModes(ArrayWithSlowPutArrayStorage):
-        return Array::ArrayWithSlowPutArrayStorage;
+        return ArrayMode(Array::SlowPutArrayStorage, Array::Array, Array::AsIs).withProfile(profile, makeSafe);
     case asArrayModes(NonArrayWithArrayStorage) | asArrayModes(ArrayWithArrayStorage):
-        return makeSafe ? Array::PossiblyArrayWithArrayStorageOutOfBounds : (profile->mayStoreToHole() ? Array::PossiblyArrayWithArrayStorageToHole : Array::PossiblyArrayWithArrayStorage);
+        return ArrayMode(Array::ArrayStorage, Array::PossiblyArray, Array::AsIs).withProfile(profile, makeSafe);
     case asArrayModes(NonArrayWithSlowPutArrayStorage) | asArrayModes(ArrayWithSlowPutArrayStorage):
     case asArrayModes(NonArrayWithArrayStorage) | asArrayModes(ArrayWithArrayStorage) | asArrayModes(NonArrayWithSlowPutArrayStorage) | asArrayModes(ArrayWithSlowPutArrayStorage):
-        return Array::PossiblyArrayWithSlowPutArrayStorage;
+        return ArrayMode(Array::SlowPutArrayStorage, Array::PossiblyArray, Array::AsIs).withProfile(profile, makeSafe);
     case asArrayModes(NonArrayWithContiguous) | asArrayModes(NonArrayWithArrayStorage):
-        return Array::ToArrayStorage;
+        return ArrayMode(Array::ArrayStorage, Array::NonArray, Array::Convert).withProfile(profile, makeSafe);
     case asArrayModes(ArrayWithContiguous) | asArrayModes(ArrayWithArrayStorage):
-        return Array::ArrayToArrayStorage;
+        return ArrayMode(Array::ArrayStorage, Array::Array, Array::Convert).withProfile(profile, makeSafe);
     case asArrayModes(NonArrayWithContiguous) | asArrayModes(NonArrayWithArrayStorage) | asArrayModes(ArrayWithContiguous) | asArrayModes(ArrayWithArrayStorage):
-        return Array::PossiblyArrayToArrayStorage;
+        return ArrayMode(Array::ArrayStorage, Array::PossiblyArray, Array::Convert).withProfile(profile, makeSafe);
     case asArrayModes(NonArray) | asArrayModes(NonArrayWithContiguous):
         if (action == Array::Write && !profile->mayInterceptIndexedAccesses())
-            return Array::ToContiguous;
-        return Array::SelectUsingPredictions;
+            return ArrayMode(Array::Contiguous, Array::NonArray, Array::OutOfBounds, Array::Convert);
+        return ArrayMode(Array::SelectUsingPredictions);
     case asArrayModes(NonArray) | asArrayModes(NonArrayWithContiguous) | asArrayModes(NonArrayWithArrayStorage):
     case asArrayModes(NonArray) | asArrayModes(NonArrayWithArrayStorage):
         if (action == Array::Write && !profile->mayInterceptIndexedAccesses())
-            return Array::ToArrayStorage;
-        return Array::SelectUsingPredictions;
+            return ArrayMode(Array::ArrayStorage, Array::NonArray, Array::OutOfBounds, Array::Convert);
+        return ArrayMode(Array::SelectUsingPredictions);
     case asArrayModes(NonArray) | asArrayModes(NonArrayWithSlowPutArrayStorage):
     case asArrayModes(NonArray) | asArrayModes(NonArrayWithArrayStorage) | asArrayModes(NonArrayWithSlowPutArrayStorage):
         if (action == Array::Write && !profile->mayInterceptIndexedAccesses())
-            return Array::ToSlowPutArrayStorage;
-        return Array::SelectUsingPredictions;
+            return ArrayMode(Array::SlowPutArrayStorage, Array::NonArray, Array::OutOfBounds, Array::Convert);
+        return ArrayMode(Array::SelectUsingPredictions);
     default:
         // We know that this is possibly a kind of array for which, though there is no
         // useful data in the array profile, we may be able to extract useful data from
         // the value profiles of the inputs. Hence, we leave it as undecided, and let
         // the predictions propagator decide later.
-        return Array::SelectUsingPredictions;
+        return ArrayMode(Array::SelectUsingPredictions);
     }
 }
 
-Array::Mode refineArrayMode(Array::Mode arrayMode, SpeculatedType base, SpeculatedType index)
+ArrayMode ArrayMode::refine(SpeculatedType base, SpeculatedType index) const
 {
     if (!base || !index) {
         // It can be that we had a legitimate arrayMode but no incoming predictions. That'll
         // happen if we inlined code based on, say, a global variable watchpoint, but later
         // realized that the callsite could not have possibly executed. It may be worthwhile
         // to fix that, but for now I'm leaving it as-is.
-        return Array::ForceExit;
+        return ArrayMode(Array::ForceExit);
     }
     
     if (!isInt32Speculation(index) || !isCellSpeculation(base))
-        return Array::Generic;
+        return ArrayMode(Array::Generic);
     
-    if (arrayMode == Array::Unprofiled) {
+    if (type() == Array::Unprofiled) {
         // If the indexing type wasn't recorded in the array profile but the values are
         // base=cell property=int, then we know that this access didn't execute.
-        return Array::ForceExit;
+        return ArrayMode(Array::ForceExit);
     }
     
-    if (arrayMode != Array::SelectUsingPredictions)
-        return arrayMode;
+    if (type() != Array::SelectUsingPredictions)
+        return *this;
     
     if (isStringSpeculation(base))
-        return Array::String;
+        return ArrayMode(Array::String);
     
     if (isArgumentsSpeculation(base))
-        return Array::Arguments;
+        return ArrayMode(Array::Arguments);
     
     if (isInt8ArraySpeculation(base))
-        return Array::Int8Array;
+        return ArrayMode(Array::Int8Array);
     
     if (isInt16ArraySpeculation(base))
-        return Array::Int16Array;
+        return ArrayMode(Array::Int16Array);
     
     if (isInt32ArraySpeculation(base))
-        return Array::Int32Array;
+        return ArrayMode(Array::Int32Array);
     
     if (isUint8ArraySpeculation(base))
-        return Array::Uint8Array;
+        return ArrayMode(Array::Uint8Array);
     
     if (isUint8ClampedArraySpeculation(base))
-        return Array::Uint8ClampedArray;
+        return ArrayMode(Array::Uint8ClampedArray);
     
     if (isUint16ArraySpeculation(base))
-        return Array::Uint16Array;
+        return ArrayMode(Array::Uint16Array);
     
     if (isUint32ArraySpeculation(base))
-        return Array::Uint32Array;
+        return ArrayMode(Array::Uint32Array);
     
     if (isFloat32ArraySpeculation(base))
-        return Array::Float32Array;
+        return ArrayMode(Array::Float32Array);
     
     if (isFloat64ArraySpeculation(base))
-        return Array::Float64Array;
+        return ArrayMode(Array::Float64Array);
     
-    return Array::Generic;
+    return ArrayMode(Array::Generic);
 }
 
-bool modeAlreadyChecked(AbstractValue& value, Array::Mode arrayMode)
+bool ArrayMode::alreadyChecked(AbstractValue& value) const
 {
-    switch (arrayMode) {
+    switch (type()) {
     case Array::Generic:
         return true;
         
@@ -159,109 +159,89 @@ bool modeAlreadyChecked(AbstractValue& value, Array::Mode arrayMode)
         return false;
         
     case Array::String:
-        return isStringSpeculation(value.m_type);
+        return speculationChecked(value.m_type, SpecString);
         
     case Array::Contiguous:
-    case Array::ContiguousToTail:
-    case Array::ContiguousOutOfBounds:
-    case Array::PossiblyArrayWithContiguous:
-    case Array::PossiblyArrayWithContiguousToTail:
-    case Array::PossiblyArrayWithContiguousOutOfBounds:
-    case Array::ToContiguous:
+        if (isJSArray()) {
+            if (arrayModesAlreadyChecked(value.m_arrayModes, asArrayModes(ArrayWithContiguous)))
+                return true;
+            return value.m_currentKnownStructure.hasSingleton()
+                && hasContiguous(value.m_currentKnownStructure.singleton()->indexingType())
+                && (value.m_currentKnownStructure.singleton()->indexingType() & IsArray);
+        }
         if (arrayModesAlreadyChecked(value.m_arrayModes, asArrayModes(NonArrayWithContiguous) | asArrayModes(ArrayWithContiguous)))
             return true;
         return value.m_currentKnownStructure.hasSingleton()
             && hasContiguous(value.m_currentKnownStructure.singleton()->indexingType());
         
-    case Array::ArrayWithContiguous:
-    case Array::ArrayWithContiguousToTail:
-    case Array::ArrayWithContiguousOutOfBounds:
-        if (arrayModesAlreadyChecked(value.m_arrayModes, asArrayModes(ArrayWithContiguous)))
-            return true;
-        return value.m_currentKnownStructure.hasSingleton()
-            && hasContiguous(value.m_currentKnownStructure.singleton()->indexingType())
-            && (value.m_currentKnownStructure.singleton()->indexingType() & IsArray);
-
     case Array::ArrayStorage:
-    case Array::ArrayStorageToHole:
-    case Array::ArrayStorageOutOfBounds:
-    case Array::PossiblyArrayWithArrayStorage:
-    case Array::PossiblyArrayWithArrayStorageToHole:
-    case Array::PossiblyArrayWithArrayStorageOutOfBounds:
-    case Array::ToArrayStorage:
-    case Array::PossiblyArrayToArrayStorage:
+        if (isJSArray()) {
+            if (arrayModesAlreadyChecked(value.m_arrayModes, asArrayModes(ArrayWithArrayStorage)))
+                return true;
+            return value.m_currentKnownStructure.hasSingleton()
+                && hasFastArrayStorage(value.m_currentKnownStructure.singleton()->indexingType())
+                && (value.m_currentKnownStructure.singleton()->indexingType() & IsArray);
+        }
         if (arrayModesAlreadyChecked(value.m_arrayModes, asArrayModes(NonArrayWithArrayStorage) | asArrayModes(ArrayWithArrayStorage)))
             return true;
         return value.m_currentKnownStructure.hasSingleton()
             && hasFastArrayStorage(value.m_currentKnownStructure.singleton()->indexingType());
         
     case Array::SlowPutArrayStorage:
-    case Array::PossiblyArrayWithSlowPutArrayStorage:
-    case Array::ToSlowPutArrayStorage:
+        if (isJSArray()) {
+            if (arrayModesAlreadyChecked(value.m_arrayModes, asArrayModes(ArrayWithArrayStorage) | asArrayModes(ArrayWithSlowPutArrayStorage)))
+                return true;
+            return value.m_currentKnownStructure.hasSingleton()
+                && hasArrayStorage(value.m_currentKnownStructure.singleton()->indexingType())
+                && (value.m_currentKnownStructure.singleton()->indexingType() & IsArray);
+        }
         if (arrayModesAlreadyChecked(value.m_arrayModes, asArrayModes(NonArrayWithArrayStorage) | asArrayModes(ArrayWithArrayStorage) | asArrayModes(NonArrayWithSlowPutArrayStorage) | asArrayModes(ArrayWithSlowPutArrayStorage)))
             return true;
         return value.m_currentKnownStructure.hasSingleton()
             && hasArrayStorage(value.m_currentKnownStructure.singleton()->indexingType());
         
-    case Array::ArrayWithArrayStorage:
-    case Array::ArrayWithArrayStorageToHole:
-    case Array::ArrayWithArrayStorageOutOfBounds:
-    case Array::ArrayToArrayStorage:
-        if (arrayModesAlreadyChecked(value.m_arrayModes, asArrayModes(ArrayWithArrayStorage)))
-            return true;
-        return value.m_currentKnownStructure.hasSingleton()
-            && hasFastArrayStorage(value.m_currentKnownStructure.singleton()->indexingType())
-            && (value.m_currentKnownStructure.singleton()->indexingType() & IsArray);
-        
-    case Array::ArrayWithSlowPutArrayStorage:
-        if (arrayModesAlreadyChecked(value.m_arrayModes, asArrayModes(ArrayWithArrayStorage) | asArrayModes(ArrayWithSlowPutArrayStorage)))
-            return true;
-        return value.m_currentKnownStructure.hasSingleton()
-            && hasArrayStorage(value.m_currentKnownStructure.singleton()->indexingType())
-            && (value.m_currentKnownStructure.singleton()->indexingType() & IsArray);
-        
     case Array::Arguments:
-        return isArgumentsSpeculation(value.m_type);
+        return speculationChecked(value.m_type, SpecArguments);
         
     case Array::Int8Array:
-        return isInt8ArraySpeculation(value.m_type);
+        return speculationChecked(value.m_type, SpecInt8Array);
         
     case Array::Int16Array:
-        return isInt16ArraySpeculation(value.m_type);
+        return speculationChecked(value.m_type, SpecInt16Array);
         
     case Array::Int32Array:
-        return isInt32ArraySpeculation(value.m_type);
+        return speculationChecked(value.m_type, SpecInt32Array);
         
     case Array::Uint8Array:
-        return isUint8ArraySpeculation(value.m_type);
+        return speculationChecked(value.m_type, SpecUint8Array);
         
     case Array::Uint8ClampedArray:
-        return isUint8ClampedArraySpeculation(value.m_type);
+        return speculationChecked(value.m_type, SpecUint8ClampedArray);
         
     case Array::Uint16Array:
-        return isUint16ArraySpeculation(value.m_type);
+        return speculationChecked(value.m_type, SpecUint16Array);
         
     case Array::Uint32Array:
-        return isUint32ArraySpeculation(value.m_type);
+        return speculationChecked(value.m_type, SpecUint32Array);
 
     case Array::Float32Array:
-        return isFloat32ArraySpeculation(value.m_type);
+        return speculationChecked(value.m_type, SpecFloat32Array);
 
     case Array::Float64Array:
-        return isFloat64ArraySpeculation(value.m_type);
+        return speculationChecked(value.m_type, SpecFloat64Array);
         
     case Array::SelectUsingPredictions:
     case Array::Unprofiled:
         break;
     }
     
-    ASSERT_NOT_REACHED();
+    CRASH();
     return false;
 }
 
-const char* modeToString(Array::Mode mode)
+const char* arrayTypeToString(Array::Type type)
 {
-    switch (mode) {
+    switch (type) {
     case Array::SelectUsingPredictions:
         return "SelectUsingPredictions";
     case Array::Unprofiled:
@@ -274,56 +254,10 @@ const char* modeToString(Array::Mode mode)
         return "String";
     case Array::Contiguous:
         return "Contiguous";
-    case Array::ContiguousToTail:
-        return "ContiguousToTail";
-    case Array::ContiguousOutOfBounds:
-        return "ContiguousOutOfBounds";
-    case Array::ArrayWithContiguous:
-        return "ArrayWithContiguous";
-    case Array::ArrayWithContiguousToTail:
-        return "ArrayWithContiguousToTail";
-    case Array::ArrayWithContiguousOutOfBounds:
-        return "ArrayWithContiguousOutOfBounds";
-    case Array::PossiblyArrayWithContiguous:
-        return "PossiblyArrayWithContiguous";
-    case Array::PossiblyArrayWithContiguousToTail:
-        return "PossiblyArrayWithContiguousToTail";
-    case Array::PossiblyArrayWithContiguousOutOfBounds:
-        return "PossiblyArrayWithContiguousOutOfBounds";
     case Array::ArrayStorage:
         return "ArrayStorage";
-    case Array::ArrayStorageToHole:
-        return "ArrayStorageToHole";
     case Array::SlowPutArrayStorage:
         return "SlowPutArrayStorage";
-    case Array::ArrayStorageOutOfBounds:
-        return "ArrayStorageOutOfBounds";
-    case Array::ArrayWithArrayStorage:
-        return "ArrayWithArrayStorage";
-    case Array::ArrayWithArrayStorageToHole:
-        return "ArrayWithArrayStorageToHole";
-    case Array::ArrayWithSlowPutArrayStorage:
-        return "ArrayWithSlowPutArrayStorage";
-    case Array::ArrayWithArrayStorageOutOfBounds:
-        return "ArrayWithArrayStorageOutOfBounds";
-    case Array::PossiblyArrayWithArrayStorage:
-        return "PossiblyArrayWithArrayStorage";
-    case Array::PossiblyArrayWithArrayStorageToHole:
-        return "PossiblyArrayWithArrayStorageToHole";
-    case Array::PossiblyArrayWithSlowPutArrayStorage:
-        return "PossiblyArrayWithSlowPutArrayStorage";
-    case Array::PossiblyArrayWithArrayStorageOutOfBounds:
-        return "PossiblyArrayWithArrayStorageOutOfBounds";
-    case Array::ToContiguous:
-        return "ToContiguous";
-    case Array::ToArrayStorage:
-        return "ToArrayStorage";
-    case Array::ToSlowPutArrayStorage:
-        return "ToSlowPutArrayStorage";
-    case Array::ArrayToArrayStorage:
-        return "ArrayToArrayStorage";
-    case Array::PossiblyArrayToArrayStorage:
-        return "PossiblyArrayToArrayStorage";
     case Array::Arguments:
         return "Arguments";
     case Array::Int8Array:
@@ -353,6 +287,55 @@ const char* modeToString(Array::Mode mode)
     }
 }
 
+const char* arrayClassToString(Array::Class arrayClass)
+{
+    switch (arrayClass) {
+    case Array::Array:
+        return "Array";
+    case Array::OriginalArray:
+        return "OriginalArray";
+    case Array::NonArray:
+        return "NonArray";
+    case Array::PossiblyArray:
+        return "PossiblyArray";
+    default:
+        return "Unknown!";
+    }
+}
+
+const char* arraySpeculationToString(Array::Speculation speculation)
+{
+    switch (speculation) {
+    case Array::InBounds:
+        return "InBounds";
+    case Array::ToHole:
+        return "ToHole";
+    case Array::OutOfBounds:
+        return "OutOfBounds";
+    default:
+        return "Unknown!";
+    }
+}
+
+const char* arrayConversionToString(Array::Conversion conversion)
+{
+    switch (conversion) {
+    case Array::AsIs:
+        return "AsIs";
+    case Array::Convert:
+        return "Convert";
+    default:
+        return "Unknown!";
+    }
+}
+
+const char* ArrayMode::toString() const
+{
+    static char buffer[256];
+    snprintf(buffer, sizeof(buffer), "%s%s%s%s", arrayTypeToString(type()), arrayClassToString(arrayClass()), arraySpeculationToString(speculation()), arrayConversionToString(conversion()));
+    return buffer;
+}
+
 } } // namespace JSC::DFG
 
 #endif // ENABLE(DFG_JIT)
diff --git a/Source/JavaScriptCore/dfg/DFGArrayMode.h b/Source/JavaScriptCore/dfg/DFGArrayMode.h
index a1cd74114..615965c92 100644
--- a/Source/JavaScriptCore/dfg/DFGArrayMode.h
+++ b/Source/JavaScriptCore/dfg/DFGArrayMode.h
@@ -46,42 +46,16 @@ enum Action {
     Write
 };
 
-enum Mode {
+enum Type {
     SelectUsingPredictions, // Implies that we need predictions to decide. We will never get to the backend in this mode.
     Unprofiled, // Implies that array profiling didn't see anything. But that could be because the operands didn't comply with basic type assumptions (base is cell, property is int). This either becomes Generic or ForceExit depending on value profiling.
     ForceExit, // Implies that we have no idea how to execute this operation, so we should just give up.
     Generic,
     String,
     
-    // Modes of conventional indexed storage where the check is non side-effecting.
     Contiguous,
-    ContiguousToTail,
-    ContiguousOutOfBounds,
-    ArrayWithContiguous,
-    ArrayWithContiguousToTail,
-    ArrayWithContiguousOutOfBounds,
-    PossiblyArrayWithContiguous,
-    PossiblyArrayWithContiguousToTail,
-    PossiblyArrayWithContiguousOutOfBounds,
     ArrayStorage,
-    ArrayStorageToHole,
     SlowPutArrayStorage,
-    ArrayStorageOutOfBounds,
-    ArrayWithArrayStorage,
-    ArrayWithArrayStorageToHole,
-    ArrayWithSlowPutArrayStorage,
-    ArrayWithArrayStorageOutOfBounds,
-    PossiblyArrayWithArrayStorage,
-    PossiblyArrayWithArrayStorageToHole,
-    PossiblyArrayWithSlowPutArrayStorage,
-    PossiblyArrayWithArrayStorageOutOfBounds,
-    
-    // Modes of conventional indexed storage where the check is side-effecting.
-    ToContiguous,
-    ToArrayStorage,
-    ArrayToArrayStorage,
-    PossiblyArrayToArrayStorage,
-    ToSlowPutArrayStorage,
     
     Arguments,
     Int8Array,
@@ -94,304 +68,311 @@ enum Mode {
     Float32Array,
     Float64Array
 };
-} // namespace Array
-
-// Helpers for 'case' statements. For example, saying "case AllArrayStorageModes:"
-// is the same as having multiple case statements listing off all of the modes that
-// have the word "ArrayStorage" in them.
-
-// First: helpers for non-side-effecting checks.
-#define NON_ARRAY_CONTIGUOUS_MODES                         \
-    Array::Contiguous:                                     \
-    case Array::ContiguousToTail:                          \
-    case Array::ContiguousOutOfBounds:                     \
-    case Array::PossiblyArrayWithContiguous:               \
-    case Array::PossiblyArrayWithContiguousToTail:         \
-    case Array::PossiblyArrayWithContiguousOutOfBounds
-#define ARRAY_WITH_CONTIGUOUS_MODES                        \
-    Array::ArrayWithContiguous:                            \
-    case Array::ArrayWithContiguousToTail:                 \
-    case Array::ArrayWithContiguousOutOfBounds
-#define ALL_CONTIGUOUS_MODES                               \
-    NON_ARRAY_CONTIGUOUS_MODES:                            \
-    case ARRAY_WITH_CONTIGUOUS_MODES
-#define IN_BOUNDS_CONTIGUOUS_MODES                         \
-    Array::Contiguous:                                     \
-    case Array::ArrayWithContiguous:                       \
-    case Array::PossiblyArrayWithContiguous
-#define CONTIGUOUS_TO_TAIL_MODES                           \
-    Array::ContiguousToTail:                               \
-    case Array::ArrayWithContiguousToTail:                 \
-    case Array::PossiblyArrayWithContiguousToTail
-#define OUT_OF_BOUNDS_CONTIGUOUS_MODES                     \
-    Array::ContiguousOutOfBounds:                          \
-    case Array::ArrayWithContiguousOutOfBounds:            \
-    case Array::PossiblyArrayWithContiguousOutOfBounds
-#define NON_ARRAY_ARRAY_STORAGE_MODES                      \
-    Array::ArrayStorage:                                   \
-    case Array::ArrayStorageToHole:                        \
-    case Array::SlowPutArrayStorage:                       \
-    case Array::ArrayStorageOutOfBounds:                   \
-    case Array::PossiblyArrayWithArrayStorage:             \
-    case Array::PossiblyArrayWithArrayStorageToHole:       \
-    case Array::PossiblyArrayWithSlowPutArrayStorage:      \
-    case Array::PossiblyArrayWithArrayStorageOutOfBounds
-#define ARRAY_WITH_ARRAY_STORAGE_MODES                     \
-    Array::ArrayWithArrayStorage:                          \
-    case Array::ArrayWithArrayStorageToHole:               \
-    case Array::ArrayWithSlowPutArrayStorage:              \
-    case Array::ArrayWithArrayStorageOutOfBounds
-#define ALL_ARRAY_STORAGE_MODES                            \
-    NON_ARRAY_ARRAY_STORAGE_MODES:                         \
-    case ARRAY_WITH_ARRAY_STORAGE_MODES
-#define IN_BOUNDS_ARRAY_STORAGE_MODES                      \
-    Array::ArrayStorage:                                   \
-    case Array::ArrayWithArrayStorage:                     \
-    case Array::PossiblyArrayWithArrayStorage
-#define ARRAY_STORAGE_TO_HOLE_MODES                        \
-    Array::ArrayStorageToHole:                             \
-    case Array::ArrayWithArrayStorageToHole:               \
-    case Array::PossiblyArrayWithArrayStorageToHole
-#define SLOW_PUT_ARRAY_STORAGE_MODES                       \
-    Array::SlowPutArrayStorage:                            \
-    case Array::ArrayWithSlowPutArrayStorage:              \
-    case Array::PossiblyArrayWithSlowPutArrayStorage
-#define OUT_OF_BOUNDS_ARRAY_STORAGE_MODES                  \
-    Array::ArrayStorageOutOfBounds:                        \
-    case Array::ArrayWithArrayStorageOutOfBounds:          \
-    case Array::PossiblyArrayWithArrayStorageOutOfBounds
 
-// Next: helpers for side-effecting checks.
-#define NON_ARRAY_EFFECTFUL_MODES                          \
-    Array::ToContiguous:                                   \
-    case Array::ToArrayStorage:                            \
-    case Array::ToSlowPutArrayStorage:                     \
-    case Array::PossiblyArrayToArrayStorage
-#define ARRAY_EFFECTFUL_MODES                              \
-    Array::ArrayToArrayStorage
-#define ALL_EFFECTFUL_CONTIGUOUS_MODES                     \
-    Array::ToContiguous
-#define ALL_EFFECTFUL_ARRAY_STORAGE_MODES                  \
-    Array::ToArrayStorage:                                 \
-    case Array::ToSlowPutArrayStorage:                     \
-    case Array::ArrayToArrayStorage:                       \
-    case Array::PossiblyArrayToArrayStorage
-#define SLOW_PUT_EFFECTFUL_ARRAY_STORAGE_MODES             \
-    Array::ToSlowPutArrayStorage
-#define ALL_EFFECTFUL_MODES                                \
-    ALL_EFFECTFUL_CONTIGUOUS_MODES:                        \
-    case ALL_EFFECTFUL_ARRAY_STORAGE_MODES
-
-Array::Mode fromObserved(ArrayProfile*, Array::Action, bool makeSafe);
-
-Array::Mode refineArrayMode(Array::Mode, SpeculatedType base, SpeculatedType index);
+enum Class {
+    NonArray, // Definitely some object that is not a JSArray.
+    Array, // Definitely a JSArray, and may or may not have custom properties or have undergone some other bizarre transitions.
+    OriginalArray, // Definitely a JSArray, and still has one of the primordial JSArray structures for the global object that this code block (possibly inlined code block) belongs to.
+    PossiblyArray // Some object that may or may not be a JSArray.
+};
 
-bool modeAlreadyChecked(AbstractValue&, Array::Mode);
+enum Speculation {
+    InBounds,
+    ToHole,
+    OutOfBounds
+};
 
-const char* modeToString(Array::Mode);
+enum Conversion {
+    AsIs,
+    Convert
+};
+} // namespace Array
 
-inline bool modeUsesButterfly(Array::Mode arrayMode)
-{
-    switch (arrayMode) {
-    case ALL_CONTIGUOUS_MODES:
-    case ALL_ARRAY_STORAGE_MODES:
-    case ALL_EFFECTFUL_MODES:
-        return true;
-    default:
-        return false;
+const char* arrayTypeToString(Array::Type);
+const char* arrayClassToString(Array::Class);
+const char* arraySpeculationToString(Array::Speculation);
+const char* arrayConversionToString(Array::Conversion);
+
+class ArrayMode {
+public:
+    ArrayMode()
+    {
+        u.asBytes.type = Array::SelectUsingPredictions;
+        u.asBytes.arrayClass = Array::NonArray;
+        u.asBytes.speculation = Array::InBounds;
+        u.asBytes.conversion = Array::AsIs;
     }
-}
-
-inline bool modeIsJSArray(Array::Mode arrayMode)
-{
-    switch (arrayMode) {
-    case ARRAY_WITH_CONTIGUOUS_MODES:
-    case ARRAY_WITH_ARRAY_STORAGE_MODES:
-    case ARRAY_EFFECTFUL_MODES:
-        return true;
-    default:
-        return false;
+    
+    explicit ArrayMode(Array::Type type)
+    {
+        u.asBytes.type = type;
+        u.asBytes.arrayClass = Array::NonArray;
+        u.asBytes.speculation = Array::InBounds;
+        u.asBytes.conversion = Array::AsIs;
     }
-}
-
-inline bool isInBoundsAccess(Array::Mode arrayMode)
-{
-    switch (arrayMode) {
-    case IN_BOUNDS_CONTIGUOUS_MODES:
-    case CONTIGUOUS_TO_TAIL_MODES:
-    case ARRAY_STORAGE_TO_HOLE_MODES:
-    case IN_BOUNDS_ARRAY_STORAGE_MODES:
-        return true;
-    default:
-        return false;
+    
+    ArrayMode(Array::Type type, Array::Class arrayClass, Array::Speculation speculation, Array::Conversion conversion)
+    {
+        u.asBytes.type = type;
+        u.asBytes.arrayClass = arrayClass;
+        u.asBytes.speculation = speculation;
+        u.asBytes.conversion = conversion;
     }
-}
-
-inline bool isSlowPutAccess(Array::Mode arrayMode)
-{
-    switch (arrayMode) {
-    case SLOW_PUT_ARRAY_STORAGE_MODES:
-    case SLOW_PUT_EFFECTFUL_ARRAY_STORAGE_MODES:
-        return true;
-    default:
-        return false;
+    
+    ArrayMode(Array::Type type, Array::Class arrayClass, Array::Conversion conversion)
+    {
+        u.asBytes.type = type;
+        u.asBytes.arrayClass = arrayClass;
+        u.asBytes.speculation = Array::InBounds;
+        u.asBytes.conversion = conversion;
     }
-}
-
-inline bool mayStoreToTail(Array::Mode arrayMode)
-{
-    switch (arrayMode) {
-    case CONTIGUOUS_TO_TAIL_MODES:
-    case OUT_OF_BOUNDS_CONTIGUOUS_MODES:
-    case ALL_EFFECTFUL_CONTIGUOUS_MODES:
-        return true;
-    default:
-        return false;
+    
+    Array::Type type() const { return static_cast<Array::Type>(u.asBytes.type); }
+    Array::Class arrayClass() const { return static_cast<Array::Class>(u.asBytes.arrayClass); }
+    Array::Speculation speculation() const { return static_cast<Array::Speculation>(u.asBytes.speculation); }
+    Array::Conversion conversion() const { return static_cast<Array::Conversion>(u.asBytes.conversion); }
+    
+    unsigned asWord() const { return u.asWord; }
+    
+    static ArrayMode fromWord(unsigned word)
+    {
+        return ArrayMode(word);
     }
-}
-
-inline bool mayStoreToHole(Array::Mode arrayMode)
-{
-    switch (arrayMode) {
-    case ARRAY_STORAGE_TO_HOLE_MODES:
-    case OUT_OF_BOUNDS_ARRAY_STORAGE_MODES:
-    case SLOW_PUT_ARRAY_STORAGE_MODES:
-    case ALL_EFFECTFUL_ARRAY_STORAGE_MODES:
-        return true;
-    default:
-        return false;
+    
+    static ArrayMode fromObserved(ArrayProfile*, Array::Action, bool makeSafe);
+    
+    ArrayMode withSpeculation(Array::Speculation speculation) const
+    {
+        return ArrayMode(type(), arrayClass(), speculation, conversion());
     }
-}
-
-inline bool canCSEStorage(Array::Mode arrayMode)
-{
-    switch (arrayMode) {
-    case Array::SelectUsingPredictions:
-    case Array::Unprofiled:
-    case Array::ForceExit:
-    case Array::Generic:
-    case Array::Arguments:
-        return false;
-    default:
-        return true;
+    
+    ArrayMode withProfile(ArrayProfile* profile, bool makeSafe) const
+    {
+        Array::Speculation mySpeculation;
+        Array::Class myArrayClass;
+        
+        if (makeSafe)
+            mySpeculation = Array::OutOfBounds;
+        else if (profile->mayStoreToHole())
+            mySpeculation = Array::ToHole;
+        else
+            mySpeculation = Array::InBounds;
+        
+        if (isJSArray()) {
+            if (profile->usesOriginalArrayStructures())
+                myArrayClass = Array::OriginalArray;
+            else
+                myArrayClass = Array::Array;
+        } else
+            myArrayClass = arrayClass();
+        
+        return ArrayMode(type(), myArrayClass, mySpeculation, conversion());
     }
-}
-
-inline bool lengthNeedsStorage(Array::Mode arrayMode)
-{
-    return modeIsJSArray(arrayMode);
-}
-
-inline Array::Mode modeForPut(Array::Mode arrayMode)
-{
-    switch (arrayMode) {
-    case Array::String:
-        return Array::Generic;
+    
+    ArrayMode refine(SpeculatedType base, SpeculatedType index) const;
+    
+    bool alreadyChecked(AbstractValue&) const;
+    
+    const char* toString() const;
+    
+    bool usesButterfly() const
+    {
+        switch (type()) {
+        case Array::Contiguous:
+        case Array::ArrayStorage:
+        case Array::SlowPutArrayStorage:
+            return true;
+        default:
+            return false;
+        }
+    }
+    
+    bool isJSArray() const
+    {
+        switch (arrayClass()) {
+        case Array::Array:
+        case Array::OriginalArray:
+            return true;
+        default:
+            return false;
+        }
+    }
+    
+    bool isJSArrayWithOriginalStructure() const
+    {
+        return arrayClass() == Array::OriginalArray;
+    }
+    
+    bool isInBounds() const
+    {
+        return speculation() == Array::InBounds;
+    }
+    
+    bool mayStoreToHole() const
+    {
+        return !isInBounds();
+    }
+    
+    bool isOutOfBounds() const
+    {
+        return speculation() == Array::OutOfBounds;
+    }
+    
+    bool isSlowPut() const
+    {
+        return type() == Array::SlowPutArrayStorage;
+    }
+    
+    bool canCSEStorage() const
+    {
+        switch (type()) {
+        case Array::SelectUsingPredictions:
+        case Array::Unprofiled:
+        case Array::ForceExit:
+        case Array::Generic:
+        case Array::Arguments:
+            return false;
+        default:
+            return true;
+        }
+    }
+    
+    bool lengthNeedsStorage() const
+    {
+        return isJSArray();
+    }
+    
+    ArrayMode modeForPut() const
+    {
+        switch (type()) {
+        case Array::String:
+            return ArrayMode(Array::Generic);
 #if USE(JSVALUE32_64)
-    case Array::Arguments:
-        return Array::Generic;
+        case Array::Arguments:
+            return ArrayMode(Array::Generic);
 #endif
-    default:
-        return arrayMode;
+        default:
+            return *this;
+        }
     }
-}
-
-inline bool modeIsSpecific(Array::Mode mode)
-{
-    switch (mode) {
-    case Array::SelectUsingPredictions:
-    case Array::Unprofiled:
-    case Array::ForceExit:
-    case Array::Generic:
-        return false;
-    default:
-        return true;
+    
+    bool isSpecific() const
+    {
+        switch (type()) {
+        case Array::SelectUsingPredictions:
+        case Array::Unprofiled:
+        case Array::ForceExit:
+        case Array::Generic:
+            return false;
+        default:
+            return true;
+        }
     }
-}
-
-inline bool modeSupportsLength(Array::Mode mode)
-{
-    switch (mode) {
-    case Array::SelectUsingPredictions:
-    case Array::Unprofiled:
-    case Array::ForceExit:
-    case Array::Generic:
-    case NON_ARRAY_CONTIGUOUS_MODES:
-    case NON_ARRAY_ARRAY_STORAGE_MODES:
-    case NON_ARRAY_EFFECTFUL_MODES:
-        return false;
-    default:
-        return true;
+    
+    bool supportsLength() const
+    {
+        switch (type()) {
+        case Array::SelectUsingPredictions:
+        case Array::Unprofiled:
+        case Array::ForceExit:
+        case Array::Generic:
+            return false;
+        case Array::Contiguous:
+        case Array::ArrayStorage:
+        case Array::SlowPutArrayStorage:
+            return isJSArray();
+        default:
+            return true;
+        }
     }
-}
-
-inline bool benefitsFromStructureCheck(Array::Mode mode)
-{
-    switch (mode) {
-    case ALL_EFFECTFUL_MODES:
-    case Array::SelectUsingPredictions:
-    case Array::Unprofiled:
-    case Array::ForceExit:
-    case Array::Generic:
-        return false;
-    default:
-        return true;
+    
+    bool benefitsFromStructureCheck() const
+    {
+        switch (type()) {
+        case Array::SelectUsingPredictions:
+        case Array::Unprofiled:
+        case Array::ForceExit:
+        case Array::Generic:
+            return false;
+        default:
+            return conversion() == Array::AsIs;
+        }
     }
-}
+    
+    bool doesConversion() const
+    {
+        return conversion() == Array::Convert;
+    }
+    
+    ArrayModes arrayModesThatPassFiltering() const
+    {
+        switch (type()) {
+        case Array::Generic:
+            return ALL_ARRAY_MODES;
+        case Array::Contiguous:
+            return arrayModesWithIndexingShape(ContiguousShape);
+        case Array::ArrayStorage:
+            return arrayModesWithIndexingShape(ArrayStorageShape);
+        case Array::SlowPutArrayStorage:
+            return arrayModesWithIndexingShape(SlowPutArrayStorageShape);
+        default:
+            return asArrayModes(NonArray);
+        }
+    }
+    
+    bool operator==(const ArrayMode& other) const
+    {
+        return type() == other.type()
+            && arrayClass() == other.arrayClass()
+            && speculation() == other.speculation()
+            && conversion() == other.conversion();
+    }
+    
+    bool operator!=(const ArrayMode& other) const
+    {
+        return !(*this == other);
+    }
+private:
+    explicit ArrayMode(unsigned word)
+    {
+        u.asWord = word;
+    }
+    
+    ArrayModes arrayModesWithIndexingShape(IndexingType shape) const
+    {
+        switch (arrayClass()) {
+        case Array::NonArray:
+            return asArrayModes(shape);
+        case Array::Array:
+        case Array::OriginalArray:
+            return asArrayModes(shape | IsArray);
+        case Array::PossiblyArray:
+            return asArrayModes(shape) | asArrayModes(shape | IsArray);
+        default:
+            // This is only necessary for C++ compilers that don't understand enums.
+            return 0;
+        }
+    }
+    
+    union {
+        struct {
+            uint8_t type;
+            uint8_t arrayClass;
+            uint8_t speculation;
+            uint8_t conversion;
+        } asBytes;
+        unsigned asWord;
+    } u;
+};
 
-inline bool isEffectful(Array::Mode mode)
+static inline bool canCSEStorage(const ArrayMode& arrayMode)
 {
-    switch (mode) {
-    case ALL_EFFECTFUL_MODES:
-        return true;
-    default:
-        return false;
-    }
+    return arrayMode.canCSEStorage();
 }
 
-// This returns the set of array modes that will pass filtering of a CheckArray or
-// Arrayify with the given mode.
-inline ArrayModes arrayModesFor(Array::Mode arrayMode)
+static inline bool lengthNeedsStorage(const ArrayMode& arrayMode)
 {
-    switch (arrayMode) {
-    case Array::Generic:
-        return ALL_ARRAY_MODES;
-    case Array::Contiguous:
-    case Array::ContiguousToTail:
-    case Array::ContiguousOutOfBounds:
-    case Array::ToContiguous:
-        return asArrayModes(NonArrayWithContiguous);
-    case Array::PossiblyArrayWithContiguous:
-    case Array::PossiblyArrayWithContiguousToTail:
-    case Array::PossiblyArrayWithContiguousOutOfBounds:
-        return asArrayModes(NonArrayWithContiguous) | asArrayModes(ArrayWithContiguous);
-    case ARRAY_WITH_CONTIGUOUS_MODES:
-        return asArrayModes(ArrayWithContiguous);
-    case Array::ArrayStorage:
-    case Array::ArrayStorageToHole:
-    case Array::ArrayStorageOutOfBounds:
-    case Array::ToArrayStorage:
-        return asArrayModes(NonArrayWithArrayStorage);
-    case Array::ToSlowPutArrayStorage:
-    case Array::SlowPutArrayStorage:
-        return asArrayModes(NonArrayWithArrayStorage) | asArrayModes(NonArrayWithSlowPutArrayStorage);
-    case Array::PossiblyArrayWithArrayStorage:
-    case Array::PossiblyArrayWithArrayStorageToHole:
-    case Array::PossiblyArrayWithArrayStorageOutOfBounds:
-    case Array::PossiblyArrayToArrayStorage:
-        return asArrayModes(NonArrayWithArrayStorage) | asArrayModes(ArrayWithArrayStorage);
-    case Array::PossiblyArrayWithSlowPutArrayStorage:
-        return asArrayModes(NonArrayWithArrayStorage) | asArrayModes(ArrayWithArrayStorage) | asArrayModes(NonArrayWithSlowPutArrayStorage) | asArrayModes(ArrayWithSlowPutArrayStorage);
-    case Array::ArrayWithArrayStorage:
-    case Array::ArrayWithArrayStorageToHole:
-    case Array::ArrayWithArrayStorageOutOfBounds:
-    case Array::ArrayToArrayStorage:
-        return asArrayModes(ArrayWithArrayStorage);
-    case Array::ArrayWithSlowPutArrayStorage:
-        return asArrayModes(ArrayWithArrayStorage) | asArrayModes(ArrayWithSlowPutArrayStorage);
-    default:
-        return asArrayModes(NonArray);
-    }
+    return arrayMode.lengthNeedsStorage();
 }
 
 } } // namespace JSC::DFG
diff --git a/Source/JavaScriptCore/dfg/DFGAssemblyHelpers.h b/Source/JavaScriptCore/dfg/DFGAssemblyHelpers.h
index 953a743ff..75b9c7072 100644
--- a/Source/JavaScriptCore/dfg/DFGAssemblyHelpers.h
+++ b/Source/JavaScriptCore/dfg/DFGAssemblyHelpers.h
@@ -320,6 +320,13 @@ public:
         return baselineCodeBlockForOriginAndBaselineCodeBlock(codeOrigin, baselineCodeBlock());
     }
     
+    CodeBlock* baselineCodeBlockFor(InlineCallFrame* inlineCallFrame)
+    {
+        if (!inlineCallFrame)
+            return baselineCodeBlock();
+        return baselineCodeBlockForInlineCallFrame(inlineCallFrame);
+    }
+    
     CodeBlock* baselineCodeBlock()
     {
         return m_baselineCodeBlock;
diff --git a/Source/JavaScriptCore/dfg/DFGByteCodeCache.h b/Source/JavaScriptCore/dfg/DFGByteCodeCache.h
index 6b9056e54..e1837b041 100644
--- a/Source/JavaScriptCore/dfg/DFGByteCodeCache.h
+++ b/Source/JavaScriptCore/dfg/DFGByteCodeCache.h
@@ -158,7 +158,7 @@ public:
             // Nope, so try to parse one.
             JSObject* exception;
             value.owned = true;
-            value.codeBlock = key.executable()->produceCodeBlockFor(scope, OptimizingCompilation, key.kind(), exception).leakPtr();
+            value.codeBlock = key.executable()->produceCodeBlockFor(scope, key.kind(), exception).leakPtr();
         }
         
         // Check if there is any reason to reject this from our cache. If so, then
diff --git a/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp b/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp
index 36d18d7b3..70aa2b637 100644
--- a/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp
+++ b/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp
@@ -35,7 +35,6 @@
 #include "DFGByteCodeCache.h"
 #include "DFGCapabilities.h"
 #include "GetByIdStatus.h"
-#include "MethodCallLinkStatus.h"
 #include "PutByIdStatus.h"
 #include "ResolveGlobalStatus.h"
 #include <wtf/HashMap.h>
@@ -906,15 +905,15 @@ private:
         return getPrediction(m_graph.size(), m_currentProfilingIndex);
     }
     
-    Array::Mode getArrayMode(ArrayProfile* profile)
+    ArrayMode getArrayMode(ArrayProfile* profile)
     {
-        profile->computeUpdatedPrediction();
-        return fromObserved(profile, Array::Read, false);
+        profile->computeUpdatedPrediction(m_inlineStackTop->m_codeBlock);
+        return ArrayMode::fromObserved(profile, Array::Read, false);
     }
     
-    Array::Mode getArrayModeAndEmitChecks(ArrayProfile* profile, Array::Action action, NodeIndex base)
+    ArrayMode getArrayModeAndEmitChecks(ArrayProfile* profile, Array::Action action, NodeIndex base)
     {
-        profile->computeUpdatedPrediction();
+        profile->computeUpdatedPrediction(m_inlineStackTop->m_codeBlock);
         
 #if DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE)
         if (m_inlineStackTop->m_profiledBlock->numberOfRareCaseProfiles())
@@ -926,9 +925,9 @@ private:
             m_inlineStackTop->m_profiledBlock->couldTakeSlowCase(m_currentIndex)
             || m_inlineStackTop->m_exitProfile.hasExitSite(m_currentIndex, OutOfBounds);
         
-        Array::Mode result = fromObserved(profile, action, makeSafe);
+        ArrayMode result = ArrayMode::fromObserved(profile, action, makeSafe);
         
-        if (profile->hasDefiniteStructure() && benefitsFromStructureCheck(result))
+        if (profile->hasDefiniteStructure() && result.benefitsFromStructureCheck())
             addToGraph(CheckStructure, OpInfo(m_graph.addStructureSet(profile->expectedStructure())), base);
         
         return result;
@@ -1649,16 +1648,11 @@ bool ByteCodeParser::handleIntrinsic(bool usesResult, int resultOperand, Intrins
         if (argumentCountIncludingThis != 2)
             return false;
         
-        Array::Mode arrayMode = getArrayMode(m_currentInstruction[5].u.arrayProfile);
-        switch (arrayMode) {
-        case Array::ArrayWithArrayStorageToHole:
-            ASSERT_NOT_REACHED();
-            
-        case Array::ArrayWithContiguous:
-        case Array::ArrayWithContiguousOutOfBounds:
-        case Array::ArrayWithArrayStorage:
-        case Array::ArrayWithArrayStorageOutOfBounds: {
-            NodeIndex arrayPush = addToGraph(ArrayPush, OpInfo(arrayMode), OpInfo(prediction), get(registerOffset + argumentToOperand(0)), get(registerOffset + argumentToOperand(1)));
+        ArrayMode arrayMode = getArrayMode(m_currentInstruction[5].u.arrayProfile);
+        switch (arrayMode.type()) {
+        case Array::Contiguous:
+        case Array::ArrayStorage: {
+            NodeIndex arrayPush = addToGraph(ArrayPush, OpInfo(arrayMode.asWord()), OpInfo(prediction), get(registerOffset + argumentToOperand(0)), get(registerOffset + argumentToOperand(1)));
             if (usesResult)
                 set(resultOperand, arrayPush);
             
@@ -1674,16 +1668,11 @@ bool ByteCodeParser::handleIntrinsic(bool usesResult, int resultOperand, Intrins
         if (argumentCountIncludingThis != 1)
             return false;
         
-        Array::Mode arrayMode = getArrayMode(m_currentInstruction[5].u.arrayProfile);
-        switch (arrayMode) {
-        case Array::ArrayWithArrayStorageToHole:
-            ASSERT_NOT_REACHED();
-            
-        case Array::ArrayWithContiguous:
-        case Array::ArrayWithContiguousOutOfBounds:
-        case Array::ArrayWithArrayStorage:
-        case Array::ArrayWithArrayStorageOutOfBounds: {
-            NodeIndex arrayPop = addToGraph(ArrayPop, OpInfo(arrayMode), OpInfo(prediction), get(registerOffset + argumentToOperand(0)));
+        ArrayMode arrayMode = getArrayMode(m_currentInstruction[5].u.arrayProfile);
+        switch (arrayMode.type()) {
+        case Array::Contiguous:
+        case Array::ArrayStorage: {
+            NodeIndex arrayPop = addToGraph(ArrayPop, OpInfo(arrayMode.asWord()), OpInfo(prediction), get(registerOffset + argumentToOperand(0)));
             if (usesResult)
                 set(resultOperand, arrayPop);
             return true;
@@ -1699,9 +1688,6 @@ bool ByteCodeParser::handleIntrinsic(bool usesResult, int resultOperand, Intrins
             return false;
 
         int thisOperand = registerOffset + argumentToOperand(0);
-        if (!(m_graph[get(thisOperand)].prediction() & SpecString))
-            return false;
-        
         int indexOperand = registerOffset + argumentToOperand(1);
         NodeIndex charCode = addToGraph(StringCharCodeAt, OpInfo(Array::String), get(thisOperand), getToInt32(indexOperand));
 
@@ -1715,9 +1701,6 @@ bool ByteCodeParser::handleIntrinsic(bool usesResult, int resultOperand, Intrins
             return false;
 
         int thisOperand = registerOffset + argumentToOperand(0);
-        if (!(m_graph[get(thisOperand)].prediction() & SpecString))
-            return false;
-
         int indexOperand = registerOffset + argumentToOperand(1);
         NodeIndex charCode = addToGraph(StringCharAt, OpInfo(Array::String), get(thisOperand), getToInt32(indexOperand));
 
@@ -1793,6 +1776,10 @@ NodeIndex ByteCodeParser::handleGetByOffset(SpeculatedType prediction, NodeIndex
         propertyStorage = base;
     else
         propertyStorage = addToGraph(GetButterfly, base);
+    // FIXME: It would be far more efficient for load elimination (and safer from
+    // an OSR standpoint) if GetByOffset also referenced the object we were loading
+    // from, and if we could load eliminate a GetByOffset even if the butterfly
+    // had changed. That would be a great success.
     NodeIndex getByOffset = addToGraph(GetByOffset, OpInfo(m_graph.m_storageAccessData.size()), OpInfo(prediction), propertyStorage);
 
     StorageAccessData storageAccessData;
@@ -1888,12 +1875,12 @@ bool ByteCodeParser::parseResolveOperations(SpeculatedType prediction, unsigned
     while (resolvingBase) {
         switch (pc->m_operation) {
         case ResolveOperation::ReturnGlobalObjectAsBase:
-            *base = get(m_codeBlock->globalObjectConstant());
+            *base = cellConstant(globalObject);
             ASSERT(!value);
             return true;
 
         case ResolveOperation::SetBaseToGlobal:
-            *base = get(m_codeBlock->globalObjectConstant());
+            *base = cellConstant(globalObject);
             setBase = true;
             resolvingBase = false;
             ++pc;
@@ -2150,7 +2137,11 @@ bool ByteCodeParser::parseBlock(unsigned limit)
         case op_new_array_buffer: {
             int startConstant = currentInstruction[2].u.operand;
             int numConstants = currentInstruction[3].u.operand;
-            set(currentInstruction[1].u.operand, addToGraph(NewArrayBuffer, OpInfo(m_inlineStackTop->m_constantBufferRemap[startConstant]), OpInfo(numConstants)));
+            NewArrayBufferData data;
+            data.startConstant = m_inlineStackTop->m_constantBufferRemap[startConstant];
+            data.numConstants = numConstants;
+            m_graph.m_newArrayBufferData.append(data);
+            set(currentInstruction[1].u.operand, addToGraph(NewArrayBuffer, OpInfo(&m_graph.m_newArrayBufferData.last())));
             NEXT_OPCODE(op_new_array_buffer);
         }
             
@@ -2472,9 +2463,9 @@ bool ByteCodeParser::parseBlock(unsigned limit)
             SpeculatedType prediction = getPrediction();
             
             NodeIndex base = get(currentInstruction[2].u.operand);
-            Array::Mode arrayMode = getArrayModeAndEmitChecks(currentInstruction[4].u.arrayProfile, Array::Read, base);
+            ArrayMode arrayMode = getArrayModeAndEmitChecks(currentInstruction[4].u.arrayProfile, Array::Read, base);
             NodeIndex property = get(currentInstruction[3].u.operand);
-            NodeIndex getByVal = addToGraph(GetByVal, OpInfo(arrayMode), OpInfo(prediction), base, property);
+            NodeIndex getByVal = addToGraph(GetByVal, OpInfo(arrayMode.asWord()), OpInfo(prediction), base, property);
             set(currentInstruction[1].u.operand, getByVal);
 
             NEXT_OPCODE(op_get_by_val);
@@ -2483,7 +2474,7 @@ bool ByteCodeParser::parseBlock(unsigned limit)
         case op_put_by_val: {
             NodeIndex base = get(currentInstruction[1].u.operand);
 
-            Array::Mode arrayMode = getArrayModeAndEmitChecks(currentInstruction[4].u.arrayProfile, Array::Write, base);
+            ArrayMode arrayMode = getArrayModeAndEmitChecks(currentInstruction[4].u.arrayProfile, Array::Write, base);
             
             NodeIndex property = get(currentInstruction[2].u.operand);
             NodeIndex value = get(currentInstruction[3].u.operand);
@@ -2492,53 +2483,11 @@ bool ByteCodeParser::parseBlock(unsigned limit)
             addVarArgChild(property);
             addVarArgChild(value);
             addVarArgChild(NoNode); // Leave room for property storage.
-            addToGraph(Node::VarArg, PutByVal, OpInfo(arrayMode), OpInfo(0));
+            addToGraph(Node::VarArg, PutByVal, OpInfo(arrayMode.asWord()), OpInfo(0));
 
             NEXT_OPCODE(op_put_by_val);
         }
             
-        case op_method_check: {
-            m_currentProfilingIndex += OPCODE_LENGTH(op_method_check);
-            Instruction* getInstruction = currentInstruction + OPCODE_LENGTH(op_method_check);
-            
-            SpeculatedType prediction = getPrediction();
-            
-            ASSERT(interpreter->getOpcodeID(getInstruction->u.opcode) == op_get_by_id
-                   || interpreter->getOpcodeID(getInstruction->u.opcode) == op_get_by_id_out_of_line);
-            
-            NodeIndex base = get(getInstruction[2].u.operand);
-            unsigned identifier = m_inlineStackTop->m_identifierRemap[getInstruction[3].u.operand];
-                
-            // Check if the method_check was monomorphic. If so, emit a CheckXYZMethod
-            // node, which is a lot more efficient.
-            GetByIdStatus getByIdStatus = GetByIdStatus::computeFor(
-                m_inlineStackTop->m_profiledBlock,
-                m_currentIndex,
-                m_codeBlock->identifier(identifier));
-            MethodCallLinkStatus methodCallStatus = MethodCallLinkStatus::computeFor(
-                m_inlineStackTop->m_profiledBlock, m_currentIndex);
-            
-            if (methodCallStatus.isSet()
-                && !getByIdStatus.wasSeenInJIT()
-                && !m_inlineStackTop->m_exitProfile.hasExitSite(m_currentIndex, BadCache)) {
-                // It's monomorphic as far as we can tell, since the method_check was linked
-                // but the slow path (i.e. the normal get_by_id) never fired.
-
-                addToGraph(CheckStructure, OpInfo(m_graph.addStructureSet(methodCallStatus.structure())), base);
-                if (methodCallStatus.needsPrototypeCheck()) {
-                    addStructureTransitionCheck(
-                        methodCallStatus.prototype(), methodCallStatus.prototypeStructure());
-                    addToGraph(Phantom, base);
-                }
-                set(getInstruction[1].u.operand, cellConstant(methodCallStatus.function()));
-            } else {
-                handleGetById(
-                    getInstruction[1].u.operand, prediction, base, identifier, getByIdStatus);
-            }
-            
-            m_currentIndex += OPCODE_LENGTH(op_method_check) + OPCODE_LENGTH(op_get_by_id);
-            continue;
-        }
         case op_get_by_id:
         case op_get_by_id_out_of_line:
         case op_get_array_length: {
@@ -2665,6 +2614,10 @@ bool ByteCodeParser::parseBlock(unsigned limit)
             NEXT_OPCODE(op_put_by_id);
         }
 
+        case op_init_global_const_nop: {
+            NEXT_OPCODE(op_init_global_const_nop);
+        }
+
         case op_init_global_const: {
             NodeIndex value = get(currentInstruction[2].u.operand);
             addToGraph(
@@ -2902,10 +2855,10 @@ bool ByteCodeParser::parseBlock(unsigned limit)
             addToGraph(Throw, get(currentInstruction[1].u.operand));
             LAST_OPCODE(op_throw);
             
-        case op_throw_reference_error:
+        case op_throw_static_error:
             flushArgumentsAndCapturedVariables();
             addToGraph(ThrowReferenceError);
-            LAST_OPCODE(op_throw_reference_error);
+            LAST_OPCODE(op_throw_static_error);
             
         case op_call:
             handleCall(interpreter, currentInstruction, Call, CodeForCall);
@@ -3104,6 +3057,14 @@ bool ByteCodeParser::parseBlock(unsigned limit)
             NodeIndex base = 0;
             NodeIndex value = 0;
             if (parseResolveOperations(prediction, identifier, operations, putToBaseOperation, &base, &value)) {
+                // First create OSR hints only.
+                set(baseDst, base);
+                set(valueDst, value);
+                
+                // If we try to hoist structure checks into here, then we're guaranteed that they will occur
+                // *after* we have already set up the values for OSR.
+                
+                // Then do the real SetLocals.
                 set(baseDst, base);
                 set(valueDst, value);
             } else {
@@ -3124,6 +3085,14 @@ bool ByteCodeParser::parseBlock(unsigned limit)
             NodeIndex base = 0;
             NodeIndex value = 0;
             if (parseResolveOperations(prediction, identifier, operations, 0, &base, &value)) {
+                // First create OSR hints only.
+                set(baseDst, base);
+                set(valueDst, value);
+                
+                // If we try to hoist structure checks into here, then we're guaranteed that they will occur
+                // *after* we have already set up the values for OSR.
+                
+                // Then do the real SetLocals.
                 set(baseDst, base);
                 set(valueDst, value);
             } else {
@@ -3632,7 +3601,7 @@ void ByteCodeParser::parseCodeBlock()
     dataLog("Parsing code block %p. codeType = %s, captureCount = %u, needsFullScopeChain = %s, needsActivation = %s, isStrictMode = %s\n",
             codeBlock,
             codeTypeToString(codeBlock->codeType()),
-            codeBlock->symbolTable()->captureCount(),
+            codeBlock->symbolTable() ? codeBlock->symbolTable()->captureCount() : 0,
             codeBlock->needsFullScopeChain()?"true":"false",
             codeBlock->ownerExecutable()->needsActivation()?"true":"false",
             codeBlock->ownerExecutable()->isStrictMode()?"true":"false");
diff --git a/Source/JavaScriptCore/dfg/DFGCSEPhase.cpp b/Source/JavaScriptCore/dfg/DFGCSEPhase.cpp
index 185332921..19051c174 100644
--- a/Source/JavaScriptCore/dfg/DFGCSEPhase.cpp
+++ b/Source/JavaScriptCore/dfg/DFGCSEPhase.cpp
@@ -176,13 +176,8 @@ private:
             case PutByVal:
                 if (!m_graph.byValIsPure(node))
                     return NoNode;
-                switch (node.arrayMode()) {
-                case CONTIGUOUS_TO_TAIL_MODES:
-                case ARRAY_STORAGE_TO_HOLE_MODES:
+                if (node.arrayMode().mayStoreToHole())
                     return NoNode;
-                default:
-                    break;
-                }
                 break;
                 
             default:
@@ -438,6 +433,12 @@ private:
                 }
                 return false;
                 
+            case Arrayify:
+            case ArrayifyToStructure:
+                // We could check if the arrayification could affect our structures.
+                // But that seems like it would take Effort.
+                return false;
+                
             default:
                 if (m_graph.clobbersWorld(index))
                     return false;
@@ -489,6 +490,12 @@ private:
                     return true;
                 break;
                 
+            case Arrayify:
+            case ArrayifyToStructure:
+                // We could check if the arrayification could affect our structures.
+                // But that seems like it would take Effort.
+                return false;
+                
             default:
                 if (m_graph.clobbersWorld(index))
                     return false;
@@ -663,7 +670,6 @@ private:
 
             case AllocatePropertyStorage:
             case ReallocatePropertyStorage:
-            case Arrayify:
                 // If we can cheaply prove this is a change to our object's storage, we
                 // can optimize and use its result.
                 if (node.child1() == child1)
@@ -689,6 +695,12 @@ private:
                 }
                 return NoNode;
                 
+            case Arrayify:
+            case ArrayifyToStructure:
+                // We could check if the arrayification could affect our butterfly.
+                // But that seems like it would take Effort.
+                return NoNode;
+                
             default:
                 if (m_graph.clobbersWorld(index))
                     return NoNode;
@@ -698,7 +710,7 @@ private:
         return NoNode;
     }
     
-    bool checkArrayElimination(NodeIndex child1, Array::Mode arrayMode)
+    bool checkArrayElimination(NodeIndex child1, ArrayMode arrayMode)
     {
         for (unsigned i = m_indexInBlock; i--;) {
             NodeIndex index = m_currentBlock->at(i);
@@ -720,6 +732,12 @@ private:
                     return true;
                 break;
                 
+            case Arrayify:
+            case ArrayifyToStructure:
+                // We could check if the arrayification could affect our array.
+                // But that seems like it would take Effort.
+                return false;
+                
             default:
                 if (m_graph.clobbersWorld(index))
                     return false;
@@ -729,7 +747,7 @@ private:
         return false;
     }
 
-    NodeIndex getIndexedPropertyStorageLoadElimination(NodeIndex child1, Array::Mode arrayMode)
+    NodeIndex getIndexedPropertyStorageLoadElimination(NodeIndex child1, ArrayMode arrayMode)
     {
         for (unsigned i = m_indexInBlock; i--;) {
             NodeIndex index = m_currentBlock->at(i);
@@ -788,8 +806,6 @@ private:
         }
         return NoNode;
     }
-
-
     
     NodeIndex getLocalLoadElimination(VirtualRegister local, NodeIndex& relevantLocalOp, bool careAboutClobbering)
     {
@@ -1234,7 +1250,7 @@ private:
         case PutByVal: {
             Edge child1 = m_graph.varArgChild(node, 0);
             Edge child2 = m_graph.varArgChild(node, 1);
-            if (canCSEStorage(node.arrayMode())) {
+            if (node.arrayMode().canCSEStorage()) {
                 NodeIndex nodeIndex = getByValLoadElimination(child1.index(), child2.index());
                 if (nodeIndex == NoNode)
                     break;
diff --git a/Source/JavaScriptCore/dfg/DFGCapabilities.h b/Source/JavaScriptCore/dfg/DFGCapabilities.h
index e80cc28ae..1f9778efe 100644
--- a/Source/JavaScriptCore/dfg/DFGCapabilities.h
+++ b/Source/JavaScriptCore/dfg/DFGCapabilities.h
@@ -157,7 +157,6 @@ inline CapabilityLevel canCompileOpcode(OpcodeID opcodeID, CodeBlock*, Instructi
     case op_nstricteq:
     case op_get_by_val:
     case op_put_by_val:
-    case op_method_check:
     case op_get_by_id:
     case op_get_by_id_out_of_line:
     case op_get_array_length:
@@ -167,6 +166,7 @@ inline CapabilityLevel canCompileOpcode(OpcodeID opcodeID, CodeBlock*, Instructi
     case op_put_by_id_transition_direct_out_of_line:
     case op_put_by_id_transition_normal:
     case op_put_by_id_transition_normal_out_of_line:
+    case op_init_global_const_nop:
     case op_init_global_const:
     case op_init_global_const_check:
     case op_jmp:
@@ -200,7 +200,7 @@ inline CapabilityLevel canCompileOpcode(OpcodeID opcodeID, CodeBlock*, Instructi
     case op_strcat:
     case op_to_primitive:
     case op_throw:
-    case op_throw_reference_error:
+    case op_throw_static_error:
     case op_call:
     case op_construct:
     case op_new_regexp: 
diff --git a/Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp b/Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp
index 25915cfd4..43aa2c007 100644
--- a/Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp
+++ b/Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp
@@ -92,10 +92,22 @@ private:
             }
                     
             case CheckStructure:
-            case ForwardCheckStructure: {
+            case ForwardCheckStructure:
+            case ArrayifyToStructure: {
                 AbstractValue& value = m_state.forNode(node.child1());
+                StructureSet set;
+                if (node.op() == ArrayifyToStructure)
+                    set = node.structure();
+                else
+                    set = node.structureSet();
+                if (value.m_currentKnownStructure.isSubsetOf(set)) {
+                    ASSERT(node.refCount() == 1);
+                    node.setOpAndDefaultFlags(Phantom);
+                    eliminated = true;
+                    break;
+                }
                 StructureAbstractValue& structureValue = value.m_futurePossibleStructure;
-                if (structureValue.isSubsetOf(node.structureSet())
+                if (structureValue.isSubsetOf(set)
                     && structureValue.hasSingleton()
                     && isCellSpeculation(value.m_type))
                     node.convertToStructureTransitionWatchpoint(structureValue.singleton());
@@ -104,7 +116,7 @@ private:
                 
             case CheckArray:
             case Arrayify: {
-                if (!modeAlreadyChecked(m_state.forNode(node.child1()), node.arrayMode()))
+                if (!node.arrayMode().alreadyChecked(m_state.forNode(node.child1())))
                     break;
                 ASSERT(node.refCount() == 1);
                 node.setOpAndDefaultFlags(Phantom);
diff --git a/Source/JavaScriptCore/dfg/DFGFPRInfo.h b/Source/JavaScriptCore/dfg/DFGFPRInfo.h
index 5ee87bce1..d6a038a99 100644
--- a/Source/JavaScriptCore/dfg/DFGFPRInfo.h
+++ b/Source/JavaScriptCore/dfg/DFGFPRInfo.h
@@ -82,7 +82,7 @@ public:
     {
         ASSERT(reg != InvalidFPRReg);
 #if CPU(X86_64)
-        ASSERT(reg < 16);
+        ASSERT(static_cast<int>(reg) < 16);
         static const char* nameForRegister[16] = {
             "xmm0", "xmm1", "xmm2", "xmm3",
             "xmm4", "xmm5", "xmm6", "xmm7",
@@ -90,7 +90,7 @@ public:
             "xmm12", "xmm13", "xmm14", "xmm15"
         };
 #elif CPU(X86)
-        ASSERT(reg < 8);
+        ASSERT(static_cast<int>(reg) < 8);
         static const char* nameForRegister[8] = {
             "xmm0", "xmm1", "xmm2", "xmm3",
             "xmm4", "xmm5", "xmm6", "xmm7"
diff --git a/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp b/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
index 5dcfe08a5..5a76aa8df 100644
--- a/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
+++ b/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
@@ -86,14 +86,14 @@ private:
             ArrayProfile* arrayProfile = 
                 m_graph.baselineCodeBlockFor(nodePtr->codeOrigin)->getArrayProfile(
                     nodePtr->codeOrigin.bytecodeIndex);
-            Array::Mode arrayMode = Array::SelectUsingPredictions;
+            ArrayMode arrayMode = ArrayMode(Array::SelectUsingPredictions);
             if (arrayProfile) {
-                arrayProfile->computeUpdatedPrediction();
-                arrayMode = refineArrayMode(
-                    fromObserved(arrayProfile, Array::Read, false),
+                arrayProfile->computeUpdatedPrediction(m_graph.baselineCodeBlockFor(node.codeOrigin));
+                arrayMode = ArrayMode::fromObserved(arrayProfile, Array::Read, false);
+                arrayMode = arrayMode.refine(
                     m_graph[node.child1()].prediction(),
                     m_graph[m_compileIndex].prediction());
-                if (modeSupportsLength(arrayMode) && arrayProfile->hasDefiniteStructure()) {
+                if (arrayMode.supportsLength() && arrayProfile->hasDefiniteStructure()) {
                     m_graph.ref(nodePtr->child1());
                     Node checkStructure(CheckStructure, nodePtr->codeOrigin, OpInfo(m_graph.addStructureSet(arrayProfile->expectedStructure())), nodePtr->child1().index());
                     checkStructure.ref();
@@ -103,12 +103,11 @@ private:
                     nodePtr = &m_graph[m_compileIndex];
                 }
             } else {
-                arrayMode = refineArrayMode(
-                    arrayMode,
+                arrayMode = arrayMode.refine(
                     m_graph[node.child1()].prediction(),
                     m_graph[m_compileIndex].prediction());
             }
-            if (!modeSupportsLength(arrayMode))
+            if (!arrayMode.supportsLength())
                 break;
             nodePtr->setOp(GetArrayLength);
             ASSERT(nodePtr->flags() & NodeMustGenerate);
@@ -125,21 +124,25 @@ private:
             break;
         }
         case GetIndexedPropertyStorage: {
-            ASSERT(canCSEStorage(node.arrayMode()));
+            ASSERT(node.arrayMode().canCSEStorage());
             break;
         }
-        case GetByVal:
-        case StringCharAt:
-        case StringCharCodeAt: {
+        case GetByVal: {
             node.setArrayMode(
-                refineArrayMode(
-                    node.arrayMode(),
+                node.arrayMode().refine(
                     m_graph[node.child1()].prediction(),
                     m_graph[node.child2()].prediction()));
             
             blessArrayOperation(node.child1(), node.child2(), 2);
             break;
         }
+        case StringCharAt:
+        case StringCharCodeAt: {
+            // Currently we have no good way of refining these.
+            ASSERT(node.arrayMode() == ArrayMode(Array::String));
+            blessArrayOperation(node.child1(), node.child2(), 2);
+            break;
+        }
             
         case ArrayPush: {
             blessArrayOperation(node.child1(), node.child2(), 2);
@@ -323,8 +326,7 @@ private:
             Edge child3 = m_graph.varArgChild(node, 2);
 
             node.setArrayMode(
-                refineArrayMode(
-                    node.arrayMode(),
+                node.arrayMode().refine(
                     m_graph[child1].prediction(),
                     m_graph[child2].prediction()));
             
@@ -332,7 +334,7 @@ private:
             
             Node* nodePtr = &m_graph[m_compileIndex];
             
-            switch (modeForPut(nodePtr->arrayMode())) {
+            switch (nodePtr->arrayMode().modeForPut().type()) {
             case Array::Int8Array:
             case Array::Int16Array:
             case Array::Int32Array:
@@ -376,47 +378,66 @@ private:
         return nodeIndex;
     }
     
-    NodeIndex checkArray(Array::Mode arrayMode, CodeOrigin codeOrigin, NodeIndex array, NodeIndex index, bool (*storageCheck)(Array::Mode) = canCSEStorage, bool shouldGenerate = true)
+    NodeIndex checkArray(ArrayMode arrayMode, CodeOrigin codeOrigin, NodeIndex array, NodeIndex index, bool (*storageCheck)(const ArrayMode&) = canCSEStorage, bool shouldGenerate = true)
     {
-        ASSERT(modeIsSpecific(arrayMode));
+        ASSERT(arrayMode.isSpecific());
         
         m_graph.ref(array);
 
-        if (isEffectful(arrayMode)) {
+        if (arrayMode.doesConversion()) {
             if (index != NoNode)
                 m_graph.ref(index);
-            Node arrayify(Arrayify, codeOrigin, OpInfo(arrayMode), array, index);
-            arrayify.ref(); // Once because it's used as a butterfly.
-            arrayify.ref(); // And twice because it's must-generate.
-            NodeIndex arrayifyIndex = m_graph.size();
-            m_graph.append(arrayify);
-            m_insertionSet.append(m_indexInBlock, arrayifyIndex);
-            
-            ASSERT(shouldGenerate);
-            ASSERT(canCSEStorage(arrayMode));
-            ASSERT(modeUsesButterfly(arrayMode));
-
-            if (!storageCheck(arrayMode))
-                return NoNode;
-            return arrayifyIndex;
+            
+            Structure* structure = 0;
+            if (arrayMode.isJSArrayWithOriginalStructure()) {
+                JSGlobalObject* globalObject = m_graph.baselineCodeBlockFor(codeOrigin)->globalObject();
+                switch (arrayMode.type()) {
+                case Array::Contiguous:
+                    structure = globalObject->arrayStructure();
+                    if (structure->indexingType() != ArrayWithContiguous)
+                        structure = 0;
+                    break;
+                case Array::ArrayStorage:
+                    structure = globalObject->arrayStructureWithArrayStorage();
+                    if (structure->indexingType() != ArrayWithArrayStorage)
+                        structure = 0;
+                    break;
+                default:
+                    break;
+                }
+            }
+            
+            if (structure) {
+                Node arrayify(ArrayifyToStructure, codeOrigin, OpInfo(structure), OpInfo(arrayMode.asWord()), array, index);
+                arrayify.ref();
+                NodeIndex arrayifyIndex = m_graph.size();
+                m_graph.append(arrayify);
+                m_insertionSet.append(m_indexInBlock, arrayifyIndex);
+            } else {
+                Node arrayify(Arrayify, codeOrigin, OpInfo(arrayMode.asWord()), array, index);
+                arrayify.ref();
+                NodeIndex arrayifyIndex = m_graph.size();
+                m_graph.append(arrayify);
+                m_insertionSet.append(m_indexInBlock, arrayifyIndex);
+            }
+        } else {
+            Node checkArray(CheckArray, codeOrigin, OpInfo(arrayMode.asWord()), array);
+            checkArray.ref();
+            NodeIndex checkArrayIndex = m_graph.size();
+            m_graph.append(checkArray);
+            m_insertionSet.append(m_indexInBlock, checkArrayIndex);
         }
         
-        Node checkArray(CheckArray, codeOrigin, OpInfo(arrayMode), array);
-        checkArray.ref();
-        NodeIndex checkArrayIndex = m_graph.size();
-        m_graph.append(checkArray);
-        m_insertionSet.append(m_indexInBlock, checkArrayIndex);
-
         if (!storageCheck(arrayMode))
             return NoNode;
         
         if (shouldGenerate)
             m_graph.ref(array);
         
-        if (modeUsesButterfly(arrayMode))
+        if (arrayMode.usesButterfly())
             return addNode(Node(GetButterfly, codeOrigin, array), shouldGenerate);
         
-        return addNode(Node(GetIndexedPropertyStorage, codeOrigin, OpInfo(arrayMode), array), shouldGenerate);
+        return addNode(Node(GetIndexedPropertyStorage, codeOrigin, OpInfo(arrayMode.asWord()), array), shouldGenerate);
     }
     
     void blessArrayOperation(Edge base, Edge index, unsigned storageChildIdx)
@@ -426,7 +447,7 @@ private:
             
         Node* nodePtr = &m_graph[m_compileIndex];
         
-        switch (nodePtr->arrayMode()) {
+        switch (nodePtr->arrayMode().type()) {
         case Array::ForceExit: {
             Node forceExit(ForceOSRExit, nodePtr->codeOrigin);
             forceExit.ref();
diff --git a/Source/JavaScriptCore/dfg/DFGGPRInfo.h b/Source/JavaScriptCore/dfg/DFGGPRInfo.h
index 498b116ec..3d07556cc 100644
--- a/Source/JavaScriptCore/dfg/DFGGPRInfo.h
+++ b/Source/JavaScriptCore/dfg/DFGGPRInfo.h
@@ -218,7 +218,7 @@ public:
     
     GPRReg tagGPR() const
     {
-        ASSERT(!isAddress() && m_baseOrTag != InvalidGPRReg);
+        ASSERT(!isAddress() && static_cast<GPRReg>(m_baseOrTag) != InvalidGPRReg);
         return static_cast<GPRReg>(m_baseOrTag);
     }
     
@@ -290,7 +290,7 @@ public:
     static unsigned toIndex(GPRReg reg)
     {
         ASSERT(reg != InvalidGPRReg);
-        ASSERT(reg < 8);
+        ASSERT(static_cast<int>(reg) < 8);
         static const unsigned indexForRegister[8] = { 0, 2, 1, 3, InvalidIndex, InvalidIndex, 4, InvalidIndex };
         unsigned result = indexForRegister[reg];
         ASSERT(result != InvalidIndex);
@@ -300,7 +300,7 @@ public:
     static const char* debugName(GPRReg reg)
     {
         ASSERT(reg != InvalidGPRReg);
-        ASSERT(reg < 8);
+        ASSERT(static_cast<int>(reg) < 8);
         static const char* nameForRegister[8] = {
             "eax", "ecx", "edx", "ebx",
             "esp", "ebp", "esi", "edi",
@@ -362,7 +362,7 @@ public:
     static unsigned toIndex(GPRReg reg)
     {
         ASSERT(reg != InvalidGPRReg);
-        ASSERT(reg < 16);
+        ASSERT(static_cast<int>(reg) < 16);
         static const unsigned indexForRegister[16] = { 0, 2, 1, 3, InvalidIndex, InvalidIndex, 5, 4, 6, 7, 8, InvalidIndex, InvalidIndex, InvalidIndex, InvalidIndex, InvalidIndex };
         unsigned result = indexForRegister[reg];
         ASSERT(result != InvalidIndex);
@@ -372,7 +372,7 @@ public:
     static const char* debugName(GPRReg reg)
     {
         ASSERT(reg != InvalidGPRReg);
-        ASSERT(reg < 16);
+        ASSERT(static_cast<int>(reg) < 16);
         static const char* nameForRegister[16] = {
             "rax", "rcx", "rdx", "rbx",
             "rsp", "rbp", "rsi", "rdi",
diff --git a/Source/JavaScriptCore/dfg/DFGGraph.cpp b/Source/JavaScriptCore/dfg/DFGGraph.cpp
index b9a0db2a2..8e8817f81 100644
--- a/Source/JavaScriptCore/dfg/DFGGraph.cpp
+++ b/Source/JavaScriptCore/dfg/DFGGraph.cpp
@@ -226,7 +226,7 @@ void Graph::dump(const char* prefix, NodeIndex nodeIndex)
         hasPrinted = true;
     }
     if (node.hasArrayMode()) {
-        dataLog("%s%s", hasPrinted ? ", " : "", modeToString(node.arrayMode()));
+        dataLog("%s%s", hasPrinted ? ", " : "", node.arrayMode().toString());
         hasPrinted = true;
     }
     if (node.hasVarNumber()) {
diff --git a/Source/JavaScriptCore/dfg/DFGGraph.h b/Source/JavaScriptCore/dfg/DFGGraph.h
index b2c754f85..9fbb2df07 100644
--- a/Source/JavaScriptCore/dfg/DFGGraph.h
+++ b/Source/JavaScriptCore/dfg/DFGGraph.h
@@ -490,14 +490,14 @@ public:
     // - and so on.
     bool byValIsPure(Node& node)
     {
-        switch (node.arrayMode()) {
+        switch (node.arrayMode().type()) {
         case Array::Generic:
-        case OUT_OF_BOUNDS_CONTIGUOUS_MODES:
-        case ARRAY_STORAGE_TO_HOLE_MODES:
-        case OUT_OF_BOUNDS_ARRAY_STORAGE_MODES:
-        case SLOW_PUT_ARRAY_STORAGE_MODES:
-        case ALL_EFFECTFUL_MODES:
             return false;
+        case Array::Contiguous:
+        case Array::ArrayStorage:
+            return !node.arrayMode().isOutOfBounds();
+        case Array::SlowPutArrayStorage:
+            return !node.arrayMode().mayStoreToHole();
         case Array::String:
             return node.op() == GetByVal;
 #if USE(JSVALUE32_64)
@@ -689,6 +689,7 @@ public:
     SegmentedVector<ArgumentPosition, 8> m_argumentPositions;
     SegmentedVector<StructureSet, 16> m_structureSet;
     SegmentedVector<StructureTransitionData, 8> m_structureTransitionData;
+    SegmentedVector<NewArrayBufferData, 4> m_newArrayBufferData;
     bool m_hasArguments;
     HashSet<ExecutableBase*> m_executablesWhoseArgumentsEscaped;
     BitVector m_preservedVars;
diff --git a/Source/JavaScriptCore/dfg/DFGNode.h b/Source/JavaScriptCore/dfg/DFGNode.h
index 40b3ed7ec..e66629ec4 100644
--- a/Source/JavaScriptCore/dfg/DFGNode.h
+++ b/Source/JavaScriptCore/dfg/DFGNode.h
@@ -59,6 +59,11 @@ struct StructureTransitionData {
     }
 };
 
+struct NewArrayBufferData {
+    unsigned startConstant;
+    unsigned numConstants;
+};
+
 // This type used in passing an immediate argument to Node constructor;
 // distinguishes an immediate value (typically an index into a CodeBlock data structure - 
 // a constant index, argument, or identifier) from a NodeIndex.
@@ -250,9 +255,9 @@ struct Node {
     
     void convertToStructureTransitionWatchpoint(Structure* structure)
     {
-        ASSERT(m_op == CheckStructure || m_op == ForwardCheckStructure);
+        ASSERT(m_op == CheckStructure || m_op == ForwardCheckStructure || m_op == ArrayifyToStructure);
         m_opInfo = bitwise_cast<uintptr_t>(structure);
-        if (m_op == CheckStructure)
+        if (m_op == CheckStructure || m_op == ArrayifyToStructure)
             m_op = StructureTransitionWatchpoint;
         else
             m_op = ForwardStructureTransitionWatchpoint;
@@ -412,16 +417,20 @@ struct Node {
         return op() == NewArrayBuffer;
     }
     
-    unsigned startConstant()
+    NewArrayBufferData* newArrayBufferData()
     {
         ASSERT(hasConstantBuffer());
-        return m_opInfo;
+        return reinterpret_cast<NewArrayBufferData*>(m_opInfo);
+    }
+    
+    unsigned startConstant()
+    {
+        return newArrayBufferData()->startConstant;
     }
     
     unsigned numConstants()
     {
-        ASSERT(hasConstantBuffer());
-        return m_opInfo2;
+        return newArrayBufferData()->numConstants;
     }
     
     bool hasRegexpIndex()
@@ -692,6 +701,7 @@ struct Node {
         switch (op()) {
         case StructureTransitionWatchpoint:
         case ForwardStructureTransitionWatchpoint:
+        case ArrayifyToStructure:
             return true;
         default:
             return false;
@@ -750,6 +760,7 @@ struct Node {
         case StringCharCodeAt:
         case CheckArray:
         case Arrayify:
+        case ArrayifyToStructure:
         case ArrayPush:
         case ArrayPop:
             return true;
@@ -758,18 +769,20 @@ struct Node {
         }
     }
     
-    Array::Mode arrayMode()
+    ArrayMode arrayMode()
     {
         ASSERT(hasArrayMode());
-        return static_cast<Array::Mode>(m_opInfo);
+        if (op() == ArrayifyToStructure)
+            return ArrayMode::fromWord(m_opInfo2);
+        return ArrayMode::fromWord(m_opInfo);
     }
     
-    bool setArrayMode(Array::Mode arrayMode)
+    bool setArrayMode(ArrayMode arrayMode)
     {
         ASSERT(hasArrayMode());
         if (this->arrayMode() == arrayMode)
             return false;
-        m_opInfo = arrayMode;
+        m_opInfo = arrayMode.asWord();
         return true;
     }
     
diff --git a/Source/JavaScriptCore/dfg/DFGNodeType.h b/Source/JavaScriptCore/dfg/DFGNodeType.h
index 1d2460659..624b1ae75 100644
--- a/Source/JavaScriptCore/dfg/DFGNodeType.h
+++ b/Source/JavaScriptCore/dfg/DFGNodeType.h
@@ -139,7 +139,8 @@ namespace JSC { namespace DFG {
     macro(ReallocatePropertyStorage, NodeMustGenerate | NodeDoesNotExit | NodeResultStorage) \
     macro(GetButterfly, NodeResultStorage) \
     macro(CheckArray, NodeMustGenerate) \
-    macro(Arrayify, NodeResultStorage | NodeMustGenerate | NodeClobbersWorld) \
+    macro(Arrayify, NodeMustGenerate) \
+    macro(ArrayifyToStructure, NodeMustGenerate) \
     macro(GetIndexedPropertyStorage, NodeResultStorage) \
     macro(GetByOffset, NodeResultJS) \
     macro(PutByOffset, NodeMustGenerate) \
diff --git a/Source/JavaScriptCore/dfg/DFGOSRExit.cpp b/Source/JavaScriptCore/dfg/DFGOSRExit.cpp
index 6560088fd..b3701722e 100644
--- a/Source/JavaScriptCore/dfg/DFGOSRExit.cpp
+++ b/Source/JavaScriptCore/dfg/DFGOSRExit.cpp
@@ -45,9 +45,9 @@ OSRExit::OSRExit(ExitKind kind, JSValueSource jsValueSource, MethodOfGettingAVal
     , m_kind(kind)
     , m_count(0)
     , m_streamIndex(streamIndex)
+    , m_lastSetOperand(jit->m_lastSetOperand)
 {
     ASSERT(m_codeOrigin.isSet());
-    m_setOperands.append(jit->m_lastSetOperand);
 }
 
 bool OSRExit::considerAddingAsFrequentExitSiteSlow(CodeBlock* dfgCodeBlock, CodeBlock* profiledCodeBlock)
diff --git a/Source/JavaScriptCore/dfg/DFGOSRExit.h b/Source/JavaScriptCore/dfg/DFGOSRExit.h
index 0ecefe386..cd2434c11 100644
--- a/Source/JavaScriptCore/dfg/DFGOSRExit.h
+++ b/Source/JavaScriptCore/dfg/DFGOSRExit.h
@@ -110,9 +110,9 @@ struct OSRExit {
     }
     
     unsigned m_streamIndex;
-    Vector<int, 1> m_setOperands;
+    int m_lastSetOperand;
     
-    Vector<RefPtr<ValueRecoveryOverride>, 1> m_valueRecoveryOverrides;
+    RefPtr<ValueRecoveryOverride> m_valueRecoveryOverride;
 
 private:
     bool considerAddingAsFrequentExitSiteSlow(CodeBlock* dfgCodeBlock, CodeBlock* profiledCodeBlock);
diff --git a/Source/JavaScriptCore/dfg/DFGOSRExitCompiler.cpp b/Source/JavaScriptCore/dfg/DFGOSRExitCompiler.cpp
index 55a903c7a..2ce1c887b 100644
--- a/Source/JavaScriptCore/dfg/DFGOSRExitCompiler.cpp
+++ b/Source/JavaScriptCore/dfg/DFGOSRExitCompiler.cpp
@@ -70,10 +70,11 @@ void compileOSRExit(ExecState* exec)
     Operands<ValueRecovery> operands;
     codeBlock->variableEventStream().reconstruct(codeBlock, exit.m_codeOrigin, codeBlock->minifiedDFG(), exit.m_streamIndex, operands);
     
-    // There may be overrides, for forward speculations.
-    for (size_t i = 0; i < exit.m_valueRecoveryOverrides.size(); i++)
-        operands.setOperand(exit.m_valueRecoveryOverrides[i]->operand, exit.m_valueRecoveryOverrides[i]->recovery);
-
+    // There may be an override, for forward speculations.
+    if (!!exit.m_valueRecoveryOverride) {
+        operands.setOperand(
+            exit.m_valueRecoveryOverride->operand, exit.m_valueRecoveryOverride->recovery);
+    }
     
     SpeculationRecovery* recovery = 0;
     if (exit.m_recoveryIndex)
diff --git a/Source/JavaScriptCore/dfg/DFGOSRExitCompiler32_64.cpp b/Source/JavaScriptCore/dfg/DFGOSRExitCompiler32_64.cpp
index b64ce3fa1..df4f3c905 100644
--- a/Source/JavaScriptCore/dfg/DFGOSRExitCompiler32_64.cpp
+++ b/Source/JavaScriptCore/dfg/DFGOSRExitCompiler32_64.cpp
@@ -688,6 +688,8 @@ void OSRExitCompiler::compileExit(const OSRExit& exit, const Operands<ValueRecov
                 }
             }
 
+            if (!m_jit.baselineCodeBlockFor(inlineCallFrame)->usesArguments())
+                continue;
             int argumentsRegister = m_jit.argumentsRegisterFor(inlineCallFrame);
             if (didCreateArgumentsObject.add(inlineCallFrame).isNewEntry) {
                 // We know this call frame optimized out an arguments object that
@@ -732,9 +734,9 @@ void OSRExitCompiler::compileExit(const OSRExit& exit, const Operands<ValueRecov
     
     // 15) Load the result of the last bytecode operation into regT0.
     
-    for (size_t i = 0; i < exit.m_setOperands.size(); i++) {
-        m_jit.load32(AssemblyHelpers::payloadFor((VirtualRegister)exit.m_setOperands[i]), GPRInfo::cachedResultRegister);
-        m_jit.load32(AssemblyHelpers::tagFor((VirtualRegister)exit.m_setOperands[i]), GPRInfo::cachedResultRegister2);
+    if (exit.m_lastSetOperand != std::numeric_limits<int>::max()) {
+        m_jit.load32(AssemblyHelpers::payloadFor((VirtualRegister)exit.m_lastSetOperand), GPRInfo::cachedResultRegister);
+        m_jit.load32(AssemblyHelpers::tagFor((VirtualRegister)exit.m_lastSetOperand), GPRInfo::cachedResultRegister2);
     }
     
     // 16) Adjust the call frame pointer.
diff --git a/Source/JavaScriptCore/dfg/DFGOSRExitCompiler64.cpp b/Source/JavaScriptCore/dfg/DFGOSRExitCompiler64.cpp
index 65b89a550..b278997ab 100644
--- a/Source/JavaScriptCore/dfg/DFGOSRExitCompiler64.cpp
+++ b/Source/JavaScriptCore/dfg/DFGOSRExitCompiler64.cpp
@@ -653,6 +653,8 @@ void OSRExitCompiler::compileExit(const OSRExit& exit, const Operands<ValueRecov
                 }
             }
 
+            if (!m_jit.baselineCodeBlockFor(inlineCallFrame)->usesArguments())
+                continue;
             int argumentsRegister = m_jit.argumentsRegisterFor(inlineCallFrame);
             if (didCreateArgumentsObject.add(inlineCallFrame).isNewEntry) {
                 // We know this call frame optimized out an arguments object that
@@ -681,9 +683,9 @@ void OSRExitCompiler::compileExit(const OSRExit& exit, const Operands<ValueRecov
     
     // 16) Load the result of the last bytecode operation into regT0.
     
-    for (size_t i = 0; i < exit.m_setOperands.size(); i++)
-        m_jit.load64(AssemblyHelpers::addressFor((VirtualRegister)exit.m_setOperands[i]), GPRInfo::cachedResultRegister);
-
+    if (exit.m_lastSetOperand != std::numeric_limits<int>::max())
+        m_jit.loadPtr(AssemblyHelpers::addressFor((VirtualRegister)exit.m_lastSetOperand), GPRInfo::cachedResultRegister);
+    
     // 17) Adjust the call frame pointer.
     
     if (exit.m_codeOrigin.inlineCallFrame)
diff --git a/Source/JavaScriptCore/dfg/DFGOperations.cpp b/Source/JavaScriptCore/dfg/DFGOperations.cpp
index 13e04388c..0e45e230c 100644
--- a/Source/JavaScriptCore/dfg/DFGOperations.cpp
+++ b/Source/JavaScriptCore/dfg/DFGOperations.cpp
@@ -1157,8 +1157,7 @@ JSCell* DFG_OPERATION operationCreateActivation(ExecState* exec)
 {
     JSGlobalData& globalData = exec->globalData();
     NativeCallFrameTracer tracer(&globalData, exec);
-    JSActivation* activation = JSActivation::create(
-        globalData, exec, static_cast<FunctionExecutable*>(exec->codeBlock()->ownerExecutable()));
+    JSActivation* activation = JSActivation::create(globalData, exec, exec->codeBlock());
     exec->setScope(activation);
     return activation;
 }
diff --git a/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp b/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp
index fee7a3ca2..3e8ead5c6 100644
--- a/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp
+++ b/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp
@@ -635,7 +635,8 @@ private:
         case PhantomPutStructure:
         case PhantomArguments:
         case CheckArray:
-        case Arrayify: {
+        case Arrayify:
+        case ArrayifyToStructure: {
             // This node should never be visible at this stage of compilation. It is
             // inserted by fixup(), which follows this phase.
             ASSERT_NOT_REACHED();
diff --git a/Source/JavaScriptCore/dfg/DFGRepatch.cpp b/Source/JavaScriptCore/dfg/DFGRepatch.cpp
index 531a525d5..7c15ef33e 100644
--- a/Source/JavaScriptCore/dfg/DFGRepatch.cpp
+++ b/Source/JavaScriptCore/dfg/DFGRepatch.cpp
@@ -324,7 +324,7 @@ static bool tryCacheGetByID(ExecState* exec, JSValue baseValue, const Identifier
     
     PropertyOffset offset = slot.cachedOffset();
     size_t count = normalizePrototypeChain(exec, baseValue, slot.slotBase(), propertyName, offset);
-    if (!count)
+    if (count == InvalidPrototypeChain)
         return false;
 
     StructureChain* prototypeChain = structure->prototypeChain(exec);
@@ -550,7 +550,7 @@ static bool tryBuildGetByIDProtoList(ExecState* exec, JSValue baseValue, const I
     
     PropertyOffset offset = slot.cachedOffset();
     size_t count = normalizePrototypeChain(exec, baseValue, slot.slotBase(), propertyName, offset);
-    if (!count)
+    if (count == InvalidPrototypeChain)
         return false;
 
     Structure* structure = baseValue.asCell()->structure();
@@ -964,7 +964,8 @@ static bool tryCachePutByID(ExecState* exec, JSValue baseValue, const Identifier
             if (hasIndexingHeader(oldStructure->indexingType()))
                 return false;
             
-            normalizePrototypeChain(exec, baseCell);
+            if (normalizePrototypeChain(exec, baseCell) == InvalidPrototypeChain)
+                return false;
             
             StructureChain* prototypeChain = structure->prototypeChain(exec);
             
@@ -1035,7 +1036,8 @@ static bool tryBuildPutByIdList(ExecState* exec, JSValue baseValue, const Identi
             if (hasIndexingHeader(oldStructure->indexingType()))
                 return false;
             
-            normalizePrototypeChain(exec, baseCell);
+            if (normalizePrototypeChain(exec, baseCell) == InvalidPrototypeChain)
+                return false;
             
             StructureChain* prototypeChain = structure->prototypeChain(exec);
             
diff --git a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
index 7cb028388..6bedd6d68 100644
--- a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
+++ b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
@@ -153,19 +153,37 @@ JumpReplacementWatchpoint* SpeculativeJIT::speculationWatchpoint(ExitKind kind)
 
 void SpeculativeJIT::convertLastOSRExitToForward(const ValueRecovery& valueRecovery)
 {
-#if !ASSERT_DISABLED
     if (!valueRecovery) {
         // Check that the preceding node was a SetLocal with the same code origin.
         Node* setLocal = &at(m_jit.graph().m_blocks[m_block]->at(m_indexInBlock - 1));
-        ASSERT(setLocal->op() == SetLocal);
-        ASSERT(setLocal->codeOrigin == at(m_compileIndex).codeOrigin);
+        ASSERT_UNUSED(setLocal, setLocal->op() == SetLocal);
+        ASSERT_UNUSED(setLocal, setLocal->codeOrigin == at(m_compileIndex).codeOrigin);
+        
+        // Find the next node.
+        unsigned indexInBlock = m_indexInBlock + 1;
+        Node* node = 0;
+        for (;;) {
+            if (indexInBlock == m_jit.graph().m_blocks[m_block]->size()) {
+                // This is an inline return. Give up and do a backwards speculation. This is safe
+                // because an inline return has its own bytecode index and it's always safe to
+                // reexecute that bytecode.
+                ASSERT(node->op() == Jump);
+                return;
+            }
+            node = &at(m_jit.graph().m_blocks[m_block]->at(indexInBlock));
+            if (node->codeOrigin != at(m_compileIndex).codeOrigin)
+                break;
+            indexInBlock++;
+        }
+        
+        ASSERT(node->codeOrigin != at(m_compileIndex).codeOrigin);
+        OSRExit& exit = m_jit.codeBlock()->lastOSRExit();
+        exit.m_codeOrigin = node->codeOrigin;
+        return;
     }
-#endif
     
     unsigned setLocalIndexInBlock = m_indexInBlock + 1;
-
-    OSRExit& exit = m_jit.codeBlock()->lastOSRExit();
-
+    
     Node* setLocal = &at(m_jit.graph().m_blocks[m_block]->at(setLocalIndexInBlock));
     bool hadInt32ToDouble = false;
     
@@ -175,13 +193,11 @@ void SpeculativeJIT::convertLastOSRExitToForward(const ValueRecovery& valueRecov
     }
     if (setLocal->op() == Flush || setLocal->op() == Phantom)
         setLocal = &at(m_jit.graph().m_blocks[m_block]->at(++setLocalIndexInBlock));
-    
-    if (!!valueRecovery) {
-        if (hadInt32ToDouble)
-            ASSERT(at(setLocal->child1()).child1() == m_compileIndex);
-        else
-            ASSERT(setLocal->child1() == m_compileIndex);
-    }
+        
+    if (hadInt32ToDouble)
+        ASSERT(at(setLocal->child1()).child1() == m_compileIndex);
+    else
+        ASSERT(setLocal->child1() == m_compileIndex);
     ASSERT(setLocal->op() == SetLocal);
     ASSERT(setLocal->codeOrigin == at(m_compileIndex).codeOrigin);
 
@@ -190,34 +206,14 @@ void SpeculativeJIT::convertLastOSRExitToForward(const ValueRecovery& valueRecov
         // We're at an inlined return. Use a backward speculation instead.
         return;
     }
-
-    exit.m_setOperands[0] = setLocal->local();
-    while (nextNode->codeOrigin == at(m_compileIndex).codeOrigin) {
-        ++setLocalIndexInBlock;
-        Node* nextSetLocal = nextNode;
-        if (nextSetLocal->op() == Int32ToDouble)
-            nextSetLocal = &at(m_jit.graph().m_blocks[m_block]->at(++setLocalIndexInBlock));
-
-        if (nextSetLocal->op() == Flush || nextSetLocal->op() == Phantom)
-            nextSetLocal = &at(m_jit.graph().m_blocks[m_block]->at(++setLocalIndexInBlock));
-
-        nextNode = &at(m_jit.graph().m_blocks[m_block]->at(setLocalIndexInBlock + 1));
-        ASSERT(nextNode->op() != Jump || nextNode->codeOrigin != at(m_compileIndex).codeOrigin);
-        ASSERT(nextSetLocal->op() == SetLocal);
-        exit.m_setOperands.append(nextSetLocal->local());
-    }
-
     ASSERT(nextNode->codeOrigin != at(m_compileIndex).codeOrigin);
-
+        
+    OSRExit& exit = m_jit.codeBlock()->lastOSRExit();
     exit.m_codeOrigin = nextNode->codeOrigin;
         
-    if (!valueRecovery)
-        return;
-
-    ASSERT(exit.m_setOperands.size() == 1);
-    for (size_t i = 0; i < exit.m_setOperands.size(); i++)
-        exit.m_valueRecoveryOverrides.append(adoptRef(new ValueRecoveryOverride(exit.m_setOperands[i], valueRecovery)));
-
+    exit.m_lastSetOperand = setLocal->local();
+    exit.m_valueRecoveryOverride = adoptRef(
+        new ValueRecoveryOverride(setLocal->local(), valueRecovery));
 }
 
 JumpReplacementWatchpoint* SpeculativeJIT::forwardSpeculationWatchpoint(ExitKind kind)
@@ -321,9 +317,9 @@ void SpeculativeJIT::clearGenerationInfo()
     m_fprs = RegisterBank<FPRInfo>();
 }
 
-const TypedArrayDescriptor* SpeculativeJIT::typedArrayDescriptor(Array::Mode arrayMode)
+const TypedArrayDescriptor* SpeculativeJIT::typedArrayDescriptor(ArrayMode arrayMode)
 {
-    switch (arrayMode) {
+    switch (arrayMode.type()) {
     case Array::Int8Array:
         return &m_jit.globalData()->int8ArrayDescriptor();
     case Array::Int16Array:
@@ -341,62 +337,75 @@ const TypedArrayDescriptor* SpeculativeJIT::typedArrayDescriptor(Array::Mode arr
     case Array::Float32Array:
         return &m_jit.globalData()->float32ArrayDescriptor();
     case Array::Float64Array:
-        return &m_jit.globalData()->float32ArrayDescriptor();
+        return &m_jit.globalData()->float64ArrayDescriptor();
     default:
         return 0;
     }
 }
 
-JITCompiler::JumpList SpeculativeJIT::jumpSlowForUnwantedArrayMode(GPRReg tempGPR, Array::Mode arrayMode)
+JITCompiler::JumpList SpeculativeJIT::jumpSlowForUnwantedArrayMode(GPRReg tempGPR, ArrayMode arrayMode, bool invert)
 {
     JITCompiler::JumpList result;
     
-    switch (arrayMode) {
-    case NON_ARRAY_CONTIGUOUS_MODES: {
+    switch (arrayMode.type()) {
+    case Array::Contiguous: {
+        if (arrayMode.isJSArray()) {
+            m_jit.and32(TrustedImm32(IsArray | IndexingShapeMask), tempGPR);
+            result.append(
+                m_jit.branch32(
+                    invert ? MacroAssembler::Equal : MacroAssembler::NotEqual, tempGPR, TrustedImm32(IsArray | ContiguousShape)));
+            break;
+        }
         m_jit.and32(TrustedImm32(IndexingShapeMask), tempGPR);
         result.append(
-            m_jit.branch32(MacroAssembler::NotEqual, tempGPR, TrustedImm32(ContiguousShape)));
+            m_jit.branch32(invert ? MacroAssembler::Equal : MacroAssembler::NotEqual, tempGPR, TrustedImm32(ContiguousShape)));
         break;
     }
-    case ARRAY_WITH_CONTIGUOUS_MODES: {
-        m_jit.and32(TrustedImm32(IsArray | IndexingShapeMask), tempGPR);
-        result.append(
-            m_jit.branch32(
-                MacroAssembler::NotEqual, tempGPR, TrustedImm32(IsArray | ContiguousShape)));
-        break;
-    }
-    case NON_ARRAY_ARRAY_STORAGE_MODES: {
+    case Array::ArrayStorage:
+    case Array::SlowPutArrayStorage: {
+        if (arrayMode.isJSArray()) {
+            if (arrayMode.isSlowPut()) {
+                if (invert) {
+                    JITCompiler::Jump slow = 
+                        m_jit.branchTest32(
+                            MacroAssembler::Zero, tempGPR, MacroAssembler::TrustedImm32(IsArray));
+                    m_jit.and32(TrustedImm32(IndexingShapeMask), tempGPR);
+                    m_jit.sub32(TrustedImm32(ArrayStorageShape), tempGPR);
+                    result.append(
+                        m_jit.branch32(
+                            MacroAssembler::BelowOrEqual, tempGPR,
+                            TrustedImm32(SlowPutArrayStorageShape - ArrayStorageShape)));
+                    
+                    slow.link(&m_jit);
+                }
+                
+                result.append(
+                    m_jit.branchTest32(
+                        MacroAssembler::Zero, tempGPR, MacroAssembler::TrustedImm32(IsArray)));
+                m_jit.and32(TrustedImm32(IndexingShapeMask), tempGPR);
+                m_jit.sub32(TrustedImm32(ArrayStorageShape), tempGPR);
+                result.append(
+                    m_jit.branch32(
+                        MacroAssembler::Above, tempGPR,
+                        TrustedImm32(SlowPutArrayStorageShape - ArrayStorageShape)));
+                break;
+            }
+            m_jit.and32(TrustedImm32(IsArray | IndexingShapeMask), tempGPR);
+            result.append(
+                m_jit.branch32(invert ? MacroAssembler::Equal : MacroAssembler::NotEqual, tempGPR, TrustedImm32(ArrayStorageShape)));
+            break;
+        }
         m_jit.and32(TrustedImm32(IndexingShapeMask), tempGPR);
-        if (isSlowPutAccess(arrayMode)) {
+        if (arrayMode.isSlowPut()) {
             m_jit.sub32(TrustedImm32(ArrayStorageShape), tempGPR);
             result.append(
                 m_jit.branch32(
-                    MacroAssembler::Above, tempGPR,
+                    invert ? MacroAssembler::BelowOrEqual : MacroAssembler::Above, tempGPR,
                     TrustedImm32(SlowPutArrayStorageShape - ArrayStorageShape)));
-        } else {
-            result.append(
-                m_jit.branch32(MacroAssembler::NotEqual, tempGPR, TrustedImm32(ArrayStorageShape)));
+            break;
         }
-        break;
-    }
-    case Array::ArrayWithArrayStorage:
-    case Array::ArrayWithArrayStorageToHole:
-    case Array::ArrayWithArrayStorageOutOfBounds: {
-        m_jit.and32(TrustedImm32(IsArray | IndexingShapeMask), tempGPR);
         result.append(
-            m_jit.branch32(MacroAssembler::NotEqual, tempGPR, TrustedImm32(ArrayStorageShape)));
-        break;
-    }
-    case Array::ArrayWithSlowPutArrayStorage: {
-        result.append(
-            m_jit.branchTest32(
-                MacroAssembler::Zero, tempGPR, MacroAssembler::TrustedImm32(IsArray)));
-        m_jit.and32(TrustedImm32(IndexingShapeMask), tempGPR);
-        m_jit.sub32(TrustedImm32(ArrayStorageShape), tempGPR);
-        result.append(
-            m_jit.branch32(
-                MacroAssembler::Above, tempGPR,
-                TrustedImm32(SlowPutArrayStorageShape - ArrayStorageShape)));
+            m_jit.branch32(invert ? MacroAssembler::Equal : MacroAssembler::NotEqual, tempGPR, TrustedImm32(ArrayStorageShape)));
         break;
     }
     default:
@@ -409,28 +418,28 @@ JITCompiler::JumpList SpeculativeJIT::jumpSlowForUnwantedArrayMode(GPRReg tempGP
 
 void SpeculativeJIT::checkArray(Node& node)
 {
-    ASSERT(modeIsSpecific(node.arrayMode()));
+    ASSERT(node.arrayMode().isSpecific());
+    ASSERT(!node.arrayMode().doesConversion());
     
     SpeculateCellOperand base(this, node.child1());
     GPRReg baseReg = base.gpr();
     
     const TypedArrayDescriptor* result = typedArrayDescriptor(node.arrayMode());
     
-    if (modeAlreadyChecked(m_state.forNode(node.child1()), node.arrayMode())) {
+    if (node.arrayMode().alreadyChecked(m_state.forNode(node.child1()))) {
         noResult(m_compileIndex);
         return;
     }
     
     const ClassInfo* expectedClassInfo = 0;
     
-    switch (node.arrayMode()) {
+    switch (node.arrayMode().type()) {
     case Array::String:
         expectedClassInfo = &JSString::s_info;
         break;
-    case NON_ARRAY_CONTIGUOUS_MODES:
-    case ARRAY_WITH_CONTIGUOUS_MODES:
-    case NON_ARRAY_ARRAY_STORAGE_MODES:
-    case ARRAY_WITH_ARRAY_STORAGE_MODES: {
+    case Array::Contiguous:
+    case Array::ArrayStorage:
+    case Array::SlowPutArrayStorage: {
         GPRTemporary temp(this);
         GPRReg tempGPR = temp.gpr();
         m_jit.loadPtr(
@@ -477,77 +486,63 @@ void SpeculativeJIT::checkArray(Node& node)
 
 void SpeculativeJIT::arrayify(Node& node, GPRReg baseReg, GPRReg propertyReg)
 {
-    Array::Mode desiredArrayMode;
-    
-    switch (node.arrayMode()) {
-    case Array::ToContiguous:
-        desiredArrayMode = Array::Contiguous;
-        break;
-    case Array::ToArrayStorage:
-        desiredArrayMode = Array::ArrayStorage;
-        break;
-    case Array::ToSlowPutArrayStorage:
-        desiredArrayMode = Array::SlowPutArrayStorage;
-        break;
-    case Array::ArrayToArrayStorage:
-        desiredArrayMode = Array::ArrayWithArrayStorage;
-        break;
-    case Array::PossiblyArrayToArrayStorage:
-        desiredArrayMode = Array::PossiblyArrayWithArrayStorage;
-        break;
-    default:
-        CRASH();
-        desiredArrayMode = Array::ForceExit;
-        break;
-    }
+    ASSERT(node.arrayMode().doesConversion());
     
-    GPRTemporary structure(this);
     GPRTemporary temp(this);
-    GPRReg structureGPR = structure.gpr();
+    GPRTemporary structure;
     GPRReg tempGPR = temp.gpr();
-        
-    m_jit.loadPtr(
-        MacroAssembler::Address(baseReg, JSCell::structureOffset()), structureGPR);
+    GPRReg structureGPR = InvalidGPRReg;
     
-    m_jit.load8(
-        MacroAssembler::Address(structureGPR, Structure::indexingTypeOffset()), tempGPR);
+    if (node.op() != ArrayifyToStructure) {
+        GPRTemporary realStructure(this);
+        structure.adopt(realStructure);
+        structureGPR = structure.gpr();
+    }
         
     // We can skip all that comes next if we already have array storage.
-    MacroAssembler::JumpList slowCases =
-        jumpSlowForUnwantedArrayMode(tempGPR, desiredArrayMode);
+    MacroAssembler::JumpList done;
+    
+    if (node.op() == ArrayifyToStructure) {
+        done.append(m_jit.branchWeakPtr(
+            JITCompiler::Equal,
+            JITCompiler::Address(baseReg, JSCell::structureOffset()),
+            node.structure()));
+    } else {
+        m_jit.loadPtr(
+            MacroAssembler::Address(baseReg, JSCell::structureOffset()), structureGPR);
         
-    m_jit.loadPtr(
-        MacroAssembler::Address(baseReg, JSObject::butterflyOffset()), tempGPR);
+        m_jit.load8(
+            MacroAssembler::Address(structureGPR, Structure::indexingTypeOffset()), tempGPR);
         
-    MacroAssembler::Jump done = m_jit.jump();
+        done = jumpSlowForUnwantedArrayMode(tempGPR, node.arrayMode(), true);
+
+        // Next check that the object does not intercept indexed accesses. If it does,
+        // then this mode won't work.
+        speculationCheck(
+            BadIndexingType, JSValueSource::unboxedCell(baseReg), NoNode,
+            m_jit.branchTest8(
+                MacroAssembler::NonZero,
+                MacroAssembler::Address(structureGPR, Structure::typeInfoFlagsOffset()),
+                MacroAssembler::TrustedImm32(InterceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero)));
+    }
         
-    slowCases.link(&m_jit);
-    
     // If we're allegedly creating contiguous storage and the index is bogus, then
     // just don't.
-    if (node.arrayMode() == Array::ToContiguous && propertyReg != InvalidGPRReg) {
+    if (node.arrayMode().type() == Array::Contiguous && propertyReg != InvalidGPRReg) {
         speculationCheck(
             Uncountable, JSValueRegs(), NoNode,
             m_jit.branch32(
                 MacroAssembler::AboveOrEqual, propertyReg, TrustedImm32(MIN_SPARSE_ARRAY_INDEX)));
     }
     
-    // Next check that the object does not intercept indexed accesses. If it does,
-    // then this mode won't work.
-    speculationCheck(
-        BadIndexingType, JSValueSource::unboxedCell(baseReg), NoNode,
-        m_jit.branchTest8(
-            MacroAssembler::NonZero,
-            MacroAssembler::Address(structureGPR, Structure::typeInfoFlagsOffset()),
-            MacroAssembler::TrustedImm32(InterceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero)));
-        
     // Now call out to create the array storage.
     silentSpillAllRegisters(tempGPR);
-    switch (node.arrayMode()) {
-    case ALL_EFFECTFUL_CONTIGUOUS_MODES:
+    switch (node.arrayMode().type()) {
+    case Array::Contiguous:
         callOperation(operationEnsureContiguous, tempGPR, baseReg);
         break;
-    case ALL_EFFECTFUL_ARRAY_STORAGE_MODES:
+    case Array::ArrayStorage:
+    case Array::SlowPutArrayStorage:
         callOperation(operationEnsureArrayStorage, tempGPR, baseReg);
         break;
     default:
@@ -555,41 +550,42 @@ void SpeculativeJIT::arrayify(Node& node, GPRReg baseReg, GPRReg propertyReg)
         break;
     }
     silentFillAllRegisters(tempGPR);
-
-    // Alas, we need to reload the structure because silent spilling does not save
-    // temporaries. Nor would it be useful for it to do so. Either way we're talking
-    // about a load.
-    m_jit.loadPtr(
-        MacroAssembler::Address(baseReg, JSCell::structureOffset()), structureGPR);
-    
-    // Finally, check that we have the kind of array storage that we wanted to get.
-    // Note that this is a backwards speculation check, which will result in the 
-    // bytecode operation corresponding to this arrayification being reexecuted.
-    // That's fine, since arrayification is not user-visible.
-    m_jit.load8(
-        MacroAssembler::Address(structureGPR, Structure::indexingTypeOffset()), structureGPR);
-    speculationCheck(
-        BadIndexingType, JSValueSource::unboxedCell(baseReg), NoNode,
-        jumpSlowForUnwantedArrayMode(structureGPR, desiredArrayMode));
+    
+    if (node.op() == ArrayifyToStructure) {
+        speculationCheck(
+            BadIndexingType, JSValueSource::unboxedCell(baseReg), NoNode,
+            m_jit.branchWeakPtr(
+                JITCompiler::NotEqual,
+                JITCompiler::Address(baseReg, JSCell::structureOffset()),
+                node.structure()));
+    } else {
+        // Alas, we need to reload the structure because silent spilling does not save
+        // temporaries. Nor would it be useful for it to do so. Either way we're talking
+        // about a load.
+        m_jit.loadPtr(
+            MacroAssembler::Address(baseReg, JSCell::structureOffset()), structureGPR);
+    
+        // Finally, check that we have the kind of array storage that we wanted to get.
+        // Note that this is a backwards speculation check, which will result in the 
+        // bytecode operation corresponding to this arrayification being reexecuted.
+        // That's fine, since arrayification is not user-visible.
+        m_jit.load8(
+            MacroAssembler::Address(structureGPR, Structure::indexingTypeOffset()), structureGPR);
+        speculationCheck(
+            BadIndexingType, JSValueSource::unboxedCell(baseReg), NoNode,
+            jumpSlowForUnwantedArrayMode(structureGPR, node.arrayMode()));
+    }
     
     done.link(&m_jit);
-    storageResult(tempGPR, m_compileIndex);
+    noResult(m_compileIndex);
 }
 
 void SpeculativeJIT::arrayify(Node& node)
 {
-    ASSERT(modeIsSpecific(node.arrayMode()));
+    ASSERT(node.arrayMode().isSpecific());
     
     SpeculateCellOperand base(this, node.child1());
     
-    if (modeAlreadyChecked(m_state.forNode(node.child1()), node.arrayMode())) {
-        GPRTemporary temp(this);
-        m_jit.loadPtr(
-            MacroAssembler::Address(base.gpr(), JSObject::butterflyOffset()), temp.gpr());
-        storageResult(temp.gpr(), m_compileIndex);
-        return;
-    }
-    
     if (!node.child2()) {
         arrayify(node, base.gpr(), InvalidGPRReg);
         return;
@@ -1803,7 +1799,6 @@ ValueRecovery SpeculativeJIT::computeValueRecoveryFor(const ValueSource& valueSo
 
 void SpeculativeJIT::compileGetCharCodeAt(Node& node)
 {
-    ASSERT(node.child3() == NoNode);
     SpeculateCellOperand string(this, node.child1());
     SpeculateStrictInt32Operand index(this, node.child2());
     StorageOperand storage(this, node.child3());
@@ -1812,12 +1807,7 @@ void SpeculativeJIT::compileGetCharCodeAt(Node& node)
     GPRReg indexReg = index.gpr();
     GPRReg storageReg = storage.gpr();
     
-    if (!isStringSpeculation(m_state.forNode(node.child1()).m_type)) {
-        ASSERT(!(at(node.child1()).prediction() & SpecString));
-        terminateSpeculativeExecution(Uncountable, JSValueRegs(), NoNode);
-        noResult(m_compileIndex);
-        return;
-    }
+    ASSERT(speculationChecked(m_state.forNode(node.child1()).m_type, SpecString));
 
     // unsigned comparison so we can filter out negative indices and indices that are too large
     speculationCheck(Uncountable, JSValueRegs(), NoNode, m_jit.branch32(MacroAssembler::AboveOrEqual, indexReg, MacroAssembler::Address(stringReg, JSString::offsetOfLength())));
@@ -1851,7 +1841,7 @@ void SpeculativeJIT::compileGetByValOnString(Node& node)
     GPRReg propertyReg = property.gpr();
     GPRReg storageReg = storage.gpr();
 
-    ASSERT(modeAlreadyChecked(m_state.forNode(node.child1()), Array::String));
+    ASSERT(ArrayMode(Array::String).alreadyChecked(m_state.forNode(node.child1())));
 
     // unsigned comparison so we can filter out negative indices and indices that are too large
     speculationCheck(Uncountable, JSValueRegs(), NoNode, m_jit.branch32(MacroAssembler::AboveOrEqual, propertyReg, MacroAssembler::Address(baseReg, JSString::offsetOfLength())));
@@ -2260,7 +2250,7 @@ void SpeculativeJIT::compileGetByValOnIntTypedArray(const TypedArrayDescriptor&
     GPRTemporary result(this);
     GPRReg resultReg = result.gpr();
 
-    ASSERT(modeAlreadyChecked(m_state.forNode(node.child1()), node.arrayMode()));
+    ASSERT(node.arrayMode().alreadyChecked(m_state.forNode(node.child1())));
 
     speculationCheck(
         Uncountable, JSValueRegs(), NoNode,
@@ -2410,7 +2400,7 @@ void SpeculativeJIT::compileGetByValOnFloatTypedArray(const TypedArrayDescriptor
     GPRReg propertyReg = property.gpr();
     GPRReg storageReg = storage.gpr();
 
-    ASSERT(modeAlreadyChecked(m_state.forNode(node.child1()), node.arrayMode()));
+    ASSERT(node.arrayMode().alreadyChecked(m_state.forNode(node.child1())));
 
     FPRTemporary result(this);
     FPRReg resultReg = result.fpr();
@@ -2426,7 +2416,7 @@ void SpeculativeJIT::compileGetByValOnFloatTypedArray(const TypedArrayDescriptor
     case 8: {
         m_jit.loadDouble(MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::TimesEight), resultReg);
         MacroAssembler::Jump notNaN = m_jit.branchDouble(MacroAssembler::DoubleEqual, resultReg, resultReg);
-        static const double NaN = std::numeric_limits<double>::quiet_NaN();
+        static const double NaN = QNaN;
         m_jit.loadDouble(&NaN, resultReg);
         notNaN.link(&m_jit);
         break;
@@ -2447,7 +2437,7 @@ void SpeculativeJIT::compilePutByValForFloatTypedArray(const TypedArrayDescripto
     
     SpeculateDoubleOperand valueOp(this, valueUse);
     
-    ASSERT_UNUSED(baseUse, modeAlreadyChecked(m_state.forNode(baseUse), node.arrayMode()));
+    ASSERT_UNUSED(baseUse, node.arrayMode().alreadyChecked(m_state.forNode(baseUse)));
     
     GPRTemporary result(this);
     
@@ -3230,7 +3220,7 @@ void SpeculativeJIT::compileGetIndexedPropertyStorage(Node& node)
     
     const TypedArrayDescriptor* descriptor = typedArrayDescriptor(node.arrayMode());
     
-    switch (node.arrayMode()) {
+    switch (node.arrayMode().type()) {
     case Array::String:
         m_jit.loadPtr(MacroAssembler::Address(baseReg, JSString::offsetOfValue()), storageReg);
         
@@ -3270,7 +3260,7 @@ void SpeculativeJIT::compileGetByValOnArguments(Node& node)
     if (!m_compileOkay)
         return;
   
-    ASSERT(modeAlreadyChecked(m_state.forNode(node.child1()), Array::Arguments));
+    ASSERT(ArrayMode(Array::Arguments).alreadyChecked(m_state.forNode(node.child1())));
     
     // Two really lame checks.
     speculationCheck(
@@ -3327,7 +3317,7 @@ void SpeculativeJIT::compileGetArgumentsLength(Node& node)
     if (!m_compileOkay)
         return;
     
-    ASSERT(modeAlreadyChecked(m_state.forNode(node.child1()), Array::Arguments));
+    ASSERT(ArrayMode(Array::Arguments).alreadyChecked(m_state.forNode(node.child1())));
     
     speculationCheck(
         Uncountable, JSValueSource(), NoNode,
@@ -3345,8 +3335,8 @@ void SpeculativeJIT::compileGetArrayLength(Node& node)
 {
     const TypedArrayDescriptor* descriptor = typedArrayDescriptor(node.arrayMode());
 
-    switch (node.arrayMode()) {
-    case ARRAY_WITH_CONTIGUOUS_MODES: {
+    switch (node.arrayMode().type()) {
+    case Array::Contiguous: {
         StorageOperand storage(this, node.child2());
         GPRTemporary result(this, storage);
         GPRReg storageReg = storage.gpr();
@@ -3356,8 +3346,8 @@ void SpeculativeJIT::compileGetArrayLength(Node& node)
         integerResult(resultReg, m_compileIndex);
         break;
     }
-    case ARRAY_WITH_ARRAY_STORAGE_MODES:
-    case ARRAY_EFFECTFUL_MODES: {
+    case Array::ArrayStorage:
+    case Array::SlowPutArrayStorage: {
         StorageOperand storage(this, node.child2());
         GPRTemporary result(this, storage);
         GPRReg storageReg = storage.gpr();
@@ -3542,7 +3532,7 @@ void SpeculativeJIT::compileReallocatePropertyStorage(Node& node)
     storageResult(scratchGPR2, m_compileIndex);
 }
 
-GPRReg SpeculativeJIT::temporaryRegisterForPutByVal(GPRTemporary& temporary, Array::Mode arrayMode)
+GPRReg SpeculativeJIT::temporaryRegisterForPutByVal(GPRTemporary& temporary, ArrayMode arrayMode)
 {
     if (!putByValWillNeedExtraRegister(arrayMode))
         return InvalidGPRReg;
diff --git a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h
index aadcdb06b..446ea7dbe 100644
--- a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h
+++ b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h
@@ -543,7 +543,7 @@ public:
             m_jit.move(valueOfJSConstantAsImm64(plan.nodeIndex()), plan.gpr());
             break;
         case SetDoubleConstant:
-            m_jit.move(Imm64(valueOfNumberConstant(plan.nodeIndex())), canTrample);
+            m_jit.move(Imm64(reinterpretDoubleToInt64(valueOfNumberConstant(plan.nodeIndex()))), canTrample);
             m_jit.move64ToDouble(canTrample, plan.fpr());
             break;
         case Load32PayloadBoxInt:
@@ -2270,47 +2270,15 @@ public:
     void compileAllocatePropertyStorage(Node&);
     void compileReallocatePropertyStorage(Node&);
     
-#if USE(JSVALUE64)
-    MacroAssembler::JumpList compileContiguousGetByVal(Node&, GPRReg baseReg, GPRReg propertyReg, GPRReg storageReg, GPRReg resultReg);
-    MacroAssembler::JumpList compileArrayStorageGetByVal(Node&, GPRReg baseReg, GPRReg propertyReg, GPRReg storageReg, GPRReg resultReg);
-#else
-    MacroAssembler::JumpList compileContiguousGetByVal(Node&, GPRReg baseReg, GPRReg propertyReg, GPRReg storageReg, GPRReg resultTagReg, GPRReg resultPayloadReg);
-    MacroAssembler::JumpList compileArrayStorageGetByVal(Node&, GPRReg baseReg, GPRReg propertyReg, GPRReg storageReg, GPRReg resultTagReg, GPRReg resultPayloadReg);
-#endif
-    
-    bool putByValWillNeedExtraRegister(Array::Mode arrayMode)
+    bool putByValWillNeedExtraRegister(ArrayMode arrayMode)
     {
-        switch (arrayMode) {
-        // For ArrayStorage, we need an extra reg for stores to holes except if
-        // we're in SlowPut mode.
-        case ARRAY_STORAGE_TO_HOLE_MODES:
-        case OUT_OF_BOUNDS_ARRAY_STORAGE_MODES:
-        case ALL_EFFECTFUL_ARRAY_STORAGE_MODES:
-            return true;
-            
-        // For Contiguous, we need an extra reg for any access that may store
-        // to the tail.
-        case CONTIGUOUS_TO_TAIL_MODES:
-        case OUT_OF_BOUNDS_CONTIGUOUS_MODES:
-        case ALL_EFFECTFUL_CONTIGUOUS_MODES:
-            return true;
-            
-        default:
-            return false;
-        }
+        return arrayMode.mayStoreToHole();
     }
-    GPRReg temporaryRegisterForPutByVal(GPRTemporary&, Array::Mode);
+    GPRReg temporaryRegisterForPutByVal(GPRTemporary&, ArrayMode);
     GPRReg temporaryRegisterForPutByVal(GPRTemporary& temporary, Node& node)
     {
         return temporaryRegisterForPutByVal(temporary, node.arrayMode());
     }
-#if USE(JSVALUE64)
-    MacroAssembler::JumpList compileContiguousPutByVal(Node&, GPRReg baseReg, GPRReg propertyReg, GPRReg storageReg, GPRReg valueReg, GPRReg tempReg);
-    MacroAssembler::JumpList compileArrayStoragePutByVal(Node&, GPRReg baseReg, GPRReg propertyReg, GPRReg storageReg, GPRReg valueReg, GPRReg tempReg);
-#else
-    MacroAssembler::JumpList compileContiguousPutByVal(Node&, GPRReg baseReg, GPRReg propertyReg, GPRReg storageReg, GPRReg valueTagReg, GPRReg valuePayloadReg);
-    MacroAssembler::JumpList compileArrayStoragePutByVal(Node&, GPRReg baseReg, GPRReg propertyReg, GPRReg storageReg, GPRReg valueTagReg, GPRReg valuePayloadReg);
-#endif
     
     void compileGetCharCodeAt(Node&);
     void compileGetByValOnString(Node&);
@@ -2445,9 +2413,9 @@ public:
     JumpReplacementWatchpoint* forwardSpeculationWatchpoint(ExitKind = UncountableWatchpoint);
     JumpReplacementWatchpoint* speculationWatchpointWithConditionalDirection(ExitKind, bool isForward);
     
-    const TypedArrayDescriptor* typedArrayDescriptor(Array::Mode);
+    const TypedArrayDescriptor* typedArrayDescriptor(ArrayMode);
     
-    JITCompiler::JumpList jumpSlowForUnwantedArrayMode(GPRReg tempWithIndexingTypeReg, Array::Mode arrayMode);
+    JITCompiler::JumpList jumpSlowForUnwantedArrayMode(GPRReg tempWithIndexingTypeReg, ArrayMode, bool invert = false);
     void checkArray(Node&);
     void arrayify(Node&, GPRReg baseReg, GPRReg propertyReg);
     void arrayify(Node&);
diff --git a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp
index ab089ba36..65fdf5593 100644
--- a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp
+++ b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp
@@ -2046,113 +2046,6 @@ void SpeculativeJIT::emitBranch(Node& node)
     }
 }
 
-MacroAssembler::JumpList SpeculativeJIT::compileContiguousGetByVal(Node&, GPRReg, GPRReg propertyReg, GPRReg storageReg, GPRReg resultTagReg, GPRReg resultPayloadReg)
-{
-    MacroAssembler::JumpList slowCases;
-    slowCases.append(m_jit.branch32(MacroAssembler::AboveOrEqual, propertyReg, MacroAssembler::Address(storageReg, Butterfly::offsetOfPublicLength())));
-    
-    m_jit.load32(MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::TimesEight, OBJECT_OFFSETOF(JSValue, u.asBits.tag)), resultTagReg);
-    m_jit.load32(MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::TimesEight, OBJECT_OFFSETOF(JSValue, u.asBits.payload)), resultPayloadReg);
-    slowCases.append(m_jit.branch32(MacroAssembler::Equal, resultTagReg, TrustedImm32(JSValue::EmptyValueTag)));
-    
-    return slowCases;
-}
-
-MacroAssembler::JumpList SpeculativeJIT::compileArrayStorageGetByVal(Node&, GPRReg, GPRReg propertyReg, GPRReg storageReg, GPRReg resultTagReg, GPRReg resultPayloadReg)
-{
-    MacroAssembler::Jump outOfBounds = m_jit.branch32(MacroAssembler::AboveOrEqual, propertyReg, MacroAssembler::Address(storageReg, ArrayStorage::vectorLengthOffset()));
-    
-    m_jit.load32(MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0]) + OBJECT_OFFSETOF(JSValue, u.asBits.tag)), resultTagReg);
-    m_jit.load32(MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0]) + OBJECT_OFFSETOF(JSValue, u.asBits.payload)), resultPayloadReg);
-    MacroAssembler::Jump hole = m_jit.branch32(MacroAssembler::Equal, resultTagReg, TrustedImm32(JSValue::EmptyValueTag));
-    
-    MacroAssembler::JumpList slowCases;
-    slowCases.append(outOfBounds);
-    slowCases.append(hole);
-    return slowCases;
-}
-
-MacroAssembler::JumpList SpeculativeJIT::compileContiguousPutByVal(Node& node, GPRReg, GPRReg propertyReg, GPRReg storageReg, GPRReg valueTagReg, GPRReg valuePayloadReg)
-{
-    Array::Mode arrayMode = node.arrayMode();
-    
-    MacroAssembler::JumpList slowCases;
-    
-    if (!mayStoreToTail(arrayMode)) {
-        speculationCheck(
-            Uncountable, JSValueRegs(), NoNode,
-            m_jit.branch32(MacroAssembler::AboveOrEqual, propertyReg, MacroAssembler::Address(storageReg, Butterfly::offsetOfPublicLength())));
-    } else {
-        MacroAssembler::Jump inBounds = m_jit.branch32(MacroAssembler::Below, propertyReg, MacroAssembler::Address(storageReg, Butterfly::offsetOfPublicLength()));
-
-        slowCases.append(m_jit.branch32(MacroAssembler::AboveOrEqual, propertyReg, MacroAssembler::Address(storageReg, Butterfly::offsetOfVectorLength())));
-        
-        if (isInBoundsAccess(arrayMode))
-            speculationCheck(Uncountable, JSValueRegs(), NoNode, slowCases);
-        
-        m_jit.add32(TrustedImm32(1), propertyReg);
-        m_jit.store32(propertyReg, MacroAssembler::Address(storageReg, Butterfly::offsetOfPublicLength()));
-        m_jit.sub32(TrustedImm32(1), propertyReg);
-
-        inBounds.link(&m_jit);
-    }
-
-    m_jit.store32(valueTagReg, MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::TimesEight, OBJECT_OFFSETOF(JSValue, u.asBits.tag)));
-    m_jit.store32(valuePayloadReg, MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::TimesEight, OBJECT_OFFSETOF(JSValue, u.asBits.payload)));
-    
-    if (isInBoundsAccess(arrayMode))
-        return MacroAssembler::JumpList();
-    return slowCases;
-}
-
-MacroAssembler::JumpList SpeculativeJIT::compileArrayStoragePutByVal(Node& node, GPRReg, GPRReg propertyReg, GPRReg storageReg, GPRReg valueTagReg, GPRReg valuePayloadReg)
-{
-    Array::Mode arrayMode = node.arrayMode();
-    
-    MacroAssembler::JumpList slowCases;
-    
-    MacroAssembler::Jump beyondArrayBounds = m_jit.branch32(MacroAssembler::AboveOrEqual, propertyReg, MacroAssembler::Address(storageReg, ArrayStorage::vectorLengthOffset()));
-    if (isInBoundsAccess(arrayMode))
-        speculationCheck(OutOfBounds, JSValueRegs(), NoNode, beyondArrayBounds);
-    else
-        slowCases.append(beyondArrayBounds);
-
-    // Check if we're writing to a hole; if so increment m_numValuesInVector.
-    if (!mayStoreToHole(arrayMode)) {
-        // This is uncountable because if we take this exit, then the baseline JIT
-        // will immediately count the hole store. So there is no need for exit
-        // profiling.
-        speculationCheck(
-            Uncountable, JSValueRegs(), NoNode,
-            m_jit.branch32(MacroAssembler::Equal, MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0]) + OBJECT_OFFSETOF(JSValue, u.asBits.tag)), TrustedImm32(JSValue::EmptyValueTag)));
-    } else {
-        MacroAssembler::Jump notHoleValue = m_jit.branch32(MacroAssembler::NotEqual, MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0]) + OBJECT_OFFSETOF(JSValue, u.asBits.tag)), TrustedImm32(JSValue::EmptyValueTag));
-        if (isSlowPutAccess(arrayMode)) {
-            // This is sort of strange. If we wanted to optimize this code path, we would invert
-            // the above branch. But it's simply not worth it since this only happens if we're
-            // already having a bad time.
-            slowCases.append(m_jit.jump());
-        } else {
-            m_jit.add32(TrustedImm32(1), MacroAssembler::Address(storageReg, ArrayStorage::numValuesInVectorOffset()));
-                
-            // If we're writing to a hole we might be growing the array; 
-            MacroAssembler::Jump lengthDoesNotNeedUpdate = m_jit.branch32(MacroAssembler::Below, propertyReg, MacroAssembler::Address(storageReg, ArrayStorage::lengthOffset()));
-            m_jit.add32(TrustedImm32(1), propertyReg);
-            m_jit.store32(propertyReg, MacroAssembler::Address(storageReg, ArrayStorage::lengthOffset()));
-            m_jit.sub32(TrustedImm32(1), propertyReg);
-                
-            lengthDoesNotNeedUpdate.link(&m_jit);
-        }
-        notHoleValue.link(&m_jit);
-    }
-    
-    // Store the value to the array.
-    m_jit.store32(valueTagReg, MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0]) + OBJECT_OFFSETOF(JSValue, u.asBits.tag)));
-    m_jit.store32(valuePayloadReg, MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0]) + OBJECT_OFFSETOF(JSValue, u.asBits.payload)));
-    
-    return slowCases;
-}
-
 void SpeculativeJIT::compile(Node& node)
 {
     NodeType op = node.op();
@@ -2646,13 +2539,14 @@ void SpeculativeJIT::compile(Node& node)
         break;
     }
         
-    case Arrayify: {
+    case Arrayify:
+    case ArrayifyToStructure: {
         arrayify(node);
         break;
     }
 
     case GetByVal: {
-        switch (node.arrayMode()) {
+        switch (node.arrayMode().type()) {
         case Array::SelectUsingPredictions:
         case Array::ForceExit:
             ASSERT_NOT_REACHED();
@@ -2673,29 +2567,28 @@ void SpeculativeJIT::compile(Node& node)
             jsValueResult(resultTag.gpr(), resultPayload.gpr(), m_compileIndex);
             break;
         }
-        case IN_BOUNDS_CONTIGUOUS_MODES: {
-            SpeculateStrictInt32Operand property(this, node.child2());
-            StorageOperand storage(this, node.child3());
+        case Array::Contiguous: {
+            if (node.arrayMode().isInBounds()) {
+                SpeculateStrictInt32Operand property(this, node.child2());
+                StorageOperand storage(this, node.child3());
             
-            GPRReg propertyReg = property.gpr();
-            GPRReg storageReg = storage.gpr();
+                GPRReg propertyReg = property.gpr();
+                GPRReg storageReg = storage.gpr();
             
-            if (!m_compileOkay)
-                return;
+                if (!m_compileOkay)
+                    return;
             
-            speculationCheck(OutOfBounds, JSValueRegs(), NoNode, m_jit.branch32(MacroAssembler::AboveOrEqual, propertyReg, MacroAssembler::Address(storageReg, Butterfly::offsetOfPublicLength())));
+                speculationCheck(OutOfBounds, JSValueRegs(), NoNode, m_jit.branch32(MacroAssembler::AboveOrEqual, propertyReg, MacroAssembler::Address(storageReg, Butterfly::offsetOfPublicLength())));
             
-            GPRTemporary resultTag(this);
-            GPRTemporary resultPayload(this);
-            m_jit.load32(MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::TimesEight, OBJECT_OFFSETOF(JSValue, u.asBits.tag)), resultTag.gpr());
-            speculationCheck(OutOfBounds, JSValueRegs(), NoNode, m_jit.branch32(MacroAssembler::Equal, resultTag.gpr(), TrustedImm32(JSValue::EmptyValueTag)));
-            m_jit.load32(MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::TimesEight, OBJECT_OFFSETOF(JSValue, u.asBits.payload)), resultPayload.gpr());
-            jsValueResult(resultTag.gpr(), resultPayload.gpr(), m_compileIndex);
-            break;
-        }
-        case CONTIGUOUS_TO_TAIL_MODES:
-        case OUT_OF_BOUNDS_CONTIGUOUS_MODES:
-        case ALL_EFFECTFUL_CONTIGUOUS_MODES: {
+                GPRTemporary resultTag(this);
+                GPRTemporary resultPayload(this);
+                m_jit.load32(MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::TimesEight, OBJECT_OFFSETOF(JSValue, u.asBits.tag)), resultTag.gpr());
+                speculationCheck(OutOfBounds, JSValueRegs(), NoNode, m_jit.branch32(MacroAssembler::Equal, resultTag.gpr(), TrustedImm32(JSValue::EmptyValueTag)));
+                m_jit.load32(MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::TimesEight, OBJECT_OFFSETOF(JSValue, u.asBits.payload)), resultPayload.gpr());
+                jsValueResult(resultTag.gpr(), resultPayload.gpr(), m_compileIndex);
+                break;
+            }
+
             SpeculateCellOperand base(this, node.child1());
             SpeculateStrictInt32Operand property(this, node.child2());
             StorageOperand storage(this, node.child3());
@@ -2712,8 +2605,14 @@ void SpeculativeJIT::compile(Node& node)
             GPRReg resultTagReg = resultTag.gpr();
             GPRReg resultPayloadReg = resultPayload.gpr();
             
-            MacroAssembler::JumpList slowCases =
-                compileContiguousGetByVal(node, baseReg, propertyReg, storageReg, resultTagReg, resultPayloadReg);
+            MacroAssembler::JumpList slowCases;
+
+            slowCases.append(m_jit.branch32(MacroAssembler::AboveOrEqual, propertyReg, MacroAssembler::Address(storageReg, Butterfly::offsetOfPublicLength())));
+            
+            m_jit.load32(MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::TimesEight, OBJECT_OFFSETOF(JSValue, u.asBits.tag)), resultTagReg);
+            m_jit.load32(MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::TimesEight, OBJECT_OFFSETOF(JSValue, u.asBits.payload)), resultPayloadReg);
+            slowCases.append(m_jit.branch32(MacroAssembler::Equal, resultTagReg, TrustedImm32(JSValue::EmptyValueTag)));
+            
             addSlowPathGenerator(
                 slowPathCall(
                     slowCases, this, operationGetByValArrayInt,
@@ -2722,30 +2621,30 @@ void SpeculativeJIT::compile(Node& node)
             jsValueResult(resultTagReg, resultPayloadReg, m_compileIndex);
             break;
         }
-        case IN_BOUNDS_ARRAY_STORAGE_MODES: {
-            SpeculateStrictInt32Operand property(this, node.child2());
-            StorageOperand storage(this, node.child3());
-            GPRReg propertyReg = property.gpr();
-            GPRReg storageReg = storage.gpr();
+        case Array::ArrayStorage:
+        case Array::SlowPutArrayStorage: {
+            if (node.arrayMode().isInBounds()) {
+                SpeculateStrictInt32Operand property(this, node.child2());
+                StorageOperand storage(this, node.child3());
+                GPRReg propertyReg = property.gpr();
+                GPRReg storageReg = storage.gpr();
         
-            if (!m_compileOkay)
-                return;
+                if (!m_compileOkay)
+                    return;
 
-            speculationCheck(OutOfBounds, JSValueRegs(), NoNode, m_jit.branch32(MacroAssembler::AboveOrEqual, propertyReg, MacroAssembler::Address(storageReg, ArrayStorage::vectorLengthOffset())));
+                speculationCheck(OutOfBounds, JSValueRegs(), NoNode, m_jit.branch32(MacroAssembler::AboveOrEqual, propertyReg, MacroAssembler::Address(storageReg, ArrayStorage::vectorLengthOffset())));
 
-            GPRTemporary resultTag(this);
-            GPRTemporary resultPayload(this);
+                GPRTemporary resultTag(this);
+                GPRTemporary resultPayload(this);
 
-            m_jit.load32(MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0]) + OBJECT_OFFSETOF(JSValue, u.asBits.tag)), resultTag.gpr());
-            speculationCheck(OutOfBounds, JSValueRegs(), NoNode, m_jit.branch32(MacroAssembler::Equal, resultTag.gpr(), TrustedImm32(JSValue::EmptyValueTag)));
-            m_jit.load32(MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0]) + OBJECT_OFFSETOF(JSValue, u.asBits.payload)), resultPayload.gpr());
+                m_jit.load32(MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0]) + OBJECT_OFFSETOF(JSValue, u.asBits.tag)), resultTag.gpr());
+                speculationCheck(OutOfBounds, JSValueRegs(), NoNode, m_jit.branch32(MacroAssembler::Equal, resultTag.gpr(), TrustedImm32(JSValue::EmptyValueTag)));
+                m_jit.load32(MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0]) + OBJECT_OFFSETOF(JSValue, u.asBits.payload)), resultPayload.gpr());
             
-            jsValueResult(resultTag.gpr(), resultPayload.gpr(), m_compileIndex);
-            break;
-        }
-        case OUT_OF_BOUNDS_ARRAY_STORAGE_MODES:
-        case SLOW_PUT_ARRAY_STORAGE_MODES:
-        case ALL_EFFECTFUL_ARRAY_STORAGE_MODES: {
+                jsValueResult(resultTag.gpr(), resultPayload.gpr(), m_compileIndex);
+                break;
+            }
+
             SpeculateCellOperand base(this, node.child1());
             SpeculateStrictInt32Operand property(this, node.child2());
             StorageOperand storage(this, node.child3());
@@ -2829,10 +2728,10 @@ void SpeculativeJIT::compile(Node& node)
         Edge child3 = m_jit.graph().varArgChild(node, 2);
         Edge child4 = m_jit.graph().varArgChild(node, 3);
         
-        Array::Mode arrayMode = modeForPut(node.arrayMode());
+        ArrayMode arrayMode = node.arrayMode().modeForPut();
         bool alreadyHandled = false;
         
-        switch (arrayMode) {
+        switch (arrayMode.type()) {
         case Array::SelectUsingPredictions:
         case Array::ForceExit:
             ASSERT_NOT_REACHED();
@@ -2871,9 +2770,8 @@ void SpeculativeJIT::compile(Node& node)
         GPRReg baseReg = base.gpr();
         GPRReg propertyReg = property.gpr();
 
-        switch (arrayMode) {
-        case ALL_CONTIGUOUS_MODES:
-        case ALL_EFFECTFUL_CONTIGUOUS_MODES: {
+        switch (arrayMode.type()) {
+        case Array::Contiguous: {
             JSValueOperand value(this, child3);
 
             GPRReg valueTagReg = value.tagGPR();
@@ -2900,16 +2798,36 @@ void SpeculativeJIT::compile(Node& node)
                 break;
             }
             
-            MacroAssembler::JumpList slowCases =
-                compileContiguousPutByVal(
-                    node, baseReg, propertyReg, storageReg, valueTagReg, valuePayloadReg);
+            MacroAssembler::JumpList slowCases;
 
+            if (arrayMode.isInBounds()) {
+                speculationCheck(
+                    Uncountable, JSValueRegs(), NoNode,
+                    m_jit.branch32(MacroAssembler::AboveOrEqual, propertyReg, MacroAssembler::Address(storageReg, Butterfly::offsetOfPublicLength())));
+            } else {
+                MacroAssembler::Jump inBounds = m_jit.branch32(MacroAssembler::Below, propertyReg, MacroAssembler::Address(storageReg, Butterfly::offsetOfPublicLength()));
+                
+                slowCases.append(m_jit.branch32(MacroAssembler::AboveOrEqual, propertyReg, MacroAssembler::Address(storageReg, Butterfly::offsetOfVectorLength())));
+                
+                if (!arrayMode.isOutOfBounds())
+                    speculationCheck(Uncountable, JSValueRegs(), NoNode, slowCases);
+                
+                m_jit.add32(TrustedImm32(1), propertyReg);
+                m_jit.store32(propertyReg, MacroAssembler::Address(storageReg, Butterfly::offsetOfPublicLength()));
+                m_jit.sub32(TrustedImm32(1), propertyReg);
+                
+                inBounds.link(&m_jit);
+            }
+            
+            m_jit.store32(valueTagReg, MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::TimesEight, OBJECT_OFFSETOF(JSValue, u.asBits.tag)));
+            m_jit.store32(valuePayloadReg, MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::TimesEight, OBJECT_OFFSETOF(JSValue, u.asBits.payload)));
+            
             base.use();
             property.use();
             value.use();
             storage.use();
             
-            if (!slowCases.empty()) {
+            if (arrayMode.isOutOfBounds()) {
                 addSlowPathGenerator(
                     slowPathCall(
                         slowCases, this,
@@ -2921,8 +2839,8 @@ void SpeculativeJIT::compile(Node& node)
             break;
         }
             
-        case ALL_ARRAY_STORAGE_MODES:
-        case ALL_EFFECTFUL_ARRAY_STORAGE_MODES: {
+        case Array::ArrayStorage:
+        case Array::SlowPutArrayStorage: {
             JSValueOperand value(this, child3);
 
             GPRReg valueTagReg = value.tagGPR();
@@ -2950,9 +2868,46 @@ void SpeculativeJIT::compile(Node& node)
                 break;
             }
 
-            MacroAssembler::JumpList slowCases =
-                compileArrayStoragePutByVal(
-                    node, baseReg, propertyReg, storageReg, valueTagReg, valuePayloadReg);
+            MacroAssembler::JumpList slowCases;
+
+            MacroAssembler::Jump beyondArrayBounds = m_jit.branch32(MacroAssembler::AboveOrEqual, propertyReg, MacroAssembler::Address(storageReg, ArrayStorage::vectorLengthOffset()));
+            if (!arrayMode.isOutOfBounds())
+                speculationCheck(OutOfBounds, JSValueRegs(), NoNode, beyondArrayBounds);
+            else
+                slowCases.append(beyondArrayBounds);
+
+            // Check if we're writing to a hole; if so increment m_numValuesInVector.
+            if (arrayMode.isInBounds()) {
+                // This is uncountable because if we take this exit, then the baseline JIT
+                // will immediately count the hole store. So there is no need for exit
+                // profiling.
+                speculationCheck(
+                    Uncountable, JSValueRegs(), NoNode,
+                    m_jit.branch32(MacroAssembler::Equal, MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0]) + OBJECT_OFFSETOF(JSValue, u.asBits.tag)), TrustedImm32(JSValue::EmptyValueTag)));
+            } else {
+                MacroAssembler::Jump notHoleValue = m_jit.branch32(MacroAssembler::NotEqual, MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0]) + OBJECT_OFFSETOF(JSValue, u.asBits.tag)), TrustedImm32(JSValue::EmptyValueTag));
+                if (arrayMode.isSlowPut()) {
+                    // This is sort of strange. If we wanted to optimize this code path, we would invert
+                    // the above branch. But it's simply not worth it since this only happens if we're
+                    // already having a bad time.
+                    slowCases.append(m_jit.jump());
+                } else {
+                    m_jit.add32(TrustedImm32(1), MacroAssembler::Address(storageReg, ArrayStorage::numValuesInVectorOffset()));
+                
+                    // If we're writing to a hole we might be growing the array; 
+                    MacroAssembler::Jump lengthDoesNotNeedUpdate = m_jit.branch32(MacroAssembler::Below, propertyReg, MacroAssembler::Address(storageReg, ArrayStorage::lengthOffset()));
+                    m_jit.add32(TrustedImm32(1), propertyReg);
+                    m_jit.store32(propertyReg, MacroAssembler::Address(storageReg, ArrayStorage::lengthOffset()));
+                    m_jit.sub32(TrustedImm32(1), propertyReg);
+                
+                    lengthDoesNotNeedUpdate.link(&m_jit);
+                }
+                notHoleValue.link(&m_jit);
+            }
+    
+            // Store the value to the array.
+            m_jit.store32(valueTagReg, MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0]) + OBJECT_OFFSETOF(JSValue, u.asBits.tag)));
+            m_jit.store32(valuePayloadReg, MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0]) + OBJECT_OFFSETOF(JSValue, u.asBits.payload)));
 
             base.use();
             property.use();
@@ -3070,7 +3025,7 @@ void SpeculativeJIT::compile(Node& node)
     }
         
     case ArrayPush: {
-        ASSERT(modeIsJSArray(node.arrayMode()));
+        ASSERT(node.arrayMode().isJSArray());
         
         SpeculateCellOperand base(this, node.child1());
         JSValueOperand value(this, node.child2());
@@ -3089,9 +3044,8 @@ void SpeculativeJIT::compile(Node& node)
         StorageOperand storage(this, node.child3());
         GPRReg storageGPR = storage.gpr();
         
-        switch (node.arrayMode()) {
-        case Array::ArrayWithContiguous:
-        case Array::ArrayWithContiguousOutOfBounds: {
+        switch (node.arrayMode().type()) {
+        case Array::Contiguous: {
             m_jit.load32(MacroAssembler::Address(storageGPR, Butterfly::offsetOfPublicLength()), storageLengthGPR);
             MacroAssembler::Jump slowPath = m_jit.branch32(MacroAssembler::AboveOrEqual, storageLengthGPR, MacroAssembler::Address(storageGPR, Butterfly::offsetOfVectorLength()));
             m_jit.store32(valueTagGPR, MacroAssembler::BaseIndex(storageGPR, storageLengthGPR, MacroAssembler::TimesEight, OBJECT_OFFSETOF(JSValue, u.asBits.tag)));
@@ -3110,8 +3064,7 @@ void SpeculativeJIT::compile(Node& node)
             break;
         }
             
-        case Array::ArrayWithArrayStorage:
-        case Array::ArrayWithArrayStorageOutOfBounds: {
+        case Array::ArrayStorage: {
             m_jit.load32(MacroAssembler::Address(storageGPR, ArrayStorage::lengthOffset()), storageLengthGPR);
         
             // Refuse to handle bizarre lengths.
@@ -3141,7 +3094,7 @@ void SpeculativeJIT::compile(Node& node)
     }
         
     case ArrayPop: {
-        ASSERT(modeIsJSArray(node.arrayMode()));
+        ASSERT(node.arrayMode().isJSArray());
         
         SpeculateCellOperand base(this, node.child1());
         StorageOperand storage(this, node.child2());
@@ -3153,9 +3106,8 @@ void SpeculativeJIT::compile(Node& node)
         GPRReg valuePayloadGPR = valuePayload.gpr();
         GPRReg storageGPR = storage.gpr();
         
-        switch (node.arrayMode()) {
-        case Array::ArrayWithContiguous:
-        case Array::ArrayWithContiguousOutOfBounds: {
+        switch (node.arrayMode().type()) {
+        case Array::Contiguous: {
             m_jit.load32(
                 MacroAssembler::Address(storageGPR, Butterfly::offsetOfPublicLength()), valuePayloadGPR);
             MacroAssembler::Jump undefinedCase =
@@ -3188,8 +3140,7 @@ void SpeculativeJIT::compile(Node& node)
             break;
         }
             
-        case Array::ArrayWithArrayStorage:
-        case Array::ArrayWithArrayStorageOutOfBounds: {
+        case Array::ArrayStorage: {
             GPRTemporary storageLength(this);
             GPRReg storageLengthGPR = storageLength.gpr();
 
diff --git a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp
index f11fd1663..6c066c388 100644
--- a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp
+++ b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp
@@ -2111,107 +2111,6 @@ void SpeculativeJIT::emitBranch(Node& node)
     }
 }
 
-MacroAssembler::JumpList SpeculativeJIT::compileContiguousGetByVal(Node&, GPRReg, GPRReg propertyReg, GPRReg storageReg, GPRReg resultReg)
-{
-    MacroAssembler::JumpList slowCases;
-    slowCases.append(m_jit.branch32(MacroAssembler::AboveOrEqual, propertyReg, MacroAssembler::Address(storageReg, Butterfly::offsetOfPublicLength())));
-    
-    m_jit.load64(MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::TimesEight), resultReg);
-    slowCases.append(m_jit.branchTest64(MacroAssembler::Zero, resultReg));
-    
-    return slowCases;
-}
-
-MacroAssembler::JumpList SpeculativeJIT::compileArrayStorageGetByVal(Node&, GPRReg, GPRReg propertyReg, GPRReg storageReg, GPRReg resultReg)
-{
-    MacroAssembler::Jump outOfBounds = m_jit.branch32(MacroAssembler::AboveOrEqual, propertyReg, MacroAssembler::Address(storageReg, ArrayStorage::vectorLengthOffset()));
-    
-    m_jit.load64(MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0])), resultReg);
-    MacroAssembler::Jump hole = m_jit.branchTest64(MacroAssembler::Zero, resultReg);
-    
-    MacroAssembler::JumpList slowCases;
-    slowCases.append(outOfBounds);
-    slowCases.append(hole);
-    return slowCases;
-}
-
-MacroAssembler::JumpList SpeculativeJIT::compileContiguousPutByVal(Node& node, GPRReg, GPRReg propertyReg, GPRReg storageReg, GPRReg valueReg, GPRReg tempReg)
-{
-    Array::Mode arrayMode = node.arrayMode();
-    
-    MacroAssembler::JumpList slowCases;
-    
-    if (!mayStoreToTail(arrayMode)) {
-        speculationCheck(
-            Uncountable, JSValueRegs(), NoNode,
-            m_jit.branch32(MacroAssembler::AboveOrEqual, propertyReg, MacroAssembler::Address(storageReg, Butterfly::offsetOfPublicLength())));
-    } else {
-        MacroAssembler::Jump inBounds = m_jit.branch32(MacroAssembler::Below, propertyReg, MacroAssembler::Address(storageReg, Butterfly::offsetOfPublicLength()));
-
-        slowCases.append(m_jit.branch32(MacroAssembler::AboveOrEqual, propertyReg, MacroAssembler::Address(storageReg, Butterfly::offsetOfVectorLength())));
-        
-        if (isInBoundsAccess(arrayMode))
-            speculationCheck(Uncountable, JSValueRegs(), NoNode, slowCases);
-        
-        m_jit.add32(TrustedImm32(1), propertyReg, tempReg);
-        m_jit.store32(tempReg, MacroAssembler::Address(storageReg, Butterfly::offsetOfPublicLength()));
-
-        inBounds.link(&m_jit);
-    }
-
-    m_jit.store64(valueReg, MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::TimesEight));
-    
-    if (isInBoundsAccess(arrayMode))
-        return MacroAssembler::JumpList();
-    return slowCases;
-}
-
-MacroAssembler::JumpList SpeculativeJIT::compileArrayStoragePutByVal(Node& node, GPRReg, GPRReg propertyReg, GPRReg storageReg, GPRReg valueReg, GPRReg tempReg)
-{
-    Array::Mode arrayMode = node.arrayMode();
-    
-    MacroAssembler::JumpList slowCases;
-    
-    MacroAssembler::Jump beyondArrayBounds = m_jit.branch32(MacroAssembler::AboveOrEqual, propertyReg, MacroAssembler::Address(storageReg, ArrayStorage::vectorLengthOffset()));
-    if (isInBoundsAccess(arrayMode))
-        speculationCheck(OutOfBounds, JSValueRegs(), NoNode, beyondArrayBounds);
-    else
-        slowCases.append(beyondArrayBounds);
-
-    // Check if we're writing to a hole; if so increment m_numValuesInVector.
-    if (!mayStoreToHole(arrayMode)) {
-        // This is uncountable because if we take this exit, then the baseline JIT
-        // will immediately count the hole store. So there is no need for exit
-        // profiling.
-        speculationCheck(
-            Uncountable, JSValueRegs(), NoNode,
-            m_jit.branchTest64(MacroAssembler::Zero, MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0]))));
-    } else {
-        MacroAssembler::Jump notHoleValue = m_jit.branchTest64(MacroAssembler::NonZero, MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0])));
-        if (isSlowPutAccess(arrayMode)) {
-            // This is sort of strange. If we wanted to optimize this code path, we would invert
-            // the above branch. But it's simply not worth it since this only happens if we're
-            // already having a bad time.
-            slowCases.append(m_jit.jump());
-        } else {
-            m_jit.add32(TrustedImm32(1), MacroAssembler::Address(storageReg, ArrayStorage::numValuesInVectorOffset()));
-                
-            // If we're writing to a hole we might be growing the array; 
-            MacroAssembler::Jump lengthDoesNotNeedUpdate = m_jit.branch32(MacroAssembler::Below, propertyReg, MacroAssembler::Address(storageReg, ArrayStorage::lengthOffset()));
-            m_jit.add32(TrustedImm32(1), propertyReg, tempReg);
-            m_jit.store32(tempReg, MacroAssembler::Address(storageReg, ArrayStorage::lengthOffset()));
-                
-            lengthDoesNotNeedUpdate.link(&m_jit);
-        }
-        notHoleValue.link(&m_jit);
-    }
-    
-    // Store the value to the array.
-    m_jit.store64(valueReg, MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0])));
-    
-    return slowCases;
-}
-
 void SpeculativeJIT::compile(Node& node)
 {
     NodeType op = node.op();
@@ -2673,13 +2572,14 @@ void SpeculativeJIT::compile(Node& node)
         break;
     }
         
-    case Arrayify: {
+    case Arrayify:
+    case ArrayifyToStructure: {
         arrayify(node);
         break;
     }
 
     case GetByVal: {
-        switch (node.arrayMode()) {
+        switch (node.arrayMode().type()) {
         case Array::SelectUsingPredictions:
         case Array::ForceExit:
             ASSERT_NOT_REACHED();
@@ -2698,27 +2598,26 @@ void SpeculativeJIT::compile(Node& node)
             jsValueResult(result.gpr(), m_compileIndex);
             break;
         }
-        case IN_BOUNDS_CONTIGUOUS_MODES: {
-            SpeculateStrictInt32Operand property(this, node.child2());
-            StorageOperand storage(this, node.child3());
-            
-            GPRReg propertyReg = property.gpr();
-            GPRReg storageReg = storage.gpr();
-            
-            if (!m_compileOkay)
-                return;
-            
-            speculationCheck(OutOfBounds, JSValueRegs(), NoNode, m_jit.branch32(MacroAssembler::AboveOrEqual, propertyReg, MacroAssembler::Address(storageReg, Butterfly::offsetOfPublicLength())));
+        case Array::Contiguous: {
+            if (node.arrayMode().isInBounds()) {
+                SpeculateStrictInt32Operand property(this, node.child2());
+                StorageOperand storage(this, node.child3());
+                
+                GPRReg propertyReg = property.gpr();
+                GPRReg storageReg = storage.gpr();
+                
+                if (!m_compileOkay)
+                    return;
+                
+                speculationCheck(OutOfBounds, JSValueRegs(), NoNode, m_jit.branch32(MacroAssembler::AboveOrEqual, propertyReg, MacroAssembler::Address(storageReg, Butterfly::offsetOfPublicLength())));
+                
+                GPRTemporary result(this);
+                m_jit.load64(MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::TimesEight), result.gpr());
+                speculationCheck(OutOfBounds, JSValueRegs(), NoNode, m_jit.branchTest64(MacroAssembler::Zero, result.gpr()));
+                jsValueResult(result.gpr(), m_compileIndex);
+                break;
+            }
             
-            GPRTemporary result(this);
-            m_jit.load64(MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::TimesEight), result.gpr());
-            speculationCheck(OutOfBounds, JSValueRegs(), NoNode, m_jit.branchTest64(MacroAssembler::Zero, result.gpr()));
-            jsValueResult(result.gpr(), m_compileIndex);
-            break;
-        }
-        case CONTIGUOUS_TO_TAIL_MODES:
-        case OUT_OF_BOUNDS_CONTIGUOUS_MODES:
-        case ALL_EFFECTFUL_CONTIGUOUS_MODES: {
             SpeculateCellOperand base(this, node.child1());
             SpeculateStrictInt32Operand property(this, node.child2());
             StorageOperand storage(this, node.child3());
@@ -2733,8 +2632,13 @@ void SpeculativeJIT::compile(Node& node)
             GPRTemporary result(this);
             GPRReg resultReg = result.gpr();
             
-            MacroAssembler::JumpList slowCases =
-                compileContiguousGetByVal(node, baseReg, propertyReg, storageReg, resultReg);
+            MacroAssembler::JumpList slowCases;
+            
+            slowCases.append(m_jit.branch32(MacroAssembler::AboveOrEqual, propertyReg, MacroAssembler::Address(storageReg, Butterfly::offsetOfPublicLength())));
+            
+            m_jit.load64(MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::TimesEight), resultReg);
+            slowCases.append(m_jit.branchTest64(MacroAssembler::Zero, resultReg));
+            
             addSlowPathGenerator(
                 slowPathCall(
                     slowCases, this, operationGetByValArrayInt,
@@ -2743,28 +2647,28 @@ void SpeculativeJIT::compile(Node& node)
             jsValueResult(resultReg, m_compileIndex);
             break;
         }
-        case IN_BOUNDS_ARRAY_STORAGE_MODES: {
-            SpeculateStrictInt32Operand property(this, node.child2());
-            StorageOperand storage(this, node.child3());
+        case Array::ArrayStorage:
+        case Array::SlowPutArrayStorage: {
+            if (node.arrayMode().isInBounds()) {
+                SpeculateStrictInt32Operand property(this, node.child2());
+                StorageOperand storage(this, node.child3());
             
-            GPRReg propertyReg = property.gpr();
-            GPRReg storageReg = storage.gpr();
+                GPRReg propertyReg = property.gpr();
+                GPRReg storageReg = storage.gpr();
             
-            if (!m_compileOkay)
-                return;
+                if (!m_compileOkay)
+                    return;
             
-            speculationCheck(OutOfBounds, JSValueRegs(), NoNode, m_jit.branch32(MacroAssembler::AboveOrEqual, propertyReg, MacroAssembler::Address(storageReg, ArrayStorage::vectorLengthOffset())));
+                speculationCheck(OutOfBounds, JSValueRegs(), NoNode, m_jit.branch32(MacroAssembler::AboveOrEqual, propertyReg, MacroAssembler::Address(storageReg, ArrayStorage::vectorLengthOffset())));
             
-            GPRTemporary result(this);
-            m_jit.load64(MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0])), result.gpr());
-            speculationCheck(OutOfBounds, JSValueRegs(), NoNode, m_jit.branchTest64(MacroAssembler::Zero, result.gpr()));
+                GPRTemporary result(this);
+                m_jit.load64(MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0])), result.gpr());
+                speculationCheck(OutOfBounds, JSValueRegs(), NoNode, m_jit.branchTest64(MacroAssembler::Zero, result.gpr()));
             
-            jsValueResult(result.gpr(), m_compileIndex);
-            break;
-        }
-        case OUT_OF_BOUNDS_ARRAY_STORAGE_MODES:
-        case SLOW_PUT_ARRAY_STORAGE_MODES:
-        case ALL_EFFECTFUL_ARRAY_STORAGE_MODES: {
+                jsValueResult(result.gpr(), m_compileIndex);
+                break;
+            }
+
             SpeculateCellOperand base(this, node.child1());
             SpeculateStrictInt32Operand property(this, node.child2());
             StorageOperand storage(this, node.child3());
@@ -2779,8 +2683,13 @@ void SpeculativeJIT::compile(Node& node)
             GPRTemporary result(this);
             GPRReg resultReg = result.gpr();
             
-            MacroAssembler::JumpList slowCases =
-                compileArrayStorageGetByVal(node, baseReg, propertyReg, storageReg, resultReg);
+            MacroAssembler::JumpList slowCases;
+            
+            slowCases.append(m_jit.branch32(MacroAssembler::AboveOrEqual, propertyReg, MacroAssembler::Address(storageReg, ArrayStorage::vectorLengthOffset())));
+    
+            m_jit.load64(MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0])), resultReg);
+            slowCases.append(m_jit.branchTest64(MacroAssembler::Zero, resultReg));
+    
             addSlowPathGenerator(
                 slowPathCall(
                     slowCases, this, operationGetByValArrayInt,
@@ -2836,10 +2745,10 @@ void SpeculativeJIT::compile(Node& node)
         Edge child3 = m_jit.graph().varArgChild(node, 2);
         Edge child4 = m_jit.graph().varArgChild(node, 3);
         
-        Array::Mode arrayMode = modeForPut(node.arrayMode());
+        ArrayMode arrayMode = node.arrayMode().modeForPut();
         bool alreadyHandled = false;
         
-        switch (arrayMode) {
+        switch (arrayMode.type()) {
         case Array::SelectUsingPredictions:
         case Array::ForceExit:
             ASSERT_NOT_REACHED();
@@ -2879,9 +2788,8 @@ void SpeculativeJIT::compile(Node& node)
         GPRReg baseReg = base.gpr();
         GPRReg propertyReg = property.gpr();
 
-        switch (arrayMode) {
-        case ALL_CONTIGUOUS_MODES:
-        case ALL_EFFECTFUL_CONTIGUOUS_MODES: {
+        switch (arrayMode.type()) {
+        case Array::Contiguous: {
             JSValueOperand value(this, child3);
 
             GPRReg valueReg = value.gpr();
@@ -2910,16 +2818,34 @@ void SpeculativeJIT::compile(Node& node)
             GPRTemporary temporary;
             GPRReg temporaryReg = temporaryRegisterForPutByVal(temporary, node);
 
-            MacroAssembler::JumpList slowCases =
-                compileContiguousPutByVal(
-                    node, baseReg, propertyReg, storageReg, valueReg, temporaryReg);
+            MacroAssembler::JumpList slowCases;
+            
+            if (arrayMode.isInBounds()) {
+                speculationCheck(
+                    Uncountable, JSValueRegs(), NoNode,
+                    m_jit.branch32(MacroAssembler::AboveOrEqual, propertyReg, MacroAssembler::Address(storageReg, Butterfly::offsetOfPublicLength())));
+            } else {
+                MacroAssembler::Jump inBounds = m_jit.branch32(MacroAssembler::Below, propertyReg, MacroAssembler::Address(storageReg, Butterfly::offsetOfPublicLength()));
+                
+                slowCases.append(m_jit.branch32(MacroAssembler::AboveOrEqual, propertyReg, MacroAssembler::Address(storageReg, Butterfly::offsetOfVectorLength())));
+                
+                if (!arrayMode.isOutOfBounds())
+                    speculationCheck(Uncountable, JSValueRegs(), NoNode, slowCases);
+                
+                m_jit.add32(TrustedImm32(1), propertyReg, temporaryReg);
+                m_jit.store32(temporaryReg, MacroAssembler::Address(storageReg, Butterfly::offsetOfPublicLength()));
+                
+                inBounds.link(&m_jit);
+            }
+            
+            m_jit.store64(valueReg, MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::TimesEight));
 
             base.use();
             property.use();
             value.use();
             storage.use();
             
-            if (!slowCases.empty()) {
+            if (arrayMode.isOutOfBounds()) {
                 addSlowPathGenerator(
                     slowPathCall(
                         slowCases, this,
@@ -2931,8 +2857,8 @@ void SpeculativeJIT::compile(Node& node)
             break;
         }
             
-        case ALL_ARRAY_STORAGE_MODES:
-        case ALL_EFFECTFUL_ARRAY_STORAGE_MODES: {
+        case Array::ArrayStorage:
+        case Array::SlowPutArrayStorage: {
             JSValueOperand value(this, child3);
 
             GPRReg valueReg = value.gpr();
@@ -2961,9 +2887,44 @@ void SpeculativeJIT::compile(Node& node)
             GPRTemporary temporary;
             GPRReg temporaryReg = temporaryRegisterForPutByVal(temporary, node);
 
-            MacroAssembler::JumpList slowCases =
-                compileArrayStoragePutByVal(
-                    node, baseReg, propertyReg, storageReg, valueReg, temporaryReg);
+            MacroAssembler::JumpList slowCases;
+
+            MacroAssembler::Jump beyondArrayBounds = m_jit.branch32(MacroAssembler::AboveOrEqual, propertyReg, MacroAssembler::Address(storageReg, ArrayStorage::vectorLengthOffset()));
+            if (!arrayMode.isOutOfBounds())
+                speculationCheck(OutOfBounds, JSValueRegs(), NoNode, beyondArrayBounds);
+            else
+                slowCases.append(beyondArrayBounds);
+
+            // Check if we're writing to a hole; if so increment m_numValuesInVector.
+            if (arrayMode.isInBounds()) {
+                // This is uncountable because if we take this exit, then the baseline JIT
+                // will immediately count the hole store. So there is no need for exit
+                // profiling.
+                speculationCheck(
+                    Uncountable, JSValueRegs(), NoNode,
+                    m_jit.branchTest64(MacroAssembler::Zero, MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0]))));
+            } else {
+                MacroAssembler::Jump notHoleValue = m_jit.branchTest64(MacroAssembler::NonZero, MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0])));
+                if (arrayMode.isSlowPut()) {
+                    // This is sort of strange. If we wanted to optimize this code path, we would invert
+                    // the above branch. But it's simply not worth it since this only happens if we're
+                    // already having a bad time.
+                    slowCases.append(m_jit.jump());
+                } else {
+                    m_jit.add32(TrustedImm32(1), MacroAssembler::Address(storageReg, ArrayStorage::numValuesInVectorOffset()));
+                
+                    // If we're writing to a hole we might be growing the array; 
+                    MacroAssembler::Jump lengthDoesNotNeedUpdate = m_jit.branch32(MacroAssembler::Below, propertyReg, MacroAssembler::Address(storageReg, ArrayStorage::lengthOffset()));
+                    m_jit.add32(TrustedImm32(1), propertyReg, temporaryReg);
+                    m_jit.store32(temporaryReg, MacroAssembler::Address(storageReg, ArrayStorage::lengthOffset()));
+                
+                    lengthDoesNotNeedUpdate.link(&m_jit);
+                }
+                notHoleValue.link(&m_jit);
+            }
+    
+            // Store the value to the array.
+            m_jit.store64(valueReg, MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0])));
 
             base.use();
             property.use();
@@ -3117,7 +3078,7 @@ void SpeculativeJIT::compile(Node& node)
     }
         
     case ArrayPush: {
-        ASSERT(modeIsJSArray(node.arrayMode()));
+        ASSERT(node.arrayMode().isJSArray());
         
         SpeculateCellOperand base(this, node.child1());
         JSValueOperand value(this, node.child2());
@@ -3135,9 +3096,8 @@ void SpeculativeJIT::compile(Node& node)
         StorageOperand storage(this, node.child3());
         GPRReg storageGPR = storage.gpr();
 
-        switch (node.arrayMode()) {
-        case Array::ArrayWithContiguous:
-        case Array::ArrayWithContiguousOutOfBounds: {
+        switch (node.arrayMode().type()) {
+        case Array::Contiguous: {
             m_jit.load32(MacroAssembler::Address(storageGPR, Butterfly::offsetOfPublicLength()), storageLengthGPR);
             MacroAssembler::Jump slowPath = m_jit.branch32(MacroAssembler::AboveOrEqual, storageLengthGPR, MacroAssembler::Address(storageGPR, Butterfly::offsetOfVectorLength()));
             m_jit.store64(valueGPR, MacroAssembler::BaseIndex(storageGPR, storageLengthGPR, MacroAssembler::TimesEight));
@@ -3154,8 +3114,7 @@ void SpeculativeJIT::compile(Node& node)
             break;
         }
             
-        case Array::ArrayWithArrayStorage:
-        case Array::ArrayWithArrayStorageOutOfBounds: {
+        case Array::ArrayStorage: {
             m_jit.load32(MacroAssembler::Address(storageGPR, ArrayStorage::lengthOffset()), storageLengthGPR);
         
             // Refuse to handle bizarre lengths.
@@ -3187,7 +3146,7 @@ void SpeculativeJIT::compile(Node& node)
     }
         
     case ArrayPop: {
-        ASSERT(modeIsJSArray(node.arrayMode()));
+        ASSERT(node.arrayMode().isJSArray());
 
         SpeculateCellOperand base(this, node.child1());
         StorageOperand storage(this, node.child2());
@@ -3199,9 +3158,8 @@ void SpeculativeJIT::compile(Node& node)
         GPRReg valueGPR = value.gpr();
         GPRReg storageLengthGPR = storageLength.gpr();
         
-        switch (node.arrayMode()) {
-        case Array::ArrayWithContiguous:
-        case Array::ArrayWithContiguousOutOfBounds: {
+        switch (node.arrayMode().type()) {
+        case Array::Contiguous: {
             m_jit.load32(
                 MacroAssembler::Address(storageGPR, Butterfly::offsetOfPublicLength()), storageLengthGPR);
             MacroAssembler::Jump undefinedCase =
@@ -3230,8 +3188,7 @@ void SpeculativeJIT::compile(Node& node)
             break;
         }
             
-        case Array::ArrayWithArrayStorage:
-        case Array::ArrayWithArrayStorageOutOfBounds: {
+        case Array::ArrayStorage: {
             m_jit.load32(MacroAssembler::Address(storageGPR, ArrayStorage::lengthOffset()), storageLengthGPR);
         
             JITCompiler::Jump undefinedCase =
@@ -3873,9 +3830,15 @@ void SpeculativeJIT::compile(Node& node)
         
         ASSERT(node.structureSet().size());
         
+        ExitKind exitKind;
+        if (m_jit.graph()[node.child1()].op() == WeakJSConstant)
+            exitKind = BadWeakConstantCache;
+        else
+            exitKind = BadCache;
+        
         if (node.structureSet().size() == 1) {
             speculationCheckWithConditionalDirection(
-                BadCache, JSValueRegs(base.gpr()), NoNode,
+                exitKind, JSValueRegs(base.gpr()), NoNode,
                 m_jit.branchWeakPtr(
                     JITCompiler::NotEqual,
                     JITCompiler::Address(base.gpr(), JSCell::structureOffset()),
@@ -3892,7 +3855,7 @@ void SpeculativeJIT::compile(Node& node)
                 done.append(m_jit.branchWeakPtr(JITCompiler::Equal, structure.gpr(), node.structureSet()[i]));
             
             speculationCheckWithConditionalDirection(
-                BadCache, JSValueRegs(base.gpr()), NoNode,
+                exitKind, JSValueRegs(base.gpr()), NoNode,
                 m_jit.branchWeakPtr(
                     JITCompiler::NotEqual, structure.gpr(), node.structureSet().last()),
                 node.op() == ForwardCheckStructure);
@@ -3916,7 +3879,8 @@ void SpeculativeJIT::compile(Node& node)
         m_jit.addWeakReference(node.structure());
         node.structure()->addTransitionWatchpoint(
             speculationWatchpointWithConditionalDirection(
-                BadCache, node.op() == ForwardStructureTransitionWatchpoint));
+                m_jit.graph()[node.child1()].op() == WeakJSConstant ? BadWeakConstantCache : BadCache,
+                node.op() == ForwardStructureTransitionWatchpoint));
 
 #if !ASSERT_DISABLED
         SpeculateCellOperand op1(this, node.child1());
diff --git a/Source/JavaScriptCore/disassembler/udis86/differences.txt b/Source/JavaScriptCore/disassembler/udis86/differences.txt
index 3ef51efcf..dc225b6ff 100644
--- a/Source/JavaScriptCore/disassembler/udis86/differences.txt
+++ b/Source/JavaScriptCore/disassembler/udis86/differences.txt
@@ -20,3 +20,5 @@ here:
 - Made the code in udis86_syn.h use vsnprintf() instead of vsprintf().
 
 - Fixed udis86_syn-att.c's jump destination printing to work correctly in 64-bit mode.
+
+- Add --outputDir option to itab.py.
diff --git a/Source/JavaScriptCore/disassembler/udis86/itab.py b/Source/JavaScriptCore/disassembler/udis86/itab.py
index 27fa9b3f3..07e20a6e1 100644
--- a/Source/JavaScriptCore/disassembler/udis86/itab.py
+++ b/Source/JavaScriptCore/disassembler/udis86/itab.py
@@ -23,6 +23,8 @@
 # (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS 
 # SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
+from optparse import OptionParser
+import os
 import sys
 
 sys.path.append( '../scripts' );
@@ -194,10 +196,11 @@ class UdItabGenerator( ud_opcode.UdOpcodeTables ):
 
     MnemonicAliases = ( "invalid", "3dnow", "none", "db", "pause" )
     
-    def __init__( self ):
+    def __init__( self, outputDir ):
         # first itab entry (0) is Invalid
         self.Itab.append( self.InvalidEntry )
         self.MnemonicsTable.extend( self.MnemonicAliases )
+        self.outputDir = outputDir
 
     def toGroupId( self, id ):
         return 0x8000 | id
@@ -289,7 +292,7 @@ class UdItabGenerator( ud_opcode.UdOpcodeTables ):
  
 
     def genItabH( self ):
-        self.ItabH = open( "udis86_itab.h", "w" )
+        self.ItabH = open( os.path.join(self.outputDir, "udis86_itab.h"), "w" )
 
         # Generate Table Type Enumeration
         self.ItabH.write( "#ifndef UD_ITAB_H\n" )
@@ -328,7 +331,7 @@ class UdItabGenerator( ud_opcode.UdOpcodeTables ):
 
 
     def genItabC( self ):
-        self.ItabC = open( "udis86_itab.c", "w" )
+        self.ItabC = open( os.path.join(self.outputDir, "udis86_itab.c"), "w" )
         self.ItabC.write( "/* itab.c -- generated by itab.py, do no edit" )
         self.ItabC.write( " */\n" );
         self.ItabC.write( "#include \"udis86_decode.h\"\n\n" );
@@ -344,9 +347,12 @@ class UdItabGenerator( ud_opcode.UdOpcodeTables ):
         self.genItabH()
 
 def main():
-    generator = UdItabGenerator()
+    parser = OptionParser()
+    parser.add_option("--outputDir", dest="outputDir", default="")
+    options, args = parser.parse_args()
+    generator = UdItabGenerator(os.path.normpath(options.outputDir))
     optableXmlParser = ud_optable.UdOptableXmlParser()
-    optableXmlParser.parse( sys.argv[ 1 ], generator.addInsnDef )
+    optableXmlParser.parse( args[ 0 ], generator.addInsnDef )
 
     generator.genItab()
 
diff --git a/Source/JavaScriptCore/heap/Heap.cpp b/Source/JavaScriptCore/heap/Heap.cpp
index cd3393aa2..c455fc2b1 100644
--- a/Source/JavaScriptCore/heap/Heap.cpp
+++ b/Source/JavaScriptCore/heap/Heap.cpp
@@ -36,6 +36,7 @@
 #include "JSLock.h"
 #include "JSONObject.h"
 #include "Tracing.h"
+#include "UnlinkedCodeBlock.h"
 #include "WeakSetInlines.h"
 #include <algorithm>
 #include <wtf/RAMSize.h>
@@ -484,13 +485,13 @@ void Heap::markRoots(bool fullGC)
             }
         }
 #endif
-    
+
         if (m_globalData->codeBlocksBeingCompiled.size()) {
             GCPHASE(VisitActiveCodeBlock);
             for (size_t i = 0; i < m_globalData->codeBlocksBeingCompiled.size(); i++)
                 m_globalData->codeBlocksBeingCompiled[i]->visitAggregate(visitor);
         }
-    
+
         {
             GCPHASE(VisitMachineRoots);
             MARK_LOG_ROOT(visitor, "C++ Stack");
diff --git a/Source/JavaScriptCore/heap/Heap.h b/Source/JavaScriptCore/heap/Heap.h
index 88dc201a4..51cebdc0e 100644
--- a/Source/JavaScriptCore/heap/Heap.h
+++ b/Source/JavaScriptCore/heap/Heap.h
@@ -86,6 +86,7 @@ namespace JSC {
         // our scan to run faster. 
         static const unsigned s_timeCheckResolution = 16;
 
+        static bool isLive(const void*);
         static bool isMarked(const void*);
         static bool testAndSetMarked(const void*);
         static void setMarked(const void*);
@@ -305,6 +306,11 @@ namespace JSC {
         return heap(v.asCell());
     }
 
+    inline bool Heap::isLive(const void* cell)
+    {
+        return MarkedBlock::blockFor(cell)->isLiveCell(cell);
+    }
+
     inline bool Heap::isMarked(const void* cell)
     {
         return MarkedBlock::blockFor(cell)->isMarked(cell);
diff --git a/Source/JavaScriptCore/heap/MarkedAllocator.h b/Source/JavaScriptCore/heap/MarkedAllocator.h
index 13bd8e493..867481fe3 100644
--- a/Source/JavaScriptCore/heap/MarkedAllocator.h
+++ b/Source/JavaScriptCore/heap/MarkedAllocator.h
@@ -74,10 +74,18 @@ inline void MarkedAllocator::init(Heap* heap, MarkedSpace* markedSpace, size_t c
 inline void* MarkedAllocator::allocate(size_t bytes)
 {
     MarkedBlock::FreeCell* head = m_freeList.head;
-    if (UNLIKELY(!head))
-        return allocateSlowCase(bytes);
+    if (UNLIKELY(!head)) {
+        void* result = allocateSlowCase(bytes);
+#ifndef NDEBUG
+        memset(result, 0xCD, bytes);
+#endif
+        return result;
+    }
     
     m_freeList.head = head->next;
+#ifndef NDEBUG
+    memset(head, 0xCD, bytes);
+#endif
     return head;
 }
 
diff --git a/Source/JavaScriptCore/heap/MarkedBlock.cpp b/Source/JavaScriptCore/heap/MarkedBlock.cpp
index 70a24b6ae..9a036f87c 100644
--- a/Source/JavaScriptCore/heap/MarkedBlock.cpp
+++ b/Source/JavaScriptCore/heap/MarkedBlock.cpp
@@ -78,7 +78,7 @@ MarkedBlock::FreeList MarkedBlock::specializedSweep()
     FreeCell* head = 0;
     size_t count = 0;
     for (size_t i = firstAtom(); i < m_endAtom; i += m_atomsPerCell) {
-        if (blockState == Marked && m_marks.get(i))
+        if (blockState == Marked && (m_marks.get(i) || (m_newlyAllocated && m_newlyAllocated->get(i))))
             continue;
 
         JSCell* cell = reinterpret_cast_ptr<JSCell*>(&atoms()[i]);
@@ -94,6 +94,11 @@ MarkedBlock::FreeList MarkedBlock::specializedSweep()
         }
     }
 
+    // We only want to discard the newlyAllocated bits if we're creating a FreeList,
+    // otherwise we would lose information on what's currently alive.
+    if (sweepMode == SweepToFreeList && m_newlyAllocated)
+        m_newlyAllocated.clear();
+
     m_state = ((sweepMode == SweepToFreeList) ? FreeListed : Marked);
     return FreeList(head, count * cellSize());
 }
@@ -138,12 +143,21 @@ MarkedBlock::FreeList MarkedBlock::sweepHelper(SweepMode sweepMode)
     return FreeList();
 }
 
-class SetAllMarksFunctor : public MarkedBlock::VoidFunctor {
+class SetNewlyAllocatedFunctor : public MarkedBlock::VoidFunctor {
 public:
+    SetNewlyAllocatedFunctor(MarkedBlock* block)
+        : m_block(block)
+    {
+    }
+
     void operator()(JSCell* cell)
     {
-        MarkedBlock::blockFor(cell)->setMarked(cell);
+        ASSERT(MarkedBlock::blockFor(cell) == m_block);
+        m_block->setNewlyAllocated(cell);
     }
+
+private:
+    MarkedBlock* m_block;
 };
 
 void MarkedBlock::canonicalizeCellLivenessData(const FreeList& freeList)
@@ -168,14 +182,17 @@ void MarkedBlock::canonicalizeCellLivenessData(const FreeList& freeList)
     // allocated from our free list are not currently marked, so we need another
     // way to tell what's live vs dead. 
     
-    SetAllMarksFunctor functor;
+    ASSERT(!m_newlyAllocated);
+    m_newlyAllocated = adoptPtr(new WTF::Bitmap<atomsPerBlock>());
+
+    SetNewlyAllocatedFunctor functor(this);
     forEachCell(functor);
 
     FreeCell* next;
     for (FreeCell* current = head; current; current = next) {
         next = current->next;
         reinterpret_cast<JSCell*>(current)->zap();
-        clearMarked(current);
+        clearNewlyAllocated(current);
     }
     
     m_state = Marked;
diff --git a/Source/JavaScriptCore/heap/MarkedBlock.h b/Source/JavaScriptCore/heap/MarkedBlock.h
index 31bf60b9f..f2f2a720d 100644
--- a/Source/JavaScriptCore/heap/MarkedBlock.h
+++ b/Source/JavaScriptCore/heap/MarkedBlock.h
@@ -159,6 +159,10 @@ namespace JSC {
         void setMarked(const void*);
         void clearMarked(const void*);
 
+        bool isNewlyAllocated(const void*);
+        void setNewlyAllocated(const void*);
+        void clearNewlyAllocated(const void*);
+
         bool needsSweeping();
 
 #if ENABLE(GGC)
@@ -218,6 +222,8 @@ namespace JSC {
 #else
         WTF::Bitmap<atomsPerBlock, WTF::BitmapNotAtomic> m_marks;
 #endif
+        OwnPtr<WTF::Bitmap<atomsPerBlock> > m_newlyAllocated;
+
         DestructorType m_destructorType;
         MarkedAllocator* m_allocator;
         BlockState m_state;
@@ -313,6 +319,7 @@ namespace JSC {
 
         ASSERT(m_state != New && m_state != FreeListed);
         m_marks.clearAll();
+        m_newlyAllocated.clear();
 
         // This will become true at the end of the mark phase. We set it now to
         // avoid an extra pass to do so later.
@@ -326,7 +333,7 @@ namespace JSC {
 
     inline bool MarkedBlock::isEmpty()
     {
-        return m_marks.isEmpty() && m_weakSet.isEmpty();
+        return m_marks.isEmpty() && m_weakSet.isEmpty() && (!m_newlyAllocated || m_newlyAllocated->isEmpty());
     }
 
     inline size_t MarkedBlock::cellSize()
@@ -375,6 +382,21 @@ namespace JSC {
         m_marks.clear(atomNumber(p));
     }
 
+    inline bool MarkedBlock::isNewlyAllocated(const void* p)
+    {
+        return m_newlyAllocated->get(atomNumber(p));
+    }
+
+    inline void MarkedBlock::setNewlyAllocated(const void* p)
+    {
+        m_newlyAllocated->set(atomNumber(p));
+    }
+
+    inline void MarkedBlock::clearNewlyAllocated(const void* p)
+    {
+        m_newlyAllocated->clear(atomNumber(p));
+    }
+
     inline bool MarkedBlock::isLive(const JSCell* cell)
     {
         switch (m_state) {
@@ -382,7 +404,7 @@ namespace JSC {
             return true;
 
         case Marked:
-            return m_marks.get(atomNumber(cell));
+            return m_marks.get(atomNumber(cell)) || (m_newlyAllocated && isNewlyAllocated(cell));
 
         case New:
         case FreeListed:
diff --git a/Source/JavaScriptCore/heap/SlotVisitor.cpp b/Source/JavaScriptCore/heap/SlotVisitor.cpp
index 7a30debda..3919705d0 100644
--- a/Source/JavaScriptCore/heap/SlotVisitor.cpp
+++ b/Source/JavaScriptCore/heap/SlotVisitor.cpp
@@ -294,6 +294,8 @@ ALWAYS_INLINE void SlotVisitor::internalAppend(JSValue* slot)
     if (!cell)
         return;
 
+    validate(cell);
+
     if (m_shouldHashConst && cell->isString()) {
         JSString* string = jsCast<JSString*>(cell);
         if (string->shouldTryHashConst() && string->tryHashConstLock()) {
@@ -355,6 +357,10 @@ void SlotVisitor::validate(JSCell* cell)
                 cell->structure()->structure(), parentClassName, cell, cell->structure(), ourClassName);
         CRASH();
     }
+
+    // Make sure we can walk the ClassInfo chain
+    const ClassInfo* info = cell->classInfo();
+    do { } while ((info = info->parentClass));
 }
 #else
 void SlotVisitor::validate(JSCell*)
diff --git a/Source/JavaScriptCore/heap/WeakBlock.cpp b/Source/JavaScriptCore/heap/WeakBlock.cpp
index 13039e702..99e306b85 100644
--- a/Source/JavaScriptCore/heap/WeakBlock.cpp
+++ b/Source/JavaScriptCore/heap/WeakBlock.cpp
@@ -102,7 +102,7 @@ void WeakBlock::visit(HeapRootVisitor& heapRootVisitor)
             continue;
 
         const JSValue& jsValue = weakImpl->jsValue();
-        if (Heap::isMarked(jsValue.asCell()))
+        if (Heap::isLive(jsValue.asCell()))
             continue;
 
         WeakHandleOwner* weakHandleOwner = weakImpl->weakHandleOwner();
@@ -127,7 +127,7 @@ void WeakBlock::reap()
         if (weakImpl->state() > WeakImpl::Dead)
             continue;
 
-        if (Heap::isMarked(weakImpl->jsValue().asCell())) {
+        if (Heap::isLive(weakImpl->jsValue().asCell())) {
             ASSERT(weakImpl->state() == WeakImpl::Live);
             continue;
         }
diff --git a/Source/JavaScriptCore/interpreter/Interpreter.cpp b/Source/JavaScriptCore/interpreter/Interpreter.cpp
index 0d475b416..397ac8474 100644
--- a/Source/JavaScriptCore/interpreter/Interpreter.cpp
+++ b/Source/JavaScriptCore/interpreter/Interpreter.cpp
@@ -100,9 +100,9 @@ Interpreter::ErrorHandlingMode::~ErrorHandlingMode()
 
 // The Interpreter::StackPolicy class is used to compute a stack capacity
 // requirement to ensure that we have enough room on the native stack for:
-// 1. the max cummulative stack used by the interpreter and all code
+// 1. the max cumulative stack used by the interpreter and all code
 //    paths sub of it up till leaf functions.
-// 2. the max cummulative stack used by the interpreter before it reaches
+// 2. the max cumulative stack used by the interpreter before it reaches
 //    the next checkpoint (execute...() function) in the interpreter.
 // 
 // The interpreter can be run on different threads and hence, different
@@ -116,11 +116,11 @@ Interpreter::ErrorHandlingMode::~ErrorHandlingMode()
 Interpreter::StackPolicy::StackPolicy(Interpreter& interpreter, const StackBounds& stack)
     : m_interpreter(interpreter)
 {
-    int size = stack.size();
+    const size_t size = stack.size();
 
-    const int DEFAULT_REQUIRED_STACK = 1024 * 1024;
-    const int DEFAULT_MINIMUM_USEABLE_STACK = 128 * 1024;
-    const int DEFAULT_ERROR_MODE_REQUIRED_STACK = 32 * 1024;
+    const size_t DEFAULT_REQUIRED_STACK = 1024 * 1024;
+    const size_t DEFAULT_MINIMUM_USEABLE_STACK = 128 * 1024;
+    const size_t DEFAULT_ERROR_MODE_REQUIRED_STACK = 32 * 1024;
 
     // Here's the policy in a nutshell:
     //
@@ -152,7 +152,7 @@ Interpreter::StackPolicy::StackPolicy(Interpreter& interpreter, const StackBound
     //    ^             ^
     //    start         current sp
     //
-    //    This smaller requried capacity also means that we won't re-trigger
+    //    This smaller required capacity also means that we won't re-trigger
     //    a stack overflow for processing the exception caused by the original
     //    StackOverflowError.
     //
@@ -169,15 +169,16 @@ Interpreter::StackPolicy::StackPolicy(Interpreter& interpreter, const StackBound
     //    The minimum useable capacity is DEFAULT_MINIMUM_USEABLE_STACK.
     //    In this case, the requiredCapacity is whatever is left of the
     //    total stack capacity after we have give JS its minimum stack
-    //    i.e. requiredCapcity can even be 0 if there's not enough stack.
+    //    i.e. requiredCapacity can even be 0 if there's not enough stack.
 
 
     // Policy 1: Normal mode: required = DEFAULT_REQUIRED_STACK.
-    // Policy 2: Erro mode: required = DEFAULT_ERROR_MODE_REQUIRED_STACK.
-    int requiredCapacity = !m_interpreter.m_errorHandlingModeReentry ?
+    // Policy 2: Error mode: required = DEFAULT_ERROR_MODE_REQUIRED_STACK.
+    size_t requiredCapacity = !m_interpreter.m_errorHandlingModeReentry ?
         DEFAULT_REQUIRED_STACK : DEFAULT_ERROR_MODE_REQUIRED_STACK;
 
-    int useableStack = size - requiredCapacity;
+    size_t useableStack = (requiredCapacity <= size) ?
+        size - requiredCapacity : DEFAULT_MINIMUM_USEABLE_STACK;
 
     // Policy 3: Ensure the useable stack is not too small:
     if (useableStack < DEFAULT_MINIMUM_USEABLE_STACK)
@@ -190,9 +191,8 @@ Interpreter::StackPolicy::StackPolicy(Interpreter& interpreter, const StackBound
 
     // Re-compute the requiredCapacity based on the adjusted useable stack
     // size:
-    // interpreter stack checks:
     requiredCapacity = size - useableStack;
-    ASSERT((requiredCapacity >= 0) && (requiredCapacity < size));
+    ASSERT(requiredCapacity < size);
 
     m_requiredCapacity = requiredCapacity;    
 }
@@ -948,10 +948,13 @@ failedJSONP:
     // object.
 
     // Compile source to bytecode if necessary:
-    JSObject* error = program->compile(callFrame, scope);
-    if (error)
+    if (JSObject* error = program->initalizeGlobalProperties(globalData, callFrame, scope))
         return checkedReturn(throwError(callFrame, error));
-    CodeBlock* codeBlock = &program->generatedBytecode();
+
+    if (JSObject* error = program->compile(callFrame, scope))
+        return checkedReturn(throwError(callFrame, error));
+
+    ProgramCodeBlock* codeBlock = &program->generatedBytecode();
 
     // Push the call frame for this invocation:
     ASSERT(codeBlock->numParameters() == 1); // 1 parameter for 'this'.
diff --git a/Source/JavaScriptCore/interpreter/VMInspector.cpp b/Source/JavaScriptCore/interpreter/VMInspector.cpp
index 566d4e8e0..58bc15075 100644
--- a/Source/JavaScriptCore/interpreter/VMInspector.cpp
+++ b/Source/JavaScriptCore/interpreter/VMInspector.cpp
@@ -28,6 +28,10 @@
 
 #if ENABLE(VMINSPECTOR)
 
+#include <stdio.h>
+#include <wtf/ASCIICType.h>
+#include <wtf/text/WTFString.h>
+
 namespace JSC {
 
 const char* VMInspector::getTypeName(JSValue value)
@@ -105,6 +109,465 @@ int VMInspector::countFrames(CallFrame* frame)
     return count;
 }
 
+
+//============================================================================
+//  class FormatPrinter
+//    - implements functionality to support fprintf.
+//
+//    The FormatPrinter classes do the real formatting and printing.
+//    By default, the superclass FormatPrinter will print to stdout (printf).
+//    Each of the subclass will implement the other ...printf() options.
+//    The subclasses are:
+//
+//        FileFormatPrinter     - fprintf
+//        StringFormatPrinter   - sprintf
+//        StringNFormatPrinter  - snprintf
+
+class FormatPrinter {
+public:
+    virtual ~FormatPrinter() { }
+
+    void print(const char* format, va_list args);
+
+protected:
+    // Low level printers:
+    bool printArg(const char* format, ...);
+    virtual bool printArg(const char* format, va_list args);
+
+    // JS type specific printers:
+    void printWTFString(va_list args, bool verbose);
+};
+
+
+// The public print() function is the real workhorse behind the printf
+// family of functions. print() deciphers the % formatting, translate them
+// to primitive formats, and dispatches to underlying printArg() functions
+// to do the printing.
+// 
+// The non-public internal printArg() function is virtual and is responsible
+// for handling the variations between printf, fprintf, sprintf, and snprintf.
+
+void FormatPrinter::print(const char* format, va_list args)
+{
+    const char* p = format;
+    const char* errorStr;
+
+    // buffer is only used for 2 purposes:
+    // 1. To temporarily hold a copy of normal chars (not needing formatting)
+    //    to be passed to printArg() and printed.
+    //
+    //    The incoming format string may contain a string of normal chars much
+    //    longer than 128, but we handle this by breaking them out to 128 chars
+    //    fragments and printing each fragment before re-using the buffer to
+    //    load up the next fragment.
+    //
+    // 2. To hold a single "%..." format to be passed to printArg() to process
+    //    a single va_arg.
+
+    char buffer[129]; // 128 chars + null terminator.
+    char* end = &buffer[sizeof(buffer) - 1];
+    const char* startOfFormatSpecifier = 0;
+
+    while (true) {
+        char c = *p++;
+        char* curr = buffer;
+
+        // Print leading normal chars:
+        while (c != '\0' && c != '%') {
+            *curr++ = c;
+            if (curr == end) {
+                // Out of buffer space. Flush the fragment, and start over.
+                *curr = '\0';
+                bool success = printArg("%s", buffer);
+                if (!success) {
+                    errorStr = buffer;
+                    goto handleError;
+                }
+                curr = buffer;
+            }
+            c = *p++;
+        }
+        // If we have stuff in the buffer, flush the fragment:
+        if (curr != buffer) {
+            ASSERT(curr < end + 1);
+            *curr = '\0';
+            bool success = printArg("%s", buffer);
+            if (!success) {
+                errorStr = buffer;
+                goto handleError;
+            }
+        }
+
+        // End if there are not more chars to print:
+        if (c == '\0')
+            break;
+
+        // If we get here, we've must have seen a '%':
+        startOfFormatSpecifier = p - 1;
+        ASSERT(*startOfFormatSpecifier == '%');
+        c = *p++;
+
+        // Check for "%%" case:
+        if (c == '%') {
+            bool success = printArg("%c", '%');
+            if (!success) {
+                errorStr = p - 2;
+                goto handleError;
+            }
+            continue;
+        }
+
+        // Check for JS (%J<x>) formatting extensions:
+        if (c == 'J') {
+            bool verbose = false;
+
+            c = *p++;
+            if (UNLIKELY(c == '\0')) {
+                errorStr = p - 2; // Rewind to % in "%J\0"
+                goto handleError;
+            }
+
+            if (c == '+') {
+                verbose = true;
+                c= *p++;
+                if (UNLIKELY(c == '\0')) {
+                    errorStr = p - 3; // Rewind to % in "%J+\0"
+                    goto handleError;
+                }
+            }
+
+            switch (c) {
+            // %Js - WTF::String*
+            case 's': {
+                printWTFString(args, verbose);
+                continue;
+            }
+            } // END switch.
+
+        // Check for non-JS extensions:
+        } else if (c == 'b') {
+            int value = va_arg(args, int);
+            printArg("%s", value ? "TRUE" : "FALSE");
+            continue;
+        }
+
+        // If we didn't handle the format in one of the above cases,
+        // rewind p and let the standard formatting check handle it
+        // if possible:
+        p = startOfFormatSpecifier;
+        ASSERT(*p == '%');
+
+        // Check for standard formatting:
+        // A format specifier always starts with a % and ends with some
+        // alphabet. We'll do the simple thing and scan until the next
+        // alphabet, or the end of string.
+
+        // In the following, we're going to use buffer as storage for a copy
+        // of a single format specifier. Hence, conceptually, we can think of
+        // 'buffer' as synonymous with 'argFormat' here:
+
+#define ABORT_IF_FORMAT_TOO_LONG(curr) \
+        do {                           \
+            if (UNLIKELY(curr >= end)) \
+                goto formatTooLong;    \
+        } while (false)
+        
+        curr = buffer;
+        *curr++ = *p++; // Output the first % in the format specifier.
+        c = *p++; // Grab the next char in the format specifier.
+
+        // Checks for leading modifiers e.g. "%-d":
+        //     0, -, ' ', +, '\''
+        if (c == '0' || c == '-' || c == ' ' || c == '+' || c == '\'' || c == '#') {
+            ABORT_IF_FORMAT_TOO_LONG(curr);
+            *curr++ = c;
+            c = *p++;
+        }
+
+        // Checks for decimal digit field width modifiers e.g. "%2f":
+        while (c >= '0' && c <= '9') {
+            ABORT_IF_FORMAT_TOO_LONG(curr);
+            *curr++ = c;
+            c = *p++;
+        }
+
+        // Checks for '.' e.g. "%2.f":
+        if (c == '.') {
+            ABORT_IF_FORMAT_TOO_LONG(curr);
+            *curr++ = c;
+            c = *p++;
+
+            // Checks for decimal digit precision modifiers  e.g. "%.2f":
+            while (c >= '0' && c <= '9') {
+                ABORT_IF_FORMAT_TOO_LONG(curr);
+                *curr++ = c;
+                c = *p++;
+            }
+        }
+
+        // Checks for the modifier <m> where <m> can be:
+        //     l, h, j, t, z
+        // e.g. "%ld"
+        if (c == 'l' || c == 'h' || c == 'j' || c == 't' || c == 'z' || c == 'L') {
+            ABORT_IF_FORMAT_TOO_LONG(curr);
+            *curr++ = c;
+            char prevChar = c;
+            c = *p++;
+
+            // Checks for the modifier ll or hh in %<x><m>:
+            if ((prevChar == 'l' || prevChar == 'h') && c == prevChar) {
+                ABORT_IF_FORMAT_TOO_LONG(curr);
+                *curr++ = c;
+                c = *p++;
+            }
+        }
+
+        // Checks for %<x> where <x> can be:
+        //     d, i, n, o, u, x, X
+        // But hey, we're just going to do the simple thing and allow any
+        // alphabet. The user is expected to pass correct format specifiers.
+        // We won't do any format checking here. We'll just pass it on, and the
+        // underlying ...printf() implementation may do the needed checking
+        // at its discretion.
+        while (c != '\0' && !isASCIIAlpha(c)) {
+            ABORT_IF_FORMAT_TOO_LONG(curr);
+            *curr++ = c;
+            c = *p++;
+        }
+
+        ABORT_IF_FORMAT_TOO_LONG(curr);
+        *curr++ = c;
+        if (c == '\0') {
+            // Uh oh. Bad format. We should have gotten an alphabet instead.
+            // Print the supposed format as a string instead:
+            errorStr = buffer;
+            goto handleError;
+        }
+
+        // Otherwise, we have the alpha that terminates the format.
+        // Terminate the buffer (i.e. argFormat) string:
+        ASSERT(isASCIIAlpha(c));
+        ABORT_IF_FORMAT_TOO_LONG(curr);
+        *curr = '\0';
+
+        bool success = printArg(buffer, args);
+        if (!success) {
+            errorStr = buffer;
+            goto handleError;
+        }
+    }
+#undef ABORT_IF_FORMAT_TOO_LONG
+
+    return;
+
+formatTooLong:
+    // Print the error string:
+    ASSERT(!!startOfFormatSpecifier);
+    p = startOfFormatSpecifier;
+    ASSERT(p >= format);
+    printArg("ERROR @ Format too long at \"%s\"\n", p);
+    return;
+
+handleError:
+    // We've got an error. Can't do any more work. Print an error message if
+    // possible and then just return.
+
+    // The errorStr may be pointing into the middle of buffer, or the original
+    // format string. Move the string to buffer for consistency, and also so
+    // that we can strip it of newlines below.
+    if (errorStr != buffer) {
+        size_t length = strlen(errorStr);
+        if (length > sizeof(buffer) - 1)
+            length = sizeof(buffer) - 1;
+        memmove(buffer, errorStr, length);
+        buffer[length] = '\0'; // Terminate the moved error string.
+    }
+    // Strip the newlines:
+    char* cp = buffer;
+    while (*cp) {
+        if (*cp == '\n' || *cp == '\r')
+            *cp = ' ';
+        cp++;
+    }
+    // Print the error string:
+    printArg("ERROR @ \"%s\"\n", buffer);
+}
+
+
+bool FormatPrinter::printArg(const char* format, ...)
+{
+    va_list args;
+    va_start(args, format);
+    bool success = printArg(format, args);
+    va_end(args);
+    return success;
+}
+
+bool FormatPrinter::printArg(const char* format, va_list args)
+{
+    int count = ::vprintf(format, args);
+    return (count >= 0); // Fail if less than 0 chars printed.
+}
+
+
+// %Js - WTF::String*
+// verbose mode prints: WTF::String "<your string>"
+void FormatPrinter::printWTFString(va_list args, bool verbose)
+{
+    const String* str = va_arg(args, const String*);
+
+    // Print verbose header if appropriate:
+    if (verbose)
+        printArg("WTF::String \"");
+
+    // Print the string itself:
+    if (!str->isEmpty()) {
+        if (str->is8Bit()) {
+            const LChar* chars = str->characters8();
+            printArg("%s", reinterpret_cast<const char*>(chars));
+        } else {
+            const UChar* chars = str->characters16();
+            printArg("%S", reinterpret_cast<const wchar_t*>(chars));
+        }
+    }
+
+    // Print verbose footer if appropriate:
+    if (verbose)
+        printArg("\"");
+}
+
+
+//============================================================================
+//  class FileFormatPrinter
+//    - implements functionality to support fprintf.
+
+class FileFormatPrinter: public FormatPrinter {
+public:
+    FileFormatPrinter(FILE*);
+private:
+    virtual bool printArg(const char* format, va_list args);
+
+    FILE* m_file;
+};
+
+FileFormatPrinter::FileFormatPrinter(FILE* file)
+    : m_file(file)
+{ 
+}
+
+bool FileFormatPrinter::printArg(const char* format, va_list args)
+{
+    int count = ::vfprintf(m_file, format, args);
+    return (count >= 0); // Fail if less than 0 chars printed.
+}
+
+
+//============================================================================
+//  class StringFormatPrinter
+//    - implements functionality to support sprintf.
+
+class StringFormatPrinter: public FormatPrinter {
+public:
+    StringFormatPrinter(char* buffer);
+private:
+    virtual bool printArg(const char* format, va_list args);
+
+    char* m_buffer;
+};
+
+StringFormatPrinter::StringFormatPrinter(char* buffer)
+    : m_buffer(buffer)
+{ 
+}
+
+bool StringFormatPrinter::printArg(const char* format, va_list args)
+{
+    int count = ::vsprintf(m_buffer, format, args);
+    m_buffer += count;
+    return (count >= 0); // Fail if less than 0 chars printed.
+}
+
+
+//============================================================================
+//  class StringNFormatPrinter
+//    - implements functionality to support snprintf.
+
+class StringNFormatPrinter: public FormatPrinter {
+public:
+    StringNFormatPrinter(char* buffer, size_t);
+private:
+    virtual bool printArg(const char* format, va_list args);
+
+    char* m_buffer;
+    size_t m_size;
+};
+
+
+StringNFormatPrinter::StringNFormatPrinter(char* buffer, size_t size)
+    : m_buffer(buffer)
+    , m_size(size)
+{
+}
+
+bool StringNFormatPrinter::printArg(const char* format, va_list args)
+{
+    if (m_size > 0) {
+        int count = ::vsnprintf(m_buffer, m_size, format, args);
+
+        // According to vsnprintf specs, ...
+        bool success = (count >= 0);
+        if (static_cast<size_t>(count) >= m_size) {
+            // If count > size, then we didn't have enough buffer space.
+            count = m_size;
+        }
+
+        // Adjust the buffer to what's left if appropriate:
+        if (success) {
+            m_buffer += count;
+            m_size -= count;
+        }
+        return success;
+    }
+    // No more room to print. Declare it a fail:
+    return false;
+}
+
+
+//============================================================================
+//  VMInspector printf family of methods:
+
+void VMInspector::fprintf(FILE* file, const char* format, ...)
+{
+    va_list args;
+    va_start(args, format);
+    FileFormatPrinter(file).print(format, args);
+    va_end(args);
+}
+
+void VMInspector::printf(const char* format, ...)
+{
+    va_list args;
+    va_start(args, format);
+    FormatPrinter().print(format, args);
+    va_end(args);
+}
+
+void VMInspector::sprintf(char* buffer, const char* format, ...)
+{
+    va_list args;
+    va_start(args, format);
+    StringFormatPrinter(buffer).print(format, args);
+    va_end(args);
+}
+
+void VMInspector::snprintf(char* buffer, size_t size, const char* format, ...)
+{
+    va_list args;
+    va_start(args, format);
+    StringNFormatPrinter(buffer, size).print(format, args);
+    va_end(args);
+}
+
 } // namespace JSC
 
 #endif // ENABLE(VMINSPECTOR)
diff --git a/Source/JavaScriptCore/interpreter/VMInspector.h b/Source/JavaScriptCore/interpreter/VMInspector.h
index 6806cafa1..81ca26c6f 100644
--- a/Source/JavaScriptCore/interpreter/VMInspector.h
+++ b/Source/JavaScriptCore/interpreter/VMInspector.h
@@ -28,23 +28,62 @@
 
 #define ENABLE_VMINSPECTOR 0
 
-#if ENABLE(VMINSPECTOR)
-
 #include "CallFrame.h"
 #include "JSValue.h"
+#include <stdarg.h>
+#include <stdio.h>
+#include <wtf/text/WTFString.h>
 
 namespace JSC {
 
+#if ENABLE(VMINSPECTOR)
+
 class VMInspector {
 public:    
     static JS_EXPORT_PRIVATE const char* getTypeName(JSValue);
     static JS_EXPORT_PRIVATE void dumpFrame0(CallFrame*);
     static JS_EXPORT_PRIVATE void dumpFrame(CallFrame*, const char* prefix = 0, const char* funcName = 0, const char* file = 0, int line = -1);
     static JS_EXPORT_PRIVATE int countFrames(CallFrame*);
-};
 
-} // namespace JSC
+    // Special family of ...printf() functions that support, in addition to the
+    // standard % formats (e.g. %d, %s, etc), the following extra JSC formatting
+    // options, %J<x>, where <x> consists of:
+    //
+    //   +    - verbose mode modifier.
+    //          Used in combination with other options. Must come after the %J.
+    //   s    - WTF::String*
+    //
+    // Examples of usage:
+    //
+    //    WTF::String str("My WTF String");
+    //
+    //    // Printing the string. Will print:
+    //    // The wtf string says: "My WTF String" and is NOT EMPTY.
+    //
+    //    VMInspector::printf("The wtf string says: \"%Js\" and is %s\n",
+    //        &str, str.isEmpty()?"EMPTY":"NOT EMPTY");
+    //
+    //    // Printing the string with verbose mode. Will print:
+    //    // <WTF::String "My WTF String">
+    //
+    //    VMInspector::printf("<%J+s>\n", &str);
+    //
+    // Also added some convenience non-JS formats:
+    //
+    //   %b    - boolean (va_args will look for an int).
+    //           Prints TRUE if non-zero, else prints FALSE.
+    //
+    // Caution: the user is expected to pass the correctly matched arguments
+    // to pair with the corresponding % fomatting.
+
+    static JS_EXPORT_PRIVATE void fprintf(FILE*, const char* format, ...);
+    static JS_EXPORT_PRIVATE void printf(const char* format, ...);
+    static JS_EXPORT_PRIVATE void sprintf(char*, const char* format, ...);
+    static JS_EXPORT_PRIVATE void snprintf(char*, size_t, const char* format, ...);
+};
 
 #endif // ENABLE(VMINSPECTOR)
 
+} // namespace JSC
+
 #endif // VMInspector.h
diff --git a/Source/JavaScriptCore/jit/JIT.cpp b/Source/JavaScriptCore/jit/JIT.cpp
index 2d2991b5f..3102c7693 100644
--- a/Source/JavaScriptCore/jit/JIT.cpp
+++ b/Source/JavaScriptCore/jit/JIT.cpp
@@ -301,7 +301,6 @@ void JIT::privateCompileMainPass()
         DEFINE_OP(op_loop_if_true)
         DEFINE_OP(op_loop_if_false)
         DEFINE_OP(op_lshift)
-        DEFINE_OP(op_method_check)
         DEFINE_OP(op_mod)
         DEFINE_OP(op_mov)
         DEFINE_OP(op_mul)
@@ -336,6 +335,8 @@ void JIT::privateCompileMainPass()
         DEFINE_OP(op_put_by_index)
         DEFINE_OP(op_put_by_val)
         DEFINE_OP(op_put_getter_setter)
+        case op_init_global_const_nop:
+            NEXT_OPCODE(op_init_global_const_nop);
         DEFINE_OP(op_init_global_const)
         DEFINE_OP(op_init_global_const_check)
 
@@ -372,7 +373,7 @@ void JIT::privateCompileMainPass()
         DEFINE_OP(op_tear_off_activation)
         DEFINE_OP(op_tear_off_arguments)
         DEFINE_OP(op_throw)
-        DEFINE_OP(op_throw_reference_error)
+        DEFINE_OP(op_throw_static_error)
         DEFINE_OP(op_to_jsnumber)
         DEFINE_OP(op_to_primitive)
 
@@ -489,7 +490,6 @@ void JIT::privateCompileSlowCases()
         DEFINE_SLOWCASE_OP(op_loop_if_true)
         DEFINE_SLOWCASE_OP(op_loop_if_false)
         DEFINE_SLOWCASE_OP(op_lshift)
-        DEFINE_SLOWCASE_OP(op_method_check)
         DEFINE_SLOWCASE_OP(op_mod)
         DEFINE_SLOWCASE_OP(op_mul)
         DEFINE_SLOWCASE_OP(op_negate)
@@ -569,13 +569,6 @@ ALWAYS_INLINE void PropertyStubCompilationInfo::copyToStubInfo(StructureStubInfo
     info.hotPathBegin = linkBuffer.locationOf(hotPathBegin);
 
     switch (m_type) {
-    case MethodCheck: {
-        CodeLocationDataLabelPtr structureToCompareLocation = linkBuffer.locationOf(methodCheckStructureToCompare);
-        info.patch.baseline.methodCheckProtoObj = MacroAssembler::differenceBetweenCodePtr(structureToCompareLocation, linkBuffer.locationOf(methodCheckProtoObj));
-        info.patch.baseline.methodCheckProtoStructureToCompare = MacroAssembler::differenceBetweenCodePtr(structureToCompareLocation, linkBuffer.locationOf(methodCheckProtoStructureToCompare));
-        info.patch.baseline.methodCheckPutFunction = MacroAssembler::differenceBetweenCodePtr(structureToCompareLocation, linkBuffer.locationOf(methodCheckPutFunction));
-        // No break - fall through to GetById.
-    }
     case GetById: {
         CodeLocationLabel hotPathBeginLocation = linkBuffer.locationOf(hotPathBegin);
         info.patch.baseline.u.get.structureToCompare = MacroAssembler::differenceBetweenCodePtr(hotPathBeginLocation, linkBuffer.locationOf(getStructureToCompare));
@@ -792,14 +785,6 @@ JITCode JIT::privateCompile(CodePtr* functionEntryArityCheck, JITCompilationEffo
         info.hotPathBegin = patchBuffer.locationOf(m_callStructureStubCompilationInfo[i].hotPathBegin);
         info.hotPathOther = patchBuffer.locationOfNearCall(m_callStructureStubCompilationInfo[i].hotPathOther);
     }
-    unsigned methodCallCount = m_methodCallCompilationInfo.size();
-    m_codeBlock->addMethodCallLinkInfos(methodCallCount);
-    for (unsigned i = 0; i < methodCallCount; ++i) {
-        MethodCallLinkInfo& info = m_codeBlock->methodCallLinkInfo(i);
-        info.bytecodeIndex = m_methodCallCompilationInfo[i].bytecodeIndex;
-        info.cachedStructure.setLocation(patchBuffer.locationOf(m_methodCallCompilationInfo[i].structureToCompare));
-        info.callReturnLocation = m_codeBlock->structureStubInfo(m_methodCallCompilationInfo[i].propertyAccessIndex).callReturnLocation;
-    }
 
 #if ENABLE(DFG_JIT) || ENABLE(LLINT)
     if (canBeOptimized()
diff --git a/Source/JavaScriptCore/jit/JIT.h b/Source/JavaScriptCore/jit/JIT.h
index cd832c21f..dcf87d352 100644
--- a/Source/JavaScriptCore/jit/JIT.h
+++ b/Source/JavaScriptCore/jit/JIT.h
@@ -150,7 +150,7 @@ namespace JSC {
     enum PropertyStubPutById_T { PropertyStubPutById };
 
     struct PropertyStubCompilationInfo {
-        enum Type { GetById, PutById, MethodCheck } m_type;
+        enum Type { GetById, PutById } m_type;
     
         unsigned bytecodeIndex;
         MacroAssembler::Call callReturnLocation;
@@ -173,10 +173,6 @@ namespace JSC {
         MacroAssembler::DataLabel32 putDisplacementLabel1;
         MacroAssembler::DataLabel32 putDisplacementLabel2;
 #endif
-        MacroAssembler::DataLabelPtr methodCheckStructureToCompare;
-        MacroAssembler::DataLabelPtr methodCheckProtoObj;
-        MacroAssembler::DataLabelPtr methodCheckProtoStructureToCompare;
-        MacroAssembler::DataLabelPtr methodCheckPutFunction;
 
 #if !ASSERT_DISABLED
         PropertyStubCompilationInfo()
@@ -241,7 +237,7 @@ namespace JSC {
 
         void slowCaseInfo(PropertyStubGetById_T, MacroAssembler::Label coldPathBegin, MacroAssembler::Call call)
         {
-            ASSERT(m_type == GetById || m_type == MethodCheck);
+            ASSERT(m_type == GetById);
             callReturnLocation = call;
             getColdPathBegin = coldPathBegin;
         }
@@ -252,15 +248,6 @@ namespace JSC {
             callReturnLocation = call;
         }
 
-        void addMethodCheckInfo(MacroAssembler::DataLabelPtr structureToCompare, MacroAssembler::DataLabelPtr protoObj, MacroAssembler::DataLabelPtr protoStructureToCompare, MacroAssembler::DataLabelPtr putFunction)
-        {
-            m_type = MethodCheck;
-            methodCheckStructureToCompare = structureToCompare;
-            methodCheckProtoObj = protoObj;
-            methodCheckProtoStructureToCompare = protoStructureToCompare;
-            methodCheckPutFunction = putFunction;
-        }
-
         void copyToStubInfo(StructureStubInfo& info, LinkBuffer &patchBuffer);
     };
 
@@ -291,18 +278,6 @@ namespace JSC {
         unsigned bytecodeIndex;
     };
 
-    struct MethodCallCompilationInfo {
-        MethodCallCompilationInfo(unsigned bytecodeIndex, unsigned propertyAccessIndex)
-            : bytecodeIndex(bytecodeIndex)
-            , propertyAccessIndex(propertyAccessIndex)
-        {
-        }
-
-        unsigned bytecodeIndex;
-        MacroAssembler::DataLabelPtr structureToCompare;
-        unsigned propertyAccessIndex;
-    };
-
     // Near calls can only be patched to other JIT code, regular calls can be patched to JIT code or relinked to stub functions.
     void ctiPatchNearCallByReturnAddress(CodeBlock* codeblock, ReturnAddressPtr returnAddress, MacroAssemblerCodePtr newCalleeFunction);
     void ctiPatchCallByReturnAddress(CodeBlock* codeblock, ReturnAddressPtr returnAddress, MacroAssemblerCodePtr newCalleeFunction);
@@ -407,7 +382,6 @@ namespace JSC {
         static void resetPatchPutById(RepatchBuffer&, StructureStubInfo*);
         static void patchGetByIdSelf(CodeBlock*, StructureStubInfo*, Structure*, PropertyOffset cachedOffset, ReturnAddressPtr);
         static void patchPutByIdReplace(CodeBlock*, StructureStubInfo*, Structure*, PropertyOffset cachedOffset, ReturnAddressPtr, bool direct);
-        static void patchMethodCallProto(JSGlobalData&, CodeBlock*, MethodCallLinkInfo&, StructureStubInfo&, JSObject*, Structure*, JSObject*, ReturnAddressPtr);
 
         static void compilePatchGetArrayLength(JSGlobalData* globalData, CodeBlock* codeBlock, ReturnAddressPtr returnAddress)
         {
@@ -428,6 +402,7 @@ namespace JSC {
         void privateCompileLinkPass();
         void privateCompileSlowCases();
         JITCode privateCompile(CodePtr* functionEntryArityCheck, JITCompilationEffort);
+        
         void privateCompileGetByIdProto(StructureStubInfo*, Structure*, Structure* prototypeStructure, const Identifier&, const PropertySlot&, PropertyOffset cachedOffset, ReturnAddressPtr, CallFrame*);
         void privateCompileGetByIdSelfList(StructureStubInfo*, PolymorphicAccessStructureList*, int, Structure*, const Identifier&, const PropertySlot&, PropertyOffset cachedOffset);
         void privateCompileGetByIdProtoList(StructureStubInfo*, PolymorphicAccessStructureList*, int, Structure*, Structure* prototypeStructure, const Identifier&, const PropertySlot&, PropertyOffset cachedOffset, CallFrame*);
@@ -466,7 +441,9 @@ namespace JSC {
         Jump emitJumpIfNotObject(RegisterID structureReg);
         Jump emitJumpIfNotType(RegisterID baseReg, RegisterID scratchReg, JSType);
 
-        void testPrototype(JSValue, JumpList& failureCases);
+        Jump addStructureTransitionCheck(JSCell*, Structure*, StructureStubInfo*, RegisterID scratch);
+        void addStructureTransitionCheck(JSCell*, Structure*, StructureStubInfo*, JumpList& failureCases, RegisterID scratch);
+        void testPrototype(JSValue, JumpList& failureCases, StructureStubInfo*);
 
         enum WriteBarrierMode { UnconditionalWriteBarrier, ShouldFilterImmediates };
         // value register in write barrier is used before any scratch registers
@@ -543,8 +520,8 @@ namespace JSC {
         void emitJumpSlowCaseIfNotJSCell(int virtualRegisterIndex);
         void emitJumpSlowCaseIfNotJSCell(int virtualRegisterIndex, RegisterID tag);
 
-        void compileGetByIdHotPath();
-        void compileGetByIdSlowCase(int resultVReg, int baseVReg, Identifier* ident, Vector<SlowCaseEntry>::iterator& iter, bool isMethodCheck = false);
+        void compileGetByIdHotPath(Identifier*);
+        void compileGetByIdSlowCase(int resultVReg, int baseVReg, Identifier*, Vector<SlowCaseEntry>::iterator&);
         void compileGetDirectOffset(RegisterID base, RegisterID resultTag, RegisterID resultPayload, PropertyOffset cachedOffset);
         void compileGetDirectOffset(JSObject* base, RegisterID resultTag, RegisterID resultPayload, PropertyOffset cachedOffset);
         void compileGetDirectOffset(RegisterID base, RegisterID resultTag, RegisterID resultPayload, RegisterID offset, FinalObjectMode = MayBeFinal);
@@ -559,9 +536,6 @@ namespace JSC {
         // sequenceOpCall
         static const int sequenceOpCallInstructionSpace = 12;
         static const int sequenceOpCallConstantSpace = 2;
-        // sequenceMethodCheck
-        static const int sequenceMethodCheckInstructionSpace = 40;
-        static const int sequenceMethodCheckConstantSpace = 6;
         // sequenceGetByIdHotPath
         static const int sequenceGetByIdHotPathInstructionSpace = 36;
         static const int sequenceGetByIdHotPathConstantSpace = 4;
@@ -575,9 +549,6 @@ namespace JSC {
         // sequenceOpCall
         static const int sequenceOpCallInstructionSpace = 12;
         static const int sequenceOpCallConstantSpace = 2;
-        // sequenceMethodCheck
-        static const int sequenceMethodCheckInstructionSpace = 40;
-        static const int sequenceMethodCheckConstantSpace = 6;
         // sequenceGetByIdHotPath
         static const int sequenceGetByIdHotPathInstructionSpace = 36;
         static const int sequenceGetByIdHotPathConstantSpace = 5;
@@ -626,7 +597,7 @@ namespace JSC {
         void compileBinaryArithOpSlowCase(OpcodeID, Vector<SlowCaseEntry>::iterator&, unsigned dst, unsigned src1, unsigned src2, OperandTypes, bool op1HasImmediateIntFastCase, bool op2HasImmediateIntFastCase);
 
         void compileGetByIdHotPath(int baseVReg, Identifier*);
-        void compileGetByIdSlowCase(int resultVReg, int baseVReg, Identifier* ident, Vector<SlowCaseEntry>::iterator& iter, bool isMethodCheck = false);
+        void compileGetByIdSlowCase(int resultVReg, int baseVReg, Identifier*, Vector<SlowCaseEntry>::iterator&);
         void compileGetDirectOffset(RegisterID base, RegisterID result, PropertyOffset cachedOffset);
         void compileGetDirectOffset(JSObject* base, RegisterID result, PropertyOffset cachedOffset);
         void compileGetDirectOffset(RegisterID base, RegisterID result, RegisterID offset, RegisterID scratch, FinalObjectMode = MayBeFinal);
@@ -708,7 +679,6 @@ namespace JSC {
         void emit_op_loop_if_true(Instruction*);
         void emit_op_loop_if_false(Instruction*);
         void emit_op_lshift(Instruction*);
-        void emit_op_method_check(Instruction*);
         void emit_op_mod(Instruction*);
         void emit_op_mov(Instruction*);
         void emit_op_mul(Instruction*);
@@ -761,7 +731,7 @@ namespace JSC {
         void emit_op_tear_off_activation(Instruction*);
         void emit_op_tear_off_arguments(Instruction*);
         void emit_op_throw(Instruction*);
-        void emit_op_throw_reference_error(Instruction*);
+        void emit_op_throw_static_error(Instruction*);
         void emit_op_to_jsnumber(Instruction*);
         void emit_op_to_primitive(Instruction*);
         void emit_op_unexpected_load(Instruction*);
@@ -803,7 +773,6 @@ namespace JSC {
         void emitSlow_op_loop_if_true(Instruction*, Vector<SlowCaseEntry>::iterator&);
         void emitSlow_op_loop_if_false(Instruction*, Vector<SlowCaseEntry>::iterator&);
         void emitSlow_op_lshift(Instruction*, Vector<SlowCaseEntry>::iterator&);
-        void emitSlow_op_method_check(Instruction*, Vector<SlowCaseEntry>::iterator&);
         void emitSlow_op_mod(Instruction*, Vector<SlowCaseEntry>::iterator&);
         void emitSlow_op_mul(Instruction*, Vector<SlowCaseEntry>::iterator&);
         void emitSlow_op_negate(Instruction*, Vector<SlowCaseEntry>::iterator&);
@@ -933,7 +902,6 @@ namespace JSC {
         Vector<PropertyStubCompilationInfo> m_propertyAccessCompilationInfo;
         Vector<ByValCompilationInfo> m_byValCompilationInfo;
         Vector<StructureStubCompilationInfo> m_callStructureStubCompilationInfo;
-        Vector<MethodCallCompilationInfo> m_methodCallCompilationInfo;
         Vector<JumpTable> m_jmpTable;
 
         unsigned m_bytecodeOffset;
diff --git a/Source/JavaScriptCore/jit/JITDriver.h b/Source/JavaScriptCore/jit/JITDriver.h
index 318b4e7aa..645c65b28 100644
--- a/Source/JavaScriptCore/jit/JITDriver.h
+++ b/Source/JavaScriptCore/jit/JITDriver.h
@@ -75,7 +75,7 @@ inline bool jitCompileIfAppropriate(ExecState* exec, OwnPtr<CodeBlockType>& code
     return true;
 }
 
-inline bool jitCompileFunctionIfAppropriate(ExecState* exec, OwnPtr<FunctionCodeBlock>& codeBlock, JITCode& jitCode, MacroAssemblerCodePtr& jitCodeWithArityCheck, WriteBarrier<SharedSymbolTable>& symbolTable, JITCode::JITType jitType, unsigned bytecodeIndex, JITCompilationEffort effort)
+inline bool jitCompileFunctionIfAppropriate(ExecState* exec, OwnPtr<FunctionCodeBlock>& codeBlock, JITCode& jitCode, MacroAssemblerCodePtr& jitCodeWithArityCheck, JITCode::JITType jitType, unsigned bytecodeIndex, JITCompilationEffort effort)
 {
     JSGlobalData& globalData = exec->globalData();
     
@@ -99,7 +99,6 @@ inline bool jitCompileFunctionIfAppropriate(ExecState* exec, OwnPtr<FunctionCode
     } else {
         if (codeBlock->alternative()) {
             codeBlock = static_pointer_cast<FunctionCodeBlock>(codeBlock->releaseAlternative());
-            symbolTable.set(exec->globalData(), codeBlock->ownerExecutable(), codeBlock->symbolTable());
             jitCode = oldJITCode;
             jitCodeWithArityCheck = oldJITCodeWithArityCheck;
             return false;
diff --git a/Source/JavaScriptCore/jit/JITOpcodes.cpp b/Source/JavaScriptCore/jit/JITOpcodes.cpp
index 07c8ace2a..249dcbac9 100644
--- a/Source/JavaScriptCore/jit/JITOpcodes.cpp
+++ b/Source/JavaScriptCore/jit/JITOpcodes.cpp
@@ -1069,13 +1069,14 @@ void JIT::emit_op_switch_string(Instruction* currentInstruction)
     jump(regT0);
 }
 
-void JIT::emit_op_throw_reference_error(Instruction* currentInstruction)
+void JIT::emit_op_throw_static_error(Instruction* currentInstruction)
 {
-    JITStubCall stubCall(this, cti_op_throw_reference_error);
+    JITStubCall stubCall(this, cti_op_throw_static_error);
     if (!m_codeBlock->getConstant(currentInstruction[1].u.operand).isNumber())
         stubCall.addArgument(TrustedImm64(JSValue::encode(m_codeBlock->getConstant(currentInstruction[1].u.operand))));
     else
         stubCall.addArgument(Imm64(JSValue::encode(m_codeBlock->getConstant(currentInstruction[1].u.operand))));
+    stubCall.addArgument(TrustedImm32(currentInstruction[2].u.operand));
     stubCall.call();
 }
 
diff --git a/Source/JavaScriptCore/jit/JITOpcodes32_64.cpp b/Source/JavaScriptCore/jit/JITOpcodes32_64.cpp
index 44123be19..9c5d260ab 100644
--- a/Source/JavaScriptCore/jit/JITOpcodes32_64.cpp
+++ b/Source/JavaScriptCore/jit/JITOpcodes32_64.cpp
@@ -1401,12 +1401,13 @@ void JIT::emit_op_switch_string(Instruction* currentInstruction)
     jump(regT0);
 }
 
-void JIT::emit_op_throw_reference_error(Instruction* currentInstruction)
+void JIT::emit_op_throw_static_error(Instruction* currentInstruction)
 {
     unsigned message = currentInstruction[1].u.operand;
 
-    JITStubCall stubCall(this, cti_op_throw_reference_error);
+    JITStubCall stubCall(this, cti_op_throw_static_error);
     stubCall.addArgument(m_codeBlock->getConstant(message));
+    stubCall.addArgument(TrustedImm32(currentInstruction[2].u.operand));
     stubCall.call();
 }
 
diff --git a/Source/JavaScriptCore/jit/JITPropertyAccess.cpp b/Source/JavaScriptCore/jit/JITPropertyAccess.cpp
index b7be821f6..6362598f4 100644
--- a/Source/JavaScriptCore/jit/JITPropertyAccess.cpp
+++ b/Source/JavaScriptCore/jit/JITPropertyAccess.cpp
@@ -440,71 +440,6 @@ void JIT::emit_op_del_by_id(Instruction* currentInstruction)
     stubCall.call(currentInstruction[1].u.operand);
 }
 
-void JIT::emit_op_method_check(Instruction* currentInstruction)
-{
-    // Assert that the following instruction is a get_by_id.
-    ASSERT(m_interpreter->getOpcodeID((currentInstruction + OPCODE_LENGTH(op_method_check))->u.opcode) == op_get_by_id
-        || m_interpreter->getOpcodeID((currentInstruction + OPCODE_LENGTH(op_method_check))->u.opcode) == op_get_by_id_out_of_line);
-
-    currentInstruction += OPCODE_LENGTH(op_method_check);
-    unsigned resultVReg = currentInstruction[1].u.operand;
-    unsigned baseVReg = currentInstruction[2].u.operand;
-    Identifier* ident = &(m_codeBlock->identifier(currentInstruction[3].u.operand));
-
-    emitGetVirtualRegister(baseVReg, regT0);
-
-    // Do the method check - check the object & its prototype's structure inline (this is the common case).
-    m_methodCallCompilationInfo.append(MethodCallCompilationInfo(m_bytecodeOffset, m_propertyAccessCompilationInfo.size()));
-    MethodCallCompilationInfo& info = m_methodCallCompilationInfo.last();
-
-    Jump notCell = emitJumpIfNotJSCell(regT0);
-
-    BEGIN_UNINTERRUPTED_SEQUENCE(sequenceMethodCheck);
-
-    Jump structureCheck = branchPtrWithPatch(NotEqual, Address(regT0, JSCell::structureOffset()), info.structureToCompare, TrustedImmPtr(reinterpret_cast<void*>(patchGetByIdDefaultStructure)));
-    DataLabelPtr protoStructureToCompare, protoObj = moveWithPatch(TrustedImmPtr(0), regT1);
-    Jump protoStructureCheck = branchPtrWithPatch(NotEqual, Address(regT1, JSCell::structureOffset()), protoStructureToCompare, TrustedImmPtr(reinterpret_cast<void*>(patchGetByIdDefaultStructure)));
-
-    // This will be relinked to load the function without doing a load.
-    DataLabelPtr putFunction = moveWithPatch(TrustedImmPtr(0), regT0);
-
-    END_UNINTERRUPTED_SEQUENCE(sequenceMethodCheck);
-
-    Jump match = jump();
-
-    // Link the failure cases here.
-    notCell.link(this);
-    structureCheck.link(this);
-    protoStructureCheck.link(this);
-
-    // Do a regular(ish) get_by_id (the slow case will be link to
-    // cti_op_get_by_id_method_check instead of cti_op_get_by_id.
-    compileGetByIdHotPath(baseVReg, ident);
-
-    match.link(this);
-    emitValueProfilingSite(m_bytecodeOffset + OPCODE_LENGTH(op_method_check));
-    emitPutVirtualRegister(resultVReg);
-
-    // We've already generated the following get_by_id, so make sure it's skipped over.
-    m_bytecodeOffset += OPCODE_LENGTH(op_get_by_id);
-
-    m_propertyAccessCompilationInfo.last().addMethodCheckInfo(info.structureToCompare, protoObj, protoStructureToCompare, putFunction);
-}
-
-void JIT::emitSlow_op_method_check(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
-{
-    currentInstruction += OPCODE_LENGTH(op_method_check);
-    unsigned resultVReg = currentInstruction[1].u.operand;
-    unsigned baseVReg = currentInstruction[2].u.operand;
-    Identifier* ident = &(m_codeBlock->identifier(currentInstruction[3].u.operand));
-
-    compileGetByIdSlowCase(resultVReg, baseVReg, ident, iter, true);
-    emitValueProfilingSite(m_bytecodeOffset + OPCODE_LENGTH(op_method_check));
-
-    // We've already generated the following get_by_id, so make sure it's skipped over.
-    m_bytecodeOffset += OPCODE_LENGTH(op_get_by_id);
-}
-
 void JIT::emit_op_get_by_id(Instruction* currentInstruction)
 {
     unsigned resultVReg = currentInstruction[1].u.operand;
@@ -517,7 +452,7 @@ void JIT::emit_op_get_by_id(Instruction* currentInstruction)
     emitPutVirtualRegister(resultVReg);
 }
 
-void JIT::compileGetByIdHotPath(int baseVReg, Identifier*)
+void JIT::compileGetByIdHotPath(int baseVReg, Identifier* ident)
 {
     // As for put_by_id, get_by_id requires the offset of the Structure and the offset of the access to be patched.
     // Additionally, for get_by_id we need patch the offset of the branch to the slow case (we patch this to jump
@@ -525,6 +460,11 @@ void JIT::compileGetByIdHotPath(int baseVReg, Identifier*)
     // to jump back to if one of these trampolies finds a match.
 
     emitJumpSlowCaseIfNotJSCell(regT0, baseVReg);
+    
+    if (*ident == m_globalData->propertyNames->length && canBeOptimized()) {
+        loadPtr(Address(regT0, JSCell::structureOffset()), regT1);
+        emitArrayProfilingSiteForBytecodeIndex(regT1, regT2, m_bytecodeOffset);
+    }
 
     BEGIN_UNINTERRUPTED_SEQUENCE(sequenceGetByIdHotPath);
 
@@ -550,11 +490,11 @@ void JIT::emitSlow_op_get_by_id(Instruction* currentInstruction, Vector<SlowCase
     unsigned baseVReg = currentInstruction[2].u.operand;
     Identifier* ident = &(m_codeBlock->identifier(currentInstruction[3].u.operand));
 
-    compileGetByIdSlowCase(resultVReg, baseVReg, ident, iter, false);
+    compileGetByIdSlowCase(resultVReg, baseVReg, ident, iter);
     emitValueProfilingSite();
 }
 
-void JIT::compileGetByIdSlowCase(int resultVReg, int baseVReg, Identifier* ident, Vector<SlowCaseEntry>::iterator& iter, bool isMethodCheck)
+void JIT::compileGetByIdSlowCase(int resultVReg, int baseVReg, Identifier* ident, Vector<SlowCaseEntry>::iterator& iter)
 {
     // As for the hot path of get_by_id, above, we ensure that we can use an architecture specific offset
     // so that we only need track one pointer into the slow case code - we track a pointer to the location
@@ -568,7 +508,7 @@ void JIT::compileGetByIdSlowCase(int resultVReg, int baseVReg, Identifier* ident
     BEGIN_UNINTERRUPTED_SEQUENCE(sequenceGetByIdSlowCase);
 
     Label coldPathBegin(this);
-    JITStubCall stubCall(this, isMethodCheck ? cti_op_get_by_id_method_check : cti_op_get_by_id);
+    JITStubCall stubCall(this, cti_op_get_by_id);
     stubCall.addArgument(regT0);
     stubCall.addArgument(TrustedImmPtr(ident));
     Call call = stubCall.call(resultVReg);
@@ -676,7 +616,7 @@ void JIT::privateCompilePutByIdTransition(StructureStubInfo* stubInfo, Structure
     failureCases.append(emitJumpIfNotJSCell(regT0));
     failureCases.append(branchPtr(NotEqual, Address(regT0, JSCell::structureOffset()), TrustedImmPtr(oldStructure)));
     
-    testPrototype(oldStructure->storedPrototype(), failureCases);
+    testPrototype(oldStructure->storedPrototype(), failureCases, stubInfo);
     
     ASSERT(oldStructure->storedPrototype().isNull() || oldStructure->storedPrototype().asCell()->structure() == chain->head()->get());
 
@@ -684,7 +624,7 @@ void JIT::privateCompilePutByIdTransition(StructureStubInfo* stubInfo, Structure
     if (!direct) {
         for (WriteBarrier<Structure>* it = chain->head(); *it; ++it) {
             ASSERT((*it)->storedPrototype().isNull() || (*it)->storedPrototype().asCell()->structure() == it[1].get());
-            testPrototype((*it)->storedPrototype(), failureCases);
+            testPrototype((*it)->storedPrototype(), failureCases, stubInfo);
         }
     }
 
@@ -788,7 +728,6 @@ void JIT::privateCompilePatchGetArrayLength(ReturnAddressPtr returnAddress)
 
     // Check eax is an array
     loadPtr(Address(regT0, JSCell::structureOffset()), regT2);
-    emitArrayProfilingSiteForBytecodeIndex(regT2, regT1, stubInfo->bytecodeIndex);
     Jump failureCases1 = branchTest32(Zero, regT2, TrustedImm32(IsArray));
     Jump failureCases2 = branchTest32(Zero, regT2, TrustedImm32(IndexingShapeMask));
 
@@ -837,8 +776,7 @@ void JIT::privateCompileGetByIdProto(StructureStubInfo* stubInfo, Structure* str
     Jump failureCases1 = checkStructure(regT0, structure);
 
     // Check the prototype object's Structure had not changed.
-    move(TrustedImmPtr(protoObject), regT3);
-    Jump failureCases2 = branchPtr(NotEqual, Address(regT3, JSCell::structureOffset()), TrustedImmPtr(prototypeStructure));
+    Jump failureCases2 = addStructureTransitionCheck(protoObject, prototypeStructure, stubInfo, regT3);
 
     bool needsStubLink = false;
     
@@ -867,7 +805,8 @@ void JIT::privateCompileGetByIdProto(StructureStubInfo* stubInfo, Structure* str
     // Use the patch information to link the failure cases back to the original slow case routine.
     CodeLocationLabel slowCaseBegin = stubInfo->callReturnLocation.labelAtOffset(-stubInfo->patch.baseline.u.get.coldPathBegin);
     patchBuffer.link(failureCases1, slowCaseBegin);
-    patchBuffer.link(failureCases2, slowCaseBegin);
+    if (failureCases2.isSet())
+        patchBuffer.link(failureCases2, slowCaseBegin);
 
     // On success return back to the hot patch code, at a point it will perform the store to dest for us.
     patchBuffer.link(success, stubInfo->hotPathBegin.labelAtOffset(stubInfo->patch.baseline.u.get.putResult));
@@ -972,8 +911,7 @@ void JIT::privateCompileGetByIdProtoList(StructureStubInfo* stubInfo, Polymorphi
     Jump failureCases1 = checkStructure(regT0, structure);
 
     // Check the prototype object's Structure had not changed.
-    move(TrustedImmPtr(protoObject), regT3);
-    Jump failureCases2 = branchPtr(NotEqual, Address(regT3, JSCell::structureOffset()), TrustedImmPtr(prototypeStructure));
+    Jump failureCases2 = addStructureTransitionCheck(protoObject, prototypeStructure, stubInfo, regT3);
 
     // Checks out okay!
     bool needsStubLink = false;
@@ -1013,7 +951,8 @@ void JIT::privateCompileGetByIdProtoList(StructureStubInfo* stubInfo, Polymorphi
     // Use the patch information to link the failure cases back to the original slow case routine.
     CodeLocationLabel lastProtoBegin = CodeLocationLabel(JITStubRoutine::asCodePtr(prototypeStructures->list[currentIndex - 1].stubRoutine));
     patchBuffer.link(failureCases1, lastProtoBegin);
-    patchBuffer.link(failureCases2, lastProtoBegin);
+    if (failureCases2.isSet())
+        patchBuffer.link(failureCases2, lastProtoBegin);
 
     // On success return back to the hot patch code, at a point it will perform the store to dest for us.
     patchBuffer.link(success, stubInfo->hotPathBegin.labelAtOffset(stubInfo->patch.baseline.u.get.putResult));
@@ -1050,7 +989,7 @@ void JIT::privateCompileGetByIdChainList(StructureStubInfo* stubInfo, Polymorphi
     for (unsigned i = 0; i < count; ++i, ++it) {
         protoObject = asObject(currStructure->prototypeForLookup(callFrame));
         currStructure = it->get();
-        testPrototype(protoObject, bucketsOfFail);
+        testPrototype(protoObject, bucketsOfFail, stubInfo);
     }
     ASSERT(protoObject);
     
@@ -1129,7 +1068,7 @@ void JIT::privateCompileGetByIdChain(StructureStubInfo* stubInfo, Structure* str
     for (unsigned i = 0; i < count; ++i, ++it) {
         protoObject = asObject(currStructure->prototypeForLookup(callFrame));
         currStructure = it->get();
-        testPrototype(protoObject, bucketsOfFail);
+        testPrototype(protoObject, bucketsOfFail, stubInfo);
     }
     ASSERT(protoObject);
 
@@ -1304,28 +1243,40 @@ void JIT::emitWriteBarrier(JSCell* owner, RegisterID value, RegisterID scratch,
 #endif
 }
 
-void JIT::testPrototype(JSValue prototype, JumpList& failureCases)
+JIT::Jump JIT::addStructureTransitionCheck(JSCell* object, Structure* structure, StructureStubInfo* stubInfo, RegisterID scratch)
 {
-    if (prototype.isNull())
-        return;
-
-    ASSERT(prototype.isCell());
-    move(TrustedImmPtr(prototype.asCell()), regT3);
-    failureCases.append(branchPtr(NotEqual, Address(regT3, JSCell::structureOffset()), TrustedImmPtr(prototype.asCell()->structure())));
+    if (object->structure() == structure && structure->transitionWatchpointSetIsStillValid()) {
+        structure->addTransitionWatchpoint(stubInfo->addWatchpoint(m_codeBlock));
+#if !ASSERT_DISABLED
+        move(TrustedImmPtr(object), scratch);
+        Jump ok = branchPtr(Equal, Address(scratch, JSCell::structureOffset()), TrustedImmPtr(structure));
+        breakpoint();
+        ok.link(this);
+#endif
+        Jump result; // Returning an unset jump this way because otherwise VC++ would complain.
+        return result;
+    }
+    
+    move(TrustedImmPtr(object), scratch);
+    return branchPtr(NotEqual, Address(scratch, JSCell::structureOffset()), TrustedImmPtr(structure));
 }
 
-void JIT::patchMethodCallProto(JSGlobalData& globalData, CodeBlock* codeBlock, MethodCallLinkInfo& methodCallLinkInfo, StructureStubInfo& stubInfo, JSObject* callee, Structure* structure, JSObject* proto, ReturnAddressPtr returnAddress)
+void JIT::addStructureTransitionCheck(JSCell* object, Structure* structure, StructureStubInfo* stubInfo, JumpList& failureCases, RegisterID scratch)
 {
-    RepatchBuffer repatchBuffer(codeBlock);
-    
-    CodeLocationDataLabelPtr structureLocation = methodCallLinkInfo.cachedStructure.location();
-    methodCallLinkInfo.cachedStructure.set(globalData, structureLocation, codeBlock->ownerExecutable(), structure);
+    Jump failureCase = addStructureTransitionCheck(object, structure, stubInfo, scratch);
+    if (!failureCase.isSet())
+        return;
     
-    Structure* prototypeStructure = proto->structure();
-    methodCallLinkInfo.cachedPrototypeStructure.set(globalData, structureLocation.dataLabelPtrAtOffset(stubInfo.patch.baseline.methodCheckProtoStructureToCompare), codeBlock->ownerExecutable(), prototypeStructure);
-    methodCallLinkInfo.cachedPrototype.set(globalData, structureLocation.dataLabelPtrAtOffset(stubInfo.patch.baseline.methodCheckProtoObj), codeBlock->ownerExecutable(), proto);
-    methodCallLinkInfo.cachedFunction.set(globalData, structureLocation.dataLabelPtrAtOffset(stubInfo.patch.baseline.methodCheckPutFunction), codeBlock->ownerExecutable(), callee);
-    repatchBuffer.relinkCallerToFunction(returnAddress, FunctionPtr(cti_op_get_by_id_method_check_update));
+    failureCases.append(failureCase);
+}
+
+void JIT::testPrototype(JSValue prototype, JumpList& failureCases, StructureStubInfo* stubInfo)
+{
+    if (prototype.isNull())
+        return;
+
+    ASSERT(prototype.isCell());
+    addStructureTransitionCheck(prototype.asCell(), prototype.asCell()->structure(), stubInfo, failureCases, regT3);
 }
 
 bool JIT::isDirectPutById(StructureStubInfo* stubInfo)
@@ -1377,9 +1328,11 @@ void JIT::privateCompileGetByVal(ByValInfo* byValInfo, ReturnAddressPtr returnAd
         slowCases = emitIntTypedArrayGetByVal(currentInstruction, badType, m_globalData->int32ArrayDescriptor(), 4, SignedTypedArray);
         break;
     case JITUint8Array:
-    case JITUint8ClampedArray:
         slowCases = emitIntTypedArrayGetByVal(currentInstruction, badType, m_globalData->uint8ArrayDescriptor(), 1, UnsignedTypedArray);
         break;
+    case JITUint8ClampedArray:
+        slowCases = emitIntTypedArrayGetByVal(currentInstruction, badType, m_globalData->uint8ClampedArrayDescriptor(), 1, UnsignedTypedArray);
+        break;
     case JITUint16Array:
         slowCases = emitIntTypedArrayGetByVal(currentInstruction, badType, m_globalData->uint16ArrayDescriptor(), 2, UnsignedTypedArray);
         break;
@@ -1400,8 +1353,8 @@ void JIT::privateCompileGetByVal(ByValInfo* byValInfo, ReturnAddressPtr returnAd
 
     LinkBuffer patchBuffer(*m_globalData, this, m_codeBlock);
     
-    patchBuffer.link(badType, CodeLocationLabel(returnAddress.value()).labelAtOffset(byValInfo->returnAddressToSlowPath));
-    patchBuffer.link(slowCases, CodeLocationLabel(returnAddress.value()).labelAtOffset(byValInfo->returnAddressToSlowPath));
+    patchBuffer.link(badType, CodeLocationLabel(MacroAssemblerCodePtr::createFromExecutableAddress(returnAddress.value())).labelAtOffset(byValInfo->returnAddressToSlowPath));
+    patchBuffer.link(slowCases, CodeLocationLabel(MacroAssemblerCodePtr::createFromExecutableAddress(returnAddress.value())).labelAtOffset(byValInfo->returnAddressToSlowPath));
     
     patchBuffer.link(done, byValInfo->badTypeJump.labelAtOffset(byValInfo->badTypeJumpToDone));
     
@@ -1580,7 +1533,7 @@ JIT::JumpList JIT::emitFloatTypedArrayGetByVal(Instruction*, PatchableJump& badT
     case 8: {
         loadDouble(BaseIndex(base, property, TimesEight), fpRegT0);
         Jump notNaN = branchDouble(DoubleEqual, fpRegT0, fpRegT0);
-        static const double NaN = std::numeric_limits<double>::quiet_NaN();
+        static const double NaN = QNaN;
         loadDouble(&NaN, fpRegT0);
         notNaN.link(this);
         break;
diff --git a/Source/JavaScriptCore/jit/JITPropertyAccess32_64.cpp b/Source/JavaScriptCore/jit/JITPropertyAccess32_64.cpp
index 5d619b94b..939766f04 100644
--- a/Source/JavaScriptCore/jit/JITPropertyAccess32_64.cpp
+++ b/Source/JavaScriptCore/jit/JITPropertyAccess32_64.cpp
@@ -91,72 +91,6 @@ void JIT::emit_op_del_by_id(Instruction* currentInstruction)
     stubCall.call(dst);
 }
 
-void JIT::emit_op_method_check(Instruction* currentInstruction)
-{
-    // Assert that the following instruction is a get_by_id.
-    ASSERT(m_interpreter->getOpcodeID((currentInstruction + OPCODE_LENGTH(op_method_check))->u.opcode) == op_get_by_id
-        || m_interpreter->getOpcodeID((currentInstruction + OPCODE_LENGTH(op_method_check))->u.opcode) == op_get_by_id_out_of_line);
-    
-    currentInstruction += OPCODE_LENGTH(op_method_check);
-    
-    // Do the method check - check the object & its prototype's structure inline (this is the common case).
-    m_methodCallCompilationInfo.append(MethodCallCompilationInfo(m_bytecodeOffset, m_propertyAccessCompilationInfo.size()));
-    MethodCallCompilationInfo& info = m_methodCallCompilationInfo.last();
-    
-    int dst = currentInstruction[1].u.operand;
-    int base = currentInstruction[2].u.operand;
-    
-    emitLoad(base, regT1, regT0);
-    emitJumpSlowCaseIfNotJSCell(base, regT1);
-    
-    BEGIN_UNINTERRUPTED_SEQUENCE(sequenceMethodCheck);
-    
-    Jump structureCheck = branchPtrWithPatch(NotEqual, Address(regT0, JSCell::structureOffset()), info.structureToCompare, TrustedImmPtr(reinterpret_cast<void*>(patchGetByIdDefaultStructure)));
-    DataLabelPtr protoStructureToCompare, protoObj = moveWithPatch(TrustedImmPtr(0), regT2);
-    Jump protoStructureCheck = branchPtrWithPatch(NotEqual, Address(regT2, JSCell::structureOffset()), protoStructureToCompare, TrustedImmPtr(reinterpret_cast<void*>(patchGetByIdDefaultStructure)));
-    
-    // This will be relinked to load the function without doing a load.
-    DataLabelPtr putFunction = moveWithPatch(TrustedImmPtr(0), regT0);
-    
-    END_UNINTERRUPTED_SEQUENCE(sequenceMethodCheck);
-    
-    move(TrustedImm32(JSValue::CellTag), regT1);
-    Jump match = jump();
-    
-    // Link the failure cases here.
-    structureCheck.link(this);
-    protoStructureCheck.link(this);
-    
-    // Do a regular(ish) get_by_id (the slow case will be link to
-    // cti_op_get_by_id_method_check instead of cti_op_get_by_id.
-    compileGetByIdHotPath();
-    
-    match.link(this);
-    emitValueProfilingSite(m_bytecodeOffset + OPCODE_LENGTH(op_method_check));
-    emitStore(dst, regT1, regT0);
-    map(m_bytecodeOffset + OPCODE_LENGTH(op_method_check) + OPCODE_LENGTH(op_get_by_id), dst, regT1, regT0);
-    
-    // We've already generated the following get_by_id, so make sure it's skipped over.
-    m_bytecodeOffset += OPCODE_LENGTH(op_get_by_id);
-
-    m_propertyAccessCompilationInfo.last().addMethodCheckInfo(info.structureToCompare, protoObj, protoStructureToCompare, putFunction);
-}
-
-void JIT::emitSlow_op_method_check(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
-{
-    currentInstruction += OPCODE_LENGTH(op_method_check);
-    
-    int dst = currentInstruction[1].u.operand;
-    int base = currentInstruction[2].u.operand;
-    int ident = currentInstruction[3].u.operand;
-    
-    compileGetByIdSlowCase(dst, base, &(m_codeBlock->identifier(ident)), iter, true);
-    emitValueProfilingSite(m_bytecodeOffset + OPCODE_LENGTH(op_method_check));
-    
-    // We've already generated the following get_by_id, so make sure it's skipped over.
-    m_bytecodeOffset += OPCODE_LENGTH(op_get_by_id);
-}
-
 JIT::CodeRef JIT::stringGetByValStubGenerator(JSGlobalData* globalData)
 {
     JSInterfaceJIT jit;
@@ -453,22 +387,28 @@ void JIT::emit_op_get_by_id(Instruction* currentInstruction)
 {
     int dst = currentInstruction[1].u.operand;
     int base = currentInstruction[2].u.operand;
+    Identifier* ident = &(m_codeBlock->identifier(currentInstruction[3].u.operand));
     
     emitLoad(base, regT1, regT0);
     emitJumpSlowCaseIfNotJSCell(base, regT1);
-    compileGetByIdHotPath();
+    compileGetByIdHotPath(ident);
     emitValueProfilingSite();
     emitStore(dst, regT1, regT0);
     map(m_bytecodeOffset + OPCODE_LENGTH(op_get_by_id), dst, regT1, regT0);
 }
 
-void JIT::compileGetByIdHotPath()
+void JIT::compileGetByIdHotPath(Identifier* ident)
 {
     // As for put_by_id, get_by_id requires the offset of the Structure and the offset of the access to be patched.
     // Additionally, for get_by_id we need patch the offset of the branch to the slow case (we patch this to jump
     // to array-length / prototype access tranpolines, and finally we also the the property-map access offset as a label
     // to jump back to if one of these trampolies finds a match.
     
+    if (*ident == m_globalData->propertyNames->length && canBeOptimized()) {
+        loadPtr(Address(regT0, JSCell::structureOffset()), regT2);
+        emitArrayProfilingSiteForBytecodeIndex(regT2, regT3, m_bytecodeOffset);
+    }
+
     BEGIN_UNINTERRUPTED_SEQUENCE(sequenceGetByIdHotPath);
     
     Label hotPathBegin(this);
@@ -498,7 +438,7 @@ void JIT::emitSlow_op_get_by_id(Instruction* currentInstruction, Vector<SlowCase
     emitValueProfilingSite();
 }
 
-void JIT::compileGetByIdSlowCase(int dst, int base, Identifier* ident, Vector<SlowCaseEntry>::iterator& iter, bool isMethodCheck)
+void JIT::compileGetByIdSlowCase(int dst, int base, Identifier* ident, Vector<SlowCaseEntry>::iterator& iter)
 {
     // As for the hot path of get_by_id, above, we ensure that we can use an architecture specific offset
     // so that we only need track one pointer into the slow case code - we track a pointer to the location
@@ -511,7 +451,7 @@ void JIT::compileGetByIdSlowCase(int dst, int base, Identifier* ident, Vector<Sl
     BEGIN_UNINTERRUPTED_SEQUENCE(sequenceGetByIdSlowCase);
     
     Label coldPathBegin(this);
-    JITStubCall stubCall(this, isMethodCheck ? cti_op_get_by_id_method_check : cti_op_get_by_id);
+    JITStubCall stubCall(this, cti_op_get_by_id);
     stubCall.addArgument(regT1, regT0);
     stubCall.addArgument(TrustedImmPtr(ident));
     Call call = stubCall.call(dst);
@@ -624,12 +564,12 @@ void JIT::privateCompilePutByIdTransition(StructureStubInfo* stubInfo, Structure
     JumpList failureCases;
     failureCases.append(branch32(NotEqual, regT1, TrustedImm32(JSValue::CellTag)));
     failureCases.append(branchPtr(NotEqual, Address(regT0, JSCell::structureOffset()), TrustedImmPtr(oldStructure)));
-    testPrototype(oldStructure->storedPrototype(), failureCases);
+    testPrototype(oldStructure->storedPrototype(), failureCases, stubInfo);
     
     if (!direct) {
         // Verify that nothing in the prototype chain has a setter for this property. 
         for (WriteBarrier<Structure>* it = chain->head(); *it; ++it)
-            testPrototype((*it)->storedPrototype(), failureCases);
+            testPrototype((*it)->storedPrototype(), failureCases, stubInfo);
     }
 
     // If we succeed in all of our checks, and the code was optimizable, then make sure we
@@ -751,7 +691,6 @@ void JIT::privateCompilePatchGetArrayLength(ReturnAddressPtr returnAddress)
     
     // Check for array
     loadPtr(Address(regT0, JSCell::structureOffset()), regT2);
-    emitArrayProfilingSiteForBytecodeIndex(regT2, regT3, stubInfo->bytecodeIndex);
     Jump failureCases1 = branchTest32(Zero, regT2, TrustedImm32(IsArray));
     Jump failureCases2 = branchTest32(Zero, regT2, TrustedImm32(IndexingShapeMask));
     
@@ -802,8 +741,7 @@ void JIT::privateCompileGetByIdProto(StructureStubInfo* stubInfo, Structure* str
     Jump failureCases1 = checkStructure(regT0, structure);
     
     // Check the prototype object's Structure had not changed.
-    move(TrustedImmPtr(protoObject), regT3);
-    Jump failureCases2 = branchPtr(NotEqual, Address(regT3, JSCell::structureOffset()), TrustedImmPtr(prototypeStructure));
+    Jump failureCases2 = addStructureTransitionCheck(protoObject, prototypeStructure, stubInfo, regT3);
 
     bool needsStubLink = false;
     // Checks out okay!
@@ -833,7 +771,8 @@ void JIT::privateCompileGetByIdProto(StructureStubInfo* stubInfo, Structure* str
     // Use the patch information to link the failure cases back to the original slow case routine.
     CodeLocationLabel slowCaseBegin = stubInfo->callReturnLocation.labelAtOffset(-stubInfo->patch.baseline.u.get.coldPathBegin);
     patchBuffer.link(failureCases1, slowCaseBegin);
-    patchBuffer.link(failureCases2, slowCaseBegin);
+    if (failureCases2.isSet())
+        patchBuffer.link(failureCases2, slowCaseBegin);
     
     // On success return back to the hot patch code, at a point it will perform the store to dest for us.
     patchBuffer.link(success, stubInfo->hotPathBegin.labelAtOffset(stubInfo->patch.baseline.u.get.putResult));
@@ -942,8 +881,7 @@ void JIT::privateCompileGetByIdProtoList(StructureStubInfo* stubInfo, Polymorphi
     Jump failureCases1 = checkStructure(regT0, structure);
     
     // Check the prototype object's Structure had not changed.
-    move(TrustedImmPtr(protoObject), regT3);
-    Jump failureCases2 = branchPtr(NotEqual, Address(regT3, JSCell::structureOffset()), TrustedImmPtr(prototypeStructure));
+    Jump failureCases2 = addStructureTransitionCheck(protoObject, prototypeStructure, stubInfo, regT3);
     
     bool needsStubLink = false;
     bool isDirect = false;
@@ -980,7 +918,8 @@ void JIT::privateCompileGetByIdProtoList(StructureStubInfo* stubInfo, Polymorphi
     // Use the patch information to link the failure cases back to the original slow case routine.
     CodeLocationLabel lastProtoBegin = CodeLocationLabel(JITStubRoutine::asCodePtr(prototypeStructures->list[currentIndex - 1].stubRoutine));
     patchBuffer.link(failureCases1, lastProtoBegin);
-    patchBuffer.link(failureCases2, lastProtoBegin);
+    if (failureCases2.isSet())
+        patchBuffer.link(failureCases2, lastProtoBegin);
     
     // On success return back to the hot patch code, at a point it will perform the store to dest for us.
     patchBuffer.link(success, stubInfo->hotPathBegin.labelAtOffset(stubInfo->patch.baseline.u.get.putResult));
@@ -1019,7 +958,7 @@ void JIT::privateCompileGetByIdChainList(StructureStubInfo* stubInfo, Polymorphi
     for (unsigned i = 0; i < count; ++i, ++it) {
         protoObject = asObject(currStructure->prototypeForLookup(callFrame));
         currStructure = it->get();
-        testPrototype(protoObject, bucketsOfFail);
+        testPrototype(protoObject, bucketsOfFail, stubInfo);
     }
     ASSERT(protoObject);
     
@@ -1098,7 +1037,7 @@ void JIT::privateCompileGetByIdChain(StructureStubInfo* stubInfo, Structure* str
     for (unsigned i = 0; i < count; ++i, ++it) {
         protoObject = asObject(currStructure->prototypeForLookup(callFrame));
         currStructure = it->get();
-        testPrototype(protoObject, bucketsOfFail);
+        testPrototype(protoObject, bucketsOfFail, stubInfo);
     }
     ASSERT(protoObject);
     
diff --git a/Source/JavaScriptCore/jit/JITStubs.cpp b/Source/JavaScriptCore/jit/JITStubs.cpp
index ba8c76cfb..5ddb98dee 100644
--- a/Source/JavaScriptCore/jit/JITStubs.cpp
+++ b/Source/JavaScriptCore/jit/JITStubs.cpp
@@ -864,7 +864,10 @@ NEVER_INLINE void JITThunks::tryCachePutByID(CallFrame* callFrame, CodeBlock* co
         }
 
         // put_by_id_transition checks the prototype chain for setters.
-        normalizePrototypeChain(callFrame, baseCell);
+        if (normalizePrototypeChain(callFrame, baseCell) == InvalidPrototypeChain) {
+            ctiPatchCallByReturnAddress(codeBlock, returnAddress, FunctionPtr(direct ? cti_op_put_by_id_direct_generic : cti_op_put_by_id_generic));
+            return;
+        }
 
         StructureChain* prototypeChain = structure->prototypeChain(callFrame);
         ASSERT(structure->previousID()->transitionWatchpointSetHasBeenInvalidated());
@@ -937,7 +940,7 @@ NEVER_INLINE void JITThunks::tryCacheGetByID(CallFrame* callFrame, CodeBlock* co
 
     if (slot.slotBase() == structure->prototypeForLookup(callFrame)) {
         ASSERT(slot.slotBase().isObject());
-
+        
         JSObject* slotBaseObject = asObject(slot.slotBase());
         size_t offset = slot.cachedOffset();
         
@@ -958,7 +961,7 @@ NEVER_INLINE void JITThunks::tryCacheGetByID(CallFrame* callFrame, CodeBlock* co
 
     PropertyOffset offset = slot.cachedOffset();
     size_t count = normalizePrototypeChain(callFrame, baseValue, slot.slotBase(), propertyName, offset);
-    if (!count) {
+    if (count == InvalidPrototypeChain) {
         stubInfo->accessType = access_get_by_id_generic;
         return;
     }
@@ -1512,178 +1515,6 @@ DEFINE_STUB_FUNCTION(JSObject*, op_put_by_id_transition_realloc)
     return base;
 }
 
-DEFINE_STUB_FUNCTION(EncodedJSValue, op_get_by_id_method_check)
-{
-    STUB_INIT_STACK_FRAME(stackFrame);
-
-    CallFrame* callFrame = stackFrame.callFrame;
-    Identifier& ident = stackFrame.args[1].identifier();
-
-    CodeBlock* codeBlock = stackFrame.callFrame->codeBlock();
-    MethodCallLinkInfo& methodCallLinkInfo = codeBlock->getMethodCallLinkInfo(STUB_RETURN_ADDRESS);
-    StructureStubInfo& stubInfo = codeBlock->getStubInfo(STUB_RETURN_ADDRESS);
-    AccessType accessType = static_cast<AccessType>(stubInfo.accessType);
-
-    JSValue baseValue = stackFrame.args[0].jsValue();
-    PropertySlot slot(baseValue);
-    JSValue result = baseValue.get(callFrame, ident, slot);
-    CHECK_FOR_EXCEPTION();
-    
-    if (accessType != static_cast<AccessType>(stubInfo.accessType))
-        return JSValue::encode(result);
-
-    if (!methodCallLinkInfo.seenOnce()) {
-        methodCallLinkInfo.setSeen();
-        return JSValue::encode(result);
-    }
-
-    // If we successfully got something, then the base from which it is being accessed must
-    // be an object.  (Assertion to ensure asObject() call below is safe, which comes after
-    // an isCacheable() chceck.
-    ASSERT(!slot.isCacheableValue() || slot.slotBase().isObject());
-
-    // Check that:
-    //   * We're dealing with a JSCell,
-    //   * the property is cachable,
-    //   * it's not a dictionary
-    //   * there is a function cached.
-    Structure* structure;
-    JSCell* specific;
-    JSObject* slotBaseObject;
-    if (baseValue.isCell()
-        && slot.isCacheableValue()
-        && !(structure = baseValue.asCell()->structure())->isUncacheableDictionary()
-        && (slotBaseObject = asObject(slot.slotBase()))->getPropertySpecificValue(callFrame, ident, specific)
-        && specific
-        ) {
-
-        JSObject* callee = asObject(specific);
-
-        // Since we're accessing a prototype in a loop, it's a good bet that it
-        // should not be treated as a dictionary.
-        if (slotBaseObject->structure()->isDictionary())
-            slotBaseObject->flattenDictionaryObject(callFrame->globalData());
-
-        // The result fetched should always be the callee!
-        ASSERT(result == JSValue(callee));
-
-        // Check to see if the function is on the object's prototype.  Patch up the code to optimize.
-        if (slot.slotBase() == structure->prototypeForLookup(callFrame)) {
-            JIT::patchMethodCallProto(callFrame->globalData(), codeBlock, methodCallLinkInfo, stubInfo, callee, structure, slotBaseObject, STUB_RETURN_ADDRESS);
-            return JSValue::encode(result);
-        }
-
-        // Check to see if the function is on the object itself.
-        // Since we generate the method-check to check both the structure and a prototype-structure (since this
-        // is the common case) we have a problem - we need to patch the prototype structure check to do something
-        // useful.  We could try to nop it out altogether, but that's a little messy, so lets do something simpler
-        // for now.  For now it performs a check on a special object on the global object only used for this
-        // purpose.  The object is in no way exposed, and as such the check will always pass.
-        if (slot.slotBase() == baseValue) {
-            JIT::patchMethodCallProto(callFrame->globalData(), codeBlock, methodCallLinkInfo, stubInfo, callee, structure, callFrame->scope()->globalObject()->methodCallDummy(), STUB_RETURN_ADDRESS);
-            return JSValue::encode(result);
-        }
-    }
-
-    // Revert the get_by_id op back to being a regular get_by_id - allow it to cache like normal, if it needs to.
-    ctiPatchCallByReturnAddress(codeBlock, STUB_RETURN_ADDRESS, FunctionPtr(cti_op_get_by_id));
-    return JSValue::encode(result);
-}
-
-DEFINE_STUB_FUNCTION(EncodedJSValue, op_get_by_id_method_check_update)
-{
-    STUB_INIT_STACK_FRAME(stackFrame);
-
-    CallFrame* callFrame = stackFrame.callFrame;
-    Identifier& ident = stackFrame.args[1].identifier();
-
-    CodeBlock* codeBlock = stackFrame.callFrame->codeBlock();
-    MethodCallLinkInfo& methodCallLinkInfo = codeBlock->getMethodCallLinkInfo(STUB_RETURN_ADDRESS);
-    StructureStubInfo& stubInfo = codeBlock->getStubInfo(STUB_RETURN_ADDRESS);
-    AccessType accessType = static_cast<AccessType>(stubInfo.accessType);
-
-    JSValue baseValue = stackFrame.args[0].jsValue();
-    PropertySlot slot(baseValue);
-    JSValue result = baseValue.get(callFrame, ident, slot);
-    CHECK_FOR_EXCEPTION();
-    
-    if (accessType != static_cast<AccessType>(stubInfo.accessType))
-        return JSValue::encode(result);
-
-    ASSERT(methodCallLinkInfo.seenOnce());
-
-    // If we successfully got something, then the base from which it is being accessed must
-    // be an object.  (Assertion to ensure asObject() call below is safe, which comes after
-    // an isCacheable() chceck.
-    ASSERT(!slot.isCacheableValue() || slot.slotBase().isObject());
-
-    // Check that:
-    //   * We're dealing with a JSCell,
-    //   * the property is cachable,
-    //   * it's not a dictionary
-    //   * there is a function cached.
-    Structure* structure;
-    JSCell* specific;
-    JSObject* slotBaseObject;
-    if (!(baseValue.isCell()
-          && slot.isCacheableValue()
-          && !(structure = baseValue.asCell()->structure())->isUncacheableDictionary()
-          && (slotBaseObject = asObject(slot.slotBase()))->getPropertySpecificValue(callFrame, ident, specific)
-          && specific
-          )
-        || (slot.slotBase() != structure->prototypeForLookup(callFrame)
-            && slot.slotBase() != baseValue)) {
-        // Revert the get_by_id op back to being a regular get_by_id - allow it to cache like normal, if it needs to.
-        ctiPatchCallByReturnAddress(codeBlock, STUB_RETURN_ADDRESS, FunctionPtr(cti_op_get_by_id));
-        return JSValue::encode(result);
-    }
-    
-    // Now check if the situation has changed sufficiently that we should bail out of
-    // doing method_check optimizations entirely, or if it changed only slightly, in
-    // which case we can just repatch.
-    
-    JSValue proto = structure->prototypeForLookup(callFrame);
-    
-    bool previousWasProto = methodCallLinkInfo.cachedPrototype.get() != codeBlock->globalObject()->methodCallDummy();
-    bool currentIsProto = slot.slotBase() == proto;
-    
-    JSObject* callee = asObject(specific);
-    
-    if (previousWasProto != currentIsProto
-        || !structure->transitivelyTransitionedFrom(methodCallLinkInfo.cachedStructure.get())
-        || (previousWasProto && !slotBaseObject->structure()->transitivelyTransitionedFrom(methodCallLinkInfo.cachedPrototypeStructure.get()))
-        || specific != methodCallLinkInfo.cachedFunction.get()) {
-        ctiPatchCallByReturnAddress(codeBlock, STUB_RETURN_ADDRESS, FunctionPtr(cti_op_get_by_id));
-        return JSValue::encode(result);
-    }
-    
-    // It makes sense to simply repatch the method_check.
-    
-    // Since we're accessing a prototype in a loop, it's a good bet that it
-    // should not be treated as a dictionary.
-    if (slotBaseObject->structure()->isDictionary())
-        slotBaseObject->flattenDictionaryObject(callFrame->globalData());
-    
-    // The result fetched should always be the callee!
-    ASSERT(result == JSValue(callee));
-    
-    // Check to see if the function is on the object's prototype. Patch up the code to optimize.
-    if (slot.slotBase() == proto) {
-        JIT::patchMethodCallProto(callFrame->globalData(), codeBlock, methodCallLinkInfo, stubInfo, callee, structure, slotBaseObject, STUB_RETURN_ADDRESS);
-        return JSValue::encode(result);
-    }
-    
-    ASSERT(slot.slotBase() == baseValue);
-    
-    // Since we generate the method-check to check both the structure and a prototype-structure (since this
-    // is the common case) we have a problem - we need to patch the prototype structure check to do something
-    // useful. We could try to nop it out altogether, but that's a little messy, so lets do something simpler
-    // for now. For now it performs a check on a special object on the global object only used for this
-    // purpose. The object is in no way exposed, and as such the check will always pass.
-    JIT::patchMethodCallProto(callFrame->globalData(), codeBlock, methodCallLinkInfo, stubInfo, callee, structure, callFrame->scope()->globalObject()->methodCallDummy(), STUB_RETURN_ADDRESS);
-    return JSValue::encode(result);
-}
-
 DEFINE_STUB_FUNCTION(EncodedJSValue, op_get_by_id)
 {
     STUB_INIT_STACK_FRAME(stackFrame);
@@ -1873,7 +1704,13 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_get_by_id_proto_list)
             if (listIndex == (POLYMORPHIC_LIST_CACHE_SIZE - 1))
                 ctiPatchCallByReturnAddress(codeBlock, STUB_RETURN_ADDRESS, FunctionPtr(cti_op_get_by_id_proto_list_full));
         }
-    } else if (size_t count = normalizePrototypeChain(callFrame, baseValue, slot.slotBase(), propertyName, offset)) {
+    } else {
+        size_t count = normalizePrototypeChain(callFrame, baseValue, slot.slotBase(), propertyName, offset);
+        if (count == InvalidPrototypeChain) {
+            ctiPatchCallByReturnAddress(codeBlock, STUB_RETURN_ADDRESS, FunctionPtr(cti_op_get_by_id_proto_fail));
+            return JSValue::encode(result);
+        }
+        
         ASSERT(!baseValue.asCell()->structure()->isDictionary());
         int listIndex;
         PolymorphicAccessStructureList* prototypeStructureList = getPolymorphicAccessStructureListSlot(callFrame->globalData(), codeBlock->ownerExecutable(), stubInfo, listIndex);
@@ -1885,8 +1722,7 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_get_by_id_proto_list)
             if (listIndex == (POLYMORPHIC_LIST_CACHE_SIZE - 1))
                 ctiPatchCallByReturnAddress(codeBlock, STUB_RETURN_ADDRESS, FunctionPtr(cti_op_get_by_id_proto_list_full));
         }
-    } else
-        ctiPatchCallByReturnAddress(codeBlock, STUB_RETURN_ADDRESS, FunctionPtr(cti_op_get_by_id_proto_fail));
+    }
 
     return JSValue::encode(result);
 }
@@ -2308,7 +2144,7 @@ DEFINE_STUB_FUNCTION(JSObject*, op_push_activation)
 {
     STUB_INIT_STACK_FRAME(stackFrame);
 
-    JSActivation* activation = JSActivation::create(stackFrame.callFrame->globalData(), stackFrame.callFrame, static_cast<FunctionExecutable*>(stackFrame.callFrame->codeBlock()->ownerExecutable()));
+    JSActivation* activation = JSActivation::create(stackFrame.callFrame->globalData(), stackFrame.callFrame, stackFrame.callFrame->codeBlock());
     stackFrame.callFrame->setScope(activation);
     return activation;
 }
@@ -3500,13 +3336,16 @@ DEFINE_STUB_FUNCTION(void, op_put_getter_setter)
     baseObj->putDirectAccessor(callFrame, stackFrame.args[1].identifier(), accessor, Accessor);
 }
 
-DEFINE_STUB_FUNCTION(void, op_throw_reference_error)
+DEFINE_STUB_FUNCTION(void, op_throw_static_error)
 {
     STUB_INIT_STACK_FRAME(stackFrame);
 
     CallFrame* callFrame = stackFrame.callFrame;
     String message = stackFrame.args[0].jsValue().toString(callFrame)->value(callFrame);
-    stackFrame.globalData->exception = createReferenceError(callFrame, message);
+    if (stackFrame.args[1].asInt32)
+        stackFrame.globalData->exception = createReferenceError(callFrame, message);
+    else
+        stackFrame.globalData->exception = createTypeError(callFrame, message);
     VM_THROW_EXCEPTION_AT_END();
 }
 
diff --git a/Source/JavaScriptCore/jit/JITStubs.h b/Source/JavaScriptCore/jit/JITStubs.h
index 6e3141e22..5761236b1 100644
--- a/Source/JavaScriptCore/jit/JITStubs.h
+++ b/Source/JavaScriptCore/jit/JITStubs.h
@@ -365,8 +365,6 @@ extern "C" {
     EncodedJSValue JIT_STUB cti_op_get_by_id_custom_stub(STUB_ARGS_DECLARATION) WTF_INTERNAL;
     EncodedJSValue JIT_STUB cti_op_get_by_id_generic(STUB_ARGS_DECLARATION) WTF_INTERNAL;
     EncodedJSValue JIT_STUB cti_op_get_by_id_getter_stub(STUB_ARGS_DECLARATION) WTF_INTERNAL;
-    EncodedJSValue JIT_STUB cti_op_get_by_id_method_check(STUB_ARGS_DECLARATION) WTF_INTERNAL;
-    EncodedJSValue JIT_STUB cti_op_get_by_id_method_check_update(STUB_ARGS_DECLARATION) WTF_INTERNAL;
     EncodedJSValue JIT_STUB cti_op_get_by_id_proto_fail(STUB_ARGS_DECLARATION) WTF_INTERNAL;
     EncodedJSValue JIT_STUB cti_op_get_by_id_proto_list(STUB_ARGS_DECLARATION) WTF_INTERNAL;
     EncodedJSValue JIT_STUB cti_op_get_by_id_proto_list_full(STUB_ARGS_DECLARATION) WTF_INTERNAL;
@@ -454,7 +452,7 @@ extern "C" {
     void JIT_STUB cti_op_init_global_const_check(STUB_ARGS_DECLARATION) WTF_INTERNAL;
     void JIT_STUB cti_op_tear_off_activation(STUB_ARGS_DECLARATION) WTF_INTERNAL;
     void JIT_STUB cti_op_tear_off_arguments(STUB_ARGS_DECLARATION) WTF_INTERNAL;
-    void JIT_STUB cti_op_throw_reference_error(STUB_ARGS_DECLARATION) WTF_INTERNAL;
+    void JIT_STUB cti_op_throw_static_error(STUB_ARGS_DECLARATION) WTF_INTERNAL;
 #if ENABLE(DFG_JIT)
     void JIT_STUB cti_optimize(STUB_ARGS_DECLARATION) WTF_INTERNAL;
 #endif
diff --git a/Source/JavaScriptCore/llint/LLIntData.cpp b/Source/JavaScriptCore/llint/LLIntData.cpp
index 8e2dacf4d..eec376b37 100644
--- a/Source/JavaScriptCore/llint/LLIntData.cpp
+++ b/Source/JavaScriptCore/llint/LLIntData.cpp
@@ -103,7 +103,7 @@ void Data::performAssertions(JSGlobalData& globalData)
     ASSERT(ValueNull == TagBitTypeOther);
 #endif
     ASSERT(StringType == 5);
-    ASSERT(ObjectType == 13);
+    ASSERT(ObjectType == 17);
     ASSERT(MasqueradesAsUndefined == 1);
     ASSERT(ImplementsHasInstance == 2);
     ASSERT(ImplementsDefaultHasInstance == 8);
diff --git a/Source/JavaScriptCore/llint/LLIntOffsetsExtractor.cpp b/Source/JavaScriptCore/llint/LLIntOffsetsExtractor.cpp
index cbfff29d6..0087fe5ff 100644
--- a/Source/JavaScriptCore/llint/LLIntOffsetsExtractor.cpp
+++ b/Source/JavaScriptCore/llint/LLIntOffsetsExtractor.cpp
@@ -53,7 +53,7 @@
 
 namespace JSC {
 
-#define OFFLINE_ASM_OFFSETOF(clazz, field) OBJECT_OFFSETOF(clazz, field)
+#define OFFLINE_ASM_OFFSETOF(clazz, field) (static_cast<unsigned>(OBJECT_OFFSETOF(clazz, field)))
 
 class LLIntOffsetsExtractor {
 public:
diff --git a/Source/JavaScriptCore/llint/LLIntSlowPaths.cpp b/Source/JavaScriptCore/llint/LLIntSlowPaths.cpp
index 74beae98a..ba44bf404 100644
--- a/Source/JavaScriptCore/llint/LLIntSlowPaths.cpp
+++ b/Source/JavaScriptCore/llint/LLIntSlowPaths.cpp
@@ -460,7 +460,7 @@ LLINT_SLOW_PATH_DECL(slow_path_create_activation)
 #if LLINT_SLOW_PATH_TRACING
     dataLog("Creating an activation, exec = %p!\n", exec);
 #endif
-    JSActivation* activation = JSActivation::create(globalData, exec, static_cast<FunctionExecutable*>(exec->codeBlock()->ownerExecutable()));
+    JSActivation* activation = JSActivation::create(globalData, exec, exec->codeBlock());
     exec->setScope(activation);
     LLINT_RETURN(JSValue(activation));
 }
@@ -1001,32 +1001,32 @@ LLINT_SLOW_PATH_DECL(slow_path_put_by_id)
                     // below may GC.
                     pc[0].u.opcode = LLInt::getOpcode(llint_op_put_by_id);
 
-                    normalizePrototypeChain(exec, baseCell);
-                    
-                    ASSERT(structure->previousID()->isObject());
-                    pc[4].u.structure.set(
-                        globalData, codeBlock->ownerExecutable(), structure->previousID());
-                    if (isInlineOffset(slot.cachedOffset()))
-                        pc[5].u.operand = offsetInInlineStorage(slot.cachedOffset()) * sizeof(JSValue) + JSObject::offsetOfInlineStorage();
-                    else
-                        pc[5].u.operand = offsetInButterfly(slot.cachedOffset()) * sizeof(JSValue);
-                    pc[6].u.structure.set(
-                        globalData, codeBlock->ownerExecutable(), structure);
-                    StructureChain* chain = structure->prototypeChain(exec);
-                    ASSERT(chain);
-                    pc[7].u.structureChain.set(
-                        globalData, codeBlock->ownerExecutable(), chain);
-                    
-                    if (pc[8].u.operand) {
-                        if (isInlineOffset(slot.cachedOffset()))
-                            pc[0].u.opcode = LLInt::getOpcode(llint_op_put_by_id_transition_direct);
-                        else
-                            pc[0].u.opcode = LLInt::getOpcode(llint_op_put_by_id_transition_direct_out_of_line);
-                    } else {
+                    if (normalizePrototypeChain(exec, baseCell) != InvalidPrototypeChain) {
+                        ASSERT(structure->previousID()->isObject());
+                        pc[4].u.structure.set(
+                            globalData, codeBlock->ownerExecutable(), structure->previousID());
                         if (isInlineOffset(slot.cachedOffset()))
-                            pc[0].u.opcode = LLInt::getOpcode(llint_op_put_by_id_transition_normal);
+                            pc[5].u.operand = offsetInInlineStorage(slot.cachedOffset()) * sizeof(JSValue) + JSObject::offsetOfInlineStorage();
                         else
-                            pc[0].u.opcode = LLInt::getOpcode(llint_op_put_by_id_transition_normal_out_of_line);
+                            pc[5].u.operand = offsetInButterfly(slot.cachedOffset()) * sizeof(JSValue);
+                        pc[6].u.structure.set(
+                            globalData, codeBlock->ownerExecutable(), structure);
+                        StructureChain* chain = structure->prototypeChain(exec);
+                        ASSERT(chain);
+                        pc[7].u.structureChain.set(
+                            globalData, codeBlock->ownerExecutable(), chain);
+                    
+                        if (pc[8].u.operand) {
+                            if (isInlineOffset(slot.cachedOffset()))
+                                pc[0].u.opcode = LLInt::getOpcode(llint_op_put_by_id_transition_direct);
+                            else
+                                pc[0].u.opcode = LLInt::getOpcode(llint_op_put_by_id_transition_direct_out_of_line);
+                        } else {
+                            if (isInlineOffset(slot.cachedOffset()))
+                                pc[0].u.opcode = LLInt::getOpcode(llint_op_put_by_id_transition_normal);
+                            else
+                                pc[0].u.opcode = LLInt::getOpcode(llint_op_put_by_id_transition_normal_out_of_line);
+                        }
                     }
                 }
             } else {
@@ -1622,10 +1622,13 @@ LLINT_SLOW_PATH_DECL(slow_path_throw)
     LLINT_THROW(LLINT_OP_C(1).jsValue());
 }
 
-LLINT_SLOW_PATH_DECL(slow_path_throw_reference_error)
+LLINT_SLOW_PATH_DECL(slow_path_throw_static_error)
 {
     LLINT_BEGIN();
-    LLINT_THROW(createReferenceError(exec, LLINT_OP_C(1).jsValue().toString(exec)->value(exec)));
+    if (pc[2].u.operand)
+        LLINT_THROW(createReferenceError(exec, LLINT_OP_C(1).jsValue().toString(exec)->value(exec)));
+    else
+        LLINT_THROW(createTypeError(exec, LLINT_OP_C(1).jsValue().toString(exec)->value(exec)));
 }
 
 LLINT_SLOW_PATH_DECL(slow_path_debug)
diff --git a/Source/JavaScriptCore/llint/LLIntSlowPaths.h b/Source/JavaScriptCore/llint/LLIntSlowPaths.h
index f78476841..99fbaccfa 100644
--- a/Source/JavaScriptCore/llint/LLIntSlowPaths.h
+++ b/Source/JavaScriptCore/llint/LLIntSlowPaths.h
@@ -204,7 +204,7 @@ LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_push_with_scope);
 LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_pop_scope);
 LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_push_name_scope);
 LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_throw);
-LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_throw_reference_error);
+LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_throw_static_error);
 LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_debug);
 LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_profile_will_call);
 LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_profile_did_call);
diff --git a/Source/JavaScriptCore/llint/LowLevelInterpreter.asm b/Source/JavaScriptCore/llint/LowLevelInterpreter.asm
index 409ec4158..ba5b67df4 100644
--- a/Source/JavaScriptCore/llint/LowLevelInterpreter.asm
+++ b/Source/JavaScriptCore/llint/LowLevelInterpreter.asm
@@ -96,7 +96,7 @@ const SlowPutArrayStorageShape = 30
 
 # Type constants.
 const StringType = 5
-const ObjectType = 13
+const ObjectType = 17
 
 # Type flags constants.
 const MasqueradesAsUndefined = 1
@@ -151,11 +151,10 @@ else
 end
 
 # This must match wtf/Vector.h
+const VectorSizeOffset = 0
 if JSVALUE64
-    const VectorSizeOffset = 0
     const VectorBufferOffset = 8
 else
-    const VectorSizeOffset = 0
     const VectorBufferOffset = 4
 end
 
@@ -344,9 +343,9 @@ macro functionInitialization(profileArgSkip)
         addp t2, t3
     .argumentProfileLoop:
         if JSVALUE64
-            loadp ThisArgumentOffset + 8 - profileArgSkip * 8[cfr, t0], t2
+            loadq ThisArgumentOffset + 8 - profileArgSkip * 8[cfr, t0], t2
             subp sizeof ValueProfile, t3
-            storep t2, profileArgSkip * sizeof ValueProfile + ValueProfile::m_buckets[t3]
+            storeq t2, profileArgSkip * sizeof ValueProfile + ValueProfile::m_buckets[t3]
         else
             loadi ThisArgumentOffset + TagOffset + 8 - profileArgSkip * 8[cfr, t0], t2
             subp sizeof ValueProfile, t3
@@ -546,13 +545,13 @@ macro getPutToBaseOperationField(scratch, scratch1, fieldOffset, fieldGetter)
 end
 
 macro moveJSValueFromRegisterWithoutProfiling(value, destBuffer, destOffsetReg)
-    storep value, [destBuffer, destOffsetReg, 8]
+    storeq value, [destBuffer, destOffsetReg, 8]
 end
 
 
 macro moveJSValueFromRegistersWithoutProfiling(tag, payload, destBuffer, destOffsetReg)
-    storep tag, TagOffset[destBuffer, destOffsetReg, 8]
-    storep payload, PayloadOffset[destBuffer, destOffsetReg, 8]
+    storei tag, TagOffset[destBuffer, destOffsetReg, 8]
+    storei payload, PayloadOffset[destBuffer, destOffsetReg, 8]
 end
 
 macro putToBaseVariableBody(variableOffset, scratch1, scratch2, scratch3)
@@ -613,15 +612,15 @@ end
 
 macro moveJSValue(sourceBuffer, sourceOffsetReg, destBuffer, destOffsetReg, profileOffset, scratchRegister)
     if JSVALUE64
-        loadp [sourceBuffer, sourceOffsetReg, 8], scratchRegister
-        storep scratchRegister, [destBuffer, destOffsetReg, 8]
+        loadq [sourceBuffer, sourceOffsetReg, 8], scratchRegister
+        storeq scratchRegister, [destBuffer, destOffsetReg, 8]
         loadpFromInstruction(profileOffset, destOffsetReg)
         valueProfile(scratchRegister, destOffsetReg)
     else
-        loadp PayloadOffset[sourceBuffer, sourceOffsetReg, 8], scratchRegister
-        storep scratchRegister, PayloadOffset[destBuffer, destOffsetReg, 8]
-        loadp TagOffset[sourceBuffer, sourceOffsetReg, 8], sourceOffsetReg
-        storep sourceOffsetReg, TagOffset[destBuffer, destOffsetReg, 8]
+        loadi PayloadOffset[sourceBuffer, sourceOffsetReg, 8], scratchRegister
+        storei scratchRegister, PayloadOffset[destBuffer, destOffsetReg, 8]
+        loadi TagOffset[sourceBuffer, sourceOffsetReg, 8], sourceOffsetReg
+        storei sourceOffsetReg, TagOffset[destBuffer, destOffsetReg, 8]
         loadpFromInstruction(profileOffset, destOffsetReg)
         valueProfile(sourceOffsetReg, scratchRegister, destOffsetReg)
     end
@@ -629,29 +628,29 @@ end
 
 macro moveJSValueFromSlot(slot, destBuffer, destOffsetReg, profileOffset, scratchRegister)
     if JSVALUE64
-        loadp [slot], scratchRegister
-        storep scratchRegister, [destBuffer, destOffsetReg, 8]
+        loadq [slot], scratchRegister
+        storeq scratchRegister, [destBuffer, destOffsetReg, 8]
         loadpFromInstruction(profileOffset, destOffsetReg)
         valueProfile(scratchRegister, destOffsetReg)
     else
-        loadp PayloadOffset[slot], scratchRegister
-        storep scratchRegister, PayloadOffset[destBuffer, destOffsetReg, 8]
-        loadp TagOffset[slot], slot
-        storep slot, TagOffset[destBuffer, destOffsetReg, 8]
+        loadi PayloadOffset[slot], scratchRegister
+        storei scratchRegister, PayloadOffset[destBuffer, destOffsetReg, 8]
+        loadi TagOffset[slot], slot
+        storei slot, TagOffset[destBuffer, destOffsetReg, 8]
         loadpFromInstruction(profileOffset, destOffsetReg)
         valueProfile(slot, scratchRegister, destOffsetReg)
     end
 end
 
 macro moveJSValueFromRegister(value, destBuffer, destOffsetReg, profileOffset)
-    storep value, [destBuffer, destOffsetReg, 8]
+    storeq value, [destBuffer, destOffsetReg, 8]
     loadpFromInstruction(profileOffset, destOffsetReg)
     valueProfile(value, destOffsetReg)
 end
 
 macro moveJSValueFromRegisters(tag, payload, destBuffer, destOffsetReg, profileOffset)
-    storep tag, TagOffset[destBuffer, destOffsetReg, 8]
-    storep payload, PayloadOffset[destBuffer, destOffsetReg, 8]
+    storei tag, TagOffset[destBuffer, destOffsetReg, 8]
+    storei payload, PayloadOffset[destBuffer, destOffsetReg, 8]
     loadpFromInstruction(profileOffset, destOffsetReg)
     valueProfile(tag, payload, destOffsetReg)
 end
@@ -662,7 +661,7 @@ _llint_op_resolve_global_property:
     loadp CodeBlock[cfr], t1
     loadp CodeBlock::m_globalObject[t1], t1
     loadp ResolveOperation::m_structure[t0], t2
-    bpneq JSCell::m_structure[t1], t2, ._llint_op_resolve
+    bpneq JSCell::m_structure[t1], t2, .llint_op_resolve_local
     loadis ResolveOperation::m_offset[t0], t0
     if JSVALUE64
         loadPropertyAtVariableOffsetKnownNotInline(t0, t1, t2)
@@ -746,8 +745,8 @@ _llint_op_resolve_scoped_var_with_top_scope_check:
     moveJSValue(t1, t2, cfr, t3, 4, t0)
     dispatch(5)
 
-._llint_op_resolve:
 _llint_op_resolve:
+.llint_op_resolve_local:
     traceExecution()
     getResolveOperation(3, t0, t1)
     btpz t0, .noInstructions
@@ -781,7 +780,7 @@ _llint_op_resolve_base_to_global:
     dispatch(7)
 
 _llint_op_resolve_base_to_global_dynamic:
-    jmp ._llint_resolve_base
+    jmp _llint_op_resolve_base
 
 _llint_op_resolve_base_to_scope:
     traceExecution()
@@ -828,7 +827,6 @@ _llint_op_resolve_base_to_scope_with_top_scope_check:
     end
     dispatch(7)
 
-._llint_resolve_base:
 _llint_op_resolve_base:
     traceExecution()
     callSlowPath(_llint_slow_path_resolve_base)
@@ -888,10 +886,11 @@ macro interpretResolveWithBase(opcodeLength, slowPath)
     # t1 now contains the index for the base register
 
     bineq t2, ResolveOperationSetBaseToScope, .notSetBaseToScope
-        storep t3, PayloadOffset[cfr, t1, 8]
         if JSVALUE64
+            storeq t3, [cfr, t1, 8]
         else
-            storep CellTag, TagOffset[cfr, t1, 8]
+            storei t3, PayloadOffset[cfr, t1, 8]
+            storei CellTag, TagOffset[cfr, t1, 8]
         end
         jmp .haveSetBase
 
@@ -899,10 +898,10 @@ macro interpretResolveWithBase(opcodeLength, slowPath)
 
     bineq t2, ResolveOperationSetBaseToUndefined, .notSetBaseToUndefined
         if JSVALUE64
-            storep ValueUndefined, PayloadOffset[cfr, t1, 8]
+            storeq ValueUndefined, [cfr, t1, 8]
         else
-            storep 0, PayloadOffset[cfr, t1, 8]
-            storep UndefinedTag, TagOffset[cfr, t1, 8]
+            storei 0, PayloadOffset[cfr, t1, 8]
+            storei UndefinedTag, TagOffset[cfr, t1, 8]
         end
         jmp .haveSetBase
 
@@ -910,10 +909,11 @@ macro interpretResolveWithBase(opcodeLength, slowPath)
     bineq t2, ResolveOperationSetBaseToGlobal, .slowPath
         loadp JSCell::m_structure[t3], t2
         loadp Structure::m_globalObject[t2], t2
-        storep t2, PayloadOffset[cfr, t1, 8]
         if JSVALUE64
+            storeq t2, [cfr, t1, 8]
         else
-            storep CellTag, TagOffset[cfr, t1, 8]
+            storei t2, PayloadOffset[cfr, t1, 8]
+            storei CellTag, TagOffset[cfr, t1, 8]
         end
 
     .haveSetBase:
@@ -1204,12 +1204,6 @@ _llint_op_strcat:
     dispatch(4)
 
 
-_llint_op_method_check:
-    traceExecution()
-    # We ignore method checks and use normal get_by_id optimizations.
-    dispatch(1)
-
-
 _llint_op_get_pnames:
     traceExecution()
     callSlowPath(_llint_slow_path_get_pnames)
@@ -1240,10 +1234,10 @@ _llint_op_throw:
     dispatch(2)
 
 
-_llint_op_throw_reference_error:
+_llint_op_throw_static_error:
     traceExecution()
-    callSlowPath(_llint_slow_path_throw_reference_error)
-    dispatch(2)
+    callSlowPath(_llint_slow_path_throw_static_error)
+    dispatch(3)
 
 
 _llint_op_profile_will_call:
@@ -1332,6 +1326,8 @@ _llint_op_put_by_id_replace:
 _llint_op_put_by_id_transition:
     notSupported()
 
+_llint_op_init_global_const_nop:
+    dispatch(5)
 
 # Indicate the end of LLInt.
 _llint_end:
diff --git a/Source/JavaScriptCore/llint/LowLevelInterpreter.cpp b/Source/JavaScriptCore/llint/LowLevelInterpreter.cpp
index ebfdadfdb..a9cb393b0 100644
--- a/Source/JavaScriptCore/llint/LowLevelInterpreter.cpp
+++ b/Source/JavaScriptCore/llint/LowLevelInterpreter.cpp
@@ -122,6 +122,98 @@ static double Ints2Double(uint32_t lo, uint32_t hi)
 
 
 //============================================================================
+// CLoopRegister is the storage for an emulated CPU register.
+// It defines the policy of how ints smaller than intptr_t are packed into the
+// pseudo register, as well as hides endianness differences.
+
+struct CLoopRegister {
+    union {
+        intptr_t i;
+        uintptr_t u;
+#if USE(JSVALUE64)
+#if CPU(BIG_ENDIAN)
+        struct {
+            int32_t i32padding;
+            int32_t i32;
+        };
+        struct {
+            uint32_t u32padding;
+            uint32_t u32;
+        };
+        struct {
+            int8_t i8padding[7];
+            int8_t i8;
+        };
+        struct {
+            uint8_t u8padding[7];
+            uint8_t u8;
+        };
+#else // !CPU(BIG_ENDIAN)
+        struct {
+            int32_t i32;
+            int32_t i32padding;
+        };
+        struct {
+            uint32_t u32;
+            uint32_t u32padding;
+        };
+        struct {
+            int8_t i8;
+            int8_t i8padding[7];
+        };
+        struct {
+            uint8_t u8;
+            uint8_t u8padding[7];
+        };
+#endif // !CPU(BIG_ENDIAN)
+#else // !USE(JSVALUE64)
+        int32_t i32;
+        uint32_t u32;
+
+#if CPU(BIG_ENDIAN)
+        struct {
+            int8_t i8padding[3];
+            int8_t i8;
+        };
+        struct {
+            uint8_t u8padding[3];
+            uint8_t u8;
+        };
+
+#else // !CPU(BIG_ENDIAN)
+        struct {
+            int8_t i8;
+            int8_t i8padding[3];
+        };
+        struct {
+            uint8_t u8;
+            uint8_t u8padding[3];
+        };
+#endif // !CPU(BIG_ENDIAN)
+#endif // !USE(JSVALUE64)
+
+        int8_t* i8p;
+        void* vp;
+        ExecState* execState;
+        void* instruction;
+        NativeFunction nativeFunc;
+#if USE(JSVALUE64)
+        int64_t i64;
+        uint64_t u64;
+        EncodedJSValue encodedJSValue;
+        double castToDouble;
+#endif
+        Opcode opcode;
+    };
+
+#if USE(JSVALUE64)
+    inline void clearHighWord() { i32padding = 0; }
+#else
+    inline void clearHighWord() { }
+#endif
+};
+
+//============================================================================
 // The llint C++ interpreter loop:
 //
 
@@ -164,29 +256,12 @@ JSValue CLoop::execute(CallFrame* callFrame, OpcodeID bootstrapOpcodeId,
     ASSERT(callFrame->globalData().topCallFrame == callFrame);
 
     // Define the pseudo registers used by the LLINT C Loop backend:
-    union CLoopRegister {
-        intptr_t i;
-        uintptr_t u;
-        int32_t i32;
-        uint32_t u32;
-        int8_t i8;
-        uint8_t u8;
-        int8_t* i8p;
-        void* vp;
-        ExecState* execState;
-        void* instruction;
-        NativeFunction nativeFunc;
-#if USE(JSVALUE64)
-        int64_t i64;
-        EncodedJSValue encodedJSValue;
-        double castToDouble;
-#endif
-        Opcode opcode;
-    };
+    ASSERT(sizeof(CLoopRegister) == sizeof(intptr_t));
+
     union CLoopDoubleRegister {
         double d;
 #if USE(JSVALUE64)
-        void* castToVoidPtr;
+        int64_t castToInt64;
 #endif
     };
 
@@ -311,6 +386,7 @@ JSValue CLoop::execute(CallFrame* callFrame, OpcodeID bootstrapOpcodeId,
 
     #define DEFINE_OPCODE(__opcode) \
         case __opcode: \
+        __opcode: \
             RECORD_OPCODE_STATS(__opcode);
 
     // Dispatch to the current PC's bytecode:
@@ -417,7 +493,7 @@ JSValue CLoop::execute(CallFrame* callFrame, OpcodeID bootstrapOpcodeId,
     // compiler on all such labels:
     #define LLINT_OPCODE_ENTRY(__opcode, length) \
         UNUSED_LABEL(__opcode);
-        FOR_EACH_LLINT_NATIVE_HELPER(LLINT_OPCODE_ENTRY)
+        FOR_EACH_OPCODE_ID(LLINT_OPCODE_ENTRY);
     #undef LLINT_OPCODE_ENTRY
 
 
diff --git a/Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm b/Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm
index d0072d714..ffb146247 100644
--- a/Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm
+++ b/Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm
@@ -984,7 +984,7 @@ _llint_op_init_global_const:
     writeBarrier(t2, t3)
     storei t2, TagOffset[t0]
     storei t3, PayloadOffset[t0]
-    dispatch(3)
+    dispatch(5)
 
 
 _llint_op_init_global_const_check:
@@ -1320,8 +1320,8 @@ _llint_op_put_by_val:
         storeb 1, ArrayProfile::m_mayStoreToHole[t1]
     end
     addi 1, ArrayStorage::m_numValuesInVector[t0]
-    bib t2, -sizeof IndexingHeader + IndexingHeader::m_publicLength[t0], .opPutByValArrayStorageStoreResult
-    addi 1, t2, t1
+    bib t3, -sizeof IndexingHeader + IndexingHeader::m_publicLength[t0], .opPutByValArrayStorageStoreResult
+    addi 1, t3, t1
     storei t1, -sizeof IndexingHeader + IndexingHeader::m_publicLength[t0]
     jmp .opPutByValArrayStorageStoreResult
 
diff --git a/Source/JavaScriptCore/llint/LowLevelInterpreter64.asm b/Source/JavaScriptCore/llint/LowLevelInterpreter64.asm
index 59fa18ccf..c9900b343 100644
--- a/Source/JavaScriptCore/llint/LowLevelInterpreter64.asm
+++ b/Source/JavaScriptCore/llint/LowLevelInterpreter64.asm
@@ -33,21 +33,29 @@ const ValueUndefined  = TagBitTypeOther | TagBitUndefined
 const ValueNull       = TagBitTypeOther
 
 # Utilities.
+macro jumpToInstruction()
+    jmp [PB, PC, 8]
+end
+
 macro dispatch(advance)
     addp advance, PC
-    jmp [PB, PC, 8]
+    jumpToInstruction()
 end
 
 macro dispatchInt(advance)
     addi advance, PC
-    jmp [PB, PC, 8]
+    jumpToInstruction()
+end
+
+macro dispatchIntIndirect(offset)
+    dispatchInt(offset * 8[PB, PC, 8])
 end
 
 macro dispatchAfterCall()
     loadi ArgumentCount + TagOffset[cfr], PC
     loadp CodeBlock[cfr], PB
     loadp CodeBlock::m_instructions[PB], PB
-    jmp [PB, PC, 8]
+    jumpToInstruction()
 end
 
 macro cCall2(function, arg1, arg2)
@@ -87,7 +95,7 @@ macro restoreStateAfterCCall()
     move t1, cfr
     move t3, PB
     subp PB, PC
-    urshiftp 3, PC
+    rshiftp 3, PC
 end
 
 macro callSlowPath(slowPath)
@@ -137,24 +145,24 @@ end
 # Index and value must be different registers. Index may be clobbered.
 macro loadConstantOrVariable(index, value)
     bpgteq index, FirstConstantRegisterIndex, .constant
-    loadp [cfr, index, 8], value
+    loadq [cfr, index, 8], value
     jmp .done
 .constant:
     loadp CodeBlock[cfr], value
     loadp CodeBlock::m_constantRegisters + VectorBufferOffset[value], value
     subp FirstConstantRegisterIndex, index
-    loadp [value, index, 8], value
+    loadq [value, index, 8], value
 .done:
 end
 
 macro loadConstantOrVariableInt32(index, value, slow)
     loadConstantOrVariable(index, value)
-    bpb value, tagTypeNumber, slow
+    bqb value, tagTypeNumber, slow
 end
 
 macro loadConstantOrVariableCell(index, value, slow)
     loadConstantOrVariable(index, value)
-    btpnz value, tagMask, slow
+    btqnz value, tagMask, slow
 end
 
 macro writeBarrier(value)
@@ -163,7 +171,7 @@ end
 
 macro valueProfile(value, profile)
     if VALUE_PROFILER
-        storep value, ValueProfile::m_buckets[profile]
+        storeq value, ValueProfile::m_buckets[profile]
     end
 end
 
@@ -200,7 +208,7 @@ _llint_op_enter:
     move ValueUndefined, t0
 .opEnterLoop:
     subi 1, t2
-    storep t0, [cfr, t2, 8]
+    storeq t0, [cfr, t2, 8]
     btinz t2, .opEnterLoop
 .opEnterDone:
     dispatch(1)
@@ -208,8 +216,8 @@ _llint_op_enter:
 
 _llint_op_create_activation:
     traceExecution()
-    loadis 8[PB, PC, 8], t0
-    bpneq [cfr, t0, 8], ValueEmpty, .opCreateActivationDone
+    loadisFromInstruction(1, t0)
+    bqneq [cfr, t0, 8], ValueEmpty, .opCreateActivationDone
     callSlowPath(_llint_slow_path_create_activation)
 .opCreateActivationDone:
     dispatch(2)
@@ -217,15 +225,15 @@ _llint_op_create_activation:
 
 _llint_op_init_lazy_reg:
     traceExecution()
-    loadis 8[PB, PC, 8], t0
-    storep ValueEmpty, [cfr, t0, 8]
+    loadisFromInstruction(1, t0)
+    storeq ValueEmpty, [cfr, t0, 8]
     dispatch(2)
 
 
 _llint_op_create_arguments:
     traceExecution()
-    loadis 8[PB, PC, 8], t0
-    bpneq [cfr, t0, 8], ValueEmpty, .opCreateArgumentsDone
+    loadisFromInstruction(1, t0)
+    bqneq [cfr, t0, 8], ValueEmpty, .opCreateArgumentsDone
     callSlowPath(_llint_slow_path_create_arguments)
 .opCreateArgumentsDone:
     dispatch(2)
@@ -237,8 +245,8 @@ _llint_op_create_this:
     loadp JSFunction::m_cachedInheritorID[t0], t2
     btpz t2, .opCreateThisSlow
     allocateBasicJSObject(JSFinalObjectSizeClassIndex, t2, t0, t1, t3, .opCreateThisSlow)
-    loadis 8[PB, PC, 8], t1
-    storep t0, [cfr, t1, 8]
+    loadisFromInstruction(1, t1)
+    storeq t0, [cfr, t1, 8]
     dispatch(2)
 
 .opCreateThisSlow:
@@ -248,12 +256,12 @@ _llint_op_create_this:
 
 _llint_op_convert_this:
     traceExecution()
-    loadis 8[PB, PC, 8], t0
-    loadp [cfr, t0, 8], t0
-    btpnz t0, tagMask, .opConvertThisSlow
+    loadisFromInstruction(1, t0)
+    loadq [cfr, t0, 8], t0
+    btqnz t0, tagMask, .opConvertThisSlow
     loadp JSCell::m_structure[t0], t0
     bbb Structure::m_typeInfo + TypeInfo::m_type[t0], ObjectType, .opConvertThisSlow
-    loadp 16[PB, PC, 8], t1
+    loadpFromInstruction(2, t1)
     valueProfile(t0, t1)
     dispatch(3)
 
@@ -268,8 +276,8 @@ _llint_op_new_object:
     loadp CodeBlock::m_globalObject[t0], t0
     loadp JSGlobalObject::m_emptyObjectStructure[t0], t1
     allocateBasicJSObject(JSFinalObjectSizeClassIndex, t1, t0, t2, t3, .opNewObjectSlow)
-    loadis 8[PB, PC, 8], t1
-    storep t0, [cfr, t1, 8]
+    loadisFromInstruction(1, t1)
+    storeq t0, [cfr, t1, 8]
     dispatch(2)
 
 .opNewObjectSlow:
@@ -279,22 +287,22 @@ _llint_op_new_object:
 
 _llint_op_mov:
     traceExecution()
-    loadis 16[PB, PC, 8], t1
-    loadis 8[PB, PC, 8], t0
+    loadisFromInstruction(2, t1)
+    loadisFromInstruction(1, t0)
     loadConstantOrVariable(t1, t2)
-    storep t2, [cfr, t0, 8]
+    storeq t2, [cfr, t0, 8]
     dispatch(3)
 
 
 _llint_op_not:
     traceExecution()
-    loadis 16[PB, PC, 8], t0
-    loadis 8[PB, PC, 8], t1
+    loadisFromInstruction(2, t0)
+    loadisFromInstruction(1, t1)
     loadConstantOrVariable(t0, t2)
-    xorp ValueFalse, t2
-    btpnz t2, ~1, .opNotSlow
-    xorp ValueTrue, t2
-    storep t2, [cfr, t1, 8]
+    xorq ValueFalse, t2
+    btqnz t2, ~1, .opNotSlow
+    xorq ValueTrue, t2
+    storeq t2, [cfr, t1, 8]
     dispatch(3)
 
 .opNotSlow:
@@ -304,14 +312,14 @@ _llint_op_not:
 
 macro equalityComparison(integerComparison, slowPath)
     traceExecution()
-    loadis 24[PB, PC, 8], t0
-    loadis 16[PB, PC, 8], t2
-    loadis 8[PB, PC, 8], t3
+    loadisFromInstruction(3, t0)
+    loadisFromInstruction(2, t2)
+    loadisFromInstruction(1, t3)
     loadConstantOrVariableInt32(t0, t1, .slow)
     loadConstantOrVariableInt32(t2, t0, .slow)
     integerComparison(t0, t1, t0)
-    orp ValueFalse, t0
-    storep t0, [cfr, t3, 8]
+    orq ValueFalse, t0
+    storeq t0, [cfr, t3, 8]
     dispatch(4)
 
 .slow:
@@ -332,9 +340,9 @@ _llint_op_neq:
 
 
 macro equalNullComparison()
-    loadis 16[PB, PC, 8], t0
-    loadp [cfr, t0, 8], t0
-    btpnz t0, tagMask, .immediate
+    loadisFromInstruction(2, t0)
+    loadq [cfr, t0, 8], t0
+    btqnz t0, tagMask, .immediate
     loadp JSCell::m_structure[t0], t2
     btbnz Structure::m_typeInfo + TypeInfo::m_flags[t2], MasqueradesAsUndefined, .masqueradesAsUndefined
     move 0, t0
@@ -345,48 +353,48 @@ macro equalNullComparison()
     cpeq Structure::m_globalObject[t2], t0, t0
     jmp .done
 .immediate:
-    andp ~TagBitUndefined, t0
-    cpeq t0, ValueNull, t0
+    andq ~TagBitUndefined, t0
+    cqeq t0, ValueNull, t0
 .done:
 end
 
 _llint_op_eq_null:
     traceExecution()
     equalNullComparison()
-    loadis 8[PB, PC, 8], t1
-    orp ValueFalse, t0
-    storep t0, [cfr, t1, 8]
+    loadisFromInstruction(1, t1)
+    orq ValueFalse, t0
+    storeq t0, [cfr, t1, 8]
     dispatch(3)
 
 
 _llint_op_neq_null:
     traceExecution()
     equalNullComparison()
-    loadis 8[PB, PC, 8], t1
-    xorp ValueTrue, t0
-    storep t0, [cfr, t1, 8]
+    loadisFromInstruction(1, t1)
+    xorq ValueTrue, t0
+    storeq t0, [cfr, t1, 8]
     dispatch(3)
 
 
 macro strictEq(equalityOperation, slowPath)
     traceExecution()
-    loadis 24[PB, PC, 8], t0
-    loadis 16[PB, PC, 8], t2
+    loadisFromInstruction(3, t0)
+    loadisFromInstruction(2, t2)
     loadConstantOrVariable(t0, t1)
     loadConstantOrVariable(t2, t0)
     move t0, t2
-    orp t1, t2
-    btpz t2, tagMask, .slow
-    bpaeq t0, tagTypeNumber, .leftOK
-    btpnz t0, tagTypeNumber, .slow
+    orq t1, t2
+    btqz t2, tagMask, .slow
+    bqaeq t0, tagTypeNumber, .leftOK
+    btqnz t0, tagTypeNumber, .slow
 .leftOK:
-    bpaeq t1, tagTypeNumber, .rightOK
-    btpnz t1, tagTypeNumber, .slow
+    bqaeq t1, tagTypeNumber, .rightOK
+    btqnz t1, tagTypeNumber, .slow
 .rightOK:
     equalityOperation(t0, t1, t0)
-    loadis 8[PB, PC, 8], t1
-    orp ValueFalse, t0
-    storep t0, [cfr, t1, 8]
+    loadisFromInstruction(1, t1)
+    orq ValueFalse, t0
+    storeq t0, [cfr, t1, 8]
     dispatch(4)
 
 .slow:
@@ -396,24 +404,24 @@ end
 
 _llint_op_stricteq:
     strictEq(
-        macro (left, right, result) cpeq left, right, result end,
+        macro (left, right, result) cqeq left, right, result end,
         _llint_slow_path_stricteq)
 
 
 _llint_op_nstricteq:
     strictEq(
-        macro (left, right, result) cpneq left, right, result end,
+        macro (left, right, result) cqneq left, right, result end,
         _llint_slow_path_nstricteq)
 
 
 macro preOp(arithmeticOperation, slowPath)
     traceExecution()
-    loadis 8[PB, PC, 8], t0
-    loadp [cfr, t0, 8], t1
-    bpb t1, tagTypeNumber, .slow
+    loadisFromInstruction(1, t0)
+    loadq [cfr, t0, 8], t1
+    bqb t1, tagTypeNumber, .slow
     arithmeticOperation(t1, .slow)
-    orp tagTypeNumber, t1
-    storep t1, [cfr, t0, 8]
+    orq tagTypeNumber, t1
+    storeq t1, [cfr, t0, 8]
     dispatch(2)
 
 .slow:
@@ -435,16 +443,16 @@ _llint_op_pre_dec:
 
 macro postOp(arithmeticOperation, slowPath)
     traceExecution()
-    loadis 16[PB, PC, 8], t0
-    loadis 8[PB, PC, 8], t1
-    loadp [cfr, t0, 8], t2
+    loadisFromInstruction(2, t0)
+    loadisFromInstruction(1, t1)
+    loadq [cfr, t0, 8], t2
     bieq t0, t1, .done
-    bpb t2, tagTypeNumber, .slow
+    bqb t2, tagTypeNumber, .slow
     move t2, t3
     arithmeticOperation(t3, .slow)
-    orp tagTypeNumber, t3
-    storep t2, [cfr, t1, 8]
-    storep t3, [cfr, t0, 8]
+    orq tagTypeNumber, t3
+    storeq t2, [cfr, t1, 8]
+    storeq t3, [cfr, t0, 8]
 .done:
     dispatch(3)
 
@@ -467,13 +475,13 @@ _llint_op_post_dec:
 
 _llint_op_to_jsnumber:
     traceExecution()
-    loadis 16[PB, PC, 8], t0
-    loadis 8[PB, PC, 8], t1
+    loadisFromInstruction(2, t0)
+    loadisFromInstruction(1, t1)
     loadConstantOrVariable(t0, t2)
-    bpaeq t2, tagTypeNumber, .opToJsnumberIsImmediate
-    btpz t2, tagTypeNumber, .opToJsnumberSlow
+    bqaeq t2, tagTypeNumber, .opToJsnumberIsImmediate
+    btqz t2, tagTypeNumber, .opToJsnumberSlow
 .opToJsnumberIsImmediate:
-    storep t2, [cfr, t1, 8]
+    storeq t2, [cfr, t1, 8]
     dispatch(3)
 
 .opToJsnumberSlow:
@@ -483,19 +491,19 @@ _llint_op_to_jsnumber:
 
 _llint_op_negate:
     traceExecution()
-    loadis 16[PB, PC, 8], t0
-    loadis 8[PB, PC, 8], t1
+    loadisFromInstruction(2, t0)
+    loadisFromInstruction(1, t1)
     loadConstantOrVariable(t0, t2)
-    bpb t2, tagTypeNumber, .opNegateNotInt
+    bqb t2, tagTypeNumber, .opNegateNotInt
     btiz t2, 0x7fffffff, .opNegateSlow
     negi t2
-    orp tagTypeNumber, t2
-    storep t2, [cfr, t1, 8]
+    orq tagTypeNumber, t2
+    storeq t2, [cfr, t1, 8]
     dispatch(3)
 .opNegateNotInt:
-    btpz t2, tagTypeNumber, .opNegateSlow
-    xorp 0x8000000000000000, t2
-    storep t2, [cfr, t1, 8]
+    btqz t2, tagTypeNumber, .opNegateSlow
+    xorq 0x8000000000000000, t2
+    storeq t2, [cfr, t1, 8]
     dispatch(3)
 
 .opNegateSlow:
@@ -504,47 +512,47 @@ _llint_op_negate:
 
 
 macro binaryOpCustomStore(integerOperationAndStore, doubleOperation, slowPath)
-    loadis 24[PB, PC, 8], t0
-    loadis 16[PB, PC, 8], t2
+    loadisFromInstruction(3, t0)
+    loadisFromInstruction(2, t2)
     loadConstantOrVariable(t0, t1)
     loadConstantOrVariable(t2, t0)
-    bpb t0, tagTypeNumber, .op1NotInt
-    bpb t1, tagTypeNumber, .op2NotInt
-    loadis 8[PB, PC, 8], t2
+    bqb t0, tagTypeNumber, .op1NotInt
+    bqb t1, tagTypeNumber, .op2NotInt
+    loadisFromInstruction(1, t2)
     integerOperationAndStore(t1, t0, .slow, t2)
     dispatch(5)
 
 .op1NotInt:
     # First operand is definitely not an int, the second operand could be anything.
-    btpz t0, tagTypeNumber, .slow
-    bpaeq t1, tagTypeNumber, .op1NotIntOp2Int
-    btpz t1, tagTypeNumber, .slow
-    addp tagTypeNumber, t1
-    fp2d t1, ft1
+    btqz t0, tagTypeNumber, .slow
+    bqaeq t1, tagTypeNumber, .op1NotIntOp2Int
+    btqz t1, tagTypeNumber, .slow
+    addq tagTypeNumber, t1
+    fq2d t1, ft1
     jmp .op1NotIntReady
 .op1NotIntOp2Int:
     ci2d t1, ft1
 .op1NotIntReady:
-    loadis 8[PB, PC, 8], t2
-    addp tagTypeNumber, t0
-    fp2d t0, ft0
+    loadisFromInstruction(1, t2)
+    addq tagTypeNumber, t0
+    fq2d t0, ft0
     doubleOperation(ft1, ft0)
-    fd2p ft0, t0
-    subp tagTypeNumber, t0
-    storep t0, [cfr, t2, 8]
+    fd2q ft0, t0
+    subq tagTypeNumber, t0
+    storeq t0, [cfr, t2, 8]
     dispatch(5)
 
 .op2NotInt:
     # First operand is definitely an int, the second is definitely not.
-    loadis 8[PB, PC, 8], t2
-    btpz t1, tagTypeNumber, .slow
+    loadisFromInstruction(1, t2)
+    btqz t1, tagTypeNumber, .slow
     ci2d t0, ft0
-    addp tagTypeNumber, t1
-    fp2d t1, ft1
+    addq tagTypeNumber, t1
+    fq2d t1, ft1
     doubleOperation(ft1, ft0)
-    fd2p ft0, t0
-    subp tagTypeNumber, t0
-    storep t0, [cfr, t2, 8]
+    fd2q ft0, t0
+    subq tagTypeNumber, t0
+    storeq t0, [cfr, t2, 8]
     dispatch(5)
 
 .slow:
@@ -556,8 +564,8 @@ macro binaryOp(integerOperation, doubleOperation, slowPath)
     binaryOpCustomStore(
         macro (left, right, slow, index)
             integerOperation(left, right, slow)
-            orp tagTypeNumber, right
-            storep right, [cfr, index, 8]
+            orq tagTypeNumber, right
+            storeq right, [cfr, index, 8]
         end,
         doubleOperation, slowPath)
 end
@@ -581,8 +589,8 @@ _llint_op_mul:
             bilt left, 0, slow
             bilt right, 0, slow
         .done:
-            orp tagTypeNumber, t3
-            storep t3, [cfr, index, 8]
+            orq tagTypeNumber, t3
+            storeq t3, [cfr, index, 8]
         end,
         macro (left, right) muld left, right end,
         _llint_slow_path_mul)
@@ -613,24 +621,24 @@ _llint_op_div:
             cdqi
             idivi t3
             btinz t1, slow
-            orp tagTypeNumber, t0
-            storep t0, [cfr, index, 8]
+            orq tagTypeNumber, t0
+            storeq t0, [cfr, index, 8]
         end,
         macro (left, right) divd left, right end,
         _llint_slow_path_div)
 
 
 macro bitOp(operation, slowPath, advance)
-    loadis 24[PB, PC, 8], t0
-    loadis 16[PB, PC, 8], t2
-    loadis 8[PB, PC, 8], t3
+    loadisFromInstruction(3, t0)
+    loadisFromInstruction(2, t2)
+    loadisFromInstruction(1, t3)
     loadConstantOrVariable(t0, t1)
     loadConstantOrVariable(t2, t0)
-    bpb t0, tagTypeNumber, .slow
-    bpb t1, tagTypeNumber, .slow
+    bqb t0, tagTypeNumber, .slow
+    bqb t1, tagTypeNumber, .slow
     operation(t1, t0, .slow)
-    orp tagTypeNumber, t0
-    storep t0, [cfr, t3, 8]
+    orq tagTypeNumber, t0
+    storeq t0, [cfr, t3, 8]
     dispatch(advance)
 
 .slow:
@@ -691,7 +699,7 @@ _llint_op_bitor:
 
 _llint_op_check_has_instance:
     traceExecution()
-    loadis 24[PB, PC, 8], t1
+    loadisFromInstruction(3, t1)
     loadConstantOrVariableCell(t1, t0, .opCheckHasInstanceSlow)
     loadp JSCell::m_structure[t0], t0
     btbz Structure::m_typeInfo + TypeInfo::m_flags[t0], ImplementsDefaultHasInstance, .opCheckHasInstanceSlow
@@ -705,26 +713,26 @@ _llint_op_check_has_instance:
 _llint_op_instanceof:
     traceExecution()
     # Actually do the work.
-    loadis 24[PB, PC, 8], t0
-    loadis 8[PB, PC, 8], t3
+    loadisFromInstruction(3, t0)
+    loadisFromInstruction(1, t3)
     loadConstantOrVariableCell(t0, t1, .opInstanceofSlow)
     loadp JSCell::m_structure[t1], t2
     bbb Structure::m_typeInfo + TypeInfo::m_type[t2], ObjectType, .opInstanceofSlow
-    loadis 16[PB, PC, 8], t0
+    loadisFromInstruction(2, t0)
     loadConstantOrVariableCell(t0, t2, .opInstanceofSlow)
     
     # Register state: t1 = prototype, t2 = value
     move 1, t0
 .opInstanceofLoop:
     loadp JSCell::m_structure[t2], t2
-    loadp Structure::m_prototype[t2], t2
-    bpeq t2, t1, .opInstanceofDone
-    btpz t2, tagMask, .opInstanceofLoop
+    loadq Structure::m_prototype[t2], t2
+    bqeq t2, t1, .opInstanceofDone
+    btqz t2, tagMask, .opInstanceofLoop
 
     move 0, t0
 .opInstanceofDone:
-    orp ValueFalse, t0
-    storep t0, [cfr, t3, 8]
+    orq ValueFalse, t0
+    storeq t0, [cfr, t3, 8]
     dispatch(4)
 
 .opInstanceofSlow:
@@ -734,65 +742,65 @@ _llint_op_instanceof:
 
 _llint_op_is_undefined:
     traceExecution()
-    loadis 16[PB, PC, 8], t1
-    loadis 8[PB, PC, 8], t2
+    loadisFromInstruction(2, t1)
+    loadisFromInstruction(1, t2)
     loadConstantOrVariable(t1, t0)
-    btpz t0, tagMask, .opIsUndefinedCell
-    cpeq t0, ValueUndefined, t3
-    orp ValueFalse, t3
-    storep t3, [cfr, t2, 8]
+    btqz t0, tagMask, .opIsUndefinedCell
+    cqeq t0, ValueUndefined, t3
+    orq ValueFalse, t3
+    storeq t3, [cfr, t2, 8]
     dispatch(3)
 .opIsUndefinedCell:
     loadp JSCell::m_structure[t0], t0
     btbnz Structure::m_typeInfo + TypeInfo::m_flags[t0], MasqueradesAsUndefined, .masqueradesAsUndefined
     move ValueFalse, t1
-    storep t1, [cfr, t2, 8]
+    storeq t1, [cfr, t2, 8]
     dispatch(3)
 .masqueradesAsUndefined:
     loadp CodeBlock[cfr], t1
     loadp CodeBlock::m_globalObject[t1], t1
     cpeq Structure::m_globalObject[t0], t1, t3
-    orp ValueFalse, t3
-    storep t3, [cfr, t2, 8]
+    orq ValueFalse, t3
+    storeq t3, [cfr, t2, 8]
     dispatch(3)
 
 
 _llint_op_is_boolean:
     traceExecution()
-    loadis 16[PB, PC, 8], t1
-    loadis 8[PB, PC, 8], t2
+    loadisFromInstruction(2, t1)
+    loadisFromInstruction(1, t2)
     loadConstantOrVariable(t1, t0)
-    xorp ValueFalse, t0
-    tpz t0, ~1, t0
-    orp ValueFalse, t0
-    storep t0, [cfr, t2, 8]
+    xorq ValueFalse, t0
+    tqz t0, ~1, t0
+    orq ValueFalse, t0
+    storeq t0, [cfr, t2, 8]
     dispatch(3)
 
 
 _llint_op_is_number:
     traceExecution()
-    loadis 16[PB, PC, 8], t1
-    loadis 8[PB, PC, 8], t2
+    loadisFromInstruction(2, t1)
+    loadisFromInstruction(1, t2)
     loadConstantOrVariable(t1, t0)
-    tpnz t0, tagTypeNumber, t1
-    orp ValueFalse, t1
-    storep t1, [cfr, t2, 8]
+    tqnz t0, tagTypeNumber, t1
+    orq ValueFalse, t1
+    storeq t1, [cfr, t2, 8]
     dispatch(3)
 
 
 _llint_op_is_string:
     traceExecution()
-    loadis 16[PB, PC, 8], t1
-    loadis 8[PB, PC, 8], t2
+    loadisFromInstruction(2, t1)
+    loadisFromInstruction(1, t2)
     loadConstantOrVariable(t1, t0)
-    btpnz t0, tagMask, .opIsStringNotCell
+    btqnz t0, tagMask, .opIsStringNotCell
     loadp JSCell::m_structure[t0], t0
     cbeq Structure::m_typeInfo + TypeInfo::m_type[t0], StringType, t1
-    orp ValueFalse, t1
-    storep t1, [cfr, t2, 8]
+    orq ValueFalse, t1
+    storeq t1, [cfr, t2, 8]
     dispatch(3)
 .opIsStringNotCell:
-    storep ValueFalse, [cfr, t2, 8]
+    storeq ValueFalse, [cfr, t2, 8]
     dispatch(3)
 
 
@@ -800,40 +808,40 @@ macro loadPropertyAtVariableOffsetKnownNotInline(propertyOffsetAsPointer, object
     assert(macro (ok) bigteq propertyOffsetAsPointer, firstOutOfLineOffset, ok end)
     negp propertyOffsetAsPointer
     loadp JSObject::m_butterfly[objectAndStorage], objectAndStorage
-    loadp (firstOutOfLineOffset - 2) * 8[objectAndStorage, propertyOffsetAsPointer, 8], value
+    loadq (firstOutOfLineOffset - 2) * 8[objectAndStorage, propertyOffsetAsPointer, 8], value
 end
 
 macro loadPropertyAtVariableOffset(propertyOffsetAsInt, objectAndStorage, value)
     bilt propertyOffsetAsInt, firstOutOfLineOffset, .isInline
     loadp JSObject::m_butterfly[objectAndStorage], objectAndStorage
     negi propertyOffsetAsInt
-    sxi2p propertyOffsetAsInt, propertyOffsetAsInt
+    sxi2q propertyOffsetAsInt, propertyOffsetAsInt
     jmp .ready
 .isInline:
     addp sizeof JSObject - (firstOutOfLineOffset - 2) * 8, objectAndStorage
 .ready:
-    loadp (firstOutOfLineOffset - 2) * 8[objectAndStorage, propertyOffsetAsInt, 8], value
+    loadq (firstOutOfLineOffset - 2) * 8[objectAndStorage, propertyOffsetAsInt, 8], value
 end
 
 _llint_op_init_global_const:
     traceExecution()
-    loadis 16[PB, PC, 8], t1
-    loadp 8[PB, PC, 8], t0
+    loadisFromInstruction(2, t1)
+    loadpFromInstruction(1, t0)
     loadConstantOrVariable(t1, t2)
     writeBarrier(t2)
-    storep t2, [t0]
-    dispatch(3)
+    storeq t2, [t0]
+    dispatch(5)
 
 
 _llint_op_init_global_const_check:
     traceExecution()
-    loadp 24[PB, PC, 8], t2
-    loadis 16[PB, PC, 8], t1
-    loadp 8[PB, PC, 8], t0
+    loadpFromInstruction(3, t2)
+    loadisFromInstruction(2, t1)
+    loadpFromInstruction(1, t0)
     btbnz [t2], .opInitGlobalConstCheckSlow
     loadConstantOrVariable(t1, t2)
     writeBarrier(t2)
-    storep t2, [t0]
+    storeq t2, [t0]
     dispatch(5)
 .opInitGlobalConstCheckSlow:
     callSlowPath(_llint_slow_path_init_global_const_check)
@@ -846,19 +854,19 @@ macro getById(getPropertyStorage)
     # ping-ponging is free. At best we get lucky and the get_by_id will continue
     # to take fast path on the new cache. At worst we take slow path, which is what
     # we would have been doing anyway.
-    loadis 16[PB, PC, 8], t0
-    loadp 32[PB, PC, 8], t1
+    loadisFromInstruction(2, t0)
+    loadpFromInstruction(4, t1)
     loadConstantOrVariableCell(t0, t3, .opGetByIdSlow)
-    loadis 40[PB, PC, 8], t2
+    loadisFromInstruction(5, t2)
     getPropertyStorage(
         t3,
         t0,
         macro (propertyStorage, scratch)
             bpneq JSCell::m_structure[t3], t1, .opGetByIdSlow
-            loadis 8[PB, PC, 8], t1
-            loadp [propertyStorage, t2], scratch
-            storep scratch, [cfr, t1, 8]
-            loadp 64[PB, PC, 8], t1
+            loadisFromInstruction(1, t1)
+            loadq [propertyStorage, t2], scratch
+            storeq scratch, [cfr, t1, 8]
+            loadpFromInstruction(8, t1)
             valueProfile(scratch, t1)
             dispatch(9)
         end)
@@ -878,21 +886,21 @@ _llint_op_get_by_id_out_of_line:
 
 _llint_op_get_array_length:
     traceExecution()
-    loadis 16[PB, PC, 8], t0
-    loadp 32[PB, PC, 8], t1
+    loadisFromInstruction(2, t0)
+    loadpFromInstruction(4, t1)
     loadConstantOrVariableCell(t0, t3, .opGetArrayLengthSlow)
     loadp JSCell::m_structure[t3], t2
     arrayProfile(t2, t1, t0)
     btiz t2, IsArray, .opGetArrayLengthSlow
     btiz t2, IndexingShapeMask, .opGetArrayLengthSlow
-    loadis 8[PB, PC, 8], t1
-    loadp 64[PB, PC, 8], t2
+    loadisFromInstruction(1, t1)
+    loadpFromInstruction(8, t2)
     loadp JSObject::m_butterfly[t3], t0
     loadi -sizeof IndexingHeader + IndexingHeader::m_publicLength[t0], t0
     bilt t0, 0, .opGetArrayLengthSlow
-    orp tagTypeNumber, t0
+    orq tagTypeNumber, t0
     valueProfile(t0, t2)
-    storep t0, [cfr, t1, 8]
+    storeq t0, [cfr, t1, 8]
     dispatch(9)
 
 .opGetArrayLengthSlow:
@@ -902,13 +910,13 @@ _llint_op_get_array_length:
 
 _llint_op_get_arguments_length:
     traceExecution()
-    loadis 16[PB, PC, 8], t0
-    loadis 8[PB, PC, 8], t1
-    btpnz [cfr, t0, 8], .opGetArgumentsLengthSlow
+    loadisFromInstruction(2, t0)
+    loadisFromInstruction(1, t1)
+    btqnz [cfr, t0, 8], .opGetArgumentsLengthSlow
     loadi ArgumentCount + PayloadOffset[cfr], t2
     subi 1, t2
-    orp tagTypeNumber, t2
-    storep t2, [cfr, t1, 8]
+    orq tagTypeNumber, t2
+    storeq t2, [cfr, t1, 8]
     dispatch(4)
 
 .opGetArgumentsLengthSlow:
@@ -918,19 +926,19 @@ _llint_op_get_arguments_length:
 
 macro putById(getPropertyStorage)
     traceExecution()
-    loadis 8[PB, PC, 8], t3
-    loadp 32[PB, PC, 8], t1
+    loadisFromInstruction(1, t3)
+    loadpFromInstruction(4, t1)
     loadConstantOrVariableCell(t3, t0, .opPutByIdSlow)
-    loadis 24[PB, PC, 8], t2
+    loadisFromInstruction(3, t2)
     getPropertyStorage(
         t0,
         t3,
         macro (propertyStorage, scratch)
             bpneq JSCell::m_structure[t0], t1, .opPutByIdSlow
-            loadis 40[PB, PC, 8], t1
+            loadisFromInstruction(5, t1)
             loadConstantOrVariable(t2, scratch)
             writeBarrier(t0)
-            storep scratch, [propertyStorage, t1]
+            storeq scratch, [propertyStorage, t1]
             dispatch(9)
         end)
 end
@@ -949,13 +957,13 @@ _llint_op_put_by_id_out_of_line:
 
 macro putByIdTransition(additionalChecks, getPropertyStorage)
     traceExecution()
-    loadis 8[PB, PC, 8], t3
-    loadp 32[PB, PC, 8], t1
+    loadisFromInstruction(1, t3)
+    loadpFromInstruction(4, t1)
     loadConstantOrVariableCell(t3, t0, .opPutByIdSlow)
-    loadis 24[PB, PC, 8], t2
+    loadisFromInstruction(3, t2)
     bpneq JSCell::m_structure[t0], t1, .opPutByIdSlow
     additionalChecks(t1, t3)
-    loadis 40[PB, PC, 8], t1
+    loadisFromInstruction(5, t1)
     getPropertyStorage(
         t0,
         t3,
@@ -963,8 +971,8 @@ macro putByIdTransition(additionalChecks, getPropertyStorage)
             addp t1, propertyStorage, t3
             loadConstantOrVariable(t2, t1)
             writeBarrier(t1)
-            storep t1, [t3]
-            loadp 48[PB, PC, 8], t1
+            storeq t1, [t3]
+            loadpFromInstruction(6, t1)
             storep t1, JSCell::m_structure[t0]
             dispatch(9)
         end)
@@ -975,17 +983,17 @@ end
 
 macro structureChainChecks(oldStructure, scratch)
     const protoCell = oldStructure    # Reusing the oldStructure register for the proto
-    loadp 56[PB, PC, 8], scratch
+    loadpFromInstruction(7, scratch)
     assert(macro (ok) btpnz scratch, ok end)
     loadp StructureChain::m_vector[scratch], scratch
     assert(macro (ok) btpnz scratch, ok end)
-    bpeq Structure::m_prototype[oldStructure], ValueNull, .done
+    bqeq Structure::m_prototype[oldStructure], ValueNull, .done
 .loop:
-    loadp Structure::m_prototype[oldStructure], protoCell
+    loadq Structure::m_prototype[oldStructure], protoCell
     loadp JSCell::m_structure[protoCell], oldStructure
     bpneq oldStructure, [scratch], .opPutByIdSlow
     addp 8, scratch
-    bpneq Structure::m_prototype[oldStructure], ValueNull, .loop
+    bqneq Structure::m_prototype[oldStructure], ValueNull, .loop
 .done:
 end
 
@@ -1007,35 +1015,35 @@ _llint_op_put_by_id_transition_normal_out_of_line:
 
 _llint_op_get_by_val:
     traceExecution()
-    loadis 16[PB, PC, 8], t2
+    loadisFromInstruction(2, t2)
     loadConstantOrVariableCell(t2, t0, .opGetByValSlow)
     loadp JSCell::m_structure[t0], t2
-    loadp 32[PB, PC, 8], t3
+    loadpFromInstruction(4, t3)
     arrayProfile(t2, t3, t1)
-    loadis 24[PB, PC, 8], t3
+    loadisFromInstruction(3, t3)
     loadConstantOrVariableInt32(t3, t1, .opGetByValSlow)
-    sxi2p t1, t1
+    sxi2q t1, t1
     loadp JSObject::m_butterfly[t0], t3
     andi IndexingShapeMask, t2
     bineq t2, ContiguousShape, .opGetByValNotContiguous
 
     biaeq t1, -sizeof IndexingHeader + IndexingHeader::m_publicLength[t3], .opGetByValSlow
-    loadis 8[PB, PC, 8], t0
-    loadp [t3, t1, 8], t2
-    btpz t2, .opGetByValSlow
+    loadisFromInstruction(1, t0)
+    loadq [t3, t1, 8], t2
+    btqz t2, .opGetByValSlow
     jmp .opGetByValDone
 
 .opGetByValNotContiguous:
     subi ArrayStorageShape, t2
     bia t2, SlowPutArrayStorageShape - ArrayStorageShape, .opGetByValSlow
     biaeq t1, -sizeof IndexingHeader + IndexingHeader::m_vectorLength[t3], .opGetByValSlow
-    loadis 8[PB, PC, 8], t0
-    loadp ArrayStorage::m_vector[t3, t1, 8], t2
-    btpz t2, .opGetByValSlow
+    loadisFromInstruction(1, t0)
+    loadq ArrayStorage::m_vector[t3, t1, 8], t2
+    btqz t2, .opGetByValSlow
 
 .opGetByValDone:
-    storep t2, [cfr, t0, 8]
-    loadp 40[PB, PC, 8], t0
+    storeq t2, [cfr, t0, 8]
+    loadpFromInstruction(5, t0)
     valueProfile(t2, t0)
     dispatch(6)
 
@@ -1048,19 +1056,19 @@ _llint_op_get_argument_by_val:
     # FIXME: At some point we should array profile this. Right now it isn't necessary
     # since the DFG will never turn a get_argument_by_val into a GetByVal.
     traceExecution()
-    loadis 16[PB, PC, 8], t0
-    loadis 24[PB, PC, 8], t1
-    btpnz [cfr, t0, 8], .opGetArgumentByValSlow
+    loadisFromInstruction(2, t0)
+    loadisFromInstruction(3, t1)
+    btqnz [cfr, t0, 8], .opGetArgumentByValSlow
     loadConstantOrVariableInt32(t1, t2, .opGetArgumentByValSlow)
     addi 1, t2
     loadi ArgumentCount + PayloadOffset[cfr], t1
     biaeq t2, t1, .opGetArgumentByValSlow
     negi t2
-    sxi2p t2, t2
-    loadis 8[PB, PC, 8], t3
-    loadp 32[PB, PC, 8], t1
-    loadp ThisArgumentOffset[cfr, t2, 8], t0
-    storep t0, [cfr, t3, 8]
+    sxi2q t2, t2
+    loadisFromInstruction(1, t3)
+    loadpFromInstruction(4, t1)
+    loadq ThisArgumentOffset[cfr, t2, 8], t0
+    storeq t0, [cfr, t3, 8]
     valueProfile(t0, t1)
     dispatch(6)
 
@@ -1071,19 +1079,19 @@ _llint_op_get_argument_by_val:
 
 _llint_op_get_by_pname:
     traceExecution()
-    loadis 24[PB, PC, 8], t1
+    loadisFromInstruction(3, t1)
     loadConstantOrVariable(t1, t0)
-    loadis 32[PB, PC, 8], t1
+    loadisFromInstruction(4, t1)
     assertNotConstant(t1)
-    bpneq t0, [cfr, t1, 8], .opGetByPnameSlow
-    loadis 16[PB, PC, 8], t2
-    loadis 40[PB, PC, 8], t3
+    bqneq t0, [cfr, t1, 8], .opGetByPnameSlow
+    loadisFromInstruction(2, t2)
+    loadisFromInstruction(5, t3)
     loadConstantOrVariableCell(t2, t0, .opGetByPnameSlow)
     assertNotConstant(t3)
-    loadp [cfr, t3, 8], t1
+    loadq [cfr, t3, 8], t1
     loadp JSCell::m_structure[t0], t2
     bpneq t2, JSPropertyNameIterator::m_cachedStructure[t1], .opGetByPnameSlow
-    loadis 48[PB, PC, 8], t3
+    loadisFromInstruction(6, t3)
     loadi PayloadOffset[cfr, t3, 8], t3
     subi 1, t3
     biaeq t3, JSPropertyNameIterator::m_numCacheableSlots[t1], .opGetByPnameSlow
@@ -1092,8 +1100,8 @@ _llint_op_get_by_pname:
     subi JSPropertyNameIterator::m_cachedStructureInlineCapacity[t1], t3
 .opGetByPnameInlineProperty:
     loadPropertyAtVariableOffset(t3, t0, t0)
-    loadis 8[PB, PC, 8], t1
-    storep t0, [cfr, t1, 8]
+    loadisFromInstruction(1, t1)
+    storeq t0, [cfr, t1, 8]
     dispatch(7)
 
 .opGetByPnameSlow:
@@ -1103,30 +1111,30 @@ _llint_op_get_by_pname:
 
 _llint_op_put_by_val:
     traceExecution()
-    loadis 8[PB, PC, 8], t0
+    loadisFromInstruction(1, t0)
     loadConstantOrVariableCell(t0, t1, .opPutByValSlow)
     loadp JSCell::m_structure[t1], t2
-    loadp 32[PB, PC, 8], t3
+    loadpFromInstruction(4, t3)
     arrayProfile(t2, t3, t0)
-    loadis 16[PB, PC, 8], t0
+    loadisFromInstruction(2, t0)
     loadConstantOrVariableInt32(t0, t3, .opPutByValSlow)
-    sxi2p t3, t3
+    sxi2q t3, t3
     loadp JSObject::m_butterfly[t1], t0
     andi IndexingShapeMask, t2
     bineq t2, ContiguousShape, .opPutByValNotContiguous
     
     biaeq t3, -sizeof IndexingHeader + IndexingHeader::m_publicLength[t0], .opPutByValContiguousOutOfBounds
 .opPutByValContiguousStoreResult:
-    loadis 24[PB, PC, 8], t2
+    loadisFromInstruction(3, t2)
     loadConstantOrVariable(t2, t1)
     writeBarrier(t1)
-    storep t1, [t0, t3, 8]
+    storeq t1, [t0, t3, 8]
     dispatch(5)
 
 .opPutByValContiguousOutOfBounds:
     biaeq t3, -sizeof IndexingHeader + IndexingHeader::m_vectorLength[t0], .opPutByValSlow
     if VALUE_PROFILER
-        loadp 32[PB, PC, 8], t2
+        loadpFromInstruction(4, t2)
         storeb 1, ArrayProfile::m_mayStoreToHole[t2]
     end
     addi 1, t3, t2
@@ -1136,17 +1144,17 @@ _llint_op_put_by_val:
 .opPutByValNotContiguous:
     bineq t2, ArrayStorageShape, .opPutByValSlow
     biaeq t3, -sizeof IndexingHeader + IndexingHeader::m_vectorLength[t0], .opPutByValSlow
-    btpz ArrayStorage::m_vector[t0, t3, 8], .opPutByValArrayStorageEmpty
+    btqz ArrayStorage::m_vector[t0, t3, 8], .opPutByValArrayStorageEmpty
 .opPutByValArrayStorageStoreResult:
-    loadis 24[PB, PC, 8], t2
+    loadisFromInstruction(3, t2)
     loadConstantOrVariable(t2, t1)
     writeBarrier(t1)
-    storep t1, ArrayStorage::m_vector[t0, t3, 8]
+    storeq t1, ArrayStorage::m_vector[t0, t3, 8]
     dispatch(5)
 
 .opPutByValArrayStorageEmpty:
     if VALUE_PROFILER
-        loadp 32[PB, PC, 8], t1
+        loadpFromInstruction(4, t1)
         storeb 1, ArrayProfile::m_mayStoreToHole[t1]
     end
     addi 1, ArrayStorage::m_numValuesInVector[t0]
@@ -1162,24 +1170,24 @@ _llint_op_put_by_val:
 
 _llint_op_loop:
     traceExecution()
-    dispatchInt(8[PB, PC, 8])
+    dispatchIntIndirect(1)
 
 
 _llint_op_jmp:
     traceExecution()
-    dispatchInt(8[PB, PC, 8])
+    dispatchIntIndirect(1)
 
 
 macro jumpTrueOrFalse(conditionOp, slow)
-    loadis 8[PB, PC, 8], t1
+    loadisFromInstruction(1, t1)
     loadConstantOrVariable(t1, t0)
-    xorp ValueFalse, t0
-    btpnz t0, -1, .slow
+    xorq ValueFalse, t0
+    btqnz t0, -1, .slow
     conditionOp(t0, .target)
     dispatch(3)
 
 .target:
-    dispatchInt(16[PB, PC, 8])
+    dispatchIntIndirect(2)
 
 .slow:
     callSlowPath(slow)
@@ -1188,19 +1196,19 @@ end
 
 
 macro equalNull(cellHandler, immediateHandler)
-    loadis 8[PB, PC, 8], t0
+    loadisFromInstruction(1, t0)
     assertNotConstant(t0)
-    loadp [cfr, t0, 8], t0
-    btpnz t0, tagMask, .immediate
+    loadq [cfr, t0, 8], t0
+    btqnz t0, tagMask, .immediate
     loadp JSCell::m_structure[t0], t2
     cellHandler(t2, Structure::m_typeInfo + TypeInfo::m_flags[t2], .target)
     dispatch(3)
 
 .target:
-    dispatch(16[PB, PC, 8])
+    dispatchIntIndirect(2)
 
 .immediate:
-    andp ~TagBitUndefined, t0
+    andq ~TagBitUndefined, t0
     immediateHandler(t0, .target)
     dispatch(3)
 end
@@ -1215,7 +1223,7 @@ _llint_op_jeq_null:
             bpeq Structure::m_globalObject[structure], t0, target
 .notMasqueradesAsUndefined:
         end,
-        macro (value, target) bpeq value, ValueNull, target end)
+        macro (value, target) bqeq value, ValueNull, target end)
 
 
 _llint_op_jneq_null:
@@ -1227,13 +1235,13 @@ _llint_op_jneq_null:
             loadp CodeBlock::m_globalObject[t0], t0
             bpneq Structure::m_globalObject[structure], t0, target
         end,
-        macro (value, target) bpneq value, ValueNull, target end)
+        macro (value, target) bqneq value, ValueNull, target end)
 
 
 _llint_op_jneq_ptr:
     traceExecution()
-    loadis 8[PB, PC, 8], t0
-    loadi 16[PB, PC, 8], t1
+    loadisFromInstruction(1, t0)
+    loadisFromInstruction(2, t1)
     loadp CodeBlock[cfr], t2
     loadp CodeBlock::m_globalObject[t2], t2
     loadp JSGlobalObject::m_specialPointers[t2, t1, 8], t1
@@ -1241,44 +1249,44 @@ _llint_op_jneq_ptr:
     dispatch(4)
 
 .opJneqPtrTarget:
-    dispatchInt(24[PB, PC, 8])
+    dispatchIntIndirect(3)
 
 
 macro compare(integerCompare, doubleCompare, slowPath)
-    loadis 8[PB, PC, 8], t2
-    loadis 16[PB, PC, 8], t3
+    loadisFromInstruction(1, t2)
+    loadisFromInstruction(2, t3)
     loadConstantOrVariable(t2, t0)
     loadConstantOrVariable(t3, t1)
-    bpb t0, tagTypeNumber, .op1NotInt
-    bpb t1, tagTypeNumber, .op2NotInt
+    bqb t0, tagTypeNumber, .op1NotInt
+    bqb t1, tagTypeNumber, .op2NotInt
     integerCompare(t0, t1, .jumpTarget)
     dispatch(4)
 
 .op1NotInt:
-    btpz t0, tagTypeNumber, .slow
-    bpb t1, tagTypeNumber, .op1NotIntOp2NotInt
+    btqz t0, tagTypeNumber, .slow
+    bqb t1, tagTypeNumber, .op1NotIntOp2NotInt
     ci2d t1, ft1
     jmp .op1NotIntReady
 .op1NotIntOp2NotInt:
-    btpz t1, tagTypeNumber, .slow
-    addp tagTypeNumber, t1
-    fp2d t1, ft1
+    btqz t1, tagTypeNumber, .slow
+    addq tagTypeNumber, t1
+    fq2d t1, ft1
 .op1NotIntReady:
-    addp tagTypeNumber, t0
-    fp2d t0, ft0
+    addq tagTypeNumber, t0
+    fq2d t0, ft0
     doubleCompare(ft0, ft1, .jumpTarget)
     dispatch(4)
 
 .op2NotInt:
     ci2d t0, ft0
-    btpz t1, tagTypeNumber, .slow
-    addp tagTypeNumber, t1
-    fp2d t1, ft1
+    btqz t1, tagTypeNumber, .slow
+    addq tagTypeNumber, t1
+    fq2d t1, ft1
     doubleCompare(ft0, ft1, .jumpTarget)
     dispatch(4)
 
 .jumpTarget:
-    dispatchInt(24[PB, PC, 8])
+    dispatchIntIndirect(3)
 
 .slow:
     callSlowPath(slowPath)
@@ -1288,15 +1296,15 @@ end
 
 _llint_op_switch_imm:
     traceExecution()
-    loadis 24[PB, PC, 8], t2
-    loadis 8[PB, PC, 8], t3
+    loadisFromInstruction(3, t2)
+    loadisFromInstruction(1, t3)
     loadConstantOrVariable(t2, t1)
     loadp CodeBlock[cfr], t2
     loadp CodeBlock::m_rareData[t2], t2
     muli sizeof SimpleJumpTable, t3    # FIXME: would be nice to peephole this!
     loadp CodeBlock::RareData::m_immediateSwitchJumpTables + VectorBufferOffset[t2], t2
     addp t3, t2
-    bpb t1, tagTypeNumber, .opSwitchImmNotInt
+    bqb t1, tagTypeNumber, .opSwitchImmNotInt
     subi SimpleJumpTable::min[t2], t1
     biaeq t1, SimpleJumpTable::branchOffsets + VectorSizeOffset[t2], .opSwitchImmFallThrough
     loadp SimpleJumpTable::branchOffsets + VectorBufferOffset[t2], t3
@@ -1305,9 +1313,9 @@ _llint_op_switch_imm:
     dispatch(t1)
 
 .opSwitchImmNotInt:
-    btpnz t1, tagTypeNumber, .opSwitchImmSlow   # Go slow if it's a double.
+    btqnz t1, tagTypeNumber, .opSwitchImmSlow   # Go slow if it's a double.
 .opSwitchImmFallThrough:
-    dispatchInt(16[PB, PC, 8])
+    dispatchIntIndirect(2)
 
 .opSwitchImmSlow:
     callSlowPath(_llint_slow_path_switch_imm)
@@ -1316,15 +1324,15 @@ _llint_op_switch_imm:
 
 _llint_op_switch_char:
     traceExecution()
-    loadis 24[PB, PC, 8], t2
-    loadis 8[PB, PC, 8], t3
+    loadisFromInstruction(3, t2)
+    loadisFromInstruction(1, t3)
     loadConstantOrVariable(t2, t1)
     loadp CodeBlock[cfr], t2
     loadp CodeBlock::m_rareData[t2], t2
     muli sizeof SimpleJumpTable, t3
     loadp CodeBlock::RareData::m_characterSwitchJumpTables + VectorBufferOffset[t2], t2
     addp t3, t2
-    btpnz t1, tagMask, .opSwitchCharFallThrough
+    btqnz t1, tagMask, .opSwitchCharFallThrough
     loadp JSCell::m_structure[t1], t0
     bbneq Structure::m_typeInfo + TypeInfo::m_type[t0], StringType, .opSwitchCharFallThrough
     bineq JSString::m_length[t1], 1, .opSwitchCharFallThrough
@@ -1345,7 +1353,7 @@ _llint_op_switch_char:
     dispatch(t1)
 
 .opSwitchCharFallThrough:
-    dispatchInt(16[PB, PC, 8])
+    dispatchIntIndirect(2)
 
 .opSwitchOnRope:
     callSlowPath(_llint_slow_path_switch_char)
@@ -1354,9 +1362,10 @@ _llint_op_switch_char:
 
 _llint_op_new_func:
     traceExecution()
-    btiz 24[PB, PC, 8], .opNewFuncUnchecked
-    loadis 8[PB, PC, 8], t1
-    btpnz [cfr, t1, 8], .opNewFuncDone
+    loadisFromInstruction(3, t2)
+    btiz t2, .opNewFuncUnchecked
+    loadisFromInstruction(1, t1)
+    btqnz [cfr, t1, 8], .opNewFuncDone
 .opNewFuncUnchecked:
     callSlowPath(_llint_slow_path_new_func)
 .opNewFuncDone:
@@ -1365,32 +1374,32 @@ _llint_op_new_func:
 
 macro arrayProfileForCall()
     if VALUE_PROFILER
-        loadis 24[PB, PC, 8], t3
-        loadp ThisArgumentOffset[cfr, t3, 8], t0
-        btpnz t0, tagMask, .done
+        loadisFromInstruction(3, t3)
+        loadq ThisArgumentOffset[cfr, t3, 8], t0
+        btqnz t0, tagMask, .done
         loadp JSCell::m_structure[t0], t0
-        loadp 40[PB, PC, 8], t1
+        loadpFromInstruction(5, t1)
         storep t0, ArrayProfile::m_lastSeenStructure[t1]
     .done:
     end
 end
 
 macro doCall(slowPath)
-    loadis 8[PB, PC, 8], t0
-    loadp 32[PB, PC, 8], t1
+    loadisFromInstruction(1, t0)
+    loadpFromInstruction(4, t1)
     loadp LLIntCallLinkInfo::callee[t1], t2
     loadConstantOrVariable(t0, t3)
-    bpneq t3, t2, .opCallSlow
-    loadis 24[PB, PC, 8], t3
+    bqneq t3, t2, .opCallSlow
+    loadisFromInstruction(3, t3)
     addi 6, PC
     lshifti 3, t3
     addp cfr, t3
     loadp JSFunction::m_scope[t2], t0
-    storep t2, Callee[t3]
-    storep t0, ScopeChain[t3]
-    loadis 16 - 48[PB, PC, 8], t2
+    storeq t2, Callee[t3]
+    storeq t0, ScopeChain[t3]
+    loadisFromInstruction(-4, t2)
     storei PC, ArgumentCount + TagOffset[cfr]
-    storep cfr, CallerFrame[t3]
+    storeq cfr, CallerFrame[t3]
     storei t2, ArgumentCount + PayloadOffset[t3]
     move t3, cfr
     callTargetFunction(t1)
@@ -1402,8 +1411,8 @@ end
 
 _llint_op_tear_off_activation:
     traceExecution()
-    loadis 8[PB, PC, 8], t0
-    btpz [cfr, t0, 8], .opTearOffActivationNotCreated
+    loadisFromInstruction(1, t0)
+    btqz [cfr, t0, 8], .opTearOffActivationNotCreated
     callSlowPath(_llint_slow_path_tear_off_activation)
 .opTearOffActivationNotCreated:
     dispatch(2)
@@ -1411,9 +1420,9 @@ _llint_op_tear_off_activation:
 
 _llint_op_tear_off_arguments:
     traceExecution()
-    loadis 8[PB, PC, 8], t0
+    loadisFromInstruction(1, t0)
     subi 1, t0   # Get the unmodifiedArgumentsRegister
-    btpz [cfr, t0, 8], .opTearOffArgumentsNotCreated
+    btqz [cfr, t0, 8], .opTearOffArgumentsNotCreated
     callSlowPath(_llint_slow_path_tear_off_arguments)
 .opTearOffArgumentsNotCreated:
     dispatch(3)
@@ -1422,15 +1431,15 @@ _llint_op_tear_off_arguments:
 _llint_op_ret:
     traceExecution()
     checkSwitchToJITForEpilogue()
-    loadis 8[PB, PC, 8], t2
+    loadisFromInstruction(1, t2)
     loadConstantOrVariable(t2, t0)
     doReturn()
 
 
 _llint_op_call_put_result:
-    loadis 8[PB, PC, 8], t2
-    loadp 16[PB, PC, 8], t3
-    storep t0, [cfr, t2, 8]
+    loadisFromInstruction(1, t2)
+    loadpFromInstruction(2, t3)
+    storeq t0, [cfr, t2, 8]
     valueProfile(t0, t3)
     traceExecution()
     dispatch(3)
@@ -1439,29 +1448,29 @@ _llint_op_call_put_result:
 _llint_op_ret_object_or_this:
     traceExecution()
     checkSwitchToJITForEpilogue()
-    loadis 8[PB, PC, 8], t2
+    loadisFromInstruction(1, t2)
     loadConstantOrVariable(t2, t0)
-    btpnz t0, tagMask, .opRetObjectOrThisNotObject
+    btqnz t0, tagMask, .opRetObjectOrThisNotObject
     loadp JSCell::m_structure[t0], t2
     bbb Structure::m_typeInfo + TypeInfo::m_type[t2], ObjectType, .opRetObjectOrThisNotObject
     doReturn()
 
 .opRetObjectOrThisNotObject:
-    loadis 16[PB, PC, 8], t2
+    loadisFromInstruction(2, t2)
     loadConstantOrVariable(t2, t0)
     doReturn()
 
 
 _llint_op_to_primitive:
     traceExecution()
-    loadis 16[PB, PC, 8], t2
-    loadis 8[PB, PC, 8], t3
+    loadisFromInstruction(2, t2)
+    loadisFromInstruction(1, t3)
     loadConstantOrVariable(t2, t0)
-    btpnz t0, tagMask, .opToPrimitiveIsImm
+    btqnz t0, tagMask, .opToPrimitiveIsImm
     loadp JSCell::m_structure[t0], t2
     bbneq Structure::m_typeInfo + TypeInfo::m_type[t2], StringType, .opToPrimitiveSlowCase
 .opToPrimitiveIsImm:
-    storep t0, [cfr, t3, 8]
+    storeq t0, [cfr, t3, 8]
     dispatch(3)
 
 .opToPrimitiveSlowCase:
@@ -1471,38 +1480,38 @@ _llint_op_to_primitive:
 
 _llint_op_next_pname:
     traceExecution()
-    loadis 24[PB, PC, 8], t1
-    loadis 32[PB, PC, 8], t2
+    loadisFromInstruction(3, t1)
+    loadisFromInstruction(4, t2)
     assertNotConstant(t1)
     assertNotConstant(t2)
     loadi PayloadOffset[cfr, t1, 8], t0
     bieq t0, PayloadOffset[cfr, t2, 8], .opNextPnameEnd
-    loadis 40[PB, PC, 8], t2
+    loadisFromInstruction(5, t2)
     assertNotConstant(t2)
     loadp [cfr, t2, 8], t2
     loadp JSPropertyNameIterator::m_jsStrings[t2], t3
-    loadp [t3, t0, 8], t3
+    loadq [t3, t0, 8], t3
     addi 1, t0
     storei t0, PayloadOffset[cfr, t1, 8]
-    loadis 8[PB, PC, 8], t1
-    storep t3, [cfr, t1, 8]
-    loadis 16[PB, PC, 8], t3
+    loadisFromInstruction(1, t1)
+    storeq t3, [cfr, t1, 8]
+    loadisFromInstruction(2, t3)
     assertNotConstant(t3)
-    loadp [cfr, t3, 8], t3
+    loadq [cfr, t3, 8], t3
     loadp JSCell::m_structure[t3], t1
     bpneq t1, JSPropertyNameIterator::m_cachedStructure[t2], .opNextPnameSlow
     loadp JSPropertyNameIterator::m_cachedPrototypeChain[t2], t0
     loadp StructureChain::m_vector[t0], t0
     btpz [t0], .opNextPnameTarget
 .opNextPnameCheckPrototypeLoop:
-    bpeq Structure::m_prototype[t1], ValueNull, .opNextPnameSlow
-    loadp Structure::m_prototype[t1], t2
+    bqeq Structure::m_prototype[t1], ValueNull, .opNextPnameSlow
+    loadq Structure::m_prototype[t1], t2
     loadp JSCell::m_structure[t2], t1
     bpneq t1, [t0], .opNextPnameSlow
     addp 8, t0
     btpnz [t0], .opNextPnameCheckPrototypeLoop
 .opNextPnameTarget:
-    dispatchInt(48[PB, PC, 8])
+    dispatchIntIndirect(6)
 
 .opNextPnameEnd:
     dispatch(7)
@@ -1525,11 +1534,11 @@ _llint_op_catch:
     loadp JITStackFrame::globalData[sp], t3
     loadp JSGlobalData::targetInterpreterPCForThrow[t3], PC
     subp PB, PC
-    urshiftp 3, PC
-    loadp JSGlobalData::exception[t3], t0
-    storep 0, JSGlobalData::exception[t3]
-    loadis 8[PB, PC, 8], t2
-    storep t0, [cfr, t2, 8]
+    rshiftp 3, PC
+    loadq JSGlobalData::exception[t3], t0
+    storeq 0, JSGlobalData::exception[t3]
+    loadisFromInstruction(1, t2)
+    storeq t0, [cfr, t2, 8]
     traceExecution()
     dispatch(2)
 
@@ -1537,9 +1546,9 @@ _llint_op_catch:
 _llint_op_end:
     traceExecution()
     checkSwitchToJITForEpilogue()
-    loadis 8[PB, PC, 8], t0
+    loadisFromInstruction(1, t0)
     assertNotConstant(t0)
-    loadp [cfr, t0, 8], t0
+    loadq [cfr, t0, 8], t0
     doReturn()
 
 
@@ -1565,8 +1574,8 @@ macro nativeCallTrampoline(executableOffsetToFunction)
         loadp JITStackFrame::globalData + 8[sp], t0
         storep cfr, JSGlobalData::topCallFrame[t0]
         loadp CallerFrame[cfr], t0
-        loadp ScopeChain[t0], t1
-        storep t1, ScopeChain[cfr]
+        loadq ScopeChain[t0], t1
+        storeq t1, ScopeChain[cfr]
         peek 0, t1
         storep t1, ReturnPC[cfr]
         move cfr, t5  # t5 = rdi
@@ -1601,7 +1610,7 @@ macro nativeCallTrampoline(executableOffsetToFunction)
         error
     end
 
-    btpnz JSGlobalData::exception[t3], .exception
+    btqnz JSGlobalData::exception[t3], .exception
     ret
 .exception:
     preserveReturnAddressAfterCall(t1)
diff --git a/Source/JavaScriptCore/offlineasm/armv7.rb b/Source/JavaScriptCore/offlineasm/armv7.rb
index ab0496f71..078be8c0f 100644
--- a/Source/JavaScriptCore/offlineasm/armv7.rb
+++ b/Source/JavaScriptCore/offlineasm/armv7.rb
@@ -401,7 +401,7 @@ class Instruction
             $asm.puts "pop #{operands[0].armV7Operand}"
         when "push"
             $asm.puts "push #{operands[0].armV7Operand}"
-        when "move", "sxi2p", "zxi2p"
+        when "move"
             if operands[0].is_a? Immediate
                 armV7MoveImmediate(operands[0].value, operands[1])
             else
diff --git a/Source/JavaScriptCore/offlineasm/asm.rb b/Source/JavaScriptCore/offlineasm/asm.rb
index 4d44c5e91..bf2426399 100644
--- a/Source/JavaScriptCore/offlineasm/asm.rb
+++ b/Source/JavaScriptCore/offlineasm/asm.rb
@@ -182,7 +182,11 @@ class Assembler
     end
     
     def self.cLabelReference(labelName)
-        "#{labelName}"
+        if /\Allint_op_/.match(labelName)
+            "op_#{$~.post_match}"  # strip opcodes of their llint_ prefix.
+        else
+            "#{labelName}"
+        end
     end
     
     def self.cLocalLabelReference(labelName)
diff --git a/Source/JavaScriptCore/offlineasm/cloop.rb b/Source/JavaScriptCore/offlineasm/cloop.rb
index b3e319c4d..cbe7e2ca1 100644
--- a/Source/JavaScriptCore/offlineasm/cloop.rb
+++ b/Source/JavaScriptCore/offlineasm/cloop.rb
@@ -37,6 +37,8 @@ def cloopMapType(type)
     when :uint;           ".u"
     when :int32;          ".i32"
     when :uint32;         ".u32"
+    when :int64;          ".i64"
+    when :uint64;         ".u64"
     when :int8;           ".i8"
     when :uint8;          ".u8"
     when :int8Ptr;        ".i8p"
@@ -44,7 +46,7 @@ def cloopMapType(type)
     when :nativeFunc;     ".nativeFunc"
     when :double;         ".d"
     when :castToDouble;   ".castToDouble"
-    when :castToVoidPtr;  ".castToVoidPtr"
+    when :castToInt64;    ".castToInt64"
     when :opcode;         ".opcode"
     else;
         raise "Unsupported type"
@@ -141,9 +143,11 @@ class Immediate
         case type
         when :int8;    "int8_t(#{valueStr})"
         when :int32;   "int32_t(#{valueStr})"
+        when :int64;   "int64_t(#{valueStr})"
         when :int;     "intptr_t(#{valueStr})"
         when :uint8;   "uint8_t(#{valueStr})"
         when :uint32;  "uint32_t(#{valueStr})"
+        when :uint64;  "uint64_t(#{valueStr})"
         when :uint;    "uintptr_t(#{valueStr})"
         else
             raise "Not implemented immediate of type: #{type}" 
@@ -159,9 +163,11 @@ class Address
         case type
         when :int8;         int8MemRef
         when :int32;        int32MemRef
+        when :int64;        int64MemRef
         when :int;          intMemRef
         when :uint8;        uint8MemRef
         when :uint32;       uint32MemRef
+        when :uint64;       uint64MemRef
         when :uint;         uintMemRef
         when :opcode;       opcodeMemRef
         when :nativeFunc;   nativeFuncMemRef
@@ -190,6 +196,9 @@ class Address
     def int32MemRef
         "*CAST<int32_t*>(#{pointerExpr})"
     end
+    def int64MemRef
+        "*CAST<int64_t*>(#{pointerExpr})"
+    end
     def intMemRef
         "*CAST<intptr_t*>(#{pointerExpr})"
     end
@@ -202,6 +211,9 @@ class Address
     def uint32MemRef
         "*CAST<uint32_t*>(#{pointerExpr})"
     end
+    def uint64MemRef
+        "*CAST<uint64_t*>(#{pointerExpr})"
+    end
     def uintMemRef
         "*CAST<uintptr_t*>(#{pointerExpr})"
     end
@@ -224,9 +236,11 @@ class BaseIndex
         case type
         when :int8;       int8MemRef
         when :int32;      int32MemRef
+        when :int64;      int64MemRef
         when :int;        intMemRef
         when :uint8;      uint8MemRef
         when :uint32;     uint32MemRef
+        when :uint64;     uint64MemRef
         when :uint;       uintMemRef
         when :opcode;     opcodeMemRef
         else
@@ -235,10 +249,10 @@ class BaseIndex
     end
     def pointerExpr
         if base.is_a? RegisterID and base.name == "sp"
-            offsetValue = "(#{index.clValue(:int32)} << #{scaleShift}) + #{offset.clValue})"
+            offsetValue = "(#{index.clValue} << #{scaleShift}) + #{offset.clValue})"
             "(ASSERT(#{offsetValue} == offsetof(JITStackFrame, globalData)), &sp->globalData)"
         else
-            "#{base.clValue(:int8Ptr)} + (#{index.clValue(:int32)} << #{scaleShift}) + #{offset.clValue}"
+            "#{base.clValue(:int8Ptr)} + (#{index.clValue} << #{scaleShift}) + #{offset.clValue}"
         end
     end
     def int8MemRef
@@ -250,6 +264,9 @@ class BaseIndex
     def int32MemRef
         "*CAST<int32_t*>(#{pointerExpr})"
     end
+    def int64MemRef
+        "*CAST<int64_t*>(#{pointerExpr})"
+    end
     def intMemRef
         "*CAST<intptr_t*>(#{pointerExpr})"
     end
@@ -262,6 +279,9 @@ class BaseIndex
     def uint32MemRef
         "*CAST<uint32_t*>(#{pointerExpr})"
     end
+    def uint64MemRef
+        "*CAST<uint64_t*>(#{pointerExpr})"
+    end
     def uintMemRef
         "*CAST<uintptr_t*>(#{pointerExpr})"
     end
@@ -333,22 +353,47 @@ end
 
 
 def cloopEmitOperation(operands, type, operator)
+    raise unless type == :int || type == :uint || type == :int32 || type == :uint32 || \
+        type == :int64 || type == :uint64 || type == :double
     if operands.size == 3
         $asm.putc "#{operands[2].clValue(type)} = #{operands[1].clValue(type)} #{operator} #{operands[0].clValue(type)};"
+        if operands[2].is_a? RegisterID and (type == :int32 or type == :uint32)
+            $asm.putc "#{operands[2].dump}.clearHighWord();" # Just clear it. It does nothing on the 32-bit port.
+        end
     else
         raise unless operands.size == 2
         raise unless not operands[1].is_a? Immediate
         $asm.putc "#{operands[1].clValue(type)} = #{operands[1].clValue(type)} #{operator} #{operands[0].clValue(type)};"
+        if operands[1].is_a? RegisterID and (type == :int32 or type == :uint32)
+            $asm.putc "#{operands[1].dump}.clearHighWord();" # Just clear it. It does nothing on the 32-bit port.
+        end
     end
 end
 
 def cloopEmitShiftOperation(operands, type, operator)
+    raise unless type == :int || type == :uint || type == :int32 || type == :uint32 || type == :int64 || type == :uint64
     if operands.size == 3
         $asm.putc "#{operands[2].clValue(type)} = #{operands[1].clValue(type)} #{operator} (#{operands[0].clValue(:int)} & 0x1f);"
+        if operands[2].is_a? RegisterID and (type == :int32 or type == :uint32)
+            $asm.putc "#{operands[2].dump}.clearHighWord();" # Just clear it. It does nothing on the 32-bit port.
+        end
     else
         raise unless operands.size == 2
         raise unless not operands[1].is_a? Immediate
         $asm.putc "#{operands[1].clValue(type)} = #{operands[1].clValue(type)} #{operator} (#{operands[0].clValue(:int)} & 0x1f);"
+        if operands[1].is_a? RegisterID and (type == :int32 or type == :uint32)
+            $asm.putc "#{operands[1].dump}.clearHighWord();" # Just clear it. It does nothing on the 32-bit port.
+        end
+    end
+end
+
+def cloopEmitUnaryOperation(operands, type, operator)
+    raise unless type == :int || type == :uint || type == :int32 || type == :uint32 || type == :int64 || type == :uint64
+    raise unless operands.size == 1
+    raise unless not operands[0].is_a? Immediate
+    $asm.putc "#{operands[0].clValue(type)} = #{operator}#{operands[0].clValue(type)};"
+    if operands[0].is_a? RegisterID and (type == :int32 or type == :uint32)
+        $asm.putc "#{operands[0].dump}.clearHighWord();" # Just clear it. It does nothing on the 32-bit port.
     end
 end
 
@@ -410,6 +455,7 @@ def cloopEmitOpAndBranch(operands, operator, type, conditionTest)
     case type
     when :int;   tempType = "intptr_t"
     when :int32; tempType = "int32_t"
+    when :int64; tempType = "int64_t"
     else
         raise "Unimplemented type"
     end
@@ -512,65 +558,91 @@ class Instruction
         case opcode
         when "addi"
             cloopEmitOperation(operands, :int32, "+")
+        when "addq"
+            cloopEmitOperation(operands, :int64, "+")
         when "addp"
             cloopEmitOperation(operands, :int, "+")
 
         when "andi"
             cloopEmitOperation(operands, :int32, "&")
+        when "andq"
+            cloopEmitOperation(operands, :int64, "&")
         when "andp"
             cloopEmitOperation(operands, :int, "&")
 
         when "ori"
             cloopEmitOperation(operands, :int32, "|")
+        when "orq"
+            cloopEmitOperation(operands, :int64, "|")
         when "orp"
             cloopEmitOperation(operands, :int, "|")
 
         when "xori"
             cloopEmitOperation(operands, :int32, "^")
+        when "xorq"
+            cloopEmitOperation(operands, :int64, "^")
         when "xorp"
             cloopEmitOperation(operands, :int, "^")
 
         when "lshifti"
             cloopEmitShiftOperation(operands, :int32, "<<")
+        when "lshiftq"
+            cloopEmitShiftOperation(operands, :int64, "<<")
         when "lshiftp"
             cloopEmitShiftOperation(operands, :int, "<<")
 
         when "rshifti"
             cloopEmitShiftOperation(operands, :int32, ">>")
+        when "rshiftq"
+            cloopEmitShiftOperation(operands, :int64, ">>")
         when "rshiftp"
             cloopEmitShiftOperation(operands, :int, ">>")
 
         when "urshifti"
             cloopEmitShiftOperation(operands, :uint32, ">>")
+        when "urshiftq"
+            cloopEmitShiftOperation(operands, :uint64, ">>")
         when "urshiftp"
             cloopEmitShiftOperation(operands, :uint, ">>")
 
         when "muli"
             cloopEmitOperation(operands, :int32, "*")
+        when "mulq"
+            cloopEmitOperation(operands, :int64, "*")
         when "mulp"
             cloopEmitOperation(operands, :int, "*")
 
         when "subi"
             cloopEmitOperation(operands, :int32, "-")
+        when "subq"
+            cloopEmitOperation(operands, :int64, "-")
         when "subp"
             cloopEmitOperation(operands, :int, "-")
 
         when "negi"
-            $asm.putc "#{operands[0].clValue(:int32)} = -#{operands[0].clValue(:int32)};"
+            cloopEmitUnaryOperation(operands, :int32, "-")
+        when "negq"
+            cloopEmitUnaryOperation(operands, :int64, "-")
         when "negp"
-            $asm.putc "#{operands[0].clValue(:int)} = -#{operands[0].clValue(:int)};"
+            cloopEmitUnaryOperation(operands, :int, "-")
 
         when "noti"
-            $asm.putc "#{operands[0].clValue(:int32)} = !#{operands[0].clValue(:int32)};"
+            cloopEmitUnaryOperation(operands, :int32, "!")
 
         when "loadi"
-            $asm.putc "#{operands[1].clValue(:int)} = #{operands[0].uint32MemRef};"
+            $asm.putc "#{operands[1].clValue(:uint)} = #{operands[0].uint32MemRef};"
+            # There's no need to call clearHighWord() here because the above will
+            # automatically take care of 0 extension.
         when "loadis"
             $asm.putc "#{operands[1].clValue(:int)} = #{operands[0].int32MemRef};"
+        when "loadq"
+            $asm.putc "#{operands[1].clValue(:int64)} = #{operands[0].int64MemRef};"
         when "loadp"
             $asm.putc "#{operands[1].clValue(:int)} = #{operands[0].intMemRef};"
         when "storei"
             $asm.putc "#{operands[1].int32MemRef} = #{operands[0].clValue(:int32)};"
+        when "storeq"
+            $asm.putc "#{operands[1].int64MemRef} = #{operands[0].clValue(:int64)};"
         when "storep"
             $asm.putc "#{operands[1].intMemRef} = #{operands[0].clValue(:int)};"
         when "loadb"
@@ -631,6 +703,7 @@ class Instruction
 
         when "td2i"
             $asm.putc "#{operands[1].clValue(:int)} = #{operands[0].clValue(:double)};"
+            $asm.putc "#{operands[1].dump}.clearHighWord();"
 
         when "bcd2i"  # operands: srcDbl dstInt slowPath
             $asm.putc "{"
@@ -639,20 +712,23 @@ class Instruction
             $asm.putc "    if (asInt32 != d || (!asInt32 && signbit(d))) // true for -0.0"
             $asm.putc "        goto  #{operands[2].cLabel};"
             $asm.putc "    #{operands[1].clValue} = asInt32;"            
+            $asm.putc "    #{operands[1].dump}.clearHighWord();"
             $asm.putc "}"
 
         when "move"
             $asm.putc "#{operands[1].clValue(:int)} = #{operands[0].clValue(:int)};"
-        when "sxi2p"
-            $asm.putc "#{operands[1].clValue(:int)} = #{operands[0].clValue(:int32)};"
-        when "zxi2p"
-            $asm.putc "#{operands[1].clValue(:uint)} = #{operands[0].clValue(:uint32)};"
+        when "sxi2q"
+            $asm.putc "#{operands[1].clValue(:int64)} = #{operands[0].clValue(:int32)};"
+        when "zxi2q"
+            $asm.putc "#{operands[1].clValue(:uint64)} = #{operands[0].clValue(:uint32)};"
         when "nop"
             $asm.putc "// nop"
         when "bbeq"
             cloopEmitCompareAndBranch(operands, :int8, "==")
         when "bieq"
             cloopEmitCompareAndBranch(operands, :int32, "==")
+        when "bqeq"
+            cloopEmitCompareAndBranch(operands, :int64, "==")
         when "bpeq"
             cloopEmitCompareAndBranch(operands, :int, "==")
 
@@ -660,6 +736,8 @@ class Instruction
             cloopEmitCompareAndBranch(operands, :int8, "!=")
         when "bineq"
             cloopEmitCompareAndBranch(operands, :int32, "!=")
+        when "bqneq"
+            cloopEmitCompareAndBranch(operands, :int64, "!=")
         when "bpneq"
             cloopEmitCompareAndBranch(operands, :int, "!=")
 
@@ -667,6 +745,8 @@ class Instruction
             cloopEmitCompareAndBranch(operands, :uint8, ">")
         when "bia"
             cloopEmitCompareAndBranch(operands, :uint32, ">")
+        when "bqa"
+            cloopEmitCompareAndBranch(operands, :uint64, ">")
         when "bpa"
             cloopEmitCompareAndBranch(operands, :uint, ">")
 
@@ -674,6 +754,8 @@ class Instruction
             cloopEmitCompareAndBranch(operands, :uint8, ">=")
         when "biaeq"
             cloopEmitCompareAndBranch(operands, :uint32, ">=")
+        when "bqaeq"
+            cloopEmitCompareAndBranch(operands, :uint64, ">=")
         when "bpaeq"
             cloopEmitCompareAndBranch(operands, :uint, ">=")
 
@@ -681,6 +763,8 @@ class Instruction
             cloopEmitCompareAndBranch(operands, :uint8, "<")
         when "bib"
             cloopEmitCompareAndBranch(operands, :uint32, "<")
+        when "bqb"
+            cloopEmitCompareAndBranch(operands, :uint64, "<")
         when "bpb"
             cloopEmitCompareAndBranch(operands, :uint, "<")
 
@@ -688,6 +772,8 @@ class Instruction
             cloopEmitCompareAndBranch(operands, :uint8, "<=")
         when "bibeq"
             cloopEmitCompareAndBranch(operands, :uint32, "<=")
+        when "bqbeq"
+            cloopEmitCompareAndBranch(operands, :uint64, "<=")
         when "bpbeq"
             cloopEmitCompareAndBranch(operands, :uint, "<=")
 
@@ -695,6 +781,8 @@ class Instruction
             cloopEmitCompareAndBranch(operands, :int8, ">")
         when "bigt"
             cloopEmitCompareAndBranch(operands, :int32, ">")
+        when "bqgt"
+            cloopEmitCompareAndBranch(operands, :int64, ">")
         when "bpgt"
             cloopEmitCompareAndBranch(operands, :int, ">")
 
@@ -702,6 +790,8 @@ class Instruction
             cloopEmitCompareAndBranch(operands, :int8, ">=")
         when "bigteq"
             cloopEmitCompareAndBranch(operands, :int32, ">=")
+        when "bqgteq"
+            cloopEmitCompareAndBranch(operands, :int64, ">=")
         when "bpgteq"
             cloopEmitCompareAndBranch(operands, :int, ">=")
 
@@ -709,6 +799,8 @@ class Instruction
             cloopEmitCompareAndBranch(operands, :int8, "<")
         when "bilt"
             cloopEmitCompareAndBranch(operands, :int32, "<")
+        when "bqlt"
+            cloopEmitCompareAndBranch(operands, :int64, "<")
         when "bplt"
             cloopEmitCompareAndBranch(operands, :int, "<")
 
@@ -716,6 +808,8 @@ class Instruction
             cloopEmitCompareAndBranch(operands, :int8, "<=")
         when "bilteq"
             cloopEmitCompareAndBranch(operands, :int32, "<=")
+        when "bqlteq"
+            cloopEmitCompareAndBranch(operands, :int64, "<=")
         when "bplteq"
             cloopEmitCompareAndBranch(operands, :int, "<=")
 
@@ -723,6 +817,8 @@ class Instruction
             cloopEmitTestAndBranchIf(operands, :int8, "== 0", operands[-1].cLabel)
         when "btiz"
             cloopEmitTestAndBranchIf(operands, :int32, "== 0", operands[-1].cLabel)
+        when "btqz"
+            cloopEmitTestAndBranchIf(operands, :int64, "== 0", operands[-1].cLabel)
         when "btpz"
             cloopEmitTestAndBranchIf(operands, :int, "== 0", operands[-1].cLabel)
 
@@ -730,6 +826,8 @@ class Instruction
             cloopEmitTestAndBranchIf(operands, :int8, "!= 0", operands[-1].cLabel)
         when "btinz"
             cloopEmitTestAndBranchIf(operands, :int32, "!= 0", operands[-1].cLabel)
+        when "btqnz"
+            cloopEmitTestAndBranchIf(operands, :int64, "!= 0", operands[-1].cLabel)
         when "btpnz"
             cloopEmitTestAndBranchIf(operands, :int, "!= 0", operands[-1].cLabel)
 
@@ -737,6 +835,8 @@ class Instruction
             cloopEmitTestAndBranchIf(operands, :int8, "< 0", operands[-1].cLabel)
         when "btis"
             cloopEmitTestAndBranchIf(operands, :int32, "< 0", operands[-1].cLabel)
+        when "btqs"
+            cloopEmitTestAndBranchIf(operands, :int64, "< 0", operands[-1].cLabel)
         when "btps"
             cloopEmitTestAndBranchIf(operands, :int, "< 0", operands[-1].cLabel)
 
@@ -770,6 +870,8 @@ class Instruction
             cloopEmitCompareAndSet(operands, :uint8, "==")
         when "cieq"
             cloopEmitCompareAndSet(operands, :uint32, "==")
+        when "cqeq"
+            cloopEmitCompareAndSet(operands, :uint64, "==")
         when "cpeq"
             cloopEmitCompareAndSet(operands, :uint, "==")
 
@@ -777,6 +879,8 @@ class Instruction
             cloopEmitCompareAndSet(operands, :uint8, "!=")
         when "cineq"
             cloopEmitCompareAndSet(operands, :uint32, "!=")
+        when "cqneq"
+            cloopEmitCompareAndSet(operands, :uint64, "!=")
         when "cpneq"
             cloopEmitCompareAndSet(operands, :uint, "!=")
 
@@ -784,6 +888,8 @@ class Instruction
             cloopEmitCompareAndSet(operands, :uint8, ">")
         when "cia"
             cloopEmitCompareAndSet(operands, :uint32, ">")
+        when "cqa"
+            cloopEmitCompareAndSet(operands, :uint64, ">")
         when "cpa"
             cloopEmitCompareAndSet(operands, :uint, ">")
 
@@ -791,6 +897,8 @@ class Instruction
             cloopEmitCompareAndSet(operands, :uint8, ">=")
         when "ciaeq"
             cloopEmitCompareAndSet(operands, :uint32, ">=")
+        when "cqaeq"
+            cloopEmitCompareAndSet(operands, :uint64, ">=")
         when "cpaeq"
             cloopEmitCompareAndSet(operands, :uint, ">=")
 
@@ -798,6 +906,8 @@ class Instruction
             cloopEmitCompareAndSet(operands, :uint8, "<")
         when "cib"
             cloopEmitCompareAndSet(operands, :uint32, "<")
+        when "cqb"
+            cloopEmitCompareAndSet(operands, :uint64, "<")
         when "cpb"
             cloopEmitCompareAndSet(operands, :uint, "<")
 
@@ -805,6 +915,8 @@ class Instruction
             cloopEmitCompareAndSet(operands, :uint8, "<=")
         when "cibeq"
             cloopEmitCompareAndSet(operands, :uint32, "<=")
+        when "cqbeq"
+            cloopEmitCompareAndSet(operands, :uint64, "<=")
         when "cpbeq"
             cloopEmitCompareAndSet(operands, :uint, "<=")
 
@@ -812,6 +924,8 @@ class Instruction
             cloopEmitCompareAndSet(operands, :int8, ">")
         when "cigt"
             cloopEmitCompareAndSet(operands, :int32, ">")
+        when "cqgt"
+            cloopEmitCompareAndSet(operands, :int64, ">")
         when "cpgt"
             cloopEmitCompareAndSet(operands, :int, ">")
 
@@ -819,6 +933,8 @@ class Instruction
             cloopEmitCompareAndSet(operands, :int8, ">=")
         when "cigteq"
             cloopEmitCompareAndSet(operands, :int32, ">=")
+        when "cqgteq"
+            cloopEmitCompareAndSet(operands, :int64, ">=")
         when "cpgteq"
             cloopEmitCompareAndSet(operands, :int, ">=")
 
@@ -826,6 +942,8 @@ class Instruction
             cloopEmitCompareAndSet(operands, :int8, "<")
         when "cilt"
             cloopEmitCompareAndSet(operands, :int32, "<")
+        when "cqlt"
+            cloopEmitCompareAndSet(operands, :int64, "<")
         when "cplt"
             cloopEmitCompareAndSet(operands, :int, "<")
 
@@ -833,6 +951,8 @@ class Instruction
             cloopEmitCompareAndSet(operands, :int8, "<=")
         when "cilteq"
             cloopEmitCompareAndSet(operands, :int32, "<=")
+        when "cqlteq"
+            cloopEmitCompareAndSet(operands, :int64, "<=")
         when "cplteq"
             cloopEmitCompareAndSet(operands, :int, "<=")
 
@@ -840,6 +960,8 @@ class Instruction
             cloopEmitTestSet(operands, :int8, "< 0")
         when "tis"
             cloopEmitTestSet(operands, :int32, "< 0")
+        when "tqs"
+            cloopEmitTestSet(operands, :int64, "< 0")
         when "tps"
             cloopEmitTestSet(operands, :int, "< 0")
 
@@ -847,6 +969,8 @@ class Instruction
             cloopEmitTestSet(operands, :int8, "== 0")
         when "tiz"
             cloopEmitTestSet(operands, :int32, "== 0")
+        when "tqz"
+            cloopEmitTestSet(operands, :int64, "== 0")
         when "tpz"
             cloopEmitTestSet(operands, :int, "== 0")
 
@@ -854,6 +978,8 @@ class Instruction
             cloopEmitTestSet(operands, :int8, "!= 0")
         when "tinz"
             cloopEmitTestSet(operands, :int32, "!= 0")
+        when "tqnz"
+            cloopEmitTestSet(operands, :int64, "!= 0")
         when "tpnz"
             cloopEmitTestSet(operands, :int, "!= 0")
 
@@ -864,7 +990,9 @@ class Instruction
             $asm.putc "{"
             $asm.putc "    int64_t temp = t0.i32; // sign extend the low 32bit"
             $asm.putc "    t0.i32 = temp; // low word"
+            $asm.putc "    t0.clearHighWord();"
             $asm.putc "    t1.i32 = uint64_t(temp) >> 32; // high word"
+            $asm.putc "    t1.clearHighWord();"
             $asm.putc "}"
 
         # 64-bit instruction: idivi op1 (based on X64)
@@ -884,7 +1012,9 @@ class Instruction
             $asm.putc "    int64_t dividend = (int64_t(t1.u32) << 32) | t0.u32;"
             $asm.putc "    int64_t divisor = #{operands[0].clValue(:int)};"
             $asm.putc "    t1.i32 = dividend % divisor; // remainder"
+            $asm.putc "    t1.clearHighWord();"
             $asm.putc "    t0.i32 = dividend / divisor; // quotient"
+            $asm.putc "    t0.clearHighWord();"
             $asm.putc "}"
 
         # 32-bit instruction: fii2d int32LoOp int32HiOp dblOp (based on ARMv7)
@@ -897,15 +1027,15 @@ class Instruction
         when "fd2ii"
             $asm.putc "Double2Ints(#{operands[0].clValue(:double)}, #{operands[1].clValue}, #{operands[2].clValue});"
 
-        # 64-bit instruction: fp2d int64Op dblOp (based on X64)
+        # 64-bit instruction: fq2d int64Op dblOp (based on X64)
         # Copy a bit-encoded double in a 64-bit int register to a double register.
-        when "fp2d"
+        when "fq2d"
             $asm.putc "#{operands[1].clValue(:double)} = #{operands[0].clValue(:castToDouble)};"
 
-        # 64-bit instruction: fd2p dblOp int64Op (based on X64 instruction set)
+        # 64-bit instruction: fd2q dblOp int64Op (based on X64 instruction set)
         # Copy a double as a bit-encoded double into a 64-bit int register.
-        when "fd2p"
-            $asm.putc "#{operands[1].clValue(:voidPtr)} = #{operands[0].clValue(:castToVoidPtr)};"
+        when "fd2q"
+            $asm.putc "#{operands[1].clValue(:int64)} = #{operands[0].clValue(:castToInt64)};"
 
         when "leai"
             operands[0].cloopEmitLea(operands[1], :int32)
@@ -926,6 +1056,13 @@ class Instruction
         when "baddinz"
             cloopEmitOpAndBranch(operands, "+", :int32, "!= 0")
 
+        when "baddqs"
+            cloopEmitOpAndBranch(operands, "+", :int64, "< 0")
+        when "baddqz"
+            cloopEmitOpAndBranch(operands, "+", :int64, "== 0")
+        when "baddqnz"
+            cloopEmitOpAndBranch(operands, "+", :int64, "!= 0")
+
         when "baddps"
             cloopEmitOpAndBranch(operands, "+", :int, "< 0")
         when "baddpz"
diff --git a/Source/JavaScriptCore/offlineasm/instructions.rb b/Source/JavaScriptCore/offlineasm/instructions.rb
index ddb1bb90f..e047b2a16 100644
--- a/Source/JavaScriptCore/offlineasm/instructions.rb
+++ b/Source/JavaScriptCore/offlineasm/instructions.rb
@@ -33,15 +33,19 @@ MACRO_INSTRUCTIONS =
      "andi",
      "lshifti",
      "lshiftp",
+     "lshiftq",
      "muli",
      "negi",
      "negp",
+     "negq",
      "noti",
      "ori",
      "rshifti",
      "urshifti",
      "rshiftp",
      "urshiftp",
+     "rshiftq",
+     "urshiftq",
      "subi",
      "xori",
      "loadi",
@@ -63,8 +67,8 @@ MACRO_INSTRUCTIONS =
      "ci2d",
      "fii2d", # usage: fii2d <gpr with least significant bits>, <gpr with most significant bits>, <fpr>
      "fd2ii", # usage: fd2ii <fpr>, <gpr with least significant bits>, <gpr with most significant bits>
-     "fp2d",
-     "fd2p",
+     "fq2d",
+     "fd2q",
      "bdeq",
      "bdneq",
      "bdgt",
@@ -84,8 +88,8 @@ MACRO_INSTRUCTIONS =
      "pop",
      "push",
      "move",
-     "sxi2p",
-     "zxi2p",
+     "sxi2q",
+     "zxi2q",
      "nop",
      "bieq",
      "bineq",
@@ -199,6 +203,46 @@ MACRO_INSTRUCTIONS =
      "baddps",
      "baddpz",
      "baddpnz",
+     "tqs",
+     "tqz",
+     "tqnz",
+     "peekq",
+     "pokeq",
+     "bqeq",
+     "bqneq",
+     "bqa",
+     "bqaeq",
+     "bqb",
+     "bqbeq",
+     "bqgt",
+     "bqgteq",
+     "bqlt",
+     "bqlteq",
+     "addq",
+     "mulq",
+     "andq",
+     "orq",
+     "subq",
+     "xorq",
+     "loadq",
+     "cqeq",
+     "cqneq",
+     "cqa",
+     "cqaeq",
+     "cqb",
+     "cqbeq",
+     "cqgt",
+     "cqgteq",
+     "cqlt",
+     "cqlteq",
+     "storeq",
+     "btqs",
+     "btqz",
+     "btqnz",
+     "baddqo",
+     "baddqs",
+     "baddqz",
+     "baddqnz",
      "bo",
      "bs",
      "bz",
diff --git a/Source/JavaScriptCore/offlineasm/x86.rb b/Source/JavaScriptCore/offlineasm/x86.rb
index 033c200d7..67cbd14b0 100644
--- a/Source/JavaScriptCore/offlineasm/x86.rb
+++ b/Source/JavaScriptCore/offlineasm/x86.rb
@@ -45,12 +45,15 @@ class SpecialRegister < NoChildren
             "%" + @name + "d"
         when :ptr
             "%" + @name
+        when :quad
+            "%" + @name
         else
             raise
         end
     end
     def x86CallOperand(kind)
-        "*#{x86Operand(kind)}"
+        # Call operands are not allowed to be partial registers.
+        "*#{x86Operand(:quad)}"
     end
 end
 
@@ -82,6 +85,8 @@ class RegisterID
                 "%eax"
             when :ptr
                 isX64 ? "%rax" : "%eax"
+            when :quad
+                isX64 ? "%rax" : raise
             else
                 raise
             end
@@ -95,6 +100,8 @@ class RegisterID
                 "%edx"
             when :ptr
                 isX64 ? "%rdx" : "%edx"
+            when :quad
+                isX64 ? "%rdx" : raise
             else
                 raise
             end
@@ -108,6 +115,8 @@ class RegisterID
                 "%ecx"
             when :ptr
                 isX64 ? "%rcx" : "%ecx"
+            when :quad
+                isX64 ? "%rcx" : raise
             else
                 raise
             end
@@ -121,6 +130,8 @@ class RegisterID
                 "%ebx"
             when :ptr
                 isX64 ? "%rbx" : "%ebx"
+            when :quad
+                isX64 ? "%rbx" : raise
             else
                 raise
             end
@@ -134,6 +145,8 @@ class RegisterID
                 "%esi"
             when :ptr
                 isX64 ? "%rsi" : "%esi"
+            when :quad
+                isX64 ? "%rsi" : raise
             else
                 raise
             end
@@ -146,6 +159,8 @@ class RegisterID
                     "%r13d"
                 when :ptr
                     "%r13"
+                when :quad
+                    "%r13"
                 else
                     raise
                 end
@@ -173,6 +188,8 @@ class RegisterID
                 "%esp"
             when :ptr
                 isX64 ? "%rsp" : "%esp"
+            when :quad
+                isX64 ? "%rsp" : raise
             else
                 raise
             end
@@ -187,6 +204,8 @@ class RegisterID
                 "%edi"
             when :ptr
                 "%rdi"
+            when :quad
+                "%rdi"
             end
         when "t6"
             raise "Cannot use #{name} in 32-bit X86 at #{codeOriginString}" unless isX64
@@ -197,6 +216,8 @@ class RegisterID
                 "%r10d"
             when :ptr
                 "%r10"
+            when :quad
+                "%r10"
             end
         when "csr1"
             raise "Cannot use #{name} in 32-bit X86 at #{codeOriginString}" unless isX64
@@ -207,6 +228,8 @@ class RegisterID
                 "%r14d"
             when :ptr
                 "%r14"
+            when :quad
+                "%r14"
             end
         when "csr2"
             raise "Cannot use #{name} in 32-bit X86 at #{codeOriginString}" unless isX64
@@ -217,13 +240,15 @@ class RegisterID
                 "%r15d"
             when :ptr
                 "%r15"
+            when :quad
+                "%r15"
             end
         else
             raise "Bad register #{name} for X86 at #{codeOriginString}"
         end
     end
     def x86CallOperand(kind)
-        "*#{x86Operand(kind)}"
+        isX64 ? "*#{x86Operand(:quad)}" : "*#{x86Operand(:ptr)}"
     end
 end
 
@@ -394,6 +419,8 @@ class Instruction
             "l"
         when :ptr
             isX64 ? "q" : "l"
+        when :quad
+            isX64 ? "q" : raise
         when :double
             "sd"
         else
@@ -411,6 +438,8 @@ class Instruction
             4
         when :ptr
             isX64 ? 8 : 4
+        when :quad
+            isX64 ? 8 : raise
         when :double
             8
         else
@@ -607,9 +636,17 @@ class Instruction
     
     def handleMove
         if Immediate.new(nil, 0) == operands[0] and operands[1].is_a? RegisterID
-            $asm.puts "xor#{x86Suffix(:ptr)} #{operands[1].x86Operand(:ptr)}, #{operands[1].x86Operand(:ptr)}"
+            if isX64
+                $asm.puts "xor#{x86Suffix(:quad)} #{operands[1].x86Operand(:quad)}, #{operands[1].x86Operand(:quad)}"
+            else
+                $asm.puts "xor#{x86Suffix(:ptr)} #{operands[1].x86Operand(:ptr)}, #{operands[1].x86Operand(:ptr)}"
+            end
         elsif operands[0] != operands[1]
-            $asm.puts "mov#{x86Suffix(:ptr)} #{x86Operands(:ptr, :ptr)}"
+            if isX64
+                $asm.puts "mov#{x86Suffix(:quad)} #{x86Operands(:quad, :quad)}"
+            else
+                $asm.puts "mov#{x86Suffix(:ptr)} #{x86Operands(:ptr, :ptr)}"
+            end
         end
     end
     
@@ -632,54 +669,76 @@ class Instruction
             handleX86Add(:int)
         when "addp"
             handleX86Add(:ptr)
+        when "addq"
+            handleX86Add(:quad)
         when "andi"
             handleX86Op("andl", :int)
         when "andp"
             handleX86Op("and#{x86Suffix(:ptr)}", :ptr)
+        when "andq"
+            handleX86Op("and#{x86Suffix(:quad)}", :quad)
         when "lshifti"
             handleX86Shift("sall", :int)
         when "lshiftp"
             handleX86Shift("sal#{x86Suffix(:ptr)}", :ptr)
+        when "lshiftq"
+            handleX86Shift("sal#{x86Suffix(:quad)}", :quad)
         when "muli"
             handleX86Mul(:int)
         when "mulp"
             handleX86Mul(:ptr)
+        when "mulq"
+            handleX86Mul(:quad)
         when "negi"
             $asm.puts "negl #{x86Operands(:int)}"
         when "negp"
             $asm.puts "neg#{x86Suffix(:ptr)} #{x86Operands(:ptr)}"
+        when "negq"
+            $asm.puts "neg#{x86Suffix(:quad)} #{x86Operands(:quad)}"
         when "noti"
             $asm.puts "notl #{x86Operands(:int)}"
         when "ori"
             handleX86Op("orl", :int)
         when "orp"
             handleX86Op("or#{x86Suffix(:ptr)}", :ptr)
+        when "orq"
+            handleX86Op("or#{x86Suffix(:quad)}", :quad)
         when "rshifti"
             handleX86Shift("sarl", :int)
         when "rshiftp"
             handleX86Shift("sar#{x86Suffix(:ptr)}", :ptr)
+        when "rshiftq"
+            handleX86Shift("sar#{x86Suffix(:quad)}", :quad)
         when "urshifti"
             handleX86Shift("shrl", :int)
         when "urshiftp"
             handleX86Shift("shr#{x86Suffix(:ptr)}", :ptr)
+        when "urshiftq"
+            handleX86Shift("shr#{x86Suffix(:quad)}", :quad)
         when "subi"
             handleX86Sub(:int)
         when "subp"
             handleX86Sub(:ptr)
+        when "subq"
+            handleX86Sub(:quad)
         when "xori"
             handleX86Op("xorl", :int)
         when "xorp"
             handleX86Op("xor#{x86Suffix(:ptr)}", :ptr)
+        when "xorq"
+            handleX86Op("xor#{x86Suffix(:quad)}", :quad)
         when "loadi", "storei"
             $asm.puts "movl #{x86Operands(:int, :int)}"
         when "loadis"
             if isX64
-                $asm.puts "movslq #{x86Operands(:int, :ptr)}"
+                $asm.puts "movslq #{x86Operands(:int, :quad)}"
             else
                 $asm.puts "movl #{x86Operands(:int, :int)}"
             end
         when "loadp", "storep"
             $asm.puts "mov#{x86Suffix(:ptr)} #{x86Operands(:ptr, :ptr)}"
+        when "loadq", "storeq"
+            $asm.puts "mov#{x86Suffix(:quad)} #{x86Operands(:quad, :quad)}"
         when "loadb"
             $asm.puts "movzbl #{operands[0].x86Operand(:byte)}, #{operands[1].x86Operand(:int)}"
         when "loadbs"
@@ -761,60 +820,72 @@ class Instruction
             $asm.puts "push #{operands[0].x86Operand(:ptr)}"
         when "move"
             handleMove
-        when "sxi2p"
-            if isX64
-                $asm.puts "movslq #{operands[0].x86Operand(:int)}, #{operands[1].x86Operand(:ptr)}"
-            else
-                handleMove
-            end
-        when "zxi2p"
-            if isX64
-                $asm.puts "movl #{operands[0].x86Operand(:int)}, #{operands[1].x86Operand(:int)}"
-            else
-                handleMove
-            end
+        when "sxi2q"
+            $asm.puts "movslq #{operands[0].x86Operand(:int)}, #{operands[1].x86Operand(:quad)}"
+        when "zxi2q"
+            $asm.puts "movl #{operands[0].x86Operand(:int)}, #{operands[1].x86Operand(:int)}"
         when "nop"
             $asm.puts "nop"
         when "bieq"
             handleX86IntBranch("je", :int)
         when "bpeq"
             handleX86IntBranch("je", :ptr)
+        when "bqeq"
+            handleX86IntBranch("je", :quad)
         when "bineq"
             handleX86IntBranch("jne", :int)
         when "bpneq"
             handleX86IntBranch("jne", :ptr)
+        when "bqneq"
+            handleX86IntBranch("jne", :quad)
         when "bia"
             handleX86IntBranch("ja", :int)
         when "bpa"
             handleX86IntBranch("ja", :ptr)
+        when "bqa"
+            handleX86IntBranch("ja", :quad)
         when "biaeq"
             handleX86IntBranch("jae", :int)
         when "bpaeq"
             handleX86IntBranch("jae", :ptr)
+        when "bqaeq"
+            handleX86IntBranch("jae", :quad)
         when "bib"
             handleX86IntBranch("jb", :int)
         when "bpb"
             handleX86IntBranch("jb", :ptr)
+        when "bqb"
+            handleX86IntBranch("jb", :quad)
         when "bibeq"
             handleX86IntBranch("jbe", :int)
         when "bpbeq"
             handleX86IntBranch("jbe", :ptr)
+        when "bqbeq"
+            handleX86IntBranch("jbe", :quad)
         when "bigt"
             handleX86IntBranch("jg", :int)
         when "bpgt"
             handleX86IntBranch("jg", :ptr)
+        when "bqgt"
+            handleX86IntBranch("jg", :quad)
         when "bigteq"
             handleX86IntBranch("jge", :int)
         when "bpgteq"
             handleX86IntBranch("jge", :ptr)
+        when "bqgteq"
+            handleX86IntBranch("jge", :quad)
         when "bilt"
             handleX86IntBranch("jl", :int)
         when "bplt"
             handleX86IntBranch("jl", :ptr)
+        when "bqlt"
+            handleX86IntBranch("jl", :quad)
         when "bilteq"
             handleX86IntBranch("jle", :int)
         when "bplteq"
             handleX86IntBranch("jle", :ptr)
+        when "bqlteq"
+            handleX86IntBranch("jle", :quad)
         when "bbeq"
             handleX86IntBranch("je", :byte)
         when "bbneq"
@@ -839,14 +910,20 @@ class Instruction
             handleX86BranchTest("js", :int)
         when "btps"
             handleX86BranchTest("js", :ptr)
+        when "btqs"
+            handleX86BranchTest("js", :quad)
         when "btiz"
             handleX86BranchTest("jz", :int)
         when "btpz"
             handleX86BranchTest("jz", :ptr)
+        when "btqz"
+            handleX86BranchTest("jz", :quad)
         when "btinz"
             handleX86BranchTest("jnz", :int)
         when "btpnz"
             handleX86BranchTest("jnz", :ptr)
+        when "btqnz"
+            handleX86BranchTest("jnz", :quad)
         when "btbs"
             handleX86BranchTest("js", :byte)
         when "btbz"
@@ -859,18 +936,26 @@ class Instruction
             handleX86OpBranch("addl", "jo", :int)
         when "baddpo"
             handleX86OpBranch("add#{x86Suffix(:ptr)}", "jo", :ptr)
+        when "baddqo"
+            handleX86OpBranch("add#{x86Suffix(:quad)}", "jo", :quad)
         when "baddis"
             handleX86OpBranch("addl", "js", :int)
         when "baddps"
             handleX86OpBranch("add#{x86Suffix(:ptr)}", "js", :ptr)
+        when "baddqs"
+            handleX86OpBranch("add#{x86Suffix(:quad)}", "js", :quad)
         when "baddiz"
             handleX86OpBranch("addl", "jz", :int)
         when "baddpz"
             handleX86OpBranch("add#{x86Suffix(:ptr)}", "jz", :ptr)
+        when "baddqz"
+            handleX86OpBranch("add#{x86Suffix(:quad)}", "jz", :quad)
         when "baddinz"
             handleX86OpBranch("addl", "jnz", :int)
         when "baddpnz"
             handleX86OpBranch("add#{x86Suffix(:ptr)}", "jnz", :ptr)
+        when "baddqnz"
+            handleX86OpBranch("add#{x86Suffix(:quad)}", "jnz", :quad)
         when "bsubio"
             handleX86SubBranch("jo", :int)
         when "bsubis"
@@ -907,60 +992,80 @@ class Instruction
             handleX86IntCompareSet("sete", :byte)
         when "cpeq"
             handleX86IntCompareSet("sete", :ptr)
+        when "cqeq"
+            handleX86IntCompareSet("sete", :quad)
         when "cineq"
             handleX86IntCompareSet("setne", :int)
         when "cbneq"
             handleX86IntCompareSet("setne", :byte)
         when "cpneq"
             handleX86IntCompareSet("setne", :ptr)
+        when "cqneq"
+            handleX86IntCompareSet("setne", :quad)
         when "cia"
             handleX86IntCompareSet("seta", :int)
         when "cba"
             handleX86IntCompareSet("seta", :byte)
         when "cpa"
             handleX86IntCompareSet("seta", :ptr)
+        when "cqa"
+            handleX86IntCompareSet("seta", :quad)
         when "ciaeq"
             handleX86IntCompareSet("setae", :int)
         when "cbaeq"
             handleX86IntCompareSet("setae", :byte)
         when "cpaeq"
             handleX86IntCompareSet("setae", :ptr)
+        when "cqaeq"
+            handleX86IntCompareSet("setae", :quad)
         when "cib"
             handleX86IntCompareSet("setb", :int)
         when "cbb"
             handleX86IntCompareSet("setb", :byte)
         when "cpb"
             handleX86IntCompareSet("setb", :ptr)
+        when "cqb"
+            handleX86IntCompareSet("setb", :quad)
         when "cibeq"
             handleX86IntCompareSet("setbe", :int)
         when "cbbeq"
             handleX86IntCompareSet("setbe", :byte)
         when "cpbeq"
             handleX86IntCompareSet("setbe", :ptr)
+        when "cqbeq"
+            handleX86IntCompareSet("setbe", :quad)
         when "cigt"
             handleX86IntCompareSet("setg", :int)
         when "cbgt"
             handleX86IntCompareSet("setg", :byte)
         when "cpgt"
             handleX86IntCompareSet("setg", :ptr)
+        when "cqgt"
+            handleX86IntCompareSet("setg", :quad)
         when "cigteq"
             handleX86IntCompareSet("setge", :int)
         when "cbgteq"
             handleX86IntCompareSet("setge", :byte)
         when "cpgteq"
             handleX86IntCompareSet("setge", :ptr)
+        when "cqgteq"
+            handleX86IntCompareSet("setge", :quad)
         when "cilt"
             handleX86IntCompareSet("setl", :int)
         when "cblt"
             handleX86IntCompareSet("setl", :byte)
         when "cplt"
             handleX86IntCompareSet("setl", :ptr)
+        when "cqlt"
+            handleX86IntCompareSet("setl", :quad)
         when "cilteq"
             handleX86IntCompareSet("setle", :int)
         when "cblteq"
             handleX86IntCompareSet("setle", :byte)
         when "cplteq"
             handleX86IntCompareSet("setle", :ptr)
+        when "cqlteq"
+            handleX86IntCompareSet("setle", :quad)
         when "tis"
             handleX86SetTest("sets", :int)
         when "tiz"
@@ -973,6 +1078,12 @@ class Instruction
             handleX86SetTest("setz", :ptr)
         when "tpnz"
             handleX86SetTest("setnz", :ptr)
+        when "tqs"
+            handleX86SetTest("sets", :quad)
+        when "tqz"
+            handleX86SetTest("setz", :quad)
+        when "tqnz"
+            handleX86SetTest("setnz", :quad)
         when "tbs"
             handleX86SetTest("sets", :byte)
         when "tbz"
@@ -982,9 +1093,15 @@ class Instruction
         when "peek"
             sp = RegisterID.new(nil, "sp")
             $asm.puts "mov#{x86Suffix(:ptr)} #{operands[0].value * x86Bytes(:ptr)}(#{sp.x86Operand(:ptr)}), #{operands[1].x86Operand(:ptr)}"
+        when "peekq"
+            sp = RegisterID.new(nil, "sp")
+            $asm.puts "mov#{x86Suffix(:quad)} #{operands[0].value * x86Bytes(:quad)}(#{sp.x86Operand(:ptr)}), #{operands[1].x86Operand(:quad)}"
         when "poke"
             sp = RegisterID.new(nil, "sp")
             $asm.puts "mov#{x86Suffix(:ptr)} #{operands[0].x86Operand(:ptr)}, #{operands[1].value * x86Bytes(:ptr)}(#{sp.x86Operand(:ptr)})"
+        when "pokeq"
+            sp = RegisterID.new(nil, "sp")
+            $asm.puts "mov#{x86Suffix(:quad)} #{operands[0].x86Operand(:quad)}, #{operands[1].value * x86Bytes(:quad)}(#{sp.x86Operand(:ptr)})"
         when "cdqi"
             $asm.puts "cdq"
         when "idivi"
@@ -999,10 +1116,10 @@ class Instruction
             $asm.puts "movsd #{operands[0].x86Operand(:double)}, %xmm7"
             $asm.puts "psrlq $32, %xmm7"
             $asm.puts "movsd %xmm7, #{operands[2].x86Operand(:int)}"
-        when "fp2d"
-            $asm.puts "movd #{operands[0].x86Operand(:ptr)}, #{operands[1].x86Operand(:double)}"
-        when "fd2p"
-            $asm.puts "movd #{operands[0].x86Operand(:double)}, #{operands[1].x86Operand(:ptr)}"
+        when "fq2d"
+            $asm.puts "movd #{operands[0].x86Operand(:quad)}, #{operands[1].x86Operand(:double)}"
+        when "fd2q"
+            $asm.puts "movd #{operands[0].x86Operand(:double)}, #{operands[1].x86Operand(:quad)}"
         when "bo"
             $asm.puts "jo #{operands[0].asmLabel}"
         when "bs"
diff --git a/Source/JavaScriptCore/parser/Lexer.cpp b/Source/JavaScriptCore/parser/Lexer.cpp
index 8b2020987..477d403c1 100644
--- a/Source/JavaScriptCore/parser/Lexer.cpp
+++ b/Source/JavaScriptCore/parser/Lexer.cpp
@@ -355,6 +355,139 @@ static const unsigned short typesOfLatin1Characters[256] = {
 /* 255 - Ll category        */ CharacterIdentifierStart
 };
 
+// This table provides the character that results from \X where X is the index in the table beginning
+// with SPACE. A table value of 0 means that more processing needs to be done.
+static const LChar singleCharacterEscapeValuesForASCII[128] = {
+/*   0 - Null               */ 0,
+/*   1 - Start of Heading   */ 0,
+/*   2 - Start of Text      */ 0,
+/*   3 - End of Text        */ 0,
+/*   4 - End of Transm.     */ 0,
+/*   5 - Enquiry            */ 0,
+/*   6 - Acknowledgment     */ 0,
+/*   7 - Bell               */ 0,
+/*   8 - Back Space         */ 0,
+/*   9 - Horizontal Tab     */ 0,
+/*  10 - Line Feed          */ 0,
+/*  11 - Vertical Tab       */ 0,
+/*  12 - Form Feed          */ 0,
+/*  13 - Carriage Return    */ 0,
+/*  14 - Shift Out          */ 0,
+/*  15 - Shift In           */ 0,
+/*  16 - Data Line Escape   */ 0,
+/*  17 - Device Control 1   */ 0,
+/*  18 - Device Control 2   */ 0,
+/*  19 - Device Control 3   */ 0,
+/*  20 - Device Control 4   */ 0,
+/*  21 - Negative Ack.      */ 0,
+/*  22 - Synchronous Idle   */ 0,
+/*  23 - End of Transmit    */ 0,
+/*  24 - Cancel             */ 0,
+/*  25 - End of Medium      */ 0,
+/*  26 - Substitute         */ 0,
+/*  27 - Escape             */ 0,
+/*  28 - File Separator     */ 0,
+/*  29 - Group Separator    */ 0,
+/*  30 - Record Separator   */ 0,
+/*  31 - Unit Separator     */ 0,
+/*  32 - Space              */ ' ',
+/*  33 - !                  */ '!',
+/*  34 - "                  */ '"',
+/*  35 - #                  */ '#',
+/*  36 - $                  */ '$',
+/*  37 - %                  */ '%',
+/*  38 - &                  */ '&',
+/*  39 - '                  */ '\'',
+/*  40 - (                  */ '(',
+/*  41 - )                  */ ')',
+/*  42 - *                  */ '*',
+/*  43 - +                  */ '+',
+/*  44 - ,                  */ ',',
+/*  45 - -                  */ '-',
+/*  46 - .                  */ '.',
+/*  47 - /                  */ '/',
+/*  48 - 0                  */ 0,
+/*  49 - 1                  */ 0,
+/*  50 - 2                  */ 0,
+/*  51 - 3                  */ 0,
+/*  52 - 4                  */ 0,
+/*  53 - 5                  */ 0,
+/*  54 - 6                  */ 0,
+/*  55 - 7                  */ 0,
+/*  56 - 8                  */ 0,
+/*  57 - 9                  */ 0,
+/*  58 - :                  */ ':',
+/*  59 - ;                  */ ';',
+/*  60 - <                  */ '<',
+/*  61 - =                  */ '=',
+/*  62 - >                  */ '>',
+/*  63 - ?                  */ '?',
+/*  64 - @                  */ '@',
+/*  65 - A                  */ 'A',
+/*  66 - B                  */ 'B',
+/*  67 - C                  */ 'C',
+/*  68 - D                  */ 'D',
+/*  69 - E                  */ 'E',
+/*  70 - F                  */ 'F',
+/*  71 - G                  */ 'G',
+/*  72 - H                  */ 'H',
+/*  73 - I                  */ 'I',
+/*  74 - J                  */ 'J',
+/*  75 - K                  */ 'K',
+/*  76 - L                  */ 'L',
+/*  77 - M                  */ 'M',
+/*  78 - N                  */ 'N',
+/*  79 - O                  */ 'O',
+/*  80 - P                  */ 'P',
+/*  81 - Q                  */ 'Q',
+/*  82 - R                  */ 'R',
+/*  83 - S                  */ 'S',
+/*  84 - T                  */ 'T',
+/*  85 - U                  */ 'U',
+/*  86 - V                  */ 'V',
+/*  87 - W                  */ 'W',
+/*  88 - X                  */ 'X',
+/*  89 - Y                  */ 'Y',
+/*  90 - Z                  */ 'Z',
+/*  91 - [                  */ '[',
+/*  92 - \                  */ '\\',
+/*  93 - ]                  */ ']',
+/*  94 - ^                  */ '^',
+/*  95 - _                  */ '_',
+/*  96 - `                  */ '`',
+/*  97 - a                  */ 'a',
+/*  98 - b                  */ 0x08,
+/*  99 - c                  */ 'c',
+/* 100 - d                  */ 'd',
+/* 101 - e                  */ 'e',
+/* 102 - f                  */ 0x0C,
+/* 103 - g                  */ 'g',
+/* 104 - h                  */ 'h',
+/* 105 - i                  */ 'i',
+/* 106 - j                  */ 'j',
+/* 107 - k                  */ 'k',
+/* 108 - l                  */ 'l',
+/* 109 - m                  */ 'm',
+/* 110 - n                  */ 0x0A,
+/* 111 - o                  */ 'o',
+/* 112 - p                  */ 'p',
+/* 113 - q                  */ 'q',
+/* 114 - r                  */ 0x0D,
+/* 115 - s                  */ 's',
+/* 116 - t                  */ 0x09,
+/* 117 - u                  */ 0,
+/* 118 - v                  */ 0x0B,
+/* 119 - w                  */ 'w',
+/* 120 - x                  */ 0,
+/* 121 - y                  */ 'y',
+/* 122 - z                  */ 'z',
+/* 123 - {                  */ '{',
+/* 124 - |                  */ '|',
+/* 125 - }                  */ '}',
+/* 126 - ~                  */ '~',
+/* 127 - Delete             */ 0
+};
+
 template <typename T>
 Lexer<T>::Lexer(JSGlobalData* globalData)
     : m_isReparsing(false)
@@ -547,30 +680,13 @@ static ALWAYS_INLINE bool isIdentPart(UChar c)
     return isLatin1(c) ? isIdentPart(static_cast<LChar>(c)) : isNonLatin1IdentPart(c);
 }
 
-static inline int singleEscape(int c)
+static inline LChar singleEscape(int c)
 {
-    switch (c) {
-    case 'b':
-        return 0x08;
-    case 't':
-        return 0x09;
-    case 'n':
-        return 0x0A;
-    case 'v':
-        return 0x0B;
-    case 'f':
-        return 0x0C;
-    case 'r':
-        return 0x0D;
-    case '\\':
-        return '\\';
-    case '\'':
-        return '\'';
-    case '"':
-        return '"';
-    default:
-        return 0;
+    if (c < 128) {
+        ASSERT(static_cast<size_t>(c) < ARRAY_SIZE(singleCharacterEscapeValuesForASCII));
+        return singleCharacterEscapeValuesForASCII[c];
     }
+    return 0;
 }
 
 template <typename T>
@@ -842,7 +958,7 @@ template <bool shouldBuildStrings> ALWAYS_INLINE bool Lexer<T>::parseString(JSTo
                 append8(stringStart, currentCharacter() - stringStart);
             shift();
 
-            int escape = singleEscape(m_current);
+            LChar escape = singleEscape(m_current);
 
             // Most common escape sequences first
             if (escape) {
@@ -907,7 +1023,7 @@ template <bool shouldBuildStrings> bool Lexer<T>::parseStringSlowCase(JSTokenDat
                 append16(stringStart, currentCharacter() - stringStart);
             shift();
 
-            int escape = singleEscape(m_current);
+            LChar escape = singleEscape(m_current);
 
             // Most common escape sequences first
             if (escape) {
@@ -1570,12 +1686,25 @@ returnError:
 }
 
 template <typename T>
+static inline void orCharacter(UChar&, UChar);
+
+template <>
+inline void orCharacter<LChar>(UChar&, UChar) { }
+
+template <>
+inline void orCharacter<UChar>(UChar& orAccumulator, UChar character)
+{
+    orAccumulator |= character;
+}
+
+template <typename T>
 bool Lexer<T>::scanRegExp(const Identifier*& pattern, const Identifier*& flags, UChar patternPrefix)
 {
     ASSERT(m_buffer16.isEmpty());
 
     bool lastWasEscape = false;
     bool inBrackets = false;
+    UChar charactersOredTogether = 0;
 
     if (patternPrefix) {
         ASSERT(!isLineTerminator(patternPrefix));
@@ -1598,6 +1727,7 @@ bool Lexer<T>::scanRegExp(const Identifier*& pattern, const Identifier*& flags,
             break;
 
         record16(prev);
+        orCharacter<T>(charactersOredTogether, prev);
 
         if (lastWasEscape) {
             lastWasEscape = false;
@@ -1617,15 +1747,18 @@ bool Lexer<T>::scanRegExp(const Identifier*& pattern, const Identifier*& flags,
         }
     }
 
-    pattern = makeIdentifierSameType(m_buffer16.data(), m_buffer16.size());
+    pattern = makeRightSizedIdentifier(m_buffer16.data(), m_buffer16.size(), charactersOredTogether);
+
     m_buffer16.resize(0);
+    charactersOredTogether = 0;
 
     while (isIdentPart(m_current)) {
         record16(m_current);
+        orCharacter<T>(charactersOredTogether, m_current);
         shift();
     }
 
-    flags = makeIdentifierSameType(m_buffer16.data(), m_buffer16.size());
+    flags = makeRightSizedIdentifier(m_buffer16.data(), m_buffer16.size(), charactersOredTogether);
     m_buffer16.resize(0);
 
     return true;
diff --git a/Source/JavaScriptCore/parser/Lexer.h b/Source/JavaScriptCore/parser/Lexer.h
index aa1599b96..78c8c8cbd 100644
--- a/Source/JavaScriptCore/parser/Lexer.h
+++ b/Source/JavaScriptCore/parser/Lexer.h
@@ -148,7 +148,7 @@ private:
     ALWAYS_INLINE const Identifier* makeIdentifier(const UChar* characters, size_t length);
     ALWAYS_INLINE const Identifier* makeLCharIdentifier(const LChar* characters, size_t length);
     ALWAYS_INLINE const Identifier* makeLCharIdentifier(const UChar* characters, size_t length);
-    ALWAYS_INLINE const Identifier* makeIdentifierSameType(const UChar* characters, size_t length);
+    ALWAYS_INLINE const Identifier* makeRightSizedIdentifier(const UChar* characters, size_t length, UChar orAllChars);
     ALWAYS_INLINE const Identifier* makeIdentifierLCharFromUChar(const UChar* characters, size_t length);
 
     ALWAYS_INLINE bool lastTokenWasRestrKeyword() const;
@@ -242,14 +242,17 @@ ALWAYS_INLINE const Identifier* Lexer<T>::makeIdentifier(const UChar* characters
 }
 
 template <>
-ALWAYS_INLINE const Identifier* Lexer<LChar>::makeIdentifierSameType(const UChar* characters, size_t length)
+ALWAYS_INLINE const Identifier* Lexer<LChar>::makeRightSizedIdentifier(const UChar* characters, size_t length, UChar)
 {
     return &m_arena->makeIdentifierLCharFromUChar(m_globalData, characters, length);
 }
 
 template <>
-ALWAYS_INLINE const Identifier* Lexer<UChar>::makeIdentifierSameType(const UChar* characters, size_t length)
+ALWAYS_INLINE const Identifier* Lexer<UChar>::makeRightSizedIdentifier(const UChar* characters, size_t length, UChar orAllChars)
 {
+    if (!(orAllChars & ~0xff))
+        return &m_arena->makeIdentifierLCharFromUChar(m_globalData, characters, length);
+
     return &m_arena->makeIdentifier(m_globalData, characters, length);
 }
 
diff --git a/Source/JavaScriptCore/parser/Parser.h b/Source/JavaScriptCore/parser/Parser.h
index 3b0316f81..615d09eb7 100644
--- a/Source/JavaScriptCore/parser/Parser.h
+++ b/Source/JavaScriptCore/parser/Parser.h
@@ -76,6 +76,49 @@ COMPILE_ASSERT(LastUntaggedToken < 64, LessThan64UntaggedTokens);
 enum SourceElementsMode { CheckForStrictMode, DontCheckForStrictMode };
 enum FunctionRequirements { FunctionNoRequirements, FunctionNeedsName };
 
+struct ParserError {
+    enum ErrorType { ErrorNone, StackOverflow, SyntaxError, EvalError, OutOfMemory } m_type;
+    String m_message;
+    int m_line;
+    ParserError()
+        : m_type(ErrorNone)
+        , m_line(-1)
+    {
+    }
+
+    ParserError(ErrorType type)
+        : m_type(type)
+        , m_line(-1)
+    {
+    }
+
+    ParserError(ErrorType type, String msg, int line)
+        : m_type(type)
+        , m_message(msg)
+        , m_line(line)
+    {
+    }
+
+    JSObject* toErrorObject(JSGlobalObject* globalObject, const SourceCode& source)
+    {
+        switch (m_type) {
+        case ErrorNone:
+            return 0;
+        case SyntaxError:
+            return addErrorInfo(globalObject->globalExec(), createSyntaxError(globalObject, m_message), m_line, source);
+        case EvalError:
+            return createSyntaxError(globalObject, m_message);
+        case StackOverflow:
+            return createStackOverflowError(globalObject);
+        case OutOfMemory:
+            return createOutOfMemoryError(globalObject);
+        }
+        CRASH();
+        return createOutOfMemoryError(globalObject); // Appease Qt bot
+    }
+
+};
+
 template <typename T> inline bool isEvalNode() { return false; }
 template <> inline bool isEvalNode<EvalNode>() { return true; }
 
@@ -370,7 +413,7 @@ public:
     ~Parser();
 
     template <class ParsedNode>
-    PassRefPtr<ParsedNode> parse(JSGlobalObject* lexicalGlobalObject, Debugger*, ExecState*, JSObject**);
+    PassRefPtr<ParsedNode> parse(ParserError&);
 
 private:
     struct AllowInOverride {
@@ -890,7 +933,7 @@ private:
         return m_lastTokenEnd;
     }
 
-    mutable const JSGlobalData* m_globalData;
+    JSGlobalData* m_globalData;
     const SourceCode* m_source;
     ParserArena* m_arena;
     OwnPtr<LexerType> m_lexer;
@@ -935,12 +978,11 @@ private:
     };
 };
 
+
 template <typename LexerType>
 template <class ParsedNode>
-PassRefPtr<ParsedNode> Parser<LexerType>::parse(JSGlobalObject* lexicalGlobalObject, Debugger* debugger, ExecState* debuggerExecState, JSObject** exception)
+PassRefPtr<ParsedNode> Parser<LexerType>::parse(ParserError& error)
 {
-    ASSERT(lexicalGlobalObject);
-    ASSERT(exception && !*exception);
     int errLine;
     String errMsg;
 
@@ -971,7 +1013,7 @@ PassRefPtr<ParsedNode> Parser<LexerType>::parse(JSGlobalObject* lexicalGlobalObj
         JSTokenLocation location;
         location.line = m_lexer->lastLineNumber();
         location.column = m_lexer->currentColumnNumber();
-        result = ParsedNode::create(&lexicalGlobalObject->globalData(),
+        result = ParsedNode::create(m_globalData,
                                     location,
                                     m_sourceElements,
                                     m_varDeclarations ? &m_varDeclarations->data : 0,
@@ -981,7 +1023,7 @@ PassRefPtr<ParsedNode> Parser<LexerType>::parse(JSGlobalObject* lexicalGlobalObj
                                     m_features,
                                     m_numConstants);
         result->setLoc(m_source->firstLine(), m_lastLine, m_lexer->currentColumnNumber());
-    } else if (lexicalGlobalObject) {
+    } else {
         // We can never see a syntax error when reparsing a function, since we should have
         // reported the error when parsing the containing program or eval code. So if we're
         // parsing a function body node, we assume that what actually happened here is that
@@ -989,35 +1031,31 @@ PassRefPtr<ParsedNode> Parser<LexerType>::parse(JSGlobalObject* lexicalGlobalObj
         // code we assume that it was a syntax error since running out of stack is much less
         // likely, and we are currently unable to distinguish between the two cases.
         if (isFunctionBodyNode(static_cast<ParsedNode*>(0)) || m_hasStackOverflow)
-            *exception = createStackOverflowError(lexicalGlobalObject);
+            error = ParserError::StackOverflow;
         else if (isEvalNode<ParsedNode>())
-            *exception = createSyntaxError(lexicalGlobalObject, errMsg);
+            error = ParserError(ParserError::EvalError, errMsg, errLine);
         else
-            *exception = addErrorInfo(lexicalGlobalObject->globalExec(), createSyntaxError(lexicalGlobalObject, errMsg), errLine, *m_source);
+            error = ParserError(ParserError::SyntaxError, errMsg, errLine);
     }
 
-    if (debugger && !ParsedNode::scopeIsFunction)
-        debugger->sourceParsed(debuggerExecState, m_source->provider(), errLine, errMsg);
-
     m_arena->reset();
 
     return result.release();
 }
 
 template <class ParsedNode>
-PassRefPtr<ParsedNode> parse(JSGlobalData* globalData, JSGlobalObject* lexicalGlobalObject, const SourceCode& source, FunctionParameters* parameters, const Identifier& name, JSParserStrictness strictness, JSParserMode parserMode, Debugger* debugger, ExecState* execState, JSObject** exception)
+PassRefPtr<ParsedNode> parse(JSGlobalData* globalData, const SourceCode& source, FunctionParameters* parameters, const Identifier& name, JSParserStrictness strictness, JSParserMode parserMode, ParserError& error)
 {
     SamplingRegion samplingRegion("Parsing");
 
     ASSERT(!source.provider()->source().isNull());
-
     if (source.provider()->source().is8Bit()) {
         Parser< Lexer<LChar> > parser(globalData, source, parameters, name, strictness, parserMode);
-        return parser.parse<ParsedNode>(lexicalGlobalObject, debugger, execState, exception);
+        return parser.parse<ParsedNode>(error);
     }
     Parser< Lexer<UChar> > parser(globalData, source, parameters, name, strictness, parserMode);
-    return parser.parse<ParsedNode>(lexicalGlobalObject, debugger, execState, exception);
+    return parser.parse<ParsedNode>(error);
 }
 
-} // namespace 
+} // namespace
 #endif
diff --git a/Source/WebKit2/UIProcess/API/efl/ewk_context_download_client_private.h b/Source/JavaScriptCore/parser/ParserModes.h
index e056aafe6..41fb7fdf9 100644
--- a/Source/WebKit2/UIProcess/API/efl/ewk_context_download_client_private.h
+++ b/Source/JavaScriptCore/parser/ParserModes.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2012 Intel Corporation. All rights reserved.
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -23,11 +23,18 @@
  * THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef ewk_context_download_client_private_h
-#define ewk_context_download_client_private_h
 
-typedef struct Ewk_Context Ewk_Context;
+#ifndef ParserModes_h
+#define ParserModes_h
 
-void ewk_context_download_client_attach(Ewk_Context*);
+namespace JSC {
 
-#endif // ewk_context_download_client_private_h
+enum JSParserStrictness { JSParseNormal, JSParseStrict };
+enum JSParserMode { JSParseProgramCode, JSParseFunctionCode };
+
+enum ProfilerMode { ProfilerOff, ProfilerOn };
+enum DebuggerMode { DebuggerOff, DebuggerOn };
+
+}
+
+#endif
diff --git a/Source/JavaScriptCore/parser/ParserTokens.h b/Source/JavaScriptCore/parser/ParserTokens.h
index 6e6cec114..14191b95d 100644
--- a/Source/JavaScriptCore/parser/ParserTokens.h
+++ b/Source/JavaScriptCore/parser/ParserTokens.h
@@ -26,6 +26,8 @@
 #ifndef ParserTokens_h
 #define ParserTokens_h
 
+#include "ParserModes.h"
+
 namespace JSC {
 
 class Identifier;
@@ -161,9 +163,6 @@ struct JSToken {
     JSTokenLocation m_location;
 };
 
-enum JSParserStrictness { JSParseNormal, JSParseStrict };
-enum JSParserMode { JSParseProgramCode, JSParseFunctionCode };
-    
 }
 
 
diff --git a/Source/JavaScriptCore/runtime/Arguments.h b/Source/JavaScriptCore/runtime/Arguments.h
index 7c8b69bd1..7961d4bc8 100644
--- a/Source/JavaScriptCore/runtime/Arguments.h
+++ b/Source/JavaScriptCore/runtime/Arguments.h
@@ -267,8 +267,7 @@ namespace JSC {
         m_overrodeCallee = false;
         m_overrodeCaller = false;
         m_isStrictMode = jsCast<FunctionExecutable*>(inlineCallFrame->executable.get())->isStrictMode();
-
-        ASSERT(!jsCast<FunctionExecutable*>(inlineCallFrame->executable.get())->symbolTable()->slowArguments());
+        ASSERT(!jsCast<FunctionExecutable*>(inlineCallFrame->executable.get())->symbolTable(inlineCallFrame->isCall ? CodeForCall : CodeForConstruct)->slowArguments());
 
         // The bytecode generator omits op_tear_off_activation in cases of no
         // declared parameters, so we need to tear off immediately.
diff --git a/Source/JavaScriptCore/runtime/ArrayConventions.h b/Source/JavaScriptCore/runtime/ArrayConventions.h
index a557b1ef9..3177c6c97 100644
--- a/Source/JavaScriptCore/runtime/ArrayConventions.h
+++ b/Source/JavaScriptCore/runtime/ArrayConventions.h
@@ -58,7 +58,7 @@ namespace JSC {
 
 // These values have to be macros to be used in max() and min() without introducing
 // a PIC branch in Mach-O binaries, see <rdar://problem/5971391>.
-#define MIN_SPARSE_ARRAY_INDEX 10000U
+#define MIN_SPARSE_ARRAY_INDEX 100000U
 #define MAX_STORAGE_VECTOR_INDEX (MAX_STORAGE_VECTOR_LENGTH - 1)
 // 0xFFFFFFFF is a bit weird -- is not an array index even though it's an integer.
 #define MAX_ARRAY_INDEX 0xFFFFFFFEU
diff --git a/Source/JavaScriptCore/runtime/CachedTranscendentalFunction.h b/Source/JavaScriptCore/runtime/CachedTranscendentalFunction.h
index f31b4a07f..62a01dbcb 100644
--- a/Source/JavaScriptCore/runtime/CachedTranscendentalFunction.h
+++ b/Source/JavaScriptCore/runtime/CachedTranscendentalFunction.h
@@ -74,8 +74,8 @@ private:
         // Lazily allocate the table, populate with NaN->NaN mapping.
         m_cache = static_cast<CacheEntry*>(fastMalloc(s_cacheSize * sizeof(CacheEntry)));
         for (unsigned x = 0; x < s_cacheSize; ++x) {
-            m_cache[x].operand = std::numeric_limits<double>::quiet_NaN();
-            m_cache[x].result = std::numeric_limits<double>::quiet_NaN();
+            m_cache[x].operand = QNaN;
+            m_cache[x].result = QNaN;
         }
     }
 
diff --git a/Source/JavaScriptCore/runtime/CodeCache.cpp b/Source/JavaScriptCore/runtime/CodeCache.cpp
new file mode 100644
index 000000000..4de760e49
--- /dev/null
+++ b/Source/JavaScriptCore/runtime/CodeCache.cpp
@@ -0,0 +1,186 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#include "CodeCache.h"
+
+#include "BytecodeGenerator.h"
+#include "CodeSpecializationKind.h"
+#include "Parser.h"
+#include "StrongInlines.h"
+#include "UnlinkedCodeBlock.h"
+
+namespace JSC {
+
+CodeCache::CodeCache()
+    : m_randomGenerator(static_cast<uint32_t>(randomNumber() * UINT32_MAX))
+{
+}
+
+CodeCache::~CodeCache()
+{
+}
+
+CodeCache::CodeBlockKey CodeCache::makeCodeBlockKey(const SourceCode& source, CodeCache::CodeType type, JSParserStrictness strictness)
+{
+    return std::make_pair(source.toString(), (type << 1) | strictness);
+}
+
+template <typename T> struct CacheTypes { };
+
+template <> struct CacheTypes<UnlinkedProgramCodeBlock> {
+    typedef JSC::ProgramNode RootNode;
+    static const CodeCache::CodeType codeType = CodeCache::ProgramType;
+};
+
+template <> struct CacheTypes<UnlinkedEvalCodeBlock> {
+    typedef JSC::EvalNode RootNode;
+    static const CodeCache::CodeType codeType = CodeCache::EvalType;
+};
+
+template <class UnlinkedCodeBlockType, class ExecutableType>
+UnlinkedCodeBlockType* CodeCache::getCodeBlock(JSGlobalData& globalData, ExecutableType* executable, const SourceCode& source, JSParserStrictness strictness, DebuggerMode debuggerMode, ProfilerMode profilerMode, ParserError& error)
+{
+    CodeBlockKey key = makeCodeBlockKey(source, CacheTypes<UnlinkedCodeBlockType>::codeType, strictness);
+    bool storeInCache = false;
+    if (debuggerMode == DebuggerOff && profilerMode == ProfilerOff) {
+        CodeBlockIndicesMap::iterator result = m_cachedCodeBlockIndices.find(key);
+        if (result != m_cachedCodeBlockIndices.end()) {
+            UnlinkedCodeBlockType* unlinkedCode = jsCast<UnlinkedCodeBlockType*>(m_cachedCodeBlocks[result->value].second.get());
+            unsigned firstLine = source.firstLine() + unlinkedCode->firstLine();
+            executable->recordParse(unlinkedCode->codeFeatures(), unlinkedCode->hasCapturedVariables(), firstLine, firstLine + unlinkedCode->lineCount());
+            return unlinkedCode;
+        }
+        storeInCache = true;
+    }
+
+    typedef typename CacheTypes<UnlinkedCodeBlockType>::RootNode RootNode;
+    RefPtr<RootNode> rootNode = parse<RootNode>(&globalData, source, 0, Identifier(), strictness, JSParseProgramCode, error);
+    if (!rootNode)
+        return 0;
+    executable->recordParse(rootNode->features(), rootNode->hasCapturedVariables(), rootNode->lineNo(), rootNode->lastLine());
+
+    UnlinkedCodeBlockType* unlinkedCode = UnlinkedCodeBlockType::create(&globalData, executable->executableInfo());
+    unlinkedCode->recordParse(rootNode->features(), rootNode->hasCapturedVariables(), rootNode->lineNo() - source.firstLine(), rootNode->lastLine() - rootNode->lineNo());
+    OwnPtr<BytecodeGenerator> generator(adoptPtr(new BytecodeGenerator(globalData, rootNode.get(), unlinkedCode, debuggerMode, profilerMode)));
+    error = generator->generate();
+    rootNode->destroyData();
+    if (error.m_type != ParserError::ErrorNone)
+        return 0;
+
+    if (storeInCache) {
+        size_t index = m_randomGenerator.getUint32() % kMaxCodeBlockEntries;
+        if (m_cachedCodeBlocks[index].second)
+            m_cachedCodeBlockIndices.remove(m_cachedCodeBlocks[index].first);
+        m_cachedCodeBlockIndices.set(key, index);
+        m_cachedCodeBlocks[index].second.set(globalData, unlinkedCode);
+        m_cachedCodeBlocks[index].first = key;
+    }
+
+    return unlinkedCode;
+}
+
+UnlinkedProgramCodeBlock* CodeCache::getProgramCodeBlock(JSGlobalData& globalData, ProgramExecutable* executable, const SourceCode& source, JSParserStrictness strictness, DebuggerMode debuggerMode, ProfilerMode profilerMode, ParserError& error)
+{
+    return getCodeBlock<UnlinkedProgramCodeBlock>(globalData, executable, source, strictness, debuggerMode, profilerMode, error);
+}
+
+UnlinkedEvalCodeBlock* CodeCache::getEvalCodeBlock(JSGlobalData& globalData, EvalExecutable* executable, const SourceCode& source, JSParserStrictness strictness, DebuggerMode debuggerMode, ProfilerMode profilerMode, ParserError& error)
+{
+    return getCodeBlock<UnlinkedEvalCodeBlock>(globalData, executable, source, strictness, debuggerMode, profilerMode, error);
+}
+
+UnlinkedFunctionCodeBlock* CodeCache::generateFunctionCodeBlock(JSGlobalData& globalData, UnlinkedFunctionExecutable* executable, const SourceCode& source, CodeSpecializationKind kind, DebuggerMode debuggerMode, ProfilerMode profilerMode, ParserError& error)
+{
+    RefPtr<FunctionBodyNode> body = parse<FunctionBodyNode>(&globalData, source, executable->parameters(), executable->name(), executable->isInStrictContext() ? JSParseStrict : JSParseNormal, JSParseFunctionCode, error);
+
+    if (!body) {
+        ASSERT(error.m_type != ParserError::ErrorNone);
+        return 0;
+    }
+
+    if (executable->forceUsesArguments())
+        body->setUsesArguments();
+    body->finishParsing(executable->parameters(), executable->name(), executable->functionNameIsInScopeToggle());
+    executable->recordParse(body->features(), body->hasCapturedVariables(), body->lineNo(), body->lastLine());
+    
+    UnlinkedFunctionCodeBlock* result = UnlinkedFunctionCodeBlock::create(&globalData, FunctionCode, ExecutableInfo(body->needsActivation(), body->usesEval(), body->isStrictMode(), kind == CodeForConstruct));
+    OwnPtr<BytecodeGenerator> generator(adoptPtr(new BytecodeGenerator(globalData, body.get(), result, debuggerMode, profilerMode)));
+    error = generator->generate();
+    body->destroyData();
+    if (error.m_type != ParserError::ErrorNone)
+        return 0;
+    return result;
+}
+
+UnlinkedFunctionCodeBlock* CodeCache::getFunctionCodeBlock(JSGlobalData& globalData, UnlinkedFunctionExecutable* executable, const SourceCode& source, CodeSpecializationKind kind, DebuggerMode debuggerMode, ProfilerMode profilerMode, ParserError& error)
+{
+    return generateFunctionCodeBlock(globalData, executable, source, kind, debuggerMode, profilerMode, error);
+}
+
+CodeCache::GlobalFunctionKey CodeCache::makeGlobalFunctionKey(const SourceCode& source, const String& name)
+{
+    return GlobalFunctionKey(source.toString(), name);
+}
+
+UnlinkedFunctionExecutable* CodeCache::getFunctionExecutableFromGlobalCode(JSGlobalData& globalData, const Identifier& name, const SourceCode& source, ParserError& error)
+{
+    GlobalFunctionKey key = makeGlobalFunctionKey(source, name.string());
+    GlobalFunctionIndicesMap::iterator result = m_cachedGlobalFunctionIndices.find(key);
+    if (result != m_cachedGlobalFunctionIndices.end())
+        return m_cachedGlobalFunctions[result->value].second.get();
+
+    RefPtr<ProgramNode> program = parse<ProgramNode>(&globalData, source, 0, Identifier(), JSParseNormal, JSParseProgramCode, error);
+    if (!program) {
+        ASSERT(error.m_type != ParserError::ErrorNone);
+        return 0;
+    }
+
+    // This function assumes an input string that would result in a single anonymous function expression.
+    StatementNode* exprStatement = program->singleStatement();
+    ASSERT(exprStatement);
+    ASSERT(exprStatement->isExprStatement());
+    ExpressionNode* funcExpr = static_cast<ExprStatementNode*>(exprStatement)->expr();
+    ASSERT(funcExpr);
+    ASSERT(funcExpr->isFuncExprNode());
+    FunctionBodyNode* body = static_cast<FuncExprNode*>(funcExpr)->body();
+    ASSERT(body);
+    ASSERT(body->ident().isNull());
+
+    UnlinkedFunctionExecutable* functionExecutable = UnlinkedFunctionExecutable::create(&globalData, source, body);
+    functionExecutable->m_nameValue.set(globalData, functionExecutable, jsString(&globalData, name.string()));
+
+    size_t index = m_randomGenerator.getUint32() % kMaxGlobalFunctionEntries;
+    if (m_cachedGlobalFunctions[index].second)
+        m_cachedGlobalFunctionIndices.remove(m_cachedGlobalFunctions[index].first);
+    m_cachedGlobalFunctionIndices.set(key, index);
+    m_cachedGlobalFunctions[index].second.set(globalData, functionExecutable);
+    m_cachedGlobalFunctions[index].first = key;
+
+    return functionExecutable;
+}
+
+}
diff --git a/Source/JavaScriptCore/runtime/CodeCache.h b/Source/JavaScriptCore/runtime/CodeCache.h
new file mode 100644
index 000000000..4d4617189
--- /dev/null
+++ b/Source/JavaScriptCore/runtime/CodeCache.h
@@ -0,0 +1,93 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef CodeCache_h
+#define CodeCache_h
+
+#include "CodeSpecializationKind.h"
+#include "ParserModes.h"
+#include "Strong.h"
+#include "WeakRandom.h"
+
+#include <wtf/FixedArray.h>
+#include <wtf/Forward.h>
+#include <wtf/PassOwnPtr.h>
+#include <wtf/text/WTFString.h>
+
+namespace JSC {
+
+class EvalExecutable;
+class Identifier;
+class ProgramExecutable;
+class UnlinkedCodeBlock;
+class UnlinkedEvalCodeBlock;
+class UnlinkedFunctionCodeBlock;
+class UnlinkedFunctionExecutable;
+class UnlinkedProgramCodeBlock;
+class JSGlobalData;
+struct ParserError;
+class SourceCode;
+class SourceProvider;
+
+class CodeCache {
+public:
+    static PassOwnPtr<CodeCache> create() { return adoptPtr(new CodeCache); }
+
+    UnlinkedProgramCodeBlock* getProgramCodeBlock(JSGlobalData&, ProgramExecutable*, const SourceCode&, JSParserStrictness, DebuggerMode, ProfilerMode, ParserError&);
+    UnlinkedEvalCodeBlock* getEvalCodeBlock(JSGlobalData&, EvalExecutable*, const SourceCode&, JSParserStrictness, DebuggerMode, ProfilerMode, ParserError&);
+    UnlinkedFunctionCodeBlock* getFunctionCodeBlock(JSGlobalData&, UnlinkedFunctionExecutable*, const SourceCode&, CodeSpecializationKind, DebuggerMode, ProfilerMode, ParserError&);
+    UnlinkedFunctionExecutable* getFunctionExecutableFromGlobalCode(JSGlobalData&, const Identifier&, const SourceCode&, ParserError&);
+    ~CodeCache();
+
+    enum CodeType { EvalType, ProgramType, FunctionType };
+    typedef std::pair<String, unsigned> CodeBlockKey;
+    typedef HashMap<CodeBlockKey, unsigned> CodeBlockIndicesMap;
+    typedef std::pair<String, String> GlobalFunctionKey;
+    typedef HashMap<GlobalFunctionKey, unsigned> GlobalFunctionIndicesMap;
+
+private:
+    CodeCache();
+
+    UnlinkedFunctionCodeBlock* generateFunctionCodeBlock(JSGlobalData&, UnlinkedFunctionExecutable*, const SourceCode&, CodeSpecializationKind, DebuggerMode, ProfilerMode, ParserError&);
+
+    template <class UnlinkedCodeBlockType, class ExecutableType> inline UnlinkedCodeBlockType* getCodeBlock(JSGlobalData&, ExecutableType*, const SourceCode&, JSParserStrictness, DebuggerMode, ProfilerMode, ParserError&);
+    CodeBlockKey makeCodeBlockKey(const SourceCode&, CodeType, JSParserStrictness);
+    CodeBlockIndicesMap m_cachedCodeBlockIndices;
+    GlobalFunctionKey makeGlobalFunctionKey(const SourceCode&, const String&);
+    GlobalFunctionIndicesMap m_cachedGlobalFunctionIndices;
+
+    enum {
+        kMaxCodeBlockEntries = 1024,
+        kMaxGlobalFunctionEntries = 1024
+    };
+
+    FixedArray<std::pair<CodeBlockKey, Strong<UnlinkedCodeBlock> >, kMaxCodeBlockEntries> m_cachedCodeBlocks;
+    FixedArray<std::pair<GlobalFunctionKey, Strong<UnlinkedFunctionExecutable> >, kMaxGlobalFunctionEntries> m_cachedGlobalFunctions;
+    WeakRandom m_randomGenerator;
+};
+
+}
+
+#endif
diff --git a/Source/JavaScriptCore/runtime/DateConstructor.cpp b/Source/JavaScriptCore/runtime/DateConstructor.cpp
index f78e8bf55..9a162e9e7 100644
--- a/Source/JavaScriptCore/runtime/DateConstructor.cpp
+++ b/Source/JavaScriptCore/runtime/DateConstructor.cpp
@@ -131,7 +131,7 @@ JSObject* constructDate(ExecState* exec, JSGlobalObject* globalObject, const Arg
             || (numArgs >= 5 && !isfinite(doubleArguments[4]))
             || (numArgs >= 6 && !isfinite(doubleArguments[5]))
             || (numArgs >= 7 && !isfinite(doubleArguments[6])))
-            value = std::numeric_limits<double>::quiet_NaN();
+            value = QNaN;
         else {
             GregorianDateTime t;
             int year = JSC::toInt32(doubleArguments[0]);
diff --git a/Source/JavaScriptCore/runtime/DateInstanceCache.h b/Source/JavaScriptCore/runtime/DateInstanceCache.h
index 153582f67..e186516e8 100644
--- a/Source/JavaScriptCore/runtime/DateInstanceCache.h
+++ b/Source/JavaScriptCore/runtime/DateInstanceCache.h
@@ -45,8 +45,8 @@ namespace JSC {
 
     private:
         DateInstanceData()
-            : m_gregorianDateTimeCachedForMS(std::numeric_limits<double>::quiet_NaN())
-            , m_gregorianDateTimeUTCCachedForMS(std::numeric_limits<double>::quiet_NaN())
+            : m_gregorianDateTimeCachedForMS(QNaN)
+            , m_gregorianDateTimeUTCCachedForMS(QNaN)
         {
         }
     };
@@ -61,7 +61,7 @@ namespace JSC {
         void reset()
         {
             for (size_t i = 0; i < cacheSize; ++i)
-                m_cache[i].key = std::numeric_limits<double>::quiet_NaN();
+                m_cache[i].key = QNaN;
         }
         
         DateInstanceData* add(double d)
diff --git a/Source/JavaScriptCore/runtime/ExceptionHelpers.cpp b/Source/JavaScriptCore/runtime/ExceptionHelpers.cpp
index a3281b6d6..a4368a2bb 100644
--- a/Source/JavaScriptCore/runtime/ExceptionHelpers.cpp
+++ b/Source/JavaScriptCore/runtime/ExceptionHelpers.cpp
@@ -48,7 +48,7 @@ JSValue InterruptedExecutionError::defaultValue(const JSObject*, ExecState* exec
 {
     if (hint == PreferString)
         return jsNontrivialString(exec, String(ASCIILiteral("JavaScript execution exceeded timeout.")));
-    return JSValue(std::numeric_limits<double>::quiet_NaN());
+    return JSValue(QNaN);
 }
 
 JSObject* createInterruptedExecutionException(JSGlobalData* globalData)
@@ -75,7 +75,7 @@ JSValue TerminatedExecutionError::defaultValue(const JSObject*, ExecState* exec,
 {
     if (hint == PreferString)
         return jsNontrivialString(exec, String(ASCIILiteral("JavaScript execution terminated.")));
-    return JSValue(std::numeric_limits<double>::quiet_NaN());
+    return JSValue(QNaN);
 }
 
 JSObject* createTerminatedExecutionException(JSGlobalData* globalData)
diff --git a/Source/JavaScriptCore/runtime/Executable.cpp b/Source/JavaScriptCore/runtime/Executable.cpp
index 0a453eea0..20a2e2acb 100644
--- a/Source/JavaScriptCore/runtime/Executable.cpp
+++ b/Source/JavaScriptCore/runtime/Executable.cpp
@@ -26,6 +26,7 @@
 #include "config.h"
 #include "Executable.h"
 
+#include "BatchedTransitionOptimizer.h"
 #include "BytecodeGenerator.h"
 #include "CodeBlock.h"
 #include "DFGDriver.h"
@@ -133,16 +134,14 @@ void ProgramExecutable::destroy(JSCell* cell)
 
 const ClassInfo FunctionExecutable::s_info = { "FunctionExecutable", &ScriptExecutable::s_info, 0, 0, CREATE_METHOD_TABLE(FunctionExecutable) };
 
-FunctionExecutable::FunctionExecutable(JSGlobalData& globalData, FunctionBodyNode* node)
-    : ScriptExecutable(globalData.functionExecutableStructure.get(), globalData, node->source(), node->isStrictMode())
-    , m_forceUsesArguments(node->usesArguments())
-    , m_parameters(node->parameters())
-    , m_name(node->ident())
-    , m_inferredName(node->inferredName().isNull() ? globalData.propertyNames->emptyIdentifier : node->inferredName())
-    , m_functionNameIsInScopeToggle(node->functionNameIsInScopeToggle())
+FunctionExecutable::FunctionExecutable(JSGlobalData& globalData, const SourceCode& source, UnlinkedFunctionExecutable* unlinkedExecutable, unsigned firstLine, unsigned lastLine)
+    : ScriptExecutable(globalData.functionExecutableStructure.get(), globalData, source, unlinkedExecutable->isInStrictContext())
+    , m_unlinkedExecutable(globalData, this, unlinkedExecutable)
 {
-    m_firstLine = node->lineNo();
-    m_lastLine = node->lastLine();
+    ASSERT(!source.isNull());
+    ASSERT(source.length());
+    m_firstLine = firstLine;
+    m_lastLine = lastLine;
 }
 
 void FunctionExecutable::destroy(JSCell* cell)
@@ -191,7 +190,6 @@ JSObject* EvalExecutable::compileInternal(ExecState* exec, JSScope* scope, JITCo
     UNUSED_PARAM(jitType);
     UNUSED_PARAM(bytecodeIndex);
 #endif
-    JSObject* exception = 0;
     JSGlobalData* globalData = &exec->globalData();
     JSGlobalObject* lexicalGlobalObject = exec->lexicalGlobalObject();
     
@@ -200,28 +198,21 @@ JSObject* EvalExecutable::compileInternal(ExecState* exec, JSScope* scope, JITCo
         newCodeBlock->setAlternative(static_pointer_cast<CodeBlock>(m_evalCodeBlock.release()));
         m_evalCodeBlock = newCodeBlock.release();
     } else {
+        UNUSED_PARAM(scope);
+        UNUSED_PARAM(globalData);
+        UNUSED_PARAM(lexicalGlobalObject);
         if (!lexicalGlobalObject->evalEnabled())
             return throwError(exec, createEvalError(exec, lexicalGlobalObject->evalDisabledErrorMessage()));
-        RefPtr<EvalNode> evalNode = parse<EvalNode>(globalData, lexicalGlobalObject, m_source, 0, Identifier(), isStrictMode() ? JSParseStrict : JSParseNormal, EvalNode::isFunctionNode ? JSParseFunctionCode : JSParseProgramCode, lexicalGlobalObject->debugger(), exec, &exception);
-        if (!evalNode) {
-            ASSERT(exception);
+
+        JSObject* exception = 0;
+        UnlinkedEvalCodeBlock* unlinkedEvalCode = lexicalGlobalObject->createEvalCodeBlock(exec, this, &exception);
+        if (!unlinkedEvalCode)
             return exception;
-        }
-        recordParse(evalNode->features(), evalNode->hasCapturedVariables(), evalNode->lineNo(), evalNode->lastLine());
-        
-        JSGlobalObject* globalObject = scope->globalObject();
-        
+
         OwnPtr<CodeBlock> previousCodeBlock = m_evalCodeBlock.release();
         ASSERT((jitType == JITCode::bottomTierJIT()) == !previousCodeBlock);
-        m_evalCodeBlock = adoptPtr(new EvalCodeBlock(this, globalObject, source().provider(), scope->localDepth(), previousCodeBlock.release()));
-        OwnPtr<BytecodeGenerator> generator(adoptPtr(new BytecodeGenerator(evalNode.get(), scope, m_evalCodeBlock->symbolTable(), m_evalCodeBlock.get(), !!m_evalCodeBlock->alternative() ? OptimizingCompilation : FirstCompilation)));
-        if ((exception = generator->generate())) {
-            m_evalCodeBlock = static_pointer_cast<EvalCodeBlock>(m_evalCodeBlock->releaseAlternative());
-            evalNode->destroyData();
-            return exception;
-        }
-        
-        evalNode->destroyData();
+        m_unlinkedEvalCodeBlock.set(*globalData, this, unlinkedEvalCode);
+        m_evalCodeBlock = adoptPtr(new EvalCodeBlock(this, unlinkedEvalCode, lexicalGlobalObject, source().provider(), scope->localDepth(), previousCodeBlock.release()));
         m_evalCodeBlock->copyPostParseDataFromAlternative();
     }
 
@@ -257,6 +248,7 @@ void EvalExecutable::visitChildren(JSCell* cell, SlotVisitor& visitor)
     ScriptExecutable::visitChildren(thisObject, visitor);
     if (thisObject->m_evalCodeBlock)
         thisObject->m_evalCodeBlock->visitAggregate(visitor);
+    visitor.append(&thisObject->m_unlinkedEvalCodeBlock);
 }
 
 void EvalExecutable::unlinkCalls()
@@ -272,19 +264,20 @@ void EvalExecutable::unlinkCalls()
 void EvalExecutable::clearCode()
 {
     m_evalCodeBlock.clear();
+    m_unlinkedEvalCodeBlock.clear();
     Base::clearCode();
 }
 
 JSObject* ProgramExecutable::checkSyntax(ExecState* exec)
 {
-    JSObject* exception = 0;
+    ParserError error;
     JSGlobalData* globalData = &exec->globalData();
     JSGlobalObject* lexicalGlobalObject = exec->lexicalGlobalObject();
-    RefPtr<ProgramNode> programNode = parse<ProgramNode>(globalData, lexicalGlobalObject, m_source, 0, Identifier(), JSParseNormal, ProgramNode::isFunctionNode ? JSParseFunctionCode : JSParseProgramCode, lexicalGlobalObject->debugger(), exec, &exception);
+    RefPtr<ProgramNode> programNode = parse<ProgramNode>(globalData, m_source, 0, Identifier(), JSParseNormal, ProgramNode::isFunctionNode ? JSParseFunctionCode : JSParseProgramCode, error);
     if (programNode)
         return 0;
-    ASSERT(exception);
-    return exception;
+    ASSERT(error.m_type != ParserError::ErrorNone);
+    return error.toErrorObject(lexicalGlobalObject, m_source);
 }
 
 JSObject* ProgramExecutable::compileOptimized(ExecState* exec, JSScope* scope, unsigned bytecodeIndex)
@@ -310,38 +303,17 @@ JSObject* ProgramExecutable::compileInternal(ExecState* exec, JSScope* scope, JI
     SamplingRegion samplingRegion(samplingDescription(jitType));
     
 #if !ENABLE(JIT)
+    UNUSED_PARAM(exec);
     UNUSED_PARAM(jitType);
     UNUSED_PARAM(bytecodeIndex);
 #endif
-    JSObject* exception = 0;
-    JSGlobalData* globalData = &exec->globalData();
-    JSGlobalObject* lexicalGlobalObject = exec->lexicalGlobalObject();
-    
     if (!!m_programCodeBlock) {
         OwnPtr<ProgramCodeBlock> newCodeBlock = adoptPtr(new ProgramCodeBlock(CodeBlock::CopyParsedBlock, *m_programCodeBlock));
         newCodeBlock->setAlternative(static_pointer_cast<CodeBlock>(m_programCodeBlock.release()));
         m_programCodeBlock = newCodeBlock.release();
     } else {
-        RefPtr<ProgramNode> programNode = parse<ProgramNode>(globalData, lexicalGlobalObject, m_source, 0, Identifier(), isStrictMode() ? JSParseStrict : JSParseNormal, ProgramNode::isFunctionNode ? JSParseFunctionCode : JSParseProgramCode, lexicalGlobalObject->debugger(), exec, &exception);
-        if (!programNode) {
-            ASSERT(exception);
-            return exception;
-        }
-        recordParse(programNode->features(), programNode->hasCapturedVariables(), programNode->lineNo(), programNode->lastLine());
-
         JSGlobalObject* globalObject = scope->globalObject();
-    
-        OwnPtr<CodeBlock> previousCodeBlock = m_programCodeBlock.release();
-        ASSERT((jitType == JITCode::bottomTierJIT()) == !previousCodeBlock);
-        m_programCodeBlock = adoptPtr(new ProgramCodeBlock(this, GlobalCode, globalObject, source().provider(), previousCodeBlock.release()));
-        OwnPtr<BytecodeGenerator> generator(adoptPtr(new BytecodeGenerator(programNode.get(), scope, globalObject->symbolTable(), m_programCodeBlock.get(), !!m_programCodeBlock->alternative() ? OptimizingCompilation : FirstCompilation)));
-        if ((exception = generator->generate())) {
-            m_programCodeBlock = static_pointer_cast<ProgramCodeBlock>(m_programCodeBlock->releaseAlternative());
-            programNode->destroyData();
-            return exception;
-        }
-
-        programNode->destroyData();
+        m_programCodeBlock = adoptPtr(new ProgramCodeBlock(this, m_unlinkedProgramCodeBlock.get(), globalObject, source().provider(), m_programCodeBlock.release()));
         m_programCodeBlock->copyPostParseDataFromAlternative();
     }
 
@@ -378,6 +350,67 @@ void ProgramExecutable::unlinkCalls()
 #endif
 }
 
+int ProgramExecutable::addGlobalVar(JSGlobalObject* globalObject, const Identifier& ident, ConstantMode constantMode, FunctionMode functionMode)
+{
+    // Try to share the symbolTable if possible
+    SharedSymbolTable* symbolTable = globalObject->symbolTable();
+    UNUSED_PARAM(functionMode);
+    int index = symbolTable->size();
+    SymbolTableEntry newEntry(index, (constantMode == IsConstant) ? ReadOnly : 0);
+    if (functionMode == IsFunctionToSpecialize)
+        newEntry.attemptToWatch();
+    SymbolTable::AddResult result = symbolTable->add(ident.impl(), newEntry);
+    if (!result.isNewEntry) {
+        result.iterator->value.notifyWrite();
+        index = result.iterator->value.getIndex();
+    }
+    return index;
+}
+
+JSObject* ProgramExecutable::initalizeGlobalProperties(JSGlobalData& globalData, CallFrame* callFrame, JSScope* scope)
+{
+    ASSERT(scope);
+    JSGlobalObject* globalObject = scope->globalObject();
+    ASSERT(globalObject);
+    ASSERT(&globalObject->globalData() == &globalData);
+
+    JSObject* exception = 0;
+    UnlinkedProgramCodeBlock* unlinkedCode = globalObject->createProgramCodeBlock(callFrame, this, &exception);
+    if (exception)
+        return exception;
+
+    m_unlinkedProgramCodeBlock.set(globalData, this, unlinkedCode);
+
+    BatchedTransitionOptimizer optimizer(globalData, globalObject);
+
+    const UnlinkedProgramCodeBlock::VariableDeclations& variableDeclarations = unlinkedCode->variableDeclarations();
+    const UnlinkedProgramCodeBlock::FunctionDeclations& functionDeclarations = unlinkedCode->functionDeclarations();
+
+    size_t newGlobals = variableDeclarations.size() + functionDeclarations.size();
+    if (!newGlobals)
+        return 0;
+    globalObject->addRegisters(newGlobals);
+    CallFrame* globalExec = globalObject->globalExec();
+
+    for (size_t i = 0; i < functionDeclarations.size(); ++i) {
+        bool propertyDidExist = globalObject->removeDirect(globalData, functionDeclarations[i].first); // Newly declared functions overwrite existing properties.
+        UnlinkedFunctionExecutable* unlinkedFunctionExecutable = functionDeclarations[i].second.get();
+        JSValue value = JSFunction::create(globalExec, unlinkedFunctionExecutable->link(globalData, m_source, lineNo(), 0), scope);
+        int index = addGlobalVar(globalObject, functionDeclarations[i].first, IsVariable,
+            !propertyDidExist ? IsFunctionToSpecialize : NotFunctionOrNotSpecializable);
+        globalObject->registerAt(index).set(globalData, globalObject, value);
+    }
+
+    for (size_t i = 0; i < variableDeclarations.size(); ++i) {
+        if (globalObject->hasProperty(globalExec, variableDeclarations[i].first))
+            continue;
+        addGlobalVar(globalObject, variableDeclarations[i].first,
+            (variableDeclarations[i].second & DeclarationStacks::IsConstant) ? IsConstant : IsVariable,
+            NotFunctionOrNotSpecializable);
+    }
+    return 0;
+}
+
 void ProgramExecutable::visitChildren(JSCell* cell, SlotVisitor& visitor)
 {
     ProgramExecutable* thisObject = jsCast<ProgramExecutable*>(cell);
@@ -385,6 +418,7 @@ void ProgramExecutable::visitChildren(JSCell* cell, SlotVisitor& visitor)
     COMPILE_ASSERT(StructureFlags & OverridesVisitChildren, OverridesVisitChildrenWithoutSettingFlag);
     ASSERT(thisObject->structure()->typeInfo().overridesVisitChildren());
     ScriptExecutable::visitChildren(thisObject, visitor);
+    visitor.append(&thisObject->m_unlinkedProgramCodeBlock);
     if (thisObject->m_programCodeBlock)
         thisObject->m_programCodeBlock->visitAggregate(visitor);
 }
@@ -392,6 +426,7 @@ void ProgramExecutable::visitChildren(JSCell* cell, SlotVisitor& visitor)
 void ProgramExecutable::clearCode()
 {
     m_programCodeBlock.clear();
+    m_unlinkedProgramCodeBlock.clear();
     Base::clearCode();
 }
 
@@ -438,12 +473,12 @@ JSObject* FunctionExecutable::compileOptimizedForConstruct(ExecState* exec, JSSc
 #if ENABLE(JIT)
 bool FunctionExecutable::jitCompileForCall(ExecState* exec)
 {
-    return jitCompileFunctionIfAppropriate(exec, m_codeBlockForCall, m_jitCodeForCall, m_jitCodeForCallWithArityCheck, m_symbolTable, JITCode::bottomTierJIT(), UINT_MAX, JITCompilationCanFail);
+    return jitCompileFunctionIfAppropriate(exec, m_codeBlockForCall, m_jitCodeForCall, m_jitCodeForCallWithArityCheck, JITCode::bottomTierJIT(), UINT_MAX, JITCompilationCanFail);
 }
 
 bool FunctionExecutable::jitCompileForConstruct(ExecState* exec)
 {
-    return jitCompileFunctionIfAppropriate(exec, m_codeBlockForConstruct, m_jitCodeForConstruct, m_jitCodeForConstructWithArityCheck, m_symbolTable, JITCode::bottomTierJIT(), UINT_MAX, JITCompilationCanFail);
+    return jitCompileFunctionIfAppropriate(exec, m_codeBlockForConstruct, m_jitCodeForConstruct, m_jitCodeForConstructWithArityCheck, JITCode::bottomTierJIT(), UINT_MAX, JITCompilationCanFail);
 }
 #endif
 
@@ -452,49 +487,30 @@ FunctionCodeBlock* FunctionExecutable::codeBlockWithBytecodeFor(CodeSpecializati
     return baselineCodeBlockFor(kind);
 }
 
-PassOwnPtr<FunctionCodeBlock> FunctionExecutable::produceCodeBlockFor(JSScope* scope, CompilationKind compilationKind, CodeSpecializationKind specializationKind, JSObject*& exception)
+PassOwnPtr<FunctionCodeBlock> FunctionExecutable::produceCodeBlockFor(JSScope* scope, CodeSpecializationKind specializationKind, JSObject*& exception)
 {
     if (!!codeBlockFor(specializationKind))
         return adoptPtr(new FunctionCodeBlock(CodeBlock::CopyParsedBlock, *codeBlockFor(specializationKind)));
-    
-    exception = 0;
+
     JSGlobalData* globalData = scope->globalData();
     JSGlobalObject* globalObject = scope->globalObject();
-    RefPtr<FunctionBodyNode> body = parse<FunctionBodyNode>(
-        globalData,
-        globalObject,
-        m_source,
-        m_parameters.get(),
-        name(),
-        isStrictMode() ? JSParseStrict : JSParseNormal,
-        FunctionBodyNode::isFunctionNode ? JSParseFunctionCode : JSParseProgramCode,
-        0,
-        0,
-        &exception
-    );
-
-    if (!body) {
-        ASSERT(exception);
+    ParserError error;
+    DebuggerMode debuggerMode = globalObject->hasDebugger() ? DebuggerOn : DebuggerOff;
+    ProfilerMode profilerMode = globalObject->hasProfiler() ? ProfilerOn : ProfilerOff;
+    UnlinkedFunctionCodeBlock* unlinkedCodeBlock = m_unlinkedExecutable->codeBlockFor(*globalData, m_source, specializationKind, debuggerMode, profilerMode, error);
+    recordParse(m_unlinkedExecutable->features(), m_unlinkedExecutable->hasCapturedVariables(), lineNo(), lastLine());
+
+    if (!unlinkedCodeBlock) {
+        exception = error.toErrorObject(globalObject, m_source);
         return nullptr;
     }
-    if (m_forceUsesArguments)
-        body->setUsesArguments();
-    body->finishParsing(m_parameters, m_name, m_functionNameIsInScopeToggle);
-    recordParse(body->features(), body->hasCapturedVariables(), body->lineNo(), body->lastLine());
-
-    OwnPtr<FunctionCodeBlock> result;
-    ASSERT((compilationKind == FirstCompilation) == !codeBlockFor(specializationKind));
-    result = adoptPtr(new FunctionCodeBlock(this, FunctionCode, globalObject, source().provider(), source().startOffset(), specializationKind == CodeForConstruct));
-    OwnPtr<BytecodeGenerator> generator(adoptPtr(new BytecodeGenerator(body.get(), scope, result->symbolTable(), result.get(), compilationKind)));
-    exception = generator->generate();
-    body->destroyData();
-    if (exception)
-        return nullptr;
 
+    OwnPtr<FunctionCodeBlock> result = adoptPtr(new FunctionCodeBlock(this, unlinkedCodeBlock, globalObject, source().provider(), source().startOffset()));
     result->copyPostParseDataFrom(codeBlockFor(specializationKind).get());
     return result.release();
 }
 
+
 JSObject* FunctionExecutable::compileForCallInternal(ExecState* exec, JSScope* scope, JITCode::JITType jitType, unsigned bytecodeIndex)
 {
     SamplingRegion samplingRegion(samplingDescription(jitType));
@@ -507,7 +523,7 @@ JSObject* FunctionExecutable::compileForCallInternal(ExecState* exec, JSScope* s
 #endif
     ASSERT((jitType == JITCode::bottomTierJIT()) == !m_codeBlockForCall);
     JSObject* exception;
-    OwnPtr<FunctionCodeBlock> newCodeBlock = produceCodeBlockFor(scope, !!m_codeBlockForCall ? OptimizingCompilation : FirstCompilation, CodeForCall, exception);
+    OwnPtr<FunctionCodeBlock> newCodeBlock = produceCodeBlockFor(scope, CodeForCall, exception);
     if (!newCodeBlock)
         return exception;
 
@@ -516,10 +532,9 @@ JSObject* FunctionExecutable::compileForCallInternal(ExecState* exec, JSScope* s
     
     m_numParametersForCall = m_codeBlockForCall->numParameters();
     ASSERT(m_numParametersForCall);
-    m_symbolTable.set(exec->globalData(), this, m_codeBlockForCall->symbolTable());
 
 #if ENABLE(JIT)
-    if (!prepareFunctionForExecution(exec, m_codeBlockForCall, m_jitCodeForCall, m_jitCodeForCallWithArityCheck, m_symbolTable, jitType, bytecodeIndex, CodeForCall))
+    if (!prepareFunctionForExecution(exec, m_codeBlockForCall, m_jitCodeForCall, m_jitCodeForCallWithArityCheck, jitType, bytecodeIndex, CodeForCall))
         return 0;
 #endif
 
@@ -544,7 +559,7 @@ JSObject* FunctionExecutable::compileForConstructInternal(ExecState* exec, JSSco
     
     ASSERT((jitType == JITCode::bottomTierJIT()) == !m_codeBlockForConstruct);
     JSObject* exception;
-    OwnPtr<FunctionCodeBlock> newCodeBlock = produceCodeBlockFor(scope, !!m_codeBlockForConstruct ? OptimizingCompilation : FirstCompilation, CodeForConstruct, exception);
+    OwnPtr<FunctionCodeBlock> newCodeBlock = produceCodeBlockFor(scope, CodeForConstruct, exception);
     if (!newCodeBlock)
         return exception;
 
@@ -553,10 +568,9 @@ JSObject* FunctionExecutable::compileForConstructInternal(ExecState* exec, JSSco
     
     m_numParametersForConstruct = m_codeBlockForConstruct->numParameters();
     ASSERT(m_numParametersForConstruct);
-    m_symbolTable.set(exec->globalData(), this, m_codeBlockForConstruct->symbolTable());
 
 #if ENABLE(JIT)
-    if (!prepareFunctionForExecution(exec, m_codeBlockForConstruct, m_jitCodeForConstruct, m_jitCodeForConstructWithArityCheck, m_symbolTable, jitType, bytecodeIndex, CodeForConstruct))
+    if (!prepareFunctionForExecution(exec, m_codeBlockForConstruct, m_jitCodeForConstruct, m_jitCodeForConstructWithArityCheck, jitType, bytecodeIndex, CodeForConstruct))
         return 0;
 #endif
 
@@ -592,12 +606,11 @@ void FunctionExecutable::visitChildren(JSCell* cell, SlotVisitor& visitor)
     COMPILE_ASSERT(StructureFlags & OverridesVisitChildren, OverridesVisitChildrenWithoutSettingFlag);
     ASSERT(thisObject->structure()->typeInfo().overridesVisitChildren());
     ScriptExecutable::visitChildren(thisObject, visitor);
-    visitor.append(&thisObject->m_nameValue);
-    visitor.append(&thisObject->m_symbolTable);
     if (thisObject->m_codeBlockForCall)
         thisObject->m_codeBlockForCall->visitAggregate(visitor);
     if (thisObject->m_codeBlockForConstruct)
         thisObject->m_codeBlockForConstruct->visitAggregate(visitor);
+    visitor.append(&thisObject->m_unlinkedExecutable);
 }
 
 void FunctionExecutable::clearCodeIfNotCompiling()
@@ -607,10 +620,18 @@ void FunctionExecutable::clearCodeIfNotCompiling()
     clearCode();
 }
 
+void FunctionExecutable::clearUnlinkedCodeIfNotCompiling()
+{
+    if (isCompiling())
+        return;
+    m_unlinkedExecutable->clearCode();
+}
+
 void FunctionExecutable::clearCode()
 {
     m_codeBlockForCall.clear();
     m_codeBlockForConstruct.clear();
+    m_unlinkedExecutable->clearCode();
     Base::clearCode();
 }
 
@@ -630,39 +651,19 @@ void FunctionExecutable::unlinkCalls()
 
 FunctionExecutable* FunctionExecutable::fromGlobalCode(const Identifier& name, ExecState* exec, Debugger* debugger, const SourceCode& source, JSObject** exception)
 {
-    JSGlobalObject* lexicalGlobalObject = exec->lexicalGlobalObject();
-    RefPtr<ProgramNode> program = parse<ProgramNode>(&exec->globalData(), lexicalGlobalObject, source, 0, Identifier(), JSParseNormal, ProgramNode::isFunctionNode ? JSParseFunctionCode : JSParseProgramCode, debugger, exec, exception);
-    if (!program) {
-        ASSERT(*exception);
+    UnlinkedFunctionExecutable* unlinkedFunction = UnlinkedFunctionExecutable::fromGlobalCode(name, exec, debugger, source, exception);
+    if (!unlinkedFunction)
         return 0;
-    }
-
-    // This function assumes an input string that would result in a single anonymous function expression.
-    StatementNode* exprStatement = program->singleStatement();
-    ASSERT(exprStatement);
-    ASSERT(exprStatement->isExprStatement());
-    ExpressionNode* funcExpr = static_cast<ExprStatementNode*>(exprStatement)->expr();
-    ASSERT(funcExpr);
-    ASSERT(funcExpr->isFuncExprNode());
-    FunctionBodyNode* body = static_cast<FuncExprNode*>(funcExpr)->body();
-    ASSERT(body);
-    ASSERT(body->ident().isNull());
-
-    FunctionExecutable* functionExecutable = FunctionExecutable::create(exec->globalData(), body);
-    functionExecutable->m_nameValue.set(exec->globalData(), functionExecutable, jsString(&exec->globalData(), name.string()));
-    return functionExecutable;
+    unsigned firstLine = source.firstLine() + unlinkedFunction->firstLineOffset();
+    unsigned startOffset = source.startOffset() + unlinkedFunction->startOffset();
+    unsigned sourceLength = unlinkedFunction->sourceLength();
+    SourceCode functionSource(source.provider(), startOffset, startOffset + sourceLength, firstLine);
+    return FunctionExecutable::create(exec->globalData(), functionSource, unlinkedFunction, firstLine, unlinkedFunction->lineCount());
 }
 
 String FunctionExecutable::paramString() const
 {
-    FunctionParameters& parameters = *m_parameters;
-    StringBuilder builder;
-    for (size_t pos = 0; pos < parameters.size(); ++pos) {
-        if (!builder.isEmpty())
-            builder.appendLiteral(", ");
-        builder.append(parameters[pos].string());
-    }
-    return builder.toString();
+    return m_unlinkedExecutable->paramString();
 }
 
 }
diff --git a/Source/JavaScriptCore/runtime/Executable.h b/Source/JavaScriptCore/runtime/Executable.h
index 76a537da3..74b4add75 100644
--- a/Source/JavaScriptCore/runtime/Executable.h
+++ b/Source/JavaScriptCore/runtime/Executable.h
@@ -35,6 +35,7 @@
 #include "LLIntCLoop.h"
 #include "Nodes.h"
 #include "SamplingTool.h"
+#include "UnlinkedCodeBlock.h"
 #include <wtf/PassOwnPtr.h>
 
 namespace JSC {
@@ -364,9 +365,19 @@ namespace JSC {
         bool isStrictMode() const { return m_features & StrictModeFeature; }
 
         void unlinkCalls();
+
+        CodeFeatures features() const { return m_features; }
         
         static const ClassInfo s_info;
 
+        void recordParse(CodeFeatures features, bool hasCapturedVariables, int firstLine, int lastLine)
+        {
+            m_features = features;
+            m_hasCapturedVariables = hasCapturedVariables;
+            m_firstLine = firstLine;
+            m_lastLine = lastLine;
+        }
+
     protected:
         void finishCreation(JSGlobalData& globalData)
         {
@@ -379,14 +390,6 @@ namespace JSC {
 #endif
         }
 
-        void recordParse(CodeFeatures features, bool hasCapturedVariables, int firstLine, int lastLine)
-        {
-            m_features = features;
-            m_hasCapturedVariables = hasCapturedVariables;
-            m_firstLine = firstLine;
-            m_lastLine = lastLine;
-        }
-
         SourceCode m_source;
         CodeFeatures m_features;
         bool m_hasCapturedVariables;
@@ -448,6 +451,8 @@ namespace JSC {
 
         void clearCode();
 
+        ExecutableInfo executableInfo() const { return ExecutableInfo(needsActivation(), usesEval(), isStrictMode(), false); }
+
     private:
         static const unsigned StructureFlags = OverridesVisitChildren | ScriptExecutable::StructureFlags;
         EvalExecutable(ExecState*, const SourceCode&, bool);
@@ -456,6 +461,7 @@ namespace JSC {
         static void visitChildren(JSCell*, SlotVisitor&);
 
         OwnPtr<EvalCodeBlock> m_evalCodeBlock;
+        WriteBarrier<UnlinkedEvalCodeBlock> m_unlinkedEvalCodeBlock;
     };
 
     class ProgramExecutable : public ScriptExecutable {
@@ -470,6 +476,9 @@ namespace JSC {
             return executable;
         }
 
+
+        JSObject* initalizeGlobalProperties(JSGlobalData&, CallFrame*, JSScope*);
+
         static void destroy(JSCell*);
 
         JSObject* compile(ExecState* exec, JSScope* scope)
@@ -515,13 +524,21 @@ namespace JSC {
 
         void clearCode();
 
+        ExecutableInfo executableInfo() const { return ExecutableInfo(needsActivation(), usesEval(), isStrictMode(), false); }
+
     private:
         static const unsigned StructureFlags = OverridesVisitChildren | ScriptExecutable::StructureFlags;
+
         ProgramExecutable(ExecState*, const SourceCode&);
 
+        enum ConstantMode { IsConstant, IsVariable };
+        enum FunctionMode { IsFunctionToSpecialize, NotFunctionOrNotSpecializable };
+        int addGlobalVar(JSGlobalObject*, const Identifier&, ConstantMode, FunctionMode);
+
         JSObject* compileInternal(ExecState*, JSScope*, JITCode::JITType, unsigned bytecodeIndex = UINT_MAX);
         static void visitChildren(JSCell*, SlotVisitor&);
 
+        WriteBarrier<UnlinkedProgramCodeBlock> m_unlinkedProgramCodeBlock;
         OwnPtr<ProgramCodeBlock> m_programCodeBlock;
     };
 
@@ -531,9 +548,9 @@ namespace JSC {
     public:
         typedef ScriptExecutable Base;
 
-        static FunctionExecutable* create(JSGlobalData& globalData, FunctionBodyNode* node)
+        static FunctionExecutable* create(JSGlobalData& globalData, const SourceCode& source, UnlinkedFunctionExecutable* unlinkedExecutable, unsigned firstLine, unsigned lastLine)
         {
-            FunctionExecutable* executable = new (NotNull, allocateCell<FunctionExecutable>(globalData.heap)) FunctionExecutable(globalData, node);
+            FunctionExecutable* executable = new (NotNull, allocateCell<FunctionExecutable>(globalData.heap)) FunctionExecutable(globalData, source, unlinkedExecutable, firstLine, lastLine);
             executable->finishCreation(globalData);
             return executable;
         }
@@ -554,7 +571,7 @@ namespace JSC {
         
         FunctionCodeBlock* codeBlockWithBytecodeFor(CodeSpecializationKind);
         
-        PassOwnPtr<FunctionCodeBlock> produceCodeBlockFor(JSScope*, CompilationKind, CodeSpecializationKind, JSObject*& exception);
+        PassOwnPtr<FunctionCodeBlock> produceCodeBlockFor(JSScope*, CodeSpecializationKind, JSObject*& exception);
 
         JSObject* compileForCall(ExecState* exec, JSScope* scope)
         {
@@ -679,14 +696,15 @@ namespace JSC {
             return baselineCodeBlockFor(kind);
         }
         
-        const Identifier& name() { return m_name; }
-        const Identifier& inferredName() { return m_inferredName; }
-        JSString* nameValue() const { return m_nameValue.get(); }
-        size_t parameterCount() const { return m_parameters->size(); } // Excluding 'this'!
+        const Identifier& name() { return m_unlinkedExecutable->name(); }
+        const Identifier& inferredName() { return m_unlinkedExecutable->inferredName(); }
+        JSString* nameValue() const { return m_unlinkedExecutable->nameValue(); }
+        size_t parameterCount() const { return m_unlinkedExecutable->parameterCount(); } // Excluding 'this'!
         String paramString() const;
-        SharedSymbolTable* symbolTable() const { return m_symbolTable.get(); }
+        SharedSymbolTable* symbolTable(CodeSpecializationKind kind) const { return m_unlinkedExecutable->symbolTable(kind); }
 
         void clearCodeIfNotCompiling();
+        void clearUnlinkedCodeIfNotCompiling();
         static void visitChildren(JSCell*, SlotVisitor&);
         static Structure* createStructure(JSGlobalData& globalData, JSGlobalObject* globalObject, JSValue proto)
         {
@@ -699,15 +717,8 @@ namespace JSC {
 
         void clearCode();
 
-    protected:
-        void finishCreation(JSGlobalData& globalData)
-        {
-            Base::finishCreation(globalData);
-            m_nameValue.set(globalData, this, jsString(&globalData, name().string()));
-        }
-
     private:
-        FunctionExecutable(JSGlobalData&, FunctionBodyNode*);
+        FunctionExecutable(JSGlobalData&, const SourceCode&, UnlinkedFunctionExecutable*, unsigned firstLine, unsigned lastLine);
 
         JSObject* compileForCallInternal(ExecState*, JSScope*, JITCode::JITType, unsigned bytecodeIndex = UINT_MAX);
         JSObject* compileForConstructInternal(ExecState*, JSScope*, JITCode::JITType, unsigned bytecodeIndex = UINT_MAX);
@@ -732,16 +743,9 @@ namespace JSC {
         }
 
         static const unsigned StructureFlags = OverridesVisitChildren | ScriptExecutable::StructureFlags;
-        bool m_forceUsesArguments;
-
-        RefPtr<FunctionParameters> m_parameters;
+        WriteBarrier<UnlinkedFunctionExecutable> m_unlinkedExecutable;
         OwnPtr<FunctionCodeBlock> m_codeBlockForCall;
         OwnPtr<FunctionCodeBlock> m_codeBlockForConstruct;
-        Identifier m_name;
-        Identifier m_inferredName;
-        FunctionNameIsInScopeToggle m_functionNameIsInScopeToggle;
-        WriteBarrier<JSString> m_nameValue;
-        WriteBarrier<SharedSymbolTable> m_symbolTable;
     };
 
     inline JSFunction::JSFunction(JSGlobalData& globalData, FunctionExecutable* executable, JSScope* scope)
diff --git a/Source/JavaScriptCore/runtime/ExecutionHarness.h b/Source/JavaScriptCore/runtime/ExecutionHarness.h
index 065788aee..b71b60217 100644
--- a/Source/JavaScriptCore/runtime/ExecutionHarness.h
+++ b/Source/JavaScriptCore/runtime/ExecutionHarness.h
@@ -49,7 +49,7 @@ inline bool prepareForExecution(ExecState* exec, OwnPtr<CodeBlockType>& codeBloc
     return jitCompileIfAppropriate(exec, codeBlock, jitCode, jitType, bytecodeIndex, JITCode::isBaselineCode(jitType) ? JITCompilationMustSucceed : JITCompilationCanFail);
 }
 
-inline bool prepareFunctionForExecution(ExecState* exec, OwnPtr<FunctionCodeBlock>& codeBlock, JITCode& jitCode, MacroAssemblerCodePtr& jitCodeWithArityCheck, WriteBarrier<SharedSymbolTable>& symbolTable, JITCode::JITType jitType, unsigned bytecodeIndex, CodeSpecializationKind kind)
+inline bool prepareFunctionForExecution(ExecState* exec, OwnPtr<FunctionCodeBlock>& codeBlock, JITCode& jitCode, MacroAssemblerCodePtr& jitCodeWithArityCheck, JITCode::JITType jitType, unsigned bytecodeIndex, CodeSpecializationKind kind)
 {
 #if ENABLE(LLINT)
     if (JITCode::isBaselineCode(jitType)) {
@@ -61,7 +61,7 @@ inline bool prepareFunctionForExecution(ExecState* exec, OwnPtr<FunctionCodeBloc
 #else
     UNUSED_PARAM(kind);
 #endif // ENABLE(LLINT)
-    return jitCompileFunctionIfAppropriate(exec, codeBlock, jitCode, jitCodeWithArityCheck, symbolTable, jitType, bytecodeIndex, JITCode::isBaselineCode(jitType) ? JITCompilationMustSucceed : JITCompilationCanFail);
+    return jitCompileFunctionIfAppropriate(exec, codeBlock, jitCode, jitCodeWithArityCheck, jitType, bytecodeIndex, JITCode::isBaselineCode(jitType) ? JITCompilationMustSucceed : JITCompilationCanFail);
 }
 
 } // namespace JSC
diff --git a/Source/JavaScriptCore/runtime/Identifier.cpp b/Source/JavaScriptCore/runtime/Identifier.cpp
index 45dd0bbde..583c12bb1 100644
--- a/Source/JavaScriptCore/runtime/Identifier.cpp
+++ b/Source/JavaScriptCore/runtime/Identifier.cpp
@@ -128,7 +128,7 @@ PassRefPtr<StringImpl> Identifier::add8(JSGlobalData* globalData, const UChar* s
     
     if (!length)
         return StringImpl::empty();
-    CharBuffer<UChar> buf = {s, length}; 
+    CharBuffer<UChar> buf = { s, static_cast<unsigned>(length) };
     HashSet<StringImpl*>::AddResult addResult = globalData->identifierTable->add<CharBuffer<UChar>, IdentifierLCharFromUCharTranslator >(buf);
     
     // If the string is newly-translated, then we need to adopt it.
diff --git a/Source/JavaScriptCore/runtime/Identifier.h b/Source/JavaScriptCore/runtime/Identifier.h
index bdcfbd187..dcb739ec3 100644
--- a/Source/JavaScriptCore/runtime/Identifier.h
+++ b/Source/JavaScriptCore/runtime/Identifier.h
@@ -180,7 +180,7 @@ namespace JSC {
         
         if (!length)
             return StringImpl::empty();
-        CharBuffer<T> buf = {s, length}; 
+        CharBuffer<T> buf = { s, static_cast<unsigned>(length) };
         HashSet<StringImpl*>::AddResult addResult = globalData->identifierTable->add<CharBuffer<T>, IdentifierCharBufferTranslator<T> >(buf);
         
         // If the string is newly-translated, then we need to adopt it.
diff --git a/Source/JavaScriptCore/runtime/JSActivation.h b/Source/JavaScriptCore/runtime/JSActivation.h
index fa2291813..fc6336463 100644
--- a/Source/JavaScriptCore/runtime/JSActivation.h
+++ b/Source/JavaScriptCore/runtime/JSActivation.h
@@ -46,15 +46,16 @@ namespace JSC {
     public:
         typedef JSVariableObject Base;
 
-        static JSActivation* create(JSGlobalData& globalData, CallFrame* callFrame, FunctionExecutable* functionExecutable)
+        static JSActivation* create(JSGlobalData& globalData, CallFrame* callFrame, CodeBlock* codeBlock)
         {
+            SharedSymbolTable* symbolTable = codeBlock->symbolTable();
             JSActivation* activation = new (
                 NotNull,
                 allocateCell<JSActivation>(
                     globalData.heap,
-                    allocationSize(functionExecutable->symbolTable())
+                    allocationSize(symbolTable)
                 )
-            ) JSActivation(globalData, callFrame, functionExecutable->symbolTable());
+            ) JSActivation(globalData, callFrame, symbolTable);
             activation->finishCreation(globalData);
             return activation;
         }
diff --git a/Source/JavaScriptCore/runtime/JSArray.cpp b/Source/JavaScriptCore/runtime/JSArray.cpp
index 7028c3b95..d1ece1a36 100644
--- a/Source/JavaScriptCore/runtime/JSArray.cpp
+++ b/Source/JavaScriptCore/runtime/JSArray.cpp
@@ -1092,7 +1092,7 @@ void JSArray::sortVector(ExecState* exec, JSValue compareFunction, CallType call
     for (; numDefined < usedVectorLength; ++numDefined) {
         if (numDefined > m_butterfly->vectorLength())
             break;
-        JSValue v = indexingData<indexingType>()[numDefined].get();
+        JSValue v = currentIndexingData()[numDefined].get();
         if (!v || v.isUndefined())
             break;
         tree.abstractor().m_nodes[numDefined].value = v;
@@ -1101,7 +1101,7 @@ void JSArray::sortVector(ExecState* exec, JSValue compareFunction, CallType call
     for (unsigned i = numDefined; i < usedVectorLength; ++i) {
         if (i > m_butterfly->vectorLength())
             break;
-        JSValue v = indexingData<indexingType>()[i].get();
+        JSValue v = currentIndexingData()[i].get();
         if (v) {
             if (v.isUndefined())
                 ++numUndefined;
@@ -1116,7 +1116,7 @@ void JSArray::sortVector(ExecState* exec, JSValue compareFunction, CallType call
     unsigned newUsedVectorLength = numDefined + numUndefined;
         
     // The array size may have changed. Figure out the new bounds.
-    unsigned newestUsedVectorLength = relevantLength<indexingType>();
+    unsigned newestUsedVectorLength = currentRelevantLength();
         
     unsigned elementsToExtractThreshold = min(min(newestUsedVectorLength, numDefined), static_cast<unsigned>(tree.abstractor().m_nodes.size()));
     unsigned undefinedElementsThreshold = min(newestUsedVectorLength, newUsedVectorLength);
@@ -1127,18 +1127,18 @@ void JSArray::sortVector(ExecState* exec, JSValue compareFunction, CallType call
     iter.start_iter_least(tree);
     JSGlobalData& globalData = exec->globalData();
     for (unsigned i = 0; i < elementsToExtractThreshold; ++i) {
-        indexingData<indexingType>()[i].set(globalData, this, tree.abstractor().m_nodes[*iter].value);
+        currentIndexingData()[i].set(globalData, this, tree.abstractor().m_nodes[*iter].value);
         ++iter;
     }
     // Put undefined values back in.
     for (unsigned i = elementsToExtractThreshold; i < undefinedElementsThreshold; ++i)
-        indexingData<indexingType>()[i].setUndefined();
+        currentIndexingData()[i].setUndefined();
 
     // Ensure that unused values in the vector are zeroed out.
     for (unsigned i = undefinedElementsThreshold; i < clearElementsThreshold; ++i)
-        indexingData<indexingType>()[i].clear();
+        currentIndexingData()[i].clear();
     
-    if (hasArrayStorage(indexingType))
+    if (hasArrayStorage(structure()->indexingType()))
         arrayStorage()->m_numValuesInVector = newUsedVectorLength;
 }
 
diff --git a/Source/JavaScriptCore/runtime/JSArray.h b/Source/JavaScriptCore/runtime/JSArray.h
index d4622aacc..1d1e64173 100644
--- a/Source/JavaScriptCore/runtime/JSArray.h
+++ b/Source/JavaScriptCore/runtime/JSArray.h
@@ -27,273 +27,273 @@
 
 namespace JSC {
 
-    class JSArray;
-    class LLIntOffsetsExtractor;
+class JSArray;
+class LLIntOffsetsExtractor;
 
-    class JSArray : public JSNonFinalObject {
-        friend class LLIntOffsetsExtractor;
-        friend class Walker;
-        friend class JIT;
+class JSArray : public JSNonFinalObject {
+    friend class LLIntOffsetsExtractor;
+    friend class Walker;
+    friend class JIT;
 
-    public:
-        typedef JSNonFinalObject Base;
+public:
+    typedef JSNonFinalObject Base;
 
-    protected:
-        explicit JSArray(JSGlobalData& globalData, Structure* structure, Butterfly* butterfly)
-            : JSNonFinalObject(globalData, structure, butterfly)
-        {
-        }
+protected:
+    explicit JSArray(JSGlobalData& globalData, Structure* structure, Butterfly* butterfly)
+        : JSNonFinalObject(globalData, structure, butterfly)
+    {
+    }
 
-    public:
-        static JSArray* create(JSGlobalData&, Structure*, unsigned initialLength = 0);
+public:
+    static JSArray* create(JSGlobalData&, Structure*, unsigned initialLength = 0);
 
-        // tryCreateUninitialized is used for fast construction of arrays whose size and
-        // contents are known at time of creation. Clients of this interface must:
-        //   - null-check the result (indicating out of memory, or otherwise unable to allocate vector).
-        //   - call 'initializeIndex' for all properties in sequence, for 0 <= i < initialLength.
-        static JSArray* tryCreateUninitialized(JSGlobalData&, Structure*, unsigned initialLength);
+    // tryCreateUninitialized is used for fast construction of arrays whose size and
+    // contents are known at time of creation. Clients of this interface must:
+    //   - null-check the result (indicating out of memory, or otherwise unable to allocate vector).
+    //   - call 'initializeIndex' for all properties in sequence, for 0 <= i < initialLength.
+    static JSArray* tryCreateUninitialized(JSGlobalData&, Structure*, unsigned initialLength);
 
-        JS_EXPORT_PRIVATE static bool defineOwnProperty(JSObject*, ExecState*, PropertyName, PropertyDescriptor&, bool throwException);
+    JS_EXPORT_PRIVATE static bool defineOwnProperty(JSObject*, ExecState*, PropertyName, PropertyDescriptor&, bool throwException);
 
-        static bool getOwnPropertySlot(JSCell*, ExecState*, PropertyName, PropertySlot&);
-        static bool getOwnPropertyDescriptor(JSObject*, ExecState*, PropertyName, PropertyDescriptor&);
+    static bool getOwnPropertySlot(JSCell*, ExecState*, PropertyName, PropertySlot&);
+    static bool getOwnPropertyDescriptor(JSObject*, ExecState*, PropertyName, PropertyDescriptor&);
 
-        static JS_EXPORTDATA const ClassInfo s_info;
+    static JS_EXPORTDATA const ClassInfo s_info;
         
-        unsigned length() const { return getArrayLength(); }
-        // OK to use on new arrays, but not if it might be a RegExpMatchArray.
-        bool setLength(ExecState*, unsigned, bool throwException = false);
+    unsigned length() const { return getArrayLength(); }
+    // OK to use on new arrays, but not if it might be a RegExpMatchArray.
+    bool setLength(ExecState*, unsigned, bool throwException = false);
 
-        void sort(ExecState*);
-        void sort(ExecState*, JSValue compareFunction, CallType, const CallData&);
-        void sortNumeric(ExecState*, JSValue compareFunction, CallType, const CallData&);
+    void sort(ExecState*);
+    void sort(ExecState*, JSValue compareFunction, CallType, const CallData&);
+    void sortNumeric(ExecState*, JSValue compareFunction, CallType, const CallData&);
 
-        void push(ExecState*, JSValue);
-        JSValue pop(ExecState*);
+    void push(ExecState*, JSValue);
+    JSValue pop(ExecState*);
 
-        enum ShiftCountMode {
-            // This form of shift hints that we're doing queueing. With this assumption in hand,
-            // we convert to ArrayStorage, which has queue optimizations.
-            ShiftCountForShift,
+    enum ShiftCountMode {
+        // This form of shift hints that we're doing queueing. With this assumption in hand,
+        // we convert to ArrayStorage, which has queue optimizations.
+        ShiftCountForShift,
             
-            // This form of shift hints that we're just doing care and feeding on an array that
-            // is probably typically used for ordinary accesses. With this assumption in hand,
-            // we try to preserve whatever indexing type it has already.
-            ShiftCountForSplice
-        };
-
-        bool shiftCountForShift(ExecState* exec, unsigned startIndex, unsigned count)
-        {
-            return shiftCountWithArrayStorage(startIndex, count, ensureArrayStorage(exec->globalData()));
-        }
-        bool shiftCountForSplice(ExecState* exec, unsigned startIndex, unsigned count)
-        {
-            return shiftCountWithAnyIndexingType(exec, startIndex, count);
-        }
-        template<ShiftCountMode shiftCountMode>
-        bool shiftCount(ExecState* exec, unsigned startIndex, unsigned count)
-        {
-            switch (shiftCountMode) {
-            case ShiftCountForShift:
-                return shiftCountForShift(exec, startIndex, count);
-            case ShiftCountForSplice:
-                return shiftCountForSplice(exec, startIndex, count);
-            default:
-                CRASH();
-                return false;
-            }
-        }
-        
-        bool unshiftCountForShift(ExecState* exec, unsigned startIndex, unsigned count)
-        {
-            return unshiftCountWithArrayStorage(exec, startIndex, count, ensureArrayStorage(exec->globalData()));
-        }
-        bool unshiftCountForSplice(ExecState* exec, unsigned startIndex, unsigned count)
-        {
-            return unshiftCountWithAnyIndexingType(exec, startIndex, count);
-        }
-        template<ShiftCountMode shiftCountMode>
-        bool unshiftCount(ExecState* exec, unsigned startIndex, unsigned count)
-        {
-            switch (shiftCountMode) {
-            case ShiftCountForShift:
-                return unshiftCountForShift(exec, startIndex, count);
-            case ShiftCountForSplice:
-                return unshiftCountForSplice(exec, startIndex, count);
-            default:
-                CRASH();
-                return false;
-            }
-        }
-
-        void fillArgList(ExecState*, MarkedArgumentBuffer&);
-        void copyToArguments(ExecState*, CallFrame*, uint32_t length);
-
-        static Structure* createStructure(JSGlobalData& globalData, JSGlobalObject* globalObject, JSValue prototype, IndexingType indexingType)
-        {
-            return Structure::create(globalData, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), &s_info, indexingType);
-        }
-        
-    protected:
-        static const unsigned StructureFlags = OverridesGetOwnPropertySlot | OverridesGetPropertyNames | JSObject::StructureFlags;
-        static void put(JSCell*, ExecState*, PropertyName, JSValue, PutPropertySlot&);
-
-        static bool deleteProperty(JSCell*, ExecState*, PropertyName);
-        JS_EXPORT_PRIVATE static void getOwnNonIndexPropertyNames(JSObject*, ExecState*, PropertyNameArray&, EnumerationMode);
-
-    private:
-        bool isLengthWritable()
-        {
-            ArrayStorage* storage = arrayStorageOrNull();
-            if (!storage)
-                return true;
-            SparseArrayValueMap* map = storage->m_sparseMap.get();
-            return !map || !map->lengthIsReadOnly();
-        }
-        
-        bool shiftCountWithAnyIndexingType(ExecState*, unsigned startIndex, unsigned count);
-        bool shiftCountWithArrayStorage(unsigned startIndex, unsigned count, ArrayStorage*);
-
-        bool unshiftCountWithAnyIndexingType(ExecState*, unsigned startIndex, unsigned count);
-        bool unshiftCountWithArrayStorage(ExecState*, unsigned startIndex, unsigned count, ArrayStorage*);
-        bool unshiftCountSlowCase(JSGlobalData&, bool, unsigned);
-
-        template<IndexingType indexingType>
-        void sortNumericVector(ExecState*, JSValue compareFunction, CallType, const CallData&);
-        
-        template<IndexingType indexingType>
-        void sortCompactedVector(ExecState*, WriteBarrier<Unknown>* begin, unsigned relevantLength);
-        
-        template<IndexingType indexingType>
-        void sortVector(ExecState*, JSValue compareFunction, CallType, const CallData&);
-
-        bool setLengthWithArrayStorage(ExecState*, unsigned newLength, bool throwException, ArrayStorage*);
-        void setLengthWritable(ExecState*, bool writable);
-        
-        template<IndexingType indexingType>
-        void compactForSorting(unsigned& numDefined, unsigned& newRelevantLength);
+        // This form of shift hints that we're just doing care and feeding on an array that
+        // is probably typically used for ordinary accesses. With this assumption in hand,
+        // we try to preserve whatever indexing type it has already.
+        ShiftCountForSplice
     };
 
-    inline Butterfly* createContiguousArrayButterfly(JSGlobalData& globalData, unsigned length)
+    bool shiftCountForShift(ExecState* exec, unsigned startIndex, unsigned count)
     {
-        IndexingHeader header;
-        header.setVectorLength(std::max(length, BASE_VECTOR_LEN));
-        header.setPublicLength(length);
-        Butterfly* result = Butterfly::create(
-            globalData, 0, 0, true, header, header.vectorLength() * sizeof(EncodedJSValue));
-        return result;
+        return shiftCountWithArrayStorage(startIndex, count, ensureArrayStorage(exec->globalData()));
     }
-
-    inline Butterfly* createArrayButterfly(JSGlobalData& globalData, unsigned initialLength)
+    bool shiftCountForSplice(ExecState* exec, unsigned startIndex, unsigned count)
     {
-        Butterfly* butterfly = Butterfly::create(
-            globalData, 0, 0, true, baseIndexingHeaderForArray(initialLength), ArrayStorage::sizeFor(BASE_VECTOR_LEN));
-        ArrayStorage* storage = butterfly->arrayStorage();
-        storage->m_indexBias = 0;
-        storage->m_sparseMap.clear();
-        storage->m_numValuesInVector = 0;
-        return butterfly;
+        return shiftCountWithAnyIndexingType(exec, startIndex, count);
     }
-
-    Butterfly* createArrayButterflyInDictionaryIndexingMode(JSGlobalData&, unsigned initialLength);
-
-    inline JSArray* JSArray::create(JSGlobalData& globalData, Structure* structure, unsigned initialLength)
+    template<ShiftCountMode shiftCountMode>
+    bool shiftCount(ExecState* exec, unsigned startIndex, unsigned count)
     {
-        Butterfly* butterfly;
-        if (LIKELY(structure->indexingType() == ArrayWithContiguous)) {
-            butterfly = createContiguousArrayButterfly(globalData, initialLength);
-            ASSERT(initialLength < MIN_SPARSE_ARRAY_INDEX);
-        } else {
-            ASSERT(
-                structure->indexingType() == ArrayWithSlowPutArrayStorage
-                || (initialLength && structure->indexingType() == ArrayWithArrayStorage));
-            butterfly = createArrayButterfly(globalData, initialLength);
+        switch (shiftCountMode) {
+        case ShiftCountForShift:
+            return shiftCountForShift(exec, startIndex, count);
+        case ShiftCountForSplice:
+            return shiftCountForSplice(exec, startIndex, count);
+        default:
+            CRASH();
+            return false;
         }
-        JSArray* array = new (NotNull, allocateCell<JSArray>(globalData.heap)) JSArray(globalData, structure, butterfly);
-        array->finishCreation(globalData);
-        return array;
     }
-
-    inline JSArray* JSArray::tryCreateUninitialized(JSGlobalData& globalData, Structure* structure, unsigned initialLength)
-    {
-        unsigned vectorLength = std::max(BASE_VECTOR_LEN, initialLength);
-        if (vectorLength > MAX_STORAGE_VECTOR_LENGTH)
-            return 0;
         
-        Butterfly* butterfly;
-        if (LIKELY(structure->indexingType() == ArrayWithContiguous)) {
-            
-            void* temp;
-            if (!globalData.heap.tryAllocateStorage(Butterfly::totalSize(0, 0, true, vectorLength * sizeof(EncodedJSValue)), &temp))
-                return 0;
-            butterfly = Butterfly::fromBase(temp, 0, 0);
-            butterfly->setVectorLength(vectorLength);
-            butterfly->setPublicLength(initialLength);
-        } else {
-            void* temp;
-            if (!globalData.heap.tryAllocateStorage(Butterfly::totalSize(0, 0, true, ArrayStorage::sizeFor(vectorLength)), &temp))
-                return 0;
-            butterfly = Butterfly::fromBase(temp, 0, 0);
-            *butterfly->indexingHeader() = indexingHeaderForArray(initialLength, vectorLength);
-            ArrayStorage* storage = butterfly->arrayStorage();
-            storage->m_indexBias = 0;
-            storage->m_sparseMap.clear();
-            storage->m_numValuesInVector = initialLength;
+    bool unshiftCountForShift(ExecState* exec, unsigned startIndex, unsigned count)
+    {
+        return unshiftCountWithArrayStorage(exec, startIndex, count, ensureArrayStorage(exec->globalData()));
+    }
+    bool unshiftCountForSplice(ExecState* exec, unsigned startIndex, unsigned count)
+    {
+        return unshiftCountWithAnyIndexingType(exec, startIndex, count);
+    }
+    template<ShiftCountMode shiftCountMode>
+    bool unshiftCount(ExecState* exec, unsigned startIndex, unsigned count)
+    {
+        switch (shiftCountMode) {
+        case ShiftCountForShift:
+            return unshiftCountForShift(exec, startIndex, count);
+        case ShiftCountForSplice:
+            return unshiftCountForSplice(exec, startIndex, count);
+        default:
+            CRASH();
+            return false;
         }
-        
-        JSArray* array = new (NotNull, allocateCell<JSArray>(globalData.heap)) JSArray(globalData, structure, butterfly);
-        array->finishCreation(globalData);
-        return array;
     }
 
-    JSArray* asArray(JSValue);
+    void fillArgList(ExecState*, MarkedArgumentBuffer&);
+    void copyToArguments(ExecState*, CallFrame*, uint32_t length);
 
-    inline JSArray* asArray(JSCell* cell)
+    static Structure* createStructure(JSGlobalData& globalData, JSGlobalObject* globalObject, JSValue prototype, IndexingType indexingType)
     {
-        ASSERT(cell->inherits(&JSArray::s_info));
-        return jsCast<JSArray*>(cell);
+        return Structure::create(globalData, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), &s_info, indexingType);
     }
+        
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | OverridesGetPropertyNames | JSObject::StructureFlags;
+    static void put(JSCell*, ExecState*, PropertyName, JSValue, PutPropertySlot&);
 
-    inline JSArray* asArray(JSValue value)
+    static bool deleteProperty(JSCell*, ExecState*, PropertyName);
+    JS_EXPORT_PRIVATE static void getOwnNonIndexPropertyNames(JSObject*, ExecState*, PropertyNameArray&, EnumerationMode);
+
+private:
+    bool isLengthWritable()
     {
-        return asArray(value.asCell());
+        ArrayStorage* storage = arrayStorageOrNull();
+        if (!storage)
+            return true;
+        SparseArrayValueMap* map = storage->m_sparseMap.get();
+        return !map || !map->lengthIsReadOnly();
     }
+        
+    bool shiftCountWithAnyIndexingType(ExecState*, unsigned startIndex, unsigned count);
+    bool shiftCountWithArrayStorage(unsigned startIndex, unsigned count, ArrayStorage*);
 
-    inline bool isJSArray(JSCell* cell) { return cell->classInfo() == &JSArray::s_info; }
-    inline bool isJSArray(JSValue v) { return v.isCell() && isJSArray(v.asCell()); }
+    bool unshiftCountWithAnyIndexingType(ExecState*, unsigned startIndex, unsigned count);
+    bool unshiftCountWithArrayStorage(ExecState*, unsigned startIndex, unsigned count, ArrayStorage*);
+    bool unshiftCountSlowCase(JSGlobalData&, bool, unsigned);
 
-    inline JSArray* constructArray(ExecState* exec, Structure* arrayStructure, const ArgList& values)
-    {
-        JSGlobalData& globalData = exec->globalData();
-        unsigned length = values.size();
-        JSArray* array = JSArray::tryCreateUninitialized(globalData, arrayStructure, length);
-
-        // FIXME: we should probably throw an out of memory error here, but
-        // when making this change we should check that all clients of this
-        // function will correctly handle an exception being thrown from here.
-        if (!array)
-            CRASH();
+    template<IndexingType indexingType>
+    void sortNumericVector(ExecState*, JSValue compareFunction, CallType, const CallData&);
+        
+    template<IndexingType indexingType>
+    void sortCompactedVector(ExecState*, WriteBarrier<Unknown>* begin, unsigned relevantLength);
+        
+    template<IndexingType indexingType>
+    void sortVector(ExecState*, JSValue compareFunction, CallType, const CallData&);
 
-        for (unsigned i = 0; i < length; ++i)
-            array->initializeIndex(globalData, i, values.at(i));
-        return array;
+    bool setLengthWithArrayStorage(ExecState*, unsigned newLength, bool throwException, ArrayStorage*);
+    void setLengthWritable(ExecState*, bool writable);
+        
+    template<IndexingType indexingType>
+    void compactForSorting(unsigned& numDefined, unsigned& newRelevantLength);
+};
+
+inline Butterfly* createContiguousArrayButterfly(JSGlobalData& globalData, unsigned length)
+{
+    IndexingHeader header;
+    header.setVectorLength(std::max(length, BASE_VECTOR_LEN));
+    header.setPublicLength(length);
+    Butterfly* result = Butterfly::create(
+        globalData, 0, 0, true, header, header.vectorLength() * sizeof(EncodedJSValue));
+    return result;
+}
+
+inline Butterfly* createArrayButterfly(JSGlobalData& globalData, unsigned initialLength)
+{
+    Butterfly* butterfly = Butterfly::create(
+        globalData, 0, 0, true, baseIndexingHeaderForArray(initialLength), ArrayStorage::sizeFor(BASE_VECTOR_LEN));
+    ArrayStorage* storage = butterfly->arrayStorage();
+    storage->m_indexBias = 0;
+    storage->m_sparseMap.clear();
+    storage->m_numValuesInVector = 0;
+    return butterfly;
+}
+
+Butterfly* createArrayButterflyInDictionaryIndexingMode(JSGlobalData&, unsigned initialLength);
+
+inline JSArray* JSArray::create(JSGlobalData& globalData, Structure* structure, unsigned initialLength)
+{
+    Butterfly* butterfly;
+    if (LIKELY(structure->indexingType() == ArrayWithContiguous)) {
+        butterfly = createContiguousArrayButterfly(globalData, initialLength);
+        ASSERT(initialLength < MIN_SPARSE_ARRAY_INDEX);
+    } else {
+        ASSERT(
+            structure->indexingType() == ArrayWithSlowPutArrayStorage
+            || (initialLength && structure->indexingType() == ArrayWithArrayStorage));
+        butterfly = createArrayButterfly(globalData, initialLength);
     }
-    
-    inline JSArray* constructArray(ExecState* exec, Structure* arrayStructure, const JSValue* values, unsigned length)
-    {
-        JSGlobalData& globalData = exec->globalData();
-        JSArray* array = JSArray::tryCreateUninitialized(globalData, arrayStructure, length);
-
-        // FIXME: we should probably throw an out of memory error here, but
-        // when making this change we should check that all clients of this
-        // function will correctly handle an exception being thrown from here.
-        if (!array)
-            CRASH();
-
-        for (unsigned i = 0; i < length; ++i)
-            array->initializeIndex(globalData, i, values[i]);
-        return array;
+    JSArray* array = new (NotNull, allocateCell<JSArray>(globalData.heap)) JSArray(globalData, structure, butterfly);
+    array->finishCreation(globalData);
+    return array;
+}
+
+inline JSArray* JSArray::tryCreateUninitialized(JSGlobalData& globalData, Structure* structure, unsigned initialLength)
+{
+    unsigned vectorLength = std::max(BASE_VECTOR_LEN, initialLength);
+    if (vectorLength > MAX_STORAGE_VECTOR_LENGTH)
+        return 0;
+        
+    Butterfly* butterfly;
+    if (LIKELY(structure->indexingType() == ArrayWithContiguous)) {
+            
+        void* temp;
+        if (!globalData.heap.tryAllocateStorage(Butterfly::totalSize(0, 0, true, vectorLength * sizeof(EncodedJSValue)), &temp))
+            return 0;
+        butterfly = Butterfly::fromBase(temp, 0, 0);
+        butterfly->setVectorLength(vectorLength);
+        butterfly->setPublicLength(initialLength);
+    } else {
+        void* temp;
+        if (!globalData.heap.tryAllocateStorage(Butterfly::totalSize(0, 0, true, ArrayStorage::sizeFor(vectorLength)), &temp))
+            return 0;
+        butterfly = Butterfly::fromBase(temp, 0, 0);
+        *butterfly->indexingHeader() = indexingHeaderForArray(initialLength, vectorLength);
+        ArrayStorage* storage = butterfly->arrayStorage();
+        storage->m_indexBias = 0;
+        storage->m_sparseMap.clear();
+        storage->m_numValuesInVector = initialLength;
     }
+        
+    JSArray* array = new (NotNull, allocateCell<JSArray>(globalData.heap)) JSArray(globalData, structure, butterfly);
+    array->finishCreation(globalData);
+    return array;
+}
+
+JSArray* asArray(JSValue);
+
+inline JSArray* asArray(JSCell* cell)
+{
+    ASSERT(cell->inherits(&JSArray::s_info));
+    return jsCast<JSArray*>(cell);
+}
+
+inline JSArray* asArray(JSValue value)
+{
+    return asArray(value.asCell());
+}
+
+inline bool isJSArray(JSCell* cell) { return cell->classInfo() == &JSArray::s_info; }
+inline bool isJSArray(JSValue v) { return v.isCell() && isJSArray(v.asCell()); }
+
+inline JSArray* constructArray(ExecState* exec, Structure* arrayStructure, const ArgList& values)
+{
+    JSGlobalData& globalData = exec->globalData();
+    unsigned length = values.size();
+    JSArray* array = JSArray::tryCreateUninitialized(globalData, arrayStructure, length);
+
+    // FIXME: we should probably throw an out of memory error here, but
+    // when making this change we should check that all clients of this
+    // function will correctly handle an exception being thrown from here.
+    if (!array)
+        CRASH();
+
+    for (unsigned i = 0; i < length; ++i)
+        array->initializeIndex(globalData, i, values.at(i));
+    return array;
+}
+    
+inline JSArray* constructArray(ExecState* exec, Structure* arrayStructure, const JSValue* values, unsigned length)
+{
+    JSGlobalData& globalData = exec->globalData();
+    JSArray* array = JSArray::tryCreateUninitialized(globalData, arrayStructure, length);
+
+    // FIXME: we should probably throw an out of memory error here, but
+    // when making this change we should check that all clients of this
+    // function will correctly handle an exception being thrown from here.
+    if (!array)
+        CRASH();
+
+    for (unsigned i = 0; i < length; ++i)
+        array->initializeIndex(globalData, i, values[i]);
+    return array;
+}
 
 } // namespace JSC
 
diff --git a/Source/JavaScriptCore/runtime/JSCell.h b/Source/JavaScriptCore/runtime/JSCell.h
index a39af1283..3b37613d1 100644
--- a/Source/JavaScriptCore/runtime/JSCell.h
+++ b/Source/JavaScriptCore/runtime/JSCell.h
@@ -38,326 +38,327 @@
 
 namespace JSC {
 
-    class CopyVisitor;
-    class JSDestructibleObject;
-    class JSGlobalObject;
-    class LLIntOffsetsExtractor;
-    class PropertyDescriptor;
-    class PropertyNameArray;
-    class Structure;
-
-    enum EnumerationMode {
-        ExcludeDontEnumProperties,
-        IncludeDontEnumProperties
-    };
-
-    class JSCell {
-        friend class JSValue;
-        friend class MarkedBlock;
-        template<typename T> friend void* allocateCell(Heap&);
-        template<typename T> friend void* allocateCell(Heap&, size_t);
-
-    public:
-        static const unsigned StructureFlags = 0;
-
-        static const bool needsDestruction = false;
-        static const bool hasImmortalStructure = false;
-
-        enum CreatingEarlyCellTag { CreatingEarlyCell };
-        JSCell(CreatingEarlyCellTag);
-
-    protected:
-        JSCell(JSGlobalData&, Structure*);
-        JS_EXPORT_PRIVATE static void destroy(JSCell*);
-
-    public:
-        // Querying the type.
-        bool isString() const;
-        bool isObject() const;
-        bool isGetterSetter() const;
-        bool inherits(const ClassInfo*) const;
-        bool isAPIValueWrapper() const;
-
-        Structure* structure() const;
-        void setStructure(JSGlobalData&, Structure*);
-        void clearStructure() { m_structure.clear(); }
-
-        const char* className();
-
-        // Extracting the value.
-        JS_EXPORT_PRIVATE bool getString(ExecState*, String&) const;
-        JS_EXPORT_PRIVATE String getString(ExecState*) const; // null string if not a string
-        JS_EXPORT_PRIVATE JSObject* getObject(); // NULL if not an object
-        const JSObject* getObject() const; // NULL if not an object
+class CopyVisitor;
+class JSDestructibleObject;
+class JSGlobalObject;
+class LLIntOffsetsExtractor;
+class PropertyDescriptor;
+class PropertyNameArray;
+class Structure;
+
+enum EnumerationMode {
+    ExcludeDontEnumProperties,
+    IncludeDontEnumProperties
+};
+
+class JSCell {
+    friend class JSValue;
+    friend class MarkedBlock;
+    template<typename T> friend void* allocateCell(Heap&);
+    template<typename T> friend void* allocateCell(Heap&, size_t);
+
+public:
+    static const unsigned StructureFlags = 0;
+
+    static const bool needsDestruction = false;
+    static const bool hasImmortalStructure = false;
+
+    enum CreatingEarlyCellTag { CreatingEarlyCell };
+    JSCell(CreatingEarlyCellTag);
+
+protected:
+    JSCell(JSGlobalData&, Structure*);
+    JS_EXPORT_PRIVATE static void destroy(JSCell*);
+
+public:
+    // Querying the type.
+    bool isString() const;
+    bool isObject() const;
+    bool isGetterSetter() const;
+    bool isProxy() const;
+    bool inherits(const ClassInfo*) const;
+    bool isAPIValueWrapper() const;
+
+    Structure* structure() const;
+    void setStructure(JSGlobalData&, Structure*);
+    void clearStructure() { m_structure.clear(); }
+
+    const char* className();
+
+    // Extracting the value.
+    JS_EXPORT_PRIVATE bool getString(ExecState*, String&) const;
+    JS_EXPORT_PRIVATE String getString(ExecState*) const; // null string if not a string
+    JS_EXPORT_PRIVATE JSObject* getObject(); // NULL if not an object
+    const JSObject* getObject() const; // NULL if not an object
         
-        JS_EXPORT_PRIVATE static CallType getCallData(JSCell*, CallData&);
-        JS_EXPORT_PRIVATE static ConstructType getConstructData(JSCell*, ConstructData&);
-
-        // Basic conversions.
-        JS_EXPORT_PRIVATE JSValue toPrimitive(ExecState*, PreferredPrimitiveType) const;
-        bool getPrimitiveNumber(ExecState*, double& number, JSValue&) const;
-        bool toBoolean(ExecState*) const;
-        JS_EXPORT_PRIVATE double toNumber(ExecState*) const;
-        JS_EXPORT_PRIVATE JSObject* toObject(ExecState*, JSGlobalObject*) const;
-
-        static void visitChildren(JSCell*, SlotVisitor&);
-        JS_EXPORT_PRIVATE static void copyBackingStore(JSCell*, CopyVisitor&);
-
-        // Object operations, with the toObject operation included.
-        const ClassInfo* classInfo() const;
-        const MethodTable* methodTable() const;
-        static void put(JSCell*, ExecState*, PropertyName, JSValue, PutPropertySlot&);
-        static void putByIndex(JSCell*, ExecState*, unsigned propertyName, JSValue, bool shouldThrow);
+    JS_EXPORT_PRIVATE static CallType getCallData(JSCell*, CallData&);
+    JS_EXPORT_PRIVATE static ConstructType getConstructData(JSCell*, ConstructData&);
+
+    // Basic conversions.
+    JS_EXPORT_PRIVATE JSValue toPrimitive(ExecState*, PreferredPrimitiveType) const;
+    bool getPrimitiveNumber(ExecState*, double& number, JSValue&) const;
+    bool toBoolean(ExecState*) const;
+    JS_EXPORT_PRIVATE double toNumber(ExecState*) const;
+    JS_EXPORT_PRIVATE JSObject* toObject(ExecState*, JSGlobalObject*) const;
+
+    static void visitChildren(JSCell*, SlotVisitor&);
+    JS_EXPORT_PRIVATE static void copyBackingStore(JSCell*, CopyVisitor&);
+
+    // Object operations, with the toObject operation included.
+    const ClassInfo* classInfo() const;
+    const MethodTable* methodTable() const;
+    static void put(JSCell*, ExecState*, PropertyName, JSValue, PutPropertySlot&);
+    static void putByIndex(JSCell*, ExecState*, unsigned propertyName, JSValue, bool shouldThrow);
         
-        static bool deleteProperty(JSCell*, ExecState*, PropertyName);
-        static bool deletePropertyByIndex(JSCell*, ExecState*, unsigned propertyName);
-
-        static JSObject* toThisObject(JSCell*, ExecState*);
-
-        void zap() { *reinterpret_cast<uintptr_t**>(this) = 0; }
-        bool isZapped() const { return !*reinterpret_cast<uintptr_t* const*>(this); }
-
-        // FIXME: Rename getOwnPropertySlot to virtualGetOwnPropertySlot, and
-        // fastGetOwnPropertySlot to getOwnPropertySlot. Callers should always
-        // call this function, not its slower virtual counterpart. (For integer
-        // property names, we want a similar interface with appropriate optimizations.)
-        bool fastGetOwnPropertySlot(ExecState*, PropertyName, PropertySlot&);
-        JSValue fastGetOwnProperty(ExecState*, const String&);
-
-        static ptrdiff_t structureOffset()
-        {
-            return OBJECT_OFFSETOF(JSCell, m_structure);
-        }
-
-        void* structureAddress()
-        {
-            return &m_structure;
-        }
-        
-#if ENABLE(GC_VALIDATION)
-        Structure* unvalidatedStructure() { return m_structure.unvalidatedGet(); }
-#endif
-        
-        static const TypedArrayType TypedArrayStorageType = TypedArrayNone;
-    protected:
-
-        void finishCreation(JSGlobalData&);
-        void finishCreation(JSGlobalData&, Structure*, CreatingEarlyCellTag);
-
-        // Base implementation; for non-object classes implements getPropertySlot.
-        static bool getOwnPropertySlot(JSCell*, ExecState*, PropertyName, PropertySlot&);
-        static bool getOwnPropertySlotByIndex(JSCell*, ExecState*, unsigned propertyName, PropertySlot&);
-
-        // Dummy implementations of override-able static functions for classes to put in their MethodTable
-        static JSValue defaultValue(const JSObject*, ExecState*, PreferredPrimitiveType);
-        static NO_RETURN_DUE_TO_ASSERT void getOwnPropertyNames(JSObject*, ExecState*, PropertyNameArray&, EnumerationMode);
-        static NO_RETURN_DUE_TO_ASSERT void getOwnNonIndexPropertyNames(JSObject*, ExecState*, PropertyNameArray&, EnumerationMode);
-        static NO_RETURN_DUE_TO_ASSERT void getPropertyNames(JSObject*, ExecState*, PropertyNameArray&, EnumerationMode);
-        static String className(const JSObject*);
-        JS_EXPORT_PRIVATE static bool customHasInstance(JSObject*, ExecState*, JSValue);
-        static NO_RETURN_DUE_TO_ASSERT void putDirectVirtual(JSObject*, ExecState*, PropertyName, JSValue, unsigned attributes);
-        static bool defineOwnProperty(JSObject*, ExecState*, PropertyName, PropertyDescriptor&, bool shouldThrow);
-        static bool getOwnPropertyDescriptor(JSObject*, ExecState*, PropertyName, PropertyDescriptor&);
-
-    private:
-        friend class LLIntOffsetsExtractor;
-        
-        WriteBarrier<Structure> m_structure;
-    };
-
-    inline JSCell::JSCell(CreatingEarlyCellTag)
-    {
-    }
-
-    inline void JSCell::finishCreation(JSGlobalData& globalData)
-    {
-#if ENABLE(GC_VALIDATION)
-        ASSERT(globalData.isInitializingObject());
-        globalData.setInitializingObjectClass(0);
-#else
-        UNUSED_PARAM(globalData);
-#endif
-        ASSERT(m_structure);
-    }
-
-    inline Structure* JSCell::structure() const
-    {
-        return m_structure.get();
-    }
-
-    inline void JSCell::visitChildren(JSCell* cell, SlotVisitor& visitor)
-    {
-        MARK_LOG_PARENT(visitor, cell);
-
-        visitor.append(&cell->m_structure);
-    }
-
-    // --- JSValue inlines ----------------------------
-
-    inline bool JSValue::isString() const
-    {
-        return isCell() && asCell()->isString();
-    }
+    static bool deleteProperty(JSCell*, ExecState*, PropertyName);
+    static bool deletePropertyByIndex(JSCell*, ExecState*, unsigned propertyName);
 
-    inline bool JSValue::isPrimitive() const
-    {
-        return !isCell() || asCell()->isString();
-    }
+    static JSObject* toThisObject(JSCell*, ExecState*);
 
-    inline bool JSValue::isGetterSetter() const
-    {
-        return isCell() && asCell()->isGetterSetter();
-    }
+    void zap() { *reinterpret_cast<uintptr_t**>(this) = 0; }
+    bool isZapped() const { return !*reinterpret_cast<uintptr_t* const*>(this); }
 
-    inline bool JSValue::isObject() const
-    {
-        return isCell() && asCell()->isObject();
-    }
+    // FIXME: Rename getOwnPropertySlot to virtualGetOwnPropertySlot, and
+    // fastGetOwnPropertySlot to getOwnPropertySlot. Callers should always
+    // call this function, not its slower virtual counterpart. (For integer
+    // property names, we want a similar interface with appropriate optimizations.)
+    bool fastGetOwnPropertySlot(ExecState*, PropertyName, PropertySlot&);
+    JSValue fastGetOwnProperty(ExecState*, const String&);
 
-    inline bool JSValue::getString(ExecState* exec, String& s) const
+    static ptrdiff_t structureOffset()
     {
-        return isCell() && asCell()->getString(exec, s);
+        return OBJECT_OFFSETOF(JSCell, m_structure);
     }
 
-    inline String JSValue::getString(ExecState* exec) const
+    void* structureAddress()
     {
-        return isCell() ? asCell()->getString(exec) : String();
+        return &m_structure;
     }
+        
+#if ENABLE(GC_VALIDATION)
+    Structure* unvalidatedStructure() { return m_structure.unvalidatedGet(); }
+#endif
+        
+    static const TypedArrayType TypedArrayStorageType = TypedArrayNone;
+protected:
+
+    void finishCreation(JSGlobalData&);
+    void finishCreation(JSGlobalData&, Structure*, CreatingEarlyCellTag);
+
+    // Base implementation; for non-object classes implements getPropertySlot.
+    static bool getOwnPropertySlot(JSCell*, ExecState*, PropertyName, PropertySlot&);
+    static bool getOwnPropertySlotByIndex(JSCell*, ExecState*, unsigned propertyName, PropertySlot&);
+
+    // Dummy implementations of override-able static functions for classes to put in their MethodTable
+    static JSValue defaultValue(const JSObject*, ExecState*, PreferredPrimitiveType);
+    static NO_RETURN_DUE_TO_ASSERT void getOwnPropertyNames(JSObject*, ExecState*, PropertyNameArray&, EnumerationMode);
+    static NO_RETURN_DUE_TO_ASSERT void getOwnNonIndexPropertyNames(JSObject*, ExecState*, PropertyNameArray&, EnumerationMode);
+    static NO_RETURN_DUE_TO_ASSERT void getPropertyNames(JSObject*, ExecState*, PropertyNameArray&, EnumerationMode);
+    static String className(const JSObject*);
+    JS_EXPORT_PRIVATE static bool customHasInstance(JSObject*, ExecState*, JSValue);
+    static NO_RETURN_DUE_TO_ASSERT void putDirectVirtual(JSObject*, ExecState*, PropertyName, JSValue, unsigned attributes);
+    static bool defineOwnProperty(JSObject*, ExecState*, PropertyName, PropertyDescriptor&, bool shouldThrow);
+    static bool getOwnPropertyDescriptor(JSObject*, ExecState*, PropertyName, PropertyDescriptor&);
+
+private:
+    friend class LLIntOffsetsExtractor;
+        
+    WriteBarrier<Structure> m_structure;
+};
 
-    template <typename Base> String HandleConverter<Base, Unknown>::getString(ExecState* exec) const
-    {
-        return jsValue().getString(exec);
-    }
+inline JSCell::JSCell(CreatingEarlyCellTag)
+{
+}
 
-    inline JSObject* JSValue::getObject() const
-    {
-        return isCell() ? asCell()->getObject() : 0;
-    }
-
-    ALWAYS_INLINE bool JSValue::getUInt32(uint32_t& v) const
-    {
-        if (isInt32()) {
-            int32_t i = asInt32();
-            v = static_cast<uint32_t>(i);
-            return i >= 0;
-        }
-        if (isDouble()) {
-            double d = asDouble();
-            v = static_cast<uint32_t>(d);
-            return v == d;
-        }
-        return false;
+inline void JSCell::finishCreation(JSGlobalData& globalData)
+{
+#if ENABLE(GC_VALIDATION)
+    ASSERT(globalData.isInitializingObject());
+    globalData.setInitializingObjectClass(0);
+#else
+    UNUSED_PARAM(globalData);
+#endif
+    ASSERT(m_structure);
+}
+
+inline Structure* JSCell::structure() const
+{
+    return m_structure.get();
+}
+
+inline void JSCell::visitChildren(JSCell* cell, SlotVisitor& visitor)
+{
+    MARK_LOG_PARENT(visitor, cell);
+
+    visitor.append(&cell->m_structure);
+}
+
+// --- JSValue inlines ----------------------------
+
+inline bool JSValue::isString() const
+{
+    return isCell() && asCell()->isString();
+}
+
+inline bool JSValue::isPrimitive() const
+{
+    return !isCell() || asCell()->isString();
+}
+
+inline bool JSValue::isGetterSetter() const
+{
+    return isCell() && asCell()->isGetterSetter();
+}
+
+inline bool JSValue::isObject() const
+{
+    return isCell() && asCell()->isObject();
+}
+
+inline bool JSValue::getString(ExecState* exec, String& s) const
+{
+    return isCell() && asCell()->getString(exec, s);
+}
+
+inline String JSValue::getString(ExecState* exec) const
+{
+    return isCell() ? asCell()->getString(exec) : String();
+}
+
+template <typename Base> String HandleConverter<Base, Unknown>::getString(ExecState* exec) const
+{
+    return jsValue().getString(exec);
+}
+
+inline JSObject* JSValue::getObject() const
+{
+    return isCell() ? asCell()->getObject() : 0;
+}
+
+ALWAYS_INLINE bool JSValue::getUInt32(uint32_t& v) const
+{
+    if (isInt32()) {
+        int32_t i = asInt32();
+        v = static_cast<uint32_t>(i);
+        return i >= 0;
     }
-
-    inline JSValue JSValue::toPrimitive(ExecState* exec, PreferredPrimitiveType preferredType) const
-    {
-        return isCell() ? asCell()->toPrimitive(exec, preferredType) : asValue();
+    if (isDouble()) {
+        double d = asDouble();
+        v = static_cast<uint32_t>(d);
+        return v == d;
     }
-
-    inline bool JSValue::getPrimitiveNumber(ExecState* exec, double& number, JSValue& value)
-    {
-        if (isInt32()) {
-            number = asInt32();
-            value = *this;
-            return true;
-        }
-        if (isDouble()) {
-            number = asDouble();
-            value = *this;
-            return true;
-        }
-        if (isCell())
-            return asCell()->getPrimitiveNumber(exec, number, value);
-        if (isTrue()) {
-            number = 1.0;
-            value = *this;
-            return true;
-        }
-        if (isFalse() || isNull()) {
-            number = 0.0;
-            value = *this;
-            return true;
-        }
-        ASSERT(isUndefined());
-        number = std::numeric_limits<double>::quiet_NaN();
+    return false;
+}
+
+inline JSValue JSValue::toPrimitive(ExecState* exec, PreferredPrimitiveType preferredType) const
+{
+    return isCell() ? asCell()->toPrimitive(exec, preferredType) : asValue();
+}
+
+inline bool JSValue::getPrimitiveNumber(ExecState* exec, double& number, JSValue& value)
+{
+    if (isInt32()) {
+        number = asInt32();
         value = *this;
         return true;
     }
-
-    ALWAYS_INLINE double JSValue::toNumber(ExecState* exec) const
-    {
-        if (isInt32())
-            return asInt32();
-        if (isDouble())
-            return asDouble();
-        return toNumberSlowCase(exec);
+    if (isDouble()) {
+        number = asDouble();
+        value = *this;
+        return true;
     }
-
-    inline JSObject* JSValue::toObject(ExecState* exec) const
-    {
-        return isCell() ? asCell()->toObject(exec, exec->lexicalGlobalObject()) : toObjectSlowCase(exec, exec->lexicalGlobalObject());
+    if (isCell())
+        return asCell()->getPrimitiveNumber(exec, number, value);
+    if (isTrue()) {
+        number = 1.0;
+        value = *this;
+        return true;
     }
-
-    inline JSObject* JSValue::toObject(ExecState* exec, JSGlobalObject* globalObject) const
-    {
-        return isCell() ? asCell()->toObject(exec, globalObject) : toObjectSlowCase(exec, globalObject);
+    if (isFalse() || isNull()) {
+        number = 0.0;
+        value = *this;
+        return true;
     }
-
-    template<typename T>
-    void* allocateCell(Heap& heap, size_t size)
-    {
-        ASSERT(size >= sizeof(T));
+    ASSERT(isUndefined());
+    number = QNaN;
+    value = *this;
+    return true;
+}
+
+ALWAYS_INLINE double JSValue::toNumber(ExecState* exec) const
+{
+    if (isInt32())
+        return asInt32();
+    if (isDouble())
+        return asDouble();
+    return toNumberSlowCase(exec);
+}
+
+inline JSObject* JSValue::toObject(ExecState* exec) const
+{
+    return isCell() ? asCell()->toObject(exec, exec->lexicalGlobalObject()) : toObjectSlowCase(exec, exec->lexicalGlobalObject());
+}
+
+inline JSObject* JSValue::toObject(ExecState* exec, JSGlobalObject* globalObject) const
+{
+    return isCell() ? asCell()->toObject(exec, globalObject) : toObjectSlowCase(exec, globalObject);
+}
+
+template<typename T>
+void* allocateCell(Heap& heap, size_t size)
+{
+    ASSERT(size >= sizeof(T));
 #if ENABLE(GC_VALIDATION)
-        ASSERT(!heap.globalData()->isInitializingObject());
-        heap.globalData()->setInitializingObjectClass(&T::s_info);
+    ASSERT(!heap.globalData()->isInitializingObject());
+    heap.globalData()->setInitializingObjectClass(&T::s_info);
 #endif
-        JSCell* result = 0;
-        if (T::needsDestruction && T::hasImmortalStructure)
-            result = static_cast<JSCell*>(heap.allocateWithImmortalStructureDestructor(size));
-        else if (T::needsDestruction && !T::hasImmortalStructure)
-            result = static_cast<JSCell*>(heap.allocateWithNormalDestructor(size));
-        else 
-            result = static_cast<JSCell*>(heap.allocateWithoutDestructor(size));
-        result->clearStructure();
-        return result;
-    }
+    JSCell* result = 0;
+    if (T::needsDestruction && T::hasImmortalStructure)
+        result = static_cast<JSCell*>(heap.allocateWithImmortalStructureDestructor(size));
+    else if (T::needsDestruction && !T::hasImmortalStructure)
+        result = static_cast<JSCell*>(heap.allocateWithNormalDestructor(size));
+    else 
+        result = static_cast<JSCell*>(heap.allocateWithoutDestructor(size));
+    result->clearStructure();
+    return result;
+}
     
-    template<typename T>
-    void* allocateCell(Heap& heap)
-    {
-        return allocateCell<T>(heap, sizeof(T));
-    }
+template<typename T>
+void* allocateCell(Heap& heap)
+{
+    return allocateCell<T>(heap, sizeof(T));
+}
     
-    inline bool isZapped(const JSCell* cell)
-    {
-        return cell->isZapped();
-    }
-
-    template<typename To, typename From>
-    inline To jsCast(From* from)
-    {
-        ASSERT(!from || from->JSCell::inherits(&WTF::RemovePointer<To>::Type::s_info));
-        return static_cast<To>(from);
-    }
+inline bool isZapped(const JSCell* cell)
+{
+    return cell->isZapped();
+}
+
+template<typename To, typename From>
+inline To jsCast(From* from)
+{
+    ASSERT(!from || from->JSCell::inherits(&WTF::RemovePointer<To>::Type::s_info));
+    return static_cast<To>(from);
+}
     
-    template<typename To>
-    inline To jsCast(JSValue from)
-    {
-        ASSERT(from.isCell() && from.asCell()->JSCell::inherits(&WTF::RemovePointer<To>::Type::s_info));
-        return static_cast<To>(from.asCell());
-    }
-
-    template<typename To, typename From>
-    inline To jsDynamicCast(From* from)
-    {
-        return from->inherits(&WTF::RemovePointer<To>::Type::s_info) ? static_cast<To>(from) : 0;
-    }
-
-    template<typename To>
-    inline To jsDynamicCast(JSValue from)
-    {
-        return from.isCell() && from.asCell()->inherits(&WTF::RemovePointer<To>::Type::s_info) ? static_cast<To>(from.asCell()) : 0;
-    }
+template<typename To>
+inline To jsCast(JSValue from)
+{
+    ASSERT(from.isCell() && from.asCell()->JSCell::inherits(&WTF::RemovePointer<To>::Type::s_info));
+    return static_cast<To>(from.asCell());
+}
+
+template<typename To, typename From>
+inline To jsDynamicCast(From* from)
+{
+    return from->inherits(&WTF::RemovePointer<To>::Type::s_info) ? static_cast<To>(from) : 0;
+}
+
+template<typename To>
+inline To jsDynamicCast(JSValue from)
+{
+    return from.isCell() && from.asCell()->inherits(&WTF::RemovePointer<To>::Type::s_info) ? static_cast<To>(from.asCell()) : 0;
+}
 
 } // namespace JSC
 
diff --git a/Source/JavaScriptCore/runtime/JSDateMath.cpp b/Source/JavaScriptCore/runtime/JSDateMath.cpp
index c54147ef2..cd3948fcf 100644
--- a/Source/JavaScriptCore/runtime/JSDateMath.cpp
+++ b/Source/JavaScriptCore/runtime/JSDateMath.cpp
@@ -247,7 +247,7 @@ double parseDateFromNullTerminatedCharacters(ExecState* exec, const char* dateSt
     int offset;
     double ms = WTF::parseDateFromNullTerminatedCharacters(dateString, haveTZ, offset);
     if (isnan(ms))
-        return std::numeric_limits<double>::quiet_NaN();
+        return QNaN;
 
     // fall back to local timezone
     if (!haveTZ) {
diff --git a/Source/JavaScriptCore/runtime/JSGlobalData.cpp b/Source/JavaScriptCore/runtime/JSGlobalData.cpp
index 5fb682bdb..4dca5b0f6 100644
--- a/Source/JavaScriptCore/runtime/JSGlobalData.cpp
+++ b/Source/JavaScriptCore/runtime/JSGlobalData.cpp
@@ -30,6 +30,7 @@
 #include "JSGlobalData.h"
 
 #include "ArgList.h"
+#include "CodeCache.h"
 #include "CommonIdentifiers.h"
 #include "DebuggerActivation.h"
 #include "FunctionConstructor.h"
@@ -57,6 +58,7 @@
 #include "RegExpObject.h"
 #include "StrictEvalActivation.h"
 #include "StrongInlines.h"
+#include "UnlinkedCodeBlock.h"
 #include <wtf/RetainPtr.h>
 #include <wtf/Threading.h>
 #include <wtf/WTFThreadData.h>
@@ -170,7 +172,7 @@ JSGlobalData::JSGlobalData(GlobalDataType globalDataType, HeapType heapType)
     , sizeOfLastScratchBuffer(0)
 #endif
     , dynamicGlobalObject(0)
-    , cachedUTCOffset(std::numeric_limits<double>::quiet_NaN())
+    , cachedUTCOffset(QNaN)
     , m_enabledProfiler(0)
     , m_regExpCache(new RegExpCache(this))
 #if ENABLE(REGEXP_TRACING)
@@ -196,6 +198,7 @@ JSGlobalData::JSGlobalData(GlobalDataType globalDataType, HeapType heapType)
     , m_initializingObjectClass(0)
 #endif
     , m_inDefineOwnProperty(false)
+    , m_codeCache(CodeCache::create())
 {
     interpreter = new Interpreter(*this);
 
@@ -221,6 +224,11 @@ JSGlobalData::JSGlobalData(GlobalDataType globalDataType, HeapType heapType)
     sharedSymbolTableStructure.set(*this, SharedSymbolTable::createStructure(*this, 0, jsNull()));
     structureChainStructure.set(*this, StructureChain::createStructure(*this, 0, jsNull()));
     sparseArrayValueMapStructure.set(*this, SparseArrayValueMap::createStructure(*this, 0, jsNull()));
+    withScopeStructure.set(*this, JSWithScope::createStructure(*this, 0, jsNull()));
+    unlinkedFunctionExecutableStructure.set(*this, UnlinkedFunctionExecutable::createStructure(*this, 0, jsNull()));
+    unlinkedProgramCodeBlockStructure.set(*this, UnlinkedProgramCodeBlock::createStructure(*this, 0, jsNull()));
+    unlinkedEvalCodeBlockStructure.set(*this, UnlinkedEvalCodeBlock::createStructure(*this, 0, jsNull()));
+    unlinkedFunctionCodeBlockStructure.set(*this, UnlinkedFunctionCodeBlock::createStructure(*this, 0, jsNull()));
 
     wtfThreadData().setCurrentIdentifierTable(existingEntryIdentifierTable);
 
@@ -400,10 +408,10 @@ JSGlobalData::ClientData::~ClientData()
 
 void JSGlobalData::resetDateCache()
 {
-    cachedUTCOffset = std::numeric_limits<double>::quiet_NaN();
+    cachedUTCOffset = QNaN;
     dstOffsetCache.reset();
     cachedDateString = String();
-    cachedDateStringValue = std::numeric_limits<double>::quiet_NaN();
+    cachedDateStringValue = QNaN;
     dateInstanceCache.reset();
 }
 
diff --git a/Source/JavaScriptCore/runtime/JSGlobalData.h b/Source/JavaScriptCore/runtime/JSGlobalData.h
index e97c0a015..0ffaccb6a 100644
--- a/Source/JavaScriptCore/runtime/JSGlobalData.h
+++ b/Source/JavaScriptCore/runtime/JSGlobalData.h
@@ -63,6 +63,7 @@ struct OpaqueJSClassContextData;
 namespace JSC {
 
     class CodeBlock;
+    class CodeCache;
     class CommonIdentifiers;
     class HandleStack;
     class IdentifierTable;
@@ -80,6 +81,10 @@ namespace JSC {
 #if ENABLE(REGEXP_TRACING)
     class RegExp;
 #endif
+    class UnlinkedCodeBlock;
+    class UnlinkedEvalCodeBlock;
+    class UnlinkedFunctionExecutable;
+    class UnlinkedProgramCodeBlock;
 
     struct HashTable;
     struct Instruction;
@@ -223,6 +228,11 @@ namespace JSC {
         Strong<Structure> sharedSymbolTableStructure;
         Strong<Structure> structureChainStructure;
         Strong<Structure> sparseArrayValueMapStructure;
+        Strong<Structure> withScopeStructure;
+        Strong<Structure> unlinkedFunctionExecutableStructure;
+        Strong<Structure> unlinkedProgramCodeBlockStructure;
+        Strong<Structure> unlinkedEvalCodeBlockStructure;
+        Strong<Structure> unlinkedFunctionCodeBlockStructure;
 
         IdentifierTable* identifierTable;
         CommonIdentifiers* propertyNames;
@@ -436,6 +446,7 @@ namespace JSC {
         }
 
         JSLock& apiLock() { return m_apiLock; }
+        CodeCache* codeCache() { return m_codeCache.get(); }
 
     private:
         friend class LLIntOffsetsExtractor;
@@ -456,6 +467,7 @@ namespace JSC {
         const ClassInfo* m_initializingObjectClass;
 #endif
         bool m_inDefineOwnProperty;
+        OwnPtr<CodeCache> m_codeCache;
 
         TypedArrayDescriptor m_int8ArrayDescriptor;
         TypedArrayDescriptor m_int16ArrayDescriptor;
diff --git a/Source/JavaScriptCore/runtime/JSGlobalObject.cpp b/Source/JavaScriptCore/runtime/JSGlobalObject.cpp
index 03252fad1..c466a2b04 100644
--- a/Source/JavaScriptCore/runtime/JSGlobalObject.cpp
+++ b/Source/JavaScriptCore/runtime/JSGlobalObject.cpp
@@ -36,6 +36,7 @@
 #include "BooleanConstructor.h"
 #include "BooleanPrototype.h"
 #include "CodeBlock.h"
+#include "CodeCache.h"
 #include "DateConstructor.h"
 #include "DatePrototype.h"
 #include "Debugger.h"
@@ -580,4 +581,58 @@ void slowValidateCell(JSGlobalObject* globalObject)
     ASSERT_GC_OBJECT_INHERITS(globalObject, &JSGlobalObject::s_info);
 }
 
+UnlinkedProgramCodeBlock* JSGlobalObject::createProgramCodeBlock(CallFrame* callFrame, ProgramExecutable* executable, JSObject** exception)
+{
+    ParserError error;
+    JSParserStrictness strictness = executable->isStrictMode() ? JSParseStrict : JSParseNormal;
+    DebuggerMode debuggerMode = hasDebugger() ? DebuggerOn : DebuggerOff;
+    ProfilerMode profilerMode = hasProfiler() ? ProfilerOn : ProfilerOff;
+    UnlinkedProgramCodeBlock* unlinkedCode = globalData().codeCache()->getProgramCodeBlock(globalData(), executable, executable->source(), strictness, debuggerMode, profilerMode, error);
+
+    if (hasDebugger())
+        debugger()->sourceParsed(callFrame, executable->source().provider(), error.m_line, error.m_message);
+
+    if (error.m_type != ParserError::ErrorNone) {
+        *exception = error.toErrorObject(this, executable->source());
+        return 0;
+    }
+    
+    return unlinkedCode;
+}
+
+UnlinkedEvalCodeBlock* JSGlobalObject::createEvalCodeBlock(CallFrame* callFrame, EvalExecutable* executable, JSObject** exception)
+{
+    ParserError error;
+    JSParserStrictness strictness = executable->isStrictMode() ? JSParseStrict : JSParseNormal;
+    DebuggerMode debuggerMode = hasDebugger() ? DebuggerOn : DebuggerOff;
+    ProfilerMode profilerMode = hasProfiler() ? ProfilerOn : ProfilerOff;
+    UnlinkedEvalCodeBlock* unlinkedCode = globalData().codeCache()->getEvalCodeBlock(globalData(), executable, executable->source(), strictness, debuggerMode, profilerMode, error);
+
+    if (hasDebugger())
+        debugger()->sourceParsed(callFrame, executable->source().provider(), error.m_line, error.m_message);
+
+    if (error.m_type != ParserError::ErrorNone) {
+        *exception = error.toErrorObject(this, executable->source());
+        return 0;
+    }
+
+    return unlinkedCode;
+}
+
+UnlinkedFunctionExecutable* JSGlobalObject::createFunctionExecutableFromGlobalCode(CallFrame* callFrame, const Identifier& name, const SourceCode& code, JSObject** exception)
+{
+    ParserError error;
+    UnlinkedFunctionExecutable* executable = globalData().codeCache()->getFunctionExecutableFromGlobalCode(globalData(), name, code, error);
+    if (hasDebugger())
+        debugger()->sourceParsed(callFrame, code.provider(), error.m_line, error.m_message);
+
+    if (error.m_type != ParserError::ErrorNone) {
+        *exception = error.toErrorObject(this, code);
+        return 0;
+    }
+
+    return executable;
+}
+
+
 } // namespace JSC
diff --git a/Source/JavaScriptCore/runtime/JSGlobalObject.h b/Source/JavaScriptCore/runtime/JSGlobalObject.h
index 2994aa64b..3212363ab 100644
--- a/Source/JavaScriptCore/runtime/JSGlobalObject.h
+++ b/Source/JavaScriptCore/runtime/JSGlobalObject.h
@@ -43,6 +43,10 @@ namespace JSC {
     class Debugger;
     class ErrorConstructor;
     class ErrorPrototype;
+    class EvalCodeBlock;
+    class EvalExecutable;
+    class FunctionCodeBlock;
+    class FunctionExecutable;
     class FunctionPrototype;
     class GetterSetter;
     class GlobalCodeBlock;
@@ -50,9 +54,10 @@ namespace JSC {
     class LLIntOffsetsExtractor;
     class NativeErrorConstructor;
     class ProgramCodeBlock;
+    class ProgramExecutable;
     class RegExpConstructor;
     class RegExpPrototype;
-
+    class SourceCode;
     struct ActivationStackNode;
     struct HashTable;
 
@@ -185,6 +190,9 @@ namespace JSC {
 
         static JS_EXPORTDATA const ClassInfo s_info;
 
+        bool hasDebugger() const { return m_debugger; }
+        bool hasProfiler() const { return globalObjectMethodTable()->supportsProfiling(this); }
+
     protected:
         JS_EXPORT_PRIVATE explicit JSGlobalObject(JSGlobalData&, Structure*, const GlobalObjectMethodTable* = 0);
 
@@ -271,6 +279,10 @@ namespace JSC {
         Structure* arrayStructureWithArrayStorage() const { return m_arrayStructureWithArrayStorage.get(); }
         void* addressOfArrayStructure() { return &m_arrayStructure; }
         void* addressOfArrayStructureWithArrayStorage() { return &m_arrayStructureWithArrayStorage; }
+        bool isOriginalArrayStructure(Structure* structure)
+        {
+            return structure == m_arrayStructure.get() || structure == m_arrayStructureWithArrayStorage.get();
+        }
         Structure* booleanObjectStructure() const { return m_booleanObjectStructure.get(); }
         Structure* callbackConstructorStructure() const { return m_callbackConstructorStructure.get(); }
         Structure* callbackFunctionStructure() const { return m_callbackFunctionStructure.get(); }
@@ -362,6 +374,11 @@ namespace JSC {
 
         double weakRandomNumber() { return m_weakRandom.get(); }
         unsigned weakRandomInteger() { return m_weakRandom.getUint32(); }
+
+        UnlinkedProgramCodeBlock* createProgramCodeBlock(CallFrame*, ProgramExecutable*, JSObject** exception);
+        UnlinkedEvalCodeBlock* createEvalCodeBlock(CallFrame*, EvalExecutable*, JSObject** exception);
+        UnlinkedFunctionExecutable* createFunctionExecutableFromGlobalCode(CallFrame*, const Identifier&, const SourceCode&, JSObject** exception);
+
     protected:
 
         static const unsigned StructureFlags = OverridesGetOwnPropertySlot | OverridesVisitChildren | OverridesGetPropertyNames | Base::StructureFlags;
diff --git a/Source/JavaScriptCore/runtime/JSGlobalObjectFunctions.cpp b/Source/JavaScriptCore/runtime/JSGlobalObjectFunctions.cpp
index 8b1acb25a..7ac76d350 100644
--- a/Source/JavaScriptCore/runtime/JSGlobalObjectFunctions.cpp
+++ b/Source/JavaScriptCore/runtime/JSGlobalObjectFunctions.cpp
@@ -276,7 +276,7 @@ static double parseInt(const String& s, const CharType* data, int radix)
 
     // 8.a If R < 2 or R > 36, then return NaN.
     if (radix < 2 || radix > 36)
-        return std::numeric_limits<double>::quiet_NaN();
+        return QNaN;
 
     // 13. Let mathInt be the mathematical integer value that is represented by Z in radix-R notation, using the letters
     //     A-Z and a-z for digits with values 10 through 35. (However, if R is 10 and Z contains more than 20 significant
@@ -299,7 +299,7 @@ static double parseInt(const String& s, const CharType* data, int radix)
 
     // 12. If Z is empty, return NaN.
     if (!sawDigit)
-        return std::numeric_limits<double>::quiet_NaN();
+        return QNaN;
 
     // Alternate code path for certain large numbers.
     if (number >= mantissaOverflowLowerBound) {
@@ -397,7 +397,7 @@ static double jsStrDecimalLiteral(const CharType*& data, const CharType* end)
     }
 
     // Not a number.
-    return std::numeric_limits<double>::quiet_NaN();
+    return QNaN;
 }
 
 template <typename CharType>
@@ -427,7 +427,7 @@ static double toDouble(const CharType* characters, unsigned size)
             break;
     }
     if (characters != endCharacters)
-        return std::numeric_limits<double>::quiet_NaN();
+        return QNaN;
     
     return number;
 }
@@ -443,7 +443,7 @@ double jsToNumber(const String& s)
             return c - '0';
         if (isStrWhiteSpace(c))
             return 0;
-        return std::numeric_limits<double>::quiet_NaN();
+        return QNaN;
     }
 
     if (s.is8Bit())
@@ -459,7 +459,7 @@ static double parseFloat(const String& s)
         UChar c = s[0];
         if (isASCIIDigit(c))
             return c - '0';
-        return std::numeric_limits<double>::quiet_NaN();
+        return QNaN;
     }
 
     if (s.is8Bit()) {
@@ -474,7 +474,7 @@ static double parseFloat(const String& s)
 
         // Empty string.
         if (data == end)
-            return std::numeric_limits<double>::quiet_NaN();
+            return QNaN;
 
         return jsStrDecimalLiteral(data, end);
     }
@@ -490,7 +490,7 @@ static double parseFloat(const String& s)
 
     // Empty string.
     if (data == end)
-        return std::numeric_limits<double>::quiet_NaN();
+        return QNaN;
 
     return jsStrDecimalLiteral(data, end);
 }
diff --git a/Source/JavaScriptCore/runtime/JSONObject.cpp b/Source/JavaScriptCore/runtime/JSONObject.cpp
index fd939934e..e051ec7d9 100644
--- a/Source/JavaScriptCore/runtime/JSONObject.cpp
+++ b/Source/JavaScriptCore/runtime/JSONObject.cpp
@@ -294,7 +294,7 @@ static void appendStringToStringBuilder(StringBuilder& builder, const CharType*
         default:
             static const char hexDigits[] = "0123456789abcdef";
             UChar ch = data[i];
-            LChar hex[] = { '\\', 'u', hexDigits[(ch >> 12) & 0xF], hexDigits[(ch >> 8) & 0xF], hexDigits[(ch >> 4) & 0xF], hexDigits[ch & 0xF] };
+            LChar hex[] = { '\\', 'u', static_cast<LChar>(hexDigits[(ch >> 12) & 0xF]), static_cast<LChar>(hexDigits[(ch >> 8) & 0xF]), static_cast<LChar>(hexDigits[(ch >> 4) & 0xF]), static_cast<LChar>(hexDigits[ch & 0xF]) };
             builder.append(hex, WTF_ARRAY_LENGTH(hex));
             break;
         }
diff --git a/Source/JavaScriptCore/runtime/JSObject.h b/Source/JavaScriptCore/runtime/JSObject.h
index 9204099cb..82455390f 100644
--- a/Source/JavaScriptCore/runtime/JSObject.h
+++ b/Source/JavaScriptCore/runtime/JSObject.h
@@ -44,810 +44,841 @@
 
 namespace JSC {
 
-    inline JSCell* getJSFunction(JSValue value)
-    {
-        if (value.isCell() && (value.asCell()->structure()->typeInfo().type() == JSFunctionType))
-            return value.asCell();
-        return 0;
-    }
+inline JSCell* getJSFunction(JSValue value)
+{
+    if (value.isCell() && (value.asCell()->structure()->typeInfo().type() == JSFunctionType))
+        return value.asCell();
+    return 0;
+}
 
-    JS_EXPORT_PRIVATE JSCell* getCallableObjectSlow(JSCell*);
+JS_EXPORT_PRIVATE JSCell* getCallableObjectSlow(JSCell*);
 
-    inline JSCell* getCallableObject(JSValue value)
-    {
-        if (!value.isCell())
-            return 0;
-        return getCallableObjectSlow(value.asCell());
-    }
-
-    class GetterSetter;
-    class HashEntry;
-    class InternalFunction;
-    class LLIntOffsetsExtractor;
-    class MarkedBlock;
-    class PropertyDescriptor;
-    class PropertyNameArray;
-    class Structure;
-    struct HashTable;
-
-    JS_EXPORT_PRIVATE JSObject* throwTypeError(ExecState*, const String&);
-    extern JS_EXPORTDATA const char* StrictModeReadonlyPropertyWriteError;
-
-    // ECMA 262-3 8.6.1
-    // Property attributes
-    enum Attribute {
-        None         = 0,
-        ReadOnly     = 1 << 1,  // property can be only read, not written
-        DontEnum     = 1 << 2,  // property doesn't appear in (for .. in ..)
-        DontDelete   = 1 << 3,  // property can't be deleted
-        Function     = 1 << 4,  // property is a function - only used by static hashtables
-        Accessor     = 1 << 5,  // property is a getter/setter
+inline JSCell* getCallableObject(JSValue value)
+{
+    if (!value.isCell())
+        return 0;
+    return getCallableObjectSlow(value.asCell());
+}
+
+class GetterSetter;
+class HashEntry;
+class InternalFunction;
+class LLIntOffsetsExtractor;
+class MarkedBlock;
+class PropertyDescriptor;
+class PropertyNameArray;
+class Structure;
+struct HashTable;
+
+JS_EXPORT_PRIVATE JSObject* throwTypeError(ExecState*, const String&);
+extern JS_EXPORTDATA const char* StrictModeReadonlyPropertyWriteError;
+
+// ECMA 262-3 8.6.1
+// Property attributes
+enum Attribute {
+    None         = 0,
+    ReadOnly     = 1 << 1,  // property can be only read, not written
+    DontEnum     = 1 << 2,  // property doesn't appear in (for .. in ..)
+    DontDelete   = 1 << 3,  // property can't be deleted
+    Function     = 1 << 4,  // property is a function - only used by static hashtables
+    Accessor     = 1 << 5,  // property is a getter/setter
+};
+
+COMPILE_ASSERT(None < FirstInternalAttribute, None_is_below_FirstInternalAttribute);
+COMPILE_ASSERT(ReadOnly < FirstInternalAttribute, ReadOnly_is_below_FirstInternalAttribute);
+COMPILE_ASSERT(DontEnum < FirstInternalAttribute, DontEnum_is_below_FirstInternalAttribute);
+COMPILE_ASSERT(DontDelete < FirstInternalAttribute, DontDelete_is_below_FirstInternalAttribute);
+COMPILE_ASSERT(Function < FirstInternalAttribute, Function_is_below_FirstInternalAttribute);
+COMPILE_ASSERT(Accessor < FirstInternalAttribute, Accessor_is_below_FirstInternalAttribute);
+
+class JSFinalObject;
+
+class JSObject : public JSCell {
+    friend class BatchedTransitionOptimizer;
+    friend class JIT;
+    friend class JSCell;
+    friend class JSFinalObject;
+    friend class MarkedBlock;
+    JS_EXPORT_PRIVATE friend bool setUpStaticFunctionSlot(ExecState*, const HashEntry*, JSObject*, PropertyName, PropertySlot&);
+
+    enum PutMode {
+        PutModePut,
+        PutModeDefineOwnProperty,
     };
 
-    COMPILE_ASSERT(None < FirstInternalAttribute, None_is_below_FirstInternalAttribute);
-    COMPILE_ASSERT(ReadOnly < FirstInternalAttribute, ReadOnly_is_below_FirstInternalAttribute);
-    COMPILE_ASSERT(DontEnum < FirstInternalAttribute, DontEnum_is_below_FirstInternalAttribute);
-    COMPILE_ASSERT(DontDelete < FirstInternalAttribute, DontDelete_is_below_FirstInternalAttribute);
-    COMPILE_ASSERT(Function < FirstInternalAttribute, Function_is_below_FirstInternalAttribute);
-    COMPILE_ASSERT(Accessor < FirstInternalAttribute, Accessor_is_below_FirstInternalAttribute);
-
-    class JSFinalObject;
-
-    class JSObject : public JSCell {
-        friend class BatchedTransitionOptimizer;
-        friend class JIT;
-        friend class JSCell;
-        friend class JSFinalObject;
-        friend class MarkedBlock;
-        JS_EXPORT_PRIVATE friend bool setUpStaticFunctionSlot(ExecState*, const HashEntry*, JSObject*, PropertyName, PropertySlot&);
-
-        enum PutMode {
-            PutModePut,
-            PutModeDefineOwnProperty,
-        };
-
-    public:
-        typedef JSCell Base;
+public:
+    typedef JSCell Base;
         
-        static size_t allocationSize(size_t inlineCapacity)
-        {
-            return sizeof(JSObject) + inlineCapacity * sizeof(WriteBarrierBase<Unknown>);
-        }
+    static size_t allocationSize(size_t inlineCapacity)
+    {
+        return sizeof(JSObject) + inlineCapacity * sizeof(WriteBarrierBase<Unknown>);
+    }
         
-        JS_EXPORT_PRIVATE static void visitChildren(JSCell*, SlotVisitor&);
-        JS_EXPORT_PRIVATE static void copyBackingStore(JSCell*, CopyVisitor&);
+    JS_EXPORT_PRIVATE static void visitChildren(JSCell*, SlotVisitor&);
+    JS_EXPORT_PRIVATE static void copyBackingStore(JSCell*, CopyVisitor&);
 
-        JS_EXPORT_PRIVATE static String className(const JSObject*);
+    JS_EXPORT_PRIVATE static String className(const JSObject*);
 
-        JSValue prototype() const;
-        void setPrototype(JSGlobalData&, JSValue prototype);
-        bool setPrototypeWithCycleCheck(JSGlobalData&, JSValue prototype);
+    JSValue prototype() const;
+    void setPrototype(JSGlobalData&, JSValue prototype);
+    bool setPrototypeWithCycleCheck(JSGlobalData&, JSValue prototype);
         
-        Structure* inheritorID(JSGlobalData&);
-        void notifyUsedAsPrototype(JSGlobalData&);
+    Structure* inheritorID(JSGlobalData&);
+    void notifyUsedAsPrototype(JSGlobalData&);
         
-        bool mayBeUsedAsPrototype(JSGlobalData& globalData)
-        {
-            return isValidOffset(structure()->get(globalData, globalData.m_inheritorIDKey));
-        }
+    bool mayBeUsedAsPrototype(JSGlobalData& globalData)
+    {
+        return isValidOffset(structure()->get(globalData, globalData.m_inheritorIDKey));
+    }
         
-        bool mayInterceptIndexedAccesses()
-        {
-            return structure()->mayInterceptIndexedAccesses();
-        }
+    bool mayInterceptIndexedAccesses()
+    {
+        return structure()->mayInterceptIndexedAccesses();
+    }
         
-        JSValue get(ExecState*, PropertyName) const;
-        JSValue get(ExecState*, unsigned propertyName) const;
-
-        bool getPropertySlot(ExecState*, PropertyName, PropertySlot&);
-        bool getPropertySlot(ExecState*, unsigned propertyName, PropertySlot&);
-        JS_EXPORT_PRIVATE bool getPropertyDescriptor(ExecState*, PropertyName, PropertyDescriptor&);
-
-        static bool getOwnPropertySlot(JSCell*, ExecState*, PropertyName, PropertySlot&);
-        JS_EXPORT_PRIVATE static bool getOwnPropertySlotByIndex(JSCell*, ExecState*, unsigned propertyName, PropertySlot&);
-        JS_EXPORT_PRIVATE static bool getOwnPropertyDescriptor(JSObject*, ExecState*, PropertyName, PropertyDescriptor&);
-
-        bool allowsAccessFrom(ExecState*);
-
-        unsigned getArrayLength() const
-        {
-            switch (structure()->indexingType()) {
-            case ALL_BLANK_INDEXING_TYPES:
-                return 0;
-            case ALL_CONTIGUOUS_INDEXING_TYPES:
-            case ALL_ARRAY_STORAGE_INDEXING_TYPES:
-                return m_butterfly->publicLength();
-            default:
-                ASSERT_NOT_REACHED();
-                return 0;
-            }
+    JSValue get(ExecState*, PropertyName) const;
+    JSValue get(ExecState*, unsigned propertyName) const;
+
+    bool getPropertySlot(ExecState*, PropertyName, PropertySlot&);
+    bool getPropertySlot(ExecState*, unsigned propertyName, PropertySlot&);
+    JS_EXPORT_PRIVATE bool getPropertyDescriptor(ExecState*, PropertyName, PropertyDescriptor&);
+
+    static bool getOwnPropertySlot(JSCell*, ExecState*, PropertyName, PropertySlot&);
+    JS_EXPORT_PRIVATE static bool getOwnPropertySlotByIndex(JSCell*, ExecState*, unsigned propertyName, PropertySlot&);
+    JS_EXPORT_PRIVATE static bool getOwnPropertyDescriptor(JSObject*, ExecState*, PropertyName, PropertyDescriptor&);
+
+    bool allowsAccessFrom(ExecState*);
+
+    unsigned getArrayLength() const
+    {
+        switch (structure()->indexingType()) {
+        case ALL_BLANK_INDEXING_TYPES:
+            return 0;
+        case ALL_CONTIGUOUS_INDEXING_TYPES:
+        case ALL_ARRAY_STORAGE_INDEXING_TYPES:
+            return m_butterfly->publicLength();
+        default:
+            ASSERT_NOT_REACHED();
+            return 0;
         }
+    }
         
-        unsigned getVectorLength()
-        {
-            switch (structure()->indexingType()) {
-            case ALL_BLANK_INDEXING_TYPES:
-                return 0;
-            case ALL_CONTIGUOUS_INDEXING_TYPES:
-            case ALL_ARRAY_STORAGE_INDEXING_TYPES:
-                return m_butterfly->vectorLength();
-            default:
-                ASSERT_NOT_REACHED();
-                return 0;
-            }
+    unsigned getVectorLength()
+    {
+        switch (structure()->indexingType()) {
+        case ALL_BLANK_INDEXING_TYPES:
+            return 0;
+        case ALL_CONTIGUOUS_INDEXING_TYPES:
+        case ALL_ARRAY_STORAGE_INDEXING_TYPES:
+            return m_butterfly->vectorLength();
+        default:
+            ASSERT_NOT_REACHED();
+            return 0;
         }
+    }
         
-        JS_EXPORT_PRIVATE static void put(JSCell*, ExecState*, PropertyName, JSValue, PutPropertySlot&);
-        JS_EXPORT_PRIVATE static void putByIndex(JSCell*, ExecState*, unsigned propertyName, JSValue, bool shouldThrow);
+    JS_EXPORT_PRIVATE static void put(JSCell*, ExecState*, PropertyName, JSValue, PutPropertySlot&);
+    JS_EXPORT_PRIVATE static void putByIndex(JSCell*, ExecState*, unsigned propertyName, JSValue, bool shouldThrow);
         
-        void putByIndexInline(ExecState* exec, unsigned propertyName, JSValue value, bool shouldThrow)
-        {
-            if (canSetIndexQuickly(propertyName)) {
-                setIndexQuickly(exec->globalData(), propertyName, value);
-                return;
-            }
-            methodTable()->putByIndex(this, exec, propertyName, value, shouldThrow);
+    void putByIndexInline(ExecState* exec, unsigned propertyName, JSValue value, bool shouldThrow)
+    {
+        if (canSetIndexQuickly(propertyName)) {
+            setIndexQuickly(exec->globalData(), propertyName, value);
+            return;
         }
+        methodTable()->putByIndex(this, exec, propertyName, value, shouldThrow);
+    }
         
-        // This is similar to the putDirect* methods:
-        //  - the prototype chain is not consulted
-        //  - accessors are not called.
-        //  - it will ignore extensibility and read-only properties if PutDirectIndexLikePutDirect is passed as the mode (the default).
-        // This method creates a property with attributes writable, enumerable and configurable all set to true.
-        bool putDirectIndex(ExecState* exec, unsigned propertyName, JSValue value, unsigned attributes, PutDirectIndexMode mode)
-        {
-            if (!attributes && canSetIndexQuicklyForPutDirect(propertyName)) {
-                setIndexQuickly(exec->globalData(), propertyName, value);
-                return true;
-            }
-            return putDirectIndexBeyondVectorLength(exec, propertyName, value, attributes, mode);
-        }
-        bool putDirectIndex(ExecState* exec, unsigned propertyName, JSValue value)
-        {
-            return putDirectIndex(exec, propertyName, value, 0, PutDirectIndexLikePutDirect);
+    // This is similar to the putDirect* methods:
+    //  - the prototype chain is not consulted
+    //  - accessors are not called.
+    //  - it will ignore extensibility and read-only properties if PutDirectIndexLikePutDirect is passed as the mode (the default).
+    // This method creates a property with attributes writable, enumerable and configurable all set to true.
+    bool putDirectIndex(ExecState* exec, unsigned propertyName, JSValue value, unsigned attributes, PutDirectIndexMode mode)
+    {
+        if (!attributes && canSetIndexQuicklyForPutDirect(propertyName)) {
+            setIndexQuickly(exec->globalData(), propertyName, value);
+            return true;
         }
+        return putDirectIndexBeyondVectorLength(exec, propertyName, value, attributes, mode);
+    }
+    bool putDirectIndex(ExecState* exec, unsigned propertyName, JSValue value)
+    {
+        return putDirectIndex(exec, propertyName, value, 0, PutDirectIndexLikePutDirect);
+    }
 
-        // A non-throwing version of putDirect and putDirectIndex.
-        JS_EXPORT_PRIVATE void putDirectMayBeIndex(ExecState*, PropertyName, JSValue);
+    // A non-throwing version of putDirect and putDirectIndex.
+    JS_EXPORT_PRIVATE void putDirectMayBeIndex(ExecState*, PropertyName, JSValue);
         
-        bool canGetIndexQuickly(unsigned i)
-        {
-            switch (structure()->indexingType()) {
-            case ALL_BLANK_INDEXING_TYPES:
-                return false;
-            case ALL_CONTIGUOUS_INDEXING_TYPES:
-                return i < m_butterfly->vectorLength() && m_butterfly->contiguous()[i];
-            case ALL_ARRAY_STORAGE_INDEXING_TYPES:
-                return i < m_butterfly->arrayStorage()->vectorLength() && m_butterfly->arrayStorage()->m_vector[i];
-            default:
-                ASSERT_NOT_REACHED();
-                return false;
-            }
+    bool canGetIndexQuickly(unsigned i)
+    {
+        switch (structure()->indexingType()) {
+        case ALL_BLANK_INDEXING_TYPES:
+            return false;
+        case ALL_CONTIGUOUS_INDEXING_TYPES:
+            return i < m_butterfly->vectorLength() && m_butterfly->contiguous()[i];
+        case ALL_ARRAY_STORAGE_INDEXING_TYPES:
+            return i < m_butterfly->arrayStorage()->vectorLength() && m_butterfly->arrayStorage()->m_vector[i];
+        default:
+            ASSERT_NOT_REACHED();
+            return false;
         }
+    }
         
-        JSValue getIndexQuickly(unsigned i)
-        {
-            switch (structure()->indexingType()) {
-            case ALL_CONTIGUOUS_INDEXING_TYPES:
+    JSValue getIndexQuickly(unsigned i)
+    {
+        switch (structure()->indexingType()) {
+        case ALL_CONTIGUOUS_INDEXING_TYPES:
+            return m_butterfly->contiguous()[i].get();
+        case ALL_ARRAY_STORAGE_INDEXING_TYPES:
+            return m_butterfly->arrayStorage()->m_vector[i].get();
+        default:
+            ASSERT_NOT_REACHED();
+            return JSValue();
+        }
+    }
+        
+    JSValue tryGetIndexQuickly(unsigned i)
+    {
+        switch (structure()->indexingType()) {
+        case ALL_BLANK_INDEXING_TYPES:
+            break;
+        case ALL_CONTIGUOUS_INDEXING_TYPES:
+            if (i < m_butterfly->publicLength())
                 return m_butterfly->contiguous()[i].get();
-            case ALL_ARRAY_STORAGE_INDEXING_TYPES:
+            break;
+        case ALL_ARRAY_STORAGE_INDEXING_TYPES:
+            if (i < m_butterfly->arrayStorage()->vectorLength())
                 return m_butterfly->arrayStorage()->m_vector[i].get();
-            default:
-                ASSERT_NOT_REACHED();
-                return JSValue();
-            }
+            break;
+        default:
+            ASSERT_NOT_REACHED();
+            break;
         }
+        return JSValue();
+    }
         
-        JSValue tryGetIndexQuickly(unsigned i)
-        {
-            switch (structure()->indexingType()) {
-            case ALL_BLANK_INDEXING_TYPES:
-                break;
-            case ALL_CONTIGUOUS_INDEXING_TYPES:
-                if (i < m_butterfly->publicLength())
-                    return m_butterfly->contiguous()[i].get();
-                break;
-            case ALL_ARRAY_STORAGE_INDEXING_TYPES:
-                if (i < m_butterfly->arrayStorage()->vectorLength())
-                    return m_butterfly->arrayStorage()->m_vector[i].get();
-                break;
-            default:
-                ASSERT_NOT_REACHED();
-                break;
-            }
-            return JSValue();
-        }
+    JSValue getDirectIndex(ExecState* exec, unsigned i)
+    {
+        if (JSValue result = tryGetIndexQuickly(i))
+            return result;
+        PropertySlot slot(this);
+        if (methodTable()->getOwnPropertySlotByIndex(this, exec, i, slot))
+            return slot.getValue(exec, i);
+        return JSValue();
+    }
         
-        JSValue getDirectIndex(ExecState* exec, unsigned i)
-        {
-            if (JSValue result = tryGetIndexQuickly(i))
-                return result;
-            PropertySlot slot(this);
-            if (methodTable()->getOwnPropertySlotByIndex(this, exec, i, slot))
-                return slot.getValue(exec, i);
-            return JSValue();
-        }
+    JSValue getIndex(ExecState* exec, unsigned i)
+    {
+        if (JSValue result = tryGetIndexQuickly(i))
+            return result;
+        return get(exec, i);
+    }
         
-        JSValue getIndex(ExecState* exec, unsigned i)
-        {
-            if (JSValue result = tryGetIndexQuickly(i))
-                return result;
-            return get(exec, i);
+    bool canSetIndexQuickly(unsigned i)
+    {
+        switch (structure()->indexingType()) {
+        case ALL_BLANK_INDEXING_TYPES:
+            return false;
+        case ALL_CONTIGUOUS_INDEXING_TYPES:
+        case NonArrayWithArrayStorage:
+        case ArrayWithArrayStorage:
+            return i < m_butterfly->vectorLength();
+        case NonArrayWithSlowPutArrayStorage:
+        case ArrayWithSlowPutArrayStorage:
+            return i < m_butterfly->arrayStorage()->vectorLength()
+                && !!m_butterfly->arrayStorage()->m_vector[i];
+        default:
+            ASSERT_NOT_REACHED();
+            return false;
         }
+    }
         
-        bool canSetIndexQuickly(unsigned i)
-        {
-            switch (structure()->indexingType()) {
-            case ALL_BLANK_INDEXING_TYPES:
-                return false;
-            case ALL_CONTIGUOUS_INDEXING_TYPES:
-            case NonArrayWithArrayStorage:
-            case ArrayWithArrayStorage:
-                return i < m_butterfly->vectorLength();
-            case NonArrayWithSlowPutArrayStorage:
-            case ArrayWithSlowPutArrayStorage:
-                return i < m_butterfly->arrayStorage()->vectorLength()
-                    && !!m_butterfly->arrayStorage()->m_vector[i];
-            default:
-                ASSERT_NOT_REACHED();
-                return false;
-            }
+    bool canSetIndexQuicklyForPutDirect(unsigned i)
+    {
+        switch (structure()->indexingType()) {
+        case ALL_BLANK_INDEXING_TYPES:
+            return false;
+        case ALL_CONTIGUOUS_INDEXING_TYPES:
+        case ALL_ARRAY_STORAGE_INDEXING_TYPES:
+            return i < m_butterfly->vectorLength();
+        default:
+            ASSERT_NOT_REACHED();
+            return false;
         }
+    }
         
-        bool canSetIndexQuicklyForPutDirect(unsigned i)
-        {
-            switch (structure()->indexingType()) {
-            case ALL_BLANK_INDEXING_TYPES:
-                return false;
-            case ALL_CONTIGUOUS_INDEXING_TYPES:
-            case ALL_ARRAY_STORAGE_INDEXING_TYPES:
-                return i < m_butterfly->vectorLength();
-            default:
-                ASSERT_NOT_REACHED();
-                return false;
-            }
+    void setIndexQuickly(JSGlobalData& globalData, unsigned i, JSValue v)
+    {
+        switch (structure()->indexingType()) {
+        case ALL_CONTIGUOUS_INDEXING_TYPES: {
+            ASSERT(i < m_butterfly->vectorLength());
+            m_butterfly->contiguous()[i].set(globalData, this, v);
+            if (i >= m_butterfly->publicLength())
+                m_butterfly->setPublicLength(i + 1);
+            break;
         }
-        
-        void setIndexQuickly(JSGlobalData& globalData, unsigned i, JSValue v)
-        {
-            switch (structure()->indexingType()) {
-            case ALL_CONTIGUOUS_INDEXING_TYPES: {
-                ASSERT(i < m_butterfly->vectorLength());
-                m_butterfly->contiguous()[i].set(globalData, this, v);
-                if (i >= m_butterfly->publicLength())
-                    m_butterfly->setPublicLength(i + 1);
-                break;
-            }
-            case ALL_ARRAY_STORAGE_INDEXING_TYPES: {
-                ArrayStorage* storage = m_butterfly->arrayStorage();
-                WriteBarrier<Unknown>& x = storage->m_vector[i];
-                JSValue old = x.get();
-                x.set(globalData, this, v);
-                if (!old) {
-                    ++storage->m_numValuesInVector;
-                    if (i >= storage->length())
-                        storage->setLength(i + 1);
-                }
-                break;
-            }
-            default:
-                ASSERT_NOT_REACHED();
+        case ALL_ARRAY_STORAGE_INDEXING_TYPES: {
+            ArrayStorage* storage = m_butterfly->arrayStorage();
+            WriteBarrier<Unknown>& x = storage->m_vector[i];
+            JSValue old = x.get();
+            x.set(globalData, this, v);
+            if (!old) {
+                ++storage->m_numValuesInVector;
+                if (i >= storage->length())
+                    storage->setLength(i + 1);
             }
+            break;
         }
-        
-        void initializeIndex(JSGlobalData& globalData, unsigned i, JSValue v)
-        {
-            switch (structure()->indexingType()) {
-            case ALL_CONTIGUOUS_INDEXING_TYPES: {
-                ASSERT(i < m_butterfly->publicLength());
-                ASSERT(i < m_butterfly->vectorLength());
-                m_butterfly->contiguous()[i].set(globalData, this, v);
-                break;
-            }
-            case ALL_ARRAY_STORAGE_INDEXING_TYPES: {
-                ArrayStorage* storage = m_butterfly->arrayStorage();
-                ASSERT(i < storage->length());
-                ASSERT(i < storage->m_numValuesInVector);
-                storage->m_vector[i].set(globalData, this, v);
-                break;
-            }
-            default:
-                ASSERT_NOT_REACHED();
-            }
+        default:
+            ASSERT_NOT_REACHED();
         }
+    }
         
-        bool hasSparseMap()
-        {
-            switch (structure()->indexingType()) {
-            case ALL_BLANK_INDEXING_TYPES:
-            case ALL_CONTIGUOUS_INDEXING_TYPES:
-                return false;
-            case ALL_ARRAY_STORAGE_INDEXING_TYPES:
-                return m_butterfly->arrayStorage()->m_sparseMap;
-            default:
-                ASSERT_NOT_REACHED();
-                return false;
-            }
+    void initializeIndex(JSGlobalData& globalData, unsigned i, JSValue v)
+    {
+        switch (structure()->indexingType()) {
+        case ALL_CONTIGUOUS_INDEXING_TYPES: {
+            ASSERT(i < m_butterfly->publicLength());
+            ASSERT(i < m_butterfly->vectorLength());
+            m_butterfly->contiguous()[i].set(globalData, this, v);
+            break;
+        }
+        case ALL_ARRAY_STORAGE_INDEXING_TYPES: {
+            ArrayStorage* storage = m_butterfly->arrayStorage();
+            ASSERT(i < storage->length());
+            ASSERT(i < storage->m_numValuesInVector);
+            storage->m_vector[i].set(globalData, this, v);
+            break;
         }
+        default:
+            ASSERT_NOT_REACHED();
+        }
+    }
         
-        bool inSparseIndexingMode()
-        {
-            switch (structure()->indexingType()) {
-            case ALL_BLANK_INDEXING_TYPES:
-            case ALL_CONTIGUOUS_INDEXING_TYPES:
-                return false;
-            case ALL_ARRAY_STORAGE_INDEXING_TYPES:
-                return m_butterfly->arrayStorage()->inSparseMode();
-            default:
-                ASSERT_NOT_REACHED();
-                return false;
-            }
+    bool hasSparseMap()
+    {
+        switch (structure()->indexingType()) {
+        case ALL_BLANK_INDEXING_TYPES:
+        case ALL_CONTIGUOUS_INDEXING_TYPES:
+            return false;
+        case ALL_ARRAY_STORAGE_INDEXING_TYPES:
+            return m_butterfly->arrayStorage()->m_sparseMap;
+        default:
+            ASSERT_NOT_REACHED();
+            return false;
         }
+    }
         
-        void enterDictionaryIndexingMode(JSGlobalData&);
-
-        // putDirect is effectively an unchecked vesion of 'defineOwnProperty':
-        //  - the prototype chain is not consulted
-        //  - accessors are not called.
-        //  - attributes will be respected (after the call the property will exist with the given attributes)
-        //  - the property name is assumed to not be an index.
-        JS_EXPORT_PRIVATE static void putDirectVirtual(JSObject*, ExecState*, PropertyName, JSValue, unsigned attributes);
-        void putDirect(JSGlobalData&, PropertyName, JSValue, unsigned attributes = 0);
-        void putDirect(JSGlobalData&, PropertyName, JSValue, PutPropertySlot&);
-        void putDirectWithoutTransition(JSGlobalData&, PropertyName, JSValue, unsigned attributes = 0);
-        void putDirectAccessor(ExecState*, PropertyName, JSValue, unsigned attributes);
-
-        bool propertyIsEnumerable(ExecState*, const Identifier& propertyName) const;
-
-        JS_EXPORT_PRIVATE bool hasProperty(ExecState*, PropertyName) const;
-        JS_EXPORT_PRIVATE bool hasProperty(ExecState*, unsigned propertyName) const;
-        bool hasOwnProperty(ExecState*, PropertyName) const;
-
-        JS_EXPORT_PRIVATE static bool deleteProperty(JSCell*, ExecState*, PropertyName);
-        JS_EXPORT_PRIVATE static bool deletePropertyByIndex(JSCell*, ExecState*, unsigned propertyName);
-
-        JS_EXPORT_PRIVATE static JSValue defaultValue(const JSObject*, ExecState*, PreferredPrimitiveType);
-
-        bool hasInstance(ExecState*, JSValue);
-        static bool defaultHasInstance(ExecState*, JSValue, JSValue prototypeProperty);
-
-        JS_EXPORT_PRIVATE static void getOwnPropertyNames(JSObject*, ExecState*, PropertyNameArray&, EnumerationMode);
-        JS_EXPORT_PRIVATE static void getOwnNonIndexPropertyNames(JSObject*, ExecState*, PropertyNameArray&, EnumerationMode);
-        JS_EXPORT_PRIVATE static void getPropertyNames(JSObject*, ExecState*, PropertyNameArray&, EnumerationMode);
-
-        JSValue toPrimitive(ExecState*, PreferredPrimitiveType = NoPreference) const;
-        bool getPrimitiveNumber(ExecState*, double& number, JSValue&) const;
-        JS_EXPORT_PRIVATE double toNumber(ExecState*) const;
-        JS_EXPORT_PRIVATE JSString* toString(ExecState*) const;
-
-        // NOTE: JSObject and its subclasses must be able to gracefully handle ExecState* = 0,
-        // because this call may come from inside the compiler.
-        JS_EXPORT_PRIVATE static JSObject* toThisObject(JSCell*, ExecState*);
-
-        bool getPropertySpecificValue(ExecState*, PropertyName, JSCell*& specificFunction) const;
-
-        // This get function only looks at the property map.
-        JSValue getDirect(JSGlobalData& globalData, PropertyName propertyName) const
-        {
-            PropertyOffset offset = structure()->get(globalData, propertyName);
-            checkOffset(offset, structure()->typeInfo().type());
-            return offset != invalidOffset ? getDirectOffset(offset) : JSValue();
+    bool inSparseIndexingMode()
+    {
+        switch (structure()->indexingType()) {
+        case ALL_BLANK_INDEXING_TYPES:
+        case ALL_CONTIGUOUS_INDEXING_TYPES:
+            return false;
+        case ALL_ARRAY_STORAGE_INDEXING_TYPES:
+            return m_butterfly->arrayStorage()->inSparseMode();
+        default:
+            ASSERT_NOT_REACHED();
+            return false;
         }
+    }
+        
+    void enterDictionaryIndexingMode(JSGlobalData&);
 
-        WriteBarrierBase<Unknown>* getDirectLocation(JSGlobalData& globalData, PropertyName propertyName)
-        {
-            PropertyOffset offset = structure()->get(globalData, propertyName);
-            checkOffset(offset, structure()->typeInfo().type());
-            return isValidOffset(offset) ? locationForOffset(offset) : 0;
-        }
+    // putDirect is effectively an unchecked vesion of 'defineOwnProperty':
+    //  - the prototype chain is not consulted
+    //  - accessors are not called.
+    //  - attributes will be respected (after the call the property will exist with the given attributes)
+    //  - the property name is assumed to not be an index.
+    JS_EXPORT_PRIVATE static void putDirectVirtual(JSObject*, ExecState*, PropertyName, JSValue, unsigned attributes);
+    void putDirect(JSGlobalData&, PropertyName, JSValue, unsigned attributes = 0);
+    void putDirect(JSGlobalData&, PropertyName, JSValue, PutPropertySlot&);
+    void putDirectWithoutTransition(JSGlobalData&, PropertyName, JSValue, unsigned attributes = 0);
+    void putDirectAccessor(ExecState*, PropertyName, JSValue, unsigned attributes);
 
-        WriteBarrierBase<Unknown>* getDirectLocation(JSGlobalData& globalData, PropertyName propertyName, unsigned& attributes)
-        {
-            JSCell* specificFunction;
-            PropertyOffset offset = structure()->get(globalData, propertyName, attributes, specificFunction);
-            return isValidOffset(offset) ? locationForOffset(offset) : 0;
-        }
+    bool propertyIsEnumerable(ExecState*, const Identifier& propertyName) const;
 
-        bool hasInlineStorage() const { return structure()->hasInlineStorage(); }
-        ConstPropertyStorage inlineStorageUnsafe() const
-        {
-            return bitwise_cast<ConstPropertyStorage>(this + 1);
-        }
-        PropertyStorage inlineStorageUnsafe()
-        {
-            return bitwise_cast<PropertyStorage>(this + 1);
-        }
-        ConstPropertyStorage inlineStorage() const
-        {
-            ASSERT(hasInlineStorage());
-            return inlineStorageUnsafe();
-        }
-        PropertyStorage inlineStorage()
-        {
-            ASSERT(hasInlineStorage());
-            return inlineStorageUnsafe();
-        }
+    JS_EXPORT_PRIVATE bool hasProperty(ExecState*, PropertyName) const;
+    JS_EXPORT_PRIVATE bool hasProperty(ExecState*, unsigned propertyName) const;
+    bool hasOwnProperty(ExecState*, PropertyName) const;
+
+    JS_EXPORT_PRIVATE static bool deleteProperty(JSCell*, ExecState*, PropertyName);
+    JS_EXPORT_PRIVATE static bool deletePropertyByIndex(JSCell*, ExecState*, unsigned propertyName);
+
+    JS_EXPORT_PRIVATE static JSValue defaultValue(const JSObject*, ExecState*, PreferredPrimitiveType);
+
+    bool hasInstance(ExecState*, JSValue);
+    static bool defaultHasInstance(ExecState*, JSValue, JSValue prototypeProperty);
+
+    JS_EXPORT_PRIVATE static void getOwnPropertyNames(JSObject*, ExecState*, PropertyNameArray&, EnumerationMode);
+    JS_EXPORT_PRIVATE static void getOwnNonIndexPropertyNames(JSObject*, ExecState*, PropertyNameArray&, EnumerationMode);
+    JS_EXPORT_PRIVATE static void getPropertyNames(JSObject*, ExecState*, PropertyNameArray&, EnumerationMode);
+
+    JSValue toPrimitive(ExecState*, PreferredPrimitiveType = NoPreference) const;
+    bool getPrimitiveNumber(ExecState*, double& number, JSValue&) const;
+    JS_EXPORT_PRIVATE double toNumber(ExecState*) const;
+    JS_EXPORT_PRIVATE JSString* toString(ExecState*) const;
+
+    // NOTE: JSObject and its subclasses must be able to gracefully handle ExecState* = 0,
+    // because this call may come from inside the compiler.
+    JS_EXPORT_PRIVATE static JSObject* toThisObject(JSCell*, ExecState*);
+
+    bool getPropertySpecificValue(ExecState*, PropertyName, JSCell*& specificFunction) const;
+
+    // This get function only looks at the property map.
+    JSValue getDirect(JSGlobalData& globalData, PropertyName propertyName) const
+    {
+        PropertyOffset offset = structure()->get(globalData, propertyName);
+        checkOffset(offset, structure()->typeInfo().type());
+        return offset != invalidOffset ? getDirectOffset(offset) : JSValue();
+    }
+
+    WriteBarrierBase<Unknown>* getDirectLocation(JSGlobalData& globalData, PropertyName propertyName)
+    {
+        PropertyOffset offset = structure()->get(globalData, propertyName);
+        checkOffset(offset, structure()->typeInfo().type());
+        return isValidOffset(offset) ? locationForOffset(offset) : 0;
+    }
+
+    WriteBarrierBase<Unknown>* getDirectLocation(JSGlobalData& globalData, PropertyName propertyName, unsigned& attributes)
+    {
+        JSCell* specificFunction;
+        PropertyOffset offset = structure()->get(globalData, propertyName, attributes, specificFunction);
+        return isValidOffset(offset) ? locationForOffset(offset) : 0;
+    }
+
+    bool hasInlineStorage() const { return structure()->hasInlineStorage(); }
+    ConstPropertyStorage inlineStorageUnsafe() const
+    {
+        return bitwise_cast<ConstPropertyStorage>(this + 1);
+    }
+    PropertyStorage inlineStorageUnsafe()
+    {
+        return bitwise_cast<PropertyStorage>(this + 1);
+    }
+    ConstPropertyStorage inlineStorage() const
+    {
+        ASSERT(hasInlineStorage());
+        return inlineStorageUnsafe();
+    }
+    PropertyStorage inlineStorage()
+    {
+        ASSERT(hasInlineStorage());
+        return inlineStorageUnsafe();
+    }
         
-        const Butterfly* butterfly() const { return m_butterfly; }
-        Butterfly* butterfly() { return m_butterfly; }
+    const Butterfly* butterfly() const { return m_butterfly; }
+    Butterfly* butterfly() { return m_butterfly; }
         
-        ConstPropertyStorage outOfLineStorage() const { return m_butterfly->propertyStorage(); }
-        PropertyStorage outOfLineStorage() { return m_butterfly->propertyStorage(); }
-
-        const WriteBarrierBase<Unknown>* locationForOffset(PropertyOffset offset) const
-        {
-            if (isInlineOffset(offset))
-                return &inlineStorage()[offsetInInlineStorage(offset)];
-            return &outOfLineStorage()[offsetInOutOfLineStorage(offset)];
-        }
+    ConstPropertyStorage outOfLineStorage() const { return m_butterfly->propertyStorage(); }
+    PropertyStorage outOfLineStorage() { return m_butterfly->propertyStorage(); }
 
-        WriteBarrierBase<Unknown>* locationForOffset(PropertyOffset offset)
-        {
-            if (isInlineOffset(offset))
-                return &inlineStorage()[offsetInInlineStorage(offset)];
-            return &outOfLineStorage()[offsetInOutOfLineStorage(offset)];
-        }
+    const WriteBarrierBase<Unknown>* locationForOffset(PropertyOffset offset) const
+    {
+        if (isInlineOffset(offset))
+            return &inlineStorage()[offsetInInlineStorage(offset)];
+        return &outOfLineStorage()[offsetInOutOfLineStorage(offset)];
+    }
 
-        PropertyOffset offsetForLocation(WriteBarrierBase<Unknown>* location) const
-        {
-            PropertyOffset result;
-            size_t offsetInInlineStorage = location - inlineStorageUnsafe();
-            if (offsetInInlineStorage < static_cast<size_t>(firstOutOfLineOffset))
-                result = offsetInInlineStorage;
-            else
-                result = outOfLineStorage() - location + (firstOutOfLineOffset - 1);
-            validateOffset(result, structure()->typeInfo().type());
-            return result;
-        }
+    WriteBarrierBase<Unknown>* locationForOffset(PropertyOffset offset)
+    {
+        if (isInlineOffset(offset))
+            return &inlineStorage()[offsetInInlineStorage(offset)];
+        return &outOfLineStorage()[offsetInOutOfLineStorage(offset)];
+    }
 
-        void transitionTo(JSGlobalData&, Structure*);
-
-        bool removeDirect(JSGlobalData&, PropertyName); // Return true if anything is removed.
-        bool hasCustomProperties() { return structure()->didTransition(); }
-        bool hasGetterSetterProperties() { return structure()->hasGetterSetterProperties(); }
-
-        // putOwnDataProperty has 'put' like semantics, however this method:
-        //  - assumes the object contains no own getter/setter properties.
-        //  - provides no special handling for __proto__
-        //  - does not walk the prototype chain (to check for accessors or non-writable properties).
-        // This is used by JSActivation.
-        bool putOwnDataProperty(JSGlobalData&, PropertyName, JSValue, PutPropertySlot&);
-
-        // Fast access to known property offsets.
-        JSValue getDirectOffset(PropertyOffset offset) const { return locationForOffset(offset)->get(); }
-        void putDirectOffset(JSGlobalData& globalData, PropertyOffset offset, JSValue value) { locationForOffset(offset)->set(globalData, this, value); }
-        void putUndefinedAtDirectOffset(PropertyOffset offset) { locationForOffset(offset)->setUndefined(); }
-
-        JS_EXPORT_PRIVATE static bool defineOwnProperty(JSObject*, ExecState*, PropertyName, PropertyDescriptor&, bool shouldThrow);
-
-        bool isGlobalObject() const;
-        bool isVariableObject() const;
-        bool isNameScopeObject() const;
-        bool isActivationObject() const;
-        bool isErrorInstance() const;
-        bool isProxy() const;
-
-        void seal(JSGlobalData&);
-        void freeze(JSGlobalData&);
-        JS_EXPORT_PRIVATE void preventExtensions(JSGlobalData&);
-        bool isSealed(JSGlobalData& globalData) { return structure()->isSealed(globalData); }
-        bool isFrozen(JSGlobalData& globalData) { return structure()->isFrozen(globalData); }
-        bool isExtensible() { return structure()->isExtensible(); }
-        bool indexingShouldBeSparse()
-        {
-            return !isExtensible()
-                || structure()->typeInfo().interceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero();
-        }
+    PropertyOffset offsetForLocation(WriteBarrierBase<Unknown>* location) const
+    {
+        PropertyOffset result;
+        size_t offsetInInlineStorage = location - inlineStorageUnsafe();
+        if (offsetInInlineStorage < static_cast<size_t>(firstOutOfLineOffset))
+            result = offsetInInlineStorage;
+        else
+            result = outOfLineStorage() - location + (firstOutOfLineOffset - 1);
+        validateOffset(result, structure()->typeInfo().type());
+        return result;
+    }
+
+    void transitionTo(JSGlobalData&, Structure*);
+
+    bool removeDirect(JSGlobalData&, PropertyName); // Return true if anything is removed.
+    bool hasCustomProperties() { return structure()->didTransition(); }
+    bool hasGetterSetterProperties() { return structure()->hasGetterSetterProperties(); }
+
+    // putOwnDataProperty has 'put' like semantics, however this method:
+    //  - assumes the object contains no own getter/setter properties.
+    //  - provides no special handling for __proto__
+    //  - does not walk the prototype chain (to check for accessors or non-writable properties).
+    // This is used by JSActivation.
+    bool putOwnDataProperty(JSGlobalData&, PropertyName, JSValue, PutPropertySlot&);
+
+    // Fast access to known property offsets.
+    JSValue getDirectOffset(PropertyOffset offset) const { return locationForOffset(offset)->get(); }
+    void putDirectOffset(JSGlobalData& globalData, PropertyOffset offset, JSValue value) { locationForOffset(offset)->set(globalData, this, value); }
+    void putUndefinedAtDirectOffset(PropertyOffset offset) { locationForOffset(offset)->setUndefined(); }
+
+    JS_EXPORT_PRIVATE static bool defineOwnProperty(JSObject*, ExecState*, PropertyName, PropertyDescriptor&, bool shouldThrow);
+
+    bool isGlobalObject() const;
+    bool isVariableObject() const;
+    bool isNameScopeObject() const;
+    bool isActivationObject() const;
+    bool isErrorInstance() const;
+
+    void seal(JSGlobalData&);
+    void freeze(JSGlobalData&);
+    JS_EXPORT_PRIVATE void preventExtensions(JSGlobalData&);
+    bool isSealed(JSGlobalData& globalData) { return structure()->isSealed(globalData); }
+    bool isFrozen(JSGlobalData& globalData) { return structure()->isFrozen(globalData); }
+    bool isExtensible() { return structure()->isExtensible(); }
+    bool indexingShouldBeSparse()
+    {
+        return !isExtensible()
+            || structure()->typeInfo().interceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero();
+    }
 
-        bool staticFunctionsReified() { return structure()->staticFunctionsReified(); }
-        void reifyStaticFunctionsForDelete(ExecState* exec);
+    bool staticFunctionsReified() { return structure()->staticFunctionsReified(); }
+    void reifyStaticFunctionsForDelete(ExecState* exec);
 
-        JS_EXPORT_PRIVATE Butterfly* growOutOfLineStorage(JSGlobalData&, size_t oldSize, size_t newSize);
-        void setButterfly(JSGlobalData&, Butterfly*, Structure*);
-        void setButterflyWithoutChangingStructure(Butterfly*); // You probably don't want to call this.
+    JS_EXPORT_PRIVATE Butterfly* growOutOfLineStorage(JSGlobalData&, size_t oldSize, size_t newSize);
+    void setButterfly(JSGlobalData&, Butterfly*, Structure*);
+    void setButterflyWithoutChangingStructure(Butterfly*); // You probably don't want to call this.
         
-        void setStructureAndReallocateStorageIfNecessary(JSGlobalData&, unsigned oldCapacity, Structure*);
-        void setStructureAndReallocateStorageIfNecessary(JSGlobalData&, Structure*);
+    void setStructureAndReallocateStorageIfNecessary(JSGlobalData&, unsigned oldCapacity, Structure*);
+    void setStructureAndReallocateStorageIfNecessary(JSGlobalData&, Structure*);
 
-        void flattenDictionaryObject(JSGlobalData& globalData)
-        {
-            structure()->flattenDictionaryStructure(globalData, this);
-        }
+    void flattenDictionaryObject(JSGlobalData& globalData)
+    {
+        structure()->flattenDictionaryStructure(globalData, this);
+    }
 
-        JSGlobalObject* globalObject() const
-        {
-            ASSERT(structure()->globalObject());
-            ASSERT(!isGlobalObject() || ((JSObject*)structure()->globalObject()) == this);
-            return structure()->globalObject();
-        }
+    JSGlobalObject* globalObject() const
+    {
+        ASSERT(structure()->globalObject());
+        ASSERT(!isGlobalObject() || ((JSObject*)structure()->globalObject()) == this);
+        return structure()->globalObject();
+    }
         
-        void switchToSlowPutArrayStorage(JSGlobalData&);
+    void switchToSlowPutArrayStorage(JSGlobalData&);
         
-        // The receiver is the prototype in this case. The following:
-        //
-        // asObject(foo->structure()->storedPrototype())->attemptToInterceptPutByIndexOnHoleForPrototype(...)
-        //
-        // is equivalent to:
-        //
-        // foo->attemptToInterceptPutByIndexOnHole(...);
-        bool attemptToInterceptPutByIndexOnHoleForPrototype(ExecState*, JSValue thisValue, unsigned propertyName, JSValue, bool shouldThrow);
+    // The receiver is the prototype in this case. The following:
+    //
+    // asObject(foo->structure()->storedPrototype())->attemptToInterceptPutByIndexOnHoleForPrototype(...)
+    //
+    // is equivalent to:
+    //
+    // foo->attemptToInterceptPutByIndexOnHole(...);
+    bool attemptToInterceptPutByIndexOnHoleForPrototype(ExecState*, JSValue thisValue, unsigned propertyName, JSValue, bool shouldThrow);
         
-        // Returns 0 if contiguous storage cannot be created - either because
-        // indexing should be sparse or because we're having a bad time.
-        WriteBarrier<Unknown>* ensureContiguous(JSGlobalData& globalData)
-        {
-            if (LIKELY(hasContiguous(structure()->indexingType())))
-                return m_butterfly->contiguous();
+    // Returns 0 if contiguous storage cannot be created - either because
+    // indexing should be sparse or because we're having a bad time.
+    WriteBarrier<Unknown>* ensureContiguous(JSGlobalData& globalData)
+    {
+        if (LIKELY(hasContiguous(structure()->indexingType())))
+            return m_butterfly->contiguous();
             
-            return ensureContiguousSlow(globalData);
-        }
+        return ensureContiguousSlow(globalData);
+    }
         
-        // Ensure that the object is in a mode where it has array storage. Use
-        // this if you're about to perform actions that would have required the
-        // object to be converted to have array storage, if it didn't have it
-        // already.
-        ArrayStorage* ensureArrayStorage(JSGlobalData& globalData)
-        {
-            if (LIKELY(hasArrayStorage(structure()->indexingType())))
-                return m_butterfly->arrayStorage();
+    // Ensure that the object is in a mode where it has array storage. Use
+    // this if you're about to perform actions that would have required the
+    // object to be converted to have array storage, if it didn't have it
+    // already.
+    ArrayStorage* ensureArrayStorage(JSGlobalData& globalData)
+    {
+        if (LIKELY(hasArrayStorage(structure()->indexingType())))
+            return m_butterfly->arrayStorage();
             
-            return ensureArrayStorageSlow(globalData);
-        }
+        return ensureArrayStorageSlow(globalData);
+    }
         
-        Butterfly* ensureIndexedStorage(JSGlobalData& globalData)
-        {
-            if (LIKELY(hasIndexedProperties(structure()->indexingType())))
-                return m_butterfly;
+    Butterfly* ensureIndexedStorage(JSGlobalData& globalData)
+    {
+        if (LIKELY(hasIndexedProperties(structure()->indexingType())))
+            return m_butterfly;
             
-            return ensureIndexedStorageSlow(globalData);
-        }
+        return ensureIndexedStorageSlow(globalData);
+    }
         
-        static size_t offsetOfInlineStorage();
+    static size_t offsetOfInlineStorage();
         
-        static ptrdiff_t butterflyOffset()
-        {
-            return OBJECT_OFFSETOF(JSObject, m_butterfly);
-        }
+    static ptrdiff_t butterflyOffset()
+    {
+        return OBJECT_OFFSETOF(JSObject, m_butterfly);
+    }
         
-        void* butterflyAddress()
-        {
-            return &m_butterfly;
-        }
+    void* butterflyAddress()
+    {
+        return &m_butterfly;
+    }
 
-        static JS_EXPORTDATA const ClassInfo s_info;
-
-    protected:
-        void finishCreation(JSGlobalData& globalData)
-        {
-            Base::finishCreation(globalData);
-            ASSERT(inherits(&s_info));
-            ASSERT(!structure()->outOfLineCapacity());
-            ASSERT(structure()->isEmpty());
-            ASSERT(prototype().isNull() || Heap::heap(this) == Heap::heap(prototype()));
-            ASSERT(structure()->isObject());
-            ASSERT(classInfo());
-        }
+    static JS_EXPORTDATA const ClassInfo s_info;
 
-        static Structure* createStructure(JSGlobalData& globalData, JSGlobalObject* globalObject, JSValue prototype)
-        {
-            return Structure::create(globalData, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), &s_info);
-        }
+protected:
+    void finishCreation(JSGlobalData& globalData)
+    {
+        Base::finishCreation(globalData);
+        ASSERT(inherits(&s_info));
+        ASSERT(!structure()->outOfLineCapacity());
+        ASSERT(structure()->isEmpty());
+        ASSERT(prototype().isNull() || Heap::heap(this) == Heap::heap(prototype()));
+        ASSERT(structure()->isObject());
+        ASSERT(classInfo());
+    }
 
-        // To instantiate objects you likely want JSFinalObject, below.
-        // To create derived types you likely want JSNonFinalObject, below.
-        JSObject(JSGlobalData&, Structure*, Butterfly* = 0);
+    static Structure* createStructure(JSGlobalData& globalData, JSGlobalObject* globalObject, JSValue prototype)
+    {
+        return Structure::create(globalData, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), &s_info);
+    }
+
+    // To instantiate objects you likely want JSFinalObject, below.
+    // To create derived types you likely want JSNonFinalObject, below.
+    JSObject(JSGlobalData&, Structure*, Butterfly* = 0);
         
-        void resetInheritorID(JSGlobalData&);
+    void resetInheritorID(JSGlobalData&);
         
-        void visitButterfly(SlotVisitor&, Butterfly*, size_t storageSize);
-        void copyButterfly(CopyVisitor&, Butterfly*, size_t storageSize);
-
-        // Call this if you know that the object is in a mode where it has array
-        // storage. This will assert otherwise.
-        ArrayStorage* arrayStorage()
-        {
-            ASSERT(hasArrayStorage(structure()->indexingType()));
-            return m_butterfly->arrayStorage();
-        }
+    void visitButterfly(SlotVisitor&, Butterfly*, size_t storageSize);
+    void copyButterfly(CopyVisitor&, Butterfly*, size_t storageSize);
+
+    // Call this if you know that the object is in a mode where it has array
+    // storage. This will assert otherwise.
+    ArrayStorage* arrayStorage()
+    {
+        ASSERT(hasArrayStorage(structure()->indexingType()));
+        return m_butterfly->arrayStorage();
+    }
         
-        // Call this if you want to predicate some actions on whether or not the
-        // object is in a mode where it has array storage.
-        ArrayStorage* arrayStorageOrNull()
-        {
-            switch (structure()->indexingType()) {
-            case ALL_ARRAY_STORAGE_INDEXING_TYPES:
-                return m_butterfly->arrayStorage();
+    // Call this if you want to predicate some actions on whether or not the
+    // object is in a mode where it has array storage.
+    ArrayStorage* arrayStorageOrNull()
+    {
+        switch (structure()->indexingType()) {
+        case ALL_ARRAY_STORAGE_INDEXING_TYPES:
+            return m_butterfly->arrayStorage();
                 
-            default:
-                return 0;
-            }
+        default:
+            return 0;
         }
+    }
 
-        ArrayStorage* createArrayStorage(JSGlobalData&, unsigned length, unsigned vectorLength);
-        ArrayStorage* createInitialArrayStorage(JSGlobalData&);
-        WriteBarrier<Unknown>* createInitialContiguous(JSGlobalData&, unsigned length);
-        ArrayStorage* convertContiguousToArrayStorage(JSGlobalData&, NonPropertyTransition, unsigned neededLength);
-        ArrayStorage* convertContiguousToArrayStorage(JSGlobalData&, NonPropertyTransition);
-        ArrayStorage* convertContiguousToArrayStorage(JSGlobalData&);
+    ArrayStorage* createArrayStorage(JSGlobalData&, unsigned length, unsigned vectorLength);
+    ArrayStorage* createInitialArrayStorage(JSGlobalData&);
+    WriteBarrier<Unknown>* createInitialContiguous(JSGlobalData&, unsigned length);
+    ArrayStorage* convertContiguousToArrayStorage(JSGlobalData&, NonPropertyTransition, unsigned neededLength);
+    ArrayStorage* convertContiguousToArrayStorage(JSGlobalData&, NonPropertyTransition);
+    ArrayStorage* convertContiguousToArrayStorage(JSGlobalData&);
         
-        ArrayStorage* ensureArrayStorageExistsAndEnterDictionaryIndexingMode(JSGlobalData&);
+    ArrayStorage* ensureArrayStorageExistsAndEnterDictionaryIndexingMode(JSGlobalData&);
         
-        bool defineOwnNonIndexProperty(ExecState*, PropertyName, PropertyDescriptor&, bool throwException);
+    bool defineOwnNonIndexProperty(ExecState*, PropertyName, PropertyDescriptor&, bool throwException);
 
-        void putByIndexBeyondVectorLengthContiguousWithoutAttributes(ExecState*, unsigned propertyName, JSValue);
-        void putByIndexBeyondVectorLengthWithArrayStorage(ExecState*, unsigned propertyName, JSValue, bool shouldThrow, ArrayStorage*);
+    void putByIndexBeyondVectorLengthContiguousWithoutAttributes(ExecState*, unsigned propertyName, JSValue);
+    void putByIndexBeyondVectorLengthWithArrayStorage(ExecState*, unsigned propertyName, JSValue, bool shouldThrow, ArrayStorage*);
 
-        bool increaseVectorLength(JSGlobalData&, unsigned newLength);
-        void deallocateSparseIndexMap();
-        bool defineOwnIndexedProperty(ExecState*, unsigned, PropertyDescriptor&, bool throwException);
-        SparseArrayValueMap* allocateSparseIndexMap(JSGlobalData&);
+    bool increaseVectorLength(JSGlobalData&, unsigned newLength);
+    void deallocateSparseIndexMap();
+    bool defineOwnIndexedProperty(ExecState*, unsigned, PropertyDescriptor&, bool throwException);
+    SparseArrayValueMap* allocateSparseIndexMap(JSGlobalData&);
         
-        void notifyPresenceOfIndexedAccessors(JSGlobalData&);
+    void notifyPresenceOfIndexedAccessors(JSGlobalData&);
         
-        bool attemptToInterceptPutByIndexOnHole(ExecState*, unsigned index, JSValue, bool shouldThrow);
+    bool attemptToInterceptPutByIndexOnHole(ExecState*, unsigned index, JSValue, bool shouldThrow);
         
-        // Call this if you want setIndexQuickly to succeed and you're sure that
-        // the array is contiguous.
-        void ensureContiguousLength(JSGlobalData& globalData, unsigned length)
-        {
-            ASSERT(length < MAX_ARRAY_INDEX);
-            ASSERT(hasContiguous(structure()->indexingType()));
+    // Call this if you want setIndexQuickly to succeed and you're sure that
+    // the array is contiguous.
+    void ensureContiguousLength(JSGlobalData& globalData, unsigned length)
+    {
+        ASSERT(length < MAX_ARRAY_INDEX);
+        ASSERT(hasContiguous(structure()->indexingType()));
             
-            if (m_butterfly->vectorLength() < length)
-                ensureContiguousLengthSlow(globalData, length);
+        if (m_butterfly->vectorLength() < length)
+            ensureContiguousLengthSlow(globalData, length);
             
-            if (m_butterfly->publicLength() < length)
-                m_butterfly->setPublicLength(length);
-        }
+        if (m_butterfly->publicLength() < length)
+            m_butterfly->setPublicLength(length);
+    }
         
-        unsigned countElementsInContiguous(Butterfly*);
+    unsigned countElementsInContiguous(Butterfly*);
         
-        template<IndexingType indexingType>
-        WriteBarrier<Unknown>* indexingData()
-        {
-            switch (indexingType) {
-            case ALL_CONTIGUOUS_INDEXING_TYPES:
-                return m_butterfly->contiguous();
+    template<IndexingType indexingType>
+    WriteBarrier<Unknown>* indexingData()
+    {
+        switch (indexingType) {
+        case ALL_CONTIGUOUS_INDEXING_TYPES:
+            return m_butterfly->contiguous();
                 
-            case ALL_ARRAY_STORAGE_INDEXING_TYPES:
-                return m_butterfly->arrayStorage()->m_vector;
+        case ALL_ARRAY_STORAGE_INDEXING_TYPES:
+            return m_butterfly->arrayStorage()->m_vector;
                 
-            default:
-                CRASH();
-                return 0;
-            }
+        default:
+            CRASH();
+            return 0;
         }
+    }
+
+    WriteBarrier<Unknown>* currentIndexingData()
+    {
+        switch (structure()->indexingType()) {
+        case ALL_CONTIGUOUS_INDEXING_TYPES:
+            return m_butterfly->contiguous();
+
+        case ALL_ARRAY_STORAGE_INDEXING_TYPES:
+            return m_butterfly->arrayStorage()->m_vector;
+
+        default:
+            CRASH();
+            return 0;
+        }
+    }
         
-        template<IndexingType indexingType>
-        unsigned relevantLength()
-        {
-            switch (indexingType) {
-            case ALL_CONTIGUOUS_INDEXING_TYPES:
-                return m_butterfly->publicLength();
+    template<IndexingType indexingType>
+    unsigned relevantLength()
+    {
+        switch (indexingType) {
+        case ALL_CONTIGUOUS_INDEXING_TYPES:
+            return m_butterfly->publicLength();
                 
-            case ALL_ARRAY_STORAGE_INDEXING_TYPES:
-                return std::min(
-                    m_butterfly->arrayStorage()->length(),
-                    m_butterfly->arrayStorage()->vectorLength());
+        case ALL_ARRAY_STORAGE_INDEXING_TYPES:
+            return std::min(
+                m_butterfly->arrayStorage()->length(),
+                m_butterfly->arrayStorage()->vectorLength());
                 
-            default:
-                CRASH();
-                return 0;
-            }
+        default:
+            CRASH();
+            return 0;
         }
+    }
 
-    private:
-        friend class LLIntOffsetsExtractor;
+    unsigned currentRelevantLength()
+    {
+        switch (structure()->indexingType()) {
+        case ALL_CONTIGUOUS_INDEXING_TYPES:
+            return m_butterfly->publicLength();
+
+        case ALL_ARRAY_STORAGE_INDEXING_TYPES:
+            return std::min(
+                m_butterfly->arrayStorage()->length(),
+                m_butterfly->arrayStorage()->vectorLength());
+
+        default:
+            CRASH();
+            return 0;
+        }
+    }
+
+private:
+    friend class LLIntOffsetsExtractor;
         
-        // Nobody should ever ask any of these questions on something already known to be a JSObject.
-        using JSCell::isAPIValueWrapper;
-        using JSCell::isGetterSetter;
-        void getObject();
-        void getString(ExecState* exec);
-        void isObject();
-        void isString();
+    // Nobody should ever ask any of these questions on something already known to be a JSObject.
+    using JSCell::isAPIValueWrapper;
+    using JSCell::isGetterSetter;
+    void getObject();
+    void getString(ExecState* exec);
+    void isObject();
+    void isString();
         
-        ArrayStorage* enterDictionaryIndexingModeWhenArrayStorageAlreadyExists(JSGlobalData&, ArrayStorage*);
+    ArrayStorage* enterDictionaryIndexingModeWhenArrayStorageAlreadyExists(JSGlobalData&, ArrayStorage*);
         
-        template<PutMode>
-        bool putDirectInternal(JSGlobalData&, PropertyName, JSValue, unsigned attr, PutPropertySlot&, JSCell*);
+    template<PutMode>
+    bool putDirectInternal(JSGlobalData&, PropertyName, JSValue, unsigned attr, PutPropertySlot&, JSCell*);
 
-        bool inlineGetOwnPropertySlot(ExecState*, PropertyName, PropertySlot&);
-        JS_EXPORT_PRIVATE void fillGetterPropertySlot(PropertySlot&, PropertyOffset);
+    bool inlineGetOwnPropertySlot(ExecState*, PropertyName, PropertySlot&);
+    JS_EXPORT_PRIVATE void fillGetterPropertySlot(PropertySlot&, PropertyOffset);
 
-        const HashEntry* findPropertyHashEntry(ExecState*, PropertyName) const;
-        Structure* createInheritorID(JSGlobalData&);
+    const HashEntry* findPropertyHashEntry(ExecState*, PropertyName) const;
+    Structure* createInheritorID(JSGlobalData&);
         
-        void putIndexedDescriptor(ExecState*, SparseArrayEntry*, PropertyDescriptor&, PropertyDescriptor& old);
+    void putIndexedDescriptor(ExecState*, SparseArrayEntry*, PropertyDescriptor&, PropertyDescriptor& old);
         
-        void putByIndexBeyondVectorLength(ExecState*, unsigned propertyName, JSValue, bool shouldThrow);
-        bool putDirectIndexBeyondVectorLengthWithArrayStorage(ExecState*, unsigned propertyName, JSValue, unsigned attributes, PutDirectIndexMode, ArrayStorage*);
-        JS_EXPORT_PRIVATE bool putDirectIndexBeyondVectorLength(ExecState*, unsigned propertyName, JSValue, unsigned attributes, PutDirectIndexMode);
+    void putByIndexBeyondVectorLength(ExecState*, unsigned propertyName, JSValue, bool shouldThrow);
+    bool putDirectIndexBeyondVectorLengthWithArrayStorage(ExecState*, unsigned propertyName, JSValue, unsigned attributes, PutDirectIndexMode, ArrayStorage*);
+    JS_EXPORT_PRIVATE bool putDirectIndexBeyondVectorLength(ExecState*, unsigned propertyName, JSValue, unsigned attributes, PutDirectIndexMode);
         
-        unsigned getNewVectorLength(unsigned currentVectorLength, unsigned currentLength, unsigned desiredLength);
-        unsigned getNewVectorLength(unsigned desiredLength);
+    unsigned getNewVectorLength(unsigned currentVectorLength, unsigned currentLength, unsigned desiredLength);
+    unsigned getNewVectorLength(unsigned desiredLength);
 
-        JS_EXPORT_PRIVATE bool getOwnPropertySlotSlow(ExecState*, PropertyName, PropertySlot&);
+    JS_EXPORT_PRIVATE bool getOwnPropertySlotSlow(ExecState*, PropertyName, PropertySlot&);
         
-        void ensureContiguousLengthSlow(JSGlobalData&, unsigned length);
+    void ensureContiguousLengthSlow(JSGlobalData&, unsigned length);
         
-        WriteBarrier<Unknown>* ensureContiguousSlow(JSGlobalData&);
-        ArrayStorage* ensureArrayStorageSlow(JSGlobalData&);
-        Butterfly* ensureIndexedStorageSlow(JSGlobalData&);
+    WriteBarrier<Unknown>* ensureContiguousSlow(JSGlobalData&);
+    ArrayStorage* ensureArrayStorageSlow(JSGlobalData&);
+    Butterfly* ensureIndexedStorageSlow(JSGlobalData&);
         
-    protected:
-        Butterfly* m_butterfly;
-    };
+protected:
+    Butterfly* m_butterfly;
+};
 
 
-    // JSNonFinalObject is a type of JSObject that has some internal storage,
-    // but also preserves some space in the collector cell for additional
-    // data members in derived types.
-    class JSNonFinalObject : public JSObject {
-        friend class JSObject;
+// JSNonFinalObject is a type of JSObject that has some internal storage,
+// but also preserves some space in the collector cell for additional
+// data members in derived types.
+class JSNonFinalObject : public JSObject {
+    friend class JSObject;
 
-    public:
-        typedef JSObject Base;
+public:
+    typedef JSObject Base;
 
-        static Structure* createStructure(JSGlobalData& globalData, JSGlobalObject* globalObject, JSValue prototype)
-        {
-            return Structure::create(globalData, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), &s_info);
-        }
+    static Structure* createStructure(JSGlobalData& globalData, JSGlobalObject* globalObject, JSValue prototype)
+    {
+        return Structure::create(globalData, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), &s_info);
+    }
 
-    protected:
-        explicit JSNonFinalObject(JSGlobalData& globalData, Structure* structure, Butterfly* butterfly = 0)
-            : JSObject(globalData, structure, butterfly)
-        {
-        }
+protected:
+    explicit JSNonFinalObject(JSGlobalData& globalData, Structure* structure, Butterfly* butterfly = 0)
+        : JSObject(globalData, structure, butterfly)
+    {
+    }
 
-        void finishCreation(JSGlobalData& globalData)
-        {
-            Base::finishCreation(globalData);
-            ASSERT(!this->structure()->totalStorageCapacity());
-            ASSERT(classInfo());
-        }
-    };
+    void finishCreation(JSGlobalData& globalData)
+    {
+        Base::finishCreation(globalData);
+        ASSERT(!this->structure()->totalStorageCapacity());
+        ASSERT(classInfo());
+    }
+};
 
-    class JSFinalObject;
+class JSFinalObject;
 
-    // JSFinalObject is a type of JSObject that contains sufficent internal
-    // storage to fully make use of the colloctor cell containing it.
-    class JSFinalObject : public JSObject {
-        friend class JSObject;
+// JSFinalObject is a type of JSObject that contains sufficent internal
+// storage to fully make use of the colloctor cell containing it.
+class JSFinalObject : public JSObject {
+    friend class JSObject;
 
-    public:
-        typedef JSObject Base;
+public:
+    typedef JSObject Base;
 
-        static JSFinalObject* create(ExecState*, Structure*);
-        static Structure* createStructure(JSGlobalData& globalData, JSGlobalObject* globalObject, JSValue prototype)
-        {
-            return Structure::create(globalData, globalObject, prototype, TypeInfo(FinalObjectType, StructureFlags), &s_info, NonArray, INLINE_STORAGE_CAPACITY);
-        }
+    static JSFinalObject* create(ExecState*, Structure*);
+    static Structure* createStructure(JSGlobalData& globalData, JSGlobalObject* globalObject, JSValue prototype)
+    {
+        return Structure::create(globalData, globalObject, prototype, TypeInfo(FinalObjectType, StructureFlags), &s_info, NonArray, INLINE_STORAGE_CAPACITY);
+    }
 
-        JS_EXPORT_PRIVATE static void visitChildren(JSCell*, SlotVisitor&);
+    JS_EXPORT_PRIVATE static void visitChildren(JSCell*, SlotVisitor&);
 
-        static JS_EXPORTDATA const ClassInfo s_info;
+    static JS_EXPORTDATA const ClassInfo s_info;
 
-    protected:
-        void visitChildrenCommon(SlotVisitor&);
+protected:
+    void visitChildrenCommon(SlotVisitor&);
         
-        void finishCreation(JSGlobalData& globalData)
-        {
-            Base::finishCreation(globalData);
-            ASSERT(structure()->totalStorageCapacity() == structure()->inlineCapacity());
-            ASSERT(classInfo());
-        }
+    void finishCreation(JSGlobalData& globalData)
+    {
+        Base::finishCreation(globalData);
+        ASSERT(structure()->totalStorageCapacity() == structure()->inlineCapacity());
+        ASSERT(classInfo());
+    }
 
-    private:
-        friend class LLIntOffsetsExtractor;
+private:
+    friend class LLIntOffsetsExtractor;
 
-        explicit JSFinalObject(JSGlobalData& globalData, Structure* structure)
-            : JSObject(globalData, structure)
-        {
-        }
+    explicit JSFinalObject(JSGlobalData& globalData, Structure* structure)
+        : JSObject(globalData, structure)
+    {
+    }
 
-        static const unsigned StructureFlags = JSObject::StructureFlags;
-    };
+    static const unsigned StructureFlags = JSObject::StructureFlags;
+};
 
 inline JSFinalObject* JSFinalObject::create(ExecState* exec, Structure* structure)
 {
@@ -902,11 +933,6 @@ inline bool JSObject::isErrorInstance() const
     return structure()->typeInfo().type() == ErrorInstanceType;
 }
 
-inline bool JSObject::isProxy() const
-{
-    return structure()->typeInfo().type() == ProxyType;
-}
-
 inline void JSObject::setButterfly(JSGlobalData& globalData, Butterfly* butterfly, Structure* structure)
 {
     ASSERT(structure);
diff --git a/Source/JavaScriptCore/runtime/JSScope.cpp b/Source/JavaScriptCore/runtime/JSScope.cpp
index 508a90540..8651a76ba 100644
--- a/Source/JavaScriptCore/runtime/JSScope.cpp
+++ b/Source/JavaScriptCore/runtime/JSScope.cpp
@@ -334,11 +334,14 @@ template <JSScope::LookupMode mode, JSScope::ReturnValues returnValues> JSObject
                     ASSERT(variableObject);
                     ASSERT(variableObject->symbolTable());
                     SymbolTableEntry entry = variableObject->symbolTable()->get(identifier.impl());
-                    // Variable was actually inserted by eval
+                    // Defend against the variable being actually inserted by eval.
                     if (entry.isNull()) {
                         ASSERT(!jsDynamicCast<JSNameScope*>(variableObject));
                         goto fail;
                     }
+                    // If we're getting the 'arguments' then give up on life.
+                    if (identifier == callFrame->propertyNames().arguments)
+                        goto fail;
 
                     if (putToBaseOperation) {
                         putToBaseOperation->m_kind = entry.isReadOnly() ? PutToBaseOperation::Readonly : PutToBaseOperation::VariablePut;
diff --git a/Source/JavaScriptCore/runtime/JSType.h b/Source/JavaScriptCore/runtime/JSType.h
index 03f4a7790..10d98d2bd 100644
--- a/Source/JavaScriptCore/runtime/JSType.h
+++ b/Source/JavaScriptCore/runtime/JSType.h
@@ -41,6 +41,11 @@ enum JSType {
     ProgramExecutableType,
     FunctionExecutableType,
 
+    UnlinkedFunctionExecutableType,
+    UnlinkedProgramCodeBlockType,
+    UnlinkedEvalCodeBlockType,
+    UnlinkedFunctionCodeBlockType,
+
     // The ObjectType value must come before any JSType that is a subclass of JSObject.
     ObjectType,
     FinalObjectType,
diff --git a/Source/JavaScriptCore/runtime/JSTypeInfo.h b/Source/JavaScriptCore/runtime/JSTypeInfo.h
index d9b3585a0..6f63260fe 100644
--- a/Source/JavaScriptCore/runtime/JSTypeInfo.h
+++ b/Source/JavaScriptCore/runtime/JSTypeInfo.h
@@ -55,7 +55,7 @@ namespace JSC {
             , m_flags2(flags >> 8)
         {
             ASSERT(flags <= 0x3ff);
-            ASSERT(type <= 0xff);
+            ASSERT(static_cast<int>(type) <= 0xff);
             ASSERT(type >= CompoundType || !(flags & OverridesVisitChildren));
             // No object that doesn't ImplementsHasInstance should override it!
             ASSERT((m_flags & (ImplementsHasInstance | OverridesHasInstance)) != OverridesHasInstance);
diff --git a/Source/JavaScriptCore/runtime/JSValue.cpp b/Source/JavaScriptCore/runtime/JSValue.cpp
index a5cdf700b..e7f8cad17 100644
--- a/Source/JavaScriptCore/runtime/JSValue.cpp
+++ b/Source/JavaScriptCore/runtime/JSValue.cpp
@@ -62,7 +62,7 @@ double JSValue::toNumberSlowCase(ExecState* exec) const
         return asCell()->toNumber(exec);
     if (isTrue())
         return 1.0;
-    return isUndefined() ? std::numeric_limits<double>::quiet_NaN() : 0; // null and false both convert to 0.
+    return isUndefined() ? QNaN : 0; // null and false both convert to 0.
 }
 
 JSObject* JSValue::toObjectSlowCase(ExecState* exec, JSGlobalObject* globalObject) const
diff --git a/Source/JavaScriptCore/runtime/JSValue.h b/Source/JavaScriptCore/runtime/JSValue.h
index 7b5c81aa9..bd9b90466 100644
--- a/Source/JavaScriptCore/runtime/JSValue.h
+++ b/Source/JavaScriptCore/runtime/JSValue.h
@@ -35,6 +35,10 @@
 
 namespace JSC {
 
+// This is used a lot throughout JavaScriptCore for everything from value boxing to marking
+// values as being missing, so it is useful to have it abbreviated.
+#define QNaN (std::numeric_limits<double>::quiet_NaN())
+
     class ExecState;
     class JSCell;
     class JSGlobalData;
diff --git a/Source/JavaScriptCore/runtime/JSValueInlineMethods.h b/Source/JavaScriptCore/runtime/JSValueInlineMethods.h
index 52b747890..224982e9e 100644
--- a/Source/JavaScriptCore/runtime/JSValueInlineMethods.h
+++ b/Source/JavaScriptCore/runtime/JSValueInlineMethods.h
@@ -62,7 +62,7 @@ namespace JSC {
 
     inline JSValue jsNaN()
     {
-        return JSValue(std::numeric_limits<double>::quiet_NaN());
+        return JSValue(QNaN);
     }
 
     inline JSValue::JSValue(char i)
diff --git a/Source/JavaScriptCore/runtime/MathObject.cpp b/Source/JavaScriptCore/runtime/MathObject.cpp
index 2f4df375a..7634487ad 100644
--- a/Source/JavaScriptCore/runtime/MathObject.cpp
+++ b/Source/JavaScriptCore/runtime/MathObject.cpp
@@ -175,7 +175,7 @@ EncodedJSValue JSC_HOST_CALL mathProtoFuncMax(ExecState* exec)
     for (unsigned k = 0; k < argsCount; ++k) {
         double val = exec->argument(k).toNumber(exec);
         if (isnan(val)) {
-            result = std::numeric_limits<double>::quiet_NaN();
+            result = QNaN;
             break;
         }
         if (val > result || (val == 0 && result == 0 && !signbit(val)))
@@ -191,7 +191,7 @@ EncodedJSValue JSC_HOST_CALL mathProtoFuncMin(ExecState* exec)
     for (unsigned k = 0; k < argsCount; ++k) {
         double val = exec->argument(k).toNumber(exec);
         if (isnan(val)) {
-            result = std::numeric_limits<double>::quiet_NaN();
+            result = QNaN;
             break;
         }
         if (val < result || (val == 0 && result == 0 && signbit(val)))
diff --git a/Source/JavaScriptCore/runtime/Operations.h b/Source/JavaScriptCore/runtime/Operations.h
index 30ba0b27d..01df7e98c 100644
--- a/Source/JavaScriptCore/runtime/Operations.h
+++ b/Source/JavaScriptCore/runtime/Operations.h
@@ -24,6 +24,7 @@
 
 #include "ExceptionHelpers.h"
 #include "Interpreter.h"
+#include "JSProxy.h"
 #include "JSString.h"
 #include "JSValueInlineMethods.h"
 
@@ -297,19 +298,24 @@ namespace JSC {
         return jsAddSlowCase(callFrame, v1, v2);
     }
 
+#define InvalidPrototypeChain (std::numeric_limits<size_t>::max())
+
     inline size_t normalizePrototypeChain(CallFrame* callFrame, JSValue base, JSValue slotBase, const Identifier& propertyName, PropertyOffset& slotOffset)
     {
         JSCell* cell = base.asCell();
         size_t count = 0;
 
         while (slotBase != cell) {
+            if (cell->isProxy())
+                return InvalidPrototypeChain;
+            
             JSValue v = cell->structure()->prototypeForLookup(callFrame);
 
             // If we didn't find slotBase in base's prototype chain, then base
             // must be a proxy for another object.
 
             if (v.isNull())
-                return 0;
+                return InvalidPrototypeChain;
 
             cell = v.asCell();
 
@@ -332,6 +338,9 @@ namespace JSC {
     {
         size_t count = 0;
         while (1) {
+            if (base->isProxy())
+                return InvalidPrototypeChain;
+            
             JSValue v = base->structure()->prototypeForLookup(callFrame);
             if (v.isNull())
                 return count;
diff --git a/Source/JavaScriptCore/runtime/RegExpObject.cpp b/Source/JavaScriptCore/runtime/RegExpObject.cpp
index dfbf533f7..35de40912 100644
--- a/Source/JavaScriptCore/runtime/RegExpObject.cpp
+++ b/Source/JavaScriptCore/runtime/RegExpObject.cpp
@@ -178,11 +178,34 @@ JSValue regExpObjectMultiline(ExecState*, JSValue slotBase, PropertyName)
     return jsBoolean(asRegExpObject(slotBase)->regExp()->multiline());
 }
 
-JSValue regExpObjectSource(ExecState* exec, JSValue slotBase, PropertyName)
+template <typename CharacterType>
+static inline void appendLineTerminatorEscape(StringBuilder&, CharacterType);
+
+template <>
+inline void appendLineTerminatorEscape<LChar>(StringBuilder& builder, LChar lineTerminator)
+{
+    if (lineTerminator == '\n')
+        builder.append('n');
+    else
+        builder.append('r');
+}
+
+template <>
+inline void appendLineTerminatorEscape<UChar>(StringBuilder& builder, UChar lineTerminator)
+{
+    if (lineTerminator == '\n')
+        builder.append('n');
+    else if (lineTerminator == '\r')
+        builder.append('r');
+    else if (lineTerminator == 0x2028)
+        builder.appendLiteral("u2028");
+    else
+        builder.appendLiteral("u2029");
+}
+
+template <typename CharacterType>
+static inline JSValue regExpObjectSourceInternal(ExecState* exec, String pattern, const CharacterType* characters, unsigned length)
 {
-    String pattern = asRegExpObject(slotBase)->regExp()->pattern();
-    unsigned length = pattern.length();
-    const UChar* characters = pattern.characters();
     bool previousCharacterWasBackslash = false;
     bool inBrackets = false;
     bool shouldEscape = false;
@@ -197,7 +220,7 @@ JSValue regExpObjectSource(ExecState* exec, JSValue slotBase, PropertyName)
 
     // early return for strings that don't contain a forwards slash and LineTerminator
     for (unsigned i = 0; i < length; ++i) {
-        UChar ch = characters[i];
+        CharacterType ch = characters[i];
         if (!previousCharacterWasBackslash) {
             if (inBrackets) {
                 if (ch == ']')
@@ -212,7 +235,7 @@ JSValue regExpObjectSource(ExecState* exec, JSValue slotBase, PropertyName)
             }
         }
 
-        if (Lexer<UChar>::isLineTerminator(ch)) {
+        if (Lexer<CharacterType>::isLineTerminator(ch)) {
             shouldEscape = true;
             break;
         }
@@ -230,7 +253,7 @@ JSValue regExpObjectSource(ExecState* exec, JSValue slotBase, PropertyName)
     inBrackets = false;
     StringBuilder result;
     for (unsigned i = 0; i < length; ++i) {
-        UChar ch = characters[i];
+        CharacterType ch = characters[i];
         if (!previousCharacterWasBackslash) {
             if (inBrackets) {
                 if (ch == ']')
@@ -244,18 +267,11 @@ JSValue regExpObjectSource(ExecState* exec, JSValue slotBase, PropertyName)
         }
 
         // escape LineTerminator
-        if (Lexer<UChar>::isLineTerminator(ch)) {
+        if (Lexer<CharacterType>::isLineTerminator(ch)) {
             if (!previousCharacterWasBackslash)
                 result.append('\\');
 
-            if (ch == '\n')
-                result.append('n');
-            else if (ch == '\r')
-                result.append('r');
-            else if (ch == 0x2028)
-                result.appendLiteral("u2028");
-            else
-                result.appendLiteral("u2029");
+            appendLineTerminatorEscape<CharacterType>(result, ch);
         } else
             result.append(ch);
 
@@ -268,6 +284,14 @@ JSValue regExpObjectSource(ExecState* exec, JSValue slotBase, PropertyName)
     return jsString(exec, result.toString());
 }
 
+JSValue regExpObjectSource(ExecState* exec, JSValue slotBase, PropertyName)
+{
+    String pattern = asRegExpObject(slotBase)->regExp()->pattern();
+    if (pattern.is8Bit())
+        return regExpObjectSourceInternal(exec, pattern, pattern.characters8(), pattern.length());
+    return regExpObjectSourceInternal(exec, pattern, pattern.characters16(), pattern.length());
+}
+
 void RegExpObject::put(JSCell* cell, ExecState* exec, PropertyName propertyName, JSValue value, PutPropertySlot& slot)
 {
     if (propertyName == exec->propertyNames().lastIndex) {
diff --git a/Source/JavaScriptCore/runtime/StringPrototype.cpp b/Source/JavaScriptCore/runtime/StringPrototype.cpp
index 4d3ccfda2..5aafe8bb3 100644
--- a/Source/JavaScriptCore/runtime/StringPrototype.cpp
+++ b/Source/JavaScriptCore/runtime/StringPrototype.cpp
@@ -666,7 +666,7 @@ static inline EncodedJSValue replaceUsingStringSearch(ExecState* exec, JSString*
     String leftPart(StringImpl::create(stringImpl, 0, matchStart));
 
     size_t matchEnd = matchStart + searchString.impl()->length();
-    int ovector[2] = { matchStart,  matchEnd};
+    int ovector[2] = { static_cast<int>(matchStart),  static_cast<int>(matchEnd)};
     String middlePart = substituteBackreferences(replaceString, string, ovector, 0);
 
     size_t leftLength = stringImpl->length() - matchEnd;
diff --git a/Source/JavaScriptCore/runtime/Structure.cpp b/Source/JavaScriptCore/runtime/Structure.cpp
index a931def27..e733c7e23 100644
--- a/Source/JavaScriptCore/runtime/Structure.cpp
+++ b/Source/JavaScriptCore/runtime/Structure.cpp
@@ -543,6 +543,15 @@ Structure* Structure::nonPropertyTransition(JSGlobalData& globalData, Structure*
     unsigned attributes = toAttributes(transitionKind);
     IndexingType indexingType = newIndexingType(structure->indexingTypeIncludingHistory(), transitionKind);
     
+    JSGlobalObject* globalObject = structure->globalObject();
+    if (structure == globalObject->arrayStructure()) {
+        Structure* transition = globalObject->arrayStructureWithArrayStorage();
+        if (transition->indexingTypeIncludingHistory() == indexingType) {
+            structure->notifyTransitionFromThisStructure();
+            return transition;
+        }
+    }
+    
     if (Structure* existingTransition = structure->m_transitionTable.get(0, attributes)) {
         ASSERT(existingTransition->m_attributesInPrevious == attributes);
         ASSERT(existingTransition->indexingTypeIncludingHistory() == indexingType);
diff --git a/Source/JavaScriptCore/runtime/Structure.h b/Source/JavaScriptCore/runtime/Structure.h
index 5f1299766..2b25803a6 100644
--- a/Source/JavaScriptCore/runtime/Structure.h
+++ b/Source/JavaScriptCore/runtime/Structure.h
@@ -521,6 +521,11 @@ namespace JSC {
         return m_structure->typeInfo().type() == GetterSetterType;
     }
 
+    inline bool JSCell::isProxy() const
+    {
+        return structure()->typeInfo().type() == ProxyType;
+    }
+
     inline bool JSCell::isAPIValueWrapper() const
     {
         return m_structure->typeInfo().type() == APIValueWrapperType;
diff --git a/Source/JavaScriptCore/runtime/SymbolTable.h b/Source/JavaScriptCore/runtime/SymbolTable.h
index debb76499..87d1c8be5 100644
--- a/Source/JavaScriptCore/runtime/SymbolTable.h
+++ b/Source/JavaScriptCore/runtime/SymbolTable.h
@@ -337,7 +337,7 @@ namespace JSC {
 
     struct SymbolTableIndexHashTraits : HashTraits<SymbolTableEntry> {
         static const bool emptyValueIsZero = true;
-        static const bool needsDestruction = false;
+        static const bool needsDestruction = true;
     };
 
     typedef HashMap<RefPtr<StringImpl>, SymbolTableEntry, IdentifierRepHash, HashTraits<RefPtr<StringImpl> >, SymbolTableIndexHashTraits> SymbolTable;
diff --git a/Source/Platform/ChangeLog b/Source/Platform/ChangeLog
index 8dae5d48b..033df1d08 100644
--- a/Source/Platform/ChangeLog
+++ b/Source/Platform/ChangeLog
@@ -1,3 +1,284 @@
+2012-10-23  Stephen White  <senorblanco@chromium.org>
+
+        [skia] Implement reference (url) filters on composited layers.
+        https://bugs.webkit.org/show_bug.cgi?id=100142
+
+        Reviewed by James Robinson.
+
+        * chromium/public/WebLayer.h:
+        Expose Layer::setFilter() to the WebKit API.
+
+2012-11-05  James Robinson  <jamesr@chromium.org>
+
+        [chromium] Use const SkBitmap& parameter for WebLayerTreeView::setFontAtlas
+        https://bugs.webkit.org/show_bug.cgi?id=101016
+
+        Reviewed by Adrienne Walker.
+
+        Passing SkBitmap by value requires including SkBitmap.h, which is tricky for some clients to do since it
+        requires having the rest of skia's headers on the include path and setting up the correct config to set
+        preprocessor defines.  Also shuffles the parameter order around to make rolling easier since you can't override
+        just by const ref-ness.
+
+        * chromium/public/WebLayerTreeView.h:
+        (WebKit::WebLayerTreeView::setFontAtlas):
+
+2012-11-05  Alok Priyadarshi  <alokp@chromium.org>
+
+        [chromium] Pass canPaintLCDText to WebContentLayerClient::paintContents
+        https://bugs.webkit.org/show_bug.cgi?id=99083
+
+        Reviewed by Stephen White.
+
+        Use LCD text setting passed to WebContentLayerClient::paintContents instead of turning it off for all composited layers.
+
+        * chromium/public/WebContentLayerClient.h:
+        (WebContentLayerClient):
+        (WebKit::WebContentLayerClient::paintContents):
+
+2012-11-01  Robert Kroeger  <rjkroege@chromium.org>
+
+        [chromium] Provide WebKit API interface for platform gesture curves
+        https://bugs.webkit.org/show_bug.cgi?id=100675
+
+        Reviewed by James Robinson.
+
+        Define interfaces to permit the Chromium embedder to provide its own
+        implementation of a gesture animation curve and add an entry point
+        to Platform.h that permits WebKit to obtain an instance of an embedder-
+        provided gesture curve.
+
+        No tests needed in this CL: only interfaces are being added.
+
+        * Platform.gypi:
+        * chromium/public/Platform.h:
+        (WebKit):
+        (Platform):
+        (WebKit::Platform::createFlingAnimationCurve):
+        * chromium/public/WebGestureCurve.h: Added.
+        (WebKit):
+        (WebGestureCurve):
+        (WebKit::WebGestureCurve::~WebGestureCurve):
+        * chromium/public/WebGestureCurveTarget.h: Added.
+        (WebKit):
+        (WebGestureCurveTarget):
+        (WebKit::WebGestureCurveTarget::~WebGestureCurveTarget):
+        * chromium/src/WebActiveGestureAnimation.cpp: Added.
+        (WebKit):
+        (WebKit::WebActiveGestureAnimation::createAtAnimationStart):
+        (WebKit::WebActiveGestureAnimation::createWithTimeOffset):
+        (WebKit::WebActiveGestureAnimation::~WebActiveGestureAnimation):
+        (WebKit::WebActiveGestureAnimation::WebActiveGestureAnimation):
+        (WebKit::WebActiveGestureAnimation::animate):
+        * chromium/src/WebActiveGestureAnimation.h: Added.
+        (WebKit):
+        (WebActiveGestureAnimation):
+
+2012-11-01  Dana Jansens  <danakj@chromium.org>
+
+        [chromium] Allow implicit conversion between gfx::Vector2d and WebSize
+        https://bugs.webkit.org/show_bug.cgi?id=100553
+
+        Reviewed by James Robinson.
+
+        The gfx::Vector2d class is used in chromium for defining distances. The
+        IntSize class is used equivalently inside WebCore. This lets us convert
+        between vectors and sizes along the API boundary.
+
+        * chromium/public/WebSize.h:
+        (WebKit::WebSize::WebSize):
+        (WebSize):
+        (WebKit::WebSize::operator=):
+        (WebKit::WebSize::operator gfx::Vector2d):
+
+2012-11-01  W. James MacLean  <wjmaclean@chromium.org>
+
+        [chromium] Make WebLayerTreeView::adjustEventPointForPinchZoom pure virtual.
+        https://bugs.webkit.org/show_bug.cgi?id=100875
+
+        Reviewed by James Robinson.
+
+        This CL removes the default implementation for adjustEventPointForPinchZoom(), which
+        was necessary for landing the original patch in https://bugs.webkit.org/show_bug.cgi?id=100542.
+
+        * chromium/public/WebLayerTreeView.h:
+        (WebLayerTreeView):
+
+2012-10-31  Stephen White  <senorblanco@chromium.org>
+
+        Unreviewed, rolling out r133122.
+        http://trac.webkit.org/changeset/133122
+        https://bugs.webkit.org/show_bug.cgi?id=99083
+
+        Broke Chromium Win, Android, ChromeOS builds
+
+        * chromium/public/WebContentLayerClient.h:
+        (WebContentLayerClient):
+
+2012-10-31  Alok Priyadarshi  <alokp@chromium.org>
+
+        [chromium] Pass canPaintLCDText to WebContentLayerClient::paintContents
+        https://bugs.webkit.org/show_bug.cgi?id=99083
+
+        Reviewed by James Robinson.
+
+        Use LCD text setting passed to WebContentLayerClient::paintContents instead of turning it off for all composited layers.
+
+        * chromium/public/WebContentLayerClient.h:
+        (WebContentLayerClient):
+        (WebKit::WebContentLayerClient::paintContents):
+
+2012-10-30  W. James MacLean  <wjmaclean@chromium.org>
+
+        [chromium] Transform mouse/gesture event coordinates to account for pinch-zoom in compositor.
+        https://bugs.webkit.org/show_bug.cgi?id=100542
+
+        Reviewed by James Robinson.
+
+        Pinch-zoom in the compositor applies a transformation that WebCore does not know about.
+        We need to adjust mouse and gesture event coordinates to account for this in order that
+        hit testing work properly for these types while zoomed.
+
+        * chromium/public/WebLayerTreeView.h:
+        (WebLayerTreeView):
+        (WebKit::WebLayerTreeView::adjustPointForZoom): Adjusts point coordinated to account for zoom in compositor.
+
+2012-10-30  James Robinson  <jamesr@chromium.org>
+
+        [chromium] Forward declare WebGraphicsContext3D in WebLayerTreeViewClient.h
+        https://bugs.webkit.org/show_bug.cgi?id=100717
+
+        Reviewed by Adrienne Walker.
+
+        Currently it isn't possible to include WebLayerTreeViewClient by itself.
+
+        * chromium/public/WebLayerTreeViewClient.h:
+        (WebKit):
+
+2012-10-26  Christopher Cameron  <ccameron@chromium.org>
+
+        [chromium] Add additional memory management fields to WebGraphicsContext3D
+        https://bugs.webkit.org/show_bug.cgi?id=99703
+
+        Reviewed by James Robinson.
+
+        Add new fields to WebGraphicsMemoryAllocation to allow for specifying
+        limits for when visible and not, and to allow for specifying priority
+        cutoffs (e.g, to allow specifying that backgrounded tabs should
+        retain only their visible textures).
+
+        Add sendManagedMemoryStatsCHROMIUM to WebGraphicsContext3D, and
+        add WebGraphicsManagedMemoryStats structure, to allow the GPU memory
+        manager to make more informed choices.
+
+        * chromium/public/WebGraphicsContext3D.h:
+        (WebKit::WebGraphicsContext3D::sendManagedMemoryStatsCHROMIUM):
+        * chromium/public/WebGraphicsMemoryAllocation.h:
+        (WebGraphicsMemoryAllocation):
+        (WebKit::WebGraphicsMemoryAllocation::WebGraphicsMemoryAllocation):
+        (WebKit):
+        (WebGraphicsManagedMemoryStats):
+        (WebKit::WebGraphicsManagedMemoryStats::WebGraphicsManagedMemoryStats):
+
+2012-10-26  Dana Jansens  <danakj@chromium.org>
+
+        [chromium] Add implicit conversions between WebFloatPoint and gfx::PointF
+        https://bugs.webkit.org/show_bug.cgi?id=100435
+
+        Reviewed by James Robinson.
+
+        This is similar to other Web geometry types, but the WebFloatPoint is
+        missing it.
+
+        * chromium/public/WebFloatPoint.h:
+        (WebFloatPoint):
+        (WebKit::WebFloatPoint::WebFloatPoint):
+        (WebKit::WebFloatPoint::operator=):
+        (WebKit::WebFloatPoint::operator gfx::PointF):
+
+2012-10-25  Jonathan Backer  <backer@chromium.org>
+
+        CHROMIUM: Add a method to WebLayerTreeView API
+        https://bugs.webkit.org/show_bug.cgi?id=100291
+
+        Reviewed by James Robinson.
+
+        Used to support browser compositor commit locks (crbug.com/136366).
+
+        * chromium/public/WebLayerTreeView.h:
+        (WebLayerTreeView):
+        (WebKit::WebLayerTreeView::setDeferCommits):
+
+2012-10-24  John Sheu  <sheu@google.com>
+
+        [chromium] Add textureWidth() and textureHeight() to WebVideoFrame
+        https://bugs.webkit.org/show_bug.cgi?id=100042
+
+        Reviewed by James Robinson.
+
+        It might be the case that the visible portion of a video frame isn't the
+        entire texture size, e.g. for cropping.  We'll need accessors in
+        WebVideoFrame to be able to query both the underlying texture dimensions
+        and the subrect which is supposed to be visible.
+
+        This is presently a no-op change.  Once Chromium changes are in, I will
+        remove the superseded parts of the WebVideoFrame interface.
+
+        * chromium/public/WebVideoFrame.h:
+        (WebKit::WebVideoFrame::visibleRect);
+        (WebKit::WebVideoFrame::textureSize);
+
+2012-10-24  Mark Pilgrim  <pilgrim@chromium.org>
+
+        [Chromium] Remove screen-related functions from PlatformSupport
+        https://bugs.webkit.org/show_bug.cgi?id=97474
+
+        Reviewed by Adam Barth.
+
+        Screen-related functions like screenHorizontalDPI that
+        used to be on PlatformSupport are now accessed through a new
+        PlatformPageClient attached to Widget in WebCore-land, which is
+        implemented by ChromeClientImpl in WebKit-land, which proxies
+        calls to WebWidgetClient, which is actually implemented in
+        Chromium-land.
+
+        * Platform.gypi:
+        * chromium/public/WebScreenInfo.h: Added.
+        (WebKit):
+        (WebScreenInfo):
+        (WebKit::WebScreenInfo::WebScreenInfo):
+
+2012-10-23  David Reveman  <reveman@chromium.org>
+
+        [Chromium] Add CHROMIUM_texture_from_image extension support.
+        https://bugs.webkit.org/show_bug.cgi?id=99894
+
+        Reviewed by James Robinson.
+
+        Add bindTexImage2DCHROMIUM and releaseTexImage2DCHROMIUM prototypes to
+        WebGraphicsContext3D.h.
+
+        * chromium/public/WebGraphicsContext3D.h:
+        (WebGraphicsContext3D):
+        (WebKit::WebGraphicsContext3D::bindTexImage2DCHROMIUM):
+        (WebKit::WebGraphicsContext3D::releaseTexImage2DCHROMIUM):
+
+2012-10-23  Dana Jansens  <danakj@chromium.org>
+
+        [chromium] Expose setAutomaticallyComputeRasterScale on the WebLayer API
+        https://bugs.webkit.org/show_bug.cgi?id=100013
+
+        Reviewed by James Robinson.
+
+        This allows web content to opt-in to having their contentsScale
+        determined from their CSS transforms, without having this behaviour
+        unconditionally enabled globally.
+
+        Supports http://crbug.com/149943
+
+        * chromium/public/WebLayer.h:
+        (WebLayer):
+
 2012-10-22  Keishi Hattori  <keishi@webkit.org>
 
         Remove monthFormatInLDML
diff --git a/Source/Platform/Platform.gypi b/Source/Platform/Platform.gypi
index fd24c0a97..dd26e6a59 100644
--- a/Source/Platform/Platform.gypi
+++ b/Source/Platform/Platform.gypi
@@ -71,6 +71,8 @@
             'chromium/public/WebFloatRect.h',
             'chromium/public/WebGamepad.h',
             'chromium/public/WebGamepads.h',
+            'chromium/public/WebGestureCurveTarget.h',
+            'chromium/public/WebGestureCurve.h',
             'chromium/public/WebGraphicsContext3D.h',
             'chromium/public/WebHTTPBody.h',
             'chromium/public/WebHTTPHeaderVisitor.h',
@@ -119,6 +121,7 @@
             'chromium/public/WebRect.h',
             'chromium/public/WebReferrerPolicy.h',
             'chromium/public/WebRenderingStats.h',
+            'chromium/public/WebScreenInfo.h',
             'chromium/public/WebScrollbar.h',
             'chromium/public/WebScrollbarLayer.h',
             'chromium/public/WebScrollbarThemeGeometry.h',
@@ -163,6 +166,8 @@
             'chromium/public/win/WebSandboxSupport.h',
             'chromium/public/win/WebThemeEngine.h',
             'chromium/src/Platform.cpp',
+            'chromium/src/WebActiveGestureAnimation.cpp',
+            'chromium/src/WebActiveGestureAnimation.h',
             'chromium/src/WebCString.cpp',
             'chromium/src/WebFilterOperation.cpp',
             'chromium/src/WebFilterOperations.cpp',
diff --git a/Source/Platform/chromium/public/Platform.h b/Source/Platform/chromium/public/Platform.h
index 47d9905dc..4a10aaa90 100644
--- a/Source/Platform/chromium/public/Platform.h
+++ b/Source/Platform/chromium/public/Platform.h
@@ -54,6 +54,8 @@ class WebCookieJar;
 class WebFileSystem;
 class WebFileUtilities;
 class WebFlingAnimator;
+class WebGestureCurveTarget;
+class WebGestureCurve;
 class WebMediaStreamCenter;
 class WebMediaStreamCenterClient;
 class WebMessagePortChannel;
@@ -71,6 +73,8 @@ class WebURL;
 class WebURLLoader;
 class WebWorkerRunLoop;
 struct WebLocalizedString;
+struct WebFloatPoint;
+struct WebSize;
 
 class Platform {
 public:
@@ -416,6 +420,10 @@ public:
 
     virtual WebFlingAnimator* createFlingAnimator() { return 0; }
 
+    // Creates a new fling animation curve instance for device |deviceSource|
+    // with |velocity| and already scrolled |cumulativeScroll| pixels.
+    virtual WebGestureCurve* createFlingAnimationCurve(int deviceSource, const WebFloatPoint& velocity, const WebSize& cumulativeScroll) { return 0; }
+
     // WebRTC ----------------------------------------------------------
 
     // DEPRECATED
diff --git a/Source/Platform/chromium/public/WebContentLayer.h b/Source/Platform/chromium/public/WebContentLayer.h
index a0ed0e4eb..ba7c83b56 100644
--- a/Source/Platform/chromium/public/WebContentLayer.h
+++ b/Source/Platform/chromium/public/WebContentLayer.h
@@ -49,6 +49,11 @@ public:
     virtual void setBoundsContainPageScale(bool) = 0;
     virtual bool boundsContainPageScale() const = 0;
 
+    // Allow the compositor to determine the scale at which the layer should
+    // be rasterized based on the layer's hierarchy and transform. This defaults
+    // to false.
+    virtual void setAutomaticallyComputeRasterScale(bool) { }
+
     // Set to render text in this layer with LCD antialiasing. Only set if you know that this layer will be
     // drawn in a way where this makes sense - i.e. opaque background, not rotated or scaled, etc.
     // Defaults to false;
diff --git a/Source/Platform/chromium/public/WebContentLayerClient.h b/Source/Platform/chromium/public/WebContentLayerClient.h
index 5469bd28c..8274d9e39 100644
--- a/Source/Platform/chromium/public/WebContentLayerClient.h
+++ b/Source/Platform/chromium/public/WebContentLayerClient.h
@@ -43,7 +43,8 @@ public:
     // optimizations.
 #define WEBCONTENTLAYERCLIENT_HAS_OPAQUE 1
 #define WEBCONTENTLAYERCLIENT_FLOAT_OPAQUE_RECT 1
-    virtual void paintContents(WebCanvas*, const WebRect& clip, WebFloatRect& opaque) = 0;
+#define WEBCONTENTLAYERCLIENT_HAS_CANPAINTLCDTEXT 1
+    virtual void paintContents(WebCanvas*, const WebRect& clip, bool canPaintLCDText, WebFloatRect& opaque) = 0;
 
 protected:
     virtual ~WebContentLayerClient() { }
diff --git a/Source/Platform/chromium/public/WebFloatPoint.h b/Source/Platform/chromium/public/WebFloatPoint.h
index 4afc16b9c..d49ab9b94 100644
--- a/Source/Platform/chromium/public/WebFloatPoint.h
+++ b/Source/Platform/chromium/public/WebFloatPoint.h
@@ -35,6 +35,8 @@
 
 #if WEBKIT_IMPLEMENTATION
 #include "FloatPoint.h"
+#else
+#include <ui/gfx/point_f.h>
 #endif
 
 namespace WebKit {
@@ -73,6 +75,25 @@ struct WebFloatPoint {
     {
         return WebCore::FloatPoint(x, y);
     }
+#else
+    WebFloatPoint(const gfx::PointF& p)
+        : x(p.x())
+        , y(p.y())
+    {
+    }
+
+    WebFloatPoint& operator=(const gfx::PointF& p)
+    {
+        x = p.x();
+        y = p.y();
+        return *this;
+    }
+
+    operator gfx::PointF() const
+    {
+        return gfx::PointF(x, y);
+    }
+
 #endif
 };
 
diff --git a/Source/WebCore/bindings/js/DOMTransaction.cpp b/Source/Platform/chromium/public/WebGestureCurve.h
index f43822aa6..f03296454 100644
--- a/Source/WebCore/bindings/js/DOMTransaction.cpp
+++ b/Source/Platform/chromium/public/WebGestureCurve.h
@@ -5,15 +5,15 @@
  * modification, are permitted provided that the following conditions
  * are met:
  * 1.  Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
+ *     notice, this list of conditions and the following disclaimer.
  * 2.  Redistributions in binary form must reproduce the above copyright
- * notice, this list of conditions and the following disclaimer in the
- * documentation and/or other materials provided with the distribution.
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
  *
- * THIS SOFTWARE IS PROVIDED BY GOOGLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
  * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
  * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
- * DISCLAIMED. IN NO EVENT SHALL GOOGLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
  * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
  * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
@@ -22,39 +22,25 @@
  * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#include "config.h"
+#ifndef WebGestureCurve_h
+#define WebGestureCurve_h
 
-#if ENABLE(UNDO_MANAGER)
+namespace WebKit {
 
-#include "DOMTransaction.h"
+class WebGestureCurveTarget;
 
-namespace WebCore {
-    
-DOMTransaction::DOMTransaction()
-    : m_undoManager(0)
-{
-}
+// Abstract interface for curves used by ActivePlatformGestureAnimation. A
+// WebGestureCurve defines the animation parameters as a function of time
+// (zero-based), and applies the parameters directly to the target of the
+// animation.
+class WebGestureCurve {
+public:
+    virtual ~WebGestureCurve() { }
 
-PassRefPtr<DOMTransaction> DOMTransaction::create()
-{
-    return adoptRef(new DOMTransaction());
-}
+    // Returns false if curve has finished and can no longer be applied.
+    virtual bool apply(double time, WebGestureCurveTarget*) = 0;
+};
 
-void DOMTransaction::apply()
-{
-    // FIXME: implement JSC bindings
-}
-
-void DOMTransaction::unapply()
-{
-    // FIXME: implement JSC bindings
-}
-
-void DOMTransaction::reapply()
-{
-    // FIXME: implement JSC bindings
-}
-
-}
+} // namespace WebKit
 
 #endif
diff --git a/Source/WebCore/editing/DOMTransaction.idl b/Source/Platform/chromium/public/WebGestureCurveTarget.h
index 0917b99f5..faeac1b6e 100644
--- a/Source/WebCore/editing/DOMTransaction.idl
+++ b/Source/Platform/chromium/public/WebGestureCurveTarget.h
@@ -5,15 +5,15 @@
  * modification, are permitted provided that the following conditions
  * are met:
  * 1.  Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
+ *     notice, this list of conditions and the following disclaimer.
  * 2.  Redistributions in binary form must reproduce the above copyright
- * notice, this list of conditions and the following disclaimer in the
- * documentation and/or other materials provided with the distribution.
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
  *
- * THIS SOFTWARE IS PROVIDED BY GOOGLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
  * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
  * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
- * DISCLAIMED. IN NO EVENT SHALL GOOGLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
  * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
  * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
@@ -22,9 +22,21 @@
  * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-[
-    Conditional=UNDO_MANAGER,
-    V8CustomIsReachable
-] interface DOMTransaction {
+#ifndef WebGestureCurveTarget_h
+#define WebGestureCurveTarget_h
+
+namespace WebKit {
+
+class WebPoint;
+
+class WebGestureCurveTarget {
+public:
+    virtual void scrollBy(const WebPoint&) = 0;
+
+protected:
+    virtual ~WebGestureCurveTarget() { }
 };
 
+} // namespace WebKit
+
+#endif
diff --git a/Source/Platform/chromium/public/WebGraphicsContext3D.h b/Source/Platform/chromium/public/WebGraphicsContext3D.h
index 8f85851a0..1707f87c0 100644
--- a/Source/Platform/chromium/public/WebGraphicsContext3D.h
+++ b/Source/Platform/chromium/public/WebGraphicsContext3D.h
@@ -33,6 +33,7 @@
 
 #include "WebCommon.h"
 #include "WebGraphicsMemoryAllocation.h"
+#include "WebGraphicsMemoryStats.h"
 #include "WebNonCopyable.h"
 #include "WebString.h"
 
@@ -162,6 +163,7 @@ public:
 
     // GL_CHROMIUM_gpu_memory_manager - sets callback to observe changes to memory allocation limits.
     virtual void setMemoryAllocationChangedCallbackCHROMIUM(WebGraphicsMemoryAllocationChangedCallbackCHROMIUM* callback) { }
+    virtual void sendManagedMemoryStatsCHROMIUM(const WebGraphicsManagedMemoryStats* stats) { }
 
     // GL_EXT_discard_framebuffer - discard/ensure existance of surface backbuffer.
     // FIXME: make these pure virtual once they are implemented by clients.
@@ -451,6 +453,10 @@ public:
     virtual WGC3Dboolean isVertexArrayOES(WebGLId array) { return false; }
     virtual void bindVertexArrayOES(WebGLId array) { }
 
+    // GL_CHROMIUM_texture_from_image
+    virtual void bindTexImage2DCHROMIUM(WGC3Denum target, WGC3Dint imageId) { }
+    virtual void releaseTexImage2DCHROMIUM(WGC3Denum target, WGC3Dint imageId) { }
+
     GrGLInterface* createGrGLInterface();
 
 protected:
diff --git a/Source/Platform/chromium/public/WebGraphicsMemoryAllocation.h b/Source/Platform/chromium/public/WebGraphicsMemoryAllocation.h
index 33583dfe5..0f4495802 100644
--- a/Source/Platform/chromium/public/WebGraphicsMemoryAllocation.h
+++ b/Source/Platform/chromium/public/WebGraphicsMemoryAllocation.h
@@ -31,18 +31,55 @@
 namespace WebKit {
 
 struct WebGraphicsMemoryAllocation {
+    // Deprecated data, to be removed from this structure.
     unsigned gpuResourceSizeInBytes;
     bool suggestHaveBackbuffer;
 
+    enum PriorityCutoff {
+        // Allow no allocations.
+        PriorityCutoffAllowNothing,
+        // Allow only allocations that are visible.
+        PriorityCutoffAllowVisibleOnly,
+        // Allow only allocations that are few screens away from being visible.
+        PriorityCutoffAllowVisibleAndNearby,
+        // Allow all allocations.
+        PriorityCutoffAllowEverything,
+    };
+
+    // Limits when this renderer is visible.
+    size_t bytesLimitWhenVisible;
+    PriorityCutoff priorityCutoffWhenVisible;
+
+    // Limits when this renderer is not visible.
+    size_t bytesLimitWhenNotVisible;
+    PriorityCutoff priorityCutoffWhenNotVisible;
+    bool haveBackbufferWhenNotVisible;
+
+    // If true, enforce this policy just once, but do not keep
+    // it as a permanent policy.
+    bool enforceButDoNotKeepAsPolicy;
+
     WebGraphicsMemoryAllocation()
         : gpuResourceSizeInBytes(0)
         , suggestHaveBackbuffer(false)
+        , bytesLimitWhenVisible(0)
+        , priorityCutoffWhenVisible(PriorityCutoffAllowNothing)
+        , bytesLimitWhenNotVisible(0)
+        , priorityCutoffWhenNotVisible(PriorityCutoffAllowNothing)
+        , haveBackbufferWhenNotVisible(false)
+        , enforceButDoNotKeepAsPolicy(false)
     {
     }
 
     WebGraphicsMemoryAllocation(unsigned gpuResourceSizeInBytes, bool suggestHaveBackbuffer)
         : gpuResourceSizeInBytes(gpuResourceSizeInBytes)
         , suggestHaveBackbuffer(suggestHaveBackbuffer)
+        , bytesLimitWhenVisible(0)
+        , priorityCutoffWhenVisible(PriorityCutoffAllowNothing)
+        , bytesLimitWhenNotVisible(0)
+        , priorityCutoffWhenNotVisible(PriorityCutoffAllowNothing)
+        , haveBackbufferWhenNotVisible(false)
+        , enforceButDoNotKeepAsPolicy(false)
     {
     }
 };
diff --git a/Source/Platform/chromium/public/WebGraphicsMemoryStats.h b/Source/Platform/chromium/public/WebGraphicsMemoryStats.h
new file mode 100644
index 000000000..c932f39f5
--- /dev/null
+++ b/Source/Platform/chromium/public/WebGraphicsMemoryStats.h
@@ -0,0 +1,60 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebGraphicsMemoryStats_h
+#define WebGraphicsMemoryStats_h
+
+#include "WebCommon.h"
+
+namespace WebKit {
+
+struct WebGraphicsManagedMemoryStats {
+    // Bytes required for all visible textures.
+    size_t bytesVisible;
+
+    // Bytes required for all textures visible or a few screens away from
+    // being visible.
+    size_t bytesVisibleAndNearby;
+
+    // The number of bytes currently allocated.
+    size_t bytesAllocated;
+
+    // Whether or not a backbuffer is currently requested (the memory usage
+    // of the buffer is known by the GPU process).
+    bool backbufferRequested;
+
+    WebGraphicsManagedMemoryStats() 
+        : bytesVisible(0)
+        , bytesVisibleAndNearby(0)
+        , bytesAllocated(0)
+        , backbufferRequested(0)
+    {
+    }
+};
+
+} // namespace WebKit
+
+#endif
+
diff --git a/Source/Platform/chromium/public/WebLayer.h b/Source/Platform/chromium/public/WebLayer.h
index 7ec516555..6a37d278c 100644
--- a/Source/Platform/chromium/public/WebLayer.h
+++ b/Source/Platform/chromium/public/WebLayer.h
@@ -36,6 +36,7 @@
 #include "WebVector.h"
 
 class SkMatrix44;
+class SkImageFilter;
 
 namespace WebKit {
 class WebAnimationDelegate;
@@ -125,6 +126,12 @@ public:
     // WebFilterOperations object.
     virtual void setFilters(const WebFilterOperations&) = 0;
 
+    // Set the root of the image filter graph for this layer. The 
+    // implementation should grab a ref on the passed-in filter in order
+    // to retain ownership. The passed-in graph will be unref'ed by the
+    // caller after this call.
+    virtual void setFilter(SkImageFilter*) = 0;
+
     // Apply filters to pixels that show through the background of this layer.
     // Note: These filters are only possible on layers that are drawn directly
     // to a root render surface with an opaque background. This means if an
diff --git a/Source/Platform/chromium/public/WebLayerTreeView.h b/Source/Platform/chromium/public/WebLayerTreeView.h
index 9c95ad2d3..345045ad4 100644
--- a/Source/Platform/chromium/public/WebLayerTreeView.h
+++ b/Source/Platform/chromium/public/WebLayerTreeView.h
@@ -26,13 +26,15 @@
 #ifndef WebLayerTreeView_h
 #define WebLayerTreeView_h
 
-#include "SkBitmap.h"
 #include "WebColor.h"
 #include "WebCommon.h"
+#include "WebFloatPoint.h"
 #include "WebNonCopyable.h"
 #include "WebPrivateOwnPtr.h"
 #include "WebSize.h"
 
+class SkBitmap;
+
 namespace WebKit {
 class WebGraphicsContext3D;
 class WebLayer;
@@ -95,6 +97,10 @@ public:
     // mode).
     virtual WebSize deviceViewportSize() const = 0;
 
+    // Gives the corrected location for an event, accounting for the pinch-zoom transformation
+    // in the compositor.
+    virtual WebFloatPoint adjustEventPointForPinchZoom(const WebFloatPoint&) const = 0;
+
     virtual void setDeviceScaleFactor(float) = 0;
     virtual float deviceScaleFactor() const = 0;
 
@@ -154,6 +160,9 @@ public:
     // This can have a significant performance impact and should be used with care.
     virtual void finishAllRendering() = 0;
 
+    // Prevents updates to layer tree from becoming visible.
+    virtual void setDeferCommits(bool deferCommits) { }
+
     // Debugging / dangerous ---------------------------------------------
 
     // Fills in a WebRenderingStats struct containing information about the state of the compositor.
@@ -162,7 +171,7 @@ public:
 
     // Provides a font atlas to use for debug visualizations. The atlas must be a bitmap containing glyph data, a table of
     // ASCII character values to a subrectangle of the atlas representing the corresponding glyph, and the glyph height.
-    virtual void setFontAtlas(SkBitmap, WebRect asciiToRectTable[128], int fontHeight) = 0;
+    virtual void setFontAtlas(WebRect asciiToRectTable[128], const SkBitmap&, int fontHeight) { }
 
     // Simulates a lost context. For testing only.
     virtual void loseCompositorContext(int numTimes) = 0;
diff --git a/Source/Platform/chromium/public/WebLayerTreeViewClient.h b/Source/Platform/chromium/public/WebLayerTreeViewClient.h
index 46b044a30..5b9929f0e 100644
--- a/Source/Platform/chromium/public/WebLayerTreeViewClient.h
+++ b/Source/Platform/chromium/public/WebLayerTreeViewClient.h
@@ -28,6 +28,7 @@
 
 namespace WebKit {
 class WebCompositorOutputSurface;
+class WebGraphicsContext3D;
 class WebInputHandler;
 class WebThread;
 struct WebSize;
diff --git a/Source/Platform/chromium/public/WebScreenInfo.h b/Source/Platform/chromium/public/WebScreenInfo.h
new file mode 100644
index 000000000..4ac199d09
--- /dev/null
+++ b/Source/Platform/chromium/public/WebScreenInfo.h
@@ -0,0 +1,82 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebScreenInfo_h
+#define WebScreenInfo_h
+
+#include "WebRect.h"
+
+namespace WebKit {
+
+struct WebScreenInfo {
+    // The horizontal screen dpi.
+    int horizontalDPI;
+
+    // The vertical screen dpi.
+    int verticalDPI;
+
+    // The screen depth in bits per pixel
+    int depth;
+
+    // The bits per colour component. This assumes that the colours are balanced
+    // equally.
+    int depthPerComponent;
+
+    // This can be true for black and white printers
+    bool isMonochrome;
+
+    // This is set from the rcMonitor member of MONITORINFOEX, to whit:
+    //   "A RECT structure that specifies the display monitor rectangle,
+    //   expressed in virtual-screen coordinates. Note that if the monitor
+    //   is not the primary display monitor, some of the rectangle's
+    //   coordinates may be negative values."
+    WebRect rect;
+
+    // This is set from the rcWork member of MONITORINFOEX, to whit:
+    //   "A RECT structure that specifies the work area rectangle of the
+    //   display monitor that can be used by applications, expressed in
+    //   virtual-screen coordinates. Windows uses this rectangle to
+    //   maximize an application on the monitor. The rest of the area in
+    //   rcMonitor contains system windows such as the task bar and side
+    //   bars. Note that if the monitor is not the primary display monitor,
+    //   some of the rectangle's coordinates may be negative values".
+    WebRect availableRect;
+
+    WebScreenInfo()
+        : horizontalDPI(0)
+        , verticalDPI(0)
+        , depth(0)
+        , depthPerComponent(0)
+        , isMonochrome(false) { }
+};
+
+} // namespace WebKit
+
+#endif
diff --git a/Source/Platform/chromium/public/WebSize.h b/Source/Platform/chromium/public/WebSize.h
index 94a53654d..97a2799c5 100644
--- a/Source/Platform/chromium/public/WebSize.h
+++ b/Source/Platform/chromium/public/WebSize.h
@@ -37,6 +37,7 @@
 #include "IntSize.h"
 #else
 #include <ui/gfx/size.h>
+#include <ui/gfx/vector2d.h>
 #endif
 
 namespace WebKit {
@@ -84,6 +85,12 @@ struct WebSize {
     {
     }
 
+    WebSize(const gfx::Vector2d& v)
+        : width(v.x())
+        , height(v.y())
+    {
+    }
+
     WebSize& operator=(const gfx::Size& s)
     {
         width = s.width();
@@ -91,10 +98,22 @@ struct WebSize {
         return *this;
     }
 
+    WebSize& operator=(const gfx::Vector2d& v)
+    {
+        width = v.x();
+        height = v.y();
+        return *this;
+    }
+
     operator gfx::Size() const
     {
         return gfx::Size(width, height);
     }
+
+    operator gfx::Vector2d() const
+    {
+        return gfx::Vector2d(width, height);
+    }
 #endif
 };
 
diff --git a/Source/Platform/chromium/public/WebVideoFrame.h b/Source/Platform/chromium/public/WebVideoFrame.h
index 74799bb71..908009591 100644
--- a/Source/Platform/chromium/public/WebVideoFrame.h
+++ b/Source/Platform/chromium/public/WebVideoFrame.h
@@ -31,6 +31,9 @@
 #ifndef WebVideoFrame_h
 #define WebVideoFrame_h
 
+#include "WebRect.h"
+#include "WebSize.h"
+
 namespace WebKit {
 
 // A proxy video frame interface to communicate frame data between chromium
@@ -69,6 +72,8 @@ public:
     virtual const void* data(unsigned plane) const { return 0; }
     virtual unsigned textureId() const { return 0; }
     virtual unsigned textureTarget() const { return 0; }
+    virtual WebKit::WebRect visibleRect() const { return WebKit::WebRect(); }
+    virtual WebKit::WebSize textureSize() const { return WebKit::WebSize(); }
 };
 
 } // namespace WebKit
diff --git a/Source/Platform/chromium/src/WebActiveGestureAnimation.cpp b/Source/Platform/chromium/src/WebActiveGestureAnimation.cpp
new file mode 100644
index 000000000..c7cad058a
--- /dev/null
+++ b/Source/Platform/chromium/src/WebActiveGestureAnimation.cpp
@@ -0,0 +1,67 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WebActiveGestureAnimation.h"
+
+#include <public/WebGestureCurve.h>
+#include <public/WebGestureCurveTarget.h>
+
+namespace WebKit {
+
+PassOwnPtr<WebActiveGestureAnimation> WebActiveGestureAnimation::createAtAnimationStart(PassOwnPtr<WebGestureCurve> curve, WebGestureCurveTarget* target)
+{
+    return adoptPtr(new WebActiveGestureAnimation(curve, target, 0, true));
+}
+
+PassOwnPtr<WebActiveGestureAnimation> WebActiveGestureAnimation::createWithTimeOffset(PassOwnPtr<WebGestureCurve> curve, WebGestureCurveTarget* target, double startTime)
+{
+    return adoptPtr(new WebActiveGestureAnimation(curve, target, startTime, false));
+}
+
+WebActiveGestureAnimation::~WebActiveGestureAnimation()
+{
+}
+
+WebActiveGestureAnimation::WebActiveGestureAnimation(PassOwnPtr<WebGestureCurve> curve, WebGestureCurveTarget* target, double startTime, bool waitingForFirstTick)
+    : m_startTime(startTime)
+    , m_waitingForFirstTick(waitingForFirstTick)
+    , m_curve(curve)
+    , m_target(target)
+{
+}
+
+bool WebActiveGestureAnimation::animate(double time)
+{
+    if (m_waitingForFirstTick) {
+        m_startTime = time;
+        m_waitingForFirstTick = false;
+    }
+    // All WebGestureCurves assume zero-based time, so we subtract
+    // the animation start time before passing to the curve.
+    return m_curve->apply(time - m_startTime, m_target);
+}
+
+} // namespace WebKit
diff --git a/Source/Platform/chromium/src/WebActiveGestureAnimation.h b/Source/Platform/chromium/src/WebActiveGestureAnimation.h
new file mode 100644
index 000000000..652e1bf75
--- /dev/null
+++ b/Source/Platform/chromium/src/WebActiveGestureAnimation.h
@@ -0,0 +1,63 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebActiveGestureAnimation_h
+#define WebActiveGestureAnimation_h
+
+#include <wtf/Noncopyable.h>
+#include <wtf/OwnPtr.h>
+#include <wtf/PassOwnPtr.h>
+
+namespace WebKit {
+
+class WebGestureCurve;
+class WebGestureCurveTarget;
+
+// Implements a gesture animation (fling scroll, etc.) using a curve with a generic interface
+// to define the animation parameters as a function of time, and applies the animation
+// to a target, again via a generic interface. It is assumed that animate() is called
+// on a more-or-less regular basis by the owner.
+class WebActiveGestureAnimation {
+    WTF_MAKE_NONCOPYABLE(WebActiveGestureAnimation);
+public:
+    static PassOwnPtr<WebActiveGestureAnimation> createAtAnimationStart(PassOwnPtr<WebGestureCurve>, WebGestureCurveTarget*);
+    static PassOwnPtr<WebActiveGestureAnimation> createWithTimeOffset(PassOwnPtr<WebGestureCurve>, WebGestureCurveTarget*, double startTime);
+    ~WebActiveGestureAnimation();
+
+    bool animate(double time);
+
+private:
+    // Assumes a valid WebGestureCurveTarget that outlives the animation.
+    WebActiveGestureAnimation(PassOwnPtr<WebGestureCurve>, WebGestureCurveTarget*, double startTime, bool waitingForFirstTick);
+
+    double m_startTime;
+    bool m_waitingForFirstTick;
+    OwnPtr<WebGestureCurve> m_curve;
+    WebGestureCurveTarget* m_target;
+};
+
+} // namespace WebKit
+
+#endif
diff --git a/Source/ThirdParty/ANGLE/ChangeLog b/Source/ThirdParty/ANGLE/ChangeLog
index bc892b5c1..4f964e8fd 100644
--- a/Source/ThirdParty/ANGLE/ChangeLog
+++ b/Source/ThirdParty/ANGLE/ChangeLog
@@ -1,3 +1,45 @@
+2012-10-29  Anders Carlsson  <andersca@apple.com>
+
+        Build WebKit as C++11 on Mac
+        https://bugs.webkit.org/show_bug.cgi?id=100720
+
+        Reviewed by Daniel Bates.
+
+        * Configurations/Base.xcconfig:
+        Add CLANG_CXX_LANGUAGE_STANDARD=gnu++0x.
+
+2012-10-28  Mark Rowe  <mrowe@apple.com>
+
+        Simplify Xcode configuration settings that used to vary between OS versions.
+
+        Reviewed by Dan Bernstein.
+
+        * Configurations/Base.xcconfig:
+        * Configurations/DebugRelease.xcconfig:
+
+2012-10-28  Mark Rowe  <mrowe@apple.com>
+
+        Remove references to unsupported OS and Xcode versions.
+
+        Reviewed by Anders Carlsson.
+
+        * Configurations/Base.xcconfig:
+        * Configurations/CompilerVersion.xcconfig: Removed.
+        * Configurations/DebugRelease.xcconfig:
+
+2012-10-27  Dan Bernstein  <mitz@apple.com>
+
+        REAL_PLATFORM_NAME build setting is no longer needed
+        https://bugs.webkit.org/show_bug.cgi?id=100587
+
+        Reviewed by Mark Rowe.
+
+        Removed the definition of REAL_PLATFORM_NAME and replaced references to it with references
+        to PLATFORM_NAME.
+
+        * Configurations/Base.xcconfig:
+        * Configurations/CompilerVersion.xcconfig:
+
 2012-10-18  Dean Jackson  <dino@apple.com>
 
         Shader translator needs option to clamp uniform array accesses in vertex shaders
diff --git a/Source/ThirdParty/ANGLE/Configurations/Base.xcconfig b/Source/ThirdParty/ANGLE/Configurations/Base.xcconfig
index f67724cc0..742c8fc4a 100644
--- a/Source/ThirdParty/ANGLE/Configurations/Base.xcconfig
+++ b/Source/ThirdParty/ANGLE/Configurations/Base.xcconfig
@@ -1,5 +1,5 @@
-#include "CompilerVersion.xcconfig"
-
+CLANG_CXX_LANGUAGE_STANDARD = gnu++0x;
+CLANG_CXX_LIBRARY = libc++;
 DEAD_CODE_STRIPPING = YES;
 DEBUG_INFORMATION_FORMAT = dwarf-with-dsym;
 GCC_C_LANGUAGE_STANDARD = gnu99;
@@ -18,28 +18,16 @@ GCC_INLINES_ARE_PRIVATE_EXTERN = YES;
 GCC_SYMBOLS_PRIVATE_EXTERN = NO;
 GCC_THREADSAFE_STATICS = NO;
 GCC_TREAT_WARNINGS_AS_ERRORS = YES;
+GCC_VERSION = com.apple.compilers.llvm.clang.1_0;
 GCC_WARN_ABOUT_DEPRECATED_FUNCTIONS = NO;
 GCC_WARN_ABOUT_MISSING_NEWLINE = YES;
 LINKER_DISPLAYS_MANGLED_NAMES = YES;
 PREBINDING = NO;
 STRIP_INSTALLED_PRODUCT = NO;
 
-CLANG_CXX_LIBRARY = $(CLANG_CXX_LIBRARY_$(TARGET_MAC_OS_X_VERSION_MAJOR));
-CLANG_CXX_LIBRARY_1060 = libstdc++;
-CLANG_CXX_LIBRARY_1070 = libc++;
-CLANG_CXX_LIBRARY_1080 = libc++;
-CLANG_CXX_LIBRARY_1090 = libc++;
-
-REAL_PLATFORM_NAME = $(REAL_PLATFORM_NAME_$(PLATFORM_NAME));
-REAL_PLATFORM_NAME_ = $(REAL_PLATFORM_NAME_macosx);
-REAL_PLATFORM_NAME_iphoneos = iphoneos;
-REAL_PLATFORM_NAME_iphonesimulator = iphonesimulator;
-REAL_PLATFORM_NAME_macosx = macosx;
-
 TARGET_MAC_OS_X_VERSION_MAJOR = $(MAC_OS_X_VERSION_MAJOR);
 
 TARGETING_SAME_OS_X_VERSION = $(TARGETING_SAME_OS_X_VERSION_$(MAC_OS_X_VERSION_MAJOR)_$(TARGET_MAC_OS_X_VERSION_MAJOR));
-TARGETING_SAME_OS_X_VERSION_1060_1060 = YES;
 TARGETING_SAME_OS_X_VERSION_1070_1070 = YES;
 TARGETING_SAME_OS_X_VERSION_1080_1080 = YES;
 TARGETING_SAME_OS_X_VERSION_1090_1090 = YES;
diff --git a/Source/ThirdParty/ANGLE/Configurations/CompilerVersion.xcconfig b/Source/ThirdParty/ANGLE/Configurations/CompilerVersion.xcconfig
deleted file mode 100644
index a8c7f75a0..000000000
--- a/Source/ThirdParty/ANGLE/Configurations/CompilerVersion.xcconfig
+++ /dev/null
@@ -1,84 +0,0 @@
-// Copyright (C) 2009, 2010, 2011 Apple Inc. All rights reserved.
-//
-// Redistribution and use in source and binary forms, with or without
-// modification, are permitted provided that the following conditions
-// are met:
-// 1. Redistributions of source code must retain the above copyright
-//    notice, this list of conditions and the following disclaimer.
-// 2. Redistributions in binary form must reproduce the above copyright
-//    notice, this list of conditions and the following disclaimer in the
-//    documentation and/or other materials provided with the distribution.
-//
-// THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
-// EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
-// IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
-// PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
-// CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
-// EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
-// PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
-// PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
-// OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
-
-IS_XCODE_0400 = $(IS_XCODE_0400_$(XCODE_VERSION_MINOR));
-IS_XCODE_0400_0400 = YES;
-
-IS_XCODE_0400_OR_0410 = $(IS_XCODE_0400_OR_0410_$(XCODE_VERSION_MINOR));
-IS_XCODE_0400_OR_0410_0400 = YES;
-IS_XCODE_0400_OR_0410_0410 = YES;
-
-// The version of the LLVM Compiler in Xcode 4.0 and earlier have difficulty compiling our code.
-LLVM_COMPILER_UNSUITABLE_FOR_DEBUG_BUILDS = $(LLVM_COMPILER_UNSUITABLE_FOR_DEBUG_BUILDS_$(XCODE_VERSION_MAJOR));
-LLVM_COMPILER_UNSUITABLE_FOR_DEBUG_BUILDS_0300 = YES;
-LLVM_COMPILER_UNSUITABLE_FOR_DEBUG_BUILDS_0400 = $(LLVM_COMPILER_UNSUITABLE_FOR_DEBUG_BUILDS_IS_XCODE_0400_$(IS_XCODE_0400));
-LLVM_COMPILER_UNSUITABLE_FOR_DEBUG_BUILDS_IS_XCODE_0400_YES = YES;
-
-// The version of the LLVM Compiler in Xcode 4.1 and earlier do not generate fast enough code.
-LLVM_COMPILER_UNSUITABLE_FOR_OPTIMIZED_BUILDS = $(LLVM_COMPILER_UNSUITABLE_FOR_OPTIMIZED_BUILDS_$(XCODE_VERSION_MAJOR));
-LLVM_COMPILER_UNSUITABLE_FOR_OPTIMIZED_BUILDS_0300 = YES;
-LLVM_COMPILER_UNSUITABLE_FOR_OPTIMIZED_BUILDS_0400 = $(LLVM_COMPILER_UNSUITABLE_FOR_OPTIMIZED_BUILDS_IS_XCODE_0400_OR_0410_$(IS_XCODE_0400_OR_0410));
-LLVM_COMPILER_UNSUITABLE_FOR_OPTIMIZED_BUILDS_IS_XCODE_0400_OR_0410_YES = YES;
-
-LLVM_COMPILER_SUITABLE_FOR_DEBUG_BUILDS = $(LLVM_COMPILER_SUITABLE_FOR_DEBUG_BUILDS_$(LLVM_COMPILER_UNSUITABLE_FOR_DEBUG_BUILDS));
-LLVM_COMPILER_SUITABLE_FOR_DEBUG_BUILDS_ = YES;
-LLVM_COMPILER_SUITABLE_FOR_DEBUG_BUILDS_YES = NO;
-
-LLVM_COMPILER_SUITABLE_FOR_OPTIMIZED_BUILDS = $(LLVM_COMPILER_SUITABLE_FOR_OPTIMIZED_BUILDS_$(LLVM_COMPILER_UNSUITABLE_FOR_OPTIMIZED_BUILDS));
-LLVM_COMPILER_SUITABLE_FOR_OPTIMIZED_BUILDS_ = YES;
-LLVM_COMPILER_SUITABLE_FOR_OPTIMIZED_BUILDS_YES = NO;
-
-
-// Use GCC 4.2 with Xcode 3.1, which includes GCC 4.2 but defaults to GCC 4.0.
-// Note that Xcode versions as new as 3.1.2 use XCODE_VERSION_ACTUAL for the minor version
-// number.  Newer versions of Xcode use XCODE_VERSION_MINOR for the minor version, and
-// XCODE_VERSION_ACTUAL for the full version number.
-TARGET_GCC_VERSION = $(TARGET_GCC_VERSION_$(REAL_PLATFORM_NAME));
-TARGET_GCC_VERSION_iphoneos = LLVM_GCC_42;
-TARGET_GCC_VERSION_iphonesimulator = GCC_42;
-TARGET_GCC_VERSION_macosx = $(TARGET_GCC_VERSION_macosx_$(TARGET_MAC_OS_X_VERSION_MAJOR));
-
-TARGET_GCC_VERSION_macosx_1050 = $(TARGET_GCC_VERSION_macosx_1050_$(XCODE_VERSION_MINOR));
-TARGET_GCC_VERSION_macosx_1050_ = $(TARGET_GCC_VERSION_macosx_1050_$(XCODE_VERSION_ACTUAL));
-TARGET_GCC_VERSION_macosx_1050_0310 = GCC_42;
-TARGET_GCC_VERSION_macosx_1050_0320 = GCC_42;
-
-TARGET_GCC_VERSION_macosx_1060 = $(TARGET_GCC_VERSION_macosx_1060_AND_1070_$(CONFIGURATION));
-TARGET_GCC_VERSION_macosx_1070 = $(TARGET_GCC_VERSION_macosx_1060_AND_1070_$(CONFIGURATION));
-TARGET_GCC_VERSION_macosx_1060_AND_1070_Debug = $(TARGET_GCC_VERSION_macosx_USE_LLVM_COMPILER_$(LLVM_COMPILER_SUITABLE_FOR_DEBUG_BUILDS));
-TARGET_GCC_VERSION_macosx_1060_AND_1070_Release = $(TARGET_GCC_VERSION_macosx_USE_LLVM_COMPILER_$(LLVM_COMPILER_SUITABLE_FOR_OPTIMIZED_BUILDS));
-TARGET_GCC_VERSION_macosx_1060_AND_1070_Production = $(TARGET_GCC_VERSION_macosx_USE_LLVM_COMPILER_$(LLVM_COMPILER_SUITABLE_FOR_OPTIMIZED_BUILDS));
-TARGET_GCC_VERSION_macosx_1060_NON_LLVM_FALLBACK = GCC_42;
-TARGET_GCC_VERSION_macosx_1070_NON_LLVM_FALLBACK = LLVM_GCC_42;
-
-TARGET_GCC_VERSION_macosx_USE_LLVM_COMPILER_YES = LLVM_COMPILER;
-TARGET_GCC_VERSION_macosx_USE_LLVM_COMPILER_NO = $(TARGET_GCC_VERSION_macosx_$(TARGET_MAC_OS_X_VERSION_MAJOR)_NON_LLVM_FALLBACK);
-
-TARGET_GCC_VERSION_macosx_1080 = LLVM_COMPILER;
-TARGET_GCC_VERSION_macosx_1090 = LLVM_COMPILER;
-
-GCC_VERSION = $(GCC_VERSION_$(TARGET_GCC_VERSION));
-GCC_VERSION_GCC_40 = 4.0;
-GCC_VERSION_GCC_42 = 4.2;
-GCC_VERSION_LLVM_GCC_42 = com.apple.compilers.llvmgcc42;
-GCC_VERSION_LLVM_COMPILER = com.apple.compilers.llvm.clang.1_0;
diff --git a/Source/ThirdParty/ANGLE/Configurations/DebugRelease.xcconfig b/Source/ThirdParty/ANGLE/Configurations/DebugRelease.xcconfig
index be088b806..f1a0b246b 100644
--- a/Source/ThirdParty/ANGLE/Configurations/DebugRelease.xcconfig
+++ b/Source/ThirdParty/ANGLE/Configurations/DebugRelease.xcconfig
@@ -1,17 +1,10 @@
 #include "Base.xcconfig"
 
-ARCHS = $(ARCHS_$(TARGET_MAC_OS_X_VERSION_MAJOR));
-ARCHS_1050 = $(NATIVE_ARCH);
-ARCHS_1060 = $(ARCHS_STANDARD_32_64_BIT);
-ARCHS_1070 = $(ARCHS_STANDARD_32_64_BIT);
-ARCHS_1080 = $(ARCHS_STANDARD_32_64_BIT);
-ARCHS_1090 = $(ARCHS_STANDARD_32_64_BIT);
+ARCHS = $(ARCHS_STANDARD_32_64_BIT);
 
 ONLY_ACTIVE_ARCH = YES;
 
 MACOSX_DEPLOYMENT_TARGET = $(MACOSX_DEPLOYMENT_TARGET_$(TARGET_MAC_OS_X_VERSION_MAJOR));
-MACOSX_DEPLOYMENT_TARGET_1050 = 10.5;
-MACOSX_DEPLOYMENT_TARGET_1060 = 10.6;
 MACOSX_DEPLOYMENT_TARGET_1070 = 10.7;
 MACOSX_DEPLOYMENT_TARGET_1080 = 10.8;
 MACOSX_DEPLOYMENT_TARGET_1090 = 10.9;
diff --git a/Source/ThirdParty/ChangeLog b/Source/ThirdParty/ChangeLog
index 2a7973e0c..f9b08552c 100644
--- a/Source/ThirdParty/ChangeLog
+++ b/Source/ThirdParty/ChangeLog
@@ -1,3 +1,33 @@
+2012-10-28  Mark Rowe  <mrowe@apple.com>
+
+        Simplify Xcode configuration settings that used to vary between OS versions.
+
+        Reviewed by Dan Bernstein.
+
+        * gtest/xcode/Config/General.xcconfig:
+
+2012-10-28  Mark Rowe  <mrowe@apple.com>
+
+        Remove references to unsupported OS and Xcode versions.
+
+        Reviewed by Anders Carlsson.
+
+        * gtest/xcode/Config/CompilerVersion.xcconfig: Removed.
+        * gtest/xcode/Config/General.xcconfig:
+
+2012-10-27  Dan Bernstein  <mitz@apple.com>
+
+        REAL_PLATFORM_NAME build setting is no longer needed
+        https://bugs.webkit.org/show_bug.cgi?id=100587
+
+        Reviewed by Mark Rowe.
+
+        Removed the definition of REAL_PLATFORM_NAME and replaced references to it with references
+        to PLATFORM_NAME.
+
+        * gtest/xcode/Config/CompilerVersion.xcconfig:
+        * gtest/xcode/Config/General.xcconfig:
+
 2012-08-23  Mark Rowe  <mrowe@apple.com>
 
         Make gtest build with the latest version of clang.
diff --git a/Source/ThirdParty/gtest/xcode/Config/CompilerVersion.xcconfig b/Source/ThirdParty/gtest/xcode/Config/CompilerVersion.xcconfig
deleted file mode 100644
index a8c7f75a0..000000000
--- a/Source/ThirdParty/gtest/xcode/Config/CompilerVersion.xcconfig
+++ /dev/null
@@ -1,84 +0,0 @@
-// Copyright (C) 2009, 2010, 2011 Apple Inc. All rights reserved.
-//
-// Redistribution and use in source and binary forms, with or without
-// modification, are permitted provided that the following conditions
-// are met:
-// 1. Redistributions of source code must retain the above copyright
-//    notice, this list of conditions and the following disclaimer.
-// 2. Redistributions in binary form must reproduce the above copyright
-//    notice, this list of conditions and the following disclaimer in the
-//    documentation and/or other materials provided with the distribution.
-//
-// THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
-// EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
-// IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
-// PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
-// CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
-// EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
-// PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
-// PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
-// OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
-
-IS_XCODE_0400 = $(IS_XCODE_0400_$(XCODE_VERSION_MINOR));
-IS_XCODE_0400_0400 = YES;
-
-IS_XCODE_0400_OR_0410 = $(IS_XCODE_0400_OR_0410_$(XCODE_VERSION_MINOR));
-IS_XCODE_0400_OR_0410_0400 = YES;
-IS_XCODE_0400_OR_0410_0410 = YES;
-
-// The version of the LLVM Compiler in Xcode 4.0 and earlier have difficulty compiling our code.
-LLVM_COMPILER_UNSUITABLE_FOR_DEBUG_BUILDS = $(LLVM_COMPILER_UNSUITABLE_FOR_DEBUG_BUILDS_$(XCODE_VERSION_MAJOR));
-LLVM_COMPILER_UNSUITABLE_FOR_DEBUG_BUILDS_0300 = YES;
-LLVM_COMPILER_UNSUITABLE_FOR_DEBUG_BUILDS_0400 = $(LLVM_COMPILER_UNSUITABLE_FOR_DEBUG_BUILDS_IS_XCODE_0400_$(IS_XCODE_0400));
-LLVM_COMPILER_UNSUITABLE_FOR_DEBUG_BUILDS_IS_XCODE_0400_YES = YES;
-
-// The version of the LLVM Compiler in Xcode 4.1 and earlier do not generate fast enough code.
-LLVM_COMPILER_UNSUITABLE_FOR_OPTIMIZED_BUILDS = $(LLVM_COMPILER_UNSUITABLE_FOR_OPTIMIZED_BUILDS_$(XCODE_VERSION_MAJOR));
-LLVM_COMPILER_UNSUITABLE_FOR_OPTIMIZED_BUILDS_0300 = YES;
-LLVM_COMPILER_UNSUITABLE_FOR_OPTIMIZED_BUILDS_0400 = $(LLVM_COMPILER_UNSUITABLE_FOR_OPTIMIZED_BUILDS_IS_XCODE_0400_OR_0410_$(IS_XCODE_0400_OR_0410));
-LLVM_COMPILER_UNSUITABLE_FOR_OPTIMIZED_BUILDS_IS_XCODE_0400_OR_0410_YES = YES;
-
-LLVM_COMPILER_SUITABLE_FOR_DEBUG_BUILDS = $(LLVM_COMPILER_SUITABLE_FOR_DEBUG_BUILDS_$(LLVM_COMPILER_UNSUITABLE_FOR_DEBUG_BUILDS));
-LLVM_COMPILER_SUITABLE_FOR_DEBUG_BUILDS_ = YES;
-LLVM_COMPILER_SUITABLE_FOR_DEBUG_BUILDS_YES = NO;
-
-LLVM_COMPILER_SUITABLE_FOR_OPTIMIZED_BUILDS = $(LLVM_COMPILER_SUITABLE_FOR_OPTIMIZED_BUILDS_$(LLVM_COMPILER_UNSUITABLE_FOR_OPTIMIZED_BUILDS));
-LLVM_COMPILER_SUITABLE_FOR_OPTIMIZED_BUILDS_ = YES;
-LLVM_COMPILER_SUITABLE_FOR_OPTIMIZED_BUILDS_YES = NO;
-
-
-// Use GCC 4.2 with Xcode 3.1, which includes GCC 4.2 but defaults to GCC 4.0.
-// Note that Xcode versions as new as 3.1.2 use XCODE_VERSION_ACTUAL for the minor version
-// number.  Newer versions of Xcode use XCODE_VERSION_MINOR for the minor version, and
-// XCODE_VERSION_ACTUAL for the full version number.
-TARGET_GCC_VERSION = $(TARGET_GCC_VERSION_$(REAL_PLATFORM_NAME));
-TARGET_GCC_VERSION_iphoneos = LLVM_GCC_42;
-TARGET_GCC_VERSION_iphonesimulator = GCC_42;
-TARGET_GCC_VERSION_macosx = $(TARGET_GCC_VERSION_macosx_$(TARGET_MAC_OS_X_VERSION_MAJOR));
-
-TARGET_GCC_VERSION_macosx_1050 = $(TARGET_GCC_VERSION_macosx_1050_$(XCODE_VERSION_MINOR));
-TARGET_GCC_VERSION_macosx_1050_ = $(TARGET_GCC_VERSION_macosx_1050_$(XCODE_VERSION_ACTUAL));
-TARGET_GCC_VERSION_macosx_1050_0310 = GCC_42;
-TARGET_GCC_VERSION_macosx_1050_0320 = GCC_42;
-
-TARGET_GCC_VERSION_macosx_1060 = $(TARGET_GCC_VERSION_macosx_1060_AND_1070_$(CONFIGURATION));
-TARGET_GCC_VERSION_macosx_1070 = $(TARGET_GCC_VERSION_macosx_1060_AND_1070_$(CONFIGURATION));
-TARGET_GCC_VERSION_macosx_1060_AND_1070_Debug = $(TARGET_GCC_VERSION_macosx_USE_LLVM_COMPILER_$(LLVM_COMPILER_SUITABLE_FOR_DEBUG_BUILDS));
-TARGET_GCC_VERSION_macosx_1060_AND_1070_Release = $(TARGET_GCC_VERSION_macosx_USE_LLVM_COMPILER_$(LLVM_COMPILER_SUITABLE_FOR_OPTIMIZED_BUILDS));
-TARGET_GCC_VERSION_macosx_1060_AND_1070_Production = $(TARGET_GCC_VERSION_macosx_USE_LLVM_COMPILER_$(LLVM_COMPILER_SUITABLE_FOR_OPTIMIZED_BUILDS));
-TARGET_GCC_VERSION_macosx_1060_NON_LLVM_FALLBACK = GCC_42;
-TARGET_GCC_VERSION_macosx_1070_NON_LLVM_FALLBACK = LLVM_GCC_42;
-
-TARGET_GCC_VERSION_macosx_USE_LLVM_COMPILER_YES = LLVM_COMPILER;
-TARGET_GCC_VERSION_macosx_USE_LLVM_COMPILER_NO = $(TARGET_GCC_VERSION_macosx_$(TARGET_MAC_OS_X_VERSION_MAJOR)_NON_LLVM_FALLBACK);
-
-TARGET_GCC_VERSION_macosx_1080 = LLVM_COMPILER;
-TARGET_GCC_VERSION_macosx_1090 = LLVM_COMPILER;
-
-GCC_VERSION = $(GCC_VERSION_$(TARGET_GCC_VERSION));
-GCC_VERSION_GCC_40 = 4.0;
-GCC_VERSION_GCC_42 = 4.2;
-GCC_VERSION_LLVM_GCC_42 = com.apple.compilers.llvmgcc42;
-GCC_VERSION_LLVM_COMPILER = com.apple.compilers.llvm.clang.1_0;
diff --git a/Source/ThirdParty/gtest/xcode/Config/General.xcconfig b/Source/ThirdParty/gtest/xcode/Config/General.xcconfig
index 47332f628..3bf5ab33f 100644
--- a/Source/ThirdParty/gtest/xcode/Config/General.xcconfig
+++ b/Source/ThirdParty/gtest/xcode/Config/General.xcconfig
@@ -7,7 +7,7 @@
 //  http://code.google.com/p/google-toolbox-for-mac/
 // 
 
-#include "CompilerVersion.xcconfig"
+GCC_VERSION = com.apple.compilers.llvm.clang.1_0;
 
 // Not building PowerPC any more
 ARCHS = i386 x86_64
@@ -38,22 +38,11 @@ GCC_DYNAMIC_NO_PIC = YES
 
 GCC_PREPROCESSOR_DEFINITIONS = $(GCC_PREPROCESSOR_DEFINITIONS) GTEST_HAS_TR1_TUPLE=0 GTEST_HAS_RTTI=0;
 
-CLANG_CXX_LIBRARY = $(CLANG_CXX_LIBRARY_$(TARGET_MAC_OS_X_VERSION_MAJOR));
-CLANG_CXX_LIBRARY_1060 = libstdc++;
-CLANG_CXX_LIBRARY_1070 = libc++;
-CLANG_CXX_LIBRARY_1080 = libc++;
-CLANG_CXX_LIBRARY_1090 = libc++;
-
-REAL_PLATFORM_NAME = $(REAL_PLATFORM_NAME_$(PLATFORM_NAME));
-REAL_PLATFORM_NAME_ = $(REAL_PLATFORM_NAME_macosx);
-REAL_PLATFORM_NAME_iphoneos = iphoneos;
-REAL_PLATFORM_NAME_iphonesimulator = iphonesimulator;
-REAL_PLATFORM_NAME_macosx = macosx;
+CLANG_CXX_LIBRARY = libc++;
 
 TARGET_MAC_OS_X_VERSION_MAJOR = $(MAC_OS_X_VERSION_MAJOR);
 
 TARGETING_SAME_OS_X_VERSION = $(TARGETING_SAME_OS_X_VERSION_$(MAC_OS_X_VERSION_MAJOR)_$(TARGET_MAC_OS_X_VERSION_MAJOR));
-TARGETING_SAME_OS_X_VERSION_1060_1060 = YES;
 TARGETING_SAME_OS_X_VERSION_1070_1070 = YES;
 TARGETING_SAME_OS_X_VERSION_1080_1080 = YES;
 TARGETING_SAME_OS_X_VERSION_1090_1090 = YES;
diff --git a/Source/WTF/ChangeLog b/Source/WTF/ChangeLog
index f170a5d1b..37a5abdcf 100644
--- a/Source/WTF/ChangeLog
+++ b/Source/WTF/ChangeLog
@@ -1,3 +1,498 @@
+2012-11-07  Christophe Dumez  <christophe.dumez@intel.com>
+
+        Add replaceWithLiteral() method to WTF::String
+        https://bugs.webkit.org/show_bug.cgi?id=101257
+
+        Reviewed by Benjamin Poulain.
+
+        Add replaceWithLiteral() method to WTF::String that takes
+        replacement string as a literal to avoid uselessly constructing
+        a String object.
+
+        * wtf/text/StringImpl.cpp:
+        (WTF::StringImpl::replace):
+        (WTF):
+        * wtf/text/StringImpl.h:
+        (WTF::StringImpl::replace):
+        (StringImpl):
+        * wtf/text/WTFString.h:
+        (String):
+        (WTF::String::replaceWithLiteral):
+
+2012-11-06  Michael Saboff  <msaboff@apple.com>
+
+        StringBuilder::append(UChar) with an 8 bit quantity shouldn't change the contents to 16 bits
+        https://bugs.webkit.org/show_bug.cgi?id=101421
+
+        Reviewed by Anders Carlsson.
+
+        If the string builder contains only 8 bit data, check if the character being appended contains
+        8 bit data.  If so, append it to the 8 bit buffer instead of converting the buffer to 16 bits.
+
+        * wtf/text/StringBuilder.cpp:
+        (WTF::StringBuilder::append):
+        * wtf/text/StringBuilder.h:
+        (WTF::StringBuilder::append):
+
+2012-11-06  Benjamin Poulain  <benjamin@webkit.org>
+
+        Speed up TransformationMatrix::multiply() on modern ARM
+        https://bugs.webkit.org/show_bug.cgi?id=101084
+
+        Reviewed by Gavin Barraclough.
+
+        * wtf/Platform.h:
+        Add CPU(ARM_VFP) for detecting VFP availability.
+        Add CPU(APPLE_ARMV7S) for the Apple ARMv7S architecture.
+
+2012-11-06  Laszlo Gombos  <l.gombos@samsung.com>
+
+        Refactor setting TEXTURE_MAPPER_GL
+        https://bugs.webkit.org/show_bug.cgi?id=99758
+
+        Reviewed by Noam Rosenthal.
+
+        Make the rule that sets the default for USE(3D_GRAPHICS) port independent.
+
+        If not set, set USE(TEXTURE_MAPPER_GL) when USE(TEXTURE_MAPPER) and 
+        USE(3D_GRAPHICS) is enabled.
+
+        * wtf/Platform.h:
+
+2012-11-05  Philip Rogers  <pdr@google.com>
+
+        Unblock SVG external references
+        https://bugs.webkit.org/show_bug.cgi?id=100635
+
+        Reviewed by Adam Barth.
+
+        This patch reverts r132849 and r132869 because the potential XSS issue
+        turned out to not be an issue after all.
+
+        Covered by existing tests, many of which are re-whitelisted with this patch.
+
+        * wtf/Platform.h:
+
+2012-11-05  Dima Gorbik  <dgorbik@apple.com>
+
+        Back out controversial changes from Bug 98665.
+        https://bugs.webkit.org/show_bug.cgi?id=101244
+
+        Reviewed by David Kilzer.
+
+        Backing out changes from Bug 98665 until further discussions take place on rules for including Platform.h in Assertions.h.
+
+        * wtf/Assertions.h:
+
+2012-11-03  Alexey Proskuryakov  <ap@apple.com>
+
+        Get rid of USE(CFURLSTORAGESESSIONS)
+        https://bugs.webkit.org/show_bug.cgi?id=101131
+
+        Reviewed by Sam Weinig.
+
+        * wtf/Platform.h:
+
+2012-11-02  Ilya Tikhonovsky  <loislo@chromium.org>
+
+        Web Inspector: NMI instrument NodeRareData::Map. It uses ~250k on nytimes.com
+        https://bugs.webkit.org/show_bug.cgi?id=101052
+
+        Reviewed by Yury Semikhatsky.
+
+        I noticed that in many cases cache structures are plain static HashMap, HashSet etc.
+        MemoryAgent can visit it but instrumentation for these containers report no objectType.
+        It means that addRootObject method needs to accept objectType property as an argument.
+        Otherwise I would have had to create a proxy class with proper objectType.
+
+        * wtf/MemoryInstrumentation.h:
+        (WTF::MemoryInstrumentation::addRootObject):
+
+2012-11-01  Kent Tamura  <tkent@chromium.org>
+
+        Introduce ENABLE_DATE_AND_TIME_INPUT_TYPES, and clarify usage of other related flags
+        https://bugs.webkit.org/show_bug.cgi?id=101007
+
+        Reviewed by Kentaro Hara.
+
+        * wtf/Platform.h:
+        Add ENABLE_DATE_AND_TIME_INPUT_TYPES.  It's a union of
+        ENABLE_INPUT_TYPE_{DATE,DATETIME,DATETIMELOCAL,MONTH,TIME,WEEK}.
+
+2012-11-01  Yury Semikhatsky  <yurys@chromium.org>
+
+        Memory instrumentation: do not call checkCountedObject with wrong pointers
+        https://bugs.webkit.org/show_bug.cgi?id=100958
+
+        Reviewed by Alexander Pavlov.
+
+        Removed calls to checkCountedObject from places where the pointer may contain
+        an address of a base class which may differ from the actual object pointer. Instead
+        checkCountedObject is only called right after processing deferred pointer where
+        we know real address.
+
+        * wtf/MemoryInstrumentation.h:
+        (WTF::MemoryInstrumentation::addObjectImpl):
+        (WTF::::process):
+
+2012-11-01  Alexey Proskuryakov  <ap@apple.com>
+
+        Rename HAVE(NETWORK_CFDATA_ARRAY_CALLBACK) to USE(NETWORK_CFDATA_ARRAY_CALLBACK)
+
+        Rubber-stamped by Joe Pecoraro.
+
+        All CFNetwork based platforms have this now, but not all use it at the moment.
+
+2012-11-01  Alexey Proskuryakov  <ap@apple.com>
+
+        Fix HAVE(NETWORK_CFDATA_ARRAY_CALLBACK) build
+        https://bugs.webkit.org/show_bug.cgi?id=100979
+
+        Reviewed by Joseph Pecoraro.
+
+        * wtf/Platform.h: Added a FIXME about HAVE(NETWORK_CFDATA_ARRAY_CALLBACK).
+
+2012-11-01  Yury Semikhatsky  <yurys@chromium.org>
+
+        Memory instrumentation: report memory occupied by ResourceRequest instead of its base ResourceRequestBase
+        https://bugs.webkit.org/show_bug.cgi?id=100497
+
+        Reviewed by Alexander Pavlov.
+
+        * wtf/MemoryInstrumentation.h:
+        (WTF::MemoryClassInfo::addPrivateBuffer): do not report memory usage for empty buffer.
+
+2012-10-31  Anders Carlsson  <andersca@apple.com>
+
+        Fix build.
+        <rdar://problem/12612207>.
+
+        Reviewed by Sam Weinig.
+
+        * wtf/CheckedArithmetic.h:
+
+2012-10-31  Benjamin Poulain  <bpoulain@apple.com>
+
+        Add an optimized version of copyLCharsFromUCharSource for ARM
+        https://bugs.webkit.org/show_bug.cgi?id=94886
+
+        Reviewed by Gavin Barraclough.
+
+        Michael Saboff added a SIMD version of copyLCharsFromUCharSource() in r125846.
+
+        This patch a similar optimization for ARMv7 by using the interleaved load/store available
+        in the NEON extension.
+
+        The performance gains:
+        -10000 characters: ~3.5 times faster.
+        -20 characters (2 vectors): ~55% faster.
+        -15 characters (1 vector): ~21% faster.
+        -3 characters (no vector, pure overhead): ~10% slower.
+
+        * wtf/text/ASCIIFastPath.h:
+        (WTF::copyLCharsFromUCharSource):
+
+2012-10-31  Christophe Dumez  <christophe.dumez@intel.com>
+
+        [EFL][WK2][AC] Use smart pointers for Evas_GL types
+        https://bugs.webkit.org/show_bug.cgi?id=100745
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Make OwnPtr usable with Evas_GL type to avoid handling
+        raw pointers in EFL port.
+
+        * wtf/OwnPtrCommon.h:
+        (WTF):
+        * wtf/efl/OwnPtrEfl.cpp:
+        (WTF):
+        (WTF::deleteOwnedPtr):
+
+2012-10-29  Anders Carlsson  <andersca@apple.com>
+
+        Build WebKit as C++11 on Mac
+        https://bugs.webkit.org/show_bug.cgi?id=100720
+
+        Reviewed by Daniel Bates.
+
+        * Configurations/Base.xcconfig:
+        Add CLANG_CXX_LANGUAGE_STANDARD=gnu++0x.
+
+        * wtf/text/AtomicString.cpp:
+        (WTF::AtomicString::add):
+        Change the type of length to be unsigned to prevent implicit type conversions in non-constant initializer lists.
+
+        * wtf/unicode/UTF8.cpp:
+        (Unicode):
+        Add static_casts to prevent implicit type conversions in non-constant initializer lists.
+
+2012-10-29  Anders Carlsson  <andersca@apple.com>
+
+        String::createCFString should return a RetainPtr
+        https://bugs.webkit.org/show_bug.cgi?id=100419
+
+        Reviewed by Andreas Kling.
+
+        Make String::createCFString and StringImpl::createCFString return RetainPtrs.
+
+        * wtf/text/AtomicString.h:
+        * wtf/text/StringImpl.h:
+        * wtf/text/WTFString.h:
+
+2012-10-30  Mark Rowe  <mrowe@apple.com>
+
+        Fix WTF to not install a few header files in bogus locations.
+
+        * WTF.xcodeproj/project.pbxproj:
+
+2012-10-28  Mark Rowe  <mrowe@apple.com>
+
+        Simplify Xcode configuration settings that used to vary between OS versions.
+
+        Reviewed by Dan Bernstein.
+
+        * Configurations/Base.xcconfig:
+        * Configurations/DebugRelease.xcconfig:
+
+2012-10-28  Mark Rowe  <mrowe@apple.com>
+
+        Remove references to unsupported OS and Xcode versions.
+
+        Reviewed by Anders Carlsson.
+
+        * Configurations/Base.xcconfig:
+        * Configurations/CompilerVersion.xcconfig: Removed.
+        * Configurations/DebugRelease.xcconfig:
+        * WTF.xcodeproj/project.pbxproj:
+
+2012-10-29  Anders Carlsson  <andersca@apple.com>
+
+        AtomicString(CFStringRef) shouldn't unconditionally create a StringImpl
+        https://bugs.webkit.org/show_bug.cgi?id=100701
+
+        Reviewed by Dan Bernstein.
+
+        * wtf/text/AtomicString.h:
+        (WTF::AtomicString::AtomicString):
+        Change the constructors that take a CFStringRef and an NSString * to call AtomicString::add(CFStringRef)
+        and remove AtomicString::createCFString.
+
+        (WTF::AtomicString::add):
+        Add new member function declaration. The definition is in a new file in WebCore, AtomicStringCF.cpp.
+        Also, fix the overload of add that takes a const char* to call the right other overload instead of itself.
+
+2012-10-29  Adam Barth  <abarth@webkit.org>
+
+        Unreviewed. Correct my previous patch to disable external SVG
+        references only on PLATFORM(CHROMIUM).
+
+        * wtf/Platform.h:
+
+2012-10-29  Adam Barth  <abarth@webkit.org>
+
+        Block SVG external references pending a security review
+        https://bugs.webkit.org/show_bug.cgi?id=100635
+
+        Reviewed by Eric Seidel.
+
+        We need to do a security review of loading external SVG references
+        before we're sure that it is safe.
+
+        * wtf/Platform.h:
+
+2012-10-29  Michael Saboff  <msaboff@apple.com>
+
+        String::split(UChar, Vector<String>&) shouldn't create a temporary String
+        https://bugs.webkit.org/show_bug.cgi?id=100578
+
+        Reviewed by Anders Carlsson.
+
+        Changed split(UChar, Vector<String>&) to call split(UChar, bool, Vector<String>&) instead of creating a
+        string and calling the split(String,...) version and moved it to WTFString.h.  Also moved
+        split(const String& separator, Vector<String>& result) to WTFString.h.
+
+        * wtf/text/WTFString.cpp:
+        (WTF::String::split):
+        * wtf/text/WTFString.h:
+        (WTF::String::split):
+
+2012-10-29  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r132736.
+        http://trac.webkit.org/changeset/132736
+        https://bugs.webkit.org/show_bug.cgi?id=100652
+
+        It broke all plugin related tests on GTK and on Qt (Requested
+        by Ossy on #webkit).
+
+        * wtf/text/WTFString.cpp:
+        (WTF::String::fromUTF8):
+
+2012-10-27  Michael Saboff  <msaboff@apple.com>
+
+        Try to create AtomicString as 8 bit where possible
+        https://bugs.webkit.org/show_bug.cgi?id=100575
+
+        Reviewed by Oliver Hunt.
+
+        Added StringImpl::create8BitIfPossible() that first tries to create an 8 bit string.  If it finds a 16 bit character
+        during processing, it calls the standard create() method.  The assumption is that this will be used on mostly 8 bit
+        strings and ones that are shorter (in the tens of characters).  Changed AtomicString to use the new creation method
+        for UChar based construction.
+
+        * wtf/text/AtomicString.cpp:
+        (WTF::UCharBufferTranslator::translate):
+        * wtf/text/StringImpl.cpp:
+        (WTF::StringImpl::create8BitIfPossible):
+        * wtf/text/StringImpl.h:
+        (WTF::StringImpl::create8BitIfPossible):
+
+2012-10-27  Michael Saboff  <msaboff@apple.com>
+
+        String::fromUTF8() should take advantage of the ASCII check in convertUTF8ToUTF16()
+        https://bugs.webkit.org/show_bug.cgi?id=100577
+
+        Reviewed by Oliver Hunt.
+
+        Passed is ASCII flag to convertUTF8ToUTF16() and if try, create an 8 bit string from the original arguments.
+
+        * wtf/text/WTFString.cpp:
+        (WTF::String::fromUTF8):
+
+2012-10-27  Dan Bernstein  <mitz@apple.com>
+
+        REAL_PLATFORM_NAME build setting is no longer needed
+        https://bugs.webkit.org/show_bug.cgi?id=100587
+
+        Reviewed by Mark Rowe.
+
+        Removed the definition of REAL_PLATFORM_NAME and replaced references to it with references
+        to PLATFORM_NAME.
+
+        * Configurations/Base.xcconfig:
+        * Configurations/CompilerVersion.xcconfig:
+        * Configurations/DebugRelease.xcconfig:
+
+2012-10-26  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r132689.
+        http://trac.webkit.org/changeset/132689
+        https://bugs.webkit.org/show_bug.cgi?id=100574
+
+        Broke HashMaps containing RetainPtrs (Requested by andersca on
+        #webkit).
+
+        * wtf/RetainPtr.h:
+
+2012-10-26  Anders Carlsson  <andersca@apple.com>
+
+        Add an operator& to RetainPtr
+        https://bugs.webkit.org/show_bug.cgi?id=100549
+
+        Reviewed by Dan Bernstein.
+
+        This is useful for APIs that return references using out parameters.
+
+        * wtf/RetainPtr.h:
+        (WTF::RetainPtr::operator&):
+
+2012-10-26  Gabor Ballabas  <gaborb@inf.u-szeged.hu>
+
+        [Qt] Enable JSC's disassembler on x86, x86_64 Linux
+        https://bugs.webkit.org/show_bug.cgi?id=100386
+
+        Reviewed by Simon Hausmann.
+
+        It works fine on Linux x86, x86_64 just needs to be enabled in the
+        QtWebKit build system.
+
+        * wtf/Platform.h:
+
+2012-10-25  Michael Saboff  <msaboff@apple.com>
+
+        REGRESSION (r131836): failures in list styles tests on EFL, GTK
+        https://bugs.webkit.org/show_bug.cgi?id=99824
+
+        Reviewed by Oliver Hunt.
+
+        Fixed ASCII check.
+        Added placeholder argument for new argument added to convertUTF8ToUTF16() in http://trac.webkit.org/changeset/131836.
+
+        * wtf/unicode/UTF8.cpp:
+        (WTF::Unicode::convertUTF8ToUTF16):
+        * wtf/unicode/glib/UnicodeGLib.cpp:
+        (WTF::Unicode::convertCase):
+
+2012-10-25  Christophe Dumez  <christophe.dumez@intel.com>
+
+        [EFL][WK2] Remove some C'ism from EwkView
+        https://bugs.webkit.org/show_bug.cgi?id=100370
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Make OwnPtr useable for Ecore_IMF_Context to avoid
+        using raw pointers in EFL port.
+
+        * wtf/OwnPtrCommon.h:
+        (WTF):
+        * wtf/PlatformEfl.cmake:
+        * wtf/efl/OwnPtrEfl.cpp:
+        (WTF::deleteOwnedPtr):
+        (WTF):
+
+2012-09-27  Yury Semikhatsky  <yurys@chromium.org>
+
+        Web Inspector: provide memory instrumentation for ListHashSet
+        https://bugs.webkit.org/show_bug.cgi?id=97786
+
+        Reviewed by Vsevolod Vlasov.
+
+        Added memory instrumentation for ListHashSet.
+
+        * GNUmakefile.list.am:
+        * WTF.gypi:
+        * WTF.pro:
+        * WTF.vcproj/WTF.vcproj:
+        * WTF.xcodeproj/project.pbxproj:
+        * wtf/HashSet.h:
+        (WTF):
+        * wtf/ListHashSet.h:
+        (ListHashSet):
+        (ListHashSetNodeAllocator): changed visibility of inPool method to public
+        (WTF::ListHashSetNodeAllocator::pool):
+        (WTF::ListHashSetNodeAllocator::pastPool):
+        (WTF::::sizeInBytes): added a method that returns size of the set in bytes including
+        all its internals but not the content elements.
+        (WTF):
+        * wtf/MemoryInstrumentation.h: removed onsolete method. All clients were updated to
+        use generic addMember instead.
+        (MemoryInstrumentation):
+        (WTF::MemoryClassInfo::addPrivateBuffer):
+        * wtf/MemoryInstrumentationHashSet.h:
+        * wtf/MemoryInstrumentationListHashSet.h: Copied from Source/WTF/wtf/MemoryInstrumentationHashSet.h.
+        (WTF):
+        (WTF::reportMemoryUsage):
+
+2012-10-23  Benjamin Poulain  <benjamin@webkit.org>
+
+        WTFURL: Implement KURL::setPort()
+        https://bugs.webkit.org/show_bug.cgi?id=99898
+
+        Reviewed by Adam Barth.
+
+        Add an efficient implementation for remplacing the port component
+        in an URL. This will be the base for replacing other components
+        efficiently.
+
+        The testing is covered by fast/dom/HTMLAnchorElement/set-href-attribute-port.html
+
+        * wtf/url/api/ParsedURL.cpp:
+        (WTF::generateNewSpecWithPort):
+        (WTF::replacePortWithString):
+        (WTF::ParsedURL::replacePort):
+        * wtf/url/api/ParsedURL.h:
+        (ParsedURL):
+
 2012-10-22  Michael Saboff  <msaboff@apple.com>
 
         Regression(r131655): Crash in StringImpl::findIgnoringCase
diff --git a/Source/WTF/Configurations/Base.xcconfig b/Source/WTF/Configurations/Base.xcconfig
index 0d7b7da49..5f00c838a 100644
--- a/Source/WTF/Configurations/Base.xcconfig
+++ b/Source/WTF/Configurations/Base.xcconfig
@@ -21,11 +21,8 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 
-#include "CompilerVersion.xcconfig"
-
-COMPILER_SPECIFIC_WARNING_CFLAGS = $(COMPILER_SPECIFIC_WARNING_CFLAGS_$(TARGET_GCC_VERSION));
-COMPILER_SPECIFIC_WARNING_CFLAGS_LLVM_COMPILER = -Wexit-time-destructors -Wglobal-constructors -Wtautological-compare;
-
+CLANG_CXX_LANGUAGE_STANDARD = gnu++0x;
+CLANG_CXX_LIBRARY = libc++;
 CLANG_WARN_CXX0X_EXTENSIONS = NO;
 DEBUG_INFORMATION_FORMAT = dwarf-with-dsym;
 GCC_C_LANGUAGE_STANDARD = gnu99;
@@ -34,7 +31,7 @@ GCC_DYNAMIC_NO_PIC = NO;
 GCC_ENABLE_CPP_EXCEPTIONS = NO;
 GCC_ENABLE_CPP_RTTI = NO;
 GCC_ENABLE_OBJC_EXCEPTIONS = YES;
-GCC_ENABLE_OBJC_GC = $(GCC_ENABLE_OBJC_GC_$(REAL_PLATFORM_NAME));
+GCC_ENABLE_OBJC_GC = $(GCC_ENABLE_OBJC_GC_$(PLATFORM_NAME));
 GCC_ENABLE_OBJC_GC_iphoneos = NO;
 GCC_ENABLE_OBJC_GC_iphonesimulator = NO;
 GCC_ENABLE_OBJC_GC_macosx = supported;
@@ -42,7 +39,7 @@ GCC_ENABLE_SYMBOL_SEPARATION = NO;
 GCC_FAST_OBJC_DISPATCH = YES;
 GCC_GENERATE_DEBUGGING_SYMBOLS = YES;
 GCC_INLINES_ARE_PRIVATE_EXTERN = YES;
-GCC_MODEL_TUNING = $(GCC_MODEL_TUNING_$(REAL_PLATFORM_NAME));
+GCC_MODEL_TUNING = $(GCC_MODEL_TUNING_$(PLATFORM_NAME));
 GCC_MODEL_TUNING_macosx = G5;
 GCC_OBJC_CALL_CXX_CDTORS = YES;
 GCC_PRECOMPILE_PREFIX_HEADER = YES;
@@ -50,6 +47,7 @@ GCC_PREPROCESSOR_DEFINITIONS = $(DEBUG_DEFINES) WEBKIT_VERSION_MIN_REQUIRED=WEBK
 GCC_STRICT_ALIASING = YES;
 GCC_THREADSAFE_STATICS = NO;
 GCC_TREAT_WARNINGS_AS_ERRORS = YES;
+GCC_VERSION = com.apple.compilers.llvm.clang.1_0;
 GCC_WARN_ABOUT_DEPRECATED_FUNCTIONS = NO;
 GCC_WARN_ABOUT_MISSING_NEWLINE = YES;
 GCC_WARN_ABOUT_MISSING_PROTOTYPES = YES;
@@ -57,12 +55,12 @@ GCC_WARN_NON_VIRTUAL_DESTRUCTOR = YES;
 GCC_WARN_SIGN_COMPARE = YES;
 LINKER_DISPLAYS_MANGLED_NAMES = YES;
 PREBINDING = NO;
-VALID_ARCHS = $(VALID_ARCHS_$(REAL_PLATFORM_NAME));
+VALID_ARCHS = $(VALID_ARCHS_$(PLATFORM_NAME));
 VALID_ARCHS_iphoneos = $(ARCHS_STANDARD_32_BIT);
 VALID_ARCHS_iphonesimulator = $(ARCHS_STANDARD_32_BIT);
 VALID_ARCHS_macosx = i386 ppc x86_64 ppc64 $(ARCHS_UNIVERSAL_IPHONE_OS);
-WARNING_CFLAGS_BASE = -Wall -Wextra -Wcast-qual -Wchar-subscripts -Wextra-tokens -Wformat=2 -Winit-self -Wmissing-format-attribute -Wmissing-noreturn -Wpacked -Wpointer-arith -Wredundant-decls -Wundef -Wwrite-strings;
-WARNING_CFLAGS = $(WARNING_CFLAGS_$(REAL_PLATFORM_NAME)) $(COMPILER_SPECIFIC_WARNING_CFLAGS);
+WARNING_CFLAGS_BASE = -Wall -Wextra -Wcast-qual -Wchar-subscripts -Wextra-tokens -Wformat=2 -Winit-self -Wmissing-format-attribute -Wmissing-noreturn -Wpacked -Wpointer-arith -Wredundant-decls -Wundef -Wwrite-strings -Wexit-time-destructors -Wglobal-constructors -Wtautological-compare;
+WARNING_CFLAGS = $(WARNING_CFLAGS_$(PLATFORM_NAME));
 WARNING_CFLAGS_iphoneos = $(WARNING_CFLAGS_BASE) -Wshorten-64-to-32;
 WARNING_CFLAGS_iphonesimulator = $(WARNING_CFLAGS_BASE) -Wshorten-64-to-32;
 WARNING_CFLAGS_macosx = $(WARNING_CFLAGS_macosx_$(CURRENT_ARCH));
@@ -70,21 +68,14 @@ WARNING_CFLAGS_macosx_ = $(WARNING_CFLAGS_BASE) -Wshorten-64-to-32;
 WARNING_CFLAGS_macosx_i386 = $(WARNING_CFLAGS_BASE) -Wshorten-64-to-32;
 WARNING_CFLAGS_macosx_ppc = $(WARNING_CFLAGS_BASE) -Wshorten-64-to-32;
 // FIXME: JavaScriptCore 64-bit builds should build with -Wshorten-64-to-32
-WARNING_CFLAGS_macosx_ppc64 = $(WARNING_CFLAGS_BASE);
 WARNING_CFLAGS_macosx_x86_64 = $(WARNING_CFLAGS_BASE);
 HEADER_SEARCH_PATHS = $(BUILT_PRODUCTS_DIR)/usr/local/include $(DSTROOT)/usr/local/include icu $(HEADER_SEARCH_PATHS);
 
 
-REAL_PLATFORM_NAME = $(REAL_PLATFORM_NAME_$(PLATFORM_NAME));
-REAL_PLATFORM_NAME_ = $(REAL_PLATFORM_NAME_macosx);
-REAL_PLATFORM_NAME_iphoneos = iphoneos;
-REAL_PLATFORM_NAME_iphonesimulator = iphonesimulator;
-REAL_PLATFORM_NAME_macosx = macosx;
-
 TARGET_MAC_OS_X_VERSION_MAJOR = $(MAC_OS_X_VERSION_MAJOR);
 
 
-JAVASCRIPTCORE_FRAMEWORKS_DIR = $(JAVASCRIPTCORE_FRAMEWORKS_DIR_$(REAL_PLATFORM_NAME));
+JAVASCRIPTCORE_FRAMEWORKS_DIR = $(JAVASCRIPTCORE_FRAMEWORKS_DIR_$(PLATFORM_NAME));
 JAVASCRIPTCORE_FRAMEWORKS_DIR_iphoneos = $(SYSTEM_LIBRARY_DIR)/PrivateFrameworks;
 JAVASCRIPTCORE_FRAMEWORKS_DIR_iphonesimulator = $(JAVASCRIPTCORE_FRAMEWORKS_DIR_iphoneos);
 JAVASCRIPTCORE_FRAMEWORKS_DIR_macosx = $(SYSTEM_LIBRARY_DIR)/Frameworks;
@@ -109,7 +100,6 @@ DEAD_CODE_STRIPPING_normal = YES;
 DEAD_CODE_STRIPPING = $(DEAD_CODE_STRIPPING_$(CURRENT_VARIANT));
 
 TARGETING_SAME_OS_X_VERSION = $(TARGETING_SAME_OS_X_VERSION_$(MAC_OS_X_VERSION_MAJOR)_$(TARGET_MAC_OS_X_VERSION_MAJOR));
-TARGETING_SAME_OS_X_VERSION_1060_1060 = YES;
 TARGETING_SAME_OS_X_VERSION_1070_1070 = YES;
 TARGETING_SAME_OS_X_VERSION_1080_1080 = YES;
 TARGETING_SAME_OS_X_VERSION_1090_1090 = YES;
diff --git a/Source/WTF/Configurations/CompilerVersion.xcconfig b/Source/WTF/Configurations/CompilerVersion.xcconfig
deleted file mode 100644
index 0bd1c1268..000000000
--- a/Source/WTF/Configurations/CompilerVersion.xcconfig
+++ /dev/null
@@ -1,77 +0,0 @@
-// Copyright (C) 2009, 2010, 2011 Apple Inc. All rights reserved.
-//
-// Redistribution and use in source and binary forms, with or without
-// modification, are permitted provided that the following conditions
-// are met:
-// 1. Redistributions of source code must retain the above copyright
-//    notice, this list of conditions and the following disclaimer.
-// 2. Redistributions in binary form must reproduce the above copyright
-//    notice, this list of conditions and the following disclaimer in the
-//    documentation and/or other materials provided with the distribution.
-//
-// THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
-// EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
-// IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
-// PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
-// CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
-// EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
-// PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
-// PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
-// OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
-
-IS_XCODE_0400 = $(IS_XCODE_0400_$(XCODE_VERSION_MINOR));
-IS_XCODE_0400_0400 = YES;
-
-IS_XCODE_0400_OR_0410 = $(IS_XCODE_0400_OR_0410_$(XCODE_VERSION_MINOR));
-IS_XCODE_0400_OR_0410_0400 = YES;
-IS_XCODE_0400_OR_0410_0410 = YES;
-
-// The version of the LLVM Compiler in Xcode 4.0 and earlier have difficulty compiling our code.
-LLVM_COMPILER_UNSUITABLE_FOR_DEBUG_BUILDS = $(LLVM_COMPILER_UNSUITABLE_FOR_DEBUG_BUILDS_$(XCODE_VERSION_MAJOR));
-LLVM_COMPILER_UNSUITABLE_FOR_DEBUG_BUILDS_0300 = YES;
-LLVM_COMPILER_UNSUITABLE_FOR_DEBUG_BUILDS_0400 = $(LLVM_COMPILER_UNSUITABLE_FOR_DEBUG_BUILDS_IS_XCODE_0400_$(IS_XCODE_0400));
-LLVM_COMPILER_UNSUITABLE_FOR_DEBUG_BUILDS_IS_XCODE_0400_YES = YES;
-
-// The version of the LLVM Compiler in Xcode 4.1 and earlier do not generate fast enough code.
-LLVM_COMPILER_UNSUITABLE_FOR_OPTIMIZED_BUILDS = $(LLVM_COMPILER_UNSUITABLE_FOR_OPTIMIZED_BUILDS_$(XCODE_VERSION_MAJOR));
-LLVM_COMPILER_UNSUITABLE_FOR_OPTIMIZED_BUILDS_0300 = YES;
-LLVM_COMPILER_UNSUITABLE_FOR_OPTIMIZED_BUILDS_0400 = $(LLVM_COMPILER_UNSUITABLE_FOR_OPTIMIZED_BUILDS_IS_XCODE_0400_OR_0410_$(IS_XCODE_0400_OR_0410));
-LLVM_COMPILER_UNSUITABLE_FOR_OPTIMIZED_BUILDS_IS_XCODE_0400_OR_0410_YES = YES;
-
-LLVM_COMPILER_SUITABLE_FOR_DEBUG_BUILDS = $(LLVM_COMPILER_SUITABLE_FOR_DEBUG_BUILDS_$(LLVM_COMPILER_UNSUITABLE_FOR_DEBUG_BUILDS));
-LLVM_COMPILER_SUITABLE_FOR_DEBUG_BUILDS_ = YES;
-LLVM_COMPILER_SUITABLE_FOR_DEBUG_BUILDS_YES = NO;
-
-LLVM_COMPILER_SUITABLE_FOR_OPTIMIZED_BUILDS = $(LLVM_COMPILER_SUITABLE_FOR_OPTIMIZED_BUILDS_$(LLVM_COMPILER_UNSUITABLE_FOR_OPTIMIZED_BUILDS));
-LLVM_COMPILER_SUITABLE_FOR_OPTIMIZED_BUILDS_ = YES;
-LLVM_COMPILER_SUITABLE_FOR_OPTIMIZED_BUILDS_YES = NO;
-
-
-// Use GCC 4.2 with Xcode 3.1, which includes GCC 4.2 but defaults to GCC 4.0.
-// Note that Xcode versions as new as 3.1.2 use XCODE_VERSION_ACTUAL for the minor version
-// number.  Newer versions of Xcode use XCODE_VERSION_MINOR for the minor version, and
-// XCODE_VERSION_ACTUAL for the full version number.
-TARGET_GCC_VERSION = $(TARGET_GCC_VERSION_$(REAL_PLATFORM_NAME));
-TARGET_GCC_VERSION_iphoneos = LLVM_COMPILER;
-TARGET_GCC_VERSION_iphonesimulator = $(TARGET_GCC_VERSION_iphoneos);
-TARGET_GCC_VERSION_macosx = $(TARGET_GCC_VERSION_macosx_$(TARGET_MAC_OS_X_VERSION_MAJOR));
-
-TARGET_GCC_VERSION_macosx_1060 = $(TARGET_GCC_VERSION_macosx_1060_AND_1070_$(CONFIGURATION));
-TARGET_GCC_VERSION_macosx_1070 = $(TARGET_GCC_VERSION_macosx_1060_AND_1070_$(CONFIGURATION));
-TARGET_GCC_VERSION_macosx_1060_AND_1070_Debug = $(TARGET_GCC_VERSION_macosx_USE_LLVM_COMPILER_$(LLVM_COMPILER_SUITABLE_FOR_DEBUG_BUILDS));
-TARGET_GCC_VERSION_macosx_1060_AND_1070_Release = $(TARGET_GCC_VERSION_macosx_USE_LLVM_COMPILER_$(LLVM_COMPILER_SUITABLE_FOR_OPTIMIZED_BUILDS));
-TARGET_GCC_VERSION_macosx_1060_AND_1070_Production = $(TARGET_GCC_VERSION_macosx_USE_LLVM_COMPILER_$(LLVM_COMPILER_SUITABLE_FOR_OPTIMIZED_BUILDS));
-
-TARGET_GCC_VERSION_macosx_USE_LLVM_COMPILER_YES = LLVM_COMPILER;
-TARGET_GCC_VERSION_macosx_USE_LLVM_COMPILER_NO = GCC_42;
-
-TARGET_GCC_VERSION_macosx_1080 = LLVM_COMPILER;
-TARGET_GCC_VERSION_macosx_1090 = LLVM_COMPILER;
-
-GCC_VERSION = $(GCC_VERSION_$(TARGET_GCC_VERSION));
-GCC_VERSION_GCC_40 = 4.0;
-GCC_VERSION_GCC_42 = 4.2;
-GCC_VERSION_LLVM_GCC_42 = com.apple.compilers.llvmgcc42;
-GCC_VERSION_LLVM_COMPILER = com.apple.compilers.llvm.clang.1_0;
diff --git a/Source/WTF/Configurations/DebugRelease.xcconfig b/Source/WTF/Configurations/DebugRelease.xcconfig
index 4863971dc..b4d352293 100644
--- a/Source/WTF/Configurations/DebugRelease.xcconfig
+++ b/Source/WTF/Configurations/DebugRelease.xcconfig
@@ -23,22 +23,17 @@
 
 #include "Base.xcconfig"
 
-ARCHS = $(ARCHS_$(REAL_PLATFORM_NAME));
+ARCHS = $(ARCHS_$(PLATFORM_NAME));
 ARCHS_iphoneos = $(ARCHS_UNIVERSAL_IPHONE_OS);
 ARCHS_iphonesimulator = $(NATIVE_ARCH);
-ARCHS_macosx = $(ARCHS_macosx_$(TARGET_MAC_OS_X_VERSION_MAJOR));
-ARCHS_macosx_1060 = $(ARCHS_STANDARD_32_64_BIT);
-ARCHS_macosx_1070 = $(ARCHS_STANDARD_32_64_BIT);
-ARCHS_macosx_1080 = $(ARCHS_STANDARD_32_64_BIT);
-ARCHS_macosx_1090 = $(ARCHS_STANDARD_32_64_BIT);
+ARCHS_macosx = $(ARCHS_STANDARD_32_64_BIT);
 
 ONLY_ACTIVE_ARCH = YES;
 
-MACOSX_DEPLOYMENT_TARGET = $(MACOSX_DEPLOYMENT_TARGET_$(REAL_PLATFORM_NAME));
+MACOSX_DEPLOYMENT_TARGET = $(MACOSX_DEPLOYMENT_TARGET_$(PLATFORM_NAME));
 MACOSX_DEPLOYMENT_TARGET_iphoneos = 10.5;
 MACOSX_DEPLOYMENT_TARGET_iphonesimulator = 10.5;
 MACOSX_DEPLOYMENT_TARGET_macosx = $(MACOSX_DEPLOYMENT_TARGET_macosx_$(TARGET_MAC_OS_X_VERSION_MAJOR));
-MACOSX_DEPLOYMENT_TARGET_macosx_1060 = 10.6;
 MACOSX_DEPLOYMENT_TARGET_macosx_1070 = 10.7;
 MACOSX_DEPLOYMENT_TARGET_macosx_1080 = 10.8;
 MACOSX_DEPLOYMENT_TARGET_macosx_1090 = 10.9;
diff --git a/Source/WTF/GNUmakefile.list.am b/Source/WTF/GNUmakefile.list.am
index 9063fb5f7..9d4f0d7e5 100644
--- a/Source/WTF/GNUmakefile.list.am
+++ b/Source/WTF/GNUmakefile.list.am
@@ -85,6 +85,7 @@ wtf_sources += \
     Source/WTF/wtf/MemoryInstrumentationHashCountedSet.h \
     Source/WTF/wtf/MemoryInstrumentationHashMap.h \
     Source/WTF/wtf/MemoryInstrumentationHashSet.h \
+    Source/WTF/wtf/MemoryInstrumentationListHashSet.h \
     Source/WTF/wtf/MemoryInstrumentationParsedURL.h \
     Source/WTF/wtf/MemoryInstrumentationSequence.h \
     Source/WTF/wtf/MemoryInstrumentationString.h \
diff --git a/Source/WTF/WTF.gypi b/Source/WTF/WTF.gypi
index 2de382c67..f54077d84 100644
--- a/Source/WTF/WTF.gypi
+++ b/Source/WTF/WTF.gypi
@@ -55,6 +55,7 @@
             'wtf/MemoryInstrumentationHashCountedSet.h',
             'wtf/MemoryInstrumentationHashMap.h',
             'wtf/MemoryInstrumentationHashSet.h',
+            'wtf/MemoryInstrumentationListHashSet.h',
             'wtf/MemoryInstrumentationParsedURL.h',
             'wtf/MemoryInstrumentationSequence.h',
             'wtf/MemoryInstrumentationString.h',
diff --git a/Source/WTF/WTF.pro b/Source/WTF/WTF.pro
index 2020ed56a..8bd303b1c 100644
--- a/Source/WTF/WTF.pro
+++ b/Source/WTF/WTF.pro
@@ -92,6 +92,7 @@ HEADERS += \
     MemoryInstrumentationHashCountedSet.h \
     MemoryInstrumentationHashMap.h \
     MemoryInstrumentationHashSet.h \
+    MemoryInstrumentationListHashSet.h \
     MemoryInstrumentationParsedURL.h \
     MemoryInstrumentationSequence.h \
     MemoryInstrumentationString.h \
diff --git a/Source/WTF/WTF.vcproj/WTF.vcproj b/Source/WTF/WTF.vcproj/WTF.vcproj
index 6b7a3199d..ed219e732 100644
--- a/Source/WTF/WTF.vcproj/WTF.vcproj
+++ b/Source/WTF/WTF.vcproj/WTF.vcproj
@@ -925,6 +925,10 @@
 			>

 		</File>

 		<File

+		        RelativePath="..\wtf\MemoryInstrumentationListHashSet.h"

+			>

+		</File>

+		<File

 		        RelativePath="..\wtf\MemoryInstrumentationSequence.h"

 			>

 		</File>

diff --git a/Source/WTF/WTF.xcodeproj/project.pbxproj b/Source/WTF/WTF.xcodeproj/project.pbxproj
index ab1251eeb..8aeebed69 100644
--- a/Source/WTF/WTF.xcodeproj/project.pbxproj
+++ b/Source/WTF/WTF.xcodeproj/project.pbxproj
@@ -23,8 +23,8 @@
 /* Begin PBXBuildFile section */
 		0FD81AC5154FB22E00983E72 /* FastBitVector.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FD81AC4154FB22E00983E72 /* FastBitVector.h */; settings = {ATTRIBUTES = (); }; };
 		143F611F1565F0F900DB514A /* RAMSize.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 143F611D1565F0F900DB514A /* RAMSize.cpp */; };
-		143F61201565F0F900DB514A /* RAMSize.h in Headers */ = {isa = PBXBuildFile; fileRef = 143F611E1565F0F900DB514A /* RAMSize.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		14F3B0F715E45E4600210069 /* SaturatedArithmetic.h in Headers */ = {isa = PBXBuildFile; fileRef = 14F3B0F615E45E4600210069 /* SaturatedArithmetic.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		143F61201565F0F900DB514A /* RAMSize.h in Headers */ = {isa = PBXBuildFile; fileRef = 143F611E1565F0F900DB514A /* RAMSize.h */; settings = {ATTRIBUTES = (); }; };
+		14F3B0F715E45E4600210069 /* SaturatedArithmetic.h in Headers */ = {isa = PBXBuildFile; fileRef = 14F3B0F615E45E4600210069 /* SaturatedArithmetic.h */; settings = {ATTRIBUTES = (); }; };
 		1A6BB769162F300500DD16DB /* StreamBuffer.h in Headers */ = {isa = PBXBuildFile; fileRef = 1A6BB768162F300500DD16DB /* StreamBuffer.h */; };
 		26147B0A15DDCCDC00DDB907 /* IntegerToStringConversion.h in Headers */ = {isa = PBXBuildFile; fileRef = 26147B0815DDCCDC00DDB907 /* IntegerToStringConversion.h */; };
 		2661122E160FEAD40013F5C3 /* URLQueryCharsetConverter.h in Headers */ = {isa = PBXBuildFile; fileRef = 2661122D160FEAD40013F5C3 /* URLQueryCharsetConverter.h */; };
@@ -293,6 +293,7 @@
 		CD5497AC15857D0300B5BC30 /* MediaTime.cpp in Sources */ = {isa = PBXBuildFile; fileRef = CD5497AA15857D0300B5BC30 /* MediaTime.cpp */; };
 		CD5497AD15857D0300B5BC30 /* MediaTime.h in Headers */ = {isa = PBXBuildFile; fileRef = CD5497AB15857D0300B5BC30 /* MediaTime.h */; };
 		EB95E1F0161A72410089A2F5 /* ByteOrder.h in Headers */ = {isa = PBXBuildFile; fileRef = EB95E1EF161A72410089A2F5 /* ByteOrder.h */; };
+		F3525E2A16149FF400278BC1 /* MemoryInstrumentationListHashSet.h in Headers */ = {isa = PBXBuildFile; fileRef = F3525E2916149FF400278BC1 /* MemoryInstrumentationListHashSet.h */; };
 		F3525E461619A4EE00278BC1 /* MemoryInstrumentationHashMap.h in Headers */ = {isa = PBXBuildFile; fileRef = F3525E451619A4EE00278BC1 /* MemoryInstrumentationHashMap.h */; };
 		F3FBC71E161AF7BF00BB4BD4 /* MemoryInstrumentationHashCountedSet.h in Headers */ = {isa = PBXBuildFile; fileRef = F3FBC71D161AF7BF00BB4BD4 /* MemoryInstrumentationHashCountedSet.h */; };
 		F3FBC720161AF7CD00BB4BD4 /* MemoryInstrumentationSequence.h in Headers */ = {isa = PBXBuildFile; fileRef = F3FBC71F161AF7CD00BB4BD4 /* MemoryInstrumentationSequence.h */; };
@@ -353,7 +354,6 @@
 		4FD8554616133E0E00C5B704 /* MemoryInstrumentationArrayBufferView.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = MemoryInstrumentationArrayBufferView.h; sourceTree = "<group>"; };
 		5D247B6214689B8600E78B76 /* libWTF.a */ = {isa = PBXFileReference; explicitFileType = archive.ar; includeInIndex = 0; path = libWTF.a; sourceTree = BUILT_PRODUCTS_DIR; };
 		5D247B6E14689C4700E78B76 /* Base.xcconfig */ = {isa = PBXFileReference; lastKnownFileType = text.xcconfig; path = Base.xcconfig; sourceTree = "<group>"; };
-		5D247B6F14689C4700E78B76 /* CompilerVersion.xcconfig */ = {isa = PBXFileReference; lastKnownFileType = text.xcconfig; path = CompilerVersion.xcconfig; sourceTree = "<group>"; };
 		5D247B7014689C4700E78B76 /* DebugRelease.xcconfig */ = {isa = PBXFileReference; lastKnownFileType = text.xcconfig; path = DebugRelease.xcconfig; sourceTree = "<group>"; };
 		5D247B7314689C4700E78B76 /* WTF.xcconfig */ = {isa = PBXFileReference; lastKnownFileType = text.xcconfig; path = WTF.xcconfig; sourceTree = "<group>"; };
 		5D247EB11468B01500E78B76 /* HeaderDetection.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = HeaderDetection.h; path = DerivedSources/WTF/HeaderDetection.h; sourceTree = BUILT_PRODUCTS_DIR; };
@@ -593,6 +593,7 @@
 		CD5497AA15857D0300B5BC30 /* MediaTime.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = MediaTime.cpp; sourceTree = "<group>"; };
 		CD5497AB15857D0300B5BC30 /* MediaTime.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = MediaTime.h; sourceTree = "<group>"; };
 		EB95E1EF161A72410089A2F5 /* ByteOrder.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ByteOrder.h; sourceTree = "<group>"; };
+		F3525E2916149FF400278BC1 /* MemoryInstrumentationListHashSet.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = MemoryInstrumentationListHashSet.h; sourceTree = "<group>"; };
 		F3525E451619A4EE00278BC1 /* MemoryInstrumentationHashMap.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = MemoryInstrumentationHashMap.h; sourceTree = "<group>"; };
 		F3FBC71D161AF7BF00BB4BD4 /* MemoryInstrumentationHashCountedSet.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = MemoryInstrumentationHashCountedSet.h; sourceTree = "<group>"; };
 		F3FBC71F161AF7CD00BB4BD4 /* MemoryInstrumentationSequence.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = MemoryInstrumentationSequence.h; sourceTree = "<group>"; };
@@ -631,9 +632,8 @@
 		5D247B6D14689C4700E78B76 /* Configurations */ = {
 			isa = PBXGroup;
 			children = (
-				6541CAF41630DB26006D0DEC /* CopyWTFHeaders.xcconfig */,
 				5D247B6E14689C4700E78B76 /* Base.xcconfig */,
-				5D247B6F14689C4700E78B76 /* CompilerVersion.xcconfig */,
+				6541CAF41630DB26006D0DEC /* CopyWTFHeaders.xcconfig */,
 				5D247B7014689C4700E78B76 /* DebugRelease.xcconfig */,
 				5D247B7314689C4700E78B76 /* WTF.xcconfig */,
 			);
@@ -745,6 +745,7 @@
 				F3FBC71D161AF7BF00BB4BD4 /* MemoryInstrumentationHashCountedSet.h */,
 				F3525E451619A4EE00278BC1 /* MemoryInstrumentationHashMap.h */,
 				4F1B2DB5160B44AA00586559 /* MemoryInstrumentationHashSet.h */,
+				F3525E2916149FF400278BC1 /* MemoryInstrumentationListHashSet.h */,
 				4FD2A358161B0EE100EBF236 /* MemoryInstrumentationParsedURL.h */,
 				F3FBC71F161AF7CD00BB4BD4 /* MemoryInstrumentationSequence.h */,
 				4FCF27E016172E8600CBF037 /* MemoryInstrumentationString.h */,
@@ -1103,6 +1104,7 @@
 				F3FBC71E161AF7BF00BB4BD4 /* MemoryInstrumentationHashCountedSet.h in Headers */,
 				F3525E461619A4EE00278BC1 /* MemoryInstrumentationHashMap.h in Headers */,
 				4F1B2DB6160B44AA00586559 /* MemoryInstrumentationHashSet.h in Headers */,
+				F3525E2A16149FF400278BC1 /* MemoryInstrumentationListHashSet.h in Headers */,
 				4FD2A359161B0EE100EBF236 /* MemoryInstrumentationParsedURL.h in Headers */,
 				F3FBC720161AF7CD00BB4BD4 /* MemoryInstrumentationSequence.h in Headers */,
 				4FCF27E116172E8600CBF037 /* MemoryInstrumentationString.h in Headers */,
diff --git a/Source/WTF/wtf/Assertions.h b/Source/WTF/wtf/Assertions.h
index f347a2174..7e079ab18 100644
--- a/Source/WTF/wtf/Assertions.h
+++ b/Source/WTF/wtf/Assertions.h
@@ -42,6 +42,8 @@
    http://msdn2.microsoft.com/en-us/library/ms177415(VS.80).aspx
 */
 
+#include <wtf/Platform.h>
+
 #include <stddef.h>
 
 #if !COMPILER(MSVC)
diff --git a/Source/WTF/wtf/CheckedArithmetic.h b/Source/WTF/wtf/CheckedArithmetic.h
index ef8a03695..f5d3b7550 100644
--- a/Source/WTF/wtf/CheckedArithmetic.h
+++ b/Source/WTF/wtf/CheckedArithmetic.h
@@ -154,7 +154,7 @@ template <typename Target, typename Source> struct BoundsChecker<Target, Source,
     }
 };
 
-template <typename Target, typename Source, bool SameType = IsSameType<Target, Source>::value> struct BoundsCheckElider;
+template <typename Target, typename Source, bool CanElide = IsSameType<Target, Source>::value || (sizeof(Target) > sizeof(Source)) > struct BoundsCheckElider;
 template <typename Target, typename Source> struct BoundsCheckElider<Target, Source, true> {
     static bool inBounds(Source) { return true; }
 };
@@ -270,7 +270,7 @@ template <typename LHS, typename RHS, typename ResultType> struct ArithmeticOper
                 if (lhs && (std::numeric_limits<ResultType>::max() / lhs) < rhs)
                     return false;
             } else {
-                if (lhs == std::numeric_limits<ResultType>::min() || rhs == std::numeric_limits<ResultType>::min())
+                if (static_cast<ResultType>(lhs) == std::numeric_limits<ResultType>::min() || static_cast<ResultType>(rhs) == std::numeric_limits<ResultType>::min())
                     return false;
                 if ((std::numeric_limits<ResultType>::max() / -lhs) < -rhs)
                     return false;
diff --git a/Source/WTF/wtf/ListHashSet.h b/Source/WTF/wtf/ListHashSet.h
index fa654c5d9..8feef72b3 100644
--- a/Source/WTF/wtf/ListHashSet.h
+++ b/Source/WTF/wtf/ListHashSet.h
@@ -98,6 +98,8 @@ namespace WTF {
         int capacity() const;
         bool isEmpty() const;
 
+        size_t sizeInBytes() const;
+
         iterator begin();
         iterator end();
         const_iterator begin() const;
@@ -209,15 +211,15 @@ namespace WTF {
             fastFree(node);
         }
 
-    private:
-        Node* pool() { return reinterpret_cast_ptr<Node*>(m_pool.pool); }
-        Node* pastPool() { return pool() + m_poolSize; }
-
         bool inPool(Node* node)
         {
             return node >= pool() && node < pastPool();
         }
 
+    private:
+        Node* pool() { return reinterpret_cast_ptr<Node*>(m_pool.pool); }
+        Node* pastPool() { return pool() + m_poolSize; }
+
         Node* m_freeList;
         bool m_isDoneWithInitialFreeList;
         static const size_t m_poolSize = inlineCapacity;
@@ -560,6 +562,18 @@ namespace WTF {
     }
 
     template<typename T, size_t inlineCapacity, typename U>
+    size_t ListHashSet<T, inlineCapacity, U>::sizeInBytes() const
+    {
+        size_t result = sizeof(*this) + sizeof(*m_allocator);
+        result += sizeof(typename ImplType::ValueType) * m_impl.capacity();
+        for (Node* node = m_head; node; node = node->m_next) {
+            if (!m_allocator->inPool(node))
+                result += sizeof(Node);
+        }
+        return result;
+    }
+
+    template<typename T, size_t inlineCapacity, typename U>
     inline typename ListHashSet<T, inlineCapacity, U>::iterator ListHashSet<T, inlineCapacity, U>::begin()
     {
         return makeIterator(m_head); 
diff --git a/Source/WTF/wtf/MemoryInstrumentation.h b/Source/WTF/wtf/MemoryInstrumentation.h
index 7ea5cc65f..eafc62442 100644
--- a/Source/WTF/wtf/MemoryInstrumentation.h
+++ b/Source/WTF/wtf/MemoryInstrumentation.h
@@ -100,9 +100,9 @@ public:
     explicit MemoryInstrumentation(MemoryInstrumentationClient* client) : m_client(client) { }
     virtual ~MemoryInstrumentation() { }
 
-    template <typename T> void addRootObject(const T& t)
+    template <typename T> void addRootObject(const T& t, MemoryObjectType objectType = 0)
     {
-        addObject(t, 0);
+        addObject(t, objectType);
         processDeferredInstrumentedPointers();
     }
 
@@ -158,7 +158,6 @@ private:
     };
 
     template<typename T> void addObject(const T& t, MemoryObjectType ownerObjectType) { OwningTraits<T>::addObject(this, t, ownerObjectType); }
-    template<typename ListHashSetType> void addListHashSet(const ListHashSetType&, MemoryObjectType, bool contentOnly = false);
     void addRawBuffer(const void* const& buffer, MemoryObjectType ownerObjectType, size_t size)
     {
         if (!buffer || visited(buffer))
@@ -201,9 +200,12 @@ public:
     }
 
     template<typename M> void addMember(const M& member) { m_memoryInstrumentation->addObject(member, m_objectType); }
-    template<typename ListHashSetType> void addListHashSet(const ListHashSetType& set) { m_memoryInstrumentation->addListHashSet(set, m_objectType, true); }
     void addRawBuffer(const void* const& buffer, size_t size) { m_memoryInstrumentation->addRawBuffer(buffer, m_objectType, size); }
-    void addPrivateBuffer(size_t size) { m_memoryInstrumentation->countObjectSize(0, m_objectType, size); }
+    void addPrivateBuffer(size_t size)
+    {
+        if (size)
+            m_memoryInstrumentation->countObjectSize(0, m_objectType, size);
+    }
 
     void addWeakPointer(void*) { }
 
@@ -228,7 +230,6 @@ void MemoryInstrumentation::addObjectImpl(const T* const& object, MemoryObjectTy
     } else {
         if (!object || visited(object))
             return;
-        checkCountedObject(object);
         deferInstrumentedPointer(adoptPtr(new InstrumentedPointer<T>(object, ownerObjectType)));
     }
 }
@@ -249,15 +250,6 @@ void MemoryInstrumentation::addObjectImpl(const RefPtr<T>* const& object, Memory
     addObjectImpl(object->get(), ownerObjectType, byPointer);
 }
 
-template<typename ListHashSetType>
-void MemoryInstrumentation::addListHashSet(const ListHashSetType& hashSet, MemoryObjectType ownerObjectType, bool contentOnly)
-{
-    if (visited(&hashSet))
-        return;
-    size_t size = (contentOnly ? 0 : sizeof(ListHashSetType)) + hashSet.capacity() * sizeof(void*) + hashSet.size() * (sizeof(typename ListHashSetType::ValueType) + 2 * sizeof(void*));
-    countObjectSize(&hashSet, ownerObjectType, size);
-}
-
 template<typename T>
 void MemoryInstrumentation::InstrumentedPointer<T>::process(MemoryInstrumentation* memoryInstrumentation)
 {
@@ -269,6 +261,7 @@ void MemoryInstrumentation::InstrumentedPointer<T>::process(MemoryInstrumentatio
     if (pointer != m_pointer && memoryInstrumentation->visited(pointer))
         return;
     memoryInstrumentation->countObjectSize(pointer, memoryObjectInfo.objectType(), memoryObjectInfo.objectSize());
+    memoryInstrumentation->checkCountedObject(pointer);
 }
 
 // Link time guard for classes with external memory instrumentation.
@@ -281,6 +274,9 @@ template<typename KeyArg, typename MappedArg, typename HashArg, typename KeyTrai
 template<typename ValueArg, typename HashArg, typename TraitsArg> class HashCountedSet;
 template<typename ValueArg, typename HashArg, typename TraitsArg> void reportMemoryUsage(const HashCountedSet<ValueArg, HashArg, TraitsArg>* const&, MemoryObjectInfo*);
 
+template<typename ValueArg, size_t inlineCapacity, typename HashArg> class ListHashSet;
+template<typename ValueArg, size_t inlineCapacity, typename HashArg> void reportMemoryUsage(const ListHashSet<ValueArg, inlineCapacity, HashArg>* const&, MemoryObjectInfo*);
+
 class String;
 void reportMemoryUsage(const String* const&, MemoryObjectInfo*);
 
diff --git a/Source/WTF/wtf/MemoryInstrumentationListHashSet.h b/Source/WTF/wtf/MemoryInstrumentationListHashSet.h
new file mode 100644
index 000000000..0e31c569b
--- /dev/null
+++ b/Source/WTF/wtf/MemoryInstrumentationListHashSet.h
@@ -0,0 +1,49 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef MemoryInstrumentationListHashSet_h
+#define MemoryInstrumentationListHashSet_h
+
+#include <wtf/ListHashSet.h>
+#include <wtf/MemoryInstrumentationSequence.h>
+
+namespace WTF {
+
+template<typename ValueArg, size_t inlineCapacity, typename HashArg>
+void reportMemoryUsage(const ListHashSet<ValueArg, inlineCapacity, HashArg>* const& set, MemoryObjectInfo* memoryObjectInfo)
+{
+    MemoryClassInfo info(memoryObjectInfo, set);
+    info.addPrivateBuffer(set->sizeInBytes() - sizeof(*set));
+    reportSequenceMemoryUsage<ValueArg, typename ListHashSet<ValueArg, inlineCapacity, HashArg>::const_iterator>(set->begin(), set->end(), info);
+}
+
+}
+
+#endif // !defined(MemoryInstrumentationListHashSet_h)
diff --git a/Source/WTF/wtf/OwnPtrCommon.h b/Source/WTF/wtf/OwnPtrCommon.h
index 43a3cb7de..c56400184 100644
--- a/Source/WTF/wtf/OwnPtrCommon.h
+++ b/Source/WTF/wtf/OwnPtrCommon.h
@@ -40,11 +40,15 @@ typedef struct HRGN__* HRGN;
 
 #if PLATFORM(EFL)
 typedef struct _Ecore_Evas Ecore_Evas;
+typedef struct _Ecore_IMF_Context Ecore_IMF_Context;
 typedef struct _Ecore_Pipe Ecore_Pipe;
 typedef struct _Ecore_Timer Ecore_Timer;
 typedef struct _Eina_Hash Eina_Hash;
 typedef struct _Eina_Module Eina_Module;
 typedef struct _Evas_Object Evas_Object;
+#if USE(ACCELERATED_COMPOSITING)
+typedef struct _Evas_GL Evas_GL;
+#endif
 #endif
 
 namespace WTF {
@@ -68,11 +72,15 @@ namespace WTF {
 
 #if PLATFORM(EFL)
     WTF_EXPORT_PRIVATE void deleteOwnedPtr(Ecore_Evas*);
+    WTF_EXPORT_PRIVATE void deleteOwnedPtr(Ecore_IMF_Context*);
     WTF_EXPORT_PRIVATE void deleteOwnedPtr(Ecore_Pipe*);
     WTF_EXPORT_PRIVATE void deleteOwnedPtr(Ecore_Timer*);
     WTF_EXPORT_PRIVATE void deleteOwnedPtr(Eina_Hash*);
     WTF_EXPORT_PRIVATE void deleteOwnedPtr(Eina_Module*);
     WTF_EXPORT_PRIVATE void deleteOwnedPtr(Evas_Object*);
+#if USE(ACCELERATED_COMPOSITING)
+    WTF_EXPORT_PRIVATE void deleteOwnedPtr(Evas_GL*);
+#endif
 #endif
 
 } // namespace WTF
diff --git a/Source/WTF/wtf/Platform.h b/Source/WTF/wtf/Platform.h
index 3c263c51d..0ab8086cc 100644
--- a/Source/WTF/wtf/Platform.h
+++ b/Source/WTF/wtf/Platform.h
@@ -302,6 +302,14 @@
 #define HAVE_ARM_NEON_INTRINSICS 1
 #endif
 
+#if (defined(__VFP_FP__) && !defined(__SOFTFP__))
+#define WTF_CPU_ARM_VFP 1
+#endif
+
+#if defined(__ARM_ARCH_7S__)
+#define WTF_CPU_APPLE_ARMV7S 1
+#endif
+
 #endif /* ARM */
 
 #if CPU(ARM) || CPU(MIPS) || CPU(SH4) || CPU(SPARC)
@@ -592,11 +600,11 @@
 #define ENABLE_ORIENTATION_EVENTS 1
 #define ENABLE_REPAINT_THROTTLING 1
 #define ENABLE_WEB_ARCHIVE 1
-#define HAVE_NETWORK_CFDATA_ARRAY_CALLBACK 1
 #define HAVE_PTHREAD_RWLOCK 1
 #define HAVE_READLINE 1
 #define WTF_USE_CF 1
 #define WTF_USE_CFNETWORK 1
+#define WTF_USE_NETWORK_CFDATA_ARRAY_CALLBACK 1
 #define WTF_USE_PTHREADS 1
 
 #if PLATFORM(IOS_SIMULATOR)
@@ -622,7 +630,6 @@
 
 #if USE(CFNETWORK) || PLATFORM(MAC) || PLATFORM(IOS)
 #define WTF_USE_CFURLCACHE 1
-#define WTF_USE_CFURLSTORAGESESSIONS 1
 #endif
 
 #if PLATFORM(WIN) && !OS(WINCE) && !PLATFORM(CHROMIUM) && !PLATFORM(QT)
@@ -834,6 +841,10 @@
 #error "ENABLE_SATURATED_LAYOUT_ARITHMETIC requires ENABLE_SUBPIXEL_LAYOUT"
 #endif
 
+#if ENABLE(INPUT_TYPE_DATE) || ENABLE(INPUT_TYPE_DATETIME) || ENABLE(INPUT_TYPE_DATETIMELOCAL) || ENABLE(INPUT_TYPE_MONTH) || ENABLE(INPUT_TYPE_TIME) || ENABLE(INPUT_TYPE_WEEK)
+#define ENABLE_DATE_AND_TIME_INPUT_TYPES 1
+#endif
+
 #define ENABLE_DEBUG_WITH_BREAKPOINT 0
 #define ENABLE_SAMPLING_COUNTERS 0
 #define ENABLE_SAMPLING_FLAGS 0
@@ -891,7 +902,8 @@
 /* If possible, try to enable a disassembler. This is optional. We proceed in two
    steps: first we try to find some disassembler that we can use, and then we
    decide if the high-level disassembler API can be enabled. */
-#if !defined(WTF_USE_UDIS86) && ENABLE(JIT) && PLATFORM(MAC) && (CPU(X86) || CPU(X86_64))
+#if !defined(WTF_USE_UDIS86) && ENABLE(JIT) && (PLATFORM(MAC) || (PLATFORM(QT) && OS(LINUX))) \
+    && (CPU(X86) || CPU(X86_64))
 #define WTF_USE_UDIS86 1
 #endif
 
@@ -1048,17 +1060,17 @@
 #define ENABLE_CSS_IMAGE_SET 1
 #endif
 
+#if ENABLE(WEBGL) && !defined(WTF_USE_3D_GRAPHICS)
+#define WTF_USE_3D_GRAPHICS 1
+#endif
 
 /* Qt always uses Texture Mapper */
 #if PLATFORM(QT)
 #define WTF_USE_TEXTURE_MAPPER 1
-#if USE(3D_GRAPHICS)
-#define WTF_USE_TEXTURE_MAPPER_GL 1
-#endif
 #endif
 
-#if ENABLE(WEBGL) && !defined(WTF_USE_3D_GRAPHICS)
-#define WTF_USE_3D_GRAPHICS 1
+#if USE(TEXTURE_MAPPER) && USE(3D_GRAPHICS) && !defined(WTF_USE_TEXTURE_MAPPER_GL)
+#define WTF_USE_TEXTURE_MAPPER_GL 1
 #endif
 
 /* Compositing on the UI-process in WebKit2 */
diff --git a/Source/WTF/wtf/PlatformEfl.cmake b/Source/WTF/wtf/PlatformEfl.cmake
index 2d663fa8f..73d57e5cf 100644
--- a/Source/WTF/wtf/PlatformEfl.cmake
+++ b/Source/WTF/wtf/PlatformEfl.cmake
@@ -21,6 +21,7 @@ LIST(APPEND WTF_LIBRARIES
     ${ICU_I18N_LIBRARIES}
     ${ECORE_LIBRARIES}
     ${ECORE_EVAS_LIBRARIES}
+    ${ECORE_IMF_LIBRARIES}
     ${EINA_LIBRARIES}
     ${EVAS_LIBRARIES}
     ${CMAKE_DL_LIBS}
diff --git a/Source/WTF/wtf/efl/OwnPtrEfl.cpp b/Source/WTF/wtf/efl/OwnPtrEfl.cpp
index c6ca5e220..59c8ad5c3 100644
--- a/Source/WTF/wtf/efl/OwnPtrEfl.cpp
+++ b/Source/WTF/wtf/efl/OwnPtrEfl.cpp
@@ -29,9 +29,14 @@
 
 #include <Ecore.h>
 #include <Ecore_Evas.h>
+#include <Ecore_IMF.h>
 #include <Eina.h>
 #include <Evas.h>
 
+#if USE(ACCELERATED_COMPOSITING)
+#include <Evas_GL.h>
+#endif
+
 namespace WTF {
 
 void deleteOwnedPtr(Ecore_Evas* ptr)
@@ -64,4 +69,18 @@ void deleteOwnedPtr(Ecore_Timer* ptr)
         ecore_timer_del(ptr);
 }
 
+void deleteOwnedPtr(Ecore_IMF_Context* ptr)
+{
+    if (ptr)
+        ecore_imf_context_del(ptr);
+}
+
+#if USE(ACCELERATED_COMPOSITING)
+void deleteOwnedPtr(Evas_GL* ptr)
+{
+    if (ptr)
+        evas_gl_free(ptr);
+}
+#endif
+
 }
diff --git a/Source/WTF/wtf/text/ASCIIFastPath.h b/Source/WTF/wtf/text/ASCIIFastPath.h
index c1485b1b3..fef892a72 100644
--- a/Source/WTF/wtf/text/ASCIIFastPath.h
+++ b/Source/WTF/wtf/text/ASCIIFastPath.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2011 Apple Inc. All rights reserved.
+ * Copyright (C) 2011, 2012 Apple Inc. All rights reserved.
  * Copyright (C) 2011 Nokia Corporation and/or its subsidiary(-ies).
  *
  * This library is free software; you can redistribute it and/or
@@ -131,6 +131,31 @@ inline void copyLCharsFromUCharSource(LChar* destination, const UChar* source, s
         ASSERT(!(source[i] & 0xff00));
         destination[i] = static_cast<LChar>(source[i]);
     }
+#elif COMPILER(GCC) && CPU(ARM_NEON) && !(PLATFORM(BIG_ENDIAN) || PLATFORM(MIDDLE_ENDIAN)) && defined(NDEBUG)
+    const LChar* const end = destination + length;
+    const uintptr_t memoryAccessSize = 8;
+
+    if (length >= (2 * memoryAccessSize) - 1) {
+        // Prefix: align dst on 64 bits.
+        const uintptr_t memoryAccessMask = memoryAccessSize - 1;
+        do {
+            *destination++ = static_cast<LChar>(*source++);
+        } while (!isAlignedTo<memoryAccessMask>(destination));
+
+        // Vector interleaved unpack, we only store the lower 8 bits.
+        const uintptr_t lengthLeft = end - destination;
+        const LChar* const simdEnd = end - (lengthLeft % memoryAccessSize);
+        do {
+            asm("vld2.8   { d0-d1 }, [%[SOURCE]] !\n\t"
+                "vst1.8   { d0 }, [%[DESTINATION],:64] !\n\t"
+                : [SOURCE]"+r" (source), [DESTINATION]"+r" (destination)
+                :
+                : "memory", "d0", "d1");
+        } while (destination != simdEnd);
+    }
+
+    while (destination != end)
+        *destination++ = static_cast<LChar>(*source++);
 #else
     for (size_t i = 0; i < length; ++i) {
         ASSERT(!(source[i] & 0xff00));
diff --git a/Source/WTF/wtf/text/AtomicString.cpp b/Source/WTF/wtf/text/AtomicString.cpp
index a37c50e6f..d637caa24 100644
--- a/Source/WTF/wtf/text/AtomicString.cpp
+++ b/Source/WTF/wtf/text/AtomicString.cpp
@@ -135,7 +135,7 @@ struct UCharBufferTranslator {
 
     static void translate(StringImpl*& location, const UCharBuffer& buf, unsigned hash)
     {
-        location = StringImpl::create(buf.s, buf.length).leakRef();
+        location = StringImpl::create8BitIfPossible(buf.s, buf.length).leakRef();
         location->setHash(hash);
         location->setIsAtomic(true);
     }
@@ -260,7 +260,7 @@ PassRefPtr<StringImpl> AtomicString::add(const UChar* s)
     if (!s)
         return 0;
 
-    int length = 0;
+    unsigned length = 0;
     while (s[length] != UChar(0))
         length++;
 
diff --git a/Source/WTF/wtf/text/AtomicString.h b/Source/WTF/wtf/text/AtomicString.h
index 6ac60e6ad..8aea58507 100644
--- a/Source/WTF/wtf/text/AtomicString.h
+++ b/Source/WTF/wtf/text/AtomicString.h
@@ -138,11 +138,10 @@ public:
     static void remove(StringImpl*);
     
 #if USE(CF)
-    AtomicString(CFStringRef s) :  m_string(add(String(s).impl())) { }
-    CFStringRef createCFString() const { return m_string.createCFString(); }
+    AtomicString(CFStringRef s) :  m_string(add(s)) { }
 #endif    
 #ifdef __OBJC__
-    AtomicString(NSString* s) : m_string(add(String(s).impl())) { }
+    AtomicString(NSString* s) : m_string(add((CFStringRef)s)) { }
     operator NSString*() const { return m_string; }
 #endif
 #if PLATFORM(QT)
@@ -173,7 +172,7 @@ private:
     ALWAYS_INLINE static PassRefPtr<StringImpl> add(const char* s) { return add(reinterpret_cast<const LChar*>(s)); };
     WTF_EXPORT_STRING_API static PassRefPtr<StringImpl> add(const LChar*, unsigned length);
     WTF_EXPORT_STRING_API static PassRefPtr<StringImpl> add(const UChar*, unsigned length);
-    ALWAYS_INLINE static PassRefPtr<StringImpl> add(const char* s, unsigned length) { return add(reinterpret_cast<const char*>(s), length); };
+    ALWAYS_INLINE static PassRefPtr<StringImpl> add(const char* s, unsigned length) { return add(reinterpret_cast<const LChar*>(s), length); };
     WTF_EXPORT_STRING_API static PassRefPtr<StringImpl> add(const UChar*, unsigned length, unsigned existingHash);
     WTF_EXPORT_STRING_API static PassRefPtr<StringImpl> add(const UChar*);
     WTF_EXPORT_STRING_API static PassRefPtr<StringImpl> add(StringImpl*, unsigned offset, unsigned length);
@@ -185,6 +184,10 @@ private:
     }
     WTF_EXPORT_STRING_API static PassRefPtr<StringImpl> addFromLiteralData(const char* characters, unsigned length);
     WTF_EXPORT_STRING_API static PassRefPtr<StringImpl> addSlowCase(StringImpl*);
+#if USE(CF)
+    static PassRefPtr<StringImpl> add(CFStringRef);
+#endif
+
     WTF_EXPORT_STRING_API static AtomicString fromUTF8Internal(const char*, const char*);
 };
 
diff --git a/Source/WTF/wtf/text/StringBuilder.cpp b/Source/WTF/wtf/text/StringBuilder.cpp
index 18c92db2e..c82ed2e1a 100644
--- a/Source/WTF/wtf/text/StringBuilder.cpp
+++ b/Source/WTF/wtf/text/StringBuilder.cpp
@@ -243,6 +243,13 @@ void StringBuilder::append(const UChar* characters, unsigned length)
     ASSERT(characters);
 
     if (m_is8Bit) {
+        if (length == 1 && !(*characters & ~0xff)) {
+            // Append as 8 bit character
+            LChar lChar = static_cast<LChar>(*characters);
+            append(&lChar, 1);
+            return;
+        }
+
         // Calculate the new size of the builder after appending.
         unsigned requiredLength = length + m_length;
         if (requiredLength < length)
diff --git a/Source/WTF/wtf/text/StringBuilder.h b/Source/WTF/wtf/text/StringBuilder.h
index 5b2322701..e65f8f301 100644
--- a/Source/WTF/wtf/text/StringBuilder.h
+++ b/Source/WTF/wtf/text/StringBuilder.h
@@ -111,10 +111,18 @@ public:
 
     void append(UChar c)
     {
-        if (m_buffer && !m_is8Bit && m_length < m_buffer->length() && m_string.isNull())
-            m_bufferCharacters16[m_length++] = c;
-        else
-            append(&c, 1);
+        if (m_buffer && m_length < m_buffer->length() && m_string.isNull()) {
+            if (!m_is8Bit) {
+                m_bufferCharacters16[m_length++] = c;
+                return;
+            }
+
+            if (!(c & ~0xff)) {
+                m_bufferCharacters8[m_length++] = static_cast<LChar>(c);
+                return;
+            }
+        }
+        append(&c, 1);
     }
 
     void append(LChar c)
diff --git a/Source/WTF/wtf/text/StringImpl.cpp b/Source/WTF/wtf/text/StringImpl.cpp
index 23a05f17f..2ff3b5fb9 100644
--- a/Source/WTF/wtf/text/StringImpl.cpp
+++ b/Source/WTF/wtf/text/StringImpl.cpp
@@ -261,6 +261,23 @@ PassRefPtr<StringImpl> StringImpl::create(const LChar* characters, unsigned leng
     return string.release();
 }
 
+PassRefPtr<StringImpl> StringImpl::create8BitIfPossible(const UChar* characters, unsigned length)
+{
+    if (!characters || !length)
+        return empty();
+
+    LChar* data;
+    RefPtr<StringImpl> string = createUninitialized(length, data);
+
+    for (size_t i = 0; i < length; ++i) {
+        if (characters[i] & 0xff00)
+            return create(characters, length);
+        data[i] = static_cast<LChar>(characters[i]);
+    }
+
+    return string.release();
+}
+
 PassRefPtr<StringImpl> StringImpl::create(const LChar* string)
 {
     if (!string)
@@ -1365,21 +1382,30 @@ PassRefPtr<StringImpl> StringImpl::replace(UChar pattern, StringImpl* replacemen
 {
     if (!replacement)
         return this;
-        
-    unsigned repStrLength = replacement->length();
+
+    if (replacement->is8Bit())
+        return replace(pattern, replacement->m_data8, replacement->length());
+
+    return replace(pattern, replacement->m_data16, replacement->length());
+}
+
+PassRefPtr<StringImpl> StringImpl::replace(UChar pattern, const LChar* replacement, unsigned repStrLength)
+{
+    ASSERT(replacement);
+
     size_t srcSegmentStart = 0;
     unsigned matchCount = 0;
-    
+
     // Count the matches.
     while ((srcSegmentStart = find(pattern, srcSegmentStart)) != notFound) {
         ++matchCount;
         ++srcSegmentStart;
     }
-    
+
     // If we have 0 matches then we don't have to do any more work.
     if (!matchCount)
         return this;
-    
+
     if (repStrLength && matchCount > numeric_limits<unsigned>::max() / repStrLength)
         CRASH();
 
@@ -1395,16 +1421,8 @@ PassRefPtr<StringImpl> StringImpl::replace(UChar pattern, StringImpl* replacemen
     unsigned srcSegmentLength;
     srcSegmentStart = 0;
     unsigned dstOffset = 0;
-    bool srcIs8Bit = is8Bit();
-    bool replacementIs8Bit = replacement->is8Bit();
-    
-    // There are 4 cases:
-    // 1. This and replacement are both 8 bit.
-    // 2. This and replacement are both 16 bit.
-    // 3. This is 8 bit and replacement is 16 bit.
-    // 4. This is 16 bit and replacement is 8 bit.
-    if (srcIs8Bit && replacementIs8Bit) {
-        // Case 1
+
+    if (is8Bit()) {
         LChar* data;
         RefPtr<StringImpl> newImpl = createUninitialized(newSize, data);
 
@@ -1412,7 +1430,7 @@ PassRefPtr<StringImpl> StringImpl::replace(UChar pattern, StringImpl* replacemen
             srcSegmentLength = srcSegmentEnd - srcSegmentStart;
             memcpy(data + dstOffset, m_data8 + srcSegmentStart, srcSegmentLength * sizeof(LChar));
             dstOffset += srcSegmentLength;
-            memcpy(data + dstOffset, replacement->m_data8, repStrLength * sizeof(LChar));
+            memcpy(data + dstOffset, replacement, repStrLength * sizeof(LChar));
             dstOffset += repStrLength;
             srcSegmentStart = srcSegmentEnd + 1;
         }
@@ -1430,37 +1448,99 @@ PassRefPtr<StringImpl> StringImpl::replace(UChar pattern, StringImpl* replacemen
 
     while ((srcSegmentEnd = find(pattern, srcSegmentStart)) != notFound) {
         srcSegmentLength = srcSegmentEnd - srcSegmentStart;
-        if (srcIs8Bit) {
-            // Case 3.
-            for (unsigned i = 0; i < srcSegmentLength; i++)
-                data[i + dstOffset] = m_data8[i + srcSegmentStart];
-        } else {
-            // Cases 2 & 4.
-            memcpy(data + dstOffset, m_data16 + srcSegmentStart, srcSegmentLength * sizeof(UChar));
-        }
+        memcpy(data + dstOffset, m_data16 + srcSegmentStart, srcSegmentLength * sizeof(UChar));
+
         dstOffset += srcSegmentLength;
-        if (replacementIs8Bit) {
-            // Case 4.
-            for (unsigned i = 0; i < repStrLength; i++)
-                data[i + dstOffset] = replacement->m_data8[i];
-        } else {
-            // Cases 2 & 3.
-            memcpy(data + dstOffset, replacement->m_data16, repStrLength * sizeof(UChar));
-        }
+        for (unsigned i = 0; i < repStrLength; ++i)
+            data[i + dstOffset] = replacement[i];
+
         dstOffset += repStrLength;
         srcSegmentStart = srcSegmentEnd + 1;
     }
 
     srcSegmentLength = m_length - srcSegmentStart;
-    if (srcIs8Bit) {
-        // Case 3.
-        for (unsigned i = 0; i < srcSegmentLength; i++)
+    memcpy(data + dstOffset, m_data16 + srcSegmentStart, srcSegmentLength * sizeof(UChar));
+
+    ASSERT(dstOffset + srcSegmentLength == newImpl->length());
+
+    return newImpl.release();
+}
+
+PassRefPtr<StringImpl> StringImpl::replace(UChar pattern, const UChar* replacement, unsigned repStrLength)
+{
+    ASSERT(replacement);
+
+    size_t srcSegmentStart = 0;
+    unsigned matchCount = 0;
+
+    // Count the matches.
+    while ((srcSegmentStart = find(pattern, srcSegmentStart)) != notFound) {
+        ++matchCount;
+        ++srcSegmentStart;
+    }
+
+    // If we have 0 matches then we don't have to do any more work.
+    if (!matchCount)
+        return this;
+
+    if (repStrLength && matchCount > numeric_limits<unsigned>::max() / repStrLength)
+        CRASH();
+
+    unsigned replaceSize = matchCount * repStrLength;
+    unsigned newSize = m_length - matchCount;
+    if (newSize >= (numeric_limits<unsigned>::max() - replaceSize))
+        CRASH();
+
+    newSize += replaceSize;
+
+    // Construct the new data.
+    size_t srcSegmentEnd;
+    unsigned srcSegmentLength;
+    srcSegmentStart = 0;
+    unsigned dstOffset = 0;
+
+    if (is8Bit()) {
+        UChar* data;
+        RefPtr<StringImpl> newImpl = createUninitialized(newSize, data);
+
+        while ((srcSegmentEnd = find(pattern, srcSegmentStart)) != notFound) {
+            srcSegmentLength = srcSegmentEnd - srcSegmentStart;
+            for (unsigned i = 0; i < srcSegmentLength; ++i)
+                data[i + dstOffset] = m_data8[i + srcSegmentStart];
+
+            dstOffset += srcSegmentLength;
+            memcpy(data + dstOffset, replacement, repStrLength * sizeof(UChar));
+
+            dstOffset += repStrLength;
+            srcSegmentStart = srcSegmentEnd + 1;
+        }
+
+        srcSegmentLength = m_length - srcSegmentStart;
+        for (unsigned i = 0; i < srcSegmentLength; ++i)
             data[i + dstOffset] = m_data8[i + srcSegmentStart];
-    } else {
-        // Cases 2 & 4.
+
+        ASSERT(dstOffset + srcSegmentLength == newImpl->length());
+
+        return newImpl.release();
+    }
+
+    UChar* data;
+    RefPtr<StringImpl> newImpl = createUninitialized(newSize, data);
+
+    while ((srcSegmentEnd = find(pattern, srcSegmentStart)) != notFound) {
+        srcSegmentLength = srcSegmentEnd - srcSegmentStart;
         memcpy(data + dstOffset, m_data16 + srcSegmentStart, srcSegmentLength * sizeof(UChar));
+
+        dstOffset += srcSegmentLength;
+        memcpy(data + dstOffset, replacement, repStrLength * sizeof(UChar));
+
+        dstOffset += repStrLength;
+        srcSegmentStart = srcSegmentEnd + 1;
     }
 
+    srcSegmentLength = m_length - srcSegmentStart;
+    memcpy(data + dstOffset, m_data16 + srcSegmentStart, srcSegmentLength * sizeof(UChar));
+
     ASSERT(dstOffset + srcSegmentLength == newImpl->length());
 
     return newImpl.release();
diff --git a/Source/WTF/wtf/text/StringImpl.h b/Source/WTF/wtf/text/StringImpl.h
index 0067bebee..53104f831 100644
--- a/Source/WTF/wtf/text/StringImpl.h
+++ b/Source/WTF/wtf/text/StringImpl.h
@@ -67,6 +67,7 @@ struct CharBufferFromLiteralDataTranslator;
 class MemoryObjectInfo;
 struct SubstringTranslator;
 struct UCharBufferTranslator;
+template<typename> class RetainPtr;
 
 enum TextCaseSensitivity { TextCaseSensitive, TextCaseInsensitive };
 
@@ -352,6 +353,7 @@ public:
 
     WTF_EXPORT_STRING_API static PassRefPtr<StringImpl> create(const UChar*, unsigned length);
     WTF_EXPORT_STRING_API static PassRefPtr<StringImpl> create(const LChar*, unsigned length);
+    WTF_EXPORT_STRING_API static PassRefPtr<StringImpl> create8BitIfPossible(const UChar*, unsigned length);
     ALWAYS_INLINE static PassRefPtr<StringImpl> create(const char* s, unsigned length) { return create(reinterpret_cast<const LChar*>(s), length); }
     WTF_EXPORT_STRING_API static PassRefPtr<StringImpl> create(const LChar*);
     ALWAYS_INLINE static PassRefPtr<StringImpl> create(const char* s) { return create(reinterpret_cast<const LChar*>(s)); }
@@ -707,13 +709,16 @@ public:
 
     WTF_EXPORT_STRING_API PassRefPtr<StringImpl> replace(UChar, UChar);
     WTF_EXPORT_STRING_API PassRefPtr<StringImpl> replace(UChar, StringImpl*);
+    ALWAYS_INLINE PassRefPtr<StringImpl> replace(UChar pattern, const char* replacement, unsigned replacementLength) { return replace(pattern, reinterpret_cast<const LChar*>(replacement), replacementLength); }
+    WTF_EXPORT_STRING_API PassRefPtr<StringImpl> replace(UChar, const LChar*, unsigned replacementLength);
+    PassRefPtr<StringImpl> replace(UChar, const UChar*, unsigned replacementLength);
     WTF_EXPORT_STRING_API PassRefPtr<StringImpl> replace(StringImpl*, StringImpl*);
     WTF_EXPORT_STRING_API PassRefPtr<StringImpl> replace(unsigned index, unsigned len, StringImpl*);
 
     WTF_EXPORT_STRING_API WTF::Unicode::Direction defaultWritingDirection(bool* hasStrongDirectionality = 0);
 
 #if USE(CF)
-    CFStringRef createCFString();
+    RetainPtr<CFStringRef> createCFString();
 #endif
 #ifdef __OBJC__
     operator NSString*();
diff --git a/Source/WTF/wtf/text/WTFString.cpp b/Source/WTF/wtf/text/WTFString.cpp
index 16a6a45e5..e10282de2 100644
--- a/Source/WTF/wtf/text/WTFString.cpp
+++ b/Source/WTF/wtf/text/WTFString.cpp
@@ -665,11 +665,6 @@ void String::split(const String& separator, bool allowEmptyEntries, Vector<Strin
         result.append(substring(startPos));
 }
 
-void String::split(const String& separator, Vector<String>& result) const
-{
-    split(separator, false, result);
-}
-
 void String::split(UChar separator, bool allowEmptyEntries, Vector<String>& result) const
 {
     result.clear();
@@ -685,11 +680,6 @@ void String::split(UChar separator, bool allowEmptyEntries, Vector<String>& resu
         result.append(substring(startPos));
 }
 
-void String::split(UChar separator, Vector<String>& result) const
-{
-    split(String(&separator, 1), false, result);
-}
-
 CString String::ascii() const
 {
     // Printable ASCII characters 32..127 and the null character are
diff --git a/Source/WTF/wtf/text/WTFString.h b/Source/WTF/wtf/text/WTFString.h
index 50c048d63..a5e337876 100644
--- a/Source/WTF/wtf/text/WTFString.h
+++ b/Source/WTF/wtf/text/WTFString.h
@@ -32,10 +32,6 @@
 #include <objc/objc.h>
 #endif
 
-#if USE(CF)
-typedef const struct __CFString * CFStringRef;
-#endif
-
 #if PLATFORM(QT)
 QT_BEGIN_NAMESPACE
 class QString;
@@ -311,6 +307,15 @@ public:
     String& replace(const String& a, const String& b) { if (m_impl) m_impl = m_impl->replace(a.impl(), b.impl()); return *this; }
     String& replace(unsigned index, unsigned len, const String& b) { if (m_impl) m_impl = m_impl->replace(index, len, b.impl()); return *this; }
 
+    template<unsigned charactersCount>
+    ALWAYS_INLINE String& replaceWithLiteral(UChar a, const char (&characters)[charactersCount])
+    {
+        if (m_impl)
+            m_impl = m_impl->replace(a, characters, charactersCount - 1);
+
+        return *this;
+    }
+
     void makeLower() { if (m_impl) m_impl = m_impl->lower(); }
     void makeUpper() { if (m_impl) m_impl = m_impl->upper(); }
     void fill(UChar c) { if (m_impl) m_impl = m_impl->fill(c); }
@@ -350,10 +355,16 @@ public:
     static String createUninitialized(unsigned length, UChar*& data) { return StringImpl::createUninitialized(length, data); }
     static String createUninitialized(unsigned length, LChar*& data) { return StringImpl::createUninitialized(length, data); }
 
-    WTF_EXPORT_STRING_API void split(const String& separator, Vector<String>& result) const;
     WTF_EXPORT_STRING_API void split(const String& separator, bool allowEmptyEntries, Vector<String>& result) const;
-    WTF_EXPORT_STRING_API void split(UChar separator, Vector<String>& result) const;
+    void split(const String& separator, Vector<String>& result) const
+    {
+        split(separator, false, result);
+    }
     WTF_EXPORT_STRING_API void split(UChar separator, bool allowEmptyEntries, Vector<String>& result) const;
+    void split(UChar separator, Vector<String>& result) const
+    {
+        split(separator, false, result);
+    }
 
     WTF_EXPORT_STRING_API int toIntStrict(bool* ok = 0, int base = 10) const;
     WTF_EXPORT_STRING_API unsigned toUIntStrict(bool* ok = 0, int base = 10) const;
@@ -386,7 +397,7 @@ public:
 
 #if USE(CF)
     String(CFStringRef);
-    CFStringRef createCFString() const;
+    RetainPtr<CFStringRef> createCFString() const;
 #endif
 
 #ifdef __OBJC__
diff --git a/Source/WTF/wtf/unicode/UTF8.cpp b/Source/WTF/wtf/unicode/UTF8.cpp
index cb3039a53..6e74f01cc 100644
--- a/Source/WTF/wtf/unicode/UTF8.cpp
+++ b/Source/WTF/wtf/unicode/UTF8.cpp
@@ -275,8 +275,7 @@ static bool isLegalUTF8(const unsigned char* source, int length)
 // Magic values subtracted from a buffer value during UTF8 conversion.
 // This table contains as many values as there might be trailing bytes
 // in a UTF-8 sequence.
-static const UChar32 offsetsFromUTF8[6] = { 0x00000000UL, 0x00003080UL, 0x000E2080UL, 
-            0x03C82080UL, 0xFA082080UL, 0x82082080UL };
+static const UChar32 offsetsFromUTF8[6] = { 0x00000000UL, 0x00003080UL, 0x000E2080UL, 0x03C82080UL, static_cast<UChar32>(0xFA082080UL), static_cast<UChar32>(0x82082080UL) };
 
 static inline UChar32 readUTF8Sequence(const char*& sequence, unsigned length)
 {
@@ -363,7 +362,7 @@ ConversionResult convertUTF8ToUTF16(
     *targetStart = target;
 
     if (sourceAllASCII)
-        *sourceAllASCII = !(orAllData & 0x7f);
+        *sourceAllASCII = !(orAllData & ~0x7f);
 
     return result;
 }
diff --git a/Source/WTF/wtf/unicode/glib/UnicodeGLib.cpp b/Source/WTF/wtf/unicode/glib/UnicodeGLib.cpp
index a01c3ee9d..80409852d 100644
--- a/Source/WTF/wtf/unicode/glib/UnicodeGLib.cpp
+++ b/Source/WTF/wtf/unicode/glib/UnicodeGLib.cpp
@@ -94,7 +94,8 @@ static int convertCase(UChar* result, int resultLength, const UChar* src, int sr
     // Convert the result to UTF-16.
     UChar* utf16Target = result;
     const char* utf8Source = utf8Result.get();
-    conversionResult = convertUTF8ToUTF16(&utf8Source, utf8Source + utf8ResultLength, &utf16Target, utf16Target + resultLength, true);
+    bool unusedISAllASCII;
+    conversionResult = convertUTF8ToUTF16(&utf8Source, utf8Source + utf8ResultLength, &utf16Target, utf16Target + resultLength, &unusedIsAllASCII, true);
     long utf16ResultLength = utf16Target - result;
     if (conversionResult != conversionOK)
         *error = true;
diff --git a/Source/WTF/wtf/url/api/ParsedURL.cpp b/Source/WTF/wtf/url/api/ParsedURL.cpp
index a20be39f1..c4a56699b 100644
--- a/Source/WTF/wtf/url/api/ParsedURL.cpp
+++ b/Source/WTF/wtf/url/api/ParsedURL.cpp
@@ -34,6 +34,7 @@
 #include <wtf/URLComponent.h>
 #include <wtf/URLUtil.h>
 #include <wtf/text/CString.h>
+#include <wtf/text/StringImpl.h>
 
 namespace WTF {
 
@@ -171,6 +172,84 @@ String ParsedURL::port() const
     return segment(m_segments.port);
 }
 
+template<typename CharacterType>
+static inline String generateNewSpecWithPort(const String& spec, unsigned newSpecLength, unsigned portDelimiterPosition, const LChar* portString, unsigned portStringLength, unsigned postPortPositionInSource)
+{
+    ASSERT(newSpecLength == portDelimiterPosition + 1 + portStringLength + (spec.length() - postPortPositionInSource));
+
+    CharacterType* buffer;
+    String newSpec = StringImpl::createUninitialized(newSpecLength, buffer);
+
+    // Copy everything prior to the port posisiton.
+    ASSERT(buffer + portDelimiterPosition < buffer + newSpecLength);
+    StringImpl::copyChars(buffer, spec.getCharacters<CharacterType>(), portDelimiterPosition);
+
+    // Add the new port from the position.
+    buffer[portDelimiterPosition] = ':';
+    unsigned portPosition = portDelimiterPosition + 1;
+    ASSERT(buffer + portPosition + portStringLength <= buffer + newSpecLength);
+    StringImpl::copyChars(buffer + portPosition, portString, portStringLength);
+
+    // Copy the character post-port from the source.
+    unsigned remainingComponentsPositionInDestination = portPosition + portStringLength;
+    ASSERT(buffer + remainingComponentsPositionInDestination + (spec.length() - postPortPositionInSource) == buffer + newSpecLength);
+    StringImpl::copyChars(buffer + remainingComponentsPositionInDestination, &(spec.getCharacters<CharacterType>()[postPortPositionInSource]), spec.length() - postPortPositionInSource);
+
+    return newSpec;
+}
+
+static inline void replacePortWithString(String& spec, URLSegments& segments, const LChar* portString, unsigned portStringLength)
+{
+    // Compute the new spec length.
+    int lengthDifference;
+    const URLComponent oldPortComponent = segments.port;
+    if (oldPortComponent.isValid())
+        lengthDifference = portStringLength - oldPortComponent.length();
+    else
+        lengthDifference = 1 + portStringLength;
+    unsigned newLength = spec.length() + lengthDifference;
+
+    // Find the substring positions for the generator template.
+    int portDelimiterPosition = segments.charactersBefore(URLSegments::Port, URLSegments::DelimiterIncluded);
+    ASSERT(portDelimiterPosition > 0);
+
+    unsigned postPortPositionInSource;
+    if (oldPortComponent.isValid())
+        postPortPositionInSource = oldPortComponent.end();
+    else
+        postPortPositionInSource = portDelimiterPosition;
+
+    // Create the new spec with portString.
+    if (spec.is8Bit())
+        spec = generateNewSpecWithPort<LChar>(spec, newLength, static_cast<unsigned>(portDelimiterPosition), portString, portStringLength, postPortPositionInSource);
+    else
+        spec = generateNewSpecWithPort<UChar>(spec, newLength, static_cast<unsigned>(portDelimiterPosition), portString, portStringLength, postPortPositionInSource);
+
+    // Update the URL components.
+    unsigned portPosition = portDelimiterPosition + 1;
+    segments.port.setBegin(portPosition);
+    segments.port.setLength(portStringLength);
+    segments.moveFromComponentBy(URLSegments::Path, lengthDifference);
+}
+
+
+void ParsedURL::replacePort(unsigned short newPort)
+{
+    ASSERT(hasStandardScheme());
+
+    // Generate a char* string for the port number.
+    LChar buf[5];
+    LChar* end = buf + WTF_ARRAY_LENGTH(buf);
+    LChar* p = end;
+    do {
+        *--p = static_cast<LChar>((newPort % 10) + '0');
+        newPort /= 10;
+    } while (newPort);
+    const unsigned portStringLength = end - p;
+
+    replacePortWithString(m_spec.m_string, m_segments, p, portStringLength);
+}
+
 void ParsedURL::removePort()
 {
     if (!hasPort())
diff --git a/Source/WTF/wtf/url/api/ParsedURL.h b/Source/WTF/wtf/url/api/ParsedURL.h
index 37767d34e..c2cbb9cd2 100644
--- a/Source/WTF/wtf/url/api/ParsedURL.h
+++ b/Source/WTF/wtf/url/api/ParsedURL.h
@@ -62,6 +62,7 @@ public:
 
     WTF_EXPORT_PRIVATE bool hasPort() const;
     WTF_EXPORT_PRIVATE String port() const;
+    WTF_EXPORT_PRIVATE void replacePort(unsigned short newPort);
     WTF_EXPORT_PRIVATE void removePort();
 
     WTF_EXPORT_PRIVATE String path() const;
diff --git a/Source/WebCore/CMakeLists.txt b/Source/WebCore/CMakeLists.txt
index 47b29e664..03b03b114 100644
--- a/Source/WebCore/CMakeLists.txt
+++ b/Source/WebCore/CMakeLists.txt
@@ -406,9 +406,6 @@ SET(WebCore_IDL_FILES
     dom/WebKitTransitionEvent.idl
     dom/WheelEvent.idl
 
-    editing/DOMTransaction.idl
-    editing/UndoManager.idl
-
     fileapi/Blob.idl
     fileapi/File.idl
     fileapi/FileError.idl
@@ -1001,6 +998,7 @@ SET(WebCore_SOURCES
     accessibility/AccessibilityScrollView.cpp
     accessibility/AccessibilitySpinButton.cpp
     accessibility/AccessibilitySlider.cpp
+    accessibility/AccessibilitySVGRoot.cpp
     accessibility/AccessibilityTable.cpp
     accessibility/AccessibilityTableCell.cpp
     accessibility/AccessibilityTableColumn.cpp
@@ -1102,6 +1100,7 @@ SET(WebCore_SOURCES
     css/WebKitCSSSVGDocumentValue.cpp
     css/WebKitCSSShaderValue.cpp
     css/WebKitCSSTransformValue.cpp
+    css/WebKitCSSViewportRule.cpp
 
     dom/ActiveDOMObject.cpp
     dom/Attr.cpp
@@ -1152,8 +1151,9 @@ SET(WebCore_SOURCES
     dom/DynamicNodeList.cpp
     dom/EditingText.cpp
     dom/Element.cpp
-    dom/ElementShadow.cpp
     dom/ElementAttributeData.cpp
+    dom/ElementRareData.cpp
+    dom/ElementShadow.cpp
     dom/EntityReference.cpp
     dom/ErrorEvent.cpp
     dom/Event.cpp
@@ -1191,6 +1191,7 @@ SET(WebCore_SOURCES
     dom/NodeFilterCondition.cpp
     dom/NodeFilter.cpp
     dom/NodeIterator.cpp
+    dom/NodeRareData.cpp
     dom/NodeRenderingContext.cpp
     dom/Notation.cpp
     dom/OverflowEvent.cpp
@@ -1253,7 +1254,6 @@ SET(WebCore_SOURCES
     editing/BreakBlockquoteCommand.cpp
     editing/CompositeEditCommand.cpp
     editing/CreateLinkCommand.cpp
-    editing/DOMTransactionStep.cpp
     editing/DeleteButton.cpp
     editing/DeleteButtonController.cpp
     editing/DeleteFromTextNodeCommand.cpp
@@ -1298,7 +1298,6 @@ SET(WebCore_SOURCES
     editing/TextInsertionBaseCommand.cpp
     editing/TextIterator.cpp
     editing/TypingCommand.cpp
-    editing/UndoManager.cpp
     editing/UnlinkCommand.cpp
     editing/VisiblePosition.cpp
     editing/VisibleSelection.cpp
@@ -1329,6 +1328,7 @@ SET(WebCore_SOURCES
 
     html/BaseButtonInputType.cpp
     html/BaseCheckableInputType.cpp
+    html/BaseChooserOnlyDateAndTimeInputType.cpp
     html/BaseClickableWithKeyInputType.cpp
     html/BaseDateAndTimeInputType.cpp
     html/BaseMultipleFieldsDateAndTimeInputType.cpp
@@ -1621,6 +1621,7 @@ SET(WebCore_SOURCES
     inspector/WorkerInspectorController.cpp
     inspector/WorkerRuntimeAgent.cpp
 
+    loader/CachedMetadata.cpp
     loader/CrossOriginAccessControl.cpp
     loader/CrossOriginPreflightResultCache.cpp
     loader/DocumentLoadTiming.cpp
@@ -1636,6 +1637,7 @@ SET(WebCore_SOURCES
     loader/HistoryController.cpp
     loader/ImageLoader.cpp
     loader/LinkLoader.cpp
+    loader/LoaderStrategy.cpp
     loader/MainResourceLoader.cpp
     loader/MixedContentChecker.cpp
     loader/NavigationAction.cpp
@@ -1910,8 +1912,11 @@ SET(WebCore_SOURCES
     platform/graphics/filters/CustomFilterGlobalContext.cpp
     platform/graphics/filters/CustomFilterMesh.cpp
     platform/graphics/filters/CustomFilterOperation.cpp
+    platform/graphics/filters/CustomFilterParameterList.cpp
+    platform/graphics/filters/ValidatedCustomFilterOperation.cpp
     platform/graphics/filters/CustomFilterProgram.cpp
     platform/graphics/filters/CustomFilterProgramInfo.cpp
+    platform/graphics/filters/CustomFilterRenderer.cpp
     platform/graphics/filters/DistantLightSource.cpp
     platform/graphics/filters/FEBlend.cpp
     platform/graphics/filters/FEColorMatrix.cpp
@@ -2019,7 +2024,7 @@ SET(WebCore_SOURCES
     platform/text/LineEnding.cpp
     platform/text/LocaleNone.cpp
     platform/text/LocaleToScriptMappingDefault.cpp
-    platform/text/Localizer.cpp
+    platform/text/PlatformLocale.cpp
     platform/text/QuotedPrintable.cpp
     platform/text/RegularExpression.cpp
     platform/text/SegmentedString.cpp
@@ -2150,6 +2155,7 @@ SET(WebCore_SOURCES
     rendering/RenderWordBreak.cpp
     rendering/RootInlineBox.cpp
     rendering/ScrollBehavior.cpp
+    rendering/TextAutosizer.cpp
     rendering/break_lines.cpp
 
     rendering/mathml/RenderMathMLBlock.cpp
@@ -2831,12 +2837,6 @@ ADD_CUSTOM_COMMAND(
     VERBATIM)
 LIST(APPEND WebCore_SOURCES ${DERIVED_SOURCES_WEBCORE_DIR}/HTMLEntityTable.cpp)
 
-SET(FEATURE_DEFINES_CSS ${FEATURE_DEFINES_WITH_SPACE_SEPARATOR})
-IF (CMAKE_SYSTEM_NAME MATCHES "QNX")
-    # filter out color input since we have our own solution
-    STRING(REPLACE "ENABLE_INPUT_TYPE_COLOR" "" FEATURE_DEFINES_CSS "${FEATURE_DEFINES_CSS}")
-ENDIF()
-
 # Generate CSS property names
 ADD_CUSTOM_COMMAND (
     OUTPUT ${DERIVED_SOURCES_WEBCORE_DIR}/CSSPropertyNames.in ${DERIVED_SOURCES_WEBCORE_DIR}/CSSPropertyNames.h ${DERIVED_SOURCES_WEBCORE_DIR}/CSSPropertyNames.cpp ${DERIVED_SOURCES_WEBCORE_DIR}/CSSPropertyNames.gperf
@@ -2844,7 +2844,7 @@ ADD_CUSTOM_COMMAND (
     DEPENDS ${WebCore_CSS_PROPERTY_NAMES}
     WORKING_DIRECTORY ${DERIVED_SOURCES_WEBCORE_DIR}
     COMMAND ${PERL_EXECUTABLE} -ne "print" ${WebCore_CSS_PROPERTY_NAMES} > ${DERIVED_SOURCES_WEBCORE_DIR}/CSSPropertyNames.in
-    COMMAND ${PERL_EXECUTABLE} -I${WEBCORE_DIR}/bindings/scripts ${WEBCORE_DIR}/css/makeprop.pl --defines "${FEATURE_DEFINES_CSS}" --preprocessor "${CODE_GENERATOR_PREPROCESSOR}"
+    COMMAND ${PERL_EXECUTABLE} -I${WEBCORE_DIR}/bindings/scripts ${WEBCORE_DIR}/css/makeprop.pl --defines "${FEATURE_DEFINES_WITH_SPACE_SEPARATOR}" --preprocessor "${CODE_GENERATOR_PREPROCESSOR}"
     VERBATIM)
 LIST(APPEND WebCore_SOURCES ${DERIVED_SOURCES_WEBCORE_DIR}/CSSPropertyNames.cpp)
 ADD_SOURCE_WEBCORE_DERIVED_DEPENDENCIES(${WEBCORE_DIR}/css/CSSParser.cpp CSSValueKeywords.h)
@@ -2858,7 +2858,7 @@ ADD_CUSTOM_COMMAND (
     DEPENDS ${WebCore_CSS_VALUE_KEYWORDS}
     WORKING_DIRECTORY ${DERIVED_SOURCES_WEBCORE_DIR}
     COMMAND ${PERL_EXECUTABLE} -ne "print" ${WebCore_CSS_VALUE_KEYWORDS} > ${DERIVED_SOURCES_WEBCORE_DIR}/CSSValueKeywords.in
-    COMMAND ${PERL_EXECUTABLE} -I${WEBCORE_DIR}/bindings/scripts ${WEBCORE_DIR}/css/makevalues.pl --defines "${FEATURE_DEFINES_CSS}" --preprocessor "${CODE_GENERATOR_PREPROCESSOR}"
+    COMMAND ${PERL_EXECUTABLE} -I${WEBCORE_DIR}/bindings/scripts ${WEBCORE_DIR}/css/makevalues.pl --defines "${FEATURE_DEFINES_WITH_SPACE_SEPARATOR}" --preprocessor "${CODE_GENERATOR_PREPROCESSOR}"
     VERBATIM)
 LIST(APPEND WebCore_SOURCES ${DERIVED_SOURCES_WEBCORE_DIR}/CSSValueKeywords.cpp)
 ADD_SOURCE_WEBCORE_DERIVED_DEPENDENCIES(${WEBCORE_DIR}/css/CSSParser.cpp CSSValueKeywords.h)
@@ -2870,7 +2870,7 @@ ADD_CUSTOM_COMMAND(
     OUTPUT ${DERIVED_SOURCES_WEBCORE_DIR}/UserAgentStyleSheetsData.cpp ${DERIVED_SOURCES_WEBCORE_DIR}/UserAgentStyleSheets.h
     MAIN_DEPENDENCY ${WEBCORE_DIR}/css/make-css-file-arrays.pl
     DEPENDS ${WebCore_USER_AGENT_STYLE_SHEETS} ${WEBCORE_DIR}/bindings/scripts/preprocessor.pm
-    COMMAND ${PERL_EXECUTABLE} -I${WEBCORE_DIR}/bindings/scripts ${WEBCORE_DIR}/css/make-css-file-arrays.pl --defines "${FEATURE_DEFINES_CSS}" --preprocessor "${CODE_GENERATOR_PREPROCESSOR}" ${DERIVED_SOURCES_WEBCORE_DIR}/UserAgentStyleSheets.h ${DERIVED_SOURCES_WEBCORE_DIR}/UserAgentStyleSheetsData.cpp ${WebCore_USER_AGENT_STYLE_SHEETS}
+    COMMAND ${PERL_EXECUTABLE} -I${WEBCORE_DIR}/bindings/scripts ${WEBCORE_DIR}/css/make-css-file-arrays.pl --defines "${FEATURE_DEFINES_WITH_SPACE_SEPARATOR}" --preprocessor "${CODE_GENERATOR_PREPROCESSOR}" ${DERIVED_SOURCES_WEBCORE_DIR}/UserAgentStyleSheets.h ${DERIVED_SOURCES_WEBCORE_DIR}/UserAgentStyleSheetsData.cpp ${WebCore_USER_AGENT_STYLE_SHEETS}
     VERBATIM)
 LIST(APPEND WebCore_SOURCES ${DERIVED_SOURCES_WEBCORE_DIR}/UserAgentStyleSheetsData.cpp)
 ADD_SOURCE_WEBCORE_DERIVED_DEPENDENCIES(${WEBCORE_DIR}/css/StyleResolver.cpp UserAgentStyleSheetsData.cpp UserAgentStyleSheets.h)
diff --git a/Source/WebCore/ChangeLog b/Source/WebCore/ChangeLog
index c654f137d..b08ece40e 100644
--- a/Source/WebCore/ChangeLog
+++ b/Source/WebCore/ChangeLog
@@ -1,3 +1,17823 @@
+2012-11-07  Simon Hausmann  <simon.hausmann@digia.com>
+
+        [Qt] Unreviewed trivial build fix adapting to QtMultimedia API changes
+
+        The QtMultimedia namespace is now called QMultimedia and
+        QtMultimedia::MetaData is now QMediaMetaData.
+
+        * platform/graphics/qt/MediaPlayerPrivateQt.cpp:
+        (WebCore::MediaPlayerPrivateQt::supportsType):
+        (WebCore::MediaPlayerPrivateQt::totalBytes):
+
+2012-11-07  Christophe Dumez  <christophe.dumez@intel.com>
+
+        Add replaceWithLiteral() method to WTF::String
+        https://bugs.webkit.org/show_bug.cgi?id=101257
+
+        Reviewed by Benjamin Poulain.
+
+        Substitute String::replace() calls by String::replaceWithLiteral() where
+        adequate, for efficiency.
+
+        No new tests, no behavior change.
+
+        * dom/Node.cpp:
+        (WebCore::Node::showNode):
+        * editing/EditingStyle.cpp:
+        (WebCore::StyleChange::extractTextStyles):
+        * editing/MarkupAccumulator.cpp:
+        (WebCore::MarkupAccumulator::appendQuotedURLAttributeValue):
+        * html/HTMLAnchorElement.cpp:
+        (WebCore::HTMLAnchorElement::setSearch):
+        * loader/FormSubmission.cpp:
+        (WebCore::appendMailtoPostFormDataToURL):
+        * platform/network/soup/ProxyResolverSoup.cpp:
+        (soupProxyResolverWkSetProperty):
+        * plugins/PluginView.cpp:
+        (WebCore::makeURL):
+        * rendering/InlineTextBox.cpp:
+        (WebCore::InlineTextBox::showBox):
+        * xml/XSLTProcessor.cpp:
+        (WebCore::transformTextStringToXHTMLDocumentString):
+
+2012-11-07  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Remove support for "desktop-width" in the viewport meta tag
+        https://bugs.webkit.org/show_bug.cgi?id=101217
+
+        Reviewed by Gyuyoung Kim.
+
+        This has been removed from the CSS Device Adaptation spec, and
+        should be safe to remove as it is not documented anywhere (neither
+        in blog posts).
+
+        The viewport meta should only support the legacy features.
+
+        * dom/ViewportArguments.cpp:
+        (WebCore::computeViewportAttributes):
+        (WebCore::findSizeValue):
+        (WebCore::findScaleValue):
+        (WebCore::findUserScalableValue):
+        * dom/ViewportArguments.h:
+
+2012-11-07  Dominik Röttsches  <dominik.rottsches@intel.com>
+
+        [EFL] Fix execution of exif-orientation-image-document.html on EFL Wk2 bot
+        https://bugs.webkit.org/show_bug.cgi?id=101343
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Add Cairo to the list of backends that support shouldRespectImageOrientation.
+
+        No new tests, fixes exif-orientation-image-document.html.
+
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::shouldRespectImageOrientation):
+
+2012-11-06  Yury Semikhatsky  <yurys@chromium.org>
+
+        Console not displaying all properties of an Object once native Constructor overwritten
+        https://bugs.webkit.org/show_bug.cgi?id=101320
+
+        Reviewed by Pavel Feldman.
+
+        Use Object instance from {}.constructor when formatting inspector messages in the
+        injected script. Otherwise inspected page may overwrite Object value and break inspector.
+
+        Test: inspector/console/console-Object-overwritten.html
+
+        * inspector/InjectedScriptSource.js:
+
+2012-11-06  Keishi Hattori  <keishi@webkit.org>
+
+        Implement month picking to calendar picker
+        https://bugs.webkit.org/show_bug.cgi?id=101333
+
+        Reviewed by Kent Tamura.
+
+        This adds month picker mode to CalendarPicker.
+
+        No new tests. Tests will be added later when this feature is enabled in DRT.
+
+        * Resources/pagepopups/calendarPicker.css:
+        (.month-mode .day): Remove rounded corners when in month mode.
+        * Resources/pagepopups/calendarPicker.js:
+        (Month.createFromToday): Creates month containing today.
+        (CalendarPicker): Set this.selectionConstructor to Day or Month depending on the mode. Create DayTables or MonthPickerDaysTable depending on the mode.
+        (CalendarPicker.prototype.handleToday):
+        (CalendarPicker.prototype._layoutButtons):
+        (DaysTable.prototype._renderMonth): Set element.dataset.monthValue for all date nodes.
+        (DaysTable.prototype._markRangeAsSelected): Marks all day nodes in range as selected.
+        (DaysTable.prototype.selectRange): Selects a day.
+        (DaysTable.prototype.selectRangeAndShowEntireRange): Same as selectRange.
+        (DaysTable.prototype._selectRangeContainingNode):
+        (DaysTable.prototype._rangeForNode): Returns Day for node.
+        (DaysTable.prototype.startDate): Start datetime of visible date range. This value is inclusive.
+        (DaysTable.prototype.endDate): End datetime of visible date range. This value is exclusive.
+        (DaysTable.prototype._handleKey):
+        (MonthPickerDaysTable):
+        (MonthPickerDaysTable.prototype._markRangeAsSelected): Marks all day nodes in range as selected.
+        (MonthPickerDaysTable.prototype.selectRange): Selects month. If month is not visible, navigates to that month.
+        (MonthPickerDaysTable.prototype.selectRangeAndShowEntireRange): Selects month. Navigates to the month.
+        (MonthPickerDaysTable.prototype._rangeForNode): Returns Month for node.
+        (MonthPickerDaysTable.prototype._handleKey): Arrow keys simply move the selection forwards or backwards.
+
+2012-11-06  Dan Beam  <dbeam@chromium.org>
+
+        Enable REQUEST_AUTOCOMPLETE for chromium port
+        https://bugs.webkit.org/show_bug.cgi?id=101376
+
+        Reviewed by Adam Barth.
+
+        Added a runtime enabled feature to control whether HTMLFormElement#requestAutocomplete is visible from JavaScript.
+
+        * bindings/generic/RuntimeEnabledFeatures.cpp:
+        (WebCore):
+        * bindings/generic/RuntimeEnabledFeatures.h:
+        (RuntimeEnabledFeatures):
+
+        Added a binding from RuntimeEnabledFeatures that triggers [V8EnabledAtRuntime=requestAutocomplete].
+
+        (WebCore::RuntimeEnabledFeatures::requestAutocompleteEnabled):
+
+        Added a getter to WebCore to ask whether the runtime flag requestAutocomplete is on.
+
+        (WebCore::RuntimeEnabledFeatures::setRequestAutocompleteEnabled):
+
+        Added a setter to WebCore to affect the runtime flag requestAutocomplete.
+
+        * html/HTMLFormElement.idl:
+
+        Wrapped commonly grouped features in an #if defined(ENABLED_REQUEST_AUTOCOMPLETE) block and added [V8EnableAtRuntime]
+        so these features can be changed with a command line switch in the chromium port.
+
+2012-11-06  Adam Barth  <abarth@webkit.org>
+
+        [V8] Unify setJSWrapperForDOMObject and setJSWrapperForDOMNode
+        https://bugs.webkit.org/show_bug.cgi?id=101422
+
+        Reviewed by Kentaro Hara.
+
+        This patch is another incremental step towards the patch in Bug 10110.
+        In this step, we unify setJSWrapperForDOMObject and
+        setJSWrapperForDOMNode.
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+        (GenerateHeader):
+        (GenerateNormalAttrGetter):
+        (GenerateConstructorCallback):
+        (GenerateNamedConstructorCallback):
+        (GenerateToV8Converters):
+        * bindings/scripts/test/V8/V8Float64Array.h:
+        (WebCore::V8Float64Array::wrap):
+        * bindings/scripts/test/V8/V8TestActiveDOMObject.h:
+        (WebCore::V8TestActiveDOMObject::wrap):
+        * bindings/scripts/test/V8/V8TestCustomNamedGetter.h:
+        (WebCore::V8TestCustomNamedGetter::wrap):
+        * bindings/scripts/test/V8/V8TestEventConstructor.h:
+        (WebCore::V8TestEventConstructor::wrap):
+        * bindings/scripts/test/V8/V8TestEventTarget.h:
+        (WebCore::V8TestEventTarget::wrap):
+        * bindings/scripts/test/V8/V8TestException.h:
+        (WebCore::V8TestException::wrap):
+        * bindings/scripts/test/V8/V8TestInterface.h:
+        (WebCore::V8TestInterface::wrap):
+        * bindings/scripts/test/V8/V8TestMediaQueryListListener.h:
+        (WebCore::V8TestMediaQueryListListener::wrap):
+        * bindings/scripts/test/V8/V8TestNamedConstructor.h:
+        (WebCore::V8TestNamedConstructor::wrap):
+        * bindings/scripts/test/V8/V8TestNode.cpp:
+        (WebCore::V8TestNode::constructorCallback):
+        (WebCore::V8TestNode::wrapSlow):
+        * bindings/scripts/test/V8/V8TestObj.cpp:
+        (WebCore::TestObjV8Internal::readOnlyTestObjAttrAttrGetter):
+        * bindings/scripts/test/V8/V8TestObj.h:
+        (WebCore::V8TestObj::wrap):
+        * bindings/scripts/test/V8/V8TestSerializedScriptValueInterface.h:
+        (WebCore::V8TestSerializedScriptValueInterface::wrap):
+        * bindings/v8/DOMDataStore.cpp:
+        (WebCore::DOMDataStore::current):
+        * bindings/v8/DOMDataStore.h:
+        (WebCore::DOMDataStore::get):
+        (DOMDataStore):
+        * bindings/v8/V8DOMWrapper.cpp:
+        * bindings/v8/V8DOMWrapper.h:
+        (V8DOMWrapper):
+        (WebCore::V8DOMWrapper::setJSWrapperPrivate):
+        (WebCore::V8DOMWrapper::setJSWrapperForDOMObject):
+        * bindings/v8/custom/V8HTMLImageElementConstructor.cpp:
+        (WebCore::v8HTMLImageElementConstructorCallback):
+
+2012-11-06  Ken Buchanan  <kenrb@chromium.org>
+
+        Crash due to column span under button element
+        https://bugs.webkit.org/show_bug.cgi?id=101402
+
+        Reviewed by Abhishek Arya.
+
+        When there is a column-spanning child of a RenderButton
+        splitBlocks() must split the RenderButton as well as its
+        only permitted direct child, the anonymous block referenced
+        by m_inner. A crash was occurring because splitBlocks()
+        calls addChildIgnoringAnonymousColumnBlocks() to add the
+        cloned m_inner to the cloned RenderButton, which meant the
+        m_inner for the cloned RenderButton was not being set even
+        though a child was being added. This violates state
+        assumptions in the RenderButton code.
+
+        This patch prevents any descendants of RenderButton from
+        spanning columns. Also, it adds a precautionary check in
+        RenderButton::removeChild() to mitigate problems if similar
+        state problems are found in future.
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::containingColumnsBlock):
+        * rendering/RenderButton.cpp:
+        (WebCore::RenderButton::removeChild):
+
+2012-11-06  Shinya Kawanaka  <shinyak@chromium.org>
+
+        [Shadow] Pseudo custom-elements should start with 'x-'.
+        https://bugs.webkit.org/show_bug.cgi?id=100919
+
+        Reviewed by Dimitri Glazkov.
+
+        Pseuco custom-elements should start with 'x-'. 'Pseudo' starting with '-webkit-' should work
+        only in UserAgent ShadowDOM. If it's used in Author ShadowDOM, it should not work.
+
+        Test: fast/dom/shadow/pseudo-attribute-rendering.html
+
+        * css/SelectorChecker.cpp:
+        (WebCore::SelectorChecker::checkSelector): Added ShadowRoot type check.
+
+2012-11-06  Chris Evans  <cevans@google.com>
+
+        Re-order variables in BidiRun and LayoutState
+        https://bugs.webkit.org/show_bug.cgi?id=100173
+
+        Reviewed by Eric Seidel.
+
+        The variable re-ordering and use of bitfields for bools has two benefits:
+        1) Size reduction. sizeof(BidiRun) goes down from 48 to 40 bytes on 64-bit. This is achieved by removing a bool member variable from BidiRun and packing it together with other bools in the BidiCharacterRun base class.
+        2) Security improvement. We have a lot of use-after-free in the RenderObject hierarchy, and the RenderArena class protects us from a lot of trouble by ensuring that objects of arbitrary type cannot be overlayed on top of freed RenderObjects. This change additionally makes sure that non-virtual RenderArena allocated objects do not have member variables which fully overlap the freed vtable pointer. This leaves re-used vtable pointers always pointing to either a valid vtable or an invalid address due to the freelist high-bit poisoning.
+
+        This change is exclusively about size savings; it is performance neutral as you would expect, including on Parser/html5-full-render.html
+
+        * platform/text/BidiResolver.h:
+        (WebCore::BidiCharacterRun::BidiCharacterRun): impact from re-ordering members.
+        (BidiCharacterRun): provide an efficiently packed bit of storage for BidiRun subclass to use, and re-order members to place bools adjacent.
+        * rendering/BidiRun.h:
+        (WebCore::BidiRun::BidiRun): use base class' efficiently packed bit storage for m_hasHyphen.
+        (BidiRun): m_hasHyphen is now stored in the base class.
+        * rendering/LayoutState.cpp:
+        (WebCore::LayoutState::LayoutState):
+        * rendering/LayoutState.h:
+        (WebCore::LayoutState::LayoutState): impact from re-ordering members.
+        (LayoutState): re-order members to place bools adjacently.
+
+2012-11-06  Kent Tamura  <tkent@chromium.org>
+
+        [Chromium-win] Refactor date/time format conversion code in LocaleWin
+        https://bugs.webkit.org/show_bug.cgi?id=101329
+
+        Reviewed by Kentaro Hara.
+
+        convertWindowsDateFormatToLDML and convertWindowsTimeFormatToLDML did
+        similar jobs with different code. We can merge them into one function.
+
+        As for the date format conversion, we have tokenized a format string and
+        stored token objects into a vector. We skip token object generation and
+        generate a LDML-compliant pattern string during parsing.
+
+        No new tests. This should make no behavior changes and
+        WebKit/chromium/tests/LocaleWinTest.cpp has test cases.
+
+        * platform/text/win/LocaleWin.cpp:
+        (WebCore): Remove DateFormatToken, isFooSymbol, ensureShortDateTokens,
+        convertWindowsDateFormatToLDML, mapCharacterToDateTimeFieldType, and
+        convertWindowsTimeFormatToLDML.
+        (WebCore::commitLiteralToken): Store the result to the specified StringBuilder.
+        (WebCore::convertWindowsDateTimeFormat):
+        Renamed from parseDateFormat, and supports time format symbols.
+        (WebCore::LocaleWin::dateFormat): Use convertWindowsDateTimeFormat.
+        (WebCore::LocaleWin::monthFormat): Ditto.
+        (WebCore::LocaleWin::timeFormat): Ditto.
+        (WebCore::LocaleWin::shortTimeFormat): Ditto.
+        * platform/text/win/LocaleWin.h:
+        (LocaleWin): Remove ensureShortDateTokens and m_shortDateTokens.
+
+2012-11-06  Elliott Sprehn  <esprehn@chromium.org>
+
+        Make Document::renderer faster by using the cached ptr for RenderView
+        https://bugs.webkit.org/show_bug.cgi?id=101409
+
+        Reviewed by Eric Seidel.
+
+        In Bug 101277 I made Document::renderView() just return m_renderView instead
+        of casting the result of renderer(). While this made renderView() cheaper it
+        makes more sense to just make renderer() faster for Document pointers and
+        go back to the out of line method in RenderView.h because lots of places in
+        the code do document()->renderer().
+
+        No new tests, this is just a refactor.
+
+        * dom/Document.h:
+        (WebCore::Document::renderer):
+        * rendering/RenderView.h:
+        (WebCore::Document::renderView):
+
+2012-11-06  Adam Barth  <abarth@webkit.org>
+
+        [V8] neuterBinding should remember the type of its argument
+        https://bugs.webkit.org/show_bug.cgi?id=101413
+
+        Reviewed by Kentaro Hara.
+
+        This is a small part of the patch in
+        https://bugs.webkit.org/show_bug.cgi?id=101110 that we can land
+        separately to try to tease out what is causing the memory regression.
+
+        * bindings/v8/SerializedScriptValue.cpp:
+        (WebCore):
+        (WebCore::neuterBinding):
+
+2012-11-06  Alexey Proskuryakov  <ap@apple.com>
+
+        Clean up which storage cookie jar functions use
+        https://bugs.webkit.org/show_bug.cgi?id=101395
+
+        Reviewed by Brady Eidson.
+
+        * WebCore.exp.in:
+        * platform/mac/WebCoreSystemInterface.h:
+        * platform/mac/WebCoreSystemInterface.mm:
+        Updated for two new WKSI functions.
+
+        * platform/CookieJar.h: Added explanatory comments.
+
+        * platform/mac/CookieJar.mm:
+        (WebCore::cookies): Removed fallback on NSHTTPCookieStorage, the WKSI function
+        already implements it.
+        (WebCore::cookieRequestHeaderFieldValue): Ditto.
+        (WebCore::setCookies): Ditto.
+        (WebCore::cookiesEnabled): Ditto.
+        (WebCore::getRawCookies): Ditto.
+        (WebCore::deleteCookie): Ditto.
+        (WebCore::getHostnamesWithCookies): This function used to look at NSHTTPCookieStorage
+        exclusively. While it makes sense to bypass private storage session, default storage
+        session (currently only used for testing on Mac) is never OK to bypass. Changed to
+        use a WKSI function that supports both.
+        (WebCore::deleteCookiesForHostname): Ditto.
+        (WebCore::deleteAllCookies): Ditto.
+
+        * platform/network/cf/CookieJarCFNet.cpp:
+        (WebCore::getHostnamesWithCookies):
+        (WebCore::deleteCookiesForHostname):
+        (WebCore::deleteAllCookies):
+        Updated to match Foundation, so now these functions bypass private session.
+
+        * platform/network/cf/CookieStorageCFNet.cpp:
+        (WebCore::currentCFHTTPCookieStorage): Updated a comment.
+        (WebCore::defaultCFHTTPCookieStorage):  Added a function that returns cookie storage
+        for non-private session (or null if that would be an NSHTTPCookieStorage).        
+        (WebCore::startObservingCookieChanges): We do not want to observe private cookies
+        here, and we certainly don't want a mismatch between start/stop due to private
+        browsing mode changes.
+        (WebCore::stopObservingCookieChanges): Ditto.
+
+        * platform/network/cf/CookieStorageCFNet.h: Added defaultCFHTTPCookieStorage().
+
+2012-11-06  Huang Dongsung  <luxtella@company100.net>
+
+        Build fix. r133601 broke the Windows build.
+        https://bugs.webkit.org/show_bug.cgi?id=101404
+
+        Reviewed by Noam Rosenthal.
+
+        Only static const integral data members can be initialized within a class in the
+        Windows, so we initialize static const double date members out of the class.
+
+        * platform/graphics/texmap/TextureMapper.cpp:
+        (BitmapTexturePool):
+        (WebCore):
+
+2012-11-06  Simon Fraser  <simon.fraser@apple.com>
+
+        -webkit-background-clip:text produces artifacts when applied to the body and the browser is resized
+        https://bugs.webkit.org/show_bug.cgi?id=89287
+
+        Reviewed by Beth Dakin.
+
+        If the body had -webkit-background-clip: text, we'd fail to paint
+        anything behind it, so would see garbage pixels.
+        
+        Fix by having RenderView::paintBoxDecorations() check for a background-clip of "text"
+        on the renderer that paints the root background.
+        
+        Added some new pixel tests for combinations of html and body transform
+        and backgrounds; earlier versions of the patch broke some of these tests.
+
+        Tests: fast/backgrounds/background-clip-text-on-body.html
+               fast/backgrounds/transformed-body-background.html
+               fast/backgrounds/transformed-body-html-background.html
+               fast/backgrounds/transformed-html-body-background.html
+
+        * rendering/RenderView.cpp:
+        (WebCore::rendererObscuresBackground): Broke up the single condition
+        into early 'false' returns when possible. We need to also check whether
+        the renderer that actually paints the background (which might be the body)
+        will fill it; background-clip: text does not.
+        (WebCore::RenderView::paintBoxDecorations): Rather than checking firstChild(),
+        actually check the root renderer, so that we can reliably get to the renderer
+        that mains the root background.
+
+2012-11-06  Stephen White  <senorblanco@chromium.org>
+
+        Implement save and restore for a bunch of InternalSettings state
+        https://bugs.webkit.org/show_bug.cgi?id=101394
+
+        Reviewed by Dirk Pranke.
+
+        In http://trac.webkit.org/changeset/133399, I resolved a bunch of 
+        flaky tests by saving and restoring the InternalSettings state
+        EnableCompositingForFixedPosition.  On a hunch, I git grepped for all
+        internal settings state which is being set by layout tests but not
+        saved and restored.  It turns out there about 15 calls.
+
+        This patch takes care of five of them, mostly compositing-related.
+        The others I was either not sure about, or were already at least
+        being reset to known values by the testing harness.
+
+        Hopefully this will alleviate some further test flakiness.
+
+        * testing/InternalSettings.cpp:
+        * testing/InternalSettings.h:
+
+2012-11-06  KyungTae Kim  <ktf.kim@samsung.com>
+
+        Fix build warning in RenderLayer.cpp caused by r133628
+        https://bugs.webkit.org/show_bug.cgi?id=101401
+
+        Reviewed by Simon Fraser.
+
+        The static function WebCore::frameViewFromLayer is only used when USE(ACCELERATED_COMPOSITING),
+        so define it only that case for removing -Wunused-function warning
+
+        * rendering/RenderLayer.cpp:
+        (WebCore):
+
+2012-11-06  Hans Muller  <hmuller@adobe.com>
+
+        [CSS Exclusions] Store ExclusionPolygonEdge vertices in clockwise order
+        https://bugs.webkit.org/show_bug.cgi?id=100763
+
+        Reviewed by Darin Adler.
+
+        The ExclusionPolygon's internal logic, notably getVertexIntersectionVertices(),
+        assumes that ExclusionPolygonEdge vertices are stored in clockwise order.
+        If this is not true, then we construct the polygon's edges in reverse.
+
+        To determine if the vertices are in clockwise order, we compare the slope
+        of the line between the top,left vertex and its previous vertex, with the
+        the slope of the line of vertices before and after the top,left vertex.
+        If the slope of the latter is greater, then top,left vertex is located
+        to its left, and the vertices are clockwise.
+
+        Test: fast/exclusions/shape-inside/shape-inside-counterclockwise-polygon.html
+
+        * rendering/ExclusionPolygon.cpp:
+        (WebCore::determinant): Used to decide if the min vertex is on the left side of the line that passes through its adjacent vertices.
+        (WebCore::ExclusionPolygon::ExclusionPolygon): If the polygon's vertices are specified in counterclockwise order, construct the edges in reverse.
+        (WebCore::appendIntervalX): Made this an inline since it was only defined as a function for the sake of clarity.
+
+2012-11-06  Tiancheng Jiang  <tijiang@rim.com>
+
+        [BlackBerry] Update BB10 form theme.
+        https://bugs.webkit.org/show_bug.cgi?id=100760
+
+        Reviewed by Rob Buis.
+
+        RIM PR 238123
+        Internal Reviewed by Chris Hutten-Czapski
+        BB10 selection theme use slice image function to draw selection button,
+        any border-radius setting other than 0 will make the button corner
+        clipped. Always set button border-radius: 0 for BB10 theme.
+
+        * css/themeBlackBerry.css:
+        (select[size][multiple]):
+        (select[size="1"]):
+
+2012-11-06  Elliott Sprehn  <esprehn@chromium.org>
+
+        Remove branch from inside RenderObject::view now that renderer() is more expensive
+        https://bugs.webkit.org/show_bug.cgi?id=101277
+
+        Reviewed by Eric Seidel.
+
+        It was observed in Bug 100057 that calling renderer() repeatedly now that it has a branch
+        can be a performance regression. Now that we no longer keep a separate pointer for rare data
+        in Document, we can use that space for a pointer to the RenderView making RenderObject::view()
+        faster and removing the branch.
+
+        This is a 1% improvement on Parser/html5-full-render.html
+
+        This also cleans up the code because it turns out we don't need to have RenderObject::view() in
+        RenderView.h because we can just call Document::renderView() and not do toRenderView. This makes
+        it easier to find this method as it exists in the right header file now.
+
+        No new tests, this is just a refactor.
+
+        * WebCore.exp.in: Remove export of Document::renderView since it's inline now.
+        * dom/Document.cpp:
+        (WebCore::Document::Document):
+        (WebCore::Document::setRenderer):
+        (WebCore):
+        * dom/Document.h:
+        (WebCore::Document::renderView):
+        (Document):
+        * rendering/RenderObject.h:
+        (WebCore::RenderObject::view):
+        * rendering/RenderView.h:
+        (WebCore):
+
+2012-11-06  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r133526.
+        http://trac.webkit.org/changeset/133526
+        https://bugs.webkit.org/show_bug.cgi?id=101388
+
+        May have caused 15% memory regression in Chromium (Requested
+        by jsbell|gardener on #webkit).
+
+        * UseV8.cmake:
+        * WebCore.gypi:
+        * bindings/scripts/CodeGeneratorV8.pm:
+        (GenerateHeader):
+        (GenerateNormalAttrGetter):
+        (GenerateConstructorCallback):
+        (GenerateNamedConstructorCallback):
+        (GenerateToV8Converters):
+        (GetDomMapFunction):
+        (GetDomMapName):
+        * bindings/scripts/test/V8/V8Float64Array.h:
+        (WebCore::V8Float64Array::wrap):
+        * bindings/scripts/test/V8/V8TestActiveDOMObject.h:
+        (WebCore::V8TestActiveDOMObject::wrap):
+        * bindings/scripts/test/V8/V8TestCustomNamedGetter.h:
+        (WebCore::V8TestCustomNamedGetter::wrap):
+        * bindings/scripts/test/V8/V8TestEventConstructor.h:
+        (WebCore::V8TestEventConstructor::wrap):
+        * bindings/scripts/test/V8/V8TestEventTarget.h:
+        (WebCore::V8TestEventTarget::wrap):
+        * bindings/scripts/test/V8/V8TestException.h:
+        (WebCore::V8TestException::wrap):
+        * bindings/scripts/test/V8/V8TestInterface.h:
+        (WebCore::V8TestInterface::wrap):
+        * bindings/scripts/test/V8/V8TestMediaQueryListListener.h:
+        (WebCore::V8TestMediaQueryListListener::wrap):
+        * bindings/scripts/test/V8/V8TestNamedConstructor.h:
+        (WebCore::V8TestNamedConstructor::wrap):
+        * bindings/scripts/test/V8/V8TestNode.cpp:
+        (WebCore::V8TestNode::constructorCallback):
+        (WebCore::V8TestNode::wrapSlow):
+        * bindings/scripts/test/V8/V8TestObj.cpp:
+        (WebCore::TestObjV8Internal::readOnlyTestObjAttrAttrGetter):
+        * bindings/scripts/test/V8/V8TestObj.h:
+        (WebCore::V8TestObj::wrap):
+        * bindings/scripts/test/V8/V8TestSerializedScriptValueInterface.h:
+        (WebCore::V8TestSerializedScriptValueInterface::wrap):
+        * bindings/v8/DOMDataStore.cpp:
+        (WebCore::DOMDataStore::DOMDataStore):
+        (WebCore::DOMDataStore::~DOMDataStore):
+        (WebCore::DOMDataStore::current):
+        (WebCore::DOMDataStore::reportMemoryUsage):
+        * bindings/v8/DOMDataStore.h:
+        (WebCore::DOMDataStore::domNodeMap):
+        (WebCore::DOMDataStore::domObjectMap):
+        (DOMDataStore):
+        * bindings/v8/DOMWrapperMap.h:
+        (WebCore):
+        (DOMWrapperMap):
+        (WebCore::DOMWrapperMap::~DOMWrapperMap):
+        (WebCore::DOMWrapperHashMap::remove):
+        * bindings/v8/DOMWrapperWorld.h:
+        * bindings/v8/IntrusiveDOMWrapperMap.h: Copied from Source/WebKit/chromium/src/WebScriptController.cpp.
+        (WebCore):
+        (IntrusiveDOMWrapperMap):
+        (WebCore::IntrusiveDOMWrapperMap::weakCallback):
+        * bindings/v8/ScriptProfiler.cpp:
+        * bindings/v8/SerializedScriptValue.cpp:
+        (WebCore::neuterBinding):
+        * bindings/v8/V8DOMMap.cpp: Copied from Source/WebKit/chromium/src/WebScriptController.cpp.
+        (WebCore):
+        (WebCore::getDOMNodeMap):
+        (WebCore::getDOMObjectMap):
+        * bindings/v8/V8DOMMap.h: Copied from Source/WebKit/chromium/src/WebScriptController.cpp.
+        (WebCore):
+        * bindings/v8/V8DOMWindowShell.cpp:
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::setJSWrapperForDOMNode):
+        (WebCore):
+        * bindings/v8/V8DOMWrapper.h:
+        (V8DOMWrapper):
+        (WebCore::V8DOMWrapper::getCachedWrapper):
+        (WebCore::V8DOMWrapper::setJSWrapperForDOMObject):
+        * bindings/v8/V8GCController.cpp:
+        * bindings/v8/V8NPObject.cpp:
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        * bindings/v8/WorkerScriptController.cpp:
+        * bindings/v8/custom/V8HTMLImageElementConstructor.cpp:
+        (WebCore::v8HTMLImageElementConstructorCallback):
+
+2012-11-06  Alexey Proskuryakov  <ap@apple.com>
+
+        Some cookie code cleanup
+        https://bugs.webkit.org/show_bug.cgi?id=101375
+
+        Reviewed by Dan Bernstein.
+
+        * platform/CookieJar.h: Fixed style. Grouped functions by which storage they operate
+        on in Mac port, but didn't add explanatory comments yet, because this is different
+        in some ports.
+
+        * platform/mac/CookieJar.mm:
+        (WebCore): Removed special code for isHTTPOnly, it's present in Foundation in all
+        supported OS X versions.
+        (WebCore::filterCookies): Use -isHTTPOnly directly.
+        (WebCore::cookies): Get rid of a variable for URL, implicit conversion works just as well.
+        (WebCore::cookieRequestHeaderFieldValue): Ditto.
+        (WebCore::setCookies): Assert that no more than one cookie was created from one
+        Set-Cookie header, document.cookie can only be used to set one cookie at a time.
+        (WebCore::getRawCookies): Removed useless local variables.
+
+        * platform/network/CookieStorage.h: Removed an unneeded include, clarified a comment.
+
+        * platform/network/HTTPHeaderMap.h: Added a FIXME.
+
+2012-11-06  John Griggs  <jgriggs@rim.com>
+
+        Implement MediaPlayerPrivate::didLoadingProgress for BlackBerry platform
+        https://bugs.webkit.org/show_bug.cgi?id=100378
+
+        Reviewed by Eric Carlson.
+
+        Implement this method for BlackBerry platform.
+
+        New test: LayoutTests/media/progress-events-generated-correctly.html
+
+        * platform/graphics/blackberry/MediaPlayerPrivateBlackBerry.cpp:
+        (WebCore::MediaPlayerPrivate::MediaPlayerPrivate):
+        (WebCore::MediaPlayerPrivate::didLoadingProgress):
+        * platform/graphics/blackberry/MediaPlayerPrivateBlackBerry.h:
+        (MediaPlayerPrivate):
+
+2012-11-06  Adam Barth  <abarth@webkit.org>
+
+        DOMImplementation should use ScriptWrappable
+        https://bugs.webkit.org/show_bug.cgi?id=101279
+
+        Reviewed by Eric Seidel.
+
+        This patch makes DOMImplementation ScriptWrappable. Both the V8 and JSC
+        bindings automatically detect the presence of this base class and use
+        it to optimize getting and setting JavaScript wrappers.
+
+        This patch is a 23% progression on Bindings/document-implementation for
+        the V8 bindings and a 69% progression for the JSC bindings.
+
+        * dom/DOMImplementation.h:
+
+2012-11-06  Benjamin Poulain  <benjamin@webkit.org>
+
+        Speed up TransformationMatrix::multiply() on modern ARM
+        https://bugs.webkit.org/show_bug.cgi?id=101084
+
+        Reviewed by Gavin Barraclough.
+
+        The main improvements are:
+        -Store the full source matrix in the registers d16 to d31. This way we avoid going
+         back and forth to memory to use the operands.
+         Since the full matrix is in register, we can also directly modify the memory of m_matrix,
+         we no longer need the temporary matrix memcopied at the end.
+        -Use of LoadMultiple and StoreMultiple to load-store the matrix parameters.
+        -Use Multiply-Accumulate instead of VMUL followed by VADD. This half the number of instruction.
+        -On regular ARMv7, using a loop to reuse the same code for each row also improve the performance.
+
+        Depending on the hardware, the new code takes 20% to 42% less time than the basic implementation.
+
+        * platform/graphics/transforms/TransformationMatrix.cpp:
+        (WebCore::TransformationMatrix::multiply):
+        * platform/graphics/transforms/TransformationMatrix.h:
+        (TransformationMatrix):
+
+2012-11-06  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r133529 and r133562.
+        http://trac.webkit.org/changeset/133529
+        http://trac.webkit.org/changeset/133562
+        https://bugs.webkit.org/show_bug.cgi?id=101371
+
+        Caused 15% memory regression on Chromium page cyclers
+        (Requested by jsbell|gardener on #webkit).
+
+        * platform/text/LineBreakIteratorPoolICU.h:
+        (WebCore::LineBreakIteratorPool::take):
+        (WebCore::LineBreakIteratorPool::put):
+        (LineBreakIteratorPool):
+        * platform/text/TextBreakIterator.cpp:
+        (WebCore::acquireLineBreakIterator):
+        * platform/text/TextBreakIterator.h:
+        (WebCore):
+        (WebCore::LazyLineBreakIterator::LazyLineBreakIterator):
+        (WebCore::LazyLineBreakIterator::get):
+        (WebCore::LazyLineBreakIterator::reset):
+        (LazyLineBreakIterator):
+        * platform/text/TextBreakIteratorICU.cpp:
+        (WebCore::acquireLineBreakIterator):
+        (WebCore::releaseLineBreakIterator):
+        * platform/text/gtk/TextBreakIteratorGtk.cpp:
+        (WebCore::setUpIterator):
+        (WebCore::acquireLineBreakIterator):
+        * platform/text/wince/TextBreakIteratorWinCE.cpp:
+        (WebCore::acquireLineBreakIterator):
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::RenderBlock::LineBreaker::nextLineBreak):
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::computePreferredLogicalWidths):
+        * rendering/RenderText.h:
+        (WebCore):
+        * rendering/break_lines.cpp:
+        (WebCore):
+        (WebCore::isBreakableSpace):
+        (WebCore::needsLineBreakIterator):
+        (WebCore::nextBreakablePosition):
+        (WebCore::nextBreakablePositionIgnoringNBSP):
+        * rendering/break_lines.h:
+        (WebCore):
+        (WebCore::isBreakable):
+
+2012-11-06  Peter Beverloo  <peter@chromium.org>
+
+        [Chromium] Enable the JavaScript i18n API for Android
+        https://bugs.webkit.org/show_bug.cgi?id=101357
+
+        Reviewed by Adam Barth.
+
+        Remove the conditional dependency on the v8-i18n API. The library is now
+        always available in a Chromium for Android checkout.
+
+        * WebCore.gyp/WebCore.gyp:
+
+2012-11-06  Adam Barth  <abarth@webkit.org>
+
+        ScriptWrappable should work for more than just Node
+        https://bugs.webkit.org/show_bug.cgi?id=101319
+
+        Reviewed by Eric Seidel.
+
+        This patch generalizes the inline cached wrapper code path to work with
+        all subclasses of ScriptWrappable, not just Node.
+
+        * bindings/js/JSDOMBinding.h:
+        (WebCore::setInlineCachedWrapper):
+        (WebCore::getInlineCachedWrapper):
+        (WebCore):
+        (WebCore::clearInlineCachedWrapper):
+        (WebCore::cacheWrapper):
+        * bindings/js/JSNodeCustom.h:
+
+2012-11-06  Tiancheng Jiang  <tijiang@rim.com>
+
+        [BlackBerry] Update BB10 form theme.
+        https://bugs.webkit.org/show_bug.cgi?id=100760
+
+        Reviewed by Rob Buis.
+
+        Revert webkit/ce306dcc698199a6f7ce679daf0a30c25d3a3d43 slider theme
+        change which break media control and vertical slider.
+
+        RIM PR 236993
+        Internal Reviewed by Jeff Rogers.
+
+        * platform/blackberry/RenderThemeBlackBerry.cpp:
+        (WebCore::RenderThemeBlackBerry::paintSliderTrackRect):
+        (WebCore::RenderThemeBlackBerry::paintSliderThumb):
+
+2012-11-06  Michael Saboff  <msaboff@apple.com>
+
+        canonicalizedTitle() shouldn't convert 8 bit title strings to 16 bit
+        https://bugs.webkit.org/show_bug.cgi?id=101105
+
+        Reviewed by Darin Adler.
+
+        Turned canonicalizedTitle() into a templated function based on character type.
+        Changed call in updateTitle() to check the bitness of the title string to call
+        the right template flavor of canonicalizedTitle().
+        Made supporting changes by adding displayBufferModifiedByEncoding(LChar*, ...)
+        and made TextEncoding::displayBuffer() a templated function as well.
+
+        No new tests needed, as functionality is unchanged.
+
+        * dom/Document.cpp:
+        (WebCore::canonicalizedTitle):
+        (WebCore::Document::updateTitle):
+        (WebCore::Document::displayBufferModifiedByEncodingInternal):
+        * dom/Document.h:
+        (WebCore::Document::displayBufferModifiedByEncoding):
+        * platform/text/TextEncoding.h:
+        (TextEncoding):
+        (WebCore::TextEncoding::displayBuffer):
+
+2012-11-05  Simon Fraser  <simon.fraser@apple.com>
+
+        Fix RenderGeometryMap assertion when layers are scrolled during layout
+        https://bugs.webkit.org/show_bug.cgi?id=101292
+
+        Reviewed by Beth Dakin.
+
+        When we set RenderLayer scroll positions as part of layout, we don't want
+        to update compositing layers right away. Updating compositing layers
+        requires that the entire layer tree has been updated from renderers,
+        so that the geometry of all RenderLayers can be trusted. When this state
+        was violated, RenderGeometryMap asserts.
+        
+        Fix by bailing from updateCompositingLayersAfterScroll() if FrameView
+        tells us that we're doing layout. A full update of the compositing layers
+        will happen later anyway.
+
+        Test: compositing/geometry/geometry-map-scroll-during-layout-assertion.html
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::frameViewFromLayer):
+        (WebCore::RenderLayer::updateCompositingLayersAfterScroll):
+
+2012-11-06  Michael Saboff  <msaboff@apple.com>
+
+        quoteCSSString() always creates a 16 bit string
+        https://bugs.webkit.org/show_bug.cgi?id=101004
+
+        Reviewed by Darin Adler.
+
+        Added a new templated helper based on character type from the logic of quoteCSSString() to process
+        the argument string based on its native bitness.
+
+        Functionality covered by existing tests.
+
+        * css/CSSParser.cpp:
+        (WebCore::quoteCSSStringInternal):
+        (WebCore::quoteCSSString):
+
+2012-11-06  Andras Becsi  <andras.becsi@digia.com>
+
+        [Qt][WK2] Fit-to-width broken on pages with viewport meta tag
+        https://bugs.webkit.org/show_bug.cgi?id=99715
+
+        Reviewed by Jocelyn Turcotte.
+
+        Add a bool that indicates if the content had an explicit
+        initial-scale in the viewport meta tag.
+
+        * dom/ViewportArguments.cpp:
+        (WebCore::computeViewportAttributes):
+        * dom/ViewportArguments.h:
+        (ViewportAttributes):
+
+2012-11-06  Mike West  <mkwst@chromium.org>
+
+        CSP 1.1: Tweak the script interface to match the spec.
+        https://bugs.webkit.org/show_bug.cgi?id=101321
+
+        Reviewed by Adam Barth.
+
+       This patch brings WebKit in line with the changes made to the spec in
+       https://dvcs.w3.org/hg/content-security-policy/rev/5a29424a37d4.
+       Specifically, the following:
+
+       - Renamed 'document.SecurityPolicy' to 'document.securityPolicy'
+       - Converted the following to read-only boolean attributes:
+         - 'allowsEval'
+         - 'allowsInlineScript'
+         - 'allowsInlineStyle'
+         - 'isActive'
+
+        These changes only have effect for ports with CSP_NEXT enabled.
+
+        Tests: http/tests/security/contentSecurityPolicy/1.1/securitypolicy-allowinlinescript.html
+               http/tests/security/contentSecurityPolicy/1.1/securitypolicy-allowinlinestyle.html
+
+        * dom/Document.idl:
+        * page/DOMSecurityPolicy.idl:
+            Tweaking the IDL files to match the new definition of the
+            functionlity in the spec.
+
+2012-11-06  Andrey Lushnikov  <lushnikov@google.com>
+
+        Added console.clear() method
+
+        Web Inspector: add console.clear()
+        https://bugs.webkit.org/show_bug.cgi?id=101021
+
+        Reviewed by Vsevolod Vlasov.
+
+        Adds native implementation of console.clear
+
+        Test: inspector/console/console-clear-function.html
+
+        * English.lproj/localizedStrings.js: Adds 'Console was cleared' string
+        * inspector/ConsoleMessage.cpp:
+        (WebCore::messageTypeValue): Adds ClearMessageType
+        * inspector/Inspector.json:
+        * inspector/InspectorConsoleAgent.cpp:
+        (WebCore::InspectorConsoleAgent::addMessageToConsole):
+        * inspector/front-end/ConsoleMessage.js:
+        (WebInspector.ConsoleMessageImpl.prototype._formatMessage): Display strategy for "clear" message
+        * inspector/front-end/ConsoleModel.js:
+        * inspector/front-end/inspector.css:
+        (.console-info): Adds style for the 'console was cleared' message
+        * page/Console.cpp: backend binging for console.clear()
+        (WebCore::Console::clear):
+        (WebCore):
+        * page/Console.h:
+        (Console):
+        * page/Console.idl: Adds 'clear' message to protocol
+        * page/ConsoleTypes.h:
+
+2012-11-06  Aaron Colwell  <acolwell@chromium.org>
+
+        Heap-buffer-overflow in WebCore::TextTrackCueList::add
+        https://bugs.webkit.org/show_bug.cgi?id=101018
+
+        Reviewed by Eric Carlson.
+
+        Added an extra check to avoid using a negative array index when a cue
+        is added to the beginning of the list.
+
+        Test case added to LayoutTests/media/track/track-add-remove-cue.html.
+
+        * html/track/TextTrackCueList.cpp:
+        (WebCore::TextTrackCueList::add):
+
+2012-11-06  Aaron Colwell  <acolwell@chromium.org>
+
+        Regression(r132681): Heap-use-after-free in WebCore::RenderTextTrackCue::layout
+        https://bugs.webkit.org/show_bug.cgi?id=100981
+
+        Reviewed by Eric Carlson.
+
+        Fixing a TextTrackCue use after free bug. textTrackRemoveCues() needs to be called when
+        an HTMLTrackElement is removed from an HTMLMediaElement so that references to
+        TextTrackCues are removed from m_cueTree.
+
+        Test: media/track/track-remove-by-setting-innerHTML.html
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::willRemoveTrack):
+
+2012-10-23  Stephen White  <senorblanco@chromium.org>
+
+        [skia] Implement reference (url) filters on composited layers.
+        https://bugs.webkit.org/show_bug.cgi?id=100142
+
+        Reviewed by James Robinson.
+
+        Covered by css3/filters/effect-reference-hw.html
+
+        * WebCore.gyp/WebCore.gyp:
+        * WebCore.gypi:
+        Add new files.
+        * WebCore.xcodeproj/project.pbxproj:
+        Mark FilterEffect.h as "private".
+        * platform/graphics/chromium/GraphicsLayerChromium.cpp:
+        (WebCore::GraphicsLayerChromium::setFilters):
+        Use the new SkImageFilter builder and setLayer() infrastructure, but
+        only if there's a reference filter in the chain.
+        * platform/graphics/filters/FEBlend.h:
+        * platform/graphics/filters/FEColorMatrix.h:
+        * platform/graphics/filters/FEGaussianBlur.h:
+        * platform/graphics/filters/FELighting.h:
+        * platform/graphics/filters/FEMorphology.h:
+        * platform/graphics/filters/FilterEffect.h:
+        (WebCore::FilterEffect::createImageFilter):
+        Add createImageFilter() factory function for building SkImageFilters.
+        * platform/graphics/filters/FilterOperation.h:
+        (WebCore::FilterOperation::ReferenceFilterOperation::filterEffect):
+        (WebCore::FilterOperation::ReferenceFilterOperation::setFilterEffect):
+        Add a FilterEffect member to ReferenceFilterOperation, and accessors
+        for it.
+        * platform/graphics/filters/skia/FEBlendSkia.cpp:
+        (WebCore::FEBlend::createImageFilter):
+        Implement SkImageFilter building for FEBlend filter.
+        * platform/graphics/filters/skia/FEColorMatrixSkia.cpp:
+        (WebCore::createColorFilter):
+        (WebCore::FEColorMatrix::platformApplySkia):
+        Refactor creation of SkColorFilter from an FEColorMatrix filter.
+        (WebCore::FEColorMatrix::createImageFilter):
+        Implement SkImageFilter building for FEColorMatrix filter.
+        * platform/graphics/filters/skia/FEGaussianBlurSkia.cpp:
+        (WebCore::FEGaussianBlur::createImageFilter):
+        Implement SkImageFilter building for FEGaussianBlur filter.
+        * platform/graphics/filters/skia/FELightingSkia.cpp:
+        (WebCore::FELighting::createImageFilter):
+        Implement SkImageFilter building for FELighting filters.
+        * platform/graphics/filters/skia/FEMorphologySkia.cpp:
+        (WebCore::FEMorphology::createImageFilter):
+        Implement SkImageFilter building for FEMorphology filter.
+        * platform/graphics/filters/skia/SkiaImageFilterBuilder.cpp: Added.
+        (WebCore::SkiaImageFilterBuilder::SkiaImageFilterBuilder):
+        (WebCore::SkiaImageFilterBuilder::build):
+        * platform/graphics/filters/skia/SkiaImageFilterBuilder.h:
+        Implement new helper class for building an SkImageFilter DAG from
+        a FilterEffect DAG.  Can also build from FilterOperations list.
+        * rendering/FilterEffectRenderer.cpp:
+        (WebCore::FilterEffectRenderer::build):
+        When building FilterEffects from a reference filter, also store the
+        generated DAG on the ReferenceFilterOperation itself.
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::updateOrRemoveFilterEffect):
+        Even when in composited mode, if there's a reference filter in the 
+        chain, build the FilterEffect DAG from it.
+
+2012-11-06  Max Feil  <mfeil@rim.com>
+
+        [BlackBerry] Automatically go fullscreen on video play
+        https://bugs.webkit.org/show_bug.cgi?id=101100
+
+        Reviewed by Eric Carlson.
+
+        There is a requirement to have HTML5 video automatically enter
+        fullscreen when a video starts playing (PR131774). This change
+        implements this feature, with restrictions. The main restriction
+        is adherence to WebKit's philosophy of only entering fullscreen
+        due to a user gesture. This is important in order to avoid
+        pop-up advertisements and other unwanted fullscreen content.
+        One consequence of this is that video elements with the autoplay
+        attribute will not automatically enter fullscreen.
+
+        Other caveats:
+        - This feature applies only to "small screen" devices where
+        automatically going fullscreen makes more sense.
+        - Fullscreen will only be entered automatically when the
+        video is played from the beginning (current time is zero).
+        It is assumed that if the user is resuming play from a paused
+        state and is not in fullscreen mode, then they exited fullscreen
+        mode intentionally.
+
+        Test: platform/blackberry/media/video-automatic-fullscreen.html
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::mediaPlayerEnterFullscreen):
+        (WebCore):
+        (WebCore::HTMLMediaElement::mediaPlayerIsFullscreen):
+        (WebCore::HTMLMediaElement::mediaPlayerIsFullscreenPermitted):
+        * html/HTMLMediaElement.h:
+        (HTMLMediaElement):
+        * platform/graphics/MediaPlayer.h:
+        (WebCore::MediaPlayerClient::mediaPlayerEnterFullscreen):
+        (WebCore::MediaPlayerClient::mediaPlayerIsFullscreen):
+        (WebCore::MediaPlayerClient::mediaPlayerIsFullscreenPermitted):
+        * platform/graphics/blackberry/MediaPlayerPrivateBlackBerry.cpp:
+        (WebCore::MediaPlayerPrivate::play):
+        (WebCore::MediaPlayerPrivate::waitMetadataTimerFired):
+        (WebCore::MediaPlayerPrivate::conditionallyGoFullscreenAfterPlay):
+        (WebCore):
+        * platform/graphics/blackberry/MediaPlayerPrivateBlackBerry.h:
+        (MediaPlayerPrivate):
+
+2012-11-06  Grzegorz Czajkowski  <g.czajkowski@samsung.com>
+
+        [WK2][EFL][GTK] early return of checkSpellingOfString treats correct words as misspelled
+        https://bugs.webkit.org/show_bug.cgi?id=101215
+
+        Reviewed by Gustavo Noronha Silva.
+
+        Save the misspelled location and length of the string to the default values (-1, 0)
+        at the beginning of the checkSpellingOfString method.
+        It assumes that the words are spelled correctly and early return of method doesn't
+        cause assertions in findFirstMisspelling (WebCore/editing/TextCheckingHelper.cpp).
+
+        * platform/text/enchant/TextCheckerEnchant.cpp:
+        (TextCheckerEnchant::checkSpellingOfString):
+
+2012-11-06  Huang Dongsung  <luxtella@company100.net>
+
+        [TexMap] Remove unused textures in the texture pool.
+        https://bugs.webkit.org/show_bug.cgi?id=100706
+
+        Reviewed by Noam Rosenthal.
+
+        Currently, we do not remove textures in the texture pool of
+        TextureMapper. The texture pool is destroyed when TextureMapper is
+        destroyed. It means the texture pool consumes texture memory until its
+        destruction. This patch removes textures if the textures have been not
+        used in 3 seconds as LayerTreeCoordinator manages UpdateAtlases.
+
+        Changing cache policy is not testable in layout tests.
+
+        * platform/graphics/texmap/TextureMapper.cpp:
+        (WebCore::BitmapTexturePoolEntry::BitmapTexturePoolEntry):
+        (WebCore::BitmapTexturePoolEntry::markUsed):
+        (WebCore::BitmapTexturePoolEntry::compareTimeLastUsed):
+        (BitmapTexturePoolEntry):
+        (WebCore):
+        (BitmapTexturePool):
+        (WebCore::BitmapTexturePool::BitmapTexturePool):
+        (WebCore::BitmapTexturePool::scheduleReleaseUnusedTextures):
+        (WebCore::BitmapTexturePool::releaseUnusedTexturesTimerFired):
+        (WebCore::BitmapTexturePool::acquireTexture):
+        (WebCore::TextureMapper::acquireTextureFromPool):
+        (WebCore::TextureMapper::TextureMapper):
+        (WebCore::TextureMapper::~TextureMapper):
+        * platform/graphics/texmap/TextureMapper.h:
+        (WebCore):
+        (TextureMapper):
+
+2012-11-02  Ilya Tikhonovsky  <loislo@chromium.org>
+
+        Web Inspector: NMI instrument CachedMetadata. It uses ~300k on plus.google.com
+        https://bugs.webkit.org/show_bug.cgi?id=101067
+
+        Reviewed by Yury Semikhatsky.
+
+        Plain vanilla instrumentation for CachedMetadata class.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * Target.pri:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * loader/CachedMetadata.cpp: Added.
+        (WebCore):
+        (WebCore::CachedMetadata::reportMemoryUsage):
+        * loader/CachedMetadata.h:
+        (CachedMetadata):
+
+2012-11-06  Alexei Filippov  <alph@chromium.org>
+
+        Web Inspector: report physical memory really committed for JS heap in NMI
+        https://bugs.webkit.org/show_bug.cgi?id=101335
+
+        Some OSes (e.g. Linux) perform lazy commits of requested memory.
+        Because of that the committed memory may not retain any physical
+        memory until the very first access to the committed chunk.
+        That led to JS heap reported more physical memory than was currently
+        in use.
+
+        Reviewed by Vsevolod Vlasov.
+
+        * bindings/v8/ScriptGCEvent.cpp:
+        (WebCore::ScriptGCEvent::getHeapSize):
+
+2012-11-06  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Web Inspector: Breakpoint is not removed when it was set in non-formatted mode and then removed while in formatted mode.
+        https://bugs.webkit.org/show_bug.cgi?id=100595
+
+        Reviewed by Yury Semikhatsky.
+
+        Breakpoints in storage are now updated/removed by file name saved from primary location when they were created,
+        not by the name returned by UISourceCode (as this one could change when UISourceCode is formatted).
+        SourceFileId is now used across BreakpointManager to specify file name.
+        And breakpointStorageId is now used to specify (fileName, lineNumber) pair.
+
+        * inspector/front-end/BreakpointManager.js:
+        (WebInspector.BreakpointManager.sourceFileId):
+        (WebInspector.BreakpointManager.prototype._restoreBreakpoints):
+        (WebInspector.BreakpointManager.prototype._uiSourceCodeRemoved): Removed redundant check.
+        (WebInspector.BreakpointManager.prototype.breakpointLocationsForUISourceCode):
+        (WebInspector.BreakpointManager.Breakpoint):
+        (WebInspector.BreakpointManager.Breakpoint.prototype._breakpointStorageId):
+        (WebInspector.BreakpointManager.Storage.prototype._restoreBreakpoints):
+        (set WebInspector.BreakpointManager.Storage.Item):
+
+2012-11-06  Keishi Hattori  <keishi@webkit.org>
+
+        The "Rect" class in WebCore/Resources/pagepopups/pickerCommon.js should be renamed
+        https://bugs.webkit.org/show_bug.cgi?id=101304
+
+        Reviewed by Kent Tamura.
+
+        The name Rect conflicts with CSS Rect.
+
+        No new tests. Just renaming.
+
+        * Resources/pagepopups/pickerCommon.js:
+        (Rectangle): Renamed from Rect.
+        (Rectangle.prototype.toString):
+        (Rectangle.intersection):
+        (adjustWindowRect):
+        (hideWindow):
+
+2012-11-06  Kentaro Hara  <haraken@chromium.org>
+
+        Replace setDOMWrapper(wrapper, 0) with resetDOMWrapper(wrapper)
+        https://bugs.webkit.org/show_bug.cgi?id=101190
+
+        Reviewed by Adam Barth.
+
+        To guarantee that we never stores NULL pointers to V8 internal
+        fields, we want to insert ASSERT()s to setDOMWrapper().
+        This patch replaces setDOMWrapper() that intentionally
+        passes NULL pointers with clearDOMWrapper().
+
+        No tests. No change in behavior.
+
+        * bindings/v8/V8DOMWrapper.h:
+        (V8DOMWrapper):
+        (WebCore::V8DOMWrapper::clearDOMWrapper):
+        * bindings/v8/V8NPObject.cpp:
+        (WebCore::forgetV8ObjectForNPObject):
+
+2012-11-06  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Web Inspector: Displayed name/path of urls in network tab of dev tools is inconsistent
+        https://bugs.webkit.org/show_bug.cgi?id=101064
+
+        Reviewed by Yury Semikhatsky.
+
+        Extracted some generic methods from ParsedURL displayName getters (about:blank and data url handlers).
+        Implemented consistent name() and path() method on NetworkRequest based on ParsedURL.
+        NetworkPanel now uses name() and path() methods on NetworkRequest to show requests and search for them.
+
+        Test: http/tests/inspector/network/request-name-path.html
+
+        * inspector/front-end/NetworkPanel.js:
+        (WebInspector.NetworkLogView.prototype._matchRequest):
+        (WebInspector.NetworkLogView.prototype._highlightMatchedRequests):
+        (WebInspector.NetworkLogView.prototype.performFilter):
+        (WebInspector.NetworkDataGridNode.prototype._refreshNameCell):
+        (WebInspector.NetworkDataGridNode.NameComparator):
+        * inspector/front-end/NetworkRequest.js:
+        (WebInspector.NetworkRequest.prototype.set url):
+        (WebInspector.NetworkRequest.prototype.name):
+        (WebInspector.NetworkRequest.prototype.path):
+        (WebInspector.NetworkRequest.prototype._parseNameAndPathFromURL):
+        * inspector/front-end/ParsedURL.js:
+        (WebInspector.ParsedURL):
+        (WebInspector.ParsedURL.prototype.get displayName):
+        (WebInspector.ParsedURL.prototype.dataURLDisplayName):
+        (WebInspector.ParsedURL.prototype.isAboutBlank):
+        (WebInspector.ParsedURL.prototype.isDataURL):
+
+2012-11-05  Pavel Feldman  <pfeldman@chromium.org>
+
+        Web Inspector: make Spectrum and Popover WebInspector.Views in order to enable reuse
+        https://bugs.webkit.org/show_bug.cgi?id=101200
+
+        Reviewed by Yury Semikhatsky.
+
+        - Split Spectrum and SpectrumPopoverHelper (first is a component, second is controller)
+        - Made Popover a root view in order to enable lazy style loading for potential subviews (such as Spectrum)
+        - Extracted spectrum's css into a separate file
+
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/front-end/DOMExtension.js:
+        (Element.prototype.positionAt):
+        (Size):
+        (Element.prototype.measurePreferredSize):
+        * inspector/front-end/HeapSnapshotView.js:
+        (WebInspector.HeapSnapshotView.prototype.willHide):
+        (WebInspector.HeapSnapshotView.prototype._helpClicked):
+        * inspector/front-end/Popover.js:
+        (WebInspector.Popover):
+        (WebInspector.Popover.prototype.show):
+        (WebInspector.Popover.prototype.showView):
+        (WebInspector.Popover.prototype._innerShow):
+        (WebInspector.Popover.prototype.hide):
+        (WebInspector.Popover.prototype.dispose):
+        (WebInspector.Popover.prototype._positionElement):
+        * inspector/front-end/Spectrum.js:
+        (WebInspector.Spectrum.alphaDrag):
+        (WebInspector.Spectrum):
+        (WebInspector.Spectrum.prototype.wasShown):
+        (WebInspector.SpectrumPopupHelper):
+        (WebInspector.SpectrumPopupHelper.prototype.spectrum):
+        (WebInspector.SpectrumPopupHelper.prototype.toggle):
+        (WebInspector.SpectrumPopupHelper.prototype.show):
+        (WebInspector.SpectrumPopupHelper.prototype.reposition):
+        (WebInspector.SpectrumPopupHelper.prototype.hide):
+        (WebInspector.ColorSwatch):
+        (WebInspector.ColorSwatch.prototype.setColorString):
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylesSidebarPane):
+        (WebInspector.StylesSidebarPane.prototype.update):
+        (WebInspector.StylesSidebarPane.prototype.willHide):
+        (WebInspector.StylePropertyTreeElement.prototype.updateTitle.):
+        * inspector/front-end/View.js:
+        (WebInspector.View.prototype.measurePreferredSize):
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/elementsPanel.css:
+        (.image-preview-container img):
+        * inspector/front-end/inspector.css:
+        (.swatch):
+        (.swatch-inner):
+        (.swatch-inner:hover):
+        * inspector/front-end/spectrum.css: Added.
+        (.spectrum-container):
+        (.spectrum-top):
+        (.spectrum-color):
+        (.spectrum-display-value):
+        (.spectrum-hue):
+        (.spectrum-fill):
+        (.spectrum-range-container):
+        (.spectrum-range-container *):
+        (.spectrum-range-container label):
+        (.spectrum-range-container input):
+        (.spectrum-dragger, .spectrum-slider):
+        (.spectrum-sat):
+        (.spectrum-val):
+        (.spectrum-dragger):
+        (.spectrum-slider):
+        (.spectrum-container .swatch):
+
+2012-11-06  Takashi Sakamoto  <tasak@google.com>
+
+        removeAttribute('style') not working in certain circumstances
+        https://bugs.webkit.org/show_bug.cgi?id=99295
+
+        Reviewed by Ryosuke Niwa.
+
+        After web developers did style.XXXX=YYYY for some element, the inline
+        style should be always removable by using "removeAttribute('style')".
+        Currently it depends on whether web developers invokes
+        getAttribute('style'), setAttribute('style), and so on. E.g. once they
+        invoke getAttribute('style'), removeAttribute('style') works. This is
+        very confusing behavior.
+        Looking at Firefox browser, removeAttribute('style') always removes
+        all inline styles.
+
+        Test: fast/css/remove-attribute-style.html
+
+        * css/StylePropertySet.cpp:
+        (WebCore::StylePropertySet::clear):
+        Added a new method to remove all style properties.
+        (WebCore):
+        * css/StylePropertySet.h:
+        (StylePropertySet):
+        * dom/Element.cpp:
+        (WebCore::Element::removeAttribute):
+        If 'style' is given but the element has no style attribute, the old
+        code did nothing. However, if the element is styled element and has any
+        inline styles, the inline styles should be removed. So invoke
+        StyledElement::removeAllInlineStyleProperties and if any inline styles
+        are removed, invoke style recalc, too.
+        * dom/StyledElement.cpp:
+        (WebCore::StyledElement::removeAllInlineStyleProperties):
+        Added a new method to remove all inline style propeties. If any inline
+        style is removed, invoke inlineStyleChanged() to force style recalc.
+        (WebCore):
+        * dom/StyledElement.h:
+        (StyledElement):
+
+2012-11-06  Alexei Filippov  <alph@chromium.org>
+
+        Web Inspector: dim size bar for expanded item in native memory snapshot grid
+        https://bugs.webkit.org/show_bug.cgi?id=101062
+
+        Reviewed by Yury Semikhatsky.
+
+        * inspector/front-end/nativeMemoryProfiler.css:
+        (.native-snapshot-view .data-grid .expanded div.size-bar):
+
+2012-11-06  Shinya Kawanaka  <shinyak@chromium.org>
+
+        [Shadow] Using isUnknownPseudoElement() for shadow pseudo id seems confusing
+        https://bugs.webkit.org/show_bug.cgi?id=100826
+
+        Reviewed by Hajime Morita.
+
+        We used isUnknownPseudoElement() for these 3 meanings: 1) the element is a custom pseudo-element (starting with 'x-'),
+        2) the element is a webkit custom pseudo-element (starting with '-webkit-'), and 3) the element has an unknown type.
+        We would like to distinguish them when parsing CSSSelector types. Also, we disable using (3) type for using
+        shadowPseudoId.
+
+        In this patch, we allow using WebKitCustomPseudoElement in AuthorShadowRoot, and CustomPseudoElement in
+        UAShadowRoot. However, we will disable them later.
+
+        Test: fast/dom/shadow/shadow-pseudo-id.html
+
+        * css/CSSGrammar.y.in: Now we can discard UNKNOWN type. It should not match anything.
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::updateSpecifiersWithElementName):
+        (WebCore::CSSParser::updateSpecifiers):
+        * css/CSSParserValues.h:
+        (WebCore::CSSParserSelector::isCustomPseudoElement):
+        (CSSParserSelector):
+        * css/CSSSelector.cpp:
+        (WebCore::CSSSelector::pseudoId):
+        (WebCore::CSSSelector::parsePseudoType):
+        (WebCore::CSSSelector::isCustomPseudoType): Returns true if the type is PseudoUserAgentCustomElement or PseudoWebKitCustomElement.
+        (WebCore::CSSSelector::extractPseudoType):
+        * css/CSSSelector.h:
+        (CSSSelector):
+        (WebCore::CSSSelector::isCustomPseudoElement):
+        (WebCore):
+        * css/CSSSelectorList.cpp:
+        (WebCore::SelectorHasInvalidSelectorFunctor::operator()): We will reject all selectors which were judged as
+        UNKNOWN before. i.e. It contians all three types for now.
+        (WebCore::CSSSelectorList::hasInvalidSelector): Renamed.
+        * css/CSSSelectorList.h:
+        (CSSSelectorList):
+        * css/RuleSet.cpp:
+        (WebCore::RuleSet::addRule):
+        * css/SelectorChecker.cpp:
+        (WebCore::SelectorChecker::checkSelector):
+        * dom/Element.cpp:
+        (WebCore::Element::setShadowPseudoId):
+        * dom/SelectorQuery.cpp:
+        (WebCore::SelectorQueryCache::add):
+
+2012-11-06  Shinya Kawanaka  <shinyak@chromium.org>
+
+        [Shadow] ShadowRoot should know the existence of elements having ElementShadow.
+        https://bugs.webkit.org/show_bug.cgi?id=100922
+
+        Reviewed by Hajime Morita.
+
+        We count the elements having ElementShadow in ShadowRoot. This is a prepation patch for to solve Bug 100451.
+        We have a count-up and count-down login in ShadowRoot::insertedInto and ShadowRoot::removedFrom.
+
+        For performance reason, we have a flag that an element should be unregistered in ShadowRoot.
+
+        Test: fast/dom/shadow/has-elementshadow.html
+
+        * dom/ShadowRoot.cpp:
+        (WebCore::ShadowRoot::ShadowRoot):
+        (WebCore::ShadowRoot::insertedInto): Count up the number of elements having ElementShadow. ElementShadow
+        is created only when the oldest ShadowRoot is created, we only count up only when this ShadowRoot is oldest.
+        (WebCore):
+        (WebCore::ShadowRoot::removedFrom): Count down if we used this ShadowRoot for count up.
+        * dom/ShadowRoot.h:
+        (ShadowRoot):
+        (WebCore::ShadowRoot::registerElementShadow):
+        (WebCore::ShadowRoot::unregisterElementShadow):
+        (WebCore::ShadowRoot::hasElementShadow):
+        (WebCore::ShadowRoot::countElementShadow):
+        * testing/Internals.cpp:
+        (WebCore::Internals::countElementShadow):
+        (WebCore):
+        * testing/Internals.h:
+        (Internals):
+        * testing/Internals.idl:
+
+2012-11-06  Pavel Feldman  <pfeldman@chromium.org>
+
+        Web Inspector: show "debugging session terminated" message when remote debuggign connection is closed unexpectedly.
+        https://bugs.webkit.org/show_bug.cgi?id=101030
+
+        Reviewed by Vsevolod Vlasov.
+
+        * inspector/front-end/inspector.js:
+        (WebInspector.loaded.WebInspector.socket.onclose):
+        (WebInspector.loaded):
+        (WebInspector.detached):
+
+2012-11-06  Alexander Pavlov  <apavlov@chromium.org>
+
+        Web Inspector: [Overrides] Add Chrome for Android and Firefox for Android user agent strings
+        https://bugs.webkit.org/show_bug.cgi?id=100666
+
+        Reviewed by Pavel Feldman.
+
+        * inspector/front-end/SettingsScreen.js:
+        (WebInspector.UserAgentSettingsTab.prototype._createUserAgentSelectRowElement.get const):
+
+2012-11-02  Yury Semikhatsky  <yurys@chromium.org>
+
+        Web Inspector: JavaScript web workers debugging crashes
+        https://bugs.webkit.org/show_bug.cgi?id=101065
+
+        Reviewed by Alexander Pavlov.
+
+        Clear m_pageInspector when page inspector instance is deleted.
+        Disable worker inspection when front-end disconnects.
+
+        Test: inspector-protocol/debugger-terminate-dedicated-worker-while-paused.html
+
+        * inspector/InspectorWorkerAgent.cpp:
+        (WebCore::InspectorWorkerAgent::WorkerFrontendChannel::~WorkerFrontendChannel): notify
+        WorkerMessagingProxy so that it can clear pointer to the channel.
+
+2012-11-06  Nikita Vasilyev  <me@elv1s.ru>
+
+        Web Inspector: Console: wrap long URLs
+        https://bugs.webkit.org/show_bug.cgi?id=100970
+
+        Reviewed by Yury Semikhatsky.
+
+        * inspector/front-end/inspector.css:
+        (.console-message-url):
+
+2012-11-05  Keishi Hattori  <keishi@webkit.org>
+
+        Introduce Day class to calendar picker
+        https://bugs.webkit.org/show_bug.cgi?id=101194
+
+        Reviewed by Kent Tamura.
+
+        Introducing Day class so day, week, and month can all be abstracted. To
+        solve some of the complexity around which months to show, I made
+        CalendarPicker in charge of it. This also made YearMonthController and
+        DaysTable independent of each other.
+
+        No new tests. Covered by existing calendar-picker-*.html tests.
+
+        * Resources/pagepopups/calendarPicker.js:
+        (createUTCDate): Allow negative month or date.
+        (parseDateString): Will return Day or Month depending on string format.
+        (Day): Represents a day.
+        (Day.parse): Parse yyyy-mm-dd.
+        (Day.createFromDate): Creates a Day that contains a datetime.
+        (Day.createFromToday): Creates Day for today. A method with the same name will be added to Week and Month in the future.
+        (Day.prototype.equals): Returns true if they are the same.
+        (Day.prototype.previous): Returns the previous day.
+        (Day.prototype.next): Returns the next day.
+        (Day.prototype.startDate): Returns the datetime that is the start of this day.
+        (Day.prototype.endDate): Returns the datetime that is the start of this day.
+        (Day.prototype.valueOf): Returns the milliseconds since epoch.
+        (Day.prototype.toString): Returns an ISO date string.
+        (Month): Fix bug in calculating month from value.
+        (Month.prototype.endDate): Use Day.Maximum.
+        (CalendarPicker): Added _currentMonth. yearMonthController and daysTable can be private members now.
+        (CalendarPicker.prototype._layout):
+        (CalendarPicker.prototype.handleToday): Use Day.createFromToday.
+        (CalendarPicker.prototype.shouldShowMonth): Returns true if the month should be shown.
+        (CalendarPicker.prototype.showMonth): Shows the given month. If the month is out of the range of months that should be shown, we clamp the month and show that.
+        (CalendarPicker.prototype.currentMonth): Returns the current month that is shown.
+        (YearMonthController): Removed _currentMonth.
+        (YearMonthController.prototype.attachTo):
+        (YearMonthController.prototype.setMonth):
+        (YearMonthController.prototype._handleYearMonthChange): Use CalendarPicker.showMonth
+        (YearMonthController.prototype.moveRelatively):
+        (DaysTable):
+        (CalendarPicker.prototype._stepMismatch): Made private.
+        (CalendarPicker.prototype._outOfRange): Made private.
+        (CalendarPicker.prototype.isValidDate): Take Day or Month instead of milliseconds since epoch.
+        (DaysTable.prototype._renderMonth):
+        (DaysTable.prototype.navigateToMonth): Shows a given month. Can use animation and leave the selection position as is.
+        (DaysTable.prototype.selectRange): Select a range.
+        (DaysTable.prototype._maybeSetPreviousMonth):
+        (DaysTable.prototype._maybeSetNextMonth):
+        (DaysTable.prototype._handleKey):
+        (CalendarPicker.prototype._handleBodyKeyDown):
+
+2012-11-05  Kenichi Ishibashi  <bashi@chromium.org>
+
+        Unreviewed, Adding #if PLATFORM(CHROMIUM) for the fix of
+        https://bugs.webkit.org/show_bug.cgi?id=101009
+
+        This fix requires the most recent version of harfbuzz-ng.
+        EFL port uses version 0.9.2, which doesn't have the fix.
+
+        * platform/graphics/harfbuzz/ng/HarfBuzzShaper.cpp:
+        (WebCore::HarfBuzzShaper::shapeHarfBuzzRuns):
+
+2012-11-05  Glenn Adams  <glenn@skynav.com>
+
+        Ensure acquireLineBreakIterator signature consistency on non-ICU ports.
+        https://bugs.webkit.org/show_bug.cgi?id=101281
+
+        Reviewed by Ryosuke Niwa.
+
+        Fix (newly) inconsistent signature for acquireLineBreakIterator for non-ICU ports
+        caused by http://trac.webkit.org/changeset/133529.
+
+        See new tests added from https://bugs.webkit.org/show_bug.cgi?id=89235.
+
+        * platform/text/TextBreakIterator.cpp:
+        (WebCore::acquireLineBreakIterator):
+        * platform/text/gtk/TextBreakIteratorGtk.cpp:
+        (WebCore::setUpIterator):
+        (WebCore::acquireLineBreakIterator):
+        * platform/text/wince/TextBreakIteratorWinCE.cpp:
+        (WebCore::acquireLineBreakIterator):
+
+2012-11-05  Hayato Ito  <hayato@chromium.org>
+
+        Use switch/case statements instead of if/elseif in CSSSelector.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=100470
+
+        Reviewed by Ryosuke Niwa.
+
+        Minor clean up. We can get compiler warnings if we use switch/case statements here.
+
+        No changes to functionality, so no new tests.
+
+        * css/CSSSelector.cpp:
+        (WebCore::CSSSelector::selectorText):
+
+2012-11-05  Kenichi Ishibashi  <bashi@chromium.org>
+
+        [Chromium] Unicode combining diacritical aren't always combined on Linux
+        https://bugs.webkit.org/show_bug.cgi?id=101009
+
+        Reviewed by Kent Tamura.
+
+        Add a space character to harfbuzzBuffer as pre-context. This will prevent
+        harfbuzz from inserting dotted-circle.
+
+        Test: fast/text/international/combining-marks-position.html
+
+        * platform/graphics/harfbuzz/ng/HarfBuzzShaper.cpp:
+        (WebCore::HarfBuzzShaper::shapeHarfBuzzRuns):
+
+2012-11-05  Shinya Kawanaka  <shinyak@chromium.org>
+
+        LayoutTest fast/dom/shadow/shadowroot-type.html is failing on Windows
+        https://bugs.webkit.org/show_bug.cgi?id=101201
+
+        Reviewed by Hajime Morita.
+
+        When we use a bit field for enum, Windows compiler seems returning some wrong value.
+        We would like to avoid using a bit field for enum value.
+
+        * dom/ShadowRoot.cpp:
+        (WebCore::ShadowRoot::create):
+        * dom/ShadowRoot.h:
+        (WebCore::ShadowRoot::type):
+        (WebCore::ShadowRoot::setType):
+        (ShadowRoot):
+
+2012-11-05  Benjamin Poulain  <benjamin@webkit.org>
+
+        TransformOperationInfo's constructor is really slow
+        https://bugs.webkit.org/show_bug.cgi?id=101143
+
+        Reviewed by Sam Weinig.
+
+        TransformOperationInfo() was slow for a few reasons:
+        -The function used a lot of branches. The basic assumption is that the input
+         is incorrect, thus every character is an opportunity to fail.
+        -Every branch had to be tested in order. If the name was matching the last if()
+         all the previous names had to be tested.
+        -Since equalIgnoringCase() was used in every branch, it was forcing the case folding
+         every time.
+        -When the string is 16bits, the case folding was using ICU, which was incredibly inefficient.
+
+        This can be fixed by either
+        1) Compute the lowercase name, then match it to a HashMap.
+        2) Write a tree to quickly reduce the number of branch needed.
+
+        The first solution is not viable because 16bits strings case folding
+        remains an important bottleneck.
+
+        Instead, the code now splits the names on simple characteristics to
+        match any name in a limited number of branches.
+
+        The assumption is the input is correct, so & is used instead of && to
+        avoid branches in favor of conditional instructions.
+
+        * css/CSSParser.cpp:
+        (WebCore::TransformOperationInfo::TransformOperationInfo):
+
+2012-11-05  Simon Fraser  <simon.fraser@apple.com>
+
+        RenderGeometryMap asserts when loading http://en.softonic.com/mac
+        https://bugs.webkit.org/show_bug.cgi?id=101284
+        <rdar://problem/11540560>
+
+        Reviewed by Tim Horton.
+
+        When FrameView::layout() calls document->updateStyleIfNeeded(), we
+        can be in a state where FrameView::needsLayout() is false. However,
+        this is a bad time to update compositing layers, because we're about
+        to do layout, which will require us to update them again soon anyway,
+        and some RenderLayers may not have been sized or positioned yet.
+        
+        Fix by adding a m_doingPreLayoutStyleUpdate member to FrameView,
+        and toggling it around this call to updateStyleIfNeeded().
+        Read this state in updateCompositingLayersAfterStyleChange(), which is
+        now called unconditionally by recalcStyle(), but returns early
+        if this flag is set, or layout is pending.
+
+        * dom/Document.cpp:
+        (WebCore::Document::recalcStyle):
+        * page/FrameView.cpp:
+        (WebCore::FrameView::reset):
+        (WebCore::FrameView::updateCompositingLayersAfterStyleChange):
+        (WebCore::FrameView::layout):
+        * page/FrameView.h:
+        (FrameView):
+
+2012-11-05  Beth Dakin  <bdakin@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=101275
+        Clean up ScrollingConstraints.h
+
+        Reviewed by Simon Fraser.
+
+        This class cleans up ScrollingConstraints.h by removing the constructors since the 
+        compiler will generate those constructors for us anyway. The patch also makes the 
+        two override functions private.
+        * page/scrolling/ScrollingConstraints.h:
+        (ViewportConstraints):
+        (FixedPositionViewportConstraints):
+        (StickyPositionViewportConstraints):
+
+2012-11-05  Simon Fraser  <simon.fraser@apple.com>
+
+        Make Document::updateStyleIfNeeded() non-virtual
+        https://bugs.webkit.org/show_bug.cgi?id=101273
+
+        Reviewed by Eric Seidel.
+
+        Document::updateStyleIfNeeded() has been virtual like forever, but
+        no-one ever overrides it, so make it non-virtual.
+
+        * dom/Document.h:
+        (Document):
+
+2012-11-05  Philip Rogers  <pdr@google.com>
+
+        Unblock SVG external references
+        https://bugs.webkit.org/show_bug.cgi?id=100635
+
+        Reviewed by Adam Barth.
+
+        This patch reverts r132849 and r132869 because the potential XSS issue
+        turned out to not be an issue after all.
+
+        Covered by existing tests, many of which are re-whitelisted with this patch.
+
+        * loader/cache/CachedResourceLoader.cpp:
+        (WebCore::CachedResourceLoader::canRequest):
+
+2012-11-05  Beth Dakin  <bdakin@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=101001
+        Pages with position:fixed elements should still be able to scroll on 
+        the scrolling thread
+        -and corresponding-
+        <rdar://problem/10857315>
+
+        Reviewed by Simon Fraser.
+
+        This patch adds two new classes. ScrollingStateFixedNode is a class 
+        to represent fixed nodes in the state tree, and 
+        ScrollingTreeFixedNode represents fixed node in the scrolling tree 
+        over on the scrolling thread.
+        * WebCore.xcodeproj/project.pbxproj:
+
+        When we are (non-programatically) scrolling fixed objects on the 
+        scrolling thread, we do not want to do any work here. 
+        * page/FrameView.cpp:
+        (WebCore::FrameView::updateFixedElementsAfterScrolling):
+
+        Whenever we sync the position of the main frame's layer, we have to 
+        do the same for scrolling tree children.
+        * page/scrolling/ScrollingCoordinator.cpp:
+        (WebCore::ScrollingCoordinator::updateMainFrameScrollPosition):
+
+        New ScrollingNodeType -- FixedNode, yay! And two new functions 
+        specific to dealing with FixedNodes.
+        * page/scrolling/ScrollingCoordinator.h:
+        (WebCore::ScrollingCoordinator::updateViewportConstrainedNode):
+        (WebCore::ScrollingCoordinator::syncChildPositions):
+
+        This is the new class that represents fixed nodes in the state tree. 
+        All of the changed properties are stored within 
+        FixedPositionViewportConstraints.
+        * page/scrolling/ScrollingStateFixedNode.cpp: Added.
+        (WebCore):
+        (WebCore::ScrollingStateFixedNode::create):
+        (WebCore::ScrollingStateFixedNode::ScrollingStateFixedNode):
+        (WebCore::ScrollingStateFixedNode::~ScrollingStateFixedNode):
+        (WebCore::ScrollingStateFixedNode::updateConstraints):
+        (WebCore::ScrollingStateFixedNode::dumpProperties):
+        * page/scrolling/ScrollingStateFixedNode.h: Added.
+        (WebCore):
+        (ScrollingStateFixedNode):
+        (WebCore::ScrollingStateFixedNode::viewportConstraints):
+        (WebCore::toScrollingStateFixedNode):
+
+        Make sure to create the right type of clone for each node.
+        * page/scrolling/ScrollingStateNode.cpp:
+        (WebCore::ScrollingStateNode::cloneAndReset):
+
+        Now that m_children may be anything other than null, I found this 
+        bug. We encounter it when the parameter to removeChild is this and we 
+        want to remove all of our children. In that case, this is obviously 
+        not found in its own child array.
+        (WebCore::ScrollingStateNode::removeChild):
+
+        ScrollingStateNode now caches the GraphicsLayer in addition to the 
+        PlatformLayer. This will allow us to sync the GraphicsLayer position 
+        at the appropriate times.
+        * page/scrolling/ScrollingStateNode.h:
+        (WebCore::ScrollingStateNode::isScrollingStateFixedNode):
+        (WebCore::ScrollingStateNode::graphicsLayer):
+        (ScrollingStateNode):
+
+        Handle fixed nodes.
+        * page/scrolling/ScrollingTree.cpp:
+        (WebCore::ScrollingTree::updateTreeFromStateNode):
+
+        New function parentScrollPositionDidChange() is called on children 
+        when the parent has scrolled.
+        * page/scrolling/ScrollingTreeNode.h:
+        (ScrollingTreeNode):
+        * page/scrolling/ScrollingTreeScrollingNode.h:
+        (ScrollingTreeScrollingNode):
+
+        Return true for supportsFixedPositionLayers(). 
+        * page/scrolling/mac/ScrollingCoordinatorMac.h:
+        (ScrollingCoordinatorMac):
+
+        Handle fixed nodes.
+        * page/scrolling/mac/ScrollingCoordinatorMac.mm:
+        (WebCore::ScrollingCoordinatorMac::attachToStateTree):
+
+        Now that m_children can be non-null I caught this pre-existing bug 
+        where we would come times remove a node without updating the HashMap. 
+        This patch fixes that by consolidating the removal into one function.
+        (WebCore::ScrollingCoordinatorMac::removeNode):
+        (WebCore::ScrollingCoordinatorMac::detachFromStateTree):
+        (WebCore::ScrollingCoordinatorMac::clearStateTree):
+
+        Update the GraphicsLayers to reflect the new position that the 
+        Scrolling thread has moved the underlying CALayer to already.
+        (WebCore::ScrollingCoordinatorMac::syncChildPositions):
+
+        Pass new constraints over to the appropriate state node.
+        (WebCore::ScrollingCoordinatorMac::updateViewportConstrainedNode):
+
+        Cache the GraphicsLayer in addition to the PlatformLayer.
+        * page/scrolling/mac/ScrollingStateNodeMac.mm:
+        (WebCore::ScrollingStateNode::setScrollLayer):
+
+        Here is the new class that represents fixed nodes over on the 
+        scrolling thread. 
+        * page/scrolling/mac/ScrollingTreeFixedNode.h: Added.
+        (WebCore):
+        (ScrollingTreeFixedNode):
+        * page/scrolling/mac/ScrollingTreeFixedNode.mm: Added.
+        (WebCore):
+        (WebCore::ScrollingTreeFixedNode::create):
+        (WebCore::ScrollingTreeFixedNode::ScrollingTreeFixedNode):
+        (WebCore::ScrollingTreeFixedNode::~ScrollingTreeFixedNode):
+        (WebCore::ScrollingTreeFixedNode::update):
+
+        This is where the magic happens. re-position the fixed object when 
+        its parent has scrolled so that it appears to have not moved at all.
+        (WebCore::ScrollingTreeFixedNode::parentScrollPositionDidChange):
+
+        Whenever we change the position of a scrolling layer, tell our 
+        children.
+        * page/scrolling/mac/ScrollingTreeScrollingNodeMac.mm:
+        (WebCore::ScrollingTreeScrollingNodeMac::setScrollLayerPosition):
+
+        Handle fixed nodes.
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::attachToScrollingCoordinator):
+
+        detachFromScrollingCoordinator() needs to be public so that it can be 
+        called from RenderLayerCompositor for fixed nodes.
+        * rendering/RenderLayerBacking.h:
+        (RenderLayerBacking):
+
+        RenderLayerCompositor takes control of attaching and detaching fixed 
+        nodes to/from the ScrollingCoordinator. 
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::flushPendingLayerChanges):
+        (WebCore::RenderLayerCompositor::didFlushChangesForLayer):
+        (WebCore::RenderLayerCompositor::updateBacking):
+        (WebCore::RenderLayerCompositor::layerWillBeRemoved):
+        (WebCore::RenderLayerCompositor::didMoveOnscreen):
+        (WebCore::RenderLayerCompositor::willMoveOffscreen):
+        (WebCore::RenderLayerCompositor::clearBackingForLayerIncludingDescendants):
+        (WebCore::isRootmostFixedOrStickyLayer):
+        (WebCore):
+        (WebCore::RenderLayerCompositor::updateViewportConstraintStatus):
+        (WebCore::RenderLayerCompositor::addViewportConstrainedLayer):
+        (WebCore::RenderLayerCompositor::removeViewportConstrainedLayer):
+        (WebCore::RenderLayerCompositor::computeViewportConstraints):
+        (WebCore::nearestScrollingCoordinatorAncestor):
+        (WebCore::RenderLayerCompositor::registerOrUpdateViewportConstrainedLayer):
+        (WebCore::RenderLayerCompositor::unregisterViewportConstrainedLayer):
+        (WebCore::RenderLayerCompositor::registerAllViewportConstrainedLayers):
+        (WebCore::RenderLayerCompositor::unregisterAllViewportConstrainedLayers):
+        * rendering/RenderLayerCompositor.h:
+        (WebCore):
+        (RenderLayerCompositor):
+
+2012-11-05  Geoffrey Garen  <ggaren@apple.com>
+
+        Cleaned up the Font class in preparation for optimizing kerning and ligatures
+        https://bugs.webkit.org/show_bug.cgi?id=101258
+
+        Reviewed by Dan Bernstein.
+
+        * platform/graphics/Font.h:
+        (WebCore::Font::typesettingFeatures):
+        (WebCore::Font::computeTypesettingFeatures): Compute and cache our
+        typesetting features instead of recomputing each time a client asks
+        for them. This makes the class interface easier to use because
+        "typesettingFeatures()" can appear in more than one expression without
+        undue performance cost. This may also be a small speedup to code that
+        calls typesettingFeatures() often for other reasons.
+
+        * platform/graphics/Font.cpp:
+        (WebCore::Font::Font):
+        (WebCore::Font::operator=):
+        (WebCore::Font::update): Ditto.
+
+        (WebCore::Font::width): Unforked the width() function so all width-related
+        interfaces can benefit from optimization without duplicate code.
+
+2012-11-05  Peng Huang  <penghuang@google.com>
+
+        Webkit does not handle some media keys correctly On Linux gtk platform.
+        https://bugs.webkit.org/show_bug.cgi?id=101221
+
+        Reviewed by Alexey Proskuryakov.
+
+        Add media keyboard support on Linux gtk platform.
+
+        * platform/chromium/KeyCodeConversionGtk.cpp:
+        (WebCore::windowsKeyCodeForKeyEvent):
+
+2012-11-05  Glenn Adams  <glenn@skynav.com>
+
+        Add support to -webkit-line-break property for CSS3 Text line-break property values and semantics.
+        https://bugs.webkit.org/show_bug.cgi?id=89235
+
+        Reviewed by Eric Seidel.
+
+        See also wiki documentation at:
+        [1] http://trac.webkit.org/wiki/LineBreaking
+        [2] http://trac.webkit.org/wiki/LineBreakingCSS3Mapping
+
+        Web exposed changes include:
+        (1) The default (initial) value for -webkit-line-break becomes 'auto', instead of 'normal';
+        (2) The values 'auto', 'loose', 'normal', and 'strict' are added to -webkit-line-break;
+        (3) See [2] above for details regarding interpretation.
+
+        Tests: css3/line-break/line-break-auto-centered.html
+               css3/line-break/line-break-auto-half-kana.html
+               css3/line-break/line-break-auto-hyphens.html
+               css3/line-break/line-break-auto-inseparables.html
+               css3/line-break/line-break-auto-iteration-marks.html
+               css3/line-break/line-break-auto-postfixes.html
+               css3/line-break/line-break-auto-prefixes.html
+               css3/line-break/line-break-auto-sound-marks.html
+               css3/line-break/line-break-loose-centered.html
+               css3/line-break/line-break-loose-half-kana.html
+               css3/line-break/line-break-loose-hyphens.html
+               css3/line-break/line-break-loose-inseparables.html
+               css3/line-break/line-break-loose-iteration-marks.html
+               css3/line-break/line-break-loose-postfixes.html
+               css3/line-break/line-break-loose-prefixes.html
+               css3/line-break/line-break-loose-sound-marks.html
+               css3/line-break/line-break-normal-centered.html
+               css3/line-break/line-break-normal-half-kana.html
+               css3/line-break/line-break-normal-hyphens.html
+               css3/line-break/line-break-normal-inseparables.html
+               css3/line-break/line-break-normal-iteration-marks.html
+               css3/line-break/line-break-normal-postfixes.html
+               css3/line-break/line-break-normal-prefixes.html
+               css3/line-break/line-break-normal-sound-marks.html
+               css3/line-break/line-break-strict-centered.html
+               css3/line-break/line-break-strict-half-kana.html
+               css3/line-break/line-break-strict-hyphens.html
+               css3/line-break/line-break-strict-inseparables.html
+               css3/line-break/line-break-strict-iteration-marks.html
+               css3/line-break/line-break-strict-postfixes.html
+               css3/line-break/line-break-strict-prefixes.html
+               css3/line-break/line-break-strict-sound-marks.html
+
+        * platform/text/LineBreakIteratorPoolICU.h:
+        (WebCore::LineBreakIteratorPool::makeLocaleWithBreakKeyword):
+        Add static function to construct ICU locale argument (also used as pool key) with additional
+        break keyword.
+        (WebCore::LineBreakIteratorPool::take):
+        (WebCore::LineBreakIteratorPool::put):
+        (LineBreakIteratorPool):
+        Remove direct dependency from ICU library (and types), moving that dependency into
+        new {open,close}LineBreakIterator() functions (defined in TextBreakIteratorICU.cpp).
+        Update to take line break mode into account.
+        Create (and cache) different break iterators depending on line break mode (in addition to locale),
+        which entails expanding pool entry key format to optionally append "@break=" +
+        "loose"|"normal"|"strict" keyword to locale string.
+
+        * platform/text/TextBreakIterator.h:
+        (WebCore::LazyLineBreakIterator::LazyLineBreakIterator):
+        (WebCore::LazyLineBreakIterator::isLooseCJKMode):
+        (WebCore::LazyLineBreakIterator::get):
+        (WebCore::LazyLineBreakIterator::reset):
+        (LazyLineBreakIterator):
+        Define LineBreakIteratorMode enumeration for use in TextBreakIterator et al.
+        Add state member to indicate line break mode.
+
+        * platform/text/TextBreakIteratorICU.cpp:
+        (WebCore::acquireLineBreakIterator):
+        Use new line break mode when making iterator from pool.
+        Handle change of return type of LineBreakIteratorPool::take() to non-ICU type,
+        i.e., TextBreakIterator* instead of ICU's UBreakIterator*.
+        (WebCore::releaseLineBreakIterator):
+        Handle change of parameter type of LineBreakIteratorPool::put() to non-ICU type,
+        i.e., TextBreakIterator* instead of ICU's UBreakIterator*.
+        (WebCore::isCJKLocale):
+        New functions for determining if CJK rules apply.
+        (WebCore::openLineBreakIterator):
+        New function for abstracting opening of ICU style line break iterator. This is now
+        used in LineBreakIteratorPoolICU.h rather than having direct ICU API dependency there.
+        This function also takes into account the line break mode.
+        (WebCore::closeLineBreakIterator):
+        (WebCore::mapLineIteratorModeToRules):
+        New function for abstracting closing of ICU style line break iterator. This is now
+        used in LineBreakIteratorPoolICU.h rather than having direct ICU API dependency there.
+
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::RenderBlock::LineBreaker::nextLineBreak):
+        Pass line break iterator mode flag when reseting LazyLineBreakIterator.
+        Add looseMode local variable to prevent need for computing under isBreakable().
+
+        * rendering/RenderText.cpp:
+        (WebCore::mapLineBreakToIteratorMode):
+        Add implementation for mapLineBreakToIteratorMode(), used by both RenderText::computePreferredLogicalWidths
+        and RenderBlock::LineBreaker::nextLineBreak.
+        (WebCore::RenderText::computePreferredLogicalWidths):
+        Ensure (lazy line) breakIterator is initialized for line break mode.
+        Ensure isBreakable() is passed loose mode flag to match behavior in RenderBlock::LineBreaker::nextLineBreak.
+
+        * rendering/RenderText.h:
+        (WebCore):
+        Add declaration for mapLineBreakToIteratorMode(), used by both RenderText::computePreferredLogicalWidths
+        and RenderBlock::LineBreaker::nextLineBreak.
+
+        * rendering/break_lines.cpp:
+        (WebCore):
+        Introduce two (local) enums NBSPBehavior and LooseBehavior for expanding template on nextBreakablePosition
+        to include loose mode parameter.
+        (WebCore::isBreakableSpace):
+        Add externally specified loose mode parameter to prevent need to invoke line break iterator
+        accessor method on each invocation. Use new loose mode flavors off NBP functions.
+        (WebCore::needsLineBreakIterator):
+        Introduce loose mode behavior template parameter to optimize loose mode behavior code path in order
+        to prevent regression to non loose mode path.
+        (WebCore::nextBreakablePosition):
+        (WebCore::nextBreakablePositionIgnoringNBSP):
+        Use new template parameter enums described above.
+        (WebCore::nextBreakablePositionIgnoringNBSPLoose):
+        (WebCore::nextBreakablePositionLoose):
+        Introduce two additional 'loose' mode flavors of NBP template expansions.
+
+        * rendering/break_lines.h:
+        (WebCore):
+        (WebCore::isBreakable):
+        Add externally specified loose mode parameter to prevent need to invoke line break iterator
+        accessor method on each invocation.
+
+2012-11-05  Adam Barth  <abarth@webkit.org>
+
+        webkitRegionLayoutUpdate is incorrectly named
+        https://bugs.webkit.org/show_bug.cgi?id=100335
+
+        Reviewed by Ojan Vafai.
+
+        DOM event names are supposed to be lower case.
+
+        * dom/EventNames.h:
+        (WebCore):
+        * dom/WebKitNamedFlow.cpp:
+        (WebCore::WebKitNamedFlow::dispatchRegionLayoutUpdateEvent):
+
+2012-11-05  Adam Barth  <abarth@webkit.org>
+
+        [V8] IntrusiveDOMWrapperMap should be usable for more than just Nodes
+        https://bugs.webkit.org/show_bug.cgi?id=101110
+
+        Reviewed by Kentaro Hara.
+
+        This patch generalizes our support for storing wrappers in DOM objects
+        to be usable for more than just nodes. After this patch, any object
+        with a ScriptWrappable base class will have its wrapper stored inline
+        in the object in the main world.
+
+        To achieve this goal, this patch hides the details of how we map from
+        objects to wrappers inside DOMDataStore and then removes the
+        IntrusiveDOMWrapperMap class entirely. This approach lets us remove the
+        DOMWrapperMap base class and make all of these functions non-virtual.
+
+        * UseV8.cmake:
+        * WebCore.gypi:
+            - Remove deleted files.
+        * bindings/scripts/CodeGeneratorV8.pm:
+        (GenerateHeader):
+        (GenerateNormalAttrGetter):
+        (GenerateConstructorCallback):
+        (GenerateNamedConstructorCallback):
+        (GenerateToV8Converters):
+            - Rather than grabbing at the DOMWrapperMap directly, we now ask
+              the DOMDataStore to do this work for us.
+        * bindings/scripts/test/V8/V8Float64Array.h:
+        (WebCore::V8Float64Array::wrap):
+        * bindings/scripts/test/V8/V8TestActiveDOMObject.h:
+        (WebCore::V8TestActiveDOMObject::wrap):
+        * bindings/scripts/test/V8/V8TestCustomNamedGetter.h:
+        (WebCore::V8TestCustomNamedGetter::wrap):
+        * bindings/scripts/test/V8/V8TestEventConstructor.h:
+        (WebCore::V8TestEventConstructor::wrap):
+        * bindings/scripts/test/V8/V8TestEventTarget.h:
+        (WebCore::V8TestEventTarget::wrap):
+        * bindings/scripts/test/V8/V8TestException.h:
+        (WebCore::V8TestException::wrap):
+        * bindings/scripts/test/V8/V8TestInterface.h:
+        (WebCore::V8TestInterface::wrap):
+        * bindings/scripts/test/V8/V8TestMediaQueryListListener.h:
+        (WebCore::V8TestMediaQueryListListener::wrap):
+        * bindings/scripts/test/V8/V8TestNamedConstructor.h:
+        (WebCore::V8TestNamedConstructor::wrap):
+        * bindings/scripts/test/V8/V8TestNode.cpp:
+        (WebCore::V8TestNode::constructorCallback):
+        (WebCore::V8TestNode::wrapSlow):
+        * bindings/scripts/test/V8/V8TestObj.cpp:
+        (WebCore::TestObjV8Internal::readOnlyTestObjAttrAttrGetter):
+        * bindings/scripts/test/V8/V8TestObj.h:
+        (WebCore::V8TestObj::wrap):
+        * bindings/scripts/test/V8/V8TestSerializedScriptValueInterface.h:
+        (WebCore::V8TestSerializedScriptValueInterface::wrap):
+        * bindings/v8/DOMDataStore.cpp:
+            - Updated run-bindings-test results.
+        (WebCore::DOMDataStore::DOMDataStore):
+        (WebCore::DOMDataStore::~DOMDataStore):
+            - Simplify constructor and destructor now that there is only one
+              hash map.
+        (WebCore::DOMDataStore::current):
+            - Now that V8DOMMap.cpp doesn't handle the null isolate case, we
+              need to handle it here.
+        (WebCore::DOMDataStore::reportMemoryUsage):
+            - Simplfied now that there is only one wrapper map.
+        (WebCore::DOMDataStore::weakCallback):
+            - Moved from IntrusiveDOMWrapperMap.h
+        * bindings/v8/DOMDataStore.h:
+        (WebCore::DOMDataStore::get):
+        (WebCore::DOMDataStore::set):
+            - These functions now handle the intrusive case with a branch
+              rather than with a virtual function call. In many cases, the
+              branch can be optimized away by the compiler when the overloaded
+              inline functions are inlined.
+        (WebCore::DOMDataStore::wrapperIsStoredInObject):
+            - Overloaded functions to determine whether to store the wrapper
+              inside the object or in the hashmap.
+        (WebCore::DOMDataStore::getWrapperFromObject):
+        (WebCore::DOMDataStore::storeWrapperInObject):
+            - Overloaded functions to get/set the wrapper from inside the
+              object itself.
+        * bindings/v8/DOMWrapperMap.h:
+        (WebCore::DOMWrapperHashMap::get):
+        (WebCore::DOMWrapperHashMap::set):
+        (WebCore::DOMWrapperHashMap::clear):
+        (WebCore::DOMWrapperHashMap::reportMemoryUsage):
+        (WebCore::DOMWrapperHashMap::remove):
+            - These functions are no longer virtual.
+        * bindings/v8/DOMWrapperWorld.h:
+        * bindings/v8/IntrusiveDOMWrapperMap.h: Removed.
+        * bindings/v8/ScriptProfiler.cpp:
+        * bindings/v8/SerializedScriptValue.cpp:
+        (WebCore::neuterBinding):
+            - We need to keep the type information slightly longer so that we
+              look in the right wrapper map.
+        * bindings/v8/V8DOMMap.cpp: Removed.
+        * bindings/v8/V8DOMMap.h: Removed.
+        * bindings/v8/V8DOMWindowShell.cpp:
+        * bindings/v8/V8DOMWrapper.cpp:
+        * bindings/v8/V8DOMWrapper.h:
+        (WebCore::V8DOMWrapper::getCachedWrapper):
+            - Defer this work to the store.
+        (WebCore::V8DOMWrapper::setWrapperClass):
+            - An overloaded function to set the right wrapper class.
+        (WebCore::V8DOMWrapper::setJSWrapperForDOMObject):
+            - This function is now general enough to handle ever kind of object.
+        * bindings/v8/V8GCController.cpp:
+        * bindings/v8/V8NPObject.cpp:
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        * bindings/v8/WorkerScriptController.cpp:
+        * bindings/v8/custom/V8HTMLImageElementConstructor.cpp:
+        (WebCore::v8HTMLImageElementConstructorCallback):
+            - Call the more general function (instead of the now-deleted specialized function).
+
+2012-11-05  Alexey Proskuryakov  <ap@apple.com>
+
+        Get rid of setCookieStoragePrivateBrowsingEnabled.
+        https://bugs.webkit.org/show_bug.cgi?id=101247
+
+        Reviewed by Brady Eidson.
+
+        We were only doing anything here on Mac, and only because we couldn't know if
+        sessions were in use. But sessions are always in use, and those obsolete changing
+        cookie storage explicitly.
+
+        * platform/network/win/CookieStorageWin.cpp: Removed.
+        * PlatformWinCE.cmake:
+        * WebCore.gypi:
+        No more CookieStorageWin.cpp with an empty implementation.
+    
+        * WebCore.exp.in:
+        * platform/mac/WebCoreSystemInterface.h:
+        * platform/mac/WebCoreSystemInterface.mm:
+        We no longer need this WKSI function.
+
+        * page/Settings.cpp: (WebCore::Settings::setPrivateBrowsingEnabled):
+        Removed the only call to setCookieStoragePrivateBrowsingEnabled().
+
+        * platform/network/CookieStorage.h:
+        * platform/network/cf/CookieStorageCFNet.cpp:
+        * platform/network/curl/CookieJarCurl.cpp:
+        * platform/network/soup/CookieStorageSoup.cpp:
+        * platform/qt/TemporaryLinkStubsQt.cpp:
+        Removed empty setCookieStoragePrivateBrowsingEnabled implementations.
+
+        * platform/network/mac/CookieStorageMac.mm: This function used to have a FIXME
+        that we should observe private storage while in private browsing mode. I don't think
+        that it was correct - Safari doesn't display content of private storage, and thus
+        doesn't need to know about changes.
+        The removal of this function has an effect on WebKit1 clients that enable private
+        browsing. We used to globally change cookie storage, even for loads not initiated
+        by WebKit. Now we match API description: "If private browsing is enabled, WebKit
+        will not store information about sites the user visits."
+
+2012-11-05  Florin Malita  <fmalita@chromium.org>
+
+        Crash when mixing layers, foreignObjects and SVG hidden containers
+        https://bugs.webkit.org/show_bug.cgi?id=87297
+
+        Reviewed by Dirk Schulze.
+
+        Foreign objects may introduce content which requires layers, but layer creation is
+        suppressed within RenderSVGHiddenContainer subtrees and this yields an inconsistent render
+        tree state. This patch prevents foreignObject renderer instantiation under
+        RenderSVGHiddenContainers.
+
+        Test: svg/foreignObject/foreign-object-defs-crash.svg
+
+        * svg/SVGForeignObjectElement.cpp:
+        (WebCore::SVGForeignObjectElement::rendererIsNeeded):
+        (WebCore):
+        * svg/SVGForeignObjectElement.h:
+        (SVGForeignObjectElement):
+
+2012-11-05  Simon Fraser  <simon.fraser@apple.com>
+
+        Remove the unused m_fixedPositionedElements from RenderView
+        https://bugs.webkit.org/show_bug.cgi?id=101251
+
+        Reviewed by Anders Carlsson.
+
+        m_fixedPositionedElements was completely unused. Remove it
+        and the related typedef.
+
+        * rendering/RenderView.h:
+        (RenderView):
+
+2012-11-05  Simon Fraser  <simon.fraser@apple.com>
+
+        Fix layer borders to cleaning appear and disappear on switching
+        https://bugs.webkit.org/show_bug.cgi?id=101136
+
+        Reviewed by Sam Weinig.
+
+        GraphicsLayers decided whether to show layer borders based
+        on a callback through the GraphicsLayerClient. This made it
+        hard to manage state, resulting in a failure to cleanly
+        hide layers when toggled off via the preference.
+        
+        Changed the layer border and repaint counter visibility to be bits
+        stored on GraphicsLayer just like other properties, with getters
+        and setters. RenderLayerBacking now updates these debug
+        indicators when we update other compositing layer properties.
+        
+        In GraphicsLayerCA, avoid calling updateDebugIndicators() explicitly
+        in several places by setting the change flag DebugIndicatorsChanged
+        for properties whose values affect the appearance of the debug border.
+
+        Removed the GraphicsLayerClient methods showDebugBorders() and
+        showRepaintCounter() which are no longer required.
+
+        * platform/graphics/GraphicsLayer.cpp:
+        (WebCore::GraphicsLayer::GraphicsLayer):
+        (WebCore::GraphicsLayer::updateDebugIndicators):
+        * platform/graphics/GraphicsLayer.h:
+        (WebCore::GraphicsLayer::setShowDebugBorder):
+        (WebCore::GraphicsLayer::isShowingDebugBorder):
+        (WebCore::GraphicsLayer::setShowRepaintCounter):
+        (WebCore::GraphicsLayer::isShowingRepaintCounter):
+        (WebCore::GraphicsLayer::repaintCount):
+        (WebCore::GraphicsLayer::incrementRepaintCount):
+        * platform/graphics/GraphicsLayerClient.h:
+        * platform/graphics/ca/GraphicsLayerCA.cpp:
+        (WebCore::GraphicsLayerCA::GraphicsLayerCA):
+        (WebCore::GraphicsLayerCA::setMasksToBounds):
+        (WebCore::GraphicsLayerCA::setDrawsContent):
+        (WebCore::GraphicsLayerCA::platformCALayerShowRepaintCounter):
+        (WebCore::GraphicsLayerCA::commitLayerChangesBeforeSublayers):
+        (WebCore::GraphicsLayerCA::updateMasksToBounds):
+        (WebCore::GraphicsLayerCA::updateLayerDrawsContent):
+        (WebCore::GraphicsLayerCA::updateDebugBorder):
+        (WebCore::GraphicsLayerCA::setShowDebugBorder):
+        (WebCore::GraphicsLayerCA::setShowRepaintCounter):
+        (WebCore::GraphicsLayerCA::swapFromOrToTiledLayer):
+        (WebCore::GraphicsLayerCA::setupContentsLayer):
+        (WebCore::GraphicsLayerCA::cloneLayer):
+        * platform/graphics/ca/GraphicsLayerCA.h:
+        (GraphicsLayerCA):
+        (WebCore::GraphicsLayerCA::platformCALayerShowDebugBorders):
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::updateDebugIndicators):
+        * rendering/RenderLayerBacking.h:
+        (RenderLayerBacking):
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::updateBacking):
+        * rendering/RenderLayerCompositor.h:
+        (RenderLayerCompositor):
+
+2012-11-05  Genevieve Mak  <gmak@rim.com>
+
+        [BLACKBERRY] Update touch code to reflect touch refactor
+        https://bugs.webkit.org/show_bug.cgi?id=101227
+
+        Reviewed by Rob Buis.
+
+        PR #2706785
+        Reviewed Internally by: Mike Lattanzio
+
+        * platform/blackberry/PlatformTouchEventBlackBerry.cpp:
+        (WebCore::touchEventType):
+        (WebCore::PlatformTouchEvent::PlatformTouchEvent):
+
+2012-11-05  Alok Priyadarshi  <alokp@chromium.org>
+
+        [chromium] Pass canPaintLCDText to WebContentLayerClient::paintContents
+        https://bugs.webkit.org/show_bug.cgi?id=99083
+
+        Reviewed by Stephen White.
+
+        Use LCD text setting passed to WebContentLayerClient::paintContents instead of turning it off for all composited layers.
+
+        No new tests needed. This patch does not change anything functionally.
+
+        * platform/graphics/chromium/GraphicsLayerChromium.cpp:
+        (WebCore::GraphicsLayerChromium::setContentsOpaque):
+        (WebCore::GraphicsLayerChromium::paint):
+        * platform/graphics/chromium/OpaqueRectTrackingContentLayerDelegate.cpp:
+        (WebCore::OpaqueRectTrackingContentLayerDelegate::paintContents):
+        * platform/graphics/chromium/OpaqueRectTrackingContentLayerDelegate.h:
+        (OpaqueRectTrackingContentLayerDelegate):
+
+2012-11-05  Stephen White  <senorblanco@chromium.org>
+
+        [chromium] Build fix after http://trac.webkit.org/changeset/133488.
+        Removed a deleted file.  Unreviewed.
+
+        * WebCore.gypi:
+
+2012-11-05  Kentaro Hara  <haraken@chromium.org>
+
+        [V8] toV8(impl) should return null if impl is 0
+        https://bugs.webkit.org/show_bug.cgi?id=101206
+
+        Reviewed by Adam Barth.
+
+        toV8(impl) should return null if impl is 0. However,
+        V8HTMLCollection::toV8() does not have the null check.
+        All other toV8()s return null.
+
+        No tests. I think there will be no call path that hits the change.
+
+        * bindings/v8/custom/V8HTMLCollectionCustom.cpp:
+        (WebCore::toV8):
+
+2012-11-05  David Barton  <dbarton@mathscribe.com>
+
+        Implement SimpleFontData::platformBoundsForGlyph on skia
+        https://bugs.webkit.org/show_bug.cgi?id=101115
+
+        Reviewed by Eric Seidel.
+
+        The implementation is similar to SimpleFontData::platformWidthForGlyph on skia.
+
+        Tested by: fast/block/lineboxcontain/*glyphs*, mathml/presentation/*
+
+        * platform/graphics/skia/SimpleFontDataSkia.cpp:
+        (WebCore::SimpleFontData::platformBoundsForGlyph): Implemented.
+
+2012-11-05  Andreas Kling  <kling@webkit.org>
+
+        Decouple Attr logic from ElementAttributeData.
+        <http://webkit.org/b/101126>
+
+        Reviewed by Antti Koivisto.
+
+        Move all logic dealing with Attr DOM nodes from ElementAttributeData to Element.
+        This makes more sense since an Attr is tied to a single Element, but an ElementAttributeData
+        can be shared by any number of Elements at a given time.
+
+        Also updated naming convention from just "Attr" to "Attr node" in the code I was touching.
+        "Attr" is way too generic, and has been historically confused with WebCore::Attribute a lot.
+
+        * dom/Element.h:
+        * dom/ElementAttributeData.h:
+        * dom/Element.cpp:
+        (WebCore::attrNodeListMap):
+        (WebCore::attrNodeListForElement):
+        (WebCore::ensureAttrNodeListForElement):
+        (WebCore::removeAttrNodeListForElement):
+        (WebCore::findAttrNodeInList):
+        (WebCore::Element::~Element):
+        (WebCore::Element::detachAttribute):
+        (WebCore::Element::setAttributeNode):
+        (WebCore::Element::removeAttributeInternal):
+        (WebCore::Element::getAttributeNode):
+        (WebCore::Element::getAttributeNodeNS):
+        (WebCore::Element::normalizeAttributes):
+        (WebCore::Element::attrIfExists):
+        (WebCore::Element::ensureAttr):
+        (WebCore::Element::detachAttrNodeFromElementWithValue):
+        (WebCore::Element::detachAllAttrNodesFromElement):
+        (WebCore::Element::cloneAttributesFromElement):
+
+            Move everything Attr-related into Element.cpp while simplifying some loops and remove
+            conditions that are no longer needed as they used to depend on having an attributeData().
+
+        * dom/Node.h:
+        (WebCore::Node::hasSyntheticAttrChildNodes):
+        (WebCore::Node::setHasSyntheticAttrChildNodes):
+
+            Renamed the hasAttrList() node flag to hasSyntheticAttrChildNodes().
+
+        * dom/Attr.cpp:
+        (WebCore::Attr::detachFromElementWithValue):
+
+            Remove awkward indirection and let the call site deal with removing the Attr node from
+            the Element's list of Attr nodes.
+
+        * dom/ElementAttributeData.cpp:
+        (WebCore::ElementAttributeData::clearAttributes):
+
+            Remove now-unused Element* argument.
+
+2012-11-05  Hans Muller  <hmuller@adobe.com>
+
+        [CSS Exclusions] Polygon edges should span colinear vertices
+        https://bugs.webkit.org/show_bug.cgi?id=99343
+
+        Reviewed by Dirk Schulze.
+
+        ExclusionPolygonEdges now span coincident and collinear vertices. Currently
+        pairs of vertices are only considered coincident if their coordinates are exactly
+        equal. Similarly, a vertex is only considered collinear with an edge if the area
+        of the triangle defined by the three vertices is exactly zero.  In the future it
+        may be useful to relax the comparison with zero.
+
+        Tests: fast/exclusions/shape-inside/shape-inside-coincident-vertices.html
+               fast/exclusions/shape-inside/shape-inside-collinear-vertices.html
+
+        * rendering/ExclusionPolygon.cpp:
+        (WebCore::determinant): Used to measure collinearity.
+        (WebCore):
+        (WebCore::areCollinearPoints): True if three FloatPoint arguments are collinear per the test outlined above.
+        (WebCore::areCoincidentPoints): True if the two FloatPoint arguments are equal.
+        (WebCore::nextVertexIndex): The next vertex index in clockwise or counterclockwise order.
+        (WebCore::ExclusionPolygon::findNextEdgeVertexIndex): Return the index of the next non-coincident, non-collinear vertex.
+        (WebCore::ExclusionPolygon::ExclusionPolygon): Skip coincident and collinear vertices when building the list of edges.
+        * rendering/ExclusionPolygon.h: Added private findNextEdgeVertexIndex() declaration.
+
+2012-11-05  Christophe Dumez  <christophe.dumez@intel.com>
+
+        [EFL] Use POSIX implementation of SharedBuffer::createWithContentsOfFile()
+        https://bugs.webkit.org/show_bug.cgi?id=101228
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Get rid of EFL-specific implementation of SharedBuffer::createWithContentsOfFile()
+        and reuse the POSIX one since it is pretty much the same.
+
+        No new tests, no behavior change.
+
+        * PlatformEfl.cmake:
+        * platform/efl/SharedBufferEfl.cpp: Removed.
+
+2012-11-05  Kentaro Hara  <haraken@chromium.org>
+
+        Add a comment about a return value of IDBKey::toV8()
+        https://bugs.webkit.org/show_bug.cgi?id=101212
+
+        Reviewed by Adam Barth.
+
+        Although all other toV8(impl) return null when impl is 0,
+        IDBKey::toV8(impl) is expected to return undefined when impl is 0.
+        This patch adds a comment about it.
+
+        No tests.
+
+        * bindings/js/JSIDBKeyCustom.cpp:
+        (WebCore::toJS):
+        * bindings/v8/custom/V8IDBKeyCustom.cpp:
+        (WebCore::toV8):
+
+2012-11-05  Dominik Röttsches  <dominik.rottsches@intel.com>
+
+        [Cairo] Make Cairo honor image orientation
+        https://bugs.webkit.org/show_bug.cgi?id=101207
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Implement transformed image drawing in BitmapImageCairo, similar
+        as it was done for Skia in bug 100179, r132384.
+        The image drawing code needs to transform the graphics context
+        depending on exif orientation in order for this to work.
+
+        No new tests, covered by fast/images/exif-* which are passing now.
+
+        * platform/graphics/BitmapImage.h: Enable draw function which respects image orientation for Cairo.
+        * platform/graphics/cairo/BitmapImageCairo.cpp:
+        (WebCore::BitmapImage::draw): Apply ImageOrientation's transformFromDefault() transformation to context.
+        (WebCore):
+
+2012-11-05  Kentaro Hara  <haraken@chromium.org>
+
+        [V8] Dispose() and Clear() should be always coupled for safety
+        https://bugs.webkit.org/show_bug.cgi?id=101191
+
+        Reviewed by Adam Barth.
+
+        Clear() is not mandatory. However, to avoid misusing already
+        disposed wrappers, Clear() should be always called just
+        after Dispose().
+
+        No tests. No change in behavior.
+
+        * bindings/v8/DOMWrapperMap.h:
+        (WebCore::DOMWrapperHashMap::defaultWeakCallback):
+        * bindings/v8/IntrusiveDOMWrapperMap.h:
+        (WebCore::IntrusiveDOMWrapperMap::weakCallback):
+        * bindings/v8/NPV8Object.cpp:
+        (WebCore::freeV8NPObject):
+        * bindings/v8/ScheduledAction.cpp:
+        (WebCore::ScheduledAction::~ScheduledAction):
+        * bindings/v8/V8NPObject.cpp:
+        (WebCore::V8NPTemplateMap::dispose):
+        (WebCore::weakNPObjectCallback):
+        (WebCore::forgetV8ObjectForNPObject):
+        * bindings/v8/V8PerContextData.cpp:
+        (WebCore::V8PerContextData::dispose):
+        * bindings/v8/V8ValueCache.cpp:
+        (WebCore::cachedStringCallback):
+        (WebCore::IntegerCache::~IntegerCache):
+        * bindings/v8/custom/V8InjectedScriptManager.cpp:
+        (WebCore::WeakReferenceCallback):
+
+2012-11-05  Hans Muller  <hmuller@adobe.com>
+
+        [CSS Exclusions] Layout of the first shape-inside line can be incorrect
+        https://bugs.webkit.org/show_bug.cgi?id=100996
+
+        Reviewed by Dirk Schulze.
+
+        Made the conversion from floating point top/bottom logical shape bounds coordinates
+        LayoutUnits explicit and corrected the case where the top value was truncated.  A
+        float logicalTop value is converted to LayoutUnit with fromFloatCeil() to ensure
+        that the LayoutUnit value is within the shape.
+        
+        Test: fast/exclusions/shape-inside/shape-inside-shape-logical-top.html
+
+        * rendering/ExclusionShapeInsideInfo.h:
+        (WebCore::ExclusionShapeInsideInfo::shapeLogicalTop): Redefined this method in terms of shapeLogicalBoundsY,Max().
+        (WebCore::ExclusionShapeInsideInfo::shapeLogicalBottom):  Ditto.
+        (WebCore::ExclusionShapeInsideInfo::lineOverlapsShapeBounds):  Ditto.
+        (ExclusionShapeInsideInfo):
+        (WebCore::ExclusionShapeInsideInfo::shapeLogicalBoundsY): Explicit conversion from floating point shape coordinates to LayoutUnits.
+        (WebCore::ExclusionShapeInsideInfo::shapeLogicalBoundsMaxY): Ditto.
+
+2012-11-05  Antti Koivisto  <antti@apple.com>
+
+        Protect against resource deletion during iteration in MemoryCache::pruneDeadResourcesToSize
+        https://bugs.webkit.org/show_bug.cgi?id=101211
+
+        Reviewed by Andreas Kling.
+        
+        Some crashes have been seen under MemoryCache::pruneDeadResourcesToSize. A possible cause is that
+        destroyDecodedData() call ends up evicting the resource pointed by 'previous' pointer during iteration
+        and deleting the object. This looks in principle possible via stylesheets and SVG images.
+        
+        Speculative fix, no repro, no obvious way to construct a test.
+
+        * loader/cache/MemoryCache.cpp:
+        (WebCore::MemoryCache::pruneDeadResourcesToSize):
+        
+            Use CachedResourceHandle to protect the 'previous' pointer during iteration. Check if the
+            resource has been kicked out from the cache during destroyDecodedData() and stop iterating
+            if has (as it may die when CachedResourceHandle releases it).
+            The 'current' pointer is not protected as the resource it points to is allowed to die.
+            
+2012-11-05  Andrey Adaikin  <aandrey@chromium.org>
+
+        Web Inspector: Fix jscompiler cast syntax
+        https://bugs.webkit.org/show_bug.cgi?id=101066
+
+        Reviewed by Pavel Feldman.
+
+        Casts should be in the form of "/** @type {TypeName} */ (expr)" instead of "/** @type {TypeName} */ expr".
+
+        * inspector/InjectedScriptCanvasModuleSource.js:
+        (.):
+        * inspector/InjectedScriptSource.js:
+        (.):
+        * inspector/front-end/ApplicationCacheModel.js:
+        (WebInspector.ApplicationCacheModel.prototype._frameNavigated):
+        (WebInspector.ApplicationCacheModel.prototype._frameDetached):
+        * inspector/front-end/AuditLauncherView.js:
+        (WebInspector.AuditLauncherView.prototype._onRequestStarted):
+        (WebInspector.AuditLauncherView.prototype._onRequestFinished):
+        * inspector/front-end/BreakpointManager.js:
+        (WebInspector.BreakpointManager.prototype._uiSourceCodeAdded):
+        (WebInspector.BreakpointManager.prototype._uiSourceCodeFormatted):
+        (WebInspector.BreakpointManager.prototype._uiSourceCodeRemoved):
+        (WebInspector.BreakpointManager.prototype._breakpointResolved):
+        (WebInspector.BreakpointManager.Breakpoint.prototype._locationUpdated):
+        (WebInspector.BreakpointManager.Storage):
+        * inspector/front-end/BreakpointsSidebarPane.js:
+        (WebInspector.JavaScriptBreakpointsSidebarPane.prototype._breakpointAdded):
+        * inspector/front-end/CSSNamedFlowCollectionsView.js:
+        (WebInspector.CSSNamedFlowCollectionsView.prototype._documentUpdated):
+        (WebInspector.CSSNamedFlowCollectionsView.prototype._namedFlowCreated):
+        (WebInspector.CSSNamedFlowCollectionsView.prototype._regionLayoutUpdated):
+        (WebInspector.CSSNamedFlowCollectionsView.prototype._selectedNodeChanged):
+        * inspector/front-end/CSSSelectorProfileView.js:
+        (WebInspector.CSSProfileHeader.prototype.createView):
+        * inspector/front-end/CSSStyleModel.js:
+        (WebInspector.CSSStyleModel.LiveLocation.prototype.uiLocation):
+        (WebInspector.CSSStyleDeclaration.parseComputedStylePayload):
+        * inspector/front-end/CompilerScriptMapping.js:
+        (WebInspector.CompilerScriptMapping.prototype.rawLocationToUILocation):
+        (WebInspector.CompilerScriptMapping.prototype.loadSourceMapForScript):
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype._frameAdded):
+        (WebInspector.ConsoleView.prototype._frameRemoved):
+        * inspector/front-end/DOMAgent.js:
+        (WebInspector.DOMDocument):
+        * inspector/front-end/DebuggerModel.js:
+        (WebInspector.DebuggerModel.prototype.didSetBreakpoint):
+        (WebInspector.DebuggerModel.prototype.setBreakpointByURL):
+        (WebInspector.DebuggerModel.prototype.):
+        (WebInspector.DebuggerModel.prototype.setBreakpointBySourceId):
+        (WebInspector.DebuggerModel.CallFrame.prototype.get location):
+        * inspector/front-end/DebuggerScriptMapping.js:
+        (WebInspector.DebuggerScriptMapping.prototype._parsedScriptSource):
+        * inspector/front-end/DirectoryContentView.js:
+        (WebInspector.DirectoryContentView.prototype._sort):
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.prototype._updateBreadcrumbIfNeeded):
+        * inspector/front-end/ElementsPanelDescriptor.js:
+        (WebInspector.ElementsPanelDescriptor.prototype.appendApplicableItems):
+        * inspector/front-end/ElementsTreeOutline.js:
+        (.get node):
+        * inspector/front-end/ExtensionServer.js:
+        (WebInspector.ExtensionServer.prototype._onAddRequestHeaders):
+        (WebInspector.ExtensionServer.prototype._handleOpenURL):
+        (WebInspector.ExtensionServer.prototype._onGetResourceContent):
+        (WebInspector.ExtensionServer.prototype._onSetResourceContent):
+        (WebInspector.ExtensionServer.prototype._notifyResourceAdded):
+        (WebInspector.ExtensionServer.prototype._notifyUISourceCodeContentCommitted):
+        (WebInspector.ExtensionServer.prototype._notifyRequestFinished):
+        * inspector/front-end/FileContentView.js:
+        (WebInspector.FileContentView.prototype._metadataReceived):
+        (WebInspector.FileContentView.FileContentProvider.prototype.requestContent):
+        * inspector/front-end/FileSystemModel.js:
+        (WebInspector.FileSystemModel.prototype._frameAdded):
+        (WebInspector.FileSystemModel.prototype._frameNavigated):
+        (WebInspector.FileSystemModel.prototype._frameDetached):
+        * inspector/front-end/FileSystemView.js:
+        (WebInspector.FileSystemView.EntryTreeElement.prototype.onselect):
+        (WebInspector.FileSystemView.EntryTreeElement.prototype.refresh):
+        * inspector/front-end/HandlerRegistry.js:
+        (WebInspector.HandlerRegistry.prototype._appendHrefItems):
+        * inspector/front-end/HeapSnapshotLoader.js:
+        (WebInspector.HeapSnapshotLoader.prototype.write):
+        * inspector/front-end/HeapSnapshotView.js:
+        (WebInspector.HeapSnapshotView.prototype._changeBase):
+        (WebInspector.HeapProfileHeader.prototype.load):
+        (WebInspector.HeapProfileHeader.prototype._snapshotReceived):
+        * inspector/front-end/IndexedDBModel.js:
+        (WebInspector.IndexedDBModel.prototype._frameNavigated):
+        (WebInspector.IndexedDBModel.prototype._frameDetached):
+        * inspector/front-end/IndexedDBViews.js:
+        (WebInspector.IDBDataView.prototype._keyColumnHeaderFragment):
+        * inspector/front-end/JavaScriptSourceFrame.js:
+        (WebInspector.JavaScriptSourceFrame.prototype._onFormattedChanged):
+        (WebInspector.JavaScriptSourceFrame.prototype._breakpointAdded):
+        (WebInspector.JavaScriptSourceFrame.prototype._breakpointRemoved):
+        (WebInspector.JavaScriptSourceFrame.prototype._consoleMessageAdded):
+        (WebInspector.JavaScriptSourceFrame.prototype._consoleMessageRemoved):
+        (WebInspector.JavaScriptSourceFrame.prototype._handleGutterClick):
+        (WebInspector.JavaScriptSourceFrame.prototype._continueToLine):
+        * inspector/front-end/MemoryStatistics.js:
+        (WebInspector.MemoryStatistics.prototype.show):
+        * inspector/front-end/NavigatorView.js:
+        (WebInspector.NavigatorView.prototype._uiSourceCodeTitleChanged):
+        (WebInspector.NavigatorView.prototype._uiSourceCodeWorkingCopyChanged):
+        (WebInspector.NavigatorView.prototype._uiSourceCodeWorkingCopyCommitted):
+        (WebInspector.NavigatorView.prototype._uiSourceCodeFormattedChanged):
+        * inspector/front-end/NetworkLog.js:
+        (WebInspector.NetworkLog.prototype._onRequestStarted):
+        * inspector/front-end/NetworkManager.js:
+        (WebInspector.NetworkManager.prototype._cacheDisabledSettingChanged):
+        * inspector/front-end/NetworkPanel.js:
+        (WebInspector.NetworkLogView.prototype._onRequestUpdated):
+        (WebInspector.NetworkLogView.prototype._mainFrameNavigated):
+        (WebInspector.NetworkPanel.prototype.reveal):
+        (WebInspector.NetworkPanel.prototype.appendApplicableItems):
+        * inspector/front-end/NetworkUISourceCodeProvider.js:
+        (WebInspector.NetworkUISourceCodeProvider.prototype._parsedScriptSource):
+        (WebInspector.NetworkUISourceCodeProvider.prototype._resourceAdded):
+        * inspector/front-end/ObjectPopoverHelper.js:
+        (WebInspector.ObjectPopoverHelper.prototype.):
+        (WebInspector.ObjectPopoverHelper.prototype._showObjectPopover):
+        * inspector/front-end/PresentationConsoleMessageHelper.js:
+        (WebInspector.PresentationConsoleMessageHelper.prototype._consoleMessageAdded):
+        (WebInspector.PresentationConsoleMessageHelper.prototype._parsedScriptSource):
+        * inspector/front-end/ProfilesPanel.js:
+        * inspector/front-end/ResourceScriptMapping.js:
+        (WebInspector.ResourceScriptMapping.prototype.rawLocationToUILocation):
+        (WebInspector.ResourceScriptMapping.prototype._uiSourceCodeAddedToWorkspace):
+        (WebInspector.ResourceScriptFile.prototype._workingCopyCommitted):
+        (WebInspector.ResourceScriptFile.prototype._workingCopyChanged):
+        * inspector/front-end/ResourceTreeModel.js:
+        (WebInspector.ResourceTreeModel.prototype._onRequestFinished):
+        (WebInspector.ResourceTreeModel.prototype._consoleMessageAdded):
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel.prototype._databaseAdded):
+        (WebInspector.ResourcesPanel.prototype._domStorageAdded):
+        (WebInspector.IndexedDBTreeElement.prototype._indexedDBAdded):
+        (WebInspector.IndexedDBTreeElement.prototype._indexedDBRemoved):
+        (WebInspector.IndexedDBTreeElement.prototype._indexedDBLoaded):
+        (WebInspector.FileSystemListTreeElement.prototype._fileSystemAdded):
+        (WebInspector.FileSystemListTreeElement.prototype._fileSystemRemoved):
+        (WebInspector.FileSystemListTreeElement.prototype._fileSystemTreeElementByName):
+        (WebInspector.SearchResultsTreeElementsTraverser.prototype._traverseNext):
+        (WebInspector.SearchResultsTreeElementsTraverser.prototype._traversePrevious):
+        * inspector/front-end/RevisionHistoryView.js:
+        (WebInspector.RevisionHistoryView.prototype._uiSourceCodeRemoved):
+        * inspector/front-end/SASSSourceMapping.js:
+        (rawLocationToUILocation):
+        * inspector/front-end/ScopeChainSidebarPane.js:
+        (WebInspector.ScopeChainSidebarPane.prototype.update):
+        * inspector/front-end/Script.js:
+        (WebInspector.Script.Location.prototype.uiLocation):
+        * inspector/front-end/ScriptFormatter.js:
+        (WebInspector.ScriptFormatter.prototype.get _worker):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype._uiSourceCodeAdded):
+        (WebInspector.ScriptsPanel.prototype._uiSourceCodeRemoved):
+        (WebInspector.ScriptsPanel.prototype._editorClosed):
+        (WebInspector.ScriptsPanel.prototype._editorSelected):
+        (WebInspector.ScriptsPanel.prototype._scriptSelected):
+        (WebInspector.ScriptsPanel.prototype.canSearchAndReplace):
+        (WebInspector.ScriptsPanel.prototype.replaceSelectionWith):
+        (WebInspector.ScriptsPanel.prototype.replaceAllWith):
+        (WebInspector.ScriptsPanel.prototype._toggleBreakpoint):
+        (WebInspector.ScriptsPanel.prototype.set _fileRenamed):
+        (WebInspector.ScriptsPanel.prototype._appendUISourceCodeItems):
+        * inspector/front-end/ScriptsPanelDescriptor.js:
+        (WebInspector.ScriptsPanelDescriptor.prototype.appendApplicableItems):
+        * inspector/front-end/StylesSourceMapping.js:
+        (WebInspector.StylesSourceMapping.prototype.rawLocationToUILocation):
+        (WebInspector.StylesSourceMapping.prototype._uiSourceCodeAddedToWorkspace):
+        * inspector/front-end/TabbedEditorContainer.js:
+        (WebInspector.TabbedEditorContainer.prototype._scrollChanged):
+        (WebInspector.TabbedEditorContainer.prototype._selectionChanged):
+        (WebInspector.TabbedEditorContainer.prototype._tabClosed):
+        (WebInspector.TabbedEditorContainer.prototype._tabSelected):
+        (WebInspector.TabbedEditorContainer.prototype._uiSourceCodeTitleChanged):
+        (WebInspector.TabbedEditorContainer.prototype._uiSourceCodeWorkingCopyChanged):
+        (WebInspector.TabbedEditorContainer.prototype._uiSourceCodeWorkingCopyCommitted):
+        (WebInspector.TabbedEditorContainer.prototype._uiSourceCodeFormattedChanged):
+        * inspector/front-end/TimelineModel.js:
+        (WebInspector.TimelineModelLoader.prototype.write):
+        * inspector/front-end/UISourceCodeFrame.js:
+        (WebInspector.UISourceCodeFrame.prototype._onFormattedChanged):
+        * inspector/front-end/Workspace.js:
+        (WebInspector.WorkspaceController.prototype._frameAdded):
+        (WebInspector.Project.prototype._fileAdded):
+        (WebInspector.Project.prototype._fileRemoved):
+
+2012-11-05  Pavel Feldman  <pfeldman@chromium.org>
+
+        Web Inspector: render message bubbles in CodeMirror experiment.
+        https://bugs.webkit.org/show_bug.cgi?id=101164
+
+        Reviewed by Vsevolod Vlasov.
+
+        It sounds like addLineWidget just makes it happen.
+
+        * inspector/front-end/CodeMirrorTextEditor.js:
+        (WebInspector.CodeMirrorTextEditor):
+        (WebInspector.CodeMirrorTextEditor.prototype.addDecoration):
+        (WebInspector.CodeMirrorTextEditor.prototype.get if):
+        (WebInspector.CodeMirrorTextEditor.prototype.removeDecoration):
+        (WebInspector.CodeMirrorTextEditor.prototype._change):
+        * inspector/front-end/DefaultTextEditor.js:
+        (.preventDefaultOnMouseUp):
+        * inspector/front-end/PresentationConsoleMessageHelper.js:
+        (WebInspector.PresentationConsoleMessageHelper):
+        * inspector/front-end/cm/cmdevtools.css:
+        (.CodeMirror .webkit-html-message-bubble):
+        (.CodeMirror .webkit-html-message-bubble img):
+        (.CodeMirror .webkit-html-warning-message):
+        (.CodeMirror .webkit-html-error-message):
+
+2012-11-05  Thiago Marcos P. Santos  <thiago.santos@intel.com>
+
+        Validate CSS Device Adaptation properties and resolve shorthands
+        https://bugs.webkit.org/show_bug.cgi?id=95962
+
+        Reviewed by Alexis Menard.
+
+        Add the missing keywords and properties for the viewport at-rule.
+        Note that we have to mark that we are inside a viewport scope because
+        some properties are not validated as they would be inside a style
+        rule. As an example, the semantics of CSSPropertyWidth are completely
+        different: on a viewport rule, it stands for a shorthand for the
+        minimum and maximum width.
+
+        Test: css3/device-adapt/viewport-properties-validation.html
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValue):
+        (WebCore):
+        (WebCore::CSSParser::parseViewportProperty):
+        (WebCore::CSSParser::parseViewportShorthand):
+        * css/CSSParser.h:
+        * css/CSSProperty.cpp:
+        (WebCore::CSSProperty::isInheritedProperty):
+        * css/CSSPropertyNames.in:
+        * css/CSSValueKeywords.in:
+
+2012-11-05  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r133286, r133385, and r133394.
+        http://trac.webkit.org/changeset/133286
+        http://trac.webkit.org/changeset/133385
+        http://trac.webkit.org/changeset/133394
+        https://bugs.webkit.org/show_bug.cgi?id=101198
+
+        Broke image placement on some web sites. (Requested by kling
+        on #webkit).
+
+        * css/StyleResolver.cpp:
+        (WebCore::StyleResolver::sweepMatchedPropertiesCache):
+        (WebCore::StyleResolver::matchAllRules):
+        (WebCore::StyleResolver::canShareStyleWithElement):
+        * dom/Attr.cpp:
+        (WebCore::Attr::detachFromElementWithValue):
+        * dom/Element.cpp:
+        (WebCore::Element::~Element):
+        (WebCore::Element::detachAttribute):
+        (WebCore::Element::getAttribute):
+        (WebCore::Element::setAttributeNode):
+        (WebCore::Element::removeAttributeInternal):
+        (WebCore::Element::getAttributeNode):
+        (WebCore::Element::getAttributeNodeNS):
+        (WebCore::Element::normalizeAttributes):
+        (WebCore::Element::attrIfExists):
+        (WebCore::Element::ensureAttr):
+        (WebCore::Element::cloneAttributesFromElement):
+        * dom/Element.h:
+        (Element):
+        (WebCore::Element::updateInvalidAttributes):
+        * dom/ElementAttributeData.cpp:
+        (WebCore::MutableElementAttributeData::MutableElementAttributeData):
+        (WebCore):
+        (WebCore::attrListMap):
+        (WebCore::attrListForElement):
+        (WebCore::ensureAttrListForElement):
+        (WebCore::removeAttrListForElement):
+        (WebCore::findAttrInList):
+        (WebCore::ElementAttributeData::attrIfExists):
+        (WebCore::ElementAttributeData::ensureAttr):
+        (WebCore::ElementAttributeData::setAttr):
+        (WebCore::ElementAttributeData::removeAttr):
+        (WebCore::ElementAttributeData::detachAttrObjectsFromElement):
+        (WebCore::ElementAttributeData::reportMemoryUsage):
+        (WebCore::ElementAttributeData::cloneDataFrom):
+        (WebCore::ElementAttributeData::clearAttributes):
+        (WebCore::ElementAttributeData::getAttributeNode):
+        * dom/ElementAttributeData.h:
+        (WebCore):
+        (WebCore::ElementAttributeData::attributeStyle):
+        (WebCore::ElementAttributeData::setAttributeStyle):
+        (ElementAttributeData):
+        (WebCore::ElementAttributeData::ElementAttributeData):
+        * dom/Node.h:
+        (WebCore):
+        (WebCore::Node::hasAttrList):
+        (WebCore::Node::attributeStyleDirty):
+        (WebCore::Node::setAttributeStyleDirty):
+        (WebCore::Node::clearAttributeStyleDirty):
+        (Node):
+        (WebCore::Node::setHasAttrList):
+        (WebCore::Node::clearHasAttrList):
+        (WebCore::Node::isStyleAttributeValid):
+        (WebCore::Node::setIsStyleAttributeValid):
+        (WebCore::Node::clearIsStyleAttributeValid):
+        * dom/StyledElement.cpp:
+        (WebCore::StyledElement::updateStyleAttribute):
+        (WebCore::StyledElement::attributeChanged):
+        (WebCore::StyledElement::styleAttributeChanged):
+        (WebCore::StyledElement::inlineStyleChanged):
+        (WebCore::StyledElement::updateAttributeStyle):
+        * dom/StyledElement.h:
+        (StyledElement):
+        (WebCore::StyledElement::invalidateStyleAttribute):
+        (WebCore::StyledElement::attributeStyle):
+        * inspector/InspectorCSSAgent.cpp:
+        (WebCore::InspectorCSSAgent::buildObjectForAttributesStyle):
+
+2012-11-05  Simon Hausmann  <simon.hausmann@digia.com>
+
+        Unreviewed trivial Qt build fix.
+
+        Surround imports from QtGui by QT_{BEGIN,END}_NAMESPACE to fix namespaced
+        builds.
+
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        * platform/graphics/qt/ImageQt.cpp:
+
+2012-11-05  Shinya Kawanaka  <shinyak@chromium.org>
+
+        [Shadow] ShadowRoot type is not set correctly.
+        https://bugs.webkit.org/show_bug.cgi?id=101188
+
+        Reviewed by Hajime Morita.
+
+        ShadowRoot type is not set correctly in Release build. We have had to remove #ifndef block.
+
+        Test: fast/dom/shadow/shadowroot-type.html
+
+        * dom/ShadowRoot.cpp:
+        (WebCore::ShadowRoot::create):
+        * testing/Internals.cpp:
+        (WebCore::Internals::shadowRootType):
+        (WebCore):
+        * testing/Internals.h:
+        (Internals):
+        * testing/Internals.idl:
+
+2012-11-05  Kent Tamura  <tkent@chromium.org>
+
+        BaseChooserOnlyDateAndTimeInputType should implement DateTimeChooserClient
+        https://bugs.webkit.org/show_bug.cgi?id=101038
+
+        Reviewed by Hajime Morita.
+
+        Add DateTimeChooserClient behavior to BaseChooserOnlyDateAndTimeInputType.
+        It means that date/time input elements without
+        ENABLE_INPUT_MULTIPLE_FIELDS_UI can open date/time choosers by
+        DOMActivate event.
+
+        This patch doesn't change behavior yet because Chromimum-Android port
+        intercepts user events and doesn't deliver them to date/time input
+        elements. <http://crbug.com/159381>
+
+        * html/BaseChooserOnlyDateAndTimeInputType.cpp:
+        Add DateTimeChooserClient behavior. The code is similar to
+        PickerIndicatorElement.
+        (WebCore::BaseChooserOnlyDateAndTimeInputType::~BaseChooserOnlyDateAndTimeInputType):
+        Closes DateTimeChooser.
+        (WebCore::BaseChooserOnlyDateAndTimeInputType::handleDOMActivateEvent):
+        Open DateTimeChooser if
+         - The element is not disabled,
+         - The element is not read-only,
+         - The element has a renderer,
+         - This event is created by a user gesture, and
+         - The element has no DateTimeChooser.
+        (WebCore::BaseChooserOnlyDateAndTimeInputType::detach):
+        Closes DateTimeChooser.
+        (WebCore::BaseChooserOnlyDateAndTimeInputType::didChooseValue):
+        Set a string value coming from a chooser to the input element.
+        (WebCore::BaseChooserOnlyDateAndTimeInputType::didEndChooser):
+        Clear m_dateTimeChooser when the chooser was closed.
+        (WebCore::BaseChooserOnlyDateAndTimeInputType::closeDateTimeChooser):
+        Requests to close the chooser.
+        * html/BaseChooserOnlyDateAndTimeInputType.h:
+        (BaseChooserOnlyDateAndTimeInputType):
+         - Implement DateTimeChooserClient
+         - Add closeDateTimeChooser helper function.
+         - Add detach override.
+         - Add m_dateTimeChooser.
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::setupDateTimeChooserParameters):
+        Added. The code is moved from PickerIndicatorElement.cpp in order to
+        share it with BaseChooserOnlyDateAndTimeInputType.
+        * html/HTMLInputElement.h:
+        (HTMLInputElement): Declare setupDateTimeChooserParameters.
+        * html/shadow/PickerIndicatorElement.cpp:
+        (WebCore::PickerIndicatorElement::openPopup):
+        Move some code to HTMLInputElement::setupDateTimeChooserParameters.
+
+2012-11-04  Julien Chaffraix  <jchaffraix@webkit.org>
+
+        Fix the collapsing border code to handle mixed directionality at the row level
+        https://bugs.webkit.org/show_bug.cgi?id=101060
+
+        Reviewed by Ojan Vafai.
+
+        After bug 87900, we support mixed directionality at the row-group level. For coherency
+        - as the underlying code didn't support it - we were artificially ignoring 'direction'
+        below the row-group. This change relaxes the restriction and patches the collapsing
+        borders code to query the right style and border.
+
+        Tests: fast/table/border-collapsing/table-ltr-rows-mixed-direction.html
+               fast/table/border-collapsing/table-rtl-row-mixed-direction.html
+
+        * rendering/RenderTable.cpp:
+        (WebCore::RenderTable::tableStartBorderAdjoiningCell):
+        (WebCore::RenderTable::tableEndBorderAdjoiningCell):
+        Changed to query the row's direction.
+
+        * rendering/RenderTableCell.cpp:
+        (WebCore::RenderTableCell::hasStartBorderAdjoiningTable):
+        (WebCore::RenderTableCell::hasEndBorderAdjoiningTable):
+        Added 2 helper functions. They determine if a specific cell's border
+        adjoins the table. This code is required as the last cell's end border
+        can be resolved against the start border.
+
+        (WebCore::RenderTableCell::computeCollapsedStartBorder):
+        (WebCore::RenderTableCell::computeCollapsedEndBorder):
+        Updated these functions now that being the start / end column doesn't mean
+        that we have to resolve against the row / row-group / table's border.
+
+        * rendering/RenderTableCell.h:
+        (WebCore::RenderTableCell::styleForCellFlow):
+        Updated to return the row's style.
+
+        * rendering/RenderTableRow.cpp:
+        (WebCore::RenderTableRow::borderAdjoiningStartCell):
+        (WebCore::RenderTableRow::borderAdjoiningEndCell):
+        * rendering/RenderTableSection.cpp:
+        (WebCore::RenderTableSection::borderAdjoiningStartCell):
+        (WebCore::RenderTableSection::borderAdjoiningEndCell):
+        Updated these functions to work with mixed directionality.
+
+        * rendering/RenderTableSection.cpp:
+        (WebCore::RenderTableSection::setLogicalPositionForCell):
+        Changed this function to use the section's direction. This is wrong and should be changed
+        once we properly fix the collapsing border code.
+
+        (WebCore::RenderTableSection::logicalRectForWritingModeAndDirection):
+        Added a FIXME.
+
+        * rendering/style/CollapsedBorderValue.h:
+        (WebCore::CollapsedBorderValue::width):
+        This is a bug in our implementation: we used to return a non-zero width for inexistant borders (per CSS 2.1,
+        'border-style: off | hidden' should have a 0 width). This is covered by our existing tests (among others by
+        fast/table/border-collapsing/last-cell-left-border-hidden-table-ltr-section-rtl.html).
+
+2012-11-04  Andrey Adaikin  <aandrey@chromium.org>
+
+        Web Inspector: [Canvas] do not blow up the capturing log
+        https://bugs.webkit.org/show_bug.cgi?id=100752
+
+        Reviewed by Pavel Feldman.
+
+        Clear obsolete calls in the canvas 2D capturing log in runtime.
+        Now we store in the log only minimum number of calls that are necessary to replay a
+        canvas 2D context. To achieve that we find in runtime those calls in the log that no
+        longer contribute to the final context state and remove them.
+        These are the rules according which we find and remove such calls:
+        - all PATH methods between a clip() call and beginPath() call can be removed
+        - all MATRIX methods before a restore() or setTransform() call but after any PATH or corresponding save() method
+        - all consecutive save() + restore() calls
+
+        Tests: inspector/profiler/canvas2d/canvas2d-api-changes.html
+               inspector/profiler/canvas2d/canvas2d-profiler-capturing-basics.html
+
+        * inspector/InjectedScriptCanvasModuleSource.js:
+        (.):
+
+2012-11-04  Shinya Kawanaka  <shinyak@chromium.org>
+
+        [Shadow] ShadowRoot should have a method to return ShadowRootType.
+        https://bugs.webkit.org/show_bug.cgi?id=101178
+
+        Reviewed by Hajime Morita.
+
+        When we style PseudoCustomElement, we have to know ShadowRootType.
+        We would like to expose a method to get ShadowRootType also in Release mode.
+
+        This is a preparation patch for Bug 101170.
+
+        * dom/ShadowRoot.h:
+        (ShadowRoot):
+
+2012-11-04  Keishi Hattori  <keishi@webkit.org>
+
+        Introduce Month class to calendar picker
+        https://bugs.webkit.org/show_bug.cgi?id=101024
+
+        Reviewed by Kent Tamura.
+
+        Month class needs to be introduced to implement a month picker. This
+        patch just introduces the Month class into the calendar picker without
+        changing the current behavior.
+
+        No new tests. Covered by existing calendar-picker-*.html tests.
+
+        * Resources/pagepopups/calendarPicker.js:
+        (Month.prototype.toLocaleString): Returns a localized month string.
+        (Month): Takes a Month object, number representing the month, or year and month numbers.
+        (Month.parse): Returns a new Month from an ISO month string.
+        (Month.createFromDate): Returns a new Month containing the given datetime.
+        (Month.prototype.equals): Returns true if the given month is the same.
+        (Month.prototype.previous): Returns the previous month.
+        (Month.prototype.next): Returns the next month.
+        (Month.prototype.startDate): Returns a datetime that is the start of this month. The value is inclusive.
+        (Month.prototype.endDate): Returns a datetime that is the end of this month. The value is exclusive.
+        (Month.prototype.valueOf): Returns a number representing the month.
+        (Month.prototype.toString): Returns an ISO month string.
+        (YearMonthController): Use Month object.
+        (YearMonthController.prototype.attachTo): Year 275760 ends in September so use the year before to measure the label width.
+        (YearMonthController.prototype.setMonth): Take a month object.
+        (YearMonthController.prototype._redraw): Use ISO month string for element.dataset.value.
+        (YearMonthController.prototype._handleYearMonthChange):
+        (YearMonthController.prototype.moveRelatively):
+        (DaysTable): Use Month object.
+        (DaysTable.prototype._renderMonth): Take a month object. Testing for isNaN is moved up to fix a bug when showing September, 275760.
+        (DaysTable.prototype._navigateToMonth): Take a month object.
+        (DaysTable.prototype._navigateToMonthWithAnimation): Take a month object.
+        (DaysTable.prototype.navigateToMonthAndKeepSelectionPosition): Take a month object.
+        (DaysTable.prototype.selectDate):
+        (DaysTable.prototype._maybeSetPreviousMonth): Use Month object to calculate the previous month.
+        (DaysTable.prototype._maybeSetNextMonth): Use Month object to calculate the next month.
+
+2012-11-04  Halton Huo  <halton.huo@intel.com>
+
+        [EFL] Use _LIBRARIES instead of _LIBRARY
+        https://bugs.webkit.org/show_bug.cgi?id=101042
+
+        Reviewed by Gyuyoung Kim.
+
+        In CMake Find files, _LIBRARY is intended for internal use, should
+        use _LIBRARIES instead.
+
+        * PlatformEfl.cmake: s/_LIBRARY}/_LIBRARIES}
+
+2012-11-04  MORITA Hajime  <morrita@google.com>
+
+        Shadow DOM should be able to be disabled per context.
+        https://bugs.webkit.org/show_bug.cgi?id=101173
+
+        Reviewed by Dimitri Glazkov.
+
+        This change pulls back relevant bits from r131549. Note that if
+        the the port enables runtime Shadow DOM flag, this can cause slow
+        down on some Chromium page cycler test cases (which r131549
+        attempted to fix).
+
+        This change is temporal and the flags should be switched back from
+        ContextFeatures to RuntimeEnabledFeatures once it gains sufficent
+        stability.
+
+        * dom/ContextFeatures.cpp:
+        (WebCore::ContextFeatures::shadowDOMEnabled):
+        (WebCore):
+        * dom/ContextFeatures.h:
+        * dom/Position.cpp:
+        (WebCore::Position::Position):
+        (WebCore::Position::findParent):
+        * dom/TreeScope.cpp:
+        (WebCore::TreeScope::getSelection):
+        * html/HTMLTagNames.in:
+        * html/shadow/HTMLContentElement.cpp:
+        (WebCore::HTMLContentElement::contentTagName):
+        * page/DOMWindow.idl:
+
+2012-11-04  Shinya Kawanaka  <shinyak@chromium.org>
+
+        [Shadow] Implement custom pseudo-elements styling
+        https://bugs.webkit.org/show_bug.cgi?id=100812
+
+        Reviewed by Hajime Morita.
+
+        Instead of using ElementRareData::m_shadowPseudoId, we use 'pseudo' attribute.
+
+        Later we would like to remove Element::shadowPseudoId and Element::setShadowPseudoId
+        and use pseudo()/setPseudo() instead (Bug 101171).
+
+        Test: fast/dom/shadow/styling-pseudo-attribute.html
+
+        * dom/Element.cpp:
+        (WebCore::Element::shadowPseudoId):
+        (WebCore::Element::setShadowPseudoId):
+        * dom/ElementRareData.cpp:
+        (WebCore::ElementRareData::reportMemoryUsage):
+        * dom/ElementRareData.h:
+        (ElementRareData):
+
+2012-11-04  Kent Tamura  <tkent@chromium.org>
+
+        BaseChooserOnlyDateAndTimeInputType should have BaseClickableWithKeyInputType behavior
+        https://bugs.webkit.org/show_bug.cgi?id=101039
+
+        Reviewed by Hajime Morita.
+
+        Add BaseClickableWithKeyInputType behavior to
+        BaseChooserOnlyDateAndTimeInputType. It means date/time input types
+        without ENABLE_INPUT_MULTIPLE_FIELDS_UI receive DOMActivate events by
+        pressing space or enter key. They're going to open a date/time chooser
+        by DOMActive event.
+
+        Because BaseChooserOnlyDateAndTimeInputType inherits from
+        BaseDateAndTimeInputType, it can't inherit
+        BaseClickableWithKeyInputType. So, this patch adds static helper
+        functions to BaseClickableWithKeyInputType, and
+        BaseChooserOnlyDateAndTimeInputType uses them.
+
+        This patch doesn't change behavior yet because Chromimum-Android port
+        intercepts user events and doesn't deliver them to date/time input
+        elements.
+
+        * html/BaseChooserOnlyDateAndTimeInputType.cpp:
+        (WebCore::BaseChooserOnlyDateAndTimeInputType::handleDOMActivateEvent):
+        Add an empty implementation with a FIXME comment.
+        (WebCore::BaseChooserOnlyDateAndTimeInputType::handleKeydownEvent):
+        Add BaseClickableWithKeyInputType behavior by a helper function.
+        (WebCore::BaseChooserOnlyDateAndTimeInputType::handleKeypressEvent): Ditto.
+        (WebCore::BaseChooserOnlyDateAndTimeInputType::handleKeyupEvent): Ditto.
+        (WebCore::BaseChooserOnlyDateAndTimeInputType::accessKeyAction): Ditto.
+        * html/BaseChooserOnlyDateAndTimeInputType.h:
+        (BaseChooserOnlyDateAndTimeInputType): Add function declarations.
+        * html/BaseClickableWithKeyInputType.cpp:
+        Add static helper functions, and existing member functions use them.
+        * html/BaseClickableWithKeyInputType.h:
+        (BaseClickableWithKeyInputType): Add declarations of the helper functions.
+        * html/InputType.h:
+        (InputType): Make dispatchSimulatedClickIfActive public because it is
+        called from a helper function.
+
+2012-11-04  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r133416.
+        http://trac.webkit.org/changeset/133416
+        https://bugs.webkit.org/show_bug.cgi?id=101169
+
+        Broke world selection by right click (Requested by rniwa on
+        #webkit).
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::handleGestureForTextSelectionOrContextMenu):
+        (WebCore::EventHandler::sendContextMenuEvent):
+
+2012-11-04  Gyuyoung Kim  <gyuyoung.kim@samsung.com>
+
+        Missing ASCIILiteral in a place of accessibility
+        https://bugs.webkit.org/show_bug.cgi?id=101160
+
+        Reviewed by Darin Adler.
+
+        ASCIILiteral usage is being missed in a spot of accessibliity.
+
+        * accessibility/AccessibilityMediaControls.cpp:
+        (WebCore::AccessibilityMediaTimeDisplay::accessibilityDescription):
+
+2012-11-03  Balazs Kelemen  <kbalazs@webkit.org>
+
+        [Qt][WK2] setPlatformStrategies always asserts after r132744
+        https://bugs.webkit.org/show_bug.cgi?id=100838
+
+        Reviewed by Simon Hausmann.
+
+        Reland with build fixes.
+
+        The problem here is that we use QWebSettings::clearMemoryCaches, a WebKit1 API
+        from the injected bundle, which calls initializeWebCoreQt and it sets the platform
+        strategies to the one for WebKit1. We should stop using WebKit1 API's from WebKit2
+        code. In order to keep the behavior, this patch adds exported helpers to WebCore
+        that can be used from DumpRenderTree and WebKitTestRunner. This is the same idea
+        as WebCoreTestSupport but these helpers are specific to Qt. Technically we could
+        add it to the WebKit1 API for the time being, but my goal was to move in the direction
+        of removing the WebKit1 dependency from WebKitTestRunner. We only build the file
+        in non production mode.
+
+        Basically covered by all tests.
+
+        * Target.pri:
+        * WebCore.pri: We need to link against fontconfig (only in non-production mode) since
+        initializeTestFonts uses it.
+        * platform/qt/QtTestSupport.cpp: Added. I choose GPL license because code from qwebsettings.cpp
+        is also under that.
+        (WebKit):
+        (WebKit::QtTestSupport::clearMemoryCaches): This is basically a copy of QWebSettings::clearMemoryCaches
+        without calling initializeWebCoreQt.
+        (WebKit::QtTestSupport::initializeTestFonts): I moved this code here as well now that we have to expose
+        symbols from WebCore anyway. The advantage is that now we don't have to build it twice and we don't need
+        additional files to forward it from the directory of DumpRenderTree for WebKitTestRunner.
+        I added a call to FontCace::invalidate in the case when the font set has been changed so that it will do
+        the job even if we would stop clearing all caches between tests. Also moved the call to
+        QFontDatabase::removeAllApplicationFonts from callers to here.
+        * platform/qt/QtTestSupport.h:
+        (WebKit):
+        (QtTestSupport):
+
+2012-11-04  Florin Malita  <fmalita@chromium.org>
+
+        Color-profile property triggers assert
+        https://bugs.webkit.org/show_bug.cgi?id=101080
+
+        Reviewed by Dirk Schulze.
+
+        CSSPropertyColorProfile is not handled in StyleResolver::applySVGProperty(), triggering the
+        unimplemented property assert. Adding a stub entry to avoid that.
+
+        Test: svg/css/color-profile-crash.html
+
+        * css/SVGCSSStyleSelector.cpp:
+        (WebCore::StyleResolver::applySVGProperty):
+
+2012-11-04  Kaustubh Atrawalkar  <kaustubh@motorola.com>
+
+        Unable to copy text on disabled input fields on long press gesture
+        https://bugs.webkit.org/show_bug.cgi?id=99698
+
+        Reviewed by Ryosuke Niwa.
+
+        Text from disabled input/text should be allowed to select. Replaced isContentEditable()
+        with canStartSelection()
+
+        Test: fast/events/touch/gesture/disabled-input-text-selection.html
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::handleGestureLongPress):
+
+2012-11-03  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r133403, r133404, and r133409.
+        http://trac.webkit.org/changeset/133403
+        http://trac.webkit.org/changeset/133404
+        http://trac.webkit.org/changeset/133409
+        https://bugs.webkit.org/show_bug.cgi?id=101158
+
+        "Broke tests" (Requested by kbalazs on #webkit).
+
+        * Target.pri:
+        * WebCore.pri:
+        * platform/qt/QtTestSupport.h: Removed.
+
+2012-11-03  Alexey Proskuryakov  <ap@apple.com>
+
+        Get rid of USE(CFURLSTORAGESESSIONS)
+        https://bugs.webkit.org/show_bug.cgi?id=101131
+
+        Reviewed by Sam Weinig.
+
+        This is always enabled on CFNetwork based platforms.
+
+        * WebCore.exp.in:
+        * page/Settings.cpp:
+        (WebCore::Settings::setPrivateBrowsingEnabled):
+        * platform/mac/CookieJar.mm:
+        (WebCore::cookies):
+        (WebCore::cookieRequestHeaderFieldValue):
+        (WebCore::setCookies):
+        (WebCore::cookiesEnabled):
+        (WebCore::getRawCookies):
+        (WebCore::deleteCookie):
+        * platform/network/ResourceHandle.h:
+        (ResourceHandle):
+        * platform/network/cf/CookieStorageCFNet.cpp:
+        (WebCore):
+        (WebCore::currentCFHTTPCookieStorage):
+        * platform/network/cf/CookieStorageCFNet.h:
+        * platform/network/cf/ResourceHandleCFNet.cpp:
+        (WebCore::willSendRequest):
+        (WebCore::makeFinalRequest):
+        (WebCore::ResourceHandle::willSendRequest):
+        (WebCore):
+        * platform/network/cf/ResourceRequest.h:
+        (ResourceRequest):
+        * platform/network/cf/ResourceRequestCFNet.cpp:
+        (WebCore::ResourceRequest::doUpdatePlatformRequest):
+        (WebCore):
+        * platform/network/mac/CookieStorageMac.mm:
+        (WebCore::setCookieStoragePrivateBrowsingEnabled):
+        * platform/network/mac/ResourceHandleMac.mm:
+        (WebCore::shouldRelaxThirdPartyCookiePolicy):
+        (WebCore::ResourceHandle::createNSURLConnection):
+        (WebCore::ResourceHandle::willSendRequest):
+        (WebCore):
+        * platform/network/mac/ResourceRequestMac.mm:
+        (WebCore):
+        (WebCore::ResourceRequest::setStorageSession):
+
+2012-11-03  Balazs Kelemen  <kbalazs@webkit.org>
+
+        [Qt][WK2] setPlatformStrategies always asserts after r132744
+        https://bugs.webkit.org/show_bug.cgi?id=100838
+
+        Reviewed by Simon Hausmann.
+
+        Reland with build fix.
+
+        The problem here is that we use QWebSettings::clearMemoryCaches, a WebKit1 API
+        from the injected bundle, which calls initializeWebCoreQt and it sets the platform
+        strategies to the one for WebKit1. We should stop using WebKit1 API's from WebKit2
+        code. In order to keep the behavior, this patch adds exported helpers to WebCore
+        that can be used from DumpRenderTree and WebKitTestRunner. This is the same idea
+        as WebCoreTestSupport but these helpers are specific to Qt. Technically we could
+        add it to the WebKit1 API for the time being, but my goal was to move in the direction
+        of removing the WebKit1 dependency from WebKitTestRunner. We only build the file
+        in non production mode.
+
+        Basically covered by all tests.
+
+        * Target.pri:
+        * WebCore.pri: We need to link against fontconfig (only in non-production mode) since
+        initializeTestFonts uses it.
+        * platform/qt/QtTestSupport.cpp: Added. I choose GPL license because code from qwebsettings.cpp
+        is also under that.
+        (WebKit):
+        (WebKit::QtTestSupport::clearMemoryCaches): This is basically a copy of QWebSettings::clearMemoryCaches
+        without calling initializeWebCoreQt.
+        (WebKit::QtTestSupport::initializeTestFonts): I moved this code here as well now that we have to expose
+        symbols from WebCore anyway. The advantage is that now we don't have to build it twice and we don't need
+        additional files to forward it from the directory of DumpRenderTree for WebKitTestRunner.
+        I added a call to FontCace::invalidate in the case when the font set has been changed so that it will do
+        the job even if we would stop clearing all caches between tests. Also moved the call to
+        QFontDatabase::removeAllApplicationFonts from callers to here.
+        * platform/qt/QtTestSupport.h:
+        (WebKit):
+        (QtTestSupport):
+
+2012-11-03  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r133397.
+        http://trac.webkit.org/changeset/133397
+        https://bugs.webkit.org/show_bug.cgi?id=101155
+
+        "Broke Qt. No way to force the damn bots to do a clean build.
+        I'm giving up." (Requested by kbalazs on #webkit).
+
+        * Target.pri:
+        * WebCore.pri:
+        * platform/qt/QtTestSupport.h: Removed.
+
+2012-11-03  Stephen White  <senorblanco@chromium.org>
+
+        Speculative fix to eliminate flakiness in
+        css3/filters/blur-filter-page-scroll-self.html
+        https://bugs.webkit.org/show_bug.cgi?id=91620.
+        Suspicion is that a prior test is setting
+        window.internals.settings.setEnableCompositingForFixedPosition(true),
+        causing this test to be intermittely run on the GPU, giving different
+        pixel results depending on test order.
+
+        Reviewed by Jochen Eisinger.
+
+        Covered by css3/filters/blur-filter-page-scroll-self.html
+
+        * testing/InternalSettings.cpp:
+        (WebCore::InternalSettings::Backup::Backup):
+        (WebCore::InternalSettings::Backup::restoreTo):
+        * testing/InternalSettings.h:
+        (Backup):
+
+2012-11-03  Mark Rowe  <mrowe@apple.com>
+
+        REGRESSION (r132858): Crash below -[DOMElement setClassName:] when called with a nil string
+
+        Reviewed by Anders Carlsson.
+
+        The changes in r132858 introduced an overload of AtomicString::add for CFStrings. However, the overload
+        that was introduced is not null safe.
+
+        * platform/text/cf/AtomicStringCF.cpp:
+        (WTF::AtomicString::add): Handle a null string by returning a null StringImpl.
+
+2012-11-03  Balazs Kelemen  <kbalazs@webkit.org>
+
+        [Qt][WK2] setPlatformStrategies always asserts after r132744
+        https://bugs.webkit.org/show_bug.cgi?id=100838
+
+        Reviewed by Simon Hausmann.
+
+        The problem here is that we use QWebSettings::clearMemoryCaches, a WebKit1 API
+        from the injected bundle, which calls initializeWebCoreQt and it sets the platform
+        strategies to the one for WebKit1. We should stop using WebKit1 API's from WebKit2
+        code. In order to keep the behavior, this patch adds exported helpers to WebCore
+        that can be used from DumpRenderTree and WebKitTestRunner. This is the same idea
+        as WebCoreTestSupport but these helpers are specific to Qt. Technically we could
+        add it to the WebKit1 API for the time being, but my goal was to move in the direction
+        of removing the WebKit1 dependency from WebKitTestRunner. We only build the file
+        in non production mode.
+
+        Basically covered by all tests.
+
+        * Target.pri:
+        * WebCore.pri: We need to link against fontconfig (only in non-production mode) since
+        initializeTestFonts uses it.
+        * platform/qt/QtTestSupport.cpp: Added. I choose GPL license because code from qwebsettings.cpp
+        is also under that.
+        (WebKit):
+        (WebKit::QtTestSupport::clearMemoryCaches): This is basically a copy of QWebSettings::clearMemoryCaches
+        without calling initializeWebCoreQt.
+        (WebKit::QtTestSupport::initializeTestFonts): I moved this code here as well now that we have to expose
+        symbols from WebCore anyway. The advantage is that now we don't have to build it twice and we don't need
+        additional files to forward it from the directory of DumpRenderTree for WebKitTestRunner.
+        I added a call to FontCace::invalidate in the case when the font set has been changed so that it will do
+        the job even if we would stop clearing all caches between tests. Also moved the call to
+        QFontDatabase::removeAllApplicationFonts from callers to here.
+        * platform/qt/QtTestSupport.h:
+        (WebKit):
+        (QtTestSupport):
+
+2012-11-03  Dan Beam  <dbeam@chromium.org>
+
+        Implement HTMLFormElement#requestAutocomplete and associated events
+        https://bugs.webkit.org/show_bug.cgi?id=100557
+
+        Reviewed by Adam Barth.
+
+        Implements an initial version of the proposal for interactive autocomplete outlined in this email:
+        http://lists.whatwg.org/htdig.cgi/whatwg-whatwg.org/2012-October/037711.html
+
+        The goal of this patch is to allow web authors to call formElement.requestAutocomplete(); after subscribing for
+        autocomplete/autocompleteerror events on formElement. If the form's [autocomplete] attribute is "off" an
+        error will be dispatched. Otherwise, a request will be issued to the FrameLoaderClient.  At the moment, the
+        implementation in Chrome (https://codereview.chromium.org/11270018/) will simply dispatch an error until the
+        UI on Chrome's side is built. Both autocomplete and autocompleteerror events will be dispatched asynchronously
+        after a small delay to behave consistently in all situations and implementations.
+
+        Currently this is behind the feature flag REQUEST_AUTOCOMPLETE, which is disabled.
+
+        Test: fast/forms/form-request-autocomplete.html
+
+        * dom/EventNames.h:
+        (WebCore):
+
+        Added autocomplete and autocompleteerror events. The autocomplete event is dispatched after a user adds more
+        information to a form using the future UI. This is not currently dispatched in any implementation (including Chrome)
+        but will be in the future. The autocompleteerror event is dispatched when the form has [autocomplete="off"] on the
+        node being asked for an interactive autocomplete. The user agent may also dispatch this event if it doesn't implement
+        this API but has turned on the feature flag, can't currently show an autocomplete UI (e.g. running headlessly or in
+        an HTML notification, security concerns, or any other reason it desires).
+
+        * html/HTMLAttributeNames.in:
+
+        Added onautocomplete and onautocompleteerror attributes so they can be parsed when creating form elements and used
+        as event listeners. For example:
+
+          <form onautocomplete="/* when autocomplete succeeds */" autocompleteerror="/* when autocomplete fails */">
+
+        * html/HTMLFormElement.cpp:
+        (WebCore::HTMLFormElement::HTMLFormElement):
+        (WebCore):
+
+        Added m_requestAutocompleteTimer (a timer that's used to dispatch events asynchronously) to the initializer list that
+        triggers requestAutocompleteTimerFired when it times out.
+
+        (WebCore::HTMLFormElement::requestAutocomplete):
+
+        Called when HTMLFormElement#requestAutocomplete is called from JS (also see HTMLFormElement.idl) and decides whether
+        to dispatch an error and exit early (in the case where autocomplete="off") or pass the request on to the
+        FrameLoaderClient.
+
+        (WebCore::HTMLFormElement::finishRequestAutocomplete):
+
+        Called when the request for an interactive autocomplete is finished with either a success or error result. This
+        causes an event to queue and fired after a 0 second delay. Events are owned by HTMLFormElement and reference the
+        target element (this) until fired.
+
+        (WebCore::HTMLFormElement::requestAutocompleteTimerFired):
+
+        Called when the event timer runs out to pump the queue of current events. Events are released on dispatch.
+
+        (WebCore::HTMLFormElement::parseAttribute):
+
+        Encountering onautocomplete or onautocompleteerror attributes while parsing HTMLFormElements now adds event listeners
+        for autocomplete an autocompleteerror events (respectively) to dispatch the value of the attribute as a script.
+
+        * html/HTMLFormElement.h:
+        (HTMLFormElement):
+
+        Added various methods and data members as required by the implementation.
+
+        * html/HTMLFormElement.idl:
+
+        Added the method requestAutocomplete and associated DOM event handler attributes (onautocomplete/onautocompleteerror)
+        to HTMLFormElement's public DOM API (unprefixed, as per Ian Hickson's advice). All are require the Conditional
+        REQUEST_AUTOCOMPLETE to be enabled to be activated.
+
+        * loader/EmptyClients.cpp:
+        (WebCore):
+        (WebCore::EmptyFrameLoaderClient::didRequestAutocomplete):
+
+        Added noop implementation for FrameLoader::didRequestAutocomplete.
+
+        * loader/EmptyClients.h:
+        (EmptyFrameLoaderClient):
+
+        Added FrameLoader::didRequestAutocomplete to EmptyFrameLoaderClient interface.
+
+        * loader/FrameLoaderClient.h:
+        (FrameLoaderClient):
+
+        Added noop implementation to FrameLoaderClient interface (which is implemented chromium's FrameLoaderLoaderImpl.cpp).
+
+2012-11-03  Pavel Feldman  <pfeldman@chromium.org>
+
+        Web Inspector: %d, %i, and %f log formatters have same result
+        https://bugs.webkit.org/show_bug.cgi?id=101148
+
+        Reviewed by Alexander Pavlov.
+
+        Added separate formatters for %f, %i, %d and %s.
+
+        Test: inspector/console/console-message-format.html
+
+        * inspector/front-end/ConsoleMessage.js:
+        (WebInspector.ConsoleMessageImpl.prototype.stringFormatter):
+        (WebInspector.ConsoleMessageImpl.prototype.floatFormatter):
+        (WebInspector.ConsoleMessageImpl.prototype.integerFormatter):
+
+2012-11-03  Andreas Kling  <kling@webkit.org>
+
+        Decouple Attr logic from ElementAttributeData.
+        <http://webkit.org/b/101126>
+
+        Reviewed by Antti Koivisto.
+
+        Move all logic dealing with Attr DOM nodes from ElementAttributeData to Element.
+        This makes more sense since an Attr is tied to a single Element, but an ElementAttributeData
+        can be shared by any number of Elements at a given time.
+
+        Also updated naming convention from just "Attr" to "Attr node" in the code I was touching.
+        "Attr" is way too generic, and has been historically confused with WebCore::Attribute a lot.
+
+        * dom/Element.h:
+        * dom/ElementAttributeData.h:
+        * dom/Element.cpp:
+        (WebCore::attrNodeListMap):
+        (WebCore::attrNodeListForElement):
+        (WebCore::ensureAttrNodeListForElement):
+        (WebCore::removeAttrNodeListForElement):
+        (WebCore::findAttrNodeInList):
+        (WebCore::Element::~Element):
+        (WebCore::Element::detachAttribute):
+        (WebCore::Element::setAttributeNode):
+        (WebCore::Element::removeAttributeInternal):
+        (WebCore::Element::getAttributeNode):
+        (WebCore::Element::getAttributeNodeNS):
+        (WebCore::Element::normalizeAttributes):
+        (WebCore::Element::attrIfExists):
+        (WebCore::Element::ensureAttr):
+        (WebCore::Element::detachAttrNodeFromElementWithValue):
+        (WebCore::Element::detachAllAttrNodesFromElement):
+        (WebCore::Element::cloneAttributesFromElement):
+
+            Move everything Attr-related into Element.cpp while simplifying some loops and remove
+            conditions that are no longer needed as they used to depend on having an attributeData().
+
+        * dom/Node.h:
+        (WebCore::Node::hasSyntheticAttrChildNodes):
+        (WebCore::Node::setHasSyntheticAttrChildNodes):
+
+            Renamed the hasAttrList() node flag to hasSyntheticAttrChildNodes().
+
+        * dom/Attr.cpp:
+        (WebCore::Attr::detachFromElementWithValue):
+
+            Remove awkward indirection and let the call site deal with removing the Attr node from
+            the Element's list of Attr nodes.
+
+        * dom/ElementAttributeData.cpp:
+        (WebCore::ElementAttributeData::clearAttributes):
+
+            Remove now-unused Element* argument.
+
+2012-11-03  Pavel Feldman  <pfeldman@chromium.org>
+
+        REGRESSION (r132014-r132047): Webkit Inspector Window docking broken
+        https://bugs.webkit.org/show_bug.cgi?id=101125
+
+        Reviewed by Vsevolod Vlasov.
+
+        Added "bottom" as default docked state.
+
+        * inspector/front-end/DockController.js:
+        (WebInspector.DockController):
+
+2012-11-02  Shinya Kawanaka  <shinyak@chromium.org>
+
+        [Shadow] ShadowRoot should be able to know the existence of <content>
+        https://bugs.webkit.org/show_bug.cgi?id=100921
+
+        Reviewed by Dimitri Glazkov.
+
+        When <content> is inserted into or removed from a shadow subtree, ShadowRoot counts the number of <content>.
+        It provides O(1) method to check the existence of <content>.
+
+        This is necessary when we implement a fast checking path for distribution invalidation when an element attribute
+        is changed. Larger context is explained in Bug 100451.
+
+        Test: fast/dom/shadow/has-content-elements.html
+
+        * dom/ShadowRoot.cpp:
+        (WebCore::ShadowRoot::ShadowRoot):
+        (WebCore::ShadowRoot::hasInsertionPoint): Since we track both <content> and <shadow>, we don't need to traverse
+        all the descendants of ShadowRoot anymore.
+        * dom/ShadowRoot.h:
+        (WebCore::ShadowRoot::registerContentElement):
+        (WebCore::ShadowRoot::unregisterContentElement):
+        (WebCore::ShadowRoot::hasContentElement):
+        (ShadowRoot):
+        * html/shadow/HTMLContentElement.cpp:
+        (WebCore::HTMLContentElement::HTMLContentElement):
+        (WebCore::HTMLContentElement::insertedInto): When <content> is inserted into ShadowDOM subtree,
+        we notify it to the ShadowRoot. Note that only active <content> element is counted.
+        (WebCore):
+        (WebCore::HTMLContentElement::removedFrom):
+        * html/shadow/HTMLContentElement.h:
+        (HTMLContentElement):
+        * testing/Internals.cpp:
+        (WebCore::Internals::hasContentElement):
+        (WebCore):
+        * testing/Internals.h:
+        (Internals):
+        * testing/Internals.idl:
+
+2012-11-02  KyungTae Kim  <ktf.kim@samsung.com>
+
+        sCurrentPaintTimeStamp is not initialized when FrameView::paintContents returns in the middle
+        https://bugs.webkit.org/show_bug.cgi?id=99990
+
+        Reviewed by Darin Adler.
+
+        Move initialization code for sCurrentPaintTimeStamp to the below of early returns,
+        because it was not reset after early return.
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::paintContents):
+
+2012-11-02  KyungTae Kim  <ktf.kim@samsung.com>
+
+        Fix build warning in PluginView.cpp on release build
+        https://bugs.webkit.org/show_bug.cgi?id=101049
+
+        Reviewed by Kentaro Hara.
+
+        The protocol, host, port parameters are not used when LOG_DISABLED
+        Use UNUSED_PARAM macro for removing -Wunused-parameter warning
+
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::getAuthenticationInfo):
+
+2012-10-25  Martin Robinson  <mrobinson@igalia.com>
+
+        [GTK] Move soup authentication from GtkAuthenticationDialog to WebCore
+        https://bugs.webkit.org/show_bug.cgi?id=99914
+
+        Reviewed by Carlos Garcia Campos.
+
+        Move the actual soup authentication code from the GtkAuthenticationDialog to ResourceHandleSoup.
+        This allows a more generic implementation of authentication, for example, one where a WebKit2
+        client can completely handle authentication.
+
+        No new tests. This does not change behavior.
+
+        * platform/gtk/GtkAuthenticationDialog.cpp: Remove references to the SoupPasswordManager, which
+        is going away in the next release of Gnome. Instead we always assume that the authentication backend has
+        support for remembering passwords and pass that information along with the answer to the authentication
+        request.
+
+        The rest of the changes to this class can be summarized as:
+        1. Getting the information from the AuthenticationChallenge instead of directly from the libsoup
+           objects.
+        2. Using the AuthenticationClient to accomplish the authentication instead of talking to libsoup
+           directly.
+        * platform/gtk/GtkAuthenticationDialog.h:
+        (GtkAuthenticationDialog): Remove members which are no longer used.
+        * platform/network/ResourceHandle.h:
+        (ResourceHandle): ResourceHandleSoup now implements the entire AuthenticationClient interface.
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::WebCoreSynchronousLoader::didReceiveAuthenticationChallenge): Don't handle authentication
+        for synchronous handles.
+        (WebCore::ResourceHandle::didReceiveAuthenticationChallenge): Now set the current challenge on
+        the internal data structure.
+        (WebCore::ResourceHandle::receivedRequestToContinueWithoutCredential): Added.
+        (WebCore::ResourceHandle::receivedCredential): Added.
+        (WebCore::ResourceHandle::receivedCancellation): Added.
+        (WebCore::authenicateCallback): Pass the handle as the authentication client.
+
+2012-11-02  Benjamin Poulain  <bpoulain@apple.com>
+
+        Improve CSSParser::setupParser() since the prefix/suffix are literals
+        https://bugs.webkit.org/show_bug.cgi?id=101107
+
+        Reviewed by Andreas Kling.
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::setupParser):
+        * css/CSSParser.h:
+        (CSSParser):
+        (WebCore::CSSParser::setupParser):
+        CSSParser::setupParser() is only used with literals prefix and suffix. We do not have
+        to compute the length at runtime, we can direclty encode it in the binary.
+
+2012-11-02  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r133375.
+        http://trac.webkit.org/changeset/133375
+        https://bugs.webkit.org/show_bug.cgi?id=101138
+
+        Caused 3 tests to fail on Mac (Requested by aboxhall-laptop on
+        #webkit).
+
+        * platform/text/LineBreakIteratorPoolICU.h:
+        (WebCore::LineBreakIteratorPool::take):
+        (WebCore::LineBreakIteratorPool::put):
+        (LineBreakIteratorPool):
+        * platform/text/TextBreakIterator.h:
+        (WebCore):
+        (WebCore::LazyLineBreakIterator::LazyLineBreakIterator):
+        (WebCore::LazyLineBreakIterator::get):
+        (WebCore::LazyLineBreakIterator::reset):
+        (LazyLineBreakIterator):
+        * platform/text/TextBreakIteratorICU.cpp:
+        (WebCore::acquireLineBreakIterator):
+        (WebCore::releaseLineBreakIterator):
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::RenderBlock::LineBreaker::nextLineBreak):
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::computePreferredLogicalWidths):
+        * rendering/RenderText.h:
+        (WebCore):
+        * rendering/break_lines.cpp:
+        (WebCore):
+        (WebCore::isBreakableSpace):
+        (WebCore::needsLineBreakIterator):
+        (WebCore::nextBreakablePosition):
+        (WebCore::nextBreakablePositionIgnoringNBSP):
+        * rendering/break_lines.h:
+        (WebCore):
+        (WebCore::isBreakable):
+
+2012-11-02  Andreas Kling  <kling@webkit.org>
+
+        Cut overgrown ElementAttributeData bitfield.
+        <http://webkit.org/b/101129>
+
+        Reviewed by Anders Carlsson.
+
+        Make sure the ElementAttributeData bitfield fits into 32 bits. Added a compile-time assertion
+        to guard against future bloatage.
+
+        * dom/ElementAttributeData.cpp:
+        (SameSizeAsElementAttributeData):
+        * dom/ElementAttributeData.h:
+        (ElementAttributeData):
+
+2012-11-02  Michael Saboff  <msaboff@apple.com>
+
+        Crash calling is8Bit() in visitedLinkHash()
+        https://bugs.webkit.org/show_bug.cgi?id=101119
+
+        Reviewed by Filip Pizlo.
+
+        Added an isEmpty() check to AttributeURL and KURL.
+
+        * platform/LinkHash.cpp:
+        (WebCore::visitedLinkHash):
+
+2012-11-02  Glenn Adams  <glenn@skynav.com>
+
+        Add support to -webkit-line-break property for CSS3 Text line-break property values and semantics.
+        https://bugs.webkit.org/show_bug.cgi?id=89235
+
+        Reviewed by Eric Seidel.
+
+        See also wiki documentation at:
+        [1] http://trac.webkit.org/wiki/LineBreaking
+        [2] http://trac.webkit.org/wiki/LineBreakingCSS3Mapping
+
+        Web exposed changes include:
+        (1) The default (initial) value for -webkit-line-break becomes 'auto', instead of 'normal';
+        (2) The values 'auto', 'loose', 'normal', and 'strict' are added to -webkit-line-break;
+        (3) See [2] above for details regarding interpretation.
+
+        Tests: css3/line-break/line-break-auto-centered.html
+               css3/line-break/line-break-auto-half-kana.html
+               css3/line-break/line-break-auto-hyphens.html
+               css3/line-break/line-break-auto-inseparables.html
+               css3/line-break/line-break-auto-iteration-marks.html
+               css3/line-break/line-break-auto-postfixes.html
+               css3/line-break/line-break-auto-prefixes.html
+               css3/line-break/line-break-auto-sound-marks.html
+               css3/line-break/line-break-loose-centered.html
+               css3/line-break/line-break-loose-half-kana.html
+               css3/line-break/line-break-loose-hyphens.html
+               css3/line-break/line-break-loose-inseparables.html
+               css3/line-break/line-break-loose-iteration-marks.html
+               css3/line-break/line-break-loose-postfixes.html
+               css3/line-break/line-break-loose-prefixes.html
+               css3/line-break/line-break-loose-sound-marks.html
+               css3/line-break/line-break-normal-centered.html
+               css3/line-break/line-break-normal-half-kana.html
+               css3/line-break/line-break-normal-hyphens.html
+               css3/line-break/line-break-normal-inseparables.html
+               css3/line-break/line-break-normal-iteration-marks.html
+               css3/line-break/line-break-normal-postfixes.html
+               css3/line-break/line-break-normal-prefixes.html
+               css3/line-break/line-break-normal-sound-marks.html
+               css3/line-break/line-break-strict-centered.html
+               css3/line-break/line-break-strict-half-kana.html
+               css3/line-break/line-break-strict-hyphens.html
+               css3/line-break/line-break-strict-inseparables.html
+               css3/line-break/line-break-strict-iteration-marks.html
+               css3/line-break/line-break-strict-postfixes.html
+               css3/line-break/line-break-strict-prefixes.html
+               css3/line-break/line-break-strict-sound-marks.html
+
+        * platform/text/LineBreakIteratorPoolICU.h:
+        (WebCore::LineBreakIteratorPool::makeLocaleWithBreakKeyword):
+        Add static function to construct ICU locale argument (also used as pool key) with additional
+        break keyword.
+        (WebCore::LineBreakIteratorPool::take):
+        (WebCore::LineBreakIteratorPool::put):
+        (LineBreakIteratorPool):
+        Remove direct dependency from ICU library (and types), moving that dependency into
+        new {open,close}LineBreakIterator() functions (defined in TextBreakIteratorICU.cpp).
+        Update to take line break mode into account.
+        Create (and cache) different break iterators depending on line break mode (in addition to locale),
+        which entails expanding pool entry key format to optionally append "@break=" +
+        "loose"|"normal"|"strict" keyword to locale string.
+
+        * platform/text/TextBreakIterator.h:
+        (WebCore::LazyLineBreakIterator::LazyLineBreakIterator):
+        (WebCore::LazyLineBreakIterator::isLooseCJKMode):
+        (WebCore::LazyLineBreakIterator::get):
+        (WebCore::LazyLineBreakIterator::reset):
+        (LazyLineBreakIterator):
+        Define LineBreakIteratorMode enumeration for use in TextBreakIterator et al.
+        Add state member to indicate line break mode.
+
+        * platform/text/TextBreakIteratorICU.cpp:
+        (WebCore::acquireLineBreakIterator):
+        Use new line break mode when making iterator from pool.
+        Handle change of return type of LineBreakIteratorPool::take() to non-ICU type,
+        i.e., TextBreakIterator* instead of ICU's UBreakIterator*.
+        (WebCore::releaseLineBreakIterator):
+        Handle change of parameter type of LineBreakIteratorPool::put() to non-ICU type,
+        i.e., TextBreakIterator* instead of ICU's UBreakIterator*.
+        (WebCore::isCJKLocale):
+        New functions for determining if CJK rules apply.
+        (WebCore::openLineBreakIterator):
+        New function for abstracting opening of ICU style line break iterator. This is now
+        used in LineBreakIteratorPoolICU.h rather than having direct ICU API dependency there.
+        This function also takes into account the line break mode.
+        (WebCore::closeLineBreakIterator):
+        (WebCore::mapLineIteratorModeToRules):
+        New function for abstracting closing of ICU style line break iterator. This is now
+        used in LineBreakIteratorPoolICU.h rather than having direct ICU API dependency there.
+
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::RenderBlock::LineBreaker::nextLineBreak):
+        Pass line break iterator mode flag when reseting LazyLineBreakIterator.
+        Add looseMode local variable to prevent need for computing under isBreakable().
+
+        * rendering/RenderText.cpp:
+        (WebCore::mapLineBreakToIteratorMode):
+        Add implementation for mapLineBreakToIteratorMode(), used by both RenderText::computePreferredLogicalWidths
+        and RenderBlock::LineBreaker::nextLineBreak.
+        (WebCore::RenderText::computePreferredLogicalWidths):
+        Ensure (lazy line) breakIterator is initialized for line break mode.
+        Ensure isBreakable() is passed loose mode flag to match behavior in RenderBlock::LineBreaker::nextLineBreak.
+
+        * rendering/RenderText.h:
+        (WebCore):
+        Add declaration for mapLineBreakToIteratorMode(), used by both RenderText::computePreferredLogicalWidths
+        and RenderBlock::LineBreaker::nextLineBreak.
+
+        * rendering/break_lines.cpp:
+        (WebCore):
+        Introduce two (local) enums NBSPBehavior and LooseBehavior for expanding template on nextBreakablePosition
+        to include loose mode parameter.
+        (WebCore::isBreakableSpace):
+        Add externally specified loose mode parameter to prevent need to invoke line break iterator
+        accessor method on each invocation. Use new loose mode flavors off NBP functions.
+        (WebCore::needsLineBreakIterator):
+        Introduce loose mode behavior template parameter to optimize loose mode behavior code path in order
+        to prevent regression to non loose mode path.
+        (WebCore::nextBreakablePosition):
+        (WebCore::nextBreakablePositionIgnoringNBSP):
+        Use new template parameter enums described above.
+        (WebCore::nextBreakablePositionIgnoringNBSPLoose):
+        (WebCore::nextBreakablePositionLoose):
+        Introduce two additional 'loose' mode flavors of NBP template expansions.
+
+        * rendering/break_lines.h:
+        (WebCore):
+        (WebCore::isBreakable):
+        Add externally specified loose mode parameter to prevent need to invoke line break iterator
+        accessor method on each invocation.
+
+2012-11-02  Elliott Sprehn  <esprehn@chromium.org>
+
+        Replace NodeRareData hash map with a union on m_renderer
+        https://bugs.webkit.org/show_bug.cgi?id=100057
+
+        Reviewed by Eric Seidel.
+
+        Use a union on Node::m_renderer between NodeRareData* and RenderObject*. This removes
+        the overhead of accessing rare data and the memory from the map.
+
+        This is an 8% improvement on Bindings/get-elements-by-tag-name.html which tested
+        document.getElementsByTagName and was previously optimized in Bug 90059 for a 5% 
+        improvement. As this is better than even the special casing for document that was
+        done in that bug, general node list access should see an even greater win.
+
+        This reduces the memory usage on nytimes.com by 250k per Bug 101052 by
+        removing the rare data map overhead.
+
+        This is also a 15% improvement on Parser/textarea-parsing.html
+
+        By removing the performance overhead of rareData() this patch addresses the performance
+        issues raised in Bugs 73853, 87034 and 89635.
+
+        I ran Parser/html5-full-render.html and there was no performance regression after
+        tuning Text::recalcTextStyle and the refactor that was done in r132684.
+
+        No new tests, this is just a refactor.
+
+        * dom/Document.cpp:
+        (WebCore::Document::Document):
+        * dom/Document.h:
+        (WebCore::Node::Node):
+        * dom/Element.cpp:
+        (WebCore::Element::elementRareData):
+        * dom/Node.cpp:
+        (WebCore::Node::rareData):
+        (WebCore::Node::ensureRareData):
+        (WebCore::Node::clearRareData):
+        (WebCore::Node::renderBox):
+        (WebCore::Node::renderBoxModelObject):
+        (WebCore::Node::reportMemoryUsage):
+        * dom/Node.h:
+        (NodeRareDataBase):
+          Base class for NodeRareData that knows about the renderer so we can
+          inline the accesses in Node.h
+        (WebCore::NodeRareDataBase::renderer):
+        (WebCore::NodeRareDataBase::setRenderer):
+        (WebCore::NodeRareDataBase::~NodeRareDataBase):
+        (WebCore::NodeRareDataBase::NodeRareDataBase):
+        (WebCore):
+        (WebCore::Node::renderer):
+        (WebCore::Node::setRenderer):
+        (Node):
+        * dom/NodeRareData.h:
+        * dom/NodeRenderStyle.h:
+        (WebCore::Node::renderStyle):
+        * dom/Text.cpp:
+        (WebCore::Text::recalcTextStyle):
+          This method appears very hot in html5-full-render.html and accessing the
+          renderer 4 times caused a 2% performance regression with this patch. I
+          reduced it to 1 access and there's no longer any performance regression.
+        * dom/WebCoreMemoryInstrumentation.cpp:
+          Removed tracking of the rare data map memory usage as there is no longer
+          a map to track.
+        * dom/WebCoreMemoryInstrumentation.h:
+        * inspector/InspectorMemoryAgent.cpp:
+        (WebCore::InspectorMemoryAgent::getProcessMemoryDistribution):
+
+2012-11-02  Alexey Proskuryakov  <ap@apple.com>
+
+        [Mac] ResourceHandle changes for network process
+        https://bugs.webkit.org/show_bug.cgi?id=101111
+
+        Reviewed by Jessie Berlin.
+
+        With NSOperationQueue, we'll be getting NetworkProcess delegate method calls
+        on secondary threads, and so we won't block other requests while consulting with WebProcess.
+
+        * platform/network/NetworkingContext.h:
+        (WebCore::NetworkingContext::scheduledRunLoopPairs):
+        (WebCore::NetworkingContext::scheduledOperationQueue):
+        Add an ability to schedule on an NSOperationQueue. Now that scheduling on run loop
+        is not a must, give scheduledRunLoopPairs() a default implementation.
+
+        * platform/network/mac/ResourceHandleMac.mm: Removed isInitializingConnection
+        static. It was only used to catch a long obsolete bug with debug logging, and
+        cannot work with multiple threads.
+        (WebCore::ResourceHandle::start): Scedule on a operation queue if applicable.
+        (-[WebCoreResourceHandleAsDelegate connection:willCacheResponse:]): Removed a
+        check that used isInitializingConnection.
+
+2012-11-02  Chris Rogers  <crogers@google.com>
+
+        Automating gain AudioParam with linearRampToValueAtTime introduces buzzing distortion
+        https://bugs.webkit.org/show_bug.cgi?id=100885
+
+        Reviewed by Kenneth Russell.
+
+        AudioParamTimeline needs to use double-precision for time-values to avoid drift and precision issues.
+
+        Covered by existing tests.
+
+        * Modules/webaudio/AudioParam.cpp:
+        (WebCore::AudioParam::calculateTimelineValues):
+        * Modules/webaudio/AudioParamTimeline.cpp:
+        (WebCore::AudioParamTimeline::valueForContextTime):
+        (WebCore::AudioParamTimeline::valuesForTimeRange):
+        (WebCore::AudioParamTimeline::valuesForTimeRangeImpl):
+        * Modules/webaudio/AudioParamTimeline.h:
+        (AudioParamTimeline):
+
+2012-11-02  Stephen Chenney  <schenney@chromium.org>
+
+        Reduce redundant code in SimpleFontData[platform]
+        https://bugs.webkit.org/show_bug.cgi?id=97245
+
+        Reviewed by Eric Seidel.
+
+        Move duplicated code out of platform specific files and into the common file.
+        This represents all of the methods in SimpleFontData that do not have genuine
+        platform specific code.
+
+        No new tests because there is no change at all in the functionality.
+
+        * platform/graphics/SimpleFontData.cpp:
+        (WebCore):
+        (WebCore::SimpleFontData::smallCapsFontData): Implementation from platform files.
+        (WebCore::SimpleFontData::emphasisMarkFontData): Implementation from platform files.
+        * platform/graphics/chromium/SimpleFontDataChromiumWin.cpp:
+        (WebCore): Removed common code.
+        * platform/graphics/freetype/SimpleFontDataFreeType.cpp:
+        (WebCore): Removed common code.
+        * platform/graphics/mac/SimpleFontDataMac.mm:
+        (WebCore): Removed common code.
+        * platform/graphics/pango/SimpleFontDataPango.cpp:
+        (WebCore): Removed common code.
+        * platform/graphics/qt/SimpleFontDataQt.cpp:
+        (WebCore): Removed common code.
+        * platform/graphics/skia/SimpleFontDataSkia.cpp:
+        (WebCore): Removed common code.
+        * platform/graphics/win/SimpleFontDataWin.cpp:
+        (WebCore): Removed common code.
+        * platform/graphics/wince/SimpleFontDataWinCE.cpp:
+        (WebCore): Removed common code.
+        * platform/graphics/wx/SimpleFontDataWx.cpp:
+        (WebCore): Removed common code.
+
+2012-11-02  Adam Barth  <abarth@webkit.org>
+
+        memory-instrumentation-cached-images.html is crashing
+        https://bugs.webkit.org/show_bug.cgi?id=101103
+
+        Unreviewed.
+
+        Restore code deleted in http://trac.webkit.org/changeset/133331.
+
+        * bindings/v8/IntrusiveDOMWrapperMap.h:
+
+2012-11-02  Simon Fraser  <simon.fraser@apple.com>
+
+        Enable SUBPIXEL_LAYOUT on Mac
+        https://bugs.webkit.org/show_bug.cgi?id=101076
+
+        Reviewed by Dave Hyatt.
+
+        Define ENABLE_SUBPIXEL_LAYOUT and include it in FEATURE_DEFINES.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2012-11-02  Lianghui Chen  <liachen@rim.com>
+
+        [BlackBerry] ResourceHandle::cancel() in ResourceHandleBlackBerry should setClient to null.
+        https://bugs.webkit.org/show_bug.cgi?id=101082
+
+        Internal PR: 235410.
+        Patch suggested by George Staikos, prepared by Lyon Chen.
+        Reviewed by Yong Li.
+
+        ResourceHandle::cancel() should call setClient(0) to close the window
+        during which it has been cancelled but its client is still there and can
+        be called.
+
+        No new tests as it's a code improvement without obvious bug.
+
+        * platform/network/blackberry/ResourceHandleBlackBerry.cpp:
+        (WebCore::ResourceHandle::cancel):
+
+2012-11-02  Anders Carlsson  <andersca@apple.com>
+
+        Add a PluginInactive plug-in unavailability reason
+        https://bugs.webkit.org/show_bug.cgi?id=101089
+
+        Reviewed by Sam Weinig.
+
+        This is to be used by Mac WebKit and WebKit2 shortly.
+
+        * English.lproj/Localizable.strings:
+        * platform/LocalizedStrings.cpp:
+        (WebCore::inactivePluginText):
+        (WebCore):
+        * platform/LocalizedStrings.h:
+        (WebCore):
+        * platform/blackberry/LocalizedStringsBlackBerry.cpp:
+        (WebCore::inactivePluginText):
+        (WebCore):
+        * platform/efl/LocalizedStringsEfl.cpp:
+        (WebCore::inactivePluginText):
+        (WebCore):
+        * platform/gtk/LocalizedStringsGtk.cpp:
+        (WebCore::inactivePluginText):
+        (WebCore):
+        * platform/qt/LocalizedStringsQt.cpp:
+        (WebCore::inactivePluginText):
+        (WebCore):
+        * rendering/RenderEmbeddedObject.cpp:
+        (WebCore::unavailablePluginReplacementText):
+        * rendering/RenderEmbeddedObject.h:
+
+2012-11-02  Rob Buis  <rbuis@rim.com>
+
+        [CMAKE] Remove QNX specific section
+        https://bugs.webkit.org/show_bug.cgi?id=101063
+
+        Reviewed by Daniel Bates.
+
+        We do not need the QNX section anymore, so also remove the FEATURE_DEFINES_CSS variable as it
+        equals FEATURE_DEFINES_WITH_SPACE_SEPARATOR.
+
+        * CMakeLists.txt:
+
+2012-11-02  Michael Saboff  <msaboff@apple.com>
+
+        visitedHashLink() converts 8 bit URLs and attributes to 16 bits.
+        https://bugs.webkit.org/show_bug.cgi?id=101014
+
+        Reviewed by Geoffrey Garen.
+
+        Converted most of the static methods to templated based on character type.  Changed visitedHashLink to 
+        check bitness of both the base URL and attribute.  If both are 8 bit, then we process using the LChar
+        version of the templated methods.  Otherwise we use the 16 bit flavor.
+
+        Changes covered by existing tests.
+
+        * platform/LinkHash.cpp:
+        (WebCore::findSlashDotDotSlash):
+        (WebCore::findSlashSlash):
+        (WebCore::findSlashDotSlash):
+        (WebCore::containsColonSlashSlash):
+        (WebCore::squeezeOutNullCharacters):
+        (WebCore::cleanSlashDotDotSlashes):
+        (WebCore::mergeDoubleSlashes):
+        (WebCore::cleanSlashDotSlashes):
+        (WebCore::cleanPath):
+        (WebCore::matchLetter):
+        (WebCore::needsTrailingSlash):
+        (WebCore::visitedURLInline):
+        (WebCore::visitedURL):
+        (WebCore::visitedLinkHash):
+
+2012-11-02  Ian Vollick  <vollick@chromium.org>
+
+        Support invalidation tracking for composited layers
+        https://bugs.webkit.org/show_bug.cgi?id=97801
+
+        Reviewed by Simon Fraser.
+
+        GraphicsLayers now store invalidated rects and can include them in
+        the layer tree dump.
+
+        Test: compositing/repaint/invalidations-on-composited-layers.html
+
+        * WebCore.exp.in:
+          Exports FrameView::resetTrackedRepaints()
+        * page/FrameView.cpp:
+        (WebCore::FrameView::setTracksRepaints):
+          Notifies each compositor that we are starting/stopping repaints.
+        (WebCore::FrameView::resetTrackedRepaints):
+          Moved implementation to the cpp file.
+        * platform/graphics/GraphicsLayer.cpp:
+        (WebCore::GraphicsLayer::~GraphicsLayer):
+          Clears the repaint rects associated with this layer.
+        (WebCore::GraphicsLayer::resetTrackedRepaints):
+          Clears the repaint rects associated with this layer.
+          Note that the repaint rects are stored in a statically allocated
+          HashMap to avoid using space on the graphics layers.
+        (WebCore::GraphicsLayer::addRepaintRect):
+          Adds a repaint rect to list associated with this layer in the
+          hash map mentioned above.
+        (WebCore::GraphicsLayer::dumpProperties):
+          This has been modified to include the repaint rects in the dump
+          if they've been requested.
+        * platform/graphics/GraphicsLayerClient.h:
+        (WebCore::GraphicsLayerClient::isTrackingRepaints):
+          This is how graphics layers check if repaint tracking is happening.
+          Returns false by default.
+        * platform/graphics/blackberry/GraphicsLayerBlackBerry.cpp:
+        (WebCore::GraphicsLayerBlackBerry::setContentsNeedsDisplay):
+        (WebCore::GraphicsLayerBlackBerry::setNeedsDisplay):
+        (WebCore::GraphicsLayerBlackBerry::setNeedsDisplayInRect):
+          These now call GraphicsLayer::addRepaintRect as necessary.
+        * platform/graphics/ca/GraphicsLayerCA.cpp:
+        (WebCore::GraphicsLayerCA::setNeedsDisplayInRect):
+          Now calls GraphicsLayer::addRepaintRect as necessary.
+        * platform/graphics/chromium/GraphicsLayerChromium.cpp:
+        (WebCore::GraphicsLayerChromium::setContentsNeedsDisplay):
+        (WebCore::GraphicsLayerChromium::setNeedsDisplay):
+        (WebCore::GraphicsLayerChromium::setNeedsDisplayInRect):
+          These now call GraphicsLayer::addRepaintRect as necessary.
+        * platform/graphics/clutter/GraphicsLayerClutter.cpp:
+        (WebCore::GraphicsLayerClutter::setNeedsDisplay):
+        (WebCore::GraphicsLayerClutter::setNeedsDisplayInRect):
+          These now call GraphicsLayer::addRepaintRect as necessary.
+        * platform/graphics/texmap/GraphicsLayerTextureMapper.cpp:
+        (WebCore::GraphicsLayerTextureMapper::setNeedsDisplay):
+        (WebCore::GraphicsLayerTextureMapper::setContentsNeedsDisplay):
+        (WebCore::GraphicsLayerTextureMapper::setNeedsDisplayInRect):
+          These now call GraphicsLayer::addRepaintRect as necessary.
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::isTrackingRepaints):
+          Required since this is a GraphicsLayerClient.
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::layerTreeAsText):
+          Now accepts a flag to include the repaint rects in the layer tree
+          dump.
+        (WebCore::resetTrackedRepaintRectsRecursive):
+          Clears the repaint rects on all graphics layers.
+        (WebCore::RenderLayerCompositor::resetTrackedRepaintRects):
+          Clears the repaint rects on all graphics layers.
+        (WebCore::RenderLayerCompositor::isTrackingRepaints):
+          Required since this is a GraphicsLayerClient.
+        * testing/Internals.cpp:
+        (WebCore::Internals::layerTreeAsText):
+        * testing/Internals.h:
+        * testing/Internals.idl:
+          The internals changes plumb the new flag for including the repaint
+          rects in the layer tree dump.
+
+2012-11-02  Adam Barth  <abarth@webkit.org>
+
+        [V8] Generalize NodeWrapperMap to be able to handle other sorts of keys
+        https://bugs.webkit.org/show_bug.cgi?id=100973
+
+        Reviewed by Stephen White.
+
+        This is the first step towards using intrusive DOM wrapper maps more
+        widely in WebCore (see
+        http://lists.webkit.org/pipermail/webkit-dev/2012-November/022686.html
+        for more context).
+
+        * bindings/v8/DOMDataStore.cpp:
+        (WebCore::DOMDataStore::DOMDataStore):
+        * bindings/v8/IntrusiveDOMWrapperMap.h:
+        (WebCore):
+        (WebCore::IntrusiveDOMWrapperMap::weakCallback):
+
+2012-11-02  Adam Barth  <abarth@webkit.org>
+
+        ASSERT in RenderLayer::hitTestContents can fire
+        https://bugs.webkit.org/show_bug.cgi?id=99656
+
+        Reviewed by Eric Seidel.
+
+        The issue is that updateHitTestResult and addNodeToRectBasedTestResult
+        are using two different nodes. Since they aren't consistent, we violate
+        assertions about only setting the inner node if we're doing a
+        rect-based hit test. This patch makes the two consistent.
+
+        Test: fast/dom/nodesFromRect/nodesFromRect-continuation-crash.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::nodeForHitTest):
+        (WebCore):
+        (WebCore::RenderBlock::nodeAtPoint):
+        (WebCore::RenderBlock::updateHitTestResult):
+        * rendering/RenderBlock.h:
+        (RenderBlock):
+
+2012-11-02  Mike West  <mkwst@chromium.org>
+
+        Prefer 'Content-Security-Policy' to 'X-WebKit-CSP'.
+        https://bugs.webkit.org/show_bug.cgi?id=101043
+
+        Reviewed by Adam Barth.
+
+        The canonical 'Content-Security-Policy' header landed in 133095, but we
+        missed a few tests while updating to the new hotness. We also should
+        start using the canonical header for the inspector.
+
+        This patch should have no visible change; tests should continue to pass
+        with the new header, just as they did with the old header.
+
+        * inspector/front-end/inspector.html:
+
+2012-11-02  Adam Barth  <abarth@webkit.org>
+
+        ENABLE(UNDO_MANAGER) is disabled everywhere and is not under active development
+        https://bugs.webkit.org/show_bug.cgi?id=100711
+
+        Reviewed by Eric Seidel.
+
+        No one is actively working on ENABLE(UNDO_MANAGER). There are some
+        tricky lifetime issues in the UndoManager API that are complicating
+        ongoing work to improve the interaction between WebCore and the garbage
+        collector. Rather than leave this code in a broken state, we should
+        remove it for the time being. We can always restore it from the svn
+        history when there is an active owner for this code.
+
+        * CMakeLists.txt:
+        * Configurations/FeatureDefines.xcconfig:
+        * DerivedSources.cpp:
+        * DerivedSources.make:
+        * DerivedSources.pri:
+        * GNUmakefile.features.am:
+        * GNUmakefile.list.am:
+        * Target.pri:
+        * UseJSC.cmake:
+        * UseV8.cmake:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/DOMTransaction.cpp: Removed.
+        * bindings/js/DOMTransaction.h: Removed.
+        * bindings/js/JSBindingsAllInOne.cpp:
+        * bindings/js/JSUndoManagerCustom.cpp: Removed.
+        * bindings/v8/DOMTransaction.cpp: Removed.
+        * bindings/v8/DOMTransaction.h: Removed.
+        * bindings/v8/V8HiddenPropertyName.h:
+        (WebCore):
+        * bindings/v8/custom/V8DOMTransactionCustom.cpp: Removed.
+        * bindings/v8/custom/V8UndoManagerCustom.cpp: Removed.
+        * css/PropertySetCSSStyleDeclaration.cpp:
+        (WebCore::PropertySetCSSStyleDeclaration::setCssText):
+        (WebCore::PropertySetCSSStyleDeclaration::setProperty):
+        (WebCore::PropertySetCSSStyleDeclaration::removeProperty):
+        (WebCore::PropertySetCSSStyleDeclaration::setPropertyInternal):
+        * dom/CharacterData.cpp:
+        (WebCore::CharacterData::setDataAndUpdate):
+        * dom/ContainerNode.cpp:
+        (WebCore::willRemoveChild):
+        (WebCore::willRemoveChildren):
+        (WebCore::updateTreeAfterInsertion):
+        * dom/Document.cpp:
+        (WebCore::Document::Document):
+        * dom/Document.h:
+        (WebCore):
+        (Document):
+        * dom/Document.idl:
+        * dom/Element.cpp:
+        (WebCore::Element::willModifyAttribute):
+        * editing/CompositeEditCommand.h:
+        * editing/DOMTransaction.idl: Removed.
+        * editing/DOMTransactionStep.cpp: Removed.
+        * editing/DOMTransactionStep.h: Removed.
+        * editing/Editor.cpp:
+        (WebCore::Editor::appliedEditing):
+        (WebCore::Editor::unappliedEditing):
+        (WebCore::Editor::reappliedEditing):
+        (WebCore::Editor::canUndo):
+        (WebCore::Editor::undo):
+        (WebCore::Editor::canRedo):
+        (WebCore::Editor::redo):
+        * editing/UndoManager.cpp: Removed.
+        * editing/UndoManager.h: Removed.
+        * editing/UndoManager.idl: Removed.
+        * editing/UndoStep.h:
+        (UndoStep):
+
+2012-11-02  Mike West  <mkwst@chromium.org>
+
+        Measure the usage of the various CSP headers.
+        https://bugs.webkit.org/show_bug.cgi?id=100974
+
+        Reviewed by Adam Barth.
+
+        Currently, we're collecting metrics regarding usage of the
+        'X-WebKit-CSP' and 'X-WebKit-CSP-Report-Only' HTTP headers. We've
+        recently added support for the canonical 'Content-Security-Policy'
+        and 'Content-Security-Policy-Report-Only' headers. This patch adds
+        those headers explicitly into the metrics, giving insight into uptake
+        of the unprefixed header, and into usage of pure reporting vs.
+        enforcement.
+
+        No visible functionality should change; all Content Security Policy
+        tests should continue to pass.
+
+        * page/ContentSecurityPolicy.cpp:
+        (WebCore::ContentSecurityPolicy::didReceiveHeader):
+            Convert the CSP header type into a FeatureObserver::Feature, and
+            observe it.
+        * page/FeatureObserver.h:
+            Add three new values to the enum to cover the new header types.
+
+2012-11-02  Ojan Vafai  <ojan@chromium.org>
+
+        Fix silly mistake from http://trac.webkit.org/changeset/133315.
+        Forgot to remove the "!".
+
+        * css/StyleResolver.cpp:
+        (WebCore::StyleResolver::canShareStyleWithElement):
+
+2012-11-02  Tom Sepez  <tsepez@chromium.org>
+
+        Support X-XSS-Protection: report=URL header syntax in XSSAuditor.
+        https://bugs.webkit.org/show_bug.cgi?id=100892
+
+        Reviewed by Adam Barth.
+
+        This patch adds a security feature which allows a violation report to be sent back
+        to a site when the XSSAuditor detects a reflected XSS against it.  It uses the same
+        reporting mechanism as for CSP violation reports.
+
+        Tests: http/tests/security/xssAuditor/malformed-xss-protection-header-5.html
+               http/tests/security/xssAuditor/malformed-xss-protection-header-6.html
+               http/tests/security/xssAuditor/malformed-xss-protection-header-7.html
+               http/tests/security/xssAuditor/malformed-xss-protection-header-8.html
+               http/tests/security/xssAuditor/malformed-xss-protection-header-9.html
+               http/tests/security/xssAuditor/report-script-tag.html
+               http/tests/security/xssAuditor/xss-protection-parsing-03.html
+               http/tests/security/xssAuditor/xss-protection-parsing-04.html
+
+        * html/parser/XSSAuditor.cpp:
+        (WebCore::XSSAuditor::XSSAuditor):
+        (WebCore::XSSAuditor::init):
+        (WebCore::XSSAuditor::filterToken):
+        Invoke Ping loader's violation reporting, if requested, when a reflected
+        XSS is detected.
+        
+        * html/parser/XSSAuditor.h:
+        XSSAuditor class need to store the report URL as well as the undigested versions
+        of the request URL and request body for reporting.
+
+        * loader/MixedContentChecker.cpp:
+        (WebCore):
+        * loader/MixedContentChecker.h:
+        (MixedContentChecker):
+        Make isMixedContent() method public.
+
+        * loader/PingLoader.cpp:
+        (WebCore::PingLoader::sendViolationReport):
+        * loader/PingLoader.h:
+        (PingLoader):
+        * page/ContentSecurityPolicy.cpp:
+        (WebCore::ContentSecurityPolicy::reportViolation):
+        Renamed reportContentSecurityPolicyViolation() method to sendViolationReport(),
+        since this is now used to send more than just CSP violations.
+        
+        * platform/network/HTTPParsers.cpp:
+        (WebCore):
+        (WebCore::skipEquals):
+        (WebCore::skipValue):
+        (WebCore::parseXSSProtectionHeader):
+        * platform/network/HTTPParsers.h:
+        Parse and return report= directive in X-XSS-Protection header.
+        
+2012-11-02  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r133313.
+        http://trac.webkit.org/changeset/133313
+        https://bugs.webkit.org/show_bug.cgi?id=101078
+
+        "A lot of tests hit the ASSERTs introduced by this patch"
+        (Requested by haraken on #webkit).
+
+        * bindings/v8/V8DOMWrapper.h:
+        (WebCore::V8DOMWrapper::setDOMWrapper):
+
+2012-11-02  Ojan Vafai  <ojan@chromium.org>
+
+        Unreviewed, rolling out r132913.
+        http://trac.webkit.org/changeset/132913
+        https://bugs.webkit.org/show_bug.cgi?id=91850
+
+        Caused performance regressions.
+        See https://bugs.webkit.org/show_bug.cgi?id=100872 for details.
+
+        * bindings/v8/V8PerIsolateData.cpp:
+        (WebCore::V8PerIsolateData::visitExternalStrings):
+        * bindings/v8/V8StringResource.cpp:
+        (StringTraits):
+        (WebCore::v8StringToWebCoreString):
+        * bindings/v8/V8ValueCache.cpp:
+        (WebCore::makeExternalString):
+        (WebCore::WebCoreStringResource::visitStrings):
+        * bindings/v8/V8ValueCache.h:
+        (WebCore::WebCoreStringResource::WebCoreStringResource):
+        (WebCore::WebCoreStringResource::~WebCoreStringResource):
+        (WebCore::WebCoreStringResource::data):
+        (WebCoreStringResource):
+        (WebCore::WebCoreStringResource::length):
+        (WebCore::WebCoreStringResource::atomicString):
+        (WebCore::WebCoreStringResource::toStringResource):
+
+2012-11-02  Martin Robinson  <mrobinson@igalia.com>
+
+        [GTK] Remove dependency on SoupPasswordManager
+        https://bugs.webkit.org/show_bug.cgi?id=100775
+
+        Reviewed by Carlos Garcia Campos.
+
+        Remember passwords using libsecret instead of SoupPasswordManager. We accomplish this using
+        a new class, CredentialBackingStore. CredentialBackingStore will soon be the thing that backs
+        CredentialStoreGtk. The name is based on the name of a similar class from the BlackBerry port.
+
+        No new tests. This does not change behavior.
+
+        * GNUmakefile.am: Add libsecret flags to the build and the new directory to the include list.
+        * GNUmakefile.list.am: Add new files to the source list.
+        * platform/gtk/GRefPtrGtk.cpp: Add support for SecretValue to GRefPtrGtk.
+        * platform/gtk/GtkAuthenticationDialog.cpp: Replace interaction with SoupPasswordManger with
+        interaction with the CredentialBackingStore. Remove all conditional SoupPasswordManager guards.
+        * platform/gtk/GtkAuthenticationDialog.h: Ditto.
+        * platform/network/gtk/CredentialBackingStore.cpp: Added.
+        * platform/network/gtk/CredentialBackingStore.h: Added.
+
+2012-11-02  Jinwoo Song  <jinwoo7.song@samsung.com>
+
+        Fix build warning [-Wswitch]
+        https://bugs.webkit.org/show_bug.cgi?id=101029
+
+        Reviewed by Alexey Proskuryakov.
+
+        Fix build warning message: enumeration value ‘Viewport’ not handled in switch [-Wswitch]
+        in Source/WebCore/css/StyleSheetContents.cpp.
+        Add case statement for 'Viewport' with the CSS_DEVICE_ADAPTATION macro.
+
+        * css/StyleSheetContents.cpp:
+        (WebCore::childRulesHaveFailedOrCanceledSubresources):
+
+2012-11-02  Ojan Vafai  <ojan@chromium.org>
+
+        Move m_element checks out of canShareStyle into locateSharedStyle
+        https://bugs.webkit.org/show_bug.cgi?id=101070
+
+        Reviewed by Darin Adler.
+
+        Can shareStyleWithElement is called for each sibling as we look for a
+        shareElement. locateSharedStyle is called once for the element we're
+        trying to find a style for. Checks that only depend on the latter
+        element should, thus be in locateSharedStyle.
+
+        No new tests. There should be no change in behavior, except possibly
+        a performance improvement in some cases.
+
+        * css/StyleResolver.cpp:
+        (WebCore::StyleResolver::canShareStyleWithElement):
+        (WebCore::StyleResolver::locateSharedStyle):
+
+2012-11-02  Kentaro Hara  <haraken@chromium.org>
+
+        [V8] Add ASSERT() to guarantee that we don't store NULL pointers to V8 internal fields
+        https://bugs.webkit.org/show_bug.cgi?id=101054
+
+        Reviewed by Adam Barth.
+
+        I'm investigating a Chromium crash bug:
+        http://code.google.com/p/chromium/issues/detail?id=155942
+
+        I've not yet identified the root cause (because I can't reproduce
+        the crash), but it looks like we are storing NULL pointers to
+        V8 internal fields. Just in case, we can add an ASSERT() to
+        guarantee that NULL pointers are never stored. (Also I'm hoping
+        that this ASSERT() will give me more debug information.)
+
+        No tests. No change in behavior.
+
+        * bindings/v8/V8DOMWrapper.h:
+        (WebCore::V8DOMWrapper::setDOMWrapper):
+
+2012-11-02  Kevin Ellis  <kevers@chromium.org>
+
+        Imrpove scoring in touch adjustment to address bias towards smaller targets.
+        https://bugs.webkit.org/show_bug.cgi?id=101046
+
+        Reviewed by Antonio Gomes.
+
+        Update the touch overlap score for touch adjustmetn to normalize
+        with respect to the maximum possible overlap rather than the size
+        of the target element.  This change enables good overlap scores for
+        small and large targets alike.  Prior to the patch it was not possible
+        to get a good overlap score for a sufficiently larget target.
+
+        Covered by existing tests, which have been updated to reflect the
+        intended behavior.
+
+        * page/TouchAdjustment.cpp:
+        (WebCore::TouchAdjustment::hybridDistanceFunction):
+
+2012-11-02  Mike West  <mkwst@chromium.org>
+
+        Web Inspector: Repeated errors are rendered incorrectly: link is not floating to the right.
+        https://bugs.webkit.org/show_bug.cgi?id=101032
+
+        Reviewed by Yury Semikhatsky.
+
+        https://bugs.webkit.org/show_bug.cgi?id=100525 incorrectly added
+        '-webkit-flex: 1' only to the list generated for errors in the console.
+        It should have been added to normal warning text as well. This patch
+        fixes the problem.
+
+        * inspector/front-end/inspector.css:
+        (.repeated-message .outline-disclosure, .repeated-message > .console-message-text):
+
+2012-11-02  Eugene Klyuchnikov  <eustas.bug@gmail.com>
+
+        Web Inspector: Timeline: show popup for CPU bars.
+        https://bugs.webkit.org/show_bug.cgi?id=100951
+
+        Reviewed by Pavel Feldman.
+
+        Each CPU bar can represent a combination of several shorter messages.
+        We should show information about combined messages - start time,
+        total duration, CPU time, message count.
+
+        * English.lproj/localizedStrings.js: Added "Message Count" string.
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel.prototype._refreshMainThreadBars):
+        Supply elements with underlying info.
+        * inspector/front-end/TimelinePresentationModel.js:
+        (WebInspector.TimelinePresentationModel.prototype.generateMainThreadBarPopupContent):
+        Added.
+
+2012-11-02  Alexei Filippov  <alph@chromium.org>
+
+        Web Inspector: Network panel grid UI is misaligned after r132888
+        https://bugs.webkit.org/show_bug.cgi?id=101050
+
+        Rollback the change to basic data grid css and move it to the native memory
+        snapshot datagrid css.
+
+        Reviewed by Alexander Pavlov.
+
+        * inspector/front-end/dataGrid.css:
+        (.data-grid td):
+        * inspector/front-end/nativeMemoryProfiler.css:
+        (.native-snapshot-view .data-grid td):
+
+2012-11-02  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r133303.
+        http://trac.webkit.org/changeset/133303
+        https://bugs.webkit.org/show_bug.cgi?id=101068
+
+        "Broke qt wk2 build (seems like bots fails to rerun qmake if
+        needed)" (Requested by kbalazs on #webkit).
+
+        * Target.pri:
+        * WebCore.pri:
+        * platform/PlatformStrategies.cpp:
+        (WebCore):
+        * platform/qt/QtTestSupport.h: Removed.
+
+2012-11-02  Balazs Kelemen  <kbalazs@webkit.org>
+
+        [Qt][WK2] setPlatformStrategies always asserts after r132744
+        https://bugs.webkit.org/show_bug.cgi?id=100838
+
+        Reviewed by Simon Hausmann.
+
+        The problem here is that we use QWebSettings::clearMemoryCaches, a WebKit1 API
+        from the injected bundle, which calls initializeWebCoreQt and it sets the platform
+        strategies to the one for WebKit1. We should stop using WebKit1 API's from WebKit2
+        code. In order to keep the behavior, this patch adds exported helpers to WebCore
+        that can be used from DumpRenderTree and WebKitTestRunner. This is the same idea
+        as WebCoreTestSupport but these helpers are specific to Qt. Technically we could
+        add it to the WebKit1 API for the time being, but my goal was to move in the direction
+        of removing the WebKit1 dependency from WebKitTestRunner. We only build the file
+        in non production mode.
+
+        Basically covered by all tests.
+
+        * Target.pri:
+        * WebCore.pri: We need to link against fontconfig (only in non-production mode) since
+        initializeTestFonts uses it.
+        * platform/PlatformStrategies.cpp:
+        (WebCore): Zero initialize the global static variable as it is expected by the functions
+        below. It is a side fix. It seems like it has not been shown on debug WebKit2 bots because
+        common runtime environments tend to zero initialize statics by default - but I don't think
+        we should rely on that.
+        * platform/qt/QtTestSupport.cpp: Added. I choose GPL license because code from qwebsettings.cpp
+        is also under that.
+        (WebKit):
+        (WebKit::QtTestSupport::clearMemoryCaches): This is basically a copy of QWebSettings::clearMemoryCaches
+        without calling initializeWebCoreQt.
+        (WebKit::QtTestSupport::initializeTestFonts): I moved this code here as well now that we have to expose
+        symbols from WebCore anyway. The advantage is that now we don't have to build it twice and we don't need
+        additional files to forward it from the directory of DumpRenderTree for WebKitTestRunner.
+        I added a call to FontCace::invalidate in the case when the font set has been changed so that it will do
+        the job even if we would stop clearing all caches between tests. Also moved the call to
+        QFontDatabase::removeAllApplicationFonts from callers to here.
+        * platform/qt/QtTestSupport.h:
+        (WebKit):
+        (QtTestSupport):
+
+2012-11-02  Kent Tamura  <tkent@chromium.org>
+
+        Optimize DateTimeFormat::quoteAndAppendLiteral output
+        https://bugs.webkit.org/show_bug.cgi?id=101040
+
+        Reviewed by Kentaro Hara.
+
+        In LDML date format pattern, only ASCII alphabet and quote have special
+        roles. So we don't need to quote the input string if it doesn't contain
+        them.
+
+        No new tests. Updated WebKit/chromium/tests/LocaleWinTest.cpp
+
+        * platform/text/DateTimeFormat.cpp:
+        (WebCore::isASCIIAlphabetOrQuote): A helper to check special characters.
+        (WebCore::DateTimeFormat::quoteAndAppendLiteral):
+        Append the input string as is if it has no special character.
+
+2012-11-02  Ilya Tikhonovsky  <loislo@chromium.org>
+
+        Web Inspector: NMI instrument NodeRareData::Map. It uses ~250k on nytimes.com
+        https://bugs.webkit.org/show_bug.cgi?id=101052
+
+        Reviewed by Yury Semikhatsky.
+
+        I noticed that in many cases cache structures are plain static HashMap, HashSet etc.
+        MemoryAgent can visit it but instrumentation for these containers report no objectType.
+        It means that addRootObject method needs to accept objectType property as an argument.
+        Otherwise I would have had to create a proxy class with proper objectType.
+
+        * dom/WebCoreMemoryInstrumentation.cpp:
+        (WebCore::WebCoreMemoryInstrumentation::reportMemoryUsage):
+        (WebCore):
+        * dom/WebCoreMemoryInstrumentation.h:
+        (WebCoreMemoryInstrumentation):
+        (WebCore):
+        * inspector/InspectorMemoryAgent.cpp:
+        (WebCore::InspectorMemoryAgent::getProcessMemoryDistribution):
+
+2012-11-02  Michael Brüning  <michael.bruning@digia.com>
+
+        [Qt][WK2] ASSERT hit for every mouse click
+        https://bugs.webkit.org/show_bug.cgi?id=100607
+
+        Reviewed by Jocelyn Turcotte.
+
+        Changed the logic of absolutePathForRenderer to use the first highlight box as the mid box 
+        by uniting the two in case the mid box is empty. This allows the first box to be merged with
+        the last box should they intersect, and thereby prevents an ASSERT in addHighlightRect that is
+        triggered by two intersecting boxes being passed to addHighlightRect as separate ones.
+
+        Also, this patch removes some superfluous checks for LayoutRect::isEmpty, which is being checked
+        in LayoutRect::intersects already.
+
+        No new tests, but added manual test: ManualTests/tap-gesture-on-em-link-tap-highlight-assert.html
+
+        * page/GestureTapHighlighter.cpp:
+
+2012-11-02  Arpita Bahuguna  <arpitabahuguna@gmail.com>
+
+        Regression r130057: Improper preferred width calculation when an inline replaced object, wrapped in an inline flow, follows some text.
+        https://bugs.webkit.org/show_bug.cgi?id=99442
+
+        Reviewed by Levi Weintraub.
+
+        Extra width is displayed after an inline replaced object that follows some
+        text (not ending in a whitespace) within an inline-block. This is due to
+        the end width (endMin) of the text object being carried forward (via inlineMin)
+        and added onto the next line containing the inline replaced object.
+
+        This was caused as a regression to, or rather became apparent post the fix
+        http://trac.webkit.org/changeset/130057 which fixed the block's preferred
+        width when a renderInline with width contained an inline replaced object.
+
+        Test: fast/block/block-with-inline-replaced-child-following-text.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::computeInlinePreferredLogicalWidths):
+        Introduced another flag (shouldBreakLineAfterText) which is set when
+        our current Text line (object) does not end in a whitespace, thereby
+        implying that there could be more text following, for which the end width
+        needs to be carried forward onto the next line.
+
+        In case the following object instead turns out to be an Inline Replaced
+        object, we should terminate our previous line and reset this extra width.
+        This is now being handled by checking for the shouldBreakLineAfterText
+        flag while processing Inline Replaced objects.
+
+        Once set, shouldBreakLineAfterText shall be reset only if we get another
+        Text object that ends in a whitespace, signifying the termination of
+        that text line. For all other cases, we persist with this flag through
+        the block's inline contents.
+
+2012-11-02  Eugene Klyuchnikov  <eustas.bug@gmail.com>
+
+        Web Inspector: Console: remove obsolete ctrl-shift-m shortcut
+        https://bugs.webkit.org/show_bug.cgi?id=101036
+
+        Reviewed by Pavel Feldman.
+
+        Ctrl-shift-m on console dumps MemoryAgent.getDOMNodeCount
+        This functionality seems to be obsolete.
+
+        * inspector/front-end/ConsoleView.js: Removed shortcut and function.
+
+2012-11-02  Stephen Chenney  <schenney@chromium.org>
+
+        SVG classes cause layering violations in platform Font code
+        https://bugs.webkit.org/show_bug.cgi?id=98513
+
+        Reviewed by Eric Seidel.
+
+        Add a contained class to save and restore GlpyhPage state in FontFallbackList.
+        This allows us to remove the layering violation, and several methods, that
+        previously existed to support SVGTextRunRenderingContext.
+
+        No new tests because no change at all in functionality.
+
+        * platform/graphics/FontFallbackList.h:
+        (FontFallbackList):
+        (GlyphPagesStateSaver): New state save and restore class
+        (WebCore::FontFallbackList::GlyphPagesStateSaver::GlyphPagesStateSaver): Save GlyphPage state
+        (WebCore::FontFallbackList::GlyphPagesStateSaver::~GlyphPagesStateSaver): Restore GlyphPage state
+        * rendering/svg/SVGTextRunRenderingContext.cpp:
+        (WebCore::SVGTextRunRenderingContext::glyphDataForCharacter): Shift to usage of the new class.
+
+2012-11-02  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Web Inspector: Fix compilation errors
+        https://bugs.webkit.org/show_bug.cgi?id=101027
+
+        Reviewed by Yury Semikhatsky.
+
+        * inspector/InjectedScriptSource.js:
+        (.):
+        * inspector/front-end/NativeMemorySnapshotView.js:
+        (WebInspector.NativeSnapshotNode.prototype._createSizeCell):
+
+2012-11-02  Andreas Kling  <kling@webkit.org>
+
+        Only resolve attribute-derived style once per shared ElementAttributeData.
+        <http://webkit.org/b/100990>
+
+        Reviewed by Antti Koivisto.
+
+        Track the serialization of the "style" attribute, and the dirtiness of the presentation attribute style
+        on ElementAttributeData instead of in Node flags.
+
+        This allows us to avoid duplicate work for ElementAttributeData that are shared between multiple elements,
+        since the state is no longer per-Element.
+
+        I've left the presentation attribute cache in there for now, since it covers two additional cases:
+
+            - Elements with the same attributes in different order.
+            - Elements with the same presentation attributes, but with differing non-presentation attributes.
+
+        It's likely that we're not gaining much from it anymore, but that's a topic for another patch.
+
+        * dom/Node.h:
+        * dom/ElementAttributeData.h:
+        (WebCore::ElementAttributeData::presentationAttributeStyle):
+        (WebCore::ElementAttributeData::setPresentationAttributeStyle):
+        (WebCore::ElementAttributeData::styleAttributeIsDirty):
+        (WebCore::ElementAttributeData::setStyleAttributeIsDirty):
+        (WebCore::ElementAttributeData::presentationAttributeStyleIsDirty):
+        (WebCore::ElementAttributeData::setPresentationAttributeStyleIsDirty):
+        (ElementAttributeData):
+        (WebCore::ElementAttributeData::ElementAttributeData):
+        * dom/Element.cpp:
+        (WebCore::Element::getAttribute):
+        * dom/Element.h:
+        (WebCore::Element::styleAttributeIsDirty):
+        (WebCore::Element::updateInvalidAttributes):
+        * dom/StyledElement.cpp:
+        (WebCore::StyledElement::updateStyleAttribute):
+        (WebCore::StyledElement::attributeChanged):
+        (WebCore::StyledElement::styleAttributeChanged):
+        (WebCore::StyledElement::inlineStyleChanged):
+        * dom/StyledElement.h:
+        (WebCore::StyledElement::invalidateStyleAttribute):
+
+            Move the "attribute style dirty" and "style attribute valid" node flags to ElementAttributeData
+            and change them to both use dirty semantics.
+
+        * dom/ElementAttributeData.cpp:
+        (WebCore::ElementAttributeData::cloneDataFrom):
+
+            Share the presentation attribute style between cloned elements initially.
+
+        * dom/StyledElement.h:
+        (WebCore::StyledElement::presentationAttributeStyle):
+        * css/StyleResolver.cpp:
+        (WebCore::StyleResolver::sweepMatchedPropertiesCache):
+        (WebCore::StyleResolver::matchAllRules):
+        (WebCore::StyleResolver::canShareStyleWithElement):
+        * dom/ElementAttributeData.cpp:
+        (WebCore::MutableElementAttributeData::MutableElementAttributeData):
+        (WebCore::ElementAttributeData::reportMemoryUsage):
+        * inspector/InspectorCSSAgent.cpp:
+        (WebCore::InspectorCSSAgent::buildObjectForAttributesStyle):
+
+            Renamed StyledElement::attributeStyle() to presentationAttributeStyle(). The old name was too
+            easily confused with "style attribute".
+
+        * dom/StyledElement.cpp:
+        (WebCore::StyledElement::rebuildPresentationAttributeStyle):
+
+            Renamed from updateAttributeStyle().
+
+2012-11-01  Kent Tamura  <tkent@chromium.org>
+
+        Introduce ENABLE_DATE_AND_TIME_INPUT_TYPES, and clarify usage of other related flags
+        https://bugs.webkit.org/show_bug.cgi?id=101007
+
+        Reviewed by Kentaro Hara.
+
+        ChromeClient::openDateTimeChooser and Locale::formatDateTime are
+        necessary if one of date/time input types is enabled and even if
+        ENABLE_INPUT_MULTIPLE_FIELDS_UI is disabled. So they should be wrapped
+        with ENABLE(DATE_AND_TIME_INPUT_TYPES).
+
+        The following clases are used only for ChromeClient::openDateTimeChooser.
+        They should be wrapped with the same flag.
+          - class DateTimeChooser
+          - class DateTiemChooserClient
+
+        The following classes/functions are used for
+        Locale::formatDateTime. They should be wrapped with the same flag.
+          - Locale::dateFormat
+          - Locale::monthFormat
+          - Locale::timeFormat
+          - Locale::shortTimeFormat
+          - Locale::monthLabels
+          - Locale::shortMonthLabels
+          - Locale::standAloneMonthLabels
+          - Locale::shortStandAloneMonthLabels
+          - class DateTimeFormat
+
+        Also, we change the meaning of ENABLE_CALENDAR_PICKER. It meant
+         1) <input> supports calendar picker UI, and
+         2) WebCore/Resources/pagepopups/ is used for the calendar UI implementation.
+        Now ENABLE_CALENDAR_PICKER means only 2.
+
+        No new tests because of no behavior changes.
+
+        * html/BaseDateAndTimeInputType.h: This is necessary only if date/time
+        input types are enabled because this is a common super class of
+        date/time InputType classes.
+        * html/BaseDateAndTimeInputType.cpp: Ditto.
+        * html/BaseChooserOnlyDateAndTimeInputType.cpp: Ditto.
+        * html/BaseChooserOnlyDateAndTimeInputType.h: Ditto.
+
+        * page/ChromeClient.h: Change the flag for openDateTimeChooser, and add a comment.
+        * loader/EmptyClients.cpp: Follow the openDateTimeChooser flag change.
+        * loader/EmptyClients.h: Ditto.
+        * platform/DateTimeChooser.h:
+        This is needed only if ChromeClient::openDateTimeChooser is available.
+        * platform/DateTimeChooserClient.h: Ditto.
+
+        * platform/LocalizedStrings.h:
+        weekFormatInLDML is necessary if ENABLE(INPUT_TYPE_WEEK) regardless of
+        ENABLE(INPUT_MULTIPLE_FIELDS_UI).
+
+        * platform/text/PlatformLocale.h:
+        Change the condition for Locale::formatDateTime and the code used by
+        Locale::formatDateTime.
+        * platform/text/PlatformLocale.cpp:
+        (WebCore::Locale::formatDateTime):
+        This is necessary even if !ENABLE(INPUT_MULTIPLE_FIELDS_UI), to produce
+        localized representations of date/time values.
+        * platform/text/LocaleICU.cpp:
+        Change the condition for the code used by Locale::formatDateTime.
+        * platform/text/LocaleICU.h: Ditto.
+        * platform/text/LocaleNone.cpp: Ditto.
+        * platform/text/mac/LocaleMac.h: Ditto.
+        * platform/text/mac/LocaleMac.mm: Ditto.
+        * platform/text/win/LocaleWin.cpp: Ditto.
+        * platform/text/win/LocaleWin.h: Ditto.
+        * platform/text/DateTimeFormat.cpp: Ditto.
+        * platform/text/DateTimeFormat.h: Ditto.
+
+        * html/BaseMultipleFieldsDateAndTimeInputType.h:
+        Remove some #if-#endif for a picker indicator element because
+        ENABLE_CALENDAR_PICKER meaning is changed.
+        * html/BaseMultipleFieldsDateAndTimeInputType.cpp: Ditto.
+
+        * html/shadow/PickerIndicatorElement.cpp: CALENDAR_PICKER ->
+        INPUT_MULTIPLE_FIELDS_UI because ENABLE_CALENDAR_PICKER meaning is changed.
+        * html/shadow/PickerIndicatorElement.h: Ditto.
+        * rendering/RenderDetailsMarker.cpp: Ditto.
+        * rendering/RenderDetailsMarker.h: Ditto.
+        * rendering/RenderTheme.h: Ditto.
+        * rendering/RenderThemeChromiumCommon.cpp: Ditto.
+        * rendering/RenderThemeChromiumCommon.h: Ditto.
+        * rendering/RenderThemeChromiumMac.h: Ditto.
+        * rendering/RenderThemeChromiumSkia.h: Ditto.
+
+2012-11-02  Zeno Albisser  <zeno@webkit.org>
+
+        [Qt] Revert QCocoaNativeInterface workaround from r131720.
+        https://bugs.webkit.org/show_bug.cgi?id=100842
+
+        Reviewed by Simon Hausmann.
+
+        After updating Qt5 on the buildbots, the workaround
+        introduced in r131720 is not needed anymore.
+
+        * platform/graphics/surfaces/mac/GraphicsSurfaceMac.cpp:
+        (WebCore::GraphicsSurfacePrivate::GraphicsSurfacePrivate):
+
+2012-11-02  Kent Tamura  <tkent@chromium.org>
+
+        Add a common base class for date/time input types without inline editing behavior
+        https://bugs.webkit.org/show_bug.cgi?id=101031
+
+        Reviewed by Hajime Morita.
+
+        Add BaseChooserOnlyDateAndTimeInputType class, which will support
+        DateTimeChooserClient, and date/time input types inherit it if
+        !ENABLE(INPUT_MULTIPLE_FIELDS_UI).
+
+        No new tests. This doesn't change any behavior.
+
+        * CMakeLists.txt: Add BaseChooserOnlyDateAndTimeInputType.{cpp,h}.
+        * GNUmakefile.list.am: Ditto.
+        * Target.pri: Ditto.
+        * WebCore.gypi: Ditto.
+        * WebCore.xcodeproj/project.pbxproj: Ditto.
+        * html/BaseChooserOnlyDateAndTimeInputType.cpp: Added.
+        * html/BaseChooserOnlyDateAndTimeInputType.h: Added.
+
+        * html/DateInputType.h: Inherit BaseChooserOnlyDateAndTimeInputType if
+        !ENABLE(INPUT_MULTIPLE_FIELDS_UI).
+        * html/DateTimeInputType.h: Ditto.
+        * html/DateTimeLocalInputType.h: Ditto.
+        * html/MonthInputType.h: Ditto.
+        * html/TimeInputType.h: Ditto.
+        * html/WeekInputType.h: Ditto.
+
+2012-11-02  Peter Wang  <peter.wang@torchmobile.com.cn>
+
+        Web Inspector: [JSC] implement WorkerScriptDebugServer
+        https://bugs.webkit.org/show_bug.cgi?id=99801
+
+        Reviewed by Yury Semikhatsky.
+
+        To implement Worker Inspector for JSC.
+        The virtual function "runEventLoopWhilePaused" is defined, since there are different ways to block
+        the JS running in worker-context and normal page-context.
+        The function "isContentScript" now is virtual because the original invoked functions are useless
+        and cause problem in worker-context.
+        In function "WebCore::WorkerScriptController::attachDebugger", we invoke "initScriptIfNeeded" to
+        ensure the JSGloblalObject exist in the case of attaching Debugger before executing the worker
+        JS code (Pause on start).
+
+        No new test case.
+
+        * bindings/js/PageScriptDebugServer.cpp:
+        (WebCore::PageScriptDebugServer::runEventLoopWhilePaused):
+        (WebCore):
+        * bindings/js/PageScriptDebugServer.h:
+        (PageScriptDebugServer):
+        * bindings/js/ScriptDebugServer.cpp:
+        (WebCore::ScriptDebugServer::isContentScript):
+        (WebCore::ScriptDebugServer::pauseIfNeeded):
+        * bindings/js/ScriptDebugServer.h:
+        (JSC):
+        (ScriptDebugServer):
+        * bindings/js/WorkerScriptController.cpp:
+        (WebCore::WorkerScriptController::attachDebugger):
+        (WebCore):
+        (WebCore::WorkerScriptController::detachDebugger):
+        * bindings/js/WorkerScriptController.h:
+        (WorkerScriptController):
+        * bindings/js/WorkerScriptDebugServer.cpp:
+        (WebCore::WorkerScriptDebugServer::WorkerScriptDebugServer):
+        (WebCore):
+        (WebCore::WorkerScriptDebugServer::addListener):
+        (WebCore::WorkerScriptDebugServer::recompileAllJSFunctions):
+        (WebCore::WorkerScriptDebugServer::removeListener):
+        (WebCore::WorkerScriptDebugServer::runEventLoopWhilePaused):
+        * bindings/js/WorkerScriptDebugServer.h:
+        (WorkerScriptDebugServer):
+        (WebCore::WorkerScriptDebugServer::getListenersForGlobalObject):
+        (WebCore::WorkerScriptDebugServer::isContentScript):
+
+2012-11-02  KyungTae Kim  <ktf.kim@samsung.com>
+
+        Compilation warning in Node.cpp when USERSELECT_ALL is disabled
+        https://bugs.webkit.org/show_bug.cgi?id=101025
+
+        Reviewed by Ryosuke Niwa.
+
+        The parameter 'treatment' is not used when USERSELECT_ALL is disabled. 
+
+        * dom/Node.cpp:
+        (WebCore::Node::rendererIsEditable):
+
+2012-11-01  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Web Inspector: Middle click closes an editor and pastes selection into current editor on Linux
+        https://bugs.webkit.org/show_bug.cgi?id=100743
+
+        Reviewed by Alexander Pavlov.
+
+        Editor now consumes all middle mouse button mouse ups except for the ones in the main panel.
+        TabbedPane now consumes all middle mouse button mouse ups as well.
+        Navigator view does not pass focus anymore if element was selected with middle mouse button.
+
+        * inspector/front-end/DefaultTextEditor.js:
+        (.preventDefaultOnMouseUp):
+        (.consumeMouseUp):
+        * inspector/front-end/NavigatorView.js:
+        (WebInspector.NavigatorSourceTreeElement.prototype.ondblclick):
+        * inspector/front-end/TabbedPane.js:
+        (WebInspector.TabbedPane):
+        (WebInspector.TabbedPane.prototype.onMouseUp):
+        (WebInspector.TabbedPane.prototype.onMouseClick):
+
+2012-11-01  Ilya Tikhonovsky  <loislo@chromium.org>
+
+        Web Inspector: NMI instrument ShadowRoot. It gives us ~400k on plus.google.com
+        https://bugs.webkit.org/show_bug.cgi?id=100866
+
+        Reviewed by Yury Semikhatsky.
+
+        Plain vanilla memory instrumentation code for HTMLInputElement which has a ElementShadow.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * Target.pri:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * dom/DocumentOrderedMap.cpp:
+        (WebCore::DocumentOrderedMap::reportMemoryUsage):
+        (WebCore):
+        * dom/DocumentOrderedMap.h:
+        (DocumentOrderedMap):
+        * dom/Element.cpp:
+        (WebCore::Element::reportMemoryUsage):
+        (WebCore):
+        * dom/Element.h:
+        * dom/ElementRareData.cpp: Added.
+        (WebCore):
+        (WebCore::ElementRareData::reportMemoryUsage):
+        * dom/ElementRareData.h:
+        (ElementRareData):
+        * dom/ElementShadow.cpp:
+        (WebCore::ElementShadow::reportMemoryUsage):
+        (WebCore):
+        * dom/ElementShadow.h:
+        (ElementShadow):
+        * dom/Node.cpp:
+        (WebCore::Node::reportMemoryUsage):
+        * dom/NodeRareData.cpp: Added.
+        (WebCore):
+        (WebCore::NodeListsNodeData::reportMemoryUsage):
+        (WebCore::NodeRareData::reportMemoryUsage):
+        * dom/NodeRareData.h:
+        (NodeListsNodeData):
+        (NodeRareData):
+        * dom/ShadowRoot.cpp:
+        (WebCore):
+        (WebCore::ShadowRoot::reportMemoryUsage):
+        * dom/ShadowRoot.h:
+        (ShadowRoot):
+        * dom/TreeScope.cpp:
+        (WebCore::TreeScope::reportMemoryUsage):
+        (WebCore):
+        * dom/TreeScope.h:
+        (TreeScope):
+        * html/HTMLFormControlElement.cpp:
+        (WebCore::HTMLFormControlElement::reportMemoryUsage):
+        (WebCore):
+        * html/HTMLFormControlElement.h:
+        (HTMLFormControlElement):
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::reportMemoryUsage):
+        (WebCore):
+        * html/HTMLInputElement.h:
+        (HTMLInputElement):
+        * html/HTMLTextFormControlElement.cpp:
+        (WebCore::HTMLTextFormControlElement::reportMemoryUsage):
+        (WebCore):
+        * html/HTMLTextFormControlElement.h:
+        (HTMLTextFormControlElement):
+
+2012-11-02  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Web Inspector: Cookie info in Network Resources Cookies tab shows "Invalid Date"
+        https://bugs.webkit.org/show_bug.cgi?id=97471
+
+        Reviewed by Pavel Feldman.
+
+        This patch is partly based on patch by Otto Derek Cheung <otcheung@rim.com>.
+        Refactored CookieParser so that all cookies in front-end were WebInspector.Cookie object.
+        Cookie table can now show Max-Age as well as Expires attribute of a cookie.
+        Fixed expiresDate calculation.
+        Removed getters from CookieParser for better compilation.
+
+        * English.lproj/localizedStrings.js:
+        * inspector/front-end/AuditRules.js:
+        (WebInspector.AuditRules.CookieRuleBase.prototype.mapResourceCookies):
+        (WebInspector.AuditRules.CookieSizeRule.prototype._average):
+        (WebInspector.AuditRules.CookieSizeRule.prototype._max):
+        (WebInspector.AuditRules.StaticCookielessRule.prototype._collectorCallback):
+        * inspector/front-end/CookieItemsView.js:
+        (WebInspector.CookieItemsView.prototype._filterCookiesForDomain):
+        * inspector/front-end/CookieParser.js:
+        (WebInspector.CookieParser.prototype.cookies):
+        (WebInspector.CookieParser.prototype._flushCookie):
+        (WebInspector.CookieParser.prototype._addCookie):
+        (WebInspector.Cookie.prototype.httpOnly):
+        (WebInspector.Cookie.prototype.secure):
+        (WebInspector.Cookie.prototype.session):
+        (WebInspector.Cookie.prototype.path):
+        (WebInspector.Cookie.prototype.domain):
+        (WebInspector.Cookie.prototype.expires):
+        (WebInspector.Cookie.prototype.maxAge):
+        (WebInspector.Cookie.prototype.size):
+        (WebInspector.Cookie.prototype.setSize):
+        (WebInspector.Cookie.prototype.expiresDate):
+        (WebInspector.Cookie.prototype.attributes):
+        (WebInspector.Cookies.getCookiesAsync):
+        (WebInspector.Cookies.buildCookiesFromString):
+        (WebInspector.Cookies.buildCookieProtocolObject):
+        (WebInspector.Cookies.cookieMatchesResourceURL):
+        (WebInspector.Cookies.cookieDomainMatchesResourceDomain):
+        * inspector/front-end/CookiesTable.js:
+        (WebInspector.CookiesTable):
+        (WebInspector.CookiesTable.prototype._totalSize):
+        (WebInspector.CookiesTable.prototype._sortCookies.expiresCompare):
+        (WebInspector.CookiesTable.prototype._sortCookies):
+        (WebInspector.CookiesTable.prototype._createGridNode):
+        * inspector/front-end/HAREntry.js:
+        (WebInspector.HAREntry.prototype._buildCookie):
+
+2012-11-01  Yury Semikhatsky  <yurys@chromium.org>
+
+        Memory instrumentation: do not call checkCountedObject with wrong pointers
+        https://bugs.webkit.org/show_bug.cgi?id=100958
+
+        Reviewed by Alexander Pavlov.
+
+        Removed redundant call to checkCountedObject.
+
+        * inspector/MemoryInstrumentationImpl.cpp:
+        (WebCore::MemoryInstrumentationClientImpl::countObjectSize):
+
+2012-11-02  Peter Wang  <peter.wang@torchmobile.com.cn>
+
+        Web Inspector: a small defect in "WorkersSidebarPanel.js"
+        https://bugs.webkit.org/show_bug.cgi?id=101022
+
+        Reviewed by Yury Semikhatsky.
+
+        In "autoattachToWorkersClicked", the "event.target.checked" doesn't alwyas valid, since the
+        "event.target" might be a label.
+
+        The problem just causes an error report, doesn't effect function, so no new test case.
+
+        * inspector/front-end/WorkersSidebarPane.js:
+        (WebInspector.WorkersSidebarPane.prototype._autoattachToWorkersClicked):
+
+2012-11-01  Shinya Kawanaka  <shinyak@chromium.org>
+
+        [Shadow] Element should have getter and setter of attribute 'pseudo'
+        https://bugs.webkit.org/show_bug.cgi?id=100831
+
+        Reviewed by Hajime Morita.
+
+        We expose 'pseudo' attribute in Element. When nothing is assigned to 'pseudo', it should return null.
+
+        Test: fast/dom/shadow/pseudo-attribute.html
+
+        * dom/Element.cpp:
+        (WebCore::Element::pseudo):
+        (WebCore):
+        (WebCore::Element::setPseudo):
+        * dom/Element.h:
+        (Element):
+        * dom/Element.idl:
+        * html/HTMLAttributeNames.in:
+
+2012-11-01  Roger Fong  <roger_fong@apple.com>
+
+        Build fix. http://trac.webkit.org/changeset/133252 broke the Windows build.
+        https://bugs.webkit.org/show_bug.cgi?id=101008
+
+        Reviewed by fischman@chromium.org.
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::clearMediaPlayer):
+        * html/HTMLMediaElement.h:
+        (HTMLMediaElement):
+
+2012-11-01  Stephen White  <senorblanco@chromium.org>
+
+        Unreviewed, rolling out r133244.
+        http://trac.webkit.org/changeset/133244
+        https://bugs.webkit.org/show_bug.cgi?id=100973
+
+        Broke Chromium Mac (clang) builds.
+
+        * bindings/v8/DOMDataStore.cpp:
+        (WebCore::DOMDataStore::DOMDataStore):
+        * bindings/v8/IntrusiveDOMWrapperMap.h:
+        (WebCore::DOMNodeWrapperMap::weakCallback):
+
+2012-11-01  Ami Fischman  <fischman@chromium.org>
+
+        HTMLMediaPlayer should free m_player when src is set/changed
+        https://bugs.webkit.org/show_bug.cgi?id=99647
+
+        Reviewed by Eric Carlson.
+
+        New ManualTest added; manual since leaking media players doesn't have layoutTestController-visible effects.
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::parseAttribute): clearMediaPlayer() when src is set/changed
+        (WebCore::HTMLMediaElement::userCancelledLoad): use new clearMediaPlayer() helper
+        (WebCore::HTMLMediaElement::clearMediaPlayer): clear m_player and associated timers/flags
+        (WebCore):
+        (WebCore::HTMLMediaElement::createMediaPlayer): whitespace-only change
+        * html/HTMLMediaElement.h: new method: createMediaPlayer().
+        (HTMLMediaElement):
+
+2012-11-01  Tom Sepez  <tsepez@chromium.org>
+
+        XSS blocker false positive when page contains <iframe src="">
+        https://bugs.webkit.org/show_bug.cgi?id=93416
+
+        Reviewed by Adam Barth.
+
+        Treat src="" and src="about:blank" as safe resources even if they appear
+        in the query parameters.
+
+        Tests: http/tests/security/xssAuditor/iframe-injection-allowed-2.html
+               http/tests/security/xssAuditor/iframe-injection-allowed-3.html
+               http/tests/security/xssAuditor/iframe-injection-allowed.html
+
+        * html/parser/XSSAuditor.cpp:
+        (WebCore::XSSAuditor::isLikelySafeResource):
+
+2012-11-01  Tien-Ren Chen  <trchen@chromium.org>
+
+        Fix assertion failure in RenderGeometryMap::absoluteRect when frame scale != 1.0
+        https://bugs.webkit.org/show_bug.cgi?id=100912
+
+        Reviewed by Simon Fraser.
+
+        Frame scale will add transformation to RenderView, so fixed position doesn't
+        get propagated up to the viewport by RenderGeometryMap. This is handled
+        correctly in RenderView::mapLocalToContainer, causing the assertion to fail.
+        This patch corrects RenderGeometryMap::mapToAbsolute to handle the RenderView
+        transformation case.
+
+        A layout test is added to catch this issue. The test will crash debug build
+        without this patch.
+
+        Test: compositing/geometry/fixed-position-composited-page-scale-scroll.html
+
+        * rendering/RenderGeometryMap.cpp:
+        (WebCore::RenderGeometryMap::mapToAbsolute):
+
+2012-11-01  Adam Barth  <abarth@webkit.org>
+
+        [V8] Generalize NodeWrapperMap to be able to handle other sorts of keys
+        https://bugs.webkit.org/show_bug.cgi?id=100973
+
+        Reviewed by Kentaro Hara.
+
+        This is the first step towards using intrusive DOM wrapper maps more
+        widely in WebCore (see
+        http://lists.webkit.org/pipermail/webkit-dev/2012-November/022686.html
+        for more context).
+
+        * bindings/v8/DOMDataStore.cpp:
+        (WebCore::DOMDataStore::DOMDataStore):
+        * bindings/v8/IntrusiveDOMWrapperMap.h:
+        (WebCore):
+        (WebCore::IntrusiveDOMWrapperMap::weakCallback):
+
+2012-11-01  Alexandru Chiculita  <achicu@adobe.com>
+
+        [CSS Shaders] CustomFilterOperation should be converted to ValidatedCustomFilterOperation before using it
+        https://bugs.webkit.org/show_bug.cgi?id=100533
+
+        Reviewed by Dean Jackson.
+
+        Added the code that converts a CustomFilterOperation to a ValidatedCustomFilterOperation.
+        Both the software path and the composited one will use this operation instead. There will be
+        no need to check the shader in platform code anymore.
+
+        No new tests, already covered by existing custom filter tests.
+
+        * platform/graphics/filters/ValidatedCustomFilterOperation.cpp:
+        (WebCore::ValidatedCustomFilterOperation::ValidatedCustomFilterOperation):
+        * platform/graphics/filters/ValidatedCustomFilterOperation.h:
+        (WebCore):
+        (WebCore::ValidatedCustomFilterOperation::create):
+        (ValidatedCustomFilterOperation):
+        (WebCore::ValidatedCustomFilterOperation::validatedProgram):
+        (WebCore::ValidatedCustomFilterOperation::parameters):
+        (WebCore::ValidatedCustomFilterOperation::meshRows):
+        (WebCore::ValidatedCustomFilterOperation::meshColumns):
+        (WebCore::ValidatedCustomFilterOperation::meshType):
+        (WebCore::ValidatedCustomFilterOperation::operator==):
+        * rendering/FilterEffectRenderer.cpp:
+        (WebCore::createCustomFilterEffect):
+        (WebCore::FilterEffectRenderer::build):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::ensureBacking):
+        (WebCore::RenderLayer::clearBacking):
+        (WebCore::RenderLayer::styleChanged): updateOrRemoveFilterClients needs to be called before the composited
+        layer is updated. Otherwise the composited layer will never see a loaded filter in the first call.
+        (WebCore):
+        (WebCore::RenderLayer::isCSSCustomFilterEnabled):
+        (WebCore::RenderLayer::computeFilterOperations):
+        (WebCore::RenderLayer::updateOrRemoveFilterClients): Split updateOrRemoveFilterEffect into 2 functions.
+        This one is supposed to add the clients needed to load network resources.
+        (WebCore::RenderLayer::updateOrRemoveFilterEffectRenderer): Figures out if a software fallback is needed 
+        and creates a FilterEffectRenderer.
+        * rendering/RenderLayer.h:
+        (RenderLayer):
+
+2012-11-01  Max Vujovic  <mvujovic@adobe.com>
+
+        [CSS Shaders] Get rid of internal tex coord attribute
+        https://bugs.webkit.org/show_bug.cgi?id=94358
+
+        Reviewed by Dean Jackson.
+
+        Remove the internal css_a_texCoord attribute that WebKit added to shaders in order to
+        sample the element texture by texture coordinate.
+
+        Now, the WebKit-added sampling code can leverage a_texCoord if the author defined it, or
+        WebKit can add its own a_texCoord definition to the author's shader.
+
+        Note that vertex attributes are read-only in GLSL. Also, note that we already reject the
+        shader if the author did not define a_texCoord with the correct type. Essentially, if
+        a_texCoord exists in the author's validated shader, we are guaranteed that it's the correct
+        type and that its value is unmodified.
+
+        Test: css3/filters/custom/custom-filter-a-tex-coord-optional.html
+
+        * platform/graphics/filters/CustomFilterCompiledProgram.cpp:
+        (WebCore::CustomFilterCompiledProgram::CustomFilterCompiledProgram):
+            Remove the references to m_internalTexCoordAttribLocation.
+        (WebCore::CustomFilterCompiledProgram::initializeParameterLocations): Ditto.
+        * platform/graphics/filters/CustomFilterCompiledProgram.h: Ditto.
+        * platform/graphics/filters/CustomFilterRenderer.cpp:
+        (WebCore::CustomFilterRenderer::bindProgramAndBuffers): Ditto.
+        (WebCore::CustomFilterRenderer::unbindVertexAttributes): Ditto.
+        * platform/graphics/filters/CustomFilterValidatedProgram.cpp:
+        (WebCore::CustomFilterValidatedProgram::CustomFilterValidatedProgram):
+            Pass the set of symbols found in the author's shaders to the rewriteMixVertexShader
+            method.
+        (WebCore::CustomFilterValidatedProgram::rewriteMixVertexShader):
+            If the author didn't define a_texCoord, add it to the end of the author's vertex 
+            shader, but before the shader's new main function. As before, the new main function
+            will pass the texture coordinate to the fragment shader via the css_v_texCoord varying.
+        * platform/graphics/filters/CustomFilterValidatedProgram.h:
+        (WebCore):
+            Add a forward declaration for ANGLEShaderSymbol.
+        (CustomFilterValidatedProgram):
+            Update the method prototype for rewriteMixVertexShader.
+
+2012-11-01  Chris Rogers  <crogers@google.com>
+
+        Ensure that AudioNode deletion is synchronized with a stable state of the rendering graph
+        https://bugs.webkit.org/show_bug.cgi?id=100994
+
+        Reviewed by Kenneth Russell.
+
+        In some rare cases it has been observed that nodes are getting deleted in the main thread
+        during an audio rendering quantum where the dirty inputs and outputs have not yet been cleaned
+        via calls to handleDirtyAudioSummingJunctions() and handleDirtyAudioNodeOutputs().
+        This was possible because nodes marked for deletion with markForDeletion() could be picked
+        up in a subsequent call to deleteMarkedNodes() before the render quantum has finished and
+        handlePostRenderTasks() has had a chance to reconcile these marked nodes and clean the dirty state.
+        The solution is to manage the marked nodes in a separate vector which only gets copied to another
+        vector truly eligible for deletion which is synchronized in handlePostRenderTasks().
+
+        * Modules/webaudio/AudioContext.cpp:
+        (WebCore::AudioContext::markForDeletion):
+        (WebCore::AudioContext::scheduleNodeDeletion):
+        (WebCore::AudioContext::deleteMarkedNodes):
+        * Modules/webaudio/AudioContext.h:
+        (AudioContext):
+
+2012-11-01  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Build fix after r133224 as suggested by Enrica.
+        Confirmed the test failures go away on Chromium Mac locally.
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::updateSelectionForMouseDrag):
+
+2012-11-01  Alexey Proskuryakov  <ap@apple.com>
+
+        Rename HAVE(NETWORK_CFDATA_ARRAY_CALLBACK) to USE(NETWORK_CFDATA_ARRAY_CALLBACK)
+
+        Rubber-stamped by Joe Pecoraro.
+
+        All CFNetwork based platforms have this now, but not all use it at the moment.
+
+        * loader/ResourceLoader.h:
+        * loader/SubresourceLoader.h:
+        * loader/cf/SubresourceLoaderCF.cpp:
+        * loader/mac/ResourceLoaderMac.mm:
+        * platform/SharedBuffer.cpp:
+        (WebCore::SharedBuffer::clear):
+        (WebCore::SharedBuffer::buffer):
+        (WebCore::SharedBuffer::getSomeData):
+        * platform/SharedBuffer.h:
+        * platform/cf/SharedBufferCF.cpp:
+        * platform/network/ResourceHandle.h:
+        * platform/network/ResourceHandleClient.h:
+        (ResourceHandleClient):
+        * platform/network/cf/ResourceHandleCFNet.cpp:
+        (WebCore::willCacheResponse):
+        (WebCore::ResourceHandle::createCFURLConnection):
+        * platform/network/mac/ResourceHandleMac.mm:
+
+2012-11-01  Alexey Proskuryakov  <ap@apple.com>
+
+        Fix HAVE(NETWORK_CFDATA_ARRAY_CALLBACK) build
+        https://bugs.webkit.org/show_bug.cgi?id=100979
+
+        Reviewed by Joseph Pecoraro.
+
+        * loader/ResourceBuffer.cpp: (WebCore::ResourceBuffer::append):
+        * loader/ResourceBuffer.h:
+        Added a version of append() that takes CFDataRef, passing it directly to SharedBuffer.
+
+        * loader/mac/ResourceLoaderMac.mm: (WebCore::ResourceLoader::didReceiveDataArray):
+        InspectorInstrumentation now takes a length. Unfortunately, we don't have encodedLength
+        here, meaning that the results will likely be incorrect.
+
+        * platform/network/cf/ResourceHandleCFNet.cpp:
+        (WebCore::willCacheResponse): Removed a version that needlessly used deprecated API.
+        (WebCore::ResourceHandle::createCFURLConnection): This code assumed that
+        HAVE(NETWORK_CFDATA_ARRAY_CALLBACK) and USE(PROTECTION_SPACE_AUTH_CALLBACK) always
+        come together. Changed to check for these separately.
+
+2012-11-01  Rob Buis  <rbuis@rim.com>
+
+        [BlackBerry] Add more form validation strings
+        https://bugs.webkit.org/show_bug.cgi?id=100978
+
+        Reviewed by Yong Li.
+
+        PR 210072
+
+        Implement these two methods properly.
+
+        * platform/blackberry/LocalizedStringsBlackBerry.cpp:
+        (WebCore::validationMessageRangeUnderflowText):
+        (WebCore::validationMessageRangeOverflowText):
+
+2012-11-01  Alexandru Chiculita  <achicu@adobe.com>
+
+        [CSS Shaders] Move MeshBoxType out of CustomFilterOperation
+        https://bugs.webkit.org/show_bug.cgi?id=100782
+
+        Reviewed by Dean Jackson.
+
+        Moved CustomFilter::MeshBoxType enum to the CustomFilterConstants.h file and renamed it to CustomFilterMeshBoxType. 
+        This way we can reuse it without including the CustomFilterOperation file.
+
+        No new tests, just refactoring code.
+
+        * css/CSSPrimitiveValueMappings.h:
+        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
+        (WebCore::CSSPrimitiveValue::operator CustomFilterMeshBoxType):
+        * css/StyleResolver.cpp:
+        (WebCore::StyleResolver::createCustomFilterOperation):
+        * platform/graphics/filters/CustomFilterArrayParameter.h: Adding AnimationUtilities.h for WebCore::blend, looks like
+        CustomFilterOperation already included AnimationsUtilities.h indirectly.
+        * platform/graphics/filters/CustomFilterConstants.h: Added CustomFilterMeshBoxType.
+        * platform/graphics/filters/CustomFilterNumberParameter.h:
+        * platform/graphics/filters/CustomFilterOperation.cpp:
+        (WebCore::CustomFilterOperation::CustomFilterOperation):
+        * platform/graphics/filters/CustomFilterOperation.h:
+        (WebCore::CustomFilterOperation::create):
+        (WebCore::CustomFilterOperation::meshBoxType):
+        (CustomFilterOperation):
+        * platform/graphics/filters/CustomFilterRenderer.cpp:
+        (WebCore::CustomFilterRenderer::create):
+        (WebCore::CustomFilterRenderer::CustomFilterRenderer):
+        * platform/graphics/filters/CustomFilterRenderer.h: Also removed the need to include CustomFilterOperation.h. Some other
+        headers were needed to replace the files that were automatically incldued because of that file.
+        (WebCore):
+        (CustomFilterRenderer):
+        * platform/graphics/filters/FECustomFilter.cpp:
+        (WebCore::FECustomFilter::FECustomFilter):
+        (WebCore::FECustomFilter::create):
+        * platform/graphics/filters/FECustomFilter.h:
+        (FECustomFilter):
+
+2012-11-01  Enrica Casucci  <enrica@apple.com>
+
+        Part2 of: Extend -webkit-user-select with new value "all"
+        <rdar://problem/10161404>
+        https://bugs.webkit.org/show_bug.cgi?id=91912
+
+        Reviewed by Ryosuke Niwa.
+
+        The new value "all" for -webkit-user-select property gives content none-or-all selection option.
+        The patch was originally prepared by Alice Cheng but the approach has been changed.
+        The idea is to treat these elements like non editable, meaning that we should skip over them entirely
+        when moving the cursor and a deletion should delete the element and all its descentants at once.
+        The key change is in Node::rendererIsEditable where we now return false if the element style is
+        userSelect: all. The other change is in the way we create the selection on mouse click and dragging
+        over the element. In both cases we force the selection to extend over the entire element with
+        the user-select: all attribute.
+        This is currently enabled only for the Mac port.
+
+        Test: editing/selection/user-select-all-selection.html
+
+        * dom/Node.cpp: Added a parameter to isContentEditable to behave differently
+        when called from JavaScript. Internally isContentEditable returns false on
+        nodes with user-select: all style.
+        (WebCore::Node::isContentEditable):
+        (WebCore::Node::isContentRichlyEditable):
+        (WebCore::Node::rendererIsEditable):
+        (WebCore::Node::shouldUseInputMethod):
+        (WebCore::Node::willRespondToMouseClickEvents):
+        * dom/Node.h:
+        (WebCore::Node::rendererIsEditable):
+        (WebCore::Node::rendererIsRichlyEditable):
+        * dom/Position.cpp:
+        (WebCore::Position::nodeIsUserSelectAll): Added.
+        (WebCore::Position::rootUserSelectAllForNode): Added.
+        * dom/Position.h: Added static functions described above.
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::ApplyStyleCommand::removeInlineStyleFromElement): Added parameter to
+        isContentEditable() call.
+        (WebCore::ApplyStyleCommand::surroundNodeRangeWithElement): Added parameter to
+        isContentEditable() call.
+        * editing/DeleteFromTextNodeCommand.cpp:
+        (WebCore::DeleteFromTextNodeCommand::doApply): Added parameter to
+        isContentEditable() call.
+        * editing/FrameSelection.cpp:
+        (WebCore::adjustForwardPositionForUserSelectAll): New helper function.
+        (WebCore::adjustBackwardPositionForUserSelectAll): New helper function.
+        (WebCore::FrameSelection::modifyExtendingRight):
+        (WebCore::FrameSelection::modifyExtendingForward):
+        (WebCore::FrameSelection::modifyExtendingLeft):
+        (WebCore::FrameSelection::modifyExtendingBackward):
+        (WebCore::FrameSelection::modify):
+        (WebCore::CaretBase::invalidateCaretRect): Added parameter to
+        isContentEditable() call.
+        * editing/InsertNodeBeforeCommand.cpp:
+        (WebCore::InsertNodeBeforeCommand::doApply): Ditto.
+        (WebCore::InsertNodeBeforeCommand::doUnapply): Ditto.
+        * editing/RemoveNodeCommand.cpp:
+        (WebCore::RemoveNodeCommand::doApply): Ditto.
+        * editing/visible_units.cpp:
+        (WebCore::startOfParagraph): We should not consider a paragraph break and element
+        with user-select: all style, like we do at the border of editability.
+        (WebCore::endOfParagraph): Ditto.
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::updateSelectionForMouseDownDispatchingSelectStart): Create a selection
+        around the element whose style is user-select: all.
+        (WebCore::EventHandler::updateSelectionForMouseDrag): Ditto.
+        * rendering/RootInlineBox.cpp:
+        (WebCore::RootInlineBox::selectionState): Fixed a bug uncovered during this work.
+        If the selection starts in one of the leaf boxes and after we encounter one with SelectionNone,
+        we should return the selection state as SelectionBoth, assuming we went past the end selection.
+        This avoids doing an incorrect gap filling for the selection highlighting.
+
+2012-11-01  Alec Flett  <alecflett@chromium.org>
+
+        IndexedDB: Fix Windows build by re-adding a #include
+        https://bugs.webkit.org/show_bug.cgi?id=100986
+
+        Reviewed by Stephen White.
+
+        Fix #include that broke windows.
+
+        * Modules/indexeddb/IDBCallbacks.h:
+
+2012-11-01  David Barton  <dbarton@mathscribe.com>
+
+        REGRESSION (r128837): mathml/presentation/subsup.xhtml became flaky
+        https://bugs.webkit.org/show_bug.cgi?id=97390
+
+        Reviewed by Ojan Vafai.
+
+        In a RenderMathMLSubSup, we need to set the base's wrapper's style so that baseHeight
+        in layout() will be the base's true height, without any flexbox stretching.
+
+        Tested by existing tests.
+
+        * rendering/mathml/RenderMathMLSubSup.cpp:
+        (WebCore::RenderMathMLSubSup::fixAnonymousStyles):
+        (WebCore::RenderMathMLSubSup::addChild):
+        (WebCore::RenderMathMLSubSup::styleDidChange):
+        * rendering/mathml/RenderMathMLSubSup.h:
+        (RenderMathMLSubSup):
+
+2012-11-01  Antti Koivisto  <antti@apple.com>
+
+        REGRESSION (r132941): attribute modification 10% performance regression
+        https://bugs.webkit.org/show_bug.cgi?id=100873
+
+        Reviewed by Ojan Vafai.
+
+        Don't do the class change finding by mutating SpaceSplitString. It is slow. Instead use a bit vector
+        to mark the unchanged classes
+
+        * css/StyleResolver.cpp:
+        (WebCore):
+        * css/StyleResolver.h:
+        (WebCore::StyleResolver::hasSelectorForAttribute):
+        (WebCore):
+        (WebCore::StyleResolver::hasSelectorForClass):
+        (WebCore::StyleResolver::hasSelectorForId):
+        
+            Inlined these and moved value validity testing to clients.
+
+        * dom/Element.cpp:
+        (WebCore::checkNeedsStyleInvalidationForIdChange):
+        (WebCore):
+        (WebCore::Element::attributeChanged):
+    
+            Clean up id testing too.
+
+        (WebCore::checkNeedsStyleInvalidationForClassChange):
+        
+            Use bit vector for marking seen values. Avoids allocations and reffing.
+
+        (WebCore::Element::classAttributeChanged):
+        
+            Don't test if style is already invalid.
+
+2012-11-01  Ryosuke Niwa  <rniwa@webkit.org>
+
+        [Mac] Crash in Range::editingStartPosition
+        https://bugs.webkit.org/show_bug.cgi?id=100972
+
+        Reviewed by Enrica Casucci.
+
+        Add a missing null pointer check. toNormalizedRange() can return null here, in which case the call to
+        pastLastNode() will crash.
+
+        No new tests since determining the exact condition under which we go through the said code path and
+        toNormalRange returns null is hard.
+
+        * editing/mac/EditorMac.mm:
+        (WebCore::Editor::fontForSelection):
+
+2012-11-01  Beth Dakin  <bdakin@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=100917
+        There should be a way to dump the scrolling tree from the layout tests
+
+        Reviewed by Simon Fraser.
+
+        New Internals call to dump the scrolling state tree as text. Calls through to the 
+        ScrollingCoordinator.
+        * testing/Internals.cpp:
+        (WebCore::Internals::scrollingStateTreeAsText):
+        (WebCore):
+        * testing/Internals.h:
+        * testing/Internals.idl:
+        * WebCore.exp.in:
+        * page/Page.cpp:
+        (WebCore::Page::scrollingStateTreeAsText):
+        (WebCore):
+        * page/Page.h:
+        (Page):
+
+        ScrollingCoordinator tells the rootStateNode to dump the tree as text.
+        * page/scrolling/mac/ScrollingCoordinatorMac.h:
+        (ScrollingCoordinatorMac):
+        * page/scrolling/mac/ScrollingCoordinatorMac.mm:
+        (WebCore::ScrollingCoordinatorMac::scrollingStateTreeAsText):
+        (WebCore):
+        * page/scrolling/ScrollingCoordinator.cpp:
+        (WebCore::ScrollingCoordinator::scrollingStateTreeAsText):
+        (WebCore):
+        * page/scrolling/ScrollingCoordinator.h:
+        (ScrollingCoordinator):
+
+        dumpNode() dumps generic stuff for each node, and dumpProperties will dump the 
+        properties that are specific to different types of nodes.
+        * page/scrolling/ScrollingStateNode.cpp:
+        (WebCore::ScrollingStateNode::writeIndent):
+        (WebCore):
+        (WebCore::ScrollingStateNode::dumpNode):
+        (WebCore::ScrollingStateNode::scrollingStateTreeAsText):
+        * page/scrolling/ScrollingStateNode.h:
+        (WebCore):
+        (ScrollingStateNode):
+        * page/scrolling/ScrollingStateScrollingNode.cpp:
+        (WebCore::ScrollingStateScrollingNode::dumpProperties):
+        (WebCore):
+        * page/scrolling/ScrollingStateScrollingNode.h:
+        (ScrollingStateScrollingNode):
+
+2012-11-01  Kenneth Russell  <kbr@google.com>
+
+        Add RGB to supported destination formats of ImageBuffer::copyToPlatformTexture
+        https://bugs.webkit.org/show_bug.cgi?id=100971
+
+        Reviewed by Stephen White.
+
+        The ImageBuffer::copyToPlatformTexture restriction added in
+        r132965 was too restrictive. Allow RGB textures to prevent
+        performance regressions.
+
+        * html/canvas/WebGLRenderingContext.cpp:
+        (WebCore):
+        (WebCore::WebGLRenderingContext::texImage2D):
+        * platform/graphics/ImageBuffer.h:
+        (ImageBuffer):
+
+2012-11-01  Michael Matovsky  <mmatovsky@rim.com>
+
+        [BlackBerry] Web page view state should be preserved for pages loaded from page cache
+        https://bugs.webkit.org/show_bug.cgi?id=100694
+        Internal PR: 220488
+
+        Internally reviewed by Lianghui Chen, Joe Mason
+        Reviewed by Rob Buis.
+
+        The web page view specific metadata should be preserved for web pages loaded from page cache (by using back/forward).
+        This requires web page view state to be saved in and restored from the corresponding page cache history item.
+
+        No new tests for platform specific internal change.
+
+        * history/blackberry/HistoryItemViewState.h:
+        (HistoryItemViewState):
+
+2012-11-01  Alec Flett  <alecflett@chromium.org>
+
+        IndexedDB: add methods to support id-based backend APIs
+        https://bugs.webkit.org/show_bug.cgi?id=100425
+
+        Reviewed by Tony Chang.
+
+        First half of refactor involves adding a number of methods that
+        are int64_t-based rather than String-based. As a part of this, the
+        IDB*Metadata structs and the backend objectStore/index maps all
+        use int64_t as keys, rather than String.
+
+        In addition, there were a number of cleanups that came out of the
+        refactor:
+
+        - The list of object stores active in a transaction is now
+          maintained by the frontend IDBTransaction rather than the backend
+          IDBTransactionBackendImpl. This also had a simplifying rippling
+          effect through other call signatures.
+
+        - I was able to remove an apparently old FIXME from
+          IDBTransactionBackendImpl::objectStore and replace it with an ASSERT.
+
+        - IDBObjectStoreBackendImpl's IndexWriter class got a little
+          simpler since the id is now easily available in the
+          IDBIndexMetadata.
+
+        - A number of methods got simpler in their int64_t versions,
+          specifically dropping a number of ExceptionCodes.
+
+        There is also some glue code
+        (getIndexId/getIndexIds/getObjectStoreId) that will go away with
+        the 2nd half of this: https://bugs.webkit.org/show_bug.cgi?id=100425
+
+        No new tests, no new functionality as this is just a refactor.
+
+        * Modules/indexeddb/IDBDatabase.cpp:
+        (WebCore::IDBDatabase::objectStoreNames):
+        (WebCore::IDBDatabase::createObjectStore):
+        (WebCore::IDBDatabase::deleteObjectStore):
+        (WebCore::IDBDatabase::transaction):
+        * Modules/indexeddb/IDBDatabaseBackendImpl.cpp:
+        (WebCore::IDBDatabaseBackendImpl::metadata):
+        (WebCore::IDBDatabaseBackendImpl::createObjectStore):
+        (WebCore::IDBDatabaseBackendImpl::objectStore):
+        (WebCore::IDBDatabaseBackendImpl::getObjectStoreId):
+        (WebCore):
+        (WebCore::IDBDatabaseBackendImpl::deleteObjectStore):
+        (WebCore::IDBDatabaseBackendImpl::transaction):
+        (WebCore::IDBDatabaseBackendImpl::loadObjectStores):
+        (WebCore::IDBDatabaseBackendImpl::removeObjectStoreFromMap):
+        (WebCore::IDBDatabaseBackendImpl::addObjectStoreToMap):
+        * Modules/indexeddb/IDBDatabaseBackendImpl.h:
+        (WebCore::IDBDatabaseBackendImpl::deleteObjectStore):
+        (IDBDatabaseBackendImpl):
+        * Modules/indexeddb/IDBDatabaseBackendInterface.h:
+        (IDBDatabaseBackendInterface):
+        * Modules/indexeddb/IDBIndex.h:
+        (WebCore::IDBIndex::id):
+        (WebCore::IDBIndex::openKeyCursor):
+        * Modules/indexeddb/IDBIndexBackendInterface.h:
+        * Modules/indexeddb/IDBMetadata.h:
+        (WebCore::IDBIndexMetadata::IDBIndexMetadata):
+        (IDBIndexMetadata):
+        (IDBObjectStoreMetadata):
+        (WebCore::IDBObjectStoreMetadata::containsIndex):
+        (IDBDatabaseMetadata):
+        (WebCore::IDBDatabaseMetadata::IDBDatabaseMetadata):
+        (WebCore::IDBDatabaseMetadata::containsObjectStore):
+        * Modules/indexeddb/IDBObjectStore.cpp:
+        (WebCore::IDBObjectStore::indexNames):
+        (WebCore::IDBObjectStore::put):
+        (WebCore::IDBObjectStore::createIndex):
+        (WebCore::IDBObjectStore::index):
+        (WebCore::IDBObjectStore::deleteIndex):
+        * Modules/indexeddb/IDBObjectStoreBackendImpl.cpp:
+        (WebCore::IDBObjectStoreBackendImpl::put):
+        (WebCore::IDBObjectStoreBackendImpl::putWithIndexKeys):
+        (WebCore):
+        (WebCore::makeIndexWriters):
+        (WebCore::IDBObjectStoreBackendImpl::setIndexKeys):
+        (WebCore::IDBObjectStoreBackendImpl::setIndexesReady):
+        (WebCore::IDBObjectStoreBackendImpl::setIndexesReadyInternal):
+        (WebCore::IDBObjectStoreBackendImpl::putInternal):
+        (WebCore::IDBObjectStoreBackendImpl::deleteInternal):
+        (WebCore::IDBObjectStoreBackendImpl::createIndex):
+        (WebCore::IDBObjectStoreBackendImpl::index):
+        (WebCore::IDBObjectStoreBackendImpl::getIndexId):
+        (WebCore::IDBObjectStoreBackendImpl::getIndexIds):
+        (WebCore::IDBObjectStoreBackendImpl::deleteIndex):
+        (WebCore::IDBObjectStoreBackendImpl::loadIndexes):
+        (WebCore::IDBObjectStoreBackendImpl::removeIndexFromMap):
+        (WebCore::IDBObjectStoreBackendImpl::addIndexToMap):
+        * Modules/indexeddb/IDBObjectStoreBackendImpl.h:
+        (IDBObjectStoreBackendImpl):
+        * Modules/indexeddb/IDBObjectStoreBackendInterface.h:
+        * Modules/indexeddb/IDBOpenDBRequest.cpp:
+        (WebCore::IDBOpenDBRequest::onUpgradeNeeded):
+        * Modules/indexeddb/IDBRequest.cpp:
+        (WebCore::IDBRequest::onSuccess):
+        (WebCore::IDBRequest::uncaughtExceptionInEventHandler):
+        * Modules/indexeddb/IDBTransaction.cpp:
+        (WebCore::IDBTransaction::create):
+        (WebCore::IDBTransaction::IDBTransaction):
+        (WebCore::IDBTransaction::objectStore):
+        * Modules/indexeddb/IDBTransaction.h:
+        (IDBTransaction):
+        * Modules/indexeddb/IDBTransactionBackendImpl.cpp:
+        (WebCore::IDBTransactionBackendImpl::create):
+        (WebCore::IDBTransactionBackendImpl::IDBTransactionBackendImpl):
+        (WebCore::IDBTransactionBackendImpl::objectStore):
+        (WebCore):
+        (WebCore::IDBTransactionBackendImpl::scheduleTask):
+        * Modules/indexeddb/IDBTransactionBackendImpl.h:
+        (IDBTransactionBackendImpl):
+        * Modules/indexeddb/IDBTransactionBackendInterface.h:
+
+2012-11-01  Adam Barth  <abarth@webkit.org>
+
+        [V8] The DOMWrapperVisitor abstraction is no longer needed
+        https://bugs.webkit.org/show_bug.cgi?id=100965
+
+        Reviewed by Kentaro Hara.
+
+        This patch removes the DOMWrapperVisitor interface because it is no
+        longer needed. As a consequence, DOMWrapperMaps no longer need to
+        support enumeration, and we can move more DOM objects to use the faster
+        intrusive wrappers.
+
+        There was one remaining user of DOMWrapperVisitor in the
+        ScriptProfiler, which I've moved over to enumerating objects directly
+        from V8, similar to a function above it in the same file.
+
+        * bindings/v8/DOMWrapperMap.h:
+        (WebCore):
+        (DOMWrapperMap):
+        * bindings/v8/IntrusiveDOMWrapperMap.h:
+        * bindings/v8/ScriptProfiler.cpp:
+        (WebCore::ScriptProfiler::visitNodeWrappers):
+        (WebCore::ScriptProfiler::visitExternalArrays):
+
+2012-11-01  Mike West  <mkwst@chromium.org>
+
+        CSP 1.0: Warn when old-style directives encountered.
+        https://bugs.webkit.org/show_bug.cgi?id=100883
+
+        Reviewed by Adam Barth.
+
+        In Mozilla's pre-W3C-spec implementation, a few directives are
+        implemented that were either renamed, reworked, or removed from CSP 1.0.
+        This patch adds special warning messages for three of those directives
+        to set developer expectations correctly.
+
+        Test: http/tests/security/contentSecurityPolicy/source-list-parsing-deprecated.html
+
+        * page/ContentSecurityPolicy.cpp:
+        (WebCore::CSPDirectiveList::parseDirective):
+        (WebCore::CSPDirectiveList::addDirective):
+        (WebCore::ContentSecurityPolicy::reportUnsupportedDirective):
+        * page/ContentSecurityPolicy.h:
+            Rename 'reportUnrecognizedDirectives' to
+            'reportUnsupportedDirectives', and teach it to give more descriptive
+            error messages when encountering 'allow', 'options', and
+            'policy-uri'.
+
+2012-11-01  Pavel Feldman  <pfeldman@chromium.org>
+
+        Web Inspector: Update CodeMirror to v3
+        https://bugs.webkit.org/show_bug.cgi?id=99319
+
+        Reviewed by Vsevolod Vlasov.
+
+        Updated to ToT v3.
+
+        * inspector/front-end/CodeMirrorTextEditor.js:
+        (WebInspector.CodeMirrorTextEditor):
+        (WebInspector.CodeMirrorTextEditor.prototype._gutterClick):
+        (WebInspector.CodeMirrorTextEditor.prototype.addBreakpoint):
+        (WebInspector.CodeMirrorTextEditor.prototype.removeBreakpoint):
+        (WebInspector.CodeMirrorTextEditor.prototype.setExecutionLine):
+        (WebInspector.CodeMirrorTextEditor.prototype.clearExecutionLine):
+        (WebInspector.CodeMirrorTextEditor.prototype.highlightLine):
+        (WebInspector.CodeMirrorTextEditor.prototype.clearLineHighlight):
+        (WebInspector.CodeMirrorTextEditor.prototype._change):
+        * inspector/front-end/cm/cmdevtools.css:
+        (.CodeMirror):
+        (.CodeMirror-linenumber):
+        (.cm-breakpoint):
+        * inspector/front-end/cm/codemirror.css:
+        (.CodeMirror):
+        (.CodeMirror-scroll):
+        (.CodeMirror-lines):
+        (.CodeMirror pre):
+        (.CodeMirror-scrollbar-filler):
+        (.CodeMirror-gutters):
+        (.CodeMirror-linenumbers):
+        (.CodeMirror-linenumber):
+        (.CodeMirror pre.CodeMirror-cursor):
+        (.CodeMirror pre.CodeMirror-secondarycursor):
+        (.cm-keymap-fat-cursor pre.CodeMirror-cursor):
+        (.cm-keymap-fat-cursor pre.CodeMirror-cursor:not(#nonsense_id)):
+        (.CodeMirror pre.CodeMirror-cursor.CodeMirror-overwrite):
+        (.cm-s-default .cm-keyword):
+        (.cm-s-default .cm-atom):
+        (.cm-s-default .cm-number):
+        (.cm-s-default .cm-def):
+        (.cm-s-default .cm-variable):
+        (.cm-s-default .cm-variable-2):
+        (.cm-s-default .cm-variable-3):
+        (.cm-s-default .cm-property):
+        (.cm-s-default .cm-operator):
+        (.cm-s-default .cm-comment):
+        (.cm-s-default .cm-string):
+        (.cm-s-default .cm-string-2):
+        (.cm-s-default .cm-meta):
+        (.cm-s-default .cm-error):
+        (.cm-s-default .cm-qualifier):
+        (.cm-s-default .cm-builtin):
+        (.cm-s-default .cm-bracket):
+        (.cm-s-default .cm-tag):
+        (.cm-s-default .cm-attribute):
+        (.cm-s-default .cm-header):
+        (.cm-s-default .cm-quote):
+        (.cm-s-default .cm-hr):
+        (.cm-s-default .cm-link):
+        (.cm-header, .cm-strong):
+        (.cm-em):
+        (.cm-emstrong):
+        (.cm-link):
+        (.cm-invalidchar):
+        (div.CodeMirror span.CodeMirror-matchingbracket):
+        (div.CodeMirror span.CodeMirror-nonmatchingbracket):
+        (.CodeMirror-sizer):
+        (.CodeMirror-vscrollbar, .CodeMirror-hscrollbar, .CodeMirror-scrollbar-filler):
+        (.CodeMirror-vscrollbar):
+        (.CodeMirror-hscrollbar):
+        (.CodeMirror-gutter):
+        (.CodeMirror-gutter-elt):
+        (.CodeMirror-linebackground):
+        (.CodeMirror-linewidget):
+        (.CodeMirror-measure):
+        (.CodeMirror-measure pre):
+        (.CodeMirror-selected):
+        (.CodeMirror-focused .CodeMirror-selected):
+        (.CodeMirror span):
+        * inspector/front-end/cm/codemirror.js:
+        (window.CodeMirror.):
+        (window.CodeMirror):
+        * inspector/front-end/utilities.js:
+
+2012-11-01  Tiancheng Jiang  <tijiang@rim.com>
+
+        [BlackBerry] Update BB10 form theme.
+        https://bugs.webkit.org/show_bug.cgi?id=100760
+
+        Reviewed by Rob Buis.
+
+        RIM PR 235194.
+
+        Check img pointer is null, if so, do early return.
+
+        * platform/blackberry/RenderThemeBlackBerry.cpp:
+        (WebCore::drawControl):
+        (WebCore::drawThreeSlice):
+        (WebCore::drawNineSlice):
+
+2012-11-01  Adam Barth  <abarth@webkit.org>
+
+        [V8] The V8DOMMap visitors are no longer needed
+        https://bugs.webkit.org/show_bug.cgi?id=100963
+
+        Reviewed by Kentaro Hara.
+
+        This patch inlines visitAllDOMNodes into its one caller (and removes
+        one layer of visitor adaptor abstraction).
+
+        * bindings/v8/ScriptProfiler.cpp:
+        (WebCore::ScriptProfiler::visitNodeWrappers):
+        * bindings/v8/V8DOMMap.cpp:
+        * bindings/v8/V8DOMMap.h:
+        (WebCore):
+
+2012-11-01  Tiancheng Jiang  <tijiang@rim.com>
+
+        [BlackBerry] Update BB10 form theme.
+        https://bugs.webkit.org/show_bug.cgi?id=100760
+
+        Reviewed by Rob Buis.
+
+        RIM PR 235194.
+
+        Check img pointer is null, if so, do early return.
+
+        * platform/blackberry/RenderThemeBlackBerry.cpp:
+        (WebCore::drawControl):
+        (WebCore::drawThreeSlice):
+        (WebCore::drawNineSlice):
+
+2012-11-01  Adam Barth  <abarth@webkit.org>
+
+        Unreviewed. Build fix.
+
+        * bindings/v8/V8GCController.cpp:
+
+2012-11-01  Christophe Dumez  <christophe.dumez@intel.com>
+
+        [EFL][WK2] Add Ewk_Auth_Request API
+        https://bugs.webkit.org/show_bug.cgi?id=100858
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Provide an AuthenticationClient for EFL port in WebCore so
+        that we can handle authentication similarly to other ports
+        of WebKit.
+
+        No new tests, no behavior change for layout tests.
+
+        * PlatformEfl.cmake: Add AuthenticationChallengeSoup.cpp to CMake.
+        * loader/ResourceLoader.cpp:
+        (WebCore::ResourceLoader::didReceiveAuthenticationChallenge):
+        * platform/network/ResourceHandle.h:
+        (ResourceHandle): Have ResourceHandle subclass AuthenticationClient like
+        most of the other ports.
+        * platform/network/soup/AuthenticationChallengeSoup.cpp: Fix initialization
+        of previousFailureCount member. It should be 1 if we are retrying
+        authentication and 0 otherwise, not the opposite.
+        (WebCore::AuthenticationChallenge::AuthenticationChallenge):
+        * platform/network/soup/ResourceHandleSoup.cpp: Provide implementation for EFL
+        port of AuthenticationClient methods.
+        (WebCore::WebCoreSynchronousLoader::didReceiveAuthenticationChallenge):
+        (WebCoreSynchronousLoader):
+        (WebCore):
+        (WebCore::ResourceHandle::didReceiveAuthenticationChallenge):
+        (WebCore::ResourceHandle::receivedRequestToContinueWithoutCredential):
+        (WebCore::ResourceHandle::receivedCredential):
+        (WebCore::ResourceHandle::receivedCancellation):
+        (WebCore::authenticateCallback):
+        (WebCore::ResourceHandle::defaultSession):
+
+2012-10-24  Jocelyn Turcotte  <jocelyn.turcotte@digia.com>
+
+        WebIconDatabase: Properly clean up on destruction
+        https://bugs.webkit.org/show_bug.cgi?id=100237
+
+        Reviewed by Brady Eidson.
+
+        It's now possible that the IconDatabase gets destroyed since WebKit2
+        isn't using it as a singleton.
+
+        Check that the database was properly closed rather than asserting that
+        it won't get deleted.
+
+        * loader/icon/IconDatabase.cpp:
+        (WebCore::IconDatabase::~IconDatabase):
+
+2012-11-01  Alexei Filippov  <alph@chromium.org>
+
+        Web Inspector: make component subitems use parent color in native memory snapshots.
+        https://bugs.webkit.org/show_bug.cgi?id=100876
+
+        A component subitems use the color of the component itself if the color
+        is not explicitly specified for the subitem.
+
+        Reviewed by Yury Semikhatsky.
+
+        * inspector/front-end/NativeMemorySnapshotView.js:
+        (WebInspector.NativeSnapshotNode.prototype._createSizeCell):
+        (WebInspector.MemoryBlockViewProperties._initialize):
+        (WebInspector.MemoryBlockViewProperties._forMemoryBlock):
+
+2012-11-01  Emil A Eklund  <eae@chromium.org>
+
+        [subpixel] Change intrinsicSize to LayoutUnit
+        https://bugs.webkit.org/show_bug.cgi?id=99104
+
+        Reviewed by Levi Weintraub.
+
+        Change RenderReplaced and intrinsicSize to LayoutUnit to avoid
+        rounding problems when zooming/scaling. Also change imageSize to
+        LayoutUnit as it can return a scaled size.
+
+        Test: fast/sub-pixel/tiled-canvas-elements.html
+
+        * html/ImageDocument.cpp:
+        (WebCore::ImageDocumentParser::finish):
+        * loader/cache/CachedImage.cpp:
+        (WebCore::CachedImage::imageSizeForRenderer):
+        * loader/cache/CachedImage.h:
+        (CachedImage):
+        * platform/graphics/FractionalLayoutSize.h:
+        (FractionalLayoutSize):
+        (WebCore::FractionalLayoutSize::scale):
+        (WebCore::FractionalLayoutSize::clampToMinimumSize):
+        * rendering/RenderBox.h:
+        (WebCore::RenderBox::intrinsicSize):
+        * rendering/RenderHTMLCanvas.cpp:
+        (WebCore::RenderHTMLCanvas::canvasSizeChanged):
+        * rendering/RenderImage.cpp:
+        (WebCore::RenderImage::imageChanged):
+        (WebCore::RenderImage::updateIntrinsicSizeIfNeeded):
+        (WebCore::RenderImage::paintReplaced):
+        (WebCore::RenderImage::minimumReplacedHeight):
+        * rendering/RenderImage.h:
+        (RenderImage):
+        * rendering/RenderImageResource.h:
+        (WebCore::RenderImageResource::imageSize):
+        * rendering/RenderImageResourceStyleImage.h:
+        * rendering/RenderReplaced.cpp:
+        (WebCore::RenderReplaced::RenderReplaced):
+        (WebCore::RenderReplaced::computeAspectRatioInformationForRenderBox):
+        (WebCore::RenderReplaced::computeReplacedLogicalWidth):
+        (WebCore::RenderReplaced::computeReplacedLogicalHeight):
+        * rendering/RenderReplaced.h:
+        (RenderReplaced):
+        (WebCore::RenderReplaced::minimumReplacedHeight):
+        (WebCore::RenderReplaced::setIntrinsicSize):
+        * rendering/RenderVideo.cpp:
+        (WebCore::RenderVideo::updateIntrinsicSize):
+        (WebCore::RenderVideo::calculateIntrinsicSize):
+        (WebCore::RenderVideo::videoBox):
+        (WebCore::RenderVideo::minimumReplacedHeight):
+        * rendering/RenderVideo.h:
+        (RenderVideo):
+        * rendering/style/StyleCachedImage.cpp:
+        (WebCore::StyleCachedImage::imageSize):
+        * rendering/style/StyleCachedImage.h:
+        (StyleCachedImage):
+        * rendering/style/StyleCachedImageSet.cpp:
+        (WebCore::StyleCachedImageSet::imageSize):
+        * rendering/style/StyleCachedImageSet.h:
+        (StyleCachedImageSet):
+        * rendering/style/StyleGeneratedImage.cpp:
+        (WebCore::StyleGeneratedImage::imageSize):
+        (WebCore::StyleGeneratedImage::computeIntrinsicDimensions):
+        * rendering/style/StyleGeneratedImage.h:
+        (StyleGeneratedImage):
+        * rendering/style/StyleImage.h:
+        (StyleImage):
+        * rendering/style/StylePendingImage.h:
+
+2012-11-01  Adam Barth  <abarth@webkit.org>
+
+        [V8] Unify the V8GCController visitors
+        https://bugs.webkit.org/show_bug.cgi?id=100897
+
+        Reviewed by Eric Seidel.
+
+        After this patch, we use a single visitor for all DOM wrappers,
+        regardless of type. We also visit all the wrappers in one pass by
+        calling v8::V8::VisitHandlesWithClassIds directly rather than via
+        visitAllDOMNodes.
+
+        This patch also introduces a wrapper class ID for non-Node DOM objects.
+        Previously, only DOM nodes had a class ID.
+
+        * bindings/v8/IntrusiveDOMWrapperMap.h:
+        * bindings/v8/ScriptProfiler.cpp:
+        (WebCore::retainedDOMInfo):
+        (WebCore::ScriptProfiler::initialize):
+        * bindings/v8/V8DOMMap.cpp:
+        (WebCore::visitAllDOMNodes):
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::setJSWrapperForDOMNode):
+        * bindings/v8/V8DOMWrapper.h:
+        (WebCore::V8DOMWrapper::setJSWrapperForDOMObject):
+        * bindings/v8/V8GCController.cpp:
+        (WebCore::GCHandleVisitor::notifyFinished):
+        (GCHandleVisitor):
+        (WebCore::V8GCController::majorGCPrologue):
+        * bindings/v8/WrapperTypeInfo.h:
+        (WebCore):
+
+2012-11-01  Stephen White  <senorblanco@chromium.org>
+
+        Unreviewed, rolling out r133143.
+        http://trac.webkit.org/changeset/133143
+        https://bugs.webkit.org/show_bug.cgi?id=96894
+
+        Causing content_browsertests failures
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * Target.pri:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * dom/DeviceOrientationClient.h:
+        (DeviceOrientationClient):
+        * dom/DeviceOrientationController.cpp:
+        (WebCore::DeviceOrientationController::DeviceOrientationController):
+        (WebCore):
+        (WebCore::DeviceOrientationController::~DeviceOrientationController):
+        (WebCore::DeviceOrientationController::timerFired):
+        (WebCore::DeviceOrientationController::addListener):
+        (WebCore::DeviceOrientationController::removeListener):
+        (WebCore::DeviceOrientationController::removeAllListeners):
+        (WebCore::DeviceOrientationController::suspendEventsForAllListeners):
+        (WebCore::DeviceOrientationController::resumeEventsForAllListeners):
+        (WebCore::DeviceOrientationController::didChangeDeviceOrientation):
+        (WebCore::DeviceOrientationController::supplementName):
+        * dom/DeviceOrientationController.h:
+        (WebCore):
+        (DeviceOrientationController):
+        (WebCore::DeviceOrientationController::isActive):
+        (WebCore::DeviceOrientationController::client):
+        (WebCore::DeviceOrientationController::from):
+        * dom/Document.cpp:
+        (WebCore::Document::suspendActiveDOMObjects):
+        (WebCore::Document::resumeActiveDOMObjects):
+        * loader/EmptyClients.h:
+        (WebCore::EmptyDeviceOrientationClient::startUpdating):
+        (WebCore::EmptyDeviceOrientationClient::stopUpdating):
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::addEventListener):
+        (WebCore::DOMWindow::removeEventListener):
+        (WebCore::DOMWindow::removeAllEventListeners):
+        * page/DeviceClient.h: Removed.
+        * page/DeviceController.cpp: Removed.
+        * page/DeviceController.h: Removed.
+
+2012-11-01  Kondapally Kalyan  <kalyan.kondapally@intel.com>
+
+        [EFL][AC]Free GL resources allocated by GraphicsContext3DEfl.
+        https://bugs.webkit.org/show_bug.cgi?id=100923.
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        GraphicsContext3DEfl creates FBO's, textures and render buffer's, but doesn't free them.
+        This patch makes sure that GraphicsContext3dEfl frees all the GL resources allocated by it.
+
+        * platform/graphics/efl/GraphicsContext3DEfl.cpp:
+        (WebCore::GraphicsContext3D::~GraphicsContext3D):
+
+2012-11-01  Andreas Kling  <kling@webkit.org>
+
+        Fix StylePropertySet/ElementAttributeData custom allocation in debug builds.
+        <http://webkit.org/b/100753>
+
+        Unreviewed debug bot crash fix after r133138.
+
+        There's additional padding after StylePropertySet and ElementAttributeData
+        in 64-bit debug builds since there are additional members in RefCountedBase.
+        Use 'sizeof(ImmutableFoo) - sizeof(void*)' as the base size of ImmutableFoo.
+
+        * css/StylePropertySet.cpp:
+        (WebCore::sizeForImmutableStylePropertySetWithPropertyCount):
+        * dom/ElementAttributeData.cpp:
+        (WebCore::sizeForImmutableElementAttributeDataWithAttributeCount):
+        (WebCore::ElementAttributeData::createImmutable):
+        (WebCore::ElementAttributeData::reportMemoryUsage):
+
+2012-11-01  Stephen Chenney  <schenney@chromium.org>
+
+        FEImage::m_document is never cleared. Why not?
+        https://bugs.webkit.org/show_bug.cgi?id=99243
+
+        Reviewed by Dirk Schulze.
+
+        Adding a comment to explain why the failure to clear m_document is not a problem.
+
+        No new tests because no code change at all.
+
+        * svg/graphics/filters/SVGFEImage.h:
+        (FEImage): Add a comment on the lifetime of m_document.
+
+2012-11-01  Eugene Klyuchnikov  <eustas.bug@gmail.com>
+
+        Web Inspector: Timeline: make "addRecord" unambiguous
+        https://bugs.webkit.org/show_bug.cgi?id=100761
+
+        Reviewed by Pavel Feldman.
+
+        TimelinePresentationModel.addRecord accepts two parameters:
+        record and parentRecord. parentRecord is always root record.
+        Make this explicit by removing parentRecord parameter.
+
+        * inspector/front-end/TimelinePanel.js: Removed parameter.
+        * inspector/front-end/TimelinePresentationModel.js:
+        (WebInspector.TimelinePresentationModel.prototype.addRecord):
+        Used root recoed instead of parent record.
+
+2012-11-01  Charles Wei  <charles.wei@torchmobile.com.cn>
+
+        [BlackBerry] Browser prematurely sends wrong credentials
+        https://bugs.webkit.org/show_bug.cgi?id=100585
+
+        Reviewed by George Staikos.
+
+        Don't send credentials to the server before been challenged.
+
+        * platform/network/blackberry/NetworkManager.cpp:
+        (WebCore::NetworkManager::startJob):
+
+2012-11-01  Stephen Chenney  <schenney@chromium.org>
+
+        SVG as an image may recreate the renderer on zoom
+        https://bugs.webkit.org/show_bug.cgi?id=99508
+
+        Reviewed by Abhishek Arya.
+
+        The SVGImage code, when SVG is used in <img> tags, caches the renderer
+        at the start of the painting method and re-uses the pointer at the end
+        of the method. However, when the page is zoomed the renderer may be
+        detached mid-method, thus leaving a stray pointer. The fix is to
+        re-fetch the pointer after the zooms.
+
+        Test: svg/as-image/img-zoom-svg-stylesheet.html
+
+        * svg/graphics/SVGImage.cpp:
+        (WebCore::SVGImage::drawSVGToImageBuffer): Re-fetch the renderer after
+        the zoom operations.
+
+2012-11-01  Pavel Feldman  <pfeldman@chromium.org>
+
+        Web Inspector: introduce Inspector.detached message containing termination cause.
+        https://bugs.webkit.org/show_bug.cgi?id=100948
+
+        Reviewed by Yury Semikhatsky.
+
+        Now protocol clients have more information to process connection termination.
+
+        * English.lproj/localizedStrings.js:
+        * inspector/Inspector.json:
+        * inspector/front-end/InspectorFrontendHostStub.js:
+        (WebInspector.RemoteDebuggingTerminatedScreen):
+        * inspector/front-end/inspector.js:
+        (WebInspector.loaded.WebInspector.socket.onopen):
+        (WebInspector.loaded):
+        (WebInspector.detached):
+
+2012-11-01  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Web Inspector: Restoring breakpoints for formatted UISourceCode should be triggered by BreakpointManager, not ScriptsPanel.
+        https://bugs.webkit.org/show_bug.cgi?id=100593
+
+        Reviewed by Pavel Feldman.
+
+        BreakpointManager now listen for FormattedChanged event and restores formatted breakpoints on it.
+        Removed now redundant callback from UISourceCode.setFormatted().
+
+        * inspector/front-end/BreakpointManager.js:
+        (WebInspector.BreakpointManager.prototype._restoreBreakpoints):
+        (WebInspector.BreakpointManager.prototype._uiSourceCodeAdded):
+        (WebInspector.BreakpointManager.prototype._uiSourceCodeFormatted):
+        (WebInspector.BreakpointManager.prototype._uiSourceCodeRemoved):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype._addUISourceCode):
+        (WebInspector.ScriptsPanel.prototype._revealExecutionLine):
+        (WebInspector.ScriptsPanel.prototype._toggleFormatSource):
+        * inspector/front-end/UISourceCode.js:
+        (WebInspector.UISourceCode.prototype._fireContentAvailable):
+        (WebInspector.UISourceCode.prototype.setFormatted.formattedChanged):
+        (WebInspector.UISourceCode.prototype.setFormatted.didGetContent):
+        (WebInspector.UISourceCode.prototype.setFormatted):
+
+2012-10-30  Yury Semikhatsky  <yurys@chromium.org>
+
+        Web Inspector: Output code evaluated in the console the same as console.log
+        https://bugs.webkit.org/show_bug.cgi?id=100695
+
+        Reviewed by Pavel Feldman.
+
+        Added an option to return object preview from evaluation commands in the protocol.
+        The option is used to generate preview for console eval results.
+
+        * inspector/InjectedScript.cpp:
+        (WebCore::InjectedScript::evaluate):
+        (WebCore::InjectedScript::callFunctionOn):
+        (WebCore::InjectedScript::evaluateOnCallFrame):
+        * inspector/InjectedScript.h:
+        (InjectedScript):
+        * inspector/InjectedScriptSource.js:
+        (.):
+        * inspector/Inspector.json:
+        * inspector/InspectorDebuggerAgent.cpp:
+        (WebCore::InspectorDebuggerAgent::evaluateOnCallFrame):
+        * inspector/InspectorDebuggerAgent.h:
+        (InspectorDebuggerAgent):
+        * inspector/InspectorRuntimeAgent.cpp:
+        (WebCore::InspectorRuntimeAgent::evaluate):
+        (WebCore::InspectorRuntimeAgent::callFunctionOn):
+        * inspector/InspectorRuntimeAgent.h:
+        (InspectorRuntimeAgent):
+        * inspector/front-end/ConsoleMessage.js:
+        (WebInspector.ConsoleMessageImpl.prototype.useArrayPreviewInFormatter):
+        (WebInspector.ConsoleMessageImpl.prototype._formatParameterAsArray):
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleCommandResult.prototype.useArrayPreviewInFormatter):
+        * inspector/front-end/DebuggerModel.js:
+        (WebInspector.DebuggerModel.prototype.evaluateOnSelectedCallFrame):
+        (WebInspector.DebuggerModel.CallFrame.prototype.evaluate):
+        * inspector/front-end/ExtensionServer.js:
+        (WebInspector.ExtensionServer.prototype.evaluate):
+        * inspector/front-end/JavaScriptSourceFrame.js:
+        (WebInspector.JavaScriptSourceFrame.prototype._resolveObjectForPopover):
+        * inspector/front-end/RemoteObject.js:
+        (WebInspector.RemoteObject.prototype.):
+        (WebInspector.RemoteObject.prototype.callFunction):
+        (WebInspector.RemoteObject.prototype.callFunctionJSON):
+        * inspector/front-end/RuntimeModel.js:
+        (WebInspector.RuntimeModel.prototype.evaluate):
+        (WebInspector.RuntimeModel.prototype.evaluated):
+        * inspector/front-end/WatchExpressionsSidebarPane.js:
+        (WebInspector.WatchExpressionsSection.prototype.update):
+
+2012-11-01  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Web Inspector: Remove obsolete code from JavaScriptSourceFrame
+        https://bugs.webkit.org/show_bug.cgi?id=100594
+
+        Reviewed by Yury Semikhatsky.
+
+        Removed obsolete WorkingCopyCommitted listener.
+        Removed redundant code that removes breakpoints from _innerSetContent.
+
+        * inspector/front-end/JavaScriptSourceFrame.js:
+        (WebInspector.JavaScriptSourceFrame):
+        (WebInspector.JavaScriptSourceFrame.prototype._innerSetContent):
+
+2012-11-01  Andreas Kling  <kling@webkit.org>
+
+        Update average StylePropertySet size estimation.
+        <http://webkit.org/b/100940>
+
+        Reviewed by Antti Koivisto.
+
+        Use sizeForImmutableStylePropertySetWithPropertyCount(2) as the average StylePropertySet
+        size to keep it in sync with the changed object memory layout.
+
+        * css/StylePropertySet.cpp:
+        (WebCore::sizeForImmutableStylePropertySetWithPropertyCount):
+        (WebCore::StylePropertySet::createImmutable):
+        (WebCore::StylePropertySet::averageSizeInBytes):
+        (WebCore::StylePropertySet::reportMemoryUsage):
+
+
+2012-11-01  Kondapally Kalyan  <kalyan.kondapally@intel.com>
+
+        [EFL][Qt][AC] Remove an unnecessary connection to X-Server.
+        https://bugs.webkit.org/show_bug.cgi?id=100628.
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        With Changset: https://bugs.webkit.org/show_bug.cgi?id=100523
+        GraphicsSurfacePrivate should always use the Display returned by offscreenwindow.
+        However, in GraphicsSurfacePrivate constructor we call XOpenDisplay before asking
+        display from offscreenwindow.
+        This patch removes unnecessary call to XOpenDisplay made in GraphicsSurfacePrivate.
+
+        * platform/graphics/surfaces/qt/GraphicsSurfaceGLX.cpp:
+        (WebCore::GraphicsSurfacePrivate::GraphicsSurfacePrivate):
+
+2012-11-01  Mihnea Ovidenie  <mihnea@adobe.com>
+
+        [CSSRegions]Former auto-height regions should not ignore their defined height
+        https://bugs.webkit.org/show_bug.cgi?id=100749
+
+        Reviewed by Julien Chaffraix.
+
+        When a region with height auto has its height defined, we should also clear the override logical content height.
+        Otherwise, the region will use the wrong height when laying out content from the associated render flow thread.
+
+        Test: fast/regions/autoheight-definedheight-changenotdetected.html
+
+        * rendering/RenderRegion.cpp:
+        (WebCore::RenderRegion::updateRegionHasAutoLogicalHeightFlag):
+
+2012-11-01  Yury Semikhatsky  <yurys@chromium.org>
+
+        Memory instrumentation: do not report memory occupied by RenderObjects referenced from CSSImageGeneratorValue
+        https://bugs.webkit.org/show_bug.cgi?id=100934
+
+        Reviewed by Alexander Pavlov.
+
+        * css/CSSImageGeneratorValue.cpp:
+        (WTF): Skip rederences to RenderObjects from CSSImageGeneratorValue when collecting
+        memory usage data.
+
+2012-11-01  Kihong Kwon  <kihong.kwon@samsung.com>
+
+        Add DeviceController base-class to remove duplication of DeviceXXXControler
+        https://bugs.webkit.org/show_bug.cgi?id=96894
+
+        Reviewed by Hajime Morita.
+
+        Add DeviceController which is extracted from DeviceOrientationController to remove duplication.
+        And soon-to-be-added DeviceMotionController and ProximityController.
+
+        Covered by existing tests.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * Target.pri:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * dom/DeviceOrientationClient.h:
+        * dom/DeviceOrientationController.cpp:
+        Remove member functions to move to DeviceController.
+        - addListener(), removeListener(), removeAllListeners(), isActive()
+        (WebCore::DeviceOrientationController::DeviceOrientationController):
+        (WebCore::DeviceOrientationController::didChangeDeviceOrientation):
+        (WebCore::DeviceOrientationController::client):
+        (WebCore::DeviceOrientationController::hasLastData):
+        (WebCore::DeviceOrientationController::getLastEvent):
+        (WebCore::DeviceOrientationController::from):
+        (WebCore):
+        * dom/DeviceOrientationController.h:
+        (WebCore):
+        (WebCore::DeviceOrientationController::~DeviceOrientationController):
+        (DeviceOrientationController):
+        * dom/Document.cpp:
+        Remove suspendEventsForAllListeners() and resumeEventsForAllListeners() function calls.
+        These calls can be made by checking activeDOMObjectsAreSuspended() and activeDOMObjectsAreStopped() before dispatchEvent.
+        (WebCore::Document::suspendActiveDOMObjects):
+        (WebCore::Document::resumeActiveDOMObjects):
+        * loader/EmptyClients.h:
+        (EmptyDeviceClient):
+        (WebCore::EmptyDeviceClient::startUpdating):
+        (WebCore::EmptyDeviceClient::stopUpdating):
+        (WebCore):
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::addEventListener):
+        (WebCore::DOMWindow::removeEventListener):
+        (WebCore::DOMWindow::removeAllEventListeners):
+        * page/DeviceClient.h: Added.
+        (WebCore):
+        (DeviceClient):
+        (WebCore::DeviceClient::~DeviceClient):
+        * page/DeviceController.cpp: Added.
+        DeviceController has extracted functions from DeviceOrientationController and DeviceMotionController.
+        - addDeviceEventListener(), removeDeviceEventlistener(), removeAllDeviceEventListeners(), dispatchDeviceEvent()
+        All kind of device event controller which has DeviceClient can be inherited from DeviceController.
+        (WebCore):
+        (WebCore::DeviceController::DeviceController):
+        (WebCore::DeviceController::addDeviceEventListener):
+        (WebCore::DeviceController::removeDeviceEventListener):
+        (WebCore::DeviceController::removeAllDeviceEventListeners):
+        (WebCore::DeviceController::dispatchDeviceEvent):
+        (WebCore::DeviceController::fireDeviceEvent):
+        * page/DeviceController.h: Added.
+        (WebCore):
+        (DeviceController):
+        (WebCore::DeviceController::~DeviceController):
+        (WebCore::DeviceController::isActive):
+        (WebCore::DeviceController::client):
+        (WebCore::DeviceController::hasLastData):
+        (WebCore::DeviceController::getLastEvent):
+
+2012-11-01  Yury Semikhatsky  <yurys@chromium.org>
+
+        Memory instrumentation: report memory occupied by ResourceRequest instead of its base ResourceRequestBase
+        https://bugs.webkit.org/show_bug.cgi?id=100497
+
+        Reviewed by Alexander Pavlov.
+
+        Added memory reporting method to chromium implementation of ResourceRequest.
+
+        * platform/network/ResourceRequestBase.cpp:
+        (WebCore::ResourceRequestBase::reportMemoryUsageBase): Renamed reportMemoryUsage
+        on ResourceRequestBase to reportMemoryUsageBase and made it protected. I'd
+        rather make ResourceRequestBase::reportMemoryUsage virtual and override it
+        in the descendant but ResourceRequestBase doesn't have any virtual methods
+        and shouldn't be used directly(ResourceRequest should be used instead).
+        * platform/network/ResourceRequestBase.h:
+        (ResourceRequestBase):
+        * platform/network/chromium/ResourceRequest.cpp:
+        (WebCore::ResourceRequest::reportMemoryUsage):
+        (WebCore):
+        * platform/network/chromium/ResourceRequest.h:
+        (ResourceRequest):
+
+2012-11-01  Andreas Kling  <kling@webkit.org>
+
+        Pack immutable StylePropertySets harder on 64-bit.
+        <http://webkit.org/b/100753>
+        <rdar://problem/12599155>
+
+        Reviewed by Antti Koivisto.
+
+        Move away from using CSSProperty as internal storage for immutable StylePropertySets.
+        Instead use two arrays, one for property metadata (ID, shorthand ID, !important, ...)
+        and one for the CSSValue pointers. This saves 4 bytes per property on 64-bit.
+
+        Old object layout:
+
+            Ref count                   (4 bytes)
+            Metadata                    (4 bytes)
+            CSSProperty [N]             (16 bytes each)
+
+        New object layout:
+
+            Ref count                   (4 bytes)
+            Metadata                    (4 bytes)
+            CSSValue* [N]               (8 bytes each)
+            StylePropertyMetadata [N]   (4 bytes each)
+
+        901kB progress on Membuster3 (22% overall reduction in StylePropertySet memory.)
+
+        The CSSProperty class sticks around for now, it's still used in mutable StylePropertySets
+        and by the StylePropertySet constructors.
+
+        * css/CSSProperty.cpp:
+        * css/CSSProperty.h:
+        (CSSProperty):
+        (WebCore::CSSProperty::CSSProperty):
+        (WebCore::CSSProperty::id):
+        (WebCore::CSSProperty::shorthandID):
+        (WebCore::CSSProperty::isImportant):
+        (WebCore::CSSProperty::metadata):
+
+            Break the bitfield from CSSProperty out into a StylePropertyMetadata class (actually a union.)
+
+        * css/StylePropertySet.cpp:
+        (WebCore::immutableStylePropertySetSize):
+
+            Updated size calculation for immutable StylePropertySets, 1/4 smaller!
+
+        (WebCore::ImmutableStylePropertySet::ImmutableStylePropertySet):
+        (WebCore::ImmutableStylePropertySet::~ImmutableStylePropertySet):
+        (WebCore::MutableStylePropertySet::MutableStylePropertySet):
+        (WebCore::StylePropertySet::mergeAndOverrideOnConflict):
+        (WebCore::StylePropertySet::reportMemoryUsage):
+        (WebCore::StylePropertySet::PropertyReference::cssName):
+        (WebCore::StylePropertySet::PropertyReference::cssText):
+        * css/StylePropertySet.h:
+        (WebCore::StylePropertySet::PropertyReference::id):
+        (WebCore::StylePropertySet::PropertyReference::shorthandID):
+        (WebCore::StylePropertySet::PropertyReference::isImportant):
+        (WebCore::StylePropertySet::PropertyReference::isInherited):
+        (WebCore::StylePropertySet::PropertyReference::isImplicit):
+        (PropertyReference):
+        (WebCore::StylePropertySet::PropertyReference::value):
+        (WebCore::StylePropertySet::PropertyReference::toCSSProperty):
+        (WebCore::StylePropertySet::PropertyReference::propertyMetadata):
+        (WebCore::StylePropertySet::PropertyReference::propertyValue):
+        (StylePropertySet):
+        (ImmutableStylePropertySet):
+        (WebCore::StylePropertySet::immutableValueArray):
+        (WebCore::StylePropertySet::immutableMetadataArray):
+
+            Refactored internal storage for StylePropertySet.
+
+2012-11-01  Kent Tamura  <tkent@chromium.org>
+
+        Remove unused Locale::parseDateTime
+        https://bugs.webkit.org/show_bug.cgi?id=100910
+
+        Reviewed by Kentaro Hara.
+
+        For date/time input types, InputType::convertFromVisibleValue is never
+        called. convertFromVisibleValue is called when an inner editable node is
+        updated. However input elements don't have such editable nodes if
+        ENABLE_INPUT_MULTIPLE_FIELDS_UI is enabled, and a user can't edit the
+        inner editable node otherwise because we open date/time pickers when a
+        user try to change the field value.
+
+        We had used convertFromVisibleValue for input[type=date] with an old UI.
+
+        No new tests because of no behavior changes.
+
+        * html/BaseDateAndTimeInputType.cpp:
+        (WebCore::BaseDateAndTimeInputType::convertFromVisibleValue):
+        Remove Locale::parseDateTiem and put ASSERT_NOT_REACHED.
+
+        * platform/text/PlatformLocale.h: Remove parseDateTime.
+
+        * platform/text/LocaleICU.h: Remove parseDateTime and a bogus comment.
+        * platform/text/LocaleICU.cpp: Remove parseDateTime.
+
+        * platform/text/LocaleNone.cpp: Remove parseDateTime.
+
+        * platform/text/mac/LocaleMac.h: Remove parseDateTime.
+        * platform/text/mac/LocaleMac.mm: Ditto.
+        * platform/text/win/LocaleWin.h:
+        - Remove parseDateTime, its helpers, and m_baseYear.
+        - Remove appendNumber, appendTwoDigitsNumber, appendFourDigitsNumber,
+          and formatDate. They don't exist.
+        * platform/text/win/LocaleWin.cpp:
+        Remove the above functions.
+        (WebCore::LocaleWin::LocaleWin): Remove m_baseYear iniitalization.
+
+2012-10-31  Nate Chapin  <japhet@chromium.org>
+
+        Remove some CachedResource::Status's in favor of looking at CachedResource::m_error
+        https://bugs.webkit.org/show_bug.cgi?id=100901
+
+        Reviewed by Adam Barth.
+
+        No new tests, refactor only.
+
+        * inspector/InspectorPageAgent.cpp:
+        (WebCore::InspectorPageAgent::buildObjectForFrameTree):
+        * loader/DocumentThreadableLoader.cpp:
+        (WebCore::DocumentThreadableLoader::notifyFinished):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::loadInSameDocument):
+        * loader/SubresourceLoader.cpp:
+        (WebCore::SubresourceLoader::didFail):
+        (WebCore::SubresourceLoader::willCancel):
+        * loader/cache/CachedResource.cpp:
+        (WebCore::CachedResource::stopLoading):
+        * loader/cache/CachedResource.h:
+        (WebCore::CachedResource::wasCanceled):
+        (WebCore::CachedResource::errorOccurred):
+        (WebCore::CachedResource::loadFailedOrCanceled):
+
+2012-10-31  Stephen White  <senorblanco@chromium.org>
+
+        Unreviewed, rolling out r133122.
+        http://trac.webkit.org/changeset/133122
+        https://bugs.webkit.org/show_bug.cgi?id=99083
+
+        Broke Chromium Win, Android, ChromeOS builds
+
+        * platform/graphics/chromium/GraphicsLayerChromium.cpp:
+        (WebCore::GraphicsLayerChromium::setContentsOpaque):
+        (WebCore::GraphicsLayerChromium::paint):
+        * platform/graphics/chromium/OpaqueRectTrackingContentLayerDelegate.cpp:
+        (WebCore::OpaqueRectTrackingContentLayerDelegate::paintContents):
+        * platform/graphics/chromium/OpaqueRectTrackingContentLayerDelegate.h:
+        (OpaqueRectTrackingContentLayerDelegate):
+
+2012-10-31  Takashi Sakamoto  <tasak@google.com>
+
+        [Refactoring] Move initial style setting for ProgressValueElement from attach method to createShadowSubtree method in HTMLProgressElement.
+        https://bugs.webkit.org/show_bug.cgi?id=83664
+
+        Reviewed by Hajime Morita.
+
+        The original code updates inline style during attach(). However,
+        the attach would be invoked from Element::recalcStyle()'s reattach().
+        If updating inline styles during the reattach(), style related flags,
+        i.e. childNeedsStyleRecalc, and needsStyleRecalc are cleared after the
+        reattach(). So the inline styles are not updated in next
+        setNeedsStyleRecalc, because ProgressValueElement has already had
+        InlineStyleChange (existingChanegType == InlineStyleChange) and
+        markAncestorsWithChildNeedsStyleRecalc is not invoked.
+
+        Test: fast/dom/HTMLProgressElement/progress-bar-set-value.html
+
+        * html/HTMLProgressElement.cpp:
+        (WebCore::HTMLProgressElement::attach):
+        Copied updateFromElement from didElementStateChange. If removing the
+        update, indeterminate-progress-001.html and progress-element.html
+        under fast/dom/HTMLProgressElement will fail. We still need attach()
+        and updateFromElement. To remove the attach(), need more refactoring,
+        i.e. investigating where attach() is invoked from and modifying all
+        related codes.
+        (WebCore::HTMLProgressElement::createShadowSubtree):
+        Initialize m_value by indeterminate-position. The value is default
+        value of progress element.
+
+2012-10-31  Hayato Ito  <hayato@chromium.org>
+
+        Make resolveReprojection() defined in ComposedShadowTreeWalker.cpp callable from outside.
+        https://bugs.webkit.org/show_bug.cgi?id=100832
+
+        Reviewed by Dimitri Glazkov.
+
+        InsertionPoint.h now defines resolveReprojection() so that it can be called from outside.
+
+        No new tests as no new functionality.
+
+        * dom/ComposedShadowTreeWalker.cpp:
+        * html/shadow/InsertionPoint.h:
+        (WebCore::shadowOfParentForDistribution):
+        (WebCore):
+        (WebCore::resolveReprojection):
+
+2012-10-31  Alok Priyadarshi  <alokp@chromium.org>
+
+        [chromium] Pass canPaintLCDText to WebContentLayerClient::paintContents
+        https://bugs.webkit.org/show_bug.cgi?id=99083
+
+        Reviewed by James Robinson.
+
+        Use LCD text setting passed to WebContentLayerClient::paintContents instead of turning it off for all composited layers.
+
+        No new tests needed. This patch does not change anything functionally.
+
+        * platform/graphics/chromium/GraphicsLayerChromium.cpp:
+        (WebCore::GraphicsLayerChromium::setContentsOpaque):
+        (WebCore::GraphicsLayerChromium::paint):
+        * platform/graphics/chromium/OpaqueRectTrackingContentLayerDelegate.cpp:
+        (WebCore::OpaqueRectTrackingContentLayerDelegate::paintContents):
+        * platform/graphics/chromium/OpaqueRectTrackingContentLayerDelegate.h:
+        (OpaqueRectTrackingContentLayerDelegate):
+
+2012-10-31  Chris Evans  <cevans@google.com>
+
+        RenderArena has a memory leak and poor efficiency
+        https://bugs.webkit.org/show_bug.cgi?id=100893
+
+        Reviewed by Eric Seidel.
+
+        1) Avoid memory leak that persists for the Document lifetime by
+        increasing recycled size buckets up to 1024. It was previously 400,
+        and sizeof(RenderNamedFlowThread) / sizeof(RenderSVGText) both blew this
+        quota. An assert was added to prevent this happening again.
+
+        2) Fix the size of the recyled size bucket array on 64-bit. We only
+        need 8 byte granularity on 64-bit, but we had 4.
+
+        3) Try and pass power-of-two sizes to the underlying malloc() call, so
+        that we're space efficient. We now take Arena metadata into account.
+
+        4) Double the default RenderArena size allocation to 8192 bytes. Even
+        for a render of a trivial text file, 4096 bytes is not enough to prevent
+        extra calls into the underlying malloc() for more arena pool.
+
+        * rendering/RenderArena.cpp:
+        (WebCore::RenderArena::RenderArena): Adjust arena size so that we pass on the page-sized multiple to the underlying malloc() implementation.
+        (WebCore::RenderArena::allocate):
+        (WebCore::RenderArena::free): Assert that the allocation size is handled by our recycling buckets.
+        * rendering/RenderArena.h:
+        (WebCore): Maintain free buckets up to 1024 bytes to avoid memory leak.
+        (RenderArena): Double the default allocation size and handle 64-bit systems more efficiently.
+
+2012-10-31  Adam Barth  <abarth@webkit.org>
+
+        [V8] Garbage collection should use opaque roots rather than implicit references
+        https://bugs.webkit.org/show_bug.cgi?id=100707
+
+        Reviewed by Kentaro Hara.
+
+        This patch replaces visitDOMWrapper with opaqueRootForGC. The
+        former used to inform V8 of implicit relationships between wrapper
+        objects on a per-wrapper basis. That meant that we needed to know which
+        DOMDataStore a given wrapper was in during garbage collection.
+
+        After this patch, we now use object groups rather than implicit
+        references to inform V8 of these relationships. That has two benefits:
+
+        1) We no longer need to know which DOMDataStore a wrapper belongs
+           because we don't need to find the exact source wrapper for the
+           implicit connection.
+
+        2) We can now handle more complicated implicit relationships, for
+           example when some of the intervening objects haven't had their
+           JavaScript wrappers created yet.
+
+        This patch also unlocks to paths of future development:
+        A) Fixing the remaining failures in fast/dom/gc-9.html
+        B) Enumerating DOM wrappers entirely from V8 rather than from the
+           DOMWrapperMaps (so that we can move more object towards using
+           IntrusiveDOMWrapperMaps, which aren't enumerable from WebCore).
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+        (NeedsCustomOpaqueRootForGC):
+        (GenerateOpaqueRootForGC):
+        (GenerateHeader):
+        (GenerateImplementation):
+        * bindings/v8/V8GCController.cpp:
+        (ImplicitConnection):
+        (WebCore::ImplicitConnection::ImplicitConnection):
+        (WebCore::ImplicitConnection::root):
+        (WebCore::ImplicitConnection::wrapper):
+        (WebCore):
+        (WebCore::operator<):
+        (WrapperGrouper):
+        (WebCore::WrapperGrouper::WrapperGrouper):
+        (WebCore::WrapperGrouper::addToGroup):
+        (WebCore::WrapperGrouper::keepAlive):
+        (WebCore::WrapperGrouper::apply):
+        (WebCore::ObjectVisitor::ObjectVisitor):
+        (WebCore::ObjectVisitor::visitDOMWrapper):
+        (ObjectVisitor):
+        (WebCore::V8GCController::opaqueRootForGC):
+        (WebCore::NodeVisitor::NodeVisitor):
+        (WebCore::NodeVisitor::visitNodeWrapper):
+        (NodeVisitor):
+        (WebCore::V8GCController::majorGCPrologue):
+        * bindings/v8/V8GCController.h:
+        (WebCore):
+        (V8GCController):
+        * bindings/v8/WrapperTypeInfo.h:
+        (WebCore):
+        (WebCore::WrapperTypeInfo::opaqueRootForGC):
+        (WrapperTypeInfo):
+        * bindings/v8/custom/V8NodeListCustom.cpp:
+        (WebCore::V8NodeList::opaqueRootForGC):
+        * bindings/v8/custom/V8SpeechRecognitionResultCustom.cpp:
+        (WebCore::V8SpeechRecognitionResult::opaqueRootForGC):
+
+2012-10-31  Stephen White  <senorblanco@chromium.org>
+
+        Unreviewed, rolling out r133107.
+        http://trac.webkit.org/changeset/133107
+        https://bugs.webkit.org/show_bug.cgi?id=100425
+
+        Broke compile on Chromium Win.
+
+        * Modules/indexeddb/IDBCallbacks.h:
+        (IDBCallbacks):
+        * Modules/indexeddb/IDBDatabase.cpp:
+        (WebCore::IDBDatabase::objectStoreNames):
+        (WebCore::IDBDatabase::createObjectStore):
+        (WebCore::IDBDatabase::deleteObjectStore):
+        (WebCore::IDBDatabase::transaction):
+        * Modules/indexeddb/IDBDatabaseBackendImpl.cpp:
+        (WebCore::IDBDatabaseBackendImpl::metadata):
+        (WebCore::IDBDatabaseBackendImpl::createObjectStore):
+        (WebCore::IDBDatabaseBackendImpl::objectStore):
+        (WebCore::IDBDatabaseBackendImpl::deleteObjectStore):
+        (WebCore::IDBDatabaseBackendImpl::transaction):
+        (WebCore::IDBDatabaseBackendImpl::loadObjectStores):
+        (WebCore::IDBDatabaseBackendImpl::removeObjectStoreFromMap):
+        (WebCore::IDBDatabaseBackendImpl::addObjectStoreToMap):
+        * Modules/indexeddb/IDBDatabaseBackendImpl.h:
+        (IDBDatabaseBackendImpl):
+        * Modules/indexeddb/IDBDatabaseBackendInterface.h:
+        (IDBDatabaseBackendInterface):
+        * Modules/indexeddb/IDBFactory.cpp:
+        * Modules/indexeddb/IDBFactory.h:
+        * Modules/indexeddb/IDBIndex.h:
+        (WebCore::IDBIndex::openKeyCursor):
+        * Modules/indexeddb/IDBIndexBackendInterface.h:
+        * Modules/indexeddb/IDBKeyPath.cpp:
+        * Modules/indexeddb/IDBMetadata.h:
+        (WebCore):
+        (IDBDatabaseMetadata):
+        (WebCore::IDBDatabaseMetadata::IDBDatabaseMetadata):
+        (IDBObjectStoreMetadata):
+        (WebCore::IDBIndexMetadata::IDBIndexMetadata):
+        (IDBIndexMetadata):
+        * Modules/indexeddb/IDBObjectStore.cpp:
+        (WebCore::IDBObjectStore::indexNames):
+        (WebCore::IDBObjectStore::put):
+        (WebCore::IDBObjectStore::createIndex):
+        (WebCore::IDBObjectStore::index):
+        (WebCore::IDBObjectStore::deleteIndex):
+        * Modules/indexeddb/IDBObjectStoreBackendImpl.cpp:
+        (WebCore::IDBObjectStoreBackendImpl::putWithIndexKeys):
+        (WebCore):
+        (WebCore::makeIndexWriters):
+        (WebCore::IDBObjectStoreBackendImpl::setIndexKeys):
+        (WebCore::IDBObjectStoreBackendImpl::setIndexesReady):
+        (WebCore::IDBObjectStoreBackendImpl::setIndexesReadyInternal):
+        (WebCore::IDBObjectStoreBackendImpl::putInternal):
+        (WebCore::IDBObjectStoreBackendImpl::deleteInternal):
+        (WebCore::IDBObjectStoreBackendImpl::createIndex):
+        (WebCore::IDBObjectStoreBackendImpl::index):
+        (WebCore::IDBObjectStoreBackendImpl::deleteIndex):
+        (WebCore::IDBObjectStoreBackendImpl::loadIndexes):
+        (WebCore::IDBObjectStoreBackendImpl::removeIndexFromMap):
+        (WebCore::IDBObjectStoreBackendImpl::addIndexToMap):
+        * Modules/indexeddb/IDBObjectStoreBackendImpl.h:
+        (IDBObjectStoreBackendImpl):
+        * Modules/indexeddb/IDBObjectStoreBackendInterface.h:
+        * Modules/indexeddb/IDBOpenDBRequest.cpp:
+        (WebCore::IDBOpenDBRequest::onUpgradeNeeded):
+        * Modules/indexeddb/IDBRequest.cpp:
+        (WebCore::IDBRequest::onSuccess):
+        (WebCore::IDBRequest::uncaughtExceptionInEventHandler):
+        * Modules/indexeddb/IDBTransaction.cpp:
+        (WebCore::IDBTransaction::create):
+        (WebCore::IDBTransaction::IDBTransaction):
+        (WebCore::IDBTransaction::objectStore):
+        * Modules/indexeddb/IDBTransaction.h:
+        (IDBTransaction):
+        * Modules/indexeddb/IDBTransactionBackendImpl.cpp:
+        (WebCore::IDBTransactionBackendImpl::create):
+        (WebCore::IDBTransactionBackendImpl::IDBTransactionBackendImpl):
+        (WebCore::IDBTransactionBackendImpl::objectStore):
+        (WebCore::IDBTransactionBackendImpl::scheduleTask):
+        * Modules/indexeddb/IDBTransactionBackendImpl.h:
+        (IDBTransactionBackendImpl):
+        * Modules/indexeddb/IDBTransactionBackendInterface.h:
+        * Modules/indexeddb/IDBTransactionCoordinator.h:
+
+2012-10-31  Alec Flett  <alecflett@chromium.org>
+
+        IndexedDB: add methods to support id-based backend APIs
+        https://bugs.webkit.org/show_bug.cgi?id=100425
+
+        Reviewed by Tony Chang.
+
+        First half of refactor involves adding a number of methods that
+        are int64_t-based rather than String-based. As a part of this, the
+        IDB*Metadata structs and the backend objectStore/index maps all
+        use int64_t as keys, rather than String.
+
+        In addition, there were a number of cleanups that came out of the
+        refactor:
+
+        - The list of object stores active in a transaction is now
+          maintained by the frontend IDBTransaction rather than the backend
+          IDBTransactionBackendImpl. This also had a simplifying rippling
+          effect through other call signatures.
+
+        - I was able to remove an apparently old FIXME from
+          IDBTransactionBackendImpl::objectStore and replace it with an ASSERT.
+
+        - IDBObjectStoreBackendImpl's IndexWriter class got a little
+          simpler since the id is now easily available in the
+          IDBIndexMetadata.
+
+        - A number of methods got simpler in their int64_t versions,
+          specifically dropping a number of ExceptionCodes.
+
+        There is also some glue code
+        (getIndexId/getIndexIds/getObjectStoreId) that will go away with
+        the 2nd half of this: https://bugs.webkit.org/show_bug.cgi?id=100425
+
+        No new tests, no new functionality as this is just a refactor.
+
+        * Modules/indexeddb/IDBDatabase.cpp:
+        (WebCore::IDBDatabase::objectStoreNames):
+        (WebCore::IDBDatabase::createObjectStore):
+        (WebCore::IDBDatabase::deleteObjectStore):
+        (WebCore::IDBDatabase::transaction):
+        * Modules/indexeddb/IDBDatabaseBackendImpl.cpp:
+        (WebCore::IDBDatabaseBackendImpl::metadata):
+        (WebCore::IDBDatabaseBackendImpl::createObjectStore):
+        (WebCore::IDBDatabaseBackendImpl::objectStore):
+        (WebCore::IDBDatabaseBackendImpl::getObjectStoreId):
+        (WebCore):
+        (WebCore::IDBDatabaseBackendImpl::deleteObjectStore):
+        (WebCore::IDBDatabaseBackendImpl::transaction):
+        (WebCore::IDBDatabaseBackendImpl::loadObjectStores):
+        (WebCore::IDBDatabaseBackendImpl::removeObjectStoreFromMap):
+        (WebCore::IDBDatabaseBackendImpl::addObjectStoreToMap):
+        * Modules/indexeddb/IDBDatabaseBackendImpl.h:
+        (WebCore::IDBDatabaseBackendImpl::deleteObjectStore):
+        (IDBDatabaseBackendImpl):
+        * Modules/indexeddb/IDBDatabaseBackendInterface.h:
+        (IDBDatabaseBackendInterface):
+        * Modules/indexeddb/IDBIndex.h:
+        (WebCore::IDBIndex::id):
+        (WebCore::IDBIndex::openKeyCursor):
+        * Modules/indexeddb/IDBIndexBackendInterface.h:
+        * Modules/indexeddb/IDBMetadata.h:
+        (WebCore::IDBIndexMetadata::IDBIndexMetadata):
+        (IDBIndexMetadata):
+        (IDBObjectStoreMetadata):
+        (WebCore::IDBObjectStoreMetadata::containsIndex):
+        (IDBDatabaseMetadata):
+        (WebCore::IDBDatabaseMetadata::IDBDatabaseMetadata):
+        (WebCore::IDBDatabaseMetadata::containsObjectStore):
+        * Modules/indexeddb/IDBObjectStore.cpp:
+        (WebCore::IDBObjectStore::indexNames):
+        (WebCore::IDBObjectStore::put):
+        (WebCore::IDBObjectStore::createIndex):
+        (WebCore::IDBObjectStore::index):
+        (WebCore::IDBObjectStore::deleteIndex):
+        * Modules/indexeddb/IDBObjectStoreBackendImpl.cpp:
+        (WebCore::IDBObjectStoreBackendImpl::put):
+        (WebCore::IDBObjectStoreBackendImpl::putWithIndexKeys):
+        (WebCore):
+        (WebCore::makeIndexWriters):
+        (WebCore::IDBObjectStoreBackendImpl::setIndexKeys):
+        (WebCore::IDBObjectStoreBackendImpl::setIndexesReady):
+        (WebCore::IDBObjectStoreBackendImpl::setIndexesReadyInternal):
+        (WebCore::IDBObjectStoreBackendImpl::putInternal):
+        (WebCore::IDBObjectStoreBackendImpl::deleteInternal):
+        (WebCore::IDBObjectStoreBackendImpl::createIndex):
+        (WebCore::IDBObjectStoreBackendImpl::index):
+        (WebCore::IDBObjectStoreBackendImpl::getIndexId):
+        (WebCore::IDBObjectStoreBackendImpl::getIndexIds):
+        (WebCore::IDBObjectStoreBackendImpl::deleteIndex):
+        (WebCore::IDBObjectStoreBackendImpl::loadIndexes):
+        (WebCore::IDBObjectStoreBackendImpl::removeIndexFromMap):
+        (WebCore::IDBObjectStoreBackendImpl::addIndexToMap):
+        * Modules/indexeddb/IDBObjectStoreBackendImpl.h:
+        (IDBObjectStoreBackendImpl):
+        * Modules/indexeddb/IDBObjectStoreBackendInterface.h:
+        * Modules/indexeddb/IDBOpenDBRequest.cpp:
+        (WebCore::IDBOpenDBRequest::onUpgradeNeeded):
+        * Modules/indexeddb/IDBRequest.cpp:
+        (WebCore::IDBRequest::onSuccess):
+        (WebCore::IDBRequest::uncaughtExceptionInEventHandler):
+        * Modules/indexeddb/IDBTransaction.cpp:
+        (WebCore::IDBTransaction::create):
+        (WebCore::IDBTransaction::IDBTransaction):
+        (WebCore::IDBTransaction::objectStore):
+        * Modules/indexeddb/IDBTransaction.h:
+        (IDBTransaction):
+        * Modules/indexeddb/IDBTransactionBackendImpl.cpp:
+        (WebCore::IDBTransactionBackendImpl::create):
+        (WebCore::IDBTransactionBackendImpl::IDBTransactionBackendImpl):
+        (WebCore::IDBTransactionBackendImpl::objectStore):
+        (WebCore):
+        (WebCore::IDBTransactionBackendImpl::scheduleTask):
+        * Modules/indexeddb/IDBTransactionBackendImpl.h:
+        (IDBTransactionBackendImpl):
+        * Modules/indexeddb/IDBTransactionBackendInterface.h:
+
+2012-10-30  Mark Lam  <mark.lam@apple.com>
+
+        A JSC printf (support for %J+s and %b).
+        https://bugs.webkit.org/show_bug.cgi?id=100566.
+
+        Reviewed by Michael Saboff.
+
+        Added forwarding header for VMInspector.h.
+
+        No new tests needed for this.
+
+        * ForwardingHeaders/interpreter/VMInspector.h: Added.
+
+2012-10-31  Chris Rogers  <crogers@google.com>
+
+        Implement optional arguments in AudioBufferSourceNode start() method
+        https://bugs.webkit.org/show_bug.cgi?id=100894
+
+        Reviewed by Kenneth Russell.
+
+        The start() method should be able to take 1, 2, or 3 arguments, optionally supporting
+        offset and duration.  Currently, only 1 and 3 arguments are supported.
+
+        Test: webaudio/audiobuffersource-start.html
+
+        * Modules/webaudio/AudioBufferSourceNode.cpp:
+        (WebCore::AudioBufferSourceNode::renderFromBuffer):
+        (WebCore::AudioBufferSourceNode::startGrain):
+        (WebCore):
+        * Modules/webaudio/AudioBufferSourceNode.h:
+        (AudioBufferSourceNode):
+        * Modules/webaudio/AudioBufferSourceNode.idl:
+
+2012-10-31  Mike West  <mkwst@chromium.org>
+
+        Implement the canonical "Content-Security-Policy" header.
+        https://bugs.webkit.org/show_bug.cgi?id=96765
+
+        Reviewed by Adam Barth.
+
+        The CSP 1.0 specification defines the "Content-Security-Policy" header
+        as the canonical mechanism of defining a resource's security policy. Up
+        through this patch, we've implemented the functionality behind a prefix
+        in order to ensure compatibility with the standard once it's released as
+        a recommendation. Both the specification and WebKit's implementation are
+        far enough along in that process that it makes sense to support the
+        unprefixed header for sites that wish to opt-in to CSP 1.0.
+
+        As discussed on public-webappsec[1], we'll keep the experimental 1.1
+        features behind the prefixed header ('X-WebKit-CSP') until that standard
+        is far enough along to justify moving them out to the canonical header.
+
+        This patch defines the 'Content-Security-Policy' header for all ports,
+        just as the 'X-WebKit-CSP' header is currently supported on all ports.
+        Ports that have not opted-in to the CSP_NEXT flag will see exactly the
+        same behavior with both headers. Ports that have opted-in will see much
+        of CSP 1.1's current definition on the prefixed header, and CSP 1.0 on
+        the canonical header.
+
+        The functionality in this change is covered by the changes made to
+        existing tests. No expectations changed, only the headers that are sent.
+
+        * dom/Document.cpp:
+        (WebCore::Document::processHttpEquiv):
+            Add canonical header support to 'meta' element definitions.
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::didBeginDocument):
+            Add canonical header support to FrameLoader.
+        * page/ContentSecurityPolicy.cpp:
+        (WebCore::CSPDirectiveList::headerType):
+            The ContentSecurityPolicy::HeaderType enum now has four values:
+            prefixed/report-only, unprefixed/report-only, prefixed/enforce, and
+            unprefixed/enforce. Instead of creating logic to output the proper
+            type based on internal flags, CSPDirectiveList now saves the value
+            provided at creation time, and returns it via this method.
+        (CSPDirectiveList):
+        (WebCore::CSPDirectiveList::CSPDirectiveList):
+            The constructor now accepts a type, which is stored on the object.
+            It also stores a new internal variable, 'm_experimental', which
+            defines whether or not experimental features ought to be available.
+            These features are still locked behind the CSP_NEXT flag, but that
+            might not be the case forever.
+        (WebCore::CSPDirectiveList::create):
+            The static constructor wrapper now passes the type into the real
+            constructor, which also now handles setting its internal variables.
+        (WebCore::CSPDirectiveList::parse):
+            'parse()' is given the header, so it makes sense to store it here as
+            well, rather than in the create wrapper.
+        (WebCore::CSPDirectiveList::addDirective):
+            1.1 directives remain locked behind CSP_NEXT, but now also require
+            that 'm_experimental' is set, signaling usage of the prefixed header
+            and an implicit opt-in to 1.1.
+        * page/ContentSecurityPolicy.h:
+            Added two new types to the HeaderTypes enum: PrefixedReportOnly, and
+            PrefixedEnforcePolicy. These map to 'X-WebKitCSP-Report-Only' and
+            'X-WebKit-CSP', respectively.
+
+2012-10-31  Roger Fong  <roger_fong@apple.com>
+
+        Change PopupMenu positioning on Windows such that behaviour on multiple monitors matches Windows standards.
+        https://bugs.webkit.org/show_bug.cgi?id=100317
+
+        Reviewed by Sam Weinig.
+
+        The existing code determines which screen the popup menu "belongs" to by determining which screen the owning application's hwnd belongs to,
+        where ownership is determined by how much of the hwnd is on which screen.
+        To match what most Windows applications do, the owning screen should be whichever screen the drop down button belongs to.
+        To determine which screen an element belongs to in Windows we need to pass in an hwnd for that element.
+        However, since the drop down button is something that WebKit renders there is no hwnd.
+
+        To remedy this issue, we can temporarily move the popup menu's hwnd to match the position and size of the button,
+        determine the correct screen, and then eventually move it back to the correct final position after the rest of 
+        the calculations have been completed. This is all done in the same function call so no rendering of the popup menu occurs
+        between the temporary and final positionings.
+
+        There's not really a good way of testing popup menus except manually, they're separate hwnds created outside of the WebView.
+
+        * platform/win/PopupMenuWin.cpp:
+        (WebCore::monitorFromHwnd):
+        (WebCore):
+        (WebCore::PopupMenuWin::show):
+        (WebCore::PopupMenuWin::calculatePositionAndSize):
+
+2012-10-31  Thiago Marcos P. Santos  <thiago.santos@intel.com>
+
+        Added viewport at-rule to the CSS parser and tokenizer
+        https://bugs.webkit.org/show_bug.cgi?id=95961
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Add tokens and grammar rules to parse @-webkit-viewport blocks. Also add
+        the newly parsed rule to the rule list.
+
+        This parser now implements the following part of the CSS Device Adaptation
+        specification: http://www.w3.org/TR/css-device-adapt/#syntax
+
+        Test: css3/device-adapt/viewport-at-rule-parsing.html
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * Target.pri:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * css/CSSGrammar.y.in:
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::CSSParser):
+        (WebCore::CSSParser::detectAtToken):
+        (WebCore):
+        (WebCore::CSSParser::createViewportRule):
+        * css/CSSParser.h:
+        (CSSParser):
+        (WebCore::CSSParser::markViewportRuleBodyStart):
+        (WebCore::CSSParser::markViewportRuleBodyEnd):
+        (WebCore::CSSParser::inViewport):
+
+            These methods are needed by the next patch validating the properties.
+            Some viewport properties are common to other rules but have different
+            semantics, and accepts different keywords. The validation needs to be
+            done in a different code path.
+
+        * css/CSSPropertySourceData.h:
+        * css/CSSRule.cpp:
+        (WebCore):
+        (WebCore::CSSRule::cssText):
+        (WebCore::CSSRule::destroy):
+        (WebCore::CSSRule::reattach):
+        (WebCore::CSSRule::reportMemoryUsage):
+        * css/CSSRule.h:
+        (CSSRule):
+        (WebCore::CSSRule::isViewportRule):
+        * css/StyleRule.cpp:
+        (WebCore::StyleRuleBase::reportMemoryUsage):
+        (WebCore::StyleRuleBase::destroy):
+        (WebCore::StyleRuleBase::copy):
+        (WebCore::StyleRuleBase::createCSSOMWrapper):
+        (WebCore):
+        (WebCore::StyleRuleViewport::StyleRuleViewport):
+        (WebCore::StyleRuleViewport::~StyleRuleViewport):
+        (WebCore::StyleRuleViewport::mutableProperties):
+        (WebCore::StyleRuleViewport::setProperties):
+        (WebCore::StyleRuleViewport::reportDescendantMemoryUsage):
+        * css/StyleRule.h:
+        (StyleRuleBase):
+        (WebCore::StyleRuleBase::isViewportRule):
+        (WebCore):
+        (StyleRuleViewport):
+        (WebCore::StyleRuleViewport::create):
+        (WebCore::StyleRuleViewport::properties):
+        (WebCore::StyleRuleViewport::copy):
+        * css/WebKitCSSViewportRule.cpp: Added.
+        (WebCore):
+        (WebCore::WebKitCSSViewportRule::WebKitCSSViewportRule):
+        (WebCore::WebKitCSSViewportRule::~WebKitCSSViewportRule):
+        (WebCore::WebKitCSSViewportRule::style):
+        (WebCore::WebKitCSSViewportRule::cssText):
+        (WebCore::WebKitCSSViewportRule::reattach):
+        (WebCore::WebKitCSSViewportRule::reportDescendantMemoryUsage):
+        * css/WebKitCSSViewportRule.h: Added.
+        (WebCore):
+
+2012-10-31  Max Vujovic  <mvujovic@adobe.com>
+
+        [CSS Shaders] Validate types of built-in uniforms
+        https://bugs.webkit.org/show_bug.cgi?id=98974
+
+        Reviewed by Dean Jackson.
+
+        Reject shaders which define built-in uniforms with the wrong type. For example, we reject a
+        shader with the GLSL code "uniform float u_textureSize;" because u_textureSize should be a
+        vec2, not a float.
+
+        Relevant Spec Section:
+        https://dvcs.w3.org/hg/FXTF/raw-file/tip/filters/index.html#shader-uniform-variables
+
+        Test: css3/filters/custom/invalid-custom-filter-uniform-types.html
+
+        * platform/graphics/filters/CustomFilterValidatedProgram.cpp:
+        (WebCore):
+        (WebCore::builtInUniformNameToTypeMap):
+        (WebCore::validateSymbols):
+
+2012-10-31  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r133044.
+        http://trac.webkit.org/changeset/133044
+        https://bugs.webkit.org/show_bug.cgi?id=100888
+
+        Hits an ASSERT in the isolatedWorlds tests (Requested by
+        abarth on #webkit).
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+        (NeedsToVisitDOMWrapper):
+        (GenerateVisitDOMWrapper):
+        (GenerateHeader):
+        (GenerateImplementation):
+        * bindings/v8/V8GCController.cpp:
+        (WebCore::ObjectVisitor::ObjectVisitor):
+        (WebCore::ObjectVisitor::visitDOMWrapper):
+        (ObjectVisitor):
+        (WebCore::rootForGC):
+        (ImplicitConnection):
+        (WebCore::ImplicitConnection::ImplicitConnection):
+        (WebCore::ImplicitConnection::root):
+        (WebCore::ImplicitConnection::wrapper):
+        (WebCore):
+        (WebCore::operator<):
+        (WebCore::NodeVisitor::NodeVisitor):
+        (WebCore::NodeVisitor::visitNodeWrapper):
+        (NodeVisitor):
+        (WebCore::NodeVisitor::applyGrouping):
+        (WebCore::V8GCController::majorGCPrologue):
+        * bindings/v8/V8GCController.h:
+        (V8GCController):
+        * bindings/v8/WrapperTypeInfo.h:
+        (WebCore):
+        (WebCore::WrapperTypeInfo::visitDOMWrapper):
+        (WrapperTypeInfo):
+        * bindings/v8/custom/V8NodeListCustom.cpp:
+        (WebCore::V8NodeList::visitDOMWrapper):
+        * bindings/v8/custom/V8SpeechRecognitionResultCustom.cpp:
+        (WebCore::V8SpeechRecognitionResult::visitDOMWrapper):
+
+2012-10-31  Philip Rogers  <pdr@google.com>
+
+        Cache animationMode() in SVG animations.
+        https://bugs.webkit.org/show_bug.cgi?id=99694
+
+        Reviewed by Eric Seidel.
+
+        This patch caches animationMode() which accounted for 25% of the CPU time of a simple
+        animation benchmark! This is the 3rd patch for WK99694.
+
+        Background: SVGAnimationElement contains most of the shared animation logic for <animate>,
+        <set>, <animateColor>, <animateTransform>, and <animateMotion>. <animateMotion> is the only
+        animation element that can depend on other elements in the page. For example:
+        <path id="mypath" d="M0 0 L 100 100Z"/> <!-- note, can be animated! -->
+        <rect x="0" y="0" width="100" height="100" fill="green">
+            <animateMotion dur="6s" repeatCount="indefinite">
+                <mpath xlink:href="#mypath"/>
+            </animateMotion>
+        </rect>
+        See: http://www.w3.org/TR/SVG/single-page.html#animate-AnimateMotionElement
+
+        animationMode depends on several properties of an animation element: the set tag, whether
+        the animation has a path, and the "values", "to", and "by" attributes. animationMode() was
+        a hot function for two reasons:
+        1) hasAttribute(SVGNames::valuesAttr) is expensive because we are unable to use
+           fastHasAttribute. This is cacheable by simply calculating the animationMode when the
+           "values" attribute changes.
+        2) In the <animateMotion> case, determining if a path is empty or changed is expensive.
+           AnimateMotion can have a path attribute, or it can have <mpath> children that reference
+           a (possibly non-existent) <path> element elsewhere in the page. Before this patch we did
+           this path lookup on every animation loop in case something changed. After this patch we
+           only update AnimateMotion's path when it changes.
+
+        A previous patch, http://trac.webkit.org/changeset/132847, laid the groundwork for tracking
+        <path> changes in <mpath>. This patch adds <mpath> to our resource tracking infrastructure
+        to track when target <path>s change, instead of looking this up every time.
+
+        This refactoring is covered by existing tests.
+        svg/animations/mozilla/animateMotion-mpath-targetChange-1.svg fails after this patch
+        because our element dependency tracking has a bug with duplicate ids; see WK99893.
+
+        * svg/SVGAnimateMotionElement.cpp:
+        (WebCore::SVGAnimateMotionElement::parseAttribute):
+        (WebCore::SVGAnimateMotionElement::updateAnimationPath):
+
+            animationPath() has been changed to updateAnimationPath() and should only be called
+            when the animation path (path attribute, or mpath's referenced path) has changed.
+
+        (WebCore::SVGAnimateMotionElement::buildTransformForProgress):
+        (WebCore::SVGAnimateMotionElement::updateAnimationMode):
+
+            If an animationPath exists, we use PathAnimation, otherwise we fall back to the normal
+            updateAnimationMode() codepath.
+
+        (WebCore):
+        * svg/SVGAnimateMotionElement.h:
+        (SVGAnimateMotionElement):
+        * svg/SVGAnimationElement.cpp:
+        (WebCore::SVGAnimationElement::SVGAnimationElement):
+        (WebCore::SVGAnimationElement::isSupportedAttribute):
+        (WebCore::SVGAnimationElement::parseAttribute):
+
+            The from, by, and to attributes have been added so that we can track when they change
+            and update the animation mode. Similarly for when the values attribute changes.
+
+        (WebCore::SVGAnimationElement::updateAnimationMode):
+        * svg/SVGAnimationElement.h:
+        (WebCore::SVGAnimationElement::animationMode):
+        (SVGAnimationElement):
+        (WebCore::SVGAnimationElement::setAnimationMode):
+        (WebCore::SVGAnimationElement::calculateDistance):
+        * svg/SVGMPathElement.cpp:
+        (WebCore::SVGMPathElement::buildPendingResource):
+
+            It would be nice to move all the duplicated buildPendingResource() logic into a central
+            place (SVGURIReference?) but for now it is copied. This function is nearly identical to
+            SVGFEImageElement::buildPendingResource.
+
+        (WebCore):
+        (WebCore::SVGMPathElement::clearResourceReferences):
+        (WebCore::SVGMPathElement::insertedInto):
+        (WebCore::SVGMPathElement::removedFrom):
+        (WebCore::SVGMPathElement::svgAttributeChanged):
+        (WebCore::SVGMPathElement::targetPathChanged):
+        (WebCore::SVGMPathElement::notifyParentOfPathChange):
+        * svg/SVGMPathElement.h:
+        (SVGMPathElement):
+        * svg/SVGPathElement.cpp:
+
+            When a <path>'s path changes, we need to notify any dependent <mpath> elements. This is
+            typically handled with RenderSVGResource::markForLayoutAndParentResourceInvalidation
+            but for the special-case of <mpath> we only need to track when the path's "d" attribute
+            changes so invalidateMPathDependencies() has been added.
+
+        (WebCore::SVGPathElement::svgAttributeChanged):
+        (WebCore::SVGPathElement::invalidateMPathDependencies):
+        (WebCore):
+        (WebCore::SVGPathElement::insertedInto):
+        (WebCore::SVGPathElement::removedFrom):
+        * svg/SVGPathElement.h:
+        (SVGPathElement):
+        * svg/SVGSetElement.cpp:
+        (WebCore::SVGSetElement::SVGSetElement):
+        (WebCore::SVGSetElement::updateAnimationMode):
+        (WebCore):
+        * svg/SVGSetElement.h:
+        (SVGSetElement):
+        * svg/animation/SVGSMILElement.cpp:
+        (WebCore::SVGSMILElement::isSupportedAttribute):
+
+2012-10-31  Beth Dakin  <bdakin@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=100879
+        ScrollingStateNode::cloneAndResetNode() should not be virtual
+
+        Reviewed by Simon Fraser.
+
+        cloneAndResetNode() is currently pure virtual and implemented only 
+        in ScrollingStateScrollingNode. However, all of the work that it 
+        does at this time is stuff that a generic ScrollingStateNode could 
+        do. We should move this implementation to the base class so that it 
+        does not need to be duplicated for future node types.
+
+        This patch also re-names cloneAndResetNode() to cloneAndReset()
+        and correspondingly re-names cloneAndResetChildNodes() to 
+        cloneAndResetChildren(). 
+
+        Finally the patch also changes the copy constructors of both of these 
+        classes to take a const reference instead of a pointer.
+
+        * page/scrolling/ScrollingStateNode.cpp:
+        (WebCore::ScrollingStateNode::ScrollingStateNode):
+        (WebCore::ScrollingStateNode::cloneAndReset):
+        (WebCore):
+        (WebCore::ScrollingStateNode::cloneAndResetChildren):
+        * page/scrolling/ScrollingStateNode.h:
+        (ScrollingStateNode):
+        * page/scrolling/ScrollingStateScrollingNode.cpp:
+        (WebCore::ScrollingStateScrollingNode::ScrollingStateScrollingNode):
+        (WebCore):
+        * page/scrolling/ScrollingStateScrollingNode.h:
+        (ScrollingStateScrollingNode):
+        * page/scrolling/ScrollingStateTree.cpp:
+        (WebCore::ScrollingStateTree::commit):
+
+2012-10-31  Tom Sepez  <tsepez@chromium.org>
+        
+        Malformed X-XSS-Protection headers not reported.
+        https://bugs.webkit.org/show_bug.cgi?id=100538
+
+        Reviewed by Adam Barth.
+
+        Re-writes X-XSS-Protection header parser to be more particular, and to
+        return better information on error.
+
+        Tests: http/tests/security/xssAuditor/malformed-xss-protection-header-1.html
+               http/tests/security/xssAuditor/malformed-xss-protection-header-2.html
+               http/tests/security/xssAuditor/malformed-xss-protection-header-4.html
+               http/tests/security/xssAuditor/xss-protection-parsing-02.html
+
+        * html/parser/XSSAuditor.cpp:
+        (WebCore::XSSAuditor::init):
+        Detect error return code and log console message with details
+        * platform/network/HTTPParsers.cpp:
+        (WebCore):
+        (WebCore::skipWhiteSpace):
+        Use safe less-than comparsion in case called with pos already out of range.
+        (WebCore::skipToken):
+        Fix comparison to properly reject substrings at end of input.  Prevent advancing
+        returned position when match fails, so that this may someday be used to match
+        optional tokens.
+        (WebCore::parseXSSProtectionHeader):
+        Return detailled error status. Avoid needless string copy.
+        * platform/network/HTTPParsers.h:
+        Add new error returns for x-xss-protection header parser.
+        
+2012-10-31  Simon Fraser  <simon.fraser@apple.com>
+
+        REGRESSION (tile cache layers): bits of tiled layers are missing with certain 3D transforms
+        https://bugs.webkit.org/show_bug.cgi?id=100808
+        <rdar://problem/12562541>
+
+        Reviewed by Dean Jackson.
+
+        When projecting rects down into transformed layers, the projection can fail with severe
+        3D rotations if the computed w component in TransformationMatrix::projectPoint() is negative.
+        In this case we already clamp, but the fact that we clamped doesn't make it out to
+        GraphicsLayerCA::computeVisibleRect() which resulted in incorrect visible rects being
+        computed.
+        
+        Fix by propagating the fact that clamping occurred out of the TransformState functions
+        which can clamp. In computeVisibleRect(), simply consider the entire layer bounds
+        to be visible if clamping occurred.
+
+        Tests: compositing/tiling/rotated-tiled-clamped.html
+               compositing/tiling/rotated-tiled-preserve3d-clamped.html
+
+        * platform/graphics/ca/GraphicsLayerCA.cpp:
+        (WebCore::GraphicsLayerCA::computeVisibleRect): If either the applyTransform()
+        or the state.mappedQuad() clamped, use our bounds as the visible rect.
+        * platform/graphics/transforms/TransformState.cpp:
+        (WebCore::TransformState::applyTransform): Pass out clamping state.
+        (WebCore::TransformState::flatten): Ditto.
+        (WebCore::TransformState::mappedPoint): Ditto.
+        (WebCore::TransformState::mappedQuad): Ditto.
+        (WebCore::TransformState::flattenWithTransform): Ditto. No need to initialize
+        wasClamped, since this function is internal.
+        * platform/graphics/transforms/TransformState.h:
+        (TransformState):
+        * platform/graphics/transforms/TransformationMatrix.cpp:
+        (WebCore::TransformationMatrix::projectQuad): If any point projection clamped,
+        set the flag to say we clamped.
+        * platform/graphics/transforms/TransformationMatrix.h:
+        (TransformationMatrix):
+
+2012-10-31  Tiancheng Jiang  <tijiang@rim.com>
+
+        Change bubble message style to BB10 UX spec.
+        https://bugs.webkit.org/show_bug.cgi?id=100862
+
+        Reviewed by Rob Buis.
+
+        RIM PR 198108
+        Internal Reviewed by Otto Cheung.
+        No new tests.
+
+        * css/themeBlackBerry.css:
+        (::-webkit-validation-bubble-message): Added.
+        (::-webkit-validation-bubble-arrow): Added.
+        (::-webkit-validation-bubble-heading): Added.
+
+2012-10-31  Mike West  <mkwst@chromium.org>
+
+        Prefer document->addConsoleMessage to document->domWindow->console->addMessage.
+        https://bugs.webkit.org/show_bug.cgi?id=100850
+
+        Reviewed by Adam Barth.
+
+        For historical reasons, a few places in WebCore talk to Console directly
+        via 'document()->domWindow()->console()->addMessage(...)'. This is more
+        safely wrapped by calling 'addConsoleMessage' on the Document itself.
+
+        No visible functionality should change; we'll simply avoid potential
+        null dereferences in the future.
+
+        * html/HTMLFormElement.cpp:
+        (WebCore::HTMLFormElement::validateInteractively):
+        * html/canvas/WebGLRenderingContext.cpp:
+        (WebCore):
+        (WebCore::WebGLRenderingContext::printWarningToConsole):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::reportLocalLoadFailed):
+        * loader/MixedContentChecker.cpp:
+        (WebCore::MixedContentChecker::logWarning):
+        * loader/appcache/ApplicationCacheGroup.cpp:
+        (WebCore::ApplicationCacheGroup::abort):
+        (WebCore::ApplicationCacheGroup::didReceiveResponse):
+        (WebCore::ApplicationCacheGroup::didFinishLoading):
+        (WebCore::ApplicationCacheGroup::didFail):
+        (WebCore::ApplicationCacheGroup::didReceiveManifestResponse):
+        (WebCore::ApplicationCacheGroup::didFinishLoadingManifest):
+        (WebCore::ApplicationCacheGroup::checkIfLoadIsComplete):
+        * loader/cache/CachedResourceLoader.cpp:
+        (WebCore::CachedResourceLoader::printAccessDeniedMessage):
+
+2012-10-31  Pavel Feldman  <pfeldman@chromium.org>
+
+        Web Inspector: frame chooser does not work on subsequent inspector open.
+        https://bugs.webkit.org/show_bug.cgi?id=100771
+
+        Reviewed by Yury Semikhatsky.
+
+        - Make WorkerRuntimeAgent and PageRuntimeAgent register themselves in the instrumenting agents independently
+        - Move pause / run worker handling from InspectorRuntimeAgent into WorkerRuntimeAgent
+        - Remove remains of the front-end reused signal from InspectorAgent
+        - Send execution contexts post clear window object instead of post commit load.
+
+        * inspector/InspectorAgent.cpp:
+        (WebCore::InspectorAgent::InspectorAgent):
+        (WebCore::InspectorAgent::clearFrontend):
+        (WebCore::InspectorAgent::didCommitLoad):
+        * inspector/InspectorAgent.h:
+        (InspectorAgent):
+        * inspector/InspectorInstrumentation.cpp:
+        (WebCore):
+        (WebCore::InspectorInstrumentation::didClearWindowObjectInWorldImpl):
+        (WebCore::InspectorInstrumentation::willEvaluateWorkerScript):
+        * inspector/InspectorInstrumentation.h:
+        (InspectorInstrumentation):
+        * inspector/InspectorPageAgent.cpp:
+        (WebCore::InspectorPageAgent::restore):
+        * inspector/InspectorRuntimeAgent.cpp:
+        (WebCore::InspectorRuntimeAgent::InspectorRuntimeAgent):
+        (WebCore::InspectorRuntimeAgent::~InspectorRuntimeAgent):
+        (WebCore::InspectorRuntimeAgent::run):
+        (WebCore::InspectorRuntimeAgent::setScriptDebugServer):
+        * inspector/InspectorRuntimeAgent.h:
+        (InspectorRuntimeAgent):
+        * inspector/InstrumentingAgents.h:
+        (WebCore):
+        (WebCore::InstrumentingAgents::InstrumentingAgents):
+        (WebCore::InstrumentingAgents::workerRuntimeAgent):
+        (WebCore::InstrumentingAgents::setWorkerRuntimeAgent):
+        (InstrumentingAgents):
+        * inspector/PageRuntimeAgent.cpp:
+        (WebCore::PageRuntimeAgent::PageRuntimeAgent):
+        (WebCore::PageRuntimeAgent::~PageRuntimeAgent):
+        (WebCore::PageRuntimeAgent::setFrontend):
+        (WebCore::PageRuntimeAgent::clearFrontend):
+        (WebCore::PageRuntimeAgent::enable):
+        (WebCore::PageRuntimeAgent::didCreateMainWorldContext):
+        * inspector/PageRuntimeAgent.h:
+        (PageRuntimeAgent):
+        * inspector/WorkerRuntimeAgent.cpp:
+        (WebCore::WorkerRuntimeAgent::WorkerRuntimeAgent):
+        (WebCore::WorkerRuntimeAgent::~WorkerRuntimeAgent):
+        (WebCore::WorkerRuntimeAgent::run):
+        (WebCore):
+        (WebCore::WorkerRuntimeAgent::pauseWorkerContext):
+        * inspector/WorkerRuntimeAgent.h:
+        (WorkerRuntimeAgent):
+
+2012-10-31  Kondapally Kalyan  <kalyan.kondapally@intel.com>
+
+        [Qt][EFL][AC][WK2]TextureMapperLayer backing store contents are drawn upside down on screen.
+        https://bugs.webkit.org/show_bug.cgi?id=100845.
+
+        Reviewed by Noam Rosenthal.
+
+        WebGL displays the Canvas with (0,0) being the bottom left corner.
+        In GraphicsSurface::platformPaintToTextureMapper we don't set ShouldFlipTexture
+        flag before painting to TextureMapper.
+        It results in backing store contents being drawn upside down on screen.
+        This patch enables ShouldFlipTexture flag when TextureMapperLayer renders 
+        it's backing store contents into a TextureMapper.
+
+        * platform/graphics/surfaces/qt/GraphicsSurfaceGLX.cpp:
+        (WebCore::GraphicsSurface::platformPaintToTextureMapper):
+
+2012-10-31  Noam Rosenthal  <noam.rosenthal@nokia.com>
+
+        [Texmap] Enable filter animations in GraphicsLayerAnimation
+        https://bugs.webkit.org/show_bug.cgi?id=100318
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Use the same method of animating filters in WebCore to animate filters for TextureMapper.
+        Added the appropriate methods to GraphicsLayerAnimation and TextureMapperLayer.
+
+        Tested by LayoutTests/css3/filters/filter-animation-hw.html and other tests.
+
+        * platform/graphics/GraphicsLayerAnimation.cpp:
+        (WebCore):
+        (WebCore::blendFunc):
+        (WebCore::applyFilterAnimation):
+        (WebCore::GraphicsLayerAnimation::applyInternal):
+        * platform/graphics/GraphicsLayerAnimation.h:
+        (Client):
+        * platform/graphics/texmap/TextureMapperLayer.cpp:
+        (WebCore::TextureMapperLayer::intermediateSurfaceRect):
+        (WebCore::TextureMapperLayer::shouldPaintToIntermediateSurface):
+        (WebCore::TextureMapperLayer::paintRecursive):
+        (WebCore::TextureMapperLayer::syncAnimations):
+        * platform/graphics/texmap/TextureMapperLayer.h:
+        (TextureMapperLayer):
+        (WebCore::TextureMapperLayer::setFilters):
+        (WebCore::TextureMapperLayer::setAnimatedFilters):
+
+2012-10-31  Adam Barth  <abarth@webkit.org>
+
+        [V8] Garbage collection should use opaque roots rather than implicit references
+        https://bugs.webkit.org/show_bug.cgi?id=100707
+
+        Reviewed by Kentaro Hara.
+
+        This patch replaces visitDOMWrapper with opaqueRootForGC. The
+        former used to inform V8 of implicit relationships between wrapper
+        objects on a per-wrapper basis. That meant that we needed to know which
+        DOMDataStore a given wrapper was in during garbage collection.
+
+        After this patch, we now use object groups rather than implicit
+        references to inform V8 of these relationships. That has two benefits:
+
+        1) We no longer need to know which DOMDataStore a wrapper belongs
+           because we don't need to find the exact source wrapper for the
+           implicit connection.
+
+        2) We can now handle more complicated implicit relationships, for
+           example when some of the intervening objects haven't had their
+           JavaScript wrappers created yet.
+
+        This patch also unlocks to paths of future development:
+        A) Fixing the remaining failures in fast/dom/gc-9.html
+        B) Enumerating DOM wrappers entirely from V8 rather than from the
+           DOMWrapperMaps (so that we can move more object towards using
+           IntrusiveDOMWrapperMaps, which aren't enumerable from WebCore).
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+        (NeedsCustomOpaqueRootForGC):
+        (GenerateOpaqueRootForGC):
+        (GenerateHeader):
+        (GenerateImplementation):
+        * bindings/v8/V8GCController.cpp:
+        (ImplicitConnection):
+        (WebCore::ImplicitConnection::ImplicitConnection):
+        (WebCore::ImplicitConnection::root):
+        (WebCore::ImplicitConnection::wrapper):
+        (WebCore):
+        (WebCore::operator<):
+        (WrapperGrouper):
+        (WebCore::WrapperGrouper::WrapperGrouper):
+        (WebCore::WrapperGrouper::addToGroup):
+        (WebCore::WrapperGrouper::keepAlive):
+        (WebCore::WrapperGrouper::apply):
+        (WebCore::ObjectVisitor::ObjectVisitor):
+        (WebCore::ObjectVisitor::visitDOMWrapper):
+        (ObjectVisitor):
+        (WebCore::V8GCController::opaqueRootForGC):
+        (WebCore::NodeVisitor::NodeVisitor):
+        (WebCore::NodeVisitor::visitNodeWrapper):
+        (NodeVisitor):
+        (WebCore::V8GCController::majorGCPrologue):
+        * bindings/v8/V8GCController.h:
+        (WebCore):
+        (V8GCController):
+        * bindings/v8/WrapperTypeInfo.h:
+        (WebCore):
+        (WebCore::WrapperTypeInfo::opaqueRootForGC):
+        (WrapperTypeInfo):
+        * bindings/v8/custom/V8NodeListCustom.cpp:
+        (WebCore::V8NodeList::opaqueRootForGC):
+        * bindings/v8/custom/V8SpeechRecognitionResultCustom.cpp:
+        (WebCore::V8SpeechRecognitionResult::opaqueRootForGC):
+
+2012-10-31  Alexei Filippov  <alph@chromium.org>
+
+        Web Inspector: Add total node to native memory snapshot tree
+        https://bugs.webkit.org/show_bug.cgi?id=100843
+
+        Reviewed by Yury Semikhatsky.
+
+        * inspector/front-end/NativeMemorySnapshotView.js:
+        (WebInspector.NativeSnapshotDataGrid):
+        (WebInspector.NativeSnapshotNode):
+        (WebInspector.MemoryBlockViewProperties._initialize):
+
+2012-10-31  Arpita Bahuguna  <arpitabahuguna@gmail.com>
+
+        Table with percentage column widths doesn't scale to fill the entire width of a table containing it
+        https://bugs.webkit.org/show_bug.cgi?id=11645
+
+        Reviewed by Julien Chaffraix.
+
+        When the inner (or nested) table has auto width and column(s) with
+        percent width, we should scale our column(s) to the width of the
+        containing table (unless it has auto width).
+
+        Test: fast/table/scale-nested-percent-width-cols.html
+
+        * rendering/AutoTableLayout.cpp:
+        (WebCore::shouldScaleColumns):
+        If the containing table width was of percent type, we were disallowing
+        our inner or nested table's column from scaling to the size of the parent
+        table. We should prohibit the scaling of the nested table columns only
+        if the parent table has auto width.
+
+2012-10-31  Ian Vollick  <vollick@chromium.org>
+
+        Add support for text-based repaint testing
+        https://bugs.webkit.org/show_bug.cgi?id=100584
+
+        Reviewed by Simon Fraser.
+
+        Allows tracked repaint rects to be dumped as text.
+
+        The following layout tests have been converted:
+          fast/repaint/layer-full-repaint.html
+          fast/repaint/overflow-flipped-writing-mode-table.html
+
+        * WebCore.exp.in:
+          Exports for:
+            FrameView::setTracksRepaints(bool)
+            Frame::trackedRepaintRectsAsText() const
+        * page/Frame.cpp:
+        (WebCore::Frame::trackedRepaintRectsAsText):
+          Returns a string containing information on all tracked repaint rects.
+        * page/FrameView.cpp:
+        (WebCore::FrameView::setTracksRepaints):
+          Rather than calling m_trackedRepaintRects.clear() directly, I've
+          called resetTrackedRepaints(). This will allow us to do more
+          sophisticated resetting when we start tracking repaint rects for
+          composited layers.
+        (WebCore::FrameView::trackedRepaintRectsAsText):
+          Provides the string returned by Frame::trackedRepaintRectsAsText.
+        * testing/Internals.cpp:
+        (WebCore::Internals::repaintRectsAsText):
+          Returns Frame::trackedRepaintRectsAsText.
+        (WebCore):
+        (WebCore::Internals::startTrackingRepaints):
+          Calls FrameView::setTracksRepaints(true)
+        (WebCore::Internals::stopTrackingRepaints):
+          Calls FrameView::setTracksRepaints(false)
+        * testing/Internals.h:
+        * testing/Internals.idl:
+          Declarations for:
+            repaintRectsAsText
+            startTrackingRepaints
+            stopTrackingRepaints
+
+2012-10-31  Yury Semikhatsky  <yurys@chromium.org>
+
+        Web Inspector: page crash when pausing in dedicated worker
+        https://bugs.webkit.org/show_bug.cgi?id=100837
+
+        Reviewed by Pavel Feldman.
+
+        Pass debugger agent to InjectedScriptHost::init in case of workers.
+
+        Test: inspector-protocol/debugger-pause-dedicated-worker.html
+
+        * inspector/WorkerInspectorController.cpp:
+        (WebCore::WorkerInspectorController::WorkerInspectorController):
+
+2012-10-31  Zoltan Nyul  <zoltan.nyul@intel.com>
+
+        perspective-origin should ignore values with more then two lengths and use the default values
+        https://bugs.webkit.org/show_bug.cgi?id=100835
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Perspective-origin should ignore values with more then two lengths
+        (http://www.w3.org/TR/css3-transforms/#perspective-origin) and use
+        the default values instead of parsing it as an unlimited-length list,
+        of which all but the first two values are ignored. This makes perspective-origin 
+        behave similar to transform-origin which uses default value in this case,
+        as well as firefox does the same.
+
+        Test: transforms/2d/computed-style-origin.html
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parsePerspectiveOrigin):
+
+2012-10-31  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r133016.
+        http://trac.webkit.org/changeset/133016
+        https://bugs.webkit.org/show_bug.cgi?id=100856
+
+        broke compile-webkit on several bots (Requested by podivilov
+        on #webkit).
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * Target.pri:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * dom/DeviceOrientationClient.h:
+        (DeviceOrientationClient):
+        * dom/DeviceOrientationController.cpp:
+        (WebCore::DeviceOrientationController::DeviceOrientationController):
+        (WebCore):
+        (WebCore::DeviceOrientationController::~DeviceOrientationController):
+        (WebCore::DeviceOrientationController::timerFired):
+        (WebCore::DeviceOrientationController::addListener):
+        (WebCore::DeviceOrientationController::removeListener):
+        (WebCore::DeviceOrientationController::removeAllListeners):
+        (WebCore::DeviceOrientationController::suspendEventsForAllListeners):
+        (WebCore::DeviceOrientationController::resumeEventsForAllListeners):
+        (WebCore::DeviceOrientationController::didChangeDeviceOrientation):
+        (WebCore::DeviceOrientationController::supplementName):
+        * dom/DeviceOrientationController.h:
+        (WebCore):
+        (DeviceOrientationController):
+        (WebCore::DeviceOrientationController::isActive):
+        (WebCore::DeviceOrientationController::client):
+        (WebCore::DeviceOrientationController::from):
+        * dom/Document.cpp:
+        (WebCore::Document::suspendActiveDOMObjects):
+        (WebCore::Document::resumeActiveDOMObjects):
+        * loader/EmptyClients.h:
+        (WebCore::EmptyDeviceOrientationClient::startUpdating):
+        (WebCore::EmptyDeviceOrientationClient::stopUpdating):
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::addEventListener):
+        (WebCore::DOMWindow::removeEventListener):
+        (WebCore::DOMWindow::removeAllEventListeners):
+        * page/DeviceClient.h: Removed.
+        * page/DeviceController.cpp: Removed.
+        * page/DeviceController.h: Removed.
+
+2012-10-31  Antti Koivisto  <antti@apple.com>
+
+        Remove stray calls to mutableAttributeData()
+        https://bugs.webkit.org/show_bug.cgi?id=100849
+
+        Reviewed by Andreas Kling.
+
+        Changing the cached class attribute value does not require mutable attribute data.
+
+        * dom/Element.cpp:
+        (WebCore::Element::classAttributeChanged):
+        * dom/ElementAttributeData.h:
+        (WebCore::ElementAttributeData::clearClass):
+        
+            Make const like setClass().
+
+2012-10-31  Mike West  <mkwst@chromium.org>
+
+        X-Frame-Options console message should be associated with a request.
+        https://bugs.webkit.org/show_bug.cgi?id=100735
+
+        Reviewed by Pavel Feldman.
+
+        In 99941, we added the possibility to tie console messages to requests,
+        which enables automatic generation of stack traces, line numbers, etc.
+        making the error simpler to diagnose for web developers. This patch
+        uses the piping laid in that patch to improve the console message
+        generated when a document is blocked by X-Frame-Options.
+
+        No new tests; the functionality is covered by changes to existing tests.
+
+        * dom/Document.cpp:
+        (WebCore::Document::processHttpEquiv):
+            Grab the request identifier from the currently active DocumentLoader
+            and pass it into the console message.
+        * loader/MainResourceLoader.cpp:
+        (WebCore::MainResourceLoader::didReceiveResponse):
+            Grab the request identifier from the MainResourceLoader, and pass it
+            into the console message.
+
+2012-10-31  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r133015.
+        http://trac.webkit.org/changeset/133015
+        https://bugs.webkit.org/show_bug.cgi?id=100847
+
+        broke Apple Win Debug compilation (Requested by podivilov on
+        #webkit).
+
+        * inspector/InspectorAgent.cpp:
+        (WebCore::InspectorAgent::InspectorAgent):
+        (WebCore::InspectorAgent::clearFrontend):
+        (WebCore::InspectorAgent::didCommitLoad):
+        * inspector/InspectorAgent.h:
+        (WebCore::InspectorAgent::didCommitLoadFired):
+        (InspectorAgent):
+        * inspector/InspectorInstrumentation.cpp:
+        (WebCore):
+        (WebCore::InspectorInstrumentation::didClearWindowObjectInWorldImpl):
+        (WebCore::InspectorInstrumentation::willEvaluateWorkerScript):
+        (WebCore::InspectorInstrumentation::runtimeAgentEnabled):
+        * inspector/InspectorInstrumentation.h:
+        (InspectorInstrumentation):
+        * inspector/InspectorPageAgent.cpp:
+        (WebCore::InspectorPageAgent::restore):
+        * inspector/InspectorRuntimeAgent.cpp:
+        (WebCore::InspectorRuntimeAgent::InspectorRuntimeAgent):
+        (WebCore::InspectorRuntimeAgent::~InspectorRuntimeAgent):
+        (WebCore::InspectorRuntimeAgent::run):
+        (WebCore):
+        (WebCore::InspectorRuntimeAgent::pauseWorkerContext):
+        * inspector/InspectorRuntimeAgent.h:
+        (InspectorRuntimeAgent):
+        * inspector/InstrumentingAgents.h:
+        (WebCore):
+        (WebCore::InstrumentingAgents::InstrumentingAgents):
+        (WebCore::InstrumentingAgents::inspectorRuntimeAgent):
+        (WebCore::InstrumentingAgents::setInspectorRuntimeAgent):
+        (InstrumentingAgents):
+        * inspector/PageRuntimeAgent.cpp:
+        (WebCore::PageRuntimeAgent::PageRuntimeAgent):
+        (WebCore::PageRuntimeAgent::~PageRuntimeAgent):
+        (WebCore::PageRuntimeAgent::setFrontend):
+        (WebCore::PageRuntimeAgent::clearFrontend):
+        (WebCore::PageRuntimeAgent::enable):
+        (WebCore::PageRuntimeAgent::didClearWindowObject):
+        * inspector/PageRuntimeAgent.h:
+        (PageRuntimeAgent):
+        * inspector/WorkerRuntimeAgent.cpp:
+        (WebCore::WorkerRuntimeAgent::WorkerRuntimeAgent):
+        (WebCore::WorkerRuntimeAgent::~WorkerRuntimeAgent):
+        * inspector/WorkerRuntimeAgent.h:
+        (WorkerRuntimeAgent):
+
+2012-10-31  Kihong Kwon  <kihong.kwon@samsung.com>
+
+        Add DeviceController base-class to remove duplication of DeviceXXXControler
+        https://bugs.webkit.org/show_bug.cgi?id=96894
+
+        Reviewed by Hajime Morita.
+
+        Add DeviceController which is extracted from DeviceOrientationController to remove duplication.
+        And soon-to-be-added DeviceMotionController and ProximityController.
+
+        Covered by existing tests.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * Target.pri:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * dom/DeviceOrientationClient.h:
+        * dom/DeviceOrientationController.cpp:
+        Remove member functions to move to DeviceController.
+        - addListener(), removeListener(), removeAllListeners(), isActive()
+        (WebCore::DeviceOrientationController::DeviceOrientationController):
+        (WebCore::DeviceOrientationController::didChangeDeviceOrientation):
+        (WebCore::DeviceOrientationController::client):
+        (WebCore::DeviceOrientationController::hasLastData):
+        (WebCore::DeviceOrientationController::getLastEvent):
+        (WebCore::DeviceOrientationController::from):
+        (WebCore):
+        * dom/DeviceOrientationController.h:
+        (WebCore):
+        (WebCore::DeviceOrientationController::~DeviceOrientationController):
+        (DeviceOrientationController):
+        * dom/Document.cpp:
+        Remove suspendEventsForAllListeners() and resumeEventsForAllListeners() function calls.
+        These calls can be made by checking activeDOMObjectsAreSuspended() and activeDOMObjectsAreStopped() before dispatchEvent.
+        (WebCore::Document::suspendActiveDOMObjects):
+        (WebCore::Document::resumeActiveDOMObjects):
+        * loader/EmptyClients.h:
+        (EmptyDeviceClient):
+        (WebCore::EmptyDeviceClient::startUpdating):
+        (WebCore::EmptyDeviceClient::stopUpdating):
+        (WebCore):
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::addEventListener):
+        (WebCore::DOMWindow::removeEventListener):
+        (WebCore::DOMWindow::removeAllEventListeners):
+        * page/DeviceClient.h: Added.
+        (WebCore):
+        (DeviceClient):
+        (WebCore::DeviceClient::~DeviceClient):
+        * page/DeviceController.cpp: Added.
+        DeviceController has extracted functions from DeviceOrientationController and DeviceMotionController.
+        - addDeviceEventListener(), removeDeviceEventlistener(), removeAllDeviceEventListeners(), dispatchDeviceEvent()
+        All kind of device event controller which has DeviceClient can be inherited from DeviceController.
+        (WebCore):
+        (WebCore::DeviceController::DeviceController):
+        (WebCore::DeviceController::addDeviceEventListener):
+        (WebCore::DeviceController::removeDeviceEventListener):
+        (WebCore::DeviceController::removeAllDeviceEventListeners):
+        (WebCore::DeviceController::dispatchDeviceEvent):
+        (WebCore::DeviceController::fireDeviceEvent):
+        * page/DeviceController.h: Added.
+        (WebCore):
+        (DeviceController):
+        (WebCore::DeviceController::~DeviceController):
+        (WebCore::DeviceController::isActive):
+        (WebCore::DeviceController::client):
+        (WebCore::DeviceController::hasLastData):
+        (WebCore::DeviceController::getLastEvent):
+
+2012-10-31  Pavel Feldman  <pfeldman@chromium.org>
+
+        Web Inspector: frame chooser does not work on subsequent inspector open.
+        https://bugs.webkit.org/show_bug.cgi?id=100771
+
+        Reviewed by Yury Semikhatsky.
+
+        - Make WorkerRuntimeAgent and PageRuntimeAgent register themselves in the instrumenting agents independently
+        - Move pause / run worker handling from InspectorRuntimeAgent into WorkerRuntimeAgent
+        - Remove remains of the front-end reused signal from InspectorAgent
+        - Send execution contexts post clear window object instead of post commit load.
+
+        * inspector/InspectorAgent.cpp:
+        (WebCore::InspectorAgent::InspectorAgent):
+        (WebCore::InspectorAgent::clearFrontend):
+        (WebCore::InspectorAgent::didCommitLoad):
+        * inspector/InspectorAgent.h:
+        (InspectorAgent):
+        * inspector/InspectorInstrumentation.cpp:
+        (WebCore):
+        (WebCore::InspectorInstrumentation::didClearWindowObjectInWorldImpl):
+        (WebCore::InspectorInstrumentation::willEvaluateWorkerScript):
+        * inspector/InspectorInstrumentation.h:
+        (InspectorInstrumentation):
+        * inspector/InspectorPageAgent.cpp:
+        (WebCore::InspectorPageAgent::restore):
+        * inspector/InspectorRuntimeAgent.cpp:
+        (WebCore::InspectorRuntimeAgent::InspectorRuntimeAgent):
+        (WebCore::InspectorRuntimeAgent::~InspectorRuntimeAgent):
+        (WebCore::InspectorRuntimeAgent::run):
+        (WebCore::InspectorRuntimeAgent::setScriptDebugServer):
+        * inspector/InspectorRuntimeAgent.h:
+        (InspectorRuntimeAgent):
+        * inspector/InstrumentingAgents.h:
+        (WebCore):
+        (WebCore::InstrumentingAgents::InstrumentingAgents):
+        (WebCore::InstrumentingAgents::workerRuntimeAgent):
+        (WebCore::InstrumentingAgents::setWorkerRuntimeAgent):
+        (InstrumentingAgents):
+        * inspector/PageRuntimeAgent.cpp:
+        (WebCore::PageRuntimeAgent::PageRuntimeAgent):
+        (WebCore::PageRuntimeAgent::~PageRuntimeAgent):
+        (WebCore::PageRuntimeAgent::setFrontend):
+        (WebCore::PageRuntimeAgent::clearFrontend):
+        (WebCore::PageRuntimeAgent::enable):
+        (WebCore::PageRuntimeAgent::didCreateMainWorldContext):
+        * inspector/PageRuntimeAgent.h:
+        (PageRuntimeAgent):
+        * inspector/WorkerRuntimeAgent.cpp:
+        (WebCore::WorkerRuntimeAgent::WorkerRuntimeAgent):
+        (WebCore::WorkerRuntimeAgent::~WorkerRuntimeAgent):
+        (WebCore::WorkerRuntimeAgent::run):
+        (WebCore):
+        (WebCore::WorkerRuntimeAgent::pauseWorkerContext):
+        * inspector/WorkerRuntimeAgent.h:
+        (WorkerRuntimeAgent):
+
+2012-10-31  Keishi Hattori  <keishi@webkit.org>
+
+        Calendar picker can flicker when opened from the suggestion picker
+        https://bugs.webkit.org/show_bug.cgi?id=100816
+
+        Reviewed by Kent Tamura.
+
+        Calendar picker was opening before the hiding completed.
+
+        No new tests. Added test to date-suggestion-picker-key-operations.html.
+
+        * Resources/pagepopups/pickerCommon.js: Added didHide event.
+        * Resources/pagepopups/suggestionPicker.js:
+        (SuggestionPicker.prototype.selectEntry): Use didHide event so we don't open the calendar picker prematurely.
+        (SuggestionPicker._handleWindowDidHide): When the window finished hiding, open the calendar picker.
+
+2012-10-31  Allan Sandfeld Jensen  <allan.jensen@digia.com>
+
+        Reset binding test result after r132973
+        https://bugs.webkit.org/show_bug.cgi?id=99178
+
+        Unreviewed gardening.
+
+        * bindings/scripts/test/JS/JSFloat64Array.cpp:
+        (WebCore::getJSFloat64ArrayConstructorTable):
+        (WebCore::JSFloat64ArrayConstructor::getOwnPropertySlot):
+        (WebCore::JSFloat64ArrayConstructor::getOwnPropertyDescriptor):
+
+2012-10-31  Mike West  <mkwst@chromium.org>
+
+        Script run from an isolated world should bypass a page's CSP.
+        https://bugs.webkit.org/show_bug.cgi?id=97398
+
+        Reviewed by Adam Barth.
+
+        A page's Content Security Policy currently applies to all resources
+        loaded, regardless of their source. That generally makes sense, but
+        proves problematic when considering script run from an isolated
+        world (Chrome extensions, for instance). These scripts should be allowed
+        to inject resources into a page's DOM without eiher being restricted by
+        the page's active CSP, or generating violation reports that spam the
+        page owner.
+
+        Ideally, the isolated world could define its own Content Security Policy
+        which should be applied to resources it loads. For the moment, this
+        patch accepts a String that we can parse later on, but only uses it in
+        a binary way. If a non-empty policy String is provided, we bypass the
+        main world's CSP checks. If an empty String is provided, the main
+        world's CSP checks remain active.
+
+        Test: http/tests/security/isolatedWorld/bypass-main-world-csp.html
+
+        (WebCore::isolatedWorldContentSecurityPolicies):
+        (WebCore::DOMWrapperWorld::isolatedWorldHasContentSecurityPolicy):
+        (WebCore::DOMWrapperWorld::setIsolatedWorldContentSecurityPolicy):
+        (WebCore::DOMWrapperWorld::clearIsolatedWorldContentSecurityPolicy):
+        * bindings/v8/DOMWrapperWorld.h:
+        (DOMWrapperWorld):
+            Mechanisms for setting and clearing Content Security Policies from
+            isolated worlds; implemented in the same HashMappy way as
+            SecurityOrigin.
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::shouldBypassMainWorldContentSecurityPolicy):
+        (WebCore):
+        * bindings/v8/ScriptController.h:
+        (ScriptController):
+            Adding a method to ScriptController to query the state of the
+            current world's Content Security Policy. We'll drop this once we can
+            apply a policy more directly, but for the moment it's necessary for
+            the next bit.
+        * loader/cache/CachedResourceLoader.cpp:
+        (WebCore::CachedResourceLoader::canRequest):
+            Check the new ScriptController method, and only perform CSP checks
+            when loading resources if we're executing code from the main world,
+            or an isolated world with no Content Security Policy set.
+
+2012-10-31  Tim Horton  <timothy_horton@apple.com>
+
+        Unreviewed, attempt to fix the release build by not exporting symbols that aren't defined there.
+
+        * WebCore.exp.in:
+
+2012-10-31  Yury Semikhatsky  <yurys@chromium.org>
+
+        Memory instrumentation: do not report memory occupied by objects referenced using client interfaces
+        https://bugs.webkit.org/show_bug.cgi?id=100824
+
+        Reviewed by Alexander Pavlov.
+
+        In many classes we have pointer to a client object. These references should be
+        reported as weak pointers and the client's memory usage should be reported when
+        the client is reached from its instrumented owner where we know exact type of
+        the client. Otherwise we would need to add reportMemoryUsage to all client
+        interfaces which places additional burden on the client implementers and blurs
+        the instrumentation boundaries.
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::reportMemoryUsage):
+        * inspector/InspectorDebuggerAgent.cpp:
+        (WebCore::InspectorDebuggerAgent::reportMemoryUsage):
+        * inspector/InspectorMemoryAgent.cpp:
+        (WebCore::InspectorMemoryAgent::reportMemoryUsage):
+        * inspector/InspectorOverlay.cpp:
+        (WebCore::InspectorOverlay::reportMemoryUsage):
+        * inspector/InspectorResourceAgent.cpp:
+        (WebCore::InspectorResourceAgent::reportMemoryUsage):
+        * page/Page.cpp:
+        (WebCore::Page::reportMemoryUsage):
+
+2012-10-31  Tim Horton  <timothy_horton@apple.com>
+
+        Unreviewed, attempt to fix the build by exporting NoExceptionAssertionChecker symbols.
+
+        * WebCore.exp.in:
+
+2012-10-31  Eric Seidel  <eric@webkit.org>
+
+        Add non-virtual firstChild/lastChild overrides to RenderBlock and RenderTableCol for a > 30% speedup on table from bug 100304
+        https://bugs.webkit.org/show_bug.cgi?id=100306
+
+        Reviewed by Abhishek Arya.
+
+        Presumably this is a speedup for other rendering tests as well.  We use firstChild() all over
+        the rendering code w/o considering that it makes a virtual function call.
+        Originally I just fixed the one callsite which was showing up on the sample to
+        use children()->firstChild() directly.  However after further thought, this
+        broader solution seemed the better way to go.  The first patch was a 15% win for
+        this large table, this broader solution was a 30%!? win.
+
+        The elephant in the room for this table is that we're walking the whole table
+        for many nextColumn calls.  But that I will solve in a later bug.
+
+        * rendering/RenderBlock.h:
+        (WebCore::RenderBlock::firstChild):
+        (WebCore::RenderBlock::lastChild):
+        (RenderBlock):
+        * rendering/RenderObject.h:
+        (RenderObject):
+        * rendering/RenderTableCol.h:
+        (WebCore::RenderTableCol::firstChild):
+        (WebCore::RenderTableCol::lastChild):
+        (RenderTableCol):
+
+2012-10-31  Philippe Normand  <pnormand@igalia.com>
+
+        Spatialized panning renders incorrectly with USE_CONCATENATED_IMPULSE_RESPONSES
+        https://bugs.webkit.org/show_bug.cgi?id=98294
+
+        Reviewed by Chris Rogers.
+
+        Regenerated the concatenated impulse responses file with
+        elevations in increasing order per azimuth. In the previous
+        version of this file the elevations for 315, 330 and 345 were
+        concatenated at the wrong indexes.
+
+        * platform/audio/resources/Composite.wav:
+
+2012-10-31  Tim Horton  <timothy_horton@apple.com>
+
+        Full-page PDFPlugin should support inline form editing
+        https://bugs.webkit.org/show_bug.cgi?id=100155
+
+        Reviewed by Dan Bernstein.
+
+        Add form controls corresponding to Text and Choice PDF annotations,
+        allowing for single- and multi-line text input, and <option>-like input.
+
+        Currently, forms are only implemented for full-page PDF documents.
+
+        * WebCore.exp.in: Expose a variety of additional WebCore functionality to WebKit2.
+        * WebCore.xcodeproj/project.pbxproj: Expose some more WebCore headers as private headers for use in WebKit2.
+
+2012-10-30  Eric Seidel  <eric@webkit.org>
+
+        RoboHornetPro spends ~25% of total test time in WebCore::Region::Shape methods
+        https://bugs.webkit.org/show_bug.cgi?id=98800
+
+        Reviewed by Sam Weinig.
+
+        This patch brings our total RoboHornetPro time from 8.2 seconds to 5.3 seconds!
+
+        OverlapMap previously used Regions to track Layer bounds rects. 
+        Unfortunately unioning a list of Regions is O(N^2)
+        where N is the number of Shapes (in this case rects).
+        This is because Shapes are immutable, so to union two shapes, we copy
+        both Shapes' segment/span vectors into a single new Shape.
+        Thus if we union a set of M Regions, each with 1 Shape, we'll end up copying
+        the segments of the first Shape N times before we have the final Region/Shape
+        and the second shape N-1 times. The sum of 1 to N is (N*(N-1))/2 aka order N^2.
+        Fixing the N^2 algorithm covered by https://bugs.webkit.org/show_bug.cgi?id=100814.
+
+        For now we just avoid this O(N^2) by moving away from Region, since OverlapMap
+        doesn't need it. We just collect a vector of the layer rects and hit-test that directly.
+        Hit-testing the rect list is O(N), just like hit-testing the same information in a Region would be.
+
+        Even better for us is that the OverlapMap is never even used in RoboHornetPro.
+        We just collect these rects to end up doing nothing with them. :)
+
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::OverlapMap::add):
+        (WebCore::RenderLayerCompositor::OverlapMap::overlapsLayers):
+        (WebCore::RenderLayerCompositor::OverlapMap::pushCompositingContainer):
+        (WebCore::RenderLayerCompositor::OverlapMap::popCompositingContainer):
+        (RenderLayerCompositor::OverlapMap):
+
+2012-10-30  Beth Dakin  <bdakin@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=100813
+        ScrollingCoordinatorMac::stateNodeForID() should return a 
+        ScrollingStateNode* instead of a ScrollingStateScrollingNode*
+
+        Reviewed by Sam Weinig.
+
+        ScrollingCoordinatorMac::stateNodeForID() should return a 
+        ScrollingStateNode* instead of a ScrollingStateScrollingNode* so that 
+        it can be used for other types of nodes once we add them.
+        * page/scrolling/mac/ScrollingCoordinatorMac.h:
+        (ScrollingCoordinatorMac):
+        * page/scrolling/mac/ScrollingCoordinatorMac.mm:
+        (WebCore::ScrollingCoordinatorMac::frameViewLayoutUpdated):
+        (WebCore::ScrollingCoordinatorMac::recomputeWheelEventHandlerCountForFrameView):
+        (WebCore::ScrollingCoordinatorMac::requestScrollPositionUpdate):
+        (WebCore::ScrollingCoordinatorMac::stateNodeForID):
+
+2012-10-30  Keishi Hattori  <keishi@webkit.org>
+
+        F4 inside <input type=time> should not open calendar picker
+        https://bugs.webkit.org/show_bug.cgi?id=100730
+
+        Reviewed by Kent Tamura.
+
+        We lacked the check to see if the picker indicator is visible.
+
+        Test: fast/forms/time-multiple-fields/time-multiple-fields-open-picker-key-bindings.html
+
+        * html/BaseMultipleFieldsDateAndTimeInputType.cpp:
+        (WebCore::BaseMultipleFieldsDateAndTimeInputType::handleKeydownEvent): Check if picker indicator is visible.
+
+2012-10-30  Kent Tamura  <tkent@chromium.org>
+
+        Delaying 'change' and 'input' event dispatching during HTMLInputElement::setValue
+        https://bugs.webkit.org/show_bug.cgi?id=100772
+
+        Reviewed by Abhishek Arya.
+
+        'change' and 'input' events are asynchronous and not
+        cancelable. We can use ScopedEvent.
+
+        Test: fast/forms/range/range-type-change-onchange.html
+
+        * dom/Node.cpp:
+        (WebCore::Node::dispatchChangeEvent): Use dispatchScopedEvent.
+        (WebCore::Node::dispatchInputEvent): Ditto.
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::setValue):
+        Make a scope to delay event dispatching.
+        * html/RangeInputType.cpp:
+        (WebCore::RangeInputType::handleKeydownEvent): Ditto.
+
+2012-10-30  Simon Fraser  <simon.fraser@apple.com>
+
+        Fix issues with filters and reflections
+        https://bugs.webkit.org/show_bug.cgi?id=100308
+
+        Reviewed by Dirk Schulze.
+
+        Composited filters were being applied to the wrong CALayer. The code used
+        primaryLayer(), which may be a CATransformLayer (which filters cannot apply
+        to; doing so causes console spew), or a CALayer that is used for reflection
+        flattening, which again is the wrong layer.
+
+        Test: css3/filters/composited-reflected.html
+
+        * platform/graphics/ca/GraphicsLayerCA.cpp:
+        (WebCore::GraphicsLayerCA::updateContentsVisibility): Replace .get()-> with ->
+        (WebCore::GraphicsLayerCA::updateContentsOpaque): Ditto.
+        (WebCore::GraphicsLayerCA::updateFilters): Apply filters to m_layer, not primaryLayer(),
+        and use m_layerClones, not primaryLayerClones().
+        (WebCore::GraphicsLayerCA::cloneLayer): When cloning a layer for reflections, copy filters
+        from the source layer.
+        * platform/graphics/ca/PlatformCALayer.h:
+        (PlatformCALayer): Add a member function to copy filters from a supplied layer.
+        * platform/graphics/ca/mac/PlatformCALayerMac.mm:
+        (PlatformCALayer::setFilters): Remove blank line.
+        (PlatformCALayer::copyFiltersFrom): Copy CAFIlters from the given layer.
+        * platform/graphics/ca/win/PlatformCALayerWin.cpp:
+        (PlatformCALayer::copyFiltersFrom): Stub; no filters on Windows.
+
+2012-10-30  Beth Dakin  <bdakin@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=100809
+        ScrollingCoordinator::attachToStateTree() should take an enum 
+        indicating what type of node to create
+
+        Reviewed by Simon Fraser.
+
+        New enum ScrollingNodeType will soon have other values, such as 
+        FixedNode.
+        * page/scrolling/ScrollingCoordinator.h:
+        (WebCore::ScrollingCoordinator::attachToStateTree):
+        * page/scrolling/mac/ScrollingCoordinatorMac.h:
+        (ScrollingCoordinatorMac):
+
+        This patch generalizes this function so that it can be used to create 
+        different types of nodes and so that it is actually ready to create 
+        child nodes. 
+        * page/scrolling/mac/ScrollingCoordinatorMac.mm:
+        (WebCore::ScrollingCoordinatorMac::attachToStateTree):
+
+        The rootStateNode is always a ScrollingNode.
+        (WebCore::ScrollingCoordinatorMac::ensureRootStateNodeForFrameView):
+
+        For the time being, always create a ScrollingNode.
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::attachToScrollingCoordinator):
+
+2012-10-30  Gregg Tavares  <gman@google.com>
+
+        Set the initial scissor box for WebGL
+        https://bugs.webkit.org/show_bug.cgi?id=100804
+
+        Reviewed by Kenneth Russell.
+
+        The initial scissor box needs to be set for WebGL
+
+        No new tests as no new functionality.
+
+        * html/canvas/WebGLRenderingContext.cpp:
+        (WebCore):
+        (WebCore::WebGLRenderingContext::initializeNewContext):
+
+2012-10-30  Charles Wei  <charles.wei@torchmobile.com.cn>
+
+        [BlackBerry] PurgeCredential should also purge the persisted credential store
+        https://bugs.webkit.org/show_bug.cgi?id=100744
+
+        Reviewed by George Staikos.
+
+        When challenged by the server, we will check the credential in-memory and from the persistent storage.
+        So the invalid credentials should also be purged from the persistent credential storage; Otherwise,
+        it will be sent to the server next time been challenged, instead of prompting the user.
+
+        * platform/network/blackberry/NetworkJob.cpp:
+        (WebCore::NetworkJob::purgeCredentials):
+
+2012-10-30  Allan Sandfeld Jensen  <allan.jensen@digia.com>
+
+        DOM URL is flaky when workers are used
+        https://bugs.webkit.org/show_bug.cgi?id=99178
+
+        Reviewed by Geoffrey Garen.
+
+        Extend JSNoStaticTables to also avoid direct access of static tables in constructor objects.
+
+        Test: fast/workers/worker-domurl.html
+
+        * bindings/scripts/CodeGeneratorJS.pm:
+        (constructorHashTableAccessor):
+        (GenerateConstructorDefinition):
+
+2012-10-30  Jae Hyun Park  <jae.park@company100.net>
+
+        Coordinated Graphics: Remove unused methods
+        https://bugs.webkit.org/show_bug.cgi?id=100799
+
+        Reviewed by Noam Rosenthal.
+
+        Currently, there are several unused methods regarding Coordinated
+        Graphics. This patch removes those unused methods.
+
+        No new tests (No change in behavior).
+
+        * platform/graphics/texmap/TextureMapperGL.cpp:
+
+2012-10-30  Hans Muller  <hmuller@adobe.com>
+
+        [CSS Exclusions] Multiple segment polygon layout does not get all segments
+        https://bugs.webkit.org/show_bug.cgi?id=100039
+
+        Reviewed by Dirk Schulze.
+
+        Corrected the algorithm for computing included polygon intervals for rectilinear polygons,
+        and polygons with horizontal edges in general.
+
+        Tests: fast/exclusions/shape-inside/shape-inside-rectilinear-polygon-001.html
+               fast/exclusions/shape-inside/shape-inside-rectilinear-polygon-002.html
+
+        * rendering/ExclusionPolygon.cpp: Removed some internal dead code related to the no-longer-used sortedEdgesMinY Vector.
+        (WebCore::ExclusionPolygon::ExclusionPolygon): Initialize new ExclusionPolygonEdge edgeIndex field.
+        (WebCore::getVertexIntersectionVertices): Return the previous, next, and target vertex indices for a vertex intersection.
+        (WebCore::ExclusionPolygon::computeXIntersections): Refactored the core of this method to improve handling of horizontal edges.
+        (WebCore::ExclusionPolygon::computeEdgeIntersections): Ignore zero-width edges.
+        * rendering/ExclusionPolygon.h: Removed the rightVertexY() method, since it's no longer used.
+        (WebCore::ExclusionPolygon::edgeAt): New method.
+        (WebCore::ExclusionPolygon::numberOfEdges): New method.
+        (ExclusionPolygon): Added support for retrieving edges.
+        (WebCore::ExclusionPolygonEdge::vertex1): Use vertex1Index.
+        (WebCore::ExclusionPolygonEdge::vertex2): Use vertex2Index.
+        (ExclusionPolygonEdge): Renamed index1, index2 fields to vertex1Index, vertex2Index.
+        (WebCore::ExclusionPolygonEdge::previousEdge): New method.
+        (WebCore::ExclusionPolygonEdge::nextEdge): New method.
+
+2012-10-30  Chris Evans  <cevans@google.com>
+
+        Improve performance of MaskPtr.
+        https://bugs.webkit.org/show_bug.cgi?id=100790
+
+        Reviewed by Eric Seidel.
+
+        Calculate the mask once, and store it as a fast-access member variable.
+        Also avoid unneccessary integer width expansion in index calculation.
+        Parser/tiny-innerHTML.html has a high stddev.
+        Best result I've seen pre-patch is 5.70 runs/s.
+        Best result I've seen post-patch is 5.72 runs/s, but this is not statistically significant.
+        MaskPtr is still showing as ~2% in the profile, so we're not sure we trust the profile symbolization at this time.
+        MaskPtr is now reduced to a single inline instruction (was: 4) so this seems like a strict improvement worth landing.
+
+        * rendering/RenderArena.cpp:
+        (MaskPtr): Use a passed-in mask for the mask operation.
+        (WebCore::RenderArena::RenderArena): Calculate the mask and store it.
+        (WebCore::RenderArena::allocate):
+        (WebCore::RenderArena::free): Use stored mask and avoid unneccessary casts.
+        * rendering/RenderArena.h:
+        (RenderArena): Store the freelist mask as a member variable.
+
+2012-10-30  Kenichi Ishibashi  <bashi@chromium.org>
+
+        local(Helvetica) in src descriptor prevent fallback
+        https://bugs.webkit.org/show_bug.cgi?id=100446
+
+        Reviewed by Dan Bernstein.
+
+        FontCache::getCachedFontData() has a mechanism that aliases a few pairs
+        of font family names, so that if the family name specified in the font-family
+        property is not available on the system, but the its alias is available,
+        it will be used instead. This is appropriate for the font-family property,
+        but not for font family names specified in the local() function of the src
+        descriptor in a @font-face rule.
+
+        This patch disables the mechanism while checking src descriptor of @font-face.
+
+        No new tests. It's difficult to test the change because 'Helvetica' can
+        be mapped any other font. For example, chromium DRT uses FontConfig to
+        map Helvetica to Times New Roman. Other ports may map Helvetica to other
+        fonts. We can't define the expected result.
+
+        * css/CSSFontFaceSource.cpp:
+        (WebCore::CSSFontFaceSource::getFontData):
+        Call fontCache()->getCachedFontData() with checkingAlternateName = true.
+        This disables aliasing font family names in FontCache.
+
+2012-10-30  Beth Dakin  <bdakin@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=100796
+        Should add FixedPositionViewportConstraints to ScrollingConstraints.h
+
+        Reviewed by Simon Fraser.
+
+        ScrollingConstraints.h currently contains an abstract class called 
+        ViewportConstraints that is intended to encapsulate data and logic 
+        required to reposition elements whose layout depends on the viewport 
+        rect (positions fixed and sticky), when scrolling and zooming. 
+        However, at this time there is only a subclass for sticky. We should 
+        add a sub-class for fixed. This is required to get pages with fixed 
+        position elements scrolling on the scrolling thread.
+
+        * page/scrolling/ScrollingConstraints.cpp:
+        (WebCore::FixedPositionViewportConstraints::layerPositionForViewportRect):
+        (WebCore):
+        * page/scrolling/ScrollingConstraints.h:
+        (WebCore::ViewportConstraints::ViewportConstraints):
+        (ViewportConstraints):
+        (WebCore::ViewportConstraints::setAnchorEdges):
+        (FixedPositionViewportConstraints):
+        (WebCore::FixedPositionViewportConstraints::FixedPositionViewportConstraints):
+        (WebCore::FixedPositionViewportConstraints::viewportRectAtLastLayout):
+        (WebCore::FixedPositionViewportConstraints::setViewportRectAtLastLayout):
+        (WebCore::FixedPositionViewportConstraints::layerPositionAtLastLayout):
+        (WebCore::FixedPositionViewportConstraints::setLayerPositionAtLastLayout):
+        (WebCore):
+
+2012-10-30  Tiancheng Jiang  <tijiang@rim.com>
+
+        [BlackBerry] update form theme for BB10.
+        https://bugs.webkit.org/show_bug.cgi?id=100760
+
+        Reviewed by Rob Buis.
+
+        RIM PR:222126
+        Introduce slide function to paint new theme for the form controls.
+
+        No new tests.
+
+        * css/themeBlackBerry.css:
+        (select):
+        * platform/blackberry/RenderThemeBlackBerry.cpp:
+        (WebCore):
+        (WebCore::drawControl): Added.
+        (WebCore::drawThreeSlice): Added.
+        (WebCore::drawNineSlice): Added.
+        (WebCore::loadImage): Added.
+        (WebCore::RenderThemeBlackBerry::systemFont): Modified.
+        (WebCore::RenderThemeBlackBerry::paintTextFieldOrTextAreaOrSearchField): Modified.
+        (WebCore::RenderThemeBlackBerry::paintCheckbox): Modified.
+        (WebCore::RenderThemeBlackBerry::paintRadio): Modified.
+        (WebCore::RenderThemeBlackBerry::paintButton): Modified.
+        (WebCore::RenderThemeBlackBerry::paintMenuList): Modified.
+        (WebCore::RenderThemeBlackBerry::paintMenuListButton): Modified.
+        (WebCore::RenderThemeBlackBerry::paintSliderTrackRect): Modified.
+        (WebCore::RenderThemeBlackBerry::paintSliderThumb): Modified.
+        * platform/blackberry/RenderThemeBlackBerry.h:
+        (RenderThemeBlackBerry):
+
+2012-10-30  Rick Byers  <rbyers@chromium.org>
+
+        cssText for cursor property doesn't include hotspot
+        https://bugs.webkit.org/show_bug.cgi?id=99530
+
+        Reviewed by Darin Adler.
+
+        Implement customCssText in CSSCursorImageValue to include the hotspot when present.
+        Also explicitly track whether or not a hotspot was supplied in the parser,
+        while still using the existing convention of (-1,-1) to denote no hotspot
+        in the rest of the system.
+
+        Test: fast/css/cursor-parsing.html
+
+        * css/CSSCursorImageValue.cpp:
+        (WebCore::CSSCursorImageValue::customCssText):
+        * css/CSSCursorImageValue.h:
+        (CSSCursorImageValue):
+
+2012-10-30  Kenneth Russell  <kbr@google.com>
+
+        Temporarily restrict use of ImageBufferSkia::copyToPlatformTexture until bugs resolved
+        https://bugs.webkit.org/show_bug.cgi?id=100714
+
+        Reviewed by Stephen White.
+
+        For the moment, only use ImageBuffer::copyToPlatformTexture when
+        copying to RGBA/UNSIGNED_BYTE textures, and document restriction
+        in header. Restriction will be lifted once the implementations
+        (currently only Chromium has one) have been fixed; see bug 100715.
+
+        No new tests; manually ran WebGL conformance test
+        tex-image-and-sub-image-2d-with-canvas-rgba5551.html on NVIDIA
+        hardware on Mac OS.
+
+        * html/canvas/WebGLRenderingContext.cpp:
+        (WebCore):
+        (WebCore::WebGLRenderingContext::texImage2D):
+        * platform/graphics/ImageBuffer.h:
+        (ImageBuffer):
+
+2012-10-30  Nico Weber  <thakis@chromium.org>
+
+        Fix potential overflow in jpeg exif reader. Found by aedla@google.com.
+        https://bugs.webkit.org/show_bug.cgi?id=100320
+
+        Reviewed by Eric Seidel.
+
+        Adding more than 1 element past an array is undefined, so don't do it.
+
+        No test, since in practice ifd will just overflow and `end - ifd` will
+        become much larget than 2 and the `if (end - ifd < 2)` a few lines
+        down will catch that case.
+
+        * platform/image-decoders/jpeg/JPEGImageDecoder.cpp:
+        (WebCore::readImageOrientation):
+
+2012-10-26  Alexandru Chiculita  <achicu@adobe.com>
+
+        [CSS Shaders] Add the ValidatedCustomFilterOperation class
+        https://bugs.webkit.org/show_bug.cgi?id=100558
+
+        Reviewed by Dean Jackson.
+
+        Added the ValidatedCustomFilterOperation class. The file is now almost empty,
+        but more is going to come in the following patches.
+
+        Added the a filter operation type VALIDATED_CUSTOM and updated the compositors to ignore
+        such operations for now.
+        
+        No new tests, there is no new functionality yet.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * Target.pri:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::CSSComputedStyleDeclaration::valueForFilter):
+        * css/StyleResolver.cpp:
+        (WebCore::StyleResolver::createFilterOperations):
+        * platform/graphics/blackberry/LayerWebKitThread.cpp:
+        (WebCore::LayerWebKitThread::filtersCanBeComposited):
+        * platform/graphics/ca/mac/PlatformCALayerMac.mm:
+        (PlatformCALayer::filtersCanBeComposited):
+        * platform/graphics/chromium/GraphicsLayerChromium.cpp:
+        (WebCore::copyWebCoreFilterOperationsToWebFilterOperations):
+        * platform/graphics/filters/FilterOperation.h:
+        * platform/graphics/filters/FilterOperations.cpp:
+        (WebCore::FilterOperations::hasCustomFilter):
+        (WebCore::FilterOperations::getOutsets):
+        * platform/graphics/filters/ValidatedCustomFilterOperation.cpp: Added.
+        (WebCore):
+        (WebCore::ValidatedCustomFilterOperation::ValidatedCustomFilterOperation):
+        (WebCore::ValidatedCustomFilterOperation::~ValidatedCustomFilterOperation):
+        (WebCore::ValidatedCustomFilterOperation::blend):
+        * platform/graphics/filters/ValidatedCustomFilterOperation.h: Added.
+        (WebCore):
+        (ValidatedCustomFilterOperation):
+        (WebCore::ValidatedCustomFilterOperation::create):
+        (WebCore::ValidatedCustomFilterOperation::affectsOpacity):
+        (WebCore::ValidatedCustomFilterOperation::movesPixels):
+        (WebCore::ValidatedCustomFilterOperation::blendingNeedsRendererSize):
+        (WebCore::ValidatedCustomFilterOperation::operator==):
+
+2012-10-30  Joseph Pecoraro  <pecoraro@apple.com>
+
+        [Mac] Sync up FeatureDefine Configuration Files
+        https://bugs.webkit.org/show_bug.cgi?id=100171
+
+        Reviewed by David Kilzer.
+
+        Follow up to better coordinate with iOS feature defines. Make:
+
+          - ENABLE_FILTERS always on
+          - ENABLE_INPUT_* iphonesimulator values point to the iphoneos values
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2012-10-30  Joseph Pecoraro  <pecoraro@apple.com>
+
+        [Mac] Sync up FeatureDefine Configuration Files
+        https://bugs.webkit.org/show_bug.cgi?id=100171
+
+        Reviewed by David Kilzer.
+
+        Ensure an identical FeatureDefine files across all projects. Changes:
+
+          - ENABLE_CSS_BOX_DECORATION_BREAK should be in all
+          - ENABLE_PDFKIT_PLUGIN should be in all
+          - ENABLE_RESOLUTION_MEDIA_QUERY should be in all
+          - ENABLE_ENCRYPTED_MEDIA should be in all
+          - ENABLE_HIDDEN_PAGE_DOM_TIMER_THROTTLING with corrected value
+          - Some alphabetical ordering cleanup
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2012-10-30  Andreas Kling  <kling@webkit.org>
+
+        StylePropertySet: Convert more logic to use PropertyReference.
+        <http://webkit.org/b/100779>
+
+        Reviewed by Antti Koivisto.
+
+        Rewrite more of the StylePropertySet logic to use PropertyReference instead of CSSProperty.
+        This is cleanup before changing the internal storage layout of immutable StylePropertySet.
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::CSSComputedStyleDeclaration::cssPropertyMatches):
+        * css/CSSComputedStyleDeclaration.h:
+        * css/CSSStyleDeclaration.h:
+        * css/PropertySetCSSStyleDeclaration.cpp:
+        (WebCore::PropertySetCSSStyleDeclaration::cssPropertyMatches):
+        * css/PropertySetCSSStyleDeclaration.h:
+        * css/StylePropertySet.cpp:
+        (WebCore::StylePropertySet::appendFontLonghandValueIfExplicit):
+        (WebCore::StylePropertySet::fontValue):
+        (WebCore::StylePropertySet::get4Values):
+        (WebCore::StylePropertySet::getPropertyCSSValue):
+        (WebCore::StylePropertySet::removeProperty):
+        (WebCore::StylePropertySet::propertyIsImportant):
+        (WebCore::StylePropertySet::getPropertyShorthand):
+        (WebCore::StylePropertySet::isPropertyImplicit):
+        (WebCore::StylePropertySet::setProperty):
+        (WebCore::StylePropertySet::mergeAndOverrideOnConflict):
+        (WebCore::StylePropertySet::findPropertyIndex):
+        (WebCore::StylePropertySet::findMutableCSSPropertyWithID):
+        (WebCore::StylePropertySet::propertyMatches):
+        (WebCore::StylePropertySet::removeEquivalentProperties):
+        * css/StylePropertySet.h:
+        (WebCore::StylePropertySet::PropertyReference::shorthandID):
+        (WebCore::StylePropertySet::PropertyReference::isImplicit):
+
+2012-10-30  Eric Seidel  <eric@webkit.org>
+
+        Teach RenderTable how to use Vector::insert and Vector::append instead of its own custom memmove code
+        https://bugs.webkit.org/show_bug.cgi?id=100428
+
+        Reviewed by Julien Chaffraix.
+
+        RenderTable is now like all other clients of Vector instead of being
+        needlessly different. :)
+
+        insert, append and grow all use the same expandCapacity logic under the covers
+        and Vector::insert uses TypeOperations::moveOverlapping which should use memmove
+        by default for unknown types.
+
+        * rendering/RenderTable.cpp:
+        (WebCore::RenderTable::splitColumn):
+        (WebCore::RenderTable::appendColumn):
+        * rendering/RenderTable.h:
+        (WebCore::RenderTable::ColumnStruct::ColumnStruct):
+
+2012-10-30  Vincent Scheib  <scheib@chromium.org>
+
+        Unreviewed, rolling out r132927.
+        http://trac.webkit.org/changeset/132927
+        https://bugs.webkit.org/show_bug.cgi?id=100558
+
+        Compile error on Chromium builders
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * Target.pri:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::CSSComputedStyleDeclaration::valueForFilter):
+        * css/StyleResolver.cpp:
+        (WebCore::StyleResolver::createFilterOperations):
+        * platform/graphics/blackberry/LayerWebKitThread.cpp:
+        (WebCore::LayerWebKitThread::filtersCanBeComposited):
+        * platform/graphics/ca/mac/PlatformCALayerMac.mm:
+        (PlatformCALayer::filtersCanBeComposited):
+        * platform/graphics/chromium/GraphicsLayerChromium.cpp:
+        (WebCore::copyWebCoreFilterOperationsToWebFilterOperations):
+        * platform/graphics/filters/FilterOperation.h:
+        * platform/graphics/filters/FilterOperations.cpp:
+        (WebCore::FilterOperations::hasCustomFilter):
+        (WebCore::FilterOperations::getOutsets):
+        * platform/graphics/filters/ValidatedCustomFilterOperation.cpp: Removed.
+        * platform/graphics/filters/ValidatedCustomFilterOperation.h: Removed.
+
+2012-10-30  W. James MacLean  <wjmaclean@chromium.org>
+
+        [chromium] Restrict link highlights to targets that display a hand-cursor
+        https://bugs.webkit.org/show_bug.cgi?id=99862
+
+        Reviewed by James Robinson.
+
+        To avoid applying highlights to inappropriate targets, such as large divs with
+        click handlers installed, test candidate targets and only highlight them if they
+        would normally display a hand cursor on mouse over. This is a heuristic, but has
+        been tested and found effective in practice.
+
+        This CL refactors EventHandler::selectCursor() to make the logic for determining
+        if CURSOR_AUTO should resolve to CURSOR_POINTER available outside EventHandler.
+
+        Relies on existing cursor tests.
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::useHandCursor):
+        (WebCore):
+        (WebCore::EventHandler::selectCursor):
+        * page/EventHandler.h:
+        (EventHandler):
+
+2012-10-30  Rob Buis  <rbuis@rim.com>
+
+        [BlackBerry] Remove CookieDatabaseBackingStore::upgradeTableIfNeeded
+        https://bugs.webkit.org/show_bug.cgi?id=100783
+
+        Reviewed by Yong Li.
+
+        PR 220513.
+
+        Remove CookieDatabaseBackingStore::upgradeTableIfNeeded, it was needed for backwards
+        compatibility, but not needed anymore.
+
+        * platform/blackberry/CookieDatabaseBackingStore/CookieDatabaseBackingStore.cpp:
+        (WebCore::CookieDatabaseBackingStore::invokeOpen):
+        * platform/blackberry/CookieDatabaseBackingStore/CookieDatabaseBackingStore.h:
+
+2012-10-30  Glenn Adams  <glenn@skynav.com>
+
+        [CSS] Expand -webkit-line-break value space
+        https://bugs.webkit.org/show_bug.cgi?id=100739
+
+        Reviewed by Eric Seidel.
+
+        (1) expand -webkit-line-break to include new values defined by CSS3 Text [1], i.e., 'auto', 'strict', 'loose';
+        (2) change default (initial) value for -webkit-line-break to 'auto' to match CSS3 Text;
+        (3) rename enum EKHTMLLineBreak to LineBreak, renaming enum values appropriately;
+
+        New tests to be added when functionality of new values is added. No rendering behavior change at this time.
+        Only externally visible change is default (initial) value returning 'auto' rather than 'normal', for which 3 existing
+        tests that were sensitive to this value have been updated. Note that until the functionality for the new values is
+        added, any actual use of the new values will be treated as the same as the pre-existing 'normal' value, i.e., the
+        default semantics.
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
+        Update from kthmlLineBreak() to lineBreak().
+
+        * css/CSSParser.cpp:
+        (WebCore::isValidKeywordPropertyAndValue):
+        Update values supported for CSSPropertyWebkitLineBreak.
+
+        * css/CSSPrimitiveValueMappings.h:
+        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
+        (WebCore::CSSPrimitiveValue::operator LineBreak):
+        Update LineBreak enumeration values (previously EKHTMLLineBreak).
+
+        * css/CSSValueKeywords.in:
+        Update keywords used for -webkit-line-break.
+
+        * css/StyleBuilder.cpp:
+        (WebCore::StyleBuilder::StyleBuilder):
+        Update names for line break style getter/setter.
+
+        * rendering/style/RenderStyle.cpp:
+        (WebCore::RenderStyle::diff):
+        Remove khtml prefix on line break related state.
+
+        * rendering/style/RenderStyle.h:
+        Remove khtml prefix on line break related methods. Update to redefined LineBreak
+        enumeration type.
+
+        * rendering/style/RenderStyleConstants.h:
+        Rename EKHTMLLineBreak enumeration to LineBreak.
+        Redefine LineBreak enumeration to include new CSS3 Text modes (auto, loose, strict) and
+        use better names.
+
+        * rendering/style/StyleRareInheritedData.cpp:
+        (WebCore::StyleRareInheritedData::StyleRareInheritedData):
+        (WebCore::StyleRareInheritedData::operator==):
+        Remove khtml prefix on line break related state references.
+
+        * rendering/style/StyleRareInheritedData.h:
+        (StyleRareInheritedData):
+        Remove khtml prefix on line break related state. Widen field to 3 bits to support 8 values,
+        of which 5 are now used.
+
+2012-10-30  Antti Koivisto  <antti@apple.com>
+
+        Avoid unnecessary style recalcs on class attribute mutation
+        https://bugs.webkit.org/show_bug.cgi?id=100776
+
+        Reviewed by Andreas Kling.
+
+        There is no need to invalidate element style on class attribute change if neither the added
+        or removed classes featured in any active stylesheet.
+
+        * css/RuleFeature.cpp:
+        (WebCore::RuleFeatureSet::add):
+        (WebCore::RuleFeatureSet::clear):
+        (WebCore::RuleFeatureSet::reportMemoryUsage):
+        * css/RuleFeature.h:
+        (RuleFeatureSet):
+        * css/RuleSet.cpp:
+        (WebCore::collectFeaturesFromSelector):
+        
+            Collect classes mentioned in CSS selectors the same way ids and attribute names are
+            already collected.
+
+        * css/StyleResolver.cpp:
+        (WebCore::StyleResolver::hasSelectorForClass):
+        
+            Add a method to test if a given class name is mentioned anywhere in stylehseets.
+
+        (WebCore):
+        * css/StyleResolver.h:
+        * css/StyleScopeResolver.h:
+        (WebCore):
+        * dom/Element.cpp:
+        (WebCore::collectAddedAndRemovedClasses):
+        (WebCore):
+        (WebCore::Element::classAttributeChanged):
+        
+            Figure out which classes were added and removed. Test if they are present in any style
+            rule and invalidate the style only if they are.
+
+        * dom/SpaceSplitString.cpp:
+        (WebCore::SpaceSplitStringData::add):
+        (WebCore::SpaceSplitStringData::remove):
+        (WebCore::SpaceSplitString::add):
+        (WebCore::SpaceSplitString::remove):
+        
+            Added bool return value to indicate if anything was actually removed. Reorganized 
+            the code a bit to avoid unnecessary uniquing when nothing changes.
+
+        * dom/SpaceSplitString.h:
+        (SpaceSplitStringData):
+        (SpaceSplitString):
+
+2012-10-30  Robert Hogan  <robert@webkit.org>
+
+        white-space: nowrap inline element beside a floated element wraps incorrectly without trailing textnode/newline
+        https://bugs.webkit.org/show_bug.cgi?id=29648
+
+        Reviewed by Levi Weintraub.
+
+        A no-wrap child on a line inside an autowrap container should move to the next line if a float doesn't allow
+        it to fit. This will happen if there is trailing space after the no-wrap child but not if it's the last renderer
+        on the line. This is because nextLineBreak() is only interested in the white-space style of the current renderer 
+        and the renderer's next sibling (if there is one) when deciding whether it needs to fit below any floats that
+        push it beyond the edge of the container. There isn't any situation in which a no-wrap child shouldn't move 
+        below a float on an auto-wrap line though, so this check always needs to respect the container's white-space style too.
+
+        Test: fast/text/whitespace/no-wrap-child-in-auto-wrap-container.html
+
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::RenderBlock::LineBreaker::nextLineBreak):
+
+2012-10-26  Alexandru Chiculita  <achicu@adobe.com>
+
+        [CSS Shaders] Add the ValidatedCustomFilterOperation class
+        https://bugs.webkit.org/show_bug.cgi?id=100558
+
+        Reviewed by Dean Jackson.
+
+        Added the ValidatedCustomFilterOperation class. The file is now almost empty,
+        but more is going to come in the following patches.
+
+        Added the a filter operation type VALIDATED_CUSTOM and updated the compositors to ignore
+        such operations for now.
+        
+        No new tests, there is no new functionality yet.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * Target.pri:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::CSSComputedStyleDeclaration::valueForFilter):
+        * css/StyleResolver.cpp:
+        (WebCore::StyleResolver::createFilterOperations):
+        * platform/graphics/blackberry/LayerWebKitThread.cpp:
+        (WebCore::LayerWebKitThread::filtersCanBeComposited):
+        * platform/graphics/ca/mac/PlatformCALayerMac.mm:
+        (PlatformCALayer::filtersCanBeComposited):
+        * platform/graphics/chromium/GraphicsLayerChromium.cpp:
+        (WebCore::copyWebCoreFilterOperationsToWebFilterOperations):
+        * platform/graphics/filters/FilterOperation.h:
+        * platform/graphics/filters/FilterOperations.cpp:
+        (WebCore::FilterOperations::hasCustomFilter):
+        (WebCore::FilterOperations::getOutsets):
+        * platform/graphics/filters/ValidatedCustomFilterOperation.cpp: Added.
+        (WebCore):
+        (WebCore::ValidatedCustomFilterOperation::ValidatedCustomFilterOperation):
+        (WebCore::ValidatedCustomFilterOperation::~ValidatedCustomFilterOperation):
+        (WebCore::ValidatedCustomFilterOperation::blend):
+        * platform/graphics/filters/ValidatedCustomFilterOperation.h: Added.
+        (WebCore):
+        (ValidatedCustomFilterOperation):
+        (WebCore::ValidatedCustomFilterOperation::create):
+        (WebCore::ValidatedCustomFilterOperation::affectsOpacity):
+        (WebCore::ValidatedCustomFilterOperation::movesPixels):
+        (WebCore::ValidatedCustomFilterOperation::blendingNeedsRendererSize):
+        (WebCore::ValidatedCustomFilterOperation::operator==):
+
+2012-10-29  Anders Carlsson  <andersca@apple.com>
+
+        Build WebKit as C++11 on Mac
+        https://bugs.webkit.org/show_bug.cgi?id=100720
+
+        Reviewed by Daniel Bates.
+
+        * Configurations/Base.xcconfig:
+        Add CLANG_CXX_LANGUAGE_STANDARD=gnu++0x.
+
+        * platform/graphics/FontPlatformData.h:
+        (WebCore::FontPlatformData::hash):
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+        (WebCore::GraphicsContext::drawLine):
+        (WebCore::GraphicsContext::strokeArc):
+        * platform/graphics/filters/CustomFilterProgramInfo.cpp:
+        (WebCore::CustomFilterProgramInfo::hash):
+        (WebCore::ProtectionSpaceHash::hash):
+        * platform/network/cf/FormDataStreamCFNet.cpp:
+        (WebCore::setHTTPBody):
+        Add static_casts to prevent implicit type conversions in non-constant initializer lists.
+        
+        * platform/mac/ClipboardMac.mm:
+        (WebCore::ClipboardMac::createDragImage):
+        * platform/mac/CursorMac.mm:
+        (WebCore::createNamedCursor):
+        * platform/mac/ScrollViewMac.mm:
+        (WebCore::ScrollView::platformSetContentsSize):
+        Use NSMakePoint to prevent implicit type conversions in non-constant initializer lists.
+
+        * platform/mac/CookieJar.mm:
+        (WebCore::cookiesEnabled):
+        * platform/network/mac/ResourceHandleMac.mm:
+        (WebCore::shouldRelaxThirdPartyCookiePolicy):
+        Add explicit casts to NSHTTPCookieAcceptPolicy.
+
+        * platform/mac/WebCoreNSURLExtras.h:
+        * platform/mac/WebCoreNSURLExtras.mm:
+        (WebCore::URLByTruncatingOneCharacterBeforeComponent):
+        (WebCore::dataForURLComponentType):
+        * platform/network/ProtectionSpaceHash.h:
+        Use CFIndex instead of CFURLComponentType, the enum can be mangled differently in some cases, and these
+        functions are exported from WebCore.
+
+2012-10-30  Dan Bernstein  <mitz@apple.com>
+
+        <rdar://problem/12395187> REGRESSION (r121299): OS X Text Replacement forces cursor out of text fields
+        https://bugs.webkit.org/show_bug.cgi?id=100768
+
+        Reviewed by Anders Carlsson.
+
+        r121299 introduced code to restore the paragraph range by saving its length and start offset
+        relative to the document. The latter was obtained by iterating over the range starting at
+        the beginning of the document and ending at the beginning of the paragraph range. However,
+        such a range could not be constructed if the paragraph range was contained in a shadow DOM,
+        since a range must have both its endpoints within the same shadow tree (or not in a shadow
+        tree).
+
+        Test: platform/mac/editing/spelling/autocorrection-in-textarea.html
+
+        * editing/Editor.cpp:
+        (WebCore::Editor::markAndReplaceFor): Changed paragraphStartIndex to be relative to the
+        root container of paragraphRange, using the same logic used by
+        checkForDifferentRootContainer() in Range.cpp.
+
+2012-10-30  Dan Carney  <dcarney@google.com>
+
+        Remove ensureAuxiliaryContext
+        https://bugs.webkit.org/show_bug.cgi?id=99975
+
+        Reviewed by Adam Barth.
+
+        Removed auxilliaryContext as use if it is problematic in IDB.
+
+        No new tests. No change in functionality.
+
+        * Modules/indexeddb/IDBCursor.cpp:
+        (WebCore::IDBCursor::update):
+        (WebCore::IDBCursor::setValueReady):
+        * Modules/indexeddb/IDBCursor.h:
+        (IDBCursor):
+        * Modules/indexeddb/IDBObjectStore.cpp:
+        (WebCore::generateIndexKeysForValue):
+        (WebCore::IDBObjectStore::put):
+        (WebCore):
+        * Modules/indexeddb/IDBRequest.cpp:
+        (WebCore::IDBRequest::onSuccess):
+        (WebCore::IDBRequest::dispatchEvent):
+        * bindings/v8/IDBBindingUtilities.cpp:
+        (WebCore::createIDBKeyFromScriptValueAndKeyPath):
+        (WebCore::deserializeIDBValue):
+        (WebCore::injectIDBKeyIntoScriptValue):
+        * bindings/v8/IDBBindingUtilities.h:
+        (WebCore):
+        * bindings/v8/V8Binding.cpp:
+        (WebCore::toV8Context):
+        (WebCore):
+        * bindings/v8/V8Binding.h:
+        (WebCore):
+        * bindings/v8/V8PerIsolateData.cpp:
+        (WebCore):
+        * bindings/v8/V8PerIsolateData.h:
+
+2012-10-30  Huang Dongsung  <luxtella@company100.net>
+
+        [CSS Shaders] Add CustomFilterRenderer to reuse this class by Accelerated Compositing.
+        https://bugs.webkit.org/show_bug.cgi?id=98989
+
+        Reviewed by Dean Jackson.
+
+        Extract CustomFilterRenderer class from the rendering part of FECustomFilter.
+        FECustomFilter now plays a role in extending FilterEffect and delegates
+        rendering CSS Shaders to CustomFilterRenderer.
+
+        CustomFilterRenderer does not know Filter and FilterEffect. We can
+        create a CustomFilterRenderer instance with only GraphicsContext3D and
+        CustomFilterValidatedProgram. It means that Accelerated Compositing can
+        create the CustomFilterRenderer instance if Accelerated Compositing has
+        GraphicsContext3D and CustomFilterOperation, and it is already possible.
+
+        This patch prepares to enable CSS Shaders on Accelerated Compositing.
+
+        No new tests. Covered by css3/filters/custom
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * Target.pri:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * platform/graphics/filters/CustomFilterRenderer.cpp: Added.
+        (WebCore):
+        (WebCore::orthogonalProjectionMatrix):
+        (WebCore::CustomFilterRenderer::create):
+        (WebCore::CustomFilterRenderer::CustomFilterRenderer):
+        (WebCore::CustomFilterRenderer::~CustomFilterRenderer):
+        (WebCore::CustomFilterRenderer::premultipliedAlpha):
+        (WebCore::CustomFilterRenderer::programNeedsInputTexture):
+        (WebCore::CustomFilterRenderer::draw):
+        (WebCore::CustomFilterRenderer::prepareForDrawing):
+        (WebCore::CustomFilterRenderer::initializeCompiledProgramIfNeeded):
+        (WebCore::CustomFilterRenderer::initializeMeshIfNeeded):
+        (WebCore::CustomFilterRenderer::bindVertexAttribute):
+        (WebCore::CustomFilterRenderer::unbindVertexAttribute):
+        (WebCore::CustomFilterRenderer::bindProgramArrayParameters):
+        (WebCore::CustomFilterRenderer::bindProgramNumberParameters):
+        (WebCore::CustomFilterRenderer::bindProgramTransformParameter):
+        (WebCore::CustomFilterRenderer::bindProgramParameters):
+        (WebCore::CustomFilterRenderer::bindProgramAndBuffers):
+        (WebCore::CustomFilterRenderer::unbindVertexAttributes):
+        * platform/graphics/filters/CustomFilterRenderer.h: Copied from Source/WebCore/platform/graphics/filters/FECustomFilter.h.
+        (WebCore):
+        (CustomFilterRenderer):
+          CustomFilterRenderer renders custom filters in GPU using a
+          GraphicsContext3D.
+        * platform/graphics/filters/FECustomFilter.cpp:
+        (WebCore::FECustomFilter::FECustomFilter):
+        (WebCore::FECustomFilter::create):
+        (WebCore::FECustomFilter::deleteRenderBuffers):
+        (WebCore::FECustomFilter::drawFilterMesh):
+        (WebCore::FECustomFilter::prepareForDrawing):
+        (WebCore::FECustomFilter::applyShader):
+        (WebCore::FECustomFilter::resolveMultisampleBuffer):
+        (WebCore::FECustomFilter::resizeMultisampleBuffers):
+        (WebCore::FECustomFilter::resizeContext):
+        * platform/graphics/filters/FECustomFilter.h:
+        (WebCore):
+        (FECustomFilter):
+        * rendering/FilterEffectRenderer.cpp:
+        (WebCore::createCustomFilterEffect):
+
+2012-10-30  Mike West  <mkwst@chromium.org>
+
+        Web Inspector: Associate console messages with the requests that caused them.
+        https://bugs.webkit.org/show_bug.cgi?id=99941
+
+        Reviewed by Pavel Feldman.
+
+        The inspector currently supports the concept of a request's "initiator"
+        in order to add context to console messages that are generated in
+        response to a specific request. The initiator is used as the message's
+        anchor link iff a requestID is present, and no stack trace is present.
+
+        Currently, this functionality is only exposed to three specific
+        callsites: 'InspectorConsoleAgent::didFinishXHRLoading',
+        'InspectorConsoleAgent::didReceiveResponse', and
+        'InspectorConsoleAgent::didFailLoading'. This patch adds a generic
+        mechanism to associate requests with console messages by passing the
+        request's identifier through 'ScriptExecutionContext::addConsoleMessage'
+        or 'Console::addMessage' when relevant.
+
+        This patch should have no visible changes. It just installs some new
+        piping, and adjusts the three methods mentioned above to use it.
+        Existing tests shouldn't break.
+
+        * dom/Document.cpp:
+        (WebCore::Document::addMessage):
+        * dom/Document.h:
+        (Document):
+            Add a 'requestIdentifier' parameter (defaulting to 0), and pipe it
+            through to Console::addMessage.
+        * dom/ScriptExecutionContext.cpp:
+        (WebCore::ScriptExecutionContext::addConsoleMessage):
+        * dom/ScriptExecutionContext.h:
+        (ScriptExecutionContext):
+            Add a 'requestIdentifier' parameter (defaulting to 0), and pipe it
+            through to the subclass' addMessage method.
+        * inspector/ConsoleMessage.cpp:
+        (WebCore::ConsoleMessage::ConsoleMessage):
+            Accept an unsigned long instead of a string, and move the conversion
+            from WebCore request identifiers to Inspector request identifiers
+            into ConsoleMessage.
+        * inspector/ConsoleMessage.h:
+        (ConsoleMessage):
+            Add 'requestIdentifier' (defaulting to 0) to the
+            ConsoleMessage constructor that accepts a ScriptCallStack (it was
+            already part of the constructor that accepted a line number).
+        * inspector/IdentifiersFactory.cpp:
+        (WebCore::IdentifiersFactory::requestId):
+            If the provided request identifier is 0, return an empty string.
+            This simplifies the logic at the callsite.
+        * inspector/InspectorConsoleAgent.cpp:
+        (WebCore::InspectorConsoleAgent::addMessageToConsole):
+            Add a 'requestIdentifier' parameter (defaulting to 0), and pipe it
+            through to the 'ConsoleMessage' constructor after converting it to
+            an internal identifier via 'IdentifiersFactor::requestId'.
+        (WebCore::InspectorConsoleAgent::didFinishXHRLoading):
+        (WebCore::InspectorConsoleAgent::didReceiveResponse):
+        (WebCore::InspectorConsoleAgent::didFailLoading):
+            Use the new 'requestIdentifier' parameter on addMessageToConsole
+            rather than replicating the behavior in each of these three methods.
+        * inspector/InspectorConsoleAgent.h:
+        (InspectorConsoleAgent):
+            Add a 'requestIdentifier' parameter (defaulting to 0).
+        * inspector/InspectorConsoleInstrumentation.h:
+        (WebCore::InspectorInstrumentation::addMessageToConsole):
+        * inspector/InspectorInstrumentation.cpp:
+        (WebCore):
+        (WebCore::InspectorInstrumentation::addMessageToConsoleImpl):
+        * inspector/InspectorInstrumentation.h:
+        (InspectorInstrumentation):
+            Add a 'requestIdentifier' parameter (defaulting to 0), and pipe it
+            through to lower levels of the stack.
+        * page/Console.cpp:
+        (WebCore::Console::addMessage):
+        * page/Console.h:
+        (Console):
+            Add a 'requestIdentifier' parameter (defaulting to 0), and pipe it
+            through to 'InspectorInstrumentation::addMessageToConsole'.
+        * workers/WorkerContext.cpp:
+        (WebCore::WorkerContext::addMessage):
+        (WebCore::WorkerContext::addMessageToWorkerConsole):
+        * workers/WorkerContext.h:
+        (WorkerContext):
+            Add a 'requestIdentifier' parameter (defaulting to 0), and pipe it
+            through to 'InspectorInstrumentation::addMessageToConsole'.
+
+2012-10-29  Anders Carlsson  <andersca@apple.com>
+
+        String::createCFString should return a RetainPtr
+        https://bugs.webkit.org/show_bug.cgi?id=100419
+
+        Reviewed by Andreas Kling.
+
+        Update callers of String::createCFString.
+
+        * bridge/objc/objc_runtime.mm:
+        (JSC::Bindings::callObjCFallbackObject):
+        * html/HTMLMediaElement.cpp:
+        (WebCore::createFileURLForApplicationCacheResource):
+        * loader/archive/cf/LegacyWebArchive.cpp:
+        (WebCore::LegacyWebArchive::createPropertyListRepresentation):
+        * platform/LocalizedStrings.cpp:
+        (WebCore::formatLocalizedString):
+        (WebCore::contextMenuItemTagLookUpInDictionary):
+        (WebCore::keygenKeychainItemName):
+        (WebCore::imageTitle):
+        * platform/RuntimeApplicationChecks.cpp:
+        (WebCore::mainBundleIsEqualTo):
+        * platform/cf/FileSystemCF.cpp:
+        (WebCore::fileSystemRepresentation):
+        (WebCore::pathAsURL):
+        * platform/graphics/ca/win/PlatformCAAnimationWin.cpp:
+        (PlatformCAAnimation::PlatformCAAnimation):
+        * platform/graphics/ca/win/PlatformCALayerWin.cpp:
+        (resubmitAllAnimations):
+        (PlatformCALayer::addAnimationForKey):
+        (PlatformCALayer::removeAnimationForKey):
+        (PlatformCALayer::setName):
+        * platform/graphics/ca/win/PlatformCALayerWinInternal.cpp:
+        (PlatformCALayerWinInternal::updateTiles):
+        * platform/graphics/cg/ImageBufferCG.cpp:
+        (WebCore::utiFromMIMEType):
+        * platform/graphics/cg/ImageSourceCGMac.mm:
+        (WebCore::MIMETypeForImageSourceType):
+        (WebCore::preferredExtensionForImageSourceType):
+        * platform/mac/ClipboardMac.mm:
+        (WebCore::cocoaTypeFromHTMLClipboardType):
+        (WebCore::utiTypeFromCocoaType):
+        * platform/mac/SSLKeyGeneratorMac.cpp:
+        (WebCore::signedPublicKeyAndChallengeString):
+        * platform/network/cf/AuthenticationCF.cpp:
+        (WebCore::createCF):
+        * platform/network/cf/CookieJarCFNet.cpp:
+        (WebCore::setCookies):
+        * platform/network/cf/DNSCFNet.cpp:
+        (WebCore::DNSResolveQueue::platformResolve):
+        * platform/network/cf/ResourceErrorCF.cpp:
+        (WebCore::ResourceError::cfError):
+        * platform/network/cf/ResourceHandleCFNet.cpp:
+        (WebCore::setDefaultMIMEType):
+        (WebCore::willSendRequest):
+        (WebCore::ResourceHandle::didReceiveAuthenticationChallenge):
+        (WebCore::ResourceHandle::setPrivateBrowsingEnabled):
+        * platform/network/cf/ResourceRequestCFNet.cpp:
+        (WebCore::setHeaderFields):
+        (WebCore::ResourceRequest::doUpdatePlatformRequest):
+        * platform/network/cf/ResourceResponseCFNet.cpp:
+        (WebCore::ResourceResponse::cfURLResponse):
+        * platform/network/cf/SocketStreamHandleCFNet.cpp:
+        (WebCore::SocketStreamHandle::createStreams):
+        (WebCore::SocketStreamHandle::addCONNECTCredentials):
+        (WebCore::SocketStreamHandle::copyCFStreamDescription):
+        * platform/network/mac/ResourceRequestMac.mm:
+        (WebCore::ResourceRequest::doUpdatePlatformRequest):
+        * platform/network/mac/WebCoreURLResponse.mm:
+        (WebCore::adjustMIMETypeIfNecessary):
+        * platform/text/cf/HyphenationCF.cpp:
+        (WebCore::::createValueForKey):
+        * platform/text/cf/StringCF.cpp:
+        (WTF::String::createCFString):
+        * platform/text/cf/StringImplCF.cpp:
+        (WTF::StringImpl::createCFString):
+        * platform/text/mac/StringImplMac.mm:
+        (WTF::StringImpl::operator NSString *):
+        * platform/text/mac/TextCodecMac.cpp:
+        (WebCore::TextCodecMac::encode):
+        * platform/win/SearchPopupMenuWin.cpp:
+        (WebCore::autosaveKey):
+        (WebCore::SearchPopupMenuWin::saveRecentSearches):
+
+2012-10-30  Chris Fleizach  <cfleizach@apple.com>
+
+        AX: Support embedded SVG objects in AX tree
+        https://bugs.webkit.org/show_bug.cgi?id=97571
+
+        Reviewed by Tim Horton.
+
+        This patch allows an SVG image from another resource to be hooked into the AX
+        hierarchy. This is done by creating an AX wrapper for the root SVG that holds onto
+        its native parent image. The SVGChromeClient is then used to connect to this SVG resource.
+
+        Test: accessibility/svg-remote-element.html
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * accessibility/AXObjectCache.cpp:
+        (WebCore::createFromRenderer):
+        * accessibility/AccessibilityAllInOne.cpp:
+        * accessibility/AccessibilityObject.h:
+        (WebCore::AccessibilityObject::isAccessibilitySVGRoot):
+        (AccessibilityObject):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::detach):
+        (WebCore::AccessibilityRenderObject::offsetBoundingBoxForRemoteSVGElement):
+        (WebCore::AccessibilityRenderObject::boundingBoxRect):
+        (WebCore::AccessibilityRenderObject::remoteSVGElementHitTest):
+        (WebCore::AccessibilityRenderObject::elementAccessibilityHitTest):
+        (WebCore::AccessibilityRenderObject::determineAccessibilityRole):
+        (WebCore::AccessibilityRenderObject::isSVGImage):
+        (WebCore::AccessibilityRenderObject::detachRemoteSVGRoot):
+        (WebCore::AccessibilityRenderObject::remoteSVGRootElement):
+        (WebCore::AccessibilityRenderObject::addRemoteSVGChildren):
+        (WebCore::AccessibilityRenderObject::addChildren):
+        * accessibility/AccessibilityRenderObject.h:
+        (AccessibilityRenderObject):
+        * accessibility/AccessibilitySVGRoot.cpp: Added.
+        (WebCore::AccessibilitySVGRoot::AccessibilitySVGRoot):
+        (WebCore::AccessibilitySVGRoot::~AccessibilitySVGRoot):
+        (WebCore::AccessibilitySVGRoot::create):
+        (WebCore::AccessibilitySVGRoot::parentObject):
+        * accessibility/AccessibilitySVGRoot.h: Added.
+        (AccessibilitySVGRoot): Class provides ability to wrap the SVG root of a remote accessibility element.
+        (WebCore::AccessibilitySVGRoot::setParent):
+        (WebCore::AccessibilitySVGRoot::isAccessibilitySVGRoot):
+        (WebCore::toAccessibilitySVGRoot):
+        * accessibility/mac/WebAccessibilityObjectWrapper.mm:
+        (-[WebAccessibilityObjectWrapper position]): The position of AX elements within a remote SVG element needs to be handled 
+        in a special manner.
+        (createAccessibilityRoleMap):
+        * loader/EmptyClients.h:
+        (EmptyChromeClient): Expose isEmptyChromeClient() so Accessibility will know when to apply different policies for finding
+        the accessibility bounding rect of elements.
+        (WebCore::EmptyChromeClient::isEmptyChromeClient):
+        * page/ChromeClient.h:
+        (WebCore::ChromeClient::isEmptyChromeClient):
+        (ChromeClient):
+        * svg/graphics/SVGImage.cpp:
+        * svg/graphics/SVGImageChromeClient.h: Added.
+        (SVGImageChromeClient): Expose the SVGImageChromeClient so that Accessibility can reference its image.
+        (WebCore::SVGImageChromeClient::SVGImageChromeClient):
+        (WebCore::SVGImageChromeClient::isSVGImageChromeClient):
+        (WebCore::SVGImageChromeClient::image):
+        (WebCore::SVGImageChromeClient::chromeDestroyed):
+        (WebCore::SVGImageChromeClient::invalidateContentsAndRootView):
+        (WebCore::toSVGImageChromeClient):
+
+2012-10-30  Dan Carney  <dcarney@google.com>
+
+        add 7 bit strings capabilities to the v8 binding layer
+        https://bugs.webkit.org/show_bug.cgi?id=91850
+
+        Reviewed by Adam Barth.
+
+        This change enables the v8 binding layer to make use of webkit's
+        8 bit string capabilities. Using 8 bit strings leads to certain
+        benchmark performance improvemnts as can be seen in
+        https://bug-91850-attachments.webkit.org/attachment.cgi?id=163334.
+
+        No new tests. Test coverage already extensive.
+
+        * bindings/v8/V8PerIsolateData.cpp:
+        (WebCore::V8PerIsolateData::visitExternalStrings):
+        * bindings/v8/V8StringResource.cpp:
+        (StringTraits):
+        (WebCore::false):
+        (WebCore):
+        (WebCore::true):
+        (WebCore::v8StringToWebCoreString):
+        * bindings/v8/V8ValueCache.cpp:
+        (WebCore::makeExternalString):
+        (WebCore::WebCoreStringResourceBase::visitStrings):
+        * bindings/v8/V8ValueCache.h:
+        (WebCore::WebCoreStringResourceBase::WebCoreStringResourceBase):
+        (WebCore::WebCoreStringResourceBase::~WebCoreStringResourceBase):
+        (WebCore::WebCoreStringResourceBase::atomicString):
+        (WebCoreStringResourceBase):
+        (WebCore::WebCoreStringResourceBase::memoryConsumption):
+
+2012-10-30  Christophe Dumez  <christophe.dumez@intel.com>
+
+        [AC] Fix compilation warnings when enabling Accelerated Compositing
+        https://bugs.webkit.org/show_bug.cgi?id=100741
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Fix a few compilation warnings when building EFL port
+        with accelerated compositing enabled.
+
+        No new tests, no behavior change.
+
+        * platform/graphics/surfaces/qt/GraphicsSurfaceGLX.cpp:
+        (WebCore::GraphicsSurfacePrivate::GraphicsSurfacePrivate):
+        (WebCore::resolveGLMethods):
+        (WebCore::GraphicsSurface::platformCopyToGLTexture):
+        (WebCore::GraphicsSurface::platformLock):
+        * platform/graphics/texmap/TextureMapperGL.cpp:
+        (WebCore::BitmapTextureGL::updateContents):
+
+2012-10-30  No'am Rosenthal  <noam.rosenthal@nokia.com>
+
+        [Qt] Animations jump when the page is suspended
+        https://bugs.webkit.org/show_bug.cgi?id=100673
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        GraphicsLayerAnimations::pause() should accept time from start and not an offset.
+
+        We need to support the "freeze" API before this can be reliably tested.
+        See https://bugs.webkit.org/show_bug.cgi?id=100703.
+
+        * platform/graphics/GraphicsLayerAnimation.cpp:
+        (WebCore::GraphicsLayerAnimation::pause):
+
+2012-10-30  Kondapally Kalyan  <kalyan.kondapally@intel.com>
+
+        [Qt][EFL][AC] While Using WebGL, MiniBrowser segfaults on Refreshing the page.
+        https://bugs.webkit.org/show_bug.cgi?id=100639.
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        TextureMapperSurfaceBackingStore can import textures from a GraphicSurface.
+        In such cases GraphicsSurfaceGLX creates an XPixmap to read texture content
+        from a given WindowId, but doesn't create any new window.
+        However, OffScreenRootWindow always tries to unmap window (in its destructor) resulting in segfault.
+        With this patch OffScreenRootWindow would check for a valid window before trying to unmap it.
+
+        * platform/graphics/surfaces/qt/GraphicsSurfaceGLX.cpp:
+        (WebCore::OffScreenRootWindow::~OffScreenRootWindow):
+
+2012-10-30  Emil A Eklund  <eae@chromium.org>
+
+        [subixel] Change LineWidth::shrinkAvailableWidthForNewFloatIfNeeded to not pixel snap
+        https://bugs.webkit.org/show_bug.cgi?id=100742
+
+        Reviewed by Levi Weintraub.
+
+        As we no longer pixel snap values when computing the current width for a
+        line we should not do it in shrinkAvailableWidthForNewFloatIfNeeded
+        either.
+
+        Test: fast/sub-pixel/float-wrap-zoom.html
+
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::LineWidth::LineWidth): Remove unnecessary ifdef.
+        (WebCore::LineWidth::shrinkAvailableWidthForNewFloatIfNeeded): Use float values instead of pixel snapped/floored values as the line width calculations uses floats.
+
+2012-10-30  Max Vujovic  <mvujovic@adobe.com>
+
+        [CSS Shaders] Reject vertex shaders with custom attributes
+        https://bugs.webkit.org/show_bug.cgi?id=98973
+
+        Reviewed by Dean Jackson.
+
+        Improved CSS Custom Filters shader validation. With this patch:
+        (1) Shaders with custom attributes do not execute (e.g. attribute float my_attribute;).
+        (2) Shaders with a_triangleCoord defined do not execute with an attached mesh.
+
+        Most of the changes are from renaming CustomFilterOperation::MeshType to
+        CustomFilterMeshType, and moving the enumeration to CustomFilterConstants.h. This avoids
+        pulling in CustomFilterOperation for classes that only care about the mesh type.
+
+        Note that in CSS Custom Filters, the a_triangleCoord attribute is only available in detached
+        meshes. In detached meshes, no vertices are shared between triangles. Thus, each vertex
+        belongs to a specific triangle, which a_triangleCoord identifies. In attached meshes,
+        vertices can belong to many triangles, which a_triangleCoord cannot identify because it's
+        only a vec3.
+
+        Tests:
+        Add two new checks to the test file:
+            css3/filters/custom/invalid-custom-filter-attribute-types.html
+        Add two new shaders:
+            css3/filters/resources/invalid-custom-attribute.vs
+            css3/filters/resources/invalid-a-triangle-coord-with-attached-mesh.vs
+
+        * WebCore.xcodeproj/project.pbxproj:
+            Update a broken reference to CustomFilterConstants.h in the Xcode project file.
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::CSSComputedStyleDeclaration::valueForFilter):
+            Replace CustomFilterOperation::MeshType with CustomFilterMeshType.
+        * css/StyleResolver.cpp:
+        (WebCore::StyleResolver::createCustomFilterOperation): Ditto.
+        * platform/graphics/filters/CustomFilterConstants.h:
+            Add CustomFilterMeshType enum to share across the Custom Filters codebase, so that we
+            don't have to include CustomFilterOperation just to access the old
+            CustomFilterOperation::MeshType enum.
+        * platform/graphics/filters/CustomFilterMesh.cpp:
+        (WebCore::CustomFilterMesh::CustomFilterMesh):
+            Replace CustomFilterOperation::MeshType with CustomFilterMeshType.
+        * platform/graphics/filters/CustomFilterMesh.h:
+        (WebCore::CustomFilterMesh::create): Ditto.
+        (WebCore::CustomFilterMesh::meshType): Ditto.
+        (CustomFilterMesh): Ditto.
+        * platform/graphics/filters/CustomFilterMeshGenerator.cpp: Ditto.
+        (WebCore::CustomFilterMeshGenerator::CustomFilterMeshGenerator): Ditto.
+        (WebCore::CustomFilterMeshGenerator::dumpBuffers): Ditto.
+        * platform/graphics/filters/CustomFilterMeshGenerator.h:
+        (CustomFilterMeshGenerator): Ditto.
+        (WebCore::CustomFilterMeshGenerator::floatsPerVertex): Ditto.
+        (WebCore::CustomFilterMeshGenerator::verticesCount): Ditto.
+        * platform/graphics/filters/CustomFilterOperation.cpp: 
+        (WebCore::CustomFilterOperation::CustomFilterOperation): Ditto.
+        * platform/graphics/filters/CustomFilterOperation.h:
+        (WebCore::CustomFilterOperation::create): Ditto.
+        (WebCore::CustomFilterOperation::meshType): Ditto.
+        (CustomFilterOperation): Ditto.
+        * platform/graphics/filters/CustomFilterProgram.cpp:
+        (WebCore::CustomFilterProgram::CustomFilterProgram):
+            Add a meshType constructor parameter because the program now needs to know the meshType
+            to properly validate.
+        (WebCore::CustomFilterProgram::programInfo):
+            Pass meshType to CustomFilterProgram constructor.
+        (WebCore::CustomFilterProgram::operator==):
+            Check the meshType in the equals operator.
+        * platform/graphics/filters/CustomFilterProgram.h:
+            Make vertexShaderString() and fragmentShaderString() public so that we don't have to ask
+            for a programInfo object just to get the shader strings in
+            CoordinatedGraphicsArgumentCoders.cpp.
+        * platform/graphics/filters/CustomFilterProgramInfo.cpp:
+        (WebCore::CustomFilterProgramInfo::CustomFilterProgramInfo):
+            Add a meshType constructor parameter.       
+        (WebCore::CustomFilterProgramInfo::hash):
+            Include the meshType in the validated program hash, since the same shader code can pass
+            or fail validation based on the meshType.
+        (WebCore::CustomFilterProgramInfo::operator==):
+            Check the meshType in the equals operator.
+        * platform/graphics/filters/CustomFilterProgramInfo.h:
+        (CustomFilterProgramInfo):
+            Update method prototype.
+        (WebCore::CustomFilterProgramInfo::meshType):
+            Add meshType getter.
+        * platform/graphics/filters/CustomFilterValidatedProgram.cpp:
+        (WebCore::CustomFilterValidatedProgram::validateSymbols):
+            If the author defines attribute that is is not found in the built-in attribute map,
+            reject the shader.
+            If the author defines a_triangleCoord without a detached mesh type, reject the shader.
+            Also, make this previously file-static function into a method of
+            CustomFilterValidatedProgram because it now needs to access the m_meshType.
+        * platform/graphics/filters/CustomFilterValidatedProgram.h:
+        (CustomFilterValidatedProgram):
+            Add a meshType constructor parameter because the program now needs to know the meshType
+            to properly validate.
+        * platform/graphics/filters/FECustomFilter.cpp:
+        (WebCore::FECustomFilter::FECustomFilter):
+            Replace CustomFilterOperation::MeshType with CustomFilterMeshType.
+        (WebCore::FECustomFilter::create): Ditto.
+        (WebCore::FECustomFilter::bindProgramAndBuffers): Ditto.
+        (WebCore::FECustomFilter::unbindVertexAttributes): Ditto.
+        * platform/graphics/filters/FECustomFilter.h:
+        (FECustomFilter): Ditto.
+        * rendering/style/StyleCustomFilterProgram.h:
+        (WebCore::StyleCustomFilterProgram::create):
+            Add a meshType constructor parameter.
+        (WebCore::StyleCustomFilterProgram::StyleCustomFilterProgram): Ditto.
+
+2012-10-30  Andrey Lushnikov  <lushnikov@google.com>
+
+        Web Inspector: adds isOwnProperty to remote protocol
+        https://bugs.webkit.org/show_bug.cgi?id=100664
+
+        Reviewed by Pavel Feldman.
+
+        Test: inspector/runtime/runtime-getProperties-isOwnProperty.html
+
+        Adds requested 'isOwn' property to the 'PropertyDescriptor' class of the
+        remote debugging protocol. 
+
+        * inspector/InjectedScriptSource.js:
+        (.):
+        * inspector/Inspector.json:
+
+2012-10-30  Zeno Albisser  <zeno@webkit.org>
+
+        [Qt][Win] BitmapTextureGL::updateContents() broken after r132019.
+        https://bugs.webkit.org/show_bug.cgi?id=100680
+
+        When creating a temporary for swizzling the image data,
+        the temporary will have the target size.
+        Therefore no offset within the available image data
+        shall be applied in this case.
+
+        Reviewed by Noam Rosenthal.
+
+        * platform/graphics/texmap/TextureMapperGL.cpp:
+        (WebCore::BitmapTextureGL::updateContents):
+
+2012-10-30  Kent Tamura  <tkent@chromium.org>
+
+        Remove unused code for old input[type=date] UI
+        https://bugs.webkit.org/show_bug.cgi?id=100734
+
+        Reviewed by Hajime Morita.
+
+        The old input[type=date] UI used in Google Chrome 20-23 (text field with
+        a fixed placeholder) was replaced with ENABLE_INPUT_MULTIPLE_FIELDS_UI.
+
+        No new tests because of no behavior changes.
+
+        * html/DateInputType.cpp: Remove ENABLE_INPUT_TYPE_DATE_LEGACY_UI code path.
+        * html/DateInputType.h: Ditto.
+
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::supportsPlaceholder):
+        Remove fixed-placeholder feature.
+        * html/HTMLInputElement.h:
+        (HTMLInputElement): Ditto.
+        * html/HTMLTextFormControlElement.h:
+        (HTMLTextFormControlElement): isPlaceholderEmpty() is not needed to be virtual
+        * html/InputType.cpp: Remove fixed-placeholder feature.
+        * html/InputType.h: Ditto.
+        * html/TextFieldInputType.cpp:
+        (WebCore::TextFieldInputType::updatePlaceholderText): Ditto.
+
+        * platform/text/PlatformLocale.h:
+        (Locale): Remove dateFormatText.
+        * platform/text/LocaleICU.cpp: Ditto.
+        * platform/text/LocaleICU.h: Ditto.
+        * platform/text/LocaleNone.cpp: Ditto.
+        * platform/text/mac/LocaleMac.h: Ditto.
+        * platform/text/mac/LocaleMac.mm: Ditto.
+        * platform/text/win/LocaleWin.cpp: Ditto.
+        * platform/text/win/LocaleWin.h: Ditto.
+        * platform/LocalizedStrings.h:
+        (WebCore): Remove unused functions; calendarTodayText,
+        calendarClearText, dateFormatYearText, dateFormatMonthText,
+        dateFormatDayInMonthText
+
+2012-10-30  Kent Tamura  <tkent@chromium.org>
+
+        Fix crash by calendar picker or suggestion picker
+        https://bugs.webkit.org/show_bug.cgi?id=100728
+
+        Reviewed by Hajime Morita.
+
+        Change DateTimeChooser so that it is ref-coutned.
+
+        Test: platform/chromium/fast/forms/calendar-picker/calendar-picker-type-change-onchange.html
+
+        * platform/DateTimeChooser.h: Made DateTimeChooser RefCounted.
+        * page/ChromeClient.h:
+        (ChromeClient): openDateTimeChooser should return PassRefPtr<DateTimeChooser>.
+        * loader/EmptyClients.h:
+        (EmptyChromeClient): Follow the above change.
+        * loader/EmptyClients.cpp:
+        (WebCore::EmptyChromeClient::openDateTimeChooser): Ditto.
+
+        * html/shadow/PickerIndicatorElement.h:
+        (PickerIndicatorElement): Hold DateTimeChooser in RefPtr<DateTimeChooser>.
+        * html/shadow/PickerIndicatorElement.cpp:
+        (WebCore::PickerIndicatorElement::PickerIndicatorElement):
+        Remove unnecessary initialization.
+
+2012-10-30  Eugene Klyuchnikov  <eustas.bug@gmail.com>
+
+        Web Inspector: Timeline: promote "cpu activity" out of experiment
+        https://bugs.webkit.org/show_bug.cgi?id=100726
+
+        Reviewed by Pavel Feldman.
+
+        1. CPU actibity bars redesigned
+        2. Experiment setting removed
+        3. Feature setting added
+
+        * English.lproj/localizedStrings.js: Updated setting label.
+        * inspector/front-end/Settings.js: Replaced experiment with setting.
+        * inspector/front-end/SettingsScreen.js: Added new setting.
+        * inspector/front-end/TimelinePanel.js: Update cpu bars appearance.
+        * inspector/front-end/timelinePanel.css: Ditto.
+
+2012-10-30  Michelangelo De Simone  <michelangelo@webkit.org>
+
+        [CSS Shaders] Change the default compositing mode and the default CSS value for <fragmentShader>
+        https://bugs.webkit.org/show_bug.cgi?id=94020
+
+        Reviewed by Dean Jackson.
+
+        The default compositing mode has been changed from "normal source-over" to
+        "normal source-atop". This applies to the default fragment shader that will
+        kick in when there is no explicit fragment shader or mix function defined.
+
+        This has required to update all the existing tests; the dummy empty fragment
+        shader has also been removed because not needed.
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::CSSComputedStyleDeclaration::valueForFilter): An existence check
+        for the fragment shader has been added.
+        * css/StyleResolver.cpp:
+        (WebCore::StyleResolver::createCustomFilterOperation): The default program
+        has been updated: PROGRAM_TYPE_BLENDS_TEXTURE (compositing enabled) now is
+        the default.
+        * platform/graphics/filters/CustomFilterProgramInfo.h:
+        (WebCore::CustomFilterProgramMixSettings::CustomFilterProgramMixSettings):
+        New CustomFilterProgramMixSettings defaults to "source-atop" composite
+        operator.
+
+2012-10-30  Ádám Kallai  <kadam@inf.u-szeged.hu>
+
+        [Qt][Mac] Unreviewed build fix.
+        https://bugs.webkit.org/show_bug.cgi?id=100727.
+
+        Speculative build fix after 132858. Include missing CoreFoundation/CoreFoundation.h header.
+
+        * platform/text/cf/AtomicStringCF.cpp:
+
+2012-10-30  Gabor Rapcsanyi  <rgabor@webkit.org>
+
+        Optimize vclip for NEON in VectorMath
+        https://bugs.webkit.org/show_bug.cgi?id=100737
+
+        Reviewed by Zoltan Herczeg.
+
+        Speed up vclip in VectorMath with NEON intrinsics.
+
+        * platform/audio/VectorMath.cpp:
+        (WebCore::VectorMath::vclip):
+
+2012-10-30  Alexandru Chiculita  <achicu@adobe.com>
+
+        [CSS Shaders] Software and composited filters should have a common path
+        https://bugs.webkit.org/show_bug.cgi?id=100532
+
+        Reviewed by Dean Jackson.
+
+        Added computeFilterOperations as a common method between the software filters
+        and hardware composited ones. The method rejects custom filters that are not
+        loaded yet. In bug 100533 it will also convert the CustomFilterOperation to a 
+        ValidatedCustomFilterOperation. That will help us keep the loading and verification 
+        code for the custom filters common across all the ports.
+
+        No new tests, just refactoring existing code.
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::computeFilterOperations):
+        (WebCore):
+        (WebCore::RenderLayer::updateOrRemoveFilterEffect):
+        * rendering/RenderLayer.h:
+        (WebCore):
+        (RenderLayer):
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::updateFilters):
+
+2012-10-30  Alexei Filippov  <alph@chromium.org>
+
+        Web Inspector: Implement native memory snapshot grid view
+        https://bugs.webkit.org/show_bug.cgi?id=100656
+
+        Native memory snapshots are now shown as an expandable tree form
+        using the grid control.
+
+        Reviewed by Yury Semikhatsky.
+
+        * inspector/front-end/NativeMemorySnapshotView.js:
+        (WebInspector.NativeMemorySnapshotView):
+        (WebInspector.NativeSnapshotDataGrid):
+        (WebInspector.NativeSnapshotNode):
+        (WebInspector.NativeSnapshotNode.prototype.createCell):
+        (WebInspector.NativeSnapshotNode.prototype._createSizeCell):
+        (WebInspector.NativeSnapshotNode.prototype._populate):
+        (WebInspector.MemoryBlockViewProperties._initialize):
+        (WebInspector.MemoryBlockViewProperties._forMemoryBlock):
+        * inspector/front-end/dataGrid.css:
+        (.data-grid td):
+        * inspector/front-end/nativeMemoryProfiler.css:
+        (.memory-bar-chart-bar):
+        (.native-snapshot-view):
+        (.native-snapshot-view.visible):
+        (.native-snapshot-view .data-grid):
+        (.native-snapshot-view .data-grid table):
+        (.native-snapshot-view .data-grid div.size-text):
+        (.native-snapshot-view .data-grid div.size-bar):
+        (.native-snapshot-view .data-grid div.percent-text):
+
+2012-10-30  Zoltan Nyul  <zoltan.nyul@intel.com>
+
+        3d rotation with [0, 0, 0] direction vector should not be applied
+        https://bugs.webkit.org/show_bug.cgi?id=100733
+
+        Reviewed by Levi Weintraub.
+
+        As stated in the specification (http://dev.w3.org/csswg/css3-3d-transforms/#transform-functions),
+        a direction vector that cannot be normalized, such as [0, 0, 0], will cause the rotation to not be applied,
+        but webkit applies it with [1, 0, 0] direction vector.
+
+        Test: transforms/3d/general/3dtransform-values.html
+
+        * platform/graphics/transforms/TransformationMatrix.cpp:
+        (WebCore::TransformationMatrix::rotate3d):
+
+2012-10-30  Yury Semikhatsky  <yurys@chromium.org>
+
+        Memory instrumentation: report actual object address for CachedResourceClients
+        https://bugs.webkit.org/show_bug.cgi?id=100659
+
+        Reviewed by Alexander Pavlov.
+
+        Skipped pointers to objects that are not allocated on the heap directly.
+
+        To test this we need to compare addresses of objects traversed by the memory
+        insrumentation with those allocated by the memory allocator. The latter set
+        should include the former one.
+
+        * css/StyleResolver.cpp:
+        (WTF): skip pointers to RuleData structures as they are stored by value in RuleSet
+        objects and should not be reported separately.
+        * loader/cache/CachedResource.cpp:
+        (WTF): do not report memory occupied by CachedResourceClients as objects implementing
+        the interface may have address which differ from CachedResourceClient*. The clients
+        should be reachable from their instrumented owners where we know exact type of the
+        clients and hence can figure correct address.
+
+2012-10-29  Shinya Kawanaka  <shinyak@chromium.org>
+
+        [Refatoring] Remove ElementShadow::insertionPointFor
+        https://bugs.webkit.org/show_bug.cgi?id=100625
+
+        Reviewed by Hajime Morita.
+
+        Now that ElementShadow::insertionPointFor does not do any special things, and it's only used in
+        ComposedShadowTreeWalker. So we can remove it.
+
+        No new tests, simple refactoring.
+
+        * dom/ComposedShadowTreeWalker.cpp:
+        (WebCore::resolveReprojection):
+        (WebCore::AncestorChainWalker::parent):
+        * dom/ElementShadow.cpp:
+        * dom/ElementShadow.h:
+        (ElementShadow):
+        * dom/ShadowRoot.h: ShadowRoot has insertionPointFor declaration, but we don't have any implementation.
+        We should remove it.
+
+2012-10-29  Andy Estes  <aestes@apple.com>
+
+        Fix a typo that caused SVG external resources to be blocked on
+        platforms other than Chromium.
+
+        * loader/cache/CachedResourceLoader.cpp:
+        (WebCore::CachedResourceLoader::canRequest):
+
+2012-10-29  Keishi Hattori  <keishi@webkit.org>
+
+        NSLocale leaks in LocaleMac
+        https://bugs.webkit.org/show_bug.cgi?id=97628
+
+        Reviewed by Kent Tamura.
+
+        We need to adopt the NSLocale object so it doesn't leak and
+        determineLocale() should return a NSLocale without additional retain.
+
+        No new tests.
+
+        * platform/text/mac/LocaleMac.mm:
+        (WebCore::determineLocale): Returns a RetainPtr<NSLocale>.
+        (WebCore::Locale::create):
+        (WebCore::LocaleMac::LocaleMac): m_locale should adopt the NSLocale object.
+        (WebCore::LocaleMac::create): LocaleMac constructor takes NSLocale without additional retain.
+
+2012-10-29  Charles Wei  <charles.wei@torchmobile.com.cn>
+
+        [BlackBerry] Disable redirect to data scheme for potential fishing.
+        https://bugs.webkit.org/show_bug.cgi?id=100713
+
+        Reviewed by George Staikos.
+
+        We will disable redirect to data scheme to avoid potential security concern, 
+        described in klevjers.com/papers/phishing.pdf.
+
+
+        * platform/network/blackberry/NetworkJob.cpp:
+        (WebCore::NetworkJob::handleRedirect):
+
+2012-10-29  Vincent Scheib  <scheib@chromium.org>
+
+        Unreviewed, rolling out r132845.
+        http://trac.webkit.org/changeset/132845
+        https://bugs.webkit.org/show_bug.cgi?id=99975
+
+        Broke chromium builds, linker errors from
+        IDBBindingUtilitiesTest
+
+        * Modules/indexeddb/IDBRequest.cpp:
+        (WebCore::IDBRequest::IDBRequest):
+        (WebCore::IDBRequest::onSuccess):
+        (WebCore::IDBRequest::dispatchEvent):
+        * Modules/indexeddb/IDBRequest.h:
+        (IDBRequest):
+        * bindings/v8/IDBBindingUtilities.cpp:
+        (WebCore::createIDBKeyFromScriptValueAndKeyPath):
+        (WebCore):
+        (WebCore::deserializeIDBValue):
+        (WebCore::injectIDBKeyIntoScriptValue):
+        (WebCore::idbKeyToScriptValue):
+        * bindings/v8/V8PerIsolateData.cpp:
+        (WebCore::V8PerIsolateData::ensureAuxiliaryContext):
+        (WebCore):
+        * bindings/v8/V8PerIsolateData.h:
+        (V8PerIsolateData):
+
+2012-10-29  Anders Carlsson  <andersca@apple.com>
+
+        Fix Windows build.
+
+        * platform/network/cf/ResourceRequestCFNet.cpp:
+        (WebCore::setHeaderFields):
+
+2012-10-28  Mark Rowe  <mrowe@apple.com>
+
+        Simplify Xcode configuration settings that used to vary between OS versions.
+
+        Reviewed by Dan Bernstein.
+
+        * Configurations/Base.xcconfig:
+        * Configurations/DebugRelease.xcconfig:
+        * Configurations/WebCore.xcconfig:
+
+2012-10-28  Mark Rowe  <mrowe@apple.com>
+
+        Remove references to unsupported OS and Xcode versions.
+
+        Reviewed by Anders Carlsson.
+
+        * Configurations/Base.xcconfig:
+        * Configurations/CompilerVersion.xcconfig: Removed.
+        * Configurations/DebugRelease.xcconfig:
+        * Configurations/Version.xcconfig:
+        * Configurations/WebCore.xcconfig:
+        * DerivedSources.make:
+        * WebCore.xcodeproj/project.pbxproj:
+
+2012-10-29  Anders Carlsson  <andersca@apple.com>
+
+        AtomicString(CFStringRef) shouldn't unconditionally create a StringImpl
+        https://bugs.webkit.org/show_bug.cgi?id=100701
+
+        Reviewed by Dan Bernstein.
+
+        * WebCore.exp.in:
+        Export AtomicString::add(CFStringRef).
+
+        * Target.pri:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        Add AtomicStringCF.cpp 
+
+        * platform/text/cf/AtomicStringCF.cpp: Added.
+        (WTF::AtomicString::add):
+        When trying to add the atomic string to the table, first try to get a Latin-1 pointer
+        from the string. Second, try to get a Unicode pointer from the string.
+        If that also fails, copy the string to a temporary unicode buffer and add it from there.
+
+        * platform/text/cf/HyphenationCF.cpp:
+        (WebCore::::createValueForKey):
+        Update for AtomicString::createCFString being removed.
+
+2012-10-25  Stephen Chenney  <schenney@chromium.org>
+
+        feImage should not be allowed to self reference
+        https://bugs.webkit.org/show_bug.cgi?id=94652
+
+        Reviewed by Eric Seidel.
+
+        Add cycle detection for SVG filter application, and also fix a problem
+        with graphics context restore when filters are applied. This also
+        converts the flags in FilterData to a state tracking system, as the
+        number of flags was getting messy and only one flag is valid at any given time.
+
+        Test: svg/filters/feImage-self-and-other-referencing.html
+
+        * rendering/svg/RenderSVGResourceFilter.cpp: Convert to new FilterData
+        state management and enable cycle detection.
+        (WebCore):
+        (WebCore::RenderSVGResourceFilter::removeClientFromCache): Change isBuilt and markedForRemoval flags to state enums.
+        (WebCore::RenderSVGResourceFilter::applyResource): Change flags to state enums and detect cycles.
+        (WebCore::RenderSVGResourceFilter::postApplyResource): Change flags to state and add handling
+        for the various states.
+        (WebCore::RenderSVGResourceFilter::primitiveAttributeChanged): Change isBuilt flag to state enums.
+        * rendering/svg/RenderSVGResourceFilter.h:
+        (WebCore::FilterData::FilterData):
+        (FilterData): Convert to a state tracking system.
+        * rendering/svg/RenderSVGRoot.cpp:
+        (WebCore::RenderSVGRoot::paintReplaced): Add a block around the
+        SVGRenderingContext so that it applies the filter and reverts the
+        context before the calling method restores the context.
+
+2012-10-29  Dan Bernstein  <mitz@apple.com>
+
+        <rdar://problem/12592716> REGRESSION (r132545): With full-page accelerated drawing, a
+        reproducible hang occurs at <http://www.cbsnews.com/stories/2010/01/24/ftn/main6136386.shtml>.
+
+        Reviewed by Anders Carlsson.
+
+        Work around <rdar://problem/12584492> by limiting the scope of the fix for <http://webkit.org/b/100413>.
+
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+        (WebCore::GraphicsContext::clipOut): Reverted to using CGContextGetClipBoundingBox() rather
+        than CGRectInfinite when the context is accelerated and has a transform that is not just
+        a translation or a scale.
+
+2012-10-29  Rob Buis  <rbuis@rim.com>
+
+        [BlackBerry] Simplify AuthenticationChallengeManager::instance
+        https://bugs.webkit.org/show_bug.cgi?id=100614
+
+        Reviewed by Yong Li.
+        Internally reviewed by Lyon Chen.
+
+        Use a standard Singleton pattern here, this makes sure we create lazily.
+
+        * platform/blackberry/AuthenticationChallengeManager.cpp:
+        (WebCore):
+        * platform/blackberry/AuthenticationChallengeManager.h:
+        (AuthenticationChallengeManager):
+
+2012-10-29  Adam Barth  <abarth@webkit.org>
+
+        Block SVG external references pending a security review
+        https://bugs.webkit.org/show_bug.cgi?id=100635
+
+        Reviewed by Eric Seidel.
+
+        We need to do a security review of loading external SVG references
+        before we're sure that it is safe.
+
+        * css/StyleResolver.cpp:
+        (WebCore::StyleResolver::createFilterOperations):
+        * loader/cache/CachedResourceLoader.cpp:
+        (WebCore::CachedResourceLoader::canRequest):
+
+2012-10-29  Joshua Bell  <jsbell@chromium.org>
+
+        IndexedDB: Crash on checking version of corrupt backing store
+        https://bugs.webkit.org/show_bug.cgi?id=100692
+
+        Reviewed by Tony Chang.
+
+        If the backing store fails to open (due to corruption, non-writeable disk, etc)
+        the subsequent schema version check dereferences a null pointer. Fix to only
+        do the schema check if the database opened.
+
+        Chromium tests will be included with crrev.com/11196029
+
+        * Modules/indexeddb/IDBLevelDBBackingStore.cpp:
+        (WebCore::IDBLevelDBBackingStore::open):
+
+2012-10-29  Philip Rogers  <pdr@google.com>
+
+        Let SVGElements have pending resources.
+        https://bugs.webkit.org/show_bug.cgi?id=99694
+
+        Reviewed by Eric Seidel.
+
+        Our SVG pending resource tracking is used for handling dynamic id changes. For example,
+        if an SVG element references an id that is not yet in the document (or has been removed),
+        the SVG element will be 'pending' an id. When styled elements are inserted into
+        the document, buildPendingResourcesIfNeeded() is called to force any pending elements
+        to resolve their dependencies. Only SVGStyledElement targets can be referenced using
+        this infrastructure, and that is not changed with this patch.
+
+        Previously, only SVGStyledElements could have pending resources. Some examples of where
+        this is violated are SVGAnimateElement and SVGMPathElement which are not a styled elements
+        but which can have pending references (they can reference styled elements and
+        paths, respectively). This patch changes the pending resource handling to allow
+        any SVGElement to have pending resources.
+
+        This patch is only a refactoring of code in preparation for WK99694 and does not
+        affect existing functionality or tests.
+
+        * svg/SVGDocumentExtensions.cpp:
+        (WebCore::SVGDocumentExtensions::addPendingResource):
+        (WebCore::SVGDocumentExtensions::isElementPendingResources):
+        (WebCore::SVGDocumentExtensions::isElementPendingResource):
+        (WebCore::SVGDocumentExtensions::removeElementFromPendingResources):
+        (WebCore::SVGDocumentExtensions::removeElementFromPendingResourcesForRemoval):
+        * svg/SVGDocumentExtensions.h:
+        (WebCore):
+        (SVGDocumentExtensions):
+        * svg/SVGElement.cpp:
+        (WebCore::SVGElement::~SVGElement):
+        (WebCore::SVGElement::removedFrom):
+        (WebCore::SVGElement::hasPendingResources):
+        (WebCore):
+        (WebCore::SVGElement::setHasPendingResources):
+        (WebCore::SVGElement::clearHasPendingResourcesIfPossible):
+        * svg/SVGElement.h:
+        (SVGElement):
+        (WebCore::SVGElement::buildPendingResource):
+        * svg/SVGStyledElement.cpp:
+        (WebCore):
+        (WebCore::SVGStyledElement::buildPendingResourcesIfNeeded):
+        (WebCore::SVGStyledElement::removedFrom):
+        * svg/SVGStyledElement.h:
+        (SVGStyledElement):
+        (WebCore::SVGStyledElement::selfHasRelativeLengths):
+
+2012-10-29  Dan Carney  <dcarney@google.com>
+
+        Remove ensureAuxiliaryContext
+        https://bugs.webkit.org/show_bug.cgi?id=99975
+
+        Reviewed by Adam Barth.
+
+        Removed auxilliaryContext as use if it is problematic in IDB.
+
+        No new tests. No change in functionality.
+
+        * Modules/indexeddb/IDBCursor.cpp:
+        (WebCore::IDBCursor::update):
+        (WebCore::IDBCursor::setValueReady):
+        * Modules/indexeddb/IDBCursor.h:
+        (IDBCursor):
+        * Modules/indexeddb/IDBObjectStore.cpp:
+        (WebCore::generateIndexKeysForValue):
+        (WebCore::IDBObjectStore::put):
+        (WebCore):
+        * Modules/indexeddb/IDBRequest.cpp:
+        (WebCore::IDBRequest::onSuccess):
+        (WebCore::IDBRequest::dispatchEvent):
+        * bindings/v8/IDBBindingUtilities.cpp:
+        (WebCore::createIDBKeyFromScriptValueAndKeyPath):
+        (WebCore::deserializeIDBValue):
+        (WebCore::injectIDBKeyIntoScriptValue):
+        * bindings/v8/IDBBindingUtilities.h:
+        (WebCore):
+        * bindings/v8/V8Binding.cpp:
+        (WebCore::toV8Context):
+        (WebCore):
+        * bindings/v8/V8Binding.h:
+        (WebCore):
+        * bindings/v8/V8PerIsolateData.cpp:
+        (WebCore):
+        * bindings/v8/V8PerIsolateData.h:
+
+2012-10-29  Alpha Lam  <hclam@chromium.org>
+
+        [skia] Handle mask box image.
+        https://bugs.webkit.org/show_bug.cgi?id=100570
+
+        Reviewed by James Robinson.
+
+        When drawing an image with source rectangle it should intersect with image rectangle.
+        This should be the case for drawing single image and tiling an image.
+
+        Test: fast/images/mask-box-image-crash.html
+
+        * platform/graphics/skia/ImageSkia.cpp:
+        (WebCore::Image::drawPattern):
+        (WebCore::BitmapImage::draw):
+        (WebCore::BitmapImageSingleFrameSkia::draw):
+
+2012-10-29  Eric Carlson  <eric.carlson@apple.com>
+
+        Support captions when PLUGIN_PROXY_FOR_VIDEO
+        https://bugs.webkit.org/show_bug.cgi?id=100690
+
+        Reviewed by Simon Fraser.
+
+        When built with PLUGIN_PROXY_FOR_VIDEO, WebCore uses a plug-in for the media element's
+        platform media engine. Update this code path so the shadow DOM elements used to display
+        text tracks are created and configured correctly.
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::configureMediaControls): Create media controls if necessary.
+
+        * rendering/RenderEmbeddedObject.cpp:
+        (WebCore::RenderEmbeddedObject::layout): Set the position and size of the shadow DOM when the
+            position of the embedded element changes.
+        * rendering/RenderEmbeddedObject.h:
+
+2012-10-29  Justin Novosad  <junov@google.com>
+
+        [Chromium] flickering observed when copying 2D canvas to webGL texture
+        https://bugs.webkit.org/show_bug.cgi?id=100691
+
+        Reviewed by Stephen White.
+
+        Added a flush to the webgl context after texture upload from an image
+        buffer to ensure proper graphics context synchronization with respect
+        to subsequent changes to the source image.
+
+        Tests: fast/canvas/webgl/canvas-2d-webgl-texture.html
+
+        * platform/graphics/skia/ImageBufferSkia.cpp:
+        (WebCore::ImageBuffer::copyToPlatformTexture):
+
+2012-10-29  Glenn Adams  <glenn@skynav.com>
+
+        [CSSOM] Extraneous whitespace in CSSImportRule.cssText
+        https://bugs.webkit.org/show_bug.cgi?id=100657
+
+        Reviewed by Simon Fraser.
+
+        Remove extraneous whitespace when serializing CSSImportRule.cssText when
+        media list is empty.
+
+        Test: cssom/cssimportrule-media.html
+
+        * css/CSSImportRule.cpp:
+        (WebCore::CSSImportRule::cssText):
+        Don't append extra whitespace if mediaText is empty.
+
+2012-10-29  Arnaud Renevier  <a.renevier@sisa.samsung.com>
+
+        webview not redrawn as needed when accelerated compositing is enabled.
+        https://bugs.webkit.org/show_bug.cgi?id=99109
+
+        Reviewed by Martin Robinson.
+
+        GL shared display is not in the gtk loop and therefore, its events are
+        not captured by gtk. So, we use gdk default instead.
+
+        No new tests, covered by existing tests.
+
+        * platform/gtk/RedirectedXCompositeWindow.cpp:
+        (WebCore::RedirectedXCompositeWindow::RedirectedXCompositeWindow):
+        (WebCore::RedirectedXCompositeWindow::~RedirectedXCompositeWindow):
+        (WebCore::RedirectedXCompositeWindow::resize):
+
+2012-10-29  Pavel Feldman  <pfeldman@chromium.org>
+
+        Web Inspector: bind redo to Ctrl+Y on non-mac platforms
+        https://bugs.webkit.org/show_bug.cgi?id=100685
+
+        Reviewed by Vsevolod Vlasov.
+
+        * inspector/front-end/DefaultTextEditor.js:
+        (WebInspector.DefaultTextEditor.prototype._registerShortcuts):
+
+2012-10-29  Enrica Casucci  <enrica@apple.com>
+
+        Add ENABLE_USERSELECT_ALL feature flag.
+        https://bugs.webkit.org/show_bug.cgi?id=100559
+
+        Reviewed by Eric Seidel.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2012-10-29  Alexandru Chiculita  <achicu@adobe.com>
+
+        [CSS Shaders] Extract the CustomFilterParameterList to its own file
+        https://bugs.webkit.org/show_bug.cgi?id=100548
+
+        Reviewed by Dean Jackson.
+
+        Moved all the CustomFilterParameterList related methods to their own file.
+        Also made CustomFilterParameterList inherit from Vector instead of typedefing it,
+        so that we can add a different operator== and a blend method to it.
+
+        No new tests, just refactoring existing code.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * Target.pri:
+        * WebCore.gypi:
+        * WebCore.xcodeproj/project.pbxproj:
+        * css/StyleResolver.h:
+        * platform/graphics/filters/CustomFilterOperation.cpp:
+        (WebCore::CustomFilterOperation::CustomFilterOperation):
+        (WebCore::CustomFilterOperation::blend):
+        * platform/graphics/filters/CustomFilterOperation.h:
+        (WebCore):
+        (WebCore::CustomFilterOperation::operator==):
+        * platform/graphics/filters/CustomFilterParameterList.cpp: Added.
+        (WebCore):
+        (WebCore::CustomFilterParameterList::operator==):
+        (WebCore::CustomFilterParameterList::checkAlphabeticalOrder):
+        (WebCore::CustomFilterParameterList::blend):
+        * platform/graphics/filters/CustomFilterParameterList.h: Added.
+        (WebCore):
+        (CustomFilterParameterList):
+
+2012-10-29  Brady Eidson  <beidson@apple.com>
+
+        Try to fix 32-bit builds after my incompletely tested m_identifier change.
+
+        Not reviewed.
+
+        * loader/ResourceLoader.h:
+        (WebCore::ResourceLoader::identifier): Revert my "unsigned long" -> "uint64_t" change in two places.
+
+2012-10-29  Csaba Osztrogonác  <ossy@webkit.org>
+
+        [Qt] Text with zero font size renders as X px sometimes, causing fast/text/zero-font-size-2.html to fail
+        https://bugs.webkit.org/show_bug.cgi?id=100115
+
+        Reviewed by Noam Rosenthal.
+
+        * platform/graphics/qt/FontQt.cpp:
+        (WebCore::Font::drawGlyphs):
+
+2012-10-29  Huang Dongsung  <luxtella@company100.net>
+
+        [TexMap] Make GraphicsLayerAnimation choose a proper timing function.
+        https://bugs.webkit.org/show_bug.cgi?id=100623
+
+        Reviewed by Noam Rosenthal.
+
+        Currently, GraphicsLayerAnimation chooses a timing function in the wrong
+        way. Other GraphicsLayers choose a timing function in the similar way to
+        GraphicsLayerCA::timingFunctionForAnimationValue(). The way consists of
+        the following steps.
+        1. Try to query the timing function of the current keyframe animation value.
+        2. If the timing function of #1 is null, try to query the timing function of Animation.
+        3. If the timing function of #2 is null, return CubicBezierTimingFunction::defaultTimingFunction().
+
+        This patch makes GraphicsLayerAnimation choose a timing function in the same way
+        to other implementations.
+
+        Covered by existing animations tests.
+
+        * platform/graphics/GraphicsLayerAnimation.cpp:
+        (WebCore::timingFunctionForAnimationValue):
+        (WebCore::GraphicsLayerAnimation::apply):
+
+2012-10-29  Patrick Dubroy  <dubroy@chromium.org>
+
+        Web Inspector: Toolbar overflow appears outside window
+        https://bugs.webkit.org/show_bug.cgi?id=100663
+
+        Reviewed by Pavel Feldman.
+
+        Since the search bar was removed from the toolbar, the overflow menu appears too far
+        to the right, and is unreadable. Fixed this by aligning it relative to the right side
+        of the window, rather than the left.
+
+        * inspector/front-end/Toolbar.js:
+        (WebInspector.ToolbarDropdown.prototype.show):
+        * inspector/front-end/inspector.css:
+        (#toolbar-dropdown .toolbar-label):
+
+2012-10-29  Michelangelo De Simone  <michelangelo@webkit.org>
+
+        [CSS Shaders] Implement CustomFilterArrayParameter::blend
+        https://bugs.webkit.org/show_bug.cgi?id=96437
+
+        Reviewed by Dean Jackson.
+
+        This patch adds the missing code to blend values within
+        an array() when using Custom Filters.
+
+        Test: css3/filters/custom/custom-filter-array-blending.html
+
+        * platform/graphics/filters/CustomFilterArrayParameter.h:
+        (WebCore::CustomFilterArrayParameter::blend):
+
+2012-10-29  Alexander Pavlov  <apavlov@chromium.org>
+
+        Web Inspector: Drag and drop a URL in inspector is not working as expected
+        https://bugs.webkit.org/show_bug.cgi?id=100527
+
+        Reviewed by Yury Semikhatsky.
+
+        Inhibit custom dragstart handling when the active element is A.
+
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeOutline.prototype._ondragstart):
+
+2012-10-29  Mike West  <mkwst@chromium.org>
+
+        Web Inspector: Error/warning count is one pixel off.
+        https://bugs.webkit.org/show_bug.cgi?id=100660
+
+        Reviewed by Pavel Feldman.
+
+        The error/warning count div had a top padding of 6. That was one pixel
+        too many.
+
+        * inspector/front-end/inspector.css:
+        (#error-warning-count):
+
+2012-10-29  Shinya Kawanaka  <shinyak@chromium.org> 
+
+        [Refactoring] Use isActiveInsertionPoint() instead of isInsertionPoint()
+        https://bugs.webkit.org/show_bug.cgi?id=100459
+
+        Reviewed by Hajime Morita.
+
+        Checking InsertionPoint and its activeness with two if-statement is error-prone. We would like to
+        use a utility function which checks both at once.
+
+        We rewrite some lines with such function.
+
+        No new tests, simple refactoring.
+
+        * dom/ComposedShadowTreeWalker.cpp:
+        (WebCore::ComposedShadowTreeWalker::traverseNode):
+        * html/shadow/ContentDistributor.cpp:
+        (WebCore::ContentDistributor::populate):
+        (WebCore::ContentDistributor::distribute):
+        (WebCore::ContentDistributor::distributeNodeChildrenTo):
+        * html/shadow/InsertionPoint.h:
+        (WebCore::isInsertionPoint): Since our convention is the argument of this kind of function should not be null,
+        we would like to make it similar to the other functions.
+        (WebCore::toInsertionPoint):
+        (WebCore::isLowerEncapsulationBoundary):
+
+2012-10-29  Patrick Dubroy  <dubroy@chromium.org>
+
+        Web Inspector: Fix vertical alignment in toolbar backgrounds and overflow button.
+        https://bugs.webkit.org/show_bug.cgi?id=100373
+
+        Reviewed by Pavel Feldman.
+
+        Fix the background image for the selected toolbar item to be vertically centered.
+        Make close button and toolbar overflow button vertically centered for any toolbar
+        height.
+
+        * inspector/front-end/Toolbar.js: Remove unused variable.
+        * inspector/front-end/inspector.css:
+        (.toolbar-item.toggleable):
+        (body.compact .toolbar-item.toggleable):
+        (.toolbar-item.toggleable.toggled-on):
+        (body.compact .toolbar-label):
+        (#toolbar-dropdown-arrow):
+        (#close-button-left, #close-button-right):
+        (.toolbar-item.close-left):
+        * inspector/front-end/inspector.html:
+
+2012-10-29  Eugene Klyuchnikov  <eustas.bug@gmail.com>
+
+        Web Inspector: Timeline: Overview bars do not correspond to timeline bars
+        https://bugs.webkit.org/show_bug.cgi?id=100500
+
+        Reviewed by Yury Semikhatsky.
+
+        Fix: do not shorten bars by nested records of the same category.
+
+        * inspector/front-end/TimelineOverviewPane.js: Check added.
+
+2012-10-29  Eugene Klyuchnikov  <eustas.bug@gmail.com>
+
+        Web Inspector: Timeline: make cpu-monitoring feature available only on capable browsers
+        https://bugs.webkit.org/show_bug.cgi?id=100530
+
+        Reviewed by Yury Semikhatsky.
+
+        Motivation: cpu-monitoring feature looks like a glitch,
+        when it is not supported by browser.
+
+        * inspector/Inspector.json: Added capability getter to protocol.
+        * inspector/InspectorClient.h: Added capability getter.
+        * inspector/InspectorTimelineAgent.cpp: Proxy to request to client.
+        * inspector/InspectorTimelineAgent.h: Added capability getter.
+        * inspector/front-end/Settings.js: Added capability field.
+        * inspector/front-end/TimelinePanel.js: Check capability.
+        * inspector/front-end/inspector.js: Forward capability value.
+
+2012-10-29  Antti Koivisto  <antti@apple.com>
+
+        Move seamless stylesheet collecting to DocumentStyleSheetCollection
+        https://bugs.webkit.org/show_bug.cgi?id=100655
+
+        Reviewed by Andreas Kling.
+
+        Move the code from StyleResolver to DocumentStyleSheetCollection. StyleResolver should focus on resolving style.
+
+        * css/StyleResolver.cpp:
+        (WebCore::StyleResolver::StyleResolver):
+        
+            Use standard create() pattern.
+
+        (WebCore):
+        * css/StyleResolver.h:
+        (StyleResolver):
+        * dom/Document.cpp:
+        (WebCore::Document::Document):
+        * dom/DocumentStyleSheetCollection.cpp:
+        (WebCore::collectActiveCSSStyleSheetsFromSeamlessParents):
+        
+            Since parent activeAuthorStyleSheets() contains all seamlessly inherited sheets too, this does not need to
+            iterate to ancestors anymore.
+
+        (WebCore):
+        (WebCore::DocumentStyleSheetCollection::updateActiveStyleSheets):
+        * dom/DocumentStyleSheetCollection.h:
+        (WebCore::DocumentStyleSheetCollection::create):
+        (DocumentStyleSheetCollection):
+        (WebCore::DocumentStyleSheetCollection::styleSheetsForStyleSheetList):
+        (WebCore::DocumentStyleSheetCollection::activeAuthorStyleSheets):
+        
+            activeAuthorStyleSheets() now includes the stylesheets inherited from the seamless parent too.
+
+        (WebCore::DocumentStyleSheetCollection::needsUpdateActiveStylesheetsOnStyleRecalc):
+
+2012-10-29  Andreas Kling  <kling@webkit.org>
+
+        Don't expose implementation details of StylePropertySet storage.
+        <http://webkit.org/b/100644>
+
+        Reviewed by Antti Koivisto.
+
+        Add a StylePropertySet::PropertyReference class, now returned by propertyAt(index).
+        This will allow us to refactor the internal storage of StylePropertySet without
+        breaking its API.
+
+        A PropertyReference is a simple inlinable wrapper around a StylePropertySet&/index pair.
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        * css/CSSParser.cpp:
+        * css/CSSParser.h:
+        * css/SVGCSSParser.cpp:
+        * css/StylePropertySet.cpp:
+        (WebCore::StylePropertySet::asText):
+        (WebCore::StylePropertySet::mergeAndOverrideOnConflict):
+        (WebCore::StylePropertySet::findPropertyWithId):
+        (WebCore::StylePropertySet::reportMemoryUsage):
+        * css/StylePropertySet.h:
+        (StylePropertySet):
+        (PropertyReference):
+        (WebCore::StylePropertySet::PropertyReference::PropertyReference):
+        (WebCore::StylePropertySet::PropertyReference::id):
+        (WebCore::StylePropertySet::PropertyReference::isImportant):
+        (WebCore::StylePropertySet::PropertyReference::isInherited):
+        (WebCore::StylePropertySet::PropertyReference::cssName):
+        (WebCore::StylePropertySet::PropertyReference::cssText):
+        (WebCore::StylePropertySet::PropertyReference::value):
+        (WebCore::StylePropertySet::PropertyReference::propertyInternal):
+        (WebCore::StylePropertySet::propertyAt):
+        (WebCore::StylePropertySet::propertyAtInternal):
+        (WebCore):
+        * css/StyleResolver.cpp:
+        (WebCore::attributeStylesEqual):
+        (WebCore::StyleResolver::applyProperties):
+        (WebCore::StyleResolver::resolveVariables):
+        * editing/ApplyStyleCommand.cpp:
+        * editing/EditingStyle.cpp:
+        (WebCore::EditingStyle::mergeStyle):
+        (WebCore::EditingStyle::mergeStyleFromRulesForSerialization):
+        * editing/Editor.cpp:
+        * editing/markup.cpp:
+        * page/Frame.cpp:
+        * svg/SVGFontFaceElement.cpp:
+
+2012-10-29  Kent Tamura  <tkent@chromium.org>
+
+        Move LocaleWin.{cpp,h} to platform/text/win/
+        https://bugs.webkit.org/show_bug.cgi?id=100641
+
+        Reviewed by Kentaro Hara.
+
+        We have platform/text/win/ directory. Windows-specific files should be
+        in it.
+        Note that these files are used only in Chromium-win for now.
+
+        No new tests. This doesn't change any behavior.
+
+        * WebCore.gyp/WebCore.gyp: Fix path names.
+        * WebCore.gypi: Ditto.
+        * platform/text/win/LocaleWin.cpp: Renamed from Source/WebCore/platform/text/LocaleWin.cpp.
+        * platform/text/win/LocaleWin.h: Renamed from Source/WebCore/platform/text/LocaleWin.h.
+
+2012-10-29  Kent Tamura  <tkent@chromium.org>
+
+        Rename Localizer to Locale
+        https://bugs.webkit.org/show_bug.cgi?id=100634
+
+        Reviewed by Kentaro Hara.
+
+        - Rename Localizer class to Locale
+        - Rename localizer with locale in variable names
+        - Rename localizer with locale in function names
+
+        No new tests. This doesn't make any behavior changes.
+
+        * dom/Document.h:
+        (WebCore): Declare Locale instead of Localizer.
+        (Document):
+        - Rename getCachedLocalizer to getCachedLocale.
+        - Rename LocaleToLocalizerMap to LocaleIdentifierToLocaleMap.
+        - Rename m_localizerCache to m_localeCache.
+        * dom/Document.cpp:
+        (WebCore::Document::getCachedLocale): Follow renamings.
+        * dom/Element.h:
+        (WebCore): Declare Locale instead of Localizer.
+        (Element): Rename localizer() to locale().
+        * dom/Element.cpp:
+        (WebCore::Element::locale): Follow renamings.
+
+        * html/BaseDateAndTimeInputType.cpp:
+        (WebCore::BaseDateAndTimeInputType::localizeValue): Ditto.
+        (WebCore::BaseDateAndTimeInputType::convertFromVisibleValue): Ditto.
+        * html/BaseMultipleFieldsDateAndTimeInputType.cpp:
+        (WebCore::BaseMultipleFieldsDateAndTimeInputType::updateInnerTextValue): Ditto.
+        * html/DateInputType.cpp:
+        (WebCore::DateInputType::fixedPlaceholder): Ditto.
+        (WebCore::DateInputType::setupLayoutParameters): Ditto.
+        * html/DateTimeInputType.cpp:
+        (WebCore::DateTimeInputType::setupLayoutParameters): Ditto.
+        * html/DateTimeLocalInputType.cpp:
+        (WebCore::DateTimeLocalInputType::setupLayoutParameters): Ditto.
+        * html/MonthInputType.cpp:
+        (WebCore::MonthInputType::setupLayoutParameters): Ditto.
+        * html/NumberInputType.cpp:
+        (WebCore::NumberInputType::localizeValue): Ditto.
+        (WebCore::NumberInputType::convertFromVisibleValue): Ditto.
+        * html/TimeInputType.cpp:
+        (WebCore::TimeInputType::localizeValue): Ditto.
+        (WebCore::TimeInputType::setupLayoutParameters): Ditto.
+
+        * html/shadow/DateTimeEditElement.h:
+        (WebCore): Declare Locale instead of Localizer.
+        (LayoutParameters): Rename localizer data member to locale.
+        (WebCore::DateTimeEditElement::LayoutParameters::LayoutParameters): Follow renamings.
+        * html/shadow/DateTimeEditElement.cpp:
+        (WebCore::DateTimeEditBuilder::visitField): Ditto.
+        * html/shadow/DateTimeNumericFieldElement.h:
+        (DateTimeNumericFieldElement): Rename localizerForOwner to localeForOwner.
+        * html/shadow/DateTimeNumericFieldElement.cpp:
+        (WebCore::DateTimeNumericFieldElement::formatValue): Follow renamings.
+        (WebCore::DateTimeNumericFieldElement::handleKeyboardEvent): Ditto.
+        (WebCore::DateTimeNumericFieldElement::localeForOwner): Ditto.
+        * page/PagePopupClient.h:
+        (WebCore): Declare Locale instead of Localizer.
+        (PagePopupClient): Rename localizer member function to locale.
+        * page/PagePopupController.cpp:
+        (WebCore::PagePopupController::localizeNumberString): Follow renamings.
+
+        * platform/text/PlatformLocale.cpp: Rename the Localizer class to Locale.
+        (DateTimeStringBuilder):
+        (WebCore::DateTimeStringBuilder::DateTimeStringBuilder):
+        (WebCore::Locale::~Locale):
+        (WebCore::Locale::setLocaleData): Renamed from setLocalizerData.
+        (WebCore::Locale::convertToLocalizedNumber):
+        (WebCore::Locale::detectSignAndGetDigitRange):
+        (WebCore::Locale::matchedDecimalSymbolIndex):
+        (WebCore::Locale::convertFromLocalizedNumber):
+        (WebCore::Locale::localizedDecimalSeparator):
+        (WebCore::Locale::dateTimeFormatWithSeconds):
+        (WebCore::Locale::dateTimeFormatWithoutSeconds):
+        (WebCore::Locale::formatDateTime):
+        * platform/text/PlatformLocale.h: Update the ifndef macro.
+        (Locale): Renamed from Localizer. Also, renamed the followings:
+         - initializeLocalizerData -> initializeLocaleData
+         - setLocalizerData -> setLocaleData
+         - m_hasLocalizerData -> m_hasLocaleData
+        (WebCore::Locale::Locale):
+        (WebCore::Locale::createDefault):
+        * platform/text/LocaleICU.cpp: Follow renamings.
+        * platform/text/LocaleICU.h: Ditto.
+        * platform/text/LocaleNone.cpp: Ditto.
+        * platform/text/LocaleWin.cpp: Ditto.
+        * platform/text/LocaleWin.h: Ditto.
+        * platform/text/mac/LocaleMac.h: Ditto.
+        * platform/text/mac/LocaleMac.mm: Ditto.
+
+2012-10-29  Mike West  <mkwst@chromium.org>
+
+        Web Inspector: Error messages lines in console are 1px taller than regular messages
+        https://bugs.webkit.org/show_bug.cgi?id=100521
+
+        Reviewed by Pavel Feldman.
+
+        The inspector is adding a 1px bottom border to list elements inside
+        a disclosure list. This is unnecessary in the current layout; it's
+        causing console messages with stack traces to be one pixel taller than
+        other console messages, which this patch fixes.
+
+        As a drive-by, this patch also adjusts the disclosure triangle's
+        position to match.
+
+        * inspector/front-end/inspector.css:
+        (.outline-disclosure li):
+        (.outline-disclosure li.parent::before):
+
+2012-10-29  Mike West  <mkwst@chromium.org>
+
+        Web Inspector: The bubble for repeated errors is misplaced.
+        https://bugs.webkit.org/show_bug.cgi?id=100525
+
+        Reviewed by Pavel Feldman.
+
+        The repeated-message bubble is displayed as an inline-block element,
+        which works well as long as no stack trace is present. If present, the
+        message is wrapped in an 'ol' element displayed as a block, which pushes
+        itself down to the next line.
+
+        To avoid that issue, this patch switches the wrapper element to flexbox,
+        glorious flexbox.
+
+        * inspector/front-end/inspector.css:
+        (.console-message .bubble):
+        (.repeated-message .outline-disclosure):
+        (.filter-all .console-log-level.repeated-message, .filter-logs .console-log-level.repeated-message):
+
+2012-10-29  Alexander Pavlov  <apavlov@chromium.org>
+
+        Web Inspector: [Styles] Handle non-parsedOk properties as inactive ones
+        https://bugs.webkit.org/show_bug.cgi?id=100119
+
+        Reviewed by Vsevolod Vlasov.
+
+        Test: inspector/styles/inactive-properties.html
+
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylesSidebarPane.createExclamationMark):
+        (WebInspector.ComputedStylePropertiesSection.prototype.rebuildComputedTrace):
+        * inspector/front-end/elementsPanel.css:
+        (.styles-section.computed-style .properties li.not-parsed-ok):
+        (.styles-section.computed-style .properties li.not-parsed-ok img.exclamation-mark):
+        (.styles-section .properties .not-parsed-ok):
+
+2012-10-29  Eric Seidel  <eric@webkit.org>
+
+        Make rendering tables with <colgroups> twice as fast by avoiding walking the DOM for colgroups 4 times for each cell
+        https://bugs.webkit.org/show_bug.cgi?id=100630
+
+        Reviewed by Ojan Vafai.
+
+        This is not a complete fix.  Our rendering of this large tables still takes 7.8 seconds
+        on my retina MBP (down from 14.3s before this change).
+        It's very expensive to walk the DOM each time we call RenderTable::colElement
+        so this caches the RenderTableCol* in a vector for easier walking.
+        We invalidate the cache any time a RenderTableCol is added or removed from the
+        rendering sub-tree to avoid holding a bad pointer.
+
+        * rendering/RenderTable.cpp:
+        (WebCore::RenderTable::RenderTable):
+        (WebCore::RenderTable::invalidateCachedColumns):
+        (WebCore):
+        (WebCore::RenderTable::addColumn):
+        (WebCore::RenderTable::removeColumn):
+        (WebCore::RenderTable::updateColumnCache):
+        (WebCore::RenderTable::slowColElement):
+        * rendering/RenderTable.h:
+        (RenderTable):
+        * rendering/RenderTableCol.cpp:
+        (WebCore::RenderTableCol::insertedIntoTree):
+        (WebCore):
+        (WebCore::RenderTableCol::willBeRemovedFromTree):
+        * rendering/RenderTableCol.h:
+
+2012-10-28  Kent Tamura  <tkent@chromium.org>
+
+        Rename Localizer.{cpp,h} to PlatformLocale.{cpp,h}
+        https://bugs.webkit.org/show_bug.cgi?id=100627
+
+        Reviewed by Yuta Kitamura.
+
+        We'd like to rename Localizer class to Locale class. However we use
+        PlatformLocale.cpp and PlatformLocale.h as their file names because
+        <locale.h> exists in the C standard.  In this patch, we rename only file
+        names. We're going to rename the class name later.
+
+        No new tests. This doesn't make any behavior change.
+
+        * platform/text/PlatformLocale.h: Renamed from Source/WebCore/platform/text/Localizer.h.
+        * platform/text/PlatformLocale.cpp: Renamed from Source/WebCore/platform/text/Localizer.cpp.
+        Follow the Localizer.h -> PlatformLocale.cpp renaming.
+
+        * CMakeLists.txt: Follow the file name renaming.
+        * GNUmakefile.list.am: Ditto.
+        * Target.pri: Ditto.
+        * WebCore.gypi: Ditto.
+        * WebCore.vcproj/WebCore.vcproj: Ditto.
+        * WebCore.xcodeproj/project.pbxproj: Ditto.
+        * dom/Document.cpp: Ditto.
+        * html/BaseDateAndTimeInputType.cpp: Ditto.
+        * html/BaseMultipleFieldsDateAndTimeInputType.cpp: Ditto.
+        * html/DateInputType.cpp: Ditto.
+        * html/DateTimeInputType.cpp: Ditto.
+        * html/DateTimeLocalInputType.cpp: Ditto.
+        * html/MonthInputType.cpp: Ditto.
+        * html/NumberInputType.cpp: Ditto.
+        * html/TimeInputType.cpp: Ditto.
+        * html/shadow/DateTimeEditElement.cpp: Ditto.
+        * html/shadow/DateTimeNumericFieldElement.cpp: Ditto.
+        * page/PagePopupController.cpp: Ditto.
+        * platform/text/LocaleICU.h: Ditto.
+        * platform/text/LocaleNone.cpp: Ditto.
+        * platform/text/LocaleWin.h: Ditto.
+        * platform/text/mac/LocaleMac.h: Ditto.
+
+2012-10-28  Shinya Kawanaka  <shinyak@chromium.org>
+
+        The shadow element is not reprojected to a nested ShadowRoot.
+        https://bugs.webkit.org/show_bug.cgi?id=99228
+
+        Reviewed by Dimitri Glazkov.
+
+        We support shadow reprojection; elements distributed to <shadow> element can be reprojected to <content> now.
+
+        First, we have a distribution vector for each InsertionPoint, even if InsertionPoint is a shadow insertion point.
+        And we update a node-distribution map. Basically We're creating a map from node to InsertionPoint in ElementShadow.
+        If a node can be distributed to several InsertionPoint (e.g. in case reprojection happens),
+        the InsertionPoint in older ShadowDOM is chosen.
+
+        We also fix ComposedShadowTreeWalker to consider shadow reprojection.
+
+        Tests: fast/dom/shadow/composed-shadow-tree-walker-shadow-reprojection.html
+               fast/dom/shadow/shadow-reprojection-click.html
+               fast/dom/shadow/shadow-reprojection-dynamic.html
+               fast/dom/shadow/shadow-reprojection-fallback.html
+               fast/dom/shadow/shadow-reprojection.html
+               fast/dom/shadow/shadow-reprojection2.html
+
+        * css/StyleResolver.cpp:
+        (WebCore::shouldResetStyleInheritance): Now context.insertionPoint() returns the final insertion point where
+        a node is distributed. So we don't have to trace shadow insertion point anymore here.
+        (WebCore::StyleResolver::styleForElement): Since a direct child of ShadowRoot can be distributed now. In that case,
+        we don't have any parentElement. The parent node is a ShadowRoot in that case.
+        * dom/ComposedShadowTreeWalker.cpp:
+        (WebCore::nodeCanBeDistributed): If a node can be distributed, returns true.
+        (WebCore):
+        (WebCore::resolveReprojection): Resolves content-reprojection and shadow-reprojection both.
+        (WebCore::ComposedShadowTreeWalker::traverseSiblingOrBackToInsertionPoint):
+        (WebCore::ComposedShadowTreeWalker::traverseParent):
+        (WebCore::ComposedShadowTreeWalker::traverseParentBackToYoungerShadowRootOrHost): A case ShadowRoot is assigned
+        to some InsertionPoint should be handled with in traverseSiblingOrBackToInsertionPoint. So we remove it.
+        (WebCore::AncestorChainWalker::parent): Now we have a case that a direct child of ShadowRoot can be distributed.
+        In that case, we should not update m_distributedNode.
+        * dom/ElementShadow.cpp:
+        (WebCore::ElementShadow::insertionPointFor): Since we have a distribution vector for each InsertionPoint,
+        we don't have a special case that a ShadowRoot is assigned to some InsertionPoint. Actually the existing code
+        is not correct now due to shadow reprojection.
+        * html/shadow/ContentDistributor.cpp:
+        (WebCore::ContentDistributor::populate): Populate a POOL. If a node is InsertionPoint, we fill it with the
+        distributed nodes.
+        (WebCore):
+        (WebCore::ContentDistributor::distribute): Since we want to make a distribution vector for each InsertionPoint,
+        we have to resolve a shadow InsertionPoint
+        (WebCore::ContentDistributor::distributeNodeChildrenTo):
+        * html/shadow/ContentDistributor.h:
+        (ContentDistributor):
+        * html/shadow/HTMLShadowElement.h:
+        (WebCore::toHTMLShadowElement):
+        (WebCore):
+        * html/shadow/InsertionPoint.h:
+        (WebCore::parentNodeForDistribution):
+        (WebCore::parentElementForDistribution):
+        (WebCore):
+
+2012-10-28  Kunihiko Sakamoto  <ksakamoto@chromium.org>
+
+        Webkit adds a boundary to the Content-Type: text/plain POST header
+        https://bugs.webkit.org/show_bug.cgi?id=100445
+
+        Reviewed by Kent Tamura.
+
+        Fixed a bug where an empty boundary parameter was added to Content-Type
+        header when POSTing forms with enctype=text/plain.
+
+        Test: http/tests/misc/form-post-textplain.html
+
+        * loader/FormSubmission.cpp:
+        (WebCore::FormSubmission::populateFrameLoadRequest): Add boundary parameter to
+        Content-Type only when a boundary string is generated.
+
+2012-10-28  Philip Rogers  <pdr@google.com>
+
+        Cache calcMode() value for SVG animations.
+        https://bugs.webkit.org/show_bug.cgi?id=99694
+
+        Reviewed by Eric Seidel.
+
+        This patch refactors SVGAnimationElement::calcMode() to return a cached value instead
+        of recalculating its value on every call. On a simple test of 100 rectangles with 100
+        animations each, calls to calcMode() account for 3% of the total animation. After this
+        patch, calcMode() no longer appears in animation profiles at all.
+
+        No new tests as this functionality is covered by existing tests.
+
+        * svg/SVGAnimateMotionElement.cpp:
+        (WebCore::SVGAnimateMotionElement::SVGAnimateMotionElement):
+
+            The default calcMode for all animation types is linear except AnimateMotion,
+            which defaults to CalcModePaced.
+            See: http://www.w3.org/TR/SVG/single-page.html#animate-CalcModeAttribute
+
+        * svg/SVGAnimationElement.cpp:
+        (WebCore::SVGAnimationElement::SVGAnimationElement):
+        (WebCore::SVGAnimationElement::isSupportedAttribute):
+        (WebCore::SVGAnimationElement::parseAttribute):
+        (WebCore::SVGAnimationElement::setCalcMode):
+        * svg/SVGAnimationElement.h:
+        (WebCore::SVGAnimationElement::calcMode):
+        (WebCore::SVGAnimationElement::setCalcMode):
+        (SVGAnimationElement):
+
+2012-10-28  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Get rid of StyleResolver state related to unknown pseudo-elements.
+        https://bugs.webkit.org/show_bug.cgi?id=100582
+
+        Reviewed by Eric Seidel.
+
+        All of the state, related to unknown pseudo-elements is already understood at the time of collecting rules.
+        We can just get rid of most of this code in StyleResolver.
+
+        At the time of matching rules, we know for certain that only rules that contain unknown pseudo-elements,
+        or are UA rules, or are explicitly invited by a TreeScope will match. So we can just return early in many cases.
+
+        No change in behavior, covered by existing tests.
+
+        * css/SelectorChecker.cpp:
+        (WebCore::SelectorChecker::checkSelector): Removed now-unnecessary param.
+        (WebCore::SelectorChecker::checkOneSelector): Ditto.
+        * css/SelectorChecker.h:
+        (SelectorChecker): Ditto.
+        * css/StyleResolver.cpp:
+        (WebCore::StyleResolver::StyleResolver): Ditto.
+        (MatchingUARulesScope): Moved class definition here, since we now use it in a different place.
+        (WebCore::StyleResolver::collectMatchingRules): Changed the logic to stop matching rules that definitely won't match in a different scope.
+        (WebCore::StyleResolver::collectMatchingRulesForList): Removed code that's now unnecesssary.
+        (WebCore::StyleResolver::checkSelector): Removed now-unnecessary param.
+        (WebCore::StyleResolver::checkRegionSelector): Removed weird dead code.
+        * css/StyleResolver.h:
+        (StyleResolver): Removed now-unnecessary member.
+
+2012-10-28  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r132696.
+        http://trac.webkit.org/changeset/132696
+        https://bugs.webkit.org/show_bug.cgi?id=100609
+
+        Needs a bit more clean-up on Chrome Web UI side. (Requested by
+        dglazkov on #webkit).
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::updateFirstLetter):
+        * rendering/RenderListBox.h:
+        * rendering/RenderObjectChildList.cpp:
+        (WebCore::RenderObjectChildList::updateBeforeAfterContent):
+
+2012-10-27  Alexey Proskuryakov  <ap@apple.com>
+
+        All tests crash in WebKit1 mode
+        https://bugs.webkit.org/show_bug.cgi?id=100602
+
+        Reviewed by Sam Weinig.
+
+        * platform/PlatformStrategies.cpp: (WebCore::setPlatformStrategies): Fix an incorrect
+        assertion - if this function is called twice, it should be with the same strategy.
+
+2012-10-27  Anders Carlsson  <andersca@apple.com>
+
+        Fix AVFoundation build.
+
+        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
+        (WebCore::MediaPlayerPrivateAVFoundationObjC::addKey):
+
+2012-10-27  David Barton  <dbarton@mathscribe.com>
+
+        ASSERTION FAILED: m_next in LayoutState.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=99796
+
+        Reviewed by Eric Seidel.
+
+        Before RenderMathMLBlock::computeChildrenPreferredLogicalHeights calls child->layoutIfNeeded(),
+        it must ensure a layoutState exists. We disable it in any case, since we are just calculating
+        metrics here, and the final layout may well happen again.
+
+        No new tests. I don't know how to create an automated test for this. The crashes users are
+        seeing are flaky.
+
+        * rendering/mathml/RenderMathMLBlock.cpp:
+        (WebCore::RenderMathMLBlock::computeChildrenPreferredLogicalHeights):
+
+2012-10-27  David Barton  <dbarton@mathscribe.com>
+
+        [MathML] Improve some addChild methods
+        https://bugs.webkit.org/show_bug.cgi?id=98791
+
+        Reviewed by Eric Seidel.
+
+        MathML addChild methods need to handle any anonymous renderers correctly. Actually, most MathML elements have a fixed
+        number of children, so conformant javascript won't be doing arbitrary addChild and removeChild calls. However, we don't
+        want any assertions to fail, and we do want addChild to work correctly when beforeChild == 0, to build up the original
+        renderer, and then replaceChild at least should work correctly after that. We therefore clean up these routines before
+        giving them to the chromium fuzzers.
+        
+        It's best to build the anonymous wrappers just once initially if possible, so empty wrappers aren't left in the render
+        tree after later removeChild calls.
+
+        Test: mathml/presentation/dynamic.html added for mfrac and msqrt. There are already tests for dynamically changing
+        msub/sup elements, in mathml/presentation/m*-changed.xhtml.
+
+        * rendering/mathml/RenderMathMLFraction.cpp:
+        (WebCore::RenderMathMLFraction::addChild):
+            - The two wrappers are built initially. Also, the old RenderMathMLBlock::addChild(row, beforeChild); doesn't really
+              work because beforeChild is buried inside a wrapper. This new routine allows the numerator and denominator to be
+              added initially, and then later replaced with replaceChild. It's not clear whether e.g. a plain removeChild of a
+              numerator should move the remaining child from the denominator to the numerator or not, so we ignore that for now.
+        * rendering/mathml/RenderMathMLRoot.cpp:
+        (WebCore::RenderMathMLRoot::addChild):
+            - A bit of bullet-proofing for the fuzzers.
+        * rendering/mathml/RenderMathMLSubSup.cpp:
+        (WebCore::RenderMathMLSubSup::addChild):
+            - Like RenderMathMLFraction::addChild, we create the wrappers once initially, and then fill them dynamically.
+
+2012-10-27  Levi Weintraub  <leviw@chromium.org>
+
+        Background images can incorrectly repeat with sub-pixel layout
+        https://bugs.webkit.org/show_bug.cgi?id=94622
+
+        Reviewed by Emil A Eklund.
+
+        Attempting to better match author expectations when painting tiled background images. When under
+        the effects of zoom with sub-pixel layout enabled, the drawn size of a rendered element can
+        differ depending on its location. This change looks at the size of the scaled tiled background
+        image size, and either ceils or floors that value depending on if tiling that value will
+        result in us being one pixel or less short of covering the background size. This is a heuristic,
+        as sub-pixel/zooming isn't specced.
+
+        Test: fast/sub-pixel/scaled-background-image.html
+
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::applySubPixelHeuristicForTileSize):
+        (WebCore):
+        (WebCore::RenderBoxModelObject::calculateFillTileSize):
+
+2012-10-27  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r132725.
+        http://trac.webkit.org/changeset/132725
+        https://bugs.webkit.org/show_bug.cgi?id=100596
+
+        it broke linking on chromium debug bots (Requested by loislo
+        on #webkit).
+
+        * inspector/InspectorMemoryAgent.cpp:
+        (WebCore::addPlatformComponentsInfo):
+        (WebCore):
+        (WebCore::InspectorMemoryAgent::getProcessMemoryDistribution):
+        * platform/MemoryUsageSupport.cpp:
+        (WebCore::MemoryUsageSupport::memoryUsageByComponents):
+        * platform/MemoryUsageSupport.h:
+        (ComponentInfo):
+        (WebCore::MemoryUsageSupport::ComponentInfo::ComponentInfo):
+        (MemoryUsageSupport):
+        * platform/PlatformMemoryInstrumentation.cpp:
+        (WebCore):
+        * platform/PlatformMemoryInstrumentation.h:
+        (PlatformMemoryTypes):
+        * platform/chromium/MemoryUsageSupportChromium.cpp:
+        (WebCore::MemoryUsageSupport::memoryUsageByComponents):
+        * platform/qt/MemoryUsageSupportQt.cpp:
+        (WebCore::MemoryUsageSupport::memoryUsageByComponents):
+
+2012-10-27  Dan Bernstein  <mitz@apple.com>
+
+        REAL_PLATFORM_NAME build setting is no longer needed
+        https://bugs.webkit.org/show_bug.cgi?id=100587
+
+        Reviewed by Mark Rowe.
+
+        Removed the definition of REAL_PLATFORM_NAME and replaced references to it with references
+        to PLATFORM_NAME.
+
+        * Configurations/Base.xcconfig:
+        * Configurations/CompilerVersion.xcconfig:
+        * Configurations/DebugRelease.xcconfig:
+        * Configurations/FeatureDefines.xcconfig:
+        * Configurations/Version.xcconfig:
+        * Configurations/WebCore.xcconfig:
+
+2012-10-27  Tony Chang  <tony@chromium.org>
+
+        Remove internals shouldDisplayTrackKind methods; these are also on internals.settings
+        https://bugs.webkit.org/show_bug.cgi?id=100564
+
+        Reviewed by Adam Barth.
+
+        Remove duplicate methods from internals that was just forwarding on the call to internals.settings.
+        Also fix a bug where we didn't reset these settings properly.
+
+        No new tests, this is covered by existing media/track tests.
+
+        * testing/InternalSettings.cpp:
+        (WebCore::InternalSettings::Backup::Backup): Properly save display track settings.
+        (WebCore::InternalSettings::Backup::restoreTo): Restore display track settings.
+        * testing/InternalSettings.h:
+        * testing/InternalSettings.idl: Use [Conditional=VIDEO_TRACK].
+        * testing/Internals.cpp: Remove code.
+        * testing/Internals.h: Remove code.
+        * testing/Internals.idl: Remove code.
+
+2012-10-26  Ilya Tikhonovsky  <loislo@chromium.org>
+
+        Web Inspector: instrument chromium GlyphCache. It keeps ~2mb.
+        https://bugs.webkit.org/show_bug.cgi?id=100515
+
+        Reviewed by Yury Semikhatsky.
+
+        I replaced old version with an abstract number with new one which precisely reports allocated SkGlyphCache objects and their sizes.
+
+        * inspector/InspectorMemoryAgent.cpp:
+        (WebCore::InspectorMemoryAgent::getProcessMemoryDistribution):
+        * platform/MemoryUsageSupport.cpp:
+        (WebCore::MemoryUsageSupport::reportMemoryUsage):
+        * platform/MemoryUsageSupport.h:
+        (MemoryUsageSupport):
+        * platform/PlatformMemoryInstrumentation.cpp:
+        (WebCore):
+        * platform/PlatformMemoryInstrumentation.h:
+        (PlatformMemoryTypes):
+        * platform/chromium/MemoryUsageSupportChromium.cpp:
+        (reportMemoryUsage):
+        (WebCore::reportGlyphCache):
+        (WebCore):
+        (WebCore::MemoryUsageSupport::reportMemoryUsage):
+        * platform/qt/MemoryUsageSupportQt.cpp:
+        (WebCore::MemoryUsageSupport::reportMemoryUsage):
+
+2012-10-26  Philip Rogers  <pdr@google.com>
+
+        Prevent NaN offset values in ElementTimeControl.
+        https://bugs.webkit.org/show_bug.cgi?id=100322
+
+        Reviewed by Abhishek Arya.
+
+        NaN values can cause ElementTimeControl to go back in time!
+        If a value of NaN is passed to ElementTimeControl::beginElementAt(offset),
+        subsequent sorting will cause an assert in SVGSMILElement::findInstanceTime
+        because NaN values are not properly sorted. NaN SMILTime values
+        should not be allowed at all, so this patch adds a check for them in
+        ElementTimeControl's setters.
+ 
+        This patch also adds preventative asserts to catch if SMILTime is ever
+        initialized with NaN, or if addEndTime/addBeginTime are ever called
+        with NaN values.
+
+        Test: svg/custom/elementTimeControl-nan-crash.html
+
+        * svg/SVGAnimationElement.cpp:
+        (WebCore::SVGAnimationElement::beginElementAt):
+        (WebCore::SVGAnimationElement::endElementAt):
+        * svg/animation/SMILTime.h:
+        (WebCore::SMILTime::SMILTime):
+        * svg/animation/SVGSMILElement.cpp:
+        (WebCore::SVGSMILElement::addBeginTime):
+        (WebCore::SVGSMILElement::addEndTime):
+
+2012-10-26  Charles Wei  <charles.wei@torchmobile.com.cn>
+
+        [BlackBerry] Browser prematurely sends wrong credentials
+        https://bugs.webkit.org/show_bug.cgi?id=100585
+
+        Reviewed by Yong Li.
+
+        Manually revert the patch for bug 96362, which causes regressions and the right patch has been
+        submitted with patch for bug 100448. Since the auto-revert fails, we use this patch to manually
+        revert.
+
+        No new tests. The test is coverted by patch for 100448.
+
+        * platform/network/blackberry/CredentialBackingStore.cpp:
+        * platform/network/blackberry/CredentialBackingStore.h:
+        (CredentialBackingStore):
+        * platform/network/blackberry/NetworkManager.cpp:
+        (WebCore::NetworkManager::startJob):
+
+2012-10-26  Brady Eidson  <beidson@apple.com>
+
+        Have NetworkProcess manage resource load scheduling.
+        https://bugs.webkit.org/show_bug.cgi?id=100479
+
+        Reviewed by Alexey Proskuryakov.
+
+        Down in WebCore we need to virtualize a handful of ResourceLoadScheduler methods
+        to be overridden by WebKit's implementation.
+
+        No new tests (No change in Core behavior).
+
+        * WebCore.exp.in:
+        * WebCore.xcodeproj/project.pbxproj:
+
+        * loader/ResourceLoadScheduler.cpp:
+        (WebCore::resourceLoadScheduler): Gracefully handle LoaderStrategies wanting to return the default scheduler.
+        (WebCore::ResourceLoadScheduler::scheduleLoad): Call notifyDidScheduleResourceRequest.
+        (WebCore::ResourceLoadScheduler::notifyDidScheduleResourceRequest): Moved InspectorInstrumentation call
+          here so derived classes can do it indirectly.
+        (WebCore::ResourceLoadScheduler::startResourceLoader): To allow derived classes the ability to call
+          ResourceLoader::start() which only ResourceLoadScheduler can do.
+
+        * loader/ResourceLoadScheduler.h:
+        (ResourceLoadScheduler): Virtualize some core public methods so they can be overridden.
+        (WebCore::ResourceLoadScheduler::setSerialLoadingEnabled): Make virtual.
+        (WebCore::ResourceLoadScheduler::isSuspendingPendingRequests): Make private as it's internal only.
+
+        * loader/ResourceLoader.cpp:
+        (WebCore::ResourceLoader::setIdentifier): Add this setter so outside clients can manually change the identifier.
+
+        * loader/ResourceLoader.h:
+        (WebCore::ResourceLoader::identifier): Change identifier to explicitly be uint64_t.
+        (WebCore::ResourceLoader::request): Make public.
+        (ResourceLoader):
+
+2012-10-26  Chris Rogers  <crogers@google.com>
+
+        Implement AudioBufferSourceNode .loopStart and .loopEnd attributes
+        https://bugs.webkit.org/show_bug.cgi?id=100170
+
+        Reviewed by Kenneth Russell.
+
+        AudioBufferSourceNode currently only supports looping of an entire AudioBuffer.
+        Sample-based synthesis is a very common technique which requires "internal" loop-points.
+        For example, the first part of the sample data might represent the attack portion of
+        a synthesized instrument, which then enters a loop portion.
+
+        Tests: webaudio/audiobuffersource-loop-comprehensive.html
+               webaudio/audiobuffersource-loop-points.html
+
+        * Modules/webaudio/AudioBufferSourceNode.cpp:
+        (WebCore::AudioBufferSourceNode::AudioBufferSourceNode):
+        (WebCore::AudioBufferSourceNode::process):
+        (WebCore::AudioBufferSourceNode::renderFromBuffer):
+        * Modules/webaudio/AudioBufferSourceNode.h:
+        (AudioBufferSourceNode):
+        (WebCore::AudioBufferSourceNode::loopStart):
+        (WebCore::AudioBufferSourceNode::loopEnd):
+        (WebCore::AudioBufferSourceNode::setLoopStart):
+        (WebCore::AudioBufferSourceNode::setLoopEnd):
+        * Modules/webaudio/AudioBufferSourceNode.idl:
+
+2012-10-26  Daniel Cheng  <dcheng@chromium.org>
+
+        dragover's default action should prevent drop for file drags
+        https://bugs.webkit.org/show_bug.cgi?id=79173
+
+        Reviewed by Tony Chang.
+
+        During a file drag, we need to keep track of whether or not the document has cancelled the
+        dragover action. We should only send a drop event if the dragover event was cancelled; this
+        matches the behavior of the spec, as well as IE, Gecko, and Opera. The relevant sections
+        from the spec are the sections pertaining to dragover and drop events at:
+        http://www.whatwg.org/specs/web-apps/current-work/#drag-and-drop-processing-model
+
+        Test: fast/events/only-valid-drop-targets-receive-file-drop.html
+
+        * page/DragController.cpp:
+        (WebCore::DragController::performDrag):
+        (WebCore::DragController::dragEnteredOrUpdated):
+        (WebCore::DragController::tryDocumentDrag):
+        * page/DragController.h:
+        (DragController): Cleanup to repurpose a variable that doesn't need to be a member anymore
+                          and remove the corresponding getter/setter.
+
+2012-10-26  Nico Weber  <thakis@chromium.org>
+
+        Fix a operator ordering bug in SVGSMILElement::calculateAnimationPercentAndRepeat
+        https://bugs.webkit.org/show_bug.cgi?id=94756
+
+        Reviewed by Dirk Schulze.
+
+        The function has an early exit for !simpleDuration.value(), so
+        !simpleDuration.value() always is 0 when passed as second parameter to
+        fmod(), which means fmod() always returns NaN, which always evaluates
+        to true. Simplify the code by removing that explicit check.
+
+        No observable behavior change.
+
+        Covered by existing svg tests.
+
+        * svg/animation/SVGSMILElement.cpp:
+        (WebCore::SVGSMILElement::calculateAnimationPercentAndRepeat):
+
+2012-10-26  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r132695.
+        http://trac.webkit.org/changeset/132695
+        https://bugs.webkit.org/show_bug.cgi?id=100581
+
+        caused 20+ test crashes on bots (Requested by estes on
+        #webkit).
+
+        * dom/ContainerNode.cpp:
+        (WebCore::ContainerNode::suspendPostAttachCallbacks):
+        (WebCore::ContainerNode::resumePostAttachCallbacks):
+        * loader/MainResourceLoader.cpp:
+        (WebCore::MainResourceLoader::loadNow):
+        * loader/ResourceLoadScheduler.cpp:
+        (WebCore::resourceLoadScheduler):
+        * loader/ResourceLoadScheduler.h:
+        * loader/ResourceLoader.cpp:
+        (WebCore::ResourceLoader::releaseResources):
+        (WebCore::ResourceLoader::willSendRequest):
+        * loader/cache/CachedResource.cpp:
+        (WebCore::CachedResource::load):
+        * loader/cache/CachedResourceLoader.cpp:
+        (WebCore::CachedResourceLoader::performPostLoadActions):
+
+2012-10-26  Vincent Scheib  <scheib@chromium.org>
+
+        Unreviewed, rolling out r132702.
+        http://trac.webkit.org/changeset/132702
+        https://bugs.webkit.org/show_bug.cgi?id=100322
+
+        Compile error on Chromium Linux dbg builder (and others)
+
+        * svg/SVGAnimationElement.cpp:
+        (WebCore::SVGAnimationElement::beginElementAt):
+        (WebCore::SVGAnimationElement::endElementAt):
+        * svg/animation/SMILTime.h:
+        (WebCore::SMILTime::SMILTime):
+        * svg/animation/SVGSMILElement.cpp:
+        (WebCore::SVGSMILElement::addBeginTime):
+        (WebCore::SVGSMILElement::addEndTime):
+
+2012-10-26  Philip Rogers  <pdr@google.com>
+
+        Prevent NaN offset values in ElementTimeControl.
+        https://bugs.webkit.org/show_bug.cgi?id=100322
+
+        Reviewed by Abhishek Arya.
+
+        NaN values can cause ElementTimeControl to go back in time!
+        If a value of NaN is passed to ElementTimeControl::beginElementAt(offset),
+        subsequent sorting will cause an assert in SVGSMILElement::findInstanceTime
+        because NaN values are not properly sorted. NaN SMILTime values
+        should not be allowed at all, so this patch adds a check for them in
+        ElementTimeControl's setters.
+
+        This patch also adds preventative asserts to catch if SMILTime is ever
+        initialized with NaN, or if addEndTime/addBeginTime are ever called
+        with NaN values.
+
+        Test: svg/custom/elementTimeControl-nan-crash.html
+
+        * svg/SVGAnimationElement.cpp:
+        (WebCore::SVGAnimationElement::beginElementAt):
+        (WebCore::SVGAnimationElement::endElementAt):
+        * svg/animation/SMILTime.h:
+        (WebCore::SMILTime::SMILTime):
+        * svg/animation/SVGSMILElement.cpp:
+        (WebCore::SVGSMILElement::addBeginTime):
+        (WebCore::SVGSMILElement::addEndTime):
+
+2012-10-26  Tony Chang  <tony@chromium.org>
+
+        Move non-Settings Inspector methods from internals.settings to internals
+        https://bugs.webkit.org/show_bug.cgi?id=100392
+
+        Reviewed by Adam Barth.
+
+        These methods don't have to do with the WebCore Settings object, so move them up to internals.
+        I moved the reset code from InternalSettings to Internals.
+
+        No new tests, this is just a rename. Existing tests should pass.
+
+        * testing/InternalSettings.cpp:
+        (WebCore::InternalSettings::Backup::Backup): Remove inspector methods.
+        (WebCore::InternalSettings::Backup::restoreTo): Remove inspector methods.
+        * testing/InternalSettings.h:
+        * testing/InternalSettings.idl:
+        * testing/Internals.cpp:
+        (WebCore::Internals::resetToConsistentState): New method for resetting page state. Named after similar
+        methods in WTR.
+        (WebCore::Internals::setInspectorResourcesDataSizeLimits): Moved from InspectorSettings.
+        (WebCore::Internals::setJavaScriptProfilingEnabled): Moved from InspectorSettings.
+        * testing/Internals.h:
+        * testing/Internals.idl:
+        * testing/js/WebCoreTestSupport.cpp:
+        (WebCoreTestSupport::resetInternalsObject): Reset state in Internals.
+        * testing/v8/WebCoreTestSupport.cpp:
+        (WebCoreTestSupport::resetInternalsObject): Reset state in Internals.
+
+2012-10-26  Dominic Mazzoni  <dmazzoni@google.com>
+
+        AX: Notification should be sent when accessibilityIsIgnored changes
+        https://bugs.webkit.org/show_bug.cgi?id=99547
+
+        Reviewed by Chris Fleizach.
+
+        Adds a new flag in AccessibilityObject that keeps track of the most recent
+        value of accessibilityIsIgnored(). After certain events such as an ARIA
+        attribute change or content change, checks the new value of
+        accessibilityIsIgnored() and posts a "children changed" notification on the
+        parent node if it changed, making sure the parent recomputes its vector of
+        (unignored) children.
+
+        Also moves handling of attribute changes to AXObjectCache, and sends
+        notifications for some attribute changes that were previously silent. On
+        Chromium, all changes to an accessibility object's attributes should
+        result in some notification.
+
+        Some tests would have broken because an AccessibilityScrollView was created
+        and holding a reference to a ScrollView for an iframe after it was deleted,
+        so this change switches AccessibilityScrollView to hold a weak reference
+        to ScrollView instead.
+
+        Tests: platform/chromium/accessibility/is-ignored-change-sends-notification.html
+               platform/chromium/accessibility/other-aria-attribute-change-sends-notification.html
+               platform/chromium/accessibility/text-change-notification.html
+
+        * accessibility/AXObjectCache.cpp:
+        (WebCore::AXObjectCache::focusedUIElementForPage):
+        (WebCore::AXObjectCache::getOrCreate):
+        (WebCore::AXObjectCache::textChanged):
+        (WebCore):
+        (WebCore::AXObjectCache::childrenChanged):
+        (WebCore::AXObjectCache::handleAriaRoleChanged):
+        (WebCore::AXObjectCache::handleAttributeChanged):
+        (WebCore::AXObjectCache::labelChanged):
+        (WebCore::AXObjectCache::recomputeIsIgnored):
+        * accessibility/AXObjectCache.h:
+        (AXObjectCache):
+        (WebCore::AXObjectCache::childrenChanged):
+        (WebCore::AXObjectCache::textChanged):
+        (WebCore::AXObjectCache::handleAttributeChanged):
+        (WebCore::AXObjectCache::recomputeIsIgnored):
+        * accessibility/AccessibilityNodeObject.cpp:
+        (WebCore::AccessibilityNodeObject::insertChild):
+        * accessibility/AccessibilityObject.cpp:
+        (WebCore::AccessibilityObject::AccessibilityObject):
+        (WebCore::AccessibilityObject::cachedIsIgnoredValue):
+        (WebCore):
+        (WebCore::AccessibilityObject::setCachedIsIgnoredValue):
+        (WebCore::AccessibilityObject::notifyIfIgnoredValueChanged):
+        * accessibility/AccessibilityObject.h:
+        (WebCore::AccessibilityObject::textChanged):
+        (AccessibilityObject):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::accessibilityIsIgnored):
+        (WebCore::AccessibilityRenderObject::correspondingControlForLabelElement):
+        (WebCore::AccessibilityRenderObject::textChanged):
+        (WebCore::AccessibilityRenderObject::addHiddenChildren):
+        (WebCore::AccessibilityRenderObject::addChildren):
+        * accessibility/AccessibilityRenderObject.h:
+        (AccessibilityRenderObject):
+        * accessibility/AccessibilityScrollView.cpp:
+        (WebCore::AccessibilityScrollView::~AccessibilityScrollView):
+        (WebCore):
+        (WebCore::AccessibilityScrollView::detach):
+        (WebCore::AccessibilityScrollView::isAttachment):
+        (WebCore::AccessibilityScrollView::widgetForAttachmentView):
+        (WebCore::AccessibilityScrollView::updateScrollbars):
+        (WebCore::AccessibilityScrollView::webAreaObject):
+        (WebCore::AccessibilityScrollView::elementRect):
+        (WebCore::AccessibilityScrollView::documentFrameView):
+        (WebCore::AccessibilityScrollView::parentObject):
+        (WebCore::AccessibilityScrollView::parentObjectIfExists):
+        (WebCore::AccessibilityScrollView::getScrollableAreaIfScrollable):
+        (WebCore::AccessibilityScrollView::scrollTo):
+        * accessibility/AccessibilityScrollView.h:
+        (WebCore::AccessibilityScrollView::scrollView):
+        (AccessibilityScrollView):
+        * accessibility/AccessibilityTable.cpp:
+        (WebCore::AccessibilityTable::isDataTable):
+        * accessibility/chromium/AXObjectCacheChromium.cpp:
+        (WebCore::AXObjectCache::postPlatformNotification):
+        * dom/Element.cpp:
+        (WebCore::Element::attributeChanged):
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::deleteLineBoxTree):
+        (WebCore::RenderBlock::createAndAppendRootInlineBox):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::styleWillChange):
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::setText):
+
+2012-10-26  Joshua Bell  <jsbell@chromium.org>
+
+        [WebKitIDL] Optional dictionary types should have default values of empty dictionary
+        https://bugs.webkit.org/show_bug.cgi?id=100547
+
+        Reviewed by Adam Barth.
+
+        Per WebIDL, "Optional dictionary type arguments are always considered to have a default
+        value of an empty dictionary." WebKitIDL already supported this via the extended attribute
+        [Optional=DefaultIsUndefined] but make this the default for Dictionary.
+
+        Binding test expectations updated.
+
+        * Modules/filesystem/DirectoryEntry.h: Remove default parameters.
+        (DirectoryEntry):
+        * Modules/indexeddb/IDBDatabase.h: Remove overloads.
+        (IDBDatabase):
+        * Modules/indexeddb/IDBObjectStore.h: Remove overloads.
+        (IDBObjectStore):
+        * Modules/mediastream/RTCPeerConnection.idl: Remove DefaultIsUndefined annotations.
+        * bindings/scripts/CodeGeneratorJS.pm: Special case for Optional Dictionary.
+        (GenerateParametersCheck):
+        * bindings/scripts/CodeGeneratorV8.pm: Ditto.
+        (GenerateParametersCheck):
+        * bindings/scripts/test/JS/JSTestObj.cpp:
+        (WebCore::jsTestObjPrototypeFunctionOptionsObject): Updated expectation - no early call.
+        * bindings/scripts/test/V8/V8TestObj.cpp:
+        (WebCore::TestObjV8Internal::optionsObjectCallback): Ditto.
+
+2012-10-26  Vincent Scheib  <scheib@chromium.org>
+
+        Generated should not be supported for things with a shadow
+        https://bugs.webkit.org/show_bug.cgi?id=98836
+
+        Unreviewed rollout of rollout of http://trac.webkit.org/changeset/132269.
+        Initial rollout was speculative and was shown not to be related to crashes.
+        Change author: Elliott Sprehn  <esprehn@chromium.org>
+
+        As far as CSS is concerned inputs and things with shadow content inside 
+        shouldn't support pseudo elements like :before, :after or :first-letter.
+        Neither Gecko or Presto supports it, and we only accidentally supported 
+        it. 
+ 
+        Until the spec tells us what to do we should disable support. This is 
+        also neccesary because the new generated content implementation doesn't 
+        support shadows. 
+
+        Test: fast/forms/pseudo-elements.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::updateFirstLetter):
+        * rendering/RenderListBox.h:
+        * rendering/RenderObjectChildList.cpp:
+        (WebCore::RenderObjectChildList::updateBeforeAfterContent):
+
+2012-10-26  Brady Eidson  <beidson@apple.com>
+
+        Crash in WebProces at WebCore::ResourceLoadScheduler::crossOriginRedirectReceived + 78
+        <rdar://problem/12575514> and https://bugs.webkit.org/show_bug.cgi?id=100554
+
+        Reviewed by Alexey Proskuryakov.
+
+        This was fallout from http://trac.webkit.org/changeset/132501 where I missed some of the 
+        spots that call resourceLoadScheduler().
+
+        As a result we were creating more than one ResourceLoadScheduler, allowing the host records 
+        to get out of sync.
+
+        The fix that also results in less #ifdefs scattered throughout the code is to use a single 
+        choke point for all ResourceLoadScheduler access.
+
+        No new tests 
+        (No change of behavior for the default config, not testable at this time in the repro config)
+
+        Add a single choke point for accessing the correct ResourceLoadScheduler:
+        * loader/ResourceLoadScheduler.cpp:
+        (WebCore::defaultResourceLoadScheduler): New private function that keeps the singleton default ResourceLoadScheduler.
+        (WebCore::resourceLoadScheduler): Refactor this function to either ask the LoaderStrategy or call through to
+
+        Revert back to using that single choke point everywhere:
+        * dom/ContainerNode.cpp:
+        (WebCore::ContainerNode::suspendPostAttachCallbacks):
+        (WebCore::ContainerNode::resumePostAttachCallbacks):
+
+        * loader/MainResourceLoader.cpp:
+        (WebCore::MainResourceLoader::loadNow):
+
+        * loader/ResourceLoader.cpp:
+        (WebCore::ResourceLoader::releaseResources):
+        (WebCore::ResourceLoader::willSendRequest):
+
+        * loader/cache/CachedResource.cpp:
+        (WebCore::CachedResource::load):
+
+        * loader/cache/CachedResourceLoader.cpp:
+        (WebCore::CachedResourceLoader::performPostLoadActions):
+
+2012-10-26  Elliott Sprehn  <esprehn@chromium.org>
+
+        Try to fix the windows build
+        https://bugs.webkit.org/show_bug.cgi?id=100556
+
+        Reviewed by Eric Seidel.
+
+        Touch files by adding whitespace to try and make the windows
+        build bot regenerate files.
+
+        No new tests, just kick the bot.
+
+        * dom/DOMAllInOne.cpp:
+        * html/HTMLElementsAllInOne.cpp:
+        * html/shadow/TextControlInnerElements.cpp:
+
+2012-10-26  Rob Buis  <rbuis@rim.com>
+
+        [BlackBerry] Platform Abstraction for WebKit Resource/Image Loading
+        https://bugs.webkit.org/show_bug.cgi?id=100518
+
+        PR 231732
+
+        Reviewed by Yong Li.
+
+        Use the new resource/image loading abstraction ResourceStore.
+
+        * platform/graphics/blackberry/ImageBlackBerry.cpp:
+        (WebCore::Image::loadPlatformResource):
+
+2012-10-26  Bear Travis  <betravis@adobe.com>
+
+        [CSS Exclusions] Block children have incorrect offset when shape-inside element lays out below other elements
+        https://bugs.webkit.org/show_bug.cgi?id=98189
+
+        Reviewed by Dirk Schulze.
+
+        The initial code assumed that each block created a new layout state, such that
+        LayoutState::layoutOffset would be specific to each block child of a shape-inside.
+        Typically, however, block children of a shape-inside do not create a new layout state,
+        and therefore we use the current element's offset instead.
+
+        Test: fast/exclusions/shape-inside/shape-inside-subsequent-blocks.html
+
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::RenderBlock::layoutRunsAndFloatsInRange): Modified to use only logicalTop
+        rather than LayoutState::layoutOffset::width/height and logicalTop.
+
+2012-10-26  Elliott Sprehn  <esprehn@chromium.org>
+
+        Remove setRenderStyle in favor of callbacks on HTMLOptionElement and HTMLOptGroupElement
+        https://bugs.webkit.org/show_bug.cgi?id=100397
+
+        Reviewed by Ojan Vafai.
+
+        Use Node custom callbacks to support the non-renderer style caching for option
+        and optgroup eliminating the need for setRenderStyle.
+
+        setRenderStyle only existed to support HTMLOptionElement and HTMLOptGroupElement
+        so they could store their RenderStyle even though they have no renderer. This
+        means all style setting went through the virtual call to setRenderStyle, and it
+        also hid the if statement protecting against null renderers meaning we end up
+        checking if the renderer is null repeatedly in recalcStyle. This refactor cleans
+        up recalcStyle to be more clear about what's going on.
+
+        No new tests needed, this is just a refactor.
+
+        * dom/Element.cpp:
+        (WebCore::Element::pseudoStyleCacheIsInvalid):
+        (WebCore::Element::recalcStyle):
+        * dom/Node.cpp:
+        (WebCore::Node::createRenderer):
+        (WebCore::Node::setRenderStyle):
+            Removed this method because it was only here to support HTMLOptionElement
+            and HTMLOptGroupElement. Instead we can use node custom callbacks.
+        * dom/Node.h:
+        (WebCore::Node::nonRendererStyle): Renamed from nonRendererRenderStyle to match other style methods.
+        * dom/NodeRenderStyle.h:
+        (WebCore::Node::renderStyle):
+        * html/HTMLOptGroupElement.cpp:
+        (WebCore::HTMLOptGroupElement::HTMLOptGroupElement):
+        (WebCore::HTMLOptGroupElement::attach): Reorder the logic to avoid calling styleForRenderer twice.
+        (WebCore::HTMLOptGroupElement::updateNonRenderStyle): Updates the cached non-renderer style.
+        (WebCore::HTMLOptGroupElement::nonRendererStyle):
+        (WebCore::HTMLOptGroupElement::customStyleForRenderer):
+        * html/HTMLOptGroupElement.h:
+        * html/HTMLOptionElement.cpp:
+        (WebCore::HTMLOptionElement::HTMLOptionElement):
+        (WebCore::HTMLOptionElement::attach): Reorder the logic to avoid calling styleForRenderer twice.
+        (WebCore::HTMLOptionElement::updateNonRenderStyle): Updates the cached non-renderer style.
+        (WebCore::HTMLOptionElement::nonRendererStyle):
+        (WebCore::HTMLOptionElement::customStyleForRenderer):
+        (WebCore::HTMLOptionElement::didRecalcStyle): Requests the repaint of the select like setRenderStyle used to.
+        * html/HTMLOptionElement.h:
+
+2012-10-26  Dirk Schulze  <krit@webkit.org>
+
+        -webkit-clip-path property should just reference clipPath
+        https://bugs.webkit.org/show_bug.cgi?id=100531
+
+        Reviewed by Eric Seidel.
+
+        The -webkit-clip-path property should just reference clipPath. Added a check for that.
+
+        Test: css3/masking/clip-path-reference-of-fake-clipPath.html
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::paintLayerContents):
+
+2012-10-26  Aaron Colwell  <acolwell@chromium.org>
+
+        Remove the circular reference between TextTrack and TextTrackCue
+        https://bugs.webkit.org/show_bug.cgi?id=100300
+
+        Reviewed by Eric Carlson.
+
+        Changed TextTrackCue.m_track to a normal pointer to break the circular
+        reference that was keeping both objects from ever getting deleted.
+
+        No new tests. This simply fixes a memory leak.
+
+        * html/track/TextTrack.cpp:
+        (WebCore::TextTrack::~TextTrack):
+        * html/track/TextTrackCue.cpp:
+        (WebCore::TextTrackCue::TextTrackCue):
+        (WebCore::TextTrackCue::~TextTrackCue):
+        (WebCore::TextTrackCue::track):
+        (WebCore::TextTrackCue::setTrack):
+        * html/track/TextTrackCue.h:
+        (TextTrackCue):
+
+2012-10-26  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Web Inspector: Breakpoints are not managed correctly when editing uiSourceCode that was bound to ScriptFile after JavaScriptSourceFrame creation.
+        https://bugs.webkit.org/show_bug.cgi?id=100535
+
+        Reviewed by Pavel Feldman.
+
+        Added SourceMappingChanged event to UISourceCode and made
+        JavaScriptSourceFrame update ScriptFile events listeners on it.
+
+        * inspector/front-end/JavaScriptSourceFrame.js:
+        (WebInspector.JavaScriptSourceFrame):
+        (WebInspector.JavaScriptSourceFrame.prototype._onSourceMappingChanged):
+        (WebInspector.JavaScriptSourceFrame.prototype._updateScriptFile):
+        * inspector/front-end/ResourceScriptMapping.js:
+        (WebInspector.ResourceScriptMapping.prototype._bindUISourceCodeToScripts):
+        * inspector/front-end/UISourceCode.js:
+        (WebInspector.UISourceCode.prototype.setSourceMapping):
+
+2012-10-26  Vincent Scheib  <scheib@chromium.org>
+
+        Unreviewed, rolling out r132644.
+        http://trac.webkit.org/changeset/132644
+        https://bugs.webkit.org/show_bug.cgi?id=100497
+
+        Causes webkit_unit_tests
+        MemoryInstrumentationTest.ImageObserver to fail.
+
+        * platform/network/ResourceRequestBase.cpp:
+        (WebCore::ResourceRequestBase::reportMemoryUsage):
+        * platform/network/ResourceRequestBase.h:
+        (ResourceRequestBase):
+        * platform/network/chromium/ResourceRequest.cpp:
+        * platform/network/chromium/ResourceRequest.h:
+
+2012-10-26  Zeno Albisser  <zeno@webkit.org>
+
+        [Qt] MiniBrowser segfaults on exit after using WebGL.
+        https://bugs.webkit.org/show_bug.cgi?id=100523
+
+        The display connection must not be closed before
+        destroying the offscreen window.
+        Therefore opening the connection is moved to the
+        getXWindow() function. And closing the connection
+        is being moved to the destructor of the offscreen window.
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+
+        * platform/graphics/surfaces/qt/GraphicsSurfaceGLX.cpp:
+        (WebCore::OffScreenRootWindow::OffScreenRootWindow):
+        (WebCore::OffScreenRootWindow::getXWindow):
+        (OffScreenRootWindow):
+        (WebCore::OffScreenRootWindow::display):
+        (WebCore::OffScreenRootWindow::~OffScreenRootWindow):
+        (WebCore):
+        (WebCore::GraphicsSurfacePrivate::GraphicsSurfacePrivate):
+        (WebCore::GraphicsSurfacePrivate::~GraphicsSurfacePrivate):
+        (WebCore::GraphicsSurfacePrivate::createSurface):
+
+2012-10-26  Parth Patel  <parpatel@rim.com>
+
+        [BlackBerry] Extending existing ThreadUnsafe singletons in webkit to
+        Generic ThreadUnsafe Singleton
+        https://bugs.webkit.org/show_bug.cgi?id=100529
+
+        Reviewed by Yong Li.
+
+        No new tests added as there was no behavioural change.
+
+        * platform/network/blackberry/NetworkManager.cpp:
+        (WebCore):
+        * platform/network/blackberry/NetworkManager.h:
+        (NetworkManager):
+
+2012-10-26  Mike West  <mkwst@chromium.org>
+
+        Web Inspector: Fix log-type icon alignment.
+        https://bugs.webkit.org/show_bug.cgi?id=100520
+
+        Reviewed by Yury Semikhatsky.
+
+        The icons are just a pixel or two off, and it's driving me nuts.
+
+        * inspector/front-end/inspector.css:
+        (.console-message::before, .console-user-command::before, #console-prompt::before, .console-group-title::before):
+        (.console-warning-level::before):
+
+2012-10-26  Erik Arvidsson  <arv@chromium.org>
+
+        Replaceable attributes should also have readonly
+        https://bugs.webkit.org/show_bug.cgi?id=91768
+
+        Reviewed by Adam Barth.
+
+        This updates the code generators for JSC and V8 to handle this case correctly.
+
+        * Modules/intents/DOMWindowIntents.idl:
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/scripts/test/GObject/WebKitDOMTestObj.cpp:
+        * bindings/scripts/test/ObjC/DOMTestObj.h:
+        * bindings/scripts/test/ObjC/DOMTestObj.mm:
+        * bindings/scripts/test/TestObj.idl:
+        * bindings/scripts/test/V8/V8TestObj.cpp:
+        * page/DOMWindow.idl:
+        * workers/WorkerContext.idl:
+
+2012-10-26  Nico Weber  <thakis@chromium.org>
+
+        Clear m_orientation in FrameData::clear() for skia
+        https://bugs.webkit.org/show_bug.cgi?id=100456
+
+        Reviewed by Stephen White.
+
+        clear() is only called by the FrameData destructor and for multi-image
+        images in BitmapImage::destroyDecodedData(). Multi-frame images don't
+        have exif data, so this patch should have no effect in practice. It
+        makes the skia code match the CG code in BitmapImageCG.cpp though.
+
+        * platform/graphics/skia/ImageSkia.cpp:
+        (WebCore::FrameData::clear):
+
+2012-10-26  Florin Malita  <fmalita@chromium.org>
+
+        Crash on loading SVG filter resource on HTML element
+        https://bugs.webkit.org/show_bug.cgi?id=100491
+
+        Reviewed by Dirk Schulze.
+
+        Skip non-filter elements referenced via -webkit-filter.
+
+        Test: svg/filters/filter-reference-crash.html
+
+        * rendering/RenderLayerFilterInfo.cpp:
+        (WebCore::RenderLayerFilterInfo::updateReferenceFilterClients):
+
+2012-10-26  Antti Koivisto  <antti@apple.com>
+
+        Lots of time spent under DNSResolveQueue::platformProxyIsEnabledInSystemPreferences
+        https://bugs.webkit.org/show_bug.cgi?id=100514
+
+        Reviewed by Anders Carlsson.
+
+        DNSResolveQueue::platformProxyIsEnabledInSystemPreferences gets called for every link in
+        the document. The function is relatively slow.
+        
+        This patch caches the result of the last check for 5 seconds. Based on code comments
+        prefetching is disabled with proxies due to regressing performance with some configurations.
+        Proxy status changes rarely and a slight reaction delay shoudn't cause practical problems.
+
+        * platform/network/DNSResolveQueue.cpp:
+        (WebCore::DNSResolveQueue::DNSResolveQueue):
+        
+            Add constructor. Also fixes a bug, m_requestsInFlight was not initialized.
+            
+        (WebCore):
+        (WebCore::DNSResolveQueue::isUsingProxy):
+        (WebCore::DNSResolveQueue::add):
+        (WebCore::DNSResolveQueue::fired):
+        * platform/network/DNSResolveQueue.h:
+        (DNSResolveQueue):
+
+2012-10-26  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r132662.
+        http://trac.webkit.org/changeset/132662
+        https://bugs.webkit.org/show_bug.cgi?id=100528
+
+        It is not necessary any more. (Requested by loislo on
+        #webkit).
+
+        * platform/qt/MemoryUsageSupportQt.cpp:
+        (WebCore::MemoryUsageSupport::memoryUsageByComponents):
+        (WebCore):
+
+2012-10-26  Ilya Tikhonovsky  <loislo@chromium.org>
+
+        Unreviewed build fix for Qt builders.
+
+        * platform/qt/MemoryUsageSupportQt.cpp:
+
+2012-10-26  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Unreviewed, rolling out r132658.
+        http://trac.webkit.org/changeset/132658
+        https://bugs.webkit.org/show_bug.cgi?id=100515
+
+        It broke the Qt build
+
+        * inspector/InspectorMemoryAgent.cpp:
+        (WebCore::addPlatformComponentsInfo):
+        (WebCore):
+        (WebCore::InspectorMemoryAgent::getProcessMemoryDistribution):
+        * platform/MemoryUsageSupport.cpp:
+        (WebCore::MemoryUsageSupport::memoryUsageByComponents):
+        * platform/MemoryUsageSupport.h:
+        (ComponentInfo):
+        (WebCore::MemoryUsageSupport::ComponentInfo::ComponentInfo):
+        (MemoryUsageSupport):
+        * platform/PlatformMemoryInstrumentation.cpp:
+        (WebCore):
+        * platform/PlatformMemoryInstrumentation.h:
+        (PlatformMemoryTypes):
+        * platform/chromium/MemoryUsageSupportChromium.cpp:
+        (WebCore::MemoryUsageSupport::memoryUsageByComponents):
+
+2012-10-26  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Web Inspector: Some context menu items are duplicated on Resources and Sources panels.
+        https://bugs.webkit.org/show_bug.cgi?id=100522
+
+        Reviewed by Pavel Feldman.
+
+        Method appendApplicableItems now receives event as a parameter.
+        HandlerRegistry now makes sure that it is not called more than once for certain context menu event.
+
+        * inspector/front-end/BreakpointsSidebarPane.js:
+        (WebInspector.JavaScriptBreakpointsSidebarPane.prototype._emptyElementContextMenu):
+        (WebInspector.JavaScriptBreakpointsSidebarPane.prototype._breakpointContextMenu):
+        (WebInspector.XHRBreakpointsSidebarPane.prototype._emptyElementContextMenu):
+        (WebInspector.XHRBreakpointsSidebarPane.prototype._contextMenu):
+        * inspector/front-end/CallStackSidebarPane.js:
+        (WebInspector.CallStackSidebarPane.Placard.prototype._placardContextMenu):
+        * inspector/front-end/ConsoleView.js:
+        * inspector/front-end/ContextMenu.js:
+        (WebInspector.ContextMenu):
+        (WebInspector.ContextMenu.prototype.show):
+        (WebInspector.ContextMenu.prototype.appendApplicableItems):
+        (WebInspector.ContextMenu.Provider.prototype.appendApplicableItems):
+        * inspector/front-end/CookieItemsView.js:
+        (WebInspector.CookieItemsView.prototype._contextMenu):
+        * inspector/front-end/DOMBreakpointsSidebarPane.js:
+        (WebInspector.DOMBreakpointsSidebarPane.prototype._contextMenu):
+        * inspector/front-end/DataGrid.js:
+        (WebInspector.DataGrid.prototype._contextMenuInDataTable):
+        * inspector/front-end/DefaultTextEditor.js:
+        (WebInspector.DefaultTextEditor.prototype._contextMenu):
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.prototype._contextMenuEventFired.set get var):
+        * inspector/front-end/ElementsPanelDescriptor.js:
+        (WebInspector.ElementsPanelDescriptor.prototype.appendApplicableItems):
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeOutline.prototype._contextMenuEventFired):
+        * inspector/front-end/HandlerRegistry.js:
+        (WebInspector.HandlerRegistry.prototype.appendApplicableItems):
+        * inspector/front-end/ImageView.js:
+        (WebInspector.ImageView.prototype._contextMenu):
+        * inspector/front-end/NavigatorView.js:
+        (WebInspector.NavigatorView.prototype.handleContextMenu):
+        * inspector/front-end/NetworkPanel.js:
+        (WebInspector.NetworkLogView.prototype._contextMenu):
+        * inspector/front-end/NetworkPanelDescriptor.js:
+        (WebInspector.NetworkPanelDescriptor.prototype.appendApplicableItems):
+        * inspector/front-end/ObjectPropertiesSection.js:
+        (WebInspector.ObjectPropertiesSection.prototype._contextMenuEventFired):
+        (WebInspector.ObjectPropertyTreeElement.prototype._contextMenuFired):
+        * inspector/front-end/ProfilesPanel.js:
+        (WebInspector.ProfilesPanel.prototype._handleContextMenuEvent):
+        (WebInspector.ProfileSidebarTreeElement.prototype.handleContextMenuEvent):
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.FrameResourceTreeElement.prototype._handleContextMenuEvent):
+        (WebInspector.IndexedDBTreeElement.prototype._handleContextMenuEvent):
+        (WebInspector.FileSystemListTreeElement.prototype._handleContextMenuEvent):
+        (WebInspector.IDBDatabaseTreeElement.prototype._handleContextMenuEvent):
+        * inspector/front-end/ScriptsNavigator.js:
+        (WebInspector.SnippetsNavigatorView.prototype.handleContextMenu):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype.appendApplicableItems):
+        * inspector/front-end/ScriptsPanelDescriptor.js:
+        (WebInspector.ScriptsPanelDescriptor.prototype.appendApplicableItems):
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylesSidebarPane.prototype._contextMenuEventFired):
+        * inspector/front-end/TabbedPane.js:
+        (WebInspector.TabbedPaneTab.prototype._tabContextMenu):
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel.prototype._contextMenu):
+        * inspector/front-end/WatchExpressionsSidebarPane.js:
+        (WebInspector.WatchExpressionsSection.prototype._emptyElementContextMenu):
+        (WebInspector.WatchExpressionTreeElement.prototype._contextMenu):
+
+2012-10-26  Ilya Tikhonovsky  <loislo@chromium.org>
+
+        Web Inspector: instrument chromium GlyphCache. It keeps ~2mb data on gmail.
+        https://bugs.webkit.org/show_bug.cgi?id=100515
+
+        Reviewed by Yury Semikhatsky.
+
+        I replaced old version with an abstract number with new one which precisely reports allocated SkGlyphCache objects and their sizes.
+
+        * inspector/InspectorMemoryAgent.cpp:
+        (WebCore::InspectorMemoryAgent::getProcessMemoryDistribution):
+        * platform/MemoryUsageSupport.cpp:
+        (WebCore::MemoryUsageSupport::reportMemoryUsage):
+        * platform/MemoryUsageSupport.h:
+        (MemoryUsageSupport):
+        * platform/PlatformMemoryInstrumentation.cpp:
+        (WebCore):
+        * platform/PlatformMemoryInstrumentation.h:
+        (PlatformMemoryTypes):
+        * platform/chromium/MemoryUsageSupportChromium.cpp:
+        (reportMemoryUsage):
+        (WebCore::reportGlyphCache):
+        (WebCore):
+        (WebCore::MemoryUsageSupport::reportMemoryUsage):
+
+2012-10-26  Kent Tamura  <tkent@chromium.org>
+
+        [Chromium] Build fix for r132650.
+        https://bugs.webkit.org/show_bug.cgi?id=100482
+
+        * platform/text/LocaleWin.cpp:
+        (WebCore::LocaleWin::timeFormat):
+
+2012-10-26  Yury Semikhatsky  <yurys@chromium.org>
+
+        [v8] Memory instrumentation: don't count memory of WrapperTypeInfo
+        https://bugs.webkit.org/show_bug.cgi?id=100517
+
+        Reviewed by Alexander Pavlov.
+
+        * bindings/v8/V8PerIsolateData.cpp: when estimating bindings memory size skip
+        pointers to WrapperTypeInfo objects as they are static fields and belong to
+        the data segment.
+        (WTF):
+
+2012-10-26  Kent Tamura  <tkent@chromium.org>
+
+        Refactor Localizer-related classes.
+        https://bugs.webkit.org/show_bug.cgi?id=100482
+
+        Reviewed by Kentaro Hara.
+
+        - Localizer has unused code
+         Localizer should have function implementations only if they are used in
+         multiple subclasses.
+        - Some Localizer subclasses hide Localizer data members
+        - Should use String::isNull to check initialization-or-not
+
+        No new tests. This should not change any behavior.
+
+        * platform/text/Localizer.h:
+        (Localizer):
+        - timeFormat, shortTimeFormat, and timeAMPMLabels should be pure virtual.
+        - Remove m_localizedDateFormatText, m_localizedShortTimeFormatText, and
+          m_timeAMPMLabels
+        * platform/text/Localizer.cpp:
+        Remove implementations of timeFormat, shortTimeFormat, and timeAMPMLabels.
+
+        * platform/text/LocaleICU.h:
+        (LocaleICU): Introduce m_timeFormatWithSeconds and m_timeFormatWithoutSeconds.
+        * platform/text/LocaleICU.cpp:
+        (WebCore::LocaleICU::initializeDateTimeFormat):
+        Use new data members instead of Localizer data members.
+        (WebCore::LocaleICU::dateFormat): Use isNull.
+
+        * platform/text/LocaleNone.cpp:
+        (LocaleNone): Add timeFormat, shortTimeFormat, timeAMPMLabels
+        implementations, and m_timeAMPMLabels.
+        (WebCore::LocaleNone::timeFormat): Returns the HTML time format.
+        (WebCore::LocaleNone::shortTimeFormat): Returns the HTML time format.
+        (WebCore::LocaleNone::timeAMPMLabels): Returns "AM" and "PM".
+
+        * platform/text/LocaleWin.h:
+        (LocaleWin): Add m_timeFormatWithSeconds.
+        * platform/text/LocaleWin.cpp:
+        (WebCore::LocaleWin::dateFormat): Use isNull.
+        (WebCore::LocaleWin::timeFormat): Use m_timeFormatWithSeconds.
+
+        * platform/text/mac/LocaleMac.h:
+        (LocaleMac): Rename m_localized*TimeFormatText to m_timeFormatWith*Seconds.
+        * platform/text/mac/LocaleMac.mm:
+        (WebCore::LocaleMac::timeFormat): Follow the renaming.
+        (WebCore::LocaleMac::shortTimeFormat): Ditto.
+
+2012-10-26  Kent Tamura  <tkent@chromium.org>
+
+        Crash in PagePopupController by events after WebPagePopupImpl::closePopup
+        https://bugs.webkit.org/show_bug.cgi?id=100454
+
+        Reviewed by Hajime Morita.
+
+        No new tests. The bug is timing-dependent.
+
+        * page/DOMWindowPagePopup.cpp:
+        (WebCore::DOMWindowPagePopup::~DOMWindowPagePopup):
+        Calls clearPagePopupClient for the associalated PagePopupController object.
+        * page/PagePopupController.cpp:
+        (WebCore::PagePopupController::setValueAndClosePopup):
+        Do nothing if m_popupClient is 0.
+        (WebCore::PagePopupController::localizeNumberString): Ditto.
+        (WebCore::PagePopupController::clearPagePopupClient): Added.
+        * page/PagePopupController.h:
+        (PagePopupController): Declare clearPagePopupClient.
+
+2012-10-25  Alexander Pavlov  <apavlov@chromium.org>
+
+        Web Inspector: Bring device geolocation and orientation emulation from behind the experiment
+        https://bugs.webkit.org/show_bug.cgi?id=100220
+
+        Reviewed by Yury Semikhatsky.
+
+        * inspector/front-end/Settings.js:
+        (WebInspector.ExperimentsSettings):
+        * inspector/front-end/SettingsScreen.js:
+        (WebInspector.UserAgentSettingsTab):
+
+2012-10-26  Yury Semikhatsky  <yurys@chromium.org>
+
+        Memory instrumentation: report memory occupied by ResourceRequest instead of its base ResourceRequestBase
+        https://bugs.webkit.org/show_bug.cgi?id=100497
+
+        Reviewed by Alexander Pavlov.
+
+        Added memory reporting method to Chromium implementation of ResourceRequest.
+
+        * platform/network/ResourceRequestBase.cpp:
+        (WebCore::ResourceRequestBase::reportMemoryUsageBase): Renamed reportMemoryUsage
+        on ResourceRequestBase to reportMemoryUsageBase and made it protected. I'd
+        rather make ResourceRequestBase::reportMemoryUsage virtual and override it
+        in the descendant but ResourceRequestBase doesn't have any virtual methods
+        and shouldn't be used directly (ResourceRequest should be used instead).
+        * platform/network/ResourceRequestBase.h:
+        (ResourceRequestBase):
+        * platform/network/chromium/ResourceRequest.cpp:
+        (WebCore::ResourceRequest::reportMemoryUsage):
+        (WebCore):
+        * platform/network/chromium/ResourceRequest.h:
+        (ResourceRequest):
+
+2012-10-26  Alexander Pavlov  <apavlov@chromium.org>
+
+        Web Inspector: Remove the on-hover highlighting of console messages
+        https://bugs.webkit.org/show_bug.cgi?id=100511
+
+        Reviewed by Pavel Feldman.
+
+        This clashes with the hovered element highlight in console messages.
+
+        * inspector/front-end/inspector.css:
+        (ol.watch-expressions > li.hovered):
+
+2012-10-26  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r132612.
+        http://trac.webkit.org/changeset/132612
+        https://bugs.webkit.org/show_bug.cgi?id=100512
+
+        Crashes fast/events/tabindex-focus-blur-all.html in debug mode
+        (Requested by pfeldman on #webkit).
+
+        * rendering/AutoTableLayout.cpp:
+        (WebCore::AutoTableLayout::recalcColumn):
+        * rendering/FixedTableLayout.cpp:
+        (WebCore::FixedTableLayout::calcWidthArray):
+        * rendering/RenderTable.cpp:
+        (WebCore::RenderTable::layout):
+        * rendering/RenderTableCol.cpp:
+        (WebCore::RenderTableCol::styleDidChange):
+        (WebCore::RenderTableCol::updateFromElement):
+        (WebCore::RenderTableCol::computePreferredLogicalWidths):
+        * rendering/RenderTableCol.h:
+        (RenderTableCol):
+
+2012-10-26  Pavel Feldman  <pfeldman@chromium.org>
+
+        Web Inspector: fast return upon setting the same dock side.
+        https://bugs.webkit.org/show_bug.cgi?id=100510
+
+        Reviewed by Vsevolod Vlasov.
+
+        Added fast return.
+
+        * inspector/front-end/DockController.js:
+
+2012-10-26  Simon Hausmann  <simon.hausmann@digia.com>
+
+        Unreviewed trivial build fix: It's glXGetCurrentContext not glxGetCurrentContext :)
+
+        * platform/graphics/surfaces/qt/GraphicsSurfaceGLX.cpp:
+        (WebCore::GraphicsSurfacePrivate::GraphicsSurfacePrivate):
+
+2012-10-26  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Printing should use use high resolution images when available
+        https://bugs.webkit.org/show_bug.cgi?id=100488
+
+        Reviewed by Antti Koivisto.
+
+        The images loaded using -webkit-device-pixel-ratio depends on
+        the display type (deviceScaleFactor) and thus affects which
+        images are being used for printing. Printing should always
+        use the higher resolution images (aka 'retina' images).
+
+        Test: fast/media/mq-pixel-ratio-print.html
+
+        * css/MediaQueryEvaluator.cpp:
+        (WebCore::device_pixel_ratioMediaFeatureEval):
+
+2012-10-26  Ilya Tikhonovsky  <loislo@chromium.org>
+
+        Web Inspector: NMI instrument InspectorResourceAgent. it caches resources for the front-end.
+        https://bugs.webkit.org/show_bug.cgi?id=100496
+
+        Reviewed by Yury Semikhatsky.
+
+        It is plain instrumentation for InspectorResourceAgent and NetworkResourceData which is used by the agent.
+
+        * dom/WebCoreMemoryInstrumentation.cpp:
+        (WebCore):
+        * dom/WebCoreMemoryInstrumentation.h:
+        (WebCoreMemoryTypes):
+        * inspector/InspectorResourceAgent.cpp:
+        (WebCore::InspectorResourceAgent::reportMemoryUsage):
+        (WebCore):
+        * inspector/InspectorResourceAgent.h:
+        (InspectorResourceAgent):
+        * inspector/NetworkResourcesData.cpp:
+        (WebCore::XHRReplayData::reportMemoryUsage):
+        (WebCore):
+        (WebCore::NetworkResourcesData::ResourceData::reportMemoryUsage):
+        (WebCore::NetworkResourcesData::reportMemoryUsage):
+        * inspector/NetworkResourcesData.h:
+        (XHRReplayData):
+        (ResourceData):
+        (NetworkResourcesData):
+
+2012-10-26  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r132493.
+        http://trac.webkit.org/changeset/132493
+        https://bugs.webkit.org/show_bug.cgi?id=100509
+
+        It didn't fix the tests on the bot as we had hoped. (Requested
+        by drott on #webkit).
+
+        * platform/network/cf/ResourceErrorCF.cpp:
+        (WebCore::ResourceError::ResourceError):
+
+2012-10-26  Zeno Albisser  <zeno@webkit.org>
+
+        [Qt] Temporarily disable use of QXcbNativeInterface in GraphicsSurfaceGLX.
+        https://bugs.webkit.org/show_bug.cgi?id=100493
+
+        Once QXcbNativeInterface::nativeResourceForContext() can provide the
+        GLXContext for an existing QOpenGLContext, this patch shall be reverted.
+
+        Reviewed by Simon Hausmann.
+
+        * platform/graphics/surfaces/qt/GraphicsSurfaceGLX.cpp:
+        (WebCore::GraphicsSurfacePrivate::GraphicsSurfacePrivate):
+
+2012-10-26  Zeno Albisser  <zeno@webkit.org>
+
+        [Qt] Remove QOpenGL specific code from GraphicsSurfaceGLX.
+        https://bugs.webkit.org/show_bug.cgi?id=100492
+
+        This patch removes most of the QOpenGLContext related code
+        from GraphicsSurfaceGLX. This allows sharing almost all
+        GraphicsSurfaceGLX code with EFL, by relying on pure GLX.
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        * platform/graphics/surfaces/qt/GraphicsSurfaceGLX.cpp:
+        (WebCore::OffScreenRootWindow::get):
+        (WebCore::OffScreenRootWindow::~OffScreenRootWindow):
+        (OffScreenRootWindow):
+        (WebCore):
+        (WebCore::GraphicsSurfacePrivate::GraphicsSurfacePrivate):
+        (WebCore::GraphicsSurfacePrivate::createSurface):
+        (WebCore::GraphicsSurfacePrivate::makeCurrent):
+        (WebCore::GraphicsSurfacePrivate::doneCurrent):
+        (WebCore::GraphicsSurfacePrivate::swapBuffers):
+        (WebCore::GraphicsSurfacePrivate::copyFromTexture):
+        (GraphicsSurfacePrivate):
+        (WebCore::resolveGLMethods):
+
+2012-10-26  Regina Chung  <heejin.r.chung@samsung.com>
+
+        [EFL][WK2] Enable WebGL
+        https://bugs.webkit.org/show_bug.cgi?id=97652
+
+        Reviewed by Gyuyoung Kim.
+
+        Implemented GraphicsSurface for EFL to enable WebGL for WebKit2.
+        Depends on GLX since Evas doesn't provide the necessary functionality.
+
+        No new tests. Covered by existing tests.
+
+        * PlatformEfl.cmake:
+        * platform/graphics/GraphicsContext3D.h:
+        * platform/graphics/efl/GraphicsContext3DEfl.cpp:
+        (WebCore::GraphicsContext3D::createGraphicsSurfaces):
+        * platform/graphics/efl/GraphicsContext3DPrivate.cpp:
+        (WebCore::GraphicsContext3DPrivate::GraphicsContext3DPrivate):
+        (WebCore::GraphicsContext3DPrivate::~GraphicsContext3DPrivate):
+        (WebCore):
+        (WebCore::GraphicsContext3DPrivate::createGraphicsSurfaces):
+        (WebCore::GraphicsContext3DPrivate::copyToGraphicsSurface):
+        (WebCore::GraphicsContext3DPrivate::graphicsSurfaceToken):
+        * platform/graphics/efl/GraphicsContext3DPrivate.h:
+        (GraphicsContext3DPrivate):
+        * platform/graphics/opengl/GraphicsContext3DOpenGLCommon.cpp:
+        (WebCore::GraphicsContext3D::reshape):
+        * platform/graphics/surfaces/efl: Added.
+        * platform/graphics/surfaces/efl/GraphicsSurfaceEfl.cpp: Added.
+        (WebCore):
+        (WebCore::OffScreenRootWindow::get):
+        (WebCore::OffScreenRootWindow::~OffScreenRootWindow):
+        (WebCore::GraphicsSurfacePrivate::GraphicsSurfacePrivate):
+        (WebCore::GraphicsSurfacePrivate::createSurface):
+        (WebCore::GraphicsSurfacePrivate::makeCurrent):
+        (WebCore::GraphicsSurfacePrivate::doneCurrent):
+        (WebCore::GraphicsSurfacePrivate::swapBuffers):
+        (WebCore::GraphicsSurface::platformBeginPaint):
+        (WebCore::GraphicsSurface::createReadOnlyImage):
+        * platform/graphics/surfaces/qt/GraphicsSurfaceGLX.cpp:
+        * platform/graphics/surfaces/qt/GraphicsSurfaceGLX.h: Added.
+        (WebCore):
+        (OffScreenRootWindow):
+        (WebCore::OffScreenRootWindow::OffScreenRootWindow):
+        (GraphicsSurfacePrivate):
+        (WebCore::GraphicsSurfacePrivate::~GraphicsSurfacePrivate):
+        (WebCore::GraphicsSurfacePrivate::createPixmap):
+        (WebCore::GraphicsSurfacePrivate::copyFromTexture):
+        (WebCore::GraphicsSurfacePrivate::display):
+        (WebCore::GraphicsSurfacePrivate::glxPixmap):
+        (WebCore::GraphicsSurfacePrivate::size):
+        (WebCore::GraphicsSurfacePrivate::glContext):
+        (WebCore::resolveGLMethods):
+        * platform/graphics/surfaces/qt/GraphicsSurfaceQt.cpp:
+        (WebCore):
+        (WebCore::OffScreenRootWindow::OffScreenRootWindow::get):
+        (WebCore::OffScreenRootWindow::~OffScreenRootWindow):
+        (WebCore::GraphicsSurfacePrivate::GraphicsSurfacePrivate):
+        (WebCore::GraphicsSurfacePrivate::createSurface):
+        (WebCore::GraphicsSurfacePrivate::makeCurrent):
+        (WebCore::GraphicsSurfacePrivate::doneCurrent):
+        (WebCore::GraphicsSurfacePrivate::swapBuffers):
+
+2012-10-26  Alexander Pavlov  <apavlov@chromium.org>
+
+        Web Inspector: [Overrides] Do not persist the User Agent "master switch"
+        https://bugs.webkit.org/show_bug.cgi?id=100484
+
+        Reviewed by Yury Semikhatsky.
+
+        The User Agent override state is managed in the front-end, just like for other override-able parameters.
+
+        * inspector/InspectorResourceAgent.cpp:
+        (WebCore::InspectorResourceAgent::disable):
+        * inspector/front-end/NetworkManager.js:
+        (WebInspector.NetworkManager.get NetworkAgent):
+        (WebInspector.NetworkManager):
+        * inspector/front-end/SettingsScreen.js:
+        (WebInspector.UserAgentSettingsTab.prototype._createUserAgentSelectRowElement.set checkboxClicked):
+        (WebInspector.UserAgentSettingsTab.prototype._createUserAgentSelectRowElement):
+        * inspector/front-end/UserAgentSupport.js:
+        (WebInspector.UserAgentSupport):
+        (WebInspector.UserAgentSupport.prototype.toggleUserAgentOverride):
+        (WebInspector.UserAgentSupport.prototype._userAgentChanged):
+
+2012-10-26  Takashi Sakamoto  <tasak@google.com>
+
+        [Shadow]: removing styles in shadow dom subtree causes crash.
+        https://bugs.webkit.org/show_bug.cgi?id=100455
+
+        Reviewed by Hajime Morita.
+
+        To quickly check whether shadow roots or elements have any scoped
+        styles or not, elements have hasStyleScoped flag. If elements have
+        any scoped styles, the styles are direct children of the element.
+        The original code just sees how many chilren are scoped style or not.
+        However styles in shadow dom subtree are registered with the shadow
+        root but are not always direct children of shadow roots. So to check
+        whether shadow roots have any scoped styles, modified to count
+        number of styles registered with the shadow root.
+
+        Test: fast/dom/shadow/remove-styles-in-shadow-crash.html
+
+        * dom/Node.cpp:
+        (WebCore::Node::registerScopedHTMLStyleChild):
+        (WebCore::Node::unregisterScopedHTMLStyleChild):
+        Made the above two method virtual. class ShadowRoot overrides these
+        methods.
+        (WebCore::Node::numberOfScopedHTMLStyleChildren):
+        Moved HTMLStyleElement.cpp to Node.cpp, because the above two methods
+        are moved into Node.cpp.
+        * dom/Node.h:
+        (Node):
+        * dom/ShadowRoot.cpp:
+        (WebCore::ShadowRoot::ShadowRoot):
+        (WebCore::ShadowRoot::registerScopedHTMLStyleChild):
+        (WebCore::ShadowRoot::unregisterScopedHTMLStyleChild):
+        Modify to count how many styles are registered with the shadow root.
+        The "counting" is done when styles are registered and unregistered
+        with the shadow root, i.e. style element is inserted into document or
+        removed from document. When unregister some style, there are no more
+        styles registered with the shadow root. Set style scoped flag false.
+        * dom/ShadowRoot.h:
+        (ShadowRoot):
+        * html/HTMLStyleElement.cpp:
+        * html/HTMLStyleElement.h:
+        (WebCore::HTMLStyleElement::isRegisteredAsScoped):
+        Now isRegisteredAsScoped is used in Node.cpp, so removed inline and
+        moved .cpp to .h.
+
+2012-10-26  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r132589.
+        http://trac.webkit.org/changeset/132589
+        https://bugs.webkit.org/show_bug.cgi?id=100498
+
+        Breaks font-face layout tests (Requested by pfeldman on
+        #webkit).
+
+        * css/CSSFontFaceSource.cpp:
+        (WebCore::CSSFontFaceSource::getFontData):
+
+2012-10-26  Takashi Sakamoto  <tasak@google.com>
+
+        [Shadow DOM] Needs @host rule for ShadowDOM styling
+        https://bugs.webkit.org/show_bug.cgi?id=88606
+
+        Reviewed by Hajime Morita.
+
+        Implemented @host-@rules according to the shadow dom spec:
+        http://dvcs.w3.org/hg/webcomponents/raw-file/tip/spec/shadow/index.html#host-at-rule
+        The design doc is:
+        https://docs.google.com/document/d/1P2yorchF8lci2sccr-mVSRf2dtvjKeiuyQWzCB2bEA8/edit
+
+        Test: fast/dom/shadow/athost-atrules.html
+
+        * css/CSSGrammar.y.in:
+        Added rules for parsing @host @-rules.
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::detectAtToken):
+        Added a new token "@host".
+        (WebCore::CSSParser::createHostRule):
+        Added a new method to create an @host @-rule, which is invoked from
+        (WebCore):
+        * css/CSSParser.h:
+        Added a declaration of the above new method: createHostRule.
+        * css/CSSPropertySourceData.h:
+        Added HOST_RULE to enum Type.
+        * css/RuleSet.cpp:
+        (WebCore::RuleData::RuleData):
+        Modified multiple bool arguments into one argument. Now it
+        uses combinations of values from enum AddRuleFlags.
+        (WebCore::RuleSet::addRule):
+        (WebCore::RuleSet::addRegionRule):
+        (WebCore::RuleSet::addStyleRule):
+        Updated according to the RuleData's change.
+        Modified to Invoke increaseSpecificity if the given rule is @host
+        @-rule.
+        (WebCore::RuleSet::addRulesFromSheet):
+        Invoked addHostRule if the given rule is @host @-rule.
+        * css/RuleSet.h:
+        (RuleData):
+        (WebCore::RuleData::increaseSpecificity):
+        Added a new method to increase selector's specificity. This method is
+        used to make @host @-rules' specificity larger than normal author
+        rules' specificity.
+        (RuleSet):
+        * css/StyleResolver.cpp:
+        (WebCore::makeRuleSet):
+        (WebCore::StyleResolver::addHostRule):
+        A wrapper method to invoke StyleScopeResolver::addHostRule. The method
+        is used to make only StyleResolver know an implementation detail about
+        class StyleScopeResolver.
+        (WebCore::StyleResolver::appendAuthorStylesheets):
+        Updated according to the RuleData's change.
+        (WebCore::StyleResolver::styleSharingCandidateMatchesHostRules):
+        A new method to find matched host rules when an element is given.
+        This method invokes
+        StyleScopeResolver::styleSharingCandidateMatchesHostRules to find
+        matched host rules.
+        (WebCore):
+        (WebCore::StyleResolver::matchHostRules):
+        A new method to find matched host rules when an element is given.
+        This method invokes StyleScopeResolver::matchHostRules to find
+        matched host rules.
+        (WebCore::StyleResolver::matchScopedAuthorRules):
+        Modified to invoke matchHostRules.
+        (WebCore::StyleResolver::locateSharedStyle):
+        Disable sibling style cache if the given element is a shadow host and
+        any @host @-rules are applied to the element.
+        * css/StyleResolver.h:
+        (WebCore::StyleResolver::ensureScopeResolver):
+        If no scopeResolver is created, create and return the instance.
+        If created, just return the instance.
+        (StyleResolver):
+        * css/StyleRule.cpp:
+        (WebCore::StyleRuleBase::reportMemoryUsage):
+        (WebCore::StyleRuleBase::destroy):
+        (WebCore::StyleRuleBase::copy):
+        (WebCore::StyleRuleBase::createCSSOMWrapper):
+        (WebCore::StyleRuleHost::StyleRuleHost):
+        Implemented class StyleRuleHost. The class is almost the same as
+        StyleRuleBlock except type.
+        (WebCore):
+        * css/StyleRule.h:
+        (WebCore::StyleRuleBase::isHostRule):
+        (StyleRuleHost):
+        (WebCore::StyleRuleHost::create):
+        (WebCore::StyleRuleHost::copy):
+        (WebCore):
+        * css/StyleScopeResolver.cpp:
+        (WebCore::StyleScopeResolver::ensureAtHostRuleSetFor):
+        A new method to create a new RuleSet for the given shadow root.
+        (WebCore):
+        (WebCore::StyleScopeResolver::atHostRuleSetFor):
+        A new private inline method to obtain @host @-rules declared in
+        the given shadow root.
+        (WebCore::StyleScopeResolver::addHostRule):
+        Added a new method to register @host @-rules with shadow roots.
+        (WebCore::StyleScopeResolver::styleSharingCandidateMatchesHostRules):
+        A new method to find whether any @host @-rules are applied to
+        the given host element.
+        (WebCore::StyleScopeResolver::matchHostRules):
+        A new method to find matched rules for the given host element.
+        (WebCore::StyleScopeResolver::reportMemoryUsage):
+        * css/StyleScopeResolver.h:
+        (WebCore):
+        (StyleScopeResolver):
+        * css/StyleSheetContents.cpp:
+        (WebCore::childRulesHaveFailedOrCanceledSubresources):
+
+2012-10-26  Jaehun Lim  <ljaehun.lim@samsung.com>
+
+        [CMAKE] Add TextAutosizer.cpp in WebCore/CMakeLists.txt
+        https://bugs.webkit.org/show_bug.cgi?id=100476
+
+        Reviewed by Kentaro Hara.
+
+        ENABLE_TEXT_AUTOSIZING option is added in CMAKE,
+        but the source file for that feature is omitted.
+
+        No new tests. Covered by existing tests.
+
+        * CMakeLists.txt:
+
+2012-10-26  Julien Chaffraix  <jchaffraix@webkit.org>
+
+        RenderTableCol::computePreferredLogicalWidths and RenderTableCol::layout should never be called
+        https://bugs.webkit.org/show_bug.cgi?id=99861
+
+        Reviewed by Ojan Vafai.
+
+        RenderTableCol's computePreferredLogicalWidths and layout's only purpose were to clear the preferred logical
+        widths dirty / layout flag so that we would properly propagate the information to our containing table. This
+        led to clunky code where the table layout code had to forcefully call RenderTableCol::computePreferredLogicalWidths
+        or else we would ignore the next layout hint on the <col> or <colgroup>.
+
+        Tests: fast/table/col-span-change-relayout.html
+               fast/table/simplified-layout-table.html
+
+        * rendering/AutoTableLayout.cpp:
+        (WebCore::AutoTableLayout::recalcColumn):
+        * rendering/RenderTable.cpp:
+        (WebCore::RenderTable::layout):
+        Simplified the code now that we only need to iterate over the sections.
+
+        * rendering/FixedTableLayout.cpp:
+        (WebCore::FixedTableLayout::calcWidthArray):
+        Removed call to computePreferredLogicalWidths.
+
+        * rendering/RenderTableCol.cpp:
+        (WebCore::RenderTableCol::styleDidChange):
+        (WebCore::RenderTableCol::updateFromElement):
+        Forward a layout hint to the table so that we properly recompute the cell's logical withs.
+
+        (WebCore::RenderTableCol::computePreferredLogicalWidths):
+        (WebCore::RenderTableCol::layout):
+        Change our implementations of those 2 methods to be no-ops, while enforcing that they are
+        never called when it was possible.
+
+        (WebCore::RenderTableCol::propagateLayoutCueToTable):
+        New helper function that forward any layout cue to the containing table, this works around
+        us not clearing the flags which confuses RenderObject markContainingBlocksForLayout and
+        invalidateContainerPreferredLogicalWidths.
+
+        * rendering/RenderTableCol.h:
+        Made the function that we are not expected to be called private.
+
+2012-10-26  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r132601.
+        http://trac.webkit.org/changeset/132601
+        https://bugs.webkit.org/show_bug.cgi?id=100494
+
+        It broke the Qt build (Requested by Ossy on #webkit).
+
+        * PlatformEfl.cmake:
+        * platform/graphics/GraphicsContext3D.h:
+        * platform/graphics/efl/GraphicsContext3DEfl.cpp:
+        (WebCore::GraphicsContext3D::createGraphicsSurfaces):
+        * platform/graphics/efl/GraphicsContext3DPrivate.cpp:
+        (WebCore::GraphicsContext3DPrivate::GraphicsContext3DPrivate):
+        (WebCore::GraphicsContext3DPrivate::~GraphicsContext3DPrivate):
+        (WebCore):
+        * platform/graphics/efl/GraphicsContext3DPrivate.h:
+        (GraphicsContext3DPrivate):
+        * platform/graphics/opengl/GraphicsContext3DOpenGLCommon.cpp:
+        (WebCore::GraphicsContext3D::reshape):
+        * platform/graphics/surfaces/qt/GraphicsSurfaceGLX.cpp:
+        (WebCore::OffScreenRootWindow::get):
+        (WebCore::OffScreenRootWindow::~OffScreenRootWindow):
+        (OffScreenRootWindow):
+        (WebCore):
+        (WebCore::GraphicsSurfacePrivate::GraphicsSurfacePrivate):
+        (WebCore::GraphicsSurfacePrivate::createSurface):
+        (WebCore::GraphicsSurfacePrivate::makeCurrent):
+        (WebCore::GraphicsSurfacePrivate::doneCurrent):
+        (WebCore::GraphicsSurfacePrivate::swapBuffers):
+        (WebCore::GraphicsSurfacePrivate::copyFromTexture):
+        (GraphicsSurfacePrivate):
+        (WebCore::resolveGLMethods):
+
+2012-10-26  Yury Semikhatsky  <yurys@chromium.org>
+
+        Memory instrumentation: do not report memory occupied by v8::String
+        https://bugs.webkit.org/show_bug.cgi?id=100487
+
+        Reviewed by Alexander Pavlov.
+
+        Pointers to v8::String are skipped when reporting memory usage of V8 bindings'
+        string cache.
+
+        * bindings/v8/V8Binding.cpp:
+        (WTF):
+
+2012-10-26  Mihnea Ovidenie  <mihnea@adobe.com>
+
+        [CSSRegions] Add support for auto-height regions with region-breaks
+        https://bugs.webkit.org/show_bug.cgi?id=99952
+
+        Reviewed by David Hyatt.
+
+        This patch takes region breaks into account when computing the height for auto logical height regions.
+        When a region break is encountered before/after an element from within a flow thread and we are in the layout
+        phase in which we lay out the flow threads in regions unconstrained, we use the region break to
+        compute the region override logical content height if the region break fits inside an auto logical height region.
+        A region break inside an auto logical height region determines the region override logical content height, taking
+        min/max height into account.
+
+        Tests: fast/regions/autoheight-allregions-nobreaks.html
+               fast/regions/autoheight-allregions.html
+               fast/regions/autoheight-breakafteralways-maxheight.html
+               fast/regions/autoheight-breakbeforealways.html
+               fast/regions/autoheight-firstregion-breakalways.html
+               fast/regions/autoheight-lastregion-overflowauto-breaksignored.html
+               fast/regions/autoheight-lastregion-overflowauto.html
+               fast/regions/autoheight-middleregion.html
+               fast/regions/autoheight-secondregion-breakoutside.html
+               fast/regions/autoheight-secondregion.html
+               fast/regions/autoheight-singleregion-breakafteralways-maxheight.html
+               fast/regions/autoheight-singleregion-breakafteralways.html
+               fast/regions/autoheight-singleregion-breakaftermargin.html
+               fast/regions/autoheight-singleregion-breakbeforealways-minheight.html
+               fast/regions/autoheight-singleregion-breakbeforealways.html
+               fast/regions/autoheight-singleregion-multiplebreaks.html
+               fast/regions/autoheight-singleregion-overflowauto-breaksignored.html
+               fast/regions/autoheight-singleregion-overflowauto.html
+
+        * rendering/RenderBlock.cpp: When encounter a region break before/after an element inside a flow thread,
+        try to use it to determine the override logical content height for auto logical height regions.
+        (WebCore::RenderBlock::applyBeforeBreak):
+        (WebCore::RenderBlock::applyAfterBreak):
+        * rendering/RenderFlowThread.cpp:
+        (WebCore::RenderFlowThread::layout):
+        (WebCore::RenderFlowThread::computeOverflowStateForRegions):
+        Simulate a region break at the end of the flow thread content.
+        (WebCore::RenderFlowThread::updateRegionsFlowThreadPortionRect):
+        (WebCore::RenderFlowThread::clearOverrideLogicalContentHeightInRegions):
+        Helper method used to clear the overrideLogicalContentHeight for auto logical height regions.
+        (WebCore::RenderFlowThread::addForcedRegionBreak):
+        Extend the method to process region breaks. The method returns true if at least one auto logical height region
+        has its override logical content height computed.        
+        * rendering/RenderFlowThread.h:
+        * rendering/RenderRegion.cpp: Make these methods work with auto logical height regions.
+        (WebCore::RenderRegion::pageLogicalHeight):
+        (WebCore::RenderRegion::logicalHeightOfAllFlowThreadContent):
+
+2012-10-26  Regina Chung  <heejin.r.chung@samsung.com>
+
+        [EFL][WK2] Enable WebGL
+        https://bugs.webkit.org/show_bug.cgi?id=97652
+
+        Reviewed by Gyuyoung Kim.
+
+        Implemented GraphicsSurface for EFL to enable WebGL for WebKit2.
+        Depends on GLX since Evas doesn't provide the necessary functionality.
+
+        No new tests. Covered by existing tests.
+
+        * PlatformEfl.cmake:
+        * platform/graphics/GraphicsContext3D.h:
+        * platform/graphics/efl/GraphicsContext3DEfl.cpp:
+        (WebCore::GraphicsContext3D::createGraphicsSurfaces):
+        * platform/graphics/efl/GraphicsContext3DPrivate.cpp:
+        (WebCore::GraphicsContext3DPrivate::GraphicsContext3DPrivate):
+        (WebCore::GraphicsContext3DPrivate::~GraphicsContext3DPrivate):
+        (WebCore):
+        (WebCore::GraphicsContext3DPrivate::createGraphicsSurfaces):
+        (WebCore::GraphicsContext3DPrivate::copyToGraphicsSurface):
+        (WebCore::GraphicsContext3DPrivate::graphicsSurfaceToken):
+        * platform/graphics/efl/GraphicsContext3DPrivate.h:
+        (GraphicsContext3DPrivate):
+        * platform/graphics/opengl/GraphicsContext3DOpenGLCommon.cpp:
+        (WebCore::GraphicsContext3D::reshape):
+        * platform/graphics/surfaces/efl: Added.
+        * platform/graphics/surfaces/efl/GraphicsSurfaceEfl.cpp: Added.
+        (WebCore):
+        (WebCore::OffScreenRootWindow::get):
+        (WebCore::OffScreenRootWindow::~OffScreenRootWindow):
+        (WebCore::GraphicsSurfacePrivate::GraphicsSurfacePrivate):
+        (WebCore::GraphicsSurfacePrivate::createSurface):
+        (WebCore::GraphicsSurfacePrivate::makeCurrent):
+        (WebCore::GraphicsSurfacePrivate::doneCurrent):
+        (WebCore::GraphicsSurfacePrivate::swapBuffers):
+        (WebCore::GraphicsSurface::platformBeginPaint):
+        (WebCore::GraphicsSurface::createReadOnlyImage):
+        * platform/graphics/surfaces/qt/GraphicsSurfaceGLX.cpp:
+        * platform/graphics/surfaces/qt/GraphicsSurfaceGLX.h: Added.
+        (WebCore):
+        (OffScreenRootWindow):
+        (WebCore::OffScreenRootWindow::OffScreenRootWindow):
+        (GraphicsSurfacePrivate):
+        (WebCore::GraphicsSurfacePrivate::~GraphicsSurfacePrivate):
+        (WebCore::GraphicsSurfacePrivate::createPixmap):
+        (WebCore::GraphicsSurfacePrivate::copyFromTexture):
+        (WebCore::GraphicsSurfacePrivate::display):
+        (WebCore::GraphicsSurfacePrivate::glxPixmap):
+        (WebCore::GraphicsSurfacePrivate::size):
+        (WebCore::GraphicsSurfacePrivate::glContext):
+        (WebCore::resolveGLMethods):
+        * platform/graphics/surfaces/qt/GraphicsSurfaceQt.cpp:
+        (WebCore):
+        (WebCore::OffScreenRootWindow::OffScreenRootWindow::get):
+        (WebCore::OffScreenRootWindow::~OffScreenRootWindow):
+        (WebCore::GraphicsSurfacePrivate::GraphicsSurfacePrivate):
+        (WebCore::GraphicsSurfacePrivate::createSurface):
+        (WebCore::GraphicsSurfacePrivate::makeCurrent):
+        (WebCore::GraphicsSurfacePrivate::doneCurrent):
+        (WebCore::GraphicsSurfacePrivate::swapBuffers):
+
+2012-10-26  Thiago Marcos P. Santos  <thiago.santos@intel.com>
+
+        Add feature flags for CSS Device Adaptation
+        https://bugs.webkit.org/show_bug.cgi?id=95960
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        * Configurations/FeatureDefines.xcconfig:
+        * GNUmakefile.am:
+        * GNUmakefile.features.am:
+
+2012-10-26  Li Yin  <li.yin@intel.com>
+
+        fast/forms/file/input-file-write-files.html should cover correct setting value
+        https://bugs.webkit.org/show_bug.cgi?id=100085
+
+        Reviewed by Kentaro Hara.
+
+        From Spec: http://dev.w3.org/html5/spec/single-page.html#dom-input-value-filename
+        On setting, if the new value is the empty string, it must empty the list of selected
+        files; otherwise, it must throw an InvalidStateError exception.
+
+        Test: fast/forms/file/input-file-value.html
+
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::setValue):
+        (WebCore):
+        * html/HTMLInputElement.h:
+        (HTMLInputElement):
+        * html/HTMLInputElement.idl:
+
+2012-10-26  Keishi Hattori  <keishi@webkit.org>
+
+        Refactor calendar picker to remove _x/_y from DaysTable
+        https://bugs.webkit.org/show_bug.cgi?id=100460
+
+        Reviewed by Kent Tamura.
+
+        _x/_y properties keep the coordinates for the selection but when we add
+        week and month picking capabilities, the selection can't be expressed as
+        a set of coordinates. This change will remove it.
+
+        No new tests. Covered by calendar-picker-*.html tests.
+
+        * Resources/pagepopups/calendarPicker.js:
+        (DaysTable): Removed _x/_y properties.
+        (DaysTable.prototype._hasSelection): Changed to refer to the DOM to see if we have a selection.
+        (DaysTable.prototype.navigateToMonthAndKeepSelectionPosition): Lookup the selection position.
+        (DaysTable.prototype.selectDate): Deselect first so we don't have two selections.
+        (DaysTable.prototype._selectRangeContainingNode): Selects date/week/month containing the given day node.
+        (DaysTable.prototype._selectRangeAtPosition): Selects date/week/month at the given position.
+        (DaysTable.prototype._firstNodeInSelectedRange): Returns first selected day node.
+        (DaysTable.prototype._deselect): Deselects all selections.
+        (DaysTable.prototype._handleMouseOver): Use _selectRangeContainingNode so we don't have many places handling the selection.
+        (DaysTable.prototype._handleMouseOut): Use _deselect.
+        (DaysTable.prototype._handleKey): Lookup the selection position.
+        (DaysTable.prototype.updateSelection): Use _selectRangeAtPosition.
+
+2012-10-26  Ningxin Hu  <ningxin.hu@intel.com>
+
+        FileReader abort case causes Chromium renderer crash
+        https://bugs.webkit.org/show_bug.cgi?id=99142
+
+        Reviewed by Kentaro Hara.
+
+        Before dispatching load event, FileReader should check if it is
+        in aborting.
+
+        Test: manually launch fast/files/file-reader-abort.html in Chromium
+        browser and compare the result with
+        fast/files/file-reader-abort-expected.txt.
+
+        * fileapi/FileReader.cpp:
+        (WebCore::FileReader::didFinishLoading):
+
+2012-10-26  Julien Chaffraix  <jchaffraix@webkit.org>
+
+        Generate less repaint calls during subtree detaching
+        https://bugs.webkit.org/show_bug.cgi?id=99741
+
+        Reviewed by Eric Seidel.
+
+        Following bug 98336, detach is now a subtree top-down operation. Because we
+        track visual overflow from our children during layout for most cases, we can
+        generate a repaint only on the subtree root.
+
+        On http://dglazkov.github.com/performance-tests/redraw.html, this ups the FPS to
+        26 fps from 22 fps on my MBP (+ 15%). On PerformanceTests/layout/subtree-detach.html,
+        it decreases the time by 35%. This is due to being the best case and we now generate
+        only one repaint per detach phase.
+
+        Covered by existing pixels tests (including but not limited to repaint ones).
+
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::destroyAndCleanupAnonymousWrappers):
+        Changed the function not to be recursive anymore to generate one painting for
+        our root only. Added a FIXME about using our RenderLayer for repainting to avoid
+        the cost of computing our absolute repaint rectangle.
+
+        * rendering/RenderObjectChildList.cpp:
+        (WebCore::RenderObjectChildList::removeChildNode):
+        Removed the logic for repainting in the general case. However we still force a repaint
+        if we have a RenderLayer as we don't track their overflow in some cases (e.g. positioned
+        objects). This check is conservative and could be narrowed down (e.g overflow RenderLayers
+        are properly accounted for in our clipppedOverflowRectForRepaint).
+
+2012-10-26  Kenichi Ishibashi  <bashi@chromium.org>
+
+        local(Helvetica) in src descriptor prevent fallback
+        https://bugs.webkit.org/show_bug.cgi?id=100446
+
+        Reviewed by Dan Bernstein.
+
+        FontCache::getCachedFontData() has a mechanism that aliases a few pairs
+        of font family names, so that if the family name specified in the font-family
+        property is not available on the system, but the its alias is available,
+        it will be used instead. This is appropriate for the font-family property,
+        but not for font family names specified in the local() function of the src
+        descriptor in a @font-face rule.
+
+        This patch disables the mechanism while checking src descriptor of @font-face.
+
+        No new tests. It's difficult to test the change because 'Helvetica' can
+        be mapped any other font. For example, chromium DRT uses FontConfig to
+        map Helvetica to Times New Roman. Other ports may map Helvetica to other
+        fonts. We can't define the expected result.
+
+        * css/CSSFontFaceSource.cpp:
+        (WebCore::CSSFontFaceSource::getFontData):
+        Call fontCache()->getCachedFontData() with checkingAlternateName = true.
+        This disables aliasing font family names in FontCache.
+
+2012-10-26  Eugene Klyuchnikov  <eustas.bug@gmail.com>
+
+        Web Inspector: Doctype Audits panel code
+        https://bugs.webkit.org/show_bug.cgi?id=100371
+
+        Reviewed by Alexander Pavlov.
+
+        This is a preparation step for ongoing refactoring.
+        It is much easier to read doctyped code.
+
+        * inspector/front-end/AuditRules.js:
+        (WebInspector.AuditRules.MinimizeDnsLookupsRule.prototype.doRun):
+        Replaced "undefined" with "null"
+        * inspector/front-end/AuditsPanel.js:
+        (WebInspector.AuditCategory.prototype.callbackWrapper):
+        Removed callback parameter indirection.        
+        (WebInspector.AuditRuleResult.prototype.addFormatted):
+        Converted private instance function to scoped function.
+
+2012-10-26  János Badics  <jbadics@inf.u-szeged.hu>
+
+        [Qt]REGRESSION(r131428): cookies.db created on wrong place
+        https://bugs.webkit.org/show_bug.cgi?id=99445
+
+        Reviewed by Simon Hausmann.
+
+        Added a slash to the path of cookies.db in CookieJarQt.cpp.
+
+        * platform/qt/CookieJarQt.cpp:
+        (WebCore::SharedCookieJarQt::SharedCookieJarQt):
+
+2012-10-26  Adam Barth  <abarth@webkit.org>
+
+        Unreviewed. This ASSERT is no longer correct (and fires on many tests.)
+
+        * bindings/v8/V8DOMWrapper.h:
+        (WebCore::V8DOMWrapper::setJSWrapperForDOMObject):
+
+2012-10-26  Kent Tamura  <tkent@chromium.org>
+
+        [Chromium-Win] Support shortTimeFormat
+        https://bugs.webkit.org/show_bug.cgi?id=100471
+
+        Reviewed by Kentaro Hara.
+
+        No new tests. Covered by fast/forms/time-multiple-fields/ and
+        WebKit/chromium/tests/LocaleWinTest.
+
+        * platform/text/LocaleWin.cpp:
+        (WebCore::LocaleWin::shortTimeFormat):
+        Gets a format by LOCALE_SSHORTTIME. If it fails, remove "<delimiter>ss"
+        from the format by LOCALE_STIMEFORMAT.
+        * platform/text/LocaleWin.h:
+        (LocaleWin): Declare m_timeFormatWithoutSeconds.
+
+2012-10-26  Adam Barth  <abarth@webkit.org>
+
+        Unreviewed. Update run-bindings-tests results after recent active DOM
+        object changes.
+
+        * bindings/scripts/test/V8/V8TestInterface.cpp:
+        (WebCore::V8TestInterface::constructorCallback):
+        (WebCore::V8TestInterface::wrapSlow):
+        * bindings/scripts/test/V8/V8TestInterface.h:
+        (WebCore::V8TestInterface::wrap):
+        * bindings/scripts/test/V8/V8TestNamedConstructor.cpp:
+        (WebCore::V8TestNamedConstructorConstructorCallback):
+        (WebCore::V8TestNamedConstructor::wrapSlow):
+        * bindings/scripts/test/V8/V8TestNamedConstructor.h:
+        (WebCore::V8TestNamedConstructor::wrap):
+
+2012-10-26  MORITA Hajime  <morrita@google.com>
+
+        [V8] REGRESSION(132540) Assertion failure on V8DOMWrapper::setJSWrapperForDOMNode()
+        https://bugs.webkit.org/show_bug.cgi?id=100462
+
+        Reviewed by Adam Barth.
+
+        Removed the no longer correct assertion statement.
+
+        No new tests. Covered by breaking tests.
+
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::setJSWrapperForDOMNode):
+
+2012-10-25  Adam Barth  <abarth@webkit.org>
+
+        [V8] WorkerContextExecutionProxy should use ScopedPersistent
+        https://bugs.webkit.org/show_bug.cgi?id=100443
+
+        Reviewed by Eric Seidel.
+
+        This class was manually re-implementing the ScopedPersistent pattern.
+
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        (WebCore::WorkerContextExecutionProxy::dispose):
+        (WebCore::WorkerContextExecutionProxy::initializeIfNeeded):
+        (WebCore::WorkerContextExecutionProxy::evaluate):
+        * bindings/v8/WorkerContextExecutionProxy.h:
+        (WebCore::WorkerContextExecutionProxy::context):
+        (WorkerContextExecutionProxy):
+
+2012-10-25  Peter Wang  <peter.wang@torchmobile.com.cn>
+
+        A mistake in WebCore::JavaScriptCallFrame::evaluate which will cause assert failed
+        https://bugs.webkit.org/show_bug.cgi?id=100347
+
+        Reviewed by Mark Lam and Filip Pizlo.
+
+        In worker context, calling "JSDOMWindowBase::commonJSGlobalData" will cause assert,
+        since there is "ASSERT(isMainThread())" in "JSDOMWindowBase::commonJSGlobalData".
+
+        No new test case, since no behaviour changed.
+
+        * bindings/js/JavaScriptCallFrame.cpp:
+        (WebCore::JavaScriptCallFrame::evaluate):
+
+2012-10-25  Adam Barth  <abarth@webkit.org>
+
+        [V8] We can merge the wrapper maps for DOM objects and active DOM objects
+        https://bugs.webkit.org/show_bug.cgi?id=100432
+
+        Reviewed by Eric Seidel.
+
+        Now that we use the same object to visit both DOM objects and active
+        DOM objects, there's no reason to keep them in separate hash maps.
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+        (GetDomMapName):
+        * bindings/v8/DOMDataStore.cpp:
+        (WebCore::DOMDataStore::DOMDataStore):
+        (WebCore::DOMDataStore::~DOMDataStore):
+        (WebCore::DOMDataStore::reportMemoryUsage):
+        * bindings/v8/DOMDataStore.h:
+        (DOMDataStore):
+        * bindings/v8/V8DOMMap.cpp:
+        * bindings/v8/V8DOMMap.h:
+        (NodeWrapperVisitor):
+        (WebCore):
+        * bindings/v8/V8DOMWrapper.h:
+        (V8DOMWrapper):
+        * bindings/v8/V8GCController.cpp:
+        (WebCore::V8GCController::majorGCPrologue):
+        * bindings/v8/custom/V8WebSocketCustom.cpp:
+        (WebCore::V8WebSocket::constructorCallback):
+        * bindings/v8/custom/V8XMLHttpRequestConstructor.cpp:
+        (WebCore::V8XMLHttpRequest::constructorCallback):
+
+2012-10-25  Charles Wei  <charles.wei@torchmobile.com.cn>
+
+        [BlackBerry] User Challenged again after browser restart for HTTP/FTP sites already successfully authenticated.
+        https://bugs.webkit.org/show_bug.cgi?id=100448
+
+        Reviewed by George Staikos.
+
+        Internally reviewed by Joe Mason.
+
+        We didn't check the persistent Credential Storage for Credentials when challenged by the server.
+
+        Manual Test: login to ftp://localhost on BlackBerry device, and restart the browser to login again.
+
+        * platform/network/blackberry/NetworkJob.cpp:
+        (WebCore::NetworkJob::sendRequestWithCredentials):
+
+2012-10-25  Joshua Bell  <jsbell@chromium.org>
+
+        IndexedDB: Add histogram statistics for backing store errors
+        https://bugs.webkit.org/show_bug.cgi?id=98465
+
+        Reviewed by Adam Barth.
+
+        Define a macro for consistent asserting (during development), logging, and recording
+        internal backing store errors via histograms. Define specific histogram values to
+        track issues with opening backing stores to gather stats on corruption.
+
+        No new tests - just the stats, ma'am, just the stats.
+
+        * Modules/indexeddb/IDBLevelDBBackingStore.cpp:
+        (WebCore):
+        (WebCore::setUpMetadata):
+        (WebCore::IDBLevelDBBackingStore::open):
+        (WebCore::IDBLevelDBBackingStore::getIDBDatabaseMetaData):
+        (WebCore::IDBLevelDBBackingStore::createIDBDatabaseMetaData):
+        (WebCore::IDBLevelDBBackingStore::updateIDBDatabaseIntVersion):
+        (WebCore::IDBLevelDBBackingStore::updateIDBDatabaseMetaData):
+        (WebCore::deleteRange):
+        (WebCore::IDBLevelDBBackingStore::getObjectStores):
+        (WebCore::IDBLevelDBBackingStore::createObjectStore):
+        (WebCore::IDBLevelDBBackingStore::putObjectStoreRecord):
+        (WebCore::IDBLevelDBBackingStore::maybeUpdateKeyGeneratorCurrentNumber):
+        (WebCore::IDBLevelDBBackingStore::forEachObjectStoreRecord):
+        (WebCore::IDBLevelDBBackingStore::getIndexes):
+        (WebCore::IDBLevelDBBackingStore::createIndex):
+        (WebCore::IDBLevelDBBackingStore::deleteIndex):
+        (WebCore::IDBLevelDBBackingStore::findKeyInIndex):
+
+2012-10-25  Adam Barth  <abarth@webkit.org>
+
+        [V8] We can merge ActiveDOMObjectPrologueVisitor with ObjectVisitor
+        https://bugs.webkit.org/show_bug.cgi?id=100430
+
+        Reviewed by Eric Seidel.
+
+        There's no reason for these visitors to be separate objects anymore.
+
+        * bindings/v8/V8GCController.cpp:
+        (WebCore::ObjectVisitor::ObjectVisitor):
+        (WebCore::ObjectVisitor::visitDOMWrapper):
+        (WebCore::V8GCController::majorGCPrologue):
+
+2012-10-25  Tony Chang  <tony@chromium.org>
+
+        Remove unused static methods from DOMTimer.h
+        https://bugs.webkit.org/show_bug.cgi?id=100427
+
+        Reviewed by Kenneth Russell.
+
+        Since these values got moved into Settings, these methods are no longer called.
+
+        No new tests, removing dead code.
+
+        * page/DOMTimer.h:
+        (DOMTimer): Remove unused getters.
+
+2012-10-25  Leo Yang  <leoyang@rim.com>
+
+        [BlackBerry] Infinite redirect loop is not displayed to user
+        https://bugs.webkit.org/show_bug.cgi?id=100420
+
+        Reviewed by George Staikos.
+
+        CNN.com is redirecting us infinitely with 302 http code and response body. We catch
+        it my setting our extended error code as we defined. But we were not trying to notify
+        error because we have received body. This was wrong. For extended http status code
+        which is less than 0 we should display our own error page regardless there was data
+        received from the server or not.
+
+        Tested by manually loading CNN.com.
+
+        * platform/network/blackberry/NetworkJob.cpp:
+        (WebCore::NetworkJob::shouldNotifyClientFailed):
+
+2012-10-25  Nico Weber  <thakis@chromium.org>
+
+        Flip ImageOrientation coordinate system from lefthanded to righthanded
+        https://bugs.webkit.org/show_bug.cgi?id=100414
+
+        Reviewed by Eric Seidel.
+
+        platform/graphics, noteably GraphicsContext uses a right-handed
+        coordinate system (origin in the top left corner, x growing to the
+        right, y to the bottom).  ImageOrientation was an outlier from
+        and used a left-handed coordinate system.  This patch makes
+        ImageOrientation match the rest of platform/graphics.
+
+        This is a pure refactoring and has no observable effects.
+
+        * platform/chromium/DragImageChromiumSkia.cpp:
+        (WebCore::createDragImageFromImage):
+        * platform/graphics/ImageOrientation.cpp:
+        (WebCore::ImageOrientation::transformFromDefault):
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+        (WebCore::GraphicsContext::drawNativeImage):
+        * platform/graphics/skia/ImageSkia.cpp:
+        (WebCore::BitmapImage::draw):
+        * platform/mac/DragImageMac.mm:
+        (WebCore::createDragImageFromImage):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::shouldRespectImageOrientation):
+
+2012-10-25  Keishi Hattori  <keishi@webkit.org>
+
+        Hide popup while transitioning from the suggestion picker to the calendar picker
+        https://bugs.webkit.org/show_bug.cgi?id=99537
+
+        Reviewed by Kent Tamura.
+
+        Right now you can see a squished calendar picker while transitioning
+        from suggestion picker from calendar picker. This change will hide the
+        popup before opening the calendar picker.
+
+        No new tests.
+
+        * Resources/pagepopups/pickerCommon.js: Hiding the window will also trigger a resize event so I created a separate event, didOpenPicker.
+        (hideWindow): Resize the window to 1x1 because we can't resize to 0x0.
+        * Resources/pagepopups/suggestionPicker.js:
+        (SuggestionPicker.prototype.selectEntry): Hide the window first and then open the calendar picker.
+
+2012-10-25  Anders Carlsson  <andersca@apple.com>
+
+        Fix build.
+
+        * page/mac/EventHandlerMac.mm:
+        (WebCore::EventHandler::needsKeyboardEventDisambiguationQuirks):
+
+2012-10-25  Anders Carlsson  <andersca@apple.com>
+
+        Remove feed and feeds URL scheme workarounds
+        https://bugs.webkit.org/show_bug.cgi?id=100442
+
+        Reviewed by Dan Bernstein.
+
+        * dom/DocumentEventQueue.cpp:
+        (WebCore::DocumentEventQueue::enqueueOrDispatchScrollEvent):
+        * page/mac/EventHandlerMac.mm:
+        (WebCore::EventHandler::needsKeyboardEventDisambiguationQuirks):
+
+2012-10-25  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r132514.
+        http://trac.webkit.org/changeset/132514
+        https://bugs.webkit.org/show_bug.cgi?id=100440
+
+        "Broke chromium content_browsertests AccessibilityAriaMenu
+        AccessibilityInputRange AccessibilityListMarkers" (Requested
+        by scheib on #webkit).
+
+        * accessibility/AXObjectCache.cpp:
+        (WebCore::AXObjectCache::getOrCreate):
+        (WebCore::AXObjectCache::contentChanged):
+        (WebCore::AXObjectCache::childrenChanged):
+        (WebCore::AXObjectCache::handleAriaRoleChanged):
+        * accessibility/AXObjectCache.h:
+        (AXObjectCache):
+        (WebCore::AXObjectCache::contentChanged):
+        * accessibility/AccessibilityObject.cpp:
+        (WebCore::AccessibilityObject::AccessibilityObject):
+        * accessibility/AccessibilityObject.h:
+        (WebCore::AccessibilityObject::contentChanged):
+        (AccessibilityObject):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::accessibilityIsIgnored):
+        (WebCore::AccessibilityRenderObject::correspondingControlForLabelElement):
+        (WebCore::AccessibilityRenderObject::contentChanged):
+        * accessibility/AccessibilityRenderObject.h:
+        (AccessibilityRenderObject):
+        * accessibility/AccessibilityScrollView.cpp:
+        (WebCore::AccessibilityScrollView::isAttachment):
+        (WebCore::AccessibilityScrollView::widgetForAttachmentView):
+        (WebCore::AccessibilityScrollView::updateScrollbars):
+        (WebCore::AccessibilityScrollView::webAreaObject):
+        (WebCore::AccessibilityScrollView::elementRect):
+        (WebCore::AccessibilityScrollView::documentFrameView):
+        (WebCore::AccessibilityScrollView::parentObject):
+        (WebCore::AccessibilityScrollView::parentObjectIfExists):
+        (WebCore::AccessibilityScrollView::getScrollableAreaIfScrollable):
+        (WebCore::AccessibilityScrollView::scrollTo):
+        * accessibility/AccessibilityScrollView.h:
+        (WebCore::AccessibilityScrollView::scrollView):
+        (AccessibilityScrollView):
+        * accessibility/AccessibilityTable.cpp:
+        (WebCore::AccessibilityTable::isDataTable):
+        * accessibility/chromium/AXObjectCacheChromium.cpp:
+        (WebCore::AXObjectCache::postPlatformNotification):
+        * dom/Element.cpp:
+        (WebCore::Element::attributeChanged):
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::deleteLineBoxTree):
+        (WebCore::RenderBlock::createAndAppendRootInlineBox):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::styleWillChange):
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::setText):
+
+2012-10-25  Dan Bernstein  <mitz@apple.com>
+
+        <rdar://problem/12544626> [cg] RenderBlock::selectionGaps() is extremely slow when there are many floats
+        https://bugs.webkit.org/show_bug.cgi?id=100413
+
+        Reviewed by Anders Carlsson.
+
+        RenderBlock::selectionGaps() calls GraphicsContext::clipOut(const IntRect&) for each float.
+        Sped up the Core Graphics implementation of this function considerably by removing an
+        unnecessary call to CGContextGetClipBoundingBox.
+
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+        (WebCore::GraphicsContext::clipOut): Changed to use CGRectInfinite rather than the bounding
+        box of the current clip.
+
+2012-10-25  Tim Horton  <timothy_horton@apple.com>
+
+        REGRESSION (132422): Tiles don't move when the Find dialog causes programmatic scrolls
+        https://bugs.webkit.org/show_bug.cgi?id=100433
+        <rdar://problem/12575582>
+
+        Reviewed by Simon Fraser.
+
+        Actually update GraphicsLayer positions from updateMainFrameScrollPosition if
+        we're doing a programmatic scroll; otherwise programmatic scrolls while scrolling
+        on the main thread will short-circuit and end up only updating the GraphicsLayer's
+        notion of its current position, but never synchronizing that to the layer itself.
+
+        No new tests, as this is currently untestable.
+
+        * page/scrolling/ScrollingCoordinator.cpp:
+        (WebCore::ScrollingCoordinator::updateMainFrameScrollPosition):
+
+2012-10-25  Simon Fraser  <simon.fraser@apple.com>
+
+        Tiled layers are missing content on zooming
+        https://bugs.webkit.org/show_bug.cgi?id=100422
+
+        Reviewed by Beth Dakin.
+
+        Tiled layers using TileCaches were missing content after
+        zooming. TileCache was confused in the presence of scaling;
+        it unapplies the scale on the layer above the tiles (so the tiles
+        live in screen space), and computed the tile coverage rect
+        in these tile coordinates. This worked for the page tile cache,
+        because its visibleRect was sent in pre-scaled. However, for
+        tiled layer TileCaches this was wrong.
+        
+        Fix by scaling the tile coverage rect by m_scale before
+        using it to compute which tiles to throw away and bring in.
+        
+        To fix the problem of the visibleRect being pre-scaled
+        for the page tile cache, remove the setting of the visibleRect
+        in RenderLayerCompositor::frameViewDidScroll(), and rely on 
+        GraphicsLayerCA::updateVisibleRect() which computes the
+        visible rect in the correct, layer coordinates.
+
+        Test: compositing/tiling/tile-cache-zoomed.html
+
+        * platform/graphics/ca/GraphicsLayerCA.cpp:
+        (WebCore::GraphicsLayerCA::updateVisibleRect): Call setVisibleRect()
+        for all tile cache layers, not just tiled layer ones, but only do
+        the visible rect adjustment for those that are not the page tile cache.
+        * platform/graphics/ca/mac/TileCache.mm:
+        (WebCore::TileCache::revalidateTiles): Use a coverageRectInTileCoords rect,
+        which is scaled to be in the same coordinate space as the tile grid.
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::frameViewDidScroll): Remove the code
+        that sets the setVisibleRect() on the TiledBacking.
+
+2012-10-25  Adam Barth  <abarth@webkit.org>
+
+        [V8] ActiveDOMNodes no longer require a separate wrapper map
+        https://bugs.webkit.org/show_bug.cgi?id=100352
+
+        Reviewed by Eric Seidel.
+
+        There is no longer any reason to keep a separate DOM wrapper map for
+        active DOM nodes. We can simply store them in the normal DOM node
+        wrapper map (which is more efficient because it doesn't use a HashMap).
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+        (GetDomMapName):
+        * bindings/v8/DOMDataStore.cpp:
+        (WebCore::DOMDataStore::DOMDataStore):
+        (WebCore::DOMDataStore::~DOMDataStore):
+        (WebCore::DOMDataStore::reportMemoryUsage):
+        * bindings/v8/DOMDataStore.h:
+        (DOMDataStore):
+        * bindings/v8/IntrusiveDOMWrapperMap.h:
+        * bindings/v8/V8DOMMap.cpp:
+        * bindings/v8/V8DOMMap.h:
+        (WebCore):
+        * bindings/v8/V8DOMWrapper.cpp:
+        * bindings/v8/V8DOMWrapper.h:
+        (V8DOMWrapper):
+        (WebCore::V8DOMWrapper::getCachedWrapper):
+
+2012-10-25  Tony Chang  <tony@chromium.org>
+
+        Unreviewed, fix the build on Mac.
+
+        Putting the getter in the Settings.h caused the global variable to be inlined and needing it to be exported.
+        Instead, put the implementation in the cpp file.
+
+        * page/Settings.cpp:
+        (WebCore::Settings::defaultMinDOMTimerInterval):
+        (WebCore):
+        (WebCore::Settings::defaultDOMTimerAlignmentInterval):
+        * page/Settings.h:
+        (Settings):
+
+2012-10-25  Tony Chang  <tony@chromium.org>
+
+        Move default DOM Timer values into Settings
+        https://bugs.webkit.org/show_bug.cgi?id=100405
+
+        Reviewed by Kenneth Russell.
+
+        Move the global values for defaultMinDOMTimerInterval and defaultDOMTimerAlignmentInterval into
+        the Settings object. This is more consistent with other global settings and allows us to remove
+        the setters on the DOMTimer object.
+
+        No new tests, this is a refactor.
+
+        * page/DOMTimer.cpp: Remove globals.
+        * page/DOMTimer.h:
+        (WebCore::DOMTimer::defaultMinTimerInterval): Call through to Settings
+        (WebCore::DOMTimer::defaultTimerAlignmentInterval): Call through to Settings.
+        (DOMTimer): Remove setters.
+        * page/Settings.cpp:
+        (WebCore::Settings::setDefaultMinDOMTimerInterval): Use a global in Settings.
+        (WebCore::Settings::setDefaultDOMTimerAlignmentInterval): Use a global in Settings.
+        * page/Settings.h:
+        (WebCore::Settings::defaultMinDOMTimerInterval): Inline the getter.
+        (WebCore::Settings::defaultDOMTimerAlignmentInterval): Inline the getter.
+        (Settings): Add globals.
+
+2012-10-25  Simon Fraser  <simon.fraser@apple.com>
+
+        Report the tile coverage rect in layer coords, and add some tests for tiled backing and zooming
+        https://bugs.webkit.org/show_bug.cgi?id=100416
+
+        Reviewed by Beth Dakin.
+
+        The tileCoverageRect is computed in "tile" coordinates, which don't match
+        the visibleRect coordinates. It's more useful when testing to see the
+        tile coverage relative to the view bounds, so unapply the scale whem
+        reporting tile coverage in tests.
+
+        Tests: platform/mac/tiled-drawing/tiled-drawing-zoom-scrolled.html
+               platform/mac/tiled-drawing/tiled-drawing-zoom.html
+
+        * platform/graphics/ca/mac/TileCache.h:
+        * platform/graphics/ca/mac/TileCache.mm:
+        (WebCore::TileCache::tileCoverageRect):
+
+2012-10-25  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r132269.
+        http://trac.webkit.org/changeset/132269
+        https://bugs.webkit.org/show_bug.cgi?id=100412
+
+        "Speculative rollout of r132269 in hopes of fixing a
+        mysterious recalcStyle crasher" (Requested by eseidel on
+        #webkit).
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::updateFirstLetter):
+        * rendering/RenderListBox.h:
+        * rendering/RenderObjectChildList.cpp:
+        (WebCore::RenderObjectChildList::updateBeforeAfterContent):
+
+2012-10-25  Stephen White  <senorblanco@chromium.org>
+
+        Change ReferenceFilterOperations to reference (own) the data passed to
+        them.
+        https://bugs.webkit.org/show_bug.cgi?id=97715
+
+        Reviewed by Nate Chapin.
+
+        Covered by css3/filters/reference-filter-update-after-remove.html
+
+        * css/CachedSVGDocumentReference.h: Added.
+        (CachedSVGDocumentReference):
+        New class which holds a CachedResourceHandle<CachedSVGDocument>, but
+        can be placed in ReferenceFilterOperation's Data.  It also calls
+        addClient() / removeClient(), in order to keep the CachedSVGDocument
+        alive until the FilterEffectRenderer can get it.
+        (WebCore::CachedSVGDocumentReference::CachedSVGDocumentReference):
+        (WebCore::CachedSVGDocumentReference::~CachedSVGDocumentReference):
+        (WebCore::CachedSVGDocumentReference::document):
+        Accessor for the underlying document.
+        * css/StyleResolver.cpp:
+        (WebCore::StyleResolver::loadPendingSVGDocuments):
+        Wrap the CachedSVGDocument handle in a CachedSVGDocumentReference, and
+        transfer ownership to the ReferenceFilterOperation.
+        (WebCore::StyleResolver::createFilterOperations):
+        Same as above.
+        * platform/graphics/filters/FilterOperation.h:
+        (Data):
+        New base class for generic data which can be deleted polymorphically.
+        (WebCore::FilterOperation::ReferenceFilterOperation::data):
+        (WebCore::FilterOperation::ReferenceFilterOperation::setData):
+        Use the above-mentioned Data class, instead of a void *.
+        (WebCore::FilterOperation::ReferenceFilterOperation::ReferenceFilterOperation):
+        Don't initialize data to null; OwnPtr will do that for us.
+        * rendering/FilterEffectRenderer.cpp:
+        (WebCore::FilterEffectRenderer::buildReferenceFilter):
+        Extract the cached SVG document from the reference data.
+        * rendering/RenderLayerFilterInfo.cpp:
+        (WebCore::RenderLayerFilterInfo::updateReferenceFilterClients):
+        Extract the cached SVG document from the reference data.
+
+2012-10-25  Simon Fraser  <simon.fraser@apple.com>
+
+        Incorrect tile size in the slow scrolling case
+        https://bugs.webkit.org/show_bug.cgi?id=100411
+
+        Reviewed by Beth Dakin.
+
+        If we're in slow scrolling mode, we don't want to inflate the
+        coverage rect based on scrollability. This ensures that the few
+        big tiles we create have the correct size.
+
+        * platform/graphics/ca/mac/TileCache.mm:
+        (WebCore::TileCache::computeTileCoverageRect):
+
+2012-10-25  Nico Weber  <thakis@chromium.org>
+
+        Move ImageOrientation transform back in CG space (lower-left origin), adapt the skia code to work with that, turn on feature for chromium
+        https://bugs.webkit.org/show_bug.cgi?id=100401
+
+        Reviewed by Eric Seidel.
+
+        This is an alternative fix for the regression caused by r132384 / bug
+        100179. The bug exists because different pieces of code didn't agree
+        which space the transformation returned by ImageOrientation was in.
+
+        r132384 moved it from CG coordinates to skia coordinates, but didn't
+        do it completetely. This CL reverts this part of r132384 so that the
+        transformation is in CG coordinates again, and adapts the skia code to
+        work in that space.
+
+        Alternatively, https://bugs.webkit.org/show_bug.cgi?id=100319 woudl
+        make the cg code work with the transform in skia coordinates.
+
+        Covered by fast/images/exif-orientation.html
+
+        * platform/chromium/DragImageChromiumSkia.cpp:
+        (WebCore::createDragImageFromImage):
+        * platform/graphics/ImageOrientation.cpp:
+        (WebCore::ImageOrientation::transformFromDefault):
+        * platform/graphics/ImageOrientation.h:
+        (WebCore):
+        (WebCore::ImageOrientation::usesWidthAsHeight):
+        (WebCore::ImageOrientation::fromEXIFValue):
+        (ImageOrientation):
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+        (WebCore::GraphicsContext::drawNativeImage):
+        * platform/graphics/skia/ImageSkia.cpp:
+        (WebCore::BitmapImage::draw):
+        * platform/mac/DragImageMac.mm:
+        (WebCore::createDragImageFromImage):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::shouldRespectImageOrientation):
+
+2012-10-25  Simon Fraser  <simon.fraser@apple.com>
+
+        Log the tile cache tile size in test output
+        https://bugs.webkit.org/show_bug.cgi?id=100409
+
+        Reviewed by Beth Dakin.
+
+        When dumping tile cache information in tests, also dump the tile size.
+
+        * platform/graphics/TiledBacking.h:
+        * platform/graphics/ca/GraphicsLayerCA.cpp:
+        (WebCore::GraphicsLayerCA::dumpAdditionalProperties):
+        * platform/graphics/ca/mac/TileCache.h:
+
+2012-10-25  Arnaud Renevier  <a.renevier@sisa.samsung.com>
+
+        do not multiply/demultiply colors when alpha is 255
+        https://bugs.webkit.org/show_bug.cgi?id=89246
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Do not use colorFromPremultipliedARGB in getImageData nor
+        premultipliedARGBFromColor in putByteArray. Avoiding object creation
+        and function call make canvas.getImageData about 10% faster and
+        canvas.putImageData about 30% faster.
+
+        Also, we avoid multiplication/demultiplication computation when alpha
+        is 255. Result is the same, but when there is no transparency,
+        canvas.getImageData is about 4x faster, and canvas.putImageData is
+        about 2x faster.
+
+        No new tests. No change in behavior.
+
+        * platform/graphics/cairo/ImageBufferCairo.cpp:
+        (WebCore::getImageData):
+        (WebCore::ImageBuffer::putByteArray):
+
+2012-10-25  Nate Chapin  <japhet@chromium.org>
+
+        Add a main resource type to the memory cache
+        https://bugs.webkit.org/show_bug.cgi?id=99864
+
+        Reviewed by Adam Barth.
+
+        No new tests, no functionality change.
+
+        * inspector/InspectorPageAgent.cpp:
+        (WebCore::hasTextContent):
+        (WebCore::InspectorPageAgent::cachedResourceType):
+        * loader/SubresourceLoader.cpp:
+        (WebCore::SubresourceLoader::willSendRequest):
+        (WebCore::SubresourceLoader::didReceiveResponse):
+        (WebCore::SubresourceLoader::didFail):
+        * loader/cache/CachedRawResource.cpp:
+        (WebCore::CachedRawResource::CachedRawResource):
+        (WebCore::CachedRawResource::addAdditionalRequestHeaders):
+        (WebCore):
+        (WebCore::CachedRawResource::setShouldBufferData):
+        (WebCore::CachedRawResource::loader):
+        (WebCore::CachedRawResource::clear):
+        * loader/cache/CachedRawResource.h:
+        (WebCore):
+        (CachedRawResource):
+        * loader/cache/CachedResource.cpp:
+        (WebCore::defaultPriorityForResourceType):
+        (WebCore::cachedResourceTypeToTargetType):
+        (WebCore::CachedResource::updateResourceRequest):
+        (WebCore):
+        * loader/cache/CachedResource.h:
+        (WebCore::CachedResource::setResourceError):
+        (WebCore::CachedResource::resourceError):
+        (CachedResource):
+        (WebCore::CachedResource::ignoreForRequestCount):
+        * loader/cache/CachedResourceLoader.cpp:
+        (WebCore::createResource):
+        (WebCore::CachedResourceLoader::requestRawResource):
+        (WebCore::CachedResourceLoader::checkInsecureContent):
+        (WebCore::CachedResourceLoader::canRequest):
+        (WebCore::CachedResourceLoader::determineRevalidationPolicy):
+        * loader/cache/CachedResourceLoader.h:
+        (CachedResourceLoader):
+        * platform/network/ResourceLoadPriority.h:
+        * platform/network/cf/ResourceRequestCFNet.h:
+        (WebCore::toResourceLoadPriority):
+        (WebCore::toHTTPPipeliningPriority):
+
+2012-10-25  Ojan Vafai  <ojan@chromium.org>
+
+        [V8] Add histograms to measure V8 work done during window close and navigation
+        https://bugs.webkit.org/show_bug.cgi?id=100358
+
+        Reviewed by Adam Barth.
+
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::clearForClose):
+        (WebCore::ScriptController::clearWindowShell):
+
+2012-10-25  Antti Koivisto  <antti@apple.com>
+
+        Avoid unnecessary style recalcs on id attribute mutation.
+        https://bugs.webkit.org/show_bug.cgi?id=100395
+
+        Reviewed by Andreas Kling.
+
+        There is no need to invalidate element style on id attribute change if neither the old nor the new id were 
+        mentioned in any stylesheet. This is similar to the optimization we already have for class attributes.
+        
+        Recalculating element style is expensive. It seems id attribute mutation is often used in scripts for purposes other than styling. 
+
+        * css/StyleResolver.cpp:
+        (WebCore::StyleResolver::hasSelectorForId):
+        (WebCore):
+        * css/StyleResolver.h:
+        * dom/Element.cpp:
+        (WebCore::makeIdForStyleResolution):
+        (WebCore):
+        (WebCore::Element::attributeChanged):
+
+2012-10-25  Dominic Mazzoni  <dmazzoni@google.com>
+
+        AX: Notification should be sent when accessibilityIsIgnored changes
+        https://bugs.webkit.org/show_bug.cgi?id=99547
+
+        Reviewed by Chris Fleizach.
+
+        Adds a new flag in AccessibilityObject that keeps track of the most recent
+        value of accessibilityIsIgnored(). After certain events such as an ARIA
+        attribute change or content change, checks the new value of
+        accessibilityIsIgnored() and posts a "children changed" notification on the
+        parent node if it changed, making sure the parent recomputes its vector of
+        (unignored) children.
+
+        Also moves handling of attribute changes to AXObjectCache, and sends
+        notifications for some attribute changes that were previously silent. On
+        Chromium, all changes to an accessibility object's attributes should
+        result in some notification.
+
+        Some tests would have broken because an AccessibilityScrollView was created
+        and holding a reference to a ScrollView for an iframe after it was deleted,
+        so this change switches AccessibilityScrollView to hold a weak reference
+        to ScrollView instead.
+
+        Tests: platform/chromium/accessibility/is-ignored-change-sends-notification.html
+               platform/chromium/accessibility/other-aria-attribute-change-sends-notification.html
+               platform/chromium/accessibility/text-change-notification.html
+
+        * accessibility/AXObjectCache.cpp:
+        (WebCore::AXObjectCache::focusedUIElementForPage):
+        (WebCore::AXObjectCache::getOrCreate):
+        (WebCore::AXObjectCache::textChanged):
+        (WebCore):
+        (WebCore::AXObjectCache::childrenChanged):
+        (WebCore::AXObjectCache::handleAriaRoleChanged):
+        (WebCore::AXObjectCache::handleAttributeChanged):
+        (WebCore::AXObjectCache::labelChanged):
+        (WebCore::AXObjectCache::recomputeIsIgnored):
+        * accessibility/AXObjectCache.h:
+        (AXObjectCache):
+        (WebCore::AXObjectCache::childrenChanged):
+        (WebCore::AXObjectCache::textChanged):
+        (WebCore::AXObjectCache::handleAttributeChanged):
+        (WebCore::AXObjectCache::recomputeIsIgnored):
+        * accessibility/AccessibilityNodeObject.cpp:
+        (WebCore::AccessibilityNodeObject::insertChild):
+        * accessibility/AccessibilityObject.cpp:
+        (WebCore::AccessibilityObject::AccessibilityObject):
+        (WebCore::AccessibilityObject::cachedIsIgnoredValue):
+        (WebCore):
+        (WebCore::AccessibilityObject::setCachedIsIgnoredValue):
+        (WebCore::AccessibilityObject::notifyIfIgnoredValueChanged):
+        * accessibility/AccessibilityObject.h:
+        (WebCore::AccessibilityObject::textChanged):
+        (AccessibilityObject):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::accessibilityIsIgnored):
+        (WebCore::AccessibilityRenderObject::correspondingControlForLabelElement):
+        (WebCore::AccessibilityRenderObject::textChanged):
+        (WebCore::AccessibilityRenderObject::addHiddenChildren):
+        (WebCore::AccessibilityRenderObject::addChildren):
+        * accessibility/AccessibilityRenderObject.h:
+        (AccessibilityRenderObject):
+        * accessibility/AccessibilityScrollView.cpp:
+        (WebCore::AccessibilityScrollView::~AccessibilityScrollView):
+        (WebCore):
+        (WebCore::AccessibilityScrollView::detach):
+        (WebCore::AccessibilityScrollView::isAttachment):
+        (WebCore::AccessibilityScrollView::widgetForAttachmentView):
+        (WebCore::AccessibilityScrollView::updateScrollbars):
+        (WebCore::AccessibilityScrollView::webAreaObject):
+        (WebCore::AccessibilityScrollView::elementRect):
+        (WebCore::AccessibilityScrollView::documentFrameView):
+        (WebCore::AccessibilityScrollView::parentObject):
+        (WebCore::AccessibilityScrollView::parentObjectIfExists):
+        (WebCore::AccessibilityScrollView::getScrollableAreaIfScrollable):
+        (WebCore::AccessibilityScrollView::scrollTo):
+        * accessibility/AccessibilityScrollView.h:
+        (WebCore::AccessibilityScrollView::scrollView):
+        (AccessibilityScrollView):
+        * accessibility/AccessibilityTable.cpp:
+        (WebCore::AccessibilityTable::isDataTable):
+        * accessibility/chromium/AXObjectCacheChromium.cpp:
+        (WebCore::AXObjectCache::postPlatformNotification):
+        * dom/Element.cpp:
+        (WebCore::Element::attributeChanged):
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::deleteLineBoxTree):
+        (WebCore::RenderBlock::createAndAppendRootInlineBox):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::styleWillChange):
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::setText):
+
+2012-10-25  Dominik Röttsches  <dominik.rottsches@intel.com>
+
+        Conditionalize XHR timeout support
+        https://bugs.webkit.org/show_bug.cgi?id=100356
+
+        Reviewed by Adam Barth.
+
+        Adding feature for XHR_TIMEOUT to disable it on ports that don't have
+        network backend support for setTimeoutInterval.
+
+        No new tests, covered by http/tests/xmlhttprequest/timeout/*
+
+        * Configurations/FeatureDefines.xcconfig: Default ON on mac.
+        * GNUmakefile.am:
+        * GNUmakefile.features.am:
+          Autotools support for the flag.
+        * xml/XMLHttpRequest.cpp: #if ENABLE(XHR_TIMEOUT) wrapping
+        (WebCore::XMLHttpRequest::XMLHttpRequest):
+        (WebCore):
+        (WebCore::XMLHttpRequest::open):
+        (WebCore::XMLHttpRequest::createRequest):
+        (WebCore::XMLHttpRequest::didFail):
+        * xml/XMLHttpRequest.h: #if ENABLE(XHR_TIMEOUT) wrapping
+        (XMLHttpRequest):
+        * xml/XMLHttpRequest.idl: Conditional properties timeout and ontimeout (event handler).
+
+2012-10-25  Tom Sepez  <tsepez@chromium.org>
+
+        XSSAuditor must replace form action with about:blank when reflected action detected.
+        https://bugs.webkit.org/show_bug.cgi?id=100280
+
+        Reviewed by Daniel Bates.
+
+        Changes empty string form-action replacement to about:blank.
+        Existing form-action.html test modified to check this case.
+        
+        * html/parser/XSSAuditor.cpp:
+        (WebCore::XSSAuditor::filterFormToken):
+
+2012-10-25  Kevin Ellis  <kevers@chromium.org>
+
+        Touch adjustment snaps to wrong target at a plugin boundary.
+        https://bugs.webkit.org/show_bug.cgi?id=99938
+
+        Reviewed by Antonio Gomes.
+
+        Inidcate that an <embed> element can respond to
+        mouse click events, since mouse events are forwarded
+        to the plugin.  Fixes touch adjustment at a plugin
+        boundary.  Prior to the patch a clickable element 
+        adjacent to the plugin would capture synthetic mouse
+        events from tap gestures that spanned the plugin
+        boundary.
+
+        Test: touchadjustment/plugin.html
+
+        * html/HTMLEmbedElement.cpp:
+        (WebCore::HTMLEmbedElement::willRespondToMouseClickEvents):
+        (WebCore):
+        * html/HTMLEmbedElement.h:
+
+2012-10-25  Ojan Vafai  <ojan@chromium.org>
+
+        Get rid of ScriptController::clearForNavigation
+        https://bugs.webkit.org/show_bug.cgi?id=100390
+
+        Reviewed by Adam Barth.
+
+        Get rid of clearForNavigation and change resetIsolatedWorlds
+        to reset so that it can also do the hintForCollectGarbage call.
+        No new tests. No behavior change.
+
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::reset):
+        (WebCore::ScriptController::clearForClose):
+        (WebCore::ScriptController::clearWindowShell):
+        * bindings/v8/ScriptController.h:
+        (ScriptController):
+
+2012-10-25  Simon Fraser  <simon.fraser@apple.com>
+
+        r132427 changed the tiling behavior of tiled layer TileCaches as well as the page tile cache
+        https://bugs.webkit.org/show_bug.cgi?id=100323
+
+        Reviewed by Anders Carlsson.
+
+        r132427 assumed that TileCaches were only used for the page, and changed the tile
+        size behavior of all non-page TileCaches.
+        
+        Fix by giving TiledBacking a new 'CoverageForSlowScrolling' flag which
+        affects the tile size behavior.
+        
+        Consolidated the two places that set TileCoverage into one, and in the process
+        reduced FrameView's direct communication with TiledBacking.
+
+        No new tests because we can't test tile size via tests.
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::didMoveOnscreen): Rely on RenderLayerCompositor to
+        call setIsInWindow() on the main page tile cache.
+        (WebCore::FrameView::willMoveOffscreen): Ditto.
+        (WebCore::FrameView::performPostLayoutTasks): Rather than explicitly tell
+        the TiledBacking that it should do stuff, just tell the compositor that
+        layout happened.
+        * platform/graphics/TiledBacking.h: New CoverageForSlowScrolling flag.
+        * platform/graphics/ca/mac/TileCache.mm:
+        (WebCore::TileCache::tileSizeForCoverageRect): Only use one big tile
+        if the CoverageForSlowScrolling flag is set.
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::RenderLayerBacking): layer->isRootLayer()
+        is equivalent to renderer()->isRenderView() and clearer.
+        (WebCore::RenderLayerBacking::tiledBacking): Call adjustTileCacheCoverage().
+        It would be nice to move the rest of this TiledBacking code from here somehow.
+        (WebCore::RenderLayerBacking::adjustTileCacheCoverage): Update the TileCoverage
+        flags, taking into account horizontal and vertical scrollability independently,
+        and whether we're in slow scrolling mode.
+        * rendering/RenderLayerBacking.h:
+        (RenderLayerBacking):
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::frameViewDidLayout): Have the page
+        tiled backing update it's coverage flags.
+        (WebCore::RenderLayerCompositor::pageTiledBacking): Utility function.
+        (WebCore::RenderLayerCompositor::didMoveOnscreen): Moved from FrameView.
+        (WebCore::RenderLayerCompositor::willMoveOffscreen): Ditto.
+        * rendering/RenderLayerCompositor.h:
+        (RenderLayerCompositor):
+
+2012-10-25  Elliott Sprehn  <esprehn@chromium.org>
+
+        Everything that sets RenderObject::m_style should go through setStyleInternal
+        https://bugs.webkit.org/show_bug.cgi?id=100338
+
+        Reviewed by Ojan Vafai.
+
+        Whenever we set m_style in RenderObject go through setStyleInternal and make
+        it inline. This gives a common place to put printfs and makes the code cleaner.
+
+        No new tests, just a refactor.
+
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::createObject):
+        (WebCore::RenderObject::setStyle):
+        * rendering/RenderObject.h:
+        (WebCore::RenderObject::setStyleInternal):
+
+2012-10-25  Brady Eidson  <beidson@apple.com>
+
+        Allow LoaderStrategy to override the ResourceLoadScheduler
+        https://bugs.webkit.org/show_bug.cgi?id=100355
+
+        Reviewed by Anders Carlsson.
+
+        Allow LoaderStrategy to override the implementation of the ResourceLoadScheduler.
+        Add a default implementation that just returns the current ResourceLoadScheduler.
+
+        No new tests (No behavior change).
+
+        Project file stuff:
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * Target.pri:
+        * WebCore.exp.in:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+
+        "Virtualize" ResourceLoadScheduler to expose build issues in preparation for future virtualization:
+        * loader/ResourceLoadScheduler.cpp:
+        (WebCore::ResourceLoadScheduler::~ResourceLoadScheduler):
+        * loader/ResourceLoadScheduler.h:
+        (ResourceLoadScheduler):
+
+        Add the new method plus a default implementation:
+         * loader/LoaderStrategy.cpp: 
+        (WebCore::LoaderStrategy::resourceLoadScheduler):
+        * loader/LoaderStrategy.h:
+
+        When strategies are enabled, use the LoaderStrategy for this:
+        * dom/ContainerNode.cpp:
+        (WebCore::ContainerNode::suspendPostAttachCallbacks):
+        (WebCore::ContainerNode::resumePostAttachCallbacks):
+
+        * loader/MainResourceLoader.cpp:
+        (WebCore::MainResourceLoader::loadNow):
+
+        * loader/ResourceLoader.cpp:
+        (WebCore::ResourceLoader::releaseResources):
+        (WebCore::ResourceLoader::willSendRequest):
+
+        * loader/cache/CachedResource.cpp:
+        (WebCore::CachedResource::load):
+
+        * loader/cache/CachedResourceLoader.cpp:
+        (WebCore::CachedResourceLoader::performPostLoadActions):
+
+2012-10-25  Yury Semikhatsky  <yurys@chromium.org>
+
+        Web Inspector: inspector tests failing after r132454
+        https://bugs.webkit.org/show_bug.cgi?id=100381
+
+        Reviewed by Pavel Feldman.
+
+        Added implementation for DOMNodeWrapperMap::reportMemoryUsage method,
+        otherwise no actual pointer is reported which breaks instrumentation.
+
+        * bindings/v8/IntrusiveDOMWrapperMap.h:
+
+2012-10-25  Dominik Röttsches  <dominik.rottsches@intel.com>
+
+        Init timeout flag in ResourceErrorCF
+        https://bugs.webkit.org/show_bug.cgi?id=100349
+
+        Reviewed by Alexey Proskuryakov.
+
+        Initialize the timeout property to true if the network error was a timeout error.
+        This is a speculative fix for the XHR timeout test cases failing on Apple Win -
+        I can't verify this on a local machine.
+
+        No new tests, covered by
+        LayoutTests/http/tests/xmlhttprequest/timeout/*
+
+        * platform/network/cf/ResourceErrorCF.cpp:
+        (WebCore::ResourceError::ResourceError): Init m_timeout from error code.
+
+2012-10-25  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        'resolution' MQ: Printing should use use high resolution images when available
+        https://bugs.webkit.org/show_bug.cgi?id=100382
+
+        Reviewed by Antti Koivisto.
+
+        Special case print to not use the dpi of the screen, but one of 300.
+
+        Updated the resolution media query test to cover this.
+
+        * css/MediaQueryEvaluator.cpp:
+        (WebCore::resolutionMediaFeatureEval): Update compared decimal points
+        to three, due to 300 / 96 being equal to 3.125.
+
+2012-10-25  Kinuko Yasuda  <kinuko@chromium.org>
+
+        [chromium] External FileSystem should use the root path returned by requestFileSystem
+        https://bugs.webkit.org/show_bug.cgi?id=100372
+
+        Reviewed by Kentaro Hara.
+
+        External FileSystem should use the root path returned by
+        requestFileSystem as other type is doing. Current implementation
+        completely ignore the returned path.
+
+        New tests are to be added in chromium (as the type is only available in chromeos and chrome extensions)
+
+        * Modules/filesystem/chromium/DOMFileSystemChromium.cpp:
+        (WebCore::DOMFileSystemBase::createFileSystemURL):
+
+2012-10-25  Kevin Ellis  <kevers@chromium.org>
+
+        Can't easily position the cursor on an empty line in a textarea with touch if touch adjustment is enabled
+        https://bugs.webkit.org/show_bug.cgi?id=97576
+
+        Reviewed by Antonio Gomes.
+
+        Consolidate touch adjustment candidates that are
+        editable.  Adjustment becomes coarse being based
+        on the bounds of the outermost editable element.
+        This fix allows tap positioning of the text caret
+        on a blank line immediately above or below another
+        element.
+
+        Test: touchadjustment/editable-content.html
+
+        * page/TouchAdjustment.cpp:
+        (WebCore::TouchAdjustment::compileSubtargetList):
+        (WebCore::TouchAdjustment::hybridDistanceFunction):
+
+2012-10-25  Yury Semikhatsky  <yurys@chromium.org>
+
+        Memory instrumentation: add reportMemoryUsage to ImageObserver interface
+        https://bugs.webkit.org/show_bug.cgi?id=100091
+
+        Reviewed by Pavel Feldman.
+
+        Added reportMemoryUsage method to ImageObserver to make sure it is reported as
+        appropriate descendant(with pointer adjusted due to offsets added by inheritance)
+        rather than as a standalone memory block.
+
+        * platform/graphics/ImageObserver.h:
+        (ImageObserver):
+
+2012-10-25  Alexander Pavlov  <apavlov@chromium.org>
+
+        Web Inspector: [Overrides] Add latitude and longitude labels for the geolocation fields
+        https://bugs.webkit.org/show_bug.cgi?id=100375
+
+        Reviewed by Yury Semikhatsky.
+
+        No new tests, a UI change.
+
+        * English.lproj/localizedStrings.js:
+        * inspector/front-end/SettingsScreen.js:
+        (WebInspector.UserAgentSettingsTab.prototype._createGeolocationOverrideElement):
+
+2012-10-25  Mikhail Pozdnyakov  <mikhail.pozdnyakov@intel.com>
+
+        Add setMediaTypeOverride to window.internals.settings
+        https://bugs.webkit.org/show_bug.cgi?id=100249
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Added setMediaTypeOverride to window.internals.settings.
+
+        Test: fast/media/print-restores-previous-mediatype.html
+
+        * WebCore.exp.in: Exported WebCore::Settings::setMediaTypeOverride(WTF::String const&) for MAC.
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+        (WebCore::Settings::setMediaTypeOverride):
+        (WebCore):
+        * page/Settings.h:
+        (Settings):
+        (WebCore::Settings::mediaTypeOverride):
+        * testing/InternalSettings.cpp:
+        (WebCore::InternalSettings::Backup::Backup):
+        (WebCore::InternalSettings::Backup::restoreTo):
+        (WebCore::InternalSettings::setMediaTypeOverride):
+        (WebCore):
+        * testing/InternalSettings.h:
+        (Backup):
+        (InternalSettings):
+        * testing/InternalSettings.idl:
+
+2012-10-22  Mikhail Naganov  <mnaganov@chromium.org>
+
+        [Chromium] Add supportMultipleWindows setting, needed for Android
+        https://bugs.webkit.org/show_bug.cgi?id=99716
+
+        Reviewed by Adam Barth.
+
+        Add supportMultipleWindows settings for reusing the same view when
+        opening popups. This is required for emulating the behavior of
+        Android WebView. Adding into WebCore, as other ports might want to
+        use this setting in the future.
+
+        Tests: fast/dom/HTMLAnchorElement/anchor-no-multiple-windows.html
+               fast/dom/Window/window-open-no-multiple-windows.html
+               fast/forms/post-popup-no-multiple-windows.html
+
+        * loader/FrameLoader.cpp:
+        (WebCore::createWindow):
+        * page/ContextMenuController.cpp:
+        (WebCore::openNewWindow):
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+        (WebCore::Settings::setSupportsMultipleWindows):
+        (WebCore):
+        * page/Settings.h:
+        (Settings):
+        (WebCore::Settings::supportsMultipleWindows):
+
+2012-10-25  Alexander Pavlov  <apavlov@chromium.org>
+
+        Unreviewed, fix Web Inspector frontend compilability
+
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeOutline.prototype._ondragstart):
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylePropertiesSection.prototype._handleEmptySpaceClick):
+        (WebInspector.StylePropertyTreeElement.prototype):
+
+2012-10-23  Alexander Pavlov  <apavlov@chromium.org>
+
+        Web Inspector: Drag and drop property value from Inspector is not working as expected
+        https://bugs.webkit.org/show_bug.cgi?id=100040
+
+        Reviewed by Vsevolod Vlasov.
+
+        Do not start a custom drag for a tree element if there is a non-collapsed selection in the Inspector.
+
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeOutline.prototype._ondragstart):
+
+2012-10-25  Ilya Tikhonovsky  <loislo@chromium.org>
+
+        Web Inspector: NMI instrument InspectorDebuggerAgent. It uses a lot of memory on heavy js sites because it keeps all the scripts in a map.
+        https://bugs.webkit.org/show_bug.cgi?id=100340
+
+        Reviewed by Yury Semikhatsky.
+
+        * dom/WebCoreMemoryInstrumentation.cpp:
+        (WebCore):
+        * dom/WebCoreMemoryInstrumentation.h:
+        (WebCoreMemoryTypes):
+        * inspector/InspectorDebuggerAgent.cpp:
+        (WebCore::InspectorDebuggerAgent::reportMemoryUsage):
+        (WebCore):
+        (WebCore::ScriptDebugListener::Script::reportMemoryUsage):
+        * inspector/InspectorDebuggerAgent.h:
+        (InspectorDebuggerAgent):
+        * inspector/ScriptDebugListener.h:
+        (Script):
+
+2012-10-25  Adam Barth  <abarth@webkit.org>
+
+        [V8] We can handle ActiveDOMNodes and DOMNodes in the same GC visitor
+        https://bugs.webkit.org/show_bug.cgi?id=100351
+
+        Reviewed by Eric Seidel.
+
+        There is no reason to handle active DOM nodes in a separate pass from
+        regular DOM nodes anymore.
+
+        * bindings/v8/V8DOMMap.cpp:
+        * bindings/v8/V8DOMMap.h:
+        (WebCore):
+        * bindings/v8/V8GCController.cpp:
+        (WebCore::ActiveDOMObjectPrologueVisitor::visitDOMWrapper):
+        (WebCore::NodeVisitor::NodeVisitor):
+        (NodeVisitor):
+        (WebCore::NodeVisitor::visitNodeWrapper):
+        (WebCore::V8GCController::majorGCPrologue):
+
+2012-10-25  Alexander Pavlov  <apavlov@chromium.org>
+
+        Web Inspector: Improper out-of-order call on a rule that is being removed from the stylesheet.
+        https://bugs.webkit.org/show_bug.cgi?id=100357
+
+        Reviewed by Vsevolod Vlasov.
+
+        * inspector/InspectorStyleSheet.cpp:
+        (WebCore::InspectorStyleSheet::deleteRule):
+
+2012-10-25  Adam Barth  <abarth@webkit.org>
+
+        [V8] DOMDataStoreHandle serves no purpose and can be removed
+        https://bugs.webkit.org/show_bug.cgi?id=100333
+
+        Reviewed by Eric Seidel.
+
+        After https://bugs.webkit.org/show_bug.cgi?id=100316,
+        DOMDataStoreHandle is just a glorified OwnPtr.
+
+        * bindings/v8/DOMWrapperWorld.h:
+        (WebCore::DOMWrapperWorld::domDataStore):
+        (DOMWrapperWorld):
+        (WebCore::DOMWrapperWorld::DOMWrapperWorld):
+        * bindings/v8/V8DOMMap.cpp:
+        * bindings/v8/V8DOMMap.h:
+
+2012-10-25  Elliott Sprehn  <esprehn@chromium.org>
+
+        Remove dead Node::isBlockFlowOrBlockTable
+        https://bugs.webkit.org/show_bug.cgi?id=100336
+
+        Reviewed by Eric Seidel.
+
+        Nothing uses Node::isBlockFlowOrBlockTable anymore so remove it.
+
+        No new tests needed, just removing dead code.
+
+        * dom/Node.cpp:
+        * dom/Node.h:
+        (Node):
+
+2012-10-25  Eugene Klyuchnikov  <eustas.bug@gmail.com>
+
+        Web Inspector: Fix "check-inspector-strings" script and fix localized strings.
+        https://bugs.webkit.org/show_bug.cgi?id=100090
+
+        Reviewed by Vsevolod Vlasov.
+
+        Fixed localized strings table.
+
+        * English.lproj/localizedStrings.js: Added missing, removed orhans.
+        * inspector/front-end/CSSNamedFlowView.js: Removed tailing whitespaces.
+        * inspector/front-end/NativeMemorySnapshotView.js:
+        Removed double localization.
+
+2012-10-25  Adam Barth  <abarth@webkit.org>
+
+        [V8] We can merge DOMDataStore, ScopedDOMDataStore, and StaticDOMDataStore into one class
+        https://bugs.webkit.org/show_bug.cgi?id=100316
+
+        Reviewed by Eric Seidel.
+
+        Prior to this patch, DOMDataStore had two subclasses,
+        ScopedDOMDataStore and StaticDOMDataStore, which used slighly different
+        wrapper map base classes and had different lifetimes. This patch
+        unifies all these classes into DOMDataStore itself. This makes this
+        code much more straightforward.
+
+        * WebCore.gypi:
+        * bindings/v8/DOMDataStore.cpp:
+        (WebCore::DOMDataStore::DOMDataStore):
+        (WebCore::DOMDataStore::~DOMDataStore):
+        (WebCore::DOMDataStore::current):
+        (WebCore::DOMDataStore::reportMemoryUsage):
+        * bindings/v8/DOMDataStore.h:
+        (DOMDataStore):
+        (WebCore::DOMDataStore::domNodeMap):
+        (WebCore::DOMDataStore::activeDomNodeMap):
+        (WebCore::DOMDataStore::domObjectMap):
+        (WebCore::DOMDataStore::activeDomObjectMap):
+        * bindings/v8/ScopedDOMDataStore.cpp: Removed.
+        * bindings/v8/ScopedDOMDataStore.h: Removed.
+        * bindings/v8/SerializedScriptValue.cpp:
+        (WebCore::neuterBinding):
+        * bindings/v8/StaticDOMDataStore.cpp: Removed.
+        * bindings/v8/StaticDOMDataStore.h: Removed.
+        * bindings/v8/V8DOMMap.cpp:
+        (WebCore::DOMDataStoreHandle::DOMDataStoreHandle):
+        (WebCore::DOMDataStoreHandle::~DOMDataStoreHandle):
+        (WebCore::visitActiveDOMNodes):
+        (WebCore::visitDOMObjects):
+        (WebCore::visitActiveDOMObjects):
+        * bindings/v8/V8DOMMap.h:
+        (WebCore):
+        * bindings/v8/V8PerIsolateData.h:
+        (V8PerIsolateData):
+        * bindings/v8/WorkerScriptController.cpp:
+        (WebCore::WorkerScriptController::WorkerScriptController):
+        (WebCore::WorkerScriptController::~WorkerScriptController):
+        * bindings/v8/WorkerScriptController.h:
+        (WorkerScriptController):
+
+2012-10-24  Kent Tamura  <tkent@chromium.org>
+
+        Minimize CSS rulesets for multiple-fields input
+        https://bugs.webkit.org/show_bug.cgi?id=100198
+
+        Reviewed by Kentaro Hara.
+
+        - Unify rulesets for input::-webkit-datetime-edit-*-field.
+         input::-webkit-datetime-edit-*-field had identical ruleset.
+
+        - Move some rulesets near to related rulesets.
+         Move -webkit-datetime-edit-*-field:focus nearby the new unified ruleset.
+         Move input::-webkit-datetime-edit-second-field[readonly] nearby
+        input::-webkit-datetime-edit-minute-field[readonly].
+
+        No new tests. This shouldn't make any behavior change.
+
+        * css/html.css:
+        (input::-webkit-datetime-edit-year-field):
+        (input::-webkit-datetime-edit-year-field:focus):
+        (input::-webkit-datetime-edit-second-field[readonly]):
+
+2012-10-24  Kent Tamura  <tkent@chromium.org>
+
+        REGRESSION(r132291): Crash in BaseMultipleFieldsDateAndTimeInputType
+        https://bugs.webkit.org/show_bug.cgi?id=100326
+
+        Reviewed by Eric Seidel.
+
+        Test: fast/forms/time-multiple-fields/time-multiple-fields-change-type.html
+
+        * html/BaseMultipleFieldsDateAndTimeInputType.cpp:
+        (WebCore::BaseMultipleFieldsDateAndTimeInputType::destroyShadowSubtree):
+        We need to disconnect m_spinButtonElement before destructing the UA shadow tree.
+
+2012-10-24  Adam Barth  <abarth@webkit.org>
+
+        [V8] DOMData is no longer needed
+        https://bugs.webkit.org/show_bug.cgi?id=100313
+
+        Reviewed by Eric Seidel.
+
+        This class serves no purpose anymore and can be deleted.
+
+        * WebCore.gypi:
+        * bindings/v8/DOMData.cpp: Removed.
+        * bindings/v8/DOMData.h: Removed.
+        * bindings/v8/DOMDataStore.cpp:
+        (WebCore::DOMDataStore::current):
+        * bindings/v8/DOMDataStore.h:
+        (WebCore):
+        (DOMDataStore):
+        * bindings/v8/SerializedScriptValue.cpp:
+        (WebCore::neuterBinding):
+        * bindings/v8/V8DOMMap.cpp:
+        (WebCore::getDOMNodeMap):
+        (WebCore::getActiveDOMNodeMap):
+        (WebCore::getDOMObjectMap):
+        (WebCore::getActiveDOMObjectMap):
+        (WebCore::removeAllDOMObjects):
+        (WebCore::visitActiveDOMNodes):
+        (WebCore::visitDOMObjects):
+        (WebCore::visitActiveDOMObjects):
+
+2012-10-24  Kent Tamura  <tkent@chromium.org>
+
+        Sort an Xcode project file.
+
+        * WebCore.xcodeproj/project.pbxproj: Sorted.
+
+2012-10-24  Adam Barth  <abarth@webkit.org>
+
+        [V8] AbstractWeakReferenceMap is unnecessarily general and complex
+        https://bugs.webkit.org/show_bug.cgi?id=100175
+
+        Reviewed by Eric Seidel.
+
+        Before this patch, AbstractWeakReferenceMap served two masters:
+
+        1) DOM wrappers
+        2) NPV8 function templates
+
+        These two uses cases pushed AbstractWeakReferenceMap to be more general
+        and complex that needed. This patch separates these two uses cases into
+        two separate classes. V8NPTemplateMap is all of 40 lines of code. It's
+        not worth complicating the DOM wrapper code path to share that tiny
+        amount of code.
+
+        The other thing this patch does is store a pointer to the DOM wrapper
+        map as the weak callback context object. That means we no longer need
+        to search through all the wrapper maps in order to find the map that
+        contains this particular DOM wrapper.
+
+        * WebCore.gypi:
+        * bindings/v8/DOMData.cpp:
+        * bindings/v8/DOMData.h:
+        (DOMData):
+        * bindings/v8/DOMDataStore.cpp:
+            - Delete all these complicated weak callback functions. The weak
+              callback functions are now an order of magnitude simpler and
+              declared as private member functions on the wrapper map.
+        * bindings/v8/DOMDataStore.h:
+        (WebCore::DOMDataStore::domNodeMap):
+        (WebCore::DOMDataStore::activeDomNodeMap):
+        (DOMDataStore):
+            - We now have a consistent type to use for all these wrapper maps.
+              Both the hash map and the intrusive map derive from
+              DOMWrapperMap (with a single template parameter).
+        * bindings/v8/DOMWrapperMap.h: Added.
+        (WebCore):
+        (DOMWrapperVisitor):
+            - The visitor is no longer an inner class. It's just a top-level
+              class that does the same thing.
+        (DOMWrapperMap):
+            - The abstract interface for DOMWrapperMap has about half as many
+              functions as the old AbstractWeakReferenceMap because the two use
+              cases are disentangled.
+        (WebCore::DOMWrapperMap::~DOMWrapperMap):
+        (DOMWrapperHashMap):
+            - This is a concrete instance of DOMWrapperMap that uses a hash map.
+        (WebCore::DOMWrapperHashMap::DOMWrapperHashMap):
+        (WebCore::DOMWrapperHashMap::remove):
+        (WebCore::DOMWrapperHashMap::defaultWeakCallback):
+            - Notice that the context parameter now points to the hashmap
+              itself rather than to the native object. Now that we don't need
+              to handle the NPAPI case, we can recover the native object from
+              the wrapper using toNative. The assert in set() ensures that this
+              always works.
+        * bindings/v8/DOMWrapperWorld.h:
+        * bindings/v8/IntrusiveDOMWrapperMap.h:
+            - These classes are now simplified because they need to implement
+              fewer functions.
+        (WebCore::DOMNodeWrapperMap::weakCallback):
+            - For this weak callback, we still use the native object as the
+              context parameter. We could also recover the native object from
+              the wrapper, which means this context parameter is available to
+              do other work.
+        * bindings/v8/ScopedDOMDataStore.cpp:
+        (WebCore::ScopedDOMDataStore::ScopedDOMDataStore):
+            - This code no longer needs to have knowledge of which weak
+              callbacks these objects use.
+        (WebCore::ScopedDOMDataStore::~ScopedDOMDataStore):
+            - We need to clear the maps before deleting them because there are
+              still JavaScript objects that have references to the map in their
+              weak callback parameter. Previously, we handled this case because
+              we would search all the wrapper maps and fail to find the wrapper.
+        * bindings/v8/ScriptProfiler.cpp:
+        (WebCore::ScriptProfiler::visitExternalArrays):
+        * bindings/v8/StaticDOMDataStore.cpp:
+            - This code no longer needs to have knowledge of which weak
+              callback these maps use.
+        * bindings/v8/StaticDOMDataStore.h:
+        (StaticDOMDataStore):
+        * bindings/v8/V8DOMMap.cpp:
+        (WebCore::getDOMNodeMap):
+        (WebCore::getActiveDOMNodeMap):
+        (WebCore::removeAllDOMObjects):
+            - Rather than using some complicated visitor pattern, we can now
+              just call clear() directly on the maps to remove all the objects.
+        (WebCore::visitActiveDOMNodes):
+        (WebCore::visitDOMObjects):
+        (WebCore::visitActiveDOMObjects):
+        * bindings/v8/V8DOMMap.h:
+        (WebCore):
+            - Delete the old versions of these classes.
+        (DOMDataStoreHandle):
+            - Style nit: one-argument constructors should be marked explicit.
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::domWrapperType):
+            - I moved this logic into WrapperTypeInfo.h to avoid a circular
+              header dependency.
+        * bindings/v8/V8DOMWrapper.h:
+        (WebCore::V8DOMWrapper::getCachedWrapper):
+        * bindings/v8/V8GCController.cpp:
+            - EnsureWeakDOMNodeVisitor is no longer used (or needed since we no
+              longer clear the weak callbacks in V8GCController).
+        * bindings/v8/V8NPObject.cpp:
+        (V8NPTemplateMap):
+            - staticTemplateMap is no longer an instance of WeakReferenceMap.
+              Instead, this patch just implements the functionality we need
+              here directly.
+        (WebCore::V8NPTemplateMap::get):
+        (WebCore::V8NPTemplateMap::set):
+        (WebCore::V8NPTemplateMap::sharedInstance):
+        (WebCore::V8NPTemplateMap::weakCallback):
+        (WebCore::V8NPTemplateMap::dispose):
+        (WebCore::npObjectGetProperty):
+        (WebCore):
+        (WebCore::staticNPObjectMap):
+        (WebCore::weakNPObjectCallback):
+            - DOMWrapperMap no longer exposes a "forget" function. Instead, we
+              just use the more basic "remove" and "Dispose" operations to do
+              the same thing. This is possible now because we no longer have
+              "removeIfPossible" to support searching all the wrapper maps for
+              the one that has the right wrapper.
+        (WebCore::createV8ObjectForNPObject):
+            - DOMWrapperMap No longer has a "contains" function. Instead, we
+              use get, which actually makes this code more efficient because we
+              only do one hash map lookup.
+        (WebCore::forgetV8ObjectForNPObject):
+            - The changes here are a combination of the two sorts of changes
+              above.
+        * bindings/v8/WrapperTypeInfo.h:
+        (WebCore::toNative):
+        (WebCore::toWrapperTypeInfo):
+            - The patch moves these functions into this header to avoid a
+              circular header dependency.
+
+2012-10-24  Arnaud Renevier  <a.renevier@sisa.samsung.com>
+
+        [cairo] unneeded FloatRect object creation in BitmapImage::draw
+        https://bugs.webkit.org/show_bug.cgi?id=100298
+
+        Reviewed by Martin Robinson.
+
+        Do not copy FloatRect arguments src and dst to local variables.
+        Instead, use src and dst directly.
+
+        No new tests. No change in behavior.
+
+        * platform/graphics/cairo/BitmapImageCairo.cpp:
+        (WebCore::BitmapImage::draw):
+
+2012-10-24  Seokju Kwon  <seokju.kwon@samsung.com>
+
+        [SOUP] Provide logging for SocketStreamHandleSoup
+        https://bugs.webkit.org/show_bug.cgi?id=100215
+
+        Reviewed by Alexey Proskuryakov.
+
+        Add logging to SocketStreamHandleSoup to facilitate debugging.
+
+        * platform/network/soup/SocketStreamHandleSoup.cpp:
+        (WebCore::SocketStreamHandle::SocketStreamHandle):
+        (WebCore::SocketStreamHandle::~SocketStreamHandle):
+        (WebCore::SocketStreamHandle::platformSend):
+        (WebCore::SocketStreamHandle::platformClose):
+
+2012-10-24  Nico Weber  <thakis@chromium.org>
+
+        Pass on exif orientation from ImageSource when using the open-source image decoders
+        https://bugs.webkit.org/show_bug.cgi?id=100164
+
+        Reviewed by Eric Seidel.
+
+        The orientation is honored always for image documents, and optionally
+        for <img> elements if shouldRespectImageOrientation is set (off by
+        default). However, the feature needs port-specific modifications to
+        GraphicsContext (without this, webcore will use the rotated bounds but
+        draw the image as if it hadn't be rotated, resulting in squished
+        pixels), and most ports don't implement these yet -- so put
+        turning this on for image documents behind a port-specific #ifdef.
+
+        No observable behavior change. Once it's hooked up, it will be tested
+        by fast/images/exif-orientation.html.
+
+        * platform/graphics/ImageSource.cpp:
+        (WebCore::ImageSource::size):
+        (WebCore::ImageSource::frameSizeAtIndex):
+        (WebCore::ImageSource::orientationAtIndex):
+        * platform/graphics/chromium/DeferredImageDecoder.cpp:
+        (WebCore::DeferredImageDecoder::orientation):
+        (WebCore):
+        * platform/graphics/chromium/DeferredImageDecoder.h:
+        (DeferredImageDecoder):
+        * platform/image-decoders/jpeg/JPEGImageDecoder.cpp:
+        (WebCore::readImageOrientation):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::shouldRespectImageOrientation):
+
+2012-10-24  Beth Dakin  <bdakin@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=100169
+        We should make TileCache tiles the size of the tile coverage rect 
+        when we can't do fast scrolling
+        -and-
+        <rdar://problem/12505021>
+
+        Reviewed by Simon Fraser.
+
+        Some websites that don't do fast scrolling still scroll slower than 
+        they do with tiled drawing disabled. 
+        https://bugs.webkit.org/show_bug.cgi?id=99768 addressed some of this 
+        performance problem, but there is still more ground to make up. This 
+        patch addresses the remaining issue by making tiles the size of the 
+        window when we can't do fast scrolling. 
+
+        The constructor and create function no longer take a size parameter. 
+        That's all fully controlled within TileCache now. m_tileSize is no 
+        longer const.
+        * platform/graphics/ca/mac/TileCache.h:
+
+        Store the current default size as constants so that we can access it 
+        in both the constructor and adjustTileSizeForCoverageRect().
+        * platform/graphics/ca/mac/TileCache.mm:
+        (WebCore::TileCache::TileCache):
+
+        This new function will set m_tileSize to the size of the tile 
+        coverage rect if the tile coverage is limited to the visible area. 
+        Otherwise, the tiles are set to be the default size.
+        (WebCore::TileCache::adjustTileSizeForCoverageRect):
+        
+        Call adjustTileSizeForCoverageRect().
+        (WebCore::TileCache::revalidateTiles):
+
+        No need to send in a size anymore.
+        * platform/graphics/ca/mac/WebTileCacheLayer.h:
+        (WebCore):
+
+2012-10-24  David Barton  <dbarton@mathscribe.com>
+
+        MathML tests trigger font cache assertions in debug bots
+        https://bugs.webkit.org/show_bug.cgi?id=100268
+
+        Reviewed by Eric Seidel.
+
+        Add a FontCachePurgePreventer to fix this.
+
+        Tested by existing tests.
+
+        * rendering/mathml/RenderMathMLOperator.cpp:
+        (WebCore::RenderMathMLOperator::updateFromElement):
+
+2012-10-24  Tim Horton  <timothy_horton@apple.com>
+
+        Update main frame scroll position immediately for programmatic scrolls
+        https://bugs.webkit.org/show_bug.cgi?id=98074
+
+        Reviewed by Simon Fraser.
+
+        Immediately update the main frame scroll position after a programmatic scroll,
+        so that performing a scrollBy or scrollTo will be instantly reflected in
+        all of the scroll offset accessors.
+
+        No new tests; this will be tested by many scrolling tests once WebKitTestRunner
+        can use threaded scrolling.
+
+        * page/scrolling/ScrollingCoordinator.cpp:
+        (WebCore::ScrollingCoordinator::requestScrollPositionUpdate):
+
+2012-10-24  Mihai Parparita  <mihaip@chromium.org>
+
+        [Chromium] Allow pushState and related history APIs to be disabled per context
+        https://bugs.webkit.org/show_bug.cgi?id=99780
+
+        Reviewed by Adam Barth.
+
+        Chrome Apps do not support the history API (or navigation in general).
+        Since pushState is generally feature detected, it's cleanest to disable
+        it via a V8 per-context feature, so that applications can have the
+        appropriate fallback behavior (other history APIs are re-mapped to throw
+        exceptions, since history.back() and the link are not feature detected).
+
+        * dom/ContextFeatures.cpp:
+        (WebCore::ContextFeatures::pushStateEnabled):
+        (WebCore):
+        * dom/ContextFeatures.h:
+        * dom/Document.cpp:
+        (WebCore::Document::enqueuePopstateEvent):
+        * page/History.idl:
+
+2012-10-24  Tommy Widenflycht  <tommyw@google.com>
+
+        MediaStream API: Make sure all events are dispatched asynchronously
+        https://bugs.webkit.org/show_bug.cgi?id=100286
+
+        Reviewed by Adam Barth.
+
+        This is necessary to safeguard against if the UA uses synchronous UA->WebKit calls,
+        and the web application calls methods on the RTCPeerConnection in the event callbacks.
+
+        Test: fast/mediastream/RTCPeerConnection-events.html
+        Also tested by the chromium webrtc fuzz tests.
+
+        * Modules/mediastream/RTCPeerConnection.cpp:
+        (WebCore::RTCPeerConnection::RTCPeerConnection):
+        (WebCore::RTCPeerConnection::negotiationNeeded):
+        (WebCore::RTCPeerConnection::didGenerateIceCandidate):
+        (WebCore::RTCPeerConnection::didAddRemoteStream):
+        (WebCore::RTCPeerConnection::didRemoveRemoteStream):
+        (WebCore::RTCPeerConnection::didAddRemoteDataChannel):
+        (WebCore::RTCPeerConnection::changeReadyState):
+        (WebCore::RTCPeerConnection::changeIceState):
+        (WebCore):
+        (WebCore::RTCPeerConnection::scheduleDispatchEvent):
+        (WebCore::RTCPeerConnection::scheduledEventTimerFired):
+        * Modules/mediastream/RTCPeerConnection.h:
+        (RTCPeerConnection):
+
+2012-10-24  Mark Pilgrim  <pilgrim@chromium.org>
+
+        [Chromium] Remove screen-related functions from PlatformSupport
+        https://bugs.webkit.org/show_bug.cgi?id=97474
+
+        Reviewed by Adam Barth.
+
+        Screen-related functions like screenHorizontalDPI that
+        used to be on PlatformSupport are now accessed through a new
+        PlatformPageClient attached to Widget in WebCore-land, which is
+        implemented by ChromeClientImpl in WebKit-land, which proxies
+        calls to WebWidgetClient, which is actually implemented in
+        Chromium-land.
+
+        * WebCore.gypi:
+        * platform/Widget.h:
+        * platform/chromium/PageClientChromium.h: Copied from Source/WebCore/platform/chromium/PlatformWidget.h.
+        (PageClientChromium):
+        * platform/chromium/PlatformScreenChromium.cpp:
+        (WebCore::toPlatformPageClient):
+        (WebCore):
+        (WebCore::screenHorizontalDPI):
+        (WebCore::screenVerticalDPI):
+        (WebCore::screenDepth):
+        (WebCore::screenDepthPerComponent):
+        (WebCore::screenIsMonochrome):
+        (WebCore::screenRect):
+        (WebCore::screenAvailableRect):
+        * platform/chromium/PlatformSupport.h:
+        (PlatformSupport):
+
+2012-10-24  Adam Barth  <abarth@webkit.org>
+
+        [V8] WorkerContextExecutionProxy doesn't need to track events
+        https://bugs.webkit.org/show_bug.cgi?id=100295
+
+        Reviewed by Eric Seidel.
+
+        This code was added when this code was originally upstreamed as part of
+        the Chromium port. There doesn't appear to be any reason why
+        WorkerContextExecutionProxy needs to keep a Vector of raw event
+        pointers. Those points are likely to become dangling, making the rest
+        of what this code does very sketchy.
+
+        * bindings/v8/V8WorkerContextEventListener.cpp:
+        (WebCore::V8WorkerContextEventListener::callListenerFunction):
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        (WebCore::WorkerContextExecutionProxy::dispose):
+        * bindings/v8/WorkerContextExecutionProxy.h:
+        (WebCore::WorkerContextExecutionState::WorkerContextExecutionState):
+        (WorkerContextExecutionProxy):
+
+2012-10-24  Max Vujovic  <mvujovic@adobe.com>
+
+        [CSS Shaders] The mesh should be specified using <column, row> order
+        https://bugs.webkit.org/show_bug.cgi?id=96285
+
+        Reviewed by Dean Jackson.
+
+        Change StyleResolver and CSSComputedStyleDeclaration to handle the mesh parameters in
+        column, row order.
+
+        Test: css3/filters/custom/custom-filter-mesh-column-row-order.html
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::CSSComputedStyleDeclaration::valueForFilter):
+            Append the number of columns before the number of rows in the meshParameters
+            CSSValueList.
+        * css/StyleResolver.cpp:
+        (WebCore::StyleResolver::createCustomFilterOperation):
+            Store the second mesh parameter in meshRows instead of meshColumns.
+
+2012-10-24  Jae Hyun Park  <jae.park@company100.net>
+
+        loaderRunLoop() should use synchronization instead of while loop
+        https://bugs.webkit.org/show_bug.cgi?id=55402
+
+        Reviewed by Alexey Proskuryakov.
+
+        Originally, loaderRunLoop() sleeps until a thread has started and set
+        the loaderRunLoopObject static variable. This patch uses
+        ThreadCondition to synchronize instead of a while loop.
+
+        No new tests (No behavior change).
+
+        * platform/network/cf/LoaderRunLoopCF.cpp:
+        (WebCore::runLoaderThread):
+        (WebCore::loaderRunLoop):
+        * platform/network/cf/LoaderRunLoopCF.h:
+        (WebCore):
+
+2012-10-24  Sailesh Agrawal  <sail@chromium.org>
+
+        Incorrect keycodes for numpad /, -, +, .
+        https://bugs.webkit.org/show_bug.cgi?id=99188
+
+        Reviewed by Tony Chang.
+
+        In r57951 we switched to mapping keys by character code.
+        This regressed the numpad keys which no longer match the Windows virtual key codes.
+        This CL fixes this by never mapping numpad keys by character code.
+
+        Test: platform/mac/fast/events/numpad-keycode-mapping.html
+
+        * platform/mac/PlatformEventFactoryMac.mm:
+        (WebCore::windowsKeyCodeForKeyEvent):
+
+2012-10-24  Simon Fraser  <simon.fraser@apple.com>
+
+        Null-check the RenderView in ocument::windowScreenDidChange to fix a crash when saving PDFs
+        https://bugs.webkit.org/show_bug.cgi?id=100141
+        <rdar://problem/12559147>
+
+        Reviewed by Tim Horton.
+
+        For PDF documents the RenderView is null, so null-check it to avoid a crash
+        when saving PDFs.
+
+        * dom/Document.cpp:
+        (WebCore::Document::windowScreenDidChange):
+
+2012-10-24  Terry Anderson  <tdanderson@chromium.org>
+
+        Handle two-finger tap gestures in the same way as long-press gestures
+        https://bugs.webkit.org/show_bug.cgi?id=99947
+
+        Reviewed by Adam Barth.
+
+        Currently a long-press gesture is used to dispatch a context menu (for platforms 
+        defining CONTEXT_MENUS) or to select text (for Android). Additionally, for platforms 
+        defining TOUCH_ADJUSTMENT, gesture target fuzzing is performed on the location and 
+        touch area of the long-press gesture.
+
+        This CL will cause two-finger tap gestures to be handled in the same way as long-press 
+        gestures. The location and touch area of a two-finger tap gesture will correspond to 
+        the location and touch area of the first finger down; the location/area of the second 
+        finger will be ignored.
+
+        Test: touchadjustment/touch-links-two-finger-tap.html
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::handleGestureLongPress):
+        (WebCore):
+        (WebCore::EventHandler::handleGestureForTextSelectionOrContextMenu):
+        (WebCore::EventHandler::handleGestureTwoFingerTap):
+        (WebCore::EventHandler::adjustGesturePosition):
+        * page/EventHandler.h:
+        (EventHandler):
+
+2012-10-24  Chris Fleizach  <cfleizach@apple.com>
+
+        AX:When aria-label is used, the text under an element is still appearing as the AXTitle
+        https://bugs.webkit.org/show_bug.cgi?id=98167
+
+        Reviewed by Beth Dakin.
+
+        According to WAI-ARIA text computation, the presence of aria-label and alternative text
+        should override the visible text within an element.
+
+        Test: platform/mac/accessibility/aria-label-overrides-visible-text.html
+
+        * accessibility/mac/WebAccessibilityObjectWrapper.mm:
+        (-[WebAccessibilityObjectWrapper accessibilityTitle]):
+
+2012-10-24  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r132303 and r132312.
+        http://trac.webkit.org/changeset/132303
+        http://trac.webkit.org/changeset/132312
+        https://bugs.webkit.org/show_bug.cgi?id=100287
+
+        Triggering crashes on many popular websites (Requested by
+        leviw|gardening on #webkit).
+
+        * css/CSSGrammar.y.in:
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::detectAtToken):
+        * css/CSSParser.h:
+        * css/CSSPropertySourceData.h:
+        * css/RuleSet.cpp:
+        (WebCore::RuleData::RuleData):
+        (WebCore::RuleSet::addRule):
+        (WebCore::RuleSet::addRegionRule):
+        (WebCore::RuleSet::addRulesFromSheet):
+        (WebCore::RuleSet::addStyleRule):
+        * css/RuleSet.h:
+        (RuleData):
+        (RuleSet):
+        * css/StyleResolver.cpp:
+        (WebCore::makeRuleSet):
+        (WebCore::StyleResolver::appendAuthorStyleSheets):
+        (WebCore::StyleResolver::matchScopedAuthorRules):
+        (WebCore::StyleResolver::locateSharedStyle):
+        * css/StyleResolver.h:
+        (StyleResolver):
+        * css/StyleRule.cpp:
+        (WebCore::StyleRuleBase::reportMemoryUsage):
+        (WebCore::StyleRuleBase::destroy):
+        (WebCore::StyleRuleBase::copy):
+        (WebCore::StyleRuleBase::createCSSOMWrapper):
+        * css/StyleRule.h:
+        * css/StyleScopeResolver.cpp:
+        (WebCore::StyleScopeResolver::reportMemoryUsage):
+        * css/StyleScopeResolver.h:
+        (WebCore):
+        (StyleScopeResolver):
+        * css/StyleSheetContents.cpp:
+        (WebCore::childRulesHaveFailedOrCanceledSubresources):
+
+2012-10-24  Joshua Bell  <jsbell@chromium.org>
+
+        IndexedDB: Cursor property value identities should be preserved
+        https://bugs.webkit.org/show_bug.cgi?id=100051
+
+        Reviewed by Tony Chang.
+
+        Some W3C test submissions point out that subsequent accesses to cursor properties should
+        yield the same value until the cursor advances. We handled this with custom binding code for
+        IDBCursor.value but not IDBCursor.key or IDBCursor.primaryKey. The custom value code is
+        being removed in webkit.org/b/100034 in favor of returning ScriptValue and the same fix can
+        be applied to key/primaryKey.
+
+        Test: storage/indexeddb/cursor-properties.html
+
+        * Modules/indexeddb/IDBCursor.cpp: Compute/store/serve up ScriptValues instead of IDBKeys
+        (WebCore::IDBCursor::key):
+        (WebCore::IDBCursor::primaryKey):
+        (WebCore::IDBCursor::setValueReady):
+        * Modules/indexeddb/IDBCursor.h:
+        (IDBCursor):
+        (WebCore::IDBCursor::idbPrimaryKey): Expose this for callers that need access to the IDBKey
+        * Modules/indexeddb/IDBCursor.idl:
+        * Modules/indexeddb/IDBObjectStore.cpp: ... like this one.
+        (WebCore):
+        * Modules/indexeddb/IDBRequest.cpp:
+        (WebCore::IDBRequest::dispatchEvent): Pass along script context, for the conversion.
+        * bindings/v8/IDBBindingUtilities.cpp:
+        (WebCore::idbKeyToScriptValue): New method for explicit conversion.
+        (WebCore):
+        * bindings/v8/IDBBindingUtilities.h:
+        (WebCore):
+
+2012-10-24  Ami Fischman  <fischman@chromium.org>
+
+        call to setNeedsLayout during RenderVideo::paintReplaced
+        https://bugs.webkit.org/show_bug.cgi?id=100265
+
+        Reviewed by Eric Carlson.
+
+        Removed unnecessary call and added new defensive guards to catch erroneous setNeedsLayout() calls
+        during paints earlier (so the offending calls are in the emitted stacktrace).
+
+        No new tests - new defensive checks are triggered by existing tests.
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::paintContents): forbid setNeedsLayout() during painting
+        * rendering/RenderObject.cpp:
+        (WebCore):
+        (WebCore::RenderObject::SetLayoutNeededForbiddenScope::SetLayoutNeededForbiddenScope):
+        (WebCore::RenderObject::SetLayoutNeededForbiddenScope::~SetLayoutNeededForbiddenScope):
+        * rendering/RenderObject.h:
+        (RenderObject):
+        (SetLayoutNeededForbiddenScope): added helper class for forbidding setNeedsLayout() in a scope.
+        * rendering/RenderVideo.cpp:
+        (WebCore::RenderVideo::paintReplaced): drop the offending & unnecessary call to updatePlayer().
+
+2012-10-24  Adam Barth  <abarth@webkit.org>
+
+        [V8] ActiveDOMObjectEpilogueVisitor is unnecessary and can be deleted
+        https://bugs.webkit.org/show_bug.cgi?id=100208
+
+        Reviewed by Eric Seidel.
+
+        Rather than clearing and re-establishing the weak callback for
+        ActiveDOMObjects during every GC, this patch puts all the
+        ActiveDOMObjects with pending activity into an object group with a live
+        object, causing them not to be garbage collected.
+
+        In addition to simplifying this code, this patch makes the patch in
+        https://bugs.webkit.org/show_bug.cgi?id=100175 much easier because
+        V8GCController no longer needs to know how to configure the weak
+        callbacks for these objects.
+
+        * bindings/v8/V8GCController.cpp:
+        (WebCore::ActiveDOMObjectPrologueVisitor::ActiveDOMObjectPrologueVisitor):
+        (ActiveDOMObjectPrologueVisitor):
+        (WebCore::ActiveDOMObjectPrologueVisitor::visitDOMWrapper):
+        (WebCore::V8GCController::majorGCPrologue):
+        (WebCore::V8GCController::majorGCEpilogue):
+        * bindings/v8/V8PerIsolateData.cpp:
+        (WebCore::V8PerIsolateData::V8PerIsolateData):
+        * bindings/v8/V8PerIsolateData.h:
+        (WebCore::V8PerIsolateData::liveRoot):
+        (V8PerIsolateData):
+
+2012-10-24  Brady Eidson  <beidson@apple.com>
+
+        Add a strategy for loader customization.
+        https://bugs.webkit.org/show_bug.cgi?id=100278
+
+        Reviewed by Alexey Proskuryakov.
+
+        It's empty for now and does nothing, just like the goggles.
+
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * platform/PlatformStrategies.h:
+        (WebCore::PlatformStrategies::loaderStrategy):
+        (PlatformStrategies):
+        (WebCore::PlatformStrategies::PlatformStrategies):
+
+2012-10-24  Tony Chang  <tony@chromium.org>
+
+        Setting width of a flexitem causes the adjacent flex item to be displayed poorly.
+        https://bugs.webkit.org/show_bug.cgi?id=99925
+
+        Reviewed by Ojan Vafai.
+
+        Make sure that we always repaint when moving a child. This is similar to what RenderDeprecatedFlexibleBox does.
+
+        Test: css3/flexbox/repaint-during-resize-no-flex.html
+
+        * rendering/RenderFlexibleBox.cpp:
+        (WebCore::RenderFlexibleBox::setFlowAwareLocationForChild): Move logic for repaining into the helper method
+        for setting the location of a child.
+        (WebCore::RenderFlexibleBox::layoutColumnReverse): Remove code for repaint since it's now in setFlowAwareLocationForChild.
+        (WebCore::RenderFlexibleBox::adjustAlignmentForChild): Remove code for repaint since it's now in setFlowAwareLocationForChild.
+
+2012-10-24  Simon Fraser  <simon.fraser@apple.com>
+
+        Fix CALayer hiearchy when combining tiling with preserve-3d
+        https://bugs.webkit.org/show_bug.cgi?id=100205
+
+        Reviewed by Dean Jackson.
+
+        When an element has "transform-style: preserve-3d", its GraphicsLayerCA has a
+        m_structuralLayer which is a CATransformLayer. The primary CALayer which contains rendered
+        content becomes a sublayer of the CATransformLayer. If the element has backface-visibility:hidden,
+        it is the primary layer that is set to be single-sided.
+        
+        In r131940 we started to use TileCaches in place of CATiledLayer. TileCaches work via
+        "customSublayers" returned from the PlatformCALayer, where the custom sublayer is 
+        the tile cache container layer. However, the custom sublayers were being added as
+        children of the structural (CATransformLayer) layer, not of the primary (CALayer) layer,
+        thus they were not affected by the doubleSided property.
+        
+        This change cleans up the confusing code in GraphicsLayerCA::updateSublayerList()
+        by maintaining two vectors of PlatformCALayers, one for sublayers of the structural
+        layer, and one for sublayers of the primary layer. It adds custom sublayers to
+        the latter list, so now the tile cache container layer becomes a sublayer of
+        the primary layer, so is affected by that layer's doubleSided property.
+
+        Test: compositing/tiling/backface-preserve-3d-tiled.html
+
+        * platform/graphics/ca/GraphicsLayerCA.cpp:
+        (WebCore::GraphicsLayerCA::updateSublayerList):
+
+2012-10-23  Zhenyao Mo  <zmo@google.com>
+
+        Update mozilla's CheckedInt.h to the latest version
+        https://bugs.webkit.org/show_bug.cgi?id=100177
+
+        Reviewed by Kenneth Russell.
+
+        * html/canvas/CheckedInt.h: Sync with mozilla's copy with minumum modifications.
+        (detail):
+        (IsSupportedPass2):
+        (IsSupported):
+        (UnsignedType):
+        (IsSigned):
+        (TwiceBiggerType):
+        (PositionOfSignBit):
+        (MinValue):
+        (MaxValue):
+        (WebCore::detail::HasSignBit):
+        (WebCore::detail::BinaryComplement):
+        (WebCore::detail::IsInRange):
+        (WebCore::detail::IsAddValid):
+        (WebCore::detail::IsSubValid):
+        (WebCore::detail::IsMulValid):
+        (WebCore::detail::IsDivValid):
+        (WebCore::detail::OppositeIfSignedImpl::run):
+        (WebCore::detail::OppositeIfSigned):
+        (WebCore):
+        (CheckedInt):
+        (WebCore::CheckedInt::CheckedInt):
+        (WebCore::CheckedInt::value):
+        (WebCore::CheckedInt::isValid):
+        (WebCore::CheckedInt::operator -):
+        (WebCore::CheckedInt::operator ==):
+        (WebCore::CheckedInt::operator++):
+        (WebCore::CheckedInt::operator--):
+        (CastToCheckedIntImpl):
+        (WebCore::detail::CastToCheckedIntImpl::run):
+        (WebCore::castToCheckedInt):
+        (WebCore::operator ==):
+        * html/canvas/DataView.cpp: change valid() to isValid().
+        (WebCore::DataView::create):
+        * html/canvas/WebGLBuffer.cpp: Ditto.
+        (WebCore::WebGLBuffer::associateBufferDataImpl):
+        (WebCore::WebGLBuffer::associateBufferSubDataImpl):
+        * html/canvas/WebGLRenderingContext.cpp: Ditto.
+        (WebCore):
+        (WebCore::WebGLRenderingContext::drawArrays):
+        * platform/graphics/GraphicsContext3D.cpp: Ditto.
+        (WebCore::GraphicsContext3D::computeImageSizeInBytes):
+
+2012-10-24  Noam Rosenthal  <noam.rosenthal@nokia.com>
+
+        [Qt-on-Mac] GraphicsSurfaces should not create a global IOSurface handle
+        https://bugs.webkit.org/show_bug.cgi?id=89885
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Use mach_port instead of global tokens for IOSurfaces.
+        Global IOSurfaces are accessible from other processes using their handle, while mach_ports
+        can only be shared directly via IPC.
+
+        Tested by existing WebGL tests.
+
+        * platform/graphics/surfaces/GraphicsSurfaceToken.h:
+        (GraphicsSurfaceToken):
+        * platform/graphics/surfaces/mac/GraphicsSurfaceMac.cpp:
+        (WebCore::GraphicsSurfacePrivate::GraphicsSurfacePrivate):
+        (WebCore::GraphicsSurfacePrivate::~GraphicsSurfacePrivate):
+
+2012-10-24  Rick Byers  <rbyers@chromium.org>
+
+        image-set doesn't round-trip properly with cssText
+        https://bugs.webkit.org/show_bug.cgi?id=99725
+
+        Reviewed by Beth Dakin.
+
+        Fix serialization of -webkit-image-set rules to use the same format as
+        is used for parsing.
+
+        Test: fast/css/image-set-setting.html
+
+        * css/CSSImageSetValue.cpp:
+        (WebCore::CSSImageSetValue::customCssText):
+        * css/CSSValueList.h:
+        (WebCore::CSSValueList::item): Add const overload
+
+2012-10-24  Jonathan Feldstein  <jfeldstein@rim.com>
+
+        BlackBerry fix for webgl-depth-texture.html
+        https://bugs.webkit.org/show_bug.cgi?id=100258
+
+        Reviewed by Yong Li.
+
+        Removed a platform specific define that is unnecessary.
+
+        * platform/graphics/GraphicsContext3D.cpp:
+        (WebCore::GraphicsContext3D::computeFormatAndTypeParameters):
+
+2012-10-24  Nico Weber  <thakis@chromium.org>
+
+        Honor image orientation in GraphicsContextSkia
+        https://bugs.webkit.org/show_bug.cgi?id=100179
+
+        Reviewed by Stephen White.
+
+        Also fix a bug in ImageOrientation.h: Some of the values were
+        switched. They now match the description in the exif spec at
+        http://www.exif.org/Exif2-2.PDF page 18, and the notes at
+        http://www.sno.phy.queensu.ca/~phil/exiftool/TagNames/EXIF.html and
+        the picture at http://www.80sidea.com/archives/2316.
+
+        They showed up correctly in Safari because the orientation transform
+        was done after flipping Y. Let the flipping happen later. I verified
+        that flipping transformation order and fixing the exif enum cancelled
+        each other out, so this has no effect on the apple port.
+
+        Not hooked up yet, so no observable difference.
+
+        * platform/graphics/BitmapImage.h:
+        * platform/graphics/ImageOrientation.h:
+        (WebCore::ImageOrientation::usesWidthAsHeight):
+        (WebCore::ImageOrientation::fromEXIFValue):
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+        (WebCore::GraphicsContext::drawNativeImage):
+        * platform/graphics/skia/ImageSkia.cpp:
+        (WebCore::paintSkBitmap):
+        (WebCore::BitmapImage::draw):
+        (WebCore):
+
+2012-10-24  Alexey Proskuryakov  <ap@apple.com>
+
+        Fixed Windows path for SharedWorkerStrategy.h - it's in workers/, not platform/.
+
+        * WebCore.vcproj/WebCore.vcproj:
+
+2012-10-24  Chris Fleizach  <cfleizach@apple.com>
+
+        AX: WebKit exposes abstract ARIA role range as AXSlider; should be generic AXGroup
+        https://bugs.webkit.org/show_bug.cgi?id=100204
+
+        Reviewed by Beth Dakin.
+
+        Remove the "range" role as a valid ARIA role.
+
+        Test: platform/mac/accessibility/aria-slider-value.html
+
+        * accessibility/AccessibilityObject.cpp:
+        (WebCore::createARIARoleMap):
+
+2012-10-24  Florin Malita  <fmalita@chromium.org>
+
+        [Chromium] SVG repaint issues
+        https://bugs.webkit.org/show_bug.cgi?id=99874
+
+        Reviewed by Levi Weintraub.
+
+        RenderSVGRoot::paintReplaced() converts the container offsets to a relative transform,
+        but in doing so it ends up accumulating subpixel rounding deltas twice: first for 
+        adjustedPaintOffset and second in localToParentTransform(). If coordinates are on
+        half-pixel boundaries, the 2x rounding delta yields a full pixel drift and we end up
+        painting at the wrong location.
+
+        This can be avoided by using localToBorderBoxTransform() directly, which (unlike
+        localToParentTransform()) doesn't perform rounding.
+
+        No new tests: existing pixel results cover this change after rebaseline.
+
+        * rendering/svg/RenderSVGRoot.cpp:
+        (WebCore::RenderSVGRoot::paintReplaced):
+
+2012-10-24  Levi Weintraub  <leviw@chromium.org>
+
+        Fixing the Chromium build after typo in r132367.
+
+        * WebCore.gypi:
+
+2012-10-24  Nico Weber  <thakis@chromium.org>
+
+        [chromium] Respect image orientation in image dragging code
+        https://bugs.webkit.org/show_bug.cgi?id=100200
+
+        Reviewed by Tony Chang.
+
+        Based on the corresponding code in DragImageMac.mm.  The image
+        rotation code isn't hooked up yet, so no observable effect for now.
+
+        * platform/chromium/DragImageChromiumSkia.cpp:
+        (WebCore::createDragImageFromImage):
+
+2012-10-24  Michael Saboff  <msaboff@apple.com>
+
+        Code cleanup after r132165
+        https://bugs.webkit.org/show_bug.cgi?id=100135
+
+        Reviewed by Geoffrey Garen.
+
+        Fixed up some unneccesary and inefficient constructs in MarkupTokenBase.h.
+
+        Code clean up without functional changes, therefore no new tests.
+
+        * xml/parser/MarkupTokenBase.h:
+        (WebCore::MarkupTokenBase::beginEndTag): Changed argument to be const Vector<LChar, 32>&.
+        (WebCore::MarkupTokenBase::appendToCharacter): Changed argument to be const Vector<LChar, 32>&.
+        (WebCore::MarkupTokenBase::appendToName): Elimintated inline.
+        (WebCore::MarkupTokenBase::name): Elimintated inline.
+        (WebCore::MarkupTokenBase::nameString): Elimintated inline.
+
+2012-10-24  Toni Barzic  <tbarzic@chromium.org>
+
+        Crash when trying to write exception message to null console
+        https://bugs.webkit.org/show_bug.cgi?id=99658
+
+        Reviewed by Adam Barth.
+
+        DOMWindow::console may return NULL, so we should do a NULL check before adding message to it.
+        This may happen e.g. if a worker throws an exception just as the document is being replaced in the view.
+        The exception task could be processes after current window in the frame changes, and console in the document window is nulled.
+
+        Test: fast/workers/worker-exception-during-navigation.html
+
+        * dom/Document.cpp:
+        (WebCore::Document::addMessage):
+
+2012-10-24  Cosmin Truta  <ctruta@rim.com>
+
+        Incorrect conditional use of LogFTP
+        https://bugs.webkit.org/show_bug.cgi?id=100260
+
+        Reviewed by Alexey Proskuryakov.
+
+        Use LogFTP if !LOG_DISABLED, to allow toggling ASSERTIONS_DISABLED_DEFAULT
+        without breaking the build.
+
+        * html/FTPDirectoryDocument.cpp:
+        (WebCore::FTPDirectoryDocument::FTPDirectoryDocument):
+
+2012-10-23  Alexey Proskuryakov  <ap@apple.com>
+
+        Add a strategy for shared workers
+        https://bugs.webkit.org/show_bug.cgi?id=100165
+
+        Reviewed by Brady Eidson.
+
+        Also a little bit of alphabetization.
+
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * platform/PlatformStrategies.h:
+        * workers/SharedWorkerStrategy.h: Added.
+
+2012-10-24  David Barton  <dbarton@mathscribe.com>
+
+        [MathML] Timeouts on linux after r132264
+        https://bugs.webkit.org/show_bug.cgi?id=100202
+
+        Reviewed by Eric Seidel.
+
+        When building a stretched operator, such as a large parenthesis or bracket, we need to
+        check that the extension glyph's height is > 0, to avoid an infinite loop. The 0 height
+        can occur if the glyph is missing on the host system.
+
+        Tested by existing tests.
+
+        * rendering/mathml/RenderMathMLOperator.cpp:
+        (WebCore::RenderMathMLOperator::updateFromElement):
+
+2012-10-24  Parth Patel  <parpatel@rim.com>
+
+        [BlackBerry] Extending existing ThreadUnsafe singletons in webkit to
+        Generic ThreadUnsafe Singleton
+        https://bugs.webkit.org/show_bug.cgi?id=100145
+
+        Reviewed by Rob Buis.
+
+        Extending the singletons to generic singleton and changing
+        getInstance() in IconDatabaseClientBlackBerry to instance()
+        to match the generic singleton template.
+
+        Reviewed Internally by Yong Li.
+
+        Tests are not modified and added as there was no behavioural change.
+
+        * platform/blackberry/SharedTimerBlackBerry.cpp:
+        (SharedTimerBlackBerry):
+        (WebCore):
+
+2012-10-24  Ilya Tikhonovsky  <loislo@chromium.org>
+
+        Web Inspector: NMI add instrumentation for ResourceBuffer. It gives us 10mb on gmail
+        https://bugs.webkit.org/show_bug.cgi?id=100254
+
+        Reviewed by Yury Semikhatsky.
+
+        * loader/ResourceBuffer.cpp:
+        (WebCore::ResourceBuffer::reportMemoryUsage):
+        (WebCore):
+        * loader/ResourceBuffer.h:
+        (ResourceBuffer):
+
+2012-10-24  Eric Carlson  <eric.carlson@apple.com>
+
+        Allow ports to override text track rendering style
+        https://bugs.webkit.org/show_bug.cgi?id=97800
+        <rdar://problem/12044964>
+
+        Unreviewed Build fix.
+        
+        CGFloat is already a float in a 32-bit build so narrowPrecisionToFloat() is unnecessary
+
+        * page/CaptionUserPreferencesMac.mm:
+        (WebCore::CaptionUserPreferencesMac::captionFontSizeScale):
+
+2012-10-24  Eric Carlson  <eric.carlson@apple.com>
+
+        Allow ports to override text track rendering style
+        https://bugs.webkit.org/show_bug.cgi?id=97800
+        <rdar://problem/12044964>
+
+        Reviewed by Maciej Stachowiak.
+
+        * WebCore.exp.in: Export new WebkitSystemInterface functions.
+        * WebCore.xcodeproj/project.pbxproj: Add CaptionUserPreferences.h, CaptionUserPreferencesMac.mm,
+            and CaptionUserPreferencesMac.h.
+
+        * css/mediaControls.css: Rearrange the caption CSS so it is possible to style the cue window,
+            background, and text independently.
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::HTMLMediaElement): Initialize m_disableCaptions with theme->userPrefersCaptions().
+        (WebCore::HTMLMediaElement::attach): Register for caption preferences change callbacks.
+        (WebCore::HTMLMediaElement::detach): Unregister for caption preferences change callbacks.
+        (WebCore::HTMLMediaElement::userPrefersCaptions): Return theme->userPrefersCaptions().
+        (WebCore::HTMLMediaElement::userIsInterestedInThisTrackKind): Consider userPrefersCaptions().
+        (WebCore::HTMLMediaElement::setClosedCaptionsVisible): Move the code that marks all tracks as
+            un-configured to markCaptionAndSubtitleTracksAsUnconfigured so it can be reused.
+        (WebCore::HTMLMediaElement::captionPreferencesChanged): New, force a reevaluation of all text tracks.
+        (WebCore::HTMLMediaElement::markCaptionAndSubtitleTracksAsUnconfigured): New, code moved from 
+            setClosedCaptionsVisible
+        * html/HTMLMediaElement.h: Inherit from CaptionPreferencesChangedListener.
+
+        * html/shadow/MediaControlElements.cpp:
+        (WebCore::MediaControlTextTrackContainerElement::updateSizes): Get rid of unnecessary member
+            variable. Get caption font scale from theme instead of hard coding.
+        * html/shadow/MediaControlElements.h:
+
+        * html/track/TextTrack.cpp:
+        (WebCore::TextTrack::TextTrack): Change attributes from String to AtomicString.
+        (WebCore::TextTrack::isValidKindKeyword): Ditto.
+        (WebCore::TextTrack::setKind): Ditto.
+        (WebCore::TextTrack::setMode): Ditto.
+        (WebCore::TextTrack::mode): Ditto.
+        * html/track/TextTrack.h:
+        (WebCore::TextTrack::create): Ditto.
+        (WebCore::TextTrack::kind): Ditto.
+        (WebCore::TextTrack::label): Ditto.
+        (WebCore::TextTrack::setLabel): Ditto.
+        (WebCore::TextTrack::language): Ditto.
+        (WebCore::TextTrack::setLanguage): Ditto.
+
+        * html/track/TextTrackCue.cpp:
+        (WebCore::TextTrackCueBox::TextTrackCueBox): Set the shadow pseudo id.
+        (WebCore::TextTrackCueBox::textTrackCueBoxShadowPseudoId): New, class method to return the 
+            shadow pseudo id so it can be used elsewhere.
+        (WebCore::TextTrackCueBox::shadowPseudoId): Call textTrackCueBoxShadowPseudoId.
+        (WebCore::TextTrackCue::pastNodesShadowPseudoId): New, class method to return the 
+            shadow pseudo id so it can be used elsewhere.
+        (WebCore::TextTrackCue::futureNodesShadowPseudoId): Ditto.
+        (WebCore::TextTrackCue::updateDisplayTree):
+        * html/track/TextTrackCue.h:
+
+        * page/CaptionUserPreferences.h: Added.
+        * page/CaptionUserPreferencesMac.h: Added.
+        * page/CaptionUserPreferencesMac.mm: Added.
+        (WebCore::userCaptionPreferencesChangedNotificationCallback):
+        (WebCore::CaptionUserPreferencesMac::CaptionUserPreferencesMac):
+        (WebCore::CaptionUserPreferencesMac::~CaptionUserPreferencesMac):
+        (WebCore::CaptionUserPreferencesMac::userHasCaptionPreferences): New, passthrough to WKSI function.
+        (WebCore::CaptionUserPreferencesMac::userPrefersCaptions): Ditto.
+        (WebCore::CaptionUserPreferencesMac::captionsWindowColor): Return Color with user's caption window color preference.
+        (WebCore::CaptionUserPreferencesMac::captionsBackgroundColor): Return Color with user's caption 
+            background color preference.
+        (WebCore::CaptionUserPreferencesMac::captionsTextColor): Return Color with user's caption text color preference.
+        (WebCore::CaptionUserPreferencesMac::captionsEdgeColorForTextColor): Return Color for text edge effect.
+        (WebCore::CaptionUserPreferencesMac::cssPropertyWithTextEdgeColor): Return String with CSS to set a text-shadow
+            or webkit-text-stroke property.
+        (WebCore::CaptionUserPreferencesMac::cssColorProperty): Return a String with css to set a property 
+            with a color value.
+        (WebCore::CaptionUserPreferencesMac::captionsTextEdgeStyle): Return a String with css to style caption 
+            text with the user's preferred text edge stye.
+        (WebCore::CaptionUserPreferencesMac::captionsDefaultFont): Return a String with css to style caption
+            text with the user's preferred font.
+        (WebCore::CaptionUserPreferencesMac::captionsStyleSheetOverride): Return a String with css to style captions
+            with the user's preferred style.
+        (WebCore::CaptionUserPreferencesMac::captionFontSizeScale): Return the user's preferred caption font scale.
+        (WebCore::CaptionUserPreferencesMac::captionPreferencesChanged): Notify listeners of caption preference change.
+        (WebCore::CaptionUserPreferencesMac::registerForCaptionPreferencesChangedCallbacks): Add a caption preferences 
+            changes listener.
+        (WebCore::CaptionUserPreferencesMac::unregisterForCaptionPreferencesChangedCallbacks): Remove a caption preferences
+            changes listener.
+        (WebCore::CaptionUserPreferencesMac::updateCaptionStyleSheetOveride): New, if theme has a captions style sheet override,
+            inject it into the current page group, otherwise remove injected sheet.
+
+        * page/PageGroup.cpp:
+        (WebCore::PageGroup::captionPreferences):
+        (WebCore::PageGroup::registerForCaptionPreferencesChangedCallbacks): New, passthrough to platform specific function
+            of the same name.
+        (WebCore::PageGroup::unregisterForCaptionPreferencesChangedCallbacks): Ditto.
+        (WebCore::PageGroup::userPrefersCaptions): Ditto.
+        (WebCore::PageGroup::userHasCaptionPreferences): Ditto.
+        (WebCore::PageGroup::captionFontSizeScale): Ditto.
+        * page/PageGroup.h:
+
+        * platform/mac/WebCoreSystemInterface.h: Updated.
+        * platform/mac/WebCoreSystemInterface.mm: Ditto.
+
+2012-10-24  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Web Inspector: Introduce workspace provider as a content providing backend for project.
+        https://bugs.webkit.org/show_bug.cgi?id=100244
+
+        Reviewed by Pavel Feldman.
+
+        Introduced WorkspaceProvider interface as a content providing backend for project.
+        Added NetworkWorkspaceProvider as a network based (default) implementation.
+
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/compile-front-end.py:
+        * inspector/front-end/CompilerScriptMapping.js:
+        (WebInspector.CompilerScriptMapping):
+        * inspector/front-end/DebuggerScriptMapping.js:
+        (WebInspector.DebuggerScriptMapping):
+        * inspector/front-end/NetworkUISourceCodeProvider.js:
+        (WebInspector.NetworkUISourceCodeProvider):
+        (WebInspector.NetworkUISourceCodeProvider.prototype._parsedScriptSource):
+        (WebInspector.NetworkUISourceCodeProvider.prototype._resourceAdded):
+        (WebInspector.NetworkUISourceCodeProvider.prototype._addFile):
+        * inspector/front-end/NetworkWorkspaceProvider.js: Added.
+        (WebInspector.NetworkWorkspaceProvider):
+        (WebInspector.NetworkWorkspaceProvider.prototype.requestFileContent):
+        (WebInspector.NetworkWorkspaceProvider.prototype.setFileContent):
+        (WebInspector.NetworkWorkspaceProvider.prototype.searchInFileContent):
+        (WebInspector.NetworkWorkspaceProvider.prototype.addFile):
+        (WebInspector.NetworkWorkspaceProvider.prototype.removeFile):
+        (WebInspector.NetworkWorkspaceProvider.prototype.reset):
+        * inspector/front-end/SASSSourceMapping.js:
+        (WebInspector.SASSSourceMapping):
+        (_bindUISourceCode):
+        * inspector/front-end/ScriptSnippetModel.js:
+        (WebInspector.ScriptSnippetModel):
+        (WebInspector.ScriptSnippetModel.prototype._addScriptSnippet):
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/Workspace.js:
+        (WebInspector.FileDescriptor):
+        (WebInspector.WorkspaceProvider):
+        (WebInspector.WorkspaceProvider.prototype.requestFileContent):
+        (WebInspector.WorkspaceProvider.prototype.searchInFileContent):
+        (WebInspector.WorkspaceProvider.prototype.addEventListener):
+        (WebInspector.WorkspaceProvider.prototype.removeEventListener):
+        (WebInspector.Project):
+        (WebInspector.Project.prototype.reset):
+        (WebInspector.Project.prototype._fileAdded):
+        (WebInspector.Project.prototype._fileRemoved):
+        (WebInspector.Project.prototype.requestFileContent):
+        (WebInspector.Project.prototype.searchInFileContent):
+        (WebInspector.Workspace):
+        (WebInspector.Workspace.prototype.addProject):
+        (WebInspector.Workspace.prototype.project):
+        * inspector/front-end/inspector.html:
+        * inspector/front-end/inspector.js:
+
+2012-10-24  Nikita Vasilyev  <me@elv1s.ru>
+
+        Web Inspector: Styles pane: Don't select whole value when I select just a part
+        https://bugs.webkit.org/show_bug.cgi?id=100242
+
+        Reviewed by Alexander Pavlov.
+
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylePropertiesSection.prototype._handleEmptySpaceClick):
+        (WebInspector.StylePropertyTreeElement.prototype):
+
+2012-10-24  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Web Inspector: UiSourceCode should rely on the workspace as a content provider.
+        https://bugs.webkit.org/show_bug.cgi?id=100216
+
+        Reviewed by Pavel Feldman.
+
+        Workspace is now passed to UISourceCode to be used as a content provider.
+        Content providers are now stored in the workspace/project.
+        Next step would be to move content providers to workspace providers.
+
+        * inspector/front-end/BreakpointManager.js:
+        (WebInspector.BreakpointManager.breakpointStorageId):
+        * inspector/front-end/UISourceCode.js:
+        (WebInspector.UISourceCode):
+        (WebInspector.UISourceCode.prototype.contentType):
+        (WebInspector.UISourceCode.prototype.requestContent):
+        (WebInspector.UISourceCode.prototype.requestOriginalContent):
+        (WebInspector.UISourceCode.prototype._commitContent):
+        (WebInspector.UISourceCode.prototype.searchInContent):
+        * inspector/front-end/Workspace.js:
+        (WebInspector.WorkspaceController.prototype._mainFrameNavigated):
+        (WebInspector.Project):
+        (WebInspector.Project.prototype.addUISourceCode):
+        (WebInspector.Project.prototype.removeUISourceCode):
+        (WebInspector.Project.prototype.uiSourceCodes):
+        (WebInspector.Project.prototype.requestFileContent):
+        (WebInspector.Project.prototype.searchInFileContent):
+        (WebInspector.Workspace):
+        (WebInspector.Workspace.prototype.addTemporaryUISourceCode):
+        (WebInspector.Workspace.prototype.removeTemporaryUISourceCode):
+        (WebInspector.Workspace.prototype.reset):
+
+2012-10-24  Zeno Albisser  <zeno@webkit.org>
+
+        Implement GraphicsSurface for Windows.
+        https://bugs.webkit.org/show_bug.cgi?id=98147
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        * Target.pri:
+            Include GraphicsSurfaceWin.cpp in SOURCES on Windows.
+        * platform/graphics/surfaces/GraphicsSurface.h:
+            Add typedef for PlatformGraphicsSurface on Windows.
+        * platform/graphics/surfaces/GraphicsSurfaceToken.h:
+            Add typedef for BufferHandle on Windows.
+        (GraphicsSurfaceToken):
+        * platform/graphics/surfaces/win/GraphicsSurfaceWin.cpp: Added.
+            The GraphicsSurface implementation on Windows relies on the
+            availability of ANGLE and the EGL_ANGLE_query_surface_pointer extension.
+            For Qt this requirements are implicitly satisfied, when Qt is built
+            on Windows and QT_CONFIG contains OpenGLES2.
+            The GraphicsSurface then renders a given texture onto an offscreen
+            pixel buffer surface, queries the surface pointer using the
+            EGL_ANGLE_query_surface_pointer extension, and transmits the received
+            surface pointer (share handle) over IPC.
+            On the UIProcess side, the surface pointer can then be resolved
+            using eglCreatePbufferFromClientBuffer.
+        (WebCore):
+        (WebCore::loadShader):
+            Initialize the shaders needed for drawing onto the GraphicsSurface.
+        (GraphicsSurfacePrivate):
+        (WebCore::GraphicsSurfacePrivate::GraphicsSurfacePrivate):
+            In case of the instance being on the WebProcess side,
+            create an EGLContext that shares the texture objects with the provided
+            share context. Also create two pixel buffer surfaces, one as front- and
+            one as backbuffer.
+            Query the surface pointers for the pixel buffer surfaces and initialize
+            the GraphicsSurfaceToken that can be passed over IPC later.
+        (WebCore::GraphicsSurfacePrivate::~GraphicsSurfacePrivate):
+            Release all aquired resources and destroy the pixel buffer surfaces.
+            Also close the EGL-Display connection.
+        (WebCore::GraphicsSurfacePrivate::copyFromTexture):
+            Make the belonging context current on the back buffer surface
+            and use drawTexture() to draw the provided texture onto the GraphicsSurface.
+        (WebCore::GraphicsSurfacePrivate::makeCurrent):
+            Save the previously current context, then make the context belonging
+            to the GraphicsSurface current.
+        (WebCore::GraphicsSurfacePrivate::doneCurrent):
+            Restore the context that was current before calling makeCurrent().
+        (WebCore::GraphicsSurfacePrivate::swapBuffers):
+            Swap front and back buffer surfaces and handles.
+        (WebCore::GraphicsSurfacePrivate::token):
+        (WebCore::GraphicsSurfacePrivate::frontBufferTextureID):
+            This function is meant to be called from the UIProcess side.
+            If no front buffer surface has been created before for the current
+            front buffer handle, one will be created.
+            Then eglBindTexImage will be used to actually bind the current
+            front buffer surface to a texture as a source for drawing.
+        (WebCore::GraphicsSurfacePrivate::initialFrontBufferShareHandle):
+        (WebCore::GraphicsSurfacePrivate::frontBufferShareHandle):
+        (WebCore::GraphicsSurfacePrivate::backBufferShareHandle):
+        (WebCore::GraphicsSurfacePrivate::releaseFrontBufferTexture):
+            Free the resources related to the front buffer surface.
+            On the UIProcess side we never actually bind the back buffer.
+        (WebCore::GraphicsSurfacePrivate::initializeShaderProgram):
+            Initialize and link the shader programs necessary for drawing
+            onto the GraphicsSurface.
+        (WebCore::GraphicsSurfacePrivate::createSurfaceFromShareHandle):
+            Creates a single pixel buffer surface from a share Handle.
+            This function will be called on the UIProcess side,
+            for the front buffer handle, whenever the buffers have been swapped.
+        (WebCore::GraphicsSurfacePrivate::drawTexture):
+            The WebProcess uses this function to draw a given
+            texture onto the GraphicsSurface's back buffer.
+        (WebCore::GraphicsSurface::platformExport):
+        (WebCore::GraphicsSurface::platformGetTextureID):
+        (WebCore::GraphicsSurface::platformCopyToGLTexture):
+        (WebCore::GraphicsSurface::platformCopyFromTexture):
+        (WebCore::GraphicsSurface::platformPaintToTextureMapper):
+            Uses TextureMapperGL::drawTexture() to draw the front buffer texture
+            to the TextureMapper on the UIProcess side.
+        (WebCore::GraphicsSurface::platformFrontBuffer):
+        (WebCore::GraphicsSurface::platformSwapBuffers):
+        (WebCore::GraphicsSurface::platformCreate):
+        (WebCore::GraphicsSurface::platformImport):
+        (WebCore::GraphicsSurface::platformLock):
+        (WebCore::GraphicsSurface::platformUnlock):
+        (WebCore::GraphicsSurface::platformDestroy):
+
+2012-09-27  Yury Semikhatsky  <yurys@chromium.org>
+
+        Web Inspector: provide memory instrumentation for ListHashSet
+        https://bugs.webkit.org/show_bug.cgi?id=97786
+
+        Reviewed by Vsevolod Vlasov.
+
+        Switched existing usages of addListHashSet to the generic instrumentation mechanism
+        as it should work just just fine now that there is a memory instrumentation of
+        ListHashSet.
+
+        * dom/DocumentEventQueue.cpp:
+        * dom/DocumentStyleSheetCollection.cpp:
+        (WebCore::DocumentStyleSheetCollection::reportMemoryUsage):
+        * loader/cache/CachedResourceLoader.cpp:
+        (WebCore::CachedResourceLoader::reportMemoryUsage):
+
+2012-10-24  Charles Wei  <charles.wei@torchmobile.com.cn>
+
+        [BlackBerry] Credentials not re-used for a redirected request to the same domain
+        https://bugs.webkit.org/show_bug.cgi?id=100193
+
+        Reviewed by George Staikos.
+
+        We should store the credentials in the redirection response handler, if the request is challenged.
+        Because the redirect response suggests the authentication succeeds. 
+
+        Test: http://browsertest01.rim.net/authbasic
+
+        * platform/network/blackberry/NetworkJob.cpp:
+        (WebCore::NetworkJob::handleRedirect):
+
+2012-10-24  Alexander Pavlov  <apavlov@chromium.org>
+
+        Web Inspector: Implement CSS reload upon related SASS resource saving
+        https://bugs.webkit.org/show_bug.cgi?id=98024
+
+        Reviewed by Vsevolod Vlasov.
+
+        SASS-generated debug info in CSS is parsed to find out which SASS files contributed to this stylesheet.
+        Upon SASS file save in the Sources panel, all affected external CSS stylesheets are reloaded to update
+        the page styles (presuming that SASS is running in the "watch" mode during the development cycle).
+
+        * English.lproj/localizedStrings.js:
+        * inspector/front-end/SASSSourceMapping.js:
+        (WebInspector.SASSSourceMapping):
+        (WebInspector.SASSSourceMapping.prototype._fileSaveFinished.callback):
+        (WebInspector.SASSSourceMapping.prototype._reloadCSS):
+        (_bindUISourceCode):
+        (_addCSSURLforSASSURL):
+        * inspector/front-end/Settings.js:
+        * inspector/front-end/SettingsScreen.js:
+        (WebInspector.GenericSettingsTab):
+
+2012-10-23  Yury Semikhatsky  <yurys@chromium.org>
+
+        Memory instrumentation: don't count agent-specific front-ends separately
+        https://bugs.webkit.org/show_bug.cgi?id=100087
+
+        Reviewed by Alexander Pavlov.
+
+        Pointers to domain-specific inspector front-end interfaces are reported as
+        weak pointers instead of members to avoid double-counting.
+
+        Test by comparing set of reported instrumented objects with the set of objects
+        allocated by tcmalloc.
+
+        * inspector/InspectorDOMStorageAgent.cpp:
+        (WebCore::InspectorDOMStorageAgent::reportMemoryUsage):
+        * inspector/InspectorDOMStorageResource.cpp:
+        (WebCore::InspectorDOMStorageResource::reportMemoryUsage):
+        * inspector/InspectorProfilerAgent.cpp:
+        (WebCore::InspectorProfilerAgent::reportMemoryUsage):
+
+2012-10-23  Christophe Dumez  <christophe.dumez@intel.com>
+
+        Regression(r132303) Broke debug build when SHADOW_DOM is enabled but STYLE_SCOPED is disabled
+        https://bugs.webkit.org/show_bug.cgi?id=100203
+
+        Unreviewed Build fix.
+
+        Fix compilation error in StyleResolver.h when SHADOW_DOM flag is
+        set and STYLE_SCOPED is not.
+
+        No new tests, no behavior change.
+
+        * css/StyleResolver.h:
+        (WebCore::StyleResolver::ensureScopeResolver):
+
+2012-10-23  Andreas Kling  <kling@webkit.org>
+
+        Remove specialized hash traits for GlyphPages.
+        <http://webkit.org/b/100185>
+
+        Reviewed by Dan Bernstein.
+
+        Now that the default minimum table size has been lowered for all tables, there's no need
+        for this specialization anymore.
+
+        * platform/graphics/FontFallbackList.h:
+        (FontFallbackList):
+
+2012-10-23  Kent Tamura  <tkent@chromium.org>
+
+        Multiple fields input UI: Don't use CSS properties for physical direction
+        https://bugs.webkit.org/show_bug.cgi?id=100195
+
+        Reviewed by Kentaro Hara.
+
+        CSS declarations such as "padding: 0 0 0 1px;" "margin-left: 0.2em;" are
+        not direction-neutral, and makes unexpected appearance in RTL. We should
+        use -webkit-padding-start or -webkit-margin-start.
+
+        No new tests. Covered by date-multiple-fields-appearance-l10n.html and
+        month-multiple-fields-appearance-l10n.html
+
+        * css/html.css:
+        (input[type="date"]): Use padding:0 and -webkit-padding-start:1px;
+        (input[type="datetime"]): Ditto.
+        (input[type="datetime-local"]): Ditto.
+        (input[type="month"]): Ditto.
+        (input[type="time"]): Ditto.
+        (input[type="week"]): Ditto.
+        (input[type="week"]::-webkit-inner-spin-button):
+        Use -webkit-margin-start. Also use an integral pixel size instead of
+        avoid a fractional relative size to avoid subpixel layout rounding.
+
+2012-10-23  Dan Bernstein  <mitz@apple.com>
+
+        The font cache evicts inactive font data too aggressively when not under memory pressure
+        https://bugs.webkit.org/show_bug.cgi?id=100194
+
+        Reviewed by Sam Weinig.
+
+        Increasing the number of inactive font data objects the cache may hold increases the hit
+        rate, leading to improved page load performance. When memory pressure is detected,
+        MemoryPressureHandler evicts all inactive objects, regardless of the limits we are
+        increasing here.
+
+        * platform/graphics/FontCache.cpp:
+        (WebCore): Increased the maximum number of inactive font data objects in the cache from 50
+        to 225, and the number of objects to evict once the limit is met from 20 to 25.
+
+2012-10-23  Takashi Sakamoto  <tasak@google.com>
+
+        [Shadow DOM] Needs @host rule for ShadowDOM styling
+        https://bugs.webkit.org/show_bug.cgi?id=88606
+
+        Reviewed by Hajime Morita.
+
+        Implemented @host-@rules according to the shadow dom spec:
+        http://dvcs.w3.org/hg/webcomponents/raw-file/tip/spec/shadow/index.html#host-at-rule
+        The design doc is:
+        https://docs.google.com/document/d/1P2yorchF8lci2sccr-mVSRf2dtvjKeiuyQWzCB2bEA8/edit
+
+        Test: fast/dom/shadow/athost-atrules.html
+
+        * css/CSSGrammar.y.in:
+        Added rules for parsing @host @-rules.
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::detectAtToken):
+        Added a new token "@host".
+        (WebCore::CSSParser::createHostRule):
+        Added a new method to create an @host @-rule, which is invoked from
+        (WebCore):
+        * css/CSSParser.h:
+        Added a declaration of the above new method: createHostRule.
+        * css/CSSPropertySourceData.h:
+        Added HOST_RULE to enum Type.
+        * css/RuleSet.cpp:
+        (WebCore::RuleData::RuleData):
+        Modified multiple bool arguments into one argument. Now it
+        uses combinations of values from enum AddRuleFlags.
+        (WebCore::RuleSet::addRule):
+        (WebCore::RuleSet::addRegionRule):
+        (WebCore::RuleSet::addStyleRule):
+        Updated according to the RuleData's change.
+        Modified to Invoke increaseSpecificity if the given rule is @host
+        @-rule.
+        (WebCore::RuleSet::addRulesFromSheet):
+        Invoked addHostRule if the given rule is @host @-rule.
+        * css/RuleSet.h:
+        (RuleData):
+        (WebCore::RuleData::increaseSpecificity):
+        Added a new method to increase selector's specificity. This method is
+        used to make @host @-rules' specificity larger than normal author
+        rules' specificity.
+        (RuleSet):
+        * css/StyleResolver.cpp:
+        (WebCore::makeRuleSet):
+        (WebCore::StyleResolver::addHostRule):
+        A wrapper method to invoke StyleScopeResolver::addHostRule. The method
+        is used to make only StyleResolver know an implementation detail about
+        class StyleScopeResolver.
+        (WebCore::StyleResolver::appendAuthorStylesheets):
+        Updated according to the RuleData's change.
+        (WebCore::StyleResolver::styleSharingCandidateMatchesHostRules):
+        A new method to find matched host rules when an element is given.
+        This method invokes
+        StyleScopeResolver::styleSharingCandidateMatchesHostRules to find
+        matched host rules.
+        (WebCore):
+        (WebCore::StyleResolver::matchHostRules):
+        A new method to find matched host rules when an element is given.
+        This method invokes StyleScopeResolver::matchHostRules to find
+        matched host rules.
+        (WebCore::StyleResolver::matchScopedAuthorRules):
+        Modified to invoke matchHostRules.
+        (WebCore::StyleResolver::locateSharedStyle):
+        Disable sibling style cache if the given element is a shadow host and
+        any @host @-rules are applied to the element.
+        * css/StyleResolver.h:
+        (WebCore::StyleResolver::ensureScopeResolver):
+        If no scopeResolver is created, create and return the instance.
+        If created, just return the instance.
+        (StyleResolver):
+        * css/StyleRule.cpp:
+        (WebCore::StyleRuleBase::reportMemoryUsage):
+        (WebCore::StyleRuleBase::destroy):
+        (WebCore::StyleRuleBase::copy):
+        (WebCore::StyleRuleBase::createCSSOMWrapper):
+        (WebCore::StyleRuleHost::StyleRuleHost):
+        Implemented class StyleRuleHost. The class is almost the same as
+        StyleRuleBlock except type.
+        (WebCore):
+        * css/StyleRule.h:
+        (WebCore::StyleRuleBase::isHostRule):
+        (StyleRuleHost):
+        (WebCore::StyleRuleHost::create):
+        (WebCore::StyleRuleHost::copy):
+        (WebCore):
+        * css/StyleScopeResolver.cpp:
+        (WebCore::StyleScopeResolver::ensureAtHostRuleSetFor):
+        A new method to create a new RuleSet for the given shadow root.
+        (WebCore):
+        (WebCore::StyleScopeResolver::atHostRuleSetFor):
+        A new private inline method to obtain @host @-rules declared in
+        the given shadow root.
+        (WebCore::StyleScopeResolver::addHostRule):
+        Added a new method to register @host @-rules with shadow roots.
+        (WebCore::StyleScopeResolver::styleSharingCandidateMatchesHostRules):
+        A new method to find whether any @host @-rules are applied to
+        the given host element.
+        (WebCore::StyleScopeResolver::matchHostRules):
+        A new method to find matched rules for the given host element.
+        (WebCore::StyleScopeResolver::reportMemoryUsage):
+        * css/StyleScopeResolver.h:
+        (WebCore):
+        (StyleScopeResolver):
+        * css/StyleSheetContents.cpp:
+        (WebCore::childRulesHaveFailedOrCanceledSubresources):
+
+2012-10-23  Andreas Kling  <kling@webkit.org>
+
+        REGRESSION(r130643): ASSERTION FAILED: result.iterator != end() below PluginDatabase::add
+        <http://webkit.org/b/100065>
+
+        Reviewed by Anders Carlsson.
+
+        Restore the pre-r130643 hash table size for PluginDatabase to prevent these easily reproducible
+        collisions. This will need a proper fix at some point.
+
+        * plugins/PluginDatabase.h:
+        * plugins/PluginPackage.h:
+        (PluginPackageHashTraits):
+
+2012-10-23  Simon Fraser  <simon.fraser@apple.com>
+
+        Allow tests to run with a tile cache, and optionally dump the tile cache via layerTreeAsText()
+        https://bugs.webkit.org/show_bug.cgi?id=100159
+
+        Reviewed by Tim Horton.
+
+        Add a LAYER_TREE_INCLUDES_PAGE_TILE_CACHE flag for layerTreeAsText(), and plumb it
+        through to GraphicsLayerCA, which dumps the TiledBacking tile coverage rect.
+
+        Test: platform/mac/tiled-drawing/use-tiled-drawing.html
+
+        * page/Frame.h:
+        * platform/graphics/GraphicsLayer.cpp:
+        (showGraphicsLayerTree):
+        * platform/graphics/GraphicsLayer.h:
+        (WebCore::GraphicsLayer::tiledBacking):
+        * platform/graphics/TiledBacking.h:
+        * platform/graphics/ca/GraphicsLayerCA.cpp:
+        (WebCore::GraphicsLayerCA::tiledBacking):
+        (WebCore::GraphicsLayerCA::dumpAdditionalProperties):
+        * platform/graphics/ca/GraphicsLayerCA.h:
+        (GraphicsLayerCA):
+        * platform/graphics/ca/mac/TileCache.h:
+        (WebCore::TileCache::tileCoverageRect):
+        (TileCache):
+        * platform/graphics/ca/mac/TileCache.mm:
+        (WebCore::TileCache::computeTileCoverageRect):
+        (WebCore::TileCache::revalidateTiles):
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::layerTreeAsText):
+        * testing/Internals.cpp:
+        (WebCore::Internals::layerTreeAsText):
+        * testing/Internals.h:
+        * testing/Internals.idl:
+
+2012-10-23  Simon Fraser  <simon.fraser@apple.com>
+
+        Flush pending GraphicsLayer changes when reattaching compositing layers if necessary
+        https://bugs.webkit.org/show_bug.cgi?id=100187
+        <rdar://problem/12546770>
+
+        Reviewed by Dan Bernstein.
+
+        Fix a regression from r131940. That revision changed RenderLayerCompositor::flushPendingLayerChanges()
+        to bail if the root layer is unattached, which indicates that we're in the page cache, or in a
+        background tab. However, that dropped the layer flush on the floor, so that any subsequent changes
+        to GraphicsLayerCAs would just pile up and never get flushed. This was most evident on pages
+        that require frequent flushing, such as those running animated GIFs.
+        
+        Fix by setting a flag in flushPendingLayerChanges() if we're unattached. Consult the flag
+        when re-attaching the root layer, and if it's set, flush the GraphicsLayers.
+        
+        Not testable because we can't test detaching and re-adding web views in DRT/WTR.
+
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::RenderLayerCompositor): Initialize m_shouldFlushOnReattach to false.
+        (WebCore::RenderLayerCompositor::flushPendingLayerChanges): If the root layer attachment
+        is RootLayerUnattached, set the m_shouldFlushOnReattach flag before returning.
+        (WebCore::RenderLayerCompositor::attachRootLayer): If m_shouldFlushOnReattach, flush the layers,
+        saying that we're the flush root.
+        * rendering/RenderLayerCompositor.h:
+        (RenderLayerCompositor): Add m_shouldFlushOnReattach flag.
+
+2012-10-23  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r132276.
+        http://trac.webkit.org/changeset/132276
+        https://bugs.webkit.org/show_bug.cgi?id=100189
+
+        It broke the Qt-WK2 build intentionally (Requested by
+        Ossy_night on #webkit).
+
+        * page/Frame.h:
+        * platform/graphics/GraphicsLayer.cpp:
+        (showGraphicsLayerTree):
+        * platform/graphics/GraphicsLayer.h:
+        (WebCore::GraphicsLayer::tiledBacking):
+        * platform/graphics/TiledBacking.h:
+        * platform/graphics/ca/GraphicsLayerCA.cpp:
+        (WebCore::GraphicsLayerCA::tiledBacking):
+        (WebCore::GraphicsLayerCA::dumpAdditionalProperties):
+        * platform/graphics/ca/GraphicsLayerCA.h:
+        (GraphicsLayerCA):
+        * platform/graphics/ca/mac/TileCache.h:
+        * platform/graphics/ca/mac/TileCache.mm:
+        (WebCore::TileCache::tileCoverageRect):
+        (WebCore::TileCache::revalidateTiles):
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::layerTreeAsText):
+        * testing/Internals.cpp:
+        (WebCore::Internals::layerTreeAsText):
+        * testing/Internals.h:
+        * testing/Internals.idl:
+
+2012-10-23  Philip Rogers  <pdr@google.com>
+
+        Add extra check for data() in PageSerializer.
+        https://bugs.webkit.org/show_bug.cgi?id=99102
+
+        Reviewed by Eric Seidel.
+
+        The image returned from imageForRenderer() does not contain the raw SVG data
+        so this patch adds a check for image->image()->data() before writing SVG
+        in PageSerializer::addImageToResources.
+
+        Covered by existing test WebPageNewSerializeTest.SVGImageDontCrash.
+
+        * page/PageSerializer.cpp:
+        (WebCore::PageSerializer::addImageToResources):
+
+2012-10-23  Kent Tamura  <tkent@chromium.org>
+
+        Move appendAsLDMLLiteral in LocaleWin.cpp to a common place
+        https://bugs.webkit.org/show_bug.cgi?id=100129
+
+        Reviewed by Kentaro Hara.
+
+        We're going to use appendAsLDMLLiteral in other code, and it is
+        related to DateTimeFormat class.  So we move it to DateTimeFormat
+        class as quoteAndAppendLiteral.
+
+        No new tests because of no behavior change.
+
+        * platform/text/DateTimeFormat.cpp:
+        (WebCore::DateTimeFormat::quoteAndAppendLiteral):
+        Moved from LocaleWin.cpp
+        * platform/text/DateTimeFormat.h:
+        Declare StringBuilder by wtf/Forward.h. It also declares String.
+        (DateTimeFormat): Declare quoteAndAppendLiteral.
+        * platform/text/LocaleWin.cpp:
+        (WebCore): Move appendLDMLLiteral to DateTimeFormat.
+        (WebCore::convertWindowsDateFormatToLDML):
+        Follow the moving.
+
+2012-10-23  Kent Tamura  <tkent@chromium.org>
+
+        REGRESSION(r131421): Text baseline is not aligned in some locales
+        https://bugs.webkit.org/show_bug.cgi?id=100088
+
+        Reviewed by Hajime Morita.
+
+        Before this patch, the element with ::-webkit-datetime-edit had
+        -webkit-align-items:center. It was incorrect at all because it
+        ignores baselines of each of inner fields. We need to change it to
+        -webkit-align-items:baseline, or stop using -webkit-flex.
+
+        However -webkit-align-items:baseline doesn't work because a spin
+        button element in the element doesn't have the baseline. If we
+        specified -webkit-align-items:baseline, the spin button would
+        shift up.
+
+        So, we change the element structure for multiple fields input
+        elements. Before this patch, the structure was:
+
+        input
+          |
+           - ::-webkit-date-and-time-container (flex cotainer)
+             |
+             |- ::-webkit-datetime-edit (has flexibility in date-and-time-container, also this is a flex container)
+             |  |- ::-webkit-datetime-edit-foo
+             |  |      :
+             |  |
+             |  |- ::-webkit-date-time-edit-gap  (has flexibility in datetime-edit)
+             |   - ::-webkit-inne-spin-button
+              - ::-webkit-calendar-picker-indicator
+
+        After the patch, the structure will be:
+
+        input
+          |
+           - ::-webkit-date-and-time-container (flexible box)
+             |
+             |- ::-webkit-datetime-edit (has flexibility in date-and-time-container)
+             |  |- ::-webkit-datetime-edit-foo
+             |  |      :
+             |  |
+             |
+             |- ::-webkit-inne-spin-button
+              - ::-webkit-calendar-picker-indicator
+
+        Because the spin button owner is date-and-time-container, we don't
+        need to make the datetime-edit element a flex container.
+
+        Also, we had rounding error by subpixel layout. To avoid it, we
+        stop using fractional paddings.
+
+        In order to implement this, we need to change the SpinButtonOwner
+        interface provider from DateTimeEditElement to
+        BaseMultipleFieldsDateAndTimeInputType.
+
+        No new tests. Covered by month-multiple-fields-appearance-l10n.html.
+
+        * css/html.css:
+        (input::-webkit-datetime-edit): Stop making this a flex
+        container. Inner fields in this use the single baseline.
+        (input::-webkit-datetime-edit-ampm-field):
+        Don't use fractional paddings to avoid rounding erros of subpixel
+        layout.  Use integral margin instead to avoid overwrap of focus
+        ring and background-color of the field.
+        (input::-webkit-datetime-edit-day-field): Ditto.
+        (input::-webkit-datetime-edit-hour-field): Ditto.
+        (input::-webkit-datetime-edit-millisecond-field): Ditto.
+        (input::-webkit-datetime-edit-minute-field): Ditto.
+        (input::-webkit-datetime-edit-month-field): Ditto.
+        (input::-webkit-datetime-edit-second-field): Ditto.
+        (input::-webkit-datetime-edit-week-field): Ditto.
+        (input::-webkit-datetime-edit-year-field): Ditto.
+        (input::-webkit-date-and-time-container): Ditto.
+
+        * html/BaseMultipleFieldsDateAndTimeInputType.h:
+        (BaseMultipleFieldsDateAndTimeInputType): Overrides
+        SpinButtonOwner functions, and add m_spinButtonElement.
+        * html/BaseMultipleFieldsDateAndTimeInputType.cpp:
+        (WebCore::BaseMultipleFieldsDateAndTimeInputType::focusAndSelectSpinButtonOwner):
+        Just delegate to DateTimeEditElement::focusIfNoFocus.
+        (WebCore::BaseMultipleFieldsDateAndTimeInputType::shouldSpinButtonRespondToMouseEvents):
+        Moved from DateTimeEditElement::shouldSpinButtonRespondToMouseEvents.
+        (WebCore::BaseMultipleFieldsDateAndTimeInputType::shouldSpinButtonRespondToWheelEvents):
+        Moved from DateTimeEditElement::shouldSpinButtonRespondToWheelEvents.
+        (WebCore::BaseMultipleFieldsDateAndTimeInputType::spinButtonStepDown):
+        Delegate to DateTimeEditElement::stepDown.
+        (WebCore::BaseMultipleFieldsDateAndTimeInputType::spinButtonStepUp):
+        Delegate to DateTimeEditElement::stepUp.
+        (WebCore::BaseMultipleFieldsDateAndTimeInputType::BaseMultipleFieldsDateAndTimeInputType):
+        Initialize m_spinButtonElement.
+        (WebCore::BaseMultipleFieldsDateAndTimeInputType::~BaseMultipleFieldsDateAndTimeInputType):
+        Reset SpinButtonOwner for m_spinButtonElement like the old code of ~DateTimeEditElement.
+        (WebCore::BaseMultipleFieldsDateAndTimeInputType::createShadowSubtree):
+        Put a SpinButtonElement between the DateTimeEditElement and the PickerIndicatorElement.
+        (WebCore::BaseMultipleFieldsDateAndTimeInputType::forwardEvent):
+        Take care of SpinButtonElement.
+        (WebCore::BaseMultipleFieldsDateAndTimeInputType::disabledAttributeChanged):
+        Release capture of SpinButtonElement. This corresponds to the old
+        code of DateTimeEditElement::updateUIState.
+        (WebCore::BaseMultipleFieldsDateAndTimeInputType::readonlyAttributeChanged): Ditto.
+
+        * html/TextFieldInputType.h:
+        Make SpinButtonElement::SpinButtonOwner protected to allow overriding.
+
+        * html/shadow/DateTimeEditElement.h:
+        (DateTimeEditElement): Remove SpniButtonOwner implementation,
+        m_spinButton, and rename some functions.
+        * html/shadow/DateTimeEditElement.cpp:
+        (WebCore::DateTimeEditElement::DateTimeEditElement):
+        Remove m_spinButton.
+        (WebCore::DateTimeEditElement::~DateTimeEditElement): Ditto.
+        (WebCore::DateTimeEditElement::focusIfNoFocus):
+        Renamed from focusAndSelectSpinButtonOwner. This is called
+        BaseMultipleFieldsDateAndTimeInputType::focusAndSelectSpinButtonOwner.
+        (WebCore::DateTimeEditElement::layout):
+        Remove creation code for -webkit-datetime-edit-gap and SpinButtonElement.
+        (WebCore::DateTimeEditElement::defaultEventHandler):
+        Move the code for m_spinButton to
+        BaseMultipleFieldsDateAndTimeInputType::forwardEvent.
+        (WebCore::DateTimeEditElement::hasFocusedField): A helper for
+        BaseMultipleFieldsDateAndTimeInputType::shouldSpinButtonRespondToWheelEvents.
+        (WebCore::DateTimeEditElement::stepDown): A helper for
+        BaseMultipleFieldsDateAndTimeInputType::spinButtonStepDown.
+        (WebCore::DateTimeEditElement::stepUp): A helper for
+        BaseMultipleFieldsDateAndTimeInputType::spinButtonStepUp.
+        (WebCore::DateTimeEditElement::updateUIState): Move the code to
+        BaseMultipleFieldsDateAndTimeInputType::disabledAttributeChanged
+        and readonlyAttributeChanged.
+
+2012-10-23  Andreas Kling  <kling@webkit.org>
+
+        Shrink immutable ElementAttributeData and StylePropertySet by one pointer each.
+        <http://webkit.org/b/100123>
+
+        Reviewed by Anders Carlsson.
+
+        Remove one pointer of unintentional padding in the immutable versions of these objects.
+        583kB progression on Membuster3.
+
+        * css/StylePropertySet.cpp:
+        (WebCore::immutableStylePropertySetSize):
+        * dom/ElementAttributeData.cpp:
+        (WebCore::immutableElementAttributeDataSize):
+
+2012-10-23  Nate Chapin  <japhet@chromium.org>
+
+        Crash in WebCore::SubresourceLoader::willSendRequest.
+        https://bugs.webkit.org/show_bug.cgi?id=100147
+
+        Reviewed by Abhishek Arya.
+
+        No new tests. There is a test case that should cover this, but it doesn't
+        work correctly on many platforms due to its use of testRunner.addURLToRedirect().
+        See http/tests/loading/cross-origin-XHR-willLoadRequest.html.
+        Tested manually on http://www.nick.co.uk/shows/spongebob
+
+        * loader/SubresourceLoader.cpp:
+        (WebCore::SubresourceLoader::willSendRequest):
+
+2012-10-23  Martin Robinson  <mrobinson@igalia.com>
+
+        [GTK][Soup] Implement the default authentication dialog via WebCoreSupport
+        https://bugs.webkit.org/show_bug.cgi?id=99351
+
+        Reviewed by Carlos Garcia Campos.
+
+        Instead of connecting to the SoupSession::authenticate signal in the API layer
+        via a SoupSessionFeature, route the message through the typical WebCore authentication
+        mechanism. This is a step on the path to having full-blown support for authentication
+        in the API allowing for custom authentication dialogs and behavior in clients.
+
+        No new tests. This should not change behavior.
+
+        * GNUmakefile.list.am: Add the new implementation file for the AuthenticationChallenge.
+        * loader/ResourceLoader.cpp:
+        (WebCore::ResourceLoader::didReceiveAuthenticationChallenge): Include GTK+ here as well.
+        * platform/gtk/GtkAuthenticationDialog.cpp: Instead of carrying a raw pointer to a SoupAuth
+        carry a GRefPtr which will allow the dialog to be used even after the AuthenticationChallenge
+        is destroyed.
+        * platform/gtk/GtkAuthenticationDialog.h: ditto.
+        * platform/network/ResourceHandle.h: Add a didReceiveAuthenticationChallenge method.
+        * platform/network/ResourceHandleInternal.h:
+        (ResourceHandleInternal): Remove the getter for the initiating page ID.
+        * platform/network/soup/AuthenticationChallenge.h: Added an implementation of AuthenticationChallenge
+        that takes a bit of data from the handle including SoupMessage, SoupAuth, and SoupSession.
+        * platform/network/soup/AuthenticationChallengeSoup.cpp: Added. Ditto.
+        * platform/network/soup/ResourceError.h:
+        (ResourceError): Added a factory for authentication errors.
+        * platform/network/soup/ResourceErrorSoup.cpp: Ditto.
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::setSoupRequestInitiaingPageID): Just get the page directly from the NetworkingContext.
+        (WebCore::createSoupMessageForHandleAndRequest): Always set the "handle" data on the message.
+        It's always used now.
+        (WebCore::ResourceHandle::start): Get the initiating page ID directly from the NetworkingContext.
+        (WebCore::ResourceHandle::didReceiveAuthenticationChallenge): Added this method which routes
+        the authentication challenge to the client.
+        (WebCore::ResourceHandle::receivedRequestToContinueWithoutCredential): Added a stub for this method.
+        (WebCore::ResourceHandle::loadResourceSynchronously): Don't pass the session to the loader.
+        (WebCore::authenicateCallback): Added.
+        (WebCore::ResourceHandle::defaultSession): Connect the authenticate callback.
+
+2012-10-23  Adam Barth  <abarth@webkit.org>
+
+        [V8] Simplify GCEpilogueVisitor along the same lines as GCPrologueVisitor
+        https://bugs.webkit.org/show_bug.cgi?id=100157
+
+        Reviewed by Eric Seidel.
+
+        This patch removes the traits template parameter from GCEpilogueVisitor
+        and makes it mirror GCPrologueVisitor again.
+
+        * bindings/v8/V8GCController.cpp:
+        (WebCore):
+        (ActiveDOMObjectEpilogueVisitor):
+        (WebCore::ActiveDOMObjectEpilogueVisitor::ActiveDOMObjectEpilogueVisitor):
+        (WebCore::ActiveDOMObjectEpilogueVisitor::visitDOMWrapper):
+        (WebCore::V8GCController::majorGCEpilogue):
+
+2012-10-23  Varun Jain  <varunjain@chromium.org>
+
+        Context menu generated from touch gestures on textareas has
+        context of the cursor position instead of the position where the event occurs.
+        https://bugs.webkit.org/show_bug.cgi?id=99520
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Send a synthetic mouse down event for context menu-summoning-gesture events so
+        that textareas can correctly set cursors before receiving the context menu event.
+
+        Test: fast/events/touch/gesture/right-click-gestures-set-cursor-at-correct-position.html
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::handleGestureEvent):
+        (WebCore::EventHandler::handleGestureTwoFingerTap):
+        (WebCore):
+        (WebCore::EventHandler::sendContextMenuEventForGesture):
+        * page/EventHandler.h:
+        (EventHandler):
+
+2012-10-23  Andy Estes  <aestes@apple.com>
+
+        [WebKit2 API] Add properties to get textRects from a WKDOMRange or WKDOMNode
+        https://bugs.webkit.org/show_bug.cgi?id=100162
+
+        Reviewed by Sam Weinig.
+
+        * WebCore.exp.in: Exported symbols needed by WebKit2.
+        * bindings/objc/DOM.mm:
+        (-[DOMNode textRects]): Moved some logic into Node::textRects()
+        (everything but the call to updateLayoutIgnorePendingStylesheets()).
+        * dom/Node.cpp:
+        (WebCore::Node::textRects):
+        * dom/Node.h:
+
+2012-10-23  Adam Barth  <abarth@webkit.org>
+
+        [V8] Remove unused function from DOM wrapper visitor
+        https://bugs.webkit.org/show_bug.cgi?id=100163
+
+        Reviewed by Eric Seidel.
+
+        No one overrides these virtual functions. They were added in
+        http://trac.webkit.org/changeset/73491, but we don't use them in the GC
+        controller anymore.
+
+        * bindings/v8/V8DOMMap.h:
+        (WebCore::WeakReferenceMap::visit):
+
+2012-10-23  Aaron Colwell  <acolwell@chromium.org>
+
+        Clear m_mediaSource reference when the MediaSource is closed
+        https://bugs.webkit.org/show_bug.cgi?id=100047
+
+        Reviewed by Eric Carlson.
+
+        The m_mediaSource object shouldn't be accessed after the object
+        transitions to closed so this change simply clears the reference
+        when that transition happens.
+
+        No new tests because the change isn't visible to JavaScript.
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::loadResource): Removed a closed transition that is actually dead code.
+        (WebCore::HTMLMediaElement::setSourceState): Clear the m_mediaSource reference on closed transition.
+
+2012-10-23  Simon Fraser  <simon.fraser@apple.com>
+
+        Allow tests to run with a tile cache, and optionally dump the tile cache via layerTreeAsText()
+        https://bugs.webkit.org/show_bug.cgi?id=100159
+
+        Reviewed by Tim Horton.
+
+        Add a LAYER_TREE_INCLUDES_PAGE_TILE_CACHE flag for layerTreeAsText(), and plumb it
+        through to GraphicsLayerCA, which dumps the TiledBacking tile coverage rect.
+
+        Test: platform/mac/tiled-drawing/use-tiled-drawing.html
+
+        * page/Frame.h:
+        * platform/graphics/GraphicsLayer.cpp:
+        (showGraphicsLayerTree):
+        * platform/graphics/GraphicsLayer.h:
+        (WebCore::GraphicsLayer::tiledBacking):
+        * platform/graphics/TiledBacking.h:
+        * platform/graphics/ca/GraphicsLayerCA.cpp:
+        (WebCore::GraphicsLayerCA::tiledBacking):
+        (WebCore::GraphicsLayerCA::dumpAdditionalProperties):
+        * platform/graphics/ca/GraphicsLayerCA.h:
+        (GraphicsLayerCA):
+        * platform/graphics/ca/mac/TileCache.h:
+        (WebCore::TileCache::tileCoverageRect):
+        (TileCache):
+        * platform/graphics/ca/mac/TileCache.mm:
+        (WebCore::TileCache::computeTileCoverageRect):
+        (WebCore::TileCache::revalidateTiles):
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::layerTreeAsText):
+        * testing/Internals.cpp:
+        (WebCore::Internals::layerTreeAsText):
+        * testing/Internals.h:
+        * testing/Internals.idl:
+
+2012-10-23  No'am Rosenthal  <noam.rosenthal@nokia.com>
+
+        Coordinated Graphics: Enable threaded/IPC animations
+        https://bugs.webkit.org/show_bug.cgi?id=93146
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Add enablers to TextureMapper and GraphicsLayerAnimation so that they could be used
+        across processes with IPC. Added some public accessors to GraphicsLayerAnimation,
+        and allowed a GraphicsLayerTextureMapper to receive a full list of animations.
+
+        Covered by existing animation and compositing tests.
+
+        * platform/graphics/GraphicsLayerAnimation.cpp:
+        (WebCore::GraphicsLayerAnimation::GraphicsLayerAnimation):
+            Initialize the animation with the startTime instead of the offset.
+
+        (WebCore::GraphicsLayerAnimations::getActiveAnimations):
+        * platform/graphics/GraphicsLayerAnimation.h:
+        (WebCore::GraphicsLayerAnimation::setState):
+            Allow setting the pause time as well.
+
+        (WebCore::GraphicsLayerAnimation::boxSize):
+        (WebCore::GraphicsLayerAnimation::startTime):
+        (WebCore::GraphicsLayerAnimation::pauseTime):
+        (WebCore::GraphicsLayerAnimation::animation):
+        (WebCore::GraphicsLayerAnimation::keyframes):
+        (WebCore::GraphicsLayerAnimation::listsMatch):
+        (WebCore::GraphicsLayerAnimations::size):
+        (WebCore::GraphicsLayerAnimations::animations):
+            Add public accessors to GraphicsLayerAnimation properties.
+
+        (GraphicsLayerAnimation):
+        (GraphicsLayerAnimations):
+        * platform/graphics/texmap/GraphicsLayerTextureMapper.cpp:
+        (WebCore::GraphicsLayerTextureMapper::addAnimation):
+        (WebCore::GraphicsLayerTextureMapper::setAnimations):
+            Allow replacing the entire list of animations.
+
+        (WebCore):
+        * platform/graphics/texmap/GraphicsLayerTextureMapper.h:
+        (GraphicsLayerTextureMapper):
+        * platform/graphics/texmap/TextureMapperLayer.cpp:
+        (WebCore::TextureMapperLayer::applyAnimationsRecursively):
+        (WebCore):
+        * platform/graphics/texmap/TextureMapperLayer.h:
+        (TextureMapperLayer):
+
+2012-10-23  Chris Rogers  <crogers@google.com>
+
+        Change setTargetValueAtTime() to setTargetAtTime()
+        https://bugs.webkit.org/show_bug.cgi?id=100153
+
+        Reviewed by Adam Barth.
+
+        The AudioParam method name has changed due to Web Audio API spec review.
+        Keep legacy support for the old name.
+
+        Test: webaudio/audioparam-setTargetAtTime.html
+
+        * Modules/webaudio/AudioParam.h:
+        (WebCore::AudioParam::setTargetAtTime):
+        * Modules/webaudio/AudioParam.idl:
+        * Modules/webaudio/AudioParamTimeline.cpp:
+        (WebCore::AudioParamTimeline::setTargetAtTime):
+        (WebCore::AudioParamTimeline::valuesForTimeRangeImpl):
+        * Modules/webaudio/AudioParamTimeline.h:
+        (AudioParamTimeline):
+
+2012-10-23  Benjamin Poulain  <benjamin@webkit.org>
+
+        [Mac] Remove extraneous conversion to String->NSString
+        https://bugs.webkit.org/show_bug.cgi?id=100044
+
+        Reviewed by Darin Adler.
+
+        Improve some unfortunate use of String->NSString.
+
+        * accessibility/mac/AXObjectCacheMac.mm:
+        (WebCore::AXObjectCache::postPlatformNotification): The variable macNotification is ultimately
+        needed as NSString, and all its value are or can be NSString.
+        Convert the last 3 char* values to NSString literal and use NSString* all the way.
+
+        * loader/mac/LoaderNSURLExtras.h:
+        * loader/mac/LoaderNSURLExtras.mm:
+        (suggestedFilenameWithMIMEType):
+        We converted the String to NSString to pass to suggestedFilenameWithMIMEType. There is no need
+        for the string to be a NSSTring there, we can leave it in its original type.
+
+        The case checking for a nil MIMEType was dead code because the implicit conversion never returns nil.
+
+        * platform/mac/DragImageMac.mm:
+        (WebCore::createDragImageForLink):
+        Use String's nsStringNilIfEmpty().
+
+        * platform/mac/HTMLConverter.mm:
+        (-[WebHTMLConverter _addAttachmentForElement:URL:needsParagraph:usePlaceholder:]):
+        Fix the coding style. Do the conversion to NSString only when needed.
+
+2012-10-23  Roger Fong  <roger_fong@apple.com>
+
+        [Win] Popup menus positioning needs to take multiple monitors into account.
+        https://bugs.webkit.org/show_bug.cgi?id=100158
+
+        Reviewed by Timothy Horton.
+
+        Add screen.x() to repositioning check to account for position of current monitor.
+
+        * platform/win/PopupMenuWin.cpp:
+        (WebCore::PopupMenuWin::calculatePositionAndSize):
+
+2012-10-23  Huang Dongsung  <luxtella@company100.net>
+
+        [CSS Shaders] Set FilterOperations on GraphicsLayer after the program of CSS Shaders is loaded.
+        https://bugs.webkit.org/show_bug.cgi?id=99908
+
+        Reviewed by Dean Jackson.
+
+        CSS Shaders can not render anything until the program is loaded. If there is
+        partial loaded shaders program, whole FilterOperations chain can not render
+        anything. It occurs a flash. So We have to wait until the program is loaded, to
+        prevent a flash as RenderLayerBacking::updateImageContents() waits until an
+        image is fully loaded.
+
+        No new tests, CSS Shaders on Accelerated Compositing are not activated yet.
+
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::updateFilters):
+
+2012-10-23  Elliott Sprehn  <esprehn@chromium.org>
+
+        Generated should not be supported for things with a shadow
+        https://bugs.webkit.org/show_bug.cgi?id=98836
+
+        Reviewed by Dimitri Glazkov.
+
+        As far as CSS is concerned inputs and things with shadow content inside
+        shouldn't support pseudo elements like :before, :after or :first-letter.
+        Neither Gecko or Presto supports it, and we only accidentally supported
+        it.
+
+        Until the spec tells us what to do we should disable support. This is
+        also neccesary because the new generated content implementation doesn't
+        support shadows.
+
+        Test: fast/forms/pseudo-elements.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::updateFirstLetter):
+        * rendering/RenderListBox.h: Added missing canHaveGeneratedChildren() that returns false.
+        * rendering/RenderObjectChildList.cpp:
+        (WebCore::RenderObjectChildList::updateBeforeAfterContent):
+
+2012-10-23  Huang Dongsung  <luxtella@company100.net>
+
+        [CSS Shaders] Implement overlay, color-dodge, color-burn, hard-light, soft-light blend modes.
+        https://bugs.webkit.org/show_bug.cgi?id=98504
+
+        Reviewed by Dean Jackson.
+
+        Add expressions for the aforementioned blend modes. The expressions are lifted
+        directly from the CSS Compositing and Blending spec [1]. WebKit adds these
+        blending expressions to the author's shader.
+
+        [1]: https://dvcs.w3.org/hg/FXTF/rawfile/tip/compositing/index.html#blendingnormal
+
+        Test: css3/filters/custom/custom-filter-blend-modes.html
+
+        * platform/graphics/filters/CustomFilterValidatedProgram.cpp:
+        (WebCore::CustomFilterValidatedProgram::rewriteMixFragmentShader):
+        (WebCore::CustomFilterValidatedProgram::blendFunctionString):
+
+2012-10-23  Huang Dongsung  <luxtella@company100.net>
+
+        [CSS Shaders] Implement all composite operators except destination and lighter.
+        https://bugs.webkit.org/show_bug.cgi?id=97859
+
+        Reviewed by Dean Jackson.
+
+        Add expressions for all composite operators except destination and
+        lighter. The expressions are lifted directly from the CSS Compositing
+        and Blending spec [1]. WebKit adds these compositing expressions to the
+        author's shader.
+
+        [1]: https://dvcs.w3.org/hg/FXTF/rawfile/tip/compositing/index.html#advancedcompositing
+
+        Test: css3/filters/custom/custom-filter-composite-operators.html
+
+        * platform/graphics/filters/CustomFilterCompiledProgram.cpp:
+        (WebCore::CustomFilterCompiledProgram::initializeParameterLocations):
+            Remove ASSERTION checking if glGetUniformLocation returns negative,
+            because ASSERTION can fail with clear and copy composite operations.
+            Clear and copy composite operations do not need "css_u_texture"
+            representing the DOM element texture. If the driver compiler is
+            smart, "css_u_texture" is not regarded as an active uniform, so
+            glGetuniformLocation returns -1. glGetAttribLocation ditto.
+        * platform/graphics/filters/CustomFilterValidatedProgram.cpp:
+        (WebCore::CustomFilterValidatedProgram::compiledProgram):
+            Move the above ASSERTION in CustomFilterCompiledProgram to here.
+            ASSERTION checks if m_samplerLocation is not -1 when the author
+            shader needs an input texture.
+        (WebCore::CustomFilterValidatedProgram::needsInputTexture):
+        (WebCore):
+        (WebCore::CustomFilterValidatedProgram::compositeFunctionString):
+        * platform/graphics/filters/CustomFilterValidatedProgram.h:
+        (CustomFilterValidatedProgram):
+
+2012-10-23  Max Vujovic  <mvujovic@adobe.com>
+
+        [CSS Shaders] Changing the blend mode in CSS doesn't update the custom filter rendering
+        https://bugs.webkit.org/show_bug.cgi?id=99887
+
+        Reviewed by Dirk Schulze.
+
+        Before this patch, WebKit would not recompute an element's style when just its custom filter
+        blend mode changed.
+
+        For example, suppose an element initially has the style:
+        -webkit-filter: custom(none mix(url(shader.fs) multiply source-atop));
+
+        Then, we change the blend mode from "multiply" to "normal":
+        -webkit-filter: custom(none mix(url(shader.fs) normal source-atop));
+
+        WebKit now detects this change and recomputes the style.
+
+        CustomFilterProgram now has an equals operator that considers the program type and the mix
+        settings. The mix settings contain the blend mode.
+
+        Test: css3/filters/custom/custom-filter-change-blend-mode.html
+
+        * platform/graphics/filters/CustomFilterProgram.cpp:
+        (WebCore::CustomFilterProgram::operator==):
+            Previously, the equals operator was pure virtual in CustomFilterProgram. Now,
+            CustomFilterProgram implements it and compares the program type and mix settings, if
+            appropriate.
+        (WebCore):
+        * platform/graphics/filters/CustomFilterProgram.h:
+        * platform/graphics/filters/CustomFilterProgramInfo.cpp:
+        (WebCore::CustomFilterProgramInfo::hash):
+            Refactor a repeated condition into a boolean to improve readability.
+        (WebCore::CustomFilterProgramInfo::operator==):
+            Refactor repeated conditions to improve readability. Reorder the conditions so the less
+            expensive ones occur first.
+        * rendering/style/StyleCustomFilterProgram.h:
+        (WebCore::StyleCustomFilterProgram::operator==):
+            Call the base class's equals operator.
+
+2012-10-23  David Barton  <dbarton@mathscribe.com>
+
+        [MathML] Symbol font uses greek letters for roman ones on linux and Windows
+        https://bugs.webkit.org/show_bug.cgi?id=99921
+
+        Reviewed by Eric Seidel.
+
+        For parts of stretched parentheses and brackets, mathml.css currently uses the Symbol font,
+        which on linux and Windows has greek letters at roman code points. To fix this, we switch
+        to the STIXSizeOneSym font when available. However, this can cause vertical gaps between
+        glyph parts, because of hard-coded constants in RenderMathMLOperator.cpp. We eliminate all
+        these constants. We also shift glyphs upward by 1px and truncate them to avoid the gaps.
+
+        Tested by existing tests, and one test added to LayoutTests/mathml/presentation/mo.xhtml.
+
+        * css/mathml.css:
+        (math, mfenced > *):
+            - Set font-family for mn, mi, etc.
+        (mo, mfenced):
+            - Set font-family for mo and anonymous operators, including extension glyphs for
+              stretched operators like parentheses and brackets.
+        (math):
+        * rendering/mathml/RenderMathMLOperator.cpp:
+        (WebCore):
+            - Change 0x23d0 to 0x23aa for STIX & Cambria Math fonts.
+        (WebCore::RenderMathMLOperator::glyphHeightForCharacter):
+        (WebCore::RenderMathMLOperator::updateFromElement):
+        (WebCore::RenderMathMLOperator::createStackableStyle):
+            - Eliminate unused lineHeight and topRelative parameters, and the hard-coded font size
+              of 14.
+        (WebCore::RenderMathMLOperator::createGlyph):
+            - Eliminate unused lineHeight and topRelative parameters.
+        * rendering/mathml/RenderMathMLOperator.h:
+        (RenderMathMLOperator):
+
+2012-10-23  Benjamin Poulain  <benjamin@webkit.org>
+
+        WTFURL: Implement KURL::setPort()
+        https://bugs.webkit.org/show_bug.cgi?id=99898
+
+        Reviewed by Adam Barth.
+
+        * platform/KURLWTFURL.cpp:
+        (WebCore::KURL::setPort):
+
+2012-10-23  Nico Weber  <thakis@chromium.org>
+
+        In the open-source jpeg decoder, read image orientation from the exif data
+        https://bugs.webkit.org/show_bug.cgi?id=100144
+
+        Reviewed by Eric Seidel.
+
+        This will be used to implement the shouldRespectImageOrientation
+        setting (see bug 19688). Currently this isn't hooked up anywhere, so
+        it has no observable effect for now.
+
+        Once it's hooked up, it will be tested by
+        fast/images/exif-orientation.html
+
+        * platform/graphics/BitmapImage.h:
+        * platform/image-decoders/ImageDecoder.h:
+        (WebCore::ImageDecoder::orientation):
+        (ImageDecoder):
+        * platform/image-decoders/jpeg/JPEGImageDecoder.cpp:
+        (WebCore::readUint16):
+        (WebCore):
+        (WebCore::readUint32):
+        (WebCore::checkExifHeader):
+        (WebCore::readImageOrientation):
+        (WebCore::JPEGImageReader::JPEGImageReader):
+        (WebCore::JPEGImageReader::decode):
+        * platform/image-decoders/jpeg/JPEGImageDecoder.h:
+        (WebCore::JPEGImageDecoder::setOrientation):
+
+2012-10-23  Chris Rogers  <crogers@google.com>
+
+        Fix thread safety issue in AudioParamTimeline
+        https://bugs.webkit.org/show_bug.cgi?id=100154
+
+        Reviewed by Kenneth Russell.
+
+        Add appropriate locking in AudioParamTimeline::valueForContextTime()
+
+        * Modules/webaudio/AudioParamTimeline.cpp:
+        (WebCore::AudioParamTimeline::valueForContextTime):
+
+2012-10-23  Alec Flett  <alecflett@chromium.org>
+
+        IndexedDB: refactor backend to use IDB*Metadata
+        https://bugs.webkit.org/show_bug.cgi?id=100055
+
+        Reviewed by Tony Chang.
+
+        This further encapsulates the static data in
+        IDBObjectStoreBackendImpl and IDBIndexBackendImp into their
+        respective IDB*Metadata structs, in preparation for
+        https://bugs.webkit.org/show_bug.cgi?id=99774.
+
+        No new tests as this is purely a refactor.
+
+        * Modules/indexeddb/IDBBackingStore.h:
+        (IDBBackingStore):
+        * Modules/indexeddb/IDBDatabaseBackendImpl.cpp:
+        (WebCore::IDBDatabaseBackendImpl::createObjectStore):
+        (WebCore::IDBDatabaseBackendImpl::loadObjectStores):
+        * Modules/indexeddb/IDBIndexBackendImpl.cpp:
+        (WebCore::IDBIndexBackendImpl::IDBIndexBackendImpl):
+        (WebCore::IDBIndexBackendImpl::metadata):
+        * Modules/indexeddb/IDBIndexBackendImpl.h:
+        (WebCore::IDBIndexBackendImpl::create):
+        (WebCore::IDBIndexBackendImpl::id):
+        (WebCore::IDBIndexBackendImpl::setId):
+        (WebCore::IDBIndexBackendImpl::hasValidId):
+        (WebCore::IDBIndexBackendImpl::name):
+        (WebCore::IDBIndexBackendImpl::keyPath):
+        (WebCore::IDBIndexBackendImpl::unique):
+        (WebCore::IDBIndexBackendImpl::multiEntry):
+        (IDBIndexBackendImpl):
+        * Modules/indexeddb/IDBLevelDBBackingStore.cpp:
+        (WebCore::IDBLevelDBBackingStore::getObjectStores):
+        (WebCore::IDBLevelDBBackingStore::getIndexes):
+        * Modules/indexeddb/IDBLevelDBBackingStore.h:
+        (IDBLevelDBBackingStore):
+        * Modules/indexeddb/IDBMetadata.h:
+        (WebCore::IDBObjectStoreMetadata::IDBObjectStoreMetadata):
+        * Modules/indexeddb/IDBObjectStoreBackendImpl.cpp:
+        (WebCore::IDBObjectStoreBackendImpl::IDBObjectStoreBackendImpl):
+        (WebCore::IDBObjectStoreBackendImpl::metadata):
+        (WebCore::IDBObjectStoreBackendImpl::setIndexKeys):
+        (WebCore::IDBObjectStoreBackendImpl::putInternal):
+        (WebCore::IDBObjectStoreBackendImpl::createIndex):
+        (WebCore::IDBObjectStoreBackendImpl::loadIndexes):
+        * Modules/indexeddb/IDBObjectStoreBackendImpl.h:
+        (WebCore::IDBObjectStoreBackendImpl::create):
+        (WebCore::IDBObjectStoreBackendImpl::id):
+        (WebCore::IDBObjectStoreBackendImpl::setId):
+        (WebCore::IDBObjectStoreBackendImpl::name):
+        (WebCore::IDBObjectStoreBackendImpl::keyPath):
+        (WebCore::IDBObjectStoreBackendImpl::autoIncrement):
+        (IDBObjectStoreBackendImpl):
+
+2012-10-19  Roger Fong  <roger_fong@apple.com>
+
+        [WebGL] conformance/textures/texture-size.html is failing on Apple Mountain Lion
+        https://bugs.webkit.org/show_bug.cgi?id=94041
+
+        Reviewed by Dean Jackson.
+
+        When binding a texture to GL_TEXTURE_2D when GL_ACTIVE_TEXTURE is 0, we set m_boundTexture0 to the texture unit. 
+        However when we delete the texture, we need to be setting m_boundTexture0 to 0.
+        Otherwise when we draw to the screen we bind m_boundTexture0 in the prepareTexture() method and since the associated texture 
+        has already been deleted we end up in an error state.
+
+        Tested using Khronos WebGL conformance suite:
+        conformance/textures/texture-size.html
+
+        * platform/graphics/opengl/GraphicsContext3DOpenGLCommon.cpp:
+        (WebCore::GraphicsContext3D::deleteTexture):
+
+2012-10-22  Dirk Schulze  <krit@webkit.org>
+
+        BasicShapePolygon::path takes width instead of height for boundary calculation
+        https://bugs.webkit.org/show_bug.cgi?id=99919
+
+        Reviewed by Darin Adler.
+
+        The 'y' parameters of polygon were calculated by the with of the bounding box of the object.
+        This caused problems on percentage values for point positions. 
+        Changed it to the height of the bounding box.
+
+        Test: css3/masking/clip-path-polygon-percentage.html
+
+        * rendering/style/BasicShapes.cpp:
+        (WebCore::BasicShapePolygon::path):
+
+2012-10-23  Dominik Röttsches  <dominik.rottsches@intel.com>
+
+        Add timeout support to XMLHttpRequest
+        https://bugs.webkit.org/show_bug.cgi?id=74802
+
+        Reviewed by Nate Chapin.
+
+        An implementation of XHR2 timeouts by using ResourceRequest's setTimeoutInterval.
+        This made several changes necessary in CachedResource and SubresourceLoader in order
+        to distinguish and forward the timeout case from there.
+
+        The case of late updates to the timeout property, changing the timeout value after send()
+        is not supported yet and handled separately in bug 98156.
+
+        XHR2 timeout tests were initially written by Mozilla's Alex Vincent's. He granted
+        permission to reuse them under PD/BSD license
+        in https://bugzilla.mozilla.org/show_bug.cgi?id=525816#c86 - big thanks!
+        I adapted them for W3C testharness.js and split them into groups with shorter test running time
+        so that they can be used as WebKit layout tests.
+
+        Tests: http/tests/xmlhttprequest/timeout/xmlhttprequest-timeout-aborted.html
+               http/tests/xmlhttprequest/timeout/xmlhttprequest-timeout-abortedonmain.html
+               http/tests/xmlhttprequest/timeout/xmlhttprequest-timeout-overridesexpires.html
+               http/tests/xmlhttprequest/timeout/xmlhttprequest-timeout-simple.html
+               http/tests/xmlhttprequest/timeout/xmlhttprequest-timeout-synconmain.html
+               http/tests/xmlhttprequest/timeout/xmlhttprequest-timeout-twice.html
+               http/tests/xmlhttprequest/timeout/xmlhttprequest-timeout-worker-aborted.html
+               http/tests/xmlhttprequest/timeout/xmlhttprequest-timeout-worker-overridesexpires.html
+               http/tests/xmlhttprequest/timeout/xmlhttprequest-timeout-worker-simple.html
+               http/tests/xmlhttprequest/timeout/xmlhttprequest-timeout-worker-synconworker.html
+               http/tests/xmlhttprequest/timeout/xmlhttprequest-timeout-worker-twice.html
+
+        * loader/DocumentThreadableLoader.cpp:
+        (WebCore::DocumentThreadableLoader::notifyFinished): Forward information about timeout case.
+        * loader/SubresourceLoader.cpp:
+        (WebCore::SubresourceLoader::didFail): Distinguish timeout case when informing client.
+        * loader/cache/CachedResource.h: Distinguishing timeout case for errors.
+        (WebCore::CachedResource::errorOccurred):
+        (WebCore::CachedResource::loadFailedOrCanceled):
+        (WebCore::CachedResource::timedOut):
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::XMLHttpRequest): Initializing m_timeout value to zero.
+        (WebCore::XMLHttpRequest::setTimeout): Setter function, possibly raising JS exception.
+        (WebCore):
+        (WebCore::XMLHttpRequest::open): Open call may raise exception for synchronous requests when timeout value is set.
+        (WebCore::XMLHttpRequest::createRequest): Assigning timeout value to ResourceRequest.
+        (WebCore::XMLHttpRequest::didFail): Handling timeout case separately.
+        (WebCore::XMLHttpRequest::didTimeout): Timeout case state transisition and event firing as spec'ed.
+        * xml/XMLHttpRequest.h: New event listener, member and callback for handling timeout.
+        (WebCore::XMLHttpRequest::timeout):
+        (XMLHttpRequest):
+        * xml/XMLHttpRequest.idl: New event listener and property added.
+        * xml/XMLHttpRequestException.cpp:
+        * xml/XMLHttpRequestException.h: Added an exception value for the timeout case.
+
+
+2012-10-23  Christophe Dumez  <christophe.dumez@intel.com>
+
+        Possible assertion hit in WebCore::HTMLSelectElement::updateListBoxSelection()
+        https://bugs.webkit.org/show_bug.cgi?id=99967
+
+        Reviewed by Tony Chang.
+
+        Fix assertion hit in WebCore::HTMLSelectElement::updateListBoxSelection() when
+        pressing the left mouse button outside a multiselect and then moving the cursor
+        over the multiselect element while holding the button down.
+
+        The issue is that the HTMLSelectElement handler for the mouse move event does
+        not check if there is a selection before trying to extend the selection.
+
+        Test: fast/dom/HTMLSelectElement/select-selectedIndex-noAnchorIndex-crash.html
+
+        * html/HTMLSelectElement.cpp:
+        (WebCore::HTMLSelectElement::listBoxDefaultEventHandler):
+
+2012-10-23  Adam Barth  <abarth@webkit.org>
+
+        [V8] ScriptWrappable should hold the wrapper handle directly (Dromaeo/dom-modify and dom-traverse get ~2.5% faster)
+        https://bugs.webkit.org/show_bug.cgi?id=97974
+
+        Reviewed by Eric Seidel.
+
+        Previously, we stored a pointer to a handle to a wrapper in Node. That
+        is an extra layer of indirection that slows down finding the wrapper
+        for the node. A handle is just a pointer, so we might as we just store
+        the handle in the Node directly. That speeds up dom-modify and
+        dom-traverse by about 2.5%.
+
+        This change also lets us get rid of the ChunkedTable we were using to
+        store all the wrappers because they're now stored in the Nodes
+        directly.
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+        (GenerateHeader):
+        * bindings/v8/IntrusiveDOMWrapperMap.h:
+        (WebCore::IntrusiveDOMWrapperMap::IntrusiveDOMWrapperMap):
+        (WebCore::IntrusiveDOMWrapperMap::get):
+        (WebCore::IntrusiveDOMWrapperMap::set):
+        (WebCore::IntrusiveDOMWrapperMap::contains):
+        (WebCore::IntrusiveDOMWrapperMap::visit):
+        (WebCore::IntrusiveDOMWrapperMap::removeIfPresent):
+        (WebCore::IntrusiveDOMWrapperMap::clear):
+        * bindings/v8/ScriptWrappable.h:
+        (WebCore::ScriptWrappable::ScriptWrappable):
+        (WebCore::ScriptWrappable::wrapper):
+        (WebCore::ScriptWrappable::setWrapper):
+        (WebCore::ScriptWrappable::disposeWrapper):
+        (WebCore::ScriptWrappable::reportMemoryUsage):
+        (ScriptWrappable):
+        * bindings/v8/V8DOMWrapper.h:
+        (WebCore::V8DOMWrapper::getCachedWrapper):
+
+2012-10-23  Kentaro Hara  <haraken@chromium.org>
+
+        [V8] Replace SetGlobalGCPrologueCallback() with AddGCPrologueCallback()
+        https://bugs.webkit.org/show_bug.cgi?id=100140
+
+        Reviewed by Adam Barth.
+
+        SetGlobalGCPrologueCallback() and SetGlobalGCEpilogueCallback()
+        are deprecated (See http://code.google.com/codesearch#OAMlx_jo-ck/src/v8/include/v8.h&exact_package=chromium&q=v8.h&type=cs&l=3149)
+        Instead we should use AddGCPrologueCallback()
+        and AddGCEpilogueCallback().
+
+        No tests. No change in behavior.
+
+        * bindings/v8/V8DOMWindowShell.cpp:
+        (WebCore::initializeV8IfNeeded):
+        * bindings/v8/V8GCController.cpp:
+        (WebCore::V8GCController::gcPrologue):
+        (WebCore):
+        (WebCore::V8GCController::minorGCPrologue):
+        (WebCore::V8GCController::majorGCPrologue):
+        (WebCore::V8GCController::gcEpilogue):
+        (WebCore::V8GCController::minorGCEpilogue):
+        (WebCore::V8GCController::majorGCEpilogue):
+        * bindings/v8/V8GCController.h:
+        (V8GCController):
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        (WebCore::WorkerContextExecutionProxy::initIsolate):
+
+2012-10-23  Adam Barth  <abarth@webkit.org>
+
+        [V8] Enumerate Nodes via the V8 heap rather than via a list in WebCore
+        https://bugs.webkit.org/show_bug.cgi?id=100033
+
+        Reviewed by Eric Seidel.
+
+        This patch changes how we enumerate nodes during garbage collection.
+        After this patch, we use V8's list of open handles to enumerate node
+        wrappers rather than using a separate list that we maintain in WebCore
+        for this purpose. A future patch will remove the list in WebCore for a
+        DOM performance gain.
+
+        * bindings/js/ScriptProfiler.h:
+        (WebCore):
+        (WebCore::ScriptProfiler::visitNodeWrappers):
+        * bindings/scripts/CodeGeneratorV8.pm:
+        (GenerateToV8Converters):
+        * bindings/scripts/test/V8/V8TestNode.cpp:
+        (WebCore::V8TestNode::wrapSlow):
+        * bindings/v8/IntrusiveDOMWrapperMap.h:
+        (WebCore::IntrusiveDOMWrapperMap::set):
+        * bindings/v8/ScriptProfiler.cpp:
+        (WebCore::ScriptProfiler::visitNodeWrappers):
+        * bindings/v8/ScriptProfiler.h:
+        (WebCore):
+        (ScriptProfiler):
+        * bindings/v8/V8DOMMap.cpp:
+        (WebCore::NodeWrapperVisitor::~NodeWrapperVisitor):
+        (WebCore):
+        (WebCore::visitAllDOMNodes):
+        * bindings/v8/V8DOMMap.h:
+        (WebCore):
+        (NodeWrapperVisitor):
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::setJSWrapperForDOMNode):
+        (WebCore::V8DOMWrapper::setJSWrapperForActiveDOMNode):
+        * bindings/v8/V8GCController.cpp:
+        (WebCore::NodeVisitor::visitNodeWrapper):
+        (WebCore::V8GCController::gcPrologue):
+        (WebCore::V8GCController::gcEpilogue):
+        * inspector/BindingVisitors.h:
+        (WebCore::WrappedNodeVisitor::~WrappedNodeVisitor):
+        * inspector/InspectorMemoryAgent.cpp:
+        (WebCore):
+
+2012-10-22  Andrey Kosyakov  <caseq@chromium.org>
+
+        Web Inspector: paint rectangles are incorrectly shown in case subframes are present
+        https://bugs.webkit.org/show_bug.cgi?id=99849
+
+        Reviewed by Pavel Feldman.
+
+        Move GraphicsContext and paint rectangle from willPaint() to didPaint(), so we don't have
+        to store them as a state of InspectorPageAgent
+
+        * inspector/InspectorInstrumentation.cpp:
+        (WebCore):
+        (WebCore::InspectorInstrumentation::willPaintImpl):
+        (WebCore::InspectorInstrumentation::didPaintImpl):
+        * inspector/InspectorInstrumentation.h:
+        (InspectorInstrumentation):
+        (WebCore::InspectorInstrumentation::willPaint):
+        (WebCore::InspectorInstrumentation::didPaint):
+        * inspector/InspectorPageAgent.cpp:
+        (WebCore::InspectorPageAgent::didPaint):
+        * inspector/InspectorPageAgent.h:
+        * inspector/InspectorTimelineAgent.cpp:
+        (WebCore::InspectorTimelineAgent::willPaint):
+        (WebCore::InspectorTimelineAgent::didPaint):
+        * inspector/InspectorTimelineAgent.h:
+        (InspectorTimelineAgent):
+        * inspector/TimelineRecordFactory.cpp:
+        * inspector/TimelineRecordFactory.h:
+        (TimelineRecordFactory):
+        * page/FrameView.cpp:
+        (WebCore::FrameView::paintContents):
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::paintContents):
+
+2012-10-23  Pavel Feldman  <pfeldman@chromium.org>
+
+        Web Inspector: array grouping does not work for arrays with exactly 10000 elements.
+        https://bugs.webkit.org/show_bug.cgi?id=100131
+
+        Reviewed by Vsevolod Vlasov.
+
+        Using ceil() - 1 instead of floor() in bucket size calculation.
+
+        * inspector/front-end/ObjectPropertiesSection.js:
+
+2012-10-23  Shinya Kawanaka  <shinyak@chromium.org>
+
+        The order of resolving distribution in tree composition is wrong.
+        https://bugs.webkit.org/show_bug.cgi?id=99552
+
+        Reviewed by Dimitri Glazkov.
+
+        According to the current ShadowDOM spec, we have to resolve <content> first, then resolve <shadow>.
+        However, the order of resolution is now the mixed tree order of <content> and <shadow>.
+
+        Test: fast/dom/shadow/content-reprojection-order.html
+
+        * html/shadow/ContentDistributor.cpp:
+        (WebCore::ContentDistributor::distribute): We should resolve <content> before <shadow>.
+        Only the first active shadow insertion point can select the rest of contents.
+        * html/shadow/HTMLContentElement.h:
+        (HTMLContentElement):
+        * html/shadow/HTMLShadowElement.cpp:
+        * html/shadow/HTMLShadowElement.h:
+        (WebCore::isHTMLShadowElement):
+        (WebCore):
+        (WebCore::toHTMLShadowElement):
+        * html/shadow/InsertionPoint.h:
+        (InsertionPoint): We don't need doesSelectFromHostChildren() anymore.
+
+2012-10-23  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Web Inspector: Move UISourceCode creation out of mappings to workspace.
+        https://bugs.webkit.org/show_bug.cgi?id=100092
+
+        Reviewed by Pavel Feldman.
+
+        Moved uiSourceCode constructor calls out of mappings to workspace.
+
+        * inspector/front-end/CompilerScriptMapping.js:
+        * inspector/front-end/NetworkUISourceCodeProvider.js:
+        (WebInspector.NetworkUISourceCodeProvider.prototype._parsedScriptSource):
+        (WebInspector.NetworkUISourceCodeProvider.prototype._addUISourceCode):
+        * inspector/front-end/ResourceScriptMapping.js:
+        (WebInspector.ResourceScriptMapping.prototype._deleteOriginalUISourceCodeForScripts):
+        (WebInspector.ResourceScriptMapping.prototype._deleteTemporaryUISourceCodeForScripts):
+        (WebInspector.ResourceScriptMapping.prototype._bindUISourceCodeToScripts):
+        (WebInspector.ResourceScriptMapping.prototype._createUISourceCode):
+        (WebInspector.ResourceScriptMapping.prototype._getOrCreateTemporaryUISourceCode):
+        (WebInspector.ResourceScriptMapping.prototype._getOrCreateOriginalUISourceCode):
+        * inspector/front-end/SASSSourceMapping.js:
+        (_bindUISourceCode):
+        * inspector/front-end/ScriptSnippetModel.js:
+        (WebInspector.ScriptSnippetModel.prototype._addScriptSnippet):
+        (WebInspector.ScriptSnippetModel.prototype._createUISourceCodeForScript):
+        * inspector/front-end/Workspace.js:
+        (WebInspector.Project.prototype.addUISourceCode):
+        (WebInspector.Project.prototype.removeUISourceCode):
+        (WebInspector.Workspace.prototype.addTemporaryUISourceCode):
+        (WebInspector.Workspace.prototype.removeTemporaryUISourceCode):
+
+2012-10-23  Emil A Eklund  <eae@chromium.org>
+
+        Remove unnecessary m_layoutDelta[XY]Saturated initialization
+        https://bugs.webkit.org/show_bug.cgi?id=100018
+
+        Reviewed by Julien Chaffraix.
+        
+        Remove unnecessary initialization from LayoutState constructor
+        added in r132105.
+
+        No new tests, no change in functionality.
+
+        * rendering/LayoutState.cpp:
+        (WebCore::LayoutState::LayoutState):
+
+2012-10-23  Zeno Albisser  <zeno@webkit.org>
+
+        [Texmap] Fix drawTextureRectangleARB after r131485.
+        https://bugs.webkit.org/show_bug.cgi?id=100133
+
+        Consistently rename u_textureSize to u_samplerSize.
+
+        Reviewed by Noam Rosenthal.
+
+        * platform/graphics/texmap/TextureMapperGL.cpp:
+        (WebCore::TextureMapperGL::drawTextureRectangleARB):
+        * platform/graphics/texmap/TextureMapperShaderManager.cpp:
+        (WebCore::getShaderSpec):
+        * platform/graphics/texmap/TextureMapperShaderManager.h:
+        (TextureMapperShaderProgram):
+
+2012-10-23  Mike West  <mkwst@chromium.org>
+
+        Web Inspector: 'data:' URLs should be properly trimmed for readability.
+        https://bugs.webkit.org/show_bug.cgi?id=100083
+
+        Reviewed by Pavel Feldman.
+
+        We recently landed a patch to trim the middle out of long URLs in
+        console messages in order to improve readability. That patch didn't
+        effect 'data:' URLs, as they didn't match the regex in the linkifier.
+        This patch ensures that 'data:' URLs are properly trimmed down to
+        size.
+
+        This problem came to light while resolving a different, smaller issue:
+        'image/jpg' wasn't whitelisted as an image MIME type. That trivial fix
+        is included in this patch.
+
+        Test: http/tests/inspector/network/image-as-text-loading-data-url.html
+
+        * inspector/front-end/NetworkManager.js:
+        (WebInspector.NetworkManager):
+            Adds 'image/jpg' as a valid image type.
+        * inspector/front-end/ResourceUtils.js:
+        (WebInspector.linkifyStringAsFragmentWithCustomLinkifier):
+            Supports 'data:' URLs in the linkifier's regex.
+
+2012-10-23  Mike West  <mkwst@chromium.org>
+
+        Web Inspector: Floated anchor element sometimes overlaps following content.
+        https://bugs.webkit.org/show_bug.cgi?id=100105
+
+        Reviewed by Pavel Feldman.
+
+        This patch ensures that each console message clears the
+        potentially-overlapping floated anchor element.
+
+        * inspector/front-end/inspector.css:
+        (#console-prompt):
+        (.console-message, .console-user-command):
+            Clear the float, and flip the border from the bottom of the
+            message to the top. Do the same for the prompt.
+        (.console-message:first-child):
+            Ensure that the first message doesn't have a top border.
+
+2012-10-23  Alexander Pavlov  <apavlov@chromium.org>
+
+        Web Inspector: Crash when adding a keyframes rule in the Styles pane
+        https://bugs.webkit.org/show_bug.cgi?id=99826
+
+        Reviewed by Pavel Feldman.
+
+        The client-supplied selector text is first parsed to make sure it results in a valid style rule selector.
+
+        Test: inspector/styles/add-new-rule-invalid-selector.html
+
+        * inspector/InspectorStyleSheet.cpp:
+        (WebCore::createCSSParser):
+        (WebCore):
+        (WebCore::InspectorStyle::setPropertyText):
+        (WebCore::checkStyleRuleSelector):
+        (WebCore::InspectorStyleSheet::addRule):
+        (WebCore::InspectorStyleSheet::ensureSourceData):
+        (WebCore::InspectorStyleSheetForInlineStyle::getStyleAttributeRanges):
+
+2012-10-15  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Add support for resolution media query
+        https://bugs.webkit.org/show_bug.cgi?id=99077
+
+        Reviewed by Antti Koivisto.
+
+        Add support for 'resolution' media query feature.
+
+        Background info:
+        http://www.w3.org/blog/CSS/2012/06/14/unprefix-webkit-device-pixel-ratio
+
+        Related spec links:
+        http://www.w3.org/TR/css3-mediaqueries/#resolution (recommendation)
+        http://www.w3.org/TR/css3-values/#resolution (candidate recommentation)
+
+        Add infrastructure to make it testable.
+
+        Test: fast/media/mq-resolution.html
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::validUnit):
+        (WebCore::CSSParser::createPrimitiveNumericValue):
+        (WebCore::CSSParser::parseValidPrimitive):
+        (WebCore::CSSParser::detectNumberToken):
+        * css/CSSParser.h:
+        * css/CSSPrimitiveValue.cpp:
+        (WebCore::isValidCSSUnitTypeForDoubleConversion):
+        (WebCore::unitCategory):
+        (WebCore::CSSPrimitiveValue::canonicalUnitTypeForCategory):
+        (WebCore::CSSPrimitiveValue::customCssText):
+        (WebCore::CSSPrimitiveValue::cloneForCSSOM):
+        * css/CSSPrimitiveValue.h:
+
+            Enable dpi, dpcm and dppx units when RESOLUTION_MEDIA_QUERY
+            is enabled.
+
+        * WebCore.exp.in:
+
+            Export the WebCore::Settings setting.
+
+        * css/CSSPrimitiveValue.h:
+        (WebCore::CSSPrimitiveValue::isDotsPerInch):
+        (WebCore::CSSPrimitiveValue::isDotsPerPixel):
+        (WebCore::CSSPrimitiveValue::isDotsPerCentimeter):
+        (CSSPrimitiveValue):
+
+            Add function for checking the recently added density types.
+
+        * css/MediaFeatureNames.h:
+        (MediaFeatureNames):
+
+            Add support for resolution, min-resolution and max-resolution.
+
+        * css/MediaQueryEvaluator.cpp:
+        (WebCore::compareResolution): Add methods for comparing resolutions.
+        (WebCore):
+        (WebCore::resolutionMediaFeatureEval):
+        (WebCore::min_resolutionMediaFeatureEval):
+        (WebCore::max_resolutionMediaFeatureEval):
+
+            Implement the resolution method evaluation.
+
+        * css/MediaQueryExp.cpp:
+        (WebCore::featureWithValidPositiveDensity):
+        (WebCore):
+        (WebCore::featureWithoutValue):
+        (WebCore::MediaQueryExp::MediaQueryExp):
+
+            Hook up resolution with the right pre-checks.
+
+       * page/Screen.cpp:
+        (WebCore::Screen::horizontalDPI):
+        (WebCore::Screen::verticalDPI):
+
+            Check whether an override exists, and if so, uses it.
+            If not calculate the value given the device scale factor.
+
+        * page/Settings.cpp:
+        (WebCore::Settings::setResolutionOverride):
+        (WebCore):
+        * page/Settings.h:
+        (Settings):
+        (WebCore::Settings::resolutionOverride):
+
+            Add a resolution override to settings.
+
+        * testing/InternalSettings.cpp:
+        (WebCore::InternalSettings::Backup::Backup):
+        (WebCore::InternalSettings::Backup::restoreTo):
+        (WebCore::InternalSettings::setResolutionOverride):
+        (WebCore):
+        * testing/InternalSettings.h:
+        (Backup):
+        (InternalSettings):
+        * testing/InternalSettings.idl:
+
+            Add a new setResolutionOverride method to internals.settings.
+
+2012-10-23  Filip Spacek  <fspacek@rim.com>
+
+        [BlackBerry] Improve the use of stencil buffer during compositing
+        https://bugs.webkit.org/show_bug.cgi?id=100020
+
+        We always want to scissor so remove the define.
+        Only turn stenciling on if needed.
+
+        Reviewed by Rob Buis.
+
+        Reviewed internally by Arvid Nilsson.
+
+        * platform/graphics/blackberry/LayerRenderer.cpp:
+        (WebCore::LayerRenderer::setViewport):
+        (WebCore::LayerRenderer::compositeLayers):
+        (WebCore::LayerRenderer::drawLayersOnSurfaces):
+        (WebCore::LayerRenderer::compositeLayersRecursive):
+        (WebCore::LayerRenderer::updateScissorIfNeeded):
+
+2012-10-23  'Pavel Feldman'  <pfeldman@chromium.org>
+
+        Not reviewed: kick out non-chromium files from WebCore.gypi.
+
+        * WebCore.gypi:
+
+2012-10-23  Alexander Shalamov  <alexander.shalamov@intel.com>
+
+        [EFL][WK2] ecore_x should be initialised in WebProcess to avoid re-initialization by PlatformScreenEfl utilities and systemBeep() function
+        https://bugs.webkit.org/show_bug.cgi?id=100110
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Removed initialization of ecore_x, since it is initialized when process starts.
+
+        test: fast/media/*
+
+        * platform/efl/PlatformScreenEfl.cpp:
+        (WebCore::screenDepth):
+        (WebCore::screenRect):
+        * platform/efl/SoundEfl.cpp:
+        (WebCore::systemBeep):
+
+2012-10-23  Adam Klein  <adamk@chromium.org>
+
+        Always parse pasted fragments as HTML even on XHTML pages
+        https://bugs.webkit.org/show_bug.cgi?id=99880
+
+        Reviewed by Ojan Vafai.
+
+        When pasting HTML into a page, using the XML parser is unlikely
+        to work correctly, as the contents of the clipboard are unlikely
+        to be properly-formed XHTML. Thus, for the pasting case, it's always
+        better to use HTML parsing, which will properly parse either HTML
+        (which is what's usually in the clipboard) or XHTML (which is
+        sometimes there as well).
+
+        The Mac port previously worked around this problem by falling back to plain text
+        when parsing failed, but switching to HTML seems like a clear improvement.
+
+        This also fixes a crash in Chromium (see http://webkit.org/b/99607
+        and http://crbug.com/136218); it erroneously assumed that createFragmentFromMarkup()
+        would never return null. This patch makes that true.
+
+        * editing/markup.cpp:
+        (WebCore::createFragmentFromMarkup): Don't delegate to createContextualFragment:
+        we already know our context element is safe (i.e., it's <body>),
+        and we want to force HTML (not XML) parsing.
+
+2012-10-23  Allan Sandfeld Jensen  <allan.jensen@digia.com>
+
+        [Qt] REGRESSION (r130851): fast/text/word-space-with-kerning.html fails
+        https://bugs.webkit.org/show_bug.cgi?id=98876
+
+        Reviewed by Simon Hausmann.
+
+        Do not add word-spacing for leading space. This matches what simple path font-width does.
+
+        Tested by existing tests.
+
+        * platform/graphics/qt/FontQt.cpp:
+        (WebCore::Font::floatWidthForComplexText):
+
+2012-10-23  Alexander Pavlov  <apavlov@chromium.org>
+
+        Web Inspector: Incorrect resolution of relative URLs containing a scheme in query parameters
+        https://bugs.webkit.org/show_bug.cgi?id=100084
+
+        Reviewed by Vsevolod Vlasov.
+
+        Use the RFC 3986 grammar for the URL scheme.
+
+        * inspector/front-end/ParsedURL.js:
+        (WebInspector.ParsedURL):
+
+2012-10-23  Eugene Klyuchnikov  <eustas.bug@gmail.com>
+
+        Web Inspector: Elaborate source panel sidebar context menus.
+        https://bugs.webkit.org/show_bug.cgi?id=99980
+
+        Reviewed by Vsevolod Vlasov.
+
+        - Watches: add "Add watch expression" item to items and empty element
+        - Watches: hide "Remove watch expression" from editing prompt context menu
+        - Watches: add titles to header buttons
+        - XHR Breakpoints: add "Add Breakpoint" item to items and empty element
+        - XHR Breakpoints: add "Remove all breakpoints" item to items (when >1)
+        - XHR Breakpoints: add title to header button
+        - JS Breakpoints: hide "Remove/(De)Activate breakpoints" when only 1 item present
+        - JS Breakpoints: add "(De)Activate breakpoints" to empty element context menu
+
+        * English.lproj/localizedStrings.js: Added corresponding strings.
+        * inspector/front-end/BreakpointsSidebarPane.js: Adjusted context menu.
+        (WebInspector.XHRBreakpointsSidebarPane): Ditto.
+        * inspector/front-end/ObjectPropertiesSection.js: Added "isEditing()"
+        * inspector/front-end/WatchExpressionsSidebarPane.js: Adjusted context menu.
+
+2012-10-23  Kent Tamura  <tkent@chromium.org>
+
+        Update binding test results for r132194
+        https://bugs.webkit.org/show_bug.cgi?id=100097
+
+        * bindings/scripts/test/V8/V8TestObj.cpp:
+        (WebCore::V8TestObj::installPerContextProperties):
+
+2012-10-23  Alexander Pavlov  <apavlov@chromium.org>
+
+        Web Inspector: Sass can only resolve same folder paths
+        https://bugs.webkit.org/show_bug.cgi?id=99259
+
+        Reviewed by Vsevolod Vlasov.
+
+        The actual reason is that the rule source location linkifier tries to linkify a resource (*.scss), which does not exist,
+        and falls back to just stripping the main page URL prefix from the rule location URL. This change introduces LiveLocations
+        for CSSRule locations and makes sure they are linkified using uiSourceCode's parsedURL.displayName.
+
+        * inspector/front-end/CSSStyleModel.js:
+        (WebInspector.CSSStyleModel): Introduced LiveLocation management for CSSRules.
+        (WebInspector.CSSStyleModel.prototype.setSourceMapping):
+        (WebInspector.CSSStyleModel.prototype._updateLocations):
+        (WebInspector.CSSStyleModel.prototype.createLiveLocation):
+        (WebInspector.CSSStyleModel.prototype.updateLocations):
+        (WebInspector.CSSStyleModel.LiveLocation): A LiveLocation for the CSS domain.
+        (WebInspector.CSSStyleModel.LiveLocation.prototype.uiLocation):
+        (WebInspector.CSSStyleModel.LiveLocation.prototype.dispose):
+        * inspector/front-end/Linkifier.js:
+        (WebInspector.Linkifier.prototype.linkifyCSSRuleLocation): CSSRule LiveLocation-based link builder.
+        (WebInspector.Linkifier.DefaultFormatter.prototype.formatLiveAnchor): Add a title for anchors.
+        (WebInspector.Linkifier.DefaultCSSFormatter): Formatter for CSS location links.
+        (WebInspector.Linkifier.DefaultCSSFormatter.prototype.formatLiveAnchor):
+        * inspector/front-end/ResourceUtils.js:
+        (WebInspector.displayNameForURL): Use parsedURL.displayName if uiSourceCode is present for the specified URL.
+        * inspector/front-end/SASSSourceMapping.js:
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylesSidebarPane):
+        (WebInspector.StylesSidebarPane.prototype._innerRebuildUpdate):
+        * inspector/front-end/inspector.html:
+
+2012-10-23  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r132149.
+        http://trac.webkit.org/changeset/132149
+        https://bugs.webkit.org/show_bug.cgi?id=100098
+
+        Breaks inspector profiler tests in debug mode. (Requested by
+        pfeldman1 on #webkit).
+
+        * rendering/AutoTableLayout.cpp:
+        (WebCore::AutoTableLayout::recalcColumn):
+        * rendering/FixedTableLayout.cpp:
+        (WebCore::FixedTableLayout::calcWidthArray):
+        * rendering/RenderTable.cpp:
+        (WebCore::RenderTable::layout):
+        * rendering/RenderTableCol.cpp:
+        (WebCore::RenderTableCol::styleDidChange):
+        (WebCore::RenderTableCol::updateFromElement):
+        (WebCore::RenderTableCol::computePreferredLogicalWidths):
+        * rendering/RenderTableCol.h:
+        (RenderTableCol):
+
 2012-10-23  Simon Hausmann  <simon.hausmann@digia.com>
 
         Unreviewed trivial Qt build fix: Fix build without USE_3D_GRAPHICS
diff --git a/Source/WebCore/Configurations/Base.xcconfig b/Source/WebCore/Configurations/Base.xcconfig
index b82dde170..5816769a9 100644
--- a/Source/WebCore/Configurations/Base.xcconfig
+++ b/Source/WebCore/Configurations/Base.xcconfig
@@ -21,11 +21,8 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 
-#include "CompilerVersion.xcconfig"
-
-COMPILER_SPECIFIC_WARNING_CFLAGS = $(COMPILER_SPECIFIC_WARNING_CFLAGS_$(TARGET_GCC_VERSION));
-COMPILER_SPECIFIC_WARNING_CFLAGS_LLVM_COMPILER = -Wexit-time-destructors -Wglobal-constructors -Wtautological-compare;
-
+CLANG_CXX_LANGUAGE_STANDARD = gnu++0x;
+CLANG_CXX_LIBRARY = libc++;
 CLANG_WARN_CXX0X_EXTENSIONS = NO;
 DEBUG_INFORMATION_FORMAT = dwarf-with-dsym;
 GCC_C_LANGUAGE_STANDARD = gnu99;
@@ -34,19 +31,20 @@ GCC_DYNAMIC_NO_PIC = NO;
 GCC_ENABLE_CPP_EXCEPTIONS = NO;
 GCC_ENABLE_CPP_RTTI = NO;
 GCC_ENABLE_OBJC_EXCEPTIONS = YES;
-GCC_ENABLE_OBJC_GC = $(GCC_ENABLE_OBJC_GC_$(REAL_PLATFORM_NAME));
+GCC_ENABLE_OBJC_GC = $(GCC_ENABLE_OBJC_GC_$(PLATFORM_NAME));
 GCC_ENABLE_OBJC_GC_iphoneos = NO;
 GCC_ENABLE_OBJC_GC_iphonesimulator = NO;
 GCC_ENABLE_OBJC_GC_macosx = supported;
 GCC_ENABLE_SYMBOL_SEPARATION = NO;
 GCC_FAST_OBJC_DISPATCH = YES;
 GCC_GENERATE_DEBUGGING_SYMBOLS = YES;
-GCC_MODEL_TUNING = $(GCC_MODEL_TUNING_$(REAL_PLATFORM_NAME));
+GCC_MODEL_TUNING = $(GCC_MODEL_TUNING_$(PLATFORM_NAME));
 GCC_MODEL_TUNING_macosx = G5;
 GCC_OBJC_CALL_CXX_CDTORS = YES;
 GCC_PRECOMPILE_PREFIX_HEADER = YES;
 GCC_THREADSAFE_STATICS = NO;
 GCC_TREAT_WARNINGS_AS_ERRORS = YES;
+GCC_VERSION = com.apple.compilers.llvm.clang.1_0;
 GCC_WARN_ABOUT_DEPRECATED_FUNCTIONS = NO;
 GCC_WARN_ABOUT_MISSING_NEWLINE = YES;
 GCC_WARN_ABOUT_MISSING_PROTOTYPES = YES;
@@ -54,12 +52,12 @@ GCC_WARN_NON_VIRTUAL_DESTRUCTOR = YES;
 GCC_WARN_SIGN_COMPARE = YES;
 LINKER_DISPLAYS_MANGLED_NAMES = YES;
 PREBINDING = NO;
-VALID_ARCHS = $(VALID_ARCHS_$(REAL_PLATFORM_NAME));
+VALID_ARCHS = $(VALID_ARCHS_$(PLATFORM_NAME));
 VALID_ARCHS_iphoneos = $(ARCHS_STANDARD_32_BIT);
 VALID_ARCHS_iphonesimulator = $(ARCHS_STANDARD_32_BIT);
 VALID_ARCHS_macosx = i386 ppc x86_64 ppc64;
-WARNING_CFLAGS_BASE = -Wall -Wextra -Wcast-qual -Wchar-subscripts -Wextra-tokens -Wformat=2 -Winit-self -Wmissing-format-attribute -Wmissing-noreturn -Wpacked -Wpointer-arith -Wredundant-decls -Wundef -Wwrite-strings;
-WARNING_CFLAGS = $(WARNING_CFLAGS_$(REAL_PLATFORM_NAME)) $(COMPILER_SPECIFIC_WARNING_CFLAGS);
+WARNING_CFLAGS_BASE = -Wall -Wextra -Wcast-qual -Wchar-subscripts -Wextra-tokens -Wformat=2 -Winit-self -Wmissing-format-attribute -Wmissing-noreturn -Wpacked -Wpointer-arith -Wredundant-decls -Wundef -Wwrite-strings -Wexit-time-destructors -Wglobal-constructors -Wtautological-compare;
+WARNING_CFLAGS = $(WARNING_CFLAGS_$(PLATFORM_NAME));
 WARNING_CFLAGS_iphoneos = $(WARNING_CFLAGS_BASE) -Wshorten-64-to-32;
 WARNING_CFLAGS_iphonesimulator = $(WARNING_CFLAGS_BASE) -Wshorten-64-to-32;
 WARNING_CFLAGS_macosx = $(WARNING_CFLAGS_macosx_$(CURRENT_ARCH));
@@ -67,21 +65,8 @@ WARNING_CFLAGS_macosx_ = $(WARNING_CFLAGS_BASE) -Wshorten-64-to-32;
 WARNING_CFLAGS_macosx_i386 = $(WARNING_CFLAGS_BASE) -Wshorten-64-to-32;
 WARNING_CFLAGS_macosx_ppc = $(WARNING_CFLAGS_BASE) -Wshorten-64-to-32;
 // FIXME: WebCore 64-bit builds should build with -Wshorten-64-to-32
-WARNING_CFLAGS_macosx_ppc64 = $(WARNING_CFLAGS_BASE);
 WARNING_CFLAGS_macosx_x86_64 = $(WARNING_CFLAGS_BASE);
 
-CLANG_CXX_LIBRARY = $(CLANG_CXX_LIBRARY_$(TARGET_MAC_OS_X_VERSION_MAJOR));
-CLANG_CXX_LIBRARY_1060 = libstdc++;
-CLANG_CXX_LIBRARY_1070 = libc++;
-CLANG_CXX_LIBRARY_1080 = libc++;
-CLANG_CXX_LIBRARY_1090 = libc++;
-
-REAL_PLATFORM_NAME = $(REAL_PLATFORM_NAME_$(PLATFORM_NAME));
-REAL_PLATFORM_NAME_ = $(REAL_PLATFORM_NAME_macosx);
-REAL_PLATFORM_NAME_iphoneos = iphoneos;
-REAL_PLATFORM_NAME_iphonesimulator = iphonesimulator;
-REAL_PLATFORM_NAME_macosx = macosx;
-
 TARGET_MAC_OS_X_VERSION_MAJOR = $(MAC_OS_X_VERSION_MAJOR);
 
 
@@ -106,27 +91,20 @@ DEAD_CODE_STRIPPING = $(DEAD_CODE_STRIPPING_$(CURRENT_VARIANT));
 SECTORDER_FLAGS = -Wl,-order_file,WebCore.order;
 
 WEBCORE_SQLITE3_HEADER_SEARCH_PATHS = $(NEXT_ROOT)/usr/local/include/WebCoreSQLite3;
-SQLITE3_HEADER_SEARCH_PATHS = $(SQLITE3_HEADER_SEARCH_PATHS_$(REAL_PLATFORM_NAME));
+SQLITE3_HEADER_SEARCH_PATHS = $(SQLITE3_HEADER_SEARCH_PATHS_$(PLATFORM_NAME));
 SQLITE3_HEADER_SEARCH_PATHS_macosx = $(SQLITE3_HEADER_SEARCH_PATHS_macosx_$(TARGET_MAC_OS_X_VERSION_MAJOR));
-SQLITE3_HEADER_SEARCH_PATHS_macosx_1050 = $(WEBCORE_SQLITE3_HEADER_SEARCH_PATHS);
 
 // FIXME: The size of the debug symbols generated for WebCore exceeds that which a 32-bit linker can deal with.
 // To allow the Leopard build bots to successfully compile WebCore we're disabling debug symbols in debug builds.
-GCC_GENERATE_DEBUGGING_SYMBOLS = $(GCC_GENERATE_DEBUGGING_SYMBOLS_$(REAL_PLATFORM_NAME));
+GCC_GENERATE_DEBUGGING_SYMBOLS = $(GCC_GENERATE_DEBUGGING_SYMBOLS_$(PLATFORM_NAME));
 GCC_GENERATE_DEBUGGING_SYMBOLS_iphoneos = YES;
 GCC_GENERATE_DEBUGGING_SYMBOLS_iphonesimulator = YES;
 GCC_GENERATE_DEBUGGING_SYMBOLS_macosx = $(GCC_GENERATE_DEBUGGING_SYMBOLS_macosx_$(TARGET_MAC_OS_X_VERSION_MAJOR));
-GCC_GENERATE_DEBUGGING_SYMBOLS_macosx_1050 = $(GCC_GENERATE_DEBUGGING_SYMBOLS_macosx_1050_$(CONFIGURATION));
-GCC_GENERATE_DEBUGGING_SYMBOLS_macosx_1050_Debug = NO;
-GCC_GENERATE_DEBUGGING_SYMBOLS_macosx_1050_Release = YES;
-GCC_GENERATE_DEBUGGING_SYMBOLS_macosx_1050_Production = YES;
-GCC_GENERATE_DEBUGGING_SYMBOLS_macosx_1060 = YES;
 GCC_GENERATE_DEBUGGING_SYMBOLS_macosx_1070 = YES;
 GCC_GENERATE_DEBUGGING_SYMBOLS_macosx_1080 = YES;
 GCC_GENERATE_DEBUGGING_SYMBOLS_macosx_1090 = YES;
 
 TARGETING_SAME_OS_X_VERSION = $(TARGETING_SAME_OS_X_VERSION_$(MAC_OS_X_VERSION_MAJOR)_$(TARGET_MAC_OS_X_VERSION_MAJOR));
-TARGETING_SAME_OS_X_VERSION_1060_1060 = YES;
 TARGETING_SAME_OS_X_VERSION_1070_1070 = YES;
 TARGETING_SAME_OS_X_VERSION_1080_1080 = YES;
 TARGETING_SAME_OS_X_VERSION_1090_1090 = YES;
diff --git a/Source/WebCore/Configurations/CompilerVersion.xcconfig b/Source/WebCore/Configurations/CompilerVersion.xcconfig
deleted file mode 100644
index a8c7f75a0..000000000
--- a/Source/WebCore/Configurations/CompilerVersion.xcconfig
+++ /dev/null
@@ -1,84 +0,0 @@
-// Copyright (C) 2009, 2010, 2011 Apple Inc. All rights reserved.
-//
-// Redistribution and use in source and binary forms, with or without
-// modification, are permitted provided that the following conditions
-// are met:
-// 1. Redistributions of source code must retain the above copyright
-//    notice, this list of conditions and the following disclaimer.
-// 2. Redistributions in binary form must reproduce the above copyright
-//    notice, this list of conditions and the following disclaimer in the
-//    documentation and/or other materials provided with the distribution.
-//
-// THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
-// EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
-// IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
-// PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
-// CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
-// EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
-// PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
-// PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
-// OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
-
-IS_XCODE_0400 = $(IS_XCODE_0400_$(XCODE_VERSION_MINOR));
-IS_XCODE_0400_0400 = YES;
-
-IS_XCODE_0400_OR_0410 = $(IS_XCODE_0400_OR_0410_$(XCODE_VERSION_MINOR));
-IS_XCODE_0400_OR_0410_0400 = YES;
-IS_XCODE_0400_OR_0410_0410 = YES;
-
-// The version of the LLVM Compiler in Xcode 4.0 and earlier have difficulty compiling our code.
-LLVM_COMPILER_UNSUITABLE_FOR_DEBUG_BUILDS = $(LLVM_COMPILER_UNSUITABLE_FOR_DEBUG_BUILDS_$(XCODE_VERSION_MAJOR));
-LLVM_COMPILER_UNSUITABLE_FOR_DEBUG_BUILDS_0300 = YES;
-LLVM_COMPILER_UNSUITABLE_FOR_DEBUG_BUILDS_0400 = $(LLVM_COMPILER_UNSUITABLE_FOR_DEBUG_BUILDS_IS_XCODE_0400_$(IS_XCODE_0400));
-LLVM_COMPILER_UNSUITABLE_FOR_DEBUG_BUILDS_IS_XCODE_0400_YES = YES;
-
-// The version of the LLVM Compiler in Xcode 4.1 and earlier do not generate fast enough code.
-LLVM_COMPILER_UNSUITABLE_FOR_OPTIMIZED_BUILDS = $(LLVM_COMPILER_UNSUITABLE_FOR_OPTIMIZED_BUILDS_$(XCODE_VERSION_MAJOR));
-LLVM_COMPILER_UNSUITABLE_FOR_OPTIMIZED_BUILDS_0300 = YES;
-LLVM_COMPILER_UNSUITABLE_FOR_OPTIMIZED_BUILDS_0400 = $(LLVM_COMPILER_UNSUITABLE_FOR_OPTIMIZED_BUILDS_IS_XCODE_0400_OR_0410_$(IS_XCODE_0400_OR_0410));
-LLVM_COMPILER_UNSUITABLE_FOR_OPTIMIZED_BUILDS_IS_XCODE_0400_OR_0410_YES = YES;
-
-LLVM_COMPILER_SUITABLE_FOR_DEBUG_BUILDS = $(LLVM_COMPILER_SUITABLE_FOR_DEBUG_BUILDS_$(LLVM_COMPILER_UNSUITABLE_FOR_DEBUG_BUILDS));
-LLVM_COMPILER_SUITABLE_FOR_DEBUG_BUILDS_ = YES;
-LLVM_COMPILER_SUITABLE_FOR_DEBUG_BUILDS_YES = NO;
-
-LLVM_COMPILER_SUITABLE_FOR_OPTIMIZED_BUILDS = $(LLVM_COMPILER_SUITABLE_FOR_OPTIMIZED_BUILDS_$(LLVM_COMPILER_UNSUITABLE_FOR_OPTIMIZED_BUILDS));
-LLVM_COMPILER_SUITABLE_FOR_OPTIMIZED_BUILDS_ = YES;
-LLVM_COMPILER_SUITABLE_FOR_OPTIMIZED_BUILDS_YES = NO;
-
-
-// Use GCC 4.2 with Xcode 3.1, which includes GCC 4.2 but defaults to GCC 4.0.
-// Note that Xcode versions as new as 3.1.2 use XCODE_VERSION_ACTUAL for the minor version
-// number.  Newer versions of Xcode use XCODE_VERSION_MINOR for the minor version, and
-// XCODE_VERSION_ACTUAL for the full version number.
-TARGET_GCC_VERSION = $(TARGET_GCC_VERSION_$(REAL_PLATFORM_NAME));
-TARGET_GCC_VERSION_iphoneos = LLVM_GCC_42;
-TARGET_GCC_VERSION_iphonesimulator = GCC_42;
-TARGET_GCC_VERSION_macosx = $(TARGET_GCC_VERSION_macosx_$(TARGET_MAC_OS_X_VERSION_MAJOR));
-
-TARGET_GCC_VERSION_macosx_1050 = $(TARGET_GCC_VERSION_macosx_1050_$(XCODE_VERSION_MINOR));
-TARGET_GCC_VERSION_macosx_1050_ = $(TARGET_GCC_VERSION_macosx_1050_$(XCODE_VERSION_ACTUAL));
-TARGET_GCC_VERSION_macosx_1050_0310 = GCC_42;
-TARGET_GCC_VERSION_macosx_1050_0320 = GCC_42;
-
-TARGET_GCC_VERSION_macosx_1060 = $(TARGET_GCC_VERSION_macosx_1060_AND_1070_$(CONFIGURATION));
-TARGET_GCC_VERSION_macosx_1070 = $(TARGET_GCC_VERSION_macosx_1060_AND_1070_$(CONFIGURATION));
-TARGET_GCC_VERSION_macosx_1060_AND_1070_Debug = $(TARGET_GCC_VERSION_macosx_USE_LLVM_COMPILER_$(LLVM_COMPILER_SUITABLE_FOR_DEBUG_BUILDS));
-TARGET_GCC_VERSION_macosx_1060_AND_1070_Release = $(TARGET_GCC_VERSION_macosx_USE_LLVM_COMPILER_$(LLVM_COMPILER_SUITABLE_FOR_OPTIMIZED_BUILDS));
-TARGET_GCC_VERSION_macosx_1060_AND_1070_Production = $(TARGET_GCC_VERSION_macosx_USE_LLVM_COMPILER_$(LLVM_COMPILER_SUITABLE_FOR_OPTIMIZED_BUILDS));
-TARGET_GCC_VERSION_macosx_1060_NON_LLVM_FALLBACK = GCC_42;
-TARGET_GCC_VERSION_macosx_1070_NON_LLVM_FALLBACK = LLVM_GCC_42;
-
-TARGET_GCC_VERSION_macosx_USE_LLVM_COMPILER_YES = LLVM_COMPILER;
-TARGET_GCC_VERSION_macosx_USE_LLVM_COMPILER_NO = $(TARGET_GCC_VERSION_macosx_$(TARGET_MAC_OS_X_VERSION_MAJOR)_NON_LLVM_FALLBACK);
-
-TARGET_GCC_VERSION_macosx_1080 = LLVM_COMPILER;
-TARGET_GCC_VERSION_macosx_1090 = LLVM_COMPILER;
-
-GCC_VERSION = $(GCC_VERSION_$(TARGET_GCC_VERSION));
-GCC_VERSION_GCC_40 = 4.0;
-GCC_VERSION_GCC_42 = 4.2;
-GCC_VERSION_LLVM_GCC_42 = com.apple.compilers.llvmgcc42;
-GCC_VERSION_LLVM_COMPILER = com.apple.compilers.llvm.clang.1_0;
diff --git a/Source/WebCore/Configurations/DebugRelease.xcconfig b/Source/WebCore/Configurations/DebugRelease.xcconfig
index bf43be0f2..41df04ddf 100644
--- a/Source/WebCore/Configurations/DebugRelease.xcconfig
+++ b/Source/WebCore/Configurations/DebugRelease.xcconfig
@@ -23,24 +23,17 @@
 
 #include "Base.xcconfig"
 
-ARCHS = $(ARCHS_$(REAL_PLATFORM_NAME));
+ARCHS = $(ARCHS_$(PLATFORM_NAME));
 ARCHS_iphoneos = $(ARCHS_STANDARD_32_BIT);
 ARCHS_iphonesimulator = $(ARCHS_STANDARD_32_BIT);
-ARCHS_macosx = $(ARCHS_macosx_$(TARGET_MAC_OS_X_VERSION_MAJOR));
-ARCHS_macosx_1050 = $(NATIVE_ARCH);
-ARCHS_macosx_1060 = $(ARCHS_STANDARD_32_64_BIT);
-ARCHS_macosx_1070 = $(ARCHS_STANDARD_32_64_BIT);
-ARCHS_macosx_1080 = $(ARCHS_STANDARD_32_64_BIT);
-ARCHS_macosx_1090 = $(ARCHS_STANDARD_32_64_BIT);
+ARCHS_macosx = $(ARCHS_STANDARD_32_64_BIT);
 
 ONLY_ACTIVE_ARCH = YES;
 
-MACOSX_DEPLOYMENT_TARGET = $(MACOSX_DEPLOYMENT_TARGET_$(REAL_PLATFORM_NAME));
+MACOSX_DEPLOYMENT_TARGET = $(MACOSX_DEPLOYMENT_TARGET_$(PLATFORM_NAME));
 MACOSX_DEPLOYMENT_TARGET_iphoneos = 10.5;
 MACOSX_DEPLOYMENT_TARGET_iphonesimulator = 10.5;
 MACOSX_DEPLOYMENT_TARGET_macosx = $(MACOSX_DEPLOYMENT_TARGET_macosx_$(TARGET_MAC_OS_X_VERSION_MAJOR));
-MACOSX_DEPLOYMENT_TARGET_macosx_1050 = 10.5;
-MACOSX_DEPLOYMENT_TARGET_macosx_1060 = 10.6;
 MACOSX_DEPLOYMENT_TARGET_macosx_1070 = 10.7;
 MACOSX_DEPLOYMENT_TARGET_macosx_1080 = 10.8;
 MACOSX_DEPLOYMENT_TARGET_macosx_1090 = 10.9;
diff --git a/Source/WebCore/Configurations/FeatureDefines.xcconfig b/Source/WebCore/Configurations/FeatureDefines.xcconfig
index 534cbd4bf..a4f8ca0c0 100644
--- a/Source/WebCore/Configurations/FeatureDefines.xcconfig
+++ b/Source/WebCore/Configurations/FeatureDefines.xcconfig
@@ -38,6 +38,8 @@ ENABLE_BLOB = ENABLE_BLOB;
 ENABLE_CHANNEL_MESSAGING = ENABLE_CHANNEL_MESSAGING;
 ENABLE_CSP_NEXT = ;
 ENABLE_CSS_BOX_DECORATION_BREAK = ENABLE_CSS_BOX_DECORATION_BREAK;
+ENABLE_CSS_COMPOSITING = ENABLE_CSS_COMPOSITING;
+ENABLE_CSS_DEVICE_ADAPTATION = ;
 ENABLE_CSS_EXCLUSIONS = ENABLE_CSS_EXCLUSIONS;
 ENABLE_CSS_FILTERS = ENABLE_CSS_FILTERS;
 ENABLE_CSS_HIERARCHIES = ;
@@ -45,13 +47,12 @@ ENABLE_CSS_IMAGE_ORIENTATION = ;
 ENABLE_CSS_IMAGE_RESOLUTION = ;
 ENABLE_CSS_REGIONS = ENABLE_CSS_REGIONS;
 ENABLE_CSS_SHADERS = ENABLE_CSS_SHADERS;
-ENABLE_CSS_COMPOSITING = ENABLE_CSS_COMPOSITING;
 ENABLE_CSS_STICKY_POSITION = ENABLE_CSS_STICKY_POSITION;
 ENABLE_CSS_VARIABLES = ;
 ENABLE_CSS3_CONDITIONAL_RULES = ;
 ENABLE_CSS3_TEXT = ;
 ENABLE_CUSTOM_SCHEME_HANDLER = ;
-ENABLE_DASHBOARD_SUPPORT = $(ENABLE_DASHBOARD_SUPPORT_$(REAL_PLATFORM_NAME));
+ENABLE_DASHBOARD_SUPPORT = $(ENABLE_DASHBOARD_SUPPORT_$(PLATFORM_NAME));
 ENABLE_DASHBOARD_SUPPORT_macosx = ENABLE_DASHBOARD_SUPPORT;
 ENABLE_DATALIST_ELEMENT = ;
 ENABLE_DATA_TRANSFER_ITEMS = ;
@@ -60,47 +61,46 @@ ENABLE_DEVICE_ORIENTATION = ;
 ENABLE_DIALOG_ELEMENT = ;
 ENABLE_DIRECTORY_UPLOAD = ;
 ENABLE_DRAGGABLE_REGION = ;
-ENABLE_ENCRYPTED_MEDIA = $(ENABLE_ENCRYPTED_MEDIA_$(REAL_PLATFORM_NAME));
+ENABLE_ENCRYPTED_MEDIA = $(ENABLE_ENCRYPTED_MEDIA_$(PLATFORM_NAME));
 ENABLE_ENCRYPTED_MEDIA_macosx = $(ENABLE_ENCRYPTED_MEDIA_macosx_$(TARGET_MAC_OS_X_VERSION_MAJOR));
 ENABLE_ENCRYPTED_MEDIA_macosx_1070 = ;
 ENABLE_ENCRYPTED_MEDIA_macosx_1080 = ;
 ENABLE_ENCRYPTED_MEDIA_macosx_1090 = ENABLE_ENCRYPTED_MEDIA;
 ENABLE_FILE_SYSTEM = ;
-ENABLE_FILTERS = $(ENABLE_FILTERS_$(REAL_PLATFORM_NAME));
-ENABLE_FILTERS_macosx = ENABLE_FILTERS;
+ENABLE_FILTERS = ENABLE_FILTERS;
 ENABLE_FULLSCREEN_API = ENABLE_FULLSCREEN_API;
 ENABLE_GAMEPAD = ;
 ENABLE_GEOLOCATION = ENABLE_GEOLOCATION;
-ENABLE_HIDDEN_PAGE_DOM_TIMER_THROTTLING = $(ENABLE_HIDDEN_PAGE_DOM_TIMER_THROTTLING_$(REAL_PLATFORM_NAME));
+ENABLE_HIDDEN_PAGE_DOM_TIMER_THROTTLING = $(ENABLE_HIDDEN_PAGE_DOM_TIMER_THROTTLING_$(PLATFORM_NAME));
 ENABLE_HIDDEN_PAGE_DOM_TIMER_THROTTLING_macosx = ENABLE_HIDDEN_PAGE_DOM_TIMER_THROTTLING;
 ENABLE_HIGH_DPI_CANVAS = ENABLE_HIGH_DPI_CANVAS;
-ENABLE_ICONDATABASE = $(ENABLE_ICONDATABASE_$(REAL_PLATFORM_NAME));
+ENABLE_ICONDATABASE = $(ENABLE_ICONDATABASE_$(PLATFORM_NAME));
 ENABLE_ICONDATABASE_macosx = ENABLE_ICONDATABASE;
 ENABLE_IFRAME_SEAMLESS = ENABLE_IFRAME_SEAMLESS;
 ENABLE_INDEXED_DATABASE = ;
 ENABLE_INPUT_SPEECH = ;
 ENABLE_INPUT_TYPE_COLOR = ;
-ENABLE_INPUT_TYPE_DATE = $(ENABLE_INPUT_TYPE_DATE_$(REAL_PLATFORM_NAME));
+ENABLE_INPUT_TYPE_DATE = $(ENABLE_INPUT_TYPE_DATE_$(PLATFORM_NAME));
 ENABLE_INPUT_TYPE_DATE_iphoneos = ENABLE_INPUT_TYPE_DATE;
-ENABLE_INPUT_TYPE_DATE_iphonesimulator = ENABLE_INPUT_TYPE_DATE;
-ENABLE_INPUT_TYPE_DATETIME = $(ENABLE_INPUT_TYPE_DATETIME_$(REAL_PLATFORM_NAME));
+ENABLE_INPUT_TYPE_DATE_iphonesimulator = $(ENABLE_INPUT_TYPE_DATE_iphoneos);
+ENABLE_INPUT_TYPE_DATETIME = $(ENABLE_INPUT_TYPE_DATETIME_$(PLATFORM_NAME));
 ENABLE_INPUT_TYPE_DATETIME_iphoneos = ENABLE_INPUT_TYPE_DATETIME;
-ENABLE_INPUT_TYPE_DATETIME_iphonesimulator = ENABLE_INPUT_TYPE_DATETIME;
-ENABLE_INPUT_TYPE_DATETIMELOCAL = $(ENABLE_INPUT_TYPE_DATETIMELOCAL_$(REAL_PLATFORM_NAME));
+ENABLE_INPUT_TYPE_DATETIME_iphonesimulator = $(ENABLE_INPUT_TYPE_DATETIME_iphoneos);
+ENABLE_INPUT_TYPE_DATETIMELOCAL = $(ENABLE_INPUT_TYPE_DATETIMELOCAL_$(PLATFORM_NAME));
 ENABLE_INPUT_TYPE_DATETIMELOCAL_iphoneos = ENABLE_INPUT_TYPE_DATETIMELOCAL;
-ENABLE_INPUT_TYPE_DATETIMELOCAL_iphonesimulator = ENABLE_INPUT_TYPE_DATETIMELOCAL;
-ENABLE_INPUT_TYPE_MONTH = $(ENABLE_INPUT_TYPE_MONTH_$(REAL_PLATFORM_NAME));
+ENABLE_INPUT_TYPE_DATETIMELOCAL_iphonesimulator = $(ENABLE_INPUT_TYPE_DATETIMELOCAL_iphoneos);
+ENABLE_INPUT_TYPE_MONTH = $(ENABLE_INPUT_TYPE_MONTH_$(PLATFORM_NAME));
 ENABLE_INPUT_TYPE_MONTH_iphoneos = ENABLE_INPUT_TYPE_MONTH;
-ENABLE_INPUT_TYPE_MONTH_iphonesimulator = ENABLE_INPUT_TYPE_MONTH;
-ENABLE_INPUT_TYPE_TIME = $(ENABLE_INPUT_TYPE_TIME_$(REAL_PLATFORM_NAME));
+ENABLE_INPUT_TYPE_MONTH_iphonesimulator = $(ENABLE_INPUT_TYPE_MONTH_iphoneos);
+ENABLE_INPUT_TYPE_TIME = $(ENABLE_INPUT_TYPE_TIME_$(PLATFORM_NAME));
 ENABLE_INPUT_TYPE_TIME_iphoneos = ENABLE_INPUT_TYPE_TIME;
-ENABLE_INPUT_TYPE_TIME_iphonesimulator = ENABLE_INPUT_TYPE_TIME;
-ENABLE_INPUT_TYPE_WEEK = $(ENABLE_INPUT_TYPE_WEEK_$(REAL_PLATFORM_NAME));
+ENABLE_INPUT_TYPE_TIME_iphonesimulator = $(ENABLE_INPUT_TYPE_TIME_iphoneos);
+ENABLE_INPUT_TYPE_WEEK = $(ENABLE_INPUT_TYPE_WEEK_$(PLATFORM_NAME));
 ENABLE_INPUT_TYPE_WEEK_iphoneos = ENABLE_INPUT_TYPE_WEEK;
-ENABLE_INPUT_TYPE_WEEK_iphonesimulator = ENABLE_INPUT_TYPE_WEEK;
+ENABLE_INPUT_TYPE_WEEK_iphonesimulator = $(ENABLE_INPUT_TYPE_WEEK_iphoneos);
 ENABLE_JAVASCRIPT_DEBUGGER = ENABLE_JAVASCRIPT_DEBUGGER;
 ENABLE_LEGACY_CSS_VENDOR_PREFIXES = ENABLE_LEGACY_CSS_VENDOR_PREFIXES;
-ENABLE_LEGACY_NOTIFICATIONS = $(ENABLE_LEGACY_NOTIFICATIONS_$(REAL_PLATFORM_NAME));
+ENABLE_LEGACY_NOTIFICATIONS = $(ENABLE_LEGACY_NOTIFICATIONS_$(PLATFORM_NAME));
 ENABLE_LEGACY_NOTIFICATIONS_macosx = $(ENABLE_LEGACY_NOTIFICATIONS_macosx_$(TARGET_MAC_OS_X_VERSION_MAJOR));
 ENABLE_LEGACY_NOTIFICATIONS_macosx_1070 = ;
 ENABLE_LEGACY_NOTIFICATIONS_macosx_1080 = ENABLE_LEGACY_NOTIFICATIONS;
@@ -115,38 +115,46 @@ ENABLE_MEDIA_STATISTICS = ;
 ENABLE_METER_ELEMENT = ENABLE_METER_ELEMENT;
 ENABLE_MHTML = ;
 ENABLE_MICRODATA = ;
-ENABLE_NAVIGATOR_CONTENT_UTILS = ;
 ENABLE_MUTATION_OBSERVERS = ENABLE_MUTATION_OBSERVERS;
-ENABLE_NOTIFICATIONS = $(ENABLE_NOTIFICATIONS_$(REAL_PLATFORM_NAME));
+ENABLE_NAVIGATOR_CONTENT_UTILS = ;
+ENABLE_NOTIFICATIONS = $(ENABLE_NOTIFICATIONS_$(PLATFORM_NAME));
 ENABLE_NOTIFICATIONS_macosx = $(ENABLE_NOTIFICATIONS_macosx_$(TARGET_MAC_OS_X_VERSION_MAJOR));
 ENABLE_NOTIFICATIONS_macosx_1070 = ;
 ENABLE_NOTIFICATIONS_macosx_1080 = ENABLE_NOTIFICATIONS;
 ENABLE_NOTIFICATIONS_macosx_1090 = ENABLE_NOTIFICATIONS;
 ENABLE_PAGE_VISIBILITY_API = ;
+ENABLE_PDFKIT_PLUGIN = $(ENABLE_PDFKIT_PLUGIN_$(PLATFORM_NAME));
+ENABLE_PDFKIT_PLUGIN_macosx = $(ENABLE_PDFKIT_PLUGIN_macosx_$(TARGET_MAC_OS_X_VERSION_MAJOR));
+ENABLE_PDFKIT_PLUGIN_macosx_1070 = ;
+ENABLE_PDFKIT_PLUGIN_macosx_1080 = ;
+ENABLE_PDFKIT_PLUGIN_macosx_1090 = ENABLE_PDFKIT_PLUGIN;
 ENABLE_PROGRESS_ELEMENT = ENABLE_PROGRESS_ELEMENT;
 ENABLE_QUOTA = ;
 ENABLE_REQUEST_ANIMATION_FRAME = ENABLE_REQUEST_ANIMATION_FRAME;
+ENABLE_RESOLUTION_MEDIA_QUERY = ;
 ENABLE_SCRIPTED_SPEECH = ;
 ENABLE_SHADOW_DOM = ;
 ENABLE_SHARED_WORKERS = ENABLE_SHARED_WORKERS;
 ENABLE_SQL_DATABASE = ENABLE_SQL_DATABASE;
 ENABLE_STYLE_SCOPED = ;
+ENABLE_SUBPIXEL_LAYOUT = ENABLE_SUBPIXEL_LAYOUT;
 ENABLE_SVG = ENABLE_SVG;
-ENABLE_SVG_DOM_OBJC_BINDINGS = $(ENABLE_SVG_DOM_OBJC_BINDINGS_$(REAL_PLATFORM_NAME));
+ENABLE_SVG_DOM_OBJC_BINDINGS = $(ENABLE_SVG_DOM_OBJC_BINDINGS_$(PLATFORM_NAME));
 ENABLE_SVG_DOM_OBJC_BINDINGS_macosx = ENABLE_SVG_DOM_OBJC_BINDINGS;
 ENABLE_SVG_FONTS = ENABLE_SVG_FONTS;
 ENABLE_TEXT_AUTOSIZING = ;
 ENABLE_TEXT_NOTIFICATIONS_ONLY = ENABLE_TEXT_NOTIFICATIONS_ONLY;
 ENABLE_TOUCH_ICON_LOADING = ;
-ENABLE_UNDO_MANAGER = ;
+ENABLE_USERSELECT_ALL = ENABLE_USERSELECT_ALL;
 ENABLE_VIDEO = ENABLE_VIDEO;
-ENABLE_VIDEO_TRACK = $(ENABLE_VIDEO_TRACK_$(REAL_PLATFORM_NAME));
+ENABLE_VIDEO_TRACK = $(ENABLE_VIDEO_TRACK_$(PLATFORM_NAME));
 ENABLE_VIDEO_TRACK_macosx = ENABLE_VIDEO_TRACK;
 ENABLE_WEBGL = ENABLE_WEBGL;
 ENABLE_WEB_AUDIO = ENABLE_WEB_AUDIO;
 ENABLE_WEB_SOCKETS = ENABLE_WEB_SOCKETS;
 ENABLE_WEB_TIMING = ;
 ENABLE_WORKERS = ENABLE_WORKERS;
+ENABLE_XHR_TIMEOUT = ENABLE_XHR_TIMEOUT;
 ENABLE_XSLT = ENABLE_XSLT;
 
-FEATURE_DEFINES = $(ENABLE_3D_RENDERING) $(ENABLE_ACCELERATED_2D_CANVAS) $(ENABLE_ANIMATION_API) $(ENABLE_BLOB) $(ENABLE_CHANNEL_MESSAGING) $(ENABLE_CSP_NEXT) $(ENABLE_CSS_BOX_DECORATION_BREAK) $(ENABLE_CSS_EXCLUSIONS) $(ENABLE_CSS_FILTERS) $(ENABLE_CSS_HIERARCHIES) $(ENABLE_CSS_IMAGE_ORIENTATION) $(ENABLE_CSS_IMAGE_RESOLUTION) $(ENABLE_CSS_REGIONS) $(ENABLE_CSS_SHADERS) $(ENABLE_CSS_COMPOSITING) $(ENABLE_CSS_STICKY_POSITION) $(ENABLE_CSS_VARIABLES) $(ENABLE_CSS3_CONDITIONAL_RULES) $(ENABLE_CSS3_TEXT) $(ENABLE_CUSTOM_SCHEME_HANDLER) $(ENABLE_DASHBOARD_SUPPORT) $(ENABLE_DATALIST_ELEMENT) $(ENABLE_DATA_TRANSFER_ITEMS) $(ENABLE_DETAILS_ELEMENT) $(ENABLE_DEVICE_ORIENTATION) $(ENABLE_DIALOG_ELEMENT) $(ENABLE_DIRECTORY_UPLOAD) $(ENABLE_DRAGGABLE_REGION) $(ENABLE_ENCRYPTED_MEDIA) $(ENABLE_FILE_SYSTEM) $(ENABLE_FILTERS) $(ENABLE_FULLSCREEN_API) $(ENABLE_GAMEPAD) $(ENABLE_GEOLOCATION) $(ENABLE_HIDDEN_PAGE_DOM_TIMER_THROTTLING) $(ENABLE_HIGH_DPI_CANVAS) $(ENABLE_ICONDATABASE) $(ENABLE_IFRAME_SEAMLESS) $(ENABLE_INDEXED_DATABASE) $(ENABLE_INPUT_SPEECH) $(ENABLE_INPUT_TYPE_COLOR) $(ENABLE_INPUT_TYPE_DATE) $(ENABLE_INPUT_TYPE_DATETIME) $(ENABLE_INPUT_TYPE_DATETIMELOCAL) $(ENABLE_INPUT_TYPE_MONTH) $(ENABLE_INPUT_TYPE_TIME) $(ENABLE_INPUT_TYPE_WEEK) $(ENABLE_JAVASCRIPT_DEBUGGER) $(ENABLE_LEGACY_CSS_VENDOR_PREFIXES) $(ENABLE_LEGACY_NOTIFICATIONS) $(ENABLE_LEGACY_VENDOR_PREFIXES) $(ENABLE_LEGACY_WEB_AUDIO) $(ENABLE_LINK_PREFETCH) $(ENABLE_LINK_PRERENDER) $(ENABLE_MATHML) $(ENABLE_MEDIA_SOURCE) $(ENABLE_MEDIA_STATISTICS) $(ENABLE_METER_ELEMENT) $(ENABLE_MHTML) $(ENABLE_MICRODATA) $(ENABLE_MUTATION_OBSERVERS) $(ENABLE_NAVIGATOR_CONTENT_UTILS) $(ENABLE_NOTIFICATIONS) $(ENABLE_PAGE_VISIBILITY_API) $(ENABLE_PROGRESS_ELEMENT) $(ENABLE_QUOTA) $(ENABLE_REQUEST_ANIMATION_FRAME) $(ENABLE_SCRIPTED_SPEECH) $(ENABLE_SHADOW_DOM) $(ENABLE_SHARED_WORKERS) $(ENABLE_SQL_DATABASE) $(ENABLE_STYLE_SCOPED) $(ENABLE_SVG) $(ENABLE_SVG_DOM_OBJC_BINDINGS) $(ENABLE_SVG_FONTS) $(ENABLE_TEXT_AUTOSIZING) $(ENABLE_TEXT_NOTIFICATIONS_ONLY) $(ENABLE_TOUCH_ICON_LOADING) $(ENABLE_UNDO_MANAGER) $(ENABLE_VIDEO) $(ENABLE_VIDEO_TRACK) $(ENABLE_WEBGL) $(ENABLE_WEB_AUDIO) $(ENABLE_WEB_SOCKETS) $(ENABLE_WEB_TIMING) $(ENABLE_WORKERS) $(ENABLE_XSLT);
+FEATURE_DEFINES = $(ENABLE_3D_RENDERING) $(ENABLE_ACCELERATED_2D_CANVAS) $(ENABLE_ANIMATION_API) $(ENABLE_BLOB) $(ENABLE_CHANNEL_MESSAGING) $(ENABLE_CSP_NEXT) $(ENABLE_CSS_BOX_DECORATION_BREAK) $(ENABLE_CSS_DEVICE_ADAPTATION) $(ENABLE_CSS_EXCLUSIONS) $(ENABLE_CSS_FILTERS) $(ENABLE_CSS_HIERARCHIES) $(ENABLE_CSS_IMAGE_ORIENTATION) $(ENABLE_CSS_IMAGE_RESOLUTION) $(ENABLE_CSS_REGIONS) $(ENABLE_CSS_SHADERS) $(ENABLE_CSS_COMPOSITING) $(ENABLE_CSS_STICKY_POSITION) $(ENABLE_CSS_VARIABLES) $(ENABLE_CSS3_CONDITIONAL_RULES) $(ENABLE_CSS3_TEXT) $(ENABLE_CUSTOM_SCHEME_HANDLER) $(ENABLE_DASHBOARD_SUPPORT) $(ENABLE_DATALIST_ELEMENT) $(ENABLE_DATA_TRANSFER_ITEMS) $(ENABLE_DETAILS_ELEMENT) $(ENABLE_DEVICE_ORIENTATION) $(ENABLE_DIALOG_ELEMENT) $(ENABLE_DIRECTORY_UPLOAD) $(ENABLE_DRAGGABLE_REGION) $(ENABLE_ENCRYPTED_MEDIA) $(ENABLE_FILE_SYSTEM) $(ENABLE_FILTERS) $(ENABLE_FULLSCREEN_API) $(ENABLE_GAMEPAD) $(ENABLE_GEOLOCATION) $(ENABLE_HIDDEN_PAGE_DOM_TIMER_THROTTLING) $(ENABLE_HIGH_DPI_CANVAS) $(ENABLE_ICONDATABASE) $(ENABLE_IFRAME_SEAMLESS) $(ENABLE_INDEXED_DATABASE) $(ENABLE_INPUT_SPEECH) $(ENABLE_INPUT_TYPE_COLOR) $(ENABLE_INPUT_TYPE_DATE) $(ENABLE_INPUT_TYPE_DATETIME) $(ENABLE_INPUT_TYPE_DATETIMELOCAL) $(ENABLE_INPUT_TYPE_MONTH) $(ENABLE_INPUT_TYPE_TIME) $(ENABLE_INPUT_TYPE_WEEK) $(ENABLE_JAVASCRIPT_DEBUGGER) $(ENABLE_LEGACY_CSS_VENDOR_PREFIXES) $(ENABLE_LEGACY_NOTIFICATIONS) $(ENABLE_LEGACY_VENDOR_PREFIXES) $(ENABLE_LEGACY_WEB_AUDIO) $(ENABLE_LINK_PREFETCH) $(ENABLE_LINK_PRERENDER) $(ENABLE_MATHML) $(ENABLE_MEDIA_SOURCE) $(ENABLE_MEDIA_STATISTICS) $(ENABLE_METER_ELEMENT) $(ENABLE_MHTML) $(ENABLE_MICRODATA) $(ENABLE_MUTATION_OBSERVERS) $(ENABLE_NAVIGATOR_CONTENT_UTILS) $(ENABLE_NOTIFICATIONS) $(ENABLE_PAGE_VISIBILITY_API) $(ENABLE_PDFKIT_PLUGIN) $(ENABLE_PROGRESS_ELEMENT) $(ENABLE_QUOTA) $(ENABLE_REQUEST_ANIMATION_FRAME) $(ENABLE_RESOLUTION_MEDIA_QUERY) $(ENABLE_SCRIPTED_SPEECH) $(ENABLE_SHADOW_DOM) $(ENABLE_SHARED_WORKERS) $(ENABLE_SQL_DATABASE) $(ENABLE_STYLE_SCOPED) $(ENABLE_SUBPIXEL_LAYOUT) $(ENABLE_SVG) $(ENABLE_SVG_DOM_OBJC_BINDINGS) $(ENABLE_SVG_FONTS) $(ENABLE_TEXT_AUTOSIZING) $(ENABLE_TEXT_NOTIFICATIONS_ONLY) $(ENABLE_TOUCH_ICON_LOADING) $(ENABLE_USERSELECT_ALL) $(ENABLE_VIDEO) $(ENABLE_VIDEO_TRACK) $(ENABLE_WEBGL) $(ENABLE_WEB_AUDIO) $(ENABLE_WEB_SOCKETS) $(ENABLE_WEB_TIMING) $(ENABLE_WORKERS) $(ENABLE_XHR_TIMEOUT) $(ENABLE_XSLT);
diff --git a/Source/WebCore/Configurations/Version.xcconfig b/Source/WebCore/Configurations/Version.xcconfig
index 0bc6e7174..8c018fcd9 100644
--- a/Source/WebCore/Configurations/Version.xcconfig
+++ b/Source/WebCore/Configurations/Version.xcconfig
@@ -22,7 +22,7 @@
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 
 MAJOR_VERSION = 537;
-MINOR_VERSION = 16;
+MINOR_VERSION = 18;
 TINY_VERSION = 0;
 FULL_VERSION = $(MAJOR_VERSION).$(MINOR_VERSION);
 
@@ -31,12 +31,10 @@ BUNDLE_VERSION = $(BUNDLE_VERSION_$(CONFIGURATION));
 SHORT_VERSION_STRING = $(SHORT_VERSION_STRING_$(CONFIGURATION))
 
 // The system version prefix is based on the current system version.
-SYSTEM_VERSION_PREFIX = $(SYSTEM_VERSION_PREFIX_$(REAL_PLATFORM_NAME));
+SYSTEM_VERSION_PREFIX = $(SYSTEM_VERSION_PREFIX_$(PLATFORM_NAME));
 SYSTEM_VERSION_PREFIX_iphoneos = 6; // iOS is most like SnowLeopard currently.
 SYSTEM_VERSION_PREFIX_iphonesimulator = $(SYSTEM_VERSION_PREFIX_iphoneos);
 SYSTEM_VERSION_PREFIX_macosx = $(SYSTEM_VERSION_PREFIX_macosx_$(TARGET_MAC_OS_X_VERSION_MAJOR));
-SYSTEM_VERSION_PREFIX_macosx_1050 = 5;
-SYSTEM_VERSION_PREFIX_macosx_1060 = 6;
 SYSTEM_VERSION_PREFIX_macosx_1070 = 7;
 SYSTEM_VERSION_PREFIX_macosx_1080 = 8;
 SYSTEM_VERSION_PREFIX_macosx_1090 = 9;
diff --git a/Source/WebCore/Configurations/WebCore.xcconfig b/Source/WebCore/Configurations/WebCore.xcconfig
index afa1f300e..87437cc58 100644
--- a/Source/WebCore/Configurations/WebCore.xcconfig
+++ b/Source/WebCore/Configurations/WebCore.xcconfig
@@ -28,15 +28,14 @@ EXPORTED_SYMBOLS_FILE = $(EXPORTED_SYMBOLS_FILE_$(CURRENT_ARCH));
 EXPORTED_SYMBOLS_FILE_ = $(BUILT_PRODUCTS_DIR)/DerivedSources/WebCore/WebCore.exp;
 EXPORTED_SYMBOLS_FILE_armv6 = $(BUILT_PRODUCTS_DIR)/DerivedSources/WebCore/WebCore.LP64.armv6.exp;
 EXPORTED_SYMBOLS_FILE_armv7 = $(BUILT_PRODUCTS_DIR)/DerivedSources/WebCore/WebCore.LP64.armv7.exp;
-EXPORTED_SYMBOLS_FILE_i386 = $(EXPORTED_SYMBOLS_FILE_i386_$(REAL_PLATFORM_NAME));
+EXPORTED_SYMBOLS_FILE_i386 = $(EXPORTED_SYMBOLS_FILE_i386_$(PLATFORM_NAME));
 EXPORTED_SYMBOLS_FILE_i386_iphonesimulator = $(BUILT_PRODUCTS_DIR)/DerivedSources/WebCore/WebCore.LP64.i386.exp;
 EXPORTED_SYMBOLS_FILE_i386_macosx = $(BUILT_PRODUCTS_DIR)/DerivedSources/WebCore/WebCore.exp;
 EXPORTED_SYMBOLS_FILE_ppc = $(BUILT_PRODUCTS_DIR)/DerivedSources/WebCore/WebCore.exp;
-EXPORTED_SYMBOLS_FILE_ppc64 = $(BUILT_PRODUCTS_DIR)/DerivedSources/WebCore/WebCore.LP64.exp;
 EXPORTED_SYMBOLS_FILE_x86_64 = $(BUILT_PRODUCTS_DIR)/DerivedSources/WebCore/WebCore.LP64.exp;
 GCC_PREFIX_HEADER = WebCorePrefix.h;
 GCC_PREPROCESSOR_DEFINITIONS = $(DEBUG_DEFINES) $(FEATURE_DEFINES) WEBKIT_VERSION_MIN_REQUIRED=WEBKIT_VERSION_LATEST $(GCC_PREPROCESSOR_DEFINITIONS);
-FRAMEWORK_SEARCH_PATHS = $(FRAMEWORK_SEARCH_PATHS_$(REAL_PLATFORM_NAME));
+FRAMEWORK_SEARCH_PATHS = $(FRAMEWORK_SEARCH_PATHS_$(PLATFORM_NAME));
 FRAMEWORK_SEARCH_PATHS_iphoneos = $(FRAMEWORK_SEARCH_PATHS_iphoneos_$(CONFIGURATION));
 FRAMEWORK_SEARCH_PATHS_iphoneos_Debug = $(BUILT_PRODUCTS_DIR) $(PRODUCTION_FRAMEWORKS_DIR);
 FRAMEWORK_SEARCH_PATHS_iphoneos_Release = $(FRAMEWORK_SEARCH_PATHS_iphoneos_Debug);
@@ -47,36 +46,33 @@ FRAMEWORK_SEARCH_PATHS_macosx = $(STAGED_FRAMEWORKS_SEARCH_PATH) $(SYSTEM_LIBRAR
 STAGED_FRAMEWORKS_SEARCH_PATH = $(STAGED_FRAMEWORKS_SEARCH_PATH_$(USE_STAGING_INSTALL_PATH));
 STAGED_FRAMEWORKS_SEARCH_PATH_YES = $(NEXT_ROOT)$(SYSTEM_LIBRARY_DIR)/StagedFrameworks/Safari;
 
-HEADER_SEARCH_PATHS = ForwardingHeaders icu /usr/include/libxslt /usr/include/libxml2 $(SQLITE3_HEADER_SEARCH_PATHS) "${BUILT_PRODUCTS_DIR}/DerivedSources/WebCore" "${BUILT_PRODUCTS_DIR}/usr/local/include" $(HEADER_SEARCH_PATHS);
+HEADER_SEARCH_PATHS = ForwardingHeaders icu /usr/include/libxslt /usr/include/libxml2 "${BUILT_PRODUCTS_DIR}/DerivedSources/WebCore" "${BUILT_PRODUCTS_DIR}/usr/local/include" $(HEADER_SEARCH_PATHS);
 INFOPLIST_FILE = Info.plist;
-INSTALL_PATH = $(INSTALL_PATH_$(REAL_PLATFORM_NAME));
+INSTALL_PATH = $(INSTALL_PATH_$(PLATFORM_NAME));
 INSTALL_PATH_iphoneos = $(SYSTEM_LIBRARY_DIR)/PrivateFrameworks;
 INSTALL_PATH_iphonesimulator = $(INDIGO_INSTALL_PATH_PREFIX)$(INSTALL_PATH_ACTUAL);
 INSTALL_PATH_macosx = $(WEBCORE_FRAMEWORKS_DIR);
-INSTALL_PATH_ACTUAL = $(INSTALL_PATH_ACTUAL_$(REAL_PLATFORM_NAME));
+INSTALL_PATH_ACTUAL = $(INSTALL_PATH_ACTUAL_$(PLATFORM_NAME));
 INSTALL_PATH_ACTUAL_iphonesimulator = $(INSTALL_PATH_iphoneos);
-DYLIB_INSTALL_NAME_BASE = $(DYLIB_INSTALL_NAME_BASE_$(REAL_PLATFORM_NAME));
+DYLIB_INSTALL_NAME_BASE = $(DYLIB_INSTALL_NAME_BASE_$(PLATFORM_NAME));
 DYLIB_INSTALL_NAME_BASE_macosx = $(NORMAL_WEBCORE_FRAMEWORKS_DIR);
 DYLIB_INSTALL_NAME_BASE_iphoneos = $(SYSTEM_LIBRARY_DIR)/PrivateFrameworks;
 DYLIB_INSTALL_NAME_BASE_iphonesimulator =  $(SDKROOT)$(DYLIB_INSTALL_NAME_BASE_iphoneos);
 INSTALLHDRS_COPY_PHASE = YES;
 INSTALLHDRS_SCRIPT_PHASE = YES;
 PRODUCT_NAME = WebCore;
-OTHER_LDFLAGS_BASE = -l$(SQLITE3_LIBRARY) -lobjc -lANGLE -allowable_client WebCoreTestSupport;
-OTHER_LDFLAGS = $(OTHER_LDFLAGS_$(REAL_PLATFORM_NAME));
+OTHER_LDFLAGS_BASE = -lsqlite3 -lobjc -lANGLE -allowable_client WebCoreTestSupport;
+OTHER_LDFLAGS = $(OTHER_LDFLAGS_$(PLATFORM_NAME));
 OTHER_LDFLAGS_iphoneos = $(OTHER_LDFLAGS_BASE) -framework CFNetwork -framework CoreFoundation -framework CoreGraphics -framework CoreText -framework Foundation -framework GraphicsServices -framework ImageIO -framework QuartzCore;
 OTHER_LDFLAGS_iphonesimulator = $(OTHER_LDFLAGS_iphoneos);
-OTHER_LDFLAGS_macosx = $(OTHER_LDFLAGS_BASE) -sub_library libobjc -umbrella WebKit $(WEBKIT2_LDFLAGS) $(OTHER_LDFLAGS_macosx_$(TARGET_MAC_OS_X_VERSION_MAJOR));
-OTHER_LDFLAGS_macosx_1070 = -Xlinker -objc_gc_compaction -framework IOSurface;
-OTHER_LDFLAGS_macosx_1080 = $(OTHER_LDFLAGS_macosx_1070);
-OTHER_LDFLAGS_macosx_1090 = $(OTHER_LDFLAGS_macosx_1070);
+OTHER_LDFLAGS_macosx = $(OTHER_LDFLAGS_BASE) -sub_library libobjc -umbrella WebKit -allowable_client WebKit2 -framework IOSurface;
 
-NORMAL_WEBCORE_FRAMEWORKS_DIR = $(NORMAL_WEBCORE_FRAMEWORKS_DIR_$(REAL_PLATFORM_NAME));
+NORMAL_WEBCORE_FRAMEWORKS_DIR = $(NORMAL_WEBCORE_FRAMEWORKS_DIR_$(PLATFORM_NAME));
 NORMAL_WEBCORE_FRAMEWORKS_DIR_iphoneos = $(PRODUCTION_FRAMEWORKS_DIR);
 NORMAL_WEBCORE_FRAMEWORKS_DIR_iphonesimulator = $(PRODUCTION_FRAMEWORKS_DIR);
 NORMAL_WEBCORE_FRAMEWORKS_DIR_macosx = $(SYSTEM_LIBRARY_DIR)/Frameworks/WebKit.framework/Versions/A/Frameworks;
 
-WEBCORE_FRAMEWORKS_DIR = $(WEBCORE_FRAMEWORKS_DIR_$(REAL_PLATFORM_NAME));
+WEBCORE_FRAMEWORKS_DIR = $(WEBCORE_FRAMEWORKS_DIR_$(PLATFORM_NAME));
 WEBCORE_FRAMEWORKS_DIR_iphoneos = $(NORMAL_WEBCORE_FRAMEWORKS_DIR_iphoneos);
 WEBCORE_FRAMEWORKS_DIR_iphonesimulator = $(WEBCORE_FRAMEWORKS_DIR_iphoneos);
 WEBCORE_FRAMEWORKS_DIR_macosx = $(WEBCORE_FRAMEWORKS_DIR_macosx_USE_STAGING_INSTALL_PATH_$(USE_STAGING_INSTALL_PATH));
@@ -84,12 +80,12 @@ WEBCORE_FRAMEWORKS_DIR_macosx_USE_STAGING_INSTALL_PATH_ = $(WEBCORE_FRAMEWORKS_D
 WEBCORE_FRAMEWORKS_DIR_macosx_USE_STAGING_INSTALL_PATH_NO = $(NORMAL_WEBCORE_FRAMEWORKS_DIR);
 WEBCORE_FRAMEWORKS_DIR_macosx_USE_STAGING_INSTALL_PATH_YES = $(SYSTEM_LIBRARY_DIR)/StagedFrameworks/Safari;
 
-NORMAL_PRODUCTION_FRAMEWORKS_DIR = $(NORMAL_PRODUCTION_FRAMEWORKS_DIR_$(REAL_PLATFORM_NAME));
+NORMAL_PRODUCTION_FRAMEWORKS_DIR = $(NORMAL_PRODUCTION_FRAMEWORKS_DIR_$(PLATFORM_NAME));
 NORMAL_PRODUCTION_FRAMEWORKS_DIR_iphoneos = $(SDKROOT)$(SYSTEM_LIBRARY_DIR)/PrivateFrameworks;
 NORMAL_PRODUCTION_FRAMEWORKS_DIR_iphonesimulator = $(NORMAL_PRODUCTION_FRAMEWORKS_DIR_iphoneos);
 NORMAL_PRODUCTION_FRAMEWORKS_DIR_macosx = $(NEXT_ROOT)$(SYSTEM_LIBRARY_DIR)/Frameworks;
 
-PRODUCTION_FRAMEWORKS_DIR = $(PRODUCTION_FRAMEWORKS_DIR_$(REAL_PLATFORM_NAME));
+PRODUCTION_FRAMEWORKS_DIR = $(PRODUCTION_FRAMEWORKS_DIR_$(PLATFORM_NAME));
 PRODUCTION_FRAMEWORKS_DIR_iphoneos = $(NORMAL_PRODUCTION_FRAMEWORKS_DIR_iphoneos);
 PRODUCTION_FRAMEWORKS_DIR_iphonesimulator = $(PRODUCTION_FRAMEWORKS_DIR_iphoneos);
 PRODUCTION_FRAMEWORKS_DIR_macosx = $(PRODUCTION_FRAMEWORKS_DIR_macosx_USE_STAGING_INSTALL_PATH_$(USE_STAGING_INSTALL_PATH));
@@ -98,12 +94,6 @@ PRODUCTION_FRAMEWORKS_DIR_macosx_USE_STAGING_INSTALL_PATH_NO = $(NORMAL_PRODUCTI
 PRODUCTION_FRAMEWORKS_DIR_macosx_USE_STAGING_INSTALL_PATH_YES = $(NEXT_ROOT)$(SYSTEM_LIBRARY_DIR)/StagedFrameworks/Safari;
 
 
-WEBKIT2_LDFLAGS = $(WEBKIT2_LDFLAGS_$(TARGET_MAC_OS_X_VERSION_MAJOR));
-WEBKIT2_LDFLAGS_1060 = -allowable_client WebKit2
-WEBKIT2_LDFLAGS_1070 = $(WEBKIT2_LDFLAGS_1060);
-WEBKIT2_LDFLAGS_1080 = $(WEBKIT2_LDFLAGS_1060);
-WEBKIT2_LDFLAGS_1090 = $(WEBKIT2_LDFLAGS_1060);
-
 JAVASCRIPTCORE_PRIVATE_HEADERS_DIR = $(JAVASCRIPTCORE_PRIVATE_HEADERS_DIR_$(CONFIGURATION));
 JAVASCRIPTCORE_PRIVATE_HEADERS_DIR_Release = $(JAVASCRIPTCORE_PRIVATE_HEADERS_engineering);
 JAVASCRIPTCORE_PRIVATE_HEADERS_DIR_Debug = $(JAVASCRIPTCORE_PRIVATE_HEADERS_engineering);
@@ -114,18 +104,8 @@ EXCLUDED_SOURCE_FILE_NAMES_SVG_DOM_OBJC_BINDINGS = $(EXCLUDED_SOURCE_FILE_NAMES_
 EXCLUDED_SOURCE_FILE_NAMES_SVG_DOM_OBJC_BINDINGS_ = DOMSVG*.* DOMHTMLFrameElementPrivate.h DOMHTMLIFrameElementPrivate.h;
 EXCLUDED_SOURCE_FILE_NAMES_SVG_DOM_OBJC_BINDINGS_ENABLE_SVG_DOM_OBJC_BINDINGS = ;
 
-EXCLUDED_SOURCE_FILE_NAMES = $(EXCLUDED_SOURCE_FILE_NAMES_$(REAL_PLATFORM_NAME)) $(EXCLUDED_SOURCE_FILE_NAMES_$(CONFIGURATION)_$(REAL_PLATFORM_NAME)) $(EXCLUDED_SOURCE_FILE_NAMES_SVG_DOM_OBJC_BINDINGS);
+EXCLUDED_SOURCE_FILE_NAMES = $(EXCLUDED_SOURCE_FILE_NAMES_$(PLATFORM_NAME)) $(EXCLUDED_SOURCE_FILE_NAMES_$(CONFIGURATION)_$(PLATFORM_NAME)) $(EXCLUDED_SOURCE_FILE_NAMES_SVG_DOM_OBJC_BINDINGS);
 EXCLUDED_SOURCE_FILE_NAMES_iphoneos = *.tiff *Cursor.png Cursor.cpp CursorMac.mm EventHandlerMac.mm HTMLConverter.mm KillRingMac.mm PlatformEventFactoryMac.mm SSLKeyGeneratorMac.cpp SearchPopupMenuMac.mm WebVideoFullscreenController.mm WebVideoFullscreenHUDWindowController.mm WebWindowAnimation.mm localizedStrings.js;
 EXCLUDED_SOURCE_FILE_NAMES_iphonesimulator = $(EXCLUDED_SOURCE_FILE_NAMES_iphoneos);
 EXCLUDED_SOURCE_FILE_NAMES_macosx = *IOS.h *IOS.cpp *IOS.mm KillRingNone.cpp;
 EXCLUDED_SOURCE_FILE_NAMES_Production_macosx = localizedStrings.js;
-
-SQLITE3_LIBRARY = $(SQLITE3_LIBRARY_$(REAL_PLATFORM_NAME));
-SQLITE3_LIBRARY_iphoneos = sqlite3;
-SQLITE3_LIBRARY_iphonesimulator = sqlite3;
-SQLITE3_LIBRARY_macosx = $(SQLITE3_LIBRARY_macosx_$(TARGET_MAC_OS_X_VERSION_MAJOR));
-SQLITE3_LIBRARY_macosx_1050 = WebCoreSQLite3;
-SQLITE3_LIBRARY_macosx_1060 = sqlite3;
-SQLITE3_LIBRARY_macosx_1070 = sqlite3;
-SQLITE3_LIBRARY_macosx_1080 = sqlite3;
-SQLITE3_LIBRARY_macosx_1090 = sqlite3;
diff --git a/Source/WebCore/DerivedSources.cpp b/Source/WebCore/DerivedSources.cpp
index 891d17e5f..02fcebb67 100644
--- a/Source/WebCore/DerivedSources.cpp
+++ b/Source/WebCore/DerivedSources.cpp
@@ -101,9 +101,6 @@
 #include "JSDOMStringList.cpp"
 #include "JSDOMStringMap.cpp"
 #include "JSDOMTokenList.cpp"
-#if ENABLE(UNDO_MANAGER)
-#include "JSDOMTransaction.cpp"
-#endif
 #include "JSDOMURL.cpp"
 #include "JSDOMWindow.cpp"
 #include "JSElement.cpp"
@@ -477,9 +474,6 @@
 #include "JSUint8Array.cpp"
 #include "JSUint8ClampedArray.cpp"
 #include "JSUIEvent.cpp"
-#if ENABLE(UNDO_MANAGER)
-#include "JSUndoManager.cpp"
-#endif
 #include "JSValidityState.cpp"
 #include "JSVoidCallback.cpp"
 #include "JSWebKitAnimation.cpp"
diff --git a/Source/WebCore/DerivedSources.make b/Source/WebCore/DerivedSources.make
index a0b77c5de..4c64c8951 100644
--- a/Source/WebCore/DerivedSources.make
+++ b/Source/WebCore/DerivedSources.make
@@ -266,8 +266,6 @@ BINDING_IDLS = \
     $(WebCore)/dom/WebKitNamedFlow.idl \
     $(WebCore)/dom/WebKitTransitionEvent.idl \
     $(WebCore)/dom/WheelEvent.idl \
-    $(WebCore)/editing/DOMTransaction.idl \
-    $(WebCore)/editing/UndoManager.idl \
     $(WebCore)/fileapi/Blob.idl \
     $(WebCore)/fileapi/File.idl \
     $(WebCore)/fileapi/FileError.idl \
@@ -670,12 +668,7 @@ ifeq ($(OS),MACOS)
 
 FRAMEWORK_FLAGS = $(shell echo $(BUILT_PRODUCTS_DIR) $(FRAMEWORK_SEARCH_PATHS) | perl -e 'print "-F " . join(" -F ", split(" ", <>));')
 HEADER_FLAGS = $(shell echo $(BUILT_PRODUCTS_DIR) $(HEADER_SEARCH_PATHS) | perl -e 'print "-I" . join(" -I", split(" ", <>));')
-
-ifeq ($(TARGET_GCC_VERSION),LLVM_COMPILER)
-	TEXT_PREPROCESSOR_FLAGS=-E -P -x c -traditional
-else
-	TEXT_PREPROCESSOR_FLAGS=-E -P -x c -std=c89
-endif
+TEXT_PREPROCESSOR_FLAGS=-E -P -x c -traditional
 
 ifneq ($(SDKROOT),)
 	SDK_FLAGS=-isysroot $(SDKROOT)
diff --git a/Source/WebCore/DerivedSources.pri b/Source/WebCore/DerivedSources.pri
index 010a0e657..9924e85d7 100644
--- a/Source/WebCore/DerivedSources.pri
+++ b/Source/WebCore/DerivedSources.pri
@@ -277,8 +277,6 @@ IDL_BINDINGS += \
     $$PWD/dom/DOMNamedFlowCollection.idl \
     $$PWD/dom/WebKitTransitionEvent.idl \
     $$PWD/dom/WheelEvent.idl \
-    $$PWD/editing/DOMTransaction.idl \
-    $$PWD/editing/UndoManager.idl \
     $$PWD/fileapi/Blob.idl \
     $$PWD/fileapi/File.idl \
     $$PWD/fileapi/FileError.idl \
diff --git a/Source/WebCore/English.lproj/Localizable.strings b/Source/WebCore/English.lproj/Localizable.strings
index 4c43150a7..56c65b026 100644
--- a/Source/WebCore/English.lproj/Localizable.strings
+++ b/Source/WebCore/English.lproj/Localizable.strings
diff --git a/Source/WebCore/English.lproj/localizedStrings.js b/Source/WebCore/English.lproj/localizedStrings.js
index a962ec553..1639c28cd 100644
--- a/Source/WebCore/English.lproj/localizedStrings.js
+++ b/Source/WebCore/English.lproj/localizedStrings.js
@@ -52,8 +52,8 @@ localizedStrings["(unable to decode value)"] = "(unable to decode value)";
 localizedStrings["(whitespace)"] = "(whitespace)";
 localizedStrings["Application Cache"] = "Application Cache";
 localizedStrings["Accept suggestion"] = "Accept suggestion";
-localizedStrings["Activate All breakpoints"] = "Activate All breakpoints";
-localizedStrings["Activate all breakpoints"] = "Activate all breakpoints";
+localizedStrings["Activate Breakpoints"] = "Activate Breakpoints";
+localizedStrings["Activate breakpoints."] = "Activate breakpoints.";
 localizedStrings["Add Attribute"] = "Add Attribute";
 localizedStrings["Add attribute"] = "Add attribute";
 localizedStrings["Add Breakpoint"] = "Add Breakpoint";
@@ -78,6 +78,7 @@ localizedStrings["Attribute Modified"] = "Attribute Modified";
 localizedStrings["Attributes Style"] = "Attributes Style";
 localizedStrings["Audit Present State"] = "Audit Present State";
 localizedStrings["Audits"] = "Audits";
+localizedStrings["Auto-reload CSS upon SASS save"] = "Auto-reload CSS upon SASS save";
 localizedStrings["Average"] = "Average";
 localizedStrings["Blocking"] = "Blocking";
 localizedStrings["Break on..."] = "Break on...";
@@ -113,6 +114,7 @@ localizedStrings["Collect JavaScript CPU Profile"] = "Collect JavaScript CPU Pro
 localizedStrings["Computed Style"] = "Computed Style";
 localizedStrings["Connecting"] = "Connecting";
 localizedStrings["Console"] = "Console";
+localizedStrings["Console was cleared"] = "Console was cleared";
 localizedStrings["Constructor"] = "Constructor";
 localizedStrings["Continue to Here"] = "Continue to Here";
 localizedStrings["Continue to here"] = "Continue to here";
@@ -134,9 +136,8 @@ localizedStrings["DOMContent event fired"] = "DOMContent event fired";
 localizedStrings["DOMContent event"] = "DOMContent event";
 localizedStrings["DOM Node Count"] = "DOM Node Count";
 localizedStrings["Database no longer has expected version."] = "Database no longer has expected version.";
-localizedStrings["Deactivate all breakpoints."] = "Deactivate all breakpoints.";
-localizedStrings["Deactivate All breakpoints"] = "Deactivate All breakpoints";
-localizedStrings["Debug"] = "Debug";
+localizedStrings["Deactivate breakpoints."] = "Deactivate breakpoints.";
+localizedStrings["Deactivate Breakpoints"] = "Deactivate Breakpoints";
 localizedStrings["Debugging disabled. Click to enable."] = "Debugging disabled. Click to enable.";
 localizedStrings["Debugging enabled. Click to disable."] = "Debugging enabled. Click to disable.";
 localizedStrings["Delete Node"] = "Delete Node";
@@ -184,7 +185,7 @@ localizedStrings["Event"] = "Event";
 localizedStrings["Exclude selected function."] = "Exclude selected function.";
 localizedStrings["Execute command"] = "Execute command";
 localizedStrings["Expand/collapse"] = "Expand/collapse";
-localizedStrings["Expires"] = "Expires";
+localizedStrings["Expires / Max-Age"] = "Expires / Max-Age";
 localizedStrings["File size"] = "File size";
 localizedStrings["Fit in window"] = "Fit in window";
 localizedStrings["Force Element State"] = "Force Element State";
@@ -376,7 +377,9 @@ localizedStrings["Show total and self times as percentages."] = "Show total and
 localizedStrings["Size"] = "Size";
 localizedStrings["Snapshot %d"] = "Snapshot %d";
 localizedStrings["End Time"] = "End Time";
+localizedStrings["Lat = "] = "Lat = ";
 localizedStrings["Latency"] = "Latency";
+localizedStrings["Lon = "] = "Lon = ";
 localizedStrings["Response Time"] = "Response Time";
 localizedStrings["Start"] = "Start";
 localizedStrings["Start CPU profiling."] = "Start CPU profiling.";
@@ -411,6 +414,7 @@ localizedStrings["This request has no response data available."] = "This request
 localizedStrings["Time"] = "Time";
 localizedStrings["Timeline"] = "Timeline";
 localizedStrings["Timeout"] = "Timeout";
+localizedStrings["Timeout (ms)"] = "Timeout (ms)";
 localizedStrings["Timer Fired"] = "Timer Fired";
 localizedStrings["Timer ID"] = "Timer ID";
 localizedStrings["Timing"] = "Timing";
@@ -594,6 +598,8 @@ localizedStrings["Search finished."] = "Search finished.";
 localizedStrings["Search interrupted."] = "Search interrupted.";
 localizedStrings["Add to Watch"] = "Add to Watch";
 localizedStrings["Add to watch"] = "Add to watch";
+localizedStrings["Add watch expression"] = "Add watch expression";
+localizedStrings["Add XHR breakpoint"] = "Add XHR breakpoint";
 localizedStrings["Indentation"] = "Indentation";
 localizedStrings["2 spaces"] = "2 spaces";
 localizedStrings["4 spaces"] = "4 spaces";
@@ -617,6 +623,8 @@ localizedStrings["Remove All DOM Breakpoints"] = "Remove All DOM Breakpoints";
 localizedStrings["Remove all DOM breakpoints"] = "Remove all DOM breakpoints";
 localizedStrings["Enable All Breakpoints"] = "Enable All Breakpoints";
 localizedStrings["Enable all breakpoints"] = "Enable all breakpoints";
+localizedStrings["Disable all breakpoints"] = "Disable all breakpoints";
+localizedStrings["Disable All Breakpoints"] = "Disable All Breakpoints";
 localizedStrings["Enable source maps"] = "Enable source maps";
 localizedStrings["Experiments"] = "Experiments";
 localizedStrings["WARNING:"] = "WARNING:";
@@ -759,3 +767,31 @@ localizedStrings["Binary File"] = "Binary File";
 localizedStrings["Modification Time"] = "Modification Time";
 localizedStrings["Directory"] = "Directory";
 localizedStrings["-"] = "-";
+localizedStrings["Memory cache resources"] = "Memory cache resources";
+localizedStrings["JavaScript heap"] = "JavaScript heap";
+localizedStrings["DOM storage cache"] = "DOM storage cache";
+localizedStrings["Live native memory chart"] = "Live native memory chart";
+localizedStrings["Support for SASS"] = "Support for SASS";
+localizedStrings["Render tree used"] = "Render tree used";
+localizedStrings["Snippets support"] = "Snippets support";
+localizedStrings["Inspector data"] = "Inspector data";
+localizedStrings["FileSystem inspection"] = "FileSystem inspection";
+localizedStrings["Use CodeMirror editor"] = "Use CodeMirror editor";
+localizedStrings["Override Device Geolocation"] = "Override Device Geolocation";
+localizedStrings["Page's structures"] = "Page's structures";
+localizedStrings["Native memory profiling"] = "Native memory profiling";
+localizedStrings["OwnersTypePlaceholder"] = "OwnersTypePlaceholder";
+localizedStrings["JavaScript external arrays"] = "JavaScript external arrays";
+localizedStrings["JavaScript external strings"] = "JavaScript external strings";
+localizedStrings["Show CPU activity on the ruler"] = "Show CPU activity on the ruler";
+localizedStrings["Render tree"] = "Render tree";
+localizedStrings["Canvas inspection"] = "Canvas inspection";
+localizedStrings["Message Count"] = "Message Count";
+localizedStrings["Used JavaScript heap"] = "Used JavaScript heap";
+localizedStrings["JavaScript external resources"] = "JavaScript external resources";
+localizedStrings["Glyph cache resources"] = "Glyph cache resources";
+localizedStrings["CSS Regions Support"] = "CSS Regions Support";
+localizedStrings["Scroll"] = "Scroll";
+localizedStrings["Detached from the target"] = "Detached from the target";
+localizedStrings["Remote debugging has been terminated with reason: "] = "Remote debugging has been terminated with reason: ";
+localizedStrings["Please re-attach to the new target."] = "Please re-attach to the new target.";
diff --git a/Source/JavaScriptCore/bytecode/MethodCallLinkInfo.cpp b/Source/WebCore/ForwardingHeaders/interpreter/VMInspector.h
index 1fcf5850f..86953a52e 100644
--- a/Source/JavaScriptCore/bytecode/MethodCallLinkInfo.cpp
+++ b/Source/WebCore/ForwardingHeaders/interpreter/VMInspector.h
@@ -23,28 +23,7 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
-#include "config.h"
-#include "MethodCallLinkInfo.h"
-
-#if ENABLE(JIT)
-
-#include "JITStubs.h"
-#include "RepatchBuffer.h"
-
-namespace JSC {
-
-void MethodCallLinkInfo::reset(RepatchBuffer& repatchBuffer, JITCode::JITType jitType)
-{
-    cachedStructure.clearToMaxUnsigned();
-    cachedPrototype.clear();
-    cachedPrototypeStructure.clearToMaxUnsigned();
-    cachedFunction.clear();
-    
-    ASSERT_UNUSED(jitType, jitType == JITCode::BaselineJIT);
-    
-    repatchBuffer.relink(callReturnLocation, cti_op_get_by_id_method_check);
-}
-
-} // namespace JSC
-
-#endif // ENABLE(JIT)
+#ifndef WebCore_FWD_VMInspector_h
+#define WebCore_FWD_VMInspector_h
+#include <JavaScriptCore/VMInspector.h>
+#endif
diff --git a/Source/WebCore/GNUmakefile.am b/Source/WebCore/GNUmakefile.am
index 5d63da6d3..e66bf0547 100644
--- a/Source/WebCore/GNUmakefile.am
+++ b/Source/WebCore/GNUmakefile.am
@@ -73,6 +73,7 @@ webcore_cppflags += \
 	-I$(srcdir)/Source/WebCore/platform/mediastream/gstreamer \
 	-I$(srcdir)/Source/WebCore/platform/mock \
 	-I$(srcdir)/Source/WebCore/platform/network \
+	-I$(srcdir)/Source/WebCore/platform/network/gtk \
 	-I$(srcdir)/Source/WebCore/platform/sql \
 	-I$(srcdir)/Source/WebCore/platform/text \
 	-I$(srcdir)/Source/WebCore/platform/text/transcoder \
@@ -206,6 +207,15 @@ $(GENSOURCES_WEBCORE)/XPathGrammar.cpp: $(WebCore)/xml/XPathGrammar.y
 	$(AM_V_at)perl $(WebCore)/css/makegrammar.pl --outputDir $(GENSOURCES_WEBCORE) --bison "$(BISON)" --symbolsPrefix xpathyy $<
 
 # ----
+# XHR timeout Support
+# ----
+if ENABLE_XHR_TIMEOUT
+feature_defines_overrides += ENABLE_XHR_TIMEOUT=1
+else
+feature_defines_overrides += ENABLE_XHR_TIMEOUT=0
+endif # END ENABLE_XHR_TIMEOUT
+
+# ----
 # XSLT Support
 # ----
 if ENABLE_XSLT
@@ -224,6 +234,15 @@ feature_defines_overrides += ENABLE_FILTERS=0
 endif # END ENABLE_FILTERS
 
 # ----
+# CSS Device Adaptation
+# ----
+if ENABLE_CSS_DEVICE_ADAPTATION
+feature_defines_overrides += ENABLE_CSS_DEVICE_ADAPTATION=1
+else
+feature_defines_overrides += ENABLE_CSS_DEVICE_ADAPTATION=0
+endif # END ENABLE_CSS_DEVICE_ADAPTATION
+
+# ----
 # Shaders
 # ----
 if ENABLE_CSS_SHADERS
@@ -623,6 +642,7 @@ libWebCore_la_CPPFLAGS = \
 	$(GEOCLUE_CFLAGS) \
 	$(GLIB_CFLAGS) \
 	$(GSTREAMER_CFLAGS) \
+	$(LIBSECRET_CFLAGS) \
 	$(LIBSOUP_CFLAGS) \
 	$(LIBXML_CFLAGS) \
 	$(LIBXSLT_CFLAGS) \
@@ -686,6 +706,7 @@ libWebCoreGtk_la_CPPFLAGS = \
 	$(GSTREAMER_CFLAGS) \
 	$(GTK_CFLAGS) \
 	$(HILDON_CFLAGS) \
+	$(LIBSECRET_CFLAGS) \
 	$(LIBSOUP_CFLAGS) \
 	$(LIBXML_CFLAGS) \
 	$(LIBXSLT_CFLAGS) \
diff --git a/Source/WebCore/GNUmakefile.features.am b/Source/WebCore/GNUmakefile.features.am
index 9c4c9d82c..0eb137768 100644
--- a/Source/WebCore/GNUmakefile.features.am
+++ b/Source/WebCore/GNUmakefile.features.am
@@ -9,6 +9,7 @@ feature_defines_defaults += \
 	ENABLE_CSS3_TEXT=1 \
 	ENABLE_CSS_BOX_DECORATION_BREAK=1 \
 	ENABLE_CSS_COMPOSITING=0 \
+	ENABLE_CSS_DEVICE_ADAPTATION=0 \
 	ENABLE_CSS_EXCLUSIONS=1 \
 	ENABLE_CSS_FILTERS=0 \
 	ENABLE_CSS_HIERARCHIES=0 \
@@ -85,7 +86,6 @@ feature_defines_defaults += \
 	ENABLE_TEXT_AUTOSIZING=0 \
 	ENABLE_TOUCH_EVENTS=0 \
 	ENABLE_TOUCH_ICON_LOADING=0 \
-	ENABLE_UNDO_MANAGER=0 \
 	ENABLE_VIBRATION=0 \
 	ENABLE_VIDEO=1 \
 	ENABLE_VIDEO_TRACK=1 \
@@ -96,4 +96,5 @@ feature_defines_defaults += \
 	ENABLE_WEB_SOCKETS=1 \
 	ENABLE_WEB_TIMING=1 \
 	ENABLE_WORKERS=1 \
+	ENABLE_XHR_TIMEOUT=1 \
 	ENABLE_XSLT=1
diff --git a/Source/WebCore/GNUmakefile.list.am b/Source/WebCore/GNUmakefile.list.am
index 7b85ba4fb..f00904031 100644
--- a/Source/WebCore/GNUmakefile.list.am
+++ b/Source/WebCore/GNUmakefile.list.am
@@ -209,8 +209,6 @@ webcore_built_sources += \
 	DerivedSources/WebCore/JSDOMStringMap.h \
 	DerivedSources/WebCore/JSDOMTokenList.cpp \
 	DerivedSources/WebCore/JSDOMTokenList.h \
-	DerivedSources/WebCore/JSDOMTransaction.cpp \
-	DerivedSources/WebCore/JSDOMTransaction.h \
 	DerivedSources/WebCore/JSDOMURL.cpp \
 	DerivedSources/WebCore/JSDOMURL.h \
 	DerivedSources/WebCore/JSDOMWindow.cpp \
@@ -1055,8 +1053,6 @@ webcore_built_sources += \
 	DerivedSources/WebCore/JSUint8Array.h \
 	DerivedSources/WebCore/JSUint8ClampedArray.cpp \
 	DerivedSources/WebCore/JSUint8ClampedArray.h \
-	DerivedSources/WebCore/JSUndoManager.cpp \
-	DerivedSources/WebCore/JSUndoManager.h \
 	DerivedSources/WebCore/JSValidityState.cpp \
 	DerivedSources/WebCore/JSValidityState.h \
 	DerivedSources/WebCore/JSVoidCallback.cpp \
@@ -1411,8 +1407,6 @@ dom_binding_idls += \
 	$(WebCore)/dom/WebKitNamedFlow.idl \
 	$(WebCore)/dom/WebKitTransitionEvent.idl \
 	$(WebCore)/dom/WheelEvent.idl \
-	$(WebCore)/editing/DOMTransaction.idl \
-	$(WebCore)/editing/UndoManager.idl \
 	$(WebCore)/fileapi/Blob.idl \
 	$(WebCore)/fileapi/File.idl \
 	$(WebCore)/fileapi/FileError.idl \
@@ -2215,6 +2209,8 @@ webcore_sources += \
 	Source/WebCore/accessibility/AccessibilitySlider.h \
 	Source/WebCore/accessibility/AccessibilitySpinButton.cpp \
 	Source/WebCore/accessibility/AccessibilitySpinButton.h \
+	Source/WebCore/accessibility/AccessibilitySVGRoot.cpp \
+	Source/WebCore/accessibility/AccessibilitySVGRoot.h \
 	Source/WebCore/accessibility/AccessibilityTableCell.cpp \
 	Source/WebCore/accessibility/AccessibilityTableCell.h \
 	Source/WebCore/accessibility/AccessibilityTableColumn.cpp \
@@ -2243,8 +2239,6 @@ webcore_sources += \
 	Source/WebCore/bindings/js/CallbackFunction.h \
 	Source/WebCore/bindings/js/DOMObjectHashTableMap.cpp \
 	Source/WebCore/bindings/js/DOMObjectHashTableMap.h \
-	Source/WebCore/bindings/js/DOMTransaction.cpp \
-	Source/WebCore/bindings/js/DOMTransaction.h \
 	Source/WebCore/bindings/js/DOMWrapperWorld.cpp \
 	Source/WebCore/bindings/js/DOMWrapperWorld.h \
 	Source/WebCore/bindings/js/GCController.cpp \
@@ -2408,7 +2402,6 @@ webcore_sources += \
 	Source/WebCore/bindings/js/JSTrackCustom.h \
 	Source/WebCore/bindings/js/JSTrackEventCustom.cpp \
 	Source/WebCore/bindings/js/JSTreeWalkerCustom.cpp \
-	Source/WebCore/bindings/js/JSUndoManagerCustom.cpp \
 	Source/WebCore/bindings/js/JSWebKitAnimationCustom.cpp \
 	Source/WebCore/bindings/js/JSWebKitAnimationListCustom.cpp \
 	Source/WebCore/bindings/js/JSWebKitCSSKeyframeRuleCustom.cpp \
@@ -2687,6 +2680,8 @@ webcore_sources += \
 	Source/WebCore/css/WebKitCSSShaderValue.h \
 	Source/WebCore/css/WebKitCSSTransformValue.cpp \
 	Source/WebCore/css/WebKitCSSTransformValue.h \
+	Source/WebCore/css/WebKitCSSViewportRule.cpp \
+	Source/WebCore/css/WebKitCSSViewportRule.h \
 	Source/WebCore/dom/ActiveDOMObject.cpp \
 	Source/WebCore/dom/ActiveDOMObject.h \
 	Source/WebCore/dom/Attr.cpp \
@@ -2796,11 +2791,12 @@ webcore_sources += \
 	Source/WebCore/dom/EditingText.h \
 	Source/WebCore/dom/Element.cpp \
 	Source/WebCore/dom/Element.h \
-	Source/WebCore/dom/ElementShadow.cpp \
-	Source/WebCore/dom/ElementShadow.h \
 	Source/WebCore/dom/ElementAttributeData.cpp \
 	Source/WebCore/dom/ElementAttributeData.h \
+	Source/WebCore/dom/ElementRareData.cpp \
 	Source/WebCore/dom/ElementRareData.h \
+	Source/WebCore/dom/ElementShadow.cpp \
+	Source/WebCore/dom/ElementShadow.h \
 	Source/WebCore/dom/Entity.h \
 	Source/WebCore/dom/EntityReference.cpp \
 	Source/WebCore/dom/EntityReference.h \
@@ -2883,6 +2879,7 @@ webcore_sources += \
 	Source/WebCore/dom/NodeFilterCondition.h \
 	Source/WebCore/dom/NodeFilter.cpp \
 	Source/WebCore/dom/NodeFilter.h \
+	Source/WebCore/dom/NodeRareData.cpp \
 	Source/WebCore/dom/NodeRenderingContext.cpp \
 	Source/WebCore/dom/Node.h \
 	Source/WebCore/dom/NodeIterator.cpp \
@@ -3021,8 +3018,6 @@ webcore_sources += \
 	Source/WebCore/editing/DictationAlternative.h \
 	Source/WebCore/editing/DictationCommand.cpp \
 	Source/WebCore/editing/DictationCommand.h \
-	Source/WebCore/editing/DOMTransactionStep.cpp \
-	Source/WebCore/editing/DOMTransactionStep.h \
 	Source/WebCore/editing/EditAction.h \
 	Source/WebCore/editing/EditCommand.cpp \
 	Source/WebCore/editing/EditCommand.h \
@@ -3112,8 +3107,6 @@ webcore_sources += \
 	Source/WebCore/editing/TextIterator.h \
 	Source/WebCore/editing/TypingCommand.cpp \
 	Source/WebCore/editing/TypingCommand.h \
-	Source/WebCore/editing/UndoManager.cpp \
-	Source/WebCore/editing/UndoManager.h \
 	Source/WebCore/editing/UndoStep.h \
 	Source/WebCore/editing/UnlinkCommand.cpp \
 	Source/WebCore/editing/UnlinkCommand.h \
@@ -3172,6 +3165,8 @@ webcore_sources += \
 	Source/WebCore/html/BaseButtonInputType.h \
 	Source/WebCore/html/BaseCheckableInputType.cpp \
 	Source/WebCore/html/BaseCheckableInputType.h \
+	Source/WebCore/html/BaseChooserOnlyDateAndTimeInputType.cpp \
+	Source/WebCore/html/BaseChooserOnlyDateAndTimeInputType.h \
 	Source/WebCore/html/BaseClickableWithKeyInputType.cpp \
 	Source/WebCore/html/BaseClickableWithKeyInputType.h \
 	Source/WebCore/html/BaseDateAndTimeInputType.cpp \
@@ -3860,6 +3855,7 @@ webcore_sources += \
 	Source/WebCore/loader/cache/CachedXSLStyleSheet.h \
 	Source/WebCore/loader/cache/MemoryCache.h \
 	Source/WebCore/loader/cache/CachePolicy.h \
+	Source/WebCore/loader/CachedMetadata.cpp \
 	Source/WebCore/loader/CachedMetadata.h \
 	Source/WebCore/loader/CrossOriginAccessControl.cpp \
 	Source/WebCore/loader/CrossOriginAccessControl.h \
@@ -3913,6 +3909,8 @@ webcore_sources += \
 	Source/WebCore/loader/LinkLoader.h \
 	Source/WebCore/loader/LinkLoader.cpp \
 	Source/WebCore/loader/LinkLoaderClient.h \
+	Source/WebCore/loader/LoaderStrategy.cpp \
+	Source/WebCore/loader/LoaderStrategy.h \
 	Source/WebCore/loader/MainResourceLoader.cpp \
 	Source/WebCore/loader/MainResourceLoader.h \
     Source/WebCore/loader/MixedContentChecker.cpp \
@@ -4333,11 +4331,17 @@ webcore_sources += \
 	Source/WebCore/platform/graphics/filters/CustomFilterNumberParameter.h \
 	Source/WebCore/platform/graphics/filters/CustomFilterOperation.cpp \
 	Source/WebCore/platform/graphics/filters/CustomFilterOperation.h \
+	Source/WebCore/platform/graphics/filters/ValidatedCustomFilterOperation.cpp \
+	Source/WebCore/platform/graphics/filters/ValidatedCustomFilterOperation.h \
 	Source/WebCore/platform/graphics/filters/CustomFilterParameter.h \
+	Source/WebCore/platform/graphics/filters/CustomFilterParameterList.cpp \
+	Source/WebCore/platform/graphics/filters/CustomFilterParameterList.h \
 	Source/WebCore/platform/graphics/filters/CustomFilterProgram.cpp \
 	Source/WebCore/platform/graphics/filters/CustomFilterProgram.h \
 	Source/WebCore/platform/graphics/filters/CustomFilterProgramInfo.cpp \
 	Source/WebCore/platform/graphics/filters/CustomFilterProgramInfo.h \
+	Source/WebCore/platform/graphics/filters/CustomFilterRenderer.cpp \
+	Source/WebCore/platform/graphics/filters/CustomFilterRenderer.h \
 	Source/WebCore/platform/graphics/filters/CustomFilterCompiledProgram.cpp \
 	Source/WebCore/platform/graphics/filters/CustomFilterCompiledProgram.h \
 	Source/WebCore/platform/graphics/filters/CustomFilterTransformParameter.h \
@@ -4732,7 +4736,10 @@ webcore_sources += \
 	Source/WebCore/platform/network/SocketStreamHandleBase.cpp \
 	Source/WebCore/platform/network/SocketStreamHandleBase.h \
 	Source/WebCore/platform/network/SocketStreamHandleClient.h \
+	Source/WebCore/platform/network/gtk/CredentialBackingStore.cpp \
+	Source/WebCore/platform/network/gtk/CredentialBackingStore.h \
 	Source/WebCore/platform/network/soup/AuthenticationChallenge.h \
+	Source/WebCore/platform/network/soup/AuthenticationChallengeSoup.cpp \
 	Source/WebCore/platform/network/soup/CookieJarSoup.cpp \
 	Source/WebCore/platform/network/soup/CookieJarSoup.h \
 	Source/WebCore/platform/network/soup/CookieStorageSoup.cpp \
@@ -4847,9 +4854,9 @@ webcore_sources += \
 	Source/WebCore/platform/text/LocaleNone.cpp \
 	Source/WebCore/platform/text/LocaleToScriptMapping.h \
 	Source/WebCore/platform/text/LocaleToScriptMappingDefault.cpp \
-	Source/WebCore/platform/text/Localizer.cpp \
-	Source/WebCore/platform/text/Localizer.h \
 	Source/WebCore/platform/text/ParserUtilities.h \
+	Source/WebCore/platform/text/PlatformLocale.cpp \
+	Source/WebCore/platform/text/PlatformLocale.h \
 	Source/WebCore/platform/text/QuotedPrintable.cpp \
 	Source/WebCore/platform/text/QuotedPrintable.h \
 	Source/WebCore/platform/text/RegularExpression.cpp \
@@ -5420,6 +5427,7 @@ webcore_sources += \
 	Source/WebCore/svg/graphics/filters/SVGFilter.h \
 	Source/WebCore/svg/graphics/SVGImageCache.cpp \
 	Source/WebCore/svg/graphics/SVGImageCache.h \
+	Source/WebCore/svg/graphics/SVGImageChromeClient.h \
 	Source/WebCore/svg/graphics/SVGImage.cpp \
 	Source/WebCore/svg/graphics/SVGImage.h \
 	Source/WebCore/svg/LinearGradientAttributes.h \
diff --git a/Source/WebCore/Modules/filesystem/DirectoryEntry.h b/Source/WebCore/Modules/filesystem/DirectoryEntry.h
index 58c9e7f67..5055c631b 100644
--- a/Source/WebCore/Modules/filesystem/DirectoryEntry.h
+++ b/Source/WebCore/Modules/filesystem/DirectoryEntry.h
@@ -56,8 +56,8 @@ public:
     virtual bool isDirectory() const { return true; }
 
     PassRefPtr<DirectoryReader> createReader();
-    void getFile(const String& path, const Dictionary& = Dictionary(), PassRefPtr<EntryCallback> = 0, PassRefPtr<ErrorCallback> = 0);
-    void getDirectory(const String& path, const Dictionary& = Dictionary(), PassRefPtr<EntryCallback> = 0, PassRefPtr<ErrorCallback> = 0);
+    void getFile(const String& path, const Dictionary&, PassRefPtr<EntryCallback> = 0, PassRefPtr<ErrorCallback> = 0);
+    void getDirectory(const String& path, const Dictionary&, PassRefPtr<EntryCallback> = 0, PassRefPtr<ErrorCallback> = 0);
     void removeRecursively(PassRefPtr<VoidCallback> successCallback = 0, PassRefPtr<ErrorCallback> = 0) const;
 
 private:
diff --git a/Source/WebCore/Modules/filesystem/chromium/DOMFileSystemChromium.cpp b/Source/WebCore/Modules/filesystem/chromium/DOMFileSystemChromium.cpp
index 456dec50f..0a41b11eb 100644
--- a/Source/WebCore/Modules/filesystem/chromium/DOMFileSystemChromium.cpp
+++ b/Source/WebCore/Modules/filesystem/chromium/DOMFileSystemChromium.cpp
@@ -90,7 +90,9 @@ KURL DOMFileSystemBase::createFileSystemURL(const String& fullPath) const
         result.append(securityOrigin()->toString());
         result.append("/");
         result.append(externalPathPrefix);
-        result.append(encodeWithURLEscapeSequences(fullPath));
+        result.append(m_filesystemRootURL.path());
+        // Remove the extra leading slash.
+        result.append(encodeWithURLEscapeSequences(fullPath.substring(1)));
         return KURL(ParsedURLString, result.toString());
     }
 
diff --git a/Source/WebCore/Modules/indexeddb/IDBBackingStore.h b/Source/WebCore/Modules/indexeddb/IDBBackingStore.h
index d37493b98..bfc3876a3 100644
--- a/Source/WebCore/Modules/indexeddb/IDBBackingStore.h
+++ b/Source/WebCore/Modules/indexeddb/IDBBackingStore.h
@@ -30,6 +30,7 @@
 
 #include "IDBCursor.h"
 #include "IDBKeyPath.h"
+#include "IDBMetadata.h"
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefCounted.h>
 #include <wtf/RefPtr.h>
@@ -49,14 +50,14 @@ public:
 
     virtual ~IDBBackingStore() {};
 
-    virtual void getDatabaseNames(Vector<String>& foundNames) = 0;
+    virtual Vector<String> getDatabaseNames() = 0;
     virtual bool getIDBDatabaseMetaData(const String& name, IDBDatabaseMetadata* foundMetadata) = 0;
     virtual bool createIDBDatabaseMetaData(const String& name, const String& stringVersion, int64_t intVersion, int64_t& rowId) = 0;
     virtual bool updateIDBDatabaseIntVersion(Transaction*, int64_t rowId, int64_t intVersion) = 0;
     virtual bool updateIDBDatabaseMetaData(Transaction*, int64_t rowId, const String& version) = 0;
     virtual bool deleteDatabase(const String& name) = 0;
 
-    virtual void getObjectStores(int64_t databaseId, Vector<int64_t>& foundIds, Vector<String>& foundNames, Vector<IDBKeyPath>& foundKeyPaths, Vector<bool>& foundAutoIncrementFlags, Vector<int64_t>& foundMaxIndexIds) = 0;
+    virtual Vector<IDBObjectStoreMetadata> getObjectStores(int64_t databaseId) = 0;
     virtual bool createObjectStore(Transaction*, int64_t databaseId, int64_t objectStoreId, const String& name, const IDBKeyPath&, bool autoIncrement) = 0;
     virtual void deleteObjectStore(Transaction*, int64_t databaseId, int64_t objectStoreId) = 0;
 
@@ -82,7 +83,7 @@ public:
     };
     virtual bool forEachObjectStoreRecord(Transaction*, int64_t databaseId, int64_t objectStoreId, ObjectStoreRecordCallback&) = 0;
 
-    virtual void getIndexes(int64_t databaseId, int64_t objectStoreId, Vector<int64_t>& foundIds, Vector<String>& foundNames, Vector<IDBKeyPath>& foundKeyPaths, Vector<bool>& foundUniqueFlags, Vector<bool>& foundMultiEntryFlags) = 0;
+    virtual Vector<IDBIndexMetadata> getIndexes(int64_t databaseId, int64_t objectStoreId) = 0;
     virtual bool createIndex(Transaction*, int64_t databaseId, int64_t objectStoreId, int64_t indexId, const String& name, const IDBKeyPath&, bool isUnique, bool isMultiEntry) = 0;
     virtual void deleteIndex(Transaction*, int64_t databaseId, int64_t objectStoreId, int64_t indexId) = 0;
     virtual bool putIndexDataForRecord(Transaction*, int64_t databaseId, int64_t objectStoreId, int64_t indexId, const IDBKey&, const ObjectStoreRecordIdentifier*) = 0;
diff --git a/Source/WebCore/Modules/indexeddb/IDBCallbacks.h b/Source/WebCore/Modules/indexeddb/IDBCallbacks.h
index c394068c5..dfd8e2092 100644
--- a/Source/WebCore/Modules/indexeddb/IDBCallbacks.h
+++ b/Source/WebCore/Modules/indexeddb/IDBCallbacks.h
@@ -67,7 +67,7 @@ public:
 
     // From IDBFactor.deleteDatabase(), IDBObjectStore/IDBIndex.get(), IDBObjectStore.delete(), IDBObjectStore.clear()
     virtual void onSuccess() = 0;
-    
+
     // From IDBCursor.advance()/continue()
     virtual void onSuccess(PassRefPtr<IDBKey>, PassRefPtr<IDBKey> primaryKey, PassRefPtr<SerializedScriptValue>) = 0;
     // From IDBCursor.advance()/continue()
diff --git a/Source/WebCore/Modules/indexeddb/IDBCursor.cpp b/Source/WebCore/Modules/indexeddb/IDBCursor.cpp
index f2ad16342..a69d4c3f1 100644
--- a/Source/WebCore/Modules/indexeddb/IDBCursor.cpp
+++ b/Source/WebCore/Modules/indexeddb/IDBCursor.cpp
@@ -101,16 +101,16 @@ const String& IDBCursor::direction() const
     return direction;
 }
 
-PassRefPtr<IDBKey> IDBCursor::key() const
+const ScriptValue& IDBCursor::key() const
 {
     IDB_TRACE("IDBCursor::key");
-    return m_currentKey;
+    return m_currentKeyValue;
 }
 
-PassRefPtr<IDBKey> IDBCursor::primaryKey() const
+const ScriptValue& IDBCursor::primaryKey() const
 {
     IDB_TRACE("IDBCursor::primaryKey");
-    return m_currentPrimaryKey;
+    return m_currentPrimaryKeyValue;
 }
 
 const ScriptValue& IDBCursor::value() const
@@ -257,10 +257,13 @@ void IDBCursor::close()
     }
 }
 
-void IDBCursor::setValueReady(PassRefPtr<IDBKey> key, PassRefPtr<IDBKey> primaryKey, ScriptValue& value)
+void IDBCursor::setValueReady(ScriptExecutionContext* context, PassRefPtr<IDBKey> key, PassRefPtr<IDBKey> primaryKey, ScriptValue& value)
 {
     m_currentKey = key;
+    m_currentKeyValue = idbKeyToScriptValue(context, m_currentKey);
+
     m_currentPrimaryKey = primaryKey;
+    m_currentPrimaryKeyValue = idbKeyToScriptValue(context, m_currentPrimaryKey);
 
     if (!isKeyCursor()) {
         RefPtr<IDBObjectStore> objectStore = effectiveObjectStore();
diff --git a/Source/WebCore/Modules/indexeddb/IDBCursor.h b/Source/WebCore/Modules/indexeddb/IDBCursor.h
index abe6becd8..188ab2e2a 100644
--- a/Source/WebCore/Modules/indexeddb/IDBCursor.h
+++ b/Source/WebCore/Modules/indexeddb/IDBCursor.h
@@ -70,8 +70,8 @@ public:
 
     // Implement the IDL
     const String& direction() const;
-    PassRefPtr<IDBKey> key() const;
-    PassRefPtr<IDBKey> primaryKey() const;
+    const ScriptValue& key() const;
+    const ScriptValue& primaryKey() const;
     const ScriptValue& value() const;
     IDBAny* source() const;
 
@@ -83,7 +83,8 @@ public:
 
     void postSuccessHandlerCallback();
     void close();
-    void setValueReady(PassRefPtr<IDBKey>, PassRefPtr<IDBKey> primaryKey, ScriptValue&);
+    void setValueReady(ScriptExecutionContext*, PassRefPtr<IDBKey>, PassRefPtr<IDBKey> primaryKey, ScriptValue&);
+    PassRefPtr<IDBKey> idbPrimaryKey() { return m_currentPrimaryKey; }
 
 protected:
     IDBCursor(PassRefPtr<IDBCursorBackendInterface>, Direction, IDBRequest*, IDBAny* source, IDBTransaction*);
@@ -101,6 +102,8 @@ private:
     bool m_gotValue;
     // These values are held because m_backend may advance while they
     // are still valid for the current success handlers.
+    ScriptValue m_currentKeyValue;
+    ScriptValue m_currentPrimaryKeyValue;
     RefPtr<IDBKey> m_currentKey;
     RefPtr<IDBKey> m_currentPrimaryKey;
     ScriptValue m_currentValue;
diff --git a/Source/WebCore/Modules/indexeddb/IDBCursor.idl b/Source/WebCore/Modules/indexeddb/IDBCursor.idl
index 0d9dd0ad1..4757093c8 100644
--- a/Source/WebCore/Modules/indexeddb/IDBCursor.idl
+++ b/Source/WebCore/Modules/indexeddb/IDBCursor.idl
@@ -33,8 +33,8 @@
     const unsigned short PREV_NO_DUPLICATE = 3;
 
     readonly attribute DOMString direction;
-    readonly attribute IDBKey key;
-    readonly attribute IDBKey primaryKey;
+    readonly attribute any key;
+    readonly attribute any primaryKey;
     readonly attribute IDBAny source;
 
     [CallWith=ScriptExecutionContext] IDBRequest update(in any value)
diff --git a/Source/WebCore/Modules/indexeddb/IDBDatabase.cpp b/Source/WebCore/Modules/indexeddb/IDBDatabase.cpp
index 2c91d72f7..fccb456c5 100644
--- a/Source/WebCore/Modules/indexeddb/IDBDatabase.cpp
+++ b/Source/WebCore/Modules/indexeddb/IDBDatabase.cpp
@@ -108,7 +108,7 @@ PassRefPtr<DOMStringList> IDBDatabase::objectStoreNames() const
 {
     RefPtr<DOMStringList> objectStoreNames = DOMStringList::create();
     for (IDBDatabaseMetadata::ObjectStoreMap::const_iterator it = m_metadata.objectStores.begin(); it != m_metadata.objectStores.end(); ++it)
-        objectStoreNames->append(it->key);
+        objectStoreNames->append(it->value.name);
     objectStoreNames->sort();
     return objectStoreNames.release();
 }
@@ -142,7 +142,7 @@ PassRefPtr<IDBObjectStore> IDBDatabase::createObjectStore(const String& name, co
             keyPath = IDBKeyPath(keyPathString);
     }
 
-    if (m_metadata.objectStores.contains(name)) {
+    if (m_metadata.containsObjectStore(name)) {
         ec = IDBDatabaseException::CONSTRAINT_ERR;
         return 0;
     }
@@ -170,7 +170,7 @@ PassRefPtr<IDBObjectStore> IDBDatabase::createObjectStore(const String& name, co
 
     IDBObjectStoreMetadata metadata(name, objectStoreId, keyPath, autoIncrement, IDBObjectStoreBackendInterface::MinimumIndexId);
     RefPtr<IDBObjectStore> objectStore = IDBObjectStore::create(metadata, objectStoreBackend.release(), m_versionChangeTransaction.get());
-    m_metadata.objectStores.set(name, metadata);
+    m_metadata.objectStores.set(metadata.id, metadata);
     ++m_metadata.maxObjectStoreId;
 
     m_versionChangeTransaction->objectStoreCreated(name, objectStore);
@@ -187,7 +187,9 @@ void IDBDatabase::deleteObjectStore(const String& name, ExceptionCode& ec)
         ec = IDBDatabaseException::TRANSACTION_INACTIVE_ERR;
         return;
     }
-    if (!m_metadata.objectStores.contains(name)) {
+
+    int64 objectStoreId = m_metadata.findObjectStore(name);
+    if (objectStoreId == IDBObjectStoreMetadata::InvalidId) {
         ec = IDBDatabaseException::IDB_NOT_FOUND_ERR;
         return;
     }
@@ -195,7 +197,7 @@ void IDBDatabase::deleteObjectStore(const String& name, ExceptionCode& ec)
     m_backend->deleteObjectStore(name, m_versionChangeTransaction->backend(), ec);
     if (!ec) {
         m_versionChangeTransaction->objectStoreDeleted(name);
-        m_metadata.objectStores.remove(name);
+        m_metadata.objectStores.remove(objectStoreId);
     }
 }
 
@@ -241,6 +243,13 @@ PassRefPtr<IDBTransaction> IDBDatabase::transaction(ScriptExecutionContext* cont
         return 0;
     }
 
+    for (size_t i = 0; i < storeNames->length(); ++i) {
+        if (!m_metadata.containsObjectStore(storeNames->item(i))) {
+            ec = IDBDatabaseException::IDB_NOT_FOUND_ERR;
+            return 0;
+        }
+    }
+
     // We need to create a new transaction synchronously. Locks are acquired asynchronously. Operations
     // can be queued against the transaction at any point. They will start executing as soon as the
     // appropriate locks have been acquired.
@@ -250,7 +259,7 @@ PassRefPtr<IDBTransaction> IDBDatabase::transaction(ScriptExecutionContext* cont
         ASSERT(ec);
         return 0;
     }
-    RefPtr<IDBTransaction> transaction = IDBTransaction::create(context, transactionBackend, mode, this);
+    RefPtr<IDBTransaction> transaction = IDBTransaction::create(context, transactionBackend, *storeNames, mode, this);
     transactionBackend->setCallbacks(transaction.get());
     return transaction.release();
 }
diff --git a/Source/WebCore/Modules/indexeddb/IDBDatabase.h b/Source/WebCore/Modules/indexeddb/IDBDatabase.h
index b8ba19450..58161673c 100644
--- a/Source/WebCore/Modules/indexeddb/IDBDatabase.h
+++ b/Source/WebCore/Modules/indexeddb/IDBDatabase.h
@@ -62,8 +62,6 @@ public:
     PassRefPtr<IDBAny> version() const;
     PassRefPtr<DOMStringList> objectStoreNames() const;
 
-    // FIXME: Try to modify the code generator so this is unneeded.
-    PassRefPtr<IDBObjectStore> createObjectStore(const String& name, ExceptionCode& ec) { return createObjectStore(name, Dictionary(), ec); }
     PassRefPtr<IDBObjectStore> createObjectStore(const String& name, const Dictionary&, ExceptionCode&);
     PassRefPtr<IDBTransaction> transaction(ScriptExecutionContext*, PassRefPtr<DOMStringList>, const String& mode, ExceptionCode&);
     PassRefPtr<IDBTransaction> transaction(ScriptExecutionContext*, const String&, const String& mode, ExceptionCode&);
diff --git a/Source/WebCore/Modules/indexeddb/IDBDatabaseBackendImpl.cpp b/Source/WebCore/Modules/indexeddb/IDBDatabaseBackendImpl.cpp
index d5fbd6dd4..7da5432d3 100644
--- a/Source/WebCore/Modules/indexeddb/IDBDatabaseBackendImpl.cpp
+++ b/Source/WebCore/Modules/indexeddb/IDBDatabaseBackendImpl.cpp
@@ -167,15 +167,15 @@ IDBDatabaseMetadata IDBDatabaseBackendImpl::metadata() const
     // FIXME: Figure out a way to keep m_metadata.objectStores.get(N).indexes up to date rather than regenerating this every time.
     IDBDatabaseMetadata metadata(m_metadata);
     for (ObjectStoreMap::const_iterator it = m_objectStores.begin(); it != m_objectStores.end(); ++it)
-        metadata.objectStores.set(it->key, it->value->metadata());
+        metadata.objectStores.set(it->value->id(), it->value->metadata());
     return metadata;
 }
 
 PassRefPtr<IDBObjectStoreBackendInterface> IDBDatabaseBackendImpl::createObjectStore(int64_t id, const String& name, const IDBKeyPath& keyPath, bool autoIncrement, IDBTransactionBackendInterface* transactionPtr, ExceptionCode& ec)
 {
-    ASSERT(!m_objectStores.contains(name));
+    ASSERT(!m_objectStores.contains(id));
 
-    RefPtr<IDBObjectStoreBackendImpl> objectStore = IDBObjectStoreBackendImpl::create(this, id, name, keyPath, autoIncrement, IDBObjectStoreBackendInterface::MinimumIndexId);
+    RefPtr<IDBObjectStoreBackendImpl> objectStore = IDBObjectStoreBackendImpl::create(this, IDBObjectStoreMetadata(name, id, keyPath, autoIncrement, IDBObjectStoreBackendInterface::MinimumIndexId));
     ASSERT(objectStore->name() == name);
 
     RefPtr<IDBTransactionBackendImpl> transaction = IDBTransactionBackendImpl::from(transactionPtr);
@@ -193,7 +193,7 @@ PassRefPtr<IDBObjectStoreBackendInterface> IDBDatabaseBackendImpl::createObjectS
         return 0;
     }
 
-    m_objectStores.set(name, objectStore);
+    m_objectStores.set(id, objectStore);
     return objectStore.release();
 }
 
@@ -207,17 +207,27 @@ void IDBDatabaseBackendImpl::createObjectStoreInternal(ScriptExecutionContext*,
     transaction->didCompleteTaskEvents();
 }
 
-PassRefPtr<IDBObjectStoreBackendImpl> IDBDatabaseBackendImpl::objectStore(const String& name)
+PassRefPtr<IDBObjectStoreBackendImpl> IDBDatabaseBackendImpl::objectStore(int64_t id)
 {
-    return m_objectStores.get(name);
+    return m_objectStores.get(id);
 }
 
-void IDBDatabaseBackendImpl::deleteObjectStore(const String& name, IDBTransactionBackendInterface* transactionPtr, ExceptionCode& ec)
+int64_t IDBDatabaseBackendImpl::getObjectStoreId(const String& name)
 {
-    ASSERT(m_objectStores.contains(name));
+    for (ObjectStoreMap::const_iterator it = m_objectStores.begin(); it != m_objectStores.end(); ++it) {
+        if (it->value->name() == name)
+            return it->key;
+    }
+    ASSERT_NOT_REACHED();
+    return 0;
+}
+
+void IDBDatabaseBackendImpl::deleteObjectStore(int64_t id, IDBTransactionBackendInterface* transactionPtr, ExceptionCode& ec)
+{
+    ASSERT(m_objectStores.contains(id));
 
     RefPtr<IDBDatabaseBackendImpl> database = this;
-    RefPtr<IDBObjectStoreBackendImpl> objectStore = m_objectStores.get(name);
+    RefPtr<IDBObjectStoreBackendImpl> objectStore = m_objectStores.get(id);
     RefPtr<IDBTransactionBackendImpl> transaction = IDBTransactionBackendImpl::from(transactionPtr);
     ASSERT(transaction->mode() == IDBTransaction::VERSION_CHANGE);
 
@@ -227,7 +237,7 @@ void IDBDatabaseBackendImpl::deleteObjectStore(const String& name, IDBTransactio
         ec = IDBDatabaseException::TRANSACTION_INACTIVE_ERR;
         return;
     }
-    m_objectStores.remove(name);
+    m_objectStores.remove(id);
 }
 
 void IDBDatabaseBackendImpl::deleteObjectStoreInternal(ScriptExecutionContext*, PassRefPtr<IDBDatabaseBackendImpl> database, PassRefPtr<IDBObjectStoreBackendImpl> objectStore, PassRefPtr<IDBTransactionBackendImpl> transaction)
@@ -421,20 +431,19 @@ void IDBDatabaseBackendImpl::processPendingCalls()
     ASSERT(m_pendingOpenCalls.isEmpty());
 }
 
-PassRefPtr<IDBTransactionBackendInterface> IDBDatabaseBackendImpl::transaction(DOMStringList* objectStoreNames, unsigned short mode, ExceptionCode& ec)
+PassRefPtr<IDBTransactionBackendInterface> IDBDatabaseBackendImpl::transaction(DOMStringList*, unsigned short mode, ExceptionCode&)
 {
-    for (size_t i = 0; i < objectStoreNames->length(); ++i) {
-        if (!m_objectStores.contains(objectStoreNames->item(i))) {
-            ec = IDBDatabaseException::IDB_NOT_FOUND_ERR;
-            return 0;
-        }
-    }
-
-    RefPtr<IDBTransactionBackendImpl> transaction = IDBTransactionBackendImpl::create(objectStoreNames, mode, this);
+    // FIXME: First parameter isn't used for anything yet anyway, and this method is going away.
+    RefPtr<IDBTransactionBackendImpl> transaction = IDBTransactionBackendImpl::create(Vector<int64_t>(), mode, this);
     m_transactions.add(transaction.get());
     return transaction.release();
 }
 
+PassRefPtr<IDBTransactionBackendInterface> IDBDatabaseBackendImpl::transaction(const Vector<int64_t>& objectStoreIds, unsigned short mode)
+{
+    return transaction(objectStoreIds, mode);
+}
+
 void IDBDatabaseBackendImpl::openConnection(PassRefPtr<IDBCallbacks> callbacks, PassRefPtr<IDBDatabaseCallbacks> databaseCallbacks)
 {
     ASSERT(m_backingStore.get());
@@ -608,29 +617,24 @@ void IDBDatabaseBackendImpl::loadObjectStores()
     Vector<IDBKeyPath> keyPaths;
     Vector<bool> autoIncrementFlags;
     Vector<int64_t> maxIndexIds;
-    m_backingStore->getObjectStores(m_metadata.id, ids, names, keyPaths, autoIncrementFlags, maxIndexIds);
-
-    ASSERT(names.size() == ids.size());
-    ASSERT(keyPaths.size() == ids.size());
-    ASSERT(autoIncrementFlags.size() == ids.size());
-    ASSERT(maxIndexIds.size() == ids.size());
+    Vector<IDBObjectStoreMetadata> objectStores = m_backingStore->getObjectStores(m_metadata.id);
 
-    for (size_t i = 0; i < ids.size(); i++)
-        m_objectStores.set(names[i], IDBObjectStoreBackendImpl::create(this, ids[i], names[i], keyPaths[i], autoIncrementFlags[i], maxIndexIds[i]));
+    for (size_t i = 0; i < objectStores.size(); i++)
+        m_objectStores.set(objectStores[i].id, IDBObjectStoreBackendImpl::create(this, objectStores[i]));
 }
 
 void IDBDatabaseBackendImpl::removeObjectStoreFromMap(ScriptExecutionContext*, PassRefPtr<IDBDatabaseBackendImpl> database, PassRefPtr<IDBObjectStoreBackendImpl> prpObjectStore)
 {
     RefPtr<IDBObjectStoreBackendImpl> objectStore = prpObjectStore;
-    ASSERT(database->m_objectStores.contains(objectStore->name()));
-    database->m_objectStores.remove(objectStore->name());
+    ASSERT(database->m_objectStores.contains(objectStore->id()));
+    database->m_objectStores.remove(objectStore->id());
 }
 
 void IDBDatabaseBackendImpl::addObjectStoreToMap(ScriptExecutionContext*, PassRefPtr<IDBDatabaseBackendImpl> database, PassRefPtr<IDBObjectStoreBackendImpl> objectStore)
 {
     RefPtr<IDBObjectStoreBackendImpl> objectStorePtr = objectStore;
-    ASSERT(!database->m_objectStores.contains(objectStorePtr->name()));
-    database->m_objectStores.set(objectStorePtr->name(), objectStorePtr);
+    ASSERT(!database->m_objectStores.contains(objectStorePtr->id()));
+    database->m_objectStores.set(objectStorePtr->id(), objectStorePtr);
 }
 
 void IDBDatabaseBackendImpl::resetVersion(ScriptExecutionContext*, PassRefPtr<IDBDatabaseBackendImpl> database, const String& previousVersion, int64_t previousIntVersion)
diff --git a/Source/WebCore/Modules/indexeddb/IDBDatabaseBackendImpl.h b/Source/WebCore/Modules/indexeddb/IDBDatabaseBackendImpl.h
index 11a69d0bf..f5ce81d6c 100644
--- a/Source/WebCore/Modules/indexeddb/IDBDatabaseBackendImpl.h
+++ b/Source/WebCore/Modules/indexeddb/IDBDatabaseBackendImpl.h
@@ -62,12 +62,15 @@ public:
     // IDBDatabaseBackendInterface
     virtual IDBDatabaseMetadata metadata() const;
     virtual PassRefPtr<IDBObjectStoreBackendInterface> createObjectStore(int64_t id, const String& name, const IDBKeyPath&, bool autoIncrement, IDBTransactionBackendInterface*, ExceptionCode&);
-    virtual void deleteObjectStore(const String& name, IDBTransactionBackendInterface*, ExceptionCode&);
+    virtual void deleteObjectStore(const String& name, IDBTransactionBackendInterface* transactionPtr, ExceptionCode& ec) { return deleteObjectStore(getObjectStoreId(name), transactionPtr, ec); }
+    virtual void deleteObjectStore(int64_t, IDBTransactionBackendInterface*, ExceptionCode&);
     virtual void setVersion(const String& version, PassRefPtr<IDBCallbacks>, PassRefPtr<IDBDatabaseCallbacks>, ExceptionCode&);
     virtual PassRefPtr<IDBTransactionBackendInterface> transaction(DOMStringList* objectStoreNames, unsigned short mode, ExceptionCode&);
+    virtual PassRefPtr<IDBTransactionBackendInterface> transaction(const Vector<int64_t>&, unsigned short);
     virtual void close(PassRefPtr<IDBDatabaseCallbacks>);
 
-    PassRefPtr<IDBObjectStoreBackendImpl> objectStore(const String& name);
+    PassRefPtr<IDBObjectStoreBackendImpl> objectStore(int64_t id);
+    int64_t getObjectStoreId(const String& name);
     IDBTransactionCoordinator* transactionCoordinator() const { return m_transactionCoordinator.get(); }
     void transactionStarted(PassRefPtr<IDBTransactionBackendImpl>);
     void transactionFinished(PassRefPtr<IDBTransactionBackendImpl>);
@@ -100,7 +103,7 @@ private:
     // This might not need to be a RefPtr since the factory's lifetime is that of the page group, but it's better to be conservitive than sorry.
     RefPtr<IDBFactoryBackendImpl> m_factory;
 
-    typedef HashMap<String, RefPtr<IDBObjectStoreBackendImpl> > ObjectStoreMap;
+    typedef HashMap<int64_t, RefPtr<IDBObjectStoreBackendImpl> > ObjectStoreMap;
     ObjectStoreMap m_objectStores;
 
     OwnPtr<IDBTransactionCoordinator> m_transactionCoordinator;
diff --git a/Source/WebCore/Modules/indexeddb/IDBDatabaseBackendInterface.h b/Source/WebCore/Modules/indexeddb/IDBDatabaseBackendInterface.h
index 4cd0845b4..0c53cd7cf 100644
--- a/Source/WebCore/Modules/indexeddb/IDBDatabaseBackendInterface.h
+++ b/Source/WebCore/Modules/indexeddb/IDBDatabaseBackendInterface.h
@@ -56,8 +56,10 @@ public:
 
     virtual PassRefPtr<IDBObjectStoreBackendInterface> createObjectStore(int64_t, const String& name, const IDBKeyPath&, bool autoIncrement, IDBTransactionBackendInterface*, ExceptionCode&) = 0;
     virtual void deleteObjectStore(const String& name, IDBTransactionBackendInterface*, ExceptionCode&) = 0;
+    virtual void deleteObjectStore(int64_t, IDBTransactionBackendInterface*, ExceptionCode&) = 0;
     virtual void setVersion(const String& version, PassRefPtr<IDBCallbacks>, PassRefPtr<IDBDatabaseCallbacks>, ExceptionCode&) = 0;
     virtual PassRefPtr<IDBTransactionBackendInterface> transaction(DOMStringList* storeNames, unsigned short mode, ExceptionCode&) = 0;
+    virtual PassRefPtr<IDBTransactionBackendInterface> transaction(const Vector<int64_t>& objectStoreIds, unsigned short mode) = 0;
     virtual void close(PassRefPtr<IDBDatabaseCallbacks>) = 0;
 };
 
diff --git a/Source/WebCore/Modules/indexeddb/IDBFactory.cpp b/Source/WebCore/Modules/indexeddb/IDBFactory.cpp
index 8535757f2..e78913ba0 100644
--- a/Source/WebCore/Modules/indexeddb/IDBFactory.cpp
+++ b/Source/WebCore/Modules/indexeddb/IDBFactory.cpp
@@ -31,7 +31,6 @@
 
 #if ENABLE(INDEXED_DATABASE)
 
-#include "DOMStringList.h"
 #include "Document.h"
 #include "ExceptionCode.h"
 #include "Frame.h"
diff --git a/Source/WebCore/Modules/indexeddb/IDBFactory.h b/Source/WebCore/Modules/indexeddb/IDBFactory.h
index 421915792..d0e74d574 100644
--- a/Source/WebCore/Modules/indexeddb/IDBFactory.h
+++ b/Source/WebCore/Modules/indexeddb/IDBFactory.h
@@ -28,7 +28,6 @@
 #ifndef IDBFactory_h
 #define IDBFactory_h
 
-#include "DOMStringList.h"
 #include "IDBFactoryBackendInterface.h"
 #include "IDBOpenDBRequest.h"
 #include <wtf/PassRefPtr.h>
diff --git a/Source/WebCore/Modules/indexeddb/IDBFactoryBackendImpl.cpp b/Source/WebCore/Modules/indexeddb/IDBFactoryBackendImpl.cpp
index f5e5e2726..55c8dab4a 100644
--- a/Source/WebCore/Modules/indexeddb/IDBFactoryBackendImpl.cpp
+++ b/Source/WebCore/Modules/indexeddb/IDBFactoryBackendImpl.cpp
@@ -90,8 +90,7 @@ void IDBFactoryBackendImpl::getDatabaseNames(PassRefPtr<IDBCallbacks> callbacks,
 
     RefPtr<DOMStringList> databaseNames = DOMStringList::create();
 
-    Vector<String> foundNames;
-    backingStore->getDatabaseNames(foundNames);
+    Vector<String> foundNames = backingStore->getDatabaseNames();
     for (Vector<String>::const_iterator it = foundNames.begin(); it != foundNames.end(); ++it)
         databaseNames->append(*it);
 
diff --git a/Source/WebCore/Modules/indexeddb/IDBIndex.h b/Source/WebCore/Modules/indexeddb/IDBIndex.h
index e10c36d22..3e04ee1d4 100644
--- a/Source/WebCore/Modules/indexeddb/IDBIndex.h
+++ b/Source/WebCore/Modules/indexeddb/IDBIndex.h
@@ -57,6 +57,7 @@ public:
     const IDBKeyPath keyPath() const { return m_metadata.keyPath; }
     bool unique() const { return m_metadata.unique; }
     bool multiEntry() const { return m_metadata.multiEntry; }
+    int64_t id() const { return m_metadata.id; }
 
     // FIXME: Try to modify the code generator so this is unneeded.
     PassRefPtr<IDBRequest> openCursor(ScriptExecutionContext* context, ExceptionCode& ec) { return openCursor(context, static_cast<IDBKeyRange*>(0), ec); }
@@ -68,7 +69,7 @@ public:
     PassRefPtr<IDBRequest> count(ScriptExecutionContext*, PassRefPtr<IDBKeyRange>, ExceptionCode&);
     PassRefPtr<IDBRequest> count(ScriptExecutionContext*, PassRefPtr<IDBKey>, ExceptionCode&);
 
-    PassRefPtr<IDBRequest> openKeyCursor(ScriptExecutionContext* context, ExceptionCode& ec) { return openKeyCursor(context, static_cast<IDBKeyRange*>(0), ec); } 
+    PassRefPtr<IDBRequest> openKeyCursor(ScriptExecutionContext* context, ExceptionCode& ec) { return openKeyCursor(context, static_cast<IDBKeyRange*>(0), ec); }
     PassRefPtr<IDBRequest> openKeyCursor(ScriptExecutionContext* context, PassRefPtr<IDBKeyRange> keyRange, ExceptionCode& ec) { return openKeyCursor(context, keyRange, IDBCursor::directionNext(), ec); }
     PassRefPtr<IDBRequest> openKeyCursor(ScriptExecutionContext* context, PassRefPtr<IDBKey> key, ExceptionCode& ec) { return openKeyCursor(context, key, IDBCursor::directionNext(), ec); }
     PassRefPtr<IDBRequest> openKeyCursor(ScriptExecutionContext*, PassRefPtr<IDBKeyRange>, const String& direction, ExceptionCode&);
diff --git a/Source/WebCore/Modules/indexeddb/IDBIndexBackendImpl.cpp b/Source/WebCore/Modules/indexeddb/IDBIndexBackendImpl.cpp
index 7b2a475e5..402b759dc 100644
--- a/Source/WebCore/Modules/indexeddb/IDBIndexBackendImpl.cpp
+++ b/Source/WebCore/Modules/indexeddb/IDBIndexBackendImpl.cpp
@@ -43,14 +43,10 @@
 
 namespace WebCore {
 
-IDBIndexBackendImpl::IDBIndexBackendImpl(const IDBDatabaseBackendImpl* database, IDBObjectStoreBackendImpl* objectStoreBackend, int64_t id, const String& name, const IDBKeyPath& keyPath, bool unique, bool multiEntry)
+IDBIndexBackendImpl::IDBIndexBackendImpl(const IDBDatabaseBackendImpl* database, IDBObjectStoreBackendImpl* objectStoreBackend, const IDBIndexMetadata& metadata)
     : m_database(database)
     , m_objectStoreBackend(objectStoreBackend)
-    , m_id(id)
-    , m_name(name)
-    , m_keyPath(keyPath)
-    , m_unique(unique)
-    , m_multiEntry(multiEntry)
+    , m_metadata(metadata)
 {
 }
 
@@ -60,7 +56,7 @@ IDBIndexBackendImpl::~IDBIndexBackendImpl()
 
 IDBIndexMetadata IDBIndexBackendImpl::metadata() const
 {
-    return IDBIndexMetadata(m_name, m_id, m_keyPath, m_unique, m_multiEntry);
+    return m_metadata;
 }
 
 void IDBIndexBackendImpl::openCursorInternal(ScriptExecutionContext*, PassRefPtr<IDBIndexBackendImpl> index, PassRefPtr<IDBKeyRange> range, unsigned short untypedDirection, IDBCursorBackendInterface::CursorType cursorType, PassRefPtr<IDBCallbacks> callbacks, PassRefPtr<IDBTransactionBackendImpl> transaction)
diff --git a/Source/WebCore/Modules/indexeddb/IDBIndexBackendImpl.h b/Source/WebCore/Modules/indexeddb/IDBIndexBackendImpl.h
index 9fbec1697..9e8843012 100644
--- a/Source/WebCore/Modules/indexeddb/IDBIndexBackendImpl.h
+++ b/Source/WebCore/Modules/indexeddb/IDBIndexBackendImpl.h
@@ -43,19 +43,17 @@ class ScriptExecutionContext;
 
 class IDBIndexBackendImpl : public IDBIndexBackendInterface {
 public:
-    static PassRefPtr<IDBIndexBackendImpl> create(const IDBDatabaseBackendImpl* database, IDBObjectStoreBackendImpl* objectStoreBackend, int64_t id, const String& name, const IDBKeyPath& keyPath, bool unique, bool multiEntry)
+    static PassRefPtr<IDBIndexBackendImpl> create(const IDBDatabaseBackendImpl* database, IDBObjectStoreBackendImpl* objectStoreBackend, const IDBIndexMetadata& metadata)
     {
-        return adoptRef(new IDBIndexBackendImpl(database, objectStoreBackend, id, name, keyPath, unique, multiEntry));
+        return adoptRef(new IDBIndexBackendImpl(database, objectStoreBackend, metadata));
     }
     virtual ~IDBIndexBackendImpl();
 
     int64_t id() const
     {
-        ASSERT(m_id != InvalidId);
-        return m_id;
+        ASSERT(m_metadata.id != InvalidId);
+        return m_metadata.id;
     }
-    void setId(int64_t id) { m_id = id; }
-    bool hasValidId() const { return m_id != InvalidId; };
 
     // IDBIndexBackendInterface
     virtual void openCursor(PassRefPtr<IDBKeyRange>, unsigned short direction, PassRefPtr<IDBCallbacks>, IDBTransactionBackendInterface*, ExceptionCode&);
@@ -65,13 +63,13 @@ public:
     virtual void getKey(PassRefPtr<IDBKeyRange>, PassRefPtr<IDBCallbacks>, IDBTransactionBackendInterface*, ExceptionCode&);
 
     IDBIndexMetadata metadata() const;
-    const String& name() { return m_name; }
-    const IDBKeyPath& keyPath() { return m_keyPath; }
-    const bool& unique() { return m_unique; }
-    const bool& multiEntry() { return m_multiEntry; }
+    const String& name() { return m_metadata.name; }
+    const IDBKeyPath& keyPath() { return m_metadata.keyPath; }
+    const bool& unique() { return m_metadata.unique; }
+    const bool& multiEntry() { return m_metadata.multiEntry; }
 
 private:
-    IDBIndexBackendImpl(const IDBDatabaseBackendImpl*, IDBObjectStoreBackendImpl*, int64_t id, const String& name, const IDBKeyPath&, bool unique, bool multiEntry);
+    IDBIndexBackendImpl(const IDBDatabaseBackendImpl*, IDBObjectStoreBackendImpl*, const IDBIndexMetadata&);
 
     static void openCursorInternal(ScriptExecutionContext*, PassRefPtr<IDBIndexBackendImpl>, PassRefPtr<IDBKeyRange>, unsigned short direction, IDBCursorBackendInterface::CursorType, PassRefPtr<IDBCallbacks>, PassRefPtr<IDBTransactionBackendImpl>);
     static void countInternal(ScriptExecutionContext*, PassRefPtr<IDBIndexBackendImpl>, PassRefPtr<IDBKeyRange>, PassRefPtr<IDBCallbacks>, PassRefPtr<IDBTransactionBackendImpl>);
@@ -86,11 +84,8 @@ private:
     const IDBDatabaseBackendImpl* m_database;
 
     IDBObjectStoreBackendImpl* m_objectStoreBackend;
-    int64_t m_id;
-    String m_name;
-    IDBKeyPath m_keyPath;
-    bool m_unique;
-    bool m_multiEntry;
+
+    IDBIndexMetadata m_metadata;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/Modules/indexeddb/IDBIndexBackendInterface.h b/Source/WebCore/Modules/indexeddb/IDBIndexBackendInterface.h
index 0761f0681..c92fc8d49 100644
--- a/Source/WebCore/Modules/indexeddb/IDBIndexBackendInterface.h
+++ b/Source/WebCore/Modules/indexeddb/IDBIndexBackendInterface.h
@@ -28,7 +28,6 @@
 
 #include <wtf/Forward.h>
 #include <wtf/ThreadSafeRefCounted.h>
-#include <wtf/text/WTFString.h>
 
 #if ENABLE(INDEXED_DATABASE)
 
diff --git a/Source/WebCore/Modules/indexeddb/IDBKeyPath.cpp b/Source/WebCore/Modules/indexeddb/IDBKeyPath.cpp
index 6351e6fb8..bac8cea06 100644
--- a/Source/WebCore/Modules/indexeddb/IDBKeyPath.cpp
+++ b/Source/WebCore/Modules/indexeddb/IDBKeyPath.cpp
@@ -28,7 +28,6 @@
 
 #if ENABLE(INDEXED_DATABASE)
 
-#include "DOMStringList.h"
 #include <wtf/ASCIICType.h>
 #include <wtf/dtoa.h>
 #include <wtf/unicode/Unicode.h>
diff --git a/Source/WebCore/Modules/indexeddb/IDBLevelDBBackingStore.cpp b/Source/WebCore/Modules/indexeddb/IDBLevelDBBackingStore.cpp
index e51350d1c..ea5d59fe3 100644
--- a/Source/WebCore/Modules/indexeddb/IDBLevelDBBackingStore.cpp
+++ b/Source/WebCore/Modules/indexeddb/IDBLevelDBBackingStore.cpp
@@ -32,6 +32,7 @@
 
 #include <wtf/Assertions.h>
 #include "FileSystem.h"
+#include "HistogramSupport.h"
 #include "IDBFactoryBackendImpl.h"
 #include "IDBKey.h"
 #include "IDBKeyPath.h"
@@ -51,6 +52,26 @@ using namespace IDBLevelDBCoding;
 
 const int64_t KeyGeneratorInitialNumber = 1; // From the IndexedDB specification.
 
+enum IDBLevelDBBackingStoreInternalErrorType {
+    IDBLevelDBBackingStoreReadError,
+    IDBLevelDBBackingStoreWriteError,
+    IDBLevelDBBackingStoreConsistencyError,
+    IDBLevelDBBackingStoreInternalErrorMax,
+};
+static inline void recordInternalError(IDBLevelDBBackingStoreInternalErrorType type)
+{
+    HistogramSupport::histogramEnumeration("WebCore.IndexedDB.BackingStore.InternalError", type, IDBLevelDBBackingStoreInternalErrorMax);
+}
+
+// Use to signal conditions that usually indicate developer error, but could be caused by data corruption.
+// A macro is used instead of an inline function so that the assert and log report the line number.
+#define InternalError(type) \
+    do { \
+        ASSERT_NOT_REACHED(); \
+        LOG_ERROR("Internal IndexedDB Error: %s", #type); \
+        recordInternalError(type); \
+    } while (0)
+
 template <typename DBOrTransaction>
 static bool getBool(DBOrTransaction* db, const Vector<char>& key, bool& foundBool)
 {
@@ -164,8 +185,10 @@ static bool setUpMetadata(LevelDBDatabase* db, const String& origin)
     int64_t schemaVersion = 0;
     if (!getInt(db, metaDataKey, schemaVersion)) {
         schemaVersion = latestSchemaVersion;
-        if (!putInt(db, metaDataKey, latestSchemaVersion))
+        if (!putInt(db, metaDataKey, latestSchemaVersion)) {
+            InternalError(IDBLevelDBBackingStoreWriteError);
             return false;
+        }
     } else {
         ASSERT(schemaVersion <= latestSchemaVersion);
         if (!schemaVersion) {
@@ -180,7 +203,7 @@ static bool setUpMetadata(LevelDBDatabase* db, const String& origin)
                 Vector<char> value;
                 bool ok = transaction->get(it->key(), value);
                 if (!ok) {
-                    ASSERT_NOT_REACHED();
+                    InternalError(IDBLevelDBBackingStoreReadError);
                     return false;
                 }
                 int databaseId = decodeInt(value.begin(), value.end());
@@ -188,13 +211,13 @@ static bool setUpMetadata(LevelDBDatabase* db, const String& origin)
                 transaction->put(intVersionKey, encodeVarInt(IDBDatabaseMetadata::DefaultIntVersion));
                 ok = transaction->get(it->key(), value);
                 if (!ok) {
-                    ASSERT_NOT_REACHED();
+                    InternalError(IDBLevelDBBackingStoreReadError);
                     return false;
                 }
             }
             bool ok = transaction->commit();
             if (!ok) {
-                ASSERT_NOT_REACHED();
+                InternalError(IDBLevelDBBackingStoreWriteError);
                 return false;
             }
         }
@@ -240,6 +263,17 @@ IDBLevelDBBackingStore::~IDBLevelDBBackingStore()
     m_comparator.clear();
 }
 
+enum IDBLevelDBBackingStoreOpenResult {
+    IDBLevelDBBackingStoreOpenMemory,
+    IDBLevelDBBackingStoreOpenSuccess,
+    IDBLevelDBBackingStoreOpenFailedDirectory,
+    IDBLevelDBBackingStoreOpenFailedUnknownSchema,
+    IDBLevelDBBackingStoreOpenCleanupDestroyFailed,
+    IDBLevelDBBackingStoreOpenCleanupReopenFailed,
+    IDBLevelDBBackingStoreOpenCleanupReopenSuccess,
+    IDBLevelDBBackingStoreOpenMax,
+};
+
 PassRefPtr<IDBBackingStore> IDBLevelDBBackingStore::open(SecurityOrigin* securityOrigin, const String& pathBaseArg, const String& fileIdentifier, IDBFactoryBackendImpl* factory)
 {
     IDB_TRACE("IDBLevelDBBackingStore::open");
@@ -248,26 +282,33 @@ PassRefPtr<IDBBackingStore> IDBLevelDBBackingStore::open(SecurityOrigin* securit
     OwnPtr<LevelDBComparator> comparator = adoptPtr(new Comparator());
     OwnPtr<LevelDBDatabase> db;
 
-    if (pathBase.isEmpty())
+    if (pathBase.isEmpty()) {
+        HistogramSupport::histogramEnumeration("WebCore.IndexedDB.BackingStore.OpenStatus", IDBLevelDBBackingStoreOpenMemory, IDBLevelDBBackingStoreOpenMax);
         db = LevelDBDatabase::openInMemory(comparator.get());
-    else {
+    } else {
         if (!makeAllDirectories(pathBase)) {
             LOG_ERROR("Unable to create IndexedDB database path %s", pathBase.utf8().data());
+            HistogramSupport::histogramEnumeration("WebCore.IndexedDB.BackingStore.OpenStatus", IDBLevelDBBackingStoreOpenFailedDirectory, IDBLevelDBBackingStoreOpenMax);
             return PassRefPtr<IDBBackingStore>();
         }
-        // FIXME: We should eventually use the same LevelDB database for all origins.
+
         String path = pathByAppendingComponent(pathBase, securityOrigin->databaseIdentifier() + ".indexeddb.leveldb");
 
         db = LevelDBDatabase::open(path, comparator.get());
-        bool knownSchema = isSchemaKnown(db.get());
-        if (!knownSchema)
+        if (db && !isSchemaKnown(db.get())) {
             LOG_ERROR("IndexedDB backing store had unknown schema, treating it as failure to open");
+            HistogramSupport::histogramEnumeration("WebCore.IndexedDB.BackingStore.OpenStatus", IDBLevelDBBackingStoreOpenFailedUnknownSchema, IDBLevelDBBackingStoreOpenMax);
+            db.release();
+        }
 
-        if (!db || !knownSchema) {
+        if (db)
+            HistogramSupport::histogramEnumeration("WebCore.IndexedDB.BackingStore.OpenStatus", IDBLevelDBBackingStoreOpenSuccess, IDBLevelDBBackingStoreOpenMax);
+        else {
             LOG_ERROR("IndexedDB backing store open failed, attempting cleanup");
             bool success = LevelDBDatabase::destroy(path);
             if (!success) {
                 LOG_ERROR("IndexedDB backing store cleanup failed");
+                HistogramSupport::histogramEnumeration("WebCore.IndexedDB.BackingStore.OpenStatus", IDBLevelDBBackingStoreOpenCleanupDestroyFailed, IDBLevelDBBackingStoreOpenMax);
                 return PassRefPtr<IDBBackingStore>();
             }
 
@@ -275,8 +316,10 @@ PassRefPtr<IDBBackingStore> IDBLevelDBBackingStore::open(SecurityOrigin* securit
             db = LevelDBDatabase::open(path, comparator.get());
             if (!db) {
                 LOG_ERROR("IndexedDB backing store reopen after recovery failed");
+                HistogramSupport::histogramEnumeration("WebCore.IndexedDB.BackingStore.OpenStatus", IDBLevelDBBackingStoreOpenCleanupReopenFailed, IDBLevelDBBackingStoreOpenMax);
                 return PassRefPtr<IDBBackingStore>();
             }
+            HistogramSupport::histogramEnumeration("WebCore.IndexedDB.BackingStore.OpenStatus", IDBLevelDBBackingStoreOpenCleanupReopenSuccess, IDBLevelDBBackingStoreOpenMax);
         }
     }
 
@@ -294,8 +337,9 @@ PassRefPtr<IDBBackingStore> IDBLevelDBBackingStore::open(SecurityOrigin* securit
     return backingStore.release();
 }
 
-void IDBLevelDBBackingStore::getDatabaseNames(Vector<String>& foundNames)
+Vector<String> IDBLevelDBBackingStore::getDatabaseNames()
 {
+    Vector<String> foundNames;
     const Vector<char> startKey = DatabaseNameKey::encodeMinKeyForOrigin(m_identifier);
     const Vector<char> stopKey = DatabaseNameKey::encodeStopKeyForOrigin(m_identifier);
 
@@ -312,6 +356,7 @@ void IDBLevelDBBackingStore::getDatabaseNames(Vector<String>& foundNames)
 
         foundNames.append(databaseNameKey.databaseName());
     }
+    return foundNames;
 }
 
 bool IDBLevelDBBackingStore::getIDBDatabaseMetaData(const String& name, IDBDatabaseMetadata* metadata)
@@ -323,12 +368,16 @@ bool IDBLevelDBBackingStore::getIDBDatabaseMetaData(const String& name, IDBDatab
         return false;
 
     ok = getString(m_db.get(), DatabaseMetaDataKey::encode(metadata->id, DatabaseMetaDataKey::UserVersion), metadata->version);
-    if (!ok)
+    if (!ok) {
+        InternalError(IDBLevelDBBackingStoreReadError);
         return false;
+    }
 
     ok = getVarInt(m_db.get(), DatabaseMetaDataKey::encode(metadata->id, DatabaseMetaDataKey::UserIntVersion), metadata->intVersion);
-    if (!ok)
+    if (!ok) {
+        InternalError(IDBLevelDBBackingStoreReadError);
         return false;
+    }
     if (metadata->intVersion == IDBDatabaseMetadata::DefaultIntVersion)
         metadata->intVersion = IDBDatabaseMetadata::NoIntVersion;
 
@@ -359,14 +408,20 @@ bool IDBLevelDBBackingStore::createIDBDatabaseMetaData(const String& name, const
         return false;
 
     const Vector<char> key = DatabaseNameKey::encode(m_identifier, name);
-    if (!putInt(m_db.get(), key, rowId))
+    if (!putInt(m_db.get(), key, rowId)) {
+        InternalError(IDBLevelDBBackingStoreWriteError);
         return false;
-    if (!putString(m_db.get(), DatabaseMetaDataKey::encode(rowId, DatabaseMetaDataKey::UserVersion), version))
+    }
+    if (!putString(m_db.get(), DatabaseMetaDataKey::encode(rowId, DatabaseMetaDataKey::UserVersion), version)) {
+        InternalError(IDBLevelDBBackingStoreWriteError);
         return false;
+    }
     if (intVersion == IDBDatabaseMetadata::NoIntVersion)
         intVersion = IDBDatabaseMetadata::DefaultIntVersion;
-    if (!putVarInt(m_db.get(), DatabaseMetaDataKey::encode(rowId, DatabaseMetaDataKey::UserIntVersion), intVersion))
+    if (!putVarInt(m_db.get(), DatabaseMetaDataKey::encode(rowId, DatabaseMetaDataKey::UserIntVersion), intVersion)) {
+        InternalError(IDBLevelDBBackingStoreWriteError);
         return false;
+    }
     return true;
 }
 
@@ -375,16 +430,19 @@ bool IDBLevelDBBackingStore::updateIDBDatabaseIntVersion(IDBBackingStore::Transa
     if (intVersion == IDBDatabaseMetadata::NoIntVersion)
         intVersion = IDBDatabaseMetadata::DefaultIntVersion;
     ASSERT_WITH_MESSAGE(intVersion >= 0, "intVersion was %lld", static_cast<long long>(intVersion));
-    if (!putVarInt(Transaction::levelDBTransactionFrom(transaction), DatabaseMetaDataKey::encode(rowId, DatabaseMetaDataKey::UserIntVersion), intVersion))
+    if (!putVarInt(Transaction::levelDBTransactionFrom(transaction), DatabaseMetaDataKey::encode(rowId, DatabaseMetaDataKey::UserIntVersion), intVersion)) {
+        InternalError(IDBLevelDBBackingStoreWriteError);
         return false;
-
+    }
     return true;
 }
 
 bool IDBLevelDBBackingStore::updateIDBDatabaseMetaData(IDBBackingStore::Transaction* transaction, int64_t rowId, const String& version)
 {
-    if (!putString(Transaction::levelDBTransactionFrom(transaction), DatabaseMetaDataKey::encode(rowId, DatabaseMetaDataKey::UserVersion), version))
+    if (!putString(Transaction::levelDBTransactionFrom(transaction), DatabaseMetaDataKey::encode(rowId, DatabaseMetaDataKey::UserVersion), version)) {
+        InternalError(IDBLevelDBBackingStoreWriteError);
         return false;
+    }
 
     return true;
 }
@@ -393,8 +451,10 @@ static bool deleteRange(LevelDBTransaction* transaction, const Vector<char>& beg
 {
     OwnPtr<LevelDBIterator> it = transaction->createIterator();
     for (it->seek(begin); it->isValid() && compareKeys(it->key(), end) < 0; it->next()) {
-        if (!transaction->remove(it->key()))
+        if (!transaction->remove(it->key())) {
+            InternalError(IDBLevelDBBackingStoreWriteError);
             return false;
+        }
     }
 
     return true;
@@ -437,18 +497,13 @@ static bool checkObjectStoreAndMetaDataType(const LevelDBIterator* it, const Vec
     return true;
 }
 
-void IDBLevelDBBackingStore::getObjectStores(int64_t databaseId, Vector<int64_t>& foundIds, Vector<String>& foundNames, Vector<IDBKeyPath>& foundKeyPaths, Vector<bool>& foundAutoIncrementFlags, Vector<int64_t>& foundMaxIndexIds)
+Vector<IDBObjectStoreMetadata> IDBLevelDBBackingStore::getObjectStores(int64_t databaseId)
 {
     IDB_TRACE("IDBLevelDBBackingStore::getObjectStores");
+    Vector<IDBObjectStoreMetadata> objectStores;
     const Vector<char> startKey = ObjectStoreMetaDataKey::encode(databaseId, 1, 0);
     const Vector<char> stopKey = ObjectStoreMetaDataKey::encodeMaxKey(databaseId);
 
-    ASSERT(foundIds.isEmpty());
-    ASSERT(foundNames.isEmpty());
-    ASSERT(foundKeyPaths.isEmpty());
-    ASSERT(foundAutoIncrementFlags.isEmpty());
-    ASSERT(foundMaxIndexIds.isEmpty());
-
     OwnPtr<LevelDBIterator> it = m_db->createIterator();
     it->seek(startKey);
     while (it->isValid() && compareKeys(it->key(), stopKey) < 0) {
@@ -459,7 +514,7 @@ void IDBLevelDBBackingStore::getObjectStores(int64_t databaseId, Vector<int64_t>
         p = ObjectStoreMetaDataKey::decode(p, limit, &metaDataKey);
         ASSERT(p);
         if (metaDataKey.metaDataType() != ObjectStoreMetaDataKey::Name) {
-            LOG_ERROR("Internal Indexed DB error.");
+            InternalError(IDBLevelDBBackingStoreReadError);
             // Possible stale metadata, but don't fail the load.
             it->next();
             continue;
@@ -472,34 +527,34 @@ void IDBLevelDBBackingStore::getObjectStores(int64_t databaseId, Vector<int64_t>
 
         it->next();
         if (!checkObjectStoreAndMetaDataType(it.get(), stopKey, objectStoreId, ObjectStoreMetaDataKey::KeyPath)) {
-            LOG_ERROR("Internal Indexed DB error.");
-            return;
+            InternalError(IDBLevelDBBackingStoreReadError);
+            break;
         }
         IDBKeyPath keyPath = decodeIDBKeyPath(it->value().begin(), it->value().end());
 
         it->next();
         if (!checkObjectStoreAndMetaDataType(it.get(), stopKey, objectStoreId, ObjectStoreMetaDataKey::AutoIncrement)) {
-            LOG_ERROR("Internal Indexed DB error.");
-            return;
+            InternalError(IDBLevelDBBackingStoreReadError);
+            break;
         }
         bool autoIncrement = decodeBool(it->value().begin(), it->value().end());
 
         it->next(); // Is evicatble.
         if (!checkObjectStoreAndMetaDataType(it.get(), stopKey, objectStoreId, ObjectStoreMetaDataKey::Evictable)) {
-            LOG_ERROR("Internal Indexed DB error.");
-            return;
+            InternalError(IDBLevelDBBackingStoreReadError);
+            break;
         }
 
         it->next(); // Last version.
         if (!checkObjectStoreAndMetaDataType(it.get(), stopKey, objectStoreId, ObjectStoreMetaDataKey::LastVersion)) {
-            LOG_ERROR("Internal Indexed DB error.");
-            return;
+            InternalError(IDBLevelDBBackingStoreReadError);
+            break;
         }
 
         it->next(); // Maximum index id allocated.
         if (!checkObjectStoreAndMetaDataType(it.get(), stopKey, objectStoreId, ObjectStoreMetaDataKey::MaxIndexId)) {
-            LOG_ERROR("Internal Indexed DB error.");
-            return;
+            InternalError(IDBLevelDBBackingStoreReadError);
+            break;
         }
         int64_t maxIndexId = decodeInt(it->value().begin(), it->value().end());
 
@@ -511,8 +566,8 @@ void IDBLevelDBBackingStore::getObjectStores(int64_t databaseId, Vector<int64_t>
             // (2) Later, null vs. string vs. array was stored in the keyPath itself.
             // So this check is only relevant for string-type keyPaths.
             if (!hasKeyPath && (keyPath.type() == IDBKeyPath::StringType && !keyPath.string().isEmpty())) {
-                LOG_ERROR("Internal Indexed DB error.");
-                return;
+                InternalError(IDBLevelDBBackingStoreReadError);
+                break;
             }
             if (!hasKeyPath)
                 keyPath = IDBKeyPath();
@@ -528,12 +583,9 @@ void IDBLevelDBBackingStore::getObjectStores(int64_t databaseId, Vector<int64_t>
             it->next();
         }
 
-        foundIds.append(objectStoreId);
-        foundNames.append(objectStoreName);
-        foundKeyPaths.append(keyPath);
-        foundAutoIncrementFlags.append(autoIncrement);
-        foundMaxIndexIds.append(maxIndexId);
+        objectStores.append(IDBObjectStoreMetadata(objectStoreName, objectStoreId, keyPath, autoIncrement, maxIndexId));
     }
+    return objectStores;
 }
 
 static bool setMaxObjectStoreId(LevelDBTransaction* transaction, int64_t databaseId, int64_t objectStoreId)
@@ -542,10 +594,14 @@ static bool setMaxObjectStoreId(LevelDBTransaction* transaction, int64_t databas
     int64_t maxObjectStoreId = getMaxObjectStoreId(transaction, maxObjectStoreIdKey);
 
     if (objectStoreId <= maxObjectStoreId) {
-        LOG_ERROR("Possible corruption: new object store id is too small.");
+        InternalError(IDBLevelDBBackingStoreConsistencyError);
+        return false;
+    }
+    if (!putInt(transaction, maxObjectStoreIdKey, objectStoreId)) {
+        InternalError(IDBLevelDBBackingStoreWriteError);
         return false;
     }
-    return putInt(transaction, maxObjectStoreIdKey, objectStoreId);
+    return true;
 }
 
 bool IDBLevelDBBackingStore::createObjectStore(IDBBackingStore::Transaction* transaction, int64_t databaseId, int64_t objectStoreId, const String& name, const IDBKeyPath& keyPath, bool autoIncrement)
@@ -567,55 +623,55 @@ bool IDBLevelDBBackingStore::createObjectStore(IDBBackingStore::Transaction* tra
 
     bool ok = putString(levelDBTransaction, nameKey, name);
     if (!ok) {
-        LOG_ERROR("Internal Indexed DB error.");
+        InternalError(IDBLevelDBBackingStoreWriteError);
         return false;
     }
 
     ok = putIDBKeyPath(levelDBTransaction, keyPathKey, keyPath);
     if (!ok) {
-        LOG_ERROR("Internal Indexed DB error.");
+        InternalError(IDBLevelDBBackingStoreWriteError);
         return false;
     }
 
     ok = putInt(levelDBTransaction, autoIncrementKey, autoIncrement);
     if (!ok) {
-        LOG_ERROR("Internal Indexed DB error.");
+        InternalError(IDBLevelDBBackingStoreWriteError);
         return false;
     }
 
     ok = putInt(levelDBTransaction, evictableKey, false);
     if (!ok) {
-        LOG_ERROR("Internal Indexed DB error.");
+        InternalError(IDBLevelDBBackingStoreWriteError);
         return false;
     }
 
     ok = putInt(levelDBTransaction, lastVersionKey, 1);
     if (!ok) {
-        LOG_ERROR("Internal Indexed DB error.");
+        InternalError(IDBLevelDBBackingStoreWriteError);
         return false;
     }
 
     ok = putInt(levelDBTransaction, maxIndexIdKey, MinimumIndexId);
     if (!ok) {
-        LOG_ERROR("Internal Indexed DB error.");
+        InternalError(IDBLevelDBBackingStoreWriteError);
         return false;
     }
 
     ok = putBool(levelDBTransaction, hasKeyPathKey, !keyPath.isNull());
     if (!ok) {
-        LOG_ERROR("Internal Indexed DB error.");
+        InternalError(IDBLevelDBBackingStoreWriteError);
         return false;
     }
 
     ok = putInt(levelDBTransaction, keyGeneratorCurrentNumberKey, KeyGeneratorInitialNumber);
     if (!ok) {
-        LOG_ERROR("Internal Indexed DB error.");
+        InternalError(IDBLevelDBBackingStoreWriteError);
         return false;
     }
 
     ok = putInt(levelDBTransaction, namesKey, objectStoreId);
     if (!ok) {
-        LOG_ERROR("Internal Indexed DB error.");
+        InternalError(IDBLevelDBBackingStoreWriteError);
         return false;
     }
 
@@ -630,15 +686,21 @@ void IDBLevelDBBackingStore::deleteObjectStore(IDBBackingStore::Transaction* tra
     String objectStoreName;
     getString(levelDBTransaction, ObjectStoreMetaDataKey::encode(databaseId, objectStoreId, ObjectStoreMetaDataKey::Name), objectStoreName);
 
-    if (!deleteRange(levelDBTransaction, ObjectStoreMetaDataKey::encode(databaseId, objectStoreId, 0), ObjectStoreMetaDataKey::encodeMaxKey(databaseId, objectStoreId)))
+    if (!deleteRange(levelDBTransaction, ObjectStoreMetaDataKey::encode(databaseId, objectStoreId, 0), ObjectStoreMetaDataKey::encodeMaxKey(databaseId, objectStoreId))) {
+        InternalError(IDBLevelDBBackingStoreWriteError);
         return; // FIXME: Report error.
+    }
 
     levelDBTransaction->remove(ObjectStoreNamesKey::encode(databaseId, objectStoreName));
 
-    if (!deleteRange(levelDBTransaction, IndexFreeListKey::encode(databaseId, objectStoreId, 0), IndexFreeListKey::encodeMaxKey(databaseId, objectStoreId)))
+    if (!deleteRange(levelDBTransaction, IndexFreeListKey::encode(databaseId, objectStoreId, 0), IndexFreeListKey::encodeMaxKey(databaseId, objectStoreId))) {
+        InternalError(IDBLevelDBBackingStoreWriteError);
         return; // FIXME: Report error.
-    if (!deleteRange(levelDBTransaction, IndexMetaDataKey::encode(databaseId, objectStoreId, 0, 0), IndexMetaDataKey::encodeMaxKey(databaseId, objectStoreId)))
+    }
+    if (!deleteRange(levelDBTransaction, IndexMetaDataKey::encode(databaseId, objectStoreId, 0, 0), IndexMetaDataKey::encodeMaxKey(databaseId, objectStoreId))) {
+        InternalError(IDBLevelDBBackingStoreWriteError);
         return; // FIXME: Report error.
+    }
 
     clearObjectStore(transaction, databaseId, objectStoreId);
 }
@@ -656,8 +718,10 @@ String IDBLevelDBBackingStore::getObjectStoreRecord(IDBBackingStore::Transaction
 
     int64_t version;
     const char* p = decodeVarInt(data.begin(), data.end(), version);
-    if (!p)
+    if (!p) {
+        InternalError(IDBLevelDBBackingStoreReadError);
         return String();
+    }
     (void) version;
 
     return decodeString(p, data.end());
@@ -715,12 +779,16 @@ bool IDBLevelDBBackingStore::putObjectStoreRecord(IDBBackingStore::Transaction*
     v.append(encodeVarInt(version));
     v.append(encodeString(value));
 
-    if (!levelDBTransaction->put(objectStoredataKey, v))
+    if (!levelDBTransaction->put(objectStoredataKey, v)) {
+        InternalError(IDBLevelDBBackingStoreWriteError);
         return false;
+    }
 
     const Vector<char> existsEntryKey = ExistsEntryKey::encode(databaseId, objectStoreId, key);
-    if (!levelDBTransaction->put(existsEntryKey, encodeInt(version)))
+    if (!levelDBTransaction->put(existsEntryKey, encodeInt(version))) {
+        InternalError(IDBLevelDBBackingStoreWriteError);
         return false;
+    }
 
     LevelDBRecordIdentifier* levelDBRecordIdentifier = static_cast<LevelDBRecordIdentifier*>(recordIdentifier);
     levelDBRecordIdentifier->setPrimaryKey(encodeIDBKey(key));
@@ -812,7 +880,7 @@ bool IDBLevelDBBackingStore::maybeUpdateKeyGeneratorCurrentNumber(IDBBackingStor
     const Vector<char> keyGeneratorCurrentNumberKey = ObjectStoreMetaDataKey::encode(databaseId, objectStoreId, ObjectStoreMetaDataKey::KeyGeneratorCurrentNumber);
     bool ok = putInt(levelDBTransaction, keyGeneratorCurrentNumberKey, newNumber);
     if (!ok) {
-        LOG_ERROR("Internal Indexed DB error.");
+        InternalError(IDBLevelDBBackingStoreWriteError);
         return false;
     }
     return true;
@@ -856,8 +924,10 @@ bool IDBLevelDBBackingStore::forEachObjectStoreRecord(IDBBackingStore::Transacti
 
         int64_t version;
         const char* q = decodeVarInt(it->value().begin(), it->value().end(), version);
-        if (!q)
+        if (!q) {
+            InternalError(IDBLevelDBBackingStoreReadError);
             return false;
+        }
 
         RefPtr<LevelDBRecordIdentifier> ri = LevelDBRecordIdentifier::create(encodeIDBKey(*primaryKey), version);
         String idbValue = decodeString(q, it->value().end());
@@ -885,17 +955,14 @@ static bool checkIndexAndMetaDataKey(const LevelDBIterator* it, const Vector<cha
 }
 
 
-void IDBLevelDBBackingStore::getIndexes(int64_t databaseId, int64_t objectStoreId, Vector<int64_t>& foundIds, Vector<String>& foundNames, Vector<IDBKeyPath>& foundKeyPaths, Vector<bool>& foundUniqueFlags, Vector<bool>& foundMultiEntryFlags)
+Vector<IDBIndexMetadata> IDBLevelDBBackingStore::getIndexes(int64_t databaseId, int64_t objectStoreId)
 {
     IDB_TRACE("IDBLevelDBBackingStore::getIndexes");
+    Vector<IDBIndexMetadata> indexes;
     const Vector<char> startKey = IndexMetaDataKey::encode(databaseId, objectStoreId, 0, 0);
     const Vector<char> stopKey = IndexMetaDataKey::encode(databaseId, objectStoreId + 1, 0, 0);
 
-    ASSERT(foundIds.isEmpty());
-    ASSERT(foundNames.isEmpty());
-    ASSERT(foundKeyPaths.isEmpty());
-    ASSERT(foundUniqueFlags.isEmpty());
-    ASSERT(foundMultiEntryFlags.isEmpty());
+    ASSERT(indexes.isEmpty());
 
     OwnPtr<LevelDBIterator> it = m_db->createIterator();
     it->seek(startKey);
@@ -907,7 +974,7 @@ void IDBLevelDBBackingStore::getIndexes(int64_t databaseId, int64_t objectStoreI
         p = IndexMetaDataKey::decode(p, limit, &metaDataKey);
         ASSERT(p);
         if (metaDataKey.metaDataType() != IndexMetaDataKey::Name) {
-            LOG_ERROR("Internal Indexed DB error.");
+            InternalError(IDBLevelDBBackingStoreReadError);
             // Possible stale metadata due to http://webkit.org/b/85557 but don't fail the load.
             it->next();
             continue;
@@ -919,15 +986,15 @@ void IDBLevelDBBackingStore::getIndexes(int64_t databaseId, int64_t objectStoreI
 
         it->next(); // unique flag
         if (!checkIndexAndMetaDataKey(it.get(), stopKey, indexId, IndexMetaDataKey::Unique)) {
-            LOG_ERROR("Internal Indexed DB error.");
-            return;
+            InternalError(IDBLevelDBBackingStoreReadError);
+            break;
         }
         bool indexUnique = decodeBool(it->value().begin(), it->value().end());
 
         it->next(); // keyPath
         if (!checkIndexAndMetaDataKey(it.get(), stopKey, indexId, IndexMetaDataKey::KeyPath)) {
-            LOG_ERROR("Internal Indexed DB error.");
-            return;
+            InternalError(IDBLevelDBBackingStoreReadError);
+            break;
         }
         IDBKeyPath keyPath = decodeIDBKeyPath(it->value().begin(), it->value().end());
 
@@ -938,12 +1005,9 @@ void IDBLevelDBBackingStore::getIndexes(int64_t databaseId, int64_t objectStoreI
             it->next();
         }
 
-        foundIds.append(indexId);
-        foundNames.append(indexName);
-        foundKeyPaths.append(keyPath);
-        foundUniqueFlags.append(indexUnique);
-        foundMultiEntryFlags.append(indexMultiEntry);
+        indexes.append(IDBIndexMetadata(indexName, indexId, keyPath, indexUnique, indexMultiEntry));
     }
+    return indexes;
 }
 
 static bool setMaxIndexId(LevelDBTransaction* transaction, int64_t databaseId, int64_t objectStoreId, int64_t indexId)
@@ -954,11 +1018,15 @@ static bool setMaxIndexId(LevelDBTransaction* transaction, int64_t databaseId, i
         maxIndexId = MinimumIndexId;
 
     if (indexId <= maxIndexId) {
-        LOG_ERROR("Possible corruption: new index id is too small.");
+        InternalError(IDBLevelDBBackingStoreConsistencyError);
         return false;
     }
 
-    return putInt(transaction, maxIndexIdKey, indexId);
+    if (!putInt(transaction, maxIndexIdKey, indexId)) {
+        InternalError(IDBLevelDBBackingStoreWriteError);
+        return false;
+    }
+    return true;
 }
 
 bool IDBLevelDBBackingStore::createIndex(IDBBackingStore::Transaction* transaction, int64_t databaseId, int64_t objectStoreId, int64_t indexId, const String& name, const IDBKeyPath& keyPath, bool isUnique, bool isMultiEntry)
@@ -975,25 +1043,25 @@ bool IDBLevelDBBackingStore::createIndex(IDBBackingStore::Transaction* transacti
 
     bool ok = putString(levelDBTransaction, nameKey, name);
     if (!ok) {
-        LOG_ERROR("Internal Indexed DB error.");
+        InternalError(IDBLevelDBBackingStoreWriteError);
         return false;
     }
 
     ok = putBool(levelDBTransaction, uniqueKey, isUnique);
     if (!ok) {
-        LOG_ERROR("Internal Indexed DB error.");
+        InternalError(IDBLevelDBBackingStoreWriteError);
         return false;
     }
 
     ok = putIDBKeyPath(levelDBTransaction, keyPathKey, keyPath);
     if (!ok) {
-        LOG_ERROR("Internal Indexed DB error.");
+        InternalError(IDBLevelDBBackingStoreWriteError);
         return false;
     }
 
     ok = putBool(levelDBTransaction, multiEntryKey, isMultiEntry);
     if (!ok) {
-        LOG_ERROR("Internal Indexed DB error.");
+        InternalError(IDBLevelDBBackingStoreWriteError);
         return false;
     }
 
@@ -1009,7 +1077,7 @@ void IDBLevelDBBackingStore::deleteIndex(IDBBackingStore::Transaction* transacti
     const Vector<char> indexMetaDataEnd = IndexMetaDataKey::encodeMaxKey(databaseId, objectStoreId, indexId);
 
     if (!deleteRange(levelDBTransaction, indexMetaDataStart, indexMetaDataEnd)) {
-        LOG_ERROR("Internal Indexed DB error.");
+        InternalError(IDBLevelDBBackingStoreWriteError);
         return;
     }
 
@@ -1017,7 +1085,7 @@ void IDBLevelDBBackingStore::deleteIndex(IDBBackingStore::Transaction* transacti
     const Vector<char> indexDataEnd = IndexDataKey::encodeMaxKey(databaseId, objectStoreId, indexId);
 
     if (!deleteRange(levelDBTransaction, indexDataStart, indexDataEnd)) {
-        LOG_ERROR("Internal Indexed DB error.");
+        InternalError(IDBLevelDBBackingStoreWriteError);
         return;
     }
 }
@@ -1102,8 +1170,10 @@ bool IDBLevelDBBackingStore::findKeyInIndex(IDBBackingStore::Transaction* transa
 
         int64_t version;
         const char* p = decodeVarInt(it->value().begin(), it->value().end(), version);
-        if (!p)
+        if (!p) {
+            InternalError(IDBLevelDBBackingStoreReadError);
             return false;
+        }
         foundEncodedPrimaryKey.append(p, it->value().end() - p);
 
         if (!versionExists(levelDBTransaction, databaseId, objectStoreId, version, foundEncodedPrimaryKey)) {
@@ -1381,17 +1451,19 @@ bool ObjectStoreKeyCursorImpl::loadCurrentRow()
 
     ObjectStoreDataKey objectStoreDataKey;
     keyPosition = ObjectStoreDataKey::decode(keyPosition, keyLimit, &objectStoreDataKey);
-    ASSERT(keyPosition);
-    if (!keyPosition)
+    if (!keyPosition) {
+        InternalError(IDBLevelDBBackingStoreReadError);
         return false;
+    }
 
     m_currentKey = objectStoreDataKey.userKey();
 
     int64_t version;
     const char* valuePosition = decodeVarInt(m_iterator->value().begin(), m_iterator->value().end(), version);
-    ASSERT(valuePosition);
-    if (!valuePosition)
+    if (!valuePosition) {
+        InternalError(IDBLevelDBBackingStoreReadError);
         return false;
+    }
 
     // FIXME: This re-encodes what was just decoded; try and optimize.
     m_identifier = LevelDBRecordIdentifier::create(encodeIDBKey(*m_currentKey), version);
@@ -1442,17 +1514,19 @@ bool ObjectStoreCursorImpl::loadCurrentRow()
 
     ObjectStoreDataKey objectStoreDataKey;
     keyPosition = ObjectStoreDataKey::decode(keyPosition, keyLimit, &objectStoreDataKey);
-    ASSERT(keyPosition);
-    if (!keyPosition)
+    if (!keyPosition) {
+        InternalError(IDBLevelDBBackingStoreReadError);
         return false;
+    }
 
     m_currentKey = objectStoreDataKey.userKey();
 
     int64_t version;
     const char* valuePosition = decodeVarInt(m_iterator->value().begin(), m_iterator->value().end(), version);
-    ASSERT(valuePosition);
-    if (!valuePosition)
+    if (!valuePosition) {
+        InternalError(IDBLevelDBBackingStoreReadError);
         return false;
+    }
 
     // FIXME: This re-encodes what was just decoded; try and optimize.
     m_identifier = LevelDBRecordIdentifier::create(encodeIDBKey(*m_currentKey), version);
@@ -1507,14 +1581,16 @@ bool IndexKeyCursorImpl::loadCurrentRow()
 
     int64_t indexDataVersion;
     const char* valuePosition = decodeVarInt(m_iterator->value().begin(), m_iterator->value().end(), indexDataVersion);
-    ASSERT(valuePosition);
-    if (!valuePosition)
+    if (!valuePosition) {
+        InternalError(IDBLevelDBBackingStoreReadError);
         return false;
+    }
 
     valuePosition = decodeIDBKey(valuePosition, m_iterator->value().end(), m_primaryKey);
-    ASSERT(valuePosition);
-    if (!valuePosition)
+    if (!valuePosition) {
+        InternalError(IDBLevelDBBackingStoreReadError);
         return false;
+    }
 
     Vector<char> primaryLevelDBKey = ObjectStoreDataKey::encode(indexDataKey.databaseId(), indexDataKey.objectStoreId(), *m_primaryKey);
 
@@ -1526,9 +1602,10 @@ bool IndexKeyCursorImpl::loadCurrentRow()
 
     int64_t objectStoreDataVersion;
     const char* t = decodeVarInt(result.begin(), result.end(), objectStoreDataVersion);
-    ASSERT(t);
-    if (!t)
+    if (!t) {
+        InternalError(IDBLevelDBBackingStoreReadError);
         return false;
+    }
 
     if (objectStoreDataVersion != indexDataVersion) {
         m_transaction->remove(m_iterator->key());
@@ -1590,13 +1667,15 @@ bool IndexCursorImpl::loadCurrentRow()
 
     int64_t indexDataVersion;
     valuePosition = decodeVarInt(valuePosition, valueLimit, indexDataVersion);
-    ASSERT(valuePosition);
-    if (!valuePosition)
+    if (!valuePosition) {
+        InternalError(IDBLevelDBBackingStoreReadError);
         return false;
+    }
     valuePosition = decodeIDBKey(valuePosition, valueLimit, m_primaryKey);
-    ASSERT(valuePosition);
-    if (!valuePosition)
+    if (!valuePosition) {
+        InternalError(IDBLevelDBBackingStoreReadError);
         return false;
+    }
 
     m_primaryLevelDBKey = ObjectStoreDataKey::encode(indexDataKey.databaseId(), indexDataKey.objectStoreId(), *m_primaryKey);
 
@@ -1608,9 +1687,10 @@ bool IndexCursorImpl::loadCurrentRow()
 
     int64_t objectStoreDataVersion;
     const char* t = decodeVarInt(result.begin(), result.end(), objectStoreDataVersion);
-    ASSERT(t);
-    if (!t)
+    if (!t) {
+        InternalError(IDBLevelDBBackingStoreReadError);
         return false;
+    }
 
     if (objectStoreDataVersion != indexDataVersion) {
         m_transaction->remove(m_iterator->key());
diff --git a/Source/WebCore/Modules/indexeddb/IDBLevelDBBackingStore.h b/Source/WebCore/Modules/indexeddb/IDBLevelDBBackingStore.h
index 0cf3276b3..26d6f90a9 100644
--- a/Source/WebCore/Modules/indexeddb/IDBLevelDBBackingStore.h
+++ b/Source/WebCore/Modules/indexeddb/IDBLevelDBBackingStore.h
@@ -44,14 +44,14 @@ public:
     static PassRefPtr<IDBBackingStore> open(SecurityOrigin*, const String& pathBase, const String& fileIdentifier, IDBFactoryBackendImpl*);
     virtual ~IDBLevelDBBackingStore();
 
-    virtual void getDatabaseNames(Vector<String>& foundNames);
+    virtual Vector<String> getDatabaseNames();
     virtual bool getIDBDatabaseMetaData(const String& name, IDBDatabaseMetadata*);
     virtual bool createIDBDatabaseMetaData(const String& name, const String& version, int64_t intVersion, int64_t& rowId);
     virtual bool updateIDBDatabaseMetaData(IDBBackingStore::Transaction*, int64_t rowId, const String& version);
     virtual bool updateIDBDatabaseIntVersion(IDBBackingStore::Transaction*, int64_t rowId, int64_t intVersion);
     virtual bool deleteDatabase(const String& name);
 
-    virtual void getObjectStores(int64_t databaseId, Vector<int64_t>& foundIds, Vector<String>& foundNames, Vector<IDBKeyPath>& foundKeyPaths, Vector<bool>& foundAutoIncrementFlags, Vector<int64_t>& foundMaxIndexIds);
+    virtual Vector<IDBObjectStoreMetadata> getObjectStores(int64_t databaseId);
     virtual bool createObjectStore(IDBBackingStore::Transaction*, int64_t databaseId, int64_t objectStoreId, const String& name, const IDBKeyPath&, bool autoIncrement);
     virtual void deleteObjectStore(IDBBackingStore::Transaction*, int64_t databaseId, int64_t objectStoreId);
     virtual PassRefPtr<ObjectStoreRecordIdentifier> createInvalidRecordIdentifier();
@@ -65,7 +65,7 @@ public:
 
     virtual bool forEachObjectStoreRecord(IDBBackingStore::Transaction*, int64_t databaseId, int64_t objectStoreId, ObjectStoreRecordCallback&);
 
-    virtual void getIndexes(int64_t databaseId, int64_t objectStoreId, Vector<int64_t>& foundIds, Vector<String>& foundNames, Vector<IDBKeyPath>& foundKeyPaths, Vector<bool>& foundUniqueFlags, Vector<bool>& foundMultiEntryFlags);
+    virtual Vector<IDBIndexMetadata> getIndexes(int64_t databaseId, int64_t objectStoreId);
     virtual bool createIndex(IDBBackingStore::Transaction*, int64_t databaseId, int64_t objectStoreId, int64_t indexId, const String& name, const IDBKeyPath&, bool isUnique, bool isMultiEntry);
     virtual void deleteIndex(IDBBackingStore::Transaction*, int64_t databaseId, int64_t objectStoreId, int64_t indexId);
     virtual bool putIndexDataForRecord(IDBBackingStore::Transaction*, int64_t databaseId, int64_t objectStoreId, int64_t indexId, const IDBKey&, const ObjectStoreRecordIdentifier*);
diff --git a/Source/WebCore/Modules/indexeddb/IDBMetadata.h b/Source/WebCore/Modules/indexeddb/IDBMetadata.h
index 096f89afa..1b0384bd9 100644
--- a/Source/WebCore/Modules/indexeddb/IDBMetadata.h
+++ b/Source/WebCore/Modules/indexeddb/IDBMetadata.h
@@ -38,43 +38,28 @@
 
 namespace WebCore {
 
-struct IDBObjectStoreMetadata;
-struct IDBIndexMetadata;
-
-struct IDBDatabaseMetadata {
-    // FIXME: These can probably be collapsed into 0.
-    enum {
-        NoIntVersion = -1,
-        DefaultIntVersion = 0
-    };
-
-    IDBDatabaseMetadata()
-        : intVersion(NoIntVersion)
-    {
-    }
-    IDBDatabaseMetadata(const String& name, int64_t id, const String& version, int64_t intVersion, int64_t maxObjectStoreId)
+struct IDBIndexMetadata {
+    IDBIndexMetadata() { }
+    IDBIndexMetadata(const String& name, int64_t id, const IDBKeyPath& keyPath, bool unique, bool multiEntry)
         : name(name)
         , id(id)
-        , version(version)
-        , intVersion(intVersion)
-        , maxObjectStoreId(maxObjectStoreId)
-    {
-    }
-
+        , keyPath(keyPath)
+        , unique(unique)
+        , multiEntry(multiEntry) { }
     String name;
     int64_t id;
-    String version;
-    int64_t intVersion;
-    int64_t maxObjectStoreId;
+    IDBKeyPath keyPath;
+    bool unique;
+    bool multiEntry;
 
-    typedef HashMap<String, IDBObjectStoreMetadata> ObjectStoreMap;
-    ObjectStoreMap objectStores;
+    static const int64_t InvalidId = -1;
 };
 
 struct IDBObjectStoreMetadata {
     IDBObjectStoreMetadata() { }
     IDBObjectStoreMetadata(const String& name, int64_t id, const IDBKeyPath& keyPath, bool autoIncrement, int64_t maxIndexId)
         : name(name)
+        , id(id)
         , keyPath(keyPath)
         , autoIncrement(autoIncrement)
         , maxIndexId(maxIndexId)
@@ -86,23 +71,66 @@ struct IDBObjectStoreMetadata {
     bool autoIncrement;
     int64_t maxIndexId;
 
-    typedef HashMap<String, IDBIndexMetadata> IndexMap;
+    static const int64_t InvalidId = -1;
+
+    typedef HashMap<int64_t, IDBIndexMetadata> IndexMap;
     IndexMap indexes;
+
+    bool containsIndex(const String& name) const
+    {
+        for (IndexMap::const_iterator it = indexes.begin(); it != indexes.end(); ++it) {
+            if (it->value.name == name)
+                return true;
+        }
+        return false;
+    }
 };
 
-struct IDBIndexMetadata {
-    IDBIndexMetadata() { }
-    IDBIndexMetadata(const String& name, int64_t id, const IDBKeyPath& keyPath, bool unique, bool multiEntry)
+struct IDBDatabaseMetadata {
+    // FIXME: These can probably be collapsed into 0.
+    enum {
+        NoIntVersion = -1,
+        DefaultIntVersion = 0
+    };
+
+    typedef HashMap<int64_t, IDBObjectStoreMetadata> ObjectStoreMap;
+
+    IDBDatabaseMetadata()
+        : intVersion(NoIntVersion)
+    {
+    }
+    IDBDatabaseMetadata(const String& name, int64_t id, const String& version, int64_t intVersion, int64_t maxObjectStoreId)
         : name(name)
         , id(id)
-        , keyPath(keyPath)
-        , unique(unique)
-        , multiEntry(multiEntry) { }
+        , version(version)
+        , intVersion(intVersion)
+        , maxObjectStoreId(maxObjectStoreId)
+    {
+    }
+
+    int64_t findObjectStore(const String& name) const
+    {
+        for (ObjectStoreMap::const_iterator it = objectStores.begin(); it != objectStores.end(); ++it) {
+            if (it->value.name == name) {
+                ASSERT(it->key != IDBObjectStoreMetadata::InvalidId);
+                return it->key;
+            }
+        }
+        return IDBObjectStoreMetadata::InvalidId;
+    }
+
+    bool containsObjectStore(const String& name) const
+    {
+        return findObjectStore(name) != IDBObjectStoreMetadata::InvalidId;
+    }
+
     String name;
     int64_t id;
-    IDBKeyPath keyPath;
-    bool unique;
-    bool multiEntry;
+    String version;
+    int64_t intVersion;
+    int64_t maxObjectStoreId;
+
+    ObjectStoreMap objectStores;
 };
 
 }
diff --git a/Source/WebCore/Modules/indexeddb/IDBObjectStore.cpp b/Source/WebCore/Modules/indexeddb/IDBObjectStore.cpp
index 3fcc38f66..d9d2ec280 100644
--- a/Source/WebCore/Modules/indexeddb/IDBObjectStore.cpp
+++ b/Source/WebCore/Modules/indexeddb/IDBObjectStore.cpp
@@ -66,7 +66,7 @@ PassRefPtr<DOMStringList> IDBObjectStore::indexNames() const
     IDB_TRACE("IDBObjectStore::indexNames");
     RefPtr<DOMStringList> indexNames = DOMStringList::create();
     for (IDBObjectStoreMetadata::IndexMap::const_iterator it = m_metadata.indexes.begin(); it != m_metadata.indexes.end(); ++it)
-        indexNames->append(it->key);
+        indexNames->append(it->value.name);
     indexNames->sort();
     return indexNames.release();
 }
@@ -209,7 +209,7 @@ PassRefPtr<IDBRequest> IDBObjectStore::put(IDBObjectStoreBackendInterface::PutMo
     for (IDBObjectStoreMetadata::IndexMap::const_iterator it = m_metadata.indexes.begin(); it != m_metadata.indexes.end(); ++it) {
         IndexKeys keys;
         generateIndexKeysForValue(it->value, value, &keys);
-        indexNames.append(it->key);
+        indexNames.append(it->value.name);
         indexKeys.append(keys);
     }
     ASSERT(indexKeys.size() == indexNames.size());
@@ -325,7 +325,7 @@ private:
             cursor->continueFunction(ec);
             ASSERT(!ec);
 
-            RefPtr<IDBKey> primaryKey = cursor->primaryKey();
+            RefPtr<IDBKey> primaryKey = cursor->idbPrimaryKey();
             ScriptValue value = cursor->value();
 
             IDBObjectStore::IndexKeys indexKeys;
@@ -382,7 +382,7 @@ PassRefPtr<IDBIndex> IDBObjectStore::createIndex(ScriptExecutionContext* context
         ec = NATIVE_TYPE_ERR;
         return 0;
     }
-    if (m_metadata.indexes.contains(name)) {
+    if (m_metadata.containsIndex(name)) {
         ec = IDBDatabaseException::CONSTRAINT_ERR;
         return 0;
     }
@@ -409,7 +409,7 @@ PassRefPtr<IDBIndex> IDBObjectStore::createIndex(ScriptExecutionContext* context
     IDBIndexMetadata metadata(name, indexId, keyPath, unique, multiEntry);
     RefPtr<IDBIndex> index = IDBIndex::create(metadata, indexBackend.release(), this, m_transaction.get());
     m_indexMap.set(name, index);
-    m_metadata.indexes.set(name, metadata);
+    m_metadata.indexes.set(indexId, metadata);
 
     ASSERT(!ec);
     if (ec)
@@ -444,15 +444,24 @@ PassRefPtr<IDBIndex> IDBObjectStore::index(const String& name, ExceptionCode& ec
     if (it != m_indexMap.end())
         return it->value;
 
-    RefPtr<IDBIndexBackendInterface> indexBackend = m_backend->index(name, ec);
-    ASSERT(!indexBackend != !ec); // If we didn't get an index, we should have gotten an exception code. And vice versa.
-    if (ec)
+    if (!m_metadata.containsIndex(name)) {
+        ec = IDBDatabaseException::IDB_NOT_FOUND_ERR;
         return 0;
+    }
 
-    IDBObjectStoreMetadata::IndexMap::const_iterator mdit = m_metadata.indexes.find(name);
-    ASSERT(mdit != m_metadata.indexes.end());
+    RefPtr<IDBIndexBackendInterface> indexBackend = m_backend->index(name, ec);
+    ASSERT(!ec && indexBackend);
 
-    RefPtr<IDBIndex> index = IDBIndex::create(mdit->value, indexBackend.release(), this, m_transaction.get());
+    const IDBIndexMetadata* indexMetadata(0);
+    for (IDBObjectStoreMetadata::IndexMap::const_iterator it = m_metadata.indexes.begin(); it != m_metadata.indexes.end(); ++it) {
+        if (it->value.name == name) {
+            indexMetadata = &it->value;
+            break;
+        }
+    }
+    ASSERT(indexMetadata);
+
+    RefPtr<IDBIndex> index = IDBIndex::create(*indexMetadata, indexBackend.release(), this, m_transaction.get());
     m_indexMap.set(name, index);
     return index.release();
 }
@@ -467,21 +476,20 @@ void IDBObjectStore::deleteIndex(const String& name, ExceptionCode& ec)
         ec = IDBDatabaseException::TRANSACTION_INACTIVE_ERR;
         return;
     }
-    if (!m_metadata.indexes.contains(name)) {
+    if (!m_metadata.containsIndex(name)) {
         ec = IDBDatabaseException::IDB_NOT_FOUND_ERR;
         return;
     }
 
     m_backend->deleteIndex(name, m_transaction->backend(), ec);
     if (!ec) {
+        ASSERT(m_metadata.containsIndex(name));
         IDBIndexMap::iterator it = m_indexMap.find(name);
         if (it != m_indexMap.end()) {
+            m_metadata.indexes.remove(it->value->id());
             it->value->markDeleted();
             m_indexMap.remove(name);
         }
-
-        ASSERT(m_metadata.indexes.contains(name));
-        m_metadata.indexes.remove(name);
     }
 }
 
diff --git a/Source/WebCore/Modules/indexeddb/IDBObjectStore.h b/Source/WebCore/Modules/indexeddb/IDBObjectStore.h
index 2a8cfcf97..9f027ea0c 100644
--- a/Source/WebCore/Modules/indexeddb/IDBObjectStore.h
+++ b/Source/WebCore/Modules/indexeddb/IDBObjectStore.h
@@ -81,11 +81,8 @@ public:
     PassRefPtr<IDBRequest> deleteFunction(ScriptExecutionContext*, PassRefPtr<IDBKey> key, ExceptionCode&);
     PassRefPtr<IDBRequest> clear(ScriptExecutionContext*, ExceptionCode&);
 
-    // FIXME: Try to modify the code generator so this duplication is unneeded.
     PassRefPtr<IDBIndex> createIndex(ScriptExecutionContext*, const String& name, const String& keyPath, const Dictionary&, ExceptionCode&);
-    PassRefPtr<IDBIndex> createIndex(ScriptExecutionContext* context, const String& name, const String& keyPath, ExceptionCode& ec) { return createIndex(context, name, keyPath, Dictionary(), ec); }
     PassRefPtr<IDBIndex> createIndex(ScriptExecutionContext*, const String& name, PassRefPtr<DOMStringList> keyPath, const Dictionary&, ExceptionCode&);
-    PassRefPtr<IDBIndex> createIndex(ScriptExecutionContext* context, const String& name, PassRefPtr<DOMStringList> keyPath, ExceptionCode& ec) { return createIndex(context, name, keyPath, Dictionary(), ec); }
     PassRefPtr<IDBIndex> createIndex(ScriptExecutionContext*, const String&, const IDBKeyPath&, const Dictionary&, ExceptionCode&);
 
     PassRefPtr<IDBIndex> index(const String& name, ExceptionCode&);
diff --git a/Source/WebCore/Modules/indexeddb/IDBObjectStoreBackendImpl.cpp b/Source/WebCore/Modules/indexeddb/IDBObjectStoreBackendImpl.cpp
index d06818a58..976ad0bdb 100644
--- a/Source/WebCore/Modules/indexeddb/IDBObjectStoreBackendImpl.cpp
+++ b/Source/WebCore/Modules/indexeddb/IDBObjectStoreBackendImpl.cpp
@@ -29,7 +29,6 @@
 #if ENABLE(INDEXED_DATABASE)
 
 #include "CrossThreadTask.h"
-#include "DOMStringList.h"
 #include "IDBBackingStore.h"
 #include "IDBBindingUtilities.h"
 #include "IDBCallbacks.h"
@@ -50,20 +49,16 @@ IDBObjectStoreBackendImpl::~IDBObjectStoreBackendImpl()
 {
 }
 
-IDBObjectStoreBackendImpl::IDBObjectStoreBackendImpl(const IDBDatabaseBackendImpl* database, int64_t id, const String& name, const IDBKeyPath& keyPath, bool autoIncrement, int64_t maxIndexId)
+IDBObjectStoreBackendImpl::IDBObjectStoreBackendImpl(const IDBDatabaseBackendImpl* database, const IDBObjectStoreMetadata& metadata)
     : m_database(database)
-    , m_id(id)
-    , m_name(name)
-    , m_keyPath(keyPath)
-    , m_autoIncrement(autoIncrement)
-    , m_maxIndexId(maxIndexId)
+    , m_metadata(metadata)
 {
     loadIndexes();
 }
 
 IDBObjectStoreMetadata IDBObjectStoreBackendImpl::metadata() const
 {
-    IDBObjectStoreMetadata metadata(m_name, m_id, m_keyPath, m_autoIncrement, m_maxIndexId);
+    IDBObjectStoreMetadata metadata(m_metadata);
     for (IndexMap::const_iterator it = m_indexes.begin(); it != m_indexes.end(); ++it)
         metadata.indexes.set(it->key, it->value->metadata());
     return metadata;
@@ -111,7 +106,7 @@ void IDBObjectStoreBackendImpl::getInternal(ScriptExecutionContext*, PassRefPtr<
     callbacks->onSuccess(SerializedScriptValue::createFromWire(wireData));
 }
 
-void IDBObjectStoreBackendImpl::putWithIndexKeys(PassRefPtr<SerializedScriptValue> prpValue, PassRefPtr<IDBKey> prpKey, PutMode putMode, PassRefPtr<IDBCallbacks> prpCallbacks, IDBTransactionBackendInterface* transactionPtr, const Vector<String>& indexNames, const Vector<IndexKeys>& indexKeys, ExceptionCode&)
+void IDBObjectStoreBackendImpl::put(PassRefPtr<SerializedScriptValue> prpValue, PassRefPtr<IDBKey> prpKey, PutMode putMode, PassRefPtr<IDBCallbacks> prpCallbacks, IDBTransactionBackendInterface* transactionPtr, const Vector<int64_t>& indexIds, const Vector<IndexKeys>& indexKeys)
 {
     IDB_TRACE("IDBObjectStoreBackendImpl::putWithIndexKeys");
 
@@ -122,16 +117,20 @@ void IDBObjectStoreBackendImpl::putWithIndexKeys(PassRefPtr<SerializedScriptValu
     RefPtr<IDBTransactionBackendImpl> transaction = IDBTransactionBackendImpl::from(transactionPtr);
     ASSERT(transaction->mode() != IDBTransaction::READ_ONLY);
 
-    OwnPtr<Vector<String> > newIndexNames = adoptPtr(new Vector<String>(indexNames));
+    OwnPtr<Vector<int64_t> > newIndexIds = adoptPtr(new Vector<int64_t>(indexIds));
     OwnPtr<Vector<IndexKeys> > newIndexKeys = adoptPtr(new Vector<IndexKeys>(indexKeys));
 
     ASSERT(autoIncrement() || key);
 
     if (!transaction->scheduleTask(
-            createCallbackTask(&IDBObjectStoreBackendImpl::putInternal, objectStore, value, key, putMode, callbacks, transaction, newIndexNames.release(), newIndexKeys.release())))
+        createCallbackTask(&IDBObjectStoreBackendImpl::putInternal, objectStore, value, key, putMode, callbacks, transaction, newIndexIds.release(), newIndexKeys.release())))
         callbacks->onError(IDBDatabaseError::create(IDBDatabaseException::IDB_ABORT_ERR));
 }
 
+void IDBObjectStoreBackendImpl::putWithIndexKeys(PassRefPtr<SerializedScriptValue> prpValue, PassRefPtr<IDBKey> prpKey, PutMode putMode, PassRefPtr<IDBCallbacks> prpCallbacks, IDBTransactionBackendInterface* transactionPtr, const Vector<String>& indexNames, const Vector<IndexKeys>& indexKeys, ExceptionCode&)
+{
+    return put(prpValue, prpKey, putMode, prpCallbacks, transactionPtr, getIndexIds(indexNames), indexKeys);
+}
 namespace {
 class IndexWriter {
 public:
@@ -161,8 +160,9 @@ public:
         return true;
     }
 
-    bool writeIndexKeys(const IDBBackingStore::ObjectStoreRecordIdentifier* recordIdentifier, IDBBackingStore& backingStore, IDBBackingStore::Transaction* transaction, int64_t databaseId, int64_t objectStoreId, int64_t indexId) const
+    bool writeIndexKeys(const IDBBackingStore::ObjectStoreRecordIdentifier* recordIdentifier, IDBBackingStore& backingStore, IDBBackingStore::Transaction* transaction, int64_t databaseId, int64_t objectStoreId) const
     {
+        int64_t indexId = m_indexMetadata.id;
         for (size_t i = 0; i < m_indexKeys.size(); ++i) {
             if (!backingStore.deleteIndexDataForRecord(transaction, databaseId, objectStoreId, indexId, recordIdentifier))
                 return false;
@@ -172,8 +172,6 @@ public:
         return true;
     }
 
-    const String& indexName() const { return m_indexMetadata.name; }
-
 private:
 
     bool addingKeyAllowed(IDBBackingStore& backingStore, IDBBackingStore::Transaction* transaction,
@@ -197,19 +195,17 @@ private:
 };
 }
 
-static bool makeIndexWriters(PassRefPtr<IDBTransactionBackendImpl> transaction, IDBObjectStoreBackendImpl* objectStore, PassRefPtr<IDBKey> primaryKey, bool keyWasGenerated, const Vector<String> indexNames, const Vector<IDBObjectStoreBackendInterface::IndexKeys>& indexKeys, Vector<OwnPtr<IndexWriter> >* indexWriters, String* errorMessage)
+static bool makeIndexWriters(PassRefPtr<IDBTransactionBackendImpl> transaction, IDBObjectStoreBackendImpl* objectStore, PassRefPtr<IDBKey> primaryKey, bool keyWasGenerated, const Vector<int64_t>& indexIds, const Vector<IDBObjectStoreBackendInterface::IndexKeys>& indexKeys, Vector<OwnPtr<IndexWriter> >* indexWriters, String* errorMessage)
 {
-    ASSERT(indexNames.size() == indexKeys.size());
+    ASSERT(indexIds.size() == indexKeys.size());
 
-    HashMap<String, IDBObjectStoreBackendInterface::IndexKeys> indexKeyMap;
-    for (size_t i = 0; i < indexNames.size(); i++)
-        indexKeyMap.add(indexNames[i], indexKeys[i]);
+    HashMap<int64_t, IDBObjectStoreBackendInterface::IndexKeys> indexKeyMap;
+    for (size_t i = 0; i < indexIds.size(); ++i)
+        indexKeyMap.add(indexIds[i], indexKeys[i]);
 
     for (IDBObjectStoreBackendImpl::IndexMap::iterator it = objectStore->iterIndexesBegin(); it != objectStore->iterIndexesEnd(); ++it) {
 
         const RefPtr<IDBIndexBackendImpl>& index = it->value;
-        if (!index->hasValidId())
-            continue; // The index object has been created, but does not exist in the database yet.
 
         IDBObjectStoreBackendInterface::IndexKeys keys = indexKeyMap.get(it->key);
         // If the objectStore is using autoIncrement, then any indexes with an identical keyPath need to also use the primary (generated) key as a key.
@@ -234,7 +230,7 @@ static bool makeIndexWriters(PassRefPtr<IDBTransactionBackendImpl> transaction,
     return true;
 }
 
-void IDBObjectStoreBackendImpl::setIndexKeys(PassRefPtr<IDBKey> prpPrimaryKey, const Vector<String>& indexNames, const Vector<IndexKeys>& indexKeys, IDBTransactionBackendInterface* transactionPtr)
+void IDBObjectStoreBackendImpl::setIndexKeys(PassRefPtr<IDBKey> prpPrimaryKey, const Vector<int64_t>& indexIds, const Vector<IndexKeys>& indexKeys, IDBTransactionBackendInterface* transactionPtr)
 {
     IDB_TRACE("IDBObjectStoreBackendImpl::setIndexKeys");
     RefPtr<IDBKey> primaryKey = prpPrimaryKey;
@@ -249,7 +245,7 @@ void IDBObjectStoreBackendImpl::setIndexKeys(PassRefPtr<IDBKey> prpPrimaryKey, c
 
     Vector<OwnPtr<IndexWriter> > indexWriters;
     String errorMessage;
-    if (!makeIndexWriters(transaction, this, primaryKey, false, indexNames, indexKeys, &indexWriters, &errorMessage)) {
+    if (!makeIndexWriters(transaction, this, primaryKey, false, indexIds, indexKeys, &indexWriters, &errorMessage)) {
         // FIXME: Need to deal with errorMessage here. makeIndexWriters only fails on uniqueness constraint errors.
         transaction->abort(IDBDatabaseError::create(IDBDatabaseException::CONSTRAINT_ERR, "Duplicate index keys exist in the object store."));
         return;
@@ -257,51 +253,68 @@ void IDBObjectStoreBackendImpl::setIndexKeys(PassRefPtr<IDBKey> prpPrimaryKey, c
 
     for (size_t i = 0; i < indexWriters.size(); ++i) {
         IndexWriter* indexWriter = indexWriters[i].get();
-        if (!indexWriter->writeIndexKeys(recordIdentifier.get(),
-                                         *backingStore(),
-                                         transaction->backingStoreTransaction(),
-                                         databaseId(),
-                                         m_id,
-                                         m_indexes.get(indexWriter->indexName())->id())) {
+        if (!indexWriter->writeIndexKeys(recordIdentifier.get(), *backingStore(), transaction->backingStoreTransaction(), databaseId(), m_metadata.id)) {
             transaction->abort();
             return;
         }
     }
 }
 
-void IDBObjectStoreBackendImpl::setIndexesReady(const Vector<String>& indexNames, IDBTransactionBackendInterface* transactionInterface)
+void IDBObjectStoreBackendImpl::setIndexKeys(PassRefPtr<IDBKey> prpPrimaryKey, const Vector<String>& indexNames, const Vector<IndexKeys>& indexKeys, IDBTransactionBackendInterface* transactionPtr)
+{
+    Vector<int64_t> indexIds = getIndexIds(indexNames);
+    return setIndexKeys(prpPrimaryKey, indexIds, indexKeys, transactionPtr);
+}
+
+void IDBObjectStoreBackendImpl::setIndexesReady(const Vector<int64_t>& indexIds, IDBTransactionBackendInterface* transactionInterface)
 {
     IDB_TRACE("IDBObjectStoreBackendImpl::setIndexesReady");
     RefPtr<IDBObjectStoreBackendImpl> objectStore = this;
 
-    OwnPtr<Vector<String> > names = adoptPtr(new Vector<String>(indexNames));
+    OwnPtr<Vector<int64_t> > newIndexIds = adoptPtr(new Vector<int64_t>(indexIds));
     RefPtr<IDBTransactionBackendImpl> transaction = IDBTransactionBackendImpl::from(transactionInterface);
 
     if (!transaction->scheduleTask(
             IDBTransactionBackendInterface::PreemptiveTask,
-            createCallbackTask(&IDBObjectStoreBackendImpl::setIndexesReadyInternal, objectStore, names.release(), transaction)))
+            createCallbackTask(&IDBObjectStoreBackendImpl::setIndexesReadyInternal, objectStore, newIndexIds.release(), transaction)))
         ASSERT_NOT_REACHED();
 }
 
-void IDBObjectStoreBackendImpl::setIndexesReadyInternal(ScriptExecutionContext*, PassRefPtr<IDBObjectStoreBackendImpl> objectStore, PassOwnPtr<Vector<String> > popIndexNames, PassRefPtr<IDBTransactionBackendImpl> transaction)
+void IDBObjectStoreBackendImpl::setIndexesReady(const Vector<String>& indexNames, IDBTransactionBackendInterface* transactionInterface)
+{
+    Vector<int64_t> indexIds(indexNames.size());
+    // FIXME: We manually convert each name to an indexId, even if the name has already been deleted, because we have to remove exactly that many preemptive events, but this will go away when https://bugs.webkit.org/show_bug.cgi?id=100426 lands.
+    for (size_t i = 0; i < indexNames.size(); ++i) {
+        indexIds[i] = InvalidId;
+        for (IndexMap::const_iterator it = m_indexes.begin(); it != m_indexes.end(); ++it) {
+            if (it->value->name() == indexNames[i]) {
+                indexIds[i] = it->key;
+                break;
+            }
+        }
+    }
+    return setIndexesReady(indexIds, transactionInterface);
+}
+
+void IDBObjectStoreBackendImpl::setIndexesReadyInternal(ScriptExecutionContext*, PassRefPtr<IDBObjectStoreBackendImpl> objectStore, PassOwnPtr<Vector<int64_t> > popIndexIds, PassRefPtr<IDBTransactionBackendImpl> transaction)
 {
     IDB_TRACE("IDBObjectStoreBackendImpl::setIndexesReadyInternal");
-    OwnPtr<Vector<String> > indexNames = popIndexNames;
-    for (size_t i = 0; i < indexNames->size(); ++i)
+    OwnPtr<Vector<int64_t> > indexIds = popIndexIds;
+    for (size_t i = 0; i < indexIds->size(); ++i)
         transaction->didCompletePreemptiveEvent();
     transaction->didCompleteTaskEvents();
 }
 
-void IDBObjectStoreBackendImpl::putInternal(ScriptExecutionContext*, PassRefPtr<IDBObjectStoreBackendImpl> objectStore, PassRefPtr<SerializedScriptValue> prpValue, PassRefPtr<IDBKey> prpKey, PutMode putMode, PassRefPtr<IDBCallbacks> callbacks, PassRefPtr<IDBTransactionBackendImpl> prpTransaction, PassOwnPtr<Vector<String> > popIndexNames, PassOwnPtr<Vector<IndexKeys> > popIndexKeys)
+void IDBObjectStoreBackendImpl::putInternal(ScriptExecutionContext*, PassRefPtr<IDBObjectStoreBackendImpl> objectStore, PassRefPtr<SerializedScriptValue> prpValue, PassRefPtr<IDBKey> prpKey, PutMode putMode, PassRefPtr<IDBCallbacks> callbacks, PassRefPtr<IDBTransactionBackendImpl> prpTransaction, PassOwnPtr<Vector<int64> > popIndexIds, PassOwnPtr<Vector<IndexKeys> > popIndexKeys)
 {
     IDB_TRACE("IDBObjectStoreBackendImpl::putInternal");
     RefPtr<IDBTransactionBackendImpl> transaction = prpTransaction;
     ASSERT(transaction->mode() != IDBTransaction::READ_ONLY);
     RefPtr<SerializedScriptValue> value = prpValue;
     RefPtr<IDBKey> key = prpKey;
-    OwnPtr<Vector<String> > indexNames = popIndexNames;
+    OwnPtr<Vector<int64_t> > indexIds = popIndexIds;
     OwnPtr<Vector<IndexKeys> > indexKeys = popIndexKeys;
-    ASSERT(indexNames && indexKeys && indexNames->size() == indexKeys->size());
+    ASSERT(indexIds && indexKeys && indexIds->size() == indexKeys->size());
     const bool autoIncrement = objectStore->autoIncrement();
     bool keyWasGenerated = false;
 
@@ -325,7 +338,7 @@ void IDBObjectStoreBackendImpl::putInternal(ScriptExecutionContext*, PassRefPtr<
 
     Vector<OwnPtr<IndexWriter> > indexWriters;
     String errorMessage;
-    if (!makeIndexWriters(transaction, objectStore.get(), key, keyWasGenerated, *indexNames, *indexKeys, &indexWriters, &errorMessage)) {
+    if (!makeIndexWriters(transaction, objectStore.get(), key, keyWasGenerated, *indexIds, *indexKeys, &indexWriters, &errorMessage)) {
         callbacks->onError(IDBDatabaseError::create(IDBDatabaseException::CONSTRAINT_ERR, errorMessage));
         return;
     }
@@ -341,12 +354,7 @@ void IDBObjectStoreBackendImpl::putInternal(ScriptExecutionContext*, PassRefPtr<
 
     for (size_t i = 0; i < indexWriters.size(); ++i) {
         IndexWriter* indexWriter = indexWriters[i].get();
-        if (!indexWriter->writeIndexKeys(recordIdentifier.get(),
-                                         *objectStore->backingStore(),
-                                         transaction->backingStoreTransaction(),
-                                         objectStore->databaseId(),
-                                         objectStore->m_id,
-                                         objectStore->m_indexes.get(indexWriter->indexName())->id())) {
+        if (!indexWriter->writeIndexKeys(recordIdentifier.get(), *objectStore->backingStore(), transaction->backingStoreTransaction(), objectStore->databaseId(), objectStore->m_metadata.id)) {
 
             RefPtr<IDBDatabaseError> error = IDBDatabaseError::create(IDBDatabaseException::UNKNOWN_ERR, "Error writing data to stable storage.");
             callbacks->onError(error);
@@ -389,10 +397,7 @@ void IDBObjectStoreBackendImpl::deleteInternal(ScriptExecutionContext*, PassRefP
             recordIdentifier = backingStoreCursor->objectStoreRecordIdentifier();
 
             for (IDBObjectStoreBackendImpl::IndexMap::iterator it = objectStore->m_indexes.begin(); it != objectStore->m_indexes.end(); ++it) {
-                if (!it->value->hasValidId())
-                    continue; // The index object has been created, but does not exist in the database yet.
-
-                bool success = objectStore->backingStore()->deleteIndexDataForRecord(transaction->backingStoreTransaction(), objectStore->databaseId(), objectStore->id(), it->value->id(), recordIdentifier.get());
+                bool success = objectStore->backingStore()->deleteIndexDataForRecord(transaction->backingStoreTransaction(), objectStore->databaseId(), objectStore->id(), it->key, recordIdentifier.get());
                 ASSERT_UNUSED(success, success);
             }
 
@@ -429,15 +434,15 @@ void IDBObjectStoreBackendImpl::clearInternal(ScriptExecutionContext*, PassRefPt
 
 PassRefPtr<IDBIndexBackendInterface> IDBObjectStoreBackendImpl::createIndex(int64_t id, const String& name, const IDBKeyPath& keyPath, bool unique, bool multiEntry, IDBTransactionBackendInterface* transactionPtr, ExceptionCode& ec)
 {
-    ASSERT_WITH_MESSAGE(!m_indexes.contains(name), "Indexes already contain %s", name.utf8().data());
+    ASSERT_WITH_MESSAGE(!m_indexes.contains(id), "Indexes already contain %s", name.utf8().data());
 
-    RefPtr<IDBIndexBackendImpl> index = IDBIndexBackendImpl::create(m_database, this, id, name, keyPath, unique, multiEntry);
+    RefPtr<IDBIndexBackendImpl> index = IDBIndexBackendImpl::create(m_database, this, IDBIndexMetadata(name, id, keyPath, unique, multiEntry));
     ASSERT(index->name() == name);
 
     RefPtr<IDBTransactionBackendImpl> transaction = IDBTransactionBackendImpl::from(transactionPtr);
     ASSERT(transaction->mode() == IDBTransaction::VERSION_CHANGE);
-    ASSERT(id > m_maxIndexId);
-    m_maxIndexId = id;
+    ASSERT(id > m_metadata.maxIndexId);
+    m_metadata.maxIndexId = id;
 
     RefPtr<IDBObjectStoreBackendImpl> objectStore = this;
     if (!transaction->scheduleTask(
@@ -447,7 +452,7 @@ PassRefPtr<IDBIndexBackendInterface> IDBObjectStoreBackendImpl::createIndex(int6
         return 0;
     }
 
-    m_indexes.set(name, index);
+    m_indexes.set(id, index);
     return index.release();
 }
 
@@ -461,22 +466,42 @@ void IDBObjectStoreBackendImpl::createIndexInternal(ScriptExecutionContext*, Pas
     transaction->didCompleteTaskEvents();
 }
 
-PassRefPtr<IDBIndexBackendInterface> IDBObjectStoreBackendImpl::index(const String& name, ExceptionCode& ec)
+PassRefPtr<IDBIndexBackendInterface> IDBObjectStoreBackendImpl::index(int64_t indexId)
 {
-    RefPtr<IDBIndexBackendInterface> index = m_indexes.get(name);
-    if (!index) {
-        ec = IDBDatabaseException::IDB_NOT_FOUND_ERR;
-        return 0;
-    }
+    RefPtr<IDBIndexBackendInterface> index = m_indexes.get(indexId);
+    ASSERT(index);
     return index.release();
 }
 
-void IDBObjectStoreBackendImpl::deleteIndex(const String& name, IDBTransactionBackendInterface* transactionPtr, ExceptionCode& ec)
+PassRefPtr<IDBIndexBackendInterface> IDBObjectStoreBackendImpl::index(const String& name, ExceptionCode&)
+{
+    return index(getIndexId(name));
+}
+
+int64_t IDBObjectStoreBackendImpl::getIndexId(const String& name)
 {
-    ASSERT(m_indexes.contains(name));
+    for (IndexMap::const_iterator it = m_indexes.begin(); it != m_indexes.end(); ++it) {
+        if (it->value->name() == name)
+            return it->key;
+    }
+    ASSERT_NOT_REACHED();
+    return 0;
+}
+
+Vector<int64_t> IDBObjectStoreBackendImpl::getIndexIds(const Vector<String>& names)
+{
+    Vector<int64_t> result;
+    for (size_t i = 0; i < names.size(); ++i)
+        result.append(getIndexId(names[i]));
+    return result;
+}
+
+void IDBObjectStoreBackendImpl::deleteIndex(int64_t indexId, IDBTransactionBackendInterface* transactionPtr, ExceptionCode& ec)
+{
+    ASSERT(m_indexes.contains(indexId));
 
     RefPtr<IDBObjectStoreBackendImpl> objectStore = this;
-    RefPtr<IDBIndexBackendImpl> index = m_indexes.get(name);
+    RefPtr<IDBIndexBackendImpl> index = m_indexes.get(indexId);
     RefPtr<IDBTransactionBackendImpl> transaction = IDBTransactionBackendImpl::from(transactionPtr);
     ASSERT(transaction->mode() == IDBTransaction::VERSION_CHANGE);
 
@@ -486,7 +511,12 @@ void IDBObjectStoreBackendImpl::deleteIndex(const String& name, IDBTransactionBa
         ec = IDBDatabaseException::TRANSACTION_INACTIVE_ERR;
         return;
     }
-    m_indexes.remove(name);
+    m_indexes.remove(indexId);
+}
+
+void IDBObjectStoreBackendImpl::deleteIndex(const String& name, IDBTransactionBackendInterface* transactionPtr, ExceptionCode& ec)
+{
+    return deleteIndex(getIndexId(name), transactionPtr, ec);
 }
 
 void IDBObjectStoreBackendImpl::deleteIndexInternal(ScriptExecutionContext*, PassRefPtr<IDBObjectStoreBackendImpl> objectStore, PassRefPtr<IDBIndexBackendImpl> index, PassRefPtr<IDBTransactionBackendImpl> transaction)
@@ -557,33 +587,23 @@ void IDBObjectStoreBackendImpl::countInternal(ScriptExecutionContext*, PassRefPt
 
 void IDBObjectStoreBackendImpl::loadIndexes()
 {
-    Vector<int64_t> ids;
-    Vector<String> names;
-    Vector<IDBKeyPath> keyPaths;
-    Vector<bool> uniqueFlags;
-    Vector<bool> multiEntryFlags;
-    backingStore()->getIndexes(databaseId(), m_id, ids, names, keyPaths, uniqueFlags, multiEntryFlags);
+    Vector<IDBIndexMetadata> indexes = backingStore()->getIndexes(databaseId(), m_metadata.id);
 
-    ASSERT(names.size() == ids.size());
-    ASSERT(keyPaths.size() == ids.size());
-    ASSERT(uniqueFlags.size() == ids.size());
-    ASSERT(multiEntryFlags.size() == ids.size());
-
-    for (size_t i = 0; i < ids.size(); ++i)
-        m_indexes.set(names[i], IDBIndexBackendImpl::create(m_database, this, ids[i], names[i], keyPaths[i], uniqueFlags[i], multiEntryFlags[i]));
+    for (size_t i = 0; i < indexes.size(); ++i)
+        m_indexes.set(indexes[i].id, IDBIndexBackendImpl::create(m_database, this, indexes[i]));
 }
 
 void IDBObjectStoreBackendImpl::removeIndexFromMap(ScriptExecutionContext*, PassRefPtr<IDBObjectStoreBackendImpl> objectStore, PassRefPtr<IDBIndexBackendImpl> index)
 {
-    ASSERT(objectStore->m_indexes.contains(index->name()));
-    objectStore->m_indexes.remove(index->name());
+    ASSERT(objectStore->m_indexes.contains(index->id()));
+    objectStore->m_indexes.remove(index->id());
 }
 
 void IDBObjectStoreBackendImpl::addIndexToMap(ScriptExecutionContext*, PassRefPtr<IDBObjectStoreBackendImpl> objectStore, PassRefPtr<IDBIndexBackendImpl> index)
 {
     RefPtr<IDBIndexBackendImpl> indexPtr = index;
-    ASSERT(!objectStore->m_indexes.contains(indexPtr->name()));
-    objectStore->m_indexes.set(indexPtr->name(), indexPtr);
+    ASSERT(!objectStore->m_indexes.contains(indexPtr->id()));
+    objectStore->m_indexes.set(indexPtr->id(), indexPtr);
 }
 
 PassRefPtr<IDBKey> IDBObjectStoreBackendImpl::generateKey(PassRefPtr<IDBTransactionBackendImpl> transaction)
@@ -602,7 +622,6 @@ void IDBObjectStoreBackendImpl::updateKeyGenerator(PassRefPtr<IDBTransactionBack
     backingStore()->maybeUpdateKeyGeneratorCurrentNumber(transaction->backingStoreTransaction(), databaseId(), id(), static_cast<int64_t>(floor(key->number())) + 1, checkCurrent);
 }
 
-
 } // namespace WebCore
 
 #endif
diff --git a/Source/WebCore/Modules/indexeddb/IDBObjectStoreBackendImpl.h b/Source/WebCore/Modules/indexeddb/IDBObjectStoreBackendImpl.h
index 08ee01ea3..c2efd3b0e 100644
--- a/Source/WebCore/Modules/indexeddb/IDBObjectStoreBackendImpl.h
+++ b/Source/WebCore/Modules/indexeddb/IDBObjectStoreBackendImpl.h
@@ -47,33 +47,38 @@ struct IDBObjectStoreMetadata;
 
 class IDBObjectStoreBackendImpl : public IDBObjectStoreBackendInterface {
 public:
-    static PassRefPtr<IDBObjectStoreBackendImpl> create(const IDBDatabaseBackendImpl* database, int64_t id, const String& name, const IDBKeyPath& keyPath, bool autoIncrement, int64_t maxIndexId)
+    static PassRefPtr<IDBObjectStoreBackendImpl> create(const IDBDatabaseBackendImpl* database, const IDBObjectStoreMetadata& metadata)
     {
-        return adoptRef(new IDBObjectStoreBackendImpl(database, id, name, keyPath, autoIncrement, maxIndexId));
+        return adoptRef(new IDBObjectStoreBackendImpl(database, metadata));
     }
     virtual ~IDBObjectStoreBackendImpl();
 
-    typedef HashMap<String, RefPtr<IDBIndexBackendImpl> > IndexMap;
-    
+    typedef HashMap<int64_t, RefPtr<IDBIndexBackendImpl> > IndexMap;
+
     static const int64_t InvalidId = 0;
     int64_t id() const
     {
-        ASSERT(m_id != InvalidId);
-        return m_id;
+        ASSERT(m_metadata.id != InvalidId);
+        return m_metadata.id;
     }
-    void setId(int64_t id) { m_id = id; }
 
     // IDBObjectStoreBackendInterface
     virtual void get(PassRefPtr<IDBKeyRange>, PassRefPtr<IDBCallbacks>, IDBTransactionBackendInterface*, ExceptionCode&);
     virtual void putWithIndexKeys(PassRefPtr<SerializedScriptValue>, PassRefPtr<IDBKey>, PutMode, PassRefPtr<IDBCallbacks>, IDBTransactionBackendInterface*, const Vector<String>&, const Vector<IndexKeys>&, ExceptionCode&);
+    virtual void put(PassRefPtr<SerializedScriptValue>, PassRefPtr<IDBKey>, PutMode, PassRefPtr<IDBCallbacks>, IDBTransactionBackendInterface*, const Vector<int64_t>&, const Vector<IndexKeys>&);
+
     virtual void deleteFunction(PassRefPtr<IDBKeyRange>, PassRefPtr<IDBCallbacks>, IDBTransactionBackendInterface*, ExceptionCode&);
     virtual void clear(PassRefPtr<IDBCallbacks>, IDBTransactionBackendInterface*, ExceptionCode&);
 
     virtual PassRefPtr<IDBIndexBackendInterface> createIndex(int64_t, const String& name, const IDBKeyPath&, bool unique, bool multiEntry, IDBTransactionBackendInterface*, ExceptionCode&);
-    virtual void setIndexKeys(PassRefPtr<IDBKey> prpPrimaryKey, const Vector<String>&, const Vector<IndexKeys>& , IDBTransactionBackendInterface*);
+    virtual void setIndexKeys(PassRefPtr<IDBKey> prpPrimaryKey, const Vector<String>&, const Vector<IndexKeys>&, IDBTransactionBackendInterface*);
+    virtual void setIndexKeys(PassRefPtr<IDBKey> prpPrimaryKey, const Vector<int64_t>&, const Vector<IndexKeys>&, IDBTransactionBackendInterface*);
     virtual void setIndexesReady(const Vector<String>&, IDBTransactionBackendInterface*);
+    virtual void setIndexesReady(const Vector<int64_t>&, IDBTransactionBackendInterface*);
     virtual PassRefPtr<IDBIndexBackendInterface> index(const String& name, ExceptionCode&);
+    virtual PassRefPtr<IDBIndexBackendInterface> index(int64_t);
     virtual void deleteIndex(const String& name, IDBTransactionBackendInterface*, ExceptionCode&);
+    virtual void deleteIndex(int64_t, IDBTransactionBackendInterface*, ExceptionCode&);
 
     virtual void openCursor(PassRefPtr<IDBKeyRange>, IDBCursor::Direction, PassRefPtr<IDBCallbacks>, IDBTransactionBackendInterface::TaskType, IDBTransactionBackendInterface*, ExceptionCode&);
     virtual void count(PassRefPtr<IDBKeyRange>, PassRefPtr<IDBCallbacks>, IDBTransactionBackendInterface*, ExceptionCode&);
@@ -84,24 +89,27 @@ public:
     const IndexMap::iterator iterIndexesEnd() { return m_indexes.end(); };
 
     IDBObjectStoreMetadata metadata() const;
-    const String& name() { return m_name; }
-    const IDBKeyPath& keyPath() const { return m_keyPath; }
-    const bool& autoIncrement() const { return m_autoIncrement; }
-    
+    const String& name() { return m_metadata.name; }
+    const IDBKeyPath& keyPath() const { return m_metadata.keyPath; }
+    const bool& autoIncrement() const { return m_metadata.autoIncrement; }
+
     PassRefPtr<IDBBackingStore> backingStore() const { return m_database->backingStore(); }
     int64_t databaseId() const { return m_database->id(); }
-    
+
+    int64_t getIndexId(const String&);
+    Vector<int64_t> getIndexIds(const Vector<String>&);
+
 private:
-    IDBObjectStoreBackendImpl(const IDBDatabaseBackendImpl*, int64_t id, const String& name, const IDBKeyPath&, bool autoIncrement, int64_t maxIndexId);
+    IDBObjectStoreBackendImpl(const IDBDatabaseBackendImpl*, const IDBObjectStoreMetadata&);
 
     void loadIndexes();
     PassRefPtr<IDBKey> generateKey(PassRefPtr<IDBTransactionBackendImpl>);
     void updateKeyGenerator(PassRefPtr<IDBTransactionBackendImpl>, const IDBKey*, bool checkCurrent);
 
     static void getInternal(ScriptExecutionContext*, PassRefPtr<IDBObjectStoreBackendImpl>, PassRefPtr<IDBKeyRange>, PassRefPtr<IDBCallbacks>, PassRefPtr<IDBTransactionBackendImpl>);
-    static void putInternal(ScriptExecutionContext*, PassRefPtr<IDBObjectStoreBackendImpl>, PassRefPtr<SerializedScriptValue>, PassRefPtr<IDBKey>, PutMode, PassRefPtr<IDBCallbacks>, PassRefPtr<IDBTransactionBackendImpl>, PassOwnPtr<Vector<String> > popIndexNames, PassOwnPtr<Vector<IndexKeys> >);
+    static void putInternal(ScriptExecutionContext*, PassRefPtr<IDBObjectStoreBackendImpl>, PassRefPtr<SerializedScriptValue>, PassRefPtr<IDBKey>, PutMode, PassRefPtr<IDBCallbacks>, PassRefPtr<IDBTransactionBackendImpl>, PassOwnPtr<Vector<int64_t> > popIndexNames, PassOwnPtr<Vector<IndexKeys> >);
     static void deleteInternal(ScriptExecutionContext*, PassRefPtr<IDBObjectStoreBackendImpl>, PassRefPtr<IDBKeyRange>, PassRefPtr<IDBCallbacks>, PassRefPtr<IDBTransactionBackendImpl>);
-    static void setIndexesReadyInternal(ScriptExecutionContext*, PassRefPtr<IDBObjectStoreBackendImpl>, PassOwnPtr<Vector<String> > popIndexNames, PassRefPtr<IDBTransactionBackendImpl>);
+    static void setIndexesReadyInternal(ScriptExecutionContext*, PassRefPtr<IDBObjectStoreBackendImpl>, PassOwnPtr<Vector<int64_t> > popIndexNames, PassRefPtr<IDBTransactionBackendImpl>);
     static void clearInternal(ScriptExecutionContext*, PassRefPtr<IDBObjectStoreBackendImpl>, PassRefPtr<IDBCallbacks>, PassRefPtr<IDBTransactionBackendImpl>);
     static void createIndexInternal(ScriptExecutionContext*, PassRefPtr<IDBObjectStoreBackendImpl>, PassRefPtr<IDBIndexBackendImpl>, PassRefPtr<IDBTransactionBackendImpl>);
     static void deleteIndexInternal(ScriptExecutionContext*, PassRefPtr<IDBObjectStoreBackendImpl>, PassRefPtr<IDBIndexBackendImpl>, PassRefPtr<IDBTransactionBackendImpl>);
@@ -113,12 +121,8 @@ private:
     static void addIndexToMap(ScriptExecutionContext*, PassRefPtr<IDBObjectStoreBackendImpl>, PassRefPtr<IDBIndexBackendImpl>);
 
     const IDBDatabaseBackendImpl* m_database;
-    int64_t m_id;
-    String m_name;
-    IDBKeyPath m_keyPath;
-    bool m_autoIncrement;
-    int64_t m_maxIndexId;
 
+    IDBObjectStoreMetadata m_metadata;
     IndexMap m_indexes;
 };
 
diff --git a/Source/WebCore/Modules/indexeddb/IDBObjectStoreBackendInterface.h b/Source/WebCore/Modules/indexeddb/IDBObjectStoreBackendInterface.h
index c6ea13c50..9abe883cb 100644
--- a/Source/WebCore/Modules/indexeddb/IDBObjectStoreBackendInterface.h
+++ b/Source/WebCore/Modules/indexeddb/IDBObjectStoreBackendInterface.h
@@ -63,16 +63,22 @@ public:
     typedef Vector<RefPtr<IDBKey> > IndexKeys;
 
     virtual void putWithIndexKeys(PassRefPtr<SerializedScriptValue>, PassRefPtr<IDBKey>, PutMode, PassRefPtr<IDBCallbacks>, IDBTransactionBackendInterface*, const Vector<String>&, const Vector<IndexKeys>&, ExceptionCode&) = 0;
+    virtual void put(PassRefPtr<SerializedScriptValue>, PassRefPtr<IDBKey>, PutMode, PassRefPtr<IDBCallbacks>, IDBTransactionBackendInterface*, const Vector<int64_t>&, const Vector<IndexKeys>&) = 0;
     virtual void deleteFunction(PassRefPtr<IDBKeyRange>, PassRefPtr<IDBCallbacks>, IDBTransactionBackendInterface*, ExceptionCode&) = 0;
 
     virtual void clear(PassRefPtr<IDBCallbacks>, IDBTransactionBackendInterface*, ExceptionCode&) = 0;
 
     virtual PassRefPtr<IDBIndexBackendInterface> createIndex(int64_t, const String& name, const IDBKeyPath&, bool unique, bool multiEntry, IDBTransactionBackendInterface*, ExceptionCode&) = 0;
     virtual void setIndexKeys(PassRefPtr<IDBKey> prpPrimaryKey, const Vector<String>&, const Vector<IndexKeys>&, IDBTransactionBackendInterface*) = 0;
+    virtual void setIndexKeys(PassRefPtr<IDBKey> prpPrimaryKey, const Vector<int64_t>&, const Vector<IndexKeys>&, IDBTransactionBackendInterface*) = 0;
     virtual void setIndexesReady(const Vector<String>&, IDBTransactionBackendInterface*) = 0;
+    virtual void setIndexesReady(const Vector<int64_t>&, IDBTransactionBackendInterface*) = 0;
     virtual PassRefPtr<IDBIndexBackendInterface> index(const String& name, ExceptionCode&) = 0;
+    virtual PassRefPtr<IDBIndexBackendInterface> index(int64_t) = 0;
     virtual void deleteIndex(const String& name, IDBTransactionBackendInterface*, ExceptionCode&) = 0;
 
+    virtual void deleteIndex(int64_t, IDBTransactionBackendInterface*, ExceptionCode&) = 0;
+
     virtual void openCursor(PassRefPtr<IDBKeyRange>, IDBCursor::Direction, PassRefPtr<IDBCallbacks>, IDBTransactionBackendInterface::TaskType, IDBTransactionBackendInterface*, ExceptionCode&) = 0;
     virtual void count(PassRefPtr<IDBKeyRange>, PassRefPtr<IDBCallbacks>, IDBTransactionBackendInterface*, ExceptionCode&) = 0;
 };
diff --git a/Source/WebCore/Modules/indexeddb/IDBOpenDBRequest.cpp b/Source/WebCore/Modules/indexeddb/IDBOpenDBRequest.cpp
index e070b8bd7..b23901619 100644
--- a/Source/WebCore/Modules/indexeddb/IDBOpenDBRequest.cpp
+++ b/Source/WebCore/Modules/indexeddb/IDBOpenDBRequest.cpp
@@ -89,7 +89,7 @@ void IDBOpenDBRequest::onUpgradeNeeded(int64_t oldVersion, PassRefPtr<IDBTransac
     m_databaseCallbacks->connect(idbDatabase.get());
     m_databaseCallbacks = 0;
 
-    RefPtr<IDBTransaction> frontend = IDBTransaction::create(scriptExecutionContext(), transactionBackend, IDBTransaction::VERSION_CHANGE, idbDatabase.get(), this);
+    RefPtr<IDBTransaction> frontend = IDBTransaction::create(scriptExecutionContext(), transactionBackend, Vector<String>(), IDBTransaction::VERSION_CHANGE, idbDatabase.get(), this);
     transactionBackend->setCallbacks(frontend.get());
     m_transaction = frontend;
     m_result = IDBAny::create(idbDatabase.release());
diff --git a/Source/WebCore/Modules/indexeddb/IDBRequest.cpp b/Source/WebCore/Modules/indexeddb/IDBRequest.cpp
index 0b502d742..7046a24da 100644
--- a/Source/WebCore/Modules/indexeddb/IDBRequest.cpp
+++ b/Source/WebCore/Modules/indexeddb/IDBRequest.cpp
@@ -42,6 +42,9 @@
 #include "IDBTracing.h"
 #include "IDBTransaction.h"
 #include "ScriptExecutionContext.h"
+#if USE(V8)
+#include "V8Binding.h"
+#endif
 
 namespace WebCore {
 
@@ -76,6 +79,9 @@ IDBRequest::IDBRequest(ScriptExecutionContext* context, PassRefPtr<IDBAny> sourc
     , m_pendingCursor(0)
     , m_didFireUpgradeNeededEvent(false)
     , m_preventPropagation(false)
+#if USE(V8)
+    , m_worldContextHandle(UseCurrentWorld)
+#endif
 {
     if (m_transaction) {
         m_transaction->registerRequest(this);
@@ -284,6 +290,14 @@ void IDBRequest::onSuccess(PassRefPtr<IDBCursorBackendInterface> backend, PassRe
     if (!shouldEnqueueEvent())
         return;
 
+#if USE(V8)
+    v8::HandleScope handleScope;
+    v8::Local<v8::Context> context = toV8Context(scriptExecutionContext(), m_worldContextHandle);
+    if (context.IsEmpty())
+        CRASH();
+    v8::Context::Scope contextScope(context);
+#endif
+
     ScriptValue value = deserializeIDBValue(scriptExecutionContext(), serializedValue);
     ASSERT(m_cursorType != IDBCursorBackendInterface::InvalidCursorType);
     RefPtr<IDBCursor> cursor;
@@ -323,7 +337,7 @@ void IDBRequest::onSuccess(PassRefPtr<IDBTransactionBackendInterface> prpBackend
     if (!shouldEnqueueEvent())
         return;
 
-    RefPtr<IDBTransaction> frontend = IDBTransaction::create(scriptExecutionContext(), backend, IDBTransaction::VERSION_CHANGE, m_source->idbDatabase().get());
+    RefPtr<IDBTransaction> frontend = IDBTransaction::create(scriptExecutionContext(), backend, Vector<String>(), IDBTransaction::VERSION_CHANGE, m_source->idbDatabase().get());
     backend->setCallbacks(frontend.get());
     m_transaction = frontend;
 
@@ -340,6 +354,14 @@ void IDBRequest::onSuccess(PassRefPtr<SerializedScriptValue> serializedScriptVal
     if (!shouldEnqueueEvent())
         return;
 
+#if USE(V8)
+    v8::HandleScope handleScope;
+    v8::Local<v8::Context> context = toV8Context(scriptExecutionContext(), m_worldContextHandle);
+    if (context.IsEmpty())
+        CRASH();
+    v8::Context::Scope contextScope(context);
+#endif
+
     ScriptValue value = deserializeIDBValue(scriptExecutionContext(), serializedScriptValue);
     onSuccessInternal(value);
 }
@@ -363,6 +385,14 @@ void IDBRequest::onSuccess(PassRefPtr<SerializedScriptValue> prpSerializedScript
     if (!shouldEnqueueEvent())
         return;
 
+#if USE(V8)
+    v8::HandleScope handleScope;
+    v8::Local<v8::Context> context = toV8Context(scriptExecutionContext(), m_worldContextHandle);
+    if (context.IsEmpty())
+        CRASH();
+    v8::Context::Scope contextScope(context);
+#endif
+
 #ifndef NDEBUG
     ASSERT(keyPath == effectiveObjectStore(m_source)->keyPath());
 #endif
@@ -404,6 +434,14 @@ void IDBRequest::onSuccess(PassRefPtr<IDBKey> key, PassRefPtr<IDBKey> primaryKey
     if (!shouldEnqueueEvent())
         return;
 
+#if USE(V8)
+    v8::HandleScope handleScope;
+    v8::Local<v8::Context> context = toV8Context(scriptExecutionContext(), m_worldContextHandle);
+    if (context.IsEmpty())
+        CRASH();
+    v8::Context::Scope contextScope(context);
+#endif
+
     ScriptValue value = deserializeIDBValue(scriptExecutionContext(), serializedValue);
     ASSERT(m_pendingCursor);
     setResultCursor(m_pendingCursor.release(), key, primaryKey, value);
@@ -449,6 +487,15 @@ bool IDBRequest::dispatchEvent(PassRefPtr<Event> event)
     ASSERT(scriptExecutionContext());
     ASSERT(event->target() == this);
     ASSERT_WITH_MESSAGE(m_readyState < DONE, "When dispatching event %s, m_readyState < DONE(%d), was %d", event->type().string().utf8().data(), DONE, m_readyState);
+
+#if USE(V8)
+    v8::HandleScope handleScope;
+    v8::Local<v8::Context> context = toV8Context(scriptExecutionContext(), m_worldContextHandle);
+    if (context.IsEmpty())
+        CRASH();
+    v8::Context::Scope contextScope(context);
+#endif
+
     if (event->type() != eventNames().blockedEvent)
         m_readyState = DONE;
 
@@ -472,8 +519,10 @@ bool IDBRequest::dispatchEvent(PassRefPtr<Event> event)
     RefPtr<IDBCursor> cursorToNotify;
     if (event->type() == eventNames().successEvent) {
         cursorToNotify = getResultCursor();
-        if (cursorToNotify)
-            cursorToNotify->setValueReady(m_cursorKey.release(), m_cursorPrimaryKey.release(), m_cursorValue);
+        if (cursorToNotify) {
+            cursorToNotify->setValueReady(scriptExecutionContext(), m_cursorKey.release(), m_cursorPrimaryKey.release(), m_cursorValue);
+            m_cursorValue.clear();
+        }
     }
 
     if (event->type() == eventNames().upgradeneededEvent) {
@@ -519,7 +568,7 @@ void IDBRequest::uncaughtExceptionInEventHandler()
 {
     if (m_transaction && !m_requestAborted) {
         m_transaction->setError(DOMError::create(IDBDatabaseException::getErrorName(IDBDatabaseException::IDB_ABORT_ERR)));
-        ExceptionCode unused; 
+        ExceptionCode unused;
         m_transaction->abort(unused);
     }
 }
diff --git a/Source/WebCore/Modules/indexeddb/IDBRequest.h b/Source/WebCore/Modules/indexeddb/IDBRequest.h
index 899783853..e0359cd39 100644
--- a/Source/WebCore/Modules/indexeddb/IDBRequest.h
+++ b/Source/WebCore/Modules/indexeddb/IDBRequest.h
@@ -42,6 +42,9 @@
 #include "IDBCallbacks.h"
 #include "IDBCursor.h"
 #include "IDBCursorBackendInterface.h"
+#if USE(V8)
+#include "WorldContextHandle.h"
+#endif
 
 namespace WebCore {
 
@@ -155,6 +158,9 @@ private:
     bool m_preventPropagation;
 
     EventTargetData m_eventTargetData;
+#if USE(V8)
+    WorldContextHandle m_worldContextHandle;
+#endif
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/Modules/indexeddb/IDBTransaction.cpp b/Source/WebCore/Modules/indexeddb/IDBTransaction.cpp
index 8ec15e5ec..47005c3b7 100644
--- a/Source/WebCore/Modules/indexeddb/IDBTransaction.cpp
+++ b/Source/WebCore/Modules/indexeddb/IDBTransaction.cpp
@@ -44,15 +44,15 @@
 
 namespace WebCore {
 
-PassRefPtr<IDBTransaction> IDBTransaction::create(ScriptExecutionContext* context, PassRefPtr<IDBTransactionBackendInterface> backend, IDBTransaction::Mode mode, IDBDatabase* db)
+PassRefPtr<IDBTransaction> IDBTransaction::create(ScriptExecutionContext* context, PassRefPtr<IDBTransactionBackendInterface> backend, const Vector<String>& objectStoreNames, IDBTransaction::Mode mode, IDBDatabase* db)
 {
     IDBOpenDBRequest* openDBRequest = 0;
-    return create(context, backend, mode, db, openDBRequest);
+    return create(context, backend, objectStoreNames, mode, db, openDBRequest);
 }
 
-PassRefPtr<IDBTransaction> IDBTransaction::create(ScriptExecutionContext* context, PassRefPtr<IDBTransactionBackendInterface> backend, IDBTransaction::Mode mode, IDBDatabase* db, IDBOpenDBRequest* openDBRequest)
+PassRefPtr<IDBTransaction> IDBTransaction::create(ScriptExecutionContext* context, PassRefPtr<IDBTransactionBackendInterface> backend, const Vector<String>& objectStoreNames, IDBTransaction::Mode mode, IDBDatabase* db, IDBOpenDBRequest* openDBRequest)
 {
-    RefPtr<IDBTransaction> transaction(adoptRef(new IDBTransaction(context, backend, mode, db, openDBRequest)));
+    RefPtr<IDBTransaction> transaction(adoptRef(new IDBTransaction(context, backend, objectStoreNames, mode, db, openDBRequest)));
     transaction->suspendIfNeeded();
     return transaction.release();
 }
@@ -88,10 +88,11 @@ const AtomicString& IDBTransaction::modeReadWriteLegacy()
 }
 
 
-IDBTransaction::IDBTransaction(ScriptExecutionContext* context, PassRefPtr<IDBTransactionBackendInterface> backend, IDBTransaction::Mode mode, IDBDatabase* db, IDBOpenDBRequest* openDBRequest)
+IDBTransaction::IDBTransaction(ScriptExecutionContext* context, PassRefPtr<IDBTransactionBackendInterface> backend, const Vector<String>& objectStoreNames, IDBTransaction::Mode mode, IDBDatabase* db, IDBOpenDBRequest* openDBRequest)
     : ActiveDOMObject(context, this)
     , m_backend(backend)
     , m_database(db)
+    , m_objectStoreNames(objectStoreNames)
     , m_openDBRequest(openDBRequest)
     , m_mode(mode)
     , m_active(true)
@@ -155,16 +156,19 @@ PassRefPtr<IDBObjectStore> IDBTransaction::objectStore(const String& name, Excep
     if (it != m_objectStoreMap.end())
         return it->value;
 
-    RefPtr<IDBObjectStoreBackendInterface> objectStoreBackend = m_backend->objectStore(name, ec);
-    ASSERT(!objectStoreBackend != !ec); // If we didn't get a store, we should have gotten an exception code. And vice versa.
-    if (ec)
+    if (!isVersionChange() && !m_objectStoreNames.contains(name)) {
+        ec = IDBDatabaseException::IDB_NOT_FOUND_ERR;
         return 0;
+    }
+    RefPtr<IDBObjectStoreBackendInterface> objectStoreBackend = m_backend->objectStore(name, ec);
+    ASSERT(!ec && objectStoreBackend);
 
     const IDBDatabaseMetadata& metadata = m_database->metadata();
-    IDBDatabaseMetadata::ObjectStoreMap::const_iterator mdit = metadata.objectStores.find(name);
-    ASSERT(mdit != metadata.objectStores.end());
+    int64_t objectStoreId = metadata.findObjectStore(name);
+
+    ASSERT(objectStoreId != IDBObjectStoreMetadata::InvalidId);
 
-    RefPtr<IDBObjectStore> objectStore = IDBObjectStore::create(mdit->value, objectStoreBackend, this);
+    RefPtr<IDBObjectStore> objectStore = IDBObjectStore::create(metadata.objectStores.get(objectStoreId), objectStoreBackend, this);
     objectStoreCreated(name, objectStore);
     return objectStore.release();
 }
diff --git a/Source/WebCore/Modules/indexeddb/IDBTransaction.h b/Source/WebCore/Modules/indexeddb/IDBTransaction.h
index 89939bf85..cb8f0b9c0 100644
--- a/Source/WebCore/Modules/indexeddb/IDBTransaction.h
+++ b/Source/WebCore/Modules/indexeddb/IDBTransaction.h
@@ -30,7 +30,6 @@
 
 #include "ActiveDOMObject.h"
 #include "DOMError.h"
-#include "DOMStringList.h"
 #include "Event.h"
 #include "EventListener.h"
 #include "EventNames.h"
@@ -56,8 +55,8 @@ public:
         VERSION_CHANGE = 2
     };
 
-    static PassRefPtr<IDBTransaction> create(ScriptExecutionContext*, PassRefPtr<IDBTransactionBackendInterface>, Mode, IDBDatabase*);
-    static PassRefPtr<IDBTransaction> create(ScriptExecutionContext*, PassRefPtr<IDBTransactionBackendInterface>, Mode, IDBDatabase*, IDBOpenDBRequest*);
+    static PassRefPtr<IDBTransaction> create(ScriptExecutionContext*, PassRefPtr<IDBTransactionBackendInterface>, const Vector<String>& objectStoreNames, Mode, IDBDatabase*);
+    static PassRefPtr<IDBTransaction> create(ScriptExecutionContext*, PassRefPtr<IDBTransactionBackendInterface>, const Vector<String>& objectStoreNames, Mode, IDBDatabase*, IDBOpenDBRequest*);
     virtual ~IDBTransaction();
 
     static const AtomicString& modeReadOnly();
@@ -122,7 +121,7 @@ public:
     using RefCounted<IDBTransactionCallbacks>::deref;
 
 private:
-    IDBTransaction(ScriptExecutionContext*, PassRefPtr<IDBTransactionBackendInterface>, Mode, IDBDatabase*, IDBOpenDBRequest*);
+    IDBTransaction(ScriptExecutionContext*, PassRefPtr<IDBTransactionBackendInterface>, const Vector<String>&, Mode, IDBDatabase*, IDBOpenDBRequest*);
 
     void enqueueEvent(PassRefPtr<Event>);
     void closeOpenCursors();
@@ -145,6 +144,7 @@ private:
 
     RefPtr<IDBTransactionBackendInterface> m_backend;
     RefPtr<IDBDatabase> m_database;
+    const Vector<String> m_objectStoreNames;
     IDBOpenDBRequest* m_openDBRequest;
     const Mode m_mode;
     bool m_active;
diff --git a/Source/WebCore/Modules/indexeddb/IDBTransactionBackendImpl.cpp b/Source/WebCore/Modules/indexeddb/IDBTransactionBackendImpl.cpp
index f16651949..e1652d695 100644
--- a/Source/WebCore/Modules/indexeddb/IDBTransactionBackendImpl.cpp
+++ b/Source/WebCore/Modules/indexeddb/IDBTransactionBackendImpl.cpp
@@ -39,13 +39,13 @@
 
 namespace WebCore {
 
-PassRefPtr<IDBTransactionBackendImpl> IDBTransactionBackendImpl::create(DOMStringList* objectStores, unsigned short mode, IDBDatabaseBackendImpl* database)
+PassRefPtr<IDBTransactionBackendImpl> IDBTransactionBackendImpl::create(const Vector<int64_t>& objectStoreIds, unsigned short mode, IDBDatabaseBackendImpl* database)
 {
-    return adoptRef(new IDBTransactionBackendImpl(objectStores, mode, database));
+    return adoptRef(new IDBTransactionBackendImpl(objectStoreIds, mode, database));
 }
 
-IDBTransactionBackendImpl::IDBTransactionBackendImpl(DOMStringList* objectStores, unsigned short mode, IDBDatabaseBackendImpl* database)
-    : m_objectStoreNames(objectStores)
+IDBTransactionBackendImpl::IDBTransactionBackendImpl(const Vector<int64_t>& objectStoreIds, unsigned short mode, IDBDatabaseBackendImpl* database)
+    : m_objectStoreIds(objectStoreIds)
     , m_mode(mode)
     , m_state(Unused)
     , m_database(database)
@@ -55,8 +55,6 @@ IDBTransactionBackendImpl::IDBTransactionBackendImpl(DOMStringList* objectStores
     , m_pendingPreemptiveEvents(0)
     , m_pendingEvents(0)
 {
-    ASSERT(m_objectStoreNames);
-    ASSERT(m_mode == IDBTransaction::VERSION_CHANGE || !m_objectStoreNames->isEmpty());
     m_database->transactionCoordinator()->didCreateTransaction(this);
 }
 
@@ -66,31 +64,23 @@ IDBTransactionBackendImpl::~IDBTransactionBackendImpl()
     ASSERT(m_state == Finished);
 }
 
-PassRefPtr<IDBObjectStoreBackendInterface> IDBTransactionBackendImpl::objectStore(const String& name, ExceptionCode& ec)
+PassRefPtr<IDBObjectStoreBackendInterface> IDBTransactionBackendImpl::objectStore(int64_t id, ExceptionCode& ec)
 {
     if (m_state == Finished) {
         ec = IDBDatabaseException::IDB_INVALID_STATE_ERR;
         return 0;
     }
 
-    // Does a linear search, but it really shouldn't be that slow in practice.
-    if (m_mode != IDBTransaction::VERSION_CHANGE && !m_objectStoreNames->contains(name)) {
-        ec = IDBDatabaseException::IDB_NOT_FOUND_ERR;
-        return 0;
-    }
-
-    RefPtr<IDBObjectStoreBackendImpl> objectStore = m_database->objectStore(name);
-    // FIXME: This is only necessary right now beacuse a setVersion transaction could modify things
-    //        between its creation (where another check occurs) and the .objectStore call.
-    //        There's a bug to make this impossible in the spec. When we make it impossible here, we
-    //        can remove this check.
-    if (!objectStore) {
-        ec = IDBDatabaseException::IDB_NOT_FOUND_ERR;
-        return 0;
-    }
+    RefPtr<IDBObjectStoreBackendImpl> objectStore = m_database->objectStore(id);
+    ASSERT(objectStore);
     return objectStore.release();
 }
 
+PassRefPtr<IDBObjectStoreBackendInterface> IDBTransactionBackendImpl::objectStore(const String& name, ExceptionCode& ec)
+{
+    return objectStore(m_database->getObjectStoreId(name), ec);
+}
+
 bool IDBTransactionBackendImpl::scheduleTask(TaskType type, PassOwnPtr<ScriptExecutionContext::Task> task, PassOwnPtr<ScriptExecutionContext::Task> abortTask)
 {
     if (m_state == Finished)
@@ -100,7 +90,7 @@ bool IDBTransactionBackendImpl::scheduleTask(TaskType type, PassOwnPtr<ScriptExe
         m_taskQueue.append(task);
     else
         m_preemptiveTaskQueue.append(task);
-    
+
     if (abortTask)
         m_abortTaskQueue.prepend(abortTask);
 
diff --git a/Source/WebCore/Modules/indexeddb/IDBTransactionBackendImpl.h b/Source/WebCore/Modules/indexeddb/IDBTransactionBackendImpl.h
index 34a97570f..4e4ddecc1 100644
--- a/Source/WebCore/Modules/indexeddb/IDBTransactionBackendImpl.h
+++ b/Source/WebCore/Modules/indexeddb/IDBTransactionBackendImpl.h
@@ -28,7 +28,6 @@
 
 #if ENABLE(INDEXED_DATABASE)
 
-#include "DOMStringList.h"
 #include "IDBBackingStore.h"
 #include "IDBDatabaseError.h"
 #include "IDBTransactionBackendInterface.h"
@@ -45,7 +44,7 @@ class IDBDatabaseBackendImpl;
 
 class IDBTransactionBackendImpl : public IDBTransactionBackendInterface {
 public:
-    static PassRefPtr<IDBTransactionBackendImpl> create(DOMStringList* objectStores, unsigned short mode, IDBDatabaseBackendImpl*);
+    static PassRefPtr<IDBTransactionBackendImpl> create(const Vector<int64_t>&, unsigned short mode, IDBDatabaseBackendImpl*);
     static IDBTransactionBackendImpl* from(IDBTransactionBackendInterface* interface)
     {
         return static_cast<IDBTransactionBackendImpl*>(interface);
@@ -54,6 +53,7 @@ public:
 
     // IDBTransactionBackendInterface
     virtual PassRefPtr<IDBObjectStoreBackendInterface> objectStore(const String& name, ExceptionCode&);
+    virtual PassRefPtr<IDBObjectStoreBackendInterface> objectStore(int64_t, ExceptionCode&);
     virtual void didCompleteTaskEvents();
     virtual void abort();
     virtual void setCallbacks(IDBTransactionCallbacks* callbacks) { m_callbacks = callbacks; }
@@ -71,7 +71,7 @@ public:
     IDBBackingStore::Transaction* backingStoreTransaction() { return m_transaction.get(); }
 
 private:
-    IDBTransactionBackendImpl(DOMStringList* objectStores, unsigned short mode, IDBDatabaseBackendImpl*);
+    IDBTransactionBackendImpl(const Vector<int64_t>& objectStoreIds, unsigned short mode, IDBDatabaseBackendImpl*);
 
     enum State {
         Unused, // Created, but no tasks yet.
@@ -89,7 +89,7 @@ private:
     void taskEventTimerFired(Timer<IDBTransactionBackendImpl>*);
     void closeOpenCursors();
 
-    RefPtr<DOMStringList> m_objectStoreNames;
+    const Vector<int64_t> m_objectStoreIds;
     const unsigned short m_mode;
 
     State m_state;
diff --git a/Source/WebCore/Modules/indexeddb/IDBTransactionBackendInterface.h b/Source/WebCore/Modules/indexeddb/IDBTransactionBackendInterface.h
index f707f34a0..d11e1811c 100644
--- a/Source/WebCore/Modules/indexeddb/IDBTransactionBackendInterface.h
+++ b/Source/WebCore/Modules/indexeddb/IDBTransactionBackendInterface.h
@@ -54,6 +54,7 @@ public:
     };
 
     virtual PassRefPtr<IDBObjectStoreBackendInterface> objectStore(const String& name, ExceptionCode&) = 0;
+    virtual PassRefPtr<IDBObjectStoreBackendInterface> objectStore(int64_t, ExceptionCode&) = 0;
     virtual void didCompleteTaskEvents() = 0;
     virtual void commit() = 0;
     virtual void abort() = 0;
diff --git a/Source/WebCore/Modules/indexeddb/IDBTransactionCoordinator.h b/Source/WebCore/Modules/indexeddb/IDBTransactionCoordinator.h
index a75b7be14..e7b9fcafb 100644
--- a/Source/WebCore/Modules/indexeddb/IDBTransactionCoordinator.h
+++ b/Source/WebCore/Modules/indexeddb/IDBTransactionCoordinator.h
@@ -28,7 +28,6 @@
 
 #if ENABLE(INDEXED_DATABASE)
 
-#include "DOMStringList.h"
 #include "IDBTransactionBackendInterface.h"
 #include <wtf/ListHashSet.h>
 #include <wtf/RefPtr.h>
diff --git a/Source/WebCore/Modules/intents/DOMWindowIntents.idl b/Source/WebCore/Modules/intents/DOMWindowIntents.idl
index 766f5f930..262f80bb9 100644
--- a/Source/WebCore/Modules/intents/DOMWindowIntents.idl
+++ b/Source/WebCore/Modules/intents/DOMWindowIntents.idl
@@ -30,6 +30,6 @@
 ] interface DOMWindowIntents {
     attribute IntentConstructor WebKitIntent;
 
-    [Replaceable] attribute DeliveredIntent webkitIntent;
+    [Replaceable] readonly attribute DeliveredIntent webkitIntent;
 };
 
diff --git a/Source/WebCore/Modules/mediastream/RTCPeerConnection.cpp b/Source/WebCore/Modules/mediastream/RTCPeerConnection.cpp
index 8583517f8..4612e1fc8 100644
--- a/Source/WebCore/Modules/mediastream/RTCPeerConnection.cpp
+++ b/Source/WebCore/Modules/mediastream/RTCPeerConnection.cpp
@@ -134,6 +134,7 @@ RTCPeerConnection::RTCPeerConnection(ScriptExecutionContext* context, PassRefPtr
     , m_iceState(IceStateClosed)
     , m_localStreams(MediaStreamList::create())
     , m_remoteStreams(MediaStreamList::create())
+    , m_scheduledEventTimer(this, &RTCPeerConnection::scheduledEventTimerFired)
 {
     ASSERT(m_scriptExecutionContext->isDocument());
     Document* document = static_cast<Document*>(m_scriptExecutionContext);
@@ -441,17 +442,17 @@ void RTCPeerConnection::close(ExceptionCode& ec)
 
 void RTCPeerConnection::negotiationNeeded()
 {
-    dispatchEvent(Event::create(eventNames().negotiationneededEvent, false, false));
+    scheduleDispatchEvent(Event::create(eventNames().negotiationneededEvent, false, false));
 }
 
 void RTCPeerConnection::didGenerateIceCandidate(PassRefPtr<RTCIceCandidateDescriptor> iceCandidateDescriptor)
 {
     ASSERT(scriptExecutionContext()->isContextThread());
     if (!iceCandidateDescriptor)
-        dispatchEvent(RTCIceCandidateEvent::create(false, false, 0));
+        scheduleDispatchEvent(RTCIceCandidateEvent::create(false, false, 0));
     else {
         RefPtr<RTCIceCandidate> iceCandidate = RTCIceCandidate::create(iceCandidateDescriptor);
-        dispatchEvent(RTCIceCandidateEvent::create(false, false, iceCandidate.release()));
+        scheduleDispatchEvent(RTCIceCandidateEvent::create(false, false, iceCandidate.release()));
     }
 }
 
@@ -477,7 +478,7 @@ void RTCPeerConnection::didAddRemoteStream(PassRefPtr<MediaStreamDescriptor> str
     RefPtr<MediaStream> stream = MediaStream::create(scriptExecutionContext(), streamDescriptor);
     m_remoteStreams->append(stream);
 
-    dispatchEvent(MediaStreamEvent::create(eventNames().addstreamEvent, false, false, stream.release()));
+    scheduleDispatchEvent(MediaStreamEvent::create(eventNames().addstreamEvent, false, false, stream.release()));
 }
 
 void RTCPeerConnection::didRemoveRemoteStream(MediaStreamDescriptor* streamDescriptor)
@@ -494,7 +495,7 @@ void RTCPeerConnection::didRemoveRemoteStream(MediaStreamDescriptor* streamDescr
     ASSERT(m_remoteStreams->contains(stream.get()));
     m_remoteStreams->remove(stream.get());
 
-    dispatchEvent(MediaStreamEvent::create(eventNames().removestreamEvent, false, false, stream.release()));
+    scheduleDispatchEvent(MediaStreamEvent::create(eventNames().removestreamEvent, false, false, stream.release()));
 }
 
 void RTCPeerConnection::didAddRemoteDataChannel(PassRefPtr<RTCDataChannelDescriptor> channelDescriptor)
@@ -507,7 +508,7 @@ void RTCPeerConnection::didAddRemoteDataChannel(PassRefPtr<RTCDataChannelDescrip
     RefPtr<RTCDataChannel> channel = RTCDataChannel::create(scriptExecutionContext(), m_peerHandler.get(), channelDescriptor);
     m_dataChannels.append(channel);
 
-    dispatchEvent(RTCDataChannelEvent::create(eventNames().datachannelEvent, false, false, channel.release()));
+    scheduleDispatchEvent(RTCDataChannelEvent::create(eventNames().datachannelEvent, false, false, channel.release()));
 }
 
 const AtomicString& RTCPeerConnection::interfaceName() const
@@ -556,7 +557,7 @@ void RTCPeerConnection::changeReadyState(ReadyState readyState)
     case ReadyStateOpening:
         break;
     case ReadyStateActive:
-        dispatchEvent(Event::create(eventNames().openEvent, false, false));
+        scheduleDispatchEvent(Event::create(eventNames().openEvent, false, false));
         break;
     case ReadyStateClosing:
     case ReadyStateClosed:
@@ -566,7 +567,7 @@ void RTCPeerConnection::changeReadyState(ReadyState readyState)
         break;
     }
 
-    dispatchEvent(Event::create(eventNames().statechangeEvent, false, false));
+    scheduleDispatchEvent(Event::create(eventNames().statechangeEvent, false, false));
 }
 
 void RTCPeerConnection::changeIceState(IceState iceState)
@@ -575,7 +576,27 @@ void RTCPeerConnection::changeIceState(IceState iceState)
         return;
 
     m_iceState = iceState;
-    dispatchEvent(Event::create(eventNames().icechangeEvent, false, false));
+    scheduleDispatchEvent(Event::create(eventNames().icechangeEvent, false, false));
+}
+
+void RTCPeerConnection::scheduleDispatchEvent(PassRefPtr<Event> event)
+{
+    m_scheduledEvents.append(event);
+
+    if (!m_scheduledEventTimer.isActive())
+        m_scheduledEventTimer.startOneShot(0);
+}
+
+void RTCPeerConnection::scheduledEventTimerFired(Timer<RTCPeerConnection>*)
+{
+    Vector<RefPtr<Event> > events;
+    events.swap(m_scheduledEvents);
+
+    Vector<RefPtr<Event> >::iterator it = events.begin();
+    for (; it != events.end(); ++it)
+        dispatchEvent((*it).release());
+
+    events.clear();
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/Modules/mediastream/RTCPeerConnection.h b/Source/WebCore/Modules/mediastream/RTCPeerConnection.h
index c7f9b910f..dadc6aa96 100644
--- a/Source/WebCore/Modules/mediastream/RTCPeerConnection.h
+++ b/Source/WebCore/Modules/mediastream/RTCPeerConnection.h
@@ -42,6 +42,7 @@
 #include "RTCIceCandidate.h"
 #include "RTCPeerConnectionHandler.h"
 #include "RTCPeerConnectionHandlerClient.h"
+#include "Timer.h"
 #include <wtf/RefCounted.h>
 
 namespace WebCore {
@@ -125,6 +126,8 @@ private:
     RTCPeerConnection(ScriptExecutionContext*, PassRefPtr<RTCConfiguration>, PassRefPtr<MediaConstraints>, ExceptionCode&);
 
     static PassRefPtr<RTCConfiguration> parseConfiguration(const Dictionary& configuration, ExceptionCode&);
+    void scheduleDispatchEvent(PassRefPtr<Event>);
+    void scheduledEventTimerFired(Timer<RTCPeerConnection>*);
 
     // EventTarget implementation.
     virtual EventTargetData* eventTargetData();
@@ -145,6 +148,9 @@ private:
     Vector<RefPtr<RTCDataChannel> > m_dataChannels;
 
     OwnPtr<RTCPeerConnectionHandler> m_peerHandler;
+
+    Timer<RTCPeerConnection> m_scheduledEventTimer;
+    Vector<RefPtr<Event> > m_scheduledEvents;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/Modules/mediastream/RTCPeerConnection.idl b/Source/WebCore/Modules/mediastream/RTCPeerConnection.idl
index 4218243e4..81c628f74 100644
--- a/Source/WebCore/Modules/mediastream/RTCPeerConnection.idl
+++ b/Source/WebCore/Modules/mediastream/RTCPeerConnection.idl
@@ -31,15 +31,15 @@
 [
     Conditional=MEDIA_STREAM,
     ActiveDOMObject,
-    Constructor(in Dictionary rtcIceServers, in [Optional=DefaultIsUndefined] Dictionary mediaConstraints),
+    Constructor(in Dictionary rtcIceServers, in [Optional] Dictionary mediaConstraints),
     ConstructorRaisesException,
     CallWith=ScriptExecutionContext,
     EventTarget
 ] interface RTCPeerConnection {
-    void createOffer(in [Callback] RTCSessionDescriptionCallback successCallback, in [Callback,Optional=DefaultIsUndefined] RTCErrorCallback failureCallback, in [Optional=DefaultIsUndefined] Dictionary mediaConstraints)
+    void createOffer(in [Callback] RTCSessionDescriptionCallback successCallback, in [Callback,Optional=DefaultIsUndefined] RTCErrorCallback failureCallback, in [Optional] Dictionary mediaConstraints)
         raises(DOMException);
 
-    void createAnswer(in [Callback] RTCSessionDescriptionCallback successCallback, in [Callback, Optional=DefaultIsUndefined] RTCErrorCallback failureCallback, in [Optional=DefaultIsUndefined] Dictionary mediaConstraints)
+    void createAnswer(in [Callback] RTCSessionDescriptionCallback successCallback, in [Callback, Optional=DefaultIsUndefined] RTCErrorCallback failureCallback, in [Optional] Dictionary mediaConstraints)
         raises(DOMException);
 
     void setLocalDescription(in RTCSessionDescription description, in [Callback, Optional=DefaultIsUndefined] VoidCallback successCallback, in [Callback, Optional=DefaultIsUndefined] RTCErrorCallback failureCallback)
@@ -54,7 +54,7 @@
 
     readonly attribute DOMString readyState;
 
-    void updateIce(in [Optional=DefaultIsUndefined] Dictionary configuration, in [Optional=DefaultIsUndefined] Dictionary mediaConstraints)
+    void updateIce(in [Optional] Dictionary configuration, in [Optional] Dictionary mediaConstraints)
         raises(DOMException);
 
     void addIceCandidate(in RTCIceCandidate candidate)
@@ -65,14 +65,14 @@
     readonly attribute MediaStreamList localStreams;
     readonly attribute MediaStreamList remoteStreams;
 
-    [StrictTypeChecking] void addStream(in MediaStream stream, in [Optional=DefaultIsUndefined] Dictionary mediaConstraints)
+    [StrictTypeChecking] void addStream(in MediaStream stream, in [Optional] Dictionary mediaConstraints)
         raises(DOMException);
     [StrictTypeChecking] void removeStream(in MediaStream stream)
         raises(DOMException);
 
     void getStats(in [Callback] RTCStatsCallback successCallback, in [Optional=DefaultIsUndefined] MediaStreamTrack selector);
 
-    RTCDataChannel createDataChannel(in [TreatNullAs=NullString, TreatUndefinedAs=NullString] DOMString label, in [Optional=DefaultIsUndefined] Dictionary options)
+    RTCDataChannel createDataChannel(in [TreatNullAs=NullString, TreatUndefinedAs=NullString] DOMString label, in [Optional] Dictionary options)
          raises(DOMException);
 
     void close()
diff --git a/Source/WebCore/Modules/webaudio/AudioBufferSourceNode.cpp b/Source/WebCore/Modules/webaudio/AudioBufferSourceNode.cpp
index e52ace462..649b7e243 100644
--- a/Source/WebCore/Modules/webaudio/AudioBufferSourceNode.cpp
+++ b/Source/WebCore/Modules/webaudio/AudioBufferSourceNode.cpp
@@ -58,6 +58,8 @@ AudioBufferSourceNode::AudioBufferSourceNode(AudioContext* context, float sample
     : AudioScheduledSourceNode(context, sampleRate)
     , m_buffer(0)
     , m_isLooping(false)
+    , m_loopStart(0)
+    , m_loopEnd(0)
     , m_virtualReadIndex(0)
     , m_isGrain(false)
     , m_grainOffset(0.0)
@@ -116,7 +118,10 @@ void AudioBufferSourceNode::process(size_t framesToProcess)
             m_destinationChannels[i] = outputBus->channel(i)->mutableData();
 
         // Render by reading directly from the buffer.
-        renderFromBuffer(outputBus, quantumFrameOffset, bufferFramesToProcess);
+        if (!renderFromBuffer(outputBus, quantumFrameOffset, bufferFramesToProcess)) {
+            outputBus->zero();
+            return;
+        }
 
         // Apply the gain (in-place) to the output bus.
         float totalGain = gain()->value() * m_buffer->gain();
@@ -147,7 +152,7 @@ bool AudioBufferSourceNode::renderSilenceAndFinishIfNotLooping(AudioBus*, unsign
     return false;
 }
 
-void AudioBufferSourceNode::renderFromBuffer(AudioBus* bus, unsigned destinationFrameOffset, size_t numberOfFrames)
+bool AudioBufferSourceNode::renderFromBuffer(AudioBus* bus, unsigned destinationFrameOffset, size_t numberOfFrames)
 {
     ASSERT(context()->isAudioThread());
     
@@ -155,7 +160,7 @@ void AudioBufferSourceNode::renderFromBuffer(AudioBus* bus, unsigned destination
     ASSERT(bus);
     ASSERT(buffer());
     if (!bus || !buffer())
-        return;
+        return false;
 
     unsigned numberOfChannels = this->numberOfChannels();
     unsigned busNumberOfChannels = bus->numberOfChannels();
@@ -163,7 +168,7 @@ void AudioBufferSourceNode::renderFromBuffer(AudioBus* bus, unsigned destination
     bool channelCountGood = numberOfChannels && numberOfChannels == busNumberOfChannels;
     ASSERT(channelCountGood);
     if (!channelCountGood)
-        return;
+        return false;
 
     // Sanity check destinationFrameOffset, numberOfFrames.
     size_t destinationLength = bus->length();
@@ -171,12 +176,12 @@ void AudioBufferSourceNode::renderFromBuffer(AudioBus* bus, unsigned destination
     bool isLengthGood = destinationLength <= 4096 && numberOfFrames <= 4096;
     ASSERT(isLengthGood);
     if (!isLengthGood)
-        return;
+        return false;
 
     bool isOffsetGood = destinationFrameOffset <= destinationLength && destinationFrameOffset + numberOfFrames <= destinationLength;
     ASSERT(isOffsetGood);
     if (!isOffsetGood)
-        return;
+        return false;
 
     // Potentially zero out initial frames leading up to the offset.
     if (destinationFrameOffset) {
@@ -190,35 +195,43 @@ void AudioBufferSourceNode::renderFromBuffer(AudioBus* bus, unsigned destination
     size_t bufferLength = buffer()->length();
     double bufferSampleRate = buffer()->sampleRate();
 
-    // Calculate the start and end frames in our buffer that we want to play.
-    // If m_isGrain is true, then we will be playing a portion of the total buffer.
-    unsigned startFrame = m_isGrain ? AudioUtilities::timeToSampleFrame(m_grainOffset, bufferSampleRate) : 0;
-
     // Avoid converting from time to sample-frames twice by computing
     // the grain end time first before computing the sample frame.
     unsigned endFrame = m_isGrain ? AudioUtilities::timeToSampleFrame(m_grainOffset + m_grainDuration, bufferSampleRate) : bufferLength;
     
-    ASSERT(endFrame >= startFrame);
-    if (endFrame < startFrame)
-        return;
-    
-    unsigned deltaFrames = endFrame - startFrame;
-    
     // This is a HACK to allow for HRTF tail-time - avoids glitch at end.
     // FIXME: implement tailTime for each AudioNode for a more general solution to this problem.
+    // https://bugs.webkit.org/show_bug.cgi?id=77224
     if (m_isGrain)
         endFrame += 512;
 
     // Do some sanity checking.
-    if (startFrame >= bufferLength)
-        startFrame = !bufferLength ? 0 : bufferLength - 1;
     if (endFrame > bufferLength)
         endFrame = bufferLength;
     if (m_virtualReadIndex >= endFrame)
-        m_virtualReadIndex = startFrame; // reset to start
+        m_virtualReadIndex = 0; // reset to start
+
+    // If the .loop attribute is true, then values of m_loopStart == 0 && m_loopEnd == 0 implies
+    // that we should use the entire buffer as the loop, otherwise use the loop values in m_loopStart and m_loopEnd.
+    double virtualEndFrame = endFrame;
+    double virtualDeltaFrames = endFrame;
+
+    if (loop() && (m_loopStart || m_loopEnd) && m_loopStart >= 0 && m_loopEnd > 0 && m_loopStart < m_loopEnd) {
+        // Convert from seconds to sample-frames.
+        double loopStartFrame = m_loopStart * buffer()->sampleRate();
+        double loopEndFrame = m_loopEnd * buffer()->sampleRate();
+
+        virtualEndFrame = min(loopEndFrame, virtualEndFrame);
+        virtualDeltaFrames = virtualEndFrame - loopStartFrame;
+    }
+
 
     double pitchRate = totalPitchRate();
 
+    // Sanity check that our playback rate isn't larger than the loop size.
+    if (pitchRate >= virtualDeltaFrames)
+        return false;
+
     // Get local copy.
     double virtualReadIndex = m_virtualReadIndex;
 
@@ -230,8 +243,12 @@ void AudioBufferSourceNode::renderFromBuffer(AudioBus* bus, unsigned destination
 
     // Optimize for the very common case of playing back with pitchRate == 1.
     // We can avoid the linear interpolation.
-    if (pitchRate == 1 && virtualReadIndex == floor(virtualReadIndex)) {
+    if (pitchRate == 1 && virtualReadIndex == floor(virtualReadIndex)
+        && virtualDeltaFrames == floor(virtualDeltaFrames)
+        && virtualEndFrame == floor(virtualEndFrame)) {
         unsigned readIndex = static_cast<unsigned>(virtualReadIndex);
+        unsigned deltaFrames = static_cast<unsigned>(virtualDeltaFrames);
+        endFrame = static_cast<unsigned>(virtualEndFrame);
         while (framesToProcess > 0) {
             int framesToEnd = endFrame - readIndex;
             int framesThisTime = min(framesToProcess, framesToEnd);
@@ -259,10 +276,10 @@ void AudioBufferSourceNode::renderFromBuffer(AudioBus* bus, unsigned destination
 
             // For linear interpolation we need the next sample-frame too.
             unsigned readIndex2 = readIndex + 1;
-            if (readIndex2 >= endFrame) {
+            if (readIndex2 >= bufferLength) {
                 if (loop()) {
                     // Make sure to wrap around at the end of the buffer.
-                    readIndex2 -= deltaFrames;
+                    readIndex2 = static_cast<unsigned>(virtualReadIndex + 1 - virtualDeltaFrames);
                 } else
                     readIndex2 = readIndex;
             }
@@ -288,9 +305,8 @@ void AudioBufferSourceNode::renderFromBuffer(AudioBus* bus, unsigned destination
             virtualReadIndex += pitchRate;
 
             // Wrap-around, retaining sub-sample position since virtualReadIndex is floating-point.
-            if (virtualReadIndex >= endFrame) {
-                virtualReadIndex -= deltaFrames;
-
+            if (virtualReadIndex >= virtualEndFrame) {
+                virtualReadIndex -= virtualDeltaFrames;
                 if (renderSilenceAndFinishIfNotLooping(bus, writeIndex, framesToProcess))
                     break;
             }
@@ -300,6 +316,8 @@ void AudioBufferSourceNode::renderFromBuffer(AudioBus* bus, unsigned destination
     bus->clearSilentFlag();
 
     m_virtualReadIndex = virtualReadIndex;
+
+    return true;
 }
 
 
@@ -346,6 +364,12 @@ unsigned AudioBufferSourceNode::numberOfChannels()
     return output(0)->numberOfChannels();
 }
 
+void AudioBufferSourceNode::startGrain(double when, double grainOffset)
+{
+    // Duration of 0 has special value, meaning calculate based on the entire buffer's duration.
+    startGrain(when, grainOffset, 0);
+}
+
 void AudioBufferSourceNode::startGrain(double when, double grainOffset, double grainDuration)
 {
     ASSERT(isMainThread());
@@ -359,21 +383,22 @@ void AudioBufferSourceNode::startGrain(double when, double grainOffset, double g
     // Do sanity checking of grain parameters versus buffer size.
     double bufferDuration = buffer()->duration();
 
-    if (grainDuration > bufferDuration)
-        return; // FIXME: maybe should throw exception - consider in specification.
-    
-    double maxGrainOffset = bufferDuration - grainDuration;
-    maxGrainOffset = max(0.0, maxGrainOffset);
-
     grainOffset = max(0.0, grainOffset);
-    grainOffset = min(maxGrainOffset, grainOffset);
+    grainOffset = min(bufferDuration, grainOffset);
     m_grainOffset = grainOffset;
 
+    // Handle default/unspecified duration.
+    double maxDuration = bufferDuration - grainOffset;
+    if (!grainDuration)
+        grainDuration = maxDuration;
+
+    grainDuration = max(0.0, grainDuration);
+    grainDuration = min(maxDuration, grainDuration);
     m_grainDuration = grainDuration;
-    
+
     m_isGrain = true;
     m_startTime = when;
-
+    
     // We call timeToSampleFrame here since at playbackRate == 1 we don't want to go through linear interpolation
     // at a sub-sample position since it will degrade the quality.
     // When aligned to the sample-frame the playback will be identical to the PCM data stored in the buffer.
diff --git a/Source/WebCore/Modules/webaudio/AudioBufferSourceNode.h b/Source/WebCore/Modules/webaudio/AudioBufferSourceNode.h
index ddc38fec0..fc5699b62 100644
--- a/Source/WebCore/Modules/webaudio/AudioBufferSourceNode.h
+++ b/Source/WebCore/Modules/webaudio/AudioBufferSourceNode.h
@@ -62,6 +62,7 @@ public:
     unsigned numberOfChannels();
                     
     // Play-state
+    void startGrain(double when, double grainOffset);
     void startGrain(double when, double grainOffset, double grainDuration);
 
 #if ENABLE(LEGACY_WEB_AUDIO)
@@ -74,10 +75,16 @@ public:
     bool loop() const { return m_isLooping; }
     void setLoop(bool looping) { m_isLooping = looping; }
 
+    // Loop times in seconds.
+    double loopStart() const { return m_loopStart; }
+    double loopEnd() const { return m_loopEnd; }
+    void setLoopStart(double loopStart) { m_loopStart = loopStart; }
+    void setLoopEnd(double loopEnd) { m_loopEnd = loopEnd; }
+
     // Deprecated.
     bool looping();
     void setLooping(bool);
-    
+
     AudioGain* gain() { return m_gain.get(); }                                        
     AudioParam* playbackRate() { return m_playbackRate.get(); }
 
@@ -94,7 +101,8 @@ public:
 private:
     AudioBufferSourceNode(AudioContext*, float sampleRate);
 
-    void renderFromBuffer(AudioBus*, unsigned destinationFrameOffset, size_t numberOfFrames);
+    // Returns true on success.
+    bool renderFromBuffer(AudioBus*, unsigned destinationFrameOffset, size_t numberOfFrames);
 
     // Render silence starting from "index" frame in AudioBus.
     inline bool renderSilenceAndFinishIfNotLooping(AudioBus*, unsigned index, size_t framesToProcess);
@@ -114,6 +122,9 @@ private:
     // If true, it will wrap around to the start of the buffer each time it reaches the end.
     bool m_isLooping;
 
+    double m_loopStart;
+    double m_loopEnd;
+
     // m_virtualReadIndex is a sample-frame index into our buffer representing the current playback position.
     // Since it's floating-point, it has sub-sample accuracy.
     double m_virtualReadIndex;
diff --git a/Source/WebCore/Modules/webaudio/AudioBufferSourceNode.idl b/Source/WebCore/Modules/webaudio/AudioBufferSourceNode.idl
index c7c0254a1..078b0b7f2 100644
--- a/Source/WebCore/Modules/webaudio/AudioBufferSourceNode.idl
+++ b/Source/WebCore/Modules/webaudio/AudioBufferSourceNode.idl
@@ -41,13 +41,18 @@
     readonly attribute AudioParam playbackRate;
 
     attribute boolean loop; // This is the proper attribute name from the specification.
-    attribute boolean looping; // This is an alias for the .loop attribute for backwards compatibility.
+
+    attribute double loopStart;
+    attribute double loopEnd;
 
     [V8MeasureAs=WebAudioStart] void start(in double when);
+    [V8MeasureAs=WebAudioStart, ImplementedAs=startGrain] void start(in double when, in double grainOffset);
     [V8MeasureAs=WebAudioStart, ImplementedAs=startGrain] void start(in double when, in double grainOffset, in double grainDuration);
     void stop(in double when);
 
 #if defined(ENABLE_LEGACY_WEB_AUDIO) && ENABLE_LEGACY_WEB_AUDIO
+    attribute boolean looping; // This is an alias for the .loop attribute for backwards compatibility.
+
     [V8MeasureAs=LegacyWebAudio] void noteOn(in double when);
     [V8MeasureAs=LegacyWebAudio] void noteGrainOn(in double when, in double grainOffset, in double grainDuration);
     void noteOff(in double when);
diff --git a/Source/WebCore/Modules/webaudio/AudioContext.cpp b/Source/WebCore/Modules/webaudio/AudioContext.cpp
index fceddf3de..9f6588016 100644
--- a/Source/WebCore/Modules/webaudio/AudioContext.cpp
+++ b/Source/WebCore/Modules/webaudio/AudioContext.cpp
@@ -764,7 +764,7 @@ void AudioContext::handleDeferredFinishDerefs()
 void AudioContext::markForDeletion(AudioNode* node)
 {
     ASSERT(isGraphOwner());
-    m_nodesToDelete.append(node);
+    m_nodesMarkedForDeletion.append(node);
 
     // This is probably the best time for us to remove the node from automatic pull list,
     // since all connections are gone and we hold the graph lock. Then when handlePostRenderTasks()
@@ -781,7 +781,11 @@ void AudioContext::scheduleNodeDeletion()
         return;
 
     // Make sure to call deleteMarkedNodes() on main thread.    
-    if (m_nodesToDelete.size() && !m_isDeletionScheduled) {
+    if (m_nodesMarkedForDeletion.size() && !m_isDeletionScheduled) {
+        for (unsigned i = 0; i < m_nodesMarkedForDeletion.size(); ++i)
+            m_nodesToDelete.append(m_nodesMarkedForDeletion[i]);
+        m_nodesMarkedForDeletion.clear();
+
         m_isDeletionScheduled = true;
 
         // Don't let ourself get deleted before the callback.
@@ -808,7 +812,6 @@ void AudioContext::deleteMarkedNodes()
 
     AutoLocker locker(this);
     
-    // Note: deleting an AudioNode can cause m_nodesToDelete to grow.
     while (size_t n = m_nodesToDelete.size()) {
         AudioNode* node = m_nodesToDelete[n - 1];
         m_nodesToDelete.removeLast();
diff --git a/Source/WebCore/Modules/webaudio/AudioContext.h b/Source/WebCore/Modules/webaudio/AudioContext.h
index 267ee4262..3098d8ec6 100644
--- a/Source/WebCore/Modules/webaudio/AudioContext.h
+++ b/Source/WebCore/Modules/webaudio/AudioContext.h
@@ -286,6 +286,11 @@ private:
     Vector<AudioNode*> m_referencedNodes;
 
     // Accumulate nodes which need to be deleted here.
+    // This is copied to m_nodesToDelete at the end of a render cycle in handlePostRenderTasks(), where we're assured of a stable graph
+    // state which will have no references to any of the nodes in m_nodesToDelete once the context lock is released
+    // (when handlePostRenderTasks() has completed).
+    Vector<AudioNode*> m_nodesMarkedForDeletion;
+
     // They will be scheduled for deletion (on the main thread) at the end of a render cycle (in realtime thread).
     Vector<AudioNode*> m_nodesToDelete;
     bool m_isDeletionScheduled;
diff --git a/Source/WebCore/Modules/webaudio/AudioParam.cpp b/Source/WebCore/Modules/webaudio/AudioParam.cpp
index c525b2e6c..f4cf11d01 100644
--- a/Source/WebCore/Modules/webaudio/AudioParam.cpp
+++ b/Source/WebCore/Modules/webaudio/AudioParam.cpp
@@ -155,9 +155,9 @@ void AudioParam::calculateTimelineValues(float* values, unsigned numberOfValues)
 {
     // Calculate values for this render quantum.
     // Normally numberOfValues will equal AudioNode::ProcessingSizeInFrames (the render quantum size).
-    float sampleRate = context()->sampleRate();
-    float startTime = narrowPrecisionToFloat(context()->currentTime());
-    float endTime = startTime + numberOfValues / sampleRate;
+    double sampleRate = context()->sampleRate();
+    double startTime = context()->currentTime();
+    double endTime = startTime + numberOfValues / sampleRate;
 
     // Note we're running control rate at the sample-rate.
     // Pass in the current value as default value.
diff --git a/Source/WebCore/Modules/webaudio/AudioParam.h b/Source/WebCore/Modules/webaudio/AudioParam.h
index d17c6a60d..524f98f07 100644
--- a/Source/WebCore/Modules/webaudio/AudioParam.h
+++ b/Source/WebCore/Modules/webaudio/AudioParam.h
@@ -88,7 +88,7 @@ public:
     void setValueAtTime(float value, float time) { m_timeline.setValueAtTime(value, time); }
     void linearRampToValueAtTime(float value, float time) { m_timeline.linearRampToValueAtTime(value, time); }
     void exponentialRampToValueAtTime(float value, float time) { m_timeline.exponentialRampToValueAtTime(value, time); }
-    void setTargetValueAtTime(float targetValue, float time, float timeConstant) { m_timeline.setTargetValueAtTime(targetValue, time, timeConstant); }
+    void setTargetAtTime(float target, float time, float timeConstant) { m_timeline.setTargetAtTime(target, time, timeConstant); }
     void setValueCurveAtTime(Float32Array* curve, float time, float duration) { m_timeline.setValueCurveAtTime(curve, time, duration); }
     void cancelScheduledValues(float startTime) { m_timeline.cancelScheduledValues(startTime); }
 
diff --git a/Source/WebCore/Modules/webaudio/AudioParam.idl b/Source/WebCore/Modules/webaudio/AudioParam.idl
index 84a952c5a..d6d01fec5 100644
--- a/Source/WebCore/Modules/webaudio/AudioParam.idl
+++ b/Source/WebCore/Modules/webaudio/AudioParam.idl
@@ -44,8 +44,8 @@
     void linearRampToValueAtTime(in float value, in float time);
     void exponentialRampToValueAtTime(in float value, in float time);
 
-    // Exponentially approach the target value with a rate having the given time constant.
-    void setTargetValueAtTime(in float targetValue, in float time, in float timeConstant);
+    // Exponentially approach the target with a rate having the given time constant.
+    void setTargetAtTime(in float target, in float time, in float timeConstant);
 
     // Sets an array of arbitrary parameter values starting at time for the given duration.
     // The number of values will be scaled to fit into the desired duration.
@@ -53,4 +53,9 @@
 
     // Cancels all scheduled parameter changes with times greater than or equal to startTime.
     void cancelScheduledValues(in float startTime);
+
+#if defined(ENABLE_LEGACY_WEB_AUDIO) && ENABLE_LEGACY_WEB_AUDIO
+    [V8MeasureAs=LegacyWebAudio, ImplementedAs=setTargetAtTime] void setTargetValueAtTime(in float targetValue, in float time, in float timeConstant);
+#endif
+
 };
diff --git a/Source/WebCore/Modules/webaudio/AudioParamTimeline.cpp b/Source/WebCore/Modules/webaudio/AudioParamTimeline.cpp
index 9b5c2c472..fef8d0e56 100644
--- a/Source/WebCore/Modules/webaudio/AudioParamTimeline.cpp
+++ b/Source/WebCore/Modules/webaudio/AudioParamTimeline.cpp
@@ -53,9 +53,9 @@ void AudioParamTimeline::exponentialRampToValueAtTime(float value, float time)
     insertEvent(ParamEvent(ParamEvent::ExponentialRampToValue, value, time, 0, 0, 0));
 }
 
-void AudioParamTimeline::setTargetValueAtTime(float targetValue, float time, float timeConstant)
+void AudioParamTimeline::setTargetAtTime(float target, float time, float timeConstant)
 {
-    insertEvent(ParamEvent(ParamEvent::SetTargetValue, targetValue, time, timeConstant, 0, 0));
+    insertEvent(ParamEvent(ParamEvent::SetTarget, target, time, timeConstant, 0, 0));
 }
 
 void AudioParamTimeline::setValueCurveAtTime(Float32Array* curve, float time, float duration)
@@ -117,30 +117,34 @@ float AudioParamTimeline::valueForContextTime(AudioContext* context, float defau
 {
     ASSERT(context);
 
-    if (!context || !m_events.size() || context->currentTime() < m_events[0].time()) {
-        hasValue = false;
-        return defaultValue;
+    {
+        MutexTryLocker tryLocker(m_eventsLock);
+        if (!tryLocker.locked() || !context || !m_events.size() || context->currentTime() < m_events[0].time()) {
+            hasValue = false;
+            return defaultValue;
+        }
     }
 
     // Ask for just a single value.
     float value;
-    float sampleRate = context->sampleRate();
-    float startTime = narrowPrecisionToFloat(context->currentTime());
-    float endTime = startTime + 1.1f / sampleRate; // time just beyond one sample-frame
-    float controlRate = sampleRate / AudioNode::ProcessingSizeInFrames; // one parameter change per render quantum
+    double sampleRate = context->sampleRate();
+    double startTime = context->currentTime();
+    double endTime = startTime + 1.1 / sampleRate; // time just beyond one sample-frame
+    double controlRate = sampleRate / AudioNode::ProcessingSizeInFrames; // one parameter change per render quantum
     value = valuesForTimeRange(startTime, endTime, defaultValue, &value, 1, sampleRate, controlRate);
 
     hasValue = true;
     return value;
 }
 
-float AudioParamTimeline::valuesForTimeRange(float startTime,
-                                             float endTime,
-                                             float defaultValue,
-                                             float* values,
-                                             unsigned numberOfValues,
-                                             float sampleRate,
-                                             float controlRate)
+float AudioParamTimeline::valuesForTimeRange(
+    double startTime,
+    double endTime,
+    float defaultValue,
+    float* values,
+    unsigned numberOfValues,
+    double sampleRate,
+    double controlRate)
 {
     // We can't contend the lock in the realtime audio thread.
     MutexTryLocker tryLocker(m_eventsLock);
@@ -157,13 +161,14 @@ float AudioParamTimeline::valuesForTimeRange(float startTime,
     return value;
 }
 
-float AudioParamTimeline::valuesForTimeRangeImpl(float startTime,
-                                                 float endTime,
-                                                 float defaultValue,
-                                                 float* values,
-                                                 unsigned numberOfValues,
-                                                 float sampleRate,
-                                                 float controlRate)
+float AudioParamTimeline::valuesForTimeRangeImpl(
+    double startTime,
+    double endTime,
+    float defaultValue,
+    float* values,
+    unsigned numberOfValues,
+    double sampleRate,
+    double controlRate)
 {
     ASSERT(values);
     if (!values)
@@ -177,14 +182,14 @@ float AudioParamTimeline::valuesForTimeRangeImpl(float startTime,
     }
 
     // Maintain a running time and index for writing the values buffer.
-    float currentTime = startTime;
+    double currentTime = startTime;
     unsigned writeIndex = 0;
 
     // If first event is after startTime then fill initial part of values buffer with defaultValue
     // until we reach the first event time.
-    float firstEventTime = m_events[0].time();
+    double firstEventTime = m_events[0].time();
     if (firstEventTime > startTime) {
-        float fillToTime = min(endTime, firstEventTime);
+        double fillToTime = min(endTime, firstEventTime);
         unsigned fillToFrame = AudioUtilities::timeToSampleFrame(fillToTime - startTime, sampleRate);
         fillToFrame = min(fillToFrame, numberOfValues);
         for (; writeIndex < fillToFrame; ++writeIndex)
@@ -209,15 +214,15 @@ float AudioParamTimeline::valuesForTimeRangeImpl(float startTime,
             continue;
 
         float value1 = event.value();
-        float time1 = event.time();
+        double time1 = event.time();
         float value2 = nextEvent ? nextEvent->value() : value1;
-        float time2 = nextEvent ? nextEvent->time() : endTime + 1;
+        double time2 = nextEvent ? nextEvent->time() : endTime + 1;
 
-        float deltaTime = time2 - time1;
+        double deltaTime = time2 - time1;
         float k = deltaTime > 0 ? 1 / deltaTime : 0;
-        float sampleFrameTimeIncr = 1 / sampleRate;
+        double sampleFrameTimeIncr = 1 / sampleRate;
 
-        float fillToTime = min(endTime, time2);
+        double fillToTime = min(endTime, time2);
         unsigned fillToFrame = AudioUtilities::timeToSampleFrame(fillToTime - startTime, sampleRate);
         fillToFrame = min(fillToFrame, numberOfValues);
 
@@ -271,18 +276,18 @@ float AudioParamTimeline::valuesForTimeRangeImpl(float startTime,
                     break;
                 }
 
-            case ParamEvent::SetTargetValue:
+            case ParamEvent::SetTarget:
                 {
                     currentTime = fillToTime;
 
                     // Exponential approach to target value with given time constant.
-                    float targetValue = event.value();
+                    float target = event.value();
                     float timeConstant = event.timeConstant();
                     float discreteTimeConstant = static_cast<float>(AudioUtilities::discreteTimeConstantForSampleRate(timeConstant, controlRate));
 
                     for (; writeIndex < fillToFrame; ++writeIndex) {
                         values[writeIndex] = value;
-                        value += (targetValue - value) * discreteTimeConstant;
+                        value += (target - value) * discreteTimeConstant;
                     }
 
                     break;
diff --git a/Source/WebCore/Modules/webaudio/AudioParamTimeline.h b/Source/WebCore/Modules/webaudio/AudioParamTimeline.h
index abc147d2a..c0a960870 100644
--- a/Source/WebCore/Modules/webaudio/AudioParamTimeline.h
+++ b/Source/WebCore/Modules/webaudio/AudioParamTimeline.h
@@ -47,7 +47,7 @@ public:
     void setValueAtTime(float value, float time);
     void linearRampToValueAtTime(float value, float time);
     void exponentialRampToValueAtTime(float value, float time);
-    void setTargetValueAtTime(float targetValue, float time, float timeConstant);
+    void setTargetAtTime(float target, float time, float timeConstant);
     void setValueCurveAtTime(Float32Array* curve, float time, float duration);
     void cancelScheduledValues(float startTime);
 
@@ -60,7 +60,7 @@ public:
     // controlRate is the rate (number per second) at which parameter values will be calculated.
     // It should equal sampleRate for sample-accurate parameter changes, and otherwise will usually match
     // the render quantum size such that the parameter value changes once per render quantum.
-    float valuesForTimeRange(float startTime, float endTime, float defaultValue, float* values, unsigned numberOfValues, float sampleRate, float controlRate);
+    float valuesForTimeRange(double startTime, double endTime, float defaultValue, float* values, unsigned numberOfValues, double sampleRate, double controlRate);
 
     bool hasValues() { return m_events.size(); }
 
@@ -71,7 +71,7 @@ private:
             SetValue,
             LinearRampToValue,
             ExponentialRampToValue,
-            SetTargetValue,
+            SetTarget,
             SetValueCurve,
             LastType
         };
@@ -103,7 +103,7 @@ private:
     };
 
     void insertEvent(const ParamEvent&);
-    float valuesForTimeRangeImpl(float startTime, float endTime, float defaultValue, float* values, unsigned numberOfValues, float sampleRate, float controlRate);
+    float valuesForTimeRangeImpl(double startTime, double endTime, float defaultValue, float* values, unsigned numberOfValues, double sampleRate, double controlRate);
 
     Vector<ParamEvent> m_events;
 
diff --git a/Source/WebCore/PlatformEfl.cmake b/Source/WebCore/PlatformEfl.cmake
index 332734f84..75d643d92 100644
--- a/Source/WebCore/PlatformEfl.cmake
+++ b/Source/WebCore/PlatformEfl.cmake
@@ -45,7 +45,6 @@ LIST(APPEND WebCore_SOURCES
   platform/efl/ScrollViewEfl.cpp
   platform/efl/ScrollbarEfl.cpp
   platform/efl/ScrollbarThemeEfl.cpp
-  platform/efl/SharedBufferEfl.cpp
   platform/efl/SharedTimerEfl.cpp
   platform/efl/SoundEfl.cpp
   platform/efl/SystemTimeEfl.cpp
@@ -69,6 +68,7 @@ LIST(APPEND WebCore_SOURCES
   platform/linux/GamepadDeviceLinux.cpp
   platform/mediastream/gstreamer/MediaStreamCenterGStreamer.cpp
   platform/network/efl/NetworkStateNotifierEfl.cpp
+  platform/network/soup/AuthenticationChallengeSoup.cpp
   platform/network/soup/CookieJarSoup.cpp
   platform/network/soup/CookieStorageSoup.cpp
   platform/network/soup/CredentialStorageSoup.cpp
@@ -84,6 +84,7 @@ LIST(APPEND WebCore_SOURCES
   platform/network/soup/SoupURIUtils.cpp
   platform/PlatformStrategies.cpp
   platform/posix/FileSystemPOSIX.cpp
+  platform/posix/SharedBufferPOSIX.cpp
   platform/text/efl/TextBreakIteratorInternalICUEfl.cpp
   platform/text/enchant/TextCheckerEnchant.cpp
 )
@@ -201,10 +202,10 @@ LIST(APPEND WebCore_LIBRARIES
   ${FONTCONFIG_LIBRARIES}
   ${FREETYPE_LIBRARIES}
   ${ICU_LIBRARIES}
-  ${JPEG_LIBRARY}
+  ${JPEG_LIBRARIES}
   ${LIBXML2_LIBRARIES}
   ${LIBXSLT_LIBRARIES}
-  ${PNG_LIBRARY}
+  ${PNG_LIBRARIES}
   ${SQLITE_LIBRARIES}
   ${GLIB_LIBRARIES}
   ${GLIB_GIO_LIBRARIES}
@@ -283,6 +284,7 @@ IF (WTF_USE_3D_GRAPHICS)
   LIST(APPEND WebCore_INCLUDE_DIRECTORIES
     "${WEBCORE_DIR}/platform/graphics/cairo"
     "${WEBCORE_DIR}/platform/graphics/opengl"
+    "${WEBCORE_DIR}/platform/graphics/surfaces"
     "${WEBCORE_DIR}/platform/graphics/texmap"
   )
   LIST(APPEND WebCore_SOURCES
@@ -294,6 +296,8 @@ IF (WTF_USE_3D_GRAPHICS)
     platform/graphics/opengl/Extensions3DOpenGLCommon.cpp
     platform/graphics/opengl/GraphicsContext3DOpenGL.cpp
     platform/graphics/opengl/GraphicsContext3DOpenGLCommon.cpp
+    platform/graphics/surfaces/GraphicsSurface.cpp
+    platform/graphics/surfaces/qt/GraphicsSurfaceGLX.cpp
     platform/graphics/texmap/TextureMapperGL.cpp
     platform/graphics/texmap/TextureMapperShaderManager.cpp
   )
diff --git a/Source/WebCore/PlatformWinCE.cmake b/Source/WebCore/PlatformWinCE.cmake
index ca23c5e7f..4c9317fb0 100644
--- a/Source/WebCore/PlatformWinCE.cmake
+++ b/Source/WebCore/PlatformWinCE.cmake
@@ -80,7 +80,6 @@ LIST(APPEND WebCore_SOURCES
 
     platform/network/win/CredentialStorageWin.cpp
     platform/network/win/CookieJarWin.cpp
-    platform/network/win/CookieStorageWin.cpp
     platform/network/win/NetworkStateNotifierWin.cpp
     platform/network/win/ProxyServerWin.cpp
     platform/network/win/ResourceHandleWin.cpp
diff --git a/Source/WebCore/Resources/pagepopups/calendarPicker.css b/Source/WebCore/Resources/pagepopups/calendarPicker.css
index 330ac3dd6..ca1dbb225 100644
--- a/Source/WebCore/Resources/pagepopups/calendarPicker.css
+++ b/Source/WebCore/Resources/pagepopups/calendarPicker.css
@@ -224,3 +224,9 @@ body {
 .preparing .unavailable {
     -webkit-transition: none;
 }
+
+.month-mode .day {
+    -webkit-transition: none;
+    border-radius: 0;
+    border: 1px solid transparent;
+}
diff --git a/Source/WebCore/Resources/pagepopups/calendarPicker.js b/Source/WebCore/Resources/pagepopups/calendarPicker.js
index f599c96e9..98cb7de39 100644
--- a/Source/WebCore/Resources/pagepopups/calendarPicker.js
+++ b/Source/WebCore/Resources/pagepopups/calendarPicker.js
@@ -46,6 +46,7 @@ var ClassNames = {
     DayLabelContainer: "day-label-container",
     DaysArea: "days-area",
     DaysAreaContainer: "days-area-container",
+    MonthMode: "month-mode",
     MonthSelector: "month-selector",
     MonthSelectorBox: "month-selector-box",
     MonthSelectorPopup: "month-selector-popup",
@@ -139,13 +140,13 @@ function formatJapaneseImperialEra(year, month) {
 }
 
 /**
- * @param {!number} year
- * @param {!number} month
  * @return {!string}
  */
-function formatYearMonth(year, month) {
-    var yearString = localizeNumber(year);
-    var monthString = global.params.monthLabels[month];
+Month.prototype.toLocaleString = function() {
+    if (isNaN(this.year) || isNaN(this.year))
+        return "Invalid Month";
+    var yearString = localizeNumber(this.year);
+    var monthString = global.params.monthLabels[this.month];
     switch (getLanguage()) {
     case "eu":
     case "fil":
@@ -158,7 +159,7 @@ function formatYearMonth(year, month) {
     case "hu":
         return yearString + ". " + monthString;
     case "ja":
-        return yearString + "年" + formatJapaneseImperialEra(year, month) + " " + monthString;
+        return yearString + "年" + formatJapaneseImperialEra(this.year, this.month) + " " + monthString;
     case "zh":
         return yearString + "年" + monthString;
     case "ko":
@@ -172,42 +173,246 @@ function formatYearMonth(year, month) {
     default:
         return monthString + " " + yearString;
     }
-}
+};
 
 function createUTCDate(year, month, date) {
-    var newDate = new Date(Date.UTC(year, month, date));
-    if (year < 100)
-        newDate.setUTCFullYear(year);
+    var newDate = new Date(0);
+    newDate.setUTCFullYear(year);
+    newDate.setUTCMonth(month);
+    newDate.setUTCDate(date);
     return newDate;
 };
 
 /**
- * @param {string=} opt_current
+ * @param {string} dateString
+ * @return {?Day|Month}
+ */
+function parseDateString(dateString) {
+    var month = Month.parse(dateString);
+    if (month)
+        return month;
+    return Day.parse(dateString);
+}
+
+/**
+ * @param {!number|Day} valueOrDayOrYear
+ * @param {!number=} month
+ * @param {!number=} date
+ */
+function Day(valueOrDayOrYear, month, date) {
+    var dateObject;
+    if (arguments.length == 3)
+        dateObject = createUTCDate(valueOrDayOrYear, month, date);
+    else if (valueOrDayOrYear instanceof Day)
+        dateObject = createUTCDate(valueOrDayOrYear.year, valueOrDayOrYear.month, valueOrDayOrYear.date);
+    else
+        dateObject = new Date(valueOrDayOrYear);
+    this.year = dateObject.getUTCFullYear();    
+    this.month = dateObject.getUTCMonth();
+    this.date = dateObject.getUTCDate();
+};
+
+Day.ISOStringRegExp = /^(\d+)-(\d+)-(\d+)$/;
+
+// See WebCore/platform/DateComponents.h.
+Day.Minimum = new Day(-62135596800000.0);
+Day.Maximum = new Day(8640000000000000.0);
+
+/**
+ * @param {!string} str
+ * @return {?Month}
+ */
+Day.parse = function(str) {
+    var match = Day.ISOStringRegExp.exec(str);
+    if (!match)
+        return null;
+    var year = parseInt(match[1], 10);
+    var month = parseInt(match[2], 10) - 1;
+    var date = parseInt(match[3], 10);
+    return new Day(year, month, date);
+};
+
+/**
+ * @param {!Date} date
+ * @return {!Month}
+ */
+Day.createFromDate = function(date) {
+    return new Day(date.getUTCFullYear(), date.getUTCMonth(), date.getUTCDate());
+};
+
+/**
+ * @return {!Month}
+ */
+Day.createFromToday = function() {
+    var now = new Date();
+    return new Day(now.getFullYear(), now.getMonth(), now.getDate());
+};
+
+/**
+ * @param {!Day} other
+ * @return {!bool}
+ */
+Day.prototype.equals = function(other) {
+    return this.year === other.year && this.month === other.month && this.date === other.date;
+};
+
+/**
+ * @return {!Day}
+ */
+Day.prototype.previous = function() {
+    return new Day(this.year, this.month, this.date - 1);
+};
+
+/**
+ * @return {!Day}
+ */
+Day.prototype.next = function() {
+    return new Day(this.year, this.month, this.date + 1);
+};
+
+/**
  * @return {!Date}
  */
-function parseDateString(opt_current) {
-    if (opt_current) {
-        var result = opt_current.match(/(\d+)-(\d+)-(\d+)/);
-        if (result)
-            return createUTCDate(Number(result[1]), Number(result[2]) - 1, Number(result[3]));
+Day.prototype.startDate = function() {
+    return createUTCDate(this.year, this.month, this.date);
+};
+
+/**
+ * @return {!Date}
+ */
+Day.prototype.endDate = function() {
+    return createUTCDate(this.year, this.month, this.date + 1);
+};
+
+/**
+ * @return {!number}
+ */
+Day.prototype.valueOf = function() {
+    return this.startDate().getTime();
+};
+
+/**
+ * @return {!string}
+ */
+Day.prototype.toString = function() {
+    var yearString = String(this.year);
+    if (yearString.length < 4)
+        yearString = ("000" + yearString).substr(-4, 4);
+    return yearString + "-" + ("0" + (this.month + 1)).substr(-2, 2) + "-" + ("0" + this.date).substr(-2, 2);
+};
+
+/**
+ * @param {!number|Month} valueOrMonthOrYear
+ * @param {!number=} month
+ */
+function Month(valueOrMonthOrYear, month) {
+    if (arguments.length == 2) {
+        this.year = valueOrMonthOrYear;
+        this.month = month;
+    } else if (valueOrMonthOrYear instanceof Month) {
+        this.year = valueOrMonthOrYear.year;
+        this.month = valueOrMonthOrYear.month;
+    } else {
+        this.year = 1970;
+        this.month = valueOrMonthOrYear;
     }
+    this.year = this.year + Math.floor(this.month / 12);
+    this.month = this.month < 0 ? this.month % 12 + 12 : this.month % 12;
+    if (this.year <= 0 || Month.Maximum < this) {
+        this.year = NaN;
+        this.month = NaN;
+    }
+};
+
+Month.ISOStringRegExp = /^(\d+)-(\d+)$/;
+
+// See WebCore/platform/DateComponents.h.
+Month.Minimum = new Month(1, 0);
+Month.Maximum = new Month(275760, 8);
+
+/**
+ * @param {!string} str
+ * @return {?Month}
+ */
+Month.parse = function(str) {
+    var match = Month.ISOStringRegExp.exec(str);
+    if (!match)
+        return null;
+    var year = parseInt(match[1], 10);
+    var month = parseInt(match[2], 10) - 1;
+    return new Month(year, month);
+};
+
+/**
+ * @param {!Date} date
+ * @return {!Month}
+ */
+Month.createFromDate = function(date) {
+    return new Month(date.getUTCFullYear(), date.getUTCMonth());
+};
+
+/**
+ * @return {!Month}
+ */
+Month.createFromToday = function() {
     var now = new Date();
-    // Create UTC date with same numbers as local date.
-    return createUTCDate(now.getFullYear(), now.getMonth(), now.getDate());
-}
+    return new Month(now.getFullYear(), now.getMonth());
+};
+
+/**
+ * @param {!Month} other
+ * @return {!bool}
+ */
+Month.prototype.equals = function(other) {
+    return this.year === other.year && this.month === other.month;
+};
+
+/**
+ * @return {!Month}
+ */
+Month.prototype.previous = function() {
+    return new Month(this.year, this.month - 1);
+};
+
+/**
+ * @return {!Month}
+ */
+Month.prototype.next = function() {
+    return new Month(this.year, this.month + 1);
+};
+
+/**
+ * @return {!Date}
+ */
+Month.prototype.startDate = function() {
+    return createUTCDate(this.year, this.month, 1);
+};
+
+/**
+ * @return {!Date}
+ */
+Month.prototype.endDate = function() {
+    if (this.equals(Month.Maximum))
+        return Day.Maximum.startDate();
+    return this.next().startDate();
+};
+
+/**
+ * @return {!number}
+ */
+Month.prototype.valueOf = function() {
+    return (this.year - 1970) * 12 + this.month;
+};
 
 /**
- * @param {!number} year
- * @param {!number} month
- * @param {!number} day
  * @return {!string}
  */
-function serializeDate(year, month, day) {
-    var yearString = String(year);
+Month.prototype.toString = function() {
+    var yearString = String(this.year);
     if (yearString.length < 4)
         yearString = ("000" + yearString).substr(-4, 4);
-    return yearString + "-" + ("0" + (month + 1)).substr(-2, 2) + "-" + ("0" + day).substr(-2, 2);
-}
+    return yearString + "-" + ("0" + (this.month + 1)).substr(-2, 2);
+};
 
 // ----------------------------------------------------------------
 // Initialization
@@ -309,35 +514,46 @@ function openCalendarPicker() {
  */
 function CalendarPicker(element, config) {
     Picker.call(this, element, config);
+    if (this._config.mode === "month") {
+        this.selectionConstructor = Month;
+        this._daysTable = new MonthPickerDaysTable(this);
+        this._element.classList.add(ClassNames.MonthMode);
+    } else {
+        this.selectionConstructor = Day;
+        this._daysTable = new DaysTable(this);
+    }
     this._element.classList.add("calendar-picker");
     this._element.classList.add("preparing");
     this._handleWindowResizeBound = this._handleWindowResize.bind(this);
     window.addEventListener("resize", this._handleWindowResizeBound, false);
-    // We assume this._config.min is a valid date.
-    this.minimumDate = (typeof this._config.min !== "undefined") ? parseDateString(this._config.min) : CalendarPicker.MinimumPossibleDate;
-    // We assume this._config.max is a valid date.
-    this.maximumDate = (typeof this._config.max !== "undefined") ? parseDateString(this._config.max) : CalendarPicker.MaximumPossibleDate;
+    // We assume this._config.min/max are valid dates or months.
+    var minimum = (typeof this._config.min !== "undefined") ? parseDateString(this._config.min) : this.selectionConstructor.Minimum;
+    var maximum = (typeof this._config.max !== "undefined") ? parseDateString(this._config.max) : this.selectionConstructor.Maximum;
+    this._minimumValue = minimum.valueOf();
+    this._maximumValue = maximum.valueOf();
     this.step = (typeof this._config.step !== undefined) ? Number(this._config.step) : CalendarPicker.DefaultStepScaleFactor;
     this.stepBase = (typeof this._config.stepBase !== "undefined") ? Number(this._config.stepBase) : CalendarPicker.DefaultStepBase;
-    this.yearMonthController = new YearMonthController(this);
-    this.daysTable = new DaysTable(this);
+    this._minimumMonth = Month.createFromDate(minimum.startDate());
+    this.maximumMonth = Month.createFromDate(maximum.startDate());
+    this._currentMonth = new Month(NaN, NaN);
+    this._yearMonthController = new YearMonthController(this);
     this._hadKeyEvent = false;
     this._layout();
-    var initialDate = parseDateString(this._config.currentValue);
-    if (initialDate < this.minimumDate)
-        initialDate = this.minimumDate;
-    else if (initialDate > this.maximumDate)
-        initialDate = this.maximumDate;
-    this.daysTable.selectDate(initialDate);
+    var initialSelection = parseDateString(this._config.currentValue);
+    if (!initialSelection)
+        initialSelection = this.selectionConstructor.createFromToday();
+    if (initialSelection.valueOf() < this._minimumValue)
+        initialSelection = new this.selectionConstructor(this._minimumValue);
+    else if (initialSelection.valueOf() > this._maximumValue)
+        initialSelection = new this.selectionConstructor(this._maximumValue);
+    this.showMonth(Month.createFromDate(initialSelection.startDate()), false);
+    this._daysTable.selectRangeAndShowEntireRange(initialSelection);
     this.fixWindowSize();
     this._handleBodyKeyDownBound = this._handleBodyKeyDown.bind(this);
     document.body.addEventListener("keydown", this._handleBodyKeyDownBound, false);
 }
 CalendarPicker.prototype = Object.create(Picker.prototype);
 
-// Hard limits of type=date. See WebCore/platform/DateComponents.h.
-CalendarPicker.MinimumPossibleDate = new Date(-62135596800000.0);
-CalendarPicker.MaximumPossibleDate = new Date(8640000000000000.0);
 // See WebCore/html/DateInputType.cpp.
 CalendarPicker.DefaultStepScaleFactor = 86400000;
 CalendarPicker.DefaultStepBase = 0.0;
@@ -353,17 +569,17 @@ CalendarPicker.prototype.cleanup = function() {
 CalendarPicker.prototype._layout = function() {
     if (this._config.isCalendarRTL)
         this._element.classList.add("rtl");
-    this.yearMonthController.attachTo(this._element);
-    this.daysTable.attachTo(this._element);
+    this._yearMonthController.attachTo(this._element);
+    this._daysTable.attachTo(this._element);
     this._layoutButtons();
     // DaysTable will have focus but we don't want to show its focus ring until the first key event.
     this._element.classList.add(ClassNames.NoFocusRing);
 };
 
 CalendarPicker.prototype.handleToday = function() {
-    var date = new Date();
-    this.daysTable.selectDate(date);
-    this.submitValue(serializeDate(date.getFullYear(), date.getMonth(), date.getDate()));
+    var today = this.selectionConstructor.createFromToday();
+    this._daysTable.selectRangeAndShowEntireRange(today);
+    this.submitValue(today.toString());
 };
 
 CalendarPicker.prototype.handleClear = function() {
@@ -407,6 +623,7 @@ CalendarPicker.prototype.fixWindowSize = function() {
 CalendarPicker.prototype._layoutButtons = function() {
     var container = createElement("div", ClassNames.TodayClearArea);
     this.today = createElement("input", ClassNames.TodayButton);
+    this.today.disabled = !this.isValidDate(this.selectionConstructor.createFromToday());
     this.today.type = "button";
     this.today.value = this._config.todayLabel;
     this.today.addEventListener("click", this.handleToday.bind(this), false);
@@ -424,6 +641,38 @@ CalendarPicker.prototype._layoutButtons = function() {
     this.lastFocusableControl = this.clear || this.today;
 };
 
+/**
+ * @param {!Month} month
+ * @return {!bool}
+ */
+CalendarPicker.prototype.shouldShowMonth = function(month) {
+    return this._minimumMonth.valueOf() <= month.valueOf() && this.maximumMonth.valueOf() >= month.valueOf();
+};
+
+/**
+ * @param {!Month} month
+ * @param {!bool=} animate
+ * @param {!bool=} keepSelectionPosition
+ */
+CalendarPicker.prototype.showMonth = function(month, animate, keepSelectionPosition) {
+    if (this._currentMonth.equals(month))
+        return;
+    else if (month.valueOf() < this._minimumMonth.valueOf())
+        month = this._minimumMonth;
+    else if (month.valueOf() > this.maximumMonth.valueOf())
+        month = this.maximumMonth;
+    this._yearMonthController.setMonth(month);
+    this._daysTable.navigateToMonth(month, animate, keepSelectionPosition);
+    this._currentMonth = month;
+};
+
+/**
+ * @return {!Month}
+ */
+CalendarPicker.prototype.currentMonth = function() {
+    return this._currentMonth;
+};
+
 // ----------------------------------------------------------------
 
 /**
@@ -432,14 +681,6 @@ CalendarPicker.prototype._layoutButtons = function() {
  */
 function YearMonthController(picker) {
     this.picker = picker;
-    /**
-     * @type {!number}
-     */
-    this._currentYear = -1;
-    /**
-     * @type {!number}
-     */
-    this._currentMonth = -1;
 }
 
 /**
@@ -476,15 +717,16 @@ YearMonthController.prototype.attachTo = function(element) {
     this._wall.addEventListener("click", this._closePopup.bind(this), false);
     element.appendChild(this._wall);
 
-    var maximumYear = this.picker.maximumDate.getUTCFullYear();
+    var month = this.picker.maximumMonth;
     var maxWidth = 0;
     for (var m = 0; m < 12; ++m) {
-        this._month.textContent = formatYearMonth(maximumYear, m);
+        this._month.textContent = month.toLocaleString();
         maxWidth = Math.max(maxWidth, this._month.offsetWidth);
+        month = month.previous();
     }
     if (getLanguage() == "ja" && ImperialEraLimit < maximumYear) {
         for (var m = 0; m < 12; ++m) {
-            this._month.textContent = formatYearMonth(ImperialEraLimit, m);
+            this._month.textContent = new Month(ImperialEraLimit, m).toLocaleString();
             maxWidth = Math.max(maxWidth, this._month.offsetWidth);
         }
     }
@@ -551,52 +793,30 @@ YearMonthController.prototype._attachRightButtonsTo = function(parent) {
 };
 
 /**
- * @return {!number}
- */
-YearMonthController.prototype.year = function() {
-    return this._currentYear;
-};
-
-/**
- * @return {!number}
- */
-YearMonthController.prototype.month = function() {
-    return this._currentMonth;
-};
-
-/**
- * @param {!number} year
- * @param {!number} month
+ * @param {!Month} month
  */
-YearMonthController.prototype.setYearMonth = function(year, month) {
-    this._currentYear = year;
-    this._currentMonth = month;
-    this._redraw();
-};
-
-YearMonthController.prototype._redraw = function() {
-    var min = this.picker.minimumDate.getUTCFullYear() * 12 + this.picker.minimumDate.getUTCMonth();
-    var max = this.picker.maximumDate.getUTCFullYear() * 12 + this.picker.maximumDate.getUTCMonth();
-    var current = this._currentYear * 12 + this._currentMonth;
+YearMonthController.prototype.setMonth = function(month) {
+    var monthValue = month.valueOf();
     if (this._left3)
-        this._left3.disabled = current - 13 < min;
-    this._left2.disabled = current - 2 < min;
-    this._left1.disabled = current - 1 < min;
-    this._right1.disabled = current + 1 > max;
-    this._right2.disabled = current + 2 > max;
+        this._left3.disabled = !this.picker.shouldShowMonth(new Month(monthValue - 13));
+    this._left2.disabled = !this.picker.shouldShowMonth(new Month(monthValue - 2));
+    this._left1.disabled = !this.picker.shouldShowMonth(new Month(monthValue - 1));
+    this._right1.disabled = !this.picker.shouldShowMonth(new Month(monthValue + 1));
+    this._right2.disabled = !this.picker.shouldShowMonth(new Month(monthValue + 2));
     if (this._right3)
-        this._right3.disabled = current + 13 > max;
-    this._month.innerText = formatYearMonth(this._currentYear, this._currentMonth);
+        this._left3.disabled = !this.picker.shouldShowMonth(new Month(monthValue + 13));
+    this._month.innerText = month.toLocaleString();
     while (this._monthPopupContents.hasChildNodes())
         this._monthPopupContents.removeChild(this._monthPopupContents.firstChild);
 
-    for (var m = current - 6; m <= current + 6; m++) {
-        if (m < min || m > max)
+    for (var m = monthValue - 6; m <= monthValue + 6; m++) {
+        var month = new Month(m);
+        if (!this.picker.shouldShowMonth(month))
             continue;
-        var option = createElement("div", ClassNames.MonthSelectorPopupEntry, formatYearMonth(Math.floor(m / 12), m % 12));
-        option.dataset.value = String(Math.floor(m / 12)) + "-" + String(m % 12);
+        var option = createElement("div", ClassNames.MonthSelectorPopupEntry, month.toLocaleString());
+        option.dataset.value = month.toString();
         this._monthPopupContents.appendChild(option);
-        if (m == current)
+        if (m == monthValue)
             option.classList.add(ClassNames.SelectedMonthYear);
     }
 };
@@ -715,13 +935,7 @@ YearMonthController.prototype._handleYearMonthChange = function() {
     var selection = this._getSelection();
     if (!selection)
         return;
-    var value = selection.dataset.value;
-    var result  = value.match(/(\d+)-(\d+)/);
-    if (!result)
-        return;
-    var newYear = Number(result[1]);
-    var newMonth = Number(result[2]);
-    this.picker.daysTable.navigateToMonthAndKeepSelectionPosition(newYear, newMonth);
+    this.picker.showMonth(Month.parse(selection.dataset.value));
 };
 
 /*
@@ -779,17 +993,9 @@ YearMonthController.prototype._handleButtonClick = function(event) {
  * @param {!number} amount
  */
 YearMonthController.prototype.moveRelatively = function(amount) {
-    var min = this.picker.minimumDate.getUTCFullYear() * 12 + this.picker.minimumDate.getUTCMonth();
-    var max = this.picker.maximumDate.getUTCFullYear() * 12 + this.picker.maximumDate.getUTCMonth();
-    var current = this._currentYear * 12 + this._currentMonth;
-    var updated = current;
-    if (amount < 0)
-        updated = current + amount >= min ? current + amount : min;
-    else
-        updated = current + amount <= max ? current + amount : max;
-    if (updated == current)
-        return;
-    this.picker.daysTable.navigateToMonthAndKeepSelectionPosition(Math.floor(updated / 12), updated % 12);
+    var current = this.picker.currentMonth().valueOf();
+    var updated = new Month(current + amount);
+    this.picker.showMonth(updated, true, true);
 };
 
 // ----------------------------------------------------------------
@@ -800,29 +1006,13 @@ YearMonthController.prototype.moveRelatively = function(amount) {
  */
 function DaysTable(picker) {
     this.picker = picker;
-    /**
-     * @type {!number}
-     */
-    this._x = -1;
-    /**
-     * @type {!number}
-     */
-    this._y = -1;
-    /**
-     * @type {!number}
-     */
-    this._currentYear = -1;
-    /**
-     * @type {!number}
-     */
-    this._currentMonth = -1;
 }
 
 /**
  * @return {!boolean}
  */
 DaysTable.prototype._hasSelection = function() {
-    return this._x >= 0 && this._y >= 0;
+    return !!this._firstNodeInSelectedRange();
 }
 
 /**
@@ -870,37 +1060,35 @@ DaysTable.prototype.attachTo = function(element) {
 };
 
 /**
- * @param {!number} time date in millisecond.
+ * @param {!number} value
  * @return {!boolean}
  */
-CalendarPicker.prototype.stepMismatch = function(time) {
-    return (time - this.stepBase) % this.step != 0;
+CalendarPicker.prototype._stepMismatch = function(value) {
+    return (value - this.stepBase) % this.step != 0;
 }
 
 /**
- * @param {!number} time date in millisecond.
+ * @param {!number} value
  * @return {!boolean}
  */
-CalendarPicker.prototype.outOfRange = function(time) {
-    return time < this.minimumDate.getTime() || time > this.maximumDate.getTime();
+CalendarPicker.prototype._outOfRange = function(value) {
+    return value < this._minimumValue || value > this._maximumValue;
 }
 
 /**
- * @param {!number} time date in millisecond.
+ * @param {!Month|Day} range
  * @return {!boolean}
  */
-CalendarPicker.prototype.isValidDate = function(time) {
-    return !this.outOfRange(time) && !this.stepMismatch(time);
+CalendarPicker.prototype.isValidDate = function(range) {
+    var value = range.valueOf();
+    return !this._outOfRange(value) && !this._stepMismatch(value);
 }
 
 /**
- * @param {!number} year
- * @param {!number} month
+ * @param {!Month} month
  */
-DaysTable.prototype._renderMonth = function(year, month) {
-    this._currentYear = year;
-    this._currentMonth = month;
-    var dayIterator = createUTCDate(year, month, 1);
+DaysTable.prototype._renderMonth = function(month) {
+    var dayIterator = month.startDate();
     var monthStartDay = dayIterator.getUTCDay();
     var weekStartDay = global.params.weekStartDay || 0;
     var startOffset = weekStartDay - monthStartDay;
@@ -909,65 +1097,47 @@ DaysTable.prototype._renderMonth = function(year, month) {
     dayIterator.setUTCDate(startOffset + 1);
     for (var w = 0; w < DaysTable._Weeks; w++) {
         for (var d = 0; d < 7; d++) {
-            var iterYear = dayIterator.getUTCFullYear();
-            var iterMonth = dayIterator.getUTCMonth();
+            var iterMonth = Month.createFromDate(dayIterator);
             var time = dayIterator.getTime();
             var element = this._days[w][d];
             element.innerText = localizeNumber(dayIterator.getUTCDate());
             element.className = ClassNames.Day;
-            element.dataset.submitValue = serializeDate(iterYear, iterMonth, dayIterator.getUTCDate());
-            if (this.picker.outOfRange(time))
+            element.dataset.submitValue = Day.createFromDate(dayIterator).toString();
+            element.dataset.monthValue = iterMonth.toString();
+            if (isNaN(time)) {
+                element.innerText = "-";
                 element.classList.add(ClassNames.Unavailable);
-            else if (this.picker.stepMismatch(time))
+            } else if (!this.picker.isValidDate(this._rangeForNode(element)))
                 element.classList.add(ClassNames.Unavailable);
-            else if ((iterYear == year && dayIterator.getUTCMonth() < month) || (month == 0 && iterMonth == 11)) {
-                element.classList.add(ClassNames.Available);
-                element.classList.add(ClassNames.NotThisMonth);
-            } else if ((iterYear == year && dayIterator.getUTCMonth() > month) || (month == 11 && iterMonth == 0)) {
+            else if (!iterMonth.equals(month)) {
                 element.classList.add(ClassNames.Available);
                 element.classList.add(ClassNames.NotThisMonth);
-            } else if (isNaN(time)) {
-                element.innerText = "-";
-                element.classList.add(ClassNames.Unavailable);
             } else
                 element.classList.add(ClassNames.Available);
             dayIterator.setUTCDate(dayIterator.getUTCDate() + 1);
         }
     }
-
-    this.picker.today.disabled = !this.picker.isValidDate(parseDateString().getTime());
 };
 
 /**
- * @param {!number} year
- * @param {!number} month
- */
-DaysTable.prototype._navigateToMonth = function(year, month) {
-    this.picker.yearMonthController.setYearMonth(year, month);
-    this._renderMonth(year, month);
-};
-
-/**
- * @param {!number} year
- * @param {!number} month
+ * @param {!Month} month
+ * @param {!bool} animate
+ * @param {!bool} keepSelectionPosition
  */
-DaysTable.prototype._navigateToMonthWithAnimation = function(year, month) {
-    if (this._currentYear >= 0 && this._currentMonth >= 0) {
-        if (year == this._currentYear && month == this._currentMonth)
-            return;
-        var decreasing = false;
-        if (year < this._currentYear)
-            decreasing = true;
-        else if (year > this._currentYear)
-            decreasing = false;
-        else
-            decreasing = month < this._currentMonth;
+DaysTable.prototype.navigateToMonth = function(month, animate, keepSelectionPosition) {
+    var firstNodeInSelectedRange = this._firstNodeInSelectedRange();
+    if (animate) {
         var daysStyle = this._daysContainer.style;
         daysStyle.position = "relative";
         daysStyle.webkitTransition = "left 0.1s ease";
-        daysStyle.left = (decreasing ? "" : "-") + this._daysContainer.offsetWidth + "px";
+        daysStyle.left = (this.picker.currentMonth().valueOf() > month.valueOf() ? "" : "-") + this._daysContainer.offsetWidth + "px";
+    }
+    this._renderMonth(month);
+    if (keepSelectionPosition && firstNodeInSelectedRange) {
+        var x = parseInt(firstNodeInSelectedRange.dataset.positionX, 10);
+        var y = parseInt(firstNodeInSelectedRange.dataset.positionY, 10);
+        this._selectRangeAtPosition(x, y);
     }
-    this._navigateToMonth(year, month);
 };
 
 DaysTable.prototype._moveInDays = function() {
@@ -982,29 +1152,14 @@ DaysTable.prototype._moveInDays = function() {
 };
 
 /**
- * @param {!number} year
- * @param {!number} month
+ * @param {!Day} day
  */
-DaysTable.prototype.navigateToMonthAndKeepSelectionPosition = function(year, month) {
-    if (year == this._currentYear && month == this._currentMonth)
-        return;
-    this._navigateToMonthWithAnimation(year, month);
-    if (this._hasSelection())
-        this._days[this._y][this._x].classList.add(ClassNames.Selected);
-};
-
-/**
- * @param {!Date} date
- */
-DaysTable.prototype.selectDate = function(date) {
-    this._navigateToMonthWithAnimation(date.getUTCFullYear(), date.getUTCMonth());
-    var dateString = serializeDate(date.getUTCFullYear(), date.getUTCMonth(), date.getUTCDate());
+DaysTable.prototype._markRangeAsSelected = function(day) {
+    var dateString = day.toString();
     for (var w = 0; w < DaysTable._Weeks; w++) {
         for (var d = 0; d < 7; d++) {
             if (this._days[w][d].dataset.submitValue == dateString) {
                 this._days[w][d].classList.add(ClassNames.Selected);
-                this._x = d;
-                this._y = w;
                 break;
             }
         }
@@ -1012,20 +1167,85 @@ DaysTable.prototype.selectDate = function(date) {
 };
 
 /**
+ * @param {!Day} day
+ */
+DaysTable.prototype.selectRange = function(day) {
+    this._deselect();
+    if (this.startDate() > day.startDate() || this.endDate() < day.endDate())
+        this.picker.showMonth(Month.createFromDate(day.startDate()), false);
+    this._markRangeAsSelected(day);
+};
+
+/**
+ * @param {!Day} day
+ */
+DaysTable.prototype.selectRangeAndShowEntireRange = function(day) {
+    this.selectRange(day);
+};
+
+/**
+ * @param {!Element} dayNode
+ */
+DaysTable.prototype._selectRangeContainingNode = function(dayNode) {
+    var range = this._rangeForNode(dayNode);
+    if (!range)
+        return;
+    this.selectRange(range);
+};
+
+/**
+ * @param {!Element} dayNode
+ * @return {?Day}
+ */
+DaysTable.prototype._rangeForNode = function(dayNode) {
+    if (!dayNode)
+        return null;
+    return Day.parse(dayNode.dataset.submitValue);
+};
+
+/**
+ * @return {!Date}
+ */
+DaysTable.prototype.startDate = function() {
+    return Day.parse(this._days[0][0].dataset.submitValue).startDate();
+};
+
+/**
+ * @return {!Date}
+ */
+DaysTable.prototype.endDate = function() {
+    return Day.parse(this._days[DaysTable._Weeks - 1][7 - 1].dataset.submitValue).endDate();
+};
+
+/**
+ * @param {!number} x
+ * @param {!number} y
+ */
+DaysTable.prototype._selectRangeAtPosition = function(x, y) {
+    this._selectRangeContainingNode(this._days[y][x]);
+};
+
+/**
+ * @return {!Element}
+ */
+DaysTable.prototype._firstNodeInSelectedRange = function() {
+    return this._daysContainer.getElementsByClassName(ClassNames.Selected)[0];
+};
+
+DaysTable.prototype._deselect = function() {
+    var selectedNodes = this._daysContainer.getElementsByClassName(ClassNames.Selected);
+    for (var node = selectedNodes[0]; node; node = selectedNodes[0])
+        node.classList.remove(ClassNames.Selected);
+};
+
+/**
  * @return {!boolean}
  */
 DaysTable.prototype._maybeSetPreviousMonth = function() {
-    var year = this.picker.yearMonthController.year();
-    var month = this.picker.yearMonthController.month();
-    var thisMonthStartTime = createUTCDate(year, month, 1).getTime();
-    if (this.picker.minimumDate.getTime() >= thisMonthStartTime)
+    var previousMonth = this.picker.currentMonth().previous();
+    if (!this.picker.shouldShowMonth(previousMonth))
         return false;
-    if (month == 0) {
-        year--;
-        month = 11;
-    } else
-        month--;
-    this._navigateToMonthWithAnimation(year, month);
+    this.picker.showMonth(previousMonth, true);
     return true;
 };
 
@@ -1033,17 +1253,10 @@ DaysTable.prototype._maybeSetPreviousMonth = function() {
  * @return {!boolean}
  */
 DaysTable.prototype._maybeSetNextMonth = function() {
-    var year = this.picker.yearMonthController.year();
-    var month = this.picker.yearMonthController.month();
-    if (month == 11) {
-        year++;
-        month = 0;
-    } else
-        month++;
-    var nextMonthStartTime = createUTCDate(year, month, 1).getTime();
-    if (this.picker.maximumDate.getTime() < nextMonthStartTime)
+    var nextMonth = this.picker.currentMonth().next();
+    if (!this.picker.shouldShowMonth(nextMonth))
         return false;
-    this._navigateToMonthWithAnimation(year, month);
+    this.picker.showMonth(nextMonth, true);
     return true;
 };
 
@@ -1060,26 +1273,16 @@ DaysTable.prototype._handleDayClick = function(event) {
  */
 DaysTable.prototype._handleMouseOver = function(event) {
     var node = event.target;
-    if (this._hasSelection())
-        this._days[this._y][this._x].classList.remove(ClassNames.Selected);
-    if (!node.classList.contains(ClassNames.Day)) {
-        this._x = -1;
-        this._y = -1;
+    if (node.classList.contains(ClassNames.Selected))
         return;
-    }
-    node.classList.add(ClassNames.Selected);
-    this._x = Number(node.dataset.positionX);
-    this._y = Number(node.dataset.positionY);
+    this._selectRangeContainingNode(node);
 };
 
 /**
  * @param {Event} event
  */
 DaysTable.prototype._handleMouseOut = function(event) {
-    if (this._hasSelection())
-        this._days[this._y][this._x].classList.remove(ClassNames.Selected);
-    this._x = -1;
-    this._y = -1;
+    this._deselect();
 };
 
 /**
@@ -1087,9 +1290,14 @@ DaysTable.prototype._handleMouseOut = function(event) {
  */
 DaysTable.prototype._handleKey = function(event) {
     this.picker.maybeUpdateFocusStyle();
-    var x = this._x;
-    var y = this._y;
+    var x = -1;
+    var y = -1;
     var key = event.keyIdentifier;
+    var firstNodeInSelectedRange = this._firstNodeInSelectedRange();
+    if (firstNodeInSelectedRange) {
+        x = parseInt(firstNodeInSelectedRange.dataset.positionX, 10);
+        y = parseInt(firstNodeInSelectedRange.dataset.positionY, 10);
+    }
     if (!this._hasSelection() && (key == "Left" || key == "Up" || key == "Right" || key == "Down")) {
         // Put the selection on a center cell.
         this.updateSelection(event, 3, Math.floor(DaysTable._Weeks / 2 - 1));
@@ -1158,8 +1366,7 @@ DaysTable.prototype._handleKey = function(event) {
         }
 
     } else if (key == "U+0054") { // 't'
-        this._days[this._y][this._x].classList.remove(ClassNames.Selected);
-        this.selectDate(new Date());
+        this.selectRangeAndShowEntireRange(Day.createFromToday());
         event.stopPropagation();
         event.preventDefault();
     }
@@ -1171,18 +1378,108 @@ DaysTable.prototype._handleKey = function(event) {
  * @param {!number} y
  */
 DaysTable.prototype.updateSelection = function(event, x, y) {
-    if (this._hasSelection())
-        this._days[this._y][this._x].classList.remove(ClassNames.Selected);
-    if (x >= 0 && y >= 0) {
-        this._days[y][x].classList.add(ClassNames.Selected);
-        this._x = x;
-        this._y = y;
-    }
+    this._selectRangeAtPosition(x, y);
     event.stopPropagation();
     event.preventDefault();
 };
 
 /**
+ * @constructor
+ * @param{!CalendarPicker} picker
+ */
+function MonthPickerDaysTable(picker) {
+    DaysTable.call(this, picker);
+}
+MonthPickerDaysTable.prototype = Object.create(DaysTable.prototype);
+
+/**
+ * @param {!Month} month
+ */
+MonthPickerDaysTable.prototype._markRangeAsSelected = function(month) {
+    var monthString = month.toString();
+    for (var w = 0; w < DaysTable._Weeks; w++) {
+        for (var d = 0; d < 7; d++) {
+            if (this._days[w][d].dataset.monthValue == monthString) {
+                this._days[w][d].classList.add(ClassNames.Selected);
+            }
+        }
+    }
+};
+
+/**
+ * @param {!Month} month
+ */
+MonthPickerDaysTable.prototype.selectRange = function(month) {
+    this._deselect();
+    if (this.startDate() >= month.endDate() || this.endDate() <= month.startDate())
+        this.picker.showMonth(month, true);
+    this._markRangeAsSelected(month);
+};
+
+/**
+ * @param {!Month} month
+ */
+MonthPickerDaysTable.prototype.selectRangeAndShowEntireRange = function(month) {
+    this._deselect();
+    this.picker.showMonth(month, true);
+    this._markRangeAsSelected(month);
+};
+
+/**
+ * @param {!Element} dayNode
+ * @return {?Month}
+ */
+MonthPickerDaysTable.prototype._rangeForNode = function(dayNode) {
+    if (!dayNode)
+        return null;
+    return Month.parse(dayNode.dataset.monthValue);
+};
+
+/**
+ * @param {Event} event
+ */
+MonthPickerDaysTable.prototype._handleKey = function(event) {
+    this.picker.maybeUpdateFocusStyle();
+    var key = event.keyIdentifier;
+    var eventHandled = false;
+    var currentMonth = this.picker.currentMonth();
+    var firstNodeInSelectedRange = this._firstNodeInSelectedRange();
+    if (!firstNodeInSelectedRange
+        && (key == "Right" || key == "Left" || key == "Up" || key == "Down" || key == "PageUp" || key == "PageDown")) {
+        this.selectRange(currentMonth);
+        event.stopPropagation();
+        event.preventDefault();
+        return;
+    }
+    var selectedMonth = this._rangeForNode(firstNodeInSelectedRange);
+    if (key == (global.params.isCalendarRTL ? "Right" : "Left") || key == "Up" || key == "PageUp") {
+        if (selectedMonth.valueOf() > currentMonth.valueOf())
+            this.selectRangeAndShowEntireRange(currentMonth);
+        else
+            this.selectRangeAndShowEntireRange(currentMonth.previous());
+        eventHandled = true;
+    } else if (key == (global.params.isCalendarRTL ? "Left" : "Right") || key == "Down" || key == "PageDown") {
+        if (selectedMonth.valueOf() < currentMonth.valueOf())
+            this.selectRangeAndShowEntireRange(currentMonth);
+        else
+            this.selectRangeAndShowEntireRange(currentMonth.next());
+        eventHandled = true;
+    } else if (this._hasSelection() && key == "Enter") {
+        if (currentSelection) {
+            this.picker.submitValue(currentSelection.toString());
+            eventHandled = true;
+        }
+    } else if (key == "U+0054") { // 't'
+        this.selectRangeAndShowEntireRange(Month.createFromToday());
+        eventHandled = true;
+    }
+    if (eventHandled) {
+        event.stopPropagation();
+        event.preventDefault();
+    }
+};
+
+/**
  * @param {!Event} event
  */
 CalendarPicker.prototype._handleBodyKeyDown = function(event) {
@@ -1199,11 +1496,11 @@ CalendarPicker.prototype._handleBodyKeyDown = function(event) {
             this.lastFocusableControl.focus();
         }
     } else if (key == "U+004D") { // 'm'
-        this.yearMonthController.moveRelatively(event.shiftKey ? YearMonthController.PreviousMonth : YearMonthController.NextMonth);
+        this._yearMonthController.moveRelatively(event.shiftKey ? YearMonthController.PreviousMonth : YearMonthController.NextMonth);
     } else if (key == "U+0059") { // 'y'
-        this.yearMonthController.moveRelatively(event.shiftKey ? YearMonthController.PreviousYear : YearMonthController.NextYear);
+        this._yearMonthController.moveRelatively(event.shiftKey ? YearMonthController.PreviousYear : YearMonthController.NextYear);
     } else if (key == "U+0044") { // 'd'
-        this.yearMonthController.moveRelatively(event.shiftKey ? YearMonthController.PreviousTenYears : YearMonthController.NextTenYears);
+        this._yearMonthController.moveRelatively(event.shiftKey ? YearMonthController.PreviousTenYears : YearMonthController.NextTenYears);
     } else if (key == "U+001B") // ESC
         this.handleCancel();
 }
diff --git a/Source/WebCore/Resources/pagepopups/pickerCommon.js b/Source/WebCore/Resources/pagepopups/pickerCommon.js
index 0e9ce7ab4..2d3e5ea4b 100644
--- a/Source/WebCore/Resources/pagepopups/pickerCommon.js
+++ b/Source/WebCore/Resources/pagepopups/pickerCommon.js
@@ -45,7 +45,7 @@ function createElement(tagName, opt_class, opt_text) {
     return element;
 }
 
-function Rect(xOrRect, y, width, height) {
+function Rectangle(xOrRect, y, width, height) {
     if (typeof xOrRect === "object") {
         y = xOrRect.y;
         width = xOrRect.width;
@@ -58,18 +58,18 @@ function Rect(xOrRect, y, width, height) {
     this.height = height;
 }
 
-Rect.prototype = {
+Rectangle.prototype = {
     get maxX() { return this.x + this.width; },
     get maxY() { return this.y + this.height; },
-    toString: function() { return "Rect(" + this.x + "," + this.y + "," + this.width + "," + this.height + ")"; }
+    toString: function() { return "Rectangle(" + this.x + "," + this.y + "," + this.width + "," + this.height + ")"; }
 };
 
 /**
- * @param {!number} Rect
- * @param {!number} Rect
- * @return {?Rect}
+ * @param {!Rectangle} rect1
+ * @param {!Rectangle} rect2
+ * @return {?Rectangle}
  */
-Rect.intersection = function(rect1, rect2) {
+Rectangle.intersection = function(rect1, rect2) {
     var x = Math.max(rect1.x, rect2.x);
     var maxX = Math.min(rect1.maxX, rect2.maxX);
     var y = Math.max(rect1.y, rect2.y);
@@ -78,7 +78,7 @@ Rect.intersection = function(rect1, rect2) {
     var height = maxY - y;
     if (width < 0 || height < 0)
         return null;
-    return new Rect(x, y, width, height);
+    return new Rectangle(x, y, width, height);
 };
 
 /**
@@ -94,7 +94,7 @@ function resizeWindow(width, height) {
  * @param {!number} height
  * @param {?number} minWidth
  * @param {?number} minHeight
- * @return {!Rect}
+ * @return {!Rectangle}
  */
 function adjustWindowRect(width, height, minWidth, minHeight) {
     if (typeof minWidth !== "number")
@@ -102,16 +102,16 @@ function adjustWindowRect(width, height, minWidth, minHeight) {
     if (typeof minHeight !== "number")
         minHeight = 0;
 
-    var windowRect = new Rect(0, 0, width, height);
+    var windowRect = new Rectangle(0, 0, width, height);
 
     if (!global.params.anchorRectInScreen)
         return windowRect;
 
-    var anchorRect = new Rect(global.params.anchorRectInScreen);
-    var rootViewRect = new Rect(global.params.rootViewRectInScreen);
-    var availRect = new Rect(window.screen.availLeft, window.screen.availTop, window.screen.availWidth, window.screen.availHeight);
+    var anchorRect = new Rectangle(global.params.anchorRectInScreen);
+    var rootViewRect = new Rectangle(global.params.rootViewRectInScreen);
+    var availRect = new Rectangle(window.screen.availLeft, window.screen.availTop, window.screen.availWidth, window.screen.availHeight);
     if (global.params.confineToRootView)
-        availRect = Rect.intersection(availRect, rootViewRect) || new Rect(0, 0, 0, 0);
+        availRect = Rectangle.intersection(availRect, rootViewRect) || new Rectangle(0, 0, 0, 0);
 
     _adjustWindowRectVertically(windowRect, availRect, anchorRect, minHeight);
     _adjustWindowRectHorizontally(windowRect, availRect, anchorRect, minWidth);
@@ -151,7 +151,7 @@ function _adjustWindowRectHorizontally(windowRect, availRect, anchorRect, minWid
 }
 
 /**
- * @param {!Rect} rect
+ * @param {!Rectangle} rect
  */
 function setWindowRect(rect) {
     if (window.frameElement) {
@@ -163,6 +163,17 @@ function setWindowRect(rect) {
     }
 }
 
+function hideWindow() {
+    setWindowRect(new Rectangle(0, 0, 1, 1));
+}
+
+window.addEventListener("resize", function() {
+    if (window.innerWidth === 1 && window.innerHeight === 1)
+        window.dispatchEvent(new CustomEvent("didHide"));
+    else
+        window.dispatchEvent(new CustomEvent("didOpenPicker"));
+}, false);
+
 /**
  * @return {!number}
  */
diff --git a/Source/WebCore/Resources/pagepopups/suggestionPicker.js b/Source/WebCore/Resources/pagepopups/suggestionPicker.js
index 503494d75..e42d7c1db 100644
--- a/Source/WebCore/Resources/pagepopups/suggestionPicker.js
+++ b/Source/WebCore/Resources/pagepopups/suggestionPicker.js
@@ -190,10 +190,16 @@ SuggestionPicker.prototype.selectEntry = function(entry) {
     if (typeof entry.dataset.value !== "undefined") {
         this.submitValue(entry.dataset.value);
     } else if (entry.dataset.action === SuggestionPicker.ActionNames.OpenCalendarPicker) {
-        openCalendarPicker();
+        window.addEventListener("didHide", SuggestionPicker._handleWindowDidHide, false);
+        hideWindow();
     }
 };
 
+SuggestionPicker._handleWindowDidHide = function() {
+    openCalendarPicker();
+    window.removeEventListener("didHide", SuggestionPicker._handleWindowDidHide);
+};
+
 /**
  * @param {!Event} event
  */
diff --git a/Source/WebCore/Target.pri b/Source/WebCore/Target.pri
index f2c4d6d85..54aed1336 100644
--- a/Source/WebCore/Target.pri
+++ b/Source/WebCore/Target.pri
@@ -72,7 +72,6 @@ SOURCES += \
      bindings/js/BindingState.cpp \
      bindings/js/CallbackFunction.cpp \
      bindings/js/DOMObjectHashTableMap.cpp \
-     bindings/js/DOMTransaction.cpp \
      bindings/js/DOMWrapperWorld.cpp \
      bindings/js/Dictionary.cpp \
      bindings/js/GCController.cpp \
@@ -181,7 +180,6 @@ SOURCES += \
      bindings/js/JSTouchCustom.cpp \
      bindings/js/JSTouchListCustom.cpp \
      bindings/js/JSTreeWalkerCustom.cpp \
-     bindings/js/JSUndoManagerCustom.cpp \
      bindings/js/JSWebKitAnimationCustom.cpp \
      bindings/js/JSWebKitAnimationListCustom.cpp \
      bindings/js/JSWebKitCSSKeyframeRuleCustom.cpp \
@@ -339,6 +337,7 @@ SOURCES += \
     css/WebKitCSSSVGDocumentValue.cpp \
     css/WebKitCSSShaderValue.cpp \
     css/WebKitCSSTransformValue.cpp \
+    css/WebKitCSSViewportRule.cpp \
     dom/ActiveDOMObject.cpp \
     dom/Attr.cpp \
     dom/BeforeTextInsertedEvent.cpp \
@@ -387,8 +386,9 @@ SOURCES += \
     dom/DynamicNodeList.cpp \
     dom/EditingText.cpp \
     dom/Element.cpp \
-    dom/ElementShadow.cpp \
     dom/ElementAttributeData.cpp \
+    dom/ElementRareData.cpp \
+    dom/ElementShadow.cpp \
     dom/EntityReference.cpp \
     dom/ErrorEvent.cpp \
     dom/Event.cpp \
@@ -427,6 +427,7 @@ SOURCES += \
     dom/NodeFilterCondition.cpp \
     dom/NodeFilter.cpp \
     dom/NodeIterator.cpp \
+    dom/NodeRareData.cpp \
     dom/NodeRenderingContext.cpp \
     dom/Notation.cpp \
     dom/StaticHashSetNodeList.cpp \
@@ -557,6 +558,7 @@ SOURCES += \
     history/PageCache.cpp \
     html/BaseButtonInputType.cpp \
     html/BaseCheckableInputType.cpp \
+    html/BaseChooserOnlyDateAndTimeInputType.cpp \
     html/BaseClickableWithKeyInputType.cpp \
     html/BaseDateAndTimeInputType.cpp \
     html/BaseMultipleFieldsDateAndTimeInputType.cpp \
@@ -802,6 +804,7 @@ SOURCES += \
     loader/appcache/ManifestParser.cpp \
     loader/archive/ArchiveResource.cpp \
     loader/archive/ArchiveResourceCollection.cpp \
+    loader/CachedMetadata.cpp \
     loader/cache/MemoryCache.cpp \
     loader/cache/CachedCSSStyleSheet.cpp \
     loader/cache/CachedFont.cpp \
@@ -834,6 +837,7 @@ SOURCES += \
     loader/icon/IconLoader.cpp \
     loader/ImageLoader.cpp \
     loader/LinkLoader.cpp \
+    loader/LoaderStrategy.cpp \
     loader/MainResourceLoader.cpp \
     loader/MixedContentChecker.cpp \
     loader/NavigationAction.cpp \
@@ -932,7 +936,7 @@ SOURCES += \
     platform/text/Hyphenation.cpp \
     platform/text/LocaleNone.cpp \
     platform/text/LocaleToScriptMappingDefault.cpp \
-    platform/text/Localizer.cpp \
+    platform/text/PlatformLocale.cpp \
     platform/text/QuotedPrintable.cpp \
     platform/CalculationValue.cpp \
     platform/Clock.cpp \
@@ -1322,7 +1326,6 @@ HEADERS += \
     bindings/js/JSDOMBinding.h \
     bindings/js/JSDOMGlobalObject.h \
     bindings/js/JSDOMStringMapCustom.h \
-    bindings/js/DOMTransaction.h \
     bindings/js/JSDOMWindowBase.h \
     bindings/js/JSDOMWindowCustom.h \
     bindings/js/JSDOMWindowShell.h \
@@ -1511,6 +1514,7 @@ HEADERS += \
     css/WebKitCSSSVGDocumentValue.h \
     css/WebKitCSSShaderValue.h \
     css/WebKitCSSTransformValue.h \
+    css/WebKitCSSViewportRule.h \
     dom/ActiveDOMObject.h \
     dom/Attr.h \
     dom/Attribute.h \
@@ -1593,6 +1597,7 @@ HEADERS += \
     dom/NodeFilter.h \
     dom/Node.h \
     dom/NodeIterator.h \
+    dom/NodeRareData.h \
     dom/NodeRenderingContext.h \
     dom/Notation.h \
     dom/StaticHashSetNodeList.h \
@@ -1962,6 +1967,7 @@ HEADERS += \
     loader/ImageLoader.h \
     loader/LinkLoader.h \
     loader/LinkLoaderClient.h \
+    loader/LoaderStrategy.h \
     loader/MainResourceLoader.h \
     loader/MixedContentChecker.h \
     loader/NavigationAction.h \
@@ -2075,9 +2081,12 @@ HEADERS += \
     platform/graphics/filters/CustomFilterNumberParameter.h \
     platform/graphics/filters/CustomFilterCompiledProgram.h \
     platform/graphics/filters/CustomFilterOperation.h \
+    platform/graphics/filters/ValidatedCustomFilterOperation.h \
     platform/graphics/filters/CustomFilterParameter.h \
+    platform/graphics/filters/CustomFilterParameterList.h \
     platform/graphics/filters/CustomFilterProgram.h \
     platform/graphics/filters/CustomFilterProgramInfo.h \
+    platform/graphics/filters/CustomFilterRenderer.h \
     platform/graphics/filters/CustomFilterTransformParameter.h \
     platform/graphics/filters/CustomFilterValidatedProgram.h \
     platform/graphics/filters/FEBlend.h \
@@ -2870,8 +2879,9 @@ win32-*|wince* {
 
 mac {
     SOURCES += \
-        platform/text/cf/StringCF.cpp \
         platform/cf/SharedBufferCF.cpp \
+        platform/text/cf/AtomicStringCF.cpp \
+        platform/text/cf/StringCF.cpp \
         platform/text/cf/StringImplCF.cpp
 }
 
@@ -3490,11 +3500,14 @@ enable?(FILTERS) {
     SOURCES += \
         platform/graphics/filters/CustomFilterGlobalContext.cpp \
         platform/graphics/filters/CustomFilterOperation.cpp \
+        platform/graphics/filters/CustomFilterParameterList.cpp \
+        platform/graphics/filters/ValidatedCustomFilterOperation.cpp \
         platform/graphics/filters/CustomFilterProgram.cpp \
         platform/graphics/filters/CustomFilterProgramInfo.cpp \
         platform/graphics/filters/CustomFilterCompiledProgram.cpp \
         platform/graphics/filters/CustomFilterMesh.cpp \
         platform/graphics/filters/CustomFilterMeshGenerator.cpp \
+        platform/graphics/filters/CustomFilterRenderer.cpp \
         platform/graphics/filters/CustomFilterValidatedProgram.cpp \
         platform/graphics/filters/DistantLightSource.cpp \
         platform/graphics/filters/FEBlend.cpp \
@@ -4006,13 +4019,6 @@ enable?(MHTML) {
         page/PageSerializer.cpp
 }
 
-enable?(UNDO_MANAGER) {
-    SOURCES += \
-        editing/UndoManager.cpp
-    HEADERS += \
-        editing/UndoManager.h
-}
-
 use?(LIBPNG) {
     SOURCES += platform/image-decoders/ico/ICOImageDecoder.cpp \
                platform/image-decoders/png/PNGImageDecoder.cpp
@@ -4062,11 +4068,19 @@ use?(GRAPHICS_SURFACE) {
         SOURCES += platform/graphics/surfaces/mac/GraphicsSurfaceMac.cpp
         INCLUDEPATH += /System/Library/Frameworks/CoreFoundation.framework/Headers
     }
+    win32 {
+        SOURCES += platform/graphics/surfaces/win/GraphicsSurfaceWin.cpp
+    }
     have?(XCOMPOSITE) {
         SOURCES += platform/graphics/surfaces/qt/GraphicsSurfaceGLX.cpp
     }
 }
 
+if(build?(drt)|build?(wtr)) {
+    HEADERS += platform/qt/QtTestSupport.h
+    SOURCES += platform/qt/QtTestSupport.cpp
+}
+
 ALL_IN_ONE_SOURCES += \
     accessibility/AccessibilityAllInOne.cpp \
     inspector/InspectorAllInOne.cpp \
diff --git a/Source/WebCore/UseJSC.cmake b/Source/WebCore/UseJSC.cmake
index ba6ce697b..da604bc6b 100644
--- a/Source/WebCore/UseJSC.cmake
+++ b/Source/WebCore/UseJSC.cmake
@@ -283,13 +283,6 @@ IF (ENABLE_WEB_INTENTS)
     )
 ENDIF ()
 
-IF (ENABLE_UNDO_MANAGER)
-    LIST (APPEND WebCore_SOURCES
-        bindings/js/DOMTransaction.cpp
-        bindings/js/JSUndoManagerCustom.cpp
-    )
-ENDIF ()
-
 LIST(APPEND SCRIPTS_BINDINGS
     ${WEBCORE_DIR}/bindings/scripts/CodeGenerator.pm
     ${WEBCORE_DIR}/bindings/scripts/CodeGeneratorJS.pm
diff --git a/Source/WebCore/UseV8.cmake b/Source/WebCore/UseV8.cmake
index 82b1da4fa..b6358f7c7 100644
--- a/Source/WebCore/UseV8.cmake
+++ b/Source/WebCore/UseV8.cmake
@@ -207,15 +207,6 @@ IF (ENABLE_SVG)
     )
 ENDIF ()
 
-IF (ENABLE_UNDO_MANAGER)
-    LIST(APPEND WebCore_SOURCES
-        bindings/v8/DOMTransaction.cpp
-
-        bindings/v8/custom/V8DOMTransactionCustom.cpp
-        bindings/v8/custom/V8UndoManagerCustom.cpp
-    )
-ENDIF ()
-
 LIST(APPEND SCRIPTS_BINDINGS
     ${WEBCORE_DIR}/bindings/scripts/CodeGenerator.pm
     ${WEBCORE_DIR}/bindings/scripts/CodeGeneratorV8.pm
diff --git a/Source/WebCore/WebCore.exp.in b/Source/WebCore/WebCore.exp.in
index 2677c88a6..0564ffb47 100644
--- a/Source/WebCore/WebCore.exp.in
+++ b/Source/WebCore/WebCore.exp.in
@@ -62,6 +62,7 @@ __Z4coreP7DOMNode
 __Z4coreP8DOMRange
 __ZN3JSC8Bindings8Instance16newRuntimeObjectEPNS_9ExecStateE
 __ZN3WTF10StringImplcvP8NSStringEv
+__ZN3WTF12AtomicString3addEPK10__CFString
 __ZN3WTF6StringC1EP8NSString
 __ZN3WTF6StringC1EPK10__CFString
 __ZN7WebCore10ClientRectC1ERKNS_7IntRectE
@@ -214,6 +215,8 @@ __ZN7WebCore13AXObjectCache21gAccessibilityEnabledE
 __ZN7WebCore13AXObjectCache23focusedUIElementForPageEPKNS_4PageE
 __ZN7WebCore13AXObjectCache42gAccessibilityEnhancedUserInterfaceEnabledE
 __ZN7WebCore13CharacterData7setDataERKN3WTF6StringERi
+__ZN7WebCore13ContainerNode11appendChildEN3WTF10PassRefPtrINS_4NodeEEERib
+__ZN7WebCore13ContainerNode11removeChildEPNS_4NodeERi
 __ZN7WebCore13HTTPHeaderMapC1Ev
 __ZN7WebCore13HTTPHeaderMapD1Ev
 __ZN7WebCore13HitTestResultC1ERKS0_
@@ -225,6 +228,8 @@ __ZN7WebCore13KeyboardEventC1ERKN3WTF12AtomicStringEbbPNS_9DOMWindowERKNS1_6Stri
 __ZN7WebCore13KeyboardEventC1ERKNS_21PlatformKeyboardEventEPNS_9DOMWindowE
 __ZN7WebCore13ResourceErrorC1EP7NSError
 __ZN7WebCore13ResourceErrorC1EP9__CFError
+__ZN7WebCore13StyledElement22setInlineStylePropertyENS_13CSSPropertyIDERKN3WTF6StringEb
+__ZN7WebCore13StyledElement22setInlineStylePropertyENS_13CSSPropertyIDEdNS_17CSSPrimitiveValue9UnitTypesEb
 __ZN7WebCore13createWrapperEPN3JSC9ExecStateEPNS_17JSDOMGlobalObjectEPNS_4NodeE
 __ZN7WebCore13directoryNameERKN3WTF6StringE
 __ZN7WebCore13toHTMLElementEPNS_21FormAssociatedElementE
@@ -263,12 +268,18 @@ __ZN7WebCore14FrameSelection5clearEv
 __ZN7WebCore14FrameSelection6modifyENS0_11EAlterationENS_18SelectionDirectionENS_15TextGranularityENS_14EUserTriggeredE
 __ZN7WebCore14FrameSelection9selectAllEv
 __ZN7WebCore14FrameSelectionC1EPNS_5FrameE
+__ZN7WebCore14LoaderStrategy21resourceLoadSchedulerEv
+__ZN7WebCore14PluginDocument10pluginNodeEv
+__ZNK7WebCore5Frame25trackedRepaintRectsAsTextEv
+__ZN7WebCore9FrameView17setTracksRepaintsEb
+__ZN7WebCore9FrameView20resetTrackedRepaintsEv
 __ZN7WebCore14PluginDocument12pluginWidgetEv
 __ZN7WebCore14ResourceBuffer12createNSDataEv
 __ZN7WebCore14ResourceBufferD1Ev
 __ZN7WebCore14ResourceHandle20forceContentSniffingEv
 __ZN7WebCore14ResourceHandle26synchronousLoadRunLoopModeEv
 __ZN7WebCore14ResourceHandle35createPrivateBrowsingStorageSessionEPK10__CFString
+__ZN7WebCore14ResourceLoader13setIdentifierEm
 __ZN7WebCore14ResourceLoader14cancelledErrorEv
 __ZN7WebCore14SchemeRegistry24registerURLSchemeAsLocalERKN3WTF6StringE
 __ZN7WebCore14SchemeRegistry25registerURLSchemeAsSecureERKN3WTF6StringE
@@ -409,6 +420,7 @@ __ZN7WebCore16DeviceMotionData12RotationRate6createEbdbdbd
 __ZN7WebCore16DeviceMotionData6createEN3WTF10PassRefPtrINS0_12AccelerationEEES4_NS2_INS0_12RotationRateEEEbd
 __ZN7WebCore16FontFallbackList15releaseFontDataEv
 __ZN7WebCore16FontPlatformDataD1Ev
+__ZN7WebCore16HTMLInputElement8setValueERKN3WTF6StringENS_22TextFieldEventBehaviorE
 __ZN7WebCore16HTMLInputElement13setAutofilledEb
 __ZN7WebCore16HTMLInputElement15setEditingValueERKN3WTF6StringE
 __ZN7WebCore16HTMLInputElement15setValueForUserERKN3WTF6StringE
@@ -471,6 +483,7 @@ __ZN7WebCore17JSDOMGlobalObject6s_infoE
 __ZN7WebCore17languageDidChangeEv
 __ZN7WebCore17RegularExpressionC1ERKN3WTF6StringENS1_19TextCaseSensitivityE
 __ZN7WebCore17RegularExpressionD1Ev
+__ZN7WebCore17SubresourceLoader6createEPNS_5FrameEPNS_14CachedResourceERKNS_15ResourceRequestERKNS_21ResourceLoaderOptionsE
 __ZN7WebCore17ViewportArguments19deprecatedTargetDPIE
 __ZN7WebCore17cacheDOMStructureEPNS_17JSDOMGlobalObjectEPN3JSC9StructureEPKNS2_9ClassInfoE
 __ZN7WebCore17openTemporaryFileERKN3WTF6StringERi
@@ -522,6 +535,7 @@ __ZN7WebCore19LayerFlushScheduler7suspendEv
 __ZN7WebCore19LayerFlushScheduler8scheduleEv
 __ZN7WebCore19LayerFlushSchedulerC1EPNS_25LayerFlushSchedulerClientE
 __ZN7WebCore19LayerFlushSchedulerD1Ev
+__ZN7WebCore19HTMLTextAreaElement8setValueERKN3WTF6StringE
 __ZN7WebCore19ResourceRequestBase11setHTTPBodyEN3WTF10PassRefPtrINS_8FormDataEEE
 __ZN7WebCore19ResourceRequestBase13setHTTPMethodERKN3WTF6StringE
 __ZN7WebCore19ResourceRequestBase18setHTTPHeaderFieldEPKcRKN3WTF6StringE
@@ -557,8 +571,19 @@ __ZN7WebCore20SpaceSplitStringDataD1Ev
 __ZN7WebCore21BackForwardController11itemAtIndexEi
 __ZN7WebCore21MemoryPressureHandler7installEv
 __ZN7WebCore21PlatformKeyboardEvent24disambiguateKeyDownEventENS_13PlatformEvent4TypeEb
+__ZN7WebCore21ResourceLoadScheduler19addMainResourceLoadEPNS_14ResourceLoaderE
+__ZN7WebCore21ResourceLoadScheduler19startResourceLoaderEPNS_14ResourceLoaderE
 __ZN7WebCore21ResourceLoadScheduler20servePendingRequestsENS_20ResourceLoadPriorityE
+__ZN7WebCore21ResourceLoadScheduler20servePendingRequestsEPNS0_15HostInformationENS_20ResourceLoadPriorityE
+__ZN7WebCore21ResourceLoadScheduler21resumePendingRequestsEv
+__ZN7WebCore21ResourceLoadScheduler22suspendPendingRequestsEv
+__ZN7WebCore21ResourceLoadScheduler23scheduleSubresourceLoadEPNS_5FrameEPNS_14CachedResourceERKNS_15ResourceRequestENS_20ResourceLoadPriorityERKNS_21ResourceLoaderOptionsE
 __ZN7WebCore21ResourceLoadScheduler24schedulePluginStreamLoadEPNS_5FrameEPNS_32NetscapePlugInStreamLoaderClientERKNS_15ResourceRequestE
+__ZN7WebCore21ResourceLoadScheduler27crossOriginRedirectReceivedEPNS_14ResourceLoaderERKNS_4KURLE
+__ZN7WebCore21ResourceLoadScheduler32notifyDidScheduleResourceRequestEPNS_14ResourceLoaderE
+__ZN7WebCore21ResourceLoadScheduler6removeEPNS_14ResourceLoaderE
+__ZN7WebCore21ResourceLoadSchedulerC2Ev
+__ZN7WebCore21ResourceLoadSchedulerD2Ev
 __ZN7WebCore21SerializedScriptValue11deserializeEPK15OpaqueJSContextPPK13OpaqueJSValue
 __ZN7WebCore21SerializedScriptValue6createEPK15OpaqueJSContextPK13OpaqueJSValuePS6_
 __ZN7WebCore21SerializedScriptValueC1ERN3WTF6VectorIhLm0EEE
@@ -631,6 +656,7 @@ __ZN7WebCore25ImmutableStylePropertySetD1Ev
 __ZN7WebCore25addLanguageChangeObserverEPvPFvS0_E
 __ZN7WebCore25computeViewportAttributesENS_17ViewportArgumentsEiiifNS_7IntSizeE
 __ZN7WebCore25jsStringWithCacheSlowCaseEPN3JSC9ExecStateERN3WTF7HashMapIPNS3_10StringImplENS0_4WeakINS0_8JSStringEEENS3_7PtrHashIS6_EENS3_10HashTraitsIS6_EENSC_IS9_EEEES6_
+__ZN7WebCore26NetscapePlugInStreamLoader6createEPNS_5FrameEPNS_32NetscapePlugInStreamLoaderClientERKNS_15ResourceRequestE
 __ZN7WebCore26UserTypingGestureIndicator27processingUserTypingGestureEv
 __ZN7WebCore26UserTypingGestureIndicator28focusedElementAtGestureStartEv
 __ZN7WebCore26stopObservingCookieChangesEv
@@ -677,6 +703,7 @@ __ZN7WebCore4Node10renderRectEPb
 __ZN7WebCore4Node11appendChildEN3WTF10PassRefPtrIS0_EERib
 __ZN7WebCore4Node11removeChildEPS0_Ri
 __ZN7WebCore4Node14removedLastRefEv
+__ZN7WebCore4Node14setTextContentERKN3WTF6StringERi
 __ZN7WebCore4Node17stopIgnoringLeaksEv
 __ZN7WebCore4Node18startIgnoringLeaksEv
 __ZN7WebCore4Node19setNeedsStyleRecalcENS_15StyleChangeTypeE
@@ -703,6 +730,7 @@ __ZN7WebCore4Page21markAllMatchesForTextERKN3WTF6StringEjbj
 __ZN7WebCore4Page22allVisitedStateChangedEPNS_9PageGroupE
 __ZN7WebCore4Page23clearUndoRedoOperationsEv
 __ZN7WebCore4Page24resumeScriptedAnimationsEv
+__ZN7WebCore4Page24scrollingStateTreeAsTextEv
 __ZN7WebCore4Page25suspendScriptedAnimationsEv
 __ZN7WebCore4Page31setCustomHTMLTokenizerChunkSizeEi
 __ZN7WebCore4Page31setCustomHTMLTokenizerTimeDelayEd
@@ -827,6 +855,7 @@ __ZN7WebCore6toNodeEN3JSC7JSValueE
 __ZN7WebCore7Console21shouldPrintExceptionsEv
 __ZN7WebCore7Console24setShouldPrintExceptionsEb
 __ZN7WebCore7Element12setAttributeERKN3WTF12AtomicStringES4_Ri
+__ZN7WebCore7Element12setAttributeERKNS_13QualifiedNameERKN3WTF12AtomicStringE
 __ZN7WebCore7Element17setShadowPseudoIdERKN3WTF12AtomicStringERi
 __ZN7WebCore7Element21boundsInRootViewSpaceEv
 __ZN7WebCore7Element9innerTextEv
@@ -859,6 +888,7 @@ __ZN7WebCore7toRangeEN3JSC7JSValueE
 __ZN7WebCore8CSSValue7destroyEv
 __ZN7WebCore8Document11createRangeEv
 __ZN7WebCore8Document12updateLayoutEv
+__ZN7WebCore8Document13createElementERKNS_13QualifiedNameEb
 __ZN7WebCore8Document14createTextNodeERKN3WTF6StringE
 __ZN7WebCore8Document14setFocusedNodeEN3WTF10PassRefPtrINS_4NodeEEE
 __ZN7WebCore8Document16isPageBoxVisibleEi
@@ -963,6 +993,8 @@ __ZN7WebCore8Settings40setTextDirectionSubmenuInclusionBehaviorENS_37TextDirecti
 __ZN7WebCore8Settings41setNeedsKeyboardEventDisambiguationQuirksEb
 __ZN7WebCore8Settings44setLoadsSiteIconsIgnoringImageLoadingSettingEb
 __ZN7WebCore8Settings45setShouldRespectPriorityInCSSAttributeSettersEb
+__ZN7WebCore8Settings21setResolutionOverrideERKNS_7IntSizeE
+__ZN7WebCore8Settings20setMediaTypeOverrideERKN3WTF6StringE
 __ZN7WebCore8blankURLEv
 __ZN7WebCore8makeRGBAEiiii
 __ZN7WebCore8openFileERKN3WTF6StringENS_12FileOpenModeE
@@ -990,7 +1022,6 @@ __ZN7WebCore9FrameView16setPaintBehaviorEj
 __ZN7WebCore9FrameView17addScrollableAreaEPNS_14ScrollableAreaE
 __ZN7WebCore9FrameView17paintControlTintsEv
 __ZN7WebCore9FrameView17setScrollPositionERKNS_8IntPointE
-__ZN7WebCore9FrameView17setTracksRepaintsEb
 __ZN7WebCore9FrameView18updateControlTintsEv
 __ZN7WebCore9FrameView19scrollElementToRectEPNS_7ElementERKNS_7IntRectE
 __ZN7WebCore9FrameView20enterCompositingModeEv
@@ -1043,11 +1074,18 @@ __ZN7WebCore9HTMLNames8frameTagE
 __ZN7WebCore9HTMLNames8hrefAttrE
 __ZN7WebCore9HTMLNames8inputTagE
 __ZN7WebCore9HTMLNames8nameAttrE
+__ZN7WebCore9HTMLNames8styleTagE
 __ZN7WebCore9HTMLNames8videoTagE
 __ZN7WebCore9HTMLNames9appletTagE
+__ZN7WebCore9HTMLNames9classAttrE
 __ZN7WebCore9HTMLNames9iframeTagE
 __ZN7WebCore9HTMLNames9objectTagE
+__ZN7WebCore9HTMLNames9optionTagE
 __ZN7WebCore9HTMLNames9scriptTagE
+__ZN7WebCore9HTMLNames9selectTagE
+__ZN7WebCore9HTMLNames9styleAttrE
+__ZN7WebCore9HTMLNames9valueAttrE
+__ZN7WebCore9HTMLNames12selectedAttrE
 __ZN7WebCore9JSElement6s_infoE
 __ZN7WebCore9PageCache11setCapacityEi
 __ZN7WebCore9PageCache27releaseAutoreleasedPagesNowEv
@@ -1194,6 +1232,7 @@ __ZNK7WebCore14DocumentLoader17parsedArchiveDataEv
 __ZNK7WebCore14DocumentLoader17reportMemoryUsageEPN3WTF16MemoryObjectInfoE
 __ZNK7WebCore14DocumentLoader19isLoadingInAPISenseEv
 __ZNK7WebCore14DocumentLoader19originalRequestCopyEv
+__ZNK7WebCore14DocumentLoader21archiveResourceForURLERKNS_4KURLE
 __ZNK7WebCore14DocumentLoader21isLoadingMainResourceEv
 __ZNK7WebCore14DocumentLoader28urlForHistoryReflectsFailureEv
 __ZNK7WebCore14DocumentLoader3urlEv
@@ -1260,6 +1299,7 @@ __ZNK7WebCore16VisibleSelection19rootEditableElementEv
 __ZNK7WebCore16VisibleSelection23isContentRichlyEditableEv
 __ZNK7WebCore16VisibleSelection5isAllENS_27EditingBoundaryCrossingRuleE
 __ZNK7WebCore17HTMLPlugInElement12pluginWidgetEv
+__ZNK7WebCore17HTMLSelectElement5valueEv
 __ZNK7WebCore17JSDOMGlobalObject22scriptExecutionContextEv
 __ZNK7WebCore17RegularExpression13matchedLengthEv
 __ZNK7WebCore17RegularExpression5matchERKN3WTF6StringEiPi
@@ -1326,6 +1366,7 @@ __ZNK7WebCore4KURL8protocolEv
 __ZNK7WebCore4KURLcvP5NSURLEv
 __ZNK7WebCore4Node11textContentEb
 __ZN7WebCore4Node12insertBeforeEN3WTF10PassRefPtrIS0_EEPS0_Rib
+__ZNK7WebCore4Node13ownerDocumentEv
 __ZNK7WebCore4Node14isDescendantOfEPKS0_
 __ZNK7WebCore4Node18getSubresourceURLsERN3WTF11ListHashSetINS_4KURLELm256ENS_8KURLHashEEE
 __ZNK7WebCore4Node20traversePreviousNodeEPKS0_
@@ -1340,7 +1381,9 @@ __ZNK7WebCore4Page17viewportArgumentsEv
 __ZNK7WebCore4Page34inLowQualityImageInterpolationModeEv
 __ZNK7WebCore4Page9groupNameEv
 __ZNK7WebCore4Page9pageCountEv
+__ZNK7WebCore4Node9textRectsERN3WTF6VectorINS_7IntRectELm0EEE
 __ZNK7WebCore5Color7getRGBAERdS1_S1_S1_
+__ZNK7WebCore5Color10serializedEv
 __ZNK7WebCore5Frame13ownerRendererEv
 __ZNK7WebCore5Frame14selectionImageEb
 __ZNK7WebCore5Frame15contentRendererEv
@@ -1360,6 +1403,7 @@ __ZNK7WebCore5Range9collapsedERi
 __ZNK7WebCore5Range9endOffsetERi
 __ZNK7WebCore5Range9firstNodeEv
 __ZNK7WebCore5Range9textQuadsERN3WTF6VectorINS_9FloatQuadELm0EEEbPNS0_20RangeInFixedPositionE
+__ZNK7WebCore5Range9textRectsERN3WTF6VectorINS_7IntRectELm0EEEbPNS0_20RangeInFixedPositionE
 __ZNK7WebCore6Chrome12createWindowEPNS_5FrameERKNS_16FrameLoadRequestERKNS_14WindowFeaturesERKNS_16NavigationActionE
 __ZNK7WebCore6Editor12selectedTextEv
 __ZNK7WebCore6Editor13canEditRichlyEv
@@ -1403,7 +1447,6 @@ __ZNK7WebCore7IntRect10intersectsERKS0_
 __ZNK7WebCore7IntRect8containsERKS0_
 __ZNK7WebCore7IntRectcv6CGRectEv
 __ZNK7WebCore7RunLoop9TimerBase8isActiveEv
-__ZNK7WebCore8Document10renderViewEv
 __ZNK7WebCore8Document11completeURLERKN3WTF6StringE
 __ZNK7WebCore8Document13axObjectCacheEv
 __ZNK7WebCore8Document13nodesFromRectEiijjjjbb
@@ -1447,6 +1490,7 @@ __ZNK7WebCore9PageCache10frameCountEv
 __ZNK7WebCore9PageCache21autoreleasedPageCountEv
 __ZNK7WebCore9TreeScope14getElementByIdERKN3WTF12AtomicStringE
 __ZTVN7WebCore12ChromeClientE
+__ZTVN7WebCore14LoaderStrategyE
 __ZTVN7WebCore16IconDatabaseBaseE
 __ZTVN7WebCore17FrameLoaderClientE
 __ZTVN7WebCore25HistoryPropertyListWriterE
@@ -1476,6 +1520,7 @@ _wkCreateCTLineWithUniCharProvider
 _wkCreateCustomCFReadStream
 _wkCreateNSURLConnectionDelegateProxy
 _wkCreatePrivateStorageSession
+_wkDeleteAllHTTPCookies
 _wkDeleteHTTPCookie
 _wkGetCFURLResponseHTTPResponse
 _wkGetCFURLResponseMIMEType
@@ -1485,13 +1530,13 @@ _wkGetHTTPPipeliningPriority
 _wkGetMIMETypeForExtension
 _wkGetNSURLResponseLastModifiedDate
 _wkGetUserToBaseCTM
+_wkHTTPCookies
 _wkHTTPCookiesForURL
 _wkInitializeMaximumHTTPConnectionCountPerHost
 _wkSetBaseCTM
 _wkSetCFURLResponseMIMEType
 _wkSetCONNECTProxyAuthorizationForStream
 _wkSetCONNECTProxyForStream
-_wkSetCookieStoragePrivateBrowsingEnabled
 _wkSetHTTPCookieAcceptPolicy
 _wkSetHTTPCookiesForURL
 _wkSetHTTPPipeliningMaximumPriority
@@ -2057,6 +2102,11 @@ __ZNK7WebCore7Element26fastAttributeLookupAllowedERKNS_13QualifiedNameE
 __ZN7WebCore36initializeLoggingChannelsIfNecessaryEv
 #endif // !LOG_DISABLED
 
+#if !ASSERT_DISABLED
+__ZN7WebCore27NoExceptionAssertionCheckerC1EPKci
+__ZN7WebCore27NoExceptionAssertionCheckerD1Ev
+#endif // !ASSERT_DISABLED
+
 #if !defined(NSGEOMETRY_TYPES_SAME_AS_CGGEOMETRY_TYPES) && !PLATFORM(IOS)
 __ZN7WebCore7IntSizeC1ERK7_NSSize
 __ZNK7WebCore7IntSizecv7_NSSizeEv
@@ -2143,17 +2193,11 @@ __ZN7WebCore12SchedulePairC1EP9NSRunLoopPK10__CFString
 __ZN7WebCore14ResourceHandle12releaseProxyEv
 #endif
 
-#if USE(CFURLSTORAGESESSIONS)
 __ZN7WebCore14ResourceHandle46setPrivateBrowsingStorageSessionIdentifierBaseERKN3WTF6StringE
 __ZN7WebCore14ResourceHandle21currentStorageSessionEv
 __ZN7WebCore14ResourceHandle29privateBrowsingStorageSessionEv
 __ZN7WebCore26currentCFHTTPCookieStorageEv
-#if !PLATFORM(IOS) && __MAC_OS_X_VERSION_MIN_REQUIRED == 1060
-__ZN7WebCore14ResourceHandle24setDefaultStorageSessionEP21__CFURLStorageSession
-#else
 __ZN7WebCore14ResourceHandle24setDefaultStorageSessionEPK21__CFURLStorageSession
-#endif
-#endif
 
 #if ENABLE(CONTEXT_MENUS)
 __ZN7WebCore11ContextMenu22setPlatformDescriptionEP14NSMutableArray
@@ -2622,3 +2666,18 @@ __ZN7WebCore27AlternativeTextUIController16showAlternativesEP6NSViewRKNS_9FloatR
 __ZN7WebCore24TextAlternativeWithRangeC1EP18NSTextAlternatives8_NSRange
 __ZN7WebCore32collectDictationTextAlternativesEP18NSAttributedStringRN3WTF6VectorINS_24TextAlternativeWithRangeELm0EEE
 #endif
+
+#if ENABLE(VIDEO_TRACK)
+_wkCaptionAppearanceHasUserPreferences
+_wkCaptionAppearanceShowCaptionsWhenAvailable
+_wkCaptionAppearanceCopyForegroundColor
+_wkCaptionAppearanceCopyBackgroundColor
+_wkCaptionAppearanceCopyWindowColor
+_wkCaptionAppearanceGetForegroundOpacity
+_wkCaptionAppearanceGetBackgroundOpacity
+_wkCaptionAppearanceGetWindowOpacity
+_wkCaptionAppearanceCopyFontForStyle
+_wkCaptionAppearanceGetRelativeCharacterSize
+_wkCaptionAppearanceGetTextEdgeStyle
+_wkCaptionAppearanceGetSettingsChangedNotification
+#endif
diff --git a/Source/WebCore/WebCore.gyp/WebCore.gyp b/Source/WebCore/WebCore.gyp/WebCore.gyp
index 2269be72c..2190572c0 100644
--- a/Source/WebCore/WebCore.gyp/WebCore.gyp
+++ b/Source/WebCore/WebCore.gyp/WebCore.gyp
@@ -113,6 +113,7 @@
       '../platform/graphics/chromium/cc',
       '../platform/graphics/filters',
       '../platform/graphics/filters/arm',
+      '../platform/graphics/filters/skia',
       '../platform/graphics/gpu',
       '../platform/graphics/opentype',
       '../platform/graphics/skia',
@@ -1876,8 +1877,8 @@
 
             ['exclude', 'platform/text/LocaleICU\\.cpp$'],
             ['exclude', 'platform/text/LocaleICU\\.h$'],
-            ['include', 'platform/text/LocaleWin\.cpp$'],
-            ['include', 'platform/text/LocaleWin\.h$'],
+            ['include', 'platform/text/win/LocaleWin\.cpp$'],
+            ['include', 'platform/text/win/LocaleWin\.h$'],
           ],
         },{ # OS!="win"
           'sources/': [
@@ -2032,6 +2033,7 @@
         'WEBKIT_IMPLEMENTATION=1',
       ],
       'dependencies': [
+        '<(chromium_src_dir)/third_party/v8-i18n/build/all.gyp:v8-i18n',
         'webcore_prerequisites',
       ],
       # This is needed for mac because of webkit_system_interface. It'd be nice
@@ -2129,11 +2131,6 @@
             '-fno-strict-aliasing',
           ],
         }, { # OS!="android"
-          'dependencies': [
-            # Android doesn't have this third party repository, so can't
-            # include it. It's not used by Android in any case.
-            '<(chromium_src_dir)/third_party/v8-i18n/build/all.gyp:v8-i18n',
-          ],
           'sources/': [['exclude', 'Android\\.cpp$']]
         }],
         ['OS!="mac"', {
diff --git a/Source/WebCore/WebCore.gypi b/Source/WebCore/WebCore.gypi
index b1c7a1e81..a29c86a37 100644
--- a/Source/WebCore/WebCore.gypi
+++ b/Source/WebCore/WebCore.gypi
@@ -172,6 +172,7 @@
             'loader/FrameLoadRequest.h',
             'loader/FrameNetworkingContext.h',
             'loader/HistoryController.h',
+            'loader/LoaderStrategy.h',
             'loader/NavigationAction.h',
             'loader/NavigationScheduler.h',
             'loader/NetscapePlugInStreamLoader.h',
@@ -632,6 +633,7 @@
             'rendering/style/StyleVariableData.h',
             'rendering/style/StyleVisualData.h',
             'rendering/svg/SVGResourcesCache.h',
+            'workers/SharedWorkerStrategy.h',
             'workers/WorkerRunLoop.h',
             'workers/WorkerThread.h',
         ],
@@ -1048,8 +1050,6 @@
             'dom/WebKitNamedFlow.idl',
             'dom/WebKitTransitionEvent.idl',
             'dom/WheelEvent.idl',
-            'editing/DOMTransaction.idl',
-            'editing/UndoManager.idl',
             'fileapi/Blob.idl',
             'fileapi/File.idl',
             'fileapi/FileError.idl',
@@ -1893,6 +1893,8 @@
             'accessibility/AccessibilitySlider.h',
             'accessibility/AccessibilitySpinButton.cpp',
             'accessibility/AccessibilitySpinButton.h',
+            'accessibility/AccessibilitySVGRoot.cpp',
+            'accessibility/AccessibilitySVGRoot.h',
             'accessibility/AccessibilityTable.cpp',
             'accessibility/AccessibilityTable.h',
             'accessibility/AccessibilityTableCell.cpp',
@@ -1996,8 +1998,6 @@
             'bindings/js/CallbackFunction.cpp',
             'bindings/js/CallbackFunction.h',
             'bindings/js/DOMObjectHashTableMap.cpp',
-            'bindings/js/DOMTransaction.cpp',
-            'bindings/js/DOMTransaction.h',
             'bindings/js/DOMWrapperWorld.cpp',
             'bindings/js/GCController.cpp',
             'bindings/js/IDBBindingUtilities.cpp',
@@ -2152,7 +2152,6 @@
             'bindings/js/JSTrackCustom.h',
             'bindings/js/JSTrackEventCustom.cpp',
             'bindings/js/JSTreeWalkerCustom.cpp',
-            'bindings/js/JSUndoManagerCustom.cpp',
             'bindings/js/JSWebGLRenderingContextCustom.cpp',
             'bindings/js/JSWebKitAnimationCustom.cpp',
             'bindings/js/JSWebKitAnimationListCustom.cpp',
@@ -2225,12 +2224,9 @@
             'bindings/v8/ArrayValue.h',
             'bindings/v8/BindingState.cpp',
             'bindings/v8/BindingState.h',
-            'bindings/v8/DOMData.cpp',
-            'bindings/v8/DOMData.h',
             'bindings/v8/DOMDataStore.cpp',
             'bindings/v8/DOMDataStore.h',
-            'bindings/v8/DOMTransaction.cpp',
-            'bindings/v8/DOMTransaction.h',
+            'bindings/v8/DOMWrapperMap.h',
             'bindings/v8/DOMWrapperWorld.cpp',
             'bindings/v8/DOMWrapperWorld.h',
             'bindings/v8/DateExtension.cpp',
@@ -2253,8 +2249,6 @@
             'bindings/v8/RetainedObjectInfo.h',
             'bindings/v8/ScheduledAction.cpp',
             'bindings/v8/ScheduledAction.h',
-            'bindings/v8/ScopedDOMDataStore.cpp',
-            'bindings/v8/ScopedDOMDataStore.h',
             'bindings/v8/ScopedPersistent.h',
             'bindings/v8/ScriptCachedFrameData.cpp',
             'bindings/v8/ScriptCachedFrameData.h',
@@ -2296,8 +2290,6 @@
             'bindings/v8/SerializedScriptValue.cpp',
             'bindings/v8/SerializedScriptValue.h',
             'bindings/v8/SharedPersistent.h',
-            'bindings/v8/StaticDOMDataStore.cpp',
-            'bindings/v8/StaticDOMDataStore.h',
             'bindings/v8/V8AbstractEventListener.cpp',
             'bindings/v8/V8AbstractEventListener.h',
             'bindings/v8/V8Binding.cpp',
@@ -2385,7 +2377,6 @@
             'bindings/v8/custom/V8CustomXPathNSResolver.h',
             'bindings/v8/custom/V8DOMFormDataCustom.cpp',
             'bindings/v8/custom/V8DOMStringMapCustom.cpp',
-            'bindings/v8/custom/V8DOMTransactionCustom.cpp',
             'bindings/v8/custom/V8DOMWindowCustom.cpp',
             'bindings/v8/custom/V8DataViewCustom.cpp',
             'bindings/v8/custom/V8DedicatedWorkerContextCustom.cpp',
@@ -2456,7 +2447,6 @@
             'bindings/v8/custom/V8StyleSheetCustom.cpp',
             'bindings/v8/custom/V8StyleSheetListCustom.cpp',
             'bindings/v8/custom/V8TrackEventCustom.cpp',
-            'bindings/v8/custom/V8UndoManagerCustom.cpp',
             'bindings/v8/custom/V8WebGLRenderingContextCustom.cpp',
             'bindings/v8/custom/V8WebKitAnimationCustom.cpp',
             'bindings/v8/custom/V8WebKitPointConstructor.cpp',
@@ -2677,6 +2667,8 @@
             'css/WebKitCSSSVGDocumentValue.cpp',
             'css/WebKitCSSSVGDocumentValue.h',
             'css/WebKitCSSTransformValue.cpp',
+            'css/WebKitCSSViewportRule.h',
+            'css/WebKitCSSViewportRule.cpp',
             'editing/AlternativeTextController.cpp',
             'editing/AlternativeTextController.h',
             'editing/AppendNodeCommand.cpp',
@@ -2689,8 +2681,6 @@
             'editing/CompositeEditCommand.cpp',
             'editing/CreateLinkCommand.cpp',
             'editing/CreateLinkCommand.h',
-            'editing/DOMTransactionStep.cpp',
-            'editing/DOMTransactionStep.h',
             'editing/DeleteButton.cpp',
             'editing/DeleteButton.h',
             'editing/DeleteButtonController.cpp',
@@ -2767,8 +2757,6 @@
             'editing/TextInsertionBaseCommand.h',
             'editing/TextIterator.cpp',
             'editing/TypingCommand.cpp',
-            'editing/UndoManager.cpp',
-            'editing/UndoManager.h',
             'editing/UndoStep.h',
             'editing/UnlinkCommand.cpp',
             'editing/UnlinkCommand.h',
@@ -2971,6 +2959,7 @@
             'inspector/WorkerInspectorController.h',
             'inspector/WorkerRuntimeAgent.cpp',
             'inspector/WorkerRuntimeAgent.h',
+            'loader/CachedMetadata.cpp',
             'loader/CachedMetadata.h',
             'loader/CrossOriginAccessControl.cpp',
             'loader/CrossOriginAccessControl.h',
@@ -2996,6 +2985,8 @@
             'loader/LinkLoader.cpp',
             'loader/LinkLoader.h',
             'loader/LinkLoaderClient.h',
+            'loader/LoaderStrategy.cpp',
+            'loader/LoaderStrategy.h',
             'loader/MainResourceLoader.cpp',
             'loader/MainResourceLoader.h',
             'loader/MixedContentChecker.cpp',
@@ -3853,6 +3844,7 @@
             'dom/ElementShadow.cpp',
             'dom/Element.cpp',
             'dom/ElementAttributeData.cpp',
+            'dom/ElementRareData.cpp',
             'dom/ElementRareData.h',
             'dom/Entity.h',
             'dom/EntityReference.cpp',
@@ -3922,6 +3914,7 @@
             'dom/NodeFilterCondition.h',
             'dom/NodeIterator.cpp',
             'dom/NodeIterator.h',
+            'dom/NodeRareData.cpp',
             'dom/NodeRareData.h',
             'dom/NodeRenderingContext.cpp',
             'dom/NodeRenderingContext.h',
@@ -4026,6 +4019,8 @@
             'html/BaseButtonInputType.h',
             'html/BaseCheckableInputType.cpp',
             'html/BaseCheckableInputType.h',
+            'html/BaseChooserOnlyDateAndTimeInputType.cpp',
+            'html/BaseChooserOnlyDateAndTimeInputType.h',
             'html/BaseClickableWithKeyInputType.cpp',
             'html/BaseClickableWithKeyInputType.h',
             'html/BaseDateAndTimeInputType.cpp',
@@ -4700,6 +4695,7 @@
             'platform/chromium/LinkHashChromium.cpp',
             'platform/chromium/MemoryUsageSupportChromium.cpp',
             'platform/chromium/MIMETypeRegistryChromium.cpp',
+            'platform/chromium/PageClientChromium.h',
             'platform/chromium/PasteboardChromium.cpp',
             'platform/chromium/PlatformCursor.h',
             'platform/chromium/PlatformKeyboardEventChromium.cpp',
@@ -4769,7 +4765,6 @@
             'platform/efl/ScrollbarEfl.h',
             'platform/efl/ScrollbarThemeEfl.cpp',
             'platform/efl/ScrollbarThemeEfl.h',
-            'platform/efl/SharedBufferEfl.cpp',
             'platform/efl/SharedTimerEfl.cpp',
             'platform/efl/SoundEfl.cpp',
             'platform/efl/SystemTimeEfl.cpp',
@@ -4976,11 +4971,17 @@
             'platform/graphics/filters/CustomFilterNumberParameter.h',
             'platform/graphics/filters/CustomFilterOperation.cpp',
             'platform/graphics/filters/CustomFilterOperation.h',
+            'platform/graphics/filters/ValidatedCustomFilterOperation.cpp',
+            'platform/graphics/filters/ValidatedCustomFilterOperation.h',
             'platform/graphics/filters/CustomFilterParameter.h',
+            'platform/graphics/filters/CustomFilterParameterList.cpp',
+            'platform/graphics/filters/CustomFilterParameterList.h',
             'platform/graphics/filters/CustomFilterProgram.cpp',
             'platform/graphics/filters/CustomFilterProgram.h',
             'platform/graphics/filters/CustomFilterProgramInfo.cpp',
             'platform/graphics/filters/CustomFilterProgramInfo.h',
+            'platform/graphics/filters/CustomFilterRenderer.cpp',
+            'platform/graphics/filters/CustomFilterRenderer.h',
             'platform/graphics/filters/CustomFilterCompiledProgram.cpp',
             'platform/graphics/filters/CustomFilterCompiledProgram.h',
             'platform/graphics/filters/CustomFilterValidatedProgram.cpp',
@@ -5055,6 +5056,8 @@
             'platform/graphics/filters/skia/FEGaussianBlurSkia.cpp',
             'platform/graphics/filters/skia/FEMorphologySkia.cpp',
             'platform/graphics/filters/skia/FELightingSkia.cpp',
+            'platform/graphics/filters/skia/SkiaImageFilterBuilder.cpp',
+            'platform/graphics/filters/skia/SkiaImageFilterBuilder.h',
             'platform/graphics/freetype/FontCacheFreeType.cpp',
             'platform/graphics/freetype/FontCustomPlatformDataFreeType.cpp',
             'platform/graphics/freetype/FontPlatformData.h',
@@ -5536,8 +5539,6 @@
             'platform/network/Credential.cpp',
             'platform/network/CredentialStorage.cpp',
             'platform/network/DNS.h',
-            'platform/network/DNSResolveQueue.cpp',
-            'platform/network/DNSResolveQueue.h',
             'platform/network/DataURL.cpp',
             'platform/network/DataURL.h',
             'platform/network/FormData.cpp',
@@ -5628,7 +5629,6 @@
             'platform/network/mac/WebCoreURLResponse.mm',
             'platform/network/qt/AuthenticationChallenge.h',
             'platform/network/qt/CredentialStorageQt.cpp',
-            'platform/network/qt/DNSQt.cpp',
             'platform/network/qt/NetworkStateNotifierPrivate.h',
             'platform/network/qt/NetworkStateNotifierQt.cpp',
             'platform/network/qt/ProxyServerQt.cpp',
@@ -5662,7 +5662,6 @@
             'platform/network/soup/SoupURIUtils.h',
             'platform/network/win/AuthenticationChallenge.h',
             'platform/network/win/CookieJarWin.cpp',
-            'platform/network/win/CookieStorageWin.cpp',
             'platform/network/win/DownloadBundleWin.cpp',
             'platform/network/win/NetworkStateNotifierWin.cpp',
             'platform/network/win/ProxyServerWin.cpp',
@@ -5726,11 +5725,9 @@
             'platform/text/LocaleToScriptMapping.h',
             'platform/text/LocaleToScriptMappingDefault.cpp',
             'platform/text/LocaleToScriptMappingICU.cpp',
-            'platform/text/LocaleWin.cpp',
-            'platform/text/LocaleWin.h',
-            'platform/text/Localizer.cpp',
-            'platform/text/Localizer.h',
             'platform/text/ParserUtilities.h',
+            'platform/text/PlatformLocale.cpp',
+            'platform/text/PlatformLocale.h',
             'platform/text/QuotedPrintable.h',
             'platform/text/QuotedPrintable.cpp',
             'platform/text/RegularExpression.cpp',
@@ -5755,6 +5752,7 @@
             'platform/text/TextEncodingRegistry.cpp',
             'platform/text/TextStream.cpp',
             'platform/text/UnicodeRange.cpp',
+            'platform/text/cf/AtomicStringCF.cpp',
             'platform/text/cf/HyphenationCF.cpp',
             'platform/text/cf/StringCF.cpp',
             'platform/text/cf/StringImplCF.cpp',
@@ -5779,6 +5777,8 @@
             'platform/text/qt/TextCodecQt.h',
             'platform/text/transcoder/FontTranscoder.cpp',
             'platform/text/transcoder/FontTranscoder.h',
+            'platform/text/win/LocaleWin.cpp',
+            'platform/text/win/LocaleWin.h',
             'platform/text/win/TextBreakIteratorInternalICUWin.cpp',
             'platform/text/win/TextCodecWin.cpp',
             'platform/text/win/TextCodecWin.h',
@@ -6334,6 +6334,7 @@
             'svg/animation/SVGSMILElement.cpp',
             'svg/graphics/SVGImageCache.cpp',
             'svg/graphics/SVGImageCache.h',
+            'svg/graphics/SVGImageChromeClient.h',
             'svg/graphics/SVGImage.cpp',
             'svg/graphics/SVGImage.h',
             'svg/graphics/filters/SVGFEImage.cpp',
@@ -6435,6 +6436,7 @@
             'inspector/front-end/NetworkLog.js',
             'inspector/front-end/NetworkPanelDescriptor.js',
             'inspector/front-end/NetworkRequest.js',
+            'inspector/front-end/NetworkWorkspaceProvider.js',
             'inspector/front-end/NetworkUISourceCodeProvider.js',
             'inspector/front-end/Object.js',
             'inspector/front-end/ObjectPopoverHelper.js',
@@ -6506,6 +6508,7 @@
             'inspector/front-end/inspector.css',
             'inspector/front-end/inspectorSyntaxHighlight.css',
             'inspector/front-end/popover.css',
+            'inspector/front-end/spectrum.css',
             '<@(webinspector_modules_js_files)',
             '<@(webinspector_standalone_css_files)',
         ],
diff --git a/Source/WebCore/WebCore.pri b/Source/WebCore/WebCore.pri
index b3e39ddfe..2958bfd48 100644
--- a/Source/WebCore/WebCore.pri
+++ b/Source/WebCore/WebCore.pri
@@ -286,3 +286,5 @@ unix|win32-g++* {
 
 enable_fast_mobile_scrolling: DEFINES += ENABLE_FAST_MOBILE_SCROLLING=1
 
+!production_build:have?(FONTCONFIG): PKGCONFIG += fontconfig
+
diff --git a/Source/WebCore/WebCore.vcproj/WebCore.vcproj b/Source/WebCore/WebCore.vcproj/WebCore.vcproj
index fd2561c10..f7ae75ae3 100755
--- a/Source/WebCore/WebCore.vcproj/WebCore.vcproj
+++ b/Source/WebCore/WebCore.vcproj/WebCore.vcproj
@@ -4122,62 +4122,6 @@
 				>

 			</File>

 			<File

-				RelativePath="$(ConfigurationBuildDir)\obj\$(ProjectName)\DerivedSources\JSDOMTransaction.cpp"

-				>

-				<FileConfiguration

-					Name="Debug|Win32"

-					ExcludedFromBuild="true"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-					/>

-				</FileConfiguration>

-				<FileConfiguration

-					Name="Release|Win32"

-					ExcludedFromBuild="true"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-					/>

-				</FileConfiguration>

-				<FileConfiguration

-					Name="Debug_Cairo_CFLite|Win32"

-					ExcludedFromBuild="true"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-					/>

-				</FileConfiguration>

-				<FileConfiguration

-					Name="Release_Cairo_CFLite|Win32"

-					ExcludedFromBuild="true"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-					/>

-				</FileConfiguration>

-				<FileConfiguration

-					Name="Debug_All|Win32"

-					ExcludedFromBuild="true"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-					/>

-				</FileConfiguration>

-				<FileConfiguration

-					Name="Production|Win32"

-					ExcludedFromBuild="true"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-					/>

-				</FileConfiguration>

-			</File>

-			<File

-				RelativePath="$(ConfigurationBuildDir)\obj\$(ProjectName)\DerivedSources\JSDOMTransaction.h"

-				>

-			</File>

-			<File

 				RelativePath="$(ConfigurationBuildDir)\obj\$(ProjectName)\DerivedSources\JSDOMURL.cpp"

 				>

 				<FileConfiguration

@@ -22675,62 +22619,6 @@
 				>

 			</File>

 			<File

-				RelativePath="$(ConfigurationBuildDir)\obj\$(ProjectName)\DerivedSources\JSUndoManager.cpp"

-				>

-				<FileConfiguration

-					Name="Debug|Win32"

-					ExcludedFromBuild="true"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-					/>

-				</FileConfiguration>

-				<FileConfiguration

-					Name="Release|Win32"

-					ExcludedFromBuild="true"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-					/>

-				</FileConfiguration>

-				<FileConfiguration

-					Name="Debug_Cairo_CFLite|Win32"

-					ExcludedFromBuild="true"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-					/>

-				</FileConfiguration>

-				<FileConfiguration

-					Name="Release_Cairo_CFLite|Win32"

-					ExcludedFromBuild="true"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-					/>

-				</FileConfiguration>

-				<FileConfiguration

-					Name="Debug_All|Win32"

-					ExcludedFromBuild="true"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-					/>

-				</FileConfiguration>

-				<FileConfiguration

-					Name="Production|Win32"

-					ExcludedFromBuild="true"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-					/>

-				</FileConfiguration>

-			</File>

-			<File

-				RelativePath="$(ConfigurationBuildDir)\obj\$(ProjectName)\DerivedSources\JSUndoManager.h"

-				>

-			</File>

-			<File

 				RelativePath="$(ConfigurationBuildDir)\obj\$(ProjectName)\DerivedSources\JSValidityState.cpp"

 				>

 				<FileConfiguration

@@ -26263,6 +26151,62 @@
 				>

 			</File>

 			<File

+				RelativePath="..\accessibility\AccessibilitySVGRoot.cpp"

+				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo_CFLite|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo_CFLite|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Production|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+			</File>

+			<File

+				RelativePath="..\accessibility\AccessibilitySVGRoot.h"

+				>

+			</File>

+			<File

 				RelativePath="..\accessibility\AccessibilityScrollbar.cpp"

 				>

 				<FileConfiguration

@@ -27463,6 +27407,14 @@
 			Name="loader"

 			>

 			<File

+				RelativePath="..\loader\CachedMetadata.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\loader\CachedMetadata.h"

+				>

+			</File>

+			<File

 				RelativePath="..\loader\CrossOriginAccessControl.cpp"

 				>

 			</File>

@@ -27607,6 +27559,14 @@
 				>

 			</File>

 			<File

+				RelativePath="..\loader\LoaderStrategy.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\loader\LoaderStrategy.h"

+				>

+			</File>

+			<File

 				RelativePath="..\loader\MainResourceLoader.cpp"

 				>

 			</File>

@@ -31913,10 +31873,26 @@
 						>

 					</File>

 					<File

+						RelativePath="..\platform\graphics\filters\ValidatedCustomFilterOperation.cpp"

+						>

+					</File>

+					<File

+						RelativePath="..\platform\graphics\filters\ValidatedCustomFilterOperation.h"

+						>

+					</File>

+					<File

 						RelativePath="..\platform\graphics\filters\CustomFilterParameter.h"

 						>

 					</File>

 					<File

+						RelativePath="..\platform\graphics\filters\CustomFilterParameterList.cpp"

+						>

+					</File>

+					<File

+						RelativePath="..\platform\graphics\filters\CustomFilterParameterList.h"

+						>

+					</File>

+					<File

 						RelativePath="..\platform\graphics\filters\CustomFilterProgram.cpp"

 						>

 					</File>

@@ -31937,6 +31913,14 @@
 						>

 					</File>

 					<File

+						RelativePath="..\platform\graphics\filters\CustomFilterRenderer.cpp"

+						>

+					</File>

+					<File

+						RelativePath="..\platform\graphics\filters\CustomFilterRenderer.h"

+						>

+					</File>

+					<File

 						RelativePath="..\platform\graphics\filters\CustomFilterCompiledProgram.cpp"

 						>

 					</File>

@@ -33702,15 +33686,15 @@
 					>

 				</File>

 				<File

-					RelativePath="..\platform\text\Localizer.cpp"

+					RelativePath="..\platform\text\ParserUtilities.h"

 					>

 				</File>

 				<File

-					RelativePath="..\platform\text\Localizer.h"

+					RelativePath="..\platform\text\PlatformLocale.cpp"

 					>

 				</File>

 				<File

-					RelativePath="..\platform\text\ParserUtilities.h"

+					RelativePath="..\platform\text\PlatformLocale.h"

 					>

 				</File>

 				<File

@@ -34169,6 +34153,10 @@
 					Name="cf"

 					>

 					<File

+						RelativePath="..\platform\text\cf\AtomicStringCF.cpp"

+						>

+					</File>

+					<File

 						RelativePath="..\platform\text\cf\HyphenationCF.cpp"

 						>

 					</File>

@@ -38115,6 +38103,14 @@
 			    >

 			</File>

 			<File

+				RelativePath="..\css\WebKitCSSViewportRule.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\css\WebKitCSSViewportRule.h"

+				>

+			</File>

+			<File

 			    RelativePath="..\css\BasicShapeFunctions.h"

 			    >

 			</File>

@@ -51031,6 +51027,10 @@
 				>

 			</File>

 			<File

+				RelativePath="..\dom\ElementRareData.cpp"

+				>

+			</File>

+			<File

 				RelativePath="..\dom\Entity.h"

 				>

 			</File>

@@ -52807,6 +52807,10 @@
 				>

 			</File>

 			<File

+				RelativePath="..\dom\NodeRareData.cpp"

+				>

+			</File>

+			<File

 				RelativePath="..\dom\NodeFilter.cpp"

 				>

 				<FileConfiguration

@@ -55711,6 +55715,10 @@
 				>

 			</File>

 			<File

+				RelativePath="..\workers\SharedWorkerStrategy.h"

+				>

+			</File>

+			<File

 				RelativePath="..\workers\SharedWorkerThread.cpp"

 				>

 			</File>

@@ -56427,62 +56435,6 @@
 				>

 			</File>

 			<File

-				RelativePath="..\editing\DOMTransactionStep.cpp"

-				>

-				<FileConfiguration

-					Name="Debug|Win32"

-					ExcludedFromBuild="true"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-					/>

-				</FileConfiguration>

-				<FileConfiguration

-					Name="Release|Win32"

-					ExcludedFromBuild="true"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-					/>

-				</FileConfiguration>

-				<FileConfiguration

-					Name="Debug_Cairo_CFLite|Win32"

-					ExcludedFromBuild="true"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-					/>

-				</FileConfiguration>

-				<FileConfiguration

-					Name="Release_Cairo_CFLite|Win32"

-					ExcludedFromBuild="true"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-					/>

-				</FileConfiguration>

-				<FileConfiguration

-					Name="Debug_All|Win32"

-					ExcludedFromBuild="true"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-					/>

-				</FileConfiguration>

-				<FileConfiguration

-					Name="Production|Win32"

-					ExcludedFromBuild="true"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-					/>

-				</FileConfiguration>

-			</File>

-			<File

-				RelativePath="..\editing\DOMTransactionStep.h"

-				>

-			</File>

-			<File

 				RelativePath="..\editing\EditAction.h"

 				>

 			</File>

@@ -58807,62 +58759,6 @@
 				>

 			</File>

 			<File

-				RelativePath="..\editing\UndoManager.cpp"

-				>

-				<FileConfiguration

-					Name="Debug|Win32"

-					ExcludedFromBuild="true"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-					/>

-				</FileConfiguration>

-				<FileConfiguration

-					Name="Release|Win32"

-					ExcludedFromBuild="true"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-					/>

-				</FileConfiguration>

-				<FileConfiguration

-					Name="Debug_Cairo_CFLite|Win32"

-					ExcludedFromBuild="true"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-					/>

-				</FileConfiguration>

-				<FileConfiguration

-					Name="Release_Cairo_CFLite|Win32"

-					ExcludedFromBuild="true"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-					/>

-				</FileConfiguration>

-				<FileConfiguration

-					Name="Debug_All|Win32"

-					ExcludedFromBuild="true"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-					/>

-				</FileConfiguration>

-				<FileConfiguration

-					Name="Production|Win32"

-					ExcludedFromBuild="true"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-					/>

-				</FileConfiguration>

-			</File>

-			<File

-				RelativePath="..\editing\UndoManager.h"

-				>

-			</File>

-			<File

 				RelativePath="..\editing\UndoStep.h"

 				>

 			</File>

@@ -70770,58 +70666,6 @@
 					</FileConfiguration>

 				</File>

 				<File

-					RelativePath="..\bindings\js\JSUndoManagerCustom.cpp"

-					>

-					<FileConfiguration

-						Name="Debug|Win32"

-						ExcludedFromBuild="true"

-						>

-						<Tool

-							Name="VCCLCompilerTool"

-						/>

-					</FileConfiguration>

-					<FileConfiguration

-						Name="Release|Win32"

-						ExcludedFromBuild="true"

-						>

-						<Tool

-							Name="VCCLCompilerTool"

-						/>

-					</FileConfiguration>

-					<FileConfiguration

-						Name="Debug_Cairo_CFLite|Win32"

-						ExcludedFromBuild="true"

-						>

-						<Tool

-							Name="VCCLCompilerTool"

-						/>

-					</FileConfiguration>

-					<FileConfiguration

-						Name="Release_Cairo_CFLite|Win32"

-						ExcludedFromBuild="true"

-						>

-						<Tool

-							Name="VCCLCompilerTool"

-						/>

-					</FileConfiguration>

-					<FileConfiguration

-						Name="Debug_All|Win32"

-						ExcludedFromBuild="true"

-						>

-						<Tool

-							Name="VCCLCompilerTool"

-						/>

-					</FileConfiguration>

-					<FileConfiguration

-						Name="Production|Win32"

-						ExcludedFromBuild="true"

-						>

-						<Tool

-							Name="VCCLCompilerTool"

-						/>

-					</FileConfiguration>

-				</File>

-				<File

 					RelativePath="..\bindings\js\JSWebKitAnimationCustom.cpp"

 					>

 					<FileConfiguration

@@ -73801,6 +73645,10 @@
 					RelativePath="..\svg\graphics\SVGImageCache.h"

 					>

 				</File>

+				<File

+					RelativePath="..\svg\graphics\SVGImageChromeClient.h"

+					>

+				</File>

 				<Filter

 					Name="filters"

 					>

@@ -76546,11 +76394,15 @@
 					>

 				</File>

 				<File

+					RelativePath="..\inspector\front-end\NetworkRequest.js"

+					>

+				</File>

+				<File

 					RelativePath="..\inspector\front-end\NetworkUISourceCodeProvider.js"

 					>

 				</File>

 				<File

-					RelativePath="..\inspector\front-end\NetworkRequest.js"

+					RelativePath="..\inspector\front-end\NetworkWorkspaceProvider.js"

 					>

 				</File>

 				<File

@@ -76838,6 +76690,10 @@
 					>

 				</File>

 				<File

+					RelativePath="..\inspector\front-end\spectrum.css"

+					>

+				</File>

+				<File

 					RelativePath="..\inspector\front-end\splitView.css"

 					>

 				</File>

diff --git a/Source/WebCore/WebCore.xcodeproj/project.pbxproj b/Source/WebCore/WebCore.xcodeproj/project.pbxproj
index 6c158566f..7ebb2654b 100644
--- a/Source/WebCore/WebCore.xcodeproj/project.pbxproj
+++ b/Source/WebCore/WebCore.xcodeproj/project.pbxproj
@@ -122,6 +122,9 @@
 		07846342145B151A00A58DF1 /* JSTrackEvent.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 07846340145B151A00A58DF1 /* JSTrackEvent.cpp */; };
 		07846343145B151A00A58DF1 /* JSTrackEvent.h in Headers */ = {isa = PBXBuildFile; fileRef = 07846341145B151A00A58DF1 /* JSTrackEvent.h */; };
 		07846385145B1B8E00A58DF1 /* JSTrackCustom.h in Headers */ = {isa = PBXBuildFile; fileRef = 07846384145B1B8E00A58DF1 /* JSTrackCustom.h */; };
+		079D0868162F20E800DB8658 /* CaptionUserPreferences.h in Headers */ = {isa = PBXBuildFile; fileRef = 079D0867162F20E800DB8658 /* CaptionUserPreferences.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		079D086B162F21F900DB8658 /* CaptionUserPreferencesMac.h in Headers */ = {isa = PBXBuildFile; fileRef = 079D0869162F21F900DB8658 /* CaptionUserPreferencesMac.h */; };
+		079D086C162F21F900DB8658 /* CaptionUserPreferencesMac.mm in Sources */ = {isa = PBXBuildFile; fileRef = 079D086A162F21F900DB8658 /* CaptionUserPreferencesMac.mm */; };
 		07A6D1EB1491137700051D0C /* MediaFragmentURIParser.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 07A6D1E91491137700051D0C /* MediaFragmentURIParser.cpp */; };
 		07A6D1EC1491137700051D0C /* MediaFragmentURIParser.h in Headers */ = {isa = PBXBuildFile; fileRef = 07A6D1EA1491137700051D0C /* MediaFragmentURIParser.h */; };
 		07B0113F1032242200FBDC33 /* AccessibilityMediaControls.h in Headers */ = {isa = PBXBuildFile; fileRef = 07B0113E1032242200FBDC33 /* AccessibilityMediaControls.h */; };
@@ -206,7 +209,7 @@
 		08C7A2C710DC7462002D368B /* SVGNames.h in Copy Generated Headers */ = {isa = PBXBuildFile; fileRef = 656581E909D1508D000E61D7 /* SVGNames.h */; };
 		08C859C01274575400A5728D /* SVGAnimatedRect.h in Headers */ = {isa = PBXBuildFile; fileRef = 08C859BF1274575300A5728D /* SVGAnimatedRect.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		08C925190FCC7C4A00480DEC /* FilterEffect.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 08C925170FCC7C4A00480DEC /* FilterEffect.cpp */; };
-		08C9251A0FCC7C4A00480DEC /* FilterEffect.h in Headers */ = {isa = PBXBuildFile; fileRef = 08C925180FCC7C4A00480DEC /* FilterEffect.h */; };
+		08C9251A0FCC7C4A00480DEC /* FilterEffect.h in Headers */ = {isa = PBXBuildFile; fileRef = 08C925180FCC7C4A00480DEC /* FilterEffect.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		08CA3D4412894A3800FFF260 /* SVGStaticPropertyWithParentTearOff.h in Headers */ = {isa = PBXBuildFile; fileRef = 08CA3D4312894A3800FFF260 /* SVGStaticPropertyWithParentTearOff.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		08D46CE3127AD5FC0089694B /* SVGAnimatedEnumeration.h in Headers */ = {isa = PBXBuildFile; fileRef = 08D46CE2127AD5FC0089694B /* SVGAnimatedEnumeration.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		08E4FE460E2BD41400F4CAE0 /* JSSVGLengthCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 08E4FE450E2BD41400F4CAE0 /* JSSVGLengthCustom.cpp */; };
@@ -500,6 +503,7 @@
 		1A927FD31416A15B003A83C8 /* npruntime.h in Headers */ = {isa = PBXBuildFile; fileRef = 1A927FD01416A15B003A83C8 /* npruntime.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		1A927FD41416A15B003A83C8 /* nptypes.h in Headers */ = {isa = PBXBuildFile; fileRef = 1A927FD11416A15B003A83C8 /* nptypes.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		1A98956B0AA78F80005EF5EF /* KURLCFNet.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1A98956A0AA78F80005EF5EF /* KURLCFNet.cpp */; };
+		1AA21250163F0DA80000E63F /* AtomicStringCF.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1AA2124F163F0DA80000E63F /* AtomicStringCF.cpp */; };
 		1AA7160A149BC4DB0016EC19 /* TileCache.mm in Sources */ = {isa = PBXBuildFile; fileRef = 1AA71608149BC4DA0016EC19 /* TileCache.mm */; };
 		1AA7160B149BC4DB0016EC19 /* TileCache.h in Headers */ = {isa = PBXBuildFile; fileRef = 1AA71609149BC4DB0016EC19 /* TileCache.h */; };
 		1AA7161E149BF2FA0016EC19 /* WebTileLayer.mm in Sources */ = {isa = PBXBuildFile; fileRef = 1AA7161C149BF2FA0016EC19 /* WebTileLayer.mm */; };
@@ -1027,6 +1031,8 @@
 		3AC648B2129E146500C3EB25 /* EditingBoundary.h in Headers */ = {isa = PBXBuildFile; fileRef = 3AC648B1129E146500C3EB25 /* EditingBoundary.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		3C244FEAA375AC633F88BE6F /* RenderLayerModelObject.h in Headers */ = {isa = PBXBuildFile; fileRef = 3C244FE4A375AC633F88BE6F /* RenderLayerModelObject.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		3C244FEBA375AC633F88BE6F /* RenderLayerModelObject.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 3C244FE5A375AC633F88BE6F /* RenderLayerModelObject.cpp */; };
+		3FFFF9A8159D9A550020BBD5 /* WebKitCSSViewportRule.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 3FFFF9A6159D9A550020BBD5 /* WebKitCSSViewportRule.cpp */; };
+		3FFFF9A9159D9A550020BBD5 /* WebKitCSSViewportRule.h in Headers */ = {isa = PBXBuildFile; fileRef = 3FFFF9A7159D9A550020BBD5 /* WebKitCSSViewportRule.h */; };
 		41002CCD0F66EDEF009E660D /* ScriptFunctionCall.h in Headers */ = {isa = PBXBuildFile; fileRef = 41002CCB0F66EDEF009E660D /* ScriptFunctionCall.h */; };
 		41002CCE0F66EDEF009E660D /* ScriptFunctionCall.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 41002CCC0F66EDEF009E660D /* ScriptFunctionCall.cpp */; };
 		410B7E721045FAB000D8224F /* JSMessageEventCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 410B7E711045FAB000D8224F /* JSMessageEventCustom.cpp */; };
@@ -1479,8 +1485,11 @@
 		4FA3B90A125CD12200300BAD /* InspectorState.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 4FA3B908125CD12100300BAD /* InspectorState.cpp */; };
 		4FA3B90B125CD12200300BAD /* InspectorState.h in Headers */ = {isa = PBXBuildFile; fileRef = 4FA3B909125CD12200300BAD /* InspectorState.h */; };
 		4FB390AD15EF61F3007AD51F /* GeneratedImage.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 4FB390AC15EF61F3007AD51F /* GeneratedImage.cpp */; };
+		4FC8534C1644272300D1C275 /* CachedMetadata.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 4FC853491644271B00D1C275 /* CachedMetadata.cpp */; };
 		4FD8D0F2119C718B002FA825 /* ScriptGCEvent.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 4FD8D0F0119C718B002FA825 /* ScriptGCEvent.cpp */; };
 		4FD8D0F3119C718B002FA825 /* ScriptGCEvent.h in Headers */ = {isa = PBXBuildFile; fileRef = 4FD8D0F1119C718B002FA825 /* ScriptGCEvent.h */; };
+		4FFC022B1643B710004E1638 /* NodeRareData.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 4FAB48661643A67E00F70C07 /* NodeRareData.cpp */; };
+		4FFC022D1643B726004E1638 /* ElementRareData.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 4FAB48641643A66D00F70C07 /* ElementRareData.cpp */; };
 		501BAAA913950E2C00F7ACEB /* WindRule.h in Headers */ = {isa = PBXBuildFile; fileRef = 501BAAA813950E2C00F7ACEB /* WindRule.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		5038BC0714711CDB0095E0D1 /* WebKitCSSShaderValue.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 5038BC0614711CDB0095E0D1 /* WebKitCSSShaderValue.cpp */; };
 		5038BE2F1472AD230095E0D1 /* StyleCachedShader.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 5038BE2D1472AD230095E0D1 /* StyleCachedShader.cpp */; };
@@ -1488,13 +1497,17 @@
 		5038BE401472AD980095E0D1 /* CachedShader.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 5038BE3E1472AD980095E0D1 /* CachedShader.cpp */; };
 		5038BE411472AD980095E0D1 /* CachedShader.h in Headers */ = {isa = PBXBuildFile; fileRef = 5038BE3F1472AD980095E0D1 /* CachedShader.h */; };
 		503D0CAA14B5B08700F32F57 /* CustomFilterProgram.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 503D0CA714B5B08700F32F57 /* CustomFilterProgram.cpp */; };
+		503D0CAA14B5B08700F32F58 /* CustomFilterRenderer.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 503D0CA714B5B08700F32F58 /* CustomFilterRenderer.cpp */; };
 		503D0CAB14B5B08700F32F57 /* CustomFilterProgram.h in Headers */ = {isa = PBXBuildFile; fileRef = 503D0CA814B5B08700F32F57 /* CustomFilterProgram.h */; settings = {ATTRIBUTES = (); }; };
+		503D0CAB14B5B08700F32F58 /* CustomFilterRenderer.h in Headers */ = {isa = PBXBuildFile; fileRef = 503D0CA814B5B08700F32F58 /* CustomFilterRenderer.h */; settings = {ATTRIBUTES = (); }; };
 		503D0CAC14B5B08700F32F57 /* CustomFilterProgramClient.h in Headers */ = {isa = PBXBuildFile; fileRef = 503D0CA914B5B08700F32F57 /* CustomFilterProgramClient.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		503D0CAE14B5B0BA00F32F57 /* StyleCustomFilterProgram.h in Headers */ = {isa = PBXBuildFile; fileRef = 503D0CAD14B5B0BA00F32F57 /* StyleCustomFilterProgram.h */; settings = {ATTRIBUTES = (); }; };
 		5081E3C33CE580C16EF8B48B /* CachedResourceRequest.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 5081E3DF3CFC80C16EF8B48B /* CachedResourceRequest.cpp */; };
 		5081E3E03CFF80C16EF8B48B /* CachedResourceRequest.h in Headers */ = {isa = PBXBuildFile; fileRef = 5081E3E13D0280C16EF8B48B /* CachedResourceRequest.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		508CCA4F13CF106B003151F3 /* RenderFlowThread.h in Headers */ = {isa = PBXBuildFile; fileRef = 508CCA4D13CF106B003151F3 /* RenderFlowThread.h */; };
 		508CCA5013CF106B003151F3 /* RenderFlowThread.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 508CCA4E13CF106B003151F3 /* RenderFlowThread.cpp */; };
+		5093334F163B0E4300099A60 /* CustomFilterParameterList.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 5093334D163B0E4300099A60 /* CustomFilterParameterList.cpp */; };
+		50933350163B0E4300099A60 /* CustomFilterParameterList.h in Headers */ = {isa = PBXBuildFile; fileRef = 5093334E163B0E4300099A60 /* CustomFilterParameterList.h */; };
 		50987C26157D676D00BDA835 /* CustomFilterGlobalContext.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 50987C24157D676D00BDA835 /* CustomFilterGlobalContext.cpp */; };
 		50987C27157D676D00BDA835 /* CustomFilterGlobalContext.h in Headers */ = {isa = PBXBuildFile; fileRef = 50987C25157D676D00BDA835 /* CustomFilterGlobalContext.h */; };
 		509CC9FB14C069ED00BBECBD /* CustomFilterParameter.h in Headers */ = {isa = PBXBuildFile; fileRef = 509CC9FA14C069ED00BBECBD /* CustomFilterParameter.h */; };
@@ -1503,6 +1516,8 @@
 		50CC0A3914C6F5B10017AB51 /* CustomFilterOperation.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 50CC0A3814C6F5B10017AB51 /* CustomFilterOperation.cpp */; };
 		50D10D991545F5760096D288 /* RenderLayerFilterInfo.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 50D10D971545F5760096D288 /* RenderLayerFilterInfo.cpp */; };
 		50D10D9A1545F5760096D288 /* RenderLayerFilterInfo.h in Headers */ = {isa = PBXBuildFile; fileRef = 50D10D981545F5760096D288 /* RenderLayerFilterInfo.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		50D32857163B313F0016111E /* ValidatedCustomFilterOperation.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 50D32855163B313F0016111E /* ValidatedCustomFilterOperation.cpp */; };
+		50D32858163B313F0016111E /* ValidatedCustomFilterOperation.h in Headers */ = {isa = PBXBuildFile; fileRef = 50D32856163B313F0016111E /* ValidatedCustomFilterOperation.h */; };
 		50D403C714768C9400D30BB5 /* FECustomFilter.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 50D403C514768C9400D30BB5 /* FECustomFilter.cpp */; };
 		50D403C814768C9400D30BB5 /* FECustomFilter.h in Headers */ = {isa = PBXBuildFile; fileRef = 50D403C614768C9400D30BB5 /* FECustomFilter.h */; };
 		50D405F9147D31F300D30BB5 /* CustomFilterMesh.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 50D405F7147D31F300D30BB5 /* CustomFilterMesh.cpp */; };
@@ -1595,6 +1610,7 @@
 		51ABAE1B103C18FF008C5260 /* SocketStreamError.h in Headers */ = {isa = PBXBuildFile; fileRef = 51ABAE1A103C18FF008C5260 /* SocketStreamError.h */; };
 		51ABAE1E103C1913008C5260 /* SocketStreamHandle.h in Headers */ = {isa = PBXBuildFile; fileRef = 51ABAE1C103C1913008C5260 /* SocketStreamHandle.h */; };
 		51ABAE1F103C1913008C5260 /* SocketStreamHandleCFNet.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 51ABAE1D103C1913008C5260 /* SocketStreamHandleCFNet.cpp */; };
+		51ABF64D16392E2800132A7A /* LoaderStrategy.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 51ABF64C16392E2800132A7A /* LoaderStrategy.cpp */; };
 		51B2417B0D931F3F00E83F5C /* LegacyWebArchiveMac.mm in Sources */ = {isa = PBXBuildFile; fileRef = 51B2417A0D931F3F00E83F5C /* LegacyWebArchiveMac.mm */; };
 		51BE37E00DAEE00E001085FC /* StorageArea.h in Headers */ = {isa = PBXBuildFile; fileRef = 51BE37DE0DAEE00E001085FC /* StorageArea.h */; };
 		51C0AA390F2AA10A001648C2 /* CachedFrame.h in Headers */ = {isa = PBXBuildFile; fileRef = 51C0AA380F2AA10A001648C2 /* CachedFrame.h */; settings = {ATTRIBUTES = (Private, ); }; };
@@ -1621,6 +1637,7 @@
 		51E1ECC30C91C90400DC255B /* PageURLRecord.h in Headers */ = {isa = PBXBuildFile; fileRef = 51E1ECBD0C91C90400DC255B /* PageURLRecord.h */; };
 		51E3F9C70DA059DC00250911 /* Storage.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 51E3F9C50DA059DC00250911 /* Storage.cpp */; };
 		51E3F9D60DA05E1D00250911 /* JSStorage.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 51E3F9D40DA05E1D00250911 /* JSStorage.cpp */; };
+		51E6821016387302003BBF3C /* LoaderStrategy.h in Headers */ = {isa = PBXBuildFile; fileRef = 51E6820F16387302003BBF3C /* LoaderStrategy.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		51EC92650CE90DD400F90308 /* JSCustomSQLStatementErrorCallback.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 51EC925D0CE90DD400F90308 /* JSCustomSQLStatementErrorCallback.cpp */; };
 		51FA2D78152132B300C1BA0B /* DOMWindowExtension.h in Headers */ = {isa = PBXBuildFile; fileRef = 517FBA18151AA71B00B57959 /* DOMWindowExtension.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		51FB5504113E3E9100821176 /* JSCloseEvent.h in Headers */ = {isa = PBXBuildFile; fileRef = 51FB5502113E3E9100821176 /* JSCloseEvent.h */; };
@@ -1984,17 +2001,6 @@
 		7AF11A5A12E727490061F23C /* InspectorRuntimeAgent.h in Headers */ = {isa = PBXBuildFile; fileRef = 7AF11A5912E727490061F23C /* InspectorRuntimeAgent.h */; };
 		7AFD4A8B1131C2760035B883 /* ScriptBreakpoint.h in Headers */ = {isa = PBXBuildFile; fileRef = 7AFD4A8A1131C2760035B883 /* ScriptBreakpoint.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		7AFD4FF4113277B60035B883 /* ScriptDebugListener.h in Headers */ = {isa = PBXBuildFile; fileRef = 7AFD4FF3113277B60035B883 /* ScriptDebugListener.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		7B0992F515ACF1AD00ED6D20 /* JSUndoManagerCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 7B0992F415ACF1AD00ED6D20 /* JSUndoManagerCustom.cpp */; };
-		7B1EA0CE1576C5B50060177D /* JSUndoManager.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 7B1EA0CC1576C5B50060177D /* JSUndoManager.cpp */; };
-		7B1EA0CF1576C5B50060177D /* JSUndoManager.h in Headers */ = {isa = PBXBuildFile; fileRef = 7B1EA0CD1576C5B50060177D /* JSUndoManager.h */; };
-		7B3537C515CB2CB50083AB69 /* JSDOMTransaction.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 7B3537C315CB2CB50083AB69 /* JSDOMTransaction.cpp */; };
-		7B3537C615CB2CB50083AB69 /* JSDOMTransaction.h in Headers */ = {isa = PBXBuildFile; fileRef = 7B3537C415CB2CB50083AB69 /* JSDOMTransaction.h */; };
-		7B9184D215758E420092AA93 /* UndoManager.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 7B9184CF15758E420092AA93 /* UndoManager.cpp */; };
-		7B9184D315758E420092AA93 /* UndoManager.h in Headers */ = {isa = PBXBuildFile; fileRef = 7B9184D015758E420092AA93 /* UndoManager.h */; };
-		7BB35AEB15CCDDF400F2A643 /* DOMTransaction.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 7BB35AE915CCDDF400F2A643 /* DOMTransaction.cpp */; };
-		7BB35AEC15CCDDF400F2A643 /* DOMTransaction.h in Headers */ = {isa = PBXBuildFile; fileRef = 7BB35AEA15CCDDF400F2A643 /* DOMTransaction.h */; };
-		7BD117EB15B8DB0100C974A3 /* DOMTransactionStep.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 7BD117E915B8DB0100C974A3 /* DOMTransactionStep.cpp */; };
-		7BD117EC15B8DB0100C974A3 /* DOMTransactionStep.h in Headers */ = {isa = PBXBuildFile; fileRef = 7BD117EA15B8DB0100C974A3 /* DOMTransactionStep.h */; };
 		7C522D4B15B477E8009B7C95 /* InspectorOverlay.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 7C522D4915B477E8009B7C95 /* InspectorOverlay.cpp */; };
 		7E12E90F15FA5D3A005E4126 /* CustomFilterMeshGenerator.h in Headers */ = {isa = PBXBuildFile; fileRef = 7E12E90D15FA5D3A005E4126 /* CustomFilterMeshGenerator.h */; };
 		7E12E91015FA5D3A005E4126 /* CustomFilterMeshGenerator.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 7E12E90E15FA5D3A005E4126 /* CustomFilterMeshGenerator.cpp */; };
@@ -2022,7 +2028,7 @@
 		7EE6846C12D26E3800E79415 /* ResourceHandleCFNet.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 7EE6845912D26E3800E79415 /* ResourceHandleCFNet.cpp */; };
 		7EE6846D12D26E3800E79415 /* ResourceRequest.h in Headers */ = {isa = PBXBuildFile; fileRef = 7EE6845A12D26E3800E79415 /* ResourceRequest.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		7EE6846E12D26E3800E79415 /* ResourceRequestCFNet.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 7EE6845B12D26E3800E79415 /* ResourceRequestCFNet.cpp */; };
-		7EE6846F12D26E3800E79415 /* ResourceRequestCFNet.h in Headers */ = {isa = PBXBuildFile; fileRef = 7EE6845C12D26E3800E79415 /* ResourceRequestCFNet.h */; };
+		7EE6846F12D26E3800E79415 /* ResourceRequestCFNet.h in Headers */ = {isa = PBXBuildFile; fileRef = 7EE6845C12D26E3800E79415 /* ResourceRequestCFNet.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		7EE6847012D26E3800E79415 /* ResourceResponse.h in Headers */ = {isa = PBXBuildFile; fileRef = 7EE6845D12D26E3800E79415 /* ResourceResponse.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		7EE6847112D26E3800E79415 /* ResourceResponseCFNet.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 7EE6845E12D26E3800E79415 /* ResourceResponseCFNet.cpp */; };
 		7EE6847512D26E7000E79415 /* ResourceLoaderCFNet.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 7EE6847412D26E7000E79415 /* ResourceLoaderCFNet.cpp */; };
@@ -3332,6 +3338,10 @@
 		93C09A7F0B064EEF005ABD4D /* EventHandlerMac.mm in Sources */ = {isa = PBXBuildFile; fileRef = 93C09A7E0B064EEF005ABD4D /* EventHandlerMac.mm */; };
 		93C09A810B064F00005ABD4D /* EventHandler.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 93C09A800B064F00005ABD4D /* EventHandler.cpp */; };
 		93C09C860B0657AA005ABD4D /* ScrollTypes.h in Headers */ = {isa = PBXBuildFile; fileRef = 93C09C850B0657AA005ABD4D /* ScrollTypes.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		93C38BFE164473C700091EB2 /* ScrollingStateFixedNode.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 93C38BFC164473C700091EB2 /* ScrollingStateFixedNode.cpp */; };
+		93C38BFF164473C700091EB2 /* ScrollingStateFixedNode.h in Headers */ = {isa = PBXBuildFile; fileRef = 93C38BFD164473C700091EB2 /* ScrollingStateFixedNode.h */; };
+		93C38C03164473DD00091EB2 /* ScrollingTreeFixedNode.h in Headers */ = {isa = PBXBuildFile; fileRef = 93C38C01164473DD00091EB2 /* ScrollingTreeFixedNode.h */; };
+		93C38C04164473DD00091EB2 /* ScrollingTreeFixedNode.mm in Sources */ = {isa = PBXBuildFile; fileRef = 93C38C02164473DD00091EB2 /* ScrollingTreeFixedNode.mm */; };
 		93C442000F813AE100C1A634 /* CollectionType.h in Headers */ = {isa = PBXBuildFile; fileRef = 93C441FF0F813AE100C1A634 /* CollectionType.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		93C4A4151629DF5A00C3EB6E /* ScrollingTreeScrollingNodeMac.h in Headers */ = {isa = PBXBuildFile; fileRef = 93C4A4131629DF5A00C3EB6E /* ScrollingTreeScrollingNodeMac.h */; };
 		93C4A4161629DF5A00C3EB6E /* ScrollingTreeScrollingNodeMac.mm in Sources */ = {isa = PBXBuildFile; fileRef = 93C4A4141629DF5A00C3EB6E /* ScrollingTreeScrollingNodeMac.mm */; };
@@ -3797,11 +3807,11 @@
 		A1E1154413015C3D0054AC8C /* DistantLightSource.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A1E1154313015C3D0054AC8C /* DistantLightSource.cpp */; };
 		A1E1154613015C4E0054AC8C /* PointLightSource.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A1E1154513015C4E0054AC8C /* PointLightSource.cpp */; };
 		A1E1154813015C5D0054AC8C /* SpotLightSource.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A1E1154713015C5D0054AC8C /* SpotLightSource.cpp */; };
-		A24A3A9D162499FF00522745 /* CustomFilterConstants.h in Headers */ = {isa = PBXBuildFile; fileRef = A24A3A9C162499FF00522745 /* CustomFilterConstants.h */; };
 		A24BF77B15CC3BAF003191F2 /* WebKitCSSMixFunctionValue.h in Headers */ = {isa = PBXBuildFile; fileRef = A24BF77915CC3BAF003191F2 /* WebKitCSSMixFunctionValue.h */; };
 		A24BF77C15CC3BAF003191F2 /* WebKitCSSMixFunctionValue.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A24BF77A15CC3BAF003191F2 /* WebKitCSSMixFunctionValue.cpp */; };
 		A29532CF15DD5E1700469EBC /* CustomFilterValidatedProgram.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A29532CD15DD5E1700469EBC /* CustomFilterValidatedProgram.cpp */; };
 		A29532D015DD5E1700469EBC /* CustomFilterValidatedProgram.h in Headers */ = {isa = PBXBuildFile; fileRef = A29532CE15DD5E1700469EBC /* CustomFilterValidatedProgram.h */; };
+		A2B2AE7C16375EE500CFA50B /* CustomFilterConstants.h in Headers */ = {isa = PBXBuildFile; fileRef = A2B2AE7B16375EE500CFA50B /* CustomFilterConstants.h */; };
 		A3BB59F31457A40D00AC56FE /* DocumentEventQueue.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A3BB59F11457A40D00AC56FE /* DocumentEventQueue.cpp */; };
 		A3BB59F41457A40D00AC56FE /* DocumentEventQueue.h in Headers */ = {isa = PBXBuildFile; fileRef = A3BB59F21457A40D00AC56FE /* DocumentEventQueue.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		A3E2643014748991005A8588 /* WorkerEventQueue.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A3E2642E14748991005A8588 /* WorkerEventQueue.cpp */; };
@@ -4138,10 +4148,10 @@
 		A81369D5097374F600D74463 /* HTMLFieldSetElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A81369B9097374F500D74463 /* HTMLFieldSetElement.cpp */; };
 		A81369D6097374F600D74463 /* HTMLTextAreaElement.h in Headers */ = {isa = PBXBuildFile; fileRef = A81369BA097374F500D74463 /* HTMLTextAreaElement.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		A81369D7097374F600D74463 /* HTMLTextAreaElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A81369BB097374F500D74463 /* HTMLTextAreaElement.cpp */; };
-		A81369D8097374F600D74463 /* HTMLSelectElement.h in Headers */ = {isa = PBXBuildFile; fileRef = A81369BC097374F500D74463 /* HTMLSelectElement.h */; };
+		A81369D8097374F600D74463 /* HTMLSelectElement.h in Headers */ = {isa = PBXBuildFile; fileRef = A81369BC097374F500D74463 /* HTMLSelectElement.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		A81369D9097374F600D74463 /* HTMLSelectElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A81369BD097374F500D74463 /* HTMLSelectElement.cpp */; };
-		A81369DA097374F600D74463 /* HTMLOptionsCollection.h in Headers */ = {isa = PBXBuildFile; fileRef = A81369BE097374F500D74463 /* HTMLOptionsCollection.h */; };
-		A81369DC097374F600D74463 /* HTMLOptionElement.h in Headers */ = {isa = PBXBuildFile; fileRef = A81369C0097374F500D74463 /* HTMLOptionElement.h */; };
+		A81369DA097374F600D74463 /* HTMLOptionsCollection.h in Headers */ = {isa = PBXBuildFile; fileRef = A81369BE097374F500D74463 /* HTMLOptionsCollection.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		A81369DC097374F600D74463 /* HTMLOptionElement.h in Headers */ = {isa = PBXBuildFile; fileRef = A81369C0097374F500D74463 /* HTMLOptionElement.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		A81369DD097374F600D74463 /* HTMLOptionElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A81369C1097374F500D74463 /* HTMLOptionElement.cpp */; };
 		A81369DE097374F600D74463 /* HTMLOptGroupElement.h in Headers */ = {isa = PBXBuildFile; fileRef = A81369C2097374F500D74463 /* HTMLOptGroupElement.h */; };
 		A81369DF097374F600D74463 /* HTMLOptGroupElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A81369C3097374F500D74463 /* HTMLOptGroupElement.cpp */; };
@@ -4566,6 +4576,8 @@
 		AAB6054F15874C58007B5031 /* InjectedScriptBase.h in Headers */ = {isa = PBXBuildFile; fileRef = AAB6054B15874C58007B5031 /* InjectedScriptBase.h */; };
 		AAB6055015874C58007B5031 /* InjectedScriptModule.cpp in Sources */ = {isa = PBXBuildFile; fileRef = AAB6054C15874C58007B5031 /* InjectedScriptModule.cpp */; };
 		AAB6055115874C58007B5031 /* InjectedScriptModule.h in Headers */ = {isa = PBXBuildFile; fileRef = AAB6054D15874C58007B5031 /* InjectedScriptModule.h */; };
+		AAC08CEF15F933D600F1E188 /* SVGImageChromeClient.h in Headers */ = {isa = PBXBuildFile; fileRef = AAC08CED15F933D600F1E188 /* SVGImageChromeClient.h */; };
+		AAC08CF315F941FD00F1E188 /* AccessibilitySVGRoot.h in Headers */ = {isa = PBXBuildFile; fileRef = AAC08CF115F941FC00F1E188 /* AccessibilitySVGRoot.h */; };
 		AAD766EB157E502F00E85423 /* InspectorCanvasAgent.cpp in Sources */ = {isa = PBXBuildFile; fileRef = AAD766E8157E502F00E85423 /* InspectorCanvasAgent.cpp */; };
 		AAD766EC157E502F00E85423 /* InspectorCanvasAgent.h in Headers */ = {isa = PBXBuildFile; fileRef = AAD766E9157E502F00E85423 /* InspectorCanvasAgent.h */; };
 		AAD766ED157E502F00E85423 /* InspectorCanvasInstrumentation.h in Headers */ = {isa = PBXBuildFile; fileRef = AAD766EA157E502F00E85423 /* InspectorCanvasInstrumentation.h */; };
@@ -5537,7 +5549,7 @@
 		BC772E16133162C2001EC9CE /* CSSLineBoxContainValue.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC772E15133162C2001EC9CE /* CSSLineBoxContainValue.cpp */; };
 		BC7F44A80B9E324E00A9D081 /* ImageObserver.h in Headers */ = {isa = PBXBuildFile; fileRef = BC7F44A70B9E324E00A9D081 /* ImageObserver.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BC7FA6200D1F0CBD00DB22A9 /* DynamicNodeList.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC7FA61E0D1F0CBD00DB22A9 /* DynamicNodeList.cpp */; };
-		BC7FA6210D1F0CBD00DB22A9 /* DynamicNodeList.h in Headers */ = {isa = PBXBuildFile; fileRef = BC7FA61F0D1F0CBD00DB22A9 /* DynamicNodeList.h */; };
+		BC7FA6210D1F0CBD00DB22A9 /* DynamicNodeList.h in Headers */ = {isa = PBXBuildFile; fileRef = BC7FA61F0D1F0CBD00DB22A9 /* DynamicNodeList.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BC7FA62D0D1F0EFF00DB22A9 /* StaticNodeList.h in Headers */ = {isa = PBXBuildFile; fileRef = BC7FA62B0D1F0EFF00DB22A9 /* StaticNodeList.h */; };
 		BC7FA62E0D1F0EFF00DB22A9 /* StaticNodeList.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC7FA62C0D1F0EFF00DB22A9 /* StaticNodeList.cpp */; };
 		BC80C9870CD294EE00A0B7B3 /* CSSTimingFunctionValue.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC80C9850CD294EE00A0B7B3 /* CSSTimingFunctionValue.cpp */; };
@@ -6086,6 +6098,7 @@
 		E1B25106152A0BAF0069B779 /* StylePropertyShorthand.cpp in Sources */ = {isa = PBXBuildFile; fileRef = E1B25104152A0BAF0069B779 /* StylePropertyShorthand.cpp */; };
 		E1B25107152A0BB00069B779 /* StylePropertyShorthand.h in Headers */ = {isa = PBXBuildFile; fileRef = E1B25105152A0BAF0069B779 /* StylePropertyShorthand.h */; };
 		E1B4CD2510B322E200BFFD7E /* CredentialStorageMac.mm in Sources */ = {isa = PBXBuildFile; fileRef = E1B4CD2410B322E200BFFD7E /* CredentialStorageMac.mm */; };
+		E1B7839C163740A70007B692 /* SharedWorkerStrategy.h in Headers */ = {isa = PBXBuildFile; fileRef = E1B7839B163740A70007B692 /* SharedWorkerStrategy.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		E1BE512D0CF6C512002EA959 /* XSLTUnicodeSort.cpp in Sources */ = {isa = PBXBuildFile; fileRef = E1BE512B0CF6C512002EA959 /* XSLTUnicodeSort.cpp */; };
 		E1BE512E0CF6C512002EA959 /* XSLTUnicodeSort.h in Headers */ = {isa = PBXBuildFile; fileRef = E1BE512C0CF6C512002EA959 /* XSLTUnicodeSort.h */; };
 		E1C2F24A1533A2120083F974 /* SettingsMac.mm in Sources */ = {isa = PBXBuildFile; fileRef = E1C2F2481533A2120083F974 /* SettingsMac.mm */; };
@@ -6260,8 +6273,8 @@
 		F5122C901547FA1B0028A93B /* PagePopupDriver.h in Headers */ = {isa = PBXBuildFile; fileRef = F5122C8F1547FA1B0028A93B /* PagePopupDriver.h */; };
 		F513A3EA15FF4841001526DB /* ValidationMessageClient.h in Headers */ = {isa = PBXBuildFile; fileRef = F513A3E915FF4841001526DB /* ValidationMessageClient.h */; };
 		F52AD5E41534245F0059FBE6 /* EmptyClients.cpp in Sources */ = {isa = PBXBuildFile; fileRef = F52AD5E31534245F0059FBE6 /* EmptyClients.cpp */; };
-		F544F78815CFB2A800AF33A8 /* Localizer.cpp in Sources */ = {isa = PBXBuildFile; fileRef = F544F78615CFB2A800AF33A8 /* Localizer.cpp */; };
-		F544F78915CFB2A800AF33A8 /* Localizer.h in Headers */ = {isa = PBXBuildFile; fileRef = F544F78715CFB2A800AF33A8 /* Localizer.h */; };
+		F544F78815CFB2A800AF33A8 /* PlatformLocale.cpp in Sources */ = {isa = PBXBuildFile; fileRef = F544F78615CFB2A800AF33A8 /* PlatformLocale.cpp */; };
+		F544F78915CFB2A800AF33A8 /* PlatformLocale.h in Headers */ = {isa = PBXBuildFile; fileRef = F544F78715CFB2A800AF33A8 /* PlatformLocale.h */; };
 		F55B3DAD1251F12D003EF269 /* BaseTextInputType.cpp in Sources */ = {isa = PBXBuildFile; fileRef = F55B3D791251F12D003EF269 /* BaseTextInputType.cpp */; };
 		F55B3DAE1251F12D003EF269 /* BaseTextInputType.h in Headers */ = {isa = PBXBuildFile; fileRef = F55B3D7A1251F12D003EF269 /* BaseTextInputType.h */; };
 		F55B3DAF1251F12D003EF269 /* ButtonInputType.cpp in Sources */ = {isa = PBXBuildFile; fileRef = F55B3D7B1251F12D003EF269 /* ButtonInputType.cpp */; };
@@ -6325,6 +6338,8 @@
 		F5C041E50FFCA96D00839D4A /* DOMHTMLDataListElementInternal.h in Headers */ = {isa = PBXBuildFile; fileRef = F5C041E00FFCA96D00839D4A /* DOMHTMLDataListElementInternal.h */; };
 		F5C041E60FFCA96D00839D4A /* JSHTMLDataListElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = F5C041E10FFCA96D00839D4A /* JSHTMLDataListElement.cpp */; };
 		F5C041E70FFCA96D00839D4A /* JSHTMLDataListElement.h in Headers */ = {isa = PBXBuildFile; fileRef = F5C041E20FFCA96D00839D4A /* JSHTMLDataListElement.h */; };
+		F5E0C65B1643C42C00D6CB69 /* BaseChooserOnlyDateAndTimeInputType.cpp in Sources */ = {isa = PBXBuildFile; fileRef = F5E0C6591643C42C00D6CB69 /* BaseChooserOnlyDateAndTimeInputType.cpp */; };
+		F5E0C65C1643C42C00D6CB69 /* BaseChooserOnlyDateAndTimeInputType.h in Headers */ = {isa = PBXBuildFile; fileRef = F5E0C65A1643C42C00D6CB69 /* BaseChooserOnlyDateAndTimeInputType.h */; };
 		F7A034C4126BF6BE007DC19E /* FontOrientation.h in Headers */ = {isa = PBXBuildFile; fileRef = F7A034C3126BF6BE007DC19E /* FontOrientation.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		F916C48D0DB510F80076CD83 /* JSXMLHttpRequestProgressEvent.cpp in Sources */ = {isa = PBXBuildFile; fileRef = F916C48B0DB510F80076CD83 /* JSXMLHttpRequestProgressEvent.cpp */; };
 		F916C48E0DB510F80076CD83 /* JSXMLHttpRequestProgressEvent.h in Headers */ = {isa = PBXBuildFile; fileRef = F916C48C0DB510F80076CD83 /* JSXMLHttpRequestProgressEvent.h */; };
@@ -7162,6 +7177,9 @@
 		07846340145B151A00A58DF1 /* JSTrackEvent.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSTrackEvent.cpp; sourceTree = "<group>"; };
 		07846341145B151A00A58DF1 /* JSTrackEvent.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSTrackEvent.h; sourceTree = "<group>"; };
 		07846384145B1B8E00A58DF1 /* JSTrackCustom.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSTrackCustom.h; sourceTree = "<group>"; };
+		079D0867162F20E800DB8658 /* CaptionUserPreferences.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CaptionUserPreferences.h; sourceTree = "<group>"; };
+		079D0869162F21F900DB8658 /* CaptionUserPreferencesMac.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CaptionUserPreferencesMac.h; sourceTree = "<group>"; };
+		079D086A162F21F900DB8658 /* CaptionUserPreferencesMac.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = CaptionUserPreferencesMac.mm; sourceTree = "<group>"; };
 		079F5E4B0F3BEBEA005E0782 /* MediaPlayerPrivate.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = MediaPlayerPrivate.h; sourceTree = "<group>"; };
 		07A6D1E91491137700051D0C /* MediaFragmentURIParser.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = MediaFragmentURIParser.cpp; sourceTree = "<group>"; };
 		07A6D1EA1491137700051D0C /* MediaFragmentURIParser.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = MediaFragmentURIParser.h; sourceTree = "<group>"; };
@@ -7595,6 +7613,7 @@
 		1A927FD01416A15B003A83C8 /* npruntime.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = npruntime.h; sourceTree = "<group>"; };
 		1A927FD11416A15B003A83C8 /* nptypes.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = nptypes.h; sourceTree = "<group>"; };
 		1A98956A0AA78F80005EF5EF /* KURLCFNet.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = KURLCFNet.cpp; sourceTree = "<group>"; };
+		1AA2124F163F0DA80000E63F /* AtomicStringCF.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = AtomicStringCF.cpp; sourceTree = "<group>"; };
 		1AA71608149BC4DA0016EC19 /* TileCache.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; name = TileCache.mm; path = ca/mac/TileCache.mm; sourceTree = "<group>"; };
 		1AA71609149BC4DB0016EC19 /* TileCache.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = TileCache.h; path = ca/mac/TileCache.h; sourceTree = "<group>"; };
 		1AA7161C149BF2FA0016EC19 /* WebTileLayer.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; name = WebTileLayer.mm; path = ca/mac/WebTileLayer.mm; sourceTree = "<group>"; };
@@ -8168,6 +8187,8 @@
 		3AC648B1129E146500C3EB25 /* EditingBoundary.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = EditingBoundary.h; sourceTree = "<group>"; };
 		3C244FE4A375AC633F88BE6F /* RenderLayerModelObject.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = RenderLayerModelObject.h; sourceTree = "<group>"; };
 		3C244FE5A375AC633F88BE6F /* RenderLayerModelObject.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = RenderLayerModelObject.cpp; sourceTree = "<group>"; };
+		3FFFF9A6159D9A550020BBD5 /* WebKitCSSViewportRule.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WebKitCSSViewportRule.cpp; sourceTree = "<group>"; };
+		3FFFF9A7159D9A550020BBD5 /* WebKitCSSViewportRule.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebKitCSSViewportRule.h; sourceTree = "<group>"; };
 		41002CCB0F66EDEF009E660D /* ScriptFunctionCall.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ScriptFunctionCall.h; sourceTree = "<group>"; };
 		41002CCC0F66EDEF009E660D /* ScriptFunctionCall.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ScriptFunctionCall.cpp; sourceTree = "<group>"; };
 		410B7E711045FAB000D8224F /* JSMessageEventCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSMessageEventCustom.cpp; sourceTree = "<group>"; };
@@ -8678,7 +8699,11 @@
 		4F8565E81530356E00FAE776 /* MemoryInstrumentationImpl.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = MemoryInstrumentationImpl.h; sourceTree = "<group>"; };
 		4FA3B908125CD12100300BAD /* InspectorState.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = InspectorState.cpp; sourceTree = "<group>"; };
 		4FA3B909125CD12200300BAD /* InspectorState.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InspectorState.h; sourceTree = "<group>"; };
+		4FAB48641643A66D00F70C07 /* ElementRareData.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ElementRareData.cpp; sourceTree = "<group>"; };
+		4FAB48661643A67E00F70C07 /* NodeRareData.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = NodeRareData.cpp; sourceTree = "<group>"; };
 		4FB390AC15EF61F3007AD51F /* GeneratedImage.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = GeneratedImage.cpp; sourceTree = "<group>"; };
+		4FC853491644271B00D1C275 /* CachedMetadata.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = CachedMetadata.cpp; sourceTree = "<group>"; };
+		4FC8534A1644271B00D1C275 /* CachedMetadata.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CachedMetadata.h; sourceTree = "<group>"; };
 		4FD8D0F0119C718B002FA825 /* ScriptGCEvent.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ScriptGCEvent.cpp; sourceTree = "<group>"; };
 		4FD8D0F1119C718B002FA825 /* ScriptGCEvent.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ScriptGCEvent.h; sourceTree = "<group>"; };
 		501BAAA813950E2C00F7ACEB /* WindRule.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WindRule.h; sourceTree = "<group>"; };
@@ -8688,11 +8713,17 @@
 		5038BE3E1472AD980095E0D1 /* CachedShader.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = CachedShader.cpp; sourceTree = "<group>"; };
 		5038BE3F1472AD980095E0D1 /* CachedShader.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CachedShader.h; sourceTree = "<group>"; };
 		503D0CA714B5B08700F32F57 /* CustomFilterProgram.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = CustomFilterProgram.cpp; path = filters/CustomFilterProgram.cpp; sourceTree = "<group>"; };
+		503D0CA714B5B08700F32F58 /* CustomFilterRenderer.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = CustomFilterRenderer.cpp; path = filters/CustomFilterRenderer.cpp; sourceTree = "<group>"; };
 		503D0CA814B5B08700F32F57 /* CustomFilterProgram.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = CustomFilterProgram.h; path = filters/CustomFilterProgram.h; sourceTree = "<group>"; };
+		503D0CA814B5B08700F32F58 /* CustomFilterRenderer.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = CustomFilterRenderer.h; path = filters/CustomFilterRenderer.h; sourceTree = "<group>"; };
 		503D0CA914B5B08700F32F57 /* CustomFilterProgramClient.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = CustomFilterProgramClient.h; path = filters/CustomFilterProgramClient.h; sourceTree = "<group>"; };
 		503D0CAD14B5B0BA00F32F57 /* StyleCustomFilterProgram.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = StyleCustomFilterProgram.h; path = style/StyleCustomFilterProgram.h; sourceTree = "<group>"; };
+		5081E3DF3CFC80C16EF8B48B /* CachedResourceRequest.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = CachedResourceRequest.cpp; sourceTree = "<group>"; };
+		5081E3E13D0280C16EF8B48B /* CachedResourceRequest.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = CachedResourceRequest.h; sourceTree = "<group>"; };
 		508CCA4D13CF106B003151F3 /* RenderFlowThread.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = RenderFlowThread.h; sourceTree = "<group>"; };
 		508CCA4E13CF106B003151F3 /* RenderFlowThread.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = RenderFlowThread.cpp; sourceTree = "<group>"; };
+		5093334D163B0E4300099A60 /* CustomFilterParameterList.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = CustomFilterParameterList.cpp; path = filters/CustomFilterParameterList.cpp; sourceTree = "<group>"; };
+		5093334E163B0E4300099A60 /* CustomFilterParameterList.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = CustomFilterParameterList.h; path = filters/CustomFilterParameterList.h; sourceTree = "<group>"; };
 		50987C24157D676D00BDA835 /* CustomFilterGlobalContext.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = CustomFilterGlobalContext.cpp; path = filters/CustomFilterGlobalContext.cpp; sourceTree = "<group>"; };
 		50987C25157D676D00BDA835 /* CustomFilterGlobalContext.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = CustomFilterGlobalContext.h; path = filters/CustomFilterGlobalContext.h; sourceTree = "<group>"; };
 		509CC9FA14C069ED00BBECBD /* CustomFilterParameter.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = CustomFilterParameter.h; path = filters/CustomFilterParameter.h; sourceTree = "<group>"; };
@@ -8703,6 +8734,8 @@
 		50CC0A3814C6F5B10017AB51 /* CustomFilterOperation.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = CustomFilterOperation.cpp; path = filters/CustomFilterOperation.cpp; sourceTree = "<group>"; };
 		50D10D971545F5760096D288 /* RenderLayerFilterInfo.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = RenderLayerFilterInfo.cpp; sourceTree = "<group>"; };
 		50D10D981545F5760096D288 /* RenderLayerFilterInfo.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = RenderLayerFilterInfo.h; sourceTree = "<group>"; };
+		50D32855163B313F0016111E /* ValidatedCustomFilterOperation.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = ValidatedCustomFilterOperation.cpp; path = filters/ValidatedCustomFilterOperation.cpp; sourceTree = "<group>"; };
+		50D32856163B313F0016111E /* ValidatedCustomFilterOperation.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = ValidatedCustomFilterOperation.h; path = filters/ValidatedCustomFilterOperation.h; sourceTree = "<group>"; };
 		50D403C514768C9400D30BB5 /* FECustomFilter.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = FECustomFilter.cpp; path = filters/FECustomFilter.cpp; sourceTree = "<group>"; };
 		50D403C614768C9400D30BB5 /* FECustomFilter.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = FECustomFilter.h; path = filters/FECustomFilter.h; sourceTree = "<group>"; };
 		50D405F7147D31F300D30BB5 /* CustomFilterMesh.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = CustomFilterMesh.cpp; path = filters/CustomFilterMesh.cpp; sourceTree = "<group>"; };
@@ -8799,6 +8832,7 @@
 		51ABAE1A103C18FF008C5260 /* SocketStreamError.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SocketStreamError.h; sourceTree = "<group>"; };
 		51ABAE1C103C1913008C5260 /* SocketStreamHandle.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SocketStreamHandle.h; sourceTree = "<group>"; };
 		51ABAE1D103C1913008C5260 /* SocketStreamHandleCFNet.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SocketStreamHandleCFNet.cpp; sourceTree = "<group>"; };
+		51ABF64C16392E2800132A7A /* LoaderStrategy.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = LoaderStrategy.cpp; sourceTree = "<group>"; };
 		51B2417A0D931F3F00E83F5C /* LegacyWebArchiveMac.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = LegacyWebArchiveMac.mm; sourceTree = "<group>"; };
 		51BE37DE0DAEE00E001085FC /* StorageArea.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = StorageArea.h; sourceTree = "<group>"; };
 		51C0AA380F2AA10A001648C2 /* CachedFrame.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CachedFrame.h; sourceTree = "<group>"; };
@@ -8829,6 +8863,7 @@
 		51E3F9D10DA05D7100250911 /* Storage.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = Storage.idl; sourceTree = "<group>"; };
 		51E3F9D40DA05E1D00250911 /* JSStorage.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSStorage.cpp; sourceTree = "<group>"; };
 		51E3F9D50DA05E1D00250911 /* JSStorage.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSStorage.h; sourceTree = "<group>"; };
+		51E6820F16387302003BBF3C /* LoaderStrategy.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = LoaderStrategy.h; sourceTree = "<group>"; };
 		51EC925D0CE90DD400F90308 /* JSCustomSQLStatementErrorCallback.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCustomSQLStatementErrorCallback.cpp; sourceTree = "<group>"; };
 		51F6A3D50663BF04004D2919 /* HTMLCanvasElement.cpp */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.cpp.cpp; path = HTMLCanvasElement.cpp; sourceTree = "<group>"; tabWidth = 8; usesTabs = 0; };
 		51F6A3D60663BF04004D2919 /* HTMLCanvasElement.h */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.c.h; path = HTMLCanvasElement.h; sourceTree = "<group>"; tabWidth = 8; usesTabs = 0; };
@@ -9225,19 +9260,6 @@
 		7AF11A5912E727490061F23C /* InspectorRuntimeAgent.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InspectorRuntimeAgent.h; sourceTree = "<group>"; };
 		7AFD4A8A1131C2760035B883 /* ScriptBreakpoint.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ScriptBreakpoint.h; sourceTree = "<group>"; };
 		7AFD4FF3113277B60035B883 /* ScriptDebugListener.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ScriptDebugListener.h; sourceTree = "<group>"; };
-		7B0992F415ACF1AD00ED6D20 /* JSUndoManagerCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSUndoManagerCustom.cpp; sourceTree = "<group>"; };
-		7B1EA0CC1576C5B50060177D /* JSUndoManager.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSUndoManager.cpp; sourceTree = "<group>"; };
-		7B1EA0CD1576C5B50060177D /* JSUndoManager.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSUndoManager.h; sourceTree = "<group>"; };
-		7B3537C315CB2CB50083AB69 /* JSDOMTransaction.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSDOMTransaction.cpp; sourceTree = "<group>"; };
-		7B3537C415CB2CB50083AB69 /* JSDOMTransaction.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSDOMTransaction.h; sourceTree = "<group>"; };
-		7B8C1FE615CCE3C2004B35DC /* DOMTransaction.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = DOMTransaction.idl; sourceTree = "<group>"; };
-		7B9184CF15758E420092AA93 /* UndoManager.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = UndoManager.cpp; sourceTree = "<group>"; };
-		7B9184D015758E420092AA93 /* UndoManager.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = UndoManager.h; sourceTree = "<group>"; };
-		7B9184D115758E420092AA93 /* UndoManager.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = UndoManager.idl; sourceTree = "<group>"; };
-		7BB35AE915CCDDF400F2A643 /* DOMTransaction.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = DOMTransaction.cpp; sourceTree = "<group>"; };
-		7BB35AEA15CCDDF400F2A643 /* DOMTransaction.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DOMTransaction.h; sourceTree = "<group>"; };
-		7BD117E915B8DB0100C974A3 /* DOMTransactionStep.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = DOMTransactionStep.cpp; sourceTree = "<group>"; };
-		7BD117EA15B8DB0100C974A3 /* DOMTransactionStep.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DOMTransactionStep.h; sourceTree = "<group>"; };
 		7C522D4915B477E8009B7C95 /* InspectorOverlay.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = InspectorOverlay.cpp; sourceTree = "<group>"; };
 		7C522D4A15B478B2009B7C95 /* InspectorOverlay.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InspectorOverlay.h; sourceTree = "<group>"; };
 		7C60128060078BB70E367A95 /* DNSResolveQueue.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = DNSResolveQueue.cpp; sourceTree = "<group>"; };
@@ -10548,6 +10570,10 @@
 		93C09A7E0B064EEF005ABD4D /* EventHandlerMac.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = EventHandlerMac.mm; sourceTree = "<group>"; };
 		93C09A800B064F00005ABD4D /* EventHandler.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = EventHandler.cpp; sourceTree = "<group>"; };
 		93C09C850B0657AA005ABD4D /* ScrollTypes.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ScrollTypes.h; sourceTree = "<group>"; };
+		93C38BFC164473C700091EB2 /* ScrollingStateFixedNode.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ScrollingStateFixedNode.cpp; sourceTree = "<group>"; };
+		93C38BFD164473C700091EB2 /* ScrollingStateFixedNode.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ScrollingStateFixedNode.h; sourceTree = "<group>"; };
+		93C38C01164473DD00091EB2 /* ScrollingTreeFixedNode.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ScrollingTreeFixedNode.h; sourceTree = "<group>"; };
+		93C38C02164473DD00091EB2 /* ScrollingTreeFixedNode.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = ScrollingTreeFixedNode.mm; sourceTree = "<group>"; };
 		93C441FF0F813AE100C1A634 /* CollectionType.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CollectionType.h; sourceTree = "<group>"; };
 		93C4A4131629DF5A00C3EB6E /* ScrollingTreeScrollingNodeMac.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ScrollingTreeScrollingNodeMac.h; sourceTree = "<group>"; };
 		93C4A4141629DF5A00C3EB6E /* ScrollingTreeScrollingNodeMac.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = ScrollingTreeScrollingNodeMac.mm; sourceTree = "<group>"; };
@@ -11058,11 +11084,11 @@
 		A1E1154313015C3D0054AC8C /* DistantLightSource.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DistantLightSource.cpp; path = filters/DistantLightSource.cpp; sourceTree = "<group>"; };
 		A1E1154513015C4E0054AC8C /* PointLightSource.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = PointLightSource.cpp; path = filters/PointLightSource.cpp; sourceTree = "<group>"; };
 		A1E1154713015C5D0054AC8C /* SpotLightSource.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = SpotLightSource.cpp; path = filters/SpotLightSource.cpp; sourceTree = "<group>"; };
-		A24A3A9C162499FF00522745 /* CustomFilterConstants.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CustomFilterConstants.h; sourceTree = "<group>"; };
 		A24BF77915CC3BAF003191F2 /* WebKitCSSMixFunctionValue.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebKitCSSMixFunctionValue.h; sourceTree = "<group>"; };
 		A24BF77A15CC3BAF003191F2 /* WebKitCSSMixFunctionValue.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WebKitCSSMixFunctionValue.cpp; sourceTree = "<group>"; };
 		A29532CD15DD5E1700469EBC /* CustomFilterValidatedProgram.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = CustomFilterValidatedProgram.cpp; path = filters/CustomFilterValidatedProgram.cpp; sourceTree = "<group>"; };
 		A29532CE15DD5E1700469EBC /* CustomFilterValidatedProgram.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = CustomFilterValidatedProgram.h; path = filters/CustomFilterValidatedProgram.h; sourceTree = "<group>"; };
+		A2B2AE7B16375EE500CFA50B /* CustomFilterConstants.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = CustomFilterConstants.h; path = filters/CustomFilterConstants.h; sourceTree = "<group>"; };
 		A3BB59F11457A40D00AC56FE /* DocumentEventQueue.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = DocumentEventQueue.cpp; sourceTree = "<group>"; };
 		A3BB59F21457A40D00AC56FE /* DocumentEventQueue.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DocumentEventQueue.h; sourceTree = "<group>"; };
 		A3E2642E14748991005A8588 /* WorkerEventQueue.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = WorkerEventQueue.cpp; path = workers/WorkerEventQueue.cpp; sourceTree = "<group>"; };
@@ -11725,6 +11751,9 @@
 		AAB6054B15874C58007B5031 /* InjectedScriptBase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InjectedScriptBase.h; sourceTree = "<group>"; };
 		AAB6054C15874C58007B5031 /* InjectedScriptModule.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = InjectedScriptModule.cpp; sourceTree = "<group>"; };
 		AAB6054D15874C58007B5031 /* InjectedScriptModule.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InjectedScriptModule.h; sourceTree = "<group>"; };
+		AAC08CED15F933D600F1E188 /* SVGImageChromeClient.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SVGImageChromeClient.h; sourceTree = "<group>"; };
+		AAC08CF015F941FC00F1E188 /* AccessibilitySVGRoot.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = AccessibilitySVGRoot.cpp; sourceTree = "<group>"; };
+		AAC08CF115F941FC00F1E188 /* AccessibilitySVGRoot.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = AccessibilitySVGRoot.h; sourceTree = "<group>"; };
 		AAD766E8157E502F00E85423 /* InspectorCanvasAgent.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = InspectorCanvasAgent.cpp; sourceTree = "<group>"; };
 		AAD766E9157E502F00E85423 /* InspectorCanvasAgent.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InspectorCanvasAgent.h; sourceTree = "<group>"; };
 		AAD766EA157E502F00E85423 /* InspectorCanvasInstrumentation.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InspectorCanvasInstrumentation.h; sourceTree = "<group>"; };
@@ -12827,7 +12856,6 @@
 		BC64649511D82349006455B0 /* JSDOMStringMap.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSDOMStringMap.cpp; sourceTree = "<group>"; };
 		BC64649611D82349006455B0 /* JSDOMStringMap.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSDOMStringMap.h; sourceTree = "<group>"; };
 		BC64649B11D8238C006455B0 /* JSDOMStringMapCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSDOMStringMapCustom.cpp; sourceTree = "<group>"; };
-		BC646F7E136A435700B35DED /* CompilerVersion.xcconfig */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.xcconfig; path = CompilerVersion.xcconfig; sourceTree = "<group>"; };
 		BC64B4C90CB4295D005F2B62 /* CachedFont.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = CachedFont.cpp; sourceTree = "<group>"; };
 		BC64B4CA0CB4295D005F2B62 /* CachedFont.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CachedFont.h; sourceTree = "<group>"; };
 		BC64B4CD0CB4298A005F2B62 /* CSSFontFace.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = CSSFontFace.cpp; sourceTree = "<group>"; };
@@ -12965,8 +12993,6 @@
 		BCB16C0F0979C3BD00467741 /* CachedXSLStyleSheet.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = CachedXSLStyleSheet.h; sourceTree = "<group>"; };
 		BCB16C100979C3BD00467741 /* CachedResourceLoader.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = CachedResourceLoader.cpp; sourceTree = "<group>"; };
 		BCB16C110979C3BD00467741 /* CachedResourceLoader.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = CachedResourceLoader.h; sourceTree = "<group>"; };
-		5081E3DF3CFC80C16EF8B48B /* CachedResourceRequest.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = CachedResourceRequest.cpp; sourceTree = "<group>"; };
-		5081E3E13D0280C16EF8B48B /* CachedResourceRequest.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = CachedResourceRequest.h; sourceTree = "<group>"; };
 		BCB7735E0C17853D00132BA4 /* JSNodeFilterCondition.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = JSNodeFilterCondition.cpp; sourceTree = "<group>"; };
 		BCB7735F0C17853D00132BA4 /* JSNodeFilterCondition.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = JSNodeFilterCondition.h; sourceTree = "<group>"; };
 		BCB773600C17853D00132BA4 /* JSNodeFilterCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = JSNodeFilterCustom.cpp; sourceTree = "<group>"; };
@@ -13498,6 +13524,7 @@
 		E1B25104152A0BAF0069B779 /* StylePropertyShorthand.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = StylePropertyShorthand.cpp; sourceTree = "<group>"; };
 		E1B25105152A0BAF0069B779 /* StylePropertyShorthand.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = StylePropertyShorthand.h; sourceTree = "<group>"; };
 		E1B4CD2410B322E200BFFD7E /* CredentialStorageMac.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = CredentialStorageMac.mm; sourceTree = "<group>"; };
+		E1B7839B163740A70007B692 /* SharedWorkerStrategy.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = SharedWorkerStrategy.h; path = workers/SharedWorkerStrategy.h; sourceTree = "<group>"; };
 		E1BE512B0CF6C512002EA959 /* XSLTUnicodeSort.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = XSLTUnicodeSort.cpp; sourceTree = "<group>"; };
 		E1BE512C0CF6C512002EA959 /* XSLTUnicodeSort.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = XSLTUnicodeSort.h; sourceTree = "<group>"; };
 		E1C2F2481533A2120083F974 /* SettingsMac.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = SettingsMac.mm; sourceTree = "<group>"; };
@@ -13691,8 +13718,8 @@
 		F523D30302DE4476018635CA /* Range.cpp */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.cpp.cpp; path = Range.cpp; sourceTree = "<group>"; tabWidth = 8; usesTabs = 0; };
 		F523D30402DE4476018635CA /* Range.h */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.c.h; path = Range.h; sourceTree = "<group>"; tabWidth = 8; usesTabs = 0; };
 		F52AD5E31534245F0059FBE6 /* EmptyClients.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = EmptyClients.cpp; sourceTree = "<group>"; };
-		F544F78615CFB2A800AF33A8 /* Localizer.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = Localizer.cpp; sourceTree = "<group>"; };
-		F544F78715CFB2A800AF33A8 /* Localizer.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = Localizer.h; sourceTree = "<group>"; };
+		F544F78615CFB2A800AF33A8 /* PlatformLocale.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = PlatformLocale.cpp; sourceTree = "<group>"; };
+		F544F78715CFB2A800AF33A8 /* PlatformLocale.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PlatformLocale.h; sourceTree = "<group>"; };
 		F55B3D791251F12D003EF269 /* BaseTextInputType.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = BaseTextInputType.cpp; sourceTree = "<group>"; };
 		F55B3D7A1251F12D003EF269 /* BaseTextInputType.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = BaseTextInputType.h; sourceTree = "<group>"; };
 		F55B3D7B1251F12D003EF269 /* ButtonInputType.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ButtonInputType.cpp; sourceTree = "<group>"; };
@@ -13766,6 +13793,8 @@
 		F5C2869302846DCD018635CA /* ApplicationServices.framework */ = {isa = PBXFileReference; lastKnownFileType = wrapper.framework; name = ApplicationServices.framework; path = /System/Library/Frameworks/ApplicationServices.framework; sourceTree = "<absolute>"; };
 		F5C2869402846DCD018635CA /* Carbon.framework */ = {isa = PBXFileReference; lastKnownFileType = wrapper.framework; name = Carbon.framework; path = /System/Library/Frameworks/Carbon.framework; sourceTree = "<absolute>"; };
 		F5C2869502846DCD018635CA /* Cocoa.framework */ = {isa = PBXFileReference; lastKnownFileType = wrapper.framework; name = Cocoa.framework; path = /System/Library/Frameworks/Cocoa.framework; sourceTree = "<absolute>"; };
+		F5E0C6591643C42C00D6CB69 /* BaseChooserOnlyDateAndTimeInputType.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = BaseChooserOnlyDateAndTimeInputType.cpp; sourceTree = "<group>"; };
+		F5E0C65A1643C42C00D6CB69 /* BaseChooserOnlyDateAndTimeInputType.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = BaseChooserOnlyDateAndTimeInputType.h; sourceTree = "<group>"; };
 		F7A034C3126BF6BE007DC19E /* FontOrientation.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = FontOrientation.h; sourceTree = "<group>"; };
 		F8216299029F4FB501000131 /* JavaScriptCore.framework */ = {isa = PBXFileReference; lastKnownFileType = wrapper.framework; path = JavaScriptCore.framework; sourceTree = BUILT_PRODUCTS_DIR; };
 		F916C48B0DB510F80076CD83 /* JSXMLHttpRequestProgressEvent.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = JSXMLHttpRequestProgressEvent.cpp; sourceTree = "<group>"; };
@@ -14416,7 +14445,6 @@
 			children = (
 				A83B79100CCB001B000B0825 /* Core */,
 				A83B790E0CCAFF97000B0825 /* CSS */,
-				7B7F686D1576BFA1003FABF2 /* Editing */,
 				A83B79120CCB003F000B0825 /* Events */,
 				89878576122CA1DA003AABDA /* FileAPI */,
 				A83B79080CCAFF2B000B0825 /* HTML */,
@@ -14621,6 +14649,8 @@
 				0F605AEB15F94848004DF0C0 /* ScrollingConstraints.h */,
 				1AF62EE414DA22A70041556C /* ScrollingCoordinator.cpp */,
 				1AF62EE514DA22A70041556C /* ScrollingCoordinator.h */,
+				93C38BFC164473C700091EB2 /* ScrollingStateFixedNode.cpp */,
+				93C38BFD164473C700091EB2 /* ScrollingStateFixedNode.h */,
 				931CBD06161A44E900E4C874 /* ScrollingStateNode.cpp */,
 				931CBD07161A44E900E4C874 /* ScrollingStateNode.h */,
 				931CBD08161A44E900E4C874 /* ScrollingStateScrollingNode.cpp */,
@@ -14646,6 +14676,8 @@
 				1AF62EE314DA22A70041556C /* ScrollingCoordinatorMac.mm */,
 				931CBD12161A44F800E4C874 /* ScrollingStateNodeMac.mm */,
 				1AF62F2314DAFE910041556C /* ScrollingThreadMac.mm */,
+				93C38C01164473DD00091EB2 /* ScrollingTreeFixedNode.h */,
+				93C38C02164473DD00091EB2 /* ScrollingTreeFixedNode.mm */,
 				1A35862A152522540022A659 /* ScrollingTreeMac.mm */,
 				93C4A4131629DF5A00C3EB6E /* ScrollingTreeScrollingNodeMac.h */,
 				93C4A4141629DF5A00C3EB6E /* ScrollingTreeScrollingNodeMac.mm */,
@@ -14832,7 +14864,6 @@
 			isa = PBXGroup;
 			children = (
 				1CDD45E60BA9C84600F90147 /* Base.xcconfig */,
-				BC646F7E136A435700B35DED /* CompilerVersion.xcconfig */,
 				1CDD45E40BA9C84600F90147 /* DebugRelease.xcconfig */,
 				449098B10F8F82520076A327 /* FeatureDefines.xcconfig */,
 				1C904DF90BA9D2C80081E9D0 /* Version.xcconfig */,
@@ -14889,6 +14920,8 @@
 				0709FC4D1025DEE30059CDBA /* AccessibilitySlider.h */,
 				29D7BCF51444AF580070619C /* AccessibilitySpinButton.cpp */,
 				29D7BCF91444AF7D0070619C /* AccessibilitySpinButton.h */,
+				AAC08CF015F941FC00F1E188 /* AccessibilitySVGRoot.cpp */,
+				AAC08CF115F941FC00F1E188 /* AccessibilitySVGRoot.h */,
 				2981CAAA131822EC00D12F2A /* AccessibilityTable.cpp */,
 				29A8120D0FBB9C1D00510293 /* AccessibilityTable.h */,
 				2981CAAB131822EC00D12F2A /* AccessibilityTableCell.cpp */,
@@ -14936,6 +14969,7 @@
 				41D168E010226E89009BC827 /* SharedWorkerContext.h */,
 				41D168E110226E89009BC827 /* SharedWorkerContext.idl */,
 				41D168E210226E89009BC827 /* SharedWorkerRepository.h */,
+				E1B7839B163740A70007B692 /* SharedWorkerStrategy.h */,
 				41D168E510226E89009BC827 /* SharedWorkerThread.cpp */,
 				41D168E610226E89009BC827 /* SharedWorkerThread.h */,
 				2E4346330F546A8200B0F1BA /* Worker.cpp */,
@@ -15160,8 +15194,6 @@
 		49484FAE102CF01E00187DD3 /* canvas */ = {
 			isa = PBXGroup;
 			children = (
-				7E5D7A73161D3F8F00896C34 /* OESElementIndexUint.cpp */,
-				7E5D7A74161D3F8F00896C34 /* OESElementIndexUint.h */,
 				49EECDCC10503C2300099FAB /* ArrayBuffer.idl */,
 				49EECDC910503C2300099FAB /* ArrayBufferView.idl */,
 				6E4E91A710F7FB3100A2779C /* CanvasContextAttributes.cpp */,
@@ -15192,6 +15224,8 @@
 				49EECDD510503C2300099FAB /* Int16Array.idl */,
 				49EECDD210503C2300099FAB /* Int32Array.idl */,
 				49C7B9AD1042D32E0009D447 /* Int8Array.idl */,
+				7E5D7A73161D3F8F00896C34 /* OESElementIndexUint.cpp */,
+				7E5D7A74161D3F8F00896C34 /* OESElementIndexUint.h */,
 				9001773D12E0347800648462 /* OESStandardDerivatives.cpp */,
 				9001773E12E0347800648462 /* OESStandardDerivatives.h */,
 				9001773F12E0347800648462 /* OESStandardDerivatives.idl */,
@@ -15801,6 +15835,9 @@
 				BC124EE40C2641CD009E2349 /* BarInfo.cpp */,
 				BC124EE50C2641CD009E2349 /* BarInfo.h */,
 				BC124EE60C2641CD009E2349 /* BarInfo.idl */,
+				079D0867162F20E800DB8658 /* CaptionUserPreferences.h */,
+				079D0869162F21F900DB8658 /* CaptionUserPreferencesMac.h */,
+				079D086A162F21F900DB8658 /* CaptionUserPreferencesMac.mm */,
 				14D8238A0AF92DF60004F057 /* Chrome.cpp */,
 				14D823500AF92A790004F057 /* Chrome.h */,
 				14D824060AF93AEB0004F057 /* ChromeClient.h */,
@@ -15977,17 +16014,6 @@
 			tabWidth = 4;
 			usesTabs = 0;
 		};
-		7B7F686D1576BFA1003FABF2 /* Editing */ = {
-			isa = PBXGroup;
-			children = (
-				7B3537C315CB2CB50083AB69 /* JSDOMTransaction.cpp */,
-				7B3537C415CB2CB50083AB69 /* JSDOMTransaction.h */,
-				7B1EA0CC1576C5B50060177D /* JSUndoManager.cpp */,
-				7B1EA0CD1576C5B50060177D /* JSUndoManager.h */,
-			);
-			name = Editing;
-			sourceTree = "<group>";
-		};
 		7EE6847312D26E5500E79415 /* cf */ = {
 			isa = PBXGroup;
 			children = (
@@ -17227,9 +17253,6 @@
 				CECADFC3153778FF00E37068 /* DictationAlternative.h */,
 				CECADFC4153778FF00E37068 /* DictationCommand.cpp */,
 				CECADFC5153778FF00E37068 /* DictationCommand.h */,
-				7B8C1FE615CCE3C2004B35DC /* DOMTransaction.idl */,
-				7BD117E915B8DB0100C974A3 /* DOMTransactionStep.cpp */,
-				7BD117EA15B8DB0100C974A3 /* DOMTransactionStep.h */,
 				93309D93099E64910056E581 /* EditAction.h */,
 				93309D94099E64910056E581 /* EditCommand.cpp */,
 				93309D95099E64910056E581 /* EditCommand.h */,
@@ -17319,9 +17342,6 @@
 				93309DCD099E64910056E581 /* TextIterator.h */,
 				93309DCA099E64910056E581 /* TypingCommand.cpp */,
 				93309DCB099E64910056E581 /* TypingCommand.h */,
-				7B9184CF15758E420092AA93 /* UndoManager.cpp */,
-				7B9184D015758E420092AA93 /* UndoManager.h */,
-				7B9184D115758E420092AA93 /* UndoManager.idl */,
 				9B2D8A7814997CCF00ECEF3E /* UndoStep.h */,
 				D086FE9709D53AAB005BC74D /* UnlinkCommand.cpp */,
 				D086FE9609D53AAB005BC74D /* UnlinkCommand.h */,
@@ -17386,6 +17406,8 @@
 				379E61C6126CA5C300B63E8D /* BaseButtonInputType.h */,
 				379E61C7126CA5C300B63E8D /* BaseCheckableInputType.cpp */,
 				379E61C8126CA5C300B63E8D /* BaseCheckableInputType.h */,
+				F5E0C6591643C42C00D6CB69 /* BaseChooserOnlyDateAndTimeInputType.cpp */,
+				F5E0C65A1643C42C00D6CB69 /* BaseChooserOnlyDateAndTimeInputType.h */,
 				C33EE5C214FB49610002095A /* BaseClickableWithKeyInputType.cpp */,
 				C33EE5C314FB49610002095A /* BaseClickableWithKeyInputType.h */,
 				F59C95FD1255B23F000623C0 /* BaseDateAndTimeInputType.cpp */,
@@ -18228,11 +18250,15 @@
 		A75E8B7F0E1DE2B0007F2481 /* filters */ = {
 			isa = PBXGroup;
 			children = (
+				5093334D163B0E4300099A60 /* CustomFilterParameterList.cpp */,
+				5093334E163B0E4300099A60 /* CustomFilterParameterList.h */,
+				50D32855163B313F0016111E /* ValidatedCustomFilterOperation.cpp */,
+				50D32856163B313F0016111E /* ValidatedCustomFilterOperation.h */,
 				49ECEB5C1499790D00CDD3A4 /* arm */,
 				15B3FC1715FB217800A81BCB /* CustomFilterArrayParameter.h */,
 				50D4060F147D49DE00D30BB5 /* CustomFilterCompiledProgram.cpp */,
 				50D40610147D49DE00D30BB5 /* CustomFilterCompiledProgram.h */,
-				A24A3A9C162499FF00522745 /* CustomFilterConstants.h */,
+				A2B2AE7B16375EE500CFA50B /* CustomFilterConstants.h */,
 				50987C24157D676D00BDA835 /* CustomFilterGlobalContext.cpp */,
 				50987C25157D676D00BDA835 /* CustomFilterGlobalContext.h */,
 				50D405F7147D31F300D30BB5 /* CustomFilterMesh.cpp */,
@@ -18248,6 +18274,8 @@
 				503D0CA914B5B08700F32F57 /* CustomFilterProgramClient.h */,
 				50D88CB315BDFDAA001809F4 /* CustomFilterProgramInfo.cpp */,
 				50D88CB415BDFDAA001809F4 /* CustomFilterProgramInfo.h */,
+				503D0CA714B5B08700F32F58 /* CustomFilterRenderer.cpp */,
+				503D0CA814B5B08700F32F58 /* CustomFilterRenderer.h */,
 				509EC10815E848CA00E82581 /* CustomFilterTransformParameter.h */,
 				A29532CD15DD5E1700469EBC /* CustomFilterValidatedProgram.cpp */,
 				A29532CE15DD5E1700469EBC /* CustomFilterValidatedProgram.h */,
@@ -19806,6 +19834,7 @@
 				B255990C0D00D8B900BB825C /* SVGImage.h */,
 				08F859D21463F9CD0067D933 /* SVGImageCache.cpp */,
 				08F859D31463F9CD0067D933 /* SVGImageCache.h */,
+				AAC08CED15F933D600F1E188 /* SVGImageChromeClient.h */,
 			);
 			path = graphics;
 			sourceTree = "<group>";
@@ -20055,6 +20084,7 @@
 				371A67CA11C6C7DB00047B8B /* HyphenationCF.cpp */,
 				B2B2645A0D00A77E000ACC1D /* StringCF.cpp */,
 				B2B2645B0D00A77E000ACC1D /* StringImplCF.cpp */,
+				1AA2124F163F0DA80000E63F /* AtomicStringCF.cpp */,
 			);
 			path = cf;
 			sourceTree = "<group>";
@@ -20079,9 +20109,9 @@
 				89B5EAA011E8003D00F2367E /* LineEnding.h */,
 				7633A72413D8B33A008501B6 /* LocaleToScriptMapping.h */,
 				7633A72513D8B33A008501B6 /* LocaleToScriptMappingDefault.cpp */,
-				F544F78615CFB2A800AF33A8 /* Localizer.cpp */,
-				F544F78715CFB2A800AF33A8 /* Localizer.h */,
 				BC76AC110DD7AD5C00415F34 /* ParserUtilities.h */,
+				F544F78615CFB2A800AF33A8 /* PlatformLocale.cpp */,
+				F544F78715CFB2A800AF33A8 /* PlatformLocale.h */,
 				379E371413736A6600B9E919 /* QuotedPrintable.cpp */,
 				379E371513736A6600B9E919 /* QuotedPrintable.h */,
 				B2C3D9FC0D006C1D00EF6F26 /* RegularExpression.cpp */,
@@ -20249,8 +20279,6 @@
 				316023EF1532C40C00D50FF4 /* Dictionary.h */,
 				BC53DA61114314BD000D817E /* DOMObjectHashTableMap.cpp */,
 				BC53DA5F1143141A000D817E /* DOMObjectHashTableMap.h */,
-				7BB35AE915CCDDF400F2A643 /* DOMTransaction.cpp */,
-				7BB35AEA15CCDDF400F2A643 /* DOMTransaction.h */,
 				BC53DA471143134D000D817E /* DOMWrapperWorld.cpp */,
 				BC53DA2D1143121E000D817E /* DOMWrapperWorld.h */,
 				1432E8480C51493F00B1500F /* GCController.cpp */,
@@ -20495,7 +20523,6 @@
 				07846384145B1B8E00A58DF1 /* JSTrackCustom.h */,
 				07B5A30A14687B8400A81ECE /* JSTrackEventCustom.cpp */,
 				516BB7920CE91E6800512F79 /* JSTreeWalkerCustom.cpp */,
-				7B0992F415ACF1AD00ED6D20 /* JSUndoManagerCustom.cpp */,
 				49EED14C1051971A00099FAB /* JSWebGLRenderingContextCustom.cpp */,
 				319E68861327C911004AC91A /* JSWebKitAnimationCustom.cpp */,
 				3194623113022F65004BB3F8 /* JSWebKitAnimationListCustom.cpp */,
@@ -20668,6 +20695,8 @@
 				5126E6B60A2E3AEF005C29FA /* icon */,
 				93A1EAA20A5634D8006960A0 /* mac */,
 				E1C416160F6563180092D2FB /* CrossOriginAccessControl.cpp */,
+				4FC853491644271B00D1C275 /* CachedMetadata.cpp */,
+				4FC8534A1644271B00D1C275 /* CachedMetadata.h */,
 				E1C416110F6562FD0092D2FB /* CrossOriginAccessControl.h */,
 				E1C415DD0F655D7C0092D2FB /* CrossOriginPreflightResultCache.cpp */,
 				E1C415D90F655D6F0092D2FB /* CrossOriginPreflightResultCache.h */,
@@ -20703,6 +20732,8 @@
 				98CE4325129E00BD005821DC /* LinkLoader.cpp */,
 				98CE4329129E00E5005821DC /* LinkLoader.h */,
 				984264EF12D5280A000D88A4 /* LinkLoaderClient.h */,
+				51E6820F16387302003BBF3C /* LoaderStrategy.h */,
+				51ABF64C16392E2800132A7A /* LoaderStrategy.cpp */,
 				93E227DC0AF589AD00D48324 /* MainResourceLoader.cpp */,
 				656D37290ADBA5DE00A4554D /* MainResourceLoader.h */,
 				52F10862162B6D82009AC81E /* MixedContentChecker.cpp */,
@@ -21381,6 +21412,8 @@
 				BC9ADD7F0CC4092200098C4C /* WebKitCSSTransformValue.cpp */,
 				BC9ADD220CC4032600098C4C /* WebKitCSSTransformValue.h */,
 				31611E540E1C4D4A00F6A579 /* WebKitCSSTransformValue.idl */,
+				3FFFF9A6159D9A550020BBD5 /* WebKitCSSViewportRule.cpp */,
+				3FFFF9A7159D9A550020BBD5 /* WebKitCSSViewportRule.h */,
 			);
 			path = css;
 			sourceTree = "<group>";
@@ -21771,6 +21804,7 @@
 				93EEC1EA09C2877700C515D1 /* Element.idl */,
 				2CF6878714D32EB500340F39 /* ElementAttributeData.cpp */,
 				2CF6878914D32EFF00340F39 /* ElementAttributeData.h */,
+				4FAB48641643A66D00F70C07 /* ElementRareData.cpp */,
 				637B7ADE0E8767B800E32194 /* ElementRareData.h */,
 				57CF4C8414F7597A00ECFF14 /* ElementShadow.cpp */,
 				57CF4C8514F7597A00ECFF14 /* ElementShadow.h */,
@@ -21886,6 +21920,7 @@
 				1A750D870A90E394000FF215 /* NodeIterator.idl */,
 				A81872100977D3C0005826D9 /* NodeList.h */,
 				85ACA9FA0A9B631000671E90 /* NodeList.idl */,
+				4FAB48661643A67E00F70C07 /* NodeRareData.cpp */,
 				63189AE20E83A33300012E41 /* NodeRareData.h */,
 				A7F5D94D1384F02D00A29A87 /* NodeRenderingContext.cpp */,
 				A7F5D94E1384F02D00A29A87 /* NodeRenderingContext.h */,
@@ -22342,6 +22377,10 @@
 			isa = PBXHeadersBuildPhase;
 			buildActionMask = 2147483647;
 			files = (
+				BC7FA6210D1F0CBD00DB22A9 /* DynamicNodeList.h in Headers */,
+				A81369DA097374F600D74463 /* HTMLOptionsCollection.h in Headers */,
+				A81369D8097374F600D74463 /* HTMLSelectElement.h in Headers */,
+				A81369DC097374F600D74463 /* HTMLOptionElement.h in Headers */,
 				97BC69DB1505F076001B74AC /* AbstractDatabase.h in Headers */,
 				41E1B1D10FF5986900576B3B /* AbstractWorker.h in Headers */,
 				29A8122E0FBB9C1D00510293 /* AccessibilityARIAGridCell.h in Headers */,
@@ -22453,6 +22492,7 @@
 				BC124EE80C2641CD009E2349 /* BarInfo.h in Headers */,
 				379E61CA126CA5C400B63E8D /* BaseButtonInputType.h in Headers */,
 				379E61CC126CA5C400B63E8D /* BaseCheckableInputType.h in Headers */,
+				F5E0C65C1643C42C00D6CB69 /* BaseChooserOnlyDateAndTimeInputType.h in Headers */,
 				C33EE5C514FB49610002095A /* BaseClickableWithKeyInputType.h in Headers */,
 				F59C96001255B23F000623C0 /* BaseDateAndTimeInputType.h in Headers */,
 				45861C73161949DC00010F3A /* BaseMultipleFieldsDateAndTimeInputType.h in Headers */,
@@ -22524,6 +22564,8 @@
 				49C7B9DD1042D32F0009D447 /* CanvasRenderingContext.h in Headers */,
 				49484FCB102CF23C00187DD3 /* CanvasRenderingContext2D.h in Headers */,
 				49484FCE102CF23C00187DD3 /* CanvasStyle.h in Headers */,
+				079D0868162F20E800DB8658 /* CaptionUserPreferences.h in Headers */,
+				079D086B162F21F900DB8658 /* CaptionUserPreferencesMac.h in Headers */,
 				6550B69E099DF0270090D781 /* CDATASection.h in Headers */,
 				97BC69DD1505F076001B74AC /* ChangeVersionWrapper.h in Headers */,
 				FD315FFF12B0267600C1A359 /* ChannelMergerNode.h in Headers */,
@@ -22671,7 +22713,7 @@
 				62CD325A1157E57C0063B0A7 /* CustomEvent.h in Headers */,
 				15B3FC1915FB217800A81BCB /* CustomFilterArrayParameter.h in Headers */,
 				50D40612147D49DE00D30BB5 /* CustomFilterCompiledProgram.h in Headers */,
-				A24A3A9D162499FF00522745 /* CustomFilterConstants.h in Headers */,
+				A2B2AE7C16375EE500CFA50B /* CustomFilterConstants.h in Headers */,
 				50987C27157D676D00BDA835 /* CustomFilterGlobalContext.h in Headers */,
 				50D405FA147D31F300D30BB5 /* CustomFilterMesh.h in Headers */,
 				7E12E90F15FA5D3A005E4126 /* CustomFilterMeshGenerator.h in Headers */,
@@ -22681,6 +22723,7 @@
 				503D0CAB14B5B08700F32F57 /* CustomFilterProgram.h in Headers */,
 				503D0CAC14B5B08700F32F57 /* CustomFilterProgramClient.h in Headers */,
 				50D88CB615BDFDAA001809F4 /* CustomFilterProgramInfo.h in Headers */,
+				503D0CAB14B5B08700F32F58 /* CustomFilterRenderer.h in Headers */,
 				A29532D015DD5E1700469EBC /* CustomFilterValidatedProgram.h in Headers */,
 				A8CB413E0E8633FD0032C4F0 /* DashArray.h in Headers */,
 				A80E6D0B0A1989CA007FB8C5 /* DashboardRegion.h in Headers */,
@@ -23340,8 +23383,6 @@
 				188604B40F2E654A000B6443 /* DOMTimer.h in Headers */,
 				05FD69E012845D4300B2BEB3 /* DOMTimeStamp.h in Headers */,
 				76FC2B0C12370DA0006A991A /* DOMTokenList.h in Headers */,
-				7BB35AEC15CCDDF400F2A643 /* DOMTransaction.h in Headers */,
-				7BD117EC15B8DB0100C974A3 /* DOMTransactionStep.h in Headers */,
 				BC1A37BE097C715F0019F3D8 /* DOMTraversal.h in Headers */,
 				85526CD20AB0B7D9000302EA /* DOMTreeWalker.h in Headers */,
 				850B41C30AD9E7E700A6ED4F /* DOMTreeWalkerInternal.h in Headers */,
@@ -23395,7 +23436,6 @@
 				3169379C14609C6C00C01362 /* DragSession.h in Headers */,
 				81F65FF613788FAA00FF6F2D /* DragState.h in Headers */,
 				498770DC1242C535002226BA /* DrawingBuffer.h in Headers */,
-				BC7FA6210D1F0CBD00DB22A9 /* DynamicNodeList.h in Headers */,
 				FD6ED2C8136B8E66003CF072 /* DynamicsCompressor.h in Headers */,
 				FD537357137B653B00008DCE /* DynamicsCompressorKernel.h in Headers */,
 				FD6ED2C4136B8E42003CF072 /* DynamicsCompressorNode.h in Headers */,
@@ -23709,8 +23749,6 @@
 				A871D45A0A127CBC00B12A68 /* HTMLObjectElement.h in Headers */,
 				A8EA79F10A1916DF00A8EF5F /* HTMLOListElement.h in Headers */,
 				A81369DE097374F600D74463 /* HTMLOptGroupElement.h in Headers */,
-				A81369DC097374F600D74463 /* HTMLOptionElement.h in Headers */,
-				A81369DA097374F600D74463 /* HTMLOptionsCollection.h in Headers */,
 				4AD01009127E642A0015035F /* HTMLOutputElement.h in Headers */,
 				A8EA7CB50A192B9C00A8EF5F /* HTMLParagraphElement.h in Headers */,
 				A871D4580A127CBC00B12A68 /* HTMLParamElement.h in Headers */,
@@ -23728,7 +23766,6 @@
 				A871DC250A15205700B12A68 /* HTMLScriptElement.h in Headers */,
 				977B3875122883E900B81FF8 /* HTMLScriptRunner.h in Headers */,
 				977B3876122883E900B81FF8 /* HTMLScriptRunnerHost.h in Headers */,
-				A81369D8097374F600D74463 /* HTMLSelectElement.h in Headers */,
 				4ABDFF0C14DBE385004D117D /* HTMLShadowElement.h in Headers */,
 				E44613A80CD6331000FADA75 /* HTMLSourceElement.h in Headers */,
 				977E2DCE12F0E28300C13379 /* HTMLSourceTracker.h in Headers */,
@@ -23993,7 +24030,6 @@
 				C5137CF311A58378004ADB99 /* JSDOMStringList.h in Headers */,
 				BC64649811D82349006455B0 /* JSDOMStringMap.h in Headers */,
 				7694563D1214D97C0007CBAE /* JSDOMTokenList.h in Headers */,
-				7B3537C615CB2CB50083AB69 /* JSDOMTransaction.h in Headers */,
 				2E37E00612DBC5A400A6B233 /* JSDOMURL.h in Headers */,
 				BC6932740D7E293900AE44D1 /* JSDOMWindowBase.h in Headers */,
 				652FBBBC0DE27CB60001D386 /* JSDOMWindowCustom.h in Headers */,
@@ -24173,6 +24209,7 @@
 				33503CA410179AD7003B47E1 /* JSNotification.h in Headers */,
 				33503CA610179AD7003B47E1 /* JSNotificationCenter.h in Headers */,
 				31EC1E2914FF60EE00C94662 /* JSNotificationPermissionCallback.h in Headers */,
+				7E46F6FB1627A2CA00062223 /* JSOESElementIndexUint.h in Headers */,
 				9001788112E0370700648462 /* JSOESStandardDerivatives.h in Headers */,
 				6EBF0E7712A9868800DB1709 /* JSOESTextureFloat.h in Headers */,
 				77A17AA712F28B2A004E02F6 /* JSOESVertexArrayObject.h in Headers */,
@@ -24387,7 +24424,6 @@
 				49EECF0B105070C400099FAB /* JSUint32Array.h in Headers */,
 				49EECF09105070C400099FAB /* JSUint8Array.h in Headers */,
 				91089D3214C33600005AFC49 /* JSUint8ClampedArray.h in Headers */,
-				7B1EA0CF1576C5B50060177D /* JSUndoManager.h in Headers */,
 				15C77093100D3CA8005BA267 /* JSValidityState.h in Headers */,
 				FD82D7F813D4C8BD004E4372 /* JSWaveShaperNode.h in Headers */,
 				FDEA6247152102FC00479DF0 /* JSWaveTable.h in Headers */,
@@ -24479,16 +24515,15 @@
 				9759E94914EF1D490026A2DD /* LoadableTextTrack.h in Headers */,
 				656D37320ADBA5DE00A4554D /* LoaderNSURLExtras.h in Headers */,
 				7EE6846912D26E3800E79415 /* LoaderRunLoopCF.h in Headers */,
+				51E6821016387302003BBF3C /* LoaderStrategy.h in Headers */,
 				06E81ED70AB5D5E900C87837 /* LocalCurrentGraphicsContext.h in Headers */,
 				F5973DE015CFB2030027F804 /* LocaleMac.h in Headers */,
 				7633A72613D8B33A008501B6 /* LocaleToScriptMapping.h in Headers */,
 				89878568122CA064003AABDA /* LocalFileSystem.h in Headers */,
 				935207BE09BD410A00F2038D /* LocalizedStrings.h in Headers */,
-				F544F78915CFB2A800AF33A8 /* Localizer.h in Headers */,
 				BCE1C41B0D982980003B02F2 /* Location.h in Headers */,
 				A8239E0109B3CF8A00B60641 /* Logging.h in Headers */,
 				656D37410ADBA5DE00A4554D /* MainResourceLoader.h in Headers */,
-				52F10866162B6DA8009AC81E /* MixedContentChecker.h in Headers */,
 				1A8F6BC60DB55CDC001DB794 /* ManifestParser.h in Headers */,
 				93309DF8099E64920056E581 /* markup.h in Headers */,
 				9728C3141268E4390041E89B /* MarkupAccumulator.h in Headers */,
@@ -24545,6 +24580,7 @@
 				9B375EDB14478A0100F3CAE5 /* MicroDataItemList.h in Headers */,
 				37DDCD9513844FD50008B793 /* MIMEHeader.h in Headers */,
 				BC772C4F0C4EB3040083285F /* MIMETypeRegistry.h in Headers */,
+				52F10866162B6DA8009AC81E /* MixedContentChecker.h in Headers */,
 				F508246F1548D96200A119AB /* MockPagePopupDriver.h in Headers */,
 				C6D74AD509AA282E000B0A52 /* ModifySelectionListLevel.h in Headers */,
 				F55B3DC61251F12D003EF269 /* MonthInputType.h in Headers */,
@@ -24610,6 +24646,7 @@
 				1CF6BDFA0E9BB26A0025E1CD /* ObjCEventListener.h in Headers */,
 				1CF6BE150E9BB4670025E1CD /* ObjCNodeFilterCondition.h in Headers */,
 				E16982551134629D00894115 /* ObjCRuntimeObject.h in Headers */,
+				7E5D7A77161D3F8F00896C34 /* OESElementIndexUint.h in Headers */,
 				9001774112E0347800648462 /* OESStandardDerivatives.h in Headers */,
 				6EBF0E4912A8926100DB1709 /* OESTextureFloat.h in Headers */,
 				77A17A7212F28182004E02F6 /* OESVertexArrayObject.h in Headers */,
@@ -24674,6 +24711,7 @@
 				49182B5315DCE6F000548418 /* PlatformInstrumentation.h in Headers */,
 				935C476809AC4D4300A6AAB4 /* PlatformKeyboardEvent.h in Headers */,
 				0562F9611573F88F0031CA16 /* PlatformLayer.h in Headers */,
+				F544F78915CFB2A800AF33A8 /* PlatformLocale.h in Headers */,
 				4F7B4A6615FF6D6A006B5F22 /* PlatformMemoryInstrumentation.h in Headers */,
 				932871C00B20DEB70049035A /* PlatformMenuDescription.h in Headers */,
 				41BF70100FE86F61005E8DEC /* PlatformMessagePortChannel.h in Headers */,
@@ -25007,6 +25045,7 @@
 				41E1B1D40FF5986900576B3B /* SharedWorker.h in Headers */,
 				41D168E810226E89009BC827 /* SharedWorkerContext.h in Headers */,
 				41D168EA10226E89009BC827 /* SharedWorkerRepository.h in Headers */,
+				E1B7839C163740A70007B692 /* SharedWorkerStrategy.h in Headers */,
 				41D168EE10226E89009BC827 /* SharedWorkerThread.h in Headers */,
 				5728BD9E1625369600C40B56 /* SiblingTraversalStrategies.h in Headers */,
 				B2C3DA650D006CD600EF6F26 /* SimpleFontData.h in Headers */,
@@ -25106,6 +25145,7 @@
 				A110DB9B14F5DF7700A03B93 /* StyleGridItemData.h in Headers */,
 				BCEF43CF0E673DA1001C1287 /* StyleImage.h in Headers */,
 				BC2273040E82F1E600E7F975 /* StyleInheritedData.h in Headers */,
+				E47127CB163438AE00ED6F5A /* StyleInvalidationAnalysis.h in Headers */,
 				BC5EB72A0E81DE8100B25965 /* StyleMarqueeData.h in Headers */,
 				0FF50272102BA96A0066F39A /* StyleMedia.h in Headers */,
 				BC5EB74E0E81E06700B25965 /* StyleMultiColData.h in Headers */,
@@ -25452,7 +25492,6 @@
 				93309E1A099E64920056E581 /* TypingCommand.h in Headers */,
 				85031B4E0A44EFC700F992E0 /* UIEvent.h in Headers */,
 				85031B4F0A44EFC700F992E0 /* UIEventWithKeyState.h in Headers */,
-				7B9184D315758E420092AA93 /* UndoManager.h in Headers */,
 				9B2D8A7914997CCF00ECEF3E /* UndoStep.h in Headers */,
 				A863E2011343412000274926 /* UnicodeBidi.h in Headers */,
 				B2C3DA4D0D006C1D00EF6F26 /* UnicodeRange.h in Headers */,
@@ -25646,9 +25685,13 @@
 				E1BE512E0CF6C512002EA959 /* XSLTUnicodeSort.h in Headers */,
 				977E2E0F12F0FC9C00C13379 /* XSSAuditor.h in Headers */,
 				FD537353137B651800008DCE /* ZeroPole.h in Headers */,
-				7E5D7A77161D3F8F00896C34 /* OESElementIndexUint.h in Headers */,
-				7E46F6FB1627A2CA00062223 /* JSOESElementIndexUint.h in Headers */,
-				E47127CB163438AE00ED6F5A /* StyleInvalidationAnalysis.h in Headers */,
+				AAC08CEF15F933D600F1E188 /* SVGImageChromeClient.h in Headers */,
+				AAC08CF315F941FD00F1E188 /* AccessibilitySVGRoot.h in Headers */,
+				50933350163B0E4300099A60 /* CustomFilterParameterList.h in Headers */,
+				50D32858163B313F0016111E /* ValidatedCustomFilterOperation.h in Headers */,
+				3FFFF9A9159D9A550020BBD5 /* WebKitCSSViewportRule.h in Headers */,
+				93C38BFF164473C700091EB2 /* ScrollingStateFixedNode.h in Headers */,
+				93C38C03164473DD00091EB2 /* ScrollingTreeFixedNode.h in Headers */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
@@ -25704,8 +25747,6 @@
 				1C5F9D760E09A1B400E91D0A /* Streamline Inspector Source */,
 				93F19A0C08245E59001E9ABC /* Sources */,
 				93F19B1208245E59001E9ABC /* Frameworks */,
-				939D050109D9FF6B00984996 /* Check For Global Initializers */,
-				933457E60EBFDF6B00B80894 /* Check For Exit Time Destructors */,
 				5D0D540D0E9862F60029E223 /* Check For Weak VTables and Externals */,
 				37A1EAA3142699BC0087F425 /* Check For Inappropriate Objective-C Class Names */,
 				5DF50887116F3077005202AB /* Check For Inappropriate Files In Framework */,
@@ -25943,36 +25984,6 @@
 			shellPath = /bin/sh;
 			shellScript = "if [ \"${ACTION}\" = \"installhdrs\" ]; then\n    exit 0;\nfi\n\nif [ -f ../../Tools/Scripts/check-for-inappropriate-files-in-framework ]; then\n    ../../Tools/Scripts/check-for-inappropriate-files-in-framework || exit $?\nfi\n";
 		};
-		933457E60EBFDF6B00B80894 /* Check For Exit Time Destructors */ = {
-			isa = PBXShellScriptBuildPhase;
-			buildActionMask = 2147483647;
-			files = (
-			);
-			inputPaths = (
-				"$(TARGET_BUILD_DIR)/$(EXECUTABLE_PATH)",
-			);
-			name = "Check For Exit Time Destructors";
-			outputPaths = (
-			);
-			runOnlyForDeploymentPostprocessing = 0;
-			shellPath = /bin/sh;
-			shellScript = "if [ \"${TARGET_GCC_VERSION}\" = \"LLVM_COMPILER\" ]; then\n    exit 0;\nfi\n\nif [ \"${ACTION}\" = \"installhdrs\" ]; then\n    exit 0;\nfi\n\nif [ -f ../../Tools/Scripts/check-for-exit-time-destructors ]; then\n    ../../Tools/Scripts/check-for-exit-time-destructors || exit $?\nfi";
-		};
-		939D050109D9FF6B00984996 /* Check For Global Initializers */ = {
-			isa = PBXShellScriptBuildPhase;
-			buildActionMask = 2147483647;
-			files = (
-			);
-			inputPaths = (
-				"$(TARGET_BUILD_DIR)/$(EXECUTABLE_PATH)",
-			);
-			name = "Check For Global Initializers";
-			outputPaths = (
-			);
-			runOnlyForDeploymentPostprocessing = 0;
-			shellPath = /bin/sh;
-			shellScript = "if [ \"${TARGET_GCC_VERSION}\" = \"LLVM_COMPILER\" ]; then\n    exit 0;\nfi\n\nif [ \"${ACTION}\" = \"installhdrs\" ]; then\n    exit 0;\nfi\n\nif [ -f ../../Tools/Scripts/check-for-global-initializers ]; then\n    ../../Tools/Scripts/check-for-global-initializers || exit $?\nfi";
-		};
 		DD041FBD09D9DDBE0010AF2A /* Generate Derived Sources */ = {
 			isa = PBXShellScriptBuildPhase;
 			buildActionMask = 2147483647;
@@ -25985,7 +25996,7 @@
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 			shellPath = /bin/sh;
-			shellScript = "mkdir -p \"${BUILT_PRODUCTS_DIR}/DerivedSources/WebCore\"\ncd \"${BUILT_PRODUCTS_DIR}/DerivedSources/WebCore\"\n\n/bin/ln -sfh \"${SRCROOT}\" WebCore\nexport WebCore=\"WebCore\"\n\nif [ ! $CC ]; then\n    case $TARGET_GCC_VERSION in\n        (GCC_42)\n            export CC=\"`xcrun -find gcc-4.2`\";;\n        (LLVM_GCC_42)\n            export CC=\"`xcrun -find llvm-gcc-4.2`\";;\n        (LLVM_COMPILER)\n            export CC=\"`xcrun -find clang`\";;\n    esac\nfi\n\nif [ ! $GPERF ]; then\n    export GPERF=\"`xcrun -find gperf`\"\nfi\n\nif [ \"${ACTION}\" = \"build\" -o \"${ACTION}\" = \"install\" -o \"${ACTION}\" = \"installhdrs\" ]; then\n    make  --no-builtin-rules -f \"WebCore/DerivedSources.make\" -j `/usr/sbin/sysctl -n hw.availcpu`\nfi\n";
+			shellScript = "mkdir -p \"${BUILT_PRODUCTS_DIR}/DerivedSources/WebCore\"\ncd \"${BUILT_PRODUCTS_DIR}/DerivedSources/WebCore\"\n\n/bin/ln -sfh \"${SRCROOT}\" WebCore\nexport WebCore=\"WebCore\"\n\nif [ ! $CC ]; then\n    export CC=\"`xcrun -find clang`\"\nfi\n\nif [ ! $GPERF ]; then\n    export GPERF=\"`xcrun -find gperf`\"\nfi\n\nif [ \"${ACTION}\" = \"build\" -o \"${ACTION}\" = \"install\" -o \"${ACTION}\" = \"installhdrs\" ]; then\n    make  --no-builtin-rules -f \"WebCore/DerivedSources.make\" -j `/usr/sbin/sysctl -n hw.availcpu`\nfi\n";
 		};
 /* End PBXShellScriptBuildPhase section */
 
@@ -26089,6 +26100,7 @@
 				BC124EE70C2641CD009E2349 /* BarInfo.cpp in Sources */,
 				379E61C9126CA5C300B63E8D /* BaseButtonInputType.cpp in Sources */,
 				379E61CB126CA5C400B63E8D /* BaseCheckableInputType.cpp in Sources */,
+				F5E0C65B1643C42C00D6CB69 /* BaseChooserOnlyDateAndTimeInputType.cpp in Sources */,
 				C33EE5C414FB49610002095A /* BaseClickableWithKeyInputType.cpp in Sources */,
 				F59C95FF1255B23F000623C0 /* BaseDateAndTimeInputType.cpp in Sources */,
 				45861C72161949DC00010F3A /* BaseMultipleFieldsDateAndTimeInputType.cpp in Sources */,
@@ -26145,6 +26157,7 @@
 				49C7B9DC1042D32F0009D447 /* CanvasRenderingContext.cpp in Sources */,
 				49484FCA102CF23C00187DD3 /* CanvasRenderingContext2D.cpp in Sources */,
 				49484FCD102CF23C00187DD3 /* CanvasStyle.cpp in Sources */,
+				079D086C162F21F900DB8658 /* CaptionUserPreferencesMac.mm in Sources */,
 				6550B69D099DF0270090D781 /* CDATASection.cpp in Sources */,
 				97BC69DC1505F076001B74AC /* ChangeVersionWrapper.cpp in Sources */,
 				FD315FFE12B0267600C1A359 /* ChannelMergerNode.cpp in Sources */,
@@ -26276,6 +26289,7 @@
 				50CC0A3914C6F5B10017AB51 /* CustomFilterOperation.cpp in Sources */,
 				503D0CAA14B5B08700F32F57 /* CustomFilterProgram.cpp in Sources */,
 				50D88CB515BDFDAA001809F4 /* CustomFilterProgramInfo.cpp in Sources */,
+				503D0CAA14B5B08700F32F58 /* CustomFilterRenderer.cpp in Sources */,
 				A29532CF15DD5E1700469EBC /* CustomFilterValidatedProgram.cpp in Sources */,
 				97BC6A201505F081001B74AC /* Database.cpp in Sources */,
 				97BC6A231505F081001B74AC /* DatabaseAuthorizer.cpp in Sources */,
@@ -26642,8 +26656,6 @@
 				933A14AA0B7D1D0900A53FFD /* DOMTextEvent.mm in Sources */,
 				188604B30F2E654A000B6443 /* DOMTimer.cpp in Sources */,
 				76FC2B0B12370DA0006A991A /* DOMTokenList.cpp in Sources */,
-				7BB35AEB15CCDDF400F2A643 /* DOMTransaction.cpp in Sources */,
-				7BD117EB15B8DB0100C974A3 /* DOMTransactionStep.cpp in Sources */,
 				85526CD30AB0B7DA000302EA /* DOMTreeWalker.mm in Sources */,
 				85C7F4920AAF79DC004014DD /* DOMUIEvent.mm in Sources */,
 				2E37DFDA12DBAFB800A6B233 /* DOMURL.cpp in Sources */,
@@ -27237,7 +27249,6 @@
 				BC64649C11D8238C006455B0 /* JSDOMStringMapCustom.cpp in Sources */,
 				7694563C1214D97C0007CBAE /* JSDOMTokenList.cpp in Sources */,
 				14E0BC56136148A8002AD12E /* JSDOMTokenListCustom.cpp in Sources */,
-				7B3537C515CB2CB50083AB69 /* JSDOMTransaction.cpp in Sources */,
 				2E37E00512DBC5A400A6B233 /* JSDOMURL.cpp in Sources */,
 				1403BA0C09EB18C700797C7F /* JSDOMWindow.cpp in Sources */,
 				BC6932730D7E293900AE44D1 /* JSDOMWindowBase.cpp in Sources */,
@@ -27467,6 +27478,7 @@
 				33503CA510179AD7003B47E1 /* JSNotificationCenter.cpp in Sources */,
 				31FE6E6D1501A3BF0004EBC4 /* JSNotificationCustom.cpp in Sources */,
 				31EC1E2814FF60EE00C94662 /* JSNotificationPermissionCallback.cpp in Sources */,
+				7E46F6FA1627A2CA00062223 /* JSOESElementIndexUint.cpp in Sources */,
 				9001788012E0370700648462 /* JSOESStandardDerivatives.cpp in Sources */,
 				6EBF0E7612A9868800DB1709 /* JSOESTextureFloat.cpp in Sources */,
 				77A17AA612F28B2A004E02F6 /* JSOESVertexArrayObject.cpp in Sources */,
@@ -27703,8 +27715,6 @@
 				49EECF0A105070C400099FAB /* JSUint32Array.cpp in Sources */,
 				49EECF08105070C400099FAB /* JSUint8Array.cpp in Sources */,
 				91089D3314C33605005AFC49 /* JSUint8ClampedArray.cpp in Sources */,
-				7B1EA0CE1576C5B50060177D /* JSUndoManager.cpp in Sources */,
-				7B0992F515ACF1AD00ED6D20 /* JSUndoManagerCustom.cpp in Sources */,
 				15C77094100D3CA8005BA267 /* JSValidityState.cpp in Sources */,
 				9703E1BF15DC4E37001F24C8 /* JSVoidCallback.cpp in Sources */,
 				FD82D7F713D4C8BD004E4372 /* JSWaveShaperNode.cpp in Sources */,
@@ -27811,12 +27821,10 @@
 				89878567122CA064003AABDA /* LocalFileSystem.cpp in Sources */,
 				C046E1AC1208A9FE00BA2CF7 /* LocalizedStrings.cpp in Sources */,
 				BC25B52A131C6D3900180E10 /* LocalizedStringsMac.cpp in Sources */,
-				F544F78815CFB2A800AF33A8 /* Localizer.cpp in Sources */,
 				BCE1C41C0D982981003B02F2 /* Location.cpp in Sources */,
 				A8239E0009B3CF8A00B60641 /* Logging.cpp in Sources */,
 				1402645E0AFDC19B005919E2 /* LoggingMac.mm in Sources */,
 				93E227E10AF589AD00D48324 /* MainResourceLoader.cpp in Sources */,
-				52F10865162B6DA4009AC81E /* MixedContentChecker.cpp in Sources */,
 				1A8F6BC50DB55CDC001DB794 /* ManifestParser.cpp in Sources */,
 				93309DF7099E64920056E581 /* markup.cpp in Sources */,
 				9728C3131268E4390041E89B /* MarkupAccumulator.cpp in Sources */,
@@ -27868,6 +27876,7 @@
 				37DDCD9413844FD50008B793 /* MIMEHeader.cpp in Sources */,
 				BC772C4E0C4EB3040083285F /* MIMETypeRegistry.cpp in Sources */,
 				BC772C5E0C4EB3440083285F /* MIMETypeRegistryMac.mm in Sources */,
+				52F10865162B6DA4009AC81E /* MixedContentChecker.cpp in Sources */,
 				F508246E1548D96200A119AB /* MockPagePopupDriver.cpp in Sources */,
 				C6D74AE409AA290A000B0A52 /* ModifySelectionListLevel.cpp in Sources */,
 				F55B3DC51251F12D003EF269 /* MonthInputType.cpp in Sources */,
@@ -27916,6 +27925,7 @@
 				1CF6BDFB0E9BB26A0025E1CD /* ObjCEventListener.mm in Sources */,
 				1CF6BE140E9BB4670025E1CD /* ObjCNodeFilterCondition.mm in Sources */,
 				E16982601134636A00894115 /* ObjCRuntimeObject.mm in Sources */,
+				7E5D7A76161D3F8F00896C34 /* OESElementIndexUint.cpp in Sources */,
 				9001774012E0347800648462 /* OESStandardDerivatives.cpp in Sources */,
 				6EBF0E4812A8926100DB1709 /* OESTextureFloat.cpp in Sources */,
 				77A17A7112F28182004E02F6 /* OESVertexArrayObject.cpp in Sources */,
@@ -27968,6 +27978,7 @@
 				BC5C762A1497FE1400BC4775 /* PlatformEvent.cpp in Sources */,
 				BCAA486F14A052530088FAC4 /* PlatformEventFactoryMac.mm in Sources */,
 				49182B5215DCE6F000548418 /* PlatformInstrumentation.cpp in Sources */,
+				F544F78815CFB2A800AF33A8 /* PlatformLocale.cpp in Sources */,
 				4F1D11BF15FF37200026E908 /* PlatformMemoryInstrumentation.cpp in Sources */,
 				41BF700F0FE86F61005E8DEC /* PlatformMessagePortChannel.cpp in Sources */,
 				C598902E14E9B0F800E8D18B /* PlatformPasteboardMac.mm in Sources */,
@@ -28327,6 +28338,7 @@
 				A10DC76A14747BAB005E2471 /* StyleGridData.cpp in Sources */,
 				A110DB9D14F5DF8700A03B93 /* StyleGridItemData.cpp in Sources */,
 				BC2273030E82F1E600E7F975 /* StyleInheritedData.cpp in Sources */,
+				E47127CA163438A100ED6F5A /* StyleInvalidationAnalysis.cpp in Sources */,
 				BC5EB7290E81DE8100B25965 /* StyleMarqueeData.cpp in Sources */,
 				0FF50271102BA96A0066F39A /* StyleMedia.cpp in Sources */,
 				BC5EB74D0E81E06700B25965 /* StyleMultiColData.cpp in Sources */,
@@ -28592,7 +28604,6 @@
 				93309E19099E64920056E581 /* TypingCommand.cpp in Sources */,
 				85031B4D0A44EFC700F992E0 /* UIEvent.cpp in Sources */,
 				93354A3C0B24F8C9003F6DEA /* UIEventWithKeyState.cpp in Sources */,
-				7B9184D215758E420092AA93 /* UndoManager.cpp in Sources */,
 				B2C3DA4C0D006C1D00EF6F26 /* UnicodeRange.cpp in Sources */,
 				D086FE9909D53AAB005BC74D /* UnlinkCommand.cpp in Sources */,
 				F55B3DDD1251F12D003EF269 /* URLInputType.cpp in Sources */,
@@ -28757,9 +28768,16 @@
 				E1BE512D0CF6C512002EA959 /* XSLTUnicodeSort.cpp in Sources */,
 				977E2E0E12F0FC9C00C13379 /* XSSAuditor.cpp in Sources */,
 				FD537352137B651800008DCE /* ZeroPole.cpp in Sources */,
-				7E5D7A76161D3F8F00896C34 /* OESElementIndexUint.cpp in Sources */,
-				7E46F6FA1627A2CA00062223 /* JSOESElementIndexUint.cpp in Sources */,
-				E47127CA163438A100ED6F5A /* StyleInvalidationAnalysis.cpp in Sources */,
+				51ABF64D16392E2800132A7A /* LoaderStrategy.cpp in Sources */,
+				5093334F163B0E4300099A60 /* CustomFilterParameterList.cpp in Sources */,
+				1AA21250163F0DA80000E63F /* AtomicStringCF.cpp in Sources */,
+				50D32857163B313F0016111E /* ValidatedCustomFilterOperation.cpp in Sources */,
+				3FFFF9A8159D9A550020BBD5 /* WebKitCSSViewportRule.cpp in Sources */,
+				4FFC022B1643B710004E1638 /* NodeRareData.cpp in Sources */,
+				4FFC022D1643B726004E1638 /* ElementRareData.cpp in Sources */,
+				93C38BFE164473C700091EB2 /* ScrollingStateFixedNode.cpp in Sources */,
+				93C38C04164473DD00091EB2 /* ScrollingTreeFixedNode.mm in Sources */,
+				4FC8534C1644272300D1C275 /* CachedMetadata.cpp in Sources */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
diff --git a/Source/WebCore/accessibility/AXObjectCache.cpp b/Source/WebCore/accessibility/AXObjectCache.cpp
index 665abc087..d88a15a36 100644
--- a/Source/WebCore/accessibility/AXObjectCache.cpp
+++ b/Source/WebCore/accessibility/AXObjectCache.cpp
@@ -45,6 +45,7 @@
 #include "AccessibilityMenuListPopup.h"
 #include "AccessibilityProgressIndicator.h"
 #include "AccessibilityRenderObject.h"
+#include "AccessibilitySVGRoot.h"
 #include "AccessibilityScrollView.h"
 #include "AccessibilityScrollbar.h"
 #include "AccessibilitySlider.h"
@@ -60,6 +61,7 @@
 #include "HTMLAreaElement.h"
 #include "HTMLImageElement.h"
 #include "HTMLInputElement.h"
+#include "HTMLLabelElement.h"
 #include "HTMLNames.h"
 #if ENABLE(VIDEO)
 #include "MediaControlElements.h"
@@ -249,6 +251,11 @@ static PassRefPtr<AccessibilityObject> createFromRenderer(RenderObject* renderer
         return AccessibilityMediaControl::create(renderer);
 #endif
 
+#if ENABLE(SVG)
+    if (renderer->isSVGRoot())
+        return AccessibilitySVGRoot::create(renderer);
+#endif
+    
     if (renderer->isBoxModelObject()) {
         RenderBoxModelObject* cssBox = toRenderBoxModelObject(renderer);
         if (cssBox->isListBox())
@@ -333,6 +340,9 @@ AccessibilityObject* AXObjectCache::getOrCreate(Node* node)
     m_nodeObjectMapping.set(node, newObj->axObjectID());
     m_objects.set(newObj->axObjectID(), newObj);
     attachWrapper(newObj.get());
+
+    newObj->setCachedIsIgnoredValue(newObj->accessibilityIsIgnored());
+
     return newObj.get();
 }
 
@@ -351,6 +361,9 @@ AccessibilityObject* AXObjectCache::getOrCreate(RenderObject* renderer)
     m_renderObjectMapping.set(renderer, newObj->axObjectID());
     m_objects.set(newObj->axObjectID(), newObj);
     attachWrapper(newObj.get());
+
+    newObj->setCachedIsIgnoredValue(newObj->accessibilityIsIgnored());
+
     return newObj.get();
 }
     
@@ -527,16 +540,26 @@ void AXObjectCache::removeAXID(AccessibilityObject* object)
     m_idsInUse.remove(objID);
 }
 
-void AXObjectCache::contentChanged(Node* node)
+void AXObjectCache::textChanged(Node* node)
 {
-    if (AccessibilityObject* object = getOrCreate(node))
-        object->contentChanged(); 
+    textChanged(getOrCreate(node));
 }
 
-void AXObjectCache::contentChanged(RenderObject* renderer)
+void AXObjectCache::textChanged(RenderObject* renderer)
 {
-    if (AccessibilityObject* object = getOrCreate(renderer))
-        object->contentChanged(); 
+    textChanged(getOrCreate(renderer));
+}
+
+void AXObjectCache::textChanged(AccessibilityObject* obj)
+{
+    if (!obj)
+        return;
+
+    bool parentAlreadyExists = obj->parentObjectIfExists();
+    obj->textChanged();
+    postNotification(obj, obj->document(), AXObjectCache::AXTextChanged, true);
+    if (parentAlreadyExists)
+        obj->notifyIfIgnoredValueChanged();
 }
 
 void AXObjectCache::updateCacheAfterNodeIsAttached(Node* node)
@@ -548,14 +571,23 @@ void AXObjectCache::updateCacheAfterNodeIsAttached(Node* node)
 
 void AXObjectCache::childrenChanged(Node* node)
 {
-    if (AccessibilityObject* obj = get(node))
-        obj->childrenChanged();
+    childrenChanged(get(node));
 }
 
 void AXObjectCache::childrenChanged(RenderObject* renderer)
 {
-    if (AccessibilityObject* obj = get(renderer))
-        obj->childrenChanged();
+    childrenChanged(get(renderer));
+}
+
+void AXObjectCache::childrenChanged(AccessibilityObject* obj)
+{
+    if (!obj)
+        return;
+
+    obj->childrenChanged();
+
+    if (obj->parentObjectIfExists() && obj->cachedIsIgnoredValue() != obj->accessibilityIsIgnored())
+        childrenChanged(obj->parentObject());
 }
     
 void AXObjectCache::notificationPostTimerFired(Timer<AXObjectCache>*)
@@ -706,8 +738,55 @@ void AXObjectCache::handleActiveDescendantChanged(Node* node)
 
 void AXObjectCache::handleAriaRoleChanged(Node* node)
 {
-    if (AccessibilityObject* obj = getOrCreate(node))
+    if (AccessibilityObject* obj = getOrCreate(node)) {
         obj->updateAccessibilityRole();
+        obj->notifyIfIgnoredValueChanged();
+    }
+}
+
+void AXObjectCache::handleAttributeChanged(const QualifiedName& attrName, Element* element)
+{
+    if (attrName == roleAttr)
+        handleAriaRoleChanged(element);
+    else if (attrName == altAttr || attrName == titleAttr)
+        textChanged(element);
+    else if (attrName == forAttr && element->hasTagName(labelTag))
+        labelChanged(element);
+
+    if (!attrName.localName().string().startsWith("aria-"))
+        return;
+
+    if (attrName == aria_activedescendantAttr)
+        handleActiveDescendantChanged(element);
+    else if (attrName == aria_valuenowAttr || attrName == aria_valuetextAttr)
+        postNotification(element, AXObjectCache::AXValueChanged, true);
+    else if (attrName == aria_labelAttr || attrName == aria_labeledbyAttr || attrName == aria_labelledbyAttr)
+        textChanged(element);
+    else if (attrName == aria_checkedAttr)
+        checkedStateChanged(element);
+    else if (attrName == aria_selectedAttr)
+        selectedChildrenChanged(element);
+    else if (attrName == aria_expandedAttr)
+        handleAriaExpandedChange(element);
+    else if (attrName == aria_hiddenAttr)
+        childrenChanged(element->parentNode());
+    else if (attrName == aria_invalidAttr)
+        postNotification(element, AXObjectCache::AXInvalidStatusChanged, true);
+    else
+        postNotification(element, AXObjectCache::AXAriaAttributeChanged, true);
+}
+
+void AXObjectCache::labelChanged(Element* element)
+{
+    ASSERT(element->hasTagName(labelTag));
+    HTMLElement* correspondingControl = static_cast<HTMLLabelElement*>(element)->control();
+    textChanged(correspondingControl);
+}
+
+void AXObjectCache::recomputeIsIgnored(RenderObject* renderer)
+{
+    if (AccessibilityObject* obj = get(renderer))
+        obj->notifyIfIgnoredValueChanged();
 }
 
 VisiblePosition AXObjectCache::visiblePositionForTextMarkerData(TextMarkerData& textMarkerData)
diff --git a/Source/WebCore/accessibility/AXObjectCache.h b/Source/WebCore/accessibility/AXObjectCache.h
index fdfd5afbf..4edf81503 100644
--- a/Source/WebCore/accessibility/AXObjectCache.h
+++ b/Source/WebCore/accessibility/AXObjectCache.h
@@ -89,12 +89,13 @@ public:
     void attachWrapper(AccessibilityObject*);
     void childrenChanged(Node*);
     void childrenChanged(RenderObject*);
+    void childrenChanged(AccessibilityObject*);
     void checkedStateChanged(Node*);
     void selectedChildrenChanged(Node*);
     void selectedChildrenChanged(RenderObject*);
     // Called by a node when text or a text equivalent (e.g. alt) attribute is changed.
-    void contentChanged(Node*);
-    void contentChanged(RenderObject*);
+    void textChanged(Node*);
+    void textChanged(RenderObject*);
     // Called when a node has just been attached, so we can make sure we have the right subclass of AccessibilityObject.
     void updateCacheAfterNodeIsAttached(Node*);
 
@@ -105,6 +106,9 @@ public:
     void handleAriaExpandedChange(Node*);
     void handleScrollbarUpdate(ScrollView*);
 
+    void handleAttributeChanged(const QualifiedName& attrName, Element*);
+    void recomputeIsIgnored(RenderObject* renderer);
+
 #if HAVE(ACCESSIBILITY)
     static void enableAccessibility() { gAccessibilityEnabled = true; }
     // Enhanced user interface accessibility can be toggled by the assistive technology.
@@ -152,6 +156,8 @@ public:
         AXRowCollapsed,
         AXRowExpanded,
         AXInvalidStatusChanged,
+        AXTextChanged,
+        AXAriaAttributeChanged
     };
 
     void postNotification(RenderObject*, AXNotification, bool postToElement, PostType = PostAsynchronously);
@@ -180,6 +186,8 @@ protected:
     void postPlatformNotification(AccessibilityObject*, AXNotification);
     void nodeTextChangePlatformNotification(AccessibilityObject*, AXTextChange, unsigned offset, const String&);
     void frameLoadingEventPlatformNotification(AccessibilityObject*, AXLoadingEvent);
+    void textChanged(AccessibilityObject*);
+    void labelChanged(Element*);
 
     // This is a weak reference cache for knowing if Nodes used by TextMarkers are valid.
     void setNodeInUse(Node* n) { m_textMarkerNodes.add(n); }
@@ -232,8 +240,10 @@ inline void AXObjectCache::attachWrapper(AccessibilityObject*) { }
 inline void AXObjectCache::checkedStateChanged(Node*) { }
 inline void AXObjectCache::childrenChanged(RenderObject*) { }
 inline void AXObjectCache::childrenChanged(Node*) { }
-inline void AXObjectCache::contentChanged(RenderObject*) { }
-inline void AXObjectCache::contentChanged(Node*) { }
+inline void AXObjectCache::childrenChanged(AccessibilityObject*) { }
+inline void AXObjectCache::textChanged(RenderObject*) { }
+inline void AXObjectCache::textChanged(Node*) { }
+inline void AXObjectCache::textChanged(AccessibilityObject*) { }
 inline void AXObjectCache::updateCacheAfterNodeIsAttached(Node*) { }
 inline void AXObjectCache::detachWrapper(AccessibilityObject*) { }
 inline void AXObjectCache::frameLoadingEventNotification(Frame*, AXLoadingEvent) { }
@@ -243,6 +253,8 @@ inline void AXObjectCache::handleAriaExpandedChange(Node*) { }
 inline void AXObjectCache::handleAriaRoleChanged(Node*) { }
 inline void AXObjectCache::handleFocusedUIElementChanged(Node*, Node*) { }
 inline void AXObjectCache::handleScrollbarUpdate(ScrollView*) { }
+inline void AXObjectCache::handleAttributeChanged(const QualifiedName&, Element*) { }
+inline void AXObjectCache::recomputeIsIgnored(RenderObject*) { }
 inline void AXObjectCache::handleScrolledToAnchor(const Node*) { }
 inline void AXObjectCache::nodeTextChangeNotification(Node*, AXTextChange, unsigned, const String&) { }
 inline void AXObjectCache::nodeTextChangePlatformNotification(AccessibilityObject*, AXTextChange, unsigned, const String&) { }
diff --git a/Source/WebCore/accessibility/AccessibilityAllInOne.cpp b/Source/WebCore/accessibility/AccessibilityAllInOne.cpp
index e353556f7..6fdda9a05 100644
--- a/Source/WebCore/accessibility/AccessibilityAllInOne.cpp
+++ b/Source/WebCore/accessibility/AccessibilityAllInOne.cpp
@@ -37,6 +37,7 @@
 #include "AccessibilityNodeObject.cpp"
 #include "AccessibilityObject.cpp"
 #include "AccessibilityRenderObject.cpp"
+#include "AccessibilitySVGRoot.cpp"
 #include "AccessibilityScrollView.cpp"
 #include "AccessibilityScrollbar.cpp"
 #include "AccessibilitySlider.cpp"
diff --git a/Source/WebCore/accessibility/AccessibilityMediaControls.cpp b/Source/WebCore/accessibility/AccessibilityMediaControls.cpp
index 887c7e2f4..cc4630c7e 100644
--- a/Source/WebCore/accessibility/AccessibilityMediaControls.cpp
+++ b/Source/WebCore/accessibility/AccessibilityMediaControls.cpp
@@ -319,8 +319,8 @@ bool AccessibilityMediaTimeDisplay::accessibilityIsIgnored() const
 
 String AccessibilityMediaTimeDisplay::accessibilityDescription() const
 {
-    DEFINE_STATIC_LOCAL(const String, currentTimeDisplay, ("CurrentTimeDisplay"));
-    DEFINE_STATIC_LOCAL(const String, timeRemainingDisplay, ("TimeRemainingDisplay"));
+    DEFINE_STATIC_LOCAL(const String, currentTimeDisplay, (ASCIILiteral("CurrentTimeDisplay")));
+    DEFINE_STATIC_LOCAL(const String, timeRemainingDisplay, (ASCIILiteral("TimeRemainingDisplay")));
 
     if (controlType() == MediaCurrentTimeDisplay)
         return localizedMediaControlElementString(currentTimeDisplay);
diff --git a/Source/WebCore/accessibility/AccessibilityNodeObject.cpp b/Source/WebCore/accessibility/AccessibilityNodeObject.cpp
index 49b83ea6d..1055fa3b5 100644
--- a/Source/WebCore/accessibility/AccessibilityNodeObject.cpp
+++ b/Source/WebCore/accessibility/AccessibilityNodeObject.cpp
@@ -1475,6 +1475,9 @@ String AccessibilityNodeObject::title() const
     case RadioButtonRole:
     case TabRole:
         return textUnderElement();
+    // SVGRoots should not use the text under itself as a title. That could include the text of objects like <text>.
+    case SVGRootRole:
+        return String();
     default:
         break;
     }
diff --git a/Source/WebCore/accessibility/AccessibilityNodeObject.h b/Source/WebCore/accessibility/AccessibilityNodeObject.h
index e1e161b22..721639c3e 100644
--- a/Source/WebCore/accessibility/AccessibilityNodeObject.h
+++ b/Source/WebCore/accessibility/AccessibilityNodeObject.h
@@ -171,6 +171,7 @@ protected:
     void alterSliderValue(bool increase);
     void changeValueByStep(bool increase);
     bool isARIARange() const;
+    // This returns true if it's focusable but it's not content editable and it's not a control or ARIA control.
     bool isGenericFocusableElement() const;
     HTMLLabelElement* labelForElement(Element*) const;
     String ariaAccessibilityDescription() const;
diff --git a/Source/WebCore/accessibility/AccessibilityObject.cpp b/Source/WebCore/accessibility/AccessibilityObject.cpp
index ed071e216..e675be2f3 100644
--- a/Source/WebCore/accessibility/AccessibilityObject.cpp
+++ b/Source/WebCore/accessibility/AccessibilityObject.cpp
@@ -72,6 +72,7 @@ AccessibilityObject::AccessibilityObject()
     : m_id(0)
     , m_haveChildren(false)
     , m_role(UnknownRole)
+    , m_cachedIsIgnoredValue(DefaultBehavior)
 #if PLATFORM(GTK)
     , m_wrapper(0)
 #elif PLATFORM(CHROMIUM)
@@ -1417,7 +1418,6 @@ static ARIARoleMap* createARIARoleMap()
         { "radiogroup", RadioGroupRole },
         { "region", DocumentRegionRole },
         { "row", RowRole },
-        { "range", SliderRole },
         { "scrollbar", ScrollBarRole },
         { "search", LandmarkSearchRole },
         { "separator", SplitterRole },
@@ -1771,6 +1771,28 @@ void AccessibilityObject::scrollToGlobalPoint(const IntPoint& globalPoint) const
     }
 }
 
+bool AccessibilityObject::cachedIsIgnoredValue()
+{
+    if (m_cachedIsIgnoredValue == DefaultBehavior)
+        m_cachedIsIgnoredValue = accessibilityIsIgnored() ? IgnoreObject : IncludeObject;
+
+    return m_cachedIsIgnoredValue == IgnoreObject;
+}
+
+void AccessibilityObject::setCachedIsIgnoredValue(bool isIgnored)
+{
+    m_cachedIsIgnoredValue = isIgnored ? IgnoreObject : IncludeObject;
+}
+
+void AccessibilityObject::notifyIfIgnoredValueChanged()
+{
+    bool isIgnored = accessibilityIsIgnored();
+    if (cachedIsIgnoredValue() != isIgnored) {
+        axObjectCache()->childrenChanged(parentObject());
+        setCachedIsIgnoredValue(isIgnored);
+    }
+}
+
 bool AccessibilityObject::ariaPressedIsPresent() const
 {
     return !getAttribute(aria_pressedAttr).isEmpty();
diff --git a/Source/WebCore/accessibility/AccessibilityObject.h b/Source/WebCore/accessibility/AccessibilityObject.h
index 873a5c6ef..399001fed 100644
--- a/Source/WebCore/accessibility/AccessibilityObject.h
+++ b/Source/WebCore/accessibility/AccessibilityObject.h
@@ -181,6 +181,7 @@ enum AccessibilityRole {
     SplitterRole,
     StaticTextRole,
     SystemWideRole,
+    SVGRootRole,
     TabGroupRole,
     TabListRole,
     TabPanelRole,            
@@ -362,7 +363,8 @@ public:
     virtual bool isAccessibilityRenderObject() const { return false; }
     virtual bool isAccessibilityScrollbar() const { return false; }
     virtual bool isAccessibilityScrollView() const { return false; }
-    
+    virtual bool isAccessibilitySVGRoot() const { return false; }
+
     bool accessibilityObjectContainsText(String *) const;
     
     virtual bool isAnchor() const { return false; }
@@ -610,7 +612,7 @@ public:
     virtual void decrement() { }
 
     virtual void childrenChanged() { }
-    virtual void contentChanged() { }
+    virtual void textChanged() { }
     virtual void updateAccessibilityRole() { }
     const AccessibilityChildrenVector& children();
     virtual void addChildren() { }
@@ -729,6 +731,12 @@ public:
     // Scroll this object to a given point in global coordinates of the top-level window.
     virtual void scrollToGlobalPoint(const IntPoint&) const;
 
+    bool cachedIsIgnoredValue();
+    void setCachedIsIgnoredValue(bool);
+
+    // Fires a children changed notification on the parent if the isIgnored value changed.
+    void notifyIfIgnoredValueChanged();
+
 #if HAVE(ACCESSIBILITY)
 #if PLATFORM(GTK)
     AccessibilityObjectWrapper* wrapper() const;
@@ -767,6 +775,7 @@ protected:
     AccessibilityChildrenVector m_children;
     mutable bool m_haveChildren;
     AccessibilityRole m_role;
+    AccessibilityObjectInclusion m_cachedIsIgnoredValue;
     
     // If this object itself scrolls, return its ScrollableArea.
     virtual ScrollableArea* getScrollableAreaIfScrollable() const { return 0; }
diff --git a/Source/WebCore/accessibility/AccessibilityRenderObject.cpp b/Source/WebCore/accessibility/AccessibilityRenderObject.cpp
index 687716c54..937e869d3 100644
--- a/Source/WebCore/accessibility/AccessibilityRenderObject.cpp
+++ b/Source/WebCore/accessibility/AccessibilityRenderObject.cpp
@@ -32,8 +32,11 @@
 #include "AXObjectCache.h"
 #include "AccessibilityImageMapLink.h"
 #include "AccessibilityListBox.h"
+#include "AccessibilitySVGRoot.h"
 #include "AccessibilitySpinButton.h"
 #include "AccessibilityTable.h"
+#include "CachedImage.h"
+#include "Chrome.h"
 #include "EventNames.h"
 #include "FloatRect.h"
 #include "Frame.h"
@@ -54,6 +57,7 @@
 #include "HTMLTextAreaElement.h"
 #include "HitTestRequest.h"
 #include "HitTestResult.h"
+#include "Image.h"
 #include "LocalizedStrings.h"
 #include "MathMLNames.h"
 #include "NodeList.h"
@@ -77,6 +81,10 @@
 #include "RenderView.h"
 #include "RenderWidget.h"
 #include "RenderedPosition.h"
+#include "SVGDocument.h"
+#include "SVGImage.h"
+#include "SVGImageChromeClient.h"
+#include "SVGSVGElement.h"
 #include "Text.h"
 #include "TextControlInnerElements.h"
 #include "htmlediting.h"
@@ -121,6 +129,8 @@ void AccessibilityRenderObject::detach()
 {
     AccessibilityNodeObject::detach();
     
+    detachRemoteSVGRoot();
+    
 #ifndef NDEBUG
     if (m_renderer)
         m_renderer->setHasAXObject(false);
@@ -711,6 +721,18 @@ HTMLLabelElement* AccessibilityRenderObject::labelElementContainer() const
     return 0;
 }
 
+// The boundingBox for elements within the remote SVG element needs to be offset by its position
+// within the parent page, otherwise they are in relative coordinates only.
+void AccessibilityRenderObject::offsetBoundingBoxForRemoteSVGElement(LayoutRect& rect) const
+{
+    for (AccessibilityObject* parent = parentObject(); parent; parent = parent->parentObject()) {
+        if (parent->isAccessibilitySVGRoot()) {
+            rect.moveBy(parent->parentObject()->boundingBoxRect().location());
+            break;
+        }
+    }
+}
+    
 LayoutRect AccessibilityRenderObject::boundingBoxRect() const
 {
     RenderObject* obj = m_renderer;
@@ -733,6 +755,12 @@ LayoutRect AccessibilityRenderObject::boundingBoxRect() const
     
     LayoutRect result = boundingBoxForQuads(obj, quads);
 
+#if ENABLE(SVG)
+    Document* document = this->document();
+    if (document && document->isSVGDocument())
+        offsetBoundingBoxForRemoteSVGElement(result);
+#endif
+    
     // The size of the web area should be the content size, not the clipped size.
     if (isWebArea() && obj->frame()->view())
         result.setSize(obj->frame()->view()->contentsSize());
@@ -1094,8 +1122,8 @@ bool AccessibilityRenderObject::accessibilityIsIgnored() const
     // NOTE: BRs always have text boxes now, so the text box check here can be removed
     if (m_renderer->isText()) {
         // static text beneath MenuItems and MenuButtons are just reported along with the menu item, so it's ignored on an individual level
-        if (parentObjectUnignored()->ariaRoleAttribute() == MenuItemRole
-            || parentObjectUnignored()->ariaRoleAttribute() == MenuButtonRole)
+        AccessibilityObject* parent = parentObjectUnignored();
+        if (parent && (parent->ariaRoleAttribute() == MenuItemRole || parent->ariaRoleAttribute() == MenuButtonRole))
             return true;
         RenderText* renderText = toRenderText(m_renderer);
         if (m_renderer->isBR() || !renderText->firstTextBox())
@@ -2059,6 +2087,24 @@ AccessibilityObject* AccessibilityRenderObject::accessibilityImageMapHitTest(HTM
     
     return 0;
 }
+
+AccessibilityObject* AccessibilityRenderObject::remoteSVGElementHitTest(const IntPoint& point) const
+{
+    AccessibilityObject* remote = remoteSVGRootElement();
+    if (!remote)
+        return 0;
+    
+    IntSize offsetPoint = point - roundedIntPoint(boundingBoxRect().location());
+    return remote->accessibilityHitTest(toPoint(offsetPoint));
+}
+
+AccessibilityObject* AccessibilityRenderObject::elementAccessibilityHitTest(const IntPoint& point) const
+{
+    if (isSVGImage())
+        return remoteSVGElementHitTest(point);
+    
+    return AccessibilityObject::elementAccessibilityHitTest(point);
+}
     
 AccessibilityObject* AccessibilityRenderObject::accessibilityHitTest(const IntPoint& point) const
 {
@@ -2212,6 +2258,10 @@ AccessibilityObject* AccessibilityRenderObject::correspondingControlForLabelElem
     HTMLElement* correspondingControl = labelElement->control();
     if (!correspondingControl)
         return 0;
+
+    // Make sure the corresponding control isn't a descendant of this label that's in the middle of being destroyed.
+    if (correspondingControl->renderer() && !correspondingControl->renderer()->parent())
+        return 0;
     
     return axObjectCache()->getOrCreate(correspondingControl);     
 }
@@ -2301,6 +2351,8 @@ AccessibilityRole AccessibilityRenderObject::determineAccessibilityRole()
     if (cssBox && cssBox->isImage()) {
         if (node && node->hasTagName(inputTag))
             return ariaHasPopup() ? PopUpButtonRole : ButtonRole;
+        if (isSVGImage())
+            return SVGRootRole;
         return ImageRole;
     }
     
@@ -2338,6 +2390,8 @@ AccessibilityRole AccessibilityRenderObject::determineAccessibilityRole()
 #if ENABLE(SVG)
     if (m_renderer->isSVGImage())
         return ImageRole;
+    if (m_renderer->isSVGRoot())
+        return SVGRootRole;
 #endif
 
 #if ENABLE(MATHML)
@@ -2528,7 +2582,7 @@ bool AccessibilityRenderObject::canSetTextRangeAttributes() const
     return isTextControl();
 }
 
-void AccessibilityRenderObject::contentChanged()
+void AccessibilityRenderObject::textChanged()
 {
     // If this element supports ARIA live regions, or is part of a region with an ARIA editable role,
     // then notify the AT of changes.
@@ -2600,6 +2654,81 @@ void AccessibilityRenderObject::addTextFieldChildren()
     axSpinButton->setParent(this);
     m_children.append(axSpinButton);
 }
+    
+bool AccessibilityRenderObject::isSVGImage() const
+{
+    return remoteSVGRootElement();
+}
+    
+void AccessibilityRenderObject::detachRemoteSVGRoot()
+{
+    if (AccessibilitySVGRoot* root = remoteSVGRootElement())
+        root->setParent(0);
+}
+
+AccessibilitySVGRoot* AccessibilityRenderObject::remoteSVGRootElement() const
+{
+#if ENABLE(SVG)
+    if (!m_renderer || !m_renderer->isRenderImage())
+        return 0;
+    
+    CachedImage* cachedImage = toRenderImage(m_renderer)->cachedImage();
+    if (!cachedImage)
+        return 0;
+    
+    Image* image = cachedImage->image();
+    if (!image || !image->isSVGImage())
+        return 0;
+    
+    SVGImage* svgImage = static_cast<SVGImage*>(image);
+    FrameView* frameView = svgImage->frameView();
+    if (!frameView)
+        return 0;
+    Frame* frame = frameView->frame();
+    if (!frame)
+        return 0;
+    
+    Document* doc = frame->document();
+    if (!doc || !doc->isSVGDocument())
+        return 0;
+    
+    SVGSVGElement* rootElement = static_cast<SVGDocument*>(doc)->rootElement();
+    if (!rootElement)
+        return 0;
+    RenderObject* rendererRoot = rootElement->renderer();
+    if (!rendererRoot)
+        return 0;
+    
+    AccessibilityObject* rootSVGObject = frame->document()->axObjectCache()->getOrCreate(rendererRoot);
+
+    // In order to connect the AX hierarchy from the SVG root element from the loaded resource
+    // the parent must be set, because there's no other way to get back to who created the image.
+    ASSERT(rootSVGObject && rootSVGObject->isAccessibilitySVGRoot());
+    if (!rootSVGObject->isAccessibilitySVGRoot())
+        return 0;
+    
+    return toAccessibilitySVGRoot(rootSVGObject);
+#else
+    return 0;
+#endif
+}
+    
+void AccessibilityRenderObject::addRemoteSVGChildren()
+{
+    AccessibilitySVGRoot* root = remoteSVGRootElement();
+    if (!root)
+        return;
+    
+    root->setParent(this);
+    
+    if (root->accessibilityIsIgnored()) {
+        AccessibilityChildrenVector children = root->children();
+        unsigned length = children.size();
+        for (unsigned i = 0; i < length; ++i)
+            m_children.append(children[i]);
+    } else
+        m_children.append(root);
+}
 
 void AccessibilityRenderObject::addCanvasChildren()
 {
@@ -2716,7 +2845,8 @@ void AccessibilityRenderObject::addChildren()
     addImageMapChildren();
     addTextFieldChildren();
     addCanvasChildren();
-
+    addRemoteSVGChildren();
+    
 #if PLATFORM(MAC)
     updateAttachmentViewParents();
 #endif
diff --git a/Source/WebCore/accessibility/AccessibilityRenderObject.h b/Source/WebCore/accessibility/AccessibilityRenderObject.h
index b1752d3f1..914b94a54 100644
--- a/Source/WebCore/accessibility/AccessibilityRenderObject.h
+++ b/Source/WebCore/accessibility/AccessibilityRenderObject.h
@@ -35,6 +35,7 @@
 
 namespace WebCore {
     
+class AccessibilitySVGRoot;
 class AXObjectCache;
 class Element;
 class Frame;
@@ -165,7 +166,7 @@ public:
     virtual AccessibilityOrientation orientation() const;
     
     virtual void detach();
-    virtual void contentChanged();
+    virtual void textChanged();
     virtual void addChildren();
     virtual bool canHaveChildren() const;
     virtual void selectedChildren(AccessibilityChildrenVector&);
@@ -241,16 +242,24 @@ private:
     AccessibilityObject* internalLinkElement() const;
     AccessibilityObject* accessibilityImageMapHitTest(HTMLAreaElement*, const IntPoint&) const;
     AccessibilityObject* accessibilityParentForImageMap(HTMLMapElement*) const;
+    virtual AccessibilityObject* elementAccessibilityHitTest(const IntPoint&) const;
+
     bool renderObjectIsObservable(RenderObject*) const;
     RenderObject* renderParentObject() const;
     bool isDescendantOfElementType(const QualifiedName& tagName) const;
-    // This returns true if it's focusable but it's not content editable and it's not a control or ARIA control.
-
+    
+    bool isSVGImage() const;
+    void detachRemoteSVGRoot();
+    AccessibilitySVGRoot* remoteSVGRootElement() const;
+    AccessibilityObject* remoteSVGElementHitTest(const IntPoint&) const;
+    void offsetBoundingBoxForRemoteSVGElement(LayoutRect&) const;
+    
     void addHiddenChildren();
     void addTextFieldChildren();
     void addImageMapChildren();
     void addCanvasChildren();
     void addAttachmentChildren();
+    void addRemoteSVGChildren();
 #if PLATFORM(MAC)
     void updateAttachmentViewParents();
 #endif
diff --git a/Tools/WebKitTestRunner/InjectedBundle/qt/QtInitializeTestFonts.h b/Source/WebCore/accessibility/AccessibilitySVGRoot.cpp
index 87fa87bfa..0a755bb08 100644
--- a/Tools/WebKitTestRunner/InjectedBundle/qt/QtInitializeTestFonts.h
+++ b/Source/WebCore/accessibility/AccessibilitySVGRoot.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2012 Nokia Corporation and/or its subsidiary(-ies)
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -26,5 +26,39 @@
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#include "../../../DumpRenderTree/qt/QtInitializeTestFonts.h"
+#include "config.h"
+#include "AccessibilitySVGRoot.h"
 
+#include "RenderObject.h"
+
+namespace WebCore {
+
+AccessibilitySVGRoot::AccessibilitySVGRoot(RenderObject* renderer)
+    : AccessibilityRenderObject(renderer)
+    , m_parent(0)
+{
+}
+
+AccessibilitySVGRoot::~AccessibilitySVGRoot()
+{
+}
+
+PassRefPtr<AccessibilitySVGRoot> AccessibilitySVGRoot::create(RenderObject* renderer)
+{
+    AccessibilitySVGRoot* obj = new AccessibilitySVGRoot(renderer);
+    obj->init();
+    return adoptRef(obj);
+}
+    
+AccessibilityObject* AccessibilitySVGRoot::parentObject() const
+{
+    // If a parent was set because this is a remote SVG resource, use that
+    // but otherwise, we should rely on the standard render tree for the parent.
+    if (m_parent)
+        return m_parent;
+    
+    return AccessibilityRenderObject::parentObject();
+}
+
+    
+} // namespace WebCore
diff --git a/Source/WebCore/accessibility/AccessibilitySVGRoot.h b/Source/WebCore/accessibility/AccessibilitySVGRoot.h
new file mode 100644
index 000000000..3d9213093
--- /dev/null
+++ b/Source/WebCore/accessibility/AccessibilitySVGRoot.h
@@ -0,0 +1,61 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef AccessibilitySVGRoot_h
+#define AccessibilitySVGRoot_h
+
+#include "AccessibilityRenderObject.h"
+
+namespace WebCore {
+
+class AccessibilitySVGRoot : public AccessibilityRenderObject {
+    
+protected:
+    explicit AccessibilitySVGRoot(RenderObject*);
+public:
+    static PassRefPtr<AccessibilitySVGRoot> create(RenderObject*);
+    virtual ~AccessibilitySVGRoot();
+    
+    void setParent(AccessibilityObject* parent) { m_parent = parent; }
+    
+private:
+    AccessibilityObject* m_parent;
+    
+    virtual AccessibilityObject* parentObject() const;
+    virtual bool isAccessibilitySVGRoot() const { return true; }
+};
+
+inline AccessibilitySVGRoot* toAccessibilitySVGRoot(AccessibilityObject* object)
+{
+    ASSERT(!object || object->isAccessibilitySVGRoot());
+    return static_cast<AccessibilitySVGRoot*>(object);
+}
+    
+} // namespace WebCore 
+
+#endif // AccessibilitySVGRoot_h
diff --git a/Source/WebCore/accessibility/AccessibilityScrollView.cpp b/Source/WebCore/accessibility/AccessibilityScrollView.cpp
index 6d13aad06..12e5b4bf3 100644
--- a/Source/WebCore/accessibility/AccessibilityScrollView.cpp
+++ b/Source/WebCore/accessibility/AccessibilityScrollView.cpp
@@ -43,6 +43,17 @@ AccessibilityScrollView::AccessibilityScrollView(ScrollView* view)
 {
 }
 
+AccessibilityScrollView::~AccessibilityScrollView()
+{
+    ASSERT(isDetached());
+}
+
+void AccessibilityScrollView::detach()
+{
+    AccessibilityObject::detach();
+    m_scrollView = 0;
+}
+
 PassRefPtr<AccessibilityScrollView> AccessibilityScrollView::create(ScrollView* view)
 {
     return adoptRef(new AccessibilityScrollView(view));
@@ -67,12 +78,12 @@ AccessibilityObject* AccessibilityScrollView::scrollBar(AccessibilityOrientation
 // In WebKit2, the ScrollView object will return the AX information (because there are no platform widgets).
 bool AccessibilityScrollView::isAttachment() const
 {
-    return m_scrollView->platformWidget();
+    return m_scrollView && m_scrollView->platformWidget();
 }
 
 Widget* AccessibilityScrollView::widgetForAttachmentView() const
 {
-    return m_scrollView.get();
+    return m_scrollView;
 }
     
 void AccessibilityScrollView::updateChildrenIfNecessary()
@@ -88,6 +99,9 @@ void AccessibilityScrollView::updateChildrenIfNecessary()
 
 void AccessibilityScrollView::updateScrollbars()
 {
+    if (!m_scrollView)
+        return;
+
     if (m_scrollView->horizontalScrollbar() && !m_horizontalScrollbar)
         m_horizontalScrollbar = addChildScrollbar(m_scrollView->horizontalScrollbar());
     else if (!m_scrollView->horizontalScrollbar() && m_horizontalScrollbar) {
@@ -153,10 +167,10 @@ void AccessibilityScrollView::addChildren()
 
 AccessibilityObject* AccessibilityScrollView::webAreaObject() const
 {
-    if (!m_scrollView->isFrameView())
+    if (!m_scrollView || !m_scrollView->isFrameView())
         return 0;
     
-    Document* doc = static_cast<FrameView*>(m_scrollView.get())->frame()->document();
+    Document* doc = static_cast<FrameView*>(m_scrollView)->frame()->document();
     if (!doc || !doc->renderer())
         return 0;
 
@@ -179,23 +193,26 @@ AccessibilityObject* AccessibilityScrollView::accessibilityHitTest(const IntPoin
 
 LayoutRect AccessibilityScrollView::elementRect() const
 {
+    if (!m_scrollView)
+        return LayoutRect();
+
     return m_scrollView->frameRect();
 }
 
 FrameView* AccessibilityScrollView::documentFrameView() const
 {
-    if (!m_scrollView->isFrameView())
+    if (!m_scrollView || !m_scrollView->isFrameView())
         return 0;
     
-    return static_cast<FrameView*>(m_scrollView.get());
+    return static_cast<FrameView*>(m_scrollView);
 }    
 
 AccessibilityObject* AccessibilityScrollView::parentObject() const
 {
-    if (!m_scrollView->isFrameView())
+    if (!m_scrollView || !m_scrollView->isFrameView())
         return 0;
     
-    HTMLFrameOwnerElement* owner = static_cast<FrameView*>(m_scrollView.get())->frame()->ownerElement();
+    HTMLFrameOwnerElement* owner = static_cast<FrameView*>(m_scrollView)->frame()->ownerElement();
     if (owner && owner->renderer())
         return axObjectCache()->getOrCreate(owner);
 
@@ -204,10 +221,10 @@ AccessibilityObject* AccessibilityScrollView::parentObject() const
     
 AccessibilityObject* AccessibilityScrollView::parentObjectIfExists() const
 {
-    if (!m_scrollView->isFrameView())
+    if (!m_scrollView || !m_scrollView->isFrameView())
         return 0;
     
-    HTMLFrameOwnerElement* owner = static_cast<FrameView*>(m_scrollView.get())->frame()->ownerElement();
+    HTMLFrameOwnerElement* owner = static_cast<FrameView*>(m_scrollView)->frame()->ownerElement();
     if (owner && owner->renderer())
         return axObjectCache()->get(owner);
     
@@ -216,12 +233,13 @@ AccessibilityObject* AccessibilityScrollView::parentObjectIfExists() const
 
 ScrollableArea* AccessibilityScrollView::getScrollableAreaIfScrollable() const
 {
-    return m_scrollView.get();
+    return m_scrollView;
 }
 
 void AccessibilityScrollView::scrollTo(const IntPoint& point) const
 {
-    m_scrollView->setScrollPosition(point);
+    if (m_scrollView)
+        m_scrollView->setScrollPosition(point);
 }
 
 } // namespace WebCore    
diff --git a/Source/WebCore/accessibility/AccessibilityScrollView.h b/Source/WebCore/accessibility/AccessibilityScrollView.h
index 9953164df..4ff8a223f 100644
--- a/Source/WebCore/accessibility/AccessibilityScrollView.h
+++ b/Source/WebCore/accessibility/AccessibilityScrollView.h
@@ -38,7 +38,10 @@ class AccessibilityScrollView : public AccessibilityObject {
 public:
     static PassRefPtr<AccessibilityScrollView> create(ScrollView*);    
     virtual AccessibilityRole roleValue() const { return ScrollAreaRole; }
-    ScrollView* scrollView() const { return m_scrollView.get(); }
+    ScrollView* scrollView() const { return m_scrollView; }
+
+    virtual ~AccessibilityScrollView();
+    virtual void detach();
 
 protected:
     virtual ScrollableArea* getScrollableAreaIfScrollable() const;
@@ -72,7 +75,7 @@ private:
     AccessibilityScrollbar* addChildScrollbar(Scrollbar*);
     void removeChildScrollbar(AccessibilityObject*);
     
-    RefPtr<ScrollView> m_scrollView;
+    ScrollView* m_scrollView;
     RefPtr<AccessibilityObject> m_horizontalScrollbar;
     RefPtr<AccessibilityObject> m_verticalScrollbar;
     bool m_childrenDirty;
diff --git a/Source/WebCore/accessibility/AccessibilityTable.cpp b/Source/WebCore/accessibility/AccessibilityTable.cpp
index b1d155d42..a6dab2546 100644
--- a/Source/WebCore/accessibility/AccessibilityTable.cpp
+++ b/Source/WebCore/accessibility/AccessibilityTable.cpp
@@ -130,6 +130,7 @@ bool AccessibilityTable::isDataTable() const
     
     // go through the cell's and check for tell-tale signs of "data" table status
     // cells have borders, or use attributes like headers, abbr, scope or axis
+    table->recalcSectionsIfNeeded();
     RenderTableSection* firstBody = table->firstBody();
     if (!firstBody)
         return false;
diff --git a/Source/WebCore/accessibility/chromium/AXObjectCacheChromium.cpp b/Source/WebCore/accessibility/chromium/AXObjectCacheChromium.cpp
index a95e04418..f68a59182 100644
--- a/Source/WebCore/accessibility/chromium/AXObjectCacheChromium.cpp
+++ b/Source/WebCore/accessibility/chromium/AXObjectCacheChromium.cpp
@@ -82,10 +82,12 @@ void AXObjectCache::postPlatformNotification(AccessibilityObject* obj, AXNotific
         // descendant and send the AXFocusedUIElementChanged notification.
         handleFocusedUIElementChanged(0, obj->document()->focusedNode());
         break;
+    case AXAriaAttributeChanged:
     case AXAutocorrectionOccured:
     case AXCheckedStateChanged:
     case AXChildrenChanged:
     case AXFocusedUIElementChanged:
+    case AXInvalidStatusChanged:
     case AXLayoutComplete:
     case AXLiveRegionChanged:
     case AXLoadComplete:
@@ -97,8 +99,8 @@ void AXObjectCache::postPlatformNotification(AccessibilityObject* obj, AXNotific
     case AXScrolledToAnchor:
     case AXSelectedChildrenChanged:
     case AXSelectedTextChanged:
+    case AXTextChanged:
     case AXValueChanged:
-    case AXInvalidStatusChanged:
         break;
     }
 
diff --git a/Source/WebCore/accessibility/mac/AXObjectCacheMac.mm b/Source/WebCore/accessibility/mac/AXObjectCacheMac.mm
index 72d54fa8d..9a7d7723c 100644
--- a/Source/WebCore/accessibility/mac/AXObjectCacheMac.mm
+++ b/Source/WebCore/accessibility/mac/AXObjectCacheMac.mm
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2003, 2004, 2005, 2006, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2003, 2004, 2005, 2006, 2008, 2012 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -61,7 +61,7 @@ void AXObjectCache::postPlatformNotification(AccessibilityObject* obj, AXNotific
         return;
     
     // Some notifications are unique to Safari and do not have NSAccessibility equivalents.
-    String macNotification;
+    NSString *macNotification;
     switch (notification) {
         case AXActiveDescendantChanged:
             // An active descendant change for trees means a selected rows change.
@@ -81,13 +81,13 @@ void AXObjectCache::postPlatformNotification(AccessibilityObject* obj, AXNotific
             macNotification = NSAccessibilityFocusedUIElementChangedNotification;
             break;
         case AXLayoutComplete:
-            macNotification = "AXLayoutComplete";
+            macNotification = @"AXLayoutComplete";
             break;
         case AXLoadComplete:
-            macNotification = "AXLoadComplete";
+            macNotification = @"AXLoadComplete";
             break;
         case AXInvalidStatusChanged:
-            macNotification = "AXInvalidStatusChanged";
+            macNotification = @"AXInvalidStatusChanged";
             break;
         case AXSelectedChildrenChanged:
             if (obj->isAccessibilityTable())
diff --git a/Source/WebCore/accessibility/mac/WebAccessibilityObjectWrapper.mm b/Source/WebCore/accessibility/mac/WebAccessibilityObjectWrapper.mm
index 552f9ff2c..384acf04e 100644
--- a/Source/WebCore/accessibility/mac/WebAccessibilityObjectWrapper.mm
+++ b/Source/WebCore/accessibility/mac/WebAccessibilityObjectWrapper.mm
@@ -43,6 +43,7 @@
 #import "AccessibilityTableColumn.h"
 #import "AccessibilityTableRow.h"
 #import "Chrome.h"
+#import "ChromeClient.h"
 #import "ColorMac.h"
 #import "ContextMenuController.h"
 #import "Font.h"
@@ -1460,7 +1461,8 @@ static NSMutableArray* convertToNSArray(const AccessibilityObject::Accessibility
         
         // Find the appropriate scroll view to use to convert the contents to the window.
         ScrollView* scrollView = 0;
-        for (AccessibilityObject* parent = m_object->parentObject(); parent; parent = parent->parentObject()) {
+        AccessibilityObject* parent = 0;
+        for (parent = m_object->parentObject(); parent; parent = parent->parentObject()) {
             if (parent->isAccessibilityScrollView()) {
                 scrollView = toAccessibilityScrollView(parent)->scrollView();
                 break;
@@ -1470,8 +1472,15 @@ static NSMutableArray* convertToNSArray(const AccessibilityObject::Accessibility
         if (scrollView)
             rect = scrollView->contentsToRootView(rect);
         
-        if (m_object->page())
-            point = m_object->page()->chrome()->rootViewToScreen(rect).location();
+        Page* page = m_object->page();
+        
+        // If we have an empty chrome client (like SVG) then we should use the page
+        // of the scroll view parent to help us get to the screen rect.
+        if (parent && page && page->chrome()->client()->isEmptyChromeClient())
+            page = parent->page();
+
+        if (page)
+            point = page->chrome()->rootViewToScreen(rect).location();
         else
             point = rect.location();
     }
@@ -1588,6 +1597,7 @@ static const AccessibilityRoleMap& createAccessibilityRoleMap()
         { FooterRole, NSAccessibilityGroupRole },
         { ToggleButtonRole, NSAccessibilityButtonRole },
         { CanvasRole, NSAccessibilityImageRole },
+        { SVGRootRole, NSAccessibilityGroupRole },
         { LegendRole, NSAccessibilityGroupRole }
     };
     AccessibilityRoleMap& roleMap = *new AccessibilityRoleMap;
@@ -1849,6 +1859,10 @@ static NSString* roleValueToNSString(AccessibilityRole value)
     for (unsigned k = 0; k < length; k++) {
         const AccessibilityText& text = textOrder[k];
         
+        // If we have alternative text, then we should not expose a title.
+        if (text.textSource == AlternativeText)
+            break;
+        
         // Once we encounter visible text, or the text from our children that should be used foremost.
         if (text.textSource == VisibleText || text.textSource == ChildrenText)
             return text.text;
diff --git a/Source/WebCore/bindings/generic/RuntimeEnabledFeatures.cpp b/Source/WebCore/bindings/generic/RuntimeEnabledFeatures.cpp
index 7cd87d13e..020a756ab 100644
--- a/Source/WebCore/bindings/generic/RuntimeEnabledFeatures.cpp
+++ b/Source/WebCore/bindings/generic/RuntimeEnabledFeatures.cpp
@@ -241,4 +241,8 @@ bool RuntimeEnabledFeatures::isInputTypeWeekEnabled = true;
 bool RuntimeEnabledFeatures::isDialogElementEnabled = false;
 #endif
 
+#if ENABLE(REQUEST_AUTOCOMPLETE)
+bool RuntimeEnabledFeatures::isRequestAutocompleteEnabled = false;
+#endif
+
 } // namespace WebCore
diff --git a/Source/WebCore/bindings/generic/RuntimeEnabledFeatures.h b/Source/WebCore/bindings/generic/RuntimeEnabledFeatures.h
index 33a7e6fe5..bdcd74044 100644
--- a/Source/WebCore/bindings/generic/RuntimeEnabledFeatures.h
+++ b/Source/WebCore/bindings/generic/RuntimeEnabledFeatures.h
@@ -259,6 +259,12 @@ public:
     // The lang attribute support is incomplete and should only be turned on for tests.
     static void setLangAttributeAwareFormControlUIEnabled(bool isEnabled) { isLangAttributeAwareFormControlUIEnabled = isEnabled; }
 
+#if ENABLE(REQUEST_AUTOCOMPLETE)
+    static bool requestAutocompleteEnabled() { return isRequestAutocompleteEnabled; }
+    static void setRequestAutocompleteEnabled(bool isEnabled) { isRequestAutocompleteEnabled = isEnabled; }
+#endif
+
+
 private:
     // Never instantiate.
     RuntimeEnabledFeatures() { }
@@ -359,6 +365,10 @@ private:
 #if ENABLE(DIALOG_ELEMENT)
     static bool isDialogElementEnabled;
 #endif
+
+#if ENABLE(REQUEST_AUTOCOMPLETE)
+    static bool isRequestAutocompleteEnabled;
+#endif
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/bindings/js/DOMTransaction.h b/Source/WebCore/bindings/js/DOMTransaction.h
deleted file mode 100644
index 45125be11..000000000
--- a/Source/WebCore/bindings/js/DOMTransaction.h
+++ /dev/null
@@ -1,65 +0,0 @@
-/*
- * Copyright (C) 2012 Google Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1.  Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- * 2.  Redistributions in binary form must reproduce the above copyright
- * notice, this list of conditions and the following disclaimer in the
- * documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY GOOGLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
- * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
- * DISCLAIMED. IN NO EVENT SHALL GOOGLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
- * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
- * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
- * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
- * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#ifndef DOMTransaction_h
-#define DOMTransaction_h
-
-#if ENABLE(UNDO_MANAGER)
-
-#include "DOMTransactionStep.h"
-#include "UndoStep.h"
-#include <wtf/RefPtr.h>
-
-namespace WebCore {
-
-class UndoManager;
-
-class DOMTransaction : public UndoStep {
-public:
-    static PassRefPtr<DOMTransaction> create();
-
-    void apply();
-    virtual void unapply() OVERRIDE;
-    virtual void reapply() OVERRIDE;
-
-    virtual EditAction editingAction() const OVERRIDE { return EditActionUnspecified; }
-    virtual bool isDOMTransaction() const OVERRIDE { return true; }
-
-    UndoManager* undoManager() const { return m_undoManager; }
-    void setUndoManager(UndoManager* undoManager) { m_undoManager = undoManager; }
-
-    void addTransactionStep(PassRefPtr<DOMTransactionStep> step) { m_transactionSteps.append(step); }
-
-private:
-    DOMTransaction();
-
-    UndoManager* m_undoManager;
-    Vector<RefPtr<DOMTransactionStep> > m_transactionSteps;
-};
-
-}
-
-#endif
-
-#endif
diff --git a/Source/WebCore/bindings/js/JSBindingsAllInOne.cpp b/Source/WebCore/bindings/js/JSBindingsAllInOne.cpp
index 33619b535..b02fa68d1 100644
--- a/Source/WebCore/bindings/js/JSBindingsAllInOne.cpp
+++ b/Source/WebCore/bindings/js/JSBindingsAllInOne.cpp
@@ -148,7 +148,6 @@
 #include "JSTrackCustom.cpp"
 #include "JSTrackEventCustom.cpp"
 #include "JSTreeWalkerCustom.cpp"
-#include "JSUndoManagerCustom.cpp"
 #include "JSWebKitAnimationCustom.cpp"
 #include "JSWebKitAnimationListCustom.cpp"
 #include "JSWebKitCSSKeyframeRuleCustom.cpp"
diff --git a/Source/WebCore/bindings/js/JSDOMBinding.h b/Source/WebCore/bindings/js/JSDOMBinding.h
index 1efa4b304..0812cbeef 100644
--- a/Source/WebCore/bindings/js/JSDOMBinding.h
+++ b/Source/WebCore/bindings/js/JSDOMBinding.h
@@ -32,6 +32,7 @@
 #include "Document.h"
 #include "Element.h"
 #include "MediaList.h"
+#include "ScriptWrappable.h"
 #include "StylePropertySet.h"
 #include "StyledElement.h"
 #include <heap/Weak.h>
@@ -129,11 +130,33 @@ enum ParameterDefaultPolicy {
         return JSC::jsCast<JSC::JSObject*>(asObject(getDOMStructure<WrapperClass>(exec, JSC::jsCast<JSDOMGlobalObject*>(globalObject))->storedPrototype()));
     }
 
-    // Overload these functions to provide a fast path for wrapper access.
     inline JSDOMWrapper* getInlineCachedWrapper(DOMWrapperWorld*, void*) { return 0; }
-    inline bool setInlineCachedWrapper(DOMWrapperWorld*, void*, JSDOMWrapper*) { return false; }
+    inline bool setInlineCachedWrapper(DOMWrapperWorld*, void*, JSDOMWrapper*, JSC::WeakHandleOwner*, void*) { return false; }
     inline bool clearInlineCachedWrapper(DOMWrapperWorld*, void*, JSDOMWrapper*) { return false; }
 
+    inline JSDOMWrapper* getInlineCachedWrapper(DOMWrapperWorld* world, ScriptWrappable* domObject)
+    {
+        if (!world->isNormal())
+            return 0;
+        return domObject->wrapper();
+    }
+
+    inline bool setInlineCachedWrapper(DOMWrapperWorld* world, ScriptWrappable* domObject, JSDOMWrapper* wrapper, JSC::WeakHandleOwner* wrapperOwner, void* context)
+    {
+        if (!world->isNormal())
+            return false;
+        domObject->setWrapper(*world->globalData(), wrapper, wrapperOwner, context);
+        return true;
+    }
+
+    inline bool clearInlineCachedWrapper(DOMWrapperWorld* world, ScriptWrappable* domObject, JSDOMWrapper* wrapper)
+    {
+        if (!world->isNormal())
+            return false;
+        domObject->clearWrapper(wrapper);
+        return true;
+    }
+
     template <typename DOMClass> inline JSDOMWrapper* getCachedWrapper(DOMWrapperWorld* world, DOMClass* domObject)
     {
         if (JSDOMWrapper* wrapper = getInlineCachedWrapper(world, domObject))
@@ -143,9 +166,11 @@ enum ParameterDefaultPolicy {
 
     template <typename DOMClass> inline void cacheWrapper(DOMWrapperWorld* world, DOMClass* domObject, JSDOMWrapper* wrapper)
     {
-        if (setInlineCachedWrapper(world, domObject, wrapper))
+        JSC::WeakHandleOwner* owner = wrapperOwner(world, domObject);
+        void* context = wrapperContext(world, domObject);
+        if (setInlineCachedWrapper(world, domObject, wrapper, owner, context))
             return;
-        JSC::PassWeak<JSDOMWrapper> passWeak(wrapper, wrapperOwner(world, domObject), wrapperContext(world, domObject));
+        JSC::PassWeak<JSDOMWrapper> passWeak(wrapper, owner, context);
         weakAdd(world->m_wrappers, (void*)domObject, passWeak);
     }
 
diff --git a/Source/WebCore/bindings/js/JSIDBKeyCustom.cpp b/Source/WebCore/bindings/js/JSIDBKeyCustom.cpp
index 85aa5db9f..a64063dbc 100644
--- a/Source/WebCore/bindings/js/JSIDBKeyCustom.cpp
+++ b/Source/WebCore/bindings/js/JSIDBKeyCustom.cpp
@@ -39,8 +39,11 @@ namespace WebCore {
 
 JSValue toJS(ExecState* exec, JSDOMGlobalObject* globalObject, IDBKey* key)
 {
-    if (!key)
+    if (!key) {
+        // This should be undefined, not null.
+        // Spec: http://dvcs.w3.org/hg/IndexedDB/raw-file/tip/Overview.html#idl-def-IDBKeyRange
         return jsUndefined();
+    }
 
     switch (key->type()) {
     case IDBKey::ArrayType:
diff --git a/Source/WebCore/bindings/js/JSNodeCustom.h b/Source/WebCore/bindings/js/JSNodeCustom.h
index e4af8036c..cc04fbfe9 100644
--- a/Source/WebCore/bindings/js/JSNodeCustom.h
+++ b/Source/WebCore/bindings/js/JSNodeCustom.h
@@ -32,29 +32,6 @@
 
 namespace WebCore {
 
-inline JSDOMWrapper* getInlineCachedWrapper(DOMWrapperWorld* world, Node* node)
-{
-    if (!world->isNormal())
-        return 0;
-    return node->wrapper();
-}
-
-inline bool setInlineCachedWrapper(DOMWrapperWorld* world, Node* node, JSDOMWrapper* wrapper)
-{
-    if (!world->isNormal())
-        return false;
-    node->setWrapper(*world->globalData(), wrapper, wrapperOwner(world, node), wrapperContext(world, node));
-    return true;
-}
-
-inline bool clearInlineCachedWrapper(DOMWrapperWorld* world, Node* node, JSDOMWrapper* wrapper)
-{
-    if (!world->isNormal())
-        return false;
-    node->clearWrapper(wrapper);
-    return true;
-}
-
 JSC::JSValue createWrapper(JSC::ExecState*, JSDOMGlobalObject*, Node*);
 
 inline JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, Node* node)
diff --git a/Source/WebCore/bindings/js/JSUndoManagerCustom.cpp b/Source/WebCore/bindings/js/JSUndoManagerCustom.cpp
deleted file mode 100644
index 8fc09c511..000000000
--- a/Source/WebCore/bindings/js/JSUndoManagerCustom.cpp
+++ /dev/null
@@ -1,49 +0,0 @@
-/*
- * Copyright (C) 2012 Google Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1.  Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- * 2.  Redistributions in binary form must reproduce the above copyright
- * notice, this list of conditions and the following disclaimer in the
- * documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY GOOGLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
- * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
- * DISCLAIMED. IN NO EVENT SHALL GOOGLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
- * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
- * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
- * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
- * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "config.h"
-
-#if ENABLE(UNDO_MANAGER)
-
-#include "JSUndoManager.h"
-
-using namespace JSC;
-
-namespace WebCore {
-
-JSValue JSUndoManager::transact(ExecState*)
-{
-    // FIXME: implement JSC bindings
-    return jsUndefined();
-}
-
-JSValue JSUndoManager::item(ExecState*)
-{
-    // FIXME: implement JSC bindings
-    return jsUndefined();
-}
-
-}
-
-#endif
diff --git a/Source/WebCore/bindings/js/JavaScriptCallFrame.cpp b/Source/WebCore/bindings/js/JavaScriptCallFrame.cpp
index 8d19d51d7..45e3b6864 100644
--- a/Source/WebCore/bindings/js/JavaScriptCallFrame.cpp
+++ b/Source/WebCore/bindings/js/JavaScriptCallFrame.cpp
@@ -115,7 +115,7 @@ JSValue JavaScriptCallFrame::evaluate(const String& script, JSValue& exception)
     if (!m_isValid)
         return jsNull();
 
-    JSLockHolder lock(JSDOMWindowBase::commonJSGlobalData());
+    JSLockHolder lock(m_debuggerCallFrame.callFrame());
     return m_debuggerCallFrame.evaluate(script, exception);
 }
 
diff --git a/Source/WebCore/bindings/js/PageScriptDebugServer.cpp b/Source/WebCore/bindings/js/PageScriptDebugServer.cpp
index ed743cc9e..6f0bc2cd2 100644
--- a/Source/WebCore/bindings/js/PageScriptDebugServer.cpp
+++ b/Source/WebCore/bindings/js/PageScriptDebugServer.cpp
@@ -34,6 +34,7 @@
 
 #include "PageScriptDebugServer.h"
 
+#include "EventLoop.h"
 #include "Frame.h"
 #include "FrameView.h"
 #include "JSDOMWindowCustom.h"
@@ -163,6 +164,13 @@ void PageScriptDebugServer::didRemoveLastListener(Page* page)
     page->setDebugger(0);
 }
 
+void PageScriptDebugServer::runEventLoopWhilePaused()
+{
+    EventLoop loop;
+    while (!m_doneProcessingDebuggerEvents && !loop.ended())
+        loop.cycle();
+}
+
 void PageScriptDebugServer::setJavaScriptPaused(const PageGroup& pageGroup, bool paused)
 {
     setMainThreadCallbacksPaused(paused);
diff --git a/Source/WebCore/bindings/js/PageScriptDebugServer.h b/Source/WebCore/bindings/js/PageScriptDebugServer.h
index 72a890d7a..8232cd9ad 100644
--- a/Source/WebCore/bindings/js/PageScriptDebugServer.h
+++ b/Source/WebCore/bindings/js/PageScriptDebugServer.h
@@ -63,6 +63,8 @@ private:
     virtual void didPause(JSC::JSGlobalObject*);
     virtual void didContinue(JSC::JSGlobalObject*);
 
+    virtual void runEventLoopWhilePaused();
+
     void didRemoveLastListener(Page*);
 
     void setJavaScriptPaused(const PageGroup&, bool paused);
diff --git a/Source/WebCore/bindings/js/ScriptController.h b/Source/WebCore/bindings/js/ScriptController.h
index fad4d443a..297cf7b2d 100644
--- a/Source/WebCore/bindings/js/ScriptController.h
+++ b/Source/WebCore/bindings/js/ScriptController.h
@@ -160,6 +160,9 @@ public:
     NPObject* windowScriptNPObject();
 #endif
 
+    // FIXME: Stub for parity with V8 implementation. http://webkit.org/b/100815
+    bool shouldBypassMainWorldContentSecurityPolicy() { return false; }
+
 private:
     JSDOMWindowShell* initScript(DOMWrapperWorld* world);
 
diff --git a/Source/WebCore/bindings/js/ScriptDebugServer.cpp b/Source/WebCore/bindings/js/ScriptDebugServer.cpp
index d6a5ab84b..8b771ea30 100644
--- a/Source/WebCore/bindings/js/ScriptDebugServer.cpp
+++ b/Source/WebCore/bindings/js/ScriptDebugServer.cpp
@@ -34,7 +34,6 @@
 #include "ScriptDebugServer.h"
 
 #include "ContentSearchUtils.h"
-#include "EventLoop.h"
 #include "Frame.h"
 #include "JSJavaScriptCallFrame.h"
 #include "JavaScriptCallFrame.h"
@@ -334,7 +333,7 @@ void ScriptDebugServer::dispatchFailedToParseSource(const ListenerSet& listeners
         copy[i]->failedToParseSource(url, data, firstLine, errorLine, errorMessage);
 }
 
-static bool isContentScript(ExecState* exec)
+bool ScriptDebugServer::isContentScript(ExecState* exec)
 {
     return currentWorld(exec) != mainThreadNormalWorld();
 }
@@ -442,10 +441,8 @@ void ScriptDebugServer::pauseIfNeeded(JSGlobalObject* dynamicGlobalObject)
 
     TimerBase::fireTimersInNestedEventLoop();
 
-    EventLoop loop;
     m_doneProcessingDebuggerEvents = false;
-    while (!m_doneProcessingDebuggerEvents && !loop.ended())
-        loop.cycle();
+    runEventLoopWhilePaused();
 
     didContinue(dynamicGlobalObject);
     dispatchFunctionToListeners(&ScriptDebugServer::dispatchDidContinue, dynamicGlobalObject);
diff --git a/Source/WebCore/bindings/js/ScriptDebugServer.h b/Source/WebCore/bindings/js/ScriptDebugServer.h
index f2452964a..99f644e41 100644
--- a/Source/WebCore/bindings/js/ScriptDebugServer.h
+++ b/Source/WebCore/bindings/js/ScriptDebugServer.h
@@ -46,6 +46,7 @@
 namespace JSC {
 class DebuggerCallFrame;
 class JSGlobalObject;
+class ExecState;
 }
 namespace WebCore {
 
@@ -113,6 +114,10 @@ protected:
     virtual void didPause(JSC::JSGlobalObject*) = 0;
     virtual void didContinue(JSC::JSGlobalObject*) = 0;
 
+    virtual void runEventLoopWhilePaused() = 0;
+
+    virtual bool isContentScript(JSC::ExecState*);
+
     bool hasBreakpoint(intptr_t sourceID, const TextPosition&) const;
 
     void dispatchFunctionToListeners(JavaScriptExecutionCallback, JSC::JSGlobalObject*);
diff --git a/Source/WebCore/bindings/js/ScriptProfiler.h b/Source/WebCore/bindings/js/ScriptProfiler.h
index 19dc19277..ce4870e2f 100644
--- a/Source/WebCore/bindings/js/ScriptProfiler.h
+++ b/Source/WebCore/bindings/js/ScriptProfiler.h
@@ -38,7 +38,7 @@ namespace WebCore {
 
 class ExternalArrayVisitor;
 class ExternalStringVisitor;
-class NodeWrapperVisitor;
+class WrappedNodeVisitor;
 class Page;
 class ScriptObject;
 class ScriptValue;
@@ -74,7 +74,7 @@ public:
     static bool isSampling() { return false; }
     static bool hasHeapProfiler() { return false; }
     // FIXME: Implement this counter for JSC. See bug 73936 for more details.
-    static void visitNodeWrappers(NodeWrapperVisitor*) { }
+    static void visitNodeWrappers(WrappedNodeVisitor*) { }
     // FIXME: Support these methods for JSC. See bug 90358.
     static void visitExternalStrings(ExternalStringVisitor*) { }
     static void visitExternalArrays(ExternalArrayVisitor*) { }
diff --git a/Source/WebCore/bindings/js/WorkerScriptController.cpp b/Source/WebCore/bindings/js/WorkerScriptController.cpp
index e009c0b90..c34e258aa 100644
--- a/Source/WebCore/bindings/js/WorkerScriptController.cpp
+++ b/Source/WebCore/bindings/js/WorkerScriptController.cpp
@@ -38,6 +38,7 @@
 #include "WebCoreJSClientData.h"
 #include "WorkerContext.h"
 #include "WorkerObjectProxy.h"
+#include "WorkerScriptDebugServer.h"
 #include "WorkerThread.h"
 #include <heap/StrongInlines.h>
 #include <interpreter/Interpreter.h>
@@ -197,6 +198,17 @@ void WorkerScriptController::disableEval(const String& errorMessage)
     m_workerContextWrapper->setEvalEnabled(false, errorMessage);
 }
 
+void WorkerScriptController::attachDebugger(JSC::Debugger* debugger)
+{
+    initScriptIfNeeded();
+    debugger->attach(m_workerContextWrapper->globalObject());
+}
+
+void WorkerScriptController::detachDebugger(JSC::Debugger* debugger)
+{
+    debugger->detach(m_workerContextWrapper->globalObject());
+}
+
 } // namespace WebCore
 
 #endif // ENABLE(WORKERS)
diff --git a/Source/WebCore/bindings/js/WorkerScriptController.h b/Source/WebCore/bindings/js/WorkerScriptController.h
index a313fb0fe..651436311 100644
--- a/Source/WebCore/bindings/js/WorkerScriptController.h
+++ b/Source/WebCore/bindings/js/WorkerScriptController.h
@@ -29,7 +29,7 @@
 #define WorkerScriptController_h
 
 #if ENABLE(WORKERS)
-
+#include <debugger/Debugger.h>
 #include <heap/Strong.h>
 #include <wtf/Forward.h>
 #include <wtf/Threading.h>
@@ -79,6 +79,9 @@ namespace WebCore {
 
         JSC::JSGlobalData* globalData() { return m_globalData.get(); }
 
+        void attachDebugger(JSC::Debugger*);
+        void detachDebugger(JSC::Debugger*);
+
     private:
         void initScriptIfNeeded()
         {
diff --git a/Source/WebCore/bindings/js/WorkerScriptDebugServer.cpp b/Source/WebCore/bindings/js/WorkerScriptDebugServer.cpp
index 67bb4da6d..c85b3b560 100644
--- a/Source/WebCore/bindings/js/WorkerScriptDebugServer.cpp
+++ b/Source/WebCore/bindings/js/WorkerScriptDebugServer.cpp
@@ -31,25 +31,65 @@
 #include "config.h"
 
 #if ENABLE(JAVASCRIPT_DEBUGGER) && ENABLE(WORKERS)
-
 #include "WorkerScriptDebugServer.h"
+
+#include "WorkerContext.h"
+#include "WorkerDebuggerAgent.h"
+#include "WorkerRunLoop.h"
+#include "WorkerThread.h"
+
 #include <wtf/PassOwnPtr.h>
 
 namespace WebCore {
 
 const char* WorkerScriptDebugServer::debuggerTaskMode = "debugger";
 
-WorkerScriptDebugServer::WorkerScriptDebugServer(WorkerContext*)
+WorkerScriptDebugServer::WorkerScriptDebugServer(WorkerContext* context)
     : ScriptDebugServer()
+    , m_workerContext(context)
+{
+}
+
+void WorkerScriptDebugServer::addListener(ScriptDebugListener* listener)
 {
+    if (!listener)
+        return;
+
+    if (m_listeners.isEmpty())
+        m_workerContext->script()->attachDebugger(this);
+    m_listeners.add(listener);
+    recompileAllJSFunctions(0);
+}
+
+void WorkerScriptDebugServer::recompileAllJSFunctions(Timer<ScriptDebugServer>*)
+{
+    JSC::JSGlobalData* globalData = m_workerContext->script()->globalData();
+
+    JSC::JSLockHolder lock(globalData);
+    // If JavaScript stack is not empty postpone recompilation.
+    if (globalData->dynamicGlobalObject)
+        recompileAllJSFunctionsSoon();
+    else
+        JSC::Debugger::recompileAllJSFunctions(globalData);
 }
 
-void WorkerScriptDebugServer::addListener(ScriptDebugListener*)
+void WorkerScriptDebugServer::removeListener(ScriptDebugListener* listener)
 {
+    if (!listener)
+        return;
+
+    m_listeners.remove(listener);
+    if (m_listeners.isEmpty())
+        m_workerContext->script()->detachDebugger(this);
 }
 
-void WorkerScriptDebugServer::removeListener(ScriptDebugListener*)
+void WorkerScriptDebugServer::runEventLoopWhilePaused()
 {
+    MessageQueueWaitResult result;
+    do {
+        result = m_workerContext->thread()->runLoop().runInMode(m_workerContext, WorkerDebuggerAgent::debuggerTaskMode);
+    // Keep waiting until execution is resumed.
+    } while (result != MessageQueueTerminated && !m_doneProcessingDebuggerEvents);
 }
 
 void WorkerScriptDebugServer::interruptAndRunTask(PassOwnPtr<ScriptDebugServer::Task>)
diff --git a/Source/WebCore/bindings/js/WorkerScriptDebugServer.h b/Source/WebCore/bindings/js/WorkerScriptDebugServer.h
index d2d7710c7..16a05b449 100644
--- a/Source/WebCore/bindings/js/WorkerScriptDebugServer.h
+++ b/Source/WebCore/bindings/js/WorkerScriptDebugServer.h
@@ -52,11 +52,19 @@ public:
 
     void interruptAndRunTask(PassOwnPtr<ScriptDebugServer::Task>);
 
+    void recompileAllJSFunctions(Timer<ScriptDebugServer>*);
+
 private:
-    virtual void recompileAllJSFunctions(Timer<ScriptDebugServer>*) { }
-    virtual ListenerSet* getListenersForGlobalObject(JSC::JSGlobalObject*) { return 0; }
+    virtual ListenerSet* getListenersForGlobalObject(JSC::JSGlobalObject*) { return &m_listeners; }
     virtual void didPause(JSC::JSGlobalObject*) { }
     virtual void didContinue(JSC::JSGlobalObject*) { }
+
+    virtual bool isContentScript(JSC::ExecState*) { return false; }
+
+    virtual void runEventLoopWhilePaused();
+
+    WorkerContext* m_workerContext;
+    ListenerSet m_listeners;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/bindings/objc/DOM.mm b/Source/WebCore/bindings/objc/DOM.mm
index 5c77da5c2..3b1b62ec4 100644
--- a/Source/WebCore/bindings/objc/DOM.mm
+++ b/Source/WebCore/bindings/objc/DOM.mm
@@ -379,15 +379,11 @@ id <DOMEventTarget> kit(WebCore::EventTarget* eventTarget)
 
 - (NSArray *)textRects
 {
-    // FIXME: Could we move this function to WebCore::Node and autogenerate?
     core(self)->document()->updateLayoutIgnorePendingStylesheets();
     if (!core(self)->renderer())
         return nil;
-    RefPtr<Range> range = Range::create(core(self)->document());
-    WebCore::ExceptionCode ec = 0;
-    range->selectNodeContents(core(self), ec);
     Vector<WebCore::IntRect> rects;
-    range->textRects(rects);
+    core(self)->textRects(rects);
     return kit(rects);
 }
 
diff --git a/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm b/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm
index 4754d3f5a..b54979fa2 100644
--- a/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm
+++ b/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm
@@ -314,6 +314,12 @@ sub IsScriptProfileType
     return 0;
 }
 
+sub IsReadonly
+{
+    my $attribute = shift;
+    return $attribute->type =~ /readonly/ && !$attribute->signature->extendedAttributes->{"Replaceable"};
+}
+
 sub AddTypedefForScriptProfileType
 {
     my $type = shift;
@@ -371,6 +377,17 @@ sub prototypeHashTableAccessor
     }
 }
 
+sub constructorHashTableAccessor
+{
+    my $noStaticTables = shift;
+    my $constructorClassName = shift;
+    if ($noStaticTables) {
+        return "get${constructorClassName}Table(exec)";
+    } else {
+        return "&${constructorClassName}Table";
+    }
+}
+
 sub GetGenerateIsReachable
 {
     my $dataNode = shift;
@@ -807,7 +824,7 @@ sub GenerateHeader
     # Check if we have any writable properties
     my $hasReadWriteProperties = 0;
     foreach (@{$dataNode->attributes}) {
-        if ($_->type !~ /^readonly\ attribute$/ && !$_->isStatic) {
+        if (!IsReadonly($_) && !$_->isStatic) {
             $hasReadWriteProperties = 1;
         }
     }
@@ -921,7 +938,7 @@ sub GenerateHeader
                 push(@headerContent, "    JSC::JSValue " . $methodName . "(JSC::ExecState*) const;\n");
                 push(@headerContent, "#endif\n") if $conditionalString;
             }
-            if (($attribute->signature->extendedAttributes->{"Custom"} || $attribute->signature->extendedAttributes->{"JSCustom"} || $attribute->signature->extendedAttributes->{"CustomSetter"} || $attribute->signature->extendedAttributes->{"JSCustomSetter"}) && $attribute->type !~ /^readonly/) {
+            if (($attribute->signature->extendedAttributes->{"Custom"} || $attribute->signature->extendedAttributes->{"JSCustom"} || $attribute->signature->extendedAttributes->{"CustomSetter"} || $attribute->signature->extendedAttributes->{"JSCustomSetter"}) && !IsReadonly($attribute)) {
                 push(@headerContent, "#if ${conditionalString}\n") if $conditionalString;
                 push(@headerContent, "    void set" . $codeGenerator->WK_ucfirst($attribute->signature->name) . "(JSC::ExecState*, JSC::JSValue);\n");
                 push(@headerContent, "#endif\n") if $conditionalString;
@@ -1144,7 +1161,7 @@ sub GenerateHeader
             push(@headerContent, "#if ${conditionalString}\n") if $conditionalString;
             my $getter = GetAttributeGetterName($interfaceName, $className, $attribute);
             push(@headerContent, "JSC::JSValue ${getter}(JSC::ExecState*, JSC::JSValue, JSC::PropertyName);\n");
-            unless ($attribute->type =~ /readonly/) {
+            if (!IsReadonly($attribute)) {
                 my $setter = GetAttributeSetterName($interfaceName, $className, $attribute);
                 push(@headerContent, "void ${setter}(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);\n");
             }
@@ -1218,14 +1235,14 @@ sub GenerateAttributesHashTable($$)
         my @specials = ();
         push(@specials, "DontDelete") unless $attribute->signature->extendedAttributes->{"Deletable"};
         push(@specials, "DontEnum") if $attribute->signature->extendedAttributes->{"NotEnumerable"};
-        push(@specials, "ReadOnly") if $attribute->type =~ /readonly/;
+        push(@specials, "ReadOnly") if IsReadonly($attribute);
         my $special = (@specials > 0) ? join(" | ", @specials) : "0";
         push(@hashSpecials, $special);
 
         my $getter = GetAttributeGetterName($interfaceName, $className, $attribute);
         push(@hashValue1, $getter);
 
-        if ($attribute->type =~ /readonly/) {
+        if (IsReadonly($attribute)) {
             push(@hashValue2, "0");
         } else {
             my $setter = GetAttributeSetterName($interfaceName, $className, $attribute);
@@ -1462,14 +1479,14 @@ sub GenerateImplementation
 
             my @specials = ();
             push(@specials, "DontDelete") unless $attribute->signature->extendedAttributes->{"Deletable"};
-            push(@specials, "ReadOnly") if $attribute->type =~ /readonly/;
+            push(@specials, "ReadOnly") if IsReadonly($attribute);
             my $special = (@specials > 0) ? join(" | ", @specials) : "0";
             push(@hashSpecials, $special);
 
             my $getter = GetAttributeGetterName($interfaceName, $className, $attribute);
             push(@hashValue1, $getter);
 
-            if ($attribute->type =~ /readonly/) {
+            if (IsReadonly($attribute)) {
                 push(@hashValue2, "0");
             } else {
                 my $setter = GetAttributeSetterName($interfaceName, $className, $attribute);
@@ -1974,7 +1991,7 @@ sub GenerateImplementation
         # Check if we have any writable attributes
         my $hasReadWriteProperties = 0;
         foreach my $attribute (@{$dataNode->attributes}) {
-            $hasReadWriteProperties = 1 if $attribute->type !~ /^readonly/ && !$attribute->isStatic;
+            $hasReadWriteProperties = 1 if !IsReadonly($attribute) && !$attribute->isStatic;
         }
 
         my $hasSetter = $hasReadWriteProperties
@@ -2033,7 +2050,7 @@ sub GenerateImplementation
 
             if ($hasReadWriteProperties) {
                 foreach my $attribute (@{$dataNode->attributes}) {
-                    if ($attribute->type !~ /^readonly/) {
+                    if (!IsReadonly($attribute)) {
                         my $name = $attribute->signature->name;
                         my $type = $codeGenerator->StripModule($attribute->signature->type);
                         my $putFunctionName = GetAttributeSetterName($interfaceName, $className, $attribute);
@@ -2646,10 +2663,13 @@ sub GenerateParametersCheck
     $implIncludes{"JSDOMBinding.h"} = 1;
 
     foreach my $parameter (@{$function->parameters}) {
+        my $argType = $codeGenerator->StripModule($parameter->type);
+
         # Optional arguments with [Optional] should generate an early call with fewer arguments.
         # Optional arguments with [Optional=...] should not generate the early call.
+        # Optional Dictionary arguments always considered to have default of empty dictionary.
         my $optional = $parameter->extendedAttributes->{"Optional"};
-        if ($optional && $optional ne "DefaultIsUndefined" && $optional ne "DefaultIsNullString" && !$parameter->extendedAttributes->{"Callback"}) {
+        if ($optional && $optional ne "DefaultIsUndefined" && $optional ne "DefaultIsNullString" && $argType ne "Dictionary" && !$parameter->extendedAttributes->{"Callback"}) {
             # Generate early call if there are enough parameters.
             if (!$hasOptionalArguments) {
                 push(@$outputArray, "\n    size_t argsCount = exec->argumentCount();\n");
@@ -2667,7 +2687,6 @@ sub GenerateParametersCheck
         }
 
         my $name = $parameter->name;
-        my $argType = $codeGenerator->StripModule($parameter->type);
 
         if ($argType eq "XPathNSResolver") {
             push(@$outputArray, "    RefPtr<XPathNSResolver> customResolver;\n");
@@ -3719,7 +3738,16 @@ sub GenerateConstructorDefinition
         push(@$outputArray, "{\n");
         push(@$outputArray, "}\n\n");
     } else {
-        push(@$outputArray, "const ClassInfo ${constructorClassName}::s_info = { \"${visibleInterfaceName}Constructor\", &Base::s_info, &${constructorClassName}Table, 0, CREATE_METHOD_TABLE($constructorClassName) };\n\n");
+        if ($dataNode->extendedAttributes->{"JSNoStaticTables"}) {
+            push(@$outputArray, "static const HashTable* get${constructorClassName}Table(ExecState* exec)\n");
+            push(@$outputArray, "{\n");
+            push(@$outputArray, "    return getHashTableForGlobalData(exec->globalData(), &${constructorClassName}Table);\n");
+            push(@$outputArray, "}\n\n");
+            push(@$outputArray, "const ClassInfo ${constructorClassName}::s_info = { \"${visibleInterfaceName}Constructor\", &Base::s_info, 0, get${constructorClassName}Table, CREATE_METHOD_TABLE($constructorClassName) };\n\n");
+        } else {
+            push(@$outputArray, "const ClassInfo ${constructorClassName}::s_info = { \"${visibleInterfaceName}Constructor\", &Base::s_info, &${constructorClassName}Table, 0, CREATE_METHOD_TABLE($constructorClassName) };\n\n");
+        }
+
         push(@$outputArray, "${constructorClassName}::${constructorClassName}(Structure* structure, JSDOMGlobalObject* globalObject)\n");
         push(@$outputArray, "    : DOMConstructorObject(structure, globalObject)\n");
         push(@$outputArray, "{\n");
@@ -3757,12 +3785,12 @@ sub GenerateConstructorDefinition
 
         push(@$outputArray, "bool ${constructorClassName}::getOwnPropertySlot(JSCell* cell, ExecState* exec, PropertyName propertyName, PropertySlot& slot)\n");
         push(@$outputArray, "{\n");
-        push(@$outputArray, "    return getStatic${kind}Slot<${constructorClassName}, JSDOMWrapper>(exec, &${constructorClassName}Table, jsCast<${constructorClassName}*>(cell), propertyName, slot);\n");
+        push(@$outputArray, "    return getStatic${kind}Slot<${constructorClassName}, JSDOMWrapper>(exec, " . constructorHashTableAccessor($dataNode->extendedAttributes->{"JSNoStaticTables"}, $constructorClassName) . ", jsCast<${constructorClassName}*>(cell), propertyName, slot);\n");
         push(@$outputArray, "}\n\n");
 
         push(@$outputArray, "bool ${constructorClassName}::getOwnPropertyDescriptor(JSObject* object, ExecState* exec, PropertyName propertyName, PropertyDescriptor& descriptor)\n");
         push(@$outputArray, "{\n");
-        push(@$outputArray, "    return getStatic${kind}Descriptor<${constructorClassName}, JSDOMWrapper>(exec, &${constructorClassName}Table, jsCast<${constructorClassName}*>(object), propertyName, descriptor);\n");
+        push(@$outputArray, "    return getStatic${kind}Descriptor<${constructorClassName}, JSDOMWrapper>(exec, " . constructorHashTableAccessor($dataNode->extendedAttributes->{"JSNoStaticTables"}, $constructorClassName) . ", jsCast<${constructorClassName}*>(object), propertyName, descriptor);\n");
         push(@$outputArray, "}\n\n");
     }
 
diff --git a/Source/WebCore/bindings/scripts/CodeGeneratorV8.pm b/Source/WebCore/bindings/scripts/CodeGeneratorV8.pm
index b3f30c6a0..2d9f912e2 100644
--- a/Source/WebCore/bindings/scripts/CodeGeneratorV8.pm
+++ b/Source/WebCore/bindings/scripts/CodeGeneratorV8.pm
@@ -181,7 +181,7 @@ sub AddIncludesForType
     }
 }
 
-sub NeedsToVisitDOMWrapper
+sub NeedsCustomOpaqueRootForGC
 {
     my $dataNode = shift;
     return GetGenerateIsReachable($dataNode) || GetCustomIsReachable($dataNode);
@@ -199,7 +199,7 @@ sub GetCustomIsReachable
     return $dataNode->extendedAttributes->{"CustomIsReachable"} || $dataNode->extendedAttributes->{"V8CustomIsReachable"};
 }
 
-sub GenerateVisitDOMWrapper
+sub GenerateOpaqueRootForGC
 {
     my ($dataNode, $implClassName) = @_;
 
@@ -208,8 +208,9 @@ sub GenerateVisitDOMWrapper
     }
 
     push(@implContent, <<END);
-void V8${implClassName}::visitDOMWrapper(DOMDataStore* store, void* object, v8::Persistent<v8::Object> wrapper)
+void* V8${implClassName}::opaqueRootForGC(void* object, v8::Persistent<v8::Object> wrapper)
 {
+    ASSERT(!wrapper.IsIndependent());
     ${implClassName}* impl = static_cast<${implClassName}*>(object);
 END
     if (GetGenerateIsReachable($dataNode) eq  "ImplDocument" ||
@@ -218,6 +219,8 @@ END
         GetGenerateIsReachable($dataNode) eq  "ImplOwnerNodeRoot" ||
         GetGenerateIsReachable($dataNode) eq  "ImplBaseRoot") {
 
+        $implIncludes{"V8GCController.h"} = 1;
+
         my $methodName;
         $methodName = "document" if (GetGenerateIsReachable($dataNode) eq "ImplDocument");
         $methodName = "element" if (GetGenerateIsReachable($dataNode) eq "ImplElementRoot");
@@ -226,17 +229,13 @@ END
         $methodName = "base" if (GetGenerateIsReachable($dataNode) eq "ImplBaseRoot");
 
         push(@implContent, <<END);
-    if (Node* owner = impl->${methodName}()) {
-        v8::Persistent<v8::Object> ownerWrapper = store->domNodeMap().get(owner);
-        if (!ownerWrapper.IsEmpty()) {
-            v8::Persistent<v8::Value> value = wrapper;
-            v8::V8::AddImplicitReferences(ownerWrapper, &value, 1);
-        }
-    }
+    if (Node* owner = impl->${methodName}())
+        return V8GCController::opaqueRootForGC(owner);
 END
     }
 
     push(@implContent, <<END);
+    return object;
 }
 
 END
@@ -387,8 +386,8 @@ END
     static WrapperTypeInfo info;
 END
 
-    if (NeedsToVisitDOMWrapper($dataNode)) {
-        push(@headerContent, "    static void visitDOMWrapper(DOMDataStore*, void*, v8::Persistent<v8::Object>);\n");
+    if (NeedsCustomOpaqueRootForGC($dataNode)) {
+        push(@headerContent, "    static void* opaqueRootForGC(void*, v8::Persistent<v8::Object>);\n");
     }
 
     if ($dataNode->extendedAttributes->{"ActiveDOMObject"}) {
@@ -503,8 +502,7 @@ END
 v8::Handle<v8::Object> ${className}::wrap(${nativeType}* impl, v8::Handle<v8::Object> creationContext, v8::Isolate* isolate)
 {
 END
-    my $domMapFunction = GetDomMapFunction($dataNode, $interfaceName, "isolate");
-    my $getCachedWrapper = IsNodeSubType($dataNode) ? "V8DOMWrapper::getCachedWrapper(impl)" : "${domMapFunction}.get(impl)";
+    my $getCachedWrapper = IsNodeSubType($dataNode) ? "V8DOMWrapper::getCachedWrapper(impl)" : "DOMDataStore::current(isolate)->get(impl)";
     push(@headerContent, <<END);
         v8::Handle<v8::Object> wrapper = $getCachedWrapper;
         if (!wrapper.IsEmpty())
@@ -556,8 +554,11 @@ inline v8::Handle<v8::Value> toV8Fast(Node* node, const v8::AccessorInfo& info,
     // whether the holder's inline wrapper is the same wrapper we see in the
     // v8::AccessorInfo.
     v8::Handle<v8::Object> holderWrapper = info.Holder();
-    if (holder->wrapper() && *holder->wrapper() == holderWrapper && node->wrapper())
-        return *node->wrapper();
+    if (holder->wrapper() == holderWrapper) {
+        v8::Handle<v8::Object> wrapper = node->wrapper();
+        if (!wrapper.IsEmpty())
+            return wrapper;
+    }
     return toV8Slow(node, holderWrapper, info.GetIsolate());
 }
 END
@@ -755,6 +756,13 @@ sub IsConstructable
     return $dataNode->extendedAttributes->{"CustomConstructor"} || $dataNode->extendedAttributes->{"V8CustomConstructor"} || $dataNode->extendedAttributes->{"Constructor"} || $dataNode->extendedAttributes->{"ConstructorTemplate"};
 }
 
+sub IsReadonly
+{
+    my $attribute = shift;
+    my $attrExt = $attribute->signature->extendedAttributes;
+    return ($attribute->type =~ /readonly/ || $attrExt->{"V8ReadOnly"}) && !$attrExt->{"Replaceable"};
+}
+
 sub GenerateDomainSafeFunctionGetter
 {
     my $function = shift;
@@ -1008,10 +1016,10 @@ END
     # Special case for readonly or Replaceable attributes (with a few exceptions). This attempts to ensure that JS wrappers don't get
     # garbage-collected prematurely when their lifetime is strongly tied to their owner. We accomplish this by inserting a reference to
     # the newly created wrapper into an internal field of the holder object.
-    if (!IsNodeSubType($dataNode) && $attrName ne "self" && (IsWrapperType($returnType) && ($attribute->type =~ /^readonly/ || $attribute->signature->extendedAttributes->{"Replaceable"} || $attrName eq "location")
+    if (!IsNodeSubType($dataNode) && $attrName ne "self" && IsWrapperType($returnType) && (IsReadonly($attribute) || $attribute->signature->extendedAttributes->{"Replaceable"} || $attrName eq "location")
         && $returnType ne "EventTarget" && $returnType ne "SerializedScriptValue" && $returnType ne "DOMWindow" 
         && $returnType ne "MessagePortArray"
-        && $returnType !~ /SVG/ && $returnType !~ /HTML/ && !IsDOMNodeType($returnType))) {
+        && $returnType !~ /SVG/ && $returnType !~ /HTML/ && !IsDOMNodeType($returnType)) {
 
         my $arrayType = $codeGenerator->GetArrayType($returnType);
         if ($arrayType) {
@@ -1028,8 +1036,7 @@ END
         # Check for a wrapper in the wrapper cache. If there is one, we know that a hidden reference has already
         # been created. If we don't find a wrapper, we create both a wrapper and a hidden reference.
         push(@implContentDecls, "    RefPtr<$returnType> result = ${getterString};\n");
-        my $domMapFunction = GetDomMapFunction($dataNode, $interfaceName, "info.GetIsolate()");
-        push(@implContentDecls, "    v8::Handle<v8::Value> wrapper = result.get() ? ${domMapFunction}.get(result.get()) : v8Undefined();\n");
+        push(@implContentDecls, "    v8::Handle<v8::Value> wrapper = result.get() ? v8::Handle<v8::Value>(DOMDataStore::current(info.GetIsolate())->get(result.get())) : v8Undefined();\n");
         push(@implContentDecls, "    if (wrapper.IsEmpty()) {\n");
         push(@implContentDecls, "        wrapper = toV8(result.get(), info.Holder(), info.GetIsolate());\n");
         push(@implContentDecls, "        if (!wrapper.IsEmpty())\n");
@@ -1705,13 +1712,13 @@ sub GenerateParametersCheck
 
     foreach my $parameter (@{$function->parameters}) {
         TranslateParameter($parameter);
-
-        my $parameterName = $parameter->name;
+        my $nativeType = GetNativeTypeFromSignature($parameter, $paramIndex);
 
         # Optional arguments with [Optional] should generate an early call with fewer arguments.
         # Optional arguments with [Optional=...] should not generate the early call.
+        # Optional Dictionary arguments always considered to have default of empty dictionary.
         my $optional = $parameter->extendedAttributes->{"Optional"};
-        if ($optional && $optional ne "DefaultIsUndefined" && $optional ne "DefaultIsNullString" && !$parameter->extendedAttributes->{"Callback"}) {
+        if ($optional && $optional ne "DefaultIsUndefined" && $optional ne "DefaultIsNullString" && $nativeType ne "Dictionary" && !$parameter->extendedAttributes->{"Callback"}) {
             $parameterCheckString .= "    if (args.Length() <= $paramIndex) {\n";
             my $functionCall = GenerateFunctionCallString($function, $paramIndex, "    " x 2, $implClassName, %replacements);
             $parameterCheckString .= $functionCall;
@@ -1723,6 +1730,7 @@ sub GenerateParametersCheck
             $parameterDefaultPolicy = "DefaultIsNullString";
         }
 
+        my $parameterName = $parameter->name;
         if (GetIndexOf($parameterName, @paramTransferListNames) != -1) {
             $replacements{$parameterName} = "messagePortArray" . ucfirst($parameterName);
             $paramIndex++;
@@ -1730,7 +1738,6 @@ sub GenerateParametersCheck
         }
 
         AddToImplIncludes("ExceptionCode.h");
-        my $nativeType = GetNativeTypeFromSignature($parameter, $paramIndex);
         if ($parameter->extendedAttributes->{"Callback"}) {
             my $className = GetCallbackClassName($parameter->type);
             AddToImplIncludes("$className.h");
@@ -1933,11 +1940,10 @@ END
         push(@implContent, "        goto fail;\n");
     }
 
-    my $DOMObject = GetDomMapName($dataNode, $implClassName);
     push(@implContent, <<END);
 
     V8DOMWrapper::setDOMWrapper(wrapper, &info, impl.get());
-    V8DOMWrapper::setJSWrapperFor${DOMObject}(impl.release(), wrapper, args.GetIsolate());
+    V8DOMWrapper::setJSWrapperForDOMObject(impl.release(), wrapper, args.GetIsolate());
     return wrapper;
 END
 
@@ -2125,11 +2131,10 @@ END
         push(@implContent, "        goto fail;\n");
     }
 
-    my $DOMObject = GetDomMapName($dataNode, $implClassName);
     push(@implContent, <<END);
 
     V8DOMWrapper::setDOMWrapper(wrapper, &V8${implClassName}Constructor::info, impl.get());
-    V8DOMWrapper::setJSWrapperFor${DOMObject}(impl.release(), wrapper, args.GetIsolate());
+    V8DOMWrapper::setJSWrapperForDOMObject(impl.release(), wrapper, args.GetIsolate());
     return wrapper;
 END
 
@@ -2193,7 +2198,7 @@ sub GenerateSingleBatchedAttribute
         $accessControl = "v8::ALL_CAN_WRITE";
     } elsif ($attrExt->{"DoNotCheckSecurity"}) {
         $accessControl = "v8::ALL_CAN_READ";
-        if (!($attribute->type =~ /^readonly/) && !($attrExt->{"V8ReadOnly"})) {
+        if (!IsReadonly($attribute)) {
             $accessControl .= " | v8::ALL_CAN_WRITE";
         }
     }
@@ -2270,7 +2275,7 @@ sub GenerateSingleBatchedAttribute
     }
 
     # Read only attributes
-    if ($attribute->type =~ /^readonly/ || $attrExt->{"V8ReadOnly"}) {
+    if (IsReadonly($attribute)) {
         $setter = "0";
     }
 
@@ -2584,7 +2589,7 @@ sub GenerateImplementation
     AddIncludesForType($interfaceName);
 
     my $toActive = $dataNode->extendedAttributes->{"ActiveDOMObject"} ? "${className}::toActiveDOMObject" : "0";
-    my $domVisitor = NeedsToVisitDOMWrapper($dataNode) ? "${className}::visitDOMWrapper" : "0";
+    my $rootForGC = NeedsCustomOpaqueRootForGC($dataNode) ? "${className}::opaqueRootForGC" : "0";
 
     # Find the super descriptor.
     my $parentClass = "";
@@ -2601,7 +2606,7 @@ sub GenerateImplementation
 
     my $WrapperTypePrototype = $dataNode->isException ? "WrapperTypeErrorPrototype" : "WrapperTypeObjectPrototype";
 
-    push(@implContentDecls, "WrapperTypeInfo ${className}::info = { ${className}::GetTemplate, ${className}::derefObject, $toActive, $domVisitor, ${className}::installPerContextPrototypeProperties, $parentClassInfo, $WrapperTypePrototype };\n\n");
+    push(@implContentDecls, "WrapperTypeInfo ${className}::info = { ${className}::GetTemplate, ${className}::derefObject, $toActive, $rootForGC, ${className}::installPerContextPrototypeProperties, $parentClassInfo, $WrapperTypePrototype };\n\n");
     push(@implContentDecls, "namespace ${interfaceName}V8Internal {\n\n");
 
     push(@implContentDecls, "template <typename T> void V8_USE(T) { }\n\n");
@@ -2649,8 +2654,7 @@ sub GenerateImplementation
             $hasReplaceable = 1;
         } elsif (!$attribute->signature->extendedAttributes->{"CustomSetter"} &&
             !$attribute->signature->extendedAttributes->{"V8CustomSetter"} &&
-            $attribute->type !~ /^readonly/ &&
-            !$attribute->signature->extendedAttributes->{"V8ReadOnly"}) {
+            !IsReadonly($attribute)) {
             GenerateNormalAttrSetter($attribute, $dataNode, $implClassName, $interfaceName);
         }
     }
@@ -2663,8 +2667,8 @@ sub GenerateImplementation
         GenerateReplaceableAttrSetter($dataNode, $implClassName);
     }
 
-    if (NeedsToVisitDOMWrapper($dataNode)) {
-        GenerateVisitDOMWrapper($dataNode, $implClassName);
+    if (NeedsCustomOpaqueRootForGC($dataNode)) {
+        GenerateOpaqueRootForGC($dataNode, $implClassName);
     }
 
     if ($dataNode->extendedAttributes->{"TypedArray"}) {
@@ -3394,7 +3398,6 @@ sub GenerateToV8Converters
     my $className = shift;
     my $nativeType = shift;
 
-    my $domMapName = GetDomMapName($dataNode, $interfaceName);
     my $wrapSlowArgumentType = GetPassRefPtrType($nativeType);
     my $baseType = BaseInterfaceName($dataNode);
 
@@ -3455,44 +3458,14 @@ END
         return wrapper;
 
     installPerContextProperties(wrapper, impl.get());
-END
-
-    push(@implContent, <<END);
-    v8::Persistent<v8::Object> wrapperHandle = V8DOMWrapper::setJSWrapperFor${domMapName}(impl, wrapper, isolate);
+    v8::Persistent<v8::Object> wrapperHandle = V8DOMWrapper::setJSWrapperForDOMObject(impl, wrapper, isolate);
     if (!hasDependentLifetime)
         wrapperHandle.MarkIndependent();
-END
-    if (IsNodeSubType($dataNode)) {
-        push(@implContent, <<END);
-    wrapperHandle.SetWrapperClassId(v8DOMSubtreeClassId);
-END
-    }
-    push(@implContent, <<END);
     return wrapper;
 }
 END
 }
 
-sub GetDomMapFunction
-{
-    my $dataNode = shift;
-    my $interfaceName = shift;
-    my $getIsolate = shift;
-
-    return "get" . GetDomMapName($dataNode, $interfaceName) . "Map(" . $getIsolate . ")";
-}
-
-sub GetDomMapName
-{
-    my $dataNode = shift;
-    my $type = shift;
-
-    return "ActiveDOMNode" if (IsNodeSubType($dataNode) && $dataNode->extendedAttributes->{"ActiveDOMObject"});
-    return "DOMNode" if IsNodeSubType($dataNode);
-    return "ActiveDOMObject" if $dataNode->extendedAttributes->{"ActiveDOMObject"};
-    return "DOMObject";
-}
-
 sub GetNativeTypeForConversions
 {
     my $dataNode = shift;
diff --git a/Source/WebCore/bindings/scripts/test/GObject/WebKitDOMTestObj.cpp b/Source/WebCore/bindings/scripts/test/GObject/WebKitDOMTestObj.cpp
index ba5db432d..296da9584 100644
--- a/Source/WebCore/bindings/scripts/test/GObject/WebKitDOMTestObj.cpp
+++ b/Source/WebCore/bindings/scripts/test/GObject/WebKitDOMTestObj.cpp
@@ -912,11 +912,11 @@ G_MAXLONG, /* max */
                                     PROP_REPLACEABLE_ATTRIBUTE,
                                     g_param_spec_long("replaceable-attribute", /* name */
                                                            "test_obj_replaceable-attribute", /* short description */
-                                                           "read-write  glong TestObj.replaceable-attribute", /* longer - could do with some extra doc stuff here */
+                                                           "read-only  glong TestObj.replaceable-attribute", /* longer - could do with some extra doc stuff here */
                                                            G_MINLONG, /* min */
 G_MAXLONG, /* max */
 0, /* default */
-                                                           WEBKIT_PARAM_READWRITE));
+                                                           WEBKIT_PARAM_READABLE));
 
 
 }
diff --git a/Source/WebCore/bindings/scripts/test/JS/JSFloat64Array.cpp b/Source/WebCore/bindings/scripts/test/JS/JSFloat64Array.cpp
index 7ceade676..eb83390fb 100644
--- a/Source/WebCore/bindings/scripts/test/JS/JSFloat64Array.cpp
+++ b/Source/WebCore/bindings/scripts/test/JS/JSFloat64Array.cpp
@@ -53,7 +53,12 @@ static const HashTableValue JSFloat64ArrayConstructorTableValues[] =
 };
 
 static const HashTable JSFloat64ArrayConstructorTable = { 1, 0, JSFloat64ArrayConstructorTableValues, 0 };
-const ClassInfo JSFloat64ArrayConstructor::s_info = { "Float64ArrayConstructor", &Base::s_info, &JSFloat64ArrayConstructorTable, 0, CREATE_METHOD_TABLE(JSFloat64ArrayConstructor) };
+static const HashTable* getJSFloat64ArrayConstructorTable(ExecState* exec)
+{
+    return getHashTableForGlobalData(exec->globalData(), &JSFloat64ArrayConstructorTable);
+}
+
+const ClassInfo JSFloat64ArrayConstructor::s_info = { "Float64ArrayConstructor", &Base::s_info, 0, getJSFloat64ArrayConstructorTable, CREATE_METHOD_TABLE(JSFloat64ArrayConstructor) };
 
 JSFloat64ArrayConstructor::JSFloat64ArrayConstructor(Structure* structure, JSDOMGlobalObject* globalObject)
     : DOMConstructorObject(structure, globalObject)
@@ -70,12 +75,12 @@ void JSFloat64ArrayConstructor::finishCreation(ExecState* exec, JSDOMGlobalObjec
 
 bool JSFloat64ArrayConstructor::getOwnPropertySlot(JSCell* cell, ExecState* exec, PropertyName propertyName, PropertySlot& slot)
 {
-    return getStaticValueSlot<JSFloat64ArrayConstructor, JSDOMWrapper>(exec, &JSFloat64ArrayConstructorTable, jsCast<JSFloat64ArrayConstructor*>(cell), propertyName, slot);
+    return getStaticValueSlot<JSFloat64ArrayConstructor, JSDOMWrapper>(exec, getJSFloat64ArrayConstructorTable(exec), jsCast<JSFloat64ArrayConstructor*>(cell), propertyName, slot);
 }
 
 bool JSFloat64ArrayConstructor::getOwnPropertyDescriptor(JSObject* object, ExecState* exec, PropertyName propertyName, PropertyDescriptor& descriptor)
 {
-    return getStaticValueDescriptor<JSFloat64ArrayConstructor, JSDOMWrapper>(exec, &JSFloat64ArrayConstructorTable, jsCast<JSFloat64ArrayConstructor*>(object), propertyName, descriptor);
+    return getStaticValueDescriptor<JSFloat64ArrayConstructor, JSDOMWrapper>(exec, getJSFloat64ArrayConstructorTable(exec), jsCast<JSFloat64ArrayConstructor*>(object), propertyName, descriptor);
 }
 
 EncodedJSValue JSC_HOST_CALL JSFloat64ArrayConstructor::constructJSFloat64Array(ExecState* exec)
diff --git a/Source/WebCore/bindings/scripts/test/JS/JSTestObj.cpp b/Source/WebCore/bindings/scripts/test/JS/JSTestObj.cpp
index e06d4bb01..31955bae2 100644
--- a/Source/WebCore/bindings/scripts/test/JS/JSTestObj.cpp
+++ b/Source/WebCore/bindings/scripts/test/JS/JSTestObj.cpp
@@ -1636,13 +1636,6 @@ EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionOptionsObject(ExecState*
     Dictionary oo(exec, MAYBE_MISSING_PARAMETER(exec, 0, DefaultIsUndefined));
     if (exec->hadException())
         return JSValue::encode(jsUndefined());
-
-    size_t argsCount = exec->argumentCount();
-    if (argsCount <= 1) {
-        impl->optionsObject(oo);
-        return JSValue::encode(jsUndefined());
-    }
-
     Dictionary ooo(exec, MAYBE_MISSING_PARAMETER(exec, 1, DefaultIsUndefined));
     if (exec->hadException())
         return JSValue::encode(jsUndefined());
diff --git a/Source/WebCore/bindings/scripts/test/ObjC/DOMTestObj.h b/Source/WebCore/bindings/scripts/test/ObjC/DOMTestObj.h
index d9066b8aa..651600a5f 100644
--- a/Source/WebCore/bindings/scripts/test/ObjC/DOMTestObj.h
+++ b/Source/WebCore/bindings/scripts/test/ObjC/DOMTestObj.h
@@ -115,7 +115,7 @@ enum {
 @property(readonly) int descriptionName;
 @property int idName;
 @property(readonly, copy) NSString *hashName;
-@property int replaceableAttribute;
+@property(readonly) int replaceableAttribute;
 
 - (void)voidMethod;
 - (void)voidMethodWithArgs:(int)longArg strArg:(NSString *)strArg objArg:(DOMTestObj *)objArg;
diff --git a/Source/WebCore/bindings/scripts/test/ObjC/DOMTestObj.mm b/Source/WebCore/bindings/scripts/test/ObjC/DOMTestObj.mm
index 4fdc61a02..e14c6571d 100644
--- a/Source/WebCore/bindings/scripts/test/ObjC/DOMTestObj.mm
+++ b/Source/WebCore/bindings/scripts/test/ObjC/DOMTestObj.mm
@@ -718,12 +718,6 @@
     return IMPL->replaceableAttribute();
 }
 
-- (void)setReplaceableAttribute:(int)newReplaceableAttribute
-{
-    WebCore::JSMainThreadNullState state;
-    IMPL->setReplaceableAttribute(newReplaceableAttribute);
-}
-
 - (void)voidMethod
 {
     WebCore::JSMainThreadNullState state;
diff --git a/Source/WebCore/bindings/scripts/test/TestObj.idl b/Source/WebCore/bindings/scripts/test/TestObj.idl
index 83fe86fc4..f9d065fa1 100644
--- a/Source/WebCore/bindings/scripts/test/TestObj.idl
+++ b/Source/WebCore/bindings/scripts/test/TestObj.idl
@@ -261,7 +261,7 @@
     const unsigned short CONST_VALUE_14 = 0x1abc;
     [Reflect=CONST_IMPL] const unsigned short CONST_JAVASCRIPT = 15;
 
-    [Replaceable] attribute long replaceableAttribute;
+    [Replaceable] readonly attribute long replaceableAttribute;
 
     void variadicStringMethod(in DOMString head, in DOMString... tail);
     void variadicDoubleMethod(in double head, in double... tail);
diff --git a/Source/WebCore/bindings/scripts/test/V8/V8Float64Array.h b/Source/WebCore/bindings/scripts/test/V8/V8Float64Array.h
index afb01344e..be01b1c06 100644
--- a/Source/WebCore/bindings/scripts/test/V8/V8Float64Array.h
+++ b/Source/WebCore/bindings/scripts/test/V8/V8Float64Array.h
@@ -55,7 +55,7 @@ private:
 
 v8::Handle<v8::Object> V8Float64Array::wrap(Float64Array* impl, v8::Handle<v8::Object> creationContext, v8::Isolate* isolate)
 {
-        v8::Handle<v8::Object> wrapper = getDOMObjectMap(isolate).get(impl);
+        v8::Handle<v8::Object> wrapper = DOMDataStore::current(isolate)->get(impl);
         if (!wrapper.IsEmpty())
             return wrapper;
     return V8Float64Array::wrapSlow(impl, creationContext, isolate);
diff --git a/Source/WebCore/bindings/scripts/test/V8/V8TestActiveDOMObject.h b/Source/WebCore/bindings/scripts/test/V8/V8TestActiveDOMObject.h
index 7baeacca9..1923810ab 100644
--- a/Source/WebCore/bindings/scripts/test/V8/V8TestActiveDOMObject.h
+++ b/Source/WebCore/bindings/scripts/test/V8/V8TestActiveDOMObject.h
@@ -55,7 +55,7 @@ private:
 
 v8::Handle<v8::Object> V8TestActiveDOMObject::wrap(TestActiveDOMObject* impl, v8::Handle<v8::Object> creationContext, v8::Isolate* isolate)
 {
-        v8::Handle<v8::Object> wrapper = getDOMObjectMap(isolate).get(impl);
+        v8::Handle<v8::Object> wrapper = DOMDataStore::current(isolate)->get(impl);
         if (!wrapper.IsEmpty())
             return wrapper;
     return V8TestActiveDOMObject::wrapSlow(impl, creationContext, isolate);
diff --git a/Source/WebCore/bindings/scripts/test/V8/V8TestCustomNamedGetter.h b/Source/WebCore/bindings/scripts/test/V8/V8TestCustomNamedGetter.h
index ea334b0e4..8c89c0a29 100644
--- a/Source/WebCore/bindings/scripts/test/V8/V8TestCustomNamedGetter.h
+++ b/Source/WebCore/bindings/scripts/test/V8/V8TestCustomNamedGetter.h
@@ -54,7 +54,7 @@ private:
 
 v8::Handle<v8::Object> V8TestCustomNamedGetter::wrap(TestCustomNamedGetter* impl, v8::Handle<v8::Object> creationContext, v8::Isolate* isolate)
 {
-        v8::Handle<v8::Object> wrapper = getDOMObjectMap(isolate).get(impl);
+        v8::Handle<v8::Object> wrapper = DOMDataStore::current(isolate)->get(impl);
         if (!wrapper.IsEmpty())
             return wrapper;
     return V8TestCustomNamedGetter::wrapSlow(impl, creationContext, isolate);
diff --git a/Source/WebCore/bindings/scripts/test/V8/V8TestEventConstructor.h b/Source/WebCore/bindings/scripts/test/V8/V8TestEventConstructor.h
index 9961280f0..629a5b55e 100644
--- a/Source/WebCore/bindings/scripts/test/V8/V8TestEventConstructor.h
+++ b/Source/WebCore/bindings/scripts/test/V8/V8TestEventConstructor.h
@@ -55,7 +55,7 @@ private:
 
 v8::Handle<v8::Object> V8TestEventConstructor::wrap(TestEventConstructor* impl, v8::Handle<v8::Object> creationContext, v8::Isolate* isolate)
 {
-        v8::Handle<v8::Object> wrapper = getDOMObjectMap(isolate).get(impl);
+        v8::Handle<v8::Object> wrapper = DOMDataStore::current(isolate)->get(impl);
         if (!wrapper.IsEmpty())
             return wrapper;
     return V8TestEventConstructor::wrapSlow(impl, creationContext, isolate);
diff --git a/Source/WebCore/bindings/scripts/test/V8/V8TestEventTarget.h b/Source/WebCore/bindings/scripts/test/V8/V8TestEventTarget.h
index f9b1f7af1..9b68e34e1 100644
--- a/Source/WebCore/bindings/scripts/test/V8/V8TestEventTarget.h
+++ b/Source/WebCore/bindings/scripts/test/V8/V8TestEventTarget.h
@@ -56,7 +56,7 @@ private:
 
 v8::Handle<v8::Object> V8TestEventTarget::wrap(TestEventTarget* impl, v8::Handle<v8::Object> creationContext, v8::Isolate* isolate)
 {
-        v8::Handle<v8::Object> wrapper = getDOMObjectMap(isolate).get(impl);
+        v8::Handle<v8::Object> wrapper = DOMDataStore::current(isolate)->get(impl);
         if (!wrapper.IsEmpty())
             return wrapper;
     return V8TestEventTarget::wrapSlow(impl, creationContext, isolate);
diff --git a/Source/WebCore/bindings/scripts/test/V8/V8TestException.h b/Source/WebCore/bindings/scripts/test/V8/V8TestException.h
index 99afe8b16..71b9478d3 100644
--- a/Source/WebCore/bindings/scripts/test/V8/V8TestException.h
+++ b/Source/WebCore/bindings/scripts/test/V8/V8TestException.h
@@ -53,7 +53,7 @@ private:
 
 v8::Handle<v8::Object> V8TestException::wrap(TestException* impl, v8::Handle<v8::Object> creationContext, v8::Isolate* isolate)
 {
-        v8::Handle<v8::Object> wrapper = getDOMObjectMap(isolate).get(impl);
+        v8::Handle<v8::Object> wrapper = DOMDataStore::current(isolate)->get(impl);
         if (!wrapper.IsEmpty())
             return wrapper;
     return V8TestException::wrapSlow(impl, creationContext, isolate);
diff --git a/Source/WebCore/bindings/scripts/test/V8/V8TestInterface.cpp b/Source/WebCore/bindings/scripts/test/V8/V8TestInterface.cpp
index 066da9c7e..6b56c928d 100644
--- a/Source/WebCore/bindings/scripts/test/V8/V8TestInterface.cpp
+++ b/Source/WebCore/bindings/scripts/test/V8/V8TestInterface.cpp
@@ -263,7 +263,7 @@ v8::Handle<v8::Value> V8TestInterface::constructorCallback(const v8::Arguments&
         goto fail;
 
     V8DOMWrapper::setDOMWrapper(wrapper, &info, impl.get());
-    V8DOMWrapper::setJSWrapperForActiveDOMObject(impl.release(), wrapper, args.GetIsolate());
+    V8DOMWrapper::setJSWrapperForDOMObject(impl.release(), wrapper, args.GetIsolate());
     return wrapper;
   fail:
     return setDOMException(ec, args.GetIsolate());
@@ -364,7 +364,7 @@ v8::Handle<v8::Object> V8TestInterface::wrapSlow(PassRefPtr<TestInterface> impl,
         return wrapper;
 
     installPerContextProperties(wrapper, impl.get());
-    v8::Persistent<v8::Object> wrapperHandle = V8DOMWrapper::setJSWrapperForActiveDOMObject(impl, wrapper, isolate);
+    v8::Persistent<v8::Object> wrapperHandle = V8DOMWrapper::setJSWrapperForDOMObject(impl, wrapper, isolate);
     if (!hasDependentLifetime)
         wrapperHandle.MarkIndependent();
     return wrapper;
diff --git a/Source/WebCore/bindings/scripts/test/V8/V8TestInterface.h b/Source/WebCore/bindings/scripts/test/V8/V8TestInterface.h
index 850c0cb5b..75fd11ff2 100644
--- a/Source/WebCore/bindings/scripts/test/V8/V8TestInterface.h
+++ b/Source/WebCore/bindings/scripts/test/V8/V8TestInterface.h
@@ -58,7 +58,7 @@ private:
 
 v8::Handle<v8::Object> V8TestInterface::wrap(TestInterface* impl, v8::Handle<v8::Object> creationContext, v8::Isolate* isolate)
 {
-        v8::Handle<v8::Object> wrapper = getActiveDOMObjectMap(isolate).get(impl);
+        v8::Handle<v8::Object> wrapper = DOMDataStore::current(isolate)->get(impl);
         if (!wrapper.IsEmpty())
             return wrapper;
     return V8TestInterface::wrapSlow(impl, creationContext, isolate);
diff --git a/Source/WebCore/bindings/scripts/test/V8/V8TestMediaQueryListListener.h b/Source/WebCore/bindings/scripts/test/V8/V8TestMediaQueryListListener.h
index f88598046..7ba4a5641 100644
--- a/Source/WebCore/bindings/scripts/test/V8/V8TestMediaQueryListListener.h
+++ b/Source/WebCore/bindings/scripts/test/V8/V8TestMediaQueryListListener.h
@@ -53,7 +53,7 @@ private:
 
 v8::Handle<v8::Object> V8TestMediaQueryListListener::wrap(TestMediaQueryListListener* impl, v8::Handle<v8::Object> creationContext, v8::Isolate* isolate)
 {
-        v8::Handle<v8::Object> wrapper = getDOMObjectMap(isolate).get(impl);
+        v8::Handle<v8::Object> wrapper = DOMDataStore::current(isolate)->get(impl);
         if (!wrapper.IsEmpty())
             return wrapper;
     return V8TestMediaQueryListListener::wrapSlow(impl, creationContext, isolate);
diff --git a/Source/WebCore/bindings/scripts/test/V8/V8TestNamedConstructor.cpp b/Source/WebCore/bindings/scripts/test/V8/V8TestNamedConstructor.cpp
index 400fd4ace..3cd9f2009 100644
--- a/Source/WebCore/bindings/scripts/test/V8/V8TestNamedConstructor.cpp
+++ b/Source/WebCore/bindings/scripts/test/V8/V8TestNamedConstructor.cpp
@@ -72,7 +72,7 @@ static v8::Handle<v8::Value> V8TestNamedConstructorConstructorCallback(const v8:
         goto fail;
 
     V8DOMWrapper::setDOMWrapper(wrapper, &V8TestNamedConstructorConstructor::info, impl.get());
-    V8DOMWrapper::setJSWrapperForActiveDOMObject(impl.release(), wrapper, args.GetIsolate());
+    V8DOMWrapper::setJSWrapperForDOMObject(impl.release(), wrapper, args.GetIsolate());
     return wrapper;
   fail:
     return setDOMException(ec, args.GetIsolate());
@@ -174,7 +174,7 @@ v8::Handle<v8::Object> V8TestNamedConstructor::wrapSlow(PassRefPtr<TestNamedCons
         return wrapper;
 
     installPerContextProperties(wrapper, impl.get());
-    v8::Persistent<v8::Object> wrapperHandle = V8DOMWrapper::setJSWrapperForActiveDOMObject(impl, wrapper, isolate);
+    v8::Persistent<v8::Object> wrapperHandle = V8DOMWrapper::setJSWrapperForDOMObject(impl, wrapper, isolate);
     if (!hasDependentLifetime)
         wrapperHandle.MarkIndependent();
     return wrapper;
diff --git a/Source/WebCore/bindings/scripts/test/V8/V8TestNamedConstructor.h b/Source/WebCore/bindings/scripts/test/V8/V8TestNamedConstructor.h
index 838b11538..b0f3471c8 100644
--- a/Source/WebCore/bindings/scripts/test/V8/V8TestNamedConstructor.h
+++ b/Source/WebCore/bindings/scripts/test/V8/V8TestNamedConstructor.h
@@ -60,7 +60,7 @@ private:
 
 v8::Handle<v8::Object> V8TestNamedConstructor::wrap(TestNamedConstructor* impl, v8::Handle<v8::Object> creationContext, v8::Isolate* isolate)
 {
-        v8::Handle<v8::Object> wrapper = getActiveDOMObjectMap(isolate).get(impl);
+        v8::Handle<v8::Object> wrapper = DOMDataStore::current(isolate)->get(impl);
         if (!wrapper.IsEmpty())
             return wrapper;
     return V8TestNamedConstructor::wrapSlow(impl, creationContext, isolate);
diff --git a/Source/WebCore/bindings/scripts/test/V8/V8TestNode.cpp b/Source/WebCore/bindings/scripts/test/V8/V8TestNode.cpp
index 89bfedc47..13ebc65ae 100644
--- a/Source/WebCore/bindings/scripts/test/V8/V8TestNode.cpp
+++ b/Source/WebCore/bindings/scripts/test/V8/V8TestNode.cpp
@@ -54,7 +54,7 @@ v8::Handle<v8::Value> V8TestNode::constructorCallback(const v8::Arguments& args)
     v8::Handle<v8::Object> wrapper = args.Holder();
 
     V8DOMWrapper::setDOMWrapper(wrapper, &info, impl.get());
-    V8DOMWrapper::setJSWrapperForDOMNode(impl.release(), wrapper, args.GetIsolate());
+    V8DOMWrapper::setJSWrapperForDOMObject(impl.release(), wrapper, args.GetIsolate());
     return wrapper;
 }
 
@@ -135,10 +135,9 @@ v8::Handle<v8::Object> V8TestNode::wrapSlow(PassRefPtr<TestNode> impl, v8::Handl
         return wrapper;
 
     installPerContextProperties(wrapper, impl.get());
-    v8::Persistent<v8::Object> wrapperHandle = V8DOMWrapper::setJSWrapperForDOMNode(impl, wrapper, isolate);
+    v8::Persistent<v8::Object> wrapperHandle = V8DOMWrapper::setJSWrapperForDOMObject(impl, wrapper, isolate);
     if (!hasDependentLifetime)
         wrapperHandle.MarkIndependent();
-    wrapperHandle.SetWrapperClassId(v8DOMSubtreeClassId);
     return wrapper;
 }
 
diff --git a/Source/WebCore/bindings/scripts/test/V8/V8TestObj.cpp b/Source/WebCore/bindings/scripts/test/V8/V8TestObj.cpp
index 3ae63a605..25b6b4b9d 100644
--- a/Source/WebCore/bindings/scripts/test/V8/V8TestObj.cpp
+++ b/Source/WebCore/bindings/scripts/test/V8/V8TestObj.cpp
@@ -101,7 +101,7 @@ static v8::Handle<v8::Value> readOnlyTestObjAttrAttrGetter(v8::Local<v8::String>
     INC_STATS("DOM.TestObj.readOnlyTestObjAttr._get");
     TestObj* imp = V8TestObj::toNative(info.Holder());
     RefPtr<TestObj> result = imp->readOnlyTestObjAttr();
-    v8::Handle<v8::Value> wrapper = result.get() ? getDOMObjectMap(info.GetIsolate()).get(result.get()) : v8Undefined();
+    v8::Handle<v8::Value> wrapper = result.get() ? v8::Handle<v8::Value>(DOMDataStore::current(info.GetIsolate())->get(result.get())) : v8Undefined();
     if (wrapper.IsEmpty()) {
         wrapper = toV8(result.get(), info.Holder(), info.GetIsolate());
         if (!wrapper.IsEmpty())
@@ -1173,10 +1173,6 @@ static v8::Handle<v8::Value> optionsObjectCallback(const v8::Arguments& args)
     EXCEPTION_BLOCK(Dictionary, oo, Dictionary(MAYBE_MISSING_PARAMETER(args, 0, DefaultIsUndefined), args.GetIsolate()));
     if (!oo.isUndefinedOrNull() && !oo.isObject())
         return throwTypeError("Not an object.", args.GetIsolate());
-    if (args.Length() <= 1) {
-        imp->optionsObject(oo);
-        return v8Undefined();
-    }
     EXCEPTION_BLOCK(Dictionary, ooo, Dictionary(MAYBE_MISSING_PARAMETER(args, 1, DefaultIsUndefined), args.GetIsolate()));
     if (!ooo.isUndefinedOrNull() && !ooo.isObject())
         return throwTypeError("Not an object.", args.GetIsolate());
@@ -2073,7 +2069,7 @@ static const V8DOMConfiguration::BatchedAttribute V8TestObjAttrs[] = {
     {"id", TestObjV8Internal::idAttrGetter, TestObjV8Internal::idAttrSetter, 0 /* no data */, static_cast<v8::AccessControl>(v8::DEFAULT), static_cast<v8::PropertyAttribute>(v8::None), 0 /* on instance */},
     // Attribute 'hash' (Type: 'readonly attribute' ExtAttr: '')
     {"hash", TestObjV8Internal::hashAttrGetter, 0, 0 /* no data */, static_cast<v8::AccessControl>(v8::DEFAULT), static_cast<v8::PropertyAttribute>(v8::None), 0 /* on instance */},
-    // Attribute 'replaceableAttribute' (Type: 'attribute' ExtAttr: 'Replaceable')
+    // Attribute 'replaceableAttribute' (Type: 'readonly attribute' ExtAttr: 'Replaceable')
     {"replaceableAttribute", TestObjV8Internal::replaceableAttributeAttrGetter, TestObjV8Internal::TestObjReplaceableAttrSetter, 0 /* no data */, static_cast<v8::AccessControl>(v8::DEFAULT), static_cast<v8::PropertyAttribute>(v8::None), 0 /* on instance */},
 };
 
@@ -2326,16 +2322,15 @@ bool V8TestObj::HasInstance(v8::Handle<v8::Value> value)
 void V8TestObj::installPerContextProperties(v8::Handle<v8::Object> instance, TestObj* impl)
 {
     v8::Local<v8::Object> proto = v8::Local<v8::Object>::Cast(instance->GetPrototype());
-    ScriptExecutionContext* context = toScriptExecutionContext(proto->CreationContext());
     // When building QtWebkit with V8 this variable is unused when none of the features are enabled.
-    UNUSED_PARAM(context);
-    if (context && context->isDocument() && ContextFeatures::enabledPerContextAttr1Enabled(static_cast<Document*>(context))) {
+    UNUSED_PARAM(proto);
+    if (ContextFeatures::enabledPerContextAttr1Enabled(impl->document())) {
         static const V8DOMConfiguration::BatchedAttribute attrData =\
         // Attribute 'enabledPerContextAttr1' (Type: 'attribute' ExtAttr: 'V8EnabledPerContext')
         {"enabledPerContextAttr1", TestObjV8Internal::enabledPerContextAttr1AttrGetter, TestObjV8Internal::enabledPerContextAttr1AttrSetter, 0 /* no data */, static_cast<v8::AccessControl>(v8::DEFAULT), static_cast<v8::PropertyAttribute>(v8::None), 0 /* on instance */};
         V8DOMConfiguration::configureAttribute(instance, proto, attrData);
     }
-    if (context && context->isDocument() && ContextFeatures::featureNameEnabled(static_cast<Document*>(context))) {
+    if (ContextFeatures::featureNameEnabled(impl->document())) {
         static const V8DOMConfiguration::BatchedAttribute attrData =\
         // Attribute 'enabledPerContextAttr2' (Type: 'attribute' ExtAttr: 'V8EnabledPerContext')
         {"enabledPerContextAttr2", TestObjV8Internal::enabledPerContextAttr2AttrGetter, TestObjV8Internal::enabledPerContextAttr2AttrSetter, 0 /* no data */, static_cast<v8::AccessControl>(v8::DEFAULT), static_cast<v8::PropertyAttribute>(v8::None), 0 /* on instance */};
diff --git a/Source/WebCore/bindings/scripts/test/V8/V8TestObj.h b/Source/WebCore/bindings/scripts/test/V8/V8TestObj.h
index 621e297af..9438952c8 100644
--- a/Source/WebCore/bindings/scripts/test/V8/V8TestObj.h
+++ b/Source/WebCore/bindings/scripts/test/V8/V8TestObj.h
@@ -59,7 +59,7 @@ private:
 
 v8::Handle<v8::Object> V8TestObj::wrap(TestObj* impl, v8::Handle<v8::Object> creationContext, v8::Isolate* isolate)
 {
-        v8::Handle<v8::Object> wrapper = getDOMObjectMap(isolate).get(impl);
+        v8::Handle<v8::Object> wrapper = DOMDataStore::current(isolate)->get(impl);
         if (!wrapper.IsEmpty())
             return wrapper;
     return V8TestObj::wrapSlow(impl, creationContext, isolate);
diff --git a/Source/WebCore/bindings/scripts/test/V8/V8TestSerializedScriptValueInterface.h b/Source/WebCore/bindings/scripts/test/V8/V8TestSerializedScriptValueInterface.h
index 63c222a0b..397016850 100644
--- a/Source/WebCore/bindings/scripts/test/V8/V8TestSerializedScriptValueInterface.h
+++ b/Source/WebCore/bindings/scripts/test/V8/V8TestSerializedScriptValueInterface.h
@@ -56,7 +56,7 @@ private:
 
 v8::Handle<v8::Object> V8TestSerializedScriptValueInterface::wrap(TestSerializedScriptValueInterface* impl, v8::Handle<v8::Object> creationContext, v8::Isolate* isolate)
 {
-        v8::Handle<v8::Object> wrapper = getDOMObjectMap(isolate).get(impl);
+        v8::Handle<v8::Object> wrapper = DOMDataStore::current(isolate)->get(impl);
         if (!wrapper.IsEmpty())
             return wrapper;
     return V8TestSerializedScriptValueInterface::wrapSlow(impl, creationContext, isolate);
diff --git a/Source/WebCore/bindings/v8/DOMData.h b/Source/WebCore/bindings/v8/DOMData.h
deleted file mode 100644
index 7df9dfdba..000000000
--- a/Source/WebCore/bindings/v8/DOMData.h
+++ /dev/null
@@ -1,107 +0,0 @@
-/*
- * Copyright (C) 2009 Google Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions are
- * met:
- *
- *     * Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- *     * Redistributions in binary form must reproduce the above
- * copyright notice, this list of conditions and the following disclaimer
- * in the documentation and/or other materials provided with the
- * distribution.
- *     * Neither the name of Google Inc. nor the names of its
- * contributors may be used to endorse or promote products derived from
- * this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
- * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#ifndef DOMData_h
-#define DOMData_h
-
-#include "DOMDataStore.h"
-#include "StaticDOMDataStore.h"
-#include "V8DOMWrapper.h"
-
-namespace WebCore {
-
-    // DOMData
-    //
-    // DOMData represents the all the DOM wrappers for a given thread.  In
-    // particular, DOMData holds wrappers for all the isolated worlds in the
-    // thread.  The DOMData for the main thread and the DOMData for child threads
-    // use different subclasses.
-    //
-    class DOMData {
-    public:
-        template<typename T>
-        static void handleWeakObject(DOMDataStore::DOMWrapperMapType, v8::Persistent<v8::Object>, T* domObject);
-
-        template<typename T>
-        static void removeObjectsFromWrapperMap(DOMDataStore* store, AbstractWeakReferenceMap<T, v8::Object>& domMap);
-
-
-        static DOMDataStore& getCurrentStore(v8::Isolate* = 0);
-    private:
-        DOMData();
-        static void derefObject(WrapperTypeInfo* type, void* domObject);
-
-        template<typename T>
-        class WrapperMapObjectRemover : public WeakReferenceMap<T, v8::Object>::Visitor {
-        public:
-            virtual void visitDOMWrapper(DOMDataStore* store, T* domObject, v8::Persistent<v8::Object> v8Object)
-            {
-                WrapperTypeInfo* type = V8DOMWrapper::domWrapperType(v8Object);
-                derefObject(type, domObject);
-                v8Object.Dispose();
-            }
-        };
-    };
-
-    template<typename T>
-    void DOMData::handleWeakObject(DOMDataStore::DOMWrapperMapType mapType, v8::Persistent<v8::Object> v8Object, T* domObject)
-    {
-        WrapperTypeInfo* type = V8DOMWrapper::domWrapperType(v8Object);
-        DOMDataList& list = DOMDataStore::allStores();
-        bool found = false;
-        for (size_t i = 0; i < list.size(); ++i) {
-            DOMDataStore* store = list[i];
-
-            DOMWrapperMap<T>* domMap = static_cast<DOMWrapperMap<T>*>(store->getDOMWrapperMap(mapType));
-            if (domMap->removeIfPresent(domObject, v8Object)) {
-                derefObject(type, domObject);
-                found = true;
-            }
-        }
-
-        // If not found, it means map for the wrapper has been already destroyed, just dispose the
-        // handle and deref the object to fight memory leak.
-        if (!found) {
-            v8Object.Dispose();
-            derefObject(type, domObject);
-        }
-    }
-
-    template<typename T>
-    void DOMData::removeObjectsFromWrapperMap(DOMDataStore* store, AbstractWeakReferenceMap<T, v8::Object>& domMap)
-    {
-        WrapperMapObjectRemover<T> remover;
-        domMap.visit(store, &remover);
-        domMap.clear();
-    }
-
-} // namespace WebCore
-
-#endif // DOMData_h
diff --git a/Source/WebCore/bindings/v8/DOMDataStore.cpp b/Source/WebCore/bindings/v8/DOMDataStore.cpp
index dc0896cf3..1eb548fbe 100644
--- a/Source/WebCore/bindings/v8/DOMDataStore.cpp
+++ b/Source/WebCore/bindings/v8/DOMDataStore.cpp
@@ -31,141 +31,59 @@
 #include "config.h"
 #include "DOMDataStore.h"
 
-#include "DOMData.h"
+#include "DOMWrapperMap.h"
+#include "IntrusiveDOMWrapperMap.h"
 #include "V8Binding.h"
 #include "WebCoreMemoryInstrumentation.h"
 #include <wtf/MainThread.h>
 
 namespace WebCore {
 
-// DOM binding algorithm:
-//
-// There are two kinds of DOM objects:
-// 1. DOM tree nodes, such as Document, HTMLElement, ...
-//    there classes implement TreeShared<T> interface;
-// 2. Non-node DOM objects, such as CSSRule, Location, etc.
-//    these classes implement a ref-counted scheme.
-//
-// A DOM object may have a JS wrapper object. If a tree node
-// is alive, its JS wrapper must be kept alive even it is not
-// reachable from JS roots.
-// However, JS wrappers of non-node objects can go away if
-// not reachable from other JS objects. It works like a cache.
-//
-// DOM objects are ref-counted, and JS objects are traced from
-// a set of root objects. They can create a cycle. To break
-// cycles, we do following:
-//   Handles from DOM objects to JS wrappers are always weak,
-// so JS wrappers of non-node object cannot create a cycle.
-//   Before starting a global GC, we create a virtual connection
-// between nodes in the same tree in the JS heap. If the wrapper
-// of one node in a tree is alive, wrappers of all nodes in
-// the same tree are considered alive. This is done by creating
-// object groups in GC prologue callbacks. The mark-compact
-// collector will remove these groups after each GC.
-//
-// DOM objects should be deref-ed from the owning thread, not the GC thread
-// that does not own them. In V8, GC can kick in from any thread. To ensure
-// that DOM objects are always deref-ed from the owning thread when running
-// V8 in multi-threading environment, we do following:
-// 1. Maintain a thread specific DOM wrapper map for each object map.
-//    (We're using TLS support from WTF instead of base since V8Bindings
-//     does not depend on base. We further assume that all child threads
-//     running V8 instances are created by WTF and thus a destructor will
-//     be called to clean up all thread specific data.)
-// 2. When GC happens:
-//    2.1. If the dead object is in GC thread's map, remove the JS reference
-//         and deref the DOM object.
-//    2.2. Otherwise, go through all thread maps to find the owning thread.
-//         Remove the JS reference from the owning thread's map and move the
-//         DOM object to a delayed queue. Post a task to the owning thread
-//         to have it deref-ed from the owning thread at later time.
-// 3. When a thread is tearing down, invoke a cleanup routine to go through
-//    all objects in the delayed queue and the thread map and deref all of
-//    them.
-
-
-DOMDataStore::DOMDataStore()
-    : m_domNodeMap(0)
-    , m_activeDomNodeMap(0)
-    , m_domObjectMap(0)
-    , m_activeDomObjectMap(0)
+DOMDataStore::DOMDataStore(Type type)
+    : m_type(type)
 {
+    if (type == MainWorld)
+        m_domNodeMap = adoptPtr(new IntrusiveDOMWrapperMap<Node>);
+    else {
+        ASSERT(type == IsolatedWorld || type == Worker);
+        // FIXME: In principle, we shouldn't need to create this
+        // wrapper map for workers because there are no Nodes on
+        // worker threads.
+        m_domNodeMap = adoptPtr(new DOMWrapperHashMap<Node>);
+    }
+    m_domObjectMap = adoptPtr(new DOMWrapperHashMap<void>);
+
+    V8PerIsolateData::current()->registerDOMDataStore(this);
 }
 
 DOMDataStore::~DOMDataStore()
 {
-}
+    ASSERT(m_type != MainWorld); // We never actually destruct the main world's DOMDataStore.
 
-DOMDataList& DOMDataStore::allStores()
-{
-    return V8PerIsolateData::current()->allStores();
+    V8PerIsolateData::current()->unregisterDOMDataStore(this);
+
+    if (m_type == IsolatedWorld)
+        m_domNodeMap->clear();
+    m_domObjectMap->clear();
 }
 
-void* DOMDataStore::getDOMWrapperMap(DOMWrapperMapType type)
+DOMDataStore* DOMDataStore::current(v8::Isolate* isolate)
 {
-    switch (type) {
-    case DOMNodeMap:
-        return m_domNodeMap;
-    case ActiveDOMNodeMap:
-        return m_activeDomNodeMap;
-    case DOMObjectMap:
-        return m_domObjectMap;
-    case ActiveDOMObjectMap:
-        return m_activeDomObjectMap;
-    }
-
-    ASSERT_NOT_REACHED();
-    return 0;
+    DEFINE_STATIC_LOCAL(DOMDataStore, defaultStore, (MainWorld));
+    V8PerIsolateData* data = isolate ? V8PerIsolateData::from(isolate) : V8PerIsolateData::current();
+    if (UNLIKELY(!!data->domDataStore()))
+        return data->domDataStore();
+    V8DOMWindowShell* context = V8DOMWindowShell::getEntered();
+    if (UNLIKELY(!!context))
+        return context->world()->domDataStore();
+    return &defaultStore;
 }
 
 void DOMDataStore::reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
 {
     MemoryClassInfo info(memoryObjectInfo, this, WebCoreMemoryTypes::Binding);
-    info.addWeakPointer(m_domNodeMap);
-    info.addWeakPointer(m_activeDomNodeMap);
-    info.addWeakPointer(m_domObjectMap);
-    info.addWeakPointer(m_activeDomObjectMap);
-}
-
-// Called when the object is near death (not reachable from JS roots).
-// It is time to remove the entry from the table and dispose the handle.
-void DOMDataStore::weakDOMObjectCallback(v8::Persistent<v8::Value> v8Object, void* domObject)
-{
-    v8::HandleScope scope;
-    ASSERT(v8Object->IsObject());
-    DOMData::handleWeakObject(DOMDataStore::DOMObjectMap, v8::Persistent<v8::Object>::Cast(v8Object), domObject);
-}
-
-void DOMDataStore::weakActiveDOMObjectCallback(v8::Persistent<v8::Value> v8Object, void* domObject)
-{
-    v8::HandleScope scope;
-    ASSERT(v8Object->IsObject());
-    DOMData::handleWeakObject(DOMDataStore::ActiveDOMObjectMap, v8::Persistent<v8::Object>::Cast(v8Object), domObject);
-}
-
-void DOMDataStore::weakNodeCallback(v8::Persistent<v8::Value> value, void* domObject)
-{
-    ASSERT(isMainThread());
-
-    Node* node = static_cast<Node*>(domObject);
-    // Node wrappers must be JS objects.
-    v8::Persistent<v8::Object> v8Object = v8::Persistent<v8::Object>::Cast(value);
-
-    DOMDataList& list = DOMDataStore::allStores();
-    for (size_t i = 0; i < list.size(); ++i) {
-        DOMDataStore* store = list[i];
-        DOMNodeMapping& nodeMap = node->isActiveNode() ? store->activeDomNodeMap() : store->domNodeMap();
-        if (nodeMap.removeIfPresent(node, v8Object)) {
-            node->deref(); // Nobody overrides Node::deref so it's safe
-            return; // There might be at most one wrapper for the node in world's maps
-        }
-    }
-
-    // If not found, it means map for the wrapper has been already destroyed, just dispose the
-    // handle and deref the object to fight memory leak.
-    v8Object.Dispose();
-    node->deref(); // Nobody overrides Node::deref so it's safe
+    info.addMember(m_domNodeMap);
+    info.addMember(m_domObjectMap);
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/bindings/v8/DOMDataStore.h b/Source/WebCore/bindings/v8/DOMDataStore.h
index 377167548..ea83f417a 100644
--- a/Source/WebCore/bindings/v8/DOMDataStore.h
+++ b/Source/WebCore/bindings/v8/DOMDataStore.h
@@ -31,8 +31,8 @@
 #ifndef DOMDataStore_h
 #define DOMDataStore_h
 
-#include "V8DOMMap.h"
-
+#include "DOMWrapperMap.h"
+#include "Node.h"
 #include <v8.h>
 #include <wtf/HashMap.h>
 #include <wtf/MainThread.h>
@@ -45,57 +45,33 @@
 
 namespace WebCore {
 
-    class DOMData;
-    class DOMDataStore;
-
-    typedef WTF::Vector<DOMDataStore*> DOMDataList;
-
-    // DOMDataStore
-    //
-    // DOMDataStore is the backing store that holds the maps between DOM objects
-    // and JavaScript objects.  In general, each thread can have multiple backing
-    // stores, one per isolated world.
-    //
-    // This class doesn't manage the lifetime of the store.  The data store
-    // lifetime is managed by subclasses.
-    //
-    class DOMDataStore {
-        WTF_MAKE_NONCOPYABLE(DOMDataStore);
-    public:
-        enum DOMWrapperMapType {
-            DOMNodeMap,
-            ActiveDOMNodeMap,
-            DOMObjectMap,
-            ActiveDOMObjectMap,
-        };
-
-        DOMDataStore();
-        virtual ~DOMDataStore();
-
-        // A list of all DOMDataStore objects in the current V8 instance (thread). Normally, each World has a DOMDataStore.
-        static DOMDataList& allStores();
+class DOMDataStore {
+    WTF_MAKE_NONCOPYABLE(DOMDataStore);
+public:
+    enum Type {
+        MainWorld,
+        IsolatedWorld,
+        Worker,
+    };
 
-        void* getDOMWrapperMap(DOMWrapperMapType);
+    explicit DOMDataStore(Type);
+    ~DOMDataStore();
 
-        DOMNodeMapping& domNodeMap() { return *m_domNodeMap; }
-        DOMNodeMapping& activeDomNodeMap() { return *m_activeDomNodeMap; }
-        DOMWrapperMap<void>& domObjectMap() { return *m_domObjectMap; }
-        DOMWrapperMap<void>& activeDomObjectMap() { return *m_activeDomObjectMap; }
+    static DOMDataStore* current(v8::Isolate*);
 
-        // Need by V8GCController.
-        static void weakActiveDOMObjectCallback(v8::Persistent<v8::Value> v8Object, void* domObject);
-        static void weakNodeCallback(v8::Persistent<v8::Value> v8Object, void* domObject);
+    inline v8::Handle<v8::Object> get(void* object) const { return m_domObjectMap->get(object); }
+    inline v8::Handle<v8::Object> get(Node* object) const { return m_domNodeMap->get(object); }
 
-        virtual void reportMemoryUsage(MemoryObjectInfo*) const;
+    DOMWrapperMap<Node>& domNodeMap() { return *m_domNodeMap; }
+    DOMWrapperMap<void>& domObjectMap() { return *m_domObjectMap; }
 
-    protected:
-        static void weakDOMObjectCallback(v8::Persistent<v8::Value> v8Object, void* domObject);
+    void reportMemoryUsage(MemoryObjectInfo*) const;
 
-        DOMNodeMapping* m_domNodeMap;
-        DOMNodeMapping* m_activeDomNodeMap;
-        DOMWrapperMap<void>* m_domObjectMap;
-        DOMWrapperMap<void>* m_activeDomObjectMap;
-    };
+protected:
+    Type m_type;
+    OwnPtr<DOMWrapperMap<Node> > m_domNodeMap;
+    OwnPtr<DOMWrapperMap<void> > m_domObjectMap;
+};
 
 } // namespace WebCore
 
diff --git a/Source/WebCore/bindings/v8/DOMTransaction.cpp b/Source/WebCore/bindings/v8/DOMTransaction.cpp
deleted file mode 100644
index 225e5abb6..000000000
--- a/Source/WebCore/bindings/v8/DOMTransaction.cpp
+++ /dev/null
@@ -1,154 +0,0 @@
-/*
- * Copyright (C) 2012 Google Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1.  Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- * 2.  Redistributions in binary form must reproduce the above copyright
- * notice, this list of conditions and the following disclaimer in the
- * documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY GOOGLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
- * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
- * DISCLAIMED. IN NO EVENT SHALL GOOGLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
- * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
- * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
- * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
- * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "config.h"
-#include "DOMTransaction.h"
-
-#if ENABLE(UNDO_MANAGER)
-
-#include "Frame.h"
-#include "UndoManager.h"
-#include "V8DOMTransaction.h"
-#include "V8HiddenPropertyName.h"
-#include "V8UndoManager.h"
-
-namespace WebCore {
-
-class DOMTransactionScope {
-public:
-    DOMTransactionScope(DOMTransaction* transaction)
-    {
-        UndoManager::setRecordingDOMTransaction(transaction);
-    }
-    
-    ~DOMTransactionScope()
-    {
-        UndoManager::setRecordingDOMTransaction(0);
-    }
-};
-
-DOMTransaction::DOMTransaction(const WorldContextHandle& worldContext)
-    : m_worldContext(worldContext)
-    , m_undoManager(0)
-{
-}
-
-PassRefPtr<DOMTransaction> DOMTransaction::create(const WorldContextHandle& worldContext)
-{
-    return adoptRef(new DOMTransaction(worldContext));
-}
-
-void DOMTransaction::apply()
-{
-    m_isAutomatic = !getFunction("executeAutomatic").IsEmpty();
-    if (!m_isAutomatic)
-        callFunction("execute");
-    else {
-        DOMTransactionScope scope(this);
-        callFunction("executeAutomatic");
-    }
-}
-
-void DOMTransaction::unapply()
-{
-    if (!m_isAutomatic)
-        callFunction("undo");
-    else {
-        for (size_t i = m_transactionSteps.size(); i > 0; --i)
-            m_transactionSteps[i - 1]->unapply();
-    }
-
-    if (m_undoManager)
-        m_undoManager->registerRedoStep(this);
-}
-
-void DOMTransaction::reapply()
-{
-    if (!m_isAutomatic)
-        callFunction("redo");
-    else {
-        for (size_t i = 0; i < m_transactionSteps.size(); ++i)
-            m_transactionSteps[i]->reapply();
-    }
-
-    if (m_undoManager)
-        m_undoManager->registerUndoStep(this);
-}
-
-v8::Handle<v8::Value> DOMTransaction::data()
-{
-    v8::Handle<v8::Object> wrapper = v8::Handle<v8::Object>::Cast(toV8(this));
-    if (wrapper.IsEmpty())
-        return v8::Handle<v8::Value>();
-    return wrapper->GetHiddenValue(V8HiddenPropertyName::domTransactionData());
-}
-
-void DOMTransaction::setData(v8::Handle<v8::Value> newData)
-{
-    v8::Handle<v8::Object> wrapper = v8::Handle<v8::Object>::Cast(toV8(this));
-    if (wrapper.IsEmpty())
-        return;
-    wrapper->SetHiddenValue(V8HiddenPropertyName::domTransactionData(), newData);
-}
-
-v8::Handle<v8::Function> DOMTransaction::getFunction(const char* propertyName)
-{
-    v8::Handle<v8::Value> dictionary = data();
-    if (dictionary.IsEmpty() || !dictionary->IsObject())
-        return v8::Handle<v8::Function>();
-    
-    v8::Local<v8::Value> function = v8::Handle<v8::Object>::Cast(dictionary)->Get(v8::String::NewSymbol(propertyName));
-    if (function.IsEmpty() || !function->IsFunction())
-        return v8::Handle<v8::Function>();
-
-    return v8::Handle<v8::Function>::Cast(function);
-}
-
-void DOMTransaction::callFunction(const char* propertyName)
-{
-    if (!m_undoManager || !m_undoManager->document())
-        return;
-
-    Frame* frame = m_undoManager->document()->frame();
-    if (!frame || !frame->script()->canExecuteScripts(AboutToExecuteScript))
-        return;
-
-    v8::Handle<v8::Function> function = getFunction(propertyName);
-    if (function.IsEmpty())
-        return;
-
-    v8::Local<v8::Context> v8Context = m_worldContext.adjustedContext(frame->script());
-    if (v8Context.IsEmpty())
-        return;
-
-    v8::Handle<v8::Object> receiver = v8::Handle<v8::Object>::Cast(toV8(m_undoManager));
-    if (receiver.IsEmpty())
-        return;
-    v8::Handle<v8::Value> parameters[0] = { };
-    frame->script()->callFunction(function, receiver, 0, parameters);
-}
-
-}
-
-#endif
diff --git a/Source/WebCore/bindings/v8/DOMTransaction.h b/Source/WebCore/bindings/v8/DOMTransaction.h
deleted file mode 100644
index 96a1f1d2e..000000000
--- a/Source/WebCore/bindings/v8/DOMTransaction.h
+++ /dev/null
@@ -1,73 +0,0 @@
-/*
- * Copyright (C) 2012 Google Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1.  Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- * 2.  Redistributions in binary form must reproduce the above copyright
- * notice, this list of conditions and the following disclaimer in the
- * documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY GOOGLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
- * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
- * DISCLAIMED. IN NO EVENT SHALL GOOGLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
- * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
- * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
- * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
- * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#ifndef DOMTransaction_h
-#define DOMTransaction_h
-
-#if ENABLE(UNDO_MANAGER)
-
-#include "DOMTransactionStep.h"
-#include "UndoStep.h"
-#include "WorldContextHandle.h"
-#include <wtf/RefPtr.h>
-
-namespace WebCore {
-
-class UndoManager;
-
-class DOMTransaction : public UndoStep {
-public:
-    static PassRefPtr<DOMTransaction> create(const WorldContextHandle&);
-
-    void apply();
-    virtual void unapply() OVERRIDE;
-    virtual void reapply() OVERRIDE;
-
-    virtual EditAction editingAction() const OVERRIDE { return EditActionUnspecified; }
-    virtual bool isDOMTransaction() const OVERRIDE { return true; }
-
-    v8::Handle<v8::Value> data();
-    void setData(v8::Handle<v8::Value>);
-
-    UndoManager* undoManager() const { return m_undoManager; }
-    void setUndoManager(UndoManager* undoManager) { m_undoManager = undoManager; }
-
-    void addTransactionStep(PassRefPtr<DOMTransactionStep> step) { m_transactionSteps.append(step); }
-
-private:
-    DOMTransaction(const WorldContextHandle&);
-    v8::Handle<v8::Function> getFunction(const char*);
-    void callFunction(const char*);
-
-    WorldContextHandle m_worldContext;
-    UndoManager* m_undoManager;
-    bool m_isAutomatic;
-    Vector<RefPtr<DOMTransactionStep> > m_transactionSteps;
-};
-
-}
-
-#endif
-
-#endif
diff --git a/Source/WebCore/bindings/v8/DOMWrapperMap.h b/Source/WebCore/bindings/v8/DOMWrapperMap.h
new file mode 100644
index 000000000..b4c25d9e4
--- /dev/null
+++ b/Source/WebCore/bindings/v8/DOMWrapperMap.h
@@ -0,0 +1,125 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef DOMWrapperMap_h
+#define DOMWrapperMap_h
+
+#include "WebCoreMemoryInstrumentation.h"
+#include "WrapperTypeInfo.h"
+#include <v8.h>
+#include <wtf/HashMap.h>
+#include <wtf/MemoryInstrumentationHashMap.h>
+
+namespace WebCore {
+
+class DOMDataStore;
+
+template<class KeyType>
+class DOMWrapperMap {
+public:
+    virtual ~DOMWrapperMap() { }
+
+    virtual v8::Persistent<v8::Object> get(KeyType*) = 0;
+    virtual void set(KeyType*, v8::Persistent<v8::Object>) = 0;
+    virtual void clear() = 0;
+
+    virtual void reportMemoryUsage(MemoryObjectInfo*) const = 0;
+};
+
+template<class KeyType>
+class DOMWrapperHashMap : public DOMWrapperMap<KeyType> {
+public:
+    typedef HashMap<KeyType*, v8::Persistent<v8::Object> > MapType;
+
+    explicit DOMWrapperHashMap(v8::WeakReferenceCallback callback = &defaultWeakCallback)
+        : m_callback(callback)
+    {
+    }
+
+    virtual v8::Persistent<v8::Object> get(KeyType* key) OVERRIDE
+    {
+        return m_map.get(key);
+    }
+
+    virtual void set(KeyType* key, v8::Persistent<v8::Object> wrapper) OVERRIDE
+    {
+        ASSERT(!m_map.contains(key));
+        ASSERT(static_cast<KeyType*>(toNative(wrapper)) == key);
+        wrapper.MakeWeak(this, m_callback);
+        m_map.set(key, wrapper);
+    }
+
+    virtual void clear() OVERRIDE
+    {
+        for (typename MapType::iterator it = m_map.begin(); it != m_map.end(); ++it) {
+            v8::Persistent<v8::Object> wrapper = it->value;
+            toWrapperTypeInfo(wrapper)->derefObject(it->key);
+            wrapper.Dispose();
+            wrapper.Clear();
+        }
+        m_map.clear();
+    }
+
+    virtual void reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const OVERRIDE
+    {
+        MemoryClassInfo info(memoryObjectInfo, this, WebCoreMemoryTypes::Binding);
+        info.addMember(m_map);
+    }
+
+    virtual void remove(KeyType* key, v8::Persistent<v8::Object> wrapper)
+    {
+        typename MapType::iterator it = m_map.find(key);
+        ASSERT(it != m_map.end());
+        ASSERT(it->value == wrapper);
+        m_map.remove(it);
+    }
+
+private:
+    static void defaultWeakCallback(v8::Persistent<v8::Value> value, void* context)
+    {
+        DOMWrapperHashMap<KeyType>* map = static_cast<DOMWrapperHashMap<KeyType>*>(context);
+        ASSERT(value->IsObject());
+        v8::Persistent<v8::Object> wrapper = v8::Persistent<v8::Object>::Cast(value);
+        WrapperTypeInfo* type = toWrapperTypeInfo(wrapper);
+        KeyType* key = static_cast<KeyType*>(toNative(wrapper));
+
+        map->remove(key, wrapper);
+        wrapper.Dispose();
+        wrapper.Clear();
+        type->derefObject(key);
+    }
+
+    v8::WeakReferenceCallback m_callback;
+    MapType m_map;
+};
+
+} // namespace WebCore
+
+#endif // DOMWrapperMap_h
diff --git a/Source/WebCore/bindings/v8/DOMWrapperWorld.cpp b/Source/WebCore/bindings/v8/DOMWrapperWorld.cpp
index 6df0b72d5..0b9f055b6 100644
--- a/Source/WebCore/bindings/v8/DOMWrapperWorld.cpp
+++ b/Source/WebCore/bindings/v8/DOMWrapperWorld.cpp
@@ -143,4 +143,35 @@ void DOMWrapperWorld::clearIsolatedWorldSecurityOrigin(int worldID)
     isolatedWorldSecurityOrigins().remove(worldID);
 }
 
+typedef HashMap<int, bool> IsolatedWorldContentSecurityPolicyMap;
+static IsolatedWorldContentSecurityPolicyMap& isolatedWorldContentSecurityPolicies()
+{
+    ASSERT(isMainThread());
+    DEFINE_STATIC_LOCAL(IsolatedWorldContentSecurityPolicyMap, map, ());
+    return map;
+}
+
+bool DOMWrapperWorld::isolatedWorldHasContentSecurityPolicy()
+{
+    ASSERT(this->isIsolatedWorld());
+    IsolatedWorldContentSecurityPolicyMap& policies = isolatedWorldContentSecurityPolicies();
+    IsolatedWorldContentSecurityPolicyMap::iterator it = policies.find(worldId());
+    return it == policies.end() ? false : it->value;
+}
+
+void DOMWrapperWorld::setIsolatedWorldContentSecurityPolicy(int worldID, const String& policy)
+{
+    ASSERT(DOMWrapperWorld::isIsolatedWorldId(worldID));
+    if (!policy.isEmpty())
+        isolatedWorldContentSecurityPolicies().set(worldID, true);
+    else
+        isolatedWorldContentSecurityPolicies().remove(worldID);
+}
+
+void DOMWrapperWorld::clearIsolatedWorldContentSecurityPolicy(int worldID)
+{
+    ASSERT(DOMWrapperWorld::isIsolatedWorldId(worldID));
+    isolatedWorldContentSecurityPolicies().remove(worldID);
+}
+
 } // namespace WebCore
diff --git a/Source/WebCore/bindings/v8/DOMWrapperWorld.h b/Source/WebCore/bindings/v8/DOMWrapperWorld.h
index adf124ec2..68ee6e9cf 100644
--- a/Source/WebCore/bindings/v8/DOMWrapperWorld.h
+++ b/Source/WebCore/bindings/v8/DOMWrapperWorld.h
@@ -33,9 +33,11 @@
 
 #include "DOMDataStore.h"
 #include "SecurityOrigin.h"
+#include "V8DOMMap.h"
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefCounted.h>
 #include <wtf/RefPtr.h>
+#include <wtf/text/WTFString.h>
 
 namespace WebCore {
 
@@ -56,6 +58,19 @@ public:
     static void setIsolatedWorldSecurityOrigin(int worldID, PassRefPtr<SecurityOrigin>);
     static void clearIsolatedWorldSecurityOrigin(int worldID);
     SecurityOrigin* isolatedWorldSecurityOrigin();
+
+    // Associated an isolated world with a Content Security Policy. Resources
+    // embedded into the main world's DOM from script executed in an isolated
+    // world should be restricted based on the isolated world's DOM, not the
+    // main world's.
+    //
+    // FIXME: Right now, resource injection simply bypasses the main world's
+    // DOM. More work is necessary to allow the isolated world's policy to be
+    // applied correctly.
+    static void setIsolatedWorldContentSecurityPolicy(int worldID, const String& policy);
+    static void clearIsolatedWorldContentSecurityPolicy(int worldID);
+    bool isolatedWorldHasContentSecurityPolicy();
+
     // FIXME: this is a workaround for a problem in WebViewImpl.
     // Do not use this anywhere else!!
     static PassRefPtr<DOMWrapperWorld> createUninitializedWorld();
@@ -67,7 +82,7 @@ public:
     DOMDataStore* domDataStore() const
     {
         ASSERT(m_worldId != uninitializedWorldId);
-        return m_domDataStore.getStore();
+        return m_domDataStore.get();
     }
     void deref()
     {
@@ -79,19 +94,18 @@ private:
     static int isolatedWorldCount;
     static PassRefPtr<DOMWrapperWorld> createMainWorld();
     static void deallocate(DOMWrapperWorld*);
+
     DOMWrapperWorld(int worldId, int extensionGroup)
         : m_worldId(worldId)
         , m_extensionGroup(extensionGroup)
-        , m_domDataStore(worldId != uninitializedWorldId)
     {
+        if (worldId != uninitializedWorldId)
+            m_domDataStore = adoptPtr(new DOMDataStore(DOMDataStore::IsolatedWorld));
     }
 
     const int m_worldId;
     const int m_extensionGroup;
-    // The backing store for the isolated world's DOM wrappers. This class
-    // doesn't have visibility into the wrappers. This handle simply helps
-    // manage their lifetime.
-    DOMDataStoreHandle m_domDataStore;
+    OwnPtr<DOMDataStore> m_domDataStore;
 
     friend DOMWrapperWorld* mainThreadNormalWorld();
 };
diff --git a/Source/WebCore/bindings/v8/IDBBindingUtilities.cpp b/Source/WebCore/bindings/v8/IDBBindingUtilities.cpp
index 6a8311fb6..01e7e37e1 100644
--- a/Source/WebCore/bindings/v8/IDBBindingUtilities.cpp
+++ b/Source/WebCore/bindings/v8/IDBBindingUtilities.cpp
@@ -179,10 +179,9 @@ static PassRefPtr<IDBKey> createIDBKeyFromScriptValueAndKeyPath(const ScriptValu
     IDBKeyPathParseError error;
     IDBParseKeyPath(keyPath, keyPathElements, error);
     ASSERT(error == IDBKeyPathParseErrorNone);
+    ASSERT(v8::Context::InContext());
 
     v8::HandleScope handleScope;
-    v8::Context::Scope scope(V8PerIsolateData::current()->ensureAuxiliaryContext());
-
     v8::Handle<v8::Value> v8Value(value.v8Value());
     v8::Handle<v8::Value> v8Key(getNthValueOnKeyPath(v8Value, keyPathElements, keyPathElements.size()));
     if (v8Key.IsEmpty())
@@ -194,8 +193,10 @@ PassRefPtr<IDBKey> createIDBKeyFromScriptValueAndKeyPath(const ScriptValue& valu
 {
     IDB_TRACE("createIDBKeyFromScriptValueAndKeyPath");
     ASSERT(!keyPath.isNull());
+    ASSERT(v8::Context::InContext());
+
 
-    v8::HandleScope scope;
+    v8::HandleScope handleScope;
     if (keyPath.type() == IDBKeyPath::ArrayType) {
         IDBKey::KeyArray result;
         const Vector<String>& array = keyPath.array();
@@ -212,11 +213,10 @@ PassRefPtr<IDBKey> createIDBKeyFromScriptValueAndKeyPath(const ScriptValue& valu
     return createIDBKeyFromScriptValueAndKeyPath(value, keyPath.string());
 }
 
-// FIXME: The only reason this exists is because we need a v8::Context and scope inside a timer. Is there a better / more general way to do this?
 ScriptValue deserializeIDBValue(ScriptExecutionContext* scriptContext, PassRefPtr<SerializedScriptValue> prpValue)
 {
+    ASSERT(v8::Context::InContext());
     v8::HandleScope handleScope;
-    v8::Context::Scope contextScope(toV8Context(scriptContext, UseCurrentWorld));
     RefPtr<SerializedScriptValue> serializedValue = prpValue;
     if (serializedValue)
         return ScriptValue(serializedValue->deserialize());
@@ -226,6 +226,7 @@ ScriptValue deserializeIDBValue(ScriptExecutionContext* scriptContext, PassRefPt
 bool injectIDBKeyIntoScriptValue(PassRefPtr<IDBKey> key, ScriptValue& value, const IDBKeyPath& keyPath)
 {
     IDB_TRACE("injectIDBKeyIntoScriptValue");
+    ASSERT(v8::Context::InContext());
 
     ASSERT(keyPath.type() == IDBKeyPath::StringType);
     Vector<String> keyPathElements;
@@ -237,8 +238,6 @@ bool injectIDBKeyIntoScriptValue(PassRefPtr<IDBKey> key, ScriptValue& value, con
         return 0;
 
     v8::HandleScope handleScope;
-    v8::Context::Scope scope(V8PerIsolateData::current()->ensureAuxiliaryContext());
-
     v8::Handle<v8::Value> v8Value(value.v8Value());
     v8::Handle<v8::Value> parent(ensureNthValueOnKeyPath(v8Value, keyPathElements, keyPathElements.size() - 1));
     if (parent.IsEmpty())
@@ -266,6 +265,14 @@ bool canInjectIDBKeyIntoScriptValue(const ScriptValue& scriptValue, const IDBKey
     return canInjectNthValueOnKeyPath(v8Value, keyPathElements, keyPathElements.size() - 1);
 }
 
+ScriptValue idbKeyToScriptValue(ScriptExecutionContext* scriptContext, PassRefPtr<IDBKey> key)
+{
+    ASSERT(v8::Context::InContext());
+    v8::HandleScope handleScope;
+    v8::Handle<v8::Value> v8Value(toV8(key.get()));
+    return ScriptValue(v8Value);
+}
+
 } // namespace WebCore
 
 #endif
diff --git a/Source/WebCore/bindings/v8/IDBBindingUtilities.h b/Source/WebCore/bindings/v8/IDBBindingUtilities.h
index a482dc974..f766056df 100644
--- a/Source/WebCore/bindings/v8/IDBBindingUtilities.h
+++ b/Source/WebCore/bindings/v8/IDBBindingUtilities.h
@@ -44,6 +44,7 @@ bool injectIDBKeyIntoScriptValue(PassRefPtr<IDBKey>, ScriptValue&, const IDBKeyP
 PassRefPtr<IDBKey> createIDBKeyFromScriptValueAndKeyPath(const ScriptValue&, const IDBKeyPath&);
 bool canInjectIDBKeyIntoScriptValue(const ScriptValue&, const IDBKeyPath&);
 ScriptValue deserializeIDBValue(ScriptExecutionContext*, PassRefPtr<SerializedScriptValue>);
+ScriptValue idbKeyToScriptValue(ScriptExecutionContext*, PassRefPtr<IDBKey>);
 
 }
 
diff --git a/Source/WebCore/bindings/v8/IntrusiveDOMWrapperMap.h b/Source/WebCore/bindings/v8/IntrusiveDOMWrapperMap.h
index ae20d0369..12246b675 100644
--- a/Source/WebCore/bindings/v8/IntrusiveDOMWrapperMap.h
+++ b/Source/WebCore/bindings/v8/IntrusiveDOMWrapperMap.h
@@ -31,199 +31,48 @@
 #ifndef IntrusiveDOMWrapperMap_h
 #define IntrusiveDOMWrapperMap_h
 
-#include "DOMDataStore.h"
-#include "V8Node.h"
-#include "WebCoreMemoryInstrumentation.h"
+#include "DOMWrapperMap.h"
 
 namespace WebCore {
 
-template <class T, int CHUNK_SIZE, class Traits>
-class ChunkedTable {
-  public:
-    ChunkedTable() : m_chunks(0), m_current(0), m_last(0) { }
-
-    T* add(T element)
-    {
-        if (m_current == m_last) {
-            m_chunks = new Chunk(m_chunks);
-            m_current = m_chunks->m_entries;
-            m_last = m_current + CHUNK_SIZE;
-        }
-        ASSERT((m_chunks->m_entries <= m_current) && (m_current < m_last));
-        T* p = m_current++;
-        *p = element;
-        return p;
-    }
-
-    void remove(T* element)
-    {
-        ASSERT(element);
-        ASSERT(m_current > m_chunks->m_entries);
-        m_current--;
-        if (element != m_current)
-            Traits::move(element, m_current);
-        if (m_current == m_chunks->m_entries) {
-            Chunk* toDelete = m_chunks;
-            m_chunks = toDelete->m_previous;
-            m_current = m_last = m_chunks ? m_chunks->m_entries + CHUNK_SIZE : 0;
-            delete toDelete;
-        }
-        ASSERT(!m_chunks || ((m_chunks->m_entries < m_current) && (m_current <= m_last)));
-    }
-
-    void clear()
-    {
-        if (!m_chunks)
-            return;
-
-        clearEntries(m_chunks->m_entries, m_current);
-        Chunk* last = m_chunks;
-        while (true) {
-            Chunk* previous = last->m_previous;
-            if (!previous)
-                break;
-            delete last;
-            clearEntries(previous->m_entries, previous->m_entries + CHUNK_SIZE);
-            last = previous;
-        }
-
-        m_chunks = last;
-        m_current = m_chunks->m_entries;
-        m_last = m_current + CHUNK_SIZE;
-    }
-
-    void visit(DOMDataStore* store, typename Traits::Visitor* visitor)
-    {
-        if (!m_chunks)
-            return;
-
-        visitEntries(store, m_chunks->m_entries, m_current, visitor);
-        for (Chunk* chunk = m_chunks->m_previous; chunk; chunk = chunk->m_previous)
-            visitEntries(store, chunk->m_entries, chunk->m_entries + CHUNK_SIZE, visitor);
-    }
-
-    void reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
-    {
-        MemoryClassInfo info(memoryObjectInfo, this, WebCoreMemoryTypes::Binding);
-        for (Chunk* chunk = m_chunks; chunk; chunk = chunk->m_previous)
-            info.addMember(chunk);
-    }
-
-  private:
-    struct Chunk {
-        explicit Chunk(Chunk* previous) : m_previous(previous) { }
-        Chunk* const m_previous;
-        T m_entries[CHUNK_SIZE];
-    };
-
-    static void clearEntries(T* first, T* last)
-    {
-        for (T* entry = first; entry < last; entry++)
-            Traits::clear(entry);
-    }
-
-    static void visitEntries(DOMDataStore* store, T* first, T* last, typename Traits::Visitor* visitor)
-    {
-        for (T* entry = first; entry < last; entry++)
-            Traits::visit(store, entry, visitor);
-    }
-
-    Chunk* m_chunks;
-    T* m_current;
-    T* m_last;
-};
-
-
-class IntrusiveDOMWrapperMap : public AbstractWeakReferenceMap<Node, v8::Object> {
+template<class KeyType>
+class IntrusiveDOMWrapperMap : public DOMWrapperMap<KeyType> {
 public:
-    IntrusiveDOMWrapperMap(v8::WeakReferenceCallback callback)
-        : AbstractWeakReferenceMap<Node, v8::Object>(callback) { }
-
-    virtual v8::Persistent<v8::Object> get(Node* obj)
+    virtual v8::Persistent<v8::Object> get(KeyType* key) OVERRIDE
     {
-        v8::Persistent<v8::Object>* wrapper = obj->wrapper();
-        return wrapper ? *wrapper : v8::Persistent<v8::Object>();
+        return key->wrapper();
     }
 
-    virtual void set(Node* obj, v8::Persistent<v8::Object> wrapper)
+    virtual void set(KeyType* key, v8::Persistent<v8::Object> wrapper) OVERRIDE
     {
-        ASSERT(obj);
-        ASSERT(!obj->wrapper());
-        v8::Persistent<v8::Object>* entry = m_table.add(wrapper);
-        obj->setWrapper(entry);
-        wrapper.MakeWeak(obj, weakReferenceCallback());
+        ASSERT(key && key->wrapper().IsEmpty());
+        key->setWrapper(wrapper);
+        wrapper.MakeWeak(key, weakCallback);
     }
 
-    virtual bool contains(Node* obj)
+    virtual void clear() OVERRIDE
     {
-        return obj->wrapper();
-    }
-
-    virtual void visit(DOMDataStore* store, Visitor* visitor)
-    {
-        m_table.visit(store, visitor);
-    }
-
-    virtual bool removeIfPresent(Node* obj, v8::Persistent<v8::Object> value)
-    {
-        ASSERT(obj);
-        v8::Persistent<v8::Object>* entry = obj->wrapper();
-        if (!entry)
-            return false;
-        if (*entry != value)
-            return false;
-        obj->clearWrapper();
-        m_table.remove(entry);
-        value.Dispose();
-        return true;
-    }
-
-
-    virtual void clear()
-    {
-        m_table.clear();
+        ASSERT_NOT_REACHED();
     }
 
     virtual void reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const OVERRIDE
     {
         MemoryClassInfo info(memoryObjectInfo, this, WebCoreMemoryTypes::Binding);
-        info.addMember(m_table);
+        UNUSED_PARAM(info);
     }
 
 private:
-    static int const numberOfEntries = (1 << 10) - 1;
-
-    struct ChunkedTableTraits {
-        typedef IntrusiveDOMWrapperMap::Visitor Visitor;
-
-        static void move(v8::Persistent<v8::Object>* target, v8::Persistent<v8::Object>* source)
-        {
-            *target = *source;
-            Node* node = V8Node::toNative(*target);
-            ASSERT(node);
-            node->setWrapper(target);
-        }
-
-        static void clear(v8::Persistent<v8::Object>* entry)
-        {
-            Node* node = V8Node::toNative(*entry);
-            ASSERT(node->wrapper() == entry);
-
-            node->clearWrapper();
-            entry->Dispose();
-        }
-
-        static void visit(DOMDataStore* store, v8::Persistent<v8::Object>* entry, Visitor* visitor)
-        {
-            Node* node = V8Node::toNative(*entry);
-            ASSERT(node->wrapper() == entry);
-
-            visitor->visitDOMWrapper(store, node, *entry);
-        }
-    };
+    static void weakCallback(v8::Persistent<v8::Value> value, void* context)
+    {
+        KeyType* key = static_cast<KeyType*>(context);
+        ASSERT(value->IsObject());
+        ASSERT(key->wrapper() == v8::Persistent<v8::Object>::Cast(value));
 
-    typedef ChunkedTable<v8::Persistent<v8::Object>, numberOfEntries, ChunkedTableTraits> Table;
-    Table m_table;
+        key->clearWrapper();
+        value.Dispose();
+        value.Clear();
+        key->deref();
+    }
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/bindings/v8/NPV8Object.cpp b/Source/WebCore/bindings/v8/NPV8Object.cpp
index e65896417..9cf9e5fad 100644
--- a/Source/WebCore/bindings/v8/NPV8Object.cpp
+++ b/Source/WebCore/bindings/v8/NPV8Object.cpp
@@ -92,6 +92,7 @@ static void freeV8NPObject(NPObject* npObject)
             v8NPObjectMap->remove(v8ObjectHash);
     }
     v8NpObject->v8Object.Dispose();
+    v8NpObject->v8Object.Clear();
     free(v8NpObject);
 }
 
diff --git a/Source/WebCore/bindings/v8/ScheduledAction.cpp b/Source/WebCore/bindings/v8/ScheduledAction.cpp
index 965144f8f..81c586e51 100644
--- a/Source/WebCore/bindings/v8/ScheduledAction.cpp
+++ b/Source/WebCore/bindings/v8/ScheduledAction.cpp
@@ -62,8 +62,10 @@ ScheduledAction::ScheduledAction(v8::Handle<v8::Context> context, v8::Handle<v8:
 
 ScheduledAction::~ScheduledAction()
 {
-    for (size_t i = 0; i < m_args.size(); ++i)
+    for (size_t i = 0; i < m_args.size(); ++i) {
         m_args[i].Dispose();
+        m_args[i].Clear();
+    }
 }
 
 void ScheduledAction::execute(ScriptExecutionContext* context)
diff --git a/Source/WebCore/bindings/v8/ScriptController.cpp b/Source/WebCore/bindings/v8/ScriptController.cpp
index b2a9b96a9..fcb1f5348 100644
--- a/Source/WebCore/bindings/v8/ScriptController.cpp
+++ b/Source/WebCore/bindings/v8/ScriptController.cpp
@@ -40,6 +40,7 @@
 #include "EventNames.h"
 #include "Frame.h"
 #include "FrameLoaderClient.h"
+#include "HistogramSupport.h"
 #include "InspectorInstrumentation.h"
 #include "NPObjectWrapper.h"
 #include "NPV8Object.h"
@@ -65,6 +66,7 @@
 #include "V8NPObject.h"
 #include "V8RecursionScope.h"
 #include "Widget.h"
+#include <wtf/CurrentTime.h>
 #include <wtf/StdLibExtras.h>
 #include <wtf/StringExtras.h>
 #include <wtf/text/CString.h>
@@ -142,27 +144,22 @@ void ScriptController::clearScriptObjects()
 #endif
 }
 
-void ScriptController::resetIsolatedWorlds()
+void ScriptController::reset()
 {
     for (IsolatedWorldMap::iterator iter = m_isolatedWorlds.begin();
          iter != m_isolatedWorlds.end(); ++iter) {
         iter->value->destroyIsolatedShell();
     }
     m_isolatedWorlds.clear();
+    V8GCController::hintForCollectGarbage();
 }
 
 void ScriptController::clearForClose()
 {
-    resetIsolatedWorlds();
-    V8GCController::hintForCollectGarbage();
+    double start = currentTime();
+    reset();
     windowShell()->clearForClose();
-}
-
-void ScriptController::clearForNavigation()
-{
-    resetIsolatedWorlds();
-    V8GCController::hintForCollectGarbage();
-    windowShell()->clearForNavigation();
+    HistogramSupport::histogramCustomCounts("WebCore.ScriptController.clearForClose", (currentTime() - start) * 1000, 0, 10000, 50);
 }
 
 void ScriptController::updateSecurityOrigin()
@@ -399,6 +396,13 @@ void ScriptController::evaluateInIsolatedWorld(int worldID, const Vector<ScriptS
     }
 }
 
+bool ScriptController::shouldBypassMainWorldContentSecurityPolicy()
+{
+    if (V8DOMWindowShell* isolatedWorldShell = V8DOMWindowShell::getEntered())
+        return isolatedWorldShell->world()->isolatedWorldHasContentSecurityPolicy();
+    return false;
+}
+
 TextPosition ScriptController::eventHandlerPosition() const
 {
     ScriptableDocumentParser* parser = m_frame->document()->scriptableDocumentParser();
@@ -634,10 +638,12 @@ NPObject* ScriptController::createScriptObjectForPluginElement(HTMLPlugInElement
 
 void ScriptController::clearWindowShell(DOMWindow*, bool)
 {
+    double start = currentTime();
+    reset();
     // V8 binding expects ScriptController::clearWindowShell only be called
-    // when a frame is loading a new page. ScriptController::clearForNavigation
-    // creates a new context for the new page.
-    clearForNavigation();
+    // when a frame is loading a new page. This creates a new context for the new page.
+    windowShell()->clearForNavigation();
+    HistogramSupport::histogramCustomCounts("WebCore.ScriptController.clearWindowShell", (currentTime() - start) * 1000, 0, 10000, 50);
 }
 
 #if ENABLE(INSPECTOR)
diff --git a/Source/WebCore/bindings/v8/ScriptController.h b/Source/WebCore/bindings/v8/ScriptController.h
index 5a1ff4578..840dc4caf 100644
--- a/Source/WebCore/bindings/v8/ScriptController.h
+++ b/Source/WebCore/bindings/v8/ScriptController.h
@@ -107,6 +107,11 @@ public:
     // FIXME: Get rid of extensionGroup here.
     void evaluateInIsolatedWorld(int worldID, const Vector<ScriptSourceCode>& sources, int extensionGroup, Vector<ScriptValue>* results);
 
+    // Returns true if the current world is isolated, and has its own Content
+    // Security Policy. In this case, the policy of the main world should be
+    // ignored when evaluating resources injected into the DOM.
+    bool shouldBypassMainWorldContentSecurityPolicy();
+
     // FIXME: Remove references to this call in chromium and delete it.
     inline static void setIsolatedWorldSecurityOrigin(int worldID, PassRefPtr<SecurityOrigin> origin)
     {
@@ -167,7 +172,6 @@ public:
     void updatePlatformScriptObjects();
     void cleanupScriptObjectsForPlugin(Widget*);
 
-    void clearForNavigation();
     void clearForClose();
 
     NPObject* createScriptObjectForPluginElement(HTMLPlugInElement*);
@@ -192,7 +196,7 @@ private:
     // call world->destroyIsolatedShell().
     typedef HashMap<int, V8DOMWindowShell*> IsolatedWorldMap;
 
-    void resetIsolatedWorlds();
+    void reset();
 
     Frame* m_frame;
     const String* m_sourceURL;
diff --git a/Source/WebCore/bindings/v8/ScriptGCEvent.cpp b/Source/WebCore/bindings/v8/ScriptGCEvent.cpp
index c18227de5..72309e7a6 100644
--- a/Source/WebCore/bindings/v8/ScriptGCEvent.cpp
+++ b/Source/WebCore/bindings/v8/ScriptGCEvent.cpp
@@ -76,7 +76,7 @@ void ScriptGCEvent::getHeapSize(HeapInfo& info)
     v8::HeapStatistics heapStatistics;
     v8::V8::GetHeapStatistics(&heapStatistics);
     info.usedJSHeapSize = heapStatistics.used_heap_size();
-    info.totalJSHeapSize = heapStatistics.total_heap_size();
+    info.totalJSHeapSize = heapStatistics.total_physical_size();
     info.jsHeapSizeLimit = heapStatistics.heap_size_limit();
 }
 
diff --git a/Source/WebCore/bindings/v8/ScriptProfiler.cpp b/Source/WebCore/bindings/v8/ScriptProfiler.cpp
index 0186839a7..c840f2281 100644
--- a/Source/WebCore/bindings/v8/ScriptProfiler.cpp
+++ b/Source/WebCore/bindings/v8/ScriptProfiler.cpp
@@ -165,7 +165,7 @@ PassRefPtr<ScriptHeapSnapshot> ScriptProfiler::takeHeapSnapshot(const String& ti
 
 static v8::RetainedObjectInfo* retainedDOMInfo(uint16_t classId, v8::Handle<v8::Value> wrapper)
 {
-    ASSERT(classId == v8DOMSubtreeClassId);
+    ASSERT(classId == v8DOMNodeClassId);
     if (!wrapper->IsObject())
         return 0;
     Node* node = V8Node::toNative(wrapper.As<v8::Object>());
@@ -174,23 +174,35 @@ static v8::RetainedObjectInfo* retainedDOMInfo(uint16_t classId, v8::Handle<v8::
 
 void ScriptProfiler::initialize()
 {
-    v8::HeapProfiler::DefineWrapperClass(v8DOMSubtreeClassId, &retainedDOMInfo);
+    v8::HeapProfiler::DefineWrapperClass(v8DOMNodeClassId, &retainedDOMInfo);
 }
 
-void ScriptProfiler::visitNodeWrappers(NodeWrapperVisitor* visitor)
+void ScriptProfiler::visitNodeWrappers(WrappedNodeVisitor* visitor)
 {
-    class VisitorAdapter : public DOMWrapperMap<Node>::Visitor {
+    v8::HandleScope scope;
+
+    class DOMNodeWrapperVisitor : public v8::PersistentHandleVisitor {
     public:
-        VisitorAdapter(NodeWrapperVisitor* visitor) : m_visitor(visitor) { }
+        explicit DOMNodeWrapperVisitor(WrappedNodeVisitor* visitor)
+            : m_visitor(visitor)
+        {
+        }
 
-        virtual void visitDOMWrapper(DOMDataStore*, Node* node, v8::Persistent<v8::Object>)
+        virtual void VisitPersistentHandle(v8::Persistent<v8::Value> value, uint16_t classId) OVERRIDE
         {
-            m_visitor->visitNode(node);
+            if (classId != v8DOMNodeClassId)
+                return;
+            ASSERT(V8Node::HasInstance(value));
+            ASSERT(value->IsObject());
+            v8::Persistent<v8::Object> wrapper = v8::Persistent<v8::Object>::Cast(value);
+            m_visitor->visitNode(V8Node::toNative(wrapper));
         }
+
     private:
-        NodeWrapperVisitor* m_visitor;
-    } adapter(visitor);
-    visitDOMNodes(&adapter);
+        WrappedNodeVisitor* m_visitor;
+    } wrapperVisitor(visitor);
+
+    v8::V8::VisitHandlesWithClassIds(&wrapperVisitor);
 }
 
 void ScriptProfiler::visitExternalStrings(ExternalStringVisitor* visitor)
@@ -200,24 +212,29 @@ void ScriptProfiler::visitExternalStrings(ExternalStringVisitor* visitor)
 
 void ScriptProfiler::visitExternalArrays(ExternalArrayVisitor* visitor)
 {
-    class VisitorAdapter : public DOMWrapperMap<void>::Visitor {
+    class DOMObjectWrapperVisitor : public v8::PersistentHandleVisitor {
     public:
-        VisitorAdapter(ExternalArrayVisitor* visitor) : m_visitor(visitor) { }
+        explicit DOMObjectWrapperVisitor(ExternalArrayVisitor* visitor)
+            : m_visitor(visitor)
+        {
+        }
 
-        virtual void visitDOMWrapper(DOMDataStore*, void* impl, v8::Persistent<v8::Object> v8Object)
+        virtual void VisitPersistentHandle(v8::Persistent<v8::Value> value, uint16_t classId) OVERRIDE
         {
-            WrapperTypeInfo* type = V8DOMWrapper::domWrapperType(v8Object);
-            if (!type->isSubclass(&V8ArrayBufferView::info))
+            if (classId != v8DOMObjectClassId)
                 return;
-            ArrayBufferView* arrayBufferView = V8ArrayBufferView::toNative(v8Object);
-            m_visitor->visitJSExternalArray(arrayBufferView);
+            ASSERT(value->IsObject());
+            v8::Persistent<v8::Object> wrapper = v8::Persistent<v8::Object>::Cast(value);
+            if (!V8DOMWrapper::domWrapperType(wrapper)->isSubclass(&V8ArrayBufferView::info))
+                return;
+            m_visitor->visitJSExternalArray(V8ArrayBufferView::toNative(wrapper));
         }
+
     private:
         ExternalArrayVisitor* m_visitor;
-    } adapter(visitor);
-
-    getDOMObjectMap().visit(0, &adapter);
+    } wrapperVisitor(visitor);
 
+    v8::V8::VisitHandlesWithClassIds(&wrapperVisitor);
 }
 
 void ScriptProfiler::collectBindingMemoryInfo(MemoryInstrumentation* instrumentation)
diff --git a/Source/WebCore/bindings/v8/ScriptProfiler.h b/Source/WebCore/bindings/v8/ScriptProfiler.h
index 76a4f2a48..f845941a8 100644
--- a/Source/WebCore/bindings/v8/ScriptProfiler.h
+++ b/Source/WebCore/bindings/v8/ScriptProfiler.h
@@ -43,7 +43,7 @@ namespace WebCore {
 
 class ExternalArrayVisitor;
 class ExternalStringVisitor;
-class NodeWrapperVisitor;
+class WrappedNodeVisitor;
 class Page;
 class ScriptObject;
 class ScriptValue;
@@ -79,7 +79,7 @@ public:
     static bool isSampling() { return true; }
     static bool hasHeapProfiler() { return true; }
     static void initialize();
-    static void visitNodeWrappers(NodeWrapperVisitor*);
+    static void visitNodeWrappers(WrappedNodeVisitor*);
     static void visitExternalStrings(ExternalStringVisitor*);
     static void visitExternalArrays(ExternalArrayVisitor*);
     static void collectBindingMemoryInfo(MemoryInstrumentation*);
diff --git a/Source/WebCore/bindings/v8/ScriptWrappable.h b/Source/WebCore/bindings/v8/ScriptWrappable.h
index 2915cc7c8..4b0df216c 100644
--- a/Source/WebCore/bindings/v8/ScriptWrappable.h
+++ b/Source/WebCore/bindings/v8/ScriptWrappable.h
@@ -38,29 +38,42 @@ namespace WebCore {
 
 class ScriptWrappable {
 public:
-    ScriptWrappable() : m_wrapper(0) { }
+    ScriptWrappable()
+    {
+    }
 
-    v8::Persistent<v8::Object>* wrapper() const
+    v8::Persistent<v8::Object> wrapper() const
     {
         return m_wrapper;
     }
 
-    void setWrapper(v8::Persistent<v8::Object>* wrapper)
+    void setWrapper(v8::Persistent<v8::Object> wrapper)
     {
-        ASSERT(wrapper);
+        ASSERT(!wrapper.IsEmpty());
         m_wrapper = wrapper;
     }
 
-    void clearWrapper() { m_wrapper = 0; }
+    void clearWrapper()
+    {
+        ASSERT(!m_wrapper.IsEmpty());
+        m_wrapper.Clear();
+    }
+
+    void disposeWrapper()
+    {
+        ASSERT(!m_wrapper.IsEmpty());
+        m_wrapper.Dispose();
+        m_wrapper.Clear();
+    }
 
     void reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
     {
         MemoryClassInfo info(memoryObjectInfo, this, WebCoreMemoryTypes::DOM);
-        info.addWeakPointer(m_wrapper);
+        info.addWeakPointer(const_cast<v8::Persistent<v8::Object>*>(&m_wrapper));
     }
 
 private:
-    v8::Persistent<v8::Object>* m_wrapper;
+    v8::Persistent<v8::Object> m_wrapper;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/bindings/v8/SerializedScriptValue.cpp b/Source/WebCore/bindings/v8/SerializedScriptValue.cpp
index 41731c142..5b6c39825 100644
--- a/Source/WebCore/bindings/v8/SerializedScriptValue.cpp
+++ b/Source/WebCore/bindings/v8/SerializedScriptValue.cpp
@@ -2206,13 +2206,14 @@ SerializedScriptValue::SerializedScriptValue()
 {
 }
 
-static void neuterBinding(void* domObject) 
+template<typename T>
+inline void neuterBinding(T* object) 
 {
-    DOMDataList& allStores = DOMDataStore::allStores();
+    Vector<DOMDataStore*>& allStores = V8PerIsolateData::current()->allStores();
     for (size_t i = 0; i < allStores.size(); i++) {
-        v8::Handle<v8::Object> obj = allStores[i]->domObjectMap().get(domObject);
-        if (!obj.IsEmpty())
-            obj->SetIndexedPropertiesToExternalArrayData(0, v8::kExternalByteArray, 0);
+        v8::Handle<v8::Object> wrapper = allStores[i]->domObjectMap().get(object);
+        if (!wrapper.IsEmpty())
+            wrapper->SetIndexedPropertiesToExternalArrayData(0, v8::kExternalByteArray, 0);
     }
 }
 
diff --git a/Source/WebCore/bindings/v8/StaticDOMDataStore.cpp b/Source/WebCore/bindings/v8/StaticDOMDataStore.cpp
deleted file mode 100644
index 5d9d09ce1..000000000
--- a/Source/WebCore/bindings/v8/StaticDOMDataStore.cpp
+++ /dev/null
@@ -1,67 +0,0 @@
-/*
- * Copyright (C) 2009 Google Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions are
- * met:
- *
- *     * Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- *     * Redistributions in binary form must reproduce the above
- * copyright notice, this list of conditions and the following disclaimer
- * in the documentation and/or other materials provided with the
- * distribution.
- *     * Neither the name of Google Inc. nor the names of its
- * contributors may be used to endorse or promote products derived from
- * this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
- * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "config.h"
-#include "StaticDOMDataStore.h"
-#include "V8Binding.h"
-#include "WebCoreMemoryInstrumentation.h"
-
-namespace WebCore {
-
-StaticDOMDataStore::StaticDOMDataStore()
-    : DOMDataStore()
-    , m_staticDomNodeMap(&DOMDataStore::weakNodeCallback)
-    , m_staticActiveDomNodeMap(&DOMDataStore::weakNodeCallback)
-    , m_staticDomObjectMap(&DOMDataStore::weakDOMObjectCallback)
-    , m_staticActiveDomObjectMap(&DOMDataStore::weakActiveDOMObjectCallback)
-{
-    m_domNodeMap = &m_staticDomNodeMap;
-    m_activeDomNodeMap = &m_staticActiveDomNodeMap;
-    m_domObjectMap = &m_staticDomObjectMap;
-    m_activeDomObjectMap = &m_staticActiveDomObjectMap;
-    V8PerIsolateData::current()->registerDOMDataStore(this);
-}
-
-StaticDOMDataStore::~StaticDOMDataStore()
-{
-    V8PerIsolateData::current()->unregisterDOMDataStore(this);
-}
-
-void StaticDOMDataStore::reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
-{
-    MemoryClassInfo info(memoryObjectInfo, this, WebCoreMemoryTypes::Binding);
-    DOMDataStore::reportMemoryUsage(memoryObjectInfo);
-    info.addMember(m_staticDomNodeMap);
-    info.addMember(m_staticActiveDomNodeMap);
-    info.addMember(m_staticDomObjectMap);
-    info.addMember(m_staticActiveDomObjectMap);
-}
-
-} // namespace WebCore
diff --git a/Source/WebCore/bindings/v8/V8Binding.cpp b/Source/WebCore/bindings/v8/V8Binding.cpp
index a2d5df4f5..7c35d45b4 100644
--- a/Source/WebCore/bindings/v8/V8Binding.cpp
+++ b/Source/WebCore/bindings/v8/V8Binding.cpp
@@ -61,6 +61,14 @@
 #include <wtf/text/StringHash.h>
 #include <wtf/text/WTFString.h>
 
+namespace WTF {
+
+template<> struct SequenceMemoryInstrumentationTraits<v8::String*> {
+    template <typename I> static void reportMemoryUsage(I, I, MemoryClassInfo&) { }
+};
+
+}
+
 namespace WebCore {
 
 v8::Handle<v8::Value> setDOMException(int exceptionCode, v8::Isolate* isolate)
diff --git a/Source/WebCore/bindings/v8/V8DOMMap.cpp b/Source/WebCore/bindings/v8/V8DOMMap.cpp
index 751642fae..34337e096 100644
--- a/Source/WebCore/bindings/v8/V8DOMMap.cpp
+++ b/Source/WebCore/bindings/v8/V8DOMMap.cpp
@@ -31,105 +31,25 @@
 #include "config.h"
 #include "V8DOMMap.h"
 
-#include "DOMData.h"
 #include "DOMDataStore.h"
-#include "ScopedDOMDataStore.h"
 #include "V8Binding.h"
+#include "V8Node.h"
 #include <wtf/MainThread.h>
 
 namespace WebCore {
 
-DOMDataStoreHandle::DOMDataStoreHandle(bool initialize)
-    : m_store(adoptPtr(!initialize ? 0 : new ScopedDOMDataStore()))
+DOMWrapperMap<Node>& getDOMNodeMap(v8::Isolate* isolate)
 {
-    if (m_store)
-        V8PerIsolateData::current()->registerDOMDataStore(m_store.get());
-}
-
-DOMDataStoreHandle::~DOMDataStoreHandle()
-{
-    if (m_store)
-        V8PerIsolateData::current()->unregisterDOMDataStore(m_store.get());
-}
-
-DOMNodeMapping& getDOMNodeMap(v8::Isolate* isolate)
-{
-    return DOMData::getCurrentStore(isolate).domNodeMap();
-}
-
-DOMNodeMapping& getActiveDOMNodeMap(v8::Isolate* isolate)
-{
-    return DOMData::getCurrentStore(isolate).activeDomNodeMap();
+    if (!isolate)
+        isolate = v8::Isolate::GetCurrent();
+    return DOMDataStore::current(isolate)->domNodeMap();
 }
 
 DOMWrapperMap<void>& getDOMObjectMap(v8::Isolate* isolate)
 {
-    return DOMData::getCurrentStore(isolate).domObjectMap();
-}
-
-DOMWrapperMap<void>& getActiveDOMObjectMap(v8::Isolate* isolate)
-{
-    return DOMData::getCurrentStore(isolate).activeDomObjectMap();
-}
-
-void removeAllDOMObjects()
-{
-    DOMDataStore& store = DOMData::getCurrentStore();
-
-    v8::HandleScope scope;
-    ASSERT(!isMainThread());
-
-    // Note: We skip the Node wrapper maps because they exist only on the main thread.
-    DOMData::removeObjectsFromWrapperMap<void>(&store, store.domObjectMap());
-    DOMData::removeObjectsFromWrapperMap<void>(&store, store.activeDomObjectMap());
-}
-
-void visitDOMNodes(DOMWrapperMap<Node>::Visitor* visitor)
-{
-    v8::HandleScope scope;
-
-    DOMDataList& list = DOMDataStore::allStores();
-    for (size_t i = 0; i < list.size(); ++i) {
-        DOMDataStore* store = list[i];
-
-        store->domNodeMap().visit(store, visitor);
-    }
-}
-
-void visitActiveDOMNodes(DOMWrapperMap<Node>::Visitor* visitor)
-{
-    v8::HandleScope scope;
-
-    DOMDataList& list = DOMDataStore::allStores();
-    for (size_t i = 0; i < list.size(); ++i) {
-        DOMDataStore* store = list[i];
-
-        store->activeDomNodeMap().visit(store, visitor);
-    }
-}
-
-void visitDOMObjects(DOMWrapperMap<void>::Visitor* visitor)
-{
-    v8::HandleScope scope;
-
-    DOMDataList& list = DOMDataStore::allStores();
-    for (size_t i = 0; i < list.size(); ++i) {
-        DOMDataStore* store = list[i];
-
-        store->domObjectMap().visit(store, visitor);
-    }
-}
-
-void visitActiveDOMObjects(DOMWrapperMap<void>::Visitor* visitor)
-{
-    v8::HandleScope scope;
-
-    DOMDataList& list = DOMDataStore::allStores();
-    for (size_t i = 0; i < list.size(); ++i) {
-        DOMDataStore* store = list[i];
-
-        store->activeDomObjectMap().visit(store, visitor);
-    }
+    if (!isolate)
+        isolate = v8::Isolate::GetCurrent();
+    return DOMDataStore::current(isolate)->domObjectMap();
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/bindings/v8/V8DOMMap.h b/Source/WebCore/bindings/v8/V8DOMMap.h
index ca45dfdc3..d8c7d289e 100644
--- a/Source/WebCore/bindings/v8/V8DOMMap.h
+++ b/Source/WebCore/bindings/v8/V8DOMMap.h
@@ -31,6 +31,7 @@
 #ifndef V8DOMMap_h
 #define V8DOMMap_h
 
+#include "DOMWrapperMap.h"
 #include "Node.h"
 #include "WebCoreMemoryInstrumentation.h"
 #include <wtf/Forward.h>
@@ -40,144 +41,9 @@
 #include <v8.h>
 
 namespace WebCore {
-    class DOMDataStore;
 
-    template <class KeyType, class ValueType> class AbstractWeakReferenceMap {
-    public:
-        AbstractWeakReferenceMap(v8::WeakReferenceCallback callback) : m_weakReferenceCallback(callback) { }
-        virtual ~AbstractWeakReferenceMap() { }
-
-        class Visitor {
-        public:
-            virtual void startMap() { }
-            virtual void endMap() { }
-            virtual void visitDOMWrapper(DOMDataStore* store, KeyType* key, v8::Persistent<ValueType> object) = 0;
-        protected:
-            virtual ~Visitor() { }
-        };
-
-        virtual v8::Persistent<ValueType> get(KeyType* obj) = 0;
-        virtual void set(KeyType* obj, v8::Persistent<ValueType> wrapper) = 0;
-        virtual bool contains(KeyType* obj) = 0;
-        virtual void visit(DOMDataStore* store, Visitor* visitor) = 0;
-        virtual bool removeIfPresent(KeyType*, v8::Persistent<ValueType>) = 0;
-        virtual void clear() = 0;
-
-        v8::WeakReferenceCallback weakReferenceCallback() { return m_weakReferenceCallback; }
-
-        virtual void reportMemoryUsage(MemoryObjectInfo*) const = 0;
-
-    private:
-        v8::WeakReferenceCallback m_weakReferenceCallback;
-    };
-
-    typedef AbstractWeakReferenceMap<Node, v8::Object> DOMNodeMapping;
-
-    // A table of wrappers with weak pointers.
-    // This table allows us to avoid track wrapped objects for debugging
-    // and for ensuring that we don't double wrap the same object.
-    template<class KeyType, class ValueType> class WeakReferenceMap : public AbstractWeakReferenceMap<KeyType, ValueType> {
-    public:
-        typedef AbstractWeakReferenceMap<KeyType, ValueType> Parent;
-        WeakReferenceMap(v8::WeakReferenceCallback callback) : Parent(callback) { }
-        virtual ~WeakReferenceMap() { }
-
-        // Get the JS wrapper object of an object.
-        virtual v8::Persistent<ValueType> get(KeyType* obj)
-        {
-            ValueType* wrapper = m_map.get(obj);
-            return wrapper ? v8::Persistent<ValueType>(wrapper) : v8::Persistent<ValueType>();
-        }
-
-        virtual void set(KeyType* obj, v8::Persistent<ValueType> wrapper)
-        {
-            ASSERT(!m_map.contains(obj));
-            wrapper.MakeWeak(obj, Parent::weakReferenceCallback());
-            m_map.set(obj, *wrapper);
-        }
-
-        virtual void forget(KeyType* obj)
-        {
-            ASSERT(obj);
-            ValueType* wrapper = m_map.take(obj);
-            if (!wrapper)
-                return;
-
-            v8::Persistent<ValueType> handle(wrapper);
-            handle.Dispose();
-            handle.Clear();
-        }
-
-        bool removeIfPresent(KeyType* key, v8::Persistent<ValueType> value)
-        {
-            typename HashMap<KeyType*, ValueType*>::iterator it = m_map.find(key);
-            if (it == m_map.end() || it->value != *value)
-                return false;
-
-            m_map.remove(it);
-            value.Dispose();
-            return true;
-        }
-
-        void clear()
-        {
-            m_map.clear();
-        }
-
-        bool contains(KeyType* obj) { return m_map.contains(obj); }
-
-        virtual void visit(DOMDataStore* store, typename Parent::Visitor* visitor)
-        {
-            visitor->startMap();
-            typename HashMap<KeyType*, ValueType*>::iterator it = m_map.begin();
-            for (; it != m_map.end(); ++it)
-                visitor->visitDOMWrapper(store, it->key, v8::Persistent<ValueType>(it->value));
-            visitor->endMap();
-        }
-
-        virtual void reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const OVERRIDE
-        {
-            MemoryClassInfo info(memoryObjectInfo, this, WebCoreMemoryTypes::Binding);
-            info.addMember(m_map);
-        }
-
-    protected:
-        HashMap<KeyType*, ValueType*> m_map;
-    };
-
-    template <class KeyType> class DOMWrapperMap : public WeakReferenceMap<KeyType, v8::Object> {
-    public:
-        DOMWrapperMap(v8::WeakReferenceCallback callback) : WeakReferenceMap<KeyType, v8::Object>(callback) { }
-    };
-
-    // A utility class to manage the lifetime of set of DOM wrappers.
-    class DOMDataStoreHandle {
-    public:
-        DOMDataStoreHandle(bool initialize);
-        ~DOMDataStoreHandle();
-
-        DOMDataStore* getStore() const { return m_store.get(); }
-
-    private:
-        OwnPtr<DOMDataStore> m_store;
-    };
-
-    // A map from DOM node to its JS wrapper.
-    DOMNodeMapping& getDOMNodeMap(v8::Isolate* = 0);
-    DOMNodeMapping& getActiveDOMNodeMap(v8::Isolate* = 0);
-    void visitDOMNodes(DOMWrapperMap<Node>::Visitor*);
-    void visitActiveDOMNodes(DOMWrapperMap<Node>::Visitor*);
-
-    // A map from a DOM object (non-node) to its JS wrapper. This map does not contain the DOM objects which can have pending activity (active dom objects).
-    DOMWrapperMap<void>& getDOMObjectMap(v8::Isolate* = 0);
-    void visitDOMObjects(DOMWrapperMap<void>::Visitor*);
-
-    // A map from a DOM object to its JS wrapper for DOM objects which can have pending activity.
-    DOMWrapperMap<void>& getActiveDOMObjectMap(v8::Isolate* = 0);
-    void visitActiveDOMObjects(DOMWrapperMap<void>::Visitor*);
-
-    // This should be called to remove all DOM objects associated with the current thread when it is tearing down.
-    void removeAllDOMObjects();
+DOMWrapperMap<Node>& getDOMNodeMap(v8::Isolate* = 0);
+DOMWrapperMap<void>& getDOMObjectMap(v8::Isolate* = 0);
 
 } // namespace WebCore
 
diff --git a/Source/WebCore/bindings/v8/V8DOMWindowShell.cpp b/Source/WebCore/bindings/v8/V8DOMWindowShell.cpp
index de65721a3..4d37fc93c 100644
--- a/Source/WebCore/bindings/v8/V8DOMWindowShell.cpp
+++ b/Source/WebCore/bindings/v8/V8DOMWindowShell.cpp
@@ -150,8 +150,8 @@ static void initializeV8IfNeeded()
 
     v8::V8::IgnoreOutOfMemoryException();
     v8::V8::SetFatalErrorHandler(reportFatalError);
-    v8::V8::SetGlobalGCPrologueCallback(&V8GCController::gcPrologue);
-    v8::V8::SetGlobalGCEpilogueCallback(&V8GCController::gcEpilogue);
+    v8::V8::AddGCPrologueCallback(&V8GCController::gcPrologue);
+    v8::V8::AddGCEpilogueCallback(&V8GCController::gcEpilogue);
     v8::V8::AddMessageListener(&reportUncaughtException);
     v8::V8::SetFailedAccessCheckCallbackFunction(reportUnsafeJavaScriptAccess);
 #if ENABLE(JAVASCRIPT_DEBUGGER)
diff --git a/Source/WebCore/bindings/v8/V8DOMWrapper.cpp b/Source/WebCore/bindings/v8/V8DOMWrapper.cpp
index c768da892..aac95dbee 100644
--- a/Source/WebCore/bindings/v8/V8DOMWrapper.cpp
+++ b/Source/WebCore/bindings/v8/V8DOMWrapper.cpp
@@ -68,24 +68,6 @@
 
 namespace WebCore {
 
-v8::Persistent<v8::Object> V8DOMWrapper::setJSWrapperForDOMNode(PassRefPtr<Node> node, v8::Handle<v8::Object> wrapper, v8::Isolate* isolate)
-{
-    v8::Persistent<v8::Object> wrapperHandle = v8::Persistent<v8::Object>::New(wrapper);
-    ASSERT(maybeDOMWrapper(wrapperHandle));
-    ASSERT(!node->isActiveNode());
-    getDOMNodeMap(isolate).set(node.leakRef(), wrapperHandle);
-    return wrapperHandle;
-}
-
-v8::Persistent<v8::Object> V8DOMWrapper::setJSWrapperForActiveDOMNode(PassRefPtr<Node> node, v8::Handle<v8::Object> wrapper, v8::Isolate* isolate)
-{
-    v8::Persistent<v8::Object> wrapperHandle = v8::Persistent<v8::Object>::New(wrapper);
-    ASSERT(maybeDOMWrapper(wrapperHandle));
-    ASSERT(node->isActiveNode());
-    getActiveDOMNodeMap(isolate).set(node.leakRef(), wrapperHandle);
-    return wrapperHandle;
-}
-
 void V8DOMWrapper::setNamedHiddenReference(v8::Handle<v8::Object> parent, const char* name, v8::Handle<v8::Value> child)
 {
     ASSERT(name);
@@ -95,7 +77,7 @@ void V8DOMWrapper::setNamedHiddenReference(v8::Handle<v8::Object> parent, const
 WrapperTypeInfo* V8DOMWrapper::domWrapperType(v8::Handle<v8::Object> object)
 {
     ASSERT(V8DOMWrapper::maybeDOMWrapper(object));
-    return static_cast<WrapperTypeInfo*>(object->GetPointerFromInternalField(v8DOMWrapperTypeIndex));
+    return toWrapperTypeInfo(object);
 }
 
 PassRefPtr<NodeFilter> V8DOMWrapper::wrapNativeNodeFilter(v8::Handle<v8::Value> filter)
diff --git a/Source/WebCore/bindings/v8/V8DOMWrapper.h b/Source/WebCore/bindings/v8/V8DOMWrapper.h
index ad1bcafd9..377fcedf6 100644
--- a/Source/WebCore/bindings/v8/V8DOMWrapper.h
+++ b/Source/WebCore/bindings/v8/V8DOMWrapper.h
@@ -32,6 +32,7 @@
 #define V8DOMWrapper_h
 
 #include "DOMDataStore.h"
+#include "DOMWrapperWorld.h"
 #include "Event.h"
 #include "Node.h"
 #include "NodeFilter.h"
@@ -66,7 +67,6 @@ namespace WebCore {
         static bool maybeDOMWrapper(v8::Handle<v8::Value>);
 #endif
 
-        // Sets contents of a DOM wrapper.
         static void setDOMWrapper(v8::Handle<v8::Object> object, WrapperTypeInfo* type, void* cptr)
         {
             ASSERT(object->InternalFieldCount() >= 2);
@@ -74,6 +74,14 @@ namespace WebCore {
             object->SetPointerInInternalField(v8DOMWrapperTypeIndex, type);
         }
 
+        static void clearDOMWrapper(v8::Handle<v8::Object> object, WrapperTypeInfo* type)
+        {
+            ASSERT(object->InternalFieldCount() >= 2);
+            ASSERT(type);
+            object->SetPointerInInternalField(v8DOMWrapperTypeIndex, type);
+            object->SetPointerInInternalField(v8DOMWrapperObjectIndex, 0);
+        }
+
         static v8::Handle<v8::Object> lookupDOMWrapper(v8::Handle<v8::FunctionTemplate> functionTemplate, v8::Handle<v8::Object> object)
         {
             return object.IsEmpty() ? object : object->FindInstanceInPrototypeChain(functionTemplate);
@@ -95,10 +103,6 @@ namespace WebCore {
 
         template<typename T>
         static v8::Persistent<v8::Object> setJSWrapperForDOMObject(PassRefPtr<T>, v8::Handle<v8::Object>, v8::Isolate* = 0);
-        template<typename T>
-        static v8::Persistent<v8::Object> setJSWrapperForActiveDOMObject(PassRefPtr<T>, v8::Handle<v8::Object>, v8::Isolate* = 0);
-        static v8::Persistent<v8::Object> setJSWrapperForDOMNode(PassRefPtr<Node>, v8::Handle<v8::Object>, v8::Isolate* = 0);
-        static v8::Persistent<v8::Object> setJSWrapperForActiveDOMNode(PassRefPtr<Node>, v8::Handle<v8::Object>, v8::Isolate* = 0);
 
         static bool isValidDOMObject(v8::Handle<v8::Value>);
 
@@ -113,22 +117,32 @@ namespace WebCore {
         {
             ASSERT(isMainThread());
             if (LIKELY(!DOMWrapperWorld::isolatedWorldsExist())) {
-                v8::Persistent<v8::Object>* wrapper = node->wrapper();
-                if (LIKELY(!!wrapper))
-                    return *wrapper;
+                v8::Persistent<v8::Object> wrapper = node->wrapper();
+                if (LIKELY(!wrapper.IsEmpty()))
+                    return wrapper;
             }
 
             V8DOMWindowShell* context = V8DOMWindowShell::getEntered();
-            if (LIKELY(!context)) {
-                v8::Persistent<v8::Object>* wrapper = node->wrapper();
-                if (!wrapper)
-                    return v8::Handle<v8::Object>();
-                return *wrapper;
-            }
+            if (LIKELY(!context))
+                return node->wrapper();
+
             DOMDataStore* store = context->world()->domDataStore();
-            DOMNodeMapping& domNodeMap = node->isActiveNode() ? store->activeDomNodeMap() : store->domNodeMap();
+            DOMWrapperMap<Node>& domNodeMap = store->domNodeMap();
             return domNodeMap.get(node);
         }
+
+    private:
+        static void setJSWrapperPrivate(void* object, v8::Persistent<v8::Object> wrapper, v8::Isolate* isolate)
+        {
+            wrapper.SetWrapperClassId(v8DOMObjectClassId);
+            getDOMObjectMap(isolate).set(object, wrapper);
+        }
+
+        static void setJSWrapperPrivate(Node* object, v8::Persistent<v8::Object> wrapper, v8::Isolate* isolate)
+        {
+            wrapper.SetWrapperClassId(v8DOMNodeClassId);
+            getDOMNodeMap(isolate).set(object, wrapper);
+        }
     };
 
     template<typename T>
@@ -136,20 +150,10 @@ namespace WebCore {
     {
         v8::Persistent<v8::Object> wrapperHandle = v8::Persistent<v8::Object>::New(wrapper);
         ASSERT(maybeDOMWrapper(wrapperHandle));
-        ASSERT(!domWrapperType(wrapperHandle)->toActiveDOMObjectFunction);
-        getDOMObjectMap(isolate).set(object.leakRef(), wrapperHandle);
+        setJSWrapperPrivate(object.leakRef(), wrapperHandle, isolate);
         return wrapperHandle;
     }
 
-    template<typename T>
-    v8::Persistent<v8::Object> V8DOMWrapper::setJSWrapperForActiveDOMObject(PassRefPtr<T> object, v8::Handle<v8::Object> wrapper, v8::Isolate* isolate)
-    {
-        v8::Persistent<v8::Object> wrapperHandle = v8::Persistent<v8::Object>::New(wrapper);
-        ASSERT(maybeDOMWrapper(wrapperHandle));
-        ASSERT(domWrapperType(wrapperHandle)->toActiveDOMObjectFunction);
-        getActiveDOMObjectMap(isolate).set(object.leakRef(), wrapperHandle);
-        return wrapperHandle;
-    }
 }
 
 #endif // V8DOMWrapper_h
diff --git a/Source/WebCore/bindings/v8/V8GCController.cpp b/Source/WebCore/bindings/v8/V8GCController.cpp
index 95d91e27f..7a679305a 100644
--- a/Source/WebCore/bindings/v8/V8GCController.cpp
+++ b/Source/WebCore/bindings/v8/V8GCController.cpp
@@ -37,6 +37,7 @@
 #include "DOMImplementation.h"
 #include "HTMLImageElement.h"
 #include "HTMLNames.h"
+#include "IntrusiveDOMWrapperMap.h"
 #include "MemoryUsageSupport.h"
 #include "MessagePort.h"
 #include "RetainedDOMInfo.h"
@@ -48,6 +49,7 @@
 #include "V8CSSStyleDeclaration.h"
 #include "V8DOMImplementation.h"
 #include "V8MessagePort.h"
+#include "V8Node.h"
 #include "V8RecursionScope.h"
 #include "V8StyleSheet.h"
 #include "V8StyleSheetList.h"
@@ -66,49 +68,72 @@
 
 namespace WebCore {
 
-#ifndef NDEBUG
-
-class EnsureWeakDOMNodeVisitor : public DOMWrapperMap<Node>::Visitor {
+class ImplicitConnection {
 public:
-    void visitDOMWrapper(DOMDataStore*, Node*, v8::Persistent<v8::Object> wrapper)
+    ImplicitConnection(void* root, v8::Persistent<v8::Value> wrapper)
+        : m_root(root)
+        , m_wrapper(wrapper)
     {
-        ASSERT(wrapper.IsWeak());
     }
+
+    void* root() const { return m_root; }
+    v8::Persistent<v8::Value> wrapper() const { return m_wrapper; }
+
+private:
+    void* m_root;
+    v8::Persistent<v8::Value> m_wrapper;
 };
 
-#endif // NDEBUG
+bool operator<(const ImplicitConnection& left, const ImplicitConnection& right)
+{
+    return left.root() < right.root();
+}
 
-template<typename T>
-class ActiveDOMObjectPrologueVisitor : public DOMWrapperMap<T>::Visitor {
+class WrapperGrouper {
 public:
-    void visitDOMWrapper(DOMDataStore*, T* object, v8::Persistent<v8::Object> wrapper)
+    WrapperGrouper()
     {
-        WrapperTypeInfo* typeInfo = V8DOMWrapper::domWrapperType(wrapper);  
+        m_liveObjects.append(V8PerIsolateData::current()->ensureLiveRoot());
+    }
 
-        if (V8MessagePort::info.equals(typeInfo)) {
-            // Mark each port as in-use if it's entangled. For simplicity's sake,
-            // we assume all ports are remotely entangled, since the Chromium port
-            // implementation can't tell the difference.
-            MessagePort* port = reinterpret_cast<MessagePort*>(object);
-            if (port->isEntangled() || port->hasPendingActivity())
-                wrapper.ClearWeak();
-            return;
-        }
+    void addToGroup(void* root, v8::Persistent<v8::Value> wrapper)
+    {
+        m_connections.append(ImplicitConnection(root, wrapper));
+    }
 
-        ActiveDOMObject* activeDOMObject = typeInfo->toActiveDOMObject(wrapper);
-        if (activeDOMObject && activeDOMObject->hasPendingActivity())
-            wrapper.ClearWeak();
+    void keepAlive(v8::Persistent<v8::Value> wrapper)
+    {
+        m_liveObjects.append(wrapper);
     }
-};
 
-class ObjectVisitor : public DOMWrapperMap<void>::Visitor {
-public:
-    void visitDOMWrapper(DOMDataStore* store, void* object, v8::Persistent<v8::Object> wrapper)
+    void apply()
     {
-        V8DOMWrapper::domWrapperType(wrapper)->visitDOMWrapper(store, object, wrapper);
+        if (m_liveObjects.size() > 1)
+            v8::V8::AddObjectGroup(m_liveObjects.data(), m_liveObjects.size());
+
+        std::sort(m_connections.begin(), m_connections.end());
+        Vector<v8::Persistent<v8::Value> > group;
+        size_t i = 0;
+        while (i < m_connections.size()) {
+            void* root = m_connections[i].root();
+
+            do {
+                group.append(m_connections[i++].wrapper());
+            } while (i < m_connections.size() && root == m_connections[i].root());
+
+            if (group.size() > 1)
+                v8::V8::AddObjectGroup(group.data(), group.size(), 0);
+
+            group.shrink(0);
+        }
     }
+
+private:
+    Vector<v8::Persistent<v8::Value> > m_liveObjects;
+    Vector<ImplicitConnection> m_connections;
 };
 
+// FIXME: This should use opaque GC roots.
 static void addImplicitReferencesForNodeWithEventListeners(Node* node, v8::Persistent<v8::Object> wrapper)
 {
     ASSERT(node->hasEventListeners());
@@ -131,15 +156,16 @@ static void addImplicitReferencesForNodeWithEventListeners(Node* node, v8::Persi
     v8::V8::AddImplicitReferences(wrapper, listeners.data(), listeners.size());
 }
 
-static Node* rootForGC(Node* node)
+void* V8GCController::opaqueRootForGC(Node* node)
 {
     if (node->inDocument() || (node->hasTagName(HTMLNames::imgTag) && static_cast<HTMLImageElement*>(node)->hasPendingActivity()))
         return node->document();
 
     if (node->isAttributeNode()) {
-        node = static_cast<Attr*>(node)->ownerElement();
-        if (!node)
-            return 0;
+        Node* ownerElement = static_cast<Attr*>(node)->ownerElement();
+        if (!ownerElement)
+            return node;
+        node = ownerElement;
     }
 
     while (Node* parent = node->parentOrHostNode())
@@ -148,136 +174,89 @@ static Node* rootForGC(Node* node)
     return node;
 }
 
-class ImplicitConnection {
+class WrapperVisitor : public v8::PersistentHandleVisitor {
 public:
-    ImplicitConnection(Node* root, v8::Persistent<v8::Value> wrapper)
-        : m_root(root)
-        , m_wrapper(wrapper)
+    virtual void VisitPersistentHandle(v8::Persistent<v8::Value> value, uint16_t classId) OVERRIDE
     {
-    }
+        ASSERT(value->IsObject());
+        v8::Persistent<v8::Object> wrapper = v8::Persistent<v8::Object>::Cast(value);
 
-    Node* root() const { return m_root; }
-    v8::Persistent<v8::Value> wrapper() const { return m_wrapper; }
+        if (classId != v8DOMNodeClassId && classId != v8DOMObjectClassId)
+            return;
 
-public:
-    Node* m_root;
-    v8::Persistent<v8::Value> m_wrapper;
-};
+        ASSERT(V8DOMWrapper::maybeDOMWrapper(value));
 
-bool operator<(const ImplicitConnection& left, const ImplicitConnection& right)
-{
-    return left.root() < right.root();
-}
+        if (value.IsIndependent())
+            return;
 
-class NodeVisitor : public DOMWrapperMap<Node>::Visitor {
-public:
-    void visitDOMWrapper(DOMDataStore*, Node* node, v8::Persistent<v8::Object> wrapper)
-    {
-        if (node->hasEventListeners())
-            addImplicitReferencesForNodeWithEventListeners(node, wrapper);
+        WrapperTypeInfo* type = V8DOMWrapper::domWrapperType(wrapper);
+        void* object = toNative(wrapper);
 
-        Node* root = rootForGC(node);
-        if (!root)
-            return;
-        m_connections.append(ImplicitConnection(root, wrapper));
-    }
+        if (V8MessagePort::info.equals(type)) {
+            // Mark each port as in-use if it's entangled. For simplicity's sake,
+            // we assume all ports are remotely entangled, since the Chromium port
+            // implementation can't tell the difference.
+            MessagePort* port = static_cast<MessagePort*>(object);
+            if (port->isEntangled() || port->hasPendingActivity())
+                m_grouper.keepAlive(wrapper);
+        } else {
+            ActiveDOMObject* activeDOMObject = type->toActiveDOMObject(wrapper);
+            if (activeDOMObject && activeDOMObject->hasPendingActivity())
+                m_grouper.keepAlive(wrapper);
+        }
 
-    void applyGrouping()
-    {
-        std::sort(m_connections.begin(), m_connections.end());
-        Vector<v8::Persistent<v8::Value> > group;
-        size_t i = 0;
-        while (i < m_connections.size()) {
-            Node* root = m_connections[i].root();
+        if (classId == v8DOMNodeClassId) {
+            ASSERT(V8Node::HasInstance(wrapper));
+            ASSERT(!wrapper.IsIndependent());
 
-            do {
-                group.append(m_connections[i++].wrapper());
-            } while (i < m_connections.size() && root == m_connections[i].root());
+            Node* node = static_cast<Node*>(object);
 
-            if (group.size() > 1)
-                v8::V8::AddObjectGroup(group.data(), group.size(), new RetainedDOMInfo(root));
+            if (node->hasEventListeners())
+                addImplicitReferencesForNodeWithEventListeners(node, wrapper);
 
-            group.shrink(0);
+            m_grouper.addToGroup(V8GCController::opaqueRootForGC(node), wrapper);
+        } else if (classId == v8DOMObjectClassId) {
+            m_grouper.addToGroup(type->opaqueRootForGC(object, wrapper), wrapper);
+        } else {
+            ASSERT_NOT_REACHED();
         }
     }
 
+    void notifyFinished()
+    {
+        m_grouper.apply();
+    }
+
 private:
-    Vector<ImplicitConnection> m_connections;
+    WrapperGrouper m_grouper;
 };
 
-// Create object groups for DOM tree nodes.
-void V8GCController::gcPrologue()
+void V8GCController::gcPrologue(v8::GCType type, v8::GCCallbackFlags flags)
 {
-    TRACE_EVENT_BEGIN0("v8", "GC");
+    if (type == v8::kGCTypeScavenge)
+        minorGCPrologue();
+    else if (type == v8::kGCTypeMarkSweepCompact)
+        majorGCPrologue();
+}
 
-    v8::HandleScope scope;
+void V8GCController::minorGCPrologue()
+{
+}
 
-    ActiveDOMObjectPrologueVisitor<void> activeObjectVisitor;
-    visitActiveDOMObjects(&activeObjectVisitor);
-    ActiveDOMObjectPrologueVisitor<Node> activeNodeVisitor;
-    visitActiveDOMNodes(&activeNodeVisitor);
+void V8GCController::majorGCPrologue()
+{
+    TRACE_EVENT_BEGIN0("v8", "GC");
 
-    NodeVisitor nodeVisitor;
-    visitDOMNodes(&nodeVisitor);
-    visitActiveDOMNodes(&nodeVisitor);
-    nodeVisitor.applyGrouping();
+    v8::HandleScope scope;
 
-    ObjectVisitor objectVisitor;
-    visitDOMObjects(&objectVisitor);
+    WrapperVisitor visitor;
+    v8::V8::VisitHandlesWithClassIds(&visitor);
+    visitor.notifyFinished();
 
     V8PerIsolateData* data = V8PerIsolateData::current();
     data->stringCache()->clearOnGC();
 }
 
-class SpecialCaseEpilogueObjectHandler {
-public:
-    static bool process(void* object, v8::Persistent<v8::Object> wrapper, WrapperTypeInfo* typeInfo)
-    {
-        if (V8MessagePort::info.equals(typeInfo)) {
-            MessagePort* port1 = static_cast<MessagePort*>(object);
-            // We marked this port as reachable in GCPrologueVisitor.  Undo this now since the
-            // port could be not reachable in the future if it gets disentangled (and also
-            // GCPrologueVisitor expects to see all handles marked as weak).
-            if ((!wrapper.IsWeak() && !wrapper.IsNearDeath()) || port1->hasPendingActivity())
-                wrapper.MakeWeak(port1, &DOMDataStore::weakActiveDOMObjectCallback);
-            return true;
-        }
-        return false;
-    }
-};
-
-class SpecialCaseEpilogueNodeHandler {
-public:
-    static bool process(Node* object, v8::Persistent<v8::Object> wrapper, WrapperTypeInfo* typeInfo)
-    {
-        UNUSED_PARAM(object);
-        UNUSED_PARAM(wrapper);
-        UNUSED_PARAM(typeInfo);
-        return false;
-    }
-};
-
-template<typename T, typename S, v8::WeakReferenceCallback callback>
-class GCEpilogueVisitor : public DOMWrapperMap<T>::Visitor {
-public:
-    void visitDOMWrapper(DOMDataStore* store, T* object, v8::Persistent<v8::Object> wrapper)
-    {
-        WrapperTypeInfo* typeInfo = V8DOMWrapper::domWrapperType(wrapper);
-        if (!S::process(object, wrapper, typeInfo)) {
-            ActiveDOMObject* activeDOMObject = typeInfo->toActiveDOMObject(wrapper);
-            if (activeDOMObject && activeDOMObject->hasPendingActivity()) {
-                ASSERT(!wrapper.IsWeak());
-                // NOTE: To re-enable weak status of the active object we use
-                // |object| from the map and not |activeDOMObject|. The latter
-                // may be a different pointer (in case ActiveDOMObject is not
-                // the main base class of the object's class) and pointer
-                // identity is required by DOM map functions.
-                wrapper.MakeWeak(object, callback);
-            }
-        }
-    }
-};
-
 #if PLATFORM(CHROMIUM)
 static int workingSetEstimateMB = 0;
 
@@ -288,16 +267,21 @@ static Mutex& workingSetEstimateMBMutex()
 }
 #endif
 
-void V8GCController::gcEpilogue()
+void V8GCController::gcEpilogue(v8::GCType type, v8::GCCallbackFlags flags)
 {
-    v8::HandleScope scope;
+    if (type == v8::kGCTypeScavenge)
+        minorGCEpilogue();
+    else if (type == v8::kGCTypeMarkSweepCompact)
+        majorGCEpilogue();
+}
 
-    // Run through all objects with pending activity making their wrappers weak
-    // again.
-    GCEpilogueVisitor<void, SpecialCaseEpilogueObjectHandler, &DOMDataStore::weakActiveDOMObjectCallback> epilogueObjectVisitor;
-    visitActiveDOMObjects(&epilogueObjectVisitor);
-    GCEpilogueVisitor<Node, SpecialCaseEpilogueNodeHandler, &DOMDataStore::weakNodeCallback> epilogueNodeVisitor;
-    visitActiveDOMNodes(&epilogueNodeVisitor);
+void V8GCController::minorGCEpilogue()
+{
+}
+
+void V8GCController::majorGCEpilogue()
+{
+    v8::HandleScope scope;
 
 #if PLATFORM(CHROMIUM)
     // The GC can happen on multiple threads in case of dedicated workers which run in-process.
@@ -307,11 +291,6 @@ void V8GCController::gcEpilogue()
     }
 #endif
 
-#ifndef NDEBUG
-    EnsureWeakDOMNodeVisitor weakDOMNodeVisitor;
-    visitDOMNodes(&weakDOMNodeVisitor);
-#endif
-
     TRACE_EVENT_END0("v8", "GC");
 }
 
diff --git a/Source/WebCore/bindings/v8/V8GCController.h b/Source/WebCore/bindings/v8/V8GCController.h
index e2d4d745f..155168125 100644
--- a/Source/WebCore/bindings/v8/V8GCController.h
+++ b/Source/WebCore/bindings/v8/V8GCController.h
@@ -35,14 +35,22 @@
 
 namespace WebCore {
 
+class Node;
+
 class V8GCController {
 public:
-    static void gcPrologue();
-    static void gcEpilogue();
+    static void gcPrologue(v8::GCType, v8::GCCallbackFlags);
+    static void gcEpilogue(v8::GCType, v8::GCCallbackFlags);
+    static void minorGCPrologue();
+    static void minorGCEpilogue();
+    static void majorGCPrologue();
+    static void majorGCEpilogue();
 
     static void checkMemoryUsage();
     static void hintForCollectGarbage();
     static void collectGarbage();
+
+    static void* opaqueRootForGC(Node*);
 };
 
 }
diff --git a/Source/WebCore/bindings/v8/V8HiddenPropertyName.h b/Source/WebCore/bindings/v8/V8HiddenPropertyName.h
index 542c8ea79..231138bed 100644
--- a/Source/WebCore/bindings/v8/V8HiddenPropertyName.h
+++ b/Source/WebCore/bindings/v8/V8HiddenPropertyName.h
@@ -40,7 +40,6 @@ namespace WebCore {
     V(document) \
     V(domStringMap) \
     V(domTokenList) \
-    V(domTransactionData) \
     V(event) \
     V(listener) \
     V(ownerNode) \
diff --git a/Source/WebCore/bindings/v8/V8NPObject.cpp b/Source/WebCore/bindings/v8/V8NPObject.cpp
index a5b3d1deb..676a672d9 100644
--- a/Source/WebCore/bindings/v8/V8NPObject.cpp
+++ b/Source/WebCore/bindings/v8/V8NPObject.cpp
@@ -161,25 +161,47 @@ v8::Handle<v8::Value> npObjectInvokeDefaultHandler(const v8::Arguments& args)
 }
 
 
-static void weakTemplateCallback(v8::Persistent<v8::Value>, void* parameter);
-
-// NPIdentifier is PrivateIdentifier*.
-static WeakReferenceMap<PrivateIdentifier, v8::FunctionTemplate>& staticTemplateMap()
+class V8NPTemplateMap
 {
-    typedef WeakReferenceMap<PrivateIdentifier, v8::FunctionTemplate> MapType;
-    DEFINE_STATIC_LOCAL(MapType, templateMap, (&weakTemplateCallback));
-    return templateMap;
-}
+public:
+    // NPIdentifier is PrivateIdentifier*.
+    typedef HashMap<PrivateIdentifier*, v8::Persistent<v8::FunctionTemplate> > MapType;
 
-static void weakTemplateCallback(v8::Persistent<v8::Value> object, void* parameter)
-{
-    PrivateIdentifier* identifier = static_cast<PrivateIdentifier*>(parameter);
-    ASSERT(identifier);
-    ASSERT(staticTemplateMap().contains(identifier));
+    v8::Persistent<v8::FunctionTemplate> get(PrivateIdentifier* key)
+    {
+        return m_map.get(key);
+    }
 
-    staticTemplateMap().forget(identifier);
-}
+    void set(PrivateIdentifier* key, v8::Persistent<v8::FunctionTemplate> wrapper)
+    {
+        ASSERT(!m_map.contains(key));
+        m_map.set(key, wrapper);
+        wrapper.MakeWeak(key, weakCallback);
+    }
 
+    static V8NPTemplateMap& sharedInstance()
+    {
+        DEFINE_STATIC_LOCAL(V8NPTemplateMap, map, ());
+        return map;
+    }
+
+private:
+    static void weakCallback(v8::Persistent<v8::Value> object, void* context)
+    {
+        sharedInstance().dispose(static_cast<PrivateIdentifier*>(context));
+    }
+
+    void dispose(PrivateIdentifier* key)
+    {
+        MapType::iterator it = m_map.find(key);
+        ASSERT(it != m_map.end());
+        it->value.Dispose();
+        it->value.Clear();
+        m_map.remove(it);
+    }
+
+    MapType m_map;
+};
 
 static v8::Handle<v8::Value> npObjectGetProperty(v8::Local<v8::Object> self, NPIdentifier identifier, v8::Local<v8::Value> key, v8::Isolate* isolate)
 {
@@ -216,14 +238,14 @@ static v8::Handle<v8::Value> npObjectGetProperty(v8::Local<v8::Object> self, NPI
             return throwError(ReferenceError, "NPObject deleted", isolate);
 
         PrivateIdentifier* id = static_cast<PrivateIdentifier*>(identifier);
-        v8::Persistent<v8::FunctionTemplate> functionTemplate = staticTemplateMap().get(id);
+        v8::Persistent<v8::FunctionTemplate> functionTemplate = V8NPTemplateMap::sharedInstance().get(id);
         // Cache templates using identifier as the key.
         if (functionTemplate.IsEmpty()) {
             // Create a new template.
             v8::Local<v8::FunctionTemplate> temp = v8::FunctionTemplate::New();
             temp->SetCallHandler(npObjectMethodHandler, key);
             functionTemplate = v8::Persistent<v8::FunctionTemplate>::New(temp);
-            staticTemplateMap().set(id, functionTemplate);
+            V8NPTemplateMap::sharedInstance().set(id, functionTemplate);
         }
 
         // FunctionTemplate caches function for each context.
@@ -355,29 +377,33 @@ v8::Handle<v8::Array> npObjectIndexedPropertyEnumerator(const v8::AccessorInfo&
     return npObjectPropertyEnumerator(info, false);
 }
 
-static void weakNPObjectCallback(v8::Persistent<v8::Value>, void* parameter);
+static void weakNPObjectCallback(v8::Persistent<v8::Value>, void*);
 
-static DOMWrapperMap<NPObject>& staticNPObjectMap()
+static DOMWrapperHashMap<NPObject>& staticNPObjectMap()
 {
-    DEFINE_STATIC_LOCAL(DOMWrapperMap<NPObject>, npObjectMap, (&weakNPObjectCallback));
+    DEFINE_STATIC_LOCAL(DOMWrapperHashMap<NPObject>, npObjectMap, (&weakNPObjectCallback));
     return npObjectMap;
 }
 
-static void weakNPObjectCallback(v8::Persistent<v8::Value> object, void* parameter)
+static void weakNPObjectCallback(v8::Persistent<v8::Value> value, void*)
 {
-    NPObject* npObject = static_cast<NPObject*>(parameter);
-    ASSERT(staticNPObjectMap().contains(npObject));
+    ASSERT(value->IsObject());
+    v8::Persistent<v8::Object> wrapper = v8::Persistent<v8::Object>::Cast(value);
+    NPObject* npObject = static_cast<NPObject*>(toNative(wrapper));
+
     ASSERT(npObject);
+    ASSERT(staticNPObjectMap().get(npObject) == wrapper);
 
-    // Must remove from our map before calling _NPN_ReleaseObject(). _NPN_ReleaseObject can call ForgetV8ObjectForNPObject, which
-    // uses the table as well.
-    staticNPObjectMap().forget(npObject);
+    // Must remove from our map before calling _NPN_ReleaseObject(). _NPN_ReleaseObject can
+    // call forgetV8ObjectForNPObject, which uses the table as well.
+    staticNPObjectMap().remove(npObject, wrapper);
+    wrapper.Dispose();
+    wrapper.Clear();
 
     if (_NPN_IsAlive(npObject))
         _NPN_ReleaseObject(npObject);
 }
 
-
 v8::Local<v8::Object> createV8ObjectForNPObject(NPObject* object, NPObject* root)
 {
     static v8::Persistent<v8::FunctionTemplate> npObjectDesc;
@@ -391,8 +417,9 @@ v8::Local<v8::Object> createV8ObjectForNPObject(NPObject* object, NPObject* root
     }
 
     // If we've already wrapped this object, just return it.
-    if (staticNPObjectMap().contains(object))
-        return v8::Local<v8::Object>::New(staticNPObjectMap().get(object));
+    v8::Handle<v8::Object> wrapper = staticNPObjectMap().get(object);
+    if (!wrapper.IsEmpty())
+        return v8::Local<v8::Object>::New(wrapper);
 
     // FIXME: we should create a Wrapper type as a subclass of JSObject. It has two internal fields, field 0 is the wrapped
     // pointer, and field 1 is the type. There should be an api function that returns unused type id. The same Wrapper type
@@ -428,11 +455,13 @@ v8::Local<v8::Object> createV8ObjectForNPObject(NPObject* object, NPObject* root
 
 void forgetV8ObjectForNPObject(NPObject* object)
 {
-    if (staticNPObjectMap().contains(object)) {
+    v8::Persistent<v8::Object> wrapper = staticNPObjectMap().get(object);
+    if (!wrapper.IsEmpty()) {
         v8::HandleScope scope;
-        v8::Persistent<v8::Object> handle(staticNPObjectMap().get(object));
-        V8DOMWrapper::setDOMWrapper(handle, npObjectTypeInfo(), 0);
-        staticNPObjectMap().forget(object);
+        V8DOMWrapper::clearDOMWrapper(wrapper, npObjectTypeInfo());
+        staticNPObjectMap().remove(object, wrapper);
+        wrapper.Dispose();
+        wrapper.Clear();
         _NPN_ReleaseObject(object);
     }
 }
diff --git a/Source/WebCore/bindings/v8/V8PerContextData.cpp b/Source/WebCore/bindings/v8/V8PerContextData.cpp
index 9764620d4..2a26f0e2d 100644
--- a/Source/WebCore/bindings/v8/V8PerContextData.cpp
+++ b/Source/WebCore/bindings/v8/V8PerContextData.cpp
@@ -55,6 +55,7 @@ void V8PerContextData::dispose()
         for (; it != m_wrapperBoilerplates.end(); ++it) {
             v8::Persistent<v8::Object> wrapper = it->value;
             wrapper.Dispose();
+            wrapper.Clear();
         }
         m_wrapperBoilerplates.clear();
     }
@@ -64,6 +65,7 @@ void V8PerContextData::dispose()
         for (; it != m_constructorMap.end(); ++it) {
             v8::Persistent<v8::Function> wrapper = it->value;
             wrapper.Dispose();
+            wrapper.Clear();
         }
         m_constructorMap.clear();
     }
diff --git a/Source/WebCore/bindings/v8/V8PerIsolateData.cpp b/Source/WebCore/bindings/v8/V8PerIsolateData.cpp
index f5cd38abd..373066c2b 100644
--- a/Source/WebCore/bindings/v8/V8PerIsolateData.cpp
+++ b/Source/WebCore/bindings/v8/V8PerIsolateData.cpp
@@ -31,6 +31,15 @@
 #include <wtf/MemoryInstrumentationHashMap.h>
 #include <wtf/MemoryInstrumentationVector.h>
 
+namespace WTF {
+
+// WrapperTypeInfo are statically allocated, don't count them.
+template<> struct SequenceMemoryInstrumentationTraits<WebCore::WrapperTypeInfo*> {
+    template <typename I> static void reportMemoryUsage(I, I, MemoryClassInfo&) { }
+};
+
+}
+
 namespace WebCore {
 
 V8PerIsolateData::V8PerIsolateData(v8::Isolate* isolate)
@@ -69,6 +78,13 @@ void V8PerIsolateData::ensureInitialized(v8::Isolate* isolate)
         create(isolate);
 }
 
+v8::Persistent<v8::Value> V8PerIsolateData::ensureLiveRoot()
+{
+    if (m_liveRoot.isEmpty())
+        m_liveRoot.set(v8::Null());
+    return m_liveRoot.get();
+}
+
 void V8PerIsolateData::dispose(v8::Isolate* isolate)
 {
     void* data = isolate->GetData();
@@ -116,13 +132,6 @@ void V8PerIsolateData::visitExternalStrings(ExternalStringVisitor* visitor)
 }
 #endif
 
-v8::Handle<v8::Context> V8PerIsolateData::ensureAuxiliaryContext()
-{
-    if (m_auxiliaryContext.isEmpty())
-        m_auxiliaryContext.adopt(v8::Context::New());
-    return m_auxiliaryContext.get();
-}
-
 v8::Handle<v8::Value> V8PerIsolateData::constructorOfToString(const v8::Arguments& args)
 {
     // The DOM constructors' toString functions grab the current toString
diff --git a/Source/WebCore/bindings/v8/V8PerIsolateData.h b/Source/WebCore/bindings/v8/V8PerIsolateData.h
index b7d5f6550..afe114774 100644
--- a/Source/WebCore/bindings/v8/V8PerIsolateData.h
+++ b/Source/WebCore/bindings/v8/V8PerIsolateData.h
@@ -78,13 +78,14 @@ public:
     StringCache* stringCache() { return m_stringCache.get(); }
     IntegerCache* integerCache() { return m_integerCache.get(); }
 
+    v8::Persistent<v8::Value> ensureLiveRoot();
+
 #if ENABLE(INSPECTOR)
     void visitExternalStrings(ExternalStringVisitor*);
 #endif
     DOMDataList& allStores() { return m_domDataList; }
 
     V8HiddenPropertyName* hiddenPropertyName() { return m_hiddenPropertyName.get(); }
-    v8::Handle<v8::Context> ensureAuxiliaryContext();
 
     void registerDOMDataStore(DOMDataStore* domDataStore) 
     {
@@ -138,10 +139,11 @@ private:
     OwnPtr<StringCache> m_stringCache;
     OwnPtr<IntegerCache> m_integerCache;
 
-    DOMDataList m_domDataList;
+    Vector<DOMDataStore*> m_domDataList;
     DOMDataStore* m_domDataStore;
 
     OwnPtr<V8HiddenPropertyName> m_hiddenPropertyName;
+    ScopedPersistent<v8::Value> m_liveRoot;
     ScopedPersistent<v8::Context> m_auxiliaryContext;
 
     bool m_constructorMode;
diff --git a/Source/WebCore/bindings/v8/V8ValueCache.cpp b/Source/WebCore/bindings/v8/V8ValueCache.cpp
index 39cffc5a2..b5f93f3a5 100644
--- a/Source/WebCore/bindings/v8/V8ValueCache.cpp
+++ b/Source/WebCore/bindings/v8/V8ValueCache.cpp
@@ -46,6 +46,7 @@ static void cachedStringCallback(v8::Persistent<v8::Value> wrapper, void* parame
     StringImpl* stringImpl = static_cast<StringImpl*>(parameter);
     V8PerIsolateData::current()->stringCache()->remove(stringImpl);
     wrapper.Dispose();
+    wrapper.Clear();
     stringImpl->deref();
 }
 
@@ -113,8 +114,10 @@ void IntegerCache::createSmallIntegers(v8::Isolate* isolate)
 IntegerCache::~IntegerCache()
 {
     if (m_initialized) {
-        for (int value = 0; value < numberOfCachedSmallIntegers; value++)
+        for (int value = 0; value < numberOfCachedSmallIntegers; value++) {
             m_smallIntegers[value].Dispose();
+            m_smallIntegers[value].Clear();
+        }
         m_initialized = false;
     }
 }
diff --git a/Source/WebCore/bindings/v8/V8WorkerContextEventListener.cpp b/Source/WebCore/bindings/v8/V8WorkerContextEventListener.cpp
index d9bb95545..74aa03c57 100644
--- a/Source/WebCore/bindings/v8/V8WorkerContextEventListener.cpp
+++ b/Source/WebCore/bindings/v8/V8WorkerContextEventListener.cpp
@@ -110,9 +110,6 @@ v8::Local<v8::Value> V8WorkerContextEventListener::callListenerFunction(ScriptEx
     V8RecursionScope recursionScope(context);
     v8::Local<v8::Value> result = handlerFunction->Call(receiver, 1, parameters);
 
-    if (WorkerContextExecutionProxy* proxy = workerProxy(context))
-        proxy->trackEvent(event);
-
     InspectorInstrumentation::didCallFunction(cookie);
 
     return result;
diff --git a/Source/WebCore/bindings/v8/WorkerContextExecutionProxy.cpp b/Source/WebCore/bindings/v8/WorkerContextExecutionProxy.cpp
index ee27ebf27..99aa09ebb 100644
--- a/Source/WebCore/bindings/v8/WorkerContextExecutionProxy.cpp
+++ b/Source/WebCore/bindings/v8/WorkerContextExecutionProxy.cpp
@@ -99,21 +99,8 @@ WorkerContextExecutionProxy::~WorkerContextExecutionProxy()
 
 void WorkerContextExecutionProxy::dispose()
 {
-    // Detach all events from their JS wrappers.
-    for (size_t eventIndex = 0; eventIndex < m_events.size(); ++eventIndex) {
-        Event* event = m_events[eventIndex];
-        if (forgetV8EventObject(event))
-          event->deref();
-    }
-    m_events.clear();
-
     m_perContextData.clear();
-
-    // Dispose the context.
-    if (!m_context.IsEmpty()) {
-        m_context.Dispose();
-        m_context.Clear();
-    }
+    m_context.clear();
 }
 
 void WorkerContextExecutionProxy::initIsolate()
@@ -122,8 +109,8 @@ void WorkerContextExecutionProxy::initIsolate()
     v8::V8::IgnoreOutOfMemoryException();
     v8::V8::SetFatalErrorHandler(reportFatalErrorInV8);
 
-    v8::V8::SetGlobalGCPrologueCallback(&V8GCController::gcPrologue);
-    v8::V8::SetGlobalGCEpilogueCallback(&V8GCController::gcEpilogue);
+    v8::V8::AddGCPrologueCallback(&V8GCController::gcPrologue);
+    v8::V8::AddGCEpilogueCallback(&V8GCController::gcEpilogue);
 
     // FIXME: Remove the following 2 lines when V8 default has changed.
     const char es5ReadonlyFlag[] = "--es5_readonly";
@@ -140,7 +127,7 @@ void WorkerContextExecutionProxy::initIsolate()
 bool WorkerContextExecutionProxy::initializeIfNeeded()
 {
     // Bail out if the context has already been initialized.
-    if (!m_context.IsEmpty())
+    if (!m_context.isEmpty())
         return true;
 
     // Setup the security handlers and message listener. This only has
@@ -151,16 +138,16 @@ bool WorkerContextExecutionProxy::initializeIfNeeded()
 
     // Create a new environment
     v8::Persistent<v8::ObjectTemplate> globalTemplate;
-    m_context = v8::Context::New(0, globalTemplate);
-    if (m_context.IsEmpty())
+    m_context.adopt(v8::Context::New(0, globalTemplate));
+    if (m_context.isEmpty())
         return false;
 
     // Starting from now, use local context only.
-    v8::Local<v8::Context> context = v8::Local<v8::Context>::New(m_context);
+    v8::Local<v8::Context> context = v8::Local<v8::Context>::New(m_context.get());
 
     v8::Context::Scope scope(context);
 
-    m_perContextData = V8PerContextData::create(m_context);
+    m_perContextData = V8PerContextData::create(m_context.get());
     if (!m_perContextData->init()) {
         dispose();
         return false;
@@ -195,15 +182,6 @@ bool WorkerContextExecutionProxy::initializeIfNeeded()
     return true;
 }
 
-bool WorkerContextExecutionProxy::forgetV8EventObject(Event* event)
-{
-    if (getDOMObjectMap().contains(event)) {
-        getDOMObjectMap().forget(event);
-        return true;
-    }
-    return false;
-}
-
 ScriptValue WorkerContextExecutionProxy::evaluate(const String& script, const String& fileName, const TextPosition& scriptStartPosition, WorkerContextExecutionState* state)
 {
     V8GCController::checkMemoryUsage();
@@ -219,7 +197,7 @@ ScriptValue WorkerContextExecutionProxy::evaluate(const String& script, const St
         m_disableEvalPending = String();
     }
 
-    v8::Context::Scope scope(m_context);
+    v8::Context::Scope scope(m_context.get());
 
     v8::TryCatch exceptionCatcher;
 
@@ -258,11 +236,6 @@ void WorkerContextExecutionProxy::setEvalAllowed(bool enable, const String& erro
     m_disableEvalPending = enable ? String() : errorMessage;
 }
 
-void WorkerContextExecutionProxy::trackEvent(Event* event)
-{
-    m_events.append(event);
-}
-
 } // namespace WebCore
 
 #endif // ENABLE(WORKERS)
diff --git a/Source/WebCore/bindings/v8/WorkerContextExecutionProxy.h b/Source/WebCore/bindings/v8/WorkerContextExecutionProxy.h
index 4c024d02d..37793adec 100644
--- a/Source/WebCore/bindings/v8/WorkerContextExecutionProxy.h
+++ b/Source/WebCore/bindings/v8/WorkerContextExecutionProxy.h
@@ -49,7 +49,11 @@ namespace WebCore {
     struct WrapperTypeInfo;
 
     struct WorkerContextExecutionState {
-        WorkerContextExecutionState() : hadException(false), lineNumber(0) { }
+        WorkerContextExecutionState()
+            : hadException(false)
+            , lineNumber(0)
+        {
+        }
 
         bool hadException;
         ScriptValue exception;
@@ -60,14 +64,9 @@ namespace WebCore {
 
     class WorkerContextExecutionProxy {
     public:
-        WorkerContextExecutionProxy(WorkerContext*);
+        explicit WorkerContextExecutionProxy(WorkerContext*);
         ~WorkerContextExecutionProxy();
 
-        // Track the event so that we can detach it from the JS wrapper when a worker
-        // terminates. This is needed because we need to be able to dispose these
-        // events and releases references to their event targets: WorkerContext.
-        void trackEvent(Event*);
-
         // Alow use of eval() and is equivalents in scripts.
         void setEvalAllowed(bool enable, const String& errorMessage);
 
@@ -75,24 +74,18 @@ namespace WebCore {
         ScriptValue evaluate(const String& script, const String& fileName, const TextPosition& scriptStartPosition, WorkerContextExecutionState*);
 
         // Returns a local handle of the context.
-        v8::Local<v8::Context> context() { return v8::Local<v8::Context>::New(m_context); }
+        v8::Local<v8::Context> context() { return v8::Local<v8::Context>::New(m_context.get()); }
 
     private:
         void initIsolate();
         bool initializeIfNeeded();
         void dispose();
 
-        static bool forgetV8EventObject(Event*);
-
         static const int kWorkerMaxStackSize = 500 * 1024;
 
         WorkerContext* m_workerContext;
-        v8::Persistent<v8::Context> m_context;
-
-        Vector<Event*> m_events;
-
+        ScopedPersistent<v8::Context> m_context;
         OwnPtr<V8PerContextData> m_perContextData;
-
         String m_disableEvalPending;
     };
 
diff --git a/Source/WebCore/bindings/v8/WorkerScriptController.cpp b/Source/WebCore/bindings/v8/WorkerScriptController.cpp
index 7d6b58a7b..5bacb5ad9 100644
--- a/Source/WebCore/bindings/v8/WorkerScriptController.cpp
+++ b/Source/WebCore/bindings/v8/WorkerScriptController.cpp
@@ -60,15 +60,15 @@ WorkerScriptController::WorkerScriptController(WorkerContext* workerContext)
     , m_executionScheduledToTerminate(false)
 {
     V8PerIsolateData* data = V8PerIsolateData::create(m_isolate);
-    data->allStores().append(&m_DOMDataStore);
-    data->setDOMDataStore(&m_DOMDataStore);
     m_isolate->Enter();
+    m_domDataStore = adoptPtr(new DOMDataStore(DOMDataStore::Worker));
+    data->setDOMDataStore(m_domDataStore.get());
     m_proxy = adoptPtr(new WorkerContextExecutionProxy(workerContext));
 }
 
 WorkerScriptController::~WorkerScriptController()
 {
-    removeAllDOMObjects();
+    m_domDataStore.clear();
 #if PLATFORM(CHROMIUM)
     // The corresponding call to didStartWorkerRunLoop is in
     // WorkerThread::workerThread().
diff --git a/Source/WebCore/bindings/v8/WorkerScriptController.h b/Source/WebCore/bindings/v8/WorkerScriptController.h
index 68ce89aae..e08eb9d9f 100644
--- a/Source/WebCore/bindings/v8/WorkerScriptController.h
+++ b/Source/WebCore/bindings/v8/WorkerScriptController.h
@@ -33,7 +33,6 @@
 
 #if ENABLE(WORKERS)
 
-#include "ScopedDOMDataStore.h"
 #include "V8Binding.h"
 
 #include <v8.h>
@@ -82,7 +81,7 @@ namespace WebCore {
         WorkerContext* m_workerContext;
         OwnPtr<WorkerContextExecutionProxy> m_proxy;
         v8::Isolate* m_isolate;
-        ScopedDOMDataStore m_DOMDataStore;
+        OwnPtr<DOMDataStore> m_domDataStore;
         bool m_executionForbidden;
         bool m_executionScheduledToTerminate;
         mutable Mutex m_scheduledTerminationMutex;
diff --git a/Source/WebCore/bindings/v8/WrapperTypeInfo.h b/Source/WebCore/bindings/v8/WrapperTypeInfo.h
index a4bd4998d..0cb4b959b 100644
--- a/Source/WebCore/bindings/v8/WrapperTypeInfo.h
+++ b/Source/WebCore/bindings/v8/WrapperTypeInfo.h
@@ -42,12 +42,13 @@ namespace WebCore {
     static const int v8DOMWrapperObjectIndex = 1;
     static const int v8DefaultWrapperInternalFieldCount = 2;
 
-    static const uint16_t v8DOMSubtreeClassId = 1;
+    static const uint16_t v8DOMNodeClassId = 1;
+    static const uint16_t v8DOMObjectClassId = 2;
 
     typedef v8::Persistent<v8::FunctionTemplate> (*GetTemplateFunction)();
     typedef void (*DerefObjectFunction)(void*);
     typedef ActiveDOMObject* (*ToActiveDOMObjectFunction)(v8::Handle<v8::Object>);
-    typedef void (*DOMWrapperVisitorFunction)(DOMDataStore*, void*, v8::Persistent<v8::Object>);
+    typedef void* (*OpaqueRootForGC)(void*, v8::Persistent<v8::Object>);
     typedef void (*InstallPerContextPrototypePropertiesFunction)(v8::Handle<v8::Object>);
 
     enum WrapperTypePrototype {
@@ -102,20 +103,34 @@ namespace WebCore {
             return toActiveDOMObjectFunction(object);
         }
 
-        void visitDOMWrapper(DOMDataStore* store, void* object, v8::Persistent<v8::Object> wrapper)
+        void* opaqueRootForGC(void* object, v8::Persistent<v8::Object> wrapper)
         {
-            if (domWrapperVisitorFunction)
-                domWrapperVisitorFunction(store, object, wrapper);
+            if (!opaqueRootForGCFunction)
+                return object;
+            return opaqueRootForGCFunction(object, wrapper);
         }
 
         const GetTemplateFunction getTemplateFunction;
         const DerefObjectFunction derefObjectFunction;
         const ToActiveDOMObjectFunction toActiveDOMObjectFunction;
-        const DOMWrapperVisitorFunction domWrapperVisitorFunction;
+        const OpaqueRootForGC opaqueRootForGCFunction;
         const InstallPerContextPrototypePropertiesFunction installPerContextPrototypePropertiesFunction;
         const WrapperTypeInfo* parentClass;
         const WrapperTypePrototype wrapperTypePrototype;
     };
+
+    inline void* toNative(v8::Handle<v8::Object> object)
+    {
+        ASSERT(object->InternalFieldCount() >= v8DOMWrapperObjectIndex);
+        return object->GetPointerFromInternalField(v8DOMWrapperObjectIndex);
+    }
+
+    inline WrapperTypeInfo* toWrapperTypeInfo(v8::Handle<v8::Object> object)
+    {
+        ASSERT(object->InternalFieldCount() >= v8DOMWrapperTypeIndex);
+        return static_cast<WrapperTypeInfo*>(object->GetPointerFromInternalField(v8DOMWrapperTypeIndex));
+    }
+
 }
 
 #endif // WrapperTypeInfo_h
diff --git a/Source/WebCore/bindings/v8/custom/V8DOMTransactionCustom.cpp b/Source/WebCore/bindings/v8/custom/V8DOMTransactionCustom.cpp
deleted file mode 100644
index 313bc8b98..000000000
--- a/Source/WebCore/bindings/v8/custom/V8DOMTransactionCustom.cpp
+++ /dev/null
@@ -1,50 +0,0 @@
-/*
- * Copyright (C) 2012 Google Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1.  Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- * 2.  Redistributions in binary form must reproduce the above copyright
- * notice, this list of conditions and the following disclaimer in the
- * documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY GOOGLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
- * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
- * DISCLAIMED. IN NO EVENT SHALL GOOGLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
- * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
- * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
- * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
- * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "config.h"
-
-#if ENABLE(UNDO_MANAGER)
-
-#include "V8DOMTransaction.h"
-
-#include "DOMTransaction.h"
-
-namespace WebCore {
-
-void V8DOMTransaction::visitDOMWrapper(DOMDataStore* store, void* object, v8::Persistent<v8::Object> wrapper)
-{
-    DOMTransaction* transaction = static_cast<DOMTransaction*>(object);
-    UndoManager* undoManager = transaction->undoManager();
-    if (!undoManager)
-        return;
-    v8::Persistent<v8::Object> undoManagerWrapper = store->domObjectMap().get(undoManager);
-    if (!undoManagerWrapper.IsEmpty()) {
-        v8::Persistent<v8::Value> value = wrapper;
-        v8::V8::AddImplicitReferences(undoManagerWrapper, &value, 1);
-    }
-}
-
-} // namespace WebCore
-
-#endif
diff --git a/Source/WebCore/bindings/v8/custom/V8HTMLCollectionCustom.cpp b/Source/WebCore/bindings/v8/custom/V8HTMLCollectionCustom.cpp
index dbff29246..04915d792 100644
--- a/Source/WebCore/bindings/v8/custom/V8HTMLCollectionCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8HTMLCollectionCustom.cpp
@@ -86,6 +86,9 @@ v8::Handle<v8::Value> V8HTMLCollection::namedItemCallback(const v8::Arguments& a
 
 v8::Handle<v8::Value> toV8(HTMLCollection* impl, v8::Handle<v8::Object> creationContext, v8::Isolate* isolate)
 {
+    if (!impl)
+        return v8NullWithCheck(isolate);
+
     if (impl->type() == DocAll)
         return toV8(static_cast<HTMLAllCollection*>(impl), creationContext, isolate);
     return V8HTMLCollection::wrap(impl, creationContext, isolate);
diff --git a/Source/WebCore/bindings/v8/custom/V8HTMLImageElementConstructor.cpp b/Source/WebCore/bindings/v8/custom/V8HTMLImageElementConstructor.cpp
index 256c9d37e..58a7af492 100644
--- a/Source/WebCore/bindings/v8/custom/V8HTMLImageElementConstructor.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8HTMLImageElementConstructor.cpp
@@ -80,7 +80,7 @@ static v8::Handle<v8::Value> v8HTMLImageElementConstructorCallback(const v8::Arg
     RefPtr<HTMLImageElement> image = HTMLImageElement::createForJSConstructor(document, optionalWidth, optionalHeight);
     v8::Handle<v8::Object> wrapper = args.Holder();
     V8DOMWrapper::setDOMWrapper(wrapper, &V8HTMLImageElementConstructor::info, image.get());
-    V8DOMWrapper::setJSWrapperForDOMNode(image.release(), wrapper);
+    V8DOMWrapper::setJSWrapperForDOMObject(image.release(), wrapper);
     return wrapper;
 }
 
diff --git a/Source/WebCore/bindings/v8/custom/V8IDBKeyCustom.cpp b/Source/WebCore/bindings/v8/custom/V8IDBKeyCustom.cpp
index fc116a986..561bc45c8 100644
--- a/Source/WebCore/bindings/v8/custom/V8IDBKeyCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8IDBKeyCustom.cpp
@@ -40,8 +40,11 @@ namespace WebCore {
 
 v8::Handle<v8::Value> toV8(IDBKey* key, v8::Handle<v8::Object> creationContext, v8::Isolate* isolate)
 {
-    if (!key)
+    if (!key) {
+        // This should be undefined, not null.
+        // Spec: http://dvcs.w3.org/hg/IndexedDB/raw-file/tip/Overview.html#idl-def-IDBKeyRange
         return v8Undefined();
+    }
 
     switch (key->type()) {
     case IDBKey::InvalidType:
diff --git a/Source/WebCore/bindings/v8/custom/V8InjectedScriptManager.cpp b/Source/WebCore/bindings/v8/custom/V8InjectedScriptManager.cpp
index 3bd2d4e56..3a0b29b51 100644
--- a/Source/WebCore/bindings/v8/custom/V8InjectedScriptManager.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8InjectedScriptManager.cpp
@@ -49,6 +49,7 @@ static void WeakReferenceCallback(v8::Persistent<v8::Value> object, void* parame
     InjectedScriptHost* nativeObject = static_cast<InjectedScriptHost*>(parameter);
     nativeObject->deref();
     object.Dispose();
+    object.Clear();
 }
 
 static v8::Local<v8::Object> createInjectedScriptHostV8Wrapper(InjectedScriptHost* host)
diff --git a/Source/WebCore/bindings/v8/custom/V8NodeListCustom.cpp b/Source/WebCore/bindings/v8/custom/V8NodeListCustom.cpp
index 4e8cb5579..e42589e69 100644
--- a/Source/WebCore/bindings/v8/custom/V8NodeListCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8NodeListCustom.cpp
@@ -34,6 +34,7 @@
 #include "DynamicNodeList.h"
 #include "NodeList.h"
 #include "V8Binding.h"
+#include "V8GCController.h"
 #include "V8Node.h"
 
 #include <wtf/RefPtr.h>
@@ -59,19 +60,16 @@ v8::Handle<v8::Value> V8NodeList::namedPropertyGetter(v8::Local<v8::String> name
     return toV8(result.release(), info.Holder(), info.GetIsolate());
 }
 
-void V8NodeList::visitDOMWrapper(DOMDataStore* store, void* object, v8::Persistent<v8::Object> wrapper)
+void* V8NodeList::opaqueRootForGC(void* object, v8::Persistent<v8::Object> wrapper)
 {
+    ASSERT(V8NodeList::HasInstance(wrapper));
     NodeList* impl = static_cast<NodeList*>(object);
-    if (impl->isDynamicNodeList()) {
-        Node* owner = static_cast<DynamicNodeList*>(impl)->ownerNode();
-        if (owner) {
-            v8::Persistent<v8::Object> ownerWrapper = store->domNodeMap().get(owner);
-            if (!ownerWrapper.IsEmpty()) {
-                v8::Persistent<v8::Value> value = wrapper;
-                v8::V8::AddImplicitReferences(ownerWrapper, &value, 1);
-            }
-        }
-    }
+    if (!impl->isDynamicNodeList())
+        return object;
+    Node* owner = static_cast<DynamicNodeList*>(impl)->ownerNode();
+    if (!owner)
+        return object;
+    return V8GCController::opaqueRootForGC(owner);
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/bindings/v8/custom/V8SpeechRecognitionResultCustom.cpp b/Source/WebCore/bindings/v8/custom/V8SpeechRecognitionResultCustom.cpp
index 32492cfb7..ef14565fc 100644
--- a/Source/WebCore/bindings/v8/custom/V8SpeechRecognitionResultCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8SpeechRecognitionResultCustom.cpp
@@ -31,16 +31,15 @@
 
 #include "SpeechRecognitionResult.h"
 #include "V8Binding.h"
+#include "V8GCController.h"
 
 namespace WebCore {
 
-void V8SpeechRecognitionResult::visitDOMWrapper(DOMDataStore* store, void* object, v8::Persistent<v8::Object> wrapper)
+void* V8SpeechRecognitionResult::opaqueRootForGC(void* object, v8::Persistent<v8::Object> wrapper)
 {
+    ASSERT(V8SpeechRecognitionResult::HasInstance(wrapper));
     SpeechRecognitionResult* impl = static_cast<SpeechRecognitionResult*>(object);
-    Document* emma = impl->emma();
-    v8::Persistent<v8::Value> emmaWrapper = store->domNodeMap().get(emma);
-    if (!emmaWrapper.IsEmpty())
-        v8::V8::AddImplicitReferences(wrapper, &emmaWrapper, 1);
+    return V8GCController::opaqueRootForGC(impl->emma());
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/bindings/v8/custom/V8UndoManagerCustom.cpp b/Source/WebCore/bindings/v8/custom/V8UndoManagerCustom.cpp
deleted file mode 100644
index 71be095a7..000000000
--- a/Source/WebCore/bindings/v8/custom/V8UndoManagerCustom.cpp
+++ /dev/null
@@ -1,93 +0,0 @@
-/*
- * Copyright (C) 2012 Google Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1.  Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- * 2.  Redistributions in binary form must reproduce the above copyright
- * notice, this list of conditions and the following disclaimer in the
- * documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY GOOGLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
- * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
- * DISCLAIMED. IN NO EVENT SHALL GOOGLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
- * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
- * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
- * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
- * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "config.h"
-
-#if ENABLE(UNDO_MANAGER)
-
-#include "V8UndoManager.h"
-
-#include "DOMTransaction.h"
-#include "ExceptionCode.h"
-#include "V8DOMTransaction.h"
-
-namespace WebCore {
-
-v8::Handle<v8::Value> V8UndoManager::transactCallback(const v8::Arguments& args)
-{
-    INC_STATS("DOM.UndoManager.transact");
-    if (args.Length() < 1)
-        return throwNotEnoughArgumentsError(args.GetIsolate());
-    UndoManager* imp = V8UndoManager::toNative(args.Holder());
-
-    EXCEPTION_BLOCK(v8::Local<v8::Value>, dictionary, MAYBE_MISSING_PARAMETER(args, 0, DefaultIsUndefined));
-    if (dictionary.IsEmpty() || !dictionary->IsObject())
-        return throwTypeError("The first argument is not of type DOMTransaction.", args.GetIsolate());
-
-    EXCEPTION_BLOCK(bool, merge, MAYBE_MISSING_PARAMETER(args, 1, DefaultIsUndefined)->BooleanValue());
-
-    RefPtr<DOMTransaction> transaction = DOMTransaction::create(WorldContextHandle(UseCurrentWorld));
-    transaction->setData(dictionary);
-
-    ExceptionCode ec = 0;
-    imp->transact(transaction, merge, ec);
-    if (ec)
-        return setDOMException(ec, args.GetIsolate());
-    return v8Undefined();
-}
-
-v8::Handle<v8::Value> V8UndoManager::itemCallback(const v8::Arguments& args)
-{
-    INC_STATS("DOM.UndoManager.item");
-    if (args.Length() < 1)
-        return throwNotEnoughArgumentsError(args.GetIsolate());
-    UndoManager* imp = V8UndoManager::toNative(args.Holder());
-
-    EXCEPTION_BLOCK(unsigned, index, toUInt32(MAYBE_MISSING_PARAMETER(args, 0, DefaultIsUndefined)));
-
-    if (index >= imp->length())
-        return v8::Null(args.GetIsolate());
-
-    const UndoManagerEntry& entry = imp->item(index);
-
-    v8::Handle<v8::Array> result = v8::Array::New(entry.size());
-    v8::Isolate* isolate = args.GetIsolate();
-    for (size_t index = 0; index < entry.size(); ++index) {
-        UndoStep* step = entry[index].get();
-        if (step->isDOMTransaction())
-            result->Set(v8Integer(index, isolate), static_cast<DOMTransaction*>(step)->data());
-        else {
-            // FIXME: We shouldn't be creating new object each time we return.
-            // Object for the same native editing command should always be the same.
-            v8::Handle<v8::Object> object = v8::Object::New();
-            object->Set(v8::String::NewSymbol("label"), v8::String::New("[Editing command]"));
-            result->Set(v8Integer(index, isolate), object);
-        }
-    }
-    return result;
-}
-
-} // namespace WebCore
-
-#endif // ENABLE(UNDO_MANAGER)
diff --git a/Source/WebCore/bindings/v8/custom/V8WebSocketCustom.cpp b/Source/WebCore/bindings/v8/custom/V8WebSocketCustom.cpp
index 900a5625e..a5de9a423 100644
--- a/Source/WebCore/bindings/v8/custom/V8WebSocketCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8WebSocketCustom.cpp
@@ -105,7 +105,7 @@ v8::Handle<v8::Value> V8WebSocket::constructorCallback(const v8::Arguments& args
 
     v8::Handle<v8::Object> wrapper = args.Holder();
     V8DOMWrapper::setDOMWrapper(wrapper, &info, webSocket.get());
-    V8DOMWrapper::setJSWrapperForActiveDOMObject(webSocket.release(), wrapper);
+    V8DOMWrapper::setJSWrapperForDOMObject(webSocket.release(), wrapper);
     return wrapper;
 }
 
diff --git a/Source/WebCore/bindings/v8/custom/V8XMLHttpRequestConstructor.cpp b/Source/WebCore/bindings/v8/custom/V8XMLHttpRequestConstructor.cpp
index 6f3d6ee41..0786a18d6 100644
--- a/Source/WebCore/bindings/v8/custom/V8XMLHttpRequestConstructor.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8XMLHttpRequestConstructor.cpp
@@ -62,7 +62,7 @@ v8::Handle<v8::Value> V8XMLHttpRequest::constructorCallback(const v8::Arguments&
 
     v8::Handle<v8::Object> wrapper = args.Holder();
     V8DOMWrapper::setDOMWrapper(wrapper, &info, xmlHttpRequest.get());
-    V8DOMWrapper::setJSWrapperForActiveDOMObject(xmlHttpRequest.release(), wrapper);
+    V8DOMWrapper::setJSWrapperForDOMObject(xmlHttpRequest.release(), wrapper);
     return wrapper;
 }
 
diff --git a/Source/WebCore/bridge/objc/objc_runtime.mm b/Source/WebCore/bridge/objc/objc_runtime.mm
index 2cf0db561..be24fdb3f 100644
--- a/Source/WebCore/bridge/objc/objc_runtime.mm
+++ b/Source/WebCore/bridge/objc/objc_runtime.mm
@@ -248,8 +248,7 @@ static EncodedJSValue JSC_HOST_CALL callObjCFallbackObject(ExecState* exec)
         ObjcClass* objcClass = static_cast<ObjcClass*>(objcInstance->getClass());
         OwnPtr<ObjcMethod> fallbackMethod(adoptPtr(new ObjcMethod(objcClass->isa(), @selector(invokeUndefinedMethodFromWebScript:withArguments:))));
         const String& nameIdentifier = static_cast<ObjcFallbackObjectImp*>(exec->callee())->propertyName();
-        RetainPtr<CFStringRef> name(AdoptCF, nameIdentifier.createCFString());
-        fallbackMethod->setJavaScriptName(name.get());
+        fallbackMethod->setJavaScriptName(nameIdentifier.createCFString().get());
         result = objcInstance->invokeObjcMethod(exec, fallbackMethod.get());
     }
             
diff --git a/Source/WebCore/css/CSSComputedStyleDeclaration.cpp b/Source/WebCore/css/CSSComputedStyleDeclaration.cpp
index 586c133ea..1e6d2079a 100644
--- a/Source/WebCore/css/CSSComputedStyleDeclaration.cpp
+++ b/Source/WebCore/css/CSSComputedStyleDeclaration.cpp
@@ -34,7 +34,6 @@
 #include "CSSParser.h"
 #include "CSSPrimitiveValue.h"
 #include "CSSPrimitiveValueMappings.h"
-#include "CSSProperty.h"
 #include "CSSPropertyNames.h"
 #include "CSSReflectValue.h"
 #include "CSSSelector.h"
@@ -905,6 +904,10 @@ PassRefPtr<CSSValue> CSSComputedStyleDeclaration::valueForFilter(const RenderObj
             break;
         }
 #if ENABLE(CSS_SHADERS)
+        case FilterOperation::VALIDATED_CUSTOM:
+            // ValidatedCustomFilterOperation is not supposed to end up in the RenderStyle.
+            ASSERT_NOT_REACHED();
+            break;
         case FilterOperation::CUSTOM: {
             CustomFilterOperation* customOperation = static_cast<CustomFilterOperation*>(filterOperation);
             filterValue = WebKitCSSFilterValue::create(WebKitCSSFilterValue::CustomFilterOperation);
@@ -921,27 +924,29 @@ PassRefPtr<CSSValue> CSSComputedStyleDeclaration::valueForFilter(const RenderObj
                 shadersList->append(cssValuePool().createIdentifierValue(CSSValueNone));
 
             const CustomFilterProgramMixSettings mixSettings = program->mixSettings();
-            if (program->programType() == PROGRAM_TYPE_BLENDS_ELEMENT_TEXTURE) {
-                RefPtr<WebKitCSSMixFunctionValue> mixFunction = WebKitCSSMixFunctionValue::create();
-                mixFunction->append(program->fragmentShader()->cssValue());
-                mixFunction->append(cssValuePool().createValue(mixSettings.blendMode));
-                mixFunction->append(cssValuePool().createValue(mixSettings.compositeOperator));
-                shadersList->append(mixFunction.release());
-            } else if (program->fragmentShader())
-                shadersList->append(program->fragmentShader()->cssValue());
+            if (program->fragmentShader()) {
+                if (program->programType() == PROGRAM_TYPE_BLENDS_ELEMENT_TEXTURE) {
+                    RefPtr<WebKitCSSMixFunctionValue> mixFunction = WebKitCSSMixFunctionValue::create();
+                    mixFunction->append(program->fragmentShader()->cssValue());
+                    mixFunction->append(cssValuePool().createValue(mixSettings.blendMode));
+                    mixFunction->append(cssValuePool().createValue(mixSettings.compositeOperator));
+                    shadersList->append(mixFunction.release());
+                } else
+                    shadersList->append(program->fragmentShader()->cssValue());
+            }
             else
                 shadersList->append(cssValuePool().createIdentifierValue(CSSValueNone));
 
             filterValue->append(shadersList.release());
             
             RefPtr<CSSValueList> meshParameters = CSSValueList::createSpaceSeparated();
-            meshParameters->append(cssValuePool().createValue(customOperation->meshRows(), CSSPrimitiveValue::CSS_NUMBER));
             meshParameters->append(cssValuePool().createValue(customOperation->meshColumns(), CSSPrimitiveValue::CSS_NUMBER));
+            meshParameters->append(cssValuePool().createValue(customOperation->meshRows(), CSSPrimitiveValue::CSS_NUMBER));
             meshParameters->append(cssValuePool().createValue(customOperation->meshBoxType()));
             
             // FIXME: The specification doesn't have any "attached" identifier. Should we add one?
             // https://bugs.webkit.org/show_bug.cgi?id=72700
-            if (customOperation->meshType() == CustomFilterOperation::DETACHED)
+            if (customOperation->meshType() == MeshTypeDetached)
                 meshParameters->append(cssValuePool().createIdentifierValue(CSSValueDetached));
             
             filterValue->append(meshParameters.release());
@@ -2133,7 +2138,7 @@ PassRefPtr<CSSValue> CSSComputedStyleDeclaration::getPropertyCSSValue(CSSPropert
         case CSSPropertyWordWrap:
             return cssValuePool().createValue(style->overflowWrap());
         case CSSPropertyWebkitLineBreak:
-            return cssValuePool().createValue(style->khtmlLineBreak());
+            return cssValuePool().createValue(style->lineBreak());
         case CSSPropertyWebkitNbspMode:
             return cssValuePool().createValue(style->nbspMode());
         case CSSPropertyResize:
@@ -2644,6 +2649,14 @@ PassRefPtr<CSSValue> CSSComputedStyleDeclaration::getPropertyCSSValue(CSSPropert
 #endif
             break;
 
+#if ENABLE(CSS_DEVICE_ADAPTATION)
+        case CSSPropertyMaxZoom:
+        case CSSPropertyMinZoom:
+        case CSSPropertyOrientation:
+        case CSSPropertyUserZoom:
+            break;
+#endif
+
 #if ENABLE(SVG)
         case CSSPropertyClipPath:
         case CSSPropertyClipRule:
@@ -2724,20 +2737,20 @@ String CSSComputedStyleDeclaration::item(unsigned i) const
     return getPropertyNameString(computedProperties[i]);
 }
 
-bool CSSComputedStyleDeclaration::cssPropertyMatches(const CSSProperty* property) const
+bool CSSComputedStyleDeclaration::cssPropertyMatches(const StylePropertySet::PropertyReference& property) const
 {
-    if (property->id() == CSSPropertyFontSize && property->value()->isPrimitiveValue() && m_node) {
+    if (property.id() == CSSPropertyFontSize && property.value()->isPrimitiveValue() && m_node) {
         m_node->document()->updateLayoutIgnorePendingStylesheets();
         RenderStyle* style = m_node->computedStyle(m_pseudoElementSpecifier);
         if (style && style->fontDescription().keywordSize()) {
             int sizeValue = cssIdentifierForFontSizeKeyword(style->fontDescription().keywordSize());
-            CSSPrimitiveValue* primitiveValue = static_cast<CSSPrimitiveValue*>(property->value());
+            const CSSPrimitiveValue* primitiveValue = static_cast<const CSSPrimitiveValue*>(property.value());
             if (primitiveValue->isIdent() && primitiveValue->getIdent() == sizeValue)
                 return true;
         }
     }
-    RefPtr<CSSValue> value = getPropertyCSSValue(property->id());
-    return value && value->cssText() == property->value()->cssText();
+    RefPtr<CSSValue> value = getPropertyCSSValue(property.id());
+    return value && value->cssText() == property.value()->cssText();
 }
 
 PassRefPtr<StylePropertySet> CSSComputedStyleDeclaration::copy() const
diff --git a/Source/WebCore/css/CSSComputedStyleDeclaration.h b/Source/WebCore/css/CSSComputedStyleDeclaration.h
index cfc837b9f..6b239e956 100644
--- a/Source/WebCore/css/CSSComputedStyleDeclaration.h
+++ b/Source/WebCore/css/CSSComputedStyleDeclaration.h
@@ -95,7 +95,7 @@ private:
     virtual String getPropertyValueInternal(CSSPropertyID);
     virtual void setPropertyInternal(CSSPropertyID, const String& value, bool important, ExceptionCode&);
 
-    virtual bool cssPropertyMatches(const CSSProperty*) const;
+    virtual bool cssPropertyMatches(const StylePropertySet::PropertyReference&) const OVERRIDE;
 
     PassRefPtr<CSSValue> valueForShadow(const ShadowData*, CSSPropertyID, const RenderStyle*) const;
     PassRefPtr<CSSPrimitiveValue> currentColorOrValidColor(RenderStyle*, const Color&) const;
diff --git a/Source/WebCore/css/CSSCursorImageValue.cpp b/Source/WebCore/css/CSSCursorImageValue.cpp
index 06d93ea60..0faa813b1 100644
--- a/Source/WebCore/css/CSSCursorImageValue.cpp
+++ b/Source/WebCore/css/CSSCursorImageValue.cpp
@@ -56,8 +56,9 @@ static inline SVGCursorElement* resourceReferencedByCursorElement(const String&
 }
 #endif
 
-CSSCursorImageValue::CSSCursorImageValue(const String& url, const IntPoint& hotSpot)
+CSSCursorImageValue::CSSCursorImageValue(const String& url, bool hasHotSpot, const IntPoint& hotSpot)
     : CSSImageValue(CursorImageClass, url)
+    , m_hasHotSpot(hasHotSpot)
     , m_hotSpot(hotSpot)
 {
 }
@@ -80,6 +81,19 @@ CSSCursorImageValue::~CSSCursorImageValue()
 #endif
 }
 
+String CSSCursorImageValue::customCssText() const
+{
+    StringBuilder result;
+    result.append(CSSImageValue::customCssText());
+    if (m_hasHotSpot) {
+        result.append(' ');
+        result.appendNumber(m_hotSpot.x());
+        result.append(' ');
+        result.appendNumber(m_hotSpot.y());
+    }
+    return result.toString();
+}
+
 bool CSSCursorImageValue::updateIfSVGCursorIsUsed(Element* element)
 {
 #if !ENABLE(SVG)
@@ -94,6 +108,7 @@ bool CSSCursorImageValue::updateIfSVGCursorIsUsed(Element* element)
     if (SVGCursorElement* cursorElement = resourceReferencedByCursorElement(url(), element->document())) {
         // FIXME: This will override hot spot specified in CSS, which is probably incorrect.
         SVGLengthContext lengthContext(0);
+        m_hasHotSpot = true;
         float x = roundf(cursorElement->x().value(lengthContext));
         m_hotSpot.setX(static_cast<int>(x));
 
diff --git a/Source/WebCore/css/CSSCursorImageValue.h b/Source/WebCore/css/CSSCursorImageValue.h
index dc8d1ff4c..80d3f15e0 100644
--- a/Source/WebCore/css/CSSCursorImageValue.h
+++ b/Source/WebCore/css/CSSCursorImageValue.h
@@ -32,14 +32,23 @@ class SVGElement;
 
 class CSSCursorImageValue : public CSSImageValue {
 public:
-    static PassRefPtr<CSSCursorImageValue> create(const String& url, const IntPoint& hotSpot)
+    static PassRefPtr<CSSCursorImageValue> create(const String& url, bool hasHotSpot, const IntPoint& hotSpot)
     {
-        return adoptRef(new CSSCursorImageValue(url, hotSpot));
+        return adoptRef(new CSSCursorImageValue(url, hasHotSpot, hotSpot));
     }
 
     ~CSSCursorImageValue();
 
-    IntPoint hotSpot() const { return m_hotSpot; }
+    bool hasHotSpot() const { return m_hasHotSpot; }
+
+    IntPoint hotSpot() const
+    {
+        if (m_hasHotSpot)
+            return m_hotSpot;
+        return IntPoint(-1, -1);
+    }
+
+    String customCssText() const;
 
     bool updateIfSVGCursorIsUsed(Element*);
     StyleCachedImage* cachedImage(CachedResourceLoader*);
@@ -51,8 +60,9 @@ public:
     void reportDescendantMemoryUsage(MemoryObjectInfo*) const;
 
 private:
-    CSSCursorImageValue(const String& url, const IntPoint& hotSpot);
+    CSSCursorImageValue(const String& url, bool hasHotSpot, const IntPoint& hotSpot);
 
+    bool m_hasHotSpot;
     IntPoint m_hotSpot;
 
 #if ENABLE(SVG)
diff --git a/Source/WebCore/css/CSSFontFaceSource.cpp b/Source/WebCore/css/CSSFontFaceSource.cpp
index 5e5289f6d..2fd63f6fa 100644
--- a/Source/WebCore/css/CSSFontFaceSource.cpp
+++ b/Source/WebCore/css/CSSFontFaceSource.cpp
@@ -106,7 +106,8 @@ PassRefPtr<SimpleFontData> CSSFontFaceSource::getFontData(const FontDescription&
 #endif
     ) {
         // We're local. Just return a SimpleFontData from the normal cache.
-        return fontCache()->getCachedFontData(fontDescription, m_string);
+        // We don't want to check alternate font family names here, so pass true as the checkingAlternateName parameter.
+        return fontCache()->getCachedFontData(fontDescription, m_string, true);
     }
 
     // See if we have a mapping in our FontData cache.
diff --git a/Source/WebCore/css/CSSGrammar.y.in b/Source/WebCore/css/CSSGrammar.y.in
index 4b894fb95..9eedcc394 100644
--- a/Source/WebCore/css/CSSGrammar.y.in
+++ b/Source/WebCore/css/CSSGrammar.y.in
@@ -3,6 +3,7 @@
  *  Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009, 2010 Apple Inc. All rights reserved.
  *  Copyright (C) 2006 Alexey Proskuryakov (ap@nypop.com)
  *  Copyright (C) 2008 Eric Seidel <eric@webkit.org>
+ *  Copyright (C) 2012 Intel Corporation. All rights reserved.
  *
  *  This library is free software; you can redistribute it and/or
  *  modify it under the terms of the GNU Lesser General Public
@@ -95,6 +96,9 @@ static inline int cssyyerror(void*, const char*)
 %token SUPPORTS_SYM
 #endif
 %token FONT_FACE_SYM
+#if ENABLE_SHADOW_DOM
+%token HOST_SYM
+#endif
 %token CHARSET_SYM
 %token NAMESPACE_SYM
 %token VARFUNCTION
@@ -106,6 +110,7 @@ static inline int cssyyerror(void*, const char*)
 %token WEBKIT_MEDIAQUERY_SYM
 %token WEBKIT_SELECTOR_SYM
 %token WEBKIT_REGION_RULE_SYM
+%token WEBKIT_VIEWPORT_RULE_SYM
 %token <marginBox> TOPLEFTCORNER_SYM
 %token <marginBox> TOPLEFT_SYM
 %token <marginBox> TOPCENTER_SYM
@@ -187,6 +192,9 @@ static inline int cssyyerror(void*, const char*)
 %type <rule> page
 %type <rule> margin_box
 %type <rule> font_face
+#if ENABLE_SHADOW_DOM
+%type <rule> host
+#endif
 %type <rule> keyframes
 %type <rule> invalid_rule
 %type <rule> save_block
@@ -200,6 +208,9 @@ static inline int cssyyerror(void*, const char*)
 #if ENABLE_CSS3_CONDITIONAL_RULES
 %type <rule> supports
 #endif
+#if ENABLE_CSS_DEVICE_ADAPTATION
+%type <rule> viewport
+#endif
 
 %type <string> maybe_ns_prefix
 
@@ -402,6 +413,12 @@ valid_rule:
 #if ENABLE_CSS3_CONDITIONAL_RULES
   | supports
 #endif
+#if ENABLE_SHADOW_DOM
+  | host
+#endif
+#if ENABLE_CSS_DEVICE_ADAPTATION
+  | viewport
+#endif
   ;
 
 rule:
@@ -430,6 +447,9 @@ block_valid_rule:
   | page
   | font_face
   | keyframes
+#if ENABLE_CSS_DEVICE_ADAPTATION
+  | viewport
+#endif
   ;
 
 block_rule:
@@ -901,6 +921,52 @@ font_face:
     }
 ;
 
+#if ENABLE_SHADOW_DOM
+before_host_rule:
+    /* empty */ {
+        parser->markRuleHeaderStart(CSSRuleSourceData::HOST_RULE);
+    }
+    ;
+
+host:
+    before_host_rule HOST_SYM at_rule_header_end_maybe_space
+    '{' at_rule_body_start maybe_space block_rule_list save_block {
+        $$ = parser->createHostRule($7);
+    }
+    | before_host_rule HOST_SYM at_rule_header_end_maybe_space ';' {
+        $$ = 0;
+        parser->popRuleData();
+    }
+    ;
+#endif
+
+#if ENABLE_CSS_DEVICE_ADAPTATION
+before_viewport_rule:
+    /* empty */ {
+        parser->markViewportRuleBodyStart();
+        parser->markRuleHeaderStart(CSSRuleSourceData::VIEWPORT_RULE);
+    }
+    ;
+
+viewport:
+    before_viewport_rule WEBKIT_VIEWPORT_RULE_SYM at_rule_header_end_maybe_space
+    '{' at_rule_body_start maybe_space_before_declaration declaration_list closing_brace {
+        $$ = parser->createViewportRule();
+        parser->markViewportRuleBodyEnd();
+    }
+    | before_viewport_rule WEBKIT_VIEWPORT_RULE_SYM error invalid_block {
+        $$ = 0;
+        parser->popRuleData();
+        parser->markViewportRuleBodyEnd();
+    }
+    | before_viewport_rule WEBKIT_VIEWPORT_RULE_SYM error ';' {
+        $$ = 0;
+        parser->popRuleData();
+        parser->markViewportRuleBodyEnd();
+    }
+;
+#endif
+
 region_selector:
     selector_list {
         if ($1) {
@@ -1241,7 +1307,9 @@ pseudo:
         $3.lower();
         $$->setValue($3);
         // FIXME: This call is needed to force selector to compute the pseudoType early enough.
-        $$->pseudoType();
+        CSSSelector::PseudoType type = $$->pseudoType();
+        if (type == CSSSelector::PseudoUnknown)
+            $$ = 0;
     }
     // use by :-webkit-any.
     // FIXME: should we support generic selectors here or just simple_selectors?
diff --git a/Source/WebCore/css/CSSImageGeneratorValue.cpp b/Source/WebCore/css/CSSImageGeneratorValue.cpp
index 8cf47f06d..6c460a768 100644
--- a/Source/WebCore/css/CSSImageGeneratorValue.cpp
+++ b/Source/WebCore/css/CSSImageGeneratorValue.cpp
@@ -36,6 +36,15 @@
 #include <wtf/MemoryInstrumentationHashMap.h>
 #include <wtf/text/WTFString.h>
 
+
+namespace WTF {
+
+template<> struct SequenceMemoryInstrumentationTraits<const WebCore::RenderObject*> {
+    template <typename I> static void reportMemoryUsage(I, I, MemoryClassInfo&) { }
+};
+
+}
+
 namespace WebCore {
 
 CSSImageGeneratorValue::CSSImageGeneratorValue(ClassType classType)
diff --git a/Source/WebCore/css/CSSImageSetValue.cpp b/Source/WebCore/css/CSSImageSetValue.cpp
index 6dc76f580..f7d401f5c 100644
--- a/Source/WebCore/css/CSSImageSetValue.cpp
+++ b/Source/WebCore/css/CSSImageSetValue.cpp
@@ -140,7 +140,32 @@ StyleImage* CSSImageSetValue::cachedOrPendingImageSet(Document* document)
 
 String CSSImageSetValue::customCssText() const
 {
-    return "-webkit-image-set(" + CSSValueList::customCssText() + ")";
+    StringBuilder result;
+    result.append("-webkit-image-set(");
+
+    size_t length = this->length();
+    size_t i = 0;
+    while (i < length) {
+        if (i > 0)
+            result.append(", ");
+
+        const CSSValue* imageValue = item(i);
+        result.append(imageValue->cssText());
+        result.append(' ');
+
+        ++i;
+        ASSERT(i < length);
+        const CSSValue* scaleFactorValue = item(i);
+        result.append(scaleFactorValue->cssText());
+        // FIXME: Eventually the scale factor should contain it's own unit http://wkb.ug/100120.
+        // For now 'x' is hard-coded in the parser, so we hard-code it here too.
+        result.append('x');
+
+        ++i;
+    }
+
+    result.append(")");
+    return result.toString();
 }
 
 bool CSSImageSetValue::hasFailedOrCanceledSubresources() const
diff --git a/Source/WebCore/css/CSSImportRule.cpp b/Source/WebCore/css/CSSImportRule.cpp
index 3bbe650a5..8697f668f 100644
--- a/Source/WebCore/css/CSSImportRule.cpp
+++ b/Source/WebCore/css/CSSImportRule.cpp
@@ -69,8 +69,11 @@ String CSSImportRule::cssText() const
     result.append("\")");
 
     if (m_importRule->mediaQueries()) {
-        result.append(' ');
-        result.append(m_importRule->mediaQueries()->mediaText());
+        String mediaText = m_importRule->mediaQueries()->mediaText();
+        if (!mediaText.isEmpty()) {
+            result.append(' ');
+            result.append(mediaText);
+        }
     }
     result.append(';');
     
diff --git a/Source/WebCore/css/CSSParser.cpp b/Source/WebCore/css/CSSParser.cpp
index d16537e6c..8ff97b8e9 100644
--- a/Source/WebCore/css/CSSParser.cpp
+++ b/Source/WebCore/css/CSSParser.cpp
@@ -6,6 +6,7 @@
  * Copyright (C) 2008 Eric Seidel <eric@webkit.org>
  * Copyright (C) 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  * Copyright (C) 2012 Adobe Systems Incorporated. All rights reserved.
+ * Copyright (C) 2012 Intel Corporation. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -43,7 +44,6 @@
 #include "CSSMediaRule.h"
 #include "CSSPageRule.h"
 #include "CSSPrimitiveValue.h"
-#include "CSSProperty.h"
 #include "CSSPropertySourceData.h"
 #include "CSSReflectValue.h"
 #include "CSSSelector.h"
@@ -53,7 +53,6 @@
 #include "CSSValueKeywords.h"
 #include "CSSValueList.h"
 #include "CSSValuePool.h"
-#include "StylePropertyShorthand.h"
 #if ENABLE(CSS_VARIABLES)
 #include "CSSVariableValue.h"
 #endif
@@ -271,6 +270,9 @@ CSSParser::CSSParser(const CSSParserContext& context)
     , m_lastSelectorLineNumber(0)
     , m_allowImportRules(true)
     , m_allowNamespaceDeclarations(true)
+#if ENABLE(CSS_DEVICE_ADAPTATION)
+    , m_inViewport(false)
+#endif
     , m_selectorVector(adoptPtr(new CSSSelectorVector))
 {
 #if YYDEBUG > 0
@@ -337,11 +339,12 @@ AtomicString CSSParserString::lowerSubstring(unsigned position, unsigned length)
     return AtomicString(result);
 }
 
-void CSSParser::setupParser(const char* prefix, const String& string, const char* suffix)
+void CSSParser::setupParser(const char* prefix, unsigned prefixLength, const String& string, const char* suffix, unsigned suffixLength)
 {
-    m_parsedTextPrefixLength = strlen(prefix);
+    m_parsedTextPrefixLength = prefixLength;
     unsigned stringLength = string.length();
-    unsigned length = stringLength + m_parsedTextPrefixLength + strlen(suffix) + 1;
+    unsigned length = stringLength + m_parsedTextPrefixLength + suffixLength + 1;
+    m_length = length;
 
     if (!stringLength || string.is8Bit()) {
         m_dataStart8 = adoptArrayPtr(new LChar[length]);
@@ -352,7 +355,7 @@ void CSSParser::setupParser(const char* prefix, const String& string, const char
             memcpy(m_dataStart8.get() + m_parsedTextPrefixLength, string.characters8(), stringLength * sizeof(LChar));
 
         unsigned start = m_parsedTextPrefixLength + stringLength;
-        unsigned end = start + strlen(suffix);
+        unsigned end = start + suffixLength;
         for (unsigned i = start; i < end; i++)
             m_dataStart8[i] = suffix[i - start];
 
@@ -362,7 +365,6 @@ void CSSParser::setupParser(const char* prefix, const String& string, const char
         m_currentCharacter8 = m_dataStart8.get();
         m_currentCharacter16 = 0;
         setTokenStart<LChar>(m_currentCharacter8);
-        m_length = length;
         m_lexFunc = &CSSParser::realLex<LChar>;
         return;
     }
@@ -374,7 +376,7 @@ void CSSParser::setupParser(const char* prefix, const String& string, const char
     memcpy(m_dataStart16.get() + m_parsedTextPrefixLength, string.characters(), stringLength * sizeof(UChar));
 
     unsigned start = m_parsedTextPrefixLength + stringLength;
-    unsigned end = start + strlen(suffix);
+    unsigned end = start + suffixLength;
     for (unsigned i = start; i < end; i++)
         m_dataStart16[i] = suffix[i - start];
 
@@ -384,7 +386,6 @@ void CSSParser::setupParser(const char* prefix, const String& string, const char
     m_currentCharacter8 = 0;
     m_currentCharacter16 = m_dataStart16.get();
     setTokenStart<UChar>(m_currentCharacter16);
-    m_length = length;
     m_lexFunc = &CSSParser::realLex<UChar>;
 }
 
@@ -829,8 +830,8 @@ static inline bool isValidKeywordPropertyAndValue(CSSPropertyID propertyId, int
         if (valueID == CSSValueNone || valueID == CSSValueEdges)
             return true;
         break;
-    case CSSPropertyWebkitLineBreak: // normal | after-white-space
-        if (valueID == CSSValueNormal || valueID == CSSValueAfterWhiteSpace)
+    case CSSPropertyWebkitLineBreak: // auto | loose | normal | strict | after-white-space
+        if (valueID == CSSValueAuto || valueID == CSSValueLoose || valueID == CSSValueNormal || valueID == CSSValueStrict || valueID == CSSValueAfterWhiteSpace)
             return true;
         break;
     case CSSPropertyWebkitLineSnap:
@@ -1572,7 +1573,7 @@ bool CSSParser::validUnit(CSSParserValue* value, Units unitflags, CSSParserMode
     case CSSPrimitiveValue::CSS_TURN:
         b = (unitflags & FAngle);
         break;
-#if ENABLE(CSS_IMAGE_RESOLUTION)
+#if ENABLE(CSS_IMAGE_RESOLUTION) || ENABLE(RESOLUTION_MEDIA_QUERY)
     case CSSPrimitiveValue::CSS_DPPX:
     case CSSPrimitiveValue::CSS_DPI:
     case CSSPrimitiveValue::CSS_DPCM:
@@ -1601,8 +1602,8 @@ inline PassRefPtr<CSSPrimitiveValue> CSSParser::createPrimitiveNumericValue(CSSP
         ASSERT(isCalculation(value));
         return CSSPrimitiveValue::create(m_parsedCalculation.release());
     }
-               
-#if ENABLE(CSS_IMAGE_RESOLUTION)
+
+#if ENABLE(CSS_IMAGE_RESOLUTION) || ENABLE(RESOLUTION_MEDIA_QUERY)
     ASSERT((value->unit >= CSSPrimitiveValue::CSS_NUMBER && value->unit <= CSSPrimitiveValue::CSS_KHZ)
            || (value->unit >= CSSPrimitiveValue::CSS_TURN && value->unit <= CSSPrimitiveValue::CSS_REMS)
            || (value->unit >= CSSPrimitiveValue::CSS_VW && value->unit <= CSSPrimitiveValue::CSS_VMIN)
@@ -1664,7 +1665,7 @@ inline PassRefPtr<CSSPrimitiveValue> CSSParser::parseValidPrimitive(int identifi
         return createPrimitiveNumericValue(value);
     if (value->unit >= CSSPrimitiveValue::CSS_VW && value->unit <= CSSPrimitiveValue::CSS_VMIN)
         return createPrimitiveNumericValue(value);
-#if ENABLE(CSS_IMAGE_RESOLUTION)
+#if ENABLE(CSS_IMAGE_RESOLUTION) || ENABLE(RESOLUTION_MEDIA_QUERY)
     if (value->unit >= CSSPrimitiveValue::CSS_DPPX && value->unit <= CSSPrimitiveValue::CSS_DPCM)
         return createPrimitiveNumericValue(value);
 #endif
@@ -1729,6 +1730,11 @@ bool CSSParser::parseValue(CSSPropertyID propId, bool important)
         return true;
     }
 
+#if ENABLE(CSS_DEVICE_ADAPTATION)
+    if (inViewport())
+        return parseViewportProperty(propId, important);
+#endif
+
     bool validPrimitive = false;
     RefPtr<CSSValue> parsedValue;
 
@@ -1876,15 +1882,18 @@ bool CSSParser::parseValue(CSSPropertyID propId, bool important)
                 coords.append(int(value->fValue));
                 value = m_valueList->next();
             }
+            bool hasHotSpot = false;
             IntPoint hotSpot(-1, -1);
             int nrcoords = coords.size();
             if (nrcoords > 0 && nrcoords != 2)
                 return false;
-            if (nrcoords == 2)
+            if (nrcoords == 2) {
+                hasHotSpot = true;
                 hotSpot = IntPoint(coords[0], coords[1]);
+            }
 
             if (!uri.isNull())
-                list->append(CSSCursorImageValue::create(completeURL(uri), hotSpot));
+                list->append(CSSCursorImageValue::create(completeURL(uri), hasHotSpot, hotSpot));
 
             if ((inStrictMode() && !value) || (value && !(value->unit == CSSParserValue::Operator && value->iValue == ',')))
                 return false;
@@ -2853,6 +2862,17 @@ bool CSSParser::parseValue(CSSPropertyID propId, bool important)
         // These properties should be handled before in isValidKeywordPropertyAndValue().
         ASSERT_NOT_REACHED();
         return false;
+#if ENABLE(CSS_DEVICE_ADAPTATION)
+    // Properties bellow are validated inside parseViewportProperty, because we
+    // check for parser state inViewportScope. We need to invalidate if someone
+    // adds them outside a @viewport rule.
+    case CSSPropertyMaxZoom:
+    case CSSPropertyMinZoom:
+    case CSSPropertyOrientation:
+    case CSSPropertyUserZoom:
+        validPrimitive = false;
+        break;
+#endif
 #if ENABLE(SVG)
     default:
         return parseSVGValue(propId, important);
@@ -7210,76 +7230,241 @@ public:
         , m_allowSingleArgument(false)
         , m_unit(CSSParser::FUnknown)
     {
-        if (equalIgnoringCase(name, "scale(") || equalIgnoringCase(name, "scalex(") || equalIgnoringCase(name, "scaley(") || equalIgnoringCase(name, "scalez(")) {
-            m_unit = CSSParser::FNumber;
-            if (equalIgnoringCase(name, "scale("))
-                m_type = WebKitCSSTransformValue::ScaleTransformOperation;
-            else if (equalIgnoringCase(name, "scalex("))
-                m_type = WebKitCSSTransformValue::ScaleXTransformOperation;
-            else if (equalIgnoringCase(name, "scaley("))
-                m_type = WebKitCSSTransformValue::ScaleYTransformOperation;
-            else
-                m_type = WebKitCSSTransformValue::ScaleZTransformOperation;
-        } else if (equalIgnoringCase(name, "scale3d(")) {
-            m_type = WebKitCSSTransformValue::Scale3DTransformOperation;
-            m_argCount = 5;
-            m_unit = CSSParser::FNumber;
-        } else if (equalIgnoringCase(name, "rotate(")) {
-            m_type = WebKitCSSTransformValue::RotateTransformOperation;
-            m_unit = CSSParser::FAngle;
-        } else if (equalIgnoringCase(name, "rotatex(") ||
-                   equalIgnoringCase(name, "rotatey(") ||
-                   equalIgnoringCase(name, "rotatez(")) {
-            m_unit = CSSParser::FAngle;
-            if (equalIgnoringCase(name, "rotatex("))
-                m_type = WebKitCSSTransformValue::RotateXTransformOperation;
-            else if (equalIgnoringCase(name, "rotatey("))
-                m_type = WebKitCSSTransformValue::RotateYTransformOperation;
-            else
-                m_type = WebKitCSSTransformValue::RotateZTransformOperation;
-        } else if (equalIgnoringCase(name, "rotate3d(")) {
-            m_type = WebKitCSSTransformValue::Rotate3DTransformOperation;
-            m_argCount = 7;
-            m_unit = CSSParser::FNumber;
-        } else if (equalIgnoringCase(name, "skew(") || equalIgnoringCase(name, "skewx(") || equalIgnoringCase(name, "skewy(")) {
-            m_unit = CSSParser::FAngle;
-            if (equalIgnoringCase(name, "skew("))
+        const UChar* characters;
+        unsigned nameLength = name.length();
+
+        const unsigned longestNameLength = 12;
+        UChar characterBuffer[longestNameLength];
+        if (name.is8Bit()) {
+            unsigned length = std::min(longestNameLength, nameLength);
+            const LChar* characters8 = name.characters8();
+            for (unsigned i = 0; i < length; ++i)
+                characterBuffer[i] = characters8[i];
+            characters = characterBuffer;
+        } else
+            characters = name.characters16();
+
+        switch (nameLength) {
+        case 5:
+            // Valid name: skew(.
+            if (((characters[0] == 's') || (characters[0] == 'S'))
+                & ((characters[1] == 'k') || (characters[1] == 'K'))
+                & ((characters[2] == 'e') || (characters[2] == 'E'))
+                & ((characters[3] == 'w') || (characters[3] == 'W'))
+                & (characters[4] == '(')) {
+                m_unit = CSSParser::FAngle;
                 m_type = WebKitCSSTransformValue::SkewTransformOperation;
-            else if (equalIgnoringCase(name, "skewx("))
-                m_type = WebKitCSSTransformValue::SkewXTransformOperation;
-            else
-                m_type = WebKitCSSTransformValue::SkewYTransformOperation;
-        } else if (equalIgnoringCase(name, "translate(") || equalIgnoringCase(name, "translatex(") || equalIgnoringCase(name, "translatey(") || equalIgnoringCase(name, "translatez(")) {
-            m_unit = CSSParser::FLength | CSSParser::FPercent;
-            if (equalIgnoringCase(name, "translate("))
+                m_allowSingleArgument = true;
+                m_argCount = 3;
+            }
+            break;
+        case 6:
+            // Valid names: skewx(, skewy(, scale(.
+            if ((characters[1] == 'c') || (characters[1] == 'C')) {
+                if (((characters[0] == 's') || (characters[0] == 'S'))
+                    & ((characters[2] == 'a') || (characters[2] == 'A'))
+                    & ((characters[3] == 'l') || (characters[3] == 'L'))
+                    & ((characters[4] == 'e') || (characters[4] == 'E'))
+                    & (characters[5] == '(')) {
+                    m_unit = CSSParser::FNumber;
+                    m_type = WebKitCSSTransformValue::ScaleTransformOperation;
+                    m_allowSingleArgument = true;
+                    m_argCount = 3;
+                }
+            } else if (((characters[0] == 's') || (characters[0] == 'S'))
+                       & ((characters[1] == 'k') || (characters[1] == 'K'))
+                       & ((characters[2] == 'e') || (characters[2] == 'E'))
+                       & ((characters[3] == 'w') || (characters[3] == 'W'))
+                       & (characters[5] == '(')) {
+                if ((characters[4] == 'x') || (characters[4] == 'X')) {
+                    m_unit = CSSParser::FAngle;
+                    m_type = WebKitCSSTransformValue::SkewXTransformOperation;
+                } else if ((characters[4] == 'y') || (characters[4] == 'Y')) {
+                    m_unit = CSSParser::FAngle;
+                    m_type = WebKitCSSTransformValue::SkewYTransformOperation;
+                }
+            }
+            break;
+        case 7:
+            // Valid names: matrix(, rotate(, scalex(, scaley(, scalez(.
+            if ((characters[0] == 'm') || (characters[0] == 'M')) {
+                if (((characters[1] == 'a') || (characters[1] == 'A'))
+                    & ((characters[2] == 't') || (characters[2] == 'T'))
+                    & ((characters[3] == 'r') || (characters[3] == 'R'))
+                    & ((characters[4] == 'i') || (characters[4] == 'I'))
+                    & ((characters[5] == 'x') || (characters[5] == 'X'))
+                    & (characters[6] == '(')) {
+                    m_unit = CSSParser::FNumber;
+                    m_type = WebKitCSSTransformValue::MatrixTransformOperation;
+                    m_argCount = 11;
+                }
+            } else if ((characters[0] == 'r') || (characters[0] == 'R')) {
+                if (((characters[1] == 'o') || (characters[1] == 'O'))
+                    & ((characters[2] == 't') || (characters[2] == 'T'))
+                    & ((characters[3] == 'a') || (characters[3] == 'A'))
+                    & ((characters[4] == 't') || (characters[4] == 'T'))
+                    & ((characters[5] == 'e') || (characters[5] == 'E'))
+                    & (characters[6] == '(')) {
+                    m_unit = CSSParser::FAngle;
+                    m_type = WebKitCSSTransformValue::RotateTransformOperation;
+                }
+            } else if (((characters[0] == 's') || (characters[0] == 'S'))
+                       & ((characters[1] == 'c') || (characters[1] == 'C'))
+                       & ((characters[2] == 'a') || (characters[2] == 'A'))
+                       & ((characters[3] == 'l') || (characters[3] == 'L'))
+                       & ((characters[4] == 'e') || (characters[4] == 'E'))
+                       & (characters[6] == '(')) {
+                if ((characters[5] == 'x') || (characters[5] == 'X')) {
+                    m_unit = CSSParser::FNumber;
+                    m_type = WebKitCSSTransformValue::ScaleXTransformOperation;
+                } else if ((characters[5] == 'y') || (characters[5] == 'Y')) {
+                    m_unit = CSSParser::FNumber;
+                    m_type = WebKitCSSTransformValue::ScaleYTransformOperation;
+                } else if ((characters[5] == 'z') || (characters[5] == 'Z')) {
+                    m_unit = CSSParser::FNumber;
+                    m_type = WebKitCSSTransformValue::ScaleZTransformOperation;
+                }
+            }
+            break;
+        case 8:
+            // Valid names: rotatex(, rotatey(, rotatez(, scale3d(.
+            if ((characters[0] == 's') || (characters[0] == 'S')) {
+                if (((characters[1] == 'c') || (characters[1] == 'C'))
+                    & ((characters[2] == 'a') || (characters[2] == 'A'))
+                    & ((characters[3] == 'l') || (characters[3] == 'L'))
+                    & ((characters[4] == 'e') || (characters[4] == 'E'))
+                    & (characters[5] == '3')
+                    & ((characters[6] == 'd') || (characters[6] == 'D'))
+                    & (characters[7] == '(')) {
+                    m_unit = CSSParser::FNumber;
+                    m_type = WebKitCSSTransformValue::Scale3DTransformOperation;
+                    m_argCount = 5;
+                }
+            } else if (((characters[0] == 'r') || (characters[0] == 'R'))
+                       & ((characters[1] == 'o') || (characters[1] == 'O'))
+                       & ((characters[2] == 't') || (characters[2] == 'T'))
+                       & ((characters[3] == 'a') || (characters[3] == 'A'))
+                       & ((characters[4] == 't') || (characters[4] == 'T'))
+                       & ((characters[5] == 'e') || (characters[5] == 'E'))
+                       & (characters[7] == '(')) {
+                if ((characters[6] == 'x') || (characters[6] == 'X')) {
+                    m_unit = CSSParser::FAngle;
+                    m_type = WebKitCSSTransformValue::RotateXTransformOperation;
+                } else if ((characters[6] == 'y') || (characters[6] == 'Y')) {
+                    m_unit = CSSParser::FAngle;
+                    m_type = WebKitCSSTransformValue::RotateYTransformOperation;
+                } else if ((characters[6] == 'z') || (characters[6] == 'Z')) {
+                    m_unit = CSSParser::FAngle;
+                    m_type = WebKitCSSTransformValue::RotateZTransformOperation;
+                }
+            }
+            break;
+        case 9:
+            // Valid names: matrix3d(, rotate3d(.
+            if ((characters[0] == 'm') || (characters[0] == 'M')) {
+                if (((characters[1] == 'a') || (characters[1] == 'A'))
+                    & ((characters[2] == 't') || (characters[2] == 'T'))
+                    & ((characters[3] == 'r') || (characters[3] == 'R'))
+                    & ((characters[4] == 'i') || (characters[4] == 'I'))
+                    & ((characters[5] == 'x') || (characters[5] == 'X'))
+                    & (characters[6] == '3')
+                    & ((characters[7] == 'd') || (characters[7] == 'D'))
+                    & (characters[8] == '(')) {
+                    m_unit = CSSParser::FNumber;
+                    m_type = WebKitCSSTransformValue::Matrix3DTransformOperation;
+                    m_argCount = 31;
+                }
+            } else if (((characters[0] == 'r') || (characters[0] == 'R'))
+                       & ((characters[1] == 'o') || (characters[1] == 'O'))
+                       & ((characters[2] == 't') || (characters[2] == 'T'))
+                       & ((characters[3] == 'a') || (characters[3] == 'A'))
+                       & ((characters[4] == 't') || (characters[4] == 'T'))
+                       & ((characters[5] == 'e') || (characters[5] == 'E'))
+                       & (characters[6] == '3')
+                       & ((characters[7] == 'd') || (characters[7] == 'D'))
+                       & (characters[8] == '(')) {
+                m_unit = CSSParser::FNumber;
+                m_type = WebKitCSSTransformValue::Rotate3DTransformOperation;
+                m_argCount = 7;
+            }
+            break;
+        case 10:
+            // Valid name: translate(.
+            if (((characters[0] == 't') || (characters[0] == 'T'))
+                & ((characters[1] == 'r') || (characters[1] == 'R'))
+                & ((characters[2] == 'a') || (characters[2] == 'A'))
+                & ((characters[3] == 'n') || (characters[3] == 'N'))
+                & ((characters[4] == 's') || (characters[4] == 'S'))
+                & ((characters[5] == 'l') || (characters[5] == 'L'))
+                & ((characters[6] == 'a') || (characters[6] == 'A'))
+                & ((characters[7] == 't') || (characters[7] == 'T'))
+                & ((characters[8] == 'e') || (characters[8] == 'E'))
+                & (characters[9] == '(')) {
+                m_unit = CSSParser::FLength | CSSParser::FPercent;
                 m_type = WebKitCSSTransformValue::TranslateTransformOperation;
-            else if (equalIgnoringCase(name, "translatex("))
-                m_type = WebKitCSSTransformValue::TranslateXTransformOperation;
-            else if (equalIgnoringCase(name, "translatey("))
-                m_type = WebKitCSSTransformValue::TranslateYTransformOperation;
-            else
-                m_type = WebKitCSSTransformValue::TranslateZTransformOperation;
-        } else if (equalIgnoringCase(name, "translate3d(")) {
-            m_type = WebKitCSSTransformValue::Translate3DTransformOperation;
-            m_argCount = 5;
-            m_unit = CSSParser::FLength | CSSParser::FPercent;
-        } else if (equalIgnoringCase(name, "matrix(")) {
-            m_type = WebKitCSSTransformValue::MatrixTransformOperation;
-            m_argCount = 11;
-            m_unit = CSSParser::FNumber;
-        } else if (equalIgnoringCase(name, "matrix3d(")) {
-            m_type = WebKitCSSTransformValue::Matrix3DTransformOperation;
-            m_argCount = 31;
-            m_unit = CSSParser::FNumber;
-        } else if (equalIgnoringCase(name, "perspective(")) {
-            m_type = WebKitCSSTransformValue::PerspectiveTransformOperation;
-            m_unit = CSSParser::FNumber;
-        }
-
-        if (equalIgnoringCase(name, "scale(") || equalIgnoringCase(name, "skew(") || equalIgnoringCase(name, "translate(")) {
-            m_allowSingleArgument = true;
-            m_argCount = 3;
-        }
+                m_allowSingleArgument = true;
+                m_argCount = 3;
+            }
+            break;
+        case 11:
+            // Valid names: translatex(, translatey(, translatez(.
+            if (((characters[0] == 't') || (characters[0] == 'T'))
+                & ((characters[1] == 'r') || (characters[1] == 'R'))
+                & ((characters[2] == 'a') || (characters[2] == 'A'))
+                & ((characters[3] == 'n') || (characters[3] == 'N'))
+                & ((characters[4] == 's') || (characters[4] == 'S'))
+                & ((characters[5] == 'l') || (characters[5] == 'L'))
+                & ((characters[6] == 'a') || (characters[6] == 'A'))
+                & ((characters[7] == 't') || (characters[7] == 'T'))
+                & ((characters[8] == 'e') || (characters[8] == 'E'))
+                & (characters[10] == '(')) {
+                if ((characters[9] == 'x') || (characters[9] == 'X')) {
+                    m_unit = CSSParser::FLength | CSSParser::FPercent;
+                    m_type = WebKitCSSTransformValue::TranslateXTransformOperation;
+                } else if ((characters[9] == 'y') || (characters[9] == 'Y')) {
+                    m_unit = CSSParser::FLength | CSSParser::FPercent;
+                    m_type = WebKitCSSTransformValue::TranslateYTransformOperation;
+                } else if ((characters[9] == 'z') || (characters[9] == 'Z')) {
+                    m_unit = CSSParser::FLength | CSSParser::FPercent;
+                    m_type = WebKitCSSTransformValue::TranslateZTransformOperation;
+                }
+            }
+            break;
+        case 12:
+            // Valid names: perspective(, translate3d(.
+            if ((characters[0] == 'p') || (characters[0] == 'P')) {
+                if (((characters[1] == 'e') || (characters[1] == 'E'))
+                    & ((characters[2] == 'r') || (characters[2] == 'R'))
+                    & ((characters[3] == 's') || (characters[3] == 'S'))
+                    & ((characters[4] == 'p') || (characters[4] == 'P'))
+                    & ((characters[5] == 'e') || (characters[5] == 'E'))
+                    & ((characters[6] == 'c') || (characters[6] == 'C'))
+                    & ((characters[7] == 't') || (characters[7] == 'T'))
+                    & ((characters[8] == 'i') || (characters[8] == 'I'))
+                    & ((characters[9] == 'v') || (characters[9] == 'V'))
+                    & ((characters[10] == 'e') || (characters[10] == 'E'))
+                    & (characters[11] == '(')) {
+                    m_unit = CSSParser::FNumber;
+                    m_type = WebKitCSSTransformValue::PerspectiveTransformOperation;
+                }
+            } else if (((characters[0] == 't') || (characters[0] == 'T'))
+                       & ((characters[1] == 'r') || (characters[1] == 'R'))
+                       & ((characters[2] == 'a') || (characters[2] == 'A'))
+                       & ((characters[3] == 'n') || (characters[3] == 'N'))
+                       & ((characters[4] == 's') || (characters[4] == 'S'))
+                       & ((characters[5] == 'l') || (characters[5] == 'L'))
+                       & ((characters[6] == 'a') || (characters[6] == 'A'))
+                       & ((characters[7] == 't') || (characters[7] == 'T'))
+                       & ((characters[8] == 'e') || (characters[8] == 'E'))
+                       & (characters[9] == '3')
+                       & ((characters[10] == 'd') || (characters[10] == 'D'))
+                       & (characters[11] == '(')) {
+                m_unit = CSSParser::FLength | CSSParser::FPercent;
+                m_type = WebKitCSSTransformValue::Translate3DTransformOperation;
+                m_argCount = 5;
+            }
+            break;
+        } // end switch ()
     }
 
     WebKitCSSTransformValue::TransformOperationType type() const { return m_type; }
@@ -8009,6 +8194,8 @@ bool CSSParser::parsePerspectiveOrigin(CSSPropertyID propId, CSSPropertyID& prop
 
     switch (propId) {
         case CSSPropertyWebkitPerspectiveOrigin:
+            if (m_valueList->size() > 2)
+                return false;
             parseFillPosition(m_valueList.get(), value, value2);
             break;
         case CSSPropertyWebkitPerspectiveOriginX: {
@@ -9010,7 +9197,7 @@ inline void CSSParser::detectNumberToken(CharacterType* type, int length)
     case 'd':
         if (length == 3 && isASCIIAlphaCaselessEqual(type[1], 'e') && isASCIIAlphaCaselessEqual(type[2], 'g'))
             m_token = DEGS;
-#if ENABLE(CSS_IMAGE_RESOLUTION)
+#if ENABLE(CSS_IMAGE_RESOLUTION) || ENABLE(RESOLUTION_MEDIA_QUERY)
         else if (length > 2 && isASCIIAlphaCaselessEqual(type[1], 'p')) {
             if (length == 4) {
                 // There is a discussion about the name of this unit on www-style.
@@ -9185,6 +9372,13 @@ inline void CSSParser::detectAtToken(int length, bool hasEscape)
             m_token = FONT_FACE_SYM;
         return;
 
+#if ENABLE(SHADOW_DOM)
+    case 'h':
+        if (length == 5 && isEqualToCSSIdentifier(name + 2, "ost"))
+            m_token = HOST_SYM;
+        return;
+#endif
+
     case 'i':
         if (length == 7 && isEqualToCSSIdentifier(name + 2, "mport")) {
             m_parsingMode = MediaQueryMode;
@@ -9308,8 +9502,15 @@ inline void CSSParser::detectAtToken(int length, bool hasEscape)
             return;
 
         case 17:
-            if (!hasEscape && isEqualToCSSIdentifier(name + 2, "webkit-selector"))
+            if (hasEscape)
+                return;
+
+            if (isASCIIAlphaCaselessEqual(name[16], 'r') && isEqualToCSSIdentifier(name + 2, "webkit-selecto"))
                 m_token = WEBKIT_SELECTOR_SYM;
+#if ENABLE(CSS_DEVICE_ADAPTATION)
+            else if (isASCIIAlphaCaselessEqual(name[16], 't') && isEqualToCSSIdentifier(name + 2, "webkit-viewpor"))
+                m_token = WEBKIT_VIEWPORT_RULE_SYM;
+#endif
             return;
 
         case 18:
@@ -10017,6 +10218,24 @@ StyleRuleBase* CSSParser::createFontFaceRule()
     return result;
 }
 
+#if ENABLE(SHADOW_DOM)
+StyleRuleBase* CSSParser::createHostRule(RuleList* rules)
+{
+    m_allowImportRules = m_allowNamespaceDeclarations = false;
+    RefPtr<StyleRuleHost> rule;
+    if (rules)
+        rule = StyleRuleHost::create(*rules);
+    else {
+        RuleList emptyRules;
+        rule = StyleRuleHost::create(emptyRules);
+    }
+    StyleRuleHost* result = rule.get();
+    m_parsedRules.append(rule.release());
+    processAndAddNewRuleToSourceTreeIfNeeded();
+    return result;
+}
+#endif
+
 void CSSParser::addNamespace(const AtomicString& prefix, const AtomicString& uri)
 {
     if (!m_styleSheet || !m_allowNamespaceDeclarations)
@@ -10038,7 +10257,7 @@ void CSSParser::updateSpecifiersWithElementName(const AtomicString& namespacePre
 {
     AtomicString determinedNamespace = namespacePrefix != nullAtom && m_styleSheet ? m_styleSheet->determineNamespace(namespacePrefix) : m_defaultNamespace;
     QualifiedName tag = QualifiedName(namespacePrefix, elementName, determinedNamespace);
-    if (!specifiers->isUnknownPseudoElement()) {
+    if (!specifiers->isCustomPseudoElement()) {
         specifiers->setTag(tag);
         return;
     }
@@ -10047,7 +10266,7 @@ void CSSParser::updateSpecifiersWithElementName(const AtomicString& namespacePre
     CSSParserSelector* history = specifiers;
     while (history->tagHistory()) {
         history = history->tagHistory();
-        if (history->isUnknownPseudoElement() || history->hasShadowDescendant())
+        if (history->isCustomPseudoElement() || history->hasShadowDescendant())
             lastShadowDescendant = history;
     }
 
@@ -10066,12 +10285,12 @@ void CSSParser::updateSpecifiersWithElementName(const AtomicString& namespacePre
 
 CSSParserSelector* CSSParser::updateSpecifiers(CSSParserSelector* specifiers, CSSParserSelector* newSpecifier)
 {
-    if (newSpecifier->isUnknownPseudoElement()) {
+    if (newSpecifier->isCustomPseudoElement()) {
         // Unknown pseudo element always goes at the top of selector chain.
         newSpecifier->appendTagHistory(CSSSelector::ShadowDescendant, sinkFloatingSelector(specifiers));
         return newSpecifier;
     }
-    if (specifiers->isUnknownPseudoElement()) {
+    if (specifiers->isCustomPseudoElement()) {
         // Specifiers for unknown pseudo element go right behind it in the chain.
         specifiers->insertTagHistory(CSSSelector::SubSelector, sinkFloatingSelector(newSpecifier), CSSSelector::ShadowDescendant);
         return specifiers;
@@ -10364,6 +10583,102 @@ void CSSParser::markPropertyEnd(bool isImportantFound, bool isPropertyParsed)
     resetPropertyRange();
 }
 
+#if ENABLE(CSS_DEVICE_ADAPTATION)
+StyleRuleBase* CSSParser::createViewportRule()
+{
+    m_allowImportRules = m_allowNamespaceDeclarations = false;
+
+    RefPtr<StyleRuleViewport> rule = StyleRuleViewport::create();
+
+    rule->setProperties(createStylePropertySet());
+    clearProperties();
+
+    StyleRuleViewport* result = rule.get();
+    m_parsedRules.append(rule.release());
+    processAndAddNewRuleToSourceTreeIfNeeded();
+
+    return result;
+}
+
+bool CSSParser::parseViewportProperty(CSSPropertyID propId, bool important)
+{
+    CSSParserValue* value = m_valueList->current();
+    if (!value)
+        return false;
+
+    int id = value->id;
+    bool validPrimitive = false;
+
+    switch (propId) {
+    case CSSPropertyMinWidth: // auto | device-width | device-height | <length> | <percentage>
+    case CSSPropertyMaxWidth:
+    case CSSPropertyMinHeight:
+    case CSSPropertyMaxHeight:
+        if (id == CSSValueAuto || id == CSSValueDeviceWidth || id == CSSValueDeviceHeight)
+            validPrimitive = true;
+        else
+            validPrimitive = (!id && validUnit(value, FLength | FPercent | FNonNeg));
+        break;
+    case CSSPropertyWidth: // shorthand
+        return parseViewportShorthand(propId, CSSPropertyMinWidth, CSSPropertyMaxWidth, important);
+    case CSSPropertyHeight:
+        return parseViewportShorthand(propId, CSSPropertyMinHeight, CSSPropertyMaxHeight, important);
+    case CSSPropertyMinZoom: // auto | <number> | <percentage>
+    case CSSPropertyMaxZoom:
+    case CSSPropertyZoom:
+        if (id == CSSValueAuto)
+            validPrimitive = true;
+        else
+            validPrimitive = (!id && validUnit(value, FNumber | FPercent | FNonNeg));
+        break;
+    case CSSPropertyUserZoom: // zoom | fixed
+        if (id == CSSValueZoom || id == CSSValueFixed)
+            validPrimitive = true;
+        break;
+    case CSSPropertyOrientation: // auto | portrait | landscape
+        if (id == CSSValueAuto || id == CSSValuePortrait || id == CSSValueLandscape)
+            validPrimitive = true;
+    default:
+        break;
+    }
+
+    RefPtr<CSSValue> parsedValue;
+    if (validPrimitive) {
+        parsedValue = parseValidPrimitive(id, value);
+        m_valueList->next();
+    }
+
+    if (parsedValue) {
+        if (!m_valueList->current() || inShorthand()) {
+            addProperty(propId, parsedValue.release(), important);
+            return true;
+        }
+    }
+
+    return false;
+}
+
+bool CSSParser::parseViewportShorthand(CSSPropertyID propId, CSSPropertyID first, CSSPropertyID second, bool important)
+{
+    unsigned numValues = m_valueList->size();
+
+    if (numValues > 2)
+        return false;
+
+    ShorthandScope scope(this, propId);
+
+    if (!parseViewportProperty(first, important))
+        return false;
+
+    // If just one value is supplied, the second value
+    // is implicitly initialized with the first value.
+    if (numValues == 1)
+        m_valueList->previous();
+
+    return parseViewportProperty(second, important);
+}
+#endif
+
 template <typename CharacterType>
 static CSSPropertyID cssPropertyID(const CharacterType* propertyName, unsigned length)
 {
@@ -10556,20 +10871,16 @@ static bool isCSSTokenizerURL(const String& string)
     return isCSSTokenizerURL(string.characters(), length);
 }
 
-// We use single quotes for now because markup.cpp uses double quotes.
-String quoteCSSString(const String& string)
-{
-    // This function expands each character to at most 3 characters ('\u0010' -> '\' '1' '0') as well as adds
-    // 2 quote characters (before and after). Make sure the resulting size (3 * length + 2) will not overflow unsigned.
-    if (string.length() >= (std::numeric_limits<unsigned>::max() / 3) - 2)
-        return "";
 
+template <typename CharacterType>
+static inline String quoteCSSStringInternal(const CharacterType* characters, unsigned length)
+{
     // For efficiency, we first pre-calculate the length of the quoted string, then we build the actual one.
     // Please see below for the actual logic.
     unsigned quotedStringSize = 2; // Two quotes surrounding the entire string.
     bool afterEscape = false;
-    for (unsigned i = 0; i < string.length(); ++i) {
-        UChar ch = string[i];
+    for (unsigned i = 0; i < length; ++i) {
+        CharacterType ch = characters[i];
         if (ch == '\\' || ch == '\'') {
             quotedStringSize += 2;
             afterEscape = false;
@@ -10582,12 +10893,12 @@ String quoteCSSString(const String& string)
         }
     }
 
-    StringBuffer<UChar> buffer(quotedStringSize);
+    StringBuffer<CharacterType> buffer(quotedStringSize);
     unsigned index = 0;
     buffer[index++] = '\'';
     afterEscape = false;
-    for (unsigned i = 0; i < string.length(); ++i) {
-        UChar ch = string[i];
+    for (unsigned i = 0; i < length; ++i) {
+        CharacterType ch = characters[i];
         if (ch == '\\' || ch == '\'') {
             buffer[index++] = '\\';
             buffer[index++] = ch;
@@ -10610,6 +10921,25 @@ String quoteCSSString(const String& string)
     return String::adopt(buffer);
 }
 
+// We use single quotes for now because markup.cpp uses double quotes.
+String quoteCSSString(const String& string)
+{
+    // This function expands each character to at most 3 characters ('\u0010' -> '\' '1' '0') as well as adds
+    // 2 quote characters (before and after). Make sure the resulting size (3 * length + 2) will not overflow unsigned.
+
+    unsigned length = string.length();
+
+    if (!length)
+        return String("\'\'");
+
+    if (length > std::numeric_limits<unsigned>::max() / 3 - 2)
+        return emptyString();
+
+    if (string.is8Bit())
+        return quoteCSSStringInternal(string.characters8(), length);
+    return quoteCSSStringInternal(string.characters16(), length);
+}
+
 String quoteCSSStringIfNeeded(const String& string)
 {
     return isCSSTokenizerIdentifier(string) ? string : quoteCSSString(string);
diff --git a/Source/WebCore/css/CSSParser.h b/Source/WebCore/css/CSSParser.h
index 75668cf30..2c31794ca 100644
--- a/Source/WebCore/css/CSSParser.h
+++ b/Source/WebCore/css/CSSParser.h
@@ -47,7 +47,6 @@ namespace WebCore {
 
 class CSSBorderImageSliceValue;
 class CSSPrimitiveValue;
-class CSSProperty;
 class CSSSelectorList;
 class CSSValue;
 class CSSValueList;
@@ -282,6 +281,9 @@ public:
     StyleRuleBase* createPageRule(PassOwnPtr<CSSParserSelector> pageSelector);
     StyleRuleBase* createRegionRule(CSSSelectorVector* regionSelector, RuleList* rules);
     StyleRuleBase* createMarginAtRule(CSSSelector::MarginBoxType);
+#if ENABLE(SHADOW_DOM)
+    StyleRuleBase* createHostRule(RuleList* rules);
+#endif
     void startDeclarationsForMarginBox();
     void endDeclarationsForMarginBox();
 
@@ -364,6 +366,12 @@ public:
 
     int token() { return m_token; }
 
+#if ENABLE(CSS_DEVICE_ADAPTATION)
+    void markViewportRuleBodyStart() { m_inViewport = true; }
+    void markViewportRuleBodyEnd() { m_inViewport = false; }
+    StyleRuleBase* createViewportRule();
+#endif
+
     PassRefPtr<CSSPrimitiveValue> createPrimitiveNumericValue(CSSParserValue*);
     PassRefPtr<CSSPrimitiveValue> createPrimitiveStringValue(CSSParserValue*);
 #if ENABLE(CSS_VARIABLES)
@@ -452,8 +460,12 @@ private:
 
     void recheckAtKeyword(const UChar* str, int len);
 
-    void setupParser(const char* prefix, const String&, const char* suffix);
-
+    template<unsigned prefixLength, unsigned suffixLength>
+    inline void setupParser(const char (&prefix)[prefixLength], const String& string, const char (&suffix)[suffixLength])
+    {
+        setupParser(prefix, prefixLength - 1, string, suffix, suffixLength - 1);
+    }
+    void setupParser(const char* prefix, unsigned prefixLength, const String&, const char* suffix, unsigned suffixLength);
     bool inShorthand() const { return m_inParseShorthand; }
 
     bool validWidth(CSSParserValue*);
@@ -511,6 +523,14 @@ private:
     bool m_allowImportRules;
     bool m_allowNamespaceDeclarations;
 
+#if ENABLE(CSS_DEVICE_ADAPTATION)
+    bool parseViewportProperty(CSSPropertyID propId, bool important);
+    bool parseViewportShorthand(CSSPropertyID propId, CSSPropertyID first, CSSPropertyID second, bool important);
+
+    bool inViewport() const { return m_inViewport; }
+    bool m_inViewport;
+#endif
+
     int (CSSParser::*m_lexFunc)(void*);
 
     Vector<RefPtr<StyleRuleBase> > m_parsedRules;
@@ -545,7 +565,7 @@ private:
         FFrequency = 0x0040,
         FPositiveInteger = 0x0080,
         FRelative = 0x0100,
-#if ENABLE(CSS_IMAGE_RESOLUTION)
+#if ENABLE(CSS_IMAGE_RESOLUTION) || ENABLE(RESOLUTION_MEDIA_QUERY)
         FResolution = 0x0200,
 #endif
         FNonNeg = 0x0400
diff --git a/Source/WebCore/css/CSSParserValues.h b/Source/WebCore/css/CSSParserValues.h
index d3fc40353..60986a830 100644
--- a/Source/WebCore/css/CSSParserValues.h
+++ b/Source/WebCore/css/CSSParserValues.h
@@ -191,7 +191,8 @@ public:
     void adoptSelectorVector(CSSSelectorVector&);
 
     CSSSelector::PseudoType pseudoType() const { return m_selector->pseudoType(); }
-    bool isUnknownPseudoElement() const { return m_selector->isUnknownPseudoElement(); }
+    bool isCustomPseudoElement() const { return m_selector->isCustomPseudoElement(); }
+
     bool isSimple() const { return !m_tagHistory && m_selector->isSimple(); }
     bool hasShadowDescendant() const;
 
diff --git a/Source/WebCore/css/CSSPrimitiveValue.cpp b/Source/WebCore/css/CSSPrimitiveValue.cpp
index 55ede8b37..c6726cdf2 100644
--- a/Source/WebCore/css/CSSPrimitiveValue.cpp
+++ b/Source/WebCore/css/CSSPrimitiveValue.cpp
@@ -62,7 +62,7 @@ static inline bool isValidCSSUnitTypeForDoubleConversion(CSSPrimitiveValue::Unit
     case CSSPrimitiveValue::CSS_CM:
     case CSSPrimitiveValue::CSS_DEG:
     case CSSPrimitiveValue::CSS_DIMENSION:
-#if ENABLE(CSS_IMAGE_RESOLUTION)
+#if ENABLE(CSS_IMAGE_RESOLUTION) || ENABLE(RESOLUTION_MEDIA_QUERY)
     case CSSPrimitiveValue::CSS_DPPX:
     case CSSPrimitiveValue::CSS_DPI:
     case CSSPrimitiveValue::CSS_DPCM:
@@ -94,7 +94,7 @@ static inline bool isValidCSSUnitTypeForDoubleConversion(CSSPrimitiveValue::Unit
 #if ENABLE(DASHBOARD_SUPPORT)
     case CSSPrimitiveValue::CSS_DASHBOARD_REGION:
 #endif
-#if !ENABLE(CSS_IMAGE_RESOLUTION)
+#if !ENABLE(CSS_IMAGE_RESOLUTION) && !ENABLE(RESOLUTION_MEDIA_QUERY)
     case CSSPrimitiveValue::CSS_DPPX:
     case CSSPrimitiveValue::CSS_DPI:
     case CSSPrimitiveValue::CSS_DPCM:
@@ -154,7 +154,7 @@ static CSSPrimitiveValue::UnitCategory unitCategory(CSSPrimitiveValue::UnitTypes
     case CSSPrimitiveValue::CSS_VH:
     case CSSPrimitiveValue::CSS_VMIN:
         return CSSPrimitiveValue::UViewportPercentageLength;
-#if ENABLE(CSS_IMAGE_RESOLUTION)
+#if ENABLE(CSS_IMAGE_RESOLUTION) || ENABLE(RESOLUTION_MEDIA_QUERY)
     case CSSPrimitiveValue::CSS_DPPX:
     case CSSPrimitiveValue::CSS_DPI:
     case CSSPrimitiveValue::CSS_DPCM:
@@ -676,7 +676,7 @@ CSSPrimitiveValue::UnitTypes CSSPrimitiveValue::canonicalUnitTypeForCategory(Uni
         return CSS_HZ;
     case UViewportPercentageLength:
         return CSS_UNKNOWN; // Cannot convert between numbers and relative lengths.
-#if ENABLE(CSS_IMAGE_RESOLUTION)
+#if ENABLE(CSS_IMAGE_RESOLUTION) || ENABLE(RESOLUTION_MEDIA_QUERY)
     case UResolution:
         return CSS_DPPX;
 #endif
@@ -896,7 +896,7 @@ String CSSPrimitiveValue::customCssText() const
         case CSS_CM:
             text = formatNumber(m_value.num, "cm");
             break;
-#if ENABLE(CSS_IMAGE_RESOLUTION)
+#if ENABLE(CSS_IMAGE_RESOLUTION) || ENABLE(RESOLUTION_MEDIA_QUERY)
         case CSS_DPPX:
             text = formatNumber(m_value.num, "dppx");
             break;
@@ -1228,7 +1228,7 @@ PassRefPtr<CSSPrimitiveValue> CSSPrimitiveValue::cloneForCSSOM() const
     case CSS_VW:
     case CSS_VH:
     case CSS_VMIN:
-#if ENABLE(CSS_IMAGE_RESOLUTION)
+#if ENABLE(CSS_IMAGE_RESOLUTION) || ENABLE(RESOLUTION_MEDIA_QUERY)
     case CSS_DPPX:
     case CSS_DPI:
     case CSS_DPCM:
diff --git a/Source/WebCore/css/CSSPrimitiveValue.h b/Source/WebCore/css/CSSPrimitiveValue.h
index aa2dbeac3..fcc5b83b8 100644
--- a/Source/WebCore/css/CSSPrimitiveValue.h
+++ b/Source/WebCore/css/CSSPrimitiveValue.h
@@ -143,7 +143,7 @@ public:
         UTime,
         UFrequency,
         UViewportPercentageLength,
-#if ENABLE(CSS_IMAGE_RESOLUTION)
+#if ENABLE(CSS_IMAGE_RESOLUTION) || ENABLE(RESOLUTION_MEDIA_QUERY)
         UResolution,
 #endif
         UOther
@@ -181,6 +181,10 @@ public:
     bool isCalculated() const { return m_primitiveUnitType == CSS_CALC; }
     bool isCalculatedPercentageWithNumber() const { return primitiveType() == CSS_CALC_PERCENTAGE_WITH_NUMBER; }
     bool isCalculatedPercentageWithLength() const { return primitiveType() == CSS_CALC_PERCENTAGE_WITH_LENGTH; }
+    bool isDotsPerInch() const { return primitiveType() == CSS_DPI; }
+    bool isDotsPerPixel() const { return primitiveType() == CSS_DPPX; }
+    bool isDotsPerCentimeter() const { return primitiveType() == CSS_DPCM; }
+
 #if ENABLE(CSS_VARIABLES)
     bool isVariableName() const { return primitiveType() == CSS_VARIABLE_NAME; }
 #endif
diff --git a/Source/WebCore/css/CSSPrimitiveValueMappings.h b/Source/WebCore/css/CSSPrimitiveValueMappings.h
index 984c0826e..9b198aacd 100644
--- a/Source/WebCore/css/CSSPrimitiveValueMappings.h
+++ b/Source/WebCore/css/CSSPrimitiveValueMappings.h
@@ -1440,31 +1440,46 @@ template<> inline CSSPrimitiveValue::operator EFloat() const
     return NoFloat;
 }
 
-template<> inline CSSPrimitiveValue::CSSPrimitiveValue(EKHTMLLineBreak e)
+template<> inline CSSPrimitiveValue::CSSPrimitiveValue(LineBreak e)
     : CSSValue(PrimitiveClass)
 {
     m_primitiveUnitType = CSS_IDENT;
     switch (e) {
-        case LBNORMAL:
-            m_value.ident = CSSValueNormal;
-            break;
-        case AFTER_WHITE_SPACE:
-            m_value.ident = CSSValueAfterWhiteSpace;
-            break;
+    case LineBreakAuto:
+        m_value.ident = CSSValueAuto;
+        break;
+    case LineBreakLoose:
+        m_value.ident = CSSValueLoose;
+        break;
+    case LineBreakNormal:
+        m_value.ident = CSSValueNormal;
+        break;
+    case LineBreakStrict:
+        m_value.ident = CSSValueStrict;
+        break;
+    case LineBreakAfterWhiteSpace:
+        m_value.ident = CSSValueAfterWhiteSpace;
+        break;
     }
 }
 
-template<> inline CSSPrimitiveValue::operator EKHTMLLineBreak() const
+template<> inline CSSPrimitiveValue::operator LineBreak() const
 {
     switch (m_value.ident) {
-        case CSSValueAfterWhiteSpace:
-            return AFTER_WHITE_SPACE;
-        case CSSValueNormal:
-            return LBNORMAL;
+    case CSSValueAuto:
+        return LineBreakAuto;
+    case CSSValueLoose:
+        return LineBreakLoose;
+    case CSSValueNormal:
+        return LineBreakNormal;
+    case CSSValueStrict:
+        return LineBreakStrict;
+    case CSSValueAfterWhiteSpace:
+        return LineBreakAfterWhiteSpace;
     }
 
     ASSERT_NOT_REACHED();
-    return LBNORMAL;
+    return LineBreakAuto;
 }
 
 template<> inline CSSPrimitiveValue::CSSPrimitiveValue(EListStylePosition e)
@@ -3400,41 +3415,41 @@ template<> inline CSSPrimitiveValue::operator ESpeak() const
 }
 
 #if ENABLE(CSS_SHADERS)
-template<> inline CSSPrimitiveValue::CSSPrimitiveValue(CustomFilterOperation::MeshBoxType meshBoxType)
+template<> inline CSSPrimitiveValue::CSSPrimitiveValue(CustomFilterMeshBoxType meshBoxType)
     : CSSValue(PrimitiveClass)
 {
     m_primitiveUnitType = CSS_IDENT;
     switch (meshBoxType) {
-    case CustomFilterOperation::FILTER_BOX:
+    case MeshBoxTypeFilter:
         m_value.ident = CSSValueFilterBox;
         break;
-    case CustomFilterOperation::BORDER_BOX:
+    case MeshBoxTypeBorder:
         m_value.ident = CSSValueBorderBox;
         break;
-    case CustomFilterOperation::PADDING_BOX:
+    case MeshBoxTypePadding:
         m_value.ident = CSSValuePaddingBox;
         break;
-    case CustomFilterOperation::CONTENT_BOX:
+    case MeshBoxTypeContent:
         m_value.ident = CSSValueContentBox;
         break;
     }
 }
 
-template<> inline CSSPrimitiveValue::operator CustomFilterOperation::MeshBoxType() const
+template<> inline CSSPrimitiveValue::operator CustomFilterMeshBoxType() const
 {
     switch (m_value.ident) {
     case CSSValueFilterBox:
-        return CustomFilterOperation::FILTER_BOX;
+        return MeshBoxTypeFilter;
     case CSSValueBorderBox:
-        return CustomFilterOperation::BORDER_BOX;
+        return MeshBoxTypeBorder;
     case CSSValuePaddingBox:
-        return CustomFilterOperation::PADDING_BOX;
+        return MeshBoxTypePadding;
     case CSSValueContentBox:
-        return CustomFilterOperation::CONTENT_BOX;
+        return MeshBoxTypeContent;
     }
 
     ASSERT_NOT_REACHED();
-    return CustomFilterOperation::FILTER_BOX;
+    return MeshBoxTypeFilter;
 }
 #endif // ENABLE(CSS_SHADERS)
 
diff --git a/Source/WebCore/css/CSSProperty.cpp b/Source/WebCore/css/CSSProperty.cpp
index b412fdbfa..79be67b46 100644
--- a/Source/WebCore/css/CSSProperty.cpp
+++ b/Source/WebCore/css/CSSProperty.cpp
@@ -41,29 +41,6 @@ struct SameSizeAsCSSProperty {
 
 COMPILE_ASSERT(sizeof(CSSProperty) == sizeof(SameSizeAsCSSProperty), CSSProperty_should_stay_small);
 
-String CSSProperty::cssName() const
-{
-#if ENABLE(CSS_VARIABLES)
-    if (id() == CSSPropertyVariable) {
-        ASSERT(value()->isVariableValue());
-        return "-webkit-var-" + static_cast<CSSVariableValue*>(value())->name();
-    }
-#endif
-    return getPropertyNameString(id());
-}
-
-String CSSProperty::cssText() const
-{
-    StringBuilder result;
-    result.append(cssName());
-    result.appendLiteral(": ");
-    result.append(m_value->cssText());
-    if (isImportant())
-        result.appendLiteral(" !important");
-    result.append(';');
-    return result.toString();
-}
-
 void CSSProperty::wrapValueInCommaSeparatedList()
 {
     RefPtr<CSSValue> value = m_value.release();
@@ -704,6 +681,12 @@ bool CSSProperty::isInheritedProperty(CSSPropertyID propertyID)
 #if ENABLE(DRAGGABLE_REGION)
     case CSSPropertyWebkitAppRegion:
 #endif
+#if ENABLE(CSS_DEVICE_ADAPTATION)
+    case CSSPropertyMaxZoom:
+    case CSSPropertyMinZoom:
+    case CSSPropertyOrientation:
+    case CSSPropertyUserZoom:
+#endif
         return false;
     case CSSPropertyInvalid:
         ASSERT_NOT_REACHED();
diff --git a/Source/WebCore/css/CSSProperty.h b/Source/WebCore/css/CSSProperty.h
index fe76e846a..27650ef74 100644
--- a/Source/WebCore/css/CSSProperty.h
+++ b/Source/WebCore/css/CSSProperty.h
@@ -31,30 +31,47 @@
 
 namespace WebCore {
 
-class CSSProperty {
-public:
-    CSSProperty(CSSPropertyID propID, PassRefPtr<CSSValue> value, bool important = false, CSSPropertyID shorthandID = CSSPropertyInvalid, bool implicit = false)
-        : m_id(propID)
+union StylePropertyMetadata {
+    StylePropertyMetadata(CSSPropertyID propertyID, CSSPropertyID shorthandID, bool important, bool implicit, bool inherited)
+        : m_propertyID(propertyID)
         , m_shorthandID(shorthandID)
         , m_important(important)
         , m_implicit(implicit)
-        , m_inherited(isInheritedProperty(propID))
+        , m_inherited(inherited)
+    {
+    }
+
+    unsigned m_bits;
+    struct {
+        unsigned m_propertyID : 14;
+        unsigned m_shorthandID : 14; // If this property was set as part of a shorthand, gives the shorthand.
+        unsigned m_important : 1;
+        unsigned m_implicit : 1; // Whether or not the property was set implicitly as the result of a shorthand.
+        unsigned m_inherited : 1;
+    };
+};
+
+class CSSProperty {
+public:
+    CSSProperty(CSSPropertyID propertyID, PassRefPtr<CSSValue> value, bool important = false, CSSPropertyID shorthandID = CSSPropertyInvalid, bool implicit = false)
+        : m_metadata(propertyID, shorthandID, important, implicit, isInheritedProperty(propertyID))
         , m_value(value)
     {
     }
 
-    CSSPropertyID id() const { return static_cast<CSSPropertyID>(m_id); }
-    CSSPropertyID shorthandID() const { return static_cast<CSSPropertyID>(m_shorthandID); }
+    // FIXME: Remove this.
+    CSSProperty(StylePropertyMetadata metadata, CSSValue* value)
+        : m_metadata(metadata)
+        , m_value(value)
+    {
+    }
 
-    bool isImportant() const { return m_important; }
-    bool isImplicit() const { return m_implicit; }
-    bool isInherited() const { return m_inherited; }
+    CSSPropertyID id() const { return static_cast<CSSPropertyID>(m_metadata.m_propertyID); }
+    CSSPropertyID shorthandID() const { return static_cast<CSSPropertyID>(m_metadata.m_shorthandID); }
+    bool isImportant() const { return m_metadata.m_important; }
 
     CSSValue* value() const { return m_value.get(); }
 
-    String cssName() const;
-    String cssText() const;
-
     void wrapValueInCommaSeparatedList();
 
     static CSSPropertyID resolveDirectionAwareProperty(CSSPropertyID, TextDirection, WritingMode);
@@ -62,14 +79,10 @@ public:
 
     void reportMemoryUsage(MemoryObjectInfo*) const;
 
-private:
-    // Make sure the following fits in 4 bytes. Really.
-    unsigned m_id : 14;
-    unsigned m_shorthandID : 14; // If this property was set as part of a shorthand, gives the shorthand.
-    unsigned m_important : 1;
-    unsigned m_implicit : 1; // Whether or not the property was set implicitly as the result of a shorthand.
-    unsigned m_inherited : 1;
+    StylePropertyMetadata metadata() const { return m_metadata; }
 
+private:
+    StylePropertyMetadata m_metadata;
     RefPtr<CSSValue> m_value;
 };
 
diff --git a/Source/WebCore/css/CSSPropertyNames.in b/Source/WebCore/css/CSSPropertyNames.in
index 8776e04be..7f699e383 100644
--- a/Source/WebCore/css/CSSPropertyNames.in
+++ b/Source/WebCore/css/CSSPropertyNames.in
@@ -402,6 +402,12 @@ z-index
 -webkit-wrap-through
 -webkit-wrap
 #endif
+#if defined(ENABLE_CSS_DEVICE_ADAPTATION) && ENABLE_CSS_DEVICE_ADAPTATION
+max-zoom
+min-zoom
+orientation
+user-zoom
+#endif
 #if defined(ENABLE_TOUCH_EVENTS) && ENABLE_TOUCH_EVENTS
 -webkit-tap-highlight-color
 #endif
diff --git a/Source/WebCore/css/CSSPropertySourceData.h b/Source/WebCore/css/CSSPropertySourceData.h
index 469bdb630..8982acf73 100644
--- a/Source/WebCore/css/CSSPropertySourceData.h
+++ b/Source/WebCore/css/CSSPropertySourceData.h
@@ -94,7 +94,9 @@ struct CSSRuleSourceData : public RefCounted<CSSRuleSourceData> {
         FONT_FACE_RULE,
         PAGE_RULE,
         KEYFRAMES_RULE,
-        REGION_RULE
+        REGION_RULE,
+        HOST_RULE,
+        VIEWPORT_RULE
     };
 
     static PassRefPtr<CSSRuleSourceData> create(Type type)
diff --git a/Source/WebCore/css/CSSRule.cpp b/Source/WebCore/css/CSSRule.cpp
index cd533d9a8..6c522bd03 100644
--- a/Source/WebCore/css/CSSRule.cpp
+++ b/Source/WebCore/css/CSSRule.cpp
@@ -30,12 +30,13 @@
 #include "CSSStyleRule.h"
 #include "CSSStyleSheet.h"
 #include "CSSUnknownRule.h"
-#include "WebKitCSSKeyframeRule.h"
-#include "WebKitCSSKeyframesRule.h"
-#include "WebKitCSSRegionRule.h"
 #include "NotImplemented.h"
 #include "StyleRule.h"
 #include "StyleSheetContents.h"
+#include "WebKitCSSKeyframeRule.h"
+#include "WebKitCSSKeyframesRule.h"
+#include "WebKitCSSRegionRule.h"
+#include "WebKitCSSViewportRule.h"
 
 namespace WebCore {
 
@@ -50,6 +51,10 @@ COMPILE_ASSERT(sizeof(CSSRule) == sizeof(SameSizeAsCSSRule), CSSRule_should_stay
 COMPILE_ASSERT(StyleRuleBase::Region == static_cast<StyleRuleBase::Type>(CSSRule::WEBKIT_REGION_RULE), enums_should_match);
 #endif
 
+#if ENABLE(CSS_DEVICE_ADAPTATION)
+COMPILE_ASSERT(StyleRuleBase::Viewport == static_cast<StyleRuleBase::Type>(CSSRule::WEBKIT_VIEWPORT_RULE), enums_should_match);
+#endif
+
 void CSSRule::setCssText(const String& /*cssText*/, ExceptionCode& /*ec*/)
 {
     notImplemented();
@@ -76,6 +81,10 @@ String CSSRule::cssText() const
         return static_cast<const WebKitCSSKeyframesRule*>(this)->cssText();
     case WEBKIT_KEYFRAME_RULE:
         return static_cast<const WebKitCSSKeyframeRule*>(this)->cssText();
+#if ENABLE(CSS_DEVICE_ADAPTATION)
+    case WEBKIT_VIEWPORT_RULE:
+        return static_cast<const WebKitCSSViewportRule*>(this)->cssText();
+#endif
 #if ENABLE(CSS_REGIONS)
     case WEBKIT_REGION_RULE:
         return static_cast<const WebKitCSSRegionRule*>(this)->cssText();
@@ -115,6 +124,11 @@ void CSSRule::destroy()
     case WEBKIT_KEYFRAME_RULE:
         delete static_cast<WebKitCSSKeyframeRule*>(this);
         return;
+#if ENABLE(CSS_DEVICE_ADAPTATION)
+    case WEBKIT_VIEWPORT_RULE:
+        delete static_cast<WebKitCSSViewportRule*>(this);
+        return;
+#endif
 #if ENABLE(CSS_REGIONS)
     case WEBKIT_REGION_RULE:
         delete static_cast<WebKitCSSRegionRule*>(this);
@@ -155,6 +169,11 @@ void CSSRule::reattach(StyleRuleBase* rule)
         // No need to reattach, the underlying data is shareable on mutation.
         ASSERT_NOT_REACHED();
         return;
+#if ENABLE(CSS_DEVICE_ADAPTATION)
+    case WEBKIT_VIEWPORT_RULE:
+        static_cast<WebKitCSSViewportRule*>(this)->reattach(static_cast<StyleRuleViewport*>(rule));
+        return;
+#endif
 #if ENABLE(CSS_REGIONS)
     case WEBKIT_REGION_RULE:
         static_cast<WebKitCSSRegionRule*>(this)->reattach(static_cast<StyleRuleRegion*>(rule));
@@ -194,6 +213,11 @@ void CSSRule::reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
     case WEBKIT_KEYFRAME_RULE:
         static_cast<const WebKitCSSKeyframeRule*>(this)->reportDescendantMemoryUsage(memoryObjectInfo);
         return;
+#if ENABLE(CSS_DEVICE_ADAPTATION)
+    case WEBKIT_VIEWPORT_RULE:
+        static_cast<const WebKitCSSViewportRule*>(this)->reportDescendantMemoryUsage(memoryObjectInfo);
+        return;
+#endif
 #if ENABLE(CSS_REGIONS)
     case WEBKIT_REGION_RULE:
         static_cast<const WebKitCSSRegionRule*>(this)->reportDescendantMemoryUsage(memoryObjectInfo);
diff --git a/Source/WebCore/css/CSSRule.h b/Source/WebCore/css/CSSRule.h
index b31fe7b8d..ab3004887 100644
--- a/Source/WebCore/css/CSSRule.h
+++ b/Source/WebCore/css/CSSRule.h
@@ -57,6 +57,9 @@ public:
         // <https://bugs.webkit.org/show_bug.cgi?id=71293>.
         WEBKIT_KEYFRAMES_RULE,
         WEBKIT_KEYFRAME_RULE,
+#if ENABLE(CSS_DEVICE_ADAPTATION)
+        WEBKIT_VIEWPORT_RULE = 15,
+#endif
 #if ENABLE(CSS_REGIONS)
         WEBKIT_REGION_RULE = 16
 #endif
@@ -73,6 +76,10 @@ public:
     bool isStyleRule() const { return type() == STYLE_RULE; }
     bool isImportRule() const { return type() == IMPORT_RULE; }
 
+#if ENABLE(CSS_DEVICE_ADAPTATION)
+    bool isViewportRule() const { return type() == WEBKIT_VIEWPORT_RULE; }
+#endif
+
 #if ENABLE(CSS_REGIONS)
     bool isRegionRule() const { return type() == WEBKIT_REGION_RULE; }
 #endif
diff --git a/Source/WebCore/css/CSSSelector.cpp b/Source/WebCore/css/CSSSelector.cpp
index d2ba75677..c9dd1937a 100644
--- a/Source/WebCore/css/CSSSelector.cpp
+++ b/Source/WebCore/css/CSSSelector.cpp
@@ -218,6 +218,8 @@ PseudoId CSSSelector::pseudoId(PseudoType type)
     case PseudoRightPage:
     case PseudoInRange:
     case PseudoOutOfRange:
+    case PseudoUserAgentCustomElement:
+    case PseudoWebKitCustomElement:
         return NOPSEUDO;
     case PseudoNotParsed:
         ASSERT_NOT_REACHED();
@@ -387,12 +389,22 @@ CSSSelector::PseudoType CSSSelector::parsePseudoType(const AtomicString& name)
         return PseudoUnknown;
     HashMap<AtomicStringImpl*, CSSSelector::PseudoType>* nameToPseudoType = nameToPseudoTypeMap();
     HashMap<AtomicStringImpl*, CSSSelector::PseudoType>::iterator slot = nameToPseudoType->find(name.impl());
-    return slot == nameToPseudoType->end() ? PseudoUnknown : slot->value;
+
+    if (slot != nameToPseudoType->end())
+        return slot->value;
+
+    if (name.startsWith("-webkit-"))
+        return PseudoWebKitCustomElement;
+    if (name.startsWith("x-"))
+        return PseudoUserAgentCustomElement;
+
+    return PseudoUnknown;
 }
 
-bool CSSSelector::isUnknownPseudoType(const AtomicString& name)
+bool CSSSelector::isCustomPseudoType(const AtomicString& name)
 {
-    return parsePseudoType(name) == PseudoUnknown;
+    CSSSelector::PseudoType type = parsePseudoType(name);
+    return type == PseudoUserAgentCustomElement || type == PseudoWebKitCustomElement;
 }
 
 void CSSSelector::extractPseudoType() const
@@ -420,6 +432,8 @@ void CSSSelector::extractPseudoType() const
     case PseudoScrollbarTrack:
     case PseudoScrollbarTrackPiece:
     case PseudoSelection:
+    case PseudoUserAgentCustomElement:
+    case PseudoWebKitCustomElement:
         element = true;
         break;
     case PseudoUnknown:
@@ -627,17 +641,19 @@ String CSSSelector::selectorText() const
 
     if (CSSSelector* tagHistory = cs->tagHistory()) {
         String tagHistoryText = tagHistory->selectorText();
-        if (cs->relation() == CSSSelector::DirectAdjacent)
+        switch (cs->relation()) {
+        case CSSSelector::Descendant:
+            return tagHistoryText + " " + str.toString();
+        case CSSSelector::Child:
+            return tagHistoryText + " > " + str.toString();
+        case CSSSelector::DirectAdjacent:
             return tagHistoryText + " + " + str.toString();
-        else if (cs->relation() == CSSSelector::IndirectAdjacent)
+        case CSSSelector::IndirectAdjacent:
             return tagHistoryText + " ~ " + str.toString();
-        else if (cs->relation() == CSSSelector::Child)
-            return tagHistoryText + " > " + str.toString();
-        else if (cs->relation() == CSSSelector::ShadowDescendant)
+        case CSSSelector::SubSelector:
+            ASSERT_NOT_REACHED();
+        case CSSSelector::ShadowDescendant:
             return tagHistoryText + str.toString();
-        else {
-            // Descendant
-            return tagHistoryText + " " + str.toString();
         }
     }
 
diff --git a/Source/WebCore/css/CSSSelector.h b/Source/WebCore/css/CSSSelector.h
index 5ca24f4e0..aee5074d7 100644
--- a/Source/WebCore/css/CSSSelector.h
+++ b/Source/WebCore/css/CSSSelector.h
@@ -154,6 +154,8 @@ namespace WebCore {
 #endif
             PseudoInRange,
             PseudoOutOfRange,
+            PseudoUserAgentCustomElement,
+            PseudoWebKitCustomElement,
         };
 
         enum MarginBoxType {
@@ -183,7 +185,7 @@ namespace WebCore {
         }
 
         static PseudoType parsePseudoType(const AtomicString&);
-        static bool isUnknownPseudoType(const AtomicString&);
+        static bool isCustomPseudoType(const AtomicString&);        
         static PseudoId pseudoId(PseudoType);
 
         // Selectors are kept in an array by CSSSelectorList. The next component of the selector is
@@ -211,6 +213,7 @@ namespace WebCore {
 
         bool matchesPseudoElement() const;
         bool isUnknownPseudoElement() const;
+        bool isCustomPseudoElement() const;
         bool isSiblingSelector() const;
         bool isAttributeSelector() const;
 
@@ -291,6 +294,11 @@ inline bool CSSSelector::isUnknownPseudoElement() const
     return m_match == PseudoElement && m_pseudoType == PseudoUnknown;
 }
 
+inline bool CSSSelector::isCustomPseudoElement() const
+{
+    return m_match == PseudoElement && (m_pseudoType == PseudoUserAgentCustomElement || m_pseudoType == PseudoWebKitCustomElement);
+}
+
 inline bool CSSSelector::isSiblingSelector() const
 {
     PseudoType type = pseudoType();
diff --git a/Source/WebCore/css/CSSSelectorList.cpp b/Source/WebCore/css/CSSSelectorList.cpp
index 56d2859d2..6a8db4f3a 100644
--- a/Source/WebCore/css/CSSSelectorList.cpp
+++ b/Source/WebCore/css/CSSSelectorList.cpp
@@ -197,17 +197,17 @@ bool CSSSelectorList::selectorsNeedNamespaceResolution()
     return forEachSelector(functor, this);
 }
 
-class SelectorHasUnknownPseudoElementFunctor {
+class SelectorHasInvalidSelectorFunctor {
 public:
     bool operator()(CSSSelector* selector)
     {
-        return selector->isUnknownPseudoElement();
+        return selector->isUnknownPseudoElement() || selector->isCustomPseudoElement();
     }
 };
 
-bool CSSSelectorList::hasUnknownPseudoElements() const
+bool CSSSelectorList::hasInvalidSelector() const
 {
-    SelectorHasUnknownPseudoElementFunctor functor;
+    SelectorHasInvalidSelectorFunctor functor;
     return forEachSelector(functor, this);
 }
 
diff --git a/Source/WebCore/css/CSSSelectorList.h b/Source/WebCore/css/CSSSelectorList.h
index d2ce1134c..83ecf9b3f 100644
--- a/Source/WebCore/css/CSSSelectorList.h
+++ b/Source/WebCore/css/CSSSelectorList.h
@@ -59,7 +59,7 @@ public:
     }
 
     bool selectorsNeedNamespaceResolution();
-    bool hasUnknownPseudoElements() const;
+    bool hasInvalidSelector() const;
 
     String selectorsText() const;
 
diff --git a/Source/WebCore/css/CSSStyleDeclaration.h b/Source/WebCore/css/CSSStyleDeclaration.h
index 3247d1eae..0cd794c3f 100644
--- a/Source/WebCore/css/CSSStyleDeclaration.h
+++ b/Source/WebCore/css/CSSStyleDeclaration.h
@@ -23,6 +23,7 @@
 
 #include "CSSPropertyNames.h"
 #include "CSSRule.h"
+#include "StylePropertySet.h"
 #include <wtf/Forward.h>
 
 namespace WebCore {
@@ -30,7 +31,6 @@ namespace WebCore {
 class CSSProperty;
 class CSSStyleSheet;
 class CSSValue;
-class StylePropertySet;
 class StyledElement;
 
 typedef int ExceptionCode;
@@ -66,7 +66,7 @@ public:
     virtual PassRefPtr<StylePropertySet> copy() const = 0;
     virtual PassRefPtr<StylePropertySet> makeMutable() = 0;
 
-    virtual bool cssPropertyMatches(const CSSProperty*) const = 0;
+    virtual bool cssPropertyMatches(const StylePropertySet::PropertyReference&) const = 0;
     virtual CSSStyleSheet* parentStyleSheet() const { return 0; }
 
     virtual void reportMemoryUsage(MemoryObjectInfo*) const = 0;
diff --git a/Source/WebCore/css/CSSValueKeywords.in b/Source/WebCore/css/CSSValueKeywords.in
index c60aa586d..4b9cc6ea6 100644
--- a/Source/WebCore/css/CSSValueKeywords.in
+++ b/Source/WebCore/css/CSSValueKeywords.in
@@ -621,6 +621,10 @@ space
 //
 // CSS_PROP__KHTML_LINE_BREAK
 //
+// auto
+loose
+// normal
+strict
 after-white-space
 
 // -webkit-appearance
@@ -771,6 +775,24 @@ step-end
 document
 reset
 
+#if defined(ENABLE_CSS_DEVICE_ADAPTATION) && ENABLE_CSS_DEVICE_ADAPTATION
+//
+// CSS_PROP_USER_ZOOM
+//
+// fixed
+zoom
+
+//
+// CSS_PROP_MIN_WIDTH
+// CSS_PROP_MAX_WIDTH
+// CSS_PROP_MIN_HEIGHT
+// CSS_PROP_MAX_HEIGHT
+//
+// auto
+device-width
+device-height
+#endif
+
 //
 // CSS_PROP_POINTER_EVENTS
 //
diff --git a/Source/WebCore/css/CSSValueList.h b/Source/WebCore/css/CSSValueList.h
index 06415fb18..3d897bcfe 100644
--- a/Source/WebCore/css/CSSValueList.h
+++ b/Source/WebCore/css/CSSValueList.h
@@ -50,6 +50,7 @@ public:
 
     size_t length() const { return m_values.size(); }
     CSSValue* item(size_t index) { return index < m_values.size() ? m_values[index].get() : 0; }
+    const CSSValue* item(size_t index) const { return index < m_values.size() ? m_values[index].get() : 0; }
     CSSValue* itemWithoutBoundsCheck(size_t index) { return m_values[index].get(); }
 
     void append(PassRefPtr<CSSValue> value) { m_values.append(value); }
diff --git a/Tools/WebKitTestRunner/InjectedBundle/qt/QtInitializeTestFonts.cpp b/Source/WebCore/css/CachedSVGDocumentReference.h
index fcacf9778..2a253abd4 100644
--- a/Tools/WebKitTestRunner/InjectedBundle/qt/QtInitializeTestFonts.cpp
+++ b/Source/WebCore/css/CachedSVGDocumentReference.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2012 Nokia Corporation and/or its subsidiary(-ies)
+ * Copyright (C) 2012 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -10,9 +10,6 @@
  * 2.  Redistributions in binary form must reproduce the above copyright
  *     notice, this list of conditions and the following disclaimer in the
  *     documentation and/or other materials provided with the distribution.
- * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
- *     its contributors may be used to endorse or promote products derived
- *     from this software without specific prior written permission.
  *
  * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
  * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
@@ -26,6 +23,28 @@
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#include "config.h"
-#include "../../../DumpRenderTree/qt/QtInitializeTestFonts.cpp"
+#ifndef CachedSVGDocumentReference_h
+#define CachedSVGDocumentReference_h
 
+#if ENABLE(SVG) && ENABLE(CSS_FILTERS)
+#include "CachedResourceHandle.h"
+#include "FilterOperation.h"
+
+namespace WebCore {
+
+class CachedSVGDocument;
+
+class CachedSVGDocumentReference : public ReferenceFilterOperation::Data, public CachedSVGDocumentClient {
+public:
+    CachedSVGDocumentReference(CachedSVGDocument* document) : m_document(document) { m_document->addClient(this); }
+    virtual ~CachedSVGDocumentReference() { m_document->removeClient(this); }
+    CachedSVGDocument* document() { return m_document.get(); }
+private:
+    CachedResourceHandle<CachedSVGDocument> m_document;
+};
+
+};
+
+#endif
+
+#endif
diff --git a/Source/WebCore/css/MediaFeatureNames.h b/Source/WebCore/css/MediaFeatureNames.h
index b08439e4a..26668ae46 100644
--- a/Source/WebCore/css/MediaFeatureNames.h
+++ b/Source/WebCore/css/MediaFeatureNames.h
@@ -47,6 +47,7 @@ namespace WebCore {
     macro(max_height, "max-height") \
     macro(max_monochrome, "max-monochrome") \
     macro(max_width, "max-width") \
+    macro(max_resolution, "max-resolution") \
     macro(min_color, "min-color") \
     macro(min_aspect_ratio, "min-aspect-ratio") \
     macro(min_device_aspect_ratio, "min-device-aspect-ratio") \
@@ -56,7 +57,9 @@ namespace WebCore {
     macro(min_height, "min-height") \
     macro(min_monochrome, "min-monochrome") \
     macro(min_width, "min-width") \
+    macro(min_resolution, "min-resolution") \
     macro(pointer, "pointer") \
+    macro(resolution, "resolution") \
     macro(transform_2d, "-webkit-transform-2d") \
     macro(transform_3d, "-webkit-transform-3d") \
     macro(transition, "-webkit-transition") \
diff --git a/Source/WebCore/css/MediaQueryEvaluator.cpp b/Source/WebCore/css/MediaQueryEvaluator.cpp
index daa490b8b..2cf69990d 100644
--- a/Source/WebCore/css/MediaQueryEvaluator.cpp
+++ b/Source/WebCore/css/MediaQueryEvaluator.cpp
@@ -29,11 +29,12 @@
 #include "MediaQueryEvaluator.h"
 
 #include "CSSAspectRatioValue.h"
-#include "Chrome.h"
-#include "ChromeClient.h"
 #include "CSSPrimitiveValue.h"
 #include "CSSValueKeywords.h"
 #include "CSSValueList.h"
+#include "Chrome.h"
+#include "ChromeClient.h"
+#include "DOMWindow.h"
 #include "FloatRect.h"
 #include "Frame.h"
 #include "FrameView.h"
@@ -45,8 +46,9 @@
 #include "NodeRenderStyle.h"
 #include "Page.h"
 #include "PlatformScreen.h"
-#include "RenderView.h"
 #include "RenderStyle.h"
+#include "RenderView.h"
+#include "Screen.h"
 #include "Settings.h"
 #include "StyleResolver.h"
 #include <wtf/HashMap.h>
@@ -66,15 +68,13 @@ typedef HashMap<AtomicStringImpl*, EvalFunc> FunctionMap;
 static FunctionMap* gFunctionMap;
 
 /*
- * FIXME: following media features are not implemented: color_index, scan, resolution
+ * FIXME: following media features are not implemented: color_index, scan
  *
  * color_index, min-color-index, max_color_index: It's unknown how to retrieve
  * the information if the display mode is indexed
  * scan: The "scan" media feature describes the scanning process of
  * tv output devices. It's unknown how to retrieve this information from
  * the platform
- * resolution, min-resolution, max-resolution: css parser doesn't seem to
- * support CSS_DIMENSION
  */
 
 MediaQueryEvaluator::MediaQueryEvaluator(bool mediaFeatureResult)
@@ -197,6 +197,23 @@ static bool compareAspectRatioValue(CSSValue* value, int width, int height, Medi
     return false;
 }
 
+#if ENABLE(RESOLUTION_MEDIA_QUERY)
+static bool compareResolution(float min, float max, float value, MediaFeaturePrefix op)
+{
+    switch (op) {
+    case NoPrefix:
+        // A 'resolution' (without a "min-" or "max-" prefix) query
+        // never matches a device with non-square pixels.
+        return value == min && value == max;
+    case MinPrefix:
+        return min >= value;
+    case MaxPrefix:
+        return max <= value;
+    }
+    return false;
+}
+#endif
+
 static bool numberValue(CSSValue* value, float& result)
 {
     if (value->isPrimitiveValue()
@@ -272,10 +289,128 @@ static bool device_aspect_ratioMediaFeatureEval(CSSValue* value, RenderStyle*, F
 
 static bool device_pixel_ratioMediaFeatureEval(CSSValue *value, RenderStyle*, Frame* frame, MediaFeaturePrefix op)
 {
-    if (value)
-        return value->isPrimitiveValue() && compareValue(frame->page()->deviceScaleFactor(), static_cast<CSSPrimitiveValue*>(value)->getFloatValue(), op);
+    // FIXME: Possible handle other media types than 'screen' and 'print'.
+    float deviceScaleFactor = 0;
+
+    // This checks the actual media type applied to the document, and we know
+    // this method only got called if this media type matches the one defined
+    // in the query. Thus, if if the document's media type is "print", the
+    // media type of the query will either be "print" or "all".
+    String mediaType = frame->view()->mediaType();
+    if (equalIgnoringCase(mediaType, "screen"))
+        deviceScaleFactor = frame->page()->deviceScaleFactor();
+    else if (equalIgnoringCase(mediaType, "print")) {
+        // The resolution of images while printing should not depend on the dpi
+        // of the screen. Until we support proper ways of querying this info
+        // we use 300px which is considered minimum for current printers.
+        deviceScaleFactor = 3.125; // 300dpi / 96dpi;
+    }
 
-    return frame->page()->deviceScaleFactor() != 0;
+    if (!value)
+        return !!deviceScaleFactor;
+
+    return value->isPrimitiveValue() && compareValue(deviceScaleFactor, static_cast<CSSPrimitiveValue*>(value)->getFloatValue(), op);
+}
+
+static bool resolutionMediaFeatureEval(CSSValue* value, RenderStyle*, Frame* frame, MediaFeaturePrefix op)
+{
+#if ENABLE(RESOLUTION_MEDIA_QUERY)
+    // The DPI below is dots per CSS inch and thus not device inch. The
+    // functions should respect this.
+    //
+    // For square pixels, it is simply the device scale factor (dppx) times 96,
+    // per definition.
+    //
+    // The device scale factor is a predefined value which is calculated per
+    // device given the preferred distance in arms length (considered one arms
+    // length for desktop computers and usually 0.6 arms length for phones).
+    //
+    // The value can be calculated as follows (rounded to quarters):
+    //     round((deviceDotsPerInch * distanceInArmsLength / 96) * 4) / 4.
+    // Example (mid-range resolution phone):
+    //     round((244 * 0.6 / 96) * 4) / 4 = 1.5
+    // Example (high-range resolution laptop):
+    //     round((220 * 1.0 / 96) * 4) / 4 = 2.0
+
+    float horiDPI;
+    float vertDPI;
+
+    // This checks the actual media type applied to the document, and we know
+    // this method only got called if this media type matches the one defined
+    // in the query. Thus, if if the document's media type is "print", the
+    // media type of the query will either be "print" or "all".
+    String mediaType = frame->view()->mediaType();
+    if (equalIgnoringCase(mediaType, "screen")) {
+        Screen* screen = frame->document()->domWindow()->screen();
+        horiDPI = screen->horizontalDPI();
+        vertDPI = screen->verticalDPI();
+    } else if (equalIgnoringCase(mediaType, "print")) {
+        // The resolution of images while printing should not depend on the dpi
+        // of the screen. Until we support proper ways of querying this info
+        // we use 300px which is considered minimum for current printers.
+        horiDPI = vertDPI = 300;
+    } else {
+        // FIXME: Possible handle other media types than 'screen' and 'print'.
+        // For now, do not match.
+        return false;
+    }
+
+    float leastDenseDPI = std::min(horiDPI, vertDPI);
+    float mostDenseDPI = std::max(horiDPI, vertDPI);
+
+    // According to spec, (resolution) will evaluate to true if (resolution:x)
+    // will evaluate to true for a value x other than zero or zero followed by
+    // a valid unit identifier (i.e., other than 0, 0dpi, 0dpcm, or 0dppx.),
+    // which is always the case. But the spec special cases 'resolution' to
+    // never matches a device with non-square pixels.
+    if (!value) {
+        ASSERT(op == NoPrefix);
+        return leastDenseDPI == mostDenseDPI;
+    }
+
+    if (!value->isPrimitiveValue())
+        return false;
+
+    // http://dev.w3.org/csswg/css3-values/#resolution defines resolution as a
+    // dimension, which contains a number (decimal point allowed), not just an
+    // integer. Also, http://dev.w3.org/csswg/css3-values/#numeric-types says
+    // "CSS theoretically supports infinite precision and infinite ranges for
+    // all value types;
+    CSSPrimitiveValue* rawValue = static_cast<CSSPrimitiveValue*>(value);
+
+    if (rawValue->isDotsPerPixel()) {
+        // http://dev.w3.org/csswg/css3-values/#absolute-lengths recommends
+        // "that the pixel unit refer to the whole number of device pixels that
+        // best approximates the reference pixel". We compare with 3 decimal
+        // points, which aligns with current device-pixel-ratio's in use.
+        float leastDenseDensity = floorf(leastDenseDPI * 1000 / 96) / 1000;
+        float mostDenseDensity = floorf(leastDenseDPI * 1000 / 96) / 1000;
+        float testedDensity = rawValue->getFloatValue(CSSPrimitiveValue::CSS_DPPX);
+        return compareResolution(leastDenseDensity, mostDenseDensity, testedDensity, op);
+    }
+
+    if (rawValue->isDotsPerInch()) {
+        unsigned testedDensity = rawValue->getFloatValue(CSSPrimitiveValue::CSS_DPI);
+        return compareResolution(leastDenseDPI, mostDenseDPI, testedDensity, op);
+    }
+
+    // http://dev.w3.org/csswg/css3-values/#absolute-lengths recommends "that
+    // the pixel unit refer to the whole number of device pixels that best
+    // approximates the reference pixel".
+    float leastDenseDPCM = roundf(leastDenseDPI / 2.54); // (2.54 cm/in)
+    float mostDenseDPCM = roundf(mostDenseDPI / 2.54);
+
+    if (rawValue->isDotsPerCentimeter()) {
+        float testedDensity = rawValue->getFloatValue(CSSPrimitiveValue::CSS_DPCM);
+        return compareResolution(leastDenseDPCM, mostDenseDPCM, testedDensity, op);
+    }
+#else
+    UNUSED_PARAM(value);
+    UNUSED_PARAM(frame);
+    UNUSED_PARAM(op);
+#endif
+
+    return false;
 }
 
 static bool gridMediaFeatureEval(CSSValue* value, RenderStyle*, Frame*, MediaFeaturePrefix op)
@@ -456,6 +591,16 @@ static bool max_device_widthMediaFeatureEval(CSSValue* value, RenderStyle* style
     return device_widthMediaFeatureEval(value, style, frame, MaxPrefix);
 }
 
+static bool min_resolutionMediaFeatureEval(CSSValue* value, RenderStyle* style, Frame* frame, MediaFeaturePrefix)
+{
+    return resolutionMediaFeatureEval(value, style, frame, MinPrefix);
+}
+
+static bool max_resolutionMediaFeatureEval(CSSValue* value, RenderStyle* style, Frame* frame, MediaFeaturePrefix)
+{
+    return resolutionMediaFeatureEval(value, style, frame, MaxPrefix);
+}
+
 static bool animationMediaFeatureEval(CSSValue* value, RenderStyle*, Frame*, MediaFeaturePrefix op)
 {
     if (value) {
diff --git a/Source/WebCore/css/MediaQueryExp.cpp b/Source/WebCore/css/MediaQueryExp.cpp
index 1a06b7965..23be429ca 100644
--- a/Source/WebCore/css/MediaQueryExp.cpp
+++ b/Source/WebCore/css/MediaQueryExp.cpp
@@ -67,6 +67,16 @@ static inline bool featureWithValidPositiveLenghtOrNumber(const AtomicString& me
         || mediaFeature == MediaFeatureNames::min_device_widthMediaFeature;
 }
 
+static inline bool featureWithValidDensity(const AtomicString& mediaFeature, const CSSParserValue* value)
+{
+    if ((value->unit != CSSPrimitiveValue::CSS_DPPX && value->unit != CSSPrimitiveValue::CSS_DPI && value->unit != CSSPrimitiveValue::CSS_DPCM) || value->fValue <= 0)
+        return false;
+
+    return mediaFeature == MediaFeatureNames::resolutionMediaFeature
+        || mediaFeature == MediaFeatureNames::max_resolutionMediaFeature
+        || mediaFeature == MediaFeatureNames::min_resolutionMediaFeature;
+}
+
 static inline bool featureWithPositiveInteger(const AtomicString& mediaFeature, const CSSParserValue* value)
 {
     if (!value->isInt || value->fValue < 0)
@@ -114,6 +124,7 @@ static inline bool featureWithAspectRatio(const AtomicString& mediaFeature)
 
 static inline bool featureWithoutValue(const AtomicString& mediaFeature)
 {
+    // Media features that are prefixed by min/max cannot be used without a value.
     return mediaFeature == MediaFeatureNames::monochromeMediaFeature
         || mediaFeature == MediaFeatureNames::colorMediaFeature
         || mediaFeature == MediaFeatureNames::gridMediaFeature
@@ -131,7 +142,8 @@ static inline bool featureWithoutValue(const AtomicString& mediaFeature)
         || mediaFeature == MediaFeatureNames::animationMediaFeature
         || mediaFeature == MediaFeatureNames::view_modeMediaFeature
         || mediaFeature == MediaFeatureNames::pointerMediaFeature
-        || mediaFeature == MediaFeatureNames::device_pixel_ratioMediaFeature;
+        || mediaFeature == MediaFeatureNames::device_pixel_ratioMediaFeature
+        || mediaFeature == MediaFeatureNames::resolutionMediaFeature;
 }
 
 inline MediaQueryExp::MediaQueryExp(const AtomicString& mediaFeature, CSSParserValueList* valueList)
@@ -148,6 +160,10 @@ inline MediaQueryExp::MediaQueryExp(const AtomicString& mediaFeature, CSSParserV
             if (featureWithCSSValueID(mediaFeature, value))
                 m_value = CSSPrimitiveValue::createIdentifier(value->id);
 
+            // Media features that must have non-negative <density>, ie. dppx, dpi or dpcm.
+            else if (featureWithValidDensity(mediaFeature, value))
+                m_value = CSSPrimitiveValue::create(value->fValue, (CSSPrimitiveValue::UnitTypes) value->unit);
+
             // Media features that must have non-negative <lenght> or number value.
             else if (featureWithValidPositiveLenghtOrNumber(mediaFeature, value))
                 m_value = CSSPrimitiveValue::create(value->fValue, (CSSPrimitiveValue::UnitTypes) value->unit);
diff --git a/Source/WebCore/css/PropertySetCSSStyleDeclaration.cpp b/Source/WebCore/css/PropertySetCSSStyleDeclaration.cpp
index 93d4e4538..824d90fb2 100644
--- a/Source/WebCore/css/PropertySetCSSStyleDeclaration.cpp
+++ b/Source/WebCore/css/PropertySetCSSStyleDeclaration.cpp
@@ -30,7 +30,6 @@
 #include "MutationRecord.h"
 #include "StylePropertySet.h"
 #include "StyledElement.h"
-#include "UndoManager.h"
 #include "WebCoreMemoryInstrumentation.h"
 #include <wtf/MemoryInstrumentationHashMap.h>
 
@@ -55,39 +54,25 @@ public:
         ASSERT(!s_currentDecl);
         s_currentDecl = decl;
 
-#if ENABLE(MUTATION_OBSERVERS) || ENABLE(UNDO_MANAGER)
+#if ENABLE(MUTATION_OBSERVERS)
         if (!s_currentDecl->parentElement())
             return;
 
         bool shouldReadOldValue = false;
 
-#if ENABLE(MUTATION_OBSERVERS)
         m_mutationRecipients = MutationObserverInterestGroup::createForAttributesMutation(s_currentDecl->parentElement(), HTMLNames::styleAttr);
         if (m_mutationRecipients && m_mutationRecipients->isOldValueRequested())
             shouldReadOldValue = true;
-#endif
-#if ENABLE(UNDO_MANAGER)
-        m_isRecordingAutomaticTransaction = UndoManager::isRecordingAutomaticTransaction(s_currentDecl->parentElement());
-        if (m_isRecordingAutomaticTransaction)
-            shouldReadOldValue = true;
-#endif
 
         AtomicString oldValue;
         if (shouldReadOldValue)
             oldValue = s_currentDecl->parentElement()->getAttribute(HTMLNames::styleAttr);
 
-#if ENABLE(MUTATION_OBSERVERS)
         if (m_mutationRecipients) {
             AtomicString requestedOldValue = m_mutationRecipients->isOldValueRequested() ? oldValue : nullAtom;
             m_mutation = MutationRecord::createAttributes(s_currentDecl->parentElement(), HTMLNames::styleAttr, requestedOldValue);
         }
 #endif
-#if ENABLE(UNDO_MANAGER)
-        if (m_isRecordingAutomaticTransaction)
-            m_oldValue = oldValue;
-#endif
-
-#endif
     }
 
     ~StyleAttributeMutationScope()
@@ -99,14 +84,7 @@ public:
 #if ENABLE(MUTATION_OBSERVERS)
         if (m_mutation && s_shouldDeliver)
             m_mutationRecipients->enqueueMutationRecord(m_mutation);
-#endif
-#if ENABLE(UNDO_MANAGER)
-        if (m_isRecordingAutomaticTransaction && s_shouldDeliver) {
-            UndoManager::addTransactionStep(AttrChangingDOMTransactionStep::create(
-                s_currentDecl->parentElement(), HTMLNames::styleAttr, m_oldValue, s_currentDecl->parentElement()->getAttribute(HTMLNames::styleAttr)));
-        }
-#endif
-#if ENABLE(MUTATION_OBSERVERS) || ENABLE(UNDO_MANAGER)
+
         s_shouldDeliver = false;
 #endif
         if (!s_shouldNotifyInspector) {
@@ -121,7 +99,7 @@ public:
             InspectorInstrumentation::didInvalidateStyleAttr(localCopyStyleDecl->parentElement()->document(), localCopyStyleDecl->parentElement());
     }
 
-#if ENABLE(MUTATION_OBSERVERS) || ENABLE(UNDO_MANAGER)
+#if ENABLE(MUTATION_OBSERVERS)
     void enqueueMutationRecord()
     {
         s_shouldDeliver = true;
@@ -137,7 +115,7 @@ private:
     static unsigned s_scopeCount;
     static PropertySetCSSStyleDeclaration* s_currentDecl;
     static bool s_shouldNotifyInspector;
-#if ENABLE(MUTATION_OBSERVERS) || ENABLE(UNDO_MANAGER)
+#if ENABLE(MUTATION_OBSERVERS)
     static bool s_shouldDeliver;
 #endif
 
@@ -145,16 +123,12 @@ private:
     OwnPtr<MutationObserverInterestGroup> m_mutationRecipients;
     RefPtr<MutationRecord> m_mutation;
 #endif
-#if ENABLE(UNDO_MANAGER)
-    bool m_isRecordingAutomaticTransaction;
-    AtomicString m_oldValue;
-#endif
 };
 
 unsigned StyleAttributeMutationScope::s_scopeCount = 0;
 PropertySetCSSStyleDeclaration* StyleAttributeMutationScope::s_currentDecl = 0;
 bool StyleAttributeMutationScope::s_shouldNotifyInspector = false;
-#if ENABLE(MUTATION_OBSERVERS) || ENABLE(UNDO_MANAGER)
+#if ENABLE(MUTATION_OBSERVERS)
 bool StyleAttributeMutationScope::s_shouldDeliver = false;
 #endif
 
@@ -196,7 +170,7 @@ String PropertySetCSSStyleDeclaration::cssText() const
     
 void PropertySetCSSStyleDeclaration::setCssText(const String& text, ExceptionCode& ec)
 {
-#if ENABLE(MUTATION_OBSERVERS) || ENABLE(UNDO_MANAGER)
+#if ENABLE(MUTATION_OBSERVERS)
     StyleAttributeMutationScope mutationScope(this);
 #endif
     willMutate();
@@ -207,7 +181,7 @@ void PropertySetCSSStyleDeclaration::setCssText(const String& text, ExceptionCod
 
     didMutate(PropertyChanged);
 
-#if ENABLE(MUTATION_OBSERVERS) || ENABLE(UNDO_MANAGER)
+#if ENABLE(MUTATION_OBSERVERS)
     mutationScope.enqueueMutationRecord();    
 #endif
 }
@@ -257,7 +231,7 @@ bool PropertySetCSSStyleDeclaration::isPropertyImplicit(const String& propertyNa
 
 void PropertySetCSSStyleDeclaration::setProperty(const String& propertyName, const String& value, const String& priority, ExceptionCode& ec)
 {
-#if ENABLE(MUTATION_OBSERVERS) || ENABLE(UNDO_MANAGER)
+#if ENABLE(MUTATION_OBSERVERS)
     StyleAttributeMutationScope mutationScope(this);
 #endif
     CSSPropertyID propertyID = cssPropertyID(propertyName);
@@ -276,7 +250,7 @@ void PropertySetCSSStyleDeclaration::setProperty(const String& propertyName, con
     if (changed) {
         // CSS DOM requires raising SYNTAX_ERR of parsing failed, but this is too dangerous for compatibility,
         // see <http://bugs.webkit.org/show_bug.cgi?id=7296>.
-#if ENABLE(MUTATION_OBSERVERS) || ENABLE(UNDO_MANAGER)
+#if ENABLE(MUTATION_OBSERVERS)
         mutationScope.enqueueMutationRecord();
 #endif
     }
@@ -284,7 +258,7 @@ void PropertySetCSSStyleDeclaration::setProperty(const String& propertyName, con
 
 String PropertySetCSSStyleDeclaration::removeProperty(const String& propertyName, ExceptionCode& ec)
 {
-#if ENABLE(MUTATION_OBSERVERS) || ENABLE(UNDO_MANAGER)
+#if ENABLE(MUTATION_OBSERVERS)
     StyleAttributeMutationScope mutationScope(this);
 #endif
     CSSPropertyID propertyID = cssPropertyID(propertyName);
@@ -300,7 +274,7 @@ String PropertySetCSSStyleDeclaration::removeProperty(const String& propertyName
     didMutate(changed ? PropertyChanged : NoChanges);
 
     if (changed) {
-#if ENABLE(MUTATION_OBSERVERS) || ENABLE(UNDO_MANAGER)
+#if ENABLE(MUTATION_OBSERVERS)
         mutationScope.enqueueMutationRecord();
 #endif
     }
@@ -319,7 +293,7 @@ String PropertySetCSSStyleDeclaration::getPropertyValueInternal(CSSPropertyID pr
 
 void PropertySetCSSStyleDeclaration::setPropertyInternal(CSSPropertyID propertyID, const String& value, bool important, ExceptionCode& ec)
 { 
-#if ENABLE(MUTATION_OBSERVERS) || ENABLE(UNDO_MANAGER)
+#if ENABLE(MUTATION_OBSERVERS)
     StyleAttributeMutationScope mutationScope(this);
 #endif
     willMutate();
@@ -330,7 +304,7 @@ void PropertySetCSSStyleDeclaration::setPropertyInternal(CSSPropertyID propertyI
     didMutate(changed ? PropertyChanged : NoChanges);
 
     if (changed) {
-#if ENABLE(MUTATION_OBSERVERS) || ENABLE(UNDO_MANAGER)
+#if ENABLE(MUTATION_OBSERVERS)
         mutationScope.enqueueMutationRecord();
 #endif
     }
@@ -369,7 +343,7 @@ PassRefPtr<StylePropertySet> PropertySetCSSStyleDeclaration::makeMutable()
     return m_propertySet;
 }
 
-bool PropertySetCSSStyleDeclaration::cssPropertyMatches(const CSSProperty* property) const
+bool PropertySetCSSStyleDeclaration::cssPropertyMatches(const StylePropertySet::PropertyReference& property) const
 {
     return m_propertySet->propertyMatches(property);
 }
diff --git a/Source/WebCore/css/PropertySetCSSStyleDeclaration.h b/Source/WebCore/css/PropertySetCSSStyleDeclaration.h
index 0bbd64b7c..cb10437df 100644
--- a/Source/WebCore/css/PropertySetCSSStyleDeclaration.h
+++ b/Source/WebCore/css/PropertySetCSSStyleDeclaration.h
@@ -67,7 +67,7 @@ private:
     virtual String getPropertyValueInternal(CSSPropertyID) OVERRIDE;
     virtual void setPropertyInternal(CSSPropertyID, const String& value, bool important, ExceptionCode&) OVERRIDE;
     
-    virtual bool cssPropertyMatches(const CSSProperty*) const OVERRIDE;
+    virtual bool cssPropertyMatches(const StylePropertySet::PropertyReference&) const OVERRIDE;
     virtual PassRefPtr<StylePropertySet> copy() const OVERRIDE;
     virtual PassRefPtr<StylePropertySet> makeMutable() OVERRIDE;
 
diff --git a/Source/WebCore/css/RuleFeature.cpp b/Source/WebCore/css/RuleFeature.cpp
index 663b94613..b1f929687 100644
--- a/Source/WebCore/css/RuleFeature.cpp
+++ b/Source/WebCore/css/RuleFeature.cpp
@@ -38,11 +38,14 @@ namespace WebCore {
 
 void RuleFeatureSet::add(const RuleFeatureSet& other)
 {
-    HashSet<AtomicStringImpl*>::iterator end = other.idsInRules.end();
-    for (HashSet<AtomicStringImpl*>::iterator it = other.idsInRules.begin(); it != end; ++it)
+    HashSet<AtomicStringImpl*>::const_iterator end = other.idsInRules.end();
+    for (HashSet<AtomicStringImpl*>::const_iterator it = other.idsInRules.begin(); it != end; ++it)
         idsInRules.add(*it);
+    end = other.classesInRules.end();
+    for (HashSet<AtomicStringImpl*>::const_iterator it = other.classesInRules.begin(); it != end; ++it)
+        classesInRules.add(*it);
     end = other.attrsInRules.end();
-    for (HashSet<AtomicStringImpl*>::iterator it = other.attrsInRules.begin(); it != end; ++it)
+    for (HashSet<AtomicStringImpl*>::const_iterator it = other.attrsInRules.begin(); it != end; ++it)
         attrsInRules.add(*it);
     siblingRules.append(other.siblingRules);
     uncommonAttributeRules.append(other.uncommonAttributeRules);
@@ -53,6 +56,7 @@ void RuleFeatureSet::add(const RuleFeatureSet& other)
 void RuleFeatureSet::clear()
 {
     idsInRules.clear();
+    classesInRules.clear();
     attrsInRules.clear();
     siblingRules.clear();
     uncommonAttributeRules.clear();
@@ -64,6 +68,7 @@ void RuleFeatureSet::reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
 {
     MemoryClassInfo info(memoryObjectInfo, this, WebCoreMemoryTypes::CSS);
     info.addMember(idsInRules);
+    info.addMember(classesInRules);
     info.addMember(attrsInRules);
     info.addMember(siblingRules);
     info.addMember(uncommonAttributeRules);
diff --git a/Source/WebCore/css/RuleFeature.h b/Source/WebCore/css/RuleFeature.h
index 5f16288c0..ce6d04e66 100644
--- a/Source/WebCore/css/RuleFeature.h
+++ b/Source/WebCore/css/RuleFeature.h
@@ -31,8 +31,7 @@ namespace WebCore {
 
 class StyleRule;
 
-class RuleFeature {
-public:
+struct RuleFeature {
     RuleFeature(StyleRule* rule, unsigned selectorIndex, bool hasDocumentSecurityOrigin)
         : rule(rule)
         , selectorIndex(selectorIndex)
@@ -44,8 +43,7 @@ public:
     bool hasDocumentSecurityOrigin;
 };
 
-class RuleFeatureSet {
-public:
+struct RuleFeatureSet {
     RuleFeatureSet()
         : usesFirstLineRules(false)
         , usesBeforeAfterRules(false)
@@ -55,6 +53,7 @@ public:
     void clear();
     void reportMemoryUsage(MemoryObjectInfo*) const;
     HashSet<AtomicStringImpl*> idsInRules;
+    HashSet<AtomicStringImpl*> classesInRules;
     HashSet<AtomicStringImpl*> attrsInRules;
     Vector<RuleFeature> siblingRules;
     Vector<RuleFeature> uncommonAttributeRules;
diff --git a/Source/WebCore/css/RuleSet.cpp b/Source/WebCore/css/RuleSet.cpp
index e2be5771e..e92d1768b 100644
--- a/Source/WebCore/css/RuleSet.cpp
+++ b/Source/WebCore/css/RuleSet.cpp
@@ -107,18 +107,18 @@ static inline bool containsUncommonAttributeSelector(const CSSSelector* selector
     return false;
 }
 
-RuleData::RuleData(StyleRule* rule, unsigned selectorIndex, unsigned position, bool hasDocumentSecurityOrigin, bool canUseFastCheckSelector, bool inRegionRule)
+RuleData::RuleData(StyleRule* rule, unsigned selectorIndex, unsigned position, AddRuleFlags addRuleFlags)
     : m_rule(rule)
     , m_selectorIndex(selectorIndex)
     , m_position(position)
     , m_specificity(selector()->specificity())
-    , m_hasFastCheckableSelector(canUseFastCheckSelector && SelectorChecker::isFastCheckableSelector(selector()))
+    , m_hasFastCheckableSelector((addRuleFlags & RuleCanUseFastCheckSelector) && SelectorChecker::isFastCheckableSelector(selector()))
     , m_hasMultipartSelector(!!selector()->tagHistory())
     , m_hasRightmostSelectorMatchingHTMLBasedOnRuleHash(isSelectorMatchingHTMLBasedOnRuleHash(selector()))
     , m_containsUncommonAttributeSelector(WebCore::containsUncommonAttributeSelector(selector()))
     , m_linkMatchType(SelectorChecker::determineLinkMatchType(selector()))
-    , m_hasDocumentSecurityOrigin(hasDocumentSecurityOrigin)
-    , m_isInRegionRule(inRegionRule)
+    , m_hasDocumentSecurityOrigin(addRuleFlags & RuleHasDocumentSecurityOrigin)
+    , m_isInRegionRule(addRuleFlags & RuleIsInRegionRule)
 {
     ASSERT(m_position == position);
     ASSERT(m_selectorIndex == selectorIndex);
@@ -161,7 +161,9 @@ static inline void collectFeaturesFromSelector(RuleFeatureSet& features, const C
 {
     if (selector->m_match == CSSSelector::Id)
         features.idsInRules.add(selector->value().impl());
-    if (selector->isAttributeSelector())
+    else if (selector->m_match == CSSSelector::Class)
+        features.classesInRules.add(selector->value().impl());
+    else if (selector->isAttributeSelector())
         features.attrsInRules.add(selector->attribute().localName().impl());
     switch (selector->pseudoType()) {
     case CSSSelector::PseudoFirstLine:
@@ -207,9 +209,14 @@ void RuleSet::addToRuleSet(AtomicStringImpl* key, AtomRuleMap& map, const RuleDa
     rules->append(ruleData);
 }
 
-void RuleSet::addRule(StyleRule* rule, unsigned selectorIndex, bool hasDocumentSecurityOrigin, bool canUseFastCheckSelector, bool inRegionRule)
+void RuleSet::addRule(StyleRule* rule, unsigned selectorIndex, AddRuleFlags addRuleFlags)
 {
-    RuleData ruleData(rule, selectorIndex, m_ruleCount++, hasDocumentSecurityOrigin, canUseFastCheckSelector, inRegionRule);
+    RuleData ruleData(rule, selectorIndex, m_ruleCount++, addRuleFlags);
+    static const unsigned athostRuleSpecificity = 0x100000;
+
+    if (addRuleFlags & RuleIsHostRule)
+        ruleData.increaseSpecificity(athostRuleSpecificity);
+
     collectFeaturesFromRuleData(m_features, ruleData);
 
     CSSSelector* selector = ruleData.selector();
@@ -222,7 +229,7 @@ void RuleSet::addRule(StyleRule* rule, unsigned selectorIndex, bool hasDocumentS
         addToRuleSet(selector->value().impl(), m_classRules, ruleData);
         return;
     }
-    if (selector->isUnknownPseudoElement()) {
+    if (selector->isCustomPseudoElement()) {
         addToRuleSet(selector->value().impl(), m_shadowPseudoElementRules, ruleData);
         return;
     }
@@ -264,10 +271,12 @@ void RuleSet::addRegionRule(StyleRuleRegion* regionRule, bool hasDocumentSecurit
 
     // Collect the region rules into a rule set
     const Vector<RefPtr<StyleRuleBase> >& childRules = regionRule->childRules();
+    AddRuleFlags addRuleFlags = hasDocumentSecurityOrigin ? RuleHasDocumentSecurityOrigin : RuleHasNoSpecialState;
+    addRuleFlags = static_cast<AddRuleFlags>(addRuleFlags | RuleCanUseFastCheckSelector | RuleIsInRegionRule);
     for (unsigned i = 0; i < childRules.size(); ++i) {
         StyleRuleBase* regionStylingRule = childRules[i].get();
         if (regionStylingRule->isStyleRule())
-            regionRuleSet->addStyleRule(static_cast<StyleRule*>(regionStylingRule), hasDocumentSecurityOrigin, true, true);
+            regionRuleSet->addStyleRule(static_cast<StyleRule*>(regionStylingRule), addRuleFlags);
     }
     // Update the "global" rule count so that proper order is maintained
     m_ruleCount = regionRuleSet->m_ruleCount;
@@ -286,6 +295,7 @@ void RuleSet::addRulesFromSheet(StyleSheetContents* sheet, const MediaQueryEvalu
             addRulesFromSheet(importRule->styleSheet(), medium, resolver, scope);
     }
     bool hasDocumentSecurityOrigin = resolver && resolver->document()->securityOrigin()->canRequest(sheet->baseURL());
+    AddRuleFlags addRuleFlags = static_cast<AddRuleFlags>((hasDocumentSecurityOrigin ? RuleHasDocumentSecurityOrigin : 0) | (!scope ? RuleCanUseFastCheckSelector : 0));
 
     const Vector<RefPtr<StyleRuleBase> >& rules = sheet->childRules();
     for (unsigned i = 0; i < rules.size(); ++i) {
@@ -293,7 +303,7 @@ void RuleSet::addRulesFromSheet(StyleSheetContents* sheet, const MediaQueryEvalu
 
         ASSERT(!rule->isImportRule());
         if (rule->isStyleRule())
-            addStyleRule(static_cast<StyleRule*>(rule), hasDocumentSecurityOrigin, !scope);
+            addStyleRule(static_cast<StyleRule*>(rule), addRuleFlags);
         else if (rule->isPageRule())
             addPageRule(static_cast<StyleRulePage*>(rule));
         else if (rule->isMediaRule()) {
@@ -305,7 +315,7 @@ void RuleSet::addRulesFromSheet(StyleSheetContents* sheet, const MediaQueryEvalu
                 for (unsigned j = 0; j < childRules.size(); ++j) {
                     StyleRuleBase* childRule = childRules[j].get();
                     if (childRule->isStyleRule())
-                        addStyleRule(static_cast<StyleRule*>(childRule), hasDocumentSecurityOrigin, !scope);
+                        addStyleRule(static_cast<StyleRule*>(childRule), addRuleFlags);
                     else if (childRule->isPageRule())
                         addPageRule(static_cast<StyleRulePage*>(childRule));
                     else if (childRule->isFontFaceRule() && resolver) {
@@ -347,15 +357,19 @@ void RuleSet::addRulesFromSheet(StyleSheetContents* sheet, const MediaQueryEvalu
             addRegionRule(static_cast<StyleRuleRegion*>(rule), hasDocumentSecurityOrigin);
         }
 #endif
+#if ENABLE(SHADOW_DOM)
+        else if (rule->isHostRule())
+            resolver->addHostRule(static_cast<StyleRuleHost*>(rule), hasDocumentSecurityOrigin, scope);
+#endif
     }
     if (m_autoShrinkToFitEnabled)
         shrinkToFit();
 }
 
-void RuleSet::addStyleRule(StyleRule* rule, bool hasDocumentSecurityOrigin, bool canUseFastCheckSelector, bool isInRegionRule)
+void RuleSet::addStyleRule(StyleRule* rule, AddRuleFlags addRuleFlags)
 {
     for (size_t selectorIndex = 0; selectorIndex != notFound; selectorIndex = rule->selectorList().indexOfNextSelectorAfter(selectorIndex))
-        addRule(rule, selectorIndex, hasDocumentSecurityOrigin, canUseFastCheckSelector, isInRegionRule);
+        addRule(rule, selectorIndex, addRuleFlags);
 }
 
 static inline void shrinkMapVectorsToFit(RuleSet::AtomRuleMap& map)
diff --git a/Source/WebCore/css/RuleSet.h b/Source/WebCore/css/RuleSet.h
index 6577238ba..a2fbecbc0 100644
--- a/Source/WebCore/css/RuleSet.h
+++ b/Source/WebCore/css/RuleSet.h
@@ -31,6 +31,14 @@
 
 namespace WebCore {
 
+enum AddRuleFlags {
+    RuleHasNoSpecialState         = 0,
+    RuleHasDocumentSecurityOrigin = 1,
+    RuleCanUseFastCheckSelector   = 1 << 1,
+    RuleIsInRegionRule            = 1 << 2,
+    RuleIsHostRule                = 1 << 3,
+};
+
 class CSSSelector;
 class ContainerNode;
 class MediaQueryEvaluator;
@@ -40,7 +48,7 @@ class StyleSheetContents;
 
 class RuleData {
 public:
-    RuleData(StyleRule*, unsigned selectorIndex, unsigned position, bool hasDocumentSecurityOrigin, bool canUseFastCheckSelector, bool inRegionRule);
+    RuleData(StyleRule*, unsigned selectorIndex, unsigned position, AddRuleFlags);
 
     unsigned position() const { return m_position; }
     StyleRule* rule() const { return m_rule; }
@@ -55,6 +63,7 @@ public:
     unsigned linkMatchType() const { return m_linkMatchType; }
     bool hasDocumentSecurityOrigin() const { return m_hasDocumentSecurityOrigin; }
     bool isInRegionRule() const { return m_isInRegionRule; }
+    void increaseSpecificity(unsigned value) { m_specificity += value; }
 
     // Try to balance between memory usage (there can be lots of RuleData objects) and good filtering performance.
     static const unsigned maximumIdentifierCount = 4;
@@ -98,8 +107,8 @@ public:
 
     void addRulesFromSheet(StyleSheetContents*, const MediaQueryEvaluator&, StyleResolver* = 0, const ContainerNode* = 0);
 
-    void addStyleRule(StyleRule*, bool hasDocumentSecurityOrigin, bool canUseFastCheckSelector, bool isInRegionRule = false);
-    void addRule(StyleRule*, unsigned selectorIndex, bool hasDocumentSecurityOrigin, bool canUseFastCheckSelector, bool isInRegionRule = false);
+    void addStyleRule(StyleRule*, AddRuleFlags);
+    void addRule(StyleRule*, unsigned selectorIndex, AddRuleFlags);
     void addPageRule(StyleRulePage*);
     void addToRuleSet(AtomicStringImpl* key, AtomRuleMap&, const RuleData&);
     void addRegionRule(StyleRuleRegion*, bool hasDocumentSecurityOrigin);
diff --git a/Source/WebCore/css/SVGCSSParser.cpp b/Source/WebCore/css/SVGCSSParser.cpp
index 26d44e462..7200f218d 100644
--- a/Source/WebCore/css/SVGCSSParser.cpp
+++ b/Source/WebCore/css/SVGCSSParser.cpp
@@ -26,7 +26,6 @@
 #include "CSSInheritedValue.h"
 #include "CSSInitialValue.h"
 #include "CSSParser.h"
-#include "CSSProperty.h"
 #include "CSSPropertyNames.h"
 #include "CSSValueKeywords.h"
 #include "CSSValueList.h"
diff --git a/Source/WebCore/css/SVGCSSStyleSelector.cpp b/Source/WebCore/css/SVGCSSStyleSelector.cpp
index eaedc1065..6145bb1f1 100644
--- a/Source/WebCore/css/SVGCSSStyleSelector.cpp
+++ b/Source/WebCore/css/SVGCSSStyleSelector.cpp
@@ -185,6 +185,11 @@ void StyleResolver::applySVGProperty(CSSPropertyID id, CSSValue* value)
                 svgstyle->setColorInterpolationFilters(*primitiveValue);
             break;
         }
+        case CSSPropertyColorProfile:
+        {
+            // Not implemented.
+            break;
+        }
         case CSSPropertyColorRendering:
         {
             HANDLE_INHERIT_AND_INITIAL(colorRendering, ColorRendering)
diff --git a/Source/WebCore/css/SelectorChecker.cpp b/Source/WebCore/css/SelectorChecker.cpp
index eb5b9f387..38d41f784 100644
--- a/Source/WebCore/css/SelectorChecker.cpp
+++ b/Source/WebCore/css/SelectorChecker.cpp
@@ -51,6 +51,7 @@
 #include "RenderStyle.h"
 #include "ScrollableArea.h"
 #include "ScrollbarTheme.h"
+#include "ShadowRoot.h"
 #include "SiblingTraversalStrategies.h"
 #include "StyledElement.h"
 #include "Text.h"
@@ -268,8 +269,7 @@ bool SelectorChecker::checkSelector(CSSSelector* sel, Element* element, bool isF
     }
 
     PseudoId ignoreDynamicPseudo = NOPSEUDO;
-    bool hasUnknownPseudoElements = false;
-    return checkSelector(SelectorCheckingContext(sel, element, SelectorChecker::VisitedMatchDisabled), ignoreDynamicPseudo, hasUnknownPseudoElements) == SelectorMatches;
+    return checkSelector(SelectorCheckingContext(sel, element, SelectorChecker::VisitedMatchDisabled), ignoreDynamicPseudo) == SelectorMatches;
 }
 
 namespace {
@@ -440,16 +440,21 @@ bool SelectorChecker::isFastCheckableSelector(const CSSSelector* selector)
 // * SelectorFailsLocally     - the selector fails for the element e
 // * SelectorFailsAllSiblings - the selector fails for e and any sibling of e
 // * SelectorFailsCompletely  - the selector fails for e and any sibling or ancestor of e
-SelectorChecker::SelectorMatch SelectorChecker::checkSelector(const SelectorCheckingContext& context, PseudoId& dynamicPseudo, bool& hasUnknownPseudoElements) const
+SelectorChecker::SelectorMatch SelectorChecker::checkSelector(const SelectorCheckingContext& context, PseudoId& dynamicPseudo) const
 {
     // first selector has to match
     if (!checkOneSelector(context, DOMSiblingTraversalStrategy()))
         return SelectorFailsLocally;
 
     if (context.selector->m_match == CSSSelector::PseudoElement) {
-        if (context.selector->isUnknownPseudoElement()) {
-            hasUnknownPseudoElements = true;
-            if (context.element->shadowPseudoId() != context.selector->value())
+        if (context.selector->isCustomPseudoElement()) {
+            if (ShadowRoot* root = context.element->shadowRoot()) {
+                if (context.element->shadowPseudoId() != context.selector->value())
+                    return SelectorFailsLocally;
+
+                if (context.selector->pseudoType() == CSSSelector::PseudoWebKitCustomElement && root->type() != ShadowRoot::UserAgentShadowRoot)
+                    return SelectorFailsLocally;
+            } else
                 return SelectorFailsLocally;
         } else {
             if ((!context.elementStyle && m_mode == ResolvingStyle) || m_mode == QueryingRules)
@@ -500,7 +505,7 @@ SelectorChecker::SelectorMatch SelectorChecker::checkSelector(const SelectorChec
         nextContext.elementStyle = 0;
         nextContext.elementParentStyle = 0;
         for (; nextContext.element; nextContext.element = nextContext.element->parentElement()) {
-            SelectorMatch match = checkSelector(nextContext, ignoreDynamicPseudo, hasUnknownPseudoElements);
+            SelectorMatch match = checkSelector(nextContext, ignoreDynamicPseudo);
             if (match == SelectorMatches || match == SelectorFailsCompletely)
                 return match;
             if (nextContext.element == nextContext.scope)
@@ -515,7 +520,7 @@ SelectorChecker::SelectorMatch SelectorChecker::checkSelector(const SelectorChec
         nextContext.isSubSelector = false;
         nextContext.elementStyle = 0;
         nextContext.elementParentStyle = 0;
-        return checkSelector(nextContext, ignoreDynamicPseudo, hasUnknownPseudoElements);
+        return checkSelector(nextContext, ignoreDynamicPseudo);
 
     case CSSSelector::DirectAdjacent:
         if (m_mode == ResolvingStyle && context.element->parentElement()) {
@@ -529,7 +534,7 @@ SelectorChecker::SelectorMatch SelectorChecker::checkSelector(const SelectorChec
         nextContext.isSubSelector = false;
         nextContext.elementStyle = 0;
         nextContext.elementParentStyle = 0;
-        return checkSelector(nextContext, ignoreDynamicPseudo, hasUnknownPseudoElements);
+        return checkSelector(nextContext, ignoreDynamicPseudo);
 
     case CSSSelector::IndirectAdjacent:
         if (m_mode == ResolvingStyle && context.element->parentElement()) {
@@ -542,7 +547,7 @@ SelectorChecker::SelectorMatch SelectorChecker::checkSelector(const SelectorChec
         nextContext.elementStyle = 0;
         nextContext.elementParentStyle = 0;
         for (; nextContext.element; nextContext.element = nextContext.element->previousElementSibling()) {
-            SelectorMatch match = checkSelector(nextContext, ignoreDynamicPseudo, hasUnknownPseudoElements);
+            SelectorMatch match = checkSelector(nextContext, ignoreDynamicPseudo);
             if (match == SelectorMatches || match == SelectorFailsAllSiblings || match == SelectorFailsCompletely)
                 return match;
         };
@@ -559,7 +564,7 @@ SelectorChecker::SelectorMatch SelectorChecker::checkSelector(const SelectorChec
             && !(nextContext.hasScrollbarPseudo && nextContext.selector->m_match == CSSSelector::PseudoClass))
             return SelectorFailsCompletely;
         nextContext.isSubSelector = true;
-        return checkSelector(nextContext, dynamicPseudo, hasUnknownPseudoElements);
+        return checkSelector(nextContext, dynamicPseudo);
 
     case CSSSelector::ShadowDescendant:
         {
@@ -573,7 +578,7 @@ SelectorChecker::SelectorMatch SelectorChecker::checkSelector(const SelectorChec
             nextContext.isSubSelector = false;
             nextContext.elementStyle = 0;
             nextContext.elementParentStyle = 0;
-            return checkSelector(nextContext, ignoreDynamicPseudo, hasUnknownPseudoElements);
+            return checkSelector(nextContext, ignoreDynamicPseudo);
         }
     }
 
@@ -979,10 +984,9 @@ bool SelectorChecker::checkOneSelector(const SelectorCheckingContext& context, c
             {
                 SelectorCheckingContext subContext(context);
                 subContext.isSubSelector = true;
-                bool hasUnknownPseudoElements = false;
                 PseudoId ignoreDynamicPseudo = NOPSEUDO;
                 for (subContext.selector = selector->selectorList()->first(); subContext.selector; subContext.selector = CSSSelectorList::next(subContext.selector)) {
-                    if (checkSelector(subContext, ignoreDynamicPseudo, hasUnknownPseudoElements) == SelectorMatches)
+                    if (checkSelector(subContext, ignoreDynamicPseudo) == SelectorMatches)
                         return true;
                 }
             }
diff --git a/Source/WebCore/css/SelectorChecker.h b/Source/WebCore/css/SelectorChecker.h
index 9eadada59..9bdb669b2 100644
--- a/Source/WebCore/css/SelectorChecker.h
+++ b/Source/WebCore/css/SelectorChecker.h
@@ -82,7 +82,7 @@ public:
     };
 
     bool checkSelector(CSSSelector*, Element*, bool isFastCheckableSelector = false) const;
-    SelectorMatch checkSelector(const SelectorCheckingContext&, PseudoId&, bool& hasUnknownPseudoElements) const;
+    SelectorMatch checkSelector(const SelectorCheckingContext&, PseudoId&) const;
     template<typename SiblingTraversalStrategy>
     bool checkOneSelector(const SelectorCheckingContext&, const SiblingTraversalStrategy&) const;
 
diff --git a/Source/WebCore/css/StyleBuilder.cpp b/Source/WebCore/css/StyleBuilder.cpp
index 5795defc4..0501dc9d1 100644
--- a/Source/WebCore/css/StyleBuilder.cpp
+++ b/Source/WebCore/css/StyleBuilder.cpp
@@ -2002,7 +2002,7 @@ StyleBuilder::StyleBuilder()
     setPropertyHandler(CSSPropertyWebkitHyphenateLimitLines, ApplyPropertyNumber<short, &RenderStyle::hyphenationLimitLines, &RenderStyle::setHyphenationLimitLines, &RenderStyle::initialHyphenationLimitLines, CSSValueNoLimit>::createHandler());
     setPropertyHandler(CSSPropertyWebkitHyphens, ApplyPropertyDefault<Hyphens, &RenderStyle::hyphens, Hyphens, &RenderStyle::setHyphens, Hyphens, &RenderStyle::initialHyphens>::createHandler());
     setPropertyHandler(CSSPropertyWebkitLineAlign, ApplyPropertyDefault<LineAlign, &RenderStyle::lineAlign, LineAlign, &RenderStyle::setLineAlign, LineAlign, &RenderStyle::initialLineAlign>::createHandler());
-    setPropertyHandler(CSSPropertyWebkitLineBreak, ApplyPropertyDefault<EKHTMLLineBreak, &RenderStyle::khtmlLineBreak, EKHTMLLineBreak, &RenderStyle::setKHTMLLineBreak, EKHTMLLineBreak, &RenderStyle::initialKHTMLLineBreak>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitLineBreak, ApplyPropertyDefault<LineBreak, &RenderStyle::lineBreak, LineBreak, &RenderStyle::setLineBreak, LineBreak, &RenderStyle::initialLineBreak>::createHandler());
     setPropertyHandler(CSSPropertyWebkitLineClamp, ApplyPropertyDefault<const LineClampValue&, &RenderStyle::lineClamp, LineClampValue, &RenderStyle::setLineClamp, LineClampValue, &RenderStyle::initialLineClamp>::createHandler());
     setPropertyHandler(CSSPropertyWebkitLineGrid, ApplyPropertyString<MapNoneToNull, &RenderStyle::lineGrid, &RenderStyle::setLineGrid, &RenderStyle::initialLineGrid>::createHandler());
     setPropertyHandler(CSSPropertyWebkitLineSnap, ApplyPropertyDefault<LineSnap, &RenderStyle::lineSnap, LineSnap, &RenderStyle::setLineSnap, LineSnap, &RenderStyle::initialLineSnap>::createHandler());
diff --git a/Source/WebCore/css/StylePropertySet.cpp b/Source/WebCore/css/StylePropertySet.cpp
index 5e522af92..110b802c9 100644
--- a/Source/WebCore/css/StylePropertySet.cpp
+++ b/Source/WebCore/css/StylePropertySet.cpp
@@ -34,6 +34,10 @@
 #include <wtf/MemoryInstrumentationVector.h>
 #include <wtf/text/StringBuilder.h>
 
+#if ENABLE(CSS_VARIABLES)
+#include "CSSVariableValue.h"
+#endif
+
 #ifndef NDEBUG
 #include <stdio.h>
 #include <wtf/ASCIICType.h>
@@ -51,14 +55,14 @@ static PropertySetCSSOMWrapperMap& propertySetCSSOMWrapperMap()
     return propertySetCSSOMWrapperMapInstance;
 }
 
-static size_t immutableStylePropertySetSize(unsigned count)
+static size_t sizeForImmutableStylePropertySetWithPropertyCount(unsigned count)
 {
-    return sizeof(ImmutableStylePropertySet) + sizeof(CSSProperty) * count;
+    return sizeof(ImmutableStylePropertySet) - sizeof(void*) + sizeof(CSSValue*) * count + sizeof(StylePropertyMetadata) * count;
 }
 
 PassRefPtr<StylePropertySet> StylePropertySet::createImmutable(const CSSProperty* properties, unsigned count, CSSParserMode cssParserMode)
 {
-    void* slot = WTF::fastMalloc(immutableStylePropertySetSize(count));
+    void* slot = WTF::fastMalloc(sizeForImmutableStylePropertySetWithPropertyCount(count));
     return adoptRef(new (slot) ImmutableStylePropertySet(properties, count, cssParserMode));
 }
 
@@ -80,8 +84,20 @@ MutableStylePropertySet::MutableStylePropertySet(const CSSProperty* properties,
 ImmutableStylePropertySet::ImmutableStylePropertySet(const CSSProperty* properties, unsigned length, CSSParserMode cssParserMode)
     : StylePropertySet(cssParserMode, length)
 {
-    for (unsigned i = 0; i < length; ++i)
-        new (&reinterpret_cast<CSSProperty*>(&m_propertyArray)[i]) CSSProperty(properties[i]);
+    StylePropertyMetadata* metadataArray = const_cast<StylePropertyMetadata*>(immutableMetadataArray());
+    CSSValue** valueArray = const_cast<CSSValue**>(immutableValueArray());
+    for (unsigned i = 0; i < length; ++i) {
+        metadataArray[i] = properties[i].metadata();
+        valueArray[i] = properties[i].value();
+        valueArray[i]->ref();
+    }
+}
+
+ImmutableStylePropertySet::~ImmutableStylePropertySet()
+{
+    CSSValue** valueArray = const_cast<CSSValue**>(immutableValueArray());
+    for (unsigned i = 0; i < m_arraySize; ++i)
+        valueArray[i]->deref();
 }
 
 MutableStylePropertySet::MutableStylePropertySet(const StylePropertySet& other)
@@ -92,16 +108,10 @@ MutableStylePropertySet::MutableStylePropertySet(const StylePropertySet& other)
     else {
         m_propertyVector.reserveInitialCapacity(other.propertyCount());
         for (unsigned i = 0; i < other.propertyCount(); ++i)
-            m_propertyVector.uncheckedAppend(other.immutablePropertyArray()[i]);
+            m_propertyVector.uncheckedAppend(other.propertyAt(i).toCSSProperty());
     }
 }
 
-ImmutableStylePropertySet::~ImmutableStylePropertySet()
-{
-    for (unsigned i = 0; i < m_arraySize; ++i)
-        immutablePropertyArray()[i].~CSSProperty();
-}
-
 StylePropertySet::~StylePropertySet()
 {
     ASSERT(!m_ownsCSSOMWrapper || propertySetCSSOMWrapperMap().contains(this));
@@ -206,16 +216,17 @@ String StylePropertySet::borderSpacingValue(const StylePropertyShorthand& shorth
     return horizontalValueCSSText + ' ' + verticalValueCSSText;
 }
 
-bool StylePropertySet::appendFontLonghandValueIfExplicit(CSSPropertyID propertyId, StringBuilder& result) const
+bool StylePropertySet::appendFontLonghandValueIfExplicit(CSSPropertyID propertyID, StringBuilder& result) const
 {
-    const CSSProperty* property = findPropertyWithId(propertyId);
-    if (!property)
+    int foundPropertyIndex = findPropertyIndex(propertyID);
+    if (foundPropertyIndex == -1)
         return false; // All longhands must have at least implicit values if "font" is specified.
-    if (property->isImplicit())
+
+    if (propertyAt(foundPropertyIndex).isImplicit())
         return true;
 
     char prefix = '\0';
-    switch (propertyId) {
+    switch (propertyID) {
     case CSSPropertyFontStyle:
         break; // No prefix.
     case CSSPropertyFontFamily:
@@ -232,15 +243,19 @@ bool StylePropertySet::appendFontLonghandValueIfExplicit(CSSPropertyID propertyI
 
     if (prefix && !result.isEmpty())
         result.append(prefix);
-    result.append(property->value()->cssText());
+    result.append(propertyAt(foundPropertyIndex).value()->cssText());
 
     return true;
 }
 
 String StylePropertySet::fontValue() const
 {
-    const CSSProperty* fontSizeProperty = findPropertyWithId(CSSPropertyFontSize);
-    if (!fontSizeProperty || fontSizeProperty->isImplicit())
+    int foundPropertyIndex = findPropertyIndex(CSSPropertyFontSize);
+    if (foundPropertyIndex == -1)
+        return emptyString();
+
+    PropertyReference fontSizeProperty = propertyAt(foundPropertyIndex);
+    if (fontSizeProperty.isImplicit())
         return emptyString();
 
     StringBuilder result;
@@ -250,7 +265,7 @@ String StylePropertySet::fontValue() const
     success &= appendFontLonghandValueIfExplicit(CSSPropertyFontWeight, result);
     if (!result.isEmpty())
         result.append(' ');
-    result.append(fontSizeProperty->value()->cssText());
+    result.append(fontSizeProperty.value()->cssText());
     success &= appendFontLonghandValueIfExplicit(CSSPropertyLineHeight, result);
     success &= appendFontLonghandValueIfExplicit(CSSPropertyFontFamily, result);
     if (!success) {
@@ -265,36 +280,44 @@ String StylePropertySet::fontValue() const
 String StylePropertySet::get4Values(const StylePropertyShorthand& shorthand) const
 {
     // Assume the properties are in the usual order top, right, bottom, left.
-    const CSSProperty* top = findPropertyWithId(shorthand.properties()[0]);
-    const CSSProperty* right = findPropertyWithId(shorthand.properties()[1]);
-    const CSSProperty* bottom = findPropertyWithId(shorthand.properties()[2]);
-    const CSSProperty* left = findPropertyWithId(shorthand.properties()[3]);
+    int topValueIndex = findPropertyIndex(shorthand.properties()[0]);
+    int rightValueIndex = findPropertyIndex(shorthand.properties()[1]);
+    int bottomValueIndex = findPropertyIndex(shorthand.properties()[2]);
+    int leftValueIndex = findPropertyIndex(shorthand.properties()[3]);
+
+    if (topValueIndex == -1 || rightValueIndex == -1 || bottomValueIndex == -1 || leftValueIndex == -1)
+        return String();
+
+    PropertyReference top = propertyAt(topValueIndex);
+    PropertyReference right = propertyAt(rightValueIndex);
+    PropertyReference bottom = propertyAt(bottomValueIndex);
+    PropertyReference left = propertyAt(leftValueIndex);
 
     // All 4 properties must be specified.
-    if (!top || !top->value() || !right || !right->value() || !bottom || !bottom->value() || !left || !left->value())
+    if (!top.value() || !right.value() || !bottom.value() || !left.value())
         return String();
-    if (top->value()->isInitialValue() || right->value()->isInitialValue() || bottom->value()->isInitialValue() || left->value()->isInitialValue())
+    if (top.value()->isInitialValue() || right.value()->isInitialValue() || bottom.value()->isInitialValue() || left.value()->isInitialValue())
         return String();
-    if (top->isImportant() != right->isImportant() || right->isImportant() != bottom->isImportant() || bottom->isImportant() != left->isImportant())
+    if (top.isImportant() != right.isImportant() || right.isImportant() != bottom.isImportant() || bottom.isImportant() != left.isImportant())
         return String();
 
-    bool showLeft = right->value()->cssText() != left->value()->cssText();
-    bool showBottom = (top->value()->cssText() != bottom->value()->cssText()) || showLeft;
-    bool showRight = (top->value()->cssText() != right->value()->cssText()) || showBottom;
+    bool showLeft = right.value()->cssText() != left.value()->cssText();
+    bool showBottom = (top.value()->cssText() != bottom.value()->cssText()) || showLeft;
+    bool showRight = (top.value()->cssText() != right.value()->cssText()) || showBottom;
 
     StringBuilder result;
-    result.append(top->value()->cssText());
+    result.append(top.value()->cssText());
     if (showRight) {
         result.append(' ');
-        result.append(right->value()->cssText());
+        result.append(right.value()->cssText());
     }
     if (showBottom) {
         result.append(' ');
-        result.append(bottom->value()->cssText());
+        result.append(bottom.value()->cssText());
     }
     if (showLeft) {
         result.append(' ');
-        result.append(left->value()->cssText());
+        result.append(left.value()->cssText());
     }
     return result.toString();
 }
@@ -480,8 +503,10 @@ String StylePropertySet::borderPropertyValue(CommonValueMode valueMode) const
 
 PassRefPtr<CSSValue> StylePropertySet::getPropertyCSSValue(CSSPropertyID propertyID) const
 {
-    const CSSProperty* property = findPropertyWithId(propertyID);
-    return property ? property->value() : 0;
+    int foundPropertyIndex = findPropertyIndex(propertyID);
+    if (foundPropertyIndex == -1)
+        return 0;
+    return propertyAt(foundPropertyIndex).value();
 }
 
 bool StylePropertySet::removeShorthandProperty(CSSPropertyID propertyID)
@@ -503,28 +528,28 @@ bool StylePropertySet::removeProperty(CSSPropertyID propertyID, String* returnTe
         return true;
     }
 
-    CSSProperty* foundProperty = findPropertyWithId(propertyID);
-    if (!foundProperty) {
+    int foundPropertyIndex = findPropertyIndex(propertyID);
+    if (foundPropertyIndex == -1) {
         if (returnText)
             *returnText = "";
         return false;
     }
 
     if (returnText)
-        *returnText = foundProperty->value()->cssText();
+        *returnText = propertyAt(foundPropertyIndex).value()->cssText();
 
     // A more efficient removal strategy would involve marking entries as empty
     // and sweeping them when the vector grows too big.
-    mutablePropertyVector().remove(foundProperty - mutablePropertyVector().data());
+    mutablePropertyVector().remove(foundPropertyIndex);
     
     return true;
 }
 
 bool StylePropertySet::propertyIsImportant(CSSPropertyID propertyID) const
 {
-    const CSSProperty* property = findPropertyWithId(propertyID);
-    if (property)
-        return property->isImportant();
+    int foundPropertyIndex = findPropertyIndex(propertyID);
+    if (foundPropertyIndex != -1)
+        return propertyAt(foundPropertyIndex).isImportant();
 
     StylePropertyShorthand shorthand = shorthandForProperty(propertyID);
     if (!shorthand.length())
@@ -539,14 +564,18 @@ bool StylePropertySet::propertyIsImportant(CSSPropertyID propertyID) const
 
 CSSPropertyID StylePropertySet::getPropertyShorthand(CSSPropertyID propertyID) const
 {
-    const CSSProperty* property = findPropertyWithId(propertyID);
-    return property ? property->shorthandID() : CSSPropertyInvalid;
+    int foundPropertyIndex = findPropertyIndex(propertyID);
+    if (foundPropertyIndex == -1)
+        return CSSPropertyInvalid;
+    return propertyAt(foundPropertyIndex).shorthandID();
 }
 
 bool StylePropertySet::isPropertyImplicit(CSSPropertyID propertyID) const
 {
-    const CSSProperty* property = findPropertyWithId(propertyID);
-    return property ? property->isImplicit() : false;
+    int foundPropertyIndex = findPropertyIndex(propertyID);
+    if (foundPropertyIndex == -1)
+        return false;
+    return propertyAt(foundPropertyIndex).isImplicit();
 }
 
 bool StylePropertySet::setProperty(CSSPropertyID propertyID, const String& value, bool important, StyleSheetContents* contextStyleSheet)
@@ -577,20 +606,20 @@ void StylePropertySet::setProperty(CSSPropertyID propertyID, PassRefPtr<CSSValue
 
     RefPtr<CSSValue> value = prpValue;
     for (unsigned i = 0; i < shorthand.length(); ++i)
-        append(CSSProperty(shorthand.properties()[i], value, important));
+        mutablePropertyVector().append(CSSProperty(shorthand.properties()[i], value, important));
 }
 
 void StylePropertySet::setProperty(const CSSProperty& property, CSSProperty* slot)
 {
     ASSERT(isMutable());
     if (!removeShorthandProperty(property.id())) {
-        CSSProperty* toReplace = slot ? slot : findPropertyWithId(property.id());
+        CSSProperty* toReplace = slot ? slot : findMutableCSSPropertyWithID(property.id());
         if (toReplace) {
             *toReplace = property;
             return;
         }
     }
-    append(property);
+    mutablePropertyVector().append(property);
 }
 
 bool StylePropertySet::setProperty(CSSPropertyID propertyID, int identifier, bool important)
@@ -635,10 +664,10 @@ String StylePropertySet::asText() const
 {
     StringBuilder result;
 
-    const CSSProperty* positionXProp = 0;
-    const CSSProperty* positionYProp = 0;
-    const CSSProperty* repeatXProp = 0;
-    const CSSProperty* repeatYProp = 0;
+    int positionXPropertyIndex = -1;
+    int positionYPropertyIndex = -1;
+    int repeatXPropertyIndex = -1;
+    int repeatYPropertyIndex = -1;
 
     BitArray<numCSSProperties> shorthandPropertyUsed;
     BitArray<numCSSProperties> shorthandPropertyAppeared;
@@ -646,8 +675,8 @@ String StylePropertySet::asText() const
     unsigned size = propertyCount();
     unsigned numDecls = 0;
     for (unsigned n = 0; n < size; ++n) {
-        const CSSProperty& prop = propertyAt(n);
-        CSSPropertyID propertyID = prop.id();
+        PropertyReference property = propertyAt(n);
+        CSSPropertyID propertyID = property.id();
         CSSPropertyID shorthandPropertyID = CSSPropertyInvalid;
         CSSPropertyID borderFallbackShorthandProperty = CSSPropertyInvalid;
         String value;
@@ -657,20 +686,20 @@ String StylePropertySet::asText() const
         case CSSPropertyVariable:
             if (numDecls++)
                 result.append(' ');
-            result.append(prop.cssText());
+            result.append(property.cssText());
             continue;
 #endif
         case CSSPropertyBackgroundPositionX:
-            positionXProp = &prop;
+            positionXPropertyIndex = n;
             continue;
         case CSSPropertyBackgroundPositionY:
-            positionYProp = &prop;
+            positionYPropertyIndex = n;
             continue;
         case CSSPropertyBackgroundRepeatX:
-            repeatXProp = &prop;
+            repeatXPropertyIndex = n;
             continue;
         case CSSPropertyBackgroundRepeatY:
-            repeatYProp = &prop;
+            repeatYPropertyIndex = n;
             continue;
         case CSSPropertyBorderTopWidth:
         case CSSPropertyBorderRightWidth:
@@ -806,7 +835,7 @@ String StylePropertySet::asText() const
             propertyID = shorthandPropertyID;
             shorthandPropertyUsed.set(shortPropertyIndex);
         } else
-            value = prop.value()->cssText();
+            value = property.value()->cssText();
 
         if (value == "initial" && !CSSProperty::isInheritedProperty(propertyID))
             continue;
@@ -816,7 +845,7 @@ String StylePropertySet::asText() const
         result.append(getPropertyName(propertyID));
         result.appendLiteral(": ");
         result.append(value);
-        if (prop.isImportant())
+        if (property.isImportant())
             result.appendLiteral(" !important");
         result.append(';');
     }
@@ -825,58 +854,64 @@ String StylePropertySet::asText() const
     // It is required because background-position-x/y are non-standard properties and WebKit generated output
     // would not work in Firefox (<rdar://problem/5143183>)
     // It would be a better solution if background-position was CSS_PAIR.
-    if (positionXProp && positionYProp && positionXProp->isImportant() == positionYProp->isImportant()) {
+    if (positionXPropertyIndex != -1 && positionYPropertyIndex != -1 && propertyAt(positionXPropertyIndex).isImportant() == propertyAt(positionYPropertyIndex).isImportant()) {
+        PropertyReference positionXProperty = propertyAt(positionXPropertyIndex);
+        PropertyReference positionYProperty = propertyAt(positionYPropertyIndex);
+
         if (numDecls++)
             result.append(' ');
         result.appendLiteral("background-position: ");
-        if (positionXProp->value()->isValueList() || positionYProp->value()->isValueList())
+        if (positionXProperty.value()->isValueList() || positionYProperty.value()->isValueList())
             result.append(getLayeredShorthandValue(backgroundPositionShorthand()));
         else {
-            result.append(positionXProp->value()->cssText());
+            result.append(positionXProperty.value()->cssText());
             result.append(' ');
-            result.append(positionYProp->value()->cssText());
+            result.append(positionYProperty.value()->cssText());
         }
-        if (positionXProp->isImportant())
+        if (positionXProperty.isImportant())
             result.appendLiteral(" !important");
         result.append(';');
     } else {
-        if (positionXProp) {
+        if (positionXPropertyIndex != -1) {
             if (numDecls++)
                 result.append(' ');
-            result.append(positionXProp->cssText());
+            result.append(propertyAt(positionXPropertyIndex).cssText());
         }
-        if (positionYProp) {
+        if (positionYPropertyIndex != -1) {
             if (numDecls++)
                 result.append(' ');
-            result.append(positionYProp->cssText());
+            result.append(propertyAt(positionYPropertyIndex).cssText());
         }
     }
 
     // FIXME: We need to do the same for background-repeat.
-    if (repeatXProp && repeatYProp && repeatXProp->isImportant() == repeatYProp->isImportant()) {
+    if (repeatXPropertyIndex != -1 && repeatYPropertyIndex != -1 && propertyAt(repeatXPropertyIndex).isImportant() == propertyAt(repeatYPropertyIndex).isImportant()) {
+        PropertyReference repeatXProperty = propertyAt(repeatXPropertyIndex);
+        PropertyReference repeatYProperty = propertyAt(repeatYPropertyIndex);
+
         if (numDecls++)
             result.append(' ');
         result.appendLiteral("background-repeat: ");
-        if (repeatXProp->value()->isValueList() || repeatYProp->value()->isValueList())
+        if (repeatXProperty.value()->isValueList() || repeatYProperty.value()->isValueList())
             result.append(getLayeredShorthandValue(backgroundRepeatShorthand()));
         else {
-            result.append(repeatXProp->value()->cssText());
+            result.append(repeatXProperty.value()->cssText());
             result.append(' ');
-            result.append(repeatYProp->value()->cssText());
+            result.append(repeatYProperty.value()->cssText());
         }
-        if (repeatXProp->isImportant())
+        if (repeatXProperty.isImportant())
             result.appendLiteral(" !important");
         result.append(';');
     } else {
-        if (repeatXProp) {
+        if (repeatXPropertyIndex != -1) {
             if (numDecls++)
                 result.append(' ');
-            result.append(repeatXProp->cssText());
+            result.append(propertyAt(repeatXPropertyIndex).cssText());
         }
-        if (repeatYProp) {
+        if (repeatYPropertyIndex != -1) {
             if (numDecls++)
                 result.append(' ');
-            result.append(repeatYProp->cssText());
+            result.append(propertyAt(repeatYPropertyIndex).cssText());
         }
     }
 
@@ -889,12 +924,12 @@ void StylePropertySet::mergeAndOverrideOnConflict(const StylePropertySet* other)
     ASSERT(isMutable());
     unsigned size = other->propertyCount();
     for (unsigned n = 0; n < size; ++n) {
-        const CSSProperty& toMerge = other->propertyAt(n);
-        CSSProperty* old = findPropertyWithId(toMerge.id());
+        PropertyReference toMerge = other->propertyAt(n);
+        CSSProperty* old = findMutableCSSPropertyWithID(toMerge.id());
         if (old)
-            setProperty(toMerge, old);
+            setProperty(toMerge.toCSSProperty(), old);
         else
-            append(toMerge);
+            mutablePropertyVector().append(toMerge.toCSSProperty());
     }
 }
 
@@ -943,6 +978,12 @@ static const CSSPropertyID blockProperties[] = {
     CSSPropertyWidows
 };
 
+void StylePropertySet::clear()
+{
+    ASSERT(isMutable());
+    mutablePropertyVector().clear();
+}
+
 const unsigned numBlockProperties = WTF_ARRAY_LENGTH(blockProperties);
 
 PassRefPtr<StylePropertySet> StylePropertySet::copyBlockProperties() const
@@ -985,29 +1026,30 @@ bool StylePropertySet::removePropertiesInSet(const CSSPropertyID* set, unsigned
     return changed;
 }
 
-const CSSProperty* StylePropertySet::findPropertyWithId(CSSPropertyID propertyID) const
+int StylePropertySet::findPropertyIndex(CSSPropertyID propertyID) const
 {
     for (int n = propertyCount() - 1 ; n >= 0; --n) {
         if (propertyID == propertyAt(n).id())
-            return &propertyAt(n);
+            return n;
     }
-    return 0;
+    return -1;
 }
 
-CSSProperty* StylePropertySet::findPropertyWithId(CSSPropertyID propertyID)
+CSSProperty* StylePropertySet::findMutableCSSPropertyWithID(CSSPropertyID propertyID)
 {
     ASSERT(isMutable());
-    for (int n = propertyCount() - 1 ; n >= 0; --n) {
-        if (propertyID == propertyAt(n).id())
-            return &propertyAt(n);
-    }
-    return 0;
+    int foundPropertyIndex = findPropertyIndex(propertyID);
+    if (foundPropertyIndex == -1)
+        return 0;
+    return &mutablePropertyVector().at(foundPropertyIndex);
 }
     
-bool StylePropertySet::propertyMatches(const CSSProperty* property) const
+bool StylePropertySet::propertyMatches(const PropertyReference& property) const
 {
-    RefPtr<CSSValue> value = getPropertyCSSValue(property->id());
-    return value && value->cssText() == property->value()->cssText();
+    int foundPropertyIndex = findPropertyIndex(property.id());
+    if (foundPropertyIndex == -1)
+        return false;
+    return propertyAt(foundPropertyIndex).value()->cssText() == property.value()->cssText();
 }
     
 void StylePropertySet::removeEquivalentProperties(const StylePropertySet* style)
@@ -1016,8 +1058,8 @@ void StylePropertySet::removeEquivalentProperties(const StylePropertySet* style)
     Vector<CSSPropertyID> propertiesToRemove;
     unsigned size = mutablePropertyVector().size();
     for (unsigned i = 0; i < size; ++i) {
-        const CSSProperty& property = mutablePropertyVector().at(i);
-        if (style->propertyMatches(&property))
+        PropertyReference property = propertyAt(i);
+        if (style->propertyMatches(property))
             propertiesToRemove.append(property.id());
     }    
     // FIXME: This should use mass removal.
@@ -1031,8 +1073,8 @@ void StylePropertySet::removeEquivalentProperties(const CSSStyleDeclaration* sty
     Vector<CSSPropertyID> propertiesToRemove;
     unsigned size = mutablePropertyVector().size();
     for (unsigned i = 0; i < size; ++i) {
-        const CSSProperty& property = mutablePropertyVector().at(i);
-        if (style->cssPropertyMatches(&property))
+        PropertyReference property = propertyAt(i);
+        if (style->cssPropertyMatches(property))
             propertiesToRemove.append(property.id());
     }    
     // FIXME: This should use mass removal.
@@ -1097,19 +1139,19 @@ void StylePropertySet::clearParentElement(StyledElement* element)
 unsigned StylePropertySet::averageSizeInBytes()
 {
     // Please update this if the storage scheme changes so that this longer reflects the actual size.
-    return sizeof(StylePropertySet) + sizeof(CSSProperty) * 2;
+    return sizeForImmutableStylePropertySetWithPropertyCount(2);
 }
 
 void StylePropertySet::reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
 {
-    size_t actualSize = m_isMutable ? sizeof(StylePropertySet) : immutableStylePropertySetSize(m_arraySize);
+    size_t actualSize = m_isMutable ? sizeof(StylePropertySet) : sizeForImmutableStylePropertySetWithPropertyCount(m_arraySize);
     MemoryClassInfo info(memoryObjectInfo, this, WebCoreMemoryTypes::CSS, actualSize);
     if (m_isMutable)
         info.addMember(mutablePropertyVector());
-
-    unsigned count = propertyCount();
-    for (unsigned i = 0; i < count; ++i)
-        info.addMember(propertyAt(i));
+    else {
+        for (unsigned i = 0; i < propertyCount(); ++i)
+            info.addMember(propertyAt(i).value());
+    }
 }
 
 // See the function above if you need to update this.
@@ -1125,12 +1167,6 @@ void StylePropertySet::showStyle()
 }
 #endif
 
-inline void StylePropertySet::append(const CSSProperty& property)
-{
-    ASSERT(isMutable());
-    mutablePropertyVector().append(property);
-}
-
 PassRefPtr<StylePropertySet> StylePropertySet::create(CSSParserMode cssParserMode)
 {
     return adoptRef(new MutableStylePropertySet(cssParserMode));
@@ -1141,4 +1177,28 @@ PassRefPtr<StylePropertySet> StylePropertySet::create(const CSSProperty* propert
     return adoptRef(new MutableStylePropertySet(properties, count));
 }
 
+String StylePropertySet::PropertyReference::cssName() const
+{
+#if ENABLE(CSS_VARIABLES)
+    if (id() == CSSPropertyVariable) {
+        ASSERT(propertyValue()->isVariableValue());
+        return "-webkit-var-" + static_cast<const CSSVariableValue*>(propertyValue())->name();
+    }
+#endif
+    return getPropertyNameString(id());
+}
+
+String StylePropertySet::PropertyReference::cssText() const
+{
+    StringBuilder result;
+    result.append(cssName());
+    result.appendLiteral(": ");
+    result.append(propertyValue()->cssText());
+    if (isImportant())
+        result.appendLiteral(" !important");
+    result.append(';');
+    return result.toString();
+}
+
+
 } // namespace WebCore
diff --git a/Source/WebCore/css/StylePropertySet.h b/Source/WebCore/css/StylePropertySet.h
index 44b6b19fc..f70f1ff7b 100644
--- a/Source/WebCore/css/StylePropertySet.h
+++ b/Source/WebCore/css/StylePropertySet.h
@@ -42,6 +42,7 @@ class StylePropertyShorthand;
 class StyleSheetContents;
 
 class StylePropertySet : public RefCounted<StylePropertySet> {
+    friend class PropertyReference;
 public:
     ~StylePropertySet();
 
@@ -53,10 +54,53 @@ public:
     static PassRefPtr<StylePropertySet> create(const CSSProperty* properties, unsigned count);
     static PassRefPtr<StylePropertySet> createImmutable(const CSSProperty* properties, unsigned count, CSSParserMode);
 
+    class PropertyReference {
+    public:
+        PropertyReference(const StylePropertySet& propertySet, unsigned index)
+            : m_propertySet(propertySet)
+            , m_index(index)
+        {
+        }
+
+        CSSPropertyID id() const { return static_cast<CSSPropertyID>(propertyMetadata().m_propertyID); }
+        CSSPropertyID shorthandID() const { return static_cast<CSSPropertyID>(propertyMetadata().m_shorthandID); }
+
+        bool isImportant() const { return propertyMetadata().m_important; }
+        bool isInherited() const { return propertyMetadata().m_inherited; }
+        bool isImplicit() const { return propertyMetadata().m_implicit; }
+
+        String cssName() const;
+        String cssText() const;
+
+        const CSSValue* value() const { return propertyValue(); }
+        // FIXME: We should try to remove this mutable overload.
+        CSSValue* value() { return const_cast<CSSValue*>(propertyValue()); }
+
+        // FIXME: Remove this.
+        CSSProperty toCSSProperty() const { return CSSProperty(propertyMetadata(), const_cast<CSSValue*>(propertyValue())); }
+
+    private:
+        StylePropertyMetadata propertyMetadata() const
+        {
+            if (m_propertySet.isMutable())
+                return m_propertySet.mutablePropertyVector().at(m_index).metadata();
+            return m_propertySet.immutableMetadataArray()[m_index];
+        }
+
+        const CSSValue* propertyValue() const
+        {
+            if (m_propertySet.isMutable())
+                return m_propertySet.mutablePropertyVector().at(m_index).value();
+            return m_propertySet.immutableValueArray()[m_index];
+        }
+
+        const StylePropertySet& m_propertySet;
+        unsigned m_index;
+    };
+
     unsigned propertyCount() const;
     bool isEmpty() const;
-    const CSSProperty& propertyAt(unsigned index) const;
-    CSSProperty& propertyAt(unsigned index);
+    PropertyReference propertyAt(unsigned index) const { return PropertyReference(*this, index); }
 
     PassRefPtr<CSSValue> getPropertyCSSValue(CSSPropertyID) const;
     String getPropertyValue(CSSPropertyID) const;
@@ -79,6 +123,7 @@ public:
     void addParsedProperties(const Vector<CSSProperty>&);
     void addParsedProperty(const CSSProperty&);
 
+    void clear();
     PassRefPtr<StylePropertySet> copyBlockProperties() const;
     void removeBlockProperties();
     bool removePropertiesInSet(const CSSPropertyID* set, unsigned length);
@@ -115,7 +160,8 @@ public:
     void showStyle();
 #endif
 
-    const CSSProperty* immutablePropertyArray() const;
+    const CSSValue** immutableValueArray() const;
+    const StylePropertyMetadata* immutableMetadataArray() const;
 
 protected:
     StylePropertySet(CSSParserMode cssParserMode)
@@ -154,12 +200,10 @@ private:
     bool appendFontLonghandValueIfExplicit(CSSPropertyID, StringBuilder& result) const;
 
     bool removeShorthandProperty(CSSPropertyID);
-    bool propertyMatches(const CSSProperty*) const;
-
-    const CSSProperty* findPropertyWithId(CSSPropertyID) const;
-    CSSProperty* findPropertyWithId(CSSPropertyID);
+    bool propertyMatches(const PropertyReference&) const;
 
-    void append(const CSSProperty&);
+    int findPropertyIndex(CSSPropertyID) const;
+    CSSProperty* findMutableCSSPropertyWithID(CSSPropertyID);
 
     friend class PropertySetCSSStyleDeclaration;
 };
@@ -169,9 +213,21 @@ public:
     ImmutableStylePropertySet(const CSSProperty*, unsigned count, CSSParserMode);
     ~ImmutableStylePropertySet();
 
-    void* m_propertyArray;
+    void* m_storage;
 };
 
+inline const CSSValue** StylePropertySet::immutableValueArray() const
+{
+    ASSERT(!m_isMutable);
+    return reinterpret_cast<const CSSValue**>(const_cast<const void**>((&static_cast<const ImmutableStylePropertySet*>(this)->m_storage)));
+}
+
+inline const StylePropertyMetadata* StylePropertySet::immutableMetadataArray() const
+{
+    ASSERT(!m_isMutable);
+    return reinterpret_cast<const StylePropertyMetadata*>(&reinterpret_cast<const char*>((&static_cast<const ImmutableStylePropertySet*>(this)->m_storage))[m_arraySize * sizeof(CSSValue*)]);
+}
+
 class MutableStylePropertySet : public StylePropertySet {
 public:
     MutableStylePropertySet(CSSParserMode cssParserMode)
@@ -195,24 +251,6 @@ inline const Vector<CSSProperty, 4>& StylePropertySet::mutablePropertyVector() c
     return static_cast<const MutableStylePropertySet*>(this)->m_propertyVector;
 }
 
-inline const CSSProperty* StylePropertySet::immutablePropertyArray() const
-{
-    ASSERT(!m_isMutable);
-    return reinterpret_cast<const CSSProperty*>(&static_cast<const ImmutableStylePropertySet*>(this)->m_propertyArray);
-}
-
-inline CSSProperty& StylePropertySet::propertyAt(unsigned index)
-{
-    return mutablePropertyVector().at(index);
-}
-
-inline const CSSProperty& StylePropertySet::propertyAt(unsigned index) const
-{
-    if (m_isMutable)
-        return mutablePropertyVector().at(index);
-    return immutablePropertyArray()[index];
-}
-
 inline unsigned StylePropertySet::propertyCount() const
 {
     if (m_isMutable)
diff --git a/Source/WebCore/css/StyleResolver.cpp b/Source/WebCore/css/StyleResolver.cpp
index ad8ddcb3c..7ccdfffd7 100644
--- a/Source/WebCore/css/StyleResolver.cpp
+++ b/Source/WebCore/css/StyleResolver.cpp
@@ -117,7 +117,6 @@
 #include "StylePendingImage.h"
 #include "StyleRule.h"
 #include "StyleRuleImport.h"
-#include "StyleScopeResolver.h"
 #include "StyleSheetContents.h"
 #include "StyleSheetList.h"
 #include "Text.h"
@@ -148,6 +147,7 @@
 
 #if ENABLE(SVG)
 #include "CachedSVGDocument.h"
+#include "CachedSVGDocumentReference.h"
 #include "SVGDocument.h"
 #include "SVGElement.h"
 #include "SVGNames.h"
@@ -157,6 +157,7 @@
 
 #if ENABLE(CSS_SHADERS)
 #include "CustomFilterArrayParameter.h"
+#include "CustomFilterConstants.h"
 #include "CustomFilterNumberParameter.h"
 #include "CustomFilterOperation.h"
 #include "CustomFilterParameter.h"
@@ -176,6 +177,14 @@
 
 using namespace std;
 
+namespace WTF {
+
+template<> struct SequenceMemoryInstrumentationTraits<const WebCore::RuleData*> {
+    template <typename I> static void reportMemoryUsage(I, I, MemoryClassInfo&) { }
+};
+
+}
+
 namespace WebCore {
 
 using namespace HTMLNames;
@@ -273,7 +282,6 @@ StyleResolver::StyleResolver(Document* document, bool matchAuthorAndUserStyles)
     , m_matchAuthorAndUserStyles(matchAuthorAndUserStyles)
     , m_sameOriginOnly(false)
     , m_distributedToInsertionPoint(false)
-    , m_hasUnknownPseudoElements(false)
     , m_fontSelector(CSSFontSelector::create(document))
     , m_applyPropertyToRegularStyle(true)
     , m_applyPropertyToVisitedLinkStyle(false)
@@ -331,25 +339,9 @@ StyleResolver::StyleResolver(Document* document, bool matchAuthorAndUserStyles)
     }
 #endif
 
-    addStylesheetsFromSeamlessParents();
     appendAuthorStyleSheets(0, styleSheetCollection->activeAuthorStyleSheets());
 }
 
-void StyleResolver::addStylesheetsFromSeamlessParents()
-{
-    // Build a list of stylesheet lists from our ancestors, and walk that
-    // list in reverse order so that the root-most sheets are appended first.
-    Document* childDocument = document();
-    Vector<const Vector<RefPtr<CSSStyleSheet> >* > ancestorSheets;
-    while (HTMLIFrameElement* parentIFrame = childDocument->seamlessParentIFrame()) {
-        Document* parentDocument = parentIFrame->document();
-        ancestorSheets.append(&parentDocument->styleSheetCollection()->activeAuthorStyleSheets());
-        childDocument = parentDocument;
-    }
-    for (int i = ancestorSheets.size() - 1; i >= 0; i--)
-        appendAuthorStyleSheets(0, *ancestorSheets[i]);
-}
-
 void StyleResolver::addAuthorRulesAndCollectUserRulesFromSheets(const Vector<RefPtr<CSSStyleSheet> >* userSheets, RuleSet& userStyle)
 {
     if (!userSheets)
@@ -372,7 +364,7 @@ static PassOwnPtr<RuleSet> makeRuleSet(const Vector<RuleFeature>& rules)
         return nullptr;
     OwnPtr<RuleSet> ruleSet = RuleSet::create();
     for (size_t i = 0; i < size; ++i)
-        ruleSet->addRule(rules[i].rule, rules[i].selectorIndex, rules[i].hasDocumentSecurityOrigin, false);
+        ruleSet->addRule(rules[i].rule, rules[i].selectorIndex, rules[i].hasDocumentSecurityOrigin ? RuleHasDocumentSecurityOrigin : RuleHasNoSpecialState);
     ruleSet->shrinkToFit();
     return ruleSet.release();
 }
@@ -411,12 +403,12 @@ void StyleResolver::appendAuthorStyleSheets(unsigned firstNew, const Vector<RefP
         if (cssSheet->mediaQueries() && !m_medium->eval(cssSheet->mediaQueries(), this))
             continue;
         StyleSheetContents* sheet = cssSheet->contents();
+#if ENABLE(STYLE_SCOPED) || ENABLE(SHADOW_DOM)
         if (const ContainerNode* scope = StyleScopeResolver::scopeFor(cssSheet)) {
-            if (!m_scopeResolver)
-                m_scopeResolver = adoptPtr(new StyleScopeResolver());
-            m_scopeResolver->ensureRuleSetFor(scope)->addRulesFromSheet(sheet, *m_medium, this, scope);
+            ensureScopeResolver()->ensureRuleSetFor(scope)->addRulesFromSheet(sheet, *m_medium, this, scope);
             continue;
         }
+#endif
 
         m_authorStyle->addRulesFromSheet(sheet, *m_medium, this);
         if (!m_styleRuleToCSSOMWrapperMap.isEmpty())
@@ -637,11 +629,56 @@ inline void StyleResolver::addElementStyleProperties(MatchResult& result, const
         result.isCacheable = false;
 }
 
+class MatchingUARulesScope {
+public:
+    MatchingUARulesScope();
+    ~MatchingUARulesScope();
+
+    static bool isMatchingUARules();
+
+private:
+    static bool m_matchingUARules;
+};
+
+MatchingUARulesScope::MatchingUARulesScope()
+{
+    ASSERT(!m_matchingUARules);
+    m_matchingUARules = true;
+}
+
+MatchingUARulesScope::~MatchingUARulesScope()
+{
+    m_matchingUARules = false;
+}
+
+inline bool MatchingUARulesScope::isMatchingUARules()
+{
+    return m_matchingUARules;
+}
+
+bool MatchingUARulesScope::m_matchingUARules = false;
+
 void StyleResolver::collectMatchingRules(RuleSet* rules, int& firstRuleIndex, int& lastRuleIndex, const MatchOptions& options)
 {
     ASSERT(rules);
     ASSERT(m_element);
 
+    const AtomicString& pseudoId = m_element->shadowPseudoId();
+    if (!pseudoId.isEmpty()) {
+        ASSERT(m_styledElement);
+        collectMatchingRulesForList(rules->shadowPseudoElementRules(pseudoId.impl()), firstRuleIndex, lastRuleIndex, options);
+    }
+
+    // Check whether other types of rules are applicable in the current tree scope. Criteria for this:
+    // a) it's a UA rule
+    // b) the tree scope allows author rules
+    // c) the rules comes from a scoped style sheet within the same tree scope
+    TreeScope* treeScope = m_element->treeScope();
+    if (!MatchingUARulesScope::isMatchingUARules()
+        && !treeScope->applyAuthorStyles()
+        && (!options.scope || options.scope->treeScope() != treeScope))
+        return;
+
     // We need to collect the rules for id, class, tag, and everything else into a buffer and
     // then sort the buffer.
     if (m_element->hasID())
@@ -650,11 +687,7 @@ void StyleResolver::collectMatchingRules(RuleSet* rules, int& firstRuleIndex, in
         for (size_t i = 0; i < m_styledElement->classNames().size(); ++i)
             collectMatchingRulesForList(rules->classRules(m_styledElement->classNames()[i].impl()), firstRuleIndex, lastRuleIndex, options);
     }
-    const AtomicString& pseudoId = m_element->shadowPseudoId();
-    if (!pseudoId.isEmpty()) {
-        ASSERT(m_styledElement);
-        collectMatchingRulesForList(rules->shadowPseudoElementRules(pseudoId.impl()), firstRuleIndex, lastRuleIndex, options);
-    }
+
     if (m_element->isLink())
         collectMatchingRulesForList(rules->linkPseudoClassRules(), firstRuleIndex, lastRuleIndex, options);
     if (m_checker.matchesFocusPseudoClass(m_element))
@@ -710,7 +743,12 @@ void StyleResolver::sortAndTransferMatchedRules(MatchResult& result)
 void StyleResolver::matchScopedAuthorRules(MatchResult& result, bool includeEmptyRules)
 {
 #if ENABLE(STYLE_SCOPED) || ENABLE(SHADOW_DOM)
-    if (!m_scopeResolver || !m_scopeResolver->hasScopedStyles())
+    if (!m_scopeResolver)
+        return;
+
+    matchHostRules(result, includeEmptyRules);
+
+    if (!m_scopeResolver->hasScopedStyles())
         return;
 
     // Match scoped author rules by traversing the scoped element stack (rebuild it if it got inconsistent).
@@ -742,6 +780,35 @@ void StyleResolver::matchScopedAuthorRules(MatchResult& result, bool includeEmpt
 #endif
 }
 
+inline bool StyleResolver::styleSharingCandidateMatchesHostRules()
+{
+#if ENABLE(SHADOW_DOM)
+    return m_scopeResolver && m_scopeResolver->styleSharingCandidateMatchesHostRules(m_element);
+#else
+    return false;
+#endif
+}
+
+void StyleResolver::matchHostRules(MatchResult& result, bool includeEmptyRules)
+{
+#if ENABLE(SHADOW_DOM)
+    ASSERT(m_scopeResolver);
+
+    Vector<RuleSet*> matchedRules;
+    m_scopeResolver->matchHostRules(m_element, matchedRules);
+    if (matchedRules.isEmpty())
+        return;
+
+    MatchOptions options(includeEmptyRules);
+    options.scope = m_element;
+    for (unsigned i = matchedRules.size(); i > 0; --i)
+        collectMatchingRules(matchedRules.at(i-1), result.ranges.firstAuthorRule, result.ranges.lastAuthorRule, options);
+#else
+    UNUSED_PARAM(result);
+    UNUSED_PARAM(includeEmptyRules);
+#endif
+}
+
 void StyleResolver::matchAuthorRules(MatchResult& result, bool includeEmptyRules)
 {
     m_matchedRules.clear();
@@ -784,42 +851,11 @@ void StyleResolver::matchUARules(MatchResult& result, RuleSet* rules)
     sortAndTransferMatchedRules(result);
 }
 
-class MatchingUARulesScope {
-public:
-    MatchingUARulesScope();
-    ~MatchingUARulesScope();
-
-    static bool isMatchingUARules();
-
-private:
-    static bool m_matchingUARules;
-};
-
-MatchingUARulesScope::MatchingUARulesScope()
-{
-    ASSERT(!m_matchingUARules);
-    m_matchingUARules = true;
-}
-
-MatchingUARulesScope::~MatchingUARulesScope()
-{
-    m_matchingUARules = false;
-}
-
-inline bool MatchingUARulesScope::isMatchingUARules()
-{
-    return m_matchingUARules;
-}
-
-bool MatchingUARulesScope::m_matchingUARules = false;
-
 void StyleResolver::collectMatchingRulesForList(const Vector<RuleData>* rules, int& firstRuleIndex, int& lastRuleIndex, const MatchOptions& options)
 {
     if (!rules)
         return;
 
-    TreeScope* treeScope = m_element->treeScope();
-
     // In some cases we may end up looking up style for random elements in the middle of a recursive tree resolve.
     // Ancestor identifier filter won't be up-to-date in that case and we can't use the fast path.
     bool canUseFastReject = m_checker.parentStackIsConsistent(m_parentNode);
@@ -833,19 +869,6 @@ void StyleResolver::collectMatchingRulesForList(const Vector<RuleData>* rules, i
         StyleRule* rule = ruleData.rule();
         InspectorInstrumentationCookie cookie = InspectorInstrumentation::willMatchRule(document(), rule);
         if (checkSelector(ruleData, options.scope)) {
-            // Check whether the rule is applicable in the current tree scope. Criteria for this:
-            // a) it's a UA rule
-            // b) the tree scope allows author rules
-            // c) the rules comes from a scoped style sheet within the same tree scope
-            // d) the rule contains shadow-ID pseudo elements
-            if (!MatchingUARulesScope::isMatchingUARules()
-                && !treeScope->applyAuthorStyles()
-                && (!options.scope || options.scope->treeScope() != treeScope)
-                && !m_hasUnknownPseudoElements) {
-
-                InspectorInstrumentation::didMatchRule(cookie, false);
-                continue;
-            }
             // If the rule has no properties to apply, then ignore it in the non-debug mode.
             const StylePropertySet* properties = rule->properties();
             if (!properties || (properties->isEmpty() && !options.includeEmptyRules)) {
@@ -959,21 +982,10 @@ inline bool shouldResetStyleInheritance(NodeRenderingContext& context)
     if (context.resetStyleInheritance())
         return true;
 
-    InsertionPoint* insertionPoint = context.insertionPoint();
-    if (!insertionPoint)
-        return false;
-
-    ASSERT(parentElementForDistribution(context.node()));
-    ElementShadow* shadow = parentElementForDistribution(context.node())->shadow();
-    ASSERT(shadow);
+    if (InsertionPoint* insertionPoint = context.insertionPoint())
+        return insertionPoint->resetStyleInheritance();
 
-    for ( ; insertionPoint; ) {
-        InsertionPoint* youngerInsertionPoint = shadow->insertionPointFor(insertionPoint);
-        if (!youngerInsertionPoint)
-            break;
-        insertionPoint = youngerInsertionPoint;
-    }
-    return insertionPoint->resetStyleInheritance();
+    return false;
 }
 
 inline void StyleResolver::initForStyleResolve(Element* e, RenderStyle* parentStyle, PseudoId pseudoID)
@@ -1124,10 +1136,10 @@ static inline bool attributeStylesEqual(const StylePropertySet* a, const StylePr
         return false;
     unsigned propertyCount = a->propertyCount();
     for (unsigned i = 0; i < propertyCount; ++i) {
-        const CSSProperty& aProperty = a->propertyAt(i);
+        StylePropertySet::PropertyReference aProperty = a->propertyAt(i);
         unsigned j;
         for (j = 0; j < propertyCount; ++j) {
-            const CSSProperty& bProperty = b->propertyAt(j);
+            StylePropertySet::PropertyReference bProperty = b->propertyAt(j);
             if (aProperty.id() != bProperty.id())
                 continue;
             // We could get a few more hits by comparing cssText() here, but that gets expensive quickly.
@@ -1187,8 +1199,6 @@ bool StyleResolver::canShareStyleWithElement(StyledElement* element) const
         return false;
     if (element == element->document()->cssTarget())
         return false;
-    if (m_element == m_element->document()->cssTarget())
-        return false;
     if (element->fastGetAttribute(XMLNames::langAttr) != m_element->fastGetAttribute(XMLNames::langAttr))
         return false;
     if (element->fastGetAttribute(langAttr) != m_element->fastGetAttribute(langAttr))
@@ -1204,9 +1214,7 @@ bool StyleResolver::canShareStyleWithElement(StyledElement* element) const
 
 #if ENABLE(PROGRESS_ELEMENT)
     if (element->hasTagName(progressTag)) {
-        if (!m_element->hasTagName(progressTag))
-            return false;
-
+        ASSERT(m_element->hasTagName(progressTag));
         HTMLProgressElement* thisProgressElement = static_cast<HTMLProgressElement*>(element);
         HTMLProgressElement* otherProgressElement = static_cast<HTMLProgressElement*>(m_element);
         if (thisProgressElement->isDeterminate() != otherProgressElement->isDeterminate())
@@ -1243,7 +1251,7 @@ bool StyleResolver::canShareStyleWithElement(StyledElement* element) const
         return false;
 #endif
 
-    if (elementHasDirectionAuto(element) || elementHasDirectionAuto(m_element))
+    if (elementHasDirectionAuto(element))
         return false;
 
     if (element->hasClass()) {
@@ -1309,6 +1317,10 @@ RenderStyle* StyleResolver::locateSharedStyle()
         return 0;
     if (m_styledElement->hasScopedHTMLStyleChild())
         return 0;
+    if (m_element == m_element->document()->cssTarget())
+        return 0;
+    if (elementHasDirectionAuto(m_element))
+        return 0;
 
     // Check previous siblings and their cousins.
     unsigned count = 0;
@@ -1332,6 +1344,9 @@ RenderStyle* StyleResolver::locateSharedStyle()
     // Can't share if attribute rules apply.
     if (styleSharingCandidateMatchesRuleSet(m_uncommonAttributeRuleSet.get()))
         return 0;
+    // Can't share if @host @-rules apply.
+    if (styleSharingCandidateMatchesHostRules())
+        return 0;
     // Tracking child index requires unique style for each node. This may get set by the sibling rule match above.
     if (parentStylePreventsSharing(m_parentStyle))
         return 0;
@@ -1539,9 +1554,10 @@ PassRefPtr<RenderStyle> StyleResolver::styleForElement(Element* element, RenderS
     // contenteditable attribute (implemented by -webkit-user-modify) should
     // be propagated from shadow host to distributed node.
     if (m_distributedToInsertionPoint) {
-        ASSERT(element->parentElement());
-        if (RenderStyle* styleOfShadowHost = element->parentElement()->renderStyle())
-            m_style->setUserModify(styleOfShadowHost->userModify());
+        if (Element* parent = element->parentElement()) {
+            if (RenderStyle* styleOfShadowHost = parent->renderStyle())
+                m_style->setUserModify(styleOfShadowHost->userModify());
+        }
     }
 
     if (element->isLink()) {
@@ -2159,7 +2175,6 @@ PassRefPtr<CSSRuleList> StyleResolver::pseudoStyleRulesForElement(Element* e, Ps
 inline bool StyleResolver::checkSelector(const RuleData& ruleData, const ContainerNode* scope)
 {
     m_dynamicPseudo = NOPSEUDO;
-    m_hasUnknownPseudoElements = false;
 
     if (ruleData.hasFastCheckableSelector()) {
         // We know this selector does not include any pseudo elements.
@@ -2183,7 +2198,7 @@ inline bool StyleResolver::checkSelector(const RuleData& ruleData, const Contain
     context.elementParentStyle = m_parentNode ? m_parentNode->renderStyle() : 0;
     context.scope = scope;
     context.pseudoStyle = m_pseudoStyle;
-    SelectorChecker::SelectorMatch match = m_checker.checkSelector(context, m_dynamicPseudo, m_hasUnknownPseudoElements);
+    SelectorChecker::SelectorMatch match = m_checker.checkSelector(context, m_dynamicPseudo);
     if (match != SelectorChecker::SelectorMatches)
         return false;
     if (m_pseudoStyle != NOPSEUDO && m_pseudoStyle != m_dynamicPseudo)
@@ -2196,7 +2211,6 @@ bool StyleResolver::checkRegionSelector(CSSSelector* regionSelector, Element* re
     if (!regionSelector || !regionElement)
         return false;
 
-    m_hasUnknownPseudoElements = false;
     m_pseudoStyle = NOPSEUDO;
 
     for (CSSSelector* s = regionSelector; s; s = CSSSelectorList::next(s))
@@ -2227,7 +2241,7 @@ void StyleResolver::applyProperties(const StylePropertySet* properties, StyleRul
 
     unsigned propertyCount = properties->propertyCount();
     for (unsigned i = 0; i < propertyCount; ++i) {
-        const CSSProperty& current = properties->propertyAt(i);
+        StylePropertySet::PropertyReference current = properties->propertyAt(i);
         if (isImportant != current.isImportant())
             continue;
         if (inheritedOnly && !current.isInherited()) {
@@ -2780,7 +2794,7 @@ void StyleResolver::resolveVariables(CSSPropertyID id, CSSValue* value, Vector<s
         return; // expression failed to parse.
 
     for (unsigned i = 0; i < resultSet->propertyCount(); i++) {
-        const CSSProperty& property = resultSet->propertyAt(i);
+        StylePropertySet::PropertyReference property = resultSet->propertyAt(i);
         if (property.id() != CSSPropertyVariable && hasVariableReference(property.value()))
             resolveVariables(property.id(), property.value(), knownExpressions);
         else
@@ -4235,11 +4249,6 @@ Color StyleResolver::colorFromPrimitiveValue(CSSPrimitiveValue* value, bool forV
     }
 }
 
-bool StyleResolver::hasSelectorForAttribute(const AtomicString &attrname) const
-{
-    return m_features.attrsInRules.contains(attrname.impl());
-}
-
 void StyleResolver::addViewportDependentMediaQueryResult(const MediaQueryExp* expr, bool result)
 {
     m_viewportDependentMediaQueryResults.append(adoptPtr(new MediaQueryResult(*expr, result)));
@@ -4586,7 +4595,7 @@ void StyleResolver::loadPendingSVGDocuments()
                 continue;
 
             // Stash the CachedSVGDocument on the reference filter.
-            referenceFilter->setData(cachedDocument);
+            referenceFilter->setData(adoptPtr(new CachedSVGDocumentReference(cachedDocument)));
         }
     }
     m_pendingSVGDocuments.clear();
@@ -4765,16 +4774,18 @@ PassRefPtr<CustomFilterOperation> StyleResolver::createCustomFilterOperation(Web
     ASSERT(shadersValue->isValueList());
     CSSValueList* shadersList = static_cast<CSSValueList*>(shadersValue);
 
-    ASSERT(shadersList->length());
-    RefPtr<StyleShader> vertexShader = styleShader(shadersList->itemWithoutBoundsCheck(0));
+    unsigned shadersListLength = shadersList->length();
+    ASSERT(shadersListLength);
 
+    RefPtr<StyleShader> vertexShader = styleShader(shadersList->itemWithoutBoundsCheck(0));
     RefPtr<StyleShader> fragmentShader;
-    CustomFilterProgramType programType = PROGRAM_TYPE_NO_ELEMENT_TEXTURE;
+    CustomFilterProgramType programType = PROGRAM_TYPE_BLENDS_ELEMENT_TEXTURE;
     CustomFilterProgramMixSettings mixSettings;
-    if (shadersList->length() > 1) {
+
+    if (shadersListLength > 1) {
         CSSValue* fragmentShaderOrMixFunction = shadersList->itemWithoutBoundsCheck(1);
+
         if (fragmentShaderOrMixFunction->isWebKitCSSMixFunctionValue()) {
-            programType = PROGRAM_TYPE_BLENDS_ELEMENT_TEXTURE;
             WebKitCSSMixFunctionValue* mixFunction = static_cast<WebKitCSSMixFunctionValue*>(fragmentShaderOrMixFunction);
             CSSValueListIterator iterator(mixFunction);
 
@@ -4793,14 +4804,16 @@ PassRefPtr<CustomFilterOperation> StyleResolver::createCustomFilterOperation(Web
                     ASSERT_NOT_REACHED();
                 iterator.advance();
             }
-        } else
+        } else {
+            programType = PROGRAM_TYPE_NO_ELEMENT_TEXTURE;
             fragmentShader = styleShader(fragmentShaderOrMixFunction);
+        }
     }
     
     unsigned meshRows = 1;
     unsigned meshColumns = 1;
-    CustomFilterOperation::MeshBoxType meshBoxType = CustomFilterOperation::FILTER_BOX;
-    CustomFilterOperation::MeshType meshType = CustomFilterOperation::ATTACHED;
+    CustomFilterMeshBoxType meshBoxType = MeshBoxTypeFilter;
+    CustomFilterMeshType meshType = MeshTypeAttached;
     
     CSSValue* parametersValue = 0;
     
@@ -4816,14 +4829,14 @@ PassRefPtr<CustomFilterOperation> StyleResolver::createCustomFilterOperation(Web
             if (primitiveValue->isNumber()) {
                 // If only one integer value is specified, it will set both
                 // the rows and the columns.
-                meshRows = meshColumns = primitiveValue->getIntValue();
+                meshColumns = meshRows = primitiveValue->getIntValue();
                 iterator.advance();
                 
-                // Try to match another number for the columns.
+                // Try to match another number for the rows.
                 if (iterator.hasMore() && iterator.isPrimitiveValue()) {
                     CSSPrimitiveValue* primitiveValue = static_cast<CSSPrimitiveValue*>(iterator.value());
                     if (primitiveValue->isNumber()) {
-                        meshColumns = primitiveValue->getIntValue();
+                        meshRows = primitiveValue->getIntValue();
                         iterator.advance();
                     }
                 }
@@ -4844,7 +4857,7 @@ PassRefPtr<CustomFilterOperation> StyleResolver::createCustomFilterOperation(Web
         if (iterator.hasMore() && iterator.isPrimitiveValue()) {
             CSSPrimitiveValue* primitiveValue = static_cast<CSSPrimitiveValue*>(iterator.value());
             if (primitiveValue->getIdent() == CSSValueDetached) {
-                meshType = CustomFilterOperation::DETACHED;
+                meshType = MeshTypeDetached;
                 iterator.advance();
             }
         }
@@ -4864,7 +4877,7 @@ PassRefPtr<CustomFilterOperation> StyleResolver::createCustomFilterOperation(Web
     if (parametersValue && !parseCustomFilterParameterList(parametersValue, parameterList))
         return 0;
     
-    RefPtr<StyleCustomFilterProgram> program = StyleCustomFilterProgram::create(vertexShader.release(), fragmentShader.release(), programType, mixSettings);
+    RefPtr<StyleCustomFilterProgram> program = StyleCustomFilterProgram::create(vertexShader.release(), fragmentShader.release(), programType, mixSettings, meshType);
     return CustomFilterOperation::create(program.release(), parameterList, meshRows, meshColumns, meshBoxType, meshType);
 }
 #endif
@@ -4896,6 +4909,11 @@ bool StyleResolver::createFilterOperations(CSSValue* inValue, RenderStyle* style
         FilterOperation::OperationType operationType = filterOperationForType(filterValue->operationType());
 
 #if ENABLE(CSS_SHADERS)
+        if (operationType == FilterOperation::VALIDATED_CUSTOM) {
+            // ValidatedCustomFilterOperation is not supposed to end up in the RenderStyle.
+            ASSERT_NOT_REACHED();
+            continue;
+        }
         if (operationType == FilterOperation::CUSTOM) {
             RefPtr<CustomFilterOperation> operation = createCustomFilterOperation(filterValue);
             if (!operation)
@@ -4921,8 +4939,8 @@ bool StyleResolver::createFilterOperations(CSSValue* inValue, RenderStyle* style
             if (SVGURIReference::isExternalURIReference(svgDocumentValue->url(), m_element->document())) {
                 if (!svgDocumentValue->loadRequested())
                     m_pendingSVGDocuments.set(operation.get(), svgDocumentValue);
-                else
-                    operation->setData(svgDocumentValue->cachedSVGDocument());
+                else if (svgDocumentValue->cachedSVGDocument())
+                    operation->setData(adoptPtr(new CachedSVGDocumentReference(svgDocumentValue->cachedSVGDocument())));
             }
             operations.operations().append(operation);
 #endif
diff --git a/Source/WebCore/css/StyleResolver.h b/Source/WebCore/css/StyleResolver.h
index 5b514ce55..f76993442 100644
--- a/Source/WebCore/css/StyleResolver.h
+++ b/Source/WebCore/css/StyleResolver.h
@@ -29,8 +29,10 @@
 #include "MediaQueryExp.h"
 #include "RenderStyle.h"
 #include "RuleFeature.h"
+#include "RuntimeEnabledFeatures.h"
 #include "SelectorChecker.h"
 #include "StyleInheritedData.h"
+#include "StyleScopeResolver.h"
 #include <wtf/HashMap.h>
 #include <wtf/HashSet.h>
 #include <wtf/RefPtr.h>
@@ -59,6 +61,7 @@ class CSSValue;
 class ContainerNode;
 class CustomFilterOperation;
 class CustomFilterParameter;
+class CustomFilterParameterList;
 class Document;
 class Element;
 class Frame;
@@ -80,6 +83,7 @@ class StyleKeyframe;
 class StylePendingImage;
 class StylePropertySet;
 class StyleRule;
+class StyleRuleHost;
 class StyleRuleKeyframes;
 class StyleRulePage;
 class StyleRuleRegion;
@@ -92,10 +96,6 @@ class WebKitCSSFilterValue;
 class WebKitCSSShaderValue;
 class WebKitCSSSVGDocumentValue;
 
-#if ENABLE(CSS_SHADERS)
-typedef Vector<RefPtr<CustomFilterParameter> > CustomFilterParameterList;
-#endif
-
 class MediaQueryResult {
     WTF_MAKE_NONCOPYABLE(MediaQueryResult); WTF_MAKE_FAST_ALLOCATED;
 public:
@@ -137,6 +137,9 @@ public:
     void popParentElement(Element*);
     void pushParentShadowRoot(const ShadowRoot*);
     void popParentShadowRoot(const ShadowRoot*);
+#if ENABLE(SHADOW_DOM)
+    void addHostRule(StyleRuleHost* rule, bool hasDocumentSecurityOrigin, const ContainerNode* scope) { ensureScopeResolver()->addHostRule(rule, hasDocumentSecurityOrigin, scope); }
+#endif
 
     PassRefPtr<RenderStyle> styleForElement(Element*, RenderStyle* parentStyle = 0, StyleSharingBehavior = AllowStyleSharing,
         RuleMatchingBehavior = MatchAllRules, RenderRegion* regionForStyling = 0);
@@ -166,11 +169,30 @@ public:
     void appendAuthorStyleSheets(unsigned firstNew, const Vector<RefPtr<CSSStyleSheet> >&);
 
 private:
+#if ENABLE(STYLE_SCOPED) || ENABLE(SHADOW_DOM)
+    StyleScopeResolver* ensureScopeResolver()
+    {
+#if ENABLE(STYLE_SCOPED)
+#if ENABLE(SHADOW_DOM)
+        ASSERT(RuntimeEnabledFeatures::shadowDOMEnabled() || RuntimeEnabledFeatures::styleScopedEnabled());
+#else
+        ASSERT(RuntimeEnabledFeatures::styleScopedEnabled());
+#endif
+#else
+        ASSERT(RuntimeEnabledFeatures::shadowDOMEnabled());
+#endif
+        if (!m_scopeResolver)
+            m_scopeResolver = adoptPtr(new StyleScopeResolver());
+        return m_scopeResolver.get();
+    }
+#endif
+
     void initForStyleResolve(Element*, RenderStyle* parentStyle = 0, PseudoId = NOPSEUDO);
     void initElement(Element*);
     void collectFeatures();
     RenderStyle* locateSharedStyle();
     bool styleSharingCandidateMatchesRuleSet(RuleSet*);
+    bool styleSharingCandidateMatchesHostRules();
     Node* locateCousinList(Element* parent, unsigned& visitedNodeCount) const;
     StyledElement* findSiblingForStyleSharing(Node*, unsigned& count) const;
     bool canShareStyleWithElement(StyledElement*) const;
@@ -218,6 +240,8 @@ public:
     static bool colorFromPrimitiveValueIsDerivedFromElement(CSSPrimitiveValue*);
     Color colorFromPrimitiveValue(CSSPrimitiveValue*, bool forVisitedLink = false) const;
 
+    bool hasSelectorForId(const AtomicString&) const;
+    bool hasSelectorForClass(const AtomicString&) const;
     bool hasSelectorForAttribute(const AtomicString&) const;
 
     CSSFontSelector* fontSelector() const { return m_fontSelector.get(); }
@@ -323,6 +347,7 @@ private:
     void matchAuthorRules(MatchResult&, bool includeEmptyRules);
     void matchUserRules(MatchResult&, bool includeEmptyRules);
     void matchScopedAuthorRules(MatchResult&, bool includeEmptyRules);
+    void matchHostRules(MatchResult&, bool includeEmptyRules);
     void collectMatchingRules(RuleSet*, int& firstRuleIndex, int& lastRuleIndex, const MatchOptions&);
     void collectMatchingRulesForRegion(RuleSet*, int& firstRuleIndex, int& lastRuleIndex, const MatchOptions&);
     void collectMatchingRulesForList(const Vector<RuleData>*, int& firstRuleIndex, int& lastRuleIndex, const MatchOptions&);
@@ -330,7 +355,7 @@ private:
     void sortMatchedRules();
     void sortAndTransferMatchedRules(MatchResult&);
 
-    bool checkSelector(const RuleData&, const ContainerNode* scope = 0);
+    bool checkSelector(const RuleData&, const ContainerNode* scope);
     bool checkRegionSelector(CSSSelector* regionSelector, Element* regionElement);
     void applyMatchedProperties(const MatchResult&, const Element*);
     enum StyleApplicationPass {
@@ -396,7 +421,6 @@ public:
 private:
     static RenderStyle* s_styleNotYetAvailable;
 
-    void addStylesheetsFromSeamlessParents();
     void addAuthorRulesAndCollectUserRulesFromSheets(const Vector<RefPtr<CSSStyleSheet> >*, RuleSet& userStyle);
 
     void cacheBorderAndBackground();
@@ -465,7 +489,6 @@ private:
     bool m_matchAuthorAndUserStyles;
     bool m_sameOriginOnly;
     bool m_distributedToInsertionPoint;
-    bool m_hasUnknownPseudoElements;
 
     RefPtr<CSSFontSelector> m_fontSelector;
     Vector<OwnPtr<MediaQueryResult> > m_viewportDependentMediaQueryResults;
@@ -495,6 +518,24 @@ private:
     friend bool operator!=(const MatchRanges&, const MatchRanges&);
 };
 
+inline bool StyleResolver::hasSelectorForAttribute(const AtomicString &attributeName) const
+{
+    ASSERT(!attributeName.isEmpty());
+    return m_features.attrsInRules.contains(attributeName.impl());
+}
+
+inline bool StyleResolver::hasSelectorForClass(const AtomicString& classValue) const
+{
+    ASSERT(!classValue.isEmpty());
+    return m_features.classesInRules.contains(classValue.impl());
+}
+
+inline bool StyleResolver::hasSelectorForId(const AtomicString& idValue) const
+{
+    ASSERT(!idValue.isEmpty());
+    return m_features.idsInRules.contains(idValue.impl());
+}
+
 } // namespace WebCore
 
 #endif // StyleResolver_h
diff --git a/Source/WebCore/css/StyleRule.cpp b/Source/WebCore/css/StyleRule.cpp
index 73b0af26c..713c97146 100644
--- a/Source/WebCore/css/StyleRule.cpp
+++ b/Source/WebCore/css/StyleRule.cpp
@@ -33,6 +33,7 @@
 #include "WebKitCSSKeyframeRule.h"
 #include "WebKitCSSKeyframesRule.h"
 #include "WebKitCSSRegionRule.h"
+#include "WebKitCSSViewportRule.h"
 #include <wtf/MemoryInstrumentationVector.h>
 
 namespace WebCore {
@@ -79,6 +80,14 @@ void StyleRuleBase::reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
     case Keyframes:
         static_cast<const StyleRuleKeyframes*>(this)->reportDescendantMemoryUsage(memoryObjectInfo);
         return;
+    case Host:
+        static_cast<const StyleRuleBlock*>(this)->reportDescendantMemoryUsage(memoryObjectInfo);
+        return;
+#if ENABLE(CSS_DEVICE_ADAPTATION)
+    case Viewport:
+        static_cast<const StyleRuleViewport*>(this)->reportDescendantMemoryUsage(memoryObjectInfo);
+        return;
+#endif
     case Unknown:
     case Charset:
     case Keyframe:
@@ -117,6 +126,14 @@ void StyleRuleBase::destroy()
     case Keyframes:
         delete static_cast<StyleRuleKeyframes*>(this);
         return;
+    case Host:
+        delete static_cast<StyleRuleHost*>(this);
+        return;
+#if ENABLE(CSS_DEVICE_ADAPTATION)
+    case Viewport:
+        delete static_cast<StyleRuleViewport*>(this);
+        return;
+#endif
     case Unknown:
     case Charset:
     case Keyframe:
@@ -150,6 +167,12 @@ PassRefPtr<StyleRuleBase> StyleRuleBase::copy() const
         return 0;
     case Keyframes:
         return static_cast<const StyleRuleKeyframes*>(this)->copy();
+    case Host:
+        return static_cast<const StyleRuleHost*>(this)->copy();
+#if ENABLE(CSS_DEVICE_ADAPTATION)
+    case Viewport:
+        return static_cast<const StyleRuleViewport*>(this)->copy();
+#endif
     case Unknown:
     case Charset:
     case Keyframe:
@@ -191,6 +214,12 @@ PassRefPtr<CSSRule> StyleRuleBase::createCSSOMWrapper(CSSStyleSheet* parentSheet
     case Keyframes:
         rule = WebKitCSSKeyframesRule::create(static_cast<StyleRuleKeyframes*>(self), parentSheet);
         break;
+#if ENABLE(CSS_DEVICE_ADAPTATION)
+    case Viewport:
+        rule = WebKitCSSViewportRule::create(static_cast<StyleRuleViewport*>(self), parentSheet);
+        break;
+#endif
+    case Host:
     case Unknown:
     case Charset:
     case Keyframe:
@@ -381,4 +410,39 @@ void StyleRuleRegion::reportDescendantMemoryUsage(MemoryObjectInfo* memoryObject
     info.addMember(m_selectorList);
 }
 
+#if ENABLE(CSS_DEVICE_ADAPTATION)
+StyleRuleViewport::StyleRuleViewport()
+    : StyleRuleBase(Viewport, 0)
+{
+}
+
+StyleRuleViewport::StyleRuleViewport(const StyleRuleViewport& o)
+    : StyleRuleBase(o)
+    , m_properties(o.m_properties->copy())
+{
+}
+
+StyleRuleViewport::~StyleRuleViewport()
+{
+}
+
+StylePropertySet* StyleRuleViewport::mutableProperties()
+{
+    if (!m_properties->isMutable())
+        m_properties = m_properties->copy();
+    return m_properties.get();
+}
+
+void StyleRuleViewport::setProperties(PassRefPtr<StylePropertySet> properties)
+{
+    m_properties = properties;
+}
+
+void StyleRuleViewport::reportDescendantMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
+{
+    MemoryClassInfo info(memoryObjectInfo, this, WebCoreMemoryTypes::CSS);
+    info.addMember(m_properties);
+}
+#endif // ENABLE(CSS_DEVICE_ADAPTATION)
+
 } // namespace WebCore
diff --git a/Source/WebCore/css/StyleRule.h b/Source/WebCore/css/StyleRule.h
index e15f32e40..4d4340a6d 100644
--- a/Source/WebCore/css/StyleRule.h
+++ b/Source/WebCore/css/StyleRule.h
@@ -46,6 +46,10 @@ public:
         Page,
         Keyframes,
         Keyframe, // Not used. These are internally non-rule StyleKeyframe objects.
+        Host,
+#if ENABLE(CSS_DEVICE_ADAPTATION)
+        Viewport = 15,
+#endif
         Region = 16
     };
     Type type() const { return static_cast<Type>(m_type); }
@@ -57,7 +61,11 @@ public:
     bool isPageRule() const { return type() == Page; }
     bool isStyleRule() const { return type() == Style; }
     bool isRegionRule() const { return type() == Region; }
+#if ENABLE(CSS_DEVICE_ADAPTATION)
+    bool isViewportRule() const { return type() == Viewport; }
+#endif
     bool isImportRule() const { return type() == Import; }
+    bool isHostRule() const { return type() == Host; }
 
     PassRefPtr<StyleRuleBase> copy() const;
 
@@ -223,6 +231,44 @@ private:
     CSSSelectorList m_selectorList;
 };
 
+class StyleRuleHost : public StyleRuleBlock {
+public:
+    static PassRefPtr<StyleRuleHost> create(Vector<RefPtr<StyleRuleBase> >& adoptRules)
+    {
+        return adoptRef(new StyleRuleHost(adoptRules));
+    }
+
+    PassRefPtr<StyleRuleHost> copy() const { return adoptRef(new StyleRuleHost(*this)); }
+
+private:
+    StyleRuleHost(Vector<RefPtr<StyleRuleBase> >& adoptRules) : StyleRuleBlock(Host, adoptRules) { }
+    StyleRuleHost(const StyleRuleHost& o) : StyleRuleBlock(o) { }
+};
+
+#if ENABLE(CSS_DEVICE_ADAPTATION)
+class StyleRuleViewport : public StyleRuleBase {
+public:
+    static PassRefPtr<StyleRuleViewport> create() { return adoptRef(new StyleRuleViewport); }
+
+    ~StyleRuleViewport();
+
+    const StylePropertySet* properties() const { return m_properties.get(); }
+    StylePropertySet* mutableProperties();
+
+    void setProperties(PassRefPtr<StylePropertySet>);
+
+    PassRefPtr<StyleRuleViewport> copy() const { return adoptRef(new StyleRuleViewport(*this)); }
+
+    void reportDescendantMemoryUsage(MemoryObjectInfo*) const;
+
+private:
+    StyleRuleViewport();
+    StyleRuleViewport(const StyleRuleViewport&);
+
+    RefPtr<StylePropertySet> m_properties;
+};
+#endif // ENABLE(CSS_DEVICE_ADAPTATION)
+
 } // namespace WebCore
 
 #endif // StyleRule_h
diff --git a/Source/WebCore/css/StyleScopeResolver.cpp b/Source/WebCore/css/StyleScopeResolver.cpp
index 87402baa5..5ff2b3e0b 100644
--- a/Source/WebCore/css/StyleScopeResolver.cpp
+++ b/Source/WebCore/css/StyleScopeResolver.cpp
@@ -29,8 +29,10 @@
 
 #if ENABLE(STYLE_SCOPED) || ENABLE(SHADOW_DOM)
 
+#include "CSSStyleRule.h"
 #include "CSSStyleSheet.h"
 #include "ContextFeatures.h"
+#include "ElementShadow.h"
 #include "HTMLNames.h"
 #include "HTMLStyleElement.h"
 #include "RuleFeature.h"
@@ -154,11 +156,91 @@ void StyleScopeResolver::collectFeaturesTo(RuleFeatureSet& features)
         features.add(it->value->features());
 }
 
+inline RuleSet* StyleScopeResolver::ensureAtHostRuleSetFor(const ShadowRoot* shadowRoot)
+{
+    ScopedRuleSetMap::AddResult addResult = m_atHostRules.add(shadowRoot, nullptr);
+    if (addResult.isNewEntry)
+        addResult.iterator->value = RuleSet::create();
+    return addResult.iterator->value.get();
+}
+
+inline RuleSet* StyleScopeResolver::atHostRuleSetFor(const ShadowRoot* shadowRoot) const
+{
+    ScopedRuleSetMap::const_iterator it = m_atHostRules.find(shadowRoot);
+    return it != m_atHostRules.end() ? it->value.get() : 0;
+}
+
+void StyleScopeResolver::addHostRule(StyleRuleHost* hostRule, bool hasDocumentSecurityOrigin, const ContainerNode* scope)
+{
+    if (!scope || !scope->isInShadowTree())
+        return;
+
+    ShadowRoot* shadowRoot = scope->shadowRoot();
+    if (!shadowRoot || !shadowRoot->host())
+        return;
+
+    RuleSet* rule = ensureAtHostRuleSetFor(shadowRoot);
+
+    const Vector<RefPtr<StyleRuleBase> >& childRules = hostRule->childRules();
+    AddRuleFlags addRuleFlags = hasDocumentSecurityOrigin ? RuleHasDocumentSecurityOrigin : RuleHasNoSpecialState;
+    addRuleFlags = static_cast<AddRuleFlags>(addRuleFlags | RuleCanUseFastCheckSelector | RuleIsHostRule);
+    for (unsigned i = 0; i < childRules.size(); ++i) {
+        StyleRuleBase* hostStylingRule = childRules[i].get();
+        if (hostStylingRule->isStyleRule())
+            rule->addStyleRule(static_cast<StyleRule*>(hostStylingRule), addRuleFlags);
+    }
+}
+
+bool StyleScopeResolver::styleSharingCandidateMatchesHostRules(const Element* element)
+{
+    if (m_atHostRules.isEmpty())
+        return false;
+
+    ElementShadow* shadow = element->shadow();
+    if (!shadow)
+        return false;
+
+    // FIXME(99827): https://bugs.webkit.org/show_bug.cgi?id=99827
+    // add a new flag to ElementShadow and cache whether any@host @-rules are
+    // applied to the element or not. So we can avoid always traversing
+    // shadow roots.
+    for (ShadowRoot* shadowRoot = shadow->youngestShadowRoot(); shadowRoot; shadowRoot = shadowRoot->olderShadowRoot()) {
+        if (atHostRuleSetFor(shadowRoot))
+            return true;
+
+        if (!shadowRoot->hasShadowInsertionPoint())
+            break;
+    }
+    return false;
+}
+
+void StyleScopeResolver::matchHostRules(const Element* element, Vector<RuleSet*>& matchedRules)
+{
+    if (m_atHostRules.isEmpty())
+        return;
+
+    ElementShadow* shadow = element->shadow();
+    if (!shadow)
+        return;
+
+    // FIXME(99827): https://bugs.webkit.org/show_bug.cgi?id=99827
+    // add a new flag to ElementShadow and cache whether any @host @-rules are
+    // applied to the element or not. So we can quickly exit this method
+    // by using the flag.
+    for (ShadowRoot* shadowRoot = shadow->youngestShadowRoot(); shadowRoot; shadowRoot = shadowRoot->olderShadowRoot()) { 
+        if (RuleSet* ruleSet = atHostRuleSetFor(shadowRoot))
+            matchedRules.append(ruleSet);
+        if (!shadowRoot->hasShadowInsertionPoint())
+            break;
+    }
+}
+
 void StyleScopeResolver::reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
 {
     MemoryClassInfo info(memoryObjectInfo, this, WebCoreMemoryTypes::CSS);
     info.addMember(m_authorStyles);
     info.addMember(m_stack);
+    info.addMember(m_atHostRules);
 }
 
 }
diff --git a/Source/WebCore/css/StyleScopeResolver.h b/Source/WebCore/css/StyleScopeResolver.h
index 5a32dfe79..3be3ff4f7 100644
--- a/Source/WebCore/css/StyleScopeResolver.h
+++ b/Source/WebCore/css/StyleScopeResolver.h
@@ -37,8 +37,11 @@ namespace WebCore {
 
 class ContainerNode;
 class CSSStyleSheet;
+class Element;
 class RuleSet;
-class RuleFeatureSet;
+class ShadowRoot;
+class StyleRuleHost;
+struct RuleFeatureSet;
 
 #if ENABLE(STYLE_SCOPED) || ENABLE(SHADOW_DOM)
 
@@ -72,12 +75,18 @@ public:
     bool matchesStyleBounds(const StackFrame& frame) const { return frame.m_authorStyleBoundsIndex == m_stackParentBoundsIndex; }
     void collectFeaturesTo(RuleFeatureSet&);
 
+    void addHostRule(StyleRuleHost*, bool hasDocumentSecurityOrigin, const ContainerNode* scope);
+    bool styleSharingCandidateMatchesHostRules(const Element*);
+    void matchHostRules(const Element*, Vector<RuleSet*>& matchedRules);
+
     void reportMemoryUsage(MemoryObjectInfo*) const;
 
 private:
     RuleSet* ruleSetFor(const ContainerNode* scope) const;
     void setupStack(const ContainerNode*);
     bool stackIsConsistent(const ContainerNode* parent) const { return parent && parent == m_stackParent; }
+    RuleSet* ensureAtHostRuleSetFor(const ShadowRoot*);
+    RuleSet* atHostRuleSetFor(const ShadowRoot*) const;
 
     ScopedRuleSetMap m_authorStyles;
 
@@ -88,6 +97,8 @@ private:
     // This is used to decide whether m_scopingElementStack is consistent, separately from SelectorChecker::m_parentStack.
     const ContainerNode* m_stackParent;
     int m_stackParentBoundsIndex;
+
+    ScopedRuleSetMap m_atHostRules;
 };
 
 inline bool StyleScopeResolver::ensureStackConsistency(ContainerNode* parent)
diff --git a/Source/WebCore/css/StyleSheetContents.cpp b/Source/WebCore/css/StyleSheetContents.cpp
index e7ce81eaa..2f07fce83 100644
--- a/Source/WebCore/css/StyleSheetContents.cpp
+++ b/Source/WebCore/css/StyleSheetContents.cpp
@@ -435,6 +435,10 @@ static bool childRulesHaveFailedOrCanceledSubresources(const Vector<RefPtr<Style
             if (childRulesHaveFailedOrCanceledSubresources(static_cast<const StyleRuleRegion*>(rule)->childRules()))
                 return true;
             break;
+        case StyleRuleBase::Host:
+            if (childRulesHaveFailedOrCanceledSubresources(static_cast<const StyleRuleHost*>(rule)->childRules()))
+                return true;
+            break;
         case StyleRuleBase::Import:
             ASSERT_NOT_REACHED();
         case StyleRuleBase::Page:
@@ -442,6 +446,9 @@ static bool childRulesHaveFailedOrCanceledSubresources(const Vector<RefPtr<Style
         case StyleRuleBase::Unknown:
         case StyleRuleBase::Charset:
         case StyleRuleBase::Keyframe:
+#if ENABLE(CSS_DEVICE_ADAPTATION)
+        case StyleRuleBase::Viewport:
+#endif
             break;
         }
     }
diff --git a/Source/WebCore/css/WebKitCSSViewportRule.cpp b/Source/WebCore/css/WebKitCSSViewportRule.cpp
new file mode 100644
index 000000000..c815b56b5
--- /dev/null
+++ b/Source/WebCore/css/WebKitCSSViewportRule.cpp
@@ -0,0 +1,97 @@
+/*
+ * Copyright (C) 2012 Intel Corporation. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above
+ *    copyright notice, this list of conditions and the following
+ *    disclaimer.
+ * 2. Redistributions in binary form must reproduce the above
+ *    copyright notice, this list of conditions and the following
+ *    disclaimer in the documentation and/or other materials
+ *    provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDER “AS IS” AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER BE
+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
+ * OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR
+ * TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF
+ * THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WebKitCSSViewportRule.h"
+
+#if ENABLE(CSS_DEVICE_ADAPTATION)
+
+#include "PropertySetCSSStyleDeclaration.h"
+#include "StylePropertySet.h"
+#include "StyleRule.h"
+#include "WebCoreMemoryInstrumentation.h"
+#include <wtf/text/StringBuilder.h>
+
+namespace WebCore {
+
+WebKitCSSViewportRule::WebKitCSSViewportRule(StyleRuleViewport* viewportRule, CSSStyleSheet* sheet)
+    : CSSRule(sheet, CSSRule::WEBKIT_VIEWPORT_RULE)
+    , m_viewportRule(viewportRule)
+{
+}
+
+WebKitCSSViewportRule::~WebKitCSSViewportRule()
+{
+    if (m_propertiesCSSOMWrapper)
+        m_propertiesCSSOMWrapper->clearParentRule();
+}
+
+CSSStyleDeclaration* WebKitCSSViewportRule::style() const
+{
+    if (!m_propertiesCSSOMWrapper)
+        m_propertiesCSSOMWrapper = StyleRuleCSSStyleDeclaration::create(m_viewportRule->mutableProperties(), const_cast<WebKitCSSViewportRule*>(this));
+
+    return m_propertiesCSSOMWrapper.get();
+}
+
+String WebKitCSSViewportRule::cssText() const
+{
+    StringBuilder result;
+    result.appendLiteral("@-webkit-viewport { ");
+
+    String decls = m_viewportRule->properties()->asText();
+    result.append(decls);
+    if (!decls.isEmpty())
+        result.append(' ');
+
+    result.append('}');
+
+    return result.toString();
+}
+
+void WebKitCSSViewportRule::reattach(StyleRuleViewport* rule)
+{
+    ASSERT(rule);
+    m_viewportRule = rule;
+
+    if (m_propertiesCSSOMWrapper)
+        m_propertiesCSSOMWrapper->reattach(m_viewportRule->mutableProperties());
+}
+
+void WebKitCSSViewportRule::reportDescendantMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
+{
+    MemoryClassInfo info(memoryObjectInfo, this, WebCoreMemoryTypes::CSS);
+    CSSRule::reportBaseClassMemoryUsage(memoryObjectInfo);
+    info.addMember(m_viewportRule);
+    info.addMember(m_propertiesCSSOMWrapper);
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(CSS_DEVICE_ADAPTATION)
diff --git a/Source/WebCore/css/WebKitCSSViewportRule.h b/Source/WebCore/css/WebKitCSSViewportRule.h
new file mode 100644
index 000000000..e8a27d18c
--- /dev/null
+++ b/Source/WebCore/css/WebKitCSSViewportRule.h
@@ -0,0 +1,73 @@
+/*
+ * Copyright (C) 2012 Intel Corporation. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above
+ *    copyright notice, this list of conditions and the following
+ *    disclaimer.
+ * 2. Redistributions in binary form must reproduce the above
+ *    copyright notice, this list of conditions and the following
+ *    disclaimer in the documentation and/or other materials
+ *    provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDER “AS IS” AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER BE
+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
+ * OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR
+ * TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF
+ * THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#ifndef WebKitCSSViewportRule_h
+#define WebKitCSSViewportRule_h
+
+#if ENABLE(CSS_DEVICE_ADAPTATION)
+
+#include "CSSRule.h"
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefPtr.h>
+
+namespace WebCore {
+
+class CSSStyleDeclaration;
+class StyleRuleViewport;
+class StyleRuleCSSStyleDeclaration;
+
+class WebKitCSSViewportRule: public CSSRule {
+public:
+    static PassRefPtr<WebKitCSSViewportRule> create(StyleRuleViewport* viewportRule, CSSStyleSheet* sheet)
+    {
+        return adoptRef(new WebKitCSSViewportRule(viewportRule, sheet));
+    }
+    ~WebKitCSSViewportRule();
+
+    CSSStyleDeclaration* style() const;
+
+    String cssText() const;
+
+    void reattach(StyleRuleViewport*);
+
+    void reportDescendantMemoryUsage(MemoryObjectInfo*) const;
+
+private:
+    WebKitCSSViewportRule(StyleRuleViewport*, CSSStyleSheet*);
+
+    RefPtr<StyleRuleViewport> m_viewportRule;
+
+    mutable RefPtr<StyleRuleCSSStyleDeclaration> m_propertiesCSSOMWrapper;
+};
+
+} // namespace WebCore
+
+#endif // WebKitCSSViewportRule_h
+
+#endif // ENABLE(CSS_DEVICE_ADAPTATION)
diff --git a/Source/WebCore/css/html.css b/Source/WebCore/css/html.css
index f07fed67b..6b3f258f7 100644
--- a/Source/WebCore/css/html.css
+++ b/Source/WebCore/css/html.css
@@ -482,7 +482,8 @@ input[type="date"] {
     -webkit-align-items: stretch;
     display: -webkit-inline-flex;
     font-family: monospace;
-    padding: 0 0 0 1px;
+    padding: 0;
+    -webkit-padding-start: 1px;
 }
 #endif
 #if defined(ENABLE_INPUT_TYPE_DATETIME) && ENABLE_INPUT_TYPE_DATETIME
@@ -490,7 +491,8 @@ input[type="datetime"] {
     -webkit-align-items: stretch;
     display: -webkit-inline-flex;
     font-family: monospace;
-    padding: 0 0 0 1px;
+    padding: 0;
+    -webkit-padding-start: 1px;
 }
 #endif
 #if defined(ENABLE_INPUT_TYPE_DATETIMELOCAL) && ENABLE_INPUT_TYPE_DATETIMELOCAL
@@ -498,7 +500,8 @@ input[type="datetime-local"] {
     -webkit-align-items: stretch;
     display: -webkit-inline-flex;
     font-family: monospace;
-    padding: 0 0 0 1px;
+    padding: 0;
+    -webkit-padding-start: 1px;
 }
 #endif
 #if defined(ENABLE_INPUT_TYPE_MONTH) && ENABLE_INPUT_TYPE_MONTH
@@ -506,7 +509,8 @@ input[type="month"] {
     -webkit-align-items: stretch;
     display: -webkit-inline-flex;
     font-family: monospace;
-    padding: 0 0 0 1px;
+    padding: 0;
+    -webkit-padding-start: 1px;
 }
 #endif
 #if defined(ENABLE_INPUT_TYPE_TIME) && ENABLE_INPUT_TYPE_TIME
@@ -514,7 +518,8 @@ input[type="time"] {
     -webkit-align-items: stretch;
     display: -webkit-inline-flex;
     font-family: monospace;
-    padding: 0 0 0 1px;
+    padding: 0;
+    -webkit-padding-start: 1px;
 }
 #endif
 #if defined(ENABLE_INPUT_TYPE_WEEK) && ENABLE_INPUT_TYPE_WEEK
@@ -522,64 +527,47 @@ input[type="week"] {
     -webkit-align-items: stretch;
     display: -webkit-inline-flex;
     font-family: monospace;
-    padding: 0 0 0 1px;
+    padding: 0;
+    -webkit-padding-start: 1px;
 }
 #endif
 
 input::-webkit-datetime-edit {
-    -webkit-align-items: center;
     -webkit-flex: 1;
     -webkit-user-modify: read-only !important;
-    display: -webkit-flex;
-    white-space: pre;
-}
-
-input::-webkit-datetime-edit-ampm-field {
-    -webkit-user-modify: read-only !important;
-    border: none;
-    padding: 0.15em;
-    display: inline-block;
-    text-align: center;
-}
-
-input::-webkit-datetime-edit-day-field {
-    -webkit-user-modify: read-only !important;
     display: inline-block;
-    border: none;
-    text-align: center;
-    padding: 0.15em;
-}
-
-input::-webkit-datetime-edit-hour-field {
-    -webkit-user-modify: read-only !important;
-    display: inline-block;
-    border: none;
-    text-align: center;
-    padding: 0.15em;
+    white-space: pre;
 }
 
-input::-webkit-datetime-edit-millisecond-field {
+input::-webkit-datetime-edit-ampm-field,
+input::-webkit-datetime-edit-day-field,
+input::-webkit-datetime-edit-hour-field,
+input::-webkit-datetime-edit-millisecond-field,
+input::-webkit-datetime-edit-minute-field,
+input::-webkit-datetime-edit-month-field,
+input::-webkit-datetime-edit-second-field,
+input::-webkit-datetime-edit-week-field,
+input::-webkit-datetime-edit-year-field {
     -webkit-user-modify: read-only !important;
-    display: inline-block;
     border: none;
-    text-align: center;
-    padding: 0.15em;
-}
-
-input::-webkit-datetime-edit-minute-field {
-    -webkit-user-modify: read-only !important;
     display: inline-block;
-    border: none;
+    margin: 1px;
     text-align: center;
-    padding: 0.15em;
 }
 
-input::-webkit-datetime-edit-month-field {
-    -webkit-user-modify: read-only !important;
-    display: inline-block;
-    border: none;
-    text-align: center;
-    padding: 0.15em;
+/* Remove focus ring from fields and use highlight color */
+input::-webkit-datetime-edit-ampm-field:focus,
+input::-webkit-datetime-edit-day-field:focus,
+input::-webkit-datetime-edit-hour-field:focus,
+input::-webkit-datetime-edit-millisecond-field:focus,
+input::-webkit-datetime-edit-minute-field:focus,
+input::-webkit-datetime-edit-month-field:focus,
+input::-webkit-datetime-edit-second-field:focus,
+input::-webkit-datetime-edit-week-field:focus,
+input::-webkit-datetime-edit-year-field:focus {
+    background-color: highlight;
+    color: highlighttext;
+    outline: none;
 }
 
 /* This selector is used when step >= 3600 second but format contains minute field. */
@@ -587,28 +575,9 @@ input::-webkit-datetime-edit-minute-field[readonly] {
     color: GrayText;
 }
 
-input::-webkit-datetime-edit-second-field {
-    -webkit-user-modify: read-only !important;
-    display: inline-block;
-    border: none;
-    text-align: center;
-    padding: 0.15em;
-}
-
-input::-webkit-datetime-edit-week-field {
-    -webkit-user-modify: read-only !important;
-    display: inline-block;
-    border: none;
-    text-align: center;
-    padding: 0.15em;
-}
-
-input::-webkit-datetime-edit-year-field {
-    -webkit-user-modify: read-only !important;
-    display: inline-block;
-    border: none;
-    text-align: center;
-    padding: 0.15em;
+/* This selector is used when step >= 60 second but format contains second field. */
+input::-webkit-datetime-edit-second-field[readonly] {
+    color: GrayText;
 }
 
 input::-webkit-datetime-edit-text {
@@ -616,36 +585,10 @@ input::-webkit-datetime-edit-text {
     display: inline-block;
 }
 
-input::-webkit-datetime-edit-gap {
-    -webkit-flex: 1;
-    -webkit-user-modify: read-only !important;
-    display: inline-block;
-}
-
 input::-webkit-date-and-time-container {
     -webkit-align-items: center;
     -webkit-flex: 1;
-    display: -webkit-flex;
-}
-
-/* Remove focus ring from fields and use highlight color */
-input::-webkit-datetime-edit-ampm-field:focus,
-input::-webkit-datetime-edit-day-field:focus,
-input::-webkit-datetime-edit-hour-field:focus,
-input::-webkit-datetime-edit-millisecond-field:focus,
-input::-webkit-datetime-edit-minute-field:focus,
-input::-webkit-datetime-edit-month-field:focus,
-input::-webkit-datetime-edit-second-field:focus,
-input::-webkit-datetime-edit-week-field:focus,
-input::-webkit-datetime-edit-year-field:focus {
-  background-color: highlight;
-  color: highlighttext;
-  outline: none;
-}
-
-/* This selector is used when step >= 60 second but format contains second field. */
-input::-webkit-datetime-edit-second-field[readonly] {
-    color: GrayText;
+    display: -webkit-inline-flex;
 }
 
 input[type="date"]::-webkit-inner-spin-button,
@@ -655,8 +598,8 @@ input[type="month"]::-webkit-inner-spin-button,
 input[type="time"]::-webkit-inner-spin-button,
 input[type="week"]::-webkit-inner-spin-button {
     display: inline-block;
-    margin-left: 0.2em;
     position: static;
+    -webkit-margin-start: 2px;
 }
 #endif
 
diff --git a/Source/WebCore/css/mathml.css b/Source/WebCore/css/mathml.css
index 205f07688..7c3118ef0 100644
--- a/Source/WebCore/css/mathml.css
+++ b/Source/WebCore/css/mathml.css
@@ -8,8 +8,16 @@ mtext {
     line-height: 1.0;
 }
 
+/* Keep font-family and other defaults here consistent with http://mxr.mozilla.org/mozilla-central/source/layout/mathml/mathml.css and feedback from www-math. */
+math, mfenced > * {
+    font-family: MathJax_Main, STIXGeneral, "DejaVu Serif", Cambria, "Cambria Math", Times, serif;
+}
+mo, mfenced {
+    font-family: MathJax_Main, STIXGeneral, STIXSizeOneSym, "DejaVu Sans", "DejaVu Serif", Cambria, "Cambria Math",
+        "Lucida Sans Unicode", "Arial Unicode MS", "Lucida Grande", OpenSymbol, "Standard Symbols L", sans-serif;
+}
+
 math {
-    font-family: STIXGeneral, Symbol, "Times New Roman", sans-serif;
     display: -webkit-inline-flex !important;
     padding-left: 1px;
     padding-right: 1px;
diff --git a/Source/WebCore/css/mediaControls.css b/Source/WebCore/css/mediaControls.css
index 81b0e16b9..6df03402d 100644
--- a/Source/WebCore/css/mediaControls.css
+++ b/Source/WebCore/css/mediaControls.css
@@ -216,7 +216,7 @@ video::-webkit-media-text-track-container {
     font-size: 22px;
     font-family: sans-serif;
     text-align: center;
-    color: rgba(255, 255, 255, 0);
+    color: rgba(255, 255, 255, 1);
 
     letter-spacing: normal;
     word-spacing: normal;
@@ -234,8 +234,6 @@ video::-webkit-media-text-track-past-nodes {
 
     background-color: rgba(0, 0, 0, 0.8);
     padding: 2px 2px;
-
-    white-space: pre-wrap;
 }
 
 video::-webkit-media-text-track-future-nodes {
@@ -246,11 +244,10 @@ video::-webkit-media-text-track-future-nodes {
 
     margin-left: -2px;
     padding: 2px 2px 2px 0px;
-
-    white-space: pre-wrap;
 }
 
 video::-webkit-media-text-track-display {
     position: absolute;
-    color: rgba(255, 255, 255, 1);
+    overflow: hidden;
+    white-space: pre-wrap;
 }
diff --git a/Source/WebCore/css/themeBlackBerry.css b/Source/WebCore/css/themeBlackBerry.css
index 120ce4981..c4d8f73bb 100644
--- a/Source/WebCore/css/themeBlackBerry.css
+++ b/Source/WebCore/css/themeBlackBerry.css
@@ -20,10 +20,6 @@ textarea {
     font-family: monospace;
 }
 
-input, textarea {
-    border-radius: 3px;
-}
-
 input[type="datetime"],
 input[type="date"],
 input[type="week"],
@@ -35,22 +31,35 @@ input[type="color"] {
     border: solid 2px blue;
 }
 
-select:focus {
-    border: 1px solid black;
-    outline: none;
+select {
+    border-radius: 0;
+}
+
+select[size="0"],
+select[size="1"] {
+    border-radius: 0;
+}
+
+::-webkit-validation-bubble-message {
+    padding-left: 10px;
+    padding-right: 10px;
+    background: #fafafa;
+    border-color: #ffffff;
+    border-width: 1px;
+    box-shadow: 2px 2px 4px rgba(100,100,100,0.3), 0 0 4px rgba(100,100,100,0.6);
+    -webkit-border-radius: 4px;
+    top: -1px;
 }
 
-select[size],
-select[multiple],
-select[size][multiple] {
-    padding: 5px;
-    border-radius: 5px;
-    border: 1px solid rgb(139,139,139);
+::-webkit-validation-bubble-arrow {
+    left: 40px;
+    top: 3px;
+    background: #fafafa;
+    border-color: #ffffff;
+    border-width: 1px;
+    box-shadow: 0 0 4px rgba(100,100,100,0.6);
 }
 
-select[size]:focus,
-select[multiple]:focus,
-select[size][multiple]:focus {
-    border: 1px solid black;
-    outline: none;
+::-webkit-validation-bubble-heading {
+    font-weight: normal;
 }
diff --git a/Source/WebCore/dom/Attr.cpp b/Source/WebCore/dom/Attr.cpp
index 57efe2982..287ef6a6a 100644
--- a/Source/WebCore/dom/Attr.cpp
+++ b/Source/WebCore/dom/Attr.cpp
@@ -218,7 +218,6 @@ void Attr::detachFromElementWithValue(const AtomicString& value)
 {
     ASSERT(m_element);
     ASSERT(m_standaloneValue.isNull());
-    m_element->attributeData()->removeAttr(m_element, qualifiedName());
     m_standaloneValue = value;
     m_element = 0;
 }
diff --git a/Source/WebCore/dom/CharacterData.cpp b/Source/WebCore/dom/CharacterData.cpp
index 08e6eb63d..25af94d7b 100644
--- a/Source/WebCore/dom/CharacterData.cpp
+++ b/Source/WebCore/dom/CharacterData.cpp
@@ -33,7 +33,6 @@
 #include "RenderText.h"
 #include "StyleInheritedData.h"
 #include "TextBreakIterator.h"
-#include "UndoManager.h"
 #include "WebCoreMemoryInstrumentation.h"
 
 using namespace std;
@@ -191,13 +190,6 @@ void CharacterData::setNodeValue(const String& nodeValue, ExceptionCode& ec)
 
 void CharacterData::setDataAndUpdate(const String& newData, unsigned offsetOfReplacedData, unsigned oldLength, unsigned newLength)
 {
-#if ENABLE(UNDO_MANAGER)
-    if (UndoManager::isRecordingAutomaticTransaction(this)) {
-        const String& replacingData = newData.substring(offsetOfReplacedData, newLength);
-        const String& replacedData = m_data.substring(offsetOfReplacedData, oldLength);
-        UndoManager::addTransactionStep(DataReplacingDOMTransactionStep::create(this, offsetOfReplacedData, oldLength, replacingData, replacedData));
-    }
-#endif
     String oldData = m_data;
     m_data = newData;
 
diff --git a/Source/WebCore/dom/ComposedShadowTreeWalker.cpp b/Source/WebCore/dom/ComposedShadowTreeWalker.cpp
index e88230e64..67d1610a4 100644
--- a/Source/WebCore/dom/ComposedShadowTreeWalker.cpp
+++ b/Source/WebCore/dom/ComposedShadowTreeWalker.cpp
@@ -31,6 +31,7 @@
 #include "Element.h"
 #include "ElementShadow.h"
 #include "HTMLContentElement.h"
+#include "HTMLShadowElement.h"
 #include "InsertionPoint.h"
 
 namespace WebCore {
@@ -52,30 +53,20 @@ static inline ElementShadow* shadowOfParent(const Node* node)
     return 0;
 }
 
-static inline ElementShadow* shadowOfParentForDistribution(const Node* node)
+static inline bool nodeCanBeDistributed(const Node* node)
 {
-    if (!node)
-        return 0;
+    ASSERT(node);
+    Node* parent = parentNodeForDistribution(node);
+    if (!parent)
+        return false;
 
-    if (Element* parent = parentElementForDistribution(node))
-        return parent->shadow();
+    if (ShadowRoot* shadowRoot = parent->isShadowRoot() ? toShadowRoot(parent) : 0)
+        return shadowRoot->assignedTo();
 
-    return 0;    
-}
+    if (parent->isElementNode() && toElement(parent)->shadow())
+        return true;
 
-static inline InsertionPoint* resolveReprojection(const Node* node)
-{
-    InsertionPoint* insertionPoint = 0;
-    const Node* current = node;
-    while (ElementShadow* shadow = shadowOfParentForDistribution(current)) {
-        shadow->ensureDistribution();
-        if (InsertionPoint* insertedTo = shadow->insertionPointFor(node)) {
-            current = insertedTo;
-            insertionPoint = insertedTo;
-        } else
-            break;
-    }
-    return insertionPoint;
+    return false;
 }
 
 inline void ComposedShadowTreeWalker::ParentTraversalDetails::didTraverseInsertionPoint(InsertionPoint* insertionPoint)
@@ -167,11 +158,9 @@ Node* ComposedShadowTreeWalker::traverseSiblings(const Node* node, TraversalDire
 Node* ComposedShadowTreeWalker::traverseNode(const Node* node, TraversalDirection direction)
 {
     ASSERT(node);
-    if (!isInsertionPoint(node))
+    if (!isActiveInsertionPoint(node))
         return const_cast<Node*>(node);
     const InsertionPoint* insertionPoint = toInsertionPoint(node);
-    if (!insertionPoint->isActive())
-        return const_cast<Node*>(node);
     if (Node* found = traverseDistributedNodes(direction == TraversalDirectionForward ? insertionPoint->first() : insertionPoint->last(), insertionPoint, direction))
         return found;
     return traverseLightChildren(node, direction);
@@ -203,9 +192,10 @@ Node* ComposedShadowTreeWalker::traverseDistributedNodes(const Node* node, const
 Node* ComposedShadowTreeWalker::traverseSiblingOrBackToInsertionPoint(const Node* node, TraversalDirection direction)
 {
     ASSERT(node);
-    ElementShadow* shadow = shadowOfParent(node);
-    if (!shadow)
+
+    if (!nodeCanBeDistributed(node))
         return traverseSiblingInCurrentTree(node, direction);
+
     InsertionPoint* insertionPoint = resolveReprojection(node);
     if (!insertionPoint)
         return traverseSiblingInCurrentTree(node, direction);
@@ -272,8 +262,8 @@ Node* ComposedShadowTreeWalker::traverseParent(const Node* node, ParentTraversal
         ASSERT(toShadowRoot(node)->isYoungest());
         return 0;
     }
-    if (ElementShadow* shadow = shadowOfParentForDistribution(node)) {
-        shadow->ensureDistribution();
+
+    if (nodeCanBeDistributed(node)) {
         if (InsertionPoint* insertionPoint = resolveReprojection(node)) {
             if (details)
                 details->didTraverseInsertionPoint(insertionPoint);
@@ -297,6 +287,8 @@ inline Node* ComposedShadowTreeWalker::traverseParentInCurrentTree(const Node* n
 Node* ComposedShadowTreeWalker::traverseParentBackToYoungerShadowRootOrHost(const ShadowRoot* shadowRoot, ParentTraversalDetails* details) const
 {
     ASSERT(shadowRoot);
+    ASSERT(!shadowRoot->assignedTo());
+
     if (shadowRoot->isYoungest()) {
         if (canCrossUpperBoundary()) {
             if (details)
@@ -307,12 +299,6 @@ Node* ComposedShadowTreeWalker::traverseParentBackToYoungerShadowRootOrHost(cons
         return const_cast<ShadowRoot*>(shadowRoot);
     }
 
-    if (InsertionPoint* assignedInsertionPoint = shadowRoot->assignedTo()) {
-        if (details)
-            details->didTraverseShadowRoot(shadowRoot);
-        return traverseParent(assignedInsertionPoint, details);
-    }
-
     return 0;
 }
 
@@ -369,7 +355,7 @@ void AncestorChainWalker::parent()
     ASSERT(m_node);
     ASSERT(m_distributedNode);
     if (ElementShadow* shadow = shadowOfParent(m_node)) {
-        if (InsertionPoint* insertionPoint = shadow->insertionPointFor(m_distributedNode)) {
+        if (InsertionPoint* insertionPoint = shadow->distributor().findInsertionPointFor(m_distributedNode)) {
             m_node = insertionPoint;
             m_isCrossingInsertionPoint = true;
             return;
@@ -377,7 +363,8 @@ void AncestorChainWalker::parent()
     }
     if (!m_node->isShadowRoot()) {
         m_node = m_node->parentNode();
-        m_distributedNode = m_node;
+        if (!(m_node && m_node->isShadowRoot() && toShadowRoot(m_node)->assignedTo()))
+            m_distributedNode = m_node;
         m_isCrossingInsertionPoint = false;
         return;
     }
diff --git a/Source/WebCore/dom/ContainerNode.cpp b/Source/WebCore/dom/ContainerNode.cpp
index 06aae46e1..a605cd08e 100644
--- a/Source/WebCore/dom/ContainerNode.cpp
+++ b/Source/WebCore/dom/ContainerNode.cpp
@@ -35,15 +35,16 @@
 #include "InlineTextBox.h"
 #include "InsertionPoint.h"
 #include "InspectorInstrumentation.h"
+#include "LoaderStrategy.h"
 #include "MemoryCache.h"
 #include "MutationEvent.h"
 #include "ResourceLoadScheduler.h"
 #include "Page.h"
+#include "PlatformStrategies.h"
 #include "RenderBox.h"
 #include "RenderTheme.h"
 #include "RenderWidget.h"
 #include "RootInlineBox.h"
-#include "UndoManager.h"
 #include <wtf/CurrentTime.h>
 #include <wtf/Vector.h>
 
@@ -343,10 +344,6 @@ static void willRemoveChild(Node* child)
     ChildListMutationScope(child->parentNode()).willRemoveChild(child);
     child->notifyMutationObserversNodeWillDetach();
 #endif
-#if ENABLE(UNDO_MANAGER)
-    if (UndoManager::isRecordingAutomaticTransaction(child->parentNode()))
-        UndoManager::addTransactionStep(NodeRemovingDOMTransactionStep::create(child->parentNode(), child));
-#endif
 
     dispatchChildRemovalEvents(child);
     child->document()->nodeWillBeRemoved(child); // e.g. mutation event listener can create a new range.
@@ -371,10 +368,6 @@ static void willRemoveChildren(ContainerNode* container)
         mutation.willRemoveChild(child);
         child->notifyMutationObserversNodeWillDetach();
 #endif
-#if ENABLE(UNDO_MANAGER)
-        if (UndoManager::isRecordingAutomaticTransaction(container))
-            UndoManager::addTransactionStep(NodeRemovingDOMTransactionStep::create(container, child));
-#endif
 
         // fire removed from document mutation events.
         dispatchChildRemovalEvents(child);
@@ -641,7 +634,11 @@ void ContainerNode::suspendPostAttachCallbacks()
                 s_shouldReEnableMemoryCacheCallsAfterAttach = true;
             }
         }
+#if USE(PLATFORM_STRATEGIES)
+        platformStrategies()->loaderStrategy()->resourceLoadScheduler()->suspendPendingRequests();
+#else
         resourceLoadScheduler()->suspendPendingRequests();
+#endif
     }
     ++s_attachDepth;
 }
@@ -658,7 +655,11 @@ void ContainerNode::resumePostAttachCallbacks()
             if (Page* page = document()->page())
                 page->setMemoryCacheClientCallsEnabled(true);
         }
+#if USE(PLATFORM_STRATEGIES)
+        platformStrategies()->loaderStrategy()->resourceLoadScheduler()->resumePendingRequests();
+#else
         resourceLoadScheduler()->resumePendingRequests();
+#endif
     }
     --s_attachDepth;
 }
@@ -1012,11 +1013,6 @@ static void updateTreeAfterInsertion(ContainerNode* parent, Node* child, bool sh
     ChildListMutationScope(parent).childAdded(child);
 #endif
 
-#if ENABLE(UNDO_MANAGER)
-    if (UndoManager::isRecordingAutomaticTransaction(parent))
-        UndoManager::addTransactionStep(NodeInsertingDOMTransactionStep::create(parent, child));
-#endif
-
     parent->childrenChanged(false, child->previousSibling(), child->nextSibling(), 1);
 
     ChildNodeInsertionNotifier(parent).notify(child);
diff --git a/Source/WebCore/dom/ContextFeatures.cpp b/Source/WebCore/dom/ContextFeatures.cpp
index 0aa310dfe..da7df9d1d 100644
--- a/Source/WebCore/dom/ContextFeatures.cpp
+++ b/Source/WebCore/dom/ContextFeatures.cpp
@@ -63,6 +63,18 @@ bool ContextFeatures::dialogElementEnabled(Document* document)
 #endif
 }
 
+bool ContextFeatures::shadowDOMEnabled(Document* document)
+{
+#if ENABLE(SHADOW_DOM)
+    if (!document)
+        return RuntimeEnabledFeatures::shadowDOMEnabled();
+    return document->contextFeatures()->isEnabled(document, ShadowDOM, RuntimeEnabledFeatures::shadowDOMEnabled());
+#else
+    UNUSED_PARAM(document);
+    return false;
+#endif
+}
+
 bool ContextFeatures::styleScopedEnabled(Document* document)
 {
 #if ENABLE(STYLE_SCOPED)
@@ -107,6 +119,11 @@ bool ContextFeatures::mutationEventsEnabled(Document* document)
     return document->contextFeatures()->isEnabled(document, MutationEvents, true);
 }
 
+bool ContextFeatures::pushStateEnabled(Document* document)
+{
+    return document->contextFeatures()->isEnabled(document, PushState, true);
+}
+
 void provideContextFeaturesTo(Page* page, ContextFeaturesClient* client)
 {
     RefCountedSupplement<Page, ContextFeatures>::provideTo(page, ContextFeatures::supplementName(), ContextFeatures::create(client));
diff --git a/Source/WebCore/dom/ContextFeatures.h b/Source/WebCore/dom/ContextFeatures.h
index f0a7fa02c..69ba53757 100644
--- a/Source/WebCore/dom/ContextFeatures.h
+++ b/Source/WebCore/dom/ContextFeatures.h
@@ -40,10 +40,12 @@ class ContextFeatures : public RefCountedSupplement<Page, ContextFeatures> {
 public:
     enum FeatureType {
         DialogElement = 0,
+        ShadowDOM,
         StyleScoped,
         PagePopup,
         HTMLNotifications,
         MutationEvents,
+        PushState,
         FeatureTypeSize // Should be the last entry.
     };
 
@@ -52,10 +54,12 @@ public:
     static PassRefPtr<ContextFeatures> create(ContextFeaturesClient*);
 
     static bool dialogElementEnabled(Document*);
+    static bool shadowDOMEnabled(Document*);
     static bool styleScopedEnabled(Document*);
     static bool pagePopupEnabled(Document*);
     static bool htmlNotificationsEnabled(Document*);
     static bool mutationEventsEnabled(Document*);
+    static bool pushStateEnabled(Document*);
 
     bool isEnabled(Document*, FeatureType, bool) const;
     void urlDidChange(Document*);
diff --git a/Source/WebCore/dom/DOMAllInOne.cpp b/Source/WebCore/dom/DOMAllInOne.cpp
index fcb569540..23b3cecbf 100644
--- a/Source/WebCore/dom/DOMAllInOne.cpp
+++ b/Source/WebCore/dom/DOMAllInOne.cpp
@@ -153,3 +153,4 @@
 #include "WindowEventContext.cpp"
 #include "XMLDocumentParser.cpp"
 #include "XMLDocumentParserScope.cpp"
+
diff --git a/Source/WebCore/dom/DOMImplementation.h b/Source/WebCore/dom/DOMImplementation.h
index 9d53b916c..dffb549e3 100644
--- a/Source/WebCore/dom/DOMImplementation.h
+++ b/Source/WebCore/dom/DOMImplementation.h
@@ -42,7 +42,7 @@ class RegularExpression;
 
 typedef int ExceptionCode;
 
-class DOMImplementation {
+class DOMImplementation : public ScriptWrappable {
     WTF_MAKE_FAST_ALLOCATED;
 public:
     static PassOwnPtr<DOMImplementation> create(Document* document) { return adoptPtr(new DOMImplementation(document)); }
diff --git a/Source/WebCore/dom/Document.cpp b/Source/WebCore/dom/Document.cpp
index e85c8f1c0..31fdbaed4 100644
--- a/Source/WebCore/dom/Document.cpp
+++ b/Source/WebCore/dom/Document.cpp
@@ -107,8 +107,8 @@
 #include "InspectorCounters.h"
 #include "InspectorInstrumentation.h"
 #include "Language.h"
-#include "Localizer.h"
 #include "Logging.h"
+#include "MainResourceLoader.h"
 #include "MediaCanStartListener.h"
 #include "MediaQueryList.h"
 #include "MediaQueryMatcher.h"
@@ -125,6 +125,7 @@
 #include "PageGroup.h"
 #include "PageTransitionEvent.h"
 #include "PlatformKeyboardEvent.h"
+#include "PlatformLocale.h"
 #include "PluginDocument.h"
 #include "PointerLockController.h"
 #include "PopStateEvent.h"
@@ -159,7 +160,6 @@
 #include "Timer.h"
 #include "TransformSource.h"
 #include "TreeWalker.h"
-#include "UndoManager.h"
 #include "UserContentURLPattern.h"
 #include "WebCoreMemoryInstrumentation.h"
 #include "WebKitNamedFlow.h"
@@ -446,7 +446,7 @@ Document::Document(Frame* frame, const KURL& url, bool isXHTML, bool isHTML)
 #if ENABLE(MUTATION_OBSERVERS)
     , m_mutationObserverTypes(0)
 #endif
-    , m_styleSheetCollection(adoptPtr(new DocumentStyleSheetCollection(this)))
+    , m_styleSheetCollection(DocumentStyleSheetCollection::create(this))
     , m_readyState(Complete)
     , m_styleRecalcTimer(this, &Document::styleRecalcTimerFired)
     , m_pendingStyleRecalcShouldForce(false)
@@ -478,7 +478,7 @@ Document::Document(Frame* frame, const KURL& url, bool isXHTML, bool isHTML)
     , m_isViewSource(false)
     , m_sawElementsInKnownNamespaces(false)
     , m_isSrcdocDocument(false)
-    , m_documentRareData(0)
+    , m_renderer(0)
     , m_eventQueue(DocumentEventQueue::create(this))
     , m_weakReference(DocumentWeakReference::create(this))
     , m_idAttributeName(idAttr)
@@ -499,9 +499,6 @@ Document::Document(Frame* frame, const KURL& url, bool isXHTML, bool isHTML)
 #if ENABLE(TOUCH_EVENTS)
     , m_touchEventHandlerCount(0)
 #endif
-#if ENABLE(UNDO_MANAGER)
-    , m_undoManager(0)
-#endif
     , m_pendingTasksTimer(this, &Document::pendingTasksTimerFired)
     , m_scheduledTasksAreSuspended(false)
     , m_visualUpdatesAllowed(true)
@@ -1500,19 +1497,20 @@ PassRefPtr<Range> Document::caretRangeFromPoint(int x, int y)
  *  2. Trim leading and trailing spaces
  *  3. Collapse internal whitespace.
  */
+template <typename CharacterType>
 static inline StringWithDirection canonicalizedTitle(Document* document, const StringWithDirection& titleWithDirection)
 {
     const String& title = titleWithDirection.string();
-    const UChar* characters = title.characters();
+    const CharacterType* characters = title.getCharacters<CharacterType>();
     unsigned length = title.length();
     unsigned i;
 
-    StringBuffer<UChar> buffer(length);
+    StringBuffer<CharacterType> buffer(length);
     unsigned builderIndex = 0;
 
     // Skip leading spaces and leading characters that would convert to spaces
     for (i = 0; i < length; ++i) {
-        UChar c = characters[i];
+        CharacterType c = characters[i];
         if (!(c <= 0x20 || c == 0x7F))
             break;
     }
@@ -1523,7 +1521,7 @@ static inline StringWithDirection canonicalizedTitle(Document* document, const S
     // Replace control characters with spaces, and backslashes with currency symbols, and collapse whitespace.
     bool previousCharWasWS = false;
     for (; i < length; ++i) {
-        UChar c = characters[i];
+        CharacterType c = characters[i];
         if (c <= 0x20 || c == 0x7F || (WTF::Unicode::category(c) & (WTF::Unicode::Separator_Line | WTF::Unicode::Separator_Paragraph))) {
             if (previousCharWasWS)
                 continue;
@@ -1559,7 +1557,15 @@ void Document::updateTitle(const StringWithDirection& title)
         return;
 
     m_rawTitle = title;
-    m_title = canonicalizedTitle(this, m_rawTitle);
+
+    if (m_rawTitle.string().isEmpty())
+        m_title = StringWithDirection();
+    else {
+        if (m_rawTitle.string().is8Bit())
+            m_title = canonicalizedTitle<LChar>(this, m_rawTitle);
+        else
+            m_title = canonicalizedTitle<UChar>(this, m_rawTitle);
+    }
     if (Frame* f = frame())
         f->loader()->setTitle(m_title);
 }
@@ -1856,14 +1862,10 @@ void Document::recalcStyle(StyleChange change)
                 element->recalcStyle(change);
         }
 
-    #if USE(ACCELERATED_COMPOSITING)
-        if (view()) {
-            bool layoutPending = view()->layoutPending() || renderer()->needsLayout();
-            // If we didn't update compositing layers because of layout(), we need to do so here.
-            if (!layoutPending)
-                view()->updateCompositingLayersAfterStyleChange();
-        }
-    #endif
+#if USE(ACCELERATED_COMPOSITING)
+        if (view())
+            view()->updateCompositingLayersAfterStyleChange();
+#endif
 
     bailOut:
         clearNeedsStyleRecalc();
@@ -2029,11 +2031,6 @@ void Document::pageSizeAndMarginsInPixels(int pageIndex, IntSize& pageSize, int&
     marginLeft = style->marginLeft().isAuto() ? marginLeft : intValueForLength(style->marginLeft(), width, view);
 }
 
-void Document::setDocumentRareData(NodeRareData* rareData)
-{
-    m_documentRareData = rareData;
-}
-
 void Document::setIsViewSource(bool isViewSource)
 {
     m_isViewSource = isViewSource;
@@ -2202,11 +2199,6 @@ void Document::resumeActiveDOMObjects()
 #endif
 }
 
-RenderView* Document::renderView() const
-{
-    return toRenderView(renderer());
-}
-
 void Document::clearAXObjectCache()
 {
     // clear cache in top document
@@ -2955,17 +2947,24 @@ void Document::processHttpEquiv(const String& equiv, const String& content)
         if (frame) {
             FrameLoader* frameLoader = frame->loader();
             if (frameLoader->shouldInterruptLoadForXFrameOptions(content, url())) {
+                unsigned long requestIdentifier = 0;
+                if (frameLoader->activeDocumentLoader() && frameLoader->activeDocumentLoader()->mainResourceLoader())
+                    requestIdentifier = frameLoader->activeDocumentLoader()->mainResourceLoader()->identifier();
+                String message = "Refused to display '" + url().string() + "' in a frame because it set 'X-Frame-Options' to '" + content + "'.";
+
                 frameLoader->stopAllLoaders();
                 frame->navigationScheduler()->scheduleLocationChange(securityOrigin(), blankURL(), String());
-
-                DEFINE_STATIC_LOCAL(String, consoleMessage, (ASCIILiteral("Refused to display document because display forbidden by X-Frame-Options.\n")));
-                addConsoleMessage(JSMessageSource, LogMessageType, ErrorMessageLevel, consoleMessage);
+                addConsoleMessage(JSMessageSource, LogMessageType, ErrorMessageLevel, message, url().string(), 0, 0, requestIdentifier);
             }
         }
-    } else if (equalIgnoringCase(equiv, "x-webkit-csp"))
-        contentSecurityPolicy()->didReceiveHeader(content, ContentSecurityPolicy::EnforcePolicy);
+    } else if (equalIgnoringCase(equiv, "content-security-policy"))
+        contentSecurityPolicy()->didReceiveHeader(content, ContentSecurityPolicy::EnforceStableDirectives);
+    else if (equalIgnoringCase(equiv, "content-security-policy-report-only"))
+        contentSecurityPolicy()->didReceiveHeader(content, ContentSecurityPolicy::ReportStableDirectives);
+    else if (equalIgnoringCase(equiv, "x-webkit-csp"))
+        contentSecurityPolicy()->didReceiveHeader(content, ContentSecurityPolicy::EnforceAllDirectives);
     else if (equalIgnoringCase(equiv, "x-webkit-csp-report-only"))
-        contentSecurityPolicy()->didReceiveHeader(content, ContentSecurityPolicy::ReportOnly);
+        contentSecurityPolicy()->didReceiveHeader(content, ContentSecurityPolicy::ReportAllDirectives);
 }
 
 // Though isspace() considers \t and \v to be whitespace, Win IE doesn't.
@@ -4862,15 +4861,17 @@ void Document::parseDNSPrefetchControlHeader(const String& dnsPrefetchControl)
     m_haveExplicitlyDisabledDNSPrefetch = true;
 }
 
-void Document::addMessage(MessageSource source, MessageType type, MessageLevel level, const String& message, const String& sourceURL, unsigned lineNumber, PassRefPtr<ScriptCallStack> callStack)
+void Document::addMessage(MessageSource source, MessageType type, MessageLevel level, const String& message, const String& sourceURL, unsigned lineNumber, PassRefPtr<ScriptCallStack> callStack, unsigned long requestIdentifier)
 {
     if (!isContextThread()) {
         postTask(AddConsoleMessageTask::create(source, type, level, message));
         return;
     }
 
-    if (DOMWindow* window = domWindow())
-        window->console()->addMessage(source, type, level, message, sourceURL, lineNumber, callStack);
+    if (DOMWindow* window = domWindow()) {
+        if (Console* console = window->console())
+            console->addMessage(source, type, level, message, sourceURL, lineNumber, callStack, requestIdentifier);
+    }
 }
 
 struct PerformTaskContext {
@@ -4975,8 +4976,10 @@ void Document::windowScreenDidChange(PlatformDisplayID displayID)
 #endif
 
 #if USE(ACCELERATED_COMPOSITING)
-    if (renderView()->usesCompositing())
-        renderView()->compositor()->windowScreenDidChange(displayID);
+    if (RenderView* view = renderView()) {
+        if (view->usesCompositing())
+            view->compositor()->windowScreenDidChange(displayID);
+    }
 #endif
 }
 
@@ -4994,12 +4997,17 @@ PassRefPtr<StringImpl> Document::displayStringModifiedByEncoding(PassRefPtr<Stri
     return str;
 }
 
-void Document::displayBufferModifiedByEncoding(UChar* buffer, unsigned len) const
+template <typename CharacterType>
+void Document::displayBufferModifiedByEncodingInternal(CharacterType* buffer, unsigned len) const
 {
     if (m_decoder)
         m_decoder->encoding().displayBuffer(buffer, len);
 }
 
+// Generate definitions for both character types
+template void Document::displayBufferModifiedByEncodingInternal<LChar>(LChar*, unsigned) const;
+template void Document::displayBufferModifiedByEncodingInternal<UChar>(UChar*, unsigned) const;
+
 void Document::enqueuePageshowEvent(PageshowEventPersistence persisted)
 {
     // FIXME: https://bugs.webkit.org/show_bug.cgi?id=36334 Pageshow event needs to fire asynchronously.
@@ -5013,6 +5021,9 @@ void Document::enqueueHashchangeEvent(const String& oldURL, const String& newURL
 
 void Document::enqueuePopstateEvent(PassRefPtr<SerializedScriptValue> stateObject)
 {
+    if (!ContextFeatures::pushStateEnabled(this))
+        return;
+
     // FIXME: https://bugs.webkit.org/show_bug.cgi?id=36202 Popstate event needs to fire asynchronously
     dispatchWindowEvent(PopStateEvent::create(stateObject, domWindow() ? domWindow()->history() : 0));
 }
@@ -5950,15 +5961,6 @@ void Document::reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
     info.addMember(m_pendingTasks);
 }
 
-#if ENABLE(UNDO_MANAGER)
-PassRefPtr<UndoManager> Document::undoManager()
-{
-    if (!m_undoManager)
-        m_undoManager = UndoManager::create(this);
-    return m_undoManager;
-}
-#endif
-
 class ImmutableAttributeDataCacheKey {
 public:
     ImmutableAttributeDataCacheKey(const QualifiedName& tagName, const Attribute* attributes, unsigned attributeCount)
@@ -6028,14 +6030,14 @@ bool Document::haveStylesheetsLoaded() const
     return !m_styleSheetCollection->hasPendingSheets() || m_ignorePendingStylesheets;
 }
 
-Localizer& Document::getCachedLocalizer(const AtomicString& locale)
+Locale& Document::getCachedLocale(const AtomicString& locale)
 {
     AtomicString localeKey = locale;
     if (locale.isEmpty() || !RuntimeEnabledFeatures::langAttributeAwareFormControlUIEnabled())
         localeKey = defaultLanguage();
-    LocaleToLocalizerMap::AddResult result = m_localizerCache.add(localeKey, nullptr);
+    LocaleIdentifierToLocaleMap::AddResult result = m_localeCache.add(localeKey, nullptr);
     if (result.isNewEntry)
-        result.iterator->value = Localizer::create(localeKey);
+        result.iterator->value = Locale::create(localeKey);
     return *(result.iterator->value);
 }
 
diff --git a/Source/WebCore/dom/Document.h b/Source/WebCore/dom/Document.h
index 3eea0f0dd..2f8707bdd 100644
--- a/Source/WebCore/dom/Document.h
+++ b/Source/WebCore/dom/Document.h
@@ -108,7 +108,7 @@ class HitTestResult;
 class IntPoint;
 class DOMWrapperWorld;
 class JSNode;
-class Localizer;
+class Locale;
 class MediaCanStartListener;
 class MediaQueryList;
 class MediaQueryMatcher;
@@ -116,7 +116,6 @@ class MouseEventWithHitTestResults;
 class NamedFlowCollection;
 class NodeFilter;
 class NodeIterator;
-class NodeRareData;
 class Page;
 class PlatformMouseEvent;
 class ProcessingInstruction;
@@ -140,7 +139,6 @@ class StyleSheetList;
 class Text;
 class TextResourceDecoder;
 class TreeWalker;
-class UndoManager;
 class WebKitNamedFlow;
 class XMLHttpRequest;
 class XPathEvaluator;
@@ -467,9 +465,6 @@ public:
 
     bool isSrcdocDocument() const { return m_isSrcdocDocument; }
 
-    NodeRareData* documentRareData() const { return m_documentRareData; };
-    void setDocumentRareData(NodeRareData*);
-
     StyleResolver* styleResolverIfExists() const { return m_styleResolver.get(); }
 
     bool isViewSource() const { return m_isViewSource; }
@@ -533,7 +528,7 @@ public:
 
     void recalcStyle(StyleChange = NoChange);
     bool childNeedsAndNotInStyleRecalc();
-    virtual void updateStyleIfNeeded();
+    void updateStyleIfNeeded();
     void updateLayout();
     void updateLayoutIgnorePendingStylesheets();
     PassRefPtr<RenderStyle> styleForElementIgnoringPendingStylesheets(Element*);
@@ -561,8 +556,18 @@ public:
 
     RenderArena* renderArena() { return m_renderArena.get(); }
 
+    // Implemented in RenderView.h to avoid a cyclic header dependency this just
+    // returns renderer so callers can avoid verbose casts.
     RenderView* renderView() const;
 
+    // Shadow the implementations on Node to provide faster access for documents.
+    RenderObject* renderer() const { return m_renderer; }
+    void setRenderer(RenderObject* renderer)
+    {
+        m_renderer = renderer;
+        Node::setRenderer(renderer);
+    }
+
     void clearAXObjectCache();
     AXObjectCache* axObjectCache() const;
     bool axObjectCacheExists() const;
@@ -986,7 +991,14 @@ public:
 
     String displayStringModifiedByEncoding(const String&) const;
     PassRefPtr<StringImpl> displayStringModifiedByEncoding(PassRefPtr<StringImpl>) const;
-    void displayBufferModifiedByEncoding(UChar* buffer, unsigned len) const;
+    void displayBufferModifiedByEncoding(LChar* buffer, unsigned len) const
+    {
+        displayBufferModifiedByEncodingInternal(buffer, len);
+    }
+    void displayBufferModifiedByEncoding(UChar* buffer, unsigned len) const
+    {
+        displayBufferModifiedByEncodingInternal(buffer, len);
+    }
 
     // Quirk for the benefit of Apple's Dictionary application.
     void setFrameElementsShouldIgnoreScrolling(bool ignore) { m_frameElementsShouldIgnoreScrolling = ignore; }
@@ -1119,11 +1131,7 @@ public:
 #if ENABLE(MICRODATA)
     PassRefPtr<NodeList> getItems(const String& typeNames);
 #endif
-    
-#if ENABLE(UNDO_MANAGER)
-    PassRefPtr<UndoManager> undoManager();
-#endif
-    
+
     bool isInDocumentWrite() { return m_writeRecursionDepth > 0; }
 
     void suspendScheduledTasks(ActiveDOMObject::ReasonForSuspension);
@@ -1156,8 +1164,8 @@ public:
 
     bool inStyleRecalc() { return m_inStyleRecalc; }
 
-    // Return a Localizer for the default locale if the argument is null or empty.
-    Localizer& getCachedLocalizer(const AtomicString& locale = nullAtom);
+    // Return a Locale for the default locale if the argument is null or empty.
+    Locale& getCachedLocale(const AtomicString& locale = nullAtom);
 
 protected:
     Document(Frame*, const KURL&, bool isXHTML, bool isHTML);
@@ -1193,7 +1201,7 @@ private:
     virtual const KURL& virtualURL() const; // Same as url(), but needed for ScriptExecutionContext to implement it without a performance loss for direct calls.
     virtual KURL virtualCompleteURL(const String&) const; // Same as completeURL() for the same reason as above.
 
-    virtual void addMessage(MessageSource, MessageType, MessageLevel, const String& message, const String& sourceURL, unsigned lineNumber, PassRefPtr<ScriptCallStack>);
+    virtual void addMessage(MessageSource, MessageType, MessageLevel, const String& message, const String& sourceURL, unsigned lineNumber, PassRefPtr<ScriptCallStack>, unsigned long requestIdentifier = 0);
 
     virtual double minimumTimerInterval() const;
 
@@ -1216,6 +1224,9 @@ private:
     void pendingTasksTimerFired(Timer<Document>*);
 
     static void didReceiveTask(void*);
+    
+    template <typename CharacterType>
+    void displayBufferModifiedByEncodingInternal(CharacterType*, unsigned) const;
 
 #if ENABLE(PAGE_VISIBILITY_API)
     PageVisibilityState visibilityState() const;
@@ -1434,8 +1445,7 @@ private:
     bool m_sawElementsInKnownNamespaces;
     bool m_isSrcdocDocument;
 
-    NodeRareData* m_documentRareData;
-
+    RenderObject* m_renderer;
     RefPtr<DocumentEventQueue> m_eventQueue;
 
     RefPtr<DocumentWeakReference> m_weakReference;
@@ -1476,10 +1486,6 @@ private:
 #if ENABLE(TOUCH_EVENTS)
     unsigned m_touchEventHandlerCount;
 #endif
-    
-#if ENABLE(UNDO_MANAGER)
-    RefPtr<UndoManager> m_undoManager;
-#endif
 
 #if ENABLE(REQUEST_ANIMATION_FRAME)
     RefPtr<ScriptedAnimationController> m_scriptedAnimationController;
@@ -1513,8 +1519,8 @@ private:
     bool m_didDispatchViewportPropertiesChanged;
 #endif
 
-    typedef HashMap<AtomicString, OwnPtr<Localizer> > LocaleToLocalizerMap;
-    LocaleToLocalizerMap m_localizerCache;
+    typedef HashMap<AtomicString, OwnPtr<Locale> > LocaleIdentifierToLocaleMap;
+    LocaleIdentifierToLocaleMap m_localeCache;
 };
 
 inline void Document::notifyRemovePendingSheetIfNeeded()
@@ -1535,7 +1541,6 @@ inline Node::Node(Document* document, ConstructionType type)
     , m_document(document)
     , m_previous(0)
     , m_next(0)
-    , m_renderer(0)
 {
     if (document)
         document->guardRef();
diff --git a/Source/WebCore/dom/Document.idl b/Source/WebCore/dom/Document.idl
index b827ed7c4..b44ba1de1 100644
--- a/Source/WebCore/dom/Document.idl
+++ b/Source/WebCore/dom/Document.idl
@@ -212,10 +212,6 @@
     CSSStyleDeclaration createCSSStyleDeclaration();
 #endif
 
-#if defined(LANGUAGE_JAVASCRIPT) && LANGUAGE_JAVASCRIPT
-    [Conditional=UNDO_MANAGER] readonly attribute UndoManager undoManager;
-#endif
-
 #if defined(LANGUAGE_OBJECTIVE_C) && LANGUAGE_OBJECTIVE_C
     // DOM Level 2 Style Interface
     [ObjCLegacyUnnamedParameters, ObjCUseDefaultView] CSSStyleDeclaration getComputedStyle(in Element element,
@@ -370,7 +366,7 @@
     [Conditional=PAGE_VISIBILITY_API] readonly attribute boolean webkitHidden;
 
     // Security Policy API: http://dvcs.w3.org/hg/content-security-policy/raw-file/tip/csp-specification.dev.html#script-interfaces
-    [Conditional=CSP_NEXT] readonly attribute DOMSecurityPolicy SecurityPolicy;
+    [Conditional=CSP_NEXT] readonly attribute DOMSecurityPolicy securityPolicy;
 
 };
 
diff --git a/Source/WebCore/dom/DocumentEventQueue.cpp b/Source/WebCore/dom/DocumentEventQueue.cpp
index 91d198087..8f7459566 100644
--- a/Source/WebCore/dom/DocumentEventQueue.cpp
+++ b/Source/WebCore/dom/DocumentEventQueue.cpp
@@ -36,15 +36,10 @@
 #include "SuspendableTimer.h"
 #include "WebCoreMemoryInstrumentation.h"
 #include <wtf/MemoryInstrumentationHashSet.h>
+#include <wtf/MemoryInstrumentationListHashSet.h>
 
 namespace WebCore {
     
-static inline bool shouldDispatchScrollEventSynchronously(Document* document)
-{
-    ASSERT_ARG(document, document);
-    return applicationIsSafari() && (document->url().protocolIs("feed") || document->url().protocolIs("feeds"));
-}
-
 class DocumentEventQueueTimer : public SuspendableTimer {
     WTF_MAKE_NONCOPYABLE(DocumentEventQueueTimer);
 public:
@@ -97,11 +92,6 @@ void DocumentEventQueue::enqueueOrDispatchScrollEvent(PassRefPtr<Node> target, S
     bool canBubble = targetType == ScrollEventDocumentTarget;
     RefPtr<Event> scrollEvent = Event::create(eventNames().scrollEvent, canBubble, false /* non cancelleable */);
      
-    if (shouldDispatchScrollEventSynchronously(target->document())) {
-        target->dispatchEvent(scrollEvent.release());
-        return;
-    }
-
     if (!m_nodesWithQueuedScrollEvents.add(target.get()).isNewEntry)
         return;
 
diff --git a/Source/WebCore/dom/DocumentOrderedMap.cpp b/Source/WebCore/dom/DocumentOrderedMap.cpp
index bbd8b3b16..2fd5e4333 100644
--- a/Source/WebCore/dom/DocumentOrderedMap.cpp
+++ b/Source/WebCore/dom/DocumentOrderedMap.cpp
@@ -35,6 +35,9 @@
 #include "HTMLMapElement.h"
 #include "HTMLNames.h"
 #include "TreeScope.h"
+#include "WebCoreMemoryInstrumentation.h"
+#include <wtf/MemoryInstrumentationHashCountedSet.h>
+#include <wtf/MemoryInstrumentationHashMap.h>
 
 namespace WebCore {
 
@@ -159,4 +162,11 @@ Element* DocumentOrderedMap::getElementByLabelForAttribute(AtomicStringImpl* key
     return get<keyMatchesLabelForAttribute>(key, scope);
 }
 
+void DocumentOrderedMap::reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
+{
+    MemoryClassInfo info(memoryObjectInfo, this, WebCoreMemoryTypes::DOM);
+    info.addMember(m_map);
+    info.addMember(m_duplicateCounts);
+}
+
 } // namespace WebCore
diff --git a/Source/WebCore/dom/DocumentOrderedMap.h b/Source/WebCore/dom/DocumentOrderedMap.h
index 1f9039e61..f7deb3bfe 100644
--- a/Source/WebCore/dom/DocumentOrderedMap.h
+++ b/Source/WebCore/dom/DocumentOrderedMap.h
@@ -56,6 +56,8 @@ public:
 
     void checkConsistency() const;
 
+    void reportMemoryUsage(MemoryObjectInfo*) const;
+
 private:
     template<bool keyMatches(AtomicStringImpl*, Element*)> Element* get(AtomicStringImpl*, const TreeScope*) const;
 
diff --git a/Source/WebCore/dom/DocumentStyleSheetCollection.cpp b/Source/WebCore/dom/DocumentStyleSheetCollection.cpp
index bfd1e5f0f..350daaa53 100644
--- a/Source/WebCore/dom/DocumentStyleSheetCollection.cpp
+++ b/Source/WebCore/dom/DocumentStyleSheetCollection.cpp
@@ -31,6 +31,7 @@
 #include "CSSStyleSheet.h"
 #include "Document.h"
 #include "Element.h"
+#include "HTMLIFrameElement.h"
 #include "HTMLLinkElement.h"
 #include "HTMLNames.h"
 #include "HTMLStyleElement.h"
@@ -47,6 +48,7 @@
 #include "StyleSheetList.h"
 #include "UserContentURLPattern.h"
 #include "WebCoreMemoryInstrumentation.h"
+#include <wtf/MemoryInstrumentationListHashSet.h>
 #include <wtf/MemoryInstrumentationVector.h>
 
 namespace WebCore {
@@ -427,6 +429,14 @@ static void filterEnabledCSSStyleSheets(Vector<RefPtr<CSSStyleSheet> >& result,
     }
 }
 
+static void collectActiveCSSStyleSheetsFromSeamlessParents(Vector<RefPtr<CSSStyleSheet> >& sheets, Document* document)
+{
+    HTMLIFrameElement* seamlessParentIFrame = document->seamlessParentIFrame();
+    if (!seamlessParentIFrame)
+        return;
+    sheets.append(seamlessParentIFrame->document()->styleSheetCollection()->activeAuthorStyleSheets());
+}
+
 bool DocumentStyleSheetCollection::updateActiveStyleSheets(UpdateFlag updateFlag)
 {
     if (m_document->inStyleRecalc()) {
@@ -445,6 +455,7 @@ bool DocumentStyleSheetCollection::updateActiveStyleSheets(UpdateFlag updateFlag
     collectActiveStyleSheets(activeStyleSheets);
 
     Vector<RefPtr<CSSStyleSheet> > activeCSSStyleSheets;
+    collectActiveCSSStyleSheetsFromSeamlessParents(activeCSSStyleSheets, m_document);
     filterEnabledCSSStyleSheets(activeCSSStyleSheets, activeStyleSheets);
 
     StyleResolverUpdateType styleResolverUpdateType;
@@ -483,7 +494,7 @@ void DocumentStyleSheetCollection::reportMemoryUsage(MemoryObjectInfo* memoryObj
     info.addMember(m_userSheets);
     info.addMember(m_activeAuthorStyleSheets);
     info.addMember(m_styleSheetsForStyleSheetList);
-    info.addListHashSet(m_styleSheetCandidateNodes);
+    info.addMember(m_styleSheetCandidateNodes);
     info.addMember(m_preferredStylesheetSetName);
     info.addMember(m_selectedStylesheetSetName);
 }
diff --git a/Source/WebCore/dom/DocumentStyleSheetCollection.h b/Source/WebCore/dom/DocumentStyleSheetCollection.h
index b67d88866..af299cd7d 100644
--- a/Source/WebCore/dom/DocumentStyleSheetCollection.h
+++ b/Source/WebCore/dom/DocumentStyleSheetCollection.h
@@ -46,12 +46,13 @@ class StyleSheetList;
 class DocumentStyleSheetCollection {
     WTF_MAKE_FAST_ALLOCATED;
 public:
-    DocumentStyleSheetCollection(Document*);
+    static PassOwnPtr<DocumentStyleSheetCollection> create(Document* document) { return adoptPtr(new DocumentStyleSheetCollection(document)); }
+
     ~DocumentStyleSheetCollection();
 
-    const Vector<RefPtr<StyleSheet> >& styleSheetsForStyleSheetList() { return m_styleSheetsForStyleSheetList; }
+    const Vector<RefPtr<StyleSheet> >& styleSheetsForStyleSheetList() const { return m_styleSheetsForStyleSheetList; }
 
-    const Vector<RefPtr<CSSStyleSheet> >& activeAuthorStyleSheets() { return m_activeAuthorStyleSheets; }
+    const Vector<RefPtr<CSSStyleSheet> >& activeAuthorStyleSheets() const { return m_activeAuthorStyleSheets; }
 
     CSSStyleSheet* pageUserSheet();
     const Vector<RefPtr<CSSStyleSheet> >* pageGroupUserSheets() const;
@@ -67,7 +68,7 @@ public:
 
     void addUserSheet(PassRefPtr<StyleSheetContents> userSheet);
 
-    bool needsUpdateActiveStylesheetsOnStyleRecalc() { return m_needsUpdateActiveStylesheetsOnStyleRecalc; }
+    bool needsUpdateActiveStylesheetsOnStyleRecalc() const { return m_needsUpdateActiveStylesheetsOnStyleRecalc; }
 
     enum UpdateFlag { FullUpdate, OptimizedUpdate };
     bool updateActiveStyleSheets(UpdateFlag);
@@ -102,6 +103,8 @@ public:
     void reportMemoryUsage(MemoryObjectInfo*) const;
 
 private:
+    DocumentStyleSheetCollection(Document*);
+
     void collectActiveStyleSheets(Vector<RefPtr<StyleSheet> >&);
     enum StyleResolverUpdateType {
         Reconstruct,
diff --git a/Source/WebCore/dom/Element.cpp b/Source/WebCore/dom/Element.cpp
index e8456f704..26672ecb8 100644
--- a/Source/WebCore/dom/Element.cpp
+++ b/Source/WebCore/dom/Element.cpp
@@ -71,12 +71,13 @@
 #include "StyleResolver.h"
 #include "Text.h"
 #include "TextIterator.h"
-#include "UndoManager.h"
 #include "VoidCallback.h"
+#include "WebCoreMemoryInstrumentation.h"
 #include "WebKitAnimationList.h"
 #include "XMLNSNames.h"
 #include "XMLNames.h"
 #include "htmlediting.h"
+#include <wtf/BitVector.h>
 #include <wtf/text/CString.h>
 
 #if ENABLE(SVG)
@@ -123,6 +124,52 @@ private:
     StyleResolver* m_pushedStyleResolver;
 };
 
+typedef Vector<RefPtr<Attr> > AttrNodeList;
+typedef HashMap<Element*, OwnPtr<AttrNodeList> > AttrNodeListMap;
+
+static AttrNodeListMap& attrNodeListMap()
+{
+    DEFINE_STATIC_LOCAL(AttrNodeListMap, map, ());
+    return map;
+}
+
+static AttrNodeList* attrNodeListForElement(Element* element)
+{
+    if (!element->hasSyntheticAttrChildNodes())
+        return 0;
+    ASSERT(attrNodeListMap().contains(element));
+    return attrNodeListMap().get(element);
+}
+
+static AttrNodeList* ensureAttrNodeListForElement(Element* element)
+{
+    if (element->hasSyntheticAttrChildNodes()) {
+        ASSERT(attrNodeListMap().contains(element));
+        return attrNodeListMap().get(element);
+    }
+    ASSERT(!attrNodeListMap().contains(element));
+    element->setHasSyntheticAttrChildNodes(true);
+    AttrNodeListMap::AddResult result = attrNodeListMap().add(element, adoptPtr(new AttrNodeList));
+    return result.iterator->value.get();
+}
+
+static void removeAttrNodeListForElement(Element* element)
+{
+    ASSERT(element->hasSyntheticAttrChildNodes());
+    ASSERT(attrNodeListMap().contains(element));
+    attrNodeListMap().remove(element);
+    element->setHasSyntheticAttrChildNodes(false);
+}
+
+static Attr* findAttrNodeInList(AttrNodeList* attrNodeList, const QualifiedName& name)
+{
+    for (unsigned i = 0; i < attrNodeList->size(); ++i) {
+        if (attrNodeList->at(i)->qualifiedName() == name)
+            return attrNodeList->at(i).get();
+    }
+    return 0;
+}
+
 PassRefPtr<Element> Element::create(const QualifiedName& tagName, Document* document)
 {
     return adoptRef(new Element(tagName, document, CreateElement));
@@ -144,18 +191,16 @@ Element::~Element()
         elementRareData()->m_shadow.clear();
     }
 
-    if (hasAttrList()) {
-        ASSERT(m_attributeData);
-        m_attributeData->detachAttrObjectsFromElement(this);
-    }
+    if (hasSyntheticAttrChildNodes())
+        detachAllAttrNodesFromElement();
 }
 
 inline ElementRareData* Element::elementRareData() const
 {
     ASSERT(hasRareData());
-    return static_cast<ElementRareData*>(NodeRareData::rareDataFromMap(this));
+    return static_cast<ElementRareData*>(rareData());
 }
-    
+
 inline ElementRareData* Element::ensureElementRareData()
 {
     return static_cast<ElementRareData*>(ensureRareData());
@@ -206,14 +251,14 @@ PassRefPtr<Attr> Element::detachAttribute(size_t index)
     const Attribute* attribute = attributeData()->attributeItem(index);
     ASSERT(attribute);
 
-    RefPtr<Attr> attr = attrIfExists(attribute->name());
-    if (attr)
-        attr->detachFromElementWithValue(attribute->value());
+    RefPtr<Attr> attrNode = attrIfExists(attribute->name());
+    if (attrNode)
+        detachAttrNodeFromElementWithValue(attrNode.get(), attribute->value());
     else
-        attr = Attr::create(document(), attribute->name(), attribute->value());
+        attrNode = Attr::create(document(), attribute->name(), attribute->value());
 
     removeAttributeInternal(index, NotInSynchronizationOfLazyAttribute);
-    return attr.release();
+    return attrNode.release();
 }
 
 void Element::removeAttribute(const QualifiedName& name)
@@ -695,58 +740,52 @@ inline void Element::setAttributeInternal(size_t index, const QualifiedName& nam
         didModifyAttribute(name, newValue);
 }
 
+static inline AtomicString makeIdForStyleResolution(const AtomicString& value, bool inQuirksMode)
+{
+    if (inQuirksMode)
+        return value.lower();
+    return value;
+}
+
+static bool checkNeedsStyleInvalidationForIdChange(const AtomicString& oldId, const AtomicString& newId, StyleResolver* styleResolver)
+{
+    ASSERT(newId != oldId);
+    if (!oldId.isEmpty() && styleResolver->hasSelectorForId(oldId))
+        return true;
+    if (!newId.isEmpty() && styleResolver->hasSelectorForId(newId))
+        return true;
+    return false;
+}
+
 void Element::attributeChanged(const QualifiedName& name, const AtomicString& newValue)
 {
     parseAttribute(Attribute(name, newValue));
 
     document()->incDOMTreeVersion();
 
+    StyleResolver* styleResolver = document()->styleResolverIfExists();
+    bool testShouldInvalidateStyle = attached() && styleResolver && styleChangeType() < FullStyleChange;
+    bool shouldInvalidateStyle = false;
+
     if (isIdAttributeName(name)) {
-        if (newValue != attributeData()->idForStyleResolution()) {
-            if (newValue.isNull())
-                attributeData()->setIdForStyleResolution(nullAtom);
-            else if (document()->inQuirksMode())
-                attributeData()->setIdForStyleResolution(newValue.lower());
-            else
-                attributeData()->setIdForStyleResolution(newValue);
-            setNeedsStyleRecalc();
+        AtomicString oldId = attributeData()->idForStyleResolution();
+        AtomicString newId = makeIdForStyleResolution(newValue, document()->inQuirksMode());
+        if (newId != oldId) {
+            attributeData()->setIdForStyleResolution(newId);
+            shouldInvalidateStyle = testShouldInvalidateStyle && checkNeedsStyleInvalidationForIdChange(oldId, newId, styleResolver);
         }
     } else if (name == HTMLNames::nameAttr)
         setHasName(!newValue.isNull());
 
-    if (!needsStyleRecalc() && document()->attached()) {
-        StyleResolver* styleResolver = document()->styleResolverIfExists();
-        if (!styleResolver || styleResolver->hasSelectorForAttribute(name.localName()))
-            setNeedsStyleRecalc();
-    }
+    shouldInvalidateStyle |= testShouldInvalidateStyle && styleResolver->hasSelectorForAttribute(name.localName());
 
     invalidateNodeListCachesInAncestors(&name, this);
 
-    if (!AXObjectCache::accessibilityEnabled())
-        return;
+    if (shouldInvalidateStyle)
+        setNeedsStyleRecalc();
 
-    if (name == aria_activedescendantAttr) {
-        // any change to aria-activedescendant attribute triggers accessibility focus change, but document focus remains intact
-        document()->axObjectCache()->handleActiveDescendantChanged(this);
-    } else if (name == roleAttr) {
-        // the role attribute can change at any time, and the AccessibilityObject must pick up these changes
-        document()->axObjectCache()->handleAriaRoleChanged(this);
-    } else if (name == aria_valuenowAttr) {
-        // If the valuenow attribute changes, AX clients need to be notified.
-        document()->axObjectCache()->postNotification(this, AXObjectCache::AXValueChanged, true);
-    } else if (name == aria_labelAttr || name == aria_labeledbyAttr || name == altAttr || name == titleAttr) {
-        // If the content of an element changes due to an attribute change, notify accessibility.
-        document()->axObjectCache()->contentChanged(this);
-    } else if (name == aria_checkedAttr)
-        document()->axObjectCache()->checkedStateChanged(this);
-    else if (name == aria_selectedAttr)
-        document()->axObjectCache()->selectedChildrenChanged(this);
-    else if (name == aria_expandedAttr)
-        document()->axObjectCache()->handleAriaExpandedChange(this);
-    else if (name == aria_hiddenAttr)
-        document()->axObjectCache()->childrenChanged(this);
-    else if (name == aria_invalidAttr)
-        document()->axObjectCache()->postNotification(this, AXObjectCache::AXInvalidStatusChanged, true);
+    if (AXObjectCache::accessibilityEnabled())
+        document()->axObjectCache()->handleAttributeChanged(name, this);
 }
 
 void Element::parseAttribute(const Attribute& attribute)
@@ -782,18 +821,72 @@ static inline bool classStringHasClassName(const AtomicString& newClassString)
     return classStringHasClassName(newClassString.characters16(), length);
 }
 
+static bool checkNeedsStyleInvalidationForClassChange(const SpaceSplitString& changedClasses, StyleResolver* styleResolver)
+{
+    unsigned changedSize = changedClasses.size();
+    for (unsigned i = 0; i < changedSize; ++i) {
+        if (styleResolver->hasSelectorForClass(changedClasses[i]))
+            return true;
+    }
+    return false;
+}
+
+static bool checkNeedsStyleInvalidationForClassChange(const SpaceSplitString& oldClasses, const SpaceSplitString& newClasses, StyleResolver* styleResolver)
+{
+    unsigned oldSize = oldClasses.size();
+    if (!oldSize)
+        return checkNeedsStyleInvalidationForClassChange(newClasses, styleResolver);
+    BitVector remainingClassBits;
+    remainingClassBits.ensureSize(oldSize);
+    // Class vectors tend to be very short. This is faster than using a hash table.
+    unsigned newSize = newClasses.size();
+    for (unsigned i = 0; i < newSize; ++i) {
+        for (unsigned j = 0; j < oldSize; ++j) {
+            if (newClasses[i] == oldClasses[j]) {
+                remainingClassBits.quickSet(j);
+                continue;
+            }
+        }
+        if (styleResolver->hasSelectorForClass(newClasses[i]))
+            return true;
+    }
+    for (unsigned i = 0; i < oldSize; ++i) {
+        // If the bit is not set the the corresponding class has been removed.
+        if (remainingClassBits.quickGet(i))
+            continue;
+        if (styleResolver->hasSelectorForClass(oldClasses[i]))
+            return true;
+    }
+    return false;
+}
+
 void Element::classAttributeChanged(const AtomicString& newClassString)
 {
+    StyleResolver* styleResolver = document()->styleResolverIfExists();
+    bool testShouldInvalidateStyle = attached() && styleResolver && styleChangeType() < FullStyleChange;
+    bool shouldInvalidateStyle = false;
+
     if (classStringHasClassName(newClassString)) {
+        const ElementAttributeData* attributeData = ensureAttributeData();
         const bool shouldFoldCase = document()->inQuirksMode();
-        ensureAttributeData()->setClass(newClassString, shouldFoldCase);
-    } else if (attributeData())
-        mutableAttributeData()->clearClass();
+        const SpaceSplitString oldClasses = attributeData->classNames();
+
+        attributeData->setClass(newClassString, shouldFoldCase);
+
+        const SpaceSplitString& newClasses = attributeData->classNames();
+        shouldInvalidateStyle = testShouldInvalidateStyle && checkNeedsStyleInvalidationForClassChange(oldClasses, newClasses, styleResolver);
+    } else if (const ElementAttributeData* attributeData = this->attributeData()) {
+        const SpaceSplitString& oldClasses = attributeData->classNames();
+        shouldInvalidateStyle = testShouldInvalidateStyle && checkNeedsStyleInvalidationForClassChange(oldClasses, styleResolver);
+
+        attributeData->clearClass();
+    }
 
     if (DOMTokenList* classList = optionalClassList())
         static_cast<ClassList*>(classList)->reset(newClassString);
 
-    setNeedsStyleRecalc();
+    if (shouldInvalidateStyle)
+        setNeedsStyleRecalc();
 }
 
 // Returns true is the given attribute is an event handler.
@@ -1062,8 +1155,9 @@ void Element::detach()
 bool Element::pseudoStyleCacheIsInvalid(const RenderStyle* currentStyle, RenderStyle* newStyle)
 {
     ASSERT(currentStyle == renderStyle());
+    ASSERT(renderer());
 
-    if (!renderer() || !currentStyle)
+    if (!currentStyle)
         return false;
 
     const PseudoStyleCache* pseudoStyleCache = currentStyle->cachedPseudoStyles();
@@ -1113,7 +1207,7 @@ void Element::recalcStyle(StyleChange change)
             return;
     }
 
-    // Ref currentStyle in case it would otherwise be deleted when setRenderStyle() is called.
+    // Ref currentStyle in case it would otherwise be deleted when setting the new style in the renderer.
     RefPtr<RenderStyle> currentStyle(renderStyle());
     bool hasParentStyle = parentNodeForRenderingAndStyle() ? static_cast<bool>(parentNodeForRenderingAndStyle()->renderStyle()) : false;
     bool hasDirectAdjacentRules = currentStyle && currentStyle->childrenAffectedByDirectAdjacentRules();
@@ -1162,17 +1256,15 @@ void Element::recalcStyle(StyleChange change)
                 newStyle->setChildrenAffectedByDirectAdjacentRules();
         }
 
-        if (ch != NoChange || pseudoStyleCacheIsInvalid(currentStyle.get(), newStyle.get()) || (change == Force && renderer() && renderer()->requiresForcedStyleRecalcPropagation())) {
-            setRenderStyle(newStyle);
-        } else if (needsStyleRecalc() && styleChangeType() != SyntheticStyleChange) {
-            // Although no change occurred, we use the new style so that the cousin style sharing code won't get
-            // fooled into believing this style is the same.
-            if (renderer())
-                renderer()->setStyleInternal(newStyle.get());
-            else
-                setRenderStyle(newStyle);
-        } else if (styleChangeType() == SyntheticStyleChange)
-             setRenderStyle(newStyle);
+        if (RenderObject* renderer = this->renderer()) {
+            if (ch != NoChange || pseudoStyleCacheIsInvalid(currentStyle.get(), newStyle.get()) || (change == Force && renderer->requiresForcedStyleRecalcPropagation()) || styleChangeType() == SyntheticStyleChange)
+                renderer->setAnimatableStyle(newStyle.get());
+            else if (needsStyleRecalc()) {
+                // Although no change occurred, we use the new style so that the cousin style sharing code won't get
+                // fooled into believing this style is the same.
+                renderer->setStyleInternal(newStyle.get());
+            }
+        }
 
         // If "rem" units are used anywhere in the document, and if the document element's font size changes, then go ahead and force font updating
         // all the way down the tree. This is simpler than having to maintain a cache of objects (and such font size changes should be rare anyway).
@@ -1262,20 +1354,17 @@ ShadowRoot* Element::userAgentShadowRoot() const
 
 const AtomicString& Element::shadowPseudoId() const
 {
-    return hasRareData() ? elementRareData()->m_shadowPseudoId : nullAtom;
+    return pseudo();
 }
 
 void Element::setShadowPseudoId(const AtomicString& id, ExceptionCode& ec)
 {
-    if (!hasRareData() && id == nullAtom)
-        return;
-
-    if (!CSSSelector::isUnknownPseudoType(id)) {
+    if (!CSSSelector::isCustomPseudoType(id)) {
         ec = SYNTAX_ERR;
         return;
     }
 
-    ensureElementRareData()->m_shadowPseudoId = id;
+    setPseudo(id);
 }
 
 bool Element::childTypeAllowed(NodeType type) const
@@ -1439,20 +1528,20 @@ void Element::formatForDebugger(char* buffer, unsigned length) const
 }
 #endif
 
-PassRefPtr<Attr> Element::setAttributeNode(Attr* attr, ExceptionCode& ec)
+PassRefPtr<Attr> Element::setAttributeNode(Attr* attrNode, ExceptionCode& ec)
 {
-    if (!attr) {
+    if (!attrNode) {
         ec = TYPE_MISMATCH_ERR;
         return 0;
     }
 
-    RefPtr<Attr> oldAttr = attrIfExists(attr->qualifiedName());
-    if (oldAttr.get() == attr)
-        return attr; // This Attr is already attached to the element.
+    RefPtr<Attr> oldAttrNode = attrIfExists(attrNode->qualifiedName());
+    if (oldAttrNode.get() == attrNode)
+        return attrNode; // This Attr is already attached to the element.
 
     // INUSE_ATTRIBUTE_ERR: Raised if node is an Attr that is already an attribute of another Element object.
     // The DOM user must explicitly clone Attr nodes to re-use them in other elements.
-    if (attr->ownerElement()) {
+    if (attrNode->ownerElement()) {
         ec = INUSE_ATTRIBUTE_ERR;
         return 0;
     }
@@ -1460,17 +1549,20 @@ PassRefPtr<Attr> Element::setAttributeNode(Attr* attr, ExceptionCode& ec)
     updateInvalidAttributes();
     ElementAttributeData* attributeData = mutableAttributeData();
 
-    size_t index = attributeData->getAttributeItemIndex(attr->qualifiedName());
+    size_t index = attributeData->getAttributeItemIndex(attrNode->qualifiedName());
     if (index != notFound) {
-        if (oldAttr)
-            oldAttr->detachFromElementWithValue(attributeData->attributeItem(index)->value());
+        if (oldAttrNode)
+            detachAttrNodeFromElementWithValue(oldAttrNode.get(), attributeData->attributeItem(index)->value());
         else
-            oldAttr = Attr::create(document(), attr->qualifiedName(), attributeData->attributeItem(index)->value());
+            oldAttrNode = Attr::create(document(), attrNode->qualifiedName(), attributeData->attributeItem(index)->value());
     }
 
-    setAttributeInternal(index, attr->qualifiedName(), attr->value(), NotInSynchronizationOfLazyAttribute);
-    attributeData->setAttr(this, attr->qualifiedName(), attr);
-    return oldAttr.release();
+    setAttributeInternal(index, attrNode->qualifiedName(), attrNode->value(), NotInSynchronizationOfLazyAttribute);
+
+    attrNode->attachToElement(this);
+    ensureAttrNodeListForElement(this)->append(attrNode);
+
+    return oldAttrNode.release();
 }
 
 PassRefPtr<Attr> Element::setAttributeNodeNS(Attr* attr, ExceptionCode& ec)
@@ -1543,10 +1635,8 @@ void Element::removeAttributeInternal(size_t index, SynchronizationOfLazyAttribu
             willModifyAttribute(name, valueBeingRemoved, nullAtom);
     }
 
-    if (hasAttrList()) {
-        if (RefPtr<Attr> attr = attributeData->attrIfExists(this, name))
-            attr->detachFromElementWithValue(attributeData->attributeItem(index)->value());
-    }
+    if (RefPtr<Attr> attrNode = attrIfExists(name))
+        detachAttrNodeFromElementWithValue(attrNode.get(), attributeData->attributeItem(index)->value());
 
     attributeData->removeAttribute(index);
 
@@ -1572,8 +1662,11 @@ void Element::removeAttribute(const AtomicString& name)
 
     AtomicString localName = shouldIgnoreAttributeCase(this) ? name.lower() : name;
     size_t index = attributeData()->getAttributeItemIndex(localName, false);
-    if (index == notFound)
+    if (index == notFound) {
+        if (UNLIKELY(localName == styleAttr) && !isStyleAttributeValid() && isStyledElement())
+            static_cast<StyledElement*>(this)->removeAllInlineStyleProperties();
         return;
+    }
 
     removeAttributeInternal(index, NotInSynchronizationOfLazyAttribute);
 }
@@ -1588,7 +1681,10 @@ PassRefPtr<Attr> Element::getAttributeNode(const AtomicString& name)
     const ElementAttributeData* attributeData = updatedAttributeData();
     if (!attributeData)
         return 0;
-    return attributeData->getAttributeNode(name, shouldIgnoreAttributeCase(this), this);
+    const Attribute* attribute = attributeData->getAttributeItem(name, shouldIgnoreAttributeCase(this));
+    if (!attribute)
+        return 0;
+    return ensureAttr(attribute->name());
 }
 
 PassRefPtr<Attr> Element::getAttributeNodeNS(const AtomicString& namespaceURI, const AtomicString& localName)
@@ -1596,7 +1692,10 @@ PassRefPtr<Attr> Element::getAttributeNodeNS(const AtomicString& namespaceURI, c
     const ElementAttributeData* attributeData = updatedAttributeData();
     if (!attributeData)
         return 0;
-    return attributeData->getAttributeNode(QualifiedName(nullAtom, localName, namespaceURI), this);
+    const Attribute* attribute = attributeData->getAttributeItem(QualifiedName(nullAtom, localName, namespaceURI));
+    if (!attribute)
+        return 0;
+    return ensureAttr(attribute->name());
 }
 
 bool Element::hasAttribute(const AtomicString& name) const
@@ -1726,6 +1825,16 @@ String Element::title() const
     return String();
 }
 
+const AtomicString& Element::pseudo() const
+{
+    return getAttribute(pseudoAttr);
+}
+
+void Element::setPseudo(const AtomicString& value)
+{
+    setAttribute(pseudoAttr, value);
+}
+
 LayoutSize Element::minimumSizeForResizing() const
 {
     return hasRareData() ? elementRareData()->m_minimumSizeForResizing : defaultMinimumSizeForResizing();
@@ -1807,9 +1916,9 @@ AtomicString Element::computeInheritedLanguage() const
     return value;
 }
 
-Localizer& Element::localizer() const
+Locale& Element::locale() const
 {
-    return document()->getCachedLocalizer(computeInheritedLanguage());
+    return document()->getCachedLocale(computeInheritedLanguage());
 }
 
 void Element::cancelFocusAppearanceUpdate()
@@ -1822,15 +1931,10 @@ void Element::cancelFocusAppearanceUpdate()
 
 void Element::normalizeAttributes()
 {
-    if (!hasAttrList())
-        return;
-
-    const ElementAttributeData* attributeData = updatedAttributeData();
-    ASSERT(attributeData);
-
-    for (size_t i = 0; i < attributeData->length(); ++i) {
-        if (RefPtr<Attr> attr = attrIfExists(attributeData->attributeItem(i)->name()))
-            attr->normalize();
+    updateInvalidAttributes();
+    if (AttrNodeList* attrNodeList = attrNodeListForElement(this)) {
+        for (unsigned i = 0; i < attrNodeList->size(); ++i)
+            attrNodeList->at(i)->normalize();
     }
 }
 
@@ -2168,11 +2272,6 @@ void Element::willModifyAttribute(const QualifiedName& name, const AtomicString&
         recipients->enqueueMutationRecord(MutationRecord::createAttributes(this, name, oldValue));
 #endif
 
-#if ENABLE(UNDO_MANAGER)
-    if (UndoManager::isRecordingAutomaticTransaction(this))
-        UndoManager::addTransactionStep(AttrChangingDOMTransactionStep::create(this, name, oldValue, newValue));
-#endif
-
 #if ENABLE(INSPECTOR)
     InspectorInstrumentation::willModifyDOMAttr(document(), this, oldValue, newValue);
 #endif
@@ -2285,16 +2384,51 @@ void Element::setSavedLayerScrollOffset(const IntSize& size)
 
 PassRefPtr<Attr> Element::attrIfExists(const QualifiedName& name)
 {
-    if (!hasAttrList())
-        return 0;
-    ASSERT(attributeData());
-    return attributeData()->attrIfExists(this, name);
+    if (AttrNodeList* attrNodeList = attrNodeListForElement(this))
+        return findAttrNodeInList(attrNodeList, name);
+    return 0;
 }
 
 PassRefPtr<Attr> Element::ensureAttr(const QualifiedName& name)
 {
-    ASSERT(attributeData());
-    return attributeData()->ensureAttr(this, name);
+    AttrNodeList* attrNodeList = ensureAttrNodeListForElement(this);
+    RefPtr<Attr> attrNode = findAttrNodeInList(attrNodeList, name);
+    if (!attrNode) {
+        attrNode = Attr::create(this, name);
+        attrNodeList->append(attrNode);
+    }
+    return attrNode.release();
+}
+
+void Element::detachAttrNodeFromElementWithValue(Attr* attrNode, const AtomicString& value)
+{
+    ASSERT(hasSyntheticAttrChildNodes());
+    attrNode->detachFromElementWithValue(value);
+
+    AttrNodeList* attrNodeList = attrNodeListForElement(this);
+    for (unsigned i = 0; i < attrNodeList->size(); ++i) {
+        if (attrNodeList->at(i)->qualifiedName() == attrNode->qualifiedName()) {
+            attrNodeList->remove(i);
+            if (attrNodeList->isEmpty())
+                removeAttrNodeListForElement(this);
+            return;
+        }
+    }
+    ASSERT_NOT_REACHED();
+}
+
+void Element::detachAllAttrNodesFromElement()
+{
+    AttrNodeList* attrNodeList = attrNodeListForElement(this);
+    ASSERT(attrNodeList);
+
+    for (unsigned i = 0; i < attributeCount(); ++i) {
+        const Attribute* attribute = attributeItem(i);
+        if (RefPtr<Attr> attrNode = findAttrNodeInList(attrNodeList, attribute->name()))
+            attrNode->detachFromElementWithValue(attribute->value());
+    }
+
+    removeAttrNodeListForElement(this);
 }
 
 bool Element::willRecalcStyle(StyleChange)
@@ -2318,10 +2452,13 @@ PassRefPtr<RenderStyle> Element::customStyleForRenderer()
 
 void Element::cloneAttributesFromElement(const Element& other)
 {
+    if (hasSyntheticAttrChildNodes())
+        detachAllAttrNodesFromElement();
+
     if (const ElementAttributeData* attributeData = other.updatedAttributeData())
         mutableAttributeData()->cloneDataFrom(*attributeData, other, *this);
     else if (m_attributeData) {
-        m_attributeData->clearAttributes(this);
+        m_attributeData->clearAttributes();
         m_attributeData.clear();
     }
 }
@@ -2340,4 +2477,12 @@ void Element::createMutableAttributeData()
         m_attributeData = m_attributeData->makeMutableCopy();
 }
 
+void Element::reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
+{
+    MemoryClassInfo info(memoryObjectInfo, this, WebCoreMemoryTypes::DOM);
+    ContainerNode::reportMemoryUsage(memoryObjectInfo);
+    info.addMember(m_tagName);
+    info.addMember(m_attributeData);
+}
+
 } // namespace WebCore
diff --git a/Source/WebCore/dom/Element.h b/Source/WebCore/dom/Element.h
index 893bbeef0..677b34754 100644
--- a/Source/WebCore/dom/Element.h
+++ b/Source/WebCore/dom/Element.h
@@ -42,7 +42,7 @@ class DOMTokenList;
 class ElementRareData;
 class ElementShadow;
 class IntSize;
-class Localizer;
+class Locale;
 class RenderRegion;
 class ShadowRoot;
 class WebKitAnimationList;
@@ -291,7 +291,7 @@ public:
     bool isInCanvasSubtree() const;
 
     AtomicString computeInheritedLanguage() const;
-    Localizer& localizer() const;
+    Locale& locale() const;
 
     virtual void accessKeyAction(bool /*sendToAnyEvent*/) { }
 
@@ -312,6 +312,9 @@ public:
  
     virtual String title() const;
 
+    const AtomicString& pseudo() const;
+    void setPseudo(const AtomicString&);
+
     void updateId(const AtomicString& oldId, const AtomicString& newId);
     void updateId(TreeScope*, const AtomicString& oldId, const AtomicString& newId);
     void updateName(const AtomicString& oldName, const AtomicString& newName);
@@ -434,13 +437,7 @@ public:
     IntSize savedLayerScrollOffset() const;
     void setSavedLayerScrollOffset(const IntSize&);
 
-    virtual void reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
-    {
-        MemoryClassInfo info(memoryObjectInfo, this, WebCoreMemoryTypes::DOM);
-        ContainerNode::reportMemoryUsage(memoryObjectInfo);
-        info.addMember(m_tagName);
-        info.addMember(m_attributeData);
-    }
+    virtual void reportMemoryUsage(MemoryObjectInfo*) const OVERRIDE;
 
 protected:
     Element(const QualifiedName& tagName, Document* document, ConstructionType type)
@@ -531,6 +528,9 @@ private:
     ElementRareData* elementRareData() const;
     ElementRareData* ensureElementRareData();
 
+    void detachAllAttrNodesFromElement();
+    void detachAttrNodeFromElementWithValue(Attr*, const AtomicString& value);
+
     RefPtr<ElementAttributeData> m_attributeData;
 };
     
diff --git a/Source/WebCore/dom/Element.idl b/Source/WebCore/dom/Element.idl
index 7a9241dc1..9724b8830 100644
--- a/Source/WebCore/dom/Element.idl
+++ b/Source/WebCore/dom/Element.idl
@@ -118,6 +118,10 @@
     readonly attribute Element nextElementSibling;
     readonly attribute unsigned long childElementCount;
 
+#if defined(ENABLE_SHADOW_DOM)
+    [TreatReturnedNullStringAs=Null, V8EnabledAtRuntime=shadowDOM] attribute DOMString pseudo;
+#endif
+
     // DOM 4
     void remove()
         raises(DOMException);
diff --git a/Source/WebCore/dom/ElementAttributeData.cpp b/Source/WebCore/dom/ElementAttributeData.cpp
index 1f0fd858b..5293426f6 100644
--- a/Source/WebCore/dom/ElementAttributeData.cpp
+++ b/Source/WebCore/dom/ElementAttributeData.cpp
@@ -35,14 +35,14 @@
 
 namespace WebCore {
 
-static size_t immutableElementAttributeDataSize(unsigned count)
+static size_t sizeForImmutableElementAttributeDataWithAttributeCount(unsigned count)
 {
-    return sizeof(ImmutableElementAttributeData) + sizeof(Attribute) * count;
+    return sizeof(ImmutableElementAttributeData) - sizeof(void*) + sizeof(Attribute) * count;
 }
 
 PassRefPtr<ElementAttributeData> ElementAttributeData::createImmutable(const Vector<Attribute>& attributes)
 {
-    void* slot = WTF::fastMalloc(immutableElementAttributeDataSize(attributes.size()));
+    void* slot = WTF::fastMalloc(sizeForImmutableElementAttributeDataWithAttributeCount(attributes.size()));
     return adoptRef(new (slot) ImmutableElementAttributeData(attributes));
 }
 
@@ -87,101 +87,6 @@ PassRefPtr<ElementAttributeData> ElementAttributeData::makeMutableCopy() const
     return adoptRef(new MutableElementAttributeData(static_cast<const ImmutableElementAttributeData&>(*this)));
 }
 
-typedef Vector<RefPtr<Attr> > AttrList;
-typedef HashMap<Element*, OwnPtr<AttrList> > AttrListMap;
-
-static AttrListMap& attrListMap()
-{
-    DEFINE_STATIC_LOCAL(AttrListMap, map, ());
-    return map;
-}
-
-static AttrList* attrListForElement(Element* element)
-{
-    ASSERT(element);
-    if (!element->hasAttrList())
-        return 0;
-    ASSERT(attrListMap().contains(element));
-    return attrListMap().get(element);
-}
-
-static AttrList* ensureAttrListForElement(Element* element)
-{
-    ASSERT(element);
-    if (element->hasAttrList()) {
-        ASSERT(attrListMap().contains(element));
-        return attrListMap().get(element);
-    }
-    ASSERT(!attrListMap().contains(element));
-    element->setHasAttrList();
-    AttrListMap::AddResult result = attrListMap().add(element, adoptPtr(new AttrList));
-    return result.iterator->value.get();
-}
-
-static void removeAttrListForElement(Element* element)
-{
-    ASSERT(element);
-    ASSERT(element->hasAttrList());
-    ASSERT(attrListMap().contains(element));
-    attrListMap().remove(element);
-    element->clearHasAttrList();
-}
-
-static Attr* findAttrInList(AttrList* attrList, const QualifiedName& name)
-{
-    for (unsigned i = 0; i < attrList->size(); ++i) {
-        if (attrList->at(i)->qualifiedName() == name)
-            return attrList->at(i).get();
-    }
-    return 0;
-}
-
-PassRefPtr<Attr> ElementAttributeData::attrIfExists(Element* element, const QualifiedName& name) const
-{
-    if (AttrList* attrList = attrListForElement(element))
-        return findAttrInList(attrList, name);
-    return 0;
-}
-
-PassRefPtr<Attr> ElementAttributeData::ensureAttr(Element* element, const QualifiedName& name) const
-{
-    AttrList* attrList = ensureAttrListForElement(element);
-    RefPtr<Attr> attr = findAttrInList(attrList, name);
-    if (!attr) {
-        attr = Attr::create(element, name);
-        attrList->append(attr);
-    }
-    return attr.release();
-}
-
-void ElementAttributeData::setAttr(Element* element, const QualifiedName& name, Attr* attr) const
-{
-    AttrList* attrList = ensureAttrListForElement(element);
-
-    if (findAttrInList(attrList, name))
-        return;
-
-    attrList->append(attr);
-    attr->attachToElement(element);
-}
-
-void ElementAttributeData::removeAttr(Element* element, const QualifiedName& name) const
-{
-    AttrList* attrList = attrListForElement(element);
-    ASSERT(attrList);
-
-    for (unsigned i = 0; i < attrList->size(); ++i) {
-        if (attrList->at(i)->qualifiedName() == name) {
-            attrList->remove(i);
-            if (attrList->isEmpty())
-                removeAttrListForElement(element);
-            return;
-        }
-    }
-
-    ASSERT_NOT_REACHED();
-}
-
 StylePropertySet* ElementAttributeData::ensureInlineStyle(StyledElement* element)
 {
     ASSERT(isMutable());
@@ -258,23 +163,9 @@ bool ElementAttributeData::isEquivalent(const ElementAttributeData* other) const
     return true;
 }
 
-void ElementAttributeData::detachAttrObjectsFromElement(Element* element) const
-{
-    ASSERT(element->hasAttrList());
-
-    for (unsigned i = 0; i < length(); ++i) {
-        const Attribute* attribute = attributeItem(i);
-        if (RefPtr<Attr> attr = attrIfExists(element, attribute->name()))
-            attr->detachFromElementWithValue(attribute->value());
-    }
-
-    // The loop above should have cleaned out this element's Attr map.
-    ASSERT(!element->hasAttrList());
-}
-
 void ElementAttributeData::reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
 {
-    size_t actualSize = m_isMutable ? sizeof(ElementAttributeData) : immutableElementAttributeDataSize(m_arraySize);
+    size_t actualSize = m_isMutable ? sizeof(ElementAttributeData) : sizeForImmutableElementAttributeDataWithAttributeCount(m_arraySize);
     MemoryClassInfo info(memoryObjectInfo, this, WebCoreMemoryTypes::DOM, actualSize);
     info.addMember(m_inlineStyleDecl);
     info.addMember(m_attributeStyle);
@@ -322,7 +213,7 @@ void ElementAttributeData::cloneDataFrom(const ElementAttributeData& sourceData,
     if (!oldName.isNull() || !newName.isNull())
         targetElement.updateName(oldName, newName);
 
-    clearAttributes(&targetElement);
+    clearAttributes();
 
     if (sourceData.isMutable())
         mutableAttributeVector() = sourceData.mutableAttributeVector();
@@ -347,33 +238,11 @@ void ElementAttributeData::cloneDataFrom(const ElementAttributeData& sourceData,
     }
 }
 
-void ElementAttributeData::clearAttributes(Element* element)
+void ElementAttributeData::clearAttributes()
 {
     ASSERT(isMutable());
-
-    if (element->hasAttrList())
-        detachAttrObjectsFromElement(element);
-
     clearClass();
     mutableAttributeVector().clear();
 }
 
-PassRefPtr<Attr> ElementAttributeData::getAttributeNode(const String& name, bool shouldIgnoreAttributeCase, Element* element) const
-{
-    ASSERT(element);
-    const Attribute* attribute = getAttributeItem(name, shouldIgnoreAttributeCase);
-    if (!attribute)
-        return 0;
-    return ensureAttr(element, attribute->name());
-}
-
-PassRefPtr<Attr> ElementAttributeData::getAttributeNode(const QualifiedName& name, Element* element) const
-{
-    ASSERT(element);
-    const Attribute* attribute = getAttributeItem(name);
-    if (!attribute)
-        return 0;
-    return ensureAttr(element, attribute->name());
-}
-
 }
diff --git a/Source/WebCore/dom/ElementAttributeData.h b/Source/WebCore/dom/ElementAttributeData.h
index 8b848831c..bc698ddc8 100644
--- a/Source/WebCore/dom/ElementAttributeData.h
+++ b/Source/WebCore/dom/ElementAttributeData.h
@@ -33,7 +33,6 @@
 
 namespace WebCore {
 
-class Attr;
 class Element;
 class ImmutableElementAttributeData;
 class MutableElementAttributeData;
@@ -48,7 +47,7 @@ public:
     // the appropriate subclass type.
     void deref();
 
-    void clearClass() { m_classNames.clear(); }
+    void clearClass() const { m_classNames.clear(); }
     void setClass(const AtomicString& className, bool shouldFoldCase) const { m_classNames.set(className, shouldFoldCase); }
     const SpaceSplitString& classNames() const { return m_classNames; }
 
@@ -69,9 +68,6 @@ public:
     size_t length() const;
     bool isEmpty() const { return !length(); }
 
-    PassRefPtr<Attr> getAttributeNode(const String&, bool shouldIgnoreAttributeCase, Element*) const;
-    PassRefPtr<Attr> getAttributeNode(const QualifiedName&, Element*) const;
-
     // Internal interface.
     const Attribute* attributeItem(unsigned index) const;
     const Attribute* getAttributeItem(const QualifiedName&) const;
@@ -89,12 +85,6 @@ public:
 
     bool isEquivalent(const ElementAttributeData* other) const;
 
-    void setAttr(Element*, const QualifiedName&, Attr*) const;
-    void removeAttr(Element*, const QualifiedName&) const;
-    PassRefPtr<Attr> attrIfExists(Element*, const QualifiedName&) const;
-    PassRefPtr<Attr> ensureAttr(Element*, const QualifiedName&) const;
-    void detachAttrObjectsFromElement(Element*) const;
-
     void reportMemoryUsage(MemoryObjectInfo*) const;
 
     bool isMutable() const { return m_isMutable; }
@@ -129,7 +119,7 @@ private:
     const Attribute* getAttributeItem(const AtomicString& name, bool shouldIgnoreAttributeCase) const;
     size_t getAttributeItemIndexSlowCase(const AtomicString& name, bool shouldIgnoreAttributeCase) const;
     void cloneDataFrom(const ElementAttributeData& sourceData, const Element& sourceElement, Element& targetElement);
-    void clearAttributes(Element*);
+    void clearAttributes();
 
     PassRefPtr<ElementAttributeData> makeMutableCopy() const;
 
diff --git a/Source/WebCore/editing/UndoManager.idl b/Source/WebCore/dom/ElementRareData.cpp
index e7bf91bef..9382f5049 100644
--- a/Source/WebCore/editing/UndoManager.idl
+++ b/Source/WebCore/dom/ElementRareData.cpp
@@ -28,25 +28,25 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-[
-    Conditional=UNDO_MANAGER,
-    V8GenerateIsReachable=ImplOwnerNodeRoot
-] interface UndoManager {
-    [Custom] void transact(in Dictionary transaction, in boolean merge);
+#include "config.h"
+#include "ElementRareData.h"
 
-    void undo()
-        raises(DOMException);
-    void redo()
-        raises(DOMException);
+#include "RenderStyle.h"
+#include "WebCoreMemoryInstrumentation.h"
 
-    [Custom] sequence<DOMTransaction> item(in unsigned long index);
+namespace WebCore {
 
-    readonly attribute unsigned long length;
-    readonly attribute unsigned long position;
+void ElementRareData::reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
+{
+    MemoryClassInfo info(memoryObjectInfo, this, WebCoreMemoryTypes::DOM);
+    NodeRareData::reportMemoryUsage(memoryObjectInfo);
+    info.addMember(m_cachedCollections);
+    info.addMember(m_computedStyle);
 
-    void clearUndo()
-        raises(DOMException);
-    void clearRedo()
-        raises(DOMException);
-};
+    info.addMember(m_datasetDOMStringMap);
+    info.addMember(m_classList);
+    info.addMember(m_shadow);
+    info.addMember(m_attributeMap);
+}
 
+} // namespace WebCore
diff --git a/Source/WebCore/dom/ElementRareData.h b/Source/WebCore/dom/ElementRareData.h
index b4bc8e2e9..4b19cd42b 100644
--- a/Source/WebCore/dom/ElementRareData.h
+++ b/Source/WebCore/dom/ElementRareData.h
@@ -107,12 +107,13 @@ public:
         }
     }
 
+    virtual void reportMemoryUsage(MemoryObjectInfo*) const OVERRIDE;
+
     typedef FixedArray<HTMLCollection*, NumNodeCollectionTypes> CachedHTMLCollectionArray;
     OwnPtr<CachedHTMLCollectionArray> m_cachedCollections;
 
     LayoutSize m_minimumSizeForResizing;
     RefPtr<RenderStyle> m_computedStyle;
-    AtomicString m_shadowPseudoId;
 
     OwnPtr<DatasetDOMStringMap> m_datasetDOMStringMap;
     OwnPtr<ClassList> m_classList;
diff --git a/Source/WebCore/dom/ElementShadow.cpp b/Source/WebCore/dom/ElementShadow.cpp
index aeb5b5b47..6f87f1644 100644
--- a/Source/WebCore/dom/ElementShadow.cpp
+++ b/Source/WebCore/dom/ElementShadow.cpp
@@ -132,20 +132,6 @@ void ElementShadow::detach()
     }
 }
 
-InsertionPoint* ElementShadow::insertionPointFor(const Node* node) const
-{
-    ASSERT(node && node->parentNode());
-
-    if (node->parentNode()->isShadowRoot()) {
-        if (InsertionPoint* insertionPoint = toShadowRoot(node->parentNode())->assignedTo())
-            return insertionPoint;
-
-        return 0;
-    }
-
-    return distributor().findInsertionPointFor(node);
-}
-
 bool ElementShadow::childNeedsStyleRecalc()
 {
     ASSERT(youngestShadowRoot());
@@ -217,4 +203,16 @@ void ElementShadow::invalidateDistribution(Element* host)
         m_distributor.finishInivalidation();
 }
 
+void ElementShadow::reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
+{
+    MemoryClassInfo info(memoryObjectInfo, this, WebCoreMemoryTypes::DOM);
+    info.addMember(m_shadowRoots);
+    ShadowRoot* shadowRoot = m_shadowRoots.head();
+    while (shadowRoot) {
+        info.addMember(shadowRoot);
+        shadowRoot = shadowRoot->next();
+    }
+    info.addMember(m_distributor);
+}
+
 } // namespace
diff --git a/Source/WebCore/dom/ElementShadow.h b/Source/WebCore/dom/ElementShadow.h
index ddb43806b..2f6f56c74 100644
--- a/Source/WebCore/dom/ElementShadow.h
+++ b/Source/WebCore/dom/ElementShadow.h
@@ -65,12 +65,12 @@ public:
     void setValidityUndetermined();
     void invalidateDistribution();
     void ensureDistribution();
- 
-    InsertionPoint* insertionPointFor(const Node*) const;
 
     ContentDistributor& distributor();
     const ContentDistributor& distributor() const;
 
+    void reportMemoryUsage(MemoryObjectInfo*) const;
+
 private:
     void invalidateDistribution(Element* host);
 
diff --git a/Source/WebCore/dom/EventNames.h b/Source/WebCore/dom/EventNames.h
index 7a0552a4a..9ed7c7c19 100644
--- a/Source/WebCore/dom/EventNames.h
+++ b/Source/WebCore/dom/EventNames.h
@@ -235,7 +235,7 @@ namespace WebCore {
     macro(webkitpointerlockchange) \
     macro(webkitpointerlockerror) \
     \
-    macro(webkitRegionLayoutUpdate) \
+    macro(webkitregionlayoutupdate) \
     \
     macro(webkitnetworkinfochange) \
     \
@@ -243,6 +243,9 @@ namespace WebCore {
     \
     macro(webkitdeviceproximity) \
     \
+    macro(autocomplete) \
+    macro(autocompleteerror) \
+    \
 
 // end of DOM_EVENT_NAMES_FOR_EACH
 
diff --git a/Source/WebCore/dom/Node.cpp b/Source/WebCore/dom/Node.cpp
index 8d991a130..2dcca26ac 100644
--- a/Source/WebCore/dom/Node.cpp
+++ b/Source/WebCore/dom/Node.cpp
@@ -64,6 +64,7 @@
 #include "HTMLElement.h"
 #include "HTMLFrameOwnerElement.h"
 #include "HTMLNames.h"
+#include "HTMLStyleElement.h"
 #include "InspectorCounters.h"
 #include "KeyboardEvent.h"
 #include "LabelsNodeList.h"
@@ -469,9 +470,7 @@ TreeScope* Node::treeScope() const
 NodeRareData* Node::rareData() const
 {
     ASSERT(hasRareData());
-    NodeRareData* data = isDocumentNode() ? static_cast<const Document*>(this)->documentRareData() : NodeRareData::rareDataFromMap(this);
-    ASSERT(data);
-    return data;
+    return static_cast<NodeRareData*>(m_data.m_rareData);
 }
 
 NodeRareData* Node::ensureRareData()
@@ -480,18 +479,13 @@ NodeRareData* Node::ensureRareData()
         return rareData();
 
     NodeRareData* data = createRareData().leakPtr();
-    if (isDocumentNode()) {
-        // Fast path for a Document. A Document knows a pointer to NodeRareData.
-        ASSERT(!static_cast<Document*>(this)->documentRareData());
-        static_cast<Document*>(this)->setDocumentRareData(data);
-    } else {
-        ASSERT(!NodeRareData::rareDataMap().contains(this));
-        NodeRareData::rareDataMap().set(this, data);
-    }
+    ASSERT(data);
+    data->setRenderer(m_data.m_renderer);
+    m_data.m_rareData = data;
     setFlag(HasRareDataFlag);
     return data;
 }
-    
+
 OwnPtr<NodeRareData> Node::createRareData()
 {
     return adoptPtr(new NodeRareData);
@@ -505,19 +499,9 @@ void Node::clearRareData()
     ASSERT(!transientMutationObserverRegistry() || transientMutationObserverRegistry()->isEmpty());
 #endif
 
-    if (isDocumentNode()) {
-        Document* document = static_cast<Document*>(this);
-        NodeRareData* data = document->documentRareData();
-        ASSERT(data);
-        delete data;
-        document->setDocumentRareData(0);
-    } else {
-        NodeRareData::NodeRareDataMap& dataMap = NodeRareData::rareDataMap();
-        NodeRareData::NodeRareDataMap::iterator it = dataMap.find(this);
-        ASSERT(it != dataMap.end());
-        delete it->value;
-        dataMap.remove(it);
-    }
+    RenderObject* renderer = m_data.m_rareData->renderer();
+    delete m_data.m_rareData;
+    m_data.m_renderer = renderer;
     clearFlag(HasRareDataFlag);
 }
 
@@ -716,16 +700,16 @@ const AtomicString& Node::virtualNamespaceURI() const
     return nullAtom;
 }
 
-bool Node::isContentEditable()
+bool Node::isContentEditable(UserSelectAllTreatment treatment)
 {
     document()->updateStyleIfNeeded();
-    return rendererIsEditable(Editable);
+    return rendererIsEditable(Editable, treatment);
 }
 
 bool Node::isContentRichlyEditable()
 {
     document()->updateStyleIfNeeded();
-    return rendererIsEditable(RichlyEditable);
+    return rendererIsEditable(RichlyEditable, UserSelectAllIsAlwaysNonEditable);
 }
 
 void Node::inspect()
@@ -736,7 +720,7 @@ void Node::inspect()
 #endif
 }
 
-bool Node::rendererIsEditable(EditableLevel editableLevel) const
+bool Node::rendererIsEditable(EditableLevel editableLevel, UserSelectAllTreatment treatment) const
 {
     if (document()->frame() && document()->frame()->page() && document()->frame()->page()->isEditable() && !shadowRoot())
         return true;
@@ -747,6 +731,14 @@ bool Node::rendererIsEditable(EditableLevel editableLevel) const
 
     for (const Node* node = this; node; node = node->parentNode()) {
         if ((node->isHTMLElement() || node->isDocumentNode()) && node->renderer()) {
+#if ENABLE(USERSELECT_ALL)
+            // Elements with user-select: all style are considered atomic
+            // therefore non editable.
+            if (node->renderer()->style()->userSelect() == SELECT_ALL && treatment == UserSelectAllIsAlwaysNonEditable)
+                return false;
+#else
+            UNUSED_PARAM(treatment);
+#endif
             switch (node->renderer()->style()->userModify()) {
             case READ_ONLY:
                 return false;
@@ -784,17 +776,19 @@ bool Node::isEditableToAccessibility(EditableLevel editableLevel) const
 
 bool Node::shouldUseInputMethod()
 {
-    return isContentEditable();
+    return isContentEditable(UserSelectAllIsAlwaysNonEditable);
 }
 
 RenderBox* Node::renderBox() const
 {
-    return m_renderer && m_renderer->isBox() ? toRenderBox(m_renderer) : 0;
+    RenderObject* renderer = this->renderer();
+    return renderer && renderer->isBox() ? toRenderBox(renderer) : 0;
 }
 
 RenderBoxModelObject* Node::renderBoxModelObject() const
 {
-    return m_renderer && m_renderer->isBoxModelObject() ? toRenderBoxModelObject(m_renderer) : 0;
+    RenderObject* renderer = this->renderer();
+    return renderer && renderer->isBoxModelObject() ? toRenderBoxModelObject(renderer) : 0;
 }
 
 LayoutRect Node::boundingBox() const
@@ -1415,17 +1409,6 @@ RenderObject* Node::createRenderer(RenderArena*, RenderStyle*)
     ASSERT_NOT_REACHED();
     return 0;
 }
-    
-RenderStyle* Node::nonRendererRenderStyle() const
-{ 
-    return 0; 
-}   
-
-void Node::setRenderStyle(PassRefPtr<RenderStyle> s)
-{
-    if (m_renderer)
-        m_renderer->setAnimatableStyle(s); 
-}
 
 RenderStyle* Node::virtualComputedStyle(PseudoId pseudoElementSpecifier)
 {
@@ -1528,11 +1511,6 @@ bool Node::isBlockFlow() const
     return renderer() && renderer()->isBlockFlow();
 }
 
-bool Node::isBlockFlowOrBlockTable() const
-{
-    return renderer() && (renderer()->isBlockFlow() || (renderer()->isTable() && !renderer()->isInline()));
-}
-
 Element *Node::enclosingBlockFlowElement() const
 {
     Node *n = const_cast<Node *>(this);
@@ -2127,8 +2105,8 @@ void Node::showNode(const char* prefix) const
         prefix = "";
     if (isTextNode()) {
         String value = nodeValue();
-        value.replace('\\', "\\\\");
-        value.replace('\n', "\\n");
+        value.replaceWithLiteral('\\', "\\\\");
+        value.replaceWithLiteral('\n', "\\n");
         fprintf(stderr, "%s%s\t%p \"%s\"\n", prefix, nodeName().utf8().data(), this, value.utf8().data());
     } else {
         StringBuilder attrs;
@@ -2680,12 +2658,12 @@ void Node::dispatchBlurEvent(PassRefPtr<Node> newFocusedNode)
 
 void Node::dispatchChangeEvent()
 {
-    dispatchEvent(Event::create(eventNames().changeEvent, true, false));
+    dispatchScopedEvent(Event::create(eventNames().changeEvent, true, false));
 }
 
 void Node::dispatchInputEvent()
 {
-    dispatchEvent(Event::create(eventNames().inputEvent, true, false));
+    dispatchScopedEvent(Event::create(eventNames().inputEvent, true, false));
 }
 
 bool Node::disabled() const
@@ -2761,7 +2739,7 @@ bool Node::willRespondToMouseClickEvents()
 {
     if (disabled())
         return false;
-    return isContentEditable() || hasEventListeners(eventNames().mouseupEvent) || hasEventListeners(eventNames().mousedownEvent) || hasEventListeners(eventNames().clickEvent) || hasEventListeners(eventNames().DOMActivateEvent);
+    return isContentEditable(UserSelectAllIsAlwaysNonEditable) || hasEventListeners(eventNames().mouseupEvent) || hasEventListeners(eventNames().mousedownEvent) || hasEventListeners(eventNames().clickEvent) || hasEventListeners(eventNames().DOMActivateEvent);
 }
 
 bool Node::willRespondToTouchEvents()
@@ -2837,8 +2815,40 @@ void Node::reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
     info.addMember(m_document);
     info.addMember(m_next);
     info.addMember(m_previous);
-    if (m_renderer)
-        info.addMember(m_renderer->style());
+    if (RenderObject* renderer = this->renderer())
+        info.addMember(renderer->style());
+    if (hasRareData())
+        info.addMember(rareData());
+}
+
+void Node::textRects(Vector<IntRect>& rects) const
+{
+    RefPtr<Range> range = Range::create(document());
+    WebCore::ExceptionCode ec = 0;
+    range->selectNodeContents(const_cast<Node*>(this), ec);
+    range->textRects(rects);
+}
+
+void Node::registerScopedHTMLStyleChild()
+{
+    setHasScopedHTMLStyleChild(true);
+}
+
+void Node::unregisterScopedHTMLStyleChild()
+{
+    ASSERT(hasScopedHTMLStyleChild());
+    setHasScopedHTMLStyleChild(numberOfScopedHTMLStyleChildren());
+}
+
+size_t Node::numberOfScopedHTMLStyleChildren() const
+{
+    size_t count = 0;
+    for (Node* child = firstChild(); child; child = child->nextSibling()) {
+        if (child->hasTagName(HTMLNames::styleTag) && static_cast<HTMLStyleElement*>(child)->isRegisteredAsScoped())
+            count++;
+    }
+
+    return count;
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/dom/Node.h b/Source/WebCore/dom/Node.h
index 5d8640cbe..96e6211d6 100644
--- a/Source/WebCore/dom/Node.h
+++ b/Source/WebCore/dom/Node.h
@@ -111,6 +111,17 @@ enum StyleChangeType {
     SyntheticStyleChange = 3 << nodeStyleChangeShift
 };
 
+class NodeRareDataBase {
+public:
+    RenderObject* renderer() const { return m_renderer; }
+    void setRenderer(RenderObject* renderer) { m_renderer = renderer; }
+    virtual ~NodeRareDataBase() { }
+protected:
+    NodeRareDataBase() { }
+private:
+    RenderObject* m_renderer;
+};
+
 class Node : public EventTarget, public ScriptWrappable, public TreeShared<Node, ContainerNode> {
     friend class Document;
     friend class TreeScope;
@@ -226,9 +237,11 @@ public:
     bool isDocumentNode() const;
     bool isShadowRoot() const { return getFlag(IsShadowRootFlag); }
     bool inNamedFlow() const { return getFlag(InNamedFlowFlag); }
-    bool hasAttrList() const { return getFlag(HasAttrListFlag); }
     bool hasCustomCallbacks() const { return getFlag(HasCustomCallbacksFlag); }
 
+    bool hasSyntheticAttrChildNodes() const { return getFlag(HasSyntheticAttrChildNodesFlag); }
+    void setHasSyntheticAttrChildNodes(bool flag) { setFlag(flag, HasSyntheticAttrChildNodesFlag); }
+
     // If this node is in a shadow tree, returns its shadow host. Otherwise, returns 0.
     Element* shadowHost() const;
     // If this node is in a shadow tree, returns its shadow host. Otherwise, returns this.
@@ -258,8 +271,7 @@ public:
     Node* enclosingLinkEventParentOrSelf();
 
     bool isBlockFlow() const;
-    bool isBlockFlowOrBlockTable() const;
-    
+
     // These low-level calls give the caller responsibility for maintaining the integrity of the tree.
     void setPreviousSibling(Node* previous) { m_previous = previous; }
     void setNextSibling(Node* next) { m_next = next; }
@@ -345,9 +357,6 @@ public:
     void setInNamedFlow() { setFlag(InNamedFlowFlag); }
     void clearInNamedFlow() { clearFlag(InNamedFlowFlag); }
 
-    void setHasAttrList() { setFlag(HasAttrListFlag); }
-    void clearHasAttrList() { clearFlag(HasAttrListFlag); }
-
     bool hasScopedHTMLStyleChild() const { return getFlag(HasScopedHTMLStyleChildFlag); }
     void setHasScopedHTMLStyleChild(bool flag) { setFlag(flag, HasScopedHTMLStyleChildFlag); }
 
@@ -376,16 +385,20 @@ public:
     virtual bool isMouseFocusable() const;
     virtual Node* focusDelegate();
 
-    bool isContentEditable();
+    enum UserSelectAllTreatment {
+        UserSelectAllDoesNotAffectEditability,
+        UserSelectAllIsAlwaysNonEditable
+    };
+    bool isContentEditable(UserSelectAllTreatment = UserSelectAllDoesNotAffectEditability);
     bool isContentRichlyEditable();
 
     void inspect();
 
-    bool rendererIsEditable(EditableType editableType = ContentIsEditable) const
+    bool rendererIsEditable(EditableType editableType = ContentIsEditable, UserSelectAllTreatment treatment = UserSelectAllIsAlwaysNonEditable) const
     {
         switch (editableType) {
         case ContentIsEditable:
-            return rendererIsEditable(Editable);
+            return rendererIsEditable(Editable, treatment);
         case HasEditableAXRole:
             return isEditableToAccessibility(Editable);
         }
@@ -397,7 +410,7 @@ public:
     {
         switch (editableType) {
         case ContentIsEditable:
-            return rendererIsEditable(RichlyEditable);
+            return rendererIsEditable(RichlyEditable, UserSelectAllIsAlwaysNonEditable);
         case HasEditableAXRole:
             return isEditableToAccessibility(RichlyEditable);
         }
@@ -500,9 +513,16 @@ public:
     // -----------------------------------------------------------------------------
     // Integration with rendering tree
 
-    RenderObject* renderer() const { return m_renderer; }
-    void setRenderer(RenderObject* renderer) { m_renderer = renderer; }
-    
+    // As renderer() includes a branch you should avoid calling it repeatedly in hot code paths.
+    RenderObject* renderer() const { return hasRareData() ? m_data.m_rareData->renderer() : m_data.m_renderer; };
+    void setRenderer(RenderObject* renderer)
+    {
+        if (hasRareData())
+            m_data.m_rareData->setRenderer(renderer);
+        else
+            m_data.m_renderer = renderer;
+    }
+
     // Use these two methods with caution.
     RenderBox* renderBox() const;
     RenderBoxModelObject* renderBoxModelObject() const;
@@ -530,7 +550,6 @@ public:
     
     // Wrapper for nodes that don't have a renderer, but still cache the style (like HTMLOptionElement).
     RenderStyle* renderStyle() const;
-    virtual void setRenderStyle(PassRefPtr<RenderStyle>);
 
     RenderStyle* computedStyle(PseudoId pseudoElementSpecifier = NOPSEUDO) { return virtualComputedStyle(pseudoElementSpecifier); }
 
@@ -663,12 +682,14 @@ public:
     void notifyMutationObserversNodeWillDetach();
 #endif // ENABLE(MUTATION_OBSERVERS)
 
-    void registerScopedHTMLStyleChild();
-    void unregisterScopedHTMLStyleChild();
+    virtual void registerScopedHTMLStyleChild();
+    virtual void unregisterScopedHTMLStyleChild();
     size_t numberOfScopedHTMLStyleChildren() const;
 
     virtual void reportMemoryUsage(MemoryObjectInfo*) const;
 
+    void textRects(Vector<IntRect>&) const;
+
 private:
     enum NodeFlags {
         IsTextFlag = 1,
@@ -711,7 +732,7 @@ private:
         DefaultNodeFlags = IsParsingChildrenFinishedFlag | IsStyleAttributeValidFlag,
 #endif
         InNamedFlowFlag = 1 << 26,
-        HasAttrListFlag = 1 << 27,
+        HasSyntheticAttrChildNodesFlag = 1 << 27,
         HasCustomCallbacksFlag = 1 << 28,
         HasScopedHTMLStyleChildFlag = 1 << 29,
         HasEventTargetDataFlag = 1 << 30,
@@ -768,7 +789,7 @@ private:
     void setDocument(Document*);
 
     enum EditableLevel { Editable, RichlyEditable };
-    bool rendererIsEditable(EditableLevel) const;
+    bool rendererIsEditable(EditableLevel, UserSelectAllTreatment = UserSelectAllIsAlwaysNonEditable) const;
     bool isEditableToAccessibility(EditableLevel) const;
 
     void setStyleChange(StyleChangeType);
@@ -782,7 +803,7 @@ private:
     virtual OwnPtr<NodeRareData> createRareData();
     bool rareDataFocused() const;
 
-    virtual RenderStyle* nonRendererRenderStyle() const;
+    virtual RenderStyle* nonRendererStyle() const { return 0; }
 
     virtual const AtomicString& virtualPrefix() const;
     virtual const AtomicString& virtualLocalName() const;
@@ -811,7 +832,12 @@ private:
     Document* m_document;
     Node* m_previous;
     Node* m_next;
-    RenderObject* m_renderer;
+    // When a node has rare data we move the renderer into the rare data.
+    union DataUnion {
+        DataUnion() : m_renderer(0) { }
+        RenderObject* m_renderer;
+        NodeRareDataBase* m_rareData;
+    } m_data;
 
 public:
     bool isStyleAttributeValid() const { return getFlag(IsStyleAttributeValidFlag); }
diff --git a/Source/WebCore/bindings/v8/ScopedDOMDataStore.cpp b/Source/WebCore/dom/NodeRareData.cpp
index bbddc5c1b..087f9c3ef 100644
--- a/Source/WebCore/bindings/v8/ScopedDOMDataStore.cpp
+++ b/Source/WebCore/dom/NodeRareData.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2009 Google Inc. All rights reserved.
+ * Copyright (C) 2012 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -29,38 +29,40 @@
  */
 
 #include "config.h"
-#include "ScopedDOMDataStore.h"
+#include "NodeRareData.h"
 
-#include "Node.h"
 #include "WebCoreMemoryInstrumentation.h"
+#include <wtf/MemoryInstrumentationHashMap.h>
+#include <wtf/MemoryInstrumentationHashSet.h>
+#include <wtf/MemoryInstrumentationVector.h>
 
 namespace WebCore {
 
-ScopedDOMDataStore::ScopedDOMDataStore()
-    : DOMDataStore()
+void NodeListsNodeData::reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
 {
-    m_domNodeMap = new DOMWrapperMap<Node>(&DOMDataStore::weakNodeCallback);
-    m_activeDomNodeMap = new DOMWrapperMap<Node>(&DOMDataStore::weakNodeCallback);
-    m_domObjectMap = new DOMWrapperMap<void>(&DOMDataStore::weakDOMObjectCallback);
-    m_activeDomObjectMap = new DOMWrapperMap<void>(&DOMDataStore::weakActiveDOMObjectCallback);
+    MemoryClassInfo info(memoryObjectInfo, this, WebCoreMemoryTypes::DOM);
+    info.addMember(m_atomicNameCaches);
+    info.addMember(m_nameCaches);
+    info.addMember(m_tagNodeListCacheNS);
 }
 
-ScopedDOMDataStore::~ScopedDOMDataStore()
+void NodeRareData::reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
 {
-    delete m_domNodeMap;
-    delete m_activeDomNodeMap;
-    delete m_domObjectMap;
-    delete m_activeDomObjectMap;
-}
+    MemoryClassInfo info(memoryObjectInfo, this, WebCoreMemoryTypes::DOM);
+    info.addMember(m_treeScope);
+    info.addMember(m_nodeLists);
+    info.addMember(m_childNodeList);
 
-void ScopedDOMDataStore::reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
-{
-    MemoryClassInfo info(memoryObjectInfo, this, WebCoreMemoryTypes::Binding);
-    DOMDataStore::reportMemoryUsage(memoryObjectInfo);
-    info.addMember(m_domNodeMap);
-    info.addMember(m_activeDomNodeMap);
-    info.addMember(m_domObjectMap);
-    info.addMember(m_activeDomObjectMap);
+#if ENABLE(MUTATION_OBSERVERS)
+    info.addMember(m_mutationObserverRegistry);
+    info.addMember(m_transientMutationObserverRegistry);
+#endif
+
+#if ENABLE(MICRODATA)
+    info.addMember(m_itemProp);
+    info.addMember(m_itemRef);
+    info.addMember(m_itemType);
+#endif
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/dom/NodeRareData.h b/Source/WebCore/dom/NodeRareData.h
index 5b3a583b0..c56d06f8a 100644
--- a/Source/WebCore/dom/NodeRareData.h
+++ b/Source/WebCore/dom/NodeRareData.h
@@ -158,6 +158,8 @@ public:
         }
     }
 
+    void reportMemoryUsage(MemoryObjectInfo*) const;
+
 private:
     NodeListsNodeData() { }
 
@@ -176,7 +178,7 @@ private:
     TagNodeListCacheNS m_tagNodeListCacheNS;
 };
 
-class NodeRareData {
+class NodeRareData : public NodeRareDataBase {
     WTF_MAKE_NONCOPYABLE(NodeRareData); WTF_MAKE_FAST_ALLOCATED;
 public:    
     NodeRareData()
@@ -198,19 +200,6 @@ public:
     {
     }
 
-    typedef HashMap<const Node*, NodeRareData*> NodeRareDataMap;
-    
-    static NodeRareDataMap& rareDataMap()
-    {
-        static NodeRareDataMap* dataMap = new NodeRareDataMap;
-        return *dataMap;
-    }
-    
-    static NodeRareData* rareDataFromMap(const Node* node)
-    {
-        return rareDataMap().get(node);
-    }
-
     TreeScope* treeScope() const { return m_treeScope; }
     void setTreeScope(TreeScope* treeScope) { m_treeScope = treeScope; }
     
@@ -308,6 +297,8 @@ public:
     bool isFocused() const { return m_isFocused; }
     void setFocused(bool focused) { m_isFocused = focused; }
 
+    virtual void reportMemoryUsage(MemoryObjectInfo*) const;
+
 protected:
     // for ElementRareData
     bool needsFocusAppearanceUpdateSoonAfterAttach() const { return m_needsFocusAppearanceUpdateSoonAfterAttach; }
diff --git a/Source/WebCore/dom/NodeRenderStyle.h b/Source/WebCore/dom/NodeRenderStyle.h
index 1a2d2c34a..cf6a58b1f 100644
--- a/Source/WebCore/dom/NodeRenderStyle.h
+++ b/Source/WebCore/dom/NodeRenderStyle.h
@@ -35,9 +35,9 @@ inline RenderStyle* Node::renderStyle() const
 {
     // Using a ternary here confuses the Solaris Studio 12/12.1/12.2 compilers:
     // Bug is CR 6569194, "Problem with question operator binding in inline function"
-    if (m_renderer) 
-        return m_renderer->style();
-    return nonRendererRenderStyle();
+    if (RenderObject* renderer = this->renderer())
+        return renderer->style();
+    return nonRendererStyle();
 }
 
 }
diff --git a/Source/WebCore/dom/Position.cpp b/Source/WebCore/dom/Position.cpp
index 9fd2c018c..31ddaf5eb 100644
--- a/Source/WebCore/dom/Position.cpp
+++ b/Source/WebCore/dom/Position.cpp
@@ -27,13 +27,13 @@
 #include "Position.h"
 
 #include "CSSComputedStyleDeclaration.h"
+#include "ContextFeatures.h"
 #include "HTMLNames.h"
 #include "InlineTextBox.h"
 #include "Logging.h"
 #include "PositionIterator.h"
 #include "RenderBlock.h"
 #include "RenderText.h"
-#include "RuntimeEnabledFeatures.h"
 #include "Text.h"
 #include "TextIterator.h"
 #include "VisiblePosition.h"
@@ -82,7 +82,7 @@ Position::Position(PassRefPtr<Node> anchorNode, LegacyEditingOffset offset)
     , m_isLegacyEditingPosition(true)
 {
 #if ENABLE(SHADOW_DOM)
-    ASSERT((m_anchorNode && RuntimeEnabledFeatures::shadowDOMEnabled())
+    ASSERT((m_anchorNode && ContextFeatures::shadowDOMEnabled(m_anchorNode->document()))
            || !m_anchorNode || !m_anchorNode->isShadowRoot());
 #else
     ASSERT(!m_anchorNode || !m_anchorNode->isShadowRoot());
@@ -96,7 +96,7 @@ Position::Position(PassRefPtr<Node> anchorNode, AnchorType anchorType)
     , m_isLegacyEditingPosition(false)
 {
 #if ENABLE(SHADOW_DOM)
-    ASSERT((m_anchorNode && RuntimeEnabledFeatures::shadowDOMEnabled())
+    ASSERT((m_anchorNode && ContextFeatures::shadowDOMEnabled(m_anchorNode->document()))
            || !m_anchorNode || !m_anchorNode->isShadowRoot());
 #else
     ASSERT(!m_anchorNode || !m_anchorNode->isShadowRoot());
@@ -114,7 +114,7 @@ Position::Position(PassRefPtr<Node> anchorNode, int offset, AnchorType anchorTyp
     , m_isLegacyEditingPosition(false)
 {
 #if ENABLE(SHADOW_DOM)
-    ASSERT((m_anchorNode && RuntimeEnabledFeatures::shadowDOMEnabled())
+    ASSERT((m_anchorNode && ContextFeatures::shadowDOMEnabled(m_anchorNode->document()))
            || !m_anchorNode || !editingIgnoresContent(m_anchorNode.get()) || !m_anchorNode->isShadowRoot());
 #else
     ASSERT(!m_anchorNode || !editingIgnoresContent(m_anchorNode.get()) || !m_anchorNode->isShadowRoot());
@@ -858,13 +858,42 @@ ContainerNode* Position::findParent(const Node* node)
     // FIXME: See http://web.ug/82697
 
 #if ENABLE(SHADOW_DOM)
-    if (RuntimeEnabledFeatures::shadowDOMEnabled())
+    if (ContextFeatures::shadowDOMEnabled(node->document()))
         return node->parentNode();
 #endif
 
     return node->nonShadowBoundaryParentNode();
 }
 
+#if ENABLE(USERSELECT_ALL)
+bool Position::nodeIsUserSelectAll(const Node* node)
+{
+    return node && node->renderer() && node->renderer()->style()->userSelect() == SELECT_ALL;
+}
+
+Node* Position::rootUserSelectAllForNode(Node* node)
+{
+    if (!node || !nodeIsUserSelectAll(node))
+        return 0;
+    Node* parent = node->parentNode();
+    if (!parent)
+        return node;
+
+    Node* candidateRoot = node;
+    while (parent) {
+        if (!parent->renderer()) {
+            parent = parent->parentNode();
+            continue;
+        }
+        if (!nodeIsUserSelectAll(parent))
+            break;
+        candidateRoot = parent;
+        parent = candidateRoot->parentNode();
+    }
+    return candidateRoot;
+}
+#endif
+
 bool Position::isCandidate() const
 {
     if (isNull())
diff --git a/Source/WebCore/dom/Position.h b/Source/WebCore/dom/Position.h
index 27c3f4297..fa2aba721 100644
--- a/Source/WebCore/dom/Position.h
+++ b/Source/WebCore/dom/Position.h
@@ -189,7 +189,10 @@ public:
 
     static bool hasRenderedNonAnonymousDescendantsWithHeight(RenderObject*);
     static bool nodeIsUserSelectNone(Node*);
-
+#if ENABLE(USERSELECT_ALL)
+    static bool nodeIsUserSelectAll(const Node*);
+    static Node* rootUserSelectAllForNode(Node*);
+#endif
     static ContainerNode* findParent(const Node*);
     
     void debugPosition(const char* msg = "") const;
diff --git a/Source/WebCore/dom/ScriptExecutionContext.cpp b/Source/WebCore/dom/ScriptExecutionContext.cpp
index 0f88eb640..39a3dcd60 100644
--- a/Source/WebCore/dom/ScriptExecutionContext.cpp
+++ b/Source/WebCore/dom/ScriptExecutionContext.cpp
@@ -311,14 +311,14 @@ void ScriptExecutionContext::reportException(const String& errorMessage, int lin
     m_pendingExceptions.clear();
 }
 
-void ScriptExecutionContext::addConsoleMessage(MessageSource source, MessageType type, MessageLevel level, const String& message, const String& sourceURL, unsigned lineNumber, PassRefPtr<ScriptCallStack> callStack)
+void ScriptExecutionContext::addConsoleMessage(MessageSource source, MessageType type, MessageLevel level, const String& message, const String& sourceURL, unsigned lineNumber, PassRefPtr<ScriptCallStack> callStack, unsigned long requestIdentifier)
 {
-    addMessage(source, type, level, message, sourceURL, lineNumber, callStack);
+    addMessage(source, type, level, message, sourceURL, lineNumber, callStack, requestIdentifier);
 }
 
-void ScriptExecutionContext::addConsoleMessage(MessageSource source, MessageType type, MessageLevel level, const String& message, PassRefPtr<ScriptCallStack> callStack)
+void ScriptExecutionContext::addConsoleMessage(MessageSource source, MessageType type, MessageLevel level, const String& message, PassRefPtr<ScriptCallStack> callStack, unsigned long requestIdentifier)
 {
-    addMessage(source, type, level, message, String(), 0, callStack);
+    addMessage(source, type, level, message, String(), 0, callStack, requestIdentifier);
 }
 
 
diff --git a/Source/WebCore/dom/ScriptExecutionContext.h b/Source/WebCore/dom/ScriptExecutionContext.h
index 50111a4fe..b8dca2906 100644
--- a/Source/WebCore/dom/ScriptExecutionContext.h
+++ b/Source/WebCore/dom/ScriptExecutionContext.h
@@ -31,6 +31,7 @@
 #include "ActiveDOMObject.h"
 #include "ConsoleTypes.h"
 #include "KURL.h"
+#include "ScriptCallStack.h"
 #include "SecurityContext.h"
 #include "Supplementable.h"
 #include <wtf/Forward.h>
@@ -53,7 +54,6 @@ class EventListener;
 class EventQueue;
 class EventTarget;
 class MessagePort;
-class ScriptCallStack;
 
 #if ENABLE(BLOB)
 class PublicURLManager;
@@ -83,8 +83,8 @@ public:
 
     bool sanitizeScriptError(String& errorMessage, int& lineNumber, String& sourceURL);
     void reportException(const String& errorMessage, int lineNumber, const String& sourceURL, PassRefPtr<ScriptCallStack>);
-    void addConsoleMessage(MessageSource, MessageType, MessageLevel, const String& message, const String& sourceURL = String(), unsigned lineNumber = 0, PassRefPtr<ScriptCallStack> = 0);
-    void addConsoleMessage(MessageSource, MessageType, MessageLevel, const String& message, PassRefPtr<ScriptCallStack>);
+    void addConsoleMessage(MessageSource, MessageType, MessageLevel, const String& message, const String& sourceURL = String(), unsigned lineNumber = 0, PassRefPtr<ScriptCallStack> = 0, unsigned long requestIdentifier = 0);
+    void addConsoleMessage(MessageSource, MessageType, MessageLevel, const String& message, PassRefPtr<ScriptCallStack>, unsigned long requestIdentifier = 0);
 
 #if ENABLE(BLOB)
     PublicURLManager& publicURLManager();
@@ -187,7 +187,7 @@ private:
     virtual const KURL& virtualURL() const = 0;
     virtual KURL virtualCompleteURL(const String&) const = 0;
 
-    virtual void addMessage(MessageSource, MessageType, MessageLevel, const String& message, const String& sourceURL, unsigned lineNumber, PassRefPtr<ScriptCallStack>) = 0;
+    virtual void addMessage(MessageSource, MessageType, MessageLevel, const String& message, const String& sourceURL, unsigned lineNumber, PassRefPtr<ScriptCallStack>, unsigned long requestIdentifier = 0) = 0;
     virtual EventTarget* errorEventTarget() = 0;
     virtual void logExceptionToConsole(const String& errorMessage, const String& sourceURL, int lineNumber, PassRefPtr<ScriptCallStack>) = 0;
     bool dispatchErrorEvent(const String& errorMessage, int lineNumber, const String& sourceURL);
diff --git a/Source/WebCore/dom/SelectorQuery.cpp b/Source/WebCore/dom/SelectorQuery.cpp
index 444930382..fa149c07a 100644
--- a/Source/WebCore/dom/SelectorQuery.cpp
+++ b/Source/WebCore/dom/SelectorQuery.cpp
@@ -180,7 +180,7 @@ SelectorQuery* SelectorQueryCache::add(const AtomicString& selectors, Document*
     CSSSelectorList selectorList;
     parser.parseSelector(selectors, selectorList);
 
-    if (!selectorList.first() || selectorList.hasUnknownPseudoElements()) {
+    if (!selectorList.first() || selectorList.hasInvalidSelector()) {
         ec = SYNTAX_ERR;
         return 0;
     }
diff --git a/Source/WebCore/dom/ShadowRoot.cpp b/Source/WebCore/dom/ShadowRoot.cpp
index 75192cded..c62396a36 100644
--- a/Source/WebCore/dom/ShadowRoot.cpp
+++ b/Source/WebCore/dom/ShadowRoot.cpp
@@ -55,8 +55,12 @@ ShadowRoot::ShadowRoot(Document* document)
     , m_next(0)
     , m_applyAuthorStyles(false)
     , m_resetStyleInheritance(false)
+    , m_registeredWithParentShadowRoot(false)
     , m_insertionPointAssignedTo(0)
     , m_numberOfShadowElementChildren(0)
+    , m_numberOfContentElementChildren(0)
+    , m_numberOfElementShadowChildren(0)
+    , m_numberOfStyles(0)
 {
     ASSERT(document);
     
@@ -127,9 +131,7 @@ PassRefPtr<ShadowRoot> ShadowRoot::create(Element* element, ShadowRootType type,
     }
 
     RefPtr<ShadowRoot> shadowRoot = adoptRef(new ShadowRoot(element->document()));
-#ifndef NDEBUG
-    shadowRoot->m_type = type;
-#endif
+    shadowRoot->setType(type);
 
     ec = 0;
     element->ensureShadow()->addShadowRoot(element, shadowRoot, type, ec);
@@ -197,12 +199,7 @@ ElementShadow* ShadowRoot::owner() const
 
 bool ShadowRoot::hasInsertionPoint() const
 {
-    for (Node* n = firstChild(); n; n = n->traverseNextNode(this)) {
-        if (isInsertionPoint(n))
-            return true;
-    }
-
-    return false;
+    return hasShadowInsertionPoint() || hasContentElement();
 }
 
 bool ShadowRoot::applyAuthorStyles() const
@@ -240,10 +237,70 @@ void ShadowRoot::attach()
     styleResolver->popParentShadowRoot(this);
 }
 
+Node::InsertionNotificationRequest ShadowRoot::insertedInto(ContainerNode* insertionPoint)
+{
+    DocumentFragment::insertedInto(insertionPoint);
+
+    if (!insertionPoint->inDocument() || !isOldest())
+        return InsertionDone;
+
+    // FIXME: When parsing <video controls>, insertedInto() is called many times without invoking removedFrom.
+    // For now, we check m_registeredWithParentShadowroot. We would like to ASSERT(!m_registeredShadowRoot) here.
+    // https://bugs.webkit.org/show_bug.cig?id=101316
+    if (m_registeredWithParentShadowRoot)
+        return InsertionDone;
+
+    if (ShadowRoot* root = host()->shadowRoot()) {
+        root->registerElementShadow();
+        m_registeredWithParentShadowRoot = true;
+    }
+
+    return InsertionDone;
+}
+
+void ShadowRoot::removedFrom(ContainerNode* insertionPoint)
+{
+    if (insertionPoint->inDocument() && m_registeredWithParentShadowRoot) {
+        ShadowRoot* root = host()->shadowRoot();
+        if (!root)
+            root = insertionPoint->shadowRoot();
+
+        if (root)
+            root->unregisterElementShadow();
+        m_registeredWithParentShadowRoot = false;
+    }
+
+    DocumentFragment::removedFrom(insertionPoint);
+}
+
 void ShadowRoot::childrenChanged(bool changedByParser, Node* beforeChange, Node* afterChange, int childCountDelta)
 {
     ContainerNode::childrenChanged(changedByParser, beforeChange, afterChange, childCountDelta);
     owner()->invalidateDistribution();
 }
 
+void ShadowRoot::registerScopedHTMLStyleChild()
+{
+    ++m_numberOfStyles;
+    setHasScopedHTMLStyleChild(true);
+}
+
+void ShadowRoot::unregisterScopedHTMLStyleChild()
+{
+    ASSERT(hasScopedHTMLStyleChild() && m_numberOfStyles > 0);
+    --m_numberOfStyles;
+    setHasScopedHTMLStyleChild(m_numberOfStyles > 0);
+}
+
+
+void ShadowRoot::reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
+{
+    MemoryClassInfo info(memoryObjectInfo, this, WebCoreMemoryTypes::DOM);
+    DocumentFragment::reportMemoryUsage(memoryObjectInfo);
+    TreeScope::reportMemoryUsage(memoryObjectInfo);
+    info.addMember(m_prev);
+    info.addMember(m_next);
+    info.addMember(m_insertionPointAssignedTo);
+}
+
 }
diff --git a/Source/WebCore/dom/ShadowRoot.h b/Source/WebCore/dom/ShadowRoot.h
index d57de8238..0675427ec 100644
--- a/Source/WebCore/dom/ShadowRoot.h
+++ b/Source/WebCore/dom/ShadowRoot.h
@@ -59,8 +59,6 @@ public:
 
     void recalcShadowTreeStyle(StyleChange);
 
-    InsertionPoint* insertionPointFor(Node*) const;
-
     virtual bool applyAuthorStyles() const OVERRIDE;
     void setApplyAuthorStyles(bool);
     virtual bool resetStyleInheritance() const OVERRIDE;
@@ -85,6 +83,9 @@ public:
 
     virtual void attach();
 
+    virtual InsertionNotificationRequest insertedInto(ContainerNode*) OVERRIDE;
+    virtual void removedFrom(ContainerNode*) OVERRIDE;
+
     bool isUsedForRendering() const;
     InsertionPoint* assignedTo() const;
     void setAssignedTo(InsertionPoint*);
@@ -93,12 +94,24 @@ public:
     void unregisterShadowElement() { --m_numberOfShadowElementChildren; }
     bool hasShadowInsertionPoint() const { return m_numberOfShadowElementChildren > 0; }
 
-#ifndef NDEBUG
-    ShadowRootType type() const { return m_type; }
-#endif
+    void registerContentElement() { ++m_numberOfContentElementChildren; }
+    void unregisterContentElement() { --m_numberOfContentElementChildren; }
+    bool hasContentElement() const { return m_numberOfContentElementChildren > 0; }
+
+    void registerElementShadow() { ++m_numberOfElementShadowChildren; }
+    void unregisterElementShadow() { ASSERT(hasElementShadow()); --m_numberOfElementShadowChildren; }
+    bool hasElementShadow() const { return m_numberOfElementShadowChildren > 0; }
+    size_t countElementShadow() const { return m_numberOfElementShadowChildren; }
+
+    virtual void registerScopedHTMLStyleChild() OVERRIDE;
+    virtual void unregisterScopedHTMLStyleChild() OVERRIDE;
+
+    ShadowRootType type() const { return m_isAuthorShadowRoot ? AuthorShadowRoot : UserAgentShadowRoot; }
 
     PassRefPtr<Node> cloneNode(bool, ExceptionCode&);
 
+    virtual void reportMemoryUsage(MemoryObjectInfo*) const OVERRIDE;
+
 private:
     explicit ShadowRoot(Document*);
     virtual ~ShadowRoot();
@@ -107,16 +120,19 @@ private:
     virtual bool childTypeAllowed(NodeType) const;
     virtual void childrenChanged(bool changedByParser, Node* beforeChange, Node* afterChange, int childCountDelta) OVERRIDE;
 
+    void setType(ShadowRootType type) { m_isAuthorShadowRoot = type == AuthorShadowRoot; }
+
     ShadowRoot* m_prev;
     ShadowRoot* m_next;
     bool m_applyAuthorStyles : 1;
     bool m_resetStyleInheritance : 1;
+    bool m_isAuthorShadowRoot : 1;
+    bool m_registeredWithParentShadowRoot : 1;
     InsertionPoint* m_insertionPointAssignedTo;
     size_t m_numberOfShadowElementChildren;
-
-#ifndef NDEBUG
-    ShadowRootType m_type;
-#endif
+    size_t m_numberOfContentElementChildren;
+    size_t m_numberOfElementShadowChildren;
+    size_t m_numberOfStyles;
 };
 
 inline Element* ShadowRoot::host() const
diff --git a/Source/WebCore/dom/SpaceSplitString.cpp b/Source/WebCore/dom/SpaceSplitString.cpp
index 995bdb7ed..42cc6ca9c 100644
--- a/Source/WebCore/dom/SpaceSplitString.cpp
+++ b/Source/WebCore/dom/SpaceSplitString.cpp
@@ -107,36 +107,43 @@ bool SpaceSplitStringData::containsAll(SpaceSplitStringData& other)
 void SpaceSplitStringData::add(const AtomicString& string)
 {
     ASSERT(hasOneRef());
-    if (contains(string))
-        return;
-
+    ASSERT(!contains(string));
     m_vector.append(string);
 }
 
-void SpaceSplitStringData::remove(const AtomicString& string)
+void SpaceSplitStringData::remove(unsigned index)
 {
     ASSERT(hasOneRef());
-    size_t position = 0;
-    while (position < m_vector.size()) {
-        if (m_vector[position] == string)
-            m_vector.remove(position);
-        else
-            ++position;
-    }
+    m_vector.remove(index);
 }
 
 void SpaceSplitString::add(const AtomicString& string)
 {
+    // FIXME: add() does not allow duplicates but createVector() does.
+    if (contains(string))
+        return;
     ensureUnique();
     if (m_data)
         m_data->add(string);
 }
 
-void SpaceSplitString::remove(const AtomicString& string)
+bool SpaceSplitString::remove(const AtomicString& string)
 {
-    ensureUnique();
-    if (m_data)
-        m_data->remove(string);
+    if (!m_data)
+        return false;
+    unsigned i = 0;
+    bool changed = false;
+    while (i < m_data->size()) {
+        if ((*m_data)[i] == string) {
+            if (!changed)
+                ensureUnique();
+            m_data->remove(i);
+            changed = true;
+            continue;
+        }
+        ++i;
+    }
+    return changed;
 }
 
 typedef HashMap<AtomicString, SpaceSplitStringData*> SpaceSplitStringDataMap;
diff --git a/Source/WebCore/dom/SpaceSplitString.h b/Source/WebCore/dom/SpaceSplitString.h
index 52f2272f6..3df9ef64f 100644
--- a/Source/WebCore/dom/SpaceSplitString.h
+++ b/Source/WebCore/dom/SpaceSplitString.h
@@ -47,7 +47,7 @@ namespace WebCore {
         bool containsAll(SpaceSplitStringData&);
 
         void add(const AtomicString&);
-        void remove(const AtomicString&);
+        void remove(unsigned index);
 
         bool isUnique() const { return m_keyString.isNull(); } 
         size_t size() const { return m_vector.size(); }
@@ -76,7 +76,7 @@ namespace WebCore {
         bool contains(const AtomicString& string) const { return m_data && m_data->contains(string); }
         bool containsAll(const SpaceSplitString& names) const { return !names.m_data || (m_data && m_data->containsAll(*names.m_data)); }
         void add(const AtomicString&);
-        void remove(const AtomicString&);
+        bool remove(const AtomicString&);
 
         size_t size() const { return m_data ? m_data->size() : 0; }
         bool isNull() const { return !m_data; }
diff --git a/Source/WebCore/dom/StyledElement.cpp b/Source/WebCore/dom/StyledElement.cpp
index 576aa2284..c4c86ecfd 100644
--- a/Source/WebCore/dom/StyledElement.cpp
+++ b/Source/WebCore/dom/StyledElement.cpp
@@ -221,6 +221,17 @@ bool StyledElement::removeInlineStyleProperty(CSSPropertyID propertyID)
     return changes;
 }
 
+void StyledElement::removeAllInlineStyleProperties()
+{
+    if (!attributeData() || !attributeData()->inlineStyle())
+        return;
+    StylePropertySet* inlineStylePropertySet = ensureInlineStyle();
+    if (inlineStylePropertySet->isEmpty())
+        return;
+    inlineStylePropertySet->clear();
+    inlineStyleChanged();
+}
+
 void StyledElement::addSubresourceAttributeURLs(ListHashSet<KURL>& urls) const
 {
     if (const StylePropertySet* inlineStyle = attributeData() ? attributeData()->inlineStyle() : 0)
diff --git a/Source/WebCore/dom/StyledElement.h b/Source/WebCore/dom/StyledElement.h
index cf59ed1ad..a5d3083f3 100644
--- a/Source/WebCore/dom/StyledElement.h
+++ b/Source/WebCore/dom/StyledElement.h
@@ -48,6 +48,7 @@ public:
     bool setInlineStyleProperty(CSSPropertyID, double value, CSSPrimitiveValue::UnitTypes, bool important = false);
     bool setInlineStyleProperty(CSSPropertyID, const String& value, bool important = false);
     bool removeInlineStyleProperty(CSSPropertyID);
+    void removeAllInlineStyleProperties();
     
     virtual CSSStyleDeclaration* style() OVERRIDE;
 
diff --git a/Source/WebCore/dom/Text.cpp b/Source/WebCore/dom/Text.cpp
index 7525542f6..3fd0f15ea 100644
--- a/Source/WebCore/dom/Text.cpp
+++ b/Source/WebCore/dom/Text.cpp
@@ -256,14 +256,17 @@ void Text::recalcTextStyle(StyleChange change)
     if (hasCustomCallbacks())
         willRecalcTextStyle(change);
 
-    if (change != NoChange && parentNode() && parentNode()->renderer()) {
-        if (renderer())
-            renderer()->setStyle(parentNode()->renderer()->style());
-    }
+    RenderObject* renderer = this->renderer();
+
+    // The only time we have a renderer and our parent doesn't is if our parent
+    // is a shadow root.
+    if (change != NoChange && renderer && !parentNode()->isShadowRoot())
+        renderer->setStyle(parentNode()->renderer()->style());
+
     if (needsStyleRecalc()) {
-        if (renderer()) {
-            if (renderer()->isText())
-                toRenderText(renderer())->setText(dataImpl());
+        if (renderer) {
+            if (renderer->isText())
+                toRenderText(renderer)->setText(dataImpl());
         } else
             reattach();
     }
diff --git a/Source/WebCore/dom/TreeScope.cpp b/Source/WebCore/dom/TreeScope.cpp
index ec723d3da..996dfd7a3 100644
--- a/Source/WebCore/dom/TreeScope.cpp
+++ b/Source/WebCore/dom/TreeScope.cpp
@@ -28,6 +28,7 @@
 
 #include "ComposedShadowTreeWalker.h"
 #include "ContainerNode.h"
+#include "ContextFeatures.h"
 #include "DOMSelection.h"
 #include "DOMWindow.h"
 #include "Document.h"
@@ -42,7 +43,6 @@
 #include "IdTargetObserverRegistry.h"
 #include "InsertionPoint.h"
 #include "Page.h"
-#include "RuntimeEnabledFeatures.h"
 #include "ShadowRoot.h"
 #include "TreeScopeAdopter.h"
 #include <wtf/Vector.h>
@@ -189,7 +189,7 @@ DOMSelection* TreeScope::getSelection() const
     // as a container. It is now enabled only if runtime Shadow DOM feature is enabled.
     // See https://bugs.webkit.org/show_bug.cgi?id=82697
 #if ENABLE(SHADOW_DOM)
-    if (RuntimeEnabledFeatures::shadowDOMEnabled()) {
+    if (ContextFeatures::shadowDOMEnabled(rootNode()->document())) {
         m_selection = DOMSelection::create(this);
         return m_selection.get();
     }
@@ -280,6 +280,18 @@ Node* TreeScope::focusedNode()
     return 0;
 }
 
+void TreeScope::reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
+{
+    MemoryClassInfo info(memoryObjectInfo, this, WebCoreMemoryTypes::DOM);
+    info.addMember(m_rootNode);
+    info.addMember(m_parentTreeScope);
+    info.addMember(m_elementsById);
+    info.addMember(m_imageMapsByName);
+    info.addMember(m_labelsByForAttribute);
+    info.addMember(m_idTargetObserverRegistry);
+    info.addMember(m_selection);
+}
+
 static void listTreeScopes(Node* node, Vector<TreeScope*, 5>& treeScopes)
 {
     while (true) {
diff --git a/Source/WebCore/dom/TreeScope.h b/Source/WebCore/dom/TreeScope.h
index 9cae54de8..4a034a2d1 100644
--- a/Source/WebCore/dom/TreeScope.h
+++ b/Source/WebCore/dom/TreeScope.h
@@ -88,6 +88,8 @@ public:
 
     IdTargetObserverRegistry& idTargetObserverRegistry() const { return *m_idTargetObserverRegistry.get(); }
 
+    virtual void reportMemoryUsage(MemoryObjectInfo*) const;
+
 protected:
     explicit TreeScope(ContainerNode*);
     virtual ~TreeScope();
diff --git a/Source/WebCore/dom/ViewportArguments.cpp b/Source/WebCore/dom/ViewportArguments.cpp
index 0151294cc..ae1878919 100644
--- a/Source/WebCore/dom/ViewportArguments.cpp
+++ b/Source/WebCore/dom/ViewportArguments.cpp
@@ -61,9 +61,6 @@ ViewportAttributes computeViewportAttributes(ViewportArguments args, int desktop
     }
 
     switch (int(args.width)) {
-    case ViewportArguments::ValueDesktopWidth:
-        args.width = desktopWidth;
-        break;
     case ViewportArguments::ValueDeviceWidth:
         args.width = deviceWidth;
         break;
@@ -73,9 +70,6 @@ ViewportAttributes computeViewportAttributes(ViewportArguments args, int desktop
     }
 
     switch (int(args.height)) {
-    case ViewportArguments::ValueDesktopWidth:
-        args.height = desktopWidth;
-        break;
     case ViewportArguments::ValueDeviceWidth:
         args.height = deviceWidth;
         break;
@@ -90,6 +84,8 @@ ViewportAttributes computeViewportAttributes(ViewportArguments args, int desktop
     if (args.height != ViewportArguments::ValueAuto)
         args.height = min(float(10000), max(args.height, float(1)));
 
+    result.initiallyFitToViewport = args.initialScale == ViewportArguments::ValueAuto;
+
     if (args.initialScale != ViewportArguments::ValueAuto)
         args.initialScale = min(float(10), max(args.initialScale, float(0.1)));
     if (args.minimumScale != ViewportArguments::ValueAuto)
@@ -216,8 +212,6 @@ static float findSizeValue(const String& keyString, const String& valueString, D
     // 3) device-width and device-height are used as keywords.
     // 4) Other keywords and unknown values translate to 0.0.
 
-    if (equalIgnoringCase(valueString, "desktop-width"))
-        return ViewportArguments::ValueDesktopWidth;
     if (equalIgnoringCase(valueString, "device-width"))
         return ViewportArguments::ValueDeviceWidth;
     if (equalIgnoringCase(valueString, "device-height"))
@@ -243,8 +237,6 @@ static float findScaleValue(const String& keyString, const String& valueString,
         return 1;
     if (equalIgnoringCase(valueString, "no"))
         return 0;
-    if (equalIgnoringCase(valueString, "desktop-width"))
-        return 10;
     if (equalIgnoringCase(valueString, "device-width"))
         return 10;
     if (equalIgnoringCase(valueString, "device-height"))
@@ -271,8 +263,6 @@ static float findUserScalableValue(const String& keyString, const String& valueS
         return 1;
     if (equalIgnoringCase(valueString, "no"))
         return 0;
-    if (equalIgnoringCase(valueString, "desktop-width"))
-        return 1;
     if (equalIgnoringCase(valueString, "device-width"))
         return 1;
     if (equalIgnoringCase(valueString, "device-height"))
diff --git a/Source/WebCore/dom/ViewportArguments.h b/Source/WebCore/dom/ViewportArguments.h
index fc0d125f0..32139eea8 100644
--- a/Source/WebCore/dom/ViewportArguments.h
+++ b/Source/WebCore/dom/ViewportArguments.h
@@ -50,6 +50,7 @@ struct ViewportAttributes {
     float maximumScale;
 
     float userScalable;
+    bool initiallyFitToViewport;
 };
 
 struct ViewportArguments {
@@ -67,9 +68,8 @@ struct ViewportArguments {
 
     enum {
         ValueAuto = -1,
-        ValueDesktopWidth = -2,
-        ValueDeviceWidth = -3,
-        ValueDeviceHeight = -4,
+        ValueDeviceWidth = -2,
+        ValueDeviceHeight = -3,
     };
 
     ViewportArguments(Type type = Implicit)
diff --git a/Source/WebCore/dom/WebCoreMemoryInstrumentation.cpp b/Source/WebCore/dom/WebCoreMemoryInstrumentation.cpp
index c5cbbcdb4..71410a14e 100644
--- a/Source/WebCore/dom/WebCoreMemoryInstrumentation.cpp
+++ b/Source/WebCore/dom/WebCoreMemoryInstrumentation.cpp
@@ -59,6 +59,8 @@ MemoryObjectType WebCoreMemoryTypes::InspectorDOMStorageAgent = "WebInspector.DO
 MemoryObjectType WebCoreMemoryTypes::InspectorDOMStorageResources = "WebInspector.DOMStorageAgent.Resources";
 MemoryObjectType WebCoreMemoryTypes::InspectorOverlay = "WebInspector.Overlay";
 MemoryObjectType WebCoreMemoryTypes::InspectorProfilerAgent = "WebInspector.ProfilerAgent";
+MemoryObjectType WebCoreMemoryTypes::InspectorDebuggerAgent = "WebInspector.DebuggerAgent";
+MemoryObjectType WebCoreMemoryTypes::InspectorResourceAgent = "WebInspector.ResourceAgent";
 
 MemoryObjectType WebCoreMemoryTypes::JSHeapUsed = "JSHeap.Used";
 MemoryObjectType WebCoreMemoryTypes::JSHeapUnused = "JSHeap.Unused";
diff --git a/Source/WebCore/dom/WebCoreMemoryInstrumentation.h b/Source/WebCore/dom/WebCoreMemoryInstrumentation.h
index 08abbe975..7479e0534 100644
--- a/Source/WebCore/dom/WebCoreMemoryInstrumentation.h
+++ b/Source/WebCore/dom/WebCoreMemoryInstrumentation.h
@@ -67,6 +67,8 @@ public:
     static MemoryObjectType InspectorDOMStorageResources;
     static MemoryObjectType InspectorOverlay;
     static MemoryObjectType InspectorProfilerAgent;
+    static MemoryObjectType InspectorDebuggerAgent;
+    static MemoryObjectType InspectorResourceAgent;
 
     static MemoryObjectType JSHeapUsed;
     static MemoryObjectType JSHeapUnused;
diff --git a/Source/WebCore/dom/WebKitNamedFlow.cpp b/Source/WebCore/dom/WebKitNamedFlow.cpp
index 593e51a6c..b9debd9dd 100644
--- a/Source/WebCore/dom/WebKitNamedFlow.cpp
+++ b/Source/WebCore/dom/WebKitNamedFlow.cpp
@@ -198,7 +198,7 @@ void WebKitNamedFlow::dispatchRegionLayoutUpdateEvent()
     ASSERT(!NoEventDispatchAssertion::isEventDispatchForbidden());
     ASSERT(m_parentFlowThread);
 
-    RefPtr<Event> event = UIEvent::create(eventNames().webkitRegionLayoutUpdateEvent, false, false, m_parentFlowThread->document()->defaultView(), 0);
+    RefPtr<Event> event = UIEvent::create(eventNames().webkitregionlayoutupdateEvent, false, false, m_parentFlowThread->document()->defaultView(), 0);
 
     dispatchEvent(event);
 }
diff --git a/Source/WebCore/editing/ApplyStyleCommand.cpp b/Source/WebCore/editing/ApplyStyleCommand.cpp
index 98b00dd12..943f6b2ee 100644
--- a/Source/WebCore/editing/ApplyStyleCommand.cpp
+++ b/Source/WebCore/editing/ApplyStyleCommand.cpp
@@ -28,7 +28,6 @@
 
 #include "CSSComputedStyleDeclaration.h"
 #include "CSSParser.h"
-#include "CSSProperty.h"
 #include "CSSPropertyNames.h"
 #include "CSSValueKeywords.h"
 #include "CSSValuePool.h"
@@ -826,7 +825,7 @@ bool ApplyStyleCommand::removeInlineStyleFromElement(EditingStyle* style, PassRe
 {
     ASSERT(element);
 
-    if (!element->parentNode() || !element->parentNode()->isContentEditable())
+    if (!element->parentNode() || !element->parentNode()->isContentEditable(Node::UserSelectAllIsAlwaysNonEditable))
         return false;
 
     if (isStyledInlineElementToRemove(element.get())) {
@@ -1289,7 +1288,7 @@ void ApplyStyleCommand::surroundNodeRangeWithElement(PassRefPtr<Node> passedStar
     RefPtr<Node> node = startNode;
     while (node) {
         RefPtr<Node> next = node->nextSibling();
-        if (node->isContentEditable()) {
+        if (node->isContentEditable(Node::UserSelectAllIsAlwaysNonEditable)) {
             removeNode(node);
             appendNode(node, element);
         }
diff --git a/Source/WebCore/editing/CompositeEditCommand.h b/Source/WebCore/editing/CompositeEditCommand.h
index e5baea641..519dabc71 100644
--- a/Source/WebCore/editing/CompositeEditCommand.h
+++ b/Source/WebCore/editing/CompositeEditCommand.h
@@ -45,9 +45,6 @@ public:
     virtual void unapply() OVERRIDE;
     virtual void reapply() OVERRIDE;
     EditAction editingAction() const OVERRIDE { return m_editAction; }
-#if ENABLE(UNDO_MANAGER)
-    virtual bool isDOMTransaction() const OVERRIDE { return false; }
-#endif
     void append(SimpleEditCommand*);
     bool wasCreateLinkCommand() const { return m_editAction == EditActionCreateLink; }
 
diff --git a/Source/WebCore/editing/DOMTransactionStep.cpp b/Source/WebCore/editing/DOMTransactionStep.cpp
deleted file mode 100644
index 3fb83028b..000000000
--- a/Source/WebCore/editing/DOMTransactionStep.cpp
+++ /dev/null
@@ -1,168 +0,0 @@
-/*
- * Copyright (C) 2012 Google Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1.  Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- * 2.  Redistributions in binary form must reproduce the above copyright
- * notice, this list of conditions and the following disclaimer in the
- * documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY GOOGLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
- * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
- * DISCLAIMED. IN NO EVENT SHALL GOOGLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
- * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
- * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
- * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
- * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "config.h"
-
-#if ENABLE(UNDO_MANAGER)
-
-#include "DOMTransactionStep.h"
-
-#include "CharacterData.h"
-#include "ContainerNode.h"
-#include "Element.h"
-#include "ExceptionCode.h"
-#include "Node.h"
-
-namespace WebCore {
-
-NodeInsertingDOMTransactionStep::NodeInsertingDOMTransactionStep(Node* node, Node* child)
-    : m_node(node)
-    , m_refChild(child->nextSibling())
-    , m_child(child)
-{
-}
-
-PassRefPtr<NodeInsertingDOMTransactionStep> NodeInsertingDOMTransactionStep::create(Node* node, Node* child)
-{
-    return adoptRef(new NodeInsertingDOMTransactionStep(node, child));
-}
-
-void NodeInsertingDOMTransactionStep::unapply()
-{
-    if (m_child && m_child->parentNode() != m_node.get())
-        return;
-    if (m_refChild && m_refChild->parentNode() != m_node.get())
-        return;
-    if (m_refChild && m_refChild->previousSibling() != m_child.get())
-        return;
-    
-    ExceptionCode ec;
-    m_node->removeChild(m_child.get(), ec);
-}
-
-void NodeInsertingDOMTransactionStep::reapply()
-{
-    if (m_child && m_child->parentNode())
-        return;
-    if (m_refChild && m_refChild->parentNode() != m_node.get())
-        return;
-    
-    ExceptionCode ec;
-    m_node->insertBefore(m_child, m_refChild.get(), ec);
-}
-
-NodeRemovingDOMTransactionStep::NodeRemovingDOMTransactionStep(Node* node, Node* child)
-    : m_node(node)
-    , m_refChild(child->nextSibling())
-    , m_child(child)
-{
-}
-
-PassRefPtr<NodeRemovingDOMTransactionStep> NodeRemovingDOMTransactionStep::create(Node* node, Node* child)
-{
-    return adoptRef(new NodeRemovingDOMTransactionStep(node, child));
-}
-
-void NodeRemovingDOMTransactionStep::unapply()
-{
-    if (m_child && m_child->parentNode())
-        return;
-    if (m_refChild && m_refChild->parentNode() != m_node.get())
-        return;
-
-    ExceptionCode ec;
-    m_node->insertBefore(m_child, m_refChild.get(), ec);
-}
-
-void NodeRemovingDOMTransactionStep::reapply()
-{
-    if (m_child && m_child->parentNode() != m_node.get())
-        return;
-    if (m_refChild && m_refChild->parentNode() != m_node.get())
-        return;
-    if (m_refChild && m_refChild->previousSibling() != m_child.get())
-        return;
-    
-    ExceptionCode ec;
-    m_node->removeChild(m_child.get(), ec);
-}
-
-DataReplacingDOMTransactionStep::DataReplacingDOMTransactionStep(CharacterData* node, unsigned offset, unsigned count, const String& data, const String& replacedData)
-    : m_node(node)
-    , m_offset(offset)
-    , m_count(count)
-    , m_data(data)
-    , m_replacedData(replacedData)
-{
-}
-
-PassRefPtr<DataReplacingDOMTransactionStep> DataReplacingDOMTransactionStep::create(CharacterData* node, unsigned offset, unsigned count, const String& data, const String& replacedData)
-{
-    return adoptRef(new DataReplacingDOMTransactionStep(node, offset, count, data, replacedData));
-}
-
-void DataReplacingDOMTransactionStep::unapply()
-{
-    if (m_node->length() < m_offset)
-        return;
-    
-    ExceptionCode ec;
-    m_node->replaceData(m_offset, m_data.length(), m_replacedData, ec);
-}
-
-void DataReplacingDOMTransactionStep::reapply()
-{
-    if (m_node->length() < m_offset)
-        return;
-    
-    ExceptionCode ec;
-    m_node->replaceData(m_offset, m_count, m_data, ec);
-}
-
-AttrChangingDOMTransactionStep::AttrChangingDOMTransactionStep(Element* element, const QualifiedName& name, const AtomicString& oldValue, const AtomicString& newValue)
-    : m_element(element)
-    , m_name(name)
-    , m_oldValue(oldValue)
-    , m_newValue(newValue)
-{
-}
-
-PassRefPtr<AttrChangingDOMTransactionStep> AttrChangingDOMTransactionStep::create(Element* element, const QualifiedName& name, const AtomicString& oldValue, const AtomicString& newValue)
-{
-    return adoptRef(new AttrChangingDOMTransactionStep(element, name, oldValue, newValue));
-}
-
-void AttrChangingDOMTransactionStep::unapply()
-{
-    m_element->setAttribute(m_name, m_oldValue);
-}
-
-void AttrChangingDOMTransactionStep::reapply()
-{
-    m_element->setAttribute(m_name, m_newValue);
-}
-
-}
-
-#endif
diff --git a/Source/WebCore/editing/DOMTransactionStep.h b/Source/WebCore/editing/DOMTransactionStep.h
deleted file mode 100644
index e7d55d96a..000000000
--- a/Source/WebCore/editing/DOMTransactionStep.h
+++ /dev/null
@@ -1,113 +0,0 @@
-/*
- * Copyright (C) 2012 Google Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1.  Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- * 2.  Redistributions in binary form must reproduce the above copyright
- * notice, this list of conditions and the following disclaimer in the
- * documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY GOOGLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
- * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
- * DISCLAIMED. IN NO EVENT SHALL GOOGLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
- * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
- * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
- * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
- * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#ifndef DOMTransactionStep_h
-#define DOMTransactionStep_h
-
-#if ENABLE(UNDO_MANAGER)
-
-#include "QualifiedName.h"
-#include <wtf/PassRefPtr.h>
-#include <wtf/RefCounted.h>
-#include <wtf/RefPtr.h>
-#include <wtf/text/WTFString.h>
-
-namespace WebCore {
-
-class CharacterData;
-class Element;
-class Node;
-
-class DOMTransactionStep : public RefCounted<DOMTransactionStep> {
-public:
-    virtual ~DOMTransactionStep() { }
-
-    virtual void unapply() = 0;
-    virtual void reapply() = 0;
-};
-
-class NodeInsertingDOMTransactionStep : public DOMTransactionStep {
-public:
-    static PassRefPtr<NodeInsertingDOMTransactionStep> create(Node*, Node* child);
-    virtual void unapply() OVERRIDE;
-    virtual void reapply() OVERRIDE;
-
-private:
-    NodeInsertingDOMTransactionStep(Node*, Node* child);
-    
-    RefPtr<Node> m_node;
-    RefPtr<Node> m_refChild;
-    RefPtr<Node> m_child;
-};
-
-class NodeRemovingDOMTransactionStep : public DOMTransactionStep {
-public:
-    static PassRefPtr<NodeRemovingDOMTransactionStep> create(Node*, Node* child);
-    virtual void unapply() OVERRIDE;
-    virtual void reapply() OVERRIDE;
-    
-private:
-    NodeRemovingDOMTransactionStep(Node*, Node* child);
-    
-    RefPtr<Node> m_node;
-    RefPtr<Node> m_refChild;
-    RefPtr<Node> m_child;
-};
-
-class DataReplacingDOMTransactionStep : public DOMTransactionStep {
-public:
-    static PassRefPtr<DataReplacingDOMTransactionStep> create(CharacterData*, unsigned offset, unsigned count, const String& data, const String& replacedData);
-    virtual void unapply() OVERRIDE;
-    virtual void reapply() OVERRIDE;
-    
-private:
-    DataReplacingDOMTransactionStep(CharacterData*, unsigned offset, unsigned count, const String& data, const String& replacedData);
-    
-    RefPtr<CharacterData> m_node;
-    unsigned m_offset;
-    unsigned m_count;
-    String m_data;
-    String m_replacedData;
-};
-
-class AttrChangingDOMTransactionStep : public DOMTransactionStep {
-public:
-    static PassRefPtr<AttrChangingDOMTransactionStep> create(Element*, const QualifiedName&, const AtomicString& oldValue, const AtomicString& newValue);
-    virtual void unapply() OVERRIDE;
-    virtual void reapply() OVERRIDE;
-    
-private:
-    AttrChangingDOMTransactionStep(Element*, const QualifiedName&, const AtomicString& oldValue, const AtomicString& newValue);
-    
-    RefPtr<Element> m_element;
-    QualifiedName m_name;
-    AtomicString m_oldValue;
-    AtomicString m_newValue;
-};
-
-}
-
-#endif
-
-#endif
diff --git a/Source/WebCore/editing/DeleteFromTextNodeCommand.cpp b/Source/WebCore/editing/DeleteFromTextNodeCommand.cpp
index 5708c86ac..25444ac31 100644
--- a/Source/WebCore/editing/DeleteFromTextNodeCommand.cpp
+++ b/Source/WebCore/editing/DeleteFromTextNodeCommand.cpp
@@ -47,7 +47,7 @@ void DeleteFromTextNodeCommand::doApply()
 {
     ASSERT(m_node);
 
-    if (!m_node->isContentEditable())
+    if (!m_node->isContentEditable(Node::UserSelectAllIsAlwaysNonEditable))
         return;
 
     ExceptionCode ec = 0;
diff --git a/Source/WebCore/editing/EditingStyle.cpp b/Source/WebCore/editing/EditingStyle.cpp
index f01a5136f..9629f662f 100644
--- a/Source/WebCore/editing/EditingStyle.cpp
+++ b/Source/WebCore/editing/EditingStyle.cpp
@@ -1058,7 +1058,7 @@ void EditingStyle::mergeStyle(const StylePropertySet* style, CSSPropertyOverride
 
     unsigned propertyCount = style->propertyCount();
     for (unsigned i = 0; i < propertyCount; ++i) {
-        const CSSProperty& property = style->propertyAt(i);
+        StylePropertySet::PropertyReference property = style->propertyAt(i);
         RefPtr<CSSValue> value = m_mutableStyle->getPropertyCSSValue(property.id());
 
         // text decorations never override values
@@ -1114,7 +1114,7 @@ void EditingStyle::mergeStyleFromRulesForSerialization(StyledElement* element)
     {
         unsigned propertyCount = m_mutableStyle->propertyCount();
         for (unsigned i = 0; i < propertyCount; ++i) {
-            const CSSProperty& property = m_mutableStyle->propertyAt(i);
+            StylePropertySet::PropertyReference property = m_mutableStyle->propertyAt(i);
             CSSValue* value = property.value();
             if (!value->isPrimitiveValue())
                 continue;
@@ -1427,7 +1427,7 @@ void StyleChange::extractTextStyles(Document* document, StylePropertySet* style,
 
     m_applyFontFace = style->getPropertyValue(CSSPropertyFontFamily);
     // Remove single quotes for Outlook 2007 compatibility. See https://bugs.webkit.org/show_bug.cgi?id=79448
-    m_applyFontFace.replace('\'', "");
+    m_applyFontFace.replaceWithLiteral('\'', "");
     style->removeProperty(CSSPropertyFontFamily);
 
     if (RefPtr<CSSValue> fontSize = style->getPropertyCSSValue(CSSPropertyFontSize)) {
diff --git a/Source/WebCore/editing/Editor.cpp b/Source/WebCore/editing/Editor.cpp
index 499c5fd81..aadc273c4 100644
--- a/Source/WebCore/editing/Editor.cpp
+++ b/Source/WebCore/editing/Editor.cpp
@@ -31,7 +31,6 @@
 #include "AlternativeTextController.h"
 #include "ApplyStyleCommand.h"
 #include "CSSComputedStyleDeclaration.h"
-#include "CSSProperty.h"
 #include "CSSPropertyNames.h"
 #include "CSSValueKeywords.h"
 #include "CachedResourceLoader.h"
@@ -86,7 +85,6 @@
 #include "TextEvent.h"
 #include "TextIterator.h"
 #include "TypingCommand.h"
-#include "UndoManager.h"
 #include "UserTypingGestureIndicator.h"
 #include "htmlediting.h"
 #include "markup.h"
@@ -803,12 +801,8 @@ void Editor::appliedEditing(PassRefPtr<CompositeEditCommand> cmd)
         // Only register a new undo command if the command passed in is
         // different from the last command
         m_lastEditCommand = cmd;
-#if !ENABLE(UNDO_MANAGER)
         if (client())
             client()->registerUndoStep(m_lastEditCommand->ensureComposition());
-#else
-        m_frame->document()->undoManager()->registerUndoStep(m_lastEditCommand->ensureComposition());
-#endif
     }
 
     respondToChangedContents(newSelection);
@@ -825,12 +819,8 @@ void Editor::unappliedEditing(PassRefPtr<EditCommandComposition> cmd)
     m_alternativeTextController->respondToUnappliedEditing(cmd.get());
     
     m_lastEditCommand = 0;
-#if !ENABLE(UNDO_MANAGER)
     if (client())
         client()->registerRedoStep(cmd);
-#else
-    m_frame->document()->undoManager()->registerRedoStep(cmd);
-#endif
     respondToChangedContents(newSelection);
 }
 
@@ -844,12 +834,8 @@ void Editor::reappliedEditing(PassRefPtr<EditCommandComposition> cmd)
     changeSelectionAfterCommand(newSelection, FrameSelection::CloseTyping | FrameSelection::ClearTypingStyle);
     
     m_lastEditCommand = 0;
-#if !ENABLE(UNDO_MANAGER)
     if (client())
         client()->registerUndoStep(cmd);
-#else
-    m_frame->document()->undoManager()->registerUndoStep(cmd);
-#endif
     respondToChangedContents(newSelection);
 }
 
@@ -1257,40 +1243,24 @@ void Editor::clearUndoRedoOperations()
 
 bool Editor::canUndo()
 {
-#if !ENABLE(UNDO_MANAGER)
     return client() && client()->canUndo();
-#else
-    return m_frame->document()->undoManager()->canUndo();
-#endif
 }
 
 void Editor::undo()
 {
-#if !ENABLE(UNDO_MANAGER)
     if (client())
         client()->undo();
-#else
-    m_frame->document()->undoManager()->undo();
-#endif
 }
 
 bool Editor::canRedo()
 {
-#if !ENABLE(UNDO_MANAGER)
     return client() && client()->canRedo();
-#else
-    return m_frame->document()->undoManager()->canRedo();
-#endif
 }
 
 void Editor::redo()
 {
-#if !ENABLE(UNDO_MANAGER)
     if (client())
         client()->redo();
-#else
-    m_frame->document()->undoManager()->redo();
-#endif
 }
 
 void Editor::didBeginEditing()
@@ -2150,11 +2120,15 @@ void Editor::markAndReplaceFor(PassRefPtr<SpellCheckRequest> request, const Vect
                 if (canEditRichly())
                     applyCommand(CreateLinkCommand::create(m_frame->document(), result->replacement));
             } else if (canEdit() && shouldInsertText(result->replacement, rangeToReplace.get(), EditorInsertActionTyped)) {
-                int paragraphStartIndex = TextIterator::rangeLength(Range::create(m_frame->document(), m_frame->document(), 0, paragraph.paragraphRange()->startContainer(), paragraph.paragraphRange()->startOffset()).get());
+                Node* root = paragraph.paragraphRange()->startContainer();
+                while (ContainerNode* parent = root->parentNode())
+                    root = parent;
+
+                int paragraphStartIndex = TextIterator::rangeLength(Range::create(m_frame->document(), root, 0, paragraph.paragraphRange()->startContainer(), paragraph.paragraphRange()->startOffset()).get());
                 int paragraphLength = TextIterator::rangeLength(paragraph.paragraphRange().get());
                 applyCommand(SpellingCorrectionCommand::create(rangeToReplace, result->replacement));
                 // Recalculate newParagraphRange, since SpellingCorrectionCommand modifies the DOM, such that the original paragraph range is no longer valid. Radar: 10305315 Bugzilla: 89526
-                RefPtr<Range> newParagraphRange = TextIterator::rangeFromLocationAndLength(m_frame->document(), paragraphStartIndex, paragraphLength+replacementLength-resultLength);
+                RefPtr<Range> newParagraphRange = TextIterator::rangeFromLocationAndLength(toContainerNode(root), paragraphStartIndex, paragraphLength + replacementLength - resultLength);
                 paragraph = TextCheckingParagraph(TextIterator::subrange(newParagraphRange.get(), resultLocation, replacementLength), newParagraphRange);
                 
                 if (AXObjectCache::accessibilityEnabled()) {
diff --git a/Source/WebCore/editing/FrameSelection.cpp b/Source/WebCore/editing/FrameSelection.cpp
index f0e249a8d..563a06686 100644
--- a/Source/WebCore/editing/FrameSelection.cpp
+++ b/Source/WebCore/editing/FrameSelection.cpp
@@ -556,6 +556,14 @@ VisiblePosition FrameSelection::endForPlatform() const
     return positionForPlatform(false);
 }
 
+#if ENABLE(USERSELECT_ALL)
+static void adjustPositionForUserSelectAll(VisiblePosition& pos, bool isForward)
+{
+    if (Node* rootUserSelectAll = Position::rootUserSelectAllForNode(pos.deepEquivalent().anchorNode()))
+        pos = isForward ? positionAfterNode(rootUserSelectAll).downstream(CanCrossEditingBoundary) : positionBeforeNode(rootUserSelectAll).upstream(CanCrossEditingBoundary);
+}
+#endif
+
 VisiblePosition FrameSelection::modifyExtendingRight(TextGranularity granularity)
 {
     VisiblePosition pos(m_selection.extent(), m_selection.affinity());
@@ -594,6 +602,9 @@ VisiblePosition FrameSelection::modifyExtendingRight(TextGranularity granularity
         pos = modifyExtendingForward(granularity);
         break;
     }
+#if ENABLE(USERSELECT_ALL)
+    adjustPositionForUserSelectAll(pos, directionOfEnclosingBlock() == LTR);
+#endif
     return pos;
 }
 
@@ -633,7 +644,9 @@ VisiblePosition FrameSelection::modifyExtendingForward(TextGranularity granulari
             pos = endOfDocument(pos);
         break;
     }
-    
+#if ENABLE(USERSELECT_ALL)
+     adjustPositionForUserSelectAll(pos, directionOfEnclosingBlock() == LTR);
+#endif
     return pos;
 }
 
@@ -760,6 +773,9 @@ VisiblePosition FrameSelection::modifyExtendingLeft(TextGranularity granularity)
         pos = modifyExtendingBackward(granularity);
         break;
     }
+#if ENABLE(USERSELECT_ALL)
+    adjustPositionForUserSelectAll(pos, !(directionOfEnclosingBlock() == LTR));
+#endif
     return pos;
 }
        
@@ -804,6 +820,9 @@ VisiblePosition FrameSelection::modifyExtendingBackward(TextGranularity granular
             pos = startOfDocument(pos);
         break;
     }
+#if ENABLE(USERSELECT_ALL)
+    adjustPositionForUserSelectAll(pos, !(directionOfEnclosingBlock() == LTR));
+#endif
     return pos;
 }
 
@@ -956,6 +975,7 @@ bool FrameSelection::modify(EAlteration alter, SelectionDirection direction, Tex
         moveTo(position, userTriggered);
         break;
     case AlterationExtend:
+
         if (!m_selection.isCaret()
             && (granularity == WordGranularity || granularity == ParagraphGranularity || granularity == LineGranularity)
             && m_frame && !m_frame->editor()->behavior().shouldExtendSelectionByWordOrLineAcrossCaret()) {
@@ -1365,7 +1385,7 @@ void CaretBase::invalidateCaretRect(Node* node, bool caretRectChanged)
 
     if (!caretRectChanged) {
         RenderView* view = toRenderView(node->document()->renderer());
-        if (view && shouldRepaintCaret(view, node->isContentEditable()))
+        if (view && shouldRepaintCaret(view, node->isContentEditable(Node::UserSelectAllIsAlwaysNonEditable)))
             view->repaintRectangleInViewAndCompositedLayers(caretRepaintRect(node), false);
     }
 }
diff --git a/Source/WebCore/editing/InsertNodeBeforeCommand.cpp b/Source/WebCore/editing/InsertNodeBeforeCommand.cpp
index bef401142..bf662a312 100644
--- a/Source/WebCore/editing/InsertNodeBeforeCommand.cpp
+++ b/Source/WebCore/editing/InsertNodeBeforeCommand.cpp
@@ -48,7 +48,7 @@ InsertNodeBeforeCommand::InsertNodeBeforeCommand(PassRefPtr<Node> insertChild, P
 void InsertNodeBeforeCommand::doApply()
 {
     ContainerNode* parent = m_refChild->parentNode();
-    if (!parent || !parent->isContentEditable())
+    if (!parent || !parent->isContentEditable(Node::UserSelectAllIsAlwaysNonEditable))
         return;
 
     ExceptionCode ec;
@@ -60,7 +60,7 @@ void InsertNodeBeforeCommand::doApply()
 
 void InsertNodeBeforeCommand::doUnapply()
 {
-    if (!m_insertChild->isContentEditable())
+    if (!m_insertChild->isContentEditable(Node::UserSelectAllIsAlwaysNonEditable))
         return;
         
     // Need to notify this before actually deleting the text
diff --git a/Source/WebCore/editing/MarkupAccumulator.cpp b/Source/WebCore/editing/MarkupAccumulator.cpp
index b27d65ed1..beb832f7f 100644
--- a/Source/WebCore/editing/MarkupAccumulator.cpp
+++ b/Source/WebCore/editing/MarkupAccumulator.cpp
@@ -216,7 +216,7 @@ void MarkupAccumulator::appendQuotedURLAttributeValue(StringBuilder& result, con
         // minimal escaping for javascript urls
         if (strippedURLString.contains('"')) {
             if (strippedURLString.contains('\''))
-                strippedURLString.replace('"', "&quot;");
+                strippedURLString.replaceWithLiteral('"', "&quot;");
             else
                 quoteChar = '\'';
         }
diff --git a/Source/WebCore/editing/RemoveNodeCommand.cpp b/Source/WebCore/editing/RemoveNodeCommand.cpp
index 19657ac0f..82cb1d124 100644
--- a/Source/WebCore/editing/RemoveNodeCommand.cpp
+++ b/Source/WebCore/editing/RemoveNodeCommand.cpp
@@ -42,7 +42,7 @@ RemoveNodeCommand::RemoveNodeCommand(PassRefPtr<Node> node)
 void RemoveNodeCommand::doApply()
 {
     ContainerNode* parent = m_node->parentNode();
-    if (!parent || !parent->isContentEditable())
+    if (!parent || !parent->isContentEditable(Node::UserSelectAllIsAlwaysNonEditable))
         return;
 
     m_parent = parent;
diff --git a/Source/WebCore/editing/UndoManager.cpp b/Source/WebCore/editing/UndoManager.cpp
deleted file mode 100644
index 419de311d..000000000
--- a/Source/WebCore/editing/UndoManager.cpp
+++ /dev/null
@@ -1,232 +0,0 @@
-/*
- * Copyright (C) 2012 Google Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions are
- * met:
- *
- *     * Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- *     * Redistributions in binary form must reproduce the above
- * copyright notice, this list of conditions and the following disclaimer
- * in the documentation and/or other materials provided with the
- * distribution.
- *     * Neither the name of Google Inc. nor the names of its
- * contributors may be used to endorse or promote products derived from
- * this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
- * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "config.h"
-
-#if ENABLE(UNDO_MANAGER)
-
-#include "UndoManager.h"
-
-#include "ExceptionCode.h"
-
-namespace WebCore {
-
-DOMTransaction* UndoManager::s_recordingDOMTransaction = 0;
-
-PassRefPtr<UndoManager> UndoManager::create(Document* document)
-{
-    RefPtr<UndoManager> undoManager = adoptRef(new UndoManager(document));
-    undoManager->suspendIfNeeded();
-    return undoManager.release();
-}
-
-UndoManager::UndoManager(Document* document)
-    : ActiveDOMObject(document, this)
-    , m_document(document)
-    , m_isInProgress(false)
-{
-}
-
-static void clearStack(UndoManagerStack& stack)
-{
-    for (size_t i = 0; i < stack.size(); ++i) {
-        const UndoManagerEntry& entry = *stack[i];
-        for (size_t j = 0; j < entry.size(); ++j) {
-            UndoStep* step = entry[j].get();
-            if (step->isDOMTransaction())
-                static_cast<DOMTransaction*>(step)->setUndoManager(0);
-        }
-    }
-    stack.clear();
-}
-
-void UndoManager::disconnect()
-{
-    m_document = 0;
-    clearStack(m_undoStack);
-    clearStack(m_redoStack);
-}
-
-void UndoManager::stop()
-{
-    disconnect();
-}
-
-UndoManager::~UndoManager()
-{
-    disconnect();
-}
-
-static inline PassOwnPtr<UndoManagerEntry> createUndoManagerEntry()
-{
-    return adoptPtr(new UndoManagerEntry);
-}
-
-void UndoManager::transact(PassRefPtr<DOMTransaction> transaction, bool merge, ExceptionCode& ec)
-{
-    if (m_isInProgress || !m_document) {
-        ec = INVALID_ACCESS_ERR;
-        return;
-    }
-    clearRedo(ASSERT_NO_EXCEPTION);
-    transaction->setUndoManager(this);
-
-    m_isInProgress = true;
-    RefPtr<UndoManager> protect(this);
-    transaction->apply();
-    m_isInProgress = false;
-
-    if (!m_document)
-        return;
-    if (!merge || m_undoStack.isEmpty())
-        m_undoStack.append(createUndoManagerEntry());
-    m_undoStack.last()->append(transaction);
-}
-
-void UndoManager::undo(ExceptionCode& ec)
-{
-    if (m_isInProgress || !m_document) {
-        ec = INVALID_ACCESS_ERR;
-        return;
-    }
-    if (m_undoStack.isEmpty())
-        return;
-    m_inProgressEntry = createUndoManagerEntry();
-
-    m_isInProgress = true;
-    RefPtr<UndoManager> protect(this);
-    UndoManagerEntry entry = *m_undoStack.last();
-    for (size_t i = entry.size(); i > 0; --i)
-        entry[i - 1]->unapply();
-    m_isInProgress = false;
-
-    if (!m_document) {
-        m_inProgressEntry.clear();
-        return;
-    }
-    m_redoStack.append(m_inProgressEntry.release());
-    m_undoStack.removeLast();
-}
-
-void UndoManager::redo(ExceptionCode& ec)
-{
-    if (m_isInProgress || !m_document) {
-        ec = INVALID_ACCESS_ERR;
-        return;
-    }
-    if (m_redoStack.isEmpty())
-        return;
-    m_inProgressEntry = createUndoManagerEntry();
-
-    m_isInProgress = true;
-    RefPtr<UndoManager> protect(this);
-    UndoManagerEntry entry = *m_redoStack.last();
-    for (size_t i = entry.size(); i > 0; --i)
-        entry[i - 1]->reapply();
-    m_isInProgress = false;
-
-    if (!m_document) {
-        m_inProgressEntry.clear();
-        return;
-    }
-    m_undoStack.append(m_inProgressEntry.release());
-    m_redoStack.removeLast();
-}
-
-UndoManagerEntry UndoManager::item(unsigned index) const
-{
-    ASSERT(index < length());
-    if (index < m_redoStack.size()) {
-        UndoManagerEntry entry = *m_redoStack[index];
-        entry.reverse();
-        return entry;
-    }
-    return *m_undoStack[length() - index - 1];
-}
-
-void UndoManager::registerUndoStep(PassRefPtr<UndoStep> step)
-{
-    if (!m_isInProgress) {
-        OwnPtr<UndoManagerEntry> entry = createUndoManagerEntry();
-        entry->append(step);
-        m_undoStack.append(entry.release());
-
-        clearRedo(ASSERT_NO_EXCEPTION);
-    } else
-        m_inProgressEntry->append(step);
-}
-
-void UndoManager::registerRedoStep(PassRefPtr<UndoStep> step)
-{
-    if (!m_isInProgress) {
-        OwnPtr<UndoManagerEntry> entry = createUndoManagerEntry();
-        entry->append(step);
-        m_redoStack.append(entry.release());
-    } else
-        m_inProgressEntry->append(step);
-}
-
-void UndoManager::clearUndo(ExceptionCode& ec)
-{
-    if (m_isInProgress || !m_document) {
-        ec = INVALID_ACCESS_ERR;
-        return;
-    }
-    clearStack(m_undoStack);
-}
-
-void UndoManager::clearRedo(ExceptionCode& ec)
-{
-    if (m_isInProgress || !m_document) {
-        ec = INVALID_ACCESS_ERR;
-        return;
-    }
-    clearStack(m_redoStack);
-}
-
-bool UndoManager::isRecordingAutomaticTransaction(Node* node)
-{
-    // We need to check that transaction still has its undomanager because
-    // transaction can disconnect its undomanager, which will clear the undo/redo stacks.
-    if (!s_recordingDOMTransaction || !s_recordingDOMTransaction->undoManager())
-        return false;
-    Document* document = s_recordingDOMTransaction->undoManager()->document();
-    return document && node->document() == document;
-}
-
-void UndoManager::addTransactionStep(PassRefPtr<DOMTransactionStep> step)
-{
-    ASSERT(s_recordingDOMTransaction);
-    s_recordingDOMTransaction->addTransactionStep(step);
-}
-
-}
-
-#endif
diff --git a/Source/WebCore/editing/UndoManager.h b/Source/WebCore/editing/UndoManager.h
deleted file mode 100644
index f43039e07..000000000
--- a/Source/WebCore/editing/UndoManager.h
+++ /dev/null
@@ -1,102 +0,0 @@
-/*
- * Copyright (C) 2012 Google Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions are
- * met:
- *
- *     * Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- *     * Redistributions in binary form must reproduce the above
- * copyright notice, this list of conditions and the following disclaimer
- * in the documentation and/or other materials provided with the
- * distribution.
- *     * Neither the name of Google Inc. nor the names of its
- * contributors may be used to endorse or promote products derived from
- * this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
- * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#ifndef UndoManager_h
-#define UndoManager_h
-
-#if ENABLE(UNDO_MANAGER)
-
-#include "ActiveDOMObject.h"
-#include "DOMTransaction.h"
-#include "Document.h"
-#include "ExceptionCodePlaceholder.h"
-#include "UndoStep.h"
-#include <wtf/OwnPtr.h>
-#include <wtf/PassOwnPtr.h>
-#include <wtf/PassRefPtr.h>
-#include <wtf/RefCounted.h>
-#include <wtf/RefPtr.h>
-#include <wtf/Vector.h>
-
-namespace WebCore {
-
-typedef Vector<RefPtr<UndoStep> > UndoManagerEntry;
-typedef Vector<OwnPtr<UndoManagerEntry> > UndoManagerStack;
-
-class UndoManager : public RefCounted<UndoManager>, public ActiveDOMObject {
-public:
-    static PassRefPtr<UndoManager> create(Document*);
-    void disconnect();
-    virtual void stop() OVERRIDE;
-    virtual ~UndoManager();
-
-    void transact(PassRefPtr<DOMTransaction>, bool merge, ExceptionCode&);
-
-    void undo(ExceptionCode& = ASSERT_NO_EXCEPTION);
-    void redo(ExceptionCode& = ASSERT_NO_EXCEPTION);
-
-    UndoManagerEntry item(unsigned index) const;
-
-    unsigned length() const { return m_undoStack.size() + m_redoStack.size(); }
-    unsigned position() const { return m_redoStack.size(); }
-
-    void clearUndo(ExceptionCode&);
-    void clearRedo(ExceptionCode&);
-    
-    bool canUndo() const { return !m_undoStack.isEmpty(); }
-    bool canRedo() const { return !m_redoStack.isEmpty(); }
-    
-    void registerUndoStep(PassRefPtr<UndoStep>);
-    void registerRedoStep(PassRefPtr<UndoStep>);
-    
-    Document* document() const { return m_document; }
-    Node* ownerNode() const { return m_document; }
-
-    static void setRecordingDOMTransaction(DOMTransaction* transaction) { s_recordingDOMTransaction = transaction; }
-    static bool isRecordingAutomaticTransaction(Node*);
-    static void addTransactionStep(PassRefPtr<DOMTransactionStep>);
-
-private:
-    explicit UndoManager(Document*);
-    
-    Document* m_document;
-    UndoManagerStack m_undoStack;
-    UndoManagerStack m_redoStack;
-    bool m_isInProgress;
-    OwnPtr<UndoManagerEntry> m_inProgressEntry;
-
-    static DOMTransaction* s_recordingDOMTransaction;
-};
-    
-}
-    
-#endif
-
-#endif
diff --git a/Source/WebCore/editing/UndoStep.h b/Source/WebCore/editing/UndoStep.h
index 86738d6dc..ed202b427 100644
--- a/Source/WebCore/editing/UndoStep.h
+++ b/Source/WebCore/editing/UndoStep.h
@@ -43,9 +43,6 @@ public:
     virtual void unapply() = 0;
     virtual void reapply() = 0;
     virtual EditAction editingAction() const = 0;
-#if ENABLE(UNDO_MANAGER)
-    virtual bool isDOMTransaction() const = 0;
-#endif
 };
 
 }
diff --git a/Source/WebCore/editing/mac/EditorMac.mm b/Source/WebCore/editing/mac/EditorMac.mm
index 303a70b72..673996094 100644
--- a/Source/WebCore/editing/mac/EditorMac.mm
+++ b/Source/WebCore/editing/mac/EditorMac.mm
@@ -163,7 +163,8 @@ const SimpleFontData* Editor::fontForSelection(bool& hasMultipleFonts) const
 
     const SimpleFontData* font = 0;
     RefPtr<Range> range = m_frame->selection()->toNormalizedRange();
-    if (Node* startNode = adjustedSelectionStartForStyleComputation(m_frame->selection()->selection()).deprecatedNode()) {
+    Node* startNode = adjustedSelectionStartForStyleComputation(m_frame->selection()->selection()).deprecatedNode();
+    if (range && startNode) {
         Node* pastEnd = range->pastLastNode();
         // In the loop below, n should eventually match pastEnd and not become nil, but we've seen at least one
         // unreproducible case where this didn't happen, so check for null also.
diff --git a/Source/WebCore/editing/markup.cpp b/Source/WebCore/editing/markup.cpp
index ba472ee69..f6bf97015 100644
--- a/Source/WebCore/editing/markup.cpp
+++ b/Source/WebCore/editing/markup.cpp
@@ -31,7 +31,6 @@
 
 #include "CDATASection.h"
 #include "CSSPrimitiveValue.h"
-#include "CSSProperty.h"
 #include "CSSPropertyNames.h"
 #include "CSSRule.h"
 #include "CSSRuleList.h"
@@ -666,11 +665,10 @@ PassRefPtr<DocumentFragment> createFragmentFromMarkup(Document* document, const
 {
     // We use a fake body element here to trick the HTML parser to using the InBody insertion mode.
     RefPtr<HTMLBodyElement> fakeBody = HTMLBodyElement::create(document);
-    // Ignore exceptions here since this function is used to parse markup for pasting or for other editing purposes.
-    ExceptionCode ignoredEC;
-    RefPtr<DocumentFragment> fragment = createContextualFragment(markup, fakeBody.get(), scriptingPermission, ignoredEC);
+    RefPtr<DocumentFragment> fragment = DocumentFragment::create(document);
+    fragment->parseHTML(markup, fakeBody.get(), scriptingPermission);
 
-    if (fragment && !baseURL.isEmpty() && baseURL != blankURL() && baseURL != document->baseURL())
+    if (!baseURL.isEmpty() && baseURL != blankURL() && baseURL != document->baseURL())
         completeURLs(fragment.get(), baseURL);
 
     return fragment.release();
diff --git a/Source/WebCore/editing/visible_units.cpp b/Source/WebCore/editing/visible_units.cpp
index b0fb925fb..950867799 100644
--- a/Source/WebCore/editing/visible_units.cpp
+++ b/Source/WebCore/editing/visible_units.cpp
@@ -1108,7 +1108,11 @@ VisiblePosition startOfParagraph(const VisiblePosition& c, EditingBoundaryCrossi
 
     Node* n = startNode;
     while (n) {
+#if ENABLE(USERSELECT_ALL)
+        if (boundaryCrossingRule == CannotCrossEditingBoundary && !Position::nodeIsUserSelectAll(n) && n->rendererIsEditable() != startNode->rendererIsEditable())
+#else
         if (boundaryCrossingRule == CannotCrossEditingBoundary && n->rendererIsEditable() != startNode->rendererIsEditable())
+#endif
             break;
         if (boundaryCrossingRule == CanSkipOverEditingBoundary) {
             while (n && n->rendererIsEditable() != startNode->rendererIsEditable())
@@ -1184,7 +1188,11 @@ VisiblePosition endOfParagraph(const VisiblePosition &c, EditingBoundaryCrossing
 
     Node* n = startNode;
     while (n) {
+#if ENABLE(USERSELECT_ALL)
+        if (boundaryCrossingRule == CannotCrossEditingBoundary && !Position::nodeIsUserSelectAll(n) && n->rendererIsEditable() != startNode->rendererIsEditable())
+#else
         if (boundaryCrossingRule == CannotCrossEditingBoundary && n->rendererIsEditable() != startNode->rendererIsEditable())
+#endif
             break;
         if (boundaryCrossingRule == CanSkipOverEditingBoundary) {
             while (n && n->rendererIsEditable() != startNode->rendererIsEditable())
diff --git a/Source/WebCore/fileapi/FileReader.cpp b/Source/WebCore/fileapi/FileReader.cpp
index 2476859fb..128eb645c 100644
--- a/Source/WebCore/fileapi/FileReader.cpp
+++ b/Source/WebCore/fileapi/FileReader.cpp
@@ -215,6 +215,9 @@ void FileReader::didReceiveData()
 
 void FileReader::didFinishLoading()
 {
+    if (m_aborting)
+        return;
+
     ASSERT(m_state != DONE);
     m_state = DONE;
 
diff --git a/Source/WebCore/history/blackberry/HistoryItemViewState.h b/Source/WebCore/history/blackberry/HistoryItemViewState.h
index d25daa317..f2efb5d26 100644
--- a/Source/WebCore/history/blackberry/HistoryItemViewState.h
+++ b/Source/WebCore/history/blackberry/HistoryItemViewState.h
@@ -19,6 +19,7 @@
 #ifndef HistoryItemViewState_h
 #define HistoryItemViewState_h
 
+#include <BlackBerryPlatformString.h>
 #include <wtf/text/WTFString.h>
 
 namespace WebCore {
@@ -46,6 +47,7 @@ struct HistoryItemViewState {
     bool shouldReflowBlock;
     bool shouldSaveViewState;
     String networkToken;
+    BlackBerry::Platform::String webPageClientState;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/html/BaseChooserOnlyDateAndTimeInputType.cpp b/Source/WebCore/html/BaseChooserOnlyDateAndTimeInputType.cpp
new file mode 100644
index 000000000..11d7bd5d3
--- /dev/null
+++ b/Source/WebCore/html/BaseChooserOnlyDateAndTimeInputType.cpp
@@ -0,0 +1,104 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include "config.h"
+#if ENABLE(DATE_AND_TIME_INPUT_TYPES) && !ENABLE(INPUT_MULTIPLE_FIELDS_UI)
+#include "BaseChooserOnlyDateAndTimeInputType.h"
+
+#include "Chrome.h"
+#include "ChromeClient.h"
+#include "HTMLInputElement.h"
+#include "Page.h"
+#include "ScriptController.h"
+
+namespace WebCore {
+
+BaseChooserOnlyDateAndTimeInputType::~BaseChooserOnlyDateAndTimeInputType()
+{
+    closeDateTimeChooser();
+}
+
+void BaseChooserOnlyDateAndTimeInputType::handleDOMActivateEvent(Event*)
+{
+    if (element()->disabled() || element()->readOnly() || !element()->renderer() || !ScriptController::processingUserGesture())
+        return;
+
+    if (m_dateTimeChooser)
+        return;
+    if (!element()->document()->page())
+        return;
+    Chrome* chrome = element()->document()->page()->chrome();
+    if (!chrome)
+        return;
+    DateTimeChooserParameters parameters;
+    if (!element()->setupDateTimeChooserParameters(parameters))
+        return;
+    m_dateTimeChooser = chrome->client()->openDateTimeChooser(this, parameters);
+}
+
+void BaseChooserOnlyDateAndTimeInputType::detach()
+{
+    closeDateTimeChooser();
+}
+
+void BaseChooserOnlyDateAndTimeInputType::didChooseValue(const String& value)
+{
+    element()->setValue(value, DispatchChangeEvent);
+}
+
+void BaseChooserOnlyDateAndTimeInputType::didEndChooser()
+{
+    m_dateTimeChooser.clear();
+}
+
+void BaseChooserOnlyDateAndTimeInputType::closeDateTimeChooser()
+{
+    if (m_dateTimeChooser)
+        m_dateTimeChooser->endChooser();
+}
+
+void BaseChooserOnlyDateAndTimeInputType::handleKeydownEvent(KeyboardEvent* event)
+{
+    BaseClickableWithKeyInputType::handleKeydownEvent(element(), event);
+}
+
+void BaseChooserOnlyDateAndTimeInputType::handleKeypressEvent(KeyboardEvent* event)
+{
+    BaseClickableWithKeyInputType::handleKeypressEvent(element(), event);
+}
+
+void BaseChooserOnlyDateAndTimeInputType::handleKeyupEvent(KeyboardEvent* event)
+{
+    BaseClickableWithKeyInputType::handleKeyupEvent(*this, event);
+}
+
+void BaseChooserOnlyDateAndTimeInputType::accessKeyAction(bool sendMouseEvents)
+{
+    BaseDateAndTimeInputType::accessKeyAction(sendMouseEvents);
+    BaseClickableWithKeyInputType::accessKeyAction(element(), sendMouseEvents);
+}
+
+}
+#endif
diff --git a/Source/WebCore/html/BaseChooserOnlyDateAndTimeInputType.h b/Source/WebCore/html/BaseChooserOnlyDateAndTimeInputType.h
new file mode 100644
index 000000000..3c78161b9
--- /dev/null
+++ b/Source/WebCore/html/BaseChooserOnlyDateAndTimeInputType.h
@@ -0,0 +1,62 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#ifndef BaseChooserOnlyDateAndTimeInputType_h
+#define BaseChooserOnlyDateAndTimeInputType_h
+
+#if ENABLE(DATE_AND_TIME_INPUT_TYPES) && !ENABLE(INPUT_MULTIPLE_FIELDS_UI)
+#include "BaseClickableWithKeyInputType.h"
+#include "BaseDateAndTimeInputType.h"
+#include "DateTimeChooser.h"
+#include "DateTimeChooserClient.h"
+
+namespace WebCore {
+
+class BaseChooserOnlyDateAndTimeInputType : public BaseDateAndTimeInputType, public DateTimeChooserClient {
+protected:
+    BaseChooserOnlyDateAndTimeInputType(HTMLInputElement* element) : BaseDateAndTimeInputType(element) { }
+    virtual ~BaseChooserOnlyDateAndTimeInputType();
+
+private:
+    void closeDateTimeChooser();
+
+    // InputType functions:
+    virtual void detach() OVERRIDE;
+    virtual void handleDOMActivateEvent(Event*) OVERRIDE;
+    virtual void handleKeydownEvent(KeyboardEvent*) OVERRIDE;
+    virtual void handleKeypressEvent(KeyboardEvent*) OVERRIDE;
+    virtual void handleKeyupEvent(KeyboardEvent*) OVERRIDE;
+    virtual void accessKeyAction(bool sendMouseEvents) OVERRIDE;
+
+    // DateTimeChooserClient functions:
+    virtual void didChooseValue(const String&) OVERRIDE;
+    virtual void didEndChooser() OVERRIDE;
+
+    RefPtr<DateTimeChooser> m_dateTimeChooser;
+};
+
+}
+#endif
+#endif
diff --git a/Source/WebCore/html/BaseClickableWithKeyInputType.cpp b/Source/WebCore/html/BaseClickableWithKeyInputType.cpp
index 9bc56ea91..329c512ed 100644
--- a/Source/WebCore/html/BaseClickableWithKeyInputType.cpp
+++ b/Source/WebCore/html/BaseClickableWithKeyInputType.cpp
@@ -39,21 +39,21 @@ namespace WebCore {
 
 using namespace HTMLNames;
 
-void BaseClickableWithKeyInputType::handleKeydownEvent(KeyboardEvent* event)
+void BaseClickableWithKeyInputType::handleKeydownEvent(HTMLInputElement* element, KeyboardEvent* event)
 {
     const String& key = event->keyIdentifier();
     if (key == "U+0020") {
-        element()->setActive(true, true);
+        element->setActive(true, true);
         // No setDefaultHandled(), because IE dispatches a keypress in this case
         // and the caller will only dispatch a keypress if we don't call setDefaultHandled().
     }
 }
 
-void BaseClickableWithKeyInputType::handleKeypressEvent(KeyboardEvent* event)
+void BaseClickableWithKeyInputType::handleKeypressEvent(HTMLInputElement* element, KeyboardEvent* event)
 {
     int charCode = event->charCode();
     if (charCode == '\r') {
-        element()->dispatchSimulatedClick(event);
+        element->dispatchSimulatedClick(event);
         event->setDefaultHandled();
         return;
     }
@@ -63,23 +63,42 @@ void BaseClickableWithKeyInputType::handleKeypressEvent(KeyboardEvent* event)
     }
 }
 
-void BaseClickableWithKeyInputType::handleKeyupEvent(KeyboardEvent* event)
+void BaseClickableWithKeyInputType::handleKeyupEvent(InputType& inputType, KeyboardEvent* event)
 {
     const String& key = event->keyIdentifier();
     if (key != "U+0020")
         return;
     // Simulate mouse click for spacebar for button types.
-    dispatchSimulatedClickIfActive(event);
+    inputType.dispatchSimulatedClickIfActive(event);
 }
 
 // FIXME: Could share this with BaseCheckableInputType and RangeInputType if we had a common base class.
-void BaseClickableWithKeyInputType::accessKeyAction(bool sendMouseEvents)
+void BaseClickableWithKeyInputType::accessKeyAction(HTMLInputElement* element, bool sendMouseEvents)
 {
-    InputType::accessKeyAction(sendMouseEvents);
-
     // Send mouse button events if the caller specified sendMouseEvents.
     // FIXME: The comment above is no good. It says what we do, but not why.
-    element()->dispatchSimulatedClick(0, sendMouseEvents);
+    element->dispatchSimulatedClick(0, sendMouseEvents);
+}
+
+void BaseClickableWithKeyInputType::handleKeydownEvent(KeyboardEvent* event)
+{
+    handleKeydownEvent(element(), event);
+}
+
+void BaseClickableWithKeyInputType::handleKeypressEvent(KeyboardEvent* event)
+{
+    handleKeypressEvent(element(), event);
+}
+
+void BaseClickableWithKeyInputType::handleKeyupEvent(KeyboardEvent* event)
+{
+    handleKeyupEvent(*this, event);
+}
+
+void BaseClickableWithKeyInputType::accessKeyAction(bool sendMouseEvents)
+{
+    InputType::accessKeyAction(sendMouseEvents);
+    accessKeyAction(element(), sendMouseEvents);
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/html/BaseClickableWithKeyInputType.h b/Source/WebCore/html/BaseClickableWithKeyInputType.h
index 5bb58cf4e..fce5b5af3 100644
--- a/Source/WebCore/html/BaseClickableWithKeyInputType.h
+++ b/Source/WebCore/html/BaseClickableWithKeyInputType.h
@@ -37,6 +37,12 @@ namespace WebCore {
 
 // Base of input types that dispatches a simulated click on space/return key.
 class BaseClickableWithKeyInputType : public InputType {
+public:
+    static void handleKeydownEvent(HTMLInputElement*, KeyboardEvent*);
+    static void handleKeypressEvent(HTMLInputElement*, KeyboardEvent*);
+    static void handleKeyupEvent(InputType&, KeyboardEvent*);
+    static void accessKeyAction(HTMLInputElement*, bool sendMouseEvents);
+    
 protected:
     BaseClickableWithKeyInputType(HTMLInputElement* element) : InputType(element) { }
 
diff --git a/Source/WebCore/html/BaseDateAndTimeInputType.cpp b/Source/WebCore/html/BaseDateAndTimeInputType.cpp
index 44c3a83d7..00a1ffc38 100644
--- a/Source/WebCore/html/BaseDateAndTimeInputType.cpp
+++ b/Source/WebCore/html/BaseDateAndTimeInputType.cpp
@@ -29,12 +29,13 @@
  */
 
 #include "config.h"
+#if ENABLE(DATE_AND_TIME_INPUT_TYPES)
 #include "BaseDateAndTimeInputType.h"
 
 #include "HTMLInputElement.h"
 #include "HTMLNames.h"
 #include "KeyboardEvent.h"
-#include "Localizer.h"
+#include "PlatformLocale.h"
 #include <limits>
 #include <wtf/CurrentTime.h>
 #include <wtf/DateMath.h>
@@ -156,7 +157,7 @@ String BaseDateAndTimeInputType::localizeValue(const String& proposedValue) cons
     if (!parseToDateComponents(proposedValue, &date))
         return proposedValue;
 
-    String localized = element()->localizer().formatDateTime(date);
+    String localized = element()->locale().formatDateTime(date);
     return localized.isEmpty() ? proposedValue : localized;
 }
 
@@ -167,14 +168,11 @@ String BaseDateAndTimeInputType::visibleValue() const
 
 String BaseDateAndTimeInputType::convertFromVisibleValue(const String& visibleValue) const
 {
-    if (visibleValue.isEmpty())
-        return visibleValue;
-
-    double parsedValue = element()->localizer().parseDateTime(visibleValue, dateType());
-    if (!isfinite(parsedValue))
-        return visibleValue;
-
-    return serializeWithMilliseconds(parsedValue);
+    // convertFromVisibleValue is used in the textfield UI. Though this class
+    // inherits TextFieldInputType, users are unable to edit visible values, and
+    // this function is never called.
+    ASSERT_NOT_REACHED();
+    return visibleValue;
 }
 
 String BaseDateAndTimeInputType::sanitizeValue(const String& proposedValue) const
@@ -183,3 +181,4 @@ String BaseDateAndTimeInputType::sanitizeValue(const String& proposedValue) cons
 }
 
 } // namespace WebCore
+#endif
diff --git a/Source/WebCore/html/BaseDateAndTimeInputType.h b/Source/WebCore/html/BaseDateAndTimeInputType.h
index 96b7b5fe6..d2fd94134 100644
--- a/Source/WebCore/html/BaseDateAndTimeInputType.h
+++ b/Source/WebCore/html/BaseDateAndTimeInputType.h
@@ -31,6 +31,7 @@
 #ifndef BaseDateAndTimeInputType_h
 #define BaseDateAndTimeInputType_h
 
+#if ENABLE(DATE_AND_TIME_INPUT_TYPES)
 #include "DateComponents.h"
 #include "TextFieldInputType.h"
 #include <wtf/unicode/Unicode.h>
@@ -67,5 +68,5 @@ private:
 };
 
 } // namespace WebCore
-
+#endif
 #endif // BaseDateAndTimeInputType_h
diff --git a/Source/WebCore/html/BaseMultipleFieldsDateAndTimeInputType.cpp b/Source/WebCore/html/BaseMultipleFieldsDateAndTimeInputType.cpp
index 962e278cd..3ca5c8f11 100644
--- a/Source/WebCore/html/BaseMultipleFieldsDateAndTimeInputType.cpp
+++ b/Source/WebCore/html/BaseMultipleFieldsDateAndTimeInputType.cpp
@@ -41,9 +41,9 @@
 #include "HTMLInputElement.h"
 #include "HTMLOptionElement.h"
 #include "KeyboardEvent.h"
-#include "Localizer.h"
 #include "Page.h"
 #include "PickerIndicatorElement.h"
+#include "PlatformLocale.h"
 #include "RenderTheme.h"
 #include "ShadowRoot.h"
 #include <wtf/DateMath.h>
@@ -93,9 +93,40 @@ bool BaseMultipleFieldsDateAndTimeInputType::isEditControlOwnerReadOnly() const
     return element()->disabled();
 }
 
+void BaseMultipleFieldsDateAndTimeInputType::focusAndSelectSpinButtonOwner()
+{
+    if (m_dateTimeEditElement)
+        m_dateTimeEditElement->focusIfNoFocus();
+}
+
+bool BaseMultipleFieldsDateAndTimeInputType::shouldSpinButtonRespondToMouseEvents()
+{
+    return !element()->disabled() && !element()->readOnly();
+}
+
+bool BaseMultipleFieldsDateAndTimeInputType::shouldSpinButtonRespondToWheelEvents()
+{
+    if (!shouldSpinButtonRespondToMouseEvents())
+        return false;
+    return m_dateTimeEditElement && m_dateTimeEditElement->hasFocusedField();
+}
+
+void BaseMultipleFieldsDateAndTimeInputType::spinButtonStepDown()
+{
+    if (m_dateTimeEditElement)
+        m_dateTimeEditElement->stepDown();
+}
+
+void BaseMultipleFieldsDateAndTimeInputType::spinButtonStepUp()
+{
+    if (m_dateTimeEditElement)
+        m_dateTimeEditElement->stepUp();
+}
+
 BaseMultipleFieldsDateAndTimeInputType::BaseMultipleFieldsDateAndTimeInputType(HTMLInputElement* element)
     : BaseDateAndTimeInputType(element)
     , m_dateTimeEditElement(0)
+    , m_spinButtonElement(0)
     , m_pickerIndicatorElement(0)
     , m_pickerIndicatorIsVisible(false)
     , m_pickerIndicatorIsAlwaysVisible(false)
@@ -104,6 +135,8 @@ BaseMultipleFieldsDateAndTimeInputType::BaseMultipleFieldsDateAndTimeInputType(H
 
 BaseMultipleFieldsDateAndTimeInputType::~BaseMultipleFieldsDateAndTimeInputType()
 {
+    if (m_spinButtonElement)
+        m_spinButtonElement->removeSpinButtonOwner();
     if (m_dateTimeEditElement)
         m_dateTimeEditElement->removeEditControlOwner();
 }
@@ -135,19 +168,20 @@ void BaseMultipleFieldsDateAndTimeInputType::createShadowSubtree()
     container->appendChild(m_dateTimeEditElement);
     updateInnerTextValue();
 
-#if ENABLE(DATALIST_ELEMENT) || ENABLE(CALENDAR_PICKER)
+    RefPtr<SpinButtonElement> spinButton = SpinButtonElement::create(document, *this);
+    m_spinButtonElement = spinButton.get();
+    container->appendChild(spinButton);
+
     bool shouldAddPickerIndicator = false;
 #if ENABLE(DATALIST_ELEMENT)
     if (InputType::themeSupportsDataListUI(this))
         shouldAddPickerIndicator = true;
 #endif
-#if ENABLE(CALENDAR_PICKER)
     RefPtr<RenderTheme> theme = document->page() ? document->page()->theme() : RenderTheme::defaultTheme();
     if (theme->supportsCalendarPicker(formControlType())) {
         shouldAddPickerIndicator = true;
         m_pickerIndicatorIsAlwaysVisible = true;
     }
-#endif
     if (shouldAddPickerIndicator) {
         RefPtr<PickerIndicatorElement> pickerElement = PickerIndicatorElement::create(document);
         m_pickerIndicatorElement = pickerElement.get();
@@ -155,11 +189,14 @@ void BaseMultipleFieldsDateAndTimeInputType::createShadowSubtree()
         m_pickerIndicatorIsVisible = true;
         updatePickerIndicatorVisibility();
     }
-#endif // ENABLE(DATALIST_ELEMENT) || ENABLE(CALENDAR_PICKER)
 }
 
 void BaseMultipleFieldsDateAndTimeInputType::destroyShadowSubtree()
 {
+    if (m_spinButtonElement) {
+        m_spinButtonElement->removeSpinButtonOwner();
+        m_spinButtonElement = 0;
+    }
     if (m_dateTimeEditElement) {
         m_dateTimeEditElement->removeEditControlOwner();
         m_dateTimeEditElement = 0;
@@ -175,12 +212,19 @@ void BaseMultipleFieldsDateAndTimeInputType::focus(bool)
 
 void BaseMultipleFieldsDateAndTimeInputType::forwardEvent(Event* event)
 {
+    if (m_spinButtonElement) {
+        m_spinButtonElement->forwardEvent(event);
+        if (event->defaultHandled())
+            return;
+    }
+        
     if (m_dateTimeEditElement)
         m_dateTimeEditElement->defaultEventHandler(event);
 }
 
 void BaseMultipleFieldsDateAndTimeInputType::disabledAttributeChanged()
 {
+    m_spinButtonElement->releaseCapture();
     if (m_dateTimeEditElement)
         m_dateTimeEditElement->disabledStateChanged();
 }
@@ -189,11 +233,8 @@ void BaseMultipleFieldsDateAndTimeInputType::handleKeydownEvent(KeyboardEvent* e
 {
     Document* document = element()->document();
     RefPtr<RenderTheme> theme = document->page() ? document->page()->theme() : RenderTheme::defaultTheme();
-    if (theme->shouldOpenPickerWithF4Key() && event->keyIdentifier() == "F4") {
-        if (m_pickerIndicatorElement)
-            m_pickerIndicatorElement->openPopup();
-        event->setDefaultHandled();
-    } else if (m_pickerIndicatorIsVisible && event->keyIdentifier() == "Down" && event->getModifierState("Alt")) {
+    if (m_pickerIndicatorIsVisible
+        && ((event->keyIdentifier() == "Down" && event->getModifierState("Alt")) || (theme->shouldOpenPickerWithF4Key() && event->keyIdentifier() == "F4"))) {
         if (m_pickerIndicatorElement)
             m_pickerIndicatorElement->openPopup();
         event->setDefaultHandled();
@@ -223,6 +264,7 @@ void BaseMultipleFieldsDateAndTimeInputType::minOrMaxAttributeChanged()
 
 void BaseMultipleFieldsDateAndTimeInputType::readonlyAttributeChanged()
 {
+    m_spinButtonElement->releaseCapture();
     if (m_dateTimeEditElement)
         m_dateTimeEditElement->readOnlyStateChanged();
 }
@@ -273,11 +315,11 @@ void BaseMultipleFieldsDateAndTimeInputType::updateInnerTextValue()
     if (!m_dateTimeEditElement)
         return;
 
-    AtomicString direction = element()->localizer().isRTL() ? AtomicString("rtl", AtomicString::ConstructFromLiteral) : AtomicString("ltr", AtomicString::ConstructFromLiteral);
+    AtomicString direction = element()->locale().isRTL() ? AtomicString("rtl", AtomicString::ConstructFromLiteral) : AtomicString("ltr", AtomicString::ConstructFromLiteral);
     if (Element* container = firstElementChild(element()->userAgentShadowRoot()))
         container->setAttribute(HTMLNames::dirAttr, direction);
 
-    DateTimeEditElement::LayoutParameters layoutParameters(element()->localizer(), createStepRange(AnyIsDefaultStep));
+    DateTimeEditElement::LayoutParameters layoutParameters(element()->locale(), createStepRange(AnyIsDefaultStep));
 
     DateComponents date;
     const bool hasValue = parseToDateComponents(element()->value(), &date);
@@ -299,15 +341,12 @@ void BaseMultipleFieldsDateAndTimeInputType::listAttributeTargetChanged()
 }
 #endif
 
-#if ENABLE(DATALIST_ELEMENT) || ENABLE(CALENDAR_PICKER)
 void BaseMultipleFieldsDateAndTimeInputType::updatePickerIndicatorVisibility()
 {
-#if ENABLE(CALENDAR_PICKER)
     if (m_pickerIndicatorIsAlwaysVisible) {
         showPickerIndicator();
         return;
     }
-#endif
 #if ENABLE(DATALIST_ELEMENT)
     if (HTMLDataListElement* dataList = element()->dataList()) {
         RefPtr<HTMLCollection> options = dataList->options();
@@ -339,7 +378,6 @@ void BaseMultipleFieldsDateAndTimeInputType::showPickerIndicator()
     ASSERT(m_pickerIndicatorElement);
     m_pickerIndicatorElement->removeInlineStyleProperty(CSSPropertyDisplay);
 }
-#endif // ENABLE(DATALIST_ELEMENT) || ENABLE(CALENDAR_PICKER)
 
 int BaseMultipleFieldsDateAndTimeInputType::fullYear(const String& source) const
 {
diff --git a/Source/WebCore/html/BaseMultipleFieldsDateAndTimeInputType.h b/Source/WebCore/html/BaseMultipleFieldsDateAndTimeInputType.h
index 319330438..9c75bb2c5 100644
--- a/Source/WebCore/html/BaseMultipleFieldsDateAndTimeInputType.h
+++ b/Source/WebCore/html/BaseMultipleFieldsDateAndTimeInputType.h
@@ -35,6 +35,7 @@
 
 #if ENABLE(INPUT_MULTIPLE_FIELDS_UI)
 #include "DateTimeEditElement.h"
+#include "SpinButtonElement.h"
 
 namespace WebCore {
 
@@ -58,6 +59,13 @@ private:
     virtual bool isEditControlOwnerReadOnly() const OVERRIDE FINAL;
     virtual AtomicString localeIdentifier() const OVERRIDE FINAL;
 
+    // SpinButtonElement::SpinButtonOwner functions.
+    virtual void focusAndSelectSpinButtonOwner() OVERRIDE;
+    virtual bool shouldSpinButtonRespondToMouseEvents() OVERRIDE;
+    virtual bool shouldSpinButtonRespondToWheelEvents() OVERRIDE;
+    virtual void spinButtonStepDown() OVERRIDE;
+    virtual void spinButtonStepUp() OVERRIDE;
+
     // InputType functions
     virtual void blur() OVERRIDE FINAL;
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle*) const OVERRIDE FINAL;
@@ -86,13 +94,10 @@ private:
     void updatePickerIndicatorVisibility();
 
     DateTimeEditElement* m_dateTimeEditElement;
-#if ENABLE(DATALIST_ELEMENT) || ENABLE(CALENDAR_PICKER)
+    SpinButtonElement* m_spinButtonElement;
     PickerIndicatorElement* m_pickerIndicatorElement;
     bool m_pickerIndicatorIsVisible;
-#if ENABLE(CALENDAR_PICKER)
     bool m_pickerIndicatorIsAlwaysVisible;
-#endif
-#endif
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/html/DateInputType.cpp b/Source/WebCore/html/DateInputType.cpp
index 1ff59329a..ab8ac7ccc 100644
--- a/Source/WebCore/html/DateInputType.cpp
+++ b/Source/WebCore/html/DateInputType.cpp
@@ -39,8 +39,8 @@
 #include "InputTypeNames.h"
 #include "KeyboardEvent.h"
 #include "LocalizedStrings.h"
-#include "Localizer.h"
 #include "PickerIndicatorElement.h"
+#include "PlatformLocale.h"
 #include <wtf/PassOwnPtr.h>
 
 namespace WebCore {
@@ -53,9 +53,6 @@ static const int dateStepScaleFactor = 86400000;
 
 inline DateInputType::DateInputType(HTMLInputElement* element)
     : BaseDateInputType(element)
-#if ENABLE(INPUT_TYPE_DATE_LEGACY_UI)
-    , m_pickerElement(0)
-#endif
 {
 }
 
@@ -103,73 +100,7 @@ bool DateInputType::isDateField() const
     return true;
 }
 
-#if ENABLE(INPUT_TYPE_DATE_LEGACY_UI)
-void DateInputType::createShadowSubtree()
-{
-    BaseDateAndTimeInputType::createShadowSubtree();
-    RefPtr<PickerIndicatorElement> pickerElement = PickerIndicatorElement::create(element()->document());
-    m_pickerElement = pickerElement.get();
-    containerElement()->insertBefore(m_pickerElement, innerBlockElement()->nextSibling(), ASSERT_NO_EXCEPTION);
-}
-
-void DateInputType::destroyShadowSubtree()
-{
-    TextFieldInputType::destroyShadowSubtree();
-    m_pickerElement = 0;
-}
-
-bool DateInputType::needsContainer() const
-{
-    return true;
-}
-
-bool DateInputType::shouldHaveSpinButton() const
-{
-    return false;
-}
-
-void DateInputType::handleKeydownEvent(KeyboardEvent* event)
-{
-    if (element()->disabled() || element()->readOnly())
-        return;
-    if (event->keyIdentifier() == "Down") {
-        if (m_pickerElement)
-            m_pickerElement->openPopup();
-        event->setDefaultHandled();
-        return;
-    }
-    BaseDateAndTimeInputType::handleKeydownEvent(event);
-}
-
-void DateInputType::handleBlurEvent()
-{
-    if (m_pickerElement)
-        m_pickerElement->closePopup();
-
-    // Reset the renderer value, which might be unmatched with the element value.
-    element()->setFormControlValueMatchesRenderer(false);
-    // We need to reset the renderer value explicitly because an unacceptable
-    // renderer value should be purged before style calculation.
-    updateInnerTextValue();
-}
-
-bool DateInputType::supportsPlaceholder() const
-{
-    return true;
-}
-
-bool DateInputType::usesFixedPlaceholder() const
-{
-    return true;
-}
-
-String DateInputType::fixedPlaceholder()
-{
-    return element()->localizer().dateFormatText();
-}
-#endif // ENABLE(INPUT_TYPE_DATE_LEGACY_UI)
-
-#if ENABLE(INPUT_MULTIPLE_FIELDS_UI) && !ENABLE(INPUT_TYPE_DATE_LEGACY_UI)
+#if ENABLE(INPUT_MULTIPLE_FIELDS_UI)
 String DateInputType::formatDateTimeFieldsState(const DateTimeFieldsState& dateTimeFieldsState) const
 {
     if (!dateTimeFieldsState.hasDayOfMonth() || !dateTimeFieldsState.hasMonth() || !dateTimeFieldsState.hasYear())
@@ -180,7 +111,7 @@ String DateInputType::formatDateTimeFieldsState(const DateTimeFieldsState& dateT
 
 void DateInputType::setupLayoutParameters(DateTimeEditElement::LayoutParameters& layoutParameters, const DateComponents& date) const
 {
-    layoutParameters.dateTimeFormat = layoutParameters.localizer.dateFormat();
+    layoutParameters.dateTimeFormat = layoutParameters.locale.dateFormat();
     layoutParameters.fallbackDateTimeFormat = ASCIILiteral("yyyy-MM-dd");
     layoutParameters.minimumYear = fullYear(element()->fastGetAttribute(minAttr));
     layoutParameters.maximumYear = fullYear(element()->fastGetAttribute(maxAttr));
diff --git a/Source/WebCore/html/DateInputType.h b/Source/WebCore/html/DateInputType.h
index 934ac2629..19c136f44 100644
--- a/Source/WebCore/html/DateInputType.h
+++ b/Source/WebCore/html/DateInputType.h
@@ -32,6 +32,7 @@
 #define DateInputType_h
 
 #if ENABLE(INPUT_TYPE_DATE)
+#include "BaseChooserOnlyDateAndTimeInputType.h"
 #include "BaseMultipleFieldsDateAndTimeInputType.h"
 #include <wtf/RefPtr.h>
 
@@ -39,10 +40,10 @@ namespace WebCore {
 
 class PickerIndicatorElement;
 
-#if ENABLE(INPUT_MULTIPLE_FIELDS_UI) && !ENABLE(INPUT_TYPE_DATE_LEGACY_UI)
+#if ENABLE(INPUT_MULTIPLE_FIELDS_UI)
 typedef BaseMultipleFieldsDateAndTimeInputType BaseDateInputType;
 #else
-typedef BaseDateAndTimeInputType BaseDateInputType;
+typedef BaseChooserOnlyDateAndTimeInputType BaseDateInputType;
 #endif
 
 class DateInputType : public BaseDateInputType {
@@ -58,27 +59,11 @@ private:
     virtual bool setMillisecondToDateComponents(double, DateComponents*) const OVERRIDE;
     virtual bool isDateField() const OVERRIDE;
 
-#if ENABLE(INPUT_TYPE_DATE_LEGACY_UI)
-    virtual void createShadowSubtree() OVERRIDE;
-    virtual void destroyShadowSubtree() OVERRIDE;
-    virtual void handleKeydownEvent(KeyboardEvent*) OVERRIDE;
-    virtual void handleBlurEvent() OVERRIDE;
-    virtual bool supportsPlaceholder() const OVERRIDE;
-    virtual bool usesFixedPlaceholder() const OVERRIDE;
-    virtual String fixedPlaceholder() OVERRIDE;
-
-    // TextFieldInputType functions
-    virtual bool needsContainer() const OVERRIDE;
-    virtual bool shouldHaveSpinButton() const OVERRIDE;
-
-    PickerIndicatorElement* m_pickerElement;
-#else
 #if ENABLE(INPUT_MULTIPLE_FIELDS_UI)
     // BaseMultipleFieldsDateAndTimeInputType functions
     virtual String formatDateTimeFieldsState(const DateTimeFieldsState&) const OVERRIDE;
     virtual void setupLayoutParameters(DateTimeEditElement::LayoutParameters&, const DateComponents&) const OVERRIDE;
 #endif
-#endif
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/html/DateTimeInputType.cpp b/Source/WebCore/html/DateTimeInputType.cpp
index c4c0473ba..0ecab6e6f 100644
--- a/Source/WebCore/html/DateTimeInputType.cpp
+++ b/Source/WebCore/html/DateTimeInputType.cpp
@@ -43,7 +43,7 @@
 #if ENABLE(INPUT_MULTIPLE_FIELDS_UI)
 #include "DateTimeFieldsState.h"
 #include "LocalizedStrings.h"
-#include "Localizer.h"
+#include "PlatformLocale.h"
 #include <wtf/text/StringBuilder.h>
 #include <wtf/text/WTFString.h>
 #endif
@@ -146,10 +146,10 @@ String DateTimeInputType::formatDateTimeFieldsState(const DateTimeFieldsState& d
 void DateTimeInputType::setupLayoutParameters(DateTimeEditElement::LayoutParameters& layoutParameters, const DateComponents& date) const
 {
     if (shouldHaveSecondField(date)) {
-        layoutParameters.dateTimeFormat = layoutParameters.localizer.dateTimeFormatWithSeconds();
+        layoutParameters.dateTimeFormat = layoutParameters.locale.dateTimeFormatWithSeconds();
         layoutParameters.fallbackDateTimeFormat = "dd/MM/yyyy HH:mm:ss";
     } else {
-        layoutParameters.dateTimeFormat = layoutParameters.localizer.dateTimeFormatWithoutSeconds();
+        layoutParameters.dateTimeFormat = layoutParameters.locale.dateTimeFormatWithoutSeconds();
         layoutParameters.fallbackDateTimeFormat = "dd/MM/yyyy HH:mm";
     }
     layoutParameters.minimumYear = fullYear(element()->fastGetAttribute(minAttr));
diff --git a/Source/WebCore/html/DateTimeInputType.h b/Source/WebCore/html/DateTimeInputType.h
index b0dda1049..8afc30f6a 100644
--- a/Source/WebCore/html/DateTimeInputType.h
+++ b/Source/WebCore/html/DateTimeInputType.h
@@ -34,6 +34,7 @@
 #include "BaseDateAndTimeInputType.h"
 
 #if ENABLE(INPUT_TYPE_DATETIME)
+#include "BaseChooserOnlyDateAndTimeInputType.h"
 #include "BaseMultipleFieldsDateAndTimeInputType.h"
 
 namespace WebCore {
@@ -41,7 +42,7 @@ namespace WebCore {
 #if ENABLE(INPUT_MULTIPLE_FIELDS_UI)
 typedef BaseMultipleFieldsDateAndTimeInputType BaseDateTimeInputType;
 #else
-typedef BaseDateAndTimeInputType BaseDateTimeInputType;
+typedef BaseChooserOnlyDateAndTimeInputType BaseDateTimeInputType;
 #endif
 
 class DateTimeInputType : public BaseDateTimeInputType {
diff --git a/Source/WebCore/html/DateTimeLocalInputType.cpp b/Source/WebCore/html/DateTimeLocalInputType.cpp
index b0cb95a8f..9373cbec2 100644
--- a/Source/WebCore/html/DateTimeLocalInputType.cpp
+++ b/Source/WebCore/html/DateTimeLocalInputType.cpp
@@ -42,7 +42,7 @@
 #if ENABLE(INPUT_MULTIPLE_FIELDS_UI)
 #include "DateTimeFieldsState.h"
 #include "LocalizedStrings.h"
-#include "Localizer.h"
+#include "PlatformLocale.h"
 #include <wtf/text/StringBuilder.h>
 #include <wtf/text/WTFString.h>
 #endif
@@ -152,10 +152,10 @@ String DateTimeLocalInputType::formatDateTimeFieldsState(const DateTimeFieldsSta
 void DateTimeLocalInputType::setupLayoutParameters(DateTimeEditElement::LayoutParameters& layoutParameters, const DateComponents& date) const
 {
     if (shouldHaveSecondField(date)) {
-        layoutParameters.dateTimeFormat = layoutParameters.localizer.dateTimeFormatWithSeconds();
+        layoutParameters.dateTimeFormat = layoutParameters.locale.dateTimeFormatWithSeconds();
         layoutParameters.fallbackDateTimeFormat = "dd/MM/yyyy HH:mm:ss";
     } else {
-        layoutParameters.dateTimeFormat = layoutParameters.localizer.dateTimeFormatWithoutSeconds();
+        layoutParameters.dateTimeFormat = layoutParameters.locale.dateTimeFormatWithoutSeconds();
         layoutParameters.fallbackDateTimeFormat = "dd/MM/yyyy HH:mm";
     }
     layoutParameters.minimumYear = fullYear(element()->fastGetAttribute(minAttr));
diff --git a/Source/WebCore/html/DateTimeLocalInputType.h b/Source/WebCore/html/DateTimeLocalInputType.h
index d8ec63823..c0e7d16df 100644
--- a/Source/WebCore/html/DateTimeLocalInputType.h
+++ b/Source/WebCore/html/DateTimeLocalInputType.h
@@ -32,6 +32,7 @@
 #define DateTimeLocalInputType_h
 
 #if ENABLE(INPUT_TYPE_DATETIMELOCAL)
+#include "BaseChooserOnlyDateAndTimeInputType.h"
 #include "BaseMultipleFieldsDateAndTimeInputType.h"
 
 namespace WebCore {
@@ -39,7 +40,7 @@ namespace WebCore {
 #if ENABLE(INPUT_MULTIPLE_FIELDS_UI)
 typedef BaseMultipleFieldsDateAndTimeInputType BaseDateTimeLocalInputType;
 #else
-typedef BaseDateAndTimeInputType BaseDateTimeLocalInputType;
+typedef BaseChooserOnlyDateAndTimeInputType BaseDateTimeLocalInputType;
 #endif
 
 class DateTimeLocalInputType : public BaseDateTimeLocalInputType {
diff --git a/Source/WebCore/html/FTPDirectoryDocument.cpp b/Source/WebCore/html/FTPDirectoryDocument.cpp
index 8fefc201e..c1a0150e3 100644
--- a/Source/WebCore/html/FTPDirectoryDocument.cpp
+++ b/Source/WebCore/html/FTPDirectoryDocument.cpp
@@ -431,7 +431,7 @@ void FTPDirectoryDocumentParser::finish()
 FTPDirectoryDocument::FTPDirectoryDocument(Frame* frame, const KURL& url)
     : HTMLDocument(frame, url)
 {
-#ifndef NDEBUG
+#if !LOG_DISABLED
     LogFTP.state = WTFLogChannelOn;
 #endif
 }
diff --git a/Source/WebCore/html/HTMLAnchorElement.cpp b/Source/WebCore/html/HTMLAnchorElement.cpp
index 7b777be13..a3699bbb5 100644
--- a/Source/WebCore/html/HTMLAnchorElement.cpp
+++ b/Source/WebCore/html/HTMLAnchorElement.cpp
@@ -463,7 +463,7 @@ void HTMLAnchorElement::setSearch(const String& value)
     KURL url = href();
     String newSearch = (value[0] == '?') ? value.substring(1) : value;
     // Make sure that '#' in the query does not leak to the hash.
-    url.setQuery(newSearch.replace('#', "%23"));
+    url.setQuery(newSearch.replaceWithLiteral('#', "%23"));
 
     setHref(url.string());
 }
diff --git a/Source/WebCore/html/HTMLAttributeNames.in b/Source/WebCore/html/HTMLAttributeNames.in
index 459078f64..ea8c01512 100644
--- a/Source/WebCore/html/HTMLAttributeNames.in
+++ b/Source/WebCore/html/HTMLAttributeNames.in
@@ -165,6 +165,8 @@ novalidate
 nowrap
 object
 onabort
+onautocomplete
+onautocompleteerror
 onbeforecopy
 onbeforecut
 onbeforeload
@@ -272,6 +274,7 @@ primary
 profile
 progress
 prompt
+pseudo
 readonly
 rel
 required
diff --git a/Source/WebCore/html/HTMLElementsAllInOne.cpp b/Source/WebCore/html/HTMLElementsAllInOne.cpp
index 8847ae120..d517c8458 100644
--- a/Source/WebCore/html/HTMLElementsAllInOne.cpp
+++ b/Source/WebCore/html/HTMLElementsAllInOne.cpp
@@ -111,3 +111,4 @@
 #include "HTMLTitleElement.cpp"
 #include "HTMLUListElement.cpp"
 #include "HTMLVideoElement.cpp"
+
diff --git a/Source/WebCore/html/HTMLFormControlElement.cpp b/Source/WebCore/html/HTMLFormControlElement.cpp
index 437be051a..cf16f4310 100644
--- a/Source/WebCore/html/HTMLFormControlElement.cpp
+++ b/Source/WebCore/html/HTMLFormControlElement.cpp
@@ -498,4 +498,11 @@ HTMLFormControlElement* HTMLFormControlElement::enclosingFormControlElement(Node
     return 0;
 }
 
+void HTMLFormControlElement::reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
+{
+    MemoryClassInfo info(memoryObjectInfo, this, WebCoreMemoryTypes::DOM);
+    LabelableElement::reportMemoryUsage(memoryObjectInfo);
+    info.addMember(m_validationMessage);
+}
+
 } // namespace Webcore
diff --git a/Source/WebCore/html/HTMLFormControlElement.h b/Source/WebCore/html/HTMLFormControlElement.h
index 24de97669..b88b1b08b 100644
--- a/Source/WebCore/html/HTMLFormControlElement.h
+++ b/Source/WebCore/html/HTMLFormControlElement.h
@@ -112,6 +112,8 @@ public:
     using Node::ref;
     using Node::deref;
 
+    virtual void reportMemoryUsage(MemoryObjectInfo*) const OVERRIDE;
+
 protected:
     HTMLFormControlElement(const QualifiedName& tagName, Document*, HTMLFormElement*);
 
diff --git a/Source/WebCore/html/HTMLFormElement.cpp b/Source/WebCore/html/HTMLFormElement.cpp
index 0a251415f..18ac7092c 100644
--- a/Source/WebCore/html/HTMLFormElement.cpp
+++ b/Source/WebCore/html/HTMLFormElement.cpp
@@ -26,7 +26,6 @@
 #include "HTMLFormElement.h"
 
 #include "Attribute.h"
-#include "Console.h"
 #include "DOMFormData.h"
 #include "DOMWindow.h"
 #include "Document.h"
@@ -75,6 +74,9 @@ HTMLFormElement::HTMLFormElement(const QualifiedName& tagName, Document* documen
     , m_shouldSubmit(false)
     , m_isInResetFunction(false)
     , m_wasDemoted(false)
+#if ENABLE(REQUEST_AUTOCOMPLETE)
+    , m_requestAutocompleteTimer(this, &HTMLFormElement::requestAutocompleteTimerFired)
+#endif
 {
     ASSERT(hasTagName(formTag));
 }
@@ -257,7 +259,7 @@ bool HTMLFormElement::validateInteractively(Event* event)
                 continue;
             String message("An invalid form control with name='%name' is not focusable.");
             message.replace("%name", unhandledAssociatedElement->name());
-            document()->domWindow()->console()->addMessage(HTMLMessageSource, LogMessageType, ErrorMessageLevel, message, document()->url().string());
+            document()->addConsoleMessage(HTMLMessageSource, LogMessageType, ErrorMessageLevel, message, document()->url().string());
         }
     }
     return false;
@@ -388,6 +390,44 @@ void HTMLFormElement::reset()
     m_isInResetFunction = false;
 }
 
+#if ENABLE(REQUEST_AUTOCOMPLETE)
+void HTMLFormElement::requestAutocomplete()
+{
+    Frame* frame = document()->frame();
+    if (!frame)
+        return;
+
+    if (!shouldAutocomplete()) {
+        finishRequestAutocomplete(AutocompleteResultError);
+        return;
+    }
+
+    StringPairVector controlNamesAndValues;
+    getTextFieldValues(controlNamesAndValues);
+    RefPtr<FormState> formState = FormState::create(this, controlNamesAndValues, document(), SubmittedByJavaScript);
+    frame->loader()->client()->didRequestAutocomplete(formState.release());
+}
+
+void HTMLFormElement::finishRequestAutocomplete(AutocompleteResult result)
+{
+    RefPtr<Event> event(Event::create(result == AutocompleteResultSuccess ? eventNames().autocompleteEvent : eventNames().autocompleteerrorEvent, false, false));
+    event->setTarget(this);
+    m_pendingAutocompleteEvents.append(event.release());
+
+    // Dispatch events later as this API is meant to work asynchronously in all situations and implementations.
+    if (!m_requestAutocompleteTimer.isActive())
+        m_requestAutocompleteTimer.startOneShot(0);
+}
+
+void HTMLFormElement::requestAutocompleteTimerFired(Timer<HTMLFormElement>*)
+{
+    Vector<RefPtr<Event> > pendingEvents;
+    m_pendingAutocompleteEvents.swap(pendingEvents);
+    for (size_t i = 0; i < pendingEvents.size(); ++i)
+        dispatchEvent(pendingEvents[i].release());
+}
+#endif
+
 void HTMLFormElement::parseAttribute(const Attribute& attribute)
 {
     if (attribute.name() == actionAttr)
@@ -409,6 +449,12 @@ void HTMLFormElement::parseAttribute(const Attribute& attribute)
         setAttributeEventListener(eventNames().submitEvent, createAttributeEventListener(this, attribute));
     else if (attribute.name() == onresetAttr)
         setAttributeEventListener(eventNames().resetEvent, createAttributeEventListener(this, attribute));
+#if ENABLE(REQUEST_AUTOCOMPLETE)
+    else if (attribute.name() == onautocompleteAttr)
+        setAttributeEventListener(eventNames().autocompleteEvent, createAttributeEventListener(this, attribute));
+    else if (attribute.name() == onautocompleteerrorAttr)
+        setAttributeEventListener(eventNames().autocompleteerrorEvent, createAttributeEventListener(this, attribute));
+#endif
     else
         HTMLElement::parseAttribute(attribute);
 }
diff --git a/Source/WebCore/html/HTMLFormElement.h b/Source/WebCore/html/HTMLFormElement.h
index bf28cca3f..a8c2bee45 100644
--- a/Source/WebCore/html/HTMLFormElement.h
+++ b/Source/WebCore/html/HTMLFormElement.h
@@ -99,6 +99,16 @@ public:
 
     bool checkValidity();
 
+#if ENABLE(REQUEST_AUTOCOMPLETE)
+    enum AutocompleteResult { AutocompleteResultSuccess, AutocompleteResultError };
+
+    void requestAutocomplete();
+    void finishRequestAutocomplete(AutocompleteResult);
+
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(autocomplete);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(autocompleteerror);
+#endif
+
     HTMLFormControlElement* elementForAlias(const AtomicString&);
     void addElementAlias(HTMLFormControlElement*, const AtomicString& alias);
 
@@ -162,6 +172,13 @@ private:
     bool m_isInResetFunction;
 
     bool m_wasDemoted;
+
+#if ENABLE(REQUEST_AUTOCOMPLETE)
+    void requestAutocompleteTimerFired(Timer<HTMLFormElement>*);
+
+    Vector<RefPtr<Event> > m_pendingAutocompleteEvents;
+    Timer<HTMLFormElement> m_requestAutocompleteTimer;
+#endif
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/html/HTMLFormElement.idl b/Source/WebCore/html/HTMLFormElement.idl
index 86a6f74c6..8ad6c27ba 100644
--- a/Source/WebCore/html/HTMLFormElement.idl
+++ b/Source/WebCore/html/HTMLFormElement.idl
@@ -42,4 +42,10 @@
 #endif
     void reset();
     boolean checkValidity();
+
+#if defined(ENABLE_REQUEST_AUTOCOMPLETE) && ENABLE_REQUEST_AUTOCOMPLETE
+    [V8EnabledAtRuntime=requestAutocomplete] void requestAutocomplete();
+    [V8EnabledAtRuntime=requestAutocomplete,NotEnumerable] attribute EventListener onautocomplete;
+    [V8EnabledAtRuntime=requestAutocomplete,NotEnumerable] attribute EventListener onautocompleteerror;
+#endif
 };
diff --git a/Source/WebCore/html/HTMLInputElement.cpp b/Source/WebCore/html/HTMLInputElement.cpp
index 4f21a0f43..8bdd6bcbc 100644
--- a/Source/WebCore/html/HTMLInputElement.cpp
+++ b/Source/WebCore/html/HTMLInputElement.cpp
@@ -33,6 +33,7 @@
 #include "BeforeTextInsertedEvent.h"
 #include "CSSPropertyNames.h"
 #include "CSSValueKeywords.h"
+#include "DateTimeChooser.h"
 #include "Document.h"
 #include "EventNames.h"
 #include "ExceptionCode.h"
@@ -40,6 +41,7 @@
 #include "FileList.h"
 #include "FormController.h"
 #include "Frame.h"
+#include "FrameView.h"
 #include "HTMLCollection.h"
 #include "HTMLDataListElement.h"
 #include "HTMLFormElement.h"
@@ -54,6 +56,7 @@
 #include "NumberInputType.h"
 #include "RenderTextControlSingleLine.h"
 #include "RenderTheme.h"
+#include "ScopedEventQueue.h"
 #include "SearchInputType.h"
 #include "ShadowRoot.h"
 #include "ScriptEventListener.h"
@@ -1006,12 +1009,22 @@ void HTMLInputElement::setEditingValue(const String& value)
     dispatchInputEvent();
 }
 
+void HTMLInputElement::setValue(const String& value, ExceptionCode& ec, TextFieldEventBehavior eventBehavior)
+{
+    if (isFileUpload() && !value.isEmpty()) {
+        ec = INVALID_STATE_ERR;
+        return;
+    }
+    setValue(value, eventBehavior);
+}
+
 void HTMLInputElement::setValue(const String& value, TextFieldEventBehavior eventBehavior)
 {
     if (!m_inputType->canSetValue(value))
         return;
 
     RefPtr<HTMLInputElement> protector(this);
+    EventQueueScope scope;
     String sanitizedValue = sanitizeValue(value);
     bool valueChanged = sanitizedValue != this->value();
 
@@ -1733,13 +1746,6 @@ bool HTMLInputElement::supportsPlaceholder() const
     return m_inputType->supportsPlaceholder();
 }
 
-bool HTMLInputElement::isPlaceholderEmpty() const
-{
-    if (m_inputType->usesFixedPlaceholder())
-        return m_inputType->fixedPlaceholder().isEmpty();
-    return HTMLTextFormControlElement::isPlaceholderEmpty();
-}
-
 void HTMLInputElement::updatePlaceholderText()
 {
     return m_inputType->updatePlaceholderText();
@@ -1897,4 +1903,56 @@ void HTMLInputElement::setRangeText(const String& replacement, unsigned start, u
     HTMLTextFormControlElement::setRangeText(replacement, start, end, selectionMode, ec);
 }
 
+#if ENABLE(DATE_AND_TIME_INPUT_TYPES)
+bool HTMLInputElement::setupDateTimeChooserParameters(DateTimeChooserParameters& parameters)
+{
+    if (!document()->view())
+        return false;
+
+    parameters.type = type();
+    parameters.minimum = minimum();
+    parameters.maximum = maximum();
+    parameters.required = required();
+
+    StepRange stepRange = createStepRange(RejectAny);
+    if (stepRange.hasStep()) {
+        parameters.step = stepRange.step().toDouble();
+        parameters.stepBase = stepRange.stepBase().toDouble();
+    } else {
+        parameters.step = 1.0;
+        parameters.stepBase = 0;
+    }
+
+    parameters.anchorRectInRootView = document()->view()->contentsToRootView(pixelSnappedBoundingBox());
+    parameters.currentValue = value();
+    parameters.isAnchorElementRTL = computedStyle()->direction() == RTL;
+#if ENABLE(DATALIST_ELEMENT)
+    if (HTMLDataListElement* dataList = this->dataList()) {
+        RefPtr<HTMLCollection> options = dataList->options();
+        for (unsigned i = 0; HTMLOptionElement* option = toHTMLOptionElement(options->item(i)); ++i) {
+            if (!isValidValue(option->value()))
+                continue;
+            parameters.suggestionValues.append(sanitizeValue(option->value()));
+            parameters.localizedSuggestionValues.append(localizeValue(option->value()));
+            parameters.suggestionLabels.append(option->value() == option->label() ? String() : option->label());
+        }
+    }
+#endif
+    return true;
+}
+#endif
+
+void HTMLInputElement::reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
+{
+    MemoryClassInfo info(memoryObjectInfo, this, WebCoreMemoryTypes::DOM);
+    HTMLTextFormControlElement::reportMemoryUsage(memoryObjectInfo);
+    info.addMember(m_name);
+    info.addMember(m_valueIfDirty);
+    info.addMember(m_suggestedValue);
+    info.addMember(m_inputType);
+#if ENABLE(DATALIST_ELEMENT)
+    info.addMember(m_listAttributeTargetObserver);
+#endif
+}
+
 } // namespace
diff --git a/Source/WebCore/html/HTMLInputElement.h b/Source/WebCore/html/HTMLInputElement.h
index ac013d980..6173e8c2b 100644
--- a/Source/WebCore/html/HTMLInputElement.h
+++ b/Source/WebCore/html/HTMLInputElement.h
@@ -41,6 +41,7 @@ class Icon;
 class InputType;
 class KURL;
 class ListAttributeTargetObserver;
+struct DateTimeChooserParameters;
 
 class HTMLInputElement : public HTMLTextFormControlElement, public ImageLoaderClientBase<HTMLInputElement> {
 public:
@@ -148,6 +149,7 @@ public:
     void setType(const String&);
 
     String value() const;
+    void setValue(const String&, ExceptionCode&, TextFieldEventBehavior = DispatchNoEvent);
     void setValue(const String&, TextFieldEventBehavior = DispatchNoEvent);
     void setValueForUser(const String&);
     // Checks if the specified string would be a valid value.
@@ -290,6 +292,11 @@ public:
     virtual void setRangeText(const String& replacement, ExceptionCode&) OVERRIDE;
     virtual void setRangeText(const String& replacement, unsigned start, unsigned end, const String& selectionMode, ExceptionCode&) OVERRIDE;
 
+#if ENABLE(DATE_AND_TIME_INPUT_TYPES)
+    bool setupDateTimeChooserParameters(DateTimeChooserParameters&);
+#endif
+    virtual void reportMemoryUsage(MemoryObjectInfo*) const OVERRIDE;
+
 protected:
     HTMLInputElement(const QualifiedName&, Document*, HTMLFormElement*, bool createdByParser);
     void createShadowSubtree();
@@ -368,7 +375,6 @@ private:
     bool tooLong(const String&, NeedsToCheckDirtyFlag) const;
 
     virtual bool supportsPlaceholder() const;
-    virtual bool isPlaceholderEmpty() const OVERRIDE;
     virtual void updatePlaceholderText();
     virtual bool isEmptyValue() const OVERRIDE { return innerTextValue().isEmpty(); }
     virtual bool isEmptySuggestedValue() const { return suggestedValue().isEmpty(); }
diff --git a/Source/WebCore/html/HTMLInputElement.idl b/Source/WebCore/html/HTMLInputElement.idl
index 4a86fe23f..9315f67ba 100644
--- a/Source/WebCore/html/HTMLInputElement.idl
+++ b/Source/WebCore/html/HTMLInputElement.idl
@@ -56,7 +56,7 @@ interface HTMLInputElement : HTMLElement {
     [Reflect] attribute DOMString step;
     [TreatNullAs=NullString] attribute DOMString type; // readonly dropped as part of DOM level 2
     [TreatNullAs=NullString] attribute DOMString defaultValue;
-    [TreatNullAs=NullString] attribute DOMString value;
+    [TreatNullAs=NullString] attribute DOMString value setter raises(DOMException);
 #if !defined(LANGUAGE_CPP) || !LANGUAGE_CPP
     attribute Date valueAsDate setter raises(DOMException);
 #endif
diff --git a/Source/WebCore/html/HTMLMediaElement.cpp b/Source/WebCore/html/HTMLMediaElement.cpp
index 753242110..b0655cdf7 100644
--- a/Source/WebCore/html/HTMLMediaElement.cpp
+++ b/Source/WebCore/html/HTMLMediaElement.cpp
@@ -69,6 +69,7 @@
 #include "MIMETypeRegistry.h"
 #include "NodeRenderingContext.h"
 #include "Page.h"
+#include "PageGroup.h"
 #include "RenderVideo.h"
 #include "RenderView.h"
 #include "ScriptController.h"
@@ -281,6 +282,14 @@ HTMLMediaElement::HTMLMediaElement(const QualifiedName& tagName, Document* docum
 
     setHasCustomCallbacks();
     addElementToDocumentMap(this, document);
+
+#if ENABLE(VIDEO_TRACK)
+    if (document->page()) {
+        PageGroup& group = document->page()->group();
+        if (group.userHasCaptionPreferences())
+            m_disableCaptions = !group.userPrefersCaptions();
+    }
+#endif
 }
 
 HTMLMediaElement::~HTMLMediaElement()
@@ -354,8 +363,10 @@ void HTMLMediaElement::parseAttribute(const Attribute& attribute)
 {
     if (attribute.name() == srcAttr) {
         // Trigger a reload, as long as the 'src' attribute is present.
-        if (fastHasAttribute(srcAttr))
+        if (fastHasAttribute(srcAttr)) {
+            clearMediaPlayer(MediaResource);
             scheduleLoad(MediaResource);
+        }
     } else if (attribute.name() == controlsAttr)
         configureMediaControls();
 #if PLATFORM(MAC)
@@ -541,6 +552,20 @@ void HTMLMediaElement::attach()
             frame->loader()->client()->hideMediaPlayerProxyPlugin(m_proxyWidget.get());
     }
 #endif
+
+#if ENABLE(VIDEO_TRACK)
+    if (document()->page())
+        document()->page()->group().registerForCaptionPreferencesChangedCallbacks(this);
+#endif
+}
+
+void HTMLMediaElement::detach()
+{
+#if ENABLE(VIDEO_TRACK)
+    if (document()->page())
+        document()->page()->group().unregisterForCaptionPreferencesChangedCallbacks(this);
+#endif
+    HTMLElement::detach();
 }
 
 void HTMLMediaElement::didRecalcStyle(StyleChange)
@@ -893,8 +918,7 @@ static KURL createFileURLForApplicationCacheResource(const String& path)
     // app cache media files are always created with encodeForFileName(createCanonicalUUIDString()).
 
 #if USE(CF) && PLATFORM(WIN)
-    RetainPtr<CFStringRef> cfPath(AdoptCF, path.createCFString());
-    RetainPtr<CFURLRef> cfURL(AdoptCF, CFURLCreateWithFileSystemPath(0, cfPath.get(), kCFURLWindowsPathStyle, false));
+    RetainPtr<CFURLRef> cfURL(AdoptCF, CFURLCreateWithFileSystemPath(0, path.createCFString().get(), kCFURLWindowsPathStyle, false));
     KURL url(cfURL.get());
 #else
     KURL url;
@@ -925,10 +949,9 @@ void HTMLMediaElement::loadResource(const KURL& initialURL, ContentType& content
     }
     
 #if ENABLE(MEDIA_SOURCE)
-    if (url.protocolIs(mediaSourceBlobProtocol)) {
-        if (m_mediaSource)
-            m_mediaSource->setReadyState(MediaSource::closedKeyword());
+    ASSERT(!m_mediaSource);
 
+    if (url.protocolIs(mediaSourceBlobProtocol)) {
         m_mediaSource = MediaSourceRegistry::registry().lookupMediaSource(url.string());
 
         if (m_mediaSource) {
@@ -2396,6 +2419,8 @@ void HTMLMediaElement::setSourceState(const String& state)
          return;
 
     m_mediaSource->setReadyState(state);
+    if (state == MediaSource::closedKeyword())
+        m_mediaSource = 0;
 }
 #endif
 
@@ -2806,33 +2831,43 @@ void HTMLMediaElement::willRemoveTrack(HTMLTrackElement* trackElement)
     // then the user agent must remove the track element's corresponding text track from the 
     // media element's list of text tracks.
     m_textTracks->remove(textTrack.get());
+    if (textTrack->cues()) {
+        TextTrackCueList* cues = textTrack->cues();
+        beginIgnoringTrackDisplayUpdateRequests();
+        for (size_t i = 0; i < cues->length(); ++i)
+            textTrackRemoveCue(cues->item(i)->track(), cues->item(i));
+        endIgnoringTrackDisplayUpdateRequests();
+    }
+
     size_t index = m_textTracksWhenResourceSelectionBegan.find(textTrack.get());
     if (index != notFound)
         m_textTracksWhenResourceSelectionBegan.remove(index);
 }
 
-bool HTMLMediaElement::userIsInterestedInThisLanguage(const String&) const
+bool HTMLMediaElement::userPrefersCaptions() const
 {
-    // FIXME: check the user's language preference - bugs.webkit.org/show_bug.cgi?id=74121
-    return true;
+    Page* page = document()->page();
+    if (!page)
+        return false;
+
+    PageGroup& group = page->group();
+    return group.userHasCaptionPreferences() && group.userPrefersCaptions();
 }
 
 bool HTMLMediaElement::userIsInterestedInThisTrackKind(String kind) const
 {
-    // If ... the user has indicated an interest in having a track with this text track kind, text track language, ... 
     if (m_disableCaptions)
         return false;
 
     Settings* settings = document()->settings();
-    if (!settings)
-        return false;
+    bool userPrefersCaptionsOrSubtitles = m_closedCaptionsVisible || userPrefersCaptions();
 
     if (kind == TextTrack::subtitlesKeyword())
-        return settings->shouldDisplaySubtitles() || m_closedCaptionsVisible;
+        return (settings && settings->shouldDisplaySubtitles()) || userPrefersCaptionsOrSubtitles;
     if (kind == TextTrack::captionsKeyword())
-        return settings->shouldDisplayCaptions() || m_closedCaptionsVisible;
+        return (settings && settings->shouldDisplayCaptions()) || userPrefersCaptionsOrSubtitles;
     if (kind == TextTrack::descriptionsKeyword())
-        return settings->shouldDisplayTextDescriptions() || m_closedCaptionsVisible;
+        return settings && settings->shouldDisplayTextDescriptions();
 
     return false;
 }
@@ -3644,13 +3679,7 @@ void HTMLMediaElement::userCancelledLoad()
     // If the media data fetching process is aborted by the user:
 
     // 1 - The user agent should cancel the fetching process.
-#if !ENABLE(PLUGIN_PROXY_FOR_VIDEO)
-    m_player.clear();
-#endif
-    stopPeriodicTimers();
-    m_loadTimer.stop();
-    m_loadState = WaitingForSource;
-    m_pendingLoadFlags = 0;
+    clearMediaPlayer(-1);
 
     // 2 - Set the error attribute to a new MediaError object whose code attribute is set to MEDIA_ERR_ABORTED.
     m_error = MediaError::create(MediaError::MEDIA_ERR_ABORTED);
@@ -3688,6 +3717,18 @@ void HTMLMediaElement::userCancelledLoad()
 #endif
 }
 
+void HTMLMediaElement::clearMediaPlayer(signed flags)
+{
+#if !ENABLE(PLUGIN_PROXY_FOR_VIDEO)
+    m_player.clear();
+#endif
+    stopPeriodicTimers();
+    m_loadTimer.stop();
+
+    m_pendingLoadFlags &= ~flags;
+    m_loadState = WaitingForSource;
+}
+
 bool HTMLMediaElement::canSuspend() const
 {
     return true; 
@@ -3997,22 +4038,8 @@ void HTMLMediaElement::setClosedCaptionsVisible(bool closedCaptionVisible)
 #if ENABLE(VIDEO_TRACK)
     if (RuntimeEnabledFeatures::webkitVideoTrackEnabled()) {
         m_disableCaptions = !m_closedCaptionsVisible;
-        
-        // Mark all track elements as not "configured" so that configureTextTracks()
-        // will reconsider which tracks to display in light of new user preferences
-        // (e.g. default tracks should not be displayed if the user has turned off
-        // captions and non-default tracks should be displayed based on language
-        // preferences if the user has turned captions on).
-        for (Node* node = firstChild(); node; node = node->nextSibling()) {
-            if (!node->hasTagName(trackTag))
-                continue;
-            HTMLTrackElement* trackElement = static_cast<HTMLTrackElement*>(node);
-            if (trackElement->kind() == TextTrack::captionsKeyword()
-                || trackElement->kind() == TextTrack::subtitlesKeyword())
-                trackElement->setHasBeenConfigured(false);
-        }
 
-        configureTextTracks();
+        markCaptionAndSubtitleTracksAsUnconfigured();
     }
 #else
     if (hasMediaControls())
@@ -4160,6 +4187,9 @@ void HTMLMediaElement::configureMediaControls()
 
     mediaControls()->show();
 #else
+    if (!hasMediaControls())
+        createMediaControls();
+
     if (m_player)
         m_player->setControls(controls());
 #endif
@@ -4200,6 +4230,39 @@ void HTMLMediaElement::updateClosedCaptionsControls()
             mediaControls()->updateTextTrackDisplay();
     }
 }
+
+void HTMLMediaElement::captionPreferencesChanged()
+{
+    if (!isVideo())
+        return;
+
+    markCaptionAndSubtitleTracksAsUnconfigured();
+}
+
+void HTMLMediaElement::markCaptionAndSubtitleTracksAsUnconfigured()
+{
+    // Mark all track elements as not "configured" so that configureTextTracks()
+    // will reconsider which tracks to display in light of new user preferences
+    // (e.g. default tracks should not be displayed if the user has turned off
+    // captions and non-default tracks should be displayed based on language
+    // preferences if the user has turned captions on).
+    for (RefPtr<Node> node = firstChild(); node; node = node->nextSibling()) {
+        if (!node->hasTagName(trackTag))
+            continue;
+        
+        HTMLTrackElement* trackElement = static_cast<HTMLTrackElement*>(node.get());
+        RefPtr<TextTrack> textTrack = trackElement->track();
+        if (!textTrack)
+            continue;
+        
+        String kind = textTrack->kind();
+
+        if (kind == TextTrack::subtitlesKeyword() || kind == TextTrack::captionsKeyword())
+            trackElement->setHasBeenConfigured(false);
+    }
+    configureTextTracks();
+}
+
 #endif
 
 void* HTMLMediaElement::preDispatchEventHandler(Event* event)
@@ -4216,7 +4279,7 @@ void HTMLMediaElement::createMediaPlayer()
     if (m_audioSourceNode)
         m_audioSourceNode->lock();
 #endif
-        
+
     m_player = MediaPlayer::create(this);
 
 #if ENABLE(MEDIA_SOURCE)
@@ -4468,11 +4531,26 @@ String HTMLMediaElement::mediaPlayerDocumentHost() const
     return document()->url().host();
 }
 
+void HTMLMediaElement::mediaPlayerEnterFullscreen()
+{
+    enterFullscreen();
+}
+
 void HTMLMediaElement::mediaPlayerExitFullscreen()
 {
     exitFullscreen();
 }
 
+bool HTMLMediaElement::mediaPlayerIsFullscreen() const
+{
+    return isFullscreen();
+}
+
+bool HTMLMediaElement::mediaPlayerIsFullscreenPermitted() const
+{
+    return !userGestureRequiredForFullscreen() || ScriptController::processingUserGesture();
+}
+
 bool HTMLMediaElement::mediaPlayerIsVideo() const
 {
     return isVideo();
diff --git a/Source/WebCore/html/HTMLMediaElement.h b/Source/WebCore/html/HTMLMediaElement.h
index b698c6b2d..872d3083a 100644
--- a/Source/WebCore/html/HTMLMediaElement.h
+++ b/Source/WebCore/html/HTMLMediaElement.h
@@ -40,6 +40,7 @@
 #endif
 
 #if ENABLE(VIDEO_TRACK)
+#include "CaptionUserPreferences.h"
 #include "PODIntervalTree.h"
 #include "TextTrack.h"
 #include "TextTrackCue.h"
@@ -78,7 +79,7 @@ typedef Vector<CueIntervalTree::IntervalType> CueList;
 
 class HTMLMediaElement : public HTMLElement, public MediaPlayerClient, public MediaPlayerSupportsTypeClient, private MediaCanStartListener, public ActiveDOMObject, public MediaControllerInterface
 #if ENABLE(VIDEO_TRACK)
-    , private TextTrackClient
+    , private TextTrackClient, private CaptionPreferencesChangedListener
 #endif
 {
 public:
@@ -240,6 +241,7 @@ public:
     void configureTextTracks();
     void configureTextTrackGroup(const TrackGroup&) const;
 
+    bool userPrefersCaptions() const;
     bool userIsInterestedInThisTrackKind(String) const;
     bool textTracksAreReady() const;
     void configureTextTrackDisplay();
@@ -325,7 +327,8 @@ protected:
     virtual void parseAttribute(const Attribute&) OVERRIDE;
     virtual void finishParsingChildren();
     virtual bool isURLAttribute(const Attribute&) const OVERRIDE;
-    virtual void attach();
+    virtual void attach() OVERRIDE;
+    virtual void detach() OVERRIDE;
 
     virtual void didMoveToNewDocument(Document* oldDocument) OVERRIDE;
 
@@ -425,7 +428,10 @@ private:
     virtual bool mediaPlayerNeedsSiteSpecificHacks() const OVERRIDE;
     virtual String mediaPlayerDocumentHost() const OVERRIDE;
 
+    virtual void mediaPlayerEnterFullscreen() OVERRIDE;
     virtual void mediaPlayerExitFullscreen() OVERRIDE;
+    virtual bool mediaPlayerIsFullscreen() const OVERRIDE;
+    virtual bool mediaPlayerIsFullscreenPermitted() const OVERRIDE;
     virtual bool mediaPlayerIsVideo() const OVERRIDE;
     virtual LayoutRect mediaPlayerContentBoxRect() const OVERRIDE;
     virtual void mediaPlayerSetSize(const IntSize&) OVERRIDE;
@@ -461,6 +467,7 @@ private:
     void scheduleNextSourceChild();
     void loadNextSourceChild();
     void userCancelledLoad();
+    void clearMediaPlayer(signed flags);
     bool havePotentialSourceChild();
     void noneSupported();
     void mediaEngineError(PassRefPtr<MediaError> err);
@@ -474,12 +481,14 @@ private:
 
 #if ENABLE(VIDEO_TRACK)
     void updateActiveTextTrackCues(float);
-    bool userIsInterestedInThisLanguage(const String&) const;
     HTMLTrackElement* showingTrackWithSameKind(HTMLTrackElement*) const;
 
     bool ignoreTrackDisplayUpdateRequests() const { return m_ignoreTrackDisplayUpdate > 0; }
     void beginIgnoringTrackDisplayUpdateRequests() { ++m_ignoreTrackDisplayUpdate; }
     void endIgnoringTrackDisplayUpdateRequests() { ASSERT(m_ignoreTrackDisplayUpdate); --m_ignoreTrackDisplayUpdate; }
+
+    void markCaptionAndSubtitleTracksAsUnconfigured();
+    virtual void captionPreferencesChanged() OVERRIDE;
 #endif
 
     // These "internal" functions do not check user gesture restrictions.
diff --git a/Source/WebCore/html/HTMLOptGroupElement.cpp b/Source/WebCore/html/HTMLOptGroupElement.cpp
index 1ff6a7d22..c95b1ff41 100644
--- a/Source/WebCore/html/HTMLOptGroupElement.cpp
+++ b/Source/WebCore/html/HTMLOptGroupElement.cpp
@@ -42,6 +42,7 @@ inline HTMLOptGroupElement::HTMLOptGroupElement(const QualifiedName& tagName, Do
     : HTMLElement(tagName, document)
 {
     ASSERT(hasTagName(optgroupTag));
+    setHasCustomCallbacks();
 }
 
 PassRefPtr<HTMLOptGroupElement> HTMLOptGroupElement::create(const QualifiedName& tagName, Document* document)
@@ -94,9 +95,12 @@ void HTMLOptGroupElement::recalcSelectOptions()
 
 void HTMLOptGroupElement::attach()
 {
-    if (parentNode()->renderStyle())
-        setRenderStyle(styleForRenderer());
     HTMLElement::attach();
+    // If after attaching nothing called styleForRenderer() on this node we
+    // manually cache the value. This happens if our parent doesn't have a
+    // renderer like <optgroup> or if it doesn't allow children like <select>.
+    if (!m_style && parentNode()->renderStyle())
+        updateNonRenderStyle();
 }
 
 void HTMLOptGroupElement::detach()
@@ -105,14 +109,22 @@ void HTMLOptGroupElement::detach()
     HTMLElement::detach();
 }
 
-void HTMLOptGroupElement::setRenderStyle(PassRefPtr<RenderStyle> newStyle)
+void HTMLOptGroupElement::updateNonRenderStyle()
 {
-    m_style = newStyle;
+    m_style = document()->styleResolver()->styleForElement(this);
 }
-    
-RenderStyle* HTMLOptGroupElement::nonRendererRenderStyle() const 
-{ 
-    return m_style.get(); 
+
+RenderStyle* HTMLOptGroupElement::nonRendererStyle() const
+{
+    return m_style.get();
+}
+
+PassRefPtr<RenderStyle> HTMLOptGroupElement::customStyleForRenderer()
+{
+    // styleForRenderer is called whenever a new style should be associated
+    // with an Element so now is a good time to update our cached style.
+    updateNonRenderStyle();
+    return m_style;
 }
 
 String HTMLOptGroupElement::groupLabelText() const
diff --git a/Source/WebCore/html/HTMLOptGroupElement.h b/Source/WebCore/html/HTMLOptGroupElement.h
index 0b4387306..c6ad359b4 100644
--- a/Source/WebCore/html/HTMLOptGroupElement.h
+++ b/Source/WebCore/html/HTMLOptGroupElement.h
@@ -50,14 +50,16 @@ private:
     virtual bool rendererIsNeeded(const NodeRenderingContext&) { return false; }
     virtual void attach();
     virtual void detach();
-    virtual void setRenderStyle(PassRefPtr<RenderStyle>);
 
     virtual void childrenChanged(bool changedByParser = false, Node* beforeChange = 0, Node* afterChange = 0, int childCountDelta = 0);
 
     virtual void accessKeyAction(bool sendMouseEvents);
-    
-    virtual RenderStyle* nonRendererRenderStyle() const;
-    
+
+    // <optgroup> never has a renderer so we manually manage a cached style.
+    void updateNonRenderStyle();
+    virtual RenderStyle* nonRendererStyle() const OVERRIDE;
+    virtual PassRefPtr<RenderStyle> customStyleForRenderer() OVERRIDE;
+
     void recalcSelectOptions();
 
     RefPtr<RenderStyle> m_style;
diff --git a/Source/WebCore/html/HTMLOptionElement.cpp b/Source/WebCore/html/HTMLOptionElement.cpp
index 8fcc22c27..b03c7f9ad 100644
--- a/Source/WebCore/html/HTMLOptionElement.cpp
+++ b/Source/WebCore/html/HTMLOptionElement.cpp
@@ -55,6 +55,7 @@ HTMLOptionElement::HTMLOptionElement(const QualifiedName& tagName, Document* doc
     , m_isSelected(false)
 {
     ASSERT(hasTagName(optionTag));
+    setHasCustomCallbacks();
 }
 
 PassRefPtr<HTMLOptionElement> HTMLOptionElement::create(Document* document)
@@ -90,9 +91,12 @@ PassRefPtr<HTMLOptionElement> HTMLOptionElement::createForJSConstructor(Document
 
 void HTMLOptionElement::attach()
 {
-    if (parentNode()->renderStyle())
-        setRenderStyle(styleForRenderer());
     HTMLElement::attach();
+    // If after attaching nothing called styleForRenderer() on this node we
+    // manually cache the value. This happens if our parent doesn't have a
+    // renderer like <optgroup> or if it doesn't allow children like <select>.
+    if (!m_style && parentNode()->renderStyle())
+        updateNonRenderStyle();
 }
 
 void HTMLOptionElement::detach()
@@ -305,20 +309,34 @@ void HTMLOptionElement::setLabel(const String& label)
     setAttribute(labelAttr, label);
 }
 
-void HTMLOptionElement::setRenderStyle(PassRefPtr<RenderStyle> newStyle)
+void HTMLOptionElement::updateNonRenderStyle()
 {
-    m_style = newStyle;
-    if (HTMLSelectElement* select = ownerSelectElement()) {
-        if (RenderObject* renderer = select->renderer())
-            renderer->repaint();
-    }
+    m_style = document()->styleResolver()->styleForElement(this);
 }
 
-RenderStyle* HTMLOptionElement::nonRendererRenderStyle() const
+RenderStyle* HTMLOptionElement::nonRendererStyle() const
 {
     return m_style.get();
 }
 
+PassRefPtr<RenderStyle> HTMLOptionElement::customStyleForRenderer()
+{
+    // styleForRenderer is called whenever a new style should be associated
+    // with an Element so now is a good time to update our cached style.
+    updateNonRenderStyle();
+    return m_style;
+}
+
+void HTMLOptionElement::didRecalcStyle(StyleChange)
+{
+    // FIXME: This is nasty, we ask our owner select to repaint even if the new
+    // style is exactly the same.
+    if (HTMLSelectElement* select = ownerSelectElement()) {
+        if (RenderObject* renderer = select->renderer())
+            renderer->repaint();
+    }
+}
+
 String HTMLOptionElement::textIndentedToRespectGroupLabel() const
 {
     ContainerNode* parent = parentNode();
diff --git a/Source/WebCore/html/HTMLOptionElement.h b/Source/WebCore/html/HTMLOptionElement.h
index 24cdcdb5e..8f61b304e 100644
--- a/Source/WebCore/html/HTMLOptionElement.h
+++ b/Source/WebCore/html/HTMLOptionElement.h
@@ -75,7 +75,6 @@ private:
     virtual bool rendererIsNeeded(const NodeRenderingContext&) { return false; }
     virtual void attach();
     virtual void detach();
-    virtual void setRenderStyle(PassRefPtr<RenderStyle>);
 
     virtual void parseAttribute(const Attribute&) OVERRIDE;
 
@@ -84,7 +83,12 @@ private:
 
     virtual void childrenChanged(bool changedByParser = false, Node* beforeChange = 0, Node* afterChange = 0, int childCountDelta = 0);
 
-    virtual RenderStyle* nonRendererRenderStyle() const;
+    // <option> never has a renderer so we manually manage a cached style.
+    void updateNonRenderStyle();
+    virtual RenderStyle* nonRendererStyle() const OVERRIDE;
+    virtual PassRefPtr<RenderStyle> customStyleForRenderer() OVERRIDE;
+
+    void didRecalcStyle(StyleChange) OVERRIDE;
 
     String collectOptionInnerText() const;
 
diff --git a/Source/WebCore/html/HTMLPlugInElement.cpp b/Source/WebCore/html/HTMLPlugInElement.cpp
index 2d965624a..7a9f654d7 100644
--- a/Source/WebCore/html/HTMLPlugInElement.cpp
+++ b/Source/WebCore/html/HTMLPlugInElement.cpp
@@ -78,6 +78,18 @@ bool HTMLPlugInElement::canProcessDrag() const
     return plugin ? plugin->canProcessDrag() : false;
 }
 
+bool HTMLPlugInElement::willRespondToMouseClickEvents()
+{
+    if (disabled())
+        return false;
+    RenderObject* r = renderer();
+    if (!r)
+        return false;
+    if (!r->isEmbeddedObject() && !r->isWidget())
+        return false;
+    return true;
+}
+
 void HTMLPlugInElement::detach()
 {
     m_instance.clear();
diff --git a/Source/WebCore/html/HTMLPlugInElement.h b/Source/WebCore/html/HTMLPlugInElement.h
index 859ac2edc..6fbe0e196 100644
--- a/Source/WebCore/html/HTMLPlugInElement.h
+++ b/Source/WebCore/html/HTMLPlugInElement.h
@@ -68,6 +68,8 @@ public:
 
     bool canProcessDrag() const;
 
+    virtual bool willRespondToMouseClickEvents() OVERRIDE;
+
 protected:
     HTMLPlugInElement(const QualifiedName& tagName, Document*);
 
diff --git a/Source/WebCore/html/HTMLProgressElement.cpp b/Source/WebCore/html/HTMLProgressElement.cpp
index 18402fc42..3c4c175e9 100644
--- a/Source/WebCore/html/HTMLProgressElement.cpp
+++ b/Source/WebCore/html/HTMLProgressElement.cpp
@@ -106,7 +106,8 @@ void HTMLProgressElement::parseAttribute(const Attribute& attribute)
 void HTMLProgressElement::attach()
 {
     LabelableElement::attach();
-    didElementStateChange();
+    if (RenderProgress* render = renderProgress())
+        render->updateFromElement();
 }
 
 double HTMLProgressElement::value() const
@@ -175,6 +176,7 @@ void HTMLProgressElement::createShadowSubtree()
     RefPtr<ProgressBarElement> bar = ProgressBarElement::create(document());
     RefPtr<ProgressValueElement> value = ProgressValueElement::create(document());
     m_value = value.get();
+    m_value->setWidthPercentage(HTMLProgressElement::IndeterminatePosition * 100);
     bar->appendChild(m_value, ASSERT_NO_EXCEPTION);
 
     inner->appendChild(bar, ASSERT_NO_EXCEPTION);
diff --git a/Source/WebCore/html/HTMLSelectElement.cpp b/Source/WebCore/html/HTMLSelectElement.cpp
index 936b1d146..fc68f01a6 100644
--- a/Source/WebCore/html/HTMLSelectElement.cpp
+++ b/Source/WebCore/html/HTMLSelectElement.cpp
@@ -1314,6 +1314,10 @@ void HTMLSelectElement::listBoxDefaultEventHandler(Event* event)
         if (listIndex >= 0) {
             if (!disabled()) {
                 if (m_multiple) {
+                    // Only extend selection if there is something selected.
+                    if (m_activeSelectionAnchorIndex < 0)
+                        return;
+
                     setActiveSelectionEndIndex(listIndex);
                     updateListBoxSelection(false);
                 } else {
diff --git a/Source/WebCore/html/HTMLStyleElement.cpp b/Source/WebCore/html/HTMLStyleElement.cpp
index 228c392df..22645dcfa 100644
--- a/Source/WebCore/html/HTMLStyleElement.cpp
+++ b/Source/WebCore/html/HTMLStyleElement.cpp
@@ -122,40 +122,6 @@ void HTMLStyleElement::finishParsingChildren()
     HTMLElement::finishParsingChildren();
 }
 
-inline bool HTMLStyleElement::isRegisteredAsScoped() const
-{
-    // Note: We cannot rely on the 'scoped' attribute still being present when this method is invoked.
-    // Therefore we cannot rely on scoped()!
-    if (m_scopedStyleRegistrationState == NotRegistered)
-        return false;
-    return true;
-}
-
-// These three Node methods are placed here to
-// make the header inclusion dependency sane.
-
-inline void Node::registerScopedHTMLStyleChild()
-{
-    setHasScopedHTMLStyleChild(true);
-}
-
-inline void Node::unregisterScopedHTMLStyleChild()
-{
-    ASSERT(hasScopedHTMLStyleChild());
-    setHasScopedHTMLStyleChild(numberOfScopedHTMLStyleChildren());
-}
-
-size_t Node::numberOfScopedHTMLStyleChildren() const
-{
-    size_t count = 0;
-    for (Node* child = firstChild(); child; child = child->nextSibling()) {
-        if (child->hasTagName(styleTag) && static_cast<HTMLStyleElement*>(child)->isRegisteredAsScoped())
-            count++;
-    }
-
-    return count;
-}
-
 void HTMLStyleElement::registerWithScopingNode(bool scoped)
 {
     // Note: We cannot rely on the 'scoped' element already being present when this method is invoked.
diff --git a/Source/WebCore/html/HTMLStyleElement.h b/Source/WebCore/html/HTMLStyleElement.h
index 76b28d4cf..cc9e0b207 100644
--- a/Source/WebCore/html/HTMLStyleElement.h
+++ b/Source/WebCore/html/HTMLStyleElement.h
@@ -44,7 +44,14 @@ public:
     bool scoped() const;
     void setScoped(bool);
     Element* scopingElement() const;
-    bool isRegisteredAsScoped() const;
+    bool isRegisteredAsScoped() const
+    {
+        // Note: We cannot rely on the 'scoped' attribute still being present when this method is invoked.
+        // Therefore we cannot rely on scoped()!
+        if (m_scopedStyleRegistrationState == NotRegistered)
+            return false;
+        return true;
+    }
 
     using StyleElement::sheet;
 
diff --git a/Source/WebCore/html/HTMLTagNames.in b/Source/WebCore/html/HTMLTagNames.in
index 85a1e61a5..3660ab948 100644
--- a/Source/WebCore/html/HTMLTagNames.in
+++ b/Source/WebCore/html/HTMLTagNames.in
@@ -31,7 +31,7 @@ code interfaceName=HTMLElement
 col interfaceName=HTMLTableColElement
 colgroup interfaceName=HTMLTableColElement
 command interfaceName=HTMLElement
-content interfaceName=HTMLContentElement, conditional=SHADOW_DOM, runtimeConditional=shadowDOM
+content interfaceName=HTMLContentElement, conditional=SHADOW_DOM, contextConditional=shadowDOM
 webkitShadowContent interfaceName=HTMLElement, noConstructor
 datalist interfaceName=HTMLDataListElement, conditional=DATALIST_ELEMENT
 dd interfaceName=HTMLElement
@@ -97,7 +97,7 @@ ol interfaceName=HTMLOListElement
 optgroup interfaceName=HTMLOptGroupElement
 option
 output constructorNeedsFormElement
-shadow interfaceName=HTMLShadowElement, conditional=SHADOW_DOM, runtimeConditional=shadowDOM
+shadow interfaceName=HTMLShadowElement, conditional=SHADOW_DOM, contextConditional=shadowDOM
 p interfaceName=HTMLParagraphElement
 param
 plaintext interfaceName=HTMLElement
diff --git a/Source/WebCore/html/HTMLTextFormControlElement.cpp b/Source/WebCore/html/HTMLTextFormControlElement.cpp
index 7aacfcb67..d52a82571 100644
--- a/Source/WebCore/html/HTMLTextFormControlElement.cpp
+++ b/Source/WebCore/html/HTMLTextFormControlElement.cpp
@@ -672,4 +672,11 @@ String HTMLTextFormControlElement::directionForFormData() const
     return "ltr";
 }
 
+void HTMLTextFormControlElement::reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
+{
+    MemoryClassInfo info(memoryObjectInfo, this, WebCoreMemoryTypes::DOM);
+    HTMLFormControlElementWithState::reportMemoryUsage(memoryObjectInfo);
+    info.addMember(m_textAsOfLastFormControlChangeEvent);
+}
+
 } // namespace Webcore
diff --git a/Source/WebCore/html/HTMLTextFormControlElement.h b/Source/WebCore/html/HTMLTextFormControlElement.h
index c7e869165..1faf8fcf6 100644
--- a/Source/WebCore/html/HTMLTextFormControlElement.h
+++ b/Source/WebCore/html/HTMLTextFormControlElement.h
@@ -87,9 +87,11 @@ public:
 
     void setTextAsOfLastFormControlChangeEvent(const String& text) { m_textAsOfLastFormControlChangeEvent = text; }
 
+    virtual void reportMemoryUsage(MemoryObjectInfo*) const OVERRIDE;
+
 protected:
     HTMLTextFormControlElement(const QualifiedName&, Document*, HTMLFormElement*);
-    virtual bool isPlaceholderEmpty() const;
+    bool isPlaceholderEmpty() const;
     virtual void updatePlaceholderText() = 0;
 
     virtual void parseAttribute(const Attribute&) OVERRIDE;
diff --git a/Source/WebCore/html/ImageDocument.cpp b/Source/WebCore/html/ImageDocument.cpp
index 5fc9268fb..51a0304a5 100644
--- a/Source/WebCore/html/ImageDocument.cpp
+++ b/Source/WebCore/html/ImageDocument.cpp
@@ -154,9 +154,9 @@ void ImageDocumentParser::finish()
 
         cachedImage->setResponse(document()->frame()->loader()->documentLoader()->response());
 
-        // Report the natural image size in the page title, regardless of zoom
-        // level.
-        IntSize size = cachedImage->imageSizeForRenderer(document()->imageElement()->renderer(), 1.0f);
+        // Report the natural image size in the page title, regardless of zoom level.
+        // At a zoom level of 1 the image is guaranteed to have an integer size.
+        IntSize size = flooredIntSize(cachedImage->imageSizeForRenderer(document()->imageElement()->renderer(), 1.0f));
         if (size.width()) {
             // Compute the title, we use the decoded filename of the resource, falling
             // back on the (decoded) hostname if there is no path.
diff --git a/Source/WebCore/html/InputType.cpp b/Source/WebCore/html/InputType.cpp
index 4195e8ed7..d669cd61c 100644
--- a/Source/WebCore/html/InputType.cpp
+++ b/Source/WebCore/html/InputType.cpp
@@ -871,16 +871,6 @@ bool InputType::supportsPlaceholder() const
     return false;
 }
 
-bool InputType::usesFixedPlaceholder() const
-{
-    return false;
-}
-
-String InputType::fixedPlaceholder()
-{
-    return String();
-}
-
 void InputType::updateInnerTextValue()
 {
 }
diff --git a/Source/WebCore/html/InputType.h b/Source/WebCore/html/InputType.h
index 0c2f010b7..7f02245e6 100644
--- a/Source/WebCore/html/InputType.h
+++ b/Source/WebCore/html/InputType.h
@@ -268,14 +268,7 @@ public:
     virtual bool isCheckable();
     virtual bool isSteppable() const;
     virtual bool shouldRespectHeightAndWidthAttributes();
-    // If supportsPlaceholder() && !usesFixedPlaceholder(), it means a type
-    // supports the 'placeholder' attribute.
-    // If supportsPlaceholder() && usesFixedPlaceholder(), it means a type
-    // doesn't support the 'placeholder' attribute, but shows
-    // fixedPlaceholder() string as a placeholder.
     virtual bool supportsPlaceholder() const;
-    virtual bool usesFixedPlaceholder() const;
-    virtual String fixedPlaceholder();
     virtual void updateInnerTextValue();
     virtual void updatePlaceholderText();
     virtual void multipleAttributeChanged();
@@ -313,10 +306,11 @@ public:
     virtual unsigned height() const;
     virtual unsigned width() const;
 
+    void dispatchSimulatedClickIfActive(KeyboardEvent*) const;
+
 protected:
     InputType(HTMLInputElement* element) : m_element(element) { }
     HTMLInputElement* element() const { return m_element; }
-    void dispatchSimulatedClickIfActive(KeyboardEvent*) const;
     Chrome* chrome() const;
     Decimal parseToNumberOrNaN(const String&) const;
 
diff --git a/Source/WebCore/html/MonthInputType.cpp b/Source/WebCore/html/MonthInputType.cpp
index 9bb2f9aef..5275e54b5 100644
--- a/Source/WebCore/html/MonthInputType.cpp
+++ b/Source/WebCore/html/MonthInputType.cpp
@@ -45,7 +45,7 @@
 #if ENABLE(INPUT_MULTIPLE_FIELDS_UI)
 #include "DateTimeFieldsState.h"
 #include "LocalizedStrings.h"
-#include "Localizer.h"
+#include "PlatformLocale.h"
 #include <wtf/text/WTFString.h>
 #endif
 
@@ -154,7 +154,7 @@ String MonthInputType::formatDateTimeFieldsState(const DateTimeFieldsState& date
 
 void MonthInputType::setupLayoutParameters(DateTimeEditElement::LayoutParameters& layoutParameters, const DateComponents& date) const
 {
-    layoutParameters.dateTimeFormat = layoutParameters.localizer.monthFormat();
+    layoutParameters.dateTimeFormat = layoutParameters.locale.monthFormat();
     layoutParameters.fallbackDateTimeFormat = "MM/yyyy";
     layoutParameters.minimumYear = fullYear(element()->fastGetAttribute(minAttr));
     layoutParameters.maximumYear = fullYear(element()->fastGetAttribute(maxAttr));
diff --git a/Source/WebCore/html/MonthInputType.h b/Source/WebCore/html/MonthInputType.h
index 3d4f59c6c..61488bc70 100644
--- a/Source/WebCore/html/MonthInputType.h
+++ b/Source/WebCore/html/MonthInputType.h
@@ -32,6 +32,7 @@
 #define MonthInputType_h
 
 #if ENABLE(INPUT_TYPE_MONTH)
+#include "BaseChooserOnlyDateAndTimeInputType.h"
 #include "BaseMultipleFieldsDateAndTimeInputType.h"
 
 namespace WebCore {
@@ -39,7 +40,7 @@ namespace WebCore {
 #if ENABLE(INPUT_MULTIPLE_FIELDS_UI)
 typedef BaseMultipleFieldsDateAndTimeInputType BaseMonthInputType;
 #else
-typedef BaseDateAndTimeInputType BaseMonthInputType;
+typedef BaseChooserOnlyDateAndTimeInputType BaseMonthInputType;
 #endif
 
 class MonthInputType : public BaseMonthInputType {
diff --git a/Source/WebCore/html/NumberInputType.cpp b/Source/WebCore/html/NumberInputType.cpp
index 306bf8fb6..ce833512d 100644
--- a/Source/WebCore/html/NumberInputType.cpp
+++ b/Source/WebCore/html/NumberInputType.cpp
@@ -39,7 +39,7 @@
 #include "HTMLParserIdioms.h"
 #include "InputTypeNames.h"
 #include "KeyboardEvent.h"
-#include "Localizer.h"
+#include "PlatformLocale.h"
 #include "RenderTextControl.h"
 #include <limits>
 #include <wtf/ASCIICType.h>
@@ -235,7 +235,7 @@ String NumberInputType::localizeValue(const String& proposedValue) const
     // We don't localize scientific notations.
     if (proposedValue.find(isE) != notFound)
         return proposedValue;
-    return element()->localizer().convertToLocalizedNumber(proposedValue);
+    return element()->locale().convertToLocalizedNumber(proposedValue);
 }
 
 String NumberInputType::visibleValue() const
@@ -250,7 +250,7 @@ String NumberInputType::convertFromVisibleValue(const String& visibleValue) cons
     // We don't localize scientific notations.
     if (visibleValue.find(isE) != notFound)
         return visibleValue;
-    return element()->localizer().convertFromLocalizedNumber(visibleValue);
+    return element()->locale().convertFromLocalizedNumber(visibleValue);
 }
 
 bool NumberInputType::isAcceptableValue(const String& proposedValue)
diff --git a/Source/WebCore/html/RangeInputType.cpp b/Source/WebCore/html/RangeInputType.cpp
index 4c70608e3..1e8384453 100644
--- a/Source/WebCore/html/RangeInputType.cpp
+++ b/Source/WebCore/html/RangeInputType.cpp
@@ -43,6 +43,7 @@
 #include "MouseEvent.h"
 #include "PlatformMouseEvent.h"
 #include "RenderSlider.h"
+#include "ScopedEventQueue.h"
 #include "ShadowRoot.h"
 #include "SliderThumbElement.h"
 #include "StepRange.h"
@@ -235,6 +236,7 @@ void RangeInputType::handleKeydownEvent(KeyboardEvent* event)
     newValue = stepRange.clampValue(newValue);
 
     if (newValue != current) {
+        EventQueueScope scope;
         ExceptionCode ec;
         TextFieldEventBehavior eventBehavior = DispatchChangeEvent;
         setValueAsDecimal(newValue, eventBehavior, ec);
diff --git a/Source/WebCore/html/TextFieldInputType.cpp b/Source/WebCore/html/TextFieldInputType.cpp
index 3e6c1ee7c..a5c2745fc 100644
--- a/Source/WebCore/html/TextFieldInputType.cpp
+++ b/Source/WebCore/html/TextFieldInputType.cpp
@@ -402,7 +402,7 @@ void TextFieldInputType::updatePlaceholderText()
     if (!supportsPlaceholder())
         return;
     ExceptionCode ec = 0;
-    String placeholderText = usesFixedPlaceholder() ? fixedPlaceholder() : element()->strippedPlaceholder();
+    String placeholderText = element()->strippedPlaceholder();
     if (placeholderText.isEmpty()) {
         if (m_placeholder) {
             m_placeholder->parentNode()->removeChild(m_placeholder.get(), ec);
diff --git a/Source/WebCore/html/TextFieldInputType.h b/Source/WebCore/html/TextFieldInputType.h
index a693cfefb..8a26b83d7 100644
--- a/Source/WebCore/html/TextFieldInputType.h
+++ b/Source/WebCore/html/TextFieldInputType.h
@@ -41,7 +41,7 @@ class FormDataList;
 
 // The class represents types of which UI contain text fields.
 // It supports not only the types for BaseTextInputType but also type=number.
-class TextFieldInputType : public InputType, private SpinButtonElement::SpinButtonOwner {
+class TextFieldInputType : public InputType, protected SpinButtonElement::SpinButtonOwner {
 protected:
     TextFieldInputType(HTMLInputElement*);
     virtual ~TextFieldInputType();
diff --git a/Source/WebCore/html/TimeInputType.cpp b/Source/WebCore/html/TimeInputType.cpp
index 789cd3fee..5f5227977 100644
--- a/Source/WebCore/html/TimeInputType.cpp
+++ b/Source/WebCore/html/TimeInputType.cpp
@@ -44,7 +44,7 @@
 
 #if ENABLE(INPUT_MULTIPLE_FIELDS_UI)
 #include "DateTimeFieldsState.h"
-#include "Localizer.h"
+#include "PlatformLocale.h"
 #include <wtf/text/WTFString.h>
 #endif
 
@@ -128,9 +128,9 @@ String TimeInputType::localizeValue(const String& proposedValue) const
     if (!parseToDateComponents(proposedValue, &date))
         return proposedValue;
 
-    Localizer::FormatType formatType = shouldHaveSecondField(date) ? Localizer::FormatTypeMedium : Localizer::FormatTypeShort;
+    Locale::FormatType formatType = shouldHaveSecondField(date) ? Locale::FormatTypeMedium : Locale::FormatTypeShort;
 
-    String localized = element()->localizer().formatDateTime(date, formatType);
+    String localized = element()->locale().formatDateTime(date, formatType);
     return localized.isEmpty() ? proposedValue : localized;
 }
 
@@ -155,10 +155,10 @@ String TimeInputType::formatDateTimeFieldsState(const DateTimeFieldsState& dateT
 void TimeInputType::setupLayoutParameters(DateTimeEditElement::LayoutParameters& layoutParameters, const DateComponents& date) const
 {
     if (shouldHaveSecondField(date)) {
-        layoutParameters.dateTimeFormat = layoutParameters.localizer.timeFormat();
+        layoutParameters.dateTimeFormat = layoutParameters.locale.timeFormat();
         layoutParameters.fallbackDateTimeFormat = "HH:mm:ss";
     } else {
-        layoutParameters.dateTimeFormat = layoutParameters.localizer.shortTimeFormat();
+        layoutParameters.dateTimeFormat = layoutParameters.locale.shortTimeFormat();
         layoutParameters.fallbackDateTimeFormat = "HH:mm";
     }
 }
diff --git a/Source/WebCore/html/TimeInputType.h b/Source/WebCore/html/TimeInputType.h
index dafd58dfb..c2ee2796b 100644
--- a/Source/WebCore/html/TimeInputType.h
+++ b/Source/WebCore/html/TimeInputType.h
@@ -32,6 +32,7 @@
 #define TimeInputType_h
 
 #if ENABLE(INPUT_TYPE_TIME)
+#include "BaseChooserOnlyDateAndTimeInputType.h"
 #include "BaseMultipleFieldsDateAndTimeInputType.h"
 
 namespace WebCore {
@@ -39,7 +40,7 @@ namespace WebCore {
 #if ENABLE(INPUT_MULTIPLE_FIELDS_UI)
 typedef BaseMultipleFieldsDateAndTimeInputType BaseTimeInputType;
 #else
-typedef BaseDateAndTimeInputType BaseTimeInputType;
+typedef BaseChooserOnlyDateAndTimeInputType BaseTimeInputType;
 #endif
 
 class TimeInputType : public BaseTimeInputType {
diff --git a/Source/WebCore/html/WeekInputType.h b/Source/WebCore/html/WeekInputType.h
index a88172009..a70b9a9e8 100644
--- a/Source/WebCore/html/WeekInputType.h
+++ b/Source/WebCore/html/WeekInputType.h
@@ -31,16 +31,16 @@
 #ifndef WeekInputType_h
 #define WeekInputType_h
 
-#include "BaseMultipleFieldsDateAndTimeInputType.h"
-
 #if ENABLE(INPUT_TYPE_WEEK)
+#include "BaseChooserOnlyDateAndTimeInputType.h"
+#include "BaseMultipleFieldsDateAndTimeInputType.h"
 
 namespace WebCore {
 
 #if ENABLE(INPUT_MULTIPLE_FIELDS_UI)
 typedef BaseMultipleFieldsDateAndTimeInputType BaseWeekInputType;
 #else
-typedef BaseDateAndTimeInputType BaseWeekInputType;
+typedef BaseChooserOnlyDateAndTimeInputType BaseWeekInputType;
 #endif
 
 class WeekInputType : public BaseWeekInputType {
diff --git a/Source/WebCore/html/canvas/CheckedInt.h b/Source/WebCore/html/canvas/CheckedInt.h
index b83ac19ea..542d9a811 100644
--- a/Source/WebCore/html/canvas/CheckedInt.h
+++ b/Source/WebCore/html/canvas/CheckedInt.h
@@ -1,588 +1,819 @@
 /* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
-/* vim:set ts=2 sw=2 sts=2 et cindent: */
-/* ***** BEGIN LICENSE BLOCK *****
- * Version: MPL 1.1/GPL 2.0/LGPL 2.1
- *
- * The contents of this file are subject to the Mozilla Public License Version
- * 1.1 (the "License"); you may not use this file except in compliance with
- * the License. You may obtain a copy of the License at
- * http://www.mozilla.org/MPL/
- *
- * Software distributed under the License is distributed on an "AS IS" basis,
- * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
- * for the specific language governing rights and limitations under the
- * License.
- *
- * The Original Code is Mozilla code.
- *
- * The Initial Developer of the Original Code is the Mozilla Corporation.
- * Portions created by the Initial Developer are Copyright (C) 2009
- * the Initial Developer. All Rights Reserved.
- *
- * Contributor(s):
- *  Benoit Jacob <bjacob@mozilla.com>
- *  Jeff Muizelaar <jmuizelaar@mozilla.com>
- *
- * Alternatively, the contents of this file may be used under the terms of
- * either the GNU General Public License Version 2 or later (the "GPL"), or
- * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
- * in which case the provisions of the GPL or the LGPL are applicable instead
- * of those above. If you wish to allow use of your version of this file only
- * under the terms of either the GPL or the LGPL, and not to allow others to
- * use your version of this file under the terms of the MPL, indicate your
- * decision by deleting the provisions above and replace them with the notice
- * and other provisions required by the GPL or the LGPL. If you do not delete
- * the provisions above, a recipient may use your version of this file under
- * the terms of any one of the MPL, the GPL or the LGPL.
- *
- * ***** END LICENSE BLOCK ***** */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+/* Provides checked integers, detecting integer overflow and divide-by-0. */
+
+// Necessary modifications are made to the original CheckedInt.h file when
+// incorporating it into WebKit:
+// 1) Comment out #define MOZ_CHECKEDINT_ENABLE_MOZ_ASSERTS
+// 2) Comment out #include "mozilla/StandardInteger.h"
+// 3) Define MOZ_DELETE
+// 4) Change namespace mozilla to namespace WebCore
+
+#ifndef mozilla_CheckedInt_h_
+#define mozilla_CheckedInt_h_
+
+/*
+ * Build options. Comment out these #defines to disable the corresponding
+ * optional feature. Disabling features may be useful for code using
+ * CheckedInt outside of Mozilla (e.g. WebKit)
+ */
+
+// Enable usage of MOZ_STATIC_ASSERT to check for unsupported types.
+// If disabled, static asserts are replaced by regular assert().
+// #define MOZ_CHECKEDINT_ENABLE_MOZ_ASSERTS
+
+/*
+ * End of build options
+ */
+
+#ifdef MOZ_CHECKEDINT_ENABLE_MOZ_ASSERTS
+#  include "mozilla/Assertions.h"
+#else
+#  ifndef MOZ_STATIC_ASSERT
+#    include <cassert>
+#    define MOZ_STATIC_ASSERT(cond, reason) assert((cond) && reason)
+#    define MOZ_ASSERT(cond, reason) assert((cond) && reason)
+#  endif
+#endif
 
-// Necessary modifications are made to the original CheckedInt.h file to remove
-// dependencies on prtypes.
-// Also, change define Mozilla_CheckedInt_h to CheckedInt_h, change namespace
-// from mozilla to WebCore for easier usage.
+// #include "mozilla/StandardInteger.h"
 
-#ifndef CheckedInt_h
-#define CheckedInt_h
+#ifndef MOZ_DELETE
+#define MOZ_DELETE
+#endif
 
 #include <climits>
+#include <cstddef>
 
 namespace WebCore {
 
-namespace CheckedInt_internal {
+namespace detail {
 
-/* we don't want to use std::numeric_limits here because int... types may not support it,
- * depending on the platform, e.g. on certain platform they use nonstandard built-in types
+/*
+ * Step 1: manually record supported types
+ *
+ * What's nontrivial here is that there are different families of integer
+ * types: basic integer types and stdint types. It is merrily undefined which
+ * types from one family may be just typedefs for a type from another family.
+ *
+ * For example, on GCC 4.6, aside from the basic integer types, the only other
+ * type that isn't just a typedef for some of them, is int8_t.
  */
 
-/*** Step 1: manually record information for all the types that we want to support
- ***/
-
-struct unsupported_type {};
-
-template<typename T> struct integer_type_manually_recorded_info;
+struct UnsupportedType {};
 
+template<typename IntegerType>
+struct IsSupportedPass2
+{
+    static const bool value = false;
+};
 
-#define CHECKEDINT_REGISTER_SUPPORTED_TYPE(T,_twice_bigger_type,_unsigned_type) \
-template<> struct integer_type_manually_recorded_info<T>       \
-{                                                              \
-    enum { is_supported = 1 };                                 \
-    typedef _twice_bigger_type twice_bigger_type;              \
-    typedef _unsigned_type unsigned_type;                      \
+template<typename IntegerType>
+struct IsSupported
+{
+    static const bool value = IsSupportedPass2<IntegerType>::value;
 };
 
-//                                 Type      Twice Bigger Type   Unsigned Type
-CHECKEDINT_REGISTER_SUPPORTED_TYPE(int8_t,   int16_t,             uint8_t)
-CHECKEDINT_REGISTER_SUPPORTED_TYPE(uint8_t,  uint16_t,            uint8_t)
-CHECKEDINT_REGISTER_SUPPORTED_TYPE(int16_t,  int32_t,             uint16_t)
-CHECKEDINT_REGISTER_SUPPORTED_TYPE(uint16_t, uint32_t,            uint16_t)
-CHECKEDINT_REGISTER_SUPPORTED_TYPE(int32_t,  int64_t,             uint32_t)
-CHECKEDINT_REGISTER_SUPPORTED_TYPE(uint32_t, uint64_t,            uint32_t)
-CHECKEDINT_REGISTER_SUPPORTED_TYPE(int64_t,  unsupported_type,    uint64_t)
-CHECKEDINT_REGISTER_SUPPORTED_TYPE(uint64_t, unsupported_type,    uint64_t)
-
-// now implement the fallback for standard types like int, long, ...
-// the difficulty is that they may or may not be equal to one of the above types, and/or
-// to each other. This is why any attempt to handle at once PRInt8... types and standard types
-// is bound to fail.
-template<typename T>
-struct is_standard_integer_type { enum { value = 0 }; };
+template<>
+struct IsSupported<int8_t>
+{ static const bool value = true; };
 
 template<>
-struct is_standard_integer_type<char> { enum { value = 1 }; };
+struct IsSupported<uint8_t>
+{ static const bool value = true; };
+
 template<>
-struct is_standard_integer_type<unsigned char> { enum { value = 1 }; };
+struct IsSupported<int16_t>
+{ static const bool value = true; };
+
 template<>
-struct is_standard_integer_type<short> { enum { value = 1 }; };
+struct IsSupported<uint16_t>
+{ static const bool value = true; };
+
 template<>
-struct is_standard_integer_type<unsigned short> { enum { value = 1 }; };
+struct IsSupported<int32_t>
+{ static const bool value = true; };
+
 template<>
-struct is_standard_integer_type<int> { enum { value = 1 }; };
+struct IsSupported<uint32_t>
+{ static const bool value = true; };
+
 template<>
-struct is_standard_integer_type<unsigned int> { enum { value = 1 }; };
+struct IsSupported<int64_t>
+{ static const bool value = true; };
+
 template<>
-struct is_standard_integer_type<long> { enum { value = 1 }; };
+struct IsSupported<uint64_t>
+{ static const bool value = true; };
+
+
 template<>
-struct is_standard_integer_type<unsigned long> { enum { value = 1 }; };
+struct IsSupportedPass2<char>
+{ static const bool value = true; };
+
 template<>
-struct is_standard_integer_type<long long> { enum { value = 1 }; };
+struct IsSupportedPass2<unsigned char>
+{ static const bool value = true; };
+
 template<>
-struct is_standard_integer_type<unsigned long long> { enum { value = 1 }; };
+struct IsSupportedPass2<short>
+{ static const bool value = true; };
 
-template<int size, bool is_signed>
-struct explicitly_sized_integer_type {};
+template<>
+struct IsSupportedPass2<unsigned short>
+{ static const bool value = true; };
 
 template<>
-struct explicitly_sized_integer_type<1, true> { typedef int8_t type; };
+struct IsSupportedPass2<int>
+{ static const bool value = true; };
+
 template<>
-struct explicitly_sized_integer_type<1, false> { typedef uint8_t type; };
+struct IsSupportedPass2<unsigned int>
+{ static const bool value = true; };
+
 template<>
-struct explicitly_sized_integer_type<2, true> { typedef int16_t type; };
+struct IsSupportedPass2<long>
+{ static const bool value = true; };
+
+template<>
+struct IsSupportedPass2<unsigned long>
+{ static const bool value = true; };
+
+
+/*
+ * Step 2: some integer-traits kind of stuff.
+ */
+
+template<size_t Size, bool Signedness>
+struct StdintTypeForSizeAndSignedness
+{};
+
 template<>
-struct explicitly_sized_integer_type<2, false> { typedef uint16_t type; };
+struct StdintTypeForSizeAndSignedness<1, true>
+{ typedef int8_t   Type; };
+
 template<>
-struct explicitly_sized_integer_type<4, true> { typedef int32_t type; };
+struct StdintTypeForSizeAndSignedness<1, false>
+{ typedef uint8_t  Type; };
+
 template<>
-struct explicitly_sized_integer_type<4, false> { typedef uint32_t type; };
+struct StdintTypeForSizeAndSignedness<2, true>
+{ typedef int16_t  Type; };
+
 template<>
-struct explicitly_sized_integer_type<8, true> { typedef int64_t type; };
+struct StdintTypeForSizeAndSignedness<2, false>
+{ typedef uint16_t Type; };
+
 template<>
-struct explicitly_sized_integer_type<8, false> { typedef uint64_t type; };
-
-template<typename T> struct integer_type_manually_recorded_info
-{
-    enum {
-      is_supported = is_standard_integer_type<T>::value,
-      size = sizeof(T),
-      is_signed = (T(-1) > T(0)) ? 0 : 1
-    };
-    typedef typename explicitly_sized_integer_type<size, is_signed>::type explicit_sized_type;
-    typedef integer_type_manually_recorded_info<explicit_sized_type> base;
-    typedef typename base::twice_bigger_type twice_bigger_type;
-    typedef typename base::unsigned_type unsigned_type;
-};
+struct StdintTypeForSizeAndSignedness<4, true>
+{ typedef int32_t  Type; };
 
-template<typename T, bool is_supported = integer_type_manually_recorded_info<T>::is_supported>
-struct TYPE_NOT_SUPPORTED_BY_CheckedInt {};
+template<>
+struct StdintTypeForSizeAndSignedness<4, false>
+{ typedef uint32_t Type; };
 
-template<typename T>
-struct TYPE_NOT_SUPPORTED_BY_CheckedInt<T, true> { static void run() {} };
+template<>
+struct StdintTypeForSizeAndSignedness<8, true>
+{ typedef int64_t  Type; };
 
+template<>
+struct StdintTypeForSizeAndSignedness<8, false>
+{ typedef uint64_t Type; };
 
-/*** Step 2: record some info about a given integer type,
- ***         including whether it is supported, whether a twice bigger integer type
- ***         is supported, what that twice bigger type is, and some stuff as found
- ***         in std::numeric_limits (which we don't use because int.. types may
- ***         not support it, if they are defined directly from compiler built-in types).
- ***/
+template<typename IntegerType>
+struct UnsignedType
+{
+    typedef typename StdintTypeForSizeAndSignedness<sizeof(IntegerType),
+                                                    false>::Type Type;
+};
 
-template<typename T> struct is_unsupported_type { enum { answer = 0 }; };
-template<> struct is_unsupported_type<unsupported_type> { enum { answer = 1 }; };
+template<typename IntegerType>
+struct IsSigned
+{
+    static const bool value = IntegerType(-1) <= IntegerType(0);
+};
 
-template<typename T> struct integer_traits
+template<typename IntegerType, size_t Size = sizeof(IntegerType)>
+struct TwiceBiggerType
 {
-    typedef typename integer_type_manually_recorded_info<T>::twice_bigger_type twice_bigger_type;
+    typedef typename StdintTypeForSizeAndSignedness<
+                       sizeof(IntegerType) * 2,
+                       IsSigned<IntegerType>::value
+                     >::Type Type;
+};
 
-    enum {
-        is_supported = integer_type_manually_recorded_info<T>::is_supported,
-        twice_bigger_type_is_supported
-            = is_unsupported_type<
-                  typename integer_type_manually_recorded_info<T>::twice_bigger_type
-              >::answer ? 0 : 1,
-        size = sizeof(T),
-        position_of_sign_bit = CHAR_BIT * size - 1,
-        is_signed = (T(-1) > T(0)) ? 0 : 1
-    };
+template<typename IntegerType>
+struct TwiceBiggerType<IntegerType, 8>
+{
+    typedef UnsupportedType Type;
+};
 
-    static T min()
-    {
-        // bitwise ops may return a larger type, that's why we cast explicitly to T
-        return is_signed ? T(T(1) << position_of_sign_bit) : T(0);
-    }
+template<typename IntegerType>
+struct PositionOfSignBit
+{
+    static const size_t value = CHAR_BIT * sizeof(IntegerType) - 1;
+};
 
-    static T max()
-    {
-        return ~min();
-    }
+template<typename IntegerType>
+struct MinValue
+{
+  private:
+    typedef typename UnsignedType<IntegerType>::Type UnsignedIntegerType;
+    static const size_t PosOfSignBit = PositionOfSignBit<IntegerType>::value;
+
+  public:
+    // Bitwise ops may return a larger type, that's why we cast explicitly.
+    // In C++, left bit shifts on signed values is undefined by the standard
+    // unless the shifted value is representable.
+    // Notice that signed-to-unsigned conversions are always well-defined in
+    // the standard as the value congruent to 2**n, as expected. By contrast,
+    // unsigned-to-signed is only well-defined if the value is representable.
+    static const IntegerType value =
+        IsSigned<IntegerType>::value
+        ? IntegerType(UnsignedIntegerType(1) << PosOfSignBit)
+        : IntegerType(0);
 };
 
-/*** Step 3: Implement the actual validity checks --- ideas taken from IntegerLib, code different.
- ***/
+template<typename IntegerType>
+struct MaxValue
+{
+    // Tricksy, but covered by the unit test.
+    // Relies heavily on the type of MinValue<IntegerType>::value
+    // being IntegerType.
+    static const IntegerType value = ~MinValue<IntegerType>::value;
+};
 
-// bitwise ops may return a larger type, so it's good to use these inline helpers guaranteeing that
-// the result is really of type T
+/*
+ * Step 3: Implement the actual validity checks.
+ *
+ * Ideas taken from IntegerLib, code different.
+ */
 
-template<typename T> inline T has_sign_bit(T x)
+template<typename T>
+inline bool
+HasSignBit(T x)
 {
-    return x >> integer_traits<T>::position_of_sign_bit;
+  // In C++, right bit shifts on negative values is undefined by the standard.
+  // Notice that signed-to-unsigned conversions are always well-defined in the
+  // standard, as the value congruent modulo 2**n as expected. By contrast,
+  // unsigned-to-signed is only well-defined if the value is representable.
+  return bool(typename UnsignedType<T>::Type(x)
+                >> PositionOfSignBit<T>::value);
 }
 
-template<typename T> inline T binary_complement(T x)
+// Bitwise ops may return a larger type, so it's good to use this inline
+// helper guaranteeing that the result is really of type T.
+template<typename T>
+inline T
+BinaryComplement(T x)
 {
-    return ~x;
+  return ~x;
 }
 
-template<typename T, typename U,
-         bool is_T_signed = integer_traits<T>::is_signed,
-         bool is_U_signed = integer_traits<U>::is_signed>
-struct is_in_range_impl {};
+template<typename T,
+         typename U,
+         bool IsTSigned = IsSigned<T>::value,
+         bool IsUSigned = IsSigned<U>::value>
+struct DoesRangeContainRange
+{
+};
+
+template<typename T, typename U, bool Signedness>
+struct DoesRangeContainRange<T, U, Signedness, Signedness>
+{
+    static const bool value = sizeof(T) >= sizeof(U);
+};
+
+template<typename T, typename U>
+struct DoesRangeContainRange<T, U, true, false>
+{
+    static const bool value = sizeof(T) > sizeof(U);
+};
+
+template<typename T, typename U>
+struct DoesRangeContainRange<T, U, false, true>
+{
+    static const bool value = false;
+};
+
+template<typename T,
+         typename U,
+         bool IsTSigned = IsSigned<T>::value,
+         bool IsUSigned = IsSigned<U>::value,
+         bool DoesTRangeContainURange = DoesRangeContainRange<T, U>::value>
+struct IsInRangeImpl {};
+
+template<typename T, typename U, bool IsTSigned, bool IsUSigned>
+struct IsInRangeImpl<T, U, IsTSigned, IsUSigned, true>
+{
+    static bool run(U)
+    {
+       return true;
+    }
+};
 
 template<typename T, typename U>
-struct is_in_range_impl<T, U, true, true>
+struct IsInRangeImpl<T, U, true, true, false>
 {
-    static T run(U x)
+    static bool run(U x)
     {
-        return (x <= integer_traits<T>::max()) &
-               (x >= integer_traits<T>::min());
+      return x <= MaxValue<T>::value && x >= MinValue<T>::value;
     }
 };
 
 template<typename T, typename U>
-struct is_in_range_impl<T, U, false, false>
+struct IsInRangeImpl<T, U, false, false, false>
 {
-    static T run(U x)
+    static bool run(U x)
     {
-        return x <= integer_traits<T>::max();
+      return x <= MaxValue<T>::value;
     }
 };
 
 template<typename T, typename U>
-struct is_in_range_impl<T, U, true, false>
+struct IsInRangeImpl<T, U, true, false, false>
 {
-    static T run(U x)
+    static bool run(U x)
     {
-        if (sizeof(T) > sizeof(U))
-            return 1;
-        else
-            return x <= U(integer_traits<T>::max());
+      return sizeof(T) > sizeof(U) || x <= U(MaxValue<T>::value);
     }
 };
 
 template<typename T, typename U>
-struct is_in_range_impl<T, U, false, true>
+struct IsInRangeImpl<T, U, false, true, false>
 {
-    static T run(U x)
+    static bool run(U x)
     {
-        if (sizeof(T) >= sizeof(U))
-            return x >= 0;
-        else
-            return x >= 0 && x <= U(integer_traits<T>::max());
+      return sizeof(T) >= sizeof(U)
+             ? x >= 0
+             : x >= 0 && x <= U(MaxValue<T>::value);
     }
 };
 
-template<typename T, typename U> inline T is_in_range(U x)
+template<typename T, typename U>
+inline bool
+IsInRange(U x)
 {
-    return is_in_range_impl<T, U>::run(x);
+  return IsInRangeImpl<T, U>::run(x);
 }
 
-template<typename T> inline T is_add_valid(T x, T y, T result)
+template<typename T>
+inline bool
+IsAddValid(T x, T y)
 {
-    return integer_traits<T>::is_signed ?
-                        // addition is valid if the sign of x+y is equal to either that of x or that of y.
-                        // Beware! These bitwise operations can return a larger integer type, if T was a
-                        // small type like int8, so we explicitly cast to T.
-                        has_sign_bit(binary_complement(T((result^x) & (result^y))))
-                    :
-                        binary_complement(x) >= y;
+  // Addition is valid if the sign of x+y is equal to either that of x or that
+  // of y. Since the value of x+y is undefined if we have a signed type, we
+  // compute it using the unsigned type of the same size.
+  // Beware! These bitwise operations can return a larger integer type,
+  // if T was a small type like int8_t, so we explicitly cast to T.
+
+  typename UnsignedType<T>::Type ux = x;
+  typename UnsignedType<T>::Type uy = y;
+  typename UnsignedType<T>::Type result = ux + uy;
+  return IsSigned<T>::value
+         ? HasSignBit(BinaryComplement(T((result ^ x) & (result ^ y))))
+         : BinaryComplement(x) >= y;
 }
 
-template<typename T> inline T is_sub_valid(T x, T y, T result)
+template<typename T>
+inline bool
+IsSubValid(T x, T y)
 {
-    return integer_traits<T>::is_signed ?
-                        // substraction is valid if either x and y have same sign, or x-y and x have same sign
-                        has_sign_bit(binary_complement(T((result^x) & (x^y))))
-                    :
-                        x >= y;
+  // Subtraction is valid if either x and y have same sign, or x-y and x have
+  // same sign. Since the value of x-y is undefined if we have a signed type,
+  // we compute it using the unsigned type of the same size.
+  typename UnsignedType<T>::Type ux = x;
+  typename UnsignedType<T>::Type uy = y;
+  typename UnsignedType<T>::Type result = ux - uy;
+
+  return IsSigned<T>::value
+         ? HasSignBit(BinaryComplement(T((result ^ x) & (x ^ y))))
+         : x >= y;
 }
 
 template<typename T,
-         bool is_signed =  integer_traits<T>::is_signed,
-         bool twice_bigger_type_is_supported = integer_traits<T>::twice_bigger_type_is_supported>
-struct is_mul_valid_impl {};
+         bool IsSigned = IsSigned<T>::value,
+         bool TwiceBiggerTypeIsSupported =
+           IsSupported<typename TwiceBiggerType<T>::Type>::value>
+struct IsMulValidImpl {};
 
-template<typename T>
-struct is_mul_valid_impl<T, true, true>
+template<typename T, bool IsSigned>
+struct IsMulValidImpl<T, IsSigned, true>
 {
-    static T run(T x, T y)
+    static bool run(T x, T y)
     {
-        typedef typename integer_traits<T>::twice_bigger_type twice_bigger_type;
-        twice_bigger_type product = twice_bigger_type(x) * twice_bigger_type(y);
-        return is_in_range<T>(product);
+      typedef typename TwiceBiggerType<T>::Type TwiceBiggerType;
+      TwiceBiggerType product = TwiceBiggerType(x) * TwiceBiggerType(y);
+      return IsInRange<T>(product);
     }
 };
 
 template<typename T>
-struct is_mul_valid_impl<T, false, true>
+struct IsMulValidImpl<T, true, false>
 {
-    static T run(T x, T y)
+    static bool run(T x, T y)
     {
-        typedef typename integer_traits<T>::twice_bigger_type twice_bigger_type;
-        twice_bigger_type product = twice_bigger_type(x) * twice_bigger_type(y);
-        return is_in_range<T>(product);
+      const T max = MaxValue<T>::value;
+      const T min = MinValue<T>::value;
+
+      if (x == 0 || y == 0)
+        return true;
+
+      if (x > 0) {
+        return y > 0
+               ? x <= max / y
+               : y >= min / x;
+      }
+
+      // If we reach this point, we know that x < 0.
+      return y > 0
+             ? x >= min / y
+             : y >= max / x;
     }
 };
 
 template<typename T>
-struct is_mul_valid_impl<T, true, false>
+struct IsMulValidImpl<T, false, false>
 {
-    static T run(T x, T y)
+    static bool run(T x, T y)
     {
-        const T max_value = integer_traits<T>::max();
-        const T min_value = integer_traits<T>::min();
-
-        if (x == 0 || y == 0) return true;
-
-        if (x > 0) {
-            if (y > 0)
-                return x <= max_value / y;
-            else
-                return y >= min_value / x;
-        } else {
-            if (y > 0)
-                return x >= min_value / y;
-            else
-                return y >= max_value / x;
-        }
+      return y == 0 ||  x <= MaxValue<T>::value / y;
     }
 };
 
 template<typename T>
-struct is_mul_valid_impl<T, false, false>
+inline bool
+IsMulValid(T x, T y)
 {
-    static T run(T x, T y)
-    {
-        const T max_value = integer_traits<T>::max();
-        if (x == 0 || y == 0) return true;
-        return x <= max_value / y;
-    }
-};
+  return IsMulValidImpl<T>::run(x, y);
+}
 
-template<typename T> inline T is_mul_valid(T x, T y, T /*result not used*/)
+template<typename T>
+inline bool
+IsDivValid(T x, T y)
 {
-    return is_mul_valid_impl<T>::run(x, y);
+  // Keep in mind that in the signed case, min/-1 is invalid because abs(min)>max.
+  return y != 0 &&
+         !(IsSigned<T>::value && x == MinValue<T>::value && y == T(-1));
 }
 
-template<typename T> inline T is_div_valid(T x, T y)
+// This is just to shut up msvc warnings about negating unsigned ints.
+template<typename T, bool IsSigned = IsSigned<T>::value>
+struct OppositeIfSignedImpl
+{
+    static T run(T x) { return -x; }
+};
+template<typename T>
+struct OppositeIfSignedImpl<T, false>
+{
+    static T run(T x) { return x; }
+};
+template<typename T>
+inline T
+OppositeIfSigned(T x)
 {
-    return integer_traits<T>::is_signed ?
-                        // keep in mind that min/-1 is invalid because abs(min)>max
-                        y != 0 && (x != integer_traits<T>::min() || y != T(-1))
-                    :
-                        y != 0;
+  return OppositeIfSignedImpl<T>::run(x);
 }
 
-} // end namespace CheckedInt_internal
-
-
-/*** Step 4: Now define the CheckedInt class.
- ***/
-
-/** \class CheckedInt
-  * \brief Integer wrapper class checking for integer overflow and other errors
-  * \param T the integer type to wrap. Can be any of int8_t, uint8_t, int16_t, uint16_t,
-  *          int32_t, uint32_t, int64_t, uint64_t.
-  *
-  * This class implements guarded integer arithmetic. Do a computation, then check that
-  * valid() returns true, you then have a guarantee that no problem, such as integer overflow,
-  * happened during this computation.
-  *
-  * The arithmetic operators in this class are guaranteed not to crash your app
-  * in case of a division by zero.
-  *
-  * For example, suppose that you want to implement a function that computes (x+y)/z,
-  * that doesn't crash if z==0, and that reports on error (divide by zero or integer overflow).
-  * You could code it as follows:
-    \code
-    bool compute_x_plus_y_over_z(int32_t x, int32_t y, int32_t z, int32_t *result)
-    {
-        CheckedInt<int32_t> checked_result = (CheckedInt<int32_t>(x) + y) / z;
-        *result = checked_result.value();
-        return checked_result.valid();
-    }
-    \endcode
-  *
-  * Implicit conversion from plain integers to checked integers is allowed. The plain integer
-  * is checked to be in range before being casted to the destination type. This means that the following
-  * lines all compile, and the resulting CheckedInts are correctly detected as valid or invalid:
-  * \code
-    CheckedInt<uint8_t> x(1);   // 1 is of type int, is found to be in range for uint8_t, x is valid
-    CheckedInt<uint8_t> x(-1);  // -1 is of type int, is found not to be in range for uint8_t, x is invalid
-    CheckedInt<int8_t> x(-1);   // -1 is of type int, is found to be in range for int8_t, x is valid
-    CheckedInt<int8_t> x(int16_t(1000)); // 1000 is of type int16_t, is found not to be in range for int8_t, x is invalid
-    CheckedInt<int32_t> x(uint32_t(123456789)); // 3123456789 is of type uint32_t, is found not to be in range
-                                             // for int32_t, x is invalid
-  * \endcode
-  * Implicit conversion from
-  * checked integers to plain integers is not allowed. As shown in the
-  * above example, to get the value of a checked integer as a normal integer, call value().
-  *
-  * Arithmetic operations between checked and plain integers is allowed; the result type
-  * is the type of the checked integer.
-  *
-  * Safe integers of different types cannot be used in the same arithmetic expression.
-  */
+} // namespace detail
+
+
+/*
+ * Step 4: Now define the CheckedInt class.
+ */
+
+/**
+ * @class CheckedInt
+ * @brief Integer wrapper class checking for integer overflow and other errors
+ * @param T the integer type to wrap. Can be any type among the following:
+ *            - any basic integer type such as |int|
+ *            - any stdint type such as |int8_t|
+ *
+ * This class implements guarded integer arithmetic. Do a computation, check
+ * that isValid() returns true, you then have a guarantee that no problem, such
+ * as integer overflow, happened during this computation, and you can call
+ * value() to get the plain integer value.
+ *
+ * The arithmetic operators in this class are guaranteed not to raise a signal
+ * (e.g. in case of a division by zero).
+ *
+ * For example, suppose that you want to implement a function that computes
+ * (x+y)/z, that doesn't crash if z==0, and that reports on error (divide by
+ * zero or integer overflow). You could code it as follows:
+   @code
+   bool computeXPlusYOverZ(int x, int y, int z, int *result)
+   {
+       CheckedInt<int> checkedResult = (CheckedInt<int>(x) + y) / z;
+       if (checkedResult.isValid()) {
+           *result = checkedResult.value();
+           return true;
+       } else {
+           return false;
+       }
+   }
+   @endcode
+ *
+ * Implicit conversion from plain integers to checked integers is allowed. The
+ * plain integer is checked to be in range before being casted to the
+ * destination type. This means that the following lines all compile, and the
+ * resulting CheckedInts are correctly detected as valid or invalid:
+ * @code
+   // 1 is of type int, is found to be in range for uint8_t, x is valid
+   CheckedInt<uint8_t> x(1);
+   // -1 is of type int, is found not to be in range for uint8_t, x is invalid
+   CheckedInt<uint8_t> x(-1);
+   // -1 is of type int, is found to be in range for int8_t, x is valid
+   CheckedInt<int8_t> x(-1);
+   // 1000 is of type int16_t, is found not to be in range for int8_t,
+   // x is invalid
+   CheckedInt<int8_t> x(int16_t(1000)); 
+   // 3123456789 is of type uint32_t, is found not to be in range for int32_t,
+   // x is invalid
+   CheckedInt<int32_t> x(uint32_t(3123456789));
+ * @endcode
+ * Implicit conversion from
+ * checked integers to plain integers is not allowed. As shown in the
+ * above example, to get the value of a checked integer as a normal integer,
+ * call value().
+ *
+ * Arithmetic operations between checked and plain integers is allowed; the
+ * result type is the type of the checked integer.
+ *
+ * Checked integers of different types cannot be used in the same arithmetic
+ * expression.
+ *
+ * There are convenience typedefs for all stdint types, of the following form
+ * (these are just 2 examples):
+   @code
+   typedef CheckedInt<int32_t> CheckedInt32;
+   typedef CheckedInt<uint16_t> CheckedUint16;
+   @endcode
+ */
 template<typename T>
 class CheckedInt
 {
-protected:
+  protected:
     T mValue;
-    T mIsValid; // stored as a T to limit the number of integer conversions when
-                // evaluating nested arithmetic expressions.
+    bool mIsValid;
 
     template<typename U>
-    CheckedInt(const U& value, bool isValid) : mValue(value), mIsValid(isValid)
+    CheckedInt(U value, bool isValid) : mValue(value), mIsValid(isValid)
     {
-        CheckedInt_internal::TYPE_NOT_SUPPORTED_BY_CheckedInt<T>::run();
+      MOZ_STATIC_ASSERT(detail::IsSupported<T>::value,
+                        "This type is not supported by CheckedInt");
     }
 
-public:
-    /** Constructs a checked integer with given \a value. The checked integer is initialized as valid or invalid
-      * depending on whether the \a value is in range.
-      *
-      * This constructor is not explicit. Instead, the type of its argument is a separate template parameter,
-      * ensuring that no conversion is performed before this constructor is actually called.
-      * As explained in the above documentation for class CheckedInt, this constructor checks that its argument is
-      * valid.
-      */
+  public:
+    /**
+     * Constructs a checked integer with given @a value. The checked integer is
+     * initialized as valid or invalid depending on whether the @a value
+     * is in range.
+     *
+     * This constructor is not explicit. Instead, the type of its argument is a
+     * separate template parameter, ensuring that no conversion is performed
+     * before this constructor is actually called. As explained in the above
+     * documentation for class CheckedInt, this constructor checks that its
+     * argument is valid.
+     */
     template<typename U>
-    CheckedInt(const U& value)
-        : mValue(value),
-          mIsValid(CheckedInt_internal::is_in_range<T>(value))
+    CheckedInt(U value)
+      : mValue(T(value)),
+        mIsValid(detail::IsInRange<T>(value))
+    {
+      MOZ_STATIC_ASSERT(detail::IsSupported<T>::value,
+                        "This type is not supported by CheckedInt");
+    }
+
+    /** Constructs a valid checked integer with initial value 0 */
+    CheckedInt() : mValue(0), mIsValid(true)
     {
-        CheckedInt_internal::TYPE_NOT_SUPPORTED_BY_CheckedInt<T>::run();
+      MOZ_STATIC_ASSERT(detail::IsSupported<T>::value,
+                        "This type is not supported by CheckedInt");
     }
 
-    /** Constructs a valid checked integer with uninitialized value */
-    CheckedInt() : mIsValid(1)
+    /** @returns the actual value */
+    T value() const
     {
-        CheckedInt_internal::TYPE_NOT_SUPPORTED_BY_CheckedInt<T>::run();
+      MOZ_ASSERT(mIsValid, "Invalid checked integer (division by zero or integer overflow)");
+      return mValue;
     }
 
-    /** \returns the actual value */
-    T value() const { return mValue; }
-
-    /** \returns true if the checked integer is valid, i.e. is not the result
-      * of an invalid operation or of an operation involving an invalid checked integer
-      */
-    bool valid() const { return mIsValid; }
-
-    /** \returns the sum. Checks for overflow. */
-    template<typename U> friend CheckedInt<U> operator +(const CheckedInt<U>& lhs, const CheckedInt<U>& rhs);
-    /** Adds. Checks for overflow. \returns self reference */
-    template<typename U> CheckedInt& operator +=(const U &rhs);
-    /** \returns the difference. Checks for overflow. */
-    template<typename U> friend CheckedInt<U> operator -(const CheckedInt<U>& lhs, const CheckedInt<U> &rhs);
-    /** Substracts. Checks for overflow. \returns self reference */
-    template<typename U> CheckedInt& operator -=(const U &rhs);
-    /** \returns the product. Checks for overflow. */
-    template<typename U> friend CheckedInt<U> operator *(const CheckedInt<U>& lhs, const CheckedInt<U> &rhs);
-    /** Multiplies. Checks for overflow. \returns self reference */
-    template<typename U> CheckedInt& operator *=(const U &rhs);
-    /** \returns the quotient. Checks for overflow and for divide-by-zero. */
-    template<typename U> friend CheckedInt<U> operator /(const CheckedInt<U>& lhs, const CheckedInt<U> &rhs);
-    /** Divides. Checks for overflow and for divide-by-zero. \returns self reference */
-    template<typename U> CheckedInt& operator /=(const U &rhs);
-
-    /** \returns the opposite value. Checks for overflow. */
+    /**
+     * @returns true if the checked integer is valid, i.e. is not the result
+     * of an invalid operation or of an operation involving an invalid checked
+     * integer
+     */
+    bool isValid() const
+    {
+      return mIsValid;
+    }
+
+    template<typename U>
+    friend CheckedInt<U> operator +(const CheckedInt<U>& lhs,
+                                    const CheckedInt<U>& rhs);
+    template<typename U>
+    CheckedInt& operator +=(U rhs);
+    template<typename U>
+    friend CheckedInt<U> operator -(const CheckedInt<U>& lhs,
+                                    const CheckedInt<U> &rhs);
+    template<typename U>
+    CheckedInt& operator -=(U rhs);
+    template<typename U>
+    friend CheckedInt<U> operator *(const CheckedInt<U>& lhs,
+                                    const CheckedInt<U> &rhs);
+    template<typename U>
+    CheckedInt& operator *=(U rhs);
+    template<typename U>
+    friend CheckedInt<U> operator /(const CheckedInt<U>& lhs,
+                                    const CheckedInt<U> &rhs);
+    template<typename U>
+    CheckedInt& operator /=(U rhs);
+
     CheckedInt operator -() const
     {
-        T result = -value();
-        /* give the compiler a good chance to perform RVO */
-        return CheckedInt(result,
-                       mIsValid & CheckedInt_internal::is_sub_valid(T(0), value(), result));
+      // Circumvent msvc warning about - applied to unsigned int.
+      // if we're unsigned, the only valid case anyway is 0
+      // in which case - is a no-op.
+      T result = detail::OppositeIfSigned(mValue);
+      /* Help the compiler perform RVO (return value optimization). */
+      return CheckedInt(result,
+                        mIsValid && detail::IsSubValid(T(0),
+                                                       mValue));
     }
 
-    /** \returns true if the left and right hand sides are valid and have the same value. */
+    /**
+     * @returns true if the left and right hand sides are valid
+     * and have the same value.
+     *
+     * Note that these semantics are the reason why we don't offer
+     * a operator!=. Indeed, we'd want to have a!=b be equivalent to !(a==b)
+     * but that would mean that whenever a or b is invalid, a!=b
+     * is always true, which would be very confusing.
+     *
+     * For similar reasons, operators <, >, <=, >= would be very tricky to
+     * specify, so we just avoid offering them.
+     *
+     * Notice that these == semantics are made more reasonable by these facts:
+     *  1. a==b implies equality at the raw data level
+     *     (the converse is false, as a==b is never true among invalids)
+     *  2. This is similar to the behavior of IEEE floats, where a==b
+     *     means that a and b have the same value *and* neither is NaN.
+     */
     bool operator ==(const CheckedInt& other) const
     {
-        return bool(mIsValid & other.mIsValid & T(value() == other.value()));
+      return mIsValid && other.mIsValid && mValue == other.mValue;
+    }
+
+    /** prefix ++ */
+    CheckedInt& operator++()
+    {
+      *this += 1;
+      return *this;
     }
 
-private:
-    /** operator!= is disabled. Indeed: (a!=b) should be the same as !(a==b) but that
-      * would mean that if a or b is invalid, (a!=b) is always true, which is very tricky.
-      */
+    /** postfix ++ */
+    CheckedInt operator++(int)
+    {
+      CheckedInt tmp = *this;
+      *this += 1;
+      return tmp;
+    }
+
+    /** prefix -- */
+    CheckedInt& operator--()
+    {
+      *this -= 1;
+      return *this;
+    }
+
+    /** postfix -- */
+    CheckedInt operator--(int)
+    {
+      CheckedInt tmp = *this;
+      *this -= 1;
+      return tmp;
+    }
+
+  private:
+    /**
+     * The !=, <, <=, >, >= operators are disabled:
+     * see the comment on operator==.
+     */
+    template<typename U>
+    bool operator !=(U other) const MOZ_DELETE;
     template<typename U>
-    bool operator !=(const U& other) const { return !(*this == other); }
+    bool operator <(U other) const MOZ_DELETE;
+    template<typename U>
+    bool operator <=(U other) const MOZ_DELETE;
+    template<typename U>
+    bool operator >(U other) const MOZ_DELETE;
+    template<typename U>
+    bool operator >=(U other) const MOZ_DELETE;
 };
 
-#define CHECKEDINT_BASIC_BINARY_OPERATOR(NAME, OP)               \
-template<typename T>                                          \
-inline CheckedInt<T> operator OP(const CheckedInt<T> &lhs, const CheckedInt<T> &rhs) \
-{                                                             \
-    T x = lhs.value();                                        \
-    T y = rhs.value();                                        \
-    T result = x OP y;                                        \
-    T is_op_valid                                             \
-        = CheckedInt_internal::is_##NAME##_valid(x, y, result);  \
-    /* give the compiler a good chance to perform RVO */      \
-    return CheckedInt<T>(result,                                 \
-                      lhs.mIsValid &                          \
-                      rhs.mIsValid &                          \
-                      is_op_valid);                           \
+#define MOZ_CHECKEDINT_BASIC_BINARY_OPERATOR(NAME, OP)                \
+template<typename T>                                                  \
+inline CheckedInt<T> operator OP(const CheckedInt<T> &lhs,            \
+                                 const CheckedInt<T> &rhs)            \
+{                                                                     \
+  if (!detail::Is##NAME##Valid(lhs.mValue, rhs.mValue))               \
+    return CheckedInt<T>(0, false);                                   \
+                                                                      \
+  return CheckedInt<T>(lhs.mValue OP rhs.mValue,                      \
+                       lhs.mIsValid && rhs.mIsValid);                 \
 }
 
-CHECKEDINT_BASIC_BINARY_OPERATOR(add, +)
-CHECKEDINT_BASIC_BINARY_OPERATOR(sub, -)
-CHECKEDINT_BASIC_BINARY_OPERATOR(mul, *)
+MOZ_CHECKEDINT_BASIC_BINARY_OPERATOR(Add, +)
+MOZ_CHECKEDINT_BASIC_BINARY_OPERATOR(Sub, -)
+MOZ_CHECKEDINT_BASIC_BINARY_OPERATOR(Mul, *)
+MOZ_CHECKEDINT_BASIC_BINARY_OPERATOR(Div, /)
 
-// division can't be implemented by CHECKEDINT_BASIC_BINARY_OPERATOR
-// because if rhs == 0, we are not allowed to even try to compute the quotient.
-template<typename T>
-inline CheckedInt<T> operator /(const CheckedInt<T> &lhs, const CheckedInt<T> &rhs)
-{
-    T x = lhs.value();
-    T y = rhs.value();
-    T is_op_valid = CheckedInt_internal::is_div_valid(x, y);
-    T result = is_op_valid ? (x / y) : 0;
-    /* give the compiler a good chance to perform RVO */
-    return CheckedInt<T>(result,
-                      lhs.mIsValid &
-                      rhs.mIsValid &
-                      is_op_valid);
-}
+#undef MOZ_CHECKEDINT_BASIC_BINARY_OPERATOR
 
-// implement cast_to_CheckedInt<T>(x), making sure that
-//  - it allows x to be either a CheckedInt<T> or any integer type that can be casted to T
-//  - if x is already a CheckedInt<T>, we just return a reference to it, instead of copying it (optimization)
+// Implement castToCheckedInt<T>(x), making sure that
+//  - it allows x to be either a CheckedInt<T> or any integer type
+//    that can be casted to T
+//  - if x is already a CheckedInt<T>, we just return a reference to it,
+//    instead of copying it (optimization)
+
+namespace detail {
 
 template<typename T, typename U>
-struct cast_to_CheckedInt_impl
+struct CastToCheckedIntImpl
 {
-    typedef CheckedInt<T> return_type;
-    static CheckedInt<T> run(const U& u) { return u; }
+    typedef CheckedInt<T> ReturnType;
+    static CheckedInt<T> run(U u) { return u; }
 };
 
 template<typename T>
-struct cast_to_CheckedInt_impl<T, CheckedInt<T> >
+struct CastToCheckedIntImpl<T, CheckedInt<T> >
 {
-    typedef const CheckedInt<T>& return_type;
+    typedef const CheckedInt<T>& ReturnType;
     static const CheckedInt<T>& run(const CheckedInt<T>& u) { return u; }
 };
 
+} // namespace detail
+
 template<typename T, typename U>
-inline typename cast_to_CheckedInt_impl<T, U>::return_type
-cast_to_CheckedInt(const U& u)
+inline typename detail::CastToCheckedIntImpl<T, U>::ReturnType
+castToCheckedInt(U u)
 {
-    return cast_to_CheckedInt_impl<T, U>::run(u);
+  return detail::CastToCheckedIntImpl<T, U>::run(u);
 }
 
-#define CHECKEDINT_CONVENIENCE_BINARY_OPERATORS(OP, COMPOUND_OP) \
-template<typename T>                                          \
-template<typename U>                                          \
-CheckedInt<T>& CheckedInt<T>::operator COMPOUND_OP(const U &rhs)    \
-{                                                             \
-    *this = *this OP cast_to_CheckedInt<T>(rhs);                 \
-    return *this;                                             \
-}                                                             \
-template<typename T, typename U>                              \
-inline CheckedInt<T> operator OP(const CheckedInt<T> &lhs, const U &rhs) \
-{                                                             \
-    return lhs OP cast_to_CheckedInt<T>(rhs);                    \
-}                                                             \
-template<typename T, typename U>                              \
-inline CheckedInt<T> operator OP(const U & lhs, const CheckedInt<T> &rhs) \
-{                                                             \
-    return cast_to_CheckedInt<T>(lhs) OP rhs;                    \
+#define MOZ_CHECKEDINT_CONVENIENCE_BINARY_OPERATORS(OP, COMPOUND_OP)  \
+template<typename T>                                              \
+template<typename U>                                              \
+CheckedInt<T>& CheckedInt<T>::operator COMPOUND_OP(U rhs)         \
+{                                                                 \
+  *this = *this OP castToCheckedInt<T>(rhs);                      \
+  return *this;                                                   \
+}                                                                 \
+template<typename T, typename U>                                  \
+inline CheckedInt<T> operator OP(const CheckedInt<T> &lhs, U rhs) \
+{                                                                 \
+  return lhs OP castToCheckedInt<T>(rhs);                         \
+}                                                                 \
+template<typename T, typename U>                                  \
+inline CheckedInt<T> operator OP(U lhs, const CheckedInt<T> &rhs) \
+{                                                                 \
+  return castToCheckedInt<T>(lhs) OP rhs;                         \
 }
 
-CHECKEDINT_CONVENIENCE_BINARY_OPERATORS(+, +=)
-CHECKEDINT_CONVENIENCE_BINARY_OPERATORS(*, *=)
-CHECKEDINT_CONVENIENCE_BINARY_OPERATORS(-, -=)
-CHECKEDINT_CONVENIENCE_BINARY_OPERATORS(/, /=)
+MOZ_CHECKEDINT_CONVENIENCE_BINARY_OPERATORS(+, +=)
+MOZ_CHECKEDINT_CONVENIENCE_BINARY_OPERATORS(*, *=)
+MOZ_CHECKEDINT_CONVENIENCE_BINARY_OPERATORS(-, -=)
+MOZ_CHECKEDINT_CONVENIENCE_BINARY_OPERATORS(/, /=)
+
+#undef MOZ_CHECKEDINT_CONVENIENCE_BINARY_OPERATORS
 
 template<typename T, typename U>
-inline bool operator ==(const CheckedInt<T> &lhs, const U &rhs)
+inline bool
+operator ==(const CheckedInt<T> &lhs, U rhs)
 {
-    return lhs == cast_to_CheckedInt<T>(rhs);
+  return lhs == castToCheckedInt<T>(rhs);
 }
 
 template<typename T, typename U>
-inline bool operator ==(const U & lhs, const CheckedInt<T> &rhs)
+inline bool
+operator ==(U  lhs, const CheckedInt<T> &rhs)
 {
-    return cast_to_CheckedInt<T>(lhs) == rhs;
+  return castToCheckedInt<T>(lhs) == rhs;
 }
 
-} // end namespace WebCore
+// Convenience typedefs.
+typedef CheckedInt<int8_t>   CheckedInt8;
+typedef CheckedInt<uint8_t>  CheckedUint8;
+typedef CheckedInt<int16_t>  CheckedInt16;
+typedef CheckedInt<uint16_t> CheckedUint16;
+typedef CheckedInt<int32_t>  CheckedInt32;
+typedef CheckedInt<uint32_t> CheckedUint32;
+typedef CheckedInt<int64_t>  CheckedInt64;
+typedef CheckedInt<uint64_t> CheckedUint64;
+
+} // namespace WebCore
 
-#endif /* CheckedInt_h */
+#endif /* mozilla_CheckedInt_h_ */
diff --git a/Source/WebCore/html/canvas/DataView.cpp b/Source/WebCore/html/canvas/DataView.cpp
index 3e55d3776..3b6c2a174 100644
--- a/Source/WebCore/html/canvas/DataView.cpp
+++ b/Source/WebCore/html/canvas/DataView.cpp
@@ -56,7 +56,7 @@ PassRefPtr<DataView> DataView::create(PassRefPtr<ArrayBuffer> buffer, unsigned b
     CheckedInt<uint32_t> checkedOffset(byteOffset);
     CheckedInt<uint32_t> checkedLength(byteLength);
     CheckedInt<uint32_t> checkedMax = checkedOffset + checkedLength;
-    if (!checkedMax.valid() || checkedMax.value() > buffer->byteLength())
+    if (!checkedMax.isValid() || checkedMax.value() > buffer->byteLength())
         return 0;
     return adoptRef(new DataView(buffer, byteOffset, byteLength));
 }
diff --git a/Source/WebCore/html/canvas/WebGLBuffer.cpp b/Source/WebCore/html/canvas/WebGLBuffer.cpp
index fc6d40860..add28cf64 100644
--- a/Source/WebCore/html/canvas/WebGLBuffer.cpp
+++ b/Source/WebCore/html/canvas/WebGLBuffer.cpp
@@ -70,7 +70,7 @@ bool WebGLBuffer::associateBufferDataImpl(ArrayBuffer* array, GC3Dintptr byteOff
         CheckedInt<GC3Dintptr> checkedOffset(byteOffset);
         CheckedInt<GC3Dsizeiptr> checkedLength(byteLength);
         CheckedInt<GC3Dintptr> checkedMax = checkedOffset + checkedLength;
-        if (!checkedMax.valid() || checkedMax.value() > static_cast<int32_t>(array->byteLength()))
+        if (!checkedMax.isValid() || checkedMax.value() > static_cast<int32_t>(array->byteLength()))
             return false;
     }
 
@@ -135,7 +135,7 @@ bool WebGLBuffer::associateBufferSubDataImpl(GC3Dintptr offset, ArrayBuffer* arr
         CheckedInt<GC3Dsizeiptr> checkedLength(byteLength);
         CheckedInt<GC3Dintptr> checkedArrayMax = checkedArrayOffset + checkedLength;
         CheckedInt<GC3Dintptr> checkedBufferMax = checkedBufferOffset + checkedLength;
-        if (!checkedArrayMax.valid() || checkedArrayMax.value() > static_cast<int32_t>(array->byteLength()) || !checkedBufferMax.valid() || checkedBufferMax.value() > m_byteLength)
+        if (!checkedArrayMax.isValid() || checkedArrayMax.value() > static_cast<int32_t>(array->byteLength()) || !checkedBufferMax.isValid() || checkedBufferMax.value() > m_byteLength)
             return false;
     }
 
diff --git a/Source/WebCore/html/canvas/WebGLRenderingContext.cpp b/Source/WebCore/html/canvas/WebGLRenderingContext.cpp
index f4c7ae128..5b1b05a5d 100644
--- a/Source/WebCore/html/canvas/WebGLRenderingContext.cpp
+++ b/Source/WebCore/html/canvas/WebGLRenderingContext.cpp
@@ -31,7 +31,6 @@
 
 #include "CachedImage.h"
 #include "CheckedInt.h"
-#include "Console.h"
 #include "DOMWindow.h"
 #include "EXTTextureFilterAnisotropic.h"
 #include "ExceptionCode.h"
@@ -532,6 +531,7 @@ void WebGLRenderingContext::initializeNewContext()
 
     m_context->reshape(canvasSize.width(), canvasSize.height());
     m_context->viewport(0, 0, canvasSize.width(), canvasSize.height());
+    m_context->scissor(0, 0, canvasSize.width(), canvasSize.height());
 
     m_context->setContextLostCallback(adoptPtr(new WebGLRenderingContextLostCallback(this)));
     m_context->setErrorMessageCallback(adoptPtr(new WebGLRenderingContextErrorMessageCallback(this)));
@@ -1918,7 +1918,7 @@ void WebGLRenderingContext::drawArrays(GC3Denum mode, GC3Dint first, GC3Dsizei c
         CheckedInt<GC3Dint> checkedFirst(first);
         CheckedInt<GC3Dint> checkedCount(count);
         CheckedInt<GC3Dint> checkedSum = checkedFirst + checkedCount;
-        if (!checkedSum.valid() || !validateRenderingState(checkedSum.value())) {
+        if (!checkedSum.isValid() || !validateRenderingState(checkedSum.value())) {
             synthesizeGLError(GraphicsContext3D::INVALID_OPERATION, "drawArrays", "attempt to access out of bounds arrays");
             return;
         }
@@ -3699,7 +3699,11 @@ void WebGLRenderingContext::texImage2D(GC3Denum target, GC3Dint level, GC3Denum
     WebGLTexture* texture = validateTextureBinding("texImage2D", target, true);
     // If possible, copy from the canvas element directly to the texture
     // via the GPU, without a read-back to system memory.
-    if (GraphicsContext3D::TEXTURE_2D == target && texture && type == texture->getType(target, level)) {
+    //
+    // FIXME: restriction of (RGB || RGBA)/UNSIGNED_BYTE should be lifted when
+    // ImageBuffer::copyToPlatformTexture implementations are fully functional.
+    if (GraphicsContext3D::TEXTURE_2D == target && texture && type == texture->getType(target, level)
+        && (format == GraphicsContext3D::RGB || format == GraphicsContext3D::RGBA) && type == GraphicsContext3D::UNSIGNED_BYTE) {
         ImageBuffer* buffer = canvas->buffer();
         if (buffer && buffer->copyToPlatformTexture(*m_context.get(), texture->object(), internalformat, m_unpackPremultiplyAlpha, m_unpackFlipY)) {
             texture->setLevelInfo(target, level, internalformat, canvas->width(), canvas->height(), type);
@@ -5202,20 +5206,10 @@ void WebGLRenderingContext::printWarningToConsole(const String& message)
 {
     if (!canvas())
         return;
-    // FIXME: This giant cascade of null checks seems a bit paranoid.
     Document* document = canvas()->document();
     if (!document)
         return;
-    Frame* frame = document->frame();
-    if (!frame)
-        return;
-    DOMWindow* window = document->domWindow();
-    if (!window)
-        return;
-    Console* console = window->console();
-    if (!console)
-        return;
-    console->addMessage(HTMLMessageSource, LogMessageType, WarningMessageLevel, message, document->url().string());
+    document->addConsoleMessage(HTMLMessageSource, LogMessageType, WarningMessageLevel, message, document->url().string());
 }
 
 bool WebGLRenderingContext::validateFramebufferFuncParameters(const char* functionName, GC3Denum target, GC3Denum attachment)
diff --git a/Source/WebCore/html/parser/XSSAuditor.cpp b/Source/WebCore/html/parser/XSSAuditor.cpp
index 822fa3a85..fdfeddf82 100644
--- a/Source/WebCore/html/parser/XSSAuditor.cpp
+++ b/Source/WebCore/html/parser/XSSAuditor.cpp
@@ -32,6 +32,8 @@
 #include "DecodeEscapeSequences.h"
 #include "Document.h"
 #include "DocumentLoader.h"
+#include "FormData.h"
+#include "FormDataList.h"
 #include "Frame.h"
 #include "FrameLoaderClient.h"
 #include "HTMLDocumentParser.h"
@@ -39,6 +41,10 @@
 #include "HTMLTokenizer.h"
 #include "HTMLParamElement.h"
 #include "HTMLParserIdioms.h"
+#include "InspectorInstrumentation.h"
+#include "InspectorValues.h"
+#include "KURL.h"
+#include "PingLoader.h"
 #include "SecurityOrigin.h"
 #include "Settings.h"
 #include "TextEncoding.h"
@@ -167,7 +173,7 @@ XSSAuditor::XSSAuditor(HTMLDocumentParser* parser)
     , m_state(Uninitialized)
     , m_shouldAllowCDATA(false)
     , m_scriptTagNestingLevel(0)
-    , m_notifiedClient(false)
+    , m_notifyClient(true)
 {
     ASSERT(m_parser);
     if (Frame* frame = parser->document()->frame()) {
@@ -214,13 +220,32 @@ void XSSAuditor::init()
     if (m_decodedURL.find(isRequiredForInjection) == notFound)
         m_decodedURL = String();
 
+    String httpBodyAsString;
     if (DocumentLoader* documentLoader = m_parser->document()->frame()->loader()->documentLoader()) {
         DEFINE_STATIC_LOCAL(String, XSSProtectionHeader, (ASCIILiteral("X-XSS-Protection")));
-        m_xssProtection = parseXSSProtectionHeader(documentLoader->response().httpHeaderField(XSSProtectionHeader));
+        String headerValue = documentLoader->response().httpHeaderField(XSSProtectionHeader);
+        String errorDetails;
+        unsigned errorPosition = 0;
+        String reportURL;
+        m_xssProtection = parseXSSProtectionHeader(headerValue, errorDetails, errorPosition, reportURL);
+
+        if ((m_xssProtection == XSSProtectionEnabled || m_xssProtection == XSSProtectionBlockEnabled) && !reportURL.isEmpty()) {
+            m_reportURL = m_parser->document()->completeURL(reportURL);
+            if (MixedContentChecker::isMixedContent(m_parser->document()->securityOrigin(), m_reportURL)) {
+                errorDetails = "insecure reporting URL for secure page";
+                m_xssProtection = XSSProtectionInvalid;
+                m_reportURL = KURL();
+            }
+        }
+
+        if (m_xssProtection == XSSProtectionInvalid) {
+            m_parser->document()->addConsoleMessage(JSMessageSource, LogMessageType, ErrorMessageLevel, "Error parsing header X-XSS-Protection: " + headerValue + ": "  + errorDetails + " at character position " + String::format("%u", errorPosition) + ". The default protections will be applied.");
+            m_xssProtection = XSSProtectionEnabled;
+        }
 
         FormData* httpBody = documentLoader->originalRequest().httpBody();
         if (httpBody && !httpBody->isEmpty()) {
-            String httpBodyAsString = httpBody->flattenToString();
+            httpBodyAsString = httpBody->flattenToString();
             if (!httpBodyAsString.isEmpty()) {
                 m_decodedHTTPBody = fullyDecodeString(httpBodyAsString, decoder);
                 if (m_decodedHTTPBody.find(isRequiredForInjection) == notFound)
@@ -231,8 +256,16 @@ void XSSAuditor::init()
         }
     }
 
-    if (m_decodedURL.isEmpty() && m_decodedHTTPBody.isEmpty())
+    if (m_decodedURL.isEmpty() && m_decodedHTTPBody.isEmpty()) {
         m_isEnabled = false;
+        return;
+    }
+
+    if (!m_reportURL.isEmpty()) {
+        // May need these for reporting later on.
+        m_originalURL = url;
+        m_originalHTTPBody = httpBodyAsString;
+    }
 }
 
 void XSSAuditor::filterToken(HTMLToken& token)
@@ -263,9 +296,25 @@ void XSSAuditor::filterToken(HTMLToken& token)
         if (didBlockEntirePage)
              m_parser->document()->frame()->loader()->stopAllLoaders();
 
-        if (!m_notifiedClient) {
+        if (m_notifyClient) {
             m_parser->document()->frame()->loader()->client()->didDetectXSS(m_parser->document()->url(), didBlockEntirePage);
-            m_notifiedClient = true;
+            m_notifyClient = false;
+        }
+
+        if (!m_reportURL.isEmpty()) {
+            RefPtr<InspectorObject> reportDetails = InspectorObject::create();
+            reportDetails->setString("request-url", m_originalURL);
+            reportDetails->setString("request-body", m_originalHTTPBody);
+
+            RefPtr<InspectorObject> reportObject = InspectorObject::create();
+            reportObject->setObject("xss-report", reportDetails.release());
+
+            RefPtr<FormData> report = FormData::create(reportObject->toJSONString().utf8().data());
+            PingLoader::sendViolationReport(m_parser->document()->frame(), m_reportURL, report);
+
+            m_reportURL = KURL();
+            m_originalURL = String();
+            m_originalHTTPBody = String();
         }
 
         if (didBlockEntirePage)
@@ -428,7 +477,7 @@ bool XSSAuditor::filterFormToken(HTMLToken& token)
     ASSERT(token.type() == HTMLTokenTypes::StartTag);
     ASSERT(hasName(token, formTag));
 
-    return eraseAttributeIfInjected(token, actionAttr);
+    return eraseAttributeIfInjected(token, actionAttr, blankURL().string());
 }
 
 bool XSSAuditor::eraseDangerousAttributesIfInjected(HTMLToken& token)
@@ -605,6 +654,12 @@ bool XSSAuditor::isContainedInRequest(const String& decodedSnippet)
 
 bool XSSAuditor::isLikelySafeResource(const String& url)
 {
+    // Give empty URLs and about:blank a pass. Making a resourceURL from an
+    // empty string below will likely later fail the "no query args test" as
+    // it inherits the document's query args.
+    if (url.isEmpty() || url == blankURL().string())
+        return true;
+
     // If the resource is loaded from the same host as the enclosing page, it's
     // probably not an XSS attack, so we reduce false positives by allowing the
     // request, ignoring scheme and port considerations. If the resource has a
diff --git a/Source/WebCore/html/parser/XSSAuditor.h b/Source/WebCore/html/parser/XSSAuditor.h
index 7e8155828..359698fce 100644
--- a/Source/WebCore/html/parser/XSSAuditor.h
+++ b/Source/WebCore/html/parser/XSSAuditor.h
@@ -85,6 +85,8 @@ private:
     bool m_isEnabled;
     XSSProtectionDisposition m_xssProtection;
 
+    String m_originalURL;
+    String m_originalHTTPBody;
     String m_decodedURL;
     String m_decodedHTTPBody;
     OwnPtr<SuffixTree<ASCIICodebook> > m_decodedHTTPBodySuffixTree;
@@ -93,7 +95,8 @@ private:
     String m_cachedDecodedSnippet;
     bool m_shouldAllowCDATA;
     unsigned m_scriptTagNestingLevel;
-    bool m_notifiedClient;
+    bool m_notifyClient;
+    KURL m_reportURL;
 };
 
 }
diff --git a/Source/WebCore/html/shadow/ContentDistributor.cpp b/Source/WebCore/html/shadow/ContentDistributor.cpp
index 6929fdc50..0a2d9262d 100644
--- a/Source/WebCore/html/shadow/ContentDistributor.cpp
+++ b/Source/WebCore/html/shadow/ContentDistributor.cpp
@@ -30,6 +30,7 @@
 #include "ContentSelectorQuery.h"
 #include "ElementShadow.h"
 #include "HTMLContentElement.h"
+#include "HTMLShadowElement.h"
 #include "ShadowRoot.h"
 
 
@@ -49,6 +50,23 @@ InsertionPoint* ContentDistributor::findInsertionPointFor(const Node* key) const
     return m_nodeToInsertionPoint.get(key);
 }
 
+void ContentDistributor::populate(Node* node, ContentDistribution& pool)
+{
+    if (!isActiveInsertionPoint(node)) {
+        pool.append(node);
+        return;
+    }
+
+    InsertionPoint* insertionPoint = toInsertionPoint(node);
+    if (insertionPoint->hasDistribution()) {
+        for (size_t i = 0; i < insertionPoint->size(); ++i)
+            populate(insertionPoint->at(i), pool);
+    } else {
+        for (Node* fallbackNode = insertionPoint->firstChild(); fallbackNode; fallbackNode = fallbackNode->nextSibling())
+            pool.append(fallbackNode);
+    }
+}
+
 void ContentDistributor::distribute(Element* host)
 {
     ASSERT(needsDistribution());
@@ -57,41 +75,45 @@ void ContentDistributor::distribute(Element* host)
     m_validity = Valid;
 
     ContentDistribution pool;
-    for (Node* node = host->firstChild(); node; node = node->nextSibling()) {
-        if (!isHTMLContentElement(node)) {
-            pool.append(node);
-            continue;
-        }
-
-        InsertionPoint* insertionPoint = toInsertionPoint(node);
-        if (insertionPoint->hasDistribution()) {
-            for (size_t i = 0; i < insertionPoint->size(); ++i)
-                pool.append(insertionPoint->at(i));
-        } else {
-            for (Node* fallbackNode = insertionPoint->firstChild(); fallbackNode; fallbackNode = fallbackNode->nextSibling())
-                pool.append(fallbackNode);
-        }
-    }
+    for (Node* node = host->firstChild(); node; node = node->nextSibling())
+        populate(node, pool);
 
     Vector<bool> distributed(pool.size());
     distributed.fill(false);
 
+    Vector<HTMLShadowElement*, 8> activeShadowInsertionPoints;
     for (ShadowRoot* root = host->youngestShadowRoot(); root; root = root->olderShadowRoot()) {
+        HTMLShadowElement* firstActiveShadowInsertionPoint = 0;
+
         for (Node* node = root; node; node = node->traverseNextNode(root)) {
-            if (!isInsertionPoint(node))
+            if (!isActiveInsertionPoint(node))
                 continue;
             InsertionPoint* point = toInsertionPoint(node);
-            if (!point->isActive())
-                continue;
-            ShadowRoot* older = root->olderShadowRoot();
-            if (point->doesSelectFromHostChildren())
+
+            if (isHTMLShadowElement(node)) {
+                if (!firstActiveShadowInsertionPoint)
+                    firstActiveShadowInsertionPoint = toHTMLShadowElement(node);
+            } else {
                 distributeSelectionsTo(point, pool, distributed);
-            else if (older && !older->assignedTo()) {
-                distributeNodeChildrenTo(point, older);
-                older->setAssignedTo(point);
+                if (ElementShadow* shadow = node->parentNode()->isElementNode() ? toElement(node->parentNode())->shadow() : 0)
+                    shadow->invalidateDistribution();
             }
+        }
 
-            if (ElementShadow* shadow = node->parentNode()->isElementNode() ? toElement(node->parentNode())->shadow() : 0)
+        if (firstActiveShadowInsertionPoint)
+            activeShadowInsertionPoints.append(firstActiveShadowInsertionPoint);
+    }
+
+    for (size_t i = activeShadowInsertionPoints.size(); i > 0; --i) {
+        HTMLShadowElement* shadowElement = activeShadowInsertionPoints[i - 1];
+        ShadowRoot* root = shadowElement->shadowRoot();
+        ASSERT(root);
+        if (root->olderShadowRoot()) {
+            distributeNodeChildrenTo(shadowElement, root->olderShadowRoot());
+            root->olderShadowRoot()->setAssignedTo(shadowElement);
+        } else {
+            distributeSelectionsTo(shadowElement, pool, distributed);
+            if (ElementShadow* shadow = shadowElement->parentNode()->isElementNode() ? toElement(shadowElement->parentNode())->shadow() : 0)
                 shadow->invalidateDistribution();
         }
     }
@@ -150,8 +172,25 @@ void ContentDistributor::distributeNodeChildrenTo(InsertionPoint* insertionPoint
 {
     ContentDistribution distribution;
     for (Node* node = containerNode->firstChild(); node; node = node->nextSibling()) {
-        distribution.append(node);
-        m_nodeToInsertionPoint.add(node, insertionPoint);
+        if (isActiveInsertionPoint(node)) {
+            InsertionPoint* innerInsertionPoint = toInsertionPoint(node);
+            if (innerInsertionPoint->hasDistribution()) {
+                for (size_t i = 0; i < innerInsertionPoint->size(); ++i) {
+                    distribution.append(innerInsertionPoint->at(i));
+                    if (!m_nodeToInsertionPoint.contains(innerInsertionPoint->at(i)))
+                        m_nodeToInsertionPoint.add(innerInsertionPoint->at(i), insertionPoint);
+                }
+            } else {
+                for (Node* child = innerInsertionPoint->firstChild(); child; child = child->nextSibling()) {
+                    distribution.append(child);
+                    m_nodeToInsertionPoint.add(child, insertionPoint);
+                }
+            }
+        } else {
+            distribution.append(node);
+            if (!m_nodeToInsertionPoint.contains(node))
+                m_nodeToInsertionPoint.add(node, insertionPoint);
+        }
     }
 
     insertionPoint->setDistribution(distribution);
diff --git a/Source/WebCore/html/shadow/ContentDistributor.h b/Source/WebCore/html/shadow/ContentDistributor.h
index bee92a56a..0d8d0082e 100644
--- a/Source/WebCore/html/shadow/ContentDistributor.h
+++ b/Source/WebCore/html/shadow/ContentDistributor.h
@@ -74,6 +74,8 @@ public:
     void invalidateDistributionIn(ContentDistribution*);
 
 private:
+    void populate(Node*, ContentDistribution&);
+
     HashMap<const Node*, InsertionPoint*> m_nodeToInsertionPoint;
     unsigned m_validity : 2;
 };
diff --git a/Source/WebCore/html/shadow/DateTimeEditElement.cpp b/Source/WebCore/html/shadow/DateTimeEditElement.cpp
index b6f0a0af7..9ae3e739f 100644
--- a/Source/WebCore/html/shadow/DateTimeEditElement.cpp
+++ b/Source/WebCore/html/shadow/DateTimeEditElement.cpp
@@ -35,8 +35,8 @@
 #include "EventHandler.h"
 #include "HTMLNames.h"
 #include "KeyboardEvent.h"
-#include "Localizer.h"
 #include "MouseEvent.h"
+#include "PlatformLocale.h"
 #include "Text.h"
 #include <wtf/DateMath.h>
 #include <wtf/text/StringBuilder.h>
@@ -130,10 +130,10 @@ void DateTimeEditBuilder::visitField(DateTimeFormat::FieldType fieldType, int co
         switch (count) {
         case countForNarrowMonth: // Fallthrough.
         case countForAbbreviatedMonth:
-            m_editElement.addField(DateTimeSymbolicMonthFieldElement::create(document, m_editElement, m_parameters.localizer.shortMonthLabels()));
+            m_editElement.addField(DateTimeSymbolicMonthFieldElement::create(document, m_editElement, m_parameters.locale.shortMonthLabels()));
             break;
         case countForFullMonth:
-            m_editElement.addField(DateTimeSymbolicMonthFieldElement::create(document, m_editElement, m_parameters.localizer.monthLabels()));
+            m_editElement.addField(DateTimeSymbolicMonthFieldElement::create(document, m_editElement, m_parameters.locale.monthLabels()));
             break;
         default:
             m_editElement.addField(DateTimeMonthFieldElement::create(document, m_editElement, m_parameters.placeholderForMonth));
@@ -145,10 +145,10 @@ void DateTimeEditBuilder::visitField(DateTimeFormat::FieldType fieldType, int co
         switch (count) {
         case countForNarrowMonth: // Fallthrough.
         case countForAbbreviatedMonth:
-            m_editElement.addField(DateTimeSymbolicMonthFieldElement::create(document, m_editElement, m_parameters.localizer.shortStandAloneMonthLabels()));
+            m_editElement.addField(DateTimeSymbolicMonthFieldElement::create(document, m_editElement, m_parameters.locale.shortStandAloneMonthLabels()));
             break;
         case countForFullMonth:
-            m_editElement.addField(DateTimeSymbolicMonthFieldElement::create(document, m_editElement, m_parameters.localizer.standAloneMonthLabels()));
+            m_editElement.addField(DateTimeSymbolicMonthFieldElement::create(document, m_editElement, m_parameters.locale.standAloneMonthLabels()));
             break;
         default:
             m_editElement.addField(DateTimeMonthFieldElement::create(document, m_editElement, m_parameters.placeholderForMonth));
@@ -157,7 +157,7 @@ void DateTimeEditBuilder::visitField(DateTimeFormat::FieldType fieldType, int co
         return;
 
     case DateTimeFormat::FieldTypePeriod:
-        m_editElement.addField(DateTimeAMPMFieldElement::create(document, m_editElement, m_parameters.localizer.timeAMPMLabels()));
+        m_editElement.addField(DateTimeAMPMFieldElement::create(document, m_editElement, m_parameters.locale.timeAMPMLabels()));
         return;
 
     case DateTimeFormat::FieldTypeSecond: {
@@ -167,7 +167,7 @@ void DateTimeEditBuilder::visitField(DateTimeFormat::FieldType fieldType, int co
             field->setReadOnly();
 
         if (needMillisecondField()) {
-            visitLiteral(m_parameters.localizer.localizedDecimalSeparator());
+            visitLiteral(m_parameters.locale.localizedDecimalSeparator());
             visitField(DateTimeFormat::FieldTypeFractionalSecond, 3);
         }
         return;
@@ -249,7 +249,6 @@ DateTimeEditElement::EditControlOwner::~EditControlOwner()
 DateTimeEditElement::DateTimeEditElement(Document* document, EditControlOwner& editControlOwner)
     : HTMLDivElement(divTag, document)
     , m_editControlOwner(&editControlOwner)
-    , m_spinButton(0)
 {
     DEFINE_STATIC_LOCAL(AtomicString, dateTimeEditPseudoId, ("-webkit-datetime-edit"));
     setShadowPseudoId(dateTimeEditPseudoId);
@@ -259,9 +258,6 @@ DateTimeEditElement::~DateTimeEditElement()
 {
     for (size_t fieldIndex = 0; fieldIndex < m_fields.size(); ++fieldIndex)
         m_fields[fieldIndex]->removeEventHandler();
-
-    if (m_spinButton)
-        m_spinButton->removeSpinButtonOwner();
 }
 
 void DateTimeEditElement::addField(PassRefPtr<DateTimeFieldElement> field)
@@ -315,7 +311,7 @@ size_t DateTimeEditElement::fieldIndexOf(const DateTimeFieldElement& field) cons
     return invalidFieldIndex;
 }
 
-void DateTimeEditElement::focusAndSelectSpinButtonOwner()
+void DateTimeEditElement::focusIfNoFocus()
 {
     if (focusedFieldIndex() != invalidFieldIndex)
         return;
@@ -427,14 +423,6 @@ void DateTimeEditElement::layout(const LayoutParameters& layoutParameters, const
                 break;
         }
     }
-
-    DEFINE_STATIC_LOCAL(AtomicString, gapPseudoId, ("-webkit-datetime-edit-gap", AtomicString::ConstructFromLiteral));
-    RefPtr<HTMLDivElement> gapElement = HTMLDivElement::create(document());
-    gapElement->setShadowPseudoId(gapPseudoId);
-    appendChild(gapElement);
-    RefPtr<SpinButtonElement> spinButton = SpinButtonElement::create(document(), *this);
-    m_spinButton = spinButton.get();
-    appendChild(spinButton);
 }
 
 AtomicString DateTimeEditElement::localeIdentifier() const
@@ -464,12 +452,6 @@ void DateTimeEditElement::defaultEventHandler(Event* event)
             return;
     }
 
-    if (m_spinButton) {
-        m_spinButton->forwardEvent(event);
-        if (event->defaultHandled())
-            return;
-    }
-
     HTMLDivElement::defaultEventHandler(event);
 }
 
@@ -493,26 +475,18 @@ void DateTimeEditElement::setEmptyValue(const LayoutParameters& layoutParameters
         m_fields[fieldIndex]->setEmptyValue(dateForReadOnlyField, DateTimeFieldElement::DispatchNoEvent);
 }
 
-bool DateTimeEditElement::shouldSpinButtonRespondToMouseEvents()
+bool DateTimeEditElement::hasFocusedField()
 {
-    return !isDisabled() && !isReadOnly();
-}
-
-bool DateTimeEditElement::shouldSpinButtonRespondToWheelEvents()
-{
-    if (!shouldSpinButtonRespondToMouseEvents())
-        return false;
-
     return focusedFieldIndex() != invalidFieldIndex;
 }
 
-void DateTimeEditElement::spinButtonStepDown()
+void DateTimeEditElement::stepDown()
 {
     if (DateTimeFieldElement* const field = focusedField())
         field->stepDown();
 }
 
-void DateTimeEditElement::spinButtonStepUp()
+void DateTimeEditElement::stepUp()
 {
     if (DateTimeFieldElement* const field = focusedField())
         field->stepUp();
@@ -521,7 +495,6 @@ void DateTimeEditElement::spinButtonStepUp()
 void DateTimeEditElement::updateUIState()
 {
     if (isDisabled() || isReadOnly()) {
-        m_spinButton->releaseCapture();
         if (DateTimeFieldElement* field = focusedField())
             field->blur();
     }
diff --git a/Source/WebCore/html/shadow/DateTimeEditElement.h b/Source/WebCore/html/shadow/DateTimeEditElement.h
index f039e9954..35c5bc7e8 100644
--- a/Source/WebCore/html/shadow/DateTimeEditElement.h
+++ b/Source/WebCore/html/shadow/DateTimeEditElement.h
@@ -28,14 +28,13 @@
 
 #if ENABLE(INPUT_MULTIPLE_FIELDS_UI)
 #include "DateTimeFieldElement.h"
-#include "SpinButtonElement.h"
 #include "StepRange.h"
 
 namespace WebCore {
 
 class DateTimeFieldsState;
 class KeyboardEvent;
-class Localizer;
+class Locale;
 class MouseEvent;
 class StepRange;
 
@@ -43,7 +42,7 @@ class StepRange;
 // representing date and time, such as
 //  - Year, Month, Day Of Month
 //  - Hour, Minute, Second, Millisecond, AM/PM
-class DateTimeEditElement : public HTMLDivElement, public DateTimeFieldElement::FieldOwner, private SpinButtonElement::SpinButtonOwner {
+class DateTimeEditElement : public HTMLDivElement, public DateTimeFieldElement::FieldOwner {
     WTF_MAKE_NONCOPYABLE(DateTimeEditElement);
 
 public:
@@ -64,7 +63,7 @@ public:
     struct LayoutParameters {
         String dateTimeFormat;
         String fallbackDateTimeFormat;
-        Localizer& localizer;
+        Locale& locale;
         const StepRange stepRange;
         int minimumYear;
         int maximumYear;
@@ -72,8 +71,8 @@ public:
         String placeholderForMonth;
         String placeholderForYear;
 
-        LayoutParameters(Localizer& localizer, const StepRange& stepRange)
-            : localizer(localizer)
+        LayoutParameters(Locale& locale, const StepRange& stepRange)
+            : locale(locale)
             , stepRange(stepRange)
             , minimumYear(undefinedYear())
             , maximumYear(undefinedYear())
@@ -90,13 +89,17 @@ public:
     void blurByOwner();
     virtual void defaultEventHandler(Event*) OVERRIDE;
     void disabledStateChanged();
+    void focusIfNoFocus();
     void focusByOwner();
+    bool hasFocusedField();
     void readOnlyStateChanged();
     void removeEditControlOwner() { m_editControlOwner = 0; }
     void resetFields();
     void setEmptyValue(const LayoutParameters&, const DateComponents& dateForReadOnlyField);
     void setValueAsDate(const LayoutParameters&, const DateComponents&);
     void setValueAsDateTimeFieldsState(const DateTimeFieldsState&, const DateComponents& dateForReadOnlyField);
+    void stepDown();
+    void stepUp();
     String value() const;
     DateTimeFieldsState valueAsDateTimeFieldsState() const;
 
@@ -134,16 +137,8 @@ private:
     virtual bool isFieldOwnerDisabledOrReadOnly() const OVERRIDE FINAL;
     virtual AtomicString localeIdentifier() const OVERRIDE FINAL;
 
-    // SpinButtonElement::SpinButtonOwner functions.
-    virtual void focusAndSelectSpinButtonOwner() OVERRIDE FINAL;
-    virtual bool shouldSpinButtonRespondToMouseEvents() OVERRIDE FINAL;
-    virtual bool shouldSpinButtonRespondToWheelEvents() OVERRIDE FINAL;
-    virtual void spinButtonStepDown() OVERRIDE FINAL;
-    virtual void spinButtonStepUp() OVERRIDE FINAL;
-
     Vector<DateTimeFieldElement*, maximumNumberOfFields> m_fields;
     EditControlOwner* m_editControlOwner;
-    SpinButtonElement* m_spinButton;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/html/shadow/DateTimeNumericFieldElement.cpp b/Source/WebCore/html/shadow/DateTimeNumericFieldElement.cpp
index f843fa630..a92fe822e 100644
--- a/Source/WebCore/html/shadow/DateTimeNumericFieldElement.cpp
+++ b/Source/WebCore/html/shadow/DateTimeNumericFieldElement.cpp
@@ -29,7 +29,7 @@
 
 #include "FontCache.h"
 #include "KeyboardEvent.h"
-#include "Localizer.h"
+#include "PlatformLocale.h"
 #include "RenderStyle.h"
 #include "StyleResolver.h"
 #include "TextRun.h"
@@ -104,12 +104,12 @@ void DateTimeNumericFieldElement::didBlur()
 
 String DateTimeNumericFieldElement::formatValue(int value) const
 {
-    Localizer& localizer = localizerForOwner();
+    Locale& locale = localeForOwner();
     if (m_range.maximum > 999)
-        return localizer.convertToLocalizedNumber(String::format("%04d", value));
+        return locale.convertToLocalizedNumber(String::format("%04d", value));
     if (m_range.maximum > 99)
-        return localizer.convertToLocalizedNumber(String::format("%03d", value));
-    return localizer.convertToLocalizedNumber(String::format("%02d", value));
+        return locale.convertToLocalizedNumber(String::format("%03d", value));
+    return locale.convertToLocalizedNumber(String::format("%02d", value));
 }
 
 void DateTimeNumericFieldElement::handleKeyboardEvent(KeyboardEvent* keyboardEvent)
@@ -127,7 +127,7 @@ void DateTimeNumericFieldElement::handleKeyboardEvent(KeyboardEvent* keyboardEve
     DOMTimeStamp delta = keyboardEvent->timeStamp() - m_lastDigitCharTime;
     m_lastDigitCharTime = 0;
 
-    String number = localizerForOwner().convertFromLocalizedNumber(String(&charCode, 1));
+    String number = localeForOwner().convertFromLocalizedNumber(String(&charCode, 1));
     const int digit = number[0] - '0';
     if (digit < 0 || digit > 9)
         return;
@@ -145,9 +145,9 @@ bool DateTimeNumericFieldElement::hasValue() const
     return m_hasValue;
 }
 
-Localizer& DateTimeNumericFieldElement::localizerForOwner() const
+Locale& DateTimeNumericFieldElement::localeForOwner() const
 {
-    return document()->getCachedLocalizer(localeIdentifier());
+    return document()->getCachedLocale(localeIdentifier());
 }
 
 int DateTimeNumericFieldElement::maximum() const
diff --git a/Source/WebCore/html/shadow/DateTimeNumericFieldElement.h b/Source/WebCore/html/shadow/DateTimeNumericFieldElement.h
index 00eeef024..7811ebadc 100644
--- a/Source/WebCore/html/shadow/DateTimeNumericFieldElement.h
+++ b/Source/WebCore/html/shadow/DateTimeNumericFieldElement.h
@@ -80,7 +80,7 @@ private:
     virtual String value() const OVERRIDE FINAL;
 
     String formatValue(int) const;
-    Localizer& localizerForOwner() const;
+    Locale& localeForOwner() const;
 
     DOMTimeStamp m_lastDigitCharTime;
     const String m_placeholder;
diff --git a/Source/WebCore/html/shadow/HTMLContentElement.cpp b/Source/WebCore/html/shadow/HTMLContentElement.cpp
index dec9e08f7..5040e9eb8 100644
--- a/Source/WebCore/html/shadow/HTMLContentElement.cpp
+++ b/Source/WebCore/html/shadow/HTMLContentElement.cpp
@@ -29,10 +29,10 @@
 
 #include "ContentDistributor.h"
 #include "ContentSelectorQuery.h"
+#include "ContextFeatures.h"
 #include "ElementShadow.h"
 #include "HTMLNames.h"
 #include "QualifiedName.h"
-#include "RuntimeEnabledFeatures.h"
 #include "ShadowRoot.h"
 #include <wtf/StdLibExtras.h>
 
@@ -40,13 +40,14 @@ namespace WebCore {
 
 using HTMLNames::selectAttr;
 
-const QualifiedName& HTMLContentElement::contentTagName(Document*)
+const QualifiedName& HTMLContentElement::contentTagName(Document* document)
 {
 #if ENABLE(SHADOW_DOM)
-    if (!RuntimeEnabledFeatures::shadowDOMEnabled())
+    if (!ContextFeatures::shadowDOMEnabled(document))
         return HTMLNames::webkitShadowContentTag;
     return HTMLNames::contentTag;
 #else
+    UNUSED_PARAM(document);
     return HTMLNames::webkitShadowContentTag;
 #endif
 }
@@ -63,6 +64,7 @@ PassRefPtr<HTMLContentElement> HTMLContentElement::create(const QualifiedName& t
 
 HTMLContentElement::HTMLContentElement(const QualifiedName& name, Document* document)
     : InsertionPoint(name, document)
+    , m_registeredWithShadowRoot(false)
 {
 }
 
@@ -95,4 +97,29 @@ void HTMLContentElement::parseAttribute(const Attribute& attribute)
         InsertionPoint::parseAttribute(attribute);
 }
 
+Node::InsertionNotificationRequest HTMLContentElement::insertedInto(ContainerNode* insertionPoint)
+{
+    InsertionPoint::insertedInto(insertionPoint);
+
+    if (insertionPoint->inDocument() && isActive()) {
+        shadowRoot()->registerContentElement();
+        m_registeredWithShadowRoot = true;
+    }
+
+    return InsertionDone;
+}
+
+void HTMLContentElement::removedFrom(ContainerNode* insertionPoint)
+{
+    if (insertionPoint->inDocument() && m_registeredWithShadowRoot) {
+        ShadowRoot* root = shadowRoot();
+        if (!root)
+            root = insertionPoint->shadowRoot();
+        if (root)
+            root->unregisterContentElement();
+        m_registeredWithShadowRoot = false;
+    }
+    InsertionPoint::removedFrom(insertionPoint);
+}
+
 }
diff --git a/Source/WebCore/html/shadow/HTMLContentElement.h b/Source/WebCore/html/shadow/HTMLContentElement.h
index ea7fb89a5..2a3a32cea 100644
--- a/Source/WebCore/html/shadow/HTMLContentElement.h
+++ b/Source/WebCore/html/shadow/HTMLContentElement.h
@@ -48,13 +48,16 @@ public:
     void setSelect(const AtomicString&);
     virtual bool isSelectValid() const;
 
-    bool doesSelectFromHostChildren() const { return true; }
-
 protected:
     HTMLContentElement(const QualifiedName&, Document*);
 
+    virtual InsertionNotificationRequest insertedInto(ContainerNode*) OVERRIDE;
+    virtual void removedFrom(ContainerNode*) OVERRIDE;
+
 private:
     virtual void parseAttribute(const Attribute&) OVERRIDE;
+
+    bool m_registeredWithShadowRoot;
 };
 
 inline bool isHTMLContentElement(const Node* node)
diff --git a/Source/WebCore/html/shadow/HTMLShadowElement.cpp b/Source/WebCore/html/shadow/HTMLShadowElement.cpp
index 5c5dbe94f..7d7e41529 100644
--- a/Source/WebCore/html/shadow/HTMLShadowElement.cpp
+++ b/Source/WebCore/html/shadow/HTMLShadowElement.cpp
@@ -60,15 +60,6 @@ const AtomicString& HTMLShadowElement::select() const
      return nullAtom;
 }
 
-bool HTMLShadowElement::doesSelectFromHostChildren() const
-{
-    TreeScope* scope = treeScope();
-
-    if (scope->rootNode()->isShadowRoot())
-        return toShadowRoot(scope->rootNode())->isOldest();
-    return false;
-}
-
 Node::InsertionNotificationRequest HTMLShadowElement::insertedInto(ContainerNode* insertionPoint)
 {
     InsertionPoint::insertedInto(insertionPoint);
diff --git a/Source/WebCore/html/shadow/HTMLShadowElement.h b/Source/WebCore/html/shadow/HTMLShadowElement.h
index 119fa9f95..bac2b92b5 100644
--- a/Source/WebCore/html/shadow/HTMLShadowElement.h
+++ b/Source/WebCore/html/shadow/HTMLShadowElement.h
@@ -44,7 +44,6 @@ public:
 
     const AtomicString& select() const;
     bool isSelectValid() const OVERRIDE { return true; }
-    bool doesSelectFromHostChildren() const;
 
 protected:
     virtual InsertionNotificationRequest insertedInto(ContainerNode*) OVERRIDE;
@@ -56,6 +55,24 @@ private:
     bool m_registeredWithShadowRoot;
 };
 
+inline bool isHTMLShadowElement(const Node* node)
+{
+    ASSERT(node);
+    return node->hasTagName(HTMLNames::shadowTag);
+}
+
+inline HTMLShadowElement* toHTMLShadowElement(Node* node)
+{
+    ASSERT(!node || isHTMLShadowElement(node));
+    return static_cast<HTMLShadowElement*>(node);
+}
+
+inline const HTMLShadowElement* toHTMLShadowElement(const Node* node)
+{
+    ASSERT(!node || isHTMLShadowElement(node));
+    return static_cast<const HTMLShadowElement*>(node);
+}
+
 } // namespace WebCore
 
 #endif // HTMLShadowElement_h
diff --git a/Source/WebCore/html/shadow/InsertionPoint.h b/Source/WebCore/html/shadow/InsertionPoint.h
index aef9813f5..243a08c18 100644
--- a/Source/WebCore/html/shadow/InsertionPoint.h
+++ b/Source/WebCore/html/shadow/InsertionPoint.h
@@ -32,6 +32,7 @@
 #define InsertionPoint_h
 
 #include "ContentDistributor.h"
+#include "ElementShadow.h"
 #include "HTMLElement.h"
 #include "HTMLNames.h"
 #include "ShadowRoot.h"
@@ -53,7 +54,6 @@ public:
 
     virtual const AtomicString& select() const = 0;
     virtual bool isSelectValid() const = 0;
-    virtual bool doesSelectFromHostChildren() const = 0;
 
     bool resetStyleInheritance() const;
     void setResetStyleInheritance(bool);
@@ -87,9 +87,6 @@ private:
 
 inline bool isInsertionPoint(const Node* node)
 {
-    if (!node)
-        return false;
-
     if (node->isHTMLElement() && toHTMLElement(node)->isInsertionPoint())
         return true;
 
@@ -98,13 +95,13 @@ inline bool isInsertionPoint(const Node* node)
 
 inline InsertionPoint* toInsertionPoint(Node* node)
 {
-    ASSERT(isInsertionPoint(node));
+    ASSERT(!node || isInsertionPoint(node));
     return static_cast<InsertionPoint*>(node);
 }
 
 inline const InsertionPoint* toInsertionPoint(const Node* node)
 {
-    ASSERT(isInsertionPoint(node));
+    ASSERT(!node || isInsertionPoint(node));
     return static_cast<const InsertionPoint*>(node);
 }
 
@@ -115,24 +112,74 @@ inline bool isActiveInsertionPoint(const Node* node)
 
 inline bool isLowerEncapsulationBoundary(Node* node)
 {
-    if (!isInsertionPoint(node))
+    if (!node || !isInsertionPoint(node))
         return false;
     return toInsertionPoint(node)->isShadowBoundary();
 }
 
-inline Element* parentElementForDistribution(const Node* node)
+inline Node* parentNodeForDistribution(const Node* node)
 {
     ASSERT(node);
-    if (Element* parent = node->parentElement()) {
-        if (isInsertionPoint(parent) && toInsertionPoint(parent)->shouldUseFallbackElements())
-            return parent->parentElement();
 
+    if (Node* parent = node->parentNode()) {
+        if (isInsertionPoint(parent) && toInsertionPoint(parent)->shouldUseFallbackElements())
+            return parent->parentNode();
         return parent;
     }
 
     return 0;
 }
 
+inline Element* parentElementForDistribution(const Node* node)
+{
+    if (Node* parent = parentNodeForDistribution(node)) {
+        if (parent->isElementNode())
+            return toElement(parent);
+    }
+
+    return 0;
+}
+
+inline ElementShadow* shadowOfParentForDistribution(const Node* node)
+{
+    if (!node)
+        return 0;
+
+    if (Element* parent = parentElementForDistribution(node))
+        return parent->shadow();
+
+    return 0;
+}
+
+inline InsertionPoint* resolveReprojection(const Node* projectedNode)
+{
+    InsertionPoint* insertionPoint = 0;
+    const Node* current = projectedNode;
+
+    while (true) {
+        if (ElementShadow* shadow = shadowOfParentForDistribution(current)) {
+            shadow->ensureDistribution();
+            if (InsertionPoint* insertedTo = shadow->distributor().findInsertionPointFor(projectedNode)) {
+                current = insertedTo;
+                insertionPoint = insertedTo;
+                continue;
+            }
+        }
+
+        if (Node* parent = parentNodeForDistribution(current)) {
+            if (InsertionPoint* insertedTo = parent->isShadowRoot() ? toShadowRoot(parent)->assignedTo() : 0) {
+                current = insertedTo;
+                insertionPoint = insertedTo;
+                continue;
+            }
+        }
+
+        break;
+    }
+
+    return insertionPoint;
+}
+
 } // namespace WebCore
 
 #endif // InsertionPoint_h
diff --git a/Source/WebCore/html/shadow/MediaControlElements.cpp b/Source/WebCore/html/shadow/MediaControlElements.cpp
index ae3b18b0a..906466013 100644
--- a/Source/WebCore/html/shadow/MediaControlElements.cpp
+++ b/Source/WebCore/html/shadow/MediaControlElements.cpp
@@ -45,9 +45,11 @@
 #include "HTMLVideoElement.h"
 #include "LayoutRepainter.h"
 #include "LocalizedStrings.h"
+#include "MediaControlRootElement.h"
 #include "MediaControls.h"
 #include "MouseEvent.h"
 #include "Page.h"
+#include "PageGroup.h"
 #include "RenderDeprecatedFlexibleBox.h"
 #include "RenderInline.h"
 #include "RenderMedia.h"
@@ -1383,22 +1385,18 @@ void MediaControlTextTrackContainerElement::updateDisplay()
     hasChildNodes() ? show() : hide();
 }
 
-static const float mimimumFontSize = 16;
-static const float videoHeightFontSizePercentage = .05;
-static const float trackBottomMultiplier = .9;
-
 void MediaControlTextTrackContainerElement::updateSizes()
 {
     HTMLMediaElement* mediaElement = toParentMediaElement(this);
     if (!mediaElement || !mediaElement->renderer() || !mediaElement->renderer()->isVideo())
         return;
 
-    IntRect videoBox = toRenderVideo(mediaElement->renderer())->videoBox();
-    if (m_videoDisplaySize == videoBox)
+    if (!document()->page())
         return;
-    m_videoDisplaySize = videoBox;
 
-    float fontSize = m_videoDisplaySize.size().height() * videoHeightFontSizePercentage;
+    IntRect videoBox = toRenderVideo(mediaElement->renderer())->videoBox();
+
+    float fontSize = videoBox.size().height() * (document()->page()->group().captionFontSizeScale());
     if (fontSize != m_fontSize) {
         m_fontSize = fontSize;
         setInlineStyleProperty(CSSPropertyFontSize, String::number(fontSize) + "px");
diff --git a/Source/WebCore/html/shadow/PickerIndicatorElement.cpp b/Source/WebCore/html/shadow/PickerIndicatorElement.cpp
index fa25bd673..f4d37f4b9 100644
--- a/Source/WebCore/html/shadow/PickerIndicatorElement.cpp
+++ b/Source/WebCore/html/shadow/PickerIndicatorElement.cpp
@@ -29,17 +29,13 @@
  */
 
 #include "config.h"
+#if ENABLE(INPUT_MULTIPLE_FIELDS_UI)
 #include "PickerIndicatorElement.h"
 
-#if ENABLE(CALENDAR_PICKER)
-
 #include "Chrome.h"
 #include "ChromeClient.h"
 #include "Event.h"
-#include "FrameView.h"
-#include "HTMLDataListElement.h"
 #include "HTMLInputElement.h"
-#include "HTMLOptionElement.h"
 #include "Page.h"
 #include "RenderDetailsMarker.h"
 
@@ -51,7 +47,6 @@ using namespace HTMLNames;
 
 inline PickerIndicatorElement::PickerIndicatorElement(Document* document)
     : HTMLDivElement(divTag, document)
-    , m_chooser(nullptr)
 {
     setShadowPseudoId("-webkit-calendar-picker-indicator");
 }
@@ -126,38 +121,9 @@ void PickerIndicatorElement::openPopup()
     Chrome* chrome = document()->page()->chrome();
     if (!chrome)
         return;
-    if (!document()->view())
-        return;
-
-    HTMLInputElement* input = hostInput();
     DateTimeChooserParameters parameters;
-    parameters.type = input->type();
-    parameters.minimum = input->minimum();
-    parameters.maximum = input->maximum();
-    parameters.required = input->required();
-
-    StepRange stepRange = input->createStepRange(RejectAny);
-    if (stepRange.hasStep()) {
-        parameters.step = stepRange.step().toDouble();
-        parameters.stepBase = stepRange.stepBase().toDouble();
-    } else {
-        parameters.step = 1.0;
-        parameters.stepBase = 0;
-    }
-
-    parameters.anchorRectInRootView = document()->view()->contentsToRootView(hostInput()->pixelSnappedBoundingBox());
-    parameters.currentValue = input->value();
-    parameters.isAnchorElementRTL = input->computedStyle()->direction() == RTL;
-    if (HTMLDataListElement* dataList = input->dataList()) {
-        RefPtr<HTMLCollection> options = dataList->options();
-        for (unsigned i = 0; HTMLOptionElement* option = toHTMLOptionElement(options->item(i)); ++i) {
-            if (!input->isValidValue(option->value()))
-                continue;
-            parameters.suggestionValues.append(input->sanitizeValue(option->value()));
-            parameters.localizedSuggestionValues.append(input->localizeValue(option->value()));
-            parameters.suggestionLabels.append(option->value() == option->label() ? String() : option->label());
-        }
-    }
+    if (!hostInput()->setupDateTimeChooserParameters(parameters))
+        return;
     m_chooser = chrome->client()->openDateTimeChooser(this, parameters);
 }
 
diff --git a/Source/WebCore/html/shadow/PickerIndicatorElement.h b/Source/WebCore/html/shadow/PickerIndicatorElement.h
index 1d891c22a..cb7556717 100644
--- a/Source/WebCore/html/shadow/PickerIndicatorElement.h
+++ b/Source/WebCore/html/shadow/PickerIndicatorElement.h
@@ -31,8 +31,7 @@
 #ifndef PickerIndicatorElement_h
 #define PickerIndicatorElement_h
 
-#if ENABLE(CALENDAR_PICKER)
-
+#if ENABLE(INPUT_MULTIPLE_FIELDS_UI)
 #include "DateTimeChooser.h"
 #include "DateTimeChooserClient.h"
 #include "HTMLDivElement.h"
@@ -63,7 +62,7 @@ private:
 
     HTMLInputElement* hostInput();
 
-    OwnPtr<DateTimeChooser> m_chooser;
+    RefPtr<DateTimeChooser> m_chooser;
 };
 
 }
diff --git a/Source/WebCore/html/shadow/TextControlInnerElements.cpp b/Source/WebCore/html/shadow/TextControlInnerElements.cpp
index fdc25355d..6a565b300 100644
--- a/Source/WebCore/html/shadow/TextControlInnerElements.cpp
+++ b/Source/WebCore/html/shadow/TextControlInnerElements.cpp
@@ -67,7 +67,7 @@ PassRefPtr<RenderStyle> TextControlInnerElement::customStyleForRenderer()
     return parentRenderer->createInnerBlockStyle(parentRenderer->style());
 }
 
-// ----------------------------
+// ---------------------------
 
 inline TextControlInnerTextElement::TextControlInnerTextElement(Document* document)
     : HTMLDivElement(divTag, document)
diff --git a/Source/WebCore/html/track/TextTrack.cpp b/Source/WebCore/html/track/TextTrack.cpp
index 120fce79c..4f76b8abf 100644
--- a/Source/WebCore/html/track/TextTrack.cpp
+++ b/Source/WebCore/html/track/TextTrack.cpp
@@ -94,7 +94,7 @@ const AtomicString& TextTrack::showingKeyword()
     return ended;
 }
 
-TextTrack::TextTrack(ScriptExecutionContext* context, TextTrackClient* client, const String& kind, const String& label, const String& language, TextTrackType type)
+TextTrack::TextTrack(ScriptExecutionContext* context, TextTrackClient* client, const AtomicString& kind, const AtomicString& label, const AtomicString& language, TextTrackType type)
     : TrackBase(context, TrackBase::TextTrack)
     , m_cues(0)
     , m_mediaElement(0)
@@ -112,12 +112,17 @@ TextTrack::TextTrack(ScriptExecutionContext* context, TextTrackClient* client, c
 
 TextTrack::~TextTrack()
 {
-    if (m_client && m_cues)
-        m_client->textTrackRemoveCues(this, m_cues.get());
+    if (m_cues) {
+        if (m_client)
+            m_client->textTrackRemoveCues(this, m_cues.get());
+
+        for (size_t i = 0; i < m_cues->length(); ++i)
+            m_cues->item(i)->setTrack(0);
+    }
     clearClient();
 }
 
-bool TextTrack::isValidKindKeyword(const String& value)
+bool TextTrack::isValidKindKeyword(const AtomicString& value)
 {
     if (equalIgnoringCase(value, subtitlesKeyword()))
         return true;
@@ -133,7 +138,7 @@ bool TextTrack::isValidKindKeyword(const String& value)
     return false;
 }
 
-void TextTrack::setKind(const String& kind)
+void TextTrack::setKind(const AtomicString& kind)
 {
     String oldKind = m_kind;
 
@@ -146,7 +151,7 @@ void TextTrack::setKind(const String& kind)
         m_client->textTrackKindChanged(this);
 }
 
-void TextTrack::setMode(const String& mode)
+void TextTrack::setMode(const AtomicString& mode)
 {
     // On setting, if the new value isn't equal to what the attribute would currently
     // return, the new value must be processed as follows ...
@@ -174,7 +179,7 @@ void TextTrack::setMode(const String& mode)
         m_client->textTrackModeChanged(this);
 }
 
-String TextTrack::mode() const
+AtomicString TextTrack::mode() const
 {
     // The text track "showing" and "showing by default" modes return the string "showing".
     if (m_showingByDefault)
diff --git a/Source/WebCore/html/track/TextTrack.h b/Source/WebCore/html/track/TextTrack.h
index 2c799ed04..3ba4d37ba 100644
--- a/Source/WebCore/html/track/TextTrack.h
+++ b/Source/WebCore/html/track/TextTrack.h
@@ -54,7 +54,7 @@ public:
 
 class TextTrack : public TrackBase {
 public:
-    static PassRefPtr<TextTrack> create(ScriptExecutionContext* context, TextTrackClient* client, const String& kind, const String& label, const String& language)
+    static PassRefPtr<TextTrack> create(ScriptExecutionContext* context, TextTrackClient* client, const AtomicString& kind, const AtomicString& label, const AtomicString& language)
     {
         return adoptRef(new TextTrack(context, client, kind, label, language, AddTrack));
     }
@@ -63,28 +63,28 @@ public:
     void setMediaElement(HTMLMediaElement* element) { m_mediaElement = element; }
     HTMLMediaElement* mediaElement() { return m_mediaElement; }
 
-    String kind() const { return m_kind; }
-    void setKind(const String&);
+    AtomicString kind() const { return m_kind; }
+    void setKind(const AtomicString&);
 
     static const AtomicString& subtitlesKeyword();
     static const AtomicString& captionsKeyword();
     static const AtomicString& descriptionsKeyword();
     static const AtomicString& chaptersKeyword();
     static const AtomicString& metadataKeyword();
-    static bool isValidKindKeyword(const String&);
+    static bool isValidKindKeyword(const AtomicString&);
 
-    String label() const { return m_label; }
-    void setLabel(const String& label) { m_label = label; }
+    AtomicString label() const { return m_label; }
+    void setLabel(const AtomicString& label) { m_label = label; }
 
-    String language() const { return m_language; }
-    void setLanguage(const String& language) { m_language = language; }
+    AtomicString language() const { return m_language; }
+    void setLanguage(const AtomicString& language) { m_language = language; }
 
     static const AtomicString& disabledKeyword();
     static const AtomicString& hiddenKeyword();
     static const AtomicString& showingKeyword();
 
-    String mode() const;
-    void setMode(const String&);
+    AtomicString mode() const;
+    void setMode(const AtomicString&);
 
     bool showingByDefault() const { return m_showingByDefault; }
     void setShowingByDefault(bool showing) { m_showingByDefault = showing; }
@@ -116,17 +116,17 @@ public:
     bool isRendered();
 
 protected:
-    TextTrack(ScriptExecutionContext*, TextTrackClient*, const String& kind, const String& label, const String& language, TextTrackType);
+    TextTrack(ScriptExecutionContext*, TextTrackClient*, const AtomicString& kind, const AtomicString& label, const AtomicString& language, TextTrackType);
 
     RefPtr<TextTrackCueList> m_cues;
 
 private:
     TextTrackCueList* ensureTextTrackCueList();
     HTMLMediaElement* m_mediaElement;
-    String m_kind;
-    String m_label;
-    String m_language;
-    String m_mode;
+    AtomicString m_kind;
+    AtomicString m_label;
+    AtomicString m_language;
+    AtomicString m_mode;
     TextTrackClient* m_client;
     TextTrackType m_trackType;
     ReadinessState m_readinessState;
diff --git a/Source/WebCore/html/track/TextTrackCue.cpp b/Source/WebCore/html/track/TextTrackCue.cpp
index 2fd4f1d4b..a04b1b8cb 100644
--- a/Source/WebCore/html/track/TextTrackCue.cpp
+++ b/Source/WebCore/html/track/TextTrackCue.cpp
@@ -95,6 +95,7 @@ TextTrackCueBox::TextTrackCueBox(Document* document, TextTrackCue* cue)
     : HTMLElement(divTag, document)
     , m_cue(cue)
 {
+    setShadowPseudoId(shadowPseudoId());
 }
 
 TextTrackCue* TextTrackCueBox::getCue() const
@@ -167,12 +168,17 @@ void TextTrackCueBox::applyCSSProperties()
     }
 }
 
-const AtomicString& TextTrackCueBox::shadowPseudoId() const
+const AtomicString& TextTrackCueBox::textTrackCueBoxShadowPseudoId()
 {
     DEFINE_STATIC_LOCAL(const AtomicString, trackDisplayBoxShadowPseudoId, ("-webkit-media-text-track-display"));
     return trackDisplayBoxShadowPseudoId;
 }
 
+const AtomicString& TextTrackCueBox::shadowPseudoId() const
+{
+    return textTrackCueBoxShadowPseudoId();
+}
+
 RenderObject* TextTrackCueBox::createRenderer(RenderArena* arena, RenderStyle*)
 {
     return new (arena) RenderTextTrackCue(this);
@@ -180,6 +186,18 @@ RenderObject* TextTrackCueBox::createRenderer(RenderArena* arena, RenderStyle*)
 
 // ----------------------------
 
+const AtomicString& TextTrackCue::pastNodesShadowPseudoId()
+{
+    DEFINE_STATIC_LOCAL(const AtomicString, subtitles, ("-webkit-media-text-track-past-nodes", AtomicString::ConstructFromLiteral));
+    return subtitles;
+}
+
+const AtomicString& TextTrackCue::futureNodesShadowPseudoId()
+{
+    DEFINE_STATIC_LOCAL(const AtomicString, subtitles, ("-webkit-media-text-track-future-nodes", AtomicString::ConstructFromLiteral));
+    return subtitles;
+}
+
 TextTrackCue::TextTrackCue(ScriptExecutionContext* context, double start, double end, const String& content)
     : m_startTime(start)
     , m_endTime(end)
@@ -192,6 +210,7 @@ TextTrackCue::TextTrackCue(ScriptExecutionContext* context, double start, double
     , m_writingDirection(Horizontal)
     , m_cueAlignment(Middle)
     , m_documentFragment(0)
+    , m_track(0)
     , m_scriptExecutionContext(context)
     , m_isActive(false)
     , m_pauseOnExit(false)
@@ -234,10 +253,10 @@ void TextTrackCue::cueDidChange()
 
 TextTrack* TextTrackCue::track() const
 {
-    return m_track.get();
+    return m_track;
 }
 
-void TextTrackCue::setTrack(PassRefPtr<TextTrack>track)
+void TextTrackCue::setTrack(TextTrack* track)
 {
     m_track = track;
 }
@@ -652,9 +671,6 @@ void TextTrackCue::updateDisplayTree(float movieTime)
     // timestamps (processing instructions), along with displayable nodes.
     DEFINE_STATIC_LOCAL(const String, timestampTag, (ASCIILiteral("timestamp")));
 
-    DEFINE_STATIC_LOCAL(const AtomicString, trackPastNodesShadowPseudoId, ("-webkit-media-text-track-past-nodes"));
-    DEFINE_STATIC_LOCAL(const AtomicString, trackFutureNodesShadowPseudoId, ("-webkit-media-text-track-future-nodes"));
-
     if (!track()->isRendered())
       return;
 
@@ -662,10 +678,10 @@ void TextTrackCue::updateDisplayTree(float movieTime)
 
     // Clear the contents of the two sets.
     m_futureDocumentNodes->removeChildren();
-    m_futureDocumentNodes->setShadowPseudoId(trackFutureNodesShadowPseudoId);
+    m_futureDocumentNodes->setShadowPseudoId(futureNodesShadowPseudoId());
 
     m_pastDocumentNodes->removeChildren();
-    m_pastDocumentNodes->setShadowPseudoId(trackPastNodesShadowPseudoId);
+    m_pastDocumentNodes->setShadowPseudoId(pastNodesShadowPseudoId());
 
     // Update the two sets containing past and future WebVTT objects.
     RefPtr<DocumentFragment> referenceTree = getCueAsHTML();
diff --git a/Source/WebCore/html/track/TextTrackCue.h b/Source/WebCore/html/track/TextTrackCue.h
index 115a86809..01a0e6603 100644
--- a/Source/WebCore/html/track/TextTrackCue.h
+++ b/Source/WebCore/html/track/TextTrackCue.h
@@ -60,6 +60,7 @@ public:
     void applyCSSProperties();
 
     virtual const AtomicString& shadowPseudoId() const OVERRIDE;
+    static const AtomicString& textTrackCueBoxShadowPseudoId();
 
 private:
     TextTrackCueBox(Document*, TextTrackCue*);
@@ -80,8 +81,11 @@ public:
 
     virtual ~TextTrackCue();
 
+    static const AtomicString& pastNodesShadowPseudoId();
+    static const AtomicString& futureNodesShadowPseudoId();
+
     TextTrack* track() const;
-    void setTrack(PassRefPtr<TextTrack>);
+    void setTrack(TextTrack*);
 
     const String& id() const { return m_id; }
     void setId(const String&);
@@ -193,7 +197,7 @@ private:
     Alignment m_cueAlignment;
 
     RefPtr<DocumentFragment> m_documentFragment;
-    RefPtr<TextTrack> m_track;
+    TextTrack* m_track;
 
     EventTargetData m_eventTargetData;
     ScriptExecutionContext* m_scriptExecutionContext;
diff --git a/Source/WebCore/html/track/TextTrackCueList.cpp b/Source/WebCore/html/track/TextTrackCueList.cpp
index 45ef441b1..56eb0a64c 100644
--- a/Source/WebCore/html/track/TextTrackCueList.cpp
+++ b/Source/WebCore/html/track/TextTrackCueList.cpp
@@ -92,12 +92,12 @@ bool TextTrackCueList::add(PassRefPtr<TextTrackCue> prpCue, size_t start, size_t
     // http://www.whatwg.org/specs/web-apps/current-work/#text-track-cue-order
     RefPtr<TextTrackCue> cue = prpCue;
     if (start == end) {
-        if (!m_list.isEmpty() && (m_list[start - 1].get() == cue.get()))
+        if (!m_list.isEmpty() && (start > 0) && (m_list[start - 1].get() == cue.get()))
             return false;
 
-       m_list.insert(start, cue);
-       invalidateCueIndexes(start);
-       return true;
+        m_list.insert(start, cue);
+        invalidateCueIndexes(start);
+        return true;
     }
 
     size_t index = (start + end) / 2;
diff --git a/Source/WebCore/inspector/BindingVisitors.h b/Source/WebCore/inspector/BindingVisitors.h
index 7530c9247..c885703ac 100644
--- a/Source/WebCore/inspector/BindingVisitors.h
+++ b/Source/WebCore/inspector/BindingVisitors.h
@@ -38,11 +38,11 @@ namespace WebCore {
 
 class Node;
 
-class NodeWrapperVisitor {
+class WrappedNodeVisitor {
 public:
     virtual void visitNode(Node*) = 0;
 protected:
-    virtual ~NodeWrapperVisitor() { }
+    virtual ~WrappedNodeVisitor() { }
 };
 
 class ExternalStringVisitor {
diff --git a/Source/WebCore/inspector/ConsoleMessage.cpp b/Source/WebCore/inspector/ConsoleMessage.cpp
index 801755390..5a873622b 100644
--- a/Source/WebCore/inspector/ConsoleMessage.cpp
+++ b/Source/WebCore/inspector/ConsoleMessage.cpp
@@ -35,6 +35,7 @@
 #include "ConsoleMessage.h"
 
 #include "Console.h"
+#include "IdentifiersFactory.h"
 #include "InjectedScript.h"
 #include "InjectedScriptManager.h"
 #include "InspectorFrontend.h"
@@ -46,7 +47,7 @@
 
 namespace WebCore {
 
-ConsoleMessage::ConsoleMessage(MessageSource s, MessageType t, MessageLevel l, const String& m, const String& u, unsigned li, const String& requestId)
+ConsoleMessage::ConsoleMessage(MessageSource s, MessageType t, MessageLevel l, const String& m, const String& u, unsigned li, unsigned long requestIdentifier)
     : m_source(s)
     , m_type(t)
     , m_level(l)
@@ -54,11 +55,11 @@ ConsoleMessage::ConsoleMessage(MessageSource s, MessageType t, MessageLevel l, c
     , m_url(u)
     , m_line(li)
     , m_repeatCount(1)
-    , m_requestId(requestId)
+    , m_requestId(IdentifiersFactory::requestId(requestIdentifier))
 {
 }
 
-ConsoleMessage::ConsoleMessage(MessageSource s, MessageType t, MessageLevel l, const String& m, PassRefPtr<ScriptArguments> arguments, PassRefPtr<ScriptCallStack> callStack)
+ConsoleMessage::ConsoleMessage(MessageSource s, MessageType t, MessageLevel l, const String& m, PassRefPtr<ScriptArguments> arguments, PassRefPtr<ScriptCallStack> callStack, unsigned long requestIdentifier)
     : m_source(s)
     , m_type(t)
     , m_level(l)
@@ -67,6 +68,7 @@ ConsoleMessage::ConsoleMessage(MessageSource s, MessageType t, MessageLevel l, c
     , m_url()
     , m_line(0)
     , m_repeatCount(1)
+    , m_requestId(IdentifiersFactory::requestId(requestIdentifier))
 {
     if (callStack && callStack->size()) {
         const ScriptCallFrame& frame = callStack->at(0);
@@ -76,7 +78,7 @@ ConsoleMessage::ConsoleMessage(MessageSource s, MessageType t, MessageLevel l, c
     m_callStack = callStack;
 }
 
-ConsoleMessage::ConsoleMessage(MessageSource s, MessageType t, MessageLevel l, const String& m, const String& responseUrl, const String& requestId)
+ConsoleMessage::ConsoleMessage(MessageSource s, MessageType t, MessageLevel l, const String& m, const String& responseUrl, unsigned long requestIdentifier)
     : m_source(s)
     , m_type(t)
     , m_level(l)
@@ -84,7 +86,7 @@ ConsoleMessage::ConsoleMessage(MessageSource s, MessageType t, MessageLevel l, c
     , m_url(responseUrl)
     , m_line(0)
     , m_repeatCount(1)
-    , m_requestId(requestId)
+    , m_requestId(IdentifiersFactory::requestId(requestIdentifier))
 {
 }
 
@@ -110,6 +112,7 @@ static TypeBuilder::Console::ConsoleMessage::Type::Enum messageTypeValue(Message
 {
     switch (type) {
     case LogMessageType: return TypeBuilder::Console::ConsoleMessage::Type::Log;
+    case ClearMessageType: return TypeBuilder::Console::ConsoleMessage::Type::Clear;
     case DirMessageType: return TypeBuilder::Console::ConsoleMessage::Type::Dir;
     case DirXMLMessageType: return TypeBuilder::Console::ConsoleMessage::Type::Dirxml;
     case TraceMessageType: return TypeBuilder::Console::ConsoleMessage::Type::Trace;
diff --git a/Source/WebCore/inspector/ConsoleMessage.h b/Source/WebCore/inspector/ConsoleMessage.h
index 6461db720..07efa1762 100644
--- a/Source/WebCore/inspector/ConsoleMessage.h
+++ b/Source/WebCore/inspector/ConsoleMessage.h
@@ -51,9 +51,9 @@ class ScriptValue;
 class ConsoleMessage {
     WTF_MAKE_NONCOPYABLE(ConsoleMessage); WTF_MAKE_FAST_ALLOCATED;
 public:
-    ConsoleMessage(MessageSource, MessageType, MessageLevel, const String& m, const String& u, unsigned li, const String& requestId = String());
-    ConsoleMessage(MessageSource, MessageType, MessageLevel, const String& m, PassRefPtr<ScriptArguments>, PassRefPtr<ScriptCallStack>);
-    ConsoleMessage(MessageSource, MessageType, MessageLevel, const String& m, const String& responseUrl, const String& requestId);
+    ConsoleMessage(MessageSource, MessageType, MessageLevel, const String& m, const String& u, unsigned li, unsigned long requestIdentifier = 0);
+    ConsoleMessage(MessageSource, MessageType, MessageLevel, const String& m, PassRefPtr<ScriptArguments>, PassRefPtr<ScriptCallStack>, unsigned long requestIdentifier = 0);
+    ConsoleMessage(MessageSource, MessageType, MessageLevel, const String& m, const String& responseUrl, unsigned long requestIdentifier);
     ~ConsoleMessage();
 
     void addToFrontend(InspectorFrontend::Console*, InjectedScriptManager*, bool generatePreview);
diff --git a/Source/WebCore/inspector/IdentifiersFactory.cpp b/Source/WebCore/inspector/IdentifiersFactory.cpp
index c2af2a566..dce2a2850 100644
--- a/Source/WebCore/inspector/IdentifiersFactory.cpp
+++ b/Source/WebCore/inspector/IdentifiersFactory.cpp
@@ -49,7 +49,9 @@ String IdentifiersFactory::createIdentifier()
 // static
 String IdentifiersFactory::requestId(unsigned long identifier)
 {
-    return addProcessIdPrefixTo(String::number(identifier));
+    if (identifier)
+        return addProcessIdPrefixTo(String::number(identifier));
+    return String();
 }
 
 // static
diff --git a/Source/WebCore/inspector/InjectedScript.cpp b/Source/WebCore/inspector/InjectedScript.cpp
index 67dd39e90..53f13e033 100644
--- a/Source/WebCore/inspector/InjectedScript.cpp
+++ b/Source/WebCore/inspector/InjectedScript.cpp
@@ -61,27 +61,29 @@ InjectedScript::InjectedScript(ScriptObject injectedScriptObject, InspectedState
 {
 }
 
-void InjectedScript::evaluate(ErrorString* errorString, const String& expression, const String& objectGroup, bool includeCommandLineAPI, bool returnByValue, RefPtr<TypeBuilder::Runtime::RemoteObject>* result, TypeBuilder::OptOutput<bool>* wasThrown)
+void InjectedScript::evaluate(ErrorString* errorString, const String& expression, const String& objectGroup, bool includeCommandLineAPI, bool returnByValue, bool generatePreview, RefPtr<TypeBuilder::Runtime::RemoteObject>* result, TypeBuilder::OptOutput<bool>* wasThrown)
 {
     ScriptFunctionCall function(injectedScriptObject(), "evaluate");
     function.appendArgument(expression);
     function.appendArgument(objectGroup);
     function.appendArgument(includeCommandLineAPI);
     function.appendArgument(returnByValue);
+    function.appendArgument(generatePreview);
     makeEvalCall(errorString, function, result, wasThrown);
 }
 
-void InjectedScript::callFunctionOn(ErrorString* errorString, const String& objectId, const String& expression, const String& arguments, bool returnByValue, RefPtr<TypeBuilder::Runtime::RemoteObject>* result, TypeBuilder::OptOutput<bool>* wasThrown)
+void InjectedScript::callFunctionOn(ErrorString* errorString, const String& objectId, const String& expression, const String& arguments, bool returnByValue, bool generatePreview, RefPtr<TypeBuilder::Runtime::RemoteObject>* result, TypeBuilder::OptOutput<bool>* wasThrown)
 {
     ScriptFunctionCall function(injectedScriptObject(), "callFunctionOn");
     function.appendArgument(objectId);
     function.appendArgument(expression);
     function.appendArgument(arguments);
     function.appendArgument(returnByValue);
+    function.appendArgument(generatePreview);
     makeEvalCall(errorString, function, result, wasThrown);
 }
 
-void InjectedScript::evaluateOnCallFrame(ErrorString* errorString, const ScriptValue& callFrames, const String& callFrameId, const String& expression, const String& objectGroup, bool includeCommandLineAPI, bool returnByValue, RefPtr<RemoteObject>* result, TypeBuilder::OptOutput<bool>* wasThrown)
+void InjectedScript::evaluateOnCallFrame(ErrorString* errorString, const ScriptValue& callFrames, const String& callFrameId, const String& expression, const String& objectGroup, bool includeCommandLineAPI, bool returnByValue, bool generatePreview, RefPtr<RemoteObject>* result, TypeBuilder::OptOutput<bool>* wasThrown)
 {
     ScriptFunctionCall function(injectedScriptObject(), "evaluateOnCallFrame");
     function.appendArgument(callFrames);
@@ -90,6 +92,7 @@ void InjectedScript::evaluateOnCallFrame(ErrorString* errorString, const ScriptV
     function.appendArgument(objectGroup);
     function.appendArgument(includeCommandLineAPI);
     function.appendArgument(returnByValue);
+    function.appendArgument(generatePreview);
     makeEvalCall(errorString, function, result, wasThrown);
 }
 
diff --git a/Source/WebCore/inspector/InjectedScript.h b/Source/WebCore/inspector/InjectedScript.h
index 8a6f33b16..dd9c29920 100644
--- a/Source/WebCore/inspector/InjectedScript.h
+++ b/Source/WebCore/inspector/InjectedScript.h
@@ -58,6 +58,7 @@ public:
                   const String& objectGroup,
                   bool includeCommandLineAPI,
                   bool returnByValue,
+                  bool generatePreview,
                   RefPtr<TypeBuilder::Runtime::RemoteObject>* result,
                   TypeBuilder::OptOutput<bool>* wasThrown);
     void callFunctionOn(ErrorString*,
@@ -65,6 +66,7 @@ public:
                         const String& expression,
                         const String& arguments,
                         bool returnByValue,
+                        bool generatePreview,
                         RefPtr<TypeBuilder::Runtime::RemoteObject>* result,
                         TypeBuilder::OptOutput<bool>* wasThrown);
     void evaluateOnCallFrame(ErrorString*,
@@ -74,6 +76,7 @@ public:
                              const String& objectGroup,
                              bool includeCommandLineAPI,
                              bool returnByValue,
+                             bool generatePreview,
                              RefPtr<TypeBuilder::Runtime::RemoteObject>* result,
                              TypeBuilder::OptOutput<bool>* wasThrown);
     void restartFrame(ErrorString*, const ScriptValue& callFrames, const String& callFrameId, RefPtr<InspectorObject>* result);
diff --git a/Source/WebCore/inspector/InjectedScriptCanvasModuleSource.js b/Source/WebCore/inspector/InjectedScriptCanvasModuleSource.js
index 3295fc4c9..eeb3ee396 100644
--- a/Source/WebCore/inspector/InjectedScriptCanvasModuleSource.js
+++ b/Source/WebCore/inspector/InjectedScriptCanvasModuleSource.js
@@ -38,7 +38,7 @@
 var TypeUtils = {
     /**
      * http://www.khronos.org/registry/typedarray/specs/latest/#7
-     * @type {Array.<Function>}
+     * @type {!Array.<Function>}
      */
     _typedArrayClasses: (function(typeNames) {
         var result = [];
@@ -117,6 +117,20 @@ var TypeUtils = {
     },
 
     /**
+     * @param {Object=} obj
+     * @return {Object}
+     */
+    cloneObject: function(obj)
+    {
+        if (!obj)
+            return null;
+        var result = {};
+        for (var key in obj)
+            result[key] = obj[key];
+        return result;
+    },
+
+    /**
      * @return {CanvasRenderingContext2D}
      */
     _dummyCanvas2dContext: function()
@@ -124,7 +138,7 @@ var TypeUtils = {
         var context = TypeUtils._dummyCanvas2dContextInstance;
         if (!context) {
             var canvas = inspectedWindow.document.createElement("canvas");
-            context = /** @type {CanvasRenderingContext2D} */ Resource.wrappedObject(canvas.getContext("2d"));
+            context = /** @type {CanvasRenderingContext2D} */ (Resource.wrappedObject(canvas.getContext("2d")));
             TypeUtils._dummyCanvas2dContextInstance = context;
         }
         return context;
@@ -175,7 +189,7 @@ function StackTraceV8(stackTraceLimit, topMostFunctionToIgnore)
     if (typeof stackTraceLimit === "number")
         Error.stackTraceLimit = stackTraceLimit;
 
-    this._error = /** @type {{stack: Array}} */ {};
+    this._error = /** @type {{stack: Array}} */ ({});
     Error.captureStackTrace(this._error, topMostFunctionToIgnore || arguments.callee);
 
     Error.stackTraceLimit = oldStackTraceLimit;
@@ -358,6 +372,28 @@ Call.prototype = {
         this._result = result;
     },
 
+    /**
+     * @param {string} name
+     * @param {Object} attachment
+     */
+    setAttachment: function(name, attachment)
+    {
+        if (attachment) {
+            this._attachments = this._attachments || {};
+            this._attachments[name] = attachment;
+        } else if (this._attachments)
+            delete this._attachments[name];
+    },
+
+    /**
+     * @param {string} name
+     * @return {Object}
+     */
+    attachment: function(name)
+    {
+        return this._attachments && this._attachments[name];
+    },
+
     freeze: function()
     {
         if (this._freezed)
@@ -377,12 +413,13 @@ Call.prototype = {
     toReplayable: function(cache)
     {
         this.freeze();
-        var thisObject = /** @type {ReplayableResource} */ Resource.toReplayable(this._thisObject, cache);
+        var thisObject = /** @type {ReplayableResource} */ (Resource.toReplayable(this._thisObject, cache));
         var result = Resource.toReplayable(this._result, cache);
         var args = this._args.map(function(obj) {
             return Resource.toReplayable(obj, cache);
         });
-        return new ReplayableCall(thisObject, this._functionName, args, result, this._stackTrace);
+        var attachments = TypeUtils.cloneObject(this._attachments);
+        return new ReplayableCall(thisObject, this._functionName, args, result, this._stackTrace, attachments);
     },
 
     /**
@@ -417,6 +454,9 @@ Call.prototype = {
         this._result = replayResult;
         this._stackTrace = replayableCall.stackTrace();
         this._freezed = true;
+        var attachments = replayableCall.attachments();
+        if (attachments)
+            this._attachments = TypeUtils.cloneObject(attachments);
         return this;
     }
 }
@@ -428,14 +468,17 @@ Call.prototype = {
  * @param {Array.<ReplayableResource|*>} args
  * @param {ReplayableResource|*} result
  * @param {StackTrace} stackTrace
+ * @param {Object.<string, Object>} attachments
  */
-function ReplayableCall(thisObject, functionName, args, result, stackTrace)
+function ReplayableCall(thisObject, functionName, args, result, stackTrace, attachments)
 {
     this._thisObject = thisObject;
     this._functionName = functionName;
     this._args = args;
     this._result = result;
     this._stackTrace = stackTrace;
+    if (attachments)
+        this._attachments = attachments;
 }
 
 ReplayableCall.prototype = {
@@ -488,6 +531,23 @@ ReplayableCall.prototype = {
     },
 
     /**
+     * @return {Object.<string, Object>}
+     */
+    attachments: function()
+    {
+        return this._attachments;
+    },
+
+    /**
+     * @param {string} name
+     * @return {Object}
+     */
+    attachment: function(name)
+    {
+        return this._attachments && this._attachments[name];
+    },
+
+    /**
      * @param {Cache} cache
      * @return {Call}
      */
@@ -619,7 +679,7 @@ Resource.prototype = {
      */
     toReplayable: function(cache)
     {
-        var result = /** @type {ReplayableResource} */ cache.get(this._id);
+        var result = /** @type {ReplayableResource} */ (cache.get(this._id));
         if (result)
             return result;
         var data = {
@@ -650,7 +710,7 @@ Resource.prototype = {
      */
     replay: function(data, cache)
     {
-        var resource = /** @type {ReplayableResource} */ cache.get(data.id);
+        var resource = /** @type {ReplayableResource} */ (cache.get(data.id));
         if (resource)
             return resource;
         this._id = data.id;
@@ -722,7 +782,9 @@ Resource.prototype = {
                 Object.defineProperty(proxy, property, {
                     get: function()
                     {
-                        return wrappedObject[property];
+                        var obj = wrappedObject[property];
+                        var resource = Resource.forObject(obj);
+                        return resource ? resource : obj;
                     },
                     set: self._wrapPropertySetter(self, wrappedObject, property),
                     enumerable: true
@@ -804,12 +866,12 @@ Resource.prototype = {
         {
             var manager = resource.manager();
             if (!manager || !manager.capturing()) {
-                originalObject[propertyName] = value;
+                originalObject[propertyName] = Resource.wrappedObject(value);
                 return;
             }
             var args = [propertyName, value];
             manager.captureArguments(resource, args);
-            originalObject[propertyName] = value;
+            originalObject[propertyName] = Resource.wrappedObject(value);
             var stackTrace = StackTrace.create(1, arguments.callee);
             var call = new Call(resource, "", args, undefined, stackTrace);
             manager.captureCall(call);
@@ -1350,7 +1412,7 @@ function WebGLRenderingContextResource(glContext, replayContextCallback)
 
 /**
  * @const
- * @type {Array.<string>}
+ * @type {!Array.<string>}
  */
 WebGLRenderingContextResource.GLCapabilities = [
     "BLEND",
@@ -1366,7 +1428,7 @@ WebGLRenderingContextResource.GLCapabilities = [
 
 /**
  * @const
- * @type {Array.<string>}
+ * @type {!Array.<string>}
  */
 WebGLRenderingContextResource.PixelStoreParameters = [
     "PACK_ALIGNMENT",
@@ -1378,7 +1440,7 @@ WebGLRenderingContextResource.PixelStoreParameters = [
 
 /**
  * @const
- * @type {Array.<string>}
+ * @type {!Array.<string>}
  */
 WebGLRenderingContextResource.StateParameters = [
     "ACTIVE_TEXTURE",
@@ -1819,12 +1881,11 @@ function CanvasRenderingContext2DResource(context, replayContextCallback)
 {
     Resource.call(this, context);
     this._replayContextCallback = replayContextCallback;
-    this._attributesStack = [];
 }
 
 /**
  * @const
- * @type {Array.<string>}
+ * @type {!Array.<string>}
  */
 CanvasRenderingContext2DResource.AttributeProperties = [
     "strokeStyle",
@@ -1841,12 +1902,16 @@ CanvasRenderingContext2DResource.AttributeProperties = [
     "globalCompositeOperation",
     "font",
     "textAlign",
-    "textBaseline"
+    "textBaseline",
+    "lineDashOffset",
+    // FIXME: Temporary properties implemented in JSC, but not in V8.
+    "webkitLineDash",
+    "webkitLineDashOffset"
 ];
 
 /**
  * @const
- * @type {Array.<string>}
+ * @type {!Array.<string>}
  */
 CanvasRenderingContext2DResource.PathMethods = [
     "beginPath",
@@ -1862,7 +1927,7 @@ CanvasRenderingContext2DResource.PathMethods = [
 
 /**
  * @const
- * @type {Array.<string>}
+ * @type {!Array.<string>}
  */
 CanvasRenderingContext2DResource.TransformationMatrixMethods = [
     "scale",
@@ -1881,8 +1946,13 @@ CanvasRenderingContext2DResource.prototype = {
     _populateReplayableData: function(data, cache)
     {
         data.replayContextCallback = this._replayContextCallback;
-        data.attributesStack = this._attributesStack.slice(0);
         data.currentAttributes = this._currentAttributesState();
+        var ctx = this.wrappedObject();
+        try {
+            data.originalImageData = ctx.getImageData(0, 0, ctx.canvas.width, ctx.canvas.height);
+        } catch (e) {
+            console.error("ASSERT_NOT_REACHED: getImageData failed.", e);
+        }
     },
 
     /**
@@ -1893,21 +1963,24 @@ CanvasRenderingContext2DResource.prototype = {
     _doReplayCalls: function(data, cache)
     {
         this._replayContextCallback = data.replayContextCallback;
-        this._attributesStack = data.attributesStack.slice(0);
 
         var ctx = Resource.wrappedObject(this._replayContextCallback());
         this.setWrappedObject(ctx);
 
-        var saveCalls = 0;
+        if (data.originalImageData) {
+            try {
+                ctx.putImageData(data.originalImageData, 0, 0);
+            } catch (e) {
+                console.error("ASSERT_NOT_REACHED: putImageData failed.", e);
+            }
+        }
+
         for (var i = 0, n = data.calls.length; i < n; ++i) {
             var replayableCall = data.calls[i];
-            if (replayableCall.functionName() === "save") {
-                console.assert(saveCalls < this._attributesStack.length, "Size of attributes stack is less than 'save' calls");
-                this._applyAttributesState(this._attributesStack[saveCalls++]);
-            }
+            if (replayableCall.functionName() === "save")
+                this._applyAttributesState(replayableCall.attachment("canvas2dAttributesState"));
             this._calls.push(replayableCall.replay(cache));
         }
-        console.assert(saveCalls === this._attributesStack.length, "Size of attributes stack should be equal to the number of 'save' calls");
         this._applyAttributesState(data.currentAttributes);
     },
 
@@ -1916,7 +1989,11 @@ CanvasRenderingContext2DResource.prototype = {
      */
     pushCall_setTransform: function(call)
     {
-        // FIXME: Remove obsolete transform matrix methods.
+        var saveCallIndex = this._lastIndexOfMatchingSaveCall();
+        var index = this._lastIndexOfAnyCall(CanvasRenderingContext2DResource.PathMethods);
+        index = Math.max(index, saveCallIndex);
+        if (this._removeCallsFromLog(CanvasRenderingContext2DResource.TransformationMatrixMethods, index + 1))
+            this._removeAllObsoleteCallsFromLog();
         this.pushCall(call);
     },
 
@@ -1925,7 +2002,9 @@ CanvasRenderingContext2DResource.prototype = {
      */
     pushCall_beginPath: function(call)
     {
-        // FIXME: Remove obsolete path methods.
+        var index = this._lastIndexOfAnyCall(["clip"]);
+        if (this._removeCallsFromLog(CanvasRenderingContext2DResource.PathMethods, index + 1))
+            this._removeAllObsoleteCallsFromLog();
         this.pushCall(call);
     },
 
@@ -1934,7 +2013,7 @@ CanvasRenderingContext2DResource.prototype = {
      */
     pushCall_save: function(call)
     {
-        this._attributesStack.push(this._currentAttributesState());
+        call.setAttachment("canvas2dAttributesState", this._currentAttributesState());
         this.pushCall(call);
     },
 
@@ -1943,9 +2022,138 @@ CanvasRenderingContext2DResource.prototype = {
      */
     pushCall_restore: function(call)
     {
-        this._attributesStack.pop();
-        // FIXME: Remove obsolete clip,save methods.
-        this.pushCall(call);
+        var lastIndexOfSave = this._lastIndexOfMatchingSaveCall();
+        if (lastIndexOfSave === -1)
+            return;
+        this._calls[lastIndexOfSave].setAttachment("canvas2dAttributesState", null); // No longer needed, free memory.
+
+        var modified = false;
+        if (this._removeCallsFromLog(["clip"], lastIndexOfSave + 1))
+            modified = true;
+
+        var lastIndexOfAnyPathMethod = this._lastIndexOfAnyCall(CanvasRenderingContext2DResource.PathMethods);
+        var index = Math.max(lastIndexOfSave, lastIndexOfAnyPathMethod);
+        if (this._removeCallsFromLog(CanvasRenderingContext2DResource.TransformationMatrixMethods, index + 1))
+            modified = true;
+
+        if (modified)
+            this._removeAllObsoleteCallsFromLog();
+
+        var lastCall = this._calls[this._calls.length - 1];
+        if (lastCall && lastCall.functionName() === "save")
+            this._calls.pop();
+        else
+            this.pushCall(call);
+    },
+
+    /**
+     * @param {number=} fromIndex
+     * @return {number}
+     */
+    _lastIndexOfMatchingSaveCall: function(fromIndex)
+    {
+        if (typeof fromIndex !== "number")
+            fromIndex = this._calls.length - 1;
+        else
+            fromIndex = Math.min(fromIndex, this._calls.length - 1);
+        var stackDepth = 1;
+        for (var i = fromIndex; i >= 0; --i) {
+            var functionName = this._calls[i].functionName();
+            if (functionName === "restore")
+                ++stackDepth;
+            else if (functionName === "save") {
+                --stackDepth;
+                if (!stackDepth)
+                    return i;
+            }
+        }
+        return -1;
+    },
+
+    /**
+     * @param {!Array.<string>} functionNames
+     * @param {number=} fromIndex
+     * @return {number}
+     */
+    _lastIndexOfAnyCall: function(functionNames, fromIndex)
+    {
+        if (typeof fromIndex !== "number")
+            fromIndex = this._calls.length - 1;
+        else
+            fromIndex = Math.min(fromIndex, this._calls.length - 1);
+        for (var i = fromIndex; i >= 0; --i) {
+            if (functionNames.indexOf(this._calls[i].functionName()) !== -1)
+                return i;
+        }
+        return -1;
+    },
+
+    _removeAllObsoleteCallsFromLog: function()
+    {
+        // Remove all PATH methods between clip() and beginPath() calls.
+        var lastIndexOfBeginPath = this._lastIndexOfAnyCall(["beginPath"]);
+        while (lastIndexOfBeginPath !== -1) {
+            var index = this._lastIndexOfAnyCall(["clip"], lastIndexOfBeginPath - 1);
+            this._removeCallsFromLog(CanvasRenderingContext2DResource.PathMethods, index + 1, lastIndexOfBeginPath);
+            lastIndexOfBeginPath = this._lastIndexOfAnyCall(["beginPath"], index - 1);
+        }
+
+        // Remove all TRASFORMATION MATRIX methods before restore() or setTransform() but after any PATH or corresponding save() method.
+        var lastRestore = this._lastIndexOfAnyCall(["restore", "setTransform"]);
+        while (lastRestore !== -1) {
+            var saveCallIndex = this._lastIndexOfMatchingSaveCall(lastRestore - 1);
+            var index = this._lastIndexOfAnyCall(CanvasRenderingContext2DResource.PathMethods, lastRestore - 1);
+            index = Math.max(index, saveCallIndex);
+            this._removeCallsFromLog(CanvasRenderingContext2DResource.TransformationMatrixMethods, index + 1, lastRestore);
+            lastRestore = this._lastIndexOfAnyCall(["restore", "setTransform"], index - 1);
+        }
+
+        // Remove all save-restore consecutive pairs.
+        var restoreCalls = 0;
+        for (var i = this._calls.length - 1; i >= 0; --i) {
+            var functionName = this._calls[i].functionName();
+            if (functionName === "restore") {
+                ++restoreCalls;
+                continue;
+            }
+            if (functionName === "save" && restoreCalls > 0) {
+                var saveCallIndex = i;
+                for (var j = i - 1; j >= 0 && i - j < restoreCalls; --j) {
+                    if (this._calls[j].functionName() === "save")
+                        saveCallIndex = j;
+                    else
+                        break;
+                }
+                this._calls.splice(saveCallIndex, (i - saveCallIndex + 1) * 2);
+                i = saveCallIndex;
+            }
+            restoreCalls = 0;
+        }
+    },
+
+    /**
+     * @param {!Array.<string>} functionNames
+     * @param {number} fromIndex
+     * @param {number=} toIndex
+     * @return {boolean}
+     */
+    _removeCallsFromLog: function(functionNames, fromIndex, toIndex)
+    {
+        var oldLength = this._calls.length;
+        if (typeof toIndex !== "number")
+            toIndex = oldLength;
+        else
+            toIndex = Math.min(toIndex, oldLength);
+        var newIndex = Math.min(fromIndex, oldLength);
+        for (var i = newIndex; i < toIndex; ++i) {
+            var call = this._calls[i];
+            if (functionNames.indexOf(call.functionName()) === -1)
+                this._calls[newIndex++] = call;
+        }
+        if (newIndex >= toIndex)
+            return false;
+        this._calls.splice(newIndex, toIndex - newIndex);
+        return true;
     },
 
     /**
@@ -1955,21 +2163,30 @@ CanvasRenderingContext2DResource.prototype = {
     {
         var ctx = this.wrappedObject();
         var state = {};
+        state.attributes = {};
         CanvasRenderingContext2DResource.AttributeProperties.forEach(function(attribute) {
-            state[attribute] = ctx[attribute];
+            state.attributes[attribute] = ctx[attribute];
         });
+        if (ctx.getLineDash)
+            state.lineDash = ctx.getLineDash();
         return state;
     },
 
     /**
-     * @param {!Object.<string, string>} state
+     * @param {Object.<string, string>=} state
      */
     _applyAttributesState: function(state)
     {
+        if (!state)
+            return;
         var ctx = this.wrappedObject();
-        Object.keys(state).forEach(function(attribute) {
-            ctx[attribute] = state[attribute];
-        });
+        if (state.attributes) {
+            Object.keys(state.attributes).forEach(function(attribute) {
+                ctx[attribute] = state.attributes[attribute];
+            });
+        }
+        if (ctx.setLineDash)
+            ctx.setLineDash(state.lineDash);
     },
 
     /**
@@ -1982,6 +2199,7 @@ CanvasRenderingContext2DResource.prototype = {
         if (!wrapFunctions) {
             wrapFunctions = Object.create(null);
 
+            // FIXME: Save state of the CanvasGradient objects.
             wrapFunctions["createLinearGradient"] = Resource.WrapFunction.resourceFactoryMethod(Resource);
             wrapFunctions["createRadialGradient"] = Resource.WrapFunction.resourceFactoryMethod(Resource);
             wrapFunctions["createPattern"] = Resource.WrapFunction.resourceFactoryMethod(Resource);
@@ -2006,14 +2224,12 @@ CanvasRenderingContext2DResource.prototype = {
                     }
                 }
             }
-            CanvasRenderingContext2DResource.TransformationMatrixMethods.forEach(function(methodName) {
-                var func = methodName === "setTransform" ? this.pushCall_setTransform : null;
-                stateModifyingWrapFunction(methodName, func);
-            });
-            CanvasRenderingContext2DResource.PathMethods.forEach(function(methodName) {
-                var func = methodName === "beginPath" ? this.pushCall_beginPath : null;
-                stateModifyingWrapFunction(methodName, func);
-            });
+
+            for (var i = 0, methodName; methodName = CanvasRenderingContext2DResource.TransformationMatrixMethods[i]; ++i)
+                stateModifyingWrapFunction(methodName, methodName === "setTransform" ? this.pushCall_setTransform : null);
+            for (var i = 0, methodName; methodName = CanvasRenderingContext2DResource.PathMethods[i]; ++i)
+                stateModifyingWrapFunction(methodName, methodName === "beginPath" ? this.pushCall_beginPath : null);
+
             stateModifyingWrapFunction("save", this.pushCall_save);
             stateModifyingWrapFunction("restore", this.pushCall_restore);
             stateModifyingWrapFunction("clip");
@@ -2378,7 +2594,7 @@ InjectedScript.prototype = {
             for (var i = 0, contextId; contextId = contextIds[i]; ++i) {
                 replayContext = canvas.getContext(contextId, attributes);
                 if (replayContext) {
-                    replayContext = /** @type {WebGLRenderingContext} */ Resource.wrappedObject(replayContext);
+                    replayContext = /** @type {WebGLRenderingContext} */ (Resource.wrappedObject(replayContext));
                     break;
                 }
             }
@@ -2401,20 +2617,10 @@ InjectedScript.prototype = {
      */
     _constructCanvas2DReplayContext: function(originalContext)
     {
-        var replayContext = originalContext["__replayContext"];
-        if (!replayContext) {
-            var canvas = originalContext.canvas.cloneNode(true);
-            replayContext = /** @type {CanvasRenderingContext2D} */ Resource.wrappedObject(canvas.getContext("2d"));
-            Object.defineProperty(originalContext, "__replayContext", {
-                value: replayContext,
-                writable: false,
-                enumerable: false,
-                configurable: true
-            });
-            this._replayContext = replayContext;
-        } else {
-            // FIXME: Clear the canvas.
-        }
+        // Create a new 2D context each time to start with an empty context drawing state stack (managed by save() and restore() methods).
+        var canvas = originalContext.canvas.cloneNode(true);
+        var replayContext = /** @type {CanvasRenderingContext2D} */ (Resource.wrappedObject(canvas.getContext("2d")));
+        this._replayContext = replayContext;
         return replayContext;
     }
 }
diff --git a/Source/WebCore/inspector/InjectedScriptSource.js b/Source/WebCore/inspector/InjectedScriptSource.js
index ecf66af08..83455e3f9 100644
--- a/Source/WebCore/inspector/InjectedScriptSource.js
+++ b/Source/WebCore/inspector/InjectedScriptSource.js
@@ -33,6 +33,9 @@
  */
 (function (InjectedScriptHost, inspectedWindow, injectedScriptId) {
 
+// Protect against Object overwritten by the user code.
+var Object = {}.constructor;
+
 /**
  * @param {Arguments} array
  * @param {number=} index
@@ -48,7 +51,7 @@ function slice(array, index)
 
 /**
  * Please use this bind, not the one from Function.prototype
- * @param {function()} func
+ * @param {function(...)} func
  * @param {Object} thisObject
  * @param {...number} var_args
  */
@@ -364,7 +367,10 @@ InjectedScript.prototype = {
                     if (!descriptor) {
                         // Not all bindings provide proper descriptors. Fall back to the writable, configurable property.
                         try {
-                            descriptors.push({ name: name, value: object[name], writable: false, configurable: false, enumerable: false});
+                            descriptor = { name: name, value: object[name], writable: false, configurable: false, enumerable: false};
+                            if (o === object) 
+                                descriptor.isOwn = true;
+                            descriptors.push(descriptor);
                         } catch (e) {
                             // Silent catch.
                         }
@@ -377,11 +383,13 @@ InjectedScript.prototype = {
                 }
 
                 descriptor.name = name;
-                descriptors.push(descriptor); 
+                if (o === object) 
+                    descriptor.isOwn = true;
+                descriptors.push(descriptor);
             }
             if (ownProperties) {
                 if (object.__proto__)
-                    descriptors.push({ name: "__proto__", value: object.__proto__, writable: true, configurable: true, enumerable: false});
+                    descriptors.push({ name: "__proto__", value: object.__proto__, writable: true, configurable: true, enumerable: false, isOwn: true});
                 break;
             }
         }
@@ -393,11 +401,12 @@ InjectedScript.prototype = {
      * @param {string} objectGroup
      * @param {boolean} injectCommandLineAPI
      * @param {boolean} returnByValue
+     * @param {boolean} generatePreview
      * @return {*}
      */
-    evaluate: function(expression, objectGroup, injectCommandLineAPI, returnByValue)
+    evaluate: function(expression, objectGroup, injectCommandLineAPI, returnByValue, generatePreview)
     {
-        return this._evaluateAndWrap(InjectedScriptHost.evaluate, InjectedScriptHost, expression, objectGroup, false, injectCommandLineAPI, returnByValue);
+        return this._evaluateAndWrap(InjectedScriptHost.evaluate, InjectedScriptHost, expression, objectGroup, false, injectCommandLineAPI, returnByValue, generatePreview);
     },
 
     /**
@@ -455,13 +464,14 @@ InjectedScript.prototype = {
      * @param {boolean} isEvalOnCallFrame
      * @param {boolean} injectCommandLineAPI
      * @param {boolean} returnByValue
+     * @param {boolean} generatePreview
      * @return {*}
      */
-    _evaluateAndWrap: function(evalFunction, object, expression, objectGroup, isEvalOnCallFrame, injectCommandLineAPI, returnByValue)
+    _evaluateAndWrap: function(evalFunction, object, expression, objectGroup, isEvalOnCallFrame, injectCommandLineAPI, returnByValue, generatePreview)
     {
         try {
             return { wasThrown: false,
-                     result: this._wrapObject(this._evaluateOn(evalFunction, object, objectGroup, expression, isEvalOnCallFrame, injectCommandLineAPI), objectGroup, returnByValue, false) };
+                     result: this._wrapObject(this._evaluateOn(evalFunction, object, objectGroup, expression, isEvalOnCallFrame, injectCommandLineAPI), objectGroup, returnByValue, generatePreview) };
         } catch (e) {
             return this._createThrownValue(e, objectGroup);
         }
@@ -537,14 +547,15 @@ InjectedScript.prototype = {
      * @param {string} objectGroup
      * @param {boolean} injectCommandLineAPI
      * @param {boolean} returnByValue
+     * @param {boolean} generatePreview
      * @return {*}
      */
-    evaluateOnCallFrame: function(topCallFrame, callFrameId, expression, objectGroup, injectCommandLineAPI, returnByValue)
+    evaluateOnCallFrame: function(topCallFrame, callFrameId, expression, objectGroup, injectCommandLineAPI, returnByValue, generatePreview)
     {
         var callFrame = this._callFrameForId(topCallFrame, callFrameId);
         if (!callFrame)
             return "Could not find call frame with given id";
-        return this._evaluateAndWrap(callFrame.evaluate, callFrame, expression, objectGroup, true, injectCommandLineAPI, returnByValue);
+        return this._evaluateAndWrap(callFrame.evaluate, callFrame, expression, objectGroup, true, injectCommandLineAPI, returnByValue, generatePreview);
     },
 
     /**
@@ -606,7 +617,7 @@ InjectedScript.prototype = {
         var object = this.findObjectById(objectId);
         if (!object || this._subtype(object) !== "node")
             return null;
-        return /** @type {Node} */ object;
+        return /** @type {Node} */ (object);
     },
 
     /**
@@ -697,7 +708,7 @@ InjectedScript.prototype = {
         if (this.isPrimitiveValue(obj))
             return null;
 
-        obj = /** @type {Object} */ obj;
+        obj = /** @type {Object} */ (obj);
 
         // Type is object, get subtype.
         var subtype = this._subtype(obj);
@@ -784,7 +795,7 @@ InjectedScript.RemoteObject = function(object, objectGroupName, forceValueType,
         return;
     }
 
-    object = /** @type {Object} */ object;
+    object = /** @type {Object} */ (object);
 
     this.objectId = injectedScript._bind(object, objectGroupName);
     var subtype = injectedScript._subtype(object);
diff --git a/Source/WebCore/inspector/Inspector.json b/Source/WebCore/inspector/Inspector.json
index 051aba495..57bd79a72 100644
--- a/Source/WebCore/inspector/Inspector.json
+++ b/Source/WebCore/inspector/Inspector.json
@@ -28,6 +28,13 @@
                     { "name": "object", "$ref": "Runtime.RemoteObject" },
                     { "name": "hints", "type": "object" }
                 ]
+            },
+            {
+                "name": "detached",
+                "description": "Fired when remote debugging connection is about to be terminated. Contains detach reason.",
+                "parameters": [
+                    { "name": "reason", "type": "string", "description": "The reason why connection has been terminated." }
+                ]
             }
         ]
     },
@@ -510,7 +517,9 @@
                     { "name": "set", "$ref": "RemoteObject", "optional": true, "description": "A function which serves as a setter for the property, or <code>undefined</code> if there is no setter (accessor descriptors only)." },
                     { "name": "configurable", "type": "boolean", "description": "True if the type of this property descriptor may be changed and if the property may be deleted from the corresponding object." },
                     { "name": "enumerable", "type": "boolean", "description": "True if this property shows up during enumeration of the properties on the corresponding object." },
-                    { "name": "wasThrown", "type": "boolean", "optional": true, "description": "True if the result was thrown during the evaluation." }
+                    { "name": "wasThrown", "type": "boolean", "optional": true, "description": "True if the result was thrown during the evaluation." },
+                    { "name": "isOwn", "optional": true, "type": "boolean", "description": "True if the property is owned for the object." }
+
                 ]
             },
             {
@@ -560,7 +569,8 @@
                     { "name": "includeCommandLineAPI", "type": "boolean", "optional": true, "description": "Determines whether Command Line API should be available during the evaluation.", "hidden": true },
                     { "name": "doNotPauseOnExceptionsAndMuteConsole", "type": "boolean", "optional": true, "description": "Specifies whether evaluation should stop on exceptions and mute console. Overrides setPauseOnException state.", "hidden": true },
                     { "name": "contextId", "$ref": "Runtime.ExecutionContextId", "optional": true, "description": "Specifies in which isolated context to perform evaluation. Each content script lives in an isolated context and this parameter may be used to specify one of those contexts. If the parameter is omitted or 0 the evaluation will be performed in the context of the inspected page.", "hidden": true },
-                    { "name": "returnByValue", "type": "boolean", "optional": true, "description": "Whether the result is expected to be a JSON object that should be sent by value." }
+                    { "name": "returnByValue", "type": "boolean", "optional": true, "description": "Whether the result is expected to be a JSON object that should be sent by value." },
+                    { "name": "generatePreview", "type": "boolean", "optional": true, "hidden": true, "description": "Whether preview should be generated for the result." }
                 ],
                 "returns": [
                     { "name": "result", "$ref": "RemoteObject", "description": "Evaluation result." },
@@ -575,7 +585,8 @@
                     { "name": "functionDeclaration", "type": "string", "description": "Declaration of the function to call." },
                     { "name": "arguments", "type": "array", "items": { "$ref": "CallArgument", "description": "Call argument." }, "optional": true, "description": "Call arguments. All call arguments must belong to the same JavaScript world as the target object." },
                     { "name": "doNotPauseOnExceptionsAndMuteConsole", "type": "boolean", "optional": true, "description": "Specifies whether function call should stop on exceptions and mute console. Overrides setPauseOnException state.", "hidden": true },
-                    { "name": "returnByValue", "type": "boolean", "optional": true, "description": "Whether the result is expected to be a JSON object which should be sent by value." }
+                    { "name": "returnByValue", "type": "boolean", "optional": true, "description": "Whether the result is expected to be a JSON object which should be sent by value." },
+                    { "name": "generatePreview", "type": "boolean", "optional": true, "hidden": true, "description": "Whether preview should be generated for the result." }
                 ],
                 "returns": [
                     { "name": "result", "$ref": "RemoteObject", "description": "Call result." },
@@ -648,7 +659,7 @@
                     { "name": "source", "type": "string", "enum": ["html", "wml", "xml", "javascript", "network", "console-api", "other"], "description": "Message source." },
                     { "name": "level", "type": "string", "enum": ["tip", "log", "warning", "error", "debug"], "description": "Message severity." },
                     { "name": "text", "type": "string", "description": "Message text." },
-                    { "name": "type", "type": "string", "optional": true, "enum": ["log", "dir", "dirxml", "trace", "startGroup", "startGroupCollapsed", "endGroup", "assert"], "description": "Console message type." },
+                    { "name": "type", "type": "string", "optional": true, "enum": ["log", "dir", "dirxml", "trace", "clear", "startGroup", "startGroupCollapsed", "endGroup", "assert"], "description": "Console message type." },
                     { "name": "url", "type": "string", "optional": true, "description": "URL of the message origin." },
                     { "name": "line", "type": "integer", "optional": true, "description": "Line number in the resource that generated this message." },
                     { "name": "repeatCount", "type": "integer", "optional": true, "description": "Repeat count for repeated messages." },
@@ -2478,6 +2489,14 @@
                 ],
                 "hidden": true,
                 "description": "Tells whether timeline agent supports frame instrumentation."
+            },
+            {
+                "name": "canMonitorMainThread",
+                "returns": [
+                    { "name": "result", "type": "boolean", "description": "True if timeline supports main thread CPU utilization instrumentation." }
+                ],
+                "hidden": true,
+                "description": "Tells whether timeline agent supports main thread CPU utilization instrumentation."
             }
         ],
         "events": [
@@ -2728,7 +2747,8 @@
                     { "name": "objectGroup", "type": "string", "optional": true, "description": "String object group name to put result into (allows rapid releasing resulting object handles using <code>releaseObjectGroup</code>)." },
                     { "name": "includeCommandLineAPI", "type": "boolean", "optional": true, "description": "Specifies whether command line API should be available to the evaluated expression, defaults to false.", "hidden": true },
                     { "name": "doNotPauseOnExceptionsAndMuteConsole", "type": "boolean", "optional": true, "description": "Specifies whether evaluation should stop on exceptions and mute console. Overrides setPauseOnException state.", "hidden": true },
-                    { "name": "returnByValue", "type": "boolean", "optional": true, "description": "Whether the result is expected to be a JSON object that should be sent by value." }
+                    { "name": "returnByValue", "type": "boolean", "optional": true, "description": "Whether the result is expected to be a JSON object that should be sent by value." },
+                    { "name": "generatePreview", "type": "boolean", "optional": true, "hidden": true, "description": "Whether preview should be generated for the result." }
                 ],
                 "returns": [
                     { "name": "result", "$ref": "Runtime.RemoteObject", "description": "Object wrapper for the evaluation result." },
diff --git a/Source/WebCore/inspector/InspectorAgent.cpp b/Source/WebCore/inspector/InspectorAgent.cpp
index 5c28ca778..01baeb800 100644
--- a/Source/WebCore/inspector/InspectorAgent.cpp
+++ b/Source/WebCore/inspector/InspectorAgent.cpp
@@ -68,7 +68,6 @@ InspectorAgent::InspectorAgent(Page* page, InjectedScriptManager* injectedScript
     , m_inspectedPage(page)
     , m_frontend(0)
     , m_injectedScriptManager(injectedScriptManager)
-    , m_didCommitLoadFired(false)
 {
     ASSERT_ARG(page, page);
     m_instrumentingAgents->setInspectorAgent(this);
@@ -102,7 +101,6 @@ void InspectorAgent::clearFrontend()
 {
     m_pendingEvaluateTestCommands.clear();
     m_frontend = 0;
-    m_didCommitLoadFired = false;
     m_injectedScriptManager->discardInjectedScripts();
     ErrorString error;
     disable(&error);
@@ -110,7 +108,6 @@ void InspectorAgent::clearFrontend()
 
 void InspectorAgent::didCommitLoad()
 {
-    m_didCommitLoadFired = true;
     m_injectedScriptManager->discardInjectedScripts();
 }
 
diff --git a/Source/WebCore/inspector/InspectorAgent.h b/Source/WebCore/inspector/InspectorAgent.h
index 3e6fd93f2..62310f246 100644
--- a/Source/WebCore/inspector/InspectorAgent.h
+++ b/Source/WebCore/inspector/InspectorAgent.h
@@ -79,7 +79,6 @@ public:
 
     void didCommitLoad();
     void domContentLoadedEventFired();
-    bool didCommitLoadFired() { return m_didCommitLoadFired; }
 
     bool hasFrontend() const { return m_frontend; }
 
@@ -109,7 +108,6 @@ private:
     pair<RefPtr<TypeBuilder::Runtime::RemoteObject>, RefPtr<InspectorObject> > m_pendingInspectData;
     typedef HashMap<String, String> InjectedScriptForOriginMap;
     InjectedScriptForOriginMap m_injectedScriptForOrigin;
-    bool m_didCommitLoadFired;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/inspector/InspectorClient.h b/Source/WebCore/inspector/InspectorClient.h
index 2a4745a81..a42c2aabc 100644
--- a/Source/WebCore/inspector/InspectorClient.h
+++ b/Source/WebCore/inspector/InspectorClient.h
@@ -57,6 +57,7 @@ public:
     virtual void clearBrowserCache() { }
     virtual bool canClearBrowserCookies() { return false; }
     virtual void clearBrowserCookies() { }
+    virtual bool canMonitorMainThread() { return false; }
     virtual void startMainThreadMonitoring() { }
     virtual void stopMainThreadMonitoring() { }
 
diff --git a/Source/WebCore/inspector/InspectorConsoleAgent.cpp b/Source/WebCore/inspector/InspectorConsoleAgent.cpp
index 9e622c04c..c37da7be6 100644
--- a/Source/WebCore/inspector/InspectorConsoleAgent.cpp
+++ b/Source/WebCore/inspector/InspectorConsoleAgent.cpp
@@ -32,7 +32,6 @@
 #include "Console.h"
 #include "ConsoleMessage.h"
 #include "DOMWindow.h"
-#include "IdentifiersFactory.h"
 #include "InjectedScriptHost.h"
 #include "InjectedScriptManager.h"
 #include "InspectorFrontend.h"
@@ -94,7 +93,7 @@ void InspectorConsoleAgent::enable(ErrorString*)
     m_state->setBoolean(ConsoleAgentState::consoleMessagesEnabled, true);
 
     if (m_expiredConsoleMessageCount) {
-        ConsoleMessage expiredMessage(OtherMessageSource, LogMessageType, WarningMessageLevel, String::format("%d console messages are not shown.", m_expiredConsoleMessageCount), "", 0, "");
+        ConsoleMessage expiredMessage(OtherMessageSource, LogMessageType, WarningMessageLevel, String::format("%d console messages are not shown.", m_expiredConsoleMessageCount), "", 0, 0);
         expiredMessage.addToFrontend(m_frontend, m_injectedScriptManager, false);
     }
 
@@ -152,18 +151,24 @@ void InspectorConsoleAgent::clearFrontend()
     disable(&errorString);
 }
 
-void InspectorConsoleAgent::addMessageToConsole(MessageSource source, MessageType type, MessageLevel level, const String& message, PassRefPtr<ScriptArguments> arguments, PassRefPtr<ScriptCallStack> callStack)
+void InspectorConsoleAgent::addMessageToConsole(MessageSource source, MessageType type, MessageLevel level, const String& message, PassRefPtr<ScriptArguments> arguments, PassRefPtr<ScriptCallStack> callStack, unsigned long requestIdentifier)
 {
     if (!developerExtrasEnabled())
         return;
-    addConsoleMessage(adoptPtr(new ConsoleMessage(source, type, level, message, arguments, callStack)));
+
+    if (type == ClearMessageType) {
+        ErrorString error;
+        clearMessages(&error);
+    }
+
+    addConsoleMessage(adoptPtr(new ConsoleMessage(source, type, level, message, arguments, callStack, requestIdentifier)));
 }
 
-void InspectorConsoleAgent::addMessageToConsole(MessageSource source, MessageType type, MessageLevel level, const String& message, const String& scriptId, unsigned lineNumber)
+void InspectorConsoleAgent::addMessageToConsole(MessageSource source, MessageType type, MessageLevel level, const String& message, const String& scriptId, unsigned lineNumber, unsigned long requestIdentifier)
 {
     if (!developerExtrasEnabled())
         return;
-    addConsoleMessage(adoptPtr(new ConsoleMessage(source, type, level, message, scriptId, lineNumber)));
+    addConsoleMessage(adoptPtr(new ConsoleMessage(source, type, level, message, scriptId, lineNumber, requestIdentifier)));
 }
 
 Vector<unsigned> InspectorConsoleAgent::consoleMessageArgumentCounts()
@@ -236,32 +241,30 @@ void InspectorConsoleAgent::frameWindowDiscarded(DOMWindow* window)
     m_injectedScriptManager->discardInjectedScriptsFor(window);
 }
 
-void InspectorConsoleAgent::didFinishXHRLoading(unsigned long identifier, const String& url, const String& sendURL, unsigned sendLineNumber)
+void InspectorConsoleAgent::didFinishXHRLoading(unsigned long requestIdentifier, const String& url, const String& sendURL, unsigned sendLineNumber)
 {
     if (!developerExtrasEnabled())
         return;
     if (m_frontend && m_state->getBoolean(ConsoleAgentState::monitoringXHR)) {
         String message = "XHR finished loading: \"" + url + "\".";
-        String requestId = IdentifiersFactory::requestId(identifier);
-        addConsoleMessage(adoptPtr(new ConsoleMessage(NetworkMessageSource, LogMessageType, LogMessageLevel, message, sendURL, sendLineNumber, requestId)));
+        addMessageToConsole(NetworkMessageSource, LogMessageType, LogMessageLevel, message, sendURL, sendLineNumber, requestIdentifier);
     }
 
 
 }
 
-void InspectorConsoleAgent::didReceiveResponse(unsigned long identifier, const ResourceResponse& response)
+void InspectorConsoleAgent::didReceiveResponse(unsigned long requestIdentifier, const ResourceResponse& response)
 {
     if (!developerExtrasEnabled())
         return;
 
     if (response.httpStatusCode() >= 400) {
         String message = "Failed to load resource: the server responded with a status of " + String::number(response.httpStatusCode()) + " (" + response.httpStatusText() + ')';
-        String requestId = IdentifiersFactory::requestId(identifier);
-        addConsoleMessage(adoptPtr(new ConsoleMessage(NetworkMessageSource, LogMessageType, ErrorMessageLevel, message, response.url().string(), requestId)));
+        addMessageToConsole(NetworkMessageSource, LogMessageType, ErrorMessageLevel, message, response.url().string(), 0, requestIdentifier);
     }
 }
 
-void InspectorConsoleAgent::didFailLoading(unsigned long identifier, const ResourceError& error)
+void InspectorConsoleAgent::didFailLoading(unsigned long requestIdentifier, const ResourceError& error)
 {
     if (!developerExtrasEnabled())
         return;
@@ -273,8 +276,7 @@ void InspectorConsoleAgent::didFailLoading(unsigned long identifier, const Resou
         message.appendLiteral(": ");
         message.append(error.localizedDescription());
     }
-    String requestId = IdentifiersFactory::requestId(identifier);
-    addConsoleMessage(adoptPtr(new ConsoleMessage(NetworkMessageSource, LogMessageType, ErrorMessageLevel, message.toString(), error.failingURL(), requestId)));
+    addMessageToConsole(NetworkMessageSource, LogMessageType, ErrorMessageLevel, message.toString(), error.failingURL(), 0, requestIdentifier);
 }
 
 void InspectorConsoleAgent::setMonitoringXHREnabled(ErrorString*, bool enabled)
diff --git a/Source/WebCore/inspector/InspectorConsoleAgent.h b/Source/WebCore/inspector/InspectorConsoleAgent.h
index 7f4339313..1fe714e49 100644
--- a/Source/WebCore/inspector/InspectorConsoleAgent.h
+++ b/Source/WebCore/inspector/InspectorConsoleAgent.h
@@ -68,8 +68,8 @@ public:
     virtual void clearFrontend();
     virtual void restore();
 
-    void addMessageToConsole(MessageSource, MessageType, MessageLevel, const String& message, PassRefPtr<ScriptArguments>, PassRefPtr<ScriptCallStack>);
-    void addMessageToConsole(MessageSource, MessageType, MessageLevel, const String& message, const String& scriptId, unsigned lineNumber);
+    void addMessageToConsole(MessageSource, MessageType, MessageLevel, const String& message, PassRefPtr<ScriptArguments>, PassRefPtr<ScriptCallStack>, unsigned long requestIdentifier = 0);
+    void addMessageToConsole(MessageSource, MessageType, MessageLevel, const String& message, const String& scriptId, unsigned lineNumber, unsigned long requestIdentifier = 0);
     Vector<unsigned> consoleMessageArgumentCounts();
 
     void startTiming(const String& title);
@@ -78,9 +78,9 @@ public:
 
     void frameWindowDiscarded(DOMWindow*);
 
-    void didFinishXHRLoading(unsigned long identifier, const String& url, const String& sendURL, unsigned sendLineNumber);
-    void didReceiveResponse(unsigned long identifier, const ResourceResponse&);
-    void didFailLoading(unsigned long identifier, const ResourceError&);
+    void didFinishXHRLoading(unsigned long requestIdentifier, const String& url, const String& sendURL, unsigned sendLineNumber);
+    void didReceiveResponse(unsigned long requestIdentifier, const ResourceResponse&);
+    void didFailLoading(unsigned long requestIdentifier, const ResourceError&);
 #if ENABLE(JAVASCRIPT_DEBUGGER)
     void addProfileFinishedMessageToConsole(PassRefPtr<ScriptProfile>, unsigned lineNumber, const String& sourceURL);
     void addStartProfilingMessageToConsole(const String& title, unsigned lineNumber, const String& sourceURL);
diff --git a/Source/WebCore/inspector/InspectorConsoleInstrumentation.h b/Source/WebCore/inspector/InspectorConsoleInstrumentation.h
index f04326b69..01b60c8d3 100644
--- a/Source/WebCore/inspector/InspectorConsoleInstrumentation.h
+++ b/Source/WebCore/inspector/InspectorConsoleInstrumentation.h
@@ -39,36 +39,36 @@
 
 namespace WebCore {
 
-inline void InspectorInstrumentation::addMessageToConsole(Page* page, MessageSource source, MessageType type, MessageLevel level, const String& message, PassRefPtr<ScriptArguments> arguments, PassRefPtr<ScriptCallStack> callStack)
+inline void InspectorInstrumentation::addMessageToConsole(Page* page, MessageSource source, MessageType type, MessageLevel level, const String& message, PassRefPtr<ScriptArguments> arguments, PassRefPtr<ScriptCallStack> callStack, unsigned long requestIdentifier)
 {
 #if ENABLE(INSPECTOR)
     if (InstrumentingAgents* instrumentingAgents = instrumentingAgentsForPage(page))
-        addMessageToConsoleImpl(instrumentingAgents, source, type, level, message, arguments, callStack);
+        addMessageToConsoleImpl(instrumentingAgents, source, type, level, message, arguments, callStack, requestIdentifier);
 #endif
 }
 
-inline void InspectorInstrumentation::addMessageToConsole(Page* page, MessageSource source, MessageType type, MessageLevel level, const String& message, const String& scriptId, unsigned lineNumber)
+inline void InspectorInstrumentation::addMessageToConsole(Page* page, MessageSource source, MessageType type, MessageLevel level, const String& message, const String& scriptId, unsigned lineNumber, unsigned long requestIdentifier)
 {
 #if ENABLE(INSPECTOR)
     if (InstrumentingAgents* instrumentingAgents = instrumentingAgentsForPage(page))
-        addMessageToConsoleImpl(instrumentingAgents, source, type, level, message, scriptId, lineNumber);
+        addMessageToConsoleImpl(instrumentingAgents, source, type, level, message, scriptId, lineNumber, requestIdentifier);
 #endif
 }
 
 #if ENABLE(WORKERS)
-inline void InspectorInstrumentation::addMessageToConsole(WorkerContext* workerContext, MessageSource source, MessageType type, MessageLevel level, const String& message, PassRefPtr<ScriptArguments> arguments, PassRefPtr<ScriptCallStack> callStack)
+inline void InspectorInstrumentation::addMessageToConsole(WorkerContext* workerContext, MessageSource source, MessageType type, MessageLevel level, const String& message, PassRefPtr<ScriptArguments> arguments, PassRefPtr<ScriptCallStack> callStack, unsigned long requestIdentifier)
 {
 #if ENABLE(INSPECTOR)
     if (InstrumentingAgents* instrumentingAgents = instrumentingAgentsForWorkerContext(workerContext))
-        addMessageToConsoleImpl(instrumentingAgents, source, type, level, message, arguments, callStack);
+        addMessageToConsoleImpl(instrumentingAgents, source, type, level, message, arguments, callStack, requestIdentifier);
 #endif
 }
 
-inline void InspectorInstrumentation::addMessageToConsole(WorkerContext* workerContext, MessageSource source, MessageType type, MessageLevel level, const String& message, const String& scriptId, unsigned lineNumber)
+inline void InspectorInstrumentation::addMessageToConsole(WorkerContext* workerContext, MessageSource source, MessageType type, MessageLevel level, const String& message, const String& scriptId, unsigned lineNumber, unsigned long requestIdentifier)
 {
 #if ENABLE(INSPECTOR)
     if (InstrumentingAgents* instrumentingAgents = instrumentingAgentsForWorkerContext(workerContext))
-        addMessageToConsoleImpl(instrumentingAgents, source, type, level, message, scriptId, lineNumber);
+        addMessageToConsoleImpl(instrumentingAgents, source, type, level, message, scriptId, lineNumber, requestIdentifier);
 #endif
 }
 #endif
diff --git a/Source/WebCore/inspector/InspectorController.cpp b/Source/WebCore/inspector/InspectorController.cpp
index 8bad7cc0c..2ff0d39c5 100644
--- a/Source/WebCore/inspector/InspectorController.cpp
+++ b/Source/WebCore/inspector/InspectorController.cpp
@@ -125,7 +125,7 @@ InspectorController::InspectorController(Page* page, InspectorClient* inspectorC
     m_resourceAgent = resourceAgentPtr.get();
     m_agents.append(resourceAgentPtr.release());
 
-    OwnPtr<InspectorRuntimeAgent> runtimeAgentPtr(PageRuntimeAgent::create(m_instrumentingAgents.get(), m_state.get(), m_injectedScriptManager.get(), page, pageAgent, m_inspectorAgent));
+    OwnPtr<InspectorRuntimeAgent> runtimeAgentPtr(PageRuntimeAgent::create(m_instrumentingAgents.get(), m_state.get(), m_injectedScriptManager.get(), page, pageAgent));
     InspectorRuntimeAgent* runtimeAgent = runtimeAgentPtr.get();
     m_agents.append(runtimeAgentPtr.release());
 
@@ -404,7 +404,7 @@ void InspectorController::reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo)
     info.addMember(m_inspectorFrontendClient);
     info.addMember(m_inspectorFrontend);
     info.addMember(m_page);
-    info.addMember(m_inspectorClient);
+    info.addWeakPointer(m_inspectorClient);
     info.addMember(m_agents);
 }
 
diff --git a/Source/WebCore/inspector/InspectorDOMStorageAgent.cpp b/Source/WebCore/inspector/InspectorDOMStorageAgent.cpp
index 5d305890c..410adeccb 100644
--- a/Source/WebCore/inspector/InspectorDOMStorageAgent.cpp
+++ b/Source/WebCore/inspector/InspectorDOMStorageAgent.cpp
@@ -228,7 +228,7 @@ void InspectorDOMStorageAgent::reportMemoryUsage(MemoryObjectInfo* memoryObjectI
     MemoryClassInfo info(memoryObjectInfo, this, WebCoreMemoryTypes::InspectorDOMStorageAgent);
     InspectorBaseAgent<InspectorDOMStorageAgent>::reportMemoryUsage(memoryObjectInfo);
     info.addMember(m_resources);
-    info.addMember(m_frontend);
+    info.addWeakPointer(m_frontend);
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/inspector/InspectorDOMStorageResource.cpp b/Source/WebCore/inspector/InspectorDOMStorageResource.cpp
index 029e39228..5e7c9577d 100644
--- a/Source/WebCore/inspector/InspectorDOMStorageResource.cpp
+++ b/Source/WebCore/inspector/InspectorDOMStorageResource.cpp
@@ -90,7 +90,7 @@ void InspectorDOMStorageResource::reportMemoryUsage(MemoryObjectInfo* memoryObje
     MemoryClassInfo info(memoryObjectInfo, this, WebCoreMemoryTypes::InspectorDOMStorageResources);
     info.addMember(m_storageArea);
     info.addMember(m_frame);
-    info.addMember(m_frontend);
+    info.addWeakPointer(m_frontend);
     info.addMember(m_id);
     info.addPrivateBuffer(m_storageArea->memoryBytesUsedByCache());
 }
diff --git a/Source/WebCore/inspector/InspectorDebuggerAgent.cpp b/Source/WebCore/inspector/InspectorDebuggerAgent.cpp
index a77c06fb5..e65315000 100644
--- a/Source/WebCore/inspector/InspectorDebuggerAgent.cpp
+++ b/Source/WebCore/inspector/InspectorDebuggerAgent.cpp
@@ -43,6 +43,8 @@
 #include "RegularExpression.h"
 #include "ScriptDebugServer.h"
 #include "ScriptObject.h"
+#include <wtf/MemoryInstrumentationHashMap.h>
+#include <wtf/MemoryInstrumentationVector.h>
 #include <wtf/text/WTFString.h>
 
 using WebCore::TypeBuilder::Array;
@@ -498,7 +500,7 @@ void InspectorDebuggerAgent::setPauseOnExceptionsImpl(ErrorString* errorString,
         m_state->setLong(DebuggerAgentState::pauseOnExceptionsState, pauseState);
 }
 
-void InspectorDebuggerAgent::evaluateOnCallFrame(ErrorString* errorString, const String& callFrameId, const String& expression, const String* const objectGroup, const bool* const includeCommandLineAPI, const bool* const doNotPauseOnExceptionsAndMuteConsole, const bool* const returnByValue, RefPtr<TypeBuilder::Runtime::RemoteObject>& result, TypeBuilder::OptOutput<bool>* wasThrown)
+void InspectorDebuggerAgent::evaluateOnCallFrame(ErrorString* errorString, const String& callFrameId, const String& expression, const String* const objectGroup, const bool* const includeCommandLineAPI, const bool* const doNotPauseOnExceptionsAndMuteConsole, const bool* const returnByValue, const bool* generatePreview, RefPtr<TypeBuilder::Runtime::RemoteObject>& result, TypeBuilder::OptOutput<bool>* wasThrown)
 {
     InjectedScript injectedScript = m_injectedScriptManager->injectedScriptForObjectId(callFrameId);
     if (injectedScript.hasNoValue()) {
@@ -513,7 +515,7 @@ void InspectorDebuggerAgent::evaluateOnCallFrame(ErrorString* errorString, const
         muteConsole();
     }
 
-    injectedScript.evaluateOnCallFrame(errorString, m_currentCallStack, callFrameId, expression, objectGroup ? *objectGroup : "", includeCommandLineAPI ? *includeCommandLineAPI : false, returnByValue ? *returnByValue : false, &result, wasThrown);
+    injectedScript.evaluateOnCallFrame(errorString, m_currentCallStack, callFrameId, expression, objectGroup ? *objectGroup : "", includeCommandLineAPI ? *includeCommandLineAPI : false, returnByValue ? *returnByValue : false, generatePreview ? *generatePreview : false, &result, wasThrown);
 
     if (doNotPauseOnExceptionsAndMuteConsole ? *doNotPauseOnExceptionsAndMuteConsole : false) {
         unmuteConsole();
@@ -734,6 +736,29 @@ void InspectorDebuggerAgent::clearBreakDetails()
     m_breakAuxData = 0;
 }
 
+void InspectorDebuggerAgent::reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
+{
+    MemoryClassInfo info(memoryObjectInfo, this, WebCoreMemoryTypes::InspectorDebuggerAgent);
+    InspectorBaseAgent<InspectorDebuggerAgent>::reportMemoryUsage(memoryObjectInfo);
+    info.addMember(m_injectedScriptManager);
+    info.addWeakPointer(m_frontend);
+    info.addMember(m_pausedScriptState);
+    info.addMember(m_currentCallStack);
+    info.addMember(m_scripts);
+    info.addMember(m_breakpointIdToDebugServerBreakpointIds);
+    info.addMember(m_continueToLocationBreakpointId);
+    info.addMember(m_breakAuxData);
+    info.addWeakPointer(m_listener);
+}
+
+void ScriptDebugListener::Script::reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
+{
+    MemoryClassInfo info(memoryObjectInfo, this, WebCoreMemoryTypes::InspectorDebuggerAgent);
+    info.addMember(url);
+    info.addMember(source);
+    info.addMember(sourceMappingURL);
+}
+
 } // namespace WebCore
 
 #endif // ENABLE(JAVASCRIPT_DEBUGGER) && ENABLE(INSPECTOR)
diff --git a/Source/WebCore/inspector/InspectorDebuggerAgent.h b/Source/WebCore/inspector/InspectorDebuggerAgent.h
index d1118dc49..81bceedec 100644
--- a/Source/WebCore/inspector/InspectorDebuggerAgent.h
+++ b/Source/WebCore/inspector/InspectorDebuggerAgent.h
@@ -107,6 +107,7 @@ public:
                              const bool* includeCommandLineAPI,
                              const bool* doNotPauseOnExceptionsAndMuteConsole,
                              const bool* returnByValue,
+                             const bool* generatePreview,
                              RefPtr<TypeBuilder::Runtime::RemoteObject>& result,
                              TypeBuilder::OptOutput<bool>* wasThrown);
     void compileScript(ErrorString*, const String& expression, const String& sourceURL, TypeBuilder::OptOutput<TypeBuilder::Debugger::ScriptId>*, TypeBuilder::OptOutput<String>* syntaxErrorMessage);
@@ -128,6 +129,8 @@ public:
 
     virtual ScriptDebugServer& scriptDebugServer() = 0;
 
+    virtual void reportMemoryUsage(MemoryObjectInfo*) const;
+
 protected:
     InspectorDebuggerAgent(InstrumentingAgents*, InspectorState*, InjectedScriptManager*);
 
diff --git a/Source/WebCore/inspector/InspectorInstrumentation.cpp b/Source/WebCore/inspector/InspectorInstrumentation.cpp
index 08f2b0d9e..ad3536a70 100644
--- a/Source/WebCore/inspector/InspectorInstrumentation.cpp
+++ b/Source/WebCore/inspector/InspectorInstrumentation.cpp
@@ -57,7 +57,6 @@
 #include "InspectorPageAgent.h"
 #include "InspectorProfilerAgent.h"
 #include "InspectorResourceAgent.h"
-#include "InspectorRuntimeAgent.h"
 #include "InspectorTimelineAgent.h"
 #include "InspectorWorkerAgent.h"
 #include "InstrumentingAgents.h"
@@ -67,6 +66,7 @@
 #include "ScriptProfile.h"
 #include "StyleRule.h"
 #include "WorkerContext.h"
+#include "WorkerRuntimeAgent.h"
 #include "WorkerThread.h"
 #include "XMLHttpRequest.h"
 #include <wtf/StdLibExtras.h>
@@ -127,7 +127,7 @@ void InspectorInstrumentation::didClearWindowObjectInWorldImpl(InstrumentingAgen
 #endif
     if (PageRuntimeAgent* pageRuntimeAgent = instrumentingAgents->pageRuntimeAgent()) {
         if (world == mainThreadNormalWorld())
-            pageRuntimeAgent->didClearWindowObject(frame);
+            pageRuntimeAgent->didCreateMainWorldContext(frame);
     }
 }
 
@@ -494,25 +494,22 @@ void InspectorInstrumentation::didDispatchXHRLoadEventImpl(const InspectorInstru
         timelineAgent->didDispatchXHRLoadEvent();
 }
 
-InspectorInstrumentationCookie InspectorInstrumentation::willPaintImpl(InstrumentingAgents* instrumentingAgents, GraphicsContext* context, const LayoutRect& rect, Frame* frame)
+InspectorInstrumentationCookie InspectorInstrumentation::willPaintImpl(InstrumentingAgents* instrumentingAgents, Frame* frame)
 {
-    if (InspectorPageAgent* pageAgent = instrumentingAgents->inspectorPageAgent())
-        pageAgent->willPaint(context, rect);
-
     int timelineAgentId = 0;
     if (InspectorTimelineAgent* timelineAgent = instrumentingAgents->inspectorTimelineAgent()) {
-        timelineAgent->willPaint(rect, frame);
+        timelineAgent->willPaint(frame);
         timelineAgentId = timelineAgent->id();
     }
     return InspectorInstrumentationCookie(instrumentingAgents, timelineAgentId);
 }
 
-void InspectorInstrumentation::didPaintImpl(const InspectorInstrumentationCookie& cookie)
+void InspectorInstrumentation::didPaintImpl(const InspectorInstrumentationCookie& cookie, GraphicsContext* context, const LayoutRect& rect)
 {
     if (InspectorTimelineAgent* timelineAgent = retrieveTimelineAgent(cookie))
-        timelineAgent->didPaint();
+        timelineAgent->didPaint(rect);
     if (InspectorPageAgent* pageAgent = cookie.first ? cookie.first->inspectorPageAgent() : 0)
-        pageAgent->didPaint();
+        pageAgent->didPaint(context, rect);
 }
 
 void InspectorInstrumentation::willScrollLayerImpl(InstrumentingAgents* instrumentingAgents, Frame* frame)
@@ -954,20 +951,20 @@ void InspectorInstrumentation::didWriteHTMLImpl(const InspectorInstrumentationCo
         timelineAgent->didWriteHTML(endLine);
 }
 
-void InspectorInstrumentation::addMessageToConsoleImpl(InstrumentingAgents* instrumentingAgents, MessageSource source, MessageType type, MessageLevel level, const String& message, PassRefPtr<ScriptArguments> arguments, PassRefPtr<ScriptCallStack> callStack)
+void InspectorInstrumentation::addMessageToConsoleImpl(InstrumentingAgents* instrumentingAgents, MessageSource source, MessageType type, MessageLevel level, const String& message, PassRefPtr<ScriptArguments> arguments, PassRefPtr<ScriptCallStack> callStack, unsigned long requestIdentifier)
 {
     if (InspectorConsoleAgent* consoleAgent = instrumentingAgents->inspectorConsoleAgent())
-        consoleAgent->addMessageToConsole(source, type, level, message, arguments, callStack);
+        consoleAgent->addMessageToConsole(source, type, level, message, arguments, callStack, requestIdentifier);
 #if ENABLE(JAVASCRIPT_DEBUGGER)
     if (InspectorDebuggerAgent* debuggerAgent = instrumentingAgents->inspectorDebuggerAgent())
         debuggerAgent->addMessageToConsole(source, type);
 #endif
 }
 
-void InspectorInstrumentation::addMessageToConsoleImpl(InstrumentingAgents* instrumentingAgents, MessageSource source, MessageType type, MessageLevel level, const String& message, const String& scriptId, unsigned lineNumber)
+void InspectorInstrumentation::addMessageToConsoleImpl(InstrumentingAgents* instrumentingAgents, MessageSource source, MessageType type, MessageLevel level, const String& message, const String& scriptId, unsigned lineNumber, unsigned long requestIdentifier)
 {
     if (InspectorConsoleAgent* consoleAgent = instrumentingAgents->inspectorConsoleAgent())
-        consoleAgent->addMessageToConsole(source, type, level, message, scriptId, lineNumber);
+        consoleAgent->addMessageToConsole(source, type, level, message, scriptId, lineNumber, requestIdentifier);
 }
 
 void InspectorInstrumentation::consoleCountImpl(InstrumentingAgents* instrumentingAgents, PassRefPtr<ScriptArguments> arguments, PassRefPtr<ScriptCallStack> stack)
@@ -1079,7 +1076,7 @@ void InspectorInstrumentation::willEvaluateWorkerScript(WorkerContext* workerCon
     if (!instrumentingAgents)
         return;
 #if ENABLE(JAVASCRIPT_DEBUGGER)
-    if (InspectorRuntimeAgent* runtimeAgent = instrumentingAgents->inspectorRuntimeAgent())
+    if (WorkerRuntimeAgent* runtimeAgent = instrumentingAgents->workerRuntimeAgent())
         runtimeAgent->pauseWorkerContext(workerContext);
 #endif
 }
@@ -1167,13 +1164,6 @@ bool InspectorInstrumentation::consoleAgentEnabled(ScriptExecutionContext* scrip
     return consoleAgent && consoleAgent->enabled();
 }
 
-bool InspectorInstrumentation::runtimeAgentEnabled(Frame* frame)
-{
-    InstrumentingAgents* instrumentingAgents = instrumentingAgentsForFrame(frame);
-    InspectorRuntimeAgent* runtimeAgent = instrumentingAgents ? instrumentingAgents->inspectorRuntimeAgent() : 0;
-    return runtimeAgent && runtimeAgent->enabled();
-}
-
 bool InspectorInstrumentation::timelineAgentEnabled(ScriptExecutionContext* scriptExecutionContext)
 {
     InstrumentingAgents* instrumentingAgents = instrumentingAgentsForContext(scriptExecutionContext);
diff --git a/Source/WebCore/inspector/InspectorInstrumentation.h b/Source/WebCore/inspector/InspectorInstrumentation.h
index 469e68690..cca054a05 100644
--- a/Source/WebCore/inspector/InspectorInstrumentation.h
+++ b/Source/WebCore/inspector/InspectorInstrumentation.h
@@ -141,10 +141,10 @@ public:
     static void didScroll(Page*);
     static InspectorInstrumentationCookie willDispatchXHRLoadEvent(ScriptExecutionContext*, XMLHttpRequest*);
     static void didDispatchXHRLoadEvent(const InspectorInstrumentationCookie&);
-    static InspectorInstrumentationCookie willPaint(Frame*, GraphicsContext*, const LayoutRect&);
-    static void didPaint(const InspectorInstrumentationCookie&);
     static void willScrollLayer(Frame*);
     static void didScrollLayer(Frame*);
+    static InspectorInstrumentationCookie willPaint(Frame*);
+    static void didPaint(const InspectorInstrumentationCookie&, GraphicsContext*, const LayoutRect&);
     static void willComposite(Page*);
     static void didComposite(Page*);
     static InspectorInstrumentationCookie willRecalculateStyle(Document*);
@@ -196,11 +196,11 @@ public:
     static InspectorInstrumentationCookie willWriteHTML(Document*, unsigned int length, unsigned int startLine);
     static void didWriteHTML(const InspectorInstrumentationCookie&, unsigned int endLine);
 
-    static void addMessageToConsole(Page*, MessageSource, MessageType, MessageLevel, const String& message, PassRefPtr<ScriptArguments>, PassRefPtr<ScriptCallStack>);
-    static void addMessageToConsole(Page*, MessageSource, MessageType, MessageLevel, const String& message, const String&, unsigned lineNumber);
+    static void addMessageToConsole(Page*, MessageSource, MessageType, MessageLevel, const String& message, PassRefPtr<ScriptArguments>, PassRefPtr<ScriptCallStack>, unsigned long requestIdentifier = 0);
+    static void addMessageToConsole(Page*, MessageSource, MessageType, MessageLevel, const String& message, const String&, unsigned lineNumber, unsigned long requestIdentifier = 0);
 #if ENABLE(WORKERS)
-    static void addMessageToConsole(WorkerContext*, MessageSource, MessageType, MessageLevel, const String& message, PassRefPtr<ScriptArguments>, PassRefPtr<ScriptCallStack>);
-    static void addMessageToConsole(WorkerContext*, MessageSource, MessageType, MessageLevel, const String& message, const String&, unsigned lineNumber);
+    static void addMessageToConsole(WorkerContext*, MessageSource, MessageType, MessageLevel, const String& message, PassRefPtr<ScriptArguments>, PassRefPtr<ScriptCallStack>, unsigned long requestIdentifier = 0);
+    static void addMessageToConsole(WorkerContext*, MessageSource, MessageType, MessageLevel, const String& message, const String&, unsigned lineNumber, unsigned long requestIdentifier = 0);
 #endif
     static void consoleCount(Page*, PassRefPtr<ScriptArguments>, PassRefPtr<ScriptCallStack>);
     static void startConsoleTiming(Frame*, const String& title);
@@ -257,7 +257,6 @@ public:
     static bool hasFrontends() { return s_frontendCounter; }
     static bool canvasAgentEnabled(ScriptExecutionContext*);
     static bool consoleAgentEnabled(ScriptExecutionContext*);
-    static bool runtimeAgentEnabled(Frame*);
     static bool timelineAgentEnabled(ScriptExecutionContext*);
     static bool collectingHTMLParseErrors(Page*);
 #else
@@ -333,10 +332,10 @@ private:
     static void didScrollImpl(InstrumentingAgents*);
     static InspectorInstrumentationCookie willDispatchXHRLoadEventImpl(InstrumentingAgents*, XMLHttpRequest*, ScriptExecutionContext*);
     static void didDispatchXHRLoadEventImpl(const InspectorInstrumentationCookie&);
-    static InspectorInstrumentationCookie willPaintImpl(InstrumentingAgents*, GraphicsContext*, const LayoutRect&, Frame*);
-    static void didPaintImpl(const InspectorInstrumentationCookie&);
     static void willScrollLayerImpl(InstrumentingAgents*, Frame*);
     static void didScrollLayerImpl(InstrumentingAgents*);
+    static InspectorInstrumentationCookie willPaintImpl(InstrumentingAgents*, Frame*);
+    static void didPaintImpl(const InspectorInstrumentationCookie&, GraphicsContext*, const LayoutRect&);
     static void willCompositeImpl(InstrumentingAgents*);
     static void didCompositeImpl(InstrumentingAgents*);
     static InspectorInstrumentationCookie willRecalculateStyleImpl(InstrumentingAgents*, Frame*);
@@ -389,8 +388,8 @@ private:
     static InspectorInstrumentationCookie willWriteHTMLImpl(InstrumentingAgents*, unsigned int length, unsigned int startLine, Frame*);
     static void didWriteHTMLImpl(const InspectorInstrumentationCookie&, unsigned int endLine);
 
-    static void addMessageToConsoleImpl(InstrumentingAgents*, MessageSource, MessageType, MessageLevel, const String& message, PassRefPtr<ScriptArguments>, PassRefPtr<ScriptCallStack>);
-    static void addMessageToConsoleImpl(InstrumentingAgents*, MessageSource, MessageType, MessageLevel, const String& message, const String& scriptId, unsigned lineNumber);
+    static void addMessageToConsoleImpl(InstrumentingAgents*, MessageSource, MessageType, MessageLevel, const String& message, PassRefPtr<ScriptArguments>, PassRefPtr<ScriptCallStack>, unsigned long requestIdentifier);
+    static void addMessageToConsoleImpl(InstrumentingAgents*, MessageSource, MessageType, MessageLevel, const String& message, const String& scriptId, unsigned lineNumber, unsigned long requestIdentifier);
     static void consoleCountImpl(InstrumentingAgents*, PassRefPtr<ScriptArguments>, PassRefPtr<ScriptCallStack>);
     static void startConsoleTimingImpl(InstrumentingAgents*, Frame*, const String& title);
     static void stopConsoleTimingImpl(InstrumentingAgents*, Frame*, const String& title, PassRefPtr<ScriptCallStack>);
@@ -903,22 +902,22 @@ inline void InspectorInstrumentation::didDispatchXHRLoadEvent(const InspectorIns
 #endif
 }
 
-inline InspectorInstrumentationCookie InspectorInstrumentation::willPaint(Frame* frame, GraphicsContext* context, const LayoutRect& rect)
+inline InspectorInstrumentationCookie InspectorInstrumentation::willPaint(Frame* frame)
 {
 #if ENABLE(INSPECTOR)
     FAST_RETURN_IF_NO_FRONTENDS(InspectorInstrumentationCookie());
     if (InstrumentingAgents* instrumentingAgents = instrumentingAgentsForFrame(frame))
-        return willPaintImpl(instrumentingAgents, context, rect, frame);
+        return willPaintImpl(instrumentingAgents, frame);
 #endif
     return InspectorInstrumentationCookie();
 }
 
-inline void InspectorInstrumentation::didPaint(const InspectorInstrumentationCookie& cookie)
+inline void InspectorInstrumentation::didPaint(const InspectorInstrumentationCookie& cookie, GraphicsContext* context, const LayoutRect& rect)
 {
 #if ENABLE(INSPECTOR)
     FAST_RETURN_IF_NO_FRONTENDS(void());
     if (cookie.first)
-        didPaintImpl(cookie);
+        didPaintImpl(cookie, context, rect);
 #endif
 }
 
diff --git a/Source/WebCore/inspector/InspectorMemoryAgent.cpp b/Source/WebCore/inspector/InspectorMemoryAgent.cpp
index fdc72afeb..75c2913d5 100644
--- a/Source/WebCore/inspector/InspectorMemoryAgent.cpp
+++ b/Source/WebCore/inspector/InspectorMemoryAgent.cpp
@@ -276,7 +276,7 @@ private:
     CharacterDataStatistics& m_characterDataStatistics;
 };
 
-class CounterVisitor : public NodeWrapperVisitor, public ExternalStringVisitor {
+class CounterVisitor : public WrappedNodeVisitor, public ExternalStringVisitor {
 public:
     CounterVisitor(Page* page)
         : m_page(page)
@@ -450,7 +450,7 @@ static void reportRenderTreeInfo(WTF::MemoryInstrumentationClient& memoryInstrum
 
 namespace {
 
-class DOMTreesIterator : public NodeWrapperVisitor {
+class DOMTreesIterator : public WrappedNodeVisitor {
 public:
     DOMTreesIterator(MemoryInstrumentationImpl& memoryInstrumentation, Page* page)
         : m_page(page)
@@ -559,7 +559,7 @@ void InspectorMemoryAgent::reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo)
 {
     MemoryClassInfo info(memoryObjectInfo, this, WebCoreMemoryTypes::Inspector);
     InspectorBaseAgent<InspectorMemoryAgent>::reportMemoryUsage(memoryObjectInfo);
-    info.addMember(m_inspectorClient);
+    info.addWeakPointer(m_inspectorClient);
     info.addMember(m_page);
 }
 
diff --git a/Source/WebCore/inspector/InspectorOverlay.cpp b/Source/WebCore/inspector/InspectorOverlay.cpp
index b141a1604..3ceab7fd9 100644
--- a/Source/WebCore/inspector/InspectorOverlay.cpp
+++ b/Source/WebCore/inspector/InspectorOverlay.cpp
@@ -504,7 +504,7 @@ void InspectorOverlay::reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo) con
 {
     MemoryClassInfo info(memoryObjectInfo, this, WebCoreMemoryTypes::InspectorOverlay);
     info.addMember(m_page);
-    info.addMember(m_client);
+    info.addWeakPointer(m_client);
     info.addMember(m_pausedInDebuggerMessage);
     info.addMember(m_highlightNode);
     info.addMember(m_nodeHighlightConfig);
diff --git a/Source/WebCore/inspector/InspectorPageAgent.cpp b/Source/WebCore/inspector/InspectorPageAgent.cpp
index 788685b1e..1ddaa7f56 100644
--- a/Source/WebCore/inspector/InspectorPageAgent.cpp
+++ b/Source/WebCore/inspector/InspectorPageAgent.cpp
@@ -139,7 +139,7 @@ static bool prepareCachedResourceBuffer(CachedResource* cachedResource, bool* ha
 static bool hasTextContent(CachedResource* cachedResource)
 {
     InspectorPageAgent::ResourceType type = InspectorPageAgent::cachedResourceType(*cachedResource);
-    return type == InspectorPageAgent::StylesheetResource || type == InspectorPageAgent::ScriptResource || type == InspectorPageAgent::XHRResource;
+    return type == InspectorPageAgent::DocumentResource || type == InspectorPageAgent::StylesheetResource || type == InspectorPageAgent::ScriptResource || type == InspectorPageAgent::XHRResource;
 }
 
 static PassRefPtr<TextResourceDecoder> createXHRTextDecoder(const String& mimeType, const String& textEncodingName)
@@ -308,6 +308,8 @@ InspectorPageAgent::ResourceType InspectorPageAgent::cachedResourceType(const Ca
         return InspectorPageAgent::ScriptResource;
     case CachedResource::RawResource:
         return InspectorPageAgent::XHRResource;
+    case CachedResource::MainResource:
+        return InspectorPageAgent::DocumentResource;
     default:
         break;
     }
@@ -328,7 +330,6 @@ InspectorPageAgent::InspectorPageAgent(InstrumentingAgents* instrumentingAgents,
     , m_frontend(0)
     , m_overlay(overlay)
     , m_lastScriptIdentifier(0)
-    , m_lastPaintContext(0)
     , m_didLoadEventFire(false)
     , m_geolocationOverridden(false)
 {
@@ -354,9 +355,6 @@ void InspectorPageAgent::restore()
     if (m_state->getBoolean(PageAgentState::pageAgentEnabled)) {
         ErrorString error;
         enable(&error);
-
-        if (m_inspectorAgent->didCommitLoadFired())
-            frameNavigated(m_page->mainFrame()->loader()->documentLoader());
 #if ENABLE(TOUCH_EVENTS)
         updateTouchEventEmulationInPage(m_state->getBoolean(PageAgentState::touchEventEmulationEnabled));
 #endif
@@ -876,18 +874,9 @@ void InspectorPageAgent::applyScreenHeightOverride(long* height)
         *height = heightOverride;
 }
 
-void InspectorPageAgent::willPaint(GraphicsContext* context, const LayoutRect& rect)
-{
-    if (m_state->getBoolean(PageAgentState::showPaintRects)) {
-        m_lastPaintContext = context;
-        m_lastPaintRect = rect;
-        m_lastPaintRect.inflate(-1);
-    }
-}
-
-void InspectorPageAgent::didPaint()
+void InspectorPageAgent::didPaint(GraphicsContext* context, const LayoutRect& rect)
 {
-    if (!m_lastPaintContext || !m_state->getBoolean(PageAgentState::showPaintRects))
+    if (!m_state->getBoolean(PageAgentState::showPaintRects))
         return;
 
     static int colorSelector = 0;
@@ -897,9 +886,9 @@ void InspectorPageAgent::didPaint()
         Color(0, 0, 0xFF, 0x3F),
     };
 
-    m_overlay->drawOutline(m_lastPaintContext, m_lastPaintRect, colors[colorSelector++ % WTF_ARRAY_LENGTH(colors)]);
-
-    m_lastPaintContext = 0;
+    LayoutRect inflatedRect(rect);
+    inflatedRect.inflate(-1);
+    m_overlay->drawOutline(context, inflatedRect, colors[colorSelector++ % WTF_ARRAY_LENGTH(colors)]);
 }
 
 void InspectorPageAgent::didLayout()
@@ -958,10 +947,10 @@ PassRefPtr<TypeBuilder::Page::FrameResourceTree> InspectorPageAgent::buildObject
             .setUrl(cachedResource->url())
             .setType(cachedResourceTypeJson(*cachedResource))
             .setMimeType(cachedResource->response().mimeType());
-        if (cachedResource->status() == CachedResource::LoadError)
-            resourceObject->setFailed(true);
-        if (cachedResource->status() == CachedResource::Canceled)
+        if (cachedResource->wasCanceled())
             resourceObject->setCanceled(true);
+        else if (cachedResource->status() == CachedResource::LoadError)
+            resourceObject->setFailed(true);
         subresources->addItem(resourceObject);
     }
 
diff --git a/Source/WebCore/inspector/InspectorPageAgent.h b/Source/WebCore/inspector/InspectorPageAgent.h
index e54bb7257..2768bb17f 100644
--- a/Source/WebCore/inspector/InspectorPageAgent.h
+++ b/Source/WebCore/inspector/InspectorPageAgent.h
@@ -136,8 +136,7 @@ public:
     void loaderDetachedFromFrame(DocumentLoader*);
     void applyScreenWidthOverride(long*);
     void applyScreenHeightOverride(long*);
-    void willPaint(GraphicsContext*, const LayoutRect&);
-    void didPaint();
+    void didPaint(GraphicsContext*, const LayoutRect&);
     void didLayout();
     void didScroll();
 
@@ -179,8 +178,6 @@ private:
     HashMap<Frame*, String> m_frameToIdentifier;
     HashMap<String, Frame*> m_identifierToFrame;
     HashMap<DocumentLoader*, String> m_loaderToIdentifier;
-    GraphicsContext* m_lastPaintContext;
-    LayoutRect m_lastPaintRect;
     bool m_didLoadEventFire;
     bool m_geolocationOverridden;
     RefPtr<GeolocationPosition> m_geolocationPosition;
diff --git a/Source/WebCore/inspector/InspectorProfilerAgent.cpp b/Source/WebCore/inspector/InspectorProfilerAgent.cpp
index 6c28ed231..1466205b8 100644
--- a/Source/WebCore/inspector/InspectorProfilerAgent.cpp
+++ b/Source/WebCore/inspector/InspectorProfilerAgent.cpp
@@ -490,7 +490,7 @@ void InspectorProfilerAgent::reportMemoryUsage(MemoryObjectInfo* memoryObjectInf
     InspectorBaseAgent<InspectorProfilerAgent>::reportMemoryUsage(memoryObjectInfo);
     info.addMember(m_consoleAgent);
     info.addMember(m_injectedScriptManager);
-    info.addMember(m_frontend);
+    info.addWeakPointer(m_frontend);
     info.addMember(m_profiles);
     info.addMember(m_snapshots);
 
diff --git a/Source/WebCore/inspector/InspectorResourceAgent.cpp b/Source/WebCore/inspector/InspectorResourceAgent.cpp
index 8d15b8e50..333cfe14c 100644
--- a/Source/WebCore/inspector/InspectorResourceAgent.cpp
+++ b/Source/WebCore/inspector/InspectorResourceAgent.cpp
@@ -71,6 +71,7 @@
 #include <wtf/CurrentTime.h>
 #include <wtf/HexNumber.h>
 #include <wtf/ListHashSet.h>
+#include <wtf/MemoryInstrumentationHashMap.h>
 #include <wtf/RefPtr.h>
 #include <wtf/text/StringBuilder.h>
 
@@ -570,6 +571,7 @@ void InspectorResourceAgent::enable()
 void InspectorResourceAgent::disable(ErrorString*)
 {
     m_state->setBoolean(ResourceAgentState::resourceAgentEnabled, false);
+    m_state->setString(ResourceAgentState::userAgentOverride, "");
     m_instrumentingAgents->setInspectorResourceAgent(0);
     m_resourcesData->clear();
 }
@@ -668,6 +670,19 @@ void InspectorResourceAgent::mainFrameNavigated(DocumentLoader* loader)
     m_resourcesData->clear(m_pageAgent->loaderId(loader));
 }
 
+void InspectorResourceAgent::reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
+{
+    MemoryClassInfo info(memoryObjectInfo, this, WebCoreMemoryTypes::InspectorResourceAgent);
+    InspectorBaseAgent<InspectorResourceAgent>::reportMemoryUsage(memoryObjectInfo);
+    info.addWeakPointer(m_pageAgent);
+    info.addWeakPointer(m_client);
+    info.addWeakPointer(m_frontend);
+    info.addMember(m_userAgentOverride);
+    info.addMember(m_resourcesData);
+    info.addMember(m_pendingXHRReplayData);
+    info.addMember(m_styleRecalculationInitiator);
+}
+
 InspectorResourceAgent::InspectorResourceAgent(InstrumentingAgents* instrumentingAgents, InspectorPageAgent* pageAgent, InspectorClient* client, InspectorState* state)
     : InspectorBaseAgent<InspectorResourceAgent>("Network", instrumentingAgents, state)
     , m_pageAgent(pageAgent)
diff --git a/Source/WebCore/inspector/InspectorResourceAgent.h b/Source/WebCore/inspector/InspectorResourceAgent.h
index 5949e5ab8..06c9eaba2 100644
--- a/Source/WebCore/inspector/InspectorResourceAgent.h
+++ b/Source/WebCore/inspector/InspectorResourceAgent.h
@@ -153,6 +153,8 @@ public:
     virtual void clearBrowserCookies(ErrorString*);
     virtual void setCacheDisabled(ErrorString*, bool cacheDisabled);
 
+    virtual void reportMemoryUsage(MemoryObjectInfo*) const OVERRIDE;
+
 private:
     InspectorResourceAgent(InstrumentingAgents*, InspectorPageAgent*, InspectorClient*, InspectorState*);
 
diff --git a/Source/WebCore/inspector/InspectorRuntimeAgent.cpp b/Source/WebCore/inspector/InspectorRuntimeAgent.cpp
index 80be50c2a..9b0d2d72e 100644
--- a/Source/WebCore/inspector/InspectorRuntimeAgent.cpp
+++ b/Source/WebCore/inspector/InspectorRuntimeAgent.cpp
@@ -37,11 +37,6 @@
 #include "InjectedScript.h"
 #include "InjectedScriptManager.h"
 #include "InspectorValues.h"
-#include "InstrumentingAgents.h"
-#include "WorkerContext.h"
-#include "WorkerDebuggerAgent.h"
-#include "WorkerRunLoop.h"
-#include "WorkerThread.h"
 #include <wtf/PassRefPtr.h>
 
 
@@ -63,14 +58,11 @@ InspectorRuntimeAgent::InspectorRuntimeAgent(InstrumentingAgents* instrumentingA
 #if ENABLE(JAVASCRIPT_DEBUGGER)
     , m_scriptDebugServer(0)
 #endif
-    , m_paused(false)
 {
-    m_instrumentingAgents->setInspectorRuntimeAgent(this);
 }
 
 InspectorRuntimeAgent::~InspectorRuntimeAgent()
 {
-    m_instrumentingAgents->setInspectorRuntimeAgent(0);
 }
 
 #if ENABLE(JAVASCRIPT_DEBUGGER)
@@ -84,7 +76,7 @@ static ScriptDebugServer::PauseOnExceptionsState setPauseOnExceptionsState(Scrip
 }
 #endif
 
-void InspectorRuntimeAgent::evaluate(ErrorString* errorString, const String& expression, const String* const objectGroup, const bool* const includeCommandLineAPI, const bool* const doNotPauseOnExceptionsAndMuteConsole, const int* executionContextId, const bool* const returnByValue, RefPtr<TypeBuilder::Runtime::RemoteObject>& result, TypeBuilder::OptOutput<bool>* wasThrown)
+void InspectorRuntimeAgent::evaluate(ErrorString* errorString, const String& expression, const String* const objectGroup, const bool* const includeCommandLineAPI, const bool* const doNotPauseOnExceptionsAndMuteConsole, const int* executionContextId, const bool* const returnByValue, const bool* generatePreview, RefPtr<TypeBuilder::Runtime::RemoteObject>& result, TypeBuilder::OptOutput<bool>* wasThrown)
 {
     InjectedScript injectedScript = injectedScriptForEval(errorString, executionContextId);
     if (injectedScript.hasNoValue())
@@ -97,7 +89,7 @@ void InspectorRuntimeAgent::evaluate(ErrorString* errorString, const String& exp
     if (asBool(doNotPauseOnExceptionsAndMuteConsole))
         muteConsole();
 
-    injectedScript.evaluate(errorString, expression, objectGroup ? *objectGroup : "", asBool(includeCommandLineAPI), asBool(returnByValue), &result, wasThrown);
+    injectedScript.evaluate(errorString, expression, objectGroup ? *objectGroup : "", asBool(includeCommandLineAPI), asBool(returnByValue), asBool(generatePreview), &result, wasThrown);
 
     if (asBool(doNotPauseOnExceptionsAndMuteConsole)) {
         unmuteConsole();
@@ -107,7 +99,7 @@ void InspectorRuntimeAgent::evaluate(ErrorString* errorString, const String& exp
     }
 }
 
-void InspectorRuntimeAgent::callFunctionOn(ErrorString* errorString, const String& objectId, const String& expression, const RefPtr<InspectorArray>* const optionalArguments, const bool* const doNotPauseOnExceptionsAndMuteConsole, const bool* const returnByValue, RefPtr<TypeBuilder::Runtime::RemoteObject>& result, TypeBuilder::OptOutput<bool>* wasThrown)
+void InspectorRuntimeAgent::callFunctionOn(ErrorString* errorString, const String& objectId, const String& expression, const RefPtr<InspectorArray>* const optionalArguments, const bool* const doNotPauseOnExceptionsAndMuteConsole, const bool* const returnByValue, const bool* generatePreview, RefPtr<TypeBuilder::Runtime::RemoteObject>& result, TypeBuilder::OptOutput<bool>* wasThrown)
 {
     InjectedScript injectedScript = m_injectedScriptManager->injectedScriptForObjectId(objectId);
     if (injectedScript.hasNoValue()) {
@@ -126,7 +118,7 @@ void InspectorRuntimeAgent::callFunctionOn(ErrorString* errorString, const Strin
     if (asBool(doNotPauseOnExceptionsAndMuteConsole))
         muteConsole();
 
-    injectedScript.callFunctionOn(errorString, objectId, expression, arguments, asBool(returnByValue), &result, wasThrown);
+    injectedScript.callFunctionOn(errorString, objectId, expression, arguments, asBool(returnByValue), asBool(generatePreview), &result, wasThrown);
 
     if (asBool(doNotPauseOnExceptionsAndMuteConsole)) {
         unmuteConsole();
@@ -172,7 +164,6 @@ void InspectorRuntimeAgent::releaseObjectGroup(ErrorString*, const String& objec
 
 void InspectorRuntimeAgent::run(ErrorString*)
 {
-    m_paused = false;
 }
 
 #if ENABLE(JAVASCRIPT_DEBUGGER)
@@ -180,18 +171,6 @@ void InspectorRuntimeAgent::setScriptDebugServer(ScriptDebugServer* scriptDebugS
 {
     m_scriptDebugServer = scriptDebugServer;
 }
-
-#if ENABLE(WORKERS)
-void InspectorRuntimeAgent::pauseWorkerContext(WorkerContext* context)
-{
-    m_paused = true;
-    MessageQueueWaitResult result;
-    do {
-        result = context->thread()->runLoop().runInMode(context, WorkerDebuggerAgent::debuggerTaskMode);
-    // Keep waiting until execution is resumed.
-    } while (result == MessageQueueMessageReceived && m_paused);
-}
-#endif // ENABLE(WORKERS)
 #endif // ENABLE(JAVASCRIPT_DEBUGGER)
 
 } // namespace WebCore
diff --git a/Source/WebCore/inspector/InspectorRuntimeAgent.h b/Source/WebCore/inspector/InspectorRuntimeAgent.h
index 29e57d22f..362f2bd13 100644
--- a/Source/WebCore/inspector/InspectorRuntimeAgent.h
+++ b/Source/WebCore/inspector/InspectorRuntimeAgent.h
@@ -68,6 +68,7 @@ public:
                   const bool* doNotPauseOnExceptionsAndMuteConsole,
                   const int* executionContextId,
                   const bool* returnByValue,
+                  const bool* generatePreview,
                   RefPtr<TypeBuilder::Runtime::RemoteObject>& result,
                   TypeBuilder::OptOutput<bool>* wasThrown);
     virtual void callFunctionOn(ErrorString*,
@@ -76,6 +77,7 @@ public:
                         const RefPtr<InspectorArray>* optionalArguments,
                         const bool* doNotPauseOnExceptionsAndMuteConsole,
                         const bool* returnByValue,
+                        const bool* generatePreview,
                         RefPtr<TypeBuilder::Runtime::RemoteObject>& result,
                         TypeBuilder::OptOutput<bool>* wasThrown);
     virtual void releaseObject(ErrorString*, const String& objectId);
@@ -85,9 +87,6 @@ public:
 
 #if ENABLE(JAVASCRIPT_DEBUGGER)
     void setScriptDebugServer(ScriptDebugServer*);
-#if ENABLE(WORKERS)
-    void pauseWorkerContext(WorkerContext*);
-#endif
 #endif
 
 protected:
@@ -105,7 +104,6 @@ private:
 #if ENABLE(JAVASCRIPT_DEBUGGER)
     ScriptDebugServer* m_scriptDebugServer;
 #endif
-    bool m_paused;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/inspector/InspectorStyleSheet.cpp b/Source/WebCore/inspector/InspectorStyleSheet.cpp
index 95da1770e..32cbe7639 100644
--- a/Source/WebCore/inspector/InspectorStyleSheet.cpp
+++ b/Source/WebCore/inspector/InspectorStyleSheet.cpp
@@ -266,6 +266,11 @@ static void fillMediaListChain(CSSRule* rule, Array<TypeBuilder::CSS::CSSMedia>*
     }
 }
 
+static PassOwnPtr<CSSParser> createCSSParser(Document* document)
+{
+    return adoptPtr(new CSSParser(document ? CSSParserContext(document) : strictCSSParserContext()));
+}
+
 PassRefPtr<InspectorStyle> InspectorStyle::create(const InspectorCSSId& styleId, PassRefPtr<CSSStyleDeclaration> style, InspectorStyleSheet* parentStyleSheet)
 {
     return adoptRef(new InspectorStyle(styleId, style, parentStyleSheet));
@@ -339,8 +344,8 @@ bool InspectorStyle::setPropertyText(unsigned index, const String& propertyText,
     if (propertyText.stripWhiteSpace().length()) {
         RefPtr<StylePropertySet> tempMutableStyle = StylePropertySet::create();
         RefPtr<CSSRuleSourceData> sourceData = CSSRuleSourceData::create(CSSRuleSourceData::STYLE_RULE);
-        CSSParser p(CSSStrictMode);
-        p.parseDeclaration(tempMutableStyle.get(), propertyText + " " + bogusPropertyName + ": none", sourceData, m_style->parentStyleSheet()->contents());
+        Document* ownerDocument = m_parentStyleSheet->pageStyleSheet() ? m_parentStyleSheet->pageStyleSheet()->ownerDocument() : 0;
+        createCSSParser(ownerDocument)->parseDeclaration(tempMutableStyle.get(), propertyText + " " + bogusPropertyName + ": none", sourceData, m_style->parentStyleSheet()->contents());
         Vector<CSSPropertySourceData>& propertyData = sourceData->styleSourceData->propertyData;
         unsigned propertyCount = propertyData.size();
 
@@ -811,8 +816,20 @@ bool InspectorStyleSheet::setRuleSelector(const InspectorCSSId& id, const String
     return true;
 }
 
+static bool checkStyleRuleSelector(Document* document, const String& selector)
+{
+    CSSSelectorList selectorList;
+    createCSSParser(document)->parseSelector(selector, selectorList);
+    return selectorList.first();
+}
+
 CSSStyleRule* InspectorStyleSheet::addRule(const String& selector, ExceptionCode& ec)
 {
+    if (!checkStyleRuleSelector(m_pageStyleSheet->ownerDocument(), selector)) {
+        ec = SYNTAX_ERR;
+        return 0;
+    }
+
     String text;
     bool success = getText(&text);
     if (!success) {
@@ -826,9 +843,20 @@ CSSStyleRule* InspectorStyleSheet::addRule(const String& selector, ExceptionCode
     if (ec)
         return 0;
     ASSERT(m_pageStyleSheet->length());
-    CSSStyleRule* rule = InspectorCSSAgent::asCSSStyleRule(m_pageStyleSheet->item(m_pageStyleSheet->length() - 1));
+    unsigned lastRuleIndex = m_pageStyleSheet->length() - 1;
+    CSSRule* rule = m_pageStyleSheet->item(lastRuleIndex);
     ASSERT(rule);
 
+    CSSStyleRule* styleRule = InspectorCSSAgent::asCSSStyleRule(rule);
+    if (!styleRule) {
+        // What we just added has to be a CSSStyleRule - we cannot handle other types of rules yet.
+        // If it is not a style rule, pretend we never touched the stylesheet.
+        m_pageStyleSheet->deleteRule(lastRuleIndex, ec);
+        ASSERT(!ec);
+        ec = SYNTAX_ERR;
+        return 0;
+    }
+
     if (!styleSheetText.isEmpty())
         styleSheetText.append('\n');
 
@@ -839,7 +867,7 @@ CSSStyleRule* InspectorStyleSheet::addRule(const String& selector, ExceptionCode
 
     fireStyleSheetChanged();
 
-    return rule;
+    return styleRule;
 }
 
 bool InspectorStyleSheet::deleteRule(const InspectorCSSId& id, ExceptionCode& ec)
@@ -855,16 +883,18 @@ bool InspectorStyleSheet::deleteRule(const InspectorCSSId& id, ExceptionCode& ec
         return false;
     }
 
-    styleSheet->deleteRule(id.ordinal(), ec);
-    if (ec)
-        return false;
-
     RefPtr<CSSRuleSourceData> sourceData = ruleSourceDataFor(rule->style());
     if (!sourceData) {
         ec = NOT_FOUND_ERR;
         return false;
     }
 
+    styleSheet->deleteRule(id.ordinal(), ec);
+    // |rule| MAY NOT be addressed after this line!
+
+    if (ec)
+        return false;
+
     String sheetText = m_parsedStyleSheet->text();
     sheetText.remove(sourceData->ruleHeaderRange.start, sourceData->ruleBodyRange.end - sourceData->ruleHeaderRange.start + 1);
     m_parsedStyleSheet->setText(sheetText);
@@ -1142,10 +1172,8 @@ bool InspectorStyleSheet::ensureSourceData()
         return false;
 
     RefPtr<StyleSheetContents> newStyleSheet = StyleSheetContents::create();
-    Document* ownerDocument = m_pageStyleSheet->ownerDocument();
-    CSSParser p(ownerDocument ?  CSSParserContext(ownerDocument) : strictCSSParserContext());
     OwnPtr<RuleSourceDataList> ruleSourceDataResult = adoptPtr(new RuleSourceDataList());
-    p.parseSheet(newStyleSheet.get(), m_parsedStyleSheet->text(), 0, ruleSourceDataResult.get());
+    createCSSParser(m_pageStyleSheet->ownerDocument())->parseSheet(newStyleSheet.get(), m_parsedStyleSheet->text(), 0, ruleSourceDataResult.get());
     m_parsedStyleSheet->setSourceData(ruleSourceDataResult.release());
     return m_parsedStyleSheet->hasSourceData();
 }
@@ -1408,8 +1436,7 @@ bool InspectorStyleSheetForInlineStyle::getStyleAttributeRanges(CSSRuleSourceDat
     }
 
     RefPtr<StylePropertySet> tempDeclaration = StylePropertySet::create();
-    CSSParser p(m_element->document());
-    p.parseDeclaration(tempDeclaration.get(), m_styleText, result, m_element->document()->elementSheet()->contents());
+    createCSSParser(m_element->document())->parseDeclaration(tempDeclaration.get(), m_styleText, result, m_element->document()->elementSheet()->contents());
     return true;
 }
 
diff --git a/Source/WebCore/inspector/InspectorTimelineAgent.cpp b/Source/WebCore/inspector/InspectorTimelineAgent.cpp
index 25e5388ec..aad827ef7 100644
--- a/Source/WebCore/inspector/InspectorTimelineAgent.cpp
+++ b/Source/WebCore/inspector/InspectorTimelineAgent.cpp
@@ -198,6 +198,11 @@ void InspectorTimelineAgent::setIncludeMemoryDetails(ErrorString*, bool value)
     m_state->setBoolean(TimelineAgentState::includeMemoryDetails, value);
 }
 
+void InspectorTimelineAgent::canMonitorMainThread(ErrorString*, bool* result)
+{
+    *result = m_client && m_client->canMonitorMainThread();
+}
+
 void InspectorTimelineAgent::supportsFrameInstrumentation(ErrorString*, bool* result)
 {
     *result = m_client && m_client->supportsFrameInstrumentation();
@@ -269,13 +274,16 @@ void InspectorTimelineAgent::didRecalculateStyle()
     didCompleteCurrentRecord(TimelineRecordType::RecalculateStyles);
 }
 
-void InspectorTimelineAgent::willPaint(const LayoutRect& rect, Frame* frame)
+void InspectorTimelineAgent::willPaint(Frame* frame)
 {
-    pushCurrentRecord(TimelineRecordFactory::createPaintData(rect), TimelineRecordType::Paint, true, frame, true);
+    pushCurrentRecord(InspectorObject::create(), TimelineRecordType::Paint, true, frame, true);
 }
 
-void InspectorTimelineAgent::didPaint()
+void InspectorTimelineAgent::didPaint(const LayoutRect& rect)
 {
+    TimelineRecordEntry entry = m_recordStack.last();
+    ASSERT(entry.type == TimelineRecordType::Paint);
+    TimelineRecordFactory::addRectData(entry.data.get(), rect);
     didCompleteCurrentRecord(TimelineRecordType::Paint);
 }
 
diff --git a/Source/WebCore/inspector/InspectorTimelineAgent.h b/Source/WebCore/inspector/InspectorTimelineAgent.h
index 4b7bc7780..36e2b117b 100644
--- a/Source/WebCore/inspector/InspectorTimelineAgent.h
+++ b/Source/WebCore/inspector/InspectorTimelineAgent.h
@@ -81,6 +81,7 @@ public:
     virtual void start(ErrorString*, const int* maxCallStackDepth);
     virtual void stop(ErrorString*);
     virtual void setIncludeMemoryDetails(ErrorString*, bool);
+    virtual void canMonitorMainThread(ErrorString*, bool*);
     virtual void supportsFrameInstrumentation(ErrorString*, bool*);
 
     int id() const { return m_id; }
@@ -105,8 +106,8 @@ public:
     void willRecalculateStyle(Frame*);
     void didRecalculateStyle();
 
-    void willPaint(const LayoutRect&, Frame*);
-    void didPaint();
+    void willPaint(Frame*);
+    void didPaint(const LayoutRect&);
 
     void willScroll(Frame*);
     void didScroll();
diff --git a/Source/WebCore/inspector/InspectorWorkerAgent.cpp b/Source/WebCore/inspector/InspectorWorkerAgent.cpp
index e90f7cb4b..b2b9374cd 100644
--- a/Source/WebCore/inspector/InspectorWorkerAgent.cpp
+++ b/Source/WebCore/inspector/InspectorWorkerAgent.cpp
@@ -63,6 +63,7 @@ public:
     }
     virtual ~WorkerFrontendChannel()
     {
+        disconnectFromWorkerContext();
     }
 
     int id() const { return m_id; }
@@ -136,9 +137,9 @@ void InspectorWorkerAgent::restore()
 
 void InspectorWorkerAgent::clearFrontend()
 {
-    m_inspectorFrontend = 0;
     m_state->setBoolean(WorkerAgentState::autoconnectToWorkers, false);
-    destroyWorkerFrontendChannels();
+    disable(0);
+    m_inspectorFrontend = 0;
 }
 
 void InspectorWorkerAgent::enable(ErrorString*)
diff --git a/Source/WebCore/inspector/InstrumentingAgents.h b/Source/WebCore/inspector/InstrumentingAgents.h
index 2306e7a1e..884d9bb11 100644
--- a/Source/WebCore/inspector/InstrumentingAgents.h
+++ b/Source/WebCore/inspector/InstrumentingAgents.h
@@ -50,12 +50,12 @@ class InspectorFileSystemAgent;
 class InspectorPageAgent;
 class InspectorProfilerAgent;
 class InspectorResourceAgent;
-class InspectorRuntimeAgent;
 class InspectorTimelineAgent;
 class InspectorWorkerAgent;
 class Page;
 class PageRuntimeAgent;
 class WorkerContext;
+class WorkerRuntimeAgent;
 
 class InstrumentingAgents {
     WTF_MAKE_NONCOPYABLE(InstrumentingAgents);
@@ -68,8 +68,8 @@ public:
         , m_inspectorConsoleAgent(0)
         , m_inspectorDOMAgent(0)
         , m_inspectorResourceAgent(0)
-        , m_inspectorRuntimeAgent(0)
         , m_pageRuntimeAgent(0)
+        , m_workerRuntimeAgent(0)
         , m_inspectorTimelineAgent(0)
         , m_inspectorDOMStorageAgent(0)
 #if ENABLE(SQL_DATABASE)
@@ -109,12 +109,12 @@ public:
     InspectorResourceAgent* inspectorResourceAgent() const { return m_inspectorResourceAgent; }
     void setInspectorResourceAgent(InspectorResourceAgent* agent) { m_inspectorResourceAgent = agent; }
 
-    InspectorRuntimeAgent* inspectorRuntimeAgent() const { return m_inspectorRuntimeAgent; }
-    void setInspectorRuntimeAgent(InspectorRuntimeAgent* agent) { m_inspectorRuntimeAgent = agent; }
-
     PageRuntimeAgent* pageRuntimeAgent() const { return m_pageRuntimeAgent; }
     void setPageRuntimeAgent(PageRuntimeAgent* agent) { m_pageRuntimeAgent = agent; }
 
+    WorkerRuntimeAgent* workerRuntimeAgent() const { return m_workerRuntimeAgent; }
+    void setWorkerRuntimeAgent(WorkerRuntimeAgent* agent) { m_workerRuntimeAgent = agent; }
+
     InspectorTimelineAgent* inspectorTimelineAgent() const { return m_inspectorTimelineAgent; }
     void setInspectorTimelineAgent(InspectorTimelineAgent* agent) { m_inspectorTimelineAgent = agent; }
 
@@ -160,8 +160,8 @@ private:
     InspectorConsoleAgent* m_inspectorConsoleAgent;
     InspectorDOMAgent* m_inspectorDOMAgent;
     InspectorResourceAgent* m_inspectorResourceAgent;
-    InspectorRuntimeAgent* m_inspectorRuntimeAgent;
     PageRuntimeAgent* m_pageRuntimeAgent;
+    WorkerRuntimeAgent* m_workerRuntimeAgent;
     InspectorTimelineAgent* m_inspectorTimelineAgent;
     InspectorDOMStorageAgent* m_inspectorDOMStorageAgent;
 #if ENABLE(SQL_DATABASE)
diff --git a/Source/WebCore/inspector/MemoryInstrumentationImpl.cpp b/Source/WebCore/inspector/MemoryInstrumentationImpl.cpp
index 20d16cb1e..ae59b991c 100644
--- a/Source/WebCore/inspector/MemoryInstrumentationImpl.cpp
+++ b/Source/WebCore/inspector/MemoryInstrumentationImpl.cpp
@@ -70,10 +70,8 @@ void MemoryInstrumentationClientImpl::countObjectSize(const void* object, Memory
     if (!checkInstrumentedObjects())
         return;
 
-    if (object) {
+    if (object)
         m_countedObjects.add(object, size);
-        checkCountedObject(object);
-    }
 }
 
 bool MemoryInstrumentationClientImpl::visited(const void* object)
diff --git a/Source/WebCore/inspector/NetworkResourcesData.cpp b/Source/WebCore/inspector/NetworkResourcesData.cpp
index 788ebea55..1a57cb0a9 100644
--- a/Source/WebCore/inspector/NetworkResourcesData.cpp
+++ b/Source/WebCore/inspector/NetworkResourcesData.cpp
@@ -35,6 +35,7 @@
 #include "DOMImplementation.h"
 #include "SharedBuffer.h"
 #include "TextResourceDecoder.h"
+#include <wtf/MemoryInstrumentationHashMap.h>
 
 namespace {
 // 100MB
@@ -66,6 +67,15 @@ XHRReplayData::XHRReplayData(const String &method, const KURL& url, bool async,
 {
 }
 
+void XHRReplayData::reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
+{
+    MemoryClassInfo info(memoryObjectInfo, this);
+    info.addMember(m_method);
+    info.addMember(m_url);
+    info.addMember(m_formData);
+    info.addMember(m_headers);
+}
+
 // ResourceData
 NetworkResourcesData::ResourceData::ResourceData(const String& requestId, const String& loaderId)
     : m_requestId(requestId)
@@ -137,6 +147,22 @@ size_t NetworkResourcesData::ResourceData::decodeDataToContent()
     return contentSizeInBytes(m_content) - dataLength;
 }
 
+void NetworkResourcesData::ResourceData::reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
+{
+    MemoryClassInfo info(memoryObjectInfo, this);
+    info.addMember(m_requestId);
+    info.addMember(m_loaderId);
+    info.addMember(m_frameId);
+    info.addMember(m_url);
+    info.addMember(m_content);
+    info.addMember(m_xhrReplayData);
+    info.addMember(m_dataBuffer);
+    info.addMember(m_textEncodingName);
+    info.addMember(m_decoder);
+    info.addMember(m_buffer);
+    info.addMember(m_cachedResource);
+}
+
 // NetworkResourcesData
 NetworkResourcesData::NetworkResourcesData()
     : m_contentSize(0)
@@ -382,6 +408,14 @@ bool NetworkResourcesData::ensureFreeSpace(size_t size)
     return true;
 }
 
+void NetworkResourcesData::reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
+{
+    MemoryClassInfo info(memoryObjectInfo, this);
+    info.addMember(m_requestIdsDeque);
+    info.addMember(m_reusedXHRReplayDataRequestIds);
+    info.addMember(m_requestIdToResourceDataMap);
+}
+
 } // namespace WebCore
 
 #endif // ENABLE(INSPECTOR)
diff --git a/Source/WebCore/inspector/NetworkResourcesData.h b/Source/WebCore/inspector/NetworkResourcesData.h
index 22093ebd3..41340a3d8 100644
--- a/Source/WebCore/inspector/NetworkResourcesData.h
+++ b/Source/WebCore/inspector/NetworkResourcesData.h
@@ -57,6 +57,7 @@ public:
     PassRefPtr<FormData> formData() const { return m_formData; }
     const HTTPHeaderMap& headers() const { return m_headers; }
     bool includeCredentials() const { return m_includeCredentials; }
+    void reportMemoryUsage(MemoryObjectInfo*) const;
 private:
     XHRReplayData(const String &method, const KURL&, bool async, PassRefPtr<FormData>, bool includeCredentials);
 
@@ -116,6 +117,9 @@ public:
 
         XHRReplayData* xhrReplayData() const { return m_xhrReplayData.get(); }
         void setXHRReplayData(XHRReplayData* xhrReplayData) { m_xhrReplayData = xhrReplayData; }
+
+        void reportMemoryUsage(MemoryObjectInfo*) const;
+
     private:
         bool hasData() const { return m_dataBuffer; }
         size_t dataLength() const;
@@ -163,6 +167,8 @@ public:
     void reuseXHRReplayData(const String& requestId, const String& reusedRequestId);
     XHRReplayData* xhrReplayData(const String& requestId);
 
+    void reportMemoryUsage(MemoryObjectInfo*) const;
+
 private:
     void ensureNoDataForRequestId(const String& requestId);
     bool ensureFreeSpace(size_t);
diff --git a/Source/WebCore/inspector/PageRuntimeAgent.cpp b/Source/WebCore/inspector/PageRuntimeAgent.cpp
index 74c3b7ff9..5d1312a34 100644
--- a/Source/WebCore/inspector/PageRuntimeAgent.cpp
+++ b/Source/WebCore/inspector/PageRuntimeAgent.cpp
@@ -38,7 +38,6 @@
 #include "Document.h"
 #include "InjectedScript.h"
 #include "InjectedScriptManager.h"
-#include "InspectorAgent.h"
 #include "InspectorPageAgent.h"
 #include "InspectorState.h"
 #include "InstrumentingAgents.h"
@@ -53,28 +52,28 @@ namespace PageRuntimeAgentState {
 static const char runtimeEnabled[] = "runtimeEnabled";
 };
 
-PageRuntimeAgent::PageRuntimeAgent(InstrumentingAgents* instrumentingAgents, InspectorState* state, InjectedScriptManager* injectedScriptManager, Page* page, InspectorPageAgent* pageAgent, InspectorAgent* inspectorAgent)
+PageRuntimeAgent::PageRuntimeAgent(InstrumentingAgents* instrumentingAgents, InspectorState* state, InjectedScriptManager* injectedScriptManager, Page* page, InspectorPageAgent* pageAgent)
     : InspectorRuntimeAgent(instrumentingAgents, state, injectedScriptManager)
     , m_inspectedPage(page)
     , m_pageAgent(pageAgent)
-    , m_inspectorAgent(inspectorAgent)
     , m_frontend(0)
+    , m_mainWorldContextCreated(false)
 {
+    m_instrumentingAgents->setPageRuntimeAgent(this);
 }
 
 PageRuntimeAgent::~PageRuntimeAgent()
 {
+    m_instrumentingAgents->setPageRuntimeAgent(0);
 }
 
 void PageRuntimeAgent::setFrontend(InspectorFrontend* frontend)
 {
     m_frontend = frontend->runtime();
-    m_instrumentingAgents->setPageRuntimeAgent(this);
 }
 
 void PageRuntimeAgent::clearFrontend()
 {
-    m_instrumentingAgents->setPageRuntimeAgent(0);
     m_frontend = 0;
     String errorString;
     disable(&errorString);
@@ -98,7 +97,7 @@ void PageRuntimeAgent::enable(ErrorString* errorString)
     // Only report existing contexts if the page did commit load, otherwise we may
     // unintentionally initialize contexts in the frames which may trigger some listeners
     // that are expected to be triggered only after the load is committed, see http://crbug.com/131623
-    if (m_inspectorAgent->didCommitLoadFired())
+    if (m_mainWorldContextCreated)
         reportExecutionContextCreation();
 }
 
@@ -111,8 +110,10 @@ void PageRuntimeAgent::disable(ErrorString* errorString)
     m_state->setBoolean(PageRuntimeAgentState::runtimeEnabled, false);
 }
 
-void PageRuntimeAgent::didClearWindowObject(Frame* frame)
+void PageRuntimeAgent::didCreateMainWorldContext(Frame* frame)
 {
+    m_mainWorldContextCreated = true;
+
     if (!m_enabled)
         return;
     ASSERT(m_frontend);
diff --git a/Source/WebCore/inspector/PageRuntimeAgent.h b/Source/WebCore/inspector/PageRuntimeAgent.h
index 5278aa737..6d1e44ac1 100644
--- a/Source/WebCore/inspector/PageRuntimeAgent.h
+++ b/Source/WebCore/inspector/PageRuntimeAgent.h
@@ -40,16 +40,15 @@
 
 namespace WebCore {
 
-class InspectorAgent;
 class InspectorPageAgent;
 class Page;
 class SecurityOrigin;
 
 class PageRuntimeAgent : public InspectorRuntimeAgent {
 public:
-    static PassOwnPtr<PageRuntimeAgent> create(InstrumentingAgents* instrumentingAgents, InspectorState* state, InjectedScriptManager* injectedScriptManager, Page* page, InspectorPageAgent* pageAgent, InspectorAgent* inspectorAgent)
+    static PassOwnPtr<PageRuntimeAgent> create(InstrumentingAgents* instrumentingAgents, InspectorState* state, InjectedScriptManager* injectedScriptManager, Page* page, InspectorPageAgent* pageAgent)
     {
-        return adoptPtr(new PageRuntimeAgent(instrumentingAgents, state, injectedScriptManager, page, pageAgent, inspectorAgent));
+        return adoptPtr(new PageRuntimeAgent(instrumentingAgents, state, injectedScriptManager, page, pageAgent));
     }
     virtual ~PageRuntimeAgent();
     virtual void setFrontend(InspectorFrontend*);
@@ -58,11 +57,11 @@ public:
     virtual void enable(ErrorString*);
     virtual void disable(ErrorString*);
 
-    void didClearWindowObject(Frame*);
+    void didCreateMainWorldContext(Frame*);
     void didCreateIsolatedContext(Frame*, ScriptState*, SecurityOrigin*);
 
 private:
-    PageRuntimeAgent(InstrumentingAgents*, InspectorState*, InjectedScriptManager*, Page*, InspectorPageAgent*, InspectorAgent*);
+    PageRuntimeAgent(InstrumentingAgents*, InspectorState*, InjectedScriptManager*, Page*, InspectorPageAgent*);
 
     virtual InjectedScript injectedScriptForEval(ErrorString*, const int* executionContextId);
     virtual void muteConsole();
@@ -72,8 +71,8 @@ private:
 
     Page* m_inspectedPage;
     InspectorPageAgent* m_pageAgent;
-    InspectorAgent* m_inspectorAgent;
     InspectorFrontend::Runtime* m_frontend;
+    bool m_mainWorldContextCreated;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/inspector/ScriptDebugListener.h b/Source/WebCore/inspector/ScriptDebugListener.h
index 579440149..ebcb7ac62 100644
--- a/Source/WebCore/inspector/ScriptDebugListener.h
+++ b/Source/WebCore/inspector/ScriptDebugListener.h
@@ -60,6 +60,8 @@ public:
         int endLine;
         int endColumn;
         bool isContentScript;
+
+        void reportMemoryUsage(MemoryObjectInfo*) const;
     };
 
     virtual ~ScriptDebugListener() { }
diff --git a/Source/WebCore/inspector/TimelineRecordFactory.cpp b/Source/WebCore/inspector/TimelineRecordFactory.cpp
index 1af580a57..776b59f6f 100644
--- a/Source/WebCore/inspector/TimelineRecordFactory.cpp
+++ b/Source/WebCore/inspector/TimelineRecordFactory.cpp
@@ -170,13 +170,6 @@ PassRefPtr<InspectorObject> TimelineRecordFactory::createReceiveResourceData(con
     return data.release();
 }
     
-PassRefPtr<InspectorObject> TimelineRecordFactory::createPaintData(const LayoutRect& rect)
-{
-    RefPtr<InspectorObject> data = InspectorObject::create();
-    addRectData(data.get(), rect);
-    return data.release();
-}
-
 PassRefPtr<InspectorObject> TimelineRecordFactory::createDecodeImageData(const String& imageType)
 {
     RefPtr<InspectorObject> data = InspectorObject::create();
diff --git a/Source/WebCore/inspector/TimelineRecordFactory.h b/Source/WebCore/inspector/TimelineRecordFactory.h
index f24436abc..c5dcec2b7 100644
--- a/Source/WebCore/inspector/TimelineRecordFactory.h
+++ b/Source/WebCore/inspector/TimelineRecordFactory.h
@@ -75,8 +75,6 @@ namespace WebCore {
 
         static PassRefPtr<InspectorObject> createResourceFinishData(const String& requestId, bool didFail, double finishTime);
 
-        static PassRefPtr<InspectorObject> createPaintData(const LayoutRect&);
-
         static void addRectData(InspectorObject*, const LayoutRect&);
 
         static PassRefPtr<InspectorObject> createDecodeImageData(const String& imageType);
diff --git a/Source/WebCore/inspector/WorkerInspectorController.cpp b/Source/WebCore/inspector/WorkerInspectorController.cpp
index d383c8cdd..e04e7eeed 100644
--- a/Source/WebCore/inspector/WorkerInspectorController.cpp
+++ b/Source/WebCore/inspector/WorkerInspectorController.cpp
@@ -114,7 +114,9 @@ WorkerInspectorController::WorkerInspectorController(WorkerContext* workerContex
 #endif
         , 0
         , 0
-        , 0
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+        , m_debuggerAgent.get()
+#endif
     );
 
 #if ENABLE(JAVASCRIPT_DEBUGGER)
diff --git a/Source/WebCore/inspector/WorkerRuntimeAgent.cpp b/Source/WebCore/inspector/WorkerRuntimeAgent.cpp
index d74e2acfb..7ff2ad127 100644
--- a/Source/WebCore/inspector/WorkerRuntimeAgent.cpp
+++ b/Source/WebCore/inspector/WorkerRuntimeAgent.cpp
@@ -35,18 +35,26 @@
 #include "WorkerRuntimeAgent.h"
 
 #include "InjectedScript.h"
+#include "InstrumentingAgents.h"
 #include "ScriptState.h"
+#include "WorkerContext.h"
+#include "WorkerDebuggerAgent.h"
+#include "WorkerRunLoop.h"
+#include "WorkerThread.h"
 
 namespace WebCore {
 
 WorkerRuntimeAgent::WorkerRuntimeAgent(InstrumentingAgents* instrumentingAgents, InspectorState* state, InjectedScriptManager* injectedScriptManager, WorkerContext* workerContext)
     : InspectorRuntimeAgent(instrumentingAgents, state, injectedScriptManager)
     , m_workerContext(workerContext)
+    , m_paused(false)
 {
+    m_instrumentingAgents->setWorkerRuntimeAgent(this);
 }
 
 WorkerRuntimeAgent::~WorkerRuntimeAgent()
 {
+    m_instrumentingAgents->setWorkerRuntimeAgent(0);
 }
 
 InjectedScript WorkerRuntimeAgent::injectedScriptForEval(ErrorString* error, const int* executionContextId)
@@ -69,6 +77,23 @@ void WorkerRuntimeAgent::unmuteConsole()
     // We don't need to mute console for workers.
 }
 
+void WorkerRuntimeAgent::run(ErrorString*)
+{
+    m_paused = false;
+}
+
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+void WorkerRuntimeAgent::pauseWorkerContext(WorkerContext* context)
+{
+    m_paused = true;
+    MessageQueueWaitResult result;
+    do {
+        result = context->thread()->runLoop().runInMode(context, WorkerDebuggerAgent::debuggerTaskMode);
+    // Keep waiting until execution is resumed.
+    } while (result == MessageQueueMessageReceived && m_paused);
+}
+#endif // ENABLE(JAVASCRIPT_DEBUGGER)
+
 } // namespace WebCore
 
 #endif // ENABLE(INSPECTOR) && ENABLE(WORKERS)
diff --git a/Source/WebCore/inspector/WorkerRuntimeAgent.h b/Source/WebCore/inspector/WorkerRuntimeAgent.h
index 9f1997b74..50ddef369 100644
--- a/Source/WebCore/inspector/WorkerRuntimeAgent.h
+++ b/Source/WebCore/inspector/WorkerRuntimeAgent.h
@@ -48,12 +48,20 @@ public:
     }
     virtual ~WorkerRuntimeAgent();
 
+    // Protocol commands.
+    virtual void run(ErrorString*);
+
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+    void pauseWorkerContext(WorkerContext*);
+#endif // ENABLE(JAVASCRIPT_DEBUGGER)
+
 private:
     WorkerRuntimeAgent(InstrumentingAgents*, InspectorState*, InjectedScriptManager*, WorkerContext*);
     virtual InjectedScript injectedScriptForEval(ErrorString*, const int* executionContextId);
     virtual void muteConsole();
     virtual void unmuteConsole();
     WorkerContext* m_workerContext;
+    bool m_paused;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/inspector/compile-front-end.py b/Source/WebCore/inspector/compile-front-end.py
index 1710c3c6a..9bf395cfa 100755
--- a/Source/WebCore/inspector/compile-front-end.py
+++ b/Source/WebCore/inspector/compile-front-end.py
@@ -84,6 +84,7 @@ modules = [
             "Linkifier.js",
             "NetworkLog.js",
             "NetworkUISourceCodeProvider.js",
+            "NetworkWorkspaceProvider.js",
             "PresentationConsoleMessageHelper.js",
             "RuntimeModel.js",
             "SASSSourceMapping.js",
diff --git a/Source/WebCore/inspector/front-end/ApplicationCacheModel.js b/Source/WebCore/inspector/front-end/ApplicationCacheModel.js
index b5529a666..7f4083065 100644
--- a/Source/WebCore/inspector/front-end/ApplicationCacheModel.js
+++ b/Source/WebCore/inspector/front-end/ApplicationCacheModel.js
@@ -56,7 +56,7 @@ WebInspector.ApplicationCacheModel.EventTypes = {
 WebInspector.ApplicationCacheModel.prototype = {
     _frameNavigated: function(event)
     {
-        var frame = /** @type {WebInspector.ResourceTreeFrame} */ event.data;
+        var frame = /** @type {WebInspector.ResourceTreeFrame} */ (event.data);
         if (frame.isMainFrame()) {
             this._mainFrameNavigated();
             return;
@@ -70,7 +70,7 @@ WebInspector.ApplicationCacheModel.prototype = {
      */
     _frameDetached: function(event)
     {
-        var frame = /** @type {WebInspector.ResourceTreeFrame} */ event.data;
+        var frame = /** @type {WebInspector.ResourceTreeFrame} */ (event.data);
         this._frameManifestRemoved(frame.id);
     },
     
diff --git a/Source/WebCore/inspector/front-end/AuditLauncherView.js b/Source/WebCore/inspector/front-end/AuditLauncherView.js
index 2939f1b21..bf6db437d 100644
--- a/Source/WebCore/inspector/front-end/AuditLauncherView.js
+++ b/Source/WebCore/inspector/front-end/AuditLauncherView.js
@@ -71,7 +71,7 @@ WebInspector.AuditLauncherView.prototype = {
 
     _onRequestStarted: function(event)
     {
-        var request = /** @type {WebInspector.NetworkRequest} */ event.data;
+        var request = /** @type {WebInspector.NetworkRequest} */ (event.data);
         // Ignore long-living WebSockets for the sake of progress indicator, as we won't be waiting them anyway.
         if (request.type === WebInspector.resourceTypes.WebSocket)
             return;
@@ -81,7 +81,7 @@ WebInspector.AuditLauncherView.prototype = {
 
     _onRequestFinished: function(event)
     {
-        var request = /** @type {WebInspector.NetworkRequest} */ event.data;
+        var request = /** @type {WebInspector.NetworkRequest} */ (event.data);
         // See resorceStarted for details.
         if (request.type === WebInspector.resourceTypes.WebSocket)
             return;
@@ -89,6 +89,9 @@ WebInspector.AuditLauncherView.prototype = {
         this._updateResourceProgress();
     },
 
+    /**
+     * @param {!WebInspector.AuditCategory} category
+     */
     addCategory: function(category)
     {
         if (!this._sortedCategories.length)
@@ -113,6 +116,9 @@ WebInspector.AuditLauncherView.prototype = {
         this._updateButton();
     },
 
+    /**
+     * @param {boolean} auditRunning
+     */
     _setAuditRunning: function(auditRunning)
     {
         if (this._auditRunning === auditRunning)
@@ -158,6 +164,9 @@ WebInspector.AuditLauncherView.prototype = {
         this._setAuditRunning(!this._auditRunning);
     },
 
+    /**
+     * @param {boolean} checkCategories
+     */
     _selectAllClicked: function(checkCategories)
     {
         var childNodes = this._categoriesElement.childNodes;
@@ -174,6 +183,10 @@ WebInspector.AuditLauncherView.prototype = {
         this._updateButton();
     },
 
+    /**
+     * @param {string} title
+     * @param {string} id
+     */
     _createCategoryElement: function(title, id)
     {
         var labelElement = document.createElement("label");
diff --git a/Source/WebCore/inspector/front-end/AuditResultView.js b/Source/WebCore/inspector/front-end/AuditResultView.js
index dbd7a89c7..0a90b4a66 100644
--- a/Source/WebCore/inspector/front-end/AuditResultView.js
+++ b/Source/WebCore/inspector/front-end/AuditResultView.js
@@ -31,6 +31,7 @@
 /**
  * @constructor
  * @extends {WebInspector.View}
+ * @param {!Array.<!WebInspector.AuditCategoryResult>} categoryResults
  */
 WebInspector.AuditResultView = function(categoryResults)
 {
@@ -52,6 +53,7 @@ WebInspector.AuditResultView.prototype = {
 /**
  * @constructor
  * @extends {WebInspector.SidebarPane}
+ * @param {!WebInspector.AuditCategoryResult} categoryResult
  */
 WebInspector.AuditCategoryResultPane = function(categoryResult)
 {
@@ -88,6 +90,10 @@ WebInspector.AuditCategoryResultPane = function(categoryResult)
 }
 
 WebInspector.AuditCategoryResultPane.prototype = {
+    /**
+     * @param {(TreeOutline|TreeElement)} parentTreeElement
+     * @param {!WebInspector.AuditCategoryResult} result
+     */
     _appendResult: function(parentTreeElement, result)
     {
         var title = "";
diff --git a/Source/WebCore/inspector/front-end/AuditRules.js b/Source/WebCore/inspector/front-end/AuditRules.js
index 383482f5b..9b0fcba70 100644
--- a/Source/WebCore/inspector/front-end/AuditRules.js
+++ b/Source/WebCore/inspector/front-end/AuditRules.js
@@ -42,6 +42,12 @@ WebInspector.AuditRules.CacheableResponseCodes =
     304: true // Underlying request is cacheable
 }
 
+/**
+ * @param {!Array.<!WebInspector.NetworkRequest>} requests
+ * @param {Array.<!WebInspector.resourceTypes>} types
+ * @param {boolean} needFullResources
+ * @return {(Object.<string, !Array.<!WebInspector.NetworkRequest>>|Object.<string, !Array.<string>>)}
+ */
 WebInspector.AuditRules.getDomainToResourcesMap = function(requests, types, needFullResources)
 {
     var domainToResourcesMap = {};
@@ -74,10 +80,10 @@ WebInspector.AuditRules.GzipRule = function()
 
 WebInspector.AuditRules.GzipRule.prototype = {
     /**
-     * @param {Array.<WebInspector.NetworkRequest>} requests
-     * @param {WebInspector.AuditRuleResult} result
+     * @param {!Array.<!WebInspector.NetworkRequest>} requests
+     * @param {!WebInspector.AuditRuleResult} result
      * @param {function(WebInspector.AuditRuleResult)} callback
-     * @param {WebInspector.Progress} progress
+     * @param {!WebInspector.Progress} progress
      */
     doRun: function(requests, result, callback, progress)
     {
@@ -139,10 +145,10 @@ WebInspector.AuditRules.CombineExternalResourcesRule = function(id, name, type,
 
 WebInspector.AuditRules.CombineExternalResourcesRule.prototype = {
     /**
-     * @param {Array.<WebInspector.NetworkRequest>} requests
-     * @param {WebInspector.AuditRuleResult} result
+     * @param {!Array.<!WebInspector.NetworkRequest>} requests
+     * @param {!WebInspector.AuditRuleResult} result
      * @param {function(WebInspector.AuditRuleResult)} callback
-     * @param {WebInspector.Progress} progress
+     * @param {!WebInspector.Progress} progress
      */
     doRun: function(requests, result, callback, progress)
     {
@@ -204,15 +210,15 @@ WebInspector.AuditRules.MinimizeDnsLookupsRule = function(hostCountThreshold) {
 
 WebInspector.AuditRules.MinimizeDnsLookupsRule.prototype = {
     /**
-     * @param {Array.<WebInspector.NetworkRequest>} requests
-     * @param {WebInspector.AuditRuleResult} result
+     * @param {!Array.<!WebInspector.NetworkRequest>} requests
+     * @param {!WebInspector.AuditRuleResult} result
      * @param {function(WebInspector.AuditRuleResult)} callback
-     * @param {WebInspector.Progress} progress
+     * @param {!WebInspector.Progress} progress
      */
     doRun: function(requests, result, callback, progress)
     {
         var summary = result.addChild("");
-        var domainToResourcesMap = WebInspector.AuditRules.getDomainToResourcesMap(requests, undefined, false);
+        var domainToResourcesMap = WebInspector.AuditRules.getDomainToResourcesMap(requests, null, false);
         for (var domain in domainToResourcesMap) {
             if (domainToResourcesMap[domain].length > 1)
                 continue;
@@ -248,10 +254,10 @@ WebInspector.AuditRules.ParallelizeDownloadRule = function(optimalHostnameCount,
 
 WebInspector.AuditRules.ParallelizeDownloadRule.prototype = {
     /**
-     * @param {Array.<WebInspector.NetworkRequest>} requests
-     * @param {WebInspector.AuditRuleResult} result
+     * @param {!Array.<!WebInspector.NetworkRequest>} requests
+     * @param {!WebInspector.AuditRuleResult} result
      * @param {function(WebInspector.AuditRuleResult)} callback
-     * @param {WebInspector.Progress} progress
+     * @param {!WebInspector.Progress} progress
      */
     doRun: function(requests, result, callback, progress)
     {
@@ -323,10 +329,10 @@ WebInspector.AuditRules.UnusedCssRule = function()
 
 WebInspector.AuditRules.UnusedCssRule.prototype = {
     /**
-     * @param {Array.<WebInspector.NetworkRequest>} requests
-     * @param {WebInspector.AuditRuleResult} result
+     * @param {!Array.<!WebInspector.NetworkRequest>} requests
+     * @param {!WebInspector.AuditRuleResult} result
      * @param {function(WebInspector.AuditRuleResult)} callback
-     * @param {WebInspector.Progress} progress
+     * @param {!WebInspector.Progress} progress
      */
     doRun: function(requests, result, callback, progress)
     {
@@ -475,10 +481,10 @@ WebInspector.AuditRules.CacheControlRule.MillisPerMonth = 1000 * 60 * 60 * 24 *
 
 WebInspector.AuditRules.CacheControlRule.prototype = {
     /**
-     * @param {Array.<WebInspector.NetworkRequest>} requests
-     * @param {WebInspector.AuditRuleResult} result
+     * @param {!Array.<!WebInspector.NetworkRequest>} requests
+     * @param {!WebInspector.AuditRuleResult} result
      * @param {function(WebInspector.AuditRuleResult)} callback
-     * @param {WebInspector.Progress} progress
+     * @param {!WebInspector.Progress} progress
      */
     doRun: function(requests, result, callback, progress)
     {
@@ -728,10 +734,10 @@ WebInspector.AuditRules.ImageDimensionsRule = function()
 
 WebInspector.AuditRules.ImageDimensionsRule.prototype = {
     /**
-     * @param {Array.<WebInspector.NetworkRequest>} requests
-     * @param {WebInspector.AuditRuleResult} result
+     * @param {!Array.<!WebInspector.NetworkRequest>} requests
+     * @param {!WebInspector.AuditRuleResult} result
      * @param {function(WebInspector.AuditRuleResult)} callback
-     * @param {WebInspector.Progress} progress
+     * @param {!WebInspector.Progress} progress
      */
     doRun: function(requests, result, callback, progress)
     {
@@ -860,10 +866,10 @@ WebInspector.AuditRules.CssInHeadRule = function()
 
 WebInspector.AuditRules.CssInHeadRule.prototype = {
     /**
-     * @param {Array.<WebInspector.NetworkRequest>} requests
-     * @param {WebInspector.AuditRuleResult} result
+     * @param {!Array.<!WebInspector.NetworkRequest>} requests
+     * @param {!WebInspector.AuditRuleResult} result
      * @param {function(WebInspector.AuditRuleResult)} callback
-     * @param {WebInspector.Progress} progress
+     * @param {!WebInspector.Progress} progress
      */
     doRun: function(requests, result, callback, progress)
     {
@@ -950,10 +956,10 @@ WebInspector.AuditRules.StylesScriptsOrderRule = function()
 
 WebInspector.AuditRules.StylesScriptsOrderRule.prototype = {
     /**
-     * @param {Array.<WebInspector.NetworkRequest>} requests
-     * @param {WebInspector.AuditRuleResult} result
+     * @param {!Array.<!WebInspector.NetworkRequest>} requests
+     * @param {!WebInspector.AuditRuleResult} result
      * @param {function(WebInspector.AuditRuleResult)} callback
-     * @param {WebInspector.Progress} progress
+     * @param {!WebInspector.Progress} progress
      */
     doRun: function(requests, result, callback, progress)
     {
@@ -1038,10 +1044,10 @@ WebInspector.AuditRules.CSSRuleBase = function(id, name)
 
 WebInspector.AuditRules.CSSRuleBase.prototype = {
     /**
-     * @param {Array.<WebInspector.NetworkRequest>} requests
-     * @param {WebInspector.AuditRuleResult} result
+     * @param {!Array.<!WebInspector.NetworkRequest>} requests
+     * @param {!WebInspector.AuditRuleResult} result
      * @param {function(WebInspector.AuditRuleResult)} callback
-     * @param {WebInspector.Progress} progress
+     * @param {!WebInspector.Progress} progress
      */
     doRun: function(requests, result, callback, progress)
     {
@@ -1205,10 +1211,10 @@ WebInspector.AuditRules.CookieRuleBase = function(id, name)
 
 WebInspector.AuditRules.CookieRuleBase.prototype = {
     /**
-     * @param {Array.<WebInspector.NetworkRequest>} requests
-     * @param {WebInspector.AuditRuleResult} result
+     * @param {!Array.<!WebInspector.NetworkRequest>} requests
+     * @param {!WebInspector.AuditRuleResult} result
      * @param {function(WebInspector.AuditRuleResult)} callback
-     * @param {WebInspector.Progress} progress
+     * @param {!WebInspector.Progress} progress
      */
     doRun: function(requests, result, callback, progress)
     {
@@ -1228,7 +1234,7 @@ WebInspector.AuditRules.CookieRuleBase.prototype = {
     {
         for (var i = 0; i < allCookies.length; ++i) {
             for (var requestDomain in requestsByDomain) {
-                if (WebInspector.Cookies.cookieDomainMatchesResourceDomain(allCookies[i].domain, requestDomain))
+                if (WebInspector.Cookies.cookieDomainMatchesResourceDomain(allCookies[i].domain(), requestDomain))
                     this._callbackForResourceCookiePairs(requestsByDomain[requestDomain], allCookies[i], callback);
             }
         }
@@ -1263,7 +1269,7 @@ WebInspector.AuditRules.CookieSizeRule.prototype = {
     {
         var total = 0;
         for (var i = 0; i < cookieArray.length; ++i)
-            total += cookieArray[i].size;
+            total += cookieArray[i].size();
         return cookieArray.length ? Math.round(total / cookieArray.length) : 0;
     },
 
@@ -1271,7 +1277,7 @@ WebInspector.AuditRules.CookieSizeRule.prototype = {
     {
         var result = 0;
         for (var i = 0; i < cookieArray.length; ++i)
-            result = Math.max(cookieArray[i].size, result);
+            result = Math.max(cookieArray[i].size(), result);
         return result;
     },
 
@@ -1397,7 +1403,7 @@ WebInspector.AuditRules.StaticCookielessRule.prototype = {
 
     _collectorCallback: function(matchingResourceData, request, cookie)
     {
-        matchingResourceData[request.url] = (matchingResourceData[request.url] || 0) + cookie.size;
+        matchingResourceData[request.url] = (matchingResourceData[request.url] || 0) + cookie.size();
     },
 
     __proto__: WebInspector.AuditRules.CookieRuleBase.prototype
diff --git a/Source/WebCore/inspector/front-end/AuditsPanel.js b/Source/WebCore/inspector/front-end/AuditsPanel.js
index 5d005a487..2624d4d15 100644
--- a/Source/WebCore/inspector/front-end/AuditsPanel.js
+++ b/Source/WebCore/inspector/front-end/AuditsPanel.js
@@ -70,17 +70,27 @@ WebInspector.AuditsPanel.prototype = {
         return [this.clearResultsButton.element];
     },
 
+    /**
+     * @return {!Object.<string, !WebInspector.AuditCategory>}
+     */
     get categoriesById()
     {
         return this._auditCategoriesById;
     },
 
+    /**
+     * @param {!WebInspector.AuditCategory} category
+     */
     addCategory: function(category)
     {
         this.categoriesById[category.id] = category;
         this._launcherView.addCategory(category);
     },
 
+    /**
+     * @param {string} id
+     * @return {WebInspector.AuditCategory}
+     */
     getCategory: function(id)
     {
         return this.categoriesById[id];
@@ -96,6 +106,10 @@ WebInspector.AuditsPanel.prototype = {
         }
     },
 
+    /**
+     * @param {!Array.<!WebInspector.AuditCategory>} categories
+     * @param {function(string, !Array.<!WebInspector.AuditCategoryResult>)} resultCallback
+     */
     _executeAudit: function(categories, resultCallback)
     {
         this._progress.setTitle(WebInspector.UIString("Running audit"));
@@ -133,6 +147,11 @@ WebInspector.AuditsPanel.prototype = {
         }
     },
 
+    /**
+     * @param {function()} launcherCallback
+     * @param {string} mainResourceURL
+     * @param {!Array.<!WebInspector.AuditCategoryResult>} results
+     */
     _auditFinishedCallback: function(launcherCallback, mainResourceURL, results)
     {
         var children = this.auditResultsTreeElement.children;
@@ -196,6 +215,9 @@ WebInspector.AuditsPanel.prototype = {
         }
     },
 
+    /**
+     * @param {!Array.<!WebInspector.AuditCategoryResult>} categoryResults
+     */
     showResults: function(categoryResults)
     {
         if (!categoryResults._resultView)
@@ -246,6 +268,7 @@ WebInspector.AuditsPanel.prototype = {
 
 /**
  * @constructor
+ * @param {string} displayName
  */
 WebInspector.AuditCategory = function(displayName)
 {
@@ -254,17 +277,27 @@ WebInspector.AuditCategory = function(displayName)
 }
 
 WebInspector.AuditCategory.prototype = {
+    /**
+     * @return {string}
+     */
     get id()
     {
         // this._id value is injected at construction time.
         return this._id;
     },
 
+    /**
+     * @return {string}
+     */
     get displayName()
     {
         return this._displayName;
     },
 
+    /**
+     * @param {!WebInspector.AuditRule} rule
+     * @param {!WebInspector.AuditRule.Severity} severity
+     */
     addRule: function(rule, severity)
     {
         rule.severity = severity;
@@ -272,19 +305,19 @@ WebInspector.AuditCategory.prototype = {
     },
 
     /**
-     * @param {Array.<WebInspector.NetworkRequest>} requests
+     * @param {!Array.<!WebInspector.NetworkRequest>} requests
      * @param {function(WebInspector.AuditRuleResult)} ruleResultCallback
      * @param {function()} categoryDoneCallback
-     * @param {WebInspector.Progress} progress
+     * @param {!WebInspector.Progress} progress
      */
     run: function(requests, ruleResultCallback, categoryDoneCallback, progress)
     {
         this._ensureInitialized();
         var remainingRulesCount = this._rules.length;
         progress.setTotalWork(remainingRulesCount);
-        function callbackWrapper()
+        function callbackWrapper(result)
         {
-            ruleResultCallback.apply(this, arguments);
+            ruleResultCallback(result);
             progress.worked();
             if (!--remainingRulesCount)
                 categoryDoneCallback();
@@ -305,6 +338,8 @@ WebInspector.AuditCategory.prototype = {
 
 /**
  * @constructor
+ * @param {string} id
+ * @param {string} displayName
  */
 WebInspector.AuditRule = function(id, displayName)
 {
@@ -312,12 +347,18 @@ WebInspector.AuditRule = function(id, displayName)
     this._displayName = displayName;
 }
 
+/**
+ * @enum {string}
+ */
 WebInspector.AuditRule.Severity = {
     Info: "info",
     Warning: "warning",
     Severe: "severe"
 }
 
+/**
+ * @type {Object.<WebInspector.AuditRule.Severity, number>}
+ */
 WebInspector.AuditRule.SeverityOrder = {
     "info": 3,
     "warning": 2,
@@ -335,15 +376,18 @@ WebInspector.AuditRule.prototype = {
         return this._displayName;
     },
 
+    /**
+     * @param {WebInspector.AuditRule.Severity} severity
+     */
     set severity(severity)
     {
         this._severity = severity;
     },
 
     /**
-     * @param {Array.<WebInspector.NetworkRequest>} requests
+     * @param {!Array.<!WebInspector.NetworkRequest>} requests
      * @param {function(WebInspector.AuditRuleResult)} callback
-     * @param {WebInspector.Progress} progress
+     * @param {!WebInspector.Progress} progress
      */
     run: function(requests, callback, progress)
     {
@@ -369,6 +413,7 @@ WebInspector.AuditRule.prototype = {
 
 /**
  * @constructor
+ * @param {!WebInspector.AuditCategory} category
  */
 WebInspector.AuditCategoryResult = function(category)
 {
@@ -377,6 +422,9 @@ WebInspector.AuditCategoryResult = function(category)
 }
 
 WebInspector.AuditCategoryResult.prototype = {
+    /**
+     * @param {!WebInspector.AuditCategoryResult} ruleResult
+     */
     addRuleResult: function(ruleResult)
     {
         this.ruleResults.push(ruleResult);
@@ -385,6 +433,7 @@ WebInspector.AuditCategoryResult.prototype = {
 
 /**
  * @constructor
+ * @param {(string|boolean|number|Object)} value
  * @param {boolean=} expanded
  * @param {string=} className
  */
@@ -402,6 +451,10 @@ WebInspector.AuditRuleResult = function(value, expanded, className)
         this._formatters[standardFormatters[i]] = String.standardFormatters[standardFormatters[i]];
 }
 
+/**
+ * @param {string} url
+ * @return {!Element}
+ */
 WebInspector.AuditRuleResult.linkifyDisplayName = function(url)
 {
     return WebInspector.linkifyURLAsNode(url, WebInspector.displayNameForURL(url));
@@ -414,8 +467,10 @@ WebInspector.AuditRuleResult.resourceDomain = function(domain)
 
 WebInspector.AuditRuleResult.prototype = {
     /**
+     * @param {(string|boolean|number|Object)} value
      * @param {boolean=} expanded
      * @param {string=} className
+     * @return {!WebInspector.AuditRuleResult}
      */
     addChild: function(value, expanded, className)
     {
@@ -426,43 +481,53 @@ WebInspector.AuditRuleResult.prototype = {
         return entry;
     },
 
+    /**
+     * @param {string} url
+     */
     addURL: function(url)
     {
-        return this.addChild(WebInspector.AuditRuleResult.linkifyDisplayName(url));
+        this.addChild(WebInspector.AuditRuleResult.linkifyDisplayName(url));
     },
 
+    /**
+     * @param {!Array.<string>} urls
+     */
     addURLs: function(urls)
     {
         for (var i = 0; i < urls.length; ++i)
             this.addURL(urls[i]);
     },
 
+    /**
+     * @param {string} snippet
+     */
     addSnippet: function(snippet)
     {
-        return this.addChild(snippet, false, "source-code");
+        this.addChild(snippet, false, "source-code");
     },
 
     /**
      * @param {string} format
      * @param {...*} vararg
+     * @return {!WebInspector.AuditRuleResult}
      */
     addFormatted: function(format, vararg)
     {
         var substitutions = Array.prototype.slice.call(arguments, 1);
         var fragment = document.createDocumentFragment();
 
-        var formattedResult = String.format(format, substitutions, this._formatters, fragment, this._append).formattedResult;
+        function append(a, b)
+        {
+            if (!(b instanceof Node))
+                b = document.createTextNode(b);
+            a.appendChild(b);
+            return a;
+        }
+
+        var formattedResult = String.format(format, substitutions, this._formatters, fragment, append).formattedResult;
         if (formattedResult instanceof Node)
             formattedResult.normalize();
         return this.addChild(formattedResult);
-    },
-
-    _append: function(a, b)
-    {
-        if (!(b instanceof Node))
-            b = document.createTextNode(b);
-        a.appendChild(b);
-        return a;
     }
 }
 
@@ -505,7 +570,10 @@ WebInspector.AuditsSidebarTreeElement.prototype = {
 /**
  * @constructor
  * @extends {WebInspector.SidebarTreeElement}
- * @param {WebInspector.AuditsPanel} panel
+ * @param {!WebInspector.AuditsPanel} panel
+ * @param {!Array.<!WebInspector.AuditCategoryResult>} results
+ * @param {string} mainResourceURL
+ * @param {number} ordinal
  */
 WebInspector.AuditResultSidebarTreeElement = function(panel, results, mainResourceURL, ordinal)
 {
@@ -532,7 +600,10 @@ WebInspector.AuditResultSidebarTreeElement.prototype = {
 // Contributed audit rules should go into this namespace.
 WebInspector.AuditRules = {};
 
-// Contributed audit categories should go into this namespace.
+/**
+ * Contributed audit categories should go into this namespace.
+ * @type {Object.<string, function(new:WebInspector.AuditCategory)>}
+ */
 WebInspector.AuditCategories = {};
 
 importScript("AuditCategories.js");
diff --git a/Source/WebCore/inspector/front-end/BreakpointManager.js b/Source/WebCore/inspector/front-end/BreakpointManager.js
index 709cf1193..982595015 100644
--- a/Source/WebCore/inspector/front-end/BreakpointManager.js
+++ b/Source/WebCore/inspector/front-end/BreakpointManager.js
@@ -58,10 +58,8 @@ WebInspector.BreakpointManager.Events = {
     BreakpointRemoved: "breakpoint-removed"
 }
 
-WebInspector.BreakpointManager.breakpointStorageId = function(uiSourceCode)
+WebInspector.BreakpointManager.sourceFileId = function(uiSourceCode)
 {
-    if (uiSourceCode.isTemporary)
-        return "";
     return uiSourceCode.formatted() ? "deobfuscated:" + uiSourceCode.url : uiSourceCode.url;
 }
 
@@ -69,9 +67,9 @@ WebInspector.BreakpointManager.prototype = {
     /**
      * @param {WebInspector.UISourceCode} uiSourceCode
      */
-    restoreBreakpoints: function(uiSourceCode)
+    _restoreBreakpoints: function(uiSourceCode)
     {
-        var sourceFileId = WebInspector.BreakpointManager.breakpointStorageId(uiSourceCode);
+        var sourceFileId = WebInspector.BreakpointManager.sourceFileId(uiSourceCode);
         if (!sourceFileId || this._sourceFilesWithRestoredBreakpoints[sourceFileId])
             return;
         this._sourceFilesWithRestoredBreakpoints[sourceFileId] = true;
@@ -79,7 +77,7 @@ WebInspector.BreakpointManager.prototype = {
         // Erase provisional breakpoints prior to restoring them.
         for (var debuggerId in this._breakpointForDebuggerId) {
             var breakpoint = this._breakpointForDebuggerId[debuggerId];
-            if (breakpoint._sourceCodeStorageId !== sourceFileId)
+            if (breakpoint._sourceFileId !== sourceFileId)
                 continue;
             this._debuggerModel.removeBreakpoint(debuggerId);
             delete this._breakpointForDebuggerId[debuggerId];
@@ -93,9 +91,20 @@ WebInspector.BreakpointManager.prototype = {
      */
     _uiSourceCodeAdded: function(event)
     {
-        var uiSourceCode = /** @type {WebInspector.UISourceCode} */ event.data;
-        if (uiSourceCode.contentType() === WebInspector.resourceTypes.Script || uiSourceCode.contentType() === WebInspector.resourceTypes.Document)
-            this.restoreBreakpoints(uiSourceCode);
+        var uiSourceCode = /** @type {WebInspector.UISourceCode} */ (event.data);
+        if (uiSourceCode.contentType() === WebInspector.resourceTypes.Script || uiSourceCode.contentType() === WebInspector.resourceTypes.Document) {
+            this._restoreBreakpoints(uiSourceCode);
+            uiSourceCode.addEventListener(WebInspector.UISourceCode.Events.FormattedChanged, this._uiSourceCodeFormatted, this);
+        }
+    },
+
+    /**
+     * @param {WebInspector.Event} event
+     */
+    _uiSourceCodeFormatted: function(event)
+    {
+        var uiSourceCode = /** @type {WebInspector.UISourceCode} */ (event.target);
+        this._restoreBreakpoints(uiSourceCode);
     },
 
     /**
@@ -103,16 +112,16 @@ WebInspector.BreakpointManager.prototype = {
      */
     _uiSourceCodeRemoved: function(event)
     {
-        var uiSourceCode = /** @type {WebInspector.UISourceCode} */ event.data;
+        var uiSourceCode = /** @type {WebInspector.UISourceCode} */ (event.data);
         if (uiSourceCode.contentType() !== WebInspector.resourceTypes.Script && uiSourceCode.contentType() !== WebInspector.resourceTypes.Document)
             return;
         if (uiSourceCode.divergedVersion)
             return;
-        
-        var sourceFileId = WebInspector.BreakpointManager.breakpointStorageId(uiSourceCode);
+
+        var sourceFileId = WebInspector.BreakpointManager.sourceFileId(uiSourceCode);
         if (!sourceFileId)
             return;
-        
+
         var breakpoints = this._breakpoints.slice();
         for (var i = 0; i < breakpoints.length; ++i) {
             var breakpoint = breakpoints[i];
@@ -122,14 +131,12 @@ WebInspector.BreakpointManager.prototype = {
                     breakpoint.remove(true);
             }
         }
-        
+
         delete this._sourceFilesWithRestoredBreakpoints[sourceFileId];
-        
+
         var uiSourceCodes = this._workspace.uiSourceCodes();
-        for (var i = 0; i < uiSourceCodes.length; ++i) {
-            if (WebInspector.BreakpointManager.breakpointStorageId(uiSourceCodes[i]) === sourceFileId)
-                this.restoreBreakpoints(uiSourceCodes[i]);
-        }
+        for (var i = 0; i < uiSourceCodes.length; ++i)
+            this._restoreBreakpoints(uiSourceCodes[i]);
     },
 
     /**
@@ -202,9 +209,9 @@ WebInspector.BreakpointManager.prototype = {
     {
         function filter(breakpoint, uiLocation)
         {
-            return uiLocation.uiSourceCode === uiSourceCode;   
+            return uiLocation.uiSourceCode === uiSourceCode;
         }
-        
+
         return this._filteredBreakpointLocations(filter);
     },
 
@@ -263,8 +270,8 @@ WebInspector.BreakpointManager.prototype = {
 
     _breakpointResolved: function(event)
     {
-        var breakpointId = /** @type {DebuggerAgent.BreakpointId} */ event.data.breakpointId;
-        var location = /** @type {WebInspector.DebuggerModel.Location} */ event.data.location;
+        var breakpointId = /** @type {DebuggerAgent.BreakpointId} */ (event.data.breakpointId);
+        var location = /** @type {WebInspector.DebuggerModel.Location} */ (event.data.location);
         var breakpoint = this._breakpointForDebuggerId[breakpointId];
         if (!breakpoint || breakpoint._isProvisional)
             return;
@@ -340,10 +347,10 @@ WebInspector.BreakpointManager.Breakpoint = function(breakpointManager, uiSource
 {
     this._breakpointManager = breakpointManager;
     this._primaryUILocation = new WebInspector.UILocation(uiSourceCode, lineNumber, 0);
-    this._sourceCodeStorageId = WebInspector.BreakpointManager.breakpointStorageId(uiSourceCode);
-    /** @type {Array.<WebInspector.Script.Location>} */ 
+    this._sourceFileId = WebInspector.BreakpointManager.sourceFileId(uiSourceCode);
+    /** @type {Array.<WebInspector.Script.Location>} */
     this._liveLocations = [];
-    /** @type {Object.<string, WebInspector.UILocation>} */ 
+    /** @type {Object.<string, WebInspector.UILocation>} */
     this._uiLocations = {};
 
     // Force breakpoint update.
@@ -376,7 +383,7 @@ WebInspector.BreakpointManager.Breakpoint.prototype = {
     _locationUpdated: function(location, uiLocation)
     {
         var stringifiedLocation = location.scriptId + ":" + location.lineNumber + ":" + location.columnNumber;
-        var oldUILocation = /** @type {WebInspector.UILocation} */ this._uiLocations[stringifiedLocation];
+        var oldUILocation = /** @type {WebInspector.UILocation} */ (this._uiLocations[stringifiedLocation]);
         if (oldUILocation)
             this._breakpointManager._uiLocationRemoved(this, oldUILocation);
         if (this._uiLocations[""]) {
@@ -458,12 +465,12 @@ WebInspector.BreakpointManager.Breakpoint.prototype = {
     _setInDebugger: function()
     {
         var rawLocation = this._primaryUILocation.uiLocationToRawLocation();
-        var debuggerModelLocation = /** @type {WebInspector.DebuggerModel.Location} */ rawLocation;
+        var debuggerModelLocation = /** @type {WebInspector.DebuggerModel.Location} */ (rawLocation);
         if (debuggerModelLocation)
             this._breakpointManager._debuggerModel.setBreakpointByScriptLocation(debuggerModelLocation, this._condition, didSetBreakpoint.bind(this));
         else
             this._breakpointManager._debuggerModel.setBreakpointByURL(this._primaryUILocation.uiSourceCode.url, this._primaryUILocation.lineNumber, 0, this._condition, didSetBreakpoint.bind(this));
-        
+
         /**
          * @this {WebInspector.BreakpointManager.Breakpoint}
          * @param {?DebuggerAgent.BreakpointId} breakpointId
@@ -527,7 +534,7 @@ WebInspector.BreakpointManager.Breakpoint.prototype = {
      */
     _breakpointStorageId: function()
     {
-        return WebInspector.BreakpointManager.breakpointStorageId(this._primaryUILocation.uiSourceCode) + ":" + this._primaryUILocation.lineNumber;
+        return this._sourceFileId + ":" + this._primaryUILocation.lineNumber;
     },
 
     _fakeBreakpointAtPrimaryLocation: function()
@@ -551,7 +558,7 @@ WebInspector.BreakpointManager.Storage = function(breakpointManager, setting)
     /** @type {Object.<string,WebInspector.BreakpointManager.Storage.Item>} */
     this._breakpoints = {};
     for (var i = 0; i < breakpoints.length; ++i) {
-        var breakpoint = /** @type {WebInspector.BreakpointManager.Storage.Item} */ breakpoints[i];
+        var breakpoint = /** @type {WebInspector.BreakpointManager.Storage.Item} */ (breakpoints[i]);
         this._breakpoints[breakpoint.sourceFileId + ":" + breakpoint.lineNumber] = breakpoint;
     }
 }
@@ -563,10 +570,10 @@ WebInspector.BreakpointManager.Storage.prototype = {
     _restoreBreakpoints: function(uiSourceCode)
     {
         this._muted = true;
-        var breakpointStorageId = WebInspector.BreakpointManager.breakpointStorageId(uiSourceCode);
+        var sourceFileId = WebInspector.BreakpointManager.sourceFileId(uiSourceCode);
         for (var id in this._breakpoints) {
             var breakpoint = this._breakpoints[id];
-            if (breakpoint.sourceFileId === breakpointStorageId)
+            if (breakpoint.sourceFileId === sourceFileId)
                 this._breakpointManager._innerSetBreakpoint(uiSourceCode, breakpoint.lineNumber, breakpoint.condition, breakpoint.enabled);
         }
         delete this._muted;
@@ -610,7 +617,7 @@ WebInspector.BreakpointManager.Storage.prototype = {
 WebInspector.BreakpointManager.Storage.Item = function(breakpoint)
 {
     var primaryUILocation = breakpoint.primaryUILocation();
-    this.sourceFileId = WebInspector.BreakpointManager.breakpointStorageId(primaryUILocation.uiSourceCode);
+    this.sourceFileId = breakpoint._sourceFileId;
     this.lineNumber = primaryUILocation.lineNumber;
     this.condition = breakpoint.condition();
     this.enabled = breakpoint.enabled();
diff --git a/Source/WebCore/inspector/front-end/BreakpointsSidebarPane.js b/Source/WebCore/inspector/front-end/BreakpointsSidebarPane.js
index bc4bb6b02..54c0a87c3 100644
--- a/Source/WebCore/inspector/front-end/BreakpointsSidebarPane.js
+++ b/Source/WebCore/inspector/front-end/BreakpointsSidebarPane.js
@@ -52,9 +52,20 @@ WebInspector.JavaScriptBreakpointsSidebarPane = function(breakpointManager, show
 
     this._breakpointManager.addEventListener(WebInspector.BreakpointManager.Events.BreakpointAdded, this._breakpointAdded, this);
     this._breakpointManager.addEventListener(WebInspector.BreakpointManager.Events.BreakpointRemoved, this._breakpointRemoved, this);
+
+    this.emptyElement.addEventListener("contextmenu", this._emptyElementContextMenu.bind(this), true);
 }
 
 WebInspector.JavaScriptBreakpointsSidebarPane.prototype = {
+    _emptyElementContextMenu: function(event)
+    {
+        var contextMenu = new WebInspector.ContextMenu(event);
+        var breakpointActive = WebInspector.debuggerModel.breakpointsActive();
+        var breakpointActiveTitle = WebInspector.UIString(breakpointActive ? "Deactivate Breakpoints" : "Activate Breakpoints");
+        contextMenu.appendItem(breakpointActiveTitle, WebInspector.debuggerModel.setBreakpointsActive.bind(WebInspector.debuggerModel, !breakpointActive));
+        contextMenu.show();
+    },
+
     /**
      * @param {WebInspector.Event} event
      */
@@ -62,8 +73,8 @@ WebInspector.JavaScriptBreakpointsSidebarPane.prototype = {
     {
         this._breakpointRemoved(event);
 
-        var breakpoint = /** @type {WebInspector.BreakpointManager.Breakpoint} */ event.data.breakpoint;
-        var uiLocation = /** @type {WebInspector.UILocation} */ event.data.uiLocation;
+        var breakpoint = /** @type {WebInspector.BreakpointManager.Breakpoint} */ (event.data.breakpoint);
+        var uiLocation = /** @type {WebInspector.UILocation} */ (event.data.uiLocation);
         this._addBreakpoint(breakpoint, uiLocation);
     },
 
@@ -128,8 +139,8 @@ WebInspector.JavaScriptBreakpointsSidebarPane.prototype = {
      */
     _breakpointRemoved: function(event)
     {
-        var breakpoint = /** @type {WebInspector.BreakpointManager.Breakpoint} */ event.data.breakpoint;
-        var uiLocation = /** @type {WebInspector.UILocation} */ event.data.uiLocation;
+        var breakpoint = /** @type {WebInspector.BreakpointManager.Breakpoint} */ (event.data.breakpoint);
+        var uiLocation = /** @type {WebInspector.UILocation} */ (event.data.uiLocation);
         var breakpointItem = this._items.get(breakpoint);
         if (!breakpointItem)
             return;
@@ -177,13 +188,17 @@ WebInspector.JavaScriptBreakpointsSidebarPane.prototype = {
      */
     _breakpointContextMenu: function(breakpoint, event)
     {
-        var contextMenu = new WebInspector.ContextMenu();
+        var breakpoints = this._items.values();
+        var contextMenu = new WebInspector.ContextMenu(event);
         contextMenu.appendItem(WebInspector.UIString("Remove Breakpoint"), breakpoint.remove.bind(breakpoint));
-        var removeAllTitle = WebInspector.UIString(WebInspector.useLowerCaseMenuTitles() ? "Remove all breakpoints" : "Remove All Breakpoints");
-        contextMenu.appendItem(removeAllTitle, this._breakpointManager.removeAllBreakpoints.bind(this._breakpointManager));
-        
+        if (breakpoints.length > 1) {
+            var removeAllTitle = WebInspector.UIString(WebInspector.useLowerCaseMenuTitles() ? "Remove all breakpoints" : "Remove All Breakpoints");
+            contextMenu.appendItem(removeAllTitle, this._breakpointManager.removeAllBreakpoints.bind(this._breakpointManager));
+        }
+
+        contextMenu.appendSeparator();
         var breakpointActive = WebInspector.debuggerModel.breakpointsActive();
-        var breakpointActiveTitle = WebInspector.UIString(breakpointActive ? "Deactivate All Breakpoints" : "Activate All Breakpoints");
+        var breakpointActiveTitle = WebInspector.UIString(breakpointActive ? "Deactivate Breakpoints" : "Activate Breakpoints");
         contextMenu.appendItem(breakpointActiveTitle, WebInspector.debuggerModel.setBreakpointsActive.bind(WebInspector.debuggerModel, !breakpointActive));
 
         function enabledBreakpointCount(breakpoints)
@@ -195,7 +210,6 @@ WebInspector.JavaScriptBreakpointsSidebarPane.prototype = {
             }
             return count;
         }
-        var breakpoints = this._items.values();
         if (breakpoints.length > 1) {
             var enableBreakpointCount = enabledBreakpointCount(breakpoints);
             var enableTitle = WebInspector.UIString(WebInspector.useLowerCaseMenuTitles() ? "Enable all breakpoints" : "Enable All Breakpoints");
@@ -207,7 +221,7 @@ WebInspector.JavaScriptBreakpointsSidebarPane.prototype = {
             contextMenu.appendItem(disableTitle, this._breakpointManager.toggleAllBreakpoints.bind(this._breakpointManager, false), !(enableBreakpointCount > 1));
         }
 
-        contextMenu.show(event);
+        contextMenu.show();
     },
 
     _addListElement: function(element, beforeElement)
@@ -270,15 +284,26 @@ WebInspector.XHRBreakpointsSidebarPane = function()
     var addButton = document.createElement("button");
     addButton.className = "pane-title-button add";
     addButton.addEventListener("click", this._addButtonClicked.bind(this), false);
+    addButton.title = WebInspector.UIString("Add XHR breakpoint");
     this.titleElement.appendChild(addButton);
 
+    this.emptyElement.addEventListener("contextmenu", this._emptyElementContextMenu.bind(this), true);
+
     this._restoreBreakpoints();
 }
 
 WebInspector.XHRBreakpointsSidebarPane.prototype = {
+    _emptyElementContextMenu: function(event)
+    {
+        var contextMenu = new WebInspector.ContextMenu(event);
+        contextMenu.appendItem(WebInspector.UIString("Add Breakpoint"), this._addButtonClicked.bind(this));
+        contextMenu.show();
+    },
+
     _addButtonClicked: function(event)
     {
-        event.consume();
+        if (event)
+            event.consume();
 
         this.expanded = true;
 
@@ -356,14 +381,24 @@ WebInspector.XHRBreakpointsSidebarPane.prototype = {
 
     _contextMenu: function(url, event)
     {
-        var contextMenu = new WebInspector.ContextMenu();
+        var contextMenu = new WebInspector.ContextMenu(event);
         function removeBreakpoint()
         {
             this._removeBreakpoint(url);
             this._saveBreakpoints();
         }
+        function removeAllBreakpoints()
+        {
+            for (var url in this._breakpointElements)
+                this._removeBreakpoint(url);
+            this._saveBreakpoints();
+        }
+        var removeAllTitle = WebInspector.UIString(WebInspector.useLowerCaseMenuTitles() ? "Remove all breakpoints" : "Remove All Breakpoints");
+
+        contextMenu.appendItem(WebInspector.UIString("Add Breakpoint"), this._addButtonClicked.bind(this));
         contextMenu.appendItem(WebInspector.UIString("Remove Breakpoint"), removeBreakpoint.bind(this));
-        contextMenu.show(event);
+        contextMenu.appendItem(removeAllTitle, removeAllBreakpoints.bind(this));
+        contextMenu.show();
     },
 
     _checkboxClicked: function(url, event)
diff --git a/Source/WebCore/inspector/front-end/CSSNamedFlowCollectionsView.js b/Source/WebCore/inspector/front-end/CSSNamedFlowCollectionsView.js
index b2a302402..b92a066da 100644
--- a/Source/WebCore/inspector/front-end/CSSNamedFlowCollectionsView.js
+++ b/Source/WebCore/inspector/front-end/CSSNamedFlowCollectionsView.js
@@ -91,7 +91,7 @@ WebInspector.CSSNamedFlowCollectionsView.prototype = {
      */
     _documentUpdated: function(event)
     {
-        var document = /** @type {WebInspector.DOMDocument} */ event.data;
+        var document = /** @type {WebInspector.DOMDocument} */ (event.data);
         this._setDocument(document);
     },
 
@@ -219,7 +219,7 @@ WebInspector.CSSNamedFlowCollectionsView.prototype = {
         if (event.data.documentNodeId !== this._document.id)
             return;
 
-        var flow = /** @type {WebInspector.NamedFlow} */ event.data;
+        var flow = /** @type {WebInspector.NamedFlow} */ (event.data);
         this._appendNamedFlow(flow);
     },
 
@@ -244,7 +244,7 @@ WebInspector.CSSNamedFlowCollectionsView.prototype = {
         if (event.data.documentNodeId !== this._document.id)
             return;
 
-        var flow = /** @type {WebInspector.NamedFlow} */ event.data;
+        var flow = /** @type {WebInspector.NamedFlow} */ (event.data);
         this._updateNamedFlow(flow);
     },
 
@@ -298,7 +298,7 @@ WebInspector.CSSNamedFlowCollectionsView.prototype = {
      */
     _selectedNodeChanged: function(event)
     {
-        var node = /** @type {WebInspector.DOMNode} */ event.data;
+        var node = /** @type {WebInspector.DOMNode} */ (event.data);
         this._showNamedFlowForNode(node);
     },
 
diff --git a/Source/WebCore/inspector/front-end/CSSNamedFlowView.js b/Source/WebCore/inspector/front-end/CSSNamedFlowView.js
index c6a09f208..ade2643b1 100644
--- a/Source/WebCore/inspector/front-end/CSSNamedFlowView.js
+++ b/Source/WebCore/inspector/front-end/CSSNamedFlowView.js
@@ -81,7 +81,7 @@ WebInspector.CSSNamedFlowView.prototype = {
         treeOutline.wireToDomAgent();
         WebInspector.domAgent.removeEventListener(WebInspector.DOMAgent.Events.DocumentUpdated, treeOutline._elementsTreeUpdater._documentUpdated, treeOutline._elementsTreeUpdater);
 
-        return treeOutline;        
+        return treeOutline;
     },
 
     /**
diff --git a/Source/WebCore/inspector/front-end/CSSSelectorProfileView.js b/Source/WebCore/inspector/front-end/CSSSelectorProfileView.js
index e10f8dc6e..e9d71ec85 100644
--- a/Source/WebCore/inspector/front-end/CSSSelectorProfileView.js
+++ b/Source/WebCore/inspector/front-end/CSSSelectorProfileView.js
@@ -399,7 +399,7 @@ WebInspector.CSSProfileHeader.prototype = {
      */
     createView: function(profilesPanel)
     {
-        var profile = /** @type {CSSAgent.SelectorProfile} */this._protocolData;
+        var profile = /** @type {CSSAgent.SelectorProfile} */ (this._protocolData);
         return new WebInspector.CSSSelectorProfileView(profile);
     },
 
diff --git a/Source/WebCore/inspector/front-end/CSSStyleModel.js b/Source/WebCore/inspector/front-end/CSSStyleModel.js
index 669e77e1d..6a6f1c555 100644
--- a/Source/WebCore/inspector/front-end/CSSStyleModel.js
+++ b/Source/WebCore/inspector/front-end/CSSStyleModel.js
@@ -35,6 +35,8 @@
 WebInspector.CSSStyleModel = function()
 {
     this._pendingCommandsMajorState = [];
+    /** @type {Array.<WebInspector.CSSStyleModel.LiveLocation>} */
+    this._locations = [];
     this._sourceMappings = {};
     WebInspector.domAgent.addEventListener(WebInspector.DOMAgent.Events.UndoRedoRequested, this._undoRedoRequested, this);
     WebInspector.domAgent.addEventListener(WebInspector.DOMAgent.Events.UndoRedoCompleted, this._undoRedoCompleted, this);
@@ -481,6 +483,7 @@ WebInspector.CSSStyleModel.prototype = {
     setSourceMapping: function(url, sourceMapping)
     {
         this._sourceMappings[url] = sourceMapping;
+        this._updateLocations();
     },
 
     resetSourceMappings: function()
@@ -493,6 +496,28 @@ WebInspector.CSSStyleModel.prototype = {
         this._namedFlowCollections = {};
     },
 
+    _updateLocations: function()
+    {
+        for (var i = 0; i < this._locations.length; ++i)
+            this._locations[i].update();
+    },
+
+    /**
+     * @param {function(WebInspector.UILocation):(boolean|undefined)} updateDelegate
+     * @return {?WebInspector.LiveLocation}
+     */
+    createLiveLocation: function(cssRule, updateDelegate)
+    {
+        if (!cssRule._rawLocation)
+            return null;
+        var location = new WebInspector.CSSStyleModel.LiveLocation(cssRule._rawLocation, updateDelegate);
+        if (!location.uiLocation())
+            return null;
+        this._locations.push(location);
+        location.update();
+        return location;
+    },
+
     /**
      * @param {WebInspector.CSSLocation} rawLocation
      * @return {?WebInspector.UILocation}
@@ -508,6 +533,38 @@ WebInspector.CSSStyleModel.prototype = {
 
 /**
  * @constructor
+ * @extends {WebInspector.LiveLocation}
+ * @param {WebInspector.CSSLocation} rawLocation
+ * @param {function(WebInspector.UILocation):(boolean|undefined)} updateDelegate
+ */
+WebInspector.CSSStyleModel.LiveLocation = function(rawLocation, updateDelegate)
+{
+    WebInspector.LiveLocation.call(this, rawLocation, updateDelegate);
+}
+
+WebInspector.CSSStyleModel.LiveLocation.prototype = {
+    /**
+     * @return {WebInspector.UILocation}
+     */
+    uiLocation: function()
+    {
+        var cssLocation = /** @type WebInspector.CSSLocation */ (this.rawLocation());
+        return WebInspector.cssModel._rawLocationToUILocation(cssLocation);
+    },
+
+    dispose: function()
+    {
+        WebInspector.LiveLocation.prototype.dispose.call(this);
+        var locations = WebInspector.cssModel._locations;
+        if (locations)
+            locations.remove(this);
+    },
+
+    __proto__: WebInspector.LiveLocation.prototype
+}
+
+/**
+ * @constructor
  * @implements {WebInspector.RawLocation}
  * @param {string} url
  * @param {number} lineNumber
@@ -579,7 +636,7 @@ WebInspector.CSSStyleDeclaration.parsePayload = function(payload)
  */
 WebInspector.CSSStyleDeclaration.parseComputedStylePayload = function(payload)
 {
-    var newPayload = /** @type {CSSAgent.CSSStyle} */ { cssProperties: [], shorthandEntries: [], width: "", height: "" };
+    var newPayload = /** @type {CSSAgent.CSSStyle} */ ({ cssProperties: [], shorthandEntries: [], width: "", height: "" });
     if (payload)
         newPayload.cssProperties = payload;
 
@@ -785,16 +842,6 @@ WebInspector.CSSRule.prototype = {
     get isRegular()
     {
         return this.origin === "regular";
-    },
-
-    /**
-     * @return {?WebInspector.UILocation}
-     */
-    uiLocation: function()
-    {
-        if (!this._rawLocation)
-            return null;
-        return WebInspector.cssModel._rawLocationToUILocation(this._rawLocation);
     }
 }
 
diff --git a/Source/WebCore/inspector/front-end/CallStackSidebarPane.js b/Source/WebCore/inspector/front-end/CallStackSidebarPane.js
index 9c71edb69..c065c9067 100644
--- a/Source/WebCore/inspector/front-end/CallStackSidebarPane.js
+++ b/Source/WebCore/inspector/front-end/CallStackSidebarPane.js
@@ -183,7 +183,7 @@ WebInspector.CallStackSidebarPane.Placard.prototype = {
 
     _placardContextMenu: function(event)
     {
-        var contextMenu = new WebInspector.ContextMenu();
+        var contextMenu = new WebInspector.ContextMenu(event);
 
         if (WebInspector.debuggerModel.canSetScriptSource()) {
             contextMenu.appendItem(WebInspector.UIString("Restart Frame"), this._restartFrame.bind(this));
@@ -191,7 +191,7 @@ WebInspector.CallStackSidebarPane.Placard.prototype = {
         }
         contextMenu.appendItem(WebInspector.UIString("Copy Stack Trace"), this._pane._copyStackTrace.bind(this._pane));
 
-        contextMenu.show(event);
+        contextMenu.show();
     },
 
     _restartFrame: function()
diff --git a/Source/WebCore/inspector/front-end/CodeMirrorTextEditor.js b/Source/WebCore/inspector/front-end/CodeMirrorTextEditor.js
index c45784be0..7af304679 100644
--- a/Source/WebCore/inspector/front-end/CodeMirrorTextEditor.js
+++ b/Source/WebCore/inspector/front-end/CodeMirrorTextEditor.js
@@ -52,15 +52,16 @@ WebInspector.CodeMirrorTextEditor = function(url, delegate)
 
     this._codeMirror = window.CodeMirror(this.element, {
         lineNumbers: true,
-        fixedGutter: true,
-        onChange: this._onChange.bind(this),
-        onGutterClick: this._onGutterClick.bind(this)
+        gutters: ["CodeMirror-linenumbers", "breakpoints"]
     });
+    CodeMirror.on(this._codeMirror, "change", this._change.bind(this));
+    CodeMirror.on(this._codeMirror, "gutterClick", this._gutterClick.bind(this));
 
     this._lastRange = this.range();
 
     this.element.firstChild.addStyleClass("source-code");
     this.element.firstChild.addStyleClass("fill");
+    this._elementToWidget = new Map();
 }
 
 WebInspector.CodeMirrorTextEditor.prototype = {
@@ -120,7 +121,7 @@ WebInspector.CodeMirrorTextEditor.prototype = {
         this._codeMirror.scrollTo(coords.x, coords.y);
     },
 
-    _onGutterClick: function(instance, lineNumber, event)
+    _gutterClick: function(instance, lineNumber, gutter, event)
     {
         this.dispatchEventToListeners(WebInspector.TextEditor.Events.GutterClick, { lineNumber: lineNumber, event: event });
     },
@@ -132,8 +133,10 @@ WebInspector.CodeMirrorTextEditor.prototype = {
      */
     addBreakpoint: function(lineNumber, disabled, conditional)
     {
-        var className = "cm-breakpoint" + (disabled ? " cm-breakpoint-disabled" : "") + (conditional ? " cm-breakpoint-conditional" : "");
-        this._codeMirror.setMarker(lineNumber, null, className);
+        var element = document.createElement("span");
+        element.textContent = lineNumber + 1;
+        element.className = "cm-breakpoint" + (disabled ? " cm-breakpoint-disabled" : "") + (conditional ? " cm-breakpoint-conditional" : "");
+        this._codeMirror.setGutterMarker(lineNumber, "breakpoints", element);
     },
 
     /**
@@ -141,7 +144,7 @@ WebInspector.CodeMirrorTextEditor.prototype = {
      */
     removeBreakpoint: function(lineNumber)
     {
-        this._codeMirror.clearMarker(lineNumber);
+        this._codeMirror.setGutterMarker(lineNumber, "breakpoints", null);
     },
 
     /**
@@ -149,14 +152,14 @@ WebInspector.CodeMirrorTextEditor.prototype = {
      */
     setExecutionLine: function(lineNumber)
     {
-        this._executionLine = this._codeMirror.getLineHandle(lineNumber)
-        this._codeMirror.setLineClass(this._executionLine, null, "cm-execution-line");
+        this._executionLine = this._codeMirror.getLineHandle(lineNumber);
+        this._codeMirror.addLineClass(this._executionLine, null, "cm-execution-line");
     },
 
     clearExecutionLine: function()
     {
         if (this._executionLine)
-            this._codeMirror.setLineClass(this._executionLine, null, null);
+            this._codeMirror.removeLineClass(this._executionLine, null, "cm-execution-line");
         delete this._executionLine;
     },
 
@@ -166,7 +169,8 @@ WebInspector.CodeMirrorTextEditor.prototype = {
      */
     addDecoration: function(lineNumber, element)
     {
-        // TODO implement so that it doesn't hide context code
+        var widget = this._codeMirror.addLineWidget(lineNumber, element);
+        this._elementToWidget.put(element, widget);
     },
 
     /**
@@ -175,7 +179,9 @@ WebInspector.CodeMirrorTextEditor.prototype = {
      */
     removeDecoration: function(lineNumber, element)
     {
-        // TODO implement so that it doesn't hide context code
+        var widget = this._elementToWidget.remove(element);
+        if (widget)
+            this._codeMirror.removeLineWidget(widget);
     },
 
     /**
@@ -194,7 +200,9 @@ WebInspector.CodeMirrorTextEditor.prototype = {
     {
         this.clearLineHighlight();
         this._highlightedLine = this._codeMirror.getLineHandle(lineNumber);
-        this._codeMirror.setLineClass(this._highlightedLine, null, "cm-highlight");
+        if (!this._highlightedLine)
+          return;
+        this._codeMirror.addLineClass(this._highlightedLine, null, "cm-highlight");
         this._clearHighlightTimeout = setTimeout(this.clearLineHighlight.bind(this), 2000);
     },
 
@@ -204,8 +212,8 @@ WebInspector.CodeMirrorTextEditor.prototype = {
             clearTimeout(this._clearHighlightTimeout);
         delete this._clearHighlightTimeout;
 
-        if (this._highlightedLine)
-            this._codeMirror.setLineClass(this._highlightedLine, null, null);
+         if (this._highlightedLine)
+            this._codeMirror.removeLineClass(this._highlightedLine, null, "cm-highlight");
         delete this._highlightedLine;
     },
 
@@ -243,8 +251,13 @@ WebInspector.CodeMirrorTextEditor.prototype = {
         return newRange;
     },
 
-    _onChange: function()
+    _change: function()
     {
+        var widgets = this._elementToWidget.values();
+        for (var i = 0; i < widgets.length; ++i)
+            this._codeMirror.removeLineWidget(widgets[i]);
+        this._elementToWidget.clear();
+
         var newRange = this.range();
         this._delegate.onTextChanged(this._lastRange, newRange);
         this._lastRange = newRange;
diff --git a/Source/WebCore/inspector/front-end/CompilerScriptMapping.js b/Source/WebCore/inspector/front-end/CompilerScriptMapping.js
index f7a502a3c..6259e9a3f 100644
--- a/Source/WebCore/inspector/front-end/CompilerScriptMapping.js
+++ b/Source/WebCore/inspector/front-end/CompilerScriptMapping.js
@@ -32,10 +32,12 @@
  * @constructor
  * @implements {WebInspector.SourceMapping}
  * @param {WebInspector.Workspace} workspace
+ * @param {WebInspector.NetworkWorkspaceProvider} networkWorkspaceProvider
  */
-WebInspector.CompilerScriptMapping = function(workspace)
+WebInspector.CompilerScriptMapping = function(workspace, networkWorkspaceProvider)
 {
     this._workspace = workspace;
+    this._networkWorkspaceProvider = networkWorkspaceProvider;
     /** @type {Object.<string, WebInspector.SourceMapParser>} */
     this._sourceMapForSourceMapURL = {};
     /** @type {Object.<string, WebInspector.SourceMapParser>} */
@@ -56,7 +58,7 @@ WebInspector.CompilerScriptMapping.prototype = {
      */
     rawLocationToUILocation: function(rawLocation)
     {
-        var debuggerModelLocation = /** @type {WebInspector.DebuggerModel.Location} */ rawLocation;
+        var debuggerModelLocation = /** @type {WebInspector.DebuggerModel.Location} */ (rawLocation);
         var sourceMap = this._sourceMapForScriptId[debuggerModelLocation.scriptId];
         var lineNumber = debuggerModelLocation.lineNumber;
         var columnNumber = debuggerModelLocation.columnNumber || 0;
@@ -92,11 +94,10 @@ WebInspector.CompilerScriptMapping.prototype = {
     {
         // FIXME: We should only create temporary uiSourceCodes on demand and should set this as a mapping to 
         // relevant uiSourceCodes added by NetworkUISourceCodeProvider.
-        var originalUISourceCode = new WebInspector.UISourceCode(script.sourceURL, script, false);
+        var originalUISourceCode = this._workspace.addTemporaryUISourceCode(script.sourceURL, script, false);
+        originalUISourceCode.setSourceMapping(this);
         this._originalUISourceCodeForScriptId[script.scriptId] = originalUISourceCode;
         this._scriptForOriginalUISourceCode.put(originalUISourceCode, script);
-        originalUISourceCode.setSourceMapping(this);
-        this._workspace.project().addTemporaryUISourceCode(originalUISourceCode);
 
         var sourceMap = this.loadSourceMapForScript(script);
 
@@ -118,9 +119,8 @@ WebInspector.CompilerScriptMapping.prototype = {
                 contentProvider = new WebInspector.StaticContentProvider(WebInspector.resourceTypes.Script, sourceContent);
             else
                 contentProvider = new WebInspector.CompilerSourceMappingContentProvider(sourceURL);
-            var uiSourceCode = new WebInspector.UISourceCode(sourceURL, contentProvider, false);
-            this._workspace.project().addUISourceCode(uiSourceCode);
-
+            this._networkWorkspaceProvider.addFile(sourceURL, contentProvider, true);
+            var uiSourceCode = this._workspace.uiSourceCodeForURL(sourceURL);
             uiSourceCode.setSourceMapping(this);
             uiSourceCode.isContentScript = script.isContentScript;
         }
@@ -146,7 +146,7 @@ WebInspector.CompilerScriptMapping.prototype = {
             var response = InspectorFrontendHost.loadResourceSynchronously(sourceMapURL);
             if (response.slice(0, 3) === ")]}")
                 response = response.substring(response.indexOf('\n'));
-            var payload = /** @type {WebInspector.SourceMapPayload} */ JSON.parse(response);
+            var payload = /** @type {WebInspector.SourceMapPayload} */ (JSON.parse(response));
             sourceMap = new WebInspector.SourceMapParser(sourceMapURL, payload);
         } catch(e) {
             console.error(e.message);
diff --git a/Source/WebCore/inspector/front-end/ConsoleMessage.js b/Source/WebCore/inspector/front-end/ConsoleMessage.js
index 5b1263fda..074fe8600 100644
--- a/Source/WebCore/inspector/front-end/ConsoleMessage.js
+++ b/Source/WebCore/inspector/front-end/ConsoleMessage.js
@@ -76,6 +76,10 @@ WebInspector.ConsoleMessageImpl.prototype = {
                 case WebInspector.ConsoleMessage.MessageType.Trace:
                     this._messageElement = document.createTextNode("console.trace()");
                     break;
+                case WebInspector.ConsoleMessage.MessageType.Clear:
+                    this._messageElement = document.createTextNode(WebInspector.UIString("Console was cleared"));
+                    this._formattedMessage.addStyleClass("console-info");
+                    break;
                 case WebInspector.ConsoleMessage.MessageType.Assert:
                     var args = [WebInspector.UIString("Assertion failed:")];
                     if (this._parameters)
@@ -355,9 +359,18 @@ WebInspector.ConsoleMessageImpl.prototype = {
         object.pushNodeToFrontend(printNode.bind(this));
     },
 
+    /**
+     * @param {WebInspector.RemoteObject} array
+     * @return {boolean}
+     */
+    useArrayPreviewInFormatter: function(array)
+    {
+        return !!array.preview;
+    },
+
     _formatParameterAsArray: function(array, elem)
     {
-        if (array.preview) {
+        if (this.useArrayPreviewInFormatter(array)) {
             this._formatParameterAsArrayOrObject(array, "", elem, true);
             return;
         }
@@ -442,11 +455,25 @@ WebInspector.ConsoleMessageImpl.prototype = {
             return this._formatParameter(obj, force, false);
         }
 
-        function valueFormatter(obj)
+        function stringFormatter(obj)
         {
             return obj.description;
         }
 
+        function floatFormatter(obj)
+        {
+            if (typeof obj.value !== "number")
+                return "NaN";
+            return obj.value;
+        }
+
+        function integerFormatter(obj)
+        {
+            if (typeof obj.value !== "number")
+                return "NaN";
+            return Math.floor(obj.value);
+        }
+
         function styleFormatter(obj)
         {
             var buffer = document.createElement("span");
@@ -470,11 +497,11 @@ WebInspector.ConsoleMessageImpl.prototype = {
 
         // Firebug uses %o for formatting objects.
         formatters.o = parameterFormatter.bind(this, false);
-        formatters.s = valueFormatter;
-        formatters.f = valueFormatter;
+        formatters.s = stringFormatter;
+        formatters.f = floatFormatter;
         // Firebug allows both %i and %d for formatting integers.
-        formatters.i = valueFormatter;
-        formatters.d = valueFormatter;
+        formatters.i = integerFormatter;
+        formatters.d = integerFormatter;
 
         // Firebug uses %c for styling the message.
         formatters.c = styleFormatter;
diff --git a/Source/WebCore/inspector/front-end/ConsoleModel.js b/Source/WebCore/inspector/front-end/ConsoleModel.js
index fd37e35d9..0a82178a3 100644
--- a/Source/WebCore/inspector/front-end/ConsoleModel.js
+++ b/Source/WebCore/inspector/front-end/ConsoleModel.js
@@ -231,6 +231,7 @@ WebInspector.ConsoleMessage.MessageType = {
     Dir: "dir",
     DirXML: "dirxml",
     Trace: "trace",
+    Clear: "clear",
     StartGroup: "startGroup",
     StartGroupCollapsed: "startGroupCollapsed",
     EndGroup: "endGroup",
diff --git a/Source/WebCore/inspector/front-end/ConsoleView.js b/Source/WebCore/inspector/front-end/ConsoleView.js
index eeb5cf2de..9ea5bca61 100644
--- a/Source/WebCore/inspector/front-end/ConsoleView.js
+++ b/Source/WebCore/inspector/front-end/ConsoleView.js
@@ -140,7 +140,7 @@ WebInspector.ConsoleView.prototype = {
      */
     _frameAdded: function(event)
     {
-        var contextList = /** @type {WebInspector.FrameExecutionContextList} */ event.data;
+        var contextList = /** @type {WebInspector.FrameExecutionContextList} */ (event.data);
         this._addFrame(contextList);
     },
 
@@ -165,7 +165,7 @@ WebInspector.ConsoleView.prototype = {
      */
     _frameRemoved: function(event)
     {
-        var contextList = /** @type {WebInspector.FrameExecutionContextList} */ event.data;
+        var contextList = /** @type {WebInspector.FrameExecutionContextList} */ (event.data);
         this._frameSelector.removeOption(contextList._consoleOption);
         this._frameChanged();
     },
@@ -441,7 +441,7 @@ WebInspector.ConsoleView.prototype = {
         if (event.target.enclosingNodeOrSelfWithNodeName("a"))
             return;
 
-        var contextMenu = new WebInspector.ContextMenu();
+        var contextMenu = new WebInspector.ContextMenu(event);
 
         function monitoringXHRItemAction()
         {
@@ -457,7 +457,7 @@ WebInspector.ConsoleView.prototype = {
 
         contextMenu.appendSeparator();
         contextMenu.appendItem(WebInspector.UIString(WebInspector.useLowerCaseMenuTitles() ? "Clear console" : "Clear Console"), this._requestClearMessages.bind(this));
-        contextMenu.show(event);
+        contextMenu.show();
     },
 
     _monitoringXHREnabledSettingChanged: function(event)
@@ -485,9 +485,6 @@ WebInspector.ConsoleView.prototype = {
         var shortcutL = shortcut.makeDescriptor("l", WebInspector.KeyboardShortcut.Modifiers.Ctrl);
         this._shortcuts[shortcutL.key] = this._requestClearMessages.bind(this);
 
-        var shortcutM = shortcut.makeDescriptor("m", WebInspector.KeyboardShortcut.Modifiers.CtrlOrMeta | WebInspector.KeyboardShortcut.Modifiers.Shift);
-        this._shortcuts[shortcutM.key] = this._dumpMemory.bind(this);
-
         var section = WebInspector.shortcutsScreen.section(WebInspector.UIString("Console"));
         var keys = WebInspector.isMac() ? [ shortcutK.name, shortcutL.name ] : [ shortcutL.name ];
         section.addAlternateKeys(keys, WebInspector.UIString("Clear console"));
@@ -582,7 +579,7 @@ WebInspector.ConsoleView.prototype = {
             
             this._printResult(result, wasThrown, commandMessage);
         }
-        WebInspector.runtimeModel.evaluate(text, "console", useCommandLineAPI, false, false, printResult.bind(this));
+        WebInspector.runtimeModel.evaluate(text, "console", useCommandLineAPI, false, false, true, printResult.bind(this));
 
         WebInspector.userMetrics.ConsoleEvaluated.record();
     },
@@ -592,44 +589,6 @@ WebInspector.ConsoleView.prototype = {
         return [this.messagesElement];
     },
 
-    _dumpMemory: function()
-    {
-        function comparator(a, b)
-        {
-            if (a.size < b.size)
-                return 1;
-            if (a.size > b.size)
-                return -1;
-            return a.title.localeCompare(b.title);
-        }
-
-        function callback(error, groups)
-        {
-            var titles = [];
-            groups.sort(comparator);
-            for (var i = 0; i < groups.length; ++i) {
-                var suffix = groups[i].size > 0 ? " [" + groups[i].size + "]" : "";
-                titles.push(groups[i].title + suffix + (groups[i].documentURI ? " (" + groups[i].documentURI + ")" : ""));
-            }
-
-            var counter = 1;
-            var previousTitle = null;
-            for (var i = 0; i < titles.length; ++i) {
-                 var title = titles[i];
-                 if (title === previousTitle) {
-                     counter++;
-                     continue;
-                 }
-                 if (previousTitle)
-                     WebInspector.log(counter > 1 ? counter + " x " + previousTitle : previousTitle);
-                 previousTitle = title;
-                 counter = 1;
-            }
-            WebInspector.log(counter > 1 ? counter + " x " + previousTitle : previousTitle);
-        }
-        MemoryAgent.getDOMNodeCount(callback);
-    },
-
     __proto__: WebInspector.View.prototype
 }
 
@@ -704,6 +663,16 @@ WebInspector.ConsoleCommandResult = function(result, wasThrown, originatingComma
 }
 
 WebInspector.ConsoleCommandResult.prototype = {
+    /**
+     * @override
+     * @param {WebInspector.RemoteObject} array
+     * @return {boolean}
+     */
+    useArrayPreviewInFormatter: function(array)
+    {
+        return false;
+    },
+
     toMessageElement: function()
     {
         var element = WebInspector.ConsoleMessageImpl.prototype.toMessageElement.call(this);
diff --git a/Source/WebCore/inspector/front-end/ContextMenu.js b/Source/WebCore/inspector/front-end/ContextMenu.js
index deecc274e..06535b4b2 100644
--- a/Source/WebCore/inspector/front-end/ContextMenu.js
+++ b/Source/WebCore/inspector/front-end/ContextMenu.js
@@ -152,8 +152,9 @@ WebInspector.ContextSubMenuItem.prototype = {
  * @constructor
  * @extends {WebInspector.ContextSubMenuItem}
  */
-WebInspector.ContextMenu = function() {
+WebInspector.ContextMenu = function(event) {
     WebInspector.ContextSubMenuItem.call(this, this, "");
+    this._event = event;
     this._handlers = {};
     this._id = 0;
 }
@@ -164,15 +165,15 @@ WebInspector.ContextMenu.prototype = {
         return this._id++;
     },
 
-    show: function(event)
+    show: function()
     {
         var menuObject = this._buildDescriptor();
 
         if (menuObject.length) {
             WebInspector._contextMenu = this;
-            InspectorFrontendHost.showContextMenu(event, menuObject);
+            InspectorFrontendHost.showContextMenu(this._event, menuObject);
         }
-        event.consume();
+        this._event.consume();
     },
 
     _setHandler: function(id, handler)
@@ -203,7 +204,7 @@ WebInspector.ContextMenu.prototype = {
         for (var i = 0; i < WebInspector.ContextMenu._providers.length; ++i) {
             var provider = WebInspector.ContextMenu._providers[i];
             this.appendSeparator();
-            provider.appendApplicableItems(this, target);
+            provider.appendApplicableItems(this._event, this, target);
             this.appendSeparator();
         }
     },
@@ -222,7 +223,7 @@ WebInspector.ContextMenu.Provider.prototype = {
      * @param {WebInspector.ContextMenu} contextMenu
      * @param {Object} target
      */
-    appendApplicableItems: function(contextMenu, target) { }
+    appendApplicableItems: function(event, contextMenu, target) { }
 }
 
 /**
diff --git a/Source/WebCore/inspector/front-end/CookieItemsView.js b/Source/WebCore/inspector/front-end/CookieItemsView.js
index 9fa23547a..31db6f504 100644
--- a/Source/WebCore/inspector/front-end/CookieItemsView.js
+++ b/Source/WebCore/inspector/front-end/CookieItemsView.js
@@ -74,6 +74,10 @@ WebInspector.CookieItemsView.prototype = {
         WebInspector.Cookies.getCookiesAsync(this._updateWithCookies.bind(this));
     },
 
+    /**
+     * @param {Array.<WebInspector.Cookie>} allCookies
+     * @param {boolean} isAdvanced
+     */
     _updateWithCookies: function(allCookies, isAdvanced)
     {
         this._cookies = isAdvanced ? this._filterCookiesForDomain(allCookies) : allCookies;
@@ -100,6 +104,9 @@ WebInspector.CookieItemsView.prototype = {
         }
     },
 
+    /**
+     * @param {Array.<WebInspector.Cookie>} allCookies
+     */
     _filterCookiesForDomain: function(allCookies)
     {
         var cookies = [];
@@ -116,7 +123,7 @@ WebInspector.CookieItemsView.prototype = {
 
         for (var i = 0; i < allCookies.length; ++i) {
             var pushed = false;
-            var size = allCookies[i].size;
+            var size = allCookies[i].size();
             for (var j = 0; j < resourceURLsForDocumentURL.length; ++j) {
                 var resourceURL = resourceURLsForDocumentURL[j];
                 if (WebInspector.Cookies.cookieMatchesResourceURL(allCookies[i], resourceURL)) {
@@ -131,6 +138,9 @@ WebInspector.CookieItemsView.prototype = {
         return cookies;
     },
 
+    /**
+     * @param {WebInspector.Cookie} cookie
+     */
     _deleteCookie: function(cookie)
     {
         PageAgent.deleteCookie(cookie.name, this._cookieDomain);
@@ -151,9 +161,9 @@ WebInspector.CookieItemsView.prototype = {
     _contextMenu: function(event)
     {
         if (!this._cookies.length) {
-            var contextMenu = new WebInspector.ContextMenu();
+            var contextMenu = new WebInspector.ContextMenu(event);
             contextMenu.appendItem(WebInspector.UIString("Refresh"), this._update.bind(this));
-            contextMenu.show(event);
+            contextMenu.show();
         }
     },
 
@@ -180,6 +190,9 @@ WebInspector.SimpleCookiesTable = function()
 }
 
 WebInspector.SimpleCookiesTable.prototype = {
+    /**
+     * @param {Array.<WebInspector.Cookie>} cookies
+     */
     setCookies: function(cookies)
     {
         this._dataGrid.rootNode().removeChildren();
diff --git a/Source/WebCore/inspector/front-end/CookieParser.js b/Source/WebCore/inspector/front-end/CookieParser.js
index a369ac8d9..4a733a622 100644
--- a/Source/WebCore/inspector/front-end/CookieParser.js
+++ b/Source/WebCore/inspector/front-end/CookieParser.js
@@ -59,7 +59,7 @@ WebInspector.CookieParser.prototype = {
     /**
      * @return {Array.<WebInspector.Cookie>}
      */
-    get cookies()
+    cookies: function()
     {
         return this._cookies;
     },
@@ -122,7 +122,7 @@ WebInspector.CookieParser.prototype = {
     _flushCookie: function()
     {
         if (this._lastCookie)
-            this._lastCookie.size = this._originalInputLength - this._input.length - this._lastCookiePosition;
+            this._lastCookie.setSize(this._originalInputLength - this._input.length - this._lastCookiePosition);
         this._lastCookie = null;
     },
 
@@ -168,7 +168,7 @@ WebInspector.CookieParser.prototype = {
     _addCookie: function(keyValue, type)
     {
         if (this._lastCookie)
-            this._lastCookie.size = keyValue.position - this._lastCookiePosition;
+            this._lastCookie.setSize(keyValue.position - this._lastCookiePosition);
         // Mozilla bug 169091: Mozilla, IE and Chrome treat single token (w/o "=") as
         // specifying a value for a cookie with empty name.
         this._lastCookie = keyValue.value ? new WebInspector.Cookie(keyValue.key, keyValue.value, type) :
@@ -198,6 +198,9 @@ WebInspector.CookieParser.parseSetCookie = function(header)
 
 /**
  * @constructor
+ * @param {string} name
+ * @param {string} value
+ * @param {number=} type
  */
 WebInspector.Cookie = function(name, value, type)
 {
@@ -211,7 +214,7 @@ WebInspector.Cookie.prototype = {
     /**
      * @return {boolean}
      */ 
-    get httpOnly()
+    httpOnly: function()
     {
         return "httponly" in this._attributes;
     },
@@ -219,7 +222,7 @@ WebInspector.Cookie.prototype = {
     /**
      * @return {boolean}
      */ 
-    get secure()
+    secure: function()
     {
         return "secure" in this._attributes;
     },
@@ -227,17 +230,17 @@ WebInspector.Cookie.prototype = {
     /**
      * @return {boolean}
      */ 
-    get session()
+    session: function()
     {
         // RFC 2965 suggests using Discard attribute to mark session cookies, but this does not seem to be widely used.
-        // Check for absence of explicity max-age or expiry date instead.
-        return  !("expires" in this._attributes || "max-age" in this._attributes);
+        // Check for absence of explicitly max-age or expiry date instead.
+        return !("expires" in this._attributes || "max-age" in this._attributes);
     },
 
     /**
      * @return {string}
      */ 
-    get path()
+    path: function()
     {
         return this._attributes["path"];
     },
@@ -245,31 +248,79 @@ WebInspector.Cookie.prototype = {
     /**
      * @return {string}
      */ 
-    get domain()
+    port: function()
+    {
+        return this._attributes["port"];
+    },
+
+    /**
+     * @return {string}
+     */ 
+    domain: function()
     {
         return this._attributes["domain"];
     },
 
     /**
+     * @return {string}
+     */ 
+    expires: function()
+    {
+        return this._attributes["expires"];
+    },
+
+    /**
+     * @return {string}
+     */ 
+    maxAge: function()
+    {
+        return this._attributes["max-age"];
+    },
+
+    /**
+     * @return {number}
+     */ 
+    size: function()
+    {
+        return this._size;
+    },
+
+    /**
+     * @param {number} size
+     */ 
+    setSize: function(size)
+    {
+        this._size = size;
+    },
+
+    /**
      * @return {Date}
      */ 
-    expires: function(requestDate)
+    expiresDate: function(requestDate)
     {
-        return this._attributes["expires"] ? new Date(this._attributes["expires"]) :
-            (this._attributes["max-age"] ? new Date(requestDate.getTime() + 1000 * this._attributes["max-age"]) : null);
+        // RFC 6265 indicates that the max-age attribute takes precedence over the expires attribute
+        if (this.maxAge()) {
+            var targetDate = requestDate === null ? new Date() : requestDate;
+            return new Date(targetDate.getTime() + 1000 * this.maxAge());
+        }
+
+        if (this.expires())
+            return new Date(this.expires());
+
+        return null;
     },
 
     /**
      * @return {Object}
      */ 
-    get attributes()
+    attributes: function()
     {
         return this._attributes;
     },
 
     /**
      * @param {string} key 
-     * @param {string} value 
+     * @param {string=} value 
      */ 
     addAttribute: function(key, value)
     {
@@ -286,6 +337,11 @@ WebInspector.Cookies = {}
 
 WebInspector.Cookies.getCookiesAsync = function(callback)
 {
+    /**
+     * @param {?Protocol.Error} error 
+     * @param {Array.<WebInspector.Cookie>} cookies 
+     * @param {string} cookiesString 
+     */ 
     function mycallback(error, cookies, cookiesString)
     {
         if (error)
@@ -293,12 +349,16 @@ WebInspector.Cookies.getCookiesAsync = function(callback)
         if (cookiesString)
             callback(WebInspector.Cookies.buildCookiesFromString(cookiesString), false);
         else
-            callback(cookies, true);
+            callback(cookies.map(WebInspector.Cookies.buildCookieProtocolObject), true);
     }
 
     PageAgent.getCookies(mycallback);
 }
 
+/**
+ * @param {string} rawCookieString 
+ * @return {Array.<WebInspector.Cookie>} 
+ */ 
 WebInspector.Cookies.buildCookiesFromString = function(rawCookieString)
 {
     var rawCookies = rawCookieString.split(/;\s*/);
@@ -306,31 +366,61 @@ WebInspector.Cookies.buildCookiesFromString = function(rawCookieString)
 
     if (!(/^\s*$/.test(rawCookieString))) {
         for (var i = 0; i < rawCookies.length; ++i) {
-            var cookie = rawCookies[i];
-            var delimIndex = cookie.indexOf("=");
-            var name = cookie.substring(0, delimIndex);
-            var value = cookie.substring(delimIndex + 1);
+            var rawCookie = rawCookies[i];
+            var delimIndex = rawCookie.indexOf("=");
+            var name = rawCookie.substring(0, delimIndex);
+            var value = rawCookie.substring(delimIndex + 1);
             var size = name.length + value.length;
-            cookies.push({ name: name, value: value, size: size });
+            var cookie = new WebInspector.Cookie(name, value);
+            cookie.setSize(size);
+            cookies.push(cookie);
         }
     }
 
     return cookies;
 }
 
+/**
+ * @param {Object} protocolCookie 
+ * @return {WebInspector.Cookie} 
+ */ 
+WebInspector.Cookies.buildCookieProtocolObject = function(protocolCookie)
+{
+    var cookie = new WebInspector.Cookie(protocolCookie.name, protocolCookie.value);
+    cookie.addAttribute("domain", protocolCookie["domain"]);
+    cookie.addAttribute("path", protocolCookie["path"]);
+    cookie.addAttribute("port", protocolCookie["port"]);
+    if (protocolCookie["expires"])
+        cookie.addAttribute("expires", protocolCookie["expires"]);
+    if (protocolCookie["httpOnly"])
+        cookie.addAttribute("httpOnly");
+    if (protocolCookie["secure"])
+        cookie.addAttribute("secure");
+    cookie.setSize(protocolCookie["size"]);
+    return cookie;
+}
+
+/**
+ * @param {WebInspector.Cookie} cookie 
+ * @param {string} resourceURL
+ */ 
 WebInspector.Cookies.cookieMatchesResourceURL = function(cookie, resourceURL)
 {
     var url = resourceURL.asParsedURL();
-    if (!url || !WebInspector.Cookies.cookieDomainMatchesResourceDomain(cookie.domain, url.host))
+    if (!url || !WebInspector.Cookies.cookieDomainMatchesResourceDomain(cookie.domain(), url.host))
         return false;
-    return (url.path.startsWith(cookie.path)
-        && (!cookie.port || url.port == cookie.port)
-        && (!cookie.secure || url.scheme === "https"));
+    return (url.path.startsWith(cookie.path())
+        && (!cookie.port() || url.port == cookie.port())
+        && (!cookie.secure() || url.scheme === "https"));
 }
 
+/**
+ * @param {string} cookieDomain 
+ * @param {string} resourceDomain
+ */ 
 WebInspector.Cookies.cookieDomainMatchesResourceDomain = function(cookieDomain, resourceDomain)
 {
     if (cookieDomain.charAt(0) !== '.')
         return resourceDomain === cookieDomain;
-    return !!resourceDomain.match(new RegExp("^([^\\.]+\\.)?" + cookieDomain.substring(1).escapeForRegExp() + "$"), "i");
+    return !!resourceDomain.match(new RegExp("^([^\\.]+\\.)?" + cookieDomain.substring(1).escapeForRegExp() + "$", "i"));
 }
diff --git a/Source/WebCore/inspector/front-end/CookiesTable.js b/Source/WebCore/inspector/front-end/CookiesTable.js
index 706b78b8e..3e6bd5521 100644
--- a/Source/WebCore/inspector/front-end/CookiesTable.js
+++ b/Source/WebCore/inspector/front-end/CookiesTable.js
@@ -31,7 +31,7 @@
 /**
  * @constructor
  * @extends {WebInspector.View}
- * @param {function(PageAgent.Cookie)=} deleteCallback
+ * @param {function(WebInspector.Cookie)=} deleteCallback
  * @param {function()=} refreshCallback
  */
 WebInspector.CookiesTable = function(cookieDomain, expandable, deleteCallback, refreshCallback)
@@ -55,7 +55,7 @@ WebInspector.CookiesTable = function(cookieDomain, expandable, deleteCallback, r
     columns[3].title = WebInspector.UIString("Path");
     columns[3].sortable = true;
     columns[3].width = "7%";
-    columns[4].title = WebInspector.UIString("Expires");
+    columns[4].title = WebInspector.UIString("Expires / Max-Age");
     columns[4].sortable = true;
     columns[4].width = "7%";
     columns[5].title = WebInspector.UIString("Size");
@@ -92,6 +92,10 @@ WebInspector.CookiesTable.prototype = {
         this._rebuildTable();
     },
 
+    /**
+     * @param {string} folderName
+     * @param {Array.<WebInspector.Cookie>} cookies
+     */
     addCookiesFolder: function(folderName, cookies)
     {
         this._data.push({cookies: cookies, folderName: folderName});
@@ -124,7 +128,7 @@ WebInspector.CookiesTable.prototype = {
 
     /**
      * @param {WebInspector.DataGridNode} parentNode
-     * @param {Array.<PageAgent.Cookie>} cookies
+     * @param {Array.<WebInspector.Cookie>} cookies
      */
     _populateNode: function(parentNode, cookies)
     {
@@ -146,7 +150,7 @@ WebInspector.CookiesTable.prototype = {
     {
         var totalSize = 0;
         for (var i = 0; cookies && i < cookies.length; ++i)
-            totalSize += cookies[i].size;
+            totalSize += cookies[i].size();
         return totalSize;
     },
 
@@ -166,13 +170,17 @@ WebInspector.CookiesTable.prototype = {
 
         function expiresCompare(cookie1, cookie2)
         {
-            if (cookie1.session !== cookie2.session)
-                return sortDirection * (cookie1.session ? 1 : -1);
+            if (cookie1.session() !== cookie2.session())
+                return sortDirection * (cookie1.session() ? 1 : -1);
 
-            if (cookie1.session)
+            if (cookie1.session())
                 return 0;
 
-            return sortDirection * (cookie1.expires - cookie2.expires);
+            if (cookie1.maxAge() && cookie2.maxAge())
+                return sortDirection * (cookie1.maxAge() - cookie2.maxAge());
+            if (cookie1.expires() && cookie2.expires())
+                return sortDirection * (cookie1.expires() - cookie2.expires());
+            return sortDirection * (cookie1.expires() ? 1 : -1);
         }
 
         var comparator;
@@ -192,21 +200,27 @@ WebInspector.CookiesTable.prototype = {
     },
 
     /**
-     * @param {PageAgent.Cookie} cookie
+     * @param {WebInspector.Cookie} cookie
      */
     _createGridNode: function(cookie)
     {
         var data = {};
         data[0] = cookie.name;
         data[1] = cookie.value;
-        data[2] = cookie.domain || "";
-        data[3] = cookie.path || "";
-        data[4] = cookie.type === WebInspector.Cookie.Type.Request ? "" :
-            (cookie.session ? WebInspector.UIString("Session") : new Date(cookie.expires).toGMTString());
-        data[5] = cookie.size;
+        data[2] = cookie.domain() || "";
+        data[3] = cookie.path() || "";
+        if (cookie.type === WebInspector.Cookie.Type.Request)
+            data[4] = "";
+        else if (cookie.maxAge())
+            data[4] = Number.secondsToString(cookie.maxAge());
+        else if (cookie.expires())
+            data[4] = new Date(cookie.expires()).toGMTString();
+        else
+            data[4] = WebInspector.UIString("Session");
+        data[5] = cookie.size();
         const checkmark = "\u2713";
-        data[6] = (cookie.httpOnly ? checkmark : "");
-        data[7] = (cookie.secure ? checkmark : "");
+        data[6] = (cookie.httpOnly() ? checkmark : "");
+        data[7] = (cookie.secure() ? checkmark : "");
 
         var node = new WebInspector.DataGridNode(data);
         node.cookie = cookie;
diff --git a/Source/WebCore/inspector/front-end/DOMAgent.js b/Source/WebCore/inspector/front-end/DOMAgent.js
index f39a3cbb8..402064173 100644
--- a/Source/WebCore/inspector/front-end/DOMAgent.js
+++ b/Source/WebCore/inspector/front-end/DOMAgent.js
@@ -772,7 +772,7 @@ WebInspector.DOMDocument = function(domAgent, payload)
 {
     WebInspector.DOMNode.call(this, domAgent, this, false, payload);
     this.documentURL = payload.documentURL || "";
-    this.baseURL = /** @type {string} */ payload.baseURL;
+    this.baseURL = /** @type {string} */ (payload.baseURL);
     console.assert(this.baseURL);
     this.xmlVersion = payload.xmlVersion;
     this._listeners = {};
diff --git a/Source/WebCore/inspector/front-end/DOMBreakpointsSidebarPane.js b/Source/WebCore/inspector/front-end/DOMBreakpointsSidebarPane.js
index c1b355e90..e977896d4 100644
--- a/Source/WebCore/inspector/front-end/DOMBreakpointsSidebarPane.js
+++ b/Source/WebCore/inspector/front-end/DOMBreakpointsSidebarPane.js
@@ -236,7 +236,7 @@ WebInspector.DOMBreakpointsSidebarPane.prototype = {
 
     _contextMenu: function(node, type, event)
     {
-        var contextMenu = new WebInspector.ContextMenu();
+        var contextMenu = new WebInspector.ContextMenu(event);
         function removeBreakpoint()
         {
             this._removeBreakpoint(node, type);
@@ -244,7 +244,7 @@ WebInspector.DOMBreakpointsSidebarPane.prototype = {
         }
         contextMenu.appendItem(WebInspector.UIString("Remove Breakpoint"), removeBreakpoint.bind(this));
         contextMenu.appendItem(WebInspector.UIString(WebInspector.useLowerCaseMenuTitles() ? "Remove all DOM breakpoints" : "Remove All DOM Breakpoints"), this._removeAllBreakpoints.bind(this));
-        contextMenu.show(event);
+        contextMenu.show();
     },
 
     _checkboxClicked: function(node, type, event)
diff --git a/Source/WebCore/inspector/front-end/DOMExtension.js b/Source/WebCore/inspector/front-end/DOMExtension.js
index c8eea3642..483714ac3 100644
--- a/Source/WebCore/inspector/front-end/DOMExtension.js
+++ b/Source/WebCore/inspector/front-end/DOMExtension.js
@@ -166,10 +166,21 @@ Element.prototype.hasStyleClass = function(className)
     return this.classList.contains(className);
 }
 
+/**
+ * @param {number|undefined} x
+ * @param {number|undefined} y
+ */
 Element.prototype.positionAt = function(x, y)
 {
-    this.style.left = x + "px";
-    this.style.top = y + "px";
+    if (typeof x === "number")
+        this.style.setProperty("left", x + "px");
+    else
+        this.style.removeProperty("left");
+
+    if (typeof y === "number")
+        this.style.setProperty("top", y + "px");
+    else
+        this.style.removeProperty("top");
 }
 
 Element.prototype.pruneEmptyTextNodes = function()
@@ -189,6 +200,30 @@ Element.prototype.isScrolledToBottom = function()
     return this.scrollTop + this.clientHeight === this.scrollHeight;
 }
 
+/**
+ * @constructor
+ * @param {number} width
+ * @param {number} height
+ */
+function Size(width, height)
+{
+    this.width = width;
+    this.height = height;
+}
+
+/**
+ * @return {Size}
+ */
+Element.prototype.measurePreferredSize = function()
+{
+    document.body.appendChild(this);
+    this.positionAt(0, 0);
+    var result = new Size(this.offsetWidth, this.offsetHeight);
+    this.positionAt(undefined, undefined);
+    document.body.removeChild(this);
+    return result;
+}
+
 Node.prototype.enclosingNodeOrSelfWithNodeNameInArray = function(nameArray)
 {
     for (var node = this; node && node !== this.ownerDocument; node = node.parentNode)
diff --git a/Source/WebCore/inspector/front-end/DataGrid.js b/Source/WebCore/inspector/front-end/DataGrid.js
index 114d82d90..24a349752 100644
--- a/Source/WebCore/inspector/front-end/DataGrid.js
+++ b/Source/WebCore/inspector/front-end/DataGrid.js
@@ -878,7 +878,7 @@ WebInspector.DataGrid.prototype = {
 
     _contextMenuInDataTable: function(event)
     {
-        var contextMenu = new WebInspector.ContextMenu();
+        var contextMenu = new WebInspector.ContextMenu(event);
 
         var gridNode = this.dataGridNodeFromNode(event.target);
         if (this._refreshCallback && (!gridNode || gridNode !== this.creationNode))
@@ -896,7 +896,7 @@ WebInspector.DataGrid.prototype = {
                 contextMenu.appendItem(WebInspector.UIString("Delete"), this._deleteCallback.bind(this, gridNode));
         }
 
-        contextMenu.show(event);
+        contextMenu.show();
     },
 
     _clickInDataTable: function(event)
diff --git a/Source/WebCore/inspector/front-end/DebuggerModel.js b/Source/WebCore/inspector/front-end/DebuggerModel.js
index 326a9be24..d58da0edb 100644
--- a/Source/WebCore/inspector/front-end/DebuggerModel.js
+++ b/Source/WebCore/inspector/front-end/DebuggerModel.js
@@ -205,7 +205,7 @@ WebInspector.DebuggerModel.prototype = {
         function didSetBreakpoint(error, breakpointId, locations)
         {
             if (callback) {
-                var rawLocations = /** @type {Array.<WebInspector.DebuggerModel.Location>} */ locations;
+                var rawLocations = /** @type {Array.<WebInspector.DebuggerModel.Location>} */ (locations);
                 callback(error ? null : breakpointId, rawLocations);
             }
         }
@@ -229,7 +229,7 @@ WebInspector.DebuggerModel.prototype = {
         function didSetBreakpoint(error, breakpointId, actualLocation)
         {
             if (callback) {
-                var rawLocation = /** @type {WebInspector.DebuggerModel.Location} */ actualLocation;
+                var rawLocation = /** @type {WebInspector.DebuggerModel.Location} */ (actualLocation);
                 callback(error ? null : breakpointId, [rawLocation]);
             }
         }
@@ -478,9 +478,10 @@ WebInspector.DebuggerModel.prototype = {
      * @param {boolean} includeCommandLineAPI
      * @param {boolean} doNotPauseOnExceptionsAndMuteConsole
      * @param {boolean} returnByValue
+     * @param {boolean} generatePreview
      * @param {function(?WebInspector.RemoteObject, boolean, RuntimeAgent.RemoteObject=)} callback
      */
-    evaluateOnSelectedCallFrame: function(code, objectGroup, includeCommandLineAPI, doNotPauseOnExceptionsAndMuteConsole, returnByValue, callback)
+    evaluateOnSelectedCallFrame: function(code, objectGroup, includeCommandLineAPI, doNotPauseOnExceptionsAndMuteConsole, returnByValue, generatePreview, callback)
     {
         /**
          * @param {?RuntimeAgent.RemoteObject} result
@@ -497,7 +498,7 @@ WebInspector.DebuggerModel.prototype = {
                 this.dispatchEventToListeners(WebInspector.DebuggerModel.Events.ConsoleCommandEvaluatedInSelectedCallFrame);
         }
 
-        this.selectedCallFrame().evaluate(code, objectGroup, includeCommandLineAPI, doNotPauseOnExceptionsAndMuteConsole, returnByValue, didEvaluate.bind(this));
+        this.selectedCallFrame().evaluate(code, objectGroup, includeCommandLineAPI, doNotPauseOnExceptionsAndMuteConsole, returnByValue, generatePreview, didEvaluate.bind(this));
     },
 
     /**
@@ -725,7 +726,7 @@ WebInspector.DebuggerModel.CallFrame.prototype = {
      */
     get location()
     {
-        var rawLocation = /** @type {WebInspector.DebuggerModel.Location} */ this._payload.location;
+        var rawLocation = /** @type {WebInspector.DebuggerModel.Location} */ (this._payload.location);
         return rawLocation;
     },
 
@@ -735,9 +736,10 @@ WebInspector.DebuggerModel.CallFrame.prototype = {
      * @param {boolean} includeCommandLineAPI
      * @param {boolean} doNotPauseOnExceptionsAndMuteConsole
      * @param {boolean} returnByValue
+     * @param {boolean} generatePreview
      * @param {function(?RuntimeAgent.RemoteObject, boolean=)=} callback
      */
-    evaluate: function(code, objectGroup, includeCommandLineAPI, doNotPauseOnExceptionsAndMuteConsole, returnByValue, callback)
+    evaluate: function(code, objectGroup, includeCommandLineAPI, doNotPauseOnExceptionsAndMuteConsole, returnByValue, generatePreview, callback)
     {
         /**
          * @this {WebInspector.DebuggerModel.CallFrame}
@@ -754,7 +756,7 @@ WebInspector.DebuggerModel.CallFrame.prototype = {
             }
             callback(result, wasThrown);
         }
-        DebuggerAgent.evaluateOnCallFrame(this._payload.callFrameId, code, objectGroup, includeCommandLineAPI, doNotPauseOnExceptionsAndMuteConsole, returnByValue, didEvaluateOnCallFrame.bind(this));
+        DebuggerAgent.evaluateOnCallFrame(this._payload.callFrameId, code, objectGroup, includeCommandLineAPI, doNotPauseOnExceptionsAndMuteConsole, returnByValue, generatePreview, didEvaluateOnCallFrame.bind(this));
     },
 
     /**
diff --git a/Source/WebCore/inspector/front-end/DebuggerScriptMapping.js b/Source/WebCore/inspector/front-end/DebuggerScriptMapping.js
index 12ce92801..d32b2e454 100644
--- a/Source/WebCore/inspector/front-end/DebuggerScriptMapping.js
+++ b/Source/WebCore/inspector/front-end/DebuggerScriptMapping.js
@@ -30,14 +30,16 @@
 
 /**
  * @constructor
+ * @param {WebInspector.Workspace} workspace
+ * @param {WebInspector.NetworkWorkspaceProvider} networkWorkspaceProvider
  */
-WebInspector.DebuggerScriptMapping = function(workspace)
+WebInspector.DebuggerScriptMapping = function(workspace, networkWorkspaceProvider)
 {
     this._mappings = [];
   
     this._resourceMapping = new WebInspector.ResourceScriptMapping(workspace);
     this._mappings.push(this._resourceMapping);
-    this._compilerMapping = new WebInspector.CompilerScriptMapping(workspace);
+    this._compilerMapping = new WebInspector.CompilerScriptMapping(workspace, networkWorkspaceProvider);
     this._mappings.push(this._compilerMapping);
     this._snippetMapping = WebInspector.scriptSnippetModel.scriptMapping;
     this._mappings.push(this._snippetMapping);
@@ -52,7 +54,7 @@ WebInspector.DebuggerScriptMapping.prototype = {
      */
     _parsedScriptSource: function(event)
     {
-        var script = /** @type {WebInspector.Script} */ event.data;
+        var script = /** @type {WebInspector.Script} */ (event.data);
         var mapping = this._mappingForScript(script);
         mapping.addScript(script);
     },
diff --git a/Source/WebCore/inspector/front-end/DefaultTextEditor.js b/Source/WebCore/inspector/front-end/DefaultTextEditor.js
index a41dd8028..d269bc276 100644
--- a/Source/WebCore/inspector/front-end/DefaultTextEditor.js
+++ b/Source/WebCore/inspector/front-end/DefaultTextEditor.js
@@ -46,6 +46,14 @@ WebInspector.DefaultTextEditor = function(url, delegate)
 
     this.element.className = "text-editor monospace";
 
+    // Prevent middle-click pasting in the editor unless it is explicitly enabled for certain component.
+    this.element.addEventListener("mouseup", preventDefaultOnMouseUp.bind(this), false);
+    function preventDefaultOnMouseUp(event)
+    {
+        if (event.button === 1)
+            event.consume(true);
+    }
+
     this._textModel = new WebInspector.TextEditorModel();
     this._textModel.addEventListener(WebInspector.TextEditorModel.Events.TextChanged, this._textChanged, this);
     this._textModel.resetUndoStack();
@@ -63,6 +71,14 @@ WebInspector.DefaultTextEditor = function(url, delegate)
 
     this._gutterPanel.element.addEventListener("mousedown", this._onMouseDown.bind(this), true);
 
+    // Explicitly enable middle-click pasting in the editor main panel.
+    this._mainPanel.element.addEventListener("mouseup", consumeMouseUp.bind(this), false);
+    function consumeMouseUp(event)
+    {
+        if (event.button === 1)
+            event.consume(false);
+    }
+
     this.element.appendChild(this._mainPanel.element);
     this.element.appendChild(this._gutterPanel.element);
 
@@ -395,6 +411,8 @@ WebInspector.DefaultTextEditor.prototype = {
         var handleRedo = this._mainPanel.handleUndoRedo.bind(this._mainPanel, true);
         this._shortcuts[WebInspector.KeyboardShortcut.makeKey("z", modifiers.CtrlOrMeta)] = handleUndo;
         this._shortcuts[WebInspector.KeyboardShortcut.makeKey("z", modifiers.Shift | modifiers.CtrlOrMeta)] = handleRedo;
+        if (!WebInspector.isMac())
+            this._shortcuts[WebInspector.KeyboardShortcut.makeKey("y", modifiers.CtrlOrMeta)] = handleRedo;
 
         var handleTabKey = this._mainPanel.handleTabKeyPress.bind(this._mainPanel, false);
         var handleShiftTabKey = this._mainPanel.handleTabKeyPress.bind(this._mainPanel, true);
@@ -418,7 +436,7 @@ WebInspector.DefaultTextEditor.prototype = {
         var anchor = event.target.enclosingNodeOrSelfWithNodeName("a");
         if (anchor)
             return;
-        var contextMenu = new WebInspector.ContextMenu();
+        var contextMenu = new WebInspector.ContextMenu(event);
         var target = event.target.enclosingNodeOrSelfWithClass("webkit-line-number");
         if (target)
             this._delegate.populateLineGutterContextMenu(contextMenu, target.lineNumber);
@@ -426,7 +444,7 @@ WebInspector.DefaultTextEditor.prototype = {
             target = this._mainPanel._enclosingLineRowOrSelf(event.target);
             this._delegate.populateTextAreaContextMenu(contextMenu, target && target.lineNumber);
         }
-        contextMenu.show(event);
+        contextMenu.show();
     },
 
     _handleScrollChanged: function(event)
diff --git a/Source/WebCore/inspector/front-end/DirectoryContentView.js b/Source/WebCore/inspector/front-end/DirectoryContentView.js
index 144260fcb..57ae53d3e 100644
--- a/Source/WebCore/inspector/front-end/DirectoryContentView.js
+++ b/Source/WebCore/inspector/front-end/DirectoryContentView.js
@@ -84,7 +84,7 @@ WebInspector.DirectoryContentView.prototype = {
 
     _sort: function()
     {
-        var column = /** @type {string} */ this.sortColumnIdentifier;
+        var column = /** @type {string} */ (this.sortColumnIdentifier);
         this.sortNodes(WebInspector.DirectoryContentView.Node.comparator(column, this.sortOrder === "descending"), false);
     },
 
diff --git a/Source/WebCore/inspector/front-end/DockController.js b/Source/WebCore/inspector/front-end/DockController.js
index 5c48cabfe..4b9de5fd5 100644
--- a/Source/WebCore/inspector/front-end/DockController.js
+++ b/Source/WebCore/inspector/front-end/DockController.js
@@ -40,7 +40,7 @@ WebInspector.DockController = function()
     if (Preferences.showDockToRight)
         this._dockToggleButton.makeLongClickEnabled(this._createDockOptions.bind(this));
 
-    this.setDockSide(WebInspector.queryParamsObject["dockSide"]);
+    this.setDockSide(WebInspector.queryParamsObject["dockSide"] || "bottom");
 }
 
 WebInspector.DockController.State = {
@@ -63,6 +63,9 @@ WebInspector.DockController.prototype = {
      */
     setDockSide: function(dockSide)
     {
+        if (this._dockSide === dockSide)
+            return;
+
         if (this._dockSide)
             WebInspector.settings.lastDockState.set(this._dockSide);
 
diff --git a/Source/WebCore/inspector/front-end/ElementsPanel.js b/Source/WebCore/inspector/front-end/ElementsPanel.js
index b7bb2f6ac..a0e6e1a18 100644
--- a/Source/WebCore/inspector/front-end/ElementsPanel.js
+++ b/Source/WebCore/inspector/front-end/ElementsPanel.js
@@ -338,7 +338,7 @@ WebInspector.ElementsPanel.prototype = {
             WebInspector.settings.domWordWrap.set(!WebInspector.settings.domWordWrap.get());
         }
 
-        var contextMenu = new WebInspector.ContextMenu();
+        var contextMenu = new WebInspector.ContextMenu(event);
         var populated = this.treeOutline.populateContextMenu(contextMenu, event);
 
         if (WebInspector.experimentsSettings.cssRegions.isEnabled()) {
@@ -349,7 +349,7 @@ WebInspector.ElementsPanel.prototype = {
         contextMenu.appendSeparator();
         contextMenu.appendCheckboxItem(WebInspector.UIString(WebInspector.useLowerCaseMenuTitles() ? "Word wrap" : "Word Wrap"), toggleWordWrap.bind(this), WebInspector.settings.domWordWrap.get());
 
-        contextMenu.show(event);
+        contextMenu.show();
     },
 
     _showNamedFlowCollections: function()
@@ -415,7 +415,7 @@ WebInspector.ElementsPanel.prototype = {
             return;
         }
         
-        var node = /** @type {WebInspector.DOMNode} */ treeElement.representedObject;
+        var node = /** @type {WebInspector.DOMNode} */ (treeElement.representedObject);
 
         if (!node.nodeName() || node.nodeName().toLowerCase() !== "img") {
             callback();
@@ -604,7 +604,7 @@ WebInspector.ElementsPanel.prototype = {
         if (name !== "class" && name !== "id")
             return;
 
-        var node = /** @type {WebInspector.DOMNode} */ event.data.node;
+        var node = /** @type {WebInspector.DOMNode} */ (event.data.node);
         var crumbs = this.crumbsElement;
         var crumb = crumbs.firstChild;
         while (crumb) {
@@ -1117,11 +1117,11 @@ WebInspector.ElementsPanel.prototype = {
      * @param {WebInspector.ContextMenu} contextMenu
      * @param {Object} target
      */
-    appendApplicableItems: function(contextMenu, target)
+    appendApplicableItems: function(event, contextMenu, target)
     {
         if (!(target instanceof WebInspector.RemoteObject))
             return;
-        var remoteObject = /** @type {WebInspector.RemoteObject} */ target;
+        var remoteObject = /** @type {WebInspector.RemoteObject} */ (target);
         if (remoteObject.subtype !== "node")
             return;
 
diff --git a/Source/WebCore/inspector/front-end/ElementsPanelDescriptor.js b/Source/WebCore/inspector/front-end/ElementsPanelDescriptor.js
index b7ced2af3..8f71aae08 100644
--- a/Source/WebCore/inspector/front-end/ElementsPanelDescriptor.js
+++ b/Source/WebCore/inspector/front-end/ElementsPanelDescriptor.js
@@ -42,14 +42,14 @@ WebInspector.ElementsPanelDescriptor.prototype = {
      * @param {WebInspector.ContextMenu} contextMenu
      * @param {Object} target
      */
-    appendApplicableItems: function(contextMenu, target)
+    appendApplicableItems: function(event, contextMenu, target)
     {
         if (!(target instanceof WebInspector.RemoteObject))
             return;
-        var remoteObject = /** @type {WebInspector.RemoteObject} */ target;
+        var remoteObject = /** @type {WebInspector.RemoteObject} */ (target);
         if (remoteObject.subtype !== "node")
             return;
-        this.panel().appendApplicableItems(contextMenu, target);
+        this.panel().appendApplicableItems(event, contextMenu, target);
     },
 
     __proto__: WebInspector.PanelDescriptor.prototype
diff --git a/Source/WebCore/inspector/front-end/ElementsTreeOutline.js b/Source/WebCore/inspector/front-end/ElementsTreeOutline.js
index 70e3e2525..a87bc923f 100644
--- a/Source/WebCore/inspector/front-end/ElementsTreeOutline.js
+++ b/Source/WebCore/inspector/front-end/ElementsTreeOutline.js
@@ -359,6 +359,11 @@ WebInspector.ElementsTreeOutline.prototype = {
 
     _ondragstart: function(event)
     {
+        if (!window.getSelection().isCollapsed)
+            return false;
+        if (event.target.nodeName === "A")
+            return false;
+
         var treeElement = this._treeElementFromEvent(event);
         if (!treeElement)
             return false;
@@ -484,9 +489,9 @@ WebInspector.ElementsTreeOutline.prototype = {
         {
             WebInspector.domAgent.inspectElement(treeElement.representedObject.id);
         }
-        var contextMenu = new WebInspector.ContextMenu();
+        var contextMenu = new WebInspector.ContextMenu(event);
         contextMenu.appendItem(WebInspector.UIString("Reveal in Elements Panel"), focusElement.bind(this));
-        contextMenu.show(event);
+        contextMenu.show();
     },
 
     populateContextMenu: function(contextMenu, event)
@@ -1721,7 +1726,7 @@ WebInspector.ElementsTreeElement.prototype = {
      */
     _buildTagDOM: function(parentElement, tagName, isClosingTag, isDistinctTreeElement, linkify)
     {
-        var node = /** @type WebInspector.DOMNode */ this.representedObject;
+        var node = /** @type WebInspector.DOMNode */ (this.representedObject);
         var classes = [ "webkit-html-tag" ];
         if (isClosingTag && isDistinctTreeElement)
             classes.push("close");
@@ -2003,7 +2008,7 @@ WebInspector.ElementsTreeElement.prototype = {
                 object.callFunction(scrollIntoView);
         }
         
-        var node = /** @type {WebInspector.DOMNode} */ this.representedObject;
+        var node = /** @type {WebInspector.DOMNode} */ (this.representedObject);
         WebInspector.RemoteObject.resolveNode(node, "", scrollIntoViewCallback);
     },
 
@@ -2039,7 +2044,7 @@ WebInspector.ElementsTreeUpdater.prototype = {
         if (this._treeOutline._visible)
             this._updateModifiedNodesSoon();
 
-        var entry = /** @type {WebInspector.ElementsTreeUpdater.UpdateEntry} */ this._recentlyModifiedNodes.get(node);
+        var entry = /** @type {WebInspector.ElementsTreeUpdater.UpdateEntry} */ (this._recentlyModifiedNodes.get(node));
         if (!entry) {
             entry = new WebInspector.ElementsTreeUpdater.UpdateEntry(isUpdated, parentNode);
             this._recentlyModifiedNodes.put(node, entry);
diff --git a/Source/WebCore/inspector/front-end/ExtensionServer.js b/Source/WebCore/inspector/front-end/ExtensionServer.js
index 149c8b8c2..6d0558900 100644
--- a/Source/WebCore/inspector/front-end/ExtensionServer.js
+++ b/Source/WebCore/inspector/front-end/ExtensionServer.js
@@ -178,7 +178,7 @@ WebInspector.ExtensionServer.prototype = {
         }
         for (var name in message.headers)
             extensionHeaders[name] = message.headers[name];
-        var allHeaders = /** @type NetworkAgent.Headers */ {};
+        var allHeaders = /** @type NetworkAgent.Headers */ ({});
         for (var extension in this._extraHeaders) {
             var headers = this._extraHeaders[extension];
             for (name in headers) {
@@ -290,7 +290,7 @@ WebInspector.ExtensionServer.prototype = {
 
     _handleOpenURL: function(port, details)
     {
-        var url = /** @type {string} */ details.url;
+        var url = /** @type {string} */ (details.url);
         var contentProvider = WebInspector.workspace.uiSourceCodeForURL(url) || WebInspector.resourceForURL(url);
         if (!contentProvider)
             return false;
@@ -482,7 +482,7 @@ WebInspector.ExtensionServer.prototype = {
 
     _onGetResourceContent: function(message, port)
     {
-        var url = /** @type {string} */ message.url;
+        var url = /** @type {string} */ (message.url);
         var contentProvider = WebInspector.workspace.uiSourceCodeForURL(url) || WebInspector.resourceForURL(url);
         if (!contentProvider)
             return this._status.E_NOTFOUND(url);
@@ -500,7 +500,7 @@ WebInspector.ExtensionServer.prototype = {
             this._dispatchCallback(message.requestId, port, response);
         }
 
-        var url = /** @type {string} */ message.url;
+        var url = /** @type {string} */ (message.url);
         var uiSourceCode = WebInspector.workspace.uiSourceCodeForURL(url);
         if (!uiSourceCode) {
             var resource = WebInspector.resourceTreeModel.resourceForURL(url);
@@ -625,20 +625,20 @@ WebInspector.ExtensionServer.prototype = {
 
     _notifyResourceAdded: function(event)
     {
-        var uiSourceCode = /** @type {WebInspector.UISourceCode} */ event.data;
+        var uiSourceCode = /** @type {WebInspector.UISourceCode} */ (event.data);
         this._postNotification(WebInspector.extensionAPI.Events.ResourceAdded, this._makeResource(uiSourceCode));
     },
 
     _notifyUISourceCodeContentCommitted: function(event)
     {
-        var uiSourceCode = /** @type {WebInspector.UISourceCode} */ event.data.uiSourceCode;
-        var content = /** @type {string} */ event.data.content;
+        var uiSourceCode = /** @type {WebInspector.UISourceCode} */ (event.data.uiSourceCode);
+        var content = /** @type {string} */ (event.data.content);
         this._postNotification(WebInspector.extensionAPI.Events.ResourceContentCommitted, this._makeResource(uiSourceCode), content);
     },
 
     _notifyRequestFinished: function(event)
     {
-        var request = /** @type {WebInspector.NetworkRequest} */ event.data;
+        var request = /** @type {WebInspector.NetworkRequest} */ (event.data);
         this._postNotification(WebInspector.extensionAPI.Events.NetworkRequestFinished, this._requestId(request), (new WebInspector.HAREntry(request)).build());
     },
 
@@ -797,7 +797,7 @@ WebInspector.ExtensionServer.prototype = {
                 return this._status.E_NOTFOUND(securityOrigin);
             contextId = context.id;
         }
-        RuntimeAgent.evaluate(expression, "extension", exposeCommandLineAPI, true, contextId, returnByValue, callback);
+        RuntimeAgent.evaluate(expression, "extension", exposeCommandLineAPI, true, contextId, returnByValue, false, callback);
     }
 }
 
diff --git a/Source/WebCore/inspector/front-end/FileContentView.js b/Source/WebCore/inspector/front-end/FileContentView.js
index b8ccd9ad1..7b47c6df0 100644
--- a/Source/WebCore/inspector/front-end/FileContentView.js
+++ b/Source/WebCore/inspector/front-end/FileContentView.js
@@ -68,7 +68,7 @@ WebInspector.FileContentView.prototype = {
         if (this._content) {
             if (!this._content.updateMetadata(metadata))
                 return;
-            var sourceFrame = /** @type {WebInspector.SourceFrame} */ this._innerView;
+            var sourceFrame = /** @type {WebInspector.SourceFrame} */ (this._innerView);
             this._content.requestContent(sourceFrame.setContent.bind(sourceFrame));
         } else {
             this._innerView.detach();
@@ -124,7 +124,7 @@ WebInspector.FileContentView.FileContentProvider.prototype = {
      */
     requestContent: function(callback)
     {
-        var size = /** @type {number} */ this._metadata.size;
+        var size = /** @type {number} */ (this._metadata.size);
         this._file.requestFileContent(true, 0, size, this._charset || "", this._fileContentReceived.bind(this, callback));
     },
 
diff --git a/Source/WebCore/inspector/front-end/FileSystemModel.js b/Source/WebCore/inspector/front-end/FileSystemModel.js
index ca5bf7300..6b15810b4 100644
--- a/Source/WebCore/inspector/front-end/FileSystemModel.js
+++ b/Source/WebCore/inspector/front-end/FileSystemModel.js
@@ -56,7 +56,7 @@ WebInspector.FileSystemModel.prototype = {
      */
     _frameAdded: function(event)
     {
-        var frame = /** @type {WebInspector.ResourceTreeFrame} */ event.data;
+        var frame = /** @type {WebInspector.ResourceTreeFrame} */ (event.data);
         this._attachFrameRecursively(frame);
     },
 
@@ -65,7 +65,7 @@ WebInspector.FileSystemModel.prototype = {
      */
     _frameNavigated: function(event)
     {
-        var frame = /** @type {WebInspector.ResourceTreeFrame} */ event.data;
+        var frame = /** @type {WebInspector.ResourceTreeFrame} */ (event.data);
         this._attachFrameRecursively(frame);
     },
 
@@ -74,7 +74,7 @@ WebInspector.FileSystemModel.prototype = {
      */
     _frameDetached: function(event)
     {
-        var frame = /** @type {WebInspector.ResourceTreeFrame} */ event.data;
+        var frame = /** @type {WebInspector.ResourceTreeFrame} */ (event.data);
         this._detachFrameRecursively(frame);
     },
 
diff --git a/Source/WebCore/inspector/front-end/FileSystemView.js b/Source/WebCore/inspector/front-end/FileSystemView.js
index 174e3450b..14465f5e0 100644
--- a/Source/WebCore/inspector/front-end/FileSystemView.js
+++ b/Source/WebCore/inspector/front-end/FileSystemView.js
@@ -135,7 +135,7 @@ WebInspector.FileSystemView.EntryTreeElement.prototype = {
             if (this._entry.isDirectory)
                 this._view = new WebInspector.DirectoryContentView();
             else {
-                var file = /** @type {WebInspector.FileSystemModel.File} */ this._entry;
+                var file = /** @type {WebInspector.FileSystemModel.File} */ (this._entry);
                 this._view = new WebInspector.FileContentView(file);
             }
         }
@@ -211,7 +211,7 @@ WebInspector.FileSystemView.EntryTreeElement.prototype = {
     {
         if (!this._entry.isDirectory) {
             if (this._view && this._view === this._fileSystemView.visibleView) {
-                var fileContentView = /** @type {WebInspector.FileContentView} */ this._view;
+                var fileContentView = /** @type {WebInspector.FileContentView} */ (this._view);
                 fileContentView.refresh();
             }
         } else
diff --git a/Source/WebCore/inspector/front-end/HAREntry.js b/Source/WebCore/inspector/front-end/HAREntry.js
index 22e07f88e..c7a80511b 100644
--- a/Source/WebCore/inspector/front-end/HAREntry.js
+++ b/Source/WebCore/inspector/front-end/HAREntry.js
@@ -204,11 +204,11 @@ WebInspector.HAREntry.prototype = {
         return {
             name: cookie.name,
             value: cookie.value,
-            path: cookie.path,
-            domain: cookie.domain,
-            expires: cookie.expires(new Date(this._request.startTime * 1000)),
-            httpOnly: cookie.httpOnly,
-            secure: cookie.secure
+            path: cookie.path(),
+            domain: cookie.domain(),
+            expires: cookie.expiresDate(new Date(this._request.startTime * 1000)),
+            httpOnly: cookie.httpOnly(),
+            secure: cookie.secure()
         };
     },
 
diff --git a/Source/WebCore/inspector/front-end/HandlerRegistry.js b/Source/WebCore/inspector/front-end/HandlerRegistry.js
index 99d1bbfa7..6b9093113 100644
--- a/Source/WebCore/inspector/front-end/HandlerRegistry.js
+++ b/Source/WebCore/inspector/front-end/HandlerRegistry.js
@@ -94,8 +94,11 @@ WebInspector.HandlerRegistry.prototype = {
      * @param {WebInspector.ContextMenu} contextMenu
      * @param {Object} target
      */
-    appendApplicableItems: function(contextMenu, target)
+    appendApplicableItems: function(event, contextMenu, target)
     {
+        if (event.hasBeenHandledByHandlerRegistry)
+            return;
+        event.hasBeenHandledByHandlerRegistry = true;
         this._appendContentProviderItems(contextMenu, target);
         this._appendHrefItems(contextMenu, target);
     },
@@ -108,7 +111,7 @@ WebInspector.HandlerRegistry.prototype = {
     {
         if (!(target instanceof WebInspector.UISourceCode || target instanceof WebInspector.Resource || target instanceof WebInspector.NetworkRequest))
             return;
-        var contentProvider = /** @type {WebInspector.ContentProvider} */ target;
+        var contentProvider = /** @type {WebInspector.ContentProvider} */ (target);
         if (!contentProvider.contentURL())
             return;
 
@@ -140,7 +143,7 @@ WebInspector.HandlerRegistry.prototype = {
         function save(forceSaveAs)
         {
             if (contentProvider instanceof WebInspector.UISourceCode) {
-                var uiSourceCode = /** @type {WebInspector.UISourceCode} */ contentProvider;
+                var uiSourceCode = /** @type {WebInspector.UISourceCode} */ (contentProvider);
                 if (uiSourceCode.isDirty()) {
                     doSave(forceSaveAs, uiSourceCode.workingCopy());
                     uiSourceCode.commitWorkingCopy(function() { });
@@ -163,7 +166,7 @@ WebInspector.HandlerRegistry.prototype = {
     {
         if (!(target instanceof Node))
             return;
-        var targetNode = /** @type {Node} */ target;
+        var targetNode = /** @type {Node} */ (target);
 
         var anchorElement = targetNode.enclosingNodeOrSelfWithClass("webkit-html-resource-link") || targetNode.enclosingNodeOrSelfWithClass("webkit-html-external-link");
         if (!anchorElement)
diff --git a/Source/WebCore/inspector/front-end/HeapSnapshotLoader.js b/Source/WebCore/inspector/front-end/HeapSnapshotLoader.js
index 8725482a5..1a457ce24 100644
--- a/Source/WebCore/inspector/front-end/HeapSnapshotLoader.js
+++ b/Source/WebCore/inspector/front-end/HeapSnapshotLoader.js
@@ -129,7 +129,7 @@ WebInspector.HeapSnapshotLoader.prototype = {
             var closingBracketIndex = WebInspector.findBalancedCurlyBrackets(this._json);
             if (closingBracketIndex === -1)
                 return;
-            this._snapshot.snapshot = /** @type {HeapSnapshotHeader} */JSON.parse(this._json.slice(0, closingBracketIndex));
+            this._snapshot.snapshot = /** @type {HeapSnapshotHeader} */ (JSON.parse(this._json.slice(0, closingBracketIndex)));
             this._json = this._json.slice(closingBracketIndex);
             this._state = "find-nodes";
         }
diff --git a/Source/WebCore/inspector/front-end/HeapSnapshotView.js b/Source/WebCore/inspector/front-end/HeapSnapshotView.js
index ccd3630a6..6b718fcc8 100644
--- a/Source/WebCore/inspector/front-end/HeapSnapshotView.js
+++ b/Source/WebCore/inspector/front-end/HeapSnapshotView.js
@@ -216,7 +216,7 @@ WebInspector.HeapSnapshotView.prototype = {
     {
         this._currentSearchResultIndex = -1;
         this._popoverHelper.hidePopover();
-        if (this.helpPopover && this.helpPopover.visible)
+        if (this.helpPopover && this.helpPopover.isShowing())
             this.helpPopover.hide();
     },
 
@@ -368,7 +368,7 @@ WebInspector.HeapSnapshotView.prototype = {
             return;
 
         this._baseProfileUid = this._profiles()[this.baseSelectElement.selectedIndex].uid;
-        var dataGrid = /** @type {WebInspector.HeapSnapshotDiffDataGrid} */ this.dataGrid;
+        var dataGrid = /** @type {WebInspector.HeapSnapshotDiffDataGrid} */ (this.dataGrid);
         // Change set base data source only if main data source is already set.
         if (dataGrid.snapshot)
             this.baseProfile.load(dataGrid.setBaseDataSource.bind(dataGrid));
@@ -646,7 +646,7 @@ WebInspector.HeapSnapshotView.prototype = {
             this._helpPopoverContentElement = contentElement;
             this.helpPopover = new WebInspector.Popover();
         }
-        if (this.helpPopover.visible)
+        if (this.helpPopover.isShowing())
             this.helpPopover.hide();
         else
             this.helpPopover.show(this._helpPopoverContentElement, this.helpButton.element);
@@ -866,7 +866,7 @@ WebInspector.HeapProfileHeader.prototype = {
             this.sidebarElement.wait = true;
             ProfilerAgent.getProfile(this.profileType().id, this.uid);
         }
-        var loaderProxy = /** @type {WebInspector.HeapSnapshotLoaderProxy} */ this._receiver;
+        var loaderProxy = /** @type {WebInspector.HeapSnapshotLoaderProxy} */ (this._receiver);
         loaderProxy.addConsumer(callback);
     },
 
@@ -937,7 +937,7 @@ WebInspector.HeapProfileHeader.prototype = {
         if (snapshotProxy)
             this._snapshotProxy = snapshotProxy;
         this._updateSnapshotStatus();
-        var worker = /** @type {WebInspector.HeapSnapshotWorker} */ this._snapshotProxy.worker;
+        var worker = /** @type {WebInspector.HeapSnapshotWorker} */ (this._snapshotProxy.worker);
         this.isTemporary = false;
         worker.startCheckingForLongRunningCalls();
     },
diff --git a/Source/WebCore/inspector/front-end/ImageView.js b/Source/WebCore/inspector/front-end/ImageView.js
index d2c79b30b..d1c4820f9 100644
--- a/Source/WebCore/inspector/front-end/ImageView.js
+++ b/Source/WebCore/inspector/front-end/ImageView.js
@@ -126,10 +126,10 @@ WebInspector.ImageView.prototype = {
 
     _contextMenu: function(event)
     {
-        var contextMenu = new WebInspector.ContextMenu();
+        var contextMenu = new WebInspector.ContextMenu(event);
         contextMenu.appendItem(WebInspector.UIString(WebInspector.useLowerCaseMenuTitles() ? "Copy image URL" : "Copy Image URL"), this._copyImageURL.bind(this));
         contextMenu.appendItem(WebInspector.UIString(WebInspector.useLowerCaseMenuTitles() ? "Open image in new tab" : "Open Image in New Tab"), this._openInNewTab.bind(this));
-        contextMenu.show(event);
+        contextMenu.show();
     },
 
     _copyImageURL: function(event)
diff --git a/Source/WebCore/inspector/front-end/IndexedDBModel.js b/Source/WebCore/inspector/front-end/IndexedDBModel.js
index 0c4fed07e..e6440c1bd 100644
--- a/Source/WebCore/inspector/front-end/IndexedDBModel.js
+++ b/Source/WebCore/inspector/front-end/IndexedDBModel.js
@@ -198,7 +198,7 @@ WebInspector.IndexedDBModel.prototype = {
      */
     _frameNavigated: function(event)
     {
-        var resourceTreeFrame = /** @type {WebInspector.ResourceTreeFrame} */ event.data;
+        var resourceTreeFrame = /** @type {WebInspector.ResourceTreeFrame} */ (event.data);
         this._processFrameNavigated(resourceTreeFrame);
     },
 
@@ -207,7 +207,7 @@ WebInspector.IndexedDBModel.prototype = {
      */
     _frameDetached: function(event)
     {
-        var resourceTreeFrame = /** @type {WebInspector.ResourceTreeFrame} */ event.data;
+        var resourceTreeFrame = /** @type {WebInspector.ResourceTreeFrame} */ (event.data);
         this._originRemovedFromFrame(resourceTreeFrame.id);
     },
 
diff --git a/Source/WebCore/inspector/front-end/IndexedDBViews.js b/Source/WebCore/inspector/front-end/IndexedDBViews.js
index d30006a78..41e2de987 100644
--- a/Source/WebCore/inspector/front-end/IndexedDBViews.js
+++ b/Source/WebCore/inspector/front-end/IndexedDBViews.js
@@ -183,7 +183,7 @@ WebInspector.IDBDataView.prototype = {
             }
             keyColumnHeaderFragment.appendChild(document.createTextNode("]"));
         } else {
-            var keyPathString = /** @type {string} */ keyPath;
+            var keyPathString = /** @type {string} */ (keyPath);
             keyColumnHeaderFragment.appendChild(this._keyPathStringFragment(keyPathString));
         }
         keyColumnHeaderFragment.appendChild(document.createTextNode(")"));
diff --git a/Source/WebCore/inspector/front-end/InspectorFrontendHostStub.js b/Source/WebCore/inspector/front-end/InspectorFrontendHostStub.js
index e92348a88..c616c1d19 100644
--- a/Source/WebCore/inspector/front-end/InspectorFrontendHostStub.js
+++ b/Source/WebCore/inspector/front-end/InspectorFrontendHostStub.js
@@ -239,12 +239,15 @@ WebInspector.ClipboardAccessDeniedScreen.prototype = {
  * @constructor
  * @extends {WebInspector.HelpScreen}
  */
-WebInspector.RemoteDebuggingTerminatedScreen = function()
+WebInspector.RemoteDebuggingTerminatedScreen = function(reason)
 {
-    WebInspector.HelpScreen.call(this, WebInspector.UIString("Debug target terminated"));
+    WebInspector.HelpScreen.call(this, WebInspector.UIString("Detached from the target"));
     var p = this.contentElement.createChild("p");
     p.addStyleClass("help-section");
-    p.textContent = WebInspector.UIString("This remote debugging client is no longer functional. Please re-attach to the new target.");
+    p.createChild("span").textContent = "Remote debugging has been terminated with reason: ";
+    p.createChild("span", "error-message").textContent = reason;
+    p.createChild("br");
+    p.createChild("span").textContent = "Please re-attach to the new target.";
 }
 
 WebInspector.RemoteDebuggingTerminatedScreen.prototype = {
diff --git a/Source/WebCore/inspector/front-end/JavaScriptSourceFrame.js b/Source/WebCore/inspector/front-end/JavaScriptSourceFrame.js
index b6ab82182..b92824b99 100644
--- a/Source/WebCore/inspector/front-end/JavaScriptSourceFrame.js
+++ b/Source/WebCore/inspector/front-end/JavaScriptSourceFrame.js
@@ -39,7 +39,6 @@ WebInspector.JavaScriptSourceFrame = function(scriptsPanel, uiSourceCode)
     this._scriptsPanel = scriptsPanel;
     this._breakpointManager = WebInspector.breakpointManager;
     this._uiSourceCode = uiSourceCode;
-    this._scriptFile = this._uiSourceCode.scriptFile();
 
     var locations = this._breakpointManager.breakpointLocationsForUISourceCode(this._uiSourceCode);
     for (var i = 0; i < locations.length; ++i)
@@ -59,17 +58,12 @@ WebInspector.JavaScriptSourceFrame = function(scriptsPanel, uiSourceCode)
 
     this._uiSourceCode.addEventListener(WebInspector.UISourceCode.Events.FormattedChanged, this._onFormattedChanged, this);
     this._uiSourceCode.addEventListener(WebInspector.UISourceCode.Events.WorkingCopyChanged, this._onWorkingCopyChanged, this);
-    this._uiSourceCode.addEventListener(WebInspector.UISourceCode.Events.WorkingCopyCommitted, this._onWorkingCopyCommitted, this);
     this._uiSourceCode.addEventListener(WebInspector.UISourceCode.Events.ConsoleMessageAdded, this._consoleMessageAdded, this);
     this._uiSourceCode.addEventListener(WebInspector.UISourceCode.Events.ConsoleMessageRemoved, this._consoleMessageRemoved, this);
     this._uiSourceCode.addEventListener(WebInspector.UISourceCode.Events.ConsoleMessagesCleared, this._consoleMessagesCleared, this);
-
-    if (this._scriptFile) {
-        this._scriptFile.addEventListener(WebInspector.ScriptFile.Events.WillMergeToVM, this._willMergeToVM, this);
-        this._scriptFile.addEventListener(WebInspector.ScriptFile.Events.DidMergeToVM, this._didMergeToVM, this);
-        this._scriptFile.addEventListener(WebInspector.ScriptFile.Events.WillDivergeFromVM, this._willDivergeFromVM, this);
-        this._scriptFile.addEventListener(WebInspector.ScriptFile.Events.DidDivergeFromVM, this._didDivergeFromVM, this);
-    }
+    this._uiSourceCode.addEventListener(WebInspector.UISourceCode.Events.SourceMappingChanged, this._onSourceMappingChanged, this);
+    
+    this._updateScriptFile();
 }
 
 WebInspector.JavaScriptSourceFrame.prototype = {
@@ -111,7 +105,7 @@ WebInspector.JavaScriptSourceFrame.prototype = {
      */
     _onFormattedChanged: function(event)
     {
-        var content = /** @type {string} */ event.data.content;
+        var content = /** @type {string} */ (event.data.content);
         this._innerSetContent(content);
     },
 
@@ -123,27 +117,12 @@ WebInspector.JavaScriptSourceFrame.prototype = {
         this._innerSetContent(this._uiSourceCode.workingCopy());
     },
 
-    /**
-     * @param {WebInspector.Event} event
-     */
-    _onWorkingCopyCommitted: function(event)
-    {
-        this._innerSetContent(this._uiSourceCode.workingCopy());
-    },
-
     _innerSetContent: function(content)
     {
         if (this._isSettingWorkingCopy || this._isCommittingEditing)
             return;
 
-        if (this._uiSourceCode.togglingFormatter())
-            this.setContent(content, false, this._uiSourceCode.mimeType());
-        else {
-            var breakpointLocations = this._breakpointManager.breakpointLocationsForUISourceCode(this._uiSourceCode);
-            for (var i = 0; i < breakpointLocations.length; ++i)
-                breakpointLocations[i].breakpoint.remove();
-            this.setContent(content, false, this._uiSourceCode.mimeType());
-        }
+        this.setContent(content, false, this._uiSourceCode.mimeType());
     },
 
     populateLineGutterContextMenu: function(contextMenu, lineNumber)
@@ -336,7 +315,7 @@ WebInspector.JavaScriptSourceFrame.prototype = {
             return;
         }
         var selectedCallFrame = WebInspector.debuggerModel.selectedCallFrame();
-        selectedCallFrame.evaluate(this._highlightElement.textContent, objectGroupName, false, true, false, showObjectPopover.bind(this));
+        selectedCallFrame.evaluate(this._highlightElement.textContent, objectGroupName, false, true, false, false, showObjectPopover.bind(this));
     },
 
     _onHidePopover: function()
@@ -510,23 +489,23 @@ WebInspector.JavaScriptSourceFrame.prototype = {
 
     _breakpointAdded: function(event)
     {
-        var uiLocation = /** @type {WebInspector.UILocation} */ event.data.uiLocation;
+        var uiLocation = /** @type {WebInspector.UILocation} */ (event.data.uiLocation);
 
         if (uiLocation.uiSourceCode !== this._uiSourceCode)
             return;
 
-        var breakpoint = /** @type {WebInspector.BreakpointManager.Breakpoint} */ event.data.breakpoint;
+        var breakpoint = /** @type {WebInspector.BreakpointManager.Breakpoint} */ (event.data.breakpoint);
         if (this.loaded)
             this._addBreakpointDecoration(uiLocation.lineNumber, breakpoint.condition(), breakpoint.enabled(), false);
     },
 
     _breakpointRemoved: function(event)
     {
-        var uiLocation = /** @type {WebInspector.UILocation} */ event.data.uiLocation;
+        var uiLocation = /** @type {WebInspector.UILocation} */ (event.data.uiLocation);
         if (uiLocation.uiSourceCode !== this._uiSourceCode)
             return;
 
-        var breakpoint = /** @type {WebInspector.BreakpointManager.Breakpoint} */ event.data.breakpoint;
+        var breakpoint = /** @type {WebInspector.BreakpointManager.Breakpoint} */ (event.data.breakpoint);
         var remainingBreakpoint = this._breakpointManager.findBreakpoint(this._uiSourceCode, uiLocation.lineNumber);
         if (!remainingBreakpoint && this.loaded)
             this._removeBreakpointDecoration(uiLocation.lineNumber);
@@ -534,14 +513,14 @@ WebInspector.JavaScriptSourceFrame.prototype = {
 
     _consoleMessageAdded: function(event)
     {
-        var message = /** @type {WebInspector.PresentationConsoleMessage} */ event.data;
+        var message = /** @type {WebInspector.PresentationConsoleMessage} */ (event.data);
         if (this.loaded)
             this.addMessageToSource(message.lineNumber, message.originalMessage);
     },
 
     _consoleMessageRemoved: function(event)
     {
-        var message = /** @type {WebInspector.PresentationConsoleMessage} */ event.data;
+        var message = /** @type {WebInspector.PresentationConsoleMessage} */ (event.data);
         if (this.loaded)
             this.removeMessageFromSource(message.lineNumber, message.originalMessage);
     },
@@ -551,6 +530,31 @@ WebInspector.JavaScriptSourceFrame.prototype = {
         this.clearMessages();
     },
 
+    /**
+     * @param {WebInspector.Event} event
+     */
+    _onSourceMappingChanged: function(event)
+    {
+        this._updateScriptFile();
+    },
+
+    _updateScriptFile: function()
+    {
+        if (this._scriptFile) {
+            this._scriptFile.removeEventListener(WebInspector.ScriptFile.Events.WillMergeToVM, this._willMergeToVM, this);
+            this._scriptFile.removeEventListener(WebInspector.ScriptFile.Events.DidMergeToVM, this._didMergeToVM, this);
+            this._scriptFile.removeEventListener(WebInspector.ScriptFile.Events.WillDivergeFromVM, this._willDivergeFromVM, this);
+            this._scriptFile.removeEventListener(WebInspector.ScriptFile.Events.DidDivergeFromVM, this._didDivergeFromVM, this);
+        }
+        this._scriptFile = this._uiSourceCode.scriptFile();
+        if (this._scriptFile) {
+            this._scriptFile.addEventListener(WebInspector.ScriptFile.Events.WillMergeToVM, this._willMergeToVM, this);
+            this._scriptFile.addEventListener(WebInspector.ScriptFile.Events.DidMergeToVM, this._didMergeToVM, this);
+            this._scriptFile.addEventListener(WebInspector.ScriptFile.Events.WillDivergeFromVM, this._willDivergeFromVM, this);
+            this._scriptFile.addEventListener(WebInspector.ScriptFile.Events.DidDivergeFromVM, this._didDivergeFromVM, this);
+        }
+    },
+
     onTextEditorContentLoaded: function()
     {
         if (typeof this._executionLineNumber === "number")
@@ -578,7 +582,7 @@ WebInspector.JavaScriptSourceFrame.prototype = {
             return;
 
         var lineNumber = event.data.lineNumber;
-        var eventObject = /** @type {Event} */ event.data.event;
+        var eventObject = /** @type {Event} */ (event.data.event);
 
         if (eventObject.button != 0 || eventObject.altKey || eventObject.ctrlKey || eventObject.metaKey)
             return;
@@ -626,7 +630,7 @@ WebInspector.JavaScriptSourceFrame.prototype = {
      */
     _continueToLine: function(lineNumber)
     {
-        var rawLocation = /** @type {WebInspector.DebuggerModel.Location} */ this._uiSourceCode.uiLocationToRawLocation(lineNumber, 0);
+        var rawLocation = /** @type {WebInspector.DebuggerModel.Location} */ (this._uiSourceCode.uiLocationToRawLocation(lineNumber, 0));
         WebInspector.debuggerModel.continueToLocation(rawLocation);
     },
 
diff --git a/Source/WebCore/inspector/front-end/Linkifier.js b/Source/WebCore/inspector/front-end/Linkifier.js
index c668a45c6..a4b5c9117 100644
--- a/Source/WebCore/inspector/front-end/Linkifier.js
+++ b/Source/WebCore/inspector/front-end/Linkifier.js
@@ -59,6 +59,7 @@ WebInspector.Linkifier.prototype = {
      * @param {number} lineNumber
      * @param {number=} columnNumber
      * @param {string=} classes
+     * @return {Element}
      */
     linkifyLocation: function(sourceURL, lineNumber, columnNumber, classes)
     {
@@ -71,6 +72,7 @@ WebInspector.Linkifier.prototype = {
     /**
      * @param {WebInspector.DebuggerModel.Location} rawLocation
      * @param {string=} classes
+     * @return {Element}
      */
     linkifyRawLocation: function(rawLocation, classes)
     {
@@ -83,6 +85,20 @@ WebInspector.Linkifier.prototype = {
         return anchor;
     },
 
+    /**
+     * @param {WebInspector.CSSRule} rule
+     * @return {?Element}
+     */
+    linkifyCSSRuleLocation: function(rule)
+    {
+        var anchor = WebInspector.linkifyURLAsNode("", "", "", false);
+        var liveLocation = WebInspector.cssModel.createLiveLocation(rule, this._updateAnchor.bind(this, anchor));
+        if (!liveLocation)
+            return null;
+        this._liveLocations.push(liveLocation);
+        return anchor;
+    },
+
     reset: function()
     {
         for (var i = 0; i < this._liveLocations.length; ++i)
@@ -125,7 +141,36 @@ WebInspector.Linkifier.DefaultFormatter.prototype = {
         if (this._maxLength)
             text = text.trimMiddle(this._maxLength);
         anchor.textContent = text;
+
+        var titleText = uiLocation.uiSourceCode.url;
+        if (typeof uiLocation.lineNumber === "number")
+            titleText += ":" + (uiLocation.lineNumber + 1);
+        anchor.title = titleText;
     },
 
     __proto__: WebInspector.LinkifierFormatter.prototype
 }
+
+/**
+ * @constructor
+ * @extends {WebInspector.Linkifier.DefaultFormatter}
+ */
+WebInspector.Linkifier.DefaultCSSFormatter = function()
+{
+    WebInspector.Linkifier.DefaultFormatter.call(this);
+}
+
+WebInspector.Linkifier.DefaultCSSFormatter.prototype = {
+    /**
+     * @param {Element} anchor
+     * @param {WebInspector.UILocation} uiLocation
+     */
+    formatLiveAnchor: function(anchor, uiLocation)
+    {
+        WebInspector.Linkifier.DefaultFormatter.prototype.formatLiveAnchor.call(this, anchor, uiLocation);
+        anchor.classList.add("webkit-html-resource-link");
+        anchor.setAttribute("data-uncopyable", anchor.textContent);
+        anchor.textContent = "";
+    },
+    __proto__: WebInspector.Linkifier.DefaultFormatter.prototype
+}
\ No newline at end of file
diff --git a/Source/WebCore/inspector/front-end/MemoryStatistics.js b/Source/WebCore/inspector/front-end/MemoryStatistics.js
index e75cd02b3..30a152cce 100644
--- a/Source/WebCore/inspector/front-end/MemoryStatistics.js
+++ b/Source/WebCore/inspector/front-end/MemoryStatistics.js
@@ -409,7 +409,7 @@ WebInspector.MemoryStatistics.prototype = {
 
     show: function()
     {
-        var anchor = /** @type {Element|null} */ this._containerAnchor.nextSibling;
+        var anchor = /** @type {Element|null} */ (this._containerAnchor.nextSibling);
         this._memorySplitView.show(this._timelinePanel.element, anchor);
         this._updateSize();
         this._refreshDividers();
diff --git a/Source/WebCore/inspector/front-end/NativeMemorySnapshotView.js b/Source/WebCore/inspector/front-end/NativeMemorySnapshotView.js
index 1c0cb67fd..8a5cf157e 100644
--- a/Source/WebCore/inspector/front-end/NativeMemorySnapshotView.js
+++ b/Source/WebCore/inspector/front-end/NativeMemorySnapshotView.js
@@ -31,35 +31,132 @@
 /**
  * @constructor
  * @extends {WebInspector.View}
+ * @param {WebInspector.NativeMemoryProfileHeader} profile
  */
 WebInspector.NativeMemorySnapshotView = function(profile)
 {
     WebInspector.View.call(this);
     this.registerRequiredCSS("nativeMemoryProfiler.css");
-    this._profile = profile;
-    this.element.addStyleClass("memory-chart-view");
 
-    var pieChart = new WebInspector.NativeMemoryPieChart(profile._memoryBlock);
-    pieChart.element.addStyleClass("fill");
-    pieChart.show(this.element);
+    this.element.addStyleClass("native-snapshot-view");
+    this.containmentDataGrid = new WebInspector.NativeSnapshotDataGrid(profile._memoryBlock);
+    this.containmentDataGrid.show(this.element);
 }
 
 WebInspector.NativeMemorySnapshotView.prototype = {
-    dispose: function()
+    __proto__: WebInspector.View.prototype
+}
+
+/**
+ * @constructor
+ * @extends {WebInspector.DataGrid}
+ * @param {MemoryAgent.MemoryBlock} profile
+ */
+WebInspector.NativeSnapshotDataGrid = function(profile)
+{
+    var columns = {
+        object: { title: WebInspector.UIString("Object"), width: "200px", disclosure: true, sortable: false },
+        size: { title: WebInspector.UIString("Size"), sortable: false },
+    };
+    WebInspector.DataGrid.call(this, columns);
+    this.setRootNode(new WebInspector.DataGridNode(null, true));
+    var totalNode = new WebInspector.NativeSnapshotNode(profile, profile);
+    this.rootNode().appendChild(totalNode);
+    totalNode.expand();
+}
+
+WebInspector.NativeSnapshotDataGrid.prototype = {
+    __proto__: WebInspector.DataGrid.prototype
+}
+
+/**
+ * @constructor
+ * @extends {WebInspector.DataGridNode}
+ * @param {MemoryAgent.MemoryBlock} nodeData
+ * @param {MemoryAgent.MemoryBlock} profile
+ */
+WebInspector.NativeSnapshotNode = function(nodeData, profile)
+{
+    this._nodeData = nodeData;
+    this._profile = profile;
+    var viewProperties = WebInspector.MemoryBlockViewProperties._forMemoryBlock(nodeData);
+    var data = { object: viewProperties._description, size: this._nodeData.size };
+    var hasChildren = !!nodeData.children && nodeData.children.length !== 0;
+    WebInspector.DataGridNode.call(this, data, hasChildren);
+    this.addEventListener("populate", this._populate, this);
+}
+
+WebInspector.NativeSnapshotNode.prototype = {
+    /**
+     * @override
+     * @param {string} columnIdentifier
+     * @return {Element}
+     */
+    createCell: function(columnIdentifier)
     {
+        var cell = columnIdentifier === "size" ?
+            this._createSizeCell(columnIdentifier) :
+            WebInspector.DataGridNode.prototype.createCell.call(this, columnIdentifier);
+        return cell;
     },
 
-    get statusBarItems()
+    /**
+     * @param {string} columnIdentifier
+     * @return {Element}
+     */
+    _createSizeCell: function(columnIdentifier)
     {
-        return [];
+        var node = this;
+        var viewProperties = null;
+        while (!viewProperties || viewProperties._fillStyle === "inherit") {
+            viewProperties = WebInspector.MemoryBlockViewProperties._forMemoryBlock(node._nodeData);
+            node = node.parent;
+        }
+
+        var sizeKiB = this._nodeData.size / 1024;
+        var totalSize = this._profile.size;
+        var percentage = this._nodeData.size / totalSize  * 100;
+
+        var cell = document.createElement("td");
+        cell.className = columnIdentifier + "-column";
+
+        var textDiv = document.createElement("div");
+        textDiv.textContent = Number.withThousandsSeparator(sizeKiB.toFixed(0)) + "\u2009" + WebInspector.UIString("KiB");
+        textDiv.className = "size-text";
+        cell.appendChild(textDiv);
+
+        var barDiv = document.createElement("div");
+        barDiv.className = "size-bar";
+        barDiv.style.width = percentage + "%";
+        barDiv.style.backgroundColor = viewProperties._fillStyle;
+        // fillerDiv displaces percentage text out of the bar visible area if it doesn't fit.
+        var fillerDiv = document.createElement("div");
+        fillerDiv.className = "percent-text"
+        barDiv.appendChild(fillerDiv);
+        var percentDiv = document.createElement("div");
+        percentDiv.textContent = percentage.toFixed(1) + "%";
+        percentDiv.className = "percent-text"
+        barDiv.appendChild(percentDiv);
+
+        var barHolderDiv = document.createElement("div");
+        barHolderDiv.appendChild(barDiv);
+        cell.appendChild(barHolderDiv);
+
+        return cell;
     },
 
-    get profile()
-    {
-        return this._profile;
+    _populate: function() {
+        function comparator(a, b) {
+            return b.size - a.size;
+        }
+        if (this._nodeData !== this._profile)
+            this._nodeData.children.sort(comparator);
+        for (var node in this._nodeData.children) {
+            this.appendChild(new WebInspector.NativeSnapshotNode(this._nodeData.children[node], this._profile));
+        }
     },
 
-    __proto__: WebInspector.View.prototype
+    __proto__: WebInspector.DataGridNode.prototype
 }
 
 /**
@@ -215,21 +312,19 @@ WebInspector.MemoryBlockViewProperties._initialize = function()
     {
         WebInspector.MemoryBlockViewProperties._standardBlocks[name] = new WebInspector.MemoryBlockViewProperties(fillStyle, name, WebInspector.UIString(description));
     }
-    addBlock("hsl(  0,  0%, 100%)", "ProcessPrivateMemory", "Total");
+    addBlock("hsl(  0,  0%,  60%)", "ProcessPrivateMemory", "Total");
     addBlock("hsl(  0,  0%,  80%)", "OwnersTypePlaceholder", "OwnersTypePlaceholder");
     addBlock("hsl(  0,  0%,  80%)", "Other", "Other");
-    addBlock("hsl(300, 30%,  80%)", "Page", "Page's structures");
-    addBlock("hsl( 90, 60%,  80%)", "JSHeap", "JavaScript heap");
-    addBlock("hsl( 90, 80%,  80%)", "JSHeap.Used", "Used JavaScript heap");
-    addBlock("hsl( 90, 30%,  80%)", "JSExternalResources", "JavaScript external resources");
-    addBlock("hsl( 90, 40%,  80%)", "JSExternalArrays", "JavaScript external arrays");
-    addBlock("hsl( 90, 50%,  80%)", "JSExternalStrings", "JavaScript external strings");
-    addBlock("hsl(210, 60%,  80%)", "WebInspector", "Inspector data");
-    addBlock("hsl( 30, 60%,  80%)", "MemoryCache", "Memory cache resources");
-    addBlock("hsl( 40, 60%,  80%)", "GlyphCache", "Glyph cache resources");
-    addBlock("hsl( 35, 60%,  80%)", "DOMStorageCache", "DOM storage cache");
-    addBlock("hsl( 60, 60%,  80%)", "RenderTree", "Render tree");
-    addBlock("hsl( 60, 60%,  80%)", "RenderTree.Used", "Render tree used");
+    addBlock("hsl(220, 80%,  70%)", "Page", "Page structures");
+    addBlock("hsl(100, 60%,  50%)", "JSHeap", "JavaScript heap");
+    addBlock("hsl( 90, 40%,  80%)", "JSExternalResources", "JavaScript external resources");
+    addBlock("hsl( 90, 60%,  80%)", "JSExternalArrays", "JavaScript external arrays");
+    addBlock("hsl( 90, 60%,  80%)", "JSExternalStrings", "JavaScript external strings");
+    addBlock("hsl(  0, 80%,  60%)", "WebInspector", "Inspector data");
+    addBlock("hsl( 36, 90%,  50%)", "MemoryCache", "Memory cache resources");
+    addBlock("hsl( 40, 80%,  80%)", "GlyphCache", "Glyph cache resources");
+    addBlock("hsl( 35, 80%,  80%)", "DOMStorageCache", "DOM storage cache");
+    addBlock("hsl( 60, 80%,  60%)", "RenderTree", "Render tree");
 }
 
 WebInspector.MemoryBlockViewProperties._forMemoryBlock = function(memoryBlock)
@@ -238,7 +333,7 @@ WebInspector.MemoryBlockViewProperties._forMemoryBlock = function(memoryBlock)
     var result = WebInspector.MemoryBlockViewProperties._standardBlocks[memoryBlock.name];
     if (result)
         return result;
-    return new WebInspector.MemoryBlockViewProperties("rgba(20, 200, 20, 0.8)", memoryBlock.name, memoryBlock.name);
+    return new WebInspector.MemoryBlockViewProperties("inherit", memoryBlock.name, memoryBlock.name);
 }
 
 
@@ -285,7 +380,7 @@ WebInspector.NativeMemoryPieChart.prototype = {
 
         var swatchElement = this._memoryBlockList.createChild("div", "item");
         swatchElement.createChild("div", "swatch").style.backgroundColor = viewProperties._fillStyle;
-        swatchElement.createChild("span", "title").textContent = WebInspector.UIString(title);
+        swatchElement.createChild("span", "title").textContent = title;
 
         if (!memoryBlock.children || !includeChildren)
             return;
diff --git a/Source/WebCore/inspector/front-end/NavigatorView.js b/Source/WebCore/inspector/front-end/NavigatorView.js
index 97f88e8e5..c9103bba2 100644
--- a/Source/WebCore/inspector/front-end/NavigatorView.js
+++ b/Source/WebCore/inspector/front-end/NavigatorView.js
@@ -84,25 +84,25 @@ WebInspector.NavigatorView.prototype = {
 
     _uiSourceCodeTitleChanged: function(event)
     {
-        var uiSourceCode = /** @type {WebInspector.UISourceCode} */ event.target;
+        var uiSourceCode = /** @type {WebInspector.UISourceCode} */ (event.target);
         this._updateScriptTitle(uiSourceCode)
     },
 
     _uiSourceCodeWorkingCopyChanged: function(event)
     {
-        var uiSourceCode = /** @type {WebInspector.UISourceCode} */ event.target;
+        var uiSourceCode = /** @type {WebInspector.UISourceCode} */ (event.target);
         this._updateScriptTitle(uiSourceCode)
     },
 
     _uiSourceCodeWorkingCopyCommitted: function(event)
     {
-        var uiSourceCode = /** @type {WebInspector.UISourceCode} */ event.target;
+        var uiSourceCode = /** @type {WebInspector.UISourceCode} */ (event.target);
         this._updateScriptTitle(uiSourceCode)
     },
 
     _uiSourceCodeFormattedChanged: function(event)
     {
-        var uiSourceCode = /** @type {WebInspector.UISourceCode} */ event.target;
+        var uiSourceCode = /** @type {WebInspector.UISourceCode} */ (event.target);
         this._updateScriptTitle(uiSourceCode);
     },
 
@@ -329,9 +329,9 @@ WebInspector.NavigatorView.prototype = {
 
     handleContextMenu: function(event, uiSourceCode)
     {
-        var contextMenu = new WebInspector.ContextMenu();
+        var contextMenu = new WebInspector.ContextMenu(event);
         contextMenu.appendApplicableItems(uiSourceCode);
-        contextMenu.show(event);
+        contextMenu.show();
     },
 
     __proto__: WebInspector.View.prototype
@@ -613,9 +613,13 @@ WebInspector.NavigatorSourceTreeElement.prototype = {
         this._navigatorView._scriptSelected(this.uiSourceCode, false);
     },
 
-    ondblclick: function()
+    /**
+     * @param {Event} event
+     */
+    ondblclick: function(event)
     {
-        this._navigatorView._scriptSelected(this.uiSourceCode, true);
+        var middleClick = event.button === 1;
+        this._navigatorView._scriptSelected(this.uiSourceCode, !middleClick);
     },
 
     onenter: function()
diff --git a/Source/WebCore/inspector/front-end/NetworkLog.js b/Source/WebCore/inspector/front-end/NetworkLog.js
index 84ff11021..fc45856b1 100644
--- a/Source/WebCore/inspector/front-end/NetworkLog.js
+++ b/Source/WebCore/inspector/front-end/NetworkLog.js
@@ -97,7 +97,7 @@ WebInspector.NetworkLog.prototype = {
      */
     _onRequestStarted: function(event)
     {
-        var request = /** @type {WebInspector.NetworkRequest} */ event.data;
+        var request = /** @type {WebInspector.NetworkRequest} */ (event.data);
         this._requests.push(request);
         this._requestForId[request.requestId] = request;
         request.__page = this._currentPageLoad;
diff --git a/Source/WebCore/inspector/front-end/NetworkManager.js b/Source/WebCore/inspector/front-end/NetworkManager.js
index da29d8951..f0b9e5cc4 100644
--- a/Source/WebCore/inspector/front-end/NetworkManager.js
+++ b/Source/WebCore/inspector/front-end/NetworkManager.js
@@ -42,10 +42,6 @@ WebInspector.NetworkManager = function()
     NetworkAgent.enable();
 
     WebInspector.settings.cacheDisabled.addChangeListener(this._cacheDisabledSettingChanged, this);
-
-    if (WebInspector.settings.userAgent.get())
-        this._userAgentSettingChanged();
-    WebInspector.settings.userAgent.addChangeListener(this._userAgentSettingChanged, this);
 }
 
 WebInspector.NetworkManager.EventTypes = {
@@ -62,6 +58,7 @@ WebInspector.NetworkManager._MIMETypes = {
     "application/xhtml+xml":       {"document": true},
     "text/css":                    {"stylesheet": true},
     "text/xsl":                    {"stylesheet": true},
+    "image/jpg":                   {"image": true},
     "image/jpeg":                  {"image": true},
     "image/pjpeg":                 {"image": true},
     "image/png":                   {"image": true},
@@ -107,15 +104,10 @@ WebInspector.NetworkManager.prototype = {
      */
     _cacheDisabledSettingChanged: function(event)
     {
-        var enabled = /** @type {boolean} */ event.data;
+        var enabled = /** @type {boolean} */ (event.data);
         NetworkAgent.setCacheDisabled(enabled);
     },
 
-    _userAgentSettingChanged: function()
-    {
-        NetworkAgent.setUserAgentOverride(WebInspector.settings.userAgent.get());
-    },
-
     __proto__: WebInspector.Object.prototype
 }
 
diff --git a/Source/WebCore/inspector/front-end/NetworkPanel.js b/Source/WebCore/inspector/front-end/NetworkPanel.js
index 52848639c..4aa583e61 100644
--- a/Source/WebCore/inspector/front-end/NetworkPanel.js
+++ b/Source/WebCore/inspector/front-end/NetworkPanel.js
@@ -795,7 +795,7 @@ WebInspector.NetworkLogView.prototype = {
      */
     _onRequestUpdated: function(event)
     {
-        var request = /** @type {WebInspector.NetworkRequest} */ event.data;
+        var request = /** @type {WebInspector.NetworkRequest} */ (event.data);
         this._refreshRequest(request);
     },
 
@@ -820,7 +820,7 @@ WebInspector.NetworkLogView.prototype = {
         if (this._preserveLogToggle.toggled)
             return;
 
-        var frame = /** @type {WebInspector.ResourceTreeFrame} */ event.data;
+        var frame = /** @type {WebInspector.ResourceTreeFrame} */ (event.data);
         var loaderId = frame.loaderId;
 
         // Preserve provisional load requests.
@@ -934,7 +934,7 @@ WebInspector.NetworkLogView.prototype = {
 
     _contextMenu: function(event)
     {
-        var contextMenu = new WebInspector.ContextMenu();
+        var contextMenu = new WebInspector.ContextMenu(event);
         var gridNode = this._dataGrid.dataGridNodeFromNode(event.target);
         var request = gridNode && gridNode._request;
 
@@ -968,7 +968,7 @@ WebInspector.NetworkLogView.prototype = {
             contextMenu.appendSeparator();
         }
 
-        contextMenu.show(event);
+        contextMenu.show();
     },
     
     _replayXHR: function(requestId)
@@ -1070,7 +1070,7 @@ WebInspector.NetworkLogView.prototype = {
         if (!this._searchRegExp)
             return -1;
 
-        if ((!request.displayName || !request.displayName.match(this._searchRegExp)) && !request.folder.match(this._searchRegExp))
+        if (!request.name().match(this._searchRegExp) && !request.path().match(this._searchRegExp))
             return -1;
 
         if (request.requestId in this._matchedRequestsMap)
@@ -1136,8 +1136,8 @@ WebInspector.NetworkLogView.prototype = {
             var request = requests[i];
             var node = this._requestGridNode(request);
             if (node) {
-                var nameMatched = request.displayName && request.displayName.match(regExp);
-                var pathMatched = request.parsedURL.path && request.folder.match(regExp);
+                var nameMatched = request.name().match(regExp);
+                var pathMatched = request.path().match(regExp);
                 if (!nameMatched && pathMatched && !this._largerRequestsButton.toggled)
                     this._toggleLargerRequests();
                 var highlightedSubstringChanges = node._highlightMatchedSubstring(regExp);
@@ -1202,8 +1202,8 @@ WebInspector.NetworkLogView.prototype = {
         for (var i = 0; i < this._dataGrid.rootNode().children.length; ++i) {
             var node = this._dataGrid.rootNode().children[i];
             node.element.removeStyleClass("filtered-out");
-            var nameMatched = node._request.displayName && node._request.displayName.match(filterRegExp);
-            var pathMatched = node._request.parsedURL.path && node._request.folder.match(filterRegExp);
+            var nameMatched = node._request.name().match(filterRegExp);
+            var pathMatched = node._request.path().match(filterRegExp);
             if (!nameMatched && !pathMatched) {
                 node.element.addStyleClass("filtered-out");
                 this._filteredOutRequests.put(this._requests[i], true);
@@ -1508,7 +1508,7 @@ WebInspector.NetworkPanel.prototype = {
      * @param {WebInspector.ContextMenu} contextMenu
      * @param {Object} target
      */
-    appendApplicableItems: function(contextMenu, target)
+    appendApplicableItems: function(event, contextMenu, target)
     {
         if (!(target instanceof WebInspector.NetworkRequest))
             return;
@@ -1518,7 +1518,7 @@ WebInspector.NetworkPanel.prototype = {
         function reveal()
         {
             WebInspector.inspectorView.setCurrentPanel(this);
-            this.revealAndHighlightRequest(/** @type {WebInspector.NetworkRequest} */ target);
+            this.revealAndHighlightRequest(/** @type {WebInspector.NetworkRequest} */ (target));
         }
         contextMenu.appendItem(WebInspector.UIString(WebInspector.useLowerCaseMenuTitles() ? "Reveal in network panel" : "Reveal in Network Panel"), reveal.bind(this));
     },
@@ -1929,25 +1929,11 @@ WebInspector.NetworkDataGridNode.prototype = {
             iconElement.className = "icon";
         }
         this._nameCell.appendChild(iconElement);
-        this._nameCell.appendChild(document.createTextNode(this._fileName()));
-
-        var subtitle = this._request.parsedURL.host === WebInspector.inspectedPageDomain ? "" : this._request.parsedURL.host;
-
-        if (this._request.parsedURL.path)
-            subtitle += this._request.folder;
-
-        this._appendSubtitle(this._nameCell, subtitle);
+        this._nameCell.appendChild(document.createTextNode(this._request.name()));
+        this._appendSubtitle(this._nameCell, this._request.path());
         this._nameCell.title = this._request.url;
     },
 
-    _fileName: function()
-    {
-        var fileName = this._request.displayName;
-        if (this._request.queryString())
-            fileName += "?" + this._request.queryString();
-        return fileName;
-    },
-
     _refreshStatusCell: function()
     {
         this._statusCell.removeChildren();
@@ -2173,8 +2159,8 @@ WebInspector.NetworkDataGridNode.prototype = {
 
 WebInspector.NetworkDataGridNode.NameComparator = function(a, b)
 {
-    var aFileName = a._request.displayName + (a._request.queryString() ? a._request.queryString() : "");
-    var bFileName = b._request.displayName + (b._request.queryString() ? b._request.queryString() : "");
+    var aFileName = a._request.name();
+    var bFileName = b._request.name();
     if (aFileName > bFileName)
         return 1;
     if (bFileName > aFileName)
diff --git a/Source/WebCore/inspector/front-end/NetworkPanelDescriptor.js b/Source/WebCore/inspector/front-end/NetworkPanelDescriptor.js
index 1621d77d0..a56758305 100644
--- a/Source/WebCore/inspector/front-end/NetworkPanelDescriptor.js
+++ b/Source/WebCore/inspector/front-end/NetworkPanelDescriptor.js
@@ -43,11 +43,11 @@ WebInspector.NetworkPanelDescriptor.prototype = {
      * @param {WebInspector.ContextMenu} contextMenu
      * @param {Object} target
      */
-    appendApplicableItems: function(contextMenu, target)
+    appendApplicableItems: function(event, contextMenu, target)
     {
         if (!(target instanceof WebInspector.NetworkRequest))
             return;
-        this.panel().appendApplicableItems(contextMenu, target);
+        this.panel().appendApplicableItems(event, contextMenu, target);
     },
 
     __proto__: WebInspector.PanelDescriptor.prototype
diff --git a/Source/WebCore/inspector/front-end/NetworkRequest.js b/Source/WebCore/inspector/front-end/NetworkRequest.js
index 961c55e23..120660c16 100644
--- a/Source/WebCore/inspector/front-end/NetworkRequest.js
+++ b/Source/WebCore/inspector/front-end/NetworkRequest.js
@@ -97,6 +97,8 @@ WebInspector.NetworkRequest.prototype = {
         this._url = x;
         this._parsedURL = new WebInspector.ParsedURL(x);
         delete this._parsedQueryParameters;
+        delete this._name;
+        delete this._path;
     },
 
     /**
@@ -356,6 +358,45 @@ WebInspector.NetworkRequest.prototype = {
         return this._parsedURL.displayName;
     },
 
+    name: function()
+    {
+        if (this._name)
+            return this._name;
+        this._parseNameAndPathFromURL();
+        return this._name;
+    },
+
+    path: function()
+    {
+        if (this._path)
+            return this._path;
+        this._parseNameAndPathFromURL();
+        return this._path;
+    },
+
+    _parseNameAndPathFromURL: function()
+    {
+        if (this._parsedURL.isDataURL()) {
+            this._name = this._parsedURL.dataURLDisplayName();
+            this._path = "";
+        } else if (this._parsedURL.isAboutBlank()) {
+            this._name = this._parsedURL.url;
+            this._path = "";
+        } else {
+            this._path = this._parsedURL.host + this._parsedURL.folderPathComponents;
+            this._path = this._path.trimURL(WebInspector.inspectedPageDomain ? WebInspector.inspectedPageDomain : "");
+            if (this._parsedURL.lastPathComponent || this._parsedURL.queryParams)
+                this._name = this._parsedURL.lastPathComponent + (this._parsedURL.queryParams ? "?" + this._parsedURL.queryParams : "");
+            else if (this._parsedURL.folderPathComponents) {
+                this._name = this._parsedURL.folderPathComponents.substring(this._parsedURL.folderPathComponents.lastIndexOf("/") + 1) + "/";
+                this._path = this._path.substring(0, this._path.lastIndexOf("/"));
+            } else {
+                this._name = this._parsedURL.host;
+                this._path = "";
+            }
+        }
+    },
+
     /**
      * @return {string}
      */
diff --git a/Source/WebCore/inspector/front-end/NetworkUISourceCodeProvider.js b/Source/WebCore/inspector/front-end/NetworkUISourceCodeProvider.js
index ec18dcf32..10fa86c96 100644
--- a/Source/WebCore/inspector/front-end/NetworkUISourceCodeProvider.js
+++ b/Source/WebCore/inspector/front-end/NetworkUISourceCodeProvider.js
@@ -31,10 +31,12 @@
 /**
  * @constructor
  * @param {WebInspector.Workspace} workspace
+ * @param {WebInspector.NetworkWorkspaceProvider} networkWorkspaceProvider
  */
-WebInspector.NetworkUISourceCodeProvider = function(workspace)
+WebInspector.NetworkUISourceCodeProvider = function(workspace, networkWorkspaceProvider)
 {
     this._workspace = workspace;
+    this._networkWorkspaceProvider = networkWorkspaceProvider;
     WebInspector.resourceTreeModel.addEventListener(WebInspector.ResourceTreeModel.EventTypes.ResourceAdded, this._resourceAdded, this);
     this._workspace.addEventListener(WebInspector.Workspace.Events.ProjectWillReset, this._projectWillReset, this);
     this._workspace.addEventListener(WebInspector.Workspace.Events.ProjectDidReset, this._projectDidReset, this);
@@ -65,7 +67,7 @@ WebInspector.NetworkUISourceCodeProvider.prototype = {
      */
     _parsedScriptSource: function(event)
     {
-        var script = /** @type {WebInspector.Script} */ event.data;
+        var script = /** @type {WebInspector.Script} */ (event.data);
         if (!script.sourceURL || script.isInlineScript())
             return;
         var isDynamicAnonymousScript;
@@ -83,7 +85,7 @@ WebInspector.NetworkUISourceCodeProvider.prototype = {
             if (!parsedURL.host)
                 return;
         }
-        this._addUISourceCode(script.sourceURL, script);
+        this._addFile(script.sourceURL, script, script.isContentScript);
     },
 
     /**
@@ -91,14 +93,16 @@ WebInspector.NetworkUISourceCodeProvider.prototype = {
      */
     _resourceAdded: function(event)
     {
-        var resource = /** @type {WebInspector.Resource} */ event.data;
-        this._addUISourceCode(resource.url, resource);
+        var resource = /** @type {WebInspector.Resource} */ (event.data);
+        this._addFile(resource.url, resource);
     },
 
     /**
+     * @param {string} url
      * @param {WebInspector.ContentProvider} contentProvider
+     * @param {boolean=} isContentScript
      */
-    _addUISourceCode: function(url, contentProvider)
+    _addFile: function(url, contentProvider, isContentScript)
     {
         var type = contentProvider.contentType();
         if (type !== WebInspector.resourceTypes.Stylesheet && type !== WebInspector.resourceTypes.Document && type !== WebInspector.resourceTypes.Script)
@@ -107,8 +111,7 @@ WebInspector.NetworkUISourceCodeProvider.prototype = {
             return;
         this._processedURLs[url] = true;
         var isEditable = type !== WebInspector.resourceTypes.Document;
-        var uiSourceCode = new WebInspector.UISourceCode(url, contentProvider, isEditable);
-        this._workspace.project().addUISourceCode(uiSourceCode);
+        this._networkWorkspaceProvider.addFile(url, contentProvider, isEditable, isContentScript);
     },
 
     _projectWillReset: function()
diff --git a/Source/WebCore/inspector/front-end/NetworkWorkspaceProvider.js b/Source/WebCore/inspector/front-end/NetworkWorkspaceProvider.js
new file mode 100644
index 000000000..66812adff
--- /dev/null
+++ b/Source/WebCore/inspector/front-end/NetworkWorkspaceProvider.js
@@ -0,0 +1,109 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+/**
+ * @constructor
+ * @implements {WebInspector.WorkspaceProvider}
+ * @extends {WebInspector.Object}
+ */
+WebInspector.NetworkWorkspaceProvider = function()
+{
+    /** @type {Object.<string, WebInspector.ContentProvider>} */
+    this._contentProviders = {};
+}
+
+WebInspector.NetworkWorkspaceProvider.prototype = {
+    /**
+     * @param {string} path
+     * @param {function(?string,boolean,string)} callback
+     */
+    requestFileContent: function(path, callback)
+    {
+        var contentProvider = this._contentProviders[path];
+        contentProvider.requestContent(callback);
+    },
+
+    /**
+     * @param {string} path
+     * @param {string} newContent
+     * @param {function(?string)} callback
+     */
+    setFileContent: function(path, newContent, callback)
+    {
+        callback(null);
+    },
+
+    /**
+     * @param {string} query
+     * @param {boolean} caseSensitive
+     * @param {boolean} isRegex
+     * @param {function(Array.<WebInspector.ContentProvider.SearchMatch>)} callback
+     */
+    searchInFileContent: function(path, query, caseSensitive, isRegex, callback)
+    {
+        var contentProvider = this._contentProviders[path];
+        contentProvider.searchInContent(query, caseSensitive, isRegex, callback);
+    },
+
+    /**
+     * @param {string} path
+     * @param {WebInspector.ContentProvider} contentProvider
+     * @param {boolean} isEditable
+     * @param {boolean=} isContentScript
+     * @param {boolean=} isSnippet
+     */
+    addFile: function(path, contentProvider, isEditable, isContentScript, isSnippet)
+    {
+        var fileDescriptor = new WebInspector.FileDescriptor(path, contentProvider.contentType(), isEditable, isContentScript, isSnippet);
+        this._contentProviders[path] = contentProvider;
+        this.dispatchEventToListeners(WebInspector.WorkspaceProvider.Events.FileAdded, fileDescriptor);
+    },
+
+    /**
+     * @param {string} path
+     */
+    removeFile: function(path)
+    {
+        delete this._contentProviders[path];
+        this.dispatchEventToListeners(WebInspector.WorkspaceProvider.Events.FileRemoved, path);
+    },
+
+    reset: function()
+    {
+        this._contentProviders = {};
+    },
+    
+    __proto__: WebInspector.Object.prototype
+}
+
+/**
+ * @type {?WebInspector.NetworkWorkspaceProvider}
+ */
+WebInspector.networkWorkspaceProvider = null;
diff --git a/Source/WebCore/inspector/front-end/ObjectPopoverHelper.js b/Source/WebCore/inspector/front-end/ObjectPopoverHelper.js
index 380f4db8f..b0bd431a6 100644
--- a/Source/WebCore/inspector/front-end/ObjectPopoverHelper.js
+++ b/Source/WebCore/inspector/front-end/ObjectPopoverHelper.js
@@ -90,7 +90,7 @@ WebInspector.ObjectPopoverHelper.prototype = {
                         functionName.textContent = response.name || response.inferredName || response.displayName || WebInspector.UIString("(anonymous function)");
 
                         this._linkifier = new WebInspector.Linkifier();
-                        var rawLocation = /** @type {WebInspector.DebuggerModel.Location} */ response.location;
+                        var rawLocation = /** @type {WebInspector.DebuggerModel.Location} */ (response.location);
                         var link = this._linkifier.linkifyRawLocation(rawLocation, "function-location-link");
                         if (link)
                             title.appendChild(link);
diff --git a/Source/WebCore/inspector/front-end/ObjectPropertiesSection.js b/Source/WebCore/inspector/front-end/ObjectPropertiesSection.js
index b64a00be9..12106c4fb 100644
--- a/Source/WebCore/inspector/front-end/ObjectPropertiesSection.js
+++ b/Source/WebCore/inspector/front-end/ObjectPropertiesSection.js
@@ -58,9 +58,9 @@ WebInspector.ObjectPropertiesSection.prototype = {
 
     _contextMenuEventFired: function(event)
     {
-        var contextMenu = new WebInspector.ContextMenu();
+        var contextMenu = new WebInspector.ContextMenu(event);
         contextMenu.appendApplicableItems(this.object);
-        contextMenu.show(event);
+        contextMenu.show();
     },
 
     onpopulate: function()
@@ -253,10 +253,10 @@ WebInspector.ObjectPropertyTreeElement.prototype = {
 
     _contextMenuFired: function(value, event)
     {
-        var contextMenu = new WebInspector.ContextMenu();
+        var contextMenu = new WebInspector.ContextMenu(event);
         this.populateContextMenu(contextMenu);
         contextMenu.appendApplicableItems(value);
-        contextMenu.show(event);
+        contextMenu.show();
     },
 
     /**
@@ -319,6 +319,14 @@ WebInspector.ObjectPropertyTreeElement.prototype = {
         proxyElement.addEventListener("keydown", this._promptKeyDown.bind(this, context), false);
     },
 
+    /**
+     * @return {boolean}
+     */
+    isEditing: function()
+    {
+        return !!this._prompt;
+    },
+
     editingEnded: function(context)
     {
         this._prompt.detach();
@@ -595,8 +603,7 @@ WebInspector.ArrayGroupingTreeElement._populateRanges = function(treeElement, ob
     {
         var count = 0;
         for (var i = fromIndex; i <= toIndex; ++i) {
-            var value = this[i];
-            if (typeof value !== "undefined")
+            if (i in this)
                 ++count;
         }
 
@@ -604,15 +611,14 @@ WebInspector.ArrayGroupingTreeElement._populateRanges = function(treeElement, ob
         if (count <= bucketThreshold)
             bucketSize = count;
         else
-            bucketSize = Math.pow(bucketThreshold, Math.floor(Math.log(count) / Math.log(bucketThreshold)));
+            bucketSize = Math.pow(bucketThreshold, Math.ceil(Math.log(count) / Math.log(bucketThreshold)) - 1);
 
         var ranges = [];
         count = 0;
         var groupStart = -1;
         var groupEnd = 0;
         for (var i = fromIndex; i <= toIndex; ++i) {
-            var value = this[i];
-            if (typeof value === "undefined")
+            if (!(i in this))
                 continue;
 
             if (groupStart === -1)
@@ -670,9 +676,8 @@ WebInspector.ArrayGroupingTreeElement._populateAsFragment = function(treeElement
     {
         var result = Object.create(null);
         for (var i = fromIndex; i <= toIndex; ++i) {
-            var value = this[i];
-            if (typeof value !== "undefined")
-                result[i] = value;
+            if (i in this)
+                result[i] = this[i];
         }
         return result;
     }
diff --git a/Source/WebCore/inspector/front-end/ParsedURL.js b/Source/WebCore/inspector/front-end/ParsedURL.js
index 49d1fde76..374f8857d 100644
--- a/Source/WebCore/inspector/front-end/ParsedURL.js
+++ b/Source/WebCore/inspector/front-end/ParsedURL.js
@@ -44,12 +44,12 @@ WebInspector.ParsedURL = function(url)
     this.lastPathComponent = "";
 
     // RegExp groups:
-    // 1 - scheme
+    // 1 - scheme (using the RFC3986 grammar)
     // 2 - hostname
     // 3 - ?port
     // 4 - ?path
     // 5 - ?fragment
-    var match = url.match(/^([^:]+):\/\/([^\/:]*)(?::([\d]+))?(?:(\/[^#]*)(?:#(.*))?)?$/i);
+    var match = url.match(/^([A-Za-z][A-Za-z0-9+.-]*):\/\/([^\/:]*)(?::([\d]+))?(?:(\/[^#]*)(?:#(.*))?)?$/i);
     if (match) {
         this.isValid = true;
         this.scheme = match[1].toLowerCase();
@@ -69,23 +69,21 @@ WebInspector.ParsedURL = function(url)
         this.path = this.url;
     }
 
-    if (this.path) {
-        // First cut the query params.
-        var path = this.path;
-        var indexOfQuery = path.indexOf("?");
-        if (indexOfQuery !== -1) {
-            this.queryParams = path.substring(indexOfQuery + 1)
-            path = path.substring(0, indexOfQuery);
-        }
-
-        // Then take last path component.
-        var lastSlashIndex = path.lastIndexOf("/");
-        if (lastSlashIndex !== -1) {
-            this.folderPathComponents = path.substring(0, lastSlashIndex);
-            this.lastPathComponent = path.substring(lastSlashIndex + 1);
-        } else
-            this.lastPathComponent = path;
+    // First cut the query params.
+    var path = this.path;
+    var indexOfQuery = path.indexOf("?");
+    if (indexOfQuery !== -1) {
+        this.queryParams = path.substring(indexOfQuery + 1)
+        path = path.substring(0, indexOfQuery);
     }
+
+    // Then take last path component.
+    var lastSlashIndex = path.lastIndexOf("/");
+    if (lastSlashIndex !== -1) {
+        this.folderPathComponents = path.substring(0, lastSlashIndex);
+        this.lastPathComponent = path.substring(lastSlashIndex + 1);
+    } else
+        this.lastPathComponent = path;
 }
 
 /**
@@ -146,12 +144,9 @@ WebInspector.ParsedURL.prototype = {
         if (this._displayName)
             return this._displayName;
 
-        if (this.scheme === "data") {
-            this._displayName = this.url.trimEnd(20);
-            return this._displayName;
-        }
-
-        if (this.url === "about:blank")
+        if (this.isDataURL())
+            return this.dataURLDisplayName();
+        if (this.isAboutBlank())
             return this.url;
 
         this._displayName = this.lastPathComponent;
@@ -162,6 +157,26 @@ WebInspector.ParsedURL.prototype = {
         if (this._displayName === "/")
             this._displayName = this.url;
         return this._displayName;
+    },
+
+    dataURLDisplayName: function()
+    {
+        if (this._dataURLDisplayName)
+            return this._dataURLDisplayName;
+        if (!this.isDataURL())
+            return "";
+        this._dataURLDisplayName = this.url.trimEnd(20);
+        return this._dataURLDisplayName;
+    },
+
+    isAboutBlank: function()
+    {
+        return this.url === "about:blank";
+    },
+
+    isDataURL: function()
+    {
+        return this.scheme === "data";
     }
 }
 
diff --git a/Source/WebCore/inspector/front-end/Popover.js b/Source/WebCore/inspector/front-end/Popover.js
index ce1e10a53..31aca9dd8 100644
--- a/Source/WebCore/inspector/front-end/Popover.js
+++ b/Source/WebCore/inspector/front-end/Popover.js
@@ -30,11 +30,13 @@
 
 /**
  * @constructor
+ * @extends {WebInspector.View}
  * @param {WebInspector.PopoverHelper=} popoverHelper
  */
 WebInspector.Popover = function(popoverHelper)
 {
-    this.element = document.createElement("div");
+    WebInspector.View.call(this);
+    this.markAsRoot();
     this.element.className = "popover custom-popup-vertical-scroll custom-popup-horizontal-scroll";
 
     this._popupArrowElement = document.createElement("div");
@@ -43,37 +45,66 @@ WebInspector.Popover = function(popoverHelper)
 
     this._contentDiv = document.createElement("div");
     this._contentDiv.className = "content";
-    this._visible = false;
+    this.element.appendChild(this._contentDiv);
+
     this._popoverHelper = popoverHelper;
 }
 
 WebInspector.Popover.prototype = {
     /**
+     * @param {Element} element
+     * @param {Element} anchor
+     * @param {number=} preferredWidth
+     * @param {number=} preferredHeight
+     */
+    show: function(element, anchor, preferredWidth, preferredHeight)
+    {
+        this._innerShow(null, element, anchor, preferredWidth, preferredHeight);
+    },
+
+    /**
+     * @param {WebInspector.View} view
+     * @param {Element} anchor
+     * @param {number=} preferredWidth
+     * @param {number=} preferredHeight
+     */
+    showView: function(view, anchor, preferredWidth, preferredHeight)
+    {
+        this._innerShow(view, view.element, anchor, preferredWidth, preferredHeight);
+    },
+
+    /**
+     * @param {WebInspector.View?} view
+     * @param {Element} contentElement
+     * @param {Element} anchor
      * @param {number=} preferredWidth
      * @param {number=} preferredHeight
      */
-    show: function(contentElement, anchor, preferredWidth, preferredHeight)
+    _innerShow: function(view, contentElement, anchor, preferredWidth, preferredHeight)
     {
         if (this._disposed)
             return;
         this.contentElement = contentElement;
 
         // This should not happen, but we hide previous popup to be on the safe side.
-        if (WebInspector.Popover._popoverElement)
-            document.body.removeChild(WebInspector.Popover._popoverElement);
-        WebInspector.Popover._popoverElement = this.element;
+        if (WebInspector.Popover._popover)
+            WebInspector.Popover._popover.detach();
+        WebInspector.Popover._popover = this;
 
         // Temporarily attach in order to measure preferred dimensions.
-        this.contentElement.positionAt(0, 0);
-        document.body.appendChild(this.contentElement);
-        preferredWidth = preferredWidth || this.contentElement.offsetWidth;
-        preferredHeight = preferredHeight || this.contentElement.offsetHeight;
-
-        this._contentDiv.appendChild(this.contentElement);
-        this.element.appendChild(this._contentDiv);
-        document.body.appendChild(this.element);
+        var preferredSize = view ? view.measurePreferredSize() : this.contentElement.measurePreferredSize();
+        preferredWidth = preferredWidth || preferredSize.width;
+        preferredHeight = preferredHeight || preferredSize.height;
+
+        WebInspector.View.prototype.show.call(this, document.body);
+
+        if (view)
+            view.show(this._contentDiv);
+        else
+            this._contentDiv.appendChild(this.contentElement);
+
         this._positionElement(anchor, preferredWidth, preferredHeight);
-        this._visible = true;
+
         if (this._popoverHelper) {
             contentElement.addEventListener("mousemove", this._popoverHelper._killHidePopoverTimer.bind(this._popoverHelper), true);
             this.element.addEventListener("mouseout", this._popoverHelper._mouseOut.bind(this._popoverHelper), true);
@@ -82,16 +113,8 @@ WebInspector.Popover.prototype = {
 
     hide: function()
     {
-        if (WebInspector.Popover._popoverElement) {
-            delete WebInspector.Popover._popoverElement;
-            document.body.removeChild(this.element);
-        }
-        this._visible = false;
-    },
-
-    get visible()
-    {
-        return this._visible;
+        this.detach();
+        delete WebInspector.Popover._popover;
     },
 
     get disposed()
@@ -101,7 +124,7 @@ WebInspector.Popover.prototype = {
 
     dispose: function()
     {
-        if (this.visible)
+        if (this.isShowing())
             this.hide();
         this._disposed = true;
     },
@@ -187,7 +210,9 @@ WebInspector.Popover.prototype = {
         this.element.positionAt(newElementPosition.x - borderWidth, newElementPosition.y - borderWidth);
         this.element.style.width = newElementPosition.width + borderWidth * 2 + "px";
         this.element.style.height = newElementPosition.height + borderWidth * 2 + "px";
-    }
+    },
+
+    __proto__: WebInspector.View.prototype
 }
 
 /**
diff --git a/Source/WebCore/inspector/front-end/PresentationConsoleMessageHelper.js b/Source/WebCore/inspector/front-end/PresentationConsoleMessageHelper.js
index a0cc97848..25533ed62 100644
--- a/Source/WebCore/inspector/front-end/PresentationConsoleMessageHelper.js
+++ b/Source/WebCore/inspector/front-end/PresentationConsoleMessageHelper.js
@@ -42,6 +42,7 @@ WebInspector.PresentationConsoleMessageHelper = function(uiSourceCodeProvider)
     this._uiSourceCodeProvider = uiSourceCodeProvider;
 
     WebInspector.console.addEventListener(WebInspector.ConsoleModel.Events.MessageAdded, this._consoleMessageAdded, this);
+    WebInspector.console.addEventListener(WebInspector.ConsoleModel.Events.RepeatCountUpdated, this._consoleMessageAdded, this);
     WebInspector.console.addEventListener(WebInspector.ConsoleModel.Events.ConsoleCleared, this._consoleCleared, this);
 
     WebInspector.debuggerModel.addEventListener(WebInspector.DebuggerModel.Events.ParsedScriptSource, this._parsedScriptSource, this);
@@ -55,7 +56,7 @@ WebInspector.PresentationConsoleMessageHelper.prototype = {
      */
     _consoleMessageAdded: function(event)
     {
-        var message = /** @type {WebInspector.ConsoleMessage} */ event.data;
+        var message = /** @type {WebInspector.ConsoleMessage} */ (event.data);
         if (!message.url || !message.isErrorOrWarning())
             return;
 
@@ -92,7 +93,7 @@ WebInspector.PresentationConsoleMessageHelper.prototype = {
      */
     _parsedScriptSource: function(event)
     {
-        var script = /** @type {WebInspector.Script} */ event.data;
+        var script = /** @type {WebInspector.Script} */ (event.data);
 
         var messages = this._pendingConsoleMessages[script.sourceURL];
         if (!messages)
@@ -101,7 +102,7 @@ WebInspector.PresentationConsoleMessageHelper.prototype = {
         var pendingMessages = [];
         for (var i = 0; i < messages.length; i++) {
             var message = messages[i];
-            var rawLocation = /** @type {WebInspector.DebuggerModel.Location} */ message.location();
+            var rawLocation = /** @type {WebInspector.DebuggerModel.Location} */ (message.location());
             if (script.scriptId === rawLocation.scriptId)
                 this._addConsoleMessageToScript(message, rawLocation);
             else
diff --git a/Source/WebCore/inspector/front-end/ProfilesPanel.js b/Source/WebCore/inspector/front-end/ProfilesPanel.js
index 1e594e2f0..3e9088582 100644
--- a/Source/WebCore/inspector/front-end/ProfilesPanel.js
+++ b/Source/WebCore/inspector/front-end/ProfilesPanel.js
@@ -429,11 +429,11 @@ WebInspector.ProfilesPanel.prototype = {
             return;
         }
         if (element !== this.element || event.srcElement === this.sidebarElement) {
-            var contextMenu = new WebInspector.ContextMenu();
+            var contextMenu = new WebInspector.ContextMenu(event);
             if (this.visibleView instanceof WebInspector.HeapSnapshotView)
                 this.visibleView.populateContextMenu(contextMenu, event);
             contextMenu.appendItem(WebInspector.UIString("Load Heap Snapshot\u2026"), this._fileSelectorElement.click.bind(this._fileSelectorElement));
-            contextMenu.show(event);
+            contextMenu.show();
         }
 
     },
@@ -1086,12 +1086,12 @@ WebInspector.ProfilesPanel.prototype = {
      * @param {WebInspector.ContextMenu} contextMenu
      * @param {Object} target
      */
-    appendApplicableItems: function(contextMenu, target)
+    appendApplicableItems: function(event, contextMenu, target)
     {
         if (WebInspector.inspectorView.currentPanel() !== this)
             return;
 
-        var object = /** @type {WebInspector.RemoteObject} */ target;
+        var object = /** @type {WebInspector.RemoteObject} */ (target);
         var objectId = object.objectId;
         if (!objectId)
             return;
@@ -1248,7 +1248,7 @@ WebInspector.ProfileSidebarTreeElement.prototype = {
     handleContextMenuEvent: function(event)
     {
         var profile = this.profile;
-        var contextMenu = new WebInspector.ContextMenu();
+        var contextMenu = new WebInspector.ContextMenu(event);
         var profilesPanel = WebInspector.ProfilesPanel._instance;
         // FIXME: use context menu provider
         if (profile.canSaveToFile()) {
@@ -1259,7 +1259,7 @@ WebInspector.ProfileSidebarTreeElement.prototype = {
             contextMenu.appendItem(WebInspector.UIString("Load Heap Snapshot\u2026"), profilesPanel._fileSelectorElement.click.bind(profilesPanel._fileSelectorElement));
             contextMenu.appendItem(WebInspector.UIString("Delete profile"), this.ondelete.bind(this));
         }
-        contextMenu.show(event);
+        contextMenu.show();
     },
 
     __proto__: WebInspector.SidebarTreeElement.prototype
diff --git a/Source/WebCore/inspector/front-end/RemoteObject.js b/Source/WebCore/inspector/front-end/RemoteObject.js
index 324f4edb5..bd59d179b 100644
--- a/Source/WebCore/inspector/front-end/RemoteObject.js
+++ b/Source/WebCore/inspector/front-end/RemoteObject.js
@@ -248,7 +248,7 @@ WebInspector.RemoteObject.prototype = {
                 setPropertyValueFunction = "function(a) { this[a] = " + result.description + "; }";
 
             delete result.description; // Optimize on traffic.
-            RuntimeAgent.callFunctionOn(this._objectId, setPropertyValueFunction, [{ value:name }, result], true, undefined, propertySetCallback.bind(this));
+            RuntimeAgent.callFunctionOn(this._objectId, setPropertyValueFunction, [{ value:name }, result], true, undefined, undefined, propertySetCallback.bind(this));
             if (result._objectId)
                 RuntimeAgent.releaseObject(result._objectId);
         }
@@ -299,7 +299,7 @@ WebInspector.RemoteObject.prototype = {
             callback((error || wasThrown) ? null : WebInspector.RemoteObject.fromPayload(result));
         }
 
-        RuntimeAgent.callFunctionOn(this._objectId, functionDeclaration.toString(), args, true, undefined, mycallback);
+        RuntimeAgent.callFunctionOn(this._objectId, functionDeclaration.toString(), args, true, undefined, undefined, mycallback);
     },
 
     /**
@@ -319,7 +319,7 @@ WebInspector.RemoteObject.prototype = {
             callback((error || wasThrown) ? null : result.value);
         }
 
-        RuntimeAgent.callFunctionOn(this._objectId, functionDeclaration.toString(), args, true, true, mycallback);
+        RuntimeAgent.callFunctionOn(this._objectId, functionDeclaration.toString(), args, true, true, false, mycallback);
     },
 
     release: function()
diff --git a/Source/WebCore/inspector/front-end/ResourceScriptMapping.js b/Source/WebCore/inspector/front-end/ResourceScriptMapping.js
index bd6b2fa3e..3bf5e301c 100644
--- a/Source/WebCore/inspector/front-end/ResourceScriptMapping.js
+++ b/Source/WebCore/inspector/front-end/ResourceScriptMapping.js
@@ -56,7 +56,7 @@ WebInspector.ResourceScriptMapping.prototype = {
      */
     rawLocationToUILocation: function(rawLocation)
     {
-        var debuggerModelLocation = /** @type {WebInspector.DebuggerModel.Location} */ rawLocation;
+        var debuggerModelLocation = /** @type {WebInspector.DebuggerModel.Location} */ (rawLocation);
         var script = WebInspector.debuggerModel.scriptForId(debuggerModelLocation.scriptId);
         var uiSourceCode = this._workspaceUISourceCodeForScript(script) || this._getOrCreateTemporaryUISourceCode(script);
         if (uiSourceCode.scriptFile() && uiSourceCode.scriptFile().hasDivergedFromVM())
@@ -148,7 +148,7 @@ WebInspector.ResourceScriptMapping.prototype = {
         }
         if (!originalUISourceCode)
             return;
-        this._workspace.project().removeTemporaryUISourceCode(originalUISourceCode);
+        this._workspace.removeTemporaryUISourceCode(originalUISourceCode);
         this._scriptIdsForOriginalUISourceCode.remove(originalUISourceCode);
     },
 
@@ -165,7 +165,7 @@ WebInspector.ResourceScriptMapping.prototype = {
         }
         if (!temporaryUISourceCode)
             return false;
-        this._workspace.project().removeTemporaryUISourceCode(temporaryUISourceCode);
+        this._workspace.removeTemporaryUISourceCode(temporaryUISourceCode);
         this._scriptIdsForTemporaryUISourceCode.remove(temporaryUISourceCode);
         return true;
     },
@@ -177,14 +177,13 @@ WebInspector.ResourceScriptMapping.prototype = {
     _bindUISourceCodeToScripts: function(uiSourceCode, scripts)
     {
         console.assert(scripts.length);
-        for (var i = 0; i < scripts.length; ++i)
-            scripts[i].setSourceMapping(this);
-        uiSourceCode.isContentScript = scripts[0].isContentScript;
-        uiSourceCode.setSourceMapping(this);
         if (uiSourceCode.isEditable()) {
             var scriptFile = new WebInspector.ResourceScriptFile(this, uiSourceCode);
             uiSourceCode.setScriptFile(scriptFile);
         }
+        for (var i = 0; i < scripts.length; ++i)
+            scripts[i].setSourceMapping(this);
+        uiSourceCode.setSourceMapping(this);
     },
 
     /**
@@ -225,7 +224,7 @@ WebInspector.ResourceScriptMapping.prototype = {
         var contentProvider = script.isInlineScript() ? new WebInspector.ConcatenatedScriptsContentProvider(scripts) : script;
         var isDynamicScript = this._isDynamicScript(script);
         var url = isDynamicScript ? "" : script.sourceURL;
-        var temporaryUISourceCode = new WebInspector.UISourceCode(url, contentProvider, !script.isInlineScript() && !divergedVersion);
+        var temporaryUISourceCode = this._workspace.addTemporaryUISourceCode(url, contentProvider, !script.isInlineScript() && !divergedVersion, script.isContentScript);
         temporaryUISourceCode.divergedVersion = divergedVersion;
         return temporaryUISourceCode;
     },
@@ -248,7 +247,6 @@ WebInspector.ResourceScriptMapping.prototype = {
             scriptIds.push(scripts[i].scriptId);
         }
         this._scriptIdsForTemporaryUISourceCode.put(temporaryUISourceCode, scriptIds);
-        this._workspace.project().addTemporaryUISourceCode(temporaryUISourceCode);
         this._bindUISourceCodeToScripts(temporaryUISourceCode, scripts);
         return temporaryUISourceCode;
     },
@@ -272,14 +270,13 @@ WebInspector.ResourceScriptMapping.prototype = {
             scriptIds.push(scripts[i].scriptId);
         }
         this._scriptIdsForOriginalUISourceCode.put(originalUISourceCode, scriptIds);
-        this._workspace.project().addTemporaryUISourceCode(originalUISourceCode);
         this._bindUISourceCodeToScripts(originalUISourceCode, scripts);
         return originalUISourceCode;
     },
 
     _uiSourceCodeAddedToWorkspace: function(event)
     {
-        var uiSourceCode = /** @type {WebInspector.UISourceCode} */ event.data;
+        var uiSourceCode = /** @type {WebInspector.UISourceCode} */ (event.data);
         console.assert(!!uiSourceCode.url);
 
         var scripts = this._scriptsForUISourceCode(uiSourceCode);
@@ -401,7 +398,7 @@ WebInspector.ResourceScriptFile.prototype = {
             this.dispatchEventToListeners(WebInspector.ScriptFile.Events.DidMergeToVM, this);
         }
 
-        var rawLocation = /** @type {WebInspector.DebuggerModel.Location} */ this._uiSourceCode.uiLocationToRawLocation(0, 0);
+        var rawLocation = /** @type {WebInspector.DebuggerModel.Location} */ (this._uiSourceCode.uiLocationToRawLocation(0, 0));
         if (!rawLocation)
             return;
         var script = WebInspector.debuggerModel.scriptForId(rawLocation.scriptId);
@@ -410,7 +407,7 @@ WebInspector.ResourceScriptFile.prototype = {
 
     _workingCopyChanged: function(event)
     {
-        var wasDirty = /** @type {boolean} */ event.data.wasDirty;
+        var wasDirty = /** @type {boolean} */ (event.data.wasDirty);
         if (!wasDirty && this._uiSourceCode.isDirty() && !this._hasDivergedFromVM) {
             this._isDivergingFromVM = true;
             this.dispatchEventToListeners(WebInspector.ScriptFile.Events.WillDivergeFromVM, this._uiSourceCode);
diff --git a/Source/WebCore/inspector/front-end/ResourceTreeModel.js b/Source/WebCore/inspector/front-end/ResourceTreeModel.js
index f5527915c..e9e12b9db 100644
--- a/Source/WebCore/inspector/front-end/ResourceTreeModel.js
+++ b/Source/WebCore/inspector/front-end/ResourceTreeModel.js
@@ -176,7 +176,7 @@ WebInspector.ResourceTreeModel.prototype = {
         if (!this._cachedResourcesProcessed)
             return;
 
-        var request = /** @type {WebInspector.NetworkRequest} */ event.data;
+        var request = /** @type {WebInspector.NetworkRequest} */ (event.data);
         if (request.failed || request.type === WebInspector.resourceTypes.XHR)
             return;
 
@@ -233,7 +233,7 @@ WebInspector.ResourceTreeModel.prototype = {
      */
     _consoleMessageAdded: function(event)
     {
-        var msg = /** @type {WebInspector.ConsoleMessage} */ event.data;
+        var msg = /** @type {WebInspector.ConsoleMessage} */ (event.data);
         var resource = msg.url ? this.resourceForURL(msg.url) : null;
         if (resource)
             this._addConsoleMessageToResource(msg, resource);
diff --git a/Source/WebCore/inspector/front-end/ResourceType.js b/Source/WebCore/inspector/front-end/ResourceType.js
index 2f88a6bbb..a3f3110d3 100644
--- a/Source/WebCore/inspector/front-end/ResourceType.js
+++ b/Source/WebCore/inspector/front-end/ResourceType.js
@@ -108,7 +108,10 @@ WebInspector.ResourceType.prototype = {
     }
 }
 
-//Keep these in sync with WebCore::InspectorPageAgent::resourceTypeJson
+/**
+ * Keep these in sync with WebCore::InspectorPageAgent::resourceTypeJson
+ * @enum {!WebInspector.ResourceType}
+ */
 WebInspector.resourceTypes = {
     Document: new WebInspector.ResourceType("document", "Document", "Documents", "rgb(47,102,236)", true),
     Stylesheet: new WebInspector.ResourceType("stylesheet", "Stylesheet", "Stylesheets", "rgb(157,231,119)", true),
diff --git a/Source/WebCore/inspector/front-end/ResourceUtils.js b/Source/WebCore/inspector/front-end/ResourceUtils.js
index 207bf0b31..01b47f5d1 100644
--- a/Source/WebCore/inspector/front-end/ResourceUtils.js
+++ b/Source/WebCore/inspector/front-end/ResourceUtils.js
@@ -58,6 +58,10 @@ WebInspector.displayNameForURL = function(url)
     if (resource)
         return resource.displayName;
 
+    var uiSourceCode = WebInspector.workspace.uiSourceCodeForURL(url);
+    if (uiSourceCode)
+        return uiSourceCode.parsedURL.displayName;
+
     if (!WebInspector.inspectedPageURL)
         return url.trimURL("");
 
@@ -81,7 +85,7 @@ WebInspector.displayNameForURL = function(url)
 WebInspector.linkifyStringAsFragmentWithCustomLinkifier = function(string, linkifier)
 {
     var container = document.createDocumentFragment();
-    var linkStringRegEx = /(?:[a-zA-Z][a-zA-Z0-9+.-]{2,}:\/\/|www\.)[\w$\-_+*'=\|\/\\(){}[\]%@&#~,:;.!?]{2,}[\w$\-_+*=\|\/\\({%@&#~]/;
+    var linkStringRegEx = /(?:[a-zA-Z][a-zA-Z0-9+.-]{2,}:\/\/|data:|www\.)[\w$\-_+*'=\|\/\\(){}[\]%@&#~,:;.!?]{2,}[\w$\-_+*=\|\/\\({%@&#~]/;
     var lineColumnRegEx = /:(\d+)(:(\d+))?$/;
 
     while (string) {
@@ -161,7 +165,7 @@ WebInspector.linkifyStringAsFragment = function(string)
  * @param {string=} classes
  * @param {boolean=} isExternal
  * @param {string=} tooltipText
- * @return {Element}
+ * @return {!Element}
  */
 WebInspector.linkifyURLAsNode = function(url, linkText, classes, isExternal, tooltipText)
 {
diff --git a/Source/WebCore/inspector/front-end/ResourcesPanel.js b/Source/WebCore/inspector/front-end/ResourcesPanel.js
index c505c97e0..2da3e9e1d 100644
--- a/Source/WebCore/inspector/front-end/ResourcesPanel.js
+++ b/Source/WebCore/inspector/front-end/ResourcesPanel.js
@@ -297,7 +297,7 @@ WebInspector.ResourcesPanel.prototype = {
      */
     _databaseAdded: function(event)
     {
-        var database = /** @type {WebInspector.Database} */ event.data;
+        var database = /** @type {WebInspector.Database} */ (event.data);
         this._addDatabase(database);
     },
 
@@ -331,7 +331,7 @@ WebInspector.ResourcesPanel.prototype = {
      */
     _domStorageAdded: function(event)
     {
-        var domStorage = /** @type {WebInspector.DOMStorage}*/ event.data;
+        var domStorage = /** @type {WebInspector.DOMStorage}*/ (event.data);
         this._addDOMStorage(domStorage);
     },
 
@@ -577,7 +577,7 @@ WebInspector.ResourcesPanel.prototype = {
      */
     _domStorageUpdated: function(event)
     {
-        var storage = /** @type {WebInspector.DOMStorage}*/ event.data;
+        var storage = /** @type {WebInspector.DOMStorage}*/ (event.data);
         var view = this._domStorageViews.get(storage);
         if (this.visibleView && view === this.visibleView)
             view.update();
@@ -1217,11 +1217,11 @@ WebInspector.FrameResourceTreeElement.prototype = {
 
     _handleContextMenuEvent: function(event)
     {
-        var contextMenu = new WebInspector.ContextMenu();
+        var contextMenu = new WebInspector.ContextMenu(event);
         contextMenu.appendApplicableItems(this._resource);
         if (this._resource.request)
             contextMenu.appendApplicableItems(this._resource.request);
-        contextMenu.show(event);
+        contextMenu.show();
     },
 
     _setBubbleText: function(x)
@@ -1417,9 +1417,9 @@ WebInspector.IndexedDBTreeElement.prototype = {
 
     _handleContextMenuEvent: function(event)
     {
-        var contextMenu = new WebInspector.ContextMenu();
+        var contextMenu = new WebInspector.ContextMenu(event);
         contextMenu.appendItem(WebInspector.UIString("Refresh IndexedDB"), this.refreshIndexedDB.bind(this));
-        contextMenu.show(event);
+        contextMenu.show();
     },
 
     _createIndexedDBModel: function()
@@ -1446,7 +1446,7 @@ WebInspector.IndexedDBTreeElement.prototype = {
      */
     _indexedDBAdded: function(event)
     {
-        var databaseId = /** @type {WebInspector.IndexedDBModel.DatabaseId} */ event.data;
+        var databaseId = /** @type {WebInspector.IndexedDBModel.DatabaseId} */ (event.data);
 
         var idbDatabaseTreeElement = new WebInspector.IDBDatabaseTreeElement(this._storagePanel, this._indexedDBModel, databaseId);
         this._idbDatabaseTreeElements.push(idbDatabaseTreeElement);
@@ -1460,7 +1460,7 @@ WebInspector.IndexedDBTreeElement.prototype = {
      */
     _indexedDBRemoved: function(event)
     {
-        var databaseId = /** @type {WebInspector.IndexedDBModel.DatabaseId} */ event.data;
+        var databaseId = /** @type {WebInspector.IndexedDBModel.DatabaseId} */ (event.data);
 
         var idbDatabaseTreeElement = this._idbDatabaseTreeElement(databaseId)
         if (!idbDatabaseTreeElement)
@@ -1476,7 +1476,7 @@ WebInspector.IndexedDBTreeElement.prototype = {
      */
     _indexedDBLoaded: function(event)
     {
-        var database = /** @type {WebInspector.IndexedDBModel.Database} */ event.data;
+        var database = /** @type {WebInspector.IndexedDBModel.Database} */ (event.data);
 
         var idbDatabaseTreeElement = this._idbDatabaseTreeElement(database.databaseId)
         if (!idbDatabaseTreeElement)
@@ -1531,21 +1531,21 @@ WebInspector.FileSystemListTreeElement.prototype = {
 
     _handleContextMenuEvent: function(event)
     {
-        var contextMenu = new WebInspector.ContextMenu();
+        var contextMenu = new WebInspector.ContextMenu(event);
         contextMenu.appendItem(WebInspector.UIString("Refresh FileSystem List"), this._refreshFileSystem.bind(this));
-        contextMenu.show(event);
+        contextMenu.show();
     },
 
     _fileSystemAdded: function(event)
     {
-        var fileSystem = /** @type {WebInspector.FileSystemModel.FileSystem} */ event.data;
+        var fileSystem = /** @type {WebInspector.FileSystemModel.FileSystem} */ (event.data);
         var fileSystemTreeElement = new WebInspector.FileSystemTreeElement(this._storagePanel, fileSystem);
         this.appendChild(fileSystemTreeElement);
     },
 
     _fileSystemRemoved: function(event)
     {
-        var fileSystem = /** @type {WebInspector.FileSystemModel.FileSystem} */ event.data;
+        var fileSystem = /** @type {WebInspector.FileSystemModel.FileSystem} */ (event.data);
         var fileSystemTreeElement = this._fileSystemTreeElementByName(fileSystem.name);
         if (!fileSystemTreeElement)
             return;
@@ -1556,7 +1556,7 @@ WebInspector.FileSystemListTreeElement.prototype = {
     _fileSystemTreeElementByName: function(fileSystemName)
     {
         for (var i = 0; i < this.children.length; ++i) {
-            var child = /** @type {WebInspector.FileSystemTreeElement} */ this.children[i];
+            var child = /** @type {WebInspector.FileSystemTreeElement} */ (this.children[i]);
             if (child.fileSystemName === fileSystemName)
                 return this.children[i];
         }
@@ -1606,9 +1606,9 @@ WebInspector.IDBDatabaseTreeElement.prototype = {
 
     _handleContextMenuEvent: function(event)
     {
-        var contextMenu = new WebInspector.ContextMenu();
+        var contextMenu = new WebInspector.ContextMenu(event);
         contextMenu.appendItem(WebInspector.UIString("Refresh IndexedDB"), this._refreshIndexedDB.bind(this));
-        contextMenu.show(event);
+        contextMenu.show();
     },
 
     _refreshIndexedDB: function(event)
@@ -2211,7 +2211,7 @@ WebInspector.SearchResultsTreeElementsTraverser.prototype = {
      */
     _traverseNext: function(treeElement)
     {
-        return /** @type {WebInspector.BaseStorageTreeElement} */ treeElement.traverseNextTreeElement(false, this._root, true);
+        return /** @type {WebInspector.BaseStorageTreeElement} */ (treeElement.traverseNextTreeElement(false, this._root, true));
     },
 
     /**
@@ -2220,7 +2220,7 @@ WebInspector.SearchResultsTreeElementsTraverser.prototype = {
      */
     _traversePrevious: function(treeElement)
     {
-        return /** @type {WebInspector.BaseStorageTreeElement} */ treeElement.traversePreviousTreeElement(false, true);
+        return /** @type {WebInspector.BaseStorageTreeElement} */ (treeElement.traversePreviousTreeElement(false, true));
     },
 
     /**
diff --git a/Source/WebCore/inspector/front-end/RevisionHistoryView.js b/Source/WebCore/inspector/front-end/RevisionHistoryView.js
index 56b822676..4592e4ad5 100644
--- a/Source/WebCore/inspector/front-end/RevisionHistoryView.js
+++ b/Source/WebCore/inspector/front-end/RevisionHistoryView.js
@@ -128,7 +128,7 @@ WebInspector.RevisionHistoryView.prototype = {
 
     _revisionAdded: function(event)
     {
-        var uiSourceCode = /** @type {WebInspector.UISourceCode} */ event.data.uiSourceCode;
+        var uiSourceCode = /** @type {WebInspector.UISourceCode} */ (event.data.uiSourceCode);
         var uiSourceCodeItem = this._uiSourceCodeItems.get(uiSourceCode);
         if (!uiSourceCodeItem) {
             uiSourceCodeItem = this._createUISourceCodeItem(uiSourceCode);
@@ -156,7 +156,7 @@ WebInspector.RevisionHistoryView.prototype = {
 
     _uiSourceCodeRemoved: function(event)
     {
-        var uiSourceCode = /** @type {WebInspector.UISourceCode} */ event.data;
+        var uiSourceCode = /** @type {WebInspector.UISourceCode} */ (event.data);
         this._removeUISourceCode(uiSourceCode);
     },
 
diff --git a/Source/WebCore/inspector/front-end/RuntimeModel.js b/Source/WebCore/inspector/front-end/RuntimeModel.js
index 6f7f9e39e..b7ba78868 100644
--- a/Source/WebCore/inspector/front-end/RuntimeModel.js
+++ b/Source/WebCore/inspector/front-end/RuntimeModel.js
@@ -129,12 +129,13 @@ WebInspector.RuntimeModel.prototype = {
      * @param {boolean} includeCommandLineAPI
      * @param {boolean} doNotPauseOnExceptionsAndMuteConsole
      * @param {boolean} returnByValue
+     * @param {boolean} generatePreview
      * @param {function(?WebInspector.RemoteObject, boolean, RuntimeAgent.RemoteObject=)} callback
      */
-    evaluate: function(expression, objectGroup, includeCommandLineAPI, doNotPauseOnExceptionsAndMuteConsole, returnByValue, callback)
+    evaluate: function(expression, objectGroup, includeCommandLineAPI, doNotPauseOnExceptionsAndMuteConsole, returnByValue, generatePreview, callback)
     {
         if (WebInspector.debuggerModel.selectedCallFrame()) {
-            WebInspector.debuggerModel.evaluateOnSelectedCallFrame(expression, objectGroup, includeCommandLineAPI, doNotPauseOnExceptionsAndMuteConsole, returnByValue, callback);
+            WebInspector.debuggerModel.evaluateOnSelectedCallFrame(expression, objectGroup, includeCommandLineAPI, doNotPauseOnExceptionsAndMuteConsole, returnByValue, generatePreview, callback);
             return;
         }
 
@@ -161,7 +162,7 @@ WebInspector.RuntimeModel.prototype = {
             else
                 callback(WebInspector.RemoteObject.fromPayload(result), !!wasThrown);
         }
-        RuntimeAgent.evaluate(expression, objectGroup, includeCommandLineAPI, doNotPauseOnExceptionsAndMuteConsole, this._currentExecutionContext ? this._currentExecutionContext.id : undefined, returnByValue, evalCallback);
+        RuntimeAgent.evaluate(expression, objectGroup, includeCommandLineAPI, doNotPauseOnExceptionsAndMuteConsole, this._currentExecutionContext ? this._currentExecutionContext.id : undefined, returnByValue, generatePreview, evalCallback);
     },
 
     /**
@@ -209,7 +210,7 @@ WebInspector.RuntimeModel.prototype = {
         if (!expressionString && WebInspector.debuggerModel.selectedCallFrame())
             WebInspector.debuggerModel.getSelectedCallFrameVariables(receivedPropertyNames.bind(this));
         else
-            this.evaluate(expressionString, "completion", true, true, false, evaluated.bind(this));
+            this.evaluate(expressionString, "completion", true, true, false, false, evaluated.bind(this));
 
         function evaluated(result, wasThrown)
         {
@@ -245,7 +246,7 @@ WebInspector.RuntimeModel.prototype = {
             if (result.type === "object" || result.type === "function")
                 result.callFunctionJSON(getCompletions, undefined, receivedPropertyNames.bind(this));
             else if (result.type === "string" || result.type === "number" || result.type === "boolean")
-                this.evaluate("(" + getCompletions + ")(\"" + result.type + "\")", "completion", false, true, true, receivedPropertyNamesFromEval.bind(this));
+                this.evaluate("(" + getCompletions + ")(\"" + result.type + "\")", "completion", false, true, true, false, receivedPropertyNamesFromEval.bind(this));
         }
 
         function receivedPropertyNamesFromEval(notRelevant, wasThrown, result)
diff --git a/Source/WebCore/inspector/front-end/SASSSourceMapping.js b/Source/WebCore/inspector/front-end/SASSSourceMapping.js
index 85b521dce..43bc1e7cf 100644
--- a/Source/WebCore/inspector/front-end/SASSSourceMapping.js
+++ b/Source/WebCore/inspector/front-end/SASSSourceMapping.js
@@ -32,12 +32,17 @@
  * @constructor
  * @implements {WebInspector.SourceMapping}
  * @param {WebInspector.Workspace} workspace
+ * @param {WebInspector.NetworkWorkspaceProvider} networkWorkspaceProvider
  */
-WebInspector.SASSSourceMapping = function(workspace)
+WebInspector.SASSSourceMapping = function(workspace, networkWorkspaceProvider)
 {
     this._workspace = workspace;
+    this._networkWorkspaceProvider = networkWorkspaceProvider;
     this._uiLocations = {};
+    this._cssURLsForSASSURL = {};
+    this._timeoutForURL = {};
     WebInspector.resourceTreeModel.addEventListener(WebInspector.ResourceTreeModel.EventTypes.ResourceAdded, this._resourceAdded, this);
+    WebInspector.fileManager.addEventListener(WebInspector.FileManager.EventTypes.SavedURL, this._fileSaveFinished, this);
     this._workspace.addEventListener(WebInspector.Workspace.Events.ProjectWillReset, this._reset, this);
 }
 
@@ -60,9 +65,46 @@ WebInspector.SASSSourceMapping.prototype = {
     /**
      * @param {WebInspector.Event} event
      */
+    _fileSaveFinished: function(event)
+    {
+        var sassURL = /** @type {string} */ (event.data);
+        function callback()
+        {
+            delete this._timeoutForURL[sassURL];
+            var cssURLs = this._cssURLsForSASSURL[sassURL];
+            if (!cssURLs)
+                return;
+            for (var i = 0; i < cssURLs.length; ++i)
+                this._reloadCSS(cssURLs[i]);
+        }
+
+        var timer = this._timeoutForURL[sassURL];
+        if (timer) {
+            clearTimeout(timer);
+            delete this._timeoutForURL[sassURL];
+        }
+        if (!WebInspector.settings.cssReloadEnabled.get() || !this._cssURLsForSASSURL[sassURL])
+            return;
+        var timeout = WebInspector.settings.cssReloadTimeout.get();
+        if (timeout && isFinite(timeout))
+            this._timeoutForURL[sassURL] = setTimeout(callback.bind(this), Number(timeout));
+    },
+
+    _reloadCSS: function(url)
+    {
+        var uiSourceCode = this._workspace.uiSourceCodeForURL(url);
+        if (!uiSourceCode)
+            return;
+        var newContent = InspectorFrontendHost.loadResourceSynchronously(url);
+        uiSourceCode.addRevision(newContent);
+    },
+
+    /**
+     * @param {WebInspector.Event} event
+     */
     _resourceAdded: function(event)
     {
-        var resource = /** @type {WebInspector.Resource} */ event.data;
+        var resource = /** @type {WebInspector.Resource} */ (event.data);
         if (resource.type !== WebInspector.resourceTypes.Stylesheet)
             return;
 
@@ -115,12 +157,30 @@ WebInspector.SASSSourceMapping.prototype = {
         if (!uiSourceCode) {
             var content = InspectorFrontendHost.loadResourceSynchronously(url);
             var contentProvider = new WebInspector.StaticContentProvider(WebInspector.resourceTypes.Stylesheet, content, "text/x-scss");
-            uiSourceCode = new WebInspector.UISourceCode(url, contentProvider, true);
-            this._workspace.project().addUISourceCode(uiSourceCode);
+            this._networkWorkspaceProvider.addFile(url, contentProvider, true);
+            uiSourceCode = this._workspace.uiSourceCodeForURL(url);
             WebInspector.cssModel.setSourceMapping(rawURL, this);
         }
         var rawLocationString = rawURL + ":" + (rawLine + 1);  // Next line after mapping metainfo
         this._uiLocations[rawLocationString] = new WebInspector.UILocation(uiSourceCode, line - 1, 0);
+        this._addCSSURLforSASSURL(rawURL, url);
+    },
+
+    /**
+     * @param {string} cssURL
+     * @param {string} sassURL
+     */
+    _addCSSURLforSASSURL: function(cssURL, sassURL)
+    {
+        var cssURLs;
+        if (this._cssURLsForSASSURL.hasOwnProperty(sassURL))
+            cssURLs = this._cssURLsForSASSURL[sassURL];
+        else {
+            cssURLs = [];
+            this._cssURLsForSASSURL[sassURL] = cssURLs;
+        }
+        if (cssURLs.indexOf(cssURL) === -1)
+            cssURLs.push(cssURL);
     },
 
     /**
@@ -129,7 +189,7 @@ WebInspector.SASSSourceMapping.prototype = {
      */
     rawLocationToUILocation: function(rawLocation)
     {
-        var location = /** @type WebInspector.CSSLocation */ rawLocation;
+        var location = /** @type WebInspector.CSSLocation */ (rawLocation);
         var uiLocation = this._uiLocations[location.url + ":" + location.lineNumber];
         if (!uiLocation) {
             var uiSourceCode = this._workspace.uiSourceCodeForURL(location.url);
diff --git a/Source/WebCore/inspector/front-end/ScopeChainSidebarPane.js b/Source/WebCore/inspector/front-end/ScopeChainSidebarPane.js
index ab692e9da..1209526b7 100644
--- a/Source/WebCore/inspector/front-end/ScopeChainSidebarPane.js
+++ b/Source/WebCore/inspector/front-end/ScopeChainSidebarPane.js
@@ -83,7 +83,7 @@ WebInspector.ScopeChainSidebarPane.prototype = {
                         var exception = details.reason === WebInspector.DebuggerModel.BreakReason.Exception ? details.auxData : 0;
                         if (exception) {
                             extraProperties = extraProperties || [];
-                            var exceptionObject = /** @type {RuntimeAgent.RemoteObject} */ exception;
+                            var exceptionObject = /** @type {RuntimeAgent.RemoteObject} */ (exception);
                             extraProperties.push(new WebInspector.RemoteObjectProperty("<exception>", WebInspector.RemoteObject.fromPayload(exceptionObject)));
                         }
                     }
diff --git a/Source/WebCore/inspector/front-end/Script.js b/Source/WebCore/inspector/front-end/Script.js
index aaf387aa7..445c5d140 100644
--- a/Source/WebCore/inspector/front-end/Script.js
+++ b/Source/WebCore/inspector/front-end/Script.js
@@ -224,7 +224,7 @@ WebInspector.Script.Location.prototype = {
      */
     uiLocation: function()
     {
-        var debuggerModelLocation = /** @type {WebInspector.DebuggerModel.Location} */ this.rawLocation();
+        var debuggerModelLocation = /** @type {WebInspector.DebuggerModel.Location} */ (this.rawLocation());
         return this._script.rawLocationToUILocation(debuggerModelLocation.lineNumber, debuggerModelLocation.columnNumber);
     },
 
diff --git a/Source/WebCore/inspector/front-end/ScriptFormatter.js b/Source/WebCore/inspector/front-end/ScriptFormatter.js
index b99eab7cd..3eedeba27 100644
--- a/Source/WebCore/inspector/front-end/ScriptFormatter.js
+++ b/Source/WebCore/inspector/front-end/ScriptFormatter.js
@@ -125,7 +125,7 @@ WebInspector.ScriptFormatter.prototype = {
     {
         if (!this._cachedWorker) {
             this._cachedWorker = new Worker("ScriptFormatterWorker.js");
-            this._cachedWorker.onmessage = /** @type {function(this:Worker)} */ this._didFormatContent.bind(this);
+            this._cachedWorker.onmessage = /** @type {function(this:Worker)} */ (this._didFormatContent.bind(this));
         }
         return this._cachedWorker;
     }
diff --git a/Source/WebCore/inspector/front-end/ScriptSnippetModel.js b/Source/WebCore/inspector/front-end/ScriptSnippetModel.js
index a6707c693..bd1f45b8f 100644
--- a/Source/WebCore/inspector/front-end/ScriptSnippetModel.js
+++ b/Source/WebCore/inspector/front-end/ScriptSnippetModel.js
@@ -32,10 +32,12 @@
  * @constructor
  * @extends {WebInspector.Object}
  * @param {WebInspector.Workspace} workspace
+ * @param {WebInspector.NetworkWorkspaceProvider} networkWorkspaceProvider
  */
-WebInspector.ScriptSnippetModel = function(workspace)
+WebInspector.ScriptSnippetModel = function(workspace, networkWorkspaceProvider)
 {
     this._workspace = workspace;
+    this._networkWorkspaceProvider = networkWorkspaceProvider;
     this._uiSourceCodeForScriptId = {};
     this._scriptForUISourceCode = new Map();
     this._uiSourceCodeForSnippetId = {};
@@ -82,14 +84,13 @@ WebInspector.ScriptSnippetModel.prototype = {
      */
     _addScriptSnippet: function(snippet)
     {
-        var uiSourceCode = new WebInspector.UISourceCode(snippet.name, new WebInspector.SnippetContentProvider(snippet), true);
-        uiSourceCode.isSnippet = true;
+        this._networkWorkspaceProvider.addFile(snippet.name, new WebInspector.SnippetContentProvider(snippet), true, false, true);
+        var uiSourceCode = this._workspace.uiSourceCodeForURL(snippet.name);
         var scriptFile = new WebInspector.SnippetScriptFile(this, uiSourceCode);
         uiSourceCode.setScriptFile(scriptFile);
         this._snippetIdForUISourceCode.put(uiSourceCode, snippet.id);
         uiSourceCode.setSourceMapping(this._snippetScriptMapping);
         this._uiSourceCodeForSnippetId[snippet.id] = uiSourceCode;
-        this._workspace.project().addUISourceCode(uiSourceCode);
         return uiSourceCode;
     },
 
@@ -105,7 +106,7 @@ WebInspector.ScriptSnippetModel.prototype = {
         this._releaseSnippetScript(uiSourceCode);
         delete this._uiSourceCodeForSnippetId[snippet.id];
         this._snippetIdForUISourceCode.remove(uiSourceCode);
-        this._workspace.project().removeUISourceCode(uiSourceCode);
+        this._networkWorkspaceProvider.removeFile(snippet.name);
     },
 
     /**
@@ -321,9 +322,7 @@ WebInspector.ScriptSnippetModel.prototype = {
      */
     _createUISourceCodeForScript: function(script)
     {
-        var uiSourceCode = new WebInspector.UISourceCode(script.sourceURL, script, false);
-        uiSourceCode.isSnippet = true;
-        this._workspace.project().addTemporaryUISourceCode(uiSourceCode);
+        var uiSourceCode = this._workspace.addTemporaryUISourceCode(script.sourceURL, script, false, true);
         uiSourceCode.setSourceMapping(this._snippetScriptMapping);
         this._uiSourceCodeForScriptId[script.scriptId] = uiSourceCode;
         this._scriptForUISourceCode.put(uiSourceCode, script);
diff --git a/Source/WebCore/inspector/front-end/ScriptsNavigator.js b/Source/WebCore/inspector/front-end/ScriptsNavigator.js
index 8477230dd..6e4860920 100644
--- a/Source/WebCore/inspector/front-end/ScriptsNavigator.js
+++ b/Source/WebCore/inspector/front-end/ScriptsNavigator.js
@@ -210,7 +210,7 @@ WebInspector.SnippetsNavigatorView.prototype = {
      */
     handleContextMenu: function(event, uiSourceCode)
     {
-        var contextMenu = new WebInspector.ContextMenu();
+        var contextMenu = new WebInspector.ContextMenu(event);
         if (uiSourceCode) {
             contextMenu.appendItem(WebInspector.UIString("Run"), this._handleEvaluateSnippet.bind(this, uiSourceCode));
             contextMenu.appendItem(WebInspector.UIString("Rename"), this._handleRenameSnippet.bind(this, uiSourceCode));
@@ -218,7 +218,7 @@ WebInspector.SnippetsNavigatorView.prototype = {
             contextMenu.appendSeparator();
         }
         contextMenu.appendItem(WebInspector.UIString("New"), this._handleCreateSnippet.bind(this));
-        contextMenu.show(event);
+        contextMenu.show();
     },
 
     /**
diff --git a/Source/WebCore/inspector/front-end/ScriptsPanel.js b/Source/WebCore/inspector/front-end/ScriptsPanel.js
index a27a45bb1..9a03ad234 100644
--- a/Source/WebCore/inspector/front-end/ScriptsPanel.js
+++ b/Source/WebCore/inspector/front-end/ScriptsPanel.js
@@ -237,7 +237,7 @@ WebInspector.ScriptsPanel.prototype = {
      */
     _uiSourceCodeAdded: function(event)
     {
-        var uiSourceCode = /** @type {WebInspector.UISourceCode} */ event.data;
+        var uiSourceCode = /** @type {WebInspector.UISourceCode} */ (event.data);
         this._addUISourceCode(uiSourceCode);
     },
 
@@ -247,7 +247,7 @@ WebInspector.ScriptsPanel.prototype = {
     _addUISourceCode: function(uiSourceCode)
     {
         if (this._toggleFormatSourceButton.toggled)
-            uiSourceCode.setFormatted(true, this._uiSourceCodeFormatted.bind(this, uiSourceCode));
+            uiSourceCode.setFormatted(true);
 
         this._navigator.addUISourceCode(uiSourceCode);
         this._editorContainer.addUISourceCode(uiSourceCode);
@@ -255,7 +255,7 @@ WebInspector.ScriptsPanel.prototype = {
 
     _uiSourceCodeRemoved: function(event)
     {
-        var uiSourceCode = /** @type {WebInspector.UISourceCode} */ event.data;
+        var uiSourceCode = /** @type {WebInspector.UISourceCode} */ (event.data);
         this._editorContainer.removeUISourceCode(uiSourceCode);
         this._navigator.removeUISourceCode(uiSourceCode);
         this._removeSourceFrame(uiSourceCode);
@@ -517,7 +517,7 @@ WebInspector.ScriptsPanel.prototype = {
                 return;
             this._editorContainer.addUISourceCode(uiSourceCode);
             if (uiSourceCode.formatted() !== this._toggleFormatSourceButton.toggled)
-                uiSourceCode.setFormatted(this._toggleFormatSourceButton.toggled, this._uiSourceCodeFormatted.bind(this, uiSourceCode));
+                uiSourceCode.setFormatted(this._toggleFormatSourceButton.toggled);
         }
         var sourceFrame = this._showFile(uiSourceCode);
         sourceFrame.revealLine(uiLocation.lineNumber);
@@ -540,7 +540,7 @@ WebInspector.ScriptsPanel.prototype = {
     _editorClosed: function(event)
     {
         this._navigatorController.hideNavigatorOverlay();
-        var uiSourceCode = /** @type {WebInspector.UISourceCode} */ event.data;
+        var uiSourceCode = /** @type {WebInspector.UISourceCode} */ (event.data);
 
         if (this._currentUISourceCode === uiSourceCode)
             delete this._currentUISourceCode;
@@ -552,7 +552,7 @@ WebInspector.ScriptsPanel.prototype = {
 
     _editorSelected: function(event)
     {
-        var uiSourceCode = /** @type {WebInspector.UISourceCode} */ event.data;
+        var uiSourceCode = /** @type {WebInspector.UISourceCode} */ (event.data);
         var sourceFrame = this._showFile(uiSourceCode);
         this._navigatorController.hideNavigatorOverlay();
         sourceFrame.focus();
@@ -561,7 +561,7 @@ WebInspector.ScriptsPanel.prototype = {
 
     _scriptSelected: function(event)
     {
-        var uiSourceCode = /** @type {WebInspector.UISourceCode} */ event.data.uiSourceCode;
+        var uiSourceCode = /** @type {WebInspector.UISourceCode} */ (event.data.uiSourceCode);
         var sourceFrame = this._showFile(uiSourceCode);
         this._navigatorController.hideNavigatorOverlay();
         if (sourceFrame && event.data.focusSource)
@@ -734,11 +734,11 @@ WebInspector.ScriptsPanel.prototype = {
         var active = event.data;
         this._toggleBreakpointsButton.toggled = active;
         if (active) {
-            this._toggleBreakpointsButton.title = WebInspector.UIString("Deactivate all breakpoints.");
+            this._toggleBreakpointsButton.title = WebInspector.UIString("Deactivate breakpoints.");
             WebInspector.inspectorView.element.removeStyleClass("breakpoints-deactivated");
             this.sidebarPanes.jsBreakpoints.listElement.removeStyleClass("breakpoints-list-deactivated");
         } else {
-            this._toggleBreakpointsButton.title = WebInspector.UIString("Activate all breakpoints.");
+            this._toggleBreakpointsButton.title = WebInspector.UIString("Activate breakpoints.");
             WebInspector.inspectorView.element.addStyleClass("breakpoints-deactivated");
             this.sidebarPanes.jsBreakpoints.listElement.addStyleClass("breakpoints-list-deactivated");
         }
@@ -795,7 +795,7 @@ WebInspector.ScriptsPanel.prototype = {
         this.stepOutButton = this._createButtonAndRegisterShortcuts(section, "scripts-step-out", title, handler, shortcuts, WebInspector.UIString("Step out"));
         debugToolbar.appendChild(this.stepOutButton);
 
-        this._toggleBreakpointsButton = new WebInspector.StatusBarButton(WebInspector.UIString("Deactivate all breakpoints."), "toggle-breakpoints");
+        this._toggleBreakpointsButton = new WebInspector.StatusBarButton(WebInspector.UIString("Deactivate breakpoints."), "toggle-breakpoints");
         this._toggleBreakpointsButton.toggled = true;
         this._toggleBreakpointsButton.addEventListener("click", this._toggleBreakpointsClicked, this);
         debugToolbar.appendChild(this._toggleBreakpointsButton.element);
@@ -918,7 +918,7 @@ WebInspector.ScriptsPanel.prototype = {
      */
     canSearchAndReplace: function()
     {
-        var view = /** @type {WebInspector.SourceFrame} */ this.visibleView;
+        var view = /** @type {WebInspector.SourceFrame} */ (this.visibleView);
         return !!view && view.canEditSource();
     },
 
@@ -927,7 +927,7 @@ WebInspector.ScriptsPanel.prototype = {
      */
     replaceSelectionWith: function(text)
     {
-        var view = /** @type {WebInspector.SourceFrame} */ this.visibleView;
+        var view = /** @type {WebInspector.SourceFrame} */ (this.visibleView);
         view.replaceSearchMatchWith(text);
     },
 
@@ -937,21 +937,16 @@ WebInspector.ScriptsPanel.prototype = {
      */
     replaceAllWith: function(query, text)
     {
-        var view = /** @type {WebInspector.SourceFrame} */ this.visibleView;
+        var view = /** @type {WebInspector.SourceFrame} */ (this.visibleView);
         view.replaceAllWith(query, text);
     },
 
-    _uiSourceCodeFormatted: function(uiSourceCode)
-    {
-        WebInspector.breakpointManager.restoreBreakpoints(uiSourceCode);
-    },
-
     _toggleFormatSource: function()
     {
         this._toggleFormatSourceButton.toggled = !this._toggleFormatSourceButton.toggled;
         var uiSourceCodes = this._workspace.uiSourceCodes();
         for (var i = 0; i < uiSourceCodes.length; ++i)
-            uiSourceCodes[i].setFormatted(this._toggleFormatSourceButton.toggled, this._uiSourceCodeFormatted.bind(this, uiSourceCodes[i]));
+            uiSourceCodes[i].setFormatted(this._toggleFormatSourceButton.toggled);
     },
 
     addToWatch: function(expression)
@@ -966,7 +961,7 @@ WebInspector.ScriptsPanel.prototype = {
             return;
 
         if (sourceFrame instanceof WebInspector.JavaScriptSourceFrame) {
-            var javaScriptSourceFrame = /** @type {WebInspector.JavaScriptSourceFrame} */ sourceFrame;
+            var javaScriptSourceFrame = /** @type {WebInspector.JavaScriptSourceFrame} */ (sourceFrame);
             javaScriptSourceFrame.toggleBreakpointOnCurrentLine();
         }            
     },
@@ -1032,8 +1027,8 @@ WebInspector.ScriptsPanel.prototype = {
 
     _fileRenamed: function(event)
     {
-        var uiSourceCode = /** @type {WebInspector.UISourceCode} */ event.data.uiSourceCode;
-        var name = /** @type {string} */ event.data.name;
+        var uiSourceCode = /** @type {WebInspector.UISourceCode} */ (event.data.uiSourceCode);
+        var name = /** @type {string} */ (event.data.name);
         if (!uiSourceCode.isSnippet)
             return;
         WebInspector.scriptSnippetModel.renameScriptSnippet(uiSourceCode, name);
@@ -1074,7 +1069,7 @@ WebInspector.ScriptsPanel.prototype = {
      */
     _itemRenamingRequested: function(event)
     {
-        var uiSourceCode = /** @type {WebInspector.UISourceCode} */ event.data;
+        var uiSourceCode = /** @type {WebInspector.UISourceCode} */ (event.data);
         
         var shouldHideNavigator = !this._navigatorController.isNavigatorPinned();
         if (this._navigatorController.isNavigatorHidden())
@@ -1105,7 +1100,7 @@ WebInspector.ScriptsPanel.prototype = {
      * @param {WebInspector.ContextMenu} contextMenu
      * @param {Object} target
      */
-    appendApplicableItems: function(contextMenu, target)
+    appendApplicableItems: function(event, contextMenu, target)
     {
         this._appendUISourceCodeItems(contextMenu, target);
         this._appendFunctionItems(contextMenu, target);
@@ -1120,7 +1115,7 @@ WebInspector.ScriptsPanel.prototype = {
         if (!(target instanceof WebInspector.UISourceCode))
             return;
 
-        var uiSourceCode = /** @type {WebInspector.UISourceCode} */ target;
+        var uiSourceCode = /** @type {WebInspector.UISourceCode} */ (target);
         contextMenu.appendItem(WebInspector.UIString("Local modifications..."), this._showLocalHistory.bind(this, uiSourceCode));
         var resource = WebInspector.resourceForURL(uiSourceCode.url);
         if (resource && resource.request)
@@ -1135,7 +1130,7 @@ WebInspector.ScriptsPanel.prototype = {
     {
         if (!(target instanceof WebInspector.RemoteObject))
             return;
-        var remoteObject = /** @type {WebInspector.RemoteObject} */ target;
+        var remoteObject = /** @type {WebInspector.RemoteObject} */ (target);
         if (remoteObject.type !== "function")
             return;
 
diff --git a/Source/WebCore/inspector/front-end/ScriptsPanelDescriptor.js b/Source/WebCore/inspector/front-end/ScriptsPanelDescriptor.js
index 99edfafef..8f387f65b 100644
--- a/Source/WebCore/inspector/front-end/ScriptsPanelDescriptor.js
+++ b/Source/WebCore/inspector/front-end/ScriptsPanelDescriptor.js
@@ -42,17 +42,17 @@ WebInspector.ScriptsPanelDescriptor.prototype = {
      * @param {WebInspector.ContextMenu} contextMenu
      * @param {Object} target
      */
-    appendApplicableItems: function(contextMenu, target)
+    appendApplicableItems: function(event, contextMenu, target)
     {
         var hasApplicableItems = target instanceof WebInspector.UISourceCode;
 
         if (!hasApplicableItems && target instanceof WebInspector.RemoteObject) {
-            var remoteObject = /** @type {WebInspector.RemoteObject} */ target;
+            var remoteObject = /** @type {WebInspector.RemoteObject} */ (target);
             if (remoteObject.type !== "function")
                 return;
         }
 
-        this.panel().appendApplicableItems(contextMenu, target);
+        this.panel().appendApplicableItems(event, contextMenu, target);
     },
 
     __proto__: WebInspector.PanelDescriptor.prototype
diff --git a/Source/WebCore/inspector/front-end/Settings.js b/Source/WebCore/inspector/front-end/Settings.js
index cc98b4cd5..cf3532dd4 100644
--- a/Source/WebCore/inspector/front-end/Settings.js
+++ b/Source/WebCore/inspector/front-end/Settings.js
@@ -55,6 +55,7 @@ var Capabilities = {
     heapProfilerPresent: false,
     canOverrideDeviceMetrics: false,
     timelineSupportsFrameInstrumentation: false,
+    timelineCanMonitorMainThread: false,
     canOverrideGeolocation: false,
     canOverrideDeviceOrientation: false,
 }
@@ -105,6 +106,10 @@ WebInspector.Settings = function()
     this.searchInContentScripts = this.createSetting("searchInContentScripts", false);
     this.textEditorIndent = this.createSetting("textEditorIndent", "    ");
     this.lastDockState = this.createSetting("lastDockState", "");
+    this.cssReloadEnabled = this.createSetting("cssReloadEnabled", false);
+    this.cssReloadTimeout = this.createSetting("cssReloadTimeout", 1000);
+    this.showCpuOnTimelineRuler = this.createSetting("showCpuOnTimelineRuler", false);
+
 
     // If there are too many breakpoints in a storage, it is likely due to a recent bug that caused
     // periodical breakpoints duplication leading to inspector slowness.
@@ -193,9 +198,6 @@ WebInspector.ExperimentsSettings = function()
     this.liveNativeMemoryChart = this._createExperiment("liveNativeMemoryChart", "Live native memory chart");
     this.fileSystemInspection = this._createExperiment("fileSystemInspection", "FileSystem inspection");
     this.canvasInspection = this._createExperiment("canvasInspection ", "Canvas inspection");
-    this.mainThreadMonitoring = this._createExperiment("mainThreadMonitoring", "Show CPU activity in Timeline");
-    this.geolocationOverride = this._createExperiment("geolocationOverride", "Override Device Geolocation");
-    this.deviceOrientationOverride = this._createExperiment("deviceOrientationOverride", "Override Device Orientation");
     this.sass = this._createExperiment("sass", "Support for SASS");
     this.codemirror = this._createExperiment("codemirror", "Use CodeMirror editor");
     this.cssRegions = this._createExperiment("cssRegions", "CSS Regions Support");
diff --git a/Source/WebCore/inspector/front-end/SettingsScreen.js b/Source/WebCore/inspector/front-end/SettingsScreen.js
index fe5aab03c..c98361cf9 100644
--- a/Source/WebCore/inspector/front-end/SettingsScreen.js
+++ b/Source/WebCore/inspector/front-end/SettingsScreen.js
@@ -276,6 +276,8 @@ WebInspector.GenericSettingsTab = function()
     p.appendChild(this._createCheckboxSetting(WebInspector.UIString("Show folders"), WebInspector.settings.showScriptFolders));
     p.appendChild(this._createCheckboxSetting(WebInspector.UIString("Search in content scripts"), WebInspector.settings.searchInContentScripts));
     p.appendChild(this._createCheckboxSetting(WebInspector.UIString("Enable source maps"), WebInspector.settings.sourceMapsEnabled));
+    if (WebInspector.experimentsSettings.isEnabled("sass"))
+        p.appendChild(this._createCSSAutoReloadControls());
     p.appendChild(this._createSelectSetting(WebInspector.UIString("Indentation"), [
             [ WebInspector.UIString("2 spaces"), WebInspector.TextEditorModel.Indent.TwoSpaces ],
             [ WebInspector.UIString("4 spaces"), WebInspector.TextEditorModel.Indent.FourSpaces ],
@@ -286,6 +288,9 @@ WebInspector.GenericSettingsTab = function()
     p = this._appendSection(WebInspector.UIString("Profiler"));
     p.appendChild(this._createCheckboxSetting(WebInspector.UIString("Show objects' hidden properties"), WebInspector.settings.showHeapSnapshotObjectsHiddenProperties));
 
+    p = this._appendSection(WebInspector.UIString("Timeline"));
+    p.appendChild(this._createCheckboxSetting(WebInspector.UIString("Show CPU activity on the ruler"), WebInspector.settings.showCpuOnTimelineRuler));
+
     p = this._appendSection(WebInspector.UIString("Console"));
     p.appendChild(this._createCheckboxSetting(WebInspector.UIString("Log XMLHttpRequests"), WebInspector.settings.monitoringXHREnabled));
     p.appendChild(this._createCheckboxSetting(WebInspector.UIString("Preserve log upon navigation"), WebInspector.settings.preserveConsoleLog));
@@ -333,6 +338,46 @@ WebInspector.GenericSettingsTab.prototype = {
         PageAgent.setScriptExecutionDisabled(WebInspector.settings.javaScriptDisabled.get(), this._updateScriptDisabledCheckbox.bind(this));
     },
 
+    _createCSSAutoReloadControls: function()
+    {
+        var fragment = document.createDocumentFragment();
+        var labelElement = fragment.createChild("label");
+        var checkboxElement = labelElement.createChild("input");
+        checkboxElement.type = "checkbox";
+        checkboxElement.checked = WebInspector.settings.cssReloadEnabled.get();
+        checkboxElement.addEventListener("click", checkboxClicked, false);
+        labelElement.appendChild(document.createTextNode(WebInspector.UIString("Auto-reload CSS upon SASS save")));
+
+        var fieldsetElement = fragment.createChild("fieldset");
+        fieldsetElement.disabled = !checkboxElement.checked;
+        var p = fieldsetElement.createChild("p");
+        p.appendChild(document.createTextNode(WebInspector.UIString("Timeout (ms)")));
+        p.appendChild(document.createTextNode(" "));
+        var timeoutInput = p.createChild("input");
+        timeoutInput.value = WebInspector.settings.cssReloadTimeout.get();
+        timeoutInput.style.width = "60px";
+        timeoutInput.maxLength = 8;
+        timeoutInput.addEventListener("blur", blurListener, false);
+        return fragment;
+
+        function checkboxClicked()
+        {
+            var reloadEnabled = checkboxElement.checked;
+            WebInspector.settings.cssReloadEnabled.set(reloadEnabled);
+            fieldsetElement.disabled = !reloadEnabled;
+        }
+
+        function blurListener()
+        {
+            var value = timeoutInput.value;
+            if (!isFinite(value) || value <= 0) {
+                timeoutInput.value = WebInspector.settings.cssReloadTimeout.get();
+                return;
+            }
+            WebInspector.settings.cssReloadTimeout.set(Number(value));
+        }
+    },
+
     __proto__: WebInspector.SettingsTab.prototype
 }
 
@@ -348,9 +393,9 @@ WebInspector.UserAgentSettingsTab = function()
     p.appendChild(this._createUserAgentControl());
     if (Capabilities.canOverrideDeviceMetrics)
         p.appendChild(this._createDeviceMetricsControl());
-    if (Capabilities.canOverrideGeolocation && WebInspector.experimentsSettings.geolocationOverride.isEnabled())
+    if (Capabilities.canOverrideGeolocation)
         p.appendChild(this._createGeolocationOverrideControl());
-    if (Capabilities.canOverrideDeviceOrientation && WebInspector.experimentsSettings.deviceOrientationOverride.isEnabled())
+    if (Capabilities.canOverrideDeviceOrientation)
         p.appendChild(this._createDeviceOrientationOverrideControl());
     p.appendChild(this._createCheckboxSetting(WebInspector.UIString("Emulate touch events"), WebInspector.settings.emulateTouchEvents));
 }
@@ -364,7 +409,7 @@ WebInspector.UserAgentSettingsTab.prototype = {
         var labelElement = p.createChild("label");
         var checkboxElement = labelElement.createChild("input");
         checkboxElement.type = "checkbox";
-        checkboxElement.checked = !!userAgent;
+        checkboxElement.checked = false;
         labelElement.appendChild(document.createTextNode(WebInspector.UIString("User Agent")));
         p.appendChild(this._createUserAgentSelectRowElement(checkboxElement));
         return p;
@@ -387,6 +432,11 @@ WebInspector.UserAgentSettingsTab.prototype = {
             ["Firefox 7 \u2014 Mac", "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:7.0.1) Gecko/20100101 Firefox/7.0.1"],
             ["Firefox 4 \u2014 Windows", "Mozilla/5.0 (Windows NT 6.1; rv:2.0.1) Gecko/20100101 Firefox/4.0.1"],
             ["Firefox 4 \u2014 Mac", "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:2.0.1) Gecko/20100101 Firefox/4.0.1"],
+            ["Firefox 14 \u2014 Android Mobile", "Mozilla/5.0 (Android; Mobile; rv:14.0) Gecko/14.0 Firefox/14.0"],
+            ["Firefox 14 \u2014 Android Tablet", "Mozilla/5.0 (Android; Tablet; rv:14.0) Gecko/14.0 Firefox/14.0"],
+
+            ["Chrome \u2014 Android Mobile", "Mozilla/5.0 (Linux; Android 4.0.4; Galaxy Nexus Build/IMM76B) AppleWebKit/535.19 (KHTML, like Gecko) Chrome/18.0.1025.133 Mobile Safari/535.19"],
+            ["Chrome \u2014 Android Tablet", "Mozilla/5.0 (Linux; Android 4.1.2; Nexus 7 Build/JZ054K) AppleWebKit/535.19 (KHTML, like Gecko) Chrome/18.0.1025.166 Safari/535.19"],
 
             ["iPhone \u2014 iOS 5", "Mozilla/5.0 (iPhone; CPU iPhone OS 5_0 like Mac OS X) AppleWebKit/534.46 (KHTML, like Gecko) Version/5.1 Mobile/9A334 Safari/7534.48.3", "640x960x1"],
             ["iPhone \u2014 iOS 4", "Mozilla/5.0 (iPhone; U; CPU iPhone OS 4_3_2 like Mac OS X; en-us) AppleWebKit/533.17.9 (KHTML, like Gecko) Version/5.0.2 Mobile/8H7 Safari/6533.18.5", "640x960x1"],
@@ -454,8 +504,8 @@ WebInspector.UserAgentSettingsTab.prototype = {
             } else {
                 this._selectElement.disabled = true;
                 this._otherUserAgentElement.disabled = true;
-                WebInspector.settings.userAgent.set("");
             }
+            WebInspector.userAgentSupport.toggleUserAgentOverride(checkboxElement.checked);
         }
         checkboxElement.addEventListener("click", checkboxClicked.bind(this), false);
 
@@ -750,11 +800,14 @@ WebInspector.UserAgentSettingsTab.prototype = {
         var cellElement = rowElement.createChild("td");
         cellElement.appendChild(document.createTextNode(WebInspector.UIString("Geolocation Position") + ":"));
         cellElement = rowElement.createChild("td");
+        cellElement.appendChild(document.createTextNode(WebInspector.UIString("Lat = ")));
         this._latitudeElement = this._createInput(cellElement, "geolocation-override-latitude", String(geolocation.latitude), this._applyGeolocationUserInput.bind(this));
         cellElement.appendChild(document.createTextNode(" , "));
+        cellElement.appendChild(document.createTextNode(WebInspector.UIString("Lon = ")));
         this._longitudeElement = this._createInput(cellElement, "geolocation-override-longitude", String(geolocation.longitude), this._applyGeolocationUserInput.bind(this));
         rowElement = tableElement.createChild("tr");
         cellElement = rowElement.createChild("td");
+        cellElement.colSpan = 2;
         var geolocationErrorLabelElement = document.createElement("label");
         var geolocationErrorCheckboxElement = geolocationErrorLabelElement.createChild("input");
         geolocationErrorCheckboxElement.id = "geolocation-error";
diff --git a/Source/WebCore/inspector/front-end/Spectrum.js b/Source/WebCore/inspector/front-end/Spectrum.js
index 4e7fdc151..bfeadb517 100644
--- a/Source/WebCore/inspector/front-end/Spectrum.js
+++ b/Source/WebCore/inspector/front-end/Spectrum.js
@@ -28,20 +28,17 @@
 
 /**
  * @constructor
- * @extends {WebInspector.Object}
+ * @extends {WebInspector.View}
  */
 WebInspector.Spectrum = function()
 {
-    this._popover = new WebInspector.Popover();
-    this._popover.setCanShrink(false);
-    this._popover.element.addEventListener("mousedown", consumeEvent, false);
+    WebInspector.View.call(this);
+    this.registerRequiredCSS("spectrum.css");
 
-    this._containerElement = document.createElement('div');
-    this._containerElement.className = "spectrum-container";
-    this._containerElement.tabIndex = 0;
-    this._containerElement.addEventListener("keydown", this._onKeyDown.bind(this), false);
+    this.element.className = "spectrum-container";
+    this.element.tabIndex = 0;
 
-    var topElement = this._containerElement.createChild("div", "spectrum-top");
+    var topElement = this.element.createChild("div", "spectrum-top");
     topElement.createChild("div", "spectrum-fill");
 
     var topInnerElement = topElement.createChild("div", "spectrum-top-inner fill");
@@ -51,7 +48,7 @@ WebInspector.Spectrum = function()
     this._sliderElement = topInnerElement.createChild("div", "spectrum-hue");
     this.slideHelper = this._sliderElement.createChild("div", "spectrum-slider");
 
-    var rangeContainer = this._containerElement.createChild("div", "spectrum-range-container");
+    var rangeContainer = this.element.createChild("div", "spectrum-range-container");
     var alphaLabel = rangeContainer.createChild("label");
     alphaLabel.textContent = WebInspector.UIString("\u03B1:");
 
@@ -65,7 +62,7 @@ WebInspector.Spectrum = function()
     swatchElement.className = "swatch";
     this._swatchInnerElement = swatchElement.createChild("span", "swatch-inner");
 
-    var displayContainer = this._containerElement.createChild("div");
+    var displayContainer = this.element.createChild("div");
     displayContainer.appendChild(swatchElement);
     this._displayElement = displayContainer.createChild("span", "source-code spectrum-display-value");
 
@@ -107,13 +104,10 @@ WebInspector.Spectrum = function()
 
         this._onchange();
     }
-
-    this._hideProxy = this.hide.bind(this, true);
 };
 
 WebInspector.Spectrum.Events = {
-    ColorChanged: "ColorChanged",
-    Hidden: "Hidden"
+    ColorChanged: "ColorChanged"
 };
 
 WebInspector.Spectrum.hsvaToRGBA = function(h, s, v, a)
@@ -323,11 +317,6 @@ WebInspector.Spectrum.prototype = {
         this._displayElement.textContent = text;
     },
 
-    get visible()
-    {
-        return this._popover.visible;
-    },
-
     _onchange: function()
     {
         this._updateUI();
@@ -378,43 +367,76 @@ WebInspector.Spectrum.prototype = {
         this._alphaElement.value = this.hsv[3] * 100;
     },
 
+    wasShown: function()
+    {
+        this.slideHeight = this._sliderElement.offsetHeight;
+        this.dragWidth = this._draggerElement.offsetWidth;
+        this.dragHeight = this._draggerElement.offsetHeight;
+        this._dragHelperElementHeight = this._dragHelperElement.offsetHeight / 2;
+        this.slideHelperHeight = this.slideHelper.offsetHeight / 2;
+        this._updateUI();
+    },
+
+    __proto__: WebInspector.View.prototype
+}
+
+/**
+ * @constructor
+ * @extends {WebInspector.Object}
+ */
+WebInspector.SpectrumPopupHelper = function()
+{
+    this._spectrum = new WebInspector.Spectrum();
+    this._spectrum.element.addEventListener("keydown", this._onKeyDown.bind(this), false);
+
+    this._popover = new WebInspector.Popover();
+    this._popover.setCanShrink(false);
+    this._popover.element.addEventListener("mousedown", consumeEvent, false);
+
+    this._hideProxy = this.hide.bind(this, true);
+}
+
+WebInspector.SpectrumPopupHelper.Events = {
+    Hidden: "Hidden"
+};
+
+WebInspector.SpectrumPopupHelper.prototype = {
+    /**
+     * @return {WebInspector.Spectrum}
+     */
+    spectrum: function()
+    {
+        return this._spectrum;
+    },
+
     toggle: function(element, color, format)
     {
-        if (this.visible)
+        if (this._popover.isShowing())
             this.hide(true);
         else
             this.show(element, color, format);
 
-        return this.visible;
+        return this._popover.isShowing();
     },
 
     show: function(element, color, format)
     {
-        if (this.visible) {
-            if (this.anchorElement === element)
+        if (this._popover.isShowing()) {
+            if (this._anchorElement === element)
                 return false;
 
             // Reopen the picker for another anchor element.
             this.hide(true);
         }
 
+        this._anchorElement = element;
+
+        this._spectrum.color = color;
+        this._spectrum._originalFormat = format || color.format;
         this.reposition(element);
-        this.anchorElement = element;
 
         document.addEventListener("mousedown", this._hideProxy, false);
         window.addEventListener("blur", this._hideProxy, false);
-
-        this.slideHeight = this._sliderElement.offsetHeight;
-        this.dragWidth = this._draggerElement.offsetWidth;
-        this.dragHeight = this._draggerElement.offsetHeight;
-        this._dragHelperElementHeight = this._dragHelperElement.offsetHeight / 2;
-        this.slideHelperHeight = this.slideHelper.offsetHeight / 2;
-
-        this.color = color;
-        this._originalFormat = format || color.format;
-
-        this._updateUI();
-
         return true;
     },
 
@@ -422,26 +444,28 @@ WebInspector.Spectrum.prototype = {
     {
         if (!this._previousFocusElement)
             this._previousFocusElement = WebInspector.currentFocusElement();
-        this._popover.show(this._containerElement, element);
-        WebInspector.setCurrentFocusElement(this._containerElement);
+        this._popover.showView(this._spectrum, element);
+        WebInspector.setCurrentFocusElement(this._spectrum.element);
     },
 
     /**
-     * @param {boolean} commitEdit
+     * @param {boolean=} commitEdit
      */
     hide: function(commitEdit)
     {
+        if (!this._popover.isShowing())
+            return;
         this._popover.hide();
 
         document.removeEventListener("mousedown", this._hideProxy, false);
         window.removeEventListener("blur", this._hideProxy, false);
 
-        this.dispatchEventToListeners(WebInspector.Spectrum.Events.Hidden, !!commitEdit);
+        this.dispatchEventToListeners(WebInspector.SpectrumPopupHelper.Events.Hidden, !!commitEdit);
 
         WebInspector.setCurrentFocusElement(this._previousFocusElement);
         delete this._previousFocusElement;
 
-        delete this.anchorElement;
+        delete this._anchorElement;
     },
 
     _onKeyDown: function(event)
@@ -459,3 +483,26 @@ WebInspector.Spectrum.prototype = {
 
     __proto__: WebInspector.Object.prototype
 }
+
+/**
+ * @constructor
+ */
+WebInspector.ColorSwatch = function()
+{
+    this.element = document.createElement("span");
+    this._swatchInnerElement = this.element.createChild("span", "swatch-inner");
+    this.element.title = WebInspector.UIString("Click to open a colorpicker. Shift-click to change color format");
+    this.element.className = "swatch";
+    this.element.addEventListener("mousedown", consumeEvent, false);
+    this.element.addEventListener("dblclick", consumeEvent, false);
+}
+
+WebInspector.ColorSwatch.prototype = {
+    /**
+     * @param {string} colorString
+     */
+    setColorString: function(colorString)
+    {
+        this._swatchInnerElement.style.backgroundColor = colorString;
+    }
+}
diff --git a/Source/WebCore/inspector/front-end/StylesSidebarPane.js b/Source/WebCore/inspector/front-end/StylesSidebarPane.js
index f6d356e97..29b0e924e 100644
--- a/Source/WebCore/inspector/front-end/StylesSidebarPane.js
+++ b/Source/WebCore/inspector/front-end/StylesSidebarPane.js
@@ -93,7 +93,8 @@ WebInspector.StylesSidebarPane = function(computedStylePane, setPseudoClassCallb
     this._sectionsContainer = document.createElement("div");
     this.bodyElement.appendChild(this._sectionsContainer);
 
-    this._spectrum = new WebInspector.Spectrum();
+    this._spectrumHelper = new WebInspector.SpectrumPopupHelper();
+    this._linkifier = new WebInspector.Linkifier(new WebInspector.Linkifier.DefaultCSSFormatter());
 
     WebInspector.cssModel.addEventListener(WebInspector.CSSStyleModel.Events.StyleSheetChanged, this._styleSheetOrMediaQueryResultChanged, this);
     WebInspector.cssModel.addEventListener(WebInspector.CSSStyleModel.Events.MediaQueryResultChanged, this._styleSheetOrMediaQueryResultChanged, this);
@@ -130,14 +131,22 @@ WebInspector.StylesSidebarPane.canonicalPropertyName = function(name)
     return match[1];
 }
 
+WebInspector.StylesSidebarPane.createExclamationMark = function(propertyName)
+{
+    var exclamationElement = document.createElement("img");
+    exclamationElement.className = "exclamation-mark";
+    exclamationElement.title = WebInspector.CSSCompletions.cssPropertiesMetainfo.keySet()[propertyName.toLowerCase()] ? WebInspector.UIString("Invalid property value.") : WebInspector.UIString("Unknown property name.");
+    return exclamationElement;
+}
+
 WebInspector.StylesSidebarPane.prototype = {
     _contextMenuEventFired: function(event)
     {
         // We start editing upon click -> default navigation to resources panel is not available
         // Hence we add a soft context menu for hrefs.
-        var contextMenu = new WebInspector.ContextMenu();
+        var contextMenu = new WebInspector.ContextMenu(event);
         contextMenu.appendApplicableItems(event.target);
-        contextMenu.show(event);
+        contextMenu.show();
     },
 
     get _forcedPseudoClasses()
@@ -161,8 +170,7 @@ WebInspector.StylesSidebarPane.prototype = {
 
     update: function(node, forceUpdate)
     {
-        if (this._spectrum.visible)
-            this._spectrum.hide(false);
+        this._spectrumHelper.hide();
 
         var refresh = false;
 
@@ -353,6 +361,7 @@ WebInspector.StylesSidebarPane.prototype = {
     {
         this._sectionsContainer.removeChildren();
         this._computedStylePane.bodyElement.removeChildren();
+        this._linkifier.reset();
 
         var styleRules = this._rebuildStyleRules(node, styles);
         var usedProperties = {};
@@ -785,8 +794,7 @@ WebInspector.StylesSidebarPane.prototype = {
 
     willHide: function()
     {
-        if (this._spectrum.visible)
-            this._spectrum.hide(false);
+        this._spectrumHelper.hide();
     },
 
     __proto__: WebInspector.SidebarPane.prototype
@@ -1191,13 +1199,8 @@ WebInspector.StylePropertiesSection.prototype = {
             return link;
         }
 
-        if (this.styleRule.sourceURL) {
-            var uiLocation = this.rule.uiLocation();
-            if (uiLocation)
-                return linkifyUncopyable(uiLocation.url(), uiLocation.lineNumber);
-            else
-                return linkifyUncopyable(this.styleRule.sourceURL, this.rule.sourceLine);
-        }
+        if (this.styleRule.sourceURL)
+            return this._parentPane._linkifier.linkifyCSSRuleLocation(this.rule) || linkifyUncopyable(this.styleRule.sourceURL, this.rule.sourceLine);
 
         if (!this.rule)
             return document.createTextNode("");
@@ -1234,6 +1237,9 @@ WebInspector.StylePropertiesSection.prototype = {
         if (!this.editable)
             return;
 
+        if (!window.getSelection().isCollapsed)
+            return;
+
         if (this._checkWillCancelEditing())
             return;
 
@@ -1456,8 +1462,10 @@ WebInspector.ComputedStylePropertiesSection.prototype = {
                     treeElement.appendChild(childElement);
                     if (property.inactive || section.isPropertyOverloaded(property.name))
                         childElement.listItemElement.addStyleClass("overloaded");
-                    if (!property.parsedOk)
+                    if (!property.parsedOk) {
                         childElement.listItemElement.addStyleClass("not-parsed-ok");
+                        childElement.listItemElement.insertBefore(WebInspector.StylesSidebarPane.createExclamationMark(property.name), childElement.listItemElement.firstChild);
+                    }
                 }
             }
         }
@@ -1759,32 +1767,21 @@ WebInspector.StylePropertyTreeElement.prototype = {
 
                 var format = getFormat();
                 var hasSpectrum = self._parentPane;
-                var spectrum = hasSpectrum ? self._parentPane._spectrum : null;
+                var spectrumHelper = hasSpectrum ? self._parentPane._spectrumHelper : null;
+                var spectrum = spectrumHelper ? spectrumHelper.spectrum() : null;
 
-                var swatchElement = document.createElement("span");
-                var swatchInnerElement = swatchElement.createChild("span", "swatch-inner");
-                swatchElement.title = WebInspector.UIString("Click to open a colorpicker. Shift-click to change color format");
-
-                swatchElement.className = "swatch";
-
-                swatchElement.addEventListener("mousedown", consumeEvent, false);
-                swatchElement.addEventListener("click", swatchClick, false);
-                swatchElement.addEventListener("dblclick", consumeEvent, false);
-
-                swatchInnerElement.style.backgroundColor = text;
+                var colorSwatch = new WebInspector.ColorSwatch();
+                colorSwatch.setColorString(text);
+                colorSwatch.element.addEventListener("click", swatchClick, false);
 
                 var scrollerElement = hasSpectrum ? self._parentPane._computedStylePane.element.parentElement : null;
 
                 function spectrumChanged(e)
                 {
                     color = e.data;
-
                     var colorString = color.toString();
-
                     colorValueElement.textContent = colorString;
-                    spectrum.displayText = colorString;
-                    swatchInnerElement.style.backgroundColor = colorString;
-
+                    colorSwatch.setColorString(colorString);
                     self.applyStyleText(nameElement.textContent + ": " + valueElement.textContent, false, false, false);
                 }
 
@@ -1795,7 +1792,7 @@ WebInspector.StylePropertyTreeElement.prototype = {
                     var propertyText = !commitEdit && self.originalPropertyText ? self.originalPropertyText : (nameElement.textContent + ": " + valueElement.textContent);
                     self.applyStyleText(propertyText, true, true, false);
                     spectrum.removeEventListener(WebInspector.Spectrum.Events.ColorChanged, spectrumChanged);
-                    spectrum.removeEventListener(WebInspector.Spectrum.Events.Hidden, spectrumHidden);
+                    spectrumHelper.removeEventListener(WebInspector.SpectrumPopupHelper.Events.Hidden, spectrumHidden);
 
                     delete self._parentPane._isEditingStyle;
                     delete self.originalPropertyText;
@@ -1803,24 +1800,24 @@ WebInspector.StylePropertyTreeElement.prototype = {
 
                 function repositionSpectrum()
                 {
-                    spectrum.reposition(swatchElement);
+                    spectrumHelper.reposition(colorSwatch.element);
                 }
 
                 function swatchClick(e)
                 {
                     // Shift + click toggles color formats.
                     // Click opens colorpicker, only if the element is not in computed styles section.
-                    if (!spectrum || e.shiftKey)
+                    if (!spectrumHelper || e.shiftKey)
                         changeColorDisplay(e);
                     else {
-                        var visible = spectrum.toggle(swatchElement, color, format);
+                        var visible = spectrumHelper.toggle(colorSwatch.element, color, format);
 
                         if (visible) {
                             spectrum.displayText = color.toString(format);
                             self.originalPropertyText = self.property.propertyText;
                             self._parentPane._isEditingStyle = true;
                             spectrum.addEventListener(WebInspector.Spectrum.Events.ColorChanged, spectrumChanged);
-                            spectrum.addEventListener(WebInspector.Spectrum.Events.Hidden, spectrumHidden);
+                            spectrumHelper.addEventListener(WebInspector.SpectrumPopupHelper.Events.Hidden, spectrumHidden);
 
                             scrollerElement.addEventListener("scroll", repositionSpectrum, false);
                         }
@@ -1907,7 +1904,7 @@ WebInspector.StylePropertyTreeElement.prototype = {
                 }
 
                 var container = document.createElement("nobr");
-                container.appendChild(swatchElement);
+                container.appendChild(colorSwatch.element);
                 container.appendChild(colorValueElement);
                 return container;
             }
@@ -1940,10 +1937,7 @@ WebInspector.StylePropertyTreeElement.prototype = {
             this.listItemElement.addStyleClass("not-parsed-ok");
 
             // Add a separate exclamation mark IMG element with a tooltip.
-            var exclamationElement = document.createElement("img");
-            exclamationElement.className = "exclamation-mark";
-            exclamationElement.title = WebInspector.CSSCompletions.cssPropertiesMetainfo.keySet()[this.property.name.toLowerCase()] ? WebInspector.UIString("Invalid property value.") : WebInspector.UIString("Unknown property name.");
-            this.listItemElement.insertBefore(exclamationElement, this.listItemElement.firstChild);
+            this.listItemElement.insertBefore(WebInspector.StylesSidebarPane.createExclamationMark(this.property.name), this.listItemElement.firstChild);
         }
         if (this.property.inactive)
             this.listItemElement.addStyleClass("inactive");
@@ -2048,6 +2042,9 @@ WebInspector.StylePropertyTreeElement.prototype = {
 
     _mouseClick: function(event)
     {
+        if (!window.getSelection().isCollapsed)
+            return;
+
         event.consume(true);
 
         if (event.target === this.listItemElement) {
diff --git a/Source/WebCore/inspector/front-end/StylesSourceMapping.js b/Source/WebCore/inspector/front-end/StylesSourceMapping.js
index 4de7509dc..bd7e26c2a 100644
--- a/Source/WebCore/inspector/front-end/StylesSourceMapping.js
+++ b/Source/WebCore/inspector/front-end/StylesSourceMapping.js
@@ -49,7 +49,7 @@ WebInspector.StylesSourceMapping.prototype = {
      */
     rawLocationToUILocation: function(rawLocation)
     {
-        var location = /** @type WebInspector.CSSLocation */ rawLocation;
+        var location = /** @type WebInspector.CSSLocation */ (rawLocation);
         var uiSourceCode = this._uiSourceCodeForURL[location.url];
         return new WebInspector.UILocation(uiSourceCode, location.lineNumber, 0);
     },
@@ -67,7 +67,7 @@ WebInspector.StylesSourceMapping.prototype = {
 
     _uiSourceCodeAddedToWorkspace: function(event)
     {
-        var uiSourceCode = /** @type {WebInspector.UISourceCode} */ event.data;
+        var uiSourceCode = /** @type {WebInspector.UISourceCode} */ (event.data);
         if (!uiSourceCode.url || this._uiSourceCodeForURL[uiSourceCode.url])
             return;
         if (uiSourceCode.contentType() !== WebInspector.resourceTypes.Stylesheet)
diff --git a/Source/WebCore/inspector/front-end/TabbedEditorContainer.js b/Source/WebCore/inspector/front-end/TabbedEditorContainer.js
index d4a4e9e0a..056adbca1 100644
--- a/Source/WebCore/inspector/front-end/TabbedEditorContainer.js
+++ b/Source/WebCore/inspector/front-end/TabbedEditorContainer.js
@@ -127,14 +127,14 @@ WebInspector.TabbedEditorContainer.prototype = {
 
     _scrollChanged: function(event)
     {
-        var lineNumber = /** @type {number} */ event.data;
+        var lineNumber = /** @type {number} */ (event.data);
         this._history.updateScrollLineNumber(this._currentFile.url, lineNumber);
         this._history.save(this._previouslyViewedFilesSetting);
     },
 
     _selectionChanged: function(event)
     {
-        var range = /** @type {WebInspector.TextRange} */ event.data;
+        var range = /** @type {WebInspector.TextRange} */ (event.data);
         this._history.updateSelectionRange(this._currentFile.url, range);
         this._history.save(this._previouslyViewedFilesSetting);
     },
@@ -295,8 +295,8 @@ WebInspector.TabbedEditorContainer.prototype = {
      */
     _tabClosed: function(event)
     {
-        var tabId = /** @type {string} */ event.data.tabId;
-        var userGesture = /** @type {boolean} */ event.data.isUserGesture;
+        var tabId = /** @type {string} */ (event.data.tabId);
+        var userGesture = /** @type {boolean} */ (event.data.isUserGesture);
 
         var uiSourceCode = this._files[tabId];
         if (this._currentFile === uiSourceCode) {
@@ -319,8 +319,8 @@ WebInspector.TabbedEditorContainer.prototype = {
      */
     _tabSelected: function(event)
     {
-        var tabId = /** @type {string} */ event.data.tabId;
-        var userGesture = /** @type {boolean} */ event.data.isUserGesture;
+        var tabId = /** @type {string} */ (event.data.tabId);
+        var userGesture = /** @type {boolean} */ (event.data.isUserGesture);
 
         var uiSourceCode = this._files[tabId];
         this._innerShowFile(uiSourceCode, userGesture);
@@ -362,25 +362,25 @@ WebInspector.TabbedEditorContainer.prototype = {
 
     _uiSourceCodeTitleChanged: function(event)
     {
-        var uiSourceCode = /** @type {WebInspector.UISourceCode} */ event.target;
+        var uiSourceCode = /** @type {WebInspector.UISourceCode} */ (event.target);
         this._updateFileTitle(uiSourceCode);
     },
 
     _uiSourceCodeWorkingCopyChanged: function(event)
     {
-        var uiSourceCode = /** @type {WebInspector.UISourceCode} */ event.target;
+        var uiSourceCode = /** @type {WebInspector.UISourceCode} */ (event.target);
         this._updateFileTitle(uiSourceCode);
     },
 
     _uiSourceCodeWorkingCopyCommitted: function(event)
     {
-        var uiSourceCode = /** @type {WebInspector.UISourceCode} */ event.target;
+        var uiSourceCode = /** @type {WebInspector.UISourceCode} */ (event.target);
         this._updateFileTitle(uiSourceCode);
     },
 
     _uiSourceCodeFormattedChanged: function(event)
     {
-        var uiSourceCode = /** @type {WebInspector.UISourceCode} */ event.target;
+        var uiSourceCode = /** @type {WebInspector.UISourceCode} */ (event.target);
         this._updateFileTitle(uiSourceCode);
     },
 
diff --git a/Source/WebCore/inspector/front-end/TabbedPane.js b/Source/WebCore/inspector/front-end/TabbedPane.js
index 19b787fa9..70d56619e 100644
--- a/Source/WebCore/inspector/front-end/TabbedPane.js
+++ b/Source/WebCore/inspector/front-end/TabbedPane.js
@@ -45,6 +45,7 @@ WebInspector.TabbedPane = function()
     this._tabsHistory = [];
     this._tabsById = {};
     this.element.addEventListener("click", this.focus.bind(this), false);
+    this.element.addEventListener("mouseup", this.onMouseUp.bind(this), false);
 
     this._dropDownButton = this._createDropDownButton();
 }
@@ -93,6 +94,16 @@ WebInspector.TabbedPane.prototype = {
     },
 
     /**
+     * @param {Event} event
+     */
+    onMouseUp: function(event)
+    {
+        // This is needed to prevent middle-click pasting on linux when tabs are clicked.
+        if (event.button === 1)
+            event.consume(true);
+    },
+
+    /**
      * @param {string} id
      * @param {string} tabTitle
      * @param {WebInspector.View} view
@@ -713,11 +724,11 @@ WebInspector.TabbedPaneTab.prototype = {
             this._tabbedPane.closeAllTabs(true);
         }
   
-        var contextMenu = new WebInspector.ContextMenu();
+        var contextMenu = new WebInspector.ContextMenu(event);
         contextMenu.appendItem(WebInspector.UIString("Close"), close.bind(this));
         contextMenu.appendItem(WebInspector.UIString("Close Others"), closeOthers.bind(this));
         contextMenu.appendItem(WebInspector.UIString("Close All"), closeAll.bind(this));
-        contextMenu.show(event);
+        contextMenu.show();
     },
 
     /**
diff --git a/Source/WebCore/inspector/front-end/TimelineModel.js b/Source/WebCore/inspector/front-end/TimelineModel.js
index e50cd5b60..924d353a6 100644
--- a/Source/WebCore/inspector/front-end/TimelineModel.js
+++ b/Source/WebCore/inspector/front-end/TimelineModel.js
@@ -295,7 +295,7 @@ WebInspector.TimelineModelLoader.prototype = {
 
         var items;
         try {
-            items = /** @type {Array} */ JSON.parse(json);
+            items = /** @type {Array} */ (JSON.parse(json));
         } catch (e) {
             WebInspector.showErrorMessage("Malformed timeline data.");
             this._model.reset();
diff --git a/Source/WebCore/inspector/front-end/TimelineOverviewPane.js b/Source/WebCore/inspector/front-end/TimelineOverviewPane.js
index 5c8ddc77c..dec588b9a 100644
--- a/Source/WebCore/inspector/front-end/TimelineOverviewPane.js
+++ b/Source/WebCore/inspector/front-end/TimelineOverviewPane.js
@@ -940,7 +940,8 @@ WebInspector.TimelineCategoryStrips.prototype = {
             // This bar may be merged with previous -- so just adjust the previous bar.
             const barsMergeThreshold = 2;
             if (bar && bar.category === category && bar.end + barsMergeThreshold >= recordStart) {
-                bar.end = recordEnd;
+                if (recordEnd > bar.end)
+                    bar.end = recordEnd;
                 return;
             }
             if (bar)
diff --git a/Source/WebCore/inspector/front-end/TimelinePanel.js b/Source/WebCore/inspector/front-end/TimelinePanel.js
index 50f4b6ada..d31c80a9b 100644
--- a/Source/WebCore/inspector/front-end/TimelinePanel.js
+++ b/Source/WebCore/inspector/front-end/TimelinePanel.js
@@ -131,9 +131,9 @@ WebInspector.TimelinePanel = function()
 
     this._headerLineCount = 1;
 
-    this._mainThreadTasks = [];
+    this._mainThreadTasks = /** @type {!Array.<{startTime: number, endTime: number}>} */ ([]);
     this._mainThreadMonitoringEnabled = false;
-    if (WebInspector.experimentsSettings.mainThreadMonitoring.isEnabled())
+    if (WebInspector.settings.showCpuOnTimelineRuler.get() && Capabilities.timelineCanMonitorMainThread)
         this._enableMainThreadMonitoring();
 
     this._createFileSelector();
@@ -334,11 +334,11 @@ WebInspector.TimelinePanel.prototype = {
 
     _contextMenu: function(event)
     {
-        var contextMenu = new WebInspector.ContextMenu();
+        var contextMenu = new WebInspector.ContextMenu(event);
         if (InspectorFrontendHost.canSave())
             contextMenu.appendItem(WebInspector.UIString("Save Timeline data\u2026"), this._saveToFile.bind(this), this._operationInProgress);
         contextMenu.appendItem(WebInspector.UIString("Load Timeline data\u2026"), this._fileSelectorElement.click.bind(this._fileSelectorElement), this._operationInProgress);
-        contextMenu.show(event);
+        contextMenu.show();
     },
 
     _saveToFile: function()
@@ -553,17 +553,17 @@ WebInspector.TimelinePanel.prototype = {
         this._automaticallySizeWindow = false;
         var records = this._model.records;
         for (var i = 0; i < records.length; ++i)
-            this._innerAddRecordToTimeline(records[i], this._rootRecord());
+            this._innerAddRecordToTimeline(records[i]);
         this._invalidateAndScheduleRefresh(false);
     },
 
     _onTimelineEventRecorded: function(event)
     {
-        if (this._innerAddRecordToTimeline(event.data, this._rootRecord()))
+        if (this._innerAddRecordToTimeline(event.data))
             this._invalidateAndScheduleRefresh(false);
     },
 
-    _innerAddRecordToTimeline: function(record, parentRecord)
+    _innerAddRecordToTimeline: function(record)
     {
         if (record.type === WebInspector.TimelineModel.RecordType.Program) {
             this._mainThreadTasks.push({
@@ -572,7 +572,7 @@ WebInspector.TimelinePanel.prototype = {
             });
         }
 
-        var records = this._presentationModel.addRecord(record, parentRecord);
+        var records = this._presentationModel.addRecord(record);
         this._allRecordsCount += records.length;
         var timeStampRecords = this._timeStampRecords;
         var hasVisibleRecords = false;
@@ -875,7 +875,7 @@ WebInspector.TimelinePanel.prototype = {
         var taskIndex = insertionIndexForObjectInListSortedByFunction(startTime, tasks, compareEndTime);
 
         var container = this._cpuBarsElement;
-        var element = container.firstChild.nextSibling;
+        var element = container.firstChild;
         var lastElement;
         var lastLeft;
         var lastRight;
@@ -893,6 +893,7 @@ WebInspector.TimelinePanel.prototype = {
                 var gap = Math.floor(left) - Math.ceil(lastRight);
                 if (gap < minGap) {
                     lastRight = right;
+                    lastElement._tasksInfo.lastTaskIndex = taskIndex;
                     continue;
                 }
                 lastElement.style.width = (lastRight - lastLeft) + "px";
@@ -902,6 +903,7 @@ WebInspector.TimelinePanel.prototype = {
                 element = container.createChild("div", "timeline-graph-bar");
 
             element.style.left = left + "px";
+            element._tasksInfo = {tasks: tasks, firstTaskIndex: taskIndex, lastTaskIndex: taskIndex};
             lastLeft = left;
             lastRight = right;
 
@@ -914,6 +916,7 @@ WebInspector.TimelinePanel.prototype = {
 
         while (element) {
             var nextElement = element.nextSibling;
+            element._tasksInfo = null;
             container.removeChild(element);
             element = nextElement;
         }
@@ -921,12 +924,8 @@ WebInspector.TimelinePanel.prototype = {
 
     _enableMainThreadMonitoring: function()
     {
-        ++this._headerLineCount;
-
         var container = this._timelineGrid.gridHeaderElement;
-        this._cpuBarsElement = container.createChild("div", "timeline-cpu-bars timeline-category-program");
-        var cpuBarsLabel = this._cpuBarsElement.createChild("span", "timeline-cpu-bars-label");
-        cpuBarsLabel.textContent = WebInspector.UIString("CPU");
+        this._cpuBarsElement = container.createChild("div", "timeline-cpu-bars");
 
         const headerBorderWidth = 1;
         const headerMargin = 2;
@@ -997,6 +996,8 @@ WebInspector.TimelinePanel.prototype = {
         } else {
             if (anchor.row && anchor.row._record)
                 anchor.row._record.generatePopupContent(showCallback);
+            else if (anchor._tasksInfo)
+                popover.show(this._presentationModel.generateMainThreadBarPopupContent(anchor._tasksInfo), anchor);
         }
 
         function showCallback(popupContent)
diff --git a/Source/WebCore/inspector/front-end/TimelinePresentationModel.js b/Source/WebCore/inspector/front-end/TimelinePresentationModel.js
index 7020d1aa3..744ee89f8 100644
--- a/Source/WebCore/inspector/front-end/TimelinePresentationModel.js
+++ b/Source/WebCore/inspector/front-end/TimelinePresentationModel.js
@@ -274,7 +274,7 @@ WebInspector.TimelinePresentationModel.prototype = {
         this._frames.push(frame);
     },
 
-    addRecord: function(record, parentRecord)
+    addRecord: function(record)
     {
         if (this._minimumRecordTime === -1 || record.startTime < this._minimumRecordTime)
             this._minimumRecordTime = WebInspector.TimelineModel.startTimeInSeconds(record);
@@ -288,7 +288,7 @@ WebInspector.TimelinePresentationModel.prototype = {
         var formattedRecords = [];
         var recordsCount = records.length;
         for (var i = 0; i < recordsCount; ++i)
-            formattedRecords.push(this._innerAddRecord(records[i], parentRecord));
+            formattedRecords.push(this._innerAddRecord(records[i], this._rootRecord));
         return formattedRecords;
     },
 
@@ -442,6 +442,36 @@ WebInspector.TimelinePresentationModel.prototype = {
         return true;
     },
 
+    /**
+     * @param {{tasks: !Array.<{startTime: number, endTime: number}>, firstTaskIndex: number, lastTaskIndex: number}} info
+     * @return {!Element}
+     */
+    generateMainThreadBarPopupContent: function(info)
+    {
+        var firstTaskIndex = info.firstTaskIndex;
+        var lastTaskIndex = info.lastTaskIndex;
+        var tasks = info.tasks;
+        var messageCount = lastTaskIndex - firstTaskIndex + 1;
+        var cpuTime = 0;
+
+        for (var i = firstTaskIndex; i <= lastTaskIndex; ++i) {
+            var task = tasks[i];
+            cpuTime += task.endTime - task.startTime;
+        }
+        var startTime = tasks[firstTaskIndex].startTime;
+        var endTime = tasks[lastTaskIndex].endTime;
+        var duration = endTime - startTime;
+        var offset = this._minimumRecordTime;
+
+        var contentHelper = new WebInspector.TimelinePresentationModel.PopupContentHelper(WebInspector.UIString("CPU"));
+        var durationText = WebInspector.UIString("%s (at %s)", Number.secondsToString(duration, true),
+            Number.secondsToString(startTime - offset, true));
+        contentHelper._appendTextRow(WebInspector.UIString("Duration"), durationText);
+        contentHelper._appendTextRow(WebInspector.UIString("CPU time"), Number.secondsToString(cpuTime, true));
+        contentHelper._appendTextRow(WebInspector.UIString("Message Count"), messageCount);
+        return contentHelper._contentTable;
+    },
+
     __proto__: WebInspector.Object.prototype
 }
 
diff --git a/Source/WebCore/inspector/front-end/Toolbar.js b/Source/WebCore/inspector/front-end/Toolbar.js
index 5756e73d7..0d2d7285d 100644
--- a/Source/WebCore/inspector/front-end/Toolbar.js
+++ b/Source/WebCore/inspector/front-end/Toolbar.js
@@ -183,7 +183,6 @@ WebInspector.Toolbar.prototype = {
     {
         this._setDropdownVisible(false);
 
-        var toolbar = document.getElementById("toolbar");
         if (this.element.scrollHeight > this.element.clientHeight)
             this._dropdownButton.removeStyleClass("hidden");
         else
@@ -217,7 +216,7 @@ WebInspector.ToolbarDropdown.prototype = {
         var top = this._arrow.totalOffsetTop() + this._arrow.clientHeight;
         this._arrow.addStyleClass("dropdown-visible");
         this.element.style.top = top + "px";
-        this.element.style.left = this._arrow.totalOffsetLeft() + "px";
+        this.element.style.right = window.innerWidth - this._arrow.totalOffsetLeft() - this._arrow.clientWidth + "px";
         this._contentElement.style.maxHeight = window.innerHeight - top - 20 + "px";
         this._toolbar.element.appendChild(this.element);
     },
diff --git a/Source/WebCore/inspector/front-end/UISourceCode.js b/Source/WebCore/inspector/front-end/UISourceCode.js
index 32010a40b..98a514651 100644
--- a/Source/WebCore/inspector/front-end/UISourceCode.js
+++ b/Source/WebCore/inspector/front-end/UISourceCode.js
@@ -33,17 +33,18 @@
  * @constructor
  * @extends {WebInspector.Object}
  * @implements {WebInspector.ContentProvider}
+ * @param {WebInspector.Workspace} workspace
  * @param {string} url
- * @param {WebInspector.ContentProvider} contentProvider
+ * @param {WebInspector.ResourceType} contentType
  * @param {boolean} isEditable
  */
-WebInspector.UISourceCode = function(url, contentProvider, isEditable)
+WebInspector.UISourceCode = function(workspace, url, contentType, isEditable)
 {
+    this._workspace = workspace;
     this._url = url;
     this._parsedURL = new WebInspector.ParsedURL(url);
-    this._contentProvider = contentProvider;
+    this._contentType = contentType;
     this._isEditable = isEditable;
-    this.isContentScript = false;
     /**
      * @type Array.<function(?string,boolean,string)>
      */
@@ -73,7 +74,8 @@ WebInspector.UISourceCode.Events = {
     TitleChanged: "TitleChanged",
     ConsoleMessageAdded: "ConsoleMessageAdded",
     ConsoleMessageRemoved: "ConsoleMessageRemoved",
-    ConsoleMessagesCleared: "ConsoleMessagesCleared"
+    ConsoleMessagesCleared: "ConsoleMessagesCleared",
+    SourceMappingChanged: "SourceMappingChanged",
 }
 
 WebInspector.UISourceCode.prototype = {
@@ -116,7 +118,7 @@ WebInspector.UISourceCode.prototype = {
      */
     contentType: function()
     {
-        return this._contentProvider.contentType();
+        return this._contentType;
     },
 
     /**
@@ -162,7 +164,7 @@ WebInspector.UISourceCode.prototype = {
         }
         this._requestContentCallbacks.push(callback);
         if (this._requestContentCallbacks.length === 1)
-            this._contentProvider.requestContent(this._fireContentAvailable.bind(this));
+            this._workspace.requestFileContent(this, this._fireContentAvailable.bind(this));
     },
 
     /**
@@ -170,7 +172,7 @@ WebInspector.UISourceCode.prototype = {
      */
     requestOriginalContent: function(callback)
     {
-        this._contentProvider.requestContent(callback);
+        this._workspace.requestFileContent(this, callback);
     },
 
     /**
@@ -191,7 +193,7 @@ WebInspector.UISourceCode.prototype = {
         var oldWorkingCopy = this._workingCopy;
         delete this._workingCopy;
         this.dispatchEventToListeners(WebInspector.UISourceCode.Events.WorkingCopyCommitted, {oldWorkingCopy: oldWorkingCopy, workingCopy: this.workingCopy()});
-        WebInspector.workspace.dispatchEventToListeners(WebInspector.Workspace.Events.UISourceCodeContentCommitted, { uiSourceCode: this, content: this._content });
+        this._workspace.dispatchEventToListeners(WebInspector.Workspace.Events.UISourceCodeContentCommitted, { uiSourceCode: this, content: this._content });
         if (this._url && WebInspector.fileManager.isURLSaved(this._url)) {
             WebInspector.fileManager.save(this._url, this._content, false);
             WebInspector.fileManager.close(this._url);
@@ -371,8 +373,13 @@ WebInspector.UISourceCode.prototype = {
     searchInContent: function(query, caseSensitive, isRegex, callback)
     {
         var content = this.content();
-        var provider = content ? new WebInspector.StaticContentProvider(this._contentProvider.contentType(), content) : this._contentProvider;
-        provider.searchInContent(query, caseSensitive, isRegex, callback);
+        if (content) {
+            var provider = new WebInspector.StaticContentProvider(this.contentType(), content);
+            provider.searchInContent(query, caseSensitive, isRegex, callback);
+            return;
+        }
+
+        this._workspace.searchInFileContent(this, query, caseSensitive, isRegex, callback);
     },
 
     /**
@@ -392,16 +399,8 @@ WebInspector.UISourceCode.prototype = {
             callbacks[i](content, contentEncoded, mimeType);
 
         if (this._formatOnLoad) {
-            function formattedCallback()
-            {
-                for (var i = 0; i < this._pendingFormattedCallbacks.length; ++i)
-                    this._pendingFormattedCallbacks[i]();
-                delete this._pendingFormattedCallbacks;
-                
-            }
-
             delete this._formatOnLoad;
-            this.setFormatted(true, formattedCallback.bind(this));
+            this.setFormatted(true);
         }
     },
 
@@ -495,14 +494,6 @@ WebInspector.UISourceCode.prototype = {
     /**
      * @return {boolean}
      */
-    togglingFormatter: function()
-    {
-        return this._togglingFormatter;
-    },
-
-    /**
-     * @return {boolean}
-     */
     formatted: function()
     {
         return !!this._formatted;
@@ -510,23 +501,16 @@ WebInspector.UISourceCode.prototype = {
 
     /**
      * @param {boolean} formatted
-     * @param {function()=} callback
      */
-    setFormatted: function(formatted, callback)
+    setFormatted: function(formatted)
     {
-        callback = callback || function() {};
         if (!this.contentLoaded()) {
-            if (!this._pendingFormattedCallbacks)
-                this._pendingFormattedCallbacks = [];
-            this._pendingFormattedCallbacks.push(callback);
             this._formatOnLoad = formatted;
             return;
         }
 
-        if (this._formatted === formatted) {
-            callback();
+        if (this._formatted === formatted)
             return;
-        }
 
         this._formatted = formatted;
 
@@ -557,14 +541,11 @@ WebInspector.UISourceCode.prototype = {
              */
             function formattedChanged(content, formatterMapping)
             {
-                this._togglingFormatter = true;
                 this._content = content;
                 delete this._workingCopy;
-                this.dispatchEventToListeners(WebInspector.UISourceCode.Events.FormattedChanged, {content: content});
-                delete this._togglingFormatter;
                 this._formatterMapping = formatterMapping;
+                this.dispatchEventToListeners(WebInspector.UISourceCode.Events.FormattedChanged, {content: content});
                 this.updateLiveLocations();
-                callback();
             }
         }
     },
@@ -584,6 +565,7 @@ WebInspector.UISourceCode.prototype = {
     setSourceMapping: function(sourceMapping)
     {
         this._sourceMapping = sourceMapping;
+        this.dispatchEventToListeners(WebInspector.UISourceCode.Events.SourceMappingChanged, null);
     },
 
     __proto__: WebInspector.Object.prototype
diff --git a/Source/WebCore/inspector/front-end/UISourceCodeFrame.js b/Source/WebCore/inspector/front-end/UISourceCodeFrame.js
index 7e0bf51cd..43d762dbe 100644
--- a/Source/WebCore/inspector/front-end/UISourceCodeFrame.js
+++ b/Source/WebCore/inspector/front-end/UISourceCodeFrame.js
@@ -82,7 +82,7 @@ WebInspector.UISourceCodeFrame.prototype = {
      */
     _onFormattedChanged: function(event)
     {
-        var content = /** @type {string} */ event.data.content;
+        var content = /** @type {string} */ (event.data.content);
         this._innerSetContent(content);
     },
 
diff --git a/Source/WebCore/inspector/front-end/UserAgentSupport.js b/Source/WebCore/inspector/front-end/UserAgentSupport.js
index b3edc6677..4859f65fc 100644
--- a/Source/WebCore/inspector/front-end/UserAgentSupport.js
+++ b/Source/WebCore/inspector/front-end/UserAgentSupport.js
@@ -33,10 +33,12 @@
  */
 WebInspector.UserAgentSupport = function()
 {
+    this._userAgentOverrideEnabled = false;
     this._deviceMetricsOverrideEnabled = false;
     this._geolocationPositionOverrideEnabled = false;
     this._deviceOrientationOverrideEnabled = false;
 
+    WebInspector.settings.userAgent.addChangeListener(this._userAgentChanged, this);
     WebInspector.settings.deviceMetrics.addChangeListener(this._deviceMetricsChanged, this);
     WebInspector.settings.deviceFitWindow.addChangeListener(this._deviceMetricsChanged, this);
     WebInspector.settings.geolocationOverride.addChangeListener(this._geolocationPositionChanged, this);
@@ -307,6 +309,14 @@ WebInspector.UserAgentSupport.DeviceOrientation.clearDeviceOrientationOverride =
 }
 
 WebInspector.UserAgentSupport.prototype = {
+    toggleUserAgentOverride: function(enabled)
+    {
+        if (enabled === this._userAgentOverrideEnabled)
+            return;
+        this._userAgentOverrideEnabled = enabled;
+        this._userAgentChanged();
+    },
+
     toggleDeviceMetricsOverride: function(enabled)
     {
         if (enabled === this._deviceMetricsOverrideEnabled)
@@ -331,6 +341,11 @@ WebInspector.UserAgentSupport.prototype = {
         this._deviceOrientationChanged();
     },
 
+    _userAgentChanged: function()
+    {
+        NetworkAgent.setUserAgentOverride(this._userAgentOverrideEnabled ? WebInspector.settings.userAgent.get() : "");
+    },
+
     _deviceMetricsChanged: function()
     {
         var metrics = WebInspector.UserAgentSupport.DeviceMetrics.parseSetting(this._deviceMetricsOverrideEnabled ? WebInspector.settings.deviceMetrics.get() : "");
diff --git a/Source/WebCore/inspector/front-end/View.js b/Source/WebCore/inspector/front-end/View.js
index d3adff99b..f5ff3c95e 100644
--- a/Source/WebCore/inspector/front-end/View.js
+++ b/Source/WebCore/inspector/front-end/View.js
@@ -360,6 +360,21 @@ WebInspector.View.prototype = {
         WebInspector.setCurrentFocusElement(element);
     },
 
+    /**
+     * @return {Size}
+     */
+    measurePreferredSize: function()
+    {
+        this._loadCSSIfNeeded();
+        WebInspector.View._originalAppendChild.call(document.body, this.element);
+        this.element.positionAt(0, 0);
+        var result = new Size(this.element.offsetWidth, this.element.offsetHeight);
+        this.element.positionAt(undefined, undefined);
+        WebInspector.View._originalRemoveChild.call(document.body, this.element);
+        this._disableCSSIfNeeded();
+        return result;
+    },
+
     __proto__: WebInspector.Object.prototype
 }
 
diff --git a/Source/WebCore/inspector/front-end/WatchExpressionsSidebarPane.js b/Source/WebCore/inspector/front-end/WatchExpressionsSidebarPane.js
index 1d92b7a0a..0fbe28c11 100644
--- a/Source/WebCore/inspector/front-end/WatchExpressionsSidebarPane.js
+++ b/Source/WebCore/inspector/front-end/WatchExpressionsSidebarPane.js
@@ -52,16 +52,18 @@ WebInspector.WatchExpressionsSidebarPane.prototype = {
 
         this.section = new WebInspector.WatchExpressionsSection();
         this.bodyElement.appendChild(this.section.element);
-    
+
         var refreshButton = document.createElement("button");
         refreshButton.className = "pane-title-button refresh";
         refreshButton.addEventListener("click", this._refreshButtonClicked.bind(this), false);
+        refreshButton.title = WebInspector.UIString("Refresh");
         this.titleElement.appendChild(refreshButton);
-    
+
         var addButton = document.createElement("button");
         addButton.className = "pane-title-button add";
         addButton.addEventListener("click", this._addButtonClicked.bind(this), false);
         this.titleElement.appendChild(addButton);
+        addButton.title = WebInspector.UIString("Add watch expression");
         this._requiresUpdate = true;
 
         if (WebInspector.settings.watchExpressions.get().length > 0)
@@ -143,6 +145,7 @@ WebInspector.WatchExpressionsSection = function()
     this.element.addEventListener("mousemove", this._mouseMove.bind(this), true);
     this.element.addEventListener("mouseout", this._mouseOut.bind(this), true);
     this.element.addEventListener("dblclick", this._sectionDoubleClick.bind(this), false);
+    this.emptyElement.addEventListener("contextmenu", this._emptyElementContextMenu.bind(this), false);
 }
 
 WebInspector.WatchExpressionsSection.NewWatchExpression = "\xA0";
@@ -210,7 +213,7 @@ WebInspector.WatchExpressionsSection.prototype = {
             if (!expression)
                 continue;
 
-            WebInspector.runtimeModel.evaluate(expression, this._watchObjectGroupId, false, true, false, appendResult.bind(this, expression, i));
+            WebInspector.runtimeModel.evaluate(expression, this._watchObjectGroupId, false, true, false, false, appendResult.bind(this, expression, i));
         }
 
         if (!propertyCount) {
@@ -326,6 +329,13 @@ WebInspector.WatchExpressionsSection.prototype = {
         this._lastMouseMovePageY = pageY;
     },
 
+    _emptyElementContextMenu: function(event)
+    {
+        var contextMenu = new WebInspector.ContextMenu(event);
+        contextMenu.appendItem(WebInspector.UIString("Add watch expression"), this.addNewExpressionAndEdit.bind(this));
+        contextMenu.show();
+    },
+
     __proto__: WebInspector.ObjectPropertiesSection.prototype
 }
 
@@ -390,25 +400,28 @@ WebInspector.WatchExpressionTreeElement.prototype = {
         this.listItemElement.addEventListener("contextmenu", this._contextMenu.bind(this), false);
         this.listItemElement.insertBefore(deleteButton, this.listItemElement.firstChild);
     },
-    
+
     /**
      * @param {WebInspector.ContextMenu} contextMenu
      * @override
      */
     populateContextMenu: function(contextMenu)
     {
-        contextMenu.appendItem(WebInspector.UIString("Delete watch expression"), this._deleteButtonClicked.bind(this));
+        if (!this.isEditing()) {
+            contextMenu.appendItem(WebInspector.UIString("Add watch expression"), this.treeOutline.section.addNewExpressionAndEdit.bind(this.treeOutline.section));
+            contextMenu.appendItem(WebInspector.UIString("Delete watch expression"), this._deleteButtonClicked.bind(this));
+        }
         if (this.treeOutline.section.watchExpressions.length > 1)
             contextMenu.appendItem(WebInspector.UIString("Delete all watch expressions"), this._deleteAllButtonClicked.bind(this));
     },
 
     _contextMenu: function(event)
     {
-        var contextMenu = new WebInspector.ContextMenu();
+        var contextMenu = new WebInspector.ContextMenu(event);
         this.populateContextMenu(contextMenu);
-        contextMenu.show(event);
+        contextMenu.show();
     },
-    
+
     _deleteAllButtonClicked: function()
     {
         this.treeOutline.section._deleteAllExpressions();
diff --git a/Source/WebCore/inspector/front-end/WebKit.qrc b/Source/WebCore/inspector/front-end/WebKit.qrc
index 467ee66dd..e57c894db 100644
--- a/Source/WebCore/inspector/front-end/WebKit.qrc
+++ b/Source/WebCore/inspector/front-end/WebKit.qrc
@@ -112,11 +112,12 @@
     <file>NavigatorView.js</file>
     <file>NetworkItemView.js</file>
     <file>NetworkLog.js</file>
-    <file>NetworkUISourceCodeProvider.js</file>
     <file>NetworkManager.js</file>
     <file>NetworkPanel.js</file>
     <file>NetworkPanelDescriptor.js</file>
     <file>NetworkRequest.js</file>
+    <file>NetworkUISourceCodeProvider.js</file>
+    <file>NetworkWorkspaceProvider.js</file>
     <file>Object.js</file>
     <file>ObjectPopoverHelper.js</file>
     <file>ObjectPropertiesSection.js</file>
@@ -241,6 +242,7 @@
     <file>resourcesPanel.css</file>
     <file>revisionHistory.css</file>
     <file>scriptsPanel.css</file>
+    <file>spectrum.css</file>
     <file>splitView.css</file>
     <file>tabbedPane.css</file>
     <file>textEditor.css</file>
diff --git a/Source/WebCore/inspector/front-end/WorkersSidebarPane.js b/Source/WebCore/inspector/front-end/WorkersSidebarPane.js
index 3e344680c..1eae6bf83 100644
--- a/Source/WebCore/inspector/front-end/WorkersSidebarPane.js
+++ b/Source/WebCore/inspector/front-end/WorkersSidebarPane.js
@@ -117,7 +117,7 @@ WebInspector.WorkersSidebarPane.prototype = {
 
     _autoattachToWorkersClicked: function(event)
     {
-        WorkerAgent.setAutoconnectToWorkers(event.target.checked);
+        WorkerAgent.setAutoconnectToWorkers(this._enableWorkersCheckbox.checked);
     },
 
     __proto__: WebInspector.SidebarPane.prototype
diff --git a/Source/WebCore/inspector/front-end/Workspace.js b/Source/WebCore/inspector/front-end/Workspace.js
index c5515e82b..09abe16c1 100644
--- a/Source/WebCore/inspector/front-end/Workspace.js
+++ b/Source/WebCore/inspector/front-end/Workspace.js
@@ -44,73 +44,127 @@ WebInspector.WorkspaceController.prototype = {
         WebInspector.Revision.filterOutStaleRevisions();
         this._workspace.dispatchEventToListeners(WebInspector.Workspace.Events.ProjectWillReset, this._workspace.project());
         this._workspace.project().reset();
+        this._workspace.reset();
         this._workspace.dispatchEventToListeners(WebInspector.Workspace.Events.ProjectDidReset, this._workspace.project());
     },
 
     _frameAdded: function(event)
     {
-        var frame = /** @type {WebInspector.ResourceTreeFrame} */ event.data;
+        var frame = /** @type {WebInspector.ResourceTreeFrame} */ (event.data);
         if (frame.isMainFrame())
             WebInspector.Revision.filterOutStaleRevisions();
     }
 }
 
 /**
+ * @constructor
+ * @param {string} path
+ * @param {WebInspector.ResourceType} contentType
+ * @param {boolean} isEditable
+ * @param {boolean=} isContentScript
+ * @param {boolean=} isSnippet
+ */
+WebInspector.FileDescriptor = function(path, contentType, isEditable, isContentScript, isSnippet)
+{
+    this.path = path;
+    this.contentType = contentType;
+    this.isEditable = isEditable;
+    this.isContentScript = isContentScript || false;
+    this.isSnippet = isSnippet || false;
+}
+
+/**
+ * @interface
+ */
+WebInspector.WorkspaceProvider = function() { }
+
+WebInspector.WorkspaceProvider.Events = {
+    FileAdded: "FileAdded",
+    FileRemoved: "FileRemoved"
+}
+
+WebInspector.WorkspaceProvider.prototype = {
+    /**
+     * @param {string} path
+     * @param {function(?string,boolean,string)} callback
+     */
+    requestFileContent: function(path, callback) { },
+
+    /**
+     * @param {string} query
+     * @param {boolean} caseSensitive
+     * @param {boolean} isRegex
+     * @param {function(Array.<WebInspector.ContentProvider.SearchMatch>)} callback
+     */
+    searchInFileContent: function(path, query, caseSensitive, isRegex, callback) { },
+
+    /**
+     * @param {string} eventType
+     * @param {function(WebInspector.Event)} listener
+     * @param {Object=} thisObject
+     */
+    addEventListener: function(eventType, listener, thisObject) { },
+
+    /**
+     * @param {string} eventType
+     * @param {function(WebInspector.Event)} listener
+     * @param {Object=} thisObject
+     */
+    removeEventListener: function(eventType, listener, thisObject) { }
+}
+
+/**
  * @type {?WebInspector.WorkspaceController}
  */
 WebInspector.workspaceController = null;
 
 /**
+ * @param {WebInspector.Workspace} workspace
+ * @param {WebInspector.WorkspaceProvider} workspaceProvider
  * @constructor
  */
-WebInspector.Project = function(workspace)
+WebInspector.Project = function(workspace, workspaceProvider)
 {
     this._uiSourceCodes = [];
     this._workspace = workspace;
+    this._workspaceProvider = workspaceProvider;
+    this._workspaceProvider.addEventListener(WebInspector.WorkspaceProvider.Events.FileAdded, this._fileAdded, this);
+    this._workspaceProvider.addEventListener(WebInspector.WorkspaceProvider.Events.FileRemoved, this._fileRemoved, this);
 }
 
 WebInspector.Project.prototype = {
     reset: function()
     {
+        this._workspaceProvider.reset();
         this._uiSourceCodes = [];
     },
 
-    /**
-     * @param {WebInspector.UISourceCode} uiSourceCode
-     */
-    addUISourceCode: function(uiSourceCode)
+    _fileAdded: function(event)
     {
+        var fileDescriptor = /** @type {WebInspector.FileDescriptor} */ (event.data);
+        var uiSourceCode = this.uiSourceCodeForURL(fileDescriptor.path);
+        if (uiSourceCode) {
+            // FIXME: Implement
+            return;
+        }
+        uiSourceCode = new WebInspector.UISourceCode(this._workspace, fileDescriptor.path, fileDescriptor.contentType, fileDescriptor.isEditable);
+        uiSourceCode.isContentScript = fileDescriptor.isContentScript;
+        uiSourceCode.isSnippet = fileDescriptor.isSnippet;
         this._uiSourceCodes.push(uiSourceCode);
         this._workspace.dispatchEventToListeners(WebInspector.UISourceCodeProvider.Events.UISourceCodeAdded, uiSourceCode);
     },
 
-    /**
-     * @param {WebInspector.UISourceCode} uiSourceCode
-     */
-    addTemporaryUISourceCode: function(uiSourceCode)
-    {
-        uiSourceCode.isTemporary = true;
-        this._workspace.dispatchEventToListeners(WebInspector.UISourceCodeProvider.Events.TemporaryUISourceCodeAdded, uiSourceCode);
-    },
-
-    /**
-     * @param {WebInspector.UISourceCode} uiSourceCode
-     */
-    removeUISourceCode: function(uiSourceCode)
+    _fileRemoved: function(event)
     {
+        var path = /** @type {string} */ (event.data);
+        var uiSourceCode = this.uiSourceCodeForURL(path);
+        if (!uiSourceCode)
+            return;
         this._uiSourceCodes.splice(this._uiSourceCodes.indexOf(uiSourceCode), 1);
         this._workspace.dispatchEventToListeners(WebInspector.UISourceCodeProvider.Events.UISourceCodeRemoved, uiSourceCode);
     },
 
     /**
-     * @param {WebInspector.UISourceCode} uiSourceCode
-     */
-    removeTemporaryUISourceCode: function(uiSourceCode)
-    {
-        this._workspace.dispatchEventToListeners(WebInspector.UISourceCodeProvider.Events.TemporaryUISourceCodeRemoved, uiSourceCode);
-    },
-
-    /**
      * @param {string} url
      * @return {?WebInspector.UISourceCode}
      */
@@ -129,6 +183,26 @@ WebInspector.Project.prototype = {
     uiSourceCodes: function()
     {
         return this._uiSourceCodes;
+    },
+
+    /**
+     * @param {string} path
+     * @param {function(?string,boolean,string)} callback
+     */
+    requestFileContent: function(path, callback)
+    {
+        this._workspaceProvider.requestFileContent(path, callback);
+    },
+
+    /**
+     * @param {string} query
+     * @param {boolean} caseSensitive
+     * @param {boolean} isRegex
+     * @param {function(Array.<WebInspector.ContentProvider.SearchMatch>)} callback
+     */
+    searchInFileContent: function(path, query, caseSensitive, isRegex, callback)
+    {
+        this._workspaceProvider.searchInFileContent(path, query, caseSensitive, isRegex, callback);
     }
 }
 
@@ -139,7 +213,8 @@ WebInspector.Project.prototype = {
  */
 WebInspector.Workspace = function()
 {
-    this._project = new WebInspector.Project(this);
+    /** @type {Object.<string, WebInspector.ContentProvider>} */
+    this._temporaryContentProviders = new Map();
 }
 
 WebInspector.Workspace.Events = {
@@ -159,11 +234,20 @@ WebInspector.Workspace.prototype = {
     },
 
     /**
+     * @param {string} projectName
+     * @param {WebInspector.WorkspaceProvider} workspaceProvider
+     */
+    addProject: function(projectName, workspaceProvider)
+    {
+        // FIXME: support multiple projects identified by project name.
+        this._project = new WebInspector.Project(this, workspaceProvider);
+    },
+
+    /**
      * @return {WebInspector.Project}
      */
     project: function()
     {
-        // FIXME: support several projects.
         return this._project;
     },
 
@@ -175,6 +259,67 @@ WebInspector.Workspace.prototype = {
         return this._project.uiSourceCodes();
     },
 
+    /**
+     * @param {string} path
+     * @param {WebInspector.ContentProvider} contentProvider
+     * @param {boolean} isEditable
+     * @param {boolean=} isContentScript
+     * @param {boolean=} isSnippet
+     */
+    addTemporaryUISourceCode: function(path, contentProvider, isEditable, isContentScript, isSnippet)
+    {
+        var uiSourceCode = new WebInspector.UISourceCode(this, path, contentProvider.contentType(), isEditable);
+        this._temporaryContentProviders.put(uiSourceCode, contentProvider);
+        uiSourceCode.isContentScript = isContentScript;
+        uiSourceCode.isSnippet = isSnippet;
+        uiSourceCode.isTemporary = true;
+        this.dispatchEventToListeners(WebInspector.UISourceCodeProvider.Events.TemporaryUISourceCodeAdded, uiSourceCode);
+        return uiSourceCode;
+    },
+
+    /**
+     * @param {WebInspector.UISourceCode} uiSourceCode
+     */
+    removeTemporaryUISourceCode: function(uiSourceCode)
+    {
+        this._temporaryContentProviders.remove(uiSourceCode.url);
+        this.dispatchEventToListeners(WebInspector.UISourceCodeProvider.Events.TemporaryUISourceCodeRemoved, uiSourceCode);
+    },
+
+    /**
+     * @param {WebInspector.UISourceCode} uiSourceCode
+     * @param {function(?string,boolean,string)} callback
+     */
+    requestFileContent: function(uiSourceCode, callback)
+    {
+        if (this._temporaryContentProviders.get(uiSourceCode)) {
+            this._temporaryContentProviders.get(uiSourceCode).requestContent(callback);
+            return;
+        }
+        this._project.requestFileContent(uiSourceCode.url, callback);
+    },
+
+    /**
+     * @param {WebInspector.UISourceCode} uiSourceCode
+     * @param {string} query
+     * @param {boolean} caseSensitive
+     * @param {boolean} isRegex
+     * @param {function(Array.<WebInspector.ContentProvider.SearchMatch>)} callback
+     */
+    searchInFileContent: function(uiSourceCode, query, caseSensitive, isRegex, callback)
+    {
+        if (this._temporaryContentProviders.get(uiSourceCode)) {
+            this._temporaryContentProviders.get(uiSourceCode).searchInContent(query, caseSensitive, isRegex, callback);
+            return;
+        }
+        this._project.searchInFileContent(uiSourceCode.url, query, caseSensitive, isRegex, callback);
+    },
+
+    reset: function()
+    {
+        this._temporaryContentProviders = new Map();
+    },
+
     __proto__: WebInspector.Object.prototype
 }
 
diff --git a/Source/WebCore/inspector/front-end/cm/cmdevtools.css b/Source/WebCore/inspector/front-end/cm/cmdevtools.css
index 3e8be97cc..62d7f5882 100644
--- a/Source/WebCore/inspector/front-end/cm/cmdevtools.css
+++ b/Source/WebCore/inspector/front-end/cm/cmdevtools.css
@@ -1,10 +1,13 @@
 .CodeMirror {
   line-height: 1.2em !important;
-}
-.CodeMirror-scroll {
   height: 100% !important;
 }
 
+.CodeMirror-linenumber {
+  padding-top: 1px !important;
+  min-width: 22px !important;
+}
+
 .cm-highlight {
   -webkit-animation: "fadeout" 2s 0s;
 }
@@ -13,11 +16,13 @@
     to { background-color: white; }
 }
 .cm-breakpoint {
-  color: white !important;
-  margin-right: -8px !important;
-  margin-left: -6px !important;
+  color: white;
+  position: absolute;
+  right: 3px;
+  margin: 0 -8px 0 -6px !important;
   border-width: 0 8px 0px 2px !important;
   -webkit-border-image: url(Images/breakpointBorder.png) 1 14 1 2;
+  padding: 0 0 1px 100px;
 }
 .cm-breakpoint-disabled {
   opacity: 0.5;
@@ -53,33 +58,30 @@
 .cm-s-web-inspector-html span.cm-attribute {color: rgb(153, 69, 0);}
 .cm-s-web-inspector-html span.cm-link {color: #00e;}
 
-.webkit-html-message-bubble {
+.CodeMirror .webkit-html-message-bubble {
     -webkit-box-shadow: black 0px 2px 5px;
     -webkit-border-radius: 9px;
     -webkit-border-fit: lines;
     font-size: 10px;
     font-family: Lucida Grande, sans-serif;
     font-weight: bold;
-    margin: 0px 10px;
-    padding: 0 7px 1px;
+    margin: 3px 10px;
+    padding: 1px 2px 0;
     z-index: 5;
 }
-.webkit-html-warning-message {
+
+.CodeMirror .webkit-html-message-bubble img {
+    position: relative;
+    top: 1px;
+    margin-right: 2px;
+}
+
+.CodeMirror .webkit-html-warning-message {
     background-color: rgb(100%, 62%, 42%);
     border: 2px solid rgb(100%, 52%, 21%);
 }
-.webkit-html-error-message {
+
+.CodeMirror .webkit-html-error-message {
     background-color: rgb(100%, 42%, 42%);
     border: 2px solid rgb(100%, 31%, 31%);
 }
-.webkit-html-message-line {
-    padding-left: 23px;
-    text-indent: -20px;
-}
-.webkit-html-message-line-hover {
-    padding-left: 23px;
-    text-indent: -20px;
-    white-space: auto;
-    text-overflow: auto;
-    overflow: auto;
-}
diff --git a/Source/WebCore/inspector/front-end/cm/codemirror.css b/Source/WebCore/inspector/front-end/cm/codemirror.css
index f0e91b2d7..ea0ecea59 100644
--- a/Source/WebCore/inspector/front-end/cm/codemirror.css
+++ b/Source/WebCore/inspector/front-end/cm/codemirror.css
@@ -1,173 +1,234 @@
+/* BASICS */
+
 .CodeMirror {
-  line-height: 1em;
+  /* Set height, width, borders, and global font properties here */
   font-family: monospace;
+  height: 300px;
+}
+.CodeMirror-scroll {
+  /* Set scrolling behaviour here */
+  overflow: auto;
+}
+
+/* PADDING */
+
+.CodeMirror-lines {
+  padding: 4px 0; /* Vertical padding around content */
+}
+.CodeMirror pre {
+  padding: 0 4px; /* Horizontal padding of content */
+}
+
+.CodeMirror-scrollbar-filler {
+  background-color: white; /* The little square between H and V scrollbars */
+}
+
+/* GUTTER */
+
+.CodeMirror-gutters {
+  border-right: 1px solid #ddd;
+  background-color: #f7f7f7;
+}
+.CodeMirror-linenumbers {}
+.CodeMirror-linenumber {
+  padding: 0 3px 0 5px;
+  min-width: 20px;
+  text-align: right;
+  color: #999;
+}
+
+/* CURSOR */
+
+.CodeMirror pre.CodeMirror-cursor {
+  border-left: 1px solid black;
+}
+/* Shown when moving in bi-directional text */
+.CodeMirror pre.CodeMirror-secondarycursor {
+  border-left: 1px solid silver;
+}
+.cm-keymap-fat-cursor pre.CodeMirror-cursor {
+  width: auto;
+  border: 0;
+  background: transparent;
+  background: rgba(0, 200, 0, .4);
+  filter: progid:DXImageTransform.Microsoft.gradient(startColorstr=#6600c800, endColorstr=#4c00c800);
+}
+/* Kludge to turn off filter in ie9+, which also accepts rgba */
+.cm-keymap-fat-cursor pre.CodeMirror-cursor:not(#nonsense_id) {
+  filter: progid:DXImageTransform.Microsoft.gradient(enabled=false);
+}
+/* Can style cursor different in overwrite (non-insert) mode */
+.CodeMirror pre.CodeMirror-cursor.CodeMirror-overwrite {}
+
+/* DEFAULT THEME */
+
+.cm-s-default .cm-keyword {color: #708;}
+.cm-s-default .cm-atom {color: #219;}
+.cm-s-default .cm-number {color: #164;}
+.cm-s-default .cm-def {color: #00f;}
+.cm-s-default .cm-variable {color: black;}
+.cm-s-default .cm-variable-2 {color: #05a;}
+.cm-s-default .cm-variable-3 {color: #085;}
+.cm-s-default .cm-property {color: black;}
+.cm-s-default .cm-operator {color: black;}
+.cm-s-default .cm-comment {color: #a50;}
+.cm-s-default .cm-string {color: #a11;}
+.cm-s-default .cm-string-2 {color: #f50;}
+.cm-s-default .cm-meta {color: #555;}
+.cm-s-default .cm-error {color: #f00;}
+.cm-s-default .cm-qualifier {color: #555;}
+.cm-s-default .cm-builtin {color: #30a;}
+.cm-s-default .cm-bracket {color: #997;}
+.cm-s-default .cm-tag {color: #170;}
+.cm-s-default .cm-attribute {color: #00c;}
+.cm-s-default .cm-header {color: blue;}
+.cm-s-default .cm-quote {color: #090;}
+.cm-s-default .cm-hr {color: #999;}
+.cm-s-default .cm-link {color: #00c;}
+
+.cm-header, .cm-strong {font-weight: bold;}
+.cm-em {font-style: italic;}
+.cm-emstrong {font-style: italic; font-weight: bold;}
+.cm-link {text-decoration: underline;}
+
+.cm-invalidchar {color: #f00;}
+
+div.CodeMirror span.CodeMirror-matchingbracket {color: #0f0;}
+div.CodeMirror span.CodeMirror-nonmatchingbracket {color: #f22;}
 
-  /* Necessary so the scrollbar can be absolutely positioned within the wrapper on Lion. */
+/* STOP */
+
+/* The rest of this file contains styles related to the mechanics of
+   the editor. You probably shouldn't touch them. */
+
+.CodeMirror {
+  line-height: 1;
   position: relative;
-  /* This prevents unwanted scrollbars from showing up on the body and wrapper in IE. */
   overflow: hidden;
 }
 
 .CodeMirror-scroll {
-  overflow: auto;
-  height: 300px;
-  /* This is needed to prevent an IE[67] bug where the scrolled content
-     is visible outside of the scrolling box. */
+  /* 30px is the magic margin used to hide the element's real scrollbars */
+  /* See overflow: hidden in .CodeMirror, and the paddings in .CodeMirror-sizer */
+  margin-bottom: -30px; margin-right: -30px;
+  padding-bottom: 30px; padding-right: 30px;
+  height: 100%;
+  outline: none; /* Prevent dragging from highlighting the element */
+  position: relative;
+}
+.CodeMirror-sizer {
   position: relative;
-  outline: none;
 }
 
-/* Vertical scrollbar */
-.CodeMirror-scrollbar {
+/* The fake, visible scrollbars. Used to force redraw during scrolling
+   before actuall scrolling happens, thus preventing shaking and
+   flickering artifacts. */
+.CodeMirror-vscrollbar, .CodeMirror-hscrollbar, .CodeMirror-scrollbar-filler {
   position: absolute;
+  z-index: 6;
+  display: none;
+}
+.CodeMirror-vscrollbar {
   right: 0; top: 0;
   overflow-x: hidden;
   overflow-y: scroll;
-  z-index: 5;
-}
-.CodeMirror-scrollbar-inner {
-  /* This needs to have a nonzero width in order for the scrollbar to appear
-     in Firefox and IE9. */
-  width: 1px;
-}
-.CodeMirror-scrollbar.cm-sb-overlap {
-  /* Ensure that the scrollbar appears in Lion, and that it overlaps the content
-     rather than sitting to the right of it. */
-  position: absolute;
-  z-index: 1;
-  float: none;
-  right: 0;
-  min-width: 12px;
 }
-.CodeMirror-scrollbar.cm-sb-nonoverlap {
-  min-width: 12px;
+.CodeMirror-hscrollbar {
+  bottom: 0; left: 0;
+  overflow-y: hidden;
+  overflow-x: scroll;
 }
-.CodeMirror-scrollbar.cm-sb-ie7 {
-  min-width: 18px;
+.CodeMirror-scrollbar-filler {
+  right: 0; bottom: 0;
+  z-index: 6;
 }
 
-.CodeMirror-gutter {
+.CodeMirror-gutters {
   position: absolute; left: 0; top: 0;
-  z-index: 10;
-  background-color: #f7f7f7;
-  border-right: 1px solid #eee;
-  min-width: 2em;
   height: 100%;
+  z-index: 3;
 }
-.CodeMirror-gutter-text {
-  color: #aaa;
-  text-align: right;
-  padding: .4em .2em .4em .4em;
-  white-space: pre !important;
+.CodeMirror-gutter {
+  height: 100%;
+  float: left;
+}
+.CodeMirror-gutter-elt {
+  position: absolute;
   cursor: default;
+  z-index: 4;
 }
+
 .CodeMirror-lines {
-  padding: .4em;
-  white-space: pre;
   cursor: text;
 }
-
 .CodeMirror pre {
-  -moz-border-radius: 0;
-  -webkit-border-radius: 0;
-  -o-border-radius: 0;
-  border-radius: 0;
-  border-width: 0; margin: 0; padding: 0; background: transparent;
+  /* Reset some styles that the rest of the page might have set */
+  -moz-border-radius: 0; -webkit-border-radius: 0; -o-border-radius: 0; border-radius: 0;
+  border-width: 0;
+  background: transparent;
   font-family: inherit;
   font-size: inherit;
-  padding: 0; margin: 0;
+  margin: 0;
   white-space: pre;
   word-wrap: normal;
   line-height: inherit;
   color: inherit;
+  z-index: 2;
+  position: relative;
+  overflow: visible;
 }
-
 .CodeMirror-wrap pre {
   word-wrap: break-word;
   white-space: pre-wrap;
   word-break: normal;
 }
+.CodeMirror-linebackground {
+  position: absolute;
+  left: 0; right: 0; top: 0; bottom: 0;
+  z-index: 0;
+}
+
+.CodeMirror-linewidget {
+  position: relative;
+  z-index: 2;
+}
+
 .CodeMirror-wrap .CodeMirror-scroll {
   overflow-x: hidden;
 }
 
-.CodeMirror textarea {
-  outline: none !important;
+.CodeMirror-measure {
+  position: absolute;
+  width: 100%; height: 0px;
+  overflow: hidden;
+  visibility: hidden;
 }
+.CodeMirror-measure pre { position: static; }
 
 .CodeMirror pre.CodeMirror-cursor {
-  z-index: 10;
   position: absolute;
   visibility: hidden;
-  border-left: 1px solid black;
   border-right: none;
   width: 0;
 }
-.cm-keymap-fat-cursor pre.CodeMirror-cursor {
-  width: auto;
-  border: 0;
-  background: transparent;
-  background: rgba(0, 200, 0, .4);
-  filter: progid:DXImageTransform.Microsoft.gradient(startColorstr=#6600c800, endColorstr=#4c00c800);
-}
-/* Kludge to turn off filter in ie9+, which also accepts rgba */
-.cm-keymap-fat-cursor pre.CodeMirror-cursor:not(#nonsense_id) {
-  filter: progid:DXImageTransform.Microsoft.gradient(enabled=false);
-}
-.CodeMirror pre.CodeMirror-cursor.CodeMirror-overwrite {}
 .CodeMirror-focused pre.CodeMirror-cursor {
   visibility: visible;
 }
 
-div.CodeMirror-selected { background: #d9d9d9; }
-.CodeMirror-focused div.CodeMirror-selected { background: #d7d4f0; }
+.CodeMirror-selected { background: #d9d9d9; }
+.CodeMirror-focused .CodeMirror-selected { background: #d7d4f0; }
 
 .CodeMirror-searching {
   background: #ffa;
   background: rgba(255, 255, 0, .4);
 }
 
-/* Default theme */
-
-.cm-s-default span.cm-keyword {color: #708;}
-.cm-s-default span.cm-atom {color: #219;}
-.cm-s-default span.cm-number {color: #164;}
-.cm-s-default span.cm-def {color: #00f;}
-.cm-s-default span.cm-variable {color: black;}
-.cm-s-default span.cm-variable-2 {color: #05a;}
-.cm-s-default span.cm-variable-3 {color: #085;}
-.cm-s-default span.cm-property {color: black;}
-.cm-s-default span.cm-operator {color: black;}
-.cm-s-default span.cm-comment {color: #a50;}
-.cm-s-default span.cm-string {color: #a11;}
-.cm-s-default span.cm-string-2 {color: #f50;}
-.cm-s-default span.cm-meta {color: #555;}
-.cm-s-default span.cm-error {color: #f00;}
-.cm-s-default span.cm-qualifier {color: #555;}
-.cm-s-default span.cm-builtin {color: #30a;}
-.cm-s-default span.cm-bracket {color: #cc7;}
-.cm-s-default span.cm-tag {color: #170;}
-.cm-s-default span.cm-attribute {color: #00c;}
-.cm-s-default span.cm-header {color: blue;}
-.cm-s-default span.cm-quote {color: #090;}
-.cm-s-default span.cm-hr {color: #999;}
-.cm-s-default span.cm-link {color: #00c;}
-
-span.cm-header, span.cm-strong {font-weight: bold;}
-span.cm-em {font-style: italic;}
-span.cm-emstrong {font-style: italic; font-weight: bold;}
-span.cm-link {text-decoration: underline;}
-
-span.cm-invalidchar {color: #f00;}
-
-div.CodeMirror span.CodeMirror-matchingbracket {color: #0f0;}
-div.CodeMirror span.CodeMirror-nonmatchingbracket {color: #f22;}
+/* IE7 hack to prevent it from returning funny offsetTops on the spans */
+.CodeMirror span { *vertical-align: text-bottom; }
 
 @media print {
-
   /* Hide the cursor when printing */
   .CodeMirror pre.CodeMirror-cursor {
     visibility: hidden;
   }
-
-}
\ No newline at end of file
+}
diff --git a/Source/WebCore/inspector/front-end/cm/codemirror.js b/Source/WebCore/inspector/front-end/cm/codemirror.js
index d7b8f8c99..5b584c83b 100644
--- a/Source/WebCore/inspector/front-end/cm/codemirror.js
+++ b/Source/WebCore/inspector/front-end/cm/codemirror.js
@@ -1,2080 +1,2746 @@
-// All functions that need access to the editor's state live inside
-// the CodeMirror function. Below that, at the bottom of the file,
-// some utilities are defined.
-
 // CodeMirror is the only global var we claim
-var CodeMirror = (function() {
+window.CodeMirror = (function() {
   "use strict";
-  // This is the function that produces an editor instance. Its
-  // closure is used to store the editor state.
-  function CodeMirror(place, givenOptions) {
+
+  // BROWSER SNIFFING
+
+  // Crude, but necessary to handle a number of hard-to-feature-detect
+  // bugs and behavior differences.
+  var gecko = /gecko\/\d{7}/i.test(navigator.userAgent);
+  var ie = /MSIE \d/.test(navigator.userAgent);
+  var ie_lt8 = /MSIE [1-7]\b/.test(navigator.userAgent);
+  var ie_lt9 = /MSIE [1-8]\b/.test(navigator.userAgent);
+  var ie_lt10 = /MSIE [1-9]\b/.test(navigator.userAgent);
+  var webkit = /WebKit\//.test(navigator.userAgent);
+  var chrome = /Chrome\//.test(navigator.userAgent);
+  var opera = /Opera\//.test(navigator.userAgent);
+  var safari = /Apple Computer/.test(navigator.vendor);
+  var khtml = /KHTML\//.test(navigator.userAgent);
+  var mac_geLion = /Mac OS X 1\d\D([7-9]|\d\d)\D/.test(navigator.userAgent);
+  var mac_geMountainLion = /Mac OS X 1\d\D([8-9]|\d\d)\D/.test(navigator.userAgent);
+  var phantom = /PhantomJS/.test(navigator.userAgent);
+
+  var ios = /AppleWebKit/.test(navigator.userAgent) && /Mobile\/\w+/.test(navigator.userAgent);
+  var mac = ios || /Mac/.test(navigator.platform);
+  var win = /Win/.test(navigator.platform);
+
+  // Optimize some code when these features are not used
+  var sawReadOnlySpans = false, sawCollapsedSpans = false;
+
+  // CONSTRUCTOR
+
+  function CodeMirror(place, options) {
+    if (!(this instanceof CodeMirror)) return new CodeMirror(place, options);
+    
+    this.options = options = options || {};
     // Determine effective options based on given values and defaults.
-    var options = {}, defaults = CodeMirror.defaults;
-    for (var opt in defaults)
-      if (defaults.hasOwnProperty(opt))
-        options[opt] = (givenOptions && givenOptions.hasOwnProperty(opt) ? givenOptions : defaults)[opt];
+    for (var opt in defaults) if (!options.hasOwnProperty(opt) && defaults.hasOwnProperty(opt))
+      options[opt] = defaults[opt];
+    setGuttersForLineNumbers(options);
+
+    var display = this.display = makeDisplay(place);
+    display.wrapper.CodeMirror = this;
+    updateGutters(this);
+    if (options.autofocus) focusInput(this);
 
-    var input = elt("textarea", null, null, "position: absolute; padding: 0; width: 1px; height: 1em");
+    var doc = new BranchChunk([new LeafChunk([makeLine("", null, textHeight(display))])]);
+    // The selection. These are always maintained to point at valid
+    // positions. Inverted is used to remember that the user is
+    // selecting bottom-to-top.
+    this.view = {
+      doc: doc,
+      // frontier is the point up to which the content has been parsed,
+      frontier: 0, highlight: new Delayed(),
+      sel: {from: {line: 0, ch: 0}, to: {line: 0, ch: 0}, inverted: false, shift: false},
+      scrollTop: 0, scrollLeft: 0,
+      overwrite: false, focused: false,
+      // Tracks the maximum line length so that
+      // the horizontal scrollbar can be kept
+      // static when scrolling.
+      maxLine: getLine(doc, 0),
+      maxLineLength: 0,
+      maxLineChanged: false,
+      suppressEdits: false,
+      goalColumn: null,
+      cantEdit: false
+    };
+    loadMode(this);
+
+    // Initialize the content.
+    this.setValue(options.value || "");
+    // Override magic textarea content restore that IE sometimes does
+    // on our hidden textarea on reload
+    if (ie) setTimeout(bind(resetInput, this, true), 20);
+    this.view.history = makeHistory();
+
+    registerEventHandlers(this);
+    // IE throws unspecified error in certain cases, when
+    // trying to access activeElement before onload
+    var hasFocus; try { hasFocus = (document.activeElement == display.input); } catch(e) { }
+    if (hasFocus || options.autofocus) setTimeout(bind(onFocus, this), 20);
+    else onBlur(this);
+
+    operation(this, function() {
+      for (var opt in optionHandlers)
+        if (optionHandlers.propertyIsEnumerable(opt))
+          optionHandlers[opt](this, options[opt], Init);
+      for (var i = 0; i < initHooks.length; ++i) initHooks[i](this);
+    })();
+  }
+
+  // DISPLAY CONSTRUCTOR
+
+  function makeDisplay(place) {
+    var d = {};
+    var input = d.input = elt("textarea", null, null, "position: absolute; padding: 0; width: 1px; height: 1em; outline: none;");
     input.setAttribute("wrap", "off"); input.setAttribute("autocorrect", "off"); input.setAttribute("autocapitalize", "off");
     // Wraps and hides input textarea
-    var inputDiv = elt("div", [input], null, "overflow: hidden; position: relative; width: 3px; height: 0px;");
-    // The empty scrollbar content, used solely for managing the scrollbar thumb.
-    var scrollbarInner = elt("div", null, "CodeMirror-scrollbar-inner");
-    // The vertical scrollbar. Horizontal scrolling is handled by the scroller itself.
-    var scrollbar = elt("div", [scrollbarInner], "CodeMirror-scrollbar");
+    d.inputDiv = elt("div", [input], null, "overflow: hidden; position: relative; width: 3px; height: 0px;");
+    // The actual fake scrollbars.
+    d.scrollbarH = elt("div", [elt("div", null, null, "height: 1px")], "CodeMirror-hscrollbar");
+    d.scrollbarV = elt("div", [elt("div", null, null, "width: 1px")], "CodeMirror-vscrollbar");
+    d.scrollbarFiller = elt("div", null, "CodeMirror-scrollbar-filler");
     // DIVs containing the selection and the actual code
-    var lineDiv = elt("div"), selectionDiv = elt("div", null, null, "position: relative; z-index: -1");
+    d.lineDiv = elt("div");
+    d.selectionDiv = elt("div", null, null, "position: relative; z-index: 1");
     // Blinky cursor, and element used to ensure cursor fits at the end of a line
-    var cursor = elt("pre", "\u00a0", "CodeMirror-cursor"), widthForcer = elt("pre", "\u00a0", "CodeMirror-cursor", "visibility: hidden");
+    d.cursor = elt("pre", "\u00a0", "CodeMirror-cursor");
+    // Secondary cursor, shown when on a 'jump' in bi-directional text
+    d.otherCursor = elt("pre", "\u00a0", "CodeMirror-cursor CodeMirror-secondarycursor");
     // Used to measure text size
-    var measure = elt("div", null, null, "position: absolute; width: 100%; height: 0px; overflow: hidden; visibility: hidden;");
-    var lineSpace = elt("div", [measure, cursor, widthForcer, selectionDiv, lineDiv], null, "position: relative; z-index: 0");
-    var gutterText = elt("div", null, "CodeMirror-gutter-text"), gutter = elt("div", [gutterText], "CodeMirror-gutter");
+    d.measure = elt("div", null, "CodeMirror-measure");
+    // Wraps everything that needs to exist inside the vertically-padded coordinate system
+    d.lineSpace = elt("div", [d.measure, d.selectionDiv, d.lineDiv, d.cursor, d.otherCursor],
+                         null, "position: relative; outline: none");
     // Moved around its parent to cover visible view
-    var mover = elt("div", [gutter, elt("div", [lineSpace], "CodeMirror-lines")], null, "position: relative");
+    d.mover = elt("div", [elt("div", [d.lineSpace], "CodeMirror-lines")], null, "position: relative");
+    d.gutters = elt("div", null, "CodeMirror-gutters");
+    d.lineGutter = null;
     // Set to the height of the text, causes scrolling
-    var sizer = elt("div", [mover], null, "position: relative");
+    d.sizer = elt("div", [d.mover], "CodeMirror-sizer");
+    // D is needed because behavior of elts with overflow: auto and padding is inconsistent across browsers
+    d.heightForcer = elt("div", "\u00a0", null, "position: absolute; height: " + scrollerCutOff + "px");
     // Provides scrolling
-    var scroller = elt("div", [sizer], "CodeMirror-scroll");
-    scroller.setAttribute("tabIndex", "-1");
+    d.scroller = elt("div", [d.sizer, d.heightForcer], "CodeMirror-scroll");
+    d.scroller.setAttribute("tabIndex", "-1");
     // The element in which the editor lives.
-    var wrapper = elt("div", [inputDiv, scrollbar, scroller], "CodeMirror" + (options.lineWrapping ? " CodeMirror-wrap" : ""));
-    if (place.appendChild) place.appendChild(wrapper); else place(wrapper);
+    d.wrapper = elt("div", [d.gutters, d.inputDiv, d.scrollbarH, d.scrollbarV,
+                            d.scrollbarFiller, d.scroller], "CodeMirror");
+    // Work around IE7 z-index bug
+    if (ie_lt8) { d.gutters.style.zIndex = -1; d.scroller.style.paddingRight = 0; }
+    if (place.appendChild) place.appendChild(d.wrapper); else place(d.wrapper);
 
-    themeChanged(); keyMapChanged();
     // Needed to hide big blue blinking cursor on Mobile Safari
     if (ios) input.style.width = "0px";
-    if (!webkit) scroller.draggable = true;
-    lineSpace.style.outline = "none";
-    if (options.tabindex != null) input.tabIndex = options.tabindex;
-    if (options.autofocus) focusInput();
-    if (!options.gutter && !options.lineNumbers) gutter.style.display = "none";
+    if (!webkit) d.scroller.draggable = true;
     // Needed to handle Tab key in KHTML
-    if (khtml) inputDiv.style.height = "1px", inputDiv.style.position = "absolute";
-
-    // Check for OS X >= 10.7. If so, we need to force a width on the scrollbar, and
-    // make it overlap the content. (But we only do this if the scrollbar doesn't already
-    // have a natural width. If the mouse is plugged in or the user sets the system pref
-    // to always show scrollbars, the scrollbar shouldn't overlap.)
-    if (mac_geLion) {
-      scrollbar.className += (overlapScrollbars() ? " cm-sb-overlap" : " cm-sb-nonoverlap");
-    } else if (ie_lt8) {
-      // Need to set a minimum width to see the scrollbar on IE7 (but must not set it on IE8).
-      scrollbar.className += " cm-sb-ie7";
-    }
-
-    // Check for problem with IE innerHTML not working when we have a
-    // P (or similar) parent node.
-    try { charWidth(); }
-    catch (e) {
-      if (e.message.match(/runtime/i))
-        e = new Error("A CodeMirror inside a P-style element does not work in Internet Explorer. (innerHTML bug)");
-      throw e;
-    }
-
-    // Delayed object wrap timeouts, making sure only one is active. blinker holds an interval.
-    var poll = new Delayed(), highlight = new Delayed(), blinker;
-
-    // mode holds a mode API object. doc is the tree of Line objects,
-    // work an array of lines that should be parsed, and history the
-    // undo history (instance of History constructor).
-    var mode, doc = new BranchChunk([new LeafChunk([new Line("")])]), work, focused;
-    loadMode();
-    // The selection. These are always maintained to point at valid
-    // positions. Inverted is used to remember that the user is
-    // selecting bottom-to-top.
-    var sel = {from: {line: 0, ch: 0}, to: {line: 0, ch: 0}, inverted: false};
-    // Selection-related flags. shiftSelecting obviously tracks
-    // whether the user is holding shift.
-    var shiftSelecting, lastClick, lastDoubleClick, lastScrollTop = 0, draggingText,
-        overwrite = false, suppressEdits = false;
-    // Variables used by startOperation/endOperation to track what
-    // happened during the operation.
-    var updateInput, userSelChange, changes, textChanged, selectionChanged, leaveInputAlone,
-        gutterDirty, callbacks;
+    if (khtml) { d.inputDiv.style.height = "1px"; d.inputDiv.style.position = "absolute"; }
+    // Need to set a minimum width to see the scrollbar on IE7 (but must not set it on IE8).
+    else if (ie_lt8) d.scrollbarH.style.minWidth = d.scrollbarV.style.minWidth = "18px";
+
     // Current visible range (may be bigger than the view window).
-    var displayOffset = 0, showingFrom = 0, showingTo = 0, lastSizeC = 0;
-    // bracketHighlighted is used to remember that a bracket has been
-    // marked.
-    var bracketHighlighted;
-    // Tracks the maximum line length so that the horizontal scrollbar
-    // can be kept static when scrolling.
-    var maxLine = getLine(0), updateMaxLine = false, maxLineChanged = true;
-    var tabCache = {};
-    var pollingFast = false; // Ensures slowPoll doesn't cancel fastPoll
-    var goalColumn = null;
+    d.viewOffset = d.showingFrom = d.showingTo = d.lastSizeC = 0;
+
+    // Used to only resize the line number gutter when necessary (when
+    // the amount of lines crosses a boundary that makes its width change)
+    d.lineNumWidth = d.lineNumInnerWidth = d.lineNumChars = null;
+    // See readInput and resetInput
+    d.prevInput = "";
+    // Set to true when a non-horizontal-scrolling widget is added. As
+    // an optimization, widget aligning is skipped when d is false.
+    d.alignWidgets = false;
+    // Flag that indicates whether we currently expect input to appear
+    // (after some event like 'keypress' or 'input') and are polling
+    // intensively.
+    d.pollingFast = false;
+    // Self-resetting timeout for the poller
+    d.poll = new Delayed();
+    // True when a drag from the editor is active
+    d.draggingText = false;
+
+    d.cachedCharWidth = d.cachedTextHeight = null;
+    d.measureLineCache = [];
+    d.measureLineCache.pos = 0;
+
+    // Tracks when resetInput has punted to just putting a short
+    // string instead of the (large) selection.
+    d.inaccurateSelection = false;
+
+    // Used to adjust overwrite behaviour when a paste has been
+    // detected
+    d.pasteIncoming = false;
+
+    return d;
+  }
 
-    // Initialize the content.
-    operation(function(){setValue(options.value || ""); updateInput = false;})();
-    var history = new History();
+  // STATE UPDATES
 
-    // Register our event handlers.
-    connect(scroller, "mousedown", operation(onMouseDown));
-    connect(scroller, "dblclick", operation(onDoubleClick));
-    connect(lineSpace, "selectstart", e_preventDefault);
-    // Gecko browsers fire contextmenu *after* opening the menu, at
-    // which point we can't mess with it anymore. Context menu is
-    // handled in onMouseDown for Gecko.
-    if (!gecko) connect(scroller, "contextmenu", onContextMenu);
-    connect(scroller, "scroll", onScrollMain);
-    connect(scrollbar, "scroll", onScrollBar);
-    connect(scrollbar, "mousedown", function() {if (focused) setTimeout(focusInput, 0);});
-    connect(window, "resize", function() {updateDisplay(true);});
-    connect(input, "keyup", operation(onKeyUp));
-    connect(input, "input", fastPoll);
-    connect(input, "keydown", operation(onKeyDown));
-    connect(input, "keypress", operation(onKeyPress));
-    connect(input, "focus", onFocus);
-    connect(input, "blur", onBlur);
+  // Used to get the editor into a consistent state again when options change.
 
-    function drag_(e) {
-      if (options.onDragEvent && options.onDragEvent(instance, addStop(e))) return;
-      e_stop(e);
-    }
-    if (options.dragDrop) {
-      connect(scroller, "dragstart", onDragStart);
-      connect(scroller, "dragenter", drag_);
-      connect(scroller, "dragover", drag_);
-      connect(scroller, "drop", operation(onDrop));
+  function loadMode(cm) {
+    var doc = cm.view.doc;
+    cm.view.mode = CodeMirror.getMode(cm.options, cm.options.mode);
+    doc.iter(0, doc.size, function(line) { line.stateAfter = null; });
+    cm.view.frontier = 0;
+    startWorker(cm, 100);
+  }
+
+  function wrappingChanged(cm) {
+    var doc = cm.view.doc, th = textHeight(cm.display);
+    if (cm.options.lineWrapping) {
+      cm.display.wrapper.className += " CodeMirror-wrap";
+      var perLine = cm.display.scroller.clientWidth / charWidth(cm.display) - 3;
+      doc.iter(0, doc.size, function(line) {
+        if (line.height == 0) return;
+        var guess = Math.ceil(line.text.length / perLine) || 1;
+        if (guess != 1) updateLineHeight(line, guess * th);
+      });
+      cm.display.sizer.style.minWidth = "";
+    } else {
+      cm.display.wrapper.className = cm.display.wrapper.className.replace(" CodeMirror-wrap", "");
+      computeMaxLength(cm.view);
+      doc.iter(0, doc.size, function(line) {
+        if (line.height != 0) updateLineHeight(line, th);
+      });
     }
-    connect(scroller, "paste", function(){focusInput(); fastPoll();});
-    connect(input, "paste", fastPoll);
-    connect(input, "cut", operation(function(){
-      if (!options.readOnly) replaceSelection("");
-    }));
+    regChange(cm, 0, doc.size);
+  }
 
-    // Needed to handle Tab key in KHTML
-    if (khtml) connect(sizer, "mouseup", function() {
-        if (document.activeElement == input) input.blur();
-        focusInput();
-    });
+  function keyMapChanged(cm) {
+    var style = keyMap[cm.options.keyMap].style;
+    cm.display.wrapper.className = cm.display.wrapper.className.replace(/\s*cm-keymap-\S+/g, "") +
+      (style ? " cm-keymap-" + style : "");
+  }
 
-    // IE throws unspecified error in certain cases, when
-    // trying to access activeElement before onload
-    var hasFocus; try { hasFocus = (document.activeElement == input); } catch(e) { }
-    if (hasFocus || options.autofocus) setTimeout(onFocus, 20);
-    else onBlur();
-
-    function isLine(l) {return l >= 0 && l < doc.size;}
-    // The instance object that we'll return. Mostly calls out to
-    // local functions in the CodeMirror function. Some do some extra
-    // range checking and/or clipping. operation is used to wrap the
-    // call so that changes it makes are tracked, and the display is
-    // updated afterwards.
-    var instance = wrapper.CodeMirror = {
-      getValue: getValue,
-      setValue: operation(setValue),
-      getSelection: getSelection,
-      replaceSelection: operation(replaceSelection),
-      focus: function(){window.focus(); focusInput(); onFocus(); fastPoll();},
-      setOption: function(option, value) {
-        var oldVal = options[option];
-        options[option] = value;
-        if (option == "mode" || option == "indentUnit") loadMode();
-        else if (option == "readOnly" && value == "nocursor") {onBlur(); input.blur();}
-        else if (option == "readOnly" && !value) {resetInput(true);}
-        else if (option == "theme") themeChanged();
-        else if (option == "lineWrapping" && oldVal != value) operation(wrappingChanged)();
-        else if (option == "tabSize") updateDisplay(true);
-        else if (option == "keyMap") keyMapChanged();
-        if (option == "lineNumbers" || option == "gutter" || option == "firstLineNumber" ||
-            option == "theme" || option == "lineNumberFormatter") {
-          gutterChanged();
-          updateDisplay(true);
-        }
-      },
-      getOption: function(option) {return options[option];},
-      undo: operation(undo),
-      redo: operation(redo),
-      indentLine: operation(function(n, dir) {
-        if (typeof dir != "string") {
-          if (dir == null) dir = options.smartIndent ? "smart" : "prev";
-          else dir = dir ? "add" : "subtract";
-        }
-        if (isLine(n)) indentLine(n, dir);
-      }),
-      indentSelection: operation(indentSelected),
-      historySize: function() {return {undo: history.done.length, redo: history.undone.length};},
-      clearHistory: function() {history = new History();},
-      setHistory: function(histData) {
-        history = new History();
-        history.done = histData.done;
-        history.undone = histData.undone;
-      },
-      getHistory: function() {
-        history.time = 0;
-        return {done: history.done.concat([]), undone: history.undone.concat([])};
-      },
-      matchBrackets: operation(function(){matchBrackets(true);}),
-      getTokenAt: operation(function(pos) {
-        pos = clipPos(pos);
-        return getLine(pos.line).getTokenAt(mode, getStateBefore(pos.line), options.tabSize, pos.ch);
-      }),
-      getStateAfter: function(line) {
-        line = clipLine(line == null ? doc.size - 1: line);
-        return getStateBefore(line + 1);
-      },
-      cursorCoords: function(start, mode) {
-        if (start == null) start = sel.inverted;
-        return this.charCoords(start ? sel.from : sel.to, mode);
-      },
-      charCoords: function(pos, mode) {
-        pos = clipPos(pos);
-        if (mode == "local") return localCoords(pos, false);
-        if (mode == "div") return localCoords(pos, true);
-        return pageCoords(pos);
-      },
-      coordsChar: function(coords) {
-        var off = eltOffset(lineSpace);
-        return coordsChar(coords.x - off.left, coords.y - off.top);
-      },
-      markText: operation(markText),
-      setBookmark: setBookmark,
-      findMarksAt: findMarksAt,
-      setMarker: operation(addGutterMarker),
-      clearMarker: operation(removeGutterMarker),
-      setLineClass: operation(setLineClass),
-      hideLine: operation(function(h) {return setLineHidden(h, true);}),
-      showLine: operation(function(h) {return setLineHidden(h, false);}),
-      onDeleteLine: function(line, f) {
-        if (typeof line == "number") {
-          if (!isLine(line)) return null;
-          line = getLine(line);
-        }
-        (line.handlers || (line.handlers = [])).push(f);
-        return line;
-      },
-      lineInfo: lineInfo,
-      addWidget: function(pos, node, scroll, vert, horiz) {
-        pos = localCoords(clipPos(pos));
-        var top = pos.yBot, left = pos.x;
-        node.style.position = "absolute";
-        sizer.appendChild(node);
-        if (vert == "over") top = pos.y;
-        else if (vert == "near") {
-          var vspace = Math.max(scroller.offsetHeight, doc.height * textHeight()),
-              hspace = Math.max(sizer.clientWidth, lineSpace.clientWidth) - paddingLeft();
-          if (pos.yBot + node.offsetHeight > vspace && pos.y > node.offsetHeight)
-            top = pos.y - node.offsetHeight;
-          if (left + node.offsetWidth > hspace)
-            left = hspace - node.offsetWidth;
-        }
-        node.style.top = (top + paddingTop()) + "px";
-        node.style.left = node.style.right = "";
-        if (horiz == "right") {
-          left = sizer.clientWidth - node.offsetWidth;
-          node.style.right = "0px";
-        } else {
-          if (horiz == "left") left = 0;
-          else if (horiz == "middle") left = (sizer.clientWidth - node.offsetWidth) / 2;
-          node.style.left = (left + paddingLeft()) + "px";
-        }
-        if (scroll)
-          scrollIntoView(left, top, left + node.offsetWidth, top + node.offsetHeight);
-      },
-
-      lineCount: function() {return doc.size;},
-      clipPos: clipPos,
-      getCursor: function(start) {
-        if (start == null) start = sel.inverted;
-        return copyPos(start ? sel.from : sel.to);
-      },
-      somethingSelected: function() {return !posEq(sel.from, sel.to);},
-      setCursor: operation(function(line, ch, user) {
-        if (ch == null && typeof line.line == "number") setCursor(line.line, line.ch, user);
-        else setCursor(line, ch, user);
-      }),
-      setSelection: operation(function(from, to, user) {
-        (user ? setSelectionUser : setSelection)(clipPos(from), clipPos(to || from));
-      }),
-      getLine: function(line) {if (isLine(line)) return getLine(line).text;},
-      getLineHandle: function(line) {if (isLine(line)) return getLine(line);},
-      setLine: operation(function(line, text) {
-        if (isLine(line)) replaceRange(text, {line: line, ch: 0}, {line: line, ch: getLine(line).text.length});
-      }),
-      removeLine: operation(function(line) {
-        if (isLine(line)) replaceRange("", {line: line, ch: 0}, clipPos({line: line+1, ch: 0}));
-      }),
-      replaceRange: operation(replaceRange),
-      getRange: function(from, to, lineSep) {return getRange(clipPos(from), clipPos(to), lineSep);},
-
-      triggerOnKeyDown: operation(onKeyDown),
-      execCommand: function(cmd) {return commands[cmd](instance);},
-      // Stuff used by commands, probably not much use to outside code.
-      moveH: operation(moveH),
-      deleteH: operation(deleteH),
-      moveV: operation(moveV),
-      toggleOverwrite: function() {
-        if(overwrite){
-          overwrite = false;
-          cursor.className = cursor.className.replace(" CodeMirror-overwrite", "");
-        } else {
-          overwrite = true;
-          cursor.className += " CodeMirror-overwrite";
-        }
-      },
-
-      posFromIndex: function(off) {
-        var lineNo = 0, ch;
-        doc.iter(0, doc.size, function(line) {
-          var sz = line.text.length + 1;
-          if (sz > off) { ch = off; return true; }
-          off -= sz;
-          ++lineNo;
-        });
-        return clipPos({line: lineNo, ch: ch});
-      },
-      indexFromPos: function (coords) {
-        if (coords.line < 0 || coords.ch < 0) return 0;
-        var index = coords.ch;
-        doc.iter(0, coords.line, function (line) {
-          index += line.text.length + 1;
-        });
-        return index;
-      },
-      scrollTo: function(x, y) {
-        if (x != null) scroller.scrollLeft = x;
-        if (y != null) scrollbar.scrollTop = scroller.scrollTop = y;
-        updateDisplay([]);
-      },
-      getScrollInfo: function() {
-        return {x: scroller.scrollLeft, y: scrollbar.scrollTop,
-                height: scrollbar.scrollHeight, width: scroller.scrollWidth};
-      },
-      setSize: function(width, height) {
-        function interpret(val) {
-          val = String(val);
-          return /^\d+$/.test(val) ? val + "px" : val;
-        }
-        if (width != null) wrapper.style.width = interpret(width);
-        if (height != null) scroller.style.height = interpret(height);
-        instance.refresh();
-      },
-
-      operation: function(f){return operation(f)();},
-      compoundChange: function(f){return compoundChange(f);},
-      refresh: function(){
-        updateDisplay(true, null, lastScrollTop);
-        if (scrollbar.scrollHeight > lastScrollTop)
-          scrollbar.scrollTop = lastScrollTop;
-      },
-      getInputField: function(){return input;},
-      getWrapperElement: function(){return wrapper;},
-      getScrollerElement: function(){return scroller;},
-      getGutterElement: function(){return gutter;}
-    };
+  function themeChanged(cm) {
+    cm.display.wrapper.className = cm.display.wrapper.className.replace(/\s*cm-s-\S+/g, "") +
+      cm.options.theme.replace(/(^|\s)\s*/g, " cm-s-");
+  }
 
-    function getLine(n) { return getLineAt(doc, n); }
-    function updateLineHeight(line, height) {
-      gutterDirty = true;
-      var diff = height - line.height;
-      for (var n = line; n; n = n.parent) n.height += diff;
+  function guttersChanged(cm) {
+    updateGutters(cm);
+    updateDisplay(cm, true);
+  }
+
+  function updateGutters(cm) {
+    var gutters = cm.display.gutters, specs = cm.options.gutters;
+    removeChildren(gutters);
+    for (var i = 0; i < specs.length; ++i) {
+      var gutterClass = specs[i];
+      var gElt = gutters.appendChild(elt("div", null, "CodeMirror-gutter " + gutterClass));
+      if (gutterClass == "CodeMirror-linenumbers") {
+        cm.display.lineGutter = gElt;
+        gElt.style.width = (cm.display.lineNumWidth || 1) + "px";
+      }
     }
+    gutters.style.display = i ? "" : "none";
+  }
 
-    function setValue(code) {
-      var top = {line: 0, ch: 0};
-      updateLines(top, {line: doc.size - 1, ch: getLine(doc.size-1).text.length},
-                  splitLines(code), top, top);
-      updateInput = true;
+  function lineLength(doc, line) {
+    if (line.height == 0) return 0;
+    var len = line.text.length, merged, cur = line;
+    while (merged = collapsedSpanAtStart(cur)) {
+      var found = merged.find();
+      cur = getLine(doc, found.from.line);
+      len += found.from.ch - found.to.ch;
     }
-    function getValue(lineSep) {
-      var text = [];
-      doc.iter(0, doc.size, function(line) { text.push(line.text); });
-      return text.join(lineSep || "\n");
+    cur = line;
+    while (merged = collapsedSpanAtEnd(cur)) {
+      var found = merged.find();
+      len -= cur.text.length - found.from.ch;
+      cur = getLine(doc, found.to.line);
+      len += cur.text.length - found.to.ch;
     }
+    return len;
+  }
 
-    function onScrollBar(e) {
-      if (scrollbar.scrollTop != lastScrollTop) {
-        lastScrollTop = scroller.scrollTop = scrollbar.scrollTop;
-        updateDisplay([]);
+  function computeMaxLength(view) {
+    view.maxLine = getLine(view.doc, 0);
+    view.maxLineLength = lineLength(view.doc, view.maxLine);
+    view.maxLineChanged = true;
+    view.doc.iter(1, view.doc.size, function(line) {
+      var len = lineLength(view.doc, line);
+      if (len > view.maxLineLength) {
+        view.maxLineLength = len;
+        view.maxLine = line;
+      }
+    });
+  }
+
+  // Make sure the gutters options contains the element
+  // "CodeMirror-linenumbers" when the lineNumbers option is true.
+  function setGuttersForLineNumbers(options) {
+    var found = false;
+    for (var i = 0; i < options.gutters.length; ++i) {
+      if (options.gutters[i] == "CodeMirror-linenumbers") {
+        if (options.lineNumbers) found = true;
+        else options.gutters.splice(i--, 1);
       }
     }
+    if (!found && options.lineNumbers)
+      options.gutters.push("CodeMirror-linenumbers");
+  }
 
-    function onScrollMain(e) {
-      if (options.fixedGutter && gutter.style.left != scroller.scrollLeft + "px")
-        gutter.style.left = scroller.scrollLeft + "px";
-      if (scroller.scrollTop != lastScrollTop) {
-        lastScrollTop = scroller.scrollTop;
-        if (scrollbar.scrollTop != lastScrollTop)
-          scrollbar.scrollTop = lastScrollTop;
-        updateDisplay([]);
+  // SCROLLBARS
+
+  // Re-synchronize the fake scrollbars with the actual size of the
+  // content. Optionally force a scrollTop.
+  function updateScrollbars(d /* display */, docHeight, scrollTop) {
+    d.sizer.style.minHeight = d.heightForcer.style.top = (docHeight + 2 * paddingTop(d)) + "px";
+    var needsH = d.scroller.scrollWidth > d.scroller.clientWidth;
+    var needsV = d.scroller.scrollHeight > d.scroller.clientHeight;
+    if (needsV) {
+      d.scrollbarV.style.display = "block";
+      d.scrollbarV.style.bottom = needsH ? scrollbarWidth(d.measure) + "px" : "0";
+      d.scrollbarV.firstChild.style.height = 
+        (d.scroller.scrollHeight - d.scroller.clientHeight + d.scrollbarV.clientHeight) + "px";
+      if (scrollTop != null) {
+        d.scrollbarV.scrollTop = d.scroller.scrollTop = scrollTop;
+        // 'Nudge' the scrollbar to work around a Webkit bug where,
+        // in some situations, we'd end up with a scrollbar that
+        // reported its scrollTop (and looked) as expected, but
+        // *behaved* as if it was still in a previous state (i.e.
+        // couldn't scroll up, even though it appeared to be at the
+        // bottom).
+        if (webkit) setTimeout(function() {
+          if (d.scrollbarV.scrollTop != scrollTop) return;
+          d.scrollbarV.scrollTop = scrollTop + (scrollTop ? -1 : 1);
+          d.scrollbarV.scrollTop = scrollTop;
+        }, 0);
       }
-      if (options.onScroll) options.onScroll(instance);
+    } else d.scrollbarV.style.display = "";
+    if (needsH) {
+      d.scrollbarH.style.display = "block";
+      d.scrollbarH.style.right = needsV ? scrollbarWidth(d.measure) + "px" : "0";
+      d.scrollbarH.firstChild.style.width =
+        (d.scroller.scrollWidth - d.scroller.clientWidth + d.scrollbarH.clientWidth) + "px";
+    } else d.scrollbarH.style.display = "";
+    if (needsH && needsV) {
+      d.scrollbarFiller.style.display = "block";
+      d.scrollbarFiller.style.height = d.scrollbarFiller.style.width = scrollbarWidth(d.measure) + "px";
+    } else d.scrollbarFiller.style.display = "";
+
+    if (mac_geLion && scrollbarWidth(d.measure) === 0)
+      d.scrollbarV.style.minWidth = d.scrollbarH.style.minHeight = mac_geMountainLion ? "18px" : "12px";
+  }
+
+  function visibleLines(display, doc, viewPort) {
+    var top = display.scroller.scrollTop, height = display.wrapper.clientHeight;
+    if (typeof viewPort == "number") top = viewPort;
+    else if (viewPort) {top = viewPort.top; height = viewPort.bottom - viewPort.top;}
+    top = Math.floor(top - paddingTop(display));
+    var bottom = Math.ceil(top + height);
+    return {from: lineAtHeight(doc, top), to: lineAtHeight(doc, bottom)};
+  }
+
+  // LINE NUMBERS
+
+  function alignVertically(display) {
+    if (!display.alignWidgets && !display.gutters.firstChild) return;
+    var l = compensateForHScroll(display) + "px";
+    for (var n = display.lineDiv.firstChild; n; n = n.nextSibling) if (n.alignable) {
+      for (var i = 0, a = n.alignable; i < a.length; ++i) a[i].style.left = l;
     }
+  }
 
-    function onMouseDown(e) {
-      setShift(e_prop(e, "shiftKey"));
-      // Check whether this is a click in a widget
-      for (var n = e_target(e); n != wrapper; n = n.parentNode)
-        if (n.parentNode == sizer && n != mover) return;
+  function maybeUpdateLineNumberWidth(cm) {
+    if (!cm.options.lineNumbers) return false;
+    var doc = cm.view.doc, last = lineNumberFor(cm.options, doc.size - 1), display = cm.display;
+    if (last.length != display.lineNumChars) {
+      var test = display.measure.appendChild(elt("div", [elt("div", last)],
+                                                 "CodeMirror-linenumber CodeMirror-gutter-elt"));
+      var innerW = test.firstChild.offsetWidth, padding = test.offsetWidth - innerW;
+      display.lineGutter.style.width = "";
+      display.lineNumInnerWidth = Math.max(innerW, display.lineGutter.offsetWidth - padding);
+      display.lineNumWidth = display.lineNumInnerWidth + padding;
+      display.lineNumChars = display.lineNumInnerWidth ? last.length : -1;
+      display.lineGutter.style.width = display.lineNumWidth + "px";
+      return true;
+    }
+    return false;
+  }
 
-      // See if this is a click in the gutter
-      for (var n = e_target(e); n != wrapper; n = n.parentNode)
-        if (n.parentNode == gutterText) {
-          if (options.onGutterClick)
-            options.onGutterClick(instance, indexOf(gutterText.childNodes, n) + showingFrom, e);
-          return e_preventDefault(e);
-        }
+  function lineNumberFor(options, i) {
+    return String(options.lineNumberFormatter(i + options.firstLineNumber));
+  }
+  function compensateForHScroll(display) {
+    return display.scroller.getBoundingClientRect().left - display.sizer.getBoundingClientRect().left;
+  }
 
-      var start = posFromMouse(e);
+  // DISPLAY DRAWING
 
-      switch (e_button(e)) {
-      case 3:
-        if (gecko) onContextMenu(e);
-        return;
-      case 2:
-        if (start) setCursor(start.line, start.ch, true);
-        setTimeout(focusInput, 20);
-        e_preventDefault(e);
-        return;
-      }
-      // For button 1, if it was clicked inside the editor
-      // (posFromMouse returning non-null), we have to adjust the
-      // selection.
-      if (!start) {if (e_target(e) == scroller) e_preventDefault(e); return;}
-
-      if (!focused) onFocus();
-
-      var now = +new Date, type = "single";
-      if (lastDoubleClick && lastDoubleClick.time > now - 400 && posEq(lastDoubleClick.pos, start)) {
-        type = "triple";
-        e_preventDefault(e);
-        setTimeout(focusInput, 20);
-        selectLine(start.line);
-      } else if (lastClick && lastClick.time > now - 400 && posEq(lastClick.pos, start)) {
-        type = "double";
-        lastDoubleClick = {time: now, pos: start};
-        e_preventDefault(e);
-        var word = findWordAt(start);
-        setSelectionUser(word.from, word.to);
-      } else { lastClick = {time: now, pos: start}; }
-
-      function dragEnd(e2) {
-        if (webkit) scroller.draggable = false;
-        draggingText = false;
-        up(); drop();
-        if (Math.abs(e.clientX - e2.clientX) + Math.abs(e.clientY - e2.clientY) < 10) {
-          e_preventDefault(e2);
-          setCursor(start.line, start.ch, true);
-          focusInput();
+  function updateDisplay(cm, changes, viewPort) {
+    var oldFrom = cm.display.showingFrom, oldTo = cm.display.showingTo;
+    var updated = updateDisplayInner(cm, changes, viewPort);
+    if (updated) {
+      signalLater(cm, cm, "update", cm);
+      if (cm.display.showingFrom != oldFrom || cm.display.showingTo != oldTo)
+        signalLater(cm, cm, "viewportChange", cm, cm.display.showingFrom, cm.display.showingTo);
+    }
+    updateSelection(cm);
+    updateScrollbars(cm.display, cm.view.doc.height, typeof viewPort == "number" ? viewPort : null);
+    return updated;
+  }
+
+  // Uses a set of changes plus the current scroll position to
+  // determine which DOM updates have to be made, and makes the
+  // updates.
+  function updateDisplayInner(cm, changes, viewPort) {
+    var display = cm.display, doc = cm.view.doc;
+    if (!display.wrapper.clientWidth) {
+      display.showingFrom = display.showingTo = display.viewOffset = 0;
+      return;
+    }
+
+    // Compute the new visible window
+    // If scrollTop is specified, use that to determine which lines
+    // to render instead of the current scrollbar position.
+    var visible = visibleLines(display, doc, viewPort);
+    // Bail out if the visible area is already rendered and nothing changed.
+    if (changes !== true && changes.length == 0 &&
+        visible.from > display.showingFrom && visible.to < display.showingTo)
+      return;
+
+    if (changes && maybeUpdateLineNumberWidth(cm))
+      changes = true;
+    display.sizer.style.marginLeft = display.scrollbarH.style.left = display.gutters.offsetWidth + "px";
+
+    // When merged lines are present, the line that needs to be
+    // redrawn might not be the one that was changed.
+    if (changes !== true && sawCollapsedSpans)
+      for (var i = 0; i < changes.length; ++i) {
+        var ch = changes[i], merged;
+        while (merged = collapsedSpanAtStart(getLine(doc, ch.from))) {
+          var from = merged.find().from.line;
+          if (ch.diff) ch.diff -= ch.from - from;
+          ch.from = from;
         }
       }
-      var last = start, going;
-      if (options.dragDrop && dragAndDrop && !options.readOnly && !posEq(sel.from, sel.to) &&
-          !posLess(start, sel.from) && !posLess(sel.to, start) && type == "single") {
-        // Let the drag handler handle this.
-        if (webkit) scroller.draggable = true;
-        var up = connect(document, "mouseup", operation(dragEnd), true);
-        var drop = connect(scroller, "drop", operation(dragEnd), true);
-        draggingText = true;
-        // IE's approach to draggable
-        if (scroller.dragDrop) scroller.dragDrop();
-        return;
+
+    // Used to determine which lines need their line numbers updated
+    var positionsChangedFrom = changes === true ? 0 : Infinity;
+    if (cm.options.lineNumbers && changes && changes !== true)
+      for (var i = 0; i < changes.length; ++i)
+        if (changes[i].diff) { positionsChangedFrom = changes[i].from; break; }
+
+    var from = Math.max(visible.from - cm.options.viewportMargin, 0);
+    var to = Math.min(doc.size, visible.to + cm.options.viewportMargin);
+    if (display.showingFrom < from && from - display.showingFrom < 20) from = display.showingFrom;
+    if (display.showingTo > to && display.showingTo - to < 20) to = Math.min(doc.size, display.showingTo);
+
+    // Create a range of theoretically intact lines, and punch holes
+    // in that using the change info.
+    var intact = changes === true ? [] :
+      computeIntact([{from: display.showingFrom, to: display.showingTo, domStart: 0}], changes);
+    // Clip off the parts that won't be visible
+    var intactLines = 0;
+    for (var i = 0; i < intact.length; ++i) {
+      var range = intact[i];
+      if (range.from < from) {range.domStart += (from - range.from); range.from = from;}
+      if (range.to > to) range.to = to;
+      if (range.from >= range.to) intact.splice(i--, 1);
+      else intactLines += range.to - range.from;
+    }
+    if (intactLines == to - from && from == display.showingFrom && to == display.showingTo)
+      return;
+    intact.sort(function(a, b) {return a.domStart - b.domStart;});
+
+    if (intactLines < (to - from) * .7) display.lineDiv.style.display = "none";
+    patchDisplay(cm, from, to, intact, positionsChangedFrom);
+    display.lineDiv.style.display = "";
+
+    var different = from != display.showingFrom || to != display.showingTo ||
+      display.lastSizeC != display.wrapper.clientHeight;
+    // This is just a bogus formula that detects when the editor is
+    // resized or the font size changes.
+    if (different) display.lastSizeC = display.wrapper.clientHeight;
+    display.showingFrom = from; display.showingTo = to;
+    display.viewOffset = heightAtLine(cm, getLine(doc, from));
+    startWorker(cm, 100);
+
+    // Since this is all rather error prone, it is honoured with the
+    // only assertion in the whole file.
+    if (display.lineDiv.childNodes.length != display.showingTo - display.showingFrom)
+      throw new Error("BAD PATCH! " + JSON.stringify(intact) + " size=" + (display.showingTo - display.showingFrom) +
+                      " nodes=" + display.lineDiv.childNodes.length);
+
+    // Update line heights for visible lines based on actual DOM
+    // sizes
+    var curNode = display.lineDiv.firstChild, relativeTo = curNode.offsetTop;
+    doc.iter(display.showingFrom, display.showingTo, function(line) {
+      // Work around bizarro IE7 bug where, sometimes, our curNode
+      // is magically replaced with a new node in the DOM, leaving
+      // us with a reference to an orphan (nextSibling-less) node.
+      if (!curNode) return;
+      if (!lineIsHidden(line)) {
+        var end = curNode.offsetHeight + curNode.offsetTop;
+        var height = end - relativeTo, diff = line.height - height;
+        if (height < 2) height = textHeight(display);
+        relativeTo = end;
+        if (diff > .001 || diff < -.001)
+          updateLineHeight(line, height);
       }
-      e_preventDefault(e);
-      if (type == "single") setCursor(start.line, start.ch, true);
-
-      var startstart = sel.from, startend = sel.to;
-
-      function doSelect(cur) {
-        if (type == "single") {
-          setSelectionUser(start, cur);
-        } else if (type == "double") {
-          var word = findWordAt(cur);
-          if (posLess(cur, startstart)) setSelectionUser(word.from, startend);
-          else setSelectionUser(startstart, word.to);
-        } else if (type == "triple") {
-          if (posLess(cur, startstart)) setSelectionUser(startend, clipPos({line: cur.line, ch: 0}));
-          else setSelectionUser(startstart, clipPos({line: cur.line + 1, ch: 0}));
+      curNode = curNode.nextSibling;
+    });
+
+    // Position the mover div to align with the current virtual scroll position
+    display.mover.style.top = display.viewOffset + "px";
+    return true;
+  }
+
+  function computeIntact(intact, changes) {
+    for (var i = 0, l = changes.length || 0; i < l; ++i) {
+      var change = changes[i], intact2 = [], diff = change.diff || 0;
+      for (var j = 0, l2 = intact.length; j < l2; ++j) {
+        var range = intact[j];
+        if (change.to <= range.from && change.diff)
+          intact2.push({from: range.from + diff, to: range.to + diff,
+                        domStart: range.domStart});
+        else if (change.to <= range.from || change.from >= range.to)
+          intact2.push(range);
+        else {
+          if (change.from > range.from)
+            intact2.push({from: range.from, to: change.from, domStart: range.domStart});
+          if (change.to < range.to)
+            intact2.push({from: change.to + diff, to: range.to + diff,
+                          domStart: range.domStart + (change.to - range.from)});
         }
       }
+      intact = intact2;
+    }
+    return intact;
+  }
+
+  function getDimensions(cm) {
+    var d = cm.display, left = {}, width = {};
+    for (var n = d.gutters.firstChild, i = 0; n; n = n.nextSibling, ++i) {
+      left[cm.options.gutters[i]] = n.offsetLeft;
+      width[cm.options.gutters[i]] = n.offsetWidth;
+    }
+    return {fixedPos: compensateForHScroll(d),
+            gutterTotalWidth: d.gutters.offsetWidth,
+            gutterLeft: left,
+            gutterWidth: width,
+            wrapperWidth: d.wrapper.clientWidth};
+  }
 
-      function extend(e) {
-        var cur = posFromMouse(e, true);
-        if (cur && !posEq(cur, last)) {
-          if (!focused) onFocus();
-          last = cur;
-          doSelect(cur);
-          updateInput = false;
-          var visible = visibleLines();
-          if (cur.line >= visible.to || cur.line < visible.from)
-            going = setTimeout(operation(function(){extend(e);}), 150);
+  function patchDisplay(cm, from, to, intact, updateNumbersFrom) {
+    function killNode(node) {
+      var tmp = node.nextSibling;
+      node.parentNode.removeChild(node);
+      return tmp;
+    }
+    var dims = getDimensions(cm);
+    var display = cm.display, lineNumbers = cm.options.lineNumbers;
+    // The first pass removes the DOM nodes that aren't intact.
+    if (!intact.length) {
+      // old IE does bad things to nodes when .innerHTML = "" is used on a parent
+      // we still need widgets and markers intact to add back to the new content later
+      if (ie_lt10) for (var ld = display.lineDiv, tmp = ld.firstChild; tmp; tmp = ld.firstChild) ld.removeChild(tmp);
+      else removeChildren(display.lineDiv);
+    } else {
+      var domPos = 0, curNode = display.lineDiv.firstChild, n;
+      for (var i = 0; i < intact.length; ++i) {
+        var cur = intact[i];
+        while (cur.domStart > domPos) {curNode = killNode(curNode); domPos++;}
+        for (var j = cur.from, e = cur.to; j < e; ++j) {
+          if (lineNumbers && updateNumbersFrom <= j && curNode.firstChild)
+            setTextContent(curNode.firstChild.firstChild, lineNumberFor(cm.options, j));
+          curNode = curNode.nextSibling; domPos++;
         }
       }
+      while (curNode) curNode = killNode(curNode);
+    }
+    // This pass fills in the lines that actually changed.
+    var nextIntact = intact.shift(), curNode = display.lineDiv.firstChild;
+    var j = from;
+
+    cm.view.doc.iter(from, to, function(line) {
+      if (nextIntact && nextIntact.to == j) nextIntact = intact.shift();
+      if (!nextIntact || nextIntact.from > j)
+        display.lineDiv.insertBefore(buildLineElement(cm, line, j, dims), curNode);
+      else
+        curNode = curNode.nextSibling;
+      ++j;
+    });
+  }
 
-      function done(e) {
-        clearTimeout(going);
-        var cur = posFromMouse(e);
-        if (cur) doSelect(cur);
-        e_preventDefault(e);
-        focusInput();
-        updateInput = true;
-        move(); up();
-      }
-      var move = connect(document, "mousemove", operation(function(e) {
-        clearTimeout(going);
-        e_preventDefault(e);
-        if (!ie && !e_button(e)) done(e);
-        else extend(e);
-      }), true);
-      var up = connect(document, "mouseup", operation(done), true);
-    }
-    function onDoubleClick(e) {
-      for (var n = e_target(e); n != wrapper; n = n.parentNode)
-        if (n.parentNode == gutterText) return e_preventDefault(e);
-      e_preventDefault(e);
+  function buildLineElement(cm, line, lineNo, dims) {
+    if (line.height == 0) return elt("div");
+
+    var lineElement = line.height == 0 ? elt("div") : lineContent(cm, line);
+    var markers = line.gutterMarkers, display = cm.display;
+
+    if (!cm.options.lineNumbers && !markers && !line.bgClass && !line.wrapClass &&
+        (!line.widgets || !line.widgets.length)) return lineElement;
+
+    // Lines with gutter elements or a background class need
+    // to be wrapped again, and have the extra elements added
+    // to the wrapper div
+
+    var wrap = elt("div", null, line.wrapClass, "position: relative");
+    if (cm.options.lineNumbers || markers) {
+      var gutterWrap = wrap.appendChild(elt("div", null, null, "position: absolute; left: " +
+                                            dims.fixedPos + "px"));
+      wrap.alignable = [gutterWrap];
+      if (cm.options.lineNumbers)
+        gutterWrap.appendChild(elt("div", lineNumberFor(cm.options, lineNo),
+                                   "CodeMirror-linenumber CodeMirror-gutter-elt",
+                                   "left: " + dims.gutterLeft["CodeMirror-linenumbers"] + "px; width: "
+                                   + display.lineNumInnerWidth + "px"));
+      if (markers)
+        for (var k = 0; k < cm.options.gutters.length; ++k) {
+          var id = cm.options.gutters[k], found = markers.hasOwnProperty(id) && markers[id];
+          if (found) {
+            gutterWrap.appendChild(elt("div", [found], "CodeMirror-gutter-elt", "left: " +
+                                       dims.gutterLeft[id] + "px; width: " + dims.gutterWidth[id] + "px"));
+          }
+        }
     }
-    function onDrop(e) {
-      if (options.onDragEvent && options.onDragEvent(instance, addStop(e))) return;
-      e_preventDefault(e);
-      var pos = posFromMouse(e, true), files = e.dataTransfer.files;
-      if (!pos || options.readOnly) return;
-      if (files && files.length && window.FileReader && window.File) {
-        var n = files.length, text = Array(n), read = 0;
-        var loadFile = function(file, i) {
-          var reader = new FileReader;
-          reader.onload = function() {
-            text[i] = reader.result;
-            if (++read == n) {
-              pos = clipPos(pos);
-              operation(function() {
-                var end = replaceRange(text.join(""), pos, pos);
-                setSelectionUser(pos, end);
-              })();
-            }
-          };
-          reader.readAsText(file);
-        };
-        for (var i = 0; i < n; ++i) loadFile(files[i], i);
-      } else {
-        // Don't do a replace if the drop happened inside of the selected text.
-        if (draggingText && !(posLess(pos, sel.from) || posLess(sel.to, pos))) return;
-        try {
-          var text = e.dataTransfer.getData("Text");
-          if (text) {
-            compoundChange(function() {
-              var curFrom = sel.from, curTo = sel.to;
-              setSelectionUser(pos, pos);
-              if (draggingText) replaceRange("", curFrom, curTo);
-              replaceSelection(text);
-              focusInput();
-            });
+    // Kludge to make sure the styled element lies behind the selection (by z-index)
+    if (line.bgClass)
+      wrap.appendChild(elt("div", "\u00a0", line.bgClass + " CodeMirror-linebackground"));
+    wrap.appendChild(lineElement);
+    if (line.widgets)
+      for (var i = 0, ws = line.widgets; i < ws.length; ++i) {
+        var widget = ws[i], node = elt("div", [widget.node], "CodeMirror-linewidget");
+        node.widget = widget;
+        if (widget.noHScroll) {
+          (wrap.alignable || (wrap.alignable = [])).push(node);
+          var width = dims.wrapperWidth;
+          node.style.left = dims.fixedPos + "px";
+          if (!widget.coverGutter) {
+            width -= dims.gutterTotalWidth;
+            node.style.paddingLeft = dims.gutterTotalWidth + "px";
           }
+          node.style.width = width + "px";
+        }
+        if (widget.coverGutter) {
+          node.style.zIndex = 5;
+          node.style.position = "relative";
+          if (!widget.noHScroll) node.style.marginLeft = -dims.gutterTotalWidth + "px";
         }
-        catch(e){}
+        if (widget.above)
+          wrap.insertBefore(node, cm.options.lineNumbers && line.height != 0 ? gutterWrap : lineElement);
+        else
+          wrap.appendChild(node);
       }
+
+    if (ie_lt8) wrap.style.zIndex = 2;
+    return wrap;
+  }
+
+  // SELECTION / CURSOR
+
+  function selHead(view) {
+    return view.sel.inverted ? view.sel.from : view.sel.to;
+  }
+
+  function updateSelection(cm) {
+    var headPos = posEq(cm.view.sel.from, cm.view.sel.to) ?
+      updateSelectionCursor(cm) :
+      updateSelectionRange(cm);
+    var display = cm.display;
+    // Move the hidden textarea near the cursor to prevent scrolling artifacts
+    var wrapOff = display.wrapper.getBoundingClientRect(), lineOff = display.lineDiv.getBoundingClientRect();
+    display.inputDiv.style.top = Math.max(0, Math.min(display.wrapper.clientHeight - 10,
+                                                      headPos.top + lineOff.top - wrapOff.top)) + "px";
+    display.inputDiv.style.left = Math.max(0, Math.min(display.wrapper.clientWidth - 10,
+                                                       headPos.left + lineOff.left - wrapOff.left)) + "px";
+  }
+
+  // No selection, plain cursor
+  function updateSelectionCursor(cm) {
+    var display = cm.display, pos = cursorCoords(cm, cm.view.sel.from, "div");
+    display.cursor.style.left = pos.left + "px";
+    display.cursor.style.top = pos.top + "px";
+    display.cursor.style.height = Math.max(0, pos.bottom - pos.top) * cm.options.cursorHeight + "px";
+    display.cursor.style.display = "";
+    display.selectionDiv.style.display = "none";
+
+    if (pos.other) {
+      display.otherCursor.style.display = "";
+      display.otherCursor.style.left = pos.other.left + "px";
+      display.otherCursor.style.top = pos.other.top + "px";
+      display.otherCursor.style.height = (pos.other.bottom - pos.other.top) * .85 + "px";
+    } else { display.otherCursor.style.display = "none"; }
+    return pos;
+  }
+
+  // Highlight selection
+  function updateSelectionRange(cm) {
+    var display = cm.display, doc = cm.view.doc, sel = cm.view.sel;
+    var fragment = document.createDocumentFragment();
+    var clientWidth = display.lineSpace.offsetWidth, pl = paddingLeft(cm.display);
+
+    function add(left, top, width, bottom) {
+      if (top < 0) top = 0;
+      fragment.appendChild(elt("div", null, "CodeMirror-selected", "position: absolute; left: " + left +
+                               "px; top: " + top + "px; width: " + (width == null ? clientWidth - left : width) +
+                               "px; height: " + (bottom - top) + "px"));
     }
-    function onDragStart(e) {
-      var txt = getSelection();
-      e.dataTransfer.setData("Text", txt);
 
-      // Use dummy image instead of default browsers image.
-      if (gecko || chrome || opera) {
-        var img = elt('img');
-        img.scr = 'data:image/gif;base64,R0lGODdhAgACAIAAAAAAAP///ywAAAAAAgACAAACAoRRADs='; //1x1 image
-        e.dataTransfer.setDragImage(img, 0, 0);
+    function drawForLine(line, fromArg, toArg, retTop) {
+      var lineObj = getLine(doc, line);
+      var lineLen = lineObj.text.length, rVal = retTop ? Infinity : -Infinity;
+      function coords(ch) {
+        return charCoords(cm, {line: line, ch: ch}, "div", lineObj);
       }
+
+      iterateBidiSections(getOrder(lineObj), fromArg || 0, toArg == null ? lineLen : toArg, function(from, to, dir) {
+        var leftPos = coords(dir == "rtl" ? to - 1 : from);
+        var rightPos = coords(dir == "rtl" ? from : to - 1);
+        var left = leftPos.left, right = rightPos.right;
+        if (rightPos.top - leftPos.top > 3) { // Different lines, draw top part
+          add(left, leftPos.top, null, leftPos.bottom);
+          left = pl;
+          if (leftPos.bottom < rightPos.top) add(left, leftPos.bottom, null, rightPos.top);
+        }
+        if (toArg == null && to == lineLen) right = clientWidth;
+        if (fromArg == null && from == 0) left = pl;
+        rVal = retTop ? Math.min(rightPos.top, rVal) : Math.max(rightPos.bottom, rVal);
+        if (left < pl + 1) left = pl;
+        add(left, rightPos.top, right - left, rightPos.bottom);
+      });
+      return rVal;
     }
 
-    function doHandleBinding(bound, dropShift) {
-      if (typeof bound == "string") {
-        bound = commands[bound];
-        if (!bound) return false;
+    if (sel.from.line == sel.to.line) {
+      drawForLine(sel.from.line, sel.from.ch, sel.to.ch);
+    } else {
+      var fromObj = getLine(doc, sel.from.line);
+      var cur = fromObj, merged, path = [sel.from.line, sel.from.ch], singleLine;
+      while (merged = collapsedSpanAtEnd(cur)) {
+        var found = merged.find();
+        path.push(found.from.ch, found.to.line, found.to.ch);
+        if (found.to.line == sel.to.line) {
+          path.push(sel.to.ch);
+          singleLine = true;
+          break;
+        }
+        cur = getLine(doc, found.to.line);
       }
-      var prevShift = shiftSelecting;
-      try {
-        if (options.readOnly) suppressEdits = true;
-        if (dropShift) shiftSelecting = null;
-        bound(instance);
-      } catch(e) {
-        if (e != Pass) throw e;
-        return false;
-      } finally {
-        shiftSelecting = prevShift;
-        suppressEdits = false;
+
+      // This is a single, merged line
+      if (singleLine) {
+        for (var i = 0; i < path.length; i += 3)
+          drawForLine(path[i], path[i+1], path[i+2]);
+      } else {
+        var middleTop, middleBot, toObj = getLine(doc, sel.to.line);
+        if (sel.from.ch)
+          // Draw the first line of selection.
+          middleTop = drawForLine(sel.from.line, sel.from.ch, null, false);
+        else
+          // Simply include it in the middle block.
+          middleTop = heightAtLine(cm, fromObj) - display.viewOffset;
+
+        if (!sel.to.ch)
+          middleBot = heightAtLine(cm, toObj) - display.viewOffset;
+        else
+          middleBot = drawForLine(sel.to.line, collapsedSpanAtStart(toObj) ? null : 0, sel.to.ch, true);
+
+        if (middleTop < middleBot) add(pl, middleTop, null, middleBot);
       }
-      return true;
     }
-    var maybeTransition;
-    function handleKeyBinding(e) {
-      // Handle auto keymap transitions
-      var startMap = getKeyMap(options.keyMap), next = startMap.auto;
-      clearTimeout(maybeTransition);
-      if (next && !isModifierKey(e)) maybeTransition = setTimeout(function() {
-        if (getKeyMap(options.keyMap) == startMap) {
-          options.keyMap = (next.call ? next.call(null, instance) : next);
-        }
-      }, 50);
-
-      var name = keyNames[e_prop(e, "keyCode")], handled = false;
-      if (name == null || e.altGraphKey) return false;
-      if (e_prop(e, "altKey")) name = "Alt-" + name;
-      if (e_prop(e, "ctrlKey")) name = "Ctrl-" + name;
-      if (e_prop(e, "metaKey")) name = "Cmd-" + name;
-
-      var stopped = false;
-      function stop() { stopped = true; }
-
-      if (e_prop(e, "shiftKey")) {
-        handled = lookupKey("Shift-" + name, options.extraKeys, options.keyMap,
-                            function(b) {return doHandleBinding(b, true);}, stop)
-               || lookupKey(name, options.extraKeys, options.keyMap, function(b) {
-                 if (typeof b == "string" && /^go[A-Z]/.test(b)) return doHandleBinding(b);
-               }, stop);
-      } else {
-        handled = lookupKey(name, options.extraKeys, options.keyMap, doHandleBinding, stop);
-      }
-      if (stopped) handled = false;
-      if (handled) {
-        e_preventDefault(e);
-        restartBlink();
-        if (ie) { e.oldKeyCode = e.keyCode; e.keyCode = 0; }
-      }
-      return handled;
-    }
-    function handleCharBinding(e, ch) {
-      var handled = lookupKey("'" + ch + "'", options.extraKeys,
-                              options.keyMap, function(b) { return doHandleBinding(b, true); });
-      if (handled) {
-        e_preventDefault(e);
-        restartBlink();
-      }
-      return handled;
-    }
-
-    var lastStoppedKey = null;
-    function onKeyDown(e) {
-      if (!focused) onFocus();
-      if (ie && e.keyCode == 27) { e.returnValue = false; }
-      if (pollingFast) { if (readInput()) pollingFast = false; }
-      if (options.onKeyEvent && options.onKeyEvent(instance, addStop(e))) return;
-      var code = e_prop(e, "keyCode");
-      // IE does strange things with escape.
-      setShift(code == 16 || e_prop(e, "shiftKey"));
-      // First give onKeyEvent option a chance to handle this.
-      var handled = handleKeyBinding(e);
-      if (opera) {
-        lastStoppedKey = handled ? code : null;
-        // Opera has no cut event... we try to at least catch the key combo
-        if (!handled && code == 88 && e_prop(e, mac ? "metaKey" : "ctrlKey"))
-          replaceSelection("");
-      }
-    }
-    function onKeyPress(e) {
-      if (pollingFast) readInput();
-      if (options.onKeyEvent && options.onKeyEvent(instance, addStop(e))) return;
-      var keyCode = e_prop(e, "keyCode"), charCode = e_prop(e, "charCode");
-      if (opera && keyCode == lastStoppedKey) {lastStoppedKey = null; e_preventDefault(e); return;}
-      if (((opera && (!e.which || e.which < 10)) || khtml) && handleKeyBinding(e)) return;
-      var ch = String.fromCharCode(charCode == null ? keyCode : charCode);
-      if (options.electricChars && mode.electricChars && options.smartIndent && !options.readOnly) {
-        if (mode.electricChars.indexOf(ch) > -1)
-          setTimeout(operation(function() {indentLine(sel.to.line, "smart");}), 75);
-      }
-      if (handleCharBinding(e, ch)) return;
-      fastPoll();
-    }
-    function onKeyUp(e) {
-      if (options.onKeyEvent && options.onKeyEvent(instance, addStop(e))) return;
-      if (e_prop(e, "keyCode") == 16) shiftSelecting = null;
-    }
-
-    function onFocus() {
-      if (options.readOnly == "nocursor") return;
-      if (!focused) {
-        if (options.onFocus) options.onFocus(instance);
-        focused = true;
-        if (scroller.className.search(/\bCodeMirror-focused\b/) == -1)
-          scroller.className += " CodeMirror-focused";
-        if (!leaveInputAlone) resetInput(true);
-      }
-      slowPoll();
-      restartBlink();
-    }
-    function onBlur() {
-      if (focused) {
-        if (options.onBlur) options.onBlur(instance);
-        focused = false;
-        if (bracketHighlighted)
-          operation(function(){
-            if (bracketHighlighted) { bracketHighlighted(); bracketHighlighted = null; }
-          })();
-        scroller.className = scroller.className.replace(" CodeMirror-focused", "");
-      }
-      clearInterval(blinker);
-      setTimeout(function() {if (!focused) shiftSelecting = null;}, 150);
-    }
-
-    // Replace the range from from to to by the strings in newText.
-    // Afterwards, set the selection to selFrom, selTo.
-    function updateLines(from, to, newText, selFrom, selTo) {
-      if (suppressEdits) return;
-      if (history) {
-        var old = [];
-        doc.iter(from.line, to.line + 1, function(line) { old.push(line.text); });
-        history.addChange(from.line, newText.length, old);
-        while (history.done.length > options.undoDepth) history.done.shift();
-      }
-      updateLinesNoUndo(from, to, newText, selFrom, selTo);
-    }
-    function unredoHelper(from, to) {
-      if (!from.length) return;
-      var set = from.pop(), out = [];
-      for (var i = set.length - 1; i >= 0; i -= 1) {
-        var change = set[i];
-        var replaced = [], end = change.start + change.added;
-        doc.iter(change.start, end, function(line) { replaced.push(line.text); });
-        out.push({start: change.start, added: change.old.length, old: replaced});
-        var pos = {line: change.start + change.old.length - 1,
-                   ch: editEnd(replaced[replaced.length-1], change.old[change.old.length-1])};
-        updateLinesNoUndo({line: change.start, ch: 0}, {line: end - 1, ch: getLine(end-1).text.length}, change.old, pos, pos);
-      }
-      updateInput = true;
-      to.push(out);
-    }
-    function undo() {unredoHelper(history.done, history.undone);}
-    function redo() {unredoHelper(history.undone, history.done);}
-
-    function updateLinesNoUndo(from, to, newText, selFrom, selTo) {
-      if (suppressEdits) return;
-      var recomputeMaxLength = false, maxLineLength = maxLine.text.length;
-      if (!options.lineWrapping)
-        doc.iter(from.line, to.line + 1, function(line) {
-          if (!line.hidden && line.text.length == maxLineLength) {recomputeMaxLength = true; return true;}
-        });
-      if (from.line != to.line || newText.length > 1) gutterDirty = true;
-
-      var nlines = to.line - from.line, firstLine = getLine(from.line), lastLine = getLine(to.line);
-      // First adjust the line structure, taking some care to leave highlighting intact.
-      if (from.ch == 0 && to.ch == 0 && newText[newText.length - 1] == "") {
-        // This is a whole-line replace. Treated specially to make
-        // sure line objects move the way they are supposed to.
-        var added = [], prevLine = null;
-        if (from.line) {
-          prevLine = getLine(from.line - 1);
-          prevLine.fixMarkEnds(lastLine);
-        } else lastLine.fixMarkStarts();
-        for (var i = 0, e = newText.length - 1; i < e; ++i)
-          added.push(Line.inheritMarks(newText[i], prevLine));
-        if (nlines) doc.remove(from.line, nlines, callbacks);
-        if (added.length) doc.insert(from.line, added);
-      } else if (firstLine == lastLine) {
-        if (newText.length == 1)
-          firstLine.replace(from.ch, to.ch, newText[0]);
-        else {
-          lastLine = firstLine.split(to.ch, newText[newText.length-1]);
-          firstLine.replace(from.ch, null, newText[0]);
-          firstLine.fixMarkEnds(lastLine);
-          var added = [];
-          for (var i = 1, e = newText.length - 1; i < e; ++i)
-            added.push(Line.inheritMarks(newText[i], firstLine));
-          added.push(lastLine);
-          doc.insert(from.line + 1, added);
+
+    removeChildrenAndAdd(display.selectionDiv, fragment);
+    display.cursor.style.display = display.otherCursor.style.display = "none";
+    display.selectionDiv.style.display = "";
+    return cursorCoords(cm, selHead(cm.view), "div");
+  }
+
+  // Cursor-blinking
+  function restartBlink(cm) {
+    var display = cm.display;
+    clearInterval(display.blinker);
+    var on = true;
+    display.cursor.style.visibility = display.otherCursor.style.visibility = "";
+    display.blinker = setInterval(function() {
+      display.cursor.style.visibility = display.otherCursor.style.visibility = (on = !on) ? "" : "hidden";
+    }, cm.options.cursorBlinkRate);
+  }
+
+  // HIGHLIGHT WORKER
+
+  function startWorker(cm, time) {
+    if (cm.view.frontier < cm.display.showingTo)
+      cm.view.highlight.set(time, bind(highlightWorker, cm));
+  }
+
+  function highlightWorker(cm) {
+    var view = cm.view, doc = view.doc;
+    if (view.frontier >= cm.display.showingTo) return;
+    var end = +new Date + cm.options.workTime;
+    var state = copyState(view.mode, getStateBefore(cm, view.frontier));
+    var changed = [], prevChange;
+    doc.iter(view.frontier, Math.min(doc.size, cm.display.showingTo + 500), function(line) {
+      if (view.frontier >= cm.display.showingFrom) { // Visible
+        if (highlightLine(cm, line, state) && view.frontier >= cm.display.showingFrom) {
+          if (prevChange && prevChange.end == view.frontier) prevChange.end++;
+          else changed.push(prevChange = {start: view.frontier, end: view.frontier + 1});
         }
-      } else if (newText.length == 1) {
-        firstLine.replace(from.ch, null, newText[0]);
-        lastLine.replace(null, to.ch, "");
-        firstLine.append(lastLine);
-        doc.remove(from.line + 1, nlines, callbacks);
+        line.stateAfter = copyState(view.mode, state);
       } else {
-        var added = [];
-        firstLine.replace(from.ch, null, newText[0]);
-        lastLine.replace(null, to.ch, newText[newText.length-1]);
-        firstLine.fixMarkEnds(lastLine);
-        for (var i = 1, e = newText.length - 1; i < e; ++i)
-          added.push(Line.inheritMarks(newText[i], firstLine));
-        if (nlines > 1) doc.remove(from.line + 1, nlines - 1, callbacks);
-        doc.insert(from.line + 1, added);
+        processLine(cm, line, state);
+        line.stateAfter = view.frontier % 5 == 0 ? copyState(view.mode, state) : null;
       }
-      if (options.lineWrapping) {
-        var perLine = Math.max(5, scroller.clientWidth / charWidth() - 3);
-        doc.iter(from.line, from.line + newText.length, function(line) {
-          if (line.hidden) return;
-          var guess = Math.ceil(line.text.length / perLine) || 1;
-          if (guess != line.height) updateLineHeight(line, guess);
-        });
-      } else {
-        doc.iter(from.line, from.line + newText.length, function(line) {
-          var l = line.text;
-          if (!line.hidden && l.length > maxLineLength) {
-            maxLine = line; maxLineLength = l.length; maxLineChanged = true;
-            recomputeMaxLength = false;
-          }
-        });
-        if (recomputeMaxLength) updateMaxLine = true;
-      }
-
-      // Add these lines to the work array, so that they will be
-      // highlighted. Adjust work lines if lines were added/removed.
-      var newWork = [], lendiff = newText.length - nlines - 1;
-      for (var i = 0, l = work.length; i < l; ++i) {
-        var task = work[i];
-        if (task < from.line) newWork.push(task);
-        else if (task > to.line) newWork.push(task + lendiff);
-      }
-      var hlEnd = from.line + Math.min(newText.length, 500);
-      highlightLines(from.line, hlEnd);
-      newWork.push(hlEnd);
-      work = newWork;
-      startWorker(100);
-      // Remember that these lines changed, for updating the display
-      changes.push({from: from.line, to: to.line + 1, diff: lendiff});
-      var changeObj = {from: from, to: to, text: newText};
-      if (textChanged) {
-        for (var cur = textChanged; cur.next; cur = cur.next) {}
-        cur.next = changeObj;
-      } else textChanged = changeObj;
+      ++view.frontier;
+      if (+new Date > end) {
+        startWorker(cm, cm.options.workDelay);
+        return true;
+      }
+    });
+    if (changed.length)
+      operation(cm, function() {
+        for (var i = 0; i < changed.length; ++i)
+          regChange(this, changed[i].start, changed[i].end);
+      })();
+  }
 
-      // Update the selection
-      function updateLine(n) {return n <= Math.min(to.line, to.line + lendiff) ? n : n + lendiff;}
-      setSelection(clipPos(selFrom), clipPos(selTo),
-                   updateLine(sel.from.line), updateLine(sel.to.line));
+  // Finds the line to start with when starting a parse. Tries to
+  // find a line with a stateAfter, so that it can start with a
+  // valid state. If that fails, it returns the line with the
+  // smallest indentation, which tends to need the least context to
+  // parse correctly.
+  function findStartLine(cm, n) {
+    var minindent, minline, doc = cm.view.doc;
+    for (var search = n, lim = n - 100; search > lim; --search) {
+      if (search == 0) return 0;
+      var line = getLine(doc, search-1);
+      if (line.stateAfter) return search;
+      var indented = countColumn(line.text, null, cm.options.tabSize);
+      if (minline == null || minindent > indented) {
+        minline = search - 1;
+        minindent = indented;
+      }
     }
+    return minline;
+  }
 
-    function needsScrollbar() {
-      var realHeight = doc.height * textHeight() + 2 * paddingTop();
-      return realHeight - 1 > scroller.offsetHeight ? realHeight : false;
+  function getStateBefore(cm, n) {
+    var view = cm.view;
+    var pos = findStartLine(cm, n), state = pos && getLine(view.doc, pos-1).stateAfter;
+    if (!state) state = startState(view.mode);
+    else state = copyState(view.mode, state);
+    view.doc.iter(pos, n, function(line) {
+      processLine(cm, line, state);
+      var save = pos == n - 1 || pos % 5 == 0 || pos >= view.showingFrom && pos < view.showingTo;
+      line.stateAfter = save ? copyState(view.mode, state) : null;
+      ++pos;
+    });
+    return state;
+  }
+
+  // POSITION MEASUREMENT
+  
+  function paddingTop(display) {return display.lineSpace.offsetTop;}
+  function paddingLeft(display) {
+    var e = removeChildrenAndAdd(display.measure, elt("pre")).appendChild(elt("span", "x"));
+    return e.offsetLeft;
+  }
+
+  function measureChar(cm, line, ch, data) {
+    var data = data || measureLine(cm, line);
+    var dir = -1, len = line.text.length;
+    for (var pos = ch;; pos += dir) {
+      var r = data[pos];
+      if (r) break;
+      if (dir < 0 && pos == 0) dir = 1;
     }
+    return {left: pos < ch ? r.right : r.left,
+            right: pos > ch ? r.left : r.right,
+            top: r.top, bottom: r.bottom};
+  }
 
-    function updateVerticalScroll(scrollTop) {
-      var scrollHeight = needsScrollbar();
-      scrollbar.style.display = scrollHeight ? "block" : "none";
-      if (scrollHeight) {
-        scrollbarInner.style.height = sizer.style.minHeight = scrollHeight + "px";
-        scrollbar.style.height = scroller.clientHeight + "px";
-        if (scrollTop != null) scrollbar.scrollTop = scroller.scrollTop = scrollTop;
-      } else {
-        sizer.style.minHeight = "";
+  function measureLine(cm, line) {
+    // First look in the cache
+    var display = cm.display, cache = cm.display.measureLineCache;
+    for (var i = 0; i < cache.length; ++i) {
+      var memo = cache[i];
+      if (memo.text == line.text && memo.markedSpans == line.markedSpans &&
+          display.scroller.clientWidth == memo.width)
+        return memo.measure;
+    }
+    
+    var measure = measureLineInner(cm, line);
+    // Store result in the cache
+    var memo = {text: line.text, width: display.scroller.clientWidth,
+                markedSpans: line.markedSpans, measure: measure};
+    if (cache.length == 16) cache[++cache.pos % 16] = memo;
+    else cache.push(memo);
+    return measure;
+  }
+
+  function measureLineInner(cm, line) {
+    var display = cm.display, measure = emptyArray(line.text.length);
+    var pre = lineContent(cm, line, measure);
+    removeChildrenAndAdd(display.measure, pre);
+
+    var outer = display.lineDiv.getBoundingClientRect();
+    var vranges = [], data = emptyArray(line.text.length), maxBot = pre.offsetHeight;
+    for (var i = 0, elt; i < measure.length; ++i) if (elt = measure[i]) {
+      var size = measure[i].getBoundingClientRect();
+      var top = Math.max(0, size.top - outer.top), bot = Math.min(size.bottom - outer.top, maxBot);
+      for (var j = 0; j < vranges.length; j += 2) {
+        var rtop = vranges[j], rbot = vranges[j+1];
+        if (rtop > bot || rbot < top) continue;
+        if (rtop <= top && rbot >= bot ||
+            top <= rtop && bot >= rbot ||
+            Math.min(bot, rbot) - Math.max(top, rtop) >= (bot - top) >> 1) {
+          vranges[j] = Math.min(top, rtop);
+          vranges[j+1] = Math.max(bot, rbot);
+          break;
+        }
       }
-      // Position the mover div to align with the current virtual scroll position
-      mover.style.top = displayOffset * textHeight() + "px";
+      if (j == vranges.length) vranges.push(top, bot);
+      data[i] = {left: size.left - outer.left, right: size.right - outer.left, top: j};
     }
+    for (var i = 0, elt; i < data.length; ++i) if (elt = data[i]) {
+      var vr = elt.top;
+      elt.top = vranges[vr]; elt.bottom = vranges[vr+1];
+    }
+    return data;
+  }
 
-    // On Mac OS X Lion and up, detect whether the mouse is plugged in by measuring
-    // the width of a div with a scrollbar in it. If the width is <= 1, then
-    // the mouse isn't plugged in and scrollbars should overlap the content.
-    function overlapScrollbars() {
-      var tmpSbInner = elt("div", null, "CodeMirror-scrollbar-inner", "height: 200px");
-      var tmpSb = elt("div", [tmpSbInner], "CodeMirror-scrollbar", "position: absolute; left: -9999px; height: 100px;");
-      document.body.appendChild(tmpSb);
-      var result = (tmpSb.offsetWidth <= 1);
-      document.body.removeChild(tmpSb);
-      return result;
+  // Context is one of "line", "div" (display.lineDiv), "local"/null (editor), or "page"
+  function intoCoordSystem(cm, lineObj, pos, rect, context) {
+    if (lineObj.widgets) for (var i = 0; i < lineObj.widgets.length; ++i) if (lineObj.widgets[i].above) {
+      var size = lineObj.widgets[i].node.offsetHeight;
+      rect.top += size; rect.bottom += size;
+    }
+    if (context == "line") return rect;
+    if (!context) context = "local";
+    var yOff = heightAtLine(cm, lineObj);
+    if (context != "local") yOff -= cm.display.viewOffset;
+    if (context == "page") {
+      var lOff = cm.display.lineSpace.getBoundingClientRect();
+      yOff += lOff.top + (window.pageYOffset || (document.documentElement || document.body).scrollTop);
+      var xOff = lOff.left + (window.pageXOffset || (document.documentElement || document.body).scrollLeft);
+      rect.left += xOff; rect.right += xOff;
     }
+    rect.top += yOff; rect.bottom += yOff;
+    return rect;
+  }
 
-    function computeMaxLength() {
-      maxLine = getLine(0); maxLineChanged = true;
-      var maxLineLength = maxLine.text.length;
-      doc.iter(1, doc.size, function(line) {
-        var l = line.text;
-        if (!line.hidden && l.length > maxLineLength) {
-          maxLineLength = l.length; maxLine = line;
-        }
-      });
-      updateMaxLine = false;
+  function charCoords(cm, pos, context, lineObj) {
+    if (!lineObj) lineObj = getLine(cm.view.doc, pos.line);
+    return intoCoordSystem(cm, lineObj, pos, measureChar(cm, lineObj, pos.ch), context);
+  }
+
+  function cursorCoords(cm, pos, context, lineObj, measurement) {
+    lineObj = lineObj || getLine(cm.view.doc, pos.line);
+    if (!measurement) measurement = measureLine(cm, lineObj);
+    function get(ch, right) {
+      var m = measureChar(cm, lineObj, ch, measurement);
+      if (right) m.left = m.right; else m.right = m.left;
+      return intoCoordSystem(cm, lineObj, pos, m, context);
+    }
+    var order = getOrder(lineObj), ch = pos.ch;
+    if (!order) return get(ch);
+    var main, other, linedir = order[0].level;
+    for (var i = 0; i < order.length; ++i) {
+      var part = order[i], rtl = part.level % 2, nb, here;
+      if (part.from < ch && part.to > ch) return get(ch, rtl);
+      var left = rtl ? part.to : part.from, right = rtl ? part.from : part.to;
+      if (left == ch) {
+        // Opera and IE return bogus offsets and widths for edges
+        // where the direction flips, but only for the side with the
+        // lower level. So we try to use the side with the higher
+        // level.
+        if (i && part.level < (nb = order[i-1]).level) here = get(nb.level % 2 ? nb.from : nb.to - 1, true);
+        else here = get(rtl && part.from != part.to ? ch - 1 : ch);
+        if (rtl == linedir) main = here; else other = here;
+      } else if (right == ch) {
+        var nb = i < order.length - 1 && order[i+1];
+        if (!rtl && nb && nb.from == nb.to) continue;
+        if (nb && part.level < nb.level) here = get(nb.level % 2 ? nb.to - 1 : nb.from);
+        else here = get(rtl ? ch : ch - 1, true);
+        if (rtl == linedir) main = here; else other = here;
+      }
     }
+    if (linedir && !ch) other = get(order[0].to - 1);
+    if (!main) return other;
+    if (other) main.other = other;
+    return main;
+  }
 
-    function replaceRange(code, from, to) {
-      from = clipPos(from);
-      if (!to) to = from; else to = clipPos(to);
-      code = splitLines(code);
-      function adjustPos(pos) {
-        if (posLess(pos, from)) return pos;
-        if (!posLess(to, pos)) return end;
-        var line = pos.line + code.length - (to.line - from.line) - 1;
-        var ch = pos.ch;
-        if (pos.line == to.line)
-          ch += code[code.length-1].length - (to.ch - (to.line == from.line ? from.ch : 0));
-        return {line: line, ch: ch};
+  // Coords must be lineSpace-local
+  function coordsChar(cm, x, y) {
+    var doc = cm.view.doc;
+    y += cm.display.viewOffset;
+    if (y < 0) return {line: 0, ch: 0, outside: true};
+    var lineNo = lineAtHeight(doc, y);
+    if (lineNo >= doc.size) return {line: doc.size - 1, ch: getLine(doc, doc.size - 1).text.length};
+    if (x < 0) x = 0;
+
+    for (;;) {
+      var lineObj = getLine(doc, lineNo);
+      var found = coordsCharInner(cm, lineObj, lineNo, x, y);
+      var merged = collapsedSpanAtEnd(lineObj);
+      if (merged && found.ch == lineRight(lineObj))
+        lineNo = merged.find().to.line;
+      else
+        return found;
+    }
+  }
+
+  function coordsCharInner(cm, lineObj, lineNo, x, y) {
+    var doc = cm.view.doc;
+    var innerOff = y - heightAtLine(cm, lineObj);
+    var wrongLine = false, cWidth = cm.display.wrapper.clientWidth;
+    var measurement = measureLine(cm, lineObj);
+
+    function getX(ch) {
+      var sp = cursorCoords(cm, {line: lineNo, ch: ch}, "line",
+                            lineObj, measurement);
+      wrongLine = true;
+      if (innerOff > sp.bottom) return Math.max(0, sp.left - cWidth);
+      else if (innerOff < sp.top) return sp.left + cWidth;
+      else wrongLine = false;
+      return sp.left;
+    }
+
+    var bidi = getOrder(lineObj), dist = lineObj.text.length;
+    var from = lineLeft(lineObj), to = lineRight(lineObj), fromX = paddingLeft(cm.display), toX;
+    if (!bidi) {
+      // Guess a suitable upper bound for our search.
+      var estimated = Math.min(to, Math.ceil((x + Math.floor(innerOff / textHeight(cm.display)) *
+                                              cWidth * .9) / charWidth(cm.display)));
+      for (;;) {
+        var estX = getX(estimated);
+        if (estX <= x && estimated < to) estimated = Math.min(to, Math.ceil(estimated * 1.2));
+        else {toX = estX; to = estimated; break;}
       }
-      var end;
-      replaceRange1(code, from, to, function(end1) {
-        end = end1;
-        return {from: adjustPos(sel.from), to: adjustPos(sel.to)};
-      });
-      return end;
+      // Try to guess a suitable lower bound as well.
+      estimated = Math.floor(to * 0.8); estX = getX(estimated);
+      if (estX < x) {from = estimated; fromX = estX;}
+      dist = to - from;
+    } else toX = getX(to);
+    if (x > toX) return {line: lineNo, ch: to, outside: wrongLine};
+    // Do a binary search between these bounds.
+    for (;;) {
+      if (bidi ? to == from || to == moveVisually(lineObj, from, 1) : to - from <= 1) {
+        var after = x - fromX < toX - x, ch = after ? from : to;
+        while (isExtendingChar.test(lineObj.text.charAt(ch))) ++ch;
+        return {line: lineNo, ch: ch, after: after, outside: wrongLine};
+      }
+      var step = Math.ceil(dist / 2), middle = from + step;
+      if (bidi) {
+        middle = from;
+        for (var i = 0; i < step; ++i) middle = moveVisually(lineObj, middle, 1);
+      }
+      var middleX = getX(middle);
+      if (middleX > x) {to = middle; toX = middleX; if (wrongLine) toX += 1000; dist -= step;}
+      else {from = middle; fromX = middleX; dist = step;}
     }
-    function replaceSelection(code, collapse) {
-      replaceRange1(splitLines(code), sel.from, sel.to, function(end) {
-        if (collapse == "end") return {from: end, to: end};
-        else if (collapse == "start") return {from: sel.from, to: sel.from};
-        else return {from: sel.from, to: end};
-      });
+  }
+
+  var measureText;
+  function textHeight(display) {
+    if (display.cachedTextHeight != null) return display.cachedTextHeight;
+    if (measureText == null) {
+      measureText = elt("pre");
+      // Measure a bunch of lines, for browsers that compute
+      // fractional heights.
+      for (var i = 0; i < 49; ++i) {
+        measureText.appendChild(document.createTextNode("x"));
+        measureText.appendChild(elt("br"));
+      }
+      measureText.appendChild(document.createTextNode("x"));
+    }
+    removeChildrenAndAdd(display.measure, measureText);
+    var height = measureText.offsetHeight / 50;
+    if (height > 3) display.cachedTextHeight = height;
+    removeChildren(display.measure);
+    return height || 1;
+  }
+
+  function charWidth(display) {
+    if (display.cachedCharWidth != null) return display.cachedCharWidth;
+    var anchor = elt("span", "x");
+    var pre = elt("pre", [anchor]);
+    removeChildrenAndAdd(display.measure, pre);
+    var width = anchor.offsetWidth;
+    if (width > 2) display.cachedCharWidth = width;
+    return width || 10;
+  }
+
+  // OPERATIONS
+
+  // Operations are used to wrap changes in such a way that each
+  // change won't have to update the cursor and display (which would
+  // be awkward, slow, and error-prone), but instead updates are
+  // batched and then all combined and executed at once.
+
+  function startOperation(cm) {
+    if (cm.curOp) ++cm.curOp.depth;
+    else cm.curOp = {
+      // Nested operations delay update until the outermost one
+      // finishes.
+      depth: 1,
+      // An array of ranges of lines that have to be updated. See
+      // updateDisplay.
+      changes: [],
+      delayedCallbacks: [],
+      updateInput: null,
+      userSelChange: null,
+      textChanged: null,
+      selectionChanged: false,
+      updateMaxLine: false
+    };
+  }
+
+  function endOperation(cm) {
+    var op = cm.curOp;
+    if (--op.depth) return;
+    cm.curOp = null;
+    var view = cm.view, display = cm.display;
+    if (op.updateMaxLine) computeMaxLength(view);
+    if (view.maxLineChanged && !cm.options.lineWrapping) {
+      var width = measureChar(cm, view.maxLine, view.maxLine.text.length).right;
+      display.sizer.style.minWidth = (width + 3 + scrollerCutOff) + "px";
+      view.maxLineChanged = false;
     }
-    function replaceRange1(code, from, to, computeSel) {
-      var endch = code.length == 1 ? code[0].length + from.ch : code[code.length-1].length;
-      var newSel = computeSel({line: from.line + code.length - 1, ch: endch});
-      updateLines(from, to, code, newSel.from, newSel.to);
+    var newScrollPos, updated;
+    if (op.selectionChanged) {
+      var coords = cursorCoords(cm, selHead(view));
+      newScrollPos = calculateScrollPos(display, coords.left, coords.top, coords.left, coords.bottom);
     }
+    if (op.changes.length || newScrollPos && newScrollPos.scrollTop != null)
+      updated = updateDisplay(cm, op.changes, newScrollPos && newScrollPos.scrollTop);
+    if (!updated && op.selectionChanged) updateSelection(cm);
+    if (newScrollPos) scrollCursorIntoView(cm);
+    if (op.selectionChanged) restartBlink(cm);
+
+    if (view.focused && op.updateInput)
+      resetInput(cm, op.userSelChange);
+
+    if (op.textChanged)
+      signal(cm, "change", cm, op.textChanged);
+    if (op.selectionChanged) signal(cm, "cursorActivity", cm);
+    for (var i = 0; i < op.delayedCallbacks.length; ++i) op.delayedCallbacks[i](cm);
+  }
 
-    function getRange(from, to, lineSep) {
-      var l1 = from.line, l2 = to.line;
-      if (l1 == l2) return getLine(l1).text.slice(from.ch, to.ch);
-      var code = [getLine(l1).text.slice(from.ch)];
-      doc.iter(l1 + 1, l2, function(line) { code.push(line.text); });
-      code.push(getLine(l2).text.slice(0, to.ch));
-      return code.join(lineSep || "\n");
+  // Wraps a function in an operation. Returns the wrapped function.
+  function operation(cm1, f) {
+    return function() {
+      var cm = cm1 || this;
+      startOperation(cm);
+      try {var result = f.apply(cm, arguments);}
+      finally {endOperation(cm);}
+      return result;
+    };
+  }
+
+  function regChange(cm, from, to, lendiff) {
+    cm.curOp.changes.push({from: from, to: to, diff: lendiff});
+  }
+
+  // INPUT HANDLING
+
+  function slowPoll(cm) {
+    if (cm.view.pollingFast) return;
+    cm.display.poll.set(cm.options.pollInterval, function() {
+      readInput(cm);
+      if (cm.view.focused) slowPoll(cm);
+    });
+  }
+
+  function fastPoll(cm) {
+    var missed = false;
+    cm.display.pollingFast = true;
+    function p() {
+      var changed = readInput(cm);
+      if (!changed && !missed) {missed = true; cm.display.poll.set(60, p);}
+      else {cm.display.pollingFast = false; slowPoll(cm);}
     }
-    function getSelection(lineSep) {
-      return getRange(sel.from, sel.to, lineSep);
+    cm.display.poll.set(20, p);
+  }
+
+  // prevInput is a hack to work with IME. If we reset the textarea
+  // on every change, that breaks IME. So we look for changes
+  // compared to the previous content instead. (Modern browsers have
+  // events that indicate IME taking place, but these are not widely
+  // supported or compatible enough yet to rely on.)
+  function readInput(cm) {
+    var input = cm.display.input, prevInput = cm.display.prevInput, view = cm.view, sel = view.sel;
+    if (!view.focused || hasSelection(input) || isReadOnly(cm)) return false;
+    var text = input.value;
+    if (text == prevInput && posEq(sel.from, sel.to)) return false;
+    startOperation(cm);
+    view.sel.shift = null;
+    var same = 0, l = Math.min(prevInput.length, text.length);
+    while (same < l && prevInput[same] == text[same]) ++same;
+    if (same < prevInput.length)
+      sel.from = {line: sel.from.line, ch: sel.from.ch - (prevInput.length - same)};
+    else if (view.overwrite && posEq(sel.from, sel.to) && !cm.display.pasteIncoming)
+      sel.to = {line: sel.to.line, ch: Math.min(getLine(cm.view.doc, sel.to.line).text.length, sel.to.ch + (text.length - same))};
+    var updateInput = cm.curOp.updateInput;
+    cm.replaceSelection(text.slice(same), "end");
+    cm.curOp.updateInput = updateInput;
+    if (text.length > 1000) { input.value = cm.display.prevInput = ""; }
+    else cm.display.prevInput = text;
+    endOperation(cm);
+    cm.display.pasteIncoming = false;
+    return true;
+  }
+
+  function resetInput(cm, user) {
+    var view = cm.view, minimal, selected;
+    if (!posEq(view.sel.from, view.sel.to)) {
+      cm.display.prevInput = "";
+      minimal = hasCopyEvent &&
+        (view.sel.to.line - view.sel.from.line > 100 || (selected = cm.getSelection()).length > 1000);
+      if (minimal) cm.display.input.value = "-";
+      else cm.display.input.value = selected || cm.getSelection();
+      if (view.focused) selectInput(cm.display.input);
+    } else if (user) cm.display.prevInput = cm.display.input.value = "";
+    cm.display.inaccurateSelection = minimal;
+  }
+
+  function focusInput(cm) {
+    if (cm.options.readOnly != "nocursor") cm.display.input.focus();
+  }
+
+  function isReadOnly(cm) {
+    return cm.options.readOnly || cm.view.cantEdit;
+  }
+
+  // EVENT HANDLERS
+
+  function registerEventHandlers(cm) {
+    var d = cm.display;
+    on(d.scroller, "mousedown", operation(cm, onMouseDown));
+    on(d.gutters, "mousedown", operation(cm, clickInGutter));
+    on(d.scroller, "dblclick", operation(cm, e_preventDefault));
+    on(d.lineSpace, "selectstart", function(e) {
+      if (!mouseEventInWidget(d, e)) e_preventDefault(e);
+    });
+    // Gecko browsers fire contextmenu *after* opening the menu, at
+    // which point we can't mess with it anymore. Context menu is
+    // handled in onMouseDown for Gecko.
+    if (!gecko) on(d.scroller, "contextmenu", function(e) {onContextMenu(cm, e);});
+
+    on(d.scroller, "scroll", function() {
+      setScrollTop(cm, d.scroller.scrollTop);
+      setScrollLeft(cm, d.scroller.scrollLeft);
+      signal(cm, "scroll", cm);
+    });
+    on(d.scrollbarV, "scroll", function() {
+      setScrollTop(cm, d.scrollbarV.scrollTop);
+    });
+    on(d.scrollbarH, "scroll", function() {
+      setScrollLeft(cm, d.scrollbarH.scrollLeft);
+    });
+
+    on(d.scroller, "mousewheel", function(e){onScrollWheel(cm, e);});
+    on(d.scroller, "DOMMouseScroll", function(e){onScrollWheel(cm, e);});
+
+    function reFocus() { if (cm.view.focused) setTimeout(bind(focusInput, cm), 0); }
+    on(d.scrollbarH, "mousedown", reFocus);
+    on(d.scrollbarV, "mousedown", reFocus);
+    // Prevent wrapper from ever scrolling
+    on(d.wrapper, "scroll", function() { d.wrapper.scrollTop = d.wrapper.scrollLeft = 0; });
+    on(window, "resize", function resizeHandler() {
+      // Might be a text scaling operation, clear size caches.
+      d.cachedCharWidth = d.cachedTextHeight = null;
+      d.measureLineCache.length = d.measureLineCache.pos = 0;
+      if (d.wrapper.parentNode) updateDisplay(cm, true);
+      else off(window, "resize", resizeHandler);
+    });
+
+    on(d.input, "keyup", operation(cm, function(e) {
+      if (cm.options.onKeyEvent && cm.options.onKeyEvent(cm, addStop(e))) return;
+      if (e_prop(e, "keyCode") == 16) cm.view.sel.shift = null;
+    }));
+    on(d.input, "input", bind(fastPoll, cm));
+    on(d.input, "keydown", operation(cm, onKeyDown));
+    on(d.input, "keypress", operation(cm, onKeyPress));
+    on(d.input, "focus", bind(onFocus, cm));
+    on(d.input, "blur", bind(onBlur, cm));
+
+    function drag_(e) {
+      if (cm.options.onDragEvent && cm.options.onDragEvent(cm, addStop(e))) return;
+      e_stop(e);
+    }
+    if (cm.options.dragDrop) {
+      on(d.scroller, "dragstart", function(e){onDragStart(cm, e);});
+      on(d.scroller, "dragenter", drag_);
+      on(d.scroller, "dragover", drag_);
+      on(d.scroller, "drop", operation(cm, onDrop));
     }
+    on(d.scroller, "paste", function(){focusInput(cm); fastPoll(cm);});
+    on(d.input, "paste", function() {
+      d.pasteIncoming = true;
+      fastPoll(cm);
+    });
 
-    function slowPoll() {
-      if (pollingFast) return;
-      poll.set(options.pollInterval, function() {
-        startOperation();
-        readInput();
-        if (focused) slowPoll();
-        endOperation();
-      });
+    function prepareCopy() {
+      if (d.inaccurateSelection) {
+        d.prevInput = "";
+        d.inaccurateSelection = false;
+        d.input.value = cm.getSelection();
+        selectInput(d.input);
+      }
     }
-    function fastPoll() {
-      var missed = false;
-      pollingFast = true;
-      function p() {
-        startOperation();
-        var changed = readInput();
-        if (!changed && !missed) {missed = true; poll.set(60, p);}
-        else {pollingFast = false; slowPoll();}
-        endOperation();
-      }
-      poll.set(20, p);
-    }
-
-    // Previnput is a hack to work with IME. If we reset the textarea
-    // on every change, that breaks IME. So we look for changes
-    // compared to the previous content instead. (Modern browsers have
-    // events that indicate IME taking place, but these are not widely
-    // supported or compatible enough yet to rely on.)
-    var prevInput = "";
-    function readInput() {
-      if (leaveInputAlone || !focused || hasSelection(input) || options.readOnly) return false;
-      var text = input.value;
-      if (text == prevInput) return false;
-      shiftSelecting = null;
-      var same = 0, l = Math.min(prevInput.length, text.length);
-      while (same < l && prevInput[same] == text[same]) ++same;
-      if (same < prevInput.length)
-        sel.from = {line: sel.from.line, ch: sel.from.ch - (prevInput.length - same)};
-      else if (overwrite && posEq(sel.from, sel.to))
-        sel.to = {line: sel.to.line, ch: Math.min(getLine(sel.to.line).text.length, sel.to.ch + (text.length - same))};
-      replaceSelection(text.slice(same), "end");
-      if (text.length > 1000) { input.value = prevInput = ""; }
-      else prevInput = text;
-      return true;
+    on(d.input, "cut", prepareCopy);
+    on(d.input, "copy", prepareCopy);
+
+    // Needed to handle Tab key in KHTML
+    if (khtml) on(d.sizer, "mouseup", function() {
+        if (document.activeElement == d.input) d.input.blur();
+        focusInput(cm);
+    });
+  }
+
+  function mouseEventInWidget(display, e) {
+    for (var n = e_target(e); n != display.wrapper; n = n.parentNode)
+      if (/\bCodeMirror-(?:line)?widget\b/.test(n.className) ||
+          n.parentNode == display.sizer && n != display.mover) return true;
+  }
+
+  function posFromMouse(cm, e, liberal) {
+    var display = cm.display;
+    if (!liberal) {
+      var target = e_target(e);
+      if (target == display.scrollbarH || target == display.scrollbarH.firstChild ||
+          target == display.scrollbarV || target == display.scrollbarV.firstChild ||
+          target == display.scrollbarFiller) return null;
     }
-    function resetInput(user) {
-      if (!posEq(sel.from, sel.to)) {
-        prevInput = "";
-        input.value = getSelection();
-        selectInput(input);
-      } else if (user) prevInput = input.value = "";
-    }
-
-    function focusInput() {
-      if (options.readOnly != "nocursor") input.focus();
-    }
-
-    function scrollEditorIntoView() {
-      var rect = cursor.getBoundingClientRect();
-      // IE returns bogus coordinates when the instance sits inside of an iframe and the cursor is hidden
-      if (ie && rect.top == rect.bottom) return;
-      var winH = window.innerHeight || Math.max(document.body.offsetHeight, document.documentElement.offsetHeight);
-      if (rect.top < 0 || rect.bottom > winH) scrollCursorIntoView();
-    }
-    function scrollCursorIntoView() {
-      var coords = calculateCursorCoords();
-      scrollIntoView(coords.x, coords.y, coords.x, coords.yBot);
-    }
-    function calculateCursorCoords() {
-      var cursor = localCoords(sel.inverted ? sel.from : sel.to);
-      var x = options.lineWrapping ? Math.min(cursor.x, lineSpace.offsetWidth) : cursor.x;
-      return {x: x, y: cursor.y, yBot: cursor.yBot};
-    }
-    function scrollIntoView(x1, y1, x2, y2) {
-      var scrollPos = calculateScrollPos(x1, y1, x2, y2);
-      if (scrollPos.scrollLeft != null) {scroller.scrollLeft = scrollPos.scrollLeft;}
-      if (scrollPos.scrollTop != null) {scrollbar.scrollTop = scroller.scrollTop = scrollPos.scrollTop;}
-    }
-    function calculateScrollPos(x1, y1, x2, y2) {
-      var pl = paddingLeft(), pt = paddingTop();
-      y1 += pt; y2 += pt; x1 += pl; x2 += pl;
-      var screen = scroller.clientHeight, screentop = scrollbar.scrollTop, result = {};
-      var docBottom = needsScrollbar() || Infinity;
-      var atTop = y1 < pt + 10, atBottom = y2 + pt > docBottom - 10;
-      if (y1 < screentop) result.scrollTop = atTop ? 0 : Math.max(0, y1);
-      else if (y2 > screentop + screen) result.scrollTop = (atBottom ? docBottom : y2) - screen;
-
-      var screenw = scroller.clientWidth, screenleft = scroller.scrollLeft;
-      var gutterw = options.fixedGutter ? gutter.clientWidth : 0;
-      var atLeft = x1 < gutterw + pl + 10;
-      if (x1 < screenleft + gutterw || atLeft) {
-        if (atLeft) x1 = 0;
-        result.scrollLeft = Math.max(0, x1 - 10 - gutterw);
-      } else if (x2 > screenw + screenleft - 3) {
-        result.scrollLeft = x2 + 10 - screenw;
+    var x, y, space = display.lineSpace.getBoundingClientRect();
+    // Fails unpredictably on IE[67] when mouse is dragged around quickly.
+    try { x = e.clientX; y = e.clientY; } catch (e) { return null; }
+    return coordsChar(cm, x - space.left, y - space.top);
+  }
+
+  var lastClick, lastDoubleClick;
+  function onMouseDown(e) {
+    var cm = this, display = cm.display, view = cm.view, sel = view.sel, doc = view.doc;
+    setShift(cm.view, e_prop(e, "shiftKey"));
+
+    if (mouseEventInWidget(display, e)) {
+      if (!webkit) {
+        display.scroller.draggable = false;
+        setTimeout(function(){display.scroller.draggable = true;}, 100);
       }
-      return result;
+      return;
     }
+    if (clickInGutter.call(cm, e)) return;
+    var start = posFromMouse(cm, e);
+
+    switch (e_button(e)) {
+    case 3:
+      if (gecko) onContextMenu.call(cm, cm, e);
+      return;
+    case 2:
+      if (start) setSelectionUser(cm, start, start);
+      setTimeout(bind(focusInput, cm), 20);
+      e_preventDefault(e);
+      return;
+    }
+    // For button 1, if it was clicked inside the editor
+    // (posFromMouse returning non-null), we have to adjust the
+    // selection.
+    if (!start) {if (e_target(e) == display.scroller) e_preventDefault(e); return;}
+
+    if (!view.focused) onFocus(cm);
 
-    function visibleLines(scrollTop) {
-      var lh = textHeight(), top = (scrollTop != null ? scrollTop : scrollbar.scrollTop) - paddingTop();
-      var fromHeight = Math.max(0, Math.floor(top / lh));
-      var toHeight = Math.ceil((top + scroller.clientHeight) / lh);
-      return {from: lineAtHeight(doc, fromHeight),
-              to: lineAtHeight(doc, toHeight)};
+    var now = +new Date, type = "single";
+    if (lastDoubleClick && lastDoubleClick.time > now - 400 && posEq(lastDoubleClick.pos, start)) {
+      type = "triple";
+      e_preventDefault(e);
+      setTimeout(bind(focusInput, cm), 20);
+      selectLine(cm, start.line);
+    } else if (lastClick && lastClick.time > now - 400 && posEq(lastClick.pos, start)) {
+      type = "double";
+      lastDoubleClick = {time: now, pos: start};
+      e_preventDefault(e);
+      var word = findWordAt(getLine(doc, start.line).text, start);
+      setSelectionUser(cm, word.from, word.to);
+    } else { lastClick = {time: now, pos: start}; }
+
+    var last = start;
+    if (cm.options.dragDrop && dragAndDrop && !isReadOnly(cm) && !posEq(sel.from, sel.to) &&
+        !posLess(start, sel.from) && !posLess(sel.to, start) && type == "single") {
+      var dragEnd = operation(cm, function(e2) {
+        if (webkit) display.scroller.draggable = false;
+        view.draggingText = false;
+        off(document, "mouseup", dragEnd);
+        off(display.scroller, "drop", dragEnd);
+        if (Math.abs(e.clientX - e2.clientX) + Math.abs(e.clientY - e2.clientY) < 10) {
+          e_preventDefault(e2);
+          setSelectionUser(cm, start, start);
+          focusInput(cm);
+        }
+      });
+      // Let the drag handler handle this.
+      if (webkit) display.scroller.draggable = true;
+      view.draggingText = dragEnd;
+      // IE's approach to draggable
+      if (display.scroller.dragDrop) display.scroller.dragDrop();
+      on(document, "mouseup", dragEnd);
+      on(display.scroller, "drop", dragEnd);
+      return;
     }
-    // Uses a set of changes plus the current scroll position to
-    // determine which DOM updates have to be made, and makes the
-    // updates.
-    function updateDisplay(changes, suppressCallback, scrollTop) {
-      if (!scroller.clientWidth) {
-        showingFrom = showingTo = displayOffset = 0;
-        return;
+    e_preventDefault(e);
+    if (type == "single") setSelectionUser(cm, start, start);
+
+    var startstart = sel.from, startend = sel.to;
+
+    function doSelect(cur) {
+      if (type == "single") {
+        setSelectionUser(cm, start, cur);
+      } else if (type == "double") {
+        var word = findWordAt(getLine(doc, cur.line).text, cur);
+        if (posLess(cur, startstart)) setSelectionUser(cm, word.from, startend);
+        else setSelectionUser(cm, startstart, word.to);
+      } else if (type == "triple") {
+        if (posLess(cur, startstart)) setSelectionUser(cm, startend, clipPos(doc, {line: cur.line, ch: 0}));
+        else setSelectionUser(cm, startstart, clipPos(doc, {line: cur.line + 1, ch: 0}));
       }
-      // Compute the new visible window
-      // If scrollTop is specified, use that to determine which lines
-      // to render instead of the current scrollbar position.
-      var visible = visibleLines(scrollTop);
-      // Bail out if the visible area is already rendered and nothing changed.
-      if (changes !== true && changes.length == 0 && visible.from > showingFrom && visible.to < showingTo) {
-        updateVerticalScroll(scrollTop);
-        return;
+    }
+
+    var editorSize = display.wrapper.getBoundingClientRect();
+    // Used to ensure timeout re-tries don't fire when another extend
+    // happened in the meantime (clearTimeout isn't reliable -- at
+    // least on Chrome, the timeouts still happen even when cleared,
+    // if the clear happens after their scheduled firing time).
+    var counter = 0;
+
+    function extend(e) {
+      var curCount = ++counter;
+      var cur = posFromMouse(cm, e, true);
+      if (!cur) return;
+      if (!posEq(cur, last)) {
+        if (!view.focused) onFocus(cm);
+        last = cur;
+        doSelect(cur);
+        var visible = visibleLines(display, doc);
+        if (cur.line >= visible.to || cur.line < visible.from)
+          setTimeout(operation(cm, function(){if (counter == curCount) extend(e);}), 150);
+      } else {
+        var outside = e.clientY < editorSize.top ? -20 : e.clientY > editorSize.bottom ? 20 : 0;
+        if (outside) setTimeout(operation(cm, function() {
+          if (counter != curCount) return;
+          display.scroller.scrollTop += outside;
+          extend(e);
+        }), 50);
       }
-      var from = Math.max(visible.from - 100, 0), to = Math.min(doc.size, visible.to + 100);
-      if (showingFrom < from && from - showingFrom < 20) from = showingFrom;
-      if (showingTo > to && showingTo - to < 20) to = Math.min(doc.size, showingTo);
+    }
 
-      // Create a range of theoretically intact lines, and punch holes
-      // in that using the change info.
-      var intact = changes === true ? [] :
-        computeIntact([{from: showingFrom, to: showingTo, domStart: 0}], changes);
-      // Clip off the parts that won't be visible
-      var intactLines = 0;
-      for (var i = 0; i < intact.length; ++i) {
-        var range = intact[i];
-        if (range.from < from) {range.domStart += (from - range.from); range.from = from;}
-        if (range.to > to) range.to = to;
-        if (range.from >= range.to) intact.splice(i--, 1);
-        else intactLines += range.to - range.from;
-      }
-      if (intactLines == to - from && from == showingFrom && to == showingTo) {
-        updateVerticalScroll(scrollTop);
+    function done(e) {
+      counter = Infinity;
+      var cur = posFromMouse(cm, e);
+      if (cur) doSelect(cur);
+      e_preventDefault(e);
+      focusInput(cm);
+      off(document, "mousemove", move);
+      off(document, "mouseup", up);
+    }
+
+    var move = operation(cm, function(e) {
+      e_preventDefault(e);
+      if (!ie && !e_button(e)) done(e);
+      else extend(e);
+    });
+    var up = operation(cm, done);
+    on(document, "mousemove", move);
+    on(document, "mouseup", up);
+  }
+
+  function onDrop(e) {
+    var cm = this;
+    if (cm.options.onDragEvent && cm.options.onDragEvent(cm, addStop(e))) return;
+    e_preventDefault(e);
+    var pos = posFromMouse(cm, e, true), files = e.dataTransfer.files;
+    if (!pos || isReadOnly(cm)) return;
+    if (files && files.length && window.FileReader && window.File) {
+      var n = files.length, text = Array(n), read = 0;
+      var loadFile = function(file, i) {
+        var reader = new FileReader;
+        reader.onload = function() {
+          text[i] = reader.result;
+          if (++read == n) {
+            pos = clipPos(cm.view.doc, pos);
+            operation(cm, function() {
+              var end = replaceRange(cm, text.join(""), pos, pos);
+              setSelectionUser(cm, pos, end);
+            })();
+          }
+        };
+        reader.readAsText(file);
+      };
+      for (var i = 0; i < n; ++i) loadFile(files[i], i);
+    } else {
+      // Don't do a replace if the drop happened inside of the selected text.
+      if (cm.view.draggingText && !(posLess(pos, cm.view.sel.from) || posLess(cm.view.sel.to, pos))) {
+        cm.view.draggingText(e);
+        if (ie) setTimeout(bind(focusInput, cm), 50);
         return;
       }
-      intact.sort(function(a, b) {return a.domStart - b.domStart;});
-
-      var th = textHeight(), gutterDisplay = gutter.style.display;
-      lineDiv.style.display = "none";
-      patchDisplay(from, to, intact);
-      lineDiv.style.display = gutter.style.display = "";
-
-      var different = from != showingFrom || to != showingTo || lastSizeC != scroller.clientHeight + th;
-      // This is just a bogus formula that detects when the editor is
-      // resized or the font size changes.
-      if (different) lastSizeC = scroller.clientHeight + th;
-      showingFrom = from; showingTo = to;
-      displayOffset = heightAtLine(doc, from);
-
-      // Since this is all rather error prone, it is honoured with the
-      // only assertion in the whole file.
-      if (lineDiv.childNodes.length != showingTo - showingFrom)
-        throw new Error("BAD PATCH! " + JSON.stringify(intact) + " size=" + (showingTo - showingFrom) +
-                        " nodes=" + lineDiv.childNodes.length);
-
-      function checkHeights() {
-        var curNode = lineDiv.firstChild, heightChanged = false;
-        doc.iter(showingFrom, showingTo, function(line) {
-          // Work around bizarro IE7 bug where, sometimes, our curNode
-          // is magically replaced with a new node in the DOM, leaving
-          // us with a reference to an orphan (nextSibling-less) node.
-          if (!curNode) return;
-          if (!line.hidden) {
-            var height = Math.round(curNode.offsetHeight / th) || 1;
-            if (line.height != height) {
-              updateLineHeight(line, height);
-              gutterDirty = heightChanged = true;
-            }
-          }
-          curNode = curNode.nextSibling;
-        });
-        return heightChanged;
-      }
-
-      if (options.lineWrapping) {
-        checkHeights();
-        var scrollHeight = needsScrollbar();
-        var shouldHaveScrollbar = scrollHeight ? "block" : "none";
-        if (scrollbar.style.display != shouldHaveScrollbar) {
-          scrollbar.style.display = shouldHaveScrollbar;
-          if (scrollHeight) scrollbarInner.style.height = scrollHeight + "px";
-          checkHeights();
+      try {
+        var text = e.dataTransfer.getData("Text");
+        if (text) {
+          compoundChange(cm, function() {
+            var curFrom = cm.view.sel.from, curTo = cm.view.sel.to;
+            setSelectionUser(cm, pos, pos);
+            if (cm.view.draggingText) replaceRange(cm, "", curFrom, curTo);
+            cm.replaceSelection(text);
+            focusInput(cm);
+            onFocus(cm);
+          });
         }
       }
+      catch(e){}
+    }
+  }
 
-      gutter.style.display = gutterDisplay;
-      if (different || gutterDirty) {
-        // If the gutter grew in size, re-check heights. If those changed, re-draw gutter.
-        updateGutter() && options.lineWrapping && checkHeights() && updateGutter();
+  function clickInGutter(e) {
+    var cm = this, display = cm.display;
+    try { var mX = e.clientX, mY = e.clientY; }
+    catch(e) { return false; }
+    
+    if (mX >= Math.floor(display.gutters.getBoundingClientRect().right)) return false;
+    e_preventDefault(e);
+    if (!hasHandler(cm, "gutterClick")) return true;
+
+    var lineBox = display.lineDiv.getBoundingClientRect();
+    if (mY > lineBox.bottom) return true;
+    mY -= lineBox.top - display.viewOffset;
+
+    for (var i = 0; i < cm.options.gutters.length; ++i) {
+      var g = display.gutters.childNodes[i];
+      if (g && g.getBoundingClientRect().right >= mX) {
+        var line = lineAtHeight(cm.view.doc, mY);
+        var gutter = cm.options.gutters[i];
+        signalLater(cm, cm, "gutterClick", cm, line, gutter, e);
+        break;
       }
-      updateVerticalScroll(scrollTop);
-      updateSelection();
-      if (!suppressCallback && options.onUpdate) options.onUpdate(instance);
-      return true;
     }
+    return true;
+  }
 
-    function computeIntact(intact, changes) {
-      for (var i = 0, l = changes.length || 0; i < l; ++i) {
-        var change = changes[i], intact2 = [], diff = change.diff || 0;
-        for (var j = 0, l2 = intact.length; j < l2; ++j) {
-          var range = intact[j];
-          if (change.to <= range.from && change.diff)
-            intact2.push({from: range.from + diff, to: range.to + diff,
-                          domStart: range.domStart});
-          else if (change.to <= range.from || change.from >= range.to)
-            intact2.push(range);
-          else {
-            if (change.from > range.from)
-              intact2.push({from: range.from, to: change.from, domStart: range.domStart});
-            if (change.to < range.to)
-              intact2.push({from: change.to + diff, to: range.to + diff,
-                            domStart: range.domStart + (change.to - range.from)});
-          }
-        }
-        intact = intact2;
+  function onDragStart(cm, e) {
+    var txt = cm.getSelection();
+    e.dataTransfer.setData("Text", txt);
+
+    // Use dummy image instead of default browsers image.
+    if (e.dataTransfer.setDragImage)
+      e.dataTransfer.setDragImage(elt('img'), 0, 0);
+  }
+
+  function setScrollTop(cm, val) {
+    if (Math.abs(cm.view.scrollTop - val) < 2) return;
+    cm.view.scrollTop = val;
+    if (!gecko) updateDisplay(cm, [], val);
+    if (cm.display.scroller.scrollTop != val) cm.display.scroller.scrollTop = val;
+    if (cm.display.scrollbarV.scrollTop != val) cm.display.scrollbarV.scrollTop = val;
+    if (gecko) updateDisplay(cm, []);
+  }
+  function setScrollLeft(cm, val) {
+    if (Math.abs(cm.view.scrollLeft - val) < 2) return;
+    cm.view.scrollLeft = val;
+    if (cm.display.scroller.scrollLeft != val) cm.display.scroller.scrollLeft = val;
+    if (cm.display.scrollbarH.scrollLeft != val) cm.display.scrollbarH.scrollLeft = val;
+    alignVertically(cm.display);
+  }
+
+  // Since the delta values reported on mouse wheel events are
+  // unstandardized between browsers and even browser versions, and
+  // generally horribly unpredictable, this code starts by measuring
+  // the scroll effect that the first few mouse wheel events have,
+  // and, from that, detects the way it can convert deltas to pixel
+  // offsets afterwards.
+  //
+  // The reason we want to know the amount a wheel event will scroll
+  // is that it gives us a chance to update the display before the
+  // actual scrolling happens, reducing flickering.
+
+  var wheelSamples = 0, wheelDX, wheelDY, wheelStartX, wheelStartY, wheelPixelsPerUnit = null;
+  // Fill in a browser-detected starting value on browsers where we
+  // know one. These don't have to be accurate -- the result of them
+  // being wrong would just be a slight flicker on the first wheel
+  // scroll (if it is large enough).
+  if (ie) wheelPixelsPerUnit = -.53;
+  else if (gecko) wheelPixelsPerUnit = 15;
+  else if (chrome) wheelPixelsPerUnit = -.7;
+  else if (safari) wheelPixelsPerUnit = -1/3;
+
+  function onScrollWheel(cm, e) {
+    var dx = e.wheelDeltaX, dy = e.wheelDeltaY;
+    if (dx == null && e.detail && e.axis == e.HORIZONTAL_AXIS) dx = e.detail;
+    if (dy == null && e.detail && e.axis == e.VERTICAL_AXIS) dy = e.detail;
+    else if (dy == null) dy = e.wheelDelta;
+
+    var scroll = cm.display.scroller;
+    if (wheelPixelsPerUnit != null) {
+      var pixels = dy * wheelPixelsPerUnit;
+      var top = cm.view.scrollTop, bot = top + cm.display.wrapper.clientHeight;
+      if (pixels < 0) top = Math.max(0, top + pixels);
+      else bot = Math.min(cm.view.doc.height, bot + pixels);
+      updateDisplay(cm, [], {top: top, bottom: bot});
+    }
+    if (wheelSamples < 20) {
+      if (wheelStartX == null) {
+        wheelStartX = scroll.scrollLeft; wheelStartY = scroll.scrollTop;
+        wheelDX = dx; wheelDY = dy;
+        setTimeout(function() {
+          var movedX = scroll.scrollLeft - wheelStartX;
+          var movedY = scroll.scrollTop - wheelStartY;
+          var sample = (movedY && wheelDY && movedY / wheelDY) ||
+            (movedX && wheelDX && movedX / wheelDX);
+          wheelStartX = wheelStartY = null;
+          if (!sample) return;
+          wheelPixelsPerUnit = (wheelPixelsPerUnit * wheelSamples + sample) / (wheelSamples + 1);
+          ++wheelSamples;
+        }, 200);
+      } else {
+        wheelDX += dx; wheelDY += dy;
       }
-      return intact;
     }
+  }
 
-    function patchDisplay(from, to, intact) {
-      function killNode(node) {
-        var tmp = node.nextSibling;
-        node.parentNode.removeChild(node);
-        return tmp;
+  function doHandleBinding(cm, bound, dropShift) {
+    if (typeof bound == "string") {
+      bound = commands[bound];
+      if (!bound) return false;
+    }
+    var view = cm.view, prevShift = view.sel.shift;
+    try {
+      if (isReadOnly(cm)) view.suppressEdits = true;
+      if (dropShift) view.sel.shift = null;
+      bound(cm);
+    } catch(e) {
+      if (e != Pass) throw e;
+      return false;
+    } finally {
+      view.sel.shift = prevShift;
+      view.suppressEdits = false;
+    }
+    return true;
+  }
+
+  var maybeTransition;
+  function handleKeyBinding(cm, e) {
+    // Handle auto keymap transitions
+    var startMap = getKeyMap(cm.options.keyMap), next = startMap.auto;
+    clearTimeout(maybeTransition);
+    if (next && !isModifierKey(e)) maybeTransition = setTimeout(function() {
+      if (getKeyMap(cm.options.keyMap) == startMap)
+        cm.options.keyMap = (next.call ? next.call(null, cm) : next);
+    }, 50);
+
+    var name = keyNames[e_prop(e, "keyCode")], handled = false;
+    var flipCtrlCmd = opera && mac;
+    if (name == null || e.altGraphKey) return false;
+    if (e_prop(e, "altKey")) name = "Alt-" + name;
+    if (e_prop(e, flipCtrlCmd ? "metaKey" : "ctrlKey")) name = "Ctrl-" + name;
+    if (e_prop(e, flipCtrlCmd ? "ctrlKey" : "metaKey")) name = "Cmd-" + name;
+
+    var stopped = false;
+    function stop() { stopped = true; }
+
+    if (e_prop(e, "shiftKey")) {
+      handled = lookupKey("Shift-" + name, cm.options.extraKeys, cm.options.keyMap,
+                          function(b) {return doHandleBinding(cm, b, true);}, stop)
+        || lookupKey(name, cm.options.extraKeys, cm.options.keyMap, function(b) {
+          if (typeof b == "string" && /^go[A-Z]/.test(b)) return doHandleBinding(cm, b);
+        }, stop);
+    } else {
+      handled = lookupKey(name, cm.options.extraKeys, cm.options.keyMap,
+                          function(b) { return doHandleBinding(cm, b); }, stop);
+    }
+    if (stopped) handled = false;
+    if (handled) {
+      e_preventDefault(e);
+      restartBlink(cm);
+      if (ie_lt9) { e.oldKeyCode = e.keyCode; e.keyCode = 0; }
+    }
+    return handled;
+  }
+
+  function handleCharBinding(cm, e, ch) {
+    var handled = lookupKey("'" + ch + "'", cm.options.extraKeys, cm.options.keyMap,
+                            function(b) { return doHandleBinding(cm, b, true); });
+    if (handled) {
+      e_preventDefault(e);
+      restartBlink(cm);
+    }
+    return handled;
+  }
+
+  var lastStoppedKey = null;
+  function onKeyDown(e) {
+    var cm = this;
+    if (!cm.view.focused) onFocus(cm);
+    if (ie && e.keyCode == 27) { e.returnValue = false; }
+    if (cm.display.pollingFast) { if (readInput(cm)) cm.display.pollingFast = false; }
+    if (cm.options.onKeyEvent && cm.options.onKeyEvent(cm, addStop(e))) return;
+    var code = e_prop(e, "keyCode");
+    // IE does strange things with escape.
+    setShift(cm.view, code == 16 || e_prop(e, "shiftKey"));
+    // First give onKeyEvent option a chance to handle this.
+    var handled = handleKeyBinding(cm, e);
+    if (opera) {
+      lastStoppedKey = handled ? code : null;
+      // Opera has no cut event... we try to at least catch the key combo
+      if (!handled && code == 88 && e_prop(e, mac ? "metaKey" : "ctrlKey"))
+        cm.replaceSelection("");
+    }
+  }
+
+  function onKeyPress(e) {
+    var cm = this;
+    if (cm.display.pollingFast) readInput(cm);
+    if (cm.options.onKeyEvent && cm.options.onKeyEvent(cm, addStop(e))) return;
+    var keyCode = e_prop(e, "keyCode"), charCode = e_prop(e, "charCode");
+    if (opera && keyCode == lastStoppedKey) {lastStoppedKey = null; e_preventDefault(e); return;}
+    if (((opera && (!e.which || e.which < 10)) || khtml) && handleKeyBinding(cm, e)) return;
+    var ch = String.fromCharCode(charCode == null ? keyCode : charCode);
+    if (this.options.electricChars && this.view.mode.electricChars &&
+        this.options.smartIndent && !isReadOnly(this) &&
+        this.view.mode.electricChars.indexOf(ch) > -1)
+      setTimeout(operation(cm, function() {indentLine(cm, cm.view.sel.to.line, "smart");}), 75);
+    if (handleCharBinding(cm, e, ch)) return;
+    fastPoll(cm);
+  }
+
+  function onFocus(cm) {
+    if (cm.options.readOnly == "nocursor") return;
+    if (!cm.view.focused) {
+      signal(cm, "focus", cm);
+      cm.view.focused = true;
+      if (cm.display.scroller.className.search(/\bCodeMirror-focused\b/) == -1)
+        cm.display.scroller.className += " CodeMirror-focused";
+      resetInput(cm, true);
+    }
+    slowPoll(cm);
+    restartBlink(cm);
+  }
+  function onBlur(cm) {
+    if (cm.view.focused) {
+      signal(cm, "blur", cm);
+      cm.view.focused = false;
+      cm.display.scroller.className = cm.display.scroller.className.replace(" CodeMirror-focused", "");
+    }
+    clearInterval(cm.display.blinker);
+    setTimeout(function() {if (!cm.view.focused) cm.view.sel.shift = null;}, 150);
+  }
+
+  var detectingSelectAll;
+  function onContextMenu(cm, e) {
+    var display = cm.display, sel = cm.view.sel;
+    var pos = posFromMouse(cm, e), scrollPos = display.scroller.scrollTop;
+    if (!pos || opera) return; // Opera is difficult.
+    if (posEq(sel.from, sel.to) || posLess(pos, sel.from) || !posLess(pos, sel.to))
+      operation(cm, setSelection)(cm, pos, pos);
+
+    var oldCSS = display.input.style.cssText;
+    display.inputDiv.style.position = "absolute";
+    display.input.style.cssText = "position: fixed; width: 30px; height: 30px; top: " + (e.clientY - 5) +
+      "px; left: " + (e.clientX - 5) + "px; z-index: 1000; background: white; outline: none;" +
+      "border-width: 0; outline: none; overflow: hidden; opacity: .05; filter: alpha(opacity=5);";
+    focusInput(cm);
+    resetInput(cm, true);
+    // Adds "Select all" to context menu in FF
+    if (posEq(sel.from, sel.to)) display.input.value = display.prevInput = " ";
+
+    function rehide() {
+      display.inputDiv.style.position = "relative";
+      display.input.style.cssText = oldCSS;
+      if (ie_lt9) display.scrollbarV.scrollTop = display.scroller.scrollTop = scrollPos;
+      slowPoll(cm);
+
+      // Try to detect the user choosing select-all 
+      if (display.input.selectionStart != null) {
+        clearTimeout(detectingSelectAll);
+        var extval = display.input.value = " " + (posEq(sel.from, sel.to) ? "" : display.input.value), i = 0;
+        display.prevInput = " ";
+        display.input.selectionStart = 1; display.input.selectionEnd = extval.length;
+        detectingSelectAll = setTimeout(function poll(){
+          if (display.prevInput == " " && display.input.selectionStart == 0)
+            operation(cm, commands.selectAll)(cm);
+          else if (i++ < 10) detectingSelectAll = setTimeout(poll, 500);
+          else resetInput(cm);
+        }, 200);
       }
-      // The first pass removes the DOM nodes that aren't intact.
-      if (!intact.length) removeChildren(lineDiv);
-      else {
-        var domPos = 0, curNode = lineDiv.firstChild, n;
-        for (var i = 0; i < intact.length; ++i) {
-          var cur = intact[i];
-          while (cur.domStart > domPos) {curNode = killNode(curNode); domPos++;}
-          for (var j = 0, e = cur.to - cur.from; j < e; ++j) {curNode = curNode.nextSibling; domPos++;}
-        }
-        while (curNode) curNode = killNode(curNode);
-      }
-      // This pass fills in the lines that actually changed.
-      var nextIntact = intact.shift(), curNode = lineDiv.firstChild, j = from;
-      doc.iter(from, to, function(line) {
-        if (nextIntact && nextIntact.to == j) nextIntact = intact.shift();
-        if (!nextIntact || nextIntact.from > j) {
-          if (line.hidden) var lineElement = elt("pre");
-          else {
-            var lineElement = line.getElement(makeTab);
-            if (line.className) lineElement.className = line.className;
-            // Kludge to make sure the styled element lies behind the selection (by z-index)
-            if (line.bgClassName) {
-              var pre = elt("pre", "\u00a0", line.bgClassName, "position: absolute; left: 0; right: 0; top: 0; bottom: 0; z-index: -2");
-              lineElement = elt("div", [pre, lineElement], null, "position: relative");
-            }
-          }
-          lineDiv.insertBefore(lineElement, curNode);
-        } else {
-          curNode = curNode.nextSibling;
-        }
-        ++j;
+    }
+
+    if (gecko) {
+      e_stop(e);
+      on(window, "mouseup", function mouseup() {
+        off(window, "mouseup", mouseup);
+        setTimeout(rehide, 20);
       });
+    } else {
+      setTimeout(rehide, 50);
     }
+  }
 
-    function updateGutter() {
-      if (!options.gutter && !options.lineNumbers) return;
-      var hText = mover.offsetHeight, hEditor = scroller.clientHeight;
-      gutter.style.height = (hText - hEditor < 2 ? hEditor : hText) + "px";
-      var fragment = document.createDocumentFragment(), i = showingFrom, normalNode;
-      doc.iter(showingFrom, Math.max(showingTo, showingFrom + 1), function(line) {
-        if (line.hidden) {
-          fragment.appendChild(elt("pre"));
-        } else {
-          var marker = line.gutterMarker;
-          var text = options.lineNumbers ? options.lineNumberFormatter(i + options.firstLineNumber) : null;
-          if (marker && marker.text)
-            text = marker.text.replace("%N%", text != null ? text : "");
-          else if (text == null)
-            text = "\u00a0";
-          var markerElement = fragment.appendChild(elt("pre", null, marker && marker.style));
-          markerElement.innerHTML = text;
-          for (var j = 1; j < line.height; ++j) {
-            markerElement.appendChild(elt("br"));
-            markerElement.appendChild(document.createTextNode("\u00a0"));
-          }
-          if (!marker) normalNode = i;
+  // UPDATING
+
+  // Replace the range from from to to by the strings in newText.
+  // Afterwards, set the selection to selFrom, selTo.
+  function updateDoc(cm, from, to, newText, selUpdate) {
+    // Possibly split or suppress the update based on the presence
+    // of read-only spans in its range.
+    var split = sawReadOnlySpans &&
+      removeReadOnlyRanges(cm.view.doc, from, to);
+    if (split) {
+      for (var i = split.length - 1; i >= 1; --i)
+        updateDocInner(cm, split[i].from, split[i].to, [""]);
+      if (split.length)
+        return updateDocInner(cm, split[0].from, split[0].to, newText, selUpdate);
+    } else {
+      return updateDocInner(cm, from, to, newText, selUpdate);
+    }
+  }
+
+  function updateDocInner(cm, from, to, newText, selUpdate) {
+    if (cm.view.suppressEdits) return;
+
+    var view = cm.view, doc = view.doc, old = [];
+    doc.iter(from.line, to.line + 1, function(line) {
+      old.push(newHL(line.text, line.markedSpans));
+    });
+    if (view.history) {
+      addChange(view.history, from.line, newText.length, old);
+      while (view.history.done.length > cm.options.undoDepth) view.history.done.shift();
+    }
+    var lines = updateMarkedSpans(hlSpans(old[0]), hlSpans(lst(old)), from.ch, to.ch, newText);
+    return updateDocNoUndo(cm, from, to, lines, selUpdate);
+  }
+
+  function unredoHelper(cm, from, to, dir) {
+    var doc = cm.view.doc, hist = cm.view.history;
+    if (!from.length) return;
+    var set = from.pop(), out = [];
+    for (var i = set.length - 1; i >= 0; i -= 1) {
+      hist.dirtyCounter += dir;
+      var change = set[i];
+      var replaced = [], end = change.start + change.added;
+      doc.iter(change.start, end, function(line) { replaced.push(newHL(line.text, line.markedSpans)); });
+      out.push({start: change.start, added: change.old.length, old: replaced});
+      var pos = {line: change.start + change.old.length - 1,
+                 ch: editEnd(hlText(lst(replaced)), hlText(lst(change.old)))};
+      updateDocNoUndo(cm, {line: change.start, ch: 0}, {line: end - 1, ch: getLine(doc, end-1).text.length},
+                      change.old, pos);
+    }
+    to.push(out);
+  }
+
+  function updateDocNoUndo(cm, from, to, lines, selUpdate) {
+    var view = cm.view, doc = view.doc, display = cm.display;
+    if (view.suppressEdits) return;
+
+    var nlines = to.line - from.line, firstLine = getLine(doc, from.line), lastLine = getLine(doc, to.line);
+    var recomputeMaxLength = false, checkWidthStart = from.line;
+    if (!cm.options.lineWrapping) {
+      for (var cur = firstLine, merged; merged = collapsedSpanAtStart(cur);) {
+        checkWidthStart = merged.find().from.line;
+        cur = getLine(doc, checkWidthStart);
+      }
+      doc.iter(checkWidthStart, to.line + 1, function(line) {
+        if (lineLength(doc, line) == view.maxLineLength) {
+          recomputeMaxLength = true;
+          return true;
         }
-        ++i;
       });
-      gutter.style.display = "none";
-      removeChildrenAndAdd(gutterText, fragment);
-      // Make sure scrolling doesn't cause number gutter size to pop
-      if (normalNode != null && options.lineNumbers) {
-        var node = gutterText.childNodes[normalNode - showingFrom];
-        var minwidth = String(doc.size).length, val = eltText(node.firstChild), pad = "";
-        while (val.length + pad.length < minwidth) pad += "\u00a0";
-        if (pad) node.insertBefore(document.createTextNode(pad), node.firstChild);
-      }
-      gutter.style.display = "";
-      var resized = Math.abs((parseInt(lineSpace.style.marginLeft) || 0) - gutter.offsetWidth) > 2;
-      lineSpace.style.marginLeft = gutter.offsetWidth + "px";
-      gutterDirty = false;
-      return resized;
-    }
-    function updateSelection() {
-      var collapsed = posEq(sel.from, sel.to);
-      var fromPos = localCoords(sel.from, true);
-      var toPos = collapsed ? fromPos : localCoords(sel.to, true);
-      var headPos = sel.inverted ? fromPos : toPos, th = textHeight();
-      var wrapOff = eltOffset(wrapper), lineOff = eltOffset(lineDiv);
-      inputDiv.style.top = Math.max(0, Math.min(scroller.offsetHeight, headPos.y + lineOff.top - wrapOff.top)) + "px";
-      inputDiv.style.left = Math.max(0, Math.min(scroller.offsetWidth, headPos.x + lineOff.left - wrapOff.left)) + "px";
-      if (collapsed) {
-        cursor.style.top = headPos.y + "px";
-        cursor.style.left = (options.lineWrapping ? Math.min(headPos.x, lineSpace.offsetWidth) : headPos.x) + "px";
-        cursor.style.display = "";
-        selectionDiv.style.display = "none";
+    }
+
+    var lastHL = lst(lines), th = textHeight(display);
+
+    // First adjust the line structure
+    if (from.ch == 0 && to.ch == 0 && hlText(lastHL) == "") {
+      // This is a whole-line replace. Treated specially to make
+      // sure line objects move the way they are supposed to.
+      var added = [], prevLine = null;
+      for (var i = 0, e = lines.length - 1; i < e; ++i)
+        added.push(makeLine(hlText(lines[i]), hlSpans(lines[i]), th));
+      updateLine(cm, lastLine, lastLine.text, hlSpans(lastHL));
+      if (nlines) doc.remove(from.line, nlines, cm);
+      if (added.length) doc.insert(from.line, added);
+    } else if (firstLine == lastLine) {
+      if (lines.length == 1) {
+        updateLine(cm, firstLine, firstLine.text.slice(0, from.ch) + hlText(lines[0]) +
+                   firstLine.text.slice(to.ch), hlSpans(lines[0]));
       } else {
-        var sameLine = fromPos.y == toPos.y, fragment = document.createDocumentFragment();
-        var clientWidth = lineSpace.clientWidth || lineSpace.offsetWidth;
-        var clientHeight = lineSpace.clientHeight || lineSpace.offsetHeight;
-        var add = function(left, top, right, height) {
-          var rstyle = quirksMode ? "width: " + (!right ? clientWidth : clientWidth - right - left) + "px"
-                                  : "right: " + right + "px";
-          fragment.appendChild(elt("div", null, "CodeMirror-selected", "position: absolute; left: " + left +
-                                   "px; top: " + top + "px; " + rstyle + "; height: " + height + "px"));
-        };
-        if (sel.from.ch && fromPos.y >= 0) {
-          var right = sameLine ? clientWidth - toPos.x : 0;
-          add(fromPos.x, fromPos.y, right, th);
-        }
-        var middleStart = Math.max(0, fromPos.y + (sel.from.ch ? th : 0));
-        var middleHeight = Math.min(toPos.y, clientHeight) - middleStart;
-        if (middleHeight > 0.2 * th)
-          add(0, middleStart, 0, middleHeight);
-        if ((!sameLine || !sel.from.ch) && toPos.y < clientHeight - .5 * th)
-          add(0, toPos.y, clientWidth - toPos.x, th);
-        removeChildrenAndAdd(selectionDiv, fragment);
-        cursor.style.display = "none";
-        selectionDiv.style.display = "";
-      }
-    }
-
-    function setShift(val) {
-      if (val) shiftSelecting = shiftSelecting || (sel.inverted ? sel.to : sel.from);
-      else shiftSelecting = null;
-    }
-    function setSelectionUser(from, to) {
-      var sh = shiftSelecting && clipPos(shiftSelecting);
-      if (sh) {
-        if (posLess(sh, from)) from = sh;
-        else if (posLess(to, sh)) to = sh;
-      }
-      setSelection(from, to);
-      userSelChange = true;
-    }
-    // Update the selection. Last two args are only used by
-    // updateLines, since they have to be expressed in the line
-    // numbers before the update.
-    function setSelection(from, to, oldFrom, oldTo) {
-      goalColumn = null;
-      if (oldFrom == null) {oldFrom = sel.from.line; oldTo = sel.to.line;}
-      if (posEq(sel.from, from) && posEq(sel.to, to)) return;
-      if (posLess(to, from)) {var tmp = to; to = from; from = tmp;}
-
-      // Skip over hidden lines.
-      if (from.line != oldFrom) {
-        var from1 = skipHidden(from, oldFrom, sel.from.ch);
-        // If there is no non-hidden line left, force visibility on current line
-        if (!from1) setLineHidden(from.line, false);
-        else from = from1;
-      }
-      if (to.line != oldTo) to = skipHidden(to, oldTo, sel.to.ch);
-
-      if (posEq(from, to)) sel.inverted = false;
-      else if (posEq(from, sel.to)) sel.inverted = false;
-      else if (posEq(to, sel.from)) sel.inverted = true;
-
-      if (options.autoClearEmptyLines && posEq(sel.from, sel.to)) {
-        var head = sel.inverted ? from : to;
-        if (head.line != sel.from.line && sel.from.line < doc.size) {
-          var oldLine = getLine(sel.from.line);
-          if (/^\s+$/.test(oldLine.text))
-            setTimeout(operation(function() {
-              if (oldLine.parent && /^\s+$/.test(oldLine.text)) {
-                var no = lineNo(oldLine);
-                replaceRange("", {line: no, ch: 0}, {line: no, ch: oldLine.text.length});
-              }
-            }, 10));
-        }
+        for (var added = [], i = 1, e = lines.length - 1; i < e; ++i)
+          added.push(makeLine(hlText(lines[i]), hlSpans(lines[i]), th));
+        added.push(makeLine(hlText(lastHL) + firstLine.text.slice(to.ch), hlSpans(lastHL), th));
+        updateLine(cm, firstLine, firstLine.text.slice(0, from.ch) + hlText(lines[0]), hlSpans(lines[0]));
+        doc.insert(from.line + 1, added);
       }
-
-      sel.from = from; sel.to = to;
-      selectionChanged = true;
+    } else if (lines.length == 1) {
+      updateLine(cm, firstLine, firstLine.text.slice(0, from.ch) + hlText(lines[0]) +
+                 lastLine.text.slice(to.ch), hlSpans(lines[0]));
+      doc.remove(from.line + 1, nlines, cm);
+    } else {
+      var added = [];
+      updateLine(cm, firstLine, firstLine.text.slice(0, from.ch) + hlText(lines[0]), hlSpans(lines[0]));
+      updateLine(cm, lastLine, hlText(lastHL) + lastLine.text.slice(to.ch), hlSpans(lastHL));
+      for (var i = 1, e = lines.length - 1; i < e; ++i)
+        added.push(makeLine(hlText(lines[i]), hlSpans(lines[i]), th));
+      if (nlines > 1) doc.remove(from.line + 1, nlines - 1, cm);
+      doc.insert(from.line + 1, added);
     }
-    function skipHidden(pos, oldLine, oldCh) {
-      function getNonHidden(dir) {
-        var lNo = pos.line + dir, end = dir == 1 ? doc.size : -1;
-        while (lNo != end) {
-          var line = getLine(lNo);
-          if (!line.hidden) {
-            var ch = pos.ch;
-            if (toEnd || ch > oldCh || ch > line.text.length) ch = line.text.length;
-            return {line: lNo, ch: ch};
-          }
-          lNo += dir;
+
+    if (cm.options.lineWrapping) {
+      var perLine = Math.max(5, display.scroller.clientWidth / charWidth(display) - 3);
+      doc.iter(from.line, from.line + lines.length, function(line) {
+        if (line.height == 0) return;
+        var guess = (Math.ceil(line.text.length / perLine) || 1) * th;
+        if (guess != line.height) updateLineHeight(line, guess);
+      });
+    } else {
+      doc.iter(checkWidthStart, from.line + lines.length, function(line) {
+        var len = lineLength(doc, line);
+        if (len > view.maxLineLength) {
+          view.maxLine = line;
+          view.maxLineLength = len;
+          view.maxLineChanged = true;
+          recomputeMaxLength = false;
         }
+      });
+      if (recomputeMaxLength) cm.curOp.updateMaxLine = true;
+    }
+
+    // Adjust frontier, schedule worker
+    view.frontier = Math.min(view.frontier, from.line);
+    startWorker(cm, 400);
+
+    var lendiff = lines.length - nlines - 1;
+    // Remember that these lines changed, for updating the display
+    regChange(cm, from.line, to.line + 1, lendiff);
+    if (hasHandler(cm, "change")) {
+      // Normalize lines to contain only strings, since that's what
+      // the change event handler expects
+      for (var i = 0; i < lines.length; ++i)
+        if (typeof lines[i] != "string") lines[i] = lines[i].text;
+      var changeObj = {from: from, to: to, text: lines};
+      if (cm.curOp.textChanged) {
+        for (var cur = cm.curOp.textChanged; cur.next; cur = cur.next) {}
+        cur.next = changeObj;
+      } else cm.curOp.textChanged = changeObj;
+    }
+
+    // Update the selection
+    var newSelFrom, newSelTo, end = {line: from.line + lines.length - 1,
+                                     ch: hlText(lastHL).length  + (lines.length == 1 ? from.ch : 0)};
+    if (typeof selUpdate == "object" && selUpdate.line != null) {
+      newSelFrom = newSelTo = selUpdate;
+    } else if (selUpdate == "end") {
+      newSelFrom = newSelTo = end;
+    } else if (selUpdate == "start") {
+      newSelFrom = newSelTo = from;
+    } else if (selUpdate == "around") {
+      newSelFrom = from; newSelTo = end;
+    } else {
+      var adjustPos = function(pos) {
+        if (posLess(pos, from)) return pos;
+        if (!posLess(to, pos)) return end;
+        var line = pos.line + lendiff;
+        var ch = pos.ch;
+        if (pos.line == to.line)
+          ch += hlText(lastHL).length - (to.ch - (to.line == from.line ? from.ch : 0));
+        return {line: line, ch: ch};
+      };
+      newSelFrom = adjustPos(view.sel.from);
+      newSelTo = adjustPos(view.sel.to);
+    }
+    setSelection(cm, newSelFrom, newSelTo, null, true);
+    return end;
+  }
+
+  function replaceRange(cm, code, from, to) {
+    if (!to) to = from;
+    if (posLess(to, from)) { var tmp = to; to = from; from = tmp; }
+    code = splitLines(code);
+    function adjustPos(pos) {
+      if (posLess(pos, from)) return pos;
+      if (!posLess(to, pos)) return end;
+      var line = pos.line + code.length - (to.line - from.line) - 1;
+      var ch = pos.ch;
+      if (pos.line == to.line)
+        ch += lst(code).length - (to.ch - (to.line == from.line ? from.ch : 0));
+      return {line: line, ch: ch};
+    }
+    return updateDoc(cm, from, to, code);
+  }
+
+  // SELECTION
+
+  function posEq(a, b) {return a.line == b.line && a.ch == b.ch;}
+  function posLess(a, b) {return a.line < b.line || (a.line == b.line && a.ch < b.ch);}
+  function copyPos(x) {return {line: x.line, ch: x.ch};}
+
+  function clipLine(doc, n) {return Math.max(0, Math.min(n, doc.size-1));}
+  function clipPos(doc, pos) {
+    if (pos.line < 0) return {line: 0, ch: 0};
+    if (pos.line >= doc.size) return {line: doc.size-1, ch: getLine(doc, doc.size-1).text.length};
+    var ch = pos.ch, linelen = getLine(doc, pos.line).text.length;
+    if (ch == null || ch > linelen) return {line: pos.line, ch: linelen};
+    else if (ch < 0) return {line: pos.line, ch: 0};
+    else return pos;
+  }
+  function isLine(doc, l) {return l >= 0 && l < doc.size;}
+
+  function setShift(view, val) {
+    if (val) view.sel.shift = view.sel.shift || selHead(view);
+    else view.sel.shift = null;
+  }
+  function setSelectionUser(cm, from, to, bias) {
+    var view = cm.view, sh = view.sel.shift;
+    if (sh) {
+      sh = clipPos(view.doc, sh);
+      if (posLess(sh, from)) from = sh;
+      else if (posLess(to, sh)) to = sh;
+    }
+    setSelection(cm, from, to, bias);
+    cm.curOp.userSelChange = true;
+  }
+
+  // Update the selection. Last two args are only used by
+  // updateDoc, since they have to be expressed in the line
+  // numbers before the update.
+  function setSelection(cm, from, to, bias, checkAtomic) {
+    cm.curOp.updateInput = true;
+    var sel = cm.view.sel, doc = cm.view.doc;
+    cm.view.goalColumn = null;
+    if (!checkAtomic && posEq(sel.from, from) && posEq(sel.to, to)) return;
+    if (posLess(to, from)) {var tmp = to; to = from; from = tmp;}
+
+    // Skip over atomic spans.
+    if (checkAtomic || !posEq(from, sel.from))
+      from = skipAtomic(cm, from, bias, checkAtomic != "push");
+    if (checkAtomic || !posEq(to, sel.to))
+      to = skipAtomic(cm, to, bias, checkAtomic != "push");
+
+    if (posEq(from, to)) sel.inverted = false;
+    else if (posEq(from, sel.to)) sel.inverted = false;
+    else if (posEq(to, sel.from)) sel.inverted = true;
+
+    if (cm.options.autoClearEmptyLines && posEq(sel.from, sel.to)) {
+      var head = selHead(cm.view);
+      if (head.line != sel.from.line && sel.from.line < doc.size) {
+        var oldLine = getLine(doc, sel.from.line);
+        if (/^\s+$/.test(oldLine.text))
+          setTimeout(operation(cm, function() {
+            if (oldLine.parent && /^\s+$/.test(oldLine.text)) {
+              var no = lineNo(oldLine);
+              replaceRange(cm, "", {line: no, ch: 0}, {line: no, ch: oldLine.text.length});
+            }
+          }, 10));
       }
-      var line = getLine(pos.line);
-      var toEnd = pos.ch == line.text.length && pos.ch != oldCh;
-      if (!line.hidden) return pos;
-      if (pos.line >= oldLine) return getNonHidden(1) || getNonHidden(-1);
-      else return getNonHidden(-1) || getNonHidden(1);
-    }
-    function setCursor(line, ch, user) {
-      var pos = clipPos({line: line, ch: ch || 0});
-      (user ? setSelectionUser : setSelection)(pos, pos);
-    }
-
-    function clipLine(n) {return Math.max(0, Math.min(n, doc.size-1));}
-    function clipPos(pos) {
-      if (pos.line < 0) return {line: 0, ch: 0};
-      if (pos.line >= doc.size) return {line: doc.size-1, ch: getLine(doc.size-1).text.length};
-      var ch = pos.ch, linelen = getLine(pos.line).text.length;
-      if (ch == null || ch > linelen) return {line: pos.line, ch: linelen};
-      else if (ch < 0) return {line: pos.line, ch: 0};
-      else return pos;
-    }
-
-    function findPosH(dir, unit) {
-      var end = sel.inverted ? sel.from : sel.to, line = end.line, ch = end.ch;
-      var lineObj = getLine(line);
-      function findNextLine() {
-        for (var l = line + dir, e = dir < 0 ? -1 : doc.size; l != e; l += dir) {
-          var lo = getLine(l);
-          if (!lo.hidden) { line = l; lineObj = lo; return true; }
+    }
+
+    sel.from = from; sel.to = to;
+    cm.curOp.selectionChanged = true;
+  }
+
+  function reCheckSelection(cm) {
+    setSelection(cm, cm.view.sel.from, cm.view.sel.to, null, "push");
+  }
+
+  function skipAtomic(cm, pos, bias, mayClear) {
+    var doc = cm.view.doc, flipped = false, curPos = pos;
+    var dir = bias || 1;
+    cm.view.cantEdit = false;
+    search: for (;;) {
+      var line = getLine(doc, curPos.line), toClear;
+      if (line.markedSpans) {
+        for (var i = 0; i < line.markedSpans.length; ++i) {
+          var sp = line.markedSpans[i], m = sp.marker;
+          if ((sp.from == null || (m.inclusiveLeft ? sp.from <= curPos.ch : sp.from < curPos.ch)) &&
+              (sp.to == null || (m.inclusiveRight ? sp.to >= curPos.ch : sp.to > curPos.ch))) {
+            if (mayClear && m.clearOnEnter) {
+              (toClear || (toClear = [])).push(m);
+              continue;
+            } else if (!m.atomic) continue;
+            var newPos = m.find()[dir < 0 ? "from" : "to"];
+            if (posEq(newPos, curPos)) {
+              newPos.ch += dir;
+              if (newPos.ch < 0) {
+                if (newPos.line) newPos = clipPos(doc, {line: newPos.line - 1});
+                else newPos = null;
+              } else if (newPos.ch > line.text.length) {
+                if (newPos.line < doc.size - 1) newPos = {line: newPos.line + 1, ch: 0};
+                else newPos = null;
+              }
+              if (!newPos) {
+                if (flipped) {
+                  // Driven in a corner -- no valid cursor position found at all
+                  // -- try again *with* clearing, if we didn't already
+                  if (!mayClear) return skipAtomic(cm, pos, bias, true);
+                  // Otherwise, turn off editing until further notice, and return the start of the doc
+                  cm.view.cantEdit = true;
+                  return {line: 0, ch: 0};
+                }
+                flipped = true; newPos = pos; dir = -dir;
+              }
+            }
+            curPos = newPos;
+            continue search;
+          }
         }
+        if (toClear) for (var i = 0; i < toClear.length; ++i) toClear[i].clear();
       }
-      function moveOnce(boundToLine) {
-        if (ch == (dir < 0 ? 0 : lineObj.text.length)) {
-          if (!boundToLine && findNextLine()) ch = dir < 0 ? lineObj.text.length : 0;
-          else return false;
-        } else ch += dir;
-        return true;
+      return curPos;
+    }
+  }
+
+  // SCROLLING
+
+  function scrollCursorIntoView(cm) {
+    var view = cm.view, coords = cursorCoords(cm, selHead(view));
+    scrollIntoView(cm.display, coords.left, coords.top, coords.left, coords.bottom);
+    if (!view.focused) return;
+    var display = cm.display, box = display.sizer.getBoundingClientRect(), doScroll = null;
+    if (coords.top + box.top < 0) doScroll = true;
+    else if (coords.bottom + box.top > (window.innerHeight || document.documentElement.clientHeight)) doScroll = false;
+    if (doScroll != null && !phantom) {
+      var hidden = display.cursor.style.display == "none";
+      if (hidden) {
+        display.cursor.style.display = "";
+        display.cursor.style.left = coords.left + "px";
+        display.cursor.style.top = (coords.top - display.viewOffset) + "px";
       }
-      if (unit == "char") moveOnce();
-      else if (unit == "column") moveOnce(true);
-      else if (unit == "word") {
-        var sawWord = false;
-        for (;;) {
-          if (dir < 0) if (!moveOnce()) break;
-          if (isWordChar(lineObj.text.charAt(ch))) sawWord = true;
-          else if (sawWord) {if (dir < 0) {dir = 1; moveOnce();} break;}
-          if (dir > 0) if (!moveOnce()) break;
-        }
+      display.cursor.scrollIntoView(doScroll);
+      if (hidden) display.cursor.style.display = "none";
+    }
+  }
+
+  function scrollIntoView(display, x1, y1, x2, y2) {
+    var scrollPos = calculateScrollPos(display, x1, y1, x2, y2);
+    if (scrollPos.scrollLeft != null) {display.scrollbarH.scrollLeft = display.scroller.scrollLeft = scrollPos.scrollLeft;}
+    if (scrollPos.scrollTop != null) {display.scrollbarV.scrollTop = display.scroller.scrollTop = scrollPos.scrollTop;}
+  }
+
+  function calculateScrollPos(display, x1, y1, x2, y2) {
+    var pt = paddingTop(display);
+    y1 += pt; y2 += pt;
+    var screen = display.scroller.clientHeight - scrollerCutOff, screentop = display.scroller.scrollTop, result = {};
+    var docBottom = display.scroller.scrollHeight - scrollerCutOff;
+    var atTop = y1 < pt + 10, atBottom = y2 + pt > docBottom - 10;
+    if (y1 < screentop) result.scrollTop = atTop ? 0 : Math.max(0, y1);
+    else if (y2 > screentop + screen) result.scrollTop = (atBottom ? docBottom : y2 - screen);
+
+    var screenw = display.scroller.clientWidth - scrollerCutOff, screenleft = display.scroller.scrollLeft;
+    x1 += display.gutters.offsetWidth; x2 += display.gutters.offsetWidth;
+    var gutterw = display.gutters.offsetWidth;
+    var atLeft = x1 < gutterw + 10;
+    if (x1 < screenleft + gutterw || atLeft) {
+      if (atLeft) x1 = 0;
+      result.scrollLeft = Math.max(0, x1 - 10 - gutterw);
+    } else if (x2 > screenw + screenleft - 3) {
+      result.scrollLeft = x2 + 10 - screenw;
+    }
+    return result;
+  }
+
+  // API UTILITIES
+
+  function indentLine(cm, n, how) {
+    var doc = cm.view.doc;
+    if (!how) how = "add";
+    if (how == "smart") {
+      if (!cm.view.mode.indent) how = "prev";
+      else var state = getStateBefore(cm, n);
+    }
+
+    var tabSize = cm.options.tabSize;
+    var line = getLine(doc, n), curSpace = countColumn(line.text, null, tabSize);
+    var curSpaceString = line.text.match(/^\s*/)[0], indentation;
+    if (how == "smart") {
+      indentation = cm.view.mode.indent(state, line.text.slice(curSpaceString.length), line.text);
+      if (indentation == Pass) how = "prev";
+    }
+    if (how == "prev") {
+      if (n) indentation = countColumn(getLine(doc, n-1).text, null, tabSize);
+      else indentation = 0;
+    }
+    else if (how == "add") indentation = curSpace + cm.options.indentUnit;
+    else if (how == "subtract") indentation = curSpace - cm.options.indentUnit;
+    indentation = Math.max(0, indentation);
+    var diff = indentation - curSpace;
+
+    var indentString = "", pos = 0;
+    if (cm.options.indentWithTabs)
+      for (var i = Math.floor(indentation / tabSize); i; --i) {pos += tabSize; indentString += "\t";}
+    if (pos < indentation) indentString += spaceStr(indentation - pos);
+
+    if (indentString != curSpaceString)
+      replaceRange(cm, indentString, {line: n, ch: 0}, {line: n, ch: curSpaceString.length});
+    line.stateAfter = null;
+  }
+
+  function changeLine(cm, handle, op) {
+    var no = handle, line = handle, doc = cm.view.doc;
+    if (typeof handle == "number") line = getLine(doc, clipLine(doc, handle));
+    else no = lineNo(handle);
+    if (no == null) return null;
+    if (op(line, no)) regChange(cm, no, no + 1);
+    else return null;
+    return line;
+  }
+
+  function findPosH(cm, dir, unit, visually) {
+    var doc = cm.view.doc, end = selHead(cm.view), line = end.line, ch = end.ch;
+    var lineObj = getLine(doc, line);
+    function findNextLine() {
+      var l = line + dir;
+      if (l < 0 || l == doc.size) return false;
+      line = l;
+      return lineObj = getLine(doc, l);
+    }
+    function moveOnce(boundToLine) {
+      var next = (visually ? moveVisually : moveLogically)(lineObj, ch, dir, true);
+      if (next == null) {
+        if (!boundToLine && findNextLine()) {
+          if (visually) ch = (dir < 0 ? lineRight : lineLeft)(lineObj);
+          else ch = dir < 0 ? lineObj.text.length : 0;
+        } else return false;
+      } else ch = next;
+      return true;
+    }
+    if (unit == "char") moveOnce();
+    else if (unit == "column") moveOnce(true);
+    else if (unit == "word") {
+      var sawWord = false;
+      for (;;) {
+        if (dir < 0) if (!moveOnce()) break;
+        if (isWordChar(lineObj.text.charAt(ch))) sawWord = true;
+        else if (sawWord) {if (dir < 0) {dir = 1; moveOnce();} break;}
+        if (dir > 0) if (!moveOnce()) break;
       }
-      return {line: line, ch: ch};
     }
-    function moveH(dir, unit) {
-      var pos = dir < 0 ? sel.from : sel.to;
-      if (shiftSelecting || posEq(sel.from, sel.to)) pos = findPosH(dir, unit);
-      setCursor(pos.line, pos.ch, true);
-    }
-    function deleteH(dir, unit) {
-      if (!posEq(sel.from, sel.to)) replaceRange("", sel.from, sel.to);
-      else if (dir < 0) replaceRange("", findPosH(dir, unit), sel.to);
-      else replaceRange("", sel.from, findPosH(dir, unit));
-      userSelChange = true;
-    }
-    function moveV(dir, unit) {
-      var dist = 0, pos = localCoords(sel.inverted ? sel.from : sel.to, true);
-      if (goalColumn != null) pos.x = goalColumn;
-      if (unit == "page") dist = Math.min(scroller.clientHeight, window.innerHeight || document.documentElement.clientHeight);
-      else if (unit == "line") dist = textHeight();
-      var target = coordsChar(pos.x, pos.y + dist * dir + 2);
-      if (unit == "page") scrollbar.scrollTop += localCoords(target, true).y - pos.y;
-      setCursor(target.line, target.ch, true);
-      goalColumn = pos.x;
-    }
-
-    function findWordAt(pos) {
-      var line = getLine(pos.line).text;
-      var start = pos.ch, end = pos.ch;
-      if (line) {
-        if (pos.after === false || end == line.length) --start; else ++end;
-        var startChar = line.charAt(start);
-        var check = isWordChar(startChar) ? isWordChar :
-                    /\s/.test(startChar) ? function(ch) {return /\s/.test(ch);} :
-                    function(ch) {return !/\s/.test(ch) && !isWordChar(ch);};
-        while (start > 0 && check(line.charAt(start - 1))) --start;
-        while (end < line.length && check(line.charAt(end))) ++end;
-      }
-      return {from: {line: pos.line, ch: start}, to: {line: pos.line, ch: end}};
-    }
-    function selectLine(line) {
-      setSelectionUser({line: line, ch: 0}, clipPos({line: line + 1, ch: 0}));
-    }
-    function indentSelected(mode) {
-      if (posEq(sel.from, sel.to)) return indentLine(sel.from.line, mode);
+    return skipAtomic(cm, {line: line, ch: ch}, dir, true);
+  }
+
+  function findWordAt(line, pos) {
+    var start = pos.ch, end = pos.ch;
+    if (line) {
+      if (pos.after === false || end == line.length) --start; else ++end;
+      var startChar = line.charAt(start);
+      var check = isWordChar(startChar) ? isWordChar :
+        /\s/.test(startChar) ? function(ch) {return /\s/.test(ch);} :
+      function(ch) {return !/\s/.test(ch) && !isWordChar(ch);};
+      while (start > 0 && check(line.charAt(start - 1))) --start;
+      while (end < line.length && check(line.charAt(end))) ++end;
+    }
+    return {from: {line: pos.line, ch: start}, to: {line: pos.line, ch: end}};
+  }
+
+  function selectLine(cm, line) {
+    setSelectionUser(cm, {line: line, ch: 0}, clipPos(cm.view.doc, {line: line + 1, ch: 0}));
+  }
+
+  // PROTOTYPE
+
+  // The publicly visible API. Note that operation(null, f) means
+  // 'wrap f in an operation, performed on its `this` parameter'
+
+  CodeMirror.prototype = {
+    getValue: function(lineSep) {
+      var text = [], doc = this.view.doc;
+      doc.iter(0, doc.size, function(line) { text.push(line.text); });
+      return text.join(lineSep || "\n");
+    },
+
+    setValue: operation(null, function(code) {
+      var doc = this.view.doc, top = {line: 0, ch: 0}, lastLen = getLine(doc, doc.size-1).text.length;
+      updateDocInner(this, top, {line: doc.size - 1, ch: lastLen}, splitLines(code), top, top);
+    }),
+
+    getSelection: function(lineSep) { return this.getRange(this.view.sel.from, this.view.sel.to, lineSep); },
+
+    replaceSelection: operation(null, function(code, collapse) {
+      var sel = this.view.sel;
+      updateDoc(this, sel.from, sel.to, splitLines(code), collapse || "around");
+    }),
+
+    focus: function(){window.focus(); focusInput(this); onFocus(this); fastPoll(this);},
+
+    setOption: function(option, value) {
+      var options = this.options, old = options[option];
+      if (options[option] == value && option != "mode") return;
+      options[option] = value;
+      if (optionHandlers.hasOwnProperty(option))
+        operation(this, optionHandlers[option])(this, value, old);
+    },
+
+    getOption: function(option) {return this.options[option];},
+
+    getMode: function() {return this.view.mode;},
+
+    undo: operation(null, function() {
+      var hist = this.view.history;
+      unredoHelper(this, hist.done, hist.undone, -1);
+    }),
+    redo: operation(null, function() {
+      var hist = this.view.history;
+      unredoHelper(this, hist.undone, hist.done, 1);
+    }),
+
+    indentLine: operation(null, function(n, dir) {
+      if (typeof dir != "string") {
+        if (dir == null) dir = this.options.smartIndent ? "smart" : "prev";
+        else dir = dir ? "add" : "subtract";
+      }
+      if (isLine(this.view.doc, n)) indentLine(this, n, dir);
+    }),
+
+    indentSelection: operation(null, function(how) {
+      var sel = this.view.sel;
+      if (posEq(sel.from, sel.to)) return indentLine(this, sel.from.line, how);
       var e = sel.to.line - (sel.to.ch ? 0 : 1);
-      for (var i = sel.from.line; i <= e; ++i) indentLine(i, mode);
-    }
-
-    function indentLine(n, how) {
-      if (!how) how = "add";
-      if (how == "smart") {
-        if (!mode.indent) how = "prev";
-        else var state = getStateBefore(n);
-      }
-
-      var line = getLine(n), curSpace = line.indentation(options.tabSize),
-          curSpaceString = line.text.match(/^\s*/)[0], indentation;
-      if (how == "smart") {
-        indentation = mode.indent(state, line.text.slice(curSpaceString.length), line.text);
-        if (indentation == Pass) how = "prev";
-      }
-      if (how == "prev") {
-        if (n) indentation = getLine(n-1).indentation(options.tabSize);
-        else indentation = 0;
-      }
-      else if (how == "add") indentation = curSpace + options.indentUnit;
-      else if (how == "subtract") indentation = curSpace - options.indentUnit;
-      indentation = Math.max(0, indentation);
-      var diff = indentation - curSpace;
-
-      var indentString = "", pos = 0;
-      if (options.indentWithTabs)
-        for (var i = Math.floor(indentation / options.tabSize); i; --i) {pos += options.tabSize; indentString += "\t";}
-      while (pos < indentation) {++pos; indentString += " ";}
-
-      replaceRange(indentString, {line: n, ch: 0}, {line: n, ch: curSpaceString.length});
-    }
-
-    function loadMode() {
-      mode = CodeMirror.getMode(options, options.mode);
-      doc.iter(0, doc.size, function(line) { line.stateAfter = null; });
-      work = [0];
-      startWorker();
-    }
-    function gutterChanged() {
-      var visible = options.gutter || options.lineNumbers;
-      gutter.style.display = visible ? "" : "none";
-      if (visible) gutterDirty = true;
-      else lineDiv.parentNode.style.marginLeft = 0;
-    }
-    function wrappingChanged(from, to) {
-      if (options.lineWrapping) {
-        wrapper.className += " CodeMirror-wrap";
-        var perLine = scroller.clientWidth / charWidth() - 3;
-        doc.iter(0, doc.size, function(line) {
-          if (line.hidden) return;
-          var guess = Math.ceil(line.text.length / perLine) || 1;
-          if (guess != 1) updateLineHeight(line, guess);
-        });
-        lineSpace.style.minWidth = widthForcer.style.left = "";
-      } else {
-        wrapper.className = wrapper.className.replace(" CodeMirror-wrap", "");
-        computeMaxLength();
-        doc.iter(0, doc.size, function(line) {
-          if (line.height != 1 && !line.hidden) updateLineHeight(line, 1);
-        });
-      }
-      changes.push({from: 0, to: doc.size});
-    }
-    function makeTab(col) {
-      var w = options.tabSize - col % options.tabSize, cached = tabCache[w];
-      if (cached) return cached;
-      for (var str = "", i = 0; i < w; ++i) str += " ";
-      var span = elt("span", str, "cm-tab");
-      return (tabCache[w] = {element: span, width: w});
-    }
-    function themeChanged() {
-      scroller.className = scroller.className.replace(/\s*cm-s-\S+/g, "") +
-        options.theme.replace(/(^|\s)\s*/g, " cm-s-");
-    }
-    function keyMapChanged() {
-      var style = keyMap[options.keyMap].style;
-      wrapper.className = wrapper.className.replace(/\s*cm-keymap-\S+/g, "") +
-        (style ? " cm-keymap-" + style : "");
-    }
-
-    function TextMarker() { this.set = []; }
-    TextMarker.prototype.clear = operation(function() {
-      var min = Infinity, max = -Infinity;
-      for (var i = 0, e = this.set.length; i < e; ++i) {
-        var line = this.set[i], mk = line.marked;
-        if (!mk || !line.parent) continue;
-        var lineN = lineNo(line);
-        min = Math.min(min, lineN); max = Math.max(max, lineN);
-        for (var j = 0; j < mk.length; ++j)
-          if (mk[j].marker == this) mk.splice(j--, 1);
-      }
-      if (min != Infinity)
-        changes.push({from: min, to: max + 1});
-    });
-    TextMarker.prototype.find = function() {
-      var from, to;
-      for (var i = 0, e = this.set.length; i < e; ++i) {
-        var line = this.set[i], mk = line.marked;
-        for (var j = 0; j < mk.length; ++j) {
-          var mark = mk[j];
-          if (mark.marker == this) {
-            if (mark.from != null || mark.to != null) {
-              var found = lineNo(line);
-              if (found != null) {
-                if (mark.from != null) from = {line: found, ch: mark.from};
-                if (mark.to != null) to = {line: found, ch: mark.to};
-              }
-            }
+      for (var i = sel.from.line; i <= e; ++i) indentLine(this, i, how);
+    }),
+
+    historySize: function() {
+      var hist = this.view.history;
+      return {undo: hist.done.length, redo: hist.undone.length};
+    },
+
+    clearHistory: function() {this.view.history = makeHistory();},
+
+    markClean: function() {
+      this.view.history.dirtyCounter = 0;
+      this.view.history.closed = true;
+    },
+
+    isClean: function () {return this.view.history.dirtyCounter == 0;},
+      
+    getHistory: function() {
+      var hist = this.view.history;
+      function cp(arr) {
+        for (var i = 0, nw = [], nwelt; i < arr.length; ++i) {
+          nw.push(nwelt = []);
+          for (var j = 0, elt = arr[i]; j < elt.length; ++j) {
+            var old = [], cur = elt[j];
+            nwelt.push({start: cur.start, added: cur.added, old: old});
+            for (var k = 0; k < cur.old.length; ++k) old.push(hlText(cur.old[k]));
           }
         }
+        return nw;
       }
-      return {from: from, to: to};
-    };
+      return {done: cp(hist.done), undone: cp(hist.undone)};
+    },
 
-    function markText(from, to, className) {
-      from = clipPos(from); to = clipPos(to);
-      var tm = new TextMarker();
-      if (!posLess(from, to)) return tm;
-      function add(line, from, to, className) {
-        getLine(line).addMark(new MarkedText(from, to, className, tm));
-      }
-      if (from.line == to.line) add(from.line, from.ch, to.ch, className);
-      else {
-        add(from.line, from.ch, null, className);
-        for (var i = from.line + 1, e = to.line; i < e; ++i)
-          add(i, null, null, className);
-        add(to.line, null, to.ch, className);
-      }
-      changes.push({from: from.line, to: to.line + 1});
-      return tm;
-    }
-
-    function setBookmark(pos) {
-      pos = clipPos(pos);
-      var bm = new Bookmark(pos.ch);
-      getLine(pos.line).addMark(bm);
-      return bm;
-    }
-
-    function findMarksAt(pos) {
-      pos = clipPos(pos);
-      var markers = [], marked = getLine(pos.line).marked;
-      if (!marked) return markers;
-      for (var i = 0, e = marked.length; i < e; ++i) {
-        var m = marked[i];
-        if ((m.from == null || m.from <= pos.ch) &&
-            (m.to == null || m.to >= pos.ch))
-          markers.push(m.marker || m);
+    setHistory: function(histData) {
+      var hist = this.view.history = makeHistory();
+      hist.done = histData.done;
+      hist.undone = histData.undone;
+    },
+
+    getTokenAt: function(pos) {
+      var doc = this.view.doc;
+      pos = clipPos(doc, pos);
+      return getTokenAt(this, getLine(doc, pos.line), getStateBefore(this, pos.line), pos.ch);
+    },
+
+    getStateAfter: function(line) {
+      var doc = this.view.doc;
+      line = clipLine(doc, line == null ? doc.size - 1: line);
+      return getStateBefore(this, line + 1);
+    },
+
+    cursorCoords: function(start, mode) {
+      var pos, sel = this.view.sel;
+      if (start == null) start = sel.inverted;
+      if (typeof start == "object") pos = clipPos(this.view.doc, start);
+      else pos = start ? sel.from : sel.to;
+      return cursorCoords(this, pos, mode || "page");
+    },
+
+    charCoords: function(pos, mode) {
+      return charCoords(this, clipPos(this.view.doc, pos), mode || "page");
+    },
+
+    coordsChar: function(coords) {
+      var off = this.display.lineSpace.getBoundingClientRect();
+      return coordsChar(this, coords.left - off.left, coords.top - off.top);
+    },
+
+    defaultTextHeight: function() { return textHeight(this.display); },
+
+    markText: operation(null, function(from, to, options) {
+      return markText(this, clipPos(this.view.doc, from), clipPos(this.view.doc, to),
+                      options, "range");
+    }),
+
+    setBookmark: operation(null, function(pos, widget) {
+      pos = clipPos(this.view.doc, pos);
+      return markText(this, pos, pos, widget ? {replacedWith: widget} : {}, "bookmark");
+    }),
+
+    findMarksAt: function(pos) {
+      var doc = this.view.doc;
+      pos = clipPos(doc, pos);
+      var markers = [], spans = getLine(doc, pos.line).markedSpans;
+      if (spans) for (var i = 0; i < spans.length; ++i) {
+        var span = spans[i];
+        if ((span.from == null || span.from <= pos.ch) &&
+            (span.to == null || span.to >= pos.ch))
+          markers.push(span.marker);
       }
       return markers;
-    }
+    },
 
-    function addGutterMarker(line, text, className) {
-      if (typeof line == "number") line = getLine(clipLine(line));
-      line.gutterMarker = {text: text, style: className};
-      gutterDirty = true;
-      return line;
-    }
-    function removeGutterMarker(line) {
-      if (typeof line == "number") line = getLine(clipLine(line));
-      line.gutterMarker = null;
-      gutterDirty = true;
-    }
-
-    function changeLine(handle, op) {
-      var no = handle, line = handle;
-      if (typeof handle == "number") line = getLine(clipLine(handle));
-      else no = lineNo(handle);
-      if (no == null) return null;
-      if (op(line, no)) changes.push({from: no, to: no + 1});
-      else return null;
-      return line;
-    }
-    function setLineClass(handle, className, bgClassName) {
-      return changeLine(handle, function(line) {
-        if (line.className != className || line.bgClassName != bgClassName) {
-          line.className = className;
-          line.bgClassName = bgClassName;
-          return true;
+    setGutterMarker: operation(null, function(line, gutterID, value) {
+      return changeLine(this, line, function(line) {
+        var markers = line.gutterMarkers || (line.gutterMarkers = {});
+        markers[gutterID] = value;
+        if (!value && isEmpty(markers)) line.gutterMarkers = null;
+        return true;
+      });
+    }),
+
+    clearGutter: operation(null, function(gutterID) {
+      var i = 0, cm = this, doc = cm.view.doc;
+      doc.iter(0, doc.size, function(line) {
+        if (line.gutterMarkers && line.gutterMarkers[gutterID]) {
+          line.gutterMarkers[gutterID] = null;
+          regChange(cm, i, i + 1);
+          if (isEmpty(line.gutterMarkers)) line.gutterMarkers = null;
         }
+        ++i;
       });
-    }
-    function setLineHidden(handle, hidden) {
-      return changeLine(handle, function(line, no) {
-        if (line.hidden != hidden) {
-          line.hidden = hidden;
-          if (!options.lineWrapping) {
-            if (hidden && line.text.length == maxLine.text.length) {
-              updateMaxLine = true;
-            } else if (!hidden && line.text.length > maxLine.text.length) {
-              maxLine = line; updateMaxLine = false;
-            }
-          }
-          updateLineHeight(line, hidden ? 0 : 1);
-          var fline = sel.from.line, tline = sel.to.line;
-          if (hidden && (fline == no || tline == no)) {
-            var from = fline == no ? skipHidden({line: fline, ch: 0}, fline, 0) : sel.from;
-            var to = tline == no ? skipHidden({line: tline, ch: 0}, tline, 0) : sel.to;
-            // Can't hide the last visible line, we'd have no place to put the cursor
-            if (!to) return;
-            setSelection(from, to);
-          }
-          return (gutterDirty = true);
+    }),
+
+    addLineClass: operation(null, function(handle, where, cls) {
+      return changeLine(this, handle, function(line) {
+        var prop = where == "text" ? "textClass" : where == "background" ? "bgClass" : "wrapClass";
+        if (!line[prop]) line[prop] = cls;
+        else if (new RegExp("\\b" + cls + "\\b").test(line[prop])) return false;
+        else line[prop] += " " + cls;
+        return true;
+      });
+    }),
+
+    removeLineClass: operation(null, function(handle, where, cls) {
+      return changeLine(this, handle, function(line) {
+        var prop = where == "text" ? "textClass" : where == "background" ? "bgClass" : "wrapClass";
+        var cur = line[prop];
+        if (!cur) return false;
+        else if (cls == null) line[prop] = null;
+        else {
+          var upd = cur.replace(new RegExp("^" + cls + "\\b\\s*|\\s*\\b" + cls + "\\b"), "");
+          if (upd == cur) return false;
+          line[prop] = upd || null;
         }
+        return true;
       });
-    }
+    }),
+
+    addLineWidget: operation(null, function addLineWidget(handle, node, options) {
+      var widget = options || {};
+      widget.node = node;
+      if (widget.noHScroll) this.display.alignWidgets = true;
+      changeLine(this, handle, function(line) {
+        (line.widgets || (line.widgets = [])).push(widget);
+        widget.line = line;
+        return true;
+      });
+      return widget;
+    }),
 
-    function lineInfo(line) {
+    removeLineWidget: operation(null, function(widget) {
+      var ws = widget.line.widgets, no = lineNo(widget.line);
+      if (no == null) return;
+      for (var i = 0; i < ws.length; ++i) if (ws[i] == widget) ws.splice(i--, 1);
+      regChange(this, no, no + 1);
+    }),
+
+    lineInfo: function(line) {
       if (typeof line == "number") {
-        if (!isLine(line)) return null;
+        if (!isLine(this.view.doc, line)) return null;
         var n = line;
-        line = getLine(line);
+        line = getLine(this.view.doc, line);
         if (!line) return null;
       } else {
         var n = lineNo(line);
         if (n == null) return null;
       }
-      var marker = line.gutterMarker;
-      return {line: n, handle: line, text: line.text, markerText: marker && marker.text,
-              markerClass: marker && marker.style, lineClass: line.className, bgClass: line.bgClassName};
-    }
+      return {line: n, handle: line, text: line.text, gutterMarkers: line.gutterMarkers,
+              textClass: line.textClass, bgClass: line.bgClass, wrapClass: line.wrapClass,
+              widgets: line.widgets};
+    },
 
-    // These are used to go from pixel positions to character
-    // positions, taking varying character widths into account.
-    function charFromX(line, x) {
-      if (x <= 0) return 0;
-      var lineObj = getLine(line), text = lineObj.text;
-      function getX(len) {
-        return measureLine(lineObj, len).left;
-      }
-      var from = 0, fromX = 0, to = text.length, toX;
-      // Guess a suitable upper bound for our search.
-      var estimated = Math.min(to, Math.ceil(x / charWidth()));
-      for (;;) {
-        var estX = getX(estimated);
-        if (estX <= x && estimated < to) estimated = Math.min(to, Math.ceil(estimated * 1.2));
-        else {toX = estX; to = estimated; break;}
-      }
-      if (x > toX) return to;
-      // Try to guess a suitable lower bound as well.
-      estimated = Math.floor(to * 0.8); estX = getX(estimated);
-      if (estX < x) {from = estimated; fromX = estX;}
-      // Do a binary search between these bounds.
-      for (;;) {
-        if (to - from <= 1) return (toX - x > x - fromX) ? from : to;
-        var middle = Math.ceil((from + to) / 2), middleX = getX(middle);
-        if (middleX > x) {to = middle; toX = middleX;}
-        else {from = middle; fromX = middleX;}
-      }
-    }
-
-    function measureLine(line, ch) {
-      if (ch == 0) return {top: 0, left: 0};
-      var wbr = options.lineWrapping && ch < line.text.length &&
-                spanAffectsWrapping.test(line.text.slice(ch - 1, ch + 1));
-      var pre = line.getElement(makeTab, ch, wbr);
-      removeChildrenAndAdd(measure, pre);
-      var anchor = pre.anchor;
-      var top = anchor.offsetTop, left = anchor.offsetLeft;
-      // Older IEs report zero offsets for spans directly after a wrap
-      if (ie && top == 0 && left == 0) {
-        var backup = elt("span", "x");
-        anchor.parentNode.insertBefore(backup, anchor.nextSibling);
-        top = backup.offsetTop;
-      }
-      return {top: top, left: left};
-    }
-    function localCoords(pos, inLineWrap) {
-      var x, lh = textHeight(), y = lh * (heightAtLine(doc, pos.line) - (inLineWrap ? displayOffset : 0));
-      if (pos.ch == 0) x = 0;
-      else {
-        var sp = measureLine(getLine(pos.line), pos.ch);
-        x = sp.left;
-        if (options.lineWrapping) y += Math.max(0, sp.top);
-      }
-      return {x: x, y: y, yBot: y + lh};
-    }
-    // Coords must be lineSpace-local
-    function coordsChar(x, y) {
-      if (y < 0) return {line: 0, ch: 0};
-      var th = textHeight(), cw = charWidth(), heightPos = displayOffset + Math.floor(y / th);
-      var lineNo = lineAtHeight(doc, heightPos);
-      if (lineNo >= doc.size) return {line: doc.size - 1, ch: getLine(doc.size - 1).text.length};
-      var lineObj = getLine(lineNo), text = lineObj.text;
-      var tw = options.lineWrapping, innerOff = tw ? heightPos - heightAtLine(doc, lineNo) : 0;
-      if (x <= 0 && innerOff == 0) return {line: lineNo, ch: 0};
-      var wrongLine = false;
-      function getX(len) {
-        var sp = measureLine(lineObj, len);
-        if (tw) {
-          var off = Math.round(sp.top / th);
-          wrongLine = off != innerOff;
-          return Math.max(0, sp.left + (off - innerOff) * scroller.clientWidth);
-        }
-        return sp.left;
-      }
-      var from = 0, fromX = 0, to = text.length, toX;
-      // Guess a suitable upper bound for our search.
-      var estimated = Math.min(to, Math.ceil((x + innerOff * scroller.clientWidth * .9) / cw));
-      for (;;) {
-        var estX = getX(estimated);
-        if (estX <= x && estimated < to) estimated = Math.min(to, Math.ceil(estimated * 1.2));
-        else {toX = estX; to = estimated; break;}
+    getViewport: function() { return {from: this.display.showingFrom, to: this.display.showingTo};},
+
+    addWidget: function(pos, node, scroll, vert, horiz) {
+      var display = this.display;
+      pos = cursorCoords(this, clipPos(this.view.doc, pos));
+      var top = pos.top, left = pos.left;
+      node.style.position = "absolute";
+      display.sizer.appendChild(node);
+      if (vert == "over") top = pos.top;
+      else if (vert == "near") {
+        var vspace = Math.max(display.wrapper.clientHeight, this.view.doc.height),
+        hspace = Math.max(display.sizer.clientWidth, display.lineSpace.clientWidth);
+        if (pos.bottom + node.offsetHeight > vspace && pos.top > node.offsetHeight)
+          top = pos.top - node.offsetHeight;
+        if (left + node.offsetWidth > hspace)
+          left = hspace - node.offsetWidth;
       }
-      if (x > toX) return {line: lineNo, ch: to};
-      // Try to guess a suitable lower bound as well.
-      estimated = Math.floor(to * 0.8); estX = getX(estimated);
-      if (estX < x) {from = estimated; fromX = estX;}
-      // Do a binary search between these bounds.
-      for (;;) {
-        if (to - from <= 1) {
-          var after = x - fromX < toX - x;
-          return {line: lineNo, ch: after ? from : to, after: after};
-        }
-        var middle = Math.ceil((from + to) / 2), middleX = getX(middle);
-        if (middleX > x) {to = middle; toX = middleX; if (wrongLine) toX += 1000; }
-        else {from = middle; fromX = middleX;}
-      }
-    }
-    function pageCoords(pos) {
-      var local = localCoords(pos, true), off = eltOffset(lineSpace);
-      return {x: off.left + local.x, y: off.top + local.y, yBot: off.top + local.yBot};
-    }
-
-    var cachedHeight, cachedHeightFor, measurePre;
-    function textHeight() {
-      if (measurePre == null) {
-        measurePre = elt("pre");
-        for (var i = 0; i < 49; ++i) {
-          measurePre.appendChild(document.createTextNode("x"));
-          measurePre.appendChild(elt("br"));
-        }
-        measurePre.appendChild(document.createTextNode("x"));
-      }
-      var offsetHeight = lineDiv.clientHeight;
-      if (offsetHeight == cachedHeightFor) return cachedHeight;
-      cachedHeightFor = offsetHeight;
-      removeChildrenAndAdd(measure, measurePre.cloneNode(true));
-      cachedHeight = measure.firstChild.offsetHeight / 50 || 1;
-      removeChildren(measure);
-      return cachedHeight;
-    }
-    var cachedWidth, cachedWidthFor = 0;
-    function charWidth() {
-      if (scroller.clientWidth == cachedWidthFor) return cachedWidth;
-      cachedWidthFor = scroller.clientWidth;
-      var anchor = elt("span", "x");
-      var pre = elt("pre", [anchor]);
-      removeChildrenAndAdd(measure, pre);
-      return (cachedWidth = anchor.offsetWidth || 10);
-    }
-    function paddingTop() {return lineSpace.offsetTop;}
-    function paddingLeft() {return lineSpace.offsetLeft;}
-
-    function posFromMouse(e, liberal) {
-      var offW = eltOffset(scroller, true), x, y;
-      // Fails unpredictably on IE[67] when mouse is dragged around quickly.
-      try { x = e.clientX; y = e.clientY; } catch (e) { return null; }
-      // This is a mess of a heuristic to try and determine whether a
-      // scroll-bar was clicked or not, and to return null if one was
-      // (and !liberal).
-      if (!liberal && (x - offW.left > scroller.clientWidth || y - offW.top > scroller.clientHeight))
-        return null;
-      var offL = eltOffset(lineSpace, true);
-      return coordsChar(x - offL.left, y - offL.top);
-    }
-    function onContextMenu(e) {
-      var pos = posFromMouse(e), scrollPos = scrollbar.scrollTop;
-      if (!pos || opera) return; // Opera is difficult.
-      if (posEq(sel.from, sel.to) || posLess(pos, sel.from) || !posLess(pos, sel.to))
-        operation(setCursor)(pos.line, pos.ch);
-
-      var oldCSS = input.style.cssText;
-      inputDiv.style.position = "absolute";
-      input.style.cssText = "position: fixed; width: 30px; height: 30px; top: " + (e.clientY - 5) +
-        "px; left: " + (e.clientX - 5) + "px; z-index: 1000; background: white; " +
-        "border-width: 0; outline: none; overflow: hidden; opacity: .05; filter: alpha(opacity=5);";
-      leaveInputAlone = true;
-      var val = input.value = getSelection();
-      focusInput();
-      selectInput(input);
-      function rehide() {
-        var newVal = splitLines(input.value).join("\n");
-        if (newVal != val && !options.readOnly) operation(replaceSelection)(newVal, "end");
-        inputDiv.style.position = "relative";
-        input.style.cssText = oldCSS;
-        if (ie_lt9) scrollbar.scrollTop = scrollPos;
-        leaveInputAlone = false;
-        resetInput(true);
-        slowPoll();
-      }
-
-      if (gecko) {
-        e_stop(e);
-        var mouseup = connect(window, "mouseup", function() {
-          mouseup();
-          setTimeout(rehide, 20);
-        }, true);
+      node.style.top = (top + paddingTop(display)) + "px";
+      node.style.left = node.style.right = "";
+      if (horiz == "right") {
+        left = display.sizer.clientWidth - node.offsetWidth;
+        node.style.right = "0px";
       } else {
-        setTimeout(rehide, 50);
-      }
-    }
-
-    // Cursor-blinking
-    function restartBlink() {
-      clearInterval(blinker);
-      var on = true;
-      cursor.style.visibility = "";
-      blinker = setInterval(function() {
-        cursor.style.visibility = (on = !on) ? "" : "hidden";
-      }, 650);
-    }
-
-    var matching = {"(": ")>", ")": "(<", "[": "]>", "]": "[<", "{": "}>", "}": "{<"};
-    function matchBrackets(autoclear) {
-      var head = sel.inverted ? sel.from : sel.to, line = getLine(head.line), pos = head.ch - 1;
-      var match = (pos >= 0 && matching[line.text.charAt(pos)]) || matching[line.text.charAt(++pos)];
-      if (!match) return;
-      var ch = match.charAt(0), forward = match.charAt(1) == ">", d = forward ? 1 : -1, st = line.styles;
-      for (var off = pos + 1, i = 0, e = st.length; i < e; i+=2)
-        if ((off -= st[i].length) <= 0) {var style = st[i+1]; break;}
-
-      var stack = [line.text.charAt(pos)], re = /[(){}[\]]/;
-      function scan(line, from, to) {
-        if (!line.text) return;
-        var st = line.styles, pos = forward ? 0 : line.text.length - 1, cur;
-        for (var i = forward ? 0 : st.length - 2, e = forward ? st.length : -2; i != e; i += 2*d) {
-          var text = st[i];
-          if (st[i+1] != style) {pos += d * text.length; continue;}
-          for (var j = forward ? 0 : text.length - 1, te = forward ? text.length : -1; j != te; j += d, pos+=d) {
-            if (pos >= from && pos < to && re.test(cur = text.charAt(j))) {
-              var match = matching[cur];
-              if (match.charAt(1) == ">" == forward) stack.push(cur);
-              else if (stack.pop() != match.charAt(0)) return {pos: pos, match: false};
-              else if (!stack.length) return {pos: pos, match: true};
-            }
-          }
-        }
+        if (horiz == "left") left = 0;
+        else if (horiz == "middle") left = (display.sizer.clientWidth - node.offsetWidth) / 2;
+        node.style.left = left + "px";
       }
-      for (var i = head.line, e = forward ? Math.min(i + 100, doc.size) : Math.max(-1, i - 100); i != e; i+=d) {
-        var line = getLine(i), first = i == head.line;
-        var found = scan(line, first && forward ? pos + 1 : 0, first && !forward ? pos : line.text.length);
-        if (found) break;
-      }
-      if (!found) found = {pos: null, match: false};
-      var style = found.match ? "CodeMirror-matchingbracket" : "CodeMirror-nonmatchingbracket";
-      var one = markText({line: head.line, ch: pos}, {line: head.line, ch: pos+1}, style),
-          two = found.pos != null && markText({line: i, ch: found.pos}, {line: i, ch: found.pos + 1}, style);
-      var clear = operation(function(){one.clear(); two && two.clear();});
-      if (autoclear) setTimeout(clear, 800);
-      else bracketHighlighted = clear;
-    }
-
-    // Finds the line to start with when starting a parse. Tries to
-    // find a line with a stateAfter, so that it can start with a
-    // valid state. If that fails, it returns the line with the
-    // smallest indentation, which tends to need the least context to
-    // parse correctly.
-    function findStartLine(n) {
-      var minindent, minline;
-      for (var search = n, lim = n - 40; search > lim; --search) {
-        if (search == 0) return 0;
-        var line = getLine(search-1);
-        if (line.stateAfter) return search;
-        var indented = line.indentation(options.tabSize);
-        if (minline == null || minindent > indented) {
-          minline = search - 1;
-          minindent = indented;
-        }
+      if (scroll)
+        scrollIntoView(display, left, top, left + node.offsetWidth, top + node.offsetHeight);
+    },
+
+    lineCount: function() {return this.view.doc.size;},
+
+    clipPos: function(pos) {return clipPos(this.view.doc, pos);},
+
+    getCursor: function(start) {
+      var sel = this.view.sel;
+      if (start == null) start = sel.inverted;
+      return copyPos(start ? sel.from : sel.to);
+    },
+
+    somethingSelected: function() {return !posEq(this.view.sel.from, this.view.sel.to);},
+
+    setCursor: operation(null, function(line, ch, user) {
+      var pos = typeof line == "number" ? {line: line, ch: ch || 0} : line;
+      (user ? setSelectionUser : setSelection)(this, pos, pos);
+    }),
+
+    setSelection: operation(null, function(from, to, user) {
+      var doc = this.view.doc;
+      (user ? setSelectionUser : setSelection)(this, clipPos(doc, from), clipPos(doc, to || from));
+    }),
+
+    getLine: function(line) {var l = this.getLineHandle(line); return l && l.text;},
+
+    getLineHandle: function(line) {
+      var doc = this.view.doc;
+      if (isLine(doc, line)) return getLine(doc, line);
+    },
+
+    getLineNumber: function(line) {return lineNo(line);},
+
+    setLine: operation(null, function(line, text) {
+      if (isLine(this.view.doc, line))
+        replaceRange(this, text, {line: line, ch: 0}, {line: line, ch: getLine(this.view.doc, line).text.length});
+    }),
+
+    removeLine: operation(null, function(line) {
+      if (isLine(this.view.doc, line))
+        replaceRange(this, "", {line: line, ch: 0}, clipPos(this.view.doc, {line: line+1, ch: 0}));
+    }),
+
+    replaceRange: operation(null, function(code, from, to) {
+      var doc = this.view.doc;
+      from = clipPos(doc, from);
+      to = to ? clipPos(doc, to) : from;
+      return replaceRange(this, code, from, to);
+    }),
+
+    getRange: function(from, to, lineSep) {
+      var doc = this.view.doc;
+      from = clipPos(doc, from); to = clipPos(doc, to);
+      var l1 = from.line, l2 = to.line;
+      if (l1 == l2) return getLine(doc, l1).text.slice(from.ch, to.ch);
+      var code = [getLine(doc, l1).text.slice(from.ch)];
+      doc.iter(l1 + 1, l2, function(line) { code.push(line.text); });
+      code.push(getLine(doc, l2).text.slice(0, to.ch));
+      return code.join(lineSep || "\n");
+    },
+
+    triggerOnKeyDown: operation(null, onKeyDown),
+
+    execCommand: function(cmd) {return commands[cmd](this);},
+
+    // Stuff used by commands, probably not much use to outside code.
+    moveH: operation(null, function(dir, unit) {
+      var sel = this.view.sel, pos = dir < 0 ? sel.from : sel.to;
+      if (sel.shift || posEq(sel.from, sel.to)) pos = findPosH(this, dir, unit, true);
+      setSelectionUser(this, pos, pos, dir);
+    }),
+
+    deleteH: operation(null, function(dir, unit) {
+      var sel = this.view.sel;
+      if (!posEq(sel.from, sel.to)) replaceRange(this, "", sel.from, sel.to);
+      else replaceRange(this, "", sel.from, findPosH(this, dir, unit, false));
+      this.curOp.userSelChange = true;
+    }),
+
+    moveV: operation(null, function(dir, unit) {
+      var view = this.view, doc = view.doc, display = this.display;
+      var dist = 0, cur = selHead(view), pos = cursorCoords(this, cur, "div");
+      var x = pos.left, y;
+      if (view.goalColumn != null) x = view.goalColumn;
+      if (unit == "page") {
+        var pageSize = Math.min(display.wrapper.clientHeight, window.innerHeight || document.documentElement.clientHeight);
+        y = pos.top + dir * pageSize;
+      } else if (unit == "line") {
+        y = dir > 0 ? pos.bottom + 3 : pos.top - 3;
       }
-      return minline;
-    }
-    function getStateBefore(n) {
-      var start = findStartLine(n), state = start && getLine(start-1).stateAfter;
-      if (!state) state = startState(mode);
-      else state = copyState(mode, state);
-      doc.iter(start, n, function(line) {
-        line.highlight(mode, state, options.tabSize);
-        line.stateAfter = copyState(mode, state);
+      do {
+        var target = coordsChar(this, x, y);
+        y += dir * 5;
+      } while (target.outside && (dir < 0 ? y > 0 : y < doc.height));
+
+      if (unit == "page") display.scrollbarV.scrollTop += charCoords(this, target, "div").top - pos.top;
+      setSelectionUser(this, target, target, dir);
+      view.goalColumn = x;
+    }),
+
+    toggleOverwrite: function() {
+      if (this.view.overwrite = !this.view.overwrite)
+        this.display.cursor.className += " CodeMirror-overwrite";
+      else
+        this.display.cursor.className = this.display.cursor.className.replace(" CodeMirror-overwrite", "");
+    },
+
+    posFromIndex: function(off) {
+      var lineNo = 0, ch, doc = this.view.doc;
+      doc.iter(0, doc.size, function(line) {
+        var sz = line.text.length + 1;
+        if (sz > off) { ch = off; return true; }
+        off -= sz;
+        ++lineNo;
       });
-      if (start < n) changes.push({from: start, to: n});
-      if (n < doc.size && !getLine(n).stateAfter) work.push(n);
-      return state;
-    }
-    function highlightLines(start, end) {
-      var state = getStateBefore(start);
-      doc.iter(start, end, function(line) {
-        line.highlight(mode, state, options.tabSize);
-        line.stateAfter = copyState(mode, state);
+      return clipPos(doc, {line: lineNo, ch: ch});
+    },
+    indexFromPos: function (coords) {
+      if (coords.line < 0 || coords.ch < 0) return 0;
+      var index = coords.ch;
+      this.view.doc.iter(0, coords.line, function (line) {
+        index += line.text.length + 1;
       });
-    }
-    function highlightWorker() {
-      var end = +new Date + options.workTime;
-      var foundWork = work.length;
-      while (work.length) {
-        if (!getLine(showingFrom).stateAfter) var task = showingFrom;
-        else var task = work.pop();
-        if (task >= doc.size) continue;
-        var start = findStartLine(task), state = start && getLine(start-1).stateAfter;
-        if (state) state = copyState(mode, state);
-        else state = startState(mode);
-
-        var unchanged = 0, compare = mode.compareStates, realChange = false,
-            i = start, bail = false;
-        doc.iter(i, doc.size, function(line) {
-          var hadState = line.stateAfter;
-          if (+new Date > end) {
-            work.push(i);
-            startWorker(options.workDelay);
-            if (realChange) changes.push({from: task, to: i + 1});
-            return (bail = true);
-          }
-          var changed = line.highlight(mode, state, options.tabSize);
-          if (changed) realChange = true;
-          line.stateAfter = copyState(mode, state);
-          var done = null;
-          if (compare) {
-            var same = hadState && compare(hadState, state);
-            if (same != Pass) done = !!same;
-          }
-          if (done == null) {
-            if (changed !== false || !hadState) unchanged = 0;
-            else if (++unchanged > 3 && (!mode.indent || mode.indent(hadState, "") == mode.indent(state, "")))
-              done = true;
-          }
-          if (done) return true;
-          ++i;
-        });
-        if (bail) return;
-        if (realChange) changes.push({from: task, to: i + 1});
-      }
-      if (foundWork && options.onHighlightComplete)
-        options.onHighlightComplete(instance);
-    }
-    function startWorker(time) {
-      if (!work.length) return;
-      highlight.set(time, operation(highlightWorker));
-    }
-
-    // Operations are used to wrap changes in such a way that each
-    // change won't have to update the cursor and display (which would
-    // be awkward, slow, and error-prone), but instead updates are
-    // batched and then all combined and executed at once.
-    function startOperation() {
-      updateInput = userSelChange = textChanged = null;
-      changes = []; selectionChanged = false; callbacks = [];
-    }
-    function endOperation() {
-      if (updateMaxLine) computeMaxLength();
-      if (maxLineChanged && !options.lineWrapping) {
-        var cursorWidth = widthForcer.offsetWidth, left = measureLine(maxLine, maxLine.text.length).left;
-        widthForcer.style.left = left + "px";
-        lineSpace.style.minWidth = (left + cursorWidth) + "px";
-        maxLineChanged = false;
-      }
-      var newScrollPos, updated;
-      if (selectionChanged) {
-        var coords = calculateCursorCoords();
-        newScrollPos = calculateScrollPos(coords.x, coords.y, coords.x, coords.yBot);
-      }
-      if (changes.length || newScrollPos && newScrollPos.scrollTop != null)
-        updated = updateDisplay(changes, true, newScrollPos && newScrollPos.scrollTop);
-      if (!updated) {
-        if (selectionChanged) updateSelection();
-        if (gutterDirty) updateGutter();
-      }
-      if (newScrollPos) scrollCursorIntoView();
-      if (selectionChanged) {scrollEditorIntoView(); restartBlink();}
-
-      if (focused && !leaveInputAlone &&
-          (updateInput === true || (updateInput !== false && selectionChanged)))
-        resetInput(userSelChange);
-
-      if (selectionChanged && options.matchBrackets)
-        setTimeout(operation(function() {
-          if (bracketHighlighted) {bracketHighlighted(); bracketHighlighted = null;}
-          if (posEq(sel.from, sel.to)) matchBrackets(false);
-        }), 20);
-      var sc = selectionChanged, cbs = callbacks; // these can be reset by callbacks
-      if (textChanged && options.onChange && instance)
-        options.onChange(instance, textChanged);
-      if (sc && options.onCursorActivity)
-        options.onCursorActivity(instance);
-      for (var i = 0; i < cbs.length; ++i) cbs[i](instance);
-      if (updated && options.onUpdate) options.onUpdate(instance);
-    }
-    var nestedOperation = 0;
-    function operation(f) {
-      return function() {
-        if (!nestedOperation++) startOperation();
-        try {var result = f.apply(this, arguments);}
-        finally {if (!--nestedOperation) endOperation();}
-        return result;
-      };
-    }
+      return index;
+    },
 
-    function compoundChange(f) {
-      history.startCompound();
-      try { return f(); } finally { history.endCompound(); }
-    }
+    scrollTo: function(x, y) {
+      if (x != null) this.display.scrollbarH.scrollLeft = this.display.scroller.scrollLeft = x;
+      if (y != null) this.display.scrollbarV.scrollTop = this.display.scroller.scrollTop = y;
+      updateDisplay(this, []);
+    },
+    getScrollInfo: function() {
+      var scroller = this.display.scroller, co = scrollerCutOff;
+      return {left: scroller.scrollLeft, top: scroller.scrollTop,
+              height: scroller.scrollHeight - co, width: scroller.scrollWidth - co,
+              clientHeight: scroller.clientHeight - co, clientWidth: scroller.clientWidth - co};
+    },
 
-    for (var ext in extensions)
-      if (extensions.propertyIsEnumerable(ext) &&
-          !instance.propertyIsEnumerable(ext))
-        instance[ext] = extensions[ext];
-    return instance;
-  } // (end of function CodeMirror)
+    scrollIntoView: function(pos) {
+      pos = pos ? clipPos(this.view.doc, pos) : selHead(this.view);
+      var coords = cursorCoords(this, pos);
+      scrollIntoView(this.display, coords.left, coords.top, coords.left, coords.bottom);
+    },
 
-  // The default configuration options.
-  CodeMirror.defaults = {
-    value: "",
-    mode: null,
-    theme: "default",
-    indentUnit: 2,
-    indentWithTabs: false,
-    smartIndent: true,
-    tabSize: 4,
-    keyMap: "default",
-    extraKeys: null,
-    electricChars: true,
-    autoClearEmptyLines: false,
-    onKeyEvent: null,
-    onDragEvent: null,
-    lineWrapping: false,
-    lineNumbers: false,
-    gutter: false,
-    fixedGutter: false,
-    firstLineNumber: 1,
-    readOnly: false,
-    dragDrop: true,
-    onChange: null,
-    onCursorActivity: null,
-    onGutterClick: null,
-    onHighlightComplete: null,
-    onUpdate: null,
-    onFocus: null, onBlur: null, onScroll: null,
-    matchBrackets: false,
-    workTime: 100,
-    workDelay: 200,
-    pollInterval: 100,
-    undoDepth: 40,
-    tabindex: null,
-    autofocus: null,
-    lineNumberFormatter: function(integer) { return integer; }
+    setSize: function(width, height) {
+      function interpret(val) {
+        return typeof val == "number" || /^\d+$/.test(String(val)) ? val + "px" : val;
+      }
+      if (width != null) this.display.wrapper.style.width = interpret(width);
+      if (height != null) this.display.wrapper.style.height = interpret(height);
+      this.refresh();
+    },
+
+    on: function(type, f) {on(this, type, f);},
+    off: function(type, f) {off(this, type, f);},
+
+    operation: function(f){return operation(this, f)();},
+    compoundChange: function(f){return compoundChange(this, f);},
+
+    refresh: function(){
+      updateDisplay(this, true, this.view.scrollTop);
+      if (this.display.scrollbarV.scrollHeight > this.view.scrollTop)
+        this.display.scrollbarV.scrollTop = this.view.scrollTop;
+    },
+
+    getInputField: function(){return this.display.input;},
+    getWrapperElement: function(){return this.display.wrapper;},
+    getScrollerElement: function(){return this.display.scroller;},
+    getGutterElement: function(){return this.display.gutters;}
   };
 
-  var ios = /AppleWebKit/.test(navigator.userAgent) && /Mobile\/\w+/.test(navigator.userAgent);
-  var mac = ios || /Mac/.test(navigator.platform);
-  var win = /Win/.test(navigator.platform);
+  // OPTION DEFAULTS
+
+  var optionHandlers = CodeMirror.optionHandlers = {};
+
+  // The default configuration options.
+  var defaults = CodeMirror.defaults = {};
+
+  function option(name, deflt, handle, notOnInit) {
+    CodeMirror.defaults[name] = deflt;
+    if (handle) optionHandlers[name] =
+      notOnInit ? function(cm, val, old) {if (old != Init) handle(cm, val, old);} : handle;
+  }
+
+  var Init = CodeMirror.Init = {toString: function(){return "CodeMirror.Init";}};
+
+  // These two are, on init, called from the constructor because they
+  // have to be initialized before the editor can start at all.
+  option("value", "", function(cm, val) {cm.setValue(val);}, true);
+  option("mode", null, loadMode, true);
+
+  option("indentUnit", 2, loadMode, true);
+  option("indentWithTabs", false);
+  option("smartIndent", true);
+  option("tabSize", 4, function(cm) {loadMode(cm); updateDisplay(cm, true);}, true);
+  option("electricChars", true);
+  option("autoClearEmptyLines", false);
+
+  option("theme", "default", function(cm, val, old) {
+    themeChanged(cm);
+    if (old != Init) guttersChanged(cm);
+  });
+  option("keyMap", "default", keyMapChanged);
+  option("extraKeys", null);
+
+  option("onKeyEvent", null);
+  option("onDragEvent", null);
+
+  option("lineWrapping", false, wrappingChanged);
+  option("gutters", [], function(cm) {
+    setGuttersForLineNumbers(cm.options);
+    guttersChanged(cm);
+  }, true);
+  option("lineNumbers", false, function(cm) {
+    setGuttersForLineNumbers(cm.options);
+    guttersChanged(cm);
+  }, true);
+  option("firstLineNumber", 1, guttersChanged, false);
+  option("lineNumberFormatter", function(integer) {return integer;}, guttersChanged, false);
+  
+  option("readOnly", false, function(cm, val) {
+    if (val == "nocursor") {onBlur(cm); cm.display.input.blur();}
+    else if (!val) resetInput(cm, true);
+  });
+  option("dragDrop", true);
+
+  option("cursorBlinkRate", 530);
+  option("cursorHeight", 1);
+  option("workTime", 100);
+  option("workDelay", 100);
+  option("flattenSpans", true);
+  option("pollInterval", 100);
+  option("undoDepth", 40);
+  option("viewportMargin", 10, function(cm){cm.refresh();}, true);
+
+  option("tabindex", null, function(cm, val) {
+    cm.display.input.tabIndex = val || "";
+  });
+  option("autofocus", null);
+
+  // MODE DEFINITION AND QUERYING
 
   // Known modes, by name and by MIME
   var modes = CodeMirror.modes = {}, mimeModes = CodeMirror.mimeModes = {};
+
   CodeMirror.defineMode = function(name, mode) {
     if (!CodeMirror.defaults.mode && name != "null") CodeMirror.defaults.mode = name;
     if (arguments.length > 2) {
@@ -2083,9 +2749,11 @@ var CodeMirror = (function() {
     }
     modes[name] = mode;
   };
+
   CodeMirror.defineMIME = function(mime, spec) {
     mimeModes[mime] = spec;
   };
+
   CodeMirror.resolveMode = function(spec) {
     if (typeof spec == "string" && mimeModes.hasOwnProperty(spec))
       spec = mimeModes[spec];
@@ -2094,35 +2762,82 @@ var CodeMirror = (function() {
     if (typeof spec == "string") return {name: spec};
     else return spec || {name: "null"};
   };
+
   CodeMirror.getMode = function(options, spec) {
     var spec = CodeMirror.resolveMode(spec);
     var mfactory = modes[spec.name];
     if (!mfactory) return CodeMirror.getMode(options, "text/plain");
-    return mfactory(options, spec);
-  };
-  CodeMirror.listModes = function() {
-    var list = [];
-    for (var m in modes)
-      if (modes.propertyIsEnumerable(m)) list.push(m);
-    return list;
+    var modeObj = mfactory(options, spec);
+    if (modeExtensions.hasOwnProperty(spec.name)) {
+      var exts = modeExtensions[spec.name];
+      for (var prop in exts) if (exts.hasOwnProperty(prop)) modeObj[prop] = exts[prop];
+    }
+    modeObj.name = spec.name;
+    return modeObj;
   };
-  CodeMirror.listMIMEs = function() {
-    var list = [];
-    for (var m in mimeModes)
-      if (mimeModes.propertyIsEnumerable(m)) list.push({mime: m, mode: mimeModes[m]});
-    return list;
+
+  CodeMirror.defineMode("null", function() {
+    return {token: function(stream) {stream.skipToEnd();}};
+  });
+  CodeMirror.defineMIME("text/plain", "null");
+
+  var modeExtensions = CodeMirror.modeExtensions = {};
+  CodeMirror.extendMode = function(mode, properties) {
+    var exts = modeExtensions.hasOwnProperty(mode) ? modeExtensions[mode] : (modeExtensions[mode] = {});
+    for (var prop in properties) if (properties.hasOwnProperty(prop))
+      exts[prop] = properties[prop];
   };
 
-  var extensions = CodeMirror.extensions = {};
+  // EXTENSIONS
+
   CodeMirror.defineExtension = function(name, func) {
-    extensions[name] = func;
+    CodeMirror.prototype[name] = func;
   };
 
+  CodeMirror.defineOption = option;
+
+  var initHooks = [];
+  CodeMirror.defineInitHook = function(f) {initHooks.push(f);};
+
+  // MODE STATE HANDLING
+
+  // Utility functions for working with state. Exported because modes
+  // sometimes need to do this.
+  function copyState(mode, state) {
+    if (state === true) return state;
+    if (mode.copyState) return mode.copyState(state);
+    var nstate = {};
+    for (var n in state) {
+      var val = state[n];
+      if (val instanceof Array) val = val.concat([]);
+      nstate[n] = val;
+    }
+    return nstate;
+  }
+  CodeMirror.copyState = copyState;
+
+  function startState(mode, a1, a2) {
+    return mode.startState ? mode.startState(a1, a2) : true;
+  }
+  CodeMirror.startState = startState;
+
+  CodeMirror.innerMode = function(mode, state) {
+    while (mode.innerMode) {
+      var info = mode.innerMode(state);
+      state = info.state;
+      mode = info.mode;
+    }
+    return info || {mode: mode, state: state};
+  };
+
+  // STANDARD COMMANDS
+
   var commands = CodeMirror.commands = {
     selectAll: function(cm) {cm.setSelection({line: 0, ch: 0}, {line: cm.lineCount() - 1});},
     killLine: function(cm) {
       var from = cm.getCursor(true), to = cm.getCursor(false), sel = !posEq(from, to);
-      if (!sel && cm.getLine(from.line).length == from.ch) cm.replaceRange("", from, {line: from.line + 1, ch: 0});
+      if (!sel && cm.getLine(from.line).length == from.ch)
+        cm.replaceRange("", from, {line: from.line + 1, ch: 0});
       else cm.replaceRange("", from, sel ? to : {line: from.line});
     },
     deleteLine: function(cm) {var l = cm.getCursor().line; cm.replaceRange("", {line: l, ch: 0}, {line: l});},
@@ -2130,13 +2845,22 @@ var CodeMirror = (function() {
     redo: function(cm) {cm.redo();},
     goDocStart: function(cm) {cm.setCursor(0, 0, true);},
     goDocEnd: function(cm) {cm.setSelection({line: cm.lineCount() - 1}, null, true);},
-    goLineStart: function(cm) {cm.setCursor(cm.getCursor().line, 0, true);},
+    goLineStart: function(cm) {
+      cm.setCursor(lineStart(cm, cm.getCursor().line), null, true);
+    },
     goLineStartSmart: function(cm) {
-      var cur = cm.getCursor();
-      var text = cm.getLine(cur.line), firstNonWS = Math.max(0, text.search(/\S/));
-      cm.setCursor(cur.line, cur.ch <= firstNonWS && cur.ch ? 0 : firstNonWS, true);
+      var cur = cm.getCursor(), start = lineStart(cm, cur.line);
+      var line = cm.getLineHandle(start.line);
+      var order = getOrder(line);
+      if (!order || order[0].level == 0) {
+        var firstNonWS = Math.max(0, line.text.search(/\S/));
+        var inWS = cur.line == start.line && cur.ch <= firstNonWS && cur.ch;
+        cm.setCursor(start.line, inWS ? 0 : firstNonWS, true);
+      } else cm.setCursor(start, null, true);
+    },
+    goLineEnd: function(cm) {
+      cm.setCursor(lineEnd(cm, cm.getCursor().line), null, true);
     },
-    goLineEnd: function(cm) {cm.setSelection({line: cm.getCursor().line}, null, true);},
     goLineUp: function(cm) {cm.moveV(-1, "line");},
     goLineDown: function(cm) {cm.moveV(1, "line");},
     goPageUp: function(cm) {cm.moveV(-1, "page");},
@@ -2147,10 +2871,10 @@ var CodeMirror = (function() {
     goColumnRight: function(cm) {cm.moveH(1, "column");},
     goWordLeft: function(cm) {cm.moveH(-1, "word");},
     goWordRight: function(cm) {cm.moveH(1, "word");},
-    delCharLeft: function(cm) {cm.deleteH(-1, "char");},
-    delCharRight: function(cm) {cm.deleteH(1, "char");},
-    delWordLeft: function(cm) {cm.deleteH(-1, "word");},
-    delWordRight: function(cm) {cm.deleteH(1, "word");},
+    delCharBefore: function(cm) {cm.deleteH(-1, "char");},
+    delCharAfter: function(cm) {cm.deleteH(1, "char");},
+    delWordBefore: function(cm) {cm.deleteH(-1, "word");},
+    delWordAfter: function(cm) {cm.deleteH(1, "word");},
     indentAuto: function(cm) {cm.indentSelection("smart");},
     indentMore: function(cm) {cm.indentSelection("add");},
     indentLess: function(cm) {cm.indentSelection("subtract");},
@@ -2172,11 +2896,13 @@ var CodeMirror = (function() {
     toggleOverwrite: function(cm) {cm.toggleOverwrite();}
   };
 
+  // STANDARD KEYMAPS
+
   var keyMap = CodeMirror.keyMap = {};
   keyMap.basic = {
     "Left": "goCharLeft", "Right": "goCharRight", "Up": "goLineUp", "Down": "goLineDown",
     "End": "goLineEnd", "Home": "goLineStartSmart", "PageUp": "goPageUp", "PageDown": "goPageDown",
-    "Delete": "delCharRight", "Backspace": "delCharLeft", "Tab": "defaultTab", "Shift-Tab": "indentAuto",
+    "Delete": "delCharAfter", "Backspace": "delCharBefore", "Tab": "defaultTab", "Shift-Tab": "indentAuto",
     "Enter": "newlineAndIndent", "Insert": "toggleOverwrite"
   };
   // Note that the save and find-related commands aren't defined by
@@ -2185,7 +2911,7 @@ var CodeMirror = (function() {
     "Ctrl-A": "selectAll", "Ctrl-D": "deleteLine", "Ctrl-Z": "undo", "Shift-Ctrl-Z": "redo", "Ctrl-Y": "redo",
     "Ctrl-Home": "goDocStart", "Alt-Up": "goDocStart", "Ctrl-End": "goDocEnd", "Ctrl-Down": "goDocEnd",
     "Ctrl-Left": "goWordLeft", "Ctrl-Right": "goWordRight", "Alt-Left": "goLineStart", "Alt-Right": "goLineEnd",
-    "Ctrl-Backspace": "delWordLeft", "Ctrl-Delete": "delWordRight", "Ctrl-S": "save", "Ctrl-F": "find",
+    "Ctrl-Backspace": "delWordBefore", "Ctrl-Delete": "delWordAfter", "Ctrl-S": "save", "Ctrl-F": "find",
     "Ctrl-G": "findNext", "Shift-Ctrl-G": "findPrev", "Shift-Ctrl-F": "replace", "Shift-Ctrl-R": "replaceAll",
     "Ctrl-[": "indentLess", "Ctrl-]": "indentMore",
     fallthrough: "basic"
@@ -2193,8 +2919,8 @@ var CodeMirror = (function() {
   keyMap.macDefault = {
     "Cmd-A": "selectAll", "Cmd-D": "deleteLine", "Cmd-Z": "undo", "Shift-Cmd-Z": "redo", "Cmd-Y": "redo",
     "Cmd-Up": "goDocStart", "Cmd-End": "goDocEnd", "Cmd-Down": "goDocEnd", "Alt-Left": "goWordLeft",
-    "Alt-Right": "goWordRight", "Cmd-Left": "goLineStart", "Cmd-Right": "goLineEnd", "Alt-Backspace": "delWordLeft",
-    "Ctrl-Alt-Backspace": "delWordRight", "Alt-Delete": "delWordRight", "Cmd-S": "save", "Cmd-F": "find",
+    "Alt-Right": "goWordRight", "Cmd-Left": "goLineStart", "Cmd-Right": "goLineEnd", "Alt-Backspace": "delWordBefore",
+    "Ctrl-Alt-Backspace": "delWordAfter", "Alt-Delete": "delWordAfter", "Cmd-S": "save", "Cmd-F": "find",
     "Cmd-G": "findNext", "Shift-Cmd-G": "findPrev", "Cmd-Alt-F": "replace", "Shift-Cmd-Alt-F": "replaceAll",
     "Cmd-[": "indentLess", "Cmd-]": "indentMore",
     fallthrough: ["basic", "emacsy"]
@@ -2203,14 +2929,17 @@ var CodeMirror = (function() {
   keyMap.emacsy = {
     "Ctrl-F": "goCharRight", "Ctrl-B": "goCharLeft", "Ctrl-P": "goLineUp", "Ctrl-N": "goLineDown",
     "Alt-F": "goWordRight", "Alt-B": "goWordLeft", "Ctrl-A": "goLineStart", "Ctrl-E": "goLineEnd",
-    "Ctrl-V": "goPageUp", "Shift-Ctrl-V": "goPageDown", "Ctrl-D": "delCharRight", "Ctrl-H": "delCharLeft",
-    "Alt-D": "delWordRight", "Alt-Backspace": "delWordLeft", "Ctrl-K": "killLine", "Ctrl-T": "transposeChars"
+    "Ctrl-V": "goPageUp", "Shift-Ctrl-V": "goPageDown", "Ctrl-D": "delCharAfter", "Ctrl-H": "delCharBefore",
+    "Alt-D": "delWordAfter", "Alt-Backspace": "delWordBefore", "Ctrl-K": "killLine", "Ctrl-T": "transposeChars"
   };
 
+  // KEYMAP DISPATCH
+
   function getKeyMap(val) {
     if (typeof val == "string") return keyMap[val];
     else return val;
   }
+
   function lookupKey(name, extraMap, map, handle, stop) {
     function lookup(map) {
       map = getKeyMap(map);
@@ -2240,19 +2969,29 @@ var CodeMirror = (function() {
     var name = keyNames[e_prop(event, "keyCode")];
     return name == "Ctrl" || name == "Alt" || name == "Shift" || name == "Mod";
   }
+  CodeMirror.isModifierKey = isModifierKey;
+
+  // FROMTEXTAREA
 
   CodeMirror.fromTextArea = function(textarea, options) {
     if (!options) options = {};
     options.value = textarea.value;
     if (!options.tabindex && textarea.tabindex)
       options.tabindex = textarea.tabindex;
-    if (options.autofocus == null && textarea.getAttribute("autofocus") != null)
-      options.autofocus = true;
+    // Set autofocus to true if this textarea is focused, or if it has
+    // autofocus and no other element is focused.
+    if (options.autofocus == null) {
+      var hasFocus = document.body;
+      // doc.activeElement occasionally throws on IE
+      try { hasFocus = document.activeElement; } catch(e) {}
+      options.autofocus = hasFocus == textarea ||
+        textarea.getAttribute("autofocus") != null && hasFocus == document.body;
+    }
 
-    function save() {textarea.value = instance.getValue();}
+    function save() {textarea.value = cm.getValue();}
     if (textarea.form) {
       // Deplorable hack to make the submit method do the right thing.
-      var rmSubmit = connect(textarea.form, "submit", save, true);
+      on(textarea.form, "submit", save);
       if (typeof textarea.form.submit == "function") {
         var realSubmit = textarea.form.submit;
         textarea.form.submit = function wrappedSubmit() {
@@ -2265,54 +3004,28 @@ var CodeMirror = (function() {
     }
 
     textarea.style.display = "none";
-    var instance = CodeMirror(function(node) {
+    var cm = CodeMirror(function(node) {
       textarea.parentNode.insertBefore(node, textarea.nextSibling);
     }, options);
-    instance.save = save;
-    instance.getTextArea = function() { return textarea; };
-    instance.toTextArea = function() {
+    cm.save = save;
+    cm.getTextArea = function() { return textarea; };
+    cm.toTextArea = function() {
       save();
-      textarea.parentNode.removeChild(instance.getWrapperElement());
+      textarea.parentNode.removeChild(cm.getWrapperElement());
       textarea.style.display = "";
       if (textarea.form) {
-        rmSubmit();
+        off(textarea.form, "submit", save);
         if (typeof textarea.form.submit == "function")
           textarea.form.submit = realSubmit;
       }
     };
-    return instance;
+    return cm;
   };
 
-  var gecko = /gecko\/\d{7}/i.test(navigator.userAgent);
-  var ie = /MSIE \d/.test(navigator.userAgent);
-  var ie_lt8 = /MSIE [1-7]\b/.test(navigator.userAgent);
-  var ie_lt9 = /MSIE [1-8]\b/.test(navigator.userAgent);
-  var quirksMode = ie && document.documentMode == 5;
-  var webkit = /WebKit\//.test(navigator.userAgent);
-  var chrome = /Chrome\//.test(navigator.userAgent);
-  var opera = /Opera\//.test(navigator.userAgent);
-  var safari = /Apple Computer/.test(navigator.vendor);
-  var khtml = /KHTML\//.test(navigator.userAgent);
-  var mac_geLion = /Mac OS X 10\D([7-9]|\d\d)\D/.test(navigator.userAgent);
+  // STRING STREAM
 
-  // Utility functions for working with state. Exported because modes
-  // sometimes need to do this.
-  function copyState(mode, state) {
-    if (state === true) return state;
-    if (mode.copyState) return mode.copyState(state);
-    var nstate = {};
-    for (var n in state) {
-      var val = state[n];
-      if (val instanceof Array) val = val.concat([]);
-      nstate[n] = val;
-    }
-    return nstate;
-  }
-  CodeMirror.copyState = copyState;
-  function startState(mode, a1, a2) {
-    return mode.startState ? mode.startState(a1, a2) : true;
-  }
-  CodeMirror.startState = startState;
+  // Fed to the mode parsers, provides helper functions to make
+  // parsers more succinct.
 
   // The character stream used by a mode's parser.
   function StringStream(string, tabSize) {
@@ -2320,10 +3033,11 @@ var CodeMirror = (function() {
     this.string = string;
     this.tabSize = tabSize || 8;
   }
+
   StringStream.prototype = {
     eol: function() {return this.pos >= this.string.length;},
     sol: function() {return this.pos == 0;},
-    peek: function() {return this.string.charAt(this.pos);},
+    peek: function() {return this.string.charAt(this.pos) || undefined;},
     next: function() {
       if (this.pos < this.string.length)
         return this.string.charAt(this.pos++);
@@ -2361,6 +3075,7 @@ var CodeMirror = (function() {
         }
       } else {
         var match = this.string.slice(this.pos).match(pattern);
+        if (match && match.index > 0) return null;
         if (match && consume !== false) this.pos += match[0].length;
         return match;
       }
@@ -2369,392 +3084,546 @@ var CodeMirror = (function() {
   };
   CodeMirror.StringStream = StringStream;
 
-  function MarkedText(from, to, className, marker) {
-    this.from = from; this.to = to; this.style = className; this.marker = marker;
+  // TEXTMARKERS
+
+  function TextMarker(cm, type) {
+    this.lines = [];
+    this.type = type;
+    this.cm = cm;
   }
-  MarkedText.prototype = {
-    attach: function(line) { this.marker.set.push(line); },
-    detach: function(line) {
-      var ix = indexOf(this.marker.set, line);
-      if (ix > -1) this.marker.set.splice(ix, 1);
-    },
-    split: function(pos, lenBefore) {
-      if (this.to <= pos && this.to != null) return null;
-      var from = this.from < pos || this.from == null ? null : this.from - pos + lenBefore;
-      var to = this.to == null ? null : this.to - pos + lenBefore;
-      return new MarkedText(from, to, this.style, this.marker);
-    },
-    dup: function() { return new MarkedText(null, null, this.style, this.marker); },
-    clipTo: function(fromOpen, from, toOpen, to, diff) {
-      if (fromOpen && to > this.from && (to < this.to || this.to == null))
-        this.from = null;
-      else if (this.from != null && this.from >= from)
-        this.from = Math.max(to, this.from) + diff;
-      if (toOpen && (from < this.to || this.to == null) && (from > this.from || this.from == null))
-        this.to = null;
-      else if (this.to != null && this.to > from)
-        this.to = to < this.to ? this.to + diff : from;
-    },
-    isDead: function() { return this.from != null && this.to != null && this.from >= this.to; },
-    sameSet: function(x) { return this.marker == x.marker; }
+
+  TextMarker.prototype.clear = function() {
+    if (this.explicitlyCleared) return;
+    startOperation(this.cm);
+    var min = null, max = null;
+    for (var i = 0; i < this.lines.length; ++i) {
+      var line = this.lines[i];
+      var span = getMarkedSpanFor(line.markedSpans, this);
+      if (span.to != null) max = lineNo(line);
+      line.markedSpans = removeMarkedSpan(line.markedSpans, span);
+      if (span.from != null)
+        min = lineNo(line);
+      else if (this.collapsed && !lineIsHidden(line))
+        updateLineHeight(line, textHeight(this.cm.display));
+    }
+    if (min != null) regChange(this.cm, min, max + 1);
+    this.lines.length = 0;
+    this.explicitlyCleared = true;
+    if (this.collapsed && this.cm.view.cantEdit) {
+      this.cm.view.cantEdit = false;
+      reCheckSelection(this.cm);
+    }
+    endOperation(this.cm);
+    signalLater(this.cm, this, "clear");
   };
 
-  function Bookmark(pos) {
-    this.from = pos; this.to = pos; this.line = null;
-  }
-  Bookmark.prototype = {
-    attach: function(line) { this.line = line; },
-    detach: function(line) { if (this.line == line) this.line = null; },
-    split: function(pos, lenBefore) {
-      if (pos < this.from) {
-        this.from = this.to = (this.from - pos) + lenBefore;
-        return this;
-      }
-    },
-    isDead: function() { return this.from > this.to; },
-    clipTo: function(fromOpen, from, toOpen, to, diff) {
-      if ((fromOpen || from < this.from) && (toOpen || to > this.to)) {
-        this.from = 0; this.to = -1;
-      } else if (this.from > from) {
-        this.from = this.to = Math.max(to, this.from) + diff;
-      }
-    },
-    sameSet: function(x) { return false; },
-    find: function() {
-      if (!this.line || !this.line.parent) return null;
-      return {line: lineNo(this.line), ch: this.from};
-    },
-    clear: function() {
-      if (this.line) {
-        var found = indexOf(this.line.marked, this);
-        if (found != -1) this.line.marked.splice(found, 1);
-        this.line = null;
+  TextMarker.prototype.find = function() {
+    var from, to;
+    for (var i = 0; i < this.lines.length; ++i) {
+      var line = this.lines[i];
+      var span = getMarkedSpanFor(line.markedSpans, this);
+      if (span.from != null || span.to != null) {
+        var found = lineNo(line);
+        if (span.from != null) from = {line: found, ch: span.from};
+        if (span.to != null) to = {line: found, ch: span.to};
       }
     }
+    if (this.type == "bookmark") return from;
+    return from && {from: from, to: to};
   };
 
-  // When measuring the position of the end of a line, different
-  // browsers require different approaches. If an empty span is added,
-  // many browsers report bogus offsets. Of those, some (Webkit,
-  // recent IE) will accept a space without moving the whole span to
-  // the next line when wrapping it, others work with a zero-width
-  // space.
-  var eolSpanContent = " ";
-  if (gecko || (ie && !ie_lt8)) eolSpanContent = "\u200b";
-  else if (opera) eolSpanContent = "";
+  function markText(cm, from, to, options, type) {
+    var doc = cm.view.doc;
+    var marker = new TextMarker(cm, type);
+    if (type == "range" && !posLess(from, to)) return marker;
+    if (options) for (var opt in options) if (options.hasOwnProperty(opt))
+      marker[opt] = options[opt];
+    if (marker.replacedWith) {
+      marker.collapsed = true;
+      marker.replacedWith = elt("span", [marker.replacedWith], "CodeMirror-widget");
+    }
+    if (marker.collapsed) sawCollapsedSpans = true;
+
+    var curLine = from.line, size = 0, collapsedAtStart, collapsedAtEnd;
+    doc.iter(curLine, to.line + 1, function(line) {
+      var span = {from: null, to: null, marker: marker};
+      size += line.text.length;
+      if (curLine == from.line) {span.from = from.ch; size -= from.ch;}
+      if (curLine == to.line) {span.to = to.ch; size -= line.text.length - to.ch;}
+      if (marker.collapsed) {
+        if (curLine == to.line) collapsedAtEnd = collapsedSpanAt(line, to.ch);
+        if (curLine == from.line) collapsedAtStart = collapsedSpanAt(line, from.ch);
+        else updateLineHeight(line, 0);
+      }
+      addMarkedSpan(line, span);
+      if (marker.collapsed && curLine == from.line && lineIsHidden(line))
+        updateLineHeight(line, 0);
+      ++curLine;
+    });
 
-  // Line objects. These hold state related to a line, including
-  // highlighting info (the styles array).
-  function Line(text, styles) {
-    this.styles = styles || [text, null];
-    this.text = text;
-    this.height = 1;
-  }
-  Line.inheritMarks = function(text, orig) {
-    var ln = new Line(text), mk = orig && orig.marked;
-    if (mk) {
-      for (var i = 0; i < mk.length; ++i) {
-        if (mk[i].to == null && mk[i].style) {
-          var newmk = ln.marked || (ln.marked = []), mark = mk[i];
-          var nmark = mark.dup(); newmk.push(nmark); nmark.attach(ln);
-        }
+    if (marker.readOnly) {
+      sawReadOnlySpans = true;
+      if (cm.view.history.done.length || cm.view.history.undone.length)
+        cm.clearHistory();
+    }
+    if (marker.collapsed) {
+      if (collapsedAtStart != collapsedAtEnd)
+        throw new Error("Inserting collapsed marker overlapping an existing one");
+      marker.size = size;
+      marker.atomic = true;
+    }
+    if (marker.className || marker.startStyle || marker.endStyle || marker.collapsed)
+      regChange(cm, from.line, to.line + 1);
+    if (marker.atomic) reCheckSelection(cm);
+    return marker;
+  }
+
+  // TEXTMARKER SPANS
+
+  function getMarkedSpanFor(spans, marker) {
+    if (spans) for (var i = 0; i < spans.length; ++i) {
+      var span = spans[i];
+      if (span.marker == marker) return span;
+    }
+  }
+  function removeMarkedSpan(spans, span) {
+    for (var r, i = 0; i < spans.length; ++i)
+      if (spans[i] != span) (r || (r = [])).push(spans[i]);
+    return r;
+  }
+  function addMarkedSpan(line, span) {
+    line.markedSpans = line.markedSpans ? line.markedSpans.concat([span]) : [span];
+    span.marker.lines.push(line);
+  }
+
+  function markedSpansBefore(old, startCh) {
+    if (old) for (var i = 0, nw; i < old.length; ++i) {
+      var span = old[i], marker = span.marker;
+      var startsBefore = span.from == null || (marker.inclusiveLeft ? span.from <= startCh : span.from < startCh);
+      if (startsBefore || marker.type == "bookmark" && span.from == startCh) {
+        var endsAfter = span.to == null || (marker.inclusiveRight ? span.to >= startCh : span.to > startCh);
+        (nw || (nw = [])).push({from: span.from,
+                                to: endsAfter ? null : span.to,
+                                marker: marker});
       }
     }
-    return ln;
-  };
-  Line.prototype = {
-    // Replace a piece of a line, keeping the styles around it intact.
-    replace: function(from, to_, text) {
-      var st = [], mk = this.marked, to = to_ == null ? this.text.length : to_;
-      copyStyles(0, from, this.styles, st);
-      if (text) st.push(text, null);
-      copyStyles(to, this.text.length, this.styles, st);
-      this.styles = st;
-      this.text = this.text.slice(0, from) + text + this.text.slice(to);
-      this.stateAfter = null;
-      if (mk) {
-        var diff = text.length - (to - from);
-        for (var i = 0; i < mk.length; ++i) {
-          var mark = mk[i];
-          mark.clipTo(from == null, from || 0, to_ == null, to, diff);
-          if (mark.isDead()) {mark.detach(this); mk.splice(i--, 1);}
-        }
+    return nw;
+  }
+
+  function markedSpansAfter(old, startCh, endCh) {
+    if (old) for (var i = 0, nw; i < old.length; ++i) {
+      var span = old[i], marker = span.marker;
+      var endsAfter = span.to == null || (marker.inclusiveRight ? span.to >= endCh : span.to > endCh);
+      if (endsAfter || marker.type == "bookmark" && span.from == endCh && span.from != startCh) {
+        var startsBefore = span.from == null || (marker.inclusiveLeft ? span.from <= endCh : span.from < endCh);
+        (nw || (nw = [])).push({from: startsBefore ? null : span.from - endCh,
+                                to: span.to == null ? null : span.to - endCh,
+                                marker: marker});
       }
-    },
-    // Split a part off a line, keeping styles and markers intact.
-    split: function(pos, textBefore) {
-      var st = [textBefore, null], mk = this.marked;
-      copyStyles(pos, this.text.length, this.styles, st);
-      var taken = new Line(textBefore + this.text.slice(pos), st);
-      if (mk) {
-        for (var i = 0; i < mk.length; ++i) {
-          var mark = mk[i];
-          var newmark = mark.split(pos, textBefore.length);
-          if (newmark) {
-            if (!taken.marked) taken.marked = [];
-            taken.marked.push(newmark); newmark.attach(taken);
-            if (newmark == mark) mk.splice(i--, 1);
-          }
+    }
+    return nw;
+  }
+
+  function updateMarkedSpans(oldFirst, oldLast, startCh, endCh, newText) {
+    if (!oldFirst && !oldLast) return newText;
+    // Get the spans that 'stick out' on both sides
+    var first = markedSpansBefore(oldFirst, startCh);
+    var last = markedSpansAfter(oldLast, startCh, endCh);
+
+    // Next, merge those two ends
+    var sameLine = newText.length == 1, offset = lst(newText).length + (sameLine ? startCh : 0);
+    if (first) {
+      // Fix up .to properties of first
+      for (var i = 0; i < first.length; ++i) {
+        var span = first[i];
+        if (span.to == null) {
+          var found = getMarkedSpanFor(last, span.marker);
+          if (!found) span.to = startCh;
+          else if (sameLine) span.to = found.to == null ? null : found.to + offset;
         }
       }
-      return taken;
-    },
-    append: function(line) {
-      var mylen = this.text.length, mk = line.marked, mymk = this.marked;
-      this.text += line.text;
-      copyStyles(0, line.text.length, line.styles, this.styles);
-      if (mymk) {
-        for (var i = 0; i < mymk.length; ++i)
-          if (mymk[i].to == null) mymk[i].to = mylen;
-      }
-      if (mk && mk.length) {
-        if (!mymk) this.marked = mymk = [];
-        outer: for (var i = 0; i < mk.length; ++i) {
-          var mark = mk[i];
-          if (!mark.from) {
-            for (var j = 0; j < mymk.length; ++j) {
-              var mymark = mymk[j];
-              if (mymark.to == mylen && mymark.sameSet(mark)) {
-                mymark.to = mark.to == null ? null : mark.to + mylen;
-                if (mymark.isDead()) {
-                  mymark.detach(this);
-                  mk.splice(i--, 1);
-                }
-                continue outer;
-              }
-            }
+    }
+    if (last) {
+      // Fix up .from in last (or move them into first in case of sameLine)
+      for (var i = 0; i < last.length; ++i) {
+        var span = last[i];
+        if (span.to != null) span.to += offset;
+        if (span.from == null) {
+          var found = getMarkedSpanFor(first, span.marker);
+          if (!found) {
+            span.from = offset;
+            if (sameLine) (first || (first = [])).push(span);
           }
-          mymk.push(mark);
-          mark.attach(this);
-          mark.from += mylen;
-          if (mark.to != null) mark.to += mylen;
+        } else {
+          span.from += offset;
+          if (sameLine) (first || (first = [])).push(span);
         }
       }
-    },
-    fixMarkEnds: function(other) {
-      var mk = this.marked, omk = other.marked;
-      if (!mk) return;
-      outer: for (var i = 0; i < mk.length; ++i) {
-        var mark = mk[i], close = mark.to == null;
-        if (close && omk) {
-          for (var j = 0; j < omk.length; ++j) {
-            var om = omk[j];
-            if (!om.sameSet(mark) || om.from != null) continue;
-            if (mark.from == this.text.length && om.to == 0) {
-              omk.splice(j, 1);
-              mk.splice(i--, 1);
-              continue outer;
-            } else {
-              close = false; break;
-            }
-          }
-        }
-        if (close) mark.to = this.text.length;
+    }
+
+    var newMarkers = [newHL(newText[0], first)];
+    if (!sameLine) {
+      // Fill gap with whole-line-spans
+      var gap = newText.length - 2, gapMarkers;
+      if (gap > 0 && first)
+        for (var i = 0; i < first.length; ++i)
+          if (first[i].to == null)
+            (gapMarkers || (gapMarkers = [])).push({from: null, to: null, marker: first[i].marker});
+      for (var i = 0; i < gap; ++i)
+        newMarkers.push(newHL(newText[i+1], gapMarkers));
+      newMarkers.push(newHL(lst(newText), last));
+    }
+    return newMarkers;
+  }
+
+  function removeReadOnlyRanges(doc, from, to) {
+    var markers = null;
+    doc.iter(from.line, to.line + 1, function(line) {
+      if (line.markedSpans) for (var i = 0; i < line.markedSpans.length; ++i) {
+        var mark = line.markedSpans[i].marker;
+        if (mark.readOnly && (!markers || indexOf(markers, mark) == -1))
+          (markers || (markers = [])).push(mark);
       }
-    },
-    fixMarkStarts: function() {
-      var mk = this.marked;
-      if (!mk) return;
-      for (var i = 0; i < mk.length; ++i)
-        if (mk[i].from == null) mk[i].from = 0;
-    },
-    addMark: function(mark) {
-      mark.attach(this);
-      if (this.marked == null) this.marked = [];
-      this.marked.push(mark);
-      this.marked.sort(function(a, b){return (a.from || 0) - (b.from || 0);});
-    },
-    // Run the given mode's parser over a line, update the styles
-    // array, which contains alternating fragments of text and CSS
-    // classes.
-    highlight: function(mode, state, tabSize) {
-      var stream = new StringStream(this.text, tabSize), st = this.styles, pos = 0;
-      var changed = false, curWord = st[0], prevWord;
-      if (this.text == "" && mode.blankLine) mode.blankLine(state);
-      while (!stream.eol()) {
-        var style = mode.token(stream, state);
-        var substr = this.text.slice(stream.start, stream.pos);
-        stream.start = stream.pos;
-        if (pos && st[pos-1] == style)
-          st[pos-2] += substr;
-        else if (substr) {
-          if (!changed && (st[pos+1] != style || (pos && st[pos-2] != prevWord))) changed = true;
-          st[pos++] = substr; st[pos++] = style;
-          prevWord = curWord; curWord = st[pos];
-        }
-        // Give up when line is ridiculously long
-        if (stream.pos > 5000) {
-          st[pos++] = this.text.slice(stream.pos); st[pos++] = null;
-          break;
+    });
+    if (!markers) return null;
+    var parts = [{from: from, to: to}];
+    for (var i = 0; i < markers.length; ++i) {
+      var m = markers[i].find();
+      for (var j = 0; j < parts.length; ++j) {
+        var p = parts[j];
+        if (!posLess(m.from, p.to) || posLess(m.to, p.from)) continue;
+        var newParts = [j, 1];
+        if (posLess(p.from, m.from)) newParts.push({from: p.from, to: m.from});
+        if (posLess(m.to, p.to)) newParts.push({from: m.to, to: p.to});
+        parts.splice.apply(parts, newParts);
+        j += newParts.length - 1;
+      }
+    }
+    return parts;
+  }
+
+  function collapsedSpanAt(line, ch) {
+    var sps = sawCollapsedSpans && line.markedSpans, found;
+    if (sps) for (var sp, i = 0; i < sps.length; ++i) {
+      sp = sps[i];
+      if (!sp.marker.collapsed) continue;
+      if ((sp.from == null || sp.from < ch) &&
+          (sp.to == null || sp.to > ch) &&
+          (!found || found.width < sp.marker.width))
+        found = sp.marker;
+    }
+    return found;
+  }
+  function collapsedSpanAtStart(line) { return collapsedSpanAt(line, -1); }
+  function collapsedSpanAtEnd(line) { return collapsedSpanAt(line, line.text.length + 1); }
+
+  function lineIsHidden(line) {
+    var sps = sawCollapsedSpans && line.markedSpans;
+    if (sps) for (var sp, i = 0; i < sps.length; ++i) {
+      sp = sps[i];
+      if (!sp.marker.collapsed) continue;
+      if (sp.from == null) return true;
+      if (sp.from == 0 && sp.marker.inclusiveLeft && lineIsHiddenInner(line, sp))
+        return true;
+    }
+  }
+  window.lineIsHidden = lineIsHidden;
+  function lineIsHiddenInner(line, span) {
+    if (span.to == null || span.marker.inclusiveRight && span.to == line.text.length)
+      return true;
+    for (var sp, i = 0; i < line.markedSpans.length; ++i) {
+      sp = line.markedSpans[i];
+      if (sp.marker.collapsed && sp.from == span.to &&
+          (sp.marker.inclusiveLeft || span.marker.inclusiveRight) &&
+          lineIsHiddenInner(line, sp)) return true;
+    }
+  }
+
+  // hl stands for history-line, a data structure that can be either a
+  // string (line without markers) or a {text, markedSpans} object.
+  function hlText(val) { return typeof val == "string" ? val : val.text; }
+  function hlSpans(val) {
+    if (typeof val == "string") return null;
+    var spans = val.markedSpans, out = null;
+    for (var i = 0; i < spans.length; ++i) {
+      if (spans[i].marker.explicitlyCleared) { if (!out) out = spans.slice(0, i); }
+      else if (out) out.push(spans[i]);
+    }
+    return !out ? spans : out.length ? out : null;
+  }
+  function newHL(text, spans) { return spans ? {text: text, markedSpans: spans} : text; }
+
+  function detachMarkedSpans(line) {
+    var spans = line.markedSpans;
+    if (!spans) return;
+    for (var i = 0; i < spans.length; ++i) {
+      var lines = spans[i].marker.lines;
+      var ix = indexOf(lines, line);
+      lines.splice(ix, 1);
+    }
+    line.markedSpans = null;
+  }
+
+  function attachMarkedSpans(line, spans) {
+    if (!spans) return;
+    for (var i = 0; i < spans.length; ++i)
+      var marker = spans[i].marker.lines.push(line);
+    line.markedSpans = spans;
+  }
+
+  // LINE DATA STRUCTURE
+
+  // Line objects. These hold state related to a line, including
+  // highlighting info (the styles array).
+  function makeLine(text, markedSpans, height) {
+    var line = {text: text, height: height};
+    attachMarkedSpans(line, markedSpans);
+    if (markedSpans && collapsedSpanAtStart(line)) line.height = 0;
+    return line;
+  }
+
+  function updateLine(cm, line, text, markedSpans) {
+    line.text = text;
+    line.stateAfter = line.styles = null;
+    if (line.order != null) line.order = null;
+    detachMarkedSpans(line);
+    attachMarkedSpans(line, markedSpans);
+    var hidden = collapsedSpanAtStart(line);
+    if (hidden) line.height = 0;
+    else if (!line.height) line.height = textHeight(cm.display);
+    signalLater(cm, line, "change");
+  }
+
+  function cleanUpLine(line) {
+    line.parent = null;
+    detachMarkedSpans(line);
+  }
+
+  // Run the given mode's parser over a line, update the styles
+  // array, which contains alternating fragments of text and CSS
+  // classes.
+  function highlightLine(cm, line, state) {
+    var mode = cm.view.mode, flattenSpans = cm.options.flattenSpans;
+    var changed = !line.styles, pos = 0, curText = "", curStyle = null;
+    var stream = new StringStream(line.text, cm.options.tabSize), st = line.styles || (line.styles = []);
+    if (line.text == "" && mode.blankLine) mode.blankLine(state);
+    while (!stream.eol()) {
+      var style = mode.token(stream, state), substr = stream.current();
+      stream.start = stream.pos;
+      if (!flattenSpans || curStyle != style) {
+        if (curText) {
+          changed = changed || pos >= st.length || curText != st[pos] || curStyle != st[pos+1];
+          st[pos++] = curText; st[pos++] = curStyle;
         }
+        curText = substr; curStyle = style;
+      } else curText = curText + substr;
+      // Give up when line is ridiculously long
+      if (stream.pos > 5000) break;
+    }
+    if (curText) {
+      changed = changed || pos >= st.length || curText != st[pos] || curStyle != st[pos+1];
+      st[pos++] = curText; st[pos++] = curStyle;
+    }
+    if (stream.pos > 5000) { st[pos++] = line.text.slice(stream.pos); st[pos++] = null; }
+    if (pos != st.length) { st.length = pos; changed = true; }
+    return changed;
+  }
+
+  // Lightweight form of highlight -- proceed over this line and
+  // update state, but don't save a style array.
+  function processLine(cm, line, state) {
+    var mode = cm.view.mode;
+    var stream = new StringStream(line.text, cm.options.tabSize);
+    if (line.text == "" && mode.blankLine) mode.blankLine(state);
+    while (!stream.eol() && stream.pos <= 5000) {
+      mode.token(stream, state);
+      stream.start = stream.pos;
+    }
+  }
+
+  // Fetch the parser token for a given character. Useful for hacks
+  // that want to inspect the mode state (say, for completion).
+  function getTokenAt(cm, line, state, ch) {
+    var mode = cm.view.mode;
+    var txt = line.text, stream = new StringStream(txt, cm.options.tabSize);
+    while (stream.pos < ch && !stream.eol()) {
+      stream.start = stream.pos;
+      var style = mode.token(stream, state);
+    }
+    return {start: stream.start,
+            end: stream.pos,
+            string: stream.current(),
+            className: style || null,
+            state: state};
+  }
+
+  var styleToClassCache = {};
+  function styleToClass(style) {
+    if (!style) return null;
+    return styleToClassCache[style] ||
+      (styleToClassCache[style] = "cm-" + style.replace(/ +/g, " cm-"));
+  }
+
+  function lineContent(cm, realLine, measure) {
+    var merged, line = realLine, lineBefore, sawBefore;
+    while (merged = collapsedSpanAtStart(line)) {
+      line = getLine(cm.view.doc, merged.find().from.line);
+      if (!lineBefore) lineBefore = line;
+    }
+
+    var builder = {pre: elt("pre"), col: 0, pos: 0, display: !measure,
+                   measure: null, addedOne: false, cm: cm};
+    if (line.textClass) builder.pre.className = line.textClass;
+
+    do {
+      if (!line.styles)
+        highlightLine(cm, line, line.stateAfter = getStateBefore(cm, lineNo(line)));
+      builder.measure = line == realLine && measure;
+      builder.pos = 0;
+      builder.addToken = builder.measure ? buildTokenMeasure : buildToken;
+      if (measure && sawBefore && line != realLine && !builder.addedOne) {
+        measure[0] = builder.pre.appendChild(elt("span", "\u200b"));
+        builder.addedOne = true;
       }
-      if (st.length != pos) {st.length = pos; changed = true;}
-      if (pos && st[pos-2] != prevWord) changed = true;
-      // Short lines with simple highlights return null, and are
-      // counted as changed by the driver because they are likely to
-      // highlight the same way in various contexts.
-      return changed || (st.length < 5 && this.text.length < 10 ? null : false);
-    },
-    // Fetch the parser token for a given character. Useful for hacks
-    // that want to inspect the mode state (say, for completion).
-    getTokenAt: function(mode, state, tabSize, ch) {
-      var txt = this.text, stream = new StringStream(txt, tabSize);
-      while (stream.pos < ch && !stream.eol()) {
-        stream.start = stream.pos;
-        var style = mode.token(stream, state);
-      }
-      return {start: stream.start,
-              end: stream.pos,
-              string: stream.current(),
-              className: style || null,
-              state: state};
-    },
-    indentation: function(tabSize) {return countColumn(this.text, null, tabSize);},
-    // Produces an HTML fragment for the line, taking selection,
-    // marking, and highlighting into account.
-    getElement: function(makeTab, wrapAt, wrapWBR) {
-      var first = true, col = 0, specials = /[\t\u0000-\u0019\u200b\u2028\u2029\uFEFF]/g;
-      var pre = elt("pre");
-      function span_(html, text, style) {
-        if (!text) return;
-        // Work around a bug where, in some compat modes, IE ignores leading spaces
-        if (first && ie && text.charAt(0) == " ") text = "\u00a0" + text.slice(1);
-        first = false;
-        if (!specials.test(text)) {
-          col += text.length;
-          var content = document.createTextNode(text);
+      var next = insertLineContent(line, builder);
+      sawBefore = line == lineBefore;
+      if (next) line = getLine(cm.view.doc, next.to.line);
+    } while (next);
+
+    if (measure && !builder.addedOne)
+      measure[0] = builder.pre.appendChild(elt("span", "\u200b"));
+    if (!builder.pre.firstChild && !lineIsHidden(realLine))
+      builder.pre.appendChild(document.createTextNode("\u00a0"));
+
+    return builder.pre;
+  }
+
+  var tokenSpecialChars = /[\t\u0000-\u0019\u200b\u2028\u2029\uFEFF]/g;
+  function buildToken(builder, text, style, startStyle, endStyle) {
+    if (!text) return;
+    if (!tokenSpecialChars.test(text)) {
+      builder.col += text.length;
+      var content = document.createTextNode(text);
+    } else {
+      var content = document.createDocumentFragment(), pos = 0;
+      while (true) {
+        tokenSpecialChars.lastIndex = pos;
+        var m = tokenSpecialChars.exec(text);
+        var skipped = m ? m.index - pos : text.length - pos;
+        if (skipped) {
+          content.appendChild(document.createTextNode(text.slice(pos, pos + skipped)));
+          builder.col += skipped;
+        }
+        if (!m) break;
+        pos += skipped + 1;
+        if (m[0] == "\t") {
+          var tabSize = builder.cm.options.tabSize, tabWidth = tabSize - builder.col % tabSize;
+          content.appendChild(elt("span", spaceStr(tabWidth), "cm-tab"));
+          builder.col += tabWidth;
         } else {
-          var content = document.createDocumentFragment(), pos = 0;
-          while (true) {
-            specials.lastIndex = pos;
-            var m = specials.exec(text);
-            var skipped = m ? m.index - pos : text.length - pos;
-            if (skipped) {
-              content.appendChild(document.createTextNode(text.slice(pos, pos + skipped)));
-              col += skipped;
-            }
-            if (!m) break;
-            pos += skipped + 1;
-            if (m[0] == "\t") {
-              var tab = makeTab(col);
-              content.appendChild(tab.element.cloneNode(true));
-              col += tab.width;
-            } else {
-              var token = elt("span", "\u2022", "cm-invalidchar");
-              token.title = "\\u" + m[0].charCodeAt(0).toString(16);
-              content.appendChild(token);
-              col += 1;
-            }
-          }
+          var token = elt("span", "\u2022", "cm-invalidchar");
+          token.title = "\\u" + m[0].charCodeAt(0).toString(16);
+          content.appendChild(token);
+          builder.col += 1;
         }
-        if (style) html.appendChild(elt("span", [content], style));
-        else html.appendChild(content);
-      }
-      var span = span_;
-      if (wrapAt != null) {
-        var outPos = 0, anchor = pre.anchor = elt("span");
-        span = function(html, text, style) {
-          var l = text.length;
-          if (wrapAt >= outPos && wrapAt < outPos + l) {
-            if (wrapAt > outPos) {
-              span_(html, text.slice(0, wrapAt - outPos), style);
-              // See comment at the definition of spanAffectsWrapping
-              if (wrapWBR) html.appendChild(elt("wbr"));
-            }
-            html.appendChild(anchor);
-            var cut = wrapAt - outPos;
-            span_(anchor, opera ? text.slice(cut, cut + 1) : text.slice(cut), style);
-            if (opera) span_(html, text.slice(cut + 1), style);
-            wrapAt--;
-            outPos += l;
-          } else {
-            outPos += l;
-            span_(html, text, style);
-            if (outPos == wrapAt && outPos == len) {
-              setTextContent(anchor, eolSpanContent);
-              html.appendChild(anchor);
-            }
-            // Stop outputting HTML when gone sufficiently far beyond measure
-            else if (outPos > wrapAt + 10 && /\s/.test(text)) span = function(){};
-          }
-        };
       }
+    }
+    if (style || startStyle || endStyle || builder.measure) {
+      var fullStyle = style || "";
+      if (startStyle) fullStyle += startStyle;
+      if (endStyle) fullStyle += endStyle;
+      return builder.pre.appendChild(elt("span", [content], fullStyle));
+    }
+    builder.pre.appendChild(content);
+  }
 
-      var st = this.styles, allText = this.text, marked = this.marked;
-      var len = allText.length;
-      function styleToClass(style) {
-        if (!style) return null;
-        return "cm-" + style.replace(/ +/g, " cm-");
-      }
-      if (!allText && wrapAt == null) {
-        span(pre, " ");
-      } else if (!marked || !marked.length) {
-        for (var i = 0, ch = 0; ch < len; i+=2) {
-          var str = st[i], style = st[i+1], l = str.length;
-          if (ch + l > len) str = str.slice(0, len - ch);
-          ch += l;
-          span(pre, str, styleToClass(style));
-        }
-      } else {
-        var pos = 0, i = 0, text = "", style, sg = 0;
-        var nextChange = marked[0].from || 0, marks = [], markpos = 0;
-        var advanceMarks = function() {
-          var m;
-          while (markpos < marked.length &&
-                 ((m = marked[markpos]).from == pos || m.from == null)) {
-            if (m.style != null) marks.push(m);
-            ++markpos;
-          }
-          nextChange = markpos < marked.length ? marked[markpos].from : Infinity;
-          for (var i = 0; i < marks.length; ++i) {
-            var to = marks[i].to;
-            if (to == null) to = Infinity;
-            if (to == pos) marks.splice(i--, 1);
-            else nextChange = Math.min(to, nextChange);
-          }
-        };
-        var m = 0;
-        while (pos < len) {
-          if (nextChange == pos) advanceMarks();
-          var upto = Math.min(len, nextChange);
-          while (true) {
-            if (text) {
-              var end = pos + text.length;
-              var appliedStyle = style;
-              for (var j = 0; j < marks.length; ++j)
-                appliedStyle = (appliedStyle ? appliedStyle + " " : "") + marks[j].style;
-              span(pre, end > upto ? text.slice(0, upto - pos) : text, appliedStyle);
-              if (end >= upto) {text = text.slice(upto - pos); pos = upto; break;}
-              pos = end;
-            }
-            text = st[i++]; style = styleToClass(st[i++]);
+  function buildTokenMeasure(builder, text, style, startStyle, endStyle) {
+    for (var i = 0; i < text.length; ++i) {
+      if (i && i < text.length - 1 &&
+          builder.cm.options.lineWrapping &&
+          spanAffectsWrapping.test(text.slice(i - 1, i + 1)))
+        builder.pre.appendChild(elt("wbr"));
+      builder.measure[builder.pos++] =
+        buildToken(builder, text.charAt(i), style,
+                   i == 0 && startStyle, i == text.length - 1 && endStyle);
+    }
+    if (text.length) builder.addedOne = true;
+  }
+
+  function buildCollapsedSpan(builder, size, widget) {
+    if (widget) {
+      if (!builder.display) widget = widget.cloneNode(true);
+      builder.pre.appendChild(widget);
+      if (builder.measure && size) {
+        builder.measure[builder.pos] = widget;
+        builder.addedOne = true;
+      }
+    }
+    builder.pos += size;
+  }
+
+  // Outputs a number of spans to make up a line, taking highlighting
+  // and marked text into account.
+  function insertLineContent(line, builder) {
+    var st = line.styles, spans = line.markedSpans;
+    if (!spans) {
+      for (var i = 0; i < st.length; i+=2)
+        builder.addToken(builder, st[i], styleToClass(st[i+1]));
+      return;
+    }
+
+    var allText = line.text, len = allText.length;
+    var pos = 0, i = 0, text = "", style;
+    var nextChange = 0, spanStyle, spanEndStyle, spanStartStyle, collapsed;
+    for (;;) {
+      if (nextChange == pos) { // Update current marker set
+        spanStyle = spanEndStyle = spanStartStyle = "";
+        collapsed = null; nextChange = Infinity;
+        var foundBookmark = null;
+        for (var j = 0; j < spans.length; ++j) {
+          var sp = spans[j], m = sp.marker;
+          if (sp.from <= pos && (sp.to == null || sp.to > pos)) {
+            if (sp.to != null && nextChange > sp.to) { nextChange = sp.to; spanEndStyle = ""; }
+            if (m.className) spanStyle += " " + m.className;
+            if (m.startStyle && sp.from == pos) spanStartStyle += " " + m.startStyle;
+            if (m.endStyle && sp.to == nextChange) spanEndStyle += " " + m.endStyle;
+            if (m.collapsed && (!collapsed || collapsed.marker.width < m.width))
+              collapsed = sp;
+          } else if (sp.from > pos && nextChange > sp.from) {
+            nextChange = sp.from;
           }
+          if (m.type == "bookmark" && sp.from == pos && m.replacedWith)
+            foundBookmark = m.replacedWith;
         }
+        if (collapsed && (collapsed.from || 0) == pos) {
+          buildCollapsedSpan(builder, (collapsed.to == null ? len : collapsed.to) - pos,
+                             collapsed.from != null && collapsed.marker.replacedWith);
+          if (collapsed.to == null) return collapsed.marker.find();
+        }
+        if (foundBookmark && !collapsed) buildCollapsedSpan(builder, 0, foundBookmark);
       }
-      return pre;
-    },
-    cleanUp: function() {
-      this.parent = null;
-      if (this.marked)
-        for (var i = 0, e = this.marked.length; i < e; ++i) this.marked[i].detach(this);
-    }
-  };
-  // Utility used by replace and split above
-  function copyStyles(from, to, source, dest) {
-    for (var i = 0, pos = 0, state = 0; pos < to; i+=2) {
-      var part = source[i], end = pos + part.length;
-      if (state == 0) {
-        if (end > from) dest.push(part.slice(from - pos, Math.min(part.length, to - pos)), source[i+1]);
-        if (end >= from) state = 1;
-      } else if (state == 1) {
-        if (end > to) dest.push(part.slice(0, to - pos), source[i+1]);
-        else dest.push(part, source[i+1]);
+      if (pos >= len) break;
+
+      var upto = Math.min(len, nextChange);
+      while (true) {
+        if (text) {
+          var end = pos + text.length;
+          if (!collapsed) {
+            var tokenText = end > upto ? text.slice(0, upto - pos) : text;
+            builder.addToken(builder, tokenText, style + spanStyle,
+                             spanStartStyle, pos + tokenText.length == nextChange ? spanEndStyle : "");
+          }
+          if (end >= upto) {text = text.slice(upto - pos); pos = upto; break;}
+          pos = end;
+          spanStartStyle = "";
+        }
+        text = st[i++]; style = styleToClass(st[i++]);
       }
-      pos = end;
     }
   }
 
-  // Data structure that holds the sequence of lines.
+  // DOCUMENT DATA STRUCTURE
+
   function LeafChunk(lines) {
     this.lines = lines;
     this.parent = null;
@@ -2764,15 +3633,15 @@ var CodeMirror = (function() {
     }
     this.height = height;
   }
+
   LeafChunk.prototype = {
     chunkSize: function() { return this.lines.length; },
-    remove: function(at, n, callbacks) {
+    remove: function(at, n, cm) {
       for (var i = at, e = at + n; i < e; ++i) {
         var line = this.lines[i];
         this.height -= line.height;
-        line.cleanUp();
-        if (line.handlers)
-          for (var j = 0; j < line.handlers.length; ++j) callbacks.push(line.handlers[j]);
+        cleanUpLine(line);
+        signalLater(cm, line, "delete");
       }
       this.lines.splice(at, n);
     },
@@ -2789,6 +3658,7 @@ var CodeMirror = (function() {
         if (op(this.lines[at])) return true;
     }
   };
+
   function BranchChunk(children) {
     this.children = children;
     var size = 0, height = 0;
@@ -2801,6 +3671,7 @@ var CodeMirror = (function() {
     this.height = height;
     this.parent = null;
   }
+
   BranchChunk.prototype = {
     chunkSize: function() { return this.size; },
     remove: function(at, n, callbacks) {
@@ -2888,7 +3759,14 @@ var CodeMirror = (function() {
     }
   };
 
-  function getLineAt(chunk, n) {
+  // LINE UTILITIES
+
+  function lineDoc(line) {
+    for (var d = line.parent; d && d.parent; d = d.parent) {}
+    return d;
+  }
+
+  function getLine(chunk, n) {
     while (!chunk.lines) {
       for (var i = 0;; ++i) {
         var child = chunk.children[i], sz = child.chunkSize();
@@ -2898,6 +3776,12 @@ var CodeMirror = (function() {
     }
     return chunk.lines[n];
   }
+
+  function updateLineHeight(line, height) {
+    var diff = height - line.height;
+    for (var n = line; n; n = n.parent) n.height += diff;
+  }
+
   function lineNo(line) {
     if (line.parent == null) return null;
     var cur = line.parent, no = indexOf(cur.lines, line);
@@ -2909,6 +3793,7 @@ var CodeMirror = (function() {
     }
     return no;
   }
+
   function lineAtHeight(chunk, h) {
     var n = 0;
     outer: do {
@@ -2927,58 +3812,84 @@ var CodeMirror = (function() {
     }
     return n + i;
   }
-  function heightAtLine(chunk, n) {
-    var h = 0;
-    outer: do {
-      for (var i = 0, e = chunk.children.length; i < e; ++i) {
-        var child = chunk.children[i], sz = child.chunkSize();
-        if (n < sz) { chunk = child; continue outer; }
-        n -= sz;
-        h += child.height;
+
+  function heightAtLine(cm, lineObj) {
+    var merged;
+    while (merged = collapsedSpanAtStart(lineObj))
+      lineObj = getLine(cm.view.doc, merged.find().from.line);
+
+    var h = 0, chunk = lineObj.parent;
+    for (var i = 0; i < chunk.lines.length; ++i) {
+      var line = chunk.lines[i];
+      if (line == lineObj) break;
+      else h += line.height;
+    }
+    for (var p = chunk.parent; p; chunk = p, p = chunk.parent) {
+      for (var i = 0; i < p.children.length; ++i) {
+        var cur = p.children[i];
+        if (cur == chunk) break;
+        else h += cur.height;
       }
-      return h;
-    } while (!chunk.lines);
-    for (var i = 0; i < n; ++i) h += chunk.lines[i].height;
+    }
     return h;
   }
 
+  function getOrder(line) {
+    var order = line.order;
+    if (order == null) order = line.order = bidiOrdering(line.text);
+    return order;
+  }
+
+  // HISTORY
+
   // The history object 'chunks' changes that are made close together
   // and at almost the same time into bigger undoable units.
-  function History() {
-    this.time = 0;
-    this.done = []; this.undone = [];
-    this.compound = 0;
-    this.closed = false;
-  }
-  History.prototype = {
-    addChange: function(start, added, old) {
-      this.undone.length = 0;
-      var time = +new Date, cur = this.done[this.done.length - 1], last = cur && cur[cur.length - 1];
-      var dtime = time - this.time;
-
-      if (this.compound && cur && !this.closed) {
-        cur.push({start: start, added: added, old: old});
-      } else if (dtime > 400 || !last || this.closed ||
-                 last.start > start + old.length || last.start + last.added < start) {
-        this.done.push([{start: start, added: added, old: old}]);
-        this.closed = false;
-      } else {
-        var startBefore = Math.max(0, last.start - start),
-            endAfter = Math.max(0, (start + old.length) - (last.start + last.added));
-        for (var i = startBefore; i > 0; --i) last.old.unshift(old[i - 1]);
-        for (var i = endAfter; i > 0; --i) last.old.push(old[old.length - i]);
-        if (startBefore) last.start = start;
-        last.added += added - (old.length - startBefore - endAfter);
-      }
-      this.time = time;
-    },
-    startCompound: function() {
-      if (!this.compound++) this.closed = true;
-    },
-    endCompound: function() {
-      if (!--this.compound) this.closed = true;
+  function makeHistory() {
+    return {time: 0, done: [], undone: [],
+            compound: 0, closed: false, dirtyCounter: 0};
+  }
+
+  function addChange(history, start, added, old) {
+    history.undone.length = 0;
+    var time = +new Date, cur = lst(history.done), last = cur && lst(cur);
+    var dtime = time - history.time;
+    
+    function updateDirty() {
+      if (history.dirtyCounter < 0) {
+          // The user has made a change after undoing past the last clean state. 
+          // We can never get back to a clean state now until markClean() is called.
+          history.dirtyCounter = NaN;
+      }
+      history.dirtyCounter++;
     }
-  };
+
+    if (cur && !history.closed && history.compound) {
+      updateDirty();
+      cur.push({start: start, added: added, old: old});
+    } else if (dtime > 400 || !last || history.closed ||
+               last.start > start + old.length || last.start + last.added < start) {
+      updateDirty();
+      history.done.push([{start: start, added: added, old: old}]);
+      history.closed = false;
+    } else {
+      var startBefore = Math.max(0, last.start - start),
+      endAfter = Math.max(0, (start + old.length) - (last.start + last.added));
+      for (var i = startBefore; i > 0; --i) last.old.unshift(old[i - 1]);
+      for (var i = endAfter; i > 0; --i) last.old.push(old[old.length - i]);
+      if (startBefore) last.start = start;
+      last.added += added - (old.length - startBefore - endAfter);
+    }
+    history.time = time;
+  }
+
+  function compoundChange(cm, f) {
+    var hist = cm.view.history;
+    if (!hist.compound++) hist.closed = true;
+    try { return f(); }
+    finally { if (!--hist.compound) hist.closed = true; }
+  }
+
+  // EVENT OPERATORS
 
   function stopMethod() {e_stop(this);}
   // Ensure an event has a stop method.
@@ -3019,53 +3930,68 @@ var CodeMirror = (function() {
     return overridden ? e.override[prop] : e[prop];
   }
 
-  // Event handler registration. If disconnect is true, it'll return a
-  // function that unregisters the handler.
-  function connect(node, type, handler, disconnect) {
-    if (typeof node.addEventListener == "function") {
-      node.addEventListener(type, handler, false);
-      if (disconnect) return function() {node.removeEventListener(type, handler, false);};
-    } else {
-      var wrapHandler = function(event) {handler(event || window.event);};
-      node.attachEvent("on" + type, wrapHandler);
-      if (disconnect) return function() {node.detachEvent("on" + type, wrapHandler);};
+  // EVENT HANDLING
+
+  function on(emitter, type, f) {
+    if (emitter.addEventListener)
+      emitter.addEventListener(type, f, false);
+    else if (emitter.attachEvent)
+      emitter.attachEvent("on" + type, f);
+    else {
+      var map = emitter._handlers || (emitter._handlers = {});
+      var arr = map[type] || (map[type] = []);
+      arr.push(f);
     }
   }
-  CodeMirror.connect = connect;
 
-  function Delayed() {this.id = null;}
-  Delayed.prototype = {set: function(ms, f) {clearTimeout(this.id); this.id = setTimeout(f, ms);}};
+  function off(emitter, type, f) {
+    if (emitter.removeEventListener)
+      emitter.removeEventListener(type, f, false);
+    else if (emitter.detachEvent)
+      emitter.detachEvent("on" + type, f);
+    else {
+      var arr = emitter._handlers && emitter._handlers[type];
+      if (!arr) return;
+      for (var i = 0; i < arr.length; ++i)
+        if (arr[i] == f) { arr.splice(i, 1); break; }
+    }
+  }
 
-  var Pass = CodeMirror.Pass = {toString: function(){return "CodeMirror.Pass";}};
+  function signal(emitter, type /*, values...*/) {
+    var arr = emitter._handlers && emitter._handlers[type];
+    if (!arr) return;
+    var args = Array.prototype.slice.call(arguments, 2);
+    for (var i = 0; i < arr.length; ++i) arr[i].apply(null, args);
+  }
 
-  // Detect drag-and-drop
-  var dragAndDrop = function() {
-    // There is *some* kind of drag-and-drop support in IE6-8, but I
-    // couldn't get it to work yet.
-    if (ie_lt9) return false;
-    var div = elt('div');
-    return "draggable" in div || "dragDrop" in div;
-  }();
+  function signalLater(cm, emitter, type /*, values...*/) {
+    var arr = emitter._handlers && emitter._handlers[type];
+    if (!arr) return;
+    var args = Array.prototype.slice.call(arguments, 3), flist = cm.curOp && cm.curOp.delayedCallbacks;
+    function bnd(f) {return function(){f.apply(null, args);};};
+    for (var i = 0; i < arr.length; ++i)
+      if (flist) flist.push(bnd(arr[i]));
+      else arr[i].apply(null, args);
+  }
 
-  // Feature-detect whether newlines in textareas are converted to \r\n
-  var lineSep = function () {
-    var te = elt("textarea");
-    te.value = "foo\nbar";
-    if (te.value.indexOf("\r") > -1) return "\r\n";
-    return "\n";
-  }();
+  function hasHandler(emitter, type) {
+    var arr = emitter._handlers && emitter._handlers[type];
+    return arr && arr.length > 0;
+  }
 
-  // For a reason I have yet to figure out, some browsers disallow
-  // word wrapping between certain characters *only* if a new inline
-  // element is started between them. This makes it hard to reliably
-  // measure the position of things, since that requires inserting an
-  // extra span. This terribly fragile set of regexps matches the
-  // character combinations that suffer from this phenomenon on the
-  // various browsers.
-  var spanAffectsWrapping = /^$/; // Won't match any two-character string
-  if (gecko) spanAffectsWrapping = /$'/;
-  else if (safari) spanAffectsWrapping = /\-[^ \-?]|\?[^ !'\"\),.\-\/:;\?\]\}]/;
-  else if (chrome) spanAffectsWrapping = /\-[^ \-\.?]|\?[^ \-\.?\]\}:;!'\"\),\/]|[\.!\"#&%\)*+,:;=>\]|\}~][\(\{\[<]|\$'/;
+  CodeMirror.on = on; CodeMirror.off = off; CodeMirror.signal = signal;
+
+  // MISC UTILITIES
+
+  // Number of pixels added to scroller and sizer to hide scrollbar
+  var scrollerCutOff = 30;
+
+  // Returned or thrown by various protocols to signal 'I'm not
+  // handling this'.
+  var Pass = CodeMirror.Pass = {toString: function(){return "CodeMirror.Pass";}};
+
+  function Delayed() {this.id = null;}
+  Delayed.prototype = {set: function(ms, f) {clearTimeout(this.id); this.id = setTimeout(f, ms);}};
 
   // Counts the column offset in a string, taking tabs into account.
   // Used mostly to find indentation.
@@ -3080,34 +4006,17 @@ var CodeMirror = (function() {
     }
     return n;
   }
+  CodeMirror.countColumn = countColumn;
 
-  function computedStyle(elt) {
-    if (elt.currentStyle) return elt.currentStyle;
-    return window.getComputedStyle(elt, null);
+  var spaceStrs = [""];
+  function spaceStr(n) {
+    while (spaceStrs.length <= n)
+      spaceStrs.push(lst(spaceStrs) + " ");
+    return spaceStrs[n];
   }
 
-  function eltOffset(node, screen) {
-    // Take the parts of bounding client rect that we are interested in so we are able to edit if need be,
-    // since the returned value cannot be changed externally (they are kept in sync as the element moves within the page)
-    try { var box = node.getBoundingClientRect(); box = { top: box.top, left: box.left }; }
-    catch(e) { box = {top: 0, left: 0}; }
-    if (!screen) {
-      // Get the toplevel scroll, working around browser differences.
-      if (window.pageYOffset == null) {
-        var t = document.documentElement || document.body.parentNode;
-        if (t.scrollTop == null) t = document.body;
-        box.top += t.scrollTop; box.left += t.scrollLeft;
-      } else {
-        box.top += window.pageYOffset; box.left += window.pageXOffset;
-      }
-    }
-    return box;
-  }
+  function lst(arr) { return arr[arr.length-1]; }
 
-  // Get a node's text content.
-  function eltText(node) {
-    return node.textContent || node.innerText || node.nodeValue || "";
-  }
   function selectInput(node) {
     if (ios) { // Mobile Safari apparently has a bug where select() is broken.
       node.selectionStart = 0;
@@ -3115,10 +4024,48 @@ var CodeMirror = (function() {
     } else node.select();
   }
 
-  // Operations on {line, ch} objects.
-  function posEq(a, b) {return a.line == b.line && a.ch == b.ch;}
-  function posLess(a, b) {return a.line < b.line || (a.line == b.line && a.ch < b.ch);}
-  function copyPos(x) {return {line: x.line, ch: x.ch};}
+  // Used to position the cursor after an undo/redo by finding the
+  // last edited character.
+  function editEnd(from, to) {
+    if (!to) return 0;
+    if (!from) return to.length;
+    for (var i = from.length, j = to.length; i >= 0 && j >= 0; --i, --j)
+      if (from.charAt(i) != to.charAt(j)) break;
+    return j + 1;
+  }
+
+  function indexOf(collection, elt) {
+    if (collection.indexOf) return collection.indexOf(elt);
+    for (var i = 0, e = collection.length; i < e; ++i)
+      if (collection[i] == elt) return i;
+    return -1;
+  }
+
+  function emptyArray(size) {
+    for (var a = [], i = 0; i < size; ++i) a.push(undefined);
+    return a;
+  }
+
+  function bind(f) {
+    var args = Array.prototype.slice.call(arguments, 1);
+    return function(){return f.apply(null, args);};
+  }
+
+  var nonASCIISingleCaseWordChar = /[\u3040-\u309f\u30a0-\u30ff\u3400-\u4db5\u4e00-\u9fcc]/;
+  function isWordChar(ch) {
+    return /\w/.test(ch) || ch > "\x80" &&
+      (ch.toUpperCase() != ch.toLowerCase() || nonASCIISingleCaseWordChar.test(ch));
+  }
+
+  function isEmpty(obj) {
+    var c = 0;
+    for (var n in obj) if (obj.hasOwnProperty(n) && obj[n]) ++c;
+    return !c;
+  }
+
+  var isExtendingChar = /[\u0300-\u036F\u0483-\u0487\u0488-\u0489\u0591-\u05BD\u05BF\u05C1-\u05C2\u05C4-\u05C5\u05C7\u0610-\u061A\u064B-\u065F\u0670\u06D6-\u06DC\u06DF-\u06E4\u06E7-\u06E8\u06EA-\u06ED\uA66F\uA670-\uA672\uA674-\uA67D\uA69F]/;
+
+  // DOM UTILITIES
 
   function elt(tag, content, className, style) {
     var e = document.createElement(tag);
@@ -3128,39 +4075,62 @@ var CodeMirror = (function() {
     else if (content) for (var i = 0; i < content.length; ++i) e.appendChild(content[i]);
     return e;
   }
+
   function removeChildren(e) {
     e.innerHTML = "";
     return e;
   }
+
   function removeChildrenAndAdd(parent, e) {
-    removeChildren(parent).appendChild(e);
+    return removeChildren(parent).appendChild(e);
   }
+
   function setTextContent(e, str) {
     if (ie_lt9) {
       e.innerHTML = "";
       e.appendChild(document.createTextNode(str));
     } else e.textContent = str;
   }
-  CodeMirror.setTextContent = setTextContent;
 
-  // Used to position the cursor after an undo/redo by finding the
-  // last edited character.
-  function editEnd(from, to) {
-    if (!to) return 0;
-    if (!from) return to.length;
-    for (var i = from.length, j = to.length; i >= 0 && j >= 0; --i, --j)
-      if (from.charAt(i) != to.charAt(j)) break;
-    return j + 1;
-  }
+  // FEATURE DETECTION
 
-  function indexOf(collection, elt) {
-    if (collection.indexOf) return collection.indexOf(elt);
-    for (var i = 0, e = collection.length; i < e; ++i)
-      if (collection[i] == elt) return i;
-    return -1;
-  }
-  function isWordChar(ch) {
-    return /\w/.test(ch) || ch.toUpperCase() != ch.toLowerCase();
+  // Detect drag-and-drop
+  var dragAndDrop = function() {
+    // There is *some* kind of drag-and-drop support in IE6-8, but I
+    // couldn't get it to work yet.
+    if (ie_lt9) return false;
+    var div = elt('div');
+    return "draggable" in div || "dragDrop" in div;
+  }();
+
+  // Feature-detect whether newlines in textareas are converted to \r\n
+  var lineSep = function () {
+    var te = elt("textarea");
+    te.value = "foo\nbar";
+    if (te.value.indexOf("\r") > -1) return "\r\n";
+    return "\n";
+  }();
+
+  // For a reason I have yet to figure out, some browsers disallow
+  // word wrapping between certain characters *only* if a new inline
+  // element is started between them. This makes it hard to reliably
+  // measure the position of things, since that requires inserting an
+  // extra span. This terribly fragile set of regexps matches the
+  // character combinations that suffer from this phenomenon on the
+  // various browsers.
+  var spanAffectsWrapping = /^$/; // Won't match any two-character string
+  if (gecko) spanAffectsWrapping = /$'/;
+  else if (safari) spanAffectsWrapping = /\-[^ \-?]|\?[^ !'\"\),.\-\/:;\?\]\}]/;
+  else if (chrome) spanAffectsWrapping = /\-[^ \-\.?]|\?[^ \-\.?\]\}:;!'\"\),\/]|[\.!\"#&%\)*+,:;=>\]|\}~][\(\{\[<]|\$'/;
+
+  var knownScrollbarWidth;
+  function scrollbarWidth(measure) {
+    if (knownScrollbarWidth != null) return knownScrollbarWidth;
+    var test = elt("div", null, null, "width: 50px; height: 50px; overflow-x: scroll");
+    removeChildrenAndAdd(measure, test);
+    if (test.offsetWidth)
+      knownScrollbarWidth = test.offsetHeight - test.clientHeight;
+    return knownScrollbarWidth || 0;
   }
 
   // See if "".split is the broken IE version, if so, provide an
@@ -3194,10 +4164,14 @@ var CodeMirror = (function() {
     return range.compareEndPoints("StartToEnd", range) != 0;
   };
 
-  CodeMirror.defineMode("null", function() {
-    return {token: function(stream) {stream.skipToEnd();}};
-  });
-  CodeMirror.defineMIME("text/plain", "null");
+  var hasCopyEvent = (function() {
+    var e = elt("div");
+    if ("oncopy" in e) return true;
+    e.setAttribute("oncopy", "return;");
+    return typeof e.oncopy == 'function';
+  })();
+
+  // KEY NAMING
 
   var keyNames = {3: "Enter", 8: "Backspace", 9: "Tab", 13: "Enter", 16: "Shift", 17: "Ctrl", 18: "Alt",
                   19: "Pause", 20: "CapsLock", 27: "Esc", 32: "Space", 33: "PageUp", 34: "PageDown", 35: "End",
@@ -3216,5 +4190,261 @@ var CodeMirror = (function() {
     for (var i = 1; i <= 12; i++) keyNames[i + 111] = keyNames[i + 63235] = "F" + i;
   })();
 
+  // BIDI HELPERS
+
+  function iterateBidiSections(order, from, to, f) {
+    if (!order) return f(from, to, "ltr");
+    for (var i = 0; i < order.length; ++i) {
+      var part = order[i];
+      if (part.from < to && part.to > from)
+        f(Math.max(part.from, from), Math.min(part.to, to), part.level == 1 ? "rtl" : "ltr");
+    }
+  }
+
+  function bidiLeft(part) { return part.level % 2 ? part.to : part.from; }
+  function bidiRight(part) { return part.level % 2 ? part.from : part.to; }
+
+  function lineLeft(line) { var order = getOrder(line); return order ? bidiLeft(order[0]) : 0; }
+  function lineRight(line) {
+    var order = getOrder(line);
+    if (!order) return line.text.length;
+    return bidiRight(lst(order));
+  }
+
+  function lineStart(cm, lineNo) {
+    var merged, line;
+    while (merged = collapsedSpanAtStart(line = getLine(cm.view.doc, lineNo)))
+      lineNo = merged.find().from.line;
+    var order = getOrder(line);
+    var ch = !order ? 0 : order[0].level % 2 ? lineRight(line) : lineLeft(line);
+    return {line: lineNo, ch: ch};
+  }
+  function lineEnd(cm, lineNo) {
+    var merged, line;
+    while (merged = collapsedSpanAtEnd(line = getLine(cm.view.doc, lineNo)))
+      lineNo = merged.find().to.line;
+    var order = getOrder(line);
+    var ch = !order ? line.text.length : order[0].level % 2 ? lineLeft(line) : lineRight(line);
+    return {line: lineNo, ch: ch};
+  }
+
+  // This is somewhat involved. It is needed in order to move
+  // 'visually' through bi-directional text -- i.e., pressing left
+  // should make the cursor go left, even when in RTL text. The
+  // tricky part is the 'jumps', where RTL and LTR text touch each
+  // other. This often requires the cursor offset to move more than
+  // one unit, in order to visually move one unit.
+  function moveVisually(line, start, dir, byUnit) {
+    var bidi = getOrder(line);
+    if (!bidi) return moveLogically(line, start, dir, byUnit);
+    var moveOneUnit = byUnit ? function(pos, dir) {
+      do pos += dir;
+      while (pos > 0 && isExtendingChar.test(line.text.charAt(pos)));
+      return pos;
+    } : function(pos, dir) { return pos + dir; };
+    var linedir = bidi[0].level;
+    for (var i = 0; i < bidi.length; ++i) {
+      var part = bidi[i], sticky = part.level % 2 == linedir;
+      if ((part.from < start && part.to > start) ||
+          (sticky && (part.from == start || part.to == start))) break;
+    }
+    var target = moveOneUnit(start, part.level % 2 ? -dir : dir);
+
+    while (target != null) {
+      if (part.level % 2 == linedir) {
+        if (target < part.from || target > part.to) {
+          part = bidi[i += dir];
+          target = part && (dir > 0 == part.level % 2 ? moveOneUnit(part.to, -1) : moveOneUnit(part.from, 1));
+        } else break;
+      } else {
+        if (target == bidiLeft(part)) {
+          part = bidi[--i];
+          target = part && bidiRight(part);
+        } else if (target == bidiRight(part)) {
+          part = bidi[++i];
+          target = part && bidiLeft(part);
+        } else break;
+      }
+    }
+
+    return target < 0 || target > line.text.length ? null : target;
+  }
+
+  function moveLogically(line, start, dir, byUnit) {
+    var target = start + dir;
+    if (byUnit) while (target > 0 && isExtendingChar.test(line.text.charAt(target))) target += dir;
+    return target < 0 || target > line.text.length ? null : target;
+  }
+
+  // Bidirectional ordering algorithm
+  // See http://unicode.org/reports/tr9/tr9-13.html for the algorithm
+  // that this (partially) implements.
+
+  // One-char codes used for character types:
+  // L (L):   Left-to-Right
+  // R (R):   Right-to-Left
+  // r (AL):  Right-to-Left Arabic
+  // 1 (EN):  European Number
+  // + (ES):  European Number Separator
+  // % (ET):  European Number Terminator
+  // n (AN):  Arabic Number
+  // , (CS):  Common Number Separator
+  // m (NSM): Non-Spacing Mark
+  // b (BN):  Boundary Neutral
+  // s (B):   Paragraph Separator
+  // t (S):   Segment Separator
+  // w (WS):  Whitespace
+  // N (ON):  Other Neutrals
+
+  // Returns null if characters are ordered as they appear
+  // (left-to-right), or an array of sections ({from, to, level}
+  // objects) in the order in which they occur visually.
+  var bidiOrdering = (function() {
+    // Character types for codepoints 0 to 0xff
+    var lowTypes = "bbbbbbbbbtstwsbbbbbbbbbbbbbbssstwNN%%%NNNNNN,N,N1111111111NNNNNNNLLLLLLLLLLLLLLLLLLLLLLLLLLNNNNNNLLLLLLLLLLLLLLLLLLLLLLLLLLNNNNbbbbbbsbbbbbbbbbbbbbbbbbbbbbbbbbb,N%%%%NNNNLNNNNN%%11NLNNN1LNNNNNLLLLLLLLLLLLLLLLLLLLLLLNLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLNLLLLLLLL";
+    // Character types for codepoints 0x600 to 0x6ff
+    var arabicTypes = "rrrrrrrrrrrr,rNNmmmmmmrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrmmmmmmmmmmmmmmrrrrrrrnnnnnnnnnn%nnrrrmrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrmmmmmmmmmmmmmmmmmmmNmmmmrrrrrrrrrrrrrrrrrr";
+    function charType(code) {
+      var type = "L";
+      if (code <= 0xff) return lowTypes.charAt(code);
+      else if (0x590 <= code && code <= 0x5f4) return "R";
+      else if (0x600 <= code && code <= 0x6ff) return arabicTypes.charAt(code - 0x600);
+      else if (0x700 <= code && code <= 0x8ac) return "r";
+      else return "L";
+    }
+
+    var bidiRE = /[\u0590-\u05f4\u0600-\u06ff\u0700-\u08ac]/;
+    var isNeutral = /[stwN]/, isStrong = /[LRr]/, countsAsLeft = /[Lb1n]/, countsAsNum = /[1n]/;
+
+    return function charOrdering(str) {
+      if (!bidiRE.test(str)) return false;
+      var len = str.length, types = [], startType = null;
+      for (var i = 0, type; i < len; ++i) {
+        types.push(type = charType(str.charCodeAt(i)));
+        if (startType == null) {
+          if (type == "L") startType = "L";
+          else if (type == "R" || type == "r") startType = "R";
+        }
+      }
+      if (startType == null) startType = "L";
+
+      // W1. Examine each non-spacing mark (NSM) in the level run, and
+      // change the type of the NSM to the type of the previous
+      // character. If the NSM is at the start of the level run, it will
+      // get the type of sor.
+      for (var i = 0, prev = startType; i < len; ++i) {
+        var type = types[i];
+        if (type == "m") types[i] = prev;
+        else prev = type;
+      }
+
+      // W2. Search backwards from each instance of a European number
+      // until the first strong type (R, L, AL, or sor) is found. If an
+      // AL is found, change the type of the European number to Arabic
+      // number.
+      // W3. Change all ALs to R.
+      for (var i = 0, cur = startType; i < len; ++i) {
+        var type = types[i];
+        if (type == "1" && cur == "r") types[i] = "n";
+        else if (isStrong.test(type)) { cur = type; if (type == "r") types[i] = "R"; }
+      }
+
+      // W4. A single European separator between two European numbers
+      // changes to a European number. A single common separator between
+      // two numbers of the same type changes to that type.
+      for (var i = 1, prev = types[0]; i < len - 1; ++i) {
+        var type = types[i];
+        if (type == "+" && prev == "1" && types[i+1] == "1") types[i] = "1";
+        else if (type == "," && prev == types[i+1] &&
+                 (prev == "1" || prev == "n")) types[i] = prev;
+        prev = type;
+      }
+
+      // W5. A sequence of European terminators adjacent to European
+      // numbers changes to all European numbers.
+      // W6. Otherwise, separators and terminators change to Other
+      // Neutral.
+      for (var i = 0; i < len; ++i) {
+        var type = types[i];
+        if (type == ",") types[i] = "N";
+        else if (type == "%") {
+          for (var end = i + 1; end < len && types[end] == "%"; ++end) {}
+          var replace = (i && types[i-1] == "!") || (end < len - 1 && types[end] == "1") ? "1" : "N";
+          for (var j = i; j < end; ++j) types[j] = replace;
+          i = end - 1;
+        }
+      }
+
+      // W7. Search backwards from each instance of a European number
+      // until the first strong type (R, L, or sor) is found. If an L is
+      // found, then change the type of the European number to L.
+      for (var i = 0, cur = startType; i < len; ++i) {
+        var type = types[i];
+        if (cur == "L" && type == "1") types[i] = "L";
+        else if (isStrong.test(type)) cur = type;
+      }
+
+      // N1. A sequence of neutrals takes the direction of the
+      // surrounding strong text if the text on both sides has the same
+      // direction. European and Arabic numbers act as if they were R in
+      // terms of their influence on neutrals. Start-of-level-run (sor)
+      // and end-of-level-run (eor) are used at level run boundaries.
+      // N2. Any remaining neutrals take the embedding direction.
+      for (var i = 0; i < len; ++i) {
+        if (isNeutral.test(types[i])) {
+          for (var end = i + 1; end < len && isNeutral.test(types[end]); ++end) {}
+          var before = (i ? types[i-1] : startType) == "L";
+          var after = (end < len - 1 ? types[end] : startType) == "L";
+          var replace = before || after ? "L" : "R";
+          for (var j = i; j < end; ++j) types[j] = replace;
+          i = end - 1;
+        }
+      }
+
+      // Here we depart from the documented algorithm, in order to avoid
+      // building up an actual levels array. Since there are only three
+      // levels (0, 1, 2) in an implementation that doesn't take
+      // explicit embedding into account, we can build up the order on
+      // the fly, without following the level-based algorithm.
+      var order = [], m;
+      for (var i = 0; i < len;) {
+        if (countsAsLeft.test(types[i])) {
+          var start = i;
+          for (++i; i < len && countsAsLeft.test(types[i]); ++i) {}
+          order.push({from: start, to: i, level: 0});
+        } else {
+          var pos = i, at = order.length;
+          for (++i; i < len && types[i] != "L"; ++i) {}
+          for (var j = pos; j < i;) {
+            if (countsAsNum.test(types[j])) {
+              if (pos < j) order.splice(at, 0, {from: pos, to: j, level: 1});
+              var nstart = j;
+              for (++j; j < i && countsAsNum.test(types[j]); ++j) {}
+              order.splice(at, 0, {from: nstart, to: j, level: 2});
+              pos = j;
+            } else ++j;
+          }
+          if (pos < i) order.splice(at, 0, {from: pos, to: i, level: 1});
+        }
+      }
+      if (order[0].level == 1 && (m = str.match(/^\s+/))) {
+        order[0].from = m[0].length;
+        order.unshift({from: 0, to: m[0].length, level: 0});
+      }
+      if (lst(order).level == 1 && (m = str.match(/\s+$/))) {
+        lst(order).to -= m[0].length;
+        order.push({from: len - m[0].length, to: len, level: 0});
+      }
+      if (order[0].level != lst(order).level)
+        order.push({from: len, to: len, level: order[0].level});
+
+      return order;
+    };
+  })();
+
+  // THE END
+
+  CodeMirror.version = "3.0 B2";
+
   return CodeMirror;
 })();
diff --git a/Source/WebCore/inspector/front-end/elementsPanel.css b/Source/WebCore/inspector/front-end/elementsPanel.css
index dc2344762..9dd1d7822 100644
--- a/Source/WebCore/inspector/front-end/elementsPanel.css
+++ b/Source/WebCore/inspector/front-end/elementsPanel.css
@@ -178,6 +178,10 @@
     margin-left: 0px;
 }
 
+.styles-section.computed-style .properties li.not-parsed-ok {
+    margin-left: -6px;
+}
+
 .styles-section .properties li.not-parsed-ok img.exclamation-mark {
     content: url(Images/warningIcon.png);
     opacity: 0.75;
@@ -194,6 +198,10 @@
     z-index: 1;
 }
 
+.styles-section.computed-style .properties li.not-parsed-ok img.exclamation-mark {
+    left: 0;
+}
+
 .styles-section .header {
     white-space: nowrap;
     -webkit-background-origin: padding;
@@ -388,7 +396,10 @@
     margin-left: 16px;
 }
 
-.styles-section .properties .overloaded, .styles-section .properties .inactive, .styles-section .properties .disabled {
+.styles-section .properties .overloaded,
+.styles-section .properties .inactive,
+.styles-section .properties .disabled,
+.styles-section .properties .not-parsed-ok {
     text-decoration: line-through;
 }
 
@@ -505,118 +516,3 @@
     -webkit-user-select: text;
     -webkit-user-drag: auto;
 }
-
-/* https://github.com/bgrins/spectrum */
-.spectrum-container {
-    position: absolute;
-    top: 0;
-    left: 0;
-    display: inline-block;
-    background: rgba(230, 230, 230, 1) !important;
-    border: 1px solid #646464;
-    padding: 10px;
-    width: 220px;
-    z-index: 10;
-    -webkit-user-select: none;
-}
-
-.spectrum-top {
-    position: relative;
-    width: 100%;
-    display: inline-block;
-}
-
-.spectrum-color {
-    position: absolute;
-    top: 0;
-    left: 0;
-    bottom: 0;
-    right: 40px;
-}
-
-.spectrum-display-value {
-    -webkit-user-select: text;
-    position: relative;
-    left: 2px;
-    top: -6px;
-}
-
-.spectrum-hue {
-    position: absolute;
-    top: 0;
-    right: 0;
-    bottom: 0;
-    left: 170px;
-    -webkit-box-reflect: right -28px;
-}
-
-.spectrum-fill {
-    /* Same as spectrum-color width to force aspect ratio. */
-    margin-top: 150px;
-}
-
-.spectrum-range-container {
-    position: relative;
-    padding-bottom: 5px;
-}
-
-.spectrum-range-container * {
-    font-size: 11px;
-    vertical-align: middle;
-}
-
-.spectrum-range-container label {
-    display: inline-block;
-    padding-right: 4px;
-}
-
-.spectrum-range-container input {
-    position: absolute;
-    left: 15px;
-    right: 40px;
-    margin: 3px 0 0 0;
-}
-
-.swatch, .spectrum-dragger, .spectrum-slider {
-    -webkit-user-select: none;
-}
-
-.spectrum-sat {
-    background-image: -webkit-linear-gradient(left, white, rgba(204, 154, 129, 0));
-}
-
-.spectrum-val {
-    background-image: -webkit-linear-gradient(bottom, black, rgba(204, 154, 129, 0));
-}
-
-.spectrum-hue {
-    background: -webkit-linear-gradient(top, #ff0000 0%, #ffff00 17%, #00ff00 33%, #00ffff 50%, #0000ff 67%, #ff00ff 83%, #ff0000 100%);
-}
-
-.spectrum-dragger {
-    border-radius: 5px;
-    height: 5px;
-    width: 5px;
-    border: 1px solid white;
-    cursor: pointer;
-    position: absolute;
-    top: 0;
-    left: 0;
-    background: black;
-}
-
-.spectrum-slider {
-    position: absolute;
-    top: 0;
-    cursor: pointer;
-    border: 1px solid black;
-    height: 4px;
-    left: -1px;
-    right: -1px;
-}
-
-.spectrum-container .swatch {
-    width: 20px;
-    height:20px;
-    margin: 0;
-}
diff --git a/Source/WebCore/inspector/front-end/inspector.css b/Source/WebCore/inspector/front-end/inspector.css
index 0dd2b7a7b..89da79cf7 100644
--- a/Source/WebCore/inspector/front-end/inspector.css
+++ b/Source/WebCore/inspector/front-end/inspector.css
@@ -96,11 +96,18 @@ body.compact.inactive #toolbar {
 
 .toolbar-item.toggleable {
     padding-top: 4px;
+    padding-bottom: 4px;
+}
+
+body.compact .toolbar-item.toggleable {
+  margin: 1px 0;
+  padding-bottom: 2px;
 }
 
 .toolbar-item.toggleable.toggled-on {
     border-width: 0 2px 0 2px;
-    padding: 4px 4px 0 4px;
+    padding-left: 4px;
+    padding-right: 4px;
     -webkit-border-image: url(Images/toolbarItemSelected.png) 0 2 0 2;
 }
 
@@ -109,6 +116,7 @@ body.compact.inactive #toolbar {
     width: 32px;
     height: 32px;
     background-image: url(Images/toolbarIcons.png);
+    vertical-align: top;
 }
 
 body.compact .toolbar-icon {
@@ -131,9 +139,12 @@ body.compact .toolbar-item:active .toolbar-icon {
 }
 
 .toolbar-label {
+    line-height: 15px;
     font-size: 11px;
     font-family: Lucida Grande, sans-serif;
     text-shadow: rgba(255, 255, 255, 0.5) 0 1px 0;
+    position: relative;
+    top: 1px;
 }
 
 .toolbar-item.toggleable:active .toolbar-label {
@@ -143,8 +154,7 @@ body.compact .toolbar-item:active .toolbar-icon {
 body.compact .toolbar-label {
     display: inline-block;
     margin-left: 3px;
-    position: relative;
-    top: 2px;
+    top: 0;
 }
 
 body.compact #search-toolbar-label {
@@ -159,17 +169,19 @@ body.compact #search-toolbar-label {
 }
 
 #toolbar-dropdown-arrow {
-    font-size: 16px;
+    font-size: 14px;
     font-weight: bold;
     border: 0;
     background-color: transparent;
     -webkit-border-radius: 5px;
     text-shadow: none;
-}
+    margin: 0;
+    position: relative;
+    top: 1px;
 
-body.compact #toolbar-dropdown-arrow {
-    font-size: 14px;
-    padding-bottom: 4px;
+    /* A line height of 0 allows precise text positioning using padding. */
+    line-height: 0;
+    padding: 9px 6px 11px;
 }
 
 #toolbar-dropdown-arrow.dropdown-visible {
@@ -233,6 +245,11 @@ body.undocked.platform-mac-snowleopard #toolbar-dropdown {
     margin-right: 0.5em;
 }
 
+#toolbar-dropdown .toolbar-label {
+    line-height: 32px;
+    top: 0;
+}
+
 .scrollable-content {
     position: static;
     height: 100%;
@@ -454,7 +471,7 @@ body.compact .toolbar-item.console .toolbar-icon {
     background-position: 0 0;
     background-color: transparent;
     border: 0 none transparent;
-    margin-top: 4px;
+    padding: 0;
 }
 
 #close-button-left:hover, #close-button-right:hover {
@@ -490,7 +507,9 @@ body:not(.platform-mac) .toolbar-item.close-left {
 }
 
 .toolbar-item.close-left {
-    margin-top: 5px;
+  display: -webkit-box;
+  -webkit-box-align: center;
+  height: 100%;
 }
 
 #main {
@@ -769,7 +788,7 @@ body.port-qt .dock-status-bar-item {
 }
 
 #error-warning-count {
-    padding: 6px 2px 6px 0px;
+    padding: 5px 2px 6px 0px;
     font-size: 10px;
     height: 19px;
     cursor: pointer;
@@ -866,7 +885,9 @@ body.platform-linux .monospace, body.platform-linux .source-code {
 }
 
 #console-prompt {
+    clear: right;
     position: relative;
+    border-top: 1px solid rgb(240, 240, 240);
     padding: 1px 22px 1px 0px;
     margin-left: 24px;
     min-height: 16px;
@@ -883,13 +904,18 @@ body.platform-linux .monospace, body.platform-linux .source-code {
 }
 
 .console-message, .console-user-command {
+    clear: right;
     position: relative;
-    border-bottom: 1px solid rgb(240, 240, 240);
+    border-top: 1px solid rgb(240, 240, 240);
     padding: 1px 22px 1px 0px;
     margin-left: 24px;
     min-height: 16px;
 }
 
+.console-mesage:first-child {
+    border-top: none;
+}
+
 .console-adjacent-user-command-result {
     border-bottom: none;
 }
@@ -902,11 +928,11 @@ body.platform-linux .monospace, body.platform-linux .source-code {
     position: absolute;
     display: block;
     content: "";
-    left: -14px;
+    left: -17px;
     top: 0.8em;
     width: 10px;
     height: 10px;
-    margin-top: -5px;
+    margin-top: -6px;
     -webkit-user-select: none;
 }
 
@@ -917,7 +943,7 @@ body.platform-linux .monospace, body.platform-linux .source-code {
     vertical-align: middle;
     white-space: nowrap;
     padding: 1px 4px;
-    margin-top: -2px;
+    margin-top: -1px;
     margin-right: 4px;
     margin-left: -18px;
     text-align: left;
@@ -938,6 +964,15 @@ body.platform-linux .monospace, body.platform-linux .source-code {
     visibility: hidden;
 }
 
+.repeated-message .outline-disclosure, .repeated-message > .console-message-text {
+    -webkit-flex: 1;
+}
+
+.console-info {
+    color: rgb(128, 128, 128);
+    font-style: italic;
+}
+
 .console-group .console-group > .console-group-messages {
     margin-left: 16px;
 }
@@ -1000,6 +1035,7 @@ body.platform-linux .monospace, body.platform-linux .source-code {
 
 .console-warning-level::before {
     background-image: url(Images/warningIcon.png);
+    margin-top: -7px;
 }
 
 .console-user-command .console-message {
@@ -1025,13 +1061,13 @@ body.platform-linux .monospace, body.platform-linux .source-code {
     color: rgb(15%, 15%, 15%);
 }
 
-ol.watch-expressions > li.hovered,
-.console-message:hover { 
+ol.watch-expressions > li.hovered {
     background-color: #F0F0F0;
 }
 
 .console-message-url {
     float: right;
+    max-width: 100%;
     margin-left: 4px;
 }
 
@@ -1262,7 +1298,6 @@ iframe.panel.extension {
 .outline-disclosure li {
     padding: 0 0 0 14px;
     margin-top: 1px;
-    margin-bottom: 1px;
     margin-left: -2px;
     word-wrap: break-word;
 }
@@ -1300,7 +1335,6 @@ iframe.panel.extension {
     float: left;
     width: 8px;
     height: 8px;
-    margin-top: 1px;
     padding-right: 2px;
 }
 
@@ -1671,19 +1705,18 @@ li.editing .swatch, li.editing .enabled-button,  li.editing-sub-part .delete-but
     margin-bottom: -1px;
     width: 1em;
     height: 1em;
-    border: 1px solid rgba(128, 128, 128, 0.6);
-    background-image: url(Images/checker.png);
     display: inline-block;
+    background-image: url(Images/checker.png);
 }
 
 .swatch-inner {
     width: 100%;
     height: 100%;
     display: inline-block;
-    margin-bottom: 1px;
+    border: 1px solid rgba(128, 128, 128, 0.6);
 }
 
-.swatch:hover {
+.swatch-inner:hover {
     border: 1px solid rgba(64, 64, 64, 0.8);
 }
 
@@ -1981,6 +2014,12 @@ button.enable-toggle-status-bar-item.toggled-on .glyph {
     display: block;
 }
 
+.filter-all .console-warning-level.repeated-message, .filter-warnings .console-warning-level.repeated-message,
+.filter-all .console-error-level.repeated-message, .filter-errors .console-error-level.repeated-message,
+.filter-all .console-log-level.repeated-message, .filter-logs .console-log-level.repeated-message {
+    display: -webkit-flex;
+}
+
 .console-user-command-result {
     display: block;
 }
diff --git a/Source/WebCore/inspector/front-end/inspector.html b/Source/WebCore/inspector/front-end/inspector.html
index eda8ddf0c..6ea0af7e9 100644
--- a/Source/WebCore/inspector/front-end/inspector.html
+++ b/Source/WebCore/inspector/front-end/inspector.html
@@ -29,7 +29,7 @@ THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 <html>
 <head>
     <meta http-equiv="content-type" content="text/html; charset=utf-8">
-    <meta http-equiv="X-WebKit-CSP" content="object-src 'none'; script-src 'self' 'unsafe-eval'">
+    <meta http-equiv="Content-Security-Policy" content="object-src 'none'; script-src 'self' 'unsafe-eval'">
     <link rel="stylesheet" type="text/css" href="dialog.css">
     <link rel="stylesheet" type="text/css" href="inspector.css">
     <link rel="stylesheet" type="text/css" href="inspectorCommon.css">
@@ -71,6 +71,7 @@ THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
     <script type="text/javascript" src="ContentProvider.js"></script>
     <script type="text/javascript" src="Resource.js"></script>
     <script type="text/javascript" src="NetworkRequest.js"></script>
+    <script type="text/javascript" src="UISourceCode.js"></script>
     <script type="text/javascript" src="CSSStyleModel.js"></script>
     <script type="text/javascript" src="NetworkManager.js"></script>
     <script type="text/javascript" src="NetworkLog.js"></script>
@@ -131,11 +132,11 @@ THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
     <script type="text/javascript" src="FileUtils.js"></script>
     <script type="text/javascript" src="DebuggerModel.js"></script>
     <script type="text/javascript" src="SourceMapping.js"></script>
-    <script type="text/javascript" src="UISourceCode.js"></script>
     <script type="text/javascript" src="Script.js"></script>
     <script type="text/javascript" src="Linkifier.js"></script>
     <script type="text/javascript" src="DebuggerScriptMapping.js"></script>
     <script type="text/javascript" src="PresentationConsoleMessageHelper.js"></script>
+    <script type="text/javascript" src="NetworkWorkspaceProvider.js"></script>
     <script type="text/javascript" src="Workspace.js"></script>
     <script type="text/javascript" src="BreakpointManager.js"></script>
     <script type="text/javascript" src="ContentProviders.js"></script>
@@ -172,7 +173,7 @@ THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
     <div id="toolbar">
         <div class="toolbar-item close-left"><button id="close-button-left"></button></div>
         <div id="toolbar-controls">
-            <div class="toolbar-item"><button id="toolbar-dropdown-arrow" class="toolbar-label">&raquo;</button></div>
+            <div class="toolbar-item"><button id="toolbar-dropdown-arrow">&raquo;</button></div>
             <div class="toolbar-item close-right"><button id="close-button-right"></button></div>
         </div>
     </div>
diff --git a/Source/WebCore/inspector/front-end/inspector.js b/Source/WebCore/inspector/front-end/inspector.js
index d2a4d3a2d..d67fb0cb1 100644
--- a/Source/WebCore/inspector/front-end/inspector.js
+++ b/Source/WebCore/inspector/front-end/inspector.js
@@ -336,7 +336,8 @@ WebInspector.loaded = function()
             WebInspector.doLoadedDone();
         }
         WebInspector.socket.onclose = function() {
-            (new WebInspector.RemoteDebuggingTerminatedScreen()).showModal();
+            if (!WebInspector.socket._detachReason)
+                (new WebInspector.RemoteDebuggingTerminatedScreen("websocket_closed")).showModal();
         }
         return;
     }
@@ -369,6 +370,7 @@ WebInspector.doLoadedDone = function()
     ProfilerAgent.isSampling(WebInspector._initializeCapability.bind(WebInspector, "samplingCPUProfiler", null));
     ProfilerAgent.hasHeapProfiler(WebInspector._initializeCapability.bind(WebInspector, "heapProfilerPresent", null));
     TimelineAgent.supportsFrameInstrumentation(WebInspector._initializeCapability.bind(WebInspector, "timelineSupportsFrameInstrumentation", null));
+    TimelineAgent.canMonitorMainThread(WebInspector._initializeCapability.bind(WebInspector, "timelineCanMonitorMainThread", null));
     PageAgent.canOverrideDeviceMetrics(WebInspector._initializeCapability.bind(WebInspector, "canOverrideDeviceMetrics", null));
     PageAgent.canOverrideGeolocation(WebInspector._initializeCapability.bind(WebInspector, "canOverrideGeolocation", null));
     PageAgent.canOverrideDeviceOrientation(WebInspector._initializeCapability.bind(WebInspector, "canOverrideDeviceOrientation", WebInspector._doLoadedDoneWithCapabilities.bind(WebInspector)));
@@ -423,18 +425,20 @@ WebInspector._doLoadedDoneWithCapabilities = function()
     this.openAnchorLocationRegistry = new WebInspector.HandlerRegistry(openAnchorLocationSetting);
     this.openAnchorLocationRegistry.registerHandler(autoselectPanel, function() { return false; });
 
+    this.networkWorkspaceProvider = new WebInspector.NetworkWorkspaceProvider();
     this.workspace = new WebInspector.Workspace();
+    this.workspace.addProject("network", this.networkWorkspaceProvider);
     this.workspaceController = new WebInspector.WorkspaceController(this.workspace);
 
     this.breakpointManager = new WebInspector.BreakpointManager(WebInspector.settings.breakpoints, this.debuggerModel, this.workspace);
 
-    this.scriptSnippetModel = new WebInspector.ScriptSnippetModel(this.workspace);
-    new WebInspector.DebuggerScriptMapping(this.workspace);
+    this.scriptSnippetModel = new WebInspector.ScriptSnippetModel(this.workspace, this.networkWorkspaceProvider);
+    new WebInspector.DebuggerScriptMapping(this.workspace, this.networkWorkspaceProvider);
     this.styleContentBinding = new WebInspector.StyleContentBinding(this.cssModel);
-    new WebInspector.NetworkUISourceCodeProvider(this.workspace);
+    new WebInspector.NetworkUISourceCodeProvider(this.workspace, this.networkWorkspaceProvider);
     new WebInspector.StylesSourceMapping(this.workspace);
     if (WebInspector.experimentsSettings.sass.isEnabled())
-        new WebInspector.SASSSourceMapping(this.workspace);
+        new WebInspector.SASSSourceMapping(this.workspace, this.networkWorkspaceProvider);
 
     new WebInspector.PresentationConsoleMessageHelper(this.workspace);
 
@@ -885,6 +889,7 @@ WebInspector.showErrorMessage = function(error)
     WebInspector.log(error, WebInspector.ConsoleMessage.MessageLevel.Error, true);
 }
 
+// Inspector.inspect protocol event
 WebInspector.inspect = function(payload, hints)
 {
     var object = WebInspector.RemoteObject.fromPayload(payload);
@@ -906,6 +911,13 @@ WebInspector.inspect = function(payload, hints)
     object.release();
 }
 
+// Inspector.detached protocol event
+WebInspector.detached = function(reason)
+{
+    WebInspector.socket._detachReason = reason;
+    (new WebInspector.RemoteDebuggingTerminatedScreen(reason)).showModal();
+}
+
 WebInspector._updateFocusedNode = function(nodeId)
 {
     if (WebInspector._nodeSearchButton.toggled) {
diff --git a/Source/WebCore/inspector/front-end/nativeMemoryProfiler.css b/Source/WebCore/inspector/front-end/nativeMemoryProfiler.css
index 4c42afd9f..815c71a89 100644
--- a/Source/WebCore/inspector/front-end/nativeMemoryProfiler.css
+++ b/Source/WebCore/inspector/front-end/nativeMemoryProfiler.css
@@ -56,12 +56,13 @@
 }
 
 .memory-bar-chart-bar {
-    border: 1px solid #bbb;
+    border: 0px;
     border-radius: 2px;
     float: left;
-    height: 20px;
+    height: 18px;
     overflow: hidden;
     position: relative;
+    background-image: -webkit-gradient(linear, left top, left bottom, from(rgba(255, 255, 255, 0.5)), to(rgba(192, 192, 192, 0)));
 }
 
 .memory-bar-chart-unused {
@@ -84,3 +85,62 @@
 .memory-bar-chart-total {
     font-weight: bold;
 }
+
+.native-snapshot-view {
+    display: none;
+    overflow: hidden;
+    position: absolute;
+    top: 0;
+    left: 0;
+    right: 0;
+    bottom: 0;
+}
+
+.native-snapshot-view.visible {
+    display: block;
+}
+
+.native-snapshot-view .data-grid {
+    position: absolute;
+    top: 0;
+    left: 0;
+    right: 0;
+    bottom: 0;
+    border: none;
+}
+
+.native-snapshot-view .data-grid table {
+    font-size: 11px;
+}
+
+.native-snapshot-view .data-grid td {
+    height: 14px;
+    line-height: 14px;
+    padding: 1px 4px;
+}
+
+.native-snapshot-view .data-grid div.size-text {
+    float: left;
+    text-align: right;
+    width: 70px;
+    padding-right: 5px;
+}
+
+.native-snapshot-view .data-grid .expanded div.size-bar {
+    background-image: -webkit-gradient(linear, left top, left bottom, from(hsla(0, 100%, 100%, 0.85)), to(hsla(0, 100%, 100%, 0.65)));
+    color: hsla(0, 0%, 0%, 0.5);
+}
+
+.native-snapshot-view .data-grid div.size-bar {
+    text-align: center;
+    background-image: -webkit-gradient(linear, left top, left bottom, from(rgba(255, 255, 255, 0.5)), to(rgba(192, 192, 192, 0)));
+    height: 14px;
+    border-radius: 2px;
+    color: black;
+    white-space: normal;
+    min-width: 1px;
+}
+
+.native-snapshot-view .data-grid div.percent-text {
+    display: inline-block;
+}
diff --git a/Source/WebCore/inspector/front-end/spectrum.css b/Source/WebCore/inspector/front-end/spectrum.css
new file mode 100644
index 000000000..7a9ea28b9
--- /dev/null
+++ b/Source/WebCore/inspector/front-end/spectrum.css
@@ -0,0 +1,114 @@
+/* https://github.com/bgrins/spectrum */
+.spectrum-container {
+    position: absolute;
+    top: 0;
+    left: 0;
+    display: inline-block;
+    background: rgba(230, 230, 230, 1) !important;
+    border: 1px solid #646464;
+    padding: 10px;
+    width: 220px;
+    z-index: 10;
+    -webkit-user-select: none;
+}
+
+.spectrum-top {
+    position: relative;
+    width: 100%;
+    display: inline-block;
+}
+
+.spectrum-color {
+    position: absolute;
+    top: 0;
+    left: 0;
+    bottom: 0;
+    right: 40px;
+}
+
+.spectrum-display-value {
+    -webkit-user-select: text;
+    position: relative;
+    left: 2px;
+    top: -6px;
+}
+
+.spectrum-hue {
+    position: absolute;
+    top: 0;
+    right: 0;
+    bottom: 0;
+    left: 170px;
+    -webkit-box-reflect: right -28px;
+}
+
+.spectrum-fill {
+    /* Same as spectrum-color width to force aspect ratio. */
+    margin-top: 150px;
+}
+
+.spectrum-range-container {
+    position: relative;
+    padding-bottom: 5px;
+}
+
+.spectrum-range-container * {
+    font-size: 11px;
+    vertical-align: middle;
+}
+
+.spectrum-range-container label {
+    display: inline-block;
+    padding-right: 4px;
+}
+
+.spectrum-range-container input {
+    position: absolute;
+    left: 15px;
+    right: 40px;
+    margin: 3px 0 0 0;
+}
+
+.spectrum-dragger, .spectrum-slider {
+    -webkit-user-select: none;
+}
+
+.spectrum-sat {
+    background-image: -webkit-linear-gradient(left, white, rgba(204, 154, 129, 0));
+}
+
+.spectrum-val {
+    background-image: -webkit-linear-gradient(bottom, black, rgba(204, 154, 129, 0));
+}
+
+.spectrum-hue {
+    background: -webkit-linear-gradient(top, #ff0000 0%, #ffff00 17%, #00ff00 33%, #00ffff 50%, #0000ff 67%, #ff00ff 83%, #ff0000 100%);
+}
+
+.spectrum-dragger {
+    border-radius: 5px;
+    height: 5px;
+    width: 5px;
+    border: 1px solid white;
+    cursor: pointer;
+    position: absolute;
+    top: 0;
+    left: 0;
+    background: black;
+}
+
+.spectrum-slider {
+    position: absolute;
+    top: 0;
+    cursor: pointer;
+    border: 1px solid black;
+    height: 4px;
+    left: -1px;
+    right: -1px;
+}
+
+.spectrum-container .swatch {
+    width: 20px;
+    height:20px;
+    margin: 0;
+}
diff --git a/Source/WebCore/inspector/front-end/timelinePanel.css b/Source/WebCore/inspector/front-end/timelinePanel.css
index c9dfabe2b..64a1adc7d 100644
--- a/Source/WebCore/inspector/front-end/timelinePanel.css
+++ b/Source/WebCore/inspector/front-end/timelinePanel.css
@@ -653,24 +653,19 @@
 
 .timeline-cpu-bars {
     position: absolute;
-    top: 19px;
-    height: 18px;
+    top: 0;
+    height: 19px;
     z-index: 350;
     width: 100%;
     overflow: hidden;
 }
 
-.timeline-cpu-bars-label {
-    font-weight: bold;
-    font-family: monospace;
-    font-size: 9px;
-    line-height: 7px;
-    position: absolute;
-    top: 5px;
-    left: 4px;
-    color: rgb(51, 51, 51);
-    background-color: rgba(255, 255, 255, 0.75);
-    z-index: 350;
+.timeline-cpu-bars .timeline-graph-bar {
+    border-color: rgb(192, 192, 192);
+    background-color: rgba(0, 0, 0, 0.15);
+    top: 2px;
+    bottom: 2px;
+    height: auto;
 }
 
 .image-preview-container {
diff --git a/Source/WebCore/bindings/v8/DOMData.cpp b/Source/WebCore/loader/CachedMetadata.cpp
index da6ea5b1a..d64c10b84 100644
--- a/Source/WebCore/bindings/v8/DOMData.cpp
+++ b/Source/WebCore/loader/CachedMetadata.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2009 Google Inc. All rights reserved.
+ * Copyright (C) 2011 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -29,33 +29,17 @@
  */
 
 #include "config.h"
-#include "DOMData.h"
-#include "V8Binding.h"
-#include "V8DOMWindowShell.h"
-#include "WebGLContextAttributes.h"
-#include "WebGLUniformLocation.h"
+#include "CachedMetadata.h"
 
-namespace WebCore {
+#include "WebCoreMemoryInstrumentation.h"
+#include <wtf/MemoryInstrumentationVector.h>
 
-DOMDataStore& DOMData::getCurrentStore(v8::Isolate* isolate)
-{
-    DEFINE_STATIC_LOCAL(StaticDOMDataStore, defaultStore, ());
-    if (UNLIKELY(!isolate))
-        isolate = v8::Isolate::GetCurrent();
-    V8PerIsolateData* data = V8PerIsolateData::from(isolate);
-    if (UNLIKELY(data->domDataStore() != 0))
-        return *data->domDataStore();
-    V8DOMWindowShell* context = V8DOMWindowShell::getEntered();
-    if (UNLIKELY(context != 0))
-        return *context->world()->domDataStore();
-    return defaultStore;
-}
+namespace WebCore {
 
-void DOMData::derefObject(WrapperTypeInfo* type, void* domObject)
+void CachedMetadata::reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
 {
-    type->derefObject(domObject);
+    MemoryClassInfo info(memoryObjectInfo, this);
+    info.addMember(m_serializedData);
 }
 
-
-
 } // namespace WebCore
diff --git a/Source/WebCore/loader/CachedMetadata.h b/Source/WebCore/loader/CachedMetadata.h
index 120e4c0ba..db9eb38c1 100644
--- a/Source/WebCore/loader/CachedMetadata.h
+++ b/Source/WebCore/loader/CachedMetadata.h
@@ -31,6 +31,7 @@
 #ifndef CachedMetadata_h
 #define CachedMetadata_h
 
+#include <wtf/Forward.h>
 #include <wtf/RefCounted.h>
 #include <wtf/Vector.h>
 
@@ -78,6 +79,8 @@ public:
         return m_serializedData.size() - dataStart;
     }
 
+    void reportMemoryUsage(MemoryObjectInfo*) const;
+
 private:
     // Reads an unsigned value at position. Returns 0 on error.
     unsigned readUnsigned(size_t position) const
diff --git a/Source/WebCore/loader/DocumentThreadableLoader.cpp b/Source/WebCore/loader/DocumentThreadableLoader.cpp
index 9c889cdf5..88f52f4b5 100644
--- a/Source/WebCore/loader/DocumentThreadableLoader.cpp
+++ b/Source/WebCore/loader/DocumentThreadableLoader.cpp
@@ -305,12 +305,9 @@ void DocumentThreadableLoader::notifyFinished(CachedResource* resource)
     ASSERT(m_client);
     ASSERT_UNUSED(resource, resource == m_resource);
         
-    if (m_resource && (m_resource->errorOccurred() || m_resource->wasCanceled())) {
-        ResourceError error("Network Request Failed", 0, m_resource->url(), "Resource failed to load");
-        if (m_resource->wasCanceled())
-            error.setIsCancellation(true);
-        didFail(error);
-    } else
+    if (m_resource && m_resource->errorOccurred())
+        didFail(m_resource->resourceError());
+    else
         didFinishLoading(m_resource->identifier(), m_resource->loadFinishTime());
 }
 
diff --git a/Source/WebCore/loader/EmptyClients.cpp b/Source/WebCore/loader/EmptyClients.cpp
index c9b3f3a6e..3898461ad 100644
--- a/Source/WebCore/loader/EmptyClients.cpp
+++ b/Source/WebCore/loader/EmptyClients.cpp
@@ -104,10 +104,10 @@ PassOwnPtr<ColorChooser> EmptyChromeClient::createColorChooser(ColorChooserClien
 }
 #endif
 
-#if ENABLE(CALENDAR_PICKER)
-PassOwnPtr<DateTimeChooser> EmptyChromeClient::openDateTimeChooser(DateTimeChooserClient*, const DateTimeChooserParameters&)
+#if ENABLE(DATE_AND_TIME_INPUT_TYPES)
+PassRefPtr<DateTimeChooser> EmptyChromeClient::openDateTimeChooser(DateTimeChooserClient*, const DateTimeChooserParameters&)
 {
-    return nullptr;
+    return PassRefPtr<DateTimeChooser>();
 }
 #endif
 
@@ -194,4 +194,10 @@ PassOwnPtr<ContextMenu> EmptyContextMenuClient::customizeMenu(PassOwnPtr<Context
 #endif
 #endif
 
+#if ENABLE(REQUEST_AUTOCOMPLETE)
+void EmptyFrameLoaderClient::didRequestAutocomplete(PassRefPtr<FormState>)
+{
+}
+#endif
+
 }
diff --git a/Source/WebCore/loader/EmptyClients.h b/Source/WebCore/loader/EmptyClients.h
index 9c2c23d3e..67e87a792 100644
--- a/Source/WebCore/loader/EmptyClients.h
+++ b/Source/WebCore/loader/EmptyClients.h
@@ -173,8 +173,8 @@ public:
     virtual PassOwnPtr<ColorChooser> createColorChooser(ColorChooserClient*, const Color&) OVERRIDE;
 #endif
 
-#if ENABLE(CALENDAR_PICKER)
-    virtual PassOwnPtr<DateTimeChooser> openDateTimeChooser(DateTimeChooserClient*, const DateTimeChooserParameters&) OVERRIDE;
+#if ENABLE(DATE_AND_TIME_INPUT_TYPES)
+    virtual PassRefPtr<DateTimeChooser> openDateTimeChooser(DateTimeChooserClient*, const DateTimeChooserParameters&) OVERRIDE;
 #endif
 
     virtual void runOpenPanel(Frame*, PassRefPtr<FileChooser>) OVERRIDE;
@@ -206,6 +206,8 @@ public:
     virtual void numWheelEventHandlersChanged(unsigned) OVERRIDE { }
     
     virtual bool shouldRubberBandInDirection(WebCore::ScrollDirection) const { return false; }
+    
+    virtual bool isEmptyChromeClient() const { return true; }
 };
 
 class EmptyFrameLoaderClient : public FrameLoaderClient {
@@ -382,6 +384,10 @@ public:
 #if ENABLE(WEB_INTENTS)
     virtual void dispatchIntent(PassRefPtr<IntentRequest>) OVERRIDE;
 #endif
+
+#if ENABLE(REQUEST_AUTOCOMPLETE)
+    virtual void didRequestAutocomplete(PassRefPtr<FormState>) OVERRIDE;
+#endif
 };
 
 class EmptyTextCheckerClient : public TextCheckerClient {
diff --git a/Source/WebCore/loader/FormSubmission.cpp b/Source/WebCore/loader/FormSubmission.cpp
index e972fea03..5d40e7841 100644
--- a/Source/WebCore/loader/FormSubmission.cpp
+++ b/Source/WebCore/loader/FormSubmission.cpp
@@ -67,13 +67,13 @@ static void appendMailtoPostFormDataToURL(KURL& url, const FormData& data, const
 
     if (equalIgnoringCase(encodingType, "text/plain")) {
         // Convention seems to be to decode, and s/&/\r\n/. Also, spaces are encoded as %20.
-        body = decodeURLEscapeSequences(body.replace('&', "\r\n").replace('+', ' ') + "\r\n");
+        body = decodeURLEscapeSequences(body.replaceWithLiteral('&', "\r\n").replace('+', ' ') + "\r\n");
     }
 
     Vector<char> bodyData;
     bodyData.append("body=", 5);
     FormDataBuilder::encodeStringAsFormData(bodyData, body.utf8());
-    body = String(bodyData.data(), bodyData.size()).replace('+', "%20");
+    body = String(bodyData.data(), bodyData.size()).replaceWithLiteral('+', "%20");
 
     String query = url.query();
     if (!query.isEmpty())
@@ -245,9 +245,9 @@ void FormSubmission::populateFrameLoadRequest(FrameLoadRequest& frameRequest)
         frameRequest.resourceRequest().setHTTPBody(m_formData);
 
         // construct some user headers if necessary
-        if (m_contentType.isNull() || m_contentType == "application/x-www-form-urlencoded")
+        if (m_boundary.isEmpty())
             frameRequest.resourceRequest().setHTTPContentType(m_contentType);
-        else // contentType must be "multipart/form-data"
+        else
             frameRequest.resourceRequest().setHTTPContentType(m_contentType + "; boundary=" + m_boundary);
     }
 
diff --git a/Source/WebCore/loader/FrameLoader.cpp b/Source/WebCore/loader/FrameLoader.cpp
index 9c3966cab..c1da44547 100644
--- a/Source/WebCore/loader/FrameLoader.cpp
+++ b/Source/WebCore/loader/FrameLoader.cpp
@@ -660,13 +660,21 @@ void FrameLoader::didBeginDocument(bool dispatch)
         if (!dnsPrefetchControl.isEmpty())
             m_frame->document()->parseDNSPrefetchControlHeader(dnsPrefetchControl);
 
-        String contentSecurityPolicy = m_documentLoader->response().httpHeaderField("X-WebKit-CSP");
-        if (!contentSecurityPolicy.isEmpty())
-            m_frame->document()->contentSecurityPolicy()->didReceiveHeader(contentSecurityPolicy, ContentSecurityPolicy::EnforcePolicy);
+        String policyValue = m_documentLoader->response().httpHeaderField("Content-Security-Policy");
+        if (!policyValue.isEmpty())
+            m_frame->document()->contentSecurityPolicy()->didReceiveHeader(policyValue, ContentSecurityPolicy::EnforceStableDirectives);
 
-        String reportOnlyContentSecurityPolicy = m_documentLoader->response().httpHeaderField("X-WebKit-CSP-Report-Only");
-        if (!reportOnlyContentSecurityPolicy.isEmpty())
-            m_frame->document()->contentSecurityPolicy()->didReceiveHeader(reportOnlyContentSecurityPolicy, ContentSecurityPolicy::ReportOnly);
+        policyValue = m_documentLoader->response().httpHeaderField("Content-Security-Policy-Report-Only");
+        if (!policyValue.isEmpty())
+            m_frame->document()->contentSecurityPolicy()->didReceiveHeader(policyValue, ContentSecurityPolicy::ReportStableDirectives);
+
+        policyValue = m_documentLoader->response().httpHeaderField("X-WebKit-CSP");
+        if (!policyValue.isEmpty())
+            m_frame->document()->contentSecurityPolicy()->didReceiveHeader(policyValue, ContentSecurityPolicy::EnforceAllDirectives);
+
+        policyValue = m_documentLoader->response().httpHeaderField("X-WebKit-CSP-Report-Only");
+        if (!policyValue.isEmpty())
+            m_frame->document()->contentSecurityPolicy()->didReceiveHeader(policyValue, ContentSecurityPolicy::ReportAllDirectives);
 
         String headerContentLanguage = m_documentLoader->response().httpHeaderField("Content-Language");
         if (!headerContentLanguage.isEmpty()) {
@@ -1392,7 +1400,7 @@ void FrameLoader::reportLocalLoadFailed(Frame* frame, const String& url)
     if (!frame)
         return;
 
-    frame->document()->domWindow()->console()->addMessage(JSMessageSource, LogMessageType, ErrorMessageLevel, "Not allowed to load local resource: " + url);
+    frame->document()->addConsoleMessage(JSMessageSource, LogMessageType, ErrorMessageLevel, "Not allowed to load local resource: " + url);
 }
 
 const ResourceRequest& FrameLoader::initialRequest() const
@@ -3283,6 +3291,11 @@ Frame* createWindow(Frame* openerFrame, Frame* lookupFrame, const FrameLoadReque
     requestWithReferrer.resourceRequest().setHTTPReferrer(openerFrame->loader()->outgoingReferrer());
     FrameLoader::addHTTPOriginIfNeeded(requestWithReferrer.resourceRequest(), openerFrame->loader()->outgoingOrigin());
 
+    if (openerFrame->settings() && !openerFrame->settings()->supportsMultipleWindows()) {
+        created = false;
+        return openerFrame;
+    }
+
     Page* oldPage = openerFrame->page();
     if (!oldPage)
         return 0;
diff --git a/Source/WebCore/loader/FrameLoaderClient.h b/Source/WebCore/loader/FrameLoaderClient.h
index 4f2388af5..b4abf88f3 100644
--- a/Source/WebCore/loader/FrameLoaderClient.h
+++ b/Source/WebCore/loader/FrameLoaderClient.h
@@ -349,6 +349,10 @@ namespace WebCore {
 #if ENABLE(MEDIA_STREAM)
         virtual void dispatchWillStartUsingPeerConnectionHandler(RTCPeerConnectionHandler*) { }
 #endif
+
+#if ENABLE(REQUEST_AUTOCOMPLETE)
+        virtual void didRequestAutocomplete(PassRefPtr<FormState>) = 0;
+#endif
     };
 
 } // namespace WebCore
diff --git a/Source/WebKit2/UIProcess/API/efl/ewk_view_find_client_private.h b/Source/WebCore/loader/LoaderStrategy.cpp
index c17143360..1406eaa1d 100644
--- a/Source/WebKit2/UIProcess/API/efl/ewk_view_find_client_private.h
+++ b/Source/WebCore/loader/LoaderStrategy.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2012 Samsung Electronics. All rights reserved.
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -23,12 +23,20 @@
  * THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef ewk_view_find_client_private_h
-#define ewk_view_find_client_private_h
+#include "config.h"
+#include "LoaderStrategy.h"
 
-#include <Evas.h>
-#include <WebKit2/WKBase.h>
+#include "ResourceLoadScheduler.h"
 
-void ewk_view_find_client_attach(WKPageRef pageRef, Evas_Object* ewkView);
+#if USE(PLATFORM_STRATEGIES)
 
-#endif // ewk_view_find_client_private_h
+namespace WebCore {
+
+ResourceLoadScheduler* LoaderStrategy::resourceLoadScheduler()
+{
+    return WebCore::resourceLoadScheduler();
+}
+
+} // namespace WebCore
+
+#endif // USE(PLATFORM_STRATEGIES)
diff --git a/Source/WebCore/loader/LoaderStrategy.h b/Source/WebCore/loader/LoaderStrategy.h
new file mode 100644
index 000000000..e87c76703
--- /dev/null
+++ b/Source/WebCore/loader/LoaderStrategy.h
@@ -0,0 +1,49 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef LoaderStrategy_h
+#define LoaderStrategy_h
+
+#if USE(PLATFORM_STRATEGIES)
+
+namespace WebCore {
+
+class ResourceLoadScheduler;
+
+class LoaderStrategy {
+public:
+    virtual ResourceLoadScheduler* resourceLoadScheduler();
+
+protected:
+    virtual ~LoaderStrategy()
+    {
+    }
+};
+
+} // namespace WebCore
+
+#endif // USE(PLATFORM_STRATEGIES)
+
+#endif // LoaderStrategy_h
diff --git a/Source/WebCore/loader/MainResourceLoader.cpp b/Source/WebCore/loader/MainResourceLoader.cpp
index 485aaa2c1..334d64895 100644
--- a/Source/WebCore/loader/MainResourceLoader.cpp
+++ b/Source/WebCore/loader/MainResourceLoader.cpp
@@ -44,7 +44,9 @@
 #include "HTMLFormElement.h"
 #include "HistoryItem.h"
 #include "InspectorInstrumentation.h"
+#include "LoaderStrategy.h"
 #include "Page.h"
+#include "PlatformStrategies.h"
 #include "ResourceError.h"
 #include "ResourceHandle.h"
 #include "ResourceLoadScheduler.h"
@@ -371,8 +373,8 @@ void MainResourceLoader::didReceiveResponse(const ResourceResponse& r)
         String content = it->value;
         if (m_frame->loader()->shouldInterruptLoadForXFrameOptions(content, r.url())) {
             InspectorInstrumentation::continueAfterXFrameOptionsDenied(m_frame.get(), documentLoader(), identifier(), r);
-            DEFINE_STATIC_LOCAL(String, consoleMessage, (ASCIILiteral("Refused to display document because display forbidden by X-Frame-Options.\n")));
-            m_frame->document()->domWindow()->console()->addMessage(JSMessageSource, LogMessageType, ErrorMessageLevel, consoleMessage);
+            String message = "Refused to display '" + r.url().string() + "' in a frame because it set 'X-Frame-Options' to '" + content + "'.";
+            m_frame->document()->addConsoleMessage(JSMessageSource, LogMessageType, ErrorMessageLevel, message, r.url().string(), 0, 0, identifier());
 
             cancel();
             return;
@@ -630,8 +632,13 @@ bool MainResourceLoader::loadNow(ResourceRequest& r)
     if (shouldLoadEmptyBeforeRedirect && !shouldLoadEmpty && defersLoading())
         return true;
 
+#if USE(PLATFORM_STRATEGIES)
+    platformStrategies()->loaderStrategy()->resourceLoadScheduler()->addMainResourceLoad(this);
+#else
     resourceLoadScheduler()->addMainResourceLoad(this);
-    if (m_substituteData.isValid()) 
+#endif
+
+    if (m_substituteData.isValid())
         handleSubstituteDataLoadSoon(r);
     else if (shouldLoadEmpty || frameLoader()->client()->representationExistsForURLScheme(url.protocol()))
         handleEmptyLoad(url, !shouldLoadEmpty);
diff --git a/Source/WebCore/loader/MixedContentChecker.cpp b/Source/WebCore/loader/MixedContentChecker.cpp
index 71fd2b36e..3818d5fb0 100644
--- a/Source/WebCore/loader/MixedContentChecker.cpp
+++ b/Source/WebCore/loader/MixedContentChecker.cpp
@@ -57,6 +57,7 @@ static inline CString asUTF8(const KURL& url)
     return url.string().utf8();
 }
 
+// static
 bool MixedContentChecker::isMixedContent(SecurityOrigin* securityOrigin, const KURL& url)
 {
     if (securityOrigin->protocol() != "https")
@@ -98,11 +99,10 @@ bool MixedContentChecker::canRunInsecureContent(SecurityOrigin* securityOrigin,
 
 void MixedContentChecker::logWarning(bool allowed, const String& action, const KURL& target) const
 {
-    Console* console = m_frame->document()->domWindow()->console();
     // FIXME: Why does this message not have a source URL or a line number? webkit.org/b/97979
     String message = String::format("%sThe page at %s %s insecure content from %s.\n",
         (allowed ? "" : "[blocked] "), asUTF8(m_frame->document()->url()).data(), action.utf8().data(), asUTF8(target).data());
-    console->addMessage(HTMLMessageSource, LogMessageType, WarningMessageLevel, message);
+    m_frame->document()->addConsoleMessage(HTMLMessageSource, LogMessageType, WarningMessageLevel, message);
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/loader/MixedContentChecker.h b/Source/WebCore/loader/MixedContentChecker.h
index ee7daf619..89e3bef25 100644
--- a/Source/WebCore/loader/MixedContentChecker.h
+++ b/Source/WebCore/loader/MixedContentChecker.h
@@ -47,12 +47,12 @@ public:
 
     bool canDisplayInsecureContent(SecurityOrigin*, const KURL&) const;
     bool canRunInsecureContent(SecurityOrigin*, const KURL&) const;
+    static bool isMixedContent(SecurityOrigin*, const KURL&);
 
 private:
     // FIXME: This should probably have a separate client from FrameLoader.
     FrameLoaderClient* client() const;
 
-    static bool isMixedContent(SecurityOrigin*, const KURL&);
     void logWarning(bool allowed, const String& action, const KURL&) const;
 
     Frame* m_frame;
diff --git a/Source/WebCore/loader/PingLoader.cpp b/Source/WebCore/loader/PingLoader.cpp
index 38b73497b..544202718 100644
--- a/Source/WebCore/loader/PingLoader.cpp
+++ b/Source/WebCore/loader/PingLoader.cpp
@@ -103,7 +103,7 @@ void PingLoader::sendPing(Frame* frame, const KURL& pingURL, const KURL& destina
     UNUSED_PARAM(leakedPingLoader);
 }
 
-void PingLoader::reportContentSecurityPolicyViolation(Frame* frame, const KURL& reportURL, PassRefPtr<FormData> report)
+void PingLoader::sendViolationReport(Frame* frame, const KURL& reportURL, PassRefPtr<FormData> report)
 {
     ResourceRequest request(reportURL);
 #if PLATFORM(CHROMIUM) || PLATFORM(BLACKBERRY)
diff --git a/Source/WebCore/loader/PingLoader.h b/Source/WebCore/loader/PingLoader.h
index efdf29ea3..acd14d123 100644
--- a/Source/WebCore/loader/PingLoader.h
+++ b/Source/WebCore/loader/PingLoader.h
@@ -56,7 +56,7 @@ class PingLoader : private ResourceHandleClient {
 public:
     static void loadImage(Frame*, const KURL& url);
     static void sendPing(Frame*, const KURL& pingURL, const KURL& destinationURL);
-    static void reportContentSecurityPolicyViolation(Frame*, const KURL& reportURL, PassRefPtr<FormData> report);
+    static void sendViolationReport(Frame*, const KURL& reportURL, PassRefPtr<FormData> report);
 
     ~PingLoader();
 
diff --git a/Source/WebCore/loader/ResourceBuffer.cpp b/Source/WebCore/loader/ResourceBuffer.cpp
index 73bdac72c..d5791431c 100644
--- a/Source/WebCore/loader/ResourceBuffer.cpp
+++ b/Source/WebCore/loader/ResourceBuffer.cpp
@@ -27,6 +27,7 @@
 #include "ResourceBuffer.h"
 
 #include "PurgeableBuffer.h"
+#include "WebCoreMemoryInstrumentation.h"
 
 namespace WebCore {
 
@@ -111,4 +112,17 @@ CFDataRef ResourceBuffer::createCFData()
 }
 #endif
 
+#if HAVE(NETWORK_CFDATA_ARRAY_CALLBACK)
+void ResourceBuffer::append(CFDataRef dataRef)
+{
+    m_sharedBuffer->append(dataRef);
+}
+#endif
+
+void ResourceBuffer::reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
+{
+    MemoryClassInfo info(memoryObjectInfo, this);
+    info.addMember(m_sharedBuffer);
+}
+
 } // namespace WebCore
diff --git a/Source/WebCore/loader/ResourceBuffer.h b/Source/WebCore/loader/ResourceBuffer.h
index 0d4a012f9..6dc2dc7fc 100644
--- a/Source/WebCore/loader/ResourceBuffer.h
+++ b/Source/WebCore/loader/ResourceBuffer.h
@@ -73,6 +73,11 @@ public:
 #if USE(CF)
     CFDataRef createCFData();
 #endif
+#if HAVE(NETWORK_CFDATA_ARRAY_CALLBACK)
+    void append(CFDataRef);
+#endif
+
+    void reportMemoryUsage(MemoryObjectInfo*) const;
 
 private:
     ResourceBuffer();
diff --git a/Source/WebCore/loader/ResourceLoadScheduler.cpp b/Source/WebCore/loader/ResourceLoadScheduler.cpp
index 7b1dade3b..f18d91352 100644
--- a/Source/WebCore/loader/ResourceLoadScheduler.cpp
+++ b/Source/WebCore/loader/ResourceLoadScheduler.cpp
@@ -31,12 +31,15 @@
 #include "FrameLoader.h"
 #include "InspectorInstrumentation.h"
 #include "KURL.h"
+#include "LoaderStrategy.h"
 #include "Logging.h"
 #include "NetscapePlugInStreamLoader.h"
+#include "PlatformStrategies.h"
 #include "ResourceLoader.h"
 #include "ResourceRequest.h"
 #include "SubresourceLoader.h"
 #include <wtf/MainThread.h>
+#include <wtf/TemporaryChange.h>
 #include <wtf/text/CString.h>
 
 #if PLATFORM(CHROMIUM)
@@ -74,8 +77,28 @@ ResourceLoadScheduler::HostInformation* ResourceLoadScheduler::hostForURL(const
 ResourceLoadScheduler* resourceLoadScheduler()
 {
     ASSERT(isMainThread());
-    DEFINE_STATIC_LOCAL(ResourceLoadScheduler, resourceLoadScheduler, ());
-    return &resourceLoadScheduler;
+    static ResourceLoadScheduler* globalScheduler = 0;
+    
+    if (!globalScheduler) {
+#if USE(PLATFORM_STRATEGIES)
+        static bool isCallingOutToStrategy = false;
+        
+        // If we're re-entering resourceLoadScheduler() while calling out to the LoaderStrategy,
+        // then the LoaderStrategy is trying to use the default resourceLoadScheduler.
+        // So we'll create it here and start using it.
+        if (isCallingOutToStrategy) {
+            globalScheduler = new ResourceLoadScheduler;
+            return globalScheduler;
+        }
+        
+        TemporaryChange<bool> recursionGuard(isCallingOutToStrategy, true);
+        globalScheduler = platformStrategies()->loaderStrategy()->resourceLoadScheduler();
+#else
+        globalScheduler = new ResourceLoadScheduler;
+#endif
+    }
+
+    return globalScheduler;
 }
 
 ResourceLoadScheduler::ResourceLoadScheduler()
@@ -89,6 +112,10 @@ ResourceLoadScheduler::ResourceLoadScheduler()
 #endif
 }
 
+ResourceLoadScheduler::~ResourceLoadScheduler()
+{
+}
+
 PassRefPtr<SubresourceLoader> ResourceLoadScheduler::scheduleSubresourceLoad(Frame* frame, CachedResource* resource, const ResourceRequest& request, ResourceLoadPriority priority, const ResourceLoaderOptions& options)
 {
     RefPtr<SubresourceLoader> loader = SubresourceLoader::create(frame, resource, request, options);
@@ -136,11 +163,18 @@ void ResourceLoadScheduler::scheduleLoad(ResourceLoader* resourceLoader, Resourc
         return;
     }
 
-    // Handle asynchronously so early low priority requests don't get scheduled before later high priority ones.
-    InspectorInstrumentation::didScheduleResourceRequest(resourceLoader->frameLoader() ? resourceLoader->frameLoader()->frame()->document() : 0, resourceLoader->url());
+    notifyDidScheduleResourceRequest(resourceLoader);
+
+    // Handle asynchronously so early low priority requests don't
+    // get scheduled before later high priority ones.
     scheduleServePendingRequests();
 }
 
+void ResourceLoadScheduler::notifyDidScheduleResourceRequest(ResourceLoader* loader)
+{
+    InspectorInstrumentation::didScheduleResourceRequest(loader->frameLoader() ? loader->frameLoader()->frame()->document() : 0, loader->url());
+}
+
 void ResourceLoadScheduler::remove(ResourceLoader* resourceLoader)
 {
     ASSERT(resourceLoader);
@@ -303,4 +337,10 @@ bool ResourceLoadScheduler::HostInformation::limitRequests(ResourceLoadPriority
     return m_requestsLoading.size() >= (resourceLoadScheduler()->isSerialLoadingEnabled() ? 1 : m_maxRequestsInFlight);
 }
 
+void ResourceLoadScheduler::startResourceLoader(ResourceLoader* loader)
+{
+    ASSERT(loader);
+    loader->start();
+}
+
 } // namespace WebCore
diff --git a/Source/WebCore/loader/ResourceLoadScheduler.h b/Source/WebCore/loader/ResourceLoadScheduler.h
index 9b6a5a398..20e5aa7d6 100644
--- a/Source/WebCore/loader/ResourceLoadScheduler.h
+++ b/Source/WebCore/loader/ResourceLoadScheduler.h
@@ -50,28 +50,33 @@ class ResourceLoadScheduler {
 public:
     friend ResourceLoadScheduler* resourceLoadScheduler();
 
-    PassRefPtr<SubresourceLoader> scheduleSubresourceLoad(Frame*, CachedResource*, const ResourceRequest&, ResourceLoadPriority, const ResourceLoaderOptions&);
-    PassRefPtr<NetscapePlugInStreamLoader> schedulePluginStreamLoad(Frame*, NetscapePlugInStreamLoaderClient*, const ResourceRequest&);
-    void addMainResourceLoad(ResourceLoader*);
-    void remove(ResourceLoader*);
-    void crossOriginRedirectReceived(ResourceLoader*, const KURL& redirectURL);
+    virtual PassRefPtr<SubresourceLoader> scheduleSubresourceLoad(Frame*, CachedResource*, const ResourceRequest&, ResourceLoadPriority, const ResourceLoaderOptions&);
+    virtual PassRefPtr<NetscapePlugInStreamLoader> schedulePluginStreamLoad(Frame*, NetscapePlugInStreamLoaderClient*, const ResourceRequest&);
+    virtual void addMainResourceLoad(ResourceLoader*);
+    virtual void remove(ResourceLoader*);
+    virtual void crossOriginRedirectReceived(ResourceLoader*, const KURL& redirectURL);
     
-    void servePendingRequests(ResourceLoadPriority minimumPriority = ResourceLoadPriorityVeryLow);
-    bool isSuspendingPendingRequests() const { return !!m_suspendPendingRequestsCount; }
-    void suspendPendingRequests();
-    void resumePendingRequests();
+    virtual void servePendingRequests(ResourceLoadPriority minimumPriority = ResourceLoadPriorityVeryLow);
+    virtual void suspendPendingRequests();
+    virtual void resumePendingRequests();
     
     bool isSerialLoadingEnabled() const { return m_isSerialLoadingEnabled; }
-    void setSerialLoadingEnabled(bool b) { m_isSerialLoadingEnabled = b; }
+    virtual void setSerialLoadingEnabled(bool b) { m_isSerialLoadingEnabled = b; }
 
-private:
+protected:
     ResourceLoadScheduler();
-    ~ResourceLoadScheduler();
+    virtual ~ResourceLoadScheduler();
+
+    void startResourceLoader(ResourceLoader*);
+    void notifyDidScheduleResourceRequest(ResourceLoader*);
 
+private:
     void scheduleLoad(ResourceLoader*, ResourceLoadPriority);
     void scheduleServePendingRequests();
     void requestTimerFired(Timer<ResourceLoadScheduler>*);
 
+    bool isSuspendingPendingRequests() const { return !!m_suspendPendingRequestsCount; }
+
     class HostInformation {
         WTF_MAKE_NONCOPYABLE(HostInformation); WTF_MAKE_FAST_ALLOCATED;
     public:
diff --git a/Source/WebCore/loader/ResourceLoader.cpp b/Source/WebCore/loader/ResourceLoader.cpp
index 7752579ce..5cc36bfdb 100644
--- a/Source/WebCore/loader/ResourceLoader.cpp
+++ b/Source/WebCore/loader/ResourceLoader.cpp
@@ -37,7 +37,9 @@
 #include "FrameLoader.h"
 #include "FrameLoaderClient.h"
 #include "InspectorInstrumentation.h"
+#include "LoaderStrategy.h"
 #include "Page.h"
+#include "PlatformStrategies.h"
 #include "ProgressTracker.h"
 #include "ResourceBuffer.h"
 #include "ResourceError.h"
@@ -89,9 +91,13 @@ void ResourceLoader::releaseResources()
     // the resources to prevent a double dealloc of WebView <rdar://problem/4372628>
     m_reachedTerminalState = true;
 
+#if USE(PLATFORM_STRATEGIES)
+    platformStrategies()->loaderStrategy()->resourceLoadScheduler()->remove(this);
+#endif
     m_identifier = 0;
-
+#if !USE(PLATFORM_STRATEGIES)
     resourceLoadScheduler()->remove(this);
+#endif
 
     if (m_handle) {
         // Clear out the ResourceHandle's client so that it doesn't try to call
@@ -237,8 +243,13 @@ void ResourceLoader::willSendRequest(ResourceRequest& request, const ResourceRes
         frameLoader()->notifier()->willSendRequest(this, request, redirectResponse);
     }
 
-    if (!redirectResponse.isNull())
+    if (!redirectResponse.isNull()) {
+#if USE(PLATFORM_STRATEGIES)
+        platformStrategies()->loaderStrategy()->resourceLoadScheduler()->crossOriginRedirectReceived(this, request.url());
+#else
         resourceLoadScheduler()->crossOriginRedirectReceived(this, request.url());
+#endif
+    }
     m_request = request;
 }
 
@@ -483,7 +494,7 @@ void ResourceLoader::didReceiveAuthenticationChallenge(const AuthenticationChall
     }
     // Only these platforms provide a way to continue without credentials.
     // If we can't continue with credentials, we need to cancel the load altogether.
-#if PLATFORM(MAC) || USE(CFNETWORK) || USE(CURL)
+#if PLATFORM(MAC) || USE(CFNETWORK) || USE(CURL) || PLATFORM(GTK) || PLATFORM(EFL)
     handle()->receivedRequestToContinueWithoutCredential(challenge);
     ASSERT(!handle()->hasAuthenticationChallenge());
 #else
@@ -547,4 +558,14 @@ void ResourceLoader::reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
     info.addMember(m_options);
 }
 
+#if PLATFORM(MAC)
+void ResourceLoader::setIdentifier(unsigned long identifier)
+{
+    // FIXME (NetworkProcess): This is temporary to allow WebKit to directly set the identifier on a ResourceLoader.
+    // More permanently we'll want the identifier to be piped through ResourceLoader::init/start so
+    // it always has it, especially in willSendRequest.
+    m_identifier = identifier;
+}
+#endif
+
 }
diff --git a/Source/WebCore/loader/ResourceLoader.h b/Source/WebCore/loader/ResourceLoader.h
index ea83121f9..54f4d6057 100644
--- a/Source/WebCore/loader/ResourceLoader.h
+++ b/Source/WebCore/loader/ResourceLoader.h
@@ -84,7 +84,7 @@ public:
     void willStopBufferingData(const char*, int);
     virtual void didFinishLoading(double finishTime);
     virtual void didFail(const ResourceError&);
-#if HAVE(NETWORK_CFDATA_ARRAY_CALLBACK)
+#if USE(NETWORK_CFDATA_ARRAY_CALLBACK)
     virtual void didReceiveDataArray(CFArrayRef dataArray);
 #endif
 
@@ -110,7 +110,7 @@ public:
     virtual bool shouldUseCredentialStorage(ResourceHandle*) { return shouldUseCredentialStorage(); }
     virtual void didReceiveAuthenticationChallenge(ResourceHandle*, const AuthenticationChallenge& challenge) { didReceiveAuthenticationChallenge(challenge); } 
     virtual void didCancelAuthenticationChallenge(ResourceHandle*, const AuthenticationChallenge& challenge) { didCancelAuthenticationChallenge(challenge); } 
-#if HAVE(NETWORK_CFDATA_ARRAY_CALLBACK)
+#if USE(NETWORK_CFDATA_ARRAY_CALLBACK)
     virtual void didReceiveDataArray(ResourceHandle*, CFArrayRef dataArray);
 #endif
 #if USE(PROTECTION_SPACE_AUTH_CALLBACK)
@@ -143,22 +143,29 @@ public:
 
     bool reachedTerminalState() const { return m_reachedTerminalState; }
 
+    const ResourceRequest& request() const { return m_request; }
+
     void setShouldBufferData(DataBufferingPolicy);
 
     virtual void reportMemoryUsage(MemoryObjectInfo*) const;
 
+#if PLATFORM(MAC)
+    // FIXME (NetworkProcess): This is temporary to allow WebKit to directly set the identifier on a ResourceLoader.
+    // More permanently we want the identifier to be piped through ResourceLoader::init/start so
+    // it always has it, especially in willSendRequest.
+    void setIdentifier(unsigned long);
+#endif
+
 protected:
     ResourceLoader(Frame*, ResourceLoaderOptions);
 
-    friend class ApplicationCacheHost;  // for access to request()
     friend class ResourceLoadScheduler; // for access to start()
-    // start() actually sends the load to the network (unless the load is being 
+    // start() actually sends the load to the network (unless the load is being
     // deferred) and should only be called by ResourceLoadScheduler or setDefersLoading().
     void start();
-    
+
     void didFinishLoadingOnePart(double finishTime);
 
-    const ResourceRequest& request() const { return m_request; }
     bool cancelled() const { return m_cancelled; }
     bool defersLoading() const { return m_defersLoading; }
 
diff --git a/Source/WebCore/loader/SubresourceLoader.cpp b/Source/WebCore/loader/SubresourceLoader.cpp
index e57017126..e67f1027a 100644
--- a/Source/WebCore/loader/SubresourceLoader.cpp
+++ b/Source/WebCore/loader/SubresourceLoader.cpp
@@ -128,6 +128,7 @@ void SubresourceLoader::willSendRequest(ResourceRequest& newRequest, const Resou
 {
     // Store the previous URL because the call to ResourceLoader::willSendRequest will modify it.
     KURL previousURL = request().url();
+    RefPtr<SubresourceLoader> protect(this);
 
     ASSERT(!newRequest.isNull());
     if (!previousURL.isNull() && previousURL != newRequest.url()) {
@@ -146,6 +147,8 @@ void SubresourceLoader::willSendRequest(ResourceRequest& newRequest, const Resou
         return;
 
     ResourceLoader::willSendRequest(newRequest, redirectResponse);
+    if (newRequest.isNull())
+        cancel();
 }
 
 void SubresourceLoader::didSendData(unsigned long long bytesSent, unsigned long long totalBytesToBeSent)
@@ -182,7 +185,9 @@ void SubresourceLoader::didReceiveResponse(const ResourceResponse& response)
         return;
     ResourceLoader::didReceiveResponse(response);
 
-    if (response.isMultipart()) {
+    // FIXME: Main resources have a different set of rules for multipart than images do.
+    // Hopefully we can merge those 2 paths.
+    if (response.isMultipart() && m_resource->type() != CachedResource::MainResource) {
         m_loadingMultipartContent = true;
 
         // We don't count multiParts in a CachedResourceLoader's request count
@@ -283,13 +288,14 @@ void SubresourceLoader::didFail(const ResourceError& error)
     RefPtr<SubresourceLoader> protect(this);
     CachedResourceHandle<CachedResource> protectResource(m_resource);
     m_state = Finishing;
+    m_resource->setResourceError(error);
     m_resource->error(CachedResource::LoadError);
     if (!m_resource->isPreloaded())
         memoryCache()->remove(m_resource);
     ResourceLoader::didFail(error);
 }
 
-void SubresourceLoader::willCancel(const ResourceError&)
+void SubresourceLoader::willCancel(const ResourceError& error)
 {
     if (m_state != Initialized)
         return;
@@ -300,6 +306,7 @@ void SubresourceLoader::willCancel(const ResourceError&)
     m_state = Finishing;
     if (m_resource->resourceToRevalidate())
         memoryCache()->revalidationFailed(m_resource);
+    m_resource->setResourceError(error);
     memoryCache()->remove(m_resource);
 }
 
diff --git a/Source/WebCore/loader/SubresourceLoader.h b/Source/WebCore/loader/SubresourceLoader.h
index 65837415c..a0600eda2 100644
--- a/Source/WebCore/loader/SubresourceLoader.h
+++ b/Source/WebCore/loader/SubresourceLoader.h
@@ -67,7 +67,7 @@ private:
     virtual void willCancel(const ResourceError&);
     virtual void didCancel(const ResourceError&) { }
 
-#if HAVE(NETWORK_CFDATA_ARRAY_CALLBACK)
+#if USE(NETWORK_CFDATA_ARRAY_CALLBACK)
     virtual bool supportsDataArray() { return true; }
     virtual void didReceiveDataArray(CFArrayRef);
 #endif
diff --git a/Source/WebCore/loader/appcache/ApplicationCacheGroup.cpp b/Source/WebCore/loader/appcache/ApplicationCacheGroup.cpp
index 4de3a49b5..118ee1a5d 100644
--- a/Source/WebCore/loader/appcache/ApplicationCacheGroup.cpp
+++ b/Source/WebCore/loader/appcache/ApplicationCacheGroup.cpp
@@ -474,7 +474,7 @@ void ApplicationCacheGroup::abort(Frame* frame)
     if (m_completionType != None)
         return;
 
-    frame->document()->domWindow()->console()->addMessage(OtherMessageSource, LogMessageType, TipMessageLevel, "Application Cache download process was aborted.");
+    frame->document()->addConsoleMessage(OtherMessageSource, LogMessageType, TipMessageLevel, "Application Cache download process was aborted.");
     cacheUpdateFailed();
 }
 
@@ -568,7 +568,7 @@ void ApplicationCacheGroup::didReceiveResponse(ResourceHandle* handle, const Res
 
     if (response.httpStatusCode() / 100 != 2 || response.url() != m_currentHandle->firstRequest().url()) {
         if ((type & ApplicationCacheResource::Explicit) || (type & ApplicationCacheResource::Fallback)) {
-            m_frame->document()->domWindow()->console()->addMessage(OtherMessageSource, LogMessageType, ErrorMessageLevel, "Application Cache update failed, because " + m_currentHandle->firstRequest().url().string() + 
+            m_frame->document()->addConsoleMessage(OtherMessageSource, LogMessageType, ErrorMessageLevel, "Application Cache update failed, because " + m_currentHandle->firstRequest().url().string() + 
                 ((response.httpStatusCode() / 100 != 2) ? " could not be fetched." : " was redirected."));
             // Note that cacheUpdateFailed() can cause the cache group to be deleted.
             cacheUpdateFailed();
@@ -645,7 +645,7 @@ void ApplicationCacheGroup::didFinishLoading(ResourceHandle* handle, double fini
     // FIXME: Should we break earlier and prevent redownloading on later page loads?
     if (m_originQuotaExceededPreviously && m_availableSpaceInQuota < m_cacheBeingUpdated->estimatedSizeInStorage()) {
         m_currentResource = 0;
-        m_frame->document()->domWindow()->console()->addMessage(OtherMessageSource, LogMessageType, ErrorMessageLevel, "Application Cache update failed, because size quota was exceeded.");
+        m_frame->document()->addConsoleMessage(OtherMessageSource, LogMessageType, ErrorMessageLevel, "Application Cache update failed, because size quota was exceeded.");
         cacheUpdateFailed();
         return;
     }
@@ -678,7 +678,7 @@ void ApplicationCacheGroup::didFail(ResourceHandle* handle, const ResourceError&
     m_pendingEntries.remove(url);
 
     if ((type & ApplicationCacheResource::Explicit) || (type & ApplicationCacheResource::Fallback)) {
-        m_frame->document()->domWindow()->console()->addMessage(OtherMessageSource, LogMessageType, ErrorMessageLevel, "Application Cache update failed, because " + url.string() + " could not be fetched.");
+        m_frame->document()->addConsoleMessage(OtherMessageSource, LogMessageType, ErrorMessageLevel, "Application Cache update failed, because " + url.string() + " could not be fetched.");
         // Note that cacheUpdateFailed() can cause the cache group to be deleted.
         cacheUpdateFailed();
     } else {
@@ -707,13 +707,13 @@ void ApplicationCacheGroup::didReceiveManifestResponse(const ResourceResponse& r
         return;
 
     if (response.httpStatusCode() / 100 != 2) {
-        m_frame->document()->domWindow()->console()->addMessage(OtherMessageSource, LogMessageType, ErrorMessageLevel, "Application Cache manifest could not be fetched.");
+        m_frame->document()->addConsoleMessage(OtherMessageSource, LogMessageType, ErrorMessageLevel, "Application Cache manifest could not be fetched.");
         cacheUpdateFailed();
         return;
     }
 
     if (response.url() != m_manifestHandle->firstRequest().url()) {
-        m_frame->document()->domWindow()->console()->addMessage(OtherMessageSource, LogMessageType, ErrorMessageLevel, "Application Cache manifest could not be fetched, because a redirection was attempted.");
+        m_frame->document()->addConsoleMessage(OtherMessageSource, LogMessageType, ErrorMessageLevel, "Application Cache manifest could not be fetched, because a redirection was attempted.");
         cacheUpdateFailed();
         return;
     }
@@ -733,7 +733,7 @@ void ApplicationCacheGroup::didFinishLoadingManifest()
 
     if (!isUpgradeAttempt && !m_manifestResource) {
         // The server returned 304 Not Modified even though we didn't send a conditional request.
-        m_frame->document()->domWindow()->console()->addMessage(OtherMessageSource, LogMessageType, ErrorMessageLevel, "Application Cache manifest could not be fetched because of an unexpected 304 Not Modified server response.");
+        m_frame->document()->addConsoleMessage(OtherMessageSource, LogMessageType, ErrorMessageLevel, "Application Cache manifest could not be fetched because of an unexpected 304 Not Modified server response.");
         cacheUpdateFailed();
         return;
     }
@@ -759,7 +759,7 @@ void ApplicationCacheGroup::didFinishLoadingManifest()
     Manifest manifest;
     if (!parseManifest(m_manifestURL, m_manifestResource->data()->data(), m_manifestResource->data()->size(), manifest)) {
         // At the time of this writing, lack of "CACHE MANIFEST" signature is the only reason for parseManifest to fail.
-        m_frame->document()->domWindow()->console()->addMessage(OtherMessageSource, LogMessageType, ErrorMessageLevel, "Application Cache manifest could not be parsed. Does it start with CACHE MANIFEST?");
+        m_frame->document()->addConsoleMessage(OtherMessageSource, LogMessageType, ErrorMessageLevel, "Application Cache manifest could not be parsed. Does it start with CACHE MANIFEST?");
         cacheUpdateFailed();
         return;
     }
@@ -948,7 +948,7 @@ void ApplicationCacheGroup::checkIfLoadIsComplete()
                 // We ran out of space for this origin. Fall down to the normal error handling
                 // after recording this state.
                 m_originQuotaExceededPreviously = true;
-                m_frame->document()->domWindow()->console()->addMessage(OtherMessageSource, LogMessageType, ErrorMessageLevel, "Application Cache update failed, because size quota was exceeded.");
+                m_frame->document()->addConsoleMessage(OtherMessageSource, LogMessageType, ErrorMessageLevel, "Application Cache update failed, because size quota was exceeded.");
             }
 
             if (failureReason == ApplicationCacheStorage::TotalQuotaReached && !m_calledReachedMaxAppCacheSize) {
diff --git a/Source/WebCore/loader/archive/cf/LegacyWebArchive.cpp b/Source/WebCore/loader/archive/cf/LegacyWebArchive.cpp
index 3576d64df..d77f874b0 100644
--- a/Source/WebCore/loader/archive/cf/LegacyWebArchive.cpp
+++ b/Source/WebCore/loader/archive/cf/LegacyWebArchive.cpp
@@ -91,8 +91,7 @@ RetainPtr<CFDictionaryRef> LegacyWebArchive::createPropertyListRepresentation(Ar
     CFDictionarySetValue(propertyList.get(), LegacyWebArchiveResourceDataKey, cfData.get());
     
     // Resource URL cannot be null
-    RetainPtr<CFStringRef> cfURL(AdoptCF, resource->url().string().createCFString());
-    if (cfURL)
+    if (RetainPtr<CFStringRef> cfURL = resource->url().string().createCFString())
         CFDictionarySetValue(propertyList.get(), LegacyWebArchiveResourceURLKey, cfURL.get());
     else {
         LOG(Archives, "LegacyWebArchive - NULL resource URL is invalid - returning null property list");
@@ -101,23 +100,17 @@ RetainPtr<CFDictionaryRef> LegacyWebArchive::createPropertyListRepresentation(Ar
 
     // FrameName should be left out if empty for subresources, but always included for main resources
     const String& frameName(resource->frameName());
-    if (!frameName.isEmpty() || isMainResource) {
-        RetainPtr<CFStringRef> cfFrameName(AdoptCF, frameName.createCFString());
-        CFDictionarySetValue(propertyList.get(), LegacyWebArchiveResourceFrameNameKey, cfFrameName.get());
-    }
+    if (!frameName.isEmpty() || isMainResource)
+        CFDictionarySetValue(propertyList.get(), LegacyWebArchiveResourceFrameNameKey, frameName.createCFString().get());
     
     // Set MIMEType, TextEncodingName, and ResourceResponse only if they actually exist
     const String& mimeType(resource->mimeType());
-    if (!mimeType.isEmpty()) {
-        RetainPtr<CFStringRef> cfMIMEType(AdoptCF, mimeType.createCFString());
-        CFDictionarySetValue(propertyList.get(), LegacyWebArchiveResourceMIMETypeKey, cfMIMEType.get());
-    }
+    if (!mimeType.isEmpty())
+        CFDictionarySetValue(propertyList.get(), LegacyWebArchiveResourceMIMETypeKey, mimeType.createCFString().get());
     
     const String& textEncoding(resource->textEncoding());
-    if (!textEncoding.isEmpty()) {
-        RetainPtr<CFStringRef> cfTextEncoding(AdoptCF, textEncoding.createCFString());
-        CFDictionarySetValue(propertyList.get(), LegacyWebArchiveResourceTextEncodingNameKey, cfTextEncoding.get());
-    }
+    if (!textEncoding.isEmpty())
+        CFDictionarySetValue(propertyList.get(), LegacyWebArchiveResourceTextEncodingNameKey, textEncoding.createCFString().get());
 
     // Don't include the resource response for the main resource
     if (!isMainResource) {
diff --git a/Source/WebCore/loader/cache/CachedImage.cpp b/Source/WebCore/loader/cache/CachedImage.cpp
index 2bec9f166..35a6c520a 100644
--- a/Source/WebCore/loader/cache/CachedImage.cpp
+++ b/Source/WebCore/loader/cache/CachedImage.cpp
@@ -226,14 +226,14 @@ bool CachedImage::imageHasRelativeHeight() const
     return false;
 }
 
-IntSize CachedImage::imageSizeForRenderer(const RenderObject* renderer, float multiplier)
+LayoutSize CachedImage::imageSizeForRenderer(const RenderObject* renderer, float multiplier)
 {
     ASSERT(!isPurgeable());
 
     if (!m_image)
         return IntSize();
 
-    IntSize imageSize;
+    LayoutSize imageSize;
 
     if (m_image->isBitmapImage() && (renderer && renderer->shouldRespectImageOrientation() == RespectImageOrientation))
         imageSize = static_cast<BitmapImage*>(m_image.get())->sizeRespectingOrientation();
@@ -262,14 +262,10 @@ IntSize CachedImage::imageSizeForRenderer(const RenderObject* renderer, float mu
     // Don't let images that have a width/height >= 1 shrink below 1 when zoomed.
     float widthScale = m_image->hasRelativeWidth() ? 1.0f : multiplier;
     float heightScale = m_image->hasRelativeHeight() ? 1.0f : multiplier;
-    IntSize minimumSize(imageSize.width() > 0 ? 1 : 0, imageSize.height() > 0 ? 1 : 0);
-#if ENABLE(SUBPIXEL_LAYOUT)
-    imageSize.setWidth(lroundf(imageSize.width() * widthScale));
-    imageSize.setHeight(lroundf(imageSize.height() * heightScale));
-#else
+    LayoutSize minimumSize(imageSize.width() > 0 ? 1 : 0, imageSize.height() > 0 ? 1 : 0);
     imageSize.scale(widthScale, heightScale);
-#endif
     imageSize.clampToMinimumSize(minimumSize);
+    ASSERT(multiplier != 1.0f || (imageSize.width().fraction() == 0.0f && imageSize.height().fraction() == 0.0f));
     return imageSize;
 }
 
diff --git a/Source/WebCore/loader/cache/CachedImage.h b/Source/WebCore/loader/cache/CachedImage.h
index 3c189b303..ad1c80208 100644
--- a/Source/WebCore/loader/cache/CachedImage.h
+++ b/Source/WebCore/loader/cache/CachedImage.h
@@ -24,9 +24,10 @@
 #define CachedImage_h
 
 #include "CachedResource.h"
-#include "SVGImageCache.h"
 #include "ImageObserver.h"
 #include "IntRect.h"
+#include "LayoutTypesInlineMethods.h"
+#include "SVGImageCache.h"
 #include <wtf/Vector.h>
 
 namespace WebCore {
@@ -63,7 +64,7 @@ public:
     bool imageHasRelativeHeight() const;
     
     // This method takes a zoom multiplier that can be used to increase the natural size of the image by the zoom.
-    IntSize imageSizeForRenderer(const RenderObject*, float multiplier); // returns the size of the complete image.
+    LayoutSize imageSizeForRenderer(const RenderObject*, float multiplier); // returns the size of the complete image.
     void computeIntrinsicDimensions(Length& intrinsicWidth, Length& intrinsicHeight, FloatSize& intrinsicRatio);
 
     virtual void didAddClient(CachedResourceClient*);
diff --git a/Source/WebCore/loader/cache/CachedRawResource.cpp b/Source/WebCore/loader/cache/CachedRawResource.cpp
index 194b15f89..b0d8c9641 100644
--- a/Source/WebCore/loader/cache/CachedRawResource.cpp
+++ b/Source/WebCore/loader/cache/CachedRawResource.cpp
@@ -36,8 +36,8 @@
 
 namespace WebCore {
 
-CachedRawResource::CachedRawResource(ResourceRequest& resourceRequest)
-    : CachedResource(resourceRequest, RawResource)
+CachedRawResource::CachedRawResource(ResourceRequest& resourceRequest, Type type)
+    : CachedResource(resourceRequest, type)
     , m_identifier(0)
 {
 }
@@ -129,6 +129,11 @@ void CachedRawResource::setDefersLoading(bool defers)
         m_loader->setDefersLoading(defers);
 }
 
+void CachedRawResource::setShouldBufferData(DataBufferingPolicy shouldBufferData)
+{
+    m_options.shouldBufferData = shouldBufferData;
+}
+
 static bool shouldIgnoreHeaderForCacheReuse(AtomicString headerName)
 {
     // FIXME: This list of headers that don't affect cache policy almost certainly isn't complete.
@@ -184,6 +189,19 @@ bool CachedRawResource::canReuse(const ResourceRequest& newRequest) const
     return true;
 }
 
+SubresourceLoader* CachedRawResource::loader() const
+{
+    return m_loader.get();
+}
+
+void CachedRawResource::clear()
+{
+    m_data.clear();
+    setEncodedSize(0);
+    if (m_loader)
+        m_loader->clearResourceData();
+}
+
 void CachedRawResource::reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
 {
     MemoryClassInfo info(memoryObjectInfo, this, WebCoreMemoryTypes::CachedResourceRaw);
diff --git a/Source/WebCore/loader/cache/CachedRawResource.h b/Source/WebCore/loader/cache/CachedRawResource.h
index 6d2e97062..358f5040b 100644
--- a/Source/WebCore/loader/cache/CachedRawResource.h
+++ b/Source/WebCore/loader/cache/CachedRawResource.h
@@ -29,19 +29,25 @@
 namespace WebCore {
 class CachedRawResourceCallback;
 class CachedRawResourceClient;
+class SubresourceLoader;
 
 class CachedRawResource : public CachedResource {
 public:
-    CachedRawResource(ResourceRequest&);
+    CachedRawResource(ResourceRequest&, Type);
 
     // FIXME: AssociatedURLLoader shouldn't be a DocumentThreadableLoader and therefore shouldn't
     // use CachedRawResource. However, it is, and it needs to be able to defer loading.
     // This can be fixed by splitting CORS preflighting out of DocumentThreacableLoader.
     virtual void setDefersLoading(bool);
+
+    virtual void setShouldBufferData(DataBufferingPolicy);
     
     // FIXME: This is exposed for the InpsectorInstrumentation for preflights in DocumentThreadableLoader. It's also really lame.
     unsigned long identifier() const { return m_identifier; }
 
+    SubresourceLoader* loader() const;
+    void clear();
+
     bool canReuse(const ResourceRequest&) const;
 
     virtual void reportMemoryUsage(MemoryObjectInfo*) const OVERRIDE;
diff --git a/Source/WebCore/loader/cache/CachedResource.cpp b/Source/WebCore/loader/cache/CachedResource.cpp
index 703c42836..ca3fe1363 100644
--- a/Source/WebCore/loader/cache/CachedResource.cpp
+++ b/Source/WebCore/loader/cache/CachedResource.cpp
@@ -36,7 +36,9 @@
 #include "FrameLoaderClient.h"
 #include "InspectorInstrumentation.h"
 #include "KURL.h"
+#include "LoaderStrategy.h"
 #include "Logging.h"
+#include "PlatformStrategies.h"
 #include "PurgeableBuffer.h"
 #include "ResourceBuffer.h"
 #include "ResourceHandle.h"
@@ -54,6 +56,14 @@
 #include <wtf/text/CString.h>
 #include <wtf/Vector.h>
 
+namespace WTF {
+
+template<> struct SequenceMemoryInstrumentationTraits<WebCore::CachedResourceClient*> {
+    template <typename I> static void reportMemoryUsage(I, I, MemoryClassInfo&) { }
+};
+
+}
+
 using namespace WTF;
 
 namespace WebCore {
@@ -61,35 +71,37 @@ namespace WebCore {
 static ResourceLoadPriority defaultPriorityForResourceType(CachedResource::Type type)
 {
     switch (type) {
-        case CachedResource::CSSStyleSheet:
-            return ResourceLoadPriorityHigh;
-        case CachedResource::Script:
-        case CachedResource::FontResource:
-        case CachedResource::RawResource:
-            return ResourceLoadPriorityMedium;
-        case CachedResource::ImageResource:
-            return ResourceLoadPriorityLow;
+    case CachedResource::MainResource:
+        return ResourceLoadPriorityVeryHigh;
+    case CachedResource::CSSStyleSheet:
+        return ResourceLoadPriorityHigh;
+    case CachedResource::Script:
+    case CachedResource::FontResource:
+    case CachedResource::RawResource:
+        return ResourceLoadPriorityMedium;
+    case CachedResource::ImageResource:
+        return ResourceLoadPriorityLow;
 #if ENABLE(XSLT)
-        case CachedResource::XSLStyleSheet:
-            return ResourceLoadPriorityHigh;
+    case CachedResource::XSLStyleSheet:
+        return ResourceLoadPriorityHigh;
 #endif
 #if ENABLE(SVG)
-        case CachedResource::SVGDocumentResource:
-            return ResourceLoadPriorityLow;
+    case CachedResource::SVGDocumentResource:
+        return ResourceLoadPriorityLow;
 #endif
 #if ENABLE(LINK_PREFETCH)
-        case CachedResource::LinkPrefetch:
-            return ResourceLoadPriorityVeryLow;
-        case CachedResource::LinkSubresource:
-            return ResourceLoadPriorityVeryLow;
+    case CachedResource::LinkPrefetch:
+        return ResourceLoadPriorityVeryLow;
+    case CachedResource::LinkSubresource:
+        return ResourceLoadPriorityVeryLow;
 #endif
 #if ENABLE(VIDEO_TRACK)
-        case CachedResource::TextTrackResource:
-            return ResourceLoadPriorityLow;
+    case CachedResource::TextTrackResource:
+        return ResourceLoadPriorityLow;
 #endif
 #if ENABLE(CSS_SHADERS)
-        case CachedResource::ShaderResource:
-            return ResourceLoadPriorityMedium;
+    case CachedResource::ShaderResource:
+        return ResourceLoadPriorityMedium;
 #endif
     }
     ASSERT_NOT_REACHED();
@@ -100,6 +112,8 @@ static ResourceLoadPriority defaultPriorityForResourceType(CachedResource::Type
 static ResourceRequest::TargetType cachedResourceTypeToTargetType(CachedResource::Type type)
 {
     switch (type) {
+    case CachedResource::MainResource:
+        return ResourceRequest::TargetIsMainFrame;
     case CachedResource::CSSStyleSheet:
 #if ENABLE(XSLT)
     case CachedResource::XSLStyleSheet:
@@ -275,9 +289,16 @@ void CachedResource::load(CachedResourceLoader* cachedResourceLoader, const Reso
         m_resourceRequest.setHTTPHeaderField("Purpose", "prefetch");
 #endif
     m_resourceRequest.setPriority(loadPriority());
-    addAdditionalRequestHeaders(cachedResourceLoader);
 
+    if (type() != MainResource)
+        addAdditionalRequestHeaders(cachedResourceLoader);
+
+#if USE(PLATFORM_STRATEGIES)
+    m_loader = platformStrategies()->loaderStrategy()->resourceLoadScheduler()->scheduleSubresourceLoad(cachedResourceLoader->frame(), this, m_resourceRequest, m_resourceRequest.priority(), options);
+#else
     m_loader = resourceLoadScheduler()->scheduleSubresourceLoad(cachedResourceLoader->frame(), this, m_resourceRequest, m_resourceRequest.priority(), options);
+#endif
+
     if (!m_loader) {
         failBeforeStarting();
         return;
@@ -417,8 +438,9 @@ void CachedResource::stopLoading()
     // canceled loads, which silently set our request to 0. Be sure to notify our
     // client in that case, so we don't seem to continue loading forever.
     if (isLoading()) {
+        ASSERT(!m_error.isNull());
         setLoading(false);
-        setStatus(Canceled);
+        setStatus(LoadError);
         checkNotify();
     }
 }
diff --git a/Source/WebCore/loader/cache/CachedResource.h b/Source/WebCore/loader/cache/CachedResource.h
index c3d093a2f..03d28c207 100644
--- a/Source/WebCore/loader/cache/CachedResource.h
+++ b/Source/WebCore/loader/cache/CachedResource.h
@@ -61,6 +61,7 @@ class CachedResource {
     
 public:
     enum Type {
+        MainResource,
         ImageResource,
         CSSStyleSheet,
         Script,
@@ -88,7 +89,6 @@ public:
         Unknown,      // let cache decide what to do with it
         Pending,      // only partially loaded
         Cached,       // regular case
-        Canceled,
         LoadError,
         DecodeError
     };
@@ -103,6 +103,9 @@ public:
     virtual void data(PassRefPtr<ResourceBuffer> data, bool allDataReceived);
     virtual void error(CachedResource::Status);
 
+    void setResourceError(const ResourceError& error) { m_error = error; }
+    const ResourceError& resourceError() const { return m_error; }
+
     virtual bool shouldIgnoreHTTPStatusCodeErrors() const { return false; }
 
     ResourceRequest& resourceRequest() { return m_resourceRequest; }
@@ -151,7 +154,7 @@ public:
     virtual bool isImage() const { return false; }
     bool ignoreForRequestCount() const
     {
-        return false
+        return type() == MainResource
 #if ENABLE(LINK_PREFETCH)
             || type() == LinkPrefetch
             || type() == LinkSubresource
@@ -206,9 +209,9 @@ public:
     String accept() const { return m_accept; }
     void setAccept(const String& accept) { m_accept = accept; }
 
-    bool wasCanceled() const { return m_status == Canceled; }
-    bool errorOccurred() const { return (m_status == LoadError || m_status == DecodeError); }
-    bool loadFailedOrCanceled() { return m_status == Canceled || m_status == LoadError; }
+    bool wasCanceled() const { return m_error.isCancellation(); }
+    bool errorOccurred() const { return m_status == LoadError || m_status == DecodeError; }
+    bool loadFailedOrCanceled() { return !m_error.isNull(); }
 
     bool shouldSendResourceLoadCallbacks() const { return m_options.sendLoadCallbacks == SendCallbacks; }
     
@@ -255,8 +258,6 @@ public:
 protected:
     virtual void checkNotify();
 
-    virtual void addAdditionalRequestHeaders(CachedResourceLoader*);
-
     void setEncodedSize(unsigned);
     void setDecodedSize(unsigned);
     void didAccessDecodedData(double timeStamp);
@@ -303,10 +304,13 @@ private:
     double currentAge() const;
     double freshnessLifetime() const;
 
+    void addAdditionalRequestHeaders(CachedResourceLoader*);
     void failBeforeStarting();
 
     RefPtr<CachedMetadata> m_cachedMetadata;
 
+    ResourceError m_error;
+
     double m_lastDecodedAccessTime; // Used as a "thrash guard" in the cache
     double m_loadFinishTime;
 
diff --git a/Source/WebCore/loader/cache/CachedResourceLoader.cpp b/Source/WebCore/loader/cache/CachedResourceLoader.cpp
index 1ccaed9bf..d4cba0591 100644
--- a/Source/WebCore/loader/cache/CachedResourceLoader.cpp
+++ b/Source/WebCore/loader/cache/CachedResourceLoader.cpp
@@ -44,14 +44,17 @@
 #include "FrameLoader.h"
 #include "FrameLoaderClient.h"
 #include "HTMLElement.h"
+#include "LoaderStrategy.h"
 #include "Logging.h"
 #include "MemoryCache.h"
 #include "PingLoader.h"
+#include "PlatformStrategies.h"
 #include "ResourceLoadScheduler.h"
 #include "SecurityOrigin.h"
 #include "Settings.h"
 #include <wtf/MemoryInstrumentationHashMap.h>
 #include <wtf/MemoryInstrumentationHashSet.h>
+#include <wtf/MemoryInstrumentationListHashSet.h>
 #include <wtf/UnusedParam.h>
 #include <wtf/text/CString.h>
 #include <wtf/text/WTFString.h>
@@ -84,7 +87,8 @@ static CachedResource* createResource(CachedResource::Type type, ResourceRequest
     case CachedResource::FontResource:
         return new CachedFont(request);
     case CachedResource::RawResource:
-        return new CachedRawResource(request);
+    case CachedResource::MainResource:
+        return new CachedRawResource(request, type);
 #if ENABLE(XSLT)
     case CachedResource::XSLStyleSheet:
         return new CachedXSLStyleSheet(request);
@@ -243,6 +247,11 @@ CachedResourceHandle<CachedRawResource> CachedResourceLoader::requestRawResource
     return static_cast<CachedRawResource*>(requestResource(CachedResource::RawResource, request).get());
 }
 
+CachedResourceHandle<CachedRawResource> CachedResourceLoader::requestMainResource(CachedResourceRequest& request)
+{
+    return static_cast<CachedRawResource*>(requestResource(CachedResource::MainResource, request).get());
+}
+
 bool CachedResourceLoader::checkInsecureContent(CachedResource::Type type, const KURL& url) const
 {
     switch (type) {
@@ -277,6 +286,7 @@ bool CachedResourceLoader::checkInsecureContent(CachedResource::Type type, const
         }
         break;
     }
+    case CachedResource::MainResource:
 #if ENABLE(LINK_PREFETCH)
     case CachedResource::LinkPrefetch:
     case CachedResource::LinkSubresource:
@@ -289,21 +299,20 @@ bool CachedResourceLoader::checkInsecureContent(CachedResource::Type type, const
 
 bool CachedResourceLoader::canRequest(CachedResource::Type type, const KURL& url, bool forPreload)
 {
-    // FIXME: When we can load main resources through CachedResourceLoader, we'll need to allow for null document() here.
-    if (!document())
-        return false;
-
-    if (!document()->securityOrigin()->canDisplay(url)) {
+    if (document() && !document()->securityOrigin()->canDisplay(url)) {
         if (!forPreload)
-            FrameLoader::reportLocalLoadFailed(document()->frame(), url.string());
+            FrameLoader::reportLocalLoadFailed(frame(), url.string());
         LOG(ResourceLoading, "CachedResourceLoader::requestResource URL was not allowed by SecurityOrigin::canDisplay");
         return 0;
     }
 
+    bool shouldBypassMainWorldContentSecurityPolicy = (frame() && frame()->script()->shouldBypassMainWorldContentSecurityPolicy());
+
     // Some types of resources can be loaded only from the same origin.  Other
     // types of resources, like Images, Scripts, and CSS, can be loaded from
     // any URL.
     switch (type) {
+    case CachedResource::MainResource:
     case CachedResource::ImageResource:
     case CachedResource::CSSStyleSheet:
     case CachedResource::Script:
@@ -340,7 +349,7 @@ bool CachedResourceLoader::canRequest(CachedResource::Type type, const KURL& url
     case CachedResource::XSLStyleSheet:
 #endif
     case CachedResource::Script:
-        if (!m_document->contentSecurityPolicy()->allowScriptFromSource(url))
+        if (!shouldBypassMainWorldContentSecurityPolicy && !m_document->contentSecurityPolicy()->allowScriptFromSource(url))
             return false;
 
         if (frame()) {
@@ -356,21 +365,22 @@ bool CachedResourceLoader::canRequest(CachedResource::Type type, const KURL& url
         // Since shaders are referenced from CSS Styles use the same rules here.
 #endif
     case CachedResource::CSSStyleSheet:
-        if (!m_document->contentSecurityPolicy()->allowStyleFromSource(url))
+        if (!shouldBypassMainWorldContentSecurityPolicy && !m_document->contentSecurityPolicy()->allowStyleFromSource(url))
             return false;
         break;
 #if ENABLE(SVG)
     case CachedResource::SVGDocumentResource:
 #endif
     case CachedResource::ImageResource:
-        if (!m_document->contentSecurityPolicy()->allowImageFromSource(url))
+        if (!shouldBypassMainWorldContentSecurityPolicy && !m_document->contentSecurityPolicy()->allowImageFromSource(url))
             return false;
         break;
     case CachedResource::FontResource: {
-        if (!m_document->contentSecurityPolicy()->allowFontFromSource(url))
+        if (!shouldBypassMainWorldContentSecurityPolicy && !m_document->contentSecurityPolicy()->allowFontFromSource(url))
             return false;
         break;
     }
+    case CachedResource::MainResource:
     case CachedResource::RawResource:
 #if ENABLE(LINK_PREFETCH)
     case CachedResource::LinkPrefetch:
@@ -381,7 +391,7 @@ bool CachedResourceLoader::canRequest(CachedResource::Type type, const KURL& url
     case CachedResource::TextTrackResource:
         // Cues aren't called out in the CPS spec yet, but they only work with a media element
         // so use the media policy.
-        if (!m_document->contentSecurityPolicy()->allowMediaFromSource(url))
+        if (!shouldBypassMainWorldContentSecurityPolicy && !m_document->contentSecurityPolicy()->allowMediaFromSource(url))
             return false;
         break;
 #endif
@@ -515,8 +525,11 @@ CachedResourceLoader::RevalidationPolicy CachedResourceLoader::determineRevalida
         return Reload;
     }
 
+    if (existingResource->type() == CachedResource::MainResource)
+        return Reload;
+
     if (existingResource->type() == CachedResource::RawResource && !static_cast<CachedRawResource*>(existingResource)->canReuse(request))
-         return Reload;
+        return Reload;
 
     // Certain requests (e.g., XHRs) might have manually set headers that require revalidation.
     // FIXME: In theory, this should be a Revalidate case. In practice, the MemoryCache revalidation path assumes a whole bunch
@@ -611,7 +624,7 @@ void CachedResourceLoader::printAccessDeniedMessage(const KURL& url) const
         message = "Unsafe attempt to load URL " + url.string() + " from frame with URL " + m_document->url().string() + ". Domains, protocols and ports must match.\n";
 
     // FIXME: provide line number and source URL.
-    frame()->document()->domWindow()->console()->addMessage(OtherMessageSource, LogMessageType, ErrorMessageLevel, message);
+    frame()->document()->addConsoleMessage(OtherMessageSource, LogMessageType, ErrorMessageLevel, message);
 }
 
 void CachedResourceLoader::setAutoLoadImages(bool enable)
@@ -718,7 +731,12 @@ void CachedResourceLoader::garbageCollectDocumentResources()
 void CachedResourceLoader::performPostLoadActions()
 {
     checkForPendingPreloads();
+
+#if USE(PLATFORM_STRATEGIES)
+    platformStrategies()->loaderStrategy()->resourceLoadScheduler()->servePendingRequests();
+#else
     resourceLoadScheduler()->servePendingRequests();
+#endif
 }
 
 void CachedResourceLoader::notifyLoadedFromMemoryCache(CachedResource* resource)
@@ -906,8 +924,7 @@ void CachedResourceLoader::reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo)
     MemoryClassInfo info(memoryObjectInfo, this, WebCoreMemoryTypes::Loader);
     info.addMember(m_documentResources);
     info.addMember(m_validatedURLs);
-    if (m_preloads)
-        info.addListHashSet(*m_preloads);
+    info.addMember(m_preloads);
     info.addMember(m_pendingPreloads);
 }
 
diff --git a/Source/WebCore/loader/cache/CachedResourceLoader.h b/Source/WebCore/loader/cache/CachedResourceLoader.h
index 0fcb1e37d..e2e2ae497 100644
--- a/Source/WebCore/loader/cache/CachedResourceLoader.h
+++ b/Source/WebCore/loader/cache/CachedResourceLoader.h
@@ -79,6 +79,7 @@ public:
     CachedResourceHandle<CachedScript> requestScript(CachedResourceRequest&);
     CachedResourceHandle<CachedFont> requestFont(CachedResourceRequest&);
     CachedResourceHandle<CachedRawResource> requestRawResource(CachedResourceRequest&);
+    CachedResourceHandle<CachedRawResource> requestMainResource(CachedResourceRequest&);
 
 #if ENABLE(SVG)
     CachedResourceHandle<CachedSVGDocument> requestSVGDocument(CachedResourceRequest&);
diff --git a/Source/WebCore/loader/cache/MemoryCache.cpp b/Source/WebCore/loader/cache/MemoryCache.cpp
index 1cf295ce4..ae3c0375e 100644
--- a/Source/WebCore/loader/cache/MemoryCache.cpp
+++ b/Source/WebCore/loader/cache/MemoryCache.cpp
@@ -308,23 +308,30 @@ void MemoryCache::pruneDeadResourcesToSize(unsigned targetSize)
         
         // First flush all the decoded data in this queue.
         while (current) {
-            CachedResource* prev = current->m_prevInAllResourcesList;
+            // Protect 'previous' so it can't get deleted during destroyDecodedData().
+            CachedResourceHandle<CachedResource> previous = current->m_prevInAllResourcesList;
+            ASSERT(!previous || previous->inCache());
             if (!current->hasClients() && !current->isPreloaded() && current->isLoaded()) {
                 // Destroy our decoded data. This will remove us from 
                 // m_liveDecodedResources, and possibly move us to a different 
                 // LRU list in m_allResources.
                 current->destroyDecodedData();
-                
+
                 if (targetSize && m_deadSize <= targetSize)
                     return;
             }
-            current = prev;
+            // Decoded data may reference other resources. Stop iterating if 'previous' somehow got
+            // kicked out of cache during destroyDecodedData().
+            if (previous && !previous->inCache())
+                break;
+            current = previous.get();
         }
 
         // Now evict objects from this queue.
         current = m_allResources[i].m_tail;
         while (current) {
-            CachedResource* prev = current->m_prevInAllResourcesList;
+            CachedResourceHandle<CachedResource> previous = current->m_prevInAllResourcesList;
+            ASSERT(!previous || previous->inCache());
             if (!current->hasClients() && !current->isPreloaded() && !current->isCacheValidator()) {
                 if (!makeResourcePurgeable(current))
                     evict(current);
@@ -332,7 +339,9 @@ void MemoryCache::pruneDeadResourcesToSize(unsigned targetSize)
                 if (targetSize && m_deadSize <= targetSize)
                     return;
             }
-            current = prev;
+            if (previous && !previous->inCache())
+                break;
+            current = previous.get();
         }
             
         // Shrink the vector back down so we don't waste time inspecting
diff --git a/Source/WebCore/loader/cf/SubresourceLoaderCF.cpp b/Source/WebCore/loader/cf/SubresourceLoaderCF.cpp
index a8663b52c..569a2b9d2 100644
--- a/Source/WebCore/loader/cf/SubresourceLoaderCF.cpp
+++ b/Source/WebCore/loader/cf/SubresourceLoaderCF.cpp
@@ -27,7 +27,7 @@
 
 namespace WebCore {
 
-#if HAVE(NETWORK_CFDATA_ARRAY_CALLBACK)
+#if USE(NETWORK_CFDATA_ARRAY_CALLBACK)
 void SubresourceLoader::didReceiveDataArray(CFArrayRef dataArray)
 {
     // Reference the object in this method since the additional processing can do
diff --git a/Source/WebCore/loader/icon/IconDatabase.cpp b/Source/WebCore/loader/icon/IconDatabase.cpp
index 163f6bd53..b3b67bfeb 100644
--- a/Source/WebCore/loader/icon/IconDatabase.cpp
+++ b/Source/WebCore/loader/icon/IconDatabase.cpp
@@ -811,7 +811,7 @@ IconDatabase::IconDatabase()
 
 IconDatabase::~IconDatabase()
 {
-    ASSERT_NOT_REACHED();
+    ASSERT(!isOpen());
 }
 
 void IconDatabase::notifyPendingLoadDecisionsOnMainThread(void* context)
diff --git a/Source/WebCore/loader/mac/LoaderNSURLExtras.h b/Source/WebCore/loader/mac/LoaderNSURLExtras.h
index ce5a4909d..a500a8e00 100644
--- a/Source/WebCore/loader/mac/LoaderNSURLExtras.h
+++ b/Source/WebCore/loader/mac/LoaderNSURLExtras.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2005, 2006 Apple Computer, Inc.  All rights reserved.
+ * Copyright (C) 2005, 2006, 2012 Apple Computer, Inc.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -28,12 +28,10 @@
 
 #import <Foundation/Foundation.h>
 
-#ifdef __cplusplus
-extern "C" {
-#endif
-
-NSString *suggestedFilenameWithMIMEType(NSURL *url, NSString *MIMEType);
+namespace WTF {
+class String;
+}
 
-#ifdef __cplusplus
+extern "C" {
+NSString *suggestedFilenameWithMIMEType(NSURL *, const WTF::String& MIMEType);
 }
-#endif
diff --git a/Source/WebCore/loader/mac/LoaderNSURLExtras.mm b/Source/WebCore/loader/mac/LoaderNSURLExtras.mm
index 2cb13af41..083b1e603 100644
--- a/Source/WebCore/loader/mac/LoaderNSURLExtras.mm
+++ b/Source/WebCore/loader/mac/LoaderNSURLExtras.mm
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2005, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2005, 2008, 2012 Apple Inc. All rights reserved.
  * Copyright (C) 2006 Alexey Proskuryakov (ap@nypop.com)
  *
  * Redistribution and use in source and binary forms, with or without
@@ -49,7 +49,7 @@ static bool vectorContainsString(const Vector<String>& vector, const String& str
     return false;
 }
 
-NSString *suggestedFilenameWithMIMEType(NSURL *url, NSString *MIMEType)
+NSString *suggestedFilenameWithMIMEType(NSURL *url, const String& mimeType)
 {
     // Get the filename from the URL. Try the lastPathComponent first.
     NSString *lastPathComponent = [[url path] lastPathComponent];
@@ -70,14 +70,9 @@ NSString *suggestedFilenameWithMIMEType(NSURL *url, NSString *MIMEType)
         extension = [filename pathExtension];
     }
 
-    // No mime type reported. Just return the filename we have now.
-    if (!MIMEType) {
-        return filename;
-    }
-
     // Do not correct filenames that are reported with a mime type of tar, and 
     // have a filename which has .tar in it or ends in .tgz
-    if (([MIMEType isEqualToString:@"application/tar"] || [MIMEType isEqualToString:@"application/x-tar"]) 
+    if ((mimeType == "application/tar" || mimeType == "application/x-tar")
         && (hasCaseInsensitiveSubstring(filename, @".tar")
         || hasCaseInsensitiveSuffix(filename, @".tgz"))) {
         return filename;
@@ -85,12 +80,12 @@ NSString *suggestedFilenameWithMIMEType(NSURL *url, NSString *MIMEType)
 
     // I don't think we need to worry about this for the image case
     // If the type is known, check the extension and correct it if necessary.
-    if (![MIMEType isEqualToString:@"application/octet-stream"] && ![MIMEType isEqualToString:@"text/plain"]) {
-        Vector<String> extensions = MIMETypeRegistry::getExtensionsForMIMEType(MIMEType);
+    if (mimeType != "application/octet-stream" && mimeType != "text/plain") {
+        Vector<String> extensions = MIMETypeRegistry::getExtensionsForMIMEType(mimeType);
 
         if (extensions.isEmpty() || !vectorContainsString(extensions, extension)) {
             // The extension doesn't match the MIME type. Correct this.
-            NSString *correctExtension = MIMETypeRegistry::getPreferredExtensionForMIMEType(MIMEType);
+            NSString *correctExtension = MIMETypeRegistry::getPreferredExtensionForMIMEType(mimeType);
             if ([correctExtension length] != 0) {
                 // Append the correct extension.
                 filename = [filename stringByAppendingPathExtension:correctExtension];
diff --git a/Source/WebCore/loader/mac/ResourceLoaderMac.mm b/Source/WebCore/loader/mac/ResourceLoaderMac.mm
index 1d18671b9..ad4d60a16 100644
--- a/Source/WebCore/loader/mac/ResourceLoaderMac.mm
+++ b/Source/WebCore/loader/mac/ResourceLoaderMac.mm
@@ -33,7 +33,7 @@
 #include "FrameLoaderClient.h"
 #include "ResourceHandle.h"
 
-#if HAVE(NETWORK_CFDATA_ARRAY_CALLBACK)
+#if USE(NETWORK_CFDATA_ARRAY_CALLBACK)
 #include "InspectorInstrumentation.h"
 #endif
 
@@ -68,7 +68,7 @@ NSCachedURLResponse* ResourceLoader::willCacheResponse(ResourceHandle*, NSCached
 
 #endif
 
-#if HAVE(NETWORK_CFDATA_ARRAY_CALLBACK)
+#if USE(NETWORK_CFDATA_ARRAY_CALLBACK)
 
 void ResourceLoader::didReceiveDataArray(CFArrayRef dataArray)
 {
@@ -83,7 +83,7 @@ void ResourceLoader::didReceiveDataArray(CFArrayRef dataArray)
 
         if (m_options.shouldBufferData == BufferData) {
             if (!m_resourceData)
-                m_resourceData = SharedBuffer::create();
+                m_resourceData = ResourceBuffer::create();
             m_resourceData->append(data);
         }
 
@@ -97,7 +97,16 @@ void ResourceLoader::didReceiveDataArray(CFArrayRef dataArray)
 
 void ResourceLoader::didReceiveDataArray(ResourceHandle*, CFArrayRef dataArray)
 {
-    InspectorInstrumentationCookie cookie = InspectorInstrumentation::willReceiveResourceData(m_frame.get(), identifier());
+    CFIndex arrayCount = CFArrayGetCount(dataArray);
+    CFIndex dataLength = 0;
+    for (CFIndex i = 0; i < arrayCount; ++i) {
+        CFDataRef data = static_cast<CFDataRef>(CFArrayGetValueAtIndex(dataArray, i));
+        dataLength += CFDataGetLength(data);
+    }
+
+    // FIXME: didReceiveData() passes encoded data length to InspectorInstrumentation, but it is not available here.
+    // This probably results in incorrect size being displayed in Web Inspector.
+    InspectorInstrumentationCookie cookie = InspectorInstrumentation::willReceiveResourceData(m_frame.get(), identifier(), dataLength);
     didReceiveDataArray(dataArray);
     InspectorInstrumentation::didReceiveResourceData(cookie);
 }
diff --git a/Source/JavaScriptCore/bytecode/MethodCallLinkInfo.h b/Source/WebCore/page/CaptionUserPreferences.h
index 2243bc24e..377f5277e 100644
--- a/Source/JavaScriptCore/bytecode/MethodCallLinkInfo.h
+++ b/Source/WebCore/page/CaptionUserPreferences.h
@@ -23,61 +23,47 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
-#ifndef MethodCallLinkInfo_h
-#define MethodCallLinkInfo_h
+#ifndef CaptionUserPreferences_h
+#define CaptionUserPreferences_h
 
-#include "CodeLocation.h"
-#include "JITCode.h"
-#include "JITWriteBarrier.h"
-#include <wtf/Platform.h>
+#if ENABLE(VIDEO_TRACK)
 
-namespace JSC {
+#include <wtf/PassOwnPtr.h>
+#include <wtf/text/AtomicString.h>
 
-#if ENABLE(JIT)
+namespace WebCore {
 
-class RepatchBuffer;
+class PageGroup;
 
-struct MethodCallLinkInfo {
-    MethodCallLinkInfo()
-        : seen(false)
-    {
-    }
+class CaptionPreferencesChangedListener {
+public:
+    virtual void captionPreferencesChanged() = 0;
+protected:
+    virtual ~CaptionPreferencesChangedListener() { }
+};
 
-    bool seenOnce()
-    {
-        return seen;
-    }
+class CaptionUserPreferences {
+public:
+    static PassOwnPtr<CaptionUserPreferences> create(PageGroup* group) { return adoptPtr(new CaptionUserPreferences(group)); }
+    virtual ~CaptionUserPreferences() { }
 
-    void setSeen()
-    {
-        seen = true;
-    }
-        
-    void reset(RepatchBuffer&, JITCode::JITType);
+    virtual bool userPrefersCaptions() const { return false; }
+    virtual bool userHasCaptionPreferences() const { return false; }
+    virtual float captionFontSizeScale() const { return 0.05f; }
+    virtual String captionsStyleSheetOverride() const { return emptyString(); }
+    virtual void registerForCaptionPreferencesChangedCallbacks(CaptionPreferencesChangedListener*) { }
+    virtual void unregisterForCaptionPreferencesChangedCallbacks(CaptionPreferencesChangedListener*) { }
 
-    unsigned bytecodeIndex;
-    CodeLocationCall callReturnLocation;
-    JITWriteBarrier<Structure> cachedStructure;
-    JITWriteBarrier<Structure> cachedPrototypeStructure;
-    // We'd like this to actually be JSFunction, but InternalFunction and JSFunction
-    // don't have a common parent class and we allow specialisation on both
-    JITWriteBarrier<JSObject> cachedFunction;
-    JITWriteBarrier<JSObject> cachedPrototype;
-    bool seen;
-};
+    PageGroup* pageGroup() { return m_pageGroup; }
 
-inline void* getMethodCallLinkInfoReturnLocation(MethodCallLinkInfo* methodCallLinkInfo)
-{
-    return methodCallLinkInfo->callReturnLocation.executableAddress();
-}
+protected:
+    CaptionUserPreferences(PageGroup* group) : m_pageGroup(group) { }
 
-inline unsigned getMethodCallLinkInfoBytecodeIndex(MethodCallLinkInfo* methodCallLinkInfo)
-{
-    return methodCallLinkInfo->bytecodeIndex;
+private:
+    PageGroup* m_pageGroup;
+};
+    
 }
+#endif
 
-#endif // ENABLE(JIT)
-
-} // namespace JSC
-
-#endif // MethodCallLinkInfo_h
+#endif
diff --git a/Source/WebCore/page/CaptionUserPreferencesMac.h b/Source/WebCore/page/CaptionUserPreferencesMac.h
new file mode 100644
index 000000000..6cba2f1b4
--- /dev/null
+++ b/Source/WebCore/page/CaptionUserPreferencesMac.h
@@ -0,0 +1,73 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef CaptionUserPreferencesMac_h
+#define CaptionUserPreferencesMac_h
+
+#if ENABLE(VIDEO_TRACK)
+
+#include "CSSPropertyNames.h"
+#include "CaptionUserPreferences.h"
+#include "Color.h"
+#include <wtf/HashSet.h>
+
+namespace WebCore {
+
+class CaptionUserPreferencesMac : public CaptionUserPreferences {
+public:
+    static PassOwnPtr<CaptionUserPreferencesMac> create(PageGroup* group) { return adoptPtr(new CaptionUserPreferencesMac(group)); }
+    virtual ~CaptionUserPreferencesMac();
+
+    virtual bool userPrefersCaptions() const OVERRIDE;
+    virtual bool userHasCaptionPreferences() const OVERRIDE;
+    virtual float captionFontSizeScale() const OVERRIDE;
+    virtual String captionsStyleSheetOverride() const OVERRIDE;
+    virtual void registerForCaptionPreferencesChangedCallbacks(CaptionPreferencesChangedListener*) OVERRIDE;
+    virtual void unregisterForCaptionPreferencesChangedCallbacks(CaptionPreferencesChangedListener*) OVERRIDE;
+
+    void captionPreferencesChanged();
+
+private:
+    CaptionUserPreferencesMac(PageGroup*);
+
+    Color captionsWindowColor() const;
+    Color captionsBackgroundColor() const;
+    Color captionsTextColor() const;
+    String captionsDefaultFont() const;
+    Color captionsEdgeColorForTextColor(const Color&) const;
+    String captionsTextEdgeStyle() const;
+    String cssPropertyWithTextEdgeColor(CSSPropertyID, const String&, const Color&) const;
+    String cssColorProperty(CSSPropertyID, const Color&) const;
+
+    void updateCaptionStyleSheetOveride();
+
+    HashSet<CaptionPreferencesChangedListener*> m_captionPreferenceChangeListeners;
+    bool m_listeningForPreferenceChanges;
+};
+    
+}
+#endif
+
+#endif
diff --git a/Source/WebCore/page/CaptionUserPreferencesMac.mm b/Source/WebCore/page/CaptionUserPreferencesMac.mm
new file mode 100644
index 000000000..779a4bc04
--- /dev/null
+++ b/Source/WebCore/page/CaptionUserPreferencesMac.mm
@@ -0,0 +1,344 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#import "config.h"
+
+#if ENABLE(VIDEO_TRACK)
+
+#import "CaptionUserPreferencesMac.h"
+
+#import "ColorMac.h"
+#import "DOMWrapperWorld.h"
+#import "FloatConversion.h"
+#import "KURL.h"
+#import "PageGroup.h"
+#import "TextTrackCue.h"
+#import "UserStyleSheetTypes.h"
+#import "WebCoreSystemInterface.h"
+#import <wtf/RetainPtr.h>
+#import <wtf/text/StringBuilder.h>
+
+using namespace std;
+
+namespace WebCore {
+
+static void userCaptionPreferencesChangedNotificationCallback(CFNotificationCenterRef, void* observer, CFStringRef, const void *, CFDictionaryRef)
+{
+    static_cast<CaptionUserPreferencesMac*>(observer)->captionPreferencesChanged();
+}
+
+
+CaptionUserPreferencesMac::CaptionUserPreferencesMac(PageGroup* group)
+    : CaptionUserPreferences(group)
+    , m_listeningForPreferenceChanges(false)
+{
+}
+
+CaptionUserPreferencesMac::~CaptionUserPreferencesMac()
+{
+    if (wkCaptionAppearanceGetSettingsChangedNotification())
+        CFNotificationCenterRemoveObserver(CFNotificationCenterGetLocalCenter(), this, wkCaptionAppearanceGetSettingsChangedNotification(), NULL);
+}
+
+bool CaptionUserPreferencesMac::userHasCaptionPreferences() const
+{
+    return wkCaptionAppearanceHasUserPreferences();
+}
+
+bool CaptionUserPreferencesMac::userPrefersCaptions() const
+{
+    return wkCaptionAppearanceShowCaptionsWhenAvailable();
+}
+
+void CaptionUserPreferencesMac::registerForCaptionPreferencesChangedCallbacks(CaptionPreferencesChangedListener* listener)
+{
+    ASSERT(!m_captionPreferenceChangeListeners.contains(listener));
+
+    if (!wkCaptionAppearanceGetSettingsChangedNotification())
+        return;
+    
+    if (!m_listeningForPreferenceChanges) {
+        m_listeningForPreferenceChanges = true;
+        CFNotificationCenterAddObserver (CFNotificationCenterGetLocalCenter(), this, userCaptionPreferencesChangedNotificationCallback, wkCaptionAppearanceGetSettingsChangedNotification(), NULL, CFNotificationSuspensionBehaviorCoalesce);
+        updateCaptionStyleSheetOveride();
+    }
+    
+    m_captionPreferenceChangeListeners.add(listener);
+}
+
+void CaptionUserPreferencesMac::unregisterForCaptionPreferencesChangedCallbacks(CaptionPreferencesChangedListener* listener)
+{
+    if (wkCaptionAppearanceGetSettingsChangedNotification())
+        m_captionPreferenceChangeListeners.remove(listener);
+}
+
+Color CaptionUserPreferencesMac::captionsWindowColor() const
+{
+    RetainPtr<CGColorRef> color(AdoptCF, wkCaptionAppearanceCopyWindowColor());
+    Color windowColor(color.get());
+    if (!windowColor.isValid())
+        windowColor = Color::transparent;
+    
+    CGFloat opacity;
+    if (wkCaptionAppearanceGetWindowOpacity(&opacity))
+        return Color(windowColor.red(), windowColor.green(), windowColor.blue(), static_cast<int>(opacity * 255));
+    
+    if (!color)
+        return Color();
+    
+    return windowColor;
+}
+
+Color CaptionUserPreferencesMac::captionsBackgroundColor() const
+{
+    // This default value must be the same as the one specified in mediaControls.css for -webkit-media-text-track-past-nodes
+    // and webkit-media-text-track-future-nodes.
+    DEFINE_STATIC_LOCAL(Color, defaultBackgroundColor, (Color(0, 0, 0, 0.8 * 255)));
+    
+    RetainPtr<CGColorRef> color(AdoptCF, wkCaptionAppearanceCopyBackgroundColor());
+    Color backgroundColor(color.get());
+    if (!backgroundColor.isValid()) {
+        backgroundColor = defaultBackgroundColor;
+    }
+    
+    CGFloat opacity;
+    if (wkCaptionAppearanceGetBackgroundOpacity(&opacity))
+        return Color(backgroundColor.red(), backgroundColor.green(), backgroundColor.blue(), static_cast<int>(opacity * 255));
+    
+    if (!color)
+        return Color();
+    
+    return backgroundColor;
+}
+
+Color CaptionUserPreferencesMac::captionsTextColor() const
+{
+    RetainPtr<CGColorRef> color(AdoptCF, wkCaptionAppearanceCopyForegroundColor());
+    Color textColor(color.get());
+    if (!textColor.isValid()) {
+        // This default value must be the same as the one specified in mediaControls.css for -webkit-media-text-track-container.
+        textColor = Color::white;
+    }
+    
+    CGFloat opacity;
+    if (wkCaptionAppearanceGetForegroundOpacity(&opacity))
+        return Color(textColor.red(), textColor.green(), textColor.blue(), static_cast<int>(opacity * 255));
+    
+    if (!color)
+        return Color();
+    
+    return textColor;
+}
+
+Color CaptionUserPreferencesMac::captionsEdgeColorForTextColor(const Color& textColor) const
+{
+    int distanceFromWhite = differenceSquared(textColor, Color::white);
+    int distanceFromBlack = differenceSquared(textColor, Color::black);
+    
+    if (distanceFromWhite < distanceFromBlack)
+        return textColor.dark();
+    
+    return textColor.light();
+}
+
+String CaptionUserPreferencesMac::cssPropertyWithTextEdgeColor(CSSPropertyID id, const String& value, const Color& textColor) const
+{
+    StringBuilder builder;
+    
+    builder.append(getPropertyNameString(id));
+    builder.append(':');
+    builder.append(value);
+    builder.append(' ');
+    builder.append(captionsEdgeColorForTextColor(textColor).serialized());
+    builder.append(';');
+    
+    return builder.toString();
+}
+
+String CaptionUserPreferencesMac::cssColorProperty(CSSPropertyID id, const Color& color) const
+{
+    StringBuilder builder;
+    
+    builder.append(getPropertyNameString(id));
+    builder.append(':');
+    builder.append(color.serialized());
+    builder.append(';');
+    
+    return builder.toString();
+}
+
+String CaptionUserPreferencesMac::captionsTextEdgeStyle() const
+{
+    DEFINE_STATIC_LOCAL(const String, edgeStyleRaised, (" -.05em -.05em 0 ", String::ConstructFromLiteral));
+    DEFINE_STATIC_LOCAL(const String, edgeStyleDepressed, (" .05em .05em 0 ", String::ConstructFromLiteral));
+    DEFINE_STATIC_LOCAL(const String, edgeStyleDropShadow, (" .075em .075em 0 ", String::ConstructFromLiteral));
+    DEFINE_STATIC_LOCAL(const String, edgeStyleUniform, (" .03em ", String::ConstructFromLiteral));
+    
+    Color color = captionsTextColor();
+    if (!color.isValid())
+        color.setNamedColor("black");
+    color = captionsEdgeColorForTextColor(color);
+    
+    wkCaptionTextEdgeStyle textEdgeStyle = static_cast<wkCaptionTextEdgeStyle>(wkCaptionAppearanceGetTextEdgeStyle());
+    switch (textEdgeStyle) {
+        case wkCaptionTextEdgeStyleUndefined:
+        case wkCaptionTextEdgeStyleNone:
+            return emptyString();
+            
+        case wkCaptionTextEdgeStyleRaised:
+            return cssPropertyWithTextEdgeColor(CSSPropertyTextShadow, edgeStyleRaised, color);
+        case wkCaptionTextEdgeStyleDepressed:
+            return cssPropertyWithTextEdgeColor(CSSPropertyTextShadow, edgeStyleDepressed, color);
+        case wkCaptionTextEdgeStyleDropShadow:
+            return cssPropertyWithTextEdgeColor(CSSPropertyTextShadow, edgeStyleDropShadow, color);
+        case wkCaptionTextEdgeStyleUniform:
+            return cssPropertyWithTextEdgeColor(CSSPropertyWebkitTextStroke, edgeStyleUniform, color);
+            
+        case wkCaptionTextEdgeStyleMax:
+            ASSERT_NOT_REACHED();
+        default:
+            ASSERT_NOT_REACHED();
+            break;
+    }
+    
+    return emptyString();
+}
+
+String CaptionUserPreferencesMac::captionsDefaultFont() const
+{
+    RetainPtr<CGFontRef> font(AdoptCF, wkCaptionAppearanceCopyFontForStyle(wkCaptionFontStyleDefault));
+    if (!font)
+        return emptyString();
+    
+    RetainPtr<CFStringRef> name(AdoptCF, CGFontCopyPostScriptName(font.get()));
+    if (!name)
+        return emptyString();
+    
+    StringBuilder builder;
+    
+    builder.append(getPropertyNameString(CSSPropertyFontFamily));
+    builder.append(": \"");
+    builder.append(name.get());
+    builder.append("\";");
+    
+    return builder.toString();
+}
+
+String CaptionUserPreferencesMac::captionsStyleSheetOverride() const
+{
+    StringBuilder captionsOverrideStyleSheet;
+    
+    Color color = captionsBackgroundColor();
+    if (color.isValid()) {
+        captionsOverrideStyleSheet.append(" video::");
+        captionsOverrideStyleSheet.append(TextTrackCue::pastNodesShadowPseudoId());
+        captionsOverrideStyleSheet.append('{');
+        captionsOverrideStyleSheet.append(cssColorProperty(CSSPropertyBackgroundColor, color));
+        captionsOverrideStyleSheet.append('}');
+        
+        captionsOverrideStyleSheet.append(" video::");
+        captionsOverrideStyleSheet.append(TextTrackCue::futureNodesShadowPseudoId());
+        captionsOverrideStyleSheet.append('{');
+        captionsOverrideStyleSheet.append(cssColorProperty(CSSPropertyBackgroundColor, color));
+        captionsOverrideStyleSheet.append('}');
+    }
+    
+    color = captionsWindowColor();
+    if (color.isValid()) {
+        captionsOverrideStyleSheet.append(" video::");
+        captionsOverrideStyleSheet.append(TextTrackCueBox::textTrackCueBoxShadowPseudoId());
+        captionsOverrideStyleSheet.append('{');
+        captionsOverrideStyleSheet.append(cssColorProperty(CSSPropertyBackgroundColor, color));
+        captionsOverrideStyleSheet.append('}');
+    }
+    
+    color = captionsTextColor();
+    String edgeStyle = captionsTextEdgeStyle();
+    String fontName = captionsDefaultFont();
+    if (color.isValid() || !edgeStyle.isEmpty() || !fontName.isEmpty()) {
+        captionsOverrideStyleSheet.append(" video::");
+        captionsOverrideStyleSheet.append(TextTrackCueBox::textTrackCueBoxShadowPseudoId());
+        captionsOverrideStyleSheet.append('{');
+        
+        if (color.isValid())
+            captionsOverrideStyleSheet.append(cssColorProperty(CSSPropertyColor, color));
+        if (!edgeStyle.isEmpty())
+            captionsOverrideStyleSheet.append(edgeStyle);
+        if (!fontName.isEmpty())
+            captionsOverrideStyleSheet.append(fontName);
+        
+        captionsOverrideStyleSheet.append('}');
+    }
+    
+    return captionsOverrideStyleSheet.toString();
+}
+
+float CaptionUserPreferencesMac::captionFontSizeScale() const
+{
+    CGFloat characterScale = CaptionUserPreferences::captionFontSizeScale();
+    CGFloat scaleAdjustment;
+    
+    if (!wkCaptionAppearanceGetRelativeCharacterSize(&scaleAdjustment))
+        return characterScale;
+    
+#if defined(__LP64__) && __LP64__
+    return narrowPrecisionToFloat(scaleAdjustment * characterScale);
+#else
+    return scaleAdjustment * characterScale;
+#endif
+}
+
+void CaptionUserPreferencesMac::captionPreferencesChanged()
+{
+    if (m_captionPreferenceChangeListeners.isEmpty())
+        return;
+
+    updateCaptionStyleSheetOveride();
+
+    for (HashSet<CaptionPreferencesChangedListener*>::iterator i = m_captionPreferenceChangeListeners.begin(); i != m_captionPreferenceChangeListeners.end(); ++i)
+        (*i)->captionPreferencesChanged();
+}
+
+void CaptionUserPreferencesMac::updateCaptionStyleSheetOveride()
+{
+    // Identify our override style sheet with a unique URL - a new scheme and a UUID.
+    DEFINE_STATIC_LOCAL(KURL, captionsStyleSheetURL, (ParsedURLString, "user-captions-override:01F6AF12-C3B0-4F70-AF5E-A3E00234DC23"));
+    
+    pageGroup()->removeUserStyleSheetFromWorld(mainThreadNormalWorld(), captionsStyleSheetURL);
+    
+    if (!userHasCaptionPreferences())
+        return;
+    
+    String captionsOverrideStyleSheet = captionsStyleSheetOverride();
+    if (captionsOverrideStyleSheet.isEmpty())
+        return;
+    
+    pageGroup()->addUserStyleSheetToWorld(mainThreadNormalWorld(), captionsOverrideStyleSheet, captionsStyleSheetURL, Vector<String>(),
+             Vector<String>(), InjectInAllFrames, UserStyleAuthorLevel, InjectInExistingDocuments);
+}
+
+}
+
+#endif // ENABLE(VIDEO_TRACK)
diff --git a/Source/WebCore/page/ChromeClient.h b/Source/WebCore/page/ChromeClient.h
index 7a505de2a..35c32328c 100644
--- a/Source/WebCore/page/ChromeClient.h
+++ b/Source/WebCore/page/ChromeClient.h
@@ -226,8 +226,14 @@ namespace WebCore {
         virtual PassOwnPtr<ColorChooser> createColorChooser(ColorChooserClient*, const Color&) = 0;
 #endif
 
-#if ENABLE(CALENDAR_PICKER)
-        virtual PassOwnPtr<DateTimeChooser> openDateTimeChooser(DateTimeChooserClient*, const DateTimeChooserParameters&) = 0;
+#if ENABLE(DATE_AND_TIME_INPUT_TYPES)
+        // This function is used for:
+        //  - Mandatory date/time choosers if !ENABLE(INPUT_MULTIPLE_FIELDS_UI)
+        //  - Date/time choosers for types for which RenderTheme::supportsCalendarPicker
+        //    returns true, if ENABLE(INPUT_MULTIPLE_FIELDS_UI)
+        //  - <datalist> UI for date/time input types regardless of
+        //    ENABLE(INPUT_MULTIPLE_FIELDS_UI)
+        virtual PassRefPtr<DateTimeChooser> openDateTimeChooser(DateTimeChooserClient*, const DateTimeChooserParameters&) = 0;
 #endif
 
         virtual void runOpenPanel(Frame*, PassRefPtr<FileChooser>) = 0;
@@ -364,6 +370,8 @@ namespace WebCore {
 
         virtual FloatSize minimumWindowSize() const { return FloatSize(100, 100); };
 
+        virtual bool isEmptyChromeClient() const { return false; }
+
     protected:
         virtual ~ChromeClient() { }
     };
diff --git a/Source/WebCore/page/Console.cpp b/Source/WebCore/page/Console.cpp
index 971337728..7c25d5433 100644
--- a/Source/WebCore/page/Console.cpp
+++ b/Source/WebCore/page/Console.cpp
@@ -134,10 +134,10 @@ static void printMessageSourceAndLevelPrefix(MessageSource source, MessageLevel
 
 void Console::addMessage(MessageSource source, MessageType type, MessageLevel level, const String& message, PassRefPtr<ScriptCallStack> callStack)
 {
-    addMessage(source, type, level, message, String(), 0, callStack);
+    addMessage(source, type, level, message, String(), 0, callStack, 0);
 }
 
-void Console::addMessage(MessageSource source, MessageType type, MessageLevel level, const String& message, const String& sourceURL, unsigned lineNumber, PassRefPtr<ScriptCallStack> callStack)
+void Console::addMessage(MessageSource source, MessageType type, MessageLevel level, const String& message, const String& url, unsigned lineNumber, PassRefPtr<ScriptCallStack> callStack, unsigned long requestIdentifier)
 {
 
     if (muteCount && source != ConsoleAPIMessageSource)
@@ -147,17 +147,17 @@ void Console::addMessage(MessageSource source, MessageType type, MessageLevel le
     if (!page)
         return;
 
-    page->chrome()->client()->addMessageToConsole(source, type, level, message, lineNumber, sourceURL);
+    page->chrome()->client()->addMessageToConsole(source, type, level, message, lineNumber, url);
 
     if (callStack)
-        InspectorInstrumentation::addMessageToConsole(page, source, type, level, message, 0, callStack);
+        InspectorInstrumentation::addMessageToConsole(page, source, type, level, message, 0, callStack, requestIdentifier);
     else
-        InspectorInstrumentation::addMessageToConsole(page, source, type, level, message, sourceURL, lineNumber);
+        InspectorInstrumentation::addMessageToConsole(page, source, type, level, message, url, lineNumber, requestIdentifier);
 
     if (!Console::shouldPrintExceptions())
         return;
 
-    printSourceURLAndLine(sourceURL, lineNumber);
+    printSourceURLAndLine(url, lineNumber);
     printMessageSourceAndLevelPrefix(source, level);
 
     printf(" %s\n", message.utf8().data());
@@ -232,6 +232,11 @@ void Console::dirxml(PassRefPtr<ScriptArguments> arguments, PassRefPtr<ScriptCal
     addMessage(DirXMLMessageType, LogMessageLevel, arguments, callStack);
 }
 
+void Console::clear(PassRefPtr<ScriptArguments> arguments, PassRefPtr<ScriptCallStack> callStack)
+{
+    addMessage(ClearMessageType, LogMessageLevel, arguments, callStack, true);
+}
+
 void Console::trace(PassRefPtr<ScriptArguments> arguments, PassRefPtr<ScriptCallStack> prpCallStack)
 {
     RefPtr<ScriptCallStack> callStack = prpCallStack;
diff --git a/Source/WebCore/page/Console.h b/Source/WebCore/page/Console.h
index 916794ea1..7af571eb7 100644
--- a/Source/WebCore/page/Console.h
+++ b/Source/WebCore/page/Console.h
@@ -55,13 +55,14 @@ public:
     static PassRefPtr<Console> create(Frame* frame) { return adoptRef(new Console(frame)); }
     virtual ~Console();
 
-    void addMessage(MessageSource, MessageType, MessageLevel, const String& message, const String& sourceURL = String(), unsigned lineNumber = 0, PassRefPtr<ScriptCallStack> = 0);
+    void addMessage(MessageSource, MessageType, MessageLevel, const String& message, const String& sourceURL = String(), unsigned lineNumber = 0, PassRefPtr<ScriptCallStack> = 0, unsigned long requestIdentifier = 0);
     void addMessage(MessageSource, MessageType, MessageLevel, const String& message, PassRefPtr<ScriptCallStack>);
 
     void debug(PassRefPtr<ScriptArguments>, PassRefPtr<ScriptCallStack>);
     void error(PassRefPtr<ScriptArguments>, PassRefPtr<ScriptCallStack>);
     void info(PassRefPtr<ScriptArguments>, PassRefPtr<ScriptCallStack>);
     void log(PassRefPtr<ScriptArguments>, PassRefPtr<ScriptCallStack>);
+    void clear(PassRefPtr<ScriptArguments>, PassRefPtr<ScriptCallStack>);
     void warn(PassRefPtr<ScriptArguments>, PassRefPtr<ScriptCallStack>);
     void dir(PassRefPtr<ScriptArguments>, PassRefPtr<ScriptCallStack>);
     void dirxml(PassRefPtr<ScriptArguments>, PassRefPtr<ScriptCallStack>);
diff --git a/Source/WebCore/page/Console.idl b/Source/WebCore/page/Console.idl
index 1f2b96ac6..6ac070f3b 100644
--- a/Source/WebCore/page/Console.idl
+++ b/Source/WebCore/page/Console.idl
@@ -58,6 +58,7 @@
     [CallWith=ScriptArguments|CallStack] void group();
     [CallWith=ScriptArguments|CallStack] void groupCollapsed();
     void groupEnd();
+    [CallWith=ScriptArguments|CallStack] void clear();
 
     [V8CustomGetter] readonly attribute MemoryInfo memory;
 };
diff --git a/Source/WebCore/page/ConsoleTypes.h b/Source/WebCore/page/ConsoleTypes.h
index 8b44030c6..b01f7ce7a 100644
--- a/Source/WebCore/page/ConsoleTypes.h
+++ b/Source/WebCore/page/ConsoleTypes.h
@@ -47,6 +47,7 @@ enum MessageType {
     StartGroupMessageType,
     StartGroupCollapsedMessageType,
     EndGroupMessageType,
+    ClearMessageType,
     AssertMessageType
 };
 
diff --git a/Source/WebCore/page/ContentSecurityPolicy.cpp b/Source/WebCore/page/ContentSecurityPolicy.cpp
index 14bbc1367..81c37ff37 100644
--- a/Source/WebCore/page/ContentSecurityPolicy.cpp
+++ b/Source/WebCore/page/ContentSecurityPolicy.cpp
@@ -142,6 +142,22 @@ bool isDirectiveName(const String& name)
     );
 }
 
+FeatureObserver::Feature getFeatureObserverType(ContentSecurityPolicy::HeaderType type)
+{
+    switch (type) {
+    case ContentSecurityPolicy::EnforceAllDirectives:
+        return FeatureObserver::PrefixedContentSecurityPolicy;
+    case ContentSecurityPolicy::EnforceStableDirectives:
+        return FeatureObserver::ContentSecurityPolicy;
+    case ContentSecurityPolicy::ReportAllDirectives:
+        return FeatureObserver::PrefixedContentSecurityPolicyReportOnly;
+    case ContentSecurityPolicy::ReportStableDirectives:
+        return FeatureObserver::ContentSecurityPolicyReportOnly;
+    }
+    ASSERT_NOT_REACHED();
+    return FeatureObserver::NumberOfFeatures;
+}
+
 } // namespace
 
 static bool skipExactly(const UChar*& position, const UChar* end, UChar delimiter)
@@ -772,7 +788,7 @@ public:
     static PassOwnPtr<CSPDirectiveList> create(ContentSecurityPolicy*, const String&, ContentSecurityPolicy::HeaderType);
 
     const String& header() const { return m_header; }
-    ContentSecurityPolicy::HeaderType headerType() const { return m_reportOnly ? ContentSecurityPolicy::ReportOnly : ContentSecurityPolicy::EnforcePolicy; }
+    ContentSecurityPolicy::HeaderType headerType() const { return m_headerType; }
 
     bool allowJavaScriptURLs(const String& contextURL, const WTF::OrdinalNumber& contextLine, ContentSecurityPolicy::ReportingStatus) const;
     bool allowInlineEventHandlers(const String& contextURL, const WTF::OrdinalNumber& contextLine, ContentSecurityPolicy::ReportingStatus) const;
@@ -796,7 +812,7 @@ public:
     const String& evalDisabledErrorMessage() { return m_evalDisabledErrorMessage; }
 
 private:
-    explicit CSPDirectiveList(ContentSecurityPolicy*);
+    CSPDirectiveList(ContentSecurityPolicy*, ContentSecurityPolicy::HeaderType);
 
     void parse(const String&);
 
@@ -833,7 +849,9 @@ private:
     ContentSecurityPolicy* m_policy;
 
     String m_header;
+    ContentSecurityPolicy::HeaderType m_headerType;
 
+    bool m_experimental;
     bool m_reportOnly;
     bool m_haveSandboxPolicy;
 
@@ -855,27 +873,21 @@ private:
     String m_evalDisabledErrorMessage;
 };
 
-CSPDirectiveList::CSPDirectiveList(ContentSecurityPolicy* policy)
+CSPDirectiveList::CSPDirectiveList(ContentSecurityPolicy* policy, ContentSecurityPolicy::HeaderType type)
     : m_policy(policy)
+    , m_headerType(type)
+    , m_experimental(false)
     , m_reportOnly(false)
     , m_haveSandboxPolicy(false)
 {
+    m_reportOnly = (type == ContentSecurityPolicy::ReportStableDirectives || type == ContentSecurityPolicy::ReportAllDirectives);
+    m_experimental = (type == ContentSecurityPolicy::ReportAllDirectives || type == ContentSecurityPolicy::EnforceAllDirectives);
 }
 
 PassOwnPtr<CSPDirectiveList> CSPDirectiveList::create(ContentSecurityPolicy* policy, const String& header, ContentSecurityPolicy::HeaderType type)
 {
-    OwnPtr<CSPDirectiveList> directives = adoptPtr(new CSPDirectiveList(policy));
+    OwnPtr<CSPDirectiveList> directives = adoptPtr(new CSPDirectiveList(policy, type));
     directives->parse(header);
-    directives->m_header = header;
-
-    switch (type) {
-    case ContentSecurityPolicy::ReportOnly:
-        directives->m_reportOnly = true;
-        return directives.release();
-    case ContentSecurityPolicy::EnforcePolicy:
-        ASSERT(!directives->m_reportOnly);
-        break;
-    }
 
     if (!directives->checkEval(directives->operativeDirective(directives->m_scriptSrc.get()))) {
         String message = makeString("Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: \"", directives->operativeDirective(directives->m_scriptSrc.get())->text(), "\".\n");
@@ -1151,6 +1163,7 @@ bool CSPDirectiveList::allowFormAction(const KURL& url, ContentSecurityPolicy::R
 //
 void CSPDirectiveList::parse(const String& policy)
 {
+    m_header = policy;
     if (policy.isEmpty())
         return;
 
@@ -1194,7 +1207,7 @@ bool CSPDirectiveList::parseDirective(const UChar* begin, const UChar* end, Stri
     // The directive-name must be non-empty.
     if (nameBegin == position) {
         skipWhile<isNotASCIISpace>(position, end);
-        m_policy->reportUnrecognizedDirective(String(nameBegin, position - nameBegin));
+        m_policy->reportUnsupportedDirective(String(nameBegin, position - nameBegin));
         return false;
     }
 
@@ -1205,7 +1218,7 @@ bool CSPDirectiveList::parseDirective(const UChar* begin, const UChar* end, Stri
 
     if (!skipExactly<isASCIISpace>(position, end)) {
         skipWhile<isNotASCIISpace>(position, end);
-        m_policy->reportUnrecognizedDirective(String(nameBegin, position - nameBegin));
+        m_policy->reportUnsupportedDirective(String(nameBegin, position - nameBegin));
         return false;
     }
 
@@ -1297,15 +1310,17 @@ void CSPDirectiveList::addDirective(const String& name, const String& value)
     else if (equalIgnoringCase(name, reportURI))
         parseReportURI(name, value);
 #if ENABLE(CSP_NEXT)
-    else if (equalIgnoringCase(name, formAction))
-        setCSPDirective<SourceListDirective>(name, value, m_formAction);
-    else if (equalIgnoringCase(name, pluginTypes))
-        setCSPDirective<MediaListDirective>(name, value, m_pluginTypes);
-    else if (equalIgnoringCase(name, scriptNonce))
-        setCSPDirective<NonceDirective>(name, value, m_scriptNonce);
+    else if (m_experimental) {
+        if (equalIgnoringCase(name, formAction))
+            setCSPDirective<SourceListDirective>(name, value, m_formAction);
+        else if (equalIgnoringCase(name, pluginTypes))
+            setCSPDirective<MediaListDirective>(name, value, m_pluginTypes);
+        else if (equalIgnoringCase(name, scriptNonce))
+            setCSPDirective<NonceDirective>(name, value, m_scriptNonce);
+    }
 #endif
     else
-        m_policy->reportUnrecognizedDirective(name);
+        m_policy->reportUnsupportedDirective(name);
 }
 
 ContentSecurityPolicy::ContentSecurityPolicy(ScriptExecutionContext* scriptExecutionContext)
@@ -1330,7 +1345,7 @@ void ContentSecurityPolicy::didReceiveHeader(const String& header, HeaderType ty
     if (m_scriptExecutionContext->isDocument()) {
         Document* document = static_cast<Document*>(m_scriptExecutionContext);
         if (document->domWindow())
-            FeatureObserver::observe(document->domWindow(), FeatureObserver::PrefixedContentSecurityPolicy);
+            FeatureObserver::observe(document->domWindow(), getFeatureObserverType(type));
     }
 
     // RFC2616, section 4.2 specifies that headers appearing multiple times can
@@ -1368,7 +1383,7 @@ const String& ContentSecurityPolicy::deprecatedHeader() const
 
 ContentSecurityPolicy::HeaderType ContentSecurityPolicy::deprecatedHeaderType() const
 {
-    return m_policies.isEmpty() ? EnforcePolicy : m_policies[0]->headerType();
+    return m_policies.isEmpty() ? EnforceStableDirectives : m_policies[0]->headerType();
 }
 
 template<bool (CSPDirectiveList::*allowed)(ContentSecurityPolicy::ReportingStatus) const>
@@ -1594,12 +1609,26 @@ void ContentSecurityPolicy::reportViolation(const String& directiveText, const S
     RefPtr<FormData> report = FormData::create(reportObject->toJSONString().utf8());
 
     for (size_t i = 0; i < reportURIs.size(); ++i)
-        PingLoader::reportContentSecurityPolicyViolation(frame, reportURIs[i], report);
+        PingLoader::sendViolationReport(frame, reportURIs[i], report);
 }
 
-void ContentSecurityPolicy::reportUnrecognizedDirective(const String& name) const
+void ContentSecurityPolicy::reportUnsupportedDirective(const String& name) const
 {
+    DEFINE_STATIC_LOCAL(String, allow, (ASCIILiteral("allow")));
+    DEFINE_STATIC_LOCAL(String, options, (ASCIILiteral("options")));
+    DEFINE_STATIC_LOCAL(String, policyURI, (ASCIILiteral("policy-uri")));
+    DEFINE_STATIC_LOCAL(String, allowMessage, (ASCIILiteral("The 'allow' directive has been replaced with 'default-src'. Please use that directive instead, as 'allow' has no effect.")));
+    DEFINE_STATIC_LOCAL(String, optionsMessage, (ASCIILiteral("The 'options' directive has been replaced with 'unsafe-inline' and 'unsafe-eval' source expressions for the 'script-src' and 'style-src' directives. Please use those directives instead, as 'options' has no effect.")));
+    DEFINE_STATIC_LOCAL(String, policyURIMessage, (ASCIILiteral("The 'policy-uri' directive has been removed from the specification. Please specify a complete policy via the Content-Security-Policy header.")));
+
     String message = makeString("Unrecognized Content-Security-Policy directive '", name, "'.\n");
+    if (equalIgnoringCase(name, allow))
+        message = allowMessage;
+    else if (equalIgnoringCase(name, options))
+        message = optionsMessage;
+    else if (equalIgnoringCase(name, policyURI))
+        message = policyURIMessage;
+
     logToConsole(message);
 }
 
diff --git a/Source/WebCore/page/ContentSecurityPolicy.h b/Source/WebCore/page/ContentSecurityPolicy.h
index 8c8e8675f..f09d9e639 100644
--- a/Source/WebCore/page/ContentSecurityPolicy.h
+++ b/Source/WebCore/page/ContentSecurityPolicy.h
@@ -60,8 +60,10 @@ public:
     void copyStateFrom(const ContentSecurityPolicy*);
 
     enum HeaderType {
-        ReportOnly,
-        EnforcePolicy
+        ReportStableDirectives,
+        EnforceStableDirectives,
+        ReportAllDirectives,
+        EnforceAllDirectives
     };
 
     enum ReportingStatus {
@@ -106,7 +108,7 @@ public:
     void reportInvalidNonce(const String&) const;
     void reportInvalidPluginTypes(const String&) const;
     void reportInvalidSourceExpression(const String& directiveName, const String& source) const;
-    void reportUnrecognizedDirective(const String&) const;
+    void reportUnsupportedDirective(const String&) const;
     void reportViolation(const String& directiveText, const String& consoleMessage, const KURL& blockedURL, const Vector<KURL>& reportURIs, const String& header, const String& contextURL = String(), const WTF::OrdinalNumber& contextLine = WTF::OrdinalNumber::beforeFirst(), ScriptState* = 0) const;
 
     void reportBlockedScriptExecutionToInspector(const String& directiveText) const;
diff --git a/Source/WebCore/page/ContextMenuController.cpp b/Source/WebCore/page/ContextMenuController.cpp
index d9019fc30..eae4bff43 100644
--- a/Source/WebCore/page/ContextMenuController.cpp
+++ b/Source/WebCore/page/ContextMenuController.cpp
@@ -179,10 +179,14 @@ static void openNewWindow(const KURL& urlToLoad, Frame* frame)
 {
     if (Page* oldPage = frame->page()) {
         FrameLoadRequest request(frame->document()->securityOrigin(), ResourceRequest(urlToLoad, frame->loader()->outgoingReferrer()));
-        if (Page* newPage = oldPage->chrome()->createWindow(frame, request, WindowFeatures(), NavigationAction(request.resourceRequest()))) {
-            newPage->mainFrame()->loader()->loadFrameRequest(request, false, false, 0, 0, MaybeSendReferrer);
+        Page* newPage = oldPage;
+        if (!frame->settings() || frame->settings()->supportsMultipleWindows()) {
+            newPage = oldPage->chrome()->createWindow(frame, request, WindowFeatures(), NavigationAction(request.resourceRequest()));
+            if (!newPage)
+                return;
             newPage->chrome()->show();
         }
+        newPage->mainFrame()->loader()->loadFrameRequest(request, false, false, 0, 0, MaybeSendReferrer);
     }
 }
 
diff --git a/Source/WebCore/page/DOMSecurityPolicy.idl b/Source/WebCore/page/DOMSecurityPolicy.idl
index c9ff043d8..2e17fb745 100644
--- a/Source/WebCore/page/DOMSecurityPolicy.idl
+++ b/Source/WebCore/page/DOMSecurityPolicy.idl
@@ -27,9 +27,12 @@
     OmitConstructor,
     InterfaceName=SecurityPolicy
 ] interface DOMSecurityPolicy {
-    readonly attribute DOMStringList reportURIs;
+    readonly attribute boolean allowsEval;
+    readonly attribute boolean allowsInlineScript;
+    readonly attribute boolean allowsInlineStyle;
+    readonly attribute boolean isActive;
 
-    boolean isActive();
+    readonly attribute DOMStringList reportURIs;
 
     boolean allowsConnectionTo(in DOMString url);
     boolean allowsFontFrom(in DOMString url);
@@ -41,9 +44,4 @@
     boolean allowsPluginType(in DOMString type);
     boolean allowsScriptFrom(in DOMString url);
     boolean allowsStyleFrom(in DOMString url);
-
-    boolean allowsEval();
-    boolean allowsInlineScript();
-    boolean allowsInlineStyle();
 };
-
diff --git a/Source/WebCore/page/DOMTimer.cpp b/Source/WebCore/page/DOMTimer.cpp
index 7d6831196..e07e70029 100644
--- a/Source/WebCore/page/DOMTimer.cpp
+++ b/Source/WebCore/page/DOMTimer.cpp
@@ -41,8 +41,6 @@ namespace WebCore {
 static const int maxIntervalForUserGestureForwarding = 1000; // One second matches Gecko.
 static const int maxTimerNestingLevel = 5;
 static const double oneMillisecond = 0.001;
-double DOMTimer::s_minDefaultTimerInterval = 0.010; // 10 milliseconds
-double DOMTimer::s_defaultTimerAlignmentInterval = 0;
 
 static int timerNestingLevel = 0;
     
diff --git a/Source/WebCore/page/DOMTimer.h b/Source/WebCore/page/DOMTimer.h
index d23898de0..e9c1446b3 100644
--- a/Source/WebCore/page/DOMTimer.h
+++ b/Source/WebCore/page/DOMTimer.h
@@ -35,10 +35,8 @@
 namespace WebCore {
 
     class ScheduledAction;
-    class Settings;
 
     class DOMTimer : public SuspendableTimer {
-        friend class Settings;
     public:
         virtual ~DOMTimer();
         // Creates a new timer owned by specified ScriptExecutionContext, starts it
@@ -61,27 +59,14 @@ namespace WebCore {
 
         double intervalClampedToMinimum(int timeout, double minimumTimerInterval) const;
 
-        // The default minimum allowable timer setting (in seconds, 0.001 == 1 ms).
-        // These are only modified via static methods in Settings.
-        static double defaultMinTimerInterval() { return s_minDefaultTimerInterval; }
-        static void setDefaultMinTimerInterval(double value) { s_minDefaultTimerInterval = value; }
-
         // Retuns timer fire time rounded to the next multiple of timer alignment interval.
         virtual double alignedFireTime(double) const;
 
-        // The default timer alignment interval (in seconds). If non zero, timer fire times
-        // will be rounded to a multiple of the alignment interval.
-        // These are only modified via static methods in Settings.
-        static double defaultTimerAlignmentInterval() { return s_defaultTimerAlignmentInterval; }
-        static void setDefaultTimerAlignmentInterval(double value) { s_defaultTimerAlignmentInterval = value; }
-
         int m_timeoutId;
         int m_nestingLevel;
         OwnPtr<ScheduledAction> m_action;
         int m_originalInterval;
         RefPtr<UserGestureIndicator::Token> m_userGestureToken;
-        static double s_minDefaultTimerInterval;
-        static double s_defaultTimerAlignmentInterval;
     };
 
 } // namespace WebCore
diff --git a/Source/WebCore/page/DOMWindow.idl b/Source/WebCore/page/DOMWindow.idl
index 5b3ab2af4..b1064a068 100644
--- a/Source/WebCore/page/DOMWindow.idl
+++ b/Source/WebCore/page/DOMWindow.idl
@@ -42,21 +42,21 @@
     InterfaceName=Window
 ] interface DOMWindow {
     // DOM Level 0
-    attribute [Replaceable] Screen screen;
-    attribute [Replaceable, DoNotCheckSecurityOnGetter] History history;
-    attribute [Replaceable] BarInfo locationbar;
-    attribute [Replaceable] BarInfo menubar;
-    attribute [Replaceable] BarInfo personalbar;
-    attribute [Replaceable] BarInfo scrollbars;
-    attribute [Replaceable] BarInfo statusbar;
-    attribute [Replaceable] BarInfo toolbar;
-    attribute [Replaceable] Navigator navigator;
-    attribute [Replaceable] Navigator clientInformation;
+    [Replaceable] readonly attribute Screen screen;
+    [Replaceable, DoNotCheckSecurityOnGetter] readonly attribute History history;
+    [Replaceable] readonly attribute BarInfo locationbar;
+    [Replaceable] readonly attribute BarInfo menubar;
+    [Replaceable] readonly attribute BarInfo personalbar;
+    [Replaceable] readonly attribute BarInfo scrollbars;
+    [Replaceable] readonly attribute BarInfo statusbar;
+    [Replaceable] readonly attribute BarInfo toolbar;
+    [Replaceable] readonly attribute Navigator navigator;
+    [Replaceable] readonly attribute Navigator clientInformation;
     readonly attribute Crypto crypto;
 #if !defined(LANGUAGE_CPP) || !LANGUAGE_CPP
     attribute [DoNotCheckSecurity, CustomSetter, V8Unforgeable] Location location;
 #endif
-    attribute [Replaceable, CustomGetter, V8CustomSetter] Event event;
+    [Replaceable, CustomGetter, V8CustomSetter] readonly attribute Event event;
 
     DOMSelection getSelection();
 
@@ -90,18 +90,18 @@
                  in [Optional=DefaultIsUndefined] boolean searchInFrames,
                  in [Optional=DefaultIsUndefined] boolean showDialog);
 
-    attribute [Replaceable] boolean offscreenBuffering;
-
-    attribute [Replaceable] long outerHeight;
-    attribute [Replaceable] long outerWidth;
-    attribute [Replaceable] long innerHeight;
-    attribute [Replaceable] long innerWidth;
-    attribute [Replaceable] long screenX;
-    attribute [Replaceable] long screenY;
-    attribute [Replaceable] long screenLeft;
-    attribute [Replaceable] long screenTop;
-    attribute [Replaceable] long scrollX;
-    attribute [Replaceable] long scrollY;
+    [Replaceable] readonly attribute  boolean offscreenBuffering;
+
+    [Replaceable] readonly attribute long outerHeight;
+    [Replaceable] readonly attribute long outerWidth;
+    [Replaceable] readonly attribute long innerHeight;
+    [Replaceable] readonly attribute long innerWidth;
+    [Replaceable] readonly attribute long screenX;
+    [Replaceable] readonly attribute long screenY;
+    [Replaceable] readonly attribute long screenLeft;
+    [Replaceable] readonly attribute long screenTop;
+    [Replaceable] readonly attribute long scrollX;
+    [Replaceable] readonly attribute long scrollY;
     readonly attribute long pageXOffset;
     readonly attribute long pageYOffset;
 
@@ -115,7 +115,7 @@
 
     readonly attribute [DoNotCheckSecurity] boolean closed;
 
-    attribute [Replaceable, DoNotCheckSecurityOnGetter] unsigned long length;
+    [Replaceable, DoNotCheckSecurityOnGetter] readonly attribute unsigned long length;
 
     attribute DOMString name;
 
@@ -127,13 +127,13 @@
 #endif
 
     // Self referential attributes
-    attribute [Replaceable, DoNotCheckSecurityOnGetter] DOMWindow self;
-    readonly attribute [DoNotCheckSecurity, V8Unforgeable] DOMWindow window;
-    attribute [Replaceable, DoNotCheckSecurityOnGetter] DOMWindow frames;
+    [Replaceable, DoNotCheckSecurityOnGetter] readonly attribute DOMWindow self;
+    [DoNotCheckSecurity, V8Unforgeable] readonly attribute DOMWindow window;
+    [Replaceable, DoNotCheckSecurityOnGetter] readonly attribute  DOMWindow frames;
 
-    attribute [Replaceable, DoNotCheckSecurityOnGetter, V8CustomSetter] DOMWindow opener;
-    attribute [Replaceable, DoNotCheckSecurityOnGetter] DOMWindow parent;
-    readonly attribute [DoNotCheckSecurityOnGetter, V8Unforgeable] DOMWindow top;
+    [Replaceable, DoNotCheckSecurityOnGetter, V8CustomSetter] readonly attribute DOMWindow opener;
+    [Replaceable, DoNotCheckSecurityOnGetter] readonly attribute DOMWindow parent;
+    [DoNotCheckSecurityOnGetter, V8Unforgeable] readonly attribute DOMWindow top;
 
     // DOM Level 2 AbstractView Interface
     readonly attribute Document document;
@@ -154,7 +154,7 @@
                                    in [TreatNullAs=NullString, TreatUndefinedAs=NullString,Optional=DefaultIsUndefined] DOMString pseudoElement);
 #endif
 
-    attribute [Replaceable] double devicePixelRatio;
+    [Replaceable] readonly attribute double devicePixelRatio;
     
     WebKitPoint webkitConvertPointFromPageToNode(in [Optional=DefaultIsUndefined] Node node, 
                                                  in [Optional=DefaultIsUndefined] WebKitPoint p);
@@ -175,7 +175,7 @@
     readonly attribute long orientation;
 #endif
 
-             attribute [Replaceable] Console console;
+    [Replaceable] readonly attribute Console console;
 
     // cross-document messaging
 #if defined(LANGUAGE_JAVASCRIPT) && LANGUAGE_JAVASCRIPT
@@ -198,7 +198,7 @@
 #endif
 
 #if defined(ENABLE_WEB_TIMING) && ENABLE_WEB_TIMING
-    attribute [Replaceable] Performance performance;
+    [Replaceable] readonly attribute Performance performance;
 #endif
 
     // Timers
@@ -392,9 +392,9 @@
     attribute EntityConstructor Entity;
     attribute EntityReferenceConstructor EntityReference;
     attribute ProcessingInstructionConstructor ProcessingInstruction;
-    [Conditional=SHADOW_DOM, V8EnabledAtRuntime=shadowDOM] attribute ShadowRootConstructor WebKitShadowRoot;
-    [Conditional=SHADOW_DOM, V8EnabledAtRuntime=shadowDOM] attribute HTMLContentElementConstructor HTMLContentElement;
-    [Conditional=SHADOW_DOM, V8EnabledAtRuntime=shadowDOM] attribute HTMLShadowElementConstructor HTMLShadowElement;
+    [Conditional=SHADOW_DOM, V8EnabledPerContext=shadowDOM] attribute ShadowRootConstructor WebKitShadowRoot;
+    [Conditional=SHADOW_DOM, V8EnabledPerContext=shadowDOM] attribute HTMLContentElementConstructor HTMLContentElement;
+    [Conditional=SHADOW_DOM, V8EnabledPerContext=shadowDOM] attribute HTMLShadowElementConstructor HTMLShadowElement;
 
     attribute DOMSelectionConstructor Selection;
     attribute DOMWindowConstructor Window;
diff --git a/Source/WebCore/page/DOMWindowPagePopup.cpp b/Source/WebCore/page/DOMWindowPagePopup.cpp
index 62ba2c396..86076dab6 100644
--- a/Source/WebCore/page/DOMWindowPagePopup.cpp
+++ b/Source/WebCore/page/DOMWindowPagePopup.cpp
@@ -45,6 +45,7 @@ DOMWindowPagePopup::DOMWindowPagePopup(PagePopupClient* popupClient)
 
 DOMWindowPagePopup::~DOMWindowPagePopup()
 {
+    m_controller->clearPagePopupClient();
 }
 
 const AtomicString& DOMWindowPagePopup::supplementName()
diff --git a/Source/WebCore/page/DragController.cpp b/Source/WebCore/page/DragController.cpp
index 2e0aafb96..81ea3f95d 100644
--- a/Source/WebCore/page/DragController.cpp
+++ b/Source/WebCore/page/DragController.cpp
@@ -96,10 +96,10 @@ DragController::DragController(Page* page, DragClient* client)
     , m_documentUnderMouse(0)
     , m_dragInitiator(0)
     , m_fileInputElementUnderMouse(0)
+    , m_documentIsHandlingDrag(false)
     , m_dragDestinationAction(DragDestinationActionNone)
     , m_dragSourceAction(DragSourceActionNone)
     , m_didInitiateDrag(false)
-    , m_isHandlingDrag(false)
     , m_sourceDragOperation(DragOperationNone)
 {
     ASSERT(m_client);
@@ -209,7 +209,7 @@ bool DragController::performDrag(DragData* dragData)
 {
     ASSERT(dragData);
     m_documentUnderMouse = m_page->mainFrame()->documentAtPoint(dragData->clientPosition());
-    if (m_dragDestinationAction & DragDestinationActionDHTML) {
+    if ((m_dragDestinationAction & DragDestinationActionDHTML) && m_documentIsHandlingDrag) {
         m_client->willPerformDragDestinationAction(DragDestinationActionDHTML, dragData);
         RefPtr<Frame> mainFrame = m_page->mainFrame();
         bool preventedDefault = false;
@@ -265,8 +265,8 @@ DragSession DragController::dragEnteredOrUpdated(DragData* dragData)
     }
 
     DragSession dragSession;
-    bool handledByDocument = tryDocumentDrag(dragData, m_dragDestinationAction, dragSession);
-    if (!handledByDocument && (m_dragDestinationAction & DragDestinationActionLoad))
+    m_documentIsHandlingDrag = tryDocumentDrag(dragData, m_dragDestinationAction, dragSession);
+    if (!m_documentIsHandlingDrag && (m_dragDestinationAction & DragDestinationActionLoad))
         dragSession.operation = operationForLoad(dragData);
     return dragSession;
 }
@@ -314,9 +314,9 @@ bool DragController::tryDocumentDrag(DragData* dragData, DragDestinationAction a
     if (m_dragInitiator && !m_documentUnderMouse->securityOrigin()->canReceiveDragData(m_dragInitiator->securityOrigin()))
         return false;
 
-    m_isHandlingDrag = false;
+    bool isHandlingDrag = false;
     if (actionMask & DragDestinationActionDHTML) {
-        m_isHandlingDrag = tryDHTMLDrag(dragData, dragSession.operation);
+        isHandlingDrag = tryDHTMLDrag(dragData, dragSession.operation);
         // Do not continue if m_documentUnderMouse has been reset by tryDHTMLDrag.
         // tryDHTMLDrag fires dragenter event. The event listener that listens
         // to this event may create a nested message loop (open a modal dialog),
@@ -332,10 +332,12 @@ bool DragController::tryDocumentDrag(DragData* dragData, DragDestinationAction a
     if (!frameView)
         return false;
 
-    if (m_isHandlingDrag) {
+    if (isHandlingDrag) {
         m_page->dragCaretController()->clear();
         return true;
-    } else if ((actionMask & DragDestinationActionEdit) && canProcessDrag(dragData)) {
+    }
+
+    if ((actionMask & DragDestinationActionEdit) && canProcessDrag(dragData)) {
         if (dragData->containsColor()) {
             dragSession.operation = DragOperationGeneric;
             return true;
diff --git a/Source/WebCore/page/DragController.h b/Source/WebCore/page/DragController.h
index 74d61782e..c7927cb47 100644
--- a/Source/WebCore/page/DragController.h
+++ b/Source/WebCore/page/DragController.h
@@ -68,8 +68,6 @@ namespace WebCore {
         // drag logic is in WebCore.
         void setDidInitiateDrag(bool initiated) { m_didInitiateDrag = initiated; } 
         bool didInitiateDrag() const { return m_didInitiateDrag; }
-        void setIsHandlingDrag(bool handling) { m_isHandlingDrag = handling; }
-        bool isHandlingDrag() const { return m_isHandlingDrag; }
         DragOperation sourceDragOperation() const { return m_sourceDragOperation; }
         const KURL& draggingImageURL() const { return m_draggingImageURL; }
         void setDragOffset(const IntPoint& offset) { m_dragOffset = offset; }
@@ -119,15 +117,15 @@ namespace WebCore {
 
         Page* m_page;
         DragClient* m_client;
-        
+
         RefPtr<Document> m_documentUnderMouse; // The document the mouse was last dragged over.
         RefPtr<Document> m_dragInitiator; // The Document (if any) that initiated the drag.
         RefPtr<HTMLInputElement> m_fileInputElementUnderMouse;
-        
+        bool m_documentIsHandlingDrag;
+
         DragDestinationAction m_dragDestinationAction;
         DragSourceAction m_dragSourceAction;
         bool m_didInitiateDrag;
-        bool m_isHandlingDrag;
         DragOperation m_sourceDragOperation; // Set in startDrag when a drag starts from a mouse down within WebKit
         IntPoint m_dragOffset;
         KURL m_draggingImageURL;
diff --git a/Source/WebCore/page/EventHandler.cpp b/Source/WebCore/page/EventHandler.cpp
index 5ef0c61da..92055a123 100644
--- a/Source/WebCore/page/EventHandler.cpp
+++ b/Source/WebCore/page/EventHandler.cpp
@@ -418,14 +418,21 @@ bool EventHandler::updateSelectionForMouseDownDispatchingSelectStart(Node* targe
     if (!dispatchSelectStart(targetNode))
         return false;
 
-    if (newSelection.isRange())
+    VisibleSelection selection(newSelection);
+#if ENABLE(USERSELECT_ALL)
+    if (Node* rootUserSelectAll = Position::rootUserSelectAllForNode(targetNode)) {
+        selection.setBase(positionBeforeNode(rootUserSelectAll).upstream(CanCrossEditingBoundary));
+        selection.setExtent(positionAfterNode(rootUserSelectAll).downstream(CanCrossEditingBoundary));
+    }
+#endif
+    if (selection.isRange())
         m_selectionInitiationState = ExtendedSelection;
     else {
         granularity = CharacterGranularity;
         m_selectionInitiationState = PlacedCaret;
     }
 
-    m_frame->selection()->setNonDirectionalSelectionIfNeeded(newSelection, granularity);
+    m_frame->selection()->setNonDirectionalSelectionIfNeeded(selection, granularity);
 
     return true;
 }
@@ -844,7 +851,28 @@ void EventHandler::updateSelectionForMouseDrag(const HitTestResult& hitTestResul
         newSelection = VisibleSelection(targetPosition);
     }
 
+#if ENABLE(USERSELECT_ALL)
+    Node* rootUserSelectAllForMousePressNode = Position::rootUserSelectAllForNode(m_mousePressNode.get());
+    if (rootUserSelectAllForMousePressNode && rootUserSelectAllForMousePressNode == Position::rootUserSelectAllForNode(target)) {
+        newSelection.setBase(positionBeforeNode(rootUserSelectAllForMousePressNode).upstream(CanCrossEditingBoundary));
+        newSelection.setExtent(positionAfterNode(rootUserSelectAllForMousePressNode).downstream(CanCrossEditingBoundary));
+    } else {
+        // Reset base for user select all when base is inside user-select-all area and extent < base.
+        if (rootUserSelectAllForMousePressNode && comparePositions(target->renderer()->positionForPoint(hitTestResult.localPoint()), m_mousePressNode->renderer()->positionForPoint(m_dragStartPos)) < 0)
+            newSelection.setBase(positionAfterNode(rootUserSelectAllForMousePressNode).downstream(CanCrossEditingBoundary));
+        
+        Node* rootUserSelectAllForTarget = Position::rootUserSelectAllForNode(target);
+        if (rootUserSelectAllForTarget && m_mousePressNode->renderer() && comparePositions(target->renderer()->positionForPoint(hitTestResult.localPoint()), m_mousePressNode->renderer()->positionForPoint(m_dragStartPos)) < 0)
+            newSelection.setExtent(positionBeforeNode(rootUserSelectAllForTarget).upstream(CanCrossEditingBoundary));
+        else if (rootUserSelectAllForTarget && m_mousePressNode->renderer())
+            newSelection.setExtent(positionAfterNode(rootUserSelectAllForTarget).downstream(CanCrossEditingBoundary));
+        else
+            newSelection.setExtent(targetPosition);
+    }
+#else
     newSelection.setExtent(targetPosition);
+#endif
+
     if (m_frame->selection()->granularity() != CharacterGranularity)
         newSelection.expandUsingGranularity(m_frame->selection()->granularity());
 
@@ -1315,6 +1343,41 @@ static bool nodeIsNotBeingEdited(Node* node, Frame* frame)
     return frame->selection()->rootEditableElement() != node->rootEditableElement();
 }
 
+bool EventHandler::useHandCursor(Node* node, bool isOverLink, bool shiftKey)
+{
+    if (!node)
+        return false;
+
+    bool editable = node->rendererIsEditable();
+    bool editableLinkEnabled = false;
+
+    // If the link is editable, then we need to check the settings to see whether or not the link should be followed
+    if (editable) {
+        ASSERT(m_frame->settings());
+        switch (m_frame->settings()->editableLinkBehavior()) {
+        default:
+        case EditableLinkDefaultBehavior:
+        case EditableLinkAlwaysLive:
+            editableLinkEnabled = true;
+            break;
+
+        case EditableLinkNeverLive:
+            editableLinkEnabled = false;
+            break;
+
+        case EditableLinkLiveWhenNotFocused:
+            editableLinkEnabled = nodeIsNotBeingEdited(node, m_frame) || shiftKey;
+            break;
+
+        case EditableLinkOnlyLiveWithShiftKey:
+            editableLinkEnabled = shiftKey;
+            break;
+        }
+    }
+
+    return ((isOverLink || isSubmitImage(node)) && (!editable || editableLinkEnabled));
+}
+
 OptionalCursor EventHandler::selectCursor(const MouseEventWithHitTestResults& event, Scrollbar* scrollbar)
 {
     if (m_resizeLayer && m_resizeLayer->inResizeMode())
@@ -1375,34 +1438,10 @@ OptionalCursor EventHandler::selectCursor(const MouseEventWithHitTestResults& ev
     switch (style ? style->cursor() : CURSOR_AUTO) {
     case CURSOR_AUTO: {
         bool editable = (node && node->rendererIsEditable());
-        bool editableLinkEnabled = false;
-
-        // If the link is editable, then we need to check the settings to see whether or not the link should be followed
-        if (editable) {
-            ASSERT(m_frame->settings());
-            switch (m_frame->settings()->editableLinkBehavior()) {
-            default:
-            case EditableLinkDefaultBehavior:
-            case EditableLinkAlwaysLive:
-                editableLinkEnabled = true;
-                break;
-
-            case EditableLinkNeverLive:
-                editableLinkEnabled = false;
-                break;
-
-            case EditableLinkLiveWhenNotFocused:
-                editableLinkEnabled = nodeIsNotBeingEdited(node, m_frame) || event.event().shiftKey();
-                break;
-            
-            case EditableLinkOnlyLiveWithShiftKey:
-                editableLinkEnabled = event.event().shiftKey();
-                break;
-            }
-        }
 
-        if ((event.isOverLink() || isSubmitImage(node)) && (!editable || editableLinkEnabled))
+        if (useHandCursor(node, event.isOverLink(), event.event().shiftKey()))
             return handCursor();
+
         bool inResizer = false;
         if (renderer) {
             if (RenderLayer* layer = renderer->enclosingLayer()) {
@@ -2523,6 +2562,8 @@ bool EventHandler::handleGestureEvent(const PlatformGestureEvent& gestureEvent)
         return handleGestureTapDown();
     case PlatformEvent::GestureLongPress:
         return handleGestureLongPress(gestureEvent);
+    case PlatformEvent::GestureTwoFingerTap:
+        return handleGestureTwoFingerTap(gestureEvent);
     case PlatformEvent::GestureDoubleTap:
     case PlatformEvent::GesturePinchBegin:
     case PlatformEvent::GesturePinchEnd:
@@ -2572,6 +2613,11 @@ bool EventHandler::handleGestureTap(const PlatformGestureEvent& gestureEvent)
 
 bool EventHandler::handleGestureLongPress(const PlatformGestureEvent& gestureEvent)
 {
+    return handleGestureForTextSelectionOrContextMenu(gestureEvent);
+}
+
+bool EventHandler::handleGestureForTextSelectionOrContextMenu(const PlatformGestureEvent& gestureEvent)
+{
 #if OS(ANDROID)
     IntPoint hitTestPoint = m_frame->view()->windowToContents(gestureEvent.position());
     HitTestResult result = hitTestResultAtPoint(hitTestPoint, true);
@@ -2589,6 +2635,11 @@ bool EventHandler::handleGestureLongPress(const PlatformGestureEvent& gestureEve
 #endif
 }
 
+bool EventHandler::handleGestureTwoFingerTap(const PlatformGestureEvent& gestureEvent)
+{
+    return handleGestureForTextSelectionOrContextMenu(gestureEvent);
+}
+
 bool EventHandler::handleGestureScrollUpdate(const PlatformGestureEvent& gestureEvent)
 {
     return handleGestureScrollCore(gestureEvent, ScrollByPixelWheelEvent, true);
@@ -2659,6 +2710,7 @@ bool EventHandler::adjustGesturePosition(const PlatformGestureEvent& gestureEven
         bestClickableNodeForTouchPoint(gestureEvent.position(), IntSize(gestureEvent.area().width() / 2, gestureEvent.area().height() / 2), adjustedPoint, targetNode);
         break;
     case PlatformEvent::GestureLongPress:
+    case PlatformEvent::GestureTwoFingerTap:
         bestContextMenuNodeForTouchPoint(gestureEvent.position(), IntSize(gestureEvent.area().width() / 2, gestureEvent.area().height() / 2), adjustedPoint, targetNode);
         break;
     default:
@@ -2785,7 +2837,12 @@ bool EventHandler::sendContextMenuEventForGesture(const PlatformGestureEvent& ev
         adjustGesturePosition(event, adjustedPoint);
 #endif
     PlatformMouseEvent mouseEvent(adjustedPoint, event.globalPosition(), RightButton, eventType, 1, false, false, false, false, WTF::currentTime());
+    // To simulate right-click behavior, we send a right mouse down and then
+    // context menu event.
+    handleMousePressEvent(mouseEvent);
     return sendContextMenuEvent(mouseEvent);
+    // We do not need to send a corresponding mouse release because in case of
+    // right-click, the context menu takes capture and consumes all events.
 }
 #endif // ENABLE(GESTURE_EVENTS)
 #endif // ENABLE(CONTEXT_MENUS)
diff --git a/Source/WebCore/page/EventHandler.h b/Source/WebCore/page/EventHandler.h
index a604da2c8..93c6b10eb 100644
--- a/Source/WebCore/page/EventHandler.h
+++ b/Source/WebCore/page/EventHandler.h
@@ -168,6 +168,7 @@ public:
     bool handleGestureEvent(const PlatformGestureEvent&);
     bool handleGestureTap(const PlatformGestureEvent&);
     bool handleGestureLongPress(const PlatformGestureEvent&);
+    bool handleGestureTwoFingerTap(const PlatformGestureEvent&);
     bool handleGestureScrollUpdate(const PlatformGestureEvent&);
 #endif
 
@@ -233,6 +234,8 @@ public:
     bool handleTouchEvent(const PlatformTouchEvent&);
 #endif
 
+    bool useHandCursor(Node*, bool isOverLink, bool shiftKey);
+
 private:
 #if ENABLE(DRAG_SUPPORT)
     static DragState& dragState();
@@ -364,6 +367,7 @@ private:
 #if ENABLE(GESTURE_EVENTS)
     bool handleGestureScrollCore(const PlatformGestureEvent&, PlatformWheelEventGranularity, bool latchedWheel);
     bool handleGestureTapDown();
+    bool handleGestureForTextSelectionOrContextMenu(const PlatformGestureEvent&);
 #endif
 
     Frame* m_frame;
diff --git a/Source/WebCore/page/FeatureObserver.h b/Source/WebCore/page/FeatureObserver.h
index 1b79f6790..531f46f38 100644
--- a/Source/WebCore/page/FeatureObserver.h
+++ b/Source/WebCore/page/FeatureObserver.h
@@ -54,6 +54,9 @@ public:
         LegacyTextNotifications,
         UnprefixedRequestAnimationFrame,
         PrefixedRequestAnimationFrame,
+        ContentSecurityPolicy,
+        ContentSecurityPolicyReportOnly,
+        PrefixedContentSecurityPolicyReportOnly,
         // Add new features above this line.
         NumberOfFeatures, // This enum value must be last.
     };
diff --git a/Source/WebCore/page/Frame.cpp b/Source/WebCore/page/Frame.cpp
index ed25477ed..ae8f3972a 100644
--- a/Source/WebCore/page/Frame.cpp
+++ b/Source/WebCore/page/Frame.cpp
@@ -33,7 +33,6 @@
 #include "ApplyStyleCommand.h"
 #include "BackForwardController.h"
 #include "CSSComputedStyleDeclaration.h"
-#include "CSSProperty.h"
 #include "CSSPropertyNames.h"
 #include "CachedCSSStyleSheet.h"
 #include "Chrome.h"
@@ -894,6 +893,13 @@ String Frame::layerTreeAsText(LayerTreeFlags flags) const
 #endif
 }
 
+String Frame::trackedRepaintRectsAsText() const
+{
+    if (!m_view)
+        return String();
+    return m_view->trackedRepaintRectsAsText();
+}
+
 void Frame::setPageZoomFactor(float factor)
 {
     setPageAndTextZoomFactors(factor, m_textZoomFactor);
diff --git a/Source/WebCore/page/Frame.h b/Source/WebCore/page/Frame.h
index 23a59ebdc..9c874ab88 100644
--- a/Source/WebCore/page/Frame.h
+++ b/Source/WebCore/page/Frame.h
@@ -78,7 +78,9 @@ namespace WebCore {
 
     enum {
         LayerTreeFlagsIncludeDebugInfo = 1 << 0,
-        LayerTreeFlagsIncludeVisibleRects = 1 << 2
+        LayerTreeFlagsIncludeVisibleRects = 1 << 1,
+        LayerTreeFlagsIncludeTileCaches = 1 << 2,
+        LayerTreeFlagsIncludeRepaintRects = 1 << 3
     };
     typedef unsigned LayerTreeFlags;
 
@@ -133,6 +135,7 @@ namespace WebCore {
         void injectUserScripts(UserScriptInjectionTime);
         
         String layerTreeAsText(LayerTreeFlags = 0) const;
+        String trackedRepaintRectsAsText() const;
 
         static Frame* frameForWidget(const Widget*);
 
diff --git a/Source/WebCore/page/FrameView.cpp b/Source/WebCore/page/FrameView.cpp
index 2d312a31a..29b075cd3 100644
--- a/Source/WebCore/page/FrameView.cpp
+++ b/Source/WebCore/page/FrameView.cpp
@@ -67,6 +67,7 @@
 #include "Settings.h"
 #include "StyleResolver.h"
 #include "TextResourceDecoder.h"
+#include "TextStream.h"
 
 #include <wtf/CurrentTime.h>
 #include <wtf/TemporaryChange.h>
@@ -266,6 +267,7 @@ void FrameView::reset()
     m_doFullRepaint = true;
     m_layoutSchedulingEnabled = true;
     m_inLayout = false;
+    m_doingPreLayoutStyleUpdate = false;
     m_inSynchronousPostLayout = false;
     m_layoutCount = 0;
     m_nestedLayoutCount = 0;
@@ -706,6 +708,10 @@ void FrameView::updateCompositingLayersAfterStyleChange()
     if (!root)
         return;
 
+    // If we expect to update compositing after an incipient layout, don't do so here.
+    if (m_doingPreLayoutStyleUpdate || layoutPending() || root->needsLayout())
+        return;
+
     // This call will make sure the cached hasAcceleratedCompositing is updated from the pref
     root->compositor()->cacheAcceleratedCompositingFlags();
     root->compositor()->updateCompositingLayers(CompositingUpdateAfterStyleChange);
@@ -931,11 +937,6 @@ bool FrameView::isSoftwareRenderable() const
 
 void FrameView::didMoveOnscreen()
 {
-#if USE(ACCELERATED_COMPOSITING)
-    if (TiledBacking* tiledBacking = this->tiledBacking())
-        tiledBacking->setIsInWindow(true);
-#endif
-
     if (RenderView* root = rootRenderer(this))
         root->didMoveOnscreen();
     contentAreaDidShow();
@@ -943,11 +944,6 @@ void FrameView::didMoveOnscreen()
 
 void FrameView::willMoveOffscreen()
 {
-#if USE(ACCELERATED_COMPOSITING)
-    if (TiledBacking* tiledBacking = this->tiledBacking())
-        tiledBacking->setIsInWindow(false);
-#endif
-
     if (RenderView* root = rootRenderer(this))
         root->willMoveOffscreen();
     contentAreaDidHide();
@@ -1074,6 +1070,7 @@ void FrameView::layout(bool allowSubtree)
 
         // Always ensure our style info is up-to-date. This can happen in situations where
         // the layout beats any sort of style recalc update that needs to occur.
+        TemporaryChange<bool> changeDoingPreLayoutStyleUpdate(m_doingPreLayoutStyleUpdate, true);
         document->updateStyleIfNeeded();
 
         subtree = m_layoutRoot;
@@ -1854,13 +1851,44 @@ void FrameView::repaintFixedElementsAfterScrolling()
     }
 }
 
+bool FrameView::shouldUpdateFixedElementsAfterScrolling()
+{
+#if ENABLE(THREADED_SCROLLING)
+    Page* page = m_frame->page();
+    if (!page)
+        return true;
+
+    // If the scrolling thread is updating the fixed elements, then the FrameView should not update them as well.
+    if (page->mainFrame() != m_frame)
+        return true;
+
+    ScrollingCoordinator* scrollingCoordinator = page->scrollingCoordinator();
+    if (!scrollingCoordinator)
+        return true;
+
+    if (!scrollingCoordinator->supportsFixedPositionLayers())
+        return true;
+
+    if (scrollingCoordinator->shouldUpdateScrollLayerPositionOnMainThread())
+        return true;
+
+    if (inProgrammaticScroll())
+        return true;
+
+    return false;
+#endif
+    return true;
+}
+
 void FrameView::updateFixedElementsAfterScrolling()
 {
 #if USE(ACCELERATED_COMPOSITING)
+    if (!shouldUpdateFixedElementsAfterScrolling())
+        return;
+
     if (m_nestedLayoutCount <= 1 && hasViewportConstrainedObjects()) {
-        if (RenderView* root = rootRenderer(this)) {
+        if (RenderView* root = rootRenderer(this))
             root->compositor()->updateCompositingLayers(CompositingUpdateOnScroll);
-        }
     }
 #endif
 }
@@ -2500,13 +2528,9 @@ void FrameView::performPostLayoutTasks()
     }
 
 #if USE(ACCELERATED_COMPOSITING)
-    if (TiledBacking* tiledBacking = this->tiledBacking()) {
-        if (page) {
-            if (ScrollingCoordinator* scrollingCoordinator = page->scrollingCoordinator()) {
-                bool shouldLimitTileCoverage = !canHaveScrollbars() || scrollingCoordinator->shouldUpdateScrollLayerPositionOnMainThread();
-                tiledBacking->setTileCoverage(shouldLimitTileCoverage ? TiledBacking::CoverageForVisibleArea : TiledBacking::CoverageForScrolling);
-            }
-        }
+    if (RenderView* root = rootRenderer(this)) {
+        if (root->usesCompositing())
+            root->compositor()->frameViewDidLayout();
     }
 #endif
 
@@ -3173,7 +3197,7 @@ void FrameView::paintContents(GraphicsContext* p, const IntRect& rect)
     if (!frame())
         return;
 
-    InspectorInstrumentationCookie cookie = InspectorInstrumentation::willPaint(m_frame.get(), p, rect);
+    InspectorInstrumentationCookie cookie = InspectorInstrumentation::willPaint(m_frame.get());
 
     Document* document = m_frame->document();
 
@@ -3196,10 +3220,6 @@ void FrameView::paintContents(GraphicsContext* p, const IntRect& rect)
         p->fillRect(rect, Color(0xFF, 0, 0), ColorSpaceDeviceRGB);
 #endif
 
-    bool isTopLevelPainter = !sCurrentPaintTimeStamp;
-    if (isTopLevelPainter)
-        sCurrentPaintTimeStamp = currentTime();
-    
     RenderView* root = rootRenderer(this);
     if (!root) {
         LOG_ERROR("called FrameView::paint with nil renderer");
@@ -3210,6 +3230,10 @@ void FrameView::paintContents(GraphicsContext* p, const IntRect& rect)
     if (needsLayout())
         return;
 
+    bool isTopLevelPainter = !sCurrentPaintTimeStamp;
+    if (isTopLevelPainter)
+        sCurrentPaintTimeStamp = currentTime();
+
     FontCachePurgePreventer fontCachePurgePreventer;
 
 #if USE(ACCELERATED_COMPOSITING)
@@ -3242,6 +3266,10 @@ void FrameView::paintContents(GraphicsContext* p, const IntRect& rect)
     RenderObject* eltRenderer = m_nodeToDraw ? m_nodeToDraw->renderer() : 0;
     RenderLayer* rootLayer = root->layer();
 
+#ifndef NDEBUG
+    RenderObject::SetLayoutNeededForbiddenScope forbidSetNeedsLayout(rootLayer->renderer());
+#endif
+
     rootLayer->paint(p, rect, m_paintBehavior, eltRenderer);
 
     if (rootLayer->containsDirtyOverlayScrollbars())
@@ -3264,7 +3292,7 @@ void FrameView::paintContents(GraphicsContext* p, const IntRect& rect)
     if (isTopLevelPainter)
         sCurrentPaintTimeStamp = 0;
 
-    InspectorInstrumentation::didPaint(cookie);
+    InspectorInstrumentation::didPaint(cookie, p, rect);
 }
 
 void FrameView::setPaintBehavior(PaintBehavior behavior)
@@ -3649,11 +3677,41 @@ void FrameView::setTracksRepaints(bool trackRepaints)
 {
     if (trackRepaints == m_isTrackingRepaints)
         return;
-    
-    m_trackedRepaintRects.clear();
+
+#if USE(ACCELERATED_COMPOSITING)
+    for (Frame* frame = m_frame->tree()->top(); frame; frame = frame->tree()->traverseNext()) {
+        if (RenderView* renderView = frame->contentRenderer())
+            renderView->compositor()->setTracksRepaints(trackRepaints);
+    }
+#endif
+
+    resetTrackedRepaints();
     m_isTrackingRepaints = trackRepaints;
 }
 
+void FrameView::resetTrackedRepaints()
+{
+    m_trackedRepaintRects.clear();
+#if USE(ACCELERATED_COMPOSITING)
+    if (RenderView* root = rootRenderer(this)) {
+        RenderLayerCompositor* compositor = root->compositor();
+        compositor->resetTrackedRepaintRects();
+    }
+#endif
+}
+
+String FrameView::trackedRepaintRectsAsText() const
+{
+    TextStream ts;
+    if (!m_trackedRepaintRects.isEmpty()) {
+        ts << "(repaint rects\n";
+        for (size_t i = 0; i < m_trackedRepaintRects.size(); ++i)
+            ts << "  (rect " << m_trackedRepaintRects[i].x() << " " << m_trackedRepaintRects[i].y() << " " << m_trackedRepaintRects[i].width() << " " << m_trackedRepaintRects[i].height() << ")\n";
+        ts << ")\n";
+    }
+    return ts.release();
+}
+
 void FrameView::addScrollableArea(ScrollableArea* scrollableArea)
 {
     if (!m_scrollableAreas)
diff --git a/Source/WebCore/page/FrameView.h b/Source/WebCore/page/FrameView.h
index 1f1adb459..583453b26 100644
--- a/Source/WebCore/page/FrameView.h
+++ b/Source/WebCore/page/FrameView.h
@@ -338,8 +338,9 @@ public:
     
     void setTracksRepaints(bool);
     bool isTrackingRepaints() const { return m_isTrackingRepaints; }
-    void resetTrackedRepaints() { m_trackedRepaintRects.clear(); }
+    void resetTrackedRepaints();
     const Vector<IntRect>& trackedRepaintRects() const { return m_trackedRepaintRects; }
+    String trackedRepaintRectsAsText() const;
 
     typedef HashSet<ScrollableArea*> ScrollableAreaSet;
     void addScrollableArea(ScrollableArea*);
@@ -389,6 +390,8 @@ private:
     void updateCanBlitOnScrollRecursively();
     bool contentsInCompositedLayer() const;
 
+    bool shouldUpdateFixedElementsAfterScrolling();
+
     void applyOverflowToViewport(RenderObject*, ScrollbarMode& hMode, ScrollbarMode& vMode);
     void applyPaginationToViewport();
 
@@ -484,6 +487,7 @@ private:
     
     bool m_layoutSchedulingEnabled;
     bool m_inLayout;
+    bool m_doingPreLayoutStyleUpdate;
     bool m_inSynchronousPostLayout;
     int m_layoutCount;
     unsigned m_nestedLayoutCount;
diff --git a/Source/WebCore/page/GestureTapHighlighter.cpp b/Source/WebCore/page/GestureTapHighlighter.cpp
index 56df47c26..6688d1501 100644
--- a/Source/WebCore/page/GestureTapHighlighter.cpp
+++ b/Source/WebCore/page/GestureTapHighlighter.cpp
@@ -165,9 +165,13 @@ Path absolutePathForRenderer(RenderObject* const o)
     LayoutRect first;
     LayoutRect last;
 
-    // Add the first box, but merge it with the center boxes if it intersects.
+    // Add the first box, but merge it with the center boxes if it intersects or if the center box is empty.
     if (rects.size() && !rects.first().isEmpty()) {
-        if (!mid.isEmpty() && mid.intersects(rects.first()))
+        // If the mid box is empty at this point, unite it with the first box. This allows the first box to be
+        // united with the last box if they intersect in the following check for last. Not uniting them would
+        // trigger in assert in addHighlighRect due to the first and the last box intersecting, but being passed
+        // as two separate boxes.
+        if (mid.isEmpty() || mid.intersects(rects.first()))
             mid.unite(rects.first());
         else {
             first = rects.first();
@@ -178,7 +182,7 @@ Path absolutePathForRenderer(RenderObject* const o)
     // Add the last box, but merge it with the center boxes if it intersects.
     if (rects.size() > 1 && !rects.last().isEmpty()) {
         // Adjust center boxes to boundary of last
-        if (!mid.isEmpty() && mid.intersects(rects.last()))
+        if (mid.intersects(rects.last()))
             mid.unite(rects.last());
         else {
             last = rects.last();
diff --git a/Source/WebCore/page/History.idl b/Source/WebCore/page/History.idl
index abb245f1d..99a9dbeea 100644
--- a/Source/WebCore/page/History.idl
+++ b/Source/WebCore/page/History.idl
@@ -41,9 +41,8 @@
     [DoNotCheckSecurity, CallWith=ScriptExecutionContext] void forward();
     [DoNotCheckSecurity, CallWith=ScriptExecutionContext] void go(in [Optional=DefaultIsUndefined] long distance);
 
-    [Custom] void pushState(in any data, in DOMString title, in [Optional] DOMString url)
+    [Custom, V8EnabledPerContext=pushState] void pushState(in any data, in DOMString title, in [Optional] DOMString url)
         raises(DOMException);
-    [Custom] void replaceState(in any data, in DOMString title, in [Optional] DOMString url)
+    [Custom, V8EnabledPerContext=pushState] void replaceState(in any data, in DOMString title, in [Optional] DOMString url)
         raises(DOMException);
 };
-
diff --git a/Source/WebCore/page/Page.cpp b/Source/WebCore/page/Page.cpp
index 7009ab566..25042144e 100644
--- a/Source/WebCore/page/Page.cpp
+++ b/Source/WebCore/page/Page.cpp
@@ -244,6 +244,17 @@ ScrollingCoordinator* Page::scrollingCoordinator()
     return m_scrollingCoordinator.get();
 }
 
+String Page::scrollingStateTreeAsText()
+{
+    if (Document* document = m_mainFrame->document())
+        document->updateLayout();
+
+    if (ScrollingCoordinator* scrollingCoordinator = this->scrollingCoordinator())
+        return scrollingCoordinator->scrollingStateTreeAsText();
+
+    return String();
+}
+
 struct ViewModeInfo {
     const char* name;
     Page::ViewMode type;
@@ -1295,7 +1306,7 @@ void Page::reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
     info.addMember(m_mainFrame);
     info.addMember(m_pluginData);
     info.addMember(m_theme);
-    info.addMember(m_editorClient);
+    info.addWeakPointer(m_editorClient);
     info.addMember(m_featureObserver);
     info.addMember(m_groupName);
     info.addMember(m_pagination);
@@ -1308,7 +1319,7 @@ void Page::reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
     info.addMember(m_relevantUnpaintedRenderObjects);
     info.addMember(m_relevantPaintedRegion);
     info.addMember(m_relevantUnpaintedRegion);
-    info.addMember(m_alternativeTextClient);
+    info.addWeakPointer(m_alternativeTextClient);
     info.addMember(m_seenPlugins);
 }
 
diff --git a/Source/WebCore/page/Page.h b/Source/WebCore/page/Page.h
index c16b57bc5..a1c4ab9a8 100644
--- a/Source/WebCore/page/Page.h
+++ b/Source/WebCore/page/Page.h
@@ -195,6 +195,8 @@ namespace WebCore {
 
         ScrollingCoordinator* scrollingCoordinator();
 
+        String scrollingStateTreeAsText();
+
         Settings* settings() const { return m_settings.get(); }
         ProgressTracker* progress() const { return m_progress.get(); }
         BackForwardController* backForward() const { return m_backForwardController.get(); }
diff --git a/Source/WebCore/page/PageGroup.cpp b/Source/WebCore/page/PageGroup.cpp
index 77928ce64..3ad8bfb40 100644
--- a/Source/WebCore/page/PageGroup.cpp
+++ b/Source/WebCore/page/PageGroup.cpp
@@ -38,6 +38,14 @@
 #include "Settings.h"
 #include "StorageNamespace.h"
 
+#if ENABLE(VIDEO_TRACK)
+#if PLATFORM(MAC)
+#include "CaptionUserPreferencesMac.h"
+#else
+#include "CaptionUserPreferences.h"
+#endif
+#endif
+
 #if PLATFORM(CHROMIUM)
 #include "VisitedLinks.h"
 #endif
@@ -396,4 +404,46 @@ void PageGroup::resetUserStyleCacheInAllFrames()
     }
 }
 
+#if ENABLE(VIDEO_TRACK)
+CaptionUserPreferences* PageGroup::captionPreferences()
+{
+    if (!m_captionPreferences)
+#if PLATFORM(MAC)
+        m_captionPreferences = CaptionUserPreferencesMac::create(this);
+#else
+        m_captionPreferences = CaptionUserPreferences::create(this);
+#endif
+
+    return m_captionPreferences.get();
+}
+    
+void PageGroup::registerForCaptionPreferencesChangedCallbacks(CaptionPreferencesChangedListener* listener)
+{
+    captionPreferences()->registerForCaptionPreferencesChangedCallbacks(listener);
+}
+
+void PageGroup::unregisterForCaptionPreferencesChangedCallbacks(CaptionPreferencesChangedListener* listener)
+{
+    if (!m_captionPreferences)
+        return;
+    captionPreferences()->unregisterForCaptionPreferencesChangedCallbacks(listener);
+}
+    
+bool PageGroup::userPrefersCaptions()
+{
+    return captionPreferences()->userPrefersCaptions();
+}
+
+bool PageGroup::userHasCaptionPreferences()
+{
+    return captionPreferences()->userPrefersCaptions();
+}
+
+float PageGroup::captionFontSizeScale()
+{
+    return captionPreferences()->captionFontSizeScale();
+}
+
+#endif
+
 } // namespace WebCore
diff --git a/Source/WebCore/page/PageGroup.h b/Source/WebCore/page/PageGroup.h
index 7d2ddfaf1..6614b65b2 100644
--- a/Source/WebCore/page/PageGroup.h
+++ b/Source/WebCore/page/PageGroup.h
@@ -36,6 +36,10 @@
 
 namespace WebCore {
 
+#if ENABLE(VIDEO_TRACK)
+    class CaptionPreferencesChangedListener;
+    class CaptionUserPreferences;
+#endif
     class KURL;
     class GroupSettings;
     class IDBFactoryBackendInterface;
@@ -103,12 +107,23 @@ namespace WebCore {
 
         GroupSettings* groupSettings() const { return m_groupSettings.get(); }
 
+#if ENABLE(VIDEO_TRACK)
+        bool userPrefersCaptions();
+        bool userHasCaptionPreferences();
+        float captionFontSizeScale();
+        void registerForCaptionPreferencesChangedCallbacks(CaptionPreferencesChangedListener*);
+        void unregisterForCaptionPreferencesChangedCallbacks(CaptionPreferencesChangedListener*);
+#endif
+
     private:
         PageGroup(Page*);
 
         void addVisitedLink(LinkHash stringHash);
         void resetUserStyleCacheInAllFrames();
   
+#if ENABLE(VIDEO_TRACK)
+        CaptionUserPreferences* captionPreferences();
+#endif
         String m_name;
 
         HashSet<Page*> m_pages;
@@ -123,6 +138,10 @@ namespace WebCore {
         OwnPtr<UserStyleSheetMap> m_userStyleSheets;
 
         OwnPtr<GroupSettings> m_groupSettings;
+
+#if ENABLE(VIDEO_TRACK)
+        OwnPtr<CaptionUserPreferences> m_captionPreferences;
+#endif
     };
 
 } // namespace WebCore
diff --git a/Source/WebCore/page/PagePopupClient.h b/Source/WebCore/page/PagePopupClient.h
index d0fb4bb56..391c8f83e 100644
--- a/Source/WebCore/page/PagePopupClient.h
+++ b/Source/WebCore/page/PagePopupClient.h
@@ -40,7 +40,7 @@
 namespace WebCore {
 
 class DocumentWriter;
-class Localizer;
+class Locale;
 
 class PagePopupClient {
 public:
@@ -53,8 +53,8 @@ public:
     //  - window.setValueAndClosePopup(number, string).
     virtual void writeDocument(DocumentWriter&) = 0;
 
-    // Returns a Localizer object associated to the client.
-    virtual Localizer& localizer() = 0;
+    // Returns a Locale object associated to the client.
+    virtual Locale& locale() = 0;
 
     // This is called by the content HTML of a PagePopup.
     // An implementation of this function should call ChromeClient::closePagePopup().
diff --git a/Source/WebCore/page/PagePopupController.cpp b/Source/WebCore/page/PagePopupController.cpp
index 24e4b349e..dace74203 100644
--- a/Source/WebCore/page/PagePopupController.cpp
+++ b/Source/WebCore/page/PagePopupController.cpp
@@ -32,8 +32,8 @@
 #include "PagePopupController.h"
 
 #if ENABLE(PAGE_POPUP)
-#include "Localizer.h"
 #include "PagePopupClient.h"
+#include "PlatformLocale.h"
 
 namespace WebCore {
 
@@ -50,12 +50,20 @@ PassRefPtr<PagePopupController> PagePopupController::create(PagePopupClient* cli
 
 void PagePopupController::setValueAndClosePopup(int numValue, const String& stringValue)
 {
-    m_popupClient->setValueAndClosePopup(numValue, stringValue);
+    if (m_popupClient)
+        m_popupClient->setValueAndClosePopup(numValue, stringValue);
 }
 
 String PagePopupController::localizeNumberString(const String& numberString)
 {
-    return m_popupClient->localizer().convertToLocalizedNumber(numberString);
+    if (m_popupClient)
+        return m_popupClient->locale().convertToLocalizedNumber(numberString);
+    return numberString;
+}
+
+void PagePopupController::clearPagePopupClient()
+{
+    m_popupClient = 0;
 }
 
 }
diff --git a/Source/WebCore/page/PagePopupController.h b/Source/WebCore/page/PagePopupController.h
index d0dd5c164..6ef5cd128 100644
--- a/Source/WebCore/page/PagePopupController.h
+++ b/Source/WebCore/page/PagePopupController.h
@@ -45,6 +45,7 @@ public:
     static PassRefPtr<PagePopupController> create(PagePopupClient*);
     void setValueAndClosePopup(int numValue, const String& stringValue);
     String localizeNumberString(const String&);
+    void clearPagePopupClient();
 
 private:
     explicit PagePopupController(PagePopupClient*);
diff --git a/Source/WebCore/page/PageSerializer.cpp b/Source/WebCore/page/PageSerializer.cpp
index 23aadb32f..19555075a 100644
--- a/Source/WebCore/page/PageSerializer.cpp
+++ b/Source/WebCore/page/PageSerializer.cpp
@@ -298,12 +298,15 @@ void PageSerializer::addImageToResources(CachedImage* image, RenderObject* image
     if (!image || image->image() == Image::nullImage())
         return;
 
-    RefPtr<SharedBuffer> data = imageRenderer ? image->imageForRenderer(imageRenderer)->data() : image->image()->data();
+    RefPtr<SharedBuffer> data = imageRenderer ? image->imageForRenderer(imageRenderer)->data() : 0;
+    if (!data)
+        data = image->image()->data();
+
     if (!data) {
-        // SVG images don't return data at this point. Bug 99102.
         LOG_ERROR("No data for image %s", url.string().utf8().data());
         return;
     }
+
     String mimeType = image->response().mimeType();
     m_resources->append(Resource(url, mimeType, data));
     m_resourceURLs.add(url);
diff --git a/Source/WebCore/page/Screen.cpp b/Source/WebCore/page/Screen.cpp
index e1e1d1173..c0880c8de 100644
--- a/Source/WebCore/page/Screen.cpp
+++ b/Source/WebCore/page/Screen.cpp
@@ -35,6 +35,7 @@
 #include "FrameView.h"
 #include "InspectorInstrumentation.h"
 #include "PlatformScreen.h"
+#include "Settings.h"
 #include "Widget.h"
 
 namespace WebCore {
@@ -48,14 +49,41 @@ unsigned Screen::horizontalDPI() const
 {
     if (!m_frame)
         return 0;
-    return static_cast<unsigned>(screenHorizontalDPI(m_frame->view()));
+
+    // Used by the testing system, can be set from internals.
+    IntSize override = m_frame->page()->settings()->resolutionOverride();
+    if (!override.isEmpty())
+        return override.width();
+
+    // These were added in https://bugs.webkit.org/show_bug.cgi?id=70556 for Chromium
+    // but seems unused. Please remove after varifying that this is indeed the case.
+    int platformValue = static_cast<unsigned>(screenHorizontalDPI(m_frame->view()));
+    if (platformValue > 0)
+        return platformValue;
+
+    // The DPI is defined as dots per CSS inch and thus not device inch.
+    return m_frame->page()->deviceScaleFactor() * 96;
 }
 
 unsigned Screen::verticalDPI() const
 {
+    // The DPI is defined as dots per CSS inch and thus not device inch.
     if (!m_frame)
         return 0;
-    return static_cast<unsigned>(screenVerticalDPI(m_frame->view()));
+
+    // Used by the testing system, can be set from internals.
+    IntSize override = m_frame->page()->settings()->resolutionOverride();
+    if (!override.isEmpty())
+        return override.height();
+
+    // These were added in https://bugs.webkit.org/show_bug.cgi?id=70556 for Chromium
+    // but seems unused. Please remove after varifying that this is indeed the case.
+    int platformValue = static_cast<unsigned>(screenVerticalDPI(m_frame->view()));
+    if (platformValue > 0)
+        return platformValue;
+
+    // The DPI is defined as dots per CSS inch and thus not device inch.
+    return m_frame->page()->deviceScaleFactor() * 96;
 }
 
 unsigned Screen::height() const
diff --git a/Source/WebCore/page/Settings.cpp b/Source/WebCore/page/Settings.cpp
index 9876af5c7..ce7669a6d 100644
--- a/Source/WebCore/page/Settings.cpp
+++ b/Source/WebCore/page/Settings.cpp
@@ -81,12 +81,15 @@ static inline const AtomicString& getGenericFontFamilyForScript(const ScriptFont
     return emptyAtom;
 }
 
+double Settings::gDefaultMinDOMTimerInterval = 0.010; // 10 milliseconds
+double Settings::gDefaultDOMTimerAlignmentInterval = 0;
+
 #if USE(SAFARI_THEME)
 bool Settings::gShouldPaintNativeControls = true;
 #endif
 
 #if USE(AVFOUNDATION)
-bool Settings::gAVFoundationEnabled(false);
+bool Settings::gAVFoundationEnabled = false;
 #endif
 
 bool Settings::gMockScrollbarsEnabled = false;
@@ -125,6 +128,7 @@ static const double defaultIncrementalRenderingSuppressionTimeoutInSeconds = 5;
 
 Settings::Settings(Page* page)
     : m_page(0)
+    , m_mediaTypeOverride("screen")
     , m_editableLinkBehavior(EditableLinkDefaultBehavior)
     , m_textDirectionSubmenuInclusionBehavior(TextDirectionSubmenuAutomaticallyIncluded)
     , m_passwordEchoDurationInSeconds(1)
@@ -168,6 +172,7 @@ Settings::Settings(Page* page)
     , m_allowUniversalAccessFromFileURLs(true)
     , m_allowFileAccessFromFileURLs(true)
     , m_javaScriptCanOpenWindowsAutomatically(false)
+    , m_supportsMultipleWindows(true)
     , m_javaScriptCanAccessClipboard(false)
     , m_shouldPrintBackgrounds(false)
     , m_textAreasAreResizable(false)
@@ -459,6 +464,31 @@ void Settings::setTextAutosizingFontScaleFactor(float fontScaleFactor)
 
 #endif
 
+void Settings::setResolutionOverride(const IntSize& densityPerInchOverride)
+{
+    if (m_resolutionDensityPerInchOverride == densityPerInchOverride)
+        return;
+
+    m_resolutionDensityPerInchOverride = densityPerInchOverride;
+    m_page->setNeedsRecalcStyleInAllFrames();
+}
+
+void Settings::setMediaTypeOverride(const String& mediaTypeOverride)
+{
+    if (m_mediaTypeOverride == mediaTypeOverride)
+        return;
+
+    m_mediaTypeOverride = mediaTypeOverride;
+
+    Frame* mainFrame = m_page->mainFrame();
+    ASSERT(mainFrame);
+    FrameView* view = mainFrame->view();
+    ASSERT(view);
+
+    view->setMediaType(mediaTypeOverride);
+    m_page->setNeedsRecalcStyleInAllFrames();
+}
+
 void Settings::setLoadsImagesAutomatically(bool loadsImagesAutomatically)
 {
     m_loadsImagesAutomatically = loadsImagesAutomatically;
@@ -560,10 +590,9 @@ void Settings::setPrivateBrowsingEnabled(bool privateBrowsingEnabled)
     // 4. The WebPage settings get applied to the new Page and setPrivateBrowsingEnabled(false)
     //    is called, but an if (m_privateBrowsingEnabled == privateBrowsingEnabled) early return
     //    prevents the global values from getting changed from true to false.
-#if USE(CFURLSTORAGESESSIONS)
+#if PLATFORM(MAC) || USE(CFNETWORK)
     ResourceHandle::setPrivateBrowsingEnabled(privateBrowsingEnabled);
 #endif
-    setCookieStoragePrivateBrowsingEnabled(privateBrowsingEnabled);
 
     if (m_privateBrowsingEnabled == privateBrowsingEnabled)
         return;
@@ -577,6 +606,11 @@ void Settings::setJavaScriptCanOpenWindowsAutomatically(bool javaScriptCanOpenWi
     m_javaScriptCanOpenWindowsAutomatically = javaScriptCanOpenWindowsAutomatically;
 }
 
+void Settings::setSupportsMultipleWindows(bool supportsMultipleWindows)
+{
+    m_supportsMultipleWindows = supportsMultipleWindows;
+}
+
 void Settings::setJavaScriptCanAccessClipboard(bool javaScriptCanAccessClipboard)
 {
     m_javaScriptCanAccessClipboard = javaScriptCanAccessClipboard;
@@ -665,12 +699,12 @@ void Settings::setDOMPasteAllowed(bool DOMPasteAllowed)
 
 void Settings::setDefaultMinDOMTimerInterval(double interval)
 {
-    DOMTimer::setDefaultMinTimerInterval(interval);
+    gDefaultMinDOMTimerInterval = interval;
 }
 
 double Settings::defaultMinDOMTimerInterval()
 {
-    return DOMTimer::defaultMinTimerInterval();
+    return gDefaultMinDOMTimerInterval;
 }
 
 void Settings::setMinDOMTimerInterval(double interval)
@@ -685,12 +719,12 @@ double Settings::minDOMTimerInterval()
 
 void Settings::setDefaultDOMTimerAlignmentInterval(double interval)
 {
-    DOMTimer::setDefaultTimerAlignmentInterval(interval);
+    gDefaultDOMTimerAlignmentInterval = interval;
 }
 
 double Settings::defaultDOMTimerAlignmentInterval()
 {
-    return DOMTimer::defaultTimerAlignmentInterval();
+    return gDefaultDOMTimerAlignmentInterval;
 }
 
 void Settings::setDOMTimerAlignmentInterval(double interval)
diff --git a/Source/WebCore/page/Settings.h b/Source/WebCore/page/Settings.h
index 89785d12f..f053f541e 100644
--- a/Source/WebCore/page/Settings.h
+++ b/Source/WebCore/page/Settings.h
@@ -29,6 +29,7 @@
 
 #include "EditingBehaviorTypes.h"
 #include "FontRenderingMode.h"
+#include "IntSize.h"
 #include "KURL.h"
 #include "SecurityOrigin.h"
 #include "Timer.h"
@@ -37,10 +38,6 @@
 #include <wtf/text/AtomicStringHash.h>
 #include <wtf/unicode/Unicode.h>
 
-#if ENABLE(TEXT_AUTOSIZING)
-#include "IntSize.h"
-#endif
-
 namespace WebCore {
 
     class Page;
@@ -123,6 +120,14 @@ namespace WebCore {
         const IntSize& textAutosizingWindowSizeOverride() const { return m_textAutosizingWindowSizeOverride; }
 #endif
 
+        // Only set by Layout Tests.
+        void setResolutionOverride(const IntSize&);
+        const IntSize& resolutionOverride() const { return m_resolutionDensityPerInchOverride; }
+
+        // Only set by Layout Tests.
+        void setMediaTypeOverride(const String&);
+        const String& mediaTypeOverride() const { return m_mediaTypeOverride; }
+
         // Unlike areImagesEnabled, this only suppresses the network load of
         // the image URL.  A cached image will still be rendered if requested.
         void setLoadsImagesAutomatically(bool);
@@ -151,6 +156,9 @@ namespace WebCore {
         void setJavaScriptCanOpenWindowsAutomatically(bool);
         bool javaScriptCanOpenWindowsAutomatically() const { return m_javaScriptCanOpenWindowsAutomatically; }
 
+        void setSupportsMultipleWindows(bool);
+        bool supportsMultipleWindows() const { return m_supportsMultipleWindows; }
+
         void setJavaScriptCanAccessClipboard(bool);
         bool javaScriptCanAccessClipboard() const { return m_javaScriptCanAccessClipboard; }
 
@@ -655,6 +663,7 @@ namespace WebCore {
         String m_defaultTextEncodingName;
         String m_ftpDirectoryTemplatePath;
         String m_localStorageDatabasePath;
+        String m_mediaTypeOverride;
         KURL m_userStyleSheetLocation;
         ScriptFontFamilyMap m_standardFontFamilyMap;
         ScriptFontFamilyMap m_serifFontFamilyMap;
@@ -686,6 +695,7 @@ namespace WebCore {
         IntSize m_textAutosizingWindowSizeOverride;
         bool m_textAutosizingEnabled : 1;
 #endif
+        IntSize m_resolutionDensityPerInchOverride;
         bool m_isSpatialNavigationEnabled : 1;
         bool m_isJavaEnabled : 1;
         bool m_isJavaEnabledForLocalFiles : 1;
@@ -702,6 +712,7 @@ namespace WebCore {
         bool m_allowUniversalAccessFromFileURLs: 1;
         bool m_allowFileAccessFromFileURLs: 1;
         bool m_javaScriptCanOpenWindowsAutomatically : 1;
+        bool m_supportsMultipleWindows : 1;
         bool m_javaScriptCanAccessClipboard : 1;
         bool m_shouldPrintBackgrounds : 1;
         bool m_textAreasAreResizable : 1;
@@ -838,6 +849,9 @@ namespace WebCore {
 
         double m_incrementalRenderingSuppressionTimeoutInSeconds;
 
+        static double gDefaultMinDOMTimerInterval;
+        static double gDefaultDOMTimerAlignmentInterval;
+
 #if USE(AVFOUNDATION)
         static bool gAVFoundationEnabled;
 #endif
diff --git a/Source/WebCore/page/TouchAdjustment.cpp b/Source/WebCore/page/TouchAdjustment.cpp
index 9663f68e8..3a956956e 100644
--- a/Source/WebCore/page/TouchAdjustment.cpp
+++ b/Source/WebCore/page/TouchAdjustment.cpp
@@ -223,6 +223,7 @@ void compileSubtargetList(const NodeList& intersectedNodes, SubtargetGeometryLis
     HashMap<Node*, Node*> responderMap;
     HashSet<Node*> ancestorsToRespondersSet;
     Vector<Node*> candidates;
+    HashSet<Node*> editableAncestors;
 
     // A node matching the NodeFilter is called a responder. Candidate nodes must either be a
     // responder or have an ancestor that is a responder.
@@ -270,7 +271,25 @@ void compileSubtargetList(const NodeList& intersectedNodes, SubtargetGeometryLis
         ASSERT(respondingNode);
         if (ancestorsToRespondersSet.contains(respondingNode))
             continue;
-        appendSubtargetsForNode(candidate, subtargets);
+        // Consolidate bounds for editable content.
+        if (editableAncestors.contains(candidate))
+            continue;
+        if (candidate->isContentEditable()) {
+            Node* replacement = candidate;
+            Node* parent = candidate->parentOrHostNode();
+            while (parent && parent->isContentEditable()) {
+                replacement = parent;
+                if (editableAncestors.contains(replacement)) {
+                    replacement = 0;
+                    break;
+                }
+                editableAncestors.add(replacement);
+                parent = parent->parentOrHostNode();
+            }
+            candidate = replacement;
+        }
+        if (candidate)
+            appendSubtargetsForNode(candidate, subtargets);
     }
 }
 
@@ -320,10 +339,12 @@ float hybridDistanceFunction(const IntPoint& touchHotspot, const IntRect& touchR
     float radiusSquared = 0.25f * (touchRect.size().diagonalLengthSquared());
     float distanceToAdjustScore = rect.distanceSquaredToPoint(touchHotspot) / radiusSquared;
 
-    float targetArea = rect.size().area();
+    int maxOverlapWidth = std::min(touchRect.width(), rect.width());
+    int maxOverlapHeight = std::min(touchRect.height(), rect.height());
+    float maxOverlapArea = std::max(maxOverlapWidth * maxOverlapHeight, 1);
     rect.intersect(touchRect);
     float intersectArea = rect.size().area();
-    float intersectionScore = 1 - intersectArea / targetArea;
+    float intersectionScore = 1 - intersectArea / maxOverlapArea;
 
     float hybridScore = intersectionScore + distanceToAdjustScore;
 
diff --git a/Source/WebCore/page/mac/EventHandlerMac.mm b/Source/WebCore/page/mac/EventHandlerMac.mm
index d2020c771..f8a0f17e2 100644
--- a/Source/WebCore/page/mac/EventHandlerMac.mm
+++ b/Source/WebCore/page/mac/EventHandlerMac.mm
@@ -709,11 +709,6 @@ bool EventHandler::tabsToAllFormControls(KeyboardEvent* event) const
 
 bool EventHandler::needsKeyboardEventDisambiguationQuirks() const
 {
-    Document* document = m_frame->document();
-
-    // RSS view needs arrow key keypress events.
-    if (applicationIsSafari() && (document->url().protocolIs("feed") || document->url().protocolIs("feeds")))
-        return true;
     Settings* settings = m_frame->settings();
     if (!settings)
         return false;
diff --git a/Source/WebCore/page/scrolling/ScrollingConstraints.cpp b/Source/WebCore/page/scrolling/ScrollingConstraints.cpp
index b94ee6279..0bbc6577f 100644
--- a/Source/WebCore/page/scrolling/ScrollingConstraints.cpp
+++ b/Source/WebCore/page/scrolling/ScrollingConstraints.cpp
@@ -28,6 +28,23 @@
 
 namespace WebCore {
 
+FloatPoint FixedPositionViewportConstraints::layerPositionForViewportRect(const FloatRect& viewportRect) const
+{
+    FloatSize offset;
+
+    if (hasAnchorEdge(AnchorEdgeLeft))
+        offset.setWidth(viewportRect.x() - m_viewportRectAtLastLayout.x());
+    else if (hasAnchorEdge(AnchorEdgeRight))
+        offset.setWidth(viewportRect.maxX() - m_viewportRectAtLastLayout.maxX());
+
+    if (hasAnchorEdge(AnchorEdgeTop))
+        offset.setHeight(viewportRect.y() - m_viewportRectAtLastLayout.y());
+    else if (hasAnchorEdge(AnchorEdgeBottom))
+        offset.setHeight(viewportRect.maxY() - m_viewportRectAtLastLayout.maxY());
+
+    return m_layerPositionAtLastLayout + offset;
+}
+
 FloatSize StickyPositionViewportConstraints::computeStickyOffset(const FloatRect& viewportRect) const
 {
     FloatRect boxRect = m_absoluteStickyBoxRect;
diff --git a/Source/WebCore/page/scrolling/ScrollingConstraints.h b/Source/WebCore/page/scrolling/ScrollingConstraints.h
index e8be408c8..eaaaef508 100644
--- a/Source/WebCore/page/scrolling/ScrollingConstraints.h
+++ b/Source/WebCore/page/scrolling/ScrollingConstraints.h
@@ -46,10 +46,6 @@ public:
         AnchorEdgeBottom = 1 << 3
     };
     typedef unsigned AnchorEdges;
-    
-    ViewportConstraints()
-        : m_anchorEdges(0)
-    { }
 
     virtual ~ViewportConstraints() { }
     
@@ -58,15 +54,47 @@ public:
     AnchorEdges anchorEdges() const { return m_anchorEdges; }
     bool hasAnchorEdge(AnchorEdgeFlags flag) const { return m_anchorEdges & flag; }
     void addAnchorEdge(AnchorEdgeFlags edgeFlag) { m_anchorEdges |= edgeFlag; }
+    void setAnchorEdges(AnchorEdges edges) { m_anchorEdges = edges; }
     
     FloatSize alignmentOffset() const { return m_alignmentOffset; }
     void setAlignmentOffset(const FloatSize& offset) { m_alignmentOffset = offset; }
 
 protected:
+    ViewportConstraints()
+        : m_anchorEdges(0)
+    { }
+
     FloatSize m_alignmentOffset;
     AnchorEdges m_anchorEdges;
 };
 
+class FixedPositionViewportConstraints : public ViewportConstraints {
+public:
+    FloatPoint layerPositionForViewportRect(const FloatRect& viewportRect) const;
+
+    const FloatRect& viewportRectAtLastLayout() const { return m_viewportRectAtLastLayout; }
+    void setViewportRectAtLastLayout(const FloatRect& rect) { m_viewportRectAtLastLayout = rect; }
+
+    const FloatPoint& layerPositionAtLastLayout() const { return m_layerPositionAtLastLayout; }
+    void setLayerPositionAtLastLayout(const FloatPoint& point) { m_layerPositionAtLastLayout = point; }
+
+    bool operator==(const FixedPositionViewportConstraints& other) const
+    {
+        return m_alignmentOffset == other.m_alignmentOffset
+            && m_anchorEdges == other.m_anchorEdges
+            && m_viewportRectAtLastLayout == other.m_viewportRectAtLastLayout
+            && m_layerPositionAtLastLayout == other.m_layerPositionAtLastLayout;
+    }
+
+    bool operator!=(const FixedPositionViewportConstraints& other) const { return !(*this == other); }
+
+private:
+    virtual ConstraintType constraintType() const OVERRIDE { return FixedPositionConstaint; };
+
+    FloatRect m_viewportRectAtLastLayout;
+    FloatPoint m_layerPositionAtLastLayout;
+};
+
 class StickyPositionViewportConstraints : public ViewportConstraints {
 public:
     StickyPositionViewportConstraints()
@@ -76,7 +104,6 @@ public:
         , m_bottomOffset(0)
     { }
 
-    virtual ConstraintType constraintType() const OVERRIDE { return StickyPositionConstraint; };
     FloatSize computeStickyOffset(const FloatRect& viewportRect) const;
 
     const FloatSize stickyOffsetAtLastLayout() const { return m_stickyOffsetAtLastLayout; }
@@ -101,6 +128,8 @@ public:
     void setAbsoluteStickyBoxRect(const FloatRect& rect) { m_absoluteStickyBoxRect = rect; }
 
 private:
+    virtual ConstraintType constraintType() const OVERRIDE { return StickyPositionConstraint; };
+
     float m_leftOffset;
     float m_rightOffset;
     float m_topOffset;
diff --git a/Source/WebCore/page/scrolling/ScrollingCoordinator.cpp b/Source/WebCore/page/scrolling/ScrollingCoordinator.cpp
index 382cfd07f..3446859c1 100644
--- a/Source/WebCore/page/scrolling/ScrollingCoordinator.cpp
+++ b/Source/WebCore/page/scrolling/ScrollingCoordinator.cpp
@@ -237,8 +237,14 @@ void ScrollingCoordinator::updateMainFrameScrollPosition(const IntPoint& scrollP
     frameView->setInProgrammaticScroll(oldProgrammaticScroll);
 
 #if USE(ACCELERATED_COMPOSITING)
-    if (GraphicsLayer* scrollLayer = scrollLayerForFrameView(frameView))
-        scrollLayer->syncPosition(-frameView->scrollPosition());
+    if (GraphicsLayer* scrollLayer = scrollLayerForFrameView(frameView)) {
+        if (programmaticScroll)
+            scrollLayer->setPosition(-frameView->scrollPosition());
+        else {
+            scrollLayer->syncPosition(-frameView->scrollPosition());
+            syncChildPositions(frameView->visibleContentRect());
+        }
+    }
 #endif
 }
 
@@ -319,4 +325,9 @@ ScrollingNodeID ScrollingCoordinator::uniqueScrollLayerID()
     return uniqueScrollLayerID++;
 }
 
+String ScrollingCoordinator::scrollingStateTreeAsText() const
+{
+    return String();
+}
+
 } // namespace WebCore
diff --git a/Source/WebCore/page/scrolling/ScrollingCoordinator.h b/Source/WebCore/page/scrolling/ScrollingCoordinator.h
index 2fa15fe2f..b008f9be8 100644
--- a/Source/WebCore/page/scrolling/ScrollingCoordinator.h
+++ b/Source/WebCore/page/scrolling/ScrollingCoordinator.h
@@ -27,6 +27,7 @@
 #define ScrollingCoordinator_h
 
 #include "IntRect.h"
+#include "LayoutTypes.h"
 #include "PlatformWheelEvent.h"
 #include "ScrollTypes.h"
 #include "Timer.h"
@@ -47,15 +48,15 @@ namespace WebCore {
 typedef unsigned MainThreadScrollingReasons;
 typedef uint64_t ScrollingNodeID;
 
+enum ScrollingNodeType { ScrollingNode, FixedNode };
+
 class Frame;
 class FrameView;
 class GraphicsLayer;
 class Page;
 class Region;
 class ScrollableArea;
-class ScrollingStateNode;
-class ScrollingStateScrollingNode;
-class ScrollingStateTree;
+class ViewportConstraints;
 
 #if ENABLE(THREADED_SCROLLING)
 class ScrollingTree;
@@ -109,9 +110,12 @@ public:
     virtual bool requestScrollPositionUpdate(FrameView*, const IntPoint&) { return false; }
     virtual bool handleWheelEvent(FrameView*, const PlatformWheelEvent&) { return true; }
     virtual void updateMainFrameScrollPositionAndScrollLayerPosition() { }
-    virtual ScrollingNodeID attachToStateTree(ScrollingNodeID newNodeID, ScrollingNodeID /*parentID*/) { return newNodeID; }
+    virtual ScrollingNodeID attachToStateTree(ScrollingNodeType, ScrollingNodeID newNodeID, ScrollingNodeID /*parentID*/) { return newNodeID; }
     virtual void detachFromStateTree(ScrollingNodeID) { }
     virtual void clearStateTree() { }
+    virtual void updateViewportConstrainedNode(ScrollingNodeID, const ViewportConstraints&, GraphicsLayer*) { }
+    virtual void syncChildPositions(const LayoutRect&) { }
+    virtual String scrollingStateTreeAsText() const;
 
     // Generated a unique id for scroll layers.
     ScrollingNodeID uniqueScrollLayerID();
diff --git a/Source/WebCore/page/scrolling/ScrollingStateFixedNode.cpp b/Source/WebCore/page/scrolling/ScrollingStateFixedNode.cpp
new file mode 100644
index 000000000..bc60aa884
--- /dev/null
+++ b/Source/WebCore/page/scrolling/ScrollingStateFixedNode.cpp
@@ -0,0 +1,111 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "ScrollingStateFixedNode.h"
+
+#include "ScrollingStateTree.h"
+#include "TextStream.h"
+#include <wtf/OwnPtr.h>
+
+#if ENABLE(THREADED_SCROLLING)
+
+namespace WebCore {
+
+PassOwnPtr<ScrollingStateFixedNode> ScrollingStateFixedNode::create(ScrollingStateTree* stateTree, ScrollingNodeID nodeID)
+{
+    return adoptPtr(new ScrollingStateFixedNode(stateTree, nodeID));
+}
+
+ScrollingStateFixedNode::ScrollingStateFixedNode(ScrollingStateTree* tree, ScrollingNodeID nodeID)
+    : ScrollingStateNode(tree, nodeID)
+    , m_changedProperties(0)
+{
+}
+
+ScrollingStateFixedNode::ScrollingStateFixedNode(const ScrollingStateFixedNode& node)
+    : ScrollingStateNode(node)
+    , m_constraints(FixedPositionViewportConstraints(node.viewportConstraints()))
+    , m_changedProperties(node.changedProperties())
+{
+}
+
+ScrollingStateFixedNode::~ScrollingStateFixedNode()
+{
+}
+
+PassOwnPtr<ScrollingStateNode> ScrollingStateFixedNode::clone()
+{
+    return adoptPtr(new ScrollingStateFixedNode(*this));
+}
+
+void ScrollingStateFixedNode::updateConstraints(const FixedPositionViewportConstraints& constraints)
+{
+    if (m_constraints == constraints)
+        return;
+
+    m_constraints = constraints;
+    m_changedProperties = ViewportConstraints;
+    m_scrollingStateTree->setHasChangedProperties(true);
+}
+
+void ScrollingStateFixedNode::dumpProperties(TextStream& ts, int indent) const
+{
+    ts << "(" << "Fixed node" << "\n";
+
+    if (m_constraints.anchorEdges()) {
+        writeIndent(ts, indent + 1);
+        ts << "(anchor edges: ";
+        if (m_constraints.hasAnchorEdge(ViewportConstraints::AnchorEdgeLeft))
+            ts << "AnchorEdgeLeft ";
+        if (m_constraints.hasAnchorEdge(ViewportConstraints::AnchorEdgeRight))
+            ts << "AnchorEdgeRight ";
+        if (m_constraints.hasAnchorEdge(ViewportConstraints::AnchorEdgeTop))
+            ts << "AnchorEdgeTop";
+        if (m_constraints.hasAnchorEdge(ViewportConstraints::AnchorEdgeBottom))
+            ts << "AnchorEdgeBottom";
+        ts << ")\n";
+    }
+
+    if (!m_constraints.alignmentOffset().isEmpty()) {
+        writeIndent(ts, indent + 1);
+        ts << "(alignment offset " << m_constraints.alignmentOffset().width() << " " << m_constraints.alignmentOffset().height() << ")\n";
+    }
+
+    if (!m_constraints.viewportRectAtLastLayout().isEmpty()) {
+        writeIndent(ts, indent + 1);
+        FloatRect viewportRect = m_constraints.viewportRectAtLastLayout();
+        ts << "(viewport rect at last layout: " << viewportRect.x() << " " << viewportRect.y() << " " << viewportRect.width() << " " << viewportRect.height() << ")\n";
+    }
+
+    if (m_constraints.layerPositionAtLastLayout() != FloatPoint()) {
+        writeIndent(ts, indent + 1);
+        ts << "(layer position at last layout " << m_constraints.layerPositionAtLastLayout().x() << " " << m_constraints.layerPositionAtLastLayout().y() << ")\n";
+    }
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(THREADED_SCROLLING)
diff --git a/Source/WebCore/page/scrolling/ScrollingStateFixedNode.h b/Source/WebCore/page/scrolling/ScrollingStateFixedNode.h
new file mode 100644
index 000000000..7c86397cb
--- /dev/null
+++ b/Source/WebCore/page/scrolling/ScrollingStateFixedNode.h
@@ -0,0 +1,85 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef ScrollingStateFixedNode_h
+#define ScrollingStateFixedNode_h
+
+#if ENABLE(THREADED_SCROLLING)
+
+#include "ScrollingConstraints.h"
+#include "ScrollingStateNode.h"
+
+#include <wtf/Forward.h>
+
+namespace WebCore {
+
+class FixedPositionViewportConstraints;
+
+class ScrollingStateFixedNode : public ScrollingStateNode {
+public:
+    static PassOwnPtr<ScrollingStateFixedNode> create(ScrollingStateTree*, ScrollingNodeID);
+
+    virtual PassOwnPtr<ScrollingStateNode> clone();
+
+    virtual ~ScrollingStateFixedNode();
+
+    enum ChangedPropertyForFixed {
+        ViewportConstraints = 1 << 0
+    };
+
+    virtual unsigned changedProperties() const OVERRIDE { return m_changedProperties; }
+
+    void updateConstraints(const FixedPositionViewportConstraints&);
+    const FixedPositionViewportConstraints& viewportConstraints() const { return m_constraints; }
+
+private:
+    ScrollingStateFixedNode(ScrollingStateTree*, ScrollingNodeID);
+    ScrollingStateFixedNode(const ScrollingStateFixedNode&);
+
+    virtual bool isFixedNode() OVERRIDE { return true; }
+
+    virtual bool hasChangedProperties() const OVERRIDE { return m_changedProperties; }
+    virtual void resetChangedProperties() OVERRIDE { m_changedProperties = 0; }
+
+    virtual void dumpProperties(TextStream&, int indent) const OVERRIDE;
+
+    FixedPositionViewportConstraints m_constraints;
+    unsigned m_changedProperties;
+};
+
+inline ScrollingStateFixedNode* toScrollingStateFixedNode(ScrollingStateNode* node)
+{
+    ASSERT(!node || node->isFixedNode());
+    return static_cast<ScrollingStateFixedNode*>(node);
+}
+    
+// This will catch anyone doing an unnecessary cast.
+void toScrollingStateFixedNode(const ScrollingStateFixedNode*);
+
+} // namespace WebCore
+
+#endif // ENABLE(THREADED_SCROLLING)
+
+#endif // ScrollingStateFixedNode_h
diff --git a/Source/WebCore/page/scrolling/ScrollingStateNode.cpp b/Source/WebCore/page/scrolling/ScrollingStateNode.cpp
index 8c1a3836b..b2aa8366e 100644
--- a/Source/WebCore/page/scrolling/ScrollingStateNode.cpp
+++ b/Source/WebCore/page/scrolling/ScrollingStateNode.cpp
@@ -26,7 +26,11 @@
 #include "config.h"
 #include "ScrollingStateNode.h"
 
+#include "ScrollingStateFixedNode.h"
 #include "ScrollingStateTree.h"
+#include "TextStream.h"
+
+#include <wtf/text/WTFString.h>
 
 #if ENABLE(THREADED_SCROLLING)
 
@@ -43,27 +47,39 @@ ScrollingStateNode::ScrollingStateNode(ScrollingStateTree* scrollingStateTree, S
 // This copy constructor is used for cloning nodes in the tree, and it doesn't make sense
 // to clone the relationship pointers, so don't copy that information from the original
 // node.
-ScrollingStateNode::ScrollingStateNode(ScrollingStateNode* stateNode)
+ScrollingStateNode::ScrollingStateNode(const ScrollingStateNode& stateNode)
     : m_scrollingStateTree(0)
-    , m_nodeID(stateNode->scrollingNodeID())
+    , m_nodeID(stateNode.scrollingNodeID())
     , m_parent(0)
-    , m_scrollLayerDidChange(stateNode->scrollLayerDidChange())
+    , m_scrollLayerDidChange(stateNode.scrollLayerDidChange())
 {
-    setScrollLayer(stateNode->platformScrollLayer());
+    setScrollLayer(stateNode.platformScrollLayer());
 }
 
 ScrollingStateNode::~ScrollingStateNode()
 {
 }
 
-void ScrollingStateNode::cloneAndResetChildNodes(ScrollingStateNode* clone)
+PassOwnPtr<ScrollingStateNode> ScrollingStateNode::cloneAndReset()
+{
+    OwnPtr<ScrollingStateNode> clone = this->clone();
+
+    // Now that this node is cloned, reset our change properties.
+    setScrollLayerDidChange(false);
+    resetChangedProperties();
+
+    cloneAndResetChildren(clone.get());
+    return clone.release();
+}
+
+void ScrollingStateNode::cloneAndResetChildren(ScrollingStateNode* clone)
 {
     if (!m_children)
         return;
 
     size_t size = m_children->size();
     for (size_t i = 0; i < size; ++i)
-        clone->appendChild(m_children->at(i)->cloneAndResetNode());
+        clone->appendChild(m_children->at(i)->cloneAndReset());
 }
 
 void ScrollingStateNode::appendChild(PassOwnPtr<ScrollingStateNode> childNode)
@@ -81,7 +97,11 @@ void ScrollingStateNode::removeChild(ScrollingStateNode* node)
     if (!m_children)
         return;
 
-    if (size_t index = m_children->find(node)) {
+    size_t index = m_children->find(node);
+
+    // The index will be notFound if the node to remove is a deeper-than-1-level descendant or
+    // if node is the root state node.
+    if (index != notFound) {
         m_scrollingStateTree->didRemoveNode(node->scrollingNodeID());
         m_children->remove(index);
         return;
@@ -92,6 +112,40 @@ void ScrollingStateNode::removeChild(ScrollingStateNode* node)
         m_children->at(i)->removeChild(node);
 }
 
+void ScrollingStateNode::writeIndent(TextStream& ts, int indent)
+{
+    for (int i = 0; i != indent; ++i)
+        ts << "  ";
+}
+
+void ScrollingStateNode::dump(TextStream& ts, int indent) const
+{
+    writeIndent(ts, indent);
+    dumpProperties(ts, indent);
+
+    if (m_children) {
+        writeIndent(ts, indent + 1);
+        size_t size = children()->size();
+        ts << "(children " << size << "\n";
+        
+        for (size_t i = 0; i < size; i++)
+            m_children->at(i)->dump(ts, indent + 2);
+        writeIndent(ts, indent + 1);
+        ts << ")\n";
+    }
+
+    writeIndent(ts, indent);
+    ts << ")\n";
+}
+
+String ScrollingStateNode::scrollingStateTreeAsText() const
+{
+    TextStream ts;
+
+    dump(ts, 0);
+    return ts.release();
+}
+
 } // namespace WebCore
 
 #endif // ENABLE(THREADED_SCROLLING)
diff --git a/Source/WebCore/page/scrolling/ScrollingStateNode.h b/Source/WebCore/page/scrolling/ScrollingStateNode.h
index eb8c389c6..60b9ef901 100644
--- a/Source/WebCore/page/scrolling/ScrollingStateNode.h
+++ b/Source/WebCore/page/scrolling/ScrollingStateNode.h
@@ -42,26 +42,28 @@ namespace WebCore {
 
 class GraphicsLayer;
 class ScrollingStateTree;
+class TextStream;
 
 class ScrollingStateNode {
-    WTF_MAKE_NONCOPYABLE(ScrollingStateNode);
-
 public:
     ScrollingStateNode(ScrollingStateTree*, ScrollingNodeID);
     virtual ~ScrollingStateNode();
 
-    virtual bool isScrollingStateScrollingNode() { return false; }
+    virtual bool isScrollingNode() { return false; }
+    virtual bool isFixedNode() { return false; }
 
-    virtual PassOwnPtr<ScrollingStateNode> cloneAndResetNode() = 0;
-    void cloneAndResetChildNodes(ScrollingStateNode*);
+    virtual PassOwnPtr<ScrollingStateNode> clone() = 0;
+    PassOwnPtr<ScrollingStateNode> cloneAndReset();
+    void cloneAndResetChildren(ScrollingStateNode*);
 
     virtual bool hasChangedProperties() const = 0;
     virtual unsigned changedProperties() const = 0;
     virtual void resetChangedProperties() = 0;
     virtual void setHasChangedProperties() { setScrollLayerDidChange(true); }
 
+    GraphicsLayer* graphicsLayer() { return m_graphicsLayer; }
     PlatformLayer* platformScrollLayer() const;
-    void setScrollLayer(const GraphicsLayer*);
+    void setScrollLayer(GraphicsLayer*);
     void setScrollLayer(PlatformLayer*);
 
     bool scrollLayerDidChange() const { return m_scrollLayerDidChange; }
@@ -81,12 +83,19 @@ public:
     void appendChild(PassOwnPtr<ScrollingStateNode>);
     void removeChild(ScrollingStateNode*);
 
+    String scrollingStateTreeAsText() const;
+
 protected:
-    ScrollingStateNode(ScrollingStateNode*);
+    ScrollingStateNode(const ScrollingStateNode&);
+    static void writeIndent(TextStream&, int indent);
 
     ScrollingStateTree* m_scrollingStateTree;
 
 private:
+    void dump(TextStream&, int indent) const;
+
+    virtual void dumpProperties(TextStream&, int indent) const = 0;
+
     ScrollingNodeID m_nodeID;
 
     ScrollingStateNode* m_parent;
@@ -97,6 +106,7 @@ private:
 #if PLATFORM(MAC)
     RetainPtr<PlatformLayer> m_platformScrollLayer;
 #endif
+    GraphicsLayer* m_graphicsLayer;
 
 };
 
diff --git a/Source/WebCore/page/scrolling/ScrollingStateScrollingNode.cpp b/Source/WebCore/page/scrolling/ScrollingStateScrollingNode.cpp
index ba3583075..5d37be2f5 100644
--- a/Source/WebCore/page/scrolling/ScrollingStateScrollingNode.cpp
+++ b/Source/WebCore/page/scrolling/ScrollingStateScrollingNode.cpp
@@ -27,6 +27,7 @@
 #include "ScrollingStateScrollingNode.h"
 
 #include "ScrollingStateTree.h"
+#include "TextStream.h"
 #include <wtf/OwnPtr.h>
 
 #if ENABLE(THREADED_SCROLLING)
@@ -53,23 +54,23 @@ ScrollingStateScrollingNode::ScrollingStateScrollingNode(ScrollingStateTree* sta
 {
 }
 
-ScrollingStateScrollingNode::ScrollingStateScrollingNode(ScrollingStateScrollingNode* stateNode)
+ScrollingStateScrollingNode::ScrollingStateScrollingNode(const ScrollingStateScrollingNode& stateNode)
     : ScrollingStateNode(stateNode)
-    , m_changedProperties(stateNode->changedProperties())
-    , m_viewportRect(stateNode->viewportRect())
-    , m_contentsSize(stateNode->contentsSize())
-    , m_nonFastScrollableRegion(stateNode->nonFastScrollableRegion())
-    , m_wheelEventHandlerCount(stateNode->wheelEventHandlerCount())
-    , m_shouldUpdateScrollLayerPositionOnMainThread(stateNode->shouldUpdateScrollLayerPositionOnMainThread())
-    , m_horizontalScrollElasticity(stateNode->horizontalScrollElasticity())
-    , m_verticalScrollElasticity(stateNode->verticalScrollElasticity())
-    , m_hasEnabledHorizontalScrollbar(stateNode->hasEnabledHorizontalScrollbar())
-    , m_hasEnabledVerticalScrollbar(stateNode->hasEnabledVerticalScrollbar())
-    , m_requestedScrollPositionRepresentsProgrammaticScroll(stateNode->requestedScrollPositionRepresentsProgrammaticScroll())
-    , m_horizontalScrollbarMode(stateNode->horizontalScrollbarMode())
-    , m_verticalScrollbarMode(stateNode->verticalScrollbarMode())
-    , m_requestedScrollPosition(stateNode->requestedScrollPosition())
-    , m_scrollOrigin(stateNode->scrollOrigin())
+    , m_changedProperties(stateNode.changedProperties())
+    , m_viewportRect(stateNode.viewportRect())
+    , m_contentsSize(stateNode.contentsSize())
+    , m_nonFastScrollableRegion(stateNode.nonFastScrollableRegion())
+    , m_wheelEventHandlerCount(stateNode.wheelEventHandlerCount())
+    , m_shouldUpdateScrollLayerPositionOnMainThread(stateNode.shouldUpdateScrollLayerPositionOnMainThread())
+    , m_horizontalScrollElasticity(stateNode.horizontalScrollElasticity())
+    , m_verticalScrollElasticity(stateNode.verticalScrollElasticity())
+    , m_hasEnabledHorizontalScrollbar(stateNode.hasEnabledHorizontalScrollbar())
+    , m_hasEnabledVerticalScrollbar(stateNode.hasEnabledVerticalScrollbar())
+    , m_requestedScrollPositionRepresentsProgrammaticScroll(stateNode.requestedScrollPositionRepresentsProgrammaticScroll())
+    , m_horizontalScrollbarMode(stateNode.horizontalScrollbarMode())
+    , m_verticalScrollbarMode(stateNode.verticalScrollbarMode())
+    , m_requestedScrollPosition(stateNode.requestedScrollPosition())
+    , m_scrollOrigin(stateNode.scrollOrigin())
 {
 }
 
@@ -77,16 +78,9 @@ ScrollingStateScrollingNode::~ScrollingStateScrollingNode()
 {
 }
 
-PassOwnPtr<ScrollingStateNode> ScrollingStateScrollingNode::cloneAndResetNode()
+PassOwnPtr<ScrollingStateNode> ScrollingStateScrollingNode::clone()
 {
-    OwnPtr<ScrollingStateScrollingNode> clone = adoptPtr(new ScrollingStateScrollingNode(this));
-
-    // Now that this node is cloned, reset our change properties.
-    setScrollLayerDidChange(false);
-    resetChangedProperties();
-
-    cloneAndResetChildNodes(clone.get());
-    return clone.release();
+    return adoptPtr(new ScrollingStateScrollingNode(*this));
 }
 
 void ScrollingStateScrollingNode::setViewportRect(const IntRect& viewportRect)
@@ -217,6 +211,48 @@ void ScrollingStateScrollingNode::setScrollOrigin(const IntPoint& scrollOrigin)
     m_scrollingStateTree->setHasChangedProperties(true);
 }
 
+void ScrollingStateScrollingNode::dumpProperties(TextStream& ts, int indent) const
+{
+    ts << "(" << "Scrolling node" << "\n";
+
+    if (!m_viewportRect.isEmpty()) {
+        writeIndent(ts, indent + 1);
+        ts << "(viewport rect " << m_viewportRect.x() << " " << m_viewportRect.y() << " " << m_viewportRect.width() << " " << m_viewportRect.height() << ")\n";
+    }
+
+    if (!m_contentsSize.isEmpty()) {
+        writeIndent(ts, indent + 1);
+        ts << "(contents size " << m_contentsSize.width() << " " << m_contentsSize.height() << ")\n";
+    }
+
+    if (m_shouldUpdateScrollLayerPositionOnMainThread) {
+        writeIndent(ts, indent + 1);
+        ts << "(Scrolling on main thread because: ";
+        if (m_shouldUpdateScrollLayerPositionOnMainThread & ScrollingCoordinator::ForcedOnMainThread)
+            ts << "Forced on main thread, ";
+        if (m_shouldUpdateScrollLayerPositionOnMainThread & ScrollingCoordinator::HasSlowRepaintObjects)
+            ts << "Has slow repaint objects, ";
+        if (m_shouldUpdateScrollLayerPositionOnMainThread & ScrollingCoordinator::HasViewportConstrainedObjectsWithoutSupportingFixedLayers)
+            ts << "Has viewport constrained objects without supporting fixed layers, ";
+        if (m_shouldUpdateScrollLayerPositionOnMainThread & ScrollingCoordinator::HasNonLayerFixedObjects)
+            ts << "Has non-layer fixed objects, ";
+        if (m_shouldUpdateScrollLayerPositionOnMainThread & ScrollingCoordinator::IsImageDocument)
+            ts << "Is image document";
+        ts << ")\n";
+    }
+
+    if (m_requestedScrollPosition != IntPoint()) {
+        writeIndent(ts, indent + 1);
+        ts << "(requested scroll position " << m_requestedScrollPosition.x() << " " << m_requestedScrollPosition.y() << ")\n";
+    }
+
+    if (m_scrollOrigin != IntPoint()) {
+        writeIndent(ts, indent + 1);
+        ts << "(scroll origin " << m_scrollOrigin.x() << " " << m_scrollOrigin.y() << ")\n";
+    }
+
+}
+
 } // namespace WebCore
 
 #endif // ENABLE(THREADED_SCROLLING)
diff --git a/Source/WebCore/page/scrolling/ScrollingStateScrollingNode.h b/Source/WebCore/page/scrolling/ScrollingStateScrollingNode.h
index 714d92683..5902e27bd 100644
--- a/Source/WebCore/page/scrolling/ScrollingStateScrollingNode.h
+++ b/Source/WebCore/page/scrolling/ScrollingStateScrollingNode.h
@@ -40,6 +40,9 @@ namespace WebCore {
 class ScrollingStateScrollingNode : public ScrollingStateNode {
 public:
     static PassOwnPtr<ScrollingStateScrollingNode> create(ScrollingStateTree*, ScrollingNodeID);
+
+    virtual PassOwnPtr<ScrollingStateNode> clone();
+
     virtual ~ScrollingStateScrollingNode();
 
     enum ChangedProperty {
@@ -58,9 +61,7 @@ public:
         RequestedScrollPosition = 1 << 12,
     };
 
-    virtual bool isScrollingStateScrollingNode() OVERRIDE { return true; }
-
-    virtual PassOwnPtr<ScrollingStateNode> cloneAndResetNode() OVERRIDE;
+    virtual bool isScrollingNode() OVERRIDE { return true; }
 
     virtual bool hasChangedProperties() const OVERRIDE { return m_changedProperties; }
     virtual unsigned changedProperties() const OVERRIDE { return m_changedProperties; }
@@ -107,9 +108,11 @@ public:
 
     bool requestedScrollPositionRepresentsProgrammaticScroll() const { return m_requestedScrollPositionRepresentsProgrammaticScroll; }
 
+    virtual void dumpProperties(TextStream&, int indent) const OVERRIDE;
+
 private:
     ScrollingStateScrollingNode(ScrollingStateTree*, ScrollingNodeID);
-    ScrollingStateScrollingNode(ScrollingStateScrollingNode*);
+    ScrollingStateScrollingNode(const ScrollingStateScrollingNode&);
 
     unsigned m_changedProperties;
 
@@ -138,7 +141,7 @@ private:
 
 inline ScrollingStateScrollingNode* toScrollingStateScrollingNode(ScrollingStateNode* node)
 {
-    ASSERT(!node || node->isScrollingStateScrollingNode());
+    ASSERT(!node || node->isScrollingNode());
     return static_cast<ScrollingStateScrollingNode*>(node);
 }
     
diff --git a/Source/WebCore/page/scrolling/ScrollingStateTree.cpp b/Source/WebCore/page/scrolling/ScrollingStateTree.cpp
index 84bc5db05..4e3b5385d 100644
--- a/Source/WebCore/page/scrolling/ScrollingStateTree.cpp
+++ b/Source/WebCore/page/scrolling/ScrollingStateTree.cpp
@@ -49,7 +49,7 @@ PassOwnPtr<ScrollingStateTree> ScrollingStateTree::commit()
 {
     // This function clones and resets the current state tree, but leaves the tree structure intact. 
     OwnPtr<ScrollingStateTree> treeStateClone = ScrollingStateTree::create();
-    treeStateClone->setRootStateNode(static_pointer_cast<ScrollingStateScrollingNode>(m_rootStateNode->cloneAndResetNode()));
+    treeStateClone->setRootStateNode(static_pointer_cast<ScrollingStateScrollingNode>(m_rootStateNode->cloneAndReset()));
 
     // Copy the IDs of the nodes that have been removed since the last commit into the clone.
     treeStateClone->m_nodesRemovedSinceLastCommit.swap(m_nodesRemovedSinceLastCommit);
diff --git a/Source/WebCore/page/scrolling/ScrollingTree.cpp b/Source/WebCore/page/scrolling/ScrollingTree.cpp
index 5a332f05f..a1d4a489a 100644
--- a/Source/WebCore/page/scrolling/ScrollingTree.cpp
+++ b/Source/WebCore/page/scrolling/ScrollingTree.cpp
@@ -32,6 +32,7 @@
 #include "ScrollingCoordinator.h"
 #include "ScrollingStateTree.h"
 #include "ScrollingThread.h"
+#include "ScrollingTreeFixedNode.h"
 #include "ScrollingTreeNode.h"
 #include "ScrollingTreeScrollingNode.h"
 #include <wtf/MainThread.h>
@@ -162,9 +163,13 @@ void ScrollingTree::updateTreeFromStateNode(ScrollingStateNode* stateNode)
             m_nodeMap.set(stateNode->scrollingNodeID(), m_rootNode.get());
             m_rootNode->update(stateNode);
         } else {
-            // FIXME: In the future, we will have more than just ScrollingTreeScrollingNode, so we'll have to
-            // figure out which type of node to create.
-            OwnPtr<ScrollingTreeNode> newNode = ScrollingTreeScrollingNode::create(this);
+            OwnPtr<ScrollingTreeNode> newNode;
+            if (stateNode->isScrollingNode())
+                newNode = ScrollingTreeScrollingNode::create(this);
+            else if (stateNode->isFixedNode())
+                newNode = ScrollingTreeFixedNode::create(this);
+            else
+                ASSERT_NOT_REACHED();
             ScrollingTreeNode* newNodeRawPtr = newNode.get();
             m_nodeMap.set(stateNode->scrollingNodeID(), newNodeRawPtr);
             ScrollingTreeNodeMap::const_iterator it = m_nodeMap.find(stateNode->parent()->scrollingNodeID());
diff --git a/Source/WebCore/page/scrolling/ScrollingTree.h b/Source/WebCore/page/scrolling/ScrollingTree.h
index b0c51ca90..525af3f10 100644
--- a/Source/WebCore/page/scrolling/ScrollingTree.h
+++ b/Source/WebCore/page/scrolling/ScrollingTree.h
@@ -47,9 +47,10 @@ OBJC_CLASS CALayer;
 namespace WebCore {
 
 class IntPoint;
+class ScrollingStateNode;
+class ScrollingStateTree;
 class ScrollingTreeNode;
 class ScrollingTreeScrollingNode;
-class ScrollingStateTree;
 
 // The ScrollingTree class lives almost exclusively on the scrolling thread and manages the
 // hierarchy of scrollable regions on the page. It's also responsible for dispatching events
diff --git a/Source/WebCore/page/scrolling/ScrollingTreeNode.h b/Source/WebCore/page/scrolling/ScrollingTreeNode.h
index 46addc40e..06027ad50 100644
--- a/Source/WebCore/page/scrolling/ScrollingTreeNode.h
+++ b/Source/WebCore/page/scrolling/ScrollingTreeNode.h
@@ -35,6 +35,10 @@
 
 namespace WebCore {
 
+class ScrollingStateFixedNode;
+class ScrollingStateNode;
+class ScrollingStateScrollingNode;
+
 class ScrollingTreeNode {
 public:
     explicit ScrollingTreeNode(ScrollingTree*);
@@ -42,6 +46,8 @@ public:
 
     virtual void update(ScrollingStateNode*) = 0;
 
+    virtual void parentScrollPositionDidChange(const IntRect& viewportRect) = 0;
+
     ScrollingNodeID scrollingNodeID() const { return m_nodeID; }
     void setScrollingNodeID(ScrollingNodeID nodeID) { m_nodeID = nodeID; }
 
@@ -54,13 +60,15 @@ public:
 protected:
     ScrollingTree* scrollingTree() const { return m_scrollingTree; }
 
+    typedef Vector<OwnPtr<ScrollingTreeNode> > ScrollingTreeChildrenVector;
+    OwnPtr<ScrollingTreeChildrenVector> m_children;
+
 private:
     ScrollingTree* m_scrollingTree;
 
     ScrollingNodeID m_nodeID;
 
     ScrollingTreeNode* m_parent;
-    OwnPtr<Vector<OwnPtr<ScrollingTreeNode> > > m_children;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/page/scrolling/ScrollingTreeScrollingNode.h b/Source/WebCore/page/scrolling/ScrollingTreeScrollingNode.h
index 23e0fde15..7b62fd8e7 100644
--- a/Source/WebCore/page/scrolling/ScrollingTreeScrollingNode.h
+++ b/Source/WebCore/page/scrolling/ScrollingTreeScrollingNode.h
@@ -46,6 +46,10 @@ public:
     virtual ~ScrollingTreeScrollingNode();
 
     virtual void update(ScrollingStateNode*) OVERRIDE;
+
+    // FIXME: We should implement this when we support ScrollingTreeScrollingNodes as children.
+    virtual void parentScrollPositionDidChange(const IntRect& /*viewportRect*/) OVERRIDE { }
+
     virtual void handleWheelEvent(const PlatformWheelEvent&) = 0;
     virtual void setScrollPosition(const IntPoint&) = 0;
 
diff --git a/Source/WebCore/page/scrolling/mac/ScrollingCoordinatorMac.h b/Source/WebCore/page/scrolling/mac/ScrollingCoordinatorMac.h
index de0d9a5c7..46e1249ee 100644
--- a/Source/WebCore/page/scrolling/mac/ScrollingCoordinatorMac.h
+++ b/Source/WebCore/page/scrolling/mac/ScrollingCoordinatorMac.h
@@ -32,6 +32,10 @@
 
 namespace WebCore {
 
+class ScrollingStateNode;
+class ScrollingStateScrollingNode;
+class ScrollingStateTree;
+
 class ScrollingCoordinatorMac : public ScrollingCoordinator {
 public:
     explicit ScrollingCoordinatorMac(Page*);
@@ -66,18 +70,30 @@ public:
 
     // These functions are used to indicate that a layer should be (or should not longer be) represented by a node
     // in the scrolling tree.
-    virtual ScrollingNodeID attachToStateTree(ScrollingNodeID newNodeID, ScrollingNodeID parentID);
+    virtual ScrollingNodeID attachToStateTree(ScrollingNodeType, ScrollingNodeID newNodeID, ScrollingNodeID parentID);
     virtual void detachFromStateTree(ScrollingNodeID);
 
     // This function wipes out the current tree.
     virtual void clearStateTree();
 
+    virtual String scrollingStateTreeAsText() const OVERRIDE;
+
 private:
+    // Return whether this scrolling coordinator can keep fixed position layers fixed to their
+    // containers while scrolling.
+    virtual bool supportsFixedPositionLayers() const OVERRIDE { return true; }
+
+    // This function will update the ScrollingStateNode for the given viewport constrained object.
+    virtual void updateViewportConstrainedNode(ScrollingNodeID, const ViewportConstraints&, GraphicsLayer*) OVERRIDE;
+
+    // Called to synch the GraphicsLayer positions for child layers when their CALayers have been moved by the scrolling thread.
+    virtual void syncChildPositions(const LayoutRect& viewportRect) OVERRIDE;
+
     virtual void recomputeWheelEventHandlerCountForFrameView(FrameView*);
     virtual void setShouldUpdateScrollLayerPositionOnMainThread(MainThreadScrollingReasons);
 
     void ensureRootStateNodeForFrameView(FrameView*);
-    ScrollingStateScrollingNode* stateNodeForID(ScrollingNodeID);
+    ScrollingStateNode* stateNodeForID(ScrollingNodeID);
 
     struct ScrollParameters {
         ScrollElasticity horizontalScrollElasticity;
@@ -107,6 +123,8 @@ private:
     void scrollingStateTreeCommitterTimerFired(Timer<ScrollingCoordinatorMac>*);
     void commitTreeState();
 
+    void removeNode(ScrollingStateNode*);
+
     OwnPtr<ScrollingStateTree> m_scrollingStateTree;
     RefPtr<ScrollingTree> m_scrollingTree;
     Timer<ScrollingCoordinatorMac> m_scrollingStateTreeCommitterTimer;
diff --git a/Source/WebCore/page/scrolling/mac/ScrollingCoordinatorMac.mm b/Source/WebCore/page/scrolling/mac/ScrollingCoordinatorMac.mm
index 5a03ef31d..6f0de4486 100644
--- a/Source/WebCore/page/scrolling/mac/ScrollingCoordinatorMac.mm
+++ b/Source/WebCore/page/scrolling/mac/ScrollingCoordinatorMac.mm
@@ -39,6 +39,8 @@
 #include "RenderLayerCompositor.h"
 #include "RenderView.h"
 #include "ScrollAnimator.h"
+#include "ScrollingConstraints.h"
+#include "ScrollingStateFixedNode.h"
 #include "ScrollingStateScrollingNode.h"
 #include "ScrollingStateTree.h"
 #include "ScrollingThread.h"
@@ -109,7 +111,7 @@ void ScrollingCoordinatorMac::frameViewLayoutUpdated(FrameView* frameView)
     if (!coordinatesScrollingForFrameView(frameView))
         return;
 
-    ScrollingStateScrollingNode* node = stateNodeForID(frameView->scrollLayerID());
+    ScrollingStateScrollingNode* node = toScrollingStateScrollingNode(stateNodeForID(frameView->scrollLayerID()));
     if (!node)
         return;
 
@@ -130,7 +132,7 @@ void ScrollingCoordinatorMac::frameViewLayoutUpdated(FrameView* frameView)
 
 void ScrollingCoordinatorMac::recomputeWheelEventHandlerCountForFrameView(FrameView* frameView)
 {
-    ScrollingStateScrollingNode* node = stateNodeForID(frameView->scrollLayerID());
+    ScrollingStateScrollingNode* node = toScrollingStateScrollingNode(stateNodeForID(frameView->scrollLayerID()));
     if (!node)
         return;
     setWheelEventHandlerCountForNode(computeCurrentWheelEventHandlerCount(), node);
@@ -183,14 +185,15 @@ bool ScrollingCoordinatorMac::requestScrollPositionUpdate(FrameView* frameView,
     if (!coordinatesScrollingForFrameView(frameView))
         return false;
 
-    if (frameView->frame()->document()->inPageCache()) {
-        // If this frame view's document is being put into the page cache, we don't want to update our
-        // main frame scroll position. Just let the FrameView think that we did.
+    if (frameView->inProgrammaticScroll() || frameView->frame()->document()->inPageCache())
         updateMainFrameScrollPosition(scrollPosition, frameView->inProgrammaticScroll());
+
+    // If this frame view's document is being put into the page cache, we don't want to update our
+    // main frame scroll position. Just let the FrameView think that we did.
+    if (frameView->frame()->document()->inPageCache())
         return true;
-    }
 
-    ScrollingStateScrollingNode* stateNode = stateNodeForID(frameView->scrollLayerID());
+    ScrollingStateScrollingNode* stateNode = toScrollingStateScrollingNode(stateNodeForID(frameView->scrollLayerID()));
     if (!stateNode)
         return false;
 
@@ -233,28 +236,59 @@ void ScrollingCoordinatorMac::updateMainFrameScrollPositionAndScrollLayerPositio
         scrollLayer->setPosition(-frameView->scrollPosition());
 }
 
-ScrollingNodeID ScrollingCoordinatorMac::attachToStateTree(ScrollingNodeID newNodeID, ScrollingNodeID parentID)
+ScrollingNodeID ScrollingCoordinatorMac::attachToStateTree(ScrollingNodeType nodeType, ScrollingNodeID newNodeID, ScrollingNodeID parentID)
 {
     ASSERT(newNodeID);
 
-    ScrollingStateScrollingNode* existingNode = stateNodeForID(newNodeID);
-    if (existingNode && existingNode == m_scrollingStateTree->rootStateNode())
+    if (stateNodeForID(newNodeID))
         return newNodeID;
 
-    // If there is no parent, this is the root node. Right now, we only support the root node.
-    // FIXME: In the future, we should append child nodes in the appropriate spot in the state
-    // tree.
+    ScrollingStateNode* newNode;
     if (!parentID) {
         // If we're resetting the root node, we should clear the HashMap and destroy the current children.
         clearStateTree();
 
         m_scrollingStateTree->rootStateNode()->setScrollingNodeID(newNodeID);
-        m_stateNodeMap.set(newNodeID, m_scrollingStateTree->rootStateNode());
+        newNode = m_scrollingStateTree->rootStateNode();
+    } else {
+        ScrollingStateNode* parent = stateNodeForID(parentID);
+        switch (nodeType) {
+        case FixedNode: {
+            ASSERT(supportsFixedPositionLayers());
+            OwnPtr<ScrollingStateFixedNode> fixedNode = ScrollingStateFixedNode::create(m_scrollingStateTree.get(), newNodeID);
+            newNode = fixedNode.get();
+            parent->appendChild(fixedNode.release());
+            break;
+        }
+        case ScrollingNode: {
+            // FIXME: We currently only support child nodes that are fixed.
+            ASSERT_NOT_REACHED();
+            OwnPtr<ScrollingStateScrollingNode> scrollingNode = ScrollingStateScrollingNode::create(m_scrollingStateTree.get(), newNodeID);
+            newNode = scrollingNode.get();
+            parent->appendChild(scrollingNode.release());
+            break;
+        }
+        default:
+            ASSERT_NOT_REACHED();
+        }
     }
 
+    m_stateNodeMap.set(newNodeID, newNode);
     return newNodeID;
 }
 
+void ScrollingCoordinatorMac::removeNode(ScrollingStateNode* node)
+{
+    m_scrollingStateTree->removeNode(node);
+
+    // ScrollingStateTree::removeNode() will destroy children, so we have to make sure we remove those children
+    // from the HashMap.
+    const Vector<ScrollingNodeID>& removedNodes = m_scrollingStateTree->removedNodes();
+    size_t size = removedNodes.size();
+    for (size_t i = 0; i < size; ++i)
+        m_stateNodeMap.remove(removedNodes[i]);
+}
+
 void ScrollingCoordinatorMac::detachFromStateTree(ScrollingNodeID scrollLayerID)
 {
     if (!scrollLayerID)
@@ -265,23 +299,15 @@ void ScrollingCoordinatorMac::detachFromStateTree(ScrollingNodeID scrollLayerID)
     if (!node)
         return;
 
-    m_scrollingStateTree->removeNode(node);
-
-    // ScrollingStateTree::removeNode() will destroy children, so we have to make sure we remove those children
-    // from the HashMap.
-    const Vector<ScrollingNodeID>& removedNodes = m_scrollingStateTree->removedNodes();
-    size_t size = removedNodes.size();
-    for (size_t i = 0; i < size; ++i)
-        m_stateNodeMap.remove(removedNodes[i]);
+    removeNode(node);
 }
 
 void ScrollingCoordinatorMac::clearStateTree()
 {
-    m_stateNodeMap.clear();
-    m_scrollingStateTree->removeNode(m_scrollingStateTree->rootStateNode());
+    removeNode(m_scrollingStateTree->rootStateNode());
 }
 
-ScrollingStateScrollingNode* ScrollingCoordinatorMac::stateNodeForID(ScrollingNodeID scrollLayerID)
+ScrollingStateNode* ScrollingCoordinatorMac::stateNodeForID(ScrollingNodeID scrollLayerID)
 {
     if (!scrollLayerID)
         return 0;
@@ -290,13 +316,12 @@ ScrollingStateScrollingNode* ScrollingCoordinatorMac::stateNodeForID(ScrollingNo
     if (it == m_stateNodeMap.end())
         return 0;
 
-    ScrollingStateNode* node = it->value;
-    return toScrollingStateScrollingNode(node);
+    return it->value;
 }
 
 void ScrollingCoordinatorMac::ensureRootStateNodeForFrameView(FrameView* frameView)
 {
-    attachToStateTree(frameView->scrollLayerID(), 0);
+    attachToStateTree(ScrollingNode, frameView->scrollLayerID(), 0);
 }
 
 void ScrollingCoordinatorMac::setScrollLayerForNode(GraphicsLayer* scrollLayer, ScrollingStateNode* node)
@@ -358,6 +383,34 @@ void ScrollingCoordinatorMac::updateMainFrameScrollLayerPosition()
         scrollLayer->setPosition(-frameView->scrollPosition());
 }
 
+void ScrollingCoordinatorMac::syncChildPositions(const LayoutRect& viewportRect)
+{
+    Vector<OwnPtr<ScrollingStateNode> >* children = m_scrollingStateTree->rootStateNode()->children();
+    if (!children)
+        return;
+
+    // FIXME: We'll have to traverse deeper into the tree at some point.
+    size_t size = children->size();
+    for (size_t i = 0; i < size; ++i) {
+        ScrollingStateFixedNode* child = toScrollingStateFixedNode(children->at(i).get());
+        FloatPoint position = child->viewportConstraints().layerPositionForViewportRect(viewportRect);
+        child->graphicsLayer()->setPosition(position);
+    }
+}
+
+void ScrollingCoordinatorMac::updateViewportConstrainedNode(ScrollingNodeID nodeID, const ViewportConstraints& constraints, GraphicsLayer* graphicsLayer)
+{
+    ASSERT(supportsFixedPositionLayers());
+
+    // FIXME: We should support sticky position here!
+    if (constraints.constraintType() == ViewportConstraints::StickyPositionConstraint)
+        return;
+
+    ScrollingStateFixedNode* node = toScrollingStateFixedNode(stateNodeForID(nodeID));
+    setScrollLayerForNode(graphicsLayer, node);
+    node->updateConstraints((const FixedPositionViewportConstraints&)constraints);
+}
+
 void ScrollingCoordinatorMac::scheduleTreeStateCommit()
 {
     if (m_scrollingStateTreeCommitterTimer.isActive())
@@ -382,6 +435,11 @@ void ScrollingCoordinatorMac::commitTreeState()
     ScrollingThread::dispatch(bind(&ScrollingTree::commitNewTreeState, m_scrollingTree.get(), treeState.release()));
 }
 
+String ScrollingCoordinatorMac::scrollingStateTreeAsText() const
+{
+    return m_scrollingStateTree->rootStateNode()->scrollingStateTreeAsText();
+}
+
 } // namespace WebCore
 
 #endif // ENABLE(THREADED_SCROLLING)
diff --git a/Source/WebCore/page/scrolling/mac/ScrollingStateNodeMac.mm b/Source/WebCore/page/scrolling/mac/ScrollingStateNodeMac.mm
index d4658dd64..41f381b54 100644
--- a/Source/WebCore/page/scrolling/mac/ScrollingStateNodeMac.mm
+++ b/Source/WebCore/page/scrolling/mac/ScrollingStateNodeMac.mm
@@ -43,7 +43,7 @@ void ScrollingStateNode::setScrollLayer(PlatformLayer* platformLayer)
     m_platformScrollLayer = platformLayer;
 }
 
-void ScrollingStateNode::setScrollLayer(const GraphicsLayer* graphicsLayer)
+void ScrollingStateNode::setScrollLayer(GraphicsLayer* graphicsLayer)
 {
     PlatformLayer* platformScrollLayer = graphicsLayer ? graphicsLayer->platformLayer() : nil;
 
@@ -51,6 +51,8 @@ void ScrollingStateNode::setScrollLayer(const GraphicsLayer* graphicsLayer)
         return;
 
     m_platformScrollLayer = platformScrollLayer;
+    m_graphicsLayer = graphicsLayer;
+
     m_scrollLayerDidChange = true;
     m_scrollingStateTree->setHasChangedProperties(true);
 }
diff --git a/Source/WebCore/page/scrolling/mac/ScrollingTreeFixedNode.h b/Source/WebCore/page/scrolling/mac/ScrollingTreeFixedNode.h
new file mode 100644
index 000000000..c3acfc6ed
--- /dev/null
+++ b/Source/WebCore/page/scrolling/mac/ScrollingTreeFixedNode.h
@@ -0,0 +1,61 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef ScrollingTreeFixedNode_h
+#define ScrollingTreeFixedNode_h
+
+#if ENABLE(THREADED_SCROLLING)
+
+#include "ScrollingConstraints.h"
+#include "ScrollingTreeNode.h"
+#include <wtf/RetainPtr.h>
+
+OBJC_CLASS CALayer;
+
+namespace WebCore {
+
+class FixedPositionViewportConstraints;
+
+class ScrollingTreeFixedNode : public ScrollingTreeNode {
+public:
+    static PassOwnPtr<ScrollingTreeFixedNode> create(ScrollingTree*);
+
+    virtual ~ScrollingTreeFixedNode();
+
+private:
+    ScrollingTreeFixedNode(ScrollingTree*);
+
+    virtual void update(ScrollingStateNode*) OVERRIDE;
+    virtual void parentScrollPositionDidChange(const IntRect& viewportRect) OVERRIDE;
+
+    FixedPositionViewportConstraints m_constraints;
+    RetainPtr<CALayer> m_layer;
+};
+
+} // namespace WebCore
+
+#endif // ENABLE(THREADED_SCROLLING)
+
+#endif // ScrollingTreeFixedNode_h
diff --git a/Source/WebCore/page/scrolling/mac/ScrollingTreeFixedNode.mm b/Source/WebCore/page/scrolling/mac/ScrollingTreeFixedNode.mm
new file mode 100644
index 000000000..c4edfc234
--- /dev/null
+++ b/Source/WebCore/page/scrolling/mac/ScrollingTreeFixedNode.mm
@@ -0,0 +1,86 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "ScrollingTreeFixedNode.h"
+
+#if ENABLE(THREADED_SCROLLING)
+
+#include "ScrollingStateFixedNode.h"
+#include "ScrollingTree.h"
+
+namespace WebCore {
+
+PassOwnPtr<ScrollingTreeFixedNode> ScrollingTreeFixedNode::create(ScrollingTree* scrollingTree)
+{
+    return adoptPtr(new ScrollingTreeFixedNode(scrollingTree));
+}
+
+ScrollingTreeFixedNode::ScrollingTreeFixedNode(ScrollingTree* scrollingTree)
+    : ScrollingTreeNode(scrollingTree)
+    , m_constraints(FixedPositionViewportConstraints())
+{
+}
+
+ScrollingTreeFixedNode::~ScrollingTreeFixedNode()
+{
+}
+
+void ScrollingTreeFixedNode::update(ScrollingStateNode* stateNode)
+{
+    ScrollingStateFixedNode* state = toScrollingStateFixedNode(stateNode);
+
+    if (state->scrollLayerDidChange())
+        m_layer = state->platformScrollLayer();
+
+    if (stateNode->changedProperties() & ScrollingStateFixedNode::ViewportConstraints)
+        m_constraints = state->viewportConstraints();
+}
+
+static inline CGPoint operator*(CGPoint& a, const CGSize& b)
+{
+    return CGPointMake(a.x * b.width, a.y * b.height);
+}
+
+void ScrollingTreeFixedNode::parentScrollPositionDidChange(const IntRect& viewportRect)
+{
+    FloatPoint layerPosition = m_constraints.layerPositionForViewportRect(viewportRect);
+
+    CGRect layerBounds = [m_layer.get() bounds];
+    CGPoint anchorPoint = [m_layer.get() anchorPoint];
+    CGPoint newPosition = layerPosition - m_constraints.alignmentOffset() + anchorPoint * layerBounds.size;
+    [m_layer.get() setPosition:newPosition];
+
+    if (!m_children)
+        return;
+
+    size_t size = m_children->size();
+    for (size_t i = 0; i < size; ++i)
+        m_children->at(i)->parentScrollPositionDidChange(viewportRect);
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(THREADED_SCROLLING)
diff --git a/Source/WebCore/page/scrolling/mac/ScrollingTreeScrollingNodeMac.mm b/Source/WebCore/page/scrolling/mac/ScrollingTreeScrollingNodeMac.mm
index efa23f911..bd6d7280a 100644
--- a/Source/WebCore/page/scrolling/mac/ScrollingTreeScrollingNodeMac.mm
+++ b/Source/WebCore/page/scrolling/mac/ScrollingTreeScrollingNodeMac.mm
@@ -275,6 +275,13 @@ void ScrollingTreeScrollingNodeMac::setScrollLayerPosition(const IntPoint& posit
 {
     ASSERT(!shouldUpdateScrollLayerPositionOnMainThread());
     m_scrollLayer.get().position = CGPointMake(-position.x() + scrollOrigin().x(), -position.y() + scrollOrigin().y());
+
+    if (!m_children)
+        return;
+
+    size_t size = m_children->size();
+    for (size_t i = 0; i < size; ++i)
+        m_children->at(i)->parentScrollPositionDidChange(IntRect(position, viewportRect().size()));
 }
 
 IntPoint ScrollingTreeScrollingNodeMac::minimumScrollPosition() const
diff --git a/Source/WebCore/platform/CookieJar.h b/Source/WebCore/platform/CookieJar.h
index f21cfd4df..f4cfd86ca 100644
--- a/Source/WebCore/platform/CookieJar.h
+++ b/Source/WebCore/platform/CookieJar.h
@@ -33,22 +33,24 @@
 
 namespace WebCore {
 
-    class Document;
-    class KURL;
-
-    struct Cookie;
-
-    // cookies omits HttpOnly cookies.
-    String cookies(const Document*, const KURL&);
-    String cookieRequestHeaderFieldValue(const Document*, const KURL&);
-    void setCookies(Document*, const KURL&, const String&);
-    bool cookiesEnabled(const Document*);
-    bool getRawCookies(const Document*, const KURL&, Vector<Cookie>&);
-    void deleteCookie(const Document*, const KURL&, const String&);
-
-    void getHostnamesWithCookies(HashSet<String>& hostnames);
-    void deleteCookiesForHostname(const String& hostname);
-    void deleteAllCookies();
+class Document;
+class KURL;
+struct Cookie;
+
+// These two functions implement document.cookie API, with special rules for HttpOnly cookies.
+String cookies(const Document*, const KURL&);
+void setCookies(Document*, const KURL&, const String&);
+
+// These methods use current cookie storage, thus taking private browsing mode into account.
+bool cookiesEnabled(const Document*);
+String cookieRequestHeaderFieldValue(const Document*, const KURL&);
+bool getRawCookies(const Document*, const KURL&, Vector<Cookie>&);
+void deleteCookie(const Document*, const KURL&, const String&);
+
+// These functions always access default cookie storage, not taking private browsing mode into account.
+void getHostnamesWithCookies(HashSet<String>& hostnames);
+void deleteCookiesForHostname(const String& hostname);
+void deleteAllCookies();
 
 }
 
diff --git a/Source/WebCore/platform/DateTimeChooser.h b/Source/WebCore/platform/DateTimeChooser.h
index 86ab13c6f..405dfdd97 100644
--- a/Source/WebCore/platform/DateTimeChooser.h
+++ b/Source/WebCore/platform/DateTimeChooser.h
@@ -31,7 +31,9 @@
 #ifndef DateTimeChooser_h
 #define DateTimeChooser_h
 
+#if ENABLE(DATE_AND_TIME_INPUT_TYPES)
 #include "IntRect.h"
+#include <wtf/RefCounted.h>
 #include <wtf/text/WTFString.h>
 
 namespace WebCore {
@@ -52,7 +54,7 @@ struct DateTimeChooserParameters {
 };
 
 // For pickers like color pickers and date pickers.
-class DateTimeChooser {
+class DateTimeChooser : public RefCounted<DateTimeChooser> {
 public:
     virtual ~DateTimeChooser() { }
 
@@ -60,5 +62,5 @@ public:
 };
 
 } // namespace WebCore
-
+#endif
 #endif // DateTimeChooser_h
diff --git a/Source/WebCore/platform/DateTimeChooserClient.h b/Source/WebCore/platform/DateTimeChooserClient.h
index 1853ea7a0..230d04544 100644
--- a/Source/WebCore/platform/DateTimeChooserClient.h
+++ b/Source/WebCore/platform/DateTimeChooserClient.h
@@ -31,6 +31,7 @@
 #ifndef DateTimeChooserClient_h
 #define DateTimeChooserClient_h
 
+#if ENABLE(DATE_AND_TIME_INPUT_TYPES)
 namespace WebCore {
 
 class DateTimeChooserClient {
@@ -44,5 +45,5 @@ public:
 };
 
 } // namespace WebCore
-
+#endif
 #endif // DateTimeChooserClient_h
diff --git a/Source/WebCore/platform/KURLWTFURL.cpp b/Source/WebCore/platform/KURLWTFURL.cpp
index 4d30680ff..8165a8f17 100644
--- a/Source/WebCore/platform/KURLWTFURL.cpp
+++ b/Source/WebCore/platform/KURLWTFURL.cpp
@@ -320,10 +320,10 @@ void KURL::removePort()
     m_urlImpl->m_parsedURL.removePort();
 }
 
-void KURL::setPort(unsigned short)
+void KURL::setPort(unsigned short newPort)
 {
     detach(m_urlImpl);
-    // FIXME: Add WTFURL Implementation.
+    m_urlImpl->m_parsedURL.replacePort(newPort);
 }
 
 void KURL::setHostAndPort(const String&)
diff --git a/Source/WebCore/platform/LinkHash.cpp b/Source/WebCore/platform/LinkHash.cpp
index a0ea795ea..2573f6353 100644
--- a/Source/WebCore/platform/LinkHash.cpp
+++ b/Source/WebCore/platform/LinkHash.cpp
@@ -30,7 +30,8 @@
 
 namespace WebCore {
 
-static inline size_t findSlashDotDotSlash(const UChar* characters, size_t length, size_t position)
+template <typename CharacterType>
+static inline size_t findSlashDotDotSlash(const CharacterType* characters, size_t length, size_t position)
 {
     if (length < 4)
         return notFound;
@@ -42,7 +43,8 @@ static inline size_t findSlashDotDotSlash(const UChar* characters, size_t length
     return notFound;
 }
 
-static inline size_t findSlashSlash(const UChar* characters, size_t length, size_t position)
+template <typename CharacterType>
+static inline size_t findSlashSlash(const CharacterType* characters, size_t length, size_t position)
 {
     if (length < 2)
         return notFound;
@@ -54,7 +56,8 @@ static inline size_t findSlashSlash(const UChar* characters, size_t length, size
     return notFound;
 }
 
-static inline size_t findSlashDotSlash(const UChar* characters, size_t length, size_t position)
+template <typename CharacterType>
+static inline size_t findSlashDotSlash(const CharacterType* characters, size_t length, size_t position)
 {
     if (length < 3)
         return notFound;
@@ -66,7 +69,8 @@ static inline size_t findSlashDotSlash(const UChar* characters, size_t length, s
     return notFound;
 }
 
-static inline bool containsColonSlashSlash(const UChar* characters, unsigned length)
+template <typename CharacterType>
+static inline bool containsColonSlashSlash(const CharacterType* characters, unsigned length)
 {
     if (length < 3)
         return false;
@@ -78,7 +82,8 @@ static inline bool containsColonSlashSlash(const UChar* characters, unsigned len
     return false;
 }
 
-static inline void squeezeOutNullCharacters(Vector<UChar, 512>& string)
+template <typename CharacterType>
+static inline void squeezeOutNullCharacters(Vector<CharacterType, 512>& string)
 {
     size_t size = string.size();
     size_t i = 0;
@@ -90,14 +95,15 @@ static inline void squeezeOutNullCharacters(Vector<UChar, 512>& string)
         return;
     size_t j = i;
     for (++i; i < size; ++i) {
-        if (UChar character = string[i])
+        if (CharacterType character = string[i])
             string[j++] = character;
     }
     ASSERT(j < size);
     string.shrink(j);
 }
 
-static void cleanSlashDotDotSlashes(Vector<UChar, 512>& path, size_t firstSlash)
+template <typename CharacterType>
+static void cleanSlashDotDotSlashes(Vector<CharacterType, 512>& path, size_t firstSlash)
 {
     size_t slash = firstSlash;
     do {
@@ -116,7 +122,8 @@ static void cleanSlashDotDotSlashes(Vector<UChar, 512>& path, size_t firstSlash)
     squeezeOutNullCharacters(path);
 }
 
-static void mergeDoubleSlashes(Vector<UChar, 512>& path, size_t firstSlash)
+template <typename CharacterType>
+static void mergeDoubleSlashes(Vector<CharacterType, 512>& path, size_t firstSlash)
 {
     size_t refPos = find(path.data(), path.size(), '#');
     if (!refPos || refPos == notFound)
@@ -134,7 +141,8 @@ static void mergeDoubleSlashes(Vector<UChar, 512>& path, size_t firstSlash)
     squeezeOutNullCharacters(path);
 }
 
-static void cleanSlashDotSlashes(Vector<UChar, 512>& path, size_t firstSlash)
+template <typename CharacterType>
+static void cleanSlashDotSlashes(Vector<CharacterType, 512>& path, size_t firstSlash)
 {
     size_t slash = firstSlash;
     do {
@@ -145,7 +153,8 @@ static void cleanSlashDotSlashes(Vector<UChar, 512>& path, size_t firstSlash)
     squeezeOutNullCharacters(path);
 }
 
-static inline void cleanPath(Vector<UChar, 512>& path)
+template <typename CharacterType>
+static inline void cleanPath(Vector<CharacterType, 512>& path)
 {
     // FIXME: Should not do this in the query or anchor part of the URL.
     size_t firstSlash = findSlashDotDotSlash(path.data(), path.size(), 0);
@@ -163,12 +172,14 @@ static inline void cleanPath(Vector<UChar, 512>& path)
         cleanSlashDotSlashes(path, firstSlash);
 }
 
-static inline bool matchLetter(UChar c, UChar lowercaseLetter)
+template <typename CharacterType>
+static inline bool matchLetter(CharacterType c, char lowercaseLetter)
 {
     return (c | 0x20) == lowercaseLetter;
 }
 
-static inline bool needsTrailingSlash(const UChar* characters, unsigned length)
+template <typename CharacterType>
+static inline bool needsTrailingSlash(const CharacterType* characters, unsigned length)
 {
     if (length < 6)
         return false;
@@ -214,14 +225,12 @@ LinkHash visitedLinkHash(const UChar* url, unsigned length)
     return visitedLinkHashInline(url, length);
 }
 
-static ALWAYS_INLINE void visitedURLInline(const KURL& base, const AtomicString& attributeURL, Vector<UChar, 512>& buffer)
+template <typename CharacterType>
+static ALWAYS_INLINE void visitedURLInline(const KURL& base, const CharacterType* characters, unsigned length, Vector<CharacterType, 512>& buffer)
 {
-    if (attributeURL.isNull())
+    if (!length)
         return;
 
-    const UChar* characters = attributeURL.characters();
-    unsigned length = attributeURL.length();
-
     // This is a poor man's completeURL. Faster with less memory allocation.
     // FIXME: It's missing a lot of what completeURL does and a lot of what KURL does.
     // For example, it does not handle international domain names properly.
@@ -236,7 +245,7 @@ static ALWAYS_INLINE void visitedURLInline(const KURL& base, const AtomicString&
     bool hasColonSlashSlash = containsColonSlashSlash(characters, length);
 
     if (hasColonSlashSlash && !needsTrailingSlash(characters, length)) {
-        buffer.append(attributeURL.characters(), attributeURL.length());
+        buffer.append(characters, length);
         return;
     }
 
@@ -250,17 +259,17 @@ static ALWAYS_INLINE void visitedURLInline(const KURL& base, const AtomicString&
     }
 
     if (!length)
-        buffer.append(base.string().characters(), base.string().length());
+        buffer.append(base.string().getCharactersWithUpconvert<CharacterType>(), base.string().length());
     else {
         switch (characters[0]) {
             case '/':
-                buffer.append(base.string().characters(), base.pathStart());
+                buffer.append(base.string().getCharactersWithUpconvert<CharacterType>(), base.pathStart());
                 break;
             case '#':
-                buffer.append(base.string().characters(), base.pathEnd());
+                buffer.append(base.string().getCharactersWithUpconvert<CharacterType>(), base.pathEnd());
                 break;
             default:
-                buffer.append(base.string().characters(), base.pathAfterLastSlash());
+                buffer.append(base.string().getCharactersWithUpconvert<CharacterType>(), base.pathAfterLastSlash());
                 break;
         }
     }
@@ -277,13 +286,25 @@ static ALWAYS_INLINE void visitedURLInline(const KURL& base, const AtomicString&
 
 void visitedURL(const KURL& base, const AtomicString& attributeURL, Vector<UChar, 512>& buffer)
 {
-    return visitedURLInline(base, attributeURL, buffer);
+    return visitedURLInline(base, attributeURL.characters(), attributeURL.length(), buffer);
 }
 
 LinkHash visitedLinkHash(const KURL& base, const AtomicString& attributeURL)
 {
+    if (attributeURL.isEmpty())
+        return 0;
+
+    if (!base.string().isEmpty() && base.string().is8Bit() && attributeURL.is8Bit()) {
+        Vector<LChar, 512> url;
+        visitedURLInline(base, attributeURL.characters8(), attributeURL.length(), url);
+        if (url.isEmpty())
+            return 0;
+
+        return visitedLinkHashInline(url.data(), url.size());
+    }
+
     Vector<UChar, 512> url;
-    visitedURLInline(base, attributeURL, url);
+    visitedURLInline(base, attributeURL.characters(), attributeURL.length(), url);
     if (url.isEmpty())
         return 0;
 
diff --git a/Source/WebCore/platform/LocalizedStrings.cpp b/Source/WebCore/platform/LocalizedStrings.cpp
index abf1bca5e..8f7866f3f 100644
--- a/Source/WebCore/platform/LocalizedStrings.cpp
+++ b/Source/WebCore/platform/LocalizedStrings.cpp
@@ -54,13 +54,12 @@ static String formatLocalizedString(String format, ...)
 #if USE(CF)
     va_list arguments;
     va_start(arguments, format);
-    RetainPtr<CFStringRef> formatCFString(AdoptCF, format.createCFString());
 
 #if COMPILER(CLANG)
 #pragma clang diagnostic push
 #pragma clang diagnostic ignored "-Wformat-nonliteral"
 #endif
-    RetainPtr<CFStringRef> result(AdoptCF, CFStringCreateWithFormatAndArguments(0, 0, formatCFString.get(), arguments));
+    RetainPtr<CFStringRef> result = adoptCF(CFStringCreateWithFormatAndArguments(0, 0, format.createCFString().get(), arguments));
 #if COMPILER(CLANG)
 #pragma clang diagnostic pop
 #endif
@@ -260,7 +259,7 @@ String contextMenuItemTagLookUpInDictionary(const String& selectedString)
     return WEB_UI_STRING("Look Up in Dictionary", "Look Up in Dictionary context menu item");
 #else
 #if USE(CF)
-    RetainPtr<CFStringRef> selectedCFString(AdoptCF, truncatedStringForLookupMenuItem(selectedString).createCFString());
+    RetainPtr<CFStringRef> selectedCFString = truncatedStringForLookupMenuItem(selectedString).createCFString();
     return formatLocalizedString(WEB_UI_STRING("Look Up “%@”", "Look Up context menu item with selected word"), selectedCFString.get());
 #else
     return WEB_UI_STRING("Look Up “<selection>”", "Look Up context menu item with selected word").replace("<selection>", truncatedStringForLookupMenuItem(selectedString));
@@ -684,6 +683,11 @@ String insecurePluginVersionText()
     return WEB_UI_STRING_KEY("Blocked Plug-in", "Blocked Plug-In (Insecure plug-in)", "Label text to be used when an insecure plug-in version was blocked from loading");
 }
 
+String inactivePluginText()
+{
+    return WEB_UI_STRING("Inactive Plug-in", "Label text to be used when a plugin has not been loaded for some time");
+}
+
 String multipleFileUploadText(unsigned numberOfFiles)
 {
     return formatLocalizedString(WEB_UI_STRING("%d files", "Label to describe the number of files selected in a file upload control that allows multiple files"), numberOfFiles);
@@ -738,8 +742,7 @@ String keygenMenuItem2048()
 
 String keygenKeychainItemName(const String& host)
 {
-    RetainPtr<CFStringRef> hostCFString(AdoptCF, host.createCFString());
-    return formatLocalizedString(WEB_UI_STRING("Key from %@", "Name of keychain key generated by the KEYGEN tag"), hostCFString.get());
+    return formatLocalizedString(WEB_UI_STRING("Key from %@", "Name of keychain key generated by the KEYGEN tag"), host.createCFString().get());
 }
 
 #endif
@@ -762,8 +765,7 @@ String imageTitle(const String& filename, const IntSize& size)
 {
 #if USE(CF)
 #if !PLATFORM(MAC) || PLATFORM(IOS) || __MAC_OS_X_VERSION_MIN_REQUIRED >= 1060
-    RetainPtr<CFStringRef> filenameCFString(AdoptCF, filename.createCFString());
-    RetainPtr<CFLocaleRef> locale(AdoptCF, CFLocaleCopyCurrent());
+    RetainPtr<CFLocaleRef> locale = adoptCF(CFLocaleCopyCurrent());
     RetainPtr<CFNumberFormatterRef> formatter(AdoptCF, CFNumberFormatterCreate(0, locale.get(), kCFNumberFormatterDecimalStyle));
 
     int widthInt = size.width();
@@ -774,7 +776,7 @@ String imageTitle(const String& filename, const IntSize& size)
     RetainPtr<CFNumberRef> height(AdoptCF, CFNumberCreate(0, kCFNumberIntType, &heightInt));
     RetainPtr<CFStringRef> heightString(AdoptCF, CFNumberFormatterCreateStringWithNumber(0, formatter.get(), height.get()));
 
-    return formatLocalizedString(WEB_UI_STRING("%@ %@×%@ pixels", "window title for a standalone image (uses multiplication symbol, not x)"), filenameCFString.get(), widthString.get(), heightString.get());
+    return formatLocalizedString(WEB_UI_STRING("%@ %@×%@ pixels", "window title for a standalone image (uses multiplication symbol, not x)"), filename.createCFString().get(), widthString.get(), heightString.get());
 #else
     RetainPtr<CFStringRef> filenameCFString(AdoptCF, filename.createCFString());
     return formatLocalizedString(WEB_UI_STRING("%@ %d×%d pixels", "window title for a standalone image (uses multiplication symbol, not x)"), filenameCFString.get(), size.width(), size.height());
diff --git a/Source/WebCore/platform/LocalizedStrings.h b/Source/WebCore/platform/LocalizedStrings.h
index 8c56fe1d5..9602e1f90 100644
--- a/Source/WebCore/platform/LocalizedStrings.h
+++ b/Source/WebCore/platform/LocalizedStrings.h
@@ -191,10 +191,10 @@ namespace WebCore {
     // "yyyy", for year field used in multiple fields "date", "datetime", and
     // "datetime-local" input UI instead "----".
     String placeholderForYearField();
-
+#endif
+#if ENABLE(INPUT_TYPE_WEEK)
     // weekFormatInLDML() returns week and year format in LDML, Unicode
-    // technical standard 35, Locale Data Markup Language, e.g. "WW-yyyyy"
-    // for "week" input type.
+    // technical standard 35, Locale Data Markup Language, e.g. "'Week' ww, yyyy"
     String weekFormatInLDML();
 #endif
 
@@ -202,6 +202,8 @@ namespace WebCore {
     String crashedPluginText();
     String blockedPluginByContentSecurityPolicyText();
     String insecurePluginVersionText();
+    String inactivePluginText();
+
     String multipleFileUploadText(unsigned numberOfFiles);
     String unknownFileSizeText();
 
@@ -246,13 +248,6 @@ namespace WebCore {
     String validationMessageRangeUnderflowText(const String& minimum);
     String validationMessageRangeOverflowText(const String& maximum);
     String validationMessageStepMismatchText(const String& base, const String& step);
-#if ENABLE(CALENDAR_PICKER)
-    String calendarTodayText();
-    String calendarClearText();
-    String dateFormatYearText();
-    String dateFormatMonthText();
-    String dateFormatDayInMonthText();
-#endif
 #if USE(SOUP)
     String unacceptableTLSCertificate();
 #endif
diff --git a/Source/WebCore/platform/PlatformStrategies.cpp b/Source/WebCore/platform/PlatformStrategies.cpp
index 643f37505..ca4515016 100644
--- a/Source/WebCore/platform/PlatformStrategies.cpp
+++ b/Source/WebCore/platform/PlatformStrategies.cpp
@@ -49,7 +49,7 @@ void setPlatformStrategies(PlatformStrategies* platformStrategies)
     
     // FIXME: This happens when mixing different platform strategies, and we should probably
     // throw an exception here in release builds.
-    ASSERT(platformStrategies != s_platformStrategies);
+    ASSERT(platformStrategies == s_platformStrategies);
 }
 
 bool hasPlatformStrategies()
diff --git a/Source/WebCore/platform/PlatformStrategies.h b/Source/WebCore/platform/PlatformStrategies.h
index c85ee5903..1fae41db4 100644
--- a/Source/WebCore/platform/PlatformStrategies.h
+++ b/Source/WebCore/platform/PlatformStrategies.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2010 Apple Inc. All rights reserved.
+ * Copyright (C) 2010, 2011, 2012 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -31,8 +31,10 @@
 namespace WebCore {
 
 class CookiesStrategy;
+class LoaderStrategy;
 class PasteboardStrategy;
 class PluginStrategy;
+class SharedWorkerStrategy;
 class VisitedLinkStrategy;
 
 class PlatformStrategies {
@@ -44,6 +46,20 @@ public:
         return m_cookiesStrategy;
     }
 
+    LoaderStrategy* loaderStrategy()
+    {
+        if (!m_loaderStrategy)
+            m_loaderStrategy = createLoaderStrategy();
+        return m_loaderStrategy;
+    }
+    
+    PasteboardStrategy* pasteboardStrategy()
+    {
+        if (!m_pasteboardStrategy)
+            m_pasteboardStrategy = createPasteboardStrategy();
+        return m_pasteboardStrategy;
+    }
+
     PluginStrategy* pluginStrategy()
     {
         if (!m_pluginStrategy)
@@ -51,25 +67,28 @@ public:
         return m_pluginStrategy;
     }
 
+    SharedWorkerStrategy* sharedWorkerStrategy()
+    {
+        if (!m_sharedWorkerStrategy)
+            m_sharedWorkerStrategy = createSharedWorkerStrategy();
+        return m_sharedWorkerStrategy;
+    }
+
     VisitedLinkStrategy* visitedLinkStrategy()
     {
         if (!m_visitedLinkStrategy)
             m_visitedLinkStrategy = createVisitedLinkStrategy();
         return m_visitedLinkStrategy;
     }
-    PasteboardStrategy* pasteboardStrategy()
-    {
-        if (!m_pasteboardStrategy)
-            m_pasteboardStrategy = createPasteboardStrategy();
-        return m_pasteboardStrategy;
-    }
 
 protected:
     PlatformStrategies()
         : m_cookiesStrategy(0)
+        , m_loaderStrategy(0)
+        , m_pasteboardStrategy(0)
         , m_pluginStrategy(0)
+        , m_sharedWorkerStrategy(0)
         , m_visitedLinkStrategy(0)
-        , m_pasteboardStrategy(0)
     {
     }
 
@@ -79,14 +98,18 @@ protected:
 
 private:
     virtual CookiesStrategy* createCookiesStrategy() = 0;
+    virtual LoaderStrategy* createLoaderStrategy() = 0;
+    virtual PasteboardStrategy* createPasteboardStrategy() = 0;
     virtual PluginStrategy* createPluginStrategy() = 0;
+    virtual SharedWorkerStrategy* createSharedWorkerStrategy() = 0;
     virtual VisitedLinkStrategy* createVisitedLinkStrategy() = 0;
-    virtual PasteboardStrategy* createPasteboardStrategy() = 0; 
 
     CookiesStrategy* m_cookiesStrategy;
+    LoaderStrategy* m_loaderStrategy;
+    PasteboardStrategy* m_pasteboardStrategy;
     PluginStrategy* m_pluginStrategy;
+    SharedWorkerStrategy* m_sharedWorkerStrategy;
     VisitedLinkStrategy* m_visitedLinkStrategy;
-    PasteboardStrategy* m_pasteboardStrategy;
 };
 
 PlatformStrategies* platformStrategies();
diff --git a/Source/WebCore/platform/RuntimeApplicationChecks.cpp b/Source/WebCore/platform/RuntimeApplicationChecks.cpp
index 1b8d006f2..730edc15f 100644
--- a/Source/WebCore/platform/RuntimeApplicationChecks.cpp
+++ b/Source/WebCore/platform/RuntimeApplicationChecks.cpp
@@ -46,8 +46,7 @@ static bool mainBundleIsEqualTo(const String& bundleIdentifierString)
     if (!bundleIdentifier)
         return false;
 
-    RetainPtr<CFStringRef> bundleIdentifierToCompare(AdoptCF, bundleIdentifierString.createCFString());
-    return CFStringCompare(bundleIdentifier, bundleIdentifierToCompare.get(), 0) == kCFCompareEqualTo;
+    return CFStringCompare(bundleIdentifier, bundleIdentifierString.createCFString().get(), 0) == kCFCompareEqualTo;
 #else
     UNUSED_PARAM(bundleIdentifierString);
     return false;
diff --git a/Source/WebCore/platform/SharedBuffer.cpp b/Source/WebCore/platform/SharedBuffer.cpp
index ed03a629e..0fe16ccdf 100644
--- a/Source/WebCore/platform/SharedBuffer.cpp
+++ b/Source/WebCore/platform/SharedBuffer.cpp
@@ -202,7 +202,7 @@ void SharedBuffer::clear()
 
     m_buffer.clear();
     m_purgeableBuffer.clear();
-#if HAVE(NETWORK_CFDATA_ARRAY_CALLBACK)
+#if USE(NETWORK_CFDATA_ARRAY_CALLBACK)
     m_dataArray.clear();
 #endif
 }
@@ -244,7 +244,7 @@ const Vector<char>& SharedBuffer::buffer() const
             freeSegment(m_segments[i]);
         }
         m_segments.clear();
-#if HAVE(NETWORK_CFDATA_ARRAY_CALLBACK)
+#if USE(NETWORK_CFDATA_ARRAY_CALLBACK)
         copyDataArrayAndClear(destination, bytesLeft);
 #endif
     }
@@ -294,7 +294,7 @@ unsigned SharedBuffer::getSomeData(const char*& someData, unsigned position) con
         someData = m_segments[segment] + positionInSegment;
         return segment == segments - 1 ? segmentedSize - position : segmentSize - positionInSegment;
     }
-#if HAVE(NETWORK_CFDATA_ARRAY_CALLBACK)
+#if USE(NETWORK_CFDATA_ARRAY_CALLBACK)
     ASSERT(maxSegmentedSize <= position);
     position -= maxSegmentedSize;
     return copySomeDataFromDataArray(someData, position);
diff --git a/Source/WebCore/platform/SharedBuffer.h b/Source/WebCore/platform/SharedBuffer.h
index 83cc64ad2..ec3d4d3c4 100644
--- a/Source/WebCore/platform/SharedBuffer.h
+++ b/Source/WebCore/platform/SharedBuffer.h
@@ -89,7 +89,7 @@ public:
     const char* platformData() const;
     unsigned platformDataSize() const;
 
-#if HAVE(NETWORK_CFDATA_ARRAY_CALLBACK)
+#if USE(NETWORK_CFDATA_ARRAY_CALLBACK)
     void append(CFDataRef);
 #endif
 
@@ -137,7 +137,7 @@ private:
     mutable Vector<char> m_buffer;
     mutable Vector<char*> m_segments;
     OwnPtr<PurgeableBuffer> m_purgeableBuffer;
-#if HAVE(NETWORK_CFDATA_ARRAY_CALLBACK)
+#if USE(NETWORK_CFDATA_ARRAY_CALLBACK)
     mutable Vector<RetainPtr<CFDataRef> > m_dataArray;
     void copyDataArrayAndClear(char *destination, unsigned bytesToCopy) const;
     unsigned copySomeDataFromDataArray(const char*& someData, unsigned position) const;
diff --git a/Source/WebCore/platform/Widget.h b/Source/WebCore/platform/Widget.h
index 65f04d993..3ba3625e2 100644
--- a/Source/WebCore/platform/Widget.h
+++ b/Source/WebCore/platform/Widget.h
@@ -32,6 +32,7 @@
 #include <wtf/RefCounted.h>
 
 #if PLATFORM(CHROMIUM)
+#include "PageClientChromium.h"
 #include "PlatformWidget.h"
 #endif
 
@@ -93,6 +94,8 @@ typedef PageClientBlackBerry* PlatformPageClient;
 #elif PLATFORM(EFL)
 class PageClientEfl;
 typedef PageClientEfl* PlatformPageClient;
+#elif PLATFORM(CHROMIUM)
+typedef WebCore::PageClientChromium* PlatformPageClient;
 #else
 typedef PlatformWidget PlatformPageClient;
 #endif
diff --git a/Source/WebCore/platform/audio/VectorMath.cpp b/Source/WebCore/platform/audio/VectorMath.cpp
index bb20ceee6..10887445e 100644
--- a/Source/WebCore/platform/audio/VectorMath.cpp
+++ b/Source/WebCore/platform/audio/VectorMath.cpp
@@ -655,7 +655,22 @@ void vclip(const float* sourceP, int sourceStride, const float* lowThresholdP, c
     float highThreshold = *highThresholdP;
 
     // FIXME: Optimize for SSE2.
-    // FIXME: Optimize for NEON.
+#if HAVE(ARM_NEON_INTRINSICS)
+    if ((sourceStride == 1) && (destStride == 1)) {
+        int tailFrames = n % 4;
+        const float* endP = destP + n - tailFrames;
+
+        float32x4_t low = vdupq_n_f32(lowThreshold);
+        float32x4_t high = vdupq_n_f32(highThreshold);
+        while (destP < endP) {
+            float32x4_t source = vld1q_f32(sourceP);
+            vst1q_f32(destP, vmaxq_f32(vminq_f32(source, high), low));
+            sourceP += 4;
+            destP += 4;
+        }
+        n = tailFrames;
+    }
+#endif
     while (n--) {
         *destP = std::max(std::min(*sourceP, highThreshold), lowThreshold);
         sourceP += sourceStride;
diff --git a/Source/WebCore/platform/audio/resources/Composite.wav b/Source/WebCore/platform/audio/resources/Composite.wav
index 25fc82314..fab198d77 100644
--- a/Source/WebCore/platform/audio/resources/Composite.wav
+++ b/Source/WebCore/platform/audio/resources/Composite.wav
diff --git a/Source/WebCore/platform/blackberry/AuthenticationChallengeManager.cpp b/Source/WebCore/platform/blackberry/AuthenticationChallengeManager.cpp
index f7e8fd088..8d52a4a0a 100644
--- a/Source/WebCore/platform/blackberry/AuthenticationChallengeManager.cpp
+++ b/Source/WebCore/platform/blackberry/AuthenticationChallengeManager.cpp
@@ -28,6 +28,7 @@
 #include <BlackBerryPlatformLog.h>
 #include <wtf/Assertions.h>
 #include <wtf/HashMap.h>
+#include <wtf/PassOwnPtr.h>
 #include <wtf/Vector.h>
 #include <wtf/text/CString.h>
 
@@ -101,6 +102,8 @@ bool AuthenticationChallengeManagerPrivate::pageExists(PageClientBlackBerry* cli
     return m_pageVisibilityMap.find(client) != m_pageVisibilityMap.end();
 }
 
+SINGLETON_INITIALIZER_THREADUNSAFE(AuthenticationChallengeManager)
+
 AuthenticationChallengeManager::AuthenticationChallengeManager()
     : d(adoptPtr(new AuthenticationChallengeManagerPrivate))
 {
@@ -223,21 +226,4 @@ void AuthenticationChallengeManager::notifyChallengeResult(const KURL& url, cons
         d->startAuthenticationChallenge(next);
 }
 
-// Keep following code at the end of this file!!!
-static AuthenticationChallengeManager* s_manager = 0;
-
-AuthenticationChallengeManager* AuthenticationChallengeManager::instance()
-{
-    ASSERT(s_manager);
-    return s_manager;
-}
-
-void AuthenticationChallengeManager::init()
-{
-    ASSERT(!s_manager);
-    s_manager = new AuthenticationChallengeManager();
-}
-
-// No more code after this line, all new code should come before s_manager declaration!!!
-
 } // namespace WebCore
diff --git a/Source/WebCore/platform/blackberry/AuthenticationChallengeManager.h b/Source/WebCore/platform/blackberry/AuthenticationChallengeManager.h
index a5d51e272..3afc8e525 100644
--- a/Source/WebCore/platform/blackberry/AuthenticationChallengeManager.h
+++ b/Source/WebCore/platform/blackberry/AuthenticationChallengeManager.h
@@ -19,6 +19,7 @@
 #ifndef AuthenticationChallengeManager_h
 #define AuthenticationChallengeManager_h
 
+#include "BlackBerryPlatformSingleton.h"
 #include <wtf/OwnPtr.h>
 
 class PageClientBlackBerry;
@@ -40,11 +41,9 @@ public:
     virtual void notifyChallengeResult(const KURL&, const ProtectionSpace&, AuthenticationChallengeResult, const Credential&) = 0;
 };
 
-class AuthenticationChallengeManager {
+class AuthenticationChallengeManager : public BlackBerry::Platform::ThreadUnsafeSingleton<AuthenticationChallengeManager> {
+    SINGLETON_DEFINITION_THREADUNSAFE(AuthenticationChallengeManager)
 public:
-    static void init();
-    static AuthenticationChallengeManager* instance();
-
     void pageCreated(PageClientBlackBerry*);
     void pageDeleted(PageClientBlackBerry*);
     void pageVisibilityChanged(PageClientBlackBerry*, bool visible);
diff --git a/Source/WebCore/platform/blackberry/CookieDatabaseBackingStore/CookieDatabaseBackingStore.cpp b/Source/WebCore/platform/blackberry/CookieDatabaseBackingStore/CookieDatabaseBackingStore.cpp
index e34594b62..b571589b8 100644
--- a/Source/WebCore/platform/blackberry/CookieDatabaseBackingStore/CookieDatabaseBackingStore.cpp
+++ b/Source/WebCore/platform/blackberry/CookieDatabaseBackingStore/CookieDatabaseBackingStore.cpp
@@ -94,112 +94,6 @@ void CookieDatabaseBackingStore::onThreadFinished()
     MessageClient::onThreadFinished();
 }
 
-void CookieDatabaseBackingStore::upgradeTableIfNeeded(const String& databaseFields, const String& primaryKeyFields)
-{
-    ASSERT(isCurrentThread());
-
-    bool creationTimeExists = false;
-    bool protocolExists = false;
-
-    if (!m_db.tableExists(m_tableName))
-        return;
-
-    // Check if the existing table has the required database fields
-    {
-        String query = "PRAGMA table_info(" + m_tableName + ");";
-
-        SQLiteStatement statement(m_db, query);
-        if (statement.prepare()) {
-            LOG_ERROR("Cannot prepare statement to query cookie table info. sql:%s", query.utf8().data());
-            LOG_ERROR("SQLite Error Message: %s", m_db.lastErrorMsg());
-            return;
-        }
-
-        while (statement.step() == SQLResultRow) {
-            DEFINE_STATIC_LOCAL(String, creationTime, (ASCIILiteral("creationTime")));
-            DEFINE_STATIC_LOCAL(String, protocol, (ASCIILiteral("protocol")));
-            String name = statement.getColumnText(1);
-            if (name == creationTime)
-                creationTimeExists = true;
-            if (name == protocol)
-                protocolExists = true;
-            if (creationTimeExists && protocolExists)
-                return;
-        }
-        LOG(Network, "Need to update cookie table schema.");
-    }
-
-    // Drop and recreate the cookie table to update to the latest database fields.
-    // We do not use alter table - add column because that method cannot add primary keys.
-    Vector<String> commands;
-
-    // Backup existing table
-    String renameQuery = "ALTER TABLE " + m_tableName + " RENAME TO Backup_" + m_tableName + ";";
-    commands.append(renameQuery);
-
-    // Recreate the cookie table using the new database and primary key fields
-    StringBuilder createTableQuery;
-    createTableQuery.append("CREATE TABLE ");
-    createTableQuery.append(m_tableName);
-    createTableQuery.append(" (" + databaseFields + ", " + primaryKeyFields + ");");
-    commands.append(createTableQuery.toString());
-
-    // Copy the old data into the new table. If a column does not exists,
-    // we have to put a '' in the select statement to make the number of columns
-    // equal in the insert statement.
-    StringBuilder migrationQuery;
-    migrationQuery.append("INSERT OR REPLACE INTO ");
-    migrationQuery.append(m_tableName);
-    migrationQuery.append(" SELECT *");
-    if (!creationTimeExists)
-        migrationQuery.append(",''");
-    if (!protocolExists)
-        migrationQuery.append(",''");
-    migrationQuery.append(" FROM Backup_" + m_tableName);
-    commands.append(migrationQuery.toString());
-
-    // The new columns will be blank, set the new values.
-    if (!creationTimeExists) {
-        String setCreationTimeQuery = "UPDATE " + m_tableName + " SET creationTime = lastAccessed;";
-        commands.append(setCreationTimeQuery);
-    }
-
-    if (!protocolExists) {
-        String setProtocolQuery = "UPDATE " + m_tableName + " SET protocol = 'http' WHERE isSecure = '0';";
-        String setProtocolQuery2 = "UPDATE " + m_tableName + " SET protocol = 'https' WHERE isSecure = '1';";
-        commands.append(setProtocolQuery);
-        commands.append(setProtocolQuery2);
-    }
-
-    // Drop the backup table
-    String dropBackupQuery = "DROP TABLE IF EXISTS Backup_" + m_tableName + ";";
-    commands.append(dropBackupQuery);
-
-    SQLiteTransaction transaction(m_db, false);
-    transaction.begin();
-    size_t commandSize = commands.size();
-    for (size_t i = 0; i < commandSize; ++i) {
-        if (!m_db.executeCommand(commands[i])) {
-            LOG_ERROR("Failed to alter cookie table when executing sql:%s", commands[i].utf8().data());
-            LOG_ERROR("SQLite Error Message: %s", m_db.lastErrorMsg());
-            transaction.rollback();
-
-            // We should never get here, but if we do, rename the current cookie table for future restoration. This has the side effect of
-            // clearing the current cookie table, but that's better than continually hitting this case and hence never being able to use the
-            // cookie table.
-            ASSERT_NOT_REACHED();
-            String renameQuery = "ALTER TABLE " + m_tableName + " RENAME TO Backup2_" + m_tableName + ";";
-            if (!m_db.executeCommand(renameQuery)) {
-                LOG_ERROR("Failed to backup existing cookie table.");
-                LOG_ERROR("SQLite Error Message: %s", m_db.lastErrorMsg());
-            }
-            return;
-        }
-    }
-    transaction.commit();
-    LOG(Network, "Successfully updated cookie table schema.");
-}
-
 void CookieDatabaseBackingStore::open(const String& cookieJar)
 {
     dispatchMessage(createMethodCallMessage(&CookieDatabaseBackingStore::invokeOpen, this, cookieJar));
@@ -222,10 +116,7 @@ void CookieDatabaseBackingStore::invokeOpen(const String& cookieJar)
 
     const String primaryKeyFields("PRIMARY KEY (protocol, host, path, name)");
     const String databaseFields("name TEXT, value TEXT, host TEXT, path TEXT, expiry DOUBLE, lastAccessed DOUBLE, isSecure INTEGER, isHttpOnly INTEGER, creationTime DOUBLE, protocol TEXT");
-    // Update table to add the new column creationTime and protocol for backwards compatability.
-    upgradeTableIfNeeded(databaseFields, primaryKeyFields);
 
-    // Create table if not exsist in case that the upgradeTableIfNeeded() failed accidentally.
     StringBuilder createTableQuery;
     createTableQuery.append("CREATE TABLE IF NOT EXISTS ");
     createTableQuery.append(m_tableName);
diff --git a/Source/WebCore/platform/blackberry/CookieDatabaseBackingStore/CookieDatabaseBackingStore.h b/Source/WebCore/platform/blackberry/CookieDatabaseBackingStore/CookieDatabaseBackingStore.h
index 8bf7410ac..539e29da9 100644
--- a/Source/WebCore/platform/blackberry/CookieDatabaseBackingStore/CookieDatabaseBackingStore.h
+++ b/Source/WebCore/platform/blackberry/CookieDatabaseBackingStore/CookieDatabaseBackingStore.h
@@ -83,7 +83,6 @@ private:
     void addToChangeQueue(const ParsedCookie* changedCookie, UpdateParameter actionParam);
     void sendChangesToDatabase(int interval);
     void sendChangesToDatabaseTimerFired();
-    void upgradeTableIfNeeded(const String& databaseSchema, const String& primarykeyFields);
 
     void invokeOpen(const String& cookieJar);
     void invokeRemoveAll();
diff --git a/Source/WebCore/platform/blackberry/LocalizedStringsBlackBerry.cpp b/Source/WebCore/platform/blackberry/LocalizedStringsBlackBerry.cpp
index 6d7b3a389..7bd71a5fe 100644
--- a/Source/WebCore/platform/blackberry/LocalizedStringsBlackBerry.cpp
+++ b/Source/WebCore/platform/blackberry/LocalizedStringsBlackBerry.cpp
@@ -25,6 +25,7 @@
 #include <LocaleHandler.h>
 #include <LocalizeResource.h>
 #include <wtf/Vector.h>
+#include <wtf/text/CString.h>
 #include <wtf/text/WTFString.h>
 
 namespace WebCore {
@@ -458,16 +459,14 @@ String validationMessageTooLongText(int, int)
     return String();
 }
 
-String validationMessageRangeUnderflowText(const String&)
+String validationMessageRangeUnderflowText(const String& text)
 {
-    notImplemented();
-    return String();
+    return String::format(s_resource.getString(BlackBerry::Platform::VALIDATION_RANGE_UNDERFLOW), text.utf8().data());
 }
 
-String validationMessageRangeOverflowText(const String&)
+String validationMessageRangeOverflowText(const String& text)
 {
-    notImplemented();
-    return String();
+    return String::format(s_resource.getString(BlackBerry::Platform::VALIDATION_RANGE_OVERFLOW), text.utf8().data());
 }
 
 String validationMessageStepMismatchText(const String&, const String&)
@@ -585,6 +584,12 @@ String insecurePluginVersionText()
     return String();
 }
 
+String inactivePluginText()
+{
+    notImplemented();
+    return String();
+}
+
 String multipleFileUploadText(unsigned)
 {
     return String(", ...");
diff --git a/Source/WebCore/platform/blackberry/PlatformTouchEventBlackBerry.cpp b/Source/WebCore/platform/blackberry/PlatformTouchEventBlackBerry.cpp
index ce9b73e9c..638735755 100644
--- a/Source/WebCore/platform/blackberry/PlatformTouchEventBlackBerry.cpp
+++ b/Source/WebCore/platform/blackberry/PlatformTouchEventBlackBerry.cpp
@@ -41,6 +41,8 @@ static PlatformEvent::Type touchEventType(BlackBerry::Platform::TouchEvent* even
         return PlatformEvent::TouchEnd;
     case BlackBerry::Platform::TouchEvent::TouchCancel:
         return PlatformEvent::TouchCancel;
+    case BlackBerry::Platform::TouchEvent::TouchInjected:
+        return PlatformEvent::TouchMove;
     }
 
     ASSERT_NOT_REACHED();
@@ -59,20 +61,13 @@ PlatformTouchEvent::PlatformTouchEvent(BlackBerry::Platform::TouchEvent* event)
     for (unsigned i = 0; i < event->m_points.size(); ++i)
         m_touchPoints.append(PlatformTouchPoint(event->m_points[i]));
 
-    if (event->m_gestures.empty())
-        return;
+    if (event->isPinch()) {
+        m_rotation = event->pinchData().m_angle * 180 / M_PI;
+        m_scale = event->pinchData().m_scale;
+    }
 
-    BlackBerry::Platform::Gesture pinch;
-    if (event->hasGesture(BlackBerry::Platform::Gesture::Pinch, &pinch)) {
-        BlackBerry::Platform::PinchGestureData* data = static_cast<BlackBerry::Platform::PinchGestureData*>(pinch.m_data);
-        if (data) {
-            m_rotation = rad2deg(data->m_angle);
-            m_scale = data->m_scale;
-        }
-    } else if (event->hasGesture(BlackBerry::Platform::Gesture::DoubleTap))
-        m_doubleTap = true;
-    else if (event->hasGesture(BlackBerry::Platform::Gesture::TouchHold))
-        m_touchHold = true;
+    m_doubleTap = event->isDoubleTap();
+    m_touchHold = event->isTouchHold();
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/platform/blackberry/RenderThemeBlackBerry.cpp b/Source/WebCore/platform/blackberry/RenderThemeBlackBerry.cpp
index b7019ff1d..16e95919a 100644
--- a/Source/WebCore/platform/blackberry/RenderThemeBlackBerry.cpp
+++ b/Source/WebCore/platform/blackberry/RenderThemeBlackBerry.cpp
@@ -35,6 +35,8 @@
 #include "RenderView.h"
 #include "UserAgentStyleSheets.h"
 
+#include <BlackBerryPlatformLog.h>
+
 namespace WebCore {
 
 // Sizes (unit px)
@@ -66,6 +68,20 @@ const unsigned paddingDivisor = 5;
 const unsigned fullScreenEnlargementFactor = 2;
 const float scaleFactorThreshold = 2.0;
 
+// Slice length
+const int smallSlice = 8;
+const int mediumSlice = 10;
+const int largeSlice = 13;
+
+// Slider Aura, calculated from UX spec
+const float auraRatio = 1.62;
+
+// Dropdown arrow position, calculated from UX spec
+const float xPositionRatio = 3;
+const float yPositionRatio = 0.38;
+const float widthRatio = 3;
+const float heightRatio = 0.23;
+
 // Colors
 const RGBA32 caretBottom = 0xff2163bf;
 const RGBA32 caretTop = 0xff69a5fa;
@@ -109,24 +125,10 @@ const RGBA32 selection = 0xff2b8fff;
 
 const RGBA32 blackPen = Color::black;
 const RGBA32 focusRingPen = 0xffa3c8fe;
+const RGBA32 activeTextColor = 0xfffafafa;
 
 float RenderThemeBlackBerry::defaultFontSize = 16;
 
-// We aim to match IE here.
-// -IE uses a font based on the encoding as the default font for form controls.
-// -Gecko uses MS Shell Dlg (actually calls GetStockObject(DEFAULT_GUI_FONT),
-// which returns MS Shell Dlg)
-// -Safari uses Lucida Grande.
-//
-// FIXME: The only case where we know we don't match IE is for ANSI encodings.
-// IE uses MS Shell Dlg there, which we render incorrectly at certain pixel
-// sizes (e.g. 15px). So we just use Arial for now.
-const String& RenderThemeBlackBerry::defaultGUIFont()
-{
-    DEFINE_STATIC_LOCAL(String, fontFace, (ASCIILiteral("Arial")));
-    return fontFace;
-}
-
 static PassRefPtr<Gradient> createLinearGradient(RGBA32 top, RGBA32 bottom, const IntPoint& a, const IntPoint& b)
 {
     RefPtr<Gradient> gradient = Gradient::create(a, b);
@@ -135,22 +137,6 @@ static PassRefPtr<Gradient> createLinearGradient(RGBA32 top, RGBA32 bottom, cons
     return gradient.release();
 }
 
-static Path roundedRectForBorder(RenderObject* object, const IntRect& rect)
-{
-    RenderStyle* style = object->style();
-    LengthSize topLeftRadius = style->borderTopLeftRadius();
-    LengthSize topRightRadius = style->borderTopRightRadius();
-    LengthSize bottomLeftRadius = style->borderBottomLeftRadius();
-    LengthSize bottomRightRadius = style->borderBottomRightRadius();
-
-    Path roundedRect;
-    roundedRect.addRoundedRect(rect, IntSize(topLeftRadius.width().value(), topLeftRadius.height().value()),
-                                     IntSize(topRightRadius.width().value(), topRightRadius.height().value()),
-                                     IntSize(bottomLeftRadius.width().value(), bottomLeftRadius.height().value()),
-                                     IntSize(bottomRightRadius.width().value(), bottomRightRadius.height().value()));
-    return roundedRect;
-}
-
 static RenderSlider* determineRenderSlider(RenderObject* object)
 {
     ASSERT(object->isSliderThumb());
@@ -182,6 +168,64 @@ static float determineFullScreenMultiplier(Element* element)
     return fullScreenMultiplier;
 }
 
+static void drawControl(GraphicsContext* gc, const FloatRect& rect, Image* img)
+{
+    if (!img)
+        return;
+    FloatRect srcRect(0, 0, img->width(), img->height());
+    gc->drawImage(img, ColorSpaceDeviceRGB, rect, srcRect);
+}
+
+static void drawNineSlice(GraphicsContext* gc, const IntRect& rect, double scale, Image* img, int slice)
+{
+    if (!img)
+        return;
+    if (rect.height() * scale < 101.0)
+        scale = 101.0 / rect.height();
+    FloatSize dstSlice(slice / scale, slice / scale);
+    FloatRect srcRect(0, 0, slice, slice);
+    FloatRect dstRect(rect.location(), dstSlice);
+    gc->drawImage(img, ColorSpaceDeviceRGB, dstRect, srcRect);
+    srcRect.move(img->width() - srcRect.width(), 0);
+    dstRect.move(rect.width() - dstRect.width(), 0);
+    gc->drawImage(img, ColorSpaceDeviceRGB, dstRect, srcRect);
+    srcRect.move(0, img->height() - srcRect.height());
+    dstRect.move(0, rect.height() - dstRect.height());
+    gc->drawImage(img, ColorSpaceDeviceRGB, dstRect, srcRect);
+    srcRect.move(-(img->width() - srcRect.width()), 0);
+    dstRect.move(-(rect.width() - dstRect.width()), 0);
+    gc->drawImage(img, ColorSpaceDeviceRGB, dstRect, srcRect);
+
+    srcRect = FloatRect(slice, 0, img->width() - 2 * slice, slice);
+    dstRect = FloatRect(rect.x() + dstSlice.width(), rect.y(), rect.width() - 2 * dstSlice.width(), dstSlice.height());
+    gc->drawImage(img, ColorSpaceDeviceRGB, dstRect, srcRect);
+    srcRect.move(0, img->height() - srcRect.height());
+    dstRect.move(0, rect.height() - dstRect.height());
+    gc->drawImage(img, ColorSpaceDeviceRGB, dstRect, srcRect);
+
+    srcRect = FloatRect(0, slice, slice, img->height() - 2 * slice);
+    dstRect = FloatRect(rect.x(), rect.y() + dstSlice.height(), dstSlice.width(), rect.height() - 2 * dstSlice.height());
+    gc->drawImage(img, ColorSpaceDeviceRGB, dstRect, srcRect);
+    srcRect.move(img->width() - srcRect.width(), 0);
+    dstRect.move(rect.width() - dstRect.width(), 0);
+    gc->drawImage(img, ColorSpaceDeviceRGB, dstRect, srcRect);
+
+    srcRect = FloatRect(slice, slice, img->width() - 2 * slice, img->height() - 2 * slice);
+    dstRect = FloatRect(rect.x() + dstSlice.width(), rect.y() + dstSlice.height(), rect.width() - 2 * dstSlice.width(), rect.height() - 2 * dstSlice.height());
+    gc->drawImage(img, ColorSpaceDeviceRGB, dstRect, srcRect);
+}
+
+static RefPtr<Image> loadImage(const char* filename)
+{
+    RefPtr<Image> resource;
+    resource = Image::loadPlatformResource(filename).leakRef();
+    if (!resource) {
+        BlackBerry::Platform::logAlways(BlackBerry::Platform::LogLevelWarn, "RenderThemeBlackBerry failed to load %s.png", filename);
+        return 0;
+    }
+    return resource;
+}
+
 PassRefPtr<RenderTheme> RenderTheme::themeForPage(Page* page)
 {
     static RenderTheme* theme = RenderThemeBlackBerry::create().leakRef();
@@ -229,7 +273,8 @@ void RenderThemeBlackBerry::systemFont(int propId, FontDescription& fontDescript
 {
     float fontSize = defaultFontSize;
 
-    if (propId == CSSValueWebkitMiniControl || propId ==  CSSValueWebkitSmallControl || propId == CSSValueWebkitControl) {
+    // Both CSSValueWebkitControl and CSSValueWebkitSmallControl should use default font size which looks better on the controls.
+    if (propId == CSSValueWebkitMiniControl) {
         // Why 2 points smaller? Because that's what Gecko does. Note that we
         // are assuming a 96dpi screen, which is the default value we use on Windows.
         static const float pointsPerInch = 72.0f;
@@ -237,10 +282,9 @@ void RenderThemeBlackBerry::systemFont(int propId, FontDescription& fontDescript
         fontSize -= (2.0f / pointsPerInch) * pixelsPerInch;
     }
 
-    fontDescription.firstFamily().setFamily(defaultGUIFont());
     fontDescription.setSpecifiedSize(fontSize);
     fontDescription.setIsAbsoluteSize(true);
-    fontDescription.setGenericFamily(FontDescription::NoFamily);
+    fontDescription.setGenericFamily(FontDescription::SansSerifFamily);
     fontDescription.setWeight(FontWeightNormal);
     fontDescription.setItalic(false);
 }
@@ -278,27 +322,22 @@ bool RenderThemeBlackBerry::paintTextFieldOrTextAreaOrSearchField(RenderObject*
     ASSERT(info.context);
     GraphicsContext* context = info.context;
 
-    context->save();
-    context->setStrokeStyle(SolidStroke);
-    context->setStrokeThickness(lineWidth);
-    if (!isEnabled(object))
-        context->setStrokeColor(disabledOutline, ColorSpaceDeviceRGB);
-    else if (isPressed(object))
-        info.context->setStrokeGradient(createLinearGradient(depressedTopOutline, depressedBottomOutline, rect.maxXMinYCorner(), rect.maxXMaxYCorner()));
-    else if (isHovered(object) || isFocused(object))
-        context->setStrokeGradient(createLinearGradient(hoverTopOutline, hoverBottomOutline, rect.maxXMinYCorner(), rect.maxXMaxYCorner()));
-    else
-        context->setStrokeGradient(createLinearGradient(regularTopOutline, regularBottomOutline, rect.maxXMinYCorner(), rect.maxXMaxYCorner()));
-
-    Path textFieldRoundedRectangle = roundedRectForBorder(object, rect);
-    if (object->style()->appearance() == SearchFieldPart) {
-        // We force the fill color to White so as to match the background color of the search cancel button graphic.
-        context->setFillColor(Color::white, ColorSpaceDeviceRGB);
-        context->fillPath(textFieldRoundedRectangle);
-        context->strokePath(textFieldRoundedRectangle);
-    } else
-        context->strokePath(textFieldRoundedRectangle);
-    context->restore();
+    static RefPtr<Image> bg, bgDisabled, bgHighlight;
+    if (!bg) {
+        bg = loadImage("core_textinput_bg");
+        bgDisabled = loadImage("core_textinput_bg_disabled");
+        bgHighlight = loadImage("core_textinput_bg_highlight");
+    }
+
+    AffineTransform ctm = context->getCTM();
+    if (isEnabled(object) && bg)
+        drawNineSlice(context, rect, ctm.xScale(), bg.get(), smallSlice);
+    if (!isEnabled(object) && bgDisabled)
+        drawNineSlice(context, rect, ctm.xScale(), bgDisabled.get(), smallSlice);
+
+    if ((isHovered(object) || isFocused(object) || isPressed(object)) && bgHighlight)
+        drawNineSlice(context, rect, ctm.xScale(), bgHighlight.get(), smallSlice);
+
     return false;
 }
 
@@ -409,7 +448,51 @@ void RenderThemeBlackBerry::calculateButtonSize(RenderStyle* style) const
 
 bool RenderThemeBlackBerry::paintCheckbox(RenderObject* object, const PaintInfo& info, const IntRect& rect)
 {
-    return paintButton(object, info, rect);
+    ASSERT(info.context);
+    GraphicsContext* context = info.context;
+
+    static RefPtr<Image> disabled, background, inactive, pressed, active, activeMark, disableMark;
+    if (!disabled) {
+        disabled = loadImage("core_checkbox_disabled");
+        background = loadImage("core_checkbox_moat");
+        inactive = loadImage("core_checkbox_inactive");
+        pressed = loadImage("core_checkbox_pressed");
+        active = loadImage("core_checkbox_active");
+        activeMark = loadImage("core_checkbox_active_mark");
+        disableMark = loadImage("core_checkbox_disabled_mark");
+    }
+
+    // Caculate where to put center checkmark.
+    FloatRect tmpRect(rect);
+
+    float centerX = ((float(inactive->width()) - float(activeMark->width())) / float(inactive->width()) * tmpRect.width() / 2) + tmpRect.x();
+    float centerY = ((float(inactive->height()) - float(activeMark->height())) / float(inactive->height()) * tmpRect.height() / 2) + tmpRect.y();
+    float width = float(activeMark->width()) / float(inactive->width()) * tmpRect.width();
+    float height = float(activeMark->height()) / float(inactive->height()) * tmpRect.height();
+    FloatRect centerRect(centerX, centerY, width, height);
+
+    drawControl(context, rect, background.get());
+
+    if (isEnabled(object)) {
+        if (isPressed(object)) {
+            drawControl(context, rect, pressed.get());
+            if (isChecked(object)) {
+                // FIXME: need opacity 30% on activeMark
+                drawControl(context, centerRect, activeMark.get());
+            }
+        } else {
+            drawControl(context, rect, inactive.get());
+            if (isChecked(object)) {
+                drawControl(context, rect, active.get());
+                drawControl(context, centerRect, activeMark.get());
+            }
+        }
+    } else {
+        drawControl(context, rect, disabled.get());
+        if (isChecked(object))
+            drawControl(context, rect, disableMark.get());
+    }
+    return false;
 }
 
 void RenderThemeBlackBerry::setCheckboxSize(RenderStyle* style) const
@@ -419,7 +502,50 @@ void RenderThemeBlackBerry::setCheckboxSize(RenderStyle* style) const
 
 bool RenderThemeBlackBerry::paintRadio(RenderObject* object, const PaintInfo& info, const IntRect& rect)
 {
-    return paintButton(object, info, rect);
+    ASSERT(info.context);
+    GraphicsContext* context = info.context;
+
+    static RefPtr<Image> disabled, disabledActive, inactive, pressed, active, activeMark;
+    if (!disabled) {
+        disabled = loadImage("core_radiobutton_disabled");
+        disabledActive = loadImage("core_radiobutton_disabled_active");
+        inactive = loadImage("core_radiobutton_inactive");
+        pressed = loadImage("core_radiobutton_pressed");
+        active = loadImage("core_radiobutton_active");
+        activeMark = loadImage("core_radiobutton_active_mark");
+    }
+
+    // Caculate where to put center circle.
+    FloatRect tmpRect(rect);
+
+    float centerX = ((float(inactive->width()) - float(activeMark->width())) / float(inactive->width()) * tmpRect.width() / 2)+ tmpRect.x();
+    float centerY = ((float(inactive->height()) - float(activeMark->height())) / float(inactive->height()) * tmpRect.height() / 2) + tmpRect.y();
+    float width = float(activeMark->width()) / float(inactive->width()) * tmpRect.width();
+    float height = float(activeMark->height()) / float(inactive->height()) * tmpRect.height();
+    FloatRect centerRect(centerX, centerY, width, height);
+
+    if (isEnabled(object)) {
+        if (isPressed(object)) {
+            drawControl(context, rect, pressed.get());
+            if (isChecked(object)) {
+                // FIXME: need opacity 30% on activeMark
+                drawControl(context, centerRect, activeMark.get());
+            }
+        } else {
+            drawControl(context, rect, inactive.get());
+            if (isChecked(object)) {
+                drawControl(context, rect, active.get());
+                drawControl(context, centerRect, activeMark.get());
+            }
+        }
+    } else {
+        drawControl(context, rect, inactive.get());
+        if (isChecked(object))
+            drawControl(context, rect, disabledActive.get());
+        else
+            drawControl(context, rect, disabled.get());
+    }
+    return false;
 }
 
 void RenderThemeBlackBerry::setRadioSize(RenderStyle* style) const
@@ -432,81 +558,26 @@ bool RenderThemeBlackBerry::paintButton(RenderObject* object, const PaintInfo& i
 {
     ASSERT(info.context);
     info.context->save();
+    GraphicsContext* context = info.context;
 
-    info.context->setStrokeStyle(SolidStroke);
-    info.context->setStrokeThickness(lineWidth);
+    static RefPtr<Image> disabled, inactive, pressed;
+    if (!disabled) {
+        disabled = loadImage("core_button_disabled");
+        inactive = loadImage("core_button_inactive");
+        pressed = loadImage("core_button_pressed");
+    }
 
-    Color check(blackPen);
+    AffineTransform ctm = context->getCTM();
     if (!isEnabled(object)) {
-        info.context->setFillGradient(createLinearGradient(disabledTop, disabledBottom, rect.maxXMinYCorner(), rect.maxXMaxYCorner()));
-        info.context->setStrokeColor(disabledOutline, ColorSpaceDeviceRGB);
+        drawNineSlice(context, rect, ctm.xScale(), inactive.get(), largeSlice);
+        drawNineSlice(context, rect, ctm.xScale(), disabled.get(), largeSlice);
     } else if (isPressed(object)) {
-        info.context->setFillGradient(createLinearGradient(depressedTop, depressedBottom, rect.maxXMinYCorner(), rect.maxXMaxYCorner()));
-        info.context->setStrokeGradient(createLinearGradient(depressedTopOutline, depressedBottomOutline, rect.maxXMinYCorner(), rect.maxXMaxYCorner()));
-    } else if (isHovered(object)) {
-        info.context->setFillGradient(createLinearGradient(hoverTop, hoverBottom, rect.maxXMinYCorner(), rect.maxXMaxYCorner()));
-        info.context->setStrokeGradient(createLinearGradient(hoverTopOutline, hoverBottomOutline, rect.maxXMinYCorner(), rect.maxXMaxYCorner()));
-    } else {
-        info.context->setFillGradient(createLinearGradient(regularTop, regularBottom, rect.maxXMinYCorner(), rect.maxXMaxYCorner()));
-        info.context->setStrokeGradient(createLinearGradient(regularTopOutline, regularBottomOutline, rect.maxXMinYCorner(), rect.maxXMaxYCorner()));
-    }
-
-    ControlPart part = object->style()->appearance();
-    switch (part) {
-    case CheckboxPart: {
-        FloatSize smallCorner(smallRadius, smallRadius);
-        Path path;
-        path.addRoundedRect(rect, smallCorner);
-        info.context->fillPath(path);
-        info.context->strokePath(path);
-
-        if (isChecked(object)) {
-            Path checkPath;
-            IntRect rect2 = rect;
-            rect2.inflate(-1);
-            checkPath.moveTo(FloatPoint(rect2.x() + rect2.width() * checkboxLeftX, rect2.y() + rect2.height() * checkboxLeftY));
-            checkPath.addLineTo(FloatPoint(rect2.x() + rect2.width() * checkboxMiddleX, rect2.maxY() - rect2.height() * checkboxMiddleY));
-            checkPath.addLineTo(FloatPoint(rect2.x() + rect2.width() * checkboxRightX, rect2.y() + rect2.height() * checkboxRightY));
-            info.context->setLineCap(RoundCap);
-            info.context->setStrokeColor(blackPen, ColorSpaceDeviceRGB);
-            info.context->setStrokeThickness(rect2.width() / checkboxStrokeThickness);
-            info.context->fillPath(checkPath);
-            info.context->strokePath(checkPath);
-        }
-        break;
-    }
-    case RadioPart:
-        info.context->drawEllipse(rect);
-        if (isChecked(object)) {
-            IntRect rect2 = rect;
-            rect2.inflate(-rect.width() * radioButtonCheckStateScaler);
-            info.context->setFillColor(check, ColorSpaceDeviceRGB);
-            info.context->setStrokeColor(check, ColorSpaceDeviceRGB);
-            info.context->drawEllipse(rect2);
-        }
-        break;
-    case ButtonPart:
-    case PushButtonPart: {
-        FloatSize largeCorner(largeRadius, largeRadius);
-        Path path;
-        path.addRoundedRect(rect, largeCorner);
-        info.context->fillPath(path);
-        info.context->strokePath(path);
-        break;
-    }
-    case SquareButtonPart: {
-        Path path;
-        path.addRect(rect);
-        info.context->fillPath(path);
-        info.context->strokePath(path);
-        break;
-    }
-    default:
-        info.context->restore();
-        return true;
-    }
+        drawNineSlice(context, rect, ctm.xScale(), pressed.get(), largeSlice);
+        object->style()->setTextFillColor(activeTextColor);
+    } else
+        drawNineSlice(context, rect, ctm.xScale(), inactive.get(), largeSlice);
 
-    info.context->restore();
+    context->restore();
     return false;
 }
 
@@ -535,43 +606,6 @@ void RenderThemeBlackBerry::adjustRadioStyle(StyleResolver*, RenderStyle* style,
     style->setCursor(CURSOR_WEBKIT_GRAB);
 }
 
-void RenderThemeBlackBerry::paintMenuListButtonGradientAndArrow(GraphicsContext* context, RenderObject* object, IntRect buttonRect, const Path& clipPath)
-{
-    ASSERT(context);
-    context->save();
-    if (!isEnabled(object))
-        context->setFillGradient(createLinearGradient(disabledTop, disabledBottom, buttonRect.maxXMinYCorner(), buttonRect.maxXMaxYCorner()));
-    else if (isPressed(object))
-        context->setFillGradient(createLinearGradient(depressedTop, depressedBottom, buttonRect.maxXMinYCorner(), buttonRect.maxXMaxYCorner()));
-    else if (isHovered(object))
-        context->setFillGradient(createLinearGradient(hoverTop, hoverBottom, buttonRect.maxXMinYCorner(), buttonRect.maxXMaxYCorner()));
-    else
-        context->setFillGradient(createLinearGradient(regularTop, regularBottom, buttonRect.maxXMinYCorner(), buttonRect.maxXMaxYCorner()));
-
-    // 1. Paint the background of the button.
-    context->clip(clipPath);
-    context->drawRect(buttonRect);
-    context->restore();
-
-    // 2. Paint the button arrow.
-    buttonRect.inflate(-buttonRect.width() / 3);
-    buttonRect.move(0, buttonRect.height() * 7 / 20);
-    Path path;
-    path.moveTo(FloatPoint(buttonRect.x(), buttonRect.y()));
-    path.addLineTo(FloatPoint(buttonRect.x() + buttonRect.width(), buttonRect.y()));
-    path.addLineTo(FloatPoint(buttonRect.x() + buttonRect.width() / 2.0, buttonRect.y() + buttonRect.height() / 2.0));
-    path.closeSubpath();
-
-    context->save();
-    context->setStrokeStyle(SolidStroke);
-    context->setStrokeThickness(lineWidth);
-    context->setStrokeColor(Color::black, ColorSpaceDeviceRGB);
-    context->setFillColor(Color::black, ColorSpaceDeviceRGB);
-    context->setLineJoin(BevelJoin);
-    context->fillPath(path);
-    context->restore();
-}
-
 static IntRect computeMenuListArrowButtonRect(const IntRect& rect)
 {
     // FIXME: The menu list arrow button should have a minimum and maximum width (to ensure usability) or
@@ -579,77 +613,48 @@ static IntRect computeMenuListArrowButtonRect(const IntRect& rect)
     return IntRect(IntPoint(rect.maxX() - rect.height(), rect.y()), IntSize(rect.height(), rect.height()));
 }
 
-static void paintMenuListBackground(GraphicsContext* context, const Path& menuListPath, const Color& backgroundColor)
-{
-    ASSERT(context);
-    context->save();
-    context->setFillColor(backgroundColor, ColorSpaceDeviceRGB);
-    context->fillPath(menuListPath);
-    context->restore();
-}
-
 bool RenderThemeBlackBerry::paintMenuList(RenderObject* object, const PaintInfo& info, const IntRect& rect)
 {
-    // Note, this method is not called if the menu list explicitly specifies either a border or background color.
-    // Instead, RenderThemeBlackBerry::paintMenuListButton is called. Therefore, when this method is called, we don't
-    // have to adjust rect with respect to the border dimensions.
-
     ASSERT(info.context);
+    info.context->save();
     GraphicsContext* context = info.context;
 
-    Path menuListRoundedRectangle = roundedRectForBorder(object, rect);
-
-    // 1. Paint the background of the entire control.
-    paintMenuListBackground(context, menuListRoundedRectangle, Color::white);
-
-    // 2. Paint the background of the button and its arrow.
-    IntRect arrowButtonRectangle = computeMenuListArrowButtonRect(rect);
-    paintMenuListButtonGradientAndArrow(context, object, arrowButtonRectangle, menuListRoundedRectangle);
-
-    // 4. Stroke an outline around the entire control.
-    context->save();
-    context->setStrokeStyle(SolidStroke);
-    context->setStrokeThickness(lineWidth);
-    if (!isEnabled(object))
-        context->setStrokeColor(disabledOutline, ColorSpaceDeviceRGB);
-    else if (isPressed(object))
-        context->setStrokeGradient(createLinearGradient(depressedTopOutline, depressedBottomOutline, rect.maxXMinYCorner(), rect.maxXMaxYCorner()));
-    else if (isHovered(object))
-        context->setStrokeGradient(createLinearGradient(hoverTopOutline, hoverBottomOutline, rect.maxXMinYCorner(), rect.maxXMaxYCorner()));
-    else
-        context->setStrokeGradient(createLinearGradient(regularTopOutline, regularBottomOutline, rect.maxXMinYCorner(), rect.maxXMaxYCorner()));
-
-    context->strokePath(menuListRoundedRectangle);
+    static RefPtr<Image> disabled, inactive, pressed, arrowUp, arrowUpPressed;
+    if (!disabled) {
+        disabled = loadImage("core_button_disabled");
+        inactive = loadImage("core_button_inactive");
+        pressed = loadImage("core_button_pressed");
+        arrowUp = loadImage("core_dropdown_button_arrowup");
+        arrowUpPressed = loadImage("core_dropdown_button_arrowup_pressed");
+    }
+
+    FloatRect arrowButtonRectangle(computeMenuListArrowButtonRect(rect));
+    float x = arrowButtonRectangle.x() + arrowButtonRectangle.width() / xPositionRatio;
+    float y = arrowButtonRectangle.y() + arrowButtonRectangle.height() * yPositionRatio;
+    float width = arrowButtonRectangle.width() / widthRatio;
+    float height = arrowButtonRectangle.height() * heightRatio;
+    FloatRect tmpRect(x, y, width, height);
+
+    AffineTransform ctm = context->getCTM();
+    if (!isEnabled(object)) {
+        drawNineSlice(context, rect, ctm.xScale(), inactive.get(), largeSlice);
+        drawNineSlice(context, rect, ctm.xScale(), disabled.get(), largeSlice);
+        drawControl(context, tmpRect, arrowUp.get()); // FIXME: should have a disabled image.
+    } else if (isFocused(object)) {
+        drawNineSlice(context, rect, ctm.xScale(), pressed.get(), largeSlice);
+        drawControl(context, tmpRect, arrowUpPressed.get());
+        object->style()->setTextFillColor(activeTextColor);
+    } else {
+        drawNineSlice(context, rect, ctm.xScale(), inactive.get(), largeSlice);
+        drawControl(context, tmpRect, arrowUp.get());
+    }
     context->restore();
     return false;
 }
 
 bool RenderThemeBlackBerry::paintMenuListButton(RenderObject* object, const PaintInfo& info, const IntRect& rect)
 {
-    // Note, this method is only called if the menu list explicitly specifies either a border or background color.
-    // Otherwise, RenderThemeBlackBerry::paintMenuList is called. We need to fit the arrow button with the border box
-    // of the menu-list so as to not occlude the custom border.
-
-    // We compute menuListRoundedRectangle with respect to the dimensions of the entire menu-list control (i.e. rect) and
-    // its border radius so that we clip the contour of the arrow button (when we paint it below) to match the contour of
-    // the control.
-    Path menuListRoundedRectangle = roundedRectForBorder(object, rect);
-
-    // 1. Paint the background of the entire control.
-    Color fillColor = object->style()->visitedDependentColor(CSSPropertyBackgroundColor);
-    if (!fillColor.isValid())
-        fillColor = Color::white;
-    paintMenuListBackground(info.context, menuListRoundedRectangle, fillColor);
-
-    // 2. Paint the background of the button and its arrow.
-    IntRect bounds = IntRect(rect.x() + object->style()->borderLeftWidth(),
-                         rect.y() + object->style()->borderTopWidth(),
-                         rect.width() - object->style()->borderLeftWidth() - object->style()->borderRightWidth(),
-                         rect.height() - object->style()->borderTopWidth() - object->style()->borderBottomWidth());
-
-    IntRect arrowButtonRectangle = computeMenuListArrowButtonRect(bounds); // Fit the arrow button within the border box of the menu-list.
-    paintMenuListButtonGradientAndArrow(info.context, object, arrowButtonRectangle, menuListRoundedRectangle);
-    return false;
+    return paintMenuList(object, info, rect);
 }
 
 void RenderThemeBlackBerry::adjustSliderThumbSize(RenderStyle* style, Element* element) const
@@ -719,11 +724,9 @@ bool RenderThemeBlackBerry::paintSliderTrackRect(RenderObject* object, const Pai
 bool RenderThemeBlackBerry::paintSliderThumb(RenderObject* object, const PaintInfo& info, const IntRect& rect)
 {
     FloatSize largeCorner(largeRadius, largeRadius);
-
     info.context->save();
     info.context->setStrokeStyle(SolidStroke);
     info.context->setStrokeThickness(lineWidth);
-
     if (isPressed(object) || isHovered(object)) {
         info.context->setStrokeGradient(createLinearGradient(hoverTopOutline, hoverBottomOutline, rect.maxXMinYCorner(), rect. maxXMaxYCorner()));
         info.context->setFillGradient(createLinearGradient(hoverTop, hoverBottom, rect.maxXMinYCorner(), rect.maxXMaxYCorner()));
@@ -731,17 +734,14 @@ bool RenderThemeBlackBerry::paintSliderThumb(RenderObject* object, const PaintIn
         info.context->setStrokeGradient(createLinearGradient(regularTopOutline, regularBottomOutline, rect.maxXMinYCorner(), rect. maxXMaxYCorner()));
         info.context->setFillGradient(createLinearGradient(regularTop, regularBottom, rect.maxXMinYCorner(), rect.maxXMaxYCorner()));
     }
-
     Path path;
     path.addRoundedRect(rect, largeCorner);
     info.context->fillPath(path);
-
     bool isVertical = rect.width() > rect.height();
     IntPoint startPoint(rect.x() + (isVertical ? 5 : 2), rect.y() + (isVertical ? 2 : 5));
     IntPoint endPoint(rect.x() + (isVertical ? 20 : 2), rect.y() + (isVertical ? 2 : 20));
     const int lineOffset = 2;
     const int shadowOffset = 1;
-
     for (int i = 0; i < 3; i++) {
         if (isVertical) {
             startPoint.setY(startPoint.y() + lineOffset);
@@ -755,7 +755,6 @@ bool RenderThemeBlackBerry::paintSliderThumb(RenderObject* object, const PaintIn
         else
             info.context->setStrokeColor(dragRegularLight, ColorSpaceDeviceRGB);
         info.context->drawLine(startPoint, endPoint);
-
         if (isVertical) {
             startPoint.setY(startPoint.y() + shadowOffset);
             endPoint.setY(endPoint.y() + shadowOffset);
diff --git a/Source/WebCore/platform/blackberry/RenderThemeBlackBerry.h b/Source/WebCore/platform/blackberry/RenderThemeBlackBerry.h
index 1c6df1565..7368df905 100644
--- a/Source/WebCore/platform/blackberry/RenderThemeBlackBerry.h
+++ b/Source/WebCore/platform/blackberry/RenderThemeBlackBerry.h
@@ -105,7 +105,6 @@ private:
     RenderThemeBlackBerry();
     void setButtonStyle(RenderStyle*) const;
 
-    void paintMenuListButtonGradientAndArrow(GraphicsContext*, RenderObject*, IntRect buttonRect, const Path& clipPath);
     bool paintTextFieldOrTextAreaOrSearchField(RenderObject*, const PaintInfo&, const IntRect&);
     bool paintSliderTrackRect(RenderObject*, const PaintInfo&, const IntRect&);
     bool paintSliderTrackRect(RenderObject*, const PaintInfo&, const IntRect&, RGBA32 strokeColorStart,
diff --git a/Source/WebCore/platform/blackberry/SharedTimerBlackBerry.cpp b/Source/WebCore/platform/blackberry/SharedTimerBlackBerry.cpp
index fa1537fd4..06a71c9c5 100644
--- a/Source/WebCore/platform/blackberry/SharedTimerBlackBerry.cpp
+++ b/Source/WebCore/platform/blackberry/SharedTimerBlackBerry.cpp
@@ -19,18 +19,17 @@
 #include "config.h"
 #include "SharedTimer.h"
 
-#include <wtf/CurrentTime.h>
-
+#include <BlackBerryPlatformSingleton.h>
 #include <BlackBerryPlatformTimer.h>
+#include <wtf/CurrentTime.h>
 
 namespace WebCore {
 
-class SharedTimerBlackBerry {
+class SharedTimerBlackBerry : public BlackBerry::Platform::ThreadUnsafeSingleton<SharedTimerBlackBerry> {
     friend void setSharedTimerFiredFunction(void (*f)());
+    SINGLETON_DEFINITION_THREADUNSAFE(SharedTimerBlackBerry)
 
 public:
-    static SharedTimerBlackBerry* instance();
-
     void start(double);
     void stop();
 
@@ -42,6 +41,8 @@ private:
     void (*m_timerFunction)();
 };
 
+SINGLETON_INITIALIZER_THREADUNSAFE(SharedTimerBlackBerry)
+
 SharedTimerBlackBerry::SharedTimerBlackBerry()
     : m_started(false)
     , m_timerFunction(0)
@@ -54,14 +55,6 @@ SharedTimerBlackBerry::~SharedTimerBlackBerry()
         stop();
 }
 
-SharedTimerBlackBerry* SharedTimerBlackBerry::instance()
-{
-    static SharedTimerBlackBerry* timer = 0;
-    if (!timer)
-        timer = new SharedTimerBlackBerry;
-    return timer;
-}
-
 void SharedTimerBlackBerry::start(double interval)
 {
     BlackBerry::Platform::timerStart(interval, m_timerFunction);
diff --git a/Source/WebCore/platform/cf/FileSystemCF.cpp b/Source/WebCore/platform/cf/FileSystemCF.cpp
index 8ef50eeb0..ffea9058b 100644
--- a/Source/WebCore/platform/cf/FileSystemCF.cpp
+++ b/Source/WebCore/platform/cf/FileSystemCF.cpp
@@ -37,7 +37,7 @@ namespace WebCore {
 
 CString fileSystemRepresentation(const String& path)
 {
-    RetainPtr<CFStringRef> cfString(AdoptCF, path.createCFString());
+    RetainPtr<CFStringRef> cfString = path.createCFString();
 
     if (!cfString)
         return CString();
@@ -63,8 +63,7 @@ RetainPtr<CFURLRef> pathAsURL(const String& path)
 #else
     pathStyle = kCFURLPOSIXPathStyle;
 #endif
-    return RetainPtr<CFURLRef>(AdoptCF, CFURLCreateWithFileSystemPath(0,
-        RetainPtr<CFStringRef>(AdoptCF, path.createCFString()).get(), pathStyle, FALSE));
+    return adoptCF(CFURLCreateWithFileSystemPath(0, path.createCFString().get(), pathStyle, FALSE));
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/platform/cf/SharedBufferCF.cpp b/Source/WebCore/platform/cf/SharedBufferCF.cpp
index d0b0ea9f0..d02cf44b4 100644
--- a/Source/WebCore/platform/cf/SharedBufferCF.cpp
+++ b/Source/WebCore/platform/cf/SharedBufferCF.cpp
@@ -91,7 +91,7 @@ void SharedBuffer::clearPlatformData()
     m_cfData = 0;
 }
 
-#if HAVE(NETWORK_CFDATA_ARRAY_CALLBACK)
+#if USE(NETWORK_CFDATA_ARRAY_CALLBACK)
 void SharedBuffer::append(CFDataRef data)
 {
     ASSERT(data);
diff --git a/Source/WebCore/platform/chromium/DragImageChromiumSkia.cpp b/Source/WebCore/platform/chromium/DragImageChromiumSkia.cpp
index dd8ace385..1b0d92ae1 100644
--- a/Source/WebCore/platform/chromium/DragImageChromiumSkia.cpp
+++ b/Source/WebCore/platform/chromium/DragImageChromiumSkia.cpp
@@ -31,10 +31,15 @@
 #include "config.h"
 #include "DragImage.h"
 
+#include "AffineTransform.h"
+#include "BitmapImage.h"
+#include "FloatRect.h"
 #include "Image.h"
 #include "NativeImageSkia.h"
 #include "NotImplemented.h"
 #include "SkBitmap.h"
+#include "SkCanvas.h"
+#include "SkMatrix.h"
 
 #include "skia/ext/image_operations.h"
 
@@ -95,7 +100,7 @@ DragImageRef dissolveDragImageToFraction(DragImageRef image, float fraction)
     return image;
 }
 
-DragImageRef createDragImageFromImage(Image* image, RespectImageOrientationEnum)
+DragImageRef createDragImageFromImage(Image* image, RespectImageOrientationEnum shouldRespectImageOrientation)
 {
     if (!image)
         return 0;
@@ -104,11 +109,38 @@ DragImageRef createDragImageFromImage(Image* image, RespectImageOrientationEnum)
     if (!bitmap)
         return 0;
 
-    SkBitmap* dragImage = new SkBitmap();
-    bitmap->bitmap().copyTo(dragImage, SkBitmap::kARGB_8888_Config);
     DragImageChromium* dragImageChromium = new DragImageChromium;
-    dragImageChromium->bitmap = dragImage;
+    dragImageChromium->bitmap = new SkBitmap();
     dragImageChromium->resolutionScale = bitmap->resolutionScale();
+
+    if (image->isBitmapImage()) {
+        ImageOrientation orientation = DefaultImageOrientation;
+        BitmapImage* bitmapImage = static_cast<BitmapImage*>(image);
+        IntSize sizeRespectingOrientation = bitmapImage->sizeRespectingOrientation();
+
+        if (shouldRespectImageOrientation == RespectImageOrientation)
+            orientation = bitmapImage->currentFrameOrientation();
+
+        if (orientation != DefaultImageOrientation) {
+            // Construct a correctly-rotated copy of the image to use as the drag image.
+            dragImageChromium->bitmap->setConfig(
+                SkBitmap::kARGB_8888_Config, sizeRespectingOrientation.width(), sizeRespectingOrientation.height());
+            dragImageChromium->bitmap->allocPixels();
+
+            FloatRect destRect(FloatPoint(), sizeRespectingOrientation);
+            SkCanvas canvas(*dragImageChromium->bitmap);
+
+            canvas.concat(orientation.transformFromDefault(sizeRespectingOrientation));
+
+            if (orientation.usesWidthAsHeight())
+                destRect = FloatRect(destRect.x(), destRect.y(), destRect.height(), destRect.width());
+
+            canvas.drawBitmapRect(bitmap->bitmap(), 0, destRect);
+            return dragImageChromium;
+        }
+    }
+
+    bitmap->bitmap().copyTo(dragImageChromium->bitmap, SkBitmap::kARGB_8888_Config);
     return dragImageChromium;
 }
 
diff --git a/Source/WebCore/platform/chromium/KeyCodeConversionGtk.cpp b/Source/WebCore/platform/chromium/KeyCodeConversionGtk.cpp
index 575392fa7..e7c0e20d0 100644
--- a/Source/WebCore/platform/chromium/KeyCodeConversionGtk.cpp
+++ b/Source/WebCore/platform/chromium/KeyCodeConversionGtk.cpp
@@ -303,24 +303,41 @@ int windowsKeyCodeForKeyEvent(unsigned keycode)
         // VKEY_RCONTROL (A3) Right CONTROL key
         // VKEY_LMENU (A4) Left MENU key
         // VKEY_RMENU (A5) Right MENU key
-        // VKEY_BROWSER_BACK (A6) Windows 2000/XP: Browser Back key
-        // VKEY_BROWSER_FORWARD (A7) Windows 2000/XP: Browser Forward key
-        // VKEY_BROWSER_REFRESH (A8) Windows 2000/XP: Browser Refresh key
-        // VKEY_BROWSER_STOP (A9) Windows 2000/XP: Browser Stop key
-        // VKEY_BROWSER_SEARCH (AA) Windows 2000/XP: Browser Search key
-        // VKEY_BROWSER_FAVORITES (AB) Windows 2000/XP: Browser Favorites key
-        // VKEY_BROWSER_HOME (AC) Windows 2000/XP: Browser Start and Home key
-        // VKEY_VOLUME_MUTE (AD) Windows 2000/XP: Volume Mute key
-        // VKEY_VOLUME_DOWN (AE) Windows 2000/XP: Volume Down key
-        // VKEY_VOLUME_UP (AF) Windows 2000/XP: Volume Up key
-        // VKEY_MEDIA_NEXT_TRACK (B0) Windows 2000/XP: Next Track key
-        // VKEY_MEDIA_PREV_TRACK (B1) Windows 2000/XP: Previous Track key
-        // VKEY_MEDIA_STOP (B2) Windows 2000/XP: Stop Media key
-        // VKEY_MEDIA_PLAY_PAUSE (B3) Windows 2000/XP: Play/Pause Media key
-        // VKEY_LAUNCH_MAIL (B4) Windows 2000/XP: Start Mail key
+    case GDK_Back:
+        return VKEY_BROWSER_BACK; // (A6) Windows 2000/XP: Browser Back key
+    case GDK_Forward:
+        return VKEY_BROWSER_FORWARD; // (A7) Windows 2000/XP: Browser Forward key
+    case GDK_Refresh:
+        return VKEY_BROWSER_REFRESH; // (A8) Windows 2000/XP: Browser Refresh key
+    case GDK_Stop:
+        return VKEY_BROWSER_STOP; // (A9) Windows 2000/XP: Browser Stop key
+    case GDK_Search:
+        return VKEY_BROWSER_SEARCH; // (AA) Windows 2000/XP: Browser Search key
+    case GDK_Favorites:
+        return VKEY_BROWSER_FAVORITES; // (AB) Windows 2000/XP: Browser Favorites key
+    case GDK_HomePage:
+        return VKEY_BROWSER_HOME; // (AC) Windows 2000/XP: Browser Start and Home key
+    case GDK_AudioMute:
+        return VKEY_VOLUME_MUTE; // (AD) Windows 2000/XP: Volume Mute key
+    case GDK_AudioLowerVolume:
+        return VKEY_VOLUME_DOWN; // (AE) Windows 2000/XP: Volume Down key
+    case GDK_AudioRaiseVolume:
+        return VKEY_VOLUME_UP; // (AF) Windows 2000/XP: Volume Up key
+    case GDK_AudioNext:
+        return VKEY_MEDIA_NEXT_TRACK; // (B0) Windows 2000/XP: Next Track key
+    case GDK_AudioPrev:
+        return VKEY_MEDIA_PREV_TRACK; // (B1) Windows 2000/XP: Previous Track key
+    case GDK_AudioStop:
+        return VKEY_MEDIA_STOP; // (B2) Windows 2000/XP: Stop Media key
+    case GDK_AudioPlay:
+        return VKEY_MEDIA_PLAY_PAUSE; // (B3) Windows 2000/XP: Play/Pause Media key
+    case GDK_Mail:
+        return VKEY_MEDIA_LAUNCH_MAIL; // (B4) Windows 2000/XP: Start Mail key
         // VKEY_LAUNCH_MEDIA_SELECT (B5) Windows 2000/XP: Select Media key
-        // VKEY_LAUNCH_APP1 (B6) Windows 2000/XP: Start Application 1 key
-        // VKEY_LAUNCH_APP2 (B7) Windows 2000/XP: Start Application 2 key
+    case GDK_LaunchA:
+        return VKEY_MEDIA_LAUNCH_APP1; // (B6) Windows 2000/XP: Start Application 1 key
+    case GDK_LaunchB:
+        return VKEY_MEDIA_LAUNCH_APP2; // (B7) Windows 2000/XP: Start Application 2 key
 
         // VKEY_OEM_1 (BA) Used for miscellaneous characters; it can vary by keyboard. Windows 2000/XP: For the US standard keyboard, the ';:' key
     case GDK_semicolon:
diff --git a/Source/WebCore/bindings/v8/ScopedDOMDataStore.h b/Source/WebCore/platform/chromium/PageClientChromium.h
index 7c63b6b9f..354e3a181 100644
--- a/Source/WebCore/bindings/v8/ScopedDOMDataStore.h
+++ b/Source/WebCore/platform/chromium/PageClientChromium.h
@@ -1,10 +1,10 @@
 /*
- * Copyright (C) 2009 Google Inc. All rights reserved.
- *
+ * Copyright (c) 2012, Google Inc. All rights reserved.
+ * 
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
- *
+ * 
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ -14,7 +14,7 @@
  *     * Neither the name of Google Inc. nor the names of its
  * contributors may be used to endorse or promote products derived from
  * this software without specific prior written permission.
- *
+ * 
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -28,31 +28,18 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef ScopedDOMDataStore_h
-#define ScopedDOMDataStore_h
+#ifndef PageClientChromium_h
+#define PageClientChromium_h
 
-#include "DOMDataStore.h"
+#include <public/WebScreenInfo.h>
 
 namespace WebCore {
 
-    // ScopedDOMDataStore
-    //
-    // ScopedDOMDataStore is a DOMDataStore that controls limits the lifetime of
-    // the store to the lifetime of the object itself.  In other words, when the
-    // ScopedDOMDataStore object is deallocated, the maps that belong to the store
-    // are deallocated as well.
-    //
-    class ScopedDOMDataStore : public DOMDataStore {
-    public:
-        ScopedDOMDataStore();
-
-        // This can be called when WTF thread is tearing down.
-        // We assume that all child threads running V8 instances are created by WTF.
-        virtual ~ScopedDOMDataStore();
-
-        virtual void reportMemoryUsage(MemoryObjectInfo*) const OVERRIDE;
-    };
+class PageClientChromium {
+public:
+    virtual WebKit::WebScreenInfo screenInfo() = 0;
+};
 
 } // namespace WebCore
 
-#endif // ScopedDOMDataStore_h
+#endif // PageClientChromium_h
diff --git a/Source/WebCore/platform/chromium/PlatformScreenChromium.cpp b/Source/WebCore/platform/chromium/PlatformScreenChromium.cpp
index 54d58da13..02f098888 100644
--- a/Source/WebCore/platform/chromium/PlatformScreenChromium.cpp
+++ b/Source/WebCore/platform/chromium/PlatformScreenChromium.cpp
@@ -31,46 +31,82 @@
 #include "config.h"
 #include "PlatformScreen.h"
 
-#include "IntRect.h"
-#include "PlatformSupport.h"
-
+#include "FloatRect.h"
+#include "HostWindow.h"
+#include "ScrollView.h"
+#include "Widget.h"
 #include <public/Platform.h>
+#include <public/WebScreenInfo.h>
 
 namespace WebCore {
 
+static PlatformPageClient toPlatformPageClient(Widget* widget)
+{
+    if (!widget)
+        return 0;
+    ScrollView* root = widget->root();
+    if (!root)
+        return 0;
+    HostWindow* hostWindow = root->hostWindow();
+    if (!hostWindow)
+        return 0;
+    return hostWindow->platformPageClient();
+}
+
 int screenHorizontalDPI(Widget* widget)
 {
-    return PlatformSupport::screenHorizontalDPI(widget);
+    PlatformPageClient client = toPlatformPageClient(widget);
+    if (!client)
+        return 0;
+    return client->screenInfo().horizontalDPI;
 }
 
 int screenVerticalDPI(Widget* widget)
 {
-    return PlatformSupport::screenVerticalDPI(widget);
+    PlatformPageClient client = toPlatformPageClient(widget);
+    if (!client)
+        return 0;
+    return client->screenInfo().verticalDPI;
 }
 
 int screenDepth(Widget* widget)
 {
-    return PlatformSupport::screenDepth(widget);
+    PlatformPageClient client = toPlatformPageClient(widget);
+    if (!client)
+        return 0;
+    return client->screenInfo().depth;
 }
 
 int screenDepthPerComponent(Widget* widget)
 {
-    return PlatformSupport::screenDepthPerComponent(widget);
+    PlatformPageClient client = toPlatformPageClient(widget);
+    if (!client)
+        return 0;
+    return client->screenInfo().depthPerComponent;
 }
 
 bool screenIsMonochrome(Widget* widget)
 {
-    return PlatformSupport::screenIsMonochrome(widget);
+    PlatformPageClient client = toPlatformPageClient(widget);
+    if (!client)
+        return false;
+    return client->screenInfo().isMonochrome;
 }
 
 FloatRect screenRect(Widget* widget)
 {
-    return PlatformSupport::screenRect(widget);
+    PlatformPageClient client = toPlatformPageClient(widget);
+    if (!client)
+        return FloatRect();
+    return IntRect(client->screenInfo().rect);
 }
 
 FloatRect screenAvailableRect(Widget* widget)
 {
-    return PlatformSupport::screenAvailableRect(widget);
+    PlatformPageClient client = toPlatformPageClient(widget);
+    if (!client)
+        return FloatRect();
+    return IntRect(client->screenInfo().availableRect);
 }
 
 void screenColorProfile(ColorProfile& toProfile)
diff --git a/Source/WebCore/platform/chromium/PlatformSupport.h b/Source/WebCore/platform/chromium/PlatformSupport.h
index 4fc3d63c4..3e051db3e 100644
--- a/Source/WebCore/platform/chromium/PlatformSupport.h
+++ b/Source/WebCore/platform/chromium/PlatformSupport.h
@@ -98,15 +98,6 @@ public:
     static bool plugins(bool refresh, Vector<PluginInfo>*);
     static NPObject* pluginScriptableObject(Widget*);
 
-    // Screen -------------------------------------------------------------
-    static int screenHorizontalDPI(Widget*);
-    static int screenVerticalDPI(Widget*);
-    static int screenDepth(Widget*);
-    static int screenDepthPerComponent(Widget*);
-    static bool screenIsMonochrome(Widget*);
-    static IntRect screenRect(Widget*);
-    static IntRect screenAvailableRect(Widget*);
-
     // Theming ------------------------------------------------------------
 #if OS(WINDOWS)
     static void paintButton(
diff --git a/Source/WebCore/platform/efl/LocalizedStringsEfl.cpp b/Source/WebCore/platform/efl/LocalizedStringsEfl.cpp
index cb5d7ba3e..5fdd3b283 100644
--- a/Source/WebCore/platform/efl/LocalizedStringsEfl.cpp
+++ b/Source/WebCore/platform/efl/LocalizedStringsEfl.cpp
@@ -572,6 +572,12 @@ String insecurePluginVersionText()
     return String();
 }
 
+String inactivePluginText()
+{
+    notImplemented();
+    return String();
+}
+
 String unacceptableTLSCertificate()
 {
     return String::fromUTF8("Unacceptable TLS certificate");
diff --git a/Source/WebCore/platform/efl/PlatformScreenEfl.cpp b/Source/WebCore/platform/efl/PlatformScreenEfl.cpp
index 430bc96ae..0e207aa10 100644
--- a/Source/WebCore/platform/efl/PlatformScreenEfl.cpp
+++ b/Source/WebCore/platform/efl/PlatformScreenEfl.cpp
@@ -48,21 +48,6 @@
 
 namespace WebCore {
 
-#ifdef HAVE_ECORE_X
-
-#define CALL_WITH_ECORE_X(ECORE_X_CALL)                                 \
-    do {                                                                \
-        int success = ecore_x_init(0);                                  \
-        if (success) {                                                  \
-            Ecore_X_Screen* screen = ecore_x_default_screen_get();      \
-            if (screen)                                                 \
-                ECORE_X_CALL;                                           \
-            ecore_x_shutdown();                                         \
-        }                                                               \
-    } while (0)                                                         \
-
-#endif
-
 int screenHorizontalDPI(Widget*)
 {
     notImplemented();
@@ -78,9 +63,7 @@ int screenVerticalDPI(Widget*)
 int screenDepth(Widget*)
 {
 #ifdef HAVE_ECORE_X
-    int depth = 24;
-    CALL_WITH_ECORE_X(depth = ecore_x_default_depth_get(ecore_x_display_get(), screen));
-    return depth;
+    return ecore_x_default_depth_get(ecore_x_display_get(), ecore_x_default_screen_get());
 #else
     return 24;
 #endif
@@ -114,12 +97,12 @@ bool screenIsMonochrome(Widget* widget)
 FloatRect screenRect(Widget* widget)
 {
 #ifdef HAVE_ECORE_X
+    UNUSED_PARAM(widget);
     // Fallback to realistic values if the EcoreX call fails
     // and we cannot accurately detect the screen size.
     int width = 800;
     int height = 600;
-    CALL_WITH_ECORE_X(ecore_x_screen_size_get(screen, &width, &height));
-    UNUSED_PARAM(widget);
+    ecore_x_screen_size_get(ecore_x_default_screen_get(), &width, &height);
     return FloatRect(0, 0, width, height);
 #else
     if (!widget || !widget->evas())
diff --git a/Source/WebCore/platform/efl/SoundEfl.cpp b/Source/WebCore/platform/efl/SoundEfl.cpp
index c3d83bc5c..091de7ac9 100644
--- a/Source/WebCore/platform/efl/SoundEfl.cpp
+++ b/Source/WebCore/platform/efl/SoundEfl.cpp
@@ -39,10 +39,7 @@ namespace WebCore {
 void systemBeep()
 {
 #ifdef HAVE_ECORE_X
-    if (ecore_x_init(0)) {
-        ecore_x_bell(0);
-        ecore_x_shutdown();
-    }
+    ecore_x_bell(0);
 #endif
 }
 
diff --git a/Source/WebCore/platform/graphics/BitmapImage.h b/Source/WebCore/platform/graphics/BitmapImage.h
index 8fedc3e50..00387d64a 100644
--- a/Source/WebCore/platform/graphics/BitmapImage.h
+++ b/Source/WebCore/platform/graphics/BitmapImage.h
@@ -204,8 +204,8 @@ protected:
     virtual void drawFrameMatchingSourceSize(GraphicsContext*, const FloatRect& dstRect, const IntSize& srcSize, ColorSpace styleColorSpace, CompositeOperator);
 #endif
     virtual void draw(GraphicsContext*, const FloatRect& dstRect, const FloatRect& srcRect, ColorSpace styleColorSpace, CompositeOperator);
-#if USE(CG)
-    virtual void draw(GraphicsContext*, const FloatRect& dstRect, const FloatRect& srcRect, ColorSpace styleColorSpace, CompositeOperator, RespectImageOrientationEnum);
+#if USE(CG) || PLATFORM(CHROMIUM) || USE(CAIRO)
+    virtual void draw(GraphicsContext*, const FloatRect& dstRect, const FloatRect& srcRect, ColorSpace styleColorSpace, CompositeOperator, RespectImageOrientationEnum) OVERRIDE;
 #endif
 
 #if (OS(WINCE) && !PLATFORM(QT))
diff --git a/Source/WebCore/platform/graphics/Font.cpp b/Source/WebCore/platform/graphics/Font.cpp
index 38ce35425..b3bf322e5 100644
--- a/Source/WebCore/platform/graphics/Font.cpp
+++ b/Source/WebCore/platform/graphics/Font.cpp
@@ -75,6 +75,7 @@ Font::Font()
     , m_wordSpacing(0)
     , m_isPlatformFont(false)
     , m_needsTranscoding(false)
+    , m_typesettingFeatures(0)
 {
 }
 
@@ -84,6 +85,7 @@ Font::Font(const FontDescription& fd, short letterSpacing, short wordSpacing)
     , m_wordSpacing(wordSpacing)
     , m_isPlatformFont(false)
     , m_needsTranscoding(fontTranscoder().needsTranscoding(fd))
+    , m_typesettingFeatures(computeTypesettingFeatures())
 {
 }
 
@@ -92,6 +94,7 @@ Font::Font(const FontPlatformData& fontData, bool isPrinterFont, FontSmoothingMo
     , m_letterSpacing(0)
     , m_wordSpacing(0)
     , m_isPlatformFont(true)
+    , m_typesettingFeatures(computeTypesettingFeatures())
 {
     m_fontDescription.setUsePrinterFont(isPrinterFont);
     m_fontDescription.setFontSmoothing(fontSmoothingMode);
@@ -106,6 +109,7 @@ Font::Font(const Font& other)
     , m_wordSpacing(other.m_wordSpacing)
     , m_isPlatformFont(other.m_isPlatformFont)
     , m_needsTranscoding(other.m_needsTranscoding)
+    , m_typesettingFeatures(computeTypesettingFeatures())
 {
 }
 
@@ -117,6 +121,7 @@ Font& Font::operator=(const Font& other)
     m_wordSpacing = other.m_wordSpacing;
     m_isPlatformFont = other.m_isPlatformFont;
     m_needsTranscoding = other.m_needsTranscoding;
+    m_typesettingFeatures = other.m_typesettingFeatures;
     return *this;
 }
 
@@ -148,6 +153,7 @@ void Font::update(PassRefPtr<FontSelector> fontSelector) const
     if (!m_fontFallbackList)
         m_fontFallbackList = FontFallbackList::create();
     m_fontFallbackList->invalidate(fontSelector);
+    m_typesettingFeatures = computeTypesettingFeatures();
 }
 
 void Font::drawText(GraphicsContext* context, const TextRun& run, const FloatPoint& point, int from, int to) const
@@ -210,11 +216,7 @@ float Font::width(const TextRun& run, int& charsConsumed, String& glyphName) con
 
     charsConsumed = run.length();
     glyphName = "";
-
-    if (codePath(run) != Complex)
-        return floatWidthForSimpleText(run);
-
-    return floatWidthForComplexText(run);
+    return width(run);
 }
 
 #if !(PLATFORM(MAC) || (PLATFORM(CHROMIUM) && OS(DARWIN)))
diff --git a/Source/WebCore/platform/graphics/Font.h b/Source/WebCore/platform/graphics/Font.h
index aabcb2e70..b60d9dd3d 100644
--- a/Source/WebCore/platform/graphics/Font.h
+++ b/Source/WebCore/platform/graphics/Font.h
@@ -121,47 +121,7 @@ public:
     
     FontRenderingMode renderingMode() const { return m_fontDescription.renderingMode(); }
 
-    TypesettingFeatures typesettingFeatures() const
-    {
-        TextRenderingMode textRenderingMode = m_fontDescription.textRenderingMode();
-        TypesettingFeatures features = s_defaultTypesettingFeatures;
-
-        switch(textRenderingMode) {
-        case AutoTextRendering:
-            break;
-        case OptimizeSpeed:
-            features &= ~(Kerning | Ligatures);
-            break;
-        case GeometricPrecision:
-        case OptimizeLegibility:
-            features |= Kerning | Ligatures;
-            break;
-        }
-
-        switch (m_fontDescription.kerning()) {
-        case FontDescription::NoneKerning:
-            features &= ~Kerning;
-            break;
-        case FontDescription::NormalKerning:
-            features |= Kerning;
-            break;
-        case FontDescription::AutoKerning:
-            break;
-        }
-
-        switch (m_fontDescription.commonLigaturesState()) {
-        case FontDescription::DisabledLigaturesState:
-            features &= ~Ligatures;
-            break;
-        case FontDescription::EnabledLigaturesState:
-            features |= Ligatures;
-            break;
-        case FontDescription::NormalLigaturesState:
-            break;
-        }
-
-        return features;
-    }
+    TypesettingFeatures typesettingFeatures() const { return m_typesettingFeatures; }
 
     FontFamily& firstFamily() { return m_fontDescription.firstFamily(); }
     const FontFamily& family() const { return m_fontDescription.family(); }
@@ -287,6 +247,48 @@ private:
         return m_fontFallbackList && m_fontFallbackList->loadingCustomFonts();
     }
 
+    TypesettingFeatures computeTypesettingFeatures() const
+    {
+        TextRenderingMode textRenderingMode = m_fontDescription.textRenderingMode();
+        TypesettingFeatures features = s_defaultTypesettingFeatures;
+
+        switch (textRenderingMode) {
+        case AutoTextRendering:
+            break;
+        case OptimizeSpeed:
+            features &= ~(Kerning | Ligatures);
+            break;
+        case GeometricPrecision:
+        case OptimizeLegibility:
+            features |= Kerning | Ligatures;
+            break;
+        }
+
+        switch (m_fontDescription.kerning()) {
+        case FontDescription::NoneKerning:
+            features &= ~Kerning;
+            break;
+        case FontDescription::NormalKerning:
+            features |= Kerning;
+            break;
+        case FontDescription::AutoKerning:
+            break;
+        }
+
+        switch (m_fontDescription.commonLigaturesState()) {
+        case FontDescription::DisabledLigaturesState:
+            features &= ~Ligatures;
+            break;
+        case FontDescription::EnabledLigaturesState:
+            features |= Ligatures;
+            break;
+        case FontDescription::NormalLigaturesState:
+            break;
+        }
+
+        return features;
+    }
+
 #if PLATFORM(QT)
     void initFormatForTextLayout(QTextLayout*) const;
 #endif
@@ -299,6 +301,7 @@ private:
     short m_wordSpacing;
     bool m_isPlatformFont;
     bool m_needsTranscoding;
+    mutable TypesettingFeatures m_typesettingFeatures; // Caches values computed from m_fontDescription.
 };
 
 inline Font::~Font()
diff --git a/Source/WebCore/platform/graphics/FontCache.cpp b/Source/WebCore/platform/graphics/FontCache.cpp
index 3fea6c235..f60883ab3 100644
--- a/Source/WebCore/platform/graphics/FontCache.cpp
+++ b/Source/WebCore/platform/graphics/FontCache.cpp
@@ -293,8 +293,8 @@ static FontDataCache* gFontDataCache = 0;
 const int cMaxInactiveFontData = 250;
 const int cTargetInactiveFontData = 200;
 #else
-const int cMaxInactiveFontData = 50; // Pretty Low Threshold
-const int cTargetInactiveFontData = 30;
+const int cMaxInactiveFontData = 225;
+const int cTargetInactiveFontData = 200;
 #endif
 static ListHashSet<RefPtr<SimpleFontData> >* gInactiveFontData = 0;
 
diff --git a/Source/WebCore/platform/graphics/FontFallbackList.h b/Source/WebCore/platform/graphics/FontFallbackList.h
index 88f1bc796..a14fb82ed 100644
--- a/Source/WebCore/platform/graphics/FontFallbackList.h
+++ b/Source/WebCore/platform/graphics/FontFallbackList.h
@@ -41,6 +41,29 @@ const int cAllFamiliesScanned = -1;
 class FontFallbackList : public RefCounted<FontFallbackList> {
     WTF_MAKE_NONCOPYABLE(FontFallbackList);
 public:
+    typedef HashMap<int, GlyphPageTreeNode*, DefaultHash<int>::Hash> GlyphPages;
+
+    class GlyphPagesStateSaver {
+    public:
+        GlyphPagesStateSaver(FontFallbackList& fallbackList)
+            : m_fallbackList(fallbackList)
+            , m_pages(fallbackList.m_pages)
+            , m_pageZero(fallbackList.m_pageZero)
+        {
+        }
+
+        ~GlyphPagesStateSaver()
+        {
+            m_fallbackList.m_pages = m_pages;
+            m_fallbackList.m_pageZero = m_pageZero;
+        }
+
+    private:
+        FontFallbackList& m_fallbackList;
+        GlyphPages& m_pages;
+        GlyphPageTreeNode* m_pageZero;
+    };
+
     static PassRefPtr<FontFallbackList> create() { return adoptRef(new FontFallbackList()); }
 
     ~FontFallbackList() { releaseFontData(); }
@@ -56,13 +79,6 @@ public:
     unsigned fontSelectorVersion() const { return m_fontSelectorVersion; }
     unsigned generation() const { return m_generation; }
 
-    struct GlyphPagesHashTraits : HashTraits<int> {
-        static const int minimumTableSize = 16;
-    };
-    typedef HashMap<int, GlyphPageTreeNode*, DefaultHash<int>::Hash, GlyphPagesHashTraits> GlyphPages;
-    GlyphPageTreeNode* glyphPageZero() const { return m_pageZero; }
-    const GlyphPages& glyphPages() const { return m_pages; }
-
 private:
     FontFallbackList();
 
@@ -80,8 +96,6 @@ private:
     void setPlatformFont(const FontPlatformData&);
 
     void releaseFontData();
-    void setGlyphPageZero(GlyphPageTreeNode* pageZero) { m_pageZero = pageZero; }
-    void setGlyphPages(const GlyphPages& pages) { m_pages = pages; }
     
     mutable Vector<RefPtr<FontData>, 1> m_fontList;
     mutable GlyphPages m_pages;
@@ -95,7 +109,6 @@ private:
     mutable bool m_loadingCustomFonts : 1;
 
     friend class Font;
-    friend class SVGTextRunRenderingContext;
 };
 
 }
diff --git a/Source/WebCore/platform/graphics/FontPlatformData.h b/Source/WebCore/platform/graphics/FontPlatformData.h
index f7af70617..be82845ed 100644
--- a/Source/WebCore/platform/graphics/FontPlatformData.h
+++ b/Source/WebCore/platform/graphics/FontPlatformData.h
@@ -181,7 +181,7 @@ public:
 #if USE(CG) || USE(SKIA_ON_MAC_CHROMIUM)
         ASSERT(m_font || !m_cgFont);
 #endif
-        uintptr_t hashCodes[3] = { (uintptr_t)m_font, m_widthVariant, m_isPrinterFont << 4 | m_textOrientation << 3 | m_orientation << 2 | m_syntheticBold << 1 | m_syntheticOblique };
+        uintptr_t hashCodes[3] = { (uintptr_t)m_font, m_widthVariant, static_cast<uintptr_t>(m_isPrinterFont << 4 | m_textOrientation << 3 | m_orientation << 2 | m_syntheticBold << 1 | m_syntheticOblique) };
         return StringHasher::hashMemory<sizeof(hashCodes)>(hashCodes);
 #elif USE(CAIRO)
         return PtrHash<cairo_scaled_font_t*>::hash(m_scaledFont);
diff --git a/Source/WebCore/platform/graphics/FractionalLayoutSize.h b/Source/WebCore/platform/graphics/FractionalLayoutSize.h
index 1071d8ae3..9ece2ed84 100644
--- a/Source/WebCore/platform/graphics/FractionalLayoutSize.h
+++ b/Source/WebCore/platform/graphics/FractionalLayoutSize.h
@@ -77,6 +77,12 @@ public:
         m_width *= scale;
         m_height *= scale;
     }
+
+    void scale(float widthScale, float heightScale)
+    {
+        m_width *= widthScale;
+        m_height *= heightScale;
+    }
     
     FractionalLayoutSize expandedTo(const FractionalLayoutSize& other) const
     {
@@ -94,6 +100,14 @@ public:
     {
         *this = expandedTo(FractionalLayoutSize());
     }
+    
+    void clampToMinimumSize(const FractionalLayoutSize& minimumSize)
+    {
+        if (m_width < minimumSize.width())
+            m_width = minimumSize.width();
+        if (m_height < minimumSize.height())
+            m_height = minimumSize.height();
+    }
 
     FractionalLayoutSize transposedSize() const
     {
diff --git a/Source/WebCore/platform/graphics/GraphicsContext3D.cpp b/Source/WebCore/platform/graphics/GraphicsContext3D.cpp
index bc899472c..5f6942bf5 100644
--- a/Source/WebCore/platform/graphics/GraphicsContext3D.cpp
+++ b/Source/WebCore/platform/graphics/GraphicsContext3D.cpp
@@ -116,9 +116,7 @@ bool GraphicsContext3D::computeFormatAndTypeParameters(GC3Denum format,
         *componentsPerPixel = 1;
         *bytesPerComponent = sizeof(GC3Dushort);
         break;
-#if !PLATFORM(BLACKBERRY)
     case GraphicsContext3D::UNSIGNED_INT_24_8:
-#endif
     case GraphicsContext3D::UNSIGNED_INT:
         *bytesPerComponent = sizeof(GC3Duint);
         break;
@@ -149,7 +147,7 @@ GC3Denum GraphicsContext3D::computeImageSizeInBytes(GC3Denum format, GC3Denum ty
     }
     CheckedInt<uint32_t> checkedValue(bytesPerComponent * componentsPerPixel);
     checkedValue *=  width;
-    if (!checkedValue.valid())
+    if (!checkedValue.isValid())
         return GraphicsContext3D::INVALID_VALUE;
     unsigned int validRowSize = checkedValue.value();
     unsigned int padding = 0;
@@ -161,7 +159,7 @@ GC3Denum GraphicsContext3D::computeImageSizeInBytes(GC3Denum format, GC3Denum ty
     // Last row needs no padding.
     checkedValue *= (height - 1);
     checkedValue += validRowSize;
-    if (!checkedValue.valid())
+    if (!checkedValue.isValid())
         return GraphicsContext3D::INVALID_VALUE;
     *imageSizeInBytes = checkedValue.value();
     if (paddingInBytes)
diff --git a/Source/WebCore/platform/graphics/GraphicsContext3D.h b/Source/WebCore/platform/graphics/GraphicsContext3D.h
index 99a21a2d4..4ede0f817 100644
--- a/Source/WebCore/platform/graphics/GraphicsContext3D.h
+++ b/Source/WebCore/platform/graphics/GraphicsContext3D.h
@@ -72,6 +72,7 @@ typedef QOpenGLContext* PlatformGraphicsContext3D;
 typedef QSurface* PlatformGraphicsSurface3D;
 #else
 typedef void* PlatformGraphicsContext3D;
+typedef void* PlatformGraphicsSurface3D;
 #endif
 
 #if (PLATFORM(CHROMIUM) || PLATFORM(BLACKBERRY)) && USE(SKIA)
@@ -947,7 +948,7 @@ public:
 
     bool reshapeFBOs(const IntSize&);
     void resolveMultisamplingIfNecessary(const IntRect& = IntRect());
-#if PLATFORM(QT) && USE(GRAPHICS_SURFACE)
+#if (PLATFORM(QT) || PLATFORM(EFL)) && USE(GRAPHICS_SURFACE)
     void createGraphicsSurfaces(const IntSize&);
 #endif
 
diff --git a/Source/WebCore/platform/graphics/GraphicsLayer.cpp b/Source/WebCore/platform/graphics/GraphicsLayer.cpp
index 3a32b5145..dd3b7a9df 100644
--- a/Source/WebCore/platform/graphics/GraphicsLayer.cpp
+++ b/Source/WebCore/platform/graphics/GraphicsLayer.cpp
@@ -30,10 +30,12 @@
 #include "GraphicsLayer.h"
 
 #include "FloatPoint.h"
+#include "FloatRect.h"
 #include "GraphicsContext.h"
 #include "LayoutTypesInlineMethods.h"
 #include "RotateTransformOperation.h"
 #include "TextStream.h"
+#include <wtf/HashMap.h>
 #include <wtf/text/CString.h>
 #include <wtf/text/StringBuilder.h>
 #include <wtf/text/WTFString.h>
@@ -44,6 +46,13 @@
 
 namespace WebCore {
 
+typedef HashMap<const GraphicsLayer*, Vector<FloatRect> > RepaintMap;
+static RepaintMap& repaintRectMap()
+{
+    DEFINE_STATIC_LOCAL(RepaintMap, map, ());
+    return map;
+}
+
 void KeyframeValueList::insert(const AnimationValue* value)
 {
     for (size_t i = 0; i < m_values.size(); ++i) {
@@ -80,6 +89,8 @@ GraphicsLayer::GraphicsLayer(GraphicsLayerClient* client)
     , m_acceleratesDrawing(false)
     , m_maintainsPixelAlignment(false)
     , m_appliesPageScale(false)
+    , m_showDebugBorder(false)
+    , m_showRepaintCounter(false)
     , m_paintingPhase(GraphicsLayerPaintAllWithOverflowClip)
     , m_contentsOrientation(CompositingCoordinatesTopDown)
     , m_parent(0)
@@ -96,6 +107,7 @@ GraphicsLayer::GraphicsLayer(GraphicsLayerClient* client)
 
 GraphicsLayer::~GraphicsLayer()
 {
+    resetTrackedRepaints();
     ASSERT(!m_parent); // willBeDestroyed should have been called already.
 }
 
@@ -364,7 +376,7 @@ void GraphicsLayer::getDebugBorderInfo(Color& color, float& width) const
 
 void GraphicsLayer::updateDebugIndicators()
 {
-    if (!GraphicsLayer::showDebugBorders())
+    if (!isShowingDebugBorder())
         return;
 
     Color borderColor;
@@ -536,6 +548,28 @@ double GraphicsLayer::backingStoreMemoryEstimate() const
     return static_cast<double>(4 * size().width()) * size().height();
 }
 
+void GraphicsLayer::resetTrackedRepaints()
+{
+    repaintRectMap().remove(this);
+}
+
+void GraphicsLayer::addRepaintRect(const FloatRect& repaintRect)
+{
+    if (m_client->isTrackingRepaints()) {
+        FloatRect largestRepaintRect(FloatPoint(), m_size);
+        largestRepaintRect.intersect(repaintRect);
+        RepaintMap::iterator repaintIt = repaintRectMap().find(this);
+        if (repaintIt == repaintRectMap().end()) {
+            Vector<FloatRect> repaintRects;
+            repaintRects.append(largestRepaintRect);
+            repaintRectMap().set(this, repaintRects);
+        } else {
+            Vector<FloatRect>& repaintRects = repaintIt->value;
+            repaintRects.append(largestRepaintRect);
+        }
+    }
+}
+
 void GraphicsLayer::writeIndent(TextStream& ts, int indent)
 {
     for (int i = 0; i != indent; ++i)
@@ -658,7 +692,25 @@ void GraphicsLayer::dumpProperties(TextStream& ts, int indent, LayerTreeAsTextBe
         writeIndent(ts, indent + 1);
         ts << "(replicated layer";
         if (behavior & LayerTreeAsTextDebug)
-            ts << " " << m_replicatedLayer;;
+            ts << " " << m_replicatedLayer;
+        ts << ")\n";
+    }
+
+    if (behavior & LayerTreeAsTextIncludeRepaintRects && repaintRectMap().contains(this) && !repaintRectMap().get(this).isEmpty()) {
+        writeIndent(ts, indent + 1);
+        ts << "(repaint rects\n";
+        for (size_t i = 0; i < repaintRectMap().get(this).size(); ++i) {
+            if (repaintRectMap().get(this)[i].isEmpty())
+                continue;
+            writeIndent(ts, indent + 2);
+            ts << "(rect ";
+            ts << repaintRectMap().get(this)[i].x() << " ";
+            ts << repaintRectMap().get(this)[i].y() << " ";
+            ts << repaintRectMap().get(this)[i].width() << " ";
+            ts << repaintRectMap().get(this)[i].height();
+            ts << ")\n";
+        }
+        writeIndent(ts, indent + 1);
         ts << ")\n";
     }
     
@@ -692,7 +744,7 @@ void showGraphicsLayerTree(const WebCore::GraphicsLayer* layer)
     if (!layer)
         return;
 
-    String output = layer->layerTreeAsText(LayerTreeAsTextDebug | LayerTreeAsTextIncludeVisibleRects);
+    String output = layer->layerTreeAsText(LayerTreeAsTextDebug | LayerTreeAsTextIncludeVisibleRects | LayerTreeAsTextIncludeTileCaches);
     fprintf(stderr, "%s\n", output.utf8().data());
 }
 #endif
diff --git a/Source/WebCore/platform/graphics/GraphicsLayer.h b/Source/WebCore/platform/graphics/GraphicsLayer.h
index e67a17eae..e2c82ba1b 100644
--- a/Source/WebCore/platform/graphics/GraphicsLayer.h
+++ b/Source/WebCore/platform/graphics/GraphicsLayer.h
@@ -48,12 +48,15 @@ enum LayerTreeAsTextBehaviorFlags {
     LayerTreeAsTextBehaviorNormal = 0,
     LayerTreeAsTextDebug = 1 << 0, // Dump extra debugging info like layer addresses.
     LayerTreeAsTextIncludeVisibleRects = 1 << 1,
+    LayerTreeAsTextIncludeTileCaches = 1 << 2,
+    LayerTreeAsTextIncludeRepaintRects = 1 << 3
 };
 typedef unsigned LayerTreeAsTextBehavior;
 
 namespace WebCore {
 
 class FloatPoint3D;
+class FloatRect;
 class GraphicsContext;
 class GraphicsLayerFactory;
 class Image;
@@ -349,24 +352,26 @@ public:
     // For hosting this GraphicsLayer in a native layer hierarchy.
     virtual PlatformLayer* platformLayer() const { return 0; }
     
-    void dumpLayer(TextStream&, int indent = 0, LayerTreeAsTextBehavior = LayerTreeAsTextBehaviorNormal) const;
-
-    int repaintCount() const { return m_repaintCount; }
-    int incrementRepaintCount() { return ++m_repaintCount; }
-
     enum CompositingCoordinatesOrientation { CompositingCoordinatesTopDown, CompositingCoordinatesBottomUp };
 
     // Flippedness of the contents of this layer. Does not affect sublayer geometry.
     virtual void setContentsOrientation(CompositingCoordinatesOrientation orientation) { m_contentsOrientation = orientation; }
     CompositingCoordinatesOrientation contentsOrientation() const { return m_contentsOrientation; }
 
-    bool showDebugBorders() const { return m_client ? m_client->showDebugBorders(this) : false; }
-    bool showRepaintCounter() const { return m_client ? m_client->showRepaintCounter(this) : false; }
-    
-    void updateDebugIndicators();
-    
+    void dumpLayer(TextStream&, int indent = 0, LayerTreeAsTextBehavior = LayerTreeAsTextBehaviorNormal) const;
+
+    virtual void setShowDebugBorder(bool show) { m_showDebugBorder = show; }
+    bool isShowingDebugBorder() const { return m_showDebugBorder; }
+
+    virtual void setShowRepaintCounter(bool show) { m_showRepaintCounter = show; }
+    bool isShowingRepaintCounter() const { return m_showRepaintCounter; }
+
+    int repaintCount() const { return m_repaintCount; }
+    int incrementRepaintCount() { return ++m_repaintCount; }
+
     virtual void setDebugBackgroundColor(const Color&) { }
     virtual void setDebugBorder(const Color&, float /*borderWidth*/) { }
+
     // z-position is the z-equivalent of position(). It's only used for debugging purposes.
     virtual float zPosition() const { return m_zPosition; }
     virtual void setZPosition(float);
@@ -401,7 +406,10 @@ public:
 
     bool usingTiledLayer() const { return m_usingTiledLayer; }
 
-    virtual TiledBacking* tiledBacking() { return 0; }
+    virtual TiledBacking* tiledBacking() const { return 0; }
+
+    void resetTrackedRepaints();
+    void addRepaintRect(const FloatRect&);
 
 #if PLATFORM(QT) || PLATFORM(GTK) || PLATFORM(EFL)
     // This allows several alternative GraphicsLayer implementations in the same port,
@@ -410,6 +418,8 @@ public:
     static void setGraphicsLayerFactory(GraphicsLayerFactoryCallback);
 #endif
 
+    void updateDebugIndicators();
+
 protected:
     // Should be called from derived class destructors. Should call willBeDestroyed() on super.
     virtual void willBeDestroyed();
@@ -480,7 +490,9 @@ protected:
     bool m_acceleratesDrawing : 1;
     bool m_maintainsPixelAlignment : 1;
     bool m_appliesPageScale : 1; // Set for the layer which has the page scale applied to it.
-
+    bool m_showDebugBorder : 1;
+    bool m_showRepaintCounter : 1;
+    
     GraphicsLayerPaintingPhase m_paintingPhase;
     CompositingCoordinatesOrientation m_contentsOrientation; // affects orientation of layer contents
 
diff --git a/Source/WebCore/platform/graphics/GraphicsLayerAnimation.cpp b/Source/WebCore/platform/graphics/GraphicsLayerAnimation.cpp
index 3aa25ac40..1b05d3f64 100644
--- a/Source/WebCore/platform/graphics/GraphicsLayerAnimation.cpp
+++ b/Source/WebCore/platform/graphics/GraphicsLayerAnimation.cpp
@@ -22,11 +22,59 @@
 #if USE(ACCELERATED_COMPOSITING)
 #include "GraphicsLayerAnimation.h"
 
+#include "FractionalLayoutSize.h"
 #include "UnitBezier.h"
 #include <wtf/CurrentTime.h>
 
 namespace WebCore {
 
+#if ENABLE(CSS_FILTERS)
+static inline PassRefPtr<FilterOperation> blendFunc(FilterOperation* fromOp, FilterOperation* toOp, double progress, const IntSize& size, bool blendToPassthrough = false)
+{
+    ASSERT(toOp);
+    if (toOp->blendingNeedsRendererSize())
+        return toOp->blend(fromOp, progress, LayoutSize(size.width(), size.height()), blendToPassthrough);
+
+    return toOp->blend(fromOp, progress, blendToPassthrough);
+}
+
+
+static FilterOperations applyFilterAnimation(const FilterOperations* from, const FilterOperations* to, double progress, const IntSize& boxSize)
+{
+    // First frame of an animation.
+    if (!progress)
+        return *from;
+
+    // Last frame of an animation.
+    if (progress == 1)
+        return *to;
+
+    if (!from->operationsMatch(*to))
+        return *to;
+
+    FilterOperations result;
+
+    size_t fromSize = from->operations().size();
+    size_t toSize = to->operations().size();
+    size_t size = std::max(fromSize, toSize);
+    for (size_t i = 0; i < size; i++) {
+        RefPtr<FilterOperation> fromOp = (i < fromSize) ? from->operations()[i].get() : 0;
+        RefPtr<FilterOperation> toOp = (i < toSize) ? to->operations()[i].get() : 0;
+        RefPtr<FilterOperation> blendedOp = toOp ? blendFunc(fromOp.get(), toOp.get(), progress, boxSize) : (fromOp ? blendFunc(0, fromOp.get(), progress, boxSize, true) : 0);
+        if (blendedOp)
+            result.operations().append(blendedOp);
+        else {
+            RefPtr<FilterOperation> identityOp = PassthroughFilterOperation::create();
+            if (progress > 0.5)
+                result.operations().append(toOp ? toOp : identityOp);
+            else
+                result.operations().append(fromOp ? fromOp : identityOp);
+        }
+    }
+
+    return result;
+}
+#endif
 
 static bool shouldReverseAnimationValue(Animation::AnimationDirection direction, int loopCount)
 {
@@ -155,14 +203,23 @@ static TransformationMatrix applyTransformAnimation(const TransformOperations* f
     return matrix;
 }
 
+static const TimingFunction* timingFunctionForAnimationValue(const AnimationValue* animValue, const Animation* anim)
+{
+    if (animValue->timingFunction())
+        return animValue->timingFunction();
+    if (anim->timingFunction())
+        return anim->timingFunction().get();
+
+    return CubicBezierTimingFunction::defaultTimingFunction();
+}
 
-GraphicsLayerAnimation::GraphicsLayerAnimation(const String& name, const KeyframeValueList& keyframes, const IntSize& boxSize, const Animation* animation, double timeOffset, bool listsMatch)
+GraphicsLayerAnimation::GraphicsLayerAnimation(const String& name, const KeyframeValueList& keyframes, const IntSize& boxSize, const Animation* animation, double startTime, bool listsMatch)
     : m_keyframes(keyframes)
     , m_boxSize(boxSize)
     , m_animation(Animation::create(animation))
     , m_name(name)
     , m_listsMatch(listsMatch)
-    , m_startTime(WTF::currentTime() - timeOffset)
+    , m_startTime(startTime)
     , m_pauseTime(0)
     , m_state(PlayingState)
 {
@@ -177,6 +234,11 @@ void GraphicsLayerAnimation::applyInternal(Client* client, const AnimationValue*
     case AnimatedPropertyWebkitTransform:
         client->setAnimatedTransform(applyTransformAnimation(static_cast<const TransformAnimationValue*>(from)->value(), static_cast<const TransformAnimationValue*>(to)->value(), progress, m_boxSize, m_listsMatch));
         return;
+#if ENABLE(CSS_FILTERS)
+    case AnimatedPropertyWebkitFilter:
+        client->setAnimatedFilters(applyFilterAnimation(static_cast<const FilterAnimationValue*>(from)->value(), static_cast<const FilterAnimationValue*>(to)->value(), progress, m_boxSize));
+        return;
+#endif
     default:
         ASSERT_NOT_REACHED();
     }
@@ -233,7 +295,8 @@ void GraphicsLayerAnimation::apply(Client* client)
         return;
     }
     if (m_keyframes.size() == 2) {
-        normalizedValue = applyTimingFunction(m_animation->timingFunction().get(), normalizedValue, m_animation->duration());
+        const TimingFunction* timingFunction = timingFunctionForAnimationValue(m_keyframes.at(0), m_animation.get());
+        normalizedValue = applyTimingFunction(timingFunction, normalizedValue, m_animation->duration());
         applyInternal(client, m_keyframes.at(0), m_keyframes.at(1), normalizedValue);
         return;
     }
@@ -245,17 +308,17 @@ void GraphicsLayerAnimation::apply(Client* client)
             continue;
 
         normalizedValue = (normalizedValue - from->keyTime()) / (to->keyTime() - from->keyTime());
-        normalizedValue = applyTimingFunction(from->timingFunction(), normalizedValue, m_animation->duration());
+        const TimingFunction* timingFunction = timingFunctionForAnimationValue(from, m_animation.get());
+        normalizedValue = applyTimingFunction(timingFunction, normalizedValue, m_animation->duration());
         applyInternal(client, from, to, normalizedValue);
         break;
     }
 }
 
-void GraphicsLayerAnimation::pause(double offset)
+void GraphicsLayerAnimation::pause(double time)
 {
-    // FIXME: should apply offset here.
     setState(PausedState);
-    m_pauseTime = WTF::currentTime() - offset;
+    m_pauseTime = time;
 }
 
 void GraphicsLayerAnimations::add(const GraphicsLayerAnimation& animation)
@@ -285,6 +348,15 @@ void GraphicsLayerAnimations::apply(GraphicsLayerAnimation::Client* client)
         m_animations[i].apply(client);
 }
 
+GraphicsLayerAnimations GraphicsLayerAnimations::getActiveAnimations() const
+{
+    GraphicsLayerAnimations active;
+    for (size_t i = 0; i < m_animations.size(); ++i) {
+        if (m_animations[i].isActive())
+            active.add(m_animations[i]);
+    }
+    return active;
+}
 }
 #endif
 
diff --git a/Source/WebCore/platform/graphics/GraphicsLayerAnimation.h b/Source/WebCore/platform/graphics/GraphicsLayerAnimation.h
index e58279c6a..fe4c44a5e 100644
--- a/Source/WebCore/platform/graphics/GraphicsLayerAnimation.h
+++ b/Source/WebCore/platform/graphics/GraphicsLayerAnimation.h
@@ -36,6 +36,9 @@ public:
     public:
         virtual void setAnimatedTransform(const TransformationMatrix&) = 0;
         virtual void setAnimatedOpacity(float) = 0;
+#if ENABLE(CSS_FILTERS)
+        virtual void setAnimatedFilters(const FilterOperations&) = 0;
+#endif
     };
 
     GraphicsLayerAnimation()
@@ -45,10 +48,20 @@ public:
     void apply(Client*);
     void pause(double);
     AnimationState state() const { return m_state; }
-    void setState(AnimationState s) { m_state = s; }
+    void setState(AnimationState s, double pauseTime = 0)
+    {
+        m_state = s;
+        m_pauseTime = pauseTime;
+    }
     AnimatedPropertyID property() const { return m_keyframes.property(); }
     bool isActive() const;
     String name() const { return m_name; }
+    IntSize boxSize() const { return m_boxSize; }
+    double startTime() const { return m_startTime; }
+    double pauseTime() const { return m_pauseTime; }
+    PassRefPtr<Animation> animation() const { return m_animation.get(); }
+    const KeyframeValueList& keyframes() const { return m_keyframes; }
+    bool listsMatch() const { return m_listsMatch; }
 
 private:
     void applyInternal(Client*, const AnimationValue* from, const AnimationValue* to, float progress);
@@ -57,7 +70,6 @@ private:
     RefPtr<Animation> m_animation;
     String m_name;
     bool m_listsMatch;
-    bool m_hasBigRotation;
     double m_startTime;
     double m_pauseTime;
     AnimationState m_state;
@@ -72,10 +84,15 @@ public:
     void pause(const String&, double);
     void apply(GraphicsLayerAnimation::Client*);
     bool isEmpty() const { return m_animations.isEmpty(); }
+    size_t size() const { return m_animations.size(); }
+    const Vector<GraphicsLayerAnimation>& animations() const { return m_animations; }
+    Vector<GraphicsLayerAnimation>& animations() { return m_animations; }
 
     bool hasRunningAnimations() const;
     bool hasActiveAnimationsOfType(AnimatedPropertyID type) const;
 
+    GraphicsLayerAnimations getActiveAnimations() const;
+
 private:
     Vector<GraphicsLayerAnimation> m_animations;
 };
diff --git a/Source/WebCore/platform/graphics/GraphicsLayerClient.h b/Source/WebCore/platform/graphics/GraphicsLayerClient.h
index 3e105ce6b..8b6bffd19 100644
--- a/Source/WebCore/platform/graphics/GraphicsLayerClient.h
+++ b/Source/WebCore/platform/graphics/GraphicsLayerClient.h
@@ -82,8 +82,7 @@ public:
     // Page scale factor.
     virtual float pageScaleFactor() const { return 1; }
 
-    virtual bool showDebugBorders(const GraphicsLayer*) const = 0;
-    virtual bool showRepaintCounter(const GraphicsLayer*) const = 0;
+    virtual bool isTrackingRepaints() const { return false; }
 
 #ifndef NDEBUG
     // RenderLayerBacking overrides this to verify that it is not
diff --git a/Source/WebCore/platform/graphics/ImageBuffer.h b/Source/WebCore/platform/graphics/ImageBuffer.h
index fe0aee0f6..4b71c3590 100644
--- a/Source/WebCore/platform/graphics/ImageBuffer.h
+++ b/Source/WebCore/platform/graphics/ImageBuffer.h
@@ -119,6 +119,8 @@ namespace WebCore {
         PlatformLayer* platformLayer() const;
 #endif
 
+        // FIXME: current implementations of this method have the restriction that they only work
+        // with textures that are RGB or RGBA format, and UNSIGNED_BYTE type.
         bool copyToPlatformTexture(GraphicsContext3D&, Platform3DObject, GC3Denum, bool, bool);
 
         void reportMemoryUsage(MemoryObjectInfo*) const;
diff --git a/Source/WebCore/platform/graphics/ImageObserver.h b/Source/WebCore/platform/graphics/ImageObserver.h
index 8b693d984..804cdeb97 100644
--- a/Source/WebCore/platform/graphics/ImageObserver.h
+++ b/Source/WebCore/platform/graphics/ImageObserver.h
@@ -26,6 +26,8 @@
 #ifndef ImageObserver_h
 #define ImageObserver_h
 
+#include <wtf/Forward.h>
+
 namespace WebCore {
 
 class Image;
@@ -44,6 +46,8 @@ public:
     virtual void animationAdvanced(const Image*) = 0;
 
     virtual void changedInRect(const Image*, const IntRect&) = 0;
+
+    virtual void reportMemoryUsage(MemoryObjectInfo*) const = 0;
 };
 
 }
diff --git a/Source/WebCore/platform/graphics/ImageOrientation.cpp b/Source/WebCore/platform/graphics/ImageOrientation.cpp
index 8a5854e63..dc2b9782b 100644
--- a/Source/WebCore/platform/graphics/ImageOrientation.cpp
+++ b/Source/WebCore/platform/graphics/ImageOrientation.cpp
@@ -41,17 +41,17 @@ AffineTransform ImageOrientation::transformFromDefault(const FloatSize& drawnSiz
     case OriginBottomRight:
         return AffineTransform(-1,  0,  0, -1,  w, h);
     case OriginLeftBottom:
-        return AffineTransform( 0,  1, -1,  0,  w, 0);
-    case OriginRightTop:
         return AffineTransform( 0, -1,  1,  0,  0, h);
+    case OriginRightTop:
+        return AffineTransform( 0,  1, -1,  0,  w, 0);
     case OriginTopRight:
         return AffineTransform(-1,  0,  0,  1,  w, 0);
     case OriginBottomLeft:
         return AffineTransform( 1,  0,  0, -1,  0, h);
     case OriginLeftTop:
-        return AffineTransform( 0, -1, -1,  0,  w, h);
-    case OriginRightBottom:
         return AffineTransform( 0,  1,  1,  0,  0, 0);
+    case OriginRightBottom:
+        return AffineTransform( 0, -1, -1,  0,  w, h);
     }
     ASSERT_NOT_REACHED();
     return AffineTransform();
diff --git a/Source/WebCore/platform/graphics/ImageOrientation.h b/Source/WebCore/platform/graphics/ImageOrientation.h
index 86be5fe77..b184dc2f7 100644
--- a/Source/WebCore/platform/graphics/ImageOrientation.h
+++ b/Source/WebCore/platform/graphics/ImageOrientation.h
@@ -36,13 +36,13 @@ class FloatSize;
 enum ImageOrientationEnum {
     // "TopLeft" means that the 0 row starts at the Top, the 0 column starts at the Left.
     OriginTopLeft = 1, // default
-    OriginTopRight = 2, // mirror along y-axes
+    OriginTopRight = 2, // mirror along y-axis
     OriginBottomRight = 3, // 180 degree rotation
-    OriginBottomLeft = 4, // mirror along the x-axes
-    OriginLeftTop = 5, // -90 degree rotation + mirror along x-axes
-    OriginRightTop = 6, // 90 degree rotation
-    OriginRightBottom = 7, // 90 degree rotation + mirror along x-axes
-    OriginLeftBottom = 8, // -90 degree rotation
+    OriginBottomLeft = 4, // mirror along the x-axis
+    OriginLeftTop = 5, // mirror along x-axis + 270 degree CW rotation
+    OriginRightTop = 6, // 90 degree CW rotation
+    OriginRightBottom = 7, // mirror along x-axis + 90 degree CW rotation
+    OriginLeftBottom = 8, // 270 degree CW rotation
     // All other values are "reserved" as of EXIF 2.2
     DefaultImageOrientation = OriginTopLeft,
 };
@@ -76,6 +76,7 @@ public:
     }
 
     // This transform can be used for drawing an image according to the orientation.
+    // It should be used in a right-handed coordinate system.
     AffineTransform transformFromDefault(const FloatSize& drawnSize) const;
 
     inline bool operator==(const ImageOrientation& other) const { return other.m_orientation == m_orientation; }
diff --git a/Source/WebCore/platform/graphics/ImageSource.cpp b/Source/WebCore/platform/graphics/ImageSource.cpp
index abfa5988b..56857a43f 100644
--- a/Source/WebCore/platform/graphics/ImageSource.cpp
+++ b/Source/WebCore/platform/graphics/ImageSource.cpp
@@ -106,20 +106,19 @@ bool ImageSource::isSizeAvailable()
 
 IntSize ImageSource::size(RespectImageOrientationEnum shouldRespectOrientation) const
 {
-    // The JPEG and TIFF decoders need to be taught how to read EXIF, XMP, or IPTC data.
-    if (shouldRespectOrientation == RespectImageOrientation)
-        notImplemented();
-
-    return m_decoder ? m_decoder->size() : IntSize();
+    return frameSizeAtIndex(0, shouldRespectOrientation);
 }
 
 IntSize ImageSource::frameSizeAtIndex(size_t index, RespectImageOrientationEnum shouldRespectOrientation) const
 {
-    // The JPEG and TIFF decoders need to be taught how to read EXIF, XMP, or IPTC data.
-    if (shouldRespectOrientation == RespectImageOrientation)
-        notImplemented();
+    if (!m_decoder)
+        return IntSize();
+
+    IntSize size = m_decoder->frameSizeAtIndex(index);
+    if ((shouldRespectOrientation == RespectImageOrientation) && m_decoder->orientation().usesWidthAsHeight())
+        return IntSize(size.height(), size.width());
 
-    return m_decoder ? m_decoder->frameSizeAtIndex(index) : IntSize();
+    return size;
 }
 
 bool ImageSource::getHotSpot(IntPoint&) const
@@ -182,9 +181,7 @@ float ImageSource::frameDurationAtIndex(size_t index)
 
 ImageOrientation ImageSource::orientationAtIndex(size_t) const
 {
-    // The JPEG and TIFF decoders need to be taught how to read EXIF, XMP, or IPTC data.
-    notImplemented();
-    return DefaultImageOrientation;
+    return m_decoder ? m_decoder->orientation() : DefaultImageOrientation;
 }
 
 bool ImageSource::frameHasAlphaAtIndex(size_t index)
diff --git a/Source/WebCore/platform/graphics/MediaPlayer.h b/Source/WebCore/platform/graphics/MediaPlayer.h
index be93e8701..bdeaaa0ab 100644
--- a/Source/WebCore/platform/graphics/MediaPlayer.h
+++ b/Source/WebCore/platform/graphics/MediaPlayer.h
@@ -193,7 +193,10 @@ public:
     virtual String mediaPlayerReferrer() const { return String(); }
     virtual String mediaPlayerUserAgent() const { return String(); }
     virtual CORSMode mediaPlayerCORSMode() const { return Unspecified; }
+    virtual void mediaPlayerEnterFullscreen() { }
     virtual void mediaPlayerExitFullscreen() { }
+    virtual bool mediaPlayerIsFullscreen() const { return false; }
+    virtual bool mediaPlayerIsFullscreenPermitted() const { return false; }
     virtual bool mediaPlayerIsVideo() const { return false; }
     virtual LayoutRect mediaPlayerContentBoxRect() const { return LayoutRect(); }
     virtual void mediaPlayerSetSize(const IntSize&) { }
diff --git a/Source/WebCore/platform/graphics/SimpleFontData.cpp b/Source/WebCore/platform/graphics/SimpleFontData.cpp
index 28fa5ab15..9e19a8298 100644
--- a/Source/WebCore/platform/graphics/SimpleFontData.cpp
+++ b/Source/WebCore/platform/graphics/SimpleFontData.cpp
@@ -41,6 +41,9 @@ using namespace std;
 
 namespace WebCore {
 
+const float smallCapsFontSizeMultiplier = 0.7f;
+const float emphasisMarkFontSizeMultiplier = 0.5f;
+
 SimpleFontData::SimpleFontData(const FontPlatformData& platformData, bool isCustomFont, bool isLoading, bool isTextOrientationFallback)
     : m_maxCharWidth(-1)
     , m_avgCharWidth(-1)
@@ -193,6 +196,26 @@ PassRefPtr<SimpleFontData> SimpleFontData::uprightOrientationFontData() const
     return m_derivedFontData->uprightOrientation;
 }
 
+PassRefPtr<SimpleFontData> SimpleFontData::smallCapsFontData(const FontDescription& fontDescription) const
+{
+    if (!m_derivedFontData)
+        m_derivedFontData = DerivedFontData::create(isCustomFont());
+    if (!m_derivedFontData->smallCaps)
+        m_derivedFontData->smallCaps = createScaledFontData(fontDescription, smallCapsFontSizeMultiplier);
+
+    return m_derivedFontData->smallCaps;
+}
+
+PassRefPtr<SimpleFontData> SimpleFontData::emphasisMarkFontData(const FontDescription& fontDescription) const
+{
+    if (!m_derivedFontData)
+        m_derivedFontData = DerivedFontData::create(isCustomFont());
+    if (!m_derivedFontData->emphasisMark)
+        m_derivedFontData->emphasisMark = createScaledFontData(fontDescription, emphasisMarkFontSizeMultiplier);
+
+    return m_derivedFontData->emphasisMark;
+}
+
 PassRefPtr<SimpleFontData> SimpleFontData::brokenIdeographFontData() const
 {
     if (!m_derivedFontData)
diff --git a/Source/WebCore/platform/graphics/TiledBacking.h b/Source/WebCore/platform/graphics/TiledBacking.h
index 4108f122b..5187bdd4a 100644
--- a/Source/WebCore/platform/graphics/TiledBacking.h
+++ b/Source/WebCore/platform/graphics/TiledBacking.h
@@ -43,6 +43,7 @@ public:
         CoverageForVisibleArea = 0,
         CoverageForVerticalScrolling = 1 << 0,
         CoverageForHorizontalScrolling = 1 << 1,
+        CoverageForSlowScrolling = 1 << 2, // Indicates that we expect to paint a lot on scrolling.
         CoverageForScrolling = CoverageForVerticalScrolling | CoverageForHorizontalScrolling
     };
     typedef unsigned TileCoverage;
@@ -50,10 +51,16 @@ public:
     virtual void setTileCoverage(TileCoverage) = 0;
     virtual TileCoverage tileCoverage() const = 0;
 
+    virtual IntSize tileSize() const = 0;
+
     virtual void forceRepaint() = 0;
 
     virtual void setScrollingPerformanceLoggingEnabled(bool) = 0;
     virtual bool scrollingPerformanceLoggingEnabled() const = 0;
+    
+    // Exposed for testing
+    virtual IntRect tileCoverageRect() const = 0;
+
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm b/Source/WebCore/platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm
index 5d9ddd9cb..c16e8d062 100644
--- a/Source/WebCore/platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm
+++ b/Source/WebCore/platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm
@@ -1089,7 +1089,10 @@ MediaPlayer::MediaKeyException MediaPlayerPrivateAVFoundationObjC::addKey(const
 
     RetainPtr<AVAssetResourceLoadingRequest> avRequest = m_sessionIDToRequestMap.get(sessionID);
     RetainPtr<NSData> keyData = adoptNS([[NSData alloc] initWithBytes:keyPtr length:keyLength]);
+#pragma clang diagnostic push
+#pragma clang diagnostic ignored "-Wdeprecated-declarations"
     [avRequest.get() finishLoadingWithResponse:nil data:keyData.get() redirect:nil];
+#pragma clang diagnostic pop
     m_sessionIDToRequestMap.remove(sessionID);
 
     player()->keyAdded(keySystem, sessionID);
diff --git a/Source/WebCore/platform/graphics/blackberry/GraphicsLayerBlackBerry.cpp b/Source/WebCore/platform/graphics/blackberry/GraphicsLayerBlackBerry.cpp
index c1a703acd..12fc69df8 100644
--- a/Source/WebCore/platform/graphics/blackberry/GraphicsLayerBlackBerry.cpp
+++ b/Source/WebCore/platform/graphics/blackberry/GraphicsLayerBlackBerry.cpp
@@ -379,20 +379,26 @@ void GraphicsLayerBlackBerry::setOpacity(float opacity)
 
 void GraphicsLayerBlackBerry::setContentsNeedsDisplay()
 {
-    if (m_contentsLayer)
+    if (m_contentsLayer) {
         m_contentsLayer->setNeedsDisplay();
+        addRepaintRect(contentsRect());
+    }
 }
 
 void GraphicsLayerBlackBerry::setNeedsDisplay()
 {
-    if (drawsContent())
+    if (drawsContent()) {
         m_layer->setNeedsDisplay();
+        addRepaintRect(FloatRect(FloatPoint(), m_size));
+    }
 }
 
 void GraphicsLayerBlackBerry::setNeedsDisplayInRect(const FloatRect& rect)
 {
-    if (drawsContent())
+    if (drawsContent()) {
         m_layer->setNeedsDisplayInRect(rect);
+        addRepaintRect(rect);
+    }
 }
 
 void GraphicsLayerBlackBerry::setContentsRect(const IntRect& rect)
diff --git a/Source/WebCore/platform/graphics/blackberry/ImageBlackBerry.cpp b/Source/WebCore/platform/graphics/blackberry/ImageBlackBerry.cpp
index 8793298d1..07da9915e 100644
--- a/Source/WebCore/platform/graphics/blackberry/ImageBlackBerry.cpp
+++ b/Source/WebCore/platform/graphics/blackberry/ImageBlackBerry.cpp
@@ -23,17 +23,20 @@
 #include "ImageBuffer.h"
 #include "SharedBuffer.h"
 
+#include <BlackBerryPlatformResourceStore.h>
+
+using BlackBerry::Platform::ResourceData;
+using BlackBerry::Platform::ResourceStore;
+
 namespace WebCore {
 
 PassRefPtr<Image> Image::loadPlatformResource(const char *name)
 {
-    // RESOURCE_PATH is set by CMake in OptionsBlackBerry.cmake
-    String fullPath(RESOURCE_PATH);
-    String extension(".png");
-
-    fullPath = fullPath + name + extension;
+    ResourceData data = ResourceStore::instance()->requestResource(BlackBerry::Platform::String(name));
+    if (!data.data())
+        return BitmapImage::nullImage();
 
-    RefPtr<SharedBuffer> buffer = SharedBuffer::createWithContentsOfFile(fullPath);
+    RefPtr<SharedBuffer> buffer = SharedBuffer::create(data.data(), data.len());
     if (!buffer)
         return BitmapImage::nullImage();
 
diff --git a/Source/WebCore/platform/graphics/blackberry/LayerRenderer.cpp b/Source/WebCore/platform/graphics/blackberry/LayerRenderer.cpp
index 4fd63cedd..ff86f38e1 100644
--- a/Source/WebCore/platform/graphics/blackberry/LayerRenderer.cpp
+++ b/Source/WebCore/platform/graphics/blackberry/LayerRenderer.cpp
@@ -47,8 +47,6 @@
 #include <wtf/text/CString.h>
 #include <wtf/text/WTFString.h>
 
-#define ENABLE_SCISSOR 1
-
 #define DEBUG_LAYER_ANIMATIONS 0 // Show running animations as green.
 #define DEBUG_CLIPPING 0
 
@@ -159,6 +157,7 @@ LayerRenderer::LayerRenderer(GLES2Context* context)
     , m_context(context)
     , m_isRobustnessSupported(false)
     , m_needsCommit(false)
+    , m_stencilCleared(false)
 {
     if (makeContextCurrent()) {
         m_isRobustnessSupported = String(reinterpret_cast<const char*>(::glGetString(GL_EXTENSIONS))).contains("GL_EXT_robustness");
@@ -279,7 +278,7 @@ void LayerRenderer::setViewport(const IntRect& targetRect, const IntRect& clipRe
     glActiveTexture(GL_TEXTURE0);
     glDisable(GL_DEPTH_TEST);
     glDisable(GL_CULL_FACE);
-    glEnable(GL_STENCIL_TEST);
+    glDisable(GL_STENCIL_TEST);
 
     // If culling is enabled then we will cull the backface.
     glCullFace(GL_BACK);
@@ -300,21 +299,18 @@ void LayerRenderer::setViewport(const IntRect& targetRect, const IntRect& clipRe
 
     glViewport(m_viewport.x(), m_viewport.y(), m_viewport.width(), m_viewport.height());
 
-#if ENABLE_SCISSOR
     glEnable(GL_SCISSOR_TEST);
 #if DEBUG_CLIPPING
     printf("LayerRenderer::compositeLayers(): clipping to (%d,%d %dx%d)\n", m_scissorRect.x(), m_scissorRect.y(), m_scissorRect.width(), m_scissorRect.height());
     fflush(stdout);
 #endif
     glScissor(m_scissorRect.x(), m_scissorRect.y(), m_scissorRect.width(), m_scissorRect.height());
-#endif
 
-    glClearStencil(0);
-    glClearColor(0, 0, 0, 0);
-    GLenum buffersToClear = GL_STENCIL_BUFFER_BIT;
-    if (m_clearSurfaceOnDrawLayers)
-        buffersToClear |= GL_COLOR_BUFFER_BIT;
-    glClear(buffersToClear);
+    if (m_clearSurfaceOnDrawLayers) {
+        glClearColor(0, 0, 0, 0);
+        glClear(GL_COLOR_BUFFER_BIT);
+    }
+    m_stencilCleared = false;
 }
 
 void LayerRenderer::compositeLayers(const TransformationMatrix& matrix, LayerCompositingThread* rootLayer)
@@ -378,9 +374,7 @@ void LayerRenderer::compositeLayers(const TransformationMatrix& matrix, LayerCom
 
     m_context->swapBuffers();
 
-#if ENABLE_SCISSOR
     glDisable(GL_SCISSOR_TEST);
-#endif
     glDisable(GL_STENCIL_TEST);
 
     // PR 147254, the EGL implementation crashes when the last bound texture
@@ -523,10 +517,8 @@ void LayerRenderer::drawLayersOnSurfaces(const Vector<RefPtr<LayerCompositingThr
     // Otherwise, we just need to set viewport.
     if (surfaceLayers.size()) {
         useSurface(0);
-#if ENABLE_SCISSOR
         glEnable(GL_SCISSOR_TEST);
         glScissor(m_scissorRect.x(), m_scissorRect.y(), m_scissorRect.width(), m_scissorRect.height());
-#endif
     }
 }
 
@@ -851,9 +843,6 @@ void LayerRenderer::compositeLayersRecursive(LayerCompositingThread* layer, int
 
     layer->setVisible(layerVisible);
 
-    glStencilFunc(GL_EQUAL, stencilValue, 0xff);
-    glStencilOp(GL_KEEP, GL_KEEP, GL_KEEP);
-
     // Note that there are two types of layers:
     // 1. Layers that have their own GraphicsContext and can draw their contents on demand (layer->drawsContent() == true).
     // 2. Layers that are just containers of images/video/etc that don't own a GraphicsContext (layer->contents() == true).
@@ -861,6 +850,11 @@ void LayerRenderer::compositeLayersRecursive(LayerCompositingThread* layer, int
     if ((layer->needsTexture() || layer->layerRendererSurface()) && layerVisible) {
         updateScissorIfNeeded(clipRect);
 
+        if (stencilValue) {
+            glStencilFunc(GL_EQUAL, stencilValue, 0xff);
+            glStencilOp(GL_KEEP, GL_KEEP, GL_KEEP);
+        }
+
         if (layer->doubleSided())
             glDisable(GL_CULL_FACE);
         else
@@ -918,13 +912,16 @@ void LayerRenderer::compositeLayersRecursive(LayerCompositingThread* layer, int
 
     // If we need to mask to bounds but the transformation has a rotational component
     // to it, scissoring is not enough and we need to use the stencil buffer for clipping.
-#if ENABLE_SCISSOR
     bool stencilClip = layer->masksToBounds() && hasRotationalComponent(layer->drawTransform());
-#else
-    bool stencilClip = layer->masksToBounds();
-#endif
 
     if (stencilClip) {
+        if (!m_stencilCleared) {
+            glClearStencil(0);
+            glClear(GL_STENCIL_BUFFER_BIT);
+            m_stencilCleared = true;
+        }
+
+        glEnable(GL_STENCIL_TEST);
         glStencilFunc(GL_EQUAL, stencilValue, 0xff);
         glStencilOp(GL_KEEP, GL_INCR, GL_INCR);
 
@@ -977,12 +974,14 @@ void LayerRenderer::compositeLayersRecursive(LayerCompositingThread* layer, int
         glVertexAttribPointer(0, 2, GL_FLOAT, GL_FALSE, 0, &layer->getTransformedBounds());
         glDrawArrays(GL_TRIANGLE_FAN, 0, 4);
         glColorMask(GL_TRUE, GL_TRUE, GL_TRUE, GL_TRUE);
+
+        if (!stencilValue)
+            glDisable(GL_STENCIL_TEST);
     }
 }
 
 void LayerRenderer::updateScissorIfNeeded(const FloatRect& clipRect)
 {
-#if ENABLE_SCISSOR
 #if DEBUG_CLIPPING
     printf("LayerRenderer::updateScissorIfNeeded(): clipRect=(%.2f,%.2f %.2fx%.2f)\n", clipRect.x(), clipRect.y(), clipRect.width(), clipRect.height());
     fflush(stdout);
@@ -997,7 +996,6 @@ void LayerRenderer::updateScissorIfNeeded(const FloatRect& clipRect)
     fflush(stdout);
 #endif
     glScissor(m_scissorRect.x(), m_scissorRect.y(), m_scissorRect.width(), m_scissorRect.height());
-#endif
 }
 
 bool LayerRenderer::makeContextCurrent()
diff --git a/Source/WebCore/platform/graphics/blackberry/LayerRenderer.h b/Source/WebCore/platform/graphics/blackberry/LayerRenderer.h
index 353b7eca8..671c4a18d 100644
--- a/Source/WebCore/platform/graphics/blackberry/LayerRenderer.h
+++ b/Source/WebCore/platform/graphics/blackberry/LayerRenderer.h
@@ -212,6 +212,7 @@ private:
 
     LayerRenderingResults m_lastRenderingResults;
     bool m_needsCommit;
+    bool m_stencilCleared;
 };
 
 }
diff --git a/Source/WebCore/platform/graphics/blackberry/LayerWebKitThread.cpp b/Source/WebCore/platform/graphics/blackberry/LayerWebKitThread.cpp
index 142991cf5..5c0375356 100644
--- a/Source/WebCore/platform/graphics/blackberry/LayerWebKitThread.cpp
+++ b/Source/WebCore/platform/graphics/blackberry/LayerWebKitThread.cpp
@@ -417,6 +417,7 @@ bool LayerWebKitThread::filtersCanBeComposited(const FilterOperations& filters)
         case FilterOperation::REFERENCE:
 #if ENABLE(CSS_SHADERS)
         case FilterOperation::CUSTOM:
+        case FilterOperation::VALIDATED_CUSTOM:
 #endif
             return false;
         default:
diff --git a/Source/WebCore/platform/graphics/blackberry/MediaPlayerPrivateBlackBerry.cpp b/Source/WebCore/platform/graphics/blackberry/MediaPlayerPrivateBlackBerry.cpp
index ea3c89550..7a9e484b5 100644
--- a/Source/WebCore/platform/graphics/blackberry/MediaPlayerPrivateBlackBerry.cpp
+++ b/Source/WebCore/platform/graphics/blackberry/MediaPlayerPrivateBlackBerry.cpp
@@ -39,6 +39,7 @@
 #include "TimeRanges.h"
 #include "WebPageClient.h"
 
+#include <BlackBerryPlatformDeviceInfo.h>
 #include <BlackBerryPlatformSettings.h>
 #include <FrameLoaderClientBlackBerry.h>
 #include <set>
@@ -113,6 +114,7 @@ MediaPlayerPrivate::MediaPlayerPrivate(MediaPlayer* player)
 #endif
     , m_userDrivenSeekTimer(this, &MediaPlayerPrivate::userDrivenSeekTimerFired)
     , m_lastSeekTime(0)
+    , m_lastLoadingTime(0)
     , m_lastSeekTimePending(false)
     , m_isAuthenticationChallenging(false)
     , m_waitMetadataTimer(this, &MediaPlayerPrivate::waitMetadataTimerFired)
@@ -187,8 +189,11 @@ void MediaPlayerPrivate::prepareToPlay()
 
 void MediaPlayerPrivate::play()
 {
-    if (m_platformPlayer)
+    if (m_platformPlayer) {
         m_platformPlayer->play();
+        if (m_platformPlayer->isMetadataReady())
+            conditionallyGoFullscreenAfterPlay();
+    }
 }
 
 void MediaPlayerPrivate::pause()
@@ -336,8 +341,15 @@ PassRefPtr<TimeRanges> MediaPlayerPrivate::buffered() const
 
 bool MediaPlayerPrivate::didLoadingProgress() const
 {
-    notImplemented();
-    return false;
+    if (!m_platformPlayer)
+        return false;
+
+    float bufferLoaded = m_platformPlayer->bufferLoaded();
+    if (bufferLoaded == m_lastLoadingTime)
+        return false;
+
+    m_lastLoadingTime = bufferLoaded;
+    return true;
 }
 
 void MediaPlayerPrivate::setSize(const IntSize&)
@@ -663,6 +675,7 @@ void MediaPlayerPrivate::waitMetadataTimerFired(Timer<MediaPlayerPrivate>*)
 {
     if (m_platformPlayer->isMetadataReady()) {
         m_platformPlayer->playWithMetadataReady();
+        conditionallyGoFullscreenAfterPlay();
         m_waitMetadataPopDialogCounter = 0;
         return;
     }
@@ -679,9 +692,10 @@ void MediaPlayerPrivate::waitMetadataTimerFired(Timer<MediaPlayerPrivate>*)
     if (!wait)
         onPauseNotified();
     else {
-        if (m_platformPlayer->isMetadataReady())
+        if (m_platformPlayer->isMetadataReady()) {
             m_platformPlayer->playWithMetadataReady();
-        else
+            conditionallyGoFullscreenAfterPlay();
+        } else
             m_waitMetadataTimer.startOneShot(checkMetadataReadyInterval);
     }
 }
@@ -963,6 +977,29 @@ void MediaPlayerPrivate::drawBufferingAnimation(const TransformationMatrix& matr
 }
 #endif
 
+void MediaPlayerPrivate::conditionallyGoFullscreenAfterPlay()
+{
+    BlackBerry::Platform::DeviceInfo* info = BlackBerry::Platform::DeviceInfo::instance();
+    if (hasVideo() && m_webCorePlayer->mediaPlayerClient()->mediaPlayerIsFullscreenPermitted() && info->isMobile()) {
+        // This is a mobile device (small screen), not a tablet, so we
+        // enter fullscreen video on user-initiated plays.
+        bool nothingIsFullscreen = !m_webCorePlayer->mediaPlayerClient()->mediaPlayerIsFullscreen();
+#if ENABLE(FULLSCREEN_API)
+        if (m_webCorePlayer->mediaPlayerClient()->mediaPlayerOwningDocument()->webkitIsFullScreen())
+            nothingIsFullscreen = false;
+#endif
+        if (nothingIsFullscreen && currentTime() == 0.0f) {
+            // Only enter fullscreen when playing from the beginning. Doing
+            // so on every play is sure to annoy the user who does not want
+            // to watch the video fullscreen. Note that the following call
+            // will fail if we are not here due to a user gesture, as per the
+            // check in Document::requestFullScreenForElement() to prevent
+            // popups.
+            m_webCorePlayer->mediaPlayerClient()->mediaPlayerEnterFullscreen();
+        }
+    }
+}
+
 } // namespace WebCore
 
 #endif // ENABLE(VIDEO)
diff --git a/Source/WebCore/platform/graphics/blackberry/MediaPlayerPrivateBlackBerry.h b/Source/WebCore/platform/graphics/blackberry/MediaPlayerPrivateBlackBerry.h
index 7b6654dce..c055abc5e 100644
--- a/Source/WebCore/platform/graphics/blackberry/MediaPlayerPrivateBlackBerry.h
+++ b/Source/WebCore/platform/graphics/blackberry/MediaPlayerPrivateBlackBerry.h
@@ -170,9 +170,11 @@ private:
     bool m_mediaIsBuffering;
 #endif
 
+    void conditionallyGoFullscreenAfterPlay();
     void userDrivenSeekTimerFired(Timer<MediaPlayerPrivate>*);
     Timer<MediaPlayerPrivate> m_userDrivenSeekTimer;
     float m_lastSeekTime;
+    mutable float m_lastLoadingTime;
     bool m_lastSeekTimePending;
     bool m_isAuthenticationChallenging;
     void waitMetadataTimerFired(Timer<MediaPlayerPrivate>*);
diff --git a/Source/WebCore/platform/graphics/ca/GraphicsLayerCA.cpp b/Source/WebCore/platform/graphics/ca/GraphicsLayerCA.cpp
index a74bb1cd0..e36b5e707 100644
--- a/Source/WebCore/platform/graphics/ca/GraphicsLayerCA.cpp
+++ b/Source/WebCore/platform/graphics/ca/GraphicsLayerCA.cpp
@@ -286,8 +286,6 @@ GraphicsLayerCA::GraphicsLayerCA(GraphicsLayerClient* client)
     }
 
     m_layer = PlatformCALayer::create(layerType, this);
-
-    updateDebugIndicators();
     noteLayerPropertyChanged(ContentsScaleChanged);
 }
 
@@ -520,7 +518,7 @@ void GraphicsLayerCA::setMasksToBounds(bool masksToBounds)
         return;
 
     GraphicsLayer::setMasksToBounds(masksToBounds);
-    noteLayerPropertyChanged(MasksToBoundsChanged);
+    noteLayerPropertyChanged(MasksToBoundsChanged | DebugIndicatorsChanged);
 }
 
 void GraphicsLayerCA::setDrawsContent(bool drawsContent)
@@ -529,7 +527,7 @@ void GraphicsLayerCA::setDrawsContent(bool drawsContent)
         return;
 
     GraphicsLayer::setDrawsContent(drawsContent);
-    noteLayerPropertyChanged(DrawsContentChanged);
+    noteLayerPropertyChanged(DrawsContentChanged | DebugIndicatorsChanged);
 }
 
 void GraphicsLayerCA::setContentsVisible(bool contentsVisible)
@@ -670,6 +668,8 @@ void GraphicsLayerCA::setNeedsDisplayInRect(const FloatRect& r)
         m_dirtyRects[0].unite(rect);
 
     noteLayerPropertyChanged(DirtyRectsChanged);
+
+    addRepaintRect(rect);
 }
 
 void GraphicsLayerCA::setContentsNeedsDisplay()
@@ -910,7 +910,7 @@ void GraphicsLayerCA::flushCompositingStateForThisLayerOnly()
     commitLayerChangesAfterSublayers();
 }
 
-TiledBacking* GraphicsLayerCA::tiledBacking()
+TiledBacking* GraphicsLayerCA::tiledBacking() const
 {
     return m_layer->tiledBacking();
 }
@@ -943,11 +943,14 @@ FloatRect GraphicsLayerCA::computeVisibleRect(TransformState& state) const
         }
     }
 
-    state.applyTransform(layerTransform, accumulation);
+    bool applyWasClamped;
+    state.applyTransform(layerTransform, accumulation, &applyWasClamped);
     
-    FloatRect clipRectForChildren = state.mappedQuad().boundingBox();
+    bool mapWasClamped;
+    FloatRect clipRectForChildren = state.mappedQuad(&mapWasClamped).boundingBox();
     FloatRect clipRectForSelf(0, 0, m_size.width(), m_size.height());
-    clipRectForSelf.intersect(clipRectForChildren);
+    if (!applyWasClamped && !mapWasClamped)
+        clipRectForSelf.intersect(clipRectForChildren);
     
     if (masksToBounds()) {
         ASSERT(accumulation == TransformState::FlattenTransform);
@@ -1039,7 +1042,7 @@ bool GraphicsLayerCA::platformCALayerShowRepaintCounter(PlatformCALayer* platfor
     if (m_isPageTileCacheLayer && platformLayer)
         return false;
     
-    return showRepaintCounter();
+    return isShowingRepaintCounter();
 }
 
 void GraphicsLayerCA::platformCALayerPaintContents(GraphicsContext& context, const IntRect& clip)
@@ -1146,6 +1149,9 @@ void GraphicsLayerCA::commitLayerChangesBeforeSublayers(float pageScaleFactor, c
     if (m_uncommittedChanges & AcceleratesDrawingChanged)
         updateAcceleratesDrawing();
 
+    if (m_uncommittedChanges & DebugIndicatorsChanged)
+        updateDebugBorder();
+
     if (m_uncommittedChanges & ChildrenChanged) {
         updateSublayerList();
         // Sublayers may set this flag again, so clear it to avoid always updating sublayers in commitLayerChangesAfterSublayers().
@@ -1184,54 +1190,47 @@ void GraphicsLayerCA::updateLayerNames()
 
 void GraphicsLayerCA::updateSublayerList()
 {
-    PlatformCALayerList newSublayers;
-    const Vector<GraphicsLayer*>& childLayers = children();
+    const PlatformCALayerList* customSublayers = m_layer->customSublayers();
 
-    if (const PlatformCALayerList* customSublayers = m_layer->customSublayers())
-        newSublayers.appendRange(customSublayers->begin(), customSublayers->end());
+    PlatformCALayerList structuralLayerChildren;
+    PlatformCALayerList primaryLayerChildren;
+
+    PlatformCALayerList& childListForSublayers = m_structuralLayer ? structuralLayerChildren : primaryLayerChildren;
+
+    if (customSublayers)
+        primaryLayerChildren.append(*customSublayers);
+
+    if (m_structuralLayer) {
+        if (m_replicaLayer)
+            structuralLayerChildren.append(static_cast<GraphicsLayerCA*>(m_replicaLayer)->primaryLayer());
     
-    if (m_structuralLayer || m_contentsLayer || childLayers.size() > 0) {
-        if (m_structuralLayer) {
-            // Add the replica layer first.
-            if (m_replicaLayer)
-                newSublayers.append(static_cast<GraphicsLayerCA*>(m_replicaLayer)->primaryLayer());
-            // Add the primary layer. Even if we have negative z-order children, the primary layer always comes behind.
-            newSublayers.append(m_layer);
-        } else if (m_contentsLayer && m_contentsVisible) {
-            // FIXME: add the contents layer in the correct order with negative z-order children.
-            // This does not cause visible rendering issues because currently contents layers are only used
-            // for replaced elements that don't have children.
-            newSublayers.append(m_contentsLayer);
-        }
-        
-        size_t numChildren = childLayers.size();
-        for (size_t i = 0; i < numChildren; ++i) {
-            GraphicsLayerCA* curChild = static_cast<GraphicsLayerCA*>(childLayers[i]);
-            PlatformCALayer* childLayer = curChild->layerForSuperlayer();
-            newSublayers.append(childLayer);
-        }
+        structuralLayerChildren.append(m_layer);
+    }
 
-        for (size_t i = 0; i < newSublayers.size(); --i)
-            newSublayers[i]->removeFromSuperlayer();
+    if (m_contentsLayer && m_contentsVisible) {
+        // FIXME: add the contents layer in the correct order with negative z-order children.
+        // This does not cause visible rendering issues because currently contents layers are only used
+        // for replaced elements that don't have children.
+        primaryLayerChildren.append(m_contentsLayer);
     }
     
+    const Vector<GraphicsLayer*>& childLayers = children();
+    size_t numChildren = childLayers.size();
+    for (size_t i = 0; i < numChildren; ++i) {
+        GraphicsLayerCA* curChild = static_cast<GraphicsLayerCA*>(childLayers[i]);
+        PlatformCALayer* childLayer = curChild->layerForSuperlayer();
+        childListForSublayers.append(childLayer);
+    }
+
 #ifdef VISIBLE_TILE_WASH
     if (m_visibleTileWashLayer)
-        newSublayers.append(m_visibleTileWashLayer);
+        childListForSublayers.append(m_visibleTileWashLayer);
 #endif
 
-    if (m_structuralLayer) {
-        m_structuralLayer->setSublayers(newSublayers);
-
-        if (m_contentsLayer) {
-            // If we have a transform layer, then the contents layer is parented in the 
-            // primary layer (which is itself a child of the transform layer).
-            m_layer->removeAllSublayers();
-            if (m_contentsVisible)
-                m_layer->appendSublayer(m_contentsLayer.get());
-        }
-    } else
-        m_layer->setSublayers(newSublayers);
+    if (m_structuralLayer)
+        m_structuralLayer->setSublayers(structuralLayerChildren);
+    
+    m_layer->setSublayers(primaryLayerChildren);
 }
 
 void GraphicsLayerCA::updateGeometry(float pageScaleFactor, const FloatPoint& positionRelativeToBase)
@@ -1345,8 +1344,6 @@ void GraphicsLayerCA::updateMasksToBounds()
         for (LayerMap::const_iterator it = layerCloneMap->begin(); it != end; ++it)
             it->value->setMasksToBounds(m_masksToBounds);
     }
-
-    updateDebugIndicators();
 }
 
 void GraphicsLayerCA::updateContentsVisibility()
@@ -1356,7 +1353,7 @@ void GraphicsLayerCA::updateContentsVisibility()
         if (m_drawsContent)
             m_layer->setNeedsDisplay();
     } else {
-        m_layer.get()->setContents(0);
+        m_layer->setContents(0);
 
         if (LayerMap* layerCloneMap = m_layerClones.get()) {
             LayerMap::const_iterator end = layerCloneMap->end();
@@ -1368,7 +1365,7 @@ void GraphicsLayerCA::updateContentsVisibility()
 
 void GraphicsLayerCA::updateContentsOpaque()
 {
-    m_layer.get()->setOpaque(m_contentsOpaque);
+    m_layer->setOpaque(m_contentsOpaque);
 
     if (LayerMap* layerCloneMap = m_layerClones.get()) {
         LayerMap::const_iterator end = layerCloneMap->end();
@@ -1401,9 +1398,9 @@ void GraphicsLayerCA::updateBackfaceVisibility()
 #if ENABLE(CSS_FILTERS)
 void GraphicsLayerCA::updateFilters()
 {
-    primaryLayer()->setFilters(m_filters);
+    m_layer->setFilters(m_filters);
 
-    if (LayerMap* layerCloneMap = primaryLayerClones()) {
+    if (LayerMap* layerCloneMap = m_layerClones.get()) {
         LayerMap::const_iterator end = layerCloneMap->end();
         for (LayerMap::const_iterator it = layerCloneMap->begin(); it != end; ++it) {
             if (m_replicaLayer && isReplicatedRootClone(it->key))
@@ -1530,7 +1527,6 @@ void GraphicsLayerCA::updateLayerDrawsContent(float pageScaleFactor, const Float
                 it->value->setContents(0);
         }
     }
-    updateDebugIndicators();
 }
 
 void GraphicsLayerCA::updateAcceleratesDrawing()
@@ -1538,6 +1534,14 @@ void GraphicsLayerCA::updateAcceleratesDrawing()
     m_layer->setAcceleratesDrawing(m_acceleratesDrawing);
 }
 
+void GraphicsLayerCA::updateDebugBorder()
+{
+    if (isShowingDebugBorder())
+        updateDebugIndicators();
+    else
+        m_layer->setBorderWidth(0);
+}
+
 FloatRect GraphicsLayerCA::adjustTiledLayerVisibleRect(TiledBacking* tiledBacking, const FloatRect& oldVisibleRect, const FloatSize& oldSize) const
 {
     // If the old visible rect is empty, we have no information about how the visible area is changing
@@ -1600,10 +1604,13 @@ FloatRect GraphicsLayerCA::adjustTiledLayerVisibleRect(TiledBacking* tiledBackin
 
 void GraphicsLayerCA::updateVisibleRect(const FloatRect& oldVisibleRect)
 {
-    if (m_layer->layerType() != PlatformCALayer::LayerTypeTileCacheLayer)
+    if (!m_layer->usesTileCacheLayer())
         return;
 
-    FloatRect tileArea = adjustTiledLayerVisibleRect(tiledBacking(), oldVisibleRect, m_sizeAtLastVisibleRectUpdate);
+    FloatRect tileArea = m_visibleRect;
+    if (m_layer->layerType() == PlatformCALayer::LayerTypeTileCacheLayer)
+        tileArea = adjustTiledLayerVisibleRect(tiledBacking(), oldVisibleRect, m_sizeAtLastVisibleRectUpdate);
+
     tiledBacking()->setVisibleRect(enclosingIntRect(tileArea));
 
     m_sizeAtLastVisibleRectUpdate = m_size;
@@ -2497,6 +2504,24 @@ void GraphicsLayerCA::updateContentsScale(float pageScaleFactor, const FloatPoin
         m_layer->setNeedsDisplay();
 }
 
+void GraphicsLayerCA::setShowDebugBorder(bool showBorder)
+{
+    if (showBorder == m_showDebugBorder)
+        return;
+
+    GraphicsLayer::setShowDebugBorder(showBorder);
+    noteLayerPropertyChanged(DebugIndicatorsChanged);
+}
+
+void GraphicsLayerCA::setShowRepaintCounter(bool showCounter)
+{
+    if (showCounter == m_showRepaintCounter)
+        return;
+
+    GraphicsLayer::setShowRepaintCounter(showCounter);
+    noteLayerPropertyChanged(DebugIndicatorsChanged);
+}
+
 void GraphicsLayerCA::setDebugBackgroundColor(const Color& color)
 {    
     if (color.isValid())
@@ -2522,6 +2547,16 @@ void GraphicsLayerCA::dumpAdditionalProperties(TextStream& textStream, int inden
         writeIndent(textStream, indent + 1);
         textStream << "(visible rect " << m_visibleRect.x() << ", " << m_visibleRect.y() << " " << m_visibleRect.width() << " x " << m_visibleRect.height() << ")\n";
     }
+
+    if (tiledBacking() && (behavior & LayerTreeAsTextIncludeTileCaches)) {
+        IntRect tileCoverageRect = tiledBacking()->tileCoverageRect();
+        writeIndent(textStream, indent + 1);
+        textStream << "(tile cache coverage " << tileCoverageRect.x() << ", " << tileCoverageRect.y() << " " << tileCoverageRect.width() << " x " << tileCoverageRect.height() << ")\n";
+
+        IntSize tileSize = tiledBacking()->tileSize();
+        writeIndent(textStream, indent + 1);
+        textStream << "(tile size " << tileSize.width() << " x " << tileSize.height() << ")\n";
+    }
 }
 
 void GraphicsLayerCA::setDebugBorder(const Color& color, float borderWidth)
@@ -2600,10 +2635,9 @@ void GraphicsLayerCA::swapFromOrToTiledLayer(bool useTiledLayer, float /*pageSca
         | BackgroundColorChanged
         | ContentsScaleChanged
         | AcceleratesDrawingChanged
-#if ENABLE(CSS_FILTERS)
         | FiltersChanged
-#endif
-        | OpacityChanged;
+        | OpacityChanged
+        | DebugIndicatorsChanged;
     
 #ifndef NDEBUG
     String name = String::format("%sCALayer(%p) GraphicsLayer(%p) ", (m_layer->layerType() == PlatformCALayer::LayerTypeWebTiledLayer) ? "Tiled " : "", m_layer->platformLayer(), this) + m_name;
@@ -2615,8 +2649,6 @@ void GraphicsLayerCA::swapFromOrToTiledLayer(bool useTiledLayer, float /*pageSca
     
     // need to tell new layer to draw itself
     setNeedsDisplay();
-    
-    updateDebugIndicators();
 }
 
 GraphicsLayer::CompositingCoordinatesOrientation GraphicsLayerCA::defaultContentsOrientation() const
@@ -2640,7 +2672,7 @@ void GraphicsLayerCA::setupContentsLayer(PlatformCALayer* contentsLayer)
     } else
         contentsLayer->setAnchorPoint(FloatPoint3D());
 
-    if (showDebugBorders()) {
+    if (isShowingDebugBorder()) {
         contentsLayer->setBorderColor(Color(0, 0, 128, 180));
         contentsLayer->setBorderWidth(1.0f);
     }
@@ -2828,13 +2860,14 @@ PassRefPtr<PlatformCALayer> GraphicsLayerCA::cloneLayer(PlatformCALayer *layer,
     newLayer->setOpaque(layer->isOpaque());
     newLayer->setBackgroundColor(layer->backgroundColor());
     newLayer->setContentsScale(layer->contentsScale());
+    newLayer->copyFiltersFrom(layer);
 
     if (cloneLevel == IntermediateCloneLevel) {
         newLayer->setOpacity(layer->opacity());
         moveOrCopyAnimations(Copy, layer, newLayer.get());
     }
     
-    if (showDebugBorders()) {
+    if (isShowingDebugBorder()) {
         newLayer->setBorderColor(Color(255, 122, 251));
         newLayer->setBorderWidth(2);
     }
diff --git a/Source/WebCore/platform/graphics/ca/GraphicsLayerCA.h b/Source/WebCore/platform/graphics/ca/GraphicsLayerCA.h
index c6b210e5b..2deb2e28c 100644
--- a/Source/WebCore/platform/graphics/ca/GraphicsLayerCA.h
+++ b/Source/WebCore/platform/graphics/ca/GraphicsLayerCA.h
@@ -121,6 +121,9 @@ public:
 
     virtual bool hasContentsLayer() const { return m_contentsLayer; }
     
+    virtual void setShowDebugBorder(bool) OVERRIDE;
+    virtual void setShowRepaintCounter(bool) OVERRIDE;
+
     virtual void setDebugBackgroundColor(const Color&);
     virtual void setDebugBorder(const Color&, float borderWidth);
 
@@ -134,7 +137,7 @@ public:
     virtual void flushCompositingState(const FloatRect&);
     virtual void flushCompositingStateForThisLayerOnly();
 
-    virtual TiledBacking* tiledBacking() OVERRIDE;
+    virtual TiledBacking* tiledBacking() const OVERRIDE;
 
     bool allowTiledLayer() const { return m_allowTiledLayer; }
     virtual void setAllowTiledLayer(bool b);
@@ -152,7 +155,7 @@ private:
     virtual void platformCALayerAnimationStarted(CFTimeInterval beginTime);
     virtual CompositingCoordinatesOrientation platformCALayerContentsOrientation() const { return contentsOrientation(); }
     virtual void platformCALayerPaintContents(GraphicsContext&, const IntRect& clip);
-    virtual bool platformCALayerShowDebugBorders() const { return showDebugBorders(); }
+    virtual bool platformCALayerShowDebugBorders() const { return isShowingDebugBorder(); }
     virtual bool platformCALayerShowRepaintCounter(PlatformCALayer*) const;
     virtual int platformCALayerIncrementRepaintCount() { return incrementRepaintCount(); }
 
@@ -326,6 +329,7 @@ private:
     void updateLayerAnimations();
     void updateContentsNeedsDisplay();
     void updateAcceleratesDrawing();
+    void updateDebugBorder();
     void updateVisibleRect(const FloatRect& oldVisibleRect);
     void updateContentsScale(float pixelAlignmentScale, const FloatPoint& positionRelativeToBase);
     
@@ -377,9 +381,8 @@ private:
         ContentsScaleChanged = 1 << 23,
         ContentsVisibilityChanged = 1 << 24,
         VisibleRectChanged = 1 << 25,
-#if ENABLE(CSS_FILTERS)
         FiltersChanged = 1 << 26,
-#endif
+        DebugIndicatorsChanged = 1 << 27
     };
     typedef unsigned LayerChangeFlags;
     void noteLayerPropertyChanged(LayerChangeFlags flags);
diff --git a/Source/WebCore/platform/graphics/ca/PlatformCALayer.h b/Source/WebCore/platform/graphics/ca/PlatformCALayer.h
index 520711681..6b0591032 100644
--- a/Source/WebCore/platform/graphics/ca/PlatformCALayer.h
+++ b/Source/WebCore/platform/graphics/ca/PlatformCALayer.h
@@ -189,6 +189,7 @@ public:
 #if ENABLE(CSS_FILTERS)
     void setFilters(const FilterOperations&);
     static bool filtersCanBeComposited(const FilterOperations&);
+    void copyFiltersFrom(const PlatformCALayer*);
 #endif
 
     String name() const;
diff --git a/Source/WebCore/platform/graphics/ca/mac/PlatformCALayerMac.mm b/Source/WebCore/platform/graphics/ca/mac/PlatformCALayerMac.mm
index 1659c4dca..408766404 100644
--- a/Source/WebCore/platform/graphics/ca/mac/PlatformCALayerMac.mm
+++ b/Source/WebCore/platform/graphics/ca/mac/PlatformCALayerMac.mm
@@ -715,7 +715,6 @@ void PlatformCALayer::setFilters(const FilterOperations& filters)
             
             [m_layer.get() setShadowRadius:op->stdDeviation()];
             [m_layer.get() setShadowOpacity:1];
-
             break;
         }
         case FilterOperation::GRAYSCALE: {
@@ -838,6 +837,13 @@ void PlatformCALayer::setFilters(const FilterOperations& filters)
     END_BLOCK_OBJC_EXCEPTIONS
 }
 
+void PlatformCALayer::copyFiltersFrom(const PlatformCALayer* sourceLayer)
+{
+    BEGIN_BLOCK_OBJC_EXCEPTIONS
+    [m_layer.get() setFilters:[sourceLayer->platformLayer() filters]];
+    END_BLOCK_OBJC_EXCEPTIONS
+}
+
 bool PlatformCALayer::filtersCanBeComposited(const FilterOperations& filters)
 {
     // Return false if there are no filters to avoid needless work
@@ -850,6 +856,7 @@ bool PlatformCALayer::filtersCanBeComposited(const FilterOperations& filters)
         case FilterOperation::REFERENCE:
 #if ENABLE(CSS_SHADERS)
         case FilterOperation::CUSTOM:
+        case FilterOperation::VALIDATED_CUSTOM:
 #endif
             return false;
         case FilterOperation::DROP_SHADOW:
diff --git a/Source/WebCore/platform/graphics/ca/mac/TileCache.h b/Source/WebCore/platform/graphics/ca/mac/TileCache.h
index 17e98ee3c..32573c70d 100644
--- a/Source/WebCore/platform/graphics/ca/mac/TileCache.h
+++ b/Source/WebCore/platform/graphics/ca/mac/TileCache.h
@@ -51,7 +51,7 @@ class TileCache : public TiledBacking {
     WTF_MAKE_NONCOPYABLE(TileCache);
 
 public:
-    static PassOwnPtr<TileCache> create(WebTileCacheLayer*, const IntSize& tileSize);
+    static PassOwnPtr<TileCache> create(WebTileCacheLayer*);
     ~TileCache();
 
     void tileCacheLayerBoundsChanged();
@@ -79,7 +79,7 @@ public:
     static unsigned blankPixelCountForTiles(const WebTileLayerList&, IntRect, IntPoint);
 
 private:
-    TileCache(WebTileCacheLayer*, const IntSize& tileSize);
+    TileCache(WebTileCacheLayer*);
 
     // TiledBacking member functions.
     virtual void setVisibleRect(const IntRect&) OVERRIDE;
@@ -87,8 +87,10 @@ private:
     virtual void setTileCoverage(TileCoverage) OVERRIDE;
     virtual TileCoverage tileCoverage() const OVERRIDE { return m_tileCoverage; }
     virtual void forceRepaint() OVERRIDE;
+    virtual IntSize tileSize() const OVERRIDE { return m_tileSize; }
     virtual void setScrollingPerformanceLoggingEnabled(bool flag) OVERRIDE { m_scrollingPerformanceLoggingEnabled = flag; }
     virtual bool scrollingPerformanceLoggingEnabled() const OVERRIDE { return m_scrollingPerformanceLoggingEnabled; }
+    virtual IntRect tileCoverageRect() const;
     
     IntRect bounds() const;
 
@@ -96,7 +98,8 @@ private:
     IntRect rectForTileIndex(const TileIndex&) const;
     void getTileIndexRangeForRect(const IntRect&, TileIndex& topLeft, TileIndex& bottomRight);
 
-    IntRect tileCoverageRect() const;
+    IntRect computeTileCoverageRect() const;
+    IntSize tileSizeForCoverageRect(const IntRect&) const;
 
     void scheduleTileRevalidation(double interval);
     void tileRevalidationTimerFired(Timer<TileCache>*);
@@ -110,7 +113,7 @@ private:
 
     WebTileCacheLayer* m_tileCacheLayer;
     RetainPtr<CALayer> m_tileContainerLayer;
-    const IntSize m_tileSize;
+    IntSize m_tileSize;
     IntRect m_visibleRect;
 
     typedef HashMap<TileIndex, RetainPtr<WebTileLayer> > TileMap;
diff --git a/Source/WebCore/platform/graphics/ca/mac/TileCache.mm b/Source/WebCore/platform/graphics/ca/mac/TileCache.mm
index 619244da9..9638f088a 100644
--- a/Source/WebCore/platform/graphics/ca/mac/TileCache.mm
+++ b/Source/WebCore/platform/graphics/ca/mac/TileCache.mm
@@ -45,15 +45,18 @@ using namespace std;
 
 namespace WebCore {
 
-PassOwnPtr<TileCache> TileCache::create(WebTileCacheLayer* tileCacheLayer, const IntSize& tileSize)
+static const int defaultTileCacheWidth = 512;
+static const int defaultTileCacheHeight = 512;
+
+PassOwnPtr<TileCache> TileCache::create(WebTileCacheLayer* tileCacheLayer)
 {
-    return adoptPtr(new TileCache(tileCacheLayer, tileSize));
+    return adoptPtr(new TileCache(tileCacheLayer));
 }
 
-TileCache::TileCache(WebTileCacheLayer* tileCacheLayer, const IntSize& tileSize)
+TileCache::TileCache(WebTileCacheLayer* tileCacheLayer)
     : m_tileCacheLayer(tileCacheLayer)
     , m_tileContainerLayer(adoptCF([[CALayer alloc] init]))
-    , m_tileSize(tileSize)
+    , m_tileSize(defaultTileCacheWidth, defaultTileCacheHeight)
     , m_tileRevalidationTimer(this, &TileCache::tileRevalidationTimerFired)
     , m_scale(1)
     , m_deviceScaleFactor(1)
@@ -300,18 +303,22 @@ void TileCache::getTileIndexRangeForRect(const IntRect& rect, TileIndex& topLeft
 
     topLeft.setX(max(clampedRect.x() / m_tileSize.width(), 0));
     topLeft.setY(max(clampedRect.y() / m_tileSize.height(), 0));
-    bottomRight.setX(max(clampedRect.maxX() / m_tileSize.width(), 0));
-    bottomRight.setY(max(clampedRect.maxY() / m_tileSize.height(), 0));
+
+    int bottomXRatio = ceil((float)clampedRect.maxX() / m_tileSize.width());
+    bottomRight.setX(max(bottomXRatio - 1, 0));
+
+    int bottomYRatio = ceil((float)clampedRect.maxY() / m_tileSize.height());
+    bottomRight.setY(max(bottomYRatio - 1, 0));
 }
 
-IntRect TileCache::tileCoverageRect() const
+IntRect TileCache::computeTileCoverageRect() const
 {
     IntRect tileCoverageRect = m_visibleRect;
 
     // If the page is not in a window (for example if it's in a background tab), we limit the tile coverage rect to the visible rect.
     // Furthermore, if the page can't have scrollbars (for example if its body element has overflow:hidden) it's very unlikely that the
     // page will ever be scrolled so we limit the tile coverage rect as well.
-    if (m_isInWindow) {
+    if (m_isInWindow && !(m_tileCoverage & CoverageForSlowScrolling)) {
         // Inflate the coverage rect so that it covers 2x of the visible width and 3x of the visible height.
         // These values were chosen because it's more common to have tall pages and to scroll vertically,
         // so we keep more tiles above and below the current area.
@@ -325,6 +332,13 @@ IntRect TileCache::tileCoverageRect() const
     return tileCoverageRect;
 }
 
+IntSize TileCache::tileSizeForCoverageRect(const IntRect& coverageRect) const
+{
+    if (m_tileCoverage & CoverageForSlowScrolling)
+        return coverageRect.size();
+    return IntSize(defaultTileCacheWidth, defaultTileCacheHeight);
+}
+
 void TileCache::scheduleTileRevalidation(double interval)
 {
     if (m_tileRevalidationTimer.isActive() && m_tileRevalidationTimer.nextFireInterval() < interval)
@@ -377,7 +391,13 @@ void TileCache::revalidateTiles()
     if (m_visibleRect.isEmpty() || bounds().isEmpty())
         return;
 
-    IntRect tileCoverageRect = this->tileCoverageRect();
+    IntRect tileCoverageRect = computeTileCoverageRect();
+    IntRect coverageRectInTileCoords(tileCoverageRect);
+    coverageRectInTileCoords.scale(m_scale);
+
+    IntSize oldTileSize = m_tileSize;
+    m_tileSize = tileSizeForCoverageRect(tileCoverageRect);
+    bool tileSizeChanged = m_tileSize != oldTileSize;
 
     Vector<TileIndex> tilesToRemove;
 
@@ -386,7 +406,7 @@ void TileCache::revalidateTiles()
 
         WebTileLayer* tileLayer = it->value.get();
 
-        if (!rectForTileIndex(tileIndex).intersects(tileCoverageRect)) {
+        if (!rectForTileIndex(tileIndex).intersects(coverageRectInTileCoords) || tileSizeChanged) {
             // Remove this layer.
             [tileLayer removeFromSuperlayer];
             [tileLayer setTileCache:0];
@@ -403,7 +423,7 @@ void TileCache::revalidateTiles()
 
     TileIndex topLeft;
     TileIndex bottomRight;
-    getTileIndexRangeForRect(tileCoverageRect, topLeft, bottomRight);
+    getTileIndexRangeForRect(coverageRectInTileCoords, topLeft, bottomRight);
 
     Vector<FloatRect> dirtyRects;
 
@@ -442,6 +462,14 @@ void TileCache::revalidateTiles()
     platformLayer->owner()->platformCALayerDidCreateTiles(dirtyRects);
 }
 
+// Return the rect in layer coords, not tile coords.
+IntRect TileCache::tileCoverageRect() const
+{
+    IntRect coverageRectInLayerCoords(m_tileCoverageRect);
+    coverageRectInLayerCoords.scale(1 / m_scale);
+    return coverageRectInLayerCoords;
+}
+
 WebTileLayer* TileCache::tileLayerAtIndex(const TileIndex& index) const
 {
     return m_tiles.get(index).get();
diff --git a/Source/WebCore/platform/graphics/ca/mac/WebTileCacheLayer.mm b/Source/WebCore/platform/graphics/ca/mac/WebTileCacheLayer.mm
index c6aab8aff..d119f5bd2 100644
--- a/Source/WebCore/platform/graphics/ca/mac/WebTileCacheLayer.mm
+++ b/Source/WebCore/platform/graphics/ca/mac/WebTileCacheLayer.mm
@@ -40,8 +40,7 @@ using namespace WebCore;
     if (!self)
         return nil;
 
-    // FIXME: The tile size should be configurable.
-    _tileCache = TileCache::create(self, IntSize(512, 512));
+    _tileCache = TileCache::create(self);
 #ifndef NDEBUG
     [self setName:@"WebTileCacheLayer"];
 #endif
diff --git a/Source/WebCore/platform/graphics/ca/win/PlatformCAAnimationWin.cpp b/Source/WebCore/platform/graphics/ca/win/PlatformCAAnimationWin.cpp
index 97fb0b609..856a4fcad 100644
--- a/Source/WebCore/platform/graphics/ca/win/PlatformCAAnimationWin.cpp
+++ b/Source/WebCore/platform/graphics/ca/win/PlatformCAAnimationWin.cpp
@@ -151,8 +151,7 @@ PlatformCAAnimation::PlatformCAAnimation(AnimationType type, const String& keyPa
     else
         m_animation.adoptCF(CACFAnimationCreate(kCACFKeyframeAnimation));
     
-    RetainPtr<CFStringRef> s(AdoptCF, keyPath.createCFString());
-    CACFAnimationSetKeyPath(m_animation.get(), s.get());
+    CACFAnimationSetKeyPath(m_animation.get(), keyPath.createCFString().get());
 }
 
 PlatformCAAnimation::PlatformCAAnimation(PlatformAnimationRef animation)
diff --git a/Source/WebCore/platform/graphics/ca/win/PlatformCALayerWin.cpp b/Source/WebCore/platform/graphics/ca/win/PlatformCALayerWin.cpp
index 70168b210..bba8f2c5c 100644
--- a/Source/WebCore/platform/graphics/ca/win/PlatformCALayerWin.cpp
+++ b/Source/WebCore/platform/graphics/ca/win/PlatformCALayerWin.cpp
@@ -176,10 +176,8 @@ void PlatformCALayer::animationStarted(CFTimeInterval beginTime)
 static void resubmitAllAnimations(PlatformCALayer* layer)
 {
     HashMap<String, RefPtr<PlatformCAAnimation> >::const_iterator end = layer->animations().end();
-    for (HashMap<String, RefPtr<PlatformCAAnimation> >::const_iterator it = layer->animations().begin(); it != end; ++it) {
-        RetainPtr<CFStringRef> s(AdoptCF, it->key.createCFString());
-        CACFLayerAddAnimation(layer->platformLayer(), s.get(), it->value->platformAnimation());
-    }
+    for (HashMap<String, RefPtr<PlatformCAAnimation> >::const_iterator it = layer->animations().begin(); it != end; ++it)
+        CACFLayerAddAnimation(layer->platformLayer(), it->key.createCFString().get(), it->value->platformAnimation());
 }
 
 void PlatformCALayer::ensureAnimationsSubmitted()
@@ -297,8 +295,7 @@ void PlatformCALayer::addAnimationForKey(const String& key, PlatformCAAnimation*
     // Add it to the animation list
     m_animations.add(key, animation);
 
-    RetainPtr<CFStringRef> s(AdoptCF, key.createCFString());
-    CACFLayerAddAnimation(m_layer.get(), s.get(), animation->platformAnimation());
+    CACFLayerAddAnimation(m_layer.get(), key.createCFString().get(), animation->platformAnimation());
     setNeedsCommit();
 
     // Tell the host about it so we can fire the start animation event
@@ -312,8 +309,7 @@ void PlatformCALayer::removeAnimationForKey(const String& key)
     // Remove it from the animation list
     m_animations.remove(key);
 
-    RetainPtr<CFStringRef> s(AdoptCF, key.createCFString());
-    CACFLayerRemoveAnimation(m_layer.get(), s.get());
+    CACFLayerRemoveAnimation(m_layer.get(), key.createCFString().get());
 
     // We don't "remove" a layer from AbstractCACFLayerTreeHost when it loses an animation.
     // There may be other active animations on the layer and if an animation
@@ -572,6 +568,10 @@ void PlatformCALayer::setFilters(const FilterOperations&)
 {
 }
 
+void PlatformCALayer::copyFiltersFrom(const PlatformCALayer*)
+{
+}
+
 bool PlatformCALayer::filtersCanBeComposited(const FilterOperations&)
 {
     return false;
@@ -586,8 +586,7 @@ String PlatformCALayer::name() const
 
 void PlatformCALayer::setName(const String& value)
 {
-    RetainPtr<CFStringRef> s(AdoptCF, value.createCFString());
-    CACFLayerSetName(m_layer.get(), s.get());
+    CACFLayerSetName(m_layer.get(), value.createCFString().get());
     setNeedsCommit();
 }
 
diff --git a/Source/WebCore/platform/graphics/ca/win/PlatformCALayerWinInternal.cpp b/Source/WebCore/platform/graphics/ca/win/PlatformCALayerWinInternal.cpp
index c430cf284..15275b3ae 100644
--- a/Source/WebCore/platform/graphics/ca/win/PlatformCALayerWinInternal.cpp
+++ b/Source/WebCore/platform/graphics/ca/win/PlatformCALayerWinInternal.cpp
@@ -459,7 +459,7 @@ void PlatformCALayerWinInternal::updateTiles()
 
 #ifndef NDEBUG
             String name = "Tile (" + String::number(i) + "," + String::number(j) + ")";
-            CACFLayerSetName(tile, RetainPtr<CFStringRef>(AdoptCF, name.createCFString()).get());
+            CACFLayerSetName(tile, name.createCFString().get());
 #endif
         }
     }
diff --git a/Source/WebCore/platform/graphics/cairo/BitmapImageCairo.cpp b/Source/WebCore/platform/graphics/cairo/BitmapImageCairo.cpp
index 83fac1fda..225dfb2f6 100644
--- a/Source/WebCore/platform/graphics/cairo/BitmapImageCairo.cpp
+++ b/Source/WebCore/platform/graphics/cairo/BitmapImageCairo.cpp
@@ -73,10 +73,12 @@ BitmapImage::BitmapImage(NativeImageCairo* nativeImage, ImageObserver* observer)
 
 void BitmapImage::draw(GraphicsContext* context, const FloatRect& dst, const FloatRect& src, ColorSpace styleColorSpace, CompositeOperator op)
 {
-    FloatRect srcRect(src);
-    FloatRect dstRect(dst);
+    draw(context, dst, src, styleColorSpace, op, DoNotRespectImageOrientation);
+}
 
-    if (!dstRect.width() || !dstRect.height() || !srcRect.width() || !srcRect.height())
+void BitmapImage::draw(GraphicsContext* context, const FloatRect& dst, const FloatRect& src, ColorSpace styleColorSpace, CompositeOperator op, RespectImageOrientationEnum shouldRespectImageOrientation)
+{
+    if (!dst.width() || !dst.height() || !src.width() || !src.height())
         return;
 
     startAnimation();
@@ -86,7 +88,7 @@ void BitmapImage::draw(GraphicsContext* context, const FloatRect& dst, const Flo
         return;
 
     if (mayFillWithSolidColor()) {
-        fillWithSolidColor(context, dstRect, solidColor(), styleColorSpace, op);
+        fillWithSolidColor(context, dst, solidColor(), styleColorSpace, op);
         return;
     }
 
@@ -101,11 +103,29 @@ void BitmapImage::draw(GraphicsContext* context, const FloatRect& dst, const Flo
 #if ENABLE(IMAGE_DECODER_DOWN_SAMPLING)
     cairo_surface_t* surface = nativeImage->surface();
     IntSize scaledSize(cairo_image_surface_get_width(surface), cairo_image_surface_get_height(surface));
-    FloatRect adjustedSrcRect = adjustSourceRectForDownSampling(srcRect, scaledSize);
+    FloatRect adjustedSrcRect = adjustSourceRectForDownSampling(src, scaledSize);
 #else
-    FloatRect adjustedSrcRect(srcRect);
+    FloatRect adjustedSrcRect(src);
 #endif
 
+    ImageOrientation orientation = DefaultImageOrientation;
+    if (shouldRespectImageOrientation == RespectImageOrientation)
+        orientation = frameOrientationAtIndex(m_currentFrame);
+
+    FloatRect dstRect = dst;
+
+    if (orientation != DefaultImageOrientation) {
+        // ImageOrientation expects the origin to be at (0, 0).
+        context->translate(dstRect.x(), dstRect.y());
+        dstRect.setLocation(FloatPoint());
+        context->concatCTM(orientation.transformFromDefault(dstRect.size()));
+        if (orientation.usesWidthAsHeight()) {
+            // The destination rectangle will have it's width and height already reversed for the orientation of
+            // the image, as it was needed for page layout, so we need to reverse it back here.
+            dstRect = FloatRect(dstRect.x(), dstRect.y(), dstRect.height(), dstRect.width());
+        }
+    }
+
     context->platformContext()->drawSurfaceToContext(nativeImage->surface(), dstRect, adjustedSrcRect, context);
 
     context->restore();
diff --git a/Source/WebCore/platform/graphics/cairo/ImageBufferCairo.cpp b/Source/WebCore/platform/graphics/cairo/ImageBufferCairo.cpp
index 8ccb8d9bc..722cb6999 100644
--- a/Source/WebCore/platform/graphics/cairo/ImageBufferCairo.cpp
+++ b/Source/WebCore/platform/graphics/cairo/ImageBufferCairo.cpp
@@ -175,15 +175,26 @@ PassRefPtr<Uint8ClampedArray> getImageData(const IntRect& rect, const ImageBuffe
         for (int x = 0; x < numColumns; x++) {
             int basex = x * 4;
             unsigned* pixel = row + x + originx;
-            Color pixelColor;
-            if (multiplied == Unmultiplied)
-                pixelColor = colorFromPremultipliedARGB(*pixel);
-            else
-                pixelColor = Color(*pixel);
-            destRows[basex]     = pixelColor.red();
-            destRows[basex + 1] = pixelColor.green();
-            destRows[basex + 2] = pixelColor.blue();
-            destRows[basex + 3] = pixelColor.alpha();
+
+            // Avoid calling Color::colorFromPremultipliedARGB() because one
+            // function call per pixel is too expensive.
+            unsigned alpha = (*pixel & 0xFF000000) >> 24;
+            unsigned red = (*pixel & 0x00FF0000) >> 16;
+            unsigned green = (*pixel & 0x0000FF00) >> 8;
+            unsigned blue = (*pixel & 0x000000FF);
+
+            if (multiplied == Unmultiplied) {
+                if (alpha && alpha != 255) {
+                    red = red * 255 / alpha;
+                    green = green * 255 / alpha;
+                    blue = blue * 255 / alpha;
+                }
+            }
+
+            destRows[basex]     = red;
+            destRows[basex + 1] = green;
+            destRows[basex + 2] = blue;
+            destRows[basex + 3] = alpha;
         }
         destRows += destBytesPerRow;
     }
@@ -242,14 +253,23 @@ void ImageBuffer::putByteArray(Multiply multiplied, Uint8ClampedArray* source, c
         for (int x = 0; x < numColumns; x++) {
             int basex = x * 4;
             unsigned* pixel = row + x + destx;
-            Color pixelColor = Color::createUnCheked(srcRows[basex],
-                                                     srcRows[basex + 1],
-                                                     srcRows[basex + 2],
-                                                     srcRows[basex + 3]);
-            if (multiplied == Unmultiplied)
-                *pixel = premultipliedARGBFromColor(pixelColor);
-            else
-                *pixel = pixelColor.rgb();
+
+            // Avoid calling Color::premultipliedARGBFromColor() because one
+            // function call per pixel is too expensive.
+            unsigned red = srcRows[basex];
+            unsigned green = srcRows[basex + 1];
+            unsigned blue = srcRows[basex + 2];
+            unsigned alpha = srcRows[basex + 3];
+
+            if (multiplied == Unmultiplied) {
+                if (alpha && alpha != 255) {
+                    red = (red * alpha + 254) / 255;
+                    green = (green * alpha + 254) / 255;
+                    blue = (blue * alpha + 254) / 255;
+                }
+            }
+
+            *pixel = (alpha << 24) | red  << 16 | green  << 8 | blue;
         }
         srcRows += srcBytesPerRow;
     }
diff --git a/Source/WebCore/platform/graphics/cg/GraphicsContextCG.cpp b/Source/WebCore/platform/graphics/cg/GraphicsContextCG.cpp
index 6ceace35d..1edab0c33 100644
--- a/Source/WebCore/platform/graphics/cg/GraphicsContextCG.cpp
+++ b/Source/WebCore/platform/graphics/cg/GraphicsContextCG.cpp
@@ -326,9 +326,8 @@ void GraphicsContext::drawNativeImage(NativeImagePtr imagePtr, const FloatSize&
 
     setPlatformCompositeOperation(op);
 
-    // Flip the coords.
-    CGContextTranslateCTM(context, adjustedDestRect.x(), adjustedDestRect.maxY());
-    CGContextScaleCTM(context, 1, -1);
+    // ImageOrientation expects the origin to be at (0, 0)
+    CGContextTranslateCTM(context, adjustedDestRect.x(), adjustedDestRect.y());
     adjustedDestRect.setLocation(FloatPoint());
 
     if (orientation != DefaultImageOrientation) {
@@ -340,6 +339,10 @@ void GraphicsContext::drawNativeImage(NativeImagePtr imagePtr, const FloatSize&
         }
     }
     
+    // Flip the coords.
+    CGContextTranslateCTM(context, 0, adjustedDestRect.height());
+    CGContextScaleCTM(context, 1, -1);
+
     // Adjust the color space.
     image = Image::imageWithColorSpace(image.get(), styleColorSpace);
 
@@ -485,7 +488,7 @@ void GraphicsContext::drawLine(const IntPoint& point1, const IntPoint& point2)
             }
         }
 
-        const CGFloat dottedLine[2] = { patWidth, patWidth };
+        const CGFloat dottedLine[2] = { static_cast<CGFloat>(patWidth), static_cast<CGFloat>(patWidth) };
         CGContextSetLineDash(context, patternOffset, dottedLine, 2);
     }
 
@@ -593,7 +596,7 @@ void GraphicsContext::strokeArc(const IntRect& rect, int startAngle, int angleSp
             }
         }
 
-        const CGFloat dottedLine[2] = { patWidth, patWidth };
+        const CGFloat dottedLine[2] = { static_cast<CGFloat>(patWidth), static_cast<CGFloat>(patWidth) };
         CGContextSetLineDash(context, patternOffset, dottedLine, 2);
     }
 
@@ -1057,7 +1060,12 @@ void GraphicsContext::clipOut(const IntRect& rect)
     if (paintingDisabled())
         return;
 
-    CGRect rects[2] = { CGContextGetClipBoundingBox(platformContext()), rect };
+    // FIXME: Using CGRectInfinite is much faster than getting the clip bounding box. However, due
+    // to <rdar://problem/12584492>, CGRectInfinite can't be used with an accelerated context that
+    // has certain transforms that aren't just a translation or a scale.
+    const AffineTransform& ctm = getCTM();
+    bool canUseCGRectInfinite = !isAcceleratedContext() || (!ctm.b() && !ctm.c());
+    CGRect rects[2] = { canUseCGRectInfinite ? CGRectInfinite : CGContextGetClipBoundingBox(platformContext()), rect };
     CGContextBeginPath(platformContext());
     CGContextAddRects(platformContext(), rects, 2);
     CGContextEOClip(platformContext());
diff --git a/Source/WebCore/platform/graphics/cg/ImageBufferCG.cpp b/Source/WebCore/platform/graphics/cg/ImageBufferCG.cpp
index 21e9db4c2..dd3781597 100644
--- a/Source/WebCore/platform/graphics/cg/ImageBufferCG.cpp
+++ b/Source/WebCore/platform/graphics/cg/ImageBufferCG.cpp
@@ -377,8 +377,7 @@ static inline CFStringRef jpegUTI()
 static RetainPtr<CFStringRef> utiFromMIMEType(const String& mimeType)
 {
 #if PLATFORM(MAC)
-    RetainPtr<CFStringRef> mimeTypeCFString(AdoptCF, mimeType.createCFString());
-    return RetainPtr<CFStringRef>(AdoptCF, UTTypeCreatePreferredIdentifierForTag(kUTTagClassMIMEType, mimeTypeCFString.get(), 0));
+    return adoptCF(UTTypeCreatePreferredIdentifierForTag(kUTTagClassMIMEType, mimeType.createCFString().get(), 0));
 #else
     ASSERT(isMainThread()); // It is unclear if CFSTR is threadsafe.
 
diff --git a/Source/WebCore/platform/graphics/cg/ImageSourceCGMac.mm b/Source/WebCore/platform/graphics/cg/ImageSourceCGMac.mm
index bd50a3175..953bcb9d2 100644
--- a/Source/WebCore/platform/graphics/cg/ImageSourceCGMac.mm
+++ b/Source/WebCore/platform/graphics/cg/ImageSourceCGMac.mm
@@ -33,16 +33,12 @@ namespace WebCore {
 
 String MIMETypeForImageSourceType(const String& uti)
 {
-    RetainPtr<CFStringRef> utiref(AdoptCF, uti.createCFString());
-    RetainPtr<CFStringRef> mime(AdoptCF, UTTypeCopyPreferredTagWithClass(utiref.get(), kUTTagClassMIMEType));
-    return mime.get();
+    return adoptCF(UTTypeCopyPreferredTagWithClass(uti.createCFString().get(), kUTTagClassMIMEType)).get();
 }
 
 String preferredExtensionForImageSourceType(const String& uti)
 {
-    RetainPtr<CFStringRef> type(AdoptCF, uti.createCFString());
-    RetainPtr<CFStringRef> extension(AdoptCF, UTTypeCopyPreferredTagWithClass(type.get(), kUTTagClassFilenameExtension));
-    return extension.get();
+    return adoptCF(UTTypeCopyPreferredTagWithClass(uti.createCFString().get(), kUTTagClassFilenameExtension)).get();
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/platform/graphics/chromium/DeferredImageDecoder.cpp b/Source/WebCore/platform/graphics/chromium/DeferredImageDecoder.cpp
index 7574196e7..e9424dfc5 100644
--- a/Source/WebCore/platform/graphics/chromium/DeferredImageDecoder.cpp
+++ b/Source/WebCore/platform/graphics/chromium/DeferredImageDecoder.cpp
@@ -151,4 +151,10 @@ unsigned DeferredImageDecoder::frameBytesAtIndex(size_t index) const
     return m_actualDecoder ? m_actualDecoder->frameBytesAtIndex(index) : 0;
 }
 
+ImageOrientation DeferredImageDecoder::orientation() const
+{
+    // FIXME: Make this work with deferred decoding.
+    return m_actualDecoder ? m_actualDecoder->orientation() : DefaultImageOrientation;
+}
+
 } // namespace WebCore
diff --git a/Source/WebCore/platform/graphics/chromium/DeferredImageDecoder.h b/Source/WebCore/platform/graphics/chromium/DeferredImageDecoder.h
index 6b33fe35e..d82aec872 100644
--- a/Source/WebCore/platform/graphics/chromium/DeferredImageDecoder.h
+++ b/Source/WebCore/platform/graphics/chromium/DeferredImageDecoder.h
@@ -56,6 +56,7 @@ public:
     void clearFrameBufferCache(size_t);
     bool frameHasAlphaAtIndex(size_t index) const;
     unsigned frameBytesAtIndex(size_t index) const;
+    ImageOrientation orientation() const;
 
 private:
     explicit DeferredImageDecoder(ImageDecoder* actualDecoder);
diff --git a/Source/WebCore/platform/graphics/chromium/GraphicsLayerChromium.cpp b/Source/WebCore/platform/graphics/chromium/GraphicsLayerChromium.cpp
index 075749e9a..7a63b6801 100644
--- a/Source/WebCore/platform/graphics/chromium/GraphicsLayerChromium.cpp
+++ b/Source/WebCore/platform/graphics/chromium/GraphicsLayerChromium.cpp
@@ -54,7 +54,9 @@
 #include "NativeImageSkia.h"
 #include "PlatformContextSkia.h"
 #include "ScrollableArea.h"
+#include "SkImageFilter.h"
 #include "SkMatrix44.h"
+#include "SkiaImageFilterBuilder.h"
 #include "SystemTime.h"
 #include <public/Platform.h>
 #include <public/WebAnimation.h>
@@ -105,6 +107,7 @@ GraphicsLayerChromium::GraphicsLayerChromium(GraphicsLayerClient* client)
     m_layer = adoptPtr(Platform::current()->compositorSupport()->createContentLayer(m_opaqueRectTrackingContentLayerDelegate.get()));
     m_layer->layer()->setDrawsContent(m_drawsContent && m_contentsVisible);
     m_layer->layer()->setScrollClient(this);
+    m_layer->setAutomaticallyComputeRasterScale(true);
     updateDebugIndicators();
 }
 
@@ -299,6 +302,7 @@ void GraphicsLayerChromium::setContentsOpaque(bool opaque)
 {
     GraphicsLayer::setContentsOpaque(opaque);
     m_layer->layer()->setOpaque(m_contentsOpaque);
+    m_opaqueRectTrackingContentLayerDelegate->setOpaque(m_contentsOpaque);
 }
 
 static bool copyWebCoreFilterOperationsToWebFilterOperations(const FilterOperations& filters, WebFilterOperations& webFilters)
@@ -366,6 +370,7 @@ static bool copyWebCoreFilterOperationsToWebFilterOperations(const FilterOperati
         }
 #if ENABLE(CSS_SHADERS)
         case FilterOperation::CUSTOM:
+        case FilterOperation::VALIDATED_CUSTOM:
             return false; // Not supported.
 #endif
         case FilterOperation::PASSTHROUGH:
@@ -378,15 +383,25 @@ static bool copyWebCoreFilterOperationsToWebFilterOperations(const FilterOperati
 
 bool GraphicsLayerChromium::setFilters(const FilterOperations& filters)
 {
-    WebFilterOperations webFilters;
-    if (!copyWebCoreFilterOperationsToWebFilterOperations(filters, webFilters)) {
-        // Make sure the filters are removed from the platform layer, as they are
-        // going to fallback to software mode.
-        m_layer->layer()->setFilters(WebFilterOperations());
-        GraphicsLayer::setFilters(FilterOperations());
-        return false;
+    // FIXME: For now, we only use SkImageFilters if there is a reference
+    // filter in the chain. Once all issues have been ironed out, we should
+    // switch all filtering over to this path, and remove setFilters() and
+    // WebFilterOperations altogether.
+    if (filters.hasReferenceFilter()) {
+        SkiaImageFilterBuilder builder;
+        SkAutoTUnref<SkImageFilter> imageFilter(builder.build(filters));
+        m_layer->layer()->setFilter(imageFilter);
+    } else {
+        WebFilterOperations webFilters;
+        if (!copyWebCoreFilterOperationsToWebFilterOperations(filters, webFilters)) {
+            // Make sure the filters are removed from the platform layer, as they are
+            // going to fallback to software mode.
+            m_layer->layer()->setFilters(WebFilterOperations());
+            GraphicsLayer::setFilters(FilterOperations());
+            return false;
+        }
+        m_layer->layer()->setFilters(webFilters);
     }
-    m_layer->layer()->setFilters(webFilters);
     return GraphicsLayer::setFilters(filters);
 }
 
@@ -434,14 +449,17 @@ void GraphicsLayerChromium::setReplicatedByLayer(GraphicsLayer* layer)
 
 void GraphicsLayerChromium::setContentsNeedsDisplay()
 {
-    if (WebLayer* contentsLayer = contentsLayerIfRegistered())
+    if (WebLayer* contentsLayer = contentsLayerIfRegistered()) {
         contentsLayer->invalidate();
+        addRepaintRect(contentsRect());
+    }
 }
 
 void GraphicsLayerChromium::setNeedsDisplay()
 {
     if (drawsContent()) {
         m_layer->layer()->invalidate();
+        addRepaintRect(FloatRect(FloatPoint(), m_size));
         if (m_linkHighlight)
             m_linkHighlight->invalidate();
     }
@@ -451,6 +469,7 @@ void GraphicsLayerChromium::setNeedsDisplayInRect(const FloatRect& rect)
 {
     if (drawsContent()) {
         m_layer->layer()->invalidateRect(rect);
+        addRepaintRect(rect);
         if (m_linkHighlight)
             m_linkHighlight->invalidate();
     }
@@ -841,7 +860,7 @@ void GraphicsLayerChromium::setupContentsLayer(WebLayer* contentsLayer)
         // shadow content that must display in front of the video.
         m_layer->layer()->insertChild(m_contentsLayer, 0);
 
-        if (showDebugBorders()) {
+        if (isShowingDebugBorder()) {
             m_contentsLayer->setDebugBorderColor(Color(0, 0, 128, 180).rgb());
             m_contentsLayer->setDebugBorderWidth(1);
         }
@@ -862,7 +881,6 @@ bool GraphicsLayerChromium::appliesPageScale() const
 
 void GraphicsLayerChromium::paint(GraphicsContext& context, const IntRect& clip)
 {
-    context.platformContext()->setDrawingToImageBuffer(true);
     paintGraphicsLayerContents(context, clip);
 }
 
diff --git a/Source/WebCore/platform/graphics/chromium/OpaqueRectTrackingContentLayerDelegate.cpp b/Source/WebCore/platform/graphics/chromium/OpaqueRectTrackingContentLayerDelegate.cpp
index a06ac666e..62edced17 100644
--- a/Source/WebCore/platform/graphics/chromium/OpaqueRectTrackingContentLayerDelegate.cpp
+++ b/Source/WebCore/platform/graphics/chromium/OpaqueRectTrackingContentLayerDelegate.cpp
@@ -49,7 +49,7 @@ OpaqueRectTrackingContentLayerDelegate::~OpaqueRectTrackingContentLayerDelegate(
 {
 }
 
-void OpaqueRectTrackingContentLayerDelegate::paintContents(SkCanvas* canvas, const WebRect& clip, WebFloatRect& opaque)
+void OpaqueRectTrackingContentLayerDelegate::paintContents(SkCanvas* canvas, const WebRect& clip, bool canPaintLCDText, WebFloatRect& opaque)
 {
     PlatformContextSkia platformContext(canvas);
 #if defined(SK_SUPPORT_HINTING_SCALE_FACTOR)
@@ -57,6 +57,10 @@ void OpaqueRectTrackingContentLayerDelegate::paintContents(SkCanvas* canvas, con
         platformContext.setHintingScaleFactor(canvas->getTotalMatrix().getScaleX());
 #endif
     platformContext.setTrackOpaqueRegion(!m_opaque);
+    // FIXME: Rename PlatformContextSkia::setDrawingToImageBuffer to setCanPaintLCDText.
+    // I also suspect that a function on PlatformContextSkia is not really needed.
+    // GraphicsContext::setAllowsFontSmoothing can be used for this purpose.
+    platformContext.setDrawingToImageBuffer(!(canPaintLCDText && m_opaque));
     GraphicsContext context(&platformContext);
 
     // Record transform prior to painting, as all opaque tracking will be
diff --git a/Source/WebCore/platform/graphics/chromium/OpaqueRectTrackingContentLayerDelegate.h b/Source/WebCore/platform/graphics/chromium/OpaqueRectTrackingContentLayerDelegate.h
index bb5c2ae96..451b647b1 100644
--- a/Source/WebCore/platform/graphics/chromium/OpaqueRectTrackingContentLayerDelegate.h
+++ b/Source/WebCore/platform/graphics/chromium/OpaqueRectTrackingContentLayerDelegate.h
@@ -55,7 +55,7 @@ public:
     void setOpaque(bool opaque) { m_opaque = opaque; }
 
     // WebKit::WebContentLayerClient implementation.
-    virtual void paintContents(SkCanvas*, const WebKit::WebRect& clip, WebKit::WebFloatRect& opaque) OVERRIDE;
+    virtual void paintContents(SkCanvas*, const WebKit::WebRect& clip, bool canPaintLCDText, WebKit::WebFloatRect& opaque) OVERRIDE;
 
 private:
     GraphicsContextPainter* m_painter;
diff --git a/Source/WebCore/platform/graphics/chromium/SimpleFontDataChromiumWin.cpp b/Source/WebCore/platform/graphics/chromium/SimpleFontDataChromiumWin.cpp
index 8510dfa52..a7aed729c 100644
--- a/Source/WebCore/platform/graphics/chromium/SimpleFontDataChromiumWin.cpp
+++ b/Source/WebCore/platform/graphics/chromium/SimpleFontDataChromiumWin.cpp
@@ -119,26 +119,6 @@ PassRefPtr<SimpleFontData> SimpleFontData::createScaledFontData(const FontDescri
     return SimpleFontData::create(FontPlatformData(hfont, scaledSize, m_platformData.orientation()), isCustomFont(), false);
 }
 
-PassRefPtr<SimpleFontData> SimpleFontData::smallCapsFontData(const FontDescription& fontDescription) const
-{
-    if (!m_derivedFontData)
-        m_derivedFontData = DerivedFontData::create(isCustomFont());
-    if (!m_derivedFontData->smallCaps)
-        m_derivedFontData->smallCaps = createScaledFontData(fontDescription, .7);
-
-    return m_derivedFontData->smallCaps;
-}
-
-PassRefPtr<SimpleFontData> SimpleFontData::emphasisMarkFontData(const FontDescription& fontDescription) const
-{
-    if (!m_derivedFontData)
-        m_derivedFontData = DerivedFontData::create(isCustomFont());
-    if (!m_derivedFontData->emphasisMark)
-        m_derivedFontData->emphasisMark = createScaledFontData(fontDescription, .5);
-
-    return m_derivedFontData->emphasisMark;
-}
-
 bool SimpleFontData::containsCharacters(const UChar* characters, int length) const
 {
   // This used to be implemented with IMLangFontLink2, but since that code has
diff --git a/Source/WebCore/platform/graphics/clutter/GraphicsLayerClutter.cpp b/Source/WebCore/platform/graphics/clutter/GraphicsLayerClutter.cpp
index 104b7982b..58bf38d5b 100644
--- a/Source/WebCore/platform/graphics/clutter/GraphicsLayerClutter.cpp
+++ b/Source/WebCore/platform/graphics/clutter/GraphicsLayerClutter.cpp
@@ -67,11 +67,13 @@ ClutterActor* GraphicsLayerClutter::platformLayer() const
 void GraphicsLayerClutter::setNeedsDisplay()
 {
     notImplemented();
+    addRepaintRect(FloatRect(FloatPoint(), m_size));
 }
 
-void GraphicsLayerClutter::setNeedsDisplayInRect(const FloatRect&)
+void GraphicsLayerClutter::setNeedsDisplayInRect(const FloatRect& rect)
 {
     notImplemented();
+    addRepaintRect(rect);
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/platform/graphics/efl/GraphicsContext3DEfl.cpp b/Source/WebCore/platform/graphics/efl/GraphicsContext3DEfl.cpp
index 65f2d63b8..d1391307c 100644
--- a/Source/WebCore/platform/graphics/efl/GraphicsContext3DEfl.cpp
+++ b/Source/WebCore/platform/graphics/efl/GraphicsContext3DEfl.cpp
@@ -151,6 +151,31 @@ GraphicsContext3D::GraphicsContext3D(GraphicsContext3D::Attributes attrs, HostWi
 
 GraphicsContext3D::~GraphicsContext3D()
 {
+    if (m_renderStyle == RenderToCurrentGLContext || !m_private)
+        return;
+
+    makeContextCurrent();
+    glDeleteTextures(1, &m_texture);
+
+    if (m_attrs.antialias) {
+        glDeleteRenderbuffers(1, &m_multisampleColorBuffer);
+
+        if (m_attrs.stencil || m_attrs.depth)
+            glDeleteRenderbuffers(1, &m_multisampleDepthStencilBuffer);
+
+        glDeleteFramebuffers(1, &m_multisampleFBO);
+    } else if (m_attrs.stencil || m_attrs.depth) {
+
+#if USE(OPENGL_ES_2)
+        if (m_attrs.depth)
+            glDeleteRenderbuffers(1, &m_depthBuffer);
+
+        if (m_attrs.stencil)
+            glDeleteRenderbuffers(1, &m_stencilBuffer);
+#endif
+        glDeleteRenderbuffers(1, &m_depthStencilBuffer);
+    }
+    glDeleteFramebuffers(1, &m_fbo);
 }
 
 PlatformGraphicsContext3D GraphicsContext3D::platformGraphicsContext3D()
@@ -226,7 +251,7 @@ void GraphicsContext3D::paintToCanvas(const unsigned char* imagePixels, int imag
 #if USE(GRAPHICS_SURFACE)
 void GraphicsContext3D::createGraphicsSurfaces(const IntSize& size)
 {
-    notImplemented();
+    m_private->createGraphicsSurfaces(size);
 }
 #endif
 
diff --git a/Source/WebCore/platform/graphics/efl/GraphicsContext3DPrivate.cpp b/Source/WebCore/platform/graphics/efl/GraphicsContext3DPrivate.cpp
index 0ab98929f..62d0a6e3a 100644
--- a/Source/WebCore/platform/graphics/efl/GraphicsContext3DPrivate.cpp
+++ b/Source/WebCore/platform/graphics/efl/GraphicsContext3DPrivate.cpp
@@ -25,6 +25,7 @@
 #include "GraphicsContext.h"
 #include "HostWindow.h"
 #include "NotImplemented.h"
+#include "PlatformContextCairo.h"
 #include <Ecore_Evas.h>
 #include <Evas_GL.h>
 #include <wtf/OwnArrayPtr.h>
@@ -87,6 +88,13 @@ GraphicsContext3DPrivate::GraphicsContext3DPrivate(GraphicsContext3D* context, H
         return;
 
     makeContextCurrent();
+
+#if USE(GRAPHICS_SURFACE)
+    IntSize surfaceSize(m_context->m_currentWidth, m_context->m_currentHeight);
+    m_surfaceFlags = GraphicsSurface::SupportsTextureTarget | GraphicsSurface::SupportsSharing;
+    if (!surfaceSize.isEmpty())
+        m_graphicsSurface = GraphicsSurface::create(surfaceSize, m_surfaceFlags);
+#endif
 }
 
 GraphicsContext3DPrivate::~GraphicsContext3DPrivate()
@@ -101,8 +109,11 @@ GraphicsContext3DPrivate::~GraphicsContext3DPrivate()
         evas_gl_context_destroy(m_evasGL, m_evasGLContext);
 
     evas_gl_free(m_evasGL);
-}
 
+#if USE(GRAPHICS_SURFACE)
+    m_graphicsSurface.clear();
+#endif
+}
 
 bool GraphicsContext3DPrivate::createSurface(PageClientEfl* pageClient, bool renderDirectlyToHostWindow)
 {
@@ -169,6 +180,32 @@ void GraphicsContext3DPrivate::paintToTextureMapper(TextureMapper*, const FloatR
     notImplemented();
 }
 #endif
+
+#if USE(GRAPHICS_SURFACE)
+void GraphicsContext3DPrivate::createGraphicsSurfaces(const IntSize& size)
+{
+    if (size.isEmpty())
+        m_graphicsSurface.clear();
+    else
+        m_graphicsSurface = GraphicsSurface::create(size, m_surfaceFlags);
+}
+
+uint32_t GraphicsContext3DPrivate::copyToGraphicsSurface()
+{
+    if (!m_graphicsSurface)
+        return 0;
+
+    makeContextCurrent();
+    m_graphicsSurface->copyFromTexture(m_context->m_texture, IntRect(0, 0, m_context->m_currentWidth, m_context->m_currentHeight));
+    return m_graphicsSurface->swapBuffers();
+}
+
+GraphicsSurfaceToken GraphicsContext3DPrivate::graphicsSurfaceToken() const
+{
+    return m_graphicsSurface->exportToken();
+}
+#endif
+
 } // namespace WebCore
 
 #endif // USE(3D_GRAPHICS) || USE(ACCELERATED_COMPOSITING)
diff --git a/Source/WebCore/platform/graphics/efl/GraphicsContext3DPrivate.h b/Source/WebCore/platform/graphics/efl/GraphicsContext3DPrivate.h
index 08ccf77a6..1ae4351f9 100644
--- a/Source/WebCore/platform/graphics/efl/GraphicsContext3DPrivate.h
+++ b/Source/WebCore/platform/graphics/efl/GraphicsContext3DPrivate.h
@@ -26,6 +26,10 @@
 #include <texmap/TextureMapperPlatformLayer.h>
 #endif
 
+#if USE(GRAPHICS_SURFACE)
+#include "GraphicsSurface.h"
+#endif
+
 typedef struct _Evas_GL               Evas_GL;
 typedef struct _Evas_GL_Surface       Evas_GL_Surface;
 typedef struct _Evas_GL_Context       Evas_GL_Context;
@@ -52,6 +56,12 @@ public:
 #if USE(TEXTURE_MAPPER_GL)
     virtual void paintToTextureMapper(TextureMapper*, const FloatRect& target, const TransformationMatrix&, float opacity, BitmapTexture* mask);
 #endif
+#if USE(GRAPHICS_SURFACE)
+    virtual uint32_t copyToGraphicsSurface();
+    virtual GraphicsSurfaceToken graphicsSurfaceToken() const;
+    void createGraphicsSurfaces(const IntSize&);
+#endif
+
     bool makeContextCurrent();
     bool createSurface(PageClientEfl*, bool renderDirectlyToEvasGLObject);
     void setCurrentGLContext(void*, void*);
@@ -59,6 +69,10 @@ public:
     GraphicsContext3D::Attributes m_attributes;
     GraphicsContext3D* m_context;
     HostWindow* m_hostWindow;
+#if USE(GRAPHICS_SURFACE)
+    GraphicsSurface::Flags m_surfaceFlags;
+    RefPtr<GraphicsSurface> m_graphicsSurface;
+#endif
 
     ListHashSet<GC3Denum> m_syntheticErrors;
 
diff --git a/Source/WebCore/platform/graphics/filters/CustomFilterArrayParameter.h b/Source/WebCore/platform/graphics/filters/CustomFilterArrayParameter.h
index b52236dde..3050cb445 100644
--- a/Source/WebCore/platform/graphics/filters/CustomFilterArrayParameter.h
+++ b/Source/WebCore/platform/graphics/filters/CustomFilterArrayParameter.h
@@ -31,6 +31,7 @@
 #define CustomFilterArrayParameter_h
 
 #if ENABLE(CSS_SHADERS)
+#include "AnimationUtilities.h"
 #include "CustomFilterParameter.h"
 #include <wtf/Vector.h>
 
@@ -50,11 +51,19 @@ public:
 
     virtual PassRefPtr<CustomFilterParameter> blend(const CustomFilterParameter* from, double progress, const LayoutSize&)
     {
-        // FIXME: https://bugs.webkit.org/show_bug.cgi?id=96437
-        UNUSED_PARAM(from);
-        UNUSED_PARAM(progress);
+        if (!from || !isSameType(*from))
+            return this;
 
-        return this;
+        const CustomFilterArrayParameter* fromArray = static_cast<const CustomFilterArrayParameter*>(from);
+
+        if (size() != fromArray->size())
+            return this;
+
+        RefPtr<CustomFilterArrayParameter> result = CustomFilterArrayParameter::create(name());
+        for (size_t i = 0; i < size(); ++i)
+            result->addValue(WebCore::blend(fromArray->valueAt(i), valueAt(i), progress));
+
+        return result.release();
     }
 
     virtual bool operator==(const CustomFilterParameter& o) const
diff --git a/Source/WebCore/platform/graphics/filters/CustomFilterCompiledProgram.cpp b/Source/WebCore/platform/graphics/filters/CustomFilterCompiledProgram.cpp
index 7e284bb83..26965d05e 100644
--- a/Source/WebCore/platform/graphics/filters/CustomFilterCompiledProgram.cpp
+++ b/Source/WebCore/platform/graphics/filters/CustomFilterCompiledProgram.cpp
@@ -50,7 +50,6 @@ CustomFilterCompiledProgram::CustomFilterCompiledProgram(PassRefPtr<GraphicsCont
     , m_samplerLocation(-1)
     , m_samplerSizeLocation(-1)
     , m_contentSamplerLocation(-1)
-    , m_internalTexCoordAttribLocation(-1)
     , m_isInitialized(false)
 {
     m_context->makeContextCurrent();
@@ -130,14 +129,9 @@ void CustomFilterCompiledProgram::initializeParameterLocations(CustomFilterProgr
     m_samplerSizeLocation = m_context->getUniformLocation(m_program, "u_textureSize");
     m_contentSamplerLocation = m_context->getUniformLocation(m_program, "u_contentTexture");
     if (programType == PROGRAM_TYPE_BLENDS_ELEMENT_TEXTURE) {
-        // When the author uses the CSS mix function in a custom filter, we add internal symbols to the shader code.
-        // One of them, css_u_texture, references the texture of the element.
+        // When the author uses the CSS mix function in a custom filter, WebKit adds the internal
+        // symbol css_u_texture to the shader code, which references the texture of the element.
         m_samplerLocation = m_context->getUniformLocation(m_program, "css_u_texture");
-        m_internalTexCoordAttribLocation = m_context->getAttribLocation(m_program, "css_a_texCoord");
-
-        // These internal symbols should have been added to the validated shaders.
-        ASSERT(m_samplerLocation != -1);
-        ASSERT(m_internalTexCoordAttribLocation != -1);
     }
 }
 
diff --git a/Source/WebCore/platform/graphics/filters/CustomFilterCompiledProgram.h b/Source/WebCore/platform/graphics/filters/CustomFilterCompiledProgram.h
index f31fdf040..5dbf0d451 100644
--- a/Source/WebCore/platform/graphics/filters/CustomFilterCompiledProgram.h
+++ b/Source/WebCore/platform/graphics/filters/CustomFilterCompiledProgram.h
@@ -61,12 +61,6 @@ public:
     int samplerLocation() const { return m_samplerLocation; }
     int contentSamplerLocation() const { return m_contentSamplerLocation; }
     int samplerSizeLocation() const { return m_samplerSizeLocation; }
-    // FIXME: Get rid of the internal tex coord attribute "css_a_texCoord".
-    // If the author defined "a_texCoord", we should leverage that.
-    // If not, we should write "a_texCoord" in the shader.
-    // This requires us to first get the list of attributes from the vertex shader using ANGLE.
-    // https://bugs.webkit.org/show_bug.cgi?id=94358
-    int internalTexCoordAttribLocation() const { return m_internalTexCoordAttribLocation; }
 
     int uniformLocationByName(const String&);
     
@@ -94,9 +88,6 @@ private:
     int m_samplerLocation;
     int m_samplerSizeLocation;
     int m_contentSamplerLocation;
-    // FIXME: Get rid of the internal tex coord attribute "css_a_texCoord".
-    // https://bugs.webkit.org/show_bug.cgi?id=94358
-    int m_internalTexCoordAttribLocation;
     
     bool m_isInitialized;
 };
diff --git a/Source/WebCore/platform/graphics/filters/CustomFilterConstants.h b/Source/WebCore/platform/graphics/filters/CustomFilterConstants.h
index 6080c38f6..cdd453a2a 100644
--- a/Source/WebCore/platform/graphics/filters/CustomFilterConstants.h
+++ b/Source/WebCore/platform/graphics/filters/CustomFilterConstants.h
@@ -45,6 +45,18 @@ enum CustomFilterMeshConstants {
     TriangleAttribOffset = MeshAttribOffset + MeshAttribSize * sizeof(float)
 };
 
+enum CustomFilterMeshType {
+    MeshTypeAttached,
+    MeshTypeDetached
+};
+
+enum CustomFilterMeshBoxType {
+    MeshBoxTypeFilter,
+    MeshBoxTypeBorder,
+    MeshBoxTypePadding,
+    MeshBoxTypeContent
+};
+
 } // namespace WebCore
 
 #endif // CustomFilterConstants_h
diff --git a/Source/WebCore/platform/graphics/filters/CustomFilterMesh.cpp b/Source/WebCore/platform/graphics/filters/CustomFilterMesh.cpp
index 0278abad0..eff07884c 100644
--- a/Source/WebCore/platform/graphics/filters/CustomFilterMesh.cpp
+++ b/Source/WebCore/platform/graphics/filters/CustomFilterMesh.cpp
@@ -37,7 +37,7 @@
 namespace WebCore {
 
 CustomFilterMesh::CustomFilterMesh(GraphicsContext3D* context, unsigned columns, unsigned rows,
-                                   const FloatRect& meshBox, CustomFilterOperation::MeshType meshType)
+    const FloatRect& meshBox, CustomFilterMeshType meshType)
     : m_context(context)
     , m_verticesBufferObject(0)
     , m_elementsBufferObject(0)
diff --git a/Source/WebCore/platform/graphics/filters/CustomFilterMesh.h b/Source/WebCore/platform/graphics/filters/CustomFilterMesh.h
index e3c7a6bac..2bb3d5af1 100644
--- a/Source/WebCore/platform/graphics/filters/CustomFilterMesh.h
+++ b/Source/WebCore/platform/graphics/filters/CustomFilterMesh.h
@@ -43,7 +43,7 @@ class GraphicsContext3D;
 
 class CustomFilterMesh : public RefCounted<CustomFilterMesh> {
 public:
-    static PassRefPtr<CustomFilterMesh> create(GraphicsContext3D* context, unsigned cols, unsigned rows, const FloatRect& meshBox, CustomFilterOperation::MeshType meshType)
+    static PassRefPtr<CustomFilterMesh> create(GraphicsContext3D* context, unsigned cols, unsigned rows, const FloatRect& meshBox, CustomFilterMeshType meshType)
     {
         return adoptRef(new CustomFilterMesh(context, cols, rows, meshBox, meshType));
     }
@@ -56,10 +56,10 @@ public:
     unsigned indicesCount() const { return m_indicesCount; }
     
     const FloatRect& meshBox() const { return m_meshBox; }
-    CustomFilterOperation::MeshType meshType() const { return m_meshType; }
+    CustomFilterMeshType meshType() const { return m_meshType; }
 
 private:
-    CustomFilterMesh(GraphicsContext3D*, unsigned cols, unsigned rows, const FloatRect& meshBox, CustomFilterOperation::MeshType);
+    CustomFilterMesh(GraphicsContext3D*, unsigned cols, unsigned rows, const FloatRect& meshBox, CustomFilterMeshType);
     
     GraphicsContext3D* m_context;
     
@@ -70,7 +70,7 @@ private:
     unsigned m_indicesCount;
     
     FloatRect m_meshBox;
-    CustomFilterOperation::MeshType m_meshType;
+    CustomFilterMeshType m_meshType;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/platform/graphics/filters/CustomFilterMeshGenerator.cpp b/Source/WebCore/platform/graphics/filters/CustomFilterMeshGenerator.cpp
index 3d9d4d1b2..774691457 100644
--- a/Source/WebCore/platform/graphics/filters/CustomFilterMeshGenerator.cpp
+++ b/Source/WebCore/platform/graphics/filters/CustomFilterMeshGenerator.cpp
@@ -39,7 +39,7 @@ namespace WebCore {
 static bool s_dumpCustomFilterMeshBuffers = false;
 #endif
 
-CustomFilterMeshGenerator::CustomFilterMeshGenerator(unsigned columns, unsigned rows, const FloatRect& meshBox, CustomFilterOperation::MeshType meshType)
+CustomFilterMeshGenerator::CustomFilterMeshGenerator(unsigned columns, unsigned rows, const FloatRect& meshBox, CustomFilterMeshType meshType)
     : m_meshType(meshType)
     , m_points(columns + 1, rows + 1)
     , m_tiles(columns, rows)
@@ -60,7 +60,7 @@ CustomFilterMeshGenerator::CustomFilterMeshGenerator(unsigned columns, unsigned
     // when there's no need to explode the tiles.
     // * detached: each triangle has its own vertices. This means each triangle can be moved independently and a vec3
     // attribute is passed, so that each vertex can be uniquely identified.
-    if (m_meshType == CustomFilterOperation::ATTACHED)
+    if (m_meshType == MeshTypeAttached)
         generateAttachedMesh();
     else
         generateDetachedMesh();
@@ -152,8 +152,8 @@ void CustomFilterMeshGenerator::addDetachedMeshVertexAttributes(int quadX, int q
 void CustomFilterMeshGenerator::dumpBuffers() const
 {
     printf("Mesh buffers: Points.width(): %d, Points.height(): %d meshBox: %f, %f, %f, %f, type: %s\n",
-           m_points.width(), m_points.height(), m_meshBox.x(), m_meshBox.y(), m_meshBox.width(), m_meshBox.height(),
-           (m_meshType == CustomFilterOperation::ATTACHED) ? "Attached" : "Detached");
+        m_points.width(), m_points.height(), m_meshBox.x(), m_meshBox.y(), m_meshBox.width(), m_meshBox.height(),
+        (m_meshType == MeshTypeAttached) ? "Attached" : "Detached");
     printf("---Vertex:\n\t");
     for (unsigned i = 0; i < m_vertices.size(); ++i) {
         printf("%f ", m_vertices.at(i));
diff --git a/Source/WebCore/platform/graphics/filters/CustomFilterMeshGenerator.h b/Source/WebCore/platform/graphics/filters/CustomFilterMeshGenerator.h
index b3a184702..7abac12e2 100644
--- a/Source/WebCore/platform/graphics/filters/CustomFilterMeshGenerator.h
+++ b/Source/WebCore/platform/graphics/filters/CustomFilterMeshGenerator.h
@@ -44,7 +44,7 @@ public:
     // and 'columns' number of columns with a total of 'rows + 1' * 'columns + 1' vertices.
     // MeshBox is the filtered area calculated defined using the border-box, padding-box, content-box or filter-box
     // attributes. A value of (0, 0, 1, 1) will cover the entire output surface.
-    CustomFilterMeshGenerator(unsigned columns, unsigned rows, const FloatRect& meshBox, CustomFilterOperation::MeshType);
+    CustomFilterMeshGenerator(unsigned columns, unsigned rows, const FloatRect& meshBox, CustomFilterMeshType);
 
     const Vector<float>& vertices() const { return m_vertices; }
     const Vector<uint16_t>& indices() const { return m_indices; }
@@ -66,12 +66,12 @@ public:
     {
         static const unsigned AttachedMeshVertexSize = PositionAttribSize + TexAttribSize + MeshAttribSize;
         static const unsigned DetachedMeshVertexSize = AttachedMeshVertexSize + TriangleAttribSize;
-        return m_meshType == CustomFilterOperation::ATTACHED ? AttachedMeshVertexSize : DetachedMeshVertexSize;
+        return m_meshType == MeshTypeAttached ? AttachedMeshVertexSize : DetachedMeshVertexSize;
     }
 
     unsigned verticesCount() const
     {
-        return m_meshType == CustomFilterOperation::ATTACHED ? pointsCount() : indicesCount();
+        return m_meshType == MeshTypeAttached ? pointsCount() : indicesCount();
     }
 
 private:
@@ -110,7 +110,7 @@ private:
     Vector<float> m_vertices;
     Vector<uint16_t> m_indices;
 
-    CustomFilterOperation::MeshType m_meshType;
+    CustomFilterMeshType m_meshType;
     IntSize m_points;
     IntSize m_tiles;
     FloatSize m_tileSizeInPixels;
diff --git a/Source/WebCore/platform/graphics/filters/CustomFilterNumberParameter.h b/Source/WebCore/platform/graphics/filters/CustomFilterNumberParameter.h
index 423ef547e..09378583c 100644
--- a/Source/WebCore/platform/graphics/filters/CustomFilterNumberParameter.h
+++ b/Source/WebCore/platform/graphics/filters/CustomFilterNumberParameter.h
@@ -31,6 +31,7 @@
 #define CustomFilterNumberParameter_h
 
 #if ENABLE(CSS_SHADERS)
+#include "AnimationUtilities.h"
 #include "CustomFilterParameter.h"
 #include <wtf/Vector.h>
 
diff --git a/Source/WebCore/platform/graphics/filters/CustomFilterOperation.cpp b/Source/WebCore/platform/graphics/filters/CustomFilterOperation.cpp
index ed57b7374..2526e5820 100644
--- a/Source/WebCore/platform/graphics/filters/CustomFilterOperation.cpp
+++ b/Source/WebCore/platform/graphics/filters/CustomFilterOperation.cpp
@@ -36,66 +36,9 @@
 #include "CustomFilterProgram.h"
 #include "FilterOperation.h"
 
-#include <wtf/text/StringHash.h>
-
 namespace WebCore {
 
-bool customFilterParametersEqual(const CustomFilterParameterList& listA, const CustomFilterParameterList& listB)
-{
-    if (listA.size() != listB.size())
-        return false;
-    for (size_t i = 0; i < listA.size(); ++i) {
-        if (listA.at(i).get() != listB.at(i).get() 
-            && *listA.at(i).get() != *listB.at(i).get())
-            return false;
-    }
-    return true;
-}
-
-#if !ASSERT_DISABLED
-static bool checkCustomFilterParametersOrder(const CustomFilterParameterList& parameters)
-{
-    for (unsigned i = 1; i < parameters.size(); ++i) {
-        // Break for equal or not-sorted parameters.
-        if (!codePointCompareLessThan(parameters.at(i - 1)->name(), parameters.at(i)->name()))
-            return false;
-    }
-    return true;
-}
-#endif
-
-void blendCustomFilterParameters(const CustomFilterParameterList& fromList, const CustomFilterParameterList& toList, 
-                                 double progress, const LayoutSize& size, CustomFilterParameterList& resultList)
-{
-    // This method expects both lists to be sorted by parameter name and the result list is also sorted.
-    ASSERT(checkCustomFilterParametersOrder(fromList));
-    ASSERT(checkCustomFilterParametersOrder(toList));
-    size_t fromListIndex = 0, toListIndex = 0;
-    while (fromListIndex < fromList.size() && toListIndex < toList.size()) {
-        CustomFilterParameter* paramFrom = fromList.at(fromListIndex).get();
-        CustomFilterParameter* paramTo = toList.at(toListIndex).get();
-        if (paramFrom->name() == paramTo->name()) {
-            resultList.append(paramTo->blend(paramFrom, progress, size));
-            ++fromListIndex;
-            ++toListIndex;
-            continue;
-        }
-        if (codePointCompareLessThan(paramFrom->name(), paramTo->name())) {
-            resultList.append(paramFrom);
-            ++fromListIndex;
-            continue;
-        }
-        resultList.append(paramTo);
-        ++toListIndex;
-    }
-    for (; fromListIndex < fromList.size(); ++fromListIndex)
-        resultList.append(fromList.at(fromListIndex));
-    for (; toListIndex < toList.size(); ++toListIndex)
-        resultList.append(toList.at(toListIndex));
-    ASSERT(checkCustomFilterParametersOrder(resultList));
-}
-
-CustomFilterOperation::CustomFilterOperation(PassRefPtr<CustomFilterProgram> program, const CustomFilterParameterList& sortedParameters, unsigned meshRows, unsigned meshColumns, MeshBoxType meshBoxType, MeshType meshType)
+CustomFilterOperation::CustomFilterOperation(PassRefPtr<CustomFilterProgram> program, const CustomFilterParameterList& sortedParameters, unsigned meshRows, unsigned meshColumns, CustomFilterMeshBoxType meshBoxType, CustomFilterMeshType meshType)
     : FilterOperation(CUSTOM)
     , m_program(program)
     , m_parameters(sortedParameters)
@@ -105,7 +48,7 @@ CustomFilterOperation::CustomFilterOperation(PassRefPtr<CustomFilterProgram> pro
     , m_meshType(meshType)
 {
     // Make sure that the parameters are alwyas sorted by name. We use that to merge two CustomFilterOperations in animations.
-    ASSERT(checkCustomFilterParametersOrder(m_parameters));
+    ASSERT(m_parameters.checkAlphabeticalOrder());
 }
     
 CustomFilterOperation::~CustomFilterOperation()
@@ -129,7 +72,7 @@ PassRefPtr<FilterOperation> CustomFilterOperation::blend(const FilterOperation*
         return this;
     
     CustomFilterParameterList animatedParameters;
-    blendCustomFilterParameters(fromOp->m_parameters, m_parameters, progress, size, animatedParameters);
+    m_parameters.blend(fromOp->m_parameters, progress, size, animatedParameters);
     return CustomFilterOperation::create(m_program, animatedParameters, m_meshRows, m_meshColumns, m_meshBoxType, m_meshType);
 }
 
diff --git a/Source/WebCore/platform/graphics/filters/CustomFilterOperation.h b/Source/WebCore/platform/graphics/filters/CustomFilterOperation.h
index 0d64d2368..edf0f129c 100644
--- a/Source/WebCore/platform/graphics/filters/CustomFilterOperation.h
+++ b/Source/WebCore/platform/graphics/filters/CustomFilterOperation.h
@@ -31,38 +31,19 @@
 #define CustomFilterOperation_h
 
 #if ENABLE(CSS_SHADERS)
+#include "CustomFilterConstants.h"
+#include "CustomFilterParameterList.h"
 #include "CustomFilterProgram.h"
 #include "FilterOperation.h"
 #include "LayoutTypes.h"
 
-#include <wtf/text/WTFString.h>
-
 namespace WebCore {
 
 // CSS Shaders
 
-class CustomFilterParameter;
-typedef Vector<RefPtr<CustomFilterParameter> > CustomFilterParameterList;
-
-bool customFilterParametersEqual(const CustomFilterParameterList&, const CustomFilterParameterList&);
-void blendCustomFilterParameters(const CustomFilterParameterList& listFrom, const CustomFilterParameterList& listTo, 
-                                 double progress, const LayoutSize&, CustomFilterParameterList& resultList);
-
 class CustomFilterOperation : public FilterOperation {
 public:
-    enum MeshBoxType {
-        FILTER_BOX,
-        BORDER_BOX,
-        PADDING_BOX,
-        CONTENT_BOX
-    };
-    
-    enum MeshType {
-        ATTACHED,
-        DETACHED
-    };
-    
-    static PassRefPtr<CustomFilterOperation> create(PassRefPtr<CustomFilterProgram> program, const CustomFilterParameterList& sortedParameters, unsigned meshRows, unsigned meshColumns, MeshBoxType meshBoxType, MeshType meshType)
+    static PassRefPtr<CustomFilterOperation> create(PassRefPtr<CustomFilterProgram> program, const CustomFilterParameterList& sortedParameters, unsigned meshRows, unsigned meshColumns, CustomFilterMeshBoxType meshBoxType, CustomFilterMeshType meshType)
     {
         return adoptRef(new CustomFilterOperation(program, sortedParameters, meshRows, meshColumns, meshBoxType, meshType));
     }
@@ -74,8 +55,8 @@ public:
     unsigned meshRows() const { return m_meshRows; }
     unsigned meshColumns() const { return m_meshColumns; }
     
-    MeshBoxType meshBoxType() const { return m_meshBoxType; }
-    MeshType meshType() const { return m_meshType; }
+    CustomFilterMeshBoxType meshBoxType() const { return m_meshBoxType; }
+    CustomFilterMeshType meshType() const { return m_meshType; }
     
     virtual ~CustomFilterOperation();
     
@@ -92,22 +73,22 @@ private:
 
         const CustomFilterOperation* other = static_cast<const CustomFilterOperation*>(&o);
         return *m_program.get() == *other->m_program.get()
-               && m_meshRows == other->m_meshRows
-               && m_meshColumns == other->m_meshColumns
-               && m_meshBoxType == other->m_meshBoxType
-               && m_meshType == other->m_meshType
-               && customFilterParametersEqual(m_parameters, other->m_parameters);
+            && m_meshRows == other->m_meshRows
+            && m_meshColumns == other->m_meshColumns
+            && m_meshBoxType == other->m_meshBoxType
+            && m_meshType == other->m_meshType
+            && m_parameters == other->m_parameters;
     }
     
-    CustomFilterOperation(PassRefPtr<CustomFilterProgram>, const CustomFilterParameterList&, unsigned meshRows, unsigned meshColumns, MeshBoxType, MeshType);
+    CustomFilterOperation(PassRefPtr<CustomFilterProgram>, const CustomFilterParameterList&, unsigned meshRows, unsigned meshColumns, CustomFilterMeshBoxType, CustomFilterMeshType);
 
     RefPtr<CustomFilterProgram> m_program;
     CustomFilterParameterList m_parameters;
     
     unsigned m_meshRows;
     unsigned m_meshColumns;
-    MeshBoxType m_meshBoxType;
-    MeshType m_meshType;
+    CustomFilterMeshBoxType m_meshBoxType;
+    CustomFilterMeshType m_meshType;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/platform/graphics/filters/CustomFilterParameterList.cpp b/Source/WebCore/platform/graphics/filters/CustomFilterParameterList.cpp
new file mode 100644
index 000000000..cc633e9d9
--- /dev/null
+++ b/Source/WebCore/platform/graphics/filters/CustomFilterParameterList.cpp
@@ -0,0 +1,104 @@
+/*
+ * Copyright (C) 2012 Adobe Systems Incorporated. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above
+ *    copyright notice, this list of conditions and the following
+ *    disclaimer.
+ * 2. Redistributions in binary form must reproduce the above
+ *    copyright notice, this list of conditions and the following
+ *    disclaimer in the documentation and/or other materials
+ *    provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDER "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER BE
+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
+ * OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR
+ * TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF
+ * THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(CSS_SHADERS)
+#include "CustomFilterParameterList.h"
+
+#include "CustomFilterParameter.h"
+#include <wtf/text/StringHash.h>
+
+namespace WebCore {
+
+CustomFilterParameterList::CustomFilterParameterList()
+{
+}
+
+CustomFilterParameterList::CustomFilterParameterList(size_t size)
+    : CustomFilterParameterListBase(size) 
+{
+}
+
+bool CustomFilterParameterList::operator==(const CustomFilterParameterList& other) const
+{
+    if (size() != other.size())
+        return false;
+    for (size_t i = 0; i < size(); ++i) {
+        if (at(i).get() != other.at(i).get() 
+            && *at(i).get() != *other.at(i).get())
+            return false;
+    }
+    return true;
+}
+
+bool CustomFilterParameterList::checkAlphabeticalOrder() const
+{
+    for (unsigned i = 1; i < size(); ++i) {
+        // Break for equal or not-sorted parameters.
+        if (!codePointCompareLessThan(at(i - 1)->name(), at(i)->name()))
+            return false;
+    }
+    return true;
+}
+
+void CustomFilterParameterList::blend(const CustomFilterParameterList& fromList, 
+    double progress, const LayoutSize& frameSize, CustomFilterParameterList& resultList) const
+{
+    // This method expects both lists to be sorted by parameter name and the result list is also sorted.
+    ASSERT(checkAlphabeticalOrder());
+    ASSERT(fromList.checkAlphabeticalOrder());
+    size_t fromListIndex = 0, toListIndex = 0;
+    while (fromListIndex < fromList.size() && toListIndex < size()) {
+        CustomFilterParameter* paramFrom = fromList.at(fromListIndex).get();
+        CustomFilterParameter* paramTo = at(toListIndex).get();
+        if (paramFrom->name() == paramTo->name()) {
+            resultList.append(paramTo->blend(paramFrom, progress, frameSize));
+            ++fromListIndex;
+            ++toListIndex;
+            continue;
+        }
+        if (codePointCompareLessThan(paramFrom->name(), paramTo->name())) {
+            resultList.append(paramFrom);
+            ++fromListIndex;
+            continue;
+        }
+        resultList.append(paramTo);
+        ++toListIndex;
+    }
+    for (; fromListIndex < fromList.size(); ++fromListIndex)
+        resultList.append(fromList.at(fromListIndex));
+    for (; toListIndex < size(); ++toListIndex)
+        resultList.append(at(toListIndex));
+    ASSERT(resultList.checkAlphabeticalOrder());
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(CSS_SHADERS)
diff --git a/Source/WebCore/platform/graphics/filters/CustomFilterParameterList.h b/Source/WebCore/platform/graphics/filters/CustomFilterParameterList.h
new file mode 100644
index 000000000..426756e79
--- /dev/null
+++ b/Source/WebCore/platform/graphics/filters/CustomFilterParameterList.h
@@ -0,0 +1,56 @@
+/*
+ * Copyright (C) 2012 Adobe Systems Incorporated. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above
+ *    copyright notice, this list of conditions and the following
+ *    disclaimer.
+ * 2. Redistributions in binary form must reproduce the above
+ *    copyright notice, this list of conditions and the following
+ *    disclaimer in the documentation and/or other materials
+ *    provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDER "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER BE
+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
+ * OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR
+ * TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF
+ * THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#ifndef CustomFilterParameterList_h
+#define CustomFilterParameterList_h
+
+#if ENABLE(CSS_SHADERS)
+#include "LayoutTypes.h"
+#include <wtf/Vector.h>
+
+namespace WebCore {
+
+class CustomFilterParameter;
+typedef Vector<RefPtr<CustomFilterParameter> > CustomFilterParameterListBase;
+
+class CustomFilterParameterList : public CustomFilterParameterListBase {
+public:
+    CustomFilterParameterList();
+    explicit CustomFilterParameterList(size_t);
+
+    bool checkAlphabeticalOrder() const;
+    void blend(const CustomFilterParameterList& from, double progress, const LayoutSize&, CustomFilterParameterList& resultList) const;
+    bool operator==(const CustomFilterParameterList&) const;
+};
+
+} // namespace WebCore
+
+#endif // ENABLE(CSS_SHADERS)
+
+#endif // CustomFilterParameterList_h
diff --git a/Source/WebCore/platform/graphics/filters/CustomFilterProgram.cpp b/Source/WebCore/platform/graphics/filters/CustomFilterProgram.cpp
index c9990d98d..2a8fce076 100644
--- a/Source/WebCore/platform/graphics/filters/CustomFilterProgram.cpp
+++ b/Source/WebCore/platform/graphics/filters/CustomFilterProgram.cpp
@@ -38,9 +38,10 @@
 
 namespace WebCore {
 
-CustomFilterProgram::CustomFilterProgram(CustomFilterProgramType programType, const CustomFilterProgramMixSettings& mixSettings)
+CustomFilterProgram::CustomFilterProgram(CustomFilterProgramType programType, const CustomFilterProgramMixSettings& mixSettings, CustomFilterMeshType meshType)
     : m_programType(programType)
     , m_mixSettings(mixSettings)
+    , m_meshType(meshType)
 {
     // Keep the constructor protected to prevent creating this object directly.
 }
@@ -82,7 +83,14 @@ void CustomFilterProgram::notifyClients()
 CustomFilterProgramInfo CustomFilterProgram::programInfo() const
 {
     ASSERT(isLoaded());
-    return CustomFilterProgramInfo(vertexShaderString(), fragmentShaderString(), m_programType, m_mixSettings);
+    return CustomFilterProgramInfo(vertexShaderString(), fragmentShaderString(), m_programType, m_mixSettings, m_meshType);
+}
+
+bool CustomFilterProgram::operator==(const CustomFilterProgram& o) const
+{
+    return m_programType == o.m_programType
+        && (m_programType != PROGRAM_TYPE_BLENDS_ELEMENT_TEXTURE || m_mixSettings == o.m_mixSettings)
+        && m_meshType == o.m_meshType;
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/platform/graphics/filters/CustomFilterProgram.h b/Source/WebCore/platform/graphics/filters/CustomFilterProgram.h
index 0492d476d..b755bb7ac 100644
--- a/Source/WebCore/platform/graphics/filters/CustomFilterProgram.h
+++ b/Source/WebCore/platform/graphics/filters/CustomFilterProgram.h
@@ -51,38 +51,37 @@ public:
     virtual ~CustomFilterProgram();
 
     virtual bool isLoaded() const = 0;
-    
-    CustomFilterProgramMixSettings mixSettings() const { return m_mixSettings; }
 
     void addClient(CustomFilterProgramClient*);
     void removeClient(CustomFilterProgramClient*);
     
     CustomFilterProgramInfo programInfo() const;
+
+    virtual String vertexShaderString() const = 0;
+    virtual String fragmentShaderString() const = 0;
     CustomFilterProgramType programType() const { return m_programType; }
+    CustomFilterProgramMixSettings mixSettings() const { return m_mixSettings; }
+    CustomFilterMeshType meshType() const { return m_meshType; }
 
-    // StyleCustomFilterProgram has the only implementation for the following method. That means, it casts to StyleCustomFilterProgram
-    // withouth checking the type. If you add another implementation, also add a mechanism to check for the correct type.
-    virtual bool operator==(const CustomFilterProgram&) const = 0;
+    virtual bool operator==(const CustomFilterProgram&) const;
     bool operator!=(const CustomFilterProgram& o) const { return !(*this == o); }
 protected:
     // StyleCustomFilterProgram can notify the clients that the cached resources are
     // loaded and it is ready to create CustomFilterCompiledProgram objects.
     void notifyClients();
-    
-    virtual String vertexShaderString() const = 0;
-    virtual String fragmentShaderString() const = 0;
-    
+
     virtual void willHaveClients() = 0;
     virtual void didRemoveLastClient() = 0;
 
     // Keep the constructor protected to prevent creating this object directly.
-    CustomFilterProgram(CustomFilterProgramType, const CustomFilterProgramMixSettings&);
+    CustomFilterProgram(CustomFilterProgramType, const CustomFilterProgramMixSettings&, CustomFilterMeshType);
 
 private:
     typedef HashCountedSet<CustomFilterProgramClient*> CustomFilterProgramClientList;
     CustomFilterProgramClientList m_clients;
     CustomFilterProgramType m_programType;
     CustomFilterProgramMixSettings m_mixSettings;
+    CustomFilterMeshType m_meshType;
 };
 
 }
diff --git a/Source/WebCore/platform/graphics/filters/CustomFilterProgramInfo.cpp b/Source/WebCore/platform/graphics/filters/CustomFilterProgramInfo.cpp
index bc1494faf..ddab9a787 100644
--- a/Source/WebCore/platform/graphics/filters/CustomFilterProgramInfo.cpp
+++ b/Source/WebCore/platform/graphics/filters/CustomFilterProgramInfo.cpp
@@ -64,11 +64,12 @@ bool CustomFilterProgramInfo::isHashTableDeletedValue() const
         && m_fragmentShaderString.isHashTableDeletedValue();
 }
 
-CustomFilterProgramInfo::CustomFilterProgramInfo(const String& vertexShader, const String& fragmentShader, CustomFilterProgramType programType, const CustomFilterProgramMixSettings& mixSettings)
+CustomFilterProgramInfo::CustomFilterProgramInfo(const String& vertexShader, const String& fragmentShader, CustomFilterProgramType programType, const CustomFilterProgramMixSettings& mixSettings, CustomFilterMeshType meshType)
     : m_vertexShaderString(vertexShader)
     , m_fragmentShaderString(fragmentShader)
     , m_programType(programType)
     , m_mixSettings(mixSettings)
+    , m_meshType(meshType)
 {
     // At least one of the shaders needs to be non-null.
     ASSERT(!m_vertexShaderString.isNull() || !m_fragmentShaderString.isNull());
@@ -78,12 +79,15 @@ unsigned CustomFilterProgramInfo::hash() const
 {
     // At least one of the shaders needs to be non-null.
     ASSERT(!m_vertexShaderString.isNull() || !m_fragmentShaderString.isNull());
-    uintptr_t hashCodes[5] = {
+
+    bool blendsElementTexture = (m_programType == PROGRAM_TYPE_BLENDS_ELEMENT_TEXTURE);
+    uintptr_t hashCodes[6] = {
         hashPossiblyNullString(m_vertexShaderString),
         hashPossiblyNullString(m_fragmentShaderString),
-        m_programType == PROGRAM_TYPE_BLENDS_ELEMENT_TEXTURE,
-        m_programType == PROGRAM_TYPE_BLENDS_ELEMENT_TEXTURE ? m_mixSettings.blendMode : 0,
-        m_programType == PROGRAM_TYPE_BLENDS_ELEMENT_TEXTURE ? m_mixSettings.compositeOperator : 0
+        blendsElementTexture,
+        static_cast<uintptr_t>(blendsElementTexture ? m_mixSettings.blendMode : 0),
+        static_cast<uintptr_t>(blendsElementTexture ? m_mixSettings.compositeOperator : 0),
+        m_meshType
     };
     return StringHasher::hashMemory<sizeof(hashCodes)>(&hashCodes);
 }
@@ -93,15 +97,11 @@ bool CustomFilterProgramInfo::operator==(const CustomFilterProgramInfo& o) const
     ASSERT(!isHashTableDeletedValue());
     ASSERT(!o.isHashTableDeletedValue());
 
-    if (m_programType == PROGRAM_TYPE_BLENDS_ELEMENT_TEXTURE)
-        return m_vertexShaderString == o.m_vertexShaderString
-            && m_fragmentShaderString == o.m_fragmentShaderString
-            && m_programType == o.m_programType
-            && m_mixSettings == o.m_mixSettings;
-
-    return m_vertexShaderString == o.m_vertexShaderString
-        && m_fragmentShaderString == o.m_fragmentShaderString
-        && m_programType == o.m_programType;
+    return m_programType == o.m_programType
+        && (m_programType != PROGRAM_TYPE_BLENDS_ELEMENT_TEXTURE || m_mixSettings == o.m_mixSettings)
+        && m_meshType == o.m_meshType
+        && m_vertexShaderString == o.m_vertexShaderString
+        && m_fragmentShaderString == o.m_fragmentShaderString;
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/platform/graphics/filters/CustomFilterProgramInfo.h b/Source/WebCore/platform/graphics/filters/CustomFilterProgramInfo.h
index 3b544c5ad..cc60cca52 100644
--- a/Source/WebCore/platform/graphics/filters/CustomFilterProgramInfo.h
+++ b/Source/WebCore/platform/graphics/filters/CustomFilterProgramInfo.h
@@ -31,6 +31,7 @@
 #define CustomFilterProgramInfo_h
 
 #if ENABLE(CSS_SHADERS)
+#include "CustomFilterConstants.h"
 #include "GraphicsTypes.h"
 
 #include <wtf/HashTraits.h>
@@ -46,7 +47,7 @@ enum CustomFilterProgramType {
 struct CustomFilterProgramMixSettings {
     CustomFilterProgramMixSettings()
         : blendMode(BlendModeNormal)
-        , compositeOperator(CompositeSourceOver)
+        , compositeOperator(CompositeSourceAtop)
     {
     }
     
@@ -64,7 +65,7 @@ struct CustomFilterProgramMixSettings {
 // Null strings are placeholders for the default shader.
 class CustomFilterProgramInfo {
 public:
-    CustomFilterProgramInfo(const String&, const String&, CustomFilterProgramType, const CustomFilterProgramMixSettings&);
+    CustomFilterProgramInfo(const String&, const String&, CustomFilterProgramType, const CustomFilterProgramMixSettings&, CustomFilterMeshType);
 
     CustomFilterProgramInfo();
     bool isEmptyValue() const;
@@ -79,11 +80,13 @@ public:
     const String& fragmentShaderString() const { return m_fragmentShaderString; }
     CustomFilterProgramType programType() const { return m_programType; }
     const CustomFilterProgramMixSettings& mixSettings() const { return m_mixSettings; }
+    CustomFilterMeshType meshType() const { return m_meshType; }
 private:
     String m_vertexShaderString;
     String m_fragmentShaderString;
     CustomFilterProgramType m_programType;
     CustomFilterProgramMixSettings m_mixSettings;
+    CustomFilterMeshType m_meshType;
 };
 
 struct CustomFilterProgramInfoHash {
diff --git a/Source/WebCore/platform/graphics/filters/CustomFilterRenderer.cpp b/Source/WebCore/platform/graphics/filters/CustomFilterRenderer.cpp
new file mode 100644
index 000000000..1b32852cd
--- /dev/null
+++ b/Source/WebCore/platform/graphics/filters/CustomFilterRenderer.cpp
@@ -0,0 +1,305 @@
+/*
+ * Copyright (C) 2012 Adobe Systems Incorporated. All rights reserved.
+ * Copyright (C) 2011 Adobe Systems Incorporated. All rights reserved.
+ * Copyright (C) 2012 Company 100, Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above
+ *    copyright notice, this list of conditions and the following
+ *    disclaimer.
+ * 2. Redistributions in binary form must reproduce the above
+ *    copyright notice, this list of conditions and the following
+ *    disclaimer in the documentation and/or other materials
+ *    provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDER “AS IS” AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER BE
+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
+ * OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR
+ * TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF
+ * THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(CSS_SHADERS) && USE(3D_GRAPHICS)
+#include "CustomFilterRenderer.h"
+
+#include "CustomFilterArrayParameter.h"
+#include "CustomFilterConstants.h"
+#include "CustomFilterMesh.h"
+#include "CustomFilterNumberParameter.h"
+#include "CustomFilterParameter.h"
+#include "CustomFilterTransformParameter.h"
+#include "CustomFilterValidatedProgram.h"
+#include "GraphicsContext3D.h"
+#include "TransformationMatrix.h"
+
+namespace WebCore {
+
+static void orthogonalProjectionMatrix(TransformationMatrix& matrix, float left, float right, float bottom, float top)
+{
+    ASSERT(matrix.isIdentity());
+
+    float deltaX = right - left;
+    float deltaY = top - bottom;
+    if (!deltaX || !deltaY)
+        return;
+    matrix.setM11(2.0f / deltaX);
+    matrix.setM41(-(right + left) / deltaX);
+    matrix.setM22(2.0f / deltaY);
+    matrix.setM42(-(top + bottom) / deltaY);
+
+    // Use big enough near/far values, so that simple rotations of rather large objects will not
+    // get clipped. 10000 should cover most of the screen resolutions.
+    const float farValue = 10000;
+    const float nearValue = -10000;
+    matrix.setM33(-2.0f / (farValue - nearValue));
+    matrix.setM43(- (farValue + nearValue) / (farValue - nearValue));
+    matrix.setM44(1.0f);
+}
+
+PassRefPtr<CustomFilterRenderer> CustomFilterRenderer::create(PassRefPtr<GraphicsContext3D> context, PassRefPtr<CustomFilterValidatedProgram> validatedProgram, const CustomFilterParameterList& parameters,
+    unsigned meshRows, unsigned meshColumns, CustomFilterMeshBoxType meshBoxType, CustomFilterMeshType meshType)
+{
+    return adoptRef(new CustomFilterRenderer(context, validatedProgram, parameters, meshRows, meshColumns, meshBoxType, meshType));
+}
+
+CustomFilterRenderer::CustomFilterRenderer(PassRefPtr<GraphicsContext3D> context, PassRefPtr<CustomFilterValidatedProgram> validatedProgram, const CustomFilterParameterList& parameters,
+    unsigned meshRows, unsigned meshColumns, CustomFilterMeshBoxType, CustomFilterMeshType meshType)
+    : m_context(context)
+    , m_validatedProgram(validatedProgram)
+    , m_compiledProgram(0) // Don't compile the program unless we need to paint.
+    , m_parameters(parameters)
+    , m_meshRows(meshRows)
+    , m_meshColumns(meshColumns)
+    , m_meshType(meshType)
+{
+}
+
+CustomFilterRenderer::~CustomFilterRenderer()
+{
+}
+
+bool CustomFilterRenderer::premultipliedAlpha() const
+{
+    return m_validatedProgram->programInfo().programType() == PROGRAM_TYPE_BLENDS_ELEMENT_TEXTURE;
+}
+
+bool CustomFilterRenderer::programNeedsInputTexture() const
+{
+    ASSERT(m_compiledProgram.get());
+    return m_compiledProgram->samplerLocation() != -1;
+}
+
+void CustomFilterRenderer::draw(Platform3DObject inputTexture, const IntSize& size)
+{
+    // FIXME: We would need something like CustomFilterRendererState that will contain the size and other parameters in the future. We should pass that to bindProgramBuffers instead of storing it.
+    // https://bugs.webkit.org/show_bug.cgi?id=100107
+    m_contextSize = size;
+
+    bindProgramAndBuffers(inputTexture);
+    m_context->drawElements(GraphicsContext3D::TRIANGLES, m_mesh->indicesCount(), GraphicsContext3D::UNSIGNED_SHORT, 0);
+    unbindVertexAttributes();
+}
+
+bool CustomFilterRenderer::prepareForDrawing()
+{
+    m_context->makeContextCurrent();
+    initializeCompiledProgramIfNeeded();
+
+    // If the shader had compiler errors we cannot draw anything.
+    if (!m_compiledProgram->isInitialized())
+        return false;
+
+    initializeMeshIfNeeded();
+    return true;
+}
+
+void CustomFilterRenderer::initializeCompiledProgramIfNeeded()
+{
+    if (m_compiledProgram.get())
+        return;
+
+    m_compiledProgram = m_validatedProgram->compiledProgram();
+}
+
+void CustomFilterRenderer::initializeMeshIfNeeded()
+{
+    if (m_mesh.get())
+        return;
+
+    // FIXME: Sharing the mesh would just save the time needed to upload it to the GPU, so I assume we could
+    // benchmark that for performance.
+    // https://bugs.webkit.org/show_bug.cgi?id=88429
+    m_mesh = CustomFilterMesh::create(m_context.get(), m_meshColumns, m_meshRows, FloatRect(0, 0, 1, 1), m_meshType);
+}
+
+void CustomFilterRenderer::bindVertexAttribute(int attributeLocation, unsigned size, unsigned offset)
+{
+    if (attributeLocation != -1) {
+        m_context->vertexAttribPointer(attributeLocation, size, GraphicsContext3D::FLOAT, false, m_mesh->bytesPerVertex(), offset);
+        m_context->enableVertexAttribArray(attributeLocation);
+    }
+}
+
+void CustomFilterRenderer::unbindVertexAttribute(int attributeLocation)
+{
+    if (attributeLocation != -1)
+        m_context->disableVertexAttribArray(attributeLocation);
+}
+
+void CustomFilterRenderer::bindProgramArrayParameters(int uniformLocation, CustomFilterArrayParameter* arrayParameter)
+{
+    unsigned parameterSize = arrayParameter->size();
+    Vector<GC3Dfloat> floatVector;
+
+    for (unsigned i = 0; i < parameterSize; ++i)
+        floatVector.append(arrayParameter->valueAt(i));
+
+    m_context->uniform1fv(uniformLocation, parameterSize, floatVector.data());
+}
+
+void CustomFilterRenderer::bindProgramNumberParameters(int uniformLocation, CustomFilterNumberParameter* numberParameter)
+{
+    switch (numberParameter->size()) {
+    case 1:
+        m_context->uniform1f(uniformLocation, numberParameter->valueAt(0));
+        break;
+    case 2:
+        m_context->uniform2f(uniformLocation, numberParameter->valueAt(0), numberParameter->valueAt(1));
+        break;
+    case 3:
+        m_context->uniform3f(uniformLocation, numberParameter->valueAt(0), numberParameter->valueAt(1), numberParameter->valueAt(2));
+        break;
+    case 4:
+        m_context->uniform4f(uniformLocation, numberParameter->valueAt(0), numberParameter->valueAt(1), numberParameter->valueAt(2), numberParameter->valueAt(3));
+        break;
+    default:
+        ASSERT_NOT_REACHED();
+    }
+}
+
+void CustomFilterRenderer::bindProgramTransformParameter(int uniformLocation, CustomFilterTransformParameter* transformParameter)
+{
+    TransformationMatrix matrix;
+    if (m_contextSize.width() && m_contextSize.height()) {
+        // The viewport is a box with the size of 1 unit, so we are scaling up here to make sure that translations happen using real pixel
+        // units. At the end we scale back down in order to map it back to the original box. Note that transforms come in reverse order, because it is
+        // supposed to multiply to the left of the coordinates of the vertices.
+        // Note that the origin (0, 0) of the viewport is in the middle of the context, so there's no need to change the origin of the transform
+        // in order to rotate around the middle of mesh.
+        matrix.scale3d(1.0 / m_contextSize.width(), 1.0 / m_contextSize.height(), 1);
+        transformParameter->applyTransform(matrix, m_contextSize);
+        matrix.scale3d(m_contextSize.width(), m_contextSize.height(), 1);
+    }
+    float glMatrix[16];
+    matrix.toColumnMajorFloatArray(glMatrix);
+    m_context->uniformMatrix4fv(uniformLocation, 1, false, &glMatrix[0]);
+}
+
+void CustomFilterRenderer::bindProgramParameters()
+{
+    // FIXME: Find a way to reset uniforms that are not specified in CSS. This is needed to avoid using values
+    // set by other previous rendered filters.
+    // https://bugs.webkit.org/show_bug.cgi?id=76440
+
+    size_t parametersSize = m_parameters.size();
+    for (size_t i = 0; i < parametersSize; ++i) {
+        CustomFilterParameter* parameter = m_parameters.at(i).get();
+        int uniformLocation = m_compiledProgram->uniformLocationByName(parameter->name());
+        if (uniformLocation == -1)
+            continue;
+        switch (parameter->parameterType()) {
+        case CustomFilterParameter::ARRAY:
+            bindProgramArrayParameters(uniformLocation, static_cast<CustomFilterArrayParameter*>(parameter));
+            break;
+        case CustomFilterParameter::NUMBER:
+            bindProgramNumberParameters(uniformLocation, static_cast<CustomFilterNumberParameter*>(parameter));
+            break;
+        case CustomFilterParameter::TRANSFORM:
+            bindProgramTransformParameter(uniformLocation, static_cast<CustomFilterTransformParameter*>(parameter));
+            break;
+        }
+    }
+}
+
+void CustomFilterRenderer::bindProgramAndBuffers(Platform3DObject inputTexture)
+{
+    ASSERT(m_compiledProgram->isInitialized());
+
+    m_context->useProgram(m_compiledProgram->program());
+
+    if (programNeedsInputTexture()) {
+        // We should be binding the DOM element texture sampler only if the author is using the CSS mix function.
+        ASSERT(m_validatedProgram->programInfo().programType() == PROGRAM_TYPE_BLENDS_ELEMENT_TEXTURE);
+        ASSERT(m_compiledProgram->samplerLocation() != -1);
+
+        m_context->activeTexture(GraphicsContext3D::TEXTURE0);
+        m_context->uniform1i(m_compiledProgram->samplerLocation(), 0);
+        m_context->bindTexture(GraphicsContext3D::TEXTURE_2D, inputTexture);
+        m_context->texParameteri(GraphicsContext3D::TEXTURE_2D, GraphicsContext3D::TEXTURE_MIN_FILTER, GraphicsContext3D::LINEAR);
+        m_context->texParameteri(GraphicsContext3D::TEXTURE_2D, GraphicsContext3D::TEXTURE_MAG_FILTER, GraphicsContext3D::LINEAR);
+        m_context->texParameteri(GraphicsContext3D::TEXTURE_2D, GraphicsContext3D::TEXTURE_WRAP_S, GraphicsContext3D::CLAMP_TO_EDGE);
+        m_context->texParameteri(GraphicsContext3D::TEXTURE_2D, GraphicsContext3D::TEXTURE_WRAP_T, GraphicsContext3D::CLAMP_TO_EDGE);
+    }
+
+    if (m_compiledProgram->projectionMatrixLocation() != -1) {
+        TransformationMatrix projectionMatrix;
+        orthogonalProjectionMatrix(projectionMatrix, -0.5, 0.5, -0.5, 0.5);
+        float glProjectionMatrix[16];
+        projectionMatrix.toColumnMajorFloatArray(glProjectionMatrix);
+        m_context->uniformMatrix4fv(m_compiledProgram->projectionMatrixLocation(), 1, false, &glProjectionMatrix[0]);
+    }
+
+    ASSERT(m_meshColumns);
+    ASSERT(m_meshRows);
+
+    if (m_compiledProgram->meshSizeLocation() != -1)
+        m_context->uniform2f(m_compiledProgram->meshSizeLocation(), m_meshColumns, m_meshRows);
+
+    if (m_compiledProgram->tileSizeLocation() != -1)
+        m_context->uniform2f(m_compiledProgram->tileSizeLocation(), 1.0 / m_meshColumns, 1.0 / m_meshRows);
+
+    if (m_compiledProgram->meshBoxLocation() != -1) {
+        // FIXME: This will change when filter margins will be implemented,
+        // see https://bugs.webkit.org/show_bug.cgi?id=71400
+        m_context->uniform4f(m_compiledProgram->meshBoxLocation(), -0.5, -0.5, 1.0, 1.0);
+    }
+
+    if (m_compiledProgram->samplerSizeLocation() != -1)
+        m_context->uniform2f(m_compiledProgram->samplerSizeLocation(), m_contextSize.width(), m_contextSize.height());
+
+    m_context->bindBuffer(GraphicsContext3D::ARRAY_BUFFER, m_mesh->verticesBufferObject());
+    m_context->bindBuffer(GraphicsContext3D::ELEMENT_ARRAY_BUFFER, m_mesh->elementsBufferObject());
+
+    bindVertexAttribute(m_compiledProgram->positionAttribLocation(), PositionAttribSize, PositionAttribOffset);
+    bindVertexAttribute(m_compiledProgram->texAttribLocation(), TexAttribSize, TexAttribOffset);
+    bindVertexAttribute(m_compiledProgram->meshAttribLocation(), MeshAttribSize, MeshAttribOffset);
+    if (m_meshType == MeshTypeDetached)
+        bindVertexAttribute(m_compiledProgram->triangleAttribLocation(), TriangleAttribSize, TriangleAttribOffset);
+
+    bindProgramParameters();
+}
+
+void CustomFilterRenderer::unbindVertexAttributes()
+{
+    unbindVertexAttribute(m_compiledProgram->positionAttribLocation());
+    unbindVertexAttribute(m_compiledProgram->texAttribLocation());
+    unbindVertexAttribute(m_compiledProgram->meshAttribLocation());
+    if (m_meshType == MeshTypeDetached)
+        unbindVertexAttribute(m_compiledProgram->triangleAttribLocation());
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(CSS_SHADERS) && USE(3D_GRAPHICS)
diff --git a/Source/WebCore/platform/graphics/filters/CustomFilterRenderer.h b/Source/WebCore/platform/graphics/filters/CustomFilterRenderer.h
new file mode 100644
index 000000000..c0622ee04
--- /dev/null
+++ b/Source/WebCore/platform/graphics/filters/CustomFilterRenderer.h
@@ -0,0 +1,99 @@
+/*
+ * Copyright (C) 2011 Adobe Systems Incorporated. All rights reserved.
+ * Copyright (C) 2012 Company 100, Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above
+ *    copyright notice, this list of conditions and the following
+ *    disclaimer.
+ * 2. Redistributions in binary form must reproduce the above
+ *    copyright notice, this list of conditions and the following
+ *    disclaimer in the documentation and/or other materials
+ *    provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDER “AS IS” AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER BE
+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
+ * OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR
+ * TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF
+ * THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#ifndef CustomFilterRenderer_h
+#define CustomFilterRenderer_h
+
+#if ENABLE(CSS_SHADERS) && USE(3D_GRAPHICS)
+
+#include "CustomFilterConstants.h"
+#include "CustomFilterParameterList.h"
+#include "GraphicsTypes3D.h"
+#include "IntSize.h"
+#include <wtf/RefCounted.h>
+#include <wtf/RefPtr.h>
+
+namespace WebCore {
+
+class CustomFilterArrayParameter;
+class CustomFilterCompiledProgram;
+class CustomFilterMesh;
+class CustomFilterNumberParameter;
+class CustomFilterTransformParameter;
+class CustomFilterValidatedProgram;
+class GraphicsContext3D;
+
+class CustomFilterRenderer : public RefCounted<CustomFilterRenderer> {
+public:
+    static PassRefPtr<CustomFilterRenderer> create(PassRefPtr<GraphicsContext3D>, PassRefPtr<CustomFilterValidatedProgram>, const CustomFilterParameterList&,
+        unsigned meshRows, unsigned meshColumns, CustomFilterMeshBoxType, CustomFilterMeshType);
+    ~CustomFilterRenderer();
+
+    bool premultipliedAlpha() const;
+    bool programNeedsInputTexture() const;
+
+    bool prepareForDrawing();
+
+    void draw(Platform3DObject, const IntSize&);
+
+private:
+    CustomFilterRenderer(PassRefPtr<GraphicsContext3D>, PassRefPtr<CustomFilterValidatedProgram>, const CustomFilterParameterList&,
+        unsigned meshRows, unsigned meshColumns, CustomFilterMeshBoxType, CustomFilterMeshType);
+
+    void initializeCompiledProgramIfNeeded();
+    void initializeMeshIfNeeded();
+
+    void bindVertexAttribute(int attributeLocation, unsigned size, unsigned offset);
+    void unbindVertexAttribute(int attributeLocation);
+    void bindProgramArrayParameters(int uniformLocation, CustomFilterArrayParameter*);
+    void bindProgramNumberParameters(int uniformLocation, CustomFilterNumberParameter*);
+    void bindProgramTransformParameter(int uniformLocation, CustomFilterTransformParameter*);
+    void bindProgramParameters();
+    void bindProgramAndBuffers(Platform3DObject inputTexture);
+    void unbindVertexAttributes();
+
+    RefPtr<GraphicsContext3D> m_context;
+    RefPtr<CustomFilterValidatedProgram> m_validatedProgram;
+    RefPtr<CustomFilterCompiledProgram> m_compiledProgram;
+    RefPtr<CustomFilterMesh> m_mesh;
+    IntSize m_contextSize;
+
+    CustomFilterParameterList m_parameters;
+
+    unsigned m_meshRows;
+    unsigned m_meshColumns;
+    CustomFilterMeshType m_meshType;
+};
+
+} // namespace WebCore
+
+#endif // ENABLE(CSS_SHADERS) && USE(3D_GRAPHICS)
+
+#endif // CustomFilterRenderer_h
diff --git a/Source/WebCore/platform/graphics/filters/CustomFilterValidatedProgram.cpp b/Source/WebCore/platform/graphics/filters/CustomFilterValidatedProgram.cpp
index 26e8b7e5f..f5ef6cff9 100644
--- a/Source/WebCore/platform/graphics/filters/CustomFilterValidatedProgram.cpp
+++ b/Source/WebCore/platform/graphics/filters/CustomFilterValidatedProgram.cpp
@@ -34,10 +34,12 @@
 #include "CustomFilterValidatedProgram.h"
 
 #include "ANGLEWebKitBridge.h"
+#include "CustomFilterConstants.h"
 #include "CustomFilterGlobalContext.h"
 #include "CustomFilterProgramInfo.h"
 #include "NotImplemented.h"
 #include <wtf/HashMap.h>
+#include <wtf/Vector.h>
 #include <wtf/text/StringBuilder.h>
 #include <wtf/text/StringHash.h>
 
@@ -45,8 +47,6 @@ namespace WebCore {
 
 #define SHADER(Src) (#Src) 
 
-// FIXME: Reuse this type when we validate the types of built-in uniforms.
-// https://bugs.webkit.org/show_bug.cgi?id=98974
 typedef HashMap<String, ShDataType> SymbolNameToTypeMap;
 
 static SymbolNameToTypeMap* builtInAttributeNameToTypeMap()
@@ -62,7 +62,21 @@ static SymbolNameToTypeMap* builtInAttributeNameToTypeMap()
     return nameToTypeMap;
 }
 
-static bool validateSymbols(const Vector<ANGLEShaderSymbol>& symbols)
+static SymbolNameToTypeMap* builtInUniformNameToTypeMap()
+{
+    static SymbolNameToTypeMap* nameToTypeMap = 0;
+    if (!nameToTypeMap) {
+        nameToTypeMap = new SymbolNameToTypeMap;
+        nameToTypeMap->set("u_meshBox", SH_FLOAT_VEC4);
+        nameToTypeMap->set("u_meshSize", SH_FLOAT_VEC2);
+        nameToTypeMap->set("u_projectionMatrix", SH_FLOAT_MAT4);
+        nameToTypeMap->set("u_textureSize", SH_FLOAT_VEC2);
+        nameToTypeMap->set("u_tileSize", SH_FLOAT_VEC2);
+    }
+    return nameToTypeMap;
+}
+
+static bool validateSymbols(const Vector<ANGLEShaderSymbol>& symbols, CustomFilterMeshType meshType)
 {
     for (size_t i = 0; i < symbols.size(); ++i) {
         const ANGLEShaderSymbol& symbol = symbols[i];
@@ -70,16 +84,27 @@ static bool validateSymbols(const Vector<ANGLEShaderSymbol>& symbols)
         case SHADER_SYMBOL_TYPE_ATTRIBUTE: {
             SymbolNameToTypeMap* attributeNameToTypeMap = builtInAttributeNameToTypeMap();
             SymbolNameToTypeMap::iterator builtInAttribute = attributeNameToTypeMap->find(symbol.name);
-            if (builtInAttribute != attributeNameToTypeMap->end() && symbol.dataType != builtInAttribute->value) {
+            if (builtInAttribute == attributeNameToTypeMap->end()) {
+                // The author defined a custom attribute.
+                // FIXME: Report the validation error.
+                // https://bugs.webkit.org/show_bug.cgi?id=74416
+                return false;
+            }
+            if (meshType == MeshTypeAttached && symbol.name == "a_triangleCoord") {
+                // a_triangleCoord is only available for detached meshes.
+                // FIXME: Report the validation error.
+                // https://bugs.webkit.org/show_bug.cgi?id=74416
+                return false;
+            }
+            if (symbol.dataType != builtInAttribute->value) {
                 // The author defined one of the built-in attributes with the wrong type.
+                // FIXME: Report the validation error.
+                // https://bugs.webkit.org/show_bug.cgi?id=74416
                 return false;
             }
-
-            // FIXME: Return false when the attribute is not one of the built-in attributes.
-            // https://bugs.webkit.org/show_bug.cgi?id=98973
             break;
         }
-        case SHADER_SYMBOL_TYPE_UNIFORM:
+        case SHADER_SYMBOL_TYPE_UNIFORM: {
             if (symbol.isSampler()) {
                 // FIXME: For now, we restrict shaders with any sampler defined.
                 // When we implement texture parameters, we will allow shaders whose samplers are bound to valid textures.
@@ -89,9 +114,16 @@ static bool validateSymbols(const Vector<ANGLEShaderSymbol>& symbols)
                 return false;
             }
 
-            // FIXME: Validate the types of built-in uniforms.
-            // https://bugs.webkit.org/show_bug.cgi?id=98974
+            SymbolNameToTypeMap* uniformNameToTypeMap = builtInUniformNameToTypeMap();
+            SymbolNameToTypeMap::iterator builtInUniform = uniformNameToTypeMap->find(symbol.name);
+            if (builtInUniform != uniformNameToTypeMap->end() && (symbol.isArray || symbol.dataType != builtInUniform->value)) {
+                // The author defined one of the built-in uniforms with the wrong type.
+                // FIXME: Report the validation error.
+                // https://bugs.webkit.org/show_bug.cgi?id=74416
+                return false;
+            }
             break;
+        }
         default:
             ASSERT_NOT_REACHED();
             break;
@@ -153,7 +185,7 @@ CustomFilterValidatedProgram::CustomFilterValidatedProgram(CustomFilterGlobalCon
         return;
     }
 
-    if (!validateSymbols(symbols)) {
+    if (!validateSymbols(symbols, m_programInfo.meshType())) {
         // FIXME: Report validation errors.
         // https://bugs.webkit.org/show_bug.cgi?id=74416
         return;
@@ -161,7 +193,7 @@ CustomFilterValidatedProgram::CustomFilterValidatedProgram(CustomFilterGlobalCon
 
     // We need to add texture access, blending, and compositing code to shaders that are referenced from the CSS mix function.
     if (blendsElementTexture) {
-        rewriteMixVertexShader();
+        rewriteMixVertexShader(symbols);
         rewriteMixFragmentShader();
     }
 
@@ -171,26 +203,46 @@ CustomFilterValidatedProgram::CustomFilterValidatedProgram(CustomFilterGlobalCon
 PassRefPtr<CustomFilterCompiledProgram> CustomFilterValidatedProgram::compiledProgram()
 {
     ASSERT(m_isInitialized && m_globalContext && !m_validatedVertexShader.isNull() && !m_validatedFragmentShader.isNull());
-    if (!m_compiledProgram)
+    if (!m_compiledProgram) {
         m_compiledProgram = CustomFilterCompiledProgram::create(m_globalContext->context(), m_validatedVertexShader, m_validatedFragmentShader, m_programInfo.programType());
+        ASSERT(m_compiledProgram->samplerLocation() != -1 || !needsInputTexture());
+    }
     return m_compiledProgram;
 }
 
-void CustomFilterValidatedProgram::rewriteMixVertexShader()
+bool CustomFilterValidatedProgram::needsInputTexture() const
+{
+    return m_programInfo.programType() == PROGRAM_TYPE_BLENDS_ELEMENT_TEXTURE
+        && m_programInfo.mixSettings().compositeOperator != CompositeClear
+        && m_programInfo.mixSettings().compositeOperator != CompositeCopy;
+}
+
+void CustomFilterValidatedProgram::rewriteMixVertexShader(const Vector<ANGLEShaderSymbol>& symbols)
 {
     ASSERT(m_programInfo.programType() == PROGRAM_TYPE_BLENDS_ELEMENT_TEXTURE);
 
+    // If the author defined a_texCoord, we can use it to shuttle the texture coordinate to the fragment shader.
+    // Note that vertex attributes are read-only in GLSL, so the author could not have changed a_texCoord's value.
+    // Also, note that we would have already rejected the shader if the author defined a_texCoord with the wrong type.
+    bool texCoordAttributeDefined = false;
+    for (size_t i = 0; i < symbols.size(); ++i) {
+        if (symbols[i].name == "a_texCoord")
+            texCoordAttributeDefined = true;
+    }
+
+    if (!texCoordAttributeDefined)
+        m_validatedVertexShader.append("attribute mediump vec2 a_texCoord;");
+
     // During validation, ANGLE renamed the author's "main" function to "css_main".
     // We write our own "main" function and call "css_main" from it.
     // This makes rewriting easy and ensures that our code runs after all author code.
     m_validatedVertexShader.append(SHADER(
-        attribute mediump vec2 css_a_texCoord;
         varying mediump vec2 css_v_texCoord;
 
         void main()
         {
             css_main();
-            css_v_texCoord = css_a_texCoord;
+            css_v_texCoord = a_texCoord;
         }
     ));
 }
@@ -222,7 +274,7 @@ void CustomFilterValidatedProgram::rewriteMixFragmentShader()
             css_main();
             mediump vec4 originalColor = texture2D(css_u_texture, css_v_texCoord);
             mediump vec4 multipliedColor = css_ColorMatrix * originalColor;
-            mediump vec3 blendedColor = css_Blend(multipliedColor.rgb, css_MixColor.rgb);
+            mediump vec3 blendedColor = css_BlendColor(multipliedColor.rgb, css_MixColor.rgb);
             gl_FragColor = css_Composite(multipliedColor.rgb, multipliedColor.a, blendedColor.rgb, css_MixColor.a);
         }
     ));
@@ -233,36 +285,124 @@ String CustomFilterValidatedProgram::blendFunctionString(BlendMode blendMode)
 {
     // Implemented using the same symbol names as the Compositing and Blending spec:
     // https://dvcs.w3.org/hg/FXTF/rawfile/tip/compositing/index.html#blendingnormal
-    // Cs: is the source color
-    // Cb: is the backdrop color
-    const char* expression = 0;
+    // Cs: is the source color in css_BlendColor() and the source color component in css_BlendComponent()
+    // Cb: is the backdrop color in css_BlendColor() and the backdrop color component in css_BlendComponent()
+    const char* blendColorExpression = "vec3(css_BlendComponent(Cb.r, Cs.r), css_BlendComponent(Cb.g, Cs.g), css_BlendComponent(Cb.b, Cs.b))";
+    const char* blendComponentExpression = "Co = 0.0;";
     switch (blendMode) {
     case BlendModeNormal:
-        expression = "Cs";
+        blendColorExpression = "Cs";
         break;
     case BlendModeMultiply:
-        expression = "Cs * Cb";
+        blendColorExpression = "Cs * Cb";
         break;
     case BlendModeScreen:
-        expression = "Cb + Cs - (Cb * Cs)";
+        blendColorExpression = "Cb + Cs - (Cb * Cs)";
         break;
     case BlendModeDarken:
-        expression = "min(Cb, Cs)";
+        blendColorExpression = "min(Cb, Cs)";
         break;
     case BlendModeLighten:
-        expression = "max(Cb, Cs)";
+        blendColorExpression = "max(Cb, Cs)";
         break;
     case BlendModeDifference:
-        expression = "abs(Cb - Cs)";
+        blendColorExpression = "abs(Cb - Cs)";
         break;
     case BlendModeExclusion:
-        expression = "Cb + Cs - 2.0 * Cb * Cs";
+        blendColorExpression = "Cb + Cs - 2.0 * Cb * Cs";
         break;
     case BlendModeOverlay:
+        /*
+            Co = HardLight(Cs, Cb)
+               = if(Cb <= 0.5)
+                     Multiply(Cs, 2 x Cb)
+                 else
+                     Screen(Cs, 2 x Cb - 1)
+               = if(Cb <= 0.5)
+                     Cs x (2 x Cb)
+                 else
+                     Cs + (2 x Cb - 1) - (Cs x (2 x Cb - 1))
+        */
+        blendComponentExpression = SHADER(
+            if (Cb <= 0.5)
+                Co = Cs * (2.0 * Cb);
+            else
+                Co = Cs + (2.0 * Cb - 1.0) - (Cs * (2.0 * Cb - 1.0));
+        );
+        break;
     case BlendModeColorDodge:
+        /*
+            Co = if(Cs < 1)
+                     min(1, Cb / (1 - Cs))
+                 else
+                     1
+        */
+        blendComponentExpression = SHADER(
+            if (Cs < 1.0)
+                Co = min(1.0, Cb / (1.0 - Cs));
+            else
+                Co = 1.0;
+        );
+        break;
     case BlendModeColorBurn:
+        /*
+            Co = if(Cs > 0)
+                     1 - min(1, (1 - Cb) / Cs)
+                 else
+                     0
+        */
+        blendComponentExpression = SHADER(
+            if (Cs > 0.0)
+                Co = 1.0 - min(1.0, (1.0 - Cb) / Cs);
+            else
+                Co = 0.0;
+        );
+        break;
     case BlendModeHardLight:
+        /*
+            Co = if(Cs <= 0.5)
+                     Multiply(Cb, 2 x Cs)
+                 else
+                     Screen(Cb, 2 x Cs -1)
+               = if(Cs <= 0.5)
+                     Cb x (2 x Cs)
+                 else
+                     Cb + (2 x Cs - 1) - (Cb x (2 x Cs - 1))
+        */
+        blendComponentExpression = SHADER(
+            if (Cs <= 0.5)
+                Co = Cb * (2.0 * Cs);
+            else
+                Co = Cb + (2.0 * Cs - 1.0) - (Cb * (2.0 * Cs - 1.0));
+        );
+        break;
     case BlendModeSoftLight:
+        /*
+            Co = if(Cs <= 0.5)
+                     Cb - (1 - 2 x Cs) x Cb x (1 - Cb)
+                 else
+                     Cb + (2 x Cs - 1) x (D(Cb) - Cb)
+
+            with
+
+            D(Cb) = if(Cb <= 0.25)
+                        (16 * Cb - 12) x Cb + 4) x Cb
+                    else
+                        sqrt(Cb)
+        */
+        blendComponentExpression = SHADER(
+            mediump float D;
+            if (Cb <= 0.25)
+                D = ((16.0 * Cb - 12.0) * Cb + 4.0) * Cb;
+            else
+                D = sqrt(Cb);
+
+            if (Cs <= 0.5)
+                Co = Cb - (1.0 - 2.0 * Cs) * Cb * (1.0 - Cb);
+            else
+                Co = Cb + (2.0 * Cs - 1.0) * (D - Cb);
+        );
+        break;
     case BlendModeHue:
     case BlendModeSaturation:
     case BlendModeColor:
@@ -271,13 +411,18 @@ String CustomFilterValidatedProgram::blendFunctionString(BlendMode blendMode)
         return String();
     }
 
-    ASSERT(expression);
     return String::format(SHADER(
-        mediump vec3 css_Blend(mediump vec3 Cb, mediump vec3 Cs)
+        mediump float css_BlendComponent(mediump float Cb, mediump float Cs)
+        {
+            mediump float Co;
+            %s
+            return Co;
+        }
+        mediump vec3 css_BlendColor(mediump vec3 Cb, mediump vec3 Cs)
         {
             return %s;
         }
-    ), expression);
+    ), blendComponentExpression, blendColorExpression);
 }
 
 String CustomFilterValidatedProgram::compositeFunctionString(CompositeOperator compositeOperator)
@@ -298,15 +443,45 @@ String CustomFilterValidatedProgram::compositeFunctionString(CompositeOperator c
         Fb = "1.0 - as";
         break;
     case CompositeClear:
+        Fa = "0.0";
+        Fb = "0.0";
+        break;
     case CompositeCopy:
+        Fa = "1.0";
+        Fb = "0.0";
+        break;
     case CompositeSourceOver:
+        Fa = "1.0";
+        Fb = "1.0 - as";
+        break;
     case CompositeSourceIn:
+        Fa = "ab";
+        Fb = "0.0";
+        break;
     case CompositeSourceOut:
+        Fa = "1.0 - ab";
+        Fb = "0.0";
+        break;
     case CompositeDestinationOver:
+        Fa = "1.0 - ab";
+        Fb = "1.0";
+        break;
     case CompositeDestinationIn:
+        Fa = "0.0";
+        Fb = "as";
+        break;
     case CompositeDestinationOut:
+        Fa = "0.0";
+        Fb = "1.0 - as";
+        break;
     case CompositeDestinationAtop:
+        Fa = "1.0 - ab";
+        Fb = "as";
+        break;
     case CompositeXOR:
+        Fa = "1.0 - ab";
+        Fb = "1.0 - as";
+        break;
     case CompositePlusLighter:
         notImplemented();
         return String();
diff --git a/Source/WebCore/platform/graphics/filters/CustomFilterValidatedProgram.h b/Source/WebCore/platform/graphics/filters/CustomFilterValidatedProgram.h
index 610884d6e..b722ac35c 100644
--- a/Source/WebCore/platform/graphics/filters/CustomFilterValidatedProgram.h
+++ b/Source/WebCore/platform/graphics/filters/CustomFilterValidatedProgram.h
@@ -49,7 +49,7 @@ typedef WebCore::LayerCompiledProgram PlatformCompiledProgram;
 
 namespace WebCore {
 
-class ANGLEWebKitBridge;
+struct ANGLEShaderSymbol;
 class CustomFilterCompiledProgram;
 class CustomFilterGlobalContext;
 
@@ -100,9 +100,11 @@ private:
     static String blendFunctionString(BlendMode);
     static String compositeFunctionString(CompositeOperator);
 
-    void rewriteMixVertexShader();
+    void rewriteMixVertexShader(const Vector<ANGLEShaderSymbol>& symbols);
     void rewriteMixFragmentShader();
 
+    bool needsInputTexture() const;
+
     CustomFilterGlobalContext* m_globalContext;
     CustomFilterProgramInfo m_programInfo;
 
diff --git a/Source/WebCore/platform/graphics/filters/FEBlend.h b/Source/WebCore/platform/graphics/filters/FEBlend.h
index e58c8a3d0..5c71c2b72 100644
--- a/Source/WebCore/platform/graphics/filters/FEBlend.h
+++ b/Source/WebCore/platform/graphics/filters/FEBlend.h
@@ -51,6 +51,7 @@ public:
                            unsigned colorArrayLength);
 #if USE(SKIA)
     virtual bool platformApplySkia();
+    virtual SkImageFilter* createImageFilter(SkiaImageFilterBuilder*);
 #endif
 
     virtual void platformApplySoftware();
diff --git a/Source/WebCore/platform/graphics/filters/FEColorMatrix.h b/Source/WebCore/platform/graphics/filters/FEColorMatrix.h
index 27a4ac843..99b650b9c 100644
--- a/Source/WebCore/platform/graphics/filters/FEColorMatrix.h
+++ b/Source/WebCore/platform/graphics/filters/FEColorMatrix.h
@@ -51,6 +51,7 @@ public:
     virtual void platformApplySoftware();
 #if USE(SKIA)
     virtual bool platformApplySkia();
+    virtual SkImageFilter* createImageFilter(SkiaImageFilterBuilder*);
 #endif
     virtual void dump();
 
diff --git a/Source/WebCore/platform/graphics/filters/FEComponentTransfer.h b/Source/WebCore/platform/graphics/filters/FEComponentTransfer.h
index 18183e6cc..68454fd35 100644
--- a/Source/WebCore/platform/graphics/filters/FEComponentTransfer.h
+++ b/Source/WebCore/platform/graphics/filters/FEComponentTransfer.h
@@ -81,6 +81,7 @@ public:
     virtual void platformApplySoftware();
 #if USE(SKIA)
     virtual bool platformApplySkia();
+    virtual SkImageFilter* createImageFilter(SkiaImageFilterBuilder*);
 #endif
     virtual void dump();
 
diff --git a/Source/WebCore/platform/graphics/filters/FECustomFilter.cpp b/Source/WebCore/platform/graphics/filters/FECustomFilter.cpp
index 707edb866..45a110fb2 100644
--- a/Source/WebCore/platform/graphics/filters/FECustomFilter.cpp
+++ b/Source/WebCore/platform/graphics/filters/FECustomFilter.cpp
@@ -33,61 +33,22 @@
 #if ENABLE(CSS_SHADERS) && USE(3D_GRAPHICS)
 #include "FECustomFilter.h"
 
-#include "CustomFilterArrayParameter.h"
-#include "CustomFilterCompiledProgram.h"
-#include "CustomFilterConstants.h"
-#include "CustomFilterGlobalContext.h"
-#include "CustomFilterMesh.h"
-#include "CustomFilterNumberParameter.h"
-#include "CustomFilterParameter.h"
-#include "CustomFilterProgram.h"
-#include "CustomFilterTransformParameter.h"
+#include "CustomFilterRenderer.h"
 #include "CustomFilterValidatedProgram.h"
-#include "DrawingBuffer.h"
 #include "Extensions3D.h"
 #include "GraphicsContext3D.h"
-#include "ImageData.h"
-#include "NotImplemented.h"
 #include "RenderTreeAsText.h"
 #include "TextStream.h"
-#include "TilingData.h"
-#include "TransformationMatrix.h"
 
 #include <wtf/Uint8ClampedArray.h>
 
 namespace WebCore {
 
-static const int kMaxSampleCount = 4;
-
-static void orthogonalProjectionMatrix(TransformationMatrix& matrix, float left, float right, float bottom, float top)
-{
-    ASSERT(matrix.isIdentity());
-    
-    float deltaX = right - left;
-    float deltaY = top - bottom;
-    if (!deltaX || !deltaY)
-        return;
-    matrix.setM11(2.0f / deltaX);
-    matrix.setM41(-(right + left) / deltaX);
-    matrix.setM22(2.0f / deltaY);
-    matrix.setM42(-(top + bottom) / deltaY);
-
-    // Use big enough near/far values, so that simple rotations of rather large objects will not
-    // get clipped. 10000 should cover most of the screen resolutions.
-    const float farValue = 10000;
-    const float nearValue = -10000;
-    matrix.setM33(-2.0f / (farValue - nearValue));
-    matrix.setM43(- (farValue + nearValue) / (farValue - nearValue));
-    matrix.setM44(1.0f);
-}
-
-FECustomFilter::FECustomFilter(Filter* filter, CustomFilterGlobalContext* customFilterGlobalContext, PassRefPtr<CustomFilterValidatedProgram> validatedProgram, const CustomFilterParameterList& parameters,
-                               unsigned meshRows, unsigned meshColumns, CustomFilterOperation::MeshBoxType,
-                               CustomFilterOperation::MeshType meshType)
+FECustomFilter::FECustomFilter(Filter* filter, PassRefPtr<GraphicsContext3D> context, PassRefPtr<CustomFilterValidatedProgram> validatedProgram, const CustomFilterParameterList& parameters,
+    unsigned meshRows, unsigned meshColumns, CustomFilterMeshBoxType meshBoxType, CustomFilterMeshType meshType)
     : FilterEffect(filter)
-    , m_globalContext(customFilterGlobalContext)
-    , m_validatedProgram(validatedProgram)
-    , m_compiledProgram(0) // Don't compile the program unless we need to paint.
+    , m_context(context)
+    , m_customFilterRenderer(CustomFilterRenderer::create(m_context, validatedProgram, parameters, meshRows, meshColumns, meshBoxType, meshType))
     , m_inputTexture(0)
     , m_frameBuffer(0)
     , m_depthBuffer(0)
@@ -96,20 +57,13 @@ FECustomFilter::FECustomFilter(Filter* filter, CustomFilterGlobalContext* custom
     , m_multisampleFrameBuffer(0)
     , m_multisampleRenderBuffer(0)
     , m_multisampleDepthBuffer(0)
-    , m_parameters(parameters)
-    , m_meshRows(meshRows)
-    , m_meshColumns(meshColumns)
-    , m_meshType(meshType)
 {
-    // An FECustomFilter shouldn't have been created unless the program passed validation.
-    ASSERT(m_validatedProgram->isInitialized());
 }
 
-PassRefPtr<FECustomFilter> FECustomFilter::create(Filter* filter, CustomFilterGlobalContext* customFilterGlobalContext, PassRefPtr<CustomFilterValidatedProgram> validatedProgram, const CustomFilterParameterList& parameters,
-                                           unsigned meshRows, unsigned meshColumns, CustomFilterOperation::MeshBoxType meshBoxType,
-                                           CustomFilterOperation::MeshType meshType)
+PassRefPtr<FECustomFilter> FECustomFilter::create(Filter* filter, PassRefPtr<GraphicsContext3D> context, PassRefPtr<CustomFilterValidatedProgram> validatedProgram, const CustomFilterParameterList& parameters,
+    unsigned meshRows, unsigned meshColumns, CustomFilterMeshBoxType meshBoxType, CustomFilterMeshType meshType)
 {
-    return adoptRef(new FECustomFilter(filter, customFilterGlobalContext, validatedProgram, parameters, meshRows, meshColumns, meshBoxType, meshType));
+    return adoptRef(new FECustomFilter(filter, context, validatedProgram, parameters, meshRows, meshColumns, meshBoxType, meshType));
 }
 
 FECustomFilter::~FECustomFilter()
@@ -119,8 +73,7 @@ FECustomFilter::~FECustomFilter()
 
 void FECustomFilter::deleteRenderBuffers()
 {
-    if (!m_context)
-        return;
+    ASSERT(m_context);
     m_context->makeContextCurrent();
     if (m_inputTexture) {
         m_context->deleteTexture(m_inputTexture);
@@ -187,45 +140,33 @@ void FECustomFilter::drawFilterMesh(Platform3DObject inputTexture)
     bool multisample = canUseMultisampleBuffers();
     m_context->bindFramebuffer(GraphicsContext3D::FRAMEBUFFER, multisample ? m_multisampleFrameBuffer : m_frameBuffer);
     m_context->viewport(0, 0, m_contextSize.width(), m_contextSize.height());
-    
+
     m_context->clearColor(0, 0, 0, 0);
     m_context->clear(GraphicsContext3D::COLOR_BUFFER_BIT | GraphicsContext3D::DEPTH_BUFFER_BIT);
-    
-    bindProgramAndBuffers(inputTexture);
-    m_context->drawElements(GraphicsContext3D::TRIANGLES, m_mesh->indicesCount(), GraphicsContext3D::UNSIGNED_SHORT, 0);
-    unbindVertexAttributes();
+
+    m_customFilterRenderer->draw(inputTexture, m_contextSize);
 
     if (multisample)
         resolveMultisampleBuffer();
 }
 
-bool FECustomFilter::prepareForDrawing(CustomFilterDrawType filterDrawType)
+bool FECustomFilter::prepareForDrawing()
 {
-    if (!m_context && !initializeContext())
-        return false;
     m_context->makeContextCurrent();
 
-    // If the shader had compiler errors we cannot draw anything.
-    if (!m_compiledProgram->isInitialized())
+    if (!m_customFilterRenderer->prepareForDrawing())
         return false;
-    
+
     // Only allocate a texture if the program needs one and the caller doesn't allocate one by itself.
-    if ((programNeedsInputTexture() && (filterDrawType == NEEDS_INPUT_TEXTURE) && !ensureInputTexture())
-        || !ensureFrameBuffer())
+    if ((m_customFilterRenderer->programNeedsInputTexture() && !ensureInputTexture()) || !ensureFrameBuffer())
         return false;
-    
-    return true;
-}
 
-bool FECustomFilter::programNeedsInputTexture() const
-{
-    ASSERT(m_compiledProgram.get());
-    return m_compiledProgram->samplerLocation() != -1;
+    return true;
 }
 
 bool FECustomFilter::applyShader()
 {
-    Uint8ClampedArray* dstPixelArray = m_validatedProgram->programInfo().programType() == PROGRAM_TYPE_BLENDS_ELEMENT_TEXTURE ? createPremultipliedImageResult() : createUnmultipliedImageResult();
+    Uint8ClampedArray* dstPixelArray = m_customFilterRenderer->premultipliedAlpha() ? createPremultipliedImageResult() : createUnmultipliedImageResult();
     if (!dstPixelArray)
         return false;
 
@@ -238,7 +179,7 @@ bool FECustomFilter::applyShader()
     if (!resizeContextIfNeeded(newContextSize))
         return false;
 
-    bool needsInputTexture = programNeedsInputTexture();
+    bool needsInputTexture = m_customFilterRenderer->programNeedsInputTexture();
     if (needsInputTexture) {
         RefPtr<Uint8ClampedArray> srcPixelArray = in->asUnmultipliedImage(effectDrawingRect);
         uploadInputTexture(srcPixelArray.get());
@@ -251,25 +192,6 @@ bool FECustomFilter::applyShader()
     return true;
 }
 
-bool FECustomFilter::initializeContext()
-{
-    ASSERT(!m_context.get());
-    m_context = m_globalContext->context();
-    if (!m_context)
-        return false;
-    m_context->makeContextCurrent();
-    m_compiledProgram = m_validatedProgram->compiledProgram();
-
-    // FIXME: Sharing the mesh would just save the time needed to upload it to the GPU, so I assume we could
-    // benchmark that for performance.
-    // https://bugs.webkit.org/show_bug.cgi?id=88429
-    m_mesh = CustomFilterMesh::create(m_context.get(), m_meshColumns, m_meshRows, 
-                                      FloatRect(0, 0, 1, 1),
-                                      m_meshType);
-
-    return true;
-}
-
 bool FECustomFilter::ensureInputTexture()
 {
     if (!m_inputTexture)
@@ -332,7 +254,7 @@ void FECustomFilter::resolveMultisampleBuffer()
 
     m_context->bindFramebuffer(Extensions3D::READ_FRAMEBUFFER, 0);
     m_context->bindFramebuffer(Extensions3D::DRAW_FRAMEBUFFER, 0);
-    
+
     m_context->bindFramebuffer(GraphicsContext3D::FRAMEBUFFER, m_frameBuffer);
 }
 
@@ -344,11 +266,12 @@ bool FECustomFilter::canUseMultisampleBuffers() const
 bool FECustomFilter::resizeMultisampleBuffers(const IntSize& newContextSize)
 {
     if (!m_triedMultisampleBuffer && !createMultisampleBuffer())
-         return false;
- 
+        return false;
+
     if (!canUseMultisampleBuffers())
         return false;
 
+    static const int kMaxSampleCount = 4;
     int maxSupportedSampleCount = 0;
     m_context->getIntegerv(Extensions3D::MAX_SAMPLES, &maxSupportedSampleCount);
     int sampleCount = std::min(kMaxSampleCount, maxSupportedSampleCount);
@@ -359,7 +282,7 @@ bool FECustomFilter::resizeMultisampleBuffers(const IntSize& newContextSize)
 
     Extensions3D* extensions = m_context->getExtensions();
     ASSERT(extensions);
-    
+
     m_context->bindFramebuffer(GraphicsContext3D::FRAMEBUFFER, m_multisampleFrameBuffer);
 
     m_context->bindRenderbuffer(GraphicsContext3D::RENDERBUFFER, m_multisampleRenderBuffer);
@@ -409,7 +332,7 @@ bool FECustomFilter::resizeContext(const IntSize& newContextSize)
     m_context->texImage2DDirect(GraphicsContext3D::TEXTURE_2D, 0, GraphicsContext3D::RGBA, newContextSize.width(), newContextSize.height(), 0, GraphicsContext3D::RGBA, GraphicsContext3D::UNSIGNED_BYTE, 0);
 #endif
     m_context->framebufferTexture2D(GraphicsContext3D::FRAMEBUFFER, GraphicsContext3D::COLOR_ATTACHMENT0, GraphicsContext3D::TEXTURE_2D, m_destTexture, 0);
- 
+
     // We don't need the depth buffer for the texture framebuffer, if we already
     // have a multisample buffer.
     if (!multisample) {
@@ -428,171 +351,11 @@ bool FECustomFilter::resizeContext(const IntSize& newContextSize)
     }
 
     m_context->bindRenderbuffer(GraphicsContext3D::RENDERBUFFER, 0);
-    
+
     m_contextSize = newContextSize;
     return true;
 }
 
-void FECustomFilter::bindVertexAttribute(int attributeLocation, unsigned size, unsigned offset)
-{
-    if (attributeLocation != -1) {
-        m_context->vertexAttribPointer(attributeLocation, size, GraphicsContext3D::FLOAT, false, m_mesh->bytesPerVertex(), offset);
-        m_context->enableVertexAttribArray(attributeLocation);
-    }
-}
-
-void FECustomFilter::unbindVertexAttribute(int attributeLocation)
-{
-    if (attributeLocation != -1)
-        m_context->disableVertexAttribArray(attributeLocation);
-}
-
-void FECustomFilter::bindProgramArrayParameters(int uniformLocation, CustomFilterArrayParameter* arrayParameter)
-{
-    unsigned parameterSize = arrayParameter->size();
-    Vector<GC3Dfloat> floatVector;
-
-    for (unsigned i = 0; i < parameterSize; ++i)
-        floatVector.append(arrayParameter->valueAt(i));
-
-    m_context->uniform1fv(uniformLocation, parameterSize, floatVector.data());
-}
-
-void FECustomFilter::bindProgramNumberParameters(int uniformLocation, CustomFilterNumberParameter* numberParameter)
-{
-    switch (numberParameter->size()) {
-    case 1:
-        m_context->uniform1f(uniformLocation, numberParameter->valueAt(0));
-        break;
-    case 2:
-        m_context->uniform2f(uniformLocation, numberParameter->valueAt(0), numberParameter->valueAt(1));
-        break;
-    case 3:
-        m_context->uniform3f(uniformLocation, numberParameter->valueAt(0), numberParameter->valueAt(1), numberParameter->valueAt(2));
-        break;
-    case 4:
-        m_context->uniform4f(uniformLocation, numberParameter->valueAt(0), numberParameter->valueAt(1), numberParameter->valueAt(2), numberParameter->valueAt(3));
-        break;
-    default:
-        ASSERT_NOT_REACHED();
-    }
-}
-
-void FECustomFilter::bindProgramTransformParameter(int uniformLocation, CustomFilterTransformParameter* transformParameter)
-{
-    TransformationMatrix matrix;
-    if (m_contextSize.width() && m_contextSize.height()) {
-        // The viewport is a box with the size of 1 unit, so we are scalling up here to make sure that translations happen using real pixel
-        // units. At the end we scale back down in order to map it back to the original box. Note that transforms come in reverse order, because it is 
-        // supposed to multiply to the left of the coordinates of the vertices.
-        // Note that the origin (0, 0) of the viewport is in the middle of the context, so there's no need to change the origin of the transform
-        // in order to rotate around the middle of mesh.
-        matrix.scale3d(1.0 / m_contextSize.width(), 1.0 / m_contextSize.height(), 1);
-        transformParameter->applyTransform(matrix, m_contextSize);
-        matrix.scale3d(m_contextSize.width(), m_contextSize.height(), 1);
-    }
-    float glMatrix[16];
-    matrix.toColumnMajorFloatArray(glMatrix);
-    m_context->uniformMatrix4fv(uniformLocation, 1, false, &glMatrix[0]);
-}
-
-void FECustomFilter::bindProgramParameters()
-{
-    // FIXME: Find a way to reset uniforms that are not specified in CSS. This is needed to avoid using values
-    // set by other previous rendered filters.
-    // https://bugs.webkit.org/show_bug.cgi?id=76440
-    
-    size_t parametersSize = m_parameters.size();
-    for (size_t i = 0; i < parametersSize; ++i) {
-        CustomFilterParameter* parameter = m_parameters.at(i).get();
-        int uniformLocation = m_compiledProgram->uniformLocationByName(parameter->name());
-        if (uniformLocation == -1)
-            continue;
-        switch (parameter->parameterType()) {
-        case CustomFilterParameter::ARRAY:
-            bindProgramArrayParameters(uniformLocation, static_cast<CustomFilterArrayParameter*>(parameter));
-            break;
-        case CustomFilterParameter::NUMBER:
-            bindProgramNumberParameters(uniformLocation, static_cast<CustomFilterNumberParameter*>(parameter));
-            break;
-        case CustomFilterParameter::TRANSFORM:
-            bindProgramTransformParameter(uniformLocation, static_cast<CustomFilterTransformParameter*>(parameter));
-            break;
-        }
-    }
-}
-
-void FECustomFilter::bindProgramAndBuffers(Platform3DObject inputTexture)
-{
-    ASSERT(m_compiledProgram->isInitialized());
-
-    m_context->useProgram(m_compiledProgram->program());
-    
-    if (programNeedsInputTexture()) {
-        // We should be binding the DOM element texture sampler only if the author is using the CSS mix function.
-        ASSERT(m_validatedProgram->programInfo().programType() == PROGRAM_TYPE_BLENDS_ELEMENT_TEXTURE);
-        ASSERT(m_compiledProgram->samplerLocation() != -1);
-
-        m_context->activeTexture(GraphicsContext3D::TEXTURE0);
-        m_context->uniform1i(m_compiledProgram->samplerLocation(), 0);
-        m_context->bindTexture(GraphicsContext3D::TEXTURE_2D, inputTexture);
-        m_context->texParameteri(GraphicsContext3D::TEXTURE_2D, GraphicsContext3D::TEXTURE_MIN_FILTER, GraphicsContext3D::LINEAR);
-        m_context->texParameteri(GraphicsContext3D::TEXTURE_2D, GraphicsContext3D::TEXTURE_MAG_FILTER, GraphicsContext3D::LINEAR);
-        m_context->texParameteri(GraphicsContext3D::TEXTURE_2D, GraphicsContext3D::TEXTURE_WRAP_S, GraphicsContext3D::CLAMP_TO_EDGE);
-        m_context->texParameteri(GraphicsContext3D::TEXTURE_2D, GraphicsContext3D::TEXTURE_WRAP_T, GraphicsContext3D::CLAMP_TO_EDGE);
-    }
-    
-    if (m_compiledProgram->projectionMatrixLocation() != -1) {
-        TransformationMatrix projectionMatrix; 
-        orthogonalProjectionMatrix(projectionMatrix, -0.5, 0.5, -0.5, 0.5);
-        float glProjectionMatrix[16];
-        projectionMatrix.toColumnMajorFloatArray(glProjectionMatrix);
-        m_context->uniformMatrix4fv(m_compiledProgram->projectionMatrixLocation(), 1, false, &glProjectionMatrix[0]);
-    }
-
-    ASSERT(m_meshColumns);
-    ASSERT(m_meshRows);
-
-    if (m_compiledProgram->meshSizeLocation() != -1)
-        m_context->uniform2f(m_compiledProgram->meshSizeLocation(), m_meshColumns, m_meshRows);
-
-    if (m_compiledProgram->tileSizeLocation() != -1)
-        m_context->uniform2f(m_compiledProgram->tileSizeLocation(), 1.0 / m_meshColumns, 1.0 / m_meshRows);
-
-    if (m_compiledProgram->meshBoxLocation() != -1) {
-        // FIXME: This will change when filter margins will be implemented,
-        // see https://bugs.webkit.org/show_bug.cgi?id=71400
-        m_context->uniform4f(m_compiledProgram->meshBoxLocation(), -0.5, -0.5, 1.0, 1.0);
-    }
-
-    if (m_compiledProgram->samplerSizeLocation() != -1)
-        m_context->uniform2f(m_compiledProgram->samplerSizeLocation(), m_contextSize.width(), m_contextSize.height());
-    
-    m_context->bindBuffer(GraphicsContext3D::ARRAY_BUFFER, m_mesh->verticesBufferObject());
-    m_context->bindBuffer(GraphicsContext3D::ELEMENT_ARRAY_BUFFER, m_mesh->elementsBufferObject());
-
-    bindVertexAttribute(m_compiledProgram->positionAttribLocation(), PositionAttribSize, PositionAttribOffset);
-    bindVertexAttribute(m_compiledProgram->texAttribLocation(), TexAttribSize, TexAttribOffset);
-    // FIXME: Get rid of the internal tex coord attribute "css_a_texCoord". 
-    // https://bugs.webkit.org/show_bug.cgi?id=94358
-    bindVertexAttribute(m_compiledProgram->internalTexCoordAttribLocation(), TexAttribSize, TexAttribOffset);
-    bindVertexAttribute(m_compiledProgram->meshAttribLocation(), MeshAttribSize, MeshAttribOffset);
-    if (m_meshType == CustomFilterOperation::DETACHED)
-        bindVertexAttribute(m_compiledProgram->triangleAttribLocation(), TriangleAttribSize, TriangleAttribOffset);
-    
-    bindProgramParameters();
-}
-
-void FECustomFilter::unbindVertexAttributes()
-{
-    unbindVertexAttribute(m_compiledProgram->positionAttribLocation());
-    unbindVertexAttribute(m_compiledProgram->texAttribLocation());
-    unbindVertexAttribute(m_compiledProgram->internalTexCoordAttribLocation());
-    unbindVertexAttribute(m_compiledProgram->meshAttribLocation());
-    if (m_meshType == CustomFilterOperation::DETACHED)
-        unbindVertexAttribute(m_compiledProgram->triangleAttribLocation());
-}
-
 void FECustomFilter::dump()
 {
 }
diff --git a/Source/WebCore/platform/graphics/filters/FECustomFilter.h b/Source/WebCore/platform/graphics/filters/FECustomFilter.h
index 09da5f1c7..44e68f1ca 100644
--- a/Source/WebCore/platform/graphics/filters/FECustomFilter.h
+++ b/Source/WebCore/platform/graphics/filters/FECustomFilter.h
@@ -32,6 +32,7 @@
 
 #if ENABLE(CSS_SHADERS) && USE(3D_GRAPHICS)
 
+#include "CustomFilterConstants.h"
 #include "CustomFilterOperation.h"
 #include "Filter.h"
 #include "FilterEffect.h"
@@ -44,23 +45,15 @@ class Uint8ClampedArray;
 
 namespace WebCore {
 
-class CachedShader;
-class CustomFilterArrayParameter;
-class CustomFilterCompiledProgram;
-class CustomFilterGlobalContext;
-class CustomFilterMesh;
-class CustomFilterNumberParameter;
-class CustomFilterTransformParameter;
+class CustomFilterRenderer;
 class CustomFilterValidatedProgram;
-class DrawingBuffer;
 class GraphicsContext3D;
 class IntSize;
 
 class FECustomFilter : public FilterEffect {
 public:
-    static PassRefPtr<FECustomFilter> create(Filter*, CustomFilterGlobalContext*, PassRefPtr<CustomFilterValidatedProgram>, const CustomFilterParameterList&,
-                   unsigned meshRows, unsigned meshColumns, CustomFilterOperation::MeshBoxType, 
-                   CustomFilterOperation::MeshType);
+    static PassRefPtr<FECustomFilter> create(Filter*, PassRefPtr<GraphicsContext3D>, PassRefPtr<CustomFilterValidatedProgram>, const CustomFilterParameterList&,
+        unsigned meshRows, unsigned meshColumns, CustomFilterMeshBoxType, CustomFilterMeshType);
 
     virtual void platformApplySoftware();
     virtual void dump();
@@ -68,23 +61,17 @@ public:
     virtual TextStream& externalRepresentation(TextStream&, int indention) const;
 
 private:
-    FECustomFilter(Filter*, CustomFilterGlobalContext*, PassRefPtr<CustomFilterValidatedProgram>, const CustomFilterParameterList&,
-                   unsigned meshRows, unsigned meshColumns, CustomFilterOperation::MeshBoxType, 
-                   CustomFilterOperation::MeshType);
+    FECustomFilter(Filter*, PassRefPtr<GraphicsContext3D>, PassRefPtr<CustomFilterValidatedProgram>, const CustomFilterParameterList&,
+        unsigned meshRows, unsigned meshColumns, CustomFilterMeshBoxType, CustomFilterMeshType);
     ~FECustomFilter();
-    
+
     bool applyShader();
     void clearShaderResult();
     bool initializeContext();
-    
-    enum CustomFilterDrawType {
-        NEEDS_INPUT_TEXTURE,
-        NO_INPUT_TEXTURE
-    };
-    bool prepareForDrawing(CustomFilterDrawType = NEEDS_INPUT_TEXTURE);
+
+    bool prepareForDrawing();
 
     void drawFilterMesh(Platform3DObject inputTexture);
-    bool programNeedsInputTexture() const;
     bool ensureInputTexture();
     void uploadInputTexture(Uint8ClampedArray* srcPixelArray);
     bool resizeContextIfNeeded(const IntSize&);
@@ -99,22 +86,8 @@ private:
     bool ensureFrameBuffer();
     void deleteRenderBuffers();
 
-    void bindVertexAttribute(int attributeLocation, unsigned size, unsigned offset);
-    void unbindVertexAttribute(int attributeLocation);
-    void bindProgramArrayParameters(int uniformLocation, CustomFilterArrayParameter*);
-    void bindProgramNumberParameters(int uniformLocation, CustomFilterNumberParameter*);
-    void bindProgramTransformParameter(int uniformLocation, CustomFilterTransformParameter*);
-    void bindProgramParameters();
-    void bindProgramAndBuffers(Platform3DObject inputTexture);
-    void unbindVertexAttributes();
-    
-    // No need to keep a reference here. It is owned by the RenderView.
-    CustomFilterGlobalContext* m_globalContext;
-    
     RefPtr<GraphicsContext3D> m_context;
-    RefPtr<CustomFilterValidatedProgram> m_validatedProgram;
-    RefPtr<CustomFilterCompiledProgram> m_compiledProgram;
-    RefPtr<CustomFilterMesh> m_mesh;
+    RefPtr<CustomFilterRenderer> m_customFilterRenderer;
     IntSize m_contextSize;
 
     Platform3DObject m_inputTexture;
@@ -126,12 +99,6 @@ private:
     Platform3DObject m_multisampleFrameBuffer;
     Platform3DObject m_multisampleRenderBuffer;
     Platform3DObject m_multisampleDepthBuffer;
-
-    CustomFilterParameterList m_parameters;
-
-    unsigned m_meshRows;
-    unsigned m_meshColumns;
-    CustomFilterOperation::MeshType m_meshType;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/platform/graphics/filters/FEGaussianBlur.h b/Source/WebCore/platform/graphics/filters/FEGaussianBlur.h
index 7b3bdce29..daf3ef17a 100644
--- a/Source/WebCore/platform/graphics/filters/FEGaussianBlur.h
+++ b/Source/WebCore/platform/graphics/filters/FEGaussianBlur.h
@@ -75,6 +75,7 @@ private:
     inline void platformApplyGeneric(Uint8ClampedArray* srcPixelArray, Uint8ClampedArray* tmpPixelArray, unsigned kernelSizeX, unsigned kernelSizeY, IntSize& paintSize);
 #if USE(SKIA)
     virtual bool platformApplySkia();
+    virtual SkImageFilter* createImageFilter(SkiaImageFilterBuilder*);
 #endif
 
     float m_stdX;
diff --git a/Source/WebCore/platform/graphics/filters/FELighting.h b/Source/WebCore/platform/graphics/filters/FELighting.h
index 4487835e8..288985d42 100644
--- a/Source/WebCore/platform/graphics/filters/FELighting.h
+++ b/Source/WebCore/platform/graphics/filters/FELighting.h
@@ -47,6 +47,7 @@ class FELighting : public FilterEffect {
 public:
     virtual void platformApplySoftware();
 #if USE(SKIA)
+    virtual SkImageFilter* createImageFilter(SkiaImageFilterBuilder*);
     virtual bool platformApplySkia();
 #endif
 
diff --git a/Source/WebCore/platform/graphics/filters/FEMorphology.h b/Source/WebCore/platform/graphics/filters/FEMorphology.h
index 19da635a2..b38e673c3 100644
--- a/Source/WebCore/platform/graphics/filters/FEMorphology.h
+++ b/Source/WebCore/platform/graphics/filters/FEMorphology.h
@@ -49,6 +49,8 @@ public:
     virtual void platformApplySoftware();
 #if USE(SKIA)
     virtual bool platformApplySkia();
+    virtual SkImageFilter* createImageFilter(SkiaImageFilterBuilder*);
+
 #endif
     virtual void dump();
 
diff --git a/Source/WebCore/platform/graphics/filters/FilterEffect.h b/Source/WebCore/platform/graphics/filters/FilterEffect.h
index 1620abf1e..069ede3ee 100644
--- a/Source/WebCore/platform/graphics/filters/FilterEffect.h
+++ b/Source/WebCore/platform/graphics/filters/FilterEffect.h
@@ -35,6 +35,10 @@
 
 static const float kMaxFilterSize = 5000.0f;
 
+#if USE(SKIA)
+class SkImageFilter;
+#endif
+
 namespace WebCore {
 
 class Filter;
@@ -42,6 +46,10 @@ class FilterEffect;
 class ImageBuffer;
 class TextStream;
 
+#if USE(SKIA)
+class SkiaImageFilterBuilder;
+#endif
+
 typedef Vector<RefPtr<FilterEffect> > FilterEffectVector;
 
 enum FilterEffectType {
@@ -95,6 +103,7 @@ public:
     virtual void platformApplySoftware() = 0;
 #if USE(SKIA)
     virtual bool platformApplySkia() { return false; }
+    virtual SkImageFilter* createImageFilter(SkiaImageFilterBuilder*) { return 0; }
 #endif
     virtual void dump() = 0;
 
diff --git a/Source/WebCore/platform/graphics/filters/FilterOperation.h b/Source/WebCore/platform/graphics/filters/FilterOperation.h
index 6d2503ac3..906706bea 100644
--- a/Source/WebCore/platform/graphics/filters/FilterOperation.h
+++ b/Source/WebCore/platform/graphics/filters/FilterOperation.h
@@ -29,6 +29,7 @@
 #if ENABLE(CSS_FILTERS)
 
 #include "Color.h"
+#include "FilterEffect.h"
 #include "LayoutTypes.h"
 #include "Length.h"
 #include <wtf/OwnPtr.h>
@@ -69,6 +70,7 @@ public:
         DROP_SHADOW,
 #if ENABLE(CSS_SHADERS)
         CUSTOM,
+        VALIDATED_CUSTOM,
 #endif
         PASSTHROUGH,
         NONE
@@ -161,14 +163,21 @@ public:
         return adoptRef(new ReferenceFilterOperation(url, fragment, type));
     }
 
+    class Data {
+    public:
+        virtual ~Data() { }
+    };
+
     virtual bool affectsOpacity() const { return true; }
     virtual bool movesPixels() const { return true; }
 
     const String& url() const { return m_url; }
     const String& fragment() const { return m_fragment; }
 
-    void* data() const { return m_data; }
-    void setData(void* data) { m_data = data; }
+    Data* data() const { return m_data.get(); }
+    void setData(PassOwnPtr<Data> data) { m_data = data; }
+    FilterEffect* filterEffect() const { return m_filterEffect.get(); }
+    void setFilterEffect(PassRefPtr<FilterEffect> filterEffect) { m_filterEffect = filterEffect; }
 
 private:
 
@@ -184,13 +193,13 @@ private:
         : FilterOperation(type)
         , m_url(url)
         , m_fragment(fragment)
-        , m_data(0)
     {
     }
 
     String m_url;
     String m_fragment;
-    void* m_data;
+    OwnPtr<Data> m_data;
+    RefPtr<FilterEffect> m_filterEffect;
 };
 
 // GRAYSCALE, SEPIA, SATURATE and HUE_ROTATE are variations on a basic color matrix effect.
diff --git a/Source/WebCore/platform/graphics/filters/FilterOperations.cpp b/Source/WebCore/platform/graphics/filters/FilterOperations.cpp
index c4b876593..fcb74fc32 100644
--- a/Source/WebCore/platform/graphics/filters/FilterOperations.cpp
+++ b/Source/WebCore/platform/graphics/filters/FilterOperations.cpp
@@ -91,7 +91,8 @@ bool FilterOperations::operationsMatch(const FilterOperations& other) const
 bool FilterOperations::hasCustomFilter() const
 {
     for (size_t i = 0; i < m_operations.size(); ++i) {
-        if (m_operations.at(i)->getOperationType() == FilterOperation::CUSTOM)
+        FilterOperation::OperationType type = m_operations.at(i)->getOperationType();
+        if (type == FilterOperation::CUSTOM || type == FilterOperation::VALIDATED_CUSTOM)
             return true;
     }
     return false;
@@ -146,8 +147,10 @@ void FilterOperations::getOutsets(int& top, int& right, int& bottom, int& left)
             break;
         }
 #if ENABLE(CSS_SHADERS)
-        case FilterOperation::CUSTOM: {
-            // Need to include the filter margins here.
+        case FilterOperation::CUSTOM:
+        case FilterOperation::VALIDATED_CUSTOM: {
+            // FIXME: Need to include the filter margins here.
+            // https://bugs.webkit.org/show_bug.cgi?id=71400
             break;
         }
 #endif
diff --git a/Source/WebCore/platform/graphics/filters/ValidatedCustomFilterOperation.cpp b/Source/WebCore/platform/graphics/filters/ValidatedCustomFilterOperation.cpp
new file mode 100644
index 000000000..35def2f38
--- /dev/null
+++ b/Source/WebCore/platform/graphics/filters/ValidatedCustomFilterOperation.cpp
@@ -0,0 +1,69 @@
+/*
+ * Copyright (C) 2012 Adobe Systems Incorporated. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above
+ *    copyright notice, this list of conditions and the following
+ *    disclaimer.
+ * 2. Redistributions in binary form must reproduce the above
+ *    copyright notice, this list of conditions and the following
+ *    disclaimer in the documentation and/or other materials
+ *    provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDER "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER BE
+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
+ * OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR
+ * TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF
+ * THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(CSS_SHADERS)
+#include "ValidatedCustomFilterOperation.h"
+
+#include "CustomFilterParameter.h"
+#include "CustomFilterValidatedProgram.h"
+#include "FractionalLayoutSize.h"
+#include <wtf/UnusedParam.h>
+
+namespace WebCore {
+
+ValidatedCustomFilterOperation::ValidatedCustomFilterOperation(PassRefPtr<CustomFilterValidatedProgram> validatedProgram, 
+    const CustomFilterParameterList& sortedParameters, unsigned meshRows, unsigned meshColumns, CustomFilterMeshType meshType)
+    : FilterOperation(VALIDATED_CUSTOM)
+    , m_validatedProgram(validatedProgram)
+    , m_parameters(sortedParameters)
+    , m_meshRows(meshRows)
+    , m_meshColumns(meshColumns)
+    , m_meshType(meshType)
+{
+}
+
+ValidatedCustomFilterOperation::~ValidatedCustomFilterOperation()
+{
+}
+
+PassRefPtr<FilterOperation> ValidatedCustomFilterOperation::blend(const FilterOperation*, double progress, const LayoutSize& size, bool blendToPassthrough)
+{
+    UNUSED_PARAM(progress);
+    UNUSED_PARAM(size);
+    UNUSED_PARAM(blendToPassthrough);
+
+    ASSERT_NOT_REACHED();
+    return this;
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(CSS_SHADERS)
diff --git a/Source/WebCore/platform/graphics/filters/ValidatedCustomFilterOperation.h b/Source/WebCore/platform/graphics/filters/ValidatedCustomFilterOperation.h
new file mode 100644
index 000000000..cf88d5144
--- /dev/null
+++ b/Source/WebCore/platform/graphics/filters/ValidatedCustomFilterOperation.h
@@ -0,0 +1,98 @@
+/*
+ * Copyright (C) 2012 Adobe Systems Incorporated. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above
+ *    copyright notice, this list of conditions and the following
+ *    disclaimer.
+ * 2. Redistributions in binary form must reproduce the above
+ *    copyright notice, this list of conditions and the following
+ *    disclaimer in the documentation and/or other materials
+ *    provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDER "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER BE
+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
+ * OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR
+ * TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF
+ * THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#ifndef ValidatedCustomFilterOperation_h
+#define ValidatedCustomFilterOperation_h
+
+#if ENABLE(CSS_SHADERS)
+#include "CustomFilterConstants.h"
+#include "CustomFilterParameterList.h"
+#include "FilterOperation.h"
+#include "LayoutTypes.h"
+
+namespace WebCore {
+
+class CustomFilterValidatedProgram;
+
+class ValidatedCustomFilterOperation : public FilterOperation {
+public:
+    static PassRefPtr<ValidatedCustomFilterOperation> create(PassRefPtr<CustomFilterValidatedProgram> validatedProgram, 
+        const CustomFilterParameterList& sortedParameters, unsigned meshRows, unsigned meshColumns, CustomFilterMeshType meshType)
+    {
+        return adoptRef(new ValidatedCustomFilterOperation(validatedProgram, sortedParameters, meshRows, meshColumns, meshType));
+    }
+
+    virtual ~ValidatedCustomFilterOperation();
+
+    virtual bool affectsOpacity() const { return true; }
+    virtual bool movesPixels() const { return true; }
+    virtual bool blendingNeedsRendererSize() const { return true; }
+
+    virtual PassRefPtr<FilterOperation> blend(const FilterOperation* from, double progress, const LayoutSize&, bool blendToPassthrough = false);
+
+    CustomFilterValidatedProgram* validatedProgram() const { return m_validatedProgram.get(); }
+    const CustomFilterParameterList& parameters() const { return m_parameters; }
+
+    unsigned meshRows() const { return m_meshRows; }
+    unsigned meshColumns() const { return m_meshColumns; }
+
+    CustomFilterMeshType meshType() const { return m_meshType; }
+
+private:
+    virtual bool operator==(const FilterOperation& o) const
+    {
+        if (!isSameType(o))
+            return false;
+
+        const ValidatedCustomFilterOperation* other = static_cast<const ValidatedCustomFilterOperation*>(&o);
+        return m_validatedProgram.get() == other->m_validatedProgram.get()
+            && m_meshRows == other->m_meshRows
+            && m_meshColumns == other->m_meshColumns
+            && m_meshType == other->m_meshType
+            && m_parameters == other->m_parameters;
+    }
+
+    ValidatedCustomFilterOperation(PassRefPtr<CustomFilterValidatedProgram>, const CustomFilterParameterList&, unsigned meshRows, unsigned meshColumns, CustomFilterMeshType);
+
+    RefPtr<CustomFilterValidatedProgram> m_validatedProgram;
+
+    CustomFilterParameterList m_parameters;
+    unsigned m_meshRows;
+    unsigned m_meshColumns;
+    CustomFilterMeshType m_meshType;
+    
+    // FIXME: Add CustomFilterMeshBoxType after 100782 is landed.
+    // https://bugs.webkit.org/show_bug.cgi?id=100890
+};
+
+} // namespace WebCore
+
+#endif // ENABLE(CSS_SHADERS)
+
+#endif // ValidatedCustomFilterOperation_h
diff --git a/Source/WebCore/platform/graphics/filters/skia/FEBlendSkia.cpp b/Source/WebCore/platform/graphics/filters/skia/FEBlendSkia.cpp
index fdca432f4..8089f3b50 100644
--- a/Source/WebCore/platform/graphics/filters/skia/FEBlendSkia.cpp
+++ b/Source/WebCore/platform/graphics/filters/skia/FEBlendSkia.cpp
@@ -31,6 +31,7 @@
 #include "NativeImageSkia.h"
 #include "SkBitmapSource.h"
 #include "SkBlendImageFilter.h"
+#include "SkiaImageFilterBuilder.h"
 
 namespace WebCore {
 
@@ -84,6 +85,14 @@ bool FEBlend::platformApplySkia()
     return true;
 }
 
+SkImageFilter* FEBlend::createImageFilter(SkiaImageFilterBuilder* builder)
+{
+    SkImageFilter* foreground = builder->build(inputEffect(0));
+    SkImageFilter* background = builder->build(inputEffect(1));
+    SkBlendImageFilter::Mode mode = toSkiaMode(m_mode);
+    return new SkBlendImageFilter(mode, background, foreground);
+}
+
 } // namespace WebCore
 
 #endif // ENABLE(FILTERS)
diff --git a/Source/WebCore/platform/graphics/filters/skia/FEColorMatrixSkia.cpp b/Source/WebCore/platform/graphics/filters/skia/FEColorMatrixSkia.cpp
index 0fd07776e..affbaead0 100644
--- a/Source/WebCore/platform/graphics/filters/skia/FEColorMatrixSkia.cpp
+++ b/Source/WebCore/platform/graphics/filters/skia/FEColorMatrixSkia.cpp
@@ -28,7 +28,9 @@
 #include "FEColorMatrix.h"
 
 #include "NativeImageSkia.h"
+#include "SkColorFilterImageFilter.h"
 #include "SkColorMatrixFilter.h"
+#include "SkiaImageFilterBuilder.h"
 
 namespace WebCore {
 
@@ -80,24 +82,15 @@ static void luminanceToAlphaMatrix(SkScalar matrix[20])
     matrix[17] = 0.0721f;
 }
 
-bool FEColorMatrix::platformApplySkia()
+static SkColorFilter* createColorFilter(ColorMatrixType type, const float* values)
 {
-    ImageBuffer* resultImage = createImageBufferResult();
-    if (!resultImage)
-        return false;
-
-    FilterEffect* in = inputEffect(0);
-
-    IntRect imageRect(IntPoint(), absolutePaintRect().size());
-
     SkScalar matrix[20];
-
-    switch (m_type) {
+    switch (type) {
     case FECOLORMATRIX_TYPE_UNKNOWN:
         break;
     case FECOLORMATRIX_TYPE_MATRIX:
         for (int i = 0; i < 20; ++i)
-            matrix[i] = m_values[i];
+            matrix[i] = values[i];
 
         matrix[4] *= SkScalar(255);
         matrix[9] *= SkScalar(255);
@@ -105,15 +98,29 @@ bool FEColorMatrix::platformApplySkia()
         matrix[19] *= SkScalar(255);
         break;
     case FECOLORMATRIX_TYPE_SATURATE: 
-        saturateMatrix(m_values[0], matrix);
+        saturateMatrix(values[0], matrix);
         break;
     case FECOLORMATRIX_TYPE_HUEROTATE:
-        hueRotateMatrix(m_values[0], matrix);
+        hueRotateMatrix(values[0], matrix);
         break;
     case FECOLORMATRIX_TYPE_LUMINANCETOALPHA:
         luminanceToAlphaMatrix(matrix);
         break;
     }
+    return new SkColorMatrixFilter(matrix);
+}
+
+bool FEColorMatrix::platformApplySkia()
+{
+    ImageBuffer* resultImage = createImageBufferResult();
+    if (!resultImage)
+        return false;
+
+    FilterEffect* in = inputEffect(0);
+
+    IntRect imageRect(IntPoint(), absolutePaintRect().size());
+
+    SkAutoTUnref<SkColorFilter> filter(createColorFilter(m_type, m_values.data()));
 
     RefPtr<Image> image = in->asImageBuffer()->copyImage(DontCopyBackingStore);
     NativeImageSkia* nativeImage = image->nativeImageForCurrentFrame();
@@ -122,12 +129,19 @@ bool FEColorMatrix::platformApplySkia()
 
     SkCanvas* canvas = resultImage->context()->platformContext()->canvas();
     SkPaint paint;
-    paint.setColorFilter(new SkColorMatrixFilter(matrix))->unref();
+    paint.setColorFilter(filter);
     paint.setXfermodeMode(SkXfermode::kSrc_Mode);
     canvas->drawBitmap(nativeImage->bitmap(), 0, 0, &paint);
     return true;
 }
 
+SkImageFilter* FEColorMatrix::createImageFilter(SkiaImageFilterBuilder* builder)
+{
+    SkAutoTUnref<SkImageFilter> input(builder->build(inputEffect(0)));
+    SkAutoTUnref<SkColorFilter> filter(createColorFilter(m_type, m_values.data()));
+    return SkColorFilterImageFilter::Create(filter, input);
+}
+
 } // namespace WebCore
 
 #endif // ENABLE(FILTERS) && USE(SKIA)
diff --git a/Source/WebCore/platform/graphics/filters/skia/FEComponentTransferSkia.cpp b/Source/WebCore/platform/graphics/filters/skia/FEComponentTransferSkia.cpp
index 577a5b065..86d5d7e66 100644
--- a/Source/WebCore/platform/graphics/filters/skia/FEComponentTransferSkia.cpp
+++ b/Source/WebCore/platform/graphics/filters/skia/FEComponentTransferSkia.cpp
@@ -29,7 +29,9 @@
 #include "FEComponentTransfer.h"
 
 #include "NativeImageSkia.h"
+#include "SkColorFilterImageFilter.h"
 #include "SkTableColorFilter.h"
+#include "SkiaImageFilterBuilder.h"
 
 namespace WebCore {
 
@@ -55,6 +57,18 @@ bool FEComponentTransfer::platformApplySkia()
     return true;
 }
 
+SkImageFilter* FEComponentTransfer::createImageFilter(SkiaImageFilterBuilder* builder)
+{
+    SkImageFilter* input = builder->build(inputEffect(0));
+
+    unsigned char rValues[256], gValues[256], bValues[256], aValues[256];
+    getValues(rValues, gValues, bValues, aValues);
+
+    SkAutoTUnref<SkColorFilter> colorFilter(SkTableColorFilter::CreateARGB(aValues, rValues, gValues, bValues));
+
+    return SkColorFilterImageFilter::Create(colorFilter, input);
+}
+
 } // namespace WebCore
 
 #endif // ENABLE(FILTERS)
diff --git a/Source/WebCore/platform/graphics/filters/skia/FEGaussianBlurSkia.cpp b/Source/WebCore/platform/graphics/filters/skia/FEGaussianBlurSkia.cpp
index b694c9b1c..f5f46daed 100644
--- a/Source/WebCore/platform/graphics/filters/skia/FEGaussianBlurSkia.cpp
+++ b/Source/WebCore/platform/graphics/filters/skia/FEGaussianBlurSkia.cpp
@@ -29,6 +29,7 @@
 
 #include "BitmapImageSingleFrameSkia.h"
 #include "SkBlurImageFilter.h"
+#include "SkiaImageFilterBuilder.h"
 
 namespace WebCore {
 
@@ -61,5 +62,11 @@ bool FEGaussianBlur::platformApplySkia()
     return true;
 }
 
+SkImageFilter* FEGaussianBlur::createImageFilter(SkiaImageFilterBuilder* builder)
+{
+    SkAutoTUnref<SkImageFilter> input(builder->build(inputEffect(0)));
+    return new SkBlurImageFilter(SkFloatToScalar(m_stdX), SkFloatToScalar(m_stdY), input);
+}
+
 };
 #endif
diff --git a/Source/WebCore/platform/graphics/filters/skia/FELightingSkia.cpp b/Source/WebCore/platform/graphics/filters/skia/FELightingSkia.cpp
index 1a6a2d70e..167234d3b 100644
--- a/Source/WebCore/platform/graphics/filters/skia/FELightingSkia.cpp
+++ b/Source/WebCore/platform/graphics/filters/skia/FELightingSkia.cpp
@@ -31,32 +31,14 @@
 #include "NativeImageSkia.h"
 #include "PointLightSource.h"
 #include "SkLightingImageFilter.h"
+#include "SkiaImageFilterBuilder.h"
 #include "SpotLightSource.h"
 
 namespace WebCore {
 
-bool FELighting::platformApplySkia()
+SkImageFilter* FELighting::createImageFilter(SkiaImageFilterBuilder* builder)
 {
-    // For now, only use the skia implementation for accelerated rendering.
-    if (filter()->renderingMode() != Accelerated)
-        return false;
-
-    ImageBuffer* resultImage = createImageBufferResult();
-    if (!resultImage)
-        return false;
-
-    FilterEffect* in = inputEffect(0);
-
-    IntRect drawingRegion = drawingRegionOfInputImage(in->absolutePaintRect());
-
-    setIsAlphaImage(in->isAlphaImage());
-
-    RefPtr<Image> image = in->asImageBuffer()->copyImage(DontCopyBackingStore);
-    NativeImageSkia* nativeImage = image->nativeImageForCurrentFrame();
-
-    GraphicsContext* dstContext = resultImage->context();
-
-    SkPaint paint;
+    SkImageFilter* input = builder ? builder->build(inputEffect(0)) : 0;
     switch (m_lightSource->type()) {
     case LS_DISTANT: {
         DistantLightSource* distantLightSource = static_cast<DistantLightSource*>(m_lightSource.get());
@@ -66,20 +48,18 @@ bool FELighting::platformApplySkia()
                            sinf(azimuthRad) * cosf(elevationRad),
                            sinf(elevationRad));
         if (m_specularConstant > 0)
-            paint.setImageFilter(SkLightingImageFilter::CreateDistantLitSpecular(direction, m_lightingColor.rgb(), m_surfaceScale, m_specularConstant, m_specularExponent))->unref();
+            return SkLightingImageFilter::CreateDistantLitSpecular(direction, m_lightingColor.rgb(), m_surfaceScale, m_specularConstant, m_specularExponent, input);
         else
-            paint.setImageFilter(SkLightingImageFilter::CreateDistantLitDiffuse(direction, m_lightingColor.rgb(), m_surfaceScale, m_diffuseConstant))->unref();
-        break;
+            return SkLightingImageFilter::CreateDistantLitDiffuse(direction, m_lightingColor.rgb(), m_surfaceScale, m_diffuseConstant, input);
     }
     case LS_POINT: {
         PointLightSource* pointLightSource = static_cast<PointLightSource*>(m_lightSource.get());
         FloatPoint3D position = pointLightSource->position();
         SkPoint3 skPosition(position.x(), position.y(), position.z());
         if (m_specularConstant > 0)
-            paint.setImageFilter(SkLightingImageFilter::CreatePointLitSpecular(skPosition, m_lightingColor.rgb(), m_surfaceScale, m_specularConstant, m_specularExponent))->unref();
+            return SkLightingImageFilter::CreatePointLitSpecular(skPosition, m_lightingColor.rgb(), m_surfaceScale, m_specularConstant, m_specularExponent, input);
         else
-            paint.setImageFilter(SkLightingImageFilter::CreatePointLitDiffuse(skPosition, m_lightingColor.rgb(), m_surfaceScale, m_diffuseConstant))->unref();
-        break;
+            return SkLightingImageFilter::CreatePointLitDiffuse(skPosition, m_lightingColor.rgb(), m_surfaceScale, m_diffuseConstant, input);
     }
     case LS_SPOT: {
         SpotLightSource* spotLightSource = static_cast<SpotLightSource*>(m_lightSource.get());
@@ -90,15 +70,39 @@ bool FELighting::platformApplySkia()
         if (!limitingConeAngle || limitingConeAngle > 90 || limitingConeAngle < -90)
             limitingConeAngle = 90;
         if (m_specularConstant > 0)
-            paint.setImageFilter(SkLightingImageFilter::CreateSpotLitSpecular(location, target, specularExponent, limitingConeAngle, m_lightingColor.rgb(), m_surfaceScale, m_specularConstant, m_specularExponent))->unref();
+            return SkLightingImageFilter::CreateSpotLitSpecular(location, target, specularExponent, limitingConeAngle, m_lightingColor.rgb(), m_surfaceScale, m_specularConstant, m_specularExponent, input);
         else
-            paint.setImageFilter(SkLightingImageFilter::CreateSpotLitDiffuse(location, target, specularExponent, limitingConeAngle, m_lightingColor.rgb(), m_surfaceScale, m_diffuseConstant))->unref();
-        break;
+            return SkLightingImageFilter::CreateSpotLitDiffuse(location, target, specularExponent, limitingConeAngle, m_lightingColor.rgb(), m_surfaceScale, m_diffuseConstant, input);
     }
     default:
         ASSERT_NOT_REACHED();
-        return false;
+        return 0;
     }
+}
+
+bool FELighting::platformApplySkia()
+{
+    // For now, only use the skia implementation for accelerated rendering.
+    if (filter()->renderingMode() != Accelerated)
+        return false;
+
+    ImageBuffer* resultImage = createImageBufferResult();
+    if (!resultImage)
+        return false;
+
+    FilterEffect* in = inputEffect(0);
+
+    IntRect drawingRegion = drawingRegionOfInputImage(in->absolutePaintRect());
+
+    setIsAlphaImage(in->isAlphaImage());
+
+    RefPtr<Image> image = in->asImageBuffer()->copyImage(DontCopyBackingStore);
+    NativeImageSkia* nativeImage = image->nativeImageForCurrentFrame();
+
+    GraphicsContext* dstContext = resultImage->context();
+
+    SkPaint paint;
+    paint.setImageFilter(createImageFilter(0))->unref();
     dstContext->platformContext()->canvas()->drawBitmap(nativeImage->bitmap(), drawingRegion.location().x(), drawingRegion.location().y(), &paint);
     return true;
 }
diff --git a/Source/WebCore/platform/graphics/filters/skia/FEMorphologySkia.cpp b/Source/WebCore/platform/graphics/filters/skia/FEMorphologySkia.cpp
index e7290bec7..b2e9f4fcf 100644
--- a/Source/WebCore/platform/graphics/filters/skia/FEMorphologySkia.cpp
+++ b/Source/WebCore/platform/graphics/filters/skia/FEMorphologySkia.cpp
@@ -28,6 +28,7 @@
 #include "FEMorphology.h"
 
 #include "SkMorphologyImageFilter.h"
+#include "SkiaImageFilterBuilder.h"
 
 namespace WebCore {
 
@@ -62,5 +63,15 @@ bool FEMorphology::platformApplySkia()
     return true;
 }
 
+SkImageFilter* FEMorphology::createImageFilter(SkiaImageFilterBuilder* builder)
+{
+    SkAutoTUnref<SkImageFilter> input(builder->build(inputEffect(0)));
+    SkScalar radiusX = SkFloatToScalar(m_radiusX);
+    SkScalar radiusY = SkFloatToScalar(m_radiusY);
+    if (m_type == FEMORPHOLOGY_OPERATOR_DILATE)
+        return new SkDilateImageFilter(radiusX, radiusY, input);
+    return new SkErodeImageFilter(radiusX, radiusY, input);
+}
+
 };
 #endif
diff --git a/Source/WebCore/platform/graphics/filters/skia/SkiaImageFilterBuilder.cpp b/Source/WebCore/platform/graphics/filters/skia/SkiaImageFilterBuilder.cpp
new file mode 100644
index 000000000..da891fb85
--- /dev/null
+++ b/Source/WebCore/platform/graphics/filters/skia/SkiaImageFilterBuilder.cpp
@@ -0,0 +1,265 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+#include "config.h"
+
+#include "SkiaImageFilterBuilder.h"
+
+#include "FilterEffect.h"
+#include "FilterOperations.h"
+#include "SkBlurImageFilter.h"
+#include "SkColorFilterImageFilter.h"
+#include "SkColorMatrixFilter.h"
+#include "SkMatrix.h"
+
+namespace {
+
+void getBrightnessMatrix(float amount, SkScalar matrix[20])
+{
+    memset(matrix, 0, 20 * sizeof(SkScalar));
+    matrix[0] = matrix[6] = matrix[12] = matrix[18] = 1;
+    matrix[4] = matrix[9] = matrix[14] = amount * 255;
+}
+
+void getContrastMatrix(float amount, SkScalar matrix[20])
+{
+    memset(matrix, 0, 20 * sizeof(SkScalar));
+    matrix[0] = matrix[6] = matrix[12] = amount;
+    matrix[4] = matrix[9] = matrix[14] = (-0.5f * amount + 0.5f) * 255;
+    matrix[18] = 1;
+}
+
+void getSaturateMatrix(float amount, SkScalar matrix[20])
+{
+    // Note, these values are computed to ensure matrixNeedsClamping is false
+    // for amount in [0..1]
+    matrix[0] = 0.213f + 0.787f * amount;
+    matrix[1] = 0.715f - 0.715f * amount;
+    matrix[2] = 1.f - (matrix[0] + matrix[1]);
+    matrix[3] = matrix[4] = 0;
+    matrix[5] = 0.213f - 0.213f * amount;
+    matrix[6] = 0.715f + 0.285f * amount;
+    matrix[7] = 1.f - (matrix[5] + matrix[6]);
+    matrix[8] = matrix[9] = 0;
+    matrix[10] = 0.213f - 0.213f * amount;
+    matrix[11] = 0.715f - 0.715f * amount;
+    matrix[12] = 1.f - (matrix[10] + matrix[11]);
+    matrix[13] = matrix[14] = 0;
+    matrix[15] = matrix[16] = matrix[17] = matrix[19] = 0;
+    matrix[18] = 1;
+}
+
+void getHueRotateMatrix(float hue, SkScalar matrix[20])
+{
+    float cosHue = cosf(hue * piFloat / 180);
+    float sinHue = sinf(hue * piFloat / 180);
+    matrix[0] = 0.213f + cosHue * 0.787f - sinHue * 0.213f;
+    matrix[1] = 0.715f - cosHue * 0.715f - sinHue * 0.715f;
+    matrix[2] = 0.072f - cosHue * 0.072f + sinHue * 0.928f;
+    matrix[3] = matrix[4] = 0;
+    matrix[5] = 0.213f - cosHue * 0.213f + sinHue * 0.143f;
+    matrix[6] = 0.715f + cosHue * 0.285f + sinHue * 0.140f;
+    matrix[7] = 0.072f - cosHue * 0.072f - sinHue * 0.283f;
+    matrix[8] = matrix[9] = 0;
+    matrix[10] = 0.213f - cosHue * 0.213f - sinHue * 0.787f;
+    matrix[11] = 0.715f - cosHue * 0.715f + sinHue * 0.715f;
+    matrix[12] = 0.072f + cosHue * 0.928f + sinHue * 0.072f;
+    matrix[13] = matrix[14] = 0;
+    matrix[15] = matrix[16] = matrix[17] = 0;
+    matrix[18] = 1;
+    matrix[19] = 0;
+}
+
+void getInvertMatrix(float amount, SkScalar matrix[20])
+{
+    memset(matrix, 0, 20 * sizeof(SkScalar));
+    matrix[0] = matrix[6] = matrix[12] = 1 - 2 * amount;
+    matrix[4] = matrix[9] = matrix[14] = amount * 255;
+    matrix[18] = 1;
+}
+
+void getOpacityMatrix(float amount, SkScalar matrix[20])
+{
+    memset(matrix, 0, 20 * sizeof(SkScalar));
+    matrix[0] = matrix[6] = matrix[12] = 1;
+    matrix[18] = amount;
+}
+
+void getGrayscaleMatrix(float amount, SkScalar matrix[20])
+{
+    // Note, these values are computed to ensure matrixNeedsClamping is false
+    // for amount in [0..1]
+    matrix[0] = 0.2126f + 0.7874f * amount;
+    matrix[1] = 0.7152f - 0.7152f * amount;
+    matrix[2] = 1.f - (matrix[0] + matrix[1]);
+    matrix[3] = matrix[4] = 0;
+
+    matrix[5] = 0.2126f - 0.2126f * amount;
+    matrix[6] = 0.7152f + 0.2848f * amount;
+    matrix[7] = 1.f - (matrix[5] + matrix[6]);
+    matrix[8] = matrix[9] = 0;
+
+    matrix[10] = 0.2126f - 0.2126f * amount;
+    matrix[11] = 0.7152f - 0.7152f * amount;
+    matrix[12] = 1.f - (matrix[10] + matrix[11]);
+    matrix[13] = matrix[14] = 0;
+
+    matrix[15] = matrix[16] = matrix[17] = matrix[19] = 0;
+    matrix[18] = 1;
+}
+
+void getSepiaMatrix(float amount, SkScalar matrix[20])
+{
+    matrix[0] = 0.393f + 0.607f * amount;
+    matrix[1] = 0.769f - 0.769f * amount;
+    matrix[2] = 0.189f - 0.189f * amount;
+    matrix[3] = matrix[4] = 0;
+
+    matrix[5] = 0.349f - 0.349f * amount;
+    matrix[6] = 0.686f + 0.314f * amount;
+    matrix[7] = 0.168f - 0.168f * amount;
+    matrix[8] = matrix[9] = 0;
+
+    matrix[10] = 0.272f - 0.272f * amount;
+    matrix[11] = 0.534f - 0.534f * amount;
+    matrix[12] = 0.131f + 0.869f * amount;
+    matrix[13] = matrix[14] = 0;
+
+    matrix[15] = matrix[16] = matrix[17] = matrix[19] = 0;
+    matrix[18] = 1;
+}
+
+SkImageFilter* createMatrixImageFilter(SkScalar matrix[20], SkImageFilter* input)
+{
+    SkAutoTUnref<SkColorFilter> colorFilter(new SkColorMatrixFilter(matrix));
+    return SkColorFilterImageFilter::Create(colorFilter, input);
+}
+
+};
+
+namespace WebCore {
+
+SkiaImageFilterBuilder::SkiaImageFilterBuilder()
+{
+}
+
+SkImageFilter* SkiaImageFilterBuilder::build(FilterEffect* effect)
+{
+    if (!effect)
+        return 0;
+
+    FilterBuilderHashMap::iterator it = m_map.find(effect);
+    if (it != m_map.end())
+        return it->value;
+
+    SkImageFilter* filter = effect->createImageFilter(this);
+    m_map.set(effect, filter);
+    return filter;
+}
+
+SkImageFilter* SkiaImageFilterBuilder::build(const FilterOperations& operations)
+{
+    SkImageFilter* filter = 0;
+    SkScalar matrix[20];
+    for (size_t i = 0; i < operations.size(); ++i) {
+        const FilterOperation& op = *operations.at(i);
+        switch (op.getOperationType()) {
+        case FilterOperation::REFERENCE: {
+            FilterEffect* filterEffect = static_cast<const ReferenceFilterOperation*>(&op)->filterEffect();
+            // FIXME: hook up parent filter to image source
+            filter = SkiaImageFilterBuilder::build(filterEffect);
+            break;
+        }
+        case FilterOperation::GRAYSCALE: {
+            float amount = static_cast<const BasicColorMatrixFilterOperation*>(&op)->amount();
+            getGrayscaleMatrix(amount, matrix);
+            filter = createMatrixImageFilter(matrix, filter);
+            break;
+        }
+        case FilterOperation::SEPIA: {
+            float amount = static_cast<const BasicColorMatrixFilterOperation*>(&op)->amount();
+            getSepiaMatrix(amount, matrix);
+            filter = createMatrixImageFilter(matrix, filter);
+            break;
+        }
+        case FilterOperation::SATURATE: {
+            float amount = static_cast<const BasicColorMatrixFilterOperation*>(&op)->amount();
+            getSaturateMatrix(amount, matrix);
+            filter = createMatrixImageFilter(matrix, filter);
+            break;
+        }
+        case FilterOperation::HUE_ROTATE: {
+            float amount = static_cast<const BasicColorMatrixFilterOperation*>(&op)->amount();
+            getHueRotateMatrix(amount, matrix);
+            filter = createMatrixImageFilter(matrix, filter);
+            break;
+        }
+        case FilterOperation::INVERT: {
+            float amount = static_cast<const BasicComponentTransferFilterOperation*>(&op)->amount();
+            getInvertMatrix(amount, matrix);
+            filter = createMatrixImageFilter(matrix, filter);
+            break;
+        }
+        case FilterOperation::OPACITY: {
+            float amount = static_cast<const BasicComponentTransferFilterOperation*>(&op)->amount();
+            getOpacityMatrix(amount, matrix);
+            filter = createMatrixImageFilter(matrix, filter);
+            break;
+        }
+        case FilterOperation::BRIGHTNESS: {
+            float amount = static_cast<const BasicComponentTransferFilterOperation*>(&op)->amount();
+            getBrightnessMatrix(amount, matrix);
+            filter = createMatrixImageFilter(matrix, filter);
+            break;
+        }
+        case FilterOperation::CONTRAST: {
+            float amount = static_cast<const BasicComponentTransferFilterOperation*>(&op)->amount();
+            getContrastMatrix(amount, matrix);
+            filter = createMatrixImageFilter(matrix, filter);
+            break;
+        }
+        case FilterOperation::BLUR: {
+            float pixelRadius = static_cast<const BlurFilterOperation*>(&op)->stdDeviation().getFloatValue();
+            filter = new SkBlurImageFilter(pixelRadius, pixelRadius, filter);
+            break;
+        }
+        case FilterOperation::DROP_SHADOW: {
+//            const DropShadowFilterOperation& dropShadowOp = *static_cast<const DropShadowFilterOperation*>(&op);
+            // FIXME: do offset and blur
+            break;
+        }
+#if ENABLE(CSS_SHADERS)
+        case FilterOperation::VALIDATED_CUSTOM:
+        case FilterOperation::CUSTOM:
+            // Not supported.
+#endif
+        case FilterOperation::PASSTHROUGH:
+        case FilterOperation::NONE:
+            break;
+        }
+    }
+    return filter;
+}
+
+};
diff --git a/Tools/DumpRenderTree/qt/QtInitializeTestFonts.h b/Source/WebCore/platform/graphics/filters/skia/SkiaImageFilterBuilder.h
index 60e4761b6..27bd68320 100644
--- a/Tools/DumpRenderTree/qt/QtInitializeTestFonts.h
+++ b/Source/WebCore/platform/graphics/filters/skia/SkiaImageFilterBuilder.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2012 Nokia Corporation and/or its subsidiary(-ies)
+ * Copyright (C) 2012 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -10,9 +10,6 @@
  * 2.  Redistributions in binary form must reproduce the above copyright
  *     notice, this list of conditions and the following disclaimer in the
  *     documentation and/or other materials provided with the distribution.
- * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
- *     its contributors may be used to endorse or promote products derived
- *     from this software without specific prior written permission.
  *
  * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
  * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
@@ -26,14 +23,28 @@
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef QtInitializeTestFonts_h
-#define QtInitializeTestFonts_h
+#ifndef SkiaImageFilterBuilder_h
+#define SkiaImageFilterBuilder_h
 
-namespace WebKit {
+#include <wtf/HashMap.h>
 
-// Helper to share code between test font users.
-void initializeTestFonts();
+class SkImageFilter;
 
-}
+namespace WebCore {
+class FilterEffect;
+class FilterOperations;
+
+class SkiaImageFilterBuilder {
+public:
+    SkiaImageFilterBuilder();
+
+    SkImageFilter* build(FilterEffect*);
+    SkImageFilter* build(const FilterOperations&);
+private:
+    typedef HashMap<FilterEffect*, SkImageFilter*> FilterBuilderHashMap;
+    FilterBuilderHashMap m_map;
+};
+
+};
 
 #endif
diff --git a/Source/WebCore/platform/graphics/freetype/SimpleFontDataFreeType.cpp b/Source/WebCore/platform/graphics/freetype/SimpleFontDataFreeType.cpp
index 30d889f5c..a16ad17df 100644
--- a/Source/WebCore/platform/graphics/freetype/SimpleFontDataFreeType.cpp
+++ b/Source/WebCore/platform/graphics/freetype/SimpleFontDataFreeType.cpp
@@ -98,27 +98,6 @@ PassRefPtr<SimpleFontData> SimpleFontData::createScaledFontData(const FontDescri
                                                         m_platformData.syntheticOblique()), isCustomFont(), false);
 }
 
-PassRefPtr<SimpleFontData> SimpleFontData::smallCapsFontData(const FontDescription& fontDescription) const
-{
-    if (!m_derivedFontData)
-        m_derivedFontData = DerivedFontData::create(isCustomFont());
-    // FIXME: I think we want to ask FontConfig for the right font again.
-    if (!m_derivedFontData->smallCaps)
-        m_derivedFontData->smallCaps = createScaledFontData(fontDescription, .7);
-
-    return m_derivedFontData->smallCaps;
-}
-
-PassRefPtr<SimpleFontData> SimpleFontData::emphasisMarkFontData(const FontDescription& fontDescription) const
-{
-    if (!m_derivedFontData)
-        m_derivedFontData = DerivedFontData::create(isCustomFont());
-    if (!m_derivedFontData->emphasisMark)
-        m_derivedFontData->emphasisMark = createScaledFontData(fontDescription, .5);
-
-    return m_derivedFontData->emphasisMark;
-}
-
 bool SimpleFontData::containsCharacters(const UChar* characters, int length) const
 {
     ASSERT(m_platformData.scaledFont());
diff --git a/Source/WebCore/platform/graphics/harfbuzz/ng/HarfBuzzShaper.cpp b/Source/WebCore/platform/graphics/harfbuzz/ng/HarfBuzzShaper.cpp
index e0686166d..b7d444f08 100644
--- a/Source/WebCore/platform/graphics/harfbuzz/ng/HarfBuzzShaper.cpp
+++ b/Source/WebCore/platform/graphics/harfbuzz/ng/HarfBuzzShaper.cpp
@@ -322,6 +322,14 @@ bool HarfBuzzShaper::shapeHarfBuzzRuns()
         HarfBuzzRun* currentRun = m_harfbuzzRuns[runIndex].get();
         const SimpleFontData* currentFontData = currentRun->fontData();
 
+        // This #if should be removed after all ports update harfbuzz-ng.
+#if PLATFORM(CHROMIUM)
+        // Add a space as pre-context to the buffer. This prevents showing dotted-circle
+        // for combining marks at the beginning of runs.
+        static const uint16_t preContext = ' ';
+        hb_buffer_add_utf16(harfbuzzBuffer.get(), &preContext, 1, 1, 0);
+#endif
+
         if (m_font->isSmallCaps() && u_islower(m_normalizedBuffer[currentRun->startIndex()])) {
             String upperText = String(m_normalizedBuffer.get() + currentRun->startIndex(), currentRun->numCharacters());
             upperText.makeUpper();
diff --git a/Source/WebCore/platform/graphics/mac/SimpleFontDataMac.mm b/Source/WebCore/platform/graphics/mac/SimpleFontDataMac.mm
index f8bb43ba7..fc23bbd9b 100644
--- a/Source/WebCore/platform/graphics/mac/SimpleFontDataMac.mm
+++ b/Source/WebCore/platform/graphics/mac/SimpleFontDataMac.mm
@@ -52,8 +52,6 @@ using namespace std;
 
 namespace WebCore {
   
-const float smallCapsFontSizeMultiplier = 0.7f;
-
 static bool fontHasVerticalGlyphs(CTFontRef ctFont)
 {
     // The check doesn't look neat but this is what AppKit does for vertical writing...
@@ -352,26 +350,6 @@ PassRefPtr<SimpleFontData> SimpleFontData::createScaledFontData(const FontDescri
     return 0;
 }
 
-PassRefPtr<SimpleFontData> SimpleFontData::smallCapsFontData(const FontDescription& fontDescription) const
-{
-    if (!m_derivedFontData)
-        m_derivedFontData = DerivedFontData::create(isCustomFont());
-    if (!m_derivedFontData->smallCaps)
-        m_derivedFontData->smallCaps = createScaledFontData(fontDescription, smallCapsFontSizeMultiplier);
-
-    return m_derivedFontData->smallCaps;
-}
-
-PassRefPtr<SimpleFontData> SimpleFontData::emphasisMarkFontData(const FontDescription& fontDescription) const
-{
-    if (!m_derivedFontData)
-        m_derivedFontData = DerivedFontData::create(isCustomFont());
-    if (!m_derivedFontData->emphasisMark)
-        m_derivedFontData->emphasisMark = createScaledFontData(fontDescription, .5f);
-
-    return m_derivedFontData->emphasisMark;
-}
-
 bool SimpleFontData::containsCharacters(const UChar* characters, int length) const
 {
     NSString *string = [[NSString alloc] initWithCharactersNoCopy:const_cast<unichar*>(characters) length:length freeWhenDone:NO];
diff --git a/Source/WebCore/platform/graphics/opengl/GraphicsContext3DOpenGLCommon.cpp b/Source/WebCore/platform/graphics/opengl/GraphicsContext3DOpenGLCommon.cpp
index db9fe43b6..58cfd7f7e 100644
--- a/Source/WebCore/platform/graphics/opengl/GraphicsContext3DOpenGLCommon.cpp
+++ b/Source/WebCore/platform/graphics/opengl/GraphicsContext3DOpenGLCommon.cpp
@@ -222,7 +222,7 @@ void GraphicsContext3D::reshape(int width, int height)
     if (width == m_currentWidth && height == m_currentHeight)
         return;
 
-#if PLATFORM(QT) && USE(GRAPHICS_SURFACE)
+#if (PLATFORM(QT) || PLATFORM(EFL)) && USE(GRAPHICS_SURFACE)
     ::glFlush(); // Make sure all GL calls have been committed before resizing.
     createGraphicsSurfaces(IntSize(width, height));
 #endif
@@ -1406,6 +1406,8 @@ void GraphicsContext3D::deleteShader(Platform3DObject shader)
 void GraphicsContext3D::deleteTexture(Platform3DObject texture)
 {
     makeContextCurrent();
+    if (m_boundTexture0 == texture)
+        m_boundTexture0 = 0;
     glDeleteTextures(1, &texture);
 }
 
diff --git a/Source/WebCore/platform/graphics/pango/SimpleFontDataPango.cpp b/Source/WebCore/platform/graphics/pango/SimpleFontDataPango.cpp
index 4fc1fbe3e..f88cbbb7a 100644
--- a/Source/WebCore/platform/graphics/pango/SimpleFontDataPango.cpp
+++ b/Source/WebCore/platform/graphics/pango/SimpleFontDataPango.cpp
@@ -92,26 +92,6 @@ PassRefPtr<SimpleFontData> SimpleFontData::createScaledFontData(const FontDescri
     return SimpleFontData::create(platformData);
 }
 
-PassRefPtr<SimpleFontData> SimpleFontData::smallCapsFontData(const FontDescription& fontDescription) const
-{
-    if (!m_derivedFontData)
-        m_derivedFontData = DerivedFontData::create(isCustomFont());
-    if (!m_derivedFontData->smallCaps)
-        m_derivedFontData->smallCaps = createScaledFontData(fontDescription, .7);
-
-    return m_derivedFontData->smallCaps;
-}
-
-PassRefPtr<SimpleFontData> SimpleFontData::emphasisMarkFontData(const FontDescription& fontDescription) const
-{
-    if (!m_derivedFontData)
-        m_derivedFontData = DerivedFontData::create(isCustomFont());
-    if (!m_derivedFontData->emphasisMark)
-        m_derivedFontData->emphasisMark = createScaledFontData(fontDescription, .5);
-
-    return m_derivedFontData->emphasisMark;
-}
-
 bool SimpleFontData::containsCharacters(const UChar* characters, int length) const
 {
     bool result = true;
diff --git a/Source/WebCore/platform/graphics/qt/FontQt.cpp b/Source/WebCore/platform/graphics/qt/FontQt.cpp
index f5bacddcc..e2cde765b 100644
--- a/Source/WebCore/platform/graphics/qt/FontQt.cpp
+++ b/Source/WebCore/platform/graphics/qt/FontQt.cpp
@@ -210,7 +210,10 @@ float Font::floatWidthForComplexText(const TextRun& run, HashSet<const SimpleFon
     QTextLine line = setupLayout(&layout, run);
     float x1 = line.cursorToX(0);
     float x2 = line.cursorToX(run.length());
-    const float width = qAbs(x2 - x1);
+    float width = qAbs(x2 - x1);
+    // RenderBlockLineLayout expects us to only add word-spacing for trailing spaces, not for leading spaces.
+    if (treatAsSpace(run[0]))
+        width -= m_wordSpacing;
 
     return width + run.expansion();
 }
@@ -275,6 +278,9 @@ void Font::drawEmphasisMarksForComplexText(GraphicsContext* /* context */, const
 
 void Font::drawGlyphs(GraphicsContext* context, const SimpleFontData* fontData, const GlyphBuffer& glyphBuffer, int from, int numGlyphs, const FloatPoint& point) const
 {
+    if (!fontData->platformData().size())
+        return;
+
     if (context->paintingDisabled())
         return;
 
diff --git a/Source/WebCore/platform/graphics/qt/MediaPlayerPrivateQt.cpp b/Source/WebCore/platform/graphics/qt/MediaPlayerPrivateQt.cpp
index 9ec765caa..e083e2973 100644
--- a/Source/WebCore/platform/graphics/qt/MediaPlayerPrivateQt.cpp
+++ b/Source/WebCore/platform/graphics/qt/MediaPlayerPrivateQt.cpp
@@ -45,6 +45,8 @@
 #include <QTimer>
 #include <QUrl>
 #include <limits>
+#include <qmediametadata.h>
+#include <qmultimedia.h>
 #include <wtf/HashSet.h>
 #include <wtf/text/CString.h>
 
@@ -92,7 +94,7 @@ MediaPlayer::SupportsType MediaPlayerPrivateQt::supportsType(const String& mime,
             codecListTrimmed.append(codecStrTrimmed);
     }
 
-    if (QMediaPlayer::hasSupport(mime, codecListTrimmed) >= QtMultimedia::ProbablySupported)
+    if (QMediaPlayer::hasSupport(mime, codecListTrimmed) >= QMultimedia::ProbablySupported)
         return MediaPlayer::IsSupported;
 
     return MediaPlayer::MayBeSupported;
@@ -366,8 +368,8 @@ bool MediaPlayerPrivateQt::didLoadingProgress() const
 
 unsigned MediaPlayerPrivateQt::totalBytes() const
 {
-    if (m_mediaPlayer->availableMetaData().contains(QtMultimedia::MetaData::Size))
-        return m_mediaPlayer->metaData(QtMultimedia::MetaData::Size).toInt();
+    if (m_mediaPlayer->availableMetaData().contains(QMediaMetaData::Size))
+        return m_mediaPlayer->metaData(QMediaMetaData::Size).toInt();
 
     return 100;
 }
diff --git a/Source/WebCore/platform/graphics/qt/SimpleFontDataQt.cpp b/Source/WebCore/platform/graphics/qt/SimpleFontDataQt.cpp
index 677d6086c..415f00d44 100644
--- a/Source/WebCore/platform/graphics/qt/SimpleFontDataQt.cpp
+++ b/Source/WebCore/platform/graphics/qt/SimpleFontDataQt.cpp
@@ -34,9 +34,6 @@ void SimpleFontData::determinePitch()
     m_treatAsFixedPitch = false;
 }
 
-static const float smallCapsFraction = 0.7;
-static const float emphasisMarkFraction = 0.5;
-
 bool SimpleFontData::containsCharacters(const UChar* characters, int length) const
 {
     QRawFont rawFont(m_platformData.rawFont());
@@ -67,26 +64,6 @@ PassRefPtr<SimpleFontData> SimpleFontData::createScaledFontData(const FontDescri
     return SimpleFontData::create(FontPlatformData(m_platformData, scaledSize), isCustomFont(), false);
 }
 
-PassRefPtr<SimpleFontData> SimpleFontData::smallCapsFontData(const FontDescription& fontDescription) const
-{
-    if (!m_derivedFontData)
-        m_derivedFontData = DerivedFontData::create(isCustomFont());
-    if (!m_derivedFontData->smallCaps)
-        m_derivedFontData->smallCaps = createScaledFontData(fontDescription, smallCapsFraction);
-
-    return m_derivedFontData->smallCaps;
-}
-
-PassRefPtr<SimpleFontData> SimpleFontData::emphasisMarkFontData(const FontDescription& fontDescription) const
-{
-    if (!m_derivedFontData)
-        m_derivedFontData = DerivedFontData::create(isCustomFont());
-    if (!m_derivedFontData->emphasisMark)
-        m_derivedFontData->emphasisMark = createScaledFontData(fontDescription, emphasisMarkFraction);
-
-    return m_derivedFontData->emphasisMark;
-}
-
 FloatRect SimpleFontData::platformBoundsForGlyph(Glyph) const
 {
     notImplemented();
diff --git a/Source/WebCore/platform/graphics/skia/ImageBufferSkia.cpp b/Source/WebCore/platform/graphics/skia/ImageBufferSkia.cpp
index 697fde224..ad47cf4b2 100644
--- a/Source/WebCore/platform/graphics/skia/ImageBufferSkia.cpp
+++ b/Source/WebCore/platform/graphics/skia/ImageBufferSkia.cpp
@@ -194,6 +194,7 @@ bool ImageBuffer::copyToPlatformTexture(GraphicsContext3D& context, Platform3DOb
 
     context.pixelStorei(Extensions3D::UNPACK_FLIP_Y_CHROMIUM, false);
     context.pixelStorei(Extensions3D::UNPACK_UNPREMULTIPLY_ALPHA_CHROMIUM, false);
+    context.flush();
     return true;
 }
 
diff --git a/Source/WebCore/platform/graphics/skia/ImageSkia.cpp b/Source/WebCore/platform/graphics/skia/ImageSkia.cpp
index e5a52411d..1dbda0fda 100644
--- a/Source/WebCore/platform/graphics/skia/ImageSkia.cpp
+++ b/Source/WebCore/platform/graphics/skia/ImageSkia.cpp
@@ -389,9 +389,9 @@ static void paintSkBitmap(PlatformContextSkia* platformContext, const NativeImag
     }
 
     if (resampling == RESAMPLE_NONE) {
-      // FIXME: This is to not break tests (it results in the filter bitmap flag
-      // being set to true). We need to decide if we respect RESAMPLE_NONE
-      // being returned from computeResamplingMode.
+        // FIXME: This is to not break tests (it results in the filter bitmap flag
+        // being set to true). We need to decide if we respect RESAMPLE_NONE
+        // being returned from computeResamplingMode.
         resampling = RESAMPLE_LINEAR;
     }
     resampling = limitResamplingMode(platformContext, resampling);
@@ -449,6 +449,8 @@ bool FrameData::clear(bool clearMetadata)
     if (clearMetadata)
         m_haveMetadata = false;
 
+    m_orientation = DefaultImageOrientation;
+
     if (m_frame) {
         // ImageSource::createFrameAtIndex() allocated |m_frame| and passed
         // ownership to BitmapImage; we must delete it here.
@@ -470,14 +472,15 @@ void Image::drawPattern(GraphicsContext* context,
 #if PLATFORM(CHROMIUM)
     TRACE_EVENT0("skia", "Image::drawPattern");
 #endif
-    FloatRect normSrcRect = normalizeRect(floatSrcRect);
-    if (destRect.isEmpty() || normSrcRect.isEmpty())
-        return; // nothing to draw
-
     NativeImageSkia* bitmap = nativeImageForCurrentFrame();
     if (!bitmap)
         return;
 
+    FloatRect normSrcRect = normalizeRect(floatSrcRect);
+    normSrcRect.intersect(FloatRect(0, 0, bitmap->bitmap().width(), bitmap->bitmap().height()));
+    if (destRect.isEmpty() || normSrcRect.isEmpty())
+        return; // nothing to draw
+
     SkMatrix ctm = context->platformContext()->canvas()->getTotalMatrix();
     SkMatrix totalMatrix;
     totalMatrix.setConcat(ctm, patternTransform);
@@ -582,8 +585,12 @@ void BitmapImage::checkForSolidColor()
     }
 }
 
-void BitmapImage::draw(GraphicsContext* ctxt, const FloatRect& dstRect,
-                       const FloatRect& srcRect, ColorSpace colorSpace, CompositeOperator compositeOp)
+void BitmapImage::draw(GraphicsContext* ctxt, const FloatRect& dstRect, const FloatRect& srcRect, ColorSpace colorSpace, CompositeOperator compositeOp)
+{
+    draw(ctxt, dstRect, srcRect, colorSpace, compositeOp, DoNotRespectImageOrientation);
+}
+
+void BitmapImage::draw(GraphicsContext* ctxt, const FloatRect& dstRect, const FloatRect& srcRect, ColorSpace colorSpace, CompositeOperator compositeOp, RespectImageOrientationEnum shouldRespectImageOrientation)
 {
     if (!m_source.initialized())
         return;
@@ -599,10 +606,32 @@ void BitmapImage::draw(GraphicsContext* ctxt, const FloatRect& dstRect,
 
     FloatRect normDstRect = normalizeRect(dstRect);
     FloatRect normSrcRect = normalizeRect(srcRect);
+    normSrcRect.intersect(FloatRect(0, 0, bm->bitmap().width(), bm->bitmap().height()));
 
     if (normSrcRect.isEmpty() || normDstRect.isEmpty())
         return; // Nothing to draw.
 
+    ImageOrientation orientation = DefaultImageOrientation;
+    if (shouldRespectImageOrientation == RespectImageOrientation)
+        orientation = frameOrientationAtIndex(m_currentFrame);
+
+    GraphicsContextStateSaver saveContext(*ctxt, false);
+    if (orientation != DefaultImageOrientation) {
+        saveContext.save();
+
+        // ImageOrientation expects the origin to be at (0, 0)
+        ctxt->translate(normDstRect.x(), normDstRect.y());
+        normDstRect.setLocation(FloatPoint());
+
+        ctxt->concatCTM(orientation.transformFromDefault(normDstRect.size()));
+
+        if (orientation.usesWidthAsHeight()) {
+            // The destination rect will have it's width and height already reversed for the orientation of
+            // the image, as it was needed for page layout, so we need to reverse it back here.
+            normDstRect = FloatRect(normDstRect.x(), normDstRect.y(), normDstRect.height(), normDstRect.width());
+        }
+    }
+
     paintSkBitmap(ctxt->platformContext(),
         *bm,
         normSrcRect,
@@ -623,6 +652,7 @@ void BitmapImageSingleFrameSkia::draw(GraphicsContext* ctxt,
 {
     FloatRect normDstRect = normalizeRect(dstRect);
     FloatRect normSrcRect = normalizeRect(srcRect);
+    normSrcRect.intersect(FloatRect(0, 0, m_nativeImage.bitmap().width(), m_nativeImage.bitmap().height()));
 
     if (normSrcRect.isEmpty() || normDstRect.isEmpty())
         return; // Nothing to draw.
diff --git a/Source/WebCore/platform/graphics/skia/SimpleFontDataSkia.cpp b/Source/WebCore/platform/graphics/skia/SimpleFontDataSkia.cpp
index 4d32c74db..4fc098124 100644
--- a/Source/WebCore/platform/graphics/skia/SimpleFontDataSkia.cpp
+++ b/Source/WebCore/platform/graphics/skia/SimpleFontDataSkia.cpp
@@ -47,9 +47,6 @@
 
 namespace WebCore {
 
-// Smallcaps versions of fonts are 70% the size of the normal font.
-static const float smallCapsFraction = 0.7f;
-static const float emphasisMarkFraction = .5;
 // This is the largest VDMX table which we'll try to load and parse.
 static const size_t maxVDMXTableSize = 1024 * 1024; // 1 MB
 
@@ -183,26 +180,6 @@ PassRefPtr<SimpleFontData> SimpleFontData::createScaledFontData(const FontDescri
     return SimpleFontData::create(FontPlatformData(m_platformData, scaledSize), isCustomFont(), false);
 }
 
-PassRefPtr<SimpleFontData> SimpleFontData::smallCapsFontData(const FontDescription& fontDescription) const
-{
-    if (!m_derivedFontData)
-        m_derivedFontData = DerivedFontData::create(isCustomFont());
-    if (!m_derivedFontData->smallCaps)
-        m_derivedFontData->smallCaps = createScaledFontData(fontDescription, smallCapsFraction);
-
-    return m_derivedFontData->smallCaps;
-}
-
-PassRefPtr<SimpleFontData> SimpleFontData::emphasisMarkFontData(const FontDescription& fontDescription) const
-{
-    if (!m_derivedFontData)
-        m_derivedFontData = DerivedFontData::create(isCustomFont());
-    if (!m_derivedFontData->emphasisMark)
-        m_derivedFontData->emphasisMark = createScaledFontData(fontDescription, emphasisMarkFraction);
-
-    return m_derivedFontData->emphasisMark;
-}
-
 bool SimpleFontData::containsCharacters(const UChar* characters, int length) const
 {
     SkPaint paint;
@@ -234,9 +211,26 @@ void SimpleFontData::determinePitch()
     m_treatAsFixedPitch = platformData().isFixedPitch();
 }
 
-FloatRect SimpleFontData::platformBoundsForGlyph(Glyph) const
+FloatRect SimpleFontData::platformBoundsForGlyph(Glyph glyph) const
 {
-    return FloatRect();
+    if (!m_platformData.size())
+        return FloatRect();
+
+    SkASSERT(sizeof(glyph) == 2); // compile-time assert
+
+    SkPaint paint;
+
+    m_platformData.setupPaint(&paint);
+
+    paint.setTextEncoding(SkPaint::kGlyphID_TextEncoding);
+    SkRect bounds;
+    paint.measureText(&glyph, 2, &bounds);
+    if (!paint.isSubpixelText()) {
+        SkIRect ir;
+        bounds.round(&ir);
+        bounds.set(ir);
+    }
+    return FloatRect(bounds);
 }
     
 float SimpleFontData::platformWidthForGlyph(Glyph glyph) const
diff --git a/Source/WebCore/platform/graphics/surfaces/GraphicsSurface.h b/Source/WebCore/platform/graphics/surfaces/GraphicsSurface.h
index 13ac33051..5602cf521 100644
--- a/Source/WebCore/platform/graphics/surfaces/GraphicsSurface.h
+++ b/Source/WebCore/platform/graphics/surfaces/GraphicsSurface.h
@@ -35,10 +35,15 @@
 typedef struct __IOSurface* IOSurfaceRef;
 typedef IOSurfaceRef PlatformGraphicsSurface;
 #endif
+
 #if OS(LINUX)
 typedef uint32_t PlatformGraphicsSurface;
 #endif
 
+#if OS(WINDOWS)
+typedef HANDLE PlatformGraphicsSurface;
+#endif
+
 namespace WebCore {
 
 class BitmapTexture;
diff --git a/Source/WebCore/platform/graphics/surfaces/GraphicsSurfaceToken.h b/Source/WebCore/platform/graphics/surfaces/GraphicsSurfaceToken.h
index 45342f141..c97f368bd 100644
--- a/Source/WebCore/platform/graphics/surfaces/GraphicsSurfaceToken.h
+++ b/Source/WebCore/platform/graphics/surfaces/GraphicsSurfaceToken.h
@@ -33,7 +33,13 @@ namespace WebCore {
 
 struct GraphicsSurfaceToken {
 
-typedef uint32_t BufferHandle;
+#if OS(DARWIN)
+    typedef mach_port_t BufferHandle;
+#elif OS(LINUX)
+    typedef uint32_t BufferHandle;
+#elif OS(WINDOWS)
+    typedef HANDLE BufferHandle;
+#endif
 
 #if HAVE(GLX)
     GraphicsSurfaceToken(uint32_t windowID = 0)
@@ -52,7 +58,7 @@ typedef uint32_t BufferHandle;
 
 #endif
 
-#if OS(DARWIN)
+#if OS(DARWIN) || OS(WINDOWS)
     GraphicsSurfaceToken(BufferHandle frontBuffer = 0, BufferHandle backBuffer = 0)
         : frontBufferHandle(frontBuffer)
         , backBufferHandle(backBuffer)
diff --git a/Source/WebCore/platform/graphics/surfaces/mac/GraphicsSurfaceMac.cpp b/Source/WebCore/platform/graphics/surfaces/mac/GraphicsSurfaceMac.cpp
index d869eb5cf..8597eb4e2 100644
--- a/Source/WebCore/platform/graphics/surfaces/mac/GraphicsSurfaceMac.cpp
+++ b/Source/WebCore/platform/graphics/surfaces/mac/GraphicsSurfaceMac.cpp
@@ -29,6 +29,7 @@
 #include <IOSurface/IOSurface.h>
 #include <OpenGL/OpenGL.h>
 #include <OpenGL/gl.h>
+#include <mach/mach.h>
 
 #if PLATFORM(QT)
 #include <QGuiApplication>
@@ -79,8 +80,8 @@ public:
         , m_readFbo(0)
         , m_drawFbo(0)
     {
-        m_frontBuffer = IOSurfaceLookup(m_token.frontBufferHandle);
-        m_backBuffer = IOSurfaceLookup(m_token.backBufferHandle);
+        m_frontBuffer = IOSurfaceLookupFromMachPort(m_token.frontBufferHandle);
+        m_backBuffer = IOSurfaceLookupFromMachPort(m_token.backBufferHandle);
     }
 
     GraphicsSurfacePrivate(const PlatformGraphicsContext3D shareContext, const IntSize& size, GraphicsSurface::Flags flags)
@@ -91,22 +92,11 @@ public:
         , m_drawFbo(0)
     {
 #if PLATFORM(QT)
-#if 0
-        // This code path requires QCocoaNativeInterface::nativeResourceForContext() which is not availble in Qt5 on the build bots yet.
         QPlatformNativeInterface* nativeInterface = QGuiApplication::platformNativeInterface();
         CGLContextObj shareContextObject = static_cast<CGLContextObj>(nativeInterface->nativeResourceForContext(QByteArrayLiteral("cglContextObj"), shareContext));
         if (!shareContextObject)
             return;
-#else
-        // This code path should be removed as soon as QCocoaNativeInterface::nativeResourceForContext() has become available in Qt5 on the build bots.
-        CGLContextObj previousContext = CGLGetCurrentContext();
-        QSurface* currentSurface = shareContext->surface();
-        shareContext->makeCurrent(currentSurface);
 
-        CGLContextObj shareContextObject = CGLGetCurrentContext();
-
-        CGLSetCurrentContext(previousContext);
-#endif
         CGLPixelFormatObj pixelFormatObject = CGLGetPixelFormat(shareContextObject);
         if (kCGLNoError != CGLCreateContext(pixelFormatObject, shareContextObject, &m_context))
             return;
@@ -127,8 +117,8 @@ public:
         if (!allocSize)
             return;
 
-        const void *keys[7];
-        const void *values[7];
+        const void *keys[6];
+        const void *values[6];
         keys[0] = kIOSurfaceWidth;
         values[0] = CFNumberCreate(0, kCFNumberIntType, &width);
         keys[1] = kIOSurfaceHeight;
@@ -141,17 +131,18 @@ public:
         values[4] = CFNumberCreate(0, kCFNumberLongType, &bytesPerRow);
         keys[5] = kIOSurfaceAllocSize;
         values[5] = CFNumberCreate(0, kCFNumberLongType, &allocSize);
-        keys[6] = kIOSurfaceIsGlobal;
-        values[6] = (flags & GraphicsSurface::SupportsSharing) ? kCFBooleanTrue : kCFBooleanFalse;
 
-        CFDictionaryRef dict = CFDictionaryCreate(0, keys, values, 7, &kCFTypeDictionaryKeyCallBacks, &kCFTypeDictionaryValueCallBacks);
-        for (unsigned i = 0; i < 7; i++)
+        CFDictionaryRef dict = CFDictionaryCreate(0, keys, values, 6, &kCFTypeDictionaryKeyCallBacks, &kCFTypeDictionaryValueCallBacks);
+        for (unsigned i = 0; i < 6; i++)
             CFRelease(values[i]);
 
         m_frontBuffer = IOSurfaceCreate(dict);
         m_backBuffer = IOSurfaceCreate(dict);
 
-        m_token = GraphicsSurfaceToken(IOSurfaceGetID(m_frontBuffer), IOSurfaceGetID(m_backBuffer));
+        if (!(flags & GraphicsSurface::SupportsSharing))
+            return;
+
+        m_token = GraphicsSurfaceToken(IOSurfaceCreateMachPort(m_frontBuffer), IOSurfaceCreateMachPort(m_backBuffer));
     }
 
     ~GraphicsSurfacePrivate()
@@ -177,6 +168,11 @@ public:
         if (m_context)
             CGLReleaseContext(m_context);
 
+        if (m_token.frontBufferHandle)
+            mach_port_deallocate(mach_task_self(), m_token.frontBufferHandle);
+        if (m_token.backBufferHandle)
+            mach_port_deallocate(mach_task_self(), m_token.backBufferHandle);
+
     }
 
     uint32_t swapBuffers()
diff --git a/Source/WebCore/platform/graphics/surfaces/qt/GraphicsSurfaceGLX.cpp b/Source/WebCore/platform/graphics/surfaces/qt/GraphicsSurfaceGLX.cpp
index fd62a0038..64077ba9c 100644
--- a/Source/WebCore/platform/graphics/surfaces/qt/GraphicsSurfaceGLX.cpp
+++ b/Source/WebCore/platform/graphics/surfaces/qt/GraphicsSurfaceGLX.cpp
@@ -22,13 +22,18 @@
 
 #if USE(GRAPHICS_SURFACE)
 
+#include "NotImplemented.h"
 #include "TextureMapperGL.h"
+
+#if PLATFORM(QT)
 // Qt headers must be included before glx headers.
-#include <QCoreApplication>
+#include <QGuiApplication>
 #include <QOpenGLContext>
-#include <QVector>
-#include <QWindow>
-#include <qpa/qplatformwindow.h>
+#include <qpa/qplatformnativeinterface.h>
+#elif PLATFORM(EFL)
+#include <GL/gl.h>
+#endif
+
 #include <GL/glext.h>
 #include <GL/glx.h>
 #include <X11/extensions/Xcomposite.h>
@@ -50,39 +55,55 @@ class OffScreenRootWindow {
 public:
     OffScreenRootWindow()
     {
-        ++refCount;
+        ++m_refCount;
     }
 
-    QWindow* get(Display* dpy)
+    Window getXWindow()
     {
-        if (!window) {
-            window = new QWindow;
-            window->setGeometry(QRect(-1, -1, 1, 1));
-            window->create();
+        if (!m_window) {
+            Display* dpy = display();
+            m_window = XCreateSimpleWindow(dpy, XDefaultRootWindow(dpy), -1, -1, 1, 1, 0, BlackPixel(dpy, 0), WhitePixel(dpy, 0));
             XSetWindowAttributes attributes;
             attributes.override_redirect = true;
-            XChangeWindowAttributes(dpy, window->handle()->winId(), X11OverrideRedirect, &attributes);
-            window->show();
+            XChangeWindowAttributes(dpy, m_window, X11OverrideRedirect, &attributes);
+            // Map window to the screen
+            XMapWindow(dpy, m_window);
         }
 
-        return window;
+        return m_window;
+    }
+
+    Display* display()
+    {
+        if (!m_display)
+            m_display = XOpenDisplay(0);
+        return m_display;
     }
 
     ~OffScreenRootWindow()
     {
-        if (!--refCount) {
-            delete window;
-            window = 0;
+        if (--m_refCount || !m_display)
+            return;
+
+        if (m_window) {
+            XUnmapWindow(m_display, m_window);
+            XDestroyWindow(m_display, m_window);
+            m_window = 0;
         }
+
+        XCloseDisplay(m_display);
+        m_display = 0;
     }
 
 private:
-    static int refCount;
-    static QWindow* window;
+    static int m_refCount;
+    static Window m_window;
+    static Display* m_display;
 };
 
-int OffScreenRootWindow::refCount = 0;
-QWindow* OffScreenRootWindow::window = 0;
+int OffScreenRootWindow::m_refCount = 0;
+Window OffScreenRootWindow::m_window = 0;
+Display* OffScreenRootWindow::m_display = 0;
 
 static const int glxSpec[] = {
     // The specification is a set key value pairs stored in a simple array.
@@ -106,25 +127,54 @@ struct GraphicsSurfacePrivate {
         : m_display(0)
         , m_xPixmap(0)
         , m_glxPixmap(0)
-        , m_glContext(adoptPtr(new QOpenGLContext))
+        , m_glContext(0)
         , m_detachedContext(0)
         , m_detachedSurface(0)
         , m_textureIsYInverted(false)
         , m_hasAlpha(false)
     {
-        QSurface* currentSurface = 0;
-        QOpenGLContext* currentContext = QOpenGLContext::currentContext();
-        if (currentContext)
-            currentSurface = currentContext->surface();
-
-        m_display = XOpenDisplay(0);
-        m_glContext->setShareContext(shareContext);
-        m_glContext->create();
-
-        // The GLX implementation of QOpenGLContext will reset the current context when create is being called.
-        // Therefore we have to make the previous context current again.
-        if (currentContext)
-            currentContext->makeCurrent(currentSurface);
+        GLXContext shareContextObject = 0;
+        m_display = m_offScreenWindow.display();
+
+#if PLATFORM(QT)
+        if (shareContext) {
+#if 0
+            // This code path requires QXcbNativeInterface::nativeResourceForContext() which is not availble in Qt5 on the build bots yet.
+            QPlatformNativeInterface* nativeInterface = QGuiApplication::platformNativeInterface();
+            shareContextObject = static_cast<GLXContext>(nativeInterface->nativeResourceForContext(QByteArrayLiteral("glxcontext"), shareContext));
+            if (!shareContextObject)
+                return;
+#else
+            // This code path should be removed as soon as QXcbNativeInterface::nativeResourceForContext() can provide the GLXContext.
+            QOpenGLContext* previousContext = QOpenGLContext::currentContext();
+            QSurface* previousSurface = previousContext->surface();
+            QSurface* currentSurface = shareContext->surface();
+            shareContext->makeCurrent(currentSurface);
+
+            shareContextObject = glXGetCurrentContext();
+
+            previousContext->makeCurrent(previousSurface);
+#endif
+        }
+#else
+        UNUSED_PARAM(shareContext);
+#endif
+
+        int attributes[] = {
+            GLX_LEVEL, 0,
+            GLX_DRAWABLE_TYPE, GLX_WINDOW_BIT,
+            GLX_RENDER_TYPE,   GLX_RGBA_BIT,
+            GLX_RED_SIZE,      1,
+            GLX_GREEN_SIZE,    1,
+            GLX_BLUE_SIZE,     1,
+            GLX_DOUBLEBUFFER,  True,
+            None
+        };
+
+        int numReturned;
+        m_fbConfigs = glXChooseFBConfig(m_display, DefaultScreen(m_display), attributes, &numReturned);
+        // Create a GLX context for OpenGL rendering
+        m_glContext = glXCreateNewContext(m_display, m_fbConfigs[0], GLX_RGBA_TYPE, shareContextObject, true);
     }
 
     ~GraphicsSurfacePrivate()
@@ -137,27 +187,34 @@ struct GraphicsSurfacePrivate {
             XFreePixmap(m_display, m_xPixmap);
         m_xPixmap = 0;
 
-        if (m_display)
-            XCloseDisplay(m_display);
-        m_display = 0;
+        if (m_glContext)
+            glXDestroyContext(m_display, m_glContext);
     }
 
     uint32_t createSurface(const IntSize& size)
     {
-        m_surface = adoptPtr(new QWindow(m_offScreenWindow.get(m_display)));
-        m_surface->setSurfaceType(QSurface::OpenGLSurface);
-        m_surface->setGeometry(0, 0, size.width(), size.height());
-        m_surface->create();
-        XCompositeRedirectWindow(m_display, m_surface->handle()->winId(), CompositeRedirectManual);
+        XVisualInfo* visualInfo = glXGetVisualFromFBConfig(m_display, m_fbConfigs[0]);
+        if (!visualInfo)
+            return 0;
+
+        Colormap cmap = XCreateColormap(m_display, m_offScreenWindow.getXWindow(), visualInfo->visual, AllocNone);
+        XSetWindowAttributes a;
+        a.background_pixel = WhitePixel(m_display, 0);
+        a.border_pixel = BlackPixel(m_display, 0);
+        a.colormap = cmap;
+        m_surface = XCreateWindow(m_display, m_offScreenWindow.getXWindow(), 0, 0, size.width(), size.height(),
+            0, visualInfo->depth, InputOutput, visualInfo->visual,
+            CWBackPixel | CWBorderPixel | CWColormap, &a);
+        XSetWindowBackgroundPixmap(m_display, m_surface, 0);
+        XCompositeRedirectWindow(m_display, m_surface, CompositeRedirectManual);
 
         // Make sure the XRender Extension is available.
         int eventBasep, errorBasep;
         if (!XRenderQueryExtension(m_display, &eventBasep, &errorBasep))
             return 0;
 
-        m_surface->show();
-
-        return m_surface->handle()->winId();
+        XMapWindow(m_display, m_surface);
+        return m_surface;
     }
 
     void createPixmap(uint32_t winId)
@@ -184,18 +241,17 @@ struct GraphicsSurfacePrivate {
 
     void makeCurrent()
     {
-        m_detachedContext = QOpenGLContext::currentContext();
-        if (m_detachedContext)
-            m_detachedSurface = m_detachedContext->surface();
-
+        m_detachedContext = glXGetCurrentContext();
+        m_detachedSurface = glXGetCurrentDrawable();
         if (m_surface && m_glContext)
-            m_glContext->makeCurrent(m_surface.get());
+            glXMakeCurrent(m_display, m_surface, m_glContext);
     }
 
     void doneCurrent()
     {
         if (m_detachedContext)
-            m_detachedContext->makeCurrent(m_detachedSurface);
+            glXMakeCurrent(m_display, m_detachedSurface, m_detachedContext);
+        m_detachedContext = 0;
     }
 
     void swapBuffers()
@@ -206,20 +262,13 @@ struct GraphicsSurfacePrivate {
         if (m_xPixmap)
             return;
 
-        if (!m_surface->isVisible())
-            return;
-
-        // Creating and exposing the surface is asynchronous. Therefore we have to wait here
-        // before swapping the buffers. This should only be the case for the very first frame.
-        while (!m_surface->isExposed())
-            QCoreApplication::processEvents();
+        GLXContext glContext = glXGetCurrentContext();
 
-        QOpenGLContext* glContext = QOpenGLContext::currentContext();
         if (m_surface && glContext) {
             GLint oldFBO;
             glGetIntegerv(GL_FRAMEBUFFER_BINDING, &oldFBO);
-            pGlBindFramebuffer(GL_FRAMEBUFFER, glContext->defaultFramebufferObject());
-            glContext->swapBuffers(m_surface.get());
+            pGlBindFramebuffer(GL_FRAMEBUFFER, 0);
+            glXSwapBuffers(m_display, m_surface);
             pGlBindFramebuffer(GL_FRAMEBUFFER, oldFBO);
         }
     }
@@ -242,7 +291,7 @@ struct GraphicsSurfacePrivate {
         glBindTexture(GL_TEXTURE_2D, texture);
         pGlFramebufferTexture2D(GL_READ_FRAMEBUFFER, GL_COLOR_ATTACHMENT0, GL_TEXTURE_2D, texture, 0);
 
-        pGlBindFramebuffer(GL_DRAW_FRAMEBUFFER, glContext()->defaultFramebufferObject());
+        pGlBindFramebuffer(GL_DRAW_FRAMEBUFFER, 0);
         pGlBlitFramebuffer(x, y, width, height, x, y, width, height, GL_COLOR_BUFFER_BIT, GL_LINEAR);
 
         pGlFramebufferTexture2D(GL_READ_FRAMEBUFFER, GL_COLOR_ATTACHMENT0, GL_TEXTURE_2D, 0, 0);
@@ -254,45 +303,40 @@ struct GraphicsSurfacePrivate {
         doneCurrent();
     }
 
-
     Display* display() const { return m_display; }
 
     GLXPixmap glxPixmap() const { return m_glxPixmap; }
 
     IntSize size() const { return m_size; }
 
-    QOpenGLContext* glContext() { return m_glContext.get(); }
-
 private:
     OffScreenRootWindow m_offScreenWindow;
     IntSize m_size;
     Display* m_display;
     Pixmap m_xPixmap;
     GLXPixmap m_glxPixmap;
-    OwnPtr<QWindow> m_surface;
-    OwnPtr<QOpenGLContext> m_glContext;
-    QOpenGLContext* m_detachedContext;
-    QSurface* m_detachedSurface;
+    Window m_surface;
+    GLXContext m_glContext;
+    GLXContext m_detachedContext;
+    GLXDrawable m_detachedSurface;
+    GLXFBConfig* m_fbConfigs;
     bool m_textureIsYInverted;
     bool m_hasAlpha;
 };
 
-static bool resolveGLMethods(GraphicsSurfacePrivate* p)
+static bool resolveGLMethods(GraphicsSurfacePrivate*)
 {
     static bool resolved = false;
     if (resolved)
         return true;
-
-    QOpenGLContext* glContext = p->glContext();
-    pGlXBindTexImageEXT = reinterpret_cast<PFNGLXBINDTEXIMAGEEXTPROC>(glContext->getProcAddress("glXBindTexImageEXT"));
-    pGlXReleaseTexImageEXT = reinterpret_cast<PFNGLXRELEASETEXIMAGEEXTPROC>(glContext->getProcAddress("glXReleaseTexImageEXT"));
-    pGlBindFramebuffer = reinterpret_cast<PFNGLBINDFRAMEBUFFERPROC>(glContext->getProcAddress("glBindFramebuffer"));
-    pGlBlitFramebuffer = reinterpret_cast<PFNGLBLITFRAMEBUFFERPROC>(glContext->getProcAddress("glBlitFramebuffer"));
-
-    pGlGenFramebuffers = reinterpret_cast<PFNGLGENFRAMEBUFFERSPROC>(glContext->getProcAddress("glGenFramebuffers"));
-    pGlDeleteFramebuffers = reinterpret_cast<PFNGLDELETEFRAMEBUFFERSPROC>(glContext->getProcAddress("glDeleteFramebuffers"));
-    pGlFramebufferTexture2D = reinterpret_cast<PFNGLFRAMEBUFFERTEXTURE2DPROC>(glContext->getProcAddress("glFramebufferTexture2D"));
-
+    pGlXBindTexImageEXT = reinterpret_cast<PFNGLXBINDTEXIMAGEEXTPROC>(glXGetProcAddress(reinterpret_cast<const GLubyte*>("glXBindTexImageEXT")));
+    pGlXReleaseTexImageEXT = reinterpret_cast<PFNGLXRELEASETEXIMAGEEXTPROC>(glXGetProcAddress(reinterpret_cast<const GLubyte*>("glXReleaseTexImageEXT")));
+    pGlBindFramebuffer = reinterpret_cast<PFNGLBINDFRAMEBUFFERPROC>(glXGetProcAddress(reinterpret_cast<const GLubyte*>("glBindFramebuffer")));
+    pGlBlitFramebuffer = reinterpret_cast<PFNGLBLITFRAMEBUFFERPROC>(glXGetProcAddress(reinterpret_cast<const GLubyte*>("glBlitFramebuffer")));
+
+    pGlGenFramebuffers = reinterpret_cast<PFNGLGENFRAMEBUFFERSPROC>(glXGetProcAddress(reinterpret_cast<const GLubyte*>("glGenFramebuffers")));
+    pGlDeleteFramebuffers = reinterpret_cast<PFNGLDELETEFRAMEBUFFERSPROC>(glXGetProcAddress(reinterpret_cast<const GLubyte*>("glDeleteFramebuffers")));
+    pGlFramebufferTexture2D = reinterpret_cast<PFNGLFRAMEBUFFERTEXTURE2DPROC>(glXGetProcAddress(reinterpret_cast<const GLubyte*>("glFramebufferTexture2D")));
     resolved = pGlBlitFramebuffer && pGlBindFramebuffer && pGlXBindTexImageEXT && pGlXReleaseTexImageEXT;
 
     return resolved;
@@ -318,7 +362,7 @@ uint32_t GraphicsSurface::platformGetTextureID()
     return m_texture;
 }
 
-void GraphicsSurface::platformCopyToGLTexture(uint32_t target, uint32_t id, const IntRect& targetRect, const IntPoint& offset)
+void GraphicsSurface::platformCopyToGLTexture(uint32_t /*target*/, uint32_t /*id*/, const IntRect& /*targetRect*/, const IntPoint& /*offset*/)
 {
     // This is not supported by GLX/Xcomposite.
 }
@@ -331,9 +375,10 @@ void GraphicsSurface::platformCopyFromTexture(uint32_t texture, const IntRect& s
 
 void GraphicsSurface::platformPaintToTextureMapper(TextureMapper* textureMapper, const FloatRect& targetRect, const TransformationMatrix& transform, float opacity, BitmapTexture* mask)
 {
+    TextureMapperGL* texMapGL = static_cast<TextureMapperGL*>(textureMapper);
     TransformationMatrix adjustedTransform = transform;
     adjustedTransform.multiply(TransformationMatrix::rectToRect(FloatRect(FloatPoint::zero(), m_size), targetRect));
-    static_cast<TextureMapperGL*>(textureMapper)->drawTexture(platformGetTextureID(), 0, m_size, targetRect, adjustedTransform, opacity, mask);
+    texMapGL->drawTexture(platformGetTextureID(), TextureMapperGL::ShouldFlipTexture, m_size, targetRect, adjustedTransform, opacity, mask);
 }
 
 uint32_t GraphicsSurface::platformFrontBuffer() const
@@ -388,7 +433,7 @@ PassRefPtr<GraphicsSurface> GraphicsSurface::platformImport(const IntSize& size,
     return surface;
 }
 
-char* GraphicsSurface::platformLock(const IntRect& rect, int* outputStride, LockOptions lockOptions)
+char* GraphicsSurface::platformLock(const IntRect&, int* /*outputStride*/, LockOptions)
 {
     // GraphicsSurface is currently only being used for WebGL, which does not require this locking mechanism.
     return 0;
@@ -410,5 +455,18 @@ void GraphicsSurface::platformDestroy()
     m_private = 0;
 }
 
+#if !PLATFORM(QT)
+PassOwnPtr<GraphicsContext> GraphicsSurface::platformBeginPaint(const IntSize&, char*, int)
+{
+    notImplemented();
+    return nullptr;
+}
+
+PassRefPtr<Image> GraphicsSurface::createReadOnlyImage(const IntRect&)
+{
+    notImplemented();
+    return 0;
+}
+#endif
 }
 #endif
diff --git a/Source/WebCore/platform/graphics/surfaces/win/GraphicsSurfaceWin.cpp b/Source/WebCore/platform/graphics/surfaces/win/GraphicsSurfaceWin.cpp
new file mode 100644
index 000000000..19bebd2ff
--- /dev/null
+++ b/Source/WebCore/platform/graphics/surfaces/win/GraphicsSurfaceWin.cpp
@@ -0,0 +1,492 @@
+/*
+
+ Copyright (C) 2012 Zeno Albisser <zeno@webkit.org>
+
+ This library is free software; you can redistribute it and/or
+ modify it under the terms of the GNU Library General Public
+ License as published by the Free Software Foundation; either
+ version 2 of the License, or (at your option) any later version.
+
+ This library is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ Library General Public License for more details.
+
+ You should have received a copy of the GNU Library General Public License
+ along with this library; see the file COPYING.LIB.  If not, write to
+ the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ Boston, MA 02110-1301, USA.
+ */
+
+#include "config.h"
+#include "GraphicsSurface.h"
+
+#if USE(GRAPHICS_SURFACE)
+#include "TextureMapperGL.h"
+
+#define EGL_EGLEXT_PROTOTYPES // This must be defined before including egl.h and eglext.h.
+#include <EGL/egl.h>
+#include <EGL/eglext.h>
+
+#if PLATFORM(QT)
+#include <QGuiApplication>
+#include <QOpenGLContext>
+#include <qpa/qplatformnativeinterface.h>
+#endif
+
+namespace WebCore {
+
+#define STRINGIFY(...) #__VA_ARGS__
+
+static GLuint loadShader(GLenum type, const GLchar *shaderSrc)
+{
+    GLuint shader;
+    GLint compiled;
+
+    shader = glCreateShader(type);
+    if (!shader)
+        return 0;
+
+    glShaderSource(shader, 1, &shaderSrc, 0);
+    glCompileShader(shader);
+    glGetShaderiv(shader, GL_COMPILE_STATUS, &compiled);
+    if (!compiled) {
+        glDeleteShader(shader);
+        return 0;
+    }
+    return shader;
+}
+
+struct GraphicsSurfacePrivate {
+public:
+    GraphicsSurfacePrivate(const IntSize& size, GraphicsSurfaceToken token)
+        : m_token(token)
+        , m_detachedContext(0)
+        , m_detachedReadSurface(0)
+        , m_detachedDrawSurface(0)
+        , m_size(size)
+        , m_eglDisplay(0)
+        , m_eglContext(0)
+        , m_eglConfig(0)
+        , m_eglFrontBufferSurface(0)
+        , m_eglBackBufferSurface(0)
+        , m_initialFrontBufferShareHandle(token.frontBufferHandle)
+        , m_frontBufferShareHandle(token.frontBufferHandle)
+        , m_backBufferShareHandle(token.backBufferHandle)
+        , m_frontBufferTexture(0)
+        , m_shaderProgram(0)
+    {
+        initializeShaderProgram();
+    }
+
+
+    GraphicsSurfacePrivate(const PlatformGraphicsContext3D shareContext, const IntSize& size, GraphicsSurface::Flags flags)
+        : m_detachedContext(0)
+        , m_detachedReadSurface(0)
+        , m_detachedDrawSurface(0)
+        , m_size(size)
+        , m_eglDisplay(0)
+        , m_eglContext(0)
+        , m_eglConfig(0)
+        , m_eglFrontBufferSurface(0)
+        , m_eglBackBufferSurface(0)
+        , m_initialFrontBufferShareHandle(0)
+        , m_frontBufferShareHandle(0)
+        , m_backBufferShareHandle(0)
+        , m_frontBufferTexture(0)
+        , m_shaderProgram(0)
+    {
+        initializeShaderProgram();
+
+        static PFNEGLQUERYSURFACEPOINTERANGLEPROC eglQuerySurfacePointerANGLE = 0;
+        if (!eglQuerySurfacePointerANGLE) {
+            eglQuerySurfacePointerANGLE = reinterpret_cast<PFNEGLQUERYSURFACEPOINTERANGLEPROC>(eglGetProcAddress("eglQuerySurfacePointerANGLE"));
+            if (!eglQuerySurfacePointerANGLE)
+                return;
+        }
+
+        if (!m_eglDisplay || !m_eglContext || !m_eglConfig) {
+            m_eglDisplay = eglGetCurrentDisplay();
+
+#if PLATFORM(QT)
+            QPlatformNativeInterface* nativeInterface = QGuiApplication::platformNativeInterface();
+            m_eglConfig = static_cast<EGLConfig>(nativeInterface->nativeResourceForContext(QByteArrayLiteral("eglConfig"), shareContext));
+            EGLContext eglShareContext = static_cast<EGLContext>(nativeInterface->nativeResourceForContext(QByteArrayLiteral("eglContext"), shareContext));
+#endif
+            EGLint contextAttributes[] = { EGL_CONTEXT_CLIENT_VERSION, 2, EGL_NONE };
+            m_eglContext = eglCreateContext(m_eglDisplay, m_eglConfig, eglShareContext, contextAttributes);
+        }
+
+        EGLint attributes[] = {
+            EGL_WIDTH, size.width(),
+            EGL_HEIGHT, size.height(),
+            EGL_TEXTURE_FORMAT, EGL_TEXTURE_RGB,
+            EGL_TEXTURE_TARGET, EGL_TEXTURE_2D,
+            EGL_NONE
+        };
+
+        m_eglFrontBufferSurface = eglCreatePbufferSurface(m_eglDisplay, m_eglConfig, attributes);
+        m_eglBackBufferSurface = eglCreatePbufferSurface(m_eglDisplay, m_eglConfig, attributes);
+        if (m_eglFrontBufferSurface == EGL_NO_SURFACE || m_eglBackBufferSurface == EGL_NO_SURFACE)
+            return;
+
+        eglQuerySurfacePointerANGLE(m_eglDisplay, m_eglFrontBufferSurface, EGL_D3D_TEXTURE_2D_SHARE_HANDLE_ANGLE, &m_frontBufferShareHandle);
+        eglQuerySurfacePointerANGLE(m_eglDisplay, m_eglBackBufferSurface, EGL_D3D_TEXTURE_2D_SHARE_HANDLE_ANGLE, &m_backBufferShareHandle);
+
+        m_initialFrontBufferShareHandle = m_frontBufferShareHandle;
+
+        m_token = GraphicsSurfaceToken(m_frontBufferShareHandle, m_backBufferShareHandle);
+    }
+
+    ~GraphicsSurfacePrivate()
+    {
+        releaseFrontBufferTexture();
+
+        if (m_eglBackBufferSurface)
+            eglDestroySurface(m_eglDisplay, m_eglBackBufferSurface);
+
+        if (m_shaderProgram)
+            glDeleteProgram(m_shaderProgram);
+        m_shaderProgram = 0;
+
+        if (m_eglDisplay && m_eglContext)
+            eglDestroyContext(m_eglDisplay, m_eglContext);
+    }
+
+    void copyFromTexture(uint32_t texture, const IntRect& sourceRect)
+    {
+        if (!makeCurrent())
+            return;
+        glBindFramebuffer(GL_FRAMEBUFFER, 0);
+        drawTexture(texture);
+        glFinish();
+        doneCurrent();
+    }
+
+    bool makeCurrent()
+    {
+        m_detachedContext = eglGetCurrentContext();
+        m_detachedReadSurface = eglGetCurrentSurface(EGL_READ);
+        m_detachedDrawSurface = eglGetCurrentSurface(EGL_DRAW);
+
+        return eglMakeCurrent(m_eglDisplay, m_eglBackBufferSurface, m_eglBackBufferSurface, m_eglContext);
+    }
+
+    bool doneCurrent()
+    {
+        if (!m_detachedContext || !m_detachedDrawSurface || !m_detachedReadSurface)
+            return false;
+
+        bool success = eglMakeCurrent(m_eglDisplay, m_detachedDrawSurface, m_detachedReadSurface, m_detachedContext);
+        m_detachedContext = 0;
+        m_detachedReadSurface = 0;
+        m_detachedDrawSurface = 0;
+        return success;
+    }
+
+    PlatformGraphicsSurface swapBuffers()
+    {
+        if (m_frontBufferTexture)
+            releaseFrontBufferTexture();
+        std::swap(m_eglFrontBufferSurface, m_eglBackBufferSurface);
+        std::swap(m_frontBufferShareHandle, m_backBufferShareHandle);
+
+        return m_frontBufferShareHandle;
+    }
+
+    GraphicsSurfaceToken token() const
+    {
+        return m_token;
+    }
+
+    uint32_t frontBufferTextureID()
+    {
+        if (!m_eglFrontBufferSurface) {
+            m_eglFrontBufferSurface = createSurfaceFromShareHandle(m_size, m_frontBufferShareHandle);
+
+            glGenTextures(1, &m_frontBufferTexture);
+            glActiveTexture(GL_TEXTURE0);
+            glBindTexture(GL_TEXTURE_2D, m_frontBufferTexture);
+            eglBindTexImage(m_eglDisplay, m_eglFrontBufferSurface, EGL_BACK_BUFFER);
+
+            glTexParameteri(GL_TEXTURE_2D, GL_TEXTURE_MIN_FILTER, GL_LINEAR);
+            glTexParameteri(GL_TEXTURE_2D, GL_TEXTURE_MAG_FILTER, GL_LINEAR);
+            glTexParameteri(GL_TEXTURE_2D, GL_TEXTURE_WRAP_S, GL_CLAMP_TO_EDGE);
+            glTexParameteri(GL_TEXTURE_2D, GL_TEXTURE_WRAP_T, GL_CLAMP_TO_EDGE);
+        }
+
+        return m_frontBufferTexture;
+    }
+
+    PlatformGraphicsSurface initialFrontBufferShareHandle() const
+    {
+        return m_initialFrontBufferShareHandle;
+    }
+
+    PlatformGraphicsSurface frontBufferShareHandle() const
+    {
+        return m_frontBufferShareHandle;
+    }
+
+    PlatformGraphicsSurface backBufferShareHandle() const
+    {
+        return m_backBufferShareHandle;
+    }
+
+    void releaseFrontBufferTexture()
+    {
+        if (m_frontBufferTexture) {
+            eglReleaseTexImage(m_eglDisplay, m_eglFrontBufferSurface, EGL_BACK_BUFFER);
+            glDeleteTextures(1, &m_frontBufferTexture);
+            m_frontBufferTexture = 0;
+        }
+
+        if (m_eglFrontBufferSurface)
+            eglDestroySurface(m_eglDisplay, m_eglFrontBufferSurface);
+        m_eglFrontBufferSurface = 0;
+    }
+
+
+protected:
+    void initializeShaderProgram()
+    {
+        if (m_shaderProgram)
+            return;
+
+        GLchar vShaderStr[] =
+            STRINGIFY(
+                attribute highp vec2 vertex;
+                attribute highp vec2 textureCoordinates;
+                varying highp vec2 textureCoords;
+                void main(void)
+                {
+                    gl_Position = vec4(vertex, 0.0, 1.0);
+                    textureCoords = textureCoordinates;
+                }
+            );
+
+        GLchar fShaderStr[] =
+            STRINGIFY(
+                varying highp vec2 textureCoords;
+                uniform sampler2D texture;
+                void main(void)
+                {
+                    highp vec3 color = texture2D(texture, textureCoords).rgb;
+                    gl_FragColor = vec4(clamp(color, 0.0, 1.0), 1.0);
+                }
+            );
+
+        GLuint vertexShader;
+        GLuint fragmentShader;
+        GLint linked;
+
+        vertexShader = loadShader(GL_VERTEX_SHADER, vShaderStr);
+        fragmentShader = loadShader(GL_FRAGMENT_SHADER, fShaderStr);
+        if (!vertexShader || !fragmentShader)
+            return;
+
+        m_shaderProgram = glCreateProgram();
+        if (!m_shaderProgram)
+            return;
+
+        glAttachShader(m_shaderProgram, vertexShader);
+        glAttachShader(m_shaderProgram, fragmentShader);
+
+        glLinkProgram(m_shaderProgram);
+        glGetProgramiv(m_shaderProgram, GL_LINK_STATUS, &linked);
+        if (!linked) {
+            glDeleteProgram(m_shaderProgram);
+            m_shaderProgram = 0;
+        }
+
+        m_vertexAttr = glGetAttribLocation(m_shaderProgram, "vertex");
+        m_textureCoordinatesAttr = glGetAttribLocation(m_shaderProgram, "textureCoordinates");
+        m_textureUniform = glGetAttribLocation(m_shaderProgram, "texture");
+
+        glTexParameteri(GL_TEXTURE_2D, GL_TEXTURE_MIN_FILTER, GL_LINEAR);
+        glTexParameteri(GL_TEXTURE_2D, GL_TEXTURE_MAG_FILTER, GL_LINEAR);
+        glTexParameteri(GL_TEXTURE_2D, GL_TEXTURE_WRAP_S, GL_CLAMP_TO_EDGE);
+        glTexParameteri(GL_TEXTURE_2D, GL_TEXTURE_WRAP_T, GL_CLAMP_TO_EDGE);
+    }
+
+    EGLSurface createSurfaceFromShareHandle(const IntSize& size, HANDLE shareHandle)
+    {
+        if (!m_eglDisplay  || !m_eglConfig) {
+            m_eglDisplay = eglGetCurrentDisplay();
+
+#if PLATFORM(QT)
+            QPlatformNativeInterface* nativeInterface = QGuiApplication::platformNativeInterface();
+            m_eglConfig = static_cast<EGLConfig>(nativeInterface->nativeResourceForContext(QByteArrayLiteral("eglConfig"), QOpenGLContext::currentContext()));
+#endif
+        }
+
+        EGLint attributes[] = {
+            EGL_WIDTH, size.width(),
+            EGL_HEIGHT, size.height(),
+            EGL_TEXTURE_FORMAT, EGL_TEXTURE_RGB,
+            EGL_TEXTURE_TARGET, EGL_TEXTURE_2D,
+            EGL_NONE
+        };
+
+        EGLSurface surface = eglCreatePbufferFromClientBuffer(m_eglDisplay, EGL_D3D_TEXTURE_2D_SHARE_HANDLE_ANGLE, reinterpret_cast<EGLClientBuffer>(shareHandle), m_eglConfig, attributes);
+        ASSERT(surface);
+
+        return surface;
+    }
+
+    void drawTexture(uint32_t texture)
+    {
+        glUseProgram(m_shaderProgram);
+
+        glBindBuffer(GL_ARRAY_BUFFER, 0);
+        glBindTexture(GL_TEXTURE_2D, texture);
+
+        glTexParameteri(GL_TEXTURE_2D, GL_TEXTURE_MIN_FILTER, GL_LINEAR);
+        glTexParameteri(GL_TEXTURE_2D, GL_TEXTURE_MAG_FILTER, GL_LINEAR);
+        glTexParameteri(GL_TEXTURE_2D, GL_TEXTURE_WRAP_S, GL_CLAMP_TO_EDGE);
+        glTexParameteri(GL_TEXTURE_2D, GL_TEXTURE_WRAP_T, GL_CLAMP_TO_EDGE);
+
+        GLfloat afVertices[] = {
+            -1, -1,
+             1, -1,
+            -1,  1,
+             1,  1
+        };
+        glVertexAttribPointer(m_vertexAttr, 2, GL_FLOAT, GL_FALSE, 0, afVertices);
+
+        GLfloat aftextureCoordinates[] = {
+            0, 1,
+            1, 1,
+            0, 0,
+            1, 0
+        };
+        glVertexAttribPointer(m_textureCoordinatesAttr, 2, GL_FLOAT, GL_FALSE, 0, aftextureCoordinates);
+
+        glUniform1i(m_textureUniform, 0);
+
+        glEnableVertexAttribArray(m_vertexAttr);
+        glEnableVertexAttribArray(m_textureCoordinatesAttr);
+
+        glDrawArrays(GL_TRIANGLE_STRIP, 0, 4);
+
+        glDisableVertexAttribArray(m_vertexAttr);
+        glDisableVertexAttribArray(m_textureCoordinatesAttr);
+
+        glBindTexture(GL_TEXTURE_2D, 0);
+    }
+
+private:
+    GraphicsSurfaceToken m_token;
+    EGLContext m_detachedContext;
+    EGLSurface m_detachedReadSurface;
+    EGLSurface m_detachedDrawSurface;
+    IntSize m_size;
+    EGLDisplay m_eglDisplay;
+    EGLContext m_eglContext;
+    EGLConfig m_eglConfig;
+    EGLSurface m_eglFrontBufferSurface;
+    EGLSurface m_eglBackBufferSurface;
+    PlatformGraphicsSurface m_initialFrontBufferShareHandle;
+    PlatformGraphicsSurface m_frontBufferShareHandle;
+    PlatformGraphicsSurface m_backBufferShareHandle;
+    GLuint m_frontBufferTexture;
+    GLint m_shaderProgram;
+
+    GLuint m_vertexAttr;
+    GLuint m_textureCoordinatesAttr;
+    GLuint m_textureUniform;
+};
+
+GraphicsSurfaceToken GraphicsSurface::platformExport()
+{
+    return m_private->token();
+}
+
+uint32_t GraphicsSurface::platformGetTextureID()
+{
+    return m_private->frontBufferTextureID();
+}
+
+void GraphicsSurface::platformCopyToGLTexture(uint32_t target, uint32_t id, const IntRect& targetRect, const IntPoint& offset)
+{
+    // Currently not implemented.
+}
+
+void GraphicsSurface::platformCopyFromTexture(uint32_t texture, const IntRect& sourceRect)
+{
+    m_private->copyFromTexture(texture, sourceRect);
+}
+
+void GraphicsSurface::platformPaintToTextureMapper(TextureMapper* textureMapper, const FloatRect& targetRect, const TransformationMatrix& transform, float opacity, BitmapTexture* mask)
+{
+    GLuint frontBufferTexture = platformGetTextureID();
+
+    TransformationMatrix adjustedTransform = transform;
+    adjustedTransform.multiply(TransformationMatrix::rectToRect(FloatRect(FloatPoint::zero(), m_size), targetRect));
+    static_cast<TextureMapperGL*>(textureMapper)->drawTexture(frontBufferTexture, 0, m_size, targetRect, adjustedTransform, opacity, mask);
+}
+
+uint32_t GraphicsSurface::platformFrontBuffer() const
+{
+    if (m_private->initialFrontBufferShareHandle() == m_private->frontBufferShareHandle())
+        return 0;
+    if (m_private->initialFrontBufferShareHandle() == m_private->backBufferShareHandle())
+        return 1;
+    return 0xFFFF;
+}
+
+uint32_t GraphicsSurface::platformSwapBuffers()
+{
+    m_private->swapBuffers();
+    return platformFrontBuffer();
+}
+
+PassRefPtr<GraphicsSurface> GraphicsSurface::platformCreate(const IntSize& size, Flags flags, const PlatformGraphicsContext3D shareContext)
+{
+    // Single buffered GraphicsSurface is currently not supported.
+    if (flags & SupportsCopyToTexture || flags & SupportsSingleBuffered)
+        return PassRefPtr<GraphicsSurface>();
+
+    RefPtr<GraphicsSurface> surface = adoptRef(new GraphicsSurface(size, flags));
+    surface->m_private = new GraphicsSurfacePrivate(shareContext, size, flags);
+
+    if (!surface->m_private->frontBufferShareHandle() || !surface->m_private->backBufferShareHandle())
+        return PassRefPtr<GraphicsSurface>();
+
+    return surface;
+}
+
+PassRefPtr<GraphicsSurface> GraphicsSurface::platformImport(const IntSize& size, Flags flags, const GraphicsSurfaceToken& token)
+{
+    // Single buffered GraphicsSurface is currently not supported.
+    if (flags & SupportsCopyToTexture || flags & SupportsSingleBuffered)
+        return PassRefPtr<GraphicsSurface>();
+
+    RefPtr<GraphicsSurface> surface = adoptRef(new GraphicsSurface(size, flags));
+    surface->m_private = new GraphicsSurfacePrivate(size, token);
+
+    if (!surface->m_private->frontBufferShareHandle() || !surface->m_private->backBufferShareHandle())
+        return PassRefPtr<GraphicsSurface>();
+
+    return surface;
+}
+
+char* GraphicsSurface::platformLock(const IntRect& rect, int* outputStride, LockOptions lockOptions)
+{
+    // GraphicsSurface is currently only being used for WebGL, which does not require this locking mechanism.
+    return 0;
+}
+
+void GraphicsSurface::platformUnlock()
+{
+    // GraphicsSurface is currently only being used for WebGL, which does not require this locking mechanism.
+}
+
+void GraphicsSurface::platformDestroy()
+{
+    delete m_private;
+    m_private = 0;
+}
+
+}
+#endif
diff --git a/Source/WebCore/platform/graphics/texmap/GraphicsLayerTextureMapper.cpp b/Source/WebCore/platform/graphics/texmap/GraphicsLayerTextureMapper.cpp
index 42954a499..41897c63e 100644
--- a/Source/WebCore/platform/graphics/texmap/GraphicsLayerTextureMapper.cpp
+++ b/Source/WebCore/platform/graphics/texmap/GraphicsLayerTextureMapper.cpp
@@ -20,6 +20,7 @@
 #include "config.h"
 #include "GraphicsLayerTextureMapper.h"
 
+#include "GraphicsLayerAnimation.h"
 #include "GraphicsLayerFactory.h"
 #include "TextureMapperLayer.h"
 
@@ -87,6 +88,7 @@ void GraphicsLayerTextureMapper::setNeedsDisplay()
 {
     m_needsDisplay = true;
     notifyChange(TextureMapperLayer::DisplayChange);
+    addRepaintRect(FloatRect(FloatPoint(), m_size));
 }
 
 /* \reimp (GraphicsLayer.h)
@@ -94,6 +96,7 @@ void GraphicsLayerTextureMapper::setNeedsDisplay()
 void GraphicsLayerTextureMapper::setContentsNeedsDisplay()
 {
     notifyChange(TextureMapperLayer::DisplayChange);
+    addRepaintRect(contentsRect());
 }
 
 /* \reimp (GraphicsLayer.h)
@@ -104,6 +107,7 @@ void GraphicsLayerTextureMapper::setNeedsDisplayInRect(const FloatRect& rect)
         return;
     m_needsDisplayRect.unite(rect);
     notifyChange(TextureMapperLayer::DisplayChange);
+    addRepaintRect(rect);
 }
 
 /* \reimp (GraphicsLayer.h)
@@ -392,12 +396,19 @@ bool GraphicsLayerTextureMapper::addAnimation(const KeyframeValueList& valueList
     if (valueList.property() == AnimatedPropertyWebkitTransform)
         listsMatch = validateTransformOperations(valueList, hasBigRotation) >= 0;
 
-    m_animations.add(GraphicsLayerAnimation(keyframesName, valueList, boxSize, anim, timeOffset, listsMatch));
+    m_animations.add(GraphicsLayerAnimation(keyframesName, valueList, boxSize, anim, WTF::currentTime() - timeOffset, listsMatch));
     notifyChange(TextureMapperLayer::AnimationChange);
     m_animationStartedTimer.startOneShot(0);
     return true;
 }
 
+void GraphicsLayerTextureMapper::setAnimations(const GraphicsLayerAnimations& animations)
+{
+    m_animations = animations;
+    notifyChange(TextureMapperLayer::AnimationChange);
+}
+
+
 void GraphicsLayerTextureMapper::pauseAnimation(const String& animationName, double timeOffset)
 {
     m_animations.pause(animationName, timeOffset);
diff --git a/Source/WebCore/platform/graphics/texmap/GraphicsLayerTextureMapper.h b/Source/WebCore/platform/graphics/texmap/GraphicsLayerTextureMapper.h
index 637abd9d4..510b23f5c 100644
--- a/Source/WebCore/platform/graphics/texmap/GraphicsLayerTextureMapper.h
+++ b/Source/WebCore/platform/graphics/texmap/GraphicsLayerTextureMapper.h
@@ -81,6 +81,7 @@ public:
     virtual bool addAnimation(const KeyframeValueList&, const IntSize&, const Animation*, const String&, double);
     virtual void pauseAnimation(const String&, double);
     virtual void removeAnimation(const String&);
+    void setAnimations(const GraphicsLayerAnimations&);
 
     TextureMapperLayer* layer() const { return m_layer.get(); }
     TextureMapperPlatformLayer* contentsLayer() const { return m_contentsLayer; }
diff --git a/Source/WebCore/platform/graphics/texmap/TextureMapper.cpp b/Source/WebCore/platform/graphics/texmap/TextureMapper.cpp
index cee45b969..7a980a9c5 100644
--- a/Source/WebCore/platform/graphics/texmap/TextureMapper.cpp
+++ b/Source/WebCore/platform/graphics/texmap/TextureMapper.cpp
@@ -21,33 +21,108 @@
 #include "TextureMapper.h"
 
 #include "TextureMapperImageBuffer.h"
+#include "Timer.h"
+#include <wtf/CurrentTime.h>
+#include <wtf/NonCopyingSort.h>
 
 #if USE(ACCELERATED_COMPOSITING) && USE(TEXTURE_MAPPER)
 
 namespace WebCore {
 
-PassRefPtr<BitmapTexture> TextureMapper::acquireTextureFromPool(const IntSize& size)
+struct BitmapTexturePoolEntry {
+    explicit BitmapTexturePoolEntry(PassRefPtr<BitmapTexture> texture)
+        : m_texture(texture)
+    { }
+    inline void markUsed() { m_timeLastUsed = monotonicallyIncreasingTime(); }
+    static bool compareTimeLastUsed(const BitmapTexturePoolEntry& a, const BitmapTexturePoolEntry& b)
+    {
+        return a.m_timeLastUsed - b.m_timeLastUsed > 0;
+    }
+
+    RefPtr<BitmapTexture> m_texture;
+    double m_timeLastUsed;
+};
+
+class BitmapTexturePool {
+    WTF_MAKE_NONCOPYABLE(BitmapTexturePool);
+    WTF_MAKE_FAST_ALLOCATED;
+public:
+    BitmapTexturePool();
+
+    PassRefPtr<BitmapTexture> acquireTexture(const IntSize&, TextureMapper*);
+
+private:
+    void scheduleReleaseUnusedTextures();
+    void releaseUnusedTexturesTimerFired(Timer<BitmapTexturePool>*);
+
+    Vector<BitmapTexturePoolEntry> m_textures;
+    Timer<BitmapTexturePool> m_releaseUnusedTexturesTimer;
+
+    static const double s_releaseUnusedSecondsTolerance;
+    static const double s_releaseUnusedTexturesTimerInterval;
+};
+
+const double BitmapTexturePool::s_releaseUnusedSecondsTolerance = 3;
+const double BitmapTexturePool::s_releaseUnusedTexturesTimerInterval = 0.5;
+
+BitmapTexturePool::BitmapTexturePool()
+    : m_releaseUnusedTexturesTimer(this, &BitmapTexturePool::releaseUnusedTexturesTimerFired)
+{ }
+
+void BitmapTexturePool::scheduleReleaseUnusedTextures()
+{
+    if (m_releaseUnusedTexturesTimer.isActive())
+        m_releaseUnusedTexturesTimer.stop();
+
+    m_releaseUnusedTexturesTimer.startOneShot(s_releaseUnusedTexturesTimerInterval);
+}
+
+void BitmapTexturePool::releaseUnusedTexturesTimerFired(Timer<BitmapTexturePool>*)
 {
-    RefPtr<BitmapTexture> selectedTexture;
+    if (m_textures.isEmpty())
+        return;
+
+    // Delete entries, which have been unused in s_releaseUnusedSecondsTolerance.
+    nonCopyingSort(m_textures.begin(), m_textures.end(), BitmapTexturePoolEntry::compareTimeLastUsed);
+
+    double minUsedTime = monotonicallyIncreasingTime() - s_releaseUnusedSecondsTolerance;
+    for (size_t i = 0; i < m_textures.size(); ++i) {
+        if (m_textures[i].m_timeLastUsed < minUsedTime) {
+            m_textures.remove(i, m_textures.size() - i);
+            break;
+        }
+    }
+}
 
-    for (size_t i = 0; i < m_texturePool.size(); ++i) {
-        RefPtr<BitmapTexture>& texture = m_texturePool[i];
+PassRefPtr<BitmapTexture> BitmapTexturePool::acquireTexture(const IntSize& size, TextureMapper* textureMapper)
+{
+    BitmapTexturePoolEntry* selectedEntry = 0;
+    for (size_t i = 0; i < m_textures.size(); ++i) {
+        BitmapTexturePoolEntry* entry = &m_textures[i];
 
-        // If the surface has only one reference (the one in m_texturePool), we can safely reuse it.
-        if (texture->refCount() > 1)
+        // If the surface has only one reference (the one in m_textures), we can safely reuse it.
+        if (entry->m_texture->refCount() > 1)
             continue;
 
-        if (texture->canReuseWith(size)) {
-            selectedTexture = texture;
+        if (entry->m_texture->canReuseWith(size)) {
+            selectedEntry = entry;
             break;
         }
     }
 
-    if (!selectedTexture) {
-        selectedTexture = createTexture();
-        m_texturePool.append(selectedTexture);
+    if (!selectedEntry) {
+        m_textures.append(BitmapTexturePoolEntry(textureMapper->createTexture()));
+        selectedEntry = &m_textures.last();
     }
 
+    scheduleReleaseUnusedTextures();
+    selectedEntry->markUsed();
+    return selectedEntry->m_texture;
+}
+
+PassRefPtr<BitmapTexture> TextureMapper::acquireTextureFromPool(const IntSize& size)
+{
+    RefPtr<BitmapTexture> selectedTexture = m_texturePool->acquireTexture(size, this);
     selectedTexture->reset(size, BitmapTexture::SupportsAlpha);
     return selectedTexture;
 }
@@ -59,5 +134,15 @@ PassOwnPtr<TextureMapper> TextureMapper::create(AccelerationMode mode)
     return platformCreateAccelerated();
 }
 
+TextureMapper::TextureMapper(AccelerationMode accelerationMode)
+    : m_interpolationQuality(InterpolationDefault)
+    , m_textDrawingMode(TextModeFill)
+    , m_texturePool(adoptPtr(new BitmapTexturePool()))
+    , m_accelerationMode(accelerationMode)
+{ }
+
+TextureMapper::~TextureMapper()
+{ }
+
 }
 #endif
diff --git a/Source/WebCore/platform/graphics/texmap/TextureMapper.h b/Source/WebCore/platform/graphics/texmap/TextureMapper.h
index 282bf2ca4..2693d9ad9 100644
--- a/Source/WebCore/platform/graphics/texmap/TextureMapper.h
+++ b/Source/WebCore/platform/graphics/texmap/TextureMapper.h
@@ -47,6 +47,7 @@
 
 namespace WebCore {
 
+class BitmapTexturePool;
 class TextureMapper;
 
 // A 2D texture that can be the target of software or GL rendering.
@@ -115,7 +116,7 @@ public:
     typedef unsigned PaintFlags;
 
     static PassOwnPtr<TextureMapper> create(AccelerationMode newMode = SoftwareMode);
-    virtual ~TextureMapper() { }
+    virtual ~TextureMapper();
 
     enum ExposedEdges {
         NoEdges = 0,
@@ -150,15 +151,10 @@ public:
 
     virtual IntSize maxTextureSize() const { return IntSize(INT_MAX, INT_MAX); }
 
-    // A surface is released implicitly when dereferenced.
     virtual PassRefPtr<BitmapTexture> acquireTextureFromPool(const IntSize&);
 
 protected:
-    TextureMapper(AccelerationMode accelerationMode)
-        : m_interpolationQuality(InterpolationDefault)
-        , m_textDrawingMode(TextModeFill)
-        , m_accelerationMode(accelerationMode)
-    {}
+    TextureMapper(AccelerationMode);
 
 private:
 #if USE(TEXTURE_MAPPER_GL)
@@ -171,7 +167,7 @@ private:
 #endif
     InterpolationQuality m_interpolationQuality;
     TextDrawingModeFlags m_textDrawingMode;
-    Vector<RefPtr<BitmapTexture> > m_texturePool;
+    OwnPtr<BitmapTexturePool> m_texturePool;
     GraphicsContext* m_context;
     AccelerationMode m_accelerationMode;
 };
diff --git a/Source/WebCore/platform/graphics/texmap/TextureMapperGL.cpp b/Source/WebCore/platform/graphics/texmap/TextureMapperGL.cpp
index d4015a7c7..acfafb99b 100644
--- a/Source/WebCore/platform/graphics/texmap/TextureMapperGL.cpp
+++ b/Source/WebCore/platform/graphics/texmap/TextureMapperGL.cpp
@@ -33,10 +33,6 @@
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefCounted.h>
 
-#if USE(GRAPHICS_SURFACE)
-#include "GraphicsSurface.h"
-#endif
-
 #if PLATFORM(QT)
 #include "NativeImageQt.h"
 #endif
@@ -381,7 +377,7 @@ void TextureMapperGL::drawTextureRectangleARB(uint32_t texture, Flags flags, con
     m_context3D->uniform1i(program->samplerLocation(), 0);
 
     m_context3D->uniform1f(program->flipLocation(), !!(flags & ShouldFlipTexture));
-    m_context3D->uniform2f(program->textureSizeLocation(), textureSize.width(), textureSize.height());
+    m_context3D->uniform2f(program->samplerSizeLocation(), textureSize.width(), textureSize.height());
     m_context3D->uniform1f(program->opacityLocation(), opacity);
 
     if (maskTexture && maskTexture->isValid()) {
@@ -644,6 +640,7 @@ void BitmapTextureGL::updateContents(const void* srcData, const IntRect& targetR
     const unsigned bytesPerPixel = 4;
     char* data = reinterpret_cast<char*>(const_cast<void*>(srcData));
     Vector<char> temporaryData;
+    IntPoint adjustedSourceOffset = sourceOffset;
 
     // prepare temporaryData if necessary
     if ((!driverSupportsBGRASwizzling() && updateContentsFlag == UpdateCannotModifyOriginalImageData)
@@ -659,14 +656,17 @@ void BitmapTextureGL::updateContents(const void* srcData, const IntRect& targetR
             src += bytesPerLine;
             dst += targetBytesPerLine;
         }
+
+        bytesPerLine = targetBytesPerLine;
+        adjustedSourceOffset = IntPoint(0, 0);
     }
 
     if (driverSupportsBGRASwizzling())
         glFormat = GraphicsContext3D::BGRA;
     else
-        swizzleBGRAToRGBA(reinterpret_cast<uint32_t*>(data), IntRect(sourceOffset, targetRect.size()), bytesPerLine / bytesPerPixel);
+        swizzleBGRAToRGBA(reinterpret_cast<uint32_t*>(data), IntRect(adjustedSourceOffset, targetRect.size()), bytesPerLine / bytesPerPixel);
 
-    if (bytesPerLine == targetRect.width() * bytesPerPixel && sourceOffset == IntPoint::zero()) {
+    if (bytesPerLine == static_cast<int>(targetRect.width() * bytesPerPixel) && adjustedSourceOffset == IntPoint::zero()) {
         m_context3D->texSubImage2D(GraphicsContext3D::TEXTURE_2D, 0, targetRect.x(), targetRect.y(), targetRect.width(), targetRect.height(), glFormat, DEFAULT_TEXTURE_PIXEL_TRANSFER_TYPE, data);
         return;
     }
@@ -680,8 +680,8 @@ void BitmapTextureGL::updateContents(const void* srcData, const IntRect& targetR
 #if !defined(TEXMAP_OPENGL_ES_2)
     // Use the OpenGL sub-image extension, now that we know it's available.
     m_context3D->pixelStorei(GL_UNPACK_ROW_LENGTH, bytesPerLine / bytesPerPixel);
-    m_context3D->pixelStorei(GL_UNPACK_SKIP_ROWS, sourceOffset.y());
-    m_context3D->pixelStorei(GL_UNPACK_SKIP_PIXELS, sourceOffset.x());
+    m_context3D->pixelStorei(GL_UNPACK_SKIP_ROWS, adjustedSourceOffset.y());
+    m_context3D->pixelStorei(GL_UNPACK_SKIP_PIXELS, adjustedSourceOffset.x());
     m_context3D->texSubImage2D(GraphicsContext3D::TEXTURE_2D, 0, targetRect.x(), targetRect.y(), targetRect.width(), targetRect.height(), glFormat, DEFAULT_TEXTURE_PIXEL_TRANSFER_TYPE, data);
     m_context3D->pixelStorei(GL_UNPACK_ROW_LENGTH, 0);
     m_context3D->pixelStorei(GL_UNPACK_SKIP_ROWS, 0);
diff --git a/Source/WebCore/platform/graphics/texmap/TextureMapperLayer.cpp b/Source/WebCore/platform/graphics/texmap/TextureMapperLayer.cpp
index 21bd7b235..401af8c3e 100644
--- a/Source/WebCore/platform/graphics/texmap/TextureMapperLayer.cpp
+++ b/Source/WebCore/platform/graphics/texmap/TextureMapperLayer.cpp
@@ -129,7 +129,7 @@ void TextureMapperLayer::updateBackingStore(TextureMapper* textureMapper, Graphi
     context->translate(-dirtyRect.x(), -dirtyRect.y());
     layer->paintGraphicsLayerContents(*context, dirtyRect);
 
-    if (layer->showRepaintCounter()) {
+    if (layer->isShowingRepaintCounter()) {
         layer->incrementRepaintCount();
         drawRepaintCounter(context, layer);
     }
@@ -138,7 +138,7 @@ void TextureMapperLayer::updateBackingStore(TextureMapper* textureMapper, Graphi
     TextureMapperTiledBackingStore* backingStore = static_cast<TextureMapperTiledBackingStore*>(m_backingStore.get());
     backingStore->updateContents(textureMapper, image.get(), m_size, dirtyRect, BitmapTexture::UpdateCanModifyOriginalImageData);
 
-    backingStore->setShowDebugBorders(layer->showDebugBorders());
+    backingStore->setShowDebugBorders(layer->isShowingDebugBorder());
     backingStore->setDebugBorder(m_debugBorderColor, m_debugBorderWidth);
 
     m_state.needsDisplay = false;
@@ -223,12 +223,12 @@ IntRect TextureMapperLayer::intermediateSurfaceRect(const TransformationMatrix&
     }
 
 #if ENABLE(CSS_FILTERS)
-    if (m_state.filters.hasOutsets()) {
+    if (m_filters.hasOutsets()) {
         int leftOutset;
         int topOutset;
         int bottomOutset;
         int rightOutset;
-        m_state.filters.getOutsets(topOutset, rightOutset, bottomOutset, leftOutset);
+        m_filters.getOutsets(topOutset, rightOutset, bottomOutset, leftOutset);
         IntRect unfilteredTargetRect(rect);
         rect.move(std::max(0, -leftOutset), std::max(0, -topOutset));
         rect.expand(leftOutset + rightOutset, topOutset + bottomOutset);
@@ -262,7 +262,7 @@ TextureMapperLayer::ContentsLayerCount TextureMapperLayer::countPotentialLayersW
 bool TextureMapperLayer::shouldPaintToIntermediateSurface() const
 {
 #if ENABLE(CSS_FILTERS)
-    if (m_state.filters.size())
+    if (m_filters.size())
         return true;
 #endif
     bool hasOpacity = m_opacity < 0.99;
@@ -381,7 +381,7 @@ void TextureMapperLayer::paintRecursive(const TextureMapperPaintOptions& options
         maskTexture = 0;
 
 #if ENABLE(CSS_FILTERS)
-    surface = applyFilters(m_state.filters, options.textureMapper, surface.get(), surfaceRect);
+    surface = applyFilters(m_filters, options.textureMapper, surface.get(), surfaceRect);
 #endif
 
     options.textureMapper->bindSurface(options.surface.get());
@@ -510,6 +510,13 @@ bool TextureMapperLayer::descendantsOrSelfHaveRunningAnimations() const
     return false;
 }
 
+void TextureMapperLayer::applyAnimationsRecursively()
+{
+    syncAnimations();
+    for (size_t i = 0; i < m_children.size(); ++i)
+        m_children[i]->applyAnimationsRecursively();
+}
+
 void TextureMapperLayer::syncAnimations()
 {
     m_animations.apply(this);
@@ -517,6 +524,10 @@ void TextureMapperLayer::syncAnimations()
         setTransform(m_state.transform);
     if (!m_animations.hasActiveAnimationsOfType(AnimatedPropertyOpacity))
         setOpacity(m_state.opacity);
+#if ENABLE(CSS_FILTERS)
+    if (!m_animations.hasActiveAnimationsOfType(AnimatedPropertyWebkitFilter))
+        setFilters(m_state.filters);
+#endif
 }
 
 void TextureMapperLayer::flushCompositingState(GraphicsLayerTextureMapper* graphicsLayer, TextureMapper* textureMapper, int options)
@@ -606,7 +617,7 @@ void TextureMapperLayer::drawRepaintCounter(GraphicsContext* context, GraphicsLa
     cairo_text_extents(cr, repaintCount.data(), &repaintTextExtents);
 
     static const int repaintCountBorderWidth = 10;
-    setSourceRGBAFromColor(cr, layer->showDebugBorders() ? m_debugBorderColor : Color(0, 255, 0, 127));
+    setSourceRGBAFromColor(cr, layer->isShowingDebugBorder() ? m_debugBorderColor : Color(0, 255, 0, 127));
     cairo_rectangle(cr, 0, 0,
                     repaintTextExtents.width + (repaintCountBorderWidth * 2),
                     repaintTextExtents.height + (repaintCountBorderWidth * 2));
diff --git a/Source/WebCore/platform/graphics/texmap/TextureMapperLayer.h b/Source/WebCore/platform/graphics/texmap/TextureMapperLayer.h
index 5740acf52..5cd959d61 100644
--- a/Source/WebCore/platform/graphics/texmap/TextureMapperLayer.h
+++ b/Source/WebCore/platform/graphics/texmap/TextureMapperLayer.h
@@ -119,6 +119,9 @@ public:
     IntSize size() const { return IntSize(m_size.width(), m_size.height()); }
     void setTransform(const TransformationMatrix&);
     void setOpacity(float value) { m_opacity = value; }
+#if ENABLE(CSS_FILTERS)
+    void setFilters(const FilterOperations& filters) { m_filters = filters; }
+#endif
     void setTextureMapper(TextureMapper* texmap) { m_textureMapper = texmap; }
     bool descendantsOrSelfHaveRunningAnimations() const;
 
@@ -132,6 +135,7 @@ public:
     void setScrollPositionDeltaIfNeeded(const FloatSize&);
 
     void setDebugBorder(const Color&, float width);
+    void applyAnimationsRecursively();
 
 private:
     TextureMapperLayer* rootLayer();
@@ -164,6 +168,9 @@ private:
     // GraphicsLayerAnimation::Client
     void setAnimatedTransform(const TransformationMatrix& matrix) { setTransform(matrix); }
     void setAnimatedOpacity(float opacity) { setOpacity(opacity); }
+#if ENABLE(CSS_FILTERS)
+    virtual void setAnimatedFilters(const FilterOperations& filters) { setFilters(filters); }
+#endif
 
     void syncAnimations();
     bool isVisible() const;
@@ -190,6 +197,9 @@ private:
     TextureMapperPlatformLayer* m_contentsLayer;
     FloatSize m_size;
     float m_opacity;
+#if ENABLE(CSS_FILTERS)
+    FilterOperations m_filters;
+#endif
     float m_centerZ;
     String m_name;
     bool m_shouldUpdateBackingStoreFromLayer;
diff --git a/Source/WebCore/platform/graphics/texmap/TextureMapperShaderManager.cpp b/Source/WebCore/platform/graphics/texmap/TextureMapperShaderManager.cpp
index 27e786713..c8e1ae461 100644
--- a/Source/WebCore/platform/graphics/texmap/TextureMapperShaderManager.cpp
+++ b/Source/WebCore/platform/graphics/texmap/TextureMapperShaderManager.cpp
@@ -224,12 +224,12 @@ static void getShaderSpec(TextureMapperShaderManager::ShaderKey key, String& ver
         STRINGIFY(
             precision mediump float;
             uniform sampler2DRect s_sampler;
-            uniform lowp vec2 s_samplerSize;
+            uniform lowp vec2 u_samplerSize;
             uniform lowp float u_opacity;
             varying highp vec2 v_sourceTexCoord;
             void main(void)
             {
-                lowp vec4 color = texture2DRect(s_sampler, s_samplerSize * v_sourceTexCoord);
+                lowp vec4 color = texture2DRect(s_sampler, u_samplerSize * v_sourceTexCoord);
                 gl_FragColor = vec4(color.rgb * u_opacity, color.a * u_opacity);
             }
         );
diff --git a/Source/WebCore/platform/graphics/texmap/TextureMapperShaderManager.h b/Source/WebCore/platform/graphics/texmap/TextureMapperShaderManager.h
index b1f8d6107..380142945 100644
--- a/Source/WebCore/platform/graphics/texmap/TextureMapperShaderManager.h
+++ b/Source/WebCore/platform/graphics/texmap/TextureMapperShaderManager.h
@@ -51,7 +51,7 @@ public:
 
     TEXMAP_DECLARE_UNIFORM(matrix)
     TEXMAP_DECLARE_UNIFORM(flip)
-    TEXMAP_DECLARE_UNIFORM(textureSize)
+    TEXMAP_DECLARE_UNIFORM(samplerSize)
     TEXMAP_DECLARE_UNIFORM(opacity)
     TEXMAP_DECLARE_UNIFORM(color)
     TEXMAP_DECLARE_UNIFORM(expandedQuadEdgesInScreenSpace)
diff --git a/Source/WebCore/platform/graphics/transforms/TransformState.cpp b/Source/WebCore/platform/graphics/transforms/TransformState.cpp
index a8fb8f32d..e0a9cec82 100644
--- a/Source/WebCore/platform/graphics/transforms/TransformState.cpp
+++ b/Source/WebCore/platform/graphics/transforms/TransformState.cpp
@@ -76,13 +76,16 @@ void TransformState::move(LayoutUnit x, LayoutUnit y, TransformAccumulation accu
 }
 
 // FIXME: We transform AffineTransform to TransformationMatrix. This is rather inefficient.
-void TransformState::applyTransform(const AffineTransform& transformFromContainer, TransformAccumulation accumulate)
+void TransformState::applyTransform(const AffineTransform& transformFromContainer, TransformAccumulation accumulate, bool* wasClamped)
 {
-    applyTransform(transformFromContainer.toTransformationMatrix(), accumulate);
+    applyTransform(transformFromContainer.toTransformationMatrix(), accumulate, wasClamped);
 }
 
-void TransformState::applyTransform(const TransformationMatrix& transformFromContainer, TransformAccumulation accumulate)
+void TransformState::applyTransform(const TransformationMatrix& transformFromContainer, TransformAccumulation accumulate, bool* wasClamped)
 {
+    if (wasClamped)
+        *wasClamped = false;
+
     // If we have an accumulated transform from last time, multiply in this transform
     if (m_accumulatedTransform) {
         if (m_direction == ApplyTransformDirection)
@@ -96,44 +99,53 @@ void TransformState::applyTransform(const TransformationMatrix& transformFromCon
     
     if (accumulate == FlattenTransform) {
         const TransformationMatrix* finalTransform = m_accumulatedTransform ? m_accumulatedTransform.get() : &transformFromContainer;
-        flattenWithTransform(*finalTransform);
+        flattenWithTransform(*finalTransform, wasClamped);
     }
     m_accumulatingTransform = accumulate == AccumulateTransform;
 }
 
-void TransformState::flatten()
+void TransformState::flatten(bool* wasClamped)
 {
+    if (wasClamped)
+        *wasClamped = false;
+
     if (!m_accumulatedTransform) {
         m_accumulatingTransform = false;
         return;
     }
     
-    flattenWithTransform(*m_accumulatedTransform);
+    flattenWithTransform(*m_accumulatedTransform, wasClamped);
 }
 
-FloatPoint TransformState::mappedPoint() const
+FloatPoint TransformState::mappedPoint(bool* wasClamped) const
 {
+    if (wasClamped)
+        *wasClamped = false;
+
     if (!m_accumulatedTransform)
         return m_lastPlanarPoint;
 
     if (m_direction == ApplyTransformDirection)
         return m_accumulatedTransform->mapPoint(m_lastPlanarPoint);
 
-    return m_accumulatedTransform->inverse().projectPoint(m_lastPlanarPoint);
+    return m_accumulatedTransform->inverse().projectPoint(m_lastPlanarPoint, wasClamped);
 }
 
-FloatQuad TransformState::mappedQuad() const
+FloatQuad TransformState::mappedQuad(bool* wasClamped) const
 {
+    if (wasClamped)
+        *wasClamped = false;
+
     if (!m_accumulatedTransform)
         return m_lastPlanarQuad;
 
     if (m_direction == ApplyTransformDirection)
         return m_accumulatedTransform->mapQuad(m_lastPlanarQuad);
 
-    return m_accumulatedTransform->inverse().projectQuad(m_lastPlanarQuad);
+    return m_accumulatedTransform->inverse().projectQuad(m_lastPlanarQuad, wasClamped);
 }
 
-void TransformState::flattenWithTransform(const TransformationMatrix& t)
+void TransformState::flattenWithTransform(const TransformationMatrix& t, bool* wasClamped)
 {
     if (m_direction == ApplyTransformDirection) {
         if (m_mapPoint)
@@ -145,7 +157,7 @@ void TransformState::flattenWithTransform(const TransformationMatrix& t)
         if (m_mapPoint)
             m_lastPlanarPoint = inverseTransform.projectPoint(m_lastPlanarPoint);
         if (m_mapQuad)
-            m_lastPlanarQuad = inverseTransform.projectQuad(m_lastPlanarQuad);
+            m_lastPlanarQuad = inverseTransform.projectQuad(m_lastPlanarQuad, wasClamped);
     }
 
     // We could throw away m_accumulatedTransform if we wanted to here, but that
diff --git a/Source/WebCore/platform/graphics/transforms/TransformState.h b/Source/WebCore/platform/graphics/transforms/TransformState.h
index 33eb7e0db..f34295f39 100644
--- a/Source/WebCore/platform/graphics/transforms/TransformState.h
+++ b/Source/WebCore/platform/graphics/transforms/TransformState.h
@@ -81,20 +81,20 @@ public:
     }
     
     void move(LayoutUnit x, LayoutUnit y, TransformAccumulation = FlattenTransform);
-    void applyTransform(const AffineTransform& transformFromContainer, TransformAccumulation = FlattenTransform);
-    void applyTransform(const TransformationMatrix& transformFromContainer, TransformAccumulation = FlattenTransform);
-    void flatten();
+    void applyTransform(const AffineTransform& transformFromContainer, TransformAccumulation = FlattenTransform, bool* wasClamped = 0);
+    void applyTransform(const TransformationMatrix& transformFromContainer, TransformAccumulation = FlattenTransform, bool* wasClamped = 0);
+    void flatten(bool* wasClamped = 0);
 
     // Return the coords of the point or quad in the last flattened layer
     FloatPoint lastPlanarPoint() const { return m_lastPlanarPoint; }
     FloatQuad lastPlanarQuad() const { return m_lastPlanarQuad; }
 
     // Return the point or quad mapped through the current transform
-    FloatPoint mappedPoint() const;
-    FloatQuad mappedQuad() const;
+    FloatPoint mappedPoint(bool* wasClamped = 0) const;
+    FloatQuad mappedQuad(bool* wasClamped = 0) const;
 
 private:
-    void flattenWithTransform(const TransformationMatrix&);
+    void flattenWithTransform(const TransformationMatrix&, bool* wasClamped);
     
     FloatPoint m_lastPlanarPoint;
     FloatQuad m_lastPlanarQuad;
diff --git a/Source/WebCore/platform/graphics/transforms/TransformationMatrix.cpp b/Source/WebCore/platform/graphics/transforms/TransformationMatrix.cpp
index 495b15f8b..a2fb7b687 100644
--- a/Source/WebCore/platform/graphics/transforms/TransformationMatrix.cpp
+++ b/Source/WebCore/platform/graphics/transforms/TransformationMatrix.cpp
@@ -589,7 +589,7 @@ FloatPoint TransformationMatrix::projectPoint(const FloatPoint& p, bool* clamped
     return FloatPoint(static_cast<float>(outX), static_cast<float>(outY));
 }
 
-FloatQuad TransformationMatrix::projectQuad(const FloatQuad& q) const
+FloatQuad TransformationMatrix::projectQuad(const FloatQuad& q, bool* clamped) const
 {
     FloatQuad projectedQuad;
 
@@ -603,6 +603,9 @@ FloatQuad TransformationMatrix::projectQuad(const FloatQuad& q) const
     projectedQuad.setP3(projectPoint(q.p3(), &clamped3));
     projectedQuad.setP4(projectPoint(q.p4(), &clamped4));
 
+    if (clamped)
+        *clamped = clamped1 || clamped2 || clamped3 || clamped4;
+        
     // If all points on the quad had w < 0, then the entire quad would not be visible to the projected surface.
     bool everythingWasClipped = clamped1 && clamped2 && clamped3 && clamped4;
     if (everythingWasClipped)
@@ -727,24 +730,22 @@ TransformationMatrix& TransformationMatrix::scale3d(double sx, double sy, double
 
 TransformationMatrix& TransformationMatrix::rotate3d(double x, double y, double z, double angle)
 {
-    // Angles are in degrees. Switch to radians.
-    angle = deg2rad(angle);
-
-    double sinTheta = sin(angle);
-    double cosTheta = cos(angle);
-    
     // Normalize the axis of rotation
     double length = sqrt(x * x + y * y + z * z);
     if (length == 0) {
-        // bad vector, just use something reasonable
-        x = 0;
-        y = 0;
-        z = 1;
+        // A direction vector that cannot be normalized, such as [0, 0, 0], will cause the rotation to not be applied. 
+        return *this;
     } else if (length != 1) {
         x /= length;
         y /= length;
         z /= length;
     }
+
+    // Angles are in degrees. Switch to radians.
+    angle = deg2rad(angle);
+
+    double sinTheta = sin(angle);
+    double cosTheta = cos(angle);
     
     TransformationMatrix mat;
 
@@ -970,6 +971,149 @@ TransformationMatrix TransformationMatrix::rectToRect(const FloatRect& from, con
 //
 TransformationMatrix& TransformationMatrix::multiply(const TransformationMatrix& mat)
 {
+#if CPU(APPLE_ARMV7S)
+    double* leftMatrix = &(m_matrix[0][0]);
+    const double* rightMatrix = &(mat.m_matrix[0][0]);
+    asm volatile (// First row of leftMatrix.
+        "mov        r3, %[leftMatrix]\n\t"
+        "vld1.64    { d16-d19 }, [%[leftMatrix], :128]!\n\t"
+        "vld1.64    { d0-d3}, [%[rightMatrix], :128]!\n\t"
+        "vmul.f64   d4, d0, d16\n\t"
+        "vld1.64    { d20-d23 }, [%[leftMatrix], :128]!\n\t"
+        "vmla.f64   d4, d1, d20\n\t"
+        "vld1.64    { d24-d27 }, [%[leftMatrix], :128]!\n\t"
+        "vmla.f64   d4, d2, d24\n\t"
+        "vld1.64    { d28-d31 }, [%[leftMatrix], :128]!\n\t"
+        "vmla.f64   d4, d3, d28\n\t"
+
+        "vmul.f64   d5, d0, d17\n\t"
+        "vmla.f64   d5, d1, d21\n\t"
+        "vmla.f64   d5, d2, d25\n\t"
+        "vmla.f64   d5, d3, d29\n\t"
+
+        "vmul.f64   d6, d0, d18\n\t"
+        "vmla.f64   d6, d1, d22\n\t"
+        "vmla.f64   d6, d2, d26\n\t"
+        "vmla.f64   d6, d3, d30\n\t"
+
+        "vmul.f64   d7, d0, d19\n\t"
+        "vmla.f64   d7, d1, d23\n\t"
+        "vmla.f64   d7, d2, d27\n\t"
+        "vmla.f64   d7, d3, d31\n\t"
+        "vld1.64    { d0-d3}, [%[rightMatrix], :128]!\n\t"
+        "vst1.64    { d4-d7 }, [r3, :128]!\n\t"
+
+        // Second row of leftMatrix.
+        "vmul.f64   d4, d0, d16\n\t"
+        "vmla.f64   d4, d1, d20\n\t"
+        "vmla.f64   d4, d2, d24\n\t"
+        "vmla.f64   d4, d3, d28\n\t"
+
+        "vmul.f64   d5, d0, d17\n\t"
+        "vmla.f64   d5, d1, d21\n\t"
+        "vmla.f64   d5, d2, d25\n\t"
+        "vmla.f64   d5, d3, d29\n\t"
+
+        "vmul.f64   d6, d0, d18\n\t"
+        "vmla.f64   d6, d1, d22\n\t"
+        "vmla.f64   d6, d2, d26\n\t"
+        "vmla.f64   d6, d3, d30\n\t"
+
+        "vmul.f64   d7, d0, d19\n\t"
+        "vmla.f64   d7, d1, d23\n\t"
+        "vmla.f64   d7, d2, d27\n\t"
+        "vmla.f64   d7, d3, d31\n\t"
+        "vld1.64    { d0-d3}, [%[rightMatrix], :128]!\n\t"
+        "vst1.64    { d4-d7 }, [r3, :128]!\n\t"
+
+        // Third row of leftMatrix.
+        "vmul.f64   d4, d0, d16\n\t"
+        "vmla.f64   d4, d1, d20\n\t"
+        "vmla.f64   d4, d2, d24\n\t"
+        "vmla.f64   d4, d3, d28\n\t"
+
+        "vmul.f64   d5, d0, d17\n\t"
+        "vmla.f64   d5, d1, d21\n\t"
+        "vmla.f64   d5, d2, d25\n\t"
+        "vmla.f64   d5, d3, d29\n\t"
+
+        "vmul.f64   d6, d0, d18\n\t"
+        "vmla.f64   d6, d1, d22\n\t"
+        "vmla.f64   d6, d2, d26\n\t"
+        "vmla.f64   d6, d3, d30\n\t"
+
+        "vmul.f64   d7, d0, d19\n\t"
+        "vmla.f64   d7, d1, d23\n\t"
+        "vmla.f64   d7, d2, d27\n\t"
+        "vmla.f64   d7, d3, d31\n\t"
+        "vld1.64    { d0-d3}, [%[rightMatrix], :128]\n\t"
+        "vst1.64    { d4-d7 }, [r3, :128]!\n\t"
+
+        // Fourth and last row of leftMatrix.
+        "vmul.f64   d4, d0, d16\n\t"
+        "vmla.f64   d4, d1, d20\n\t"
+        "vmla.f64   d4, d2, d24\n\t"
+        "vmla.f64   d4, d3, d28\n\t"
+
+        "vmul.f64   d5, d0, d17\n\t"
+        "vmla.f64   d5, d1, d21\n\t"
+        "vmla.f64   d5, d2, d25\n\t"
+        "vmla.f64   d5, d3, d29\n\t"
+
+        "vmul.f64   d6, d0, d18\n\t"
+        "vmla.f64   d6, d1, d22\n\t"
+        "vmla.f64   d6, d2, d26\n\t"
+        "vmla.f64   d6, d3, d30\n\t"
+
+        "vmul.f64   d7, d0, d19\n\t"
+        "vmla.f64   d7, d1, d23\n\t"
+        "vmla.f64   d7, d2, d27\n\t"
+        "vmla.f64   d7, d3, d31\n\t"
+        "vst1.64    { d4-d7 }, [r3, :128]\n\t"
+        : [leftMatrix]"+r"(leftMatrix), [rightMatrix]"+r"(rightMatrix)
+        :
+        : "memory", "r3", "d0", "d1", "d2", "d3", "d4", "d5", "d6", "d7", "d16", "d17", "d18", "d19", "d20", "d21", "d22", "d23", "d24", "d25", "d26", "d27", "d28", "d29", "d30", "d31");
+#elif CPU(ARM_VFP) && PLATFORM(IOS)
+
+#define MATRIX_MULTIPLY_ONE_LINE \
+    "vldmia.64  %[rightMatrix]!, { d0-d3}\n\t" \
+    "vmul.f64   d4, d0, d16\n\t" \
+    "vmla.f64   d4, d1, d20\n\t" \
+    "vmla.f64   d4, d2, d24\n\t" \
+    "vmla.f64   d4, d3, d28\n\t" \
+    \
+    "vmul.f64   d5, d0, d17\n\t" \
+    "vmla.f64   d5, d1, d21\n\t" \
+    "vmla.f64   d5, d2, d25\n\t" \
+    "vmla.f64   d5, d3, d29\n\t" \
+    \
+    "vmul.f64   d6, d0, d18\n\t" \
+    "vmla.f64   d6, d1, d22\n\t" \
+    "vmla.f64   d6, d2, d26\n\t" \
+    "vmla.f64   d6, d3, d30\n\t" \
+    \
+    "vmul.f64   d7, d0, d19\n\t" \
+    "vmla.f64   d7, d1, d23\n\t" \
+    "vmla.f64   d7, d2, d27\n\t" \
+    "vmla.f64   d7, d3, d31\n\t" \
+    "vstmia.64  %[leftMatrix]!, { d4-d7 }\n\t"
+
+    double* leftMatrix = &(m_matrix[0][0]);
+    const double* rightMatrix = &(mat.m_matrix[0][0]);
+    // We load the full m_matrix at once in d16-d31.
+    asm volatile("vldmia.64  %[leftMatrix], { d16-d31 }\n\t"
+                 :
+                 : [leftMatrix]"r"(leftMatrix)
+                 : "d16", "d17", "d18", "d19", "d20", "d21", "d22", "d23", "d24", "d25", "d26", "d27", "d28", "d29", "d30", "d31");
+    for (unsigned i = 0; i < 4; ++i) {
+        asm volatile(MATRIX_MULTIPLY_ONE_LINE
+                     : [leftMatrix]"+r"(leftMatrix), [rightMatrix]"+r"(rightMatrix)
+                     :
+                     : "memory", "d0", "d1", "d2", "d3", "d4", "d5", "d6", "d7");
+    }
+#undef MATRIX_MULTIPLY_ONE_LINE
+
+#else
     Matrix4 tmp;
     
     tmp[0][0] = (mat.m_matrix[0][0] * m_matrix[0][0] + mat.m_matrix[0][1] * m_matrix[1][0]
@@ -1009,6 +1153,7 @@ TransformationMatrix& TransformationMatrix::multiply(const TransformationMatrix&
                + mat.m_matrix[3][2] * m_matrix[2][3] + mat.m_matrix[3][3] * m_matrix[3][3]);
     
     setMatrix(tmp);
+#endif
     return *this;
 }
 
diff --git a/Source/WebCore/platform/graphics/transforms/TransformationMatrix.h b/Source/WebCore/platform/graphics/transforms/TransformationMatrix.h
index 9eda74608..49e4b0796 100644
--- a/Source/WebCore/platform/graphics/transforms/TransformationMatrix.h
+++ b/Source/WebCore/platform/graphics/transforms/TransformationMatrix.h
@@ -72,7 +72,11 @@ class FloatQuad;
 class TransformationMatrix {
     WTF_MAKE_FAST_ALLOCATED;
 public:
+#if CPU(APPLE_ARMV7S)
+    typedef double Matrix4[4][4] __attribute__((aligned (16)));
+#else
     typedef double Matrix4[4][4];
+#endif
 
     TransformationMatrix() { makeIdentity(); }
     TransformationMatrix(const AffineTransform& t);
@@ -166,7 +170,7 @@ public:
     // with the destination plane.
     FloatPoint projectPoint(const FloatPoint&, bool* clamped = 0) const;
     // Projects the four corners of the quad
-    FloatQuad projectQuad(const FloatQuad&) const;
+    FloatQuad projectQuad(const FloatQuad&,  bool* clamped = 0) const;
     // Projects the four corners of the quad and takes a bounding box,
     // while sanitizing values created when the w component is negative.
     FractionalLayoutRect clampedBoundsOfProjectedQuad(const FloatQuad&) const;
diff --git a/Source/WebCore/platform/graphics/win/SimpleFontDataWin.cpp b/Source/WebCore/platform/graphics/win/SimpleFontDataWin.cpp
index 72323518f..f2125c78f 100644
--- a/Source/WebCore/platform/graphics/win/SimpleFontDataWin.cpp
+++ b/Source/WebCore/platform/graphics/win/SimpleFontDataWin.cpp
@@ -148,26 +148,6 @@ PassRefPtr<SimpleFontData> SimpleFontData::createScaledFontData(const FontDescri
     return SimpleFontData::create(FontPlatformData(hfont, scaledSize, m_platformData.syntheticBold(), m_platformData.syntheticOblique(), m_platformData.useGDI()), isCustomFont(), false);
 }
 
-PassRefPtr<SimpleFontData> SimpleFontData::smallCapsFontData(const FontDescription& fontDescription) const
-{
-    if (!m_derivedFontData)
-        m_derivedFontData = DerivedFontData::create(isCustomFont());
-    if (!m_derivedFontData->smallCaps)
-        m_derivedFontData->smallCaps = createScaledFontData(fontDescription, cSmallCapsFontSizeMultiplier);
-
-    return m_derivedFontData->smallCaps;
-}
-
-PassRefPtr<SimpleFontData> SimpleFontData::emphasisMarkFontData(const FontDescription& fontDescription) const
-{
-    if (!m_derivedFontData)
-        m_derivedFontData = DerivedFontData::create(isCustomFont());
-    if (!m_derivedFontData->emphasisMark)
-        m_derivedFontData->emphasisMark = createScaledFontData(fontDescription, .5);
-
-    return m_derivedFontData->emphasisMark;
-}
-
 bool SimpleFontData::containsCharacters(const UChar* characters, int length) const
 {
     // FIXME: Support custom fonts.
diff --git a/Source/WebCore/platform/graphics/wince/SimpleFontDataWinCE.cpp b/Source/WebCore/platform/graphics/wince/SimpleFontDataWinCE.cpp
index 5925c7aa9..842fad5f3 100644
--- a/Source/WebCore/platform/graphics/wince/SimpleFontDataWinCE.cpp
+++ b/Source/WebCore/platform/graphics/wince/SimpleFontDataWinCE.cpp
@@ -75,26 +75,6 @@ PassRefPtr<SimpleFontData> SimpleFontData::createScaledFontData(const FontDescri
     return SimpleFontData::create(*result);
 }
 
-PassRefPtr<SimpleFontData> SimpleFontData::smallCapsFontData(const FontDescription& fontDescription) const
-{
-    if (!m_derivedFontData)
-        m_derivedFontData = DerivedFontData::create(isCustomFont());
-    if (!m_derivedFontData->smallCaps)
-        m_derivedFontData->smallCaps = createScaledFontData(fontDescription, .7);
-
-    return m_derivedFontData->smallCaps;
-}
-
-PassRefPtr<SimpleFontData> SimpleFontData::emphasisMarkFontData(const FontDescription& fontDescription) const
-{
-    if (!m_derivedFontData)
-        m_derivedFontData = DerivedFontData::create(isCustomFont());
-    if (!m_derivedFontData->emphasisMark)
-        m_derivedFontData->emphasisMark = createScaledFontData(fontDescription, .5);
-
-    return m_derivedFontData->emphasisMark;
-}
-
 DWORD getKnownFontCodePages(const wchar_t* family);
 
 bool SimpleFontData::containsCharacters(const UChar* characters, int length) const
diff --git a/Source/WebCore/platform/graphics/wx/SimpleFontDataWx.cpp b/Source/WebCore/platform/graphics/wx/SimpleFontDataWx.cpp
index e08a1540c..a58d3e512 100644
--- a/Source/WebCore/platform/graphics/wx/SimpleFontDataWx.cpp
+++ b/Source/WebCore/platform/graphics/wx/SimpleFontDataWx.cpp
@@ -98,26 +98,6 @@ PassRefPtr<SimpleFontData> SimpleFontData::createScaledFontData(const FontDescri
     return SimpleFontData::create(platformData, isCustomFont(), false);
 }
 
-PassRefPtr<SimpleFontData> SimpleFontData::smallCapsFontData(const FontDescription& fontDescription) const
-{
-    if (!m_derivedFontData)
-        m_derivedFontData = DerivedFontData::create(isCustomFont());
-    if (!m_derivedFontData->smallCaps)
-        m_derivedFontData->smallCaps = createScaledFontData(fontDescription, .7);
-
-    return m_derivedFontData->smallCaps;
-}
-
-PassRefPtr<SimpleFontData> SimpleFontData::emphasisMarkFontData(const FontDescription& fontDescription) const
-{
-    if (!m_derivedFontData)
-        m_derivedFontData = DerivedFontData::create(isCustomFont());
-    if (!m_derivedFontData->emphasisMark)
-        m_derivedFontData->emphasisMark = createScaledFontData(fontDescription, .5);
-
-    return m_derivedFontData->emphasisMark;
-}
-
 bool SimpleFontData::containsCharacters(const UChar* characters, int length) const
 {
     // FIXME: We will need to implement this to load non-ASCII encoding sites
diff --git a/Source/WebCore/platform/gtk/GRefPtrGtk.cpp b/Source/WebCore/platform/gtk/GRefPtrGtk.cpp
index 9a9d6795f..fa506df90 100644
--- a/Source/WebCore/platform/gtk/GRefPtrGtk.cpp
+++ b/Source/WebCore/platform/gtk/GRefPtrGtk.cpp
@@ -20,8 +20,12 @@
 #include "config.h"
 #include "GRefPtrGtk.h"
 
+#define SECRET_WITH_UNSTABLE 1
+#define SECRET_API_SUBJECT_TO_CHANGE 1
+
 #include <glib.h>
 #include <gtk/gtk.h>
+#include <libsecret/secret.h>
 
 namespace WTF {
 
@@ -38,6 +42,19 @@ template <> void derefGPtr(GtkTargetList* ptr)
         gtk_target_list_unref(ptr);
 }
 
+template <> SecretValue* refGPtr(SecretValue* ptr)
+{
+    if (ptr)
+        secret_value_ref(ptr);
+    return ptr;
+}
+
+template <> void derefGPtr(SecretValue* ptr)
+{
+    if (ptr)
+        secret_value_unref(ptr);
+}
+
 #ifdef GTK_API_VERSION_2
 template <> GdkCursor* refGPtr(GdkCursor* ptr)
 {
diff --git a/Source/WebCore/platform/gtk/GRefPtrGtk.h b/Source/WebCore/platform/gtk/GRefPtrGtk.h
index a9f491f14..9192864a9 100644
--- a/Source/WebCore/platform/gtk/GRefPtrGtk.h
+++ b/Source/WebCore/platform/gtk/GRefPtrGtk.h
@@ -23,11 +23,16 @@
 
 #include <wtf/gobject/GRefPtr.h>
 
+typedef struct _SecretValue SecretValue;
+
 namespace WTF {
 
 template <> GtkTargetList* refGPtr(GtkTargetList* ptr);
 template <> void derefGPtr(GtkTargetList* ptr);
 
+template <> SecretValue* refGPtr(SecretValue* ptr);
+template <> void derefGPtr(SecretValue* ptr);
+
 #ifdef GTK_API_VERSION_2
 template <> GdkCursor* refGPtr(GdkCursor* ptr);
 template <> void derefGPtr(GdkCursor* ptr);
diff --git a/Source/WebCore/platform/gtk/GtkAuthenticationDialog.cpp b/Source/WebCore/platform/gtk/GtkAuthenticationDialog.cpp
index d65f74f91..6535d8498 100644
--- a/Source/WebCore/platform/gtk/GtkAuthenticationDialog.cpp
+++ b/Source/WebCore/platform/gtk/GtkAuthenticationDialog.cpp
@@ -20,10 +20,12 @@
 #include "config.h"
 #include "GtkAuthenticationDialog.h"
 
+#include "CredentialBackingStore.h"
 #include "GtkVersioning.h"
 #include <glib/gi18n-lib.h>
 #include <gtk/gtk.h>
 #include <libsoup/soup.h>
+#include <wtf/gobject/GOwnPtr.h>
 
 namespace WebCore {
 
@@ -54,31 +56,18 @@ static GtkWidget* addEntryToGrid(GtkGrid* grid, int row, const char* labelText)
     return entry;
 }
 
-static bool sessionCanSavePasswords(SoupSession* session)
-{
-#ifdef SOUP_TYPE_PASSWORD_MANAGER
-    return soup_session_get_feature(session, SOUP_TYPE_PASSWORD_MANAGER);
-#else
-    return false;
-#endif
-}
-
 GtkAuthenticationDialog::~GtkAuthenticationDialog()
 {
 }
 
-GtkAuthenticationDialog::GtkAuthenticationDialog(GtkWindow* parentWindow, SoupSession* session, SoupMessage* message, SoupAuth* auth)
-    : m_dialog(gtk_dialog_new())
-    , m_session(session)
-    , m_message(message)
-    , m_auth(auth)
+GtkAuthenticationDialog::GtkAuthenticationDialog(GtkWindow* parentWindow, const AuthenticationChallenge& challenge)
+    : m_challenge(challenge)
+    , m_dialog(gtk_dialog_new())
     , m_loginEntry(0)
     , m_passwordEntry(0)
     , m_rememberCheckButton(0)
-#ifdef SOUP_TYPE_PASSWORD_MANAGER
     , m_isSavingPassword(false)
     , m_savePasswordHandler(0)
-#endif
 {
     GtkDialog* dialog = GTK_DIALOG(m_dialog);
     gtk_dialog_add_buttons(dialog, GTK_STOCK_CANCEL, GTK_RESPONSE_CANCEL, GTK_STOCK_OK, GTK_RESPONSE_OK, NULL);
@@ -119,8 +108,8 @@ GtkAuthenticationDialog::GtkAuthenticationDialog(GtkWindow* parentWindow, SoupSe
 #endif
     gtk_box_pack_start(GTK_BOX(hBox), mainVBox, TRUE, TRUE, 0);
 
-    SoupURI* uri = soup_message_get_uri(m_message.get());
-    GOwnPtr<char>description(g_strdup_printf(_("A username and password are being requested by the site %s"), uri->host));
+    GOwnPtr<char> description(g_strdup_printf(_("A username and password are being requested by the site %s"),
+        m_challenge.protectionSpace().host().utf8().data()));
     GtkWidget* descriptionLabel = gtk_label_new(description.get());
     gtk_misc_set_alignment(GTK_MISC(descriptionLabel), 0.0, 0.5);
     gtk_label_set_line_wrap(GTK_LABEL(descriptionLabel), TRUE);
@@ -138,9 +127,9 @@ GtkAuthenticationDialog::GtkAuthenticationDialog(GtkWindow* parentWindow, SoupSe
     gtk_alignment_set_padding(GTK_ALIGNMENT(entryContainer), 0, 0, 0, 0);
     gtk_box_pack_start(GTK_BOX(vBox), entryContainer, FALSE, FALSE, 0);
 
-    const char* realm = soup_auth_get_realm(m_auth);
     // Checking that realm is not an empty string.
-    bool hasRealm = (realm && realm[0] != '\0');
+    String realm = m_challenge.protectionSpace().realm();
+    bool hasRealm = !realm.isEmpty();
 
 #ifdef GTK_API_VERSION_2
     GtkWidget* table = gtk_table_new(hasRealm ? 3 : 2, 2, FALSE);
@@ -165,7 +154,7 @@ GtkAuthenticationDialog::GtkAuthenticationDialog(GtkWindow* parentWindow, SoupSe
         gtk_widget_set_hexpand(serverMessageDescriptionLabel, TRUE);
         gtk_widget_set_vexpand(serverMessageDescriptionLabel, TRUE);
 #endif
-        GtkWidget* serverMessageLabel = gtk_label_new(realm);
+        GtkWidget* serverMessageLabel = gtk_label_new(realm.utf8().data());
         gtk_misc_set_alignment(GTK_MISC(serverMessageLabel), 0.0, 0.5);
         gtk_label_set_line_wrap(GTK_LABEL(serverMessageLabel), TRUE);
 #ifdef GTK_API_VERSION_2
@@ -187,70 +176,42 @@ GtkAuthenticationDialog::GtkAuthenticationDialog(GtkWindow* parentWindow, SoupSe
 
     gtk_entry_set_visibility(GTK_ENTRY(m_passwordEntry), FALSE);
 
-    if (sessionCanSavePasswords(m_session)) {
 #ifdef GTK_API_VERSION_2
-        GtkWidget* rememberBox = gtk_vbox_new(FALSE, 6);
+    GtkWidget* rememberBox = gtk_vbox_new(FALSE, 6);
 #else
-        GtkWidget* rememberBox = gtk_box_new(GTK_ORIENTATION_VERTICAL, 6);
+    GtkWidget* rememberBox = gtk_box_new(GTK_ORIENTATION_VERTICAL, 6);
 #endif
-        gtk_box_pack_start(GTK_BOX(vBox), rememberBox, FALSE, FALSE, 0);
+    gtk_box_pack_start(GTK_BOX(vBox), rememberBox, FALSE, FALSE, 0);
 
-        m_rememberCheckButton = gtk_check_button_new_with_mnemonic(_("_Remember password"));
-        gtk_label_set_line_wrap(GTK_LABEL(gtk_bin_get_child(GTK_BIN(m_rememberCheckButton))), TRUE);
-        gtk_box_pack_start(GTK_BOX(rememberBox), m_rememberCheckButton, FALSE, FALSE, 0);
-    }
-}
-
-static bool getSavedLogin(SoupAuth* auth, const char** username, const char** password)
-{
-#ifdef SOUP_TYPE_PASSWORD_MANAGER
-    GSList* users = soup_auth_get_saved_users(auth);
-    if (!users)
-        return false;
-
-    *username = static_cast<char*>(users->data);
-    *password = soup_auth_get_saved_password(auth, *username);
-    g_slist_free(users);
-
-    return *username && *password;
-#else
-    return false;
-#endif
+    m_rememberCheckButton = gtk_check_button_new_with_mnemonic(_("_Remember password"));
+    gtk_label_set_line_wrap(GTK_LABEL(gtk_bin_get_child(GTK_BIN(m_rememberCheckButton))), TRUE);
+    gtk_box_pack_start(GTK_BOX(rememberBox), m_rememberCheckButton, FALSE, FALSE, 0);
 }
 
 void GtkAuthenticationDialog::show()
 {
-    const char* username = 0;
-    const char* password = 0;
-    bool haveSavedLogin = getSavedLogin(m_auth, &username, &password);
-    soup_session_pause_message(m_session, m_message.get());
-    gtk_entry_set_text(GTK_ENTRY(m_loginEntry), username ? username : "");
-    gtk_entry_set_text(GTK_ENTRY(m_passwordEntry), password ? password : "");
-    if (m_rememberCheckButton && haveSavedLogin)
+    Credential savedCredential = credentialBackingStore().credentialForChallenge(m_challenge);
+    if (!savedCredential.isEmpty()) {
+        gtk_entry_set_text(GTK_ENTRY(m_loginEntry), savedCredential.user().utf8().data());
+        gtk_entry_set_text(GTK_ENTRY(m_passwordEntry), savedCredential.password().utf8().data());
         gtk_toggle_button_set_active(GTK_TOGGLE_BUTTON(m_rememberCheckButton), TRUE);
+    }
+
     g_signal_connect(m_dialog, "response", G_CALLBACK(authenticationDialogResponseCallback), this);
     gtk_widget_show_all(m_dialog);
 }
 
 void GtkAuthenticationDialog::destroy()
 {
-    bool shouldDelete = true;
-
-    soup_session_unpause_message(m_session, m_message.get());
     gtk_widget_destroy(m_dialog);
 
-#ifdef SOUP_TYPE_PASSWORD_MANAGER
-    shouldDelete = !m_isSavingPassword;
-#endif
-
     // Do not delete the object if it's still saving the password,
     // the save password callback will delete it.
-    if (shouldDelete)
+    if (!m_isSavingPassword)
         delete this;
 }
 
-#ifdef SOUP_TYPE_PASSWORD_MANAGER
-void GtkAuthenticationDialog::savePasswordCallback(SoupMessage* message, GtkAuthenticationDialog* dialog)
+void GtkAuthenticationDialog::savePasswordCallback(SoupMessage*, GtkAuthenticationDialog* dialog)
 {
     dialog->savePassword();
 }
@@ -261,33 +222,40 @@ void GtkAuthenticationDialog::savePassword()
     ASSERT(!m_password.isNull());
 
     // Anything but 401 and 5xx means the password was accepted.
-    if (m_message.get()->status_code != 401 && m_message.get()->status_code < 500)
-        soup_auth_save_password(m_auth, m_username.data(), m_password.data());
+    SoupMessage* message = m_challenge.soupMessage();
+    if (message->status_code != 401 && message->status_code < 500) {
+        Credential credentialToSave = Credential(
+            String::fromUTF8(m_username.data()),
+            String::fromUTF8(m_password.data()),
+            CredentialPersistencePermanent);
+        credentialBackingStore().storeCredentialsForChallenge(m_challenge, credentialToSave);
+    }
 
     // Disconnect the callback. If the authentication succeeded we are done,
     // and if it failed we'll create a new GtkAuthenticationDialog and we'll
     // connect to 'got-headers' again in GtkAuthenticationDialog::authenticate()
-    g_signal_handler_disconnect(m_message.get(), m_savePasswordHandler);
+    g_signal_handler_disconnect(message, m_savePasswordHandler);
 
     // Dialog has been already destroyed, after saving the password it should be deleted.
     delete this;
 }
-#endif
 
 void GtkAuthenticationDialog::authenticate()
 {
     const char *username = gtk_entry_get_text(GTK_ENTRY(m_loginEntry));
     const char *password = gtk_entry_get_text(GTK_ENTRY(m_passwordEntry));
-    soup_auth_authenticate(m_auth, username, password);
 
-#ifdef SOUP_TYPE_PASSWORD_MANAGER
+    bool rememberCredentials = gtk_toggle_button_get_active(GTK_TOGGLE_BUTTON(m_rememberCheckButton));
     if (m_rememberCheckButton && gtk_toggle_button_get_active(GTK_TOGGLE_BUTTON(m_rememberCheckButton))) {
         m_username = username;
         m_password = password;
         m_isSavingPassword = true;
-        m_savePasswordHandler = g_signal_connect(m_message.get(), "got-headers", G_CALLBACK(savePasswordCallback), this);
+        m_savePasswordHandler = g_signal_connect(m_challenge.soupMessage(), "got-headers", G_CALLBACK(savePasswordCallback), this);
     }
-#endif
+
+    CredentialPersistence persistence = rememberCredentials ? CredentialPersistencePermanent : CredentialPersistenceForSession;
+    m_challenge.authenticationClient()->receivedCredential(m_challenge,
+        Credential(String::fromUTF8(username), String::fromUTF8(password), persistence));
 }
 
 void GtkAuthenticationDialog::authenticationDialogResponseCallback(GtkWidget*, gint responseID, GtkAuthenticationDialog* dialog)
@@ -295,6 +263,7 @@ void GtkAuthenticationDialog::authenticationDialogResponseCallback(GtkWidget*, g
     if (responseID == GTK_RESPONSE_OK)
         dialog->authenticate();
 
+    dialog->m_challenge.authenticationClient()->receivedRequestToContinueWithoutCredential(dialog->m_challenge);
     dialog->destroy();
 }
 
diff --git a/Source/WebCore/platform/gtk/GtkAuthenticationDialog.h b/Source/WebCore/platform/gtk/GtkAuthenticationDialog.h
index 23f6f5574..021e0e2c1 100644
--- a/Source/WebCore/platform/gtk/GtkAuthenticationDialog.h
+++ b/Source/WebCore/platform/gtk/GtkAuthenticationDialog.h
@@ -20,9 +20,7 @@
 #ifndef GtkAuthenticationDialog_h
 #define GtkAuthenticationDialog_h
 
-#define LIBSOUP_I_HAVE_READ_BUG_594377_AND_KNOW_SOUP_PASSWORD_MANAGER_MIGHT_GO_AWAY
-
-#include <wtf/gobject/GOwnPtr.h>
+#include "AuthenticationChallenge.h"
 #include "GRefPtrGtk.h"
 #include <libsoup/soup.h>
 #include <wtf/FastAllocBase.h>
@@ -36,7 +34,7 @@ class GtkAuthenticationDialog {
     WTF_MAKE_FAST_ALLOCATED;
 
 public:
-    GtkAuthenticationDialog(GtkWindow*, SoupSession*, SoupMessage*, SoupAuth*);
+    GtkAuthenticationDialog(GtkWindow*, const AuthenticationChallenge&);
     ~GtkAuthenticationDialog();
 
     void show();
@@ -44,29 +42,19 @@ public:
 private:
     void destroy();
     void authenticate();
-
-#ifdef SOUP_TYPE_PASSWORD_MANAGER
     void savePassword();
     static void savePasswordCallback(SoupMessage*, GtkAuthenticationDialog*);
-#endif
-
     static void authenticationDialogResponseCallback(GtkWidget*, gint responseID, GtkAuthenticationDialog*);
 
+    AuthenticationChallenge m_challenge;
     GtkWidget* m_dialog;
-    SoupSession* m_session;
-    GRefPtr<SoupMessage> m_message;
-    SoupAuth* m_auth;
-
     GtkWidget* m_loginEntry;
     GtkWidget* m_passwordEntry;
     GtkWidget* m_rememberCheckButton;
-
-#ifdef SOUP_TYPE_PASSWORD_MANAGER
     bool m_isSavingPassword;
     unsigned long m_savePasswordHandler;
     CString m_username;
     CString m_password;
-#endif
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/platform/gtk/LocalizedStringsGtk.cpp b/Source/WebCore/platform/gtk/LocalizedStringsGtk.cpp
index 91b35d04b..aae044089 100644
--- a/Source/WebCore/platform/gtk/LocalizedStringsGtk.cpp
+++ b/Source/WebCore/platform/gtk/LocalizedStringsGtk.cpp
@@ -485,6 +485,12 @@ String insecurePluginVersionText()
     return String();
 }
 
+String inactivePluginText()
+{
+    notImplemented();
+    return String();
+}
+
 String multipleFileUploadText(unsigned numberOfFiles)
 {
     // FIXME: If this file gets localized, this should really be localized as one string with a wildcard for the number.
diff --git a/Source/WebCore/platform/gtk/RedirectedXCompositeWindow.cpp b/Source/WebCore/platform/gtk/RedirectedXCompositeWindow.cpp
index e9118c77e..911058128 100644
--- a/Source/WebCore/platform/gtk/RedirectedXCompositeWindow.cpp
+++ b/Source/WebCore/platform/gtk/RedirectedXCompositeWindow.cpp
@@ -108,7 +108,7 @@ RedirectedXCompositeWindow::RedirectedXCompositeWindow(const IntSize& size)
     , m_damageNotifyCallback(0)
     , m_damageNotifyData(0)
 {
-    Display* display = GLContext::sharedX11Display();
+    Display* display = GDK_DISPLAY_XDISPLAY(gdk_display_get_default());
     Screen* screen = DefaultScreenOfDisplay(display);
 
     // This is based on code from Chromium: src/content/common/gpu/image_transport_surface_linux.cc
@@ -163,7 +163,7 @@ RedirectedXCompositeWindow::~RedirectedXCompositeWindow()
     if (getWindowHashMap().isEmpty())
         gdk_window_remove_filter(0, reinterpret_cast<GdkFilterFunc>(filterXDamageEvent), 0);
 
-    Display* display = GLContext::sharedX11Display();
+    Display* display = GDK_DISPLAY_XDISPLAY(gdk_display_get_default());
     XDamageDestroy(display, m_damage);
     XDestroyWindow(display, m_window);
     XDestroyWindow(display, m_parentWindow);
@@ -172,7 +172,7 @@ RedirectedXCompositeWindow::~RedirectedXCompositeWindow()
 
 void RedirectedXCompositeWindow::resize(const IntSize& size)
 {
-    Display* display = GLContext::sharedX11Display();
+    Display* display = GDK_DISPLAY_XDISPLAY(gdk_display_get_default());
     XResizeWindow(display, m_window, size.width(), size.height());
 
     XFlush(display);
diff --git a/Source/WebCore/platform/image-decoders/ImageDecoder.h b/Source/WebCore/platform/image-decoders/ImageDecoder.h
index 9f697a84a..8c0db3929 100644
--- a/Source/WebCore/platform/image-decoders/ImageDecoder.h
+++ b/Source/WebCore/platform/image-decoders/ImageDecoder.h
@@ -300,6 +300,8 @@ namespace WebCore {
         void setIgnoreGammaAndColorProfile(bool flag) { m_ignoreGammaAndColorProfile = flag; }
         bool ignoresGammaAndColorProfile() const { return m_ignoreGammaAndColorProfile; }
 
+        ImageOrientation orientation() const { return m_orientation; }
+
         enum { iccColorProfileHeaderLength = 128 };
 
         static bool rgbColorProfile(const char* profileData, unsigned profileLength)
@@ -393,6 +395,7 @@ namespace WebCore {
         Vector<int> m_scaledRows;
         bool m_premultiplyAlpha;
         bool m_ignoreGammaAndColorProfile;
+        ImageOrientation m_orientation;
 
     private:
         // Some code paths compute the size of the image as "width * height * 4"
diff --git a/Source/WebCore/platform/image-decoders/jpeg/JPEGImageDecoder.cpp b/Source/WebCore/platform/image-decoders/jpeg/JPEGImageDecoder.cpp
index 525f3a6f7..e43743f9a 100644
--- a/Source/WebCore/platform/image-decoders/jpeg/JPEGImageDecoder.cpp
+++ b/Source/WebCore/platform/image-decoders/jpeg/JPEGImageDecoder.cpp
@@ -97,6 +97,8 @@ inline bool doFancyUpsampling() { return false; }
 inline bool doFancyUpsampling() { return true; }
 #endif
 
+const int exifMarker = JPEG_APP0 + 1;
+
 namespace WebCore {
 
 struct decoder_error_mgr {
@@ -131,6 +133,93 @@ struct decoder_source_mgr {
     JPEGImageReader* decoder;
 };
 
+static unsigned readUint16(JOCTET* data, bool isBigEndian)
+{
+    if (isBigEndian)
+        return (GETJOCTET(data[0]) << 8) | GETJOCTET(data[1]);
+    return (GETJOCTET(data[1]) << 8) | GETJOCTET(data[0]);
+}
+
+static unsigned readUint32(JOCTET* data, bool isBigEndian)
+{
+    if (isBigEndian)
+        return (GETJOCTET(data[0]) << 24) | (GETJOCTET(data[1]) << 16) | (GETJOCTET(data[2]) << 8) | GETJOCTET(data[3]);
+    return (GETJOCTET(data[3]) << 24) | (GETJOCTET(data[2]) << 16) | (GETJOCTET(data[1]) << 8) | GETJOCTET(data[0]);
+}
+
+static bool checkExifHeader(jpeg_saved_marker_ptr marker, bool& isBigEndian, unsigned& ifdOffset)
+{
+    // For exif data, the APP1 block is followed by 'E', 'x', 'i', 'f', '\0',
+    // then a fill byte, and then a tiff file that contains the metadata.
+    // A tiff file starts with 'I', 'I' (intel / little endian byte order) or
+    // 'M', 'M' (motorola / big endian byte order), followed by (uint16_t)42,
+    // followed by an uint32_t with the offset to the tag block, relative to the
+    // tiff file start.
+    const unsigned exifHeaderSize = 14;
+    if (!(marker->marker == exifMarker
+        && marker->data_length >= exifHeaderSize
+        && marker->data[0] == 'E'
+        && marker->data[1] == 'x'
+        && marker->data[2] == 'i'
+        && marker->data[3] == 'f'
+        && marker->data[4] == '\0'
+        // data[5] is a fill byte
+        && ((marker->data[6] == 'I' && marker->data[7] == 'I')
+            || (marker->data[6] == 'M' && marker->data[7] == 'M'))))
+        return false;
+
+    isBigEndian = marker->data[6] == 'M';
+    if (readUint16(marker->data + 8, isBigEndian) != 42)
+        return false;
+
+    ifdOffset = readUint32(marker->data + 10, isBigEndian);
+    return true;
+}
+
+static ImageOrientation readImageOrientation(jpeg_decompress_struct* info)
+{
+    // The JPEG decoder looks at EXIF metadata.
+    // FIXME: Possibly implement XMP and IPTC support.
+    const unsigned orientationTag = 0x112;
+    const unsigned shortType = 3;
+    for (jpeg_saved_marker_ptr marker = info->marker_list; marker; marker = marker->next) {
+        bool isBigEndian;
+        unsigned ifdOffset;
+        if (!checkExifHeader(marker, isBigEndian, ifdOffset))
+            continue;
+        const unsigned offsetToTiffData = 6; // Account for 'Exif\0<fill byte>' header.
+        if (marker->data_length < offsetToTiffData || ifdOffset >= marker->data_length - offsetToTiffData)
+            continue;
+        ifdOffset += offsetToTiffData;
+
+        // The jpeg exif container format contains a tiff block for metadata.
+        // A tiff image file directory (ifd) consists of a uint16_t describing
+        // the number of ifd entries, followed by that many entries.
+        // When touching this code, it's useful to look at the tiff spec:
+        // http://partners.adobe.com/public/developer/en/tiff/TIFF6.pdf
+        JOCTET* ifd = marker->data + ifdOffset;
+        JOCTET* end = marker->data + marker->data_length;
+        if (end - ifd < 2)
+            continue;
+        unsigned tagCount = readUint16(ifd, isBigEndian);
+        ifd += 2; // Skip over the uint16 that was just read.
+
+        // Every ifd entry is 2 bytes of tag, 2 bytes of contents datatype,
+        // 4 bytes of number-of-elements, and 4 bytes of either offset to the
+        // tag data, or if the data is small enough, the inlined data itself.
+        const int ifdEntrySize = 12;
+        for (unsigned i = 0; i < tagCount && end - ifd >= ifdEntrySize; ++i, ifd += ifdEntrySize) {
+            unsigned tag = readUint16(ifd, isBigEndian);
+            unsigned type = readUint16(ifd + 2, isBigEndian);
+            unsigned count = readUint32(ifd + 4, isBigEndian);
+            if (tag == orientationTag && type == shortType && count == 1)
+                return ImageOrientation::fromEXIFValue(readUint16(ifd + 8, isBigEndian));
+        }
+    }
+
+    return ImageOrientation();
+}
+
 static ColorProfile readColorProfile(jpeg_decompress_struct* info)
 {
 #if USE(ICCJPEG)
@@ -206,6 +295,9 @@ public:
         // Retain ICC color profile markers for color management.
         setup_read_icc_profile(&m_info);
 #endif
+
+        // Keep APP1 blocks, for obtaining exif data.
+        jpeg_save_markers(&m_info, exifMarker, 0xFFFF);
     }
 
     ~JPEGImageReader()
@@ -308,6 +400,8 @@ public:
             if (!m_decoder->setSize(m_info.image_width, m_info.image_height))
                 return false;
 
+            m_decoder->setOrientation(readImageOrientation(info()));
+
             // Allow color management of the decoded RGBA pixels if possible.
             if (!m_decoder->ignoresGammaAndColorProfile()) {
                 ColorProfile rgbInputDeviceColorProfile = readColorProfile(info());
diff --git a/Source/WebCore/platform/image-decoders/jpeg/JPEGImageDecoder.h b/Source/WebCore/platform/image-decoders/jpeg/JPEGImageDecoder.h
index d095cbb16..95fe8a40b 100644
--- a/Source/WebCore/platform/image-decoders/jpeg/JPEGImageDecoder.h
+++ b/Source/WebCore/platform/image-decoders/jpeg/JPEGImageDecoder.h
@@ -54,6 +54,7 @@ namespace WebCore {
         void jpegComplete();
 
         void setColorProfile(const ColorProfile& colorProfile) { m_colorProfile = colorProfile; }
+        void setOrientation(ImageOrientation orientation) { m_orientation = orientation; }
 
     private:
         // Decodes the image.  If |onlySize| is true, stops decoding after
diff --git a/Source/WebCore/platform/mac/ClipboardMac.mm b/Source/WebCore/platform/mac/ClipboardMac.mm
index bd8802044..0107732a9 100644
--- a/Source/WebCore/platform/mac/ClipboardMac.mm
+++ b/Source/WebCore/platform/mac/ClipboardMac.mm
@@ -99,11 +99,10 @@ static String cocoaTypeFromHTMLClipboardType(const String& type)
 
     // Try UTI now
     String mimeType = qType;
-    RetainPtr<CFStringRef> utiType(AdoptCF, UTTypeCreatePreferredIdentifierForTag(kUTTagClassMIMEType, mimeType.createCFString(), NULL));
-    if (utiType) {
-        CFStringRef pbType = UTTypeCopyPreferredTagWithClass(utiType.get(), kUTTagClassNSPboardType);
+    if (RetainPtr<CFStringRef> utiType = adoptCF(UTTypeCreatePreferredIdentifierForTag(kUTTagClassMIMEType, mimeType.createCFString().get(), NULL))) {
+        RetainPtr<CFStringRef> pbType = adoptCF(UTTypeCopyPreferredTagWithClass(utiType.get(), kUTTagClassNSPboardType));
         if (pbType)
-            return pbType;
+            return pbType.get();
     }
 
     // No mapping, just pass the whole string though
@@ -112,11 +111,8 @@ static String cocoaTypeFromHTMLClipboardType(const String& type)
 
 static String utiTypeFromCocoaType(const String& type)
 {
-    RetainPtr<CFStringRef> typeCF = adoptCF(type.createCFString());
-    RetainPtr<CFStringRef> utiType(AdoptCF, UTTypeCreatePreferredIdentifierForTag(kUTTagClassNSPboardType, typeCF.get(), 0));
-    if (utiType) {
-        RetainPtr<CFStringRef> mimeType(AdoptCF, UTTypeCopyPreferredTagWithClass(utiType.get(), kUTTagClassMIMEType));
-        if (mimeType)
+    if (RetainPtr<CFStringRef> utiType = adoptCF(UTTypeCreatePreferredIdentifierForTag(kUTTagClassNSPboardType, type.createCFString().get(), 0))) {
+        if (RetainPtr<CFStringRef> mimeType = adoptCF(UTTypeCopyPreferredTagWithClass(utiType.get(), kUTTagClassMIMEType)))
             return String(mimeType.get());
     }
     return String();
@@ -408,7 +404,7 @@ void ClipboardMac::declareAndWriteDragImage(Element* element, const KURL& url, c
     
 DragImageRef ClipboardMac::createDragImage(IntPoint& loc) const
 {
-    NSPoint nsloc = {loc.x(), loc.y()};
+    NSPoint nsloc = NSMakePoint(loc.x(), loc.y());
     DragImageRef result = dragNSImage(nsloc);
     loc = (IntPoint)nsloc;
     return result;
diff --git a/Source/WebCore/platform/mac/CookieJar.mm b/Source/WebCore/platform/mac/CookieJar.mm
index 421d86d8b..b6d82ae96 100644
--- a/Source/WebCore/platform/mac/CookieJar.mm
+++ b/Source/WebCore/platform/mac/CookieJar.mm
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2003, 2006, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2003, 2006, 2008, 2012 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -33,25 +33,10 @@
 #import "CookieStorage.h"
 #import "CookieStorageCFNet.h"
 #import "Document.h"
-#import "KURL.h"
 #import "WebCoreSystemInterface.h"
-#import <wtf/RetainPtr.h>
-
-
-@interface NSHTTPCookie (WebCoreHTTPOnlyCookies)
-- (BOOL)isHTTPOnly;
-@end
 
 namespace WebCore {
 
-static bool isHTTPOnly(NSHTTPCookie *cookie)
-{
-    // Once we require a newer version of Foundation with the isHTTPOnly method,
-    // we can eliminate the instancesRespondToSelector: check.
-    static bool supportsHTTPOnlyCookies = [NSHTTPCookie instancesRespondToSelector:@selector(isHTTPOnly)];
-    return supportsHTTPOnlyCookies && [cookie isHTTPOnly];
-}
-
 static RetainPtr<NSArray> filterCookies(NSArray *unfilteredCookies)
 {
     NSUInteger count = [unfilteredCookies count];
@@ -67,7 +52,7 @@ static RetainPtr<NSArray> filterCookies(NSArray *unfilteredCookies)
         if (![[cookie name] length])
             continue;
 
-        if (isHTTPOnly(cookie))
+        if ([cookie isHTTPOnly])
             continue;
 
         [filteredCookies.get() addObject:cookie];
@@ -80,15 +65,7 @@ String cookies(const Document*, const KURL& url)
 {
     BEGIN_BLOCK_OBJC_EXCEPTIONS;
 
-    NSURL *cookieURL = url;
-    NSArray *cookies;
-#if USE(CFURLSTORAGESESSIONS)
-    if (RetainPtr<CFHTTPCookieStorageRef> cfCookieStorage = currentCFHTTPCookieStorage())
-        cookies = wkHTTPCookiesForURL(cfCookieStorage.get(), cookieURL);
-    else
-#endif
-        cookies = [[NSHTTPCookieStorage sharedHTTPCookieStorage] cookiesForURL:cookieURL];
-
+    NSArray *cookies = wkHTTPCookiesForURL(currentCFHTTPCookieStorage().get(), url);
     return [[NSHTTPCookie requestHeaderFieldsWithCookies:filterCookies(cookies).get()] objectForKey:@"Cookie"];
 
     END_BLOCK_OBJC_EXCEPTIONS;
@@ -99,15 +76,7 @@ String cookieRequestHeaderFieldValue(const Document*, const KURL& url)
 {
     BEGIN_BLOCK_OBJC_EXCEPTIONS;
 
-    NSURL *cookieURL = url;
-    NSArray *cookies;
-#if USE(CFURLSTORAGESESSIONS)
-    if (RetainPtr<CFHTTPCookieStorageRef> cfCookieStorage = currentCFHTTPCookieStorage())
-        cookies = wkHTTPCookiesForURL(cfCookieStorage.get(), cookieURL);
-    else
-#endif
-        cookies = [[NSHTTPCookieStorage sharedHTTPCookieStorage] cookiesForURL:cookieURL];
-
+    NSArray *cookies = wkHTTPCookiesForURL(currentCFHTTPCookieStorage().get(), url);
     return [[NSHTTPCookie requestHeaderFieldsWithCookies:cookies] objectForKey:@"Cookie"];
 
     END_BLOCK_OBJC_EXCEPTIONS;
@@ -127,15 +96,11 @@ void setCookies(Document* document, const KURL& url, const String& cookieStr)
     // cookiesWithResponseHeaderFields doesn't parse cookies without a value
     String cookieString = cookieStr.contains('=') ? cookieStr : cookieStr + "=";
 
-    NSURL *cookieURL = url;    
+    NSURL *cookieURL = url;
     RetainPtr<NSArray> filteredCookies = filterCookies([NSHTTPCookie cookiesWithResponseHeaderFields:[NSDictionary dictionaryWithObject:cookieString forKey:@"Set-Cookie"] forURL:cookieURL]);
+    ASSERT([filteredCookies.get() count] <= 1);
 
-#if USE(CFURLSTORAGESESSIONS)
-    if (RetainPtr<CFHTTPCookieStorageRef> cfCookieStorage = currentCFHTTPCookieStorage())
-        wkSetHTTPCookiesForURL(cfCookieStorage.get(), filteredCookies.get(), cookieURL, document->firstPartyForCookies());
-    else
-#endif
-        [[NSHTTPCookieStorage sharedHTTPCookieStorage] setCookies:filteredCookies.get() forURL:cookieURL mainDocumentURL:document->firstPartyForCookies()];
+    wkSetHTTPCookiesForURL(currentCFHTTPCookieStorage().get(), filteredCookies.get(), cookieURL, document->firstPartyForCookies());
 
     END_BLOCK_OBJC_EXCEPTIONS;
 }
@@ -144,14 +109,7 @@ bool cookiesEnabled(const Document*)
 {
     BEGIN_BLOCK_OBJC_EXCEPTIONS;
 
-    NSHTTPCookieAcceptPolicy cookieAcceptPolicy;
-#if USE(CFURLSTORAGESESSIONS)
-    if (RetainPtr<CFHTTPCookieStorageRef> cfCookieStorage = currentCFHTTPCookieStorage())
-        cookieAcceptPolicy = wkGetHTTPCookieAcceptPolicy(cfCookieStorage.get());
-    else
-#endif
-        cookieAcceptPolicy = [[NSHTTPCookieStorage sharedHTTPCookieStorage] cookieAcceptPolicy];
-
+    NSHTTPCookieAcceptPolicy cookieAcceptPolicy = static_cast<NSHTTPCookieAcceptPolicy>(wkGetHTTPCookieAcceptPolicy(currentCFHTTPCookieStorage().get()));
     return cookieAcceptPolicy == NSHTTPCookieAcceptPolicyAlways || cookieAcceptPolicy == NSHTTPCookieAcceptPolicyOnlyFromMainDocumentDomain;
 
     END_BLOCK_OBJC_EXCEPTIONS;
@@ -163,28 +121,14 @@ bool getRawCookies(const Document*, const KURL& url, Vector<Cookie>& rawCookies)
     rawCookies.clear();
     BEGIN_BLOCK_OBJC_EXCEPTIONS;
 
-    NSURL *cookieURL = url;
-    NSArray *cookies;
-#if USE(CFURLSTORAGESESSIONS)
-    if (RetainPtr<CFHTTPCookieStorageRef> cfCookieStorage = currentCFHTTPCookieStorage())
-        cookies = wkHTTPCookiesForURL(cfCookieStorage.get(), cookieURL);
-    else
-#endif
-        cookies = [[NSHTTPCookieStorage sharedHTTPCookieStorage] cookiesForURL:cookieURL];
-
+    NSArray *cookies = wkHTTPCookiesForURL(currentCFHTTPCookieStorage().get(), url);
     NSUInteger count = [cookies count];
     rawCookies.reserveCapacity(count);
     for (NSUInteger i = 0; i < count; ++i) {
         NSHTTPCookie *cookie = (NSHTTPCookie *)[cookies objectAtIndex:i];
-        NSString *name = [cookie name];
-        NSString *value = [cookie value];
-        NSString *domain = [cookie domain];
-        NSString *path = [cookie path];
         NSTimeInterval expires = [[cookie expiresDate] timeIntervalSince1970] * 1000;
-        bool httpOnly = [cookie isHTTPOnly];
-        bool secure = [cookie isSecure];
-        bool session = [cookie isSessionOnly];
-        rawCookies.uncheckedAppend(Cookie(name, value, domain, path, expires, httpOnly, secure, session));
+        rawCookies.uncheckedAppend(Cookie([cookie name], [cookie value], [cookie domain], [cookie path], expires,
+            [cookie isHTTPOnly], [cookie isSecure], [cookie isSessionOnly]));
     }
 
     END_BLOCK_OBJC_EXCEPTIONS;
@@ -196,30 +140,16 @@ void deleteCookie(const Document*, const KURL& url, const String& cookieName)
     BEGIN_BLOCK_OBJC_EXCEPTIONS;
 
     NSURL *cookieURL = url;
-    NSHTTPCookieStorage *cookieStorage = [NSHTTPCookieStorage sharedHTTPCookieStorage];
-    NSArray *cookies;
-#if USE(CFURLSTORAGESESSIONS)
-    RetainPtr<CFHTTPCookieStorageRef> cfCookieStorage = currentCFHTTPCookieStorage();
-    if (cfCookieStorage)
-        cookies = wkHTTPCookiesForURL(cfCookieStorage.get(), cookieURL);
-    else
-#endif
-        cookies = [cookieStorage cookiesForURL:cookieURL];
-
-    NSString *cookieNameString = (NSString *) cookieName;
+    RetainPtr<CFHTTPCookieStorageRef> cookieStorage = currentCFHTTPCookieStorage();
+    NSArray *cookies = wkHTTPCookiesForURL(cookieStorage.get(), cookieURL);
+
+    NSString *cookieNameString = cookieName;
 
     NSUInteger count = [cookies count];
     for (NSUInteger i = 0; i < count; ++i) {
         NSHTTPCookie *cookie = (NSHTTPCookie *)[cookies objectAtIndex:i];
-        if ([[cookie name] isEqualToString:cookieNameString]) {
-#if USE(CFURLSTORAGESESSIONS)
-            if (cfCookieStorage)
-                wkDeleteHTTPCookie(cfCookieStorage.get(), cookie);
-            else
-#endif
-                [cookieStorage deleteCookie:cookie];
-            break;
-        }
+        if ([[cookie name] isEqualToString:cookieNameString])
+            wkDeleteHTTPCookie(cookieStorage.get(), cookie);
     }
 
     END_BLOCK_OBJC_EXCEPTIONS;
@@ -228,9 +158,8 @@ void deleteCookie(const Document*, const KURL& url, const String& cookieName)
 void getHostnamesWithCookies(HashSet<String>& hostnames)
 {
     BEGIN_BLOCK_OBJC_EXCEPTIONS;
-    
-    NSHTTPCookieStorage *cookieStorage = [NSHTTPCookieStorage sharedHTTPCookieStorage];
-    NSArray *cookies = [cookieStorage cookies];
+
+    NSArray *cookies = wkHTTPCookies(defaultCFHTTPCookieStorage().get());
     
     for (NSHTTPCookie* cookie in cookies)
         hostnames.add([cookie domain]);
@@ -241,15 +170,15 @@ void getHostnamesWithCookies(HashSet<String>& hostnames)
 void deleteCookiesForHostname(const String& hostname)
 {
     BEGIN_BLOCK_OBJC_EXCEPTIONS;
-    
-    NSHTTPCookieStorage *cookieStorage = [NSHTTPCookieStorage sharedHTTPCookieStorage];
-    NSArray *cookies = [cookieStorage cookies];
+
+    RetainPtr<CFHTTPCookieStorageRef> cookieStorage = defaultCFHTTPCookieStorage();
+    NSArray *cookies = wkHTTPCookies(cookieStorage.get());
     if (!cookies)
         return;
     
     for (NSHTTPCookie* cookie in cookies) {
         if (hostname == String([cookie domain]))
-            [cookieStorage deleteCookie:cookie];
+            wkDeleteHTTPCookie(cookieStorage.get(), cookie);
     }
     
     END_BLOCK_OBJC_EXCEPTIONS;
@@ -257,17 +186,7 @@ void deleteCookiesForHostname(const String& hostname)
 
 void deleteAllCookies()
 {
-    BEGIN_BLOCK_OBJC_EXCEPTIONS;
-    
-    NSHTTPCookieStorage *cookieStorage = [NSHTTPCookieStorage sharedHTTPCookieStorage];
-    NSArray *cookies = [cookieStorage cookies];
-    if (!cookies)
-        return;
-    
-    for (NSHTTPCookie* cookie in cookies)
-        [cookieStorage deleteCookie:cookie];
-
-    END_BLOCK_OBJC_EXCEPTIONS;
+    wkDeleteAllHTTPCookies(defaultCFHTTPCookieStorage().get());
 }
 
 }
diff --git a/Source/WebCore/platform/mac/CursorMac.mm b/Source/WebCore/platform/mac/CursorMac.mm
index ac24b88c4..13e706230 100644
--- a/Source/WebCore/platform/mac/CursorMac.mm
+++ b/Source/WebCore/platform/mac/CursorMac.mm
@@ -61,10 +61,9 @@ static RetainPtr<NSCursor> createNamedCursor(const char* name, int x, int y)
     
     RetainPtr<NSCursor> cursor;
 
-    if (cursorImage) {
-        NSPoint hotSpotPoint = {x, y}; // workaround for 4213314
-        cursor.adoptNS([[NSCursor alloc] initWithImage:cursorImage.get() hotSpot:hotSpotPoint]);
-    }
+    if (cursorImage)
+        cursor = adoptNS([[NSCursor alloc] initWithImage:cursorImage.get() hotSpot:NSMakePoint(x, y)]);
+
     return cursor;
     END_BLOCK_OBJC_EXCEPTIONS;
     return nil;
diff --git a/Source/WebCore/platform/mac/DragImageMac.mm b/Source/WebCore/platform/mac/DragImageMac.mm
index 3379f39ca..b92ce60ee 100644
--- a/Source/WebCore/platform/mac/DragImageMac.mm
+++ b/Source/WebCore/platform/mac/DragImageMac.mm
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007, 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2007, 2009, 2012 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -99,17 +99,27 @@ RetainPtr<NSImage> createDragImageFromImage(Image* image, RespectImageOrientatio
 
         if (orientation != DefaultImageOrientation) {
             // Construct a correctly-rotated copy of the image to use as the drag image.
-            RetainPtr<NSAffineTransform> cocoaTransform(AdoptNS, [[NSAffineTransform alloc] init]);
-            CGAffineTransform transform = orientation.transformFromDefault(sizeRespectingOrientation);
-            [cocoaTransform.get() setTransformStruct:*(NSAffineTransformStruct*)&transform];
-
             FloatRect destRect(FloatPoint(), sizeRespectingOrientation);
 
             RetainPtr<NSImage> rotatedDragImage(AdoptNS, [[NSImage alloc] initWithSize:(NSSize)(sizeRespectingOrientation)]);
             [rotatedDragImage.get() lockFocus];
-            [cocoaTransform.get() concat];
+
+            // ImageOrientation uses top-left coordinates, need to flip to bottom-left, apply...
+            CGAffineTransform transform = CGAffineTransformMakeTranslation(0, destRect.height());
+            transform = CGAffineTransformScale(transform, 1, -1);
+            transform = CGAffineTransformConcat(orientation.transformFromDefault(sizeRespectingOrientation), transform);
+
             if (orientation.usesWidthAsHeight())
                 destRect = FloatRect(destRect.x(), destRect.y(), destRect.height(), destRect.width());
+
+            // ...and flip back.
+            transform = CGAffineTransformTranslate(transform, 0, destRect.height());
+            transform = CGAffineTransformScale(transform, 1, -1);
+
+            RetainPtr<NSAffineTransform> cocoaTransform(AdoptNS, [[NSAffineTransform alloc] init]);
+            [cocoaTransform.get() setTransformStruct:*(NSAffineTransformStruct*)&transform];
+            [cocoaTransform.get() concat];
+
             [image->getNSImage() drawInRect:destRect fromRect:NSMakeRect(0, 0, size.width(), size.height()) operation:NSCompositeSourceOver fraction:1.0];
             [rotatedDragImage.get() unlockFocus];
 
@@ -270,9 +280,7 @@ DragImageRef createDragImageForLink(KURL& url, const String& title, Frame* frame
 {
     if (!frame)
         return nil;
-    NSString *label = 0;
-    if (!title.isEmpty())
-        label = title;
+    NSString *label = nsStringNilIfEmpty(title);
     NSURL *cocoaURL = url;
     NSString *urlString = [cocoaURL absoluteString];
 
diff --git a/Source/WebCore/platform/mac/HTMLConverter.mm b/Source/WebCore/platform/mac/HTMLConverter.mm
index bb6e743b6..6516a2d2c 100644
--- a/Source/WebCore/platform/mac/HTMLConverter.mm
+++ b/Source/WebCore/platform/mac/HTMLConverter.mm
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2011 Apple Inc. All rights reserved.
+ * Copyright (C) 2011, 2012 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -798,11 +798,15 @@ static inline NSShadow *_shadowForShadowStyle(NSString *shadowStyle)
     }
     if (!fileWrapper) {
         RefPtr<ArchiveResource> resource = dataSource->subresource(url);
-        if (!resource) resource = dataSource->subresource(url);
-        if (flag && resource && [@"text/html" isEqual:resource->mimeType()]) notFound = YES;
+        if (!resource)
+            resource = dataSource->subresource(url);
+
+        const String& mimeType = resource->mimeType();
+        if (flag && resource && mimeType == "text/html")
+            notFound = YES;
         if (resource && !notFound) {
             fileWrapper = [[[NSFileWrapper alloc] initRegularFileWithContents:[resource->data()->createNSData() autorelease]] autorelease];
-            [fileWrapper setPreferredFilename:suggestedFilenameWithMIMEType(url, resource->mimeType())];
+            [fileWrapper setPreferredFilename:suggestedFilenameWithMIMEType(url, mimeType)];
         }
     }
     if (!fileWrapper && !notFound) {
diff --git a/Source/WebCore/platform/mac/PlatformEventFactoryMac.mm b/Source/WebCore/platform/mac/PlatformEventFactoryMac.mm
index 2ec524c20..f116424bf 100644
--- a/Source/WebCore/platform/mac/PlatformEventFactoryMac.mm
+++ b/Source/WebCore/platform/mac/PlatformEventFactoryMac.mm
@@ -327,7 +327,7 @@ int windowsKeyCodeForKeyEvent(NSEvent* event)
     // 2. Keys for which there is no known Mac virtual key codes, like PrintScreen.
     // 3. Certain punctuation keys. On Windows, these are also remapped depending on current keyboard layout,
     //    but see comment in windowsKeyCodeForCharCode().
-    if ([event type] == NSKeyDown || [event type] == NSKeyUp) {
+    if (!isKeypadEvent(event) && ([event type] == NSKeyDown || [event type] == NSKeyUp)) {
         // Cmd switches Roman letters for Dvorak-QWERTY layout, so try modified characters first.
         NSString* s = [event characters];
         code = [s length] > 0 ? windowsKeyCodeForCharCode([s characterAtIndex:0]) : 0;
diff --git a/Source/WebCore/platform/mac/SSLKeyGeneratorMac.cpp b/Source/WebCore/platform/mac/SSLKeyGeneratorMac.cpp
index 0a1a4d8c7..e58d9a949 100644
--- a/Source/WebCore/platform/mac/SSLKeyGeneratorMac.cpp
+++ b/Source/WebCore/platform/mac/SSLKeyGeneratorMac.cpp
@@ -60,11 +60,7 @@ String signedPublicKeyAndChallengeString(unsigned keySizeIndex, const String& ch
         return String();
     }
 
-    RetainPtr<CFStringRef> challengeStringCF(AdoptCF, challengeString.createCFString());
-    RetainPtr<CFStringRef> keyDescription(AdoptCF, keygenKeychainItemName(url.host()).createCFString());
-    RetainPtr<CFStringRef> result(AdoptCF, wkSignedPublicKeyAndChallengeString(keySize, challengeStringCF.get(), keyDescription.get()));
-
-    return result.get();
+    return adoptCF(wkSignedPublicKeyAndChallengeString(keySize, challengeString.createCFString().get(), keygenKeychainItemName(url.host()).createCFString().get())).get();
 }
 
 }
diff --git a/Source/WebCore/platform/mac/ScrollViewMac.mm b/Source/WebCore/platform/mac/ScrollViewMac.mm
index a560bc598..1e9fe3fa8 100644
--- a/Source/WebCore/platform/mac/ScrollViewMac.mm
+++ b/Source/WebCore/platform/mac/ScrollViewMac.mm
@@ -123,8 +123,7 @@ void ScrollView::platformSetContentsSize()
     int w = m_contentsSize.width();
     int h = m_contentsSize.height();
     LOG(Frames, "%p %@ at w %d h %d\n", documentView(), [(id)[documentView() class] className], w, h);            
-    NSSize tempSize = { max(0, w), max(0, h) }; // workaround for 4213314
-    [documentView() setFrameSize:tempSize];
+    [documentView() setFrameSize:NSMakeSize(max(0, w), max(0, h))];
     END_BLOCK_OBJC_EXCEPTIONS;
 }
 
diff --git a/Source/WebCore/platform/mac/WebCoreNSURLExtras.h b/Source/WebCore/platform/mac/WebCoreNSURLExtras.h
index b8cbfdacd..940316865 100644
--- a/Source/WebCore/platform/mac/WebCoreNSURLExtras.h
+++ b/Source/WebCore/platform/mac/WebCoreNSURLExtras.h
@@ -47,10 +47,10 @@ NSString *decodeHostNameWithRange(NSString *, NSRange);
 NSString *encodeHostNameWithRange(NSString *, NSRange);
 NSString *decodeHostName(NSString *);
 NSString *encodeHostName(NSString *);
-NSURL *URLByTruncatingOneCharacterBeforeComponent(NSURL *, CFURLComponentType);
+NSURL *URLByTruncatingOneCharacterBeforeComponent(NSURL *, CFIndex);
 NSURL *URLWithData(NSData *, NSURL *baseURL);
 NSData *originalURLData(NSURL *);
-NSData *dataForURLComponentType(NSURL *, CFURLComponentType);
+NSData *dataForURLComponentType(NSURL *, CFIndex);
 BOOL isUserVisibleURL(NSString *);
     
 } // namespace WebCore
diff --git a/Source/WebCore/platform/mac/WebCoreNSURLExtras.mm b/Source/WebCore/platform/mac/WebCoreNSURLExtras.mm
index 3b87d5370..4612633fb 100644
--- a/Source/WebCore/platform/mac/WebCoreNSURLExtras.mm
+++ b/Source/WebCore/platform/mac/WebCoreNSURLExtras.mm
@@ -510,12 +510,12 @@ static NSString *stringByTrimmingWhitespace(NSString *string)
     return trimmed;
 }
 
-NSURL *URLByTruncatingOneCharacterBeforeComponent(NSURL *URL, CFURLComponentType component)
+NSURL *URLByTruncatingOneCharacterBeforeComponent(NSURL *URL, CFIndex component)
 {
     if (!URL)
         return nil;
     
-    CFRange fragRg = CFURLGetByteRangeForComponent((CFURLRef)URL, component, NULL);
+    CFRange fragRg = CFURLGetByteRangeForComponent((CFURLRef)URL, static_cast<CFURLComponentType>(component), NULL);
     if (fragRg.location == kCFNotFound)
         return URL;
     
@@ -619,7 +619,7 @@ static BOOL hasQuestionMarkOnlyQueryString(NSURL *URL)
 
 #define completeURL (CFURLComponentType)-1
 
-NSData *dataForURLComponentType(NSURL *URL, CFURLComponentType componentType)
+NSData *dataForURLComponentType(NSURL *URL, CFIndex componentType)
 {
     static int URLComponentTypeBufferLength = 2048;
     
@@ -635,7 +635,7 @@ NSData *dataForURLComponentType(NSURL *URL, CFURLComponentType componentType)
     
     CFRange range;
     if (componentType != completeURL) {
-        range = CFURLGetByteRangeForComponent((CFURLRef)URL, componentType, NULL);
+        range = CFURLGetByteRangeForComponent((CFURLRef)URL, static_cast<CFURLComponentType>(componentType), NULL);
         if (range.location == kCFNotFound)
             return nil;
     } else {
diff --git a/Source/WebCore/platform/mac/WebCoreSystemInterface.h b/Source/WebCore/platform/mac/WebCoreSystemInterface.h
index c5df5d199..78e2ef0b2 100644
--- a/Source/WebCore/platform/mac/WebCoreSystemInterface.h
+++ b/Source/WebCore/platform/mac/WebCoreSystemInterface.h
@@ -193,7 +193,6 @@ extern NSArray *(*wkQTGetSitesInMediaDownloadCache)();
 extern void (*wkQTClearMediaDownloadCacheForSite)(NSString *site);
 extern void (*wkQTClearMediaDownloadCache)();
 extern void (*wkSetCGFontRenderingMode)(CGContextRef, NSFont*);
-extern void (*wkSetCookieStoragePrivateBrowsingEnabled)(BOOL);
 extern void (*wkSetDragImage)(NSImage*, NSPoint offset);
 extern void (*wkSetNSURLConnectionDefersCallbacks)(NSURLConnection *, BOOL);
 extern void (*wkSetNSURLRequestShouldContentSniff)(NSMutableURLRequest *, BOOL);
@@ -291,9 +290,11 @@ typedef struct OpaqueCFHTTPCookieStorage* CFHTTPCookieStorageRef;
 extern CFHTTPCookieStorageRef (*wkCopyHTTPCookieStorage)(CFURLStorageSessionRef);
 extern unsigned (*wkGetHTTPCookieAcceptPolicy)(CFHTTPCookieStorageRef);
 extern void (*wkSetHTTPCookieAcceptPolicy)(CFHTTPCookieStorageRef, unsigned);
+extern NSArray *(*wkHTTPCookies)(CFHTTPCookieStorageRef);
 extern NSArray *(*wkHTTPCookiesForURL)(CFHTTPCookieStorageRef, NSURL *);
 extern void (*wkSetHTTPCookiesForURL)(CFHTTPCookieStorageRef, NSArray *, NSURL *, NSURL *);
 extern void (*wkDeleteHTTPCookie)(CFHTTPCookieStorageRef, NSHTTPCookie *);
+extern void (*wkDeleteAllHTTPCookies)(CFHTTPCookieStorageRef);
 
 extern CFStringRef (*wkGetCFURLResponseMIMEType)(CFURLResponseRef);
 extern CFURLRef (*wkGetCFURLResponseURL)(CFURLResponseRef);
@@ -344,6 +345,40 @@ extern CGFloat (*wkNSElasticDeltaForReboundDelta)(CGFloat delta);
 extern CGFloat (*wkNSReboundDeltaForElasticDelta)(CGFloat delta);
 #endif
 
+typedef enum {
+    wkCaptionFontStyleDefault = 0,
+    wkCaptionFontStyleMonospacedWithSerif,
+    wkCaptionFontStyleProportionalWithSerif,
+    wkCaptionFontStyleMonospacedWithoutSerif,
+    wkCaptionFontStyleProportionalWithoutSerif,
+    wkCaptionFontStyleCasual,
+    wkCaptionFontStyleCursive,
+    wkCaptionFontStyleSmallCapital,
+    wkCaptionFontStyleMax
+} wkCaptionFontStyle;
+
+typedef enum {
+    wkCaptionTextEdgeStyleUndefined = 0,
+    wkCaptionTextEdgeStyleNone,
+    wkCaptionTextEdgeStyleRaised,
+    wkCaptionTextEdgeStyleDepressed,
+    wkCaptionTextEdgeStyleUniform,
+    wkCaptionTextEdgeStyleDropShadow,
+    wkCaptionTextEdgeStyleMax
+} wkCaptionTextEdgeStyle;
+
+extern bool (*wkCaptionAppearanceHasUserPreferences)(void);
+extern bool (*wkCaptionAppearanceShowCaptionsWhenAvailable)(void);
+extern CGColorRef(*wkCaptionAppearanceCopyForegroundColor)(void);
+extern CGColorRef(*wkCaptionAppearanceCopyBackgroundColor)(void);
+extern CGColorRef(*wkCaptionAppearanceCopyWindowColor)(void);
+extern bool(*wkCaptionAppearanceGetForegroundOpacity)(CGFloat*);
+extern bool(*wkCaptionAppearanceGetBackgroundOpacity)(CGFloat*);
+extern bool(*wkCaptionAppearanceGetWindowOpacity)(CGFloat*);
+extern CGFontRef(*wkCaptionAppearanceCopyFontForStyle)(int);
+extern bool(*wkCaptionAppearanceGetRelativeCharacterSize)(CGFloat*);
+extern int(*wkCaptionAppearanceGetTextEdgeStyle)(void);
+extern CFStringRef(*wkCaptionAppearanceGetSettingsChangedNotification)(void);
 }
 
 #endif
diff --git a/Source/WebCore/platform/mac/WebCoreSystemInterface.mm b/Source/WebCore/platform/mac/WebCoreSystemInterface.mm
index a467a4b16..7bc6c3b34 100644
--- a/Source/WebCore/platform/mac/WebCoreSystemInterface.mm
+++ b/Source/WebCore/platform/mac/WebCoreSystemInterface.mm
@@ -86,7 +86,6 @@ void (*wkQTClearMediaDownloadCacheForSite)(NSString *site);
 void (*wkQTClearMediaDownloadCache)();
 
 void (*wkSetCGFontRenderingMode)(CGContextRef, NSFont*);
-void (*wkSetCookieStoragePrivateBrowsingEnabled)(BOOL);
 void (*wkSetDragImage)(NSImage*, NSPoint offset);
 void (*wkSetBaseCTM)(CGContextRef, CGAffineTransform);
 void (*wkSetPatternPhaseInUserSpace)(CGContextRef, CGPoint point);
@@ -175,8 +174,10 @@ NSURLRequest* (*wkCopyRequestWithStorageSession)(CFURLStorageSessionRef, NSURLRe
 CFHTTPCookieStorageRef (*wkCopyHTTPCookieStorage)(CFURLStorageSessionRef);
 unsigned (*wkGetHTTPCookieAcceptPolicy)(CFHTTPCookieStorageRef);
 void (*wkSetHTTPCookieAcceptPolicy)(CFHTTPCookieStorageRef, unsigned);
+NSArray *(*wkHTTPCookies)(CFHTTPCookieStorageRef);
 NSArray *(*wkHTTPCookiesForURL)(CFHTTPCookieStorageRef, NSURL *);
 void (*wkSetHTTPCookiesForURL)(CFHTTPCookieStorageRef, NSArray *, NSURL *, NSURL *);
+void (*wkDeleteAllHTTPCookies)(CFHTTPCookieStorageRef);
 void (*wkDeleteHTTPCookie)(CFHTTPCookieStorageRef, NSHTTPCookie *);
 
 CFStringRef (*wkGetCFURLResponseMIMEType)(CFURLResponseRef);
@@ -216,3 +217,15 @@ CGFloat (*wkNSElasticDeltaForReboundDelta)(CGFloat delta);
 CGFloat (*wkNSReboundDeltaForElasticDelta)(CGFloat delta);
 #endif
 
+bool (*wkCaptionAppearanceHasUserPreferences)(void);
+bool (*wkCaptionAppearanceShowCaptionsWhenAvailable)(void);
+CGColorRef(*wkCaptionAppearanceCopyForegroundColor)(void);
+CGColorRef(*wkCaptionAppearanceCopyBackgroundColor)(void);
+CGColorRef(*wkCaptionAppearanceCopyWindowColor)(void);
+bool(*wkCaptionAppearanceGetForegroundOpacity)(CGFloat*);
+bool(*wkCaptionAppearanceGetBackgroundOpacity)(CGFloat*);
+bool(*wkCaptionAppearanceGetWindowOpacity)(CGFloat*);
+CGFontRef(*wkCaptionAppearanceCopyFontForStyle)(int);
+bool(*wkCaptionAppearanceGetRelativeCharacterSize)(CGFloat*);
+int(*wkCaptionAppearanceGetTextEdgeStyle)(void);
+CFStringRef(*wkCaptionAppearanceGetSettingsChangedNotification)(void);
diff --git a/Source/WebCore/platform/network/CookieStorage.h b/Source/WebCore/platform/network/CookieStorage.h
index ad8e91fc7..e7a2b8af9 100644
--- a/Source/WebCore/platform/network/CookieStorage.h
+++ b/Source/WebCore/platform/network/CookieStorage.h
@@ -26,11 +26,9 @@
 #ifndef CookieStorage_h
 #define CookieStorage_h
 
-#include <wtf/RetainPtr.h>
-
 namespace WebCore {
 
-void setCookieStoragePrivateBrowsingEnabled(bool);
+// These are always observing the shared cookie storage, even when in private browsing mode.
 void startObservingCookieChanges();
 void stopObservingCookieChanges();
 
diff --git a/Source/WebCore/platform/network/DNSResolveQueue.cpp b/Source/WebCore/platform/network/DNSResolveQueue.cpp
index b9d011379..0ef2049ee 100644
--- a/Source/WebCore/platform/network/DNSResolveQueue.cpp
+++ b/Source/WebCore/platform/network/DNSResolveQueue.cpp
@@ -27,6 +27,8 @@
 #include "config.h"
 #include "DNSResolveQueue.h"
 
+#include <wtf/CurrentTime.h>
+
 namespace WebCore {
 
 // When resolve queue is empty, we fire async resolution requests immediately (which is important if the prefetch is triggered by hovering).
@@ -47,13 +49,30 @@ static const int gMaxRequestsToQueue = 64;
 // If there were queued names that couldn't be sent simultaneously, check the state of resolvers after this delay.
 static const double gRetryResolvingInSeconds = 0.1;
 
+DNSResolveQueue::DNSResolveQueue()
+    : m_requestsInFlight(0)
+    , m_cachedProxyEnabledStatus(false)
+    , m_lastProxyEnabledStatusCheckTime(0)
+{
+}
+
+bool DNSResolveQueue::isUsingProxy()
+{
+    double time = currentTime();
+    static const double minimumProxyCheckDelay = 5;
+    if (time - m_lastProxyEnabledStatusCheckTime > minimumProxyCheckDelay) {
+        m_lastProxyEnabledStatusCheckTime = time;
+        m_cachedProxyEnabledStatus = platformProxyIsEnabledInSystemPreferences();
+    }
+    return m_cachedProxyEnabledStatus;
+}
+
 void DNSResolveQueue::add(const String& hostname)
 {
     // If there are no names queued, and few enough are in flight, resolve immediately (the mouse may be over a link).
     if (!m_names.size()) {
-        if (platformProxyIsEnabledInSystemPreferences())
+        if (isUsingProxy())
             return;
-
         if (atomicIncrement(&m_requestsInFlight) <= gNamesToResolveImmediately) {
             platformResolve(hostname);
             return;
@@ -72,7 +91,7 @@ void DNSResolveQueue::add(const String& hostname)
 
 void DNSResolveQueue::fired()
 {
-    if (platformProxyIsEnabledInSystemPreferences()) {
+    if (isUsingProxy()) {
         m_names.clear();
         return;
     }
diff --git a/Source/WebCore/platform/network/DNSResolveQueue.h b/Source/WebCore/platform/network/DNSResolveQueue.h
index e4b96f810..c531f1fc4 100644
--- a/Source/WebCore/platform/network/DNSResolveQueue.h
+++ b/Source/WebCore/platform/network/DNSResolveQueue.h
@@ -50,6 +50,10 @@ public:
     }
 
 private:
+    DNSResolveQueue();
+
+    bool isUsingProxy();
+
     bool platformProxyIsEnabledInSystemPreferences();
     void platformResolve(const String&);
 
@@ -57,6 +61,8 @@ private:
 
     HashSet<String> m_names;
     int m_requestsInFlight;
+    bool m_cachedProxyEnabledStatus;
+    double m_lastProxyEnabledStatusCheckTime;
 };
 
 }
diff --git a/Source/WebCore/platform/network/HTTPHeaderMap.h b/Source/WebCore/platform/network/HTTPHeaderMap.h
index 12bde0689..f919ba185 100644
--- a/Source/WebCore/platform/network/HTTPHeaderMap.h
+++ b/Source/WebCore/platform/network/HTTPHeaderMap.h
@@ -39,6 +39,7 @@ namespace WebCore {
 
     typedef Vector<std::pair<String, String> > CrossThreadHTTPHeaderMapData;
 
+    // FIXME: Not every header fits into a map. Notably, multiple Set-Cookie header fields are needed to set multiple cookies.
     class HTTPHeaderMap : public HashMap<AtomicString, String, CaseFoldingHash> {
     public:
         HTTPHeaderMap();
diff --git a/Source/WebCore/platform/network/HTTPParsers.cpp b/Source/WebCore/platform/network/HTTPParsers.cpp
index 310243e50..ba47d220f 100644
--- a/Source/WebCore/platform/network/HTTPParsers.cpp
+++ b/Source/WebCore/platform/network/HTTPParsers.cpp
@@ -43,37 +43,64 @@ using namespace WTF;
 
 namespace WebCore {
 
-// true if there is more to parse
+// true if there is more to parse, after incrementing pos past whitespace.
+// Note: Might return pos == str.length()
 static inline bool skipWhiteSpace(const String& str, unsigned& pos, bool fromHttpEquivMeta)
 {
     unsigned len = str.length();
 
     if (fromHttpEquivMeta) {
-        while (pos != len && str[pos] <= ' ')
+        while (pos < len && str[pos] <= ' ')
             ++pos;
     } else {
-        while (pos != len && (str[pos] == '\t' || str[pos] == ' '))
+        while (pos < len && (str[pos] == '\t' || str[pos] == ' '))
             ++pos;
     }
 
-    return pos != len;
+    return pos < len;
 }
 
-// Returns true if the function can match the whole token (case insensitive).
+// Returns true if the function can match the whole token (case insensitive)
+// incrementing pos on match, otherwise leaving pos unchanged.
 // Note: Might return pos == str.length()
 static inline bool skipToken(const String& str, unsigned& pos, const char* token)
 {
     unsigned len = str.length();
+    unsigned current = pos;
 
-    while (pos != len && *token) {
-        if (toASCIILower(str[pos]) != *token++)
+    while (current < len && *token) {
+        if (toASCIILower(str[current]) != *token++)
             return false;
-        ++pos;
+        ++current;
     }
 
+    if (*token)
+        return false;
+
+    pos = current;
     return true;
 }
 
+// True if the expected equals sign is seen and there is more to follow.
+static inline bool skipEquals(const String& str, unsigned &pos)
+{
+    return skipWhiteSpace(str, pos, false) && str[pos++] == '=' && skipWhiteSpace(str, pos, false);
+}
+
+// True if a value present, incrementing pos to next space or semicolon, if any.  
+// Note: might return pos == str.length().
+static inline bool skipValue(const String& str, unsigned& pos)
+{
+    unsigned start = pos;
+    unsigned len = str.length();
+    while (pos < len) {
+        if (str[pos] == ' ' || str[pos] == '\t' || str[pos] == ';')
+            break;
+        ++pos;
+    }
+    return pos != start;
+}
+
 // See RFC 2616, Section 2.2.
 bool isRFC2616Token(const String& characters)
 {
@@ -313,31 +340,93 @@ void findCharsetInMediaType(const String& mediaType, unsigned int& charsetPos, u
     }
 }
 
-XSSProtectionDisposition parseXSSProtectionHeader(const String& header)
+XSSProtectionDisposition parseXSSProtectionHeader(const String& header, String& failureReason, unsigned& failurePosition, String& reportURL)
 {
-    String stippedHeader = header.stripWhiteSpace();
+    DEFINE_STATIC_LOCAL(String, failureReasonInvalidToggle, (ASCIILiteral("expected 0 or 1")));
+    DEFINE_STATIC_LOCAL(String, failureReasonInvalidSeparator, (ASCIILiteral("expected semicolon")));
+    DEFINE_STATIC_LOCAL(String, failureReasonInvalidEquals, (ASCIILiteral("expected equals sign")));
+    DEFINE_STATIC_LOCAL(String, failureReasonInvalidMode, (ASCIILiteral("invalid mode directive")));
+    DEFINE_STATIC_LOCAL(String, failureReasonInvalidReport, (ASCIILiteral("invalid report directive")));
+    DEFINE_STATIC_LOCAL(String, failureReasonDuplicateMode, (ASCIILiteral("duplicate mode directive")));
+    DEFINE_STATIC_LOCAL(String, failureReasonDuplicateReport, (ASCIILiteral("duplicate report directive")));
+    DEFINE_STATIC_LOCAL(String, failureReasonInvalidDirective, (ASCIILiteral("unrecognized directive")));
+
+    unsigned pos = 0;
 
-    if (stippedHeader.isEmpty())
+    if (!skipWhiteSpace(header, pos, false))
         return XSSProtectionEnabled;
 
-    if (stippedHeader[0] == '0')
+    if (header[pos] == '0')
         return XSSProtectionDisabled;
 
-    unsigned length = header.length();
-    unsigned pos = 0;
-    if (stippedHeader[pos++] == '1'
-        && skipWhiteSpace(stippedHeader, pos, false)
-        && stippedHeader[pos++] == ';'
-        && skipWhiteSpace(stippedHeader, pos, false)
-        && skipToken(stippedHeader, pos, "mode")
-        && skipWhiteSpace(stippedHeader, pos, false)
-        && stippedHeader[pos++] == '='
-        && skipWhiteSpace(stippedHeader, pos, false)
-        && skipToken(stippedHeader, pos, "block")
-        && pos == length)
-        return XSSProtectionBlockEnabled;
-
-    return XSSProtectionEnabled;
+    if (header[pos++] != '1') {
+        failureReason = failureReasonInvalidToggle;
+        return XSSProtectionInvalid;
+    }
+
+    XSSProtectionDisposition result = XSSProtectionEnabled;
+    bool modeDirectiveSeen = false;
+    bool reportDirectiveSeen = false;
+
+    while (1) {
+        // At end of previous directive: consume whitespace, semicolon, and whitespace.
+        if (!skipWhiteSpace(header, pos, false))
+            return result;
+
+        if (header[pos++] != ';') {
+            failureReason = failureReasonInvalidSeparator;
+            failurePosition = pos;
+            return XSSProtectionInvalid;
+        }
+
+        if (!skipWhiteSpace(header, pos, false))
+            return result;
+
+        // At start of next directive.
+        if (skipToken(header, pos, "mode")) {
+            if (modeDirectiveSeen) {
+                failureReason = failureReasonDuplicateMode;
+                failurePosition = pos;
+                return XSSProtectionInvalid;
+            }
+            modeDirectiveSeen = true;
+            if (!skipEquals(header, pos)) {
+                failureReason = failureReasonInvalidEquals;
+                failurePosition = pos;
+                return XSSProtectionInvalid;
+            }
+            if (!skipToken(header, pos, "block")) {
+                failureReason = failureReasonInvalidMode;
+                failurePosition = pos;
+                return XSSProtectionInvalid;
+            }
+            result = XSSProtectionBlockEnabled;
+        } else if (skipToken(header, pos, "report")) {
+            if (reportDirectiveSeen) {
+                failureReason = failureReasonDuplicateReport;
+                failurePosition = pos;
+                return XSSProtectionInvalid;
+            }
+            reportDirectiveSeen = true;
+            if (!skipEquals(header, pos)) {
+                failureReason = failureReasonInvalidEquals;
+                failurePosition = pos;
+                return XSSProtectionInvalid;
+            }
+            size_t startPos = pos;
+            if (!skipValue(header, pos)) {
+                failureReason = failureReasonInvalidReport;
+                failurePosition = pos;
+                return XSSProtectionInvalid;
+            }
+            reportURL = header.substring(startPos, pos - startPos);
+            failurePosition = startPos; // If later semantic check deems unacceptable.
+        } else {
+            failureReason = failureReasonInvalidDirective;
+            failurePosition = pos;
+            return XSSProtectionInvalid;
+        }
+    }
 }
 
 String extractReasonPhraseFromHTTPStatusLine(const String& statusLine)
diff --git a/Source/WebCore/platform/network/HTTPParsers.h b/Source/WebCore/platform/network/HTTPParsers.h
index 02ec13ebc..611abae80 100644
--- a/Source/WebCore/platform/network/HTTPParsers.h
+++ b/Source/WebCore/platform/network/HTTPParsers.h
@@ -40,6 +40,7 @@ class HTTPHeaderMap;
 class ResourceResponseBase;
 
 enum XSSProtectionDisposition {
+    XSSProtectionInvalid,
     XSSProtectionDisabled,
     XSSProtectionEnabled,
     XSSProtectionBlockEnabled
@@ -60,7 +61,7 @@ String filenameFromHTTPContentDisposition(const String&);
 String extractMIMETypeFromMediaType(const String&);
 String extractCharsetFromMediaType(const String&); 
 void findCharsetInMediaType(const String& mediaType, unsigned int& charsetPos, unsigned int& charsetLen, unsigned int start = 0);
-XSSProtectionDisposition parseXSSProtectionHeader(const String&);
+XSSProtectionDisposition parseXSSProtectionHeader(const String& header, String& failureReason, unsigned& failurePosition, String& reportURL);
 String extractReasonPhraseFromHTTPStatusLine(const String&);
 
 // -1 could be set to one of the return parameters to indicate the value is not specified.
diff --git a/Source/WebCore/platform/network/NetworkingContext.h b/Source/WebCore/platform/network/NetworkingContext.h
index e4c2daf94..1021b47d1 100644
--- a/Source/WebCore/platform/network/NetworkingContext.h
+++ b/Source/WebCore/platform/network/NetworkingContext.h
@@ -23,6 +23,7 @@
 #include <wtf/RefCounted.h>
 
 #if PLATFORM(MAC)
+OBJC_CLASS NSOperationQueue;
 #include "SchedulePair.h"
 #endif
 
@@ -53,7 +54,8 @@ public:
 #if PLATFORM(MAC)
     virtual bool needsSiteSpecificQuirks() const = 0;
     virtual bool localFileContentSniffingEnabled() const = 0;
-    virtual SchedulePairHashSet* scheduledRunLoopPairs() const = 0;
+    virtual SchedulePairHashSet* scheduledRunLoopPairs() const { return 0; }
+    virtual NSOperationQueue *scheduledOperationQueue() const { return 0; }
     virtual ResourceError blockedError(const ResourceRequest&) const = 0;
 #endif
 
diff --git a/Source/WebCore/platform/network/ProtectionSpaceHash.h b/Source/WebCore/platform/network/ProtectionSpaceHash.h
index edd95dbfb..2d56b313b 100644
--- a/Source/WebCore/platform/network/ProtectionSpaceHash.h
+++ b/Source/WebCore/platform/network/ProtectionSpaceHash.h
@@ -36,7 +36,7 @@ struct ProtectionSpaceHash {
     { 
         unsigned hashCodes[5] = {
             protectionSpace.host().impl() ? protectionSpace.host().impl()->hash() : 0, 
-            protectionSpace.port(), 
+            static_cast<unsigned>(protectionSpace.port()),
             protectionSpace.serverType(),
             protectionSpace.authenticationScheme(),
             protectionSpace.realm().impl() ? protectionSpace.realm().impl()->hash() : 0
diff --git a/Source/WebCore/platform/network/ResourceHandle.h b/Source/WebCore/platform/network/ResourceHandle.h
index b9bf34feb..e4532d23f 100644
--- a/Source/WebCore/platform/network/ResourceHandle.h
+++ b/Source/WebCore/platform/network/ResourceHandle.h
@@ -48,7 +48,7 @@ typedef void* LPVOID;
 typedef LPVOID HINTERNET;
 #endif
 
-#if PLATFORM(MAC) || USE(CFURLSTORAGESESSIONS)
+#if PLATFORM(MAC) || USE(CFNETWORK)
 #include <wtf/RetainPtr.h>
 #endif
 
@@ -68,9 +68,7 @@ typedef int CFHTTPCookieStorageAcceptPolicy;
 typedef struct OpaqueCFHTTPCookieStorage* CFHTTPCookieStorageRef;
 #endif
 
-#if USE(CFURLSTORAGESESSIONS) && PLATFORM(MAC) && !PLATFORM(IOS) && __MAC_OS_X_VERSION_MIN_REQUIRED <= 1060
-typedef struct __CFURLStorageSession* CFURLStorageSessionRef;
-#elif USE(CFURLSTORAGESESSIONS)
+#if PLATFORM(MAC) || USE(CFNETWORK)
 typedef const struct __CFURLStorageSession* CFURLStorageSessionRef;
 #endif
 
@@ -97,7 +95,7 @@ enum StoredCredentials {
 template <typename T> class Timer;
 
 class ResourceHandle : public RefCounted<ResourceHandle>
-#if PLATFORM(MAC) || USE(CFNETWORK) || USE(CURL)
+#if PLATFORM(MAC) || USE(CFNETWORK) || USE(CURL) || USE(SOUP)
     , public AuthenticationClient
 #endif
     {
@@ -114,7 +112,7 @@ public:
     void willSendRequest(ResourceRequest&, const ResourceResponse& redirectResponse);
     bool shouldUseCredentialStorage();
 #endif
-#if PLATFORM(MAC) || USE(CFNETWORK) || USE(CURL)
+#if PLATFORM(MAC) || USE(CFNETWORK) || USE(CURL) || USE(SOUP)
     void didReceiveAuthenticationChallenge(const AuthenticationChallenge&);
     virtual void receivedCredential(const AuthenticationChallenge&, const Credential&);
     virtual void receivedRequestToContinueWithoutCredential(const AuthenticationChallenge&);
@@ -198,7 +196,7 @@ public:
 
     void fireFailure(Timer<ResourceHandle>*);
 
-#if USE(CFURLSTORAGESESSIONS)
+#if PLATFORM(MAC) || USE(CFNETWORK)
     static CFURLStorageSessionRef currentStorageSession();
     static void setDefaultStorageSession(CFURLStorageSessionRef);
     static CFURLStorageSessionRef defaultStorageSession();
@@ -206,7 +204,7 @@ public:
 
     static void setPrivateBrowsingStorageSessionIdentifierBase(const String&);
     static RetainPtr<CFURLStorageSessionRef> createPrivateBrowsingStorageSession(CFStringRef identifier);
-#endif // USE(CFURLSTORAGESESSIONS)
+#endif
 
     using RefCounted<ResourceHandle>::ref;
     using RefCounted<ResourceHandle>::deref;
@@ -215,7 +213,7 @@ public:
     static CFStringRef synchronousLoadRunLoopMode();
 #endif
 
-#if HAVE(NETWORK_CFDATA_ARRAY_CALLBACK)
+#if USE(NETWORK_CFDATA_ARRAY_CALLBACK)
     void handleDataArray(CFArrayRef dataArray);
 #endif
 
@@ -247,7 +245,7 @@ private:
     void createCFURLConnection(bool shouldUseCredentialStorage, bool shouldContentSniff);
 #endif
 
-#if USE(CFURLSTORAGESESSIONS)
+#if PLATFORM(MAC) || USE(CFNETWORK)
     static String privateBrowsingStorageSessionIdentifierDefaultBase();
     static CFURLStorageSessionRef privateBrowsingStorageSession();
 #endif
diff --git a/Source/WebCore/platform/network/ResourceHandleClient.h b/Source/WebCore/platform/network/ResourceHandleClient.h
index befbccfa0..a5709c62c 100644
--- a/Source/WebCore/platform/network/ResourceHandleClient.h
+++ b/Source/WebCore/platform/network/ResourceHandleClient.h
@@ -77,7 +77,7 @@ namespace WebCore {
         virtual void wasBlocked(ResourceHandle*) { }
         virtual void cannotShowURL(ResourceHandle*) { }
 
-#if HAVE(NETWORK_CFDATA_ARRAY_CALLBACK)
+#if USE(NETWORK_CFDATA_ARRAY_CALLBACK)
         virtual bool supportsDataArray() { return false; }
         virtual void didReceiveDataArray(ResourceHandle*, CFArrayRef) { }
 #endif
diff --git a/Source/WebCore/platform/network/ResourceHandleInternal.h b/Source/WebCore/platform/network/ResourceHandleInternal.h
index 63df28245..663cd0494 100644
--- a/Source/WebCore/platform/network/ResourceHandleInternal.h
+++ b/Source/WebCore/platform/network/ResourceHandleInternal.h
@@ -193,7 +193,6 @@ namespace WebCore {
         unsigned long m_bodyDataSent;
         RefPtr<NetworkingContext> m_context;
         SoupSession* soupSession();
-        uint64_t initiatingPageID();
 #endif
 #if PLATFORM(QT)
         QNetworkReplyHandler* m_job;
diff --git a/Source/WebCore/platform/network/ResourceLoadPriority.h b/Source/WebCore/platform/network/ResourceLoadPriority.h
index 45238d7d9..5a7104f97 100644
--- a/Source/WebCore/platform/network/ResourceLoadPriority.h
+++ b/Source/WebCore/platform/network/ResourceLoadPriority.h
@@ -35,8 +35,9 @@ enum ResourceLoadPriority {
     ResourceLoadPriorityLow,
     ResourceLoadPriorityMedium,
     ResourceLoadPriorityHigh,
+    ResourceLoadPriorityVeryHigh,
     ResourceLoadPriorityLowest = ResourceLoadPriorityVeryLow,
-    ResourceLoadPriorityHighest = ResourceLoadPriorityHigh,
+    ResourceLoadPriorityHighest = ResourceLoadPriorityVeryHigh,
 };
 
 }
diff --git a/Source/WebCore/platform/network/ResourceRequestBase.cpp b/Source/WebCore/platform/network/ResourceRequestBase.cpp
index afcb243c6..84a1f3016 100644
--- a/Source/WebCore/platform/network/ResourceRequestBase.cpp
+++ b/Source/WebCore/platform/network/ResourceRequestBase.cpp
@@ -447,7 +447,7 @@ bool ResourceRequestBase::isConditional() const
             m_httpHeaderFields.contains("If-Unmodified-Since"));
 }
 
-void ResourceRequestBase::reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
+void ResourceRequestBase::reportMemoryUsageBase(MemoryObjectInfo* memoryObjectInfo) const
 {
     MemoryClassInfo info(memoryObjectInfo, this, PlatformMemoryTypes::Loader);
     info.addMember(m_url);
diff --git a/Source/WebCore/platform/network/ResourceRequestBase.h b/Source/WebCore/platform/network/ResourceRequestBase.h
index b686bac14..a8ea77cf3 100644
--- a/Source/WebCore/platform/network/ResourceRequestBase.h
+++ b/Source/WebCore/platform/network/ResourceRequestBase.h
@@ -132,8 +132,6 @@ namespace WebCore {
         bool reportRawHeaders() const { return m_reportRawHeaders; }
         void setReportRawHeaders(bool reportRawHeaders) { m_reportRawHeaders = reportRawHeaders; }
 
-        void reportMemoryUsage(MemoryObjectInfo*) const;
-
         static double defaultTimeoutInterval(); // May return 0 when using platform default.
         static void setDefaultTimeoutInterval(double);
 
@@ -169,6 +167,8 @@ namespace WebCore {
         void updatePlatformRequest() const; 
         void updateResourceRequest() const; 
 
+        void reportMemoryUsageBase(MemoryObjectInfo*) const;
+
         // The ResourceRequest subclass may "shadow" this method to compare platform specific fields
         static bool platformCompare(const ResourceRequest&, const ResourceRequest&) { return true; }
 
diff --git a/Source/WebCore/platform/network/blackberry/CredentialBackingStore.cpp b/Source/WebCore/platform/network/blackberry/CredentialBackingStore.cpp
index b08a84110..0d3ec69e9 100644
--- a/Source/WebCore/platform/network/blackberry/CredentialBackingStore.cpp
+++ b/Source/WebCore/platform/network/blackberry/CredentialBackingStore.cpp
@@ -253,32 +253,6 @@ bool CredentialBackingStore::hasLogin(const KURL& url, const ProtectionSpace& pr
     return false;
 }
 
-ProtectionSpace CredentialBackingStore::getProtectionSpace(const KURL& url)
-{
-    ASSERT(m_database.isOpen());
-    ASSERT(m_database.tableExists("logins"));
-
-    if (!m_getLoginByURLStatement)
-        return ProtectionSpace();
-
-    m_getLoginByURLStatement->bindText(1, url.string());
-
-    int result = m_getLoginByURLStatement->step();
-    String username = m_getLoginByURLStatement->getColumnText(0);
-    String password = certMgrWrapper()->isReady() ? "" : m_getLoginByURLStatement->getColumnBlobAsString(1);
-    String host = m_getLoginByURLStatement->getColumnText(2);
-    int port = m_getLoginByURLStatement->getColumnInt(3);
-    int serviceType = m_getLoginByURLStatement->getColumnInt(4);
-    String realm = m_getLoginByURLStatement->getColumnText(5);
-    int authenticationScheme = m_getLoginByURLStatement->getColumnInt(6);
-    m_getLoginByURLStatement->reset();
-    HANDLE_SQL_EXEC_FAILURE(result != SQLResultRow, ProtectionSpace(),
-        "Failed to execute select login info from table logins in getLoginByURL - %i", result);
-
-    return ProtectionSpace (host, port, static_cast<ProtectionSpaceServerType>(serviceType),
-                            realm, static_cast<ProtectionSpaceAuthenticationScheme>(authenticationScheme));
-}
-
 Credential CredentialBackingStore::getLogin(const ProtectionSpace& protectionSpace)
 {
     ASSERT(m_database.isOpen());
diff --git a/Source/WebCore/platform/network/blackberry/CredentialBackingStore.h b/Source/WebCore/platform/network/blackberry/CredentialBackingStore.h
index cc5392480..471a06971 100644
--- a/Source/WebCore/platform/network/blackberry/CredentialBackingStore.h
+++ b/Source/WebCore/platform/network/blackberry/CredentialBackingStore.h
@@ -44,7 +44,6 @@ public:
     bool addLogin(const KURL&, const ProtectionSpace&, const Credential&);
     bool updateLogin(const KURL&, const ProtectionSpace&, const Credential&);
     bool hasLogin(const KURL&, const ProtectionSpace&);
-    ProtectionSpace getProtectionSpace(const KURL&);
     Credential getLogin(const ProtectionSpace&);
     Credential getLogin(const KURL&);
     bool removeLogin(const KURL&, const ProtectionSpace&);
diff --git a/Source/WebCore/platform/network/blackberry/NetworkJob.cpp b/Source/WebCore/platform/network/blackberry/NetworkJob.cpp
index 079fe51ae..3018aa2cd 100644
--- a/Source/WebCore/platform/network/blackberry/NetworkJob.cpp
+++ b/Source/WebCore/platform/network/blackberry/NetworkJob.cpp
@@ -23,6 +23,7 @@
 #include "Chrome.h"
 #include "ChromeClient.h"
 #include "CookieManager.h"
+#include "CredentialBackingStore.h"
 #include "CredentialStorage.h"
 #include "Frame.h"
 #include "FrameLoaderClientBlackBerry.h"
@@ -538,9 +539,7 @@ bool NetworkJob::shouldReleaseClientResource()
 
 bool NetworkJob::shouldNotifyClientFailed() const
 {
-    if (m_handle->firstRequest().targetType() == ResourceRequest::TargetIsXHR)
-        return m_extendedStatusCode < 0;
-    return isError(m_extendedStatusCode) && !m_dataReceived;
+    return m_extendedStatusCode < 0 || (isError(m_extendedStatusCode) && !m_dataReceived);
 }
 
 bool NetworkJob::retryAsFTPDirectory()
@@ -606,6 +605,11 @@ bool NetworkJob::handleRedirect()
     if (!newURL.isValid())
         return false;
 
+    if (newURL.protocolIsData()) {
+        m_extendedStatusCode = BlackBerry::Platform::FilterStream::StatusInvalidRedirectToData;
+        return false;
+    }
+
     ResourceRequest newRequest = m_handle->firstRequest();
     newRequest.setURL(newURL);
     newRequest.setMustHandleInternally(true);
@@ -618,8 +622,12 @@ bool NetworkJob::handleRedirect()
         newRequest.clearHTTPContentType();
     }
 
-    // Do not send existing credentials with the new request.
-    m_handle->getInternal()->m_currentWebChallenge.nullify();
+    if (!m_handle->getInternal()->m_currentWebChallenge.isNull()) {
+        // If this request is challenged, store the credentials now because the credential is correct (otherwise, it won't get here).
+        storeCredentials();
+        // Do not send existing credentials with the new request.
+        m_handle->getInternal()->m_currentWebChallenge.nullify();
+    }
 
     return startNewJobWithRequest(newRequest, true);
 }
@@ -768,8 +776,12 @@ bool NetworkJob::sendRequestWithCredentials(ProtectionSpaceServerType type, Prot
         // Don't overwrite any existing credentials with the empty credential
         if (m_handle->getInternal()->m_currentWebChallenge.isNull())
             m_handle->getInternal()->m_currentWebChallenge = AuthenticationChallenge(protectionSpace, credential, 0, m_response, ResourceError());
-    } else if (!(credential = CredentialStorage::get(protectionSpace)).isEmpty()) {
-        // First search the CredentialStorage.
+    } else if (!(credential = CredentialStorage::get(protectionSpace)).isEmpty()
+#if ENABLE(BLACKBERRY_CREDENTIAL_PERSIST)
+            || !(credential = CredentialStorage::getFromPersistentStorage(protectionSpace)).isEmpty()
+#endif
+            ) {
+        // First search the CredentialStorage and Persistent Credential Storage
         m_handle->getInternal()->m_currentWebChallenge = AuthenticationChallenge(protectionSpace, credential, 0, m_response, ResourceError());
         m_handle->getInternal()->m_currentWebChallenge.setStored(true);
     } else {
@@ -863,6 +875,9 @@ void NetworkJob::purgeCredentials()
 
     CredentialStorage::remove(challenge.protectionSpace());
     challenge.setStored(false);
+#if ENABLE(BLACKBERRY_CREDENTIAL_PERSIST)
+    credentialBackingStore().removeLogin(m_response.url(), challenge.protectionSpace());
+#endif
 }
 
 bool NetworkJob::shouldSendClientData() const
diff --git a/Source/WebCore/platform/network/blackberry/NetworkManager.cpp b/Source/WebCore/platform/network/blackberry/NetworkManager.cpp
index 3d8c54207..18bc1e751 100644
--- a/Source/WebCore/platform/network/blackberry/NetworkManager.cpp
+++ b/Source/WebCore/platform/network/blackberry/NetworkManager.cpp
@@ -20,17 +20,11 @@
 #include "NetworkManager.h"
 
 #include "Chrome.h"
-#if ENABLE(BLACKBERRY_CREDENTIAL_PERSIST)
-#include "CredentialBackingStore.h"
-#endif
 #include "CredentialStorage.h"
 #include "Frame.h"
 #include "FrameLoaderClientBlackBerry.h"
 #include "NetworkJob.h"
 #include "Page.h"
-#if ENABLE(BLACKBERRY_CREDENTIAL_PERSIST)
-#include "ResourceHandleClient.h"
-#endif
 #include "ResourceHandleInternal.h"
 #include "ResourceRequest.h"
 #include "SecurityOrigin.h"
@@ -42,15 +36,7 @@
 
 namespace WebCore {
 
-NetworkManager* NetworkManager::instance()
-{
-    static NetworkManager* sInstance;
-    if (!sInstance) {
-        sInstance = new NetworkManager;
-        ASSERT(sInstance);
-    }
-    return sInstance;
-}
+SINGLETON_INITIALIZER_THREADUNSAFE(NetworkManager)
 
 bool NetworkManager::startJob(int playerId, PassRefPtr<ResourceHandle> job, const Frame& frame, bool defersLoading)
 {
@@ -128,20 +114,6 @@ bool NetworkManager::startJob(int playerId, const String& pageGroupName, PassRef
 
         if (authType != BlackBerry::Platform::NetworkRequest::AuthNone)
             platformRequest.setCredentials(username.utf8().data(), password.utf8().data(), authType);
-    } else if (url.protocolIsInHTTPFamily()) {
-        // For URLs that match the paths of those previously challenged for HTTP Basic authentication,
-        // try and reuse the credential preemptively, as allowed by RFC 2617.
-        Credential credential = CredentialStorage::get(url);
-#if ENABLE(BLACKBERRY_CREDENTIAL_PERSIST)
-        // FIXME: needs to refactor the credentialBackingStore to get credential and protection space at one time.
-        if (credential.isEmpty() && guardJob->client()->shouldUseCredentialStorage(guardJob.get())) {
-            credential = credentialBackingStore().getLogin(url);
-            if (!credential.isEmpty())
-                CredentialStorage::set(credential, credentialBackingStore().getProtectionSpace(url), url);
-        }
-#endif
-        if (!credential.isEmpty())
-            platformRequest.setCredentials(credential.user().utf8().data(), credential.password().utf8().data(), BlackBerry::Platform::NetworkRequest::AuthHTTPBasic);
     }
 
     if (!request.overrideContentType().isEmpty())
diff --git a/Source/WebCore/platform/network/blackberry/NetworkManager.h b/Source/WebCore/platform/network/blackberry/NetworkManager.h
index 956861fd6..af60ab890 100644
--- a/Source/WebCore/platform/network/blackberry/NetworkManager.h
+++ b/Source/WebCore/platform/network/blackberry/NetworkManager.h
@@ -22,6 +22,7 @@
 #include "KURL.h"
 #include "ResourceHandle.h"
 
+#include <BlackBerryPlatformSingleton.h>
 #include <wtf/Vector.h>
 
 namespace BlackBerry {
@@ -36,9 +37,9 @@ namespace WebCore {
 class Frame;
 class NetworkJob;
 
-class NetworkManager {
+class NetworkManager : public BlackBerry::Platform::ThreadUnsafeSingleton<NetworkManager> {
+    SINGLETON_DEFINITION_THREADUNSAFE(NetworkManager)
 public:
-    static NetworkManager* instance();
     void setInitialURL(const KURL& url) { m_initialURL = url; }
     KURL initialURL() { return m_initialURL; }
     bool startJob(int playerId, PassRefPtr<ResourceHandle> job, const Frame&, bool defersLoading);
diff --git a/Source/WebCore/platform/network/blackberry/ResourceHandleBlackBerry.cpp b/Source/WebCore/platform/network/blackberry/ResourceHandleBlackBerry.cpp
index fe0df4e1b..2a4044512 100644
--- a/Source/WebCore/platform/network/blackberry/ResourceHandleBlackBerry.cpp
+++ b/Source/WebCore/platform/network/blackberry/ResourceHandleBlackBerry.cpp
@@ -135,6 +135,7 @@ bool ResourceHandle::willLoadFromCache(ResourceRequest&, Frame*)
 void ResourceHandle::cancel()
 {
     NetworkManager::instance()->stopJob(this);
+    setClient(0);
 }
 
 void ResourceHandle::loadResourceSynchronously(NetworkingContext* context, const ResourceRequest& request, StoredCredentials, ResourceError& error, ResourceResponse& response, Vector<char>& data)
diff --git a/Source/WebCore/platform/network/cf/AuthenticationCF.cpp b/Source/WebCore/platform/network/cf/AuthenticationCF.cpp
index 87a3fab8a..7b1d4fa47 100644
--- a/Source/WebCore/platform/network/cf/AuthenticationCF.cpp
+++ b/Source/WebCore/platform/network/cf/AuthenticationCF.cpp
@@ -119,13 +119,7 @@ CFURLCredentialRef createCF(const Credential& coreCredential)
         return CFURLCredentialCreateWithIdentityAndCertificateArray(kCFAllocatorDefault, coreCredential.identity(), coreCredential.certificates(), persistence);
 #endif
 
-    CFStringRef user = coreCredential.user().createCFString();
-    CFStringRef password = coreCredential.password().createCFString();
-    CFURLCredentialRef result = CFURLCredentialCreate(0, user, password, 0, persistence);
-    CFRelease(user);
-    CFRelease(password);
-
-    return result;
+    return CFURLCredentialCreate(0, coreCredential.user().createCFString().get(), coreCredential.password().createCFString().get(), 0, persistence);
 }
 
 CFURLProtectionSpaceRef createCF(const ProtectionSpace& coreSpace)
@@ -192,13 +186,7 @@ CFURLProtectionSpaceRef createCF(const ProtectionSpace& coreSpace)
         ASSERT_NOT_REACHED();
     }
 
-    CFStringRef host = coreSpace.host().createCFString();
-    CFStringRef realm = coreSpace.realm().createCFString();
-    CFURLProtectionSpaceRef result = CFURLProtectionSpaceCreate(0, host, coreSpace.port(), serverType, realm, scheme);
-    CFRelease(host);
-    CFRelease(realm);
-    
-    return result;
+    return CFURLProtectionSpaceCreate(0, coreSpace.host().createCFString().get(), coreSpace.port(), serverType, coreSpace.realm().createCFString().get(), scheme);
 }
 
 Credential core(CFURLCredentialRef cfCredential)
diff --git a/Source/WebCore/platform/network/cf/CookieJarCFNet.cpp b/Source/WebCore/platform/network/cf/CookieJarCFNet.cpp
index 5d6d73926..10dfbc6a1 100644
--- a/Source/WebCore/platform/network/cf/CookieJarCFNet.cpp
+++ b/Source/WebCore/platform/network/cf/CookieJarCFNet.cpp
@@ -112,7 +112,7 @@ void setCookies(Document* document, const KURL& url, const String& value)
     // cookiesWithResponseHeaderFields doesn't parse cookies without a value
     String cookieString = value.contains('=') ? value : value + "=";
 
-    RetainPtr<CFStringRef> cookieStringCF(AdoptCF, cookieString.createCFString());
+    RetainPtr<CFStringRef> cookieStringCF = cookieString.createCFString();
     RetainPtr<CFDictionaryRef> headerFieldsCF(AdoptCF, CFDictionaryCreate(kCFAllocatorDefault,
         (const void**)&s_setCookieKeyCF, (const void**)&cookieStringCF, 1,
         &kCFTypeDictionaryKeyCallBacks, &kCFTypeDictionaryValueCallBacks));
@@ -216,7 +216,7 @@ void deleteCookie(const Document*, const KURL& url, const String& name)
 
 void getHostnamesWithCookies(HashSet<String>& hostnames)
 {
-    RetainPtr<CFHTTPCookieStorageRef> cookieStorage = currentCFHTTPCookieStorage();
+    RetainPtr<CFHTTPCookieStorageRef> cookieStorage = defaultCFHTTPCookieStorage();
     if (!cookieStorage)
         return;
 
@@ -234,7 +234,7 @@ void getHostnamesWithCookies(HashSet<String>& hostnames)
 
 void deleteCookiesForHostname(const String& hostname)
 {
-    RetainPtr<CFHTTPCookieStorageRef> cookieStorage = currentCFHTTPCookieStorage();
+    RetainPtr<CFHTTPCookieStorageRef> cookieStorage = defaultCFHTTPCookieStorage();
     if (!cookieStorage)
         return;
 
@@ -253,7 +253,7 @@ void deleteCookiesForHostname(const String& hostname)
 
 void deleteAllCookies()
 {
-    RetainPtr<CFHTTPCookieStorageRef> cookieStorage = currentCFHTTPCookieStorage();
+    RetainPtr<CFHTTPCookieStorageRef> cookieStorage = defaultCFHTTPCookieStorage();
     if (!cookieStorage)
         return;
 
diff --git a/Source/WebCore/platform/network/cf/CookieStorageCFNet.cpp b/Source/WebCore/platform/network/cf/CookieStorageCFNet.cpp
index 0e9e373a3..b4fbecd39 100644
--- a/Source/WebCore/platform/network/cf/CookieStorageCFNet.cpp
+++ b/Source/WebCore/platform/network/cf/CookieStorageCFNet.cpp
@@ -28,8 +28,6 @@
 
 #include "CookieStorageCFNet.h"
 
-#if USE(CFNETWORK) || USE(CFURLSTORAGESESSIONS)
-
 #include "ResourceHandle.h"
 #include <wtf/MainThread.h>
 
@@ -46,8 +44,6 @@
 #include "PlatformStrategies.h"
 #endif
 
-#endif
-
 namespace WebCore {
 
 #if PLATFORM(WIN)
@@ -60,8 +56,6 @@ static RetainPtr<CFHTTPCookieStorageRef>& cookieStorageOverride()
 
 #endif
 
-#if USE(CFNETWORK) || USE(CFURLSTORAGESESSIONS)
-
 RetainPtr<CFHTTPCookieStorageRef> currentCFHTTPCookieStorage()
 {
 #if PLATFORM(WIN)
@@ -69,22 +63,36 @@ RetainPtr<CFHTTPCookieStorageRef> currentCFHTTPCookieStorage()
         return override;
 #endif
 
-#if USE(CFNETWORK) || USE(CFURLSTORAGESESSIONS)
     if (CFURLStorageSessionRef session = ResourceHandle::currentStorageSession())
         return RetainPtr<CFHTTPCookieStorageRef>(AdoptCF, wkCopyHTTPCookieStorage(session));
-#endif
 
 #if USE(CFNETWORK)
     return wkGetDefaultHTTPCookieStorage();
 #else
-    // When using NSURLConnection, we also use its default cookie storage.
+    // When using NSURLConnection, we also use its shared cookie storage.
     return 0;
 #endif
 }
 
-#endif // USE(CFNETWORK) || USE(CFURLSTORAGESESSIONS)
+RetainPtr<CFHTTPCookieStorageRef> defaultCFHTTPCookieStorage()
+{
+#if PLATFORM(WIN)
+    if (RetainPtr<CFHTTPCookieStorageRef>& override = cookieStorageOverride())
+        return override;
+#endif
+
+    if (CFURLStorageSessionRef session = ResourceHandle::defaultStorageSession())
+        return RetainPtr<CFHTTPCookieStorageRef>(AdoptCF, wkCopyHTTPCookieStorage(session));
+
+#if USE(CFNETWORK)
+    return wkGetDefaultHTTPCookieStorage();
+#else
+    // When using NSURLConnection, we also use its shared cookie storage.
+    return 0;
+#endif
+}
 
-#if USE(CFNETWORK) && PLATFORM(WIN)
+#if PLATFORM(WIN)
 
 void overrideCookieStorage(CFHTTPCookieStorageRef cookieStorage)
 {
@@ -93,16 +101,6 @@ void overrideCookieStorage(CFHTTPCookieStorageRef cookieStorage)
     cookieStorageOverride().adoptCF(cookieStorage);
 }
 
-void setCookieStoragePrivateBrowsingEnabled(bool)
-{
-    ASSERT(isMainThread());
-
-    // Nothing to do here - we'll just use a private session from ResourceHandle.
-
-    // FIXME: When Private Browsing is enabled, the Private Browsing Cookie Storage should be
-    // observed for changes, not the default Cookie Storage.
-}
-
 static void notifyCookiesChangedOnMainThread(void*)
 {
     ASSERT(isMainThread());
@@ -135,7 +133,7 @@ void startObservingCookieChanges()
     CFRunLoopRef runLoop = cookieStorageObserverRunLoop();
     ASSERT(runLoop);
 
-    RetainPtr<CFHTTPCookieStorageRef> cookieStorage = currentCFHTTPCookieStorage();
+    RetainPtr<CFHTTPCookieStorageRef> cookieStorage = defaultCFHTTPCookieStorage();
     ASSERT(cookieStorage);
 
     CFHTTPCookieStorageScheduleWithRunLoop(cookieStorage.get(), runLoop, kCFRunLoopCommonModes);
@@ -149,13 +147,13 @@ void stopObservingCookieChanges()
     CFRunLoopRef runLoop = cookieStorageObserverRunLoop();
     ASSERT(runLoop);
 
-    RetainPtr<CFHTTPCookieStorageRef> cookieStorage = currentCFHTTPCookieStorage();
+    RetainPtr<CFHTTPCookieStorageRef> cookieStorage = defaultCFHTTPCookieStorage();
     ASSERT(cookieStorage);
 
     CFHTTPCookieStorageRemoveObserver(cookieStorage.get(), runLoop, kCFRunLoopDefaultMode, notifyCookiesChanged, 0);
     CFHTTPCookieStorageUnscheduleFromRunLoop(cookieStorage.get(), runLoop, kCFRunLoopCommonModes);
 }
 
-#endif // USE(CFNETWORK) && PLATFORM(WIN)
+#endif // PLATFORM(WIN)
 
 } // namespace WebCore
diff --git a/Source/WebCore/platform/network/cf/CookieStorageCFNet.h b/Source/WebCore/platform/network/cf/CookieStorageCFNet.h
index 5e7dfd35b..fcf8dea9c 100644
--- a/Source/WebCore/platform/network/cf/CookieStorageCFNet.h
+++ b/Source/WebCore/platform/network/cf/CookieStorageCFNet.h
@@ -26,8 +26,6 @@
 #ifndef CookieStorageCFNet_h
 #define CookieStorageCFNet_h
 
-#if USE(CFNETWORK) || USE(CFURLSTORAGESESSIONS)
-
 #include <wtf/RetainPtr.h>
 
 typedef struct OpaqueCFHTTPCookieStorage*  CFHTTPCookieStorageRef;
@@ -35,6 +33,7 @@ typedef struct OpaqueCFHTTPCookieStorage*  CFHTTPCookieStorageRef;
 namespace WebCore {
 
 RetainPtr<CFHTTPCookieStorageRef> currentCFHTTPCookieStorage(); // Will be null when using shared NSHTTPCookieStorage.
+RetainPtr<CFHTTPCookieStorageRef> defaultCFHTTPCookieStorage(); // Doesn't take current session into account.
 
 #if PLATFORM(WIN)
 // Needed for WebKit1 API only.
@@ -43,6 +42,4 @@ void overrideCookieStorage(CFHTTPCookieStorageRef);
 
 }
 
-#endif // USE(CFNETWORK) || USE(CFURLSTORAGESESSIONS)
-
 #endif // CookieStorageCFNet_h
diff --git a/Source/WebCore/platform/network/cf/DNSCFNet.cpp b/Source/WebCore/platform/network/cf/DNSCFNet.cpp
index 3f901a541..ce1451909 100644
--- a/Source/WebCore/platform/network/cf/DNSCFNet.cpp
+++ b/Source/WebCore/platform/network/cf/DNSCFNet.cpp
@@ -90,12 +90,12 @@ void DNSResolveQueue::platformResolve(const String& hostname)
 {
     ASSERT(isMainThread());
 
-    RetainPtr<CFStringRef> hostnameCF(AdoptCF, hostname.createCFString());
-    RetainPtr<CFHostRef> host(AdoptCF, CFHostCreateWithName(0, hostnameCF.get()));
+    RetainPtr<CFHostRef> host = adoptCF(CFHostCreateWithName(0, hostname.createCFString().get()));
     if (!host) {
         decrementRequestCount();
         return;
     }
+
     CFHostClientContext context = { 0, 0, 0, 0, 0 };
     CFHostRef leakedHost = host.leakRef(); // The host will be released from clientCallback().
     Boolean result = CFHostSetClient(leakedHost, clientCallback, &context);
diff --git a/Source/WebCore/platform/network/cf/FormDataStreamCFNet.cpp b/Source/WebCore/platform/network/cf/FormDataStreamCFNet.cpp
index 3d3e8a3ed..233c8c7be 100644
--- a/Source/WebCore/platform/network/cf/FormDataStreamCFNet.cpp
+++ b/Source/WebCore/platform/network/cf/FormDataStreamCFNet.cpp
@@ -438,7 +438,7 @@ void setHTTPBody(CFMutableURLRequestRef request, PassRefPtr<FormData> prpFormDat
 #endif
 
     // Precompute the content length so NSURLConnection doesn't use chunked mode.
-    long long length = 0;
+    unsigned long long length = 0;
     for (size_t i = 0; i < count; ++i) {
         const FormDataElement& element = formData->elements()[i];
         if (element.m_type == FormDataElement::data)
diff --git a/Source/WebCore/platform/network/cf/LoaderRunLoopCF.cpp b/Source/WebCore/platform/network/cf/LoaderRunLoopCF.cpp
index 3088eb4c8..ef220884c 100644
--- a/Source/WebCore/platform/network/cf/LoaderRunLoopCF.cpp
+++ b/Source/WebCore/platform/network/cf/LoaderRunLoopCF.cpp
@@ -38,18 +38,35 @@ namespace WebCore {
 
 static CFRunLoopRef loaderRunLoopObject = 0;
 
+static Mutex& loaderRunLoopMutex()
+{
+    DEFINE_STATIC_LOCAL(Mutex, mutex, ());
+    return mutex;
+}
+
+static ThreadCondition& loaderRunLoopCondition()
+{
+    DEFINE_STATIC_LOCAL(ThreadCondition, threadCondition, ());
+    return threadCondition;
+}
+
 static void emptyPerform(void*) 
 {
 }
 
 static void runLoaderThread(void*)
 {
-    loaderRunLoopObject = CFRunLoopGetCurrent();
+    {
+        MutexLocker lock(loaderRunLoopMutex());
+        loaderRunLoopObject = CFRunLoopGetCurrent();
+
+        // Must add a source to the run loop to prevent CFRunLoopRun() from exiting.
+        CFRunLoopSourceContext ctxt = {0, (void*)1 /*must be non-null*/, 0, 0, 0, 0, 0, 0, 0, emptyPerform};
+        CFRunLoopSourceRef bogusSource = CFRunLoopSourceCreate(0, 0, &ctxt);
+        CFRunLoopAddSource(loaderRunLoopObject, bogusSource, kCFRunLoopDefaultMode);
 
-    // Must add a source to the run loop to prevent CFRunLoopRun() from exiting.
-    CFRunLoopSourceContext ctxt = {0, (void*)1 /*must be non-NULL*/, 0, 0, 0, 0, 0, 0, 0, emptyPerform};
-    CFRunLoopSourceRef bogusSource = CFRunLoopSourceCreate(0, 0, &ctxt);
-    CFRunLoopAddSource(loaderRunLoopObject, bogusSource, kCFRunLoopDefaultMode);
+        loaderRunLoopCondition().signal();
+    }
 
     SInt32 result;
     do {
@@ -61,17 +78,11 @@ static void runLoaderThread(void*)
 CFRunLoopRef loaderRunLoop()
 {
     ASSERT(isMainThread());
+
+    MutexLocker lock(loaderRunLoopMutex());
     if (!loaderRunLoopObject) {
         createThread(runLoaderThread, 0, "WebCore: CFNetwork Loader");
-        while (!loaderRunLoopObject) {
-            // FIXME: <http://webkit.org/b/55402> - loaderRunLoop() should use synchronization instead of while loop
-#if PLATFORM(WIN)
-            Sleep(10);
-#else
-            struct timespec sleepTime = { 0, 10 * 1000 * 1000 };
-            nanosleep(&sleepTime, 0);
-#endif
-        }
+        loaderRunLoopCondition().wait(loaderRunLoopMutex());
     }
     return loaderRunLoopObject;
 }
diff --git a/Source/WebCore/platform/network/cf/ResourceErrorCF.cpp b/Source/WebCore/platform/network/cf/ResourceErrorCF.cpp
index 354fd2758..5895ed993 100644
--- a/Source/WebCore/platform/network/cf/ResourceErrorCF.cpp
+++ b/Source/WebCore/platform/network/cf/ResourceErrorCF.cpp
@@ -145,13 +145,11 @@ CFErrorRef ResourceError::cfError() const
     if (!m_platformError) {
         RetainPtr<CFMutableDictionaryRef> userInfo(AdoptCF, CFDictionaryCreateMutable(0, 0, &kCFTypeDictionaryKeyCallBacks, &kCFTypeDictionaryValueCallBacks));
 
-        if (!m_localizedDescription.isEmpty()) {
-            RetainPtr<CFStringRef> localizedDescriptionString(AdoptCF, m_localizedDescription.createCFString());
-            CFDictionarySetValue(userInfo.get(), kCFErrorLocalizedDescriptionKey, localizedDescriptionString.get());
-        }
+        if (!m_localizedDescription.isEmpty())
+            CFDictionarySetValue(userInfo.get(), kCFErrorLocalizedDescriptionKey, m_localizedDescription.createCFString().get());
 
         if (!m_failingURL.isEmpty()) {
-            RetainPtr<CFStringRef> failingURLString(AdoptCF, m_failingURL.createCFString());
+            RetainPtr<CFStringRef> failingURLString = m_failingURL.createCFString();
             CFDictionarySetValue(userInfo.get(), failingURLStringKey, failingURLString.get());
             RetainPtr<CFURLRef> url(AdoptCF, CFURLCreateWithString(0, failingURLString.get(), 0));
             CFDictionarySetValue(userInfo.get(), failingURLKey, url.get());
@@ -162,8 +160,7 @@ CFErrorRef ResourceError::cfError() const
             wkSetSSLPeerCertificateData(userInfo.get(), m_certificate.get());
 #endif
         
-        RetainPtr<CFStringRef> domainString(AdoptCF, m_domain.createCFString());
-        m_platformError.adoptCF(CFErrorCreate(0, domainString.get(), m_errorCode, userInfo.get()));
+        m_platformError = adoptCF(CFErrorCreate(0, m_domain.createCFString().get(), m_errorCode, userInfo.get()));
     }
 
     return m_platformError.get();
diff --git a/Source/WebCore/platform/network/cf/ResourceHandleCFNet.cpp b/Source/WebCore/platform/network/cf/ResourceHandleCFNet.cpp
index 01e8b8ae5..92c7d73b1 100644
--- a/Source/WebCore/platform/network/cf/ResourceHandleCFNet.cpp
+++ b/Source/WebCore/platform/network/cf/ResourceHandleCFNet.cpp
@@ -131,7 +131,7 @@ static HashMap<String, RetainPtr<CFDataRef> >& clientCerts()
 
 static void setDefaultMIMEType(CFURLResponseRef response)
 {
-    static CFStringRef defaultMIMETypeString = defaultMIMEType().createCFString();
+    static CFStringRef defaultMIMETypeString = defaultMIMEType().createCFString().leakRef();
     
     CFURLResponseSetMIMEType(response, defaultMIMETypeString);
 }
@@ -161,13 +161,11 @@ static CFURLRequestRef willSendRequest(CFURLConnectionRef conn, CFURLRequestRef
     if (cfRedirectResponse) {
         CFHTTPMessageRef httpMessage = CFURLResponseGetHTTPResponse(cfRedirectResponse);
         if (httpMessage && CFHTTPMessageGetResponseStatusCode(httpMessage) == 307) {
-            RetainPtr<CFStringRef> lastHTTPMethod(AdoptCF, handle->lastHTTPMethod().createCFString());
-            RetainPtr<CFStringRef> newMethod(AdoptCF, CFURLRequestCopyHTTPRequestMethod(cfRequest));
+            RetainPtr<CFStringRef> lastHTTPMethod = handle->lastHTTPMethod().createCFString();
+            RetainPtr<CFStringRef> newMethod = adoptCF(CFURLRequestCopyHTTPRequestMethod(cfRequest));
             if (CFStringCompareWithOptions(lastHTTPMethod.get(), newMethod.get(), CFRangeMake(0, CFStringGetLength(lastHTTPMethod.get())), kCFCompareCaseInsensitive)) {
                 RetainPtr<CFMutableURLRequestRef> mutableRequest(AdoptCF, CFURLRequestCreateMutableCopy(0, cfRequest));
-#if USE(CFURLSTORAGESESSIONS)
                 wkSetRequestStorageSession(ResourceHandle::currentStorageSession(), mutableRequest.get());
-#endif
                 CFURLRequestSetHTTPRequestMethod(mutableRequest.get(), lastHTTPMethod.get());
 
                 FormData* body = handle->firstRequest().httpBody();
@@ -175,9 +173,8 @@ static CFURLRequestRef willSendRequest(CFURLConnectionRef conn, CFURLRequestRef
                     WebCore::setHTTPBody(mutableRequest.get(), body);
 
                 String originalContentType = handle->firstRequest().httpContentType();
-                RetainPtr<CFStringRef> originalContentTypeCF(AdoptCF, originalContentType.createCFString());
                 if (!originalContentType.isEmpty())
-                    CFURLRequestSetHTTPHeaderFieldValue(mutableRequest.get(), CFSTR("Content-Type"), originalContentTypeCF.get());
+                    CFURLRequestSetHTTPHeaderFieldValue(mutableRequest.get(), CFSTR("Content-Type"), originalContentType.createCFString().get());
 
                 request = mutableRequest.get();
             }
@@ -234,7 +231,7 @@ static void didReceiveResponse(CFURLConnectionRef conn, CFURLResponseRef cfRespo
     handle->client()->didReceiveResponse(handle, cfResponse);
 }
 
-#if HAVE(NETWORK_CFDATA_ARRAY_CALLBACK)
+#if USE(NETWORK_CFDATA_ARRAY_CALLBACK)
 static void didReceiveDataArray(CFURLConnectionRef conn, CFArrayRef dataArray, const void* clientInfo)
 {
 #if LOG_DISABLED
@@ -343,20 +340,12 @@ static CFCachedURLResponseRef willCacheResponse(CFURLConnectionRef, CFCachedURLR
         handle->client()->willCacheResponse(handle, policy);
 
     if (static_cast<CFURLCacheStoragePolicy>(policy) != CFCachedURLResponseGetStoragePolicy(cachedResponse)) {
-#if HAVE(NETWORK_CFDATA_ARRAY_CALLBACK)
         RetainPtr<CFArrayRef> receiverData(AdoptCF, CFCachedURLResponseCopyReceiverDataArray(cachedResponse));
         cachedResponse = CFCachedURLResponseCreateWithDataArray(kCFAllocatorDefault,
                                                                 wrappedResponse,
                                                                 receiverData.get(),
                                                                 CFCachedURLResponseGetUserInfo(cachedResponse),
                                                                 static_cast<CFURLCacheStoragePolicy>(policy));
-#else
-        cachedResponse = CFCachedURLResponseCreateWithUserInfo(kCFAllocatorDefault, 
-                                                               wrappedResponse,
-                                                               CFCachedURLResponseGetReceiverData(cachedResponse),
-                                                               CFCachedURLResponseGetUserInfo(cachedResponse), 
-                                                               static_cast<CFURLCacheStoragePolicy>(policy));
-#endif
     } else
         CFRetain(cachedResponse);
 
@@ -406,9 +395,7 @@ ResourceHandle::~ResourceHandle()
 static CFURLRequestRef makeFinalRequest(const ResourceRequest& request, bool shouldContentSniff)
 {
     CFMutableURLRequestRef newRequest = CFURLRequestCreateMutableCopy(kCFAllocatorDefault, request.cfURLRequest());
-#if USE(CFURLSTORAGESESSIONS)
     wkSetRequestStorageSession(ResourceHandle::currentStorageSession(), newRequest);
-#endif
     
     if (!shouldContentSniff)
         wkSetCFURLRequestShouldContentSniff(newRequest, false);
@@ -500,11 +487,19 @@ void ResourceHandle::createCFURLConnection(bool shouldUseCredentialStorage, bool
 
     RetainPtr<CFURLRequestRef> request(AdoptCF, makeFinalRequest(firstRequest(), shouldContentSniff));
 
-#if HAVE(NETWORK_CFDATA_ARRAY_CALLBACK) && USE(PROTECTION_SPACE_AUTH_CALLBACK)
-    CFURLConnectionClient_V6 client = { 6, this, 0, 0, 0, WebCore::willSendRequest, didReceiveResponse, didReceiveData, 0, didFinishLoading, didFail, willCacheResponse, didReceiveChallenge, didSendBodyData, shouldUseCredentialStorageCallback, 0, canRespondToProtectionSpace, 0, didReceiveDataArray};
+    CFURLConnectionClient_V6 client = { 6, this, 0, 0, 0, WebCore::willSendRequest, didReceiveResponse, didReceiveData, 0, didFinishLoading, didFail, willCacheResponse, didReceiveChallenge, didSendBodyData, shouldUseCredentialStorageCallback, 0,
+#if USE(PROTECTION_SPACE_AUTH_CALLBACK)
+        canRespondToProtectionSpace,
 #else
-    CFURLConnectionClient_V3 client = { 3, this, 0, 0, 0, WebCore::willSendRequest, didReceiveResponse, didReceiveData, 0, didFinishLoading, didFail, willCacheResponse, didReceiveChallenge, didSendBodyData, shouldUseCredentialStorageCallback, 0};
+        0,
 #endif
+        0,
+#if USE(NETWORK_CFDATA_ARRAY_CALLBACK)
+        didReceiveDataArray
+#else 
+        0
+#endif
+    };
     RetainPtr<CFDictionaryRef> connectionProperties(AdoptCF, createConnectionProperties(shouldUseCredentialStorage));
 
     d->m_connection.adoptCF(CFURLConnectionCreateWithProperties(0, request.get(), reinterpret_cast<CFURLConnectionClient*>(&client), connectionProperties.get()));
@@ -571,9 +566,7 @@ void ResourceHandle::willSendRequest(ResourceRequest& request, const ResourceRes
         }
     }
 
-#if USE(CFURLSTORAGESESSIONS)
      request.setStorageSession(ResourceHandle::currentStorageSession());
-#endif
 
     client()->willSendRequest(this, request, redirectResponse);
 }
@@ -607,10 +600,7 @@ void ResourceHandle::didReceiveAuthenticationChallenge(const AuthenticationChall
 #endif
 
     if (!d->m_user.isNull() && !d->m_pass.isNull()) {
-        RetainPtr<CFStringRef> user(AdoptCF, d->m_user.createCFString());
-        RetainPtr<CFStringRef> pass(AdoptCF, d->m_pass.createCFString());
-        RetainPtr<CFURLCredentialRef> credential(AdoptCF,
-            CFURLCredentialCreate(kCFAllocatorDefault, user.get(), pass.get(), 0, kCFURLCredentialPersistenceNone));
+        RetainPtr<CFURLCredentialRef> credential = adoptCF(CFURLCredentialCreate(kCFAllocatorDefault, d->m_user.createCFString().get(), d->m_pass.createCFString().get(), 0, kCFURLCredentialPersistenceNone));
         
         KURL urlToStore;
         if (challenge.failureResponse().httpStatusCode() == 401)
@@ -915,7 +905,7 @@ bool WebCoreSynchronousLoaderClient::canAuthenticateAgainstProtectionSpace(Resou
 
 #endif // USE(CFNETWORK)
 
-#if HAVE(NETWORK_CFDATA_ARRAY_CALLBACK)
+#if USE(NETWORK_CFDATA_ARRAY_CALLBACK)
 void ResourceHandle::handleDataArray(CFArrayRef dataArray)
 {
     ASSERT(client());
@@ -948,8 +938,6 @@ void ResourceHandle::handleDataArray(CFArrayRef dataArray)
 }
 #endif
 
-#if USE(CFURLSTORAGESESSIONS)
-
 RetainPtr<CFURLStorageSessionRef> ResourceHandle::createPrivateBrowsingStorageSession(CFStringRef identifier)
 {
 #if PLATFORM(WIN)
@@ -1005,7 +993,7 @@ void ResourceHandle::setPrivateBrowsingEnabled(bool enabled)
         return;
 
     String base = privateBrowsingStorageSessionIdentifierBase().isNull() ? privateBrowsingStorageSessionIdentifierDefaultBase() : privateBrowsingStorageSessionIdentifierBase();
-    RetainPtr<CFStringRef> cfIdentifier(AdoptCF, String(base + ".PrivateBrowsing").createCFString());
+    RetainPtr<CFStringRef> cfIdentifier = String(base + ".PrivateBrowsing").createCFString();
 
     privateStorageSession() = createPrivateBrowsingStorageSession(cfIdentifier.get());
 }
@@ -1029,7 +1017,5 @@ String ResourceHandle::privateBrowsingStorageSessionIdentifierDefaultBase()
 
 #endif // PLATFORM(WIN)
 
-#endif // USE(CFURLSTORAGESESSIONS)
-
 } // namespace WebCore
 
diff --git a/Source/WebCore/platform/network/cf/ResourceRequest.h b/Source/WebCore/platform/network/cf/ResourceRequest.h
index 64be955f6..5e3724c37 100644
--- a/Source/WebCore/platform/network/cf/ResourceRequest.h
+++ b/Source/WebCore/platform/network/cf/ResourceRequest.h
@@ -36,9 +36,7 @@ typedef const struct _CFURLRequest* CFURLRequestRef;
 
 OBJC_CLASS NSURLRequest;
 
-#if USE(CFURLSTORAGESESSIONS) && PLATFORM(MAC) && !PLATFORM(IOS) && __MAC_OS_X_VERSION_MIN_REQUIRED <= 1060
-typedef struct __CFURLStorageSession* CFURLStorageSessionRef;
-#elif USE(CFURLSTORAGESESSIONS)
+#if PLATFORM(MAC) || USE(CFNETWORK)
 typedef const struct __CFURLStorageSession* CFURLStorageSessionRef;
 #endif
 
@@ -96,7 +94,7 @@ namespace WebCore {
         NSURLRequest *nsURLRequest() const;
 #endif
 
-#if USE(CFURLSTORAGESESSIONS)
+#if PLATFORM(MAC) || USE(CFNETWORK)
         void setStorageSession(CFURLStorageSessionRef);
 #endif
 
diff --git a/Source/WebCore/platform/network/cf/ResourceRequestCFNet.cpp b/Source/WebCore/platform/network/cf/ResourceRequestCFNet.cpp
index 8cff87ca0..9fc8f3da5 100644
--- a/Source/WebCore/platform/network/cf/ResourceRequestCFNet.cpp
+++ b/Source/WebCore/platform/network/cf/ResourceRequestCFNet.cpp
@@ -118,14 +118,8 @@ static inline void setHeaderFields(CFMutableURLRequestRef request, const HTTPHea
             CFURLRequestSetHTTPHeaderFieldValue(request, oldHeaderFieldNames[i], 0);
     }
 
-    HTTPHeaderMap::const_iterator end = requestHeaders.end();
-    for (HTTPHeaderMap::const_iterator it = requestHeaders.begin(); it != end; ++it) {
-        CFStringRef key = it->key.createCFString();
-        CFStringRef value = it->value.createCFString();
-        CFURLRequestSetHTTPHeaderFieldValue(request, key, value);
-        CFRelease(key);
-        CFRelease(value);
-    }
+    for (HTTPHeaderMap::const_iterator it = requestHeaders.begin(), end = requestHeaders.end(); it != end; ++it)
+        CFURLRequestSetHTTPHeaderFieldValue(request, it->key.string().createCFString().get(), it->value.createCFString().get());
 }
 
 void ResourceRequest::doUpdatePlatformRequest()
@@ -142,12 +136,9 @@ void ResourceRequest::doUpdatePlatformRequest()
         CFURLRequestSetTimeoutInterval(cfRequest, timeoutInterval());
     } else
         cfRequest = CFURLRequestCreateMutable(0, url.get(), (CFURLRequestCachePolicy)cachePolicy(), timeoutInterval(), firstPartyForCookies.get());
-#if USE(CFURLSTORAGESESSIONS)
     wkSetRequestStorageSession(ResourceHandle::currentStorageSession(), cfRequest);
-#endif
 
-    RetainPtr<CFStringRef> requestMethod(AdoptCF, httpMethod().createCFString());
-    CFURLRequestSetHTTPRequestMethod(cfRequest, requestMethod.get());
+    CFURLRequestSetHTTPRequestMethod(cfRequest, httpMethod().createCFString().get());
 
     if (httpPipeliningEnabled())
         wkSetHTTPPipeliningPriority(cfRequest, toHTTPPipeliningPriority(m_priority));
@@ -164,7 +155,7 @@ void ResourceRequest::doUpdatePlatformRequest()
     unsigned fallbackCount = m_responseContentDispositionEncodingFallbackArray.size();
     RetainPtr<CFMutableArrayRef> encodingFallbacks(AdoptCF, CFArrayCreateMutable(kCFAllocatorDefault, fallbackCount, 0));
     for (unsigned i = 0; i != fallbackCount; ++i) {
-        RetainPtr<CFStringRef> encodingName(AdoptCF, m_responseContentDispositionEncodingFallbackArray[i].createCFString());
+        RetainPtr<CFStringRef> encodingName = m_responseContentDispositionEncodingFallbackArray[i].createCFString();
         CFStringEncoding encoding = CFStringConvertIANACharSetNameToEncoding(encodingName.get());
         if (encoding != kCFStringEncodingInvalidId)
             CFArrayAppendValue(encodingFallbacks.get(), reinterpret_cast<const void*>(encoding));
@@ -231,8 +222,6 @@ void ResourceRequest::doUpdateResourceRequest()
     m_httpBody = httpBodyFromRequest(m_cfRequest.get());
 }
 
-#if USE(CFURLSTORAGESESSIONS)
-
 void ResourceRequest::setStorageSession(CFURLStorageSessionRef storageSession)
 {
     CFMutableURLRequestRef cfRequest = CFURLRequestCreateMutableCopy(0, m_cfRequest.get());
@@ -243,8 +232,6 @@ void ResourceRequest::setStorageSession(CFURLStorageSessionRef storageSession)
 #endif
 }
 
-#endif
-
 #if PLATFORM(MAC)
 void ResourceRequest::applyWebArchiveHackForMail()
 {
@@ -272,7 +259,6 @@ unsigned initializeMaximumHTTPConnectionCountPerHost()
     // Always set the connection count per host, even when pipelining.
     unsigned maximumHTTPConnectionCountPerHost = wkInitializeMaximumHTTPConnectionCountPerHost(preferredConnectionCount);
 
-#if USE(CFNETWORK) || PLATFORM(MAC) && __MAC_OS_X_VERSION_MIN_REQUIRED >= 1070
     static const unsigned unlimitedConnectionCount = 10000;
 
     Boolean keyExistsAndHasValidFormat = false;
@@ -289,7 +275,6 @@ unsigned initializeMaximumHTTPConnectionCountPerHost()
         // When pipelining do not rate-limit requests sent from WebCore since CFNetwork handles that.
         return unlimitedConnectionCount;
     }
-#endif
 
     return maximumHTTPConnectionCountPerHost;
 }
diff --git a/Source/WebCore/platform/network/cf/ResourceRequestCFNet.h b/Source/WebCore/platform/network/cf/ResourceRequestCFNet.h
index 987508fe1..919b23658 100644
--- a/Source/WebCore/platform/network/cf/ResourceRequestCFNet.h
+++ b/Source/WebCore/platform/network/cf/ResourceRequestCFNet.h
@@ -54,6 +54,8 @@ inline ResourceLoadPriority toResourceLoadPriority(int priority)
         return ResourceLoadPriorityMedium;
     case 3:
         return ResourceLoadPriorityHigh;
+    case 4:
+        return ResourceLoadPriorityVeryHigh;
     default:
         ASSERT_NOT_REACHED();
         return ResourceLoadPriorityLowest;
@@ -73,6 +75,8 @@ inline int toHTTPPipeliningPriority(ResourceLoadPriority priority)
         return 2;
     case ResourceLoadPriorityHigh:
         return 3;
+    case ResourceLoadPriorityVeryHigh:
+        return 4;
     }
 
     ASSERT_NOT_REACHED();
diff --git a/Source/WebCore/platform/network/cf/ResourceResponseCFNet.cpp b/Source/WebCore/platform/network/cf/ResourceResponseCFNet.cpp
index a45beedc4..95508363a 100644
--- a/Source/WebCore/platform/network/cf/ResourceResponseCFNet.cpp
+++ b/Source/WebCore/platform/network/cf/ResourceResponseCFNet.cpp
@@ -51,9 +51,7 @@ CFURLResponseRef ResourceResponse::cfURLResponse() const
 {
     if (!m_cfResponse && !m_isNull) {
         RetainPtr<CFURLRef> url(AdoptCF, m_url.createCFURL());
-        RetainPtr<CFStringRef> mimeType(AdoptCF, m_mimeType.createCFString());
-        RetainPtr<CFStringRef> textEncodingName(AdoptCF, m_textEncodingName.createCFString());
-        m_cfResponse.adoptCF(CFURLResponseCreate(0, url.get(), mimeType.get(), m_expectedContentLength, textEncodingName.get(), kCFURLCacheStorageAllowed));
+        m_cfResponse.adoptCF(CFURLResponseCreate(0, url.get(), m_mimeType.createCFString().get(), m_expectedContentLength, m_textEncodingName.createCFString().get(), kCFURLCacheStorageAllowed));
     }
 
     return m_cfResponse.get();
diff --git a/Source/WebCore/platform/network/cf/SocketStreamHandleCFNet.cpp b/Source/WebCore/platform/network/cf/SocketStreamHandleCFNet.cpp
index d86c76bc6..4a7cd902a 100644
--- a/Source/WebCore/platform/network/cf/SocketStreamHandleCFNet.cpp
+++ b/Source/WebCore/platform/network/cf/SocketStreamHandleCFNet.cpp
@@ -269,7 +269,7 @@ void SocketStreamHandle::createStreams()
     if (m_connectionType == Unknown)
         return;
 
-    RetainPtr<CFStringRef> host(AdoptCF, m_url.host().createCFString());
+    RetainPtr<CFStringRef> host = m_url.host().createCFString();
 
     // Creating streams to final destination, not to proxy.
     CFReadStreamRef readStream = 0;
@@ -359,12 +359,10 @@ void SocketStreamHandle::addCONNECTCredentials(CFHTTPMessageRef proxyResponse)
     String password;
     if (!m_sentStoredCredentials && getStoredCONNECTProxyCredentials(protectionSpace, login, password)) {
         // Try to apply stored credentials, if we haven't tried those already.
-        RetainPtr<CFStringRef> loginCF(AdoptCF, login.createCFString());
-        RetainPtr<CFStringRef> passwordCF(AdoptCF, password.createCFString());
-        // Creating a temporary request to make CFNetwork apply credentials to it. Unfortunately, this cannot work with NTLM authentication.
+        // Create a temporary request to make CFNetwork apply credentials to it. Unfortunately, this cannot work with NTLM authentication.
         RetainPtr<CFHTTPMessageRef> dummyRequest(AdoptCF, CFHTTPMessageCreateRequest(0, CFSTR("GET"), m_httpsURL.get(), kCFHTTPVersion1_1));
 
-        Boolean appliedCredentials = CFHTTPMessageApplyCredentials(dummyRequest.get(), authentication.get(), loginCF.get(), passwordCF.get(), 0);
+        Boolean appliedCredentials = CFHTTPMessageApplyCredentials(dummyRequest.get(), authentication.get(), login.createCFString().get(), password.createCFString().get(), 0);
         ASSERT_UNUSED(appliedCredentials, appliedCredentials);
 
         RetainPtr<CFStringRef> proxyAuthorizationString(AdoptCF, CFHTTPMessageCopyHeaderFieldValue(dummyRequest.get(), CFSTR("Proxy-Authorization")));
@@ -389,7 +387,7 @@ void SocketStreamHandle::addCONNECTCredentials(CFHTTPMessageRef proxyResponse)
 CFStringRef SocketStreamHandle::copyCFStreamDescription(void* info)
 {
     SocketStreamHandle* handle = static_cast<SocketStreamHandle*>(info);
-    return String("WebKit socket stream, " + handle->m_url.string()).createCFString();
+    return String("WebKit socket stream, " + handle->m_url.string()).createCFString().leakRef();
 }
 
 struct MainThreadEventCallbackInfo {
diff --git a/Source/WebCore/platform/network/chromium/ResourceRequest.cpp b/Source/WebCore/platform/network/chromium/ResourceRequest.cpp
index 2541de769..845bcb3da 100644
--- a/Source/WebCore/platform/network/chromium/ResourceRequest.cpp
+++ b/Source/WebCore/platform/network/chromium/ResourceRequest.cpp
@@ -26,6 +26,8 @@
 #include "config.h"
 #include "ResourceRequest.h"
 
+#include "PlatformMemoryInstrumentation.h"
+
 namespace WebCore {
 
 // This is used by the loader to control the number of issued parallel load requests. 
@@ -58,4 +60,11 @@ void ResourceRequest::doPlatformAdopt(PassOwnPtr<CrossThreadResourceRequestData>
     m_targetType = data->m_targetType;
 }
 
+void ResourceRequest::reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
+{
+    MemoryClassInfo info(memoryObjectInfo, this, PlatformMemoryTypes::Loader);
+    ResourceRequestBase::reportMemoryUsageBase(memoryObjectInfo);
+    info.addMember(m_extraData);
+}
+
 } // namespace WebCore
diff --git a/Source/WebCore/platform/network/chromium/ResourceRequest.h b/Source/WebCore/platform/network/chromium/ResourceRequest.h
index 7ea61a888..f5bb0b372 100644
--- a/Source/WebCore/platform/network/chromium/ResourceRequest.h
+++ b/Source/WebCore/platform/network/chromium/ResourceRequest.h
@@ -140,6 +140,8 @@ namespace WebCore {
         TargetType targetType() const { return m_targetType; }
         void setTargetType(TargetType type) { m_targetType = type; }
 
+        void reportMemoryUsage(MemoryObjectInfo*) const;
+
     private:
         friend class ResourceRequestBase;
 
diff --git a/Source/WebCore/platform/network/curl/CookieJarCurl.cpp b/Source/WebCore/platform/network/curl/CookieJarCurl.cpp
index 8e802c3a0..b522dbc0b 100644
--- a/Source/WebCore/platform/network/curl/CookieJarCurl.cpp
+++ b/Source/WebCore/platform/network/curl/CookieJarCurl.cpp
@@ -61,13 +61,6 @@ void deleteCookie(const Document*, const KURL&, const String&)
     // FIXME: Not yet implemented
 }
 
-#if !PLATFORM(EFL)
-void setCookieStoragePrivateBrowsingEnabled(bool enabled)
-{
-    // FIXME: Not yet implemented
-}
-#endif
-
 void getHostnamesWithCookies(HashSet<String>& hostnames)
 {
     // FIXME: Not yet implemented
diff --git a/Source/WebCore/platform/network/gtk/CredentialBackingStore.cpp b/Source/WebCore/platform/network/gtk/CredentialBackingStore.cpp
new file mode 100644
index 000000000..e4d1baf20
--- /dev/null
+++ b/Source/WebCore/platform/network/gtk/CredentialBackingStore.cpp
@@ -0,0 +1,108 @@
+/*
+ * Copyright (C) 2012 Igalia S.L.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY IGALIA S.L. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "CredentialBackingStore.h"
+
+#define SECRET_WITH_UNSTABLE 1
+#define SECRET_API_SUBJECT_TO_CHANGE 1
+#include "AuthenticationChallenge.h"
+#include "GRefPtrGtk.h"
+#include <glib/gi18n-lib.h>
+#include <libsecret/secret.h>
+#include <libsoup/soup.h>
+#include <wtf/gobject/GOwnPtr.h>
+#include <wtf/text/CString.h>
+
+namespace WebCore {
+
+CredentialBackingStore& credentialBackingStore()
+{
+    DEFINE_STATIC_LOCAL(CredentialBackingStore, backingStore, ());
+    return backingStore;
+}
+
+static GRefPtr<GHashTable> createAttributeHashTableFromChallenge(const AuthenticationChallenge& challenge, const Credential& credential = Credential())
+{
+    SoupURI* uri = soup_message_get_uri(challenge.soupMessage());
+    GRefPtr<GHashTable> attributes = adoptGRef(secret_attributes_build(
+        SECRET_SCHEMA_COMPAT_NETWORK,
+        "domain", soup_auth_get_realm(challenge.soupAuth()),
+        "server", uri->host,
+        "protocol", uri->scheme,
+        "authtype", soup_auth_get_scheme_name(challenge.soupAuth()),
+        "port", uri->port,
+        NULL));
+    if (credential.isEmpty())
+        return attributes;
+
+    g_hash_table_insert(attributes.get(), g_strdup("user"), g_strdup(credential.user().utf8().data()));
+    return attributes;
+}
+
+Credential CredentialBackingStore::credentialForChallenge(const AuthenticationChallenge& challenge)
+{
+    GOwnPtr<GList> elements(secret_service_search_sync(
+        0, // The default SecretService.
+        SECRET_SCHEMA_COMPAT_NETWORK,
+        createAttributeHashTableFromChallenge(challenge).get(),
+        static_cast<SecretSearchFlags>(SECRET_SEARCH_UNLOCK | SECRET_SEARCH_LOAD_SECRETS), // The default behavior is to only return the most recent item.
+        0, // cancellable
+        0)); // error
+    if (!elements || !elements->data)
+        return Credential();
+
+    GRefPtr<SecretItem> secretItem = adoptGRef(static_cast<SecretItem*>(elements->data));
+    GRefPtr<GHashTable> attributes = adoptGRef(secret_item_get_attributes(secretItem.get()));
+    String user = String::fromUTF8(static_cast<const char*>(g_hash_table_lookup(attributes.get(), "user")));
+    if (user.isEmpty())
+        return Credential();
+
+    size_t length;
+    GRefPtr<SecretValue> secretValue = adoptGRef(secret_item_get_secret(secretItem.get()));
+    const char* passwordData = secret_value_get(secretValue.get(), &length);
+    String password = String::fromUTF8(passwordData, length);
+
+    return Credential(user, password, CredentialPersistencePermanent);
+}
+
+void CredentialBackingStore::storeCredentialsForChallenge(const AuthenticationChallenge& challenge, const Credential& credential)
+{
+    CString utf8Password = credential.password().utf8();
+    GRefPtr<SecretValue> newSecretValue = adoptGRef(secret_value_new(utf8Password.data(), utf8Password.length(), "text/plain"));
+
+    secret_service_store(
+        0, // The default SecretService.
+        SECRET_SCHEMA_COMPAT_NETWORK,
+        createAttributeHashTableFromChallenge(challenge, credential).get(),
+        SECRET_COLLECTION_DEFAULT,
+        _("WebKitGTK+ password"),
+        newSecretValue.get(),
+        0, // cancellable
+        0, // callback
+        0); // data
+}
+
+} // namespace WebCore
diff --git a/Source/WebCore/platform/efl/SharedBufferEfl.cpp b/Source/WebCore/platform/network/gtk/CredentialBackingStore.h
index 8db44a654..383dafcf1 100644
--- a/Source/WebCore/platform/efl/SharedBufferEfl.cpp
+++ b/Source/WebCore/platform/network/gtk/CredentialBackingStore.h
@@ -1,8 +1,5 @@
 /*
- * Copyright (C) 2008 Holger Hans Peter Freyther
- *               2008 Kenneth Rohde Christiansen
- *               2009-2010 ProFUSION embedded systems
- *               2009-2010 Samsung Electronics
+ * Copyright (C) 2012 Igalia S.L.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -13,7 +10,7 @@
  *    notice, this list of conditions and the following disclaimer in the
  *    documentation and/or other materials provided with the distribution.
  *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * THIS SOFTWARE IS PROVIDED BY IGALIA S.L. ``AS IS'' AND ANY
  * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
@@ -26,37 +23,30 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#include "config.h"
-#include "SharedBuffer.h"
+#ifndef CredentialBackingStore_h
+#define CredentialBackingStore_h
 
-#include <stdio.h>
-#include <sys/stat.h>
-#include <sys/types.h>
-#include <unistd.h>
-#include <wtf/text/CString.h>
+#include "Credential.h"
 
 namespace WebCore {
 
-PassRefPtr<SharedBuffer> SharedBuffer::createWithContentsOfFile(const String& filePath)
-{
-    if (filePath.isEmpty())
-        return 0;
+class AuthenticationChallenge;
 
-    FILE* file = fopen(filePath.utf8().data(), "rb");
-    if (!file)
-        return 0;
+class CredentialBackingStore {
+WTF_MAKE_NONCOPYABLE(CredentialBackingStore);
+public:
+    friend CredentialBackingStore& credentialBackingStore();
+    virtual ~CredentialBackingStore() { }
 
-    struct stat fileStat;
-    if (fstat(fileno(file), &fileStat)) {
-        fclose(file);
-        return 0;
-    }
+    Credential credentialForChallenge(const AuthenticationChallenge&);
+    void storeCredentialsForChallenge(const AuthenticationChallenge&, const Credential&);
 
-    Vector<char> buffer(fileStat.st_size);
-    const size_t bytesRead = fread(buffer.data(), 1, buffer.size(), file);
-    fclose(file);
+private:
+    CredentialBackingStore() { }
+};
 
-    return (bytesRead == buffer.size()) ? SharedBuffer::adoptVector(buffer) : 0;
-}
+CredentialBackingStore& credentialBackingStore();
 
 } // namespace WebCore
+
+#endif // CredentialBackingStore_h
diff --git a/Source/WebCore/platform/network/mac/CookieStorageMac.mm b/Source/WebCore/platform/network/mac/CookieStorageMac.mm
index 1de6888a2..8c25211cf 100644
--- a/Source/WebCore/platform/network/mac/CookieStorageMac.mm
+++ b/Source/WebCore/platform/network/mac/CookieStorageMac.mm
@@ -77,25 +77,6 @@ using namespace WebCore;
 
 namespace WebCore {
 
-void setCookieStoragePrivateBrowsingEnabled(bool enabled)
-{
-#if !PLATFORM(IOS) && __MAC_OS_X_VERSION_MIN_REQUIRED == 1060 && USE(CFURLSTORAGESESSIONS)
-    // Don't call wkSetCookieStoragePrivateBrowsingEnabled() when cookie storage is set up via sessions.
-    // That would make NSURLConnect use global private browsing cookie storage regardless of request session.
-    // The global private cookie storage has different semantics - it makes new cookies non-persistent,
-    // but doesn't start with a clean state.
-    if (enabled && currentCFHTTPCookieStorage())
-        return;
-#endif
-
-    // FIXME: When Private Browsing is enabled, the Private Browsing Cookie Storage should be
-    // observed for changes, not the default Cookie Storage.
-
-    // There is nothing to do here if sessions are supported. But we don't know if they are,
-    // so enable legacy private browsing mode on sharedHTTPCookieStorage, too.
-    wkSetCookieStoragePrivateBrowsingEnabled(enabled);
-}
-
 static WebCookieStorageObjCAdapter *cookieStorageAdapter;
 
 void startObservingCookieChanges()
diff --git a/Source/WebCore/platform/network/mac/ResourceHandleMac.mm b/Source/WebCore/platform/network/mac/ResourceHandleMac.mm
index 7e226e259..68b14c1d5 100644
--- a/Source/WebCore/platform/network/mac/ResourceHandleMac.mm
+++ b/Source/WebCore/platform/network/mac/ResourceHandleMac.mm
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2006, 2007, 2008, 2009, 2010, 2011 Apple Inc. All rights reserved.
+ * Copyright (C) 2004, 2006, 2007, 2008, 2009, 2010, 2011, 2012 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -124,10 +124,6 @@ private:
 
 namespace WebCore {
 
-#ifndef NDEBUG
-static bool isInitializingConnection;
-#endif
-    
 static void applyBasicAuthorizationHeader(ResourceRequest& request, const Credential& credential)
 {
     String authenticationHeader = "Basic " + base64Encode(String(credential.user() + ":" + credential.password()).utf8());
@@ -154,23 +150,19 @@ static bool shouldRelaxThirdPartyCookiePolicy(const KURL& url)
     NSHTTPCookieStorage *sharedStorage = [NSHTTPCookieStorage sharedHTTPCookieStorage];
 
     NSHTTPCookieAcceptPolicy cookieAcceptPolicy;
-#if USE(CFURLSTORAGESESSIONS)
     RetainPtr<CFHTTPCookieStorageRef> cfCookieStorage = currentCFHTTPCookieStorage();
     if (cfCookieStorage)
-        cookieAcceptPolicy = wkGetHTTPCookieAcceptPolicy(cfCookieStorage.get());
+        cookieAcceptPolicy = static_cast<NSHTTPCookieAcceptPolicy>(wkGetHTTPCookieAcceptPolicy(cfCookieStorage.get()));
     else
-#endif
         cookieAcceptPolicy = [sharedStorage cookieAcceptPolicy];
 
     if (cookieAcceptPolicy != NSHTTPCookieAcceptPolicyOnlyFromMainDocumentDomain)
         return false;
 
     NSArray *cookies;
-#if USE(CFURLSTORAGESESSIONS)
     if (cfCookieStorage)
         cookies = wkHTTPCookiesForURL(cfCookieStorage.get(), url);
     else
-#endif
         cookies = [sharedStorage cookiesForURL:url];
 
     return [cookies count];
@@ -221,10 +213,8 @@ void ResourceHandle::createNSURLConnection(id delegate, bool shouldUseCredential
     static bool supportsSettingConnectionProperties = [NSURLConnection instancesRespondToSelector:@selector(_initWithRequest:delegate:usesCache:maxContentLength:startImmediately:connectionProperties:)];
 #endif
 
-#if USE(CFURLSTORAGESESSIONS)
     if (CFURLStorageSessionRef storageSession = currentStorageSession())
         nsRequest = [wkCopyRequestWithStorageSession(storageSession, nsRequest) autorelease];
-#endif
 
     if (supportsSettingConnectionProperties) {
         NSDictionary *sessionID = shouldUseCredentialStorage ? [NSDictionary dictionary] : [NSDictionary dictionaryWithObject:@"WebKitPrivateSession" forKey:@"_kCFURLConnectionSessionID"];
@@ -250,10 +240,6 @@ bool ResourceHandle::start(NetworkingContext* context)
     if (!context->isValid())
         return false;
 
-#ifndef NDEBUG
-    isInitializingConnection = YES;
-#endif
-
     ASSERT(!d->m_proxy);
     d->m_proxy.adoptNS(wkCreateNSURLConnectionDelegateProxy());
     [static_cast<WebCoreNSURLConnectionDelegateProxy*>(d->m_proxy.get()) setDelegate:ResourceHandle::delegate()];
@@ -278,6 +264,12 @@ bool ResourceHandle::start(NetworkingContext* context)
         }
     }
 
+    if (NSOperationQueue *operationQueue = context->scheduledOperationQueue()) {
+        ASSERT(!scheduled);
+        [connection() setDelegateQueue:operationQueue];
+        scheduled = true;
+    }
+
     // Start the connection if we did schedule with at least one runloop.
     // We can't start the connection until we have one runloop scheduled.
     if (scheduled)
@@ -285,10 +277,6 @@ bool ResourceHandle::start(NetworkingContext* context)
     else
         d->m_startWhenScheduled = true;
 
-#ifndef NDEBUG
-    isInitializingConnection = NO;
-#endif
-
     LOG(Network, "Handle %p starting connection %p for %@", this, connection(), firstRequest().nsURLRequest());
     
     if (d->m_connection) {
@@ -488,10 +476,8 @@ void ResourceHandle::willSendRequest(ResourceRequest& request, const ResourceRes
         }
     }
 
-#if USE(CFURLSTORAGESESSIONS)
     if (CFURLStorageSessionRef storageSession = currentStorageSession())
         request.setStorageSession(storageSession);
-#endif
 
     client()->willSendRequest(this, request, redirectResponse);
 }
@@ -637,15 +623,11 @@ void ResourceHandle::receivedCancellation(const AuthenticationChallenge& challen
         client()->receivedCancellation(this, challenge);
 }
 
-#if USE(CFURLSTORAGESESSIONS)
-
 String ResourceHandle::privateBrowsingStorageSessionIdentifierDefaultBase()
 {
     return String([[NSBundle mainBundle] bundleIdentifier]);
 }
 
-#endif
-
 } // namespace WebCore
 
 @implementation WebCoreResourceHandleAsDelegate
@@ -786,7 +768,7 @@ String ResourceHandle::privateBrowsingStorageSessionIdentifierDefaultBase()
     m_handle->client()->didReceiveResponse(m_handle, r);
 }
 
-#if HAVE(NETWORK_CFDATA_ARRAY_CALLBACK)
+#if USE(NETWORK_CFDATA_ARRAY_CALLBACK)
 - (void)connection:(NSURLConnection *)connection didReceiveDataArray:(NSArray *)dataArray
 {
     UNUSED_PARAM(connection);
@@ -879,11 +861,6 @@ String ResourceHandle::privateBrowsingStorageSessionIdentifierDefaultBase()
 
     UNUSED_PARAM(connection);
 
-#ifndef NDEBUG
-    if (isInitializingConnection)
-        LOG_ERROR("connection:willCacheResponse: was called inside of [NSURLConnection initWithRequest:delegate:] (4067625)");
-#endif
-
     if (!m_handle || !m_handle->client())
         return nil;
 
diff --git a/Source/WebCore/platform/network/mac/ResourceRequestMac.mm b/Source/WebCore/platform/network/mac/ResourceRequestMac.mm
index 93216cb55..1807b3983 100644
--- a/Source/WebCore/platform/network/mac/ResourceRequestMac.mm
+++ b/Source/WebCore/platform/network/mac/ResourceRequestMac.mm
@@ -163,9 +163,9 @@ void ResourceRequest::doUpdatePlatformRequest()
         NSMutableArray *encodingFallbacks = [NSMutableArray array];
         unsigned count = m_responseContentDispositionEncodingFallbackArray.size();
         for (unsigned i = 0; i != count; ++i) {
-            CFStringRef encodingName = m_responseContentDispositionEncodingFallbackArray[i].createCFString();
-            unsigned long nsEncoding = CFStringConvertEncodingToNSStringEncoding(CFStringConvertIANACharSetNameToEncoding(encodingName));
-            CFRelease(encodingName);
+            RetainPtr<CFStringRef> encodingName = m_responseContentDispositionEncodingFallbackArray[i].createCFString();
+            unsigned long nsEncoding = CFStringConvertEncodingToNSStringEncoding(CFStringConvertIANACharSetNameToEncoding(encodingName.get()));
+
             if (nsEncoding != kCFStringEncodingInvalidId)
                 [encodingFallbacks addObject:[NSNumber numberWithUnsignedLong:nsEncoding]];
         }
@@ -185,14 +185,10 @@ void ResourceRequest::applyWebArchiveHackForMail()
     [NSURLProtocol setProperty:@"" forKey:@"WebDataRequest" inRequest:(NSMutableURLRequest *)nsURLRequest()];
 }
 
-#if USE(CFURLSTORAGESESSIONS)
-
 void ResourceRequest::setStorageSession(CFURLStorageSessionRef storageSession)
 {
     m_nsRequest.adoptNS(wkCopyRequestWithStorageSession(storageSession, m_nsRequest.get()));
 }
-
-#endif
     
 #endif // USE(CFNETWORK)
 
diff --git a/Source/WebCore/platform/network/mac/WebCoreURLResponse.mm b/Source/WebCore/platform/network/mac/WebCoreURLResponse.mm
index 6aa76f6dd..f9710b2dd 100644
--- a/Source/WebCore/platform/network/mac/WebCoreURLResponse.mm
+++ b/Source/WebCore/platform/network/mac/WebCoreURLResponse.mm
@@ -478,7 +478,7 @@ void adjustMIMETypeIfNecessary(CFURLResponseRef cfResponse)
     }
     
     if (!result) {
-        static CFStringRef defaultMIMETypeString = WebCore::defaultMIMEType().createCFString();
+        static CFStringRef defaultMIMETypeString = WebCore::defaultMIMEType().createCFString().leakRef();
         result = defaultMIMETypeString;
     }
 
diff --git a/Source/WebCore/platform/network/soup/AuthenticationChallenge.h b/Source/WebCore/platform/network/soup/AuthenticationChallenge.h
index 492d5c202..1675b9621 100644
--- a/Source/WebCore/platform/network/soup/AuthenticationChallenge.h
+++ b/Source/WebCore/platform/network/soup/AuthenticationChallenge.h
@@ -28,6 +28,9 @@
 #include "AuthenticationChallengeBase.h"
 #include "AuthenticationClient.h"
 
+typedef struct _SoupAuth SoupAuth;
+typedef struct _SoupMessage SoupMessage;
+
 namespace WebCore {
 
 class AuthenticationChallenge : public AuthenticationChallengeBase {
@@ -41,8 +44,19 @@ public:
     {
     }
 
+    AuthenticationChallenge(SoupSession*, SoupMessage*, SoupAuth*, bool retrying, AuthenticationClient*);
     AuthenticationClient* authenticationClient() const { return m_authenticationClient.get(); }
+    SoupSession* soupSession() const { return m_soupSession.get(); }
+    SoupMessage* soupMessage() const { return m_soupMessage.get(); }
+    SoupAuth* soupAuth() const { return m_soupAuth.get(); }
+
+private:
+    friend class AuthenticationChallengeBase;
+    static bool platformCompare(const AuthenticationChallenge&, const AuthenticationChallenge&);
 
+    GRefPtr<SoupSession> m_soupSession;
+    GRefPtr<SoupMessage> m_soupMessage;
+    GRefPtr<SoupAuth> m_soupAuth;
     RefPtr<AuthenticationClient> m_authenticationClient;
 };
 
diff --git a/Source/WebCore/platform/network/soup/AuthenticationChallengeSoup.cpp b/Source/WebCore/platform/network/soup/AuthenticationChallengeSoup.cpp
new file mode 100644
index 000000000..2e7d02852
--- /dev/null
+++ b/Source/WebCore/platform/network/soup/AuthenticationChallengeSoup.cpp
@@ -0,0 +1,86 @@
+/*
+ * Copyright (C) 2012 Igalia S.L.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY IGALIA S.L. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "AuthenticationChallenge.h"
+
+#include "ResourceError.h"
+#include <libsoup/soup.h>
+
+namespace WebCore {
+
+static ProtectionSpaceServerType protectionSpaceServerTypeFromURI(SoupURI* uri, bool isForProxy)
+{
+    if (uri->scheme == SOUP_URI_SCHEME_HTTPS)
+        return isForProxy ? ProtectionSpaceProxyHTTPS : ProtectionSpaceServerHTTPS;
+    if (uri->scheme == SOUP_URI_SCHEME_HTTP)
+        return isForProxy ? ProtectionSpaceProxyHTTP : ProtectionSpaceServerHTTP;
+    if (uri->scheme == SOUP_URI_SCHEME_FTP)
+        return isForProxy ? ProtectionSpaceProxyFTP : ProtectionSpaceServerFTP;
+    return isForProxy ? ProtectionSpaceProxyHTTP : ProtectionSpaceServerHTTP;
+}
+
+static ProtectionSpace protectionSpaceFromSoupAuthAndMessage(SoupAuth* soupAuth, SoupMessage* message)
+{
+    const char* schemeName = soup_auth_get_scheme_name(soupAuth);
+    ProtectionSpaceAuthenticationScheme scheme;
+    if (!g_ascii_strcasecmp(schemeName, "basic"))
+        scheme = ProtectionSpaceAuthenticationSchemeHTTPBasic;
+    else if (!g_ascii_strcasecmp(schemeName, "digest"))
+        scheme = ProtectionSpaceAuthenticationSchemeHTTPDigest;
+    else if (!g_ascii_strcasecmp(schemeName, "ntlm"))
+        scheme = ProtectionSpaceAuthenticationSchemeNTLM;
+    else if (!g_ascii_strcasecmp(schemeName, "negotiate"))
+        scheme = ProtectionSpaceAuthenticationSchemeNegotiate;
+    else
+        scheme = ProtectionSpaceAuthenticationSchemeUnknown;
+
+    SoupURI* soupURI = soup_message_get_uri(message);
+    return ProtectionSpace(String::fromUTF8(soup_uri_get_host(soupURI)), soup_uri_get_port(soupURI),
+        protectionSpaceServerTypeFromURI(soupURI, soup_auth_is_for_proxy(soupAuth)),
+        String::fromUTF8(soup_auth_get_realm(soupAuth)), scheme);
+}
+
+AuthenticationChallenge::AuthenticationChallenge(SoupSession* soupSession, SoupMessage* soupMessage, SoupAuth* soupAuth, bool retrying, AuthenticationClient* client)
+    : AuthenticationChallengeBase(protectionSpaceFromSoupAuthAndMessage(soupAuth, soupMessage),
+        Credential(), // proposedCredentials
+        retrying ? 1 : 0, // previousFailureCount
+        soupMessage, // failureResponse
+        ResourceError::authenticationError(soupMessage))
+    , m_soupSession(soupSession)
+    , m_soupMessage(soupMessage)
+    , m_soupAuth(soupAuth)
+    , m_authenticationClient(client)
+{
+}
+
+bool AuthenticationChallenge::platformCompare(const AuthenticationChallenge& a, const AuthenticationChallenge& b)
+{
+    return a.soupSession() == b.soupSession()
+        && a.soupMessage() == b.soupMessage()
+        && a.soupAuth() == b.soupAuth();
+}
+
+} // namespace WebCore
diff --git a/Source/WebCore/platform/network/soup/CookieStorageSoup.cpp b/Source/WebCore/platform/network/soup/CookieStorageSoup.cpp
index bc87afba1..1f5c670b1 100644
--- a/Source/WebCore/platform/network/soup/CookieStorageSoup.cpp
+++ b/Source/WebCore/platform/network/soup/CookieStorageSoup.cpp
@@ -31,11 +31,6 @@
 
 namespace WebCore {
 
-void setCookieStoragePrivateBrowsingEnabled(bool)
-{
-    notImplemented();
-}
-
 #if USE(PLATFORM_STRATEGIES)
 static void soupCookiesChanged(SoupCookieJar* jar, SoupCookie*, SoupCookie*, gpointer)
 {
diff --git a/Source/WebCore/platform/network/soup/ProxyResolverSoup.cpp b/Source/WebCore/platform/network/soup/ProxyResolverSoup.cpp
index 6f6ed7b9f..2f350fcba 100644
--- a/Source/WebCore/platform/network/soup/ProxyResolverSoup.cpp
+++ b/Source/WebCore/platform/network/soup/ProxyResolverSoup.cpp
@@ -84,7 +84,7 @@ static void soupProxyResolverWkSetProperty(GObject* object, uint propID, const G
     case PROP_NO_PROXY:
         priv->noProxy = g_value_get_string(value);
         priv->proxyExceptions.clear();
-        String::fromUTF8(priv->noProxy.data()).replace(' ', "").split(',', priv->proxyExceptions);
+        String::fromUTF8(priv->noProxy.data()).replaceWithLiteral(' ', "").split(',', priv->proxyExceptions);
         break;
     default:
         G_OBJECT_WARN_INVALID_PROPERTY_ID(object, propID, pspec);
diff --git a/Source/WebCore/platform/network/soup/ResourceError.h b/Source/WebCore/platform/network/soup/ResourceError.h
index 766da0b30..0cb5db75b 100644
--- a/Source/WebCore/platform/network/soup/ResourceError.h
+++ b/Source/WebCore/platform/network/soup/ResourceError.h
@@ -53,6 +53,7 @@ public:
     static ResourceError genericIOError(GError*, SoupRequest*);
     static ResourceError tlsError(SoupRequest*, unsigned tlsErrors, GTlsCertificate*);
     static ResourceError timeoutError(const String& failingURL);
+    static ResourceError authenticationError(SoupMessage*);
 
     unsigned tlsErrors() const { return m_tlsErrors; }
     GTlsCertificate* certificate() const { return m_certificate.get(); }
diff --git a/Source/WebCore/platform/network/soup/ResourceErrorSoup.cpp b/Source/WebCore/platform/network/soup/ResourceErrorSoup.cpp
index a1e0863f8..535133f67 100644
--- a/Source/WebCore/platform/network/soup/ResourceErrorSoup.cpp
+++ b/Source/WebCore/platform/network/soup/ResourceErrorSoup.cpp
@@ -35,11 +35,17 @@
 
 namespace WebCore {
 
+static String failingURI(SoupURI* soupURI)
+{
+    ASSERT(soupURI);
+    GOwnPtr<char> uri(soup_uri_to_string(soupURI, FALSE));
+    return uri.get();
+}
+
 static String failingURI(SoupRequest* request)
 {
     ASSERT(request);
-    GOwnPtr<char> uri(soup_uri_to_string(soup_request_get_uri(request), FALSE));
-    return uri.get();
+    return failingURI(soup_request_get_uri(request));
 }
 
 ResourceError ResourceError::httpError(SoupMessage* message, GError* error, SoupRequest* request)
@@ -50,6 +56,13 @@ ResourceError ResourceError::httpError(SoupMessage* message, GError* error, Soup
         failingURI(request), String::fromUTF8(message->reason_phrase));
 }
 
+ResourceError ResourceError::authenticationError(SoupMessage* message)
+{
+    ASSERT(message);
+    return ResourceError(g_quark_to_string(SOUP_HTTP_ERROR), message->status_code,
+        failingURI(soup_message_get_uri(message)), String::fromUTF8(message->reason_phrase));
+}
+
 ResourceError ResourceError::genericIOError(GError* error, SoupRequest* request)
 {
     return ResourceError(g_quark_to_string(G_IO_ERROR), error->code,
diff --git a/Source/WebCore/platform/network/soup/ResourceHandleSoup.cpp b/Source/WebCore/platform/network/soup/ResourceHandleSoup.cpp
index b1e92f8c4..a7d7b6db2 100644
--- a/Source/WebCore/platform/network/soup/ResourceHandleSoup.cpp
+++ b/Source/WebCore/platform/network/soup/ResourceHandleSoup.cpp
@@ -147,6 +147,12 @@ public:
         didFinishLoading(handle, 0);
     }
 
+    virtual void didReceiveAuthenticationChallenge(ResourceHandle*, const AuthenticationChallenge& challenge)
+    {
+        // We do not handle authentication for synchronous XMLHttpRequests.
+        challenge.authenticationClient()->receivedRequestToContinueWithoutCredential(challenge);
+    }
+
     void run()
     {
         if (!m_finished)
@@ -231,11 +237,6 @@ static SoupSession* sessionFromContext(NetworkingContext* context)
     return (context && context->isValid()) ? context->soupSession() : ResourceHandle::defaultSession();
 }
 
-uint64_t ResourceHandleInternal::initiatingPageID()
-{
-    return (m_context && m_context->isValid()) ? m_context->initiatingPageID() : 0;
-}
-
 ResourceHandle::~ResourceHandle()
 {
     cleanupSoupRequestOperation(this, true);
@@ -674,13 +675,13 @@ static void networkEventCallback(SoupMessage*, GSocketClientEvent event, GIOStre
 
 static const char* gSoupRequestInitiaingPageIDKey = "wk-soup-request-initiaing-page-id";
 
-static void setSoupRequestInitiaingPageID(SoupRequest* request, uint64_t initiatingPageID)
+static void setSoupRequestInitiaingPageIDFromNetworkingContext(SoupRequest* request, NetworkingContext* context)
 {
-    if (!initiatingPageID)
+    if (!context || !context->isValid())
         return;
 
     uint64_t* initiatingPageIDPtr = static_cast<uint64_t*>(fastMalloc(sizeof(uint64_t)));
-    *initiatingPageIDPtr = initiatingPageID;
+    *initiatingPageIDPtr = context->initiatingPageID();
     g_object_set_data_full(G_OBJECT(request), g_intern_static_string(gSoupRequestInitiaingPageIDKey), initiatingPageIDPtr, fastFree);
 }
 
@@ -698,6 +699,7 @@ static bool createSoupMessageForHandleAndRequest(ResourceHandle* handle, const R
     SoupMessage* soupMessage = d->m_soupMessage.get();
     request.updateSoupMessage(soupMessage);
 
+    g_object_set_data(G_OBJECT(soupMessage), "handle", handle);
     if (!handle->shouldContentSniff())
         soup_message_disable_feature(soupMessage, SOUP_TYPE_CONTENT_SNIFFER);
 
@@ -736,7 +738,6 @@ static bool createSoupMessageForHandleAndRequest(ResourceHandle* handle, const R
     d->m_response.setResourceLoadTiming(ResourceLoadTiming::create());
     g_signal_connect(d->m_soupMessage.get(), "network-event", G_CALLBACK(networkEventCallback), handle);
     g_signal_connect(d->m_soupMessage.get(), "wrote-body", G_CALLBACK(wroteBodyCallback), handle);
-    g_object_set_data(G_OBJECT(d->m_soupMessage.get()), "handle", handle);
 #endif
 
     return true;
@@ -776,6 +777,9 @@ bool ResourceHandle::start(NetworkingContext* context)
     if (context && !context->isValid())
         return false;
 
+    // Used to set the keep track of custom SoupSessions for ports that support it (EFL).
+    d->m_context = context;
+
     if (!(d->m_user.isEmpty() || d->m_pass.isEmpty())) {
         // If credentials were specified for this request, add them to the url,
         // so that they will be passed to NetworkRequest.
@@ -785,9 +789,6 @@ bool ResourceHandle::start(NetworkingContext* context)
         d->m_firstRequest.setURL(urlWithCredentials);
     }
 
-    // Used to set the authentication dialog toplevel; may be NULL
-    d->m_context = context;
-
     // Only allow the POST and GET methods for non-HTTP requests.
     const ResourceRequest& request = firstRequest();
     bool isHTTPFamilyRequest = request.url().protocolIsInHTTPFamily();
@@ -801,7 +802,7 @@ bool ResourceHandle::start(NetworkingContext* context)
         return true;
     }
 
-    setSoupRequestInitiaingPageID(d->m_soupRequest.get(), d->initiatingPageID());
+    setSoupRequestInitiaingPageIDFromNetworkingContext(d->m_soupRequest.get(), context);
 
     // Send the request only if it's not been explicitly deferred.
     if (!d->m_defersLoading)
@@ -855,6 +856,57 @@ void ResourceHandle::setIgnoreSSLErrors(bool ignoreSSLErrors)
     gIgnoreSSLErrors = ignoreSSLErrors;
 }
 
+void ResourceHandle::didReceiveAuthenticationChallenge(const AuthenticationChallenge& challenge)
+{
+    ASSERT(d->m_currentWebChallenge.isNull());
+    d->m_currentWebChallenge = challenge;
+
+    if (client()) {
+        ASSERT(challenge.soupSession());
+        ASSERT(challenge.soupMessage());
+        soup_session_pause_message(challenge.soupSession(), challenge.soupMessage());
+        client()->didReceiveAuthenticationChallenge(this, challenge);
+    }
+}
+
+void ResourceHandle::receivedRequestToContinueWithoutCredential(const AuthenticationChallenge& challenge)
+{
+    ASSERT(!challenge.isNull());
+    if (challenge != d->m_currentWebChallenge)
+        return;
+    soup_session_unpause_message(challenge.soupSession(), challenge.soupMessage());
+
+    clearAuthentication();
+}
+
+void ResourceHandle::receivedCredential(const AuthenticationChallenge& challenge, const Credential& credential)
+{
+    ASSERT(!challenge.isNull());
+    if (challenge != d->m_currentWebChallenge)
+        return;
+
+    ASSERT(challenge.soupSession());
+    ASSERT(challenge.soupMessage());
+    soup_auth_authenticate(challenge.soupAuth(), credential.user().utf8().data(), credential.password().utf8().data());
+    soup_session_unpause_message(challenge.soupSession(), challenge.soupMessage());
+
+    clearAuthentication();
+}
+
+void ResourceHandle::receivedCancellation(const AuthenticationChallenge& challenge)
+{
+    ASSERT(!challenge.isNull());
+    if (challenge != d->m_currentWebChallenge)
+        return;
+
+    soup_session_unpause_message(challenge.soupSession(), challenge.soupMessage());
+
+    if (client())
+        client()->receivedCancellation(this, challenge);
+
+    clearAuthentication();
+}
+
 static bool waitingToSendRequest(ResourceHandle* handle)
 {
     // We need to check for d->m_soupRequest because the request may have raised a failure
@@ -1007,6 +1059,14 @@ static gboolean requestTimeoutCallback(gpointer data)
     return FALSE;
 }
 
+static void authenticateCallback(SoupSession* session, SoupMessage* soupMessage, SoupAuth* soupAuth, gboolean retrying)
+{
+    RefPtr<ResourceHandle> handle = static_cast<ResourceHandle*>(g_object_get_data(G_OBJECT(soupMessage), "handle"));
+    if (!handle)
+        return;
+    handle->didReceiveAuthenticationChallenge(AuthenticationChallenge(session, soupMessage, soupAuth, retrying, handle.get()));
+}
+
 SoupSession* ResourceHandle::defaultSession()
 {
     static SoupSession* session = 0;
@@ -1027,8 +1087,10 @@ SoupSession* ResourceHandle::defaultSession()
                      SOUP_SESSION_ADD_FEATURE_BY_TYPE, SOUP_TYPE_PROXY_RESOLVER_DEFAULT,
                      SOUP_SESSION_USE_THREAD_CONTEXT, TRUE,
                      NULL);
+        g_signal_connect(session, "authenticate", G_CALLBACK(authenticateCallback), 0);
+
 #if ENABLE(WEB_TIMING)
-        g_signal_connect(G_OBJECT(session), "request-started", G_CALLBACK(requestStartedCallback), 0);
+        g_signal_connect(session, "request-started", G_CALLBACK(requestStartedCallback), 0);
 #endif
     }
 
diff --git a/Source/WebCore/platform/network/soup/SocketStreamHandleSoup.cpp b/Source/WebCore/platform/network/soup/SocketStreamHandleSoup.cpp
index 7aa6cccb8..c53658313 100644
--- a/Source/WebCore/platform/network/soup/SocketStreamHandleSoup.cpp
+++ b/Source/WebCore/platform/network/soup/SocketStreamHandleSoup.cpp
@@ -84,6 +84,7 @@ SocketStreamHandle::SocketStreamHandle(const KURL& url, SocketStreamHandleClient
     : SocketStreamHandleBase(url, client)
     , m_readBuffer(0)
 {
+    LOG(Network, "SocketStreamHandle %p new client %p", this, m_client);
     unsigned int port = url.hasPort() ? url.port() : (url.protocolIs("wss") ? 443 : 80);
 
     m_id = activateHandle(this);
@@ -96,6 +97,7 @@ SocketStreamHandle::SocketStreamHandle(const KURL& url, SocketStreamHandleClient
 
 SocketStreamHandle::~SocketStreamHandle()
 {
+    LOG(Network, "SocketStreamHandle %p delete", this);
     // If for some reason we were destroyed without closing, ensure that we are deactivated.
     deactivateHandle(this);
     setClient(0);
@@ -153,6 +155,7 @@ void SocketStreamHandle::writeReady()
 
 int SocketStreamHandle::platformSend(const char* data, int length)
 {
+    LOG(Network, "SocketStreamHandle %p platformSend", this);
     GOwnPtr<GError> error;
     gssize written = g_pollable_output_stream_write_nonblocking(m_outputStream.get(), data, length, 0, &error.outPtr());
     if (error) {
@@ -173,6 +176,7 @@ int SocketStreamHandle::platformSend(const char* data, int length)
 
 void SocketStreamHandle::platformClose()
 {
+    LOG(Network, "SocketStreamHandle %p platformClose", this);
     // We remove this handle from the active handles list first, to disable all callbacks.
     deactivateHandle(this);
     stopWaitingForSocketWritability();
diff --git a/Source/WebCore/platform/network/win/CookieStorageWin.cpp b/Source/WebCore/platform/network/win/CookieStorageWin.cpp
deleted file mode 100644
index c1ec33d95..000000000
--- a/Source/WebCore/platform/network/win/CookieStorageWin.cpp
+++ /dev/null
@@ -1,37 +0,0 @@
-/*
- * Copyright (C) 2010 Patrick Gansterer <paroga@paroga.com>
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
- * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
- * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
- * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
- * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
- * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "config.h"
-#include "CookieStorage.h"
-
-#include "NotImplemented.h"
-
-namespace WebCore {
-
-void setCookieStoragePrivateBrowsingEnabled(bool)
-{
-    notImplemented();
-}
-
-} // namespace WebCore
diff --git a/Source/WebCore/platform/qt/CookieJarQt.cpp b/Source/WebCore/platform/qt/CookieJarQt.cpp
index 7d57aac1c..602174a17 100644
--- a/Source/WebCore/platform/qt/CookieJarQt.cpp
+++ b/Source/WebCore/platform/qt/CookieJarQt.cpp
@@ -235,7 +235,7 @@ SharedCookieJarQt::SharedCookieJarQt(const String& cookieStorageDirectory)
 {
     m_database = QSqlDatabase::addDatabase(QLatin1String("QSQLITE"));
     const QString cookieStoragePath = cookieStorageDirectory;
-    const QString dataBaseName = cookieStoragePath + QLatin1String("cookies.db");
+    const QString dataBaseName = cookieStoragePath + QLatin1String("/cookies.db");
     m_database.setDatabaseName(dataBaseName);
     ensureDatabaseTable();
     loadCookies();
diff --git a/Source/WebCore/platform/qt/LocalizedStringsQt.cpp b/Source/WebCore/platform/qt/LocalizedStringsQt.cpp
index a410f438e..0cdce3a85 100644
--- a/Source/WebCore/platform/qt/LocalizedStringsQt.cpp
+++ b/Source/WebCore/platform/qt/LocalizedStringsQt.cpp
@@ -457,6 +457,12 @@ String insecurePluginVersionText()
     return String();
 }
 
+String inactivePluginText()
+{
+    notImplemented();
+    return String();
+}
+
 String multipleFileUploadText(unsigned)
 {
     notImplemented();
diff --git a/Tools/DumpRenderTree/qt/QtInitializeTestFonts.cpp b/Source/WebCore/platform/qt/QtTestSupport.cpp
index c69347e8d..6aedf638e 100644
--- a/Tools/DumpRenderTree/qt/QtInitializeTestFonts.cpp
+++ b/Source/WebCore/platform/qt/QtTestSupport.cpp
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2012 Nokia Corporation and/or its subsidiary(-ies)
+ * Copyright (C) 2012 University of Szeged. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -10,11 +11,8 @@
  * 2.  Redistributions in binary form must reproduce the above copyright
  *     notice, this list of conditions and the following disclaimer in the
  *     documentation and/or other materials provided with the distribution.
- * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
- *     its contributors may be used to endorse or promote products derived
- *     from this software without specific prior written permission.
  *
- * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS "AS IS" AND ANY
  * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
  * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
  * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
@@ -27,8 +25,13 @@
  */
 
 #include "config.h"
+#include "QtTestSupport.h"
 
-#include "QtInitializeTestFonts.h"
+#include "CrossOriginPreflightResultCache.h"
+#include "FontCache.h"
+#include "MemoryCache.h"
+#include "PageCache.h"
+#include <QFontDatabase>
 
 #if HAVE(FONTCONFIG)
 #include <QByteArray>
@@ -36,9 +39,28 @@
 #include <fontconfig/fontconfig.h>
 #endif
 
+using namespace WebCore;
+
 namespace WebKit {
 
-void initializeTestFonts()
+void QtTestSupport::clearMemoryCaches()
+{
+    if (!memoryCache()->disabled()) {
+        memoryCache()->setDisabled(true);
+        memoryCache()->setDisabled(false);
+    }
+
+    int pageCapacity = WebCore::pageCache()->capacity();
+    WebCore::pageCache()->setCapacity(0);
+    WebCore::pageCache()->releaseAutoreleasedPagesNow();
+    WebCore::pageCache()->setCapacity(pageCapacity);
+
+    WebCore::fontCache()->invalidate();
+
+    WebCore::CrossOriginPreflightResultCache::shared().empty();
+}
+
+void QtTestSupport::initializeTestFonts()
 {
 #if HAVE(FONTCONFIG)
     static int numFonts = -1;
@@ -54,12 +76,12 @@ void initializeTestFonts()
     QByteArray fontDir = getenv("WEBKIT_TESTFONTS");
     if (fontDir.isEmpty() || !QDir(QString::fromLatin1(fontDir)).exists()) {
         qFatal("\n\n"
-                "----------------------------------------------------------------------\n"
-                "WEBKIT_TESTFONTS environment variable is not set correctly.\n"
-                "This variable has to point to the directory containing the fonts\n"
-                "you can clone from git://gitorious.org/qtwebkit/testfonts.git\n"
-                "----------------------------------------------------------------------\n"
-               );
+            "----------------------------------------------------------------------\n"
+            "WEBKIT_TESTFONTS environment variable is not set correctly.\n"
+            "This variable has to point to the directory containing the fonts\n"
+            "you can clone from git://gitorious.org/qtwebkit/testfonts.git\n"
+            "----------------------------------------------------------------------\n"
+            );
     }
 
     QByteArray configFile = fontDir + "/fonts.conf";
@@ -72,6 +94,9 @@ void initializeTestFonts()
 
     appFontSet = FcConfigGetFonts(config, FcSetApplication);
     numFonts = appFontSet->nfont;
+
+    WebCore::fontCache()->invalidate();
+    QFontDatabase::removeAllApplicationFonts();
 #endif
 }
 
diff --git a/Source/WebCore/platform/qt/QtTestSupport.h b/Source/WebCore/platform/qt/QtTestSupport.h
new file mode 100644
index 000000000..dc4029389
--- /dev/null
+++ b/Source/WebCore/platform/qt/QtTestSupport.h
@@ -0,0 +1,48 @@
+/*
+ * Copyright (C) 2011 Nokia Corporation and/or its subsidiary(-ies)
+ * Copyright (C) 2012 University of Szeged. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this program; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ *
+ */
+
+#ifndef QtTestSupport_h
+#define QtTestSupport_h
+
+#include <QtCore/qglobal.h>
+
+#if defined(BUILDING_WEBKIT)
+#define TESTSUPPORT_EXPORT Q_DECL_EXPORT
+#else
+#define TESTSUPPORT_EXPORT Q_DECL_IMPORT
+#endif
+
+// Helpers for test runners (DumpRenderTree and WebKitTestRunner).
+// This is living in WebCore for better code sharing, although
+// we expose it as (private) API, so it is part of the WebKit layer.
+
+namespace WebKit {
+
+namespace QtTestSupport {
+
+TESTSUPPORT_EXPORT void clearMemoryCaches();
+TESTSUPPORT_EXPORT void initializeTestFonts();
+
+}
+
+}
+
+#endif
diff --git a/Source/WebCore/platform/qt/TemporaryLinkStubsQt.cpp b/Source/WebCore/platform/qt/TemporaryLinkStubsQt.cpp
index 12c54f244..030a2ff35 100644
--- a/Source/WebCore/platform/qt/TemporaryLinkStubsQt.cpp
+++ b/Source/WebCore/platform/qt/TemporaryLinkStubsQt.cpp
@@ -88,10 +88,6 @@ bool PluginDatabase::isPreferredPluginDirectory(const String& directory)
     return false;
 }
 
-void PluginView::privateBrowsingStateChanged(bool)
-{
-}
-
 PassRefPtr<JSC::Bindings::Instance> PluginView::bindingInstance()
 {
     return 0;
diff --git a/Source/WebCore/platform/text/BidiResolver.h b/Source/WebCore/platform/text/BidiResolver.h
index 3d4dae8f6..c8e276c99 100644
--- a/Source/WebCore/platform/text/BidiResolver.h
+++ b/Source/WebCore/platform/text/BidiResolver.h
@@ -113,10 +113,10 @@ inline bool operator!=(const BidiStatus& status1, const BidiStatus& status2)
 
 struct BidiCharacterRun {
     BidiCharacterRun(int start, int stop, BidiContext* context, WTF::Unicode::Direction dir)
-        : m_start(start)
-        , m_stop(stop)
-        , m_override(context->override())
+        : m_override(context->override())
         , m_next(0)
+        , m_start(start)
+        , m_stop(stop)
     {
         if (dir == WTF::Unicode::OtherNeutral)
             dir = context->dir();
@@ -146,11 +146,13 @@ struct BidiCharacterRun {
     BidiCharacterRun* next() const { return m_next; }
     void setNext(BidiCharacterRun* next) { m_next = next; }
 
+    // Do not add anything apart from bitfields until after m_next. See https://bugs.webkit.org/show_bug.cgi?id=100173
+    bool m_override:1;
+    bool m_hasHyphen:1; // Used by BidiRun subclass which is a layering violation but enables us to save 8 bytes per object on 64-bit.
     unsigned char m_level;
+    BidiCharacterRun* m_next;
     int m_start;
     int m_stop;
-    bool m_override;
-    BidiCharacterRun* m_next;
 };
 
 enum VisualDirectionOverride {
diff --git a/Source/WebCore/platform/text/DateTimeFormat.cpp b/Source/WebCore/platform/text/DateTimeFormat.cpp
index 2b1c28c68..bcbe1d578 100644
--- a/Source/WebCore/platform/text/DateTimeFormat.cpp
+++ b/Source/WebCore/platform/text/DateTimeFormat.cpp
@@ -26,7 +26,7 @@
 #include "config.h"
 #include "DateTimeFormat.h"
 
-#if ENABLE(INPUT_MULTIPLE_FIELDS_UI)
+#if ENABLE(DATE_AND_TIME_INPUT_TYPES)
 #include <wtf/ASCIICType.h>
 #include <wtf/text/StringBuilder.h>
 
@@ -241,6 +241,42 @@ bool DateTimeFormat::parse(const String& source, TokenHandler& tokenHandler)
     return false;
 }
 
+static bool isASCIIAlphabetOrQuote(UChar ch)
+{
+    return isASCIIAlpha(ch) || ch == '\'';
+}
+
+void DateTimeFormat::quoteAndAppendLiteral(const String& literal, StringBuilder& buffer)
+{
+    if (literal.length() <= 0)
+        return;
+
+    if (literal.find(isASCIIAlphabetOrQuote) == notFound) {
+        buffer.append(literal);
+        return;
+    }
+    
+    if (literal.find('\'') == notFound) {
+        buffer.append("'");
+        buffer.append(literal);
+        buffer.append("'");
+        return;
+    }
+
+    for (unsigned i = 0; i < literal.length(); ++i) {
+        if (literal[i] == '\'')
+            buffer.append("''");
+        else {
+            String escaped = literal.substring(i);
+            escaped.replace(ASCIILiteral("'"), ASCIILiteral("''"));
+            buffer.append("'");
+            buffer.append(escaped);
+            buffer.append("'");
+            return;
+        }
+    }
+}
+
 } // namespace WebCore
 
 #endif
diff --git a/Source/WebCore/platform/text/DateTimeFormat.h b/Source/WebCore/platform/text/DateTimeFormat.h
index f5ff0038f..aa43d2cca 100644
--- a/Source/WebCore/platform/text/DateTimeFormat.h
+++ b/Source/WebCore/platform/text/DateTimeFormat.h
@@ -26,8 +26,8 @@
 #ifndef DateTimeFormat_h
 #define DateTimeFormat_h
 
-#if ENABLE(INPUT_MULTIPLE_FIELDS_UI)
-#include <wtf/text/WTFString.h>
+#if ENABLE(DATE_AND_TIME_INPUT_TYPES)
+#include <wtf/Forward.h>
 
 namespace WebCore {
 
@@ -103,6 +103,7 @@ public:
 
     // Returns true if succeeded, false if failed.
     static bool parse(const String&, TokenHandler&);
+    static void quoteAndAppendLiteral(const String&, StringBuilder&);
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/platform/text/LocaleICU.cpp b/Source/WebCore/platform/text/LocaleICU.cpp
index 5bcf4dd72..24705f044 100644
--- a/Source/WebCore/platform/text/LocaleICU.cpp
+++ b/Source/WebCore/platform/text/LocaleICU.cpp
@@ -44,7 +44,7 @@ using namespace std;
 
 namespace WebCore {
 
-PassOwnPtr<Localizer> Localizer::create(const AtomicString& locale)
+PassOwnPtr<Locale> Locale::create(const AtomicString& locale)
 {
     return LocaleICU::create(locale.string().utf8().data());
 }
@@ -58,7 +58,7 @@ LocaleICU::LocaleICU(const char* locale)
 #if ENABLE(CALENDAR_PICKER)
     , m_firstDayOfWeek(0)
 #endif
-#if ENABLE(INPUT_MULTIPLE_FIELDS_UI)
+#if ENABLE(DATE_AND_TIME_INPUT_TYPES)
     , m_mediumTimeFormat(0)
     , m_shortTimeFormat(0)
     , m_didCreateTimeFormat(false)
@@ -70,7 +70,7 @@ LocaleICU::~LocaleICU()
 {
     unum_close(m_numberFormat);
     udat_close(m_shortDateFormat);
-#if ENABLE(INPUT_MULTIPLE_FIELDS_UI)
+#if ENABLE(DATE_AND_TIME_INPUT_TYPES)
     udat_close(m_mediumTimeFormat);
     udat_close(m_shortTimeFormat);
 #endif
@@ -112,7 +112,7 @@ String LocaleICU::decimalTextAttribute(UNumberFormatTextAttribute tag)
     return String::adopt(buffer);
 }
 
-void LocaleICU::initializeLocalizerData()
+void LocaleICU::initializeLocaleData()
 {
     if (m_didCreateDecimalFormat)
         return;
@@ -136,7 +136,7 @@ void LocaleICU::initializeLocalizerData()
     symbols.append(decimalSymbol(UNUM_DECIMAL_SEPARATOR_SYMBOL));
     symbols.append(decimalSymbol(UNUM_GROUPING_SEPARATOR_SYMBOL));
     ASSERT(symbols.size() == DecimalSymbolsSize);
-    setLocalizerData(symbols, decimalTextAttribute(UNUM_POSITIVE_PREFIX), decimalTextAttribute(UNUM_POSITIVE_SUFFIX), decimalTextAttribute(UNUM_NEGATIVE_PREFIX), decimalTextAttribute(UNUM_NEGATIVE_SUFFIX));
+    setLocaleData(symbols, decimalTextAttribute(UNUM_POSITIVE_PREFIX), decimalTextAttribute(UNUM_POSITIVE_SUFFIX), decimalTextAttribute(UNUM_NEGATIVE_PREFIX), decimalTextAttribute(UNUM_NEGATIVE_SUFFIX));
 }
 
 bool LocaleICU::initializeShortDateFormat()
@@ -155,25 +155,7 @@ UDateFormat* LocaleICU::openDateFormat(UDateFormatStyle timeStyle, UDateFormatSt
     return udat_open(timeStyle, dateStyle, m_locale.data(), gmtTimezone, WTF_ARRAY_LENGTH(gmtTimezone), 0, -1, &status);
 }
 
-double LocaleICU::parseDateTime(const String& input, DateComponents::Type type)
-{
-    if (type != DateComponents::Date)
-        return std::numeric_limits<double>::quiet_NaN();
-    if (!initializeShortDateFormat())
-        return numeric_limits<double>::quiet_NaN();
-    if (input.length() > static_cast<unsigned>(numeric_limits<int32_t>::max()))
-        return numeric_limits<double>::quiet_NaN();
-    int32_t inputLength = static_cast<int32_t>(input.length());
-    UErrorCode status = U_ZERO_ERROR;
-    int32_t parsePosition = 0;
-    UDate date = udat_parse(m_shortDateFormat, input.characters(), inputLength, &parsePosition, &status);
-    if (parsePosition != inputLength || U_FAILURE(status))
-        return numeric_limits<double>::quiet_NaN();
-    // UDate, which is an alias of double, is compatible with our expectation.
-    return date;
-}
-
-#if ENABLE(CALENDAR_PICKER) || ENABLE(INPUT_MULTIPLE_FIELDS_UI)
+#if ENABLE(DATE_AND_TIME_INPUT_TYPES)
 static String getDateFormatPattern(const UDateFormat* dateFormat)
 {
     if (!dateFormat)
@@ -190,78 +172,6 @@ static String getDateFormatPattern(const UDateFormat* dateFormat)
         return emptyString();
     return String::adopt(buffer);
 }
-#endif
-
-#if ENABLE(CALENDAR_PICKER)
-static inline bool isICUYearSymbol(UChar letter)
-{
-    return letter == 'y' || letter == 'Y';
-}
-
-static inline bool isICUMonthSymbol(UChar letter)
-{
-    return letter == 'M';
-}
-
-static inline bool isICUDayInMonthSymbol(UChar letter)
-{
-    return letter == 'd';
-}
-
-// Specification of the input:
-// http://icu-project.org/apiref/icu4c/classSimpleDateFormat.html#details
-static String localizeFormat(const String& buffer)
-{
-    StringBuilder builder;
-    UChar lastChar = 0;
-    bool inQuote = false;
-    for (unsigned i = 0; i < buffer.length(); ++i) {
-        if (inQuote) {
-            if (buffer[i] == '\'') {
-                inQuote = false;
-                lastChar = 0;
-                ASSERT(i);
-                if (buffer[i - 1] == '\'')
-                    builder.append('\'');
-            } else
-                builder.append(buffer[i]);
-        } else {
-            if (isASCIIAlpha(lastChar) && lastChar == buffer[i])
-                continue;
-            lastChar = buffer[i];
-            if (isICUYearSymbol(lastChar)) {
-                String text = dateFormatYearText();
-                builder.append(text.isEmpty() ? "Year" : text);
-            } else if (isICUMonthSymbol(lastChar)) {
-                String text = dateFormatMonthText();
-                builder.append(text.isEmpty() ? "Month" : text);
-            } else if (isICUDayInMonthSymbol(lastChar)) {
-                String text = dateFormatDayInMonthText();
-                builder.append(text.isEmpty() ? "Day" : text);
-            } else if (lastChar == '\'')
-                inQuote = true;
-            else
-                builder.append(lastChar);
-        }
-    }
-    return builder.toString();
-}
-
-void LocaleICU::initializeLocalizedDateFormatText()
-{
-    if (!m_localizedDateFormatText.isNull())
-        return;
-    m_localizedDateFormatText = emptyString();
-    if (!initializeShortDateFormat())
-        return;
-    m_localizedDateFormatText = localizeFormat(getDateFormatPattern(m_shortDateFormat));
-}
-
-String LocaleICU::dateFormatText()
-{
-    initializeLocalizedDateFormatText();
-    return m_localizedDateFormatText;
-}
 
 PassOwnPtr<Vector<String> > LocaleICU::createLabelVector(const UDateFormat* dateFormat, UDateFormatSymbolType type, int32_t startIndex, int32_t size)
 {
@@ -286,7 +196,9 @@ PassOwnPtr<Vector<String> > LocaleICU::createLabelVector(const UDateFormat* date
     }
     return labels.release();
 }
+#endif
 
+#if ENABLE(CALENDAR_PICKER)
 static PassOwnPtr<Vector<String> > createFallbackWeekDayShortLabels()
 {
     OwnPtr<Vector<String> > labels = adoptPtr(new Vector<String>());
@@ -319,7 +231,7 @@ void LocaleICU::initializeCalendar()
 }
 #endif
 
-#if ENABLE(CALENDAR_PICKER) || ENABLE(INPUT_MULTIPLE_FIELDS_UI)
+#if ENABLE(DATE_AND_TIME_INPUT_TYPES)
 static PassOwnPtr<Vector<String> > createFallbackMonthLabels()
 {
     OwnPtr<Vector<String> > labels = adoptPtr(new Vector<String>());
@@ -363,7 +275,7 @@ bool LocaleICU::isRTL()
 }
 #endif
 
-#if ENABLE(INPUT_MULTIPLE_FIELDS_UI)
+#if ENABLE(DATE_AND_TIME_INPUT_TYPES)
 static PassOwnPtr<Vector<String> > createFallbackAMPMLabels()
 {
     OwnPtr<Vector<String> > labels = adoptPtr(new Vector<String>());
@@ -382,10 +294,10 @@ void LocaleICU::initializeDateTimeFormat()
     // with LDML, because ICU specific pattern character "V" doesn't appear
     // in both medium and short time pattern.
     m_mediumTimeFormat = openDateFormat(UDAT_MEDIUM, UDAT_NONE);
-    m_localizedTimeFormatText = getDateFormatPattern(m_mediumTimeFormat);
+    m_timeFormatWithSeconds = getDateFormatPattern(m_mediumTimeFormat);
 
     m_shortTimeFormat = openDateFormat(UDAT_SHORT, UDAT_NONE);
-    m_localizedShortTimeFormatText = getDateFormatPattern(m_shortTimeFormat);
+    m_timeFormatWithoutSeconds = getDateFormatPattern(m_shortTimeFormat);
 
     OwnPtr<Vector<String> > timeAMPMLabels = createLabelVector(m_mediumTimeFormat, UDAT_AM_PMS, UCAL_AM, 2);
     if (!timeAMPMLabels)
@@ -397,7 +309,7 @@ void LocaleICU::initializeDateTimeFormat()
 
 String LocaleICU::dateFormat()
 {
-    if (!m_dateFormat.isEmpty())
+    if (!m_dateFormat.isNull())
         return m_dateFormat;
     if (!initializeShortDateFormat())
         return ASCIILiteral("dd/MM/yyyy");
@@ -438,13 +350,13 @@ String LocaleICU::monthFormat()
 String LocaleICU::timeFormat()
 {
     initializeDateTimeFormat();
-    return m_localizedTimeFormatText;
+    return m_timeFormatWithSeconds;
 }
 
 String LocaleICU::shortTimeFormat()
 {
     initializeDateTimeFormat();
-    return m_localizedShortTimeFormatText;
+    return m_timeFormatWithoutSeconds;
 }
 
 const Vector<String>& LocaleICU::shortMonthLabels()
diff --git a/Source/WebCore/platform/text/LocaleICU.h b/Source/WebCore/platform/text/LocaleICU.h
index ee80cbfdc..9a8d4bd1d 100644
--- a/Source/WebCore/platform/text/LocaleICU.h
+++ b/Source/WebCore/platform/text/LocaleICU.h
@@ -32,7 +32,7 @@
 #define LocaleICU_h
 
 #include "DateComponents.h"
-#include "Localizer.h"
+#include "PlatformLocale.h"
 #include <unicode/udat.h>
 #include <unicode/unum.h>
 #include <wtf/Forward.h>
@@ -44,28 +44,22 @@ namespace WebCore {
 
 // We should use this class only for LocalizedNumberICU.cpp, LocalizedDateICU.cpp,
 // and LocalizedNumberICUTest.cpp.
-class LocaleICU : public Localizer {
+class LocaleICU : public Locale {
 public:
     static PassOwnPtr<LocaleICU> create(const char* localeString);
     virtual ~LocaleICU();
 
-    // For LocalizedDate
-    virtual double parseDateTime(const String&, DateComponents::Type) OVERRIDE;
 #if ENABLE(CALENDAR_PICKER)
-    virtual String dateFormatText() OVERRIDE;
-
     virtual const Vector<String>& weekDayShortLabels() OVERRIDE;
     virtual unsigned firstDayOfWeek() OVERRIDE;
     virtual bool isRTL() OVERRIDE;
 #endif
-#if ENABLE(CALENDAR_PICKER) || ENABLE(INPUT_MULTIPLE_FIELDS_UI)
-    virtual const Vector<String>& monthLabels() OVERRIDE;
-#endif
-#if ENABLE(INPUT_MULTIPLE_FIELDS_UI)
+#if ENABLE(DATE_AND_TIME_INPUT_TYPES)
     virtual String dateFormat() OVERRIDE;
     virtual String monthFormat() OVERRIDE;
     virtual String timeFormat() OVERRIDE;
     virtual String shortTimeFormat() OVERRIDE;
+    virtual const Vector<String>& monthLabels() OVERRIDE;
     virtual const Vector<String>& shortMonthLabels() OVERRIDE;
     virtual const Vector<String>& standAloneMonthLabels() OVERRIDE;
     virtual const Vector<String>& shortStandAloneMonthLabels() OVERRIDE;
@@ -76,7 +70,7 @@ private:
     explicit LocaleICU(const char*);
     String decimalSymbol(UNumberFormatSymbol);
     String decimalTextAttribute(UNumberFormatTextAttribute);
-    virtual void initializeLocalizerData() OVERRIDE;
+    virtual void initializeLocaleData() OVERRIDE;
 
     bool detectSignAndGetDigitRange(const String& input, bool& isNegative, unsigned& startIndex, unsigned& endIndex);
     unsigned matchedDecimalSymbolIndex(const String& input, unsigned& position);
@@ -85,15 +79,11 @@ private:
     UDateFormat* openDateFormat(UDateFormatStyle timeStyle, UDateFormatStyle dateStyle) const;
 
 #if ENABLE(CALENDAR_PICKER)
-    void initializeLocalizedDateFormatText();
     void initializeCalendar();
 #endif
 
-#if ENABLE(CALENDAR_PICKER) || ENABLE(INPUT_MULTIPLE_FIELDS_UI)
+#if ENABLE(DATE_AND_TIME_INPUT_TYPES)
     PassOwnPtr<Vector<String> > createLabelVector(const UDateFormat*, UDateFormatSymbolType, int32_t startIndex, int32_t size);
-#endif
-
-#if ENABLE(INPUT_MULTIPLE_FIELDS_UI)
     void initializeDateTimeFormat();
 #endif
 
@@ -104,16 +94,15 @@ private:
     bool m_didCreateShortDateFormat;
 
 #if ENABLE(CALENDAR_PICKER)
-    String m_localizedDateFormatText;
     OwnPtr<Vector<String> > m_weekDayShortLabels;
     unsigned m_firstDayOfWeek;
 #endif
-#if ENABLE(CALENDAR_PICKER) || ENABLE(INPUT_MULTIPLE_FIELDS_UI)
+#if ENABLE(DATE_AND_TIME_INPUT_TYPES)
     OwnPtr<Vector<String> > m_monthLabels;
-#endif
-#if ENABLE(INPUT_MULTIPLE_FIELDS_UI)
     String m_dateFormat;
     String m_monthFormat;
+    String m_timeFormatWithSeconds;
+    String m_timeFormatWithoutSeconds;
     UDateFormat* m_mediumTimeFormat;
     UDateFormat* m_shortTimeFormat;
     Vector<String> m_shortMonthLabels;
diff --git a/Source/WebCore/platform/text/LocaleNone.cpp b/Source/WebCore/platform/text/LocaleNone.cpp
index 61173806e..9dc5c00a5 100644
--- a/Source/WebCore/platform/text/LocaleNone.cpp
+++ b/Source/WebCore/platform/text/LocaleNone.cpp
@@ -24,41 +24,39 @@
  */
 
 #include "config.h"
-#include "Localizer.h"
+#include "PlatformLocale.h"
 #include <wtf/DateMath.h>
 #include <wtf/PassOwnPtr.h>
 
 namespace WebCore {
 
-class LocaleNone : public Localizer {
+class LocaleNone : public Locale {
 public:
     virtual ~LocaleNone();
 
 private:
-    virtual void initializeLocalizerData() OVERRIDE FINAL;
-    virtual double parseDateTime(const String&, DateComponents::Type) OVERRIDE;
+    virtual void initializeLocaleData() OVERRIDE FINAL;
 #if ENABLE(CALENDAR_PICKER)
-    virtual String dateFormatText() OVERRIDE;
     virtual bool isRTL() OVERRIDE;
 #endif
-#if ENABLE(CALENDAR_PICKER) || ENABLE(INPUT_MULTIPLE_FIELDS_UI)
-    virtual const Vector<String>& monthLabels() OVERRIDE;
-#endif
-#if ENABLE(INPUT_MULTIPLE_FIELDS_UI)
+#if ENABLE(DATE_AND_TIME_INPUT_TYPES)
     virtual String dateFormat() OVERRIDE;
     virtual String monthFormat() OVERRIDE;
+    virtual String timeFormat() OVERRIDE;
+    virtual String shortTimeFormat() OVERRIDE;
+    virtual const Vector<String>& monthLabels() OVERRIDE;
     virtual const Vector<String>& shortMonthLabels() OVERRIDE;
     virtual const Vector<String>& standAloneMonthLabels() OVERRIDE;
     virtual const Vector<String>& shortStandAloneMonthLabels() OVERRIDE;
+    virtual const Vector<String>& timeAMPMLabels() OVERRIDE;
 
+    Vector<String> m_timeAMPMLabels;
     Vector<String> m_shortMonthLabels;
-#endif
-#if ENABLE(CALENDAR_PICKER) || ENABLE(INPUT_MULTIPLE_FIELDS_UI)
     Vector<String> m_monthLabels;
 #endif
 };
 
-PassOwnPtr<Localizer> Localizer::create(const AtomicString&)
+PassOwnPtr<Locale> Locale::create(const AtomicString&)
 {
     return adoptPtr(new LocaleNone());
 }
@@ -67,28 +65,18 @@ LocaleNone::~LocaleNone()
 {
 }
 
-void LocaleNone::initializeLocalizerData()
+void LocaleNone::initializeLocaleData()
 {
 }
 
-double LocaleNone::parseDateTime(const String&, DateComponents::Type)
-{
-    return std::numeric_limits<double>::quiet_NaN();
-}
-
 #if ENABLE(CALENDAR_PICKER)
-String LocaleNone::dateFormatText()
-{
-    return ASCIILiteral("Year-Month-Day");
-}
-
 bool LocaleNone::isRTL()
 {
     return false;
 }
 #endif
 
-#if ENABLE(CALENDAR_PICKER) || ENABLE(INPUT_MULTIPLE_FIELDS_UI)
+#if ENABLE(DATE_AND_TIME_INPUT_TYPES)
 const Vector<String>& LocaleNone::monthLabels()
 {
     if (!m_monthLabels.isEmpty())
@@ -98,9 +86,7 @@ const Vector<String>& LocaleNone::monthLabels()
         m_monthLabels.append(WTF::monthFullName[i]);
     return m_monthLabels;
 }
-#endif
 
-#if ENABLE(INPUT_MULTIPLE_FIELDS_UI)
 String LocaleNone::dateFormat()
 {
     return ASCIILiteral("dd/MM/yyyyy");
@@ -111,6 +97,16 @@ String LocaleNone::monthFormat()
     return ASCIILiteral("yyyy-MM");
 }
 
+String LocaleNone::timeFormat()
+{
+    return ASCIILiteral("HH:mm:ss");
+}
+
+String LocaleNone::shortTimeFormat()
+{
+    return ASCIILiteral("HH:mm");
+}
+
 const Vector<String>& LocaleNone::shortMonthLabels()
 {
     if (!m_shortMonthLabels.isEmpty())
@@ -130,6 +126,17 @@ const Vector<String>& LocaleNone::standAloneMonthLabels()
 {
     return monthLabels();
 }
+
+const Vector<String>& LocaleNone::timeAMPMLabels()
+{
+    if (!m_timeAMPMLabels.isEmpty())
+        return m_timeAMPMLabels;
+    m_timeAMPMLabels.reserveCapacity(2);
+    m_timeAMPMLabels.append("AM");
+    m_timeAMPMLabels.append("PM");
+    return m_timeAMPMLabels;
+}
+
 #endif
 
 } // namespace WebCore
diff --git a/Source/WebCore/platform/text/LocaleWin.cpp b/Source/WebCore/platform/text/LocaleWin.cpp
deleted file mode 100644
index edefda299..000000000
--- a/Source/WebCore/platform/text/LocaleWin.cpp
+++ /dev/null
@@ -1,839 +0,0 @@
-/*
- * Copyright (C) 2012 Google Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions are
- * met:
- *
- *     * Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- *     * Redistributions in binary form must reproduce the above
- * copyright notice, this list of conditions and the following disclaimer
- * in the documentation and/or other materials provided with the
- * distribution.
- *     * Neither the name of Google Inc. nor the names of its
- * contributors may be used to endorse or promote products derived from
- * this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
- * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "config.h"
-#include "LocaleWin.h"
-
-#include "DateComponents.h"
-#if ENABLE(INPUT_MULTIPLE_FIELDS_UI)
-#include "DateTimeFormat.h"
-#endif
-#include "Language.h"
-#include "LocalizedStrings.h"
-#include <limits>
-#include <windows.h>
-#include <wtf/CurrentTime.h>
-#include <wtf/DateMath.h>
-#include <wtf/OwnPtr.h>
-#include <wtf/PassOwnPtr.h>
-#include <wtf/text/StringBuilder.h>
-
-using namespace std;
-
-namespace WebCore {
-
-typedef LCID (WINAPI* LocaleNameToLCIDPtr)(LPCWSTR, DWORD);
-
-static String extractLanguageCode(const String& locale)
-{
-    size_t dashPosition = locale.find('-');
-    if (dashPosition == notFound)
-        return locale;
-    return locale.left(dashPosition);
-}
-
-static LCID LCIDFromLocaleInternal(LCID userDefaultLCID, const String& userDefaultLanguageCode, LocaleNameToLCIDPtr localeNameToLCID, String& locale)
-{
-    String localeLanguageCode = extractLanguageCode(locale);
-    if (equalIgnoringCase(localeLanguageCode, userDefaultLanguageCode))
-        return userDefaultLCID;
-    return localeNameToLCID(locale.charactersWithNullTermination(), 0);
-}
-
-static LCID LCIDFromLocale(const AtomicString& locale)
-{
-    // LocaleNameToLCID() is available since Windows Vista.
-    LocaleNameToLCIDPtr localeNameToLCID = reinterpret_cast<LocaleNameToLCIDPtr>(::GetProcAddress(::GetModuleHandle(L"kernel32"), "LocaleNameToLCID"));
-    if (!localeNameToLCID)
-        return LOCALE_USER_DEFAULT;
-
-    // According to MSDN, 9 is enough for LOCALE_SISO639LANGNAME.
-    const size_t languageCodeBufferSize = 9;
-    WCHAR lowercaseLanguageCode[languageCodeBufferSize];
-    ::GetLocaleInfo(LOCALE_USER_DEFAULT, LOCALE_SISO639LANGNAME, lowercaseLanguageCode, languageCodeBufferSize);
-    String userDefaultLanguageCode = String(lowercaseLanguageCode);
-
-    LCID lcid = LCIDFromLocaleInternal(LOCALE_USER_DEFAULT, userDefaultLanguageCode, localeNameToLCID, String(locale));
-    if (!lcid)
-        lcid = LCIDFromLocaleInternal(LOCALE_USER_DEFAULT, userDefaultLanguageCode, localeNameToLCID, defaultLanguage());
-    return lcid;
-}
-
-PassOwnPtr<Localizer> Localizer::create(const AtomicString& locale)
-{
-    return LocaleWin::create(LCIDFromLocale(locale));
-}
-
-// Windows doesn't have an API to parse locale-specific date string,
-// and GetDateFormat() and GetDateFormatEx() don't support years older
-// than 1600, which we should support according to the HTML
-// standard. So, we obtain the date format from the system, but we
-// format/parse a date by our own code.
-
-inline LocaleWin::LocaleWin(LCID lcid)
-    : m_lcid(lcid)
-    , m_didInitializeNumberData(false)
-{
-    SYSTEMTIME systemTime;
-    GetLocalTime(&systemTime);
-    m_baseYear = systemTime.wYear;
-
-#if ENABLE(CALENDAR_PICKER)
-    DWORD value = 0;
-    getLocaleInfo(LOCALE_IFIRSTDAYOFWEEK, value);
-    // 0:Monday, ..., 6:Sunday.
-    // We need 1 for Monday, 0 for Sunday.
-    m_firstDayOfWeek = (value + 1) % 7;
-#endif
-}
-
-PassOwnPtr<LocaleWin> LocaleWin::create(LCID lcid)
-{
-    return adoptPtr(new LocaleWin(lcid));
-}
-
-LocaleWin::~LocaleWin()
-{
-}
-
-String LocaleWin::getLocaleInfoString(LCTYPE type)
-{
-    int bufferSizeWithNUL = ::GetLocaleInfo(m_lcid, type, 0, 0);
-    if (bufferSizeWithNUL <= 0)
-        return String();
-    Vector<UChar> buffer(bufferSizeWithNUL);
-    ::GetLocaleInfo(m_lcid, type, buffer.data(), bufferSizeWithNUL);
-    buffer.shrink(bufferSizeWithNUL - 1);
-    return String::adopt(buffer);
-}
-
-void LocaleWin::getLocaleInfo(LCTYPE type, DWORD& result)
-{
-    ::GetLocaleInfo(m_lcid, type | LOCALE_RETURN_NUMBER, reinterpret_cast<LPWSTR>(&result), sizeof(DWORD) / sizeof(TCHAR));
-}
-
-void LocaleWin::ensureShortMonthLabels()
-{
-    if (!m_shortMonthLabels.isEmpty())
-        return;
-    const LCTYPE types[12] = {
-        LOCALE_SABBREVMONTHNAME1,
-        LOCALE_SABBREVMONTHNAME2,
-        LOCALE_SABBREVMONTHNAME3,
-        LOCALE_SABBREVMONTHNAME4,
-        LOCALE_SABBREVMONTHNAME5,
-        LOCALE_SABBREVMONTHNAME6,
-        LOCALE_SABBREVMONTHNAME7,
-        LOCALE_SABBREVMONTHNAME8,
-        LOCALE_SABBREVMONTHNAME9,
-        LOCALE_SABBREVMONTHNAME10,
-        LOCALE_SABBREVMONTHNAME11,
-        LOCALE_SABBREVMONTHNAME12,
-    };
-    m_shortMonthLabels.reserveCapacity(WTF_ARRAY_LENGTH(types));
-    for (unsigned i = 0; i < WTF_ARRAY_LENGTH(types); ++i) {
-        m_shortMonthLabels.append(getLocaleInfoString(types[i]));
-        if (m_shortMonthLabels.last().isEmpty()) {
-            m_shortMonthLabels.shrink(0);
-            m_shortMonthLabels.reserveCapacity(WTF_ARRAY_LENGTH(WTF::monthName));
-            for (unsigned m = 0; m < WTF_ARRAY_LENGTH(WTF::monthName); ++m)
-                m_shortMonthLabels.append(WTF::monthName[m]);
-            return;
-        }
-    }
-}
-
-// -------------------------------- Tokenized date format
-
-struct DateFormatToken {
-    enum Type {
-        Literal,
-        Day1,
-        Day2,
-        Month1,
-        Month2,
-        Month3,
-        Month4,
-        Year1,
-        Year2,
-        Year4,
-    };
-    Type type;
-    String data; // This is valid only if type==Literal.
-
-    DateFormatToken(Type type)
-        : type(type)
-    { }
-
-    DateFormatToken(const String& data)
-        : type(Literal)
-        , data(data)
-    { }
-
-    DateFormatToken(const DateFormatToken& token)
-        : type(token.type)
-        , data(token.data)
-    { }
-};
-
-static inline bool isEraSymbol(UChar letter) { return letter == 'g'; }
-static inline bool isYearSymbol(UChar letter) { return letter == 'y'; }
-static inline bool isMonthSymbol(UChar letter) { return letter == 'M'; }
-static inline bool isDaySymbol(UChar letter) { return letter == 'd'; }
-
-static unsigned countContinuousLetters(const String& format, unsigned index)
-{
-    unsigned count = 1;
-    UChar reference = format[index];
-    while (index + 1 < format.length()) {
-        if (format[++index] != reference)
-            break;
-        ++count;
-    }
-    return count;
-}
-
-static void commitLiteralToken(StringBuilder& literalBuffer, Vector<DateFormatToken>& tokens)
-{
-    if (literalBuffer.length() <= 0)
-        return;
-    tokens.append(DateFormatToken(literalBuffer.toString()));
-    literalBuffer.clear();
-}
-
-// See http://msdn.microsoft.com/en-us/library/dd317787(v=vs.85).aspx
-static Vector<DateFormatToken> parseDateFormat(const String format)
-{
-    Vector<DateFormatToken> tokens;
-    StringBuilder literalBuffer;
-    bool inQuote = false;
-    bool lastQuoteCanBeLiteral = false;
-    for (unsigned i = 0; i < format.length(); ++i) {
-        UChar ch = format[i];
-        if (inQuote) {
-            if (ch == '\'') {
-                inQuote = false;
-                ASSERT(i);
-                if (lastQuoteCanBeLiteral && format[i - 1] == '\'') {
-                    literalBuffer.append('\'');
-                    lastQuoteCanBeLiteral = false;
-                } else
-                    lastQuoteCanBeLiteral = true;
-            } else
-                literalBuffer.append(ch);
-            continue;
-        }
-
-        if (ch == '\'') {
-            inQuote = true;
-            if (lastQuoteCanBeLiteral && i > 0 && format[i - 1] == '\'') {
-                literalBuffer.append(ch);
-                lastQuoteCanBeLiteral = false;
-            } else
-                lastQuoteCanBeLiteral = true;
-        } else if (isYearSymbol(ch)) {
-            commitLiteralToken(literalBuffer, tokens);
-            unsigned count = countContinuousLetters(format, i);
-            i += count - 1;
-            if (count == 1)
-                tokens.append(DateFormatToken(DateFormatToken::Year1));
-            else if (count == 2)
-                tokens.append(DateFormatToken(DateFormatToken::Year2));
-            else
-                tokens.append(DateFormatToken(DateFormatToken::Year4));
-        } else if (isMonthSymbol(ch)) {
-            commitLiteralToken(literalBuffer, tokens);
-            unsigned count = countContinuousLetters(format, i);
-            i += count - 1;
-            if (count == 1)
-                tokens.append(DateFormatToken(DateFormatToken::Month1));
-            else if (count == 2)
-                tokens.append(DateFormatToken(DateFormatToken::Month2));
-            else if (count == 3)
-                tokens.append(DateFormatToken(DateFormatToken::Month3));
-            else
-                tokens.append(DateFormatToken(DateFormatToken::Month4));
-        } else if (isDaySymbol(ch)) {
-            commitLiteralToken(literalBuffer, tokens);
-            unsigned count = countContinuousLetters(format, i);
-            i += count - 1;
-            if (count == 1)
-                tokens.append(DateFormatToken(DateFormatToken::Day1));
-            else
-                tokens.append(DateFormatToken(DateFormatToken::Day2));
-        } else if (isEraSymbol(ch)) {
-            // Just ignore era.
-            // HTML5 date supports only A.D.
-        } else
-            literalBuffer.append(ch);
-    }
-    commitLiteralToken(literalBuffer, tokens);
-    return tokens;
-}
-
-// -------------------------------- Parsing
-
-bool LocaleWin::isLocalizedDigit(UChar ch)
-{
-    String normalizedDigit = convertFromLocalizedNumber(String(&ch, 1));
-    if (normalizedDigit.length() != 1)
-        return false;
-    return isASCIIDigit(normalizedDigit[0]);
-}
-
-// Returns -1 if parsing fails.
-int LocaleWin::parseNumber(const String& input, unsigned& index)
-{
-    unsigned digitsStart = index;
-    while (index < input.length() && isASCIIDigit(input[index]))
-        index++;
-    if (digitsStart != index) {
-        bool ok = false;
-        int number = input.substring(digitsStart, index - digitsStart).toInt(&ok);
-        return ok ? number : -1;
-    }
-
-    while (index < input.length() && isLocalizedDigit(input[index]))
-        index++;
-    if (digitsStart == index)
-        return -1;
-    bool ok = false;
-    int number = convertFromLocalizedNumber(input.substring(digitsStart, index - digitsStart)).toInt(&ok);
-    return ok ? number : -1;
-}
-
-// Returns 0-based month number. Returns -1 if parsing fails.
-int LocaleWin::parseNumberOrMonth(const String& input, unsigned& index)
-{
-    int result = parseNumber(input, index);
-    if (result >= 0) {
-        if (result < 1 || result > 12)
-            return -1;
-        return result - 1;
-    }
-    for (unsigned m = 0; m < m_monthLabels.size(); ++m) {
-        unsigned labelLength = m_monthLabels[m].length();
-        if (equalIgnoringCase(input.substring(index, labelLength), m_monthLabels[m])) {
-            index += labelLength;
-            return m;
-        }
-    }
-    for (unsigned m = 0; m < m_shortMonthLabels.size(); ++m) {
-        unsigned labelLength = m_shortMonthLabels[m].length();
-        if (equalIgnoringCase(input.substring(index, labelLength), m_shortMonthLabels[m])) {
-            index += labelLength;
-            return m;
-        }
-    }
-    return -1;
-}
-
-double LocaleWin::parseDateTime(const String& input, DateComponents::Type type)
-{
-    if (type != DateComponents::Date)
-        return std::numeric_limits<double>::quiet_NaN();
-    ensureShortDateTokens();
-    return parseDate(m_shortDateTokens, m_baseYear, input);
-}
-
-double LocaleWin::parseDate(const String& format, int baseYear, const String& input)
-{
-    return parseDate(parseDateFormat(format), baseYear, input);
-}
-
-double LocaleWin::parseDate(const Vector<DateFormatToken>& tokens, int baseYear, const String& input)
-{
-    ensureShortMonthLabels();
-    ensureMonthLabels();
-    const double NaN = numeric_limits<double>::quiet_NaN();
-    unsigned inputIndex = 0;
-    int day = -1, month = -1, year = -1;
-    for (unsigned i = 0; i < tokens.size(); ++i) {
-        switch (tokens[i].type) {
-        case DateFormatToken::Literal: {
-            String data = tokens[i].data;
-            unsigned literalLength = data.length();
-            if (input.substring(inputIndex, literalLength) == data)
-                inputIndex += literalLength;
-            // Go ahead even if the input doesn't have this string.
-            break;
-        }
-        case DateFormatToken::Day1:
-        case DateFormatToken::Day2:
-            day = parseNumber(input, inputIndex);
-            if (day < 1 || day > 31)
-                return NaN;
-            break;
-        case DateFormatToken::Month1:
-        case DateFormatToken::Month2:
-        case DateFormatToken::Month3:
-        case DateFormatToken::Month4:
-            month = parseNumberOrMonth(input, inputIndex);
-            if (month < 0 || month > 11)
-                return NaN;
-            break;
-        case DateFormatToken::Year1: {
-            unsigned oldIndex = inputIndex;
-            year = parseNumber(input, inputIndex);
-            if (year <= 0)
-                return NaN;
-            if (inputIndex - oldIndex == 1) {
-                int shortYear = baseYear % 10;
-                int decade = baseYear - shortYear;
-                if (shortYear >= 5)
-                    year += shortYear - 4 <= year ? decade : decade + 10;
-                else
-                    year += shortYear + 5 >= year ? decade : decade - 10;
-            }
-            break;
-        }
-        case DateFormatToken::Year2: {
-            unsigned oldIndex = inputIndex;
-            year = parseNumber(input, inputIndex);
-            if (year <= 0)
-                return NaN;
-            if (inputIndex - oldIndex == 2) {
-                int shortYear = baseYear % 100;
-                int century = baseYear - shortYear;
-                if (shortYear >= 50)
-                    year += shortYear - 49 <= year ? century : century + 100;
-                else
-                    year += shortYear + 50 >= year ? century : century - 100;
-            }
-            break;
-        }
-        case DateFormatToken::Year4:
-            year = parseNumber(input, inputIndex);
-            if (year <= 0)
-                return NaN;
-            break;
-        }
-    }
-    if (year <= 0 || month < 0 || day <= 0)
-        return NaN;
-    return dateToDaysFrom1970(year, month, day) * msPerDay;
-}
-
-// -------------------------------- Formatting
-
-void LocaleWin::ensureShortDateTokens()
-{
-    if (!m_shortDateTokens.isEmpty())
-        return;
-    m_shortDateTokens = parseDateFormat(getLocaleInfoString(LOCALE_SSHORTDATE));
-}
-
-static String substituteLabelsIntoFormat(const Vector<DateFormatToken>& tokens, const String& yearText, const String& monthText, const String& dayText)
-{
-    String nonEmptyDayText = dayText.isEmpty() ? "Day" : dayText;
-    String nonEmptyMonthText = monthText.isEmpty() ? "Month" : monthText;
-    String nonEmptyYearText = yearText.isEmpty() ? "Year" : yearText;
-    StringBuilder buffer;
-    for (unsigned i = 0; i < tokens.size(); ++i) {
-        switch (tokens[i].type) {
-        case DateFormatToken::Literal:
-            buffer.append(tokens[i].data);
-            break;
-        case DateFormatToken::Day1:
-        case DateFormatToken::Day2:
-            buffer.append(nonEmptyDayText);
-            break;
-        case DateFormatToken::Month1:
-        case DateFormatToken::Month2:
-        case DateFormatToken::Month3:
-        case DateFormatToken::Month4:
-            buffer.append(nonEmptyMonthText);
-            break;
-        case DateFormatToken::Year1:
-        case DateFormatToken::Year2:
-        case DateFormatToken::Year4:
-            buffer.append(nonEmptyYearText);
-            break;
-        }
-    }
-    return buffer.toString();
-}
-
-String LocaleWin::dateFormatText()
-{
-    ensureShortDateTokens();
-    return substituteLabelsIntoFormat(m_shortDateTokens, dateFormatYearText(), dateFormatMonthText(), dateFormatDayInMonthText());
-}
-
-String LocaleWin::dateFormatText(const String& format, const String& yearText, const String& monthText, const String& dayText)
-{
-    return substituteLabelsIntoFormat(parseDateFormat(format), yearText, monthText, dayText);
-}
-
-void LocaleWin::ensureMonthLabels()
-{
-    if (!m_monthLabels.isEmpty())
-        return;
-    const LCTYPE types[12] = {
-        LOCALE_SMONTHNAME1,
-        LOCALE_SMONTHNAME2,
-        LOCALE_SMONTHNAME3,
-        LOCALE_SMONTHNAME4,
-        LOCALE_SMONTHNAME5,
-        LOCALE_SMONTHNAME6,
-        LOCALE_SMONTHNAME7,
-        LOCALE_SMONTHNAME8,
-        LOCALE_SMONTHNAME9,
-        LOCALE_SMONTHNAME10,
-        LOCALE_SMONTHNAME11,
-        LOCALE_SMONTHNAME12,
-    };
-    m_monthLabels.reserveCapacity(WTF_ARRAY_LENGTH(types));
-    for (unsigned i = 0; i < WTF_ARRAY_LENGTH(types); ++i) {
-        m_monthLabels.append(getLocaleInfoString(types[i]));
-        if (m_monthLabels.last().isEmpty()) {
-            m_monthLabels.shrink(0);
-            m_monthLabels.reserveCapacity(WTF_ARRAY_LENGTH(WTF::monthFullName));
-            for (unsigned m = 0; m < WTF_ARRAY_LENGTH(WTF::monthFullName); ++m)
-                m_monthLabels.append(WTF::monthFullName[m]);
-            return;
-        }
-    }
-}
-
-void LocaleWin::ensureWeekDayShortLabels()
-{
-    if (!m_weekDayShortLabels.isEmpty())
-        return;
-    const LCTYPE types[7] = {
-        LOCALE_SABBREVDAYNAME7, // Sunday
-        LOCALE_SABBREVDAYNAME1, // Monday
-        LOCALE_SABBREVDAYNAME2,
-        LOCALE_SABBREVDAYNAME3,
-        LOCALE_SABBREVDAYNAME4,
-        LOCALE_SABBREVDAYNAME5,
-        LOCALE_SABBREVDAYNAME6
-    };
-    m_weekDayShortLabels.reserveCapacity(WTF_ARRAY_LENGTH(types));
-    for (unsigned i = 0; i < WTF_ARRAY_LENGTH(types); ++i) {
-        m_weekDayShortLabels.append(getLocaleInfoString(types[i]));
-        if (m_weekDayShortLabels.last().isEmpty()) {
-            m_weekDayShortLabels.shrink(0);
-            m_weekDayShortLabels.reserveCapacity(WTF_ARRAY_LENGTH(WTF::weekdayName));
-            for (unsigned w = 0; w < WTF_ARRAY_LENGTH(WTF::weekdayName); ++w) {
-                // weekdayName starts with Monday.
-                m_weekDayShortLabels.append(WTF::weekdayName[(w + 6) % 7]);
-            }
-            return;
-        }
-    }
-}
-
-#if ENABLE(CALENDAR_PICKER) || ENABLE(INPUT_MULTIPLE_FIELDS_UI)
-const Vector<String>& LocaleWin::monthLabels()
-{
-    ensureMonthLabels();
-    return m_monthLabels;
-}
-#endif
-
-#if ENABLE(CALENDAR_PICKER)
-const Vector<String>& LocaleWin::weekDayShortLabels()
-{
-    ensureWeekDayShortLabels();
-    return m_weekDayShortLabels;
-}
-
-unsigned LocaleWin::firstDayOfWeek()
-{
-    return m_firstDayOfWeek;
-}
-
-bool LocaleWin::isRTL()
-{
-    WTF::Unicode::Direction dir = WTF::Unicode::direction(monthLabels()[0][0]);
-    return dir == WTF::Unicode::RightToLeft || dir == WTF::Unicode::RightToLeftArabic;
-}
-#endif
-
-#if ENABLE(INPUT_MULTIPLE_FIELDS_UI)
-static void appendAsLDMLLiteral(const String& literal, StringBuilder& buffer)
-{
-    if (literal.length() <= 0)
-        return;
-    
-    if (literal.find('\'') == notFound) {
-        buffer.append("'");
-        buffer.append(literal);
-        buffer.append("'");
-        return;
-    }
-
-    for (unsigned i = 0; i < literal.length(); ++i) {
-        if (literal[i] == '\'')
-            buffer.append("''");
-        else {
-            String escaped = literal.substring(i);
-            escaped.replace(ASCIILiteral("'"), ASCIILiteral("''"));
-            buffer.append("'");
-            buffer.append(escaped);
-            buffer.append("'");
-            return;
-        }
-    }
-}
-
-static String convertWindowsDateFormatToLDML(const Vector<DateFormatToken>& tokens)
-{
-    StringBuilder buffer;
-    for (unsigned i = 0; i < tokens.size(); ++i) {
-        switch (tokens[i].type) {
-        case DateFormatToken::Literal:
-            appendAsLDMLLiteral(tokens[i].data, buffer);
-            break;
-
-        case DateFormatToken::Day2:
-            buffer.append(static_cast<char>(DateTimeFormat::FieldTypeDayOfMonth));
-            // Fallthrough.
-        case DateFormatToken::Day1:
-            buffer.append(static_cast<char>(DateTimeFormat::FieldTypeDayOfMonth));
-            break;
-
-        case DateFormatToken::Month4:
-            buffer.append(static_cast<char>(DateTimeFormat::FieldTypeMonth));
-            // Fallthrough.
-        case DateFormatToken::Month3:
-            buffer.append(static_cast<char>(DateTimeFormat::FieldTypeMonth));
-            // Fallthrough.
-        case DateFormatToken::Month2:
-            buffer.append(static_cast<char>(DateTimeFormat::FieldTypeMonth));
-            // Fallthrough.
-        case DateFormatToken::Month1:
-            buffer.append(static_cast<char>(DateTimeFormat::FieldTypeMonth));
-            break;
-
-        case DateFormatToken::Year4:
-            buffer.append(static_cast<char>(DateTimeFormat::FieldTypeYear));
-            buffer.append(static_cast<char>(DateTimeFormat::FieldTypeYear));
-            // Fallthrough.
-        case DateFormatToken::Year2:
-            buffer.append(static_cast<char>(DateTimeFormat::FieldTypeYear));
-            // Fallthrough.
-        case DateFormatToken::Year1:
-            buffer.append(static_cast<char>(DateTimeFormat::FieldTypeYear));
-            break;
-        }
-    }
-    return buffer.toString();
-}
-
-static DateTimeFormat::FieldType mapCharacterToDateTimeFieldType(UChar ch)
-{
-    switch (ch) {
-    case 'h':
-        return DateTimeFormat::FieldTypeHour12;
-
-    case 'H':
-        return DateTimeFormat::FieldTypeHour23;
-
-    case 'm':
-        return DateTimeFormat::FieldTypeMinute;
-
-    case 's':
-        return DateTimeFormat::FieldTypeSecond;
-
-    case 't':
-        return DateTimeFormat::FieldTypePeriod;
-
-    default:
-        return DateTimeFormat::FieldTypeLiteral;
-    }
-}
-
-// This class used for converting Windows time pattern format[1] into LDML[2]
-// time format string.
-// [1] http://msdn.microsoft.com/en-us/library/windows/desktop/dd318148(v=vs.85).aspx
-// [2] LDML http://unicode.org/reports/tr35/tr35-6.html#Date_Format_Patterns
-static String convertWindowsTimeFormatToLDML(const String& windowsTimeFormat)
-{
-    StringBuilder builder;
-    int counter = 0;
-    DateTimeFormat::FieldType lastFieldType = DateTimeFormat::FieldTypeLiteral;
-    for (unsigned index = 0; index < windowsTimeFormat.length(); ++index) {
-        UChar const ch = windowsTimeFormat[index];
-        DateTimeFormat::FieldType fieldType = mapCharacterToDateTimeFieldType(ch);
-        if (fieldType == DateTimeFormat::FieldTypeLiteral)
-            builder.append(ch);
-        else if (fieldType == lastFieldType) {
-            ++counter;
-            if (counter == 2 && lastFieldType != DateTimeFormat::FieldTypePeriod)
-                builder.append(static_cast<UChar>(lastFieldType));
-        } else {
-            if (lastFieldType != DateTimeFormat::FieldTypeLiteral)
-                builder.append(static_cast<UChar>(lastFieldType));
-            builder.append(static_cast<UChar>(fieldType));
-            counter = 1;
-        }
-        lastFieldType = fieldType;
-    }
-    return builder.toString();
-}
-
-String LocaleWin::dateFormat()
-{
-    if (!m_dateFormat.isEmpty())
-        return m_dateFormat;
-    ensureShortDateTokens();
-    m_dateFormat = convertWindowsDateFormatToLDML(m_shortDateTokens);
-    return m_dateFormat;
-}
-
-String LocaleWin::dateFormat(const String& windowsFormat)
-{
-    return convertWindowsDateFormatToLDML(parseDateFormat(windowsFormat));
-}
-
-String LocaleWin::monthFormat()
-{
-    if (!m_monthFormat.isNull())
-        return m_monthFormat;
-    m_monthFormat = convertWindowsDateFormatToLDML(parseDateFormat(getLocaleInfoString(LOCALE_SYEARMONTH)));
-    return m_monthFormat;
-}
-
-String LocaleWin::timeFormat()
-{
-    if (m_localizedTimeFormatText.isEmpty())
-        m_localizedTimeFormatText = convertWindowsTimeFormatToLDML(getLocaleInfoString(LOCALE_STIMEFORMAT));
-    return m_localizedTimeFormatText;
-}
-
-// Note: To make XP/Vista and Windows 7/later same behavior, we don't use
-// LOCALE_SSHORTTIME.
-String LocaleWin::shortTimeFormat()
-{
-    return timeFormat();
-}
-
-const Vector<String>& LocaleWin::shortMonthLabels()
-{
-    ensureShortMonthLabels();
-    return m_shortMonthLabels;
-}
-
-const Vector<String>& LocaleWin::standAloneMonthLabels()
-{
-    // Windows doesn't provide a way to get stand-alone month labels.
-    return monthLabels();
-}
-
-const Vector<String>& LocaleWin::shortStandAloneMonthLabels()
-{
-    // Windows doesn't provide a way to get stand-alone month labels.
-    return shortMonthLabels();
-}
-
-const Vector<String>& LocaleWin::timeAMPMLabels()
-{
-    if (m_timeAMPMLabels.isEmpty()) {
-        m_timeAMPMLabels.append(getLocaleInfoString(LOCALE_S1159));
-        m_timeAMPMLabels.append(getLocaleInfoString(LOCALE_S2359));
-    }
-    return m_timeAMPMLabels;
-}
-#endif
-
-void LocaleWin::initializeLocalizerData()
-{
-    if (m_didInitializeNumberData)
-        return;
-
-    Vector<String, DecimalSymbolsSize> symbols;
-    enum DigitSubstitution {
-        DigitSubstitutionContext = 0,
-        DigitSubstitution0to9 = 1,
-        DigitSubstitutionNative = 2,
-    };
-    DWORD digitSubstitution = DigitSubstitution0to9;
-    getLocaleInfo(LOCALE_IDIGITSUBSTITUTION, digitSubstitution);
-    if (digitSubstitution == DigitSubstitution0to9) {
-        symbols.append("0");
-        symbols.append("1");
-        symbols.append("2");
-        symbols.append("3");
-        symbols.append("4");
-        symbols.append("5");
-        symbols.append("6");
-        symbols.append("7");
-        symbols.append("8");
-        symbols.append("9");
-    } else {
-        String digits = getLocaleInfoString(LOCALE_SNATIVEDIGITS);
-        ASSERT(digits.length() >= 10);
-        for (unsigned i = 0; i < 10; ++i)
-            symbols.append(digits.substring(i, 1));
-    }
-    ASSERT(symbols.size() == DecimalSeparatorIndex);
-    symbols.append(getLocaleInfoString(LOCALE_SDECIMAL));
-    ASSERT(symbols.size() == GroupSeparatorIndex);
-    symbols.append(getLocaleInfoString(LOCALE_STHOUSAND));
-    ASSERT(symbols.size() == DecimalSymbolsSize);
-
-    String negativeSign = getLocaleInfoString(LOCALE_SNEGATIVESIGN);
-    enum NegativeFormat {
-        NegativeFormatParenthesis = 0,
-        NegativeFormatSignPrefix = 1,
-        NegativeFormatSignSpacePrefix = 2,
-        NegativeFormatSignSuffix = 3,
-        NegativeFormatSpaceSignSuffix = 4,
-    };
-    DWORD negativeFormat = NegativeFormatSignPrefix;
-    getLocaleInfo(LOCALE_INEGNUMBER, negativeFormat);
-    String negativePrefix = emptyString();
-    String negativeSuffix = emptyString();
-    switch (negativeFormat) {
-    case NegativeFormatParenthesis:
-        negativePrefix = "(";
-        negativeSuffix = ")";
-        break;
-    case NegativeFormatSignSpacePrefix:
-        negativePrefix = negativeSign + " ";
-        break;
-    case NegativeFormatSignSuffix:
-        negativeSuffix = negativeSign;
-        break;
-    case NegativeFormatSpaceSignSuffix:
-        negativeSuffix = " " + negativeSign;
-        break;
-    case NegativeFormatSignPrefix: // Fall through.
-    default:
-        negativePrefix = negativeSign;
-        break;
-    }
-    m_didInitializeNumberData = true;
-    setLocalizerData(symbols, emptyString(), emptyString(), negativePrefix, negativeSuffix);
-}
-
-}
diff --git a/Source/WebCore/platform/text/Localizer.cpp b/Source/WebCore/platform/text/PlatformLocale.cpp
index 9c712b30c..eafdfddcd 100644
--- a/Source/WebCore/platform/text/Localizer.cpp
+++ b/Source/WebCore/platform/text/PlatformLocale.cpp
@@ -29,21 +29,21 @@
  */
 
 #include "config.h"
-#include "Localizer.h"
+#include "PlatformLocale.h"
 
 #include "DateTimeFormat.h"
 #include <wtf/text/StringBuilder.h>
 
 namespace WebCore {
 
-#if ENABLE(INPUT_MULTIPLE_FIELDS_UI)
+#if ENABLE(DATE_AND_TIME_INPUT_TYPES)
 
 class DateTimeStringBuilder : private DateTimeFormat::TokenHandler {
     WTF_MAKE_NONCOPYABLE(DateTimeStringBuilder);
 
 public:
     // The argument objects must be alive until this object dies.
-    DateTimeStringBuilder(Localizer&, const DateComponents&);
+    DateTimeStringBuilder(Locale&, const DateComponents&);
 
     bool build(const String&);
     String toString();
@@ -57,11 +57,11 @@ private:
     void appendNumber(int number, size_t width);
 
     StringBuilder m_builder;
-    Localizer& m_localizer;
+    Locale& m_localizer;
     const DateComponents& m_date;
 };
 
-DateTimeStringBuilder::DateTimeStringBuilder(Localizer& localizer, const DateComponents& date)
+DateTimeStringBuilder::DateTimeStringBuilder(Locale& localizer, const DateComponents& date)
     : m_localizer(localizer)
     , m_date(date)
 {
@@ -159,11 +159,11 @@ String DateTimeStringBuilder::toString()
 
 #endif
 
-Localizer::~Localizer()
+Locale::~Locale()
 {
 }
 
-void Localizer::setLocalizerData(const Vector<String, DecimalSymbolsSize>& symbols, const String& positivePrefix, const String& positiveSuffix, const String& negativePrefix, const String& negativeSuffix)
+void Locale::setLocaleData(const Vector<String, DecimalSymbolsSize>& symbols, const String& positivePrefix, const String& positiveSuffix, const String& negativePrefix, const String& negativeSuffix)
 {
     for (size_t i = 0; i < symbols.size(); ++i) {
         ASSERT(!symbols[i].isEmpty());
@@ -174,13 +174,13 @@ void Localizer::setLocalizerData(const Vector<String, DecimalSymbolsSize>& symbo
     m_negativePrefix = negativePrefix;
     m_negativeSuffix = negativeSuffix;
     ASSERT(!m_positivePrefix.isEmpty() || !m_positiveSuffix.isEmpty() || !m_negativePrefix.isEmpty() || !m_negativeSuffix.isEmpty());
-    m_hasLocalizerData = true;
+    m_hasLocaleData = true;
 }
 
-String Localizer::convertToLocalizedNumber(const String& input)
+String Locale::convertToLocalizedNumber(const String& input)
 {
-    initializeLocalizerData();
-    if (!m_hasLocalizerData || input.isEmpty())
+    initializeLocaleData();
+    if (!m_hasLocaleData || input.isEmpty())
         return input;
 
     unsigned i = 0;
@@ -235,7 +235,7 @@ static bool matches(const String& text, unsigned position, const String& part)
     return true;
 }
 
-bool Localizer::detectSignAndGetDigitRange(const String& input, bool& isNegative, unsigned& startIndex, unsigned& endIndex)
+bool Locale::detectSignAndGetDigitRange(const String& input, bool& isNegative, unsigned& startIndex, unsigned& endIndex)
 {
     startIndex = 0;
     endIndex = input.length();
@@ -263,7 +263,7 @@ bool Localizer::detectSignAndGetDigitRange(const String& input, bool& isNegative
     return true;
 }
 
-unsigned Localizer::matchedDecimalSymbolIndex(const String& input, unsigned& position)
+unsigned Locale::matchedDecimalSymbolIndex(const String& input, unsigned& position)
 {
     for (unsigned symbolIndex = 0; symbolIndex < DecimalSymbolsSize; ++symbolIndex) {
         if (m_decimalSymbols[symbolIndex].length() && matches(input, position, m_decimalSymbols[symbolIndex])) {
@@ -274,11 +274,11 @@ unsigned Localizer::matchedDecimalSymbolIndex(const String& input, unsigned& pos
     return DecimalSymbolsSize;
 }
 
-String Localizer::convertFromLocalizedNumber(const String& localized)
+String Locale::convertFromLocalizedNumber(const String& localized)
 {
-    initializeLocalizerData();
+    initializeLocaleData();
     String input = localized.stripWhiteSpace();
-    if (!m_hasLocalizerData || input.isEmpty())
+    if (!m_hasLocaleData || input.isEmpty())
         return input;
 
     bool isNegative;
@@ -309,29 +309,15 @@ String Localizer::convertFromLocalizedNumber(const String& localized)
 }
 
 #if ENABLE(INPUT_MULTIPLE_FIELDS_UI)
-String Localizer::localizedDecimalSeparator()
+String Locale::localizedDecimalSeparator()
 {
-    initializeLocalizerData();
+    initializeLocaleData();
     return m_decimalSymbols[DecimalSeparatorIndex];
 }
+#endif
 
-String Localizer::timeFormat()
-{
-    if (!m_localizedTimeFormatText.isNull())
-        return m_localizedTimeFormatText;
-    m_localizedTimeFormatText = "hh:mm:ss";
-    return m_localizedTimeFormatText;
-}
-
-String Localizer::shortTimeFormat()
-{
-    if (!m_localizedShortTimeFormatText.isNull())
-        return m_localizedShortTimeFormatText;
-    m_localizedTimeFormatText = "hh:mm";
-    return m_localizedShortTimeFormatText;
-}
-
-String Localizer::dateTimeFormatWithSeconds()
+#if ENABLE(DATE_AND_TIME_INPUT_TYPES)
+String Locale::dateTimeFormatWithSeconds()
 {
     if (!m_dateTimeFormatWithSeconds.isNull())
         return m_dateTimeFormatWithSeconds;
@@ -344,7 +330,7 @@ String Localizer::dateTimeFormatWithSeconds()
     return m_dateTimeFormatWithSeconds;
 }
 
-String Localizer::dateTimeFormatWithoutSeconds()
+String Locale::dateTimeFormatWithoutSeconds()
 {
     if (!m_dateTimeFormatWithoutSeconds.isNull())
         return m_dateTimeFormatWithoutSeconds;
@@ -357,33 +343,19 @@ String Localizer::dateTimeFormatWithoutSeconds()
     return m_dateTimeFormatWithoutSeconds;
 }
 
-const Vector<String>& Localizer::timeAMPMLabels()
+String Locale::formatDateTime(const DateComponents& date, FormatType formatType)
 {
-    if (!m_timeAMPMLabels.isEmpty())
-        return m_timeAMPMLabels;
-    m_timeAMPMLabels.reserveCapacity(2);
-    m_timeAMPMLabels.append("AM");
-    m_timeAMPMLabels.append("PM");
-    return m_timeAMPMLabels;
-}
-#endif
-
-String Localizer::formatDateTime(const DateComponents& date, FormatType formatType)
-{
-#if ENABLE(INPUT_MULTIPLE_FIELDS_UI)
     if (date.type() != DateComponents::Time && date.type() != DateComponents::Date)
         return String();
+    // FIXME: Supports all types.
+
     DateTimeStringBuilder builder(*this, date);
     if (date.type() == DateComponents::Time)
         builder.build(formatType == FormatTypeShort ? shortTimeFormat() : timeFormat());
     else if (date.type() == DateComponents::Date)
         builder.build(dateFormat());
     return builder.toString();
-#else
-    UNUSED_PARAM(date);
-    UNUSED_PARAM(formatType);
-    return String();
-#endif
 }
+#endif
 
 }
diff --git a/Source/WebCore/platform/text/Localizer.h b/Source/WebCore/platform/text/PlatformLocale.h
index b422faab7..358512482 100644
--- a/Source/WebCore/platform/text/Localizer.h
+++ b/Source/WebCore/platform/text/PlatformLocale.h
@@ -23,8 +23,8 @@
  * DAMAGE.
  */
 
-#ifndef Localizer_h
-#define Localizer_h
+#ifndef PlatformLocale_h
+#define PlatformLocale_h
 
 #include "DateComponents.h"
 #include "Language.h"
@@ -33,15 +33,15 @@
 
 namespace WebCore {
 
-class Localizer {
-    WTF_MAKE_NONCOPYABLE(Localizer);
+class Locale {
+    WTF_MAKE_NONCOPYABLE(Locale);
 
 public:
-    static PassOwnPtr<Localizer> create(const AtomicString& localeIdentifier);
-    static PassOwnPtr<Localizer> createDefault();
+    static PassOwnPtr<Locale> create(const AtomicString& localeIdentifier);
+    static PassOwnPtr<Locale> createDefault();
 
     // Converts the specified number string to another number string localized
-    // for this Localizer locale. The input string must conform to HTML
+    // for this Locale locale. The input string must conform to HTML
     // floating-point numbers, and is not empty.
     String convertToLocalizedNumber(const String&);
 
@@ -56,7 +56,9 @@ public:
 #if ENABLE(INPUT_MULTIPLE_FIELDS_UI)
     // Returns localized decimal separator, e.g. "." for English, "," for French.
     String localizedDecimalSeparator();
+#endif
 
+#if ENABLE(DATE_AND_TIME_INPUT_TYPES)
     // Returns date format in Unicode TR35 LDML[1] containing day of month,
     // month, and year, e.g. "dd/mm/yyyy"
     // [1] LDML http://unicode.org/reports/tr35/#Date_Format_Patterns
@@ -68,12 +70,12 @@ public:
     // Returns time format in Unicode TR35 LDML[1] containing hour, minute, and
     // second with optional period(AM/PM), e.g. "h:mm:ss a"
     // [1] LDML http://unicode.org/reports/tr35/#Date_Format_Patterns
-    virtual String timeFormat();
+    virtual String timeFormat() = 0;
 
     // Returns time format in Unicode TR35 LDML containing hour, and minute
     // with optional period(AM/PM), e.g. "h:mm a"
     // Note: Some platforms return same value as timeFormat().
-    virtual String shortTimeFormat();
+    virtual String shortTimeFormat() = 0;
 
     // Returns a date-time format in Unicode TR35 LDML. It should have a seconds
     // field.
@@ -98,10 +100,8 @@ public:
     virtual const Vector<String>& shortStandAloneMonthLabels() = 0;
 
     // Returns localized period field(AM/PM) strings.
-    virtual const Vector<String>& timeAMPMLabels();
-#endif
+    virtual const Vector<String>& timeAMPMLabels() = 0;
 
-#if ENABLE(CALENDAR_PICKER) || ENABLE(INPUT_MULTIPLE_FIELDS_UI)
     // Returns a vector of string of which size is 12. The first item is a
     // localized string of January, and the last item is a localized string of
     // December. These strings should not be abbreviations.
@@ -117,29 +117,21 @@ public:
     // The first day of a week. 0 is Sunday, and 6 is Saturday.
     virtual unsigned firstDayOfWeek() = 0;
 
-    virtual String dateFormatText() = 0;
-
     // Returns true if people use right-to-left writing in the locale for this
     // object.
     virtual bool isRTL() = 0;
 #endif
 
-    // Parses a string representation of a date/time string localized
-    // for this Localizer locale. If the input string is not valid or
-    // an implementation doesn't support localized dates, this
-    // function returns NaN. If the input string is valid this
-    // function returns the number of milliseconds since 1970-01-01
-    // 00:00:00.000 UTC.
-    virtual double parseDateTime(const String&, DateComponents::Type) = 0;
-
+#if ENABLE(DATE_AND_TIME_INPUT_TYPES)
     enum FormatType { FormatTypeUnspecified, FormatTypeShort, FormatTypeMedium };
 
     // Serializes the specified date into a formatted date string to
     // display to the user. If an implementation doesn't support
     // localized dates the function should return an empty string.
     String formatDateTime(const DateComponents&, FormatType = FormatTypeUnspecified);
+#endif
 
-    virtual ~Localizer();
+    virtual ~Locale();
 
 protected:
     enum {
@@ -149,17 +141,14 @@ protected:
         DecimalSymbolsSize
     };
 
-#if ENABLE(INPUT_MULTIPLE_FIELDS_UI)
-    String m_localizedTimeFormatText;
-    String m_localizedShortTimeFormatText;
-    Vector<String> m_timeAMPMLabels;
+#if ENABLE(DATE_AND_TIME_INPUT_TYPES)
     String m_dateTimeFormatWithSeconds;
     String m_dateTimeFormatWithoutSeconds;
 #endif
 
-    Localizer() : m_hasLocalizerData(false) { }
-    virtual void initializeLocalizerData() = 0;
-    void setLocalizerData(const Vector<String, DecimalSymbolsSize>&, const String& positivePrefix, const String& positiveSuffix, const String& negativePrefix, const String& negativeSuffix);
+    Locale() : m_hasLocaleData(false) { }
+    virtual void initializeLocaleData() = 0;
+    void setLocaleData(const Vector<String, DecimalSymbolsSize>&, const String& positivePrefix, const String& positiveSuffix, const String& negativePrefix, const String& negativeSuffix);
 
 private:
     bool detectSignAndGetDigitRange(const String& input, bool& isNegative, unsigned& startIndex, unsigned& endIndex);
@@ -170,12 +159,12 @@ private:
     String m_positiveSuffix;
     String m_negativePrefix;
     String m_negativeSuffix;
-    bool m_hasLocalizerData;
+    bool m_hasLocaleData;
 };
 
-inline PassOwnPtr<Localizer> Localizer::createDefault()
+inline PassOwnPtr<Locale> Locale::createDefault()
 {
-    return Localizer::create(defaultLanguage());
+    return Locale::create(defaultLanguage());
 }
 
 }
diff --git a/Source/WebCore/platform/text/TextEncoding.h b/Source/WebCore/platform/text/TextEncoding.h
index 675625b21..68e397814 100644
--- a/Source/WebCore/platform/text/TextEncoding.h
+++ b/Source/WebCore/platform/text/TextEncoding.h
@@ -50,7 +50,8 @@ namespace WebCore {
                 return str;
             return str->replace('\\', m_backslashAsCurrencySymbol);
         }
-        void displayBuffer(UChar* characters, unsigned len) const
+        template <typename CharacterType>
+        void displayBuffer(CharacterType* characters, unsigned len) const
         {
             if (m_backslashAsCurrencySymbol == '\\')
                 return;
diff --git a/Source/WebCore/platform/text/cf/AtomicStringCF.cpp b/Source/WebCore/platform/text/cf/AtomicStringCF.cpp
new file mode 100644
index 000000000..b17373764
--- /dev/null
+++ b/Source/WebCore/platform/text/cf/AtomicStringCF.cpp
@@ -0,0 +1,56 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include <wtf/text/AtomicString.h>
+
+#if USE(CF)
+
+#include <CoreFoundation/CoreFoundation.h>
+#include <wtf/text/CString.h>
+
+namespace WTF {
+
+PassRefPtr<StringImpl> AtomicString::add(CFStringRef string)
+{
+    if (!string)
+        return 0;
+
+    CFIndex length = CFStringGetLength(string);
+
+    if (const LChar* ptr = reinterpret_cast<const LChar*>(CFStringGetCStringPtr(string, kCFStringEncodingISOLatin1)))
+        return add(ptr, length);
+
+    if (const UniChar* ptr = CFStringGetCharactersPtr(string))
+        return add(reinterpret_cast<const UChar*>(ptr), length);
+
+    Vector<UniChar, 1024> ucharBuffer(length);
+    CFStringGetCharacters(string, CFRangeMake(0, length), ucharBuffer.data());
+    return add(reinterpret_cast<const UChar*>(ucharBuffer.data()), length);
+}
+
+} // namespace WTF
+
+#endif // USE(CF)
diff --git a/Source/WebCore/platform/text/cf/HyphenationCF.cpp b/Source/WebCore/platform/text/cf/HyphenationCF.cpp
index 4e3fced44..1b616eb60 100644
--- a/Source/WebCore/platform/text/cf/HyphenationCF.cpp
+++ b/Source/WebCore/platform/text/cf/HyphenationCF.cpp
@@ -46,8 +46,7 @@ RetainPtr<CFLocaleRef> AtomicStringKeyedMRUCache<RetainPtr<CFLocaleRef> >::creat
 template<>
 RetainPtr<CFLocaleRef> AtomicStringKeyedMRUCache<RetainPtr<CFLocaleRef> >::createValueForKey(const AtomicString& localeIdentifier)
 {
-    RetainPtr<CFStringRef> cfLocaleIdentifier(AdoptCF, localeIdentifier.createCFString());
-    RetainPtr<CFLocaleRef> locale(AdoptCF, CFLocaleCreate(kCFAllocatorDefault, cfLocaleIdentifier.get()));
+    RetainPtr<CFLocaleRef> locale = adoptCF(CFLocaleCreate(kCFAllocatorDefault, localeIdentifier.string().createCFString().get()));
 
     return CFStringIsHyphenationAvailableForLocale(locale.get()) ? locale : 0;
 }
diff --git a/Source/WebCore/platform/text/cf/StringCF.cpp b/Source/WebCore/platform/text/cf/StringCF.cpp
index d7cda7962..2697e76f0 100644
--- a/Source/WebCore/platform/text/cf/StringCF.cpp
+++ b/Source/WebCore/platform/text/cf/StringCF.cpp
@@ -23,8 +23,8 @@
 #include <wtf/text/WTFString.h>
 
 #if USE(CF)
-
 #include <CoreFoundation/CoreFoundation.h>
+#include <wtf/RetainPtr.h>
 
 namespace WTF {
 
@@ -51,7 +51,7 @@ String::String(CFStringRef str)
     }
 }
 
-CFStringRef String::createCFString() const
+RetainPtr<CFStringRef> String::createCFString() const
 {
     if (!m_impl)
         return CFSTR("");
diff --git a/Source/WebCore/platform/text/cf/StringImplCF.cpp b/Source/WebCore/platform/text/cf/StringImplCF.cpp
index 7a2d82e40..1da561b60 100644
--- a/Source/WebCore/platform/text/cf/StringImplCF.cpp
+++ b/Source/WebCore/platform/text/cf/StringImplCF.cpp
@@ -26,6 +26,7 @@
 #include <CoreFoundation/CoreFoundation.h>
 #include <wtf/MainThread.h>
 #include <wtf/PassRefPtr.h>
+#include <wtf/RetainPtr.h>
 #include <wtf/Threading.h>
 
 #if PLATFORM(MAC)
@@ -132,7 +133,7 @@ namespace StringWrapperCFAllocator {
 
 }
 
-CFStringRef StringImpl::createCFString()
+RetainPtr<CFStringRef> StringImpl::createCFString()
 {
     if (!m_length || !isMainThread()) {
         if (is8Bit())
@@ -153,7 +154,7 @@ CFStringRef StringImpl::createCFString()
     // CoreFoundation might not have to allocate anything, we clear currentString in case we did not execute allocate().
     StringWrapperCFAllocator::currentString = 0;
 
-    return string;
+    return adoptCF(string);
 }
 
 // On StringImpl creation we could check if the allocator is the StringWrapperCFAllocator.
diff --git a/Source/WebCore/platform/text/enchant/TextCheckerEnchant.cpp b/Source/WebCore/platform/text/enchant/TextCheckerEnchant.cpp
index d315ee975..28633f15f 100644
--- a/Source/WebCore/platform/text/enchant/TextCheckerEnchant.cpp
+++ b/Source/WebCore/platform/text/enchant/TextCheckerEnchant.cpp
@@ -68,6 +68,10 @@ void TextCheckerEnchant::learnWord(const String& word)
 
 void TextCheckerEnchant::checkSpellingOfString(const String& string, int& misspellingLocation, int& misspellingLength)
 {
+    // Assume that the words in the string are spelled correctly.
+    misspellingLocation = -1;
+    misspellingLength = 0;
+
     if (m_enchantDictionaries.isEmpty())
         return;
 
diff --git a/Source/WebCore/platform/text/mac/LocaleMac.h b/Source/WebCore/platform/text/mac/LocaleMac.h
index a7a72da2e..e363799dc 100644
--- a/Source/WebCore/platform/text/mac/LocaleMac.h
+++ b/Source/WebCore/platform/text/mac/LocaleMac.h
@@ -31,7 +31,7 @@
 #ifndef LocaleMac_h
 #define LocaleMac_h
 
-#include "Localizer.h"
+#include "PlatformLocale.h"
 #include <wtf/Forward.h>
 #include <wtf/RetainPtr.h>
 #include <wtf/Vector.h>
@@ -45,28 +45,24 @@ namespace WebCore {
 
 class DateComponents;
 
-class LocaleMac : public Localizer {
+class LocaleMac : public Locale {
 public:
     static PassOwnPtr<LocaleMac> create(const String&);
     static PassOwnPtr<LocaleMac> create(NSLocale*);
     ~LocaleMac();
-    virtual double parseDateTime(const String&, DateComponents::Type) OVERRIDE;
 
 #if ENABLE(CALENDAR_PICKER)
-    virtual String dateFormatText() OVERRIDE;
     virtual const Vector<String>& weekDayShortLabels() OVERRIDE;
     virtual unsigned firstDayOfWeek() OVERRIDE;
     virtual bool isRTL() OVERRIDE;
 #endif
-#if ENABLE(CALENDAR_PICKER) || ENABLE(INPUT_MULTIPLE_FIELDS_UI)
-    virtual const Vector<String>& monthLabels() OVERRIDE;
-#endif
 
-#if ENABLE(INPUT_MULTIPLE_FIELDS_UI)
+#if ENABLE(DATE_AND_TIME_INPUT_TYPES)
     virtual String dateFormat() OVERRIDE;
     virtual String monthFormat() OVERRIDE;
     virtual String timeFormat() OVERRIDE;
     virtual String shortTimeFormat() OVERRIDE;
+    virtual const Vector<String>& monthLabels() OVERRIDE;
     virtual const Vector<String>& shortMonthLabels() OVERRIDE;
     virtual const Vector<String>& standAloneMonthLabels() OVERRIDE;
     virtual const Vector<String>& shortStandAloneMonthLabels() OVERRIDE;
@@ -76,25 +72,22 @@ public:
 private:
     explicit LocaleMac(NSLocale*);
     RetainPtr<NSDateFormatter> shortDateFormatter();
-    virtual void initializeLocalizerData() OVERRIDE;
+    virtual void initializeLocaleData() OVERRIDE;
 
     RetainPtr<NSLocale> m_locale;
     RetainPtr<NSCalendar> m_gregorianCalendar;
 #if ENABLE(CALENDAR_PICKER)
-    String m_localizedDateFormatText;
     Vector<String> m_weekDayShortLabels;
 #endif
-#if ENABLE(CALENDAR_PICKER) || ENABLE(INPUT_MULTIPLE_FIELDS_UI)
+#if ENABLE(DATE_AND_TIME_INPUT_TYPES)
     Vector<String> m_monthLabels;
-#endif
-#if ENABLE(INPUT_MULTIPLE_FIELDS_UI)
     RetainPtr<NSDateFormatter> timeFormatter();
     RetainPtr<NSDateFormatter> shortTimeFormatter();
 
     String m_dateFormat;
     String m_monthFormat;
-    String m_localizedTimeFormatText;
-    String m_localizedShortTimeFormatText;
+    String m_timeFormatWithSeconds;
+    String m_timeFormatWithoutSeconds;
     Vector<String> m_shortMonthLabels;
     Vector<String> m_standAloneMonthLabels;
     Vector<String> m_shortStandAloneMonthLabels;
diff --git a/Source/WebCore/platform/text/mac/LocaleMac.mm b/Source/WebCore/platform/text/mac/LocaleMac.mm
index bbc86507a..8f99dd219 100644
--- a/Source/WebCore/platform/text/mac/LocaleMac.mm
+++ b/Source/WebCore/platform/text/mac/LocaleMac.mm
@@ -54,20 +54,20 @@ static inline String languageFromLocale(const String& locale)
     return normalizedLocale.left(separatorPosition);
 }
 
-static NSLocale* determineLocale(const String& locale)
+static RetainPtr<NSLocale> determineLocale(const String& locale)
 {
-    NSLocale* currentLocale = [NSLocale currentLocale];
-    String currentLocaleLanguage = languageFromLocale(String([currentLocale localeIdentifier]));
+    RetainPtr<NSLocale> currentLocale = [NSLocale currentLocale];
+    String currentLocaleLanguage = languageFromLocale(String([currentLocale.get() localeIdentifier]));
     String localeLanguage = languageFromLocale(locale);
     if (equalIgnoringCase(currentLocaleLanguage, localeLanguage))
         return currentLocale;
     // It seems initWithLocaleIdentifier accepts dash-separated locale identifier.
-    return [[NSLocale alloc] initWithLocaleIdentifier:locale];
+     return RetainPtr<NSLocale>(AdoptNS, [[NSLocale alloc] initWithLocaleIdentifier:locale]);
 }
 
-PassOwnPtr<Localizer> Localizer::create(const AtomicString& locale)
+PassOwnPtr<Locale> Locale::create(const AtomicString& locale)
 {
-    return LocaleMac::create(determineLocale(locale.string()));
+    return LocaleMac::create(determineLocale(locale.string()).get());
 }
 
 static RetainPtr<NSDateFormatter> createDateTimeFormatter(NSLocale* locale, NSCalendar* calendar, NSDateFormatterStyle dateStyle, NSDateFormatterStyle timeStyle)
@@ -90,7 +90,7 @@ LocaleMac::LocaleMac(NSLocale* locale)
     // NSLocale returns a lower case NSLocaleLanguageCode so we don't have care about case.
     NSString* language = [m_locale.get() objectForKey:NSLocaleLanguageCode];
     if ([availableLanguages indexOfObject:language] == NSNotFound)
-        m_locale = [[NSLocale alloc] initWithLocaleIdentifier:defaultLanguage()];
+        m_locale.adoptNS([[NSLocale alloc] initWithLocaleIdentifier:defaultLanguage()]);
     [m_gregorianCalendar.get() setLocale:m_locale.get()];
 }
 
@@ -100,7 +100,8 @@ LocaleMac::~LocaleMac()
 
 PassOwnPtr<LocaleMac> LocaleMac::create(const String& localeIdentifier)
 {
-    return adoptPtr(new LocaleMac([[NSLocale alloc] initWithLocaleIdentifier:localeIdentifier]));
+    RetainPtr<NSLocale> locale = [[NSLocale alloc] initWithLocaleIdentifier:localeIdentifier];
+    return adoptPtr(new LocaleMac(locale.get()));
 }
 
 PassOwnPtr<LocaleMac> LocaleMac::create(NSLocale* locale)
@@ -113,74 +114,7 @@ RetainPtr<NSDateFormatter> LocaleMac::shortDateFormatter()
     return createDateTimeFormatter(m_locale.get(), m_gregorianCalendar.get(), NSDateFormatterShortStyle, NSDateFormatterNoStyle);
 }
 
-double LocaleMac::parseDateTime(const String& input, DateComponents::Type type)
-{
-    if (type != DateComponents::Date)
-        return std::numeric_limits<double>::quiet_NaN();
-    NSDate *date = [shortDateFormatter().get() dateFromString:input];
-    if (!date)
-        return std::numeric_limits<double>::quiet_NaN();
-    return [date timeIntervalSince1970] * msPerSecond;
-}
-
-#if ENABLE(CALENDAR_PICKER)
-static bool isYearSymbol(UChar letter) { return letter == 'y' || letter == 'Y' || letter == 'u'; }
-static bool isMonthSymbol(UChar letter) { return letter == 'M' || letter == 'L'; }
-static bool isDaySymbol(UChar letter) { return letter == 'd'; }
-
-// http://unicode.org/reports/tr35/tr35-6.html#Date_Format_Patterns
-static String localizeDateFormat(const String& format)
-{
-    String yearText = dateFormatYearText().isEmpty() ? "Year" : dateFormatYearText();
-    String monthText = dateFormatMonthText().isEmpty() ? "Month" : dateFormatMonthText();
-    String dayText = dateFormatDayInMonthText().isEmpty() ? "Day" : dateFormatDayInMonthText();
-    StringBuilder buffer;
-    bool inQuote = false;
-    for (unsigned i = 0; i < format.length(); ++i) {
-        UChar ch = format[i];
-        if (inQuote) {
-            if (ch == '\'') {
-                inQuote = false;
-                ASSERT(i);
-                if (format[i - 1] == '\'')
-                    buffer.append('\'');
-            } else
-                buffer.append(ch);
-            continue;
-        }
-
-        if (ch == '\'') {
-            inQuote = true;
-            if (i > 0 && format[i - 1] == '\'')
-                buffer.append(ch);
-        } else if (isYearSymbol(ch)) {
-            if (i > 0 && format[i - 1] == ch)
-                continue;
-            buffer.append(yearText);
-        } else if (isMonthSymbol(ch)) {
-            if (i > 0 && format[i - 1] == ch)
-                continue;
-            buffer.append(monthText);
-        } else if (isDaySymbol(ch)) {
-            if (i > 0 && format[i - 1] == ch)
-                continue;
-            buffer.append(dayText);
-        } else
-            buffer.append(ch);
-    }
-    return buffer.toString();
-}
-
-String LocaleMac::dateFormatText()
-{
-    if (!m_localizedDateFormatText.isNull())
-        return m_localizedDateFormatText;
-    m_localizedDateFormatText = localizeDateFormat([shortDateFormatter().get() dateFormat]);
-    return  m_localizedDateFormatText;
-}
-#endif
-
-#if ENABLE(CALENDAR_PICKER) || ENABLE(INPUT_MULTIPLE_FIELDS_UI)
+#if ENABLE(DATE_AND_TIME_INPUT_TYPES)
 const Vector<String>& LocaleMac::monthLabels()
 {
     if (!m_monthLabels.isEmpty())
@@ -231,7 +165,7 @@ bool LocaleMac::isRTL()
 }
 #endif
 
-#if ENABLE(INPUT_MULTIPLE_FIELDS_UI)
+#if ENABLE(DATE_AND_TIME_INPUT_TYPES)
 RetainPtr<NSDateFormatter> LocaleMac::timeFormatter()
 {
     return createDateTimeFormatter(m_locale.get(), m_gregorianCalendar.get(), NSDateFormatterNoStyle, NSDateFormatterMediumStyle);
@@ -262,18 +196,18 @@ String LocaleMac::monthFormat()
 
 String LocaleMac::timeFormat()
 {
-    if (!m_localizedTimeFormatText.isNull())
-        return m_localizedTimeFormatText;
-    m_localizedTimeFormatText = [timeFormatter().get() dateFormat];
-    return m_localizedTimeFormatText;
+    if (!m_timeFormatWithSeconds.isNull())
+        return m_timeFormatWithSeconds;
+    m_timeFormatWithSeconds = [timeFormatter().get() dateFormat];
+    return m_timeFormatWithSeconds;
 }
 
 String LocaleMac::shortTimeFormat()
 {
-    if (!m_localizedShortTimeFormatText.isNull())
-        return m_localizedShortTimeFormatText;
-    m_localizedShortTimeFormatText = [shortTimeFormatter().get() dateFormat];
-    return m_localizedShortTimeFormatText;
+    if (!m_timeFormatWithoutSeconds.isNull())
+        return m_timeFormatWithoutSeconds;
+    m_timeFormatWithoutSeconds = [shortTimeFormatter().get() dateFormat];
+    return m_timeFormatWithoutSeconds;
 }
 
 const Vector<String>& LocaleMac::shortMonthLabels()
@@ -334,7 +268,7 @@ const Vector<String>& LocaleMac::timeAMPMLabels()
 }
 #endif
 
-void LocaleMac::initializeLocalizerData()
+void LocaleMac::initializeLocaleData()
 {
     if (m_didInitializeNumberData)
         return;
@@ -362,7 +296,7 @@ void LocaleMac::initializeLocalizerData()
     String positiveSuffix([formatter.get() positiveSuffix]);
     String negativePrefix([formatter.get() negativePrefix]);
     String negativeSuffix([formatter.get() negativeSuffix]);
-    setLocalizerData(symbols, positivePrefix, positiveSuffix, negativePrefix, negativeSuffix);
+    setLocaleData(symbols, positivePrefix, positiveSuffix, negativePrefix, negativeSuffix);
 }
 
 }
diff --git a/Source/WebCore/platform/text/mac/StringImplMac.mm b/Source/WebCore/platform/text/mac/StringImplMac.mm
index 6f5e953ba..2f088a7eb 100644
--- a/Source/WebCore/platform/text/mac/StringImplMac.mm
+++ b/Source/WebCore/platform/text/mac/StringImplMac.mm
@@ -22,12 +22,13 @@
 #include <wtf/text/StringImpl.h>
 
 #include "FoundationExtras.h"
+#include <wtf/RetainPtr.h>
 
 namespace WTF {
 
 StringImpl::operator NSString *()
 {
-    return HardAutorelease(createCFString());
+    return HardAutorelease(createCFString().leakRef());
 }
 
 }
diff --git a/Source/WebCore/platform/text/mac/TextCodecMac.cpp b/Source/WebCore/platform/text/mac/TextCodecMac.cpp
index 312412faa..a70474952 100644
--- a/Source/WebCore/platform/text/mac/TextCodecMac.cpp
+++ b/Source/WebCore/platform/text/mac/TextCodecMac.cpp
@@ -284,7 +284,7 @@ CString TextCodecMac::encode(const UChar* characters, size_t length, Unencodable
     // Encoding will change the yen sign back into a backslash.
     String copy(characters, length);
     copy.replace('\\', m_backslashAsCurrencySymbol);
-    RetainPtr<CFStringRef> cfs(AdoptCF, copy.createCFString());
+    RetainPtr<CFStringRef> cfs = copy.createCFString();
 
     CFIndex startPos = 0;
     CFIndex charactersLeft = CFStringGetLength(cfs.get());
diff --git a/Source/WebCore/platform/text/win/LocaleWin.cpp b/Source/WebCore/platform/text/win/LocaleWin.cpp
new file mode 100644
index 000000000..924b7d3dd
--- /dev/null
+++ b/Source/WebCore/platform/text/win/LocaleWin.cpp
@@ -0,0 +1,492 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "LocaleWin.h"
+
+#include "DateComponents.h"
+#include "DateTimeFormat.h"
+#include "Language.h"
+#include "LocalizedStrings.h"
+#include <limits>
+#include <windows.h>
+#include <wtf/CurrentTime.h>
+#include <wtf/DateMath.h>
+#include <wtf/OwnPtr.h>
+#include <wtf/PassOwnPtr.h>
+#include <wtf/text/StringBuilder.h>
+
+using namespace std;
+
+namespace WebCore {
+
+typedef LCID (WINAPI* LocaleNameToLCIDPtr)(LPCWSTR, DWORD);
+
+static String extractLanguageCode(const String& locale)
+{
+    size_t dashPosition = locale.find('-');
+    if (dashPosition == notFound)
+        return locale;
+    return locale.left(dashPosition);
+}
+
+static LCID LCIDFromLocaleInternal(LCID userDefaultLCID, const String& userDefaultLanguageCode, LocaleNameToLCIDPtr localeNameToLCID, String& locale)
+{
+    String localeLanguageCode = extractLanguageCode(locale);
+    if (equalIgnoringCase(localeLanguageCode, userDefaultLanguageCode))
+        return userDefaultLCID;
+    return localeNameToLCID(locale.charactersWithNullTermination(), 0);
+}
+
+static LCID LCIDFromLocale(const AtomicString& locale)
+{
+    // LocaleNameToLCID() is available since Windows Vista.
+    LocaleNameToLCIDPtr localeNameToLCID = reinterpret_cast<LocaleNameToLCIDPtr>(::GetProcAddress(::GetModuleHandle(L"kernel32"), "LocaleNameToLCID"));
+    if (!localeNameToLCID)
+        return LOCALE_USER_DEFAULT;
+
+    // According to MSDN, 9 is enough for LOCALE_SISO639LANGNAME.
+    const size_t languageCodeBufferSize = 9;
+    WCHAR lowercaseLanguageCode[languageCodeBufferSize];
+    ::GetLocaleInfo(LOCALE_USER_DEFAULT, LOCALE_SISO639LANGNAME, lowercaseLanguageCode, languageCodeBufferSize);
+    String userDefaultLanguageCode = String(lowercaseLanguageCode);
+
+    LCID lcid = LCIDFromLocaleInternal(LOCALE_USER_DEFAULT, userDefaultLanguageCode, localeNameToLCID, String(locale));
+    if (!lcid)
+        lcid = LCIDFromLocaleInternal(LOCALE_USER_DEFAULT, userDefaultLanguageCode, localeNameToLCID, defaultLanguage());
+    return lcid;
+}
+
+PassOwnPtr<Locale> Locale::create(const AtomicString& locale)
+{
+    return LocaleWin::create(LCIDFromLocale(locale));
+}
+
+inline LocaleWin::LocaleWin(LCID lcid)
+    : m_lcid(lcid)
+    , m_didInitializeNumberData(false)
+{
+#if ENABLE(CALENDAR_PICKER)
+    DWORD value = 0;
+    getLocaleInfo(LOCALE_IFIRSTDAYOFWEEK, value);
+    // 0:Monday, ..., 6:Sunday.
+    // We need 1 for Monday, 0 for Sunday.
+    m_firstDayOfWeek = (value + 1) % 7;
+#endif
+}
+
+PassOwnPtr<LocaleWin> LocaleWin::create(LCID lcid)
+{
+    return adoptPtr(new LocaleWin(lcid));
+}
+
+LocaleWin::~LocaleWin()
+{
+}
+
+String LocaleWin::getLocaleInfoString(LCTYPE type)
+{
+    int bufferSizeWithNUL = ::GetLocaleInfo(m_lcid, type, 0, 0);
+    if (bufferSizeWithNUL <= 0)
+        return String();
+    Vector<UChar> buffer(bufferSizeWithNUL);
+    ::GetLocaleInfo(m_lcid, type, buffer.data(), bufferSizeWithNUL);
+    buffer.shrink(bufferSizeWithNUL - 1);
+    return String::adopt(buffer);
+}
+
+void LocaleWin::getLocaleInfo(LCTYPE type, DWORD& result)
+{
+    ::GetLocaleInfo(m_lcid, type | LOCALE_RETURN_NUMBER, reinterpret_cast<LPWSTR>(&result), sizeof(DWORD) / sizeof(TCHAR));
+}
+
+void LocaleWin::ensureShortMonthLabels()
+{
+    if (!m_shortMonthLabels.isEmpty())
+        return;
+    const LCTYPE types[12] = {
+        LOCALE_SABBREVMONTHNAME1,
+        LOCALE_SABBREVMONTHNAME2,
+        LOCALE_SABBREVMONTHNAME3,
+        LOCALE_SABBREVMONTHNAME4,
+        LOCALE_SABBREVMONTHNAME5,
+        LOCALE_SABBREVMONTHNAME6,
+        LOCALE_SABBREVMONTHNAME7,
+        LOCALE_SABBREVMONTHNAME8,
+        LOCALE_SABBREVMONTHNAME9,
+        LOCALE_SABBREVMONTHNAME10,
+        LOCALE_SABBREVMONTHNAME11,
+        LOCALE_SABBREVMONTHNAME12,
+    };
+    m_shortMonthLabels.reserveCapacity(WTF_ARRAY_LENGTH(types));
+    for (unsigned i = 0; i < WTF_ARRAY_LENGTH(types); ++i) {
+        m_shortMonthLabels.append(getLocaleInfoString(types[i]));
+        if (m_shortMonthLabels.last().isEmpty()) {
+            m_shortMonthLabels.shrink(0);
+            m_shortMonthLabels.reserveCapacity(WTF_ARRAY_LENGTH(WTF::monthName));
+            for (unsigned m = 0; m < WTF_ARRAY_LENGTH(WTF::monthName); ++m)
+                m_shortMonthLabels.append(WTF::monthName[m]);
+            return;
+        }
+    }
+}
+
+// -------------------------------- Tokenized date format
+
+static unsigned countContinuousLetters(const String& format, unsigned index)
+{
+    unsigned count = 1;
+    UChar reference = format[index];
+    while (index + 1 < format.length()) {
+        if (format[++index] != reference)
+            break;
+        ++count;
+    }
+    return count;
+}
+
+static void commitLiteralToken(StringBuilder& literalBuffer, StringBuilder& converted)
+{
+    if (literalBuffer.length() <= 0)
+        return;
+    DateTimeFormat::quoteAndAppendLiteral(literalBuffer.toString(), converted);
+    literalBuffer.clear();
+}
+
+// This function converts Windows date/time pattern format [1][2] into LDML date
+// format pattern [3].
+//
+// i.e.
+//   We set h, H, m, s, d, dd, M, or y as is. They have same meaning in both of
+//   Windows and LDML.
+//   We need to convert the following patterns:
+//     t -> a
+//     tt -> a
+//     ddd -> EEE
+//     dddd -> EEEE
+//     g -> G
+//     gg -> ignore
+//
+// [1] http://msdn.microsoft.com/en-us/library/dd317787(v=vs.85).aspx
+// [2] http://msdn.microsoft.com/en-us/library/dd318148(v=vs.85).aspx
+// [3] LDML http://unicode.org/reports/tr35/tr35-6.html#Date_Format_Patterns
+static String convertWindowsDateTimeFormat(const String& format)
+{
+    StringBuilder converted;
+    StringBuilder literalBuffer;
+    bool inQuote = false;
+    bool lastQuoteCanBeLiteral = false;
+    for (unsigned i = 0; i < format.length(); ++i) {
+        UChar ch = format[i];
+        if (inQuote) {
+            if (ch == '\'') {
+                inQuote = false;
+                ASSERT(i);
+                if (lastQuoteCanBeLiteral && format[i - 1] == '\'') {
+                    literalBuffer.append('\'');
+                    lastQuoteCanBeLiteral = false;
+                } else
+                    lastQuoteCanBeLiteral = true;
+            } else
+                literalBuffer.append(ch);
+            continue;
+        }
+
+        if (ch == '\'') {
+            inQuote = true;
+            if (lastQuoteCanBeLiteral && i > 0 && format[i - 1] == '\'') {
+                literalBuffer.append(ch);
+                lastQuoteCanBeLiteral = false;
+            } else
+                lastQuoteCanBeLiteral = true;
+        } else if (isASCIIAlpha(ch)) {
+            commitLiteralToken(literalBuffer, converted);
+            unsigned symbolStart = i;
+            unsigned count = countContinuousLetters(format, i);
+            i += count - 1;
+            if (ch == 'h' || ch == 'H' || ch == 'm' || ch == 's' || ch == 'M' || ch == 'y')
+                converted.append(format, symbolStart, count);
+            else if (ch == 'd') {
+                if (count <= 2)
+                    converted.append(format, symbolStart, count);
+                else if (count == 3)
+                    converted.append("EEE");
+                else
+                    converted.append("EEEE");
+            } else if (ch == 'g') {
+                if (count == 1)
+                    converted.append('G');
+                else {
+                    // gg means imperial era in Windows.
+                    // Just ignore it.
+                }
+            } else if (ch == 't')
+                converted.append('a');
+            else
+                literalBuffer.append(format, symbolStart, count);
+        } else
+            literalBuffer.append(ch);
+    }
+    commitLiteralToken(literalBuffer, converted);
+    return converted.toString();
+}
+
+void LocaleWin::ensureMonthLabels()
+{
+    if (!m_monthLabels.isEmpty())
+        return;
+    const LCTYPE types[12] = {
+        LOCALE_SMONTHNAME1,
+        LOCALE_SMONTHNAME2,
+        LOCALE_SMONTHNAME3,
+        LOCALE_SMONTHNAME4,
+        LOCALE_SMONTHNAME5,
+        LOCALE_SMONTHNAME6,
+        LOCALE_SMONTHNAME7,
+        LOCALE_SMONTHNAME8,
+        LOCALE_SMONTHNAME9,
+        LOCALE_SMONTHNAME10,
+        LOCALE_SMONTHNAME11,
+        LOCALE_SMONTHNAME12,
+    };
+    m_monthLabels.reserveCapacity(WTF_ARRAY_LENGTH(types));
+    for (unsigned i = 0; i < WTF_ARRAY_LENGTH(types); ++i) {
+        m_monthLabels.append(getLocaleInfoString(types[i]));
+        if (m_monthLabels.last().isEmpty()) {
+            m_monthLabels.shrink(0);
+            m_monthLabels.reserveCapacity(WTF_ARRAY_LENGTH(WTF::monthFullName));
+            for (unsigned m = 0; m < WTF_ARRAY_LENGTH(WTF::monthFullName); ++m)
+                m_monthLabels.append(WTF::monthFullName[m]);
+            return;
+        }
+    }
+}
+
+void LocaleWin::ensureWeekDayShortLabels()
+{
+    if (!m_weekDayShortLabels.isEmpty())
+        return;
+    const LCTYPE types[7] = {
+        LOCALE_SABBREVDAYNAME7, // Sunday
+        LOCALE_SABBREVDAYNAME1, // Monday
+        LOCALE_SABBREVDAYNAME2,
+        LOCALE_SABBREVDAYNAME3,
+        LOCALE_SABBREVDAYNAME4,
+        LOCALE_SABBREVDAYNAME5,
+        LOCALE_SABBREVDAYNAME6
+    };
+    m_weekDayShortLabels.reserveCapacity(WTF_ARRAY_LENGTH(types));
+    for (unsigned i = 0; i < WTF_ARRAY_LENGTH(types); ++i) {
+        m_weekDayShortLabels.append(getLocaleInfoString(types[i]));
+        if (m_weekDayShortLabels.last().isEmpty()) {
+            m_weekDayShortLabels.shrink(0);
+            m_weekDayShortLabels.reserveCapacity(WTF_ARRAY_LENGTH(WTF::weekdayName));
+            for (unsigned w = 0; w < WTF_ARRAY_LENGTH(WTF::weekdayName); ++w) {
+                // weekdayName starts with Monday.
+                m_weekDayShortLabels.append(WTF::weekdayName[(w + 6) % 7]);
+            }
+            return;
+        }
+    }
+}
+
+#if ENABLE(DATE_AND_TIME_INPUT_TYPES)
+const Vector<String>& LocaleWin::monthLabels()
+{
+    ensureMonthLabels();
+    return m_monthLabels;
+}
+#endif
+
+#if ENABLE(CALENDAR_PICKER)
+const Vector<String>& LocaleWin::weekDayShortLabels()
+{
+    ensureWeekDayShortLabels();
+    return m_weekDayShortLabels;
+}
+
+unsigned LocaleWin::firstDayOfWeek()
+{
+    return m_firstDayOfWeek;
+}
+
+bool LocaleWin::isRTL()
+{
+    WTF::Unicode::Direction dir = WTF::Unicode::direction(monthLabels()[0][0]);
+    return dir == WTF::Unicode::RightToLeft || dir == WTF::Unicode::RightToLeftArabic;
+}
+#endif
+
+#if ENABLE(DATE_AND_TIME_INPUT_TYPES)
+String LocaleWin::dateFormat()
+{
+    if (m_dateFormat.isNull())
+        m_dateFormat = convertWindowsDateTimeFormat(getLocaleInfoString(LOCALE_SSHORTDATE));
+    return m_dateFormat;
+}
+
+String LocaleWin::dateFormat(const String& windowsFormat)
+{
+    return convertWindowsDateTimeFormat(windowsFormat);
+}
+
+String LocaleWin::monthFormat()
+{
+    if (m_monthFormat.isNull())
+        m_monthFormat = convertWindowsDateTimeFormat(getLocaleInfoString(LOCALE_SYEARMONTH));
+    return m_monthFormat;
+}
+
+String LocaleWin::timeFormat()
+{
+    if (m_timeFormatWithSeconds.isNull())
+        m_timeFormatWithSeconds = convertWindowsDateTimeFormat(getLocaleInfoString(LOCALE_STIMEFORMAT));
+    return m_timeFormatWithSeconds;
+}
+
+String LocaleWin::shortTimeFormat()
+{
+    if (!m_timeFormatWithoutSeconds.isNull())
+        return m_timeFormatWithoutSeconds;
+    String format = getLocaleInfoString(LOCALE_SSHORTTIME);
+    // Vista or older Windows doesn't support LOCALE_SSHORTTIME.
+    if (format.isEmpty()) {
+        format = timeFormat();
+        StringBuilder builder;
+        builder.append(getLocaleInfoString(LOCALE_STIME));
+        builder.append("ss");
+        size_t pos = format.reverseFind(builder.toString());
+        if (pos != notFound)
+            format.remove(pos, builder.length());
+    }
+    m_timeFormatWithoutSeconds = convertWindowsDateTimeFormat(format);
+    return m_timeFormatWithoutSeconds;
+}
+
+const Vector<String>& LocaleWin::shortMonthLabels()
+{
+    ensureShortMonthLabels();
+    return m_shortMonthLabels;
+}
+
+const Vector<String>& LocaleWin::standAloneMonthLabels()
+{
+    // Windows doesn't provide a way to get stand-alone month labels.
+    return monthLabels();
+}
+
+const Vector<String>& LocaleWin::shortStandAloneMonthLabels()
+{
+    // Windows doesn't provide a way to get stand-alone month labels.
+    return shortMonthLabels();
+}
+
+const Vector<String>& LocaleWin::timeAMPMLabels()
+{
+    if (m_timeAMPMLabels.isEmpty()) {
+        m_timeAMPMLabels.append(getLocaleInfoString(LOCALE_S1159));
+        m_timeAMPMLabels.append(getLocaleInfoString(LOCALE_S2359));
+    }
+    return m_timeAMPMLabels;
+}
+#endif
+
+void LocaleWin::initializeLocaleData()
+{
+    if (m_didInitializeNumberData)
+        return;
+
+    Vector<String, DecimalSymbolsSize> symbols;
+    enum DigitSubstitution {
+        DigitSubstitutionContext = 0,
+        DigitSubstitution0to9 = 1,
+        DigitSubstitutionNative = 2,
+    };
+    DWORD digitSubstitution = DigitSubstitution0to9;
+    getLocaleInfo(LOCALE_IDIGITSUBSTITUTION, digitSubstitution);
+    if (digitSubstitution == DigitSubstitution0to9) {
+        symbols.append("0");
+        symbols.append("1");
+        symbols.append("2");
+        symbols.append("3");
+        symbols.append("4");
+        symbols.append("5");
+        symbols.append("6");
+        symbols.append("7");
+        symbols.append("8");
+        symbols.append("9");
+    } else {
+        String digits = getLocaleInfoString(LOCALE_SNATIVEDIGITS);
+        ASSERT(digits.length() >= 10);
+        for (unsigned i = 0; i < 10; ++i)
+            symbols.append(digits.substring(i, 1));
+    }
+    ASSERT(symbols.size() == DecimalSeparatorIndex);
+    symbols.append(getLocaleInfoString(LOCALE_SDECIMAL));
+    ASSERT(symbols.size() == GroupSeparatorIndex);
+    symbols.append(getLocaleInfoString(LOCALE_STHOUSAND));
+    ASSERT(symbols.size() == DecimalSymbolsSize);
+
+    String negativeSign = getLocaleInfoString(LOCALE_SNEGATIVESIGN);
+    enum NegativeFormat {
+        NegativeFormatParenthesis = 0,
+        NegativeFormatSignPrefix = 1,
+        NegativeFormatSignSpacePrefix = 2,
+        NegativeFormatSignSuffix = 3,
+        NegativeFormatSpaceSignSuffix = 4,
+    };
+    DWORD negativeFormat = NegativeFormatSignPrefix;
+    getLocaleInfo(LOCALE_INEGNUMBER, negativeFormat);
+    String negativePrefix = emptyString();
+    String negativeSuffix = emptyString();
+    switch (negativeFormat) {
+    case NegativeFormatParenthesis:
+        negativePrefix = "(";
+        negativeSuffix = ")";
+        break;
+    case NegativeFormatSignSpacePrefix:
+        negativePrefix = negativeSign + " ";
+        break;
+    case NegativeFormatSignSuffix:
+        negativeSuffix = negativeSign;
+        break;
+    case NegativeFormatSpaceSignSuffix:
+        negativeSuffix = " " + negativeSign;
+        break;
+    case NegativeFormatSignPrefix: // Fall through.
+    default:
+        negativePrefix = negativeSign;
+        break;
+    }
+    m_didInitializeNumberData = true;
+    setLocaleData(symbols, emptyString(), emptyString(), negativePrefix, negativeSuffix);
+}
+
+}
diff --git a/Source/WebCore/platform/text/LocaleWin.h b/Source/WebCore/platform/text/win/LocaleWin.h
index 0c300abde..ce64d2327 100644
--- a/Source/WebCore/platform/text/LocaleWin.h
+++ b/Source/WebCore/platform/text/win/LocaleWin.h
@@ -31,7 +31,7 @@
 #ifndef LocaleWin_h
 #define LocaleWin_h
 
-#include "Localizer.h"
+#include "PlatformLocale.h"
 #include <windows.h>
 #include <wtf/Forward.h>
 #include <wtf/Vector.h>
@@ -42,36 +42,26 @@ namespace WebCore {
 class DateComponents;
 struct DateFormatToken;
 
-class LocaleWin : public Localizer {
+class LocaleWin : public Locale {
 public:
     static PassOwnPtr<LocaleWin> create(LCID);
     ~LocaleWin();
-    virtual double parseDateTime(const String&, DateComponents::Type) OVERRIDE;
 #if ENABLE(CALENDAR_PICKER)
-    virtual String dateFormatText() OVERRIDE;
     virtual const Vector<String>& weekDayShortLabels() OVERRIDE;
     virtual unsigned firstDayOfWeek() OVERRIDE;
     virtual bool isRTL() OVERRIDE;
 #endif
-#if ENABLE(CALENDAR_PICKER) || ENABLE(INPUT_MULTIPLE_FIELDS_UI)
-    virtual const Vector<String>& monthLabels() OVERRIDE;
-#endif
-#if ENABLE(INPUT_MULTIPLE_FIELDS_UI)
+#if ENABLE(DATE_AND_TIME_INPUT_TYPES)
     virtual String dateFormat() OVERRIDE;
     virtual String monthFormat() OVERRIDE;
     virtual String timeFormat() OVERRIDE;
     virtual String shortTimeFormat() OVERRIDE;
+    virtual const Vector<String>& monthLabels() OVERRIDE;
     virtual const Vector<String>& shortMonthLabels() OVERRIDE;
     virtual const Vector<String>& standAloneMonthLabels() OVERRIDE;
     virtual const Vector<String>& shortStandAloneMonthLabels() OVERRIDE;
     virtual const Vector<String>& timeAMPMLabels() OVERRIDE;
-#endif
 
-    // For testing.
-    double parseDate(const String& format, int baseYear, const String& input);
-    String formatDate(const String& format, int baseYear, int year, int month, int day);
-    static String dateFormatText(const String& format, const String& yearText, const String& monthText, const String& dayText);
-#if ENABLE(INPUT_MULTIPLE_FIELDS_UI)
     static String dateFormat(const String&);
 #endif
 
@@ -81,29 +71,21 @@ private:
     void getLocaleInfo(LCTYPE, DWORD&);
     void ensureShortMonthLabels();
     void ensureMonthLabels();
-    void ensureShortDateTokens();
-    bool isLocalizedDigit(UChar);
-    int parseNumber(const String&, unsigned& index);
-    int parseNumberOrMonth(const String&, unsigned& index);
-    double parseDate(const Vector<DateFormatToken>&, int baseYear, const String&);
-    void appendNumber(int, StringBuilder&);
-    void appendTwoDigitsNumber(int, StringBuilder&);
-    void appendFourDigitsNumber(int, StringBuilder&);
-    String formatDate(const Vector<DateFormatToken>&, int baseYear, int year, int month, int day);
 #if ENABLE(CALENDAR_PICKER)
     void ensureWeekDayShortLabels();
 #endif
-    // Localizer function:
-    virtual void initializeLocalizerData() OVERRIDE;
+    // Locale function:
+    virtual void initializeLocaleData() OVERRIDE;
 
     LCID m_lcid;
-    int m_baseYear;
-    Vector<DateFormatToken> m_shortDateTokens;
+#if ENABLE(DATE_AND_TIME_INPUT_TYPES)
     Vector<String> m_shortMonthLabels;
     Vector<String> m_monthLabels;
-#if ENABLE(INPUT_MULTIPLE_FIELDS_UI)
     String m_dateFormat;
     String m_monthFormat;
+    String m_timeFormatWithSeconds;
+    String m_timeFormatWithoutSeconds;
+    Vector<String> m_timeAMPMLabels;
 #endif
 #if ENABLE(CALENDAR_PICKER)
     Vector<String> m_weekDayShortLabels;
diff --git a/Source/WebCore/platform/win/PopupMenuWin.cpp b/Source/WebCore/platform/win/PopupMenuWin.cpp
index b8d7f19fd..7994b9db3 100644
--- a/Source/WebCore/platform/win/PopupMenuWin.cpp
+++ b/Source/WebCore/platform/win/PopupMenuWin.cpp
@@ -37,6 +37,7 @@
 #include "Page.h"
 #include "PlatformMouseEvent.h"
 #include "PlatformScreen.h"
+#include "RenderMenuList.h"
 #include "RenderTheme.h"
 #include "RenderView.h"
 #include "Scrollbar.h"
@@ -93,6 +94,15 @@ static void translatePoint(LPARAM& lParam, HWND from, HWND to)
     lParam = MAKELPARAM(pt.x, pt.y);
 }
 
+static FloatRect monitorFromHwnd(HWND hwnd)
+{
+    HMONITOR monitor = MonitorFromWindow(hwnd, MONITOR_DEFAULTTOPRIMARY);
+    MONITORINFOEX monitorInfo;
+    monitorInfo.cbSize = sizeof(MONITORINFOEX);
+    GetMonitorInfo(monitor, &monitorInfo);
+    return monitorInfo.rcWork;
+}
+
 PopupMenuWin::PopupMenuWin(PopupMenuClient* client)
     : m_popupClient(client)
     , m_scrollbar(0)
@@ -145,22 +155,9 @@ void PopupMenuWin::show(const IntRect& r, FrameView* view, int index)
         m_scrollbar->styleChanged();
     }
 
-    if (!m_popup) {
-        registerClass();
-
-        DWORD exStyle = WS_EX_LTRREADING;
-
-        m_popup = ::CreateWindowExW(exStyle, kPopupWindowClassName, L"PopupMenu",
-            WS_POPUP | WS_BORDER,
-            m_windowRect.x(), m_windowRect.y(), m_windowRect.width(), m_windowRect.height(),
-            hostWindow, 0, WebCore::instanceHandle(), this);
-
-        if (!m_popup)
-            return;
-    } else {
-        // We need to reposition the popup window.
-        ::MoveWindow(m_popup, m_windowRect.x(), m_windowRect.y(), m_windowRect.width(), m_windowRect.height(), false);
-    }
+    // We need to reposition the popup window to its final coordinates.
+    // Before calling this, the popup hwnd is currently the size of and at the location of the menu list client so it needs to be updated.
+    ::MoveWindow(m_popup, m_windowRect.x(), m_windowRect.y(), m_windowRect.width(), m_windowRect.height(), false);
 
     // Determine whether we should animate our popups
     // Note: Must use 'BOOL' and 'FALSE' instead of 'bool' and 'false' to avoid stack corruption with SystemParametersInfo
@@ -296,9 +293,39 @@ void PopupMenuWin::hide()
     ::PostMessage(m_popup, WM_NULL, 0, 0);
 }
 
+// The screen that the popup is placed on should be whichever one the popup menu button lies on.
+// We fake an hwnd (here we use the popup's hwnd) on top of the button which we can then use to determine the screen.
+// We can then proceed with our final position/size calculations.
 void PopupMenuWin::calculatePositionAndSize(const IntRect& r, FrameView* v)
 {
-    // r is in absolute document coordinates, but we want to be in screen coordinates
+    // First get the screen coordinates of the popup menu client.
+    HWND hostWindow = v->hostWindow()->platformPageClient();
+    IntRect absoluteBounds = ((RenderMenuList*)m_popupClient)->absoluteBoundingBoxRect();
+    IntRect absoluteScreenCoords(v->contentsToWindow(absoluteBounds.location()), absoluteBounds.size());
+    POINT absoluteLocation(absoluteScreenCoords.location());
+    if (!::ClientToScreen(v->hostWindow()->platformPageClient(), &absoluteLocation))
+        return;
+    absoluteScreenCoords.setLocation(absoluteLocation);
+
+    // Now set the popup menu's location temporarily to these coordinates so we can determine which screen the popup should lie on.
+    // We create or move m_popup as necessary.
+    if (!m_popup) {
+        registerClass();
+        DWORD exStyle = WS_EX_LTRREADING;
+        m_popup = ::CreateWindowExW(exStyle, kPopupWindowClassName, L"PopupMenu",
+            WS_POPUP | WS_BORDER,
+            absoluteScreenCoords.x(), absoluteScreenCoords.y(), absoluteScreenCoords.width(), absoluteScreenCoords.height(),
+            hostWindow, 0, WebCore::instanceHandle(), this);
+
+        if (!m_popup)
+            return;
+    } else
+        ::MoveWindow(m_popup, absoluteScreenCoords.x(), absoluteScreenCoords.y(), absoluteScreenCoords.width(), absoluteScreenCoords.height(), false);
+
+    FloatRect screen = monitorFromHwnd(m_popup);
+    
+    // Now we determine the actual location and measurements of the popup itself.
+    // r is in absolute document coordinates, but we want to be in screen coordinates.
 
     // First, move to WebView coordinates
     IntRect rScreenCoords(v->contentsToWindow(r.location()), r.size());
@@ -355,9 +382,6 @@ void PopupMenuWin::calculatePositionAndSize(const IntRect& r, FrameView* v)
 
     IntRect popupRect(popupX, rScreenCoords.maxY(), popupWidth, popupHeight);
 
-    // The popup needs to stay within the bounds of the screen and not overlap any toolbars
-    FloatRect screen = screenAvailableRect(v);
-
     // Check that we don't go off the screen vertically
     if (popupRect.maxY() > screen.height()) {
         // The popup will go off the screen, so try placing it above the client
@@ -378,7 +402,7 @@ void PopupMenuWin::calculatePositionAndSize(const IntRect& r, FrameView* v)
     }
 
     // Check that we don't go off the screen horizontally
-    if (popupRect.x() + popupRect.width() > screen.width())
+    if (popupRect.x() + popupRect.width() > screen.width() + screen.x())
         popupRect.setX(screen.x() + screen.width() - popupRect.width());
     if (popupRect.x() < screen.x())
         popupRect.setX(screen.x());
diff --git a/Source/WebCore/platform/win/SearchPopupMenuWin.cpp b/Source/WebCore/platform/win/SearchPopupMenuWin.cpp
index a5ca9b744..0d251df18 100644
--- a/Source/WebCore/platform/win/SearchPopupMenuWin.cpp
+++ b/Source/WebCore/platform/win/SearchPopupMenuWin.cpp
@@ -51,8 +51,7 @@ bool SearchPopupMenuWin::enabled()
 #if USE(CF)
 static RetainPtr<CFStringRef> autosaveKey(const String& name)
 {
-    String key = "com.apple.WebKit.searchField:" + name;
-    return RetainPtr<CFStringRef>(AdoptCF, key.createCFString());
+    return String("com.apple.WebKit.searchField:" + name).createCFString();
 }
 #endif
 
@@ -67,10 +66,8 @@ void SearchPopupMenuWin::saveRecentSearches(const AtomicString& name, const Vect
     size_t size = searchItems.size();
     if (size) {
         items.adoptCF(CFArrayCreateMutable(0, size, &kCFTypeArrayCallBacks));
-        for (size_t i = 0; i < size; ++i) {
-            RetainPtr<CFStringRef> item(AdoptCF, searchItems[i].createCFString());
-            CFArrayAppendValue(items.get(), item.get());
-        }
+        for (size_t i = 0; i < size; ++i)
+            CFArrayAppendValue(items.get(), searchItems[i].createCFString().get());
     }
 
     CFPreferencesSetAppValue(autosaveKey(name).get(), items.get(), kCFPreferencesCurrentApplication);
diff --git a/Source/WebCore/plugins/PluginDatabase.h b/Source/WebCore/plugins/PluginDatabase.h
index 55980d1de..a1c44bc5b 100644
--- a/Source/WebCore/plugins/PluginDatabase.h
+++ b/Source/WebCore/plugins/PluginDatabase.h
@@ -42,7 +42,7 @@ namespace WebCore {
     class PluginDatabaseClient;
     class PluginPackage;
 
-    typedef HashSet<RefPtr<PluginPackage>, PluginPackageHash> PluginSet;
+    typedef HashSet<RefPtr<PluginPackage>, PluginPackageHash, PluginPackageHashTraits> PluginSet;
 
     class PluginDatabase {
         WTF_MAKE_NONCOPYABLE(PluginDatabase); WTF_MAKE_FAST_ALLOCATED;
diff --git a/Source/WebCore/plugins/PluginPackage.h b/Source/WebCore/plugins/PluginPackage.h
index 01fa565f8..5f31e8a16 100644
--- a/Source/WebCore/plugins/PluginPackage.h
+++ b/Source/WebCore/plugins/PluginPackage.h
@@ -124,6 +124,11 @@ namespace WebCore {
 #endif
     };
 
+    // FIXME: This is a workaround because PluginPackageHash is broken and may consider keys with different hashes as equal.
+    struct PluginPackageHashTraits : HashTraits<RefPtr<PluginPackage> > {
+        static const int minimumTableSize = 64;
+    };
+
     struct PluginPackageHash {
         static unsigned hash(const uintptr_t key) { return reinterpret_cast<PluginPackage*>(key)->hash(); }
         static unsigned hash(const RefPtr<PluginPackage>& key) { return key->hash(); }
diff --git a/Source/WebCore/plugins/PluginView.cpp b/Source/WebCore/plugins/PluginView.cpp
index bd3f8834d..0466846d4 100644
--- a/Source/WebCore/plugins/PluginView.cpp
+++ b/Source/WebCore/plugins/PluginView.cpp
@@ -548,8 +548,8 @@ static KURL makeURL(const KURL& baseURL, const char* relativeURLString)
     String urlString = relativeURLString;
 
     // Strip return characters.
-    urlString.replace('\n', "");
-    urlString.replace('\r', "");
+    urlString.replaceWithLiteral('\n', "");
+    urlString.replaceWithLiteral('\r', "");
 
     return KURL(baseURL, urlString);
 }
@@ -1474,6 +1474,11 @@ NPError PluginView::setValueForURL(NPNURLVariable variable, const char* url, con
 
 NPError PluginView::getAuthenticationInfo(const char* protocol, const char* host, int32_t port, const char* /* scheme */, const char* /* realm */, char**  /* username */, uint32_t* /* ulen */, char** /* password */, uint32_t* /* plen */)
 {
+#if LOG_DISABLED
+    UNUSED_PARAM(protocol);
+    UNUSED_PARAM(host);
+    UNUSED_PARAM(port);
+#endif
     LOG(Plugins, "PluginView::getAuthenticationInfo: protocol=%s, host=%s, port=%d", protocol, host, port);
     notImplemented();
     return NPERR_GENERIC_ERROR;
diff --git a/Source/WebCore/rendering/AutoTableLayout.cpp b/Source/WebCore/rendering/AutoTableLayout.cpp
index fb436ca55..8a712c74f 100644
--- a/Source/WebCore/rendering/AutoTableLayout.cpp
+++ b/Source/WebCore/rendering/AutoTableLayout.cpp
@@ -49,77 +49,81 @@ void AutoTableLayout::recalcColumn(unsigned effCol)
     RenderTableCell* fixedContributor = 0;
     RenderTableCell* maxContributor = 0;
 
-    for (RenderTableSection* section = m_table->topNonEmptySection(); section; section = m_table->sectionBelow(section, SkipEmptySections)) {
-        unsigned numRows = section->numRows();
-        ASSERT(numRows);
-        for (unsigned i = 0; i < numRows; i++) {
-            RenderTableSection::CellStruct current = section->cellAt(i, effCol);
-            RenderTableCell* cell = current.primaryCell();
-
-            if (current.inColSpan || !cell)
-                continue;
-
-            bool cellHasContent = cell->children()->firstChild() || cell->style()->hasBorder() || cell->style()->hasPadding();
-            if (cellHasContent)
-                columnLayout.emptyCellsOnly = false;
-
-            // A cell originates in this column. Ensure we have
-            // a min/max width of at least 1px for this column now.
-            columnLayout.minLogicalWidth = max<int>(columnLayout.minLogicalWidth, cellHasContent ? 1 : 0);
-            columnLayout.maxLogicalWidth = max<int>(columnLayout.maxLogicalWidth, 1);
-
-            if (cell->colSpan() == 1) {
-                if (cell->preferredLogicalWidthsDirty())
-                    cell->computePreferredLogicalWidths();
-                columnLayout.minLogicalWidth = max<int>(cell->minPreferredLogicalWidth(), columnLayout.minLogicalWidth);
-                if (cell->maxPreferredLogicalWidth() > columnLayout.maxLogicalWidth) {
-                    columnLayout.maxLogicalWidth = cell->maxPreferredLogicalWidth();
-                    maxContributor = cell;
-                }
+    for (RenderObject* child = m_table->children()->firstChild(); child; child = child->nextSibling()) {
+        if (child->isRenderTableCol())
+            toRenderTableCol(child)->computePreferredLogicalWidths();
+        else if (child->isTableSection()) {
+            RenderTableSection* section = toRenderTableSection(child);
+            unsigned numRows = section->numRows();
+            for (unsigned i = 0; i < numRows; i++) {
+                RenderTableSection::CellStruct current = section->cellAt(i, effCol);
+                RenderTableCell* cell = current.primaryCell();
+                
+                if (current.inColSpan || !cell)
+                    continue;
+
+                bool cellHasContent = cell->children()->firstChild() || cell->style()->hasBorder() || cell->style()->hasPadding();
+                if (cellHasContent)
+                    columnLayout.emptyCellsOnly = false;
+
+                // A cell originates in this column. Ensure we have
+                // a min/max width of at least 1px for this column now.
+                columnLayout.minLogicalWidth = max<int>(columnLayout.minLogicalWidth, cellHasContent ? 1 : 0);
+                columnLayout.maxLogicalWidth = max<int>(columnLayout.maxLogicalWidth, 1);
+
+                if (cell->colSpan() == 1) {
+                    if (cell->preferredLogicalWidthsDirty())
+                        cell->computePreferredLogicalWidths();
+                    columnLayout.minLogicalWidth = max<int>(cell->minPreferredLogicalWidth(), columnLayout.minLogicalWidth);
+                    if (cell->maxPreferredLogicalWidth() > columnLayout.maxLogicalWidth) {
+                        columnLayout.maxLogicalWidth = cell->maxPreferredLogicalWidth();
+                        maxContributor = cell;
+                    }
 
-                // All browsers implement a size limit on the cell's max width.
-                // Our limit is based on KHTML's representation that used 16 bits widths.
-                // FIXME: Other browsers have a lower limit for the cell's max width.
-                const int cCellMaxWidth = 32760;
-                Length cellLogicalWidth = cell->styleOrColLogicalWidth();
-                if (cellLogicalWidth.value() > cCellMaxWidth)
-                    cellLogicalWidth.setValue(cCellMaxWidth);
-                if (cellLogicalWidth.isNegative())
-                    cellLogicalWidth.setValue(0);
-                switch (cellLogicalWidth.type()) {
-                case Fixed:
-                    // ignore width=0
-                    if (cellLogicalWidth.isPositive() && !columnLayout.logicalWidth.isPercent()) {
-                        LayoutUnit logicalWidth = cell->adjustBorderBoxLogicalWidthForBoxSizing(cellLogicalWidth.value());
-                        if (columnLayout.logicalWidth.isFixed()) {
-                            // Nav/IE weirdness
-                            if ((logicalWidth > columnLayout.logicalWidth.value())
-                                || ((columnLayout.logicalWidth.value() == logicalWidth) && (maxContributor == cell))) {
+                    // All browsers implement a size limit on the cell's max width. 
+                    // Our limit is based on KHTML's representation that used 16 bits widths.
+                    // FIXME: Other browsers have a lower limit for the cell's max width. 
+                    const int cCellMaxWidth = 32760;
+                    Length cellLogicalWidth = cell->styleOrColLogicalWidth();
+                    if (cellLogicalWidth.value() > cCellMaxWidth)
+                        cellLogicalWidth.setValue(cCellMaxWidth);
+                    if (cellLogicalWidth.isNegative())
+                        cellLogicalWidth.setValue(0);
+                    switch (cellLogicalWidth.type()) {
+                    case Fixed:
+                        // ignore width=0
+                        if (cellLogicalWidth.isPositive() && !columnLayout.logicalWidth.isPercent()) {
+                            LayoutUnit logicalWidth = cell->adjustBorderBoxLogicalWidthForBoxSizing(cellLogicalWidth.value());
+                            if (columnLayout.logicalWidth.isFixed()) {
+                                // Nav/IE weirdness
+                                if ((logicalWidth > columnLayout.logicalWidth.value()) 
+                                    || ((columnLayout.logicalWidth.value() == logicalWidth) && (maxContributor == cell))) {
+                                    columnLayout.logicalWidth.setValue(Fixed, logicalWidth);
+                                    fixedContributor = cell;
+                                }
+                            } else {
                                 columnLayout.logicalWidth.setValue(Fixed, logicalWidth);
                                 fixedContributor = cell;
                             }
-                        } else {
-                            columnLayout.logicalWidth.setValue(Fixed, logicalWidth);
-                            fixedContributor = cell;
                         }
+                        break;
+                    case Percent:
+                        m_hasPercent = true;
+                        if (cellLogicalWidth.isPositive() && (!columnLayout.logicalWidth.isPercent() || cellLogicalWidth.value() > columnLayout.logicalWidth.value()))
+                            columnLayout.logicalWidth = cellLogicalWidth;
+                        break;
+                    case Relative:
+                        // FIXME: Need to understand this case and whether it makes sense to compare values
+                        // which are not necessarily of the same type.
+                        if (cellLogicalWidth.value() > columnLayout.logicalWidth.value())
+                            columnLayout.logicalWidth = cellLogicalWidth;
+                    default:
+                        break;
                     }
-                    break;
-                case Percent:
-                    m_hasPercent = true;
-                    if (cellLogicalWidth.isPositive() && (!columnLayout.logicalWidth.isPercent() || cellLogicalWidth.value() > columnLayout.logicalWidth.value()))
-                        columnLayout.logicalWidth = cellLogicalWidth;
-                    break;
-                case Relative:
-                    // FIXME: Need to understand this case and whether it makes sense to compare values
-                    // which are not necessarily of the same type.
-                    if (cellLogicalWidth.value() > columnLayout.logicalWidth.value())
-                        columnLayout.logicalWidth = cellLogicalWidth;
-                default:
-                    break;
+                } else if (!effCol || section->primaryCellAt(i, effCol - 1) != cell) {
+                    // This spanning cell originates in this column. Insert the cell into spanning cells list.
+                    insertSpanCell(cell);
                 }
-            } else if (!effCol || section->primaryCellAt(i, effCol - 1) != cell) {
-                // This spanning cell originates in this column. Insert the cell into spanning cells list.
-                insertSpanCell(cell);
             }
         }
     }
@@ -192,15 +196,11 @@ static bool shouldScaleColumns(RenderTable* table)
             table = 0;
             if (cb && cb->isTableCell() &&
                 (cb->style()->width().isAuto() || cb->style()->width().isPercent())) {
-                if (tw.isPercent())
+                RenderTableCell* cell = toRenderTableCell(cb);
+                if (cell->colSpan() > 1 || cell->table()->style()->width().isAuto())
                     scale = false;
-                else {
-                    RenderTableCell* cell = toRenderTableCell(cb);
-                    if (cell->colSpan() > 1 || cell->table()->style()->width().isAuto())
-                        scale = false;
-                    else
-                        table = cell->table();
-                }
+                else
+                    table = cell->table();
             }
         }
         else
diff --git a/Source/WebCore/rendering/BidiRun.h b/Source/WebCore/rendering/BidiRun.h
index f50fa196f..694cbca77 100644
--- a/Source/WebCore/rendering/BidiRun.h
+++ b/Source/WebCore/rendering/BidiRun.h
@@ -38,8 +38,8 @@ struct BidiRun : BidiCharacterRun {
         : BidiCharacterRun(start, stop, context, dir)
         , m_object(object)
         , m_box(0)
-        , m_hasHyphen(false)
     {
+        m_hasHyphen = false; // Stored in base class to save space.
     }
 
     void destroy();
@@ -60,7 +60,6 @@ private:
 public:
     RenderObject* m_object;
     InlineBox* m_box;
-    bool m_hasHyphen;
 };
 
 }
diff --git a/Source/WebCore/rendering/ExclusionPolygon.cpp b/Source/WebCore/rendering/ExclusionPolygon.cpp
index eaeeba70d..efb6acddb 100644
--- a/Source/WebCore/rendering/ExclusionPolygon.cpp
+++ b/Source/WebCore/rendering/ExclusionPolygon.cpp
@@ -47,9 +47,42 @@ struct EdgeIntersection {
     EdgeIntersectionType type;
 };
 
-static bool compareEdgeMinY(const ExclusionPolygonEdge* e1, const ExclusionPolygonEdge* e2)
+static inline float determinant(const FloatSize& a, const FloatSize& b)
 {
-    return e1->minY() < e2->minY();
+    return a.width() * b.height() - a.height() * b.width();
+}
+
+static inline bool areCollinearPoints(const FloatPoint& p0, const FloatPoint& p1, const FloatPoint& p2)
+{
+    return !determinant(p1 - p0, p2 - p0);
+}
+
+static inline bool areCoincidentPoints(const FloatPoint& p0, const FloatPoint& p1)
+{
+    return p0.x() == p1.x() && p0.y() == p1.y();
+}
+
+static inline unsigned nextVertexIndex(unsigned vertexIndex, unsigned nVertices, bool clockwise)
+{
+    return ((clockwise) ? vertexIndex + 1 : vertexIndex - 1 + nVertices) % nVertices;
+}
+
+unsigned ExclusionPolygon::findNextEdgeVertexIndex(unsigned vertexIndex1, bool clockwise) const
+{
+    unsigned nVertices = numberOfVertices();
+    unsigned vertexIndex2 = nextVertexIndex(vertexIndex1, nVertices, clockwise);
+
+    while (vertexIndex2 && areCoincidentPoints(vertexAt(vertexIndex1), vertexAt(vertexIndex2)))
+        vertexIndex2 = nextVertexIndex(vertexIndex2, nVertices, clockwise);
+
+    while (vertexIndex2) {
+        unsigned vertexIndex3 = nextVertexIndex(vertexIndex2, nVertices, clockwise);
+        if (!areCollinearPoints(vertexAt(vertexIndex1), vertexAt(vertexIndex2), vertexAt(vertexIndex3)))
+            break;
+        vertexIndex2 = vertexIndex3;
+    }
+
+    return vertexIndex2;
 }
 
 ExclusionPolygon::ExclusionPolygon(PassOwnPtr<Vector<FloatPoint> > vertices, WindRule fillRule)
@@ -60,22 +93,50 @@ ExclusionPolygon::ExclusionPolygon(PassOwnPtr<Vector<FloatPoint> > vertices, Win
     unsigned nVertices = numberOfVertices();
     m_edges.resize(nVertices);
     m_empty = nVertices < 3;
-    Vector<ExclusionPolygonEdge*> sortedEdgesMinY(nVertices);
 
     if (nVertices)
         m_boundingBox.setLocation(vertexAt(0));
 
-    for (unsigned i = 0; i < nVertices; i++) {
-        const FloatPoint& vertex = vertexAt(i);
-        m_boundingBox.extend(vertex);
-        m_edges[i].polygon = this;
-        m_edges[i].index1 = i;
-        m_edges[i].index2 = (i + 1) % nVertices;
+    if (m_empty)
+        return;
 
-        sortedEdgesMinY[i] = &m_edges[i];
+    unsigned minVertexIndex = 0;
+    for (unsigned i = 1; i < nVertices; ++i) {
+        const FloatPoint& vertex = vertexAt(i);
+        if (vertex.y() < vertexAt(minVertexIndex).y() || (vertex.y() == vertexAt(minVertexIndex).y() && vertex.x() < vertexAt(minVertexIndex).x()))
+            minVertexIndex = i;
+    }
+    FloatPoint nextVertex = vertexAt((minVertexIndex + 1) % nVertices);
+    FloatPoint prevVertex = vertexAt((minVertexIndex + nVertices - 1) % nVertices);
+    bool clockwise = determinant(vertexAt(minVertexIndex) - prevVertex, nextVertex - prevVertex) > 0;
+
+    unsigned edgeIndex = 0;
+    unsigned vertexIndex1 = 0;
+    do {
+        m_boundingBox.extend(vertexAt(vertexIndex1));
+        unsigned vertexIndex2 = findNextEdgeVertexIndex(vertexIndex1, clockwise);
+        m_edges[edgeIndex].polygon = this;
+        m_edges[edgeIndex].vertexIndex1 = vertexIndex1;
+        m_edges[edgeIndex].vertexIndex2 = vertexIndex2;
+        m_edges[edgeIndex].edgeIndex = edgeIndex;
+        edgeIndex++;
+        vertexIndex1 = vertexIndex2;
+    } while (vertexIndex1);
+
+    if (edgeIndex > 3) {
+        const ExclusionPolygonEdge& firstEdge = m_edges[0];
+        const ExclusionPolygonEdge& lastEdge = m_edges[edgeIndex - 1];
+        if (areCollinearPoints(lastEdge.vertex1(), lastEdge.vertex2(), firstEdge.vertex2())) {
+            m_edges[0].vertexIndex1 = lastEdge.vertexIndex1;
+            edgeIndex--;
+        }
     }
 
-    std::sort(sortedEdgesMinY.begin(), sortedEdgesMinY.end(), WebCore::compareEdgeMinY);
+    m_edges.resize(edgeIndex);
+    m_empty = m_edges.size() < 3;
+
+    if (m_empty)
+        return;
 
     for (unsigned i = 0; i < m_edges.size(); i++) {
         ExclusionPolygonEdge* edge = &m_edges[i];
@@ -118,18 +179,30 @@ static bool computeXIntersection(const ExclusionPolygonEdge* edgePointer, float
     return true;
 }
 
-float ExclusionPolygon::rightVertexY(unsigned index) const
+static inline bool getVertexIntersectionVertices(const EdgeIntersection& intersection, FloatPoint& prevVertex, FloatPoint& thisVertex, FloatPoint& nextVertex)
 {
-    unsigned nVertices = numberOfVertices();
-    const FloatPoint& vertex1 = vertexAt((index + 1) % nVertices);
-    const FloatPoint& vertex2 = vertexAt((index - 1) % nVertices);
+    if (intersection.type != VertexMinY && intersection.type != VertexMaxY)
+        return false;
+
+    ASSERT(intersection.edge && intersection.edge->polygon);
+    const ExclusionPolygon& polygon = *(intersection.edge->polygon);
+    const ExclusionPolygonEdge& thisEdge = *(intersection.edge);
 
-    if (vertex1.x() == vertex2.x())
-        return vertex1.y() > vertex2.y() ? vertex1.y() : vertex2.y();
-    return vertex1.x() > vertex2.x() ? vertex1.y() : vertex2.y();
+    if ((intersection.type == VertexMinY && (thisEdge.vertex1().y() < thisEdge.vertex2().y()))
+        || (intersection.type == VertexMaxY && (thisEdge.vertex1().y() > thisEdge.vertex2().y()))) {
+        prevVertex = polygon.vertexAt(thisEdge.previousEdge().vertexIndex2);
+        thisVertex = polygon.vertexAt(thisEdge.vertexIndex1);
+        nextVertex = polygon.vertexAt(thisEdge.vertexIndex2);
+    } else {
+        prevVertex = polygon.vertexAt(thisEdge.vertexIndex1);
+        thisVertex = polygon.vertexAt(thisEdge.vertexIndex2);
+        nextVertex = polygon.vertexAt(thisEdge.nextEdge().vertexIndex1);
+    }
+
+    return true;
 }
 
-static bool appendIntervalX(float x, bool inside, Vector<ExclusionInterval>& result)
+static inline bool appendIntervalX(float x, bool inside, Vector<ExclusionInterval>& result)
 {
     if (!inside)
         result.append(ExclusionInterval(x));
@@ -155,7 +228,7 @@ void ExclusionPolygon::computeXIntersections(float y, Vector<ExclusionInterval>&
     EdgeIntersection intersection;
     for (unsigned i = 0; i < overlappingEdges.size(); i++) {
         ExclusionPolygonEdge* edge = static_cast<ExclusionPolygonEdge*>(overlappingEdges[i].data());
-        if (computeXIntersection(edge, y, intersection))
+        if (computeXIntersection(edge, y, intersection) && intersection.type != VertexYBoth)
             intersections.append(intersection);
     }
     if (intersections.size() < 2)
@@ -169,7 +242,6 @@ void ExclusionPolygon::computeXIntersections(float y, Vector<ExclusionInterval>&
 
     while (index < intersections.size()) {
         const EdgeIntersection& thisIntersection = intersections[index];
-
         if (index + 1 < intersections.size()) {
             const EdgeIntersection& nextIntersection = intersections[index + 1];
             if ((thisIntersection.point.x() == nextIntersection.point.x()) && (thisIntersection.type == VertexMinY || thisIntersection.type == VertexMaxY)) {
@@ -177,9 +249,7 @@ void ExclusionPolygon::computeXIntersections(float y, Vector<ExclusionInterval>&
                     // Skip pairs of intersections whose types are VertexMaxY,VertexMaxY and VertexMinY,VertexMinY.
                     index += 2;
                 } else {
-                    // Replace pairs of intersections whose types are VertexMinY,VertexMaxY or VertexMaxY,VertexMinY with one VertexMinY intersection.
-                    if (nextIntersection.type == VertexMaxY)
-                        intersections[index + 1] = thisIntersection;
+                    // Replace pairs of intersections whose types are VertexMinY,VertexMaxY or VertexMaxY,VertexMinY with one intersection.
                     index++;
                 }
                 continue;
@@ -187,22 +257,32 @@ void ExclusionPolygon::computeXIntersections(float y, Vector<ExclusionInterval>&
         }
 
         const ExclusionPolygonEdge& thisEdge = *thisIntersection.edge;
-        bool crossing = !windCount;
+        bool evenOddCrossing = !windCount;
 
         if (fillRule() == RULE_EVENODD) {
             windCount += (thisEdge.vertex2().y() > thisEdge.vertex1().y()) ? 1 : -1;
-            crossing = crossing || !windCount;
+            evenOddCrossing = evenOddCrossing || !windCount;
         }
 
-        if ((thisIntersection.type == Normal) || (thisIntersection.type == VertexMinY)) {
-            if (crossing)
+        if (evenOddCrossing) {
+            bool edgeCrossing = false;
+            if (thisIntersection.type == Normal || !inside || index == intersections.size() - 1)
+                edgeCrossing = true;
+            else {
+                FloatPoint prevVertex;
+                FloatPoint thisVertex;
+                FloatPoint nextVertex;
+
+                if (getVertexIntersectionVertices(thisIntersection, prevVertex, thisVertex, nextVertex)) {
+                    if (prevVertex.y() == y)
+                        edgeCrossing =  (thisVertex.x() > prevVertex.x()) ? nextVertex.y() > y : nextVertex.y() < y;
+                    else
+                        edgeCrossing = (nextVertex.y() != y);
+                }
+            }
+            if (edgeCrossing)
                 inside = appendIntervalX(thisIntersection.point.x(), inside, result);
-        } else if (thisIntersection.type == VertexMaxY) {
-            int vertexIndex = (thisEdge.vertex2().y() > thisEdge.vertex1().y()) ? thisEdge.index2 : thisEdge.index1;
-            if (crossing && rightVertexY(vertexIndex) > y)
-                inside = appendIntervalX(thisEdge.maxX(), inside, result);
-        } else if (thisIntersection.type == VertexYBoth)
-            result.append(ExclusionInterval(thisEdge.minX(), thisEdge.maxX()));
+        }
 
         index++;
     }
@@ -235,7 +315,8 @@ void ExclusionPolygon::computeEdgeIntersections(float y1, float y2, Vector<Exclu
         if (x1 > x2)
             std::swap(x1, x2);
 
-        result.append(ExclusionInterval(x1, x2));
+        if (x2 > x1)
+            result.append(ExclusionInterval(x1, x2));
     }
 
     sortExclusionIntervals(result);
diff --git a/Source/WebCore/rendering/ExclusionPolygon.h b/Source/WebCore/rendering/ExclusionPolygon.h
index be28a7f45..ce7a23c0d 100644
--- a/Source/WebCore/rendering/ExclusionPolygon.h
+++ b/Source/WebCore/rendering/ExclusionPolygon.h
@@ -59,15 +59,18 @@ public:
     unsigned numberOfVertices() const { return m_vertices->size(); }
     WindRule fillRule() const { return m_fillRule; }
 
+    const ExclusionPolygonEdge& edgeAt(unsigned index) const { return m_edges[index]; }
+    unsigned numberOfEdges() const { return m_edges.size(); }
+
     virtual FloatRect shapeLogicalBoundingBox() const OVERRIDE { return internalToLogicalBoundingBox(m_boundingBox); }
     virtual bool isEmpty() const OVERRIDE { return m_empty; }
     virtual void getExcludedIntervals(float logicalTop, float logicalHeight, SegmentList&) const OVERRIDE;
     virtual void getIncludedIntervals(float logicalTop, float logicalHeight, SegmentList&) const OVERRIDE;
 
 private:
-    float rightVertexY(unsigned) const;
     void computeXIntersections(float y, Vector<ExclusionInterval>&) const;
     void computeEdgeIntersections(float minY, float maxY, Vector<ExclusionInterval>&) const;
+    unsigned findNextEdgeVertexIndex(unsigned vertexIndex1, bool clockwise) const;
 
     typedef PODInterval<float, ExclusionPolygonEdge*> EdgeInterval;
     typedef PODIntervalTree<float, ExclusionPolygonEdge*> EdgeIntervalTree;
@@ -87,13 +90,25 @@ struct ExclusionPolygonEdge {
     const FloatPoint& vertex1() const
     {
         ASSERT(polygon);
-        return polygon->vertexAt(index1);
+        return polygon->vertexAt(vertexIndex1);
     }
 
     const FloatPoint& vertex2() const
     {
         ASSERT(polygon);
-        return polygon->vertexAt(index2);
+        return polygon->vertexAt(vertexIndex2);
+    }
+
+    const ExclusionPolygonEdge& previousEdge() const
+    {
+        ASSERT(polygon && polygon->numberOfEdges() > 1);
+        return polygon->edgeAt((edgeIndex + polygon->numberOfEdges() - 2) % polygon->numberOfEdges());
+    }
+
+    const ExclusionPolygonEdge& nextEdge() const
+    {
+        ASSERT(polygon && polygon->numberOfEdges() > 1);
+        return polygon->edgeAt((edgeIndex + 1) % polygon->numberOfEdges());
     }
 
     float minX() const { return std::min(vertex1().x(), vertex2().x()); }
@@ -102,8 +117,9 @@ struct ExclusionPolygonEdge {
     float maxY() const { return std::max(vertex1().y(), vertex2().y()); }
 
     const ExclusionPolygon* polygon;
-    unsigned index1;
-    unsigned index2;
+    unsigned vertexIndex1;
+    unsigned vertexIndex2;
+    unsigned edgeIndex;
 };
 
 // These structures are used by PODIntervalTree for debugging.1
diff --git a/Source/WebCore/rendering/ExclusionShapeInsideInfo.h b/Source/WebCore/rendering/ExclusionShapeInsideInfo.h
index bea2b45a0..cd93b5fb1 100644
--- a/Source/WebCore/rendering/ExclusionShapeInsideInfo.h
+++ b/Source/WebCore/rendering/ExclusionShapeInsideInfo.h
@@ -54,16 +54,10 @@ public:
     static void removeExclusionShapeInsideInfoForRenderBlock(const RenderBlock*);
     static bool isExclusionShapeInsideInfoEnabledForRenderBlock(const RenderBlock*);
 
-    LayoutUnit shapeLogicalTop() const 
-    { 
-        ASSERT(m_shape);
-        return m_shape->shapeLogicalBoundingBox().y();
-    }
-    LayoutUnit shapeLogicalBottom() const
-    {
-        ASSERT(m_shape);
-        return m_shape->shapeLogicalBoundingBox().maxY();
-    }
+    LayoutUnit shapeLogicalTop() const { return shapeLogicalBoundsY(); }
+    LayoutUnit shapeLogicalBottom() const { return shapeLogicalBoundsMaxY(); }
+    bool lineOverlapsShapeBounds() const { return m_lineTop < shapeLogicalBottom() && m_lineTop + m_lineHeight >= shapeLogicalTop(); }
+
     bool hasSegments() const
     {
         return lineOverlapsShapeBounds() && m_segments.size();
@@ -74,13 +68,26 @@ public:
         return m_segments;
     }
     bool computeSegmentsForLine(LayoutUnit lineTop, LayoutUnit lineHeight);
-    bool lineOverlapsShapeBounds() const;
     void computeShapeSize(LayoutUnit logicalWidth, LayoutUnit logicalHeight);
     void dirtyShapeSize() { m_shapeSizeDirty = true; }
 
 private:
     ExclusionShapeInsideInfo(RenderBlock*);
 
+    inline LayoutUnit shapeLogicalBoundsY() const
+    {
+        ASSERT(m_shape);
+        // Use fromFloatCeil() to ensure that the returned LayoutUnit value is within the shape's bounds.
+        return FractionalLayoutUnit::fromFloatCeil(m_shape->shapeLogicalBoundingBox().y());
+    }
+
+    inline LayoutUnit shapeLogicalBoundsMaxY() const
+    {
+        ASSERT(m_shape);
+        // Use fromFloatFloor() to ensure that the returned LayoutUnit value is within the shape's bounds.
+        return FractionalLayoutUnit::fromFloatFloor(m_shape->shapeLogicalBoundingBox().maxY());
+    }
+
     RenderBlock* m_block;
     OwnPtr<ExclusionShape> m_shape;
 
@@ -93,13 +100,6 @@ private:
     bool m_shapeSizeDirty;
 };
 
-inline bool ExclusionShapeInsideInfo::lineOverlapsShapeBounds() const
-{
-    ASSERT(m_shape);
-    FloatRect shapeBounds = m_shape->shapeLogicalBoundingBox();
-    return m_lineTop < shapeBounds.maxY() && m_lineTop + m_lineHeight >= shapeBounds.y();
-}
-
 }
 #endif
 #endif
diff --git a/Source/WebCore/rendering/FilterEffectRenderer.cpp b/Source/WebCore/rendering/FilterEffectRenderer.cpp
index fd07f4a88..3bfe52bf8 100644
--- a/Source/WebCore/rendering/FilterEffectRenderer.cpp
+++ b/Source/WebCore/rendering/FilterEffectRenderer.cpp
@@ -43,17 +43,19 @@
 #include <wtf/MathExtras.h>
 
 #if ENABLE(CSS_SHADERS) && USE(3D_GRAPHICS)
+#include "CustomFilterConstants.h"
 #include "CustomFilterGlobalContext.h"
-#include "CustomFilterProgram.h"
 #include "CustomFilterOperation.h"
+#include "CustomFilterProgram.h"
 #include "CustomFilterValidatedProgram.h"
 #include "FECustomFilter.h"
 #include "RenderView.h"
-#include "Settings.h"
+#include "ValidatedCustomFilterOperation.h"
 #endif
 
 #if ENABLE(SVG)
 #include "CachedSVGDocument.h"
+#include "CachedSVGDocumentReference.h"
 #include "SVGElement.h"
 #include "SVGFilterPrimitiveStandardAttributes.h"
 #include "SourceAlpha.h"
@@ -85,31 +87,18 @@ inline bool isFilterSizeValid(FloatRect rect)
 }
 
 #if ENABLE(CSS_SHADERS) && USE(3D_GRAPHICS)
-static bool isCSSCustomFilterEnabled(Document* document)
-{
-    // We only want to enable shaders if WebGL is also enabled on this platform.
-    Settings* settings = document->settings();
-    return settings && settings->isCSSCustomFilterEnabled() && settings->webGLEnabled();
-}
-
-static PassRefPtr<FECustomFilter> createCustomFilterEffect(Filter* filter, Document* document, CustomFilterOperation* operation)
+static PassRefPtr<FECustomFilter> createCustomFilterEffect(Filter* filter, Document* document, ValidatedCustomFilterOperation* operation)
 {
-    if (!isCSSCustomFilterEnabled(document))
-        return 0;
-    
-    RefPtr<CustomFilterProgram> program = operation->program();
-    if (!program->isLoaded())
-        return 0;
-
     CustomFilterGlobalContext* globalContext = document->renderView()->customFilterGlobalContext();
     globalContext->prepareContextIfNeeded(document->view()->hostWindow());
-    RefPtr<CustomFilterValidatedProgram> validatedProgram = globalContext->getValidatedProgram(program->programInfo());
-    if (!validatedProgram->isInitialized())
+    if (!globalContext->context())
         return 0;
 
-    return FECustomFilter::create(filter, globalContext, validatedProgram, operation->parameters(),
-                                  operation->meshRows(), operation->meshColumns(),
-                                  operation->meshBoxType(), operation->meshType());
+    // FIXME: Use the right CustomFilterMeshBoxType when that will be available on the ValidatedCustomFilterOperation.
+    // Right now the implementation doesn't use that parameter anyway, so just pass the default MeshBoxTypeFilter.
+    // https://bugs.webkit.org/show_bug.cgi?id=100890
+    return FECustomFilter::create(filter, globalContext->context(), operation->validatedProgram(), operation->parameters(),
+        operation->meshRows(), operation->meshColumns(), MeshBoxTypeFilter, operation->meshType());
 }
 #endif
 
@@ -140,7 +129,8 @@ GraphicsContext* FilterEffectRenderer::inputContext()
 PassRefPtr<FilterEffect> FilterEffectRenderer::buildReferenceFilter(Document* document, PassRefPtr<FilterEffect> previousEffect, ReferenceFilterOperation* op)
 {
 #if ENABLE(SVG)
-    CachedSVGDocument* cachedSVGDocument = static_cast<CachedSVGDocument*>(op->data());
+    CachedSVGDocumentReference* cachedSVGDocumentReference = static_cast<CachedSVGDocumentReference*>(op->data());
+    CachedSVGDocument* cachedSVGDocument = cachedSVGDocumentReference ? cachedSVGDocumentReference->document() : 0;
 
     // If we have an SVG document, this is an external reference. Otherwise
     // we look up the referenced node in the current document.
@@ -214,7 +204,9 @@ bool FilterEffectRenderer::build(Document* document, const FilterOperations& ope
         FilterOperation* filterOperation = operations.operations().at(i).get();
         switch (filterOperation->getOperationType()) {
         case FilterOperation::REFERENCE: {
-            effect = buildReferenceFilter(document, previousEffect, static_cast<ReferenceFilterOperation*>(filterOperation));
+            ReferenceFilterOperation* referenceOperation = static_cast<ReferenceFilterOperation*>(filterOperation);
+            effect = buildReferenceFilter(document, previousEffect, referenceOperation);
+            referenceOperation->setFilterEffect(effect);
             break;
         }
         case FilterOperation::GRAYSCALE: {
@@ -349,8 +341,13 @@ bool FilterEffectRenderer::build(Document* document, const FilterOperations& ope
             break;
         }
 #if ENABLE(CSS_SHADERS) && USE(3D_GRAPHICS)
-        case FilterOperation::CUSTOM: {
-            CustomFilterOperation* customFilterOperation = static_cast<CustomFilterOperation*>(filterOperation);
+        case FilterOperation::CUSTOM:
+            // CUSTOM operations are always converted to VALIDATED_CUSTOM before getting here.
+            // The conversion happens in RenderLayer::computeFilterOperations.
+            ASSERT_NOT_REACHED();
+            break;
+        case FilterOperation::VALIDATED_CUSTOM: {
+            ValidatedCustomFilterOperation* customFilterOperation = static_cast<ValidatedCustomFilterOperation*>(filterOperation);
             effect = createCustomFilterEffect(this, document, customFilterOperation);
             if (effect)
                 m_hasCustomShaderFilter = true;
diff --git a/Source/WebCore/rendering/FixedTableLayout.cpp b/Source/WebCore/rendering/FixedTableLayout.cpp
index eed6e0b54..2a08ad6b5 100644
--- a/Source/WebCore/rendering/FixedTableLayout.cpp
+++ b/Source/WebCore/rendering/FixedTableLayout.cpp
@@ -88,6 +88,8 @@ int FixedTableLayout::calcWidthArray(int)
 
     unsigned currentEffectiveColumn = 0;
     for (RenderTableCol* col = m_table->firstColumn(); col; col = col->nextColumn()) {
+        col->computePreferredLogicalWidths();
+
         // Width specified by column-groups that have column child does not affect column width in fixed layout tables
         if (col->isTableColumnGroupWithColumnChildren())
             continue;
diff --git a/Source/WebCore/rendering/InlineTextBox.cpp b/Source/WebCore/rendering/InlineTextBox.cpp
index ca1fef31b..56ab76cc8 100644
--- a/Source/WebCore/rendering/InlineTextBox.cpp
+++ b/Source/WebCore/rendering/InlineTextBox.cpp
@@ -1436,8 +1436,8 @@ void InlineTextBox::showBox(int printedCharacters) const
     const RenderText* obj = toRenderText(renderer());
     String value = obj->text();
     value = value.substring(start(), len());
-    value.replace('\\', "\\\\");
-    value.replace('\n', "\\n");
+    value.replaceWithLiteral('\\', "\\\\");
+    value.replaceWithLiteral('\n', "\\n");
     printedCharacters += fprintf(stderr, "%s\t%p", boxName(), this);
     for (; printedCharacters < showTreeCharacterOffset; printedCharacters++)
         fputc(' ', stderr);
diff --git a/Source/WebCore/rendering/LayoutState.cpp b/Source/WebCore/rendering/LayoutState.cpp
index d389b93b3..485d91775 100644
--- a/Source/WebCore/rendering/LayoutState.cpp
+++ b/Source/WebCore/rendering/LayoutState.cpp
@@ -36,20 +36,15 @@
 namespace WebCore {
 
 LayoutState::LayoutState(LayoutState* prev, RenderBox* renderer, const LayoutSize& offset, LayoutUnit pageLogicalHeight, bool pageLogicalHeightChanged, ColumnInfo* columnInfo)
-    : m_clipped(false)
-#if !ASSERT_DISABLED && ENABLE(SATURATED_LAYOUT_ARITHMETIC)
-    , m_layoutDeltaXSaturated(false)
-    , m_layoutDeltaYSaturated(false)
-#endif
-    , m_columnInfo(columnInfo)
+    : m_columnInfo(columnInfo)
     , m_lineGrid(0)
     , m_next(prev)
-#ifndef NDEBUG
-    , m_renderer(renderer)
-#endif
 #if ENABLE(CSS_EXCLUSIONS)
     , m_exclusionShapeInsideInfo(0)
 #endif
+#ifndef NDEBUG
+    , m_renderer(renderer)
+#endif
 {
     ASSERT(m_next);
 
@@ -144,21 +139,21 @@ LayoutState::LayoutState(LayoutState* prev, RenderBox* renderer, const LayoutSiz
 LayoutState::LayoutState(RenderObject* root)
     : m_clipped(false)
     , m_isPaginated(false)
+    , m_pageLogicalHeightChanged(false)
 #if !ASSERT_DISABLED && ENABLE(SATURATED_LAYOUT_ARITHMETIC)
     , m_layoutDeltaXSaturated(false)
     , m_layoutDeltaYSaturated(false)
 #endif    
-    , m_pageLogicalHeight(0)
-    , m_pageLogicalHeightChanged(false)
     , m_columnInfo(0)
     , m_lineGrid(0)
     , m_next(0)
-#ifndef NDEBUG
-    , m_renderer(root)
-#endif
 #if ENABLE(CSS_EXCLUSIONS)
     , m_exclusionShapeInsideInfo(0)
 #endif
+    , m_pageLogicalHeight(0)
+#ifndef NDEBUG
+    , m_renderer(root)
+#endif
 {
     RenderObject* container = root->container();
     FloatPoint absContentPoint = container->localToAbsolute(FloatPoint(), UseTransforms | SnapOffsetForTransforms);
diff --git a/Source/WebCore/rendering/LayoutState.h b/Source/WebCore/rendering/LayoutState.h
index b0ac4943e..6c3cfe52c 100644
--- a/Source/WebCore/rendering/LayoutState.h
+++ b/Source/WebCore/rendering/LayoutState.h
@@ -48,21 +48,21 @@ public:
     LayoutState()
         : m_clipped(false)
         , m_isPaginated(false)
+        , m_pageLogicalHeightChanged(false)
 #if !ASSERT_DISABLED && ENABLE(SATURATED_LAYOUT_ARITHMETIC)
         , m_layoutDeltaXSaturated(false)
         , m_layoutDeltaYSaturated(false)
 #endif
-        , m_pageLogicalHeight(0)
-        , m_pageLogicalHeightChanged(false)
         , m_columnInfo(0)
         , m_lineGrid(0)
         , m_next(0)
-#ifndef NDEBUG
-        , m_renderer(0)
-#endif
 #if ENABLE(CSS_EXCLUSIONS)
         , m_exclusionShapeInsideInfo(0)
 #endif
+        , m_pageLogicalHeight(0)
+#ifndef NDEBUG
+        , m_renderer(0)
+#endif
     {
     }
 
@@ -111,12 +111,24 @@ private:
     void computeLineGridPaginationOrigin(RenderBox*);
 
 public:
-    bool m_clipped;
-    bool m_isPaginated;
+    // Do not add anything apart from bitfields until after m_columnInfo. See https://bugs.webkit.org/show_bug.cgi?id=100173
+    bool m_clipped:1;
+    bool m_isPaginated:1;
+    // If our page height has changed, this will force all blocks to relayout.
+    bool m_pageLogicalHeightChanged:1;
 #if !ASSERT_DISABLED && ENABLE(SATURATED_LAYOUT_ARITHMETIC)
-    bool m_layoutDeltaXSaturated;
-    bool m_layoutDeltaYSaturated;
+    bool m_layoutDeltaXSaturated:1;
+    bool m_layoutDeltaYSaturated:1;
+#endif
+    // If the enclosing pagination model is a column model, then this will store column information for easy retrieval/manipulation.
+    ColumnInfo* m_columnInfo;
+    // The current line grid that we're snapping to and the offset of the start of the grid.
+    RenderBlock* m_lineGrid;
+    LayoutState* m_next;
+#if ENABLE(CSS_EXCLUSIONS)
+    ExclusionShapeInsideInfo* m_exclusionShapeInsideInfo;
 #endif
+
     LayoutRect m_clipRect;
     
     // x/y offset from container. Includes relative positioning and scroll offsets.
@@ -130,25 +142,14 @@ public:
 
     // The current page height for the pagination model that encloses us.
     LayoutUnit m_pageLogicalHeight;
-    // If our page height has changed, this will force all blocks to relayout.
-    bool m_pageLogicalHeightChanged;
     // The offset of the start of the first page in the nearest enclosing pagination model.
     LayoutSize m_pageOffset;
-    // If the enclosing pagination model is a column model, then this will store column information for easy retrieval/manipulation.
-    ColumnInfo* m_columnInfo;
-
-    // The current line grid that we're snapping to and the offset of the start of the grid.
-    RenderBlock* m_lineGrid;
     LayoutSize m_lineGridOffset;
     LayoutSize m_lineGridPaginationOrigin;
 
-    LayoutState* m_next;
 #ifndef NDEBUG
     RenderObject* m_renderer;
 #endif
-#if ENABLE(CSS_EXCLUSIONS)
-    ExclusionShapeInsideInfo* m_exclusionShapeInsideInfo;
-#endif
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/rendering/RenderArena.cpp b/Source/WebCore/rendering/RenderArena.cpp
index 8fff4c56b..cc2362059 100644
--- a/Source/WebCore/rendering/RenderArena.cpp
+++ b/Source/WebCore/rendering/RenderArena.cpp
@@ -43,18 +43,8 @@
 #define ROUNDUP(x, y) ((((x)+((y)-1))/(y))*(y))
 
 #ifdef NDEBUG
-// Mask freelist pointers to detect corruption and prevent freelist spraying.
-// We use an arbitray function and rely on ASLR to randomize it.
-// The first value in RenderObject (or any class) is a vtable pointer, which always
-// overlaps with the next pointer. This change guarantees that the masked vtable/next
-// pointer will never point to valid memory. So, we should immediately crash on the
-// first invalid vtable access for a stale RenderObject pointer.
-// See http://download.crowdstrike.com/papers/hes-exploiting-a-coalmine.pdf.
-static void* MaskPtr(void* p)
+static void* MaskPtr(void* p, uintptr_t mask)
 {
-    // The bottom bits are predictable because the binary is loaded on a boundary.
-    // This just shifts most of those predictable bits out.
-    const uintptr_t mask = ~(reinterpret_cast<uintptr_t>(WTF::fastMalloc) >> 13);
     return reinterpret_cast<void*>(reinterpret_cast<uintptr_t>(p) ^ mask);
 }
 #endif
@@ -80,11 +70,29 @@ RenderArena::RenderArena(unsigned arenaSize)
     : m_totalSize(0)
     , m_totalAllocated(0)
 {
+    ASSERT(arenaSize > sizeof(Arena) + ARENA_ALIGN_MASK);
+    // The underlying Arena class allocates some metadata on top of our
+    // requested size. Factor this in so that we can get perfect power-of-two
+    // allocation sizes passed to the underlying malloc() call.
+    arenaSize -= (sizeof(Arena) + ARENA_ALIGN_MASK);
     // Initialize the arena pool
     INIT_ARENA_POOL(&m_pool, "RenderArena", arenaSize);
 
     // Zero out the recyclers array
     memset(m_recyclers, 0, sizeof(m_recyclers));
+
+    // Mask freelist pointers to detect corruption and stop freelist spraying.
+    // We use an arbitray function and rely on ASLR to randomize it.
+    // The first value in RenderObject (or any class) is a vtable pointer, which
+    // always overlaps with the next pointer. This change guarantees that the
+    // masked vtable/next pointer will never point to valid memory. So, we
+    // should immediately crash on the first invalid vtable access for a stale
+    // RenderObject pointer.
+    // See http://download.crowdstrike.com/papers/hes-exploiting-a-coalmine.pdf.
+
+    // The bottom bits are predictable because the binary is loaded on a
+    // boundary. This just shifts most of those predictable bits out.
+    m_mask = ~(reinterpret_cast<uintptr_t>(WTF::fastMalloc) >> 13);
 }
 
 RenderArena::~RenderArena()
@@ -94,6 +102,7 @@ RenderArena::~RenderArena()
 
 void* RenderArena::allocate(size_t size)
 {
+    ASSERT(size <= gMaxRecycledSize - 32);
     m_totalSize += size;
 
 #ifdef ADDRESS_SANITIZER
@@ -108,21 +117,16 @@ void* RenderArena::allocate(size_t size)
     header->signature = signature;
     return static_cast<char*>(block) + debugHeaderSize;
 #else
-    void* result = 0;
-
     // Ensure we have correct alignment for pointers.  Important for Tru64
     size = ROUNDUP(size, sizeof(void*));
 
-    // Check recyclers first
-    if (size < gMaxRecycledSize) {
-        const int index = size >> 2;
+    const size_t index = size >> kRecyclerShift;
 
-        result = m_recyclers[index];
-        if (result) {
-            // Need to move to the next object
-            void* next = MaskPtr(*((void**)result));
-            m_recyclers[index] = next;
-        }
+    void* result = m_recyclers[index];
+    if (result) {
+        // Need to move to the next object
+        void* next = MaskPtr(*((void**)result), m_mask);
+        m_recyclers[index] = next;
     }
 
     if (!result) {
@@ -138,6 +142,7 @@ void* RenderArena::allocate(size_t size)
 
 void RenderArena::free(size_t size, void* ptr)
 {
+    ASSERT(size <= gMaxRecycledSize - 32);
     m_totalSize -= size;
 
 #ifdef ADDRESS_SANITIZER
@@ -155,13 +160,10 @@ void RenderArena::free(size_t size, void* ptr)
     // Ensure we have correct alignment for pointers.  Important for Tru64
     size = ROUNDUP(size, sizeof(void*));
 
-    // See if it's a size that we recycle
-    if (size < gMaxRecycledSize) {
-        const int index = size >> 2;
-        void* currentTop = m_recyclers[index];
-        m_recyclers[index] = ptr;
-        *((void**)ptr) = MaskPtr(currentTop);
-    }
+    const size_t index = size >> kRecyclerShift;
+    void* currentTop = m_recyclers[index];
+    m_recyclers[index] = ptr;
+    *((void**)ptr) = MaskPtr(currentTop, m_mask);
 #endif
 }
 
diff --git a/Source/WebCore/rendering/RenderArena.h b/Source/WebCore/rendering/RenderArena.h
index 0b64e1877..5538effd6 100644
--- a/Source/WebCore/rendering/RenderArena.h
+++ b/Source/WebCore/rendering/RenderArena.h
@@ -41,12 +41,12 @@
 
 namespace WebCore {
 
-static const size_t gMaxRecycledSize = 400;
+static const size_t gMaxRecycledSize = 1024;
 
 class RenderArena {
     WTF_MAKE_NONCOPYABLE(RenderArena); WTF_MAKE_FAST_ALLOCATED;
 public:
-    RenderArena(unsigned arenaSize = 4096);
+    RenderArena(unsigned arenaSize = 8192);
     ~RenderArena();
 
     // Memory management functions
@@ -60,9 +60,12 @@ private:
     // Underlying arena pool
     ArenaPool m_pool;
 
-    // The recycler array is sparse with the indices being multiples of 4,
-    // i.e., 0, 4, 8, 12, 16, 20, ...
-    void* m_recyclers[gMaxRecycledSize >> 2];
+    // The mask used to secure the recycled freelist pointers.
+    uintptr_t m_mask;
+    // The recycler array is sparse with the indices being multiples of the
+    // rounding size, sizeof(void*), i.e., 0, 4, 8, 12, 16, 20, ... on 32-bit.
+    static const size_t kRecyclerShift = (sizeof(void*) == 8) ? 3 : 2;
+    void* m_recyclers[gMaxRecycledSize >> kRecyclerShift];
 
     size_t m_totalSize;
     size_t m_totalAllocated;
diff --git a/Source/WebCore/rendering/RenderBlock.cpp b/Source/WebCore/rendering/RenderBlock.cpp
index f20b0b22f..470898579 100644
--- a/Source/WebCore/rendering/RenderBlock.cpp
+++ b/Source/WebCore/rendering/RenderBlock.cpp
@@ -24,6 +24,7 @@
 #include "config.h"
 #include "RenderBlock.h"
 
+#include "AXObjectCache.h"
 #include "ColumnInfo.h"
 #include "Document.h"
 #include "Element.h"
@@ -532,7 +533,10 @@ RenderBlock* RenderBlock::containingColumnsBlock(bool allowAnonymousColumnBlock)
         // FIXME: Table manages its own table parts, most of which are RenderBoxes.
         // Multi-column code cannot handle splitting the flow in table. Disabling it
         // to prevent crashes.
-        if (curr->isTable())
+        // Similarly, RenderButton maintains an anonymous block child and overrides
+        // addChild() to prevent itself from having additional direct children. This
+        // causes problems for split flows.
+        if (curr->isTable() || curr->isRenderButton())
             return 0;
         
         RenderBlock* currBlock = toRenderBlock(curr);
@@ -1011,6 +1015,8 @@ void RenderBlock::deleteLineBoxTree()
         }
     }
     m_lineBoxes.deleteLineBoxTree(renderArena());
+    if (UNLIKELY(AXObjectCache::accessibilityEnabled()))
+        document()->axObjectCache()->recomputeIsIgnored(this);
 }
 
 RootInlineBox* RenderBlock::createRootInlineBox() 
@@ -1022,6 +1028,10 @@ RootInlineBox* RenderBlock::createAndAppendRootInlineBox()
 {
     RootInlineBox* rootBox = createRootInlineBox();
     m_lineBoxes.appendLineBox(rootBox);
+
+    if (UNLIKELY(AXObjectCache::accessibilityEnabled()) && m_lineBoxes.firstLineBox() == rootBox)
+        document()->axObjectCache()->recomputeIsIgnored(this);
+
     return rootBox;
 }
 
@@ -4709,6 +4719,14 @@ bool RenderBlock::isPointInOverflowControl(HitTestResult& result, const LayoutPo
     return layer()->hitTestOverflowControls(result, roundedIntPoint(locationInContainer - toLayoutSize(accumulatedOffset)));
 }
 
+Node* RenderBlock::nodeForHitTest() const
+{
+    // If we are in the margins of block elements that are part of a
+    // continuation we're actually still inside the enclosing element
+    // that was split. Use the appropriate inner node.
+    return isAnonymousBlockContinuation() ? continuation()->node() : node();
+}
+
 bool RenderBlock::nodeAtPoint(const HitTestRequest& request, HitTestResult& result, const HitTestLocation& locationInContainer, const LayoutPoint& accumulatedOffset, HitTestAction hitTestAction)
 {
     LayoutPoint adjustedLocation(accumulatedOffset + location());
@@ -4726,7 +4744,7 @@ bool RenderBlock::nodeAtPoint(const HitTestRequest& request, HitTestResult& resu
     if ((hitTestAction == HitTestBlockBackground || hitTestAction == HitTestChildBlockBackground) && isPointInOverflowControl(result, locationInContainer.point(), adjustedLocation)) {
         updateHitTestResult(result, locationInContainer.point() - localOffset);
         // FIXME: isPointInOverflowControl() doesn't handle rect-based tests yet.
-        if (!result.addNodeToRectBasedTestResult(node(), request, locationInContainer))
+        if (!result.addNodeToRectBasedTestResult(nodeForHitTest(), request, locationInContainer))
            return true;
     }
 
@@ -4759,7 +4777,7 @@ bool RenderBlock::nodeAtPoint(const HitTestRequest& request, HitTestResult& resu
         LayoutRect boundsRect(adjustedLocation, size());
         if (visibleToHitTesting() && locationInContainer.intersects(boundsRect)) {
             updateHitTestResult(result, flipForWritingMode(locationInContainer.point() - localOffset));
-            if (!result.addNodeToRectBasedTestResult(node(), request, locationInContainer, boundsRect))
+            if (!result.addNodeToRectBasedTestResult(nodeForHitTest(), request, locationInContainer, boundsRect))
                 return true;
         }
     }
@@ -5785,6 +5803,7 @@ void RenderBlock::computeInlinePreferredLogicalWidths()
     LayoutUnit textIndent = minimumValueForLength(styleToUse->textIndent(), cw, view());
     RenderObject* prevFloat = 0;
     bool isPrevChildInlineFlow = false;
+    bool shouldBreakLineAfterText = false;
     while (RenderObject* child = childIterator.next()) {
         autoWrap = child->isReplaced() ? child->parent()->style()->autoWrap() : 
             child->style()->autoWrap();
@@ -5873,7 +5892,7 @@ void RenderBlock::computeInlinePreferredLogicalWidths()
                     clearPreviousFloat = false;
 
                 bool canBreakReplacedElement = !child->isImage() || allowImagesToBreak;
-                if ((canBreakReplacedElement && (autoWrap || oldAutoWrap) && !isPrevChildInlineFlow) || clearPreviousFloat) {
+                if ((canBreakReplacedElement && (autoWrap || oldAutoWrap) && (!isPrevChildInlineFlow || shouldBreakLineAfterText)) || clearPreviousFloat) {
                     updatePreferredWidth(m_minPreferredLogicalWidth, inlineMin);
                     inlineMin = 0;
                 }
@@ -5900,7 +5919,7 @@ void RenderBlock::computeInlinePreferredLogicalWidths()
                 // Add our width to the max.
                 inlineMax += max<float>(0, childMax);
 
-                if (!autoWrap || !canBreakReplacedElement || isPrevChildInlineFlow) {
+                if (!autoWrap || !canBreakReplacedElement || (isPrevChildInlineFlow && !shouldBreakLineAfterText)) {
                     if (child->isFloating())
                         updatePreferredWidth(m_minPreferredLogicalWidth, childMin);
                     else
@@ -6004,9 +6023,11 @@ void RenderBlock::computeInlinePreferredLogicalWidths()
                         // and end our current line.
                         updatePreferredWidth(m_minPreferredLogicalWidth, inlineMin);
                         inlineMin = 0;
+                        shouldBreakLineAfterText = false;
                     } else {
                         updatePreferredWidth(m_minPreferredLogicalWidth, inlineMin);
                         inlineMin = endMin;
+                        shouldBreakLineAfterText = true;
                     }
                 }
 
@@ -6819,14 +6840,7 @@ void RenderBlock::updateHitTestResult(HitTestResult& result, const LayoutPoint&
     if (result.innerNode())
         return;
 
-    Node* n = node();
-    if (isAnonymousBlockContinuation())
-        // We are in the margins of block elements that are part of a continuation.  In
-        // this case we're actually still inside the enclosing element that was
-        // split.  Go ahead and set our inner node accordingly.
-        n = continuation()->node();
-
-    if (n) {
+    if (Node* n = nodeForHitTest()) {
         result.setInnerNode(n);
         if (!result.innerNonSharedNode())
             result.setInnerNonSharedNode(n);
@@ -6981,6 +6995,11 @@ LayoutUnit RenderBlock::applyBeforeBreak(RenderBox* child, LayoutUnit logicalOff
     if (checkBeforeAlways && inNormalFlow(child) && hasNextPage(logicalOffset, IncludePageBoundary)) {
         if (checkColumnBreaks)
             view()->layoutState()->addForcedColumnBreak(child, logicalOffset);
+        if (checkRegionBreaks) {
+            LayoutUnit offsetBreakAdjustment = ZERO_LAYOUT_UNIT;
+            if (enclosingRenderFlowThread()->addForcedRegionBreak(offsetFromLogicalTopOfFirstPage() + logicalOffset, child, true, &offsetBreakAdjustment))
+                return logicalOffset + offsetBreakAdjustment;
+        }
         return nextPageLogicalTop(logicalOffset, IncludePageBoundary);
     }
     return logicalOffset;
@@ -6998,6 +7017,12 @@ LayoutUnit RenderBlock::applyAfterBreak(RenderBox* child, LayoutUnit logicalOffs
         marginInfo.setMarginAfterQuirk(true); // Cause margins to be discarded for any following content.
         if (checkColumnBreaks)
             view()->layoutState()->addForcedColumnBreak(child, logicalOffset);
+        if (checkRegionBreaks) {
+            LayoutUnit marginOffset = marginInfo.canCollapseWithMarginBefore() ? ZERO_LAYOUT_UNIT : marginInfo.margin();
+            LayoutUnit offsetBreakAdjustment = ZERO_LAYOUT_UNIT;
+            if (enclosingRenderFlowThread()->addForcedRegionBreak(offsetFromLogicalTopOfFirstPage() + logicalOffset + marginOffset, child, false, &offsetBreakAdjustment))
+                return logicalOffset + offsetBreakAdjustment;
+        }
         return nextPageLogicalTop(logicalOffset, IncludePageBoundary);
     }
     return logicalOffset;
diff --git a/Source/WebCore/rendering/RenderBlock.h b/Source/WebCore/rendering/RenderBlock.h
index 567d7dcb4..cb4158b00 100644
--- a/Source/WebCore/rendering/RenderBlock.h
+++ b/Source/WebCore/rendering/RenderBlock.h
@@ -86,6 +86,9 @@ public:
     RenderBlock(Node*);
     virtual ~RenderBlock();
 
+    RenderObject* firstChild() const { ASSERT(children() == virtualChildren()); return children()->firstChild(); }
+    RenderObject* lastChild() const { ASSERT(children() == virtualChildren()); return children()->lastChild(); }
+
     const RenderObjectChildList* children() const { return &m_children; }
     RenderObjectChildList* children() { return &m_children; }
 
@@ -568,6 +571,8 @@ private:
     void createFirstLetterRenderer(RenderObject* firstLetterBlock, RenderObject* currentChild);
     void updateFirstLetterStyle(RenderObject* firstLetterBlock, RenderObject* firstLetterContainer);
 
+    Node* nodeForHitTest() const;
+
     struct FloatWithRect {
         FloatWithRect(RenderBox* f)
             : object(f)
diff --git a/Source/WebCore/rendering/RenderBlockLineLayout.cpp b/Source/WebCore/rendering/RenderBlockLineLayout.cpp
index 756a3c31e..3b27abd6f 100644
--- a/Source/WebCore/rendering/RenderBlockLineLayout.cpp
+++ b/Source/WebCore/rendering/RenderBlockLineLayout.cpp
@@ -94,13 +94,8 @@ public:
 #endif
         updateAvailableWidth();
     }
-#if ENABLE(SUBPIXEL_LAYOUT)
     bool fitsOnLine() const { return currentWidth() <= m_availableWidth; }
     bool fitsOnLine(float extra) const { return currentWidth() + extra <= m_availableWidth; }
-#else
-    bool fitsOnLine() const { return currentWidth() <= m_availableWidth; }
-    bool fitsOnLine(float extra) const { return currentWidth() + extra <= m_availableWidth; }
-#endif
     float currentWidth() const { return m_committedWidth + m_uncommittedWidth; }
 
     // FIXME: We should eventually replace these three functions by ones that work on a higher abstraction.
@@ -177,12 +172,12 @@ inline void LineWidth::shrinkAvailableWidthForNewFloatIfNeeded(RenderBlock::Floa
         return;
 
     if (newFloat->type() == RenderBlock::FloatingObject::FloatLeft) {
-        float newLeft = m_block->pixelSnappedLogicalRightForFloat(newFloat);
+        float newLeft = m_block->logicalRightForFloat(newFloat);
         if (m_isFirstLine && m_block->style()->isLeftToRightDirection())
             newLeft += floorToInt(m_block->textIndentOffset());
         m_left = max<float>(m_left, newLeft);
     } else {
-        float newRight = m_block->pixelSnappedLogicalLeftForFloat(newFloat);
+        float newRight = m_block->logicalLeftForFloat(newFloat);
         if (m_isFirstLine && !m_block->style()->isLeftToRightDirection())
             newRight -= floorToInt(m_block->textIndentOffset());
         m_right = min<float>(m_right, newRight);
@@ -1403,9 +1398,9 @@ void RenderBlock::layoutRunsAndFloatsInRange(LineLayoutState& layoutState, Inlin
     ExclusionShapeInsideInfo* exclusionShapeInsideInfo = layoutExclusionShapeInsideInfo(this);
     if (exclusionShapeInsideInfo) {
         if (exclusionShapeInsideInfo != this->exclusionShapeInsideInfo()) {
-            // FIXME: If layout state is disabled, the offset will be incorrect.
-            LayoutSize layoutOffset = view()->layoutState()->layoutOffset();
-            absoluteLogicalTop = logicalTop() + (isHorizontalWritingMode() ? layoutOffset.height() : layoutOffset.width());
+            // FIXME Bug 100284: If subsequent LayoutStates are pushed, we will have to add
+            // their offsets from the original shape-inside container.
+            absoluteLogicalTop = logicalTop();
         }
         // Begin layout at the logical top of our shape inside.
         if (logicalHeight() + absoluteLogicalTop < exclusionShapeInsideInfo->shapeLogicalTop())
@@ -2815,7 +2810,7 @@ InlineIterator RenderBlock::LineBreaker::nextLineBreak(InlineBidiResolver& resol
         } else
             ASSERT_NOT_REACHED();
 
-        bool checkForBreak = autoWrap;
+        bool checkForBreak = autoWrap || blockStyle->autoWrap();
         if (width.committedWidth() && !width.fitsOnLine() && lBreak.m_obj && currWS == NOWRAP)
             checkForBreak = true;
         else if (next && current.m_obj->isText() && next->isText() && !next->isBR() && (autoWrap || (next->style()->autoWrap()))) {
diff --git a/Source/WebCore/rendering/RenderBox.h b/Source/WebCore/rendering/RenderBox.h
index 4d1328cfa..0e7312c0d 100644
--- a/Source/WebCore/rendering/RenderBox.h
+++ b/Source/WebCore/rendering/RenderBox.h
@@ -382,7 +382,7 @@ public:
         return document()->inQuirksMode() && style()->logicalHeight().isAuto() && !isFloatingOrOutOfFlowPositioned() && (isRoot() || isBody()) && !document()->shouldDisplaySeamlesslyWithParent();
     }
 
-    virtual IntSize intrinsicSize() const { return IntSize(); }
+    virtual LayoutSize intrinsicSize() const { return LayoutSize(); }
     LayoutUnit intrinsicLogicalWidth() const { return style()->isHorizontalWritingMode() ? intrinsicSize().width() : intrinsicSize().height(); }
     LayoutUnit intrinsicLogicalHeight() const { return style()->isHorizontalWritingMode() ? intrinsicSize().height() : intrinsicSize().width(); }
 
diff --git a/Source/WebCore/rendering/RenderBoxModelObject.cpp b/Source/WebCore/rendering/RenderBoxModelObject.cpp
index fd6390ae3..3ee8827f2 100644
--- a/Source/WebCore/rendering/RenderBoxModelObject.cpp
+++ b/Source/WebCore/rendering/RenderBoxModelObject.cpp
@@ -1046,6 +1046,12 @@ IntSize RenderBoxModelObject::calculateImageIntrinsicDimensions(StyleImage* imag
     return positioningAreaSize;
 }
 
+static inline void applySubPixelHeuristicForTileSize(LayoutSize& tileSize, const IntSize& positioningAreaSize)
+{
+    tileSize.setWidth(positioningAreaSize.width() - tileSize.width() <= 1 ? tileSize.width().ceil() : tileSize.width().floor());
+    tileSize.setHeight(positioningAreaSize.height() - tileSize.height() <= 1 ? tileSize.height().ceil() : tileSize.height().floor());
+}
+
 IntSize RenderBoxModelObject::calculateFillTileSize(const FillLayer* fillLayer, const IntSize& positioningAreaSize) const
 {
     StyleImage* image = fillLayer->image();
@@ -1056,37 +1062,38 @@ IntSize RenderBoxModelObject::calculateFillTileSize(const FillLayer* fillLayer,
     RenderView* renderView = view();
     switch (type) {
         case SizeLength: {
-            int w = positioningAreaSize.width();
-            int h = positioningAreaSize.height();
+            LayoutSize tileSize = positioningAreaSize;
 
             Length layerWidth = fillLayer->size().size.width();
             Length layerHeight = fillLayer->size().size.height();
 
             if (layerWidth.isFixed())
-                w = layerWidth.value();
+                tileSize.setWidth(layerWidth.value());
             else if (layerWidth.isPercent() || layerHeight.isViewportPercentage())
-                w = valueForLength(layerWidth, positioningAreaSize.width(), renderView);
+                tileSize.setWidth(valueForLength(layerWidth, positioningAreaSize.width(), renderView));
             
             if (layerHeight.isFixed())
-                h = layerHeight.value();
+                tileSize.setHeight(layerHeight.value());
             else if (layerHeight.isPercent() || layerHeight.isViewportPercentage())
-                h = valueForLength(layerHeight, positioningAreaSize.height(), renderView);
-            
+                tileSize.setHeight(valueForLength(layerHeight, positioningAreaSize.height(), renderView));
+
+            applySubPixelHeuristicForTileSize(tileSize, positioningAreaSize);
+
             // If one of the values is auto we have to use the appropriate
             // scale to maintain our aspect ratio.
             if (layerWidth.isAuto() && !layerHeight.isAuto()) {
                 if (imageIntrinsicSize.height())
-                    w = imageIntrinsicSize.width() * h / imageIntrinsicSize.height();        
+                    tileSize.setWidth(imageIntrinsicSize.width() * tileSize.height() / imageIntrinsicSize.height());
             } else if (!layerWidth.isAuto() && layerHeight.isAuto()) {
                 if (imageIntrinsicSize.width())
-                    h = imageIntrinsicSize.height() * w / imageIntrinsicSize.width();
+                    tileSize.setHeight(imageIntrinsicSize.height() * tileSize.width() / imageIntrinsicSize.width());
             } else if (layerWidth.isAuto() && layerHeight.isAuto()) {
                 // If both width and height are auto, use the image's intrinsic size.
-                w = imageIntrinsicSize.width();
-                h = imageIntrinsicSize.height();
+                tileSize = imageIntrinsicSize;
             }
             
-            return IntSize(max(0, w), max(0, h));
+            tileSize.clampNegativeToZero();
+            return flooredIntSize(tileSize);
         }
         case SizeNone: {
             // If both values are ‘auto’ then the intrinsic width and/or height of the image should be used, if any.
diff --git a/Source/WebCore/rendering/RenderButton.cpp b/Source/WebCore/rendering/RenderButton.cpp
index 7103e6e50..69cef2922 100644
--- a/Source/WebCore/rendering/RenderButton.cpp
+++ b/Source/WebCore/rendering/RenderButton.cpp
@@ -60,7 +60,11 @@ void RenderButton::addChild(RenderObject* newChild, RenderObject* beforeChild)
 
 void RenderButton::removeChild(RenderObject* oldChild)
 {
-    if (oldChild == m_inner || !m_inner) {
+    // m_inner should be the only child, but checking for direct children who
+    // are not m_inner prevents security problems when that assumption is
+    // violated.
+    if (oldChild == m_inner || !m_inner || oldChild->parent() == this) {
+        ASSERT(oldChild == m_inner || !m_inner);
         RenderDeprecatedFlexibleBox::removeChild(oldChild);
         m_inner = 0;
     } else
diff --git a/Source/WebCore/rendering/RenderDetailsMarker.cpp b/Source/WebCore/rendering/RenderDetailsMarker.cpp
index 01b234876..345c1389e 100644
--- a/Source/WebCore/rendering/RenderDetailsMarker.cpp
+++ b/Source/WebCore/rendering/RenderDetailsMarker.cpp
@@ -21,7 +21,7 @@
 #include "config.h"
 #include "RenderDetailsMarker.h"
 
-#if ENABLE(DETAILS_ELEMENT) || ENABLE(CALENDAR_PICKER)
+#if ENABLE(DETAILS_ELEMENT) || ENABLE(INPUT_MULTIPLE_FIELDS_UI)
 #include "Element.h"
 #include "GraphicsContext.h"
 #include "HTMLNames.h"
diff --git a/Source/WebCore/rendering/RenderDetailsMarker.h b/Source/WebCore/rendering/RenderDetailsMarker.h
index ac93be868..f60b3cb48 100644
--- a/Source/WebCore/rendering/RenderDetailsMarker.h
+++ b/Source/WebCore/rendering/RenderDetailsMarker.h
@@ -21,7 +21,7 @@
 #ifndef RenderDetailsMarker_h
 #define RenderDetailsMarker_h
 
-#if ENABLE(DETAILS_ELEMENT) || ENABLE(CALENDAR_PICKER)
+#if ENABLE(DETAILS_ELEMENT) || ENABLE(INPUT_MULTIPLE_FIELDS_UI)
 #include "RenderBlock.h"
 
 namespace WebCore {
diff --git a/Source/WebCore/rendering/RenderEmbeddedObject.cpp b/Source/WebCore/rendering/RenderEmbeddedObject.cpp
index 1e12c7c90..e964855d7 100644
--- a/Source/WebCore/rendering/RenderEmbeddedObject.cpp
+++ b/Source/WebCore/rendering/RenderEmbeddedObject.cpp
@@ -53,6 +53,10 @@
 #include "Text.h"
 #include "TextRun.h"
 
+#if ENABLE(PLUGIN_PROXY_FOR_VIDEO)
+#include "HTMLMediaElement.h"
+#endif
+
 namespace WebCore {
 
 using namespace HTMLNames;
@@ -113,6 +117,8 @@ static String unavailablePluginReplacementText(RenderEmbeddedObject::PluginUnava
         return blockedPluginByContentSecurityPolicyText();
     case RenderEmbeddedObject::InsecurePluginVersion:
         return insecurePluginVersionText();
+    case RenderEmbeddedObject::PluginInactive:
+        return inactivePluginText();
     }
 
     ASSERT_NOT_REACHED();
@@ -231,6 +237,10 @@ void RenderEmbeddedObject::layout()
     StackStats::LayoutCheckPoint layoutCheckPoint;
     ASSERT(needsLayout());
 
+#if ENABLE(PLUGIN_PROXY_FOR_VIDEO)
+    LayoutSize oldSize = contentBoxRect().size();
+#endif
+
     updateLogicalWidth();
     updateLogicalHeight();
 
@@ -245,6 +255,31 @@ void RenderEmbeddedObject::layout()
         frameView()->addWidgetToUpdate(this);
 
     setNeedsLayout(false);
+
+#if ENABLE(PLUGIN_PROXY_FOR_VIDEO)
+    // This code copied from RenderMedia::layout().
+    RenderBox* controlsRenderer = toRenderBox(m_children.firstChild());
+    if (!controlsRenderer)
+        return;
+    
+    LayoutSize newSize = contentBoxRect().size();
+    if (newSize == oldSize && !controlsRenderer->needsLayout())
+        return;
+    
+    // When calling layout() on a child node, a parent must either push a LayoutStateMaintainter, or
+    // instantiate LayoutStateDisabler. Since using a LayoutStateMaintainer is slightly more efficient,
+    // and this method will be called many times per second during playback, use a LayoutStateMaintainer:
+    LayoutStateMaintainer statePusher(view(), this, locationOffset(), hasTransform() || hasReflection() || style()->isFlippedBlocksWritingMode());
+    
+    controlsRenderer->setLocation(LayoutPoint(borderLeft(), borderTop()) + LayoutSize(paddingLeft(), paddingTop()));
+    controlsRenderer->style()->setHeight(Length(newSize.height(), Fixed));
+    controlsRenderer->style()->setWidth(Length(newSize.width(), Fixed));
+    controlsRenderer->setNeedsLayout(true, MarkOnlyThis);
+    controlsRenderer->layout();
+    setChildNeedsLayout(false);
+    
+    statePusher.pop();
+#endif
 }
 
 void RenderEmbeddedObject::viewCleared()
diff --git a/Source/WebCore/rendering/RenderEmbeddedObject.h b/Source/WebCore/rendering/RenderEmbeddedObject.h
index 95d131756..133f34d92 100644
--- a/Source/WebCore/rendering/RenderEmbeddedObject.h
+++ b/Source/WebCore/rendering/RenderEmbeddedObject.h
@@ -41,7 +41,8 @@ public:
         PluginMissing,
         PluginCrashed,
         PluginBlockedByContentSecurityPolicy,
-        InsecurePluginVersion
+        InsecurePluginVersion,
+        PluginInactive,
     };
     void setPluginUnavailabilityReason(PluginUnavailabilityReason);
     bool showsUnavailablePluginIndicator() const;
@@ -62,6 +63,11 @@ protected:
 
     virtual CursorDirective getCursor(const LayoutPoint&, Cursor&) const;
 
+#if ENABLE(PLUGIN_PROXY_FOR_VIDEO)
+    const RenderObjectChildList* children() const { return &m_children; }
+    RenderObjectChildList* children() { return &m_children; }
+#endif
+
 private:
     virtual const char* renderName() const { return "RenderEmbeddedObject"; }
     virtual bool isEmbeddedObject() const { return true; }
@@ -83,6 +89,12 @@ private:
     bool isInUnavailablePluginIndicator(const LayoutPoint&) const;
     bool getReplacementTextGeometry(const LayoutPoint& accumulatedOffset, FloatRect& contentRect, Path&, FloatRect& replacementTextRect, Font&, TextRun&, float& textWidth) const;
 
+#if ENABLE(PLUGIN_PROXY_FOR_VIDEO)
+    virtual bool canHaveChildren() const { return node() && toElement(node())->isMediaElement(); }
+    virtual RenderObjectChildList* virtualChildren() { return children(); }
+    virtual const RenderObjectChildList* virtualChildren() const { return children(); }
+#endif
+
     bool m_hasFallbackContent; // FIXME: This belongs on HTMLObjectElement.
 
     bool m_showsUnavailablePluginIndicator;
@@ -90,6 +102,9 @@ private:
     String m_unavailablePluginReplacementText;
     bool m_unavailablePluginIndicatorIsPressed;
     bool m_mouseDownWasInUnavailablePluginIndicator;
+#if ENABLE(PLUGIN_PROXY_FOR_VIDEO)
+    RenderObjectChildList m_children;
+#endif
 };
 
 inline RenderEmbeddedObject* toRenderEmbeddedObject(RenderObject* object)
diff --git a/Source/WebCore/rendering/RenderFlexibleBox.cpp b/Source/WebCore/rendering/RenderFlexibleBox.cpp
index ee425b3f4..e16b32127 100644
--- a/Source/WebCore/rendering/RenderFlexibleBox.cpp
+++ b/Source/WebCore/rendering/RenderFlexibleBox.cpp
@@ -661,10 +661,21 @@ LayoutPoint RenderFlexibleBox::flowAwareLocationForChild(RenderBox* child) const
 
 void RenderFlexibleBox::setFlowAwareLocationForChild(RenderBox* child, const LayoutPoint& location)
 {
+    LayoutRect oldFrameRect = child->frameRect();
+
     if (isHorizontalFlow())
         child->setLocation(location);
     else
         child->setLocation(location.transposedPoint());
+
+    // If the child moved, we have to repaint it as well as any floating/positioned
+    // descendants. An exception is if we need a layout. In this case, we know we're going to
+    // repaint ourselves (and the child) anyway.
+    // FIXME: In some cases, we might overpaint as we move a child multiple times. We could reduce
+    // overpainting by keeping track of the original position of a child and running this check on
+    // the final position.
+    if (!selfNeedsLayout() && child->checkForRepaintDuringLayout())
+        child->repaintDuringLayoutIfMoved(oldFrameRect);
 }
 
 LayoutUnit RenderFlexibleBox::mainAxisBorderAndPaddingExtentForChild(RenderBox* child) const
@@ -1142,10 +1153,7 @@ void RenderFlexibleBox::layoutColumnReverse(const OrderedFlexItemList& children,
         }
         mainAxisOffset -= mainAxisExtentForChild(child) + flowAwareMarginEndForChild(child);
 
-        LayoutRect oldRect = child->frameRect();
         setFlowAwareLocationForChild(child, LayoutPoint(mainAxisOffset, crossAxisOffset + flowAwareMarginBeforeForChild(child)));
-        if (!selfNeedsLayout() && child->checkForRepaintDuringLayout())
-            child->repaintDuringLayoutIfMoved(oldRect);
 
         mainAxisOffset -= flowAwareMarginStartForChild(child);
 
@@ -1216,14 +1224,7 @@ void RenderFlexibleBox::adjustAlignmentForChild(RenderBox* child, LayoutUnit del
         return;
     }
 
-    LayoutRect oldRect = child->frameRect();
     setFlowAwareLocationForChild(child, flowAwareLocationForChild(child) + LayoutSize(0, delta));
-
-    // If the child moved, we have to repaint it as well as any floating/positioned
-    // descendants. An exception is if we need a layout. In this case, we know we're going to
-    // repaint ourselves (and the child) anyway.
-    if (!selfNeedsLayout() && child->checkForRepaintDuringLayout())
-        child->repaintDuringLayoutIfMoved(oldRect);
 }
 
 void RenderFlexibleBox::alignChildren(OrderIterator& iterator, const WTF::Vector<LineContext>& lineContexts)
diff --git a/Source/WebCore/rendering/RenderFlowThread.cpp b/Source/WebCore/rendering/RenderFlowThread.cpp
index d054d2457..5af8d561a 100644
--- a/Source/WebCore/rendering/RenderFlowThread.cpp
+++ b/Source/WebCore/rendering/RenderFlowThread.cpp
@@ -133,12 +133,16 @@ private:
 void RenderFlowThread::layout()
 {
     StackStats::LayoutCheckPoint layoutCheckPoint;
+
     m_pageLogicalHeightChanged = m_regionsInvalidated && everHadLayout();
     if (m_regionsInvalidated) {
         m_regionsInvalidated = false;
         m_regionsHaveUniformLogicalWidth = true;
         m_regionsHaveUniformLogicalHeight = true;
         m_regionRangeMap.clear();
+        m_breakBeforeToRegionMap.clear();
+        m_breakAfterToRegionMap.clear();
+
         LayoutUnit previousRegionLogicalWidth = 0;
         LayoutUnit previousRegionLogicalHeight = 0;
         bool firstRegionVisited = false;
@@ -599,8 +603,8 @@ void RenderFlowThread::computeOverflowStateForRegions(LayoutUnit oldClientAfterE
     LayoutUnit height = oldClientAfterEdge;
 
     // Simulate a region break at height. If it points inside an auto logical height region,
-    // then it determines the region override logical content height.
-    addForcedRegionBreak(height);
+    // then it may determine the region override logical content height.
+    addForcedRegionBreak(height, this, false);
 
     // FIXME: the visual overflow of middle region (if it is the last one to contain any content in a render flow thread)
     // might not be taken into account because the render flow thread height is greater that that regions height + its visual overflow
@@ -784,59 +788,103 @@ void RenderFlowThread::updateRegionsFlowThreadPortionRect()
 
         LayoutRect regionRect(style()->direction() == LTR ? ZERO_LAYOUT_UNIT : logicalWidth() - regionLogicalWidth, logicalHeight, regionLogicalWidth, regionLogicalHeight);
 
-        // FIXME: when a flow thread has more than one auto logical height region,
+        // When a flow thread has more than one auto logical height region,
         // we have to take into account the override logical content height value,
         // if computed for an auto logical height region, and use it to set the height
         // for the region rect. This way, the regions in the chain following the auto
         // logical height region, will be able to fragment the right part of their
         // associated flow thread content (and compute their overrideComputedLogicalHeight properly).
+        if (region->hasOverrideHeight() && view()->normalLayoutPhase()) {
+            regionLogicalHeight = region->overrideLogicalContentHeight();
+            regionRect.setHeight(regionLogicalHeight);
+        }
 
         region->setFlowThreadPortionRect(isHorizontalWritingMode() ? regionRect : regionRect.transposedRect());
         logicalHeight += regionLogicalHeight;
     }
 }
 
-// FIXME: Extend it to account for region break
-void RenderFlowThread::addForcedRegionBreak(LayoutUnit offsetBreakInFlowThread)
+void RenderFlowThread::clearOverrideLogicalContentHeightInRegions(RenderRegion* startRegion)
+{
+    RenderRegionList::iterator regionIter = startRegion ? m_regionList.find(startRegion) : m_regionList.begin();
+    for (; regionIter != m_regionList.end(); ++regionIter) {
+        RenderRegion* region = *regionIter;
+        if (region->hasAutoLogicalHeight())
+            region->clearOverrideLogicalContentHeight();
+    }
+}
+
+// Even if we require the break to occur at offsetBreakInFlowThread, because regions may have min/max-height values,
+// it is possible that the break will occur at a different offset than the original one required.
+// offsetBreakAdjustment measures the different between the requested break offset and the current break offset.
+bool RenderFlowThread::addForcedRegionBreak(LayoutUnit offsetBreakInFlowThread, RenderObject* breakChild, bool isBefore, LayoutUnit* offsetBreakAdjustment)
 {
     // We take breaks into account for height computation for auto logical height regions
     // only in the layout phase in which we lay out the flows threads unconstrained
     // and we use the content breaks to determine the overrideContentLogicalHeight for
     // auto logical height regions.
     if (view()->constrainedFlowThreadsLayoutPhase())
-        return;
+        return false;
 
-    // Simulate a region break at height. If it points inside an auto logical height region,
+    // Breaks can come before or after some objects. We need to track these objects, so that if we get
+    // multiple breaks for the same object (for example because of multiple layouts on the same object),
+    // we need to invalidate every other region after the old one and start computing from fresh.
+    RenderObjectToRegionMap& mapToUse = isBefore ? m_breakBeforeToRegionMap : m_breakAfterToRegionMap;
+    RenderObjectToRegionMap::iterator iter = mapToUse.find(breakChild);
+    if (iter != mapToUse.end()) {
+        RenderRegionList::iterator regionIter = m_regionList.find(iter->value);
+        ASSERT(regionIter != m_regionList.end());
+        ASSERT((*regionIter)->hasAutoLogicalHeight());
+        clearOverrideLogicalContentHeightInRegions(*regionIter);
+
+        // We need to update the regions flow thread portion rect because we are going to process
+        // a break on these regions.
+        updateRegionsFlowThreadPortionRect();
+    }
+
+    // Simulate a region break at offsetBreakInFlowThread. If it points inside an auto logical height region,
     // then it determines the region override logical content height.
     RenderRegion* region = regionAtBlockOffset(offsetBreakInFlowThread);
     if (!region)
-        return;
+        return false;
 
-    if (!region->needsOverrideLogicalContentHeightComputation())
-        return;
+    // We want to distribute the offsetBreakInFlowThread content among the regions starting with the found region.
+    bool overrideLogicalContentHeightComputed = false;
 
     LayoutUnit currentRegionOffsetInFlowThread = isHorizontalWritingMode() ? region->flowThreadPortionRect().y() : region->flowThreadPortionRect().x();
     LayoutUnit offsetBreakInCurrentRegion = offsetBreakInFlowThread - currentRegionOffsetInFlowThread;
-    LayoutUnit regionOverrideLogicalContentHeight = region->computeReplacedLogicalHeightRespectingMinMaxHeight(offsetBreakInCurrentRegion);
-    region->setOverrideLogicalContentHeight(regionOverrideLogicalContentHeight);
 
-    // FIXME: Extend it to take into account that we may have more than one auto-height region in flow.
-    // For now, clear the override logical content height for remaining auto logical height regions in the flow.
-    // A follow-up patch will properly distribute the remaining height into the following regions.
     RenderRegionList::iterator regionIter = m_regionList.find(region);
     ASSERT(regionIter != m_regionList.end());
+    for (; (regionIter != m_regionList.end()) && (currentRegionOffsetInFlowThread < offsetBreakInFlowThread); ++regionIter) {
+        RenderRegion* region = *regionIter;
+        if (region->needsOverrideLogicalContentHeightComputation()) {
+            mapToUse.set(breakChild, region);
 
-    // Skip the current region.
-    ++regionIter;
+            overrideLogicalContentHeightComputed = true;
 
-    for (; regionIter != m_regionList.end(); ++regionIter) {
-        RenderRegion* currRegion = *regionIter;
-        if (!currRegion->hasAutoLogicalHeight())
-            continue;
-        currRegion->clearOverrideLogicalContentHeight();
+            // Compute the region height pretending that the offsetBreakInCurrentRegion is the logicalHeight for the auto-height region.
+            LayoutUnit regionOverrideLogicalContentHeight = region->computeReplacedLogicalHeightRespectingMinMaxHeight(offsetBreakInCurrentRegion);
+            region->setOverrideLogicalContentHeight(regionOverrideLogicalContentHeight);
+
+            offsetBreakInCurrentRegion -= regionOverrideLogicalContentHeight;
+            currentRegionOffsetInFlowThread += regionOverrideLogicalContentHeight;
+        } else
+            currentRegionOffsetInFlowThread += isHorizontalWritingMode() ? region->flowThreadPortionRect().height() : region->flowThreadPortionRect().width();
     }
 
-    updateRegionsFlowThreadPortionRect();
+    // The remaining auto logical height regions in the chain that were unable to receive content
+    // and set their overrideLogicalContentHeight should have their associated values cleared.
+    if (regionIter != m_regionList.end())
+        clearOverrideLogicalContentHeightInRegions(*regionIter);
+
+    if (overrideLogicalContentHeightComputed)
+        updateRegionsFlowThreadPortionRect();
+
+    if (offsetBreakAdjustment)
+        *offsetBreakAdjustment = max<LayoutUnit>(ZERO_LAYOUT_UNIT, currentRegionOffsetInFlowThread - offsetBreakInFlowThread);
+
+    return overrideLogicalContentHeightComputed;
 }
 
 CurrentRenderFlowThreadMaintainer::CurrentRenderFlowThreadMaintainer(RenderFlowThread* renderFlowThread)
diff --git a/Source/WebCore/rendering/RenderFlowThread.h b/Source/WebCore/rendering/RenderFlowThread.h
index 1fb761016..581315be5 100644
--- a/Source/WebCore/rendering/RenderFlowThread.h
+++ b/Source/WebCore/rendering/RenderFlowThread.h
@@ -131,7 +131,7 @@ public:
     void resetRegionsOverrideLogicalContentHeight();
     void markAutoLogicalHeightRegionsForLayout();
 
-    void addForcedRegionBreak(LayoutUnit);
+    bool addForcedRegionBreak(LayoutUnit, RenderObject* breakChild, bool isBefore, LayoutUnit* offsetBreakAdjustment = 0);
 
     bool pageLogicalHeightChanged() const { return m_pageLogicalHeightChanged; }
 
@@ -152,6 +152,8 @@ protected:
     // Override if the flow thread implementation supports dispatching events when the flow layout is updated (e.g. for named flows)
     virtual void dispatchRegionLayoutUpdateEvent() { m_dispatchRegionLayoutUpdateEvent = false; }
 
+    void clearOverrideLogicalContentHeightInRegions(RenderRegion* startRegion = 0);
+
     RenderRegionList m_regionList;
 
     class RenderRegionRange {
@@ -184,6 +186,10 @@ protected:
     typedef HashMap<const RenderBox*, RenderRegionRange> RenderRegionRangeMap;
     RenderRegionRangeMap m_regionRangeMap;
 
+    typedef HashMap<RenderObject*, RenderRegion*> RenderObjectToRegionMap;
+    RenderObjectToRegionMap m_breakBeforeToRegionMap;
+    RenderObjectToRegionMap m_breakAfterToRegionMap;
+
     bool m_regionsInvalidated : 1;
     bool m_regionsHaveUniformLogicalWidth : 1;
     bool m_regionsHaveUniformLogicalHeight : 1;
diff --git a/Source/WebCore/rendering/RenderFrameSet.h b/Source/WebCore/rendering/RenderFrameSet.h
index b670575c3..edab2d98c 100644
--- a/Source/WebCore/rendering/RenderFrameSet.h
+++ b/Source/WebCore/rendering/RenderFrameSet.h
@@ -58,6 +58,9 @@ public:
     RenderFrameSet(HTMLFrameSetElement*);
     virtual ~RenderFrameSet();
 
+    RenderObject* firstChild() const { ASSERT(children() == virtualChildren()); return children()->firstChild(); }
+    RenderObject* lastChild() const { ASSERT(children() == virtualChildren()); return children()->lastChild(); }
+
     const RenderObjectChildList* children() const { return &m_children; }
     RenderObjectChildList* children() { return &m_children; }
 
diff --git a/Source/WebCore/rendering/RenderGeometryMap.cpp b/Source/WebCore/rendering/RenderGeometryMap.cpp
index 46d210da5..5a6a69d9d 100644
--- a/Source/WebCore/rendering/RenderGeometryMap.cpp
+++ b/Source/WebCore/rendering/RenderGeometryMap.cpp
@@ -104,7 +104,7 @@ void RenderGeometryMap::mapToAbsolute(TransformState& transformState) const
         // If this box has a transform, it acts as a fixed position container
         // for fixed descendants, which prevents the propagation of 'fixed'
         // unless the layer itself is also fixed position.
-        if (currentStep.m_hasTransform && !currentStep.m_isFixedPosition)
+        if (i && currentStep.m_hasTransform && !currentStep.m_isFixedPosition)
             inFixed = false;
         else if (currentStep.m_isFixedPosition)
             inFixed = true;
diff --git a/Source/WebCore/rendering/RenderHTMLCanvas.cpp b/Source/WebCore/rendering/RenderHTMLCanvas.cpp
index 5810da230..bfa1c4fbf 100644
--- a/Source/WebCore/rendering/RenderHTMLCanvas.cpp
+++ b/Source/WebCore/rendering/RenderHTMLCanvas.cpp
@@ -75,7 +75,7 @@ void RenderHTMLCanvas::paintReplaced(PaintInfo& paintInfo, const LayoutPoint& pa
 void RenderHTMLCanvas::canvasSizeChanged()
 {
     IntSize canvasSize = static_cast<HTMLCanvasElement*>(node())->size();
-    IntSize zoomedSize(canvasSize.width() * style()->effectiveZoom(), canvasSize.height() * style()->effectiveZoom());
+    LayoutSize zoomedSize(canvasSize.width() * style()->effectiveZoom(), canvasSize.height() * style()->effectiveZoom());
 
     if (zoomedSize == intrinsicSize())
         return;
diff --git a/Source/WebCore/rendering/RenderImage.cpp b/Source/WebCore/rendering/RenderImage.cpp
index 25a62f50b..c3bcf3a1a 100644
--- a/Source/WebCore/rendering/RenderImage.cpp
+++ b/Source/WebCore/rendering/RenderImage.cpp
@@ -165,7 +165,8 @@ void RenderImage::imageChanged(WrappedImagePtr newImage, const IntRect* rect)
         return;
     
     if (!m_didIncrementVisuallyNonEmptyPixelCount) {
-        view()->frameView()->incrementVisuallyNonEmptyPixelCount(m_imageResource->imageSize(1.0f));
+        // At a zoom level of 1 the image is guaranteed to have an integer size.
+        view()->frameView()->incrementVisuallyNonEmptyPixelCount(flooredIntSize(m_imageResource->imageSize(1.0f)));
         m_didIncrementVisuallyNonEmptyPixelCount = true;
     }
 
@@ -187,7 +188,7 @@ void RenderImage::imageChanged(WrappedImagePtr newImage, const IntRect* rect)
     imageDimensionsChanged(imageSizeChanged, rect);
 }
 
-bool RenderImage::updateIntrinsicSizeIfNeeded(const IntSize& newSize, bool imageSizeChanged)
+bool RenderImage::updateIntrinsicSizeIfNeeded(const LayoutSize& newSize, bool imageSizeChanged)
 {
     if (newSize == intrinsicSize() && !imageSizeChanged)
         return false;
@@ -326,7 +327,7 @@ void RenderImage::paintReplaced(PaintInfo& paintInfo, const LayoutPoint& paintOf
                 if (centerY < 0)
                     centerY = 0;
                 imageOffset = LayoutSize(leftBorder + leftPad + centerX + 1, topBorder + topPad + centerY + 1);
-                context->drawImage(image.get(), style()->colorSpace(), IntRect(roundedIntPoint(paintOffset + imageOffset), imageSize), CompositeSourceOver, shouldRespectImageOrientation());
+                context->drawImage(image.get(), style()->colorSpace(), pixelSnappedIntRect(LayoutRect(paintOffset + imageOffset, imageSize)), CompositeSourceOver, shouldRespectImageOrientation());
                 errorPictureDrawn = true;
             }
 
@@ -485,9 +486,9 @@ bool RenderImage::backgroundIsObscured() const
     return true;
 }
 
-int RenderImage::minimumReplacedHeight() const
+LayoutUnit RenderImage::minimumReplacedHeight() const
 {
-    return m_imageResource->errorOccurred() ? intrinsicSize().height() : 0;
+    return m_imageResource->errorOccurred() ? intrinsicSize().height() : LayoutUnit();
 }
 
 HTMLMapElement* RenderImage::imageMap() const
diff --git a/Source/WebCore/rendering/RenderImage.h b/Source/WebCore/rendering/RenderImage.h
index 2358fb2db..e734fdd4d 100644
--- a/Source/WebCore/rendering/RenderImage.h
+++ b/Source/WebCore/rendering/RenderImage.h
@@ -89,7 +89,7 @@ private:
 
     virtual bool backgroundIsObscured() const;
 
-    virtual int minimumReplacedHeight() const;
+    virtual LayoutUnit minimumReplacedHeight() const OVERRIDE;
 
     virtual void notifyFinished(CachedResource*);
     virtual bool nodeAtPoint(const HitTestRequest&, HitTestResult&, const HitTestLocation& locationInContainer, const LayoutPoint& accumulatedOffset, HitTestAction) OVERRIDE;
@@ -98,7 +98,7 @@ private:
 
     IntSize imageSizeForError(CachedImage*) const;
     void imageDimensionsChanged(bool imageSizeChanged, const IntRect* = 0);
-    bool updateIntrinsicSizeIfNeeded(const IntSize&, bool imageSizeChanged);
+    bool updateIntrinsicSizeIfNeeded(const LayoutSize&, bool imageSizeChanged);
 
     void paintAreaElementFocusRing(PaintInfo&);
 
diff --git a/Source/WebCore/rendering/RenderImageResource.h b/Source/WebCore/rendering/RenderImageResource.h
index ac24fbaf9..4546684ed 100644
--- a/Source/WebCore/rendering/RenderImageResource.h
+++ b/Source/WebCore/rendering/RenderImageResource.h
@@ -29,6 +29,7 @@
 #include "CachedImage.h"
 #include "CachedResourceHandle.h"
 #include "Image.h"
+#include "LayoutTypesInlineMethods.h"
 #include "StyleImage.h"
 
 namespace WebCore {
@@ -62,7 +63,7 @@ public:
     virtual bool imageHasRelativeWidth() const { return m_cachedImage ? m_cachedImage->imageHasRelativeWidth() : false; }
     virtual bool imageHasRelativeHeight() const { return m_cachedImage ? m_cachedImage->imageHasRelativeHeight() : false; }
 
-    virtual IntSize imageSize(float multiplier) const { return m_cachedImage ? m_cachedImage->imageSizeForRenderer(m_renderer, multiplier) : IntSize(); }
+    virtual LayoutSize imageSize(float multiplier) const { return m_cachedImage ? m_cachedImage->imageSizeForRenderer(m_renderer, multiplier) : LayoutSize(); }
 
     virtual WrappedImagePtr imagePtr() const { return m_cachedImage.get(); }
 
diff --git a/Source/WebCore/rendering/RenderImageResourceStyleImage.h b/Source/WebCore/rendering/RenderImageResourceStyleImage.h
index 6d2f7b6b2..6263be1a1 100644
--- a/Source/WebCore/rendering/RenderImageResourceStyleImage.h
+++ b/Source/WebCore/rendering/RenderImageResourceStyleImage.h
@@ -54,7 +54,7 @@ public:
     virtual bool imageHasRelativeWidth() const { return m_styleImage->imageHasRelativeWidth(); }
     virtual bool imageHasRelativeHeight() const { return m_styleImage->imageHasRelativeHeight(); }
 
-    virtual IntSize imageSize(float multiplier) const { return m_styleImage->imageSize(m_renderer, multiplier); }
+    virtual LayoutSize imageSize(float multiplier) const OVERRIDE { return m_styleImage->imageSize(m_renderer, multiplier); }
 
     virtual WrappedImagePtr imagePtr() const { return m_styleImage->data(); }
 
diff --git a/Source/WebCore/rendering/RenderInline.h b/Source/WebCore/rendering/RenderInline.h
index 562ff47b9..5bc954a0b 100644
--- a/Source/WebCore/rendering/RenderInline.h
+++ b/Source/WebCore/rendering/RenderInline.h
@@ -35,6 +35,9 @@ class RenderInline : public RenderBoxModelObject {
 public:
     explicit RenderInline(Node*);
 
+    RenderObject* firstChild() const { ASSERT(children() == virtualChildren()); return children()->firstChild(); }
+    RenderObject* lastChild() const { ASSERT(children() == virtualChildren()); return children()->lastChild(); }
+
     virtual void addChild(RenderObject* newChild, RenderObject* beforeChild = 0);
 
     virtual LayoutUnit marginLeft() const;
diff --git a/Source/WebCore/rendering/RenderLayer.cpp b/Source/WebCore/rendering/RenderLayer.cpp
index 69908af42..410fca1f4 100644
--- a/Source/WebCore/rendering/RenderLayer.cpp
+++ b/Source/WebCore/rendering/RenderLayer.cpp
@@ -110,6 +110,13 @@
 #include "SVGNames.h"
 #endif
 
+#if ENABLE(CSS_SHADERS) && USE(3D_GRAPHICS)
+#include "CustomFilterGlobalContext.h"
+#include "CustomFilterOperation.h"
+#include "CustomFilterValidatedProgram.h"
+#include "ValidatedCustomFilterOperation.h"
+#endif
+
 #if PLATFORM(BLACKBERRY)
 #define DISABLE_ROUNDED_CORNER_CLIPPING
 #endif
@@ -1878,10 +1885,27 @@ void RenderLayer::scrollRectToVisible(const LayoutRect& rect, const ScrollAlignm
         frameView->resumeScheduledEvents();
 }
 
+#if USE(ACCELERATED_COMPOSITING)
+static FrameView* frameViewFromLayer(const RenderLayer* layer)
+{
+    Frame* frame = layer->renderer()->frame();
+    if (!frame)
+        return 0;
+
+    return frame->view();
+}
+#endif
+
 void RenderLayer::updateCompositingLayersAfterScroll()
 {
 #if USE(ACCELERATED_COMPOSITING)
     if (compositor()->inCompositingMode()) {
+        // If we're in the middle of layout, we'll just update compositiong once layout has finished.
+        if (FrameView* frameView = frameViewFromLayer(this)) {
+            if (frameView->isInLayout())
+                return;
+        }
+
         // Our stacking context is guaranteed to contain all of our descendants that may need
         // repositioning, so update compositing layers from there.
         if (RenderLayer* compositingAncestor = stackingContext()->enclosingCompositingLayer()) {
@@ -3173,9 +3197,9 @@ void RenderLayer::paintLayerContents(RenderLayer* rootLayer, GraphicsContext* co
             ReferenceClipPathOperation* referenceClipPathOperation = static_cast<ReferenceClipPathOperation*>(style->clipPath());
             Document* document = renderer()->document();
             // FIXME: It doesn't work with forward or external SVG references (https://bugs.webkit.org/show_bug.cgi?id=90405)
-            Element* clipPath = document ? document->getElementById(referenceClipPathOperation->fragment()) : 0;
-            if (clipPath && clipPath->renderer() && clipPath->renderer()->isSVGResourceContainer())
-                static_cast<RenderSVGResourceClipper*>(clipPath->renderer())->applyClippingToContext(renderer(), calculateLayerBounds(this, rootLayer, 0), paintDirtyRect, context);
+            Element* element = document ? document->getElementById(referenceClipPathOperation->fragment()) : 0;
+            if (element && element->hasTagName(SVGNames::clipPathTag) && element->renderer())
+                static_cast<RenderSVGResourceClipper*>(element->renderer())->applyClippingToContext(renderer(), calculateLayerBounds(this, rootLayer, 0), paintDirtyRect, context);
         }
 #endif
     }
@@ -4501,7 +4525,7 @@ RenderLayerBacking* RenderLayer::ensureBacking()
         compositor()->layerBecameComposited(this);
 
 #if ENABLE(CSS_FILTERS)
-        updateOrRemoveFilterEffect();
+        updateOrRemoveFilterEffectRenderer();
 #endif
 #if ENABLE(CSS_COMPOSITING)
         backing()->setBlendMode(m_blendMode);
@@ -4518,7 +4542,7 @@ void RenderLayer::clearBacking(bool layerBeingDestroyed)
 
 #if ENABLE(CSS_FILTERS)
     if (!layerBeingDestroyed)
-        updateOrRemoveFilterEffect();
+        updateOrRemoveFilterEffectRenderer();
 #else
     UNUSED_PARAM(layerBeingDestroyed);
 #endif
@@ -4937,6 +4961,9 @@ void RenderLayer::styleChanged(StyleDifference, const RenderStyle* oldStyle)
 #if ENABLE(CSS_COMPOSITING)
     updateBlendMode();
 #endif
+#if ENABLE(CSS_FILTERS)
+    updateOrRemoveFilterClients();
+#endif
 
 #if USE(ACCELERATED_COMPOSITING)
     if (compositor()->updateLayerCompositingState(this))
@@ -4952,7 +4979,7 @@ void RenderLayer::styleChanged(StyleDifference, const RenderStyle* oldStyle)
 #endif
 
 #if ENABLE(CSS_FILTERS)
-    updateOrRemoveFilterEffect();
+    updateOrRemoveFilterEffectRenderer();
 #if USE(ACCELERATED_COMPOSITING)
     bool backingDidCompositeLayers = isComposited() && backing()->canCompositeFilters();
     if (isComposited() && backingDidCompositeLayers && !backing()->canCompositeFilters()) {
@@ -5075,8 +5102,60 @@ void RenderLayer::updateReflectionStyle()
     m_reflection->setStyle(newStyle.release());
 }
 
+#if ENABLE(CSS_SHADERS)
+bool RenderLayer::isCSSCustomFilterEnabled() const
+{
+    // We only want to enable shaders if WebGL is also enabled on this platform.
+    const Settings* settings = renderer()->document()->settings();
+    return settings && settings->isCSSCustomFilterEnabled() && settings->webGLEnabled();
+}
+#endif
+
 #if ENABLE(CSS_FILTERS)
-void RenderLayer::updateOrRemoveFilterEffect()
+FilterOperations RenderLayer::computeFilterOperations(const RenderStyle* style)
+{
+#if !ENABLE(CSS_SHADERS)
+    return style->filter();
+#else
+    const FilterOperations& filters = style->filter();
+    if (!filters.hasCustomFilter())
+        return filters;
+
+    if (!isCSSCustomFilterEnabled()) {
+        // CSS Custom filters should not parse at all in this case, but there might be
+        // remaining styles that were parsed when the flag was enabled. Reproduces in DumpRenderTree
+        // because it resets the flag while the previous test is still loaded.
+        return FilterOperations();
+    }
+
+    FilterOperations outputFilters;
+    for (size_t i = 0; i < filters.size(); ++i) {
+        RefPtr<FilterOperation> filterOperation = filters.operations().at(i);
+        if (filterOperation->getOperationType() == FilterOperation::CUSTOM) {
+            // We have to wait until the program of CSS Shaders is loaded before setting it on the layer.
+            // Note that we will handle the loading of the shaders and repainting of the layer in updateOrRemoveFilterClients.
+            const CustomFilterOperation* customOperation = static_cast<const CustomFilterOperation*>(filterOperation.get());
+            RefPtr<CustomFilterProgram> program = customOperation->program();
+            if (!program->isLoaded())
+                continue;
+            
+            CustomFilterGlobalContext* globalContext = renderer()->view()->customFilterGlobalContext();
+            RefPtr<CustomFilterValidatedProgram> validatedProgram = globalContext->getValidatedProgram(program->programInfo());
+            if (!validatedProgram->isInitialized())
+                continue;
+
+            RefPtr<ValidatedCustomFilterOperation> validatedOperation = ValidatedCustomFilterOperation::create(validatedProgram.release(), 
+                customOperation->parameters(), customOperation->meshRows(), customOperation->meshColumns(), customOperation->meshType());
+            outputFilters.operations().append(validatedOperation.release());
+            continue;
+        }
+        outputFilters.operations().append(filterOperation.release());
+    }
+    return outputFilters;
+#endif
+}
+
+void RenderLayer::updateOrRemoveFilterClients()
 {
     if (!hasFilter()) {
         removeFilterInfoIfNeeded();
@@ -5096,13 +5175,24 @@ void RenderLayer::updateOrRemoveFilterEffect()
     else if (hasFilterInfo())
         filterInfo()->removeReferenceFilterClients();
 #endif
+}
 
+void RenderLayer::updateOrRemoveFilterEffectRenderer()
+{
+    // FilterEffectRenderer is only used to render the filters in software mode,
+    // so we always need to run updateOrRemoveFilterEffectRenderer after the composited
+    // mode might have changed for this layer.
     if (!paintsWithFilters()) {
         // Don't delete the whole filter info here, because we might use it
         // for loading CSS shader files.
         if (RenderLayerFilterInfo* filterInfo = this->filterInfo())
             filterInfo->setRenderer(0);
-        return;
+
+        // Early-return only if we *don't* have reference filters.
+        // For reference filters, we still want the FilterEffect graph built
+        // for us, even if we're composited.
+        if (!renderer()->style()->filter().hasReferenceFilter())
+            return;
     }
     
     RenderLayerFilterInfo* filterInfo = ensureFilterInfo();
@@ -5115,7 +5205,7 @@ void RenderLayer::updateOrRemoveFilterEffect()
 
     // If the filter fails to build, remove it from the layer. It will still attempt to
     // go through regular processing (e.g. compositing), but never apply anything.
-    if (!filterInfo->renderer()->build(renderer()->document(), renderer()->style()->filter()))
+    if (!filterInfo->renderer()->build(renderer()->document(), computeFilterOperations(renderer()->style())))
         filterInfo->setRenderer(0);
 }
 
diff --git a/Source/WebCore/rendering/RenderLayer.h b/Source/WebCore/rendering/RenderLayer.h
index 181103643..7fe448afc 100644
--- a/Source/WebCore/rendering/RenderLayer.h
+++ b/Source/WebCore/rendering/RenderLayer.h
@@ -57,6 +57,7 @@ namespace WebCore {
 
 #if ENABLE(CSS_FILTERS)
 class FilterEffectRenderer;
+class FilterOperations;
 #endif
 class HitTestRequest;
 class HitTestResult;
@@ -652,7 +653,12 @@ public:
     bool containsDirtyOverlayScrollbars() const { return m_containsDirtyOverlayScrollbars; }
     void setContainsDirtyOverlayScrollbars(bool dirtyScrollbars) { m_containsDirtyOverlayScrollbars = dirtyScrollbars; }
 
+#if ENABLE(CSS_SHADERS)
+    bool isCSSCustomFilterEnabled() const;
+#endif
+
 #if ENABLE(CSS_FILTERS)
+    FilterOperations computeFilterOperations(const RenderStyle*);
     bool paintsWithFilters() const;
     bool requiresFullLayerImageForFilters() const;
     FilterEffectRenderer* filterRenderer() const 
@@ -841,7 +847,8 @@ private:
     void setPaintingInsideReflection(bool b) { m_paintingInsideReflection = b; }
 
 #if ENABLE(CSS_FILTERS)
-    void updateOrRemoveFilterEffect();
+    void updateOrRemoveFilterClients();
+    void updateOrRemoveFilterEffectRenderer();
 #endif
 
     void parentClipRects(const RenderLayer* rootLayer, RenderRegion*, ClipRectsType, ClipRects&, OverlayScrollbarSizeRelevancy = IgnoreOverlayScrollbarSize, ShouldRespectOverflowClip = RespectOverflowClip) const;
diff --git a/Source/WebCore/rendering/RenderLayerBacking.cpp b/Source/WebCore/rendering/RenderLayerBacking.cpp
index 8c147e141..1f2a647f5 100644
--- a/Source/WebCore/rendering/RenderLayerBacking.cpp
+++ b/Source/WebCore/rendering/RenderLayerBacking.cpp
@@ -60,6 +60,9 @@
 
 #if ENABLE(CSS_FILTERS)
 #include "FilterEffectRenderer.h"
+#if ENABLE(CSS_SHADERS)
+#include "CustomFilterOperation.h"
+#endif
 #endif
 
 #if ENABLE(WEBGL) || ENABLE(ACCELERATED_2D_CANVAS)
@@ -104,7 +107,7 @@ RenderLayerBacking::RenderLayerBacking(RenderLayer* layer)
     , m_canCompositeFilters(false)
 #endif
 {
-    if (renderer()->isRenderView()) {
+    if (layer->isRootLayer()) {
         Frame* frame = toRenderView(renderer())->frameView()->frame();
         Page* page = frame ? frame->page() : 0;
         if (page && frame && page->mainFrame() == frame) {
@@ -121,16 +124,12 @@ RenderLayerBacking::RenderLayerBacking(RenderLayer* layer)
     createPrimaryGraphicsLayer();
 
     if (m_usingTiledCacheLayer) {
+        TiledBacking* tiledBacking = this->tiledBacking();
         if (Page* page = renderer()->frame()->page()) {
-            if (TiledBacking* tiledBacking = m_graphicsLayer->tiledBacking()) {
-                Frame* frame = renderer()->frame();
-                tiledBacking->setIsInWindow(page->isOnscreen());
-                if (ScrollingCoordinator* scrollingCoordinator = page->scrollingCoordinator()) {
-                    bool shouldLimitTileCoverage = !frame->view()->canHaveScrollbars() || scrollingCoordinator->shouldUpdateScrollLayerPositionOnMainThread();
-                    tiledBacking->setTileCoverage(shouldLimitTileCoverage ? TiledBacking::CoverageForVisibleArea : TiledBacking::CoverageForScrolling);
-                }
-                tiledBacking->setScrollingPerformanceLoggingEnabled(frame->settings() && frame->settings()->scrollingPerformanceLoggingEnabled());
-            }
+            Frame* frame = renderer()->frame();
+            tiledBacking->setIsInWindow(page->isOnscreen());
+            tiledBacking->setScrollingPerformanceLoggingEnabled(frame->settings() && frame->settings()->scrollingPerformanceLoggingEnabled());
+            adjustTileCacheCoverage();
         }
     }
 }
@@ -173,6 +172,62 @@ bool RenderLayerBacking::shouldUseTileCache(const GraphicsLayer*) const
     return m_usingTiledCacheLayer && m_creatingPrimaryGraphicsLayer;
 }
 
+TiledBacking* RenderLayerBacking::tiledBacking() const
+{
+    return m_graphicsLayer->tiledBacking();
+}
+
+void RenderLayerBacking::adjustTileCacheCoverage()
+{
+    if (!m_usingTiledCacheLayer)
+        return;
+
+    TiledBacking::TileCoverage tileCoverage = TiledBacking::CoverageForVisibleArea;
+
+    // FIXME: When we use TiledBacking for overflow, this should look at RenderView scrollability.
+    Frame* frame = renderer()->frame();
+    if (frame) {
+        FrameView* frameView = frame->view();
+        if (frameView->horizontalScrollbarMode() != ScrollbarAlwaysOff)
+            tileCoverage |= TiledBacking::CoverageForHorizontalScrolling;
+
+        if (frameView->verticalScrollbarMode() != ScrollbarAlwaysOff)
+            tileCoverage |= TiledBacking::CoverageForVerticalScrolling;
+
+        if (ScrollingCoordinator* scrollingCoordinator = frame->page()->scrollingCoordinator()) {
+            if (scrollingCoordinator->shouldUpdateScrollLayerPositionOnMainThread())
+                tileCoverage |= TiledBacking::CoverageForSlowScrolling;
+        }
+    }
+
+    tiledBacking()->setTileCoverage(tileCoverage);
+}
+
+void RenderLayerBacking::updateDebugIndicators(bool showBorder, bool showRepaintCounter)
+{
+    m_graphicsLayer->setShowDebugBorder(showBorder);
+    m_graphicsLayer->setShowRepaintCounter(showRepaintCounter);
+    
+    if (m_ancestorClippingLayer)
+        m_ancestorClippingLayer->setShowDebugBorder(showBorder);
+
+    if (m_foregroundLayer) {
+        m_foregroundLayer->setShowDebugBorder(showBorder);
+        m_foregroundLayer->setShowRepaintCounter(showRepaintCounter);
+    }
+
+    if (m_maskLayer) {
+        m_maskLayer->setShowDebugBorder(showBorder);
+        m_maskLayer->setShowRepaintCounter(showRepaintCounter);
+    }
+
+    if (m_scrollingLayer)
+        m_scrollingLayer->setShowDebugBorder(showBorder);
+
+    if (m_scrollingContentsLayer)
+        m_scrollingContentsLayer->setShowDebugBorder(showBorder);
+}
+
 void RenderLayerBacking::createPrimaryGraphicsLayer()
 {
     String layerName;
@@ -254,7 +309,7 @@ void RenderLayerBacking::updateTransform(const RenderStyle* style)
 #if ENABLE(CSS_FILTERS)
 void RenderLayerBacking::updateFilters(const RenderStyle* style)
 {
-    m_canCompositeFilters = m_graphicsLayer->setFilters(style->filter());
+    m_canCompositeFilters = m_graphicsLayer->setFilters(owningLayer()->computeFilterOperations(style));
 }
 #endif
 
@@ -982,8 +1037,16 @@ void RenderLayerBacking::attachToScrollingCoordinator(RenderLayerBacking* parent
     if (!scrollingCoordinator)
         return;
 
+    // FIXME: When we support overflow areas, we will have to refine this for overflow areas that are also
+    // positon:fixed.
+    ScrollingNodeType nodeType;
+    if (renderer()->style()->position() == FixedPosition)
+        nodeType = FixedNode;
+    else
+        nodeType = ScrollingNode;
+
     ScrollingNodeID parentID = parent ? parent->scrollLayerID() : 0;
-    m_scrollLayerID = scrollingCoordinator->attachToStateTree(scrollingCoordinator->uniqueScrollLayerID(), parentID);
+    m_scrollLayerID = scrollingCoordinator->attachToStateTree(nodeType, scrollingCoordinator->uniqueScrollLayerID(), parentID);
 }
 
 void RenderLayerBacking::detachFromScrollingCoordinator()
@@ -1494,7 +1557,7 @@ void RenderLayerBacking::paintContents(const GraphicsLayer* graphicsLayer, Graph
 #endif
 
     if (graphicsLayer == m_graphicsLayer.get() || graphicsLayer == m_foregroundLayer.get() || graphicsLayer == m_maskLayer.get() || graphicsLayer == m_scrollingContentsLayer.get()) {
-        InspectorInstrumentationCookie cookie = InspectorInstrumentation::willPaint(m_owningLayer->renderer()->frame(), &context, clip);
+        InspectorInstrumentationCookie cookie = InspectorInstrumentation::willPaint(m_owningLayer->renderer()->frame());
 
         // The dirtyRect is in the coords of the painting root.
         IntRect dirtyRect = clip;
@@ -1507,7 +1570,7 @@ void RenderLayerBacking::paintContents(const GraphicsLayer* graphicsLayer, Graph
         if (m_usingTiledCacheLayer)
             m_owningLayer->renderer()->frame()->view()->setLastPaintTime(currentTime());
 
-        InspectorInstrumentation::didPaint(cookie);
+        InspectorInstrumentation::didPaint(cookie, &context, clip);
     } else if (graphicsLayer == layerForHorizontalScrollbar()) {
         paintScrollbar(m_owningLayer->horizontalScrollbar(), context, clip);
     } else if (graphicsLayer == layerForVerticalScrollbar()) {
@@ -1555,14 +1618,10 @@ bool RenderLayerBacking::getCurrentTransform(const GraphicsLayer* graphicsLayer,
     return false;
 }
 
-bool RenderLayerBacking::showDebugBorders(const GraphicsLayer*) const
-{
-    return compositor() ? compositor()->compositorShowDebugBorders() : false;
-}
-
-bool RenderLayerBacking::showRepaintCounter(const GraphicsLayer*) const
+bool RenderLayerBacking::isTrackingRepaints() const
 {
-    return compositor() ? compositor()->compositorShowRepaintCounter() : false;
+    GraphicsLayerClient* client = compositor();
+    return client ? client->isTrackingRepaints() : false;
 }
 
 #ifndef NDEBUG
diff --git a/Source/WebCore/rendering/RenderLayerBacking.h b/Source/WebCore/rendering/RenderLayerBacking.h
index 9468fe9d3..39f6ac594 100644
--- a/Source/WebCore/rendering/RenderLayerBacking.h
+++ b/Source/WebCore/rendering/RenderLayerBacking.h
@@ -39,6 +39,7 @@ namespace WebCore {
 
 class KeyframeList;
 class RenderLayerCompositor;
+class TiledBacking;
 
 enum CompositingLayerType {
     NormalCompositingLayer, // non-tiled layer with backing store
@@ -89,6 +90,7 @@ public:
     GraphicsLayer* scrollingContentsLayer() const { return m_scrollingContentsLayer.get(); }
 
     void attachToScrollingCoordinator(RenderLayerBacking* parent);
+    void detachFromScrollingCoordinator();
     uint64_t scrollLayerID() const { return m_scrollLayerID; }
     
     bool hasMaskLayer() const { return m_maskLayer != 0; }
@@ -137,7 +139,11 @@ public:
     void positionOverflowControlsLayers(const IntSize& offsetFromRoot);
 
     bool usingTileCache() const { return m_usingTiledCacheLayer; }
-
+    TiledBacking* tiledBacking() const;
+    void adjustTileCacheCoverage();
+    
+    void updateDebugIndicators(bool showBorder, bool showRepaintCounter);
+    
     // GraphicsLayerClient interface
     virtual bool shouldUseTileCache(const GraphicsLayer*) const OVERRIDE;
     virtual void notifyAnimationStarted(const GraphicsLayer*, double startTime) OVERRIDE;
@@ -151,8 +157,7 @@ public:
     virtual void didCommitChangesForLayer(const GraphicsLayer*) const OVERRIDE;
     virtual bool getCurrentTransform(const GraphicsLayer*, TransformationMatrix&) const OVERRIDE;
 
-    virtual bool showDebugBorders(const GraphicsLayer*) const OVERRIDE;
-    virtual bool showRepaintCounter(const GraphicsLayer*) const OVERRIDE;
+    virtual bool isTrackingRepaints() const OVERRIDE;
 
 #ifndef NDEBUG
     virtual void verifyNotPainting();
@@ -199,8 +204,6 @@ private:
     bool requiresScrollCornerLayer() const;
     bool updateScrollingLayers(bool scrollingLayers);
 
-    void detachFromScrollingCoordinator();
-
     GraphicsLayerPaintingPhase paintingPhaseForPrimaryLayer() const;
     
     IntSize contentOffsetInCompostingLayer() const;
diff --git a/Source/WebCore/rendering/RenderLayerCompositor.cpp b/Source/WebCore/rendering/RenderLayerCompositor.cpp
index 55664c228..7fa6da51c 100644
--- a/Source/WebCore/rendering/RenderLayerCompositor.cpp
+++ b/Source/WebCore/rendering/RenderLayerCompositor.cpp
@@ -52,6 +52,7 @@
 #include "RenderVideo.h"
 #include "RenderView.h"
 #include "ScrollbarTheme.h"
+#include "ScrollingConstraints.h"
 #include "ScrollingCoordinator.h"
 #include "Settings.h"
 #include "TiledBacking.h"
@@ -95,7 +96,7 @@ public:
         // contribute to overlap as soon as their composited ancestor has been
         // recursively processed and popped off the stack.
         ASSERT(m_overlapStack.size() >= 2);
-        m_overlapStack[m_overlapStack.size() - 2].unite(bounds);
+        m_overlapStack[m_overlapStack.size() - 2].append(bounds);
         m_layers.add(layer);
     }
 
@@ -106,7 +107,12 @@ public:
 
     bool overlapsLayers(const IntRect& bounds) const
     {
-        return m_overlapStack.last().intersects(bounds);
+        const RectList& layerRects = m_overlapStack.last();
+        for (unsigned i = 0; i < layerRects.size(); i++) {
+            if (layerRects[i].intersects(bounds))
+                return true;
+        }
+        return false;
     }
 
     bool isEmpty()
@@ -116,19 +122,20 @@ public:
 
     void pushCompositingContainer()
     {
-        m_overlapStack.append(Region());
+        m_overlapStack.append(RectList());
     }
 
     void popCompositingContainer()
     {
-        m_overlapStack[m_overlapStack.size() - 2].unite(m_overlapStack.last());
+        m_overlapStack[m_overlapStack.size() - 2].append(m_overlapStack.last());
         m_overlapStack.removeLast();
     }
-    
+
     RenderGeometryMap& geometryMap() { return m_geometryMap; }
 
 private:
-    Vector<Region> m_overlapStack;
+    typedef Vector<IntRect> RectList;
+    Vector<RectList> m_overlapStack;
     HashSet<const RenderLayer*> m_layers;
     RenderGeometryMap m_geometryMap;
 };
@@ -186,7 +193,9 @@ RenderLayerCompositor::RenderLayerCompositor(RenderView* renderView)
     , m_compositing(false)
     , m_compositingLayersNeedRebuild(false)
     , m_flushingLayers(false)
+    , m_shouldFlushOnReattach(false)
     , m_forceCompositingMode(false)
+    , m_isTrackingRepaints(false)
     , m_rootLayerAttachment(RootLayerUnattached)
 #if !LOG_DISABLED
     , m_rootLayerUpdateCount(0)
@@ -283,8 +292,10 @@ void RenderLayerCompositor::flushPendingLayerChanges(bool isFlushRoot)
     if (!isFlushRoot && rootLayerAttachment() == RootLayerAttachedViaEnclosingFrame)
         return;
     
-    if (rootLayerAttachment() == RootLayerUnattached)
+    if (rootLayerAttachment() == RootLayerUnattached) {
+        m_shouldFlushOnReattach = true;
         return;
+    }
 
     AnimationUpdateBlock animationUpdateBlock(m_renderView->frameView()->frame()->animation());
 
@@ -302,10 +313,20 @@ void RenderLayerCompositor::flushPendingLayerChanges(bool isFlushRoot)
     
     ASSERT(m_flushingLayers);
     m_flushingLayers = false;
+
+    if (!m_viewportConstrainedLayersNeedingUpdate.isEmpty()) {
+        HashSet<RenderLayer*>::const_iterator end = m_viewportConstrainedLayersNeedingUpdate.end();
+        for (HashSet<RenderLayer*>::const_iterator it = m_viewportConstrainedLayersNeedingUpdate.begin(); it != end; ++it)
+            registerOrUpdateViewportConstrainedLayer(*it);
+        
+        m_viewportConstrainedLayersNeedingUpdate.clear();
+    }
 }
 
-void RenderLayerCompositor::didFlushChangesForLayer(RenderLayer*)
+void RenderLayerCompositor::didFlushChangesForLayer(RenderLayer* layer)
 {
+    if (m_viewportConstrainedLayers.contains(layer))
+        m_viewportConstrainedLayersNeedingUpdate.add(layer);
 }
 
 void RenderLayerCompositor::notifyFlushBeforeDisplayRefresh(const GraphicsLayer*)
@@ -525,6 +546,9 @@ bool RenderLayerCompositor::updateBacking(RenderLayer* layer, CompositingChangeR
 
             layerChanged = true;
         }
+
+        // Need to add for every compositing layer, because a composited layer may change from being non-fixed to fixed.
+        updateViewportConstraintStatus(layer);
     } else {
         if (layer->backing()) {
             // If we're removing backing on a reflection, clear the source GraphicsLayer's pointer to
@@ -537,6 +561,8 @@ bool RenderLayerCompositor::updateBacking(RenderLayer* layer, CompositingChangeR
                     backing->graphicsLayer()->setReplicatedByLayer(0);
                 }
             }
+
+            removeViewportConstrainedLayer(layer);
             
             layer->clearBacking();
             layerChanged = true;
@@ -573,6 +599,10 @@ bool RenderLayerCompositor::updateBacking(RenderLayer* layer, CompositingChangeR
         if (ScrollingCoordinator* scrollingCoordinator = this->scrollingCoordinator())
             scrollingCoordinator->frameViewFixedObjectsDidChange(m_renderView->frameView());
     }
+    
+    if (layer->backing())
+        layer->backing()->updateDebugIndicators(m_showDebugBorders, m_showRepaintCounter);
+
     return layerChanged;
 }
 
@@ -648,6 +678,7 @@ void RenderLayerCompositor::layerWillBeRemoved(RenderLayer* parent, RenderLayer*
     if (!child->isComposited() || parent->renderer()->documentBeingDestroyed())
         return;
 
+    removeViewportConstrainedLayer(child);
     repaintInCompositedAncestor(child, child->backing()->compositedBounds());
 
     setCompositingParent(child, 0);
@@ -1097,12 +1128,6 @@ void RenderLayerCompositor::frameViewDidScroll()
     FrameView* frameView = m_renderView->frameView();
     IntPoint scrollPosition = frameView->scrollPosition();
 
-    if (TiledBacking* tiledBacking = frameView->tiledBacking()) {
-        IntRect visibleContentRect = frameView->visibleContentRect(false /* exclude scrollbars */);
-        visibleContentRect.move(toSize(frameView->scrollOrigin()));
-        tiledBacking->setVisibleRect(visibleContentRect);
-    }
-
     if (!m_scrollLayer)
         return;
 
@@ -1116,6 +1141,13 @@ void RenderLayerCompositor::frameViewDidScroll()
     m_scrollLayer->setPosition(FloatPoint(-scrollPosition.x(), -scrollPosition.y()));
 }
 
+void RenderLayerCompositor::frameViewDidLayout()
+{
+    RenderLayerBacking* renderViewBacking = m_renderView->layer()->backing();
+    if (renderViewBacking)
+        renderViewBacking->adjustTileCacheCoverage();
+}
+
 void RenderLayerCompositor::scrollingLayerDidChange(RenderLayer* layer)
 {
     RenderLayerBacking* backing = layer->backing();
@@ -1137,10 +1169,24 @@ String RenderLayerCompositor::layerTreeAsText(LayerTreeFlags flags)
         layerTreeBehavior |= LayerTreeAsTextDebug;
     if (flags & LayerTreeFlagsIncludeVisibleRects)
         layerTreeBehavior |= LayerTreeAsTextIncludeVisibleRects;
-    
+    if (flags & LayerTreeFlagsIncludeTileCaches)
+        layerTreeBehavior |= LayerTreeAsTextIncludeTileCaches;
+    if (flags & LayerTreeFlagsIncludeRepaintRects)
+        layerTreeBehavior |= LayerTreeAsTextIncludeRepaintRects;
+
     // We skip dumping the scroll and clip layers to keep layerTreeAsText output
     // similar between platforms.
-    return m_rootContentLayer->layerTreeAsText(layerTreeBehavior);
+    String layerTreeText = m_rootContentLayer->layerTreeAsText(layerTreeBehavior);
+
+    // The true root layer is not included in the dump, so if we want to report
+    // its repaint rects, they must be included here.
+    if (flags & LayerTreeFlagsIncludeRepaintRects) {
+        String layerTreeTextWithRootRepaintRects = m_renderView->frameView()->trackedRepaintRectsAsText();
+        layerTreeTextWithRootRepaintRects.append(layerTreeText);
+        return layerTreeTextWithRootRepaintRects;
+    }
+
+    return layerTreeText;
 }
 
 RenderLayerCompositor* RenderLayerCompositor::frameContentsCompositor(RenderPart* renderer)
@@ -1345,8 +1391,17 @@ GraphicsLayer* RenderLayerCompositor::scrollLayer() const
     return m_scrollLayer.get();
 }
 
+TiledBacking* RenderLayerCompositor::pageTiledBacking() const
+{
+    RenderLayerBacking* renderViewBacking = m_renderView->layer()->backing();
+    return renderViewBacking ? renderViewBacking->tiledBacking() : 0;
+}
+
 void RenderLayerCompositor::didMoveOnscreen()
 {
+    if (TiledBacking* tiledBacking = pageTiledBacking())
+        tiledBacking->setIsInWindow(true);
+
     if (!inCompositingMode() || m_rootLayerAttachment != RootLayerUnattached)
         return;
 
@@ -1356,6 +1411,9 @@ void RenderLayerCompositor::didMoveOnscreen()
 
 void RenderLayerCompositor::willMoveOffscreen()
 {
+    if (TiledBacking* tiledBacking = pageTiledBacking())
+        tiledBacking->setIsInWindow(false);
+
     if (!inCompositingMode() || m_rootLayerAttachment == RootLayerUnattached)
         return;
 
@@ -1367,8 +1425,10 @@ void RenderLayerCompositor::clearBackingForLayerIncludingDescendants(RenderLayer
     if (!layer)
         return;
 
-    if (layer->isComposited())
+    if (layer->isComposited()) {
+        removeViewportConstrainedLayer(layer);
         layer->clearBacking();
+    }
     
     for (RenderLayer* currLayer = layer->firstChild(); currLayer; currLayer = currLayer->nextSibling())
         clearBackingForLayerIncludingDescendants(currLayer);
@@ -1979,20 +2039,37 @@ void RenderLayerCompositor::documentBackgroundColorDidChange()
     graphicsLayer->setBackgroundColor(backgroundColor);
 }
 
-bool RenderLayerCompositor::showDebugBorders(const GraphicsLayer* layer) const
+static void resetTrackedRepaintRectsRecursive(GraphicsLayer* graphicsLayer)
 {
-    if (layer == m_layerForHorizontalScrollbar || layer == m_layerForVerticalScrollbar || layer == m_layerForScrollCorner)
-        return m_showDebugBorders;
+    if (!graphicsLayer)
+        return;
 
-    return false;
+    graphicsLayer->resetTrackedRepaints();
+
+    for (size_t i = 0; i < graphicsLayer->children().size(); ++i)
+        resetTrackedRepaintRectsRecursive(graphicsLayer->children()[i]);
+
+    if (GraphicsLayer* replicaLayer = graphicsLayer->replicaLayer())
+        resetTrackedRepaintRectsRecursive(replicaLayer);
+
+    if (GraphicsLayer* maskLayer = graphicsLayer->maskLayer())
+        resetTrackedRepaintRectsRecursive(maskLayer);
 }
 
-bool RenderLayerCompositor::showRepaintCounter(const GraphicsLayer* layer) const
+void RenderLayerCompositor::resetTrackedRepaintRects()
 {
-    if (layer == m_layerForHorizontalScrollbar || layer == m_layerForVerticalScrollbar || layer == m_layerForScrollCorner)
-        return m_showDebugBorders;
+    if (GraphicsLayer* rootLayer = rootGraphicsLayer())
+        resetTrackedRepaintRectsRecursive(rootLayer);
+}
 
-    return false;
+void RenderLayerCompositor::setTracksRepaints(bool tracksRepaints)
+{
+    m_isTrackingRepaints = tracksRepaints;
+}
+
+bool RenderLayerCompositor::isTrackingRepaints() const
+{
+    return m_isTrackingRepaints;
 }
 
 float RenderLayerCompositor::deviceScaleFactor() const
@@ -2332,6 +2409,11 @@ void RenderLayerCompositor::attachRootLayer(RootLayerAttachment attachment)
 
     m_rootLayerAttachment = attachment;
     rootLayerAttachmentChanged();
+    
+    if (m_shouldFlushOnReattach) {
+        flushPendingLayerChanges(true);
+        m_shouldFlushOnReattach = false;
+    }
 }
 
 void RenderLayerCompositor::detachRootLayer()
@@ -2461,6 +2543,163 @@ void RenderLayerCompositor::deviceOrPageScaleFactorChanged()
         rootLayer->noteDeviceOrPageScaleFactorChangedIncludingDescendants();
 }
 
+static bool isRootmostFixedOrStickyLayer(RenderLayer* layer)
+{
+    if (layer->renderer()->isStickyPositioned())
+        return true;
+
+    if (layer->renderer()->style()->position() != FixedPosition)
+        return false;
+
+    for (RenderLayer* stackingContext = layer->stackingContext(); stackingContext; stackingContext = stackingContext->stackingContext()) {
+        if (stackingContext->isComposited() && stackingContext->renderer()->style()->position() == FixedPosition)
+            return false;
+    }
+
+    return true;
+}
+
+void RenderLayerCompositor::updateViewportConstraintStatus(RenderLayer* layer)
+{
+    if (isRootmostFixedOrStickyLayer(layer))
+        addViewportConstrainedLayer(layer);
+    else
+        removeViewportConstrainedLayer(layer);
+}
+
+void RenderLayerCompositor::addViewportConstrainedLayer(RenderLayer* layer)
+{
+    m_viewportConstrainedLayers.add(layer);
+    registerOrUpdateViewportConstrainedLayer(layer);
+}
+
+void RenderLayerCompositor::removeViewportConstrainedLayer(RenderLayer* layer)
+{
+    if (!m_viewportConstrainedLayers.contains(layer))
+        return;
+
+    unregisterViewportConstrainedLayer(layer);
+    m_viewportConstrainedLayers.remove(layer);
+}
+
+const FixedPositionViewportConstraints RenderLayerCompositor::computeFixedViewportConstraints(RenderLayer* layer)
+{
+    ASSERT(layer->isComposited());
+
+    FrameView* frameView = m_renderView->frameView();
+    LayoutRect viewportRect = frameView->visibleContentRect();
+
+    FixedPositionViewportConstraints constraints = FixedPositionViewportConstraints();
+
+    GraphicsLayer* graphicsLayer = layer->backing()->graphicsLayer();
+
+    constraints.setLayerPositionAtLastLayout(graphicsLayer->position());
+    constraints.setViewportRectAtLastLayout(viewportRect);
+        
+    RenderStyle* style = layer->renderer()->style();
+    if (!style->left().isAuto())
+        constraints.addAnchorEdge(ViewportConstraints::AnchorEdgeLeft);
+
+    if (!style->right().isAuto())
+        constraints.addAnchorEdge(ViewportConstraints::AnchorEdgeRight);
+
+    if (!style->top().isAuto())
+        constraints.addAnchorEdge(ViewportConstraints::AnchorEdgeTop);
+
+    if (!style->bottom().isAuto())
+        constraints.addAnchorEdge(ViewportConstraints::AnchorEdgeBottom);
+
+    // If left and right are auto, use left.
+    if (style->left().isAuto() && style->right().isAuto())
+        constraints.addAnchorEdge(ViewportConstraints::AnchorEdgeLeft);
+
+    // If top and bottom are auto, use top.
+    if (style->top().isAuto() && style->bottom().isAuto())
+        constraints.addAnchorEdge(ViewportConstraints::AnchorEdgeTop);
+        
+    return constraints;
+}
+
+const StickyPositionViewportConstraints RenderLayerCompositor::computeStickyViewportConstraints(RenderLayer* layer)
+{
+    ASSERT(layer->isComposited());
+
+    FrameView* frameView = m_renderView->frameView();
+    LayoutRect viewportRect = frameView->visibleContentRect();
+
+    StickyPositionViewportConstraints constraints = StickyPositionViewportConstraints();
+
+    RenderBoxModelObject* renderer = toRenderBoxModelObject(layer->renderer());
+
+    renderer->computeStickyPositionConstraints(constraints, viewportRect);
+
+    GraphicsLayer* graphicsLayer = layer->backing()->graphicsLayer();
+
+    constraints.setLayerPositionAtLastLayout(graphicsLayer->position());
+    constraints.setStickyOffsetAtLastLayout(renderer->stickyPositionOffset());
+
+    return constraints;
+}
+
+static RenderLayerBacking* nearestScrollingCoordinatorAncestor(RenderLayer* layer)
+{
+    RenderLayer* ancestor = layer->parent();
+    while (ancestor) {
+        if (RenderLayerBacking* backing = ancestor->backing()) {
+            if (backing->scrollLayerID() && !ancestor->scrollsOverflow())
+                return backing;
+        }
+        ancestor = ancestor->parent();
+    }
+
+    return 0;
+}
+
+void RenderLayerCompositor::registerOrUpdateViewportConstrainedLayer(RenderLayer* layer)
+{
+    // FIXME: We should support sticky position here! And we should eventuall support fixed/sticky elements
+    // that are inside non-main frames once we get non-main frames scrolling with the ScrollingCoordinator.
+    if (layer->renderer()->isStickyPositioned() || m_renderView->document()->ownerElement())
+        return;
+
+    ScrollingCoordinator* scrollingCoordinator = this->scrollingCoordinator();
+    if (!scrollingCoordinator)
+        return;
+
+    if (!scrollingCoordinator->supportsFixedPositionLayers() || !layer->parent())
+        return;
+
+    ASSERT(layer->renderer()->style()->position() == FixedPosition);
+    ASSERT(m_viewportConstrainedLayers.contains(layer));
+    ASSERT(layer->isComposited());
+
+    RenderLayerBacking* backing = layer->backing();
+    if (!backing)
+        return;
+
+    ScrollingNodeID nodeID = backing->scrollLayerID();
+    if (!nodeID) {
+        RenderLayerBacking* parent = nearestScrollingCoordinatorAncestor(layer);
+        if (!parent)
+            return;
+        backing->attachToScrollingCoordinator(parent);
+        nodeID = backing->scrollLayerID();
+    }
+
+    if (layer->renderer()->isStickyPositioned())
+        scrollingCoordinator->updateViewportConstrainedNode(nodeID, computeStickyViewportConstraints(layer), backing->graphicsLayer());
+    else
+        scrollingCoordinator->updateViewportConstrainedNode(nodeID, computeFixedViewportConstraints(layer), backing->graphicsLayer());
+}
+
+void RenderLayerCompositor::unregisterViewportConstrainedLayer(RenderLayer* layer)
+{
+    ASSERT(m_viewportConstrainedLayers.contains(layer));
+
+    if (RenderLayerBacking* backing = layer->backing())
+        backing->detachFromScrollingCoordinator();
+}
+
 void RenderLayerCompositor::windowScreenDidChange(PlatformDisplayID displayID)
 {
     if (m_layerUpdater)
diff --git a/Source/WebCore/rendering/RenderLayerCompositor.h b/Source/WebCore/rendering/RenderLayerCompositor.h
index 2591c882a..87380acf1 100644
--- a/Source/WebCore/rendering/RenderLayerCompositor.h
+++ b/Source/WebCore/rendering/RenderLayerCompositor.h
@@ -34,14 +34,17 @@
 
 namespace WebCore {
 
+class FixedPositionViewportConstraints;
 class GraphicsLayer;
 class GraphicsLayerUpdater;
 class RenderEmbeddedObject;
 class RenderPart;
 class ScrollingCoordinator;
+class StickyPositionViewportConstraints;
 #if ENABLE(VIDEO)
 class RenderVideo;
 #endif
+class TiledBacking;
 
 enum CompositingUpdateType {
     CompositingUpdateAfterStyleChange,
@@ -195,16 +198,12 @@ public:
     void frameViewDidChangeLocation(const IntPoint& contentsOffset);
     void frameViewDidChangeSize();
     void frameViewDidScroll();
+    void frameViewDidLayout();
 
     void scrollingLayerDidChange(RenderLayer*);
 
     String layerTreeAsText(LayerTreeFlags);
 
-    // These are named to avoid conflicts with the functions in GraphicsLayerClient
-    // These return the actual internal variables.
-    bool compositorShowDebugBorders() const { return m_showDebugBorders; }
-    bool compositorShowRepaintCounter() const { return m_showRepaintCounter; }
-
     virtual float deviceScaleFactor() const OVERRIDE;
     virtual float pageScaleFactor() const OVERRIDE;
     virtual void didCommitChangesForLayer(const GraphicsLayer*) const OVERRIDE;
@@ -226,6 +225,12 @@ public:
 
     void documentBackgroundColorDidChange();
 
+    void updateViewportConstraintStatus(RenderLayer*);
+    void removeViewportConstrainedLayer(RenderLayer*);
+
+    void resetTrackedRepaintRects();
+    void setTracksRepaints(bool);
+
 private:
     class OverlapMap;
 
@@ -234,8 +239,7 @@ private:
     virtual void notifyFlushRequired(const GraphicsLayer*) OVERRIDE { scheduleLayerFlush(); }
     virtual void paintContents(const GraphicsLayer*, GraphicsContext&, GraphicsLayerPaintingPhase, const IntRect&) OVERRIDE;
 
-    virtual bool showDebugBorders(const GraphicsLayer*) const OVERRIDE;
-    virtual bool showRepaintCounter(const GraphicsLayer*) const OVERRIDE;
+    virtual bool isTrackingRepaints() const OVERRIDE;
     
     // GraphicsLayerUpdaterClient implementation
     virtual void flushLayers(GraphicsLayerUpdater*) OVERRIDE;
@@ -293,6 +297,7 @@ private:
     bool isFlushingLayers() const { return m_flushingLayers; }
     
     Page* page() const;
+    TiledBacking* pageTiledBacking() const;
 
     GraphicsLayerFactory* graphicsLayerFactory() const;
     ScrollingCoordinator* scrollingCoordinator() const;
@@ -311,6 +316,13 @@ private:
     bool requiresCompositingForOverflowScrolling(const RenderLayer*) const;
     bool requiresCompositingForIndirectReason(RenderObject*, bool hasCompositedDescendants, bool has3DTransformedDescendants, RenderLayer::IndirectCompositingReason&) const;
 
+    void addViewportConstrainedLayer(RenderLayer*);
+    void registerOrUpdateViewportConstrainedLayer(RenderLayer*);
+    void unregisterViewportConstrainedLayer(RenderLayer*);
+
+    const FixedPositionViewportConstraints computeFixedViewportConstraints(RenderLayer*);
+    const StickyPositionViewportConstraints computeStickyViewportConstraints(RenderLayer*);
+
     bool requiresScrollLayer(RootLayerAttachment) const;
     bool requiresHorizontalScrollbarLayer() const;
     bool requiresVerticalScrollbarLayer() const;
@@ -346,14 +358,20 @@ private:
     bool m_compositing;
     bool m_compositingLayersNeedRebuild;
     bool m_flushingLayers;
+    bool m_shouldFlushOnReattach;
     bool m_forceCompositingMode;
 
+    bool m_isTrackingRepaints; // Used for testing.
+
     RootLayerAttachment m_rootLayerAttachment;
 
     // Enclosing clipping layer for iframe content
     OwnPtr<GraphicsLayer> m_clipLayer;
     OwnPtr<GraphicsLayer> m_scrollLayer;
 
+    HashSet<RenderLayer*> m_viewportConstrainedLayers;
+    HashSet<RenderLayer*> m_viewportConstrainedLayersNeedingUpdate;
+
     // Enclosing layer for overflow controls and the clipping layer
     OwnPtr<GraphicsLayer> m_overflowControlsHostLayer;
 
diff --git a/Source/WebCore/rendering/RenderLayerFilterInfo.cpp b/Source/WebCore/rendering/RenderLayerFilterInfo.cpp
index cb4c5d661..190de61be 100644
--- a/Source/WebCore/rendering/RenderLayerFilterInfo.cpp
+++ b/Source/WebCore/rendering/RenderLayerFilterInfo.cpp
@@ -37,6 +37,7 @@
 
 #if ENABLE(SVG)
 #include "CachedSVGDocument.h"
+#include "CachedSVGDocumentReference.h"
 #include "SVGElement.h"
 #include "SVGFilter.h"
 #include "SVGFilterPrimitiveStandardAttributes.h"
@@ -129,7 +130,8 @@ void RenderLayerFilterInfo::updateReferenceFilterClients(const FilterOperations&
         if (filterOperation->getOperationType() != FilterOperation::REFERENCE)
             continue;
         ReferenceFilterOperation* referenceFilterOperation = static_cast<ReferenceFilterOperation*>(filterOperation.get());
-        CachedSVGDocument* cachedSVGDocument = static_cast<CachedSVGDocument*>(referenceFilterOperation->data());
+        CachedSVGDocumentReference* documentReference = static_cast<CachedSVGDocumentReference*>(referenceFilterOperation->data());
+        CachedSVGDocument* cachedSVGDocument = documentReference ? documentReference->document() : 0;
 
         if (cachedSVGDocument) {
             // Reference is external; wait for notifyFinished().
@@ -139,9 +141,8 @@ void RenderLayerFilterInfo::updateReferenceFilterClients(const FilterOperations&
             // Reference is internal; add layer as a client so we can trigger
             // filter repaint on SVG attribute change.
             Element* filter = m_layer->renderer()->node()->document()->getElementById(referenceFilterOperation->fragment());
-            if (!filter || !filter->renderer())
+            if (!filter || !filter->renderer() || !filter->renderer()->isSVGResourceFilter())
                 continue;
-            ASSERT(filter->renderer()->isSVGResourceContainer());
             filter->renderer()->toRenderSVGResourceContainer()->addClientRenderLayer(m_layer);
             m_internalSVGReferences.append(filter);
         }
diff --git a/Source/WebCore/rendering/RenderMedia.h b/Source/WebCore/rendering/RenderMedia.h
index abcc3b64b..4694cabc4 100644
--- a/Source/WebCore/rendering/RenderMedia.h
+++ b/Source/WebCore/rendering/RenderMedia.h
@@ -40,6 +40,9 @@ public:
     RenderMedia(HTMLMediaElement*, const IntSize& intrinsicSize);
     virtual ~RenderMedia();
 
+    RenderObject* firstChild() const { ASSERT(children() == virtualChildren()); return children()->firstChild(); }
+    RenderObject* lastChild() const { ASSERT(children() == virtualChildren()); return children()->lastChild(); }
+
     const RenderObjectChildList* children() const { return &m_children; }
     RenderObjectChildList* children() { return &m_children; }
 
diff --git a/Source/WebCore/rendering/RenderObject.cpp b/Source/WebCore/rendering/RenderObject.cpp
index 318a1497e..4bb0a3dcd 100644
--- a/Source/WebCore/rendering/RenderObject.cpp
+++ b/Source/WebCore/rendering/RenderObject.cpp
@@ -91,6 +91,18 @@ using namespace HTMLNames;
 
 #ifndef NDEBUG
 static void* baseOfRenderObjectBeingDeleted;
+
+RenderObject::SetLayoutNeededForbiddenScope::SetLayoutNeededForbiddenScope(RenderObject* renderObject)
+    : m_renderObject(renderObject)
+    , m_preexistingForbidden(m_renderObject->isSetNeedsLayoutForbidden())
+{
+    m_renderObject->setNeedsLayoutIsForbidden(true);
+}
+
+RenderObject::SetLayoutNeededForbiddenScope::~SetLayoutNeededForbiddenScope()
+{
+    m_renderObject->setNeedsLayoutIsForbidden(m_preexistingForbidden);
+}
 #endif
 
 struct SameSizeAsRenderObject {
@@ -135,13 +147,13 @@ RenderObject* RenderObject::createObject(Node* node, RenderStyle* style)
         // RenderImageResourceStyleImage requires a style being present on the image but we don't want to
         // trigger a style change now as the node is not fully attached. Moving this code to style change
         // doesn't make sense as it should be run once at renderer creation.
-        image->m_style = style;
+        image->setStyleInternal(style);
         if (const StyleImage* styleImage = static_cast<const ImageContentData*>(contentData)->image()) {
             image->setImageResource(RenderImageResourceStyleImage::create(const_cast<StyleImage*>(styleImage)));
             image->setIsGeneratedContent();
         } else
             image->setImageResource(RenderImageResource::create());
-        image->m_style = 0;
+        image->setStyleInternal(0);
         return image;
     }
 
@@ -1756,7 +1768,7 @@ void RenderObject::setStyle(PassRefPtr<RenderStyle> style)
     styleWillChange(diff, style.get());
     
     RefPtr<RenderStyle> oldStyle = m_style.release();
-    m_style = style;
+    setStyleInternal(style);
 
     updateFillImages(oldStyle ? oldStyle->backgroundLayers() : 0, m_style ? m_style->backgroundLayers() : 0);
     updateFillImages(oldStyle ? oldStyle->maskLayers() : 0, m_style ? m_style->maskLayers() : 0);
@@ -1803,11 +1815,6 @@ void RenderObject::setStyle(PassRefPtr<RenderStyle> style)
     }
 }
 
-void RenderObject::setStyleInternal(PassRefPtr<RenderStyle> style)
-{
-    m_style = style;
-}
-
 void RenderObject::styleWillChange(StyleDifference diff, const RenderStyle* newStyle)
 {
     if (m_style) {
@@ -1822,7 +1829,7 @@ void RenderObject::styleWillChange(StyleDifference diff, const RenderStyle* newS
                 document()->setAnnotatedRegionsDirty(true);
 #endif
             if (visibilityChanged && AXObjectCache::accessibilityEnabled())
-                document()->axObjectCache()->childrenChanged(this);
+                document()->axObjectCache()->childrenChanged(parent());
 
             // Keep layer hierarchy visibility bits up to date if visibility changes.
             if (m_style->visibility() != newStyle->visibility()) {
@@ -2219,7 +2226,12 @@ RespectImageOrientationEnum RenderObject::shouldRespectImageOrientation() const
 {
     // Respect the image's orientation if it's being used as a full-page image or it's
     // an <img> and the setting to respect it everywhere is set.
-    return document()->isImageDocument() || (document()->settings() && document()->settings()->shouldRespectImageOrientation() && node() && (node()->hasTagName(HTMLNames::imgTag) || node()->hasTagName(HTMLNames::webkitInnerImageTag))) ? RespectImageOrientation : DoNotRespectImageOrientation;
+    return
+#if USE(CG) || PLATFORM(CHROMIUM) || USE(CAIRO)
+        // This can only be enabled for ports which honor the orientation flag in their drawing code.
+        document()->isImageDocument() ||
+#endif
+        (document()->settings() && document()->settings()->shouldRespectImageOrientation() && node() && (node()->hasTagName(HTMLNames::imgTag) || node()->hasTagName(HTMLNames::webkitInnerImageTag))) ? RespectImageOrientation : DoNotRespectImageOrientation;
 }
 
 bool RenderObject::hasOutlineAnnotation() const
@@ -2438,29 +2450,36 @@ void RenderObject::willBeRemovedFromTree()
 
 void RenderObject::destroyAndCleanupAnonymousWrappers()
 {
-    RenderObject* parent = this->parent();
-
-    // If the tree is destroyed or our parent is not anonymous, there is no need for a clean-up phase.
-    if (documentBeingDestroyed() || !parent || !parent->isAnonymous()) {
+    // If the tree is destroyed, there is no need for a clean-up phase.
+    if (documentBeingDestroyed()) {
         destroy();
         return;
     }
 
-    bool parentIsLeftOverAnonymousWrapper = false;
+    RenderObject* destroyRoot = this;
+    for (RenderObject* destroyRootParent = destroyRoot->parent(); destroyRootParent && destroyRootParent->isAnonymous(); destroyRoot = destroyRootParent, destroyRootParent = destroyRootParent->parent()) {
+        // Currently we only remove anonymous cells' wrapper but we should remove all unneeded
+        // wrappers. See http://webkit.org/b/52123 as an example where this is needed.
+        if (!destroyRootParent->isTableCell())
+            break;
 
-    // Currently we only remove anonymous cells' wrapper but we should remove all unneeded
-    // wrappers. See http://webkit.org/b/52123 as an example where this is needed.
-    if (parent->isTableCell())
-        parentIsLeftOverAnonymousWrapper = parent->firstChild() == this && parent->lastChild() == this;
+        if (destroyRootParent->firstChild() != this || destroyRootParent->lastChild() != this)
+            break;
+    }
 
-    destroy();
+    // We repaint, so that the area exposed when this object disappears gets repainted properly.
+    // FIXME: A RenderObject with RenderLayer should probably repaint through it as getting the
+    // repaint rects is O(1) through a RenderLayer (assuming it's up-to-date).
+    if (destroyRoot->everHadLayout()) {
+        if (destroyRoot->isBody())
+            destroyRoot->view()->repaint();
+        else
+            destroyRoot->repaint();
+    }
 
-    // WARNING: |this| is deleted here.
+    destroyRoot->destroy();
 
-    if (parentIsLeftOverAnonymousWrapper) {
-        ASSERT(!parent->firstChild());
-        parent->destroyAndCleanupAnonymousWrappers();
-    }
+    // WARNING: |this| is deleted here.
 }
 
 void RenderObject::destroy()
diff --git a/Source/WebCore/rendering/RenderObject.h b/Source/WebCore/rendering/RenderObject.h
index 1d5e767d4..67a4d3796 100644
--- a/Source/WebCore/rendering/RenderObject.h
+++ b/Source/WebCore/rendering/RenderObject.h
@@ -29,13 +29,14 @@
 #include "CachedImageClient.h"
 #include "DocumentStyleSheetCollection.h"
 #include "Element.h"
-#include "FractionalLayoutUnit.h"
 #include "FloatQuad.h"
+#include "FractionalLayoutUnit.h"
 #include "LayoutTypes.h"
 #include "PaintPhase.h"
 #include "RenderObjectChildList.h"
 #include "RenderStyle.h"
 #include "ScrollBehavior.h"
+#include "StyleInheritedData.h"
 #include "TextAffinity.h"
 #include "TransformationMatrix.h"
 #include <wtf/HashSet.h>
@@ -177,6 +178,11 @@ public:
     RenderObject* previousSibling() const { return m_previous; }
     RenderObject* nextSibling() const { return m_next; }
 
+    // FIXME: These should be renamed slowFirstChild, slowLastChild, etc.
+    // to discourage their use. The virtualChildren() call inside these
+    // can be slow for hot code paths.
+    // Currently, some subclasses like RenderBlock, override these NON-virtual
+    // functions to make these fast when we already have a more specific pointer type.
     RenderObject* firstChild() const
     {
         if (const RenderObjectChildList* children = virtualChildren())
@@ -248,6 +254,16 @@ public:
     bool hasAXObject() const { return m_hasAXObject; }
     bool isSetNeedsLayoutForbidden() const { return m_setNeedsLayoutForbidden; }
     void setNeedsLayoutIsForbidden(bool flag) { m_setNeedsLayoutForbidden = flag; }
+
+    // Helper class forbidding calls to setNeedsLayout() during its lifetime.
+    class SetLayoutNeededForbiddenScope {
+    public:
+        explicit SetLayoutNeededForbiddenScope(RenderObject*);
+        ~SetLayoutNeededForbiddenScope();
+    private:
+        RenderObject* m_renderObject;
+        bool m_preexistingForbidden;
+    };
 #endif
 
     // Obtains the nearest enclosing block (including this block) that contributes a first-line style to our inline
@@ -599,8 +615,7 @@ public:
     
     virtual void updateDragState(bool dragOn);
 
-    // Inlined into RenderView.h for performance and to avoid a cyclic dependency.
-    RenderView* view() const;
+    RenderView* view() const { return document()->renderView(); };
 
     // Returns true if this renderer is rooted, and optionally returns the hosting view (the root of the hierarchy).
     bool isRooted(RenderView** = 0) const;
@@ -702,7 +717,7 @@ public:
 
     // Updates only the local style ptr of the object.  Does not update the state of the object,
     // and so only should be called when the style is known not to have changed (or from setStyle).
-    void setStyleInternal(PassRefPtr<RenderStyle>);
+    void setStyleInternal(PassRefPtr<RenderStyle> style) { m_style = style; }
 
     // returns the containing block level element for this element.
     RenderBlock* containingBlock() const;
diff --git a/Source/WebCore/rendering/RenderObjectChildList.cpp b/Source/WebCore/rendering/RenderObjectChildList.cpp
index bee4cc2f6..202cc36b3 100644
--- a/Source/WebCore/rendering/RenderObjectChildList.cpp
+++ b/Source/WebCore/rendering/RenderObjectChildList.cpp
@@ -65,13 +65,11 @@ RenderObject* RenderObjectChildList::removeChildNode(RenderObject* owner, Render
         toRenderBox(oldChild)->removeFloatingOrPositionedChildFromBlockLists();
 
     // So that we'll get the appropriate dirty bit set (either that a normal flow child got yanked or
-    // that a positioned child got yanked).  We also repaint, so that the area exposed when the child
-    // disappears gets repainted properly.
+    // that a positioned child got yanked).
     if (!owner->documentBeingDestroyed() && notifyRenderer && oldChild->everHadLayout()) {
         oldChild->setNeedsLayoutAndPrefWidthsRecalc();
-        if (oldChild->isBody())
-            owner->view()->repaint();
-        else
+        // We only repaint |oldChild| if we have a RenderLayer as its visual overflow may not be tracked by its parent.
+        if (oldChild->hasLayer())
             oldChild->repaint();
     }
 
diff --git a/Source/WebCore/rendering/RenderRegion.cpp b/Source/WebCore/rendering/RenderRegion.cpp
index 6f3f2e98d..87f949845 100644
--- a/Source/WebCore/rendering/RenderRegion.cpp
+++ b/Source/WebCore/rendering/RenderRegion.cpp
@@ -61,11 +61,15 @@ LayoutUnit RenderRegion::pageLogicalWidth() const
 
 LayoutUnit RenderRegion::pageLogicalHeight() const
 {
+    if (hasOverrideHeight() && view()->normalLayoutPhase())
+        return overrideLogicalContentHeight() + borderAndPaddingLogicalHeight();
     return m_flowThread->isHorizontalWritingMode() ? contentHeight() : contentWidth();
 }
 
 LayoutUnit RenderRegion::logicalHeightOfAllFlowThreadContent() const
 {
+    if (hasOverrideHeight() && view()->normalLayoutPhase())
+        return overrideLogicalContentHeight() + borderAndPaddingLogicalHeight();
     return m_flowThread->isHorizontalWritingMode() ? contentHeight() : contentWidth();
 }
 
@@ -185,8 +189,10 @@ void RenderRegion::updateRegionHasAutoLogicalHeightFlag()
     if (m_hasAutoLogicalHeight != didHaveAutoLogicalHeight) {
         if (m_hasAutoLogicalHeight)
             view()->flowThreadController()->incrementAutoLogicalHeightRegions();
-        else
+        else {
+            clearOverrideLogicalContentHeight();
             view()->flowThreadController()->decrementAutoLogicalHeightRegions();
+        }
     }
 }
 
diff --git a/Source/WebCore/rendering/RenderReplaced.cpp b/Source/WebCore/rendering/RenderReplaced.cpp
index 2cc54930e..cd93458f0 100644
--- a/Source/WebCore/rendering/RenderReplaced.cpp
+++ b/Source/WebCore/rendering/RenderReplaced.cpp
@@ -48,7 +48,7 @@ RenderReplaced::RenderReplaced(Node* node)
     setReplaced(true);
 }
 
-RenderReplaced::RenderReplaced(Node* node, const IntSize& intrinsicSize)
+RenderReplaced::RenderReplaced(Node* node, const LayoutSize& intrinsicSize)
     : RenderBox(node)
     , m_intrinsicSize(intrinsicSize)
 {
@@ -291,7 +291,7 @@ void RenderReplaced::computeAspectRatioInformationForRenderBox(RenderBox* conten
         // constrain the size below, the correct intrinsic size will be obtained for comparison against
         // min and max widths.
         if (intrinsicRatio && !isPercentageIntrinsicSize && !intrinsicSize.isEmpty())
-            m_intrinsicSize = flooredIntSize(intrinsicSize); // FIXME: This introduces precision errors. We should convert m_intrinsicSize to be a float.
+            m_intrinsicSize = LayoutSize(intrinsicSize);
 
         if (!isHorizontalWritingMode()) {
             if (intrinsicRatio)
@@ -303,7 +303,7 @@ void RenderReplaced::computeAspectRatioInformationForRenderBox(RenderBox* conten
         if (intrinsicRatio) {
             ASSERT(!isPercentageIntrinsicSize);
             if (!intrinsicSize.isEmpty())
-                m_intrinsicSize = isHorizontalWritingMode() ? flooredIntSize(intrinsicSize) : flooredIntSize(intrinsicSize).transposedSize(); // FIXME: This introduces precision errors. We should convert m_intrinsicSize to be a float.
+                m_intrinsicSize = LayoutSize(isHorizontalWritingMode() ? intrinsicSize : intrinsicSize.transposedSize());
         }
     }
 
@@ -349,14 +349,13 @@ LayoutUnit RenderReplaced::computeReplacedLogicalWidth(bool includeMaxWidth) con
     FloatSize constrainedSize;
     computeAspectRatioInformationForRenderBox(contentRenderer, constrainedSize, intrinsicRatio, isPercentageIntrinsicSize);
 
-    // FIXME: Remove unnecessary round/roundToInt calls from this method when layout is off ints: webkit.org/b/63656
     if (style()->logicalWidth().isAuto()) {
         bool heightIsAuto = style()->logicalHeight().isAuto();
         bool hasIntrinsicWidth = !isPercentageIntrinsicSize && constrainedSize.width() > 0;
 
         // If 'height' and 'width' both have computed values of 'auto' and the element also has an intrinsic width, then that intrinsic width is the used value of 'width'.
         if (heightIsAuto && hasIntrinsicWidth)
-            return computeReplacedLogicalWidthRespectingMinMaxWidth(roundToInt(constrainedSize.width()), includeMaxWidth);
+            return computeReplacedLogicalWidthRespectingMinMaxWidth(constrainedSize.width(), includeMaxWidth);
 
         bool hasIntrinsicHeight = !isPercentageIntrinsicSize && constrainedSize.height() > 0;
         if (intrinsicRatio || isPercentageIntrinsicSize) {
@@ -385,14 +384,14 @@ LayoutUnit RenderReplaced::computeReplacedLogicalWidth(bool includeMaxWidth) con
                 LayoutUnit marginEnd = minimumValueForLength(style()->marginEnd(), logicalWidth);
                 logicalWidth = max(ZERO_LAYOUT_UNIT, logicalWidth - (marginStart + marginEnd + (width() - clientWidth())));
                 if (isPercentageIntrinsicSize)
-                    logicalWidth = roundToInt(logicalWidth * constrainedSize.width() / 100);
+                    logicalWidth = logicalWidth * constrainedSize.width() / 100;
                 return computeReplacedLogicalWidthRespectingMinMaxWidth(logicalWidth, includeMaxWidth);
             }
         }
 
         // Otherwise, if 'width' has a computed value of 'auto', and the element has an intrinsic width, then that intrinsic width is the used value of 'width'.
         if (hasIntrinsicWidth)
-            return computeReplacedLogicalWidthRespectingMinMaxWidth(roundToInt(constrainedSize.width()), includeMaxWidth);
+            return computeReplacedLogicalWidthRespectingMinMaxWidth(constrainedSize.width(), includeMaxWidth);
 
         // Otherwise, if 'width' has a computed value of 'auto', but none of the conditions above are met, then the used value of 'width' becomes 300px. If 300px is too
         // wide to fit the device, UAs should use the width of the largest rectangle that has a 2:1 ratio and fits the device instead.
@@ -418,13 +417,12 @@ LayoutUnit RenderReplaced::computeReplacedLogicalHeight() const
     FloatSize constrainedSize;
     computeAspectRatioInformationForRenderBox(contentRenderer, constrainedSize, intrinsicRatio, isPercentageIntrinsicSize);
 
-    // FIXME: Remove unnecessary round/roundToInt calls from this method when layout is off ints: webkit.org/b/63656
     bool widthIsAuto = style()->logicalWidth().isAuto();
     bool hasIntrinsicHeight = !isPercentageIntrinsicSize && constrainedSize.height() > 0;
 
     // If 'height' and 'width' both have computed values of 'auto' and the element also has an intrinsic height, then that intrinsic height is the used value of 'height'.
     if (widthIsAuto && hasIntrinsicHeight)
-        return computeReplacedLogicalHeightRespectingMinMaxHeight(roundToInt(constrainedSize.height()));
+        return computeReplacedLogicalHeightRespectingMinMaxHeight(constrainedSize.height());
 
     // Otherwise, if 'height' has a computed value of 'auto', and the element has an intrinsic ratio then the used value of 'height' is:
     // (used width) / (intrinsic ratio)
@@ -433,7 +431,7 @@ LayoutUnit RenderReplaced::computeReplacedLogicalHeight() const
 
     // Otherwise, if 'height' has a computed value of 'auto', and the element has an intrinsic height, then that intrinsic height is the used value of 'height'.
     if (hasIntrinsicHeight)
-        return computeReplacedLogicalHeightRespectingMinMaxHeight(roundToInt(constrainedSize.height()));
+        return computeReplacedLogicalHeightRespectingMinMaxHeight(constrainedSize.height());
 
     // Otherwise, if 'height' has a computed value of 'auto', but none of the conditions above are met, then the used value of 'height' must be set to the height
     // of the largest rectangle that has a 2:1 ratio, has a height not greater than 150px, and has a width not greater than the device width.
diff --git a/Source/WebCore/rendering/RenderReplaced.h b/Source/WebCore/rendering/RenderReplaced.h
index 6a242157f..7a9290142 100644
--- a/Source/WebCore/rendering/RenderReplaced.h
+++ b/Source/WebCore/rendering/RenderReplaced.h
@@ -29,7 +29,7 @@ namespace WebCore {
 class RenderReplaced : public RenderBox {
 public:
     RenderReplaced(Node*);
-    RenderReplaced(Node*, const IntSize& intrinsicSize);
+    RenderReplaced(Node*, const LayoutSize& intrinsicSize);
     virtual ~RenderReplaced();
 
     virtual LayoutUnit computeReplacedLogicalWidth(bool includeMaxWidth = true) const;
@@ -43,10 +43,10 @@ protected:
 
     virtual void layout();
 
-    virtual IntSize intrinsicSize() const { return m_intrinsicSize; }
+    virtual LayoutSize intrinsicSize() const OVERRIDE { return m_intrinsicSize; }
     virtual void computeIntrinsicRatioInformation(FloatSize& intrinsicSize, double& intrinsicRatio, bool& isPercentageIntrinsicSize) const;
 
-    virtual int minimumReplacedHeight() const { return 0; }
+    virtual LayoutUnit minimumReplacedHeight() const { return LayoutUnit(); }
 
     virtual void setSelectionState(SelectionState);
 
@@ -54,7 +54,7 @@ protected:
 
     virtual void styleDidChange(StyleDifference, const RenderStyle* oldStyle);
 
-    void setIntrinsicSize(const IntSize& intrinsicSize) { m_intrinsicSize = intrinsicSize; }
+    void setIntrinsicSize(const LayoutSize& intrinsicSize) { m_intrinsicSize = intrinsicSize; }
     virtual void intrinsicSizeChanged();
 
     virtual void paint(PaintInfo&, const LayoutPoint&);
@@ -80,7 +80,7 @@ private:
     virtual LayoutRect selectionRectForRepaint(RenderLayerModelObject* repaintContainer, bool clipToVisibleContent = true) OVERRIDE;
     void computeAspectRatioInformationForRenderBox(RenderBox*, FloatSize& constrainedSize, double& intrinsicRatio, bool& isPercentageIntrinsicSize) const;
 
-    mutable IntSize m_intrinsicSize;
+    mutable LayoutSize m_intrinsicSize;
 };
 
 }
diff --git a/Source/WebCore/rendering/RenderTable.cpp b/Source/WebCore/rendering/RenderTable.cpp
index d5c58bc9c..948b526d3 100644
--- a/Source/WebCore/rendering/RenderTable.cpp
+++ b/Source/WebCore/rendering/RenderTable.cpp
@@ -59,6 +59,7 @@ RenderTable::RenderTable(Node* node)
     , m_hasColElements(false)
     , m_needsSectionRecalc(false)
     , m_columnLogicalWidthChanged(false)
+    , m_columnRenderersValid(false)
     , m_hSpacing(0)
     , m_vSpacing(0)
     , m_borderStart(0)
@@ -213,6 +214,26 @@ void RenderTable::removeCaption(const RenderTableCaption* oldCaption)
     m_captions.remove(index);
 }
 
+void RenderTable::invalidateCachedColumns()
+{
+    m_columnRenderersValid = false;
+    m_columnRenderers.resize(0);
+}
+
+void RenderTable::addColumn(const RenderTableCol*)
+{
+    invalidateCachedColumns();
+}
+
+void RenderTable::removeColumn(const RenderTableCol*)
+{
+    invalidateCachedColumns();
+    // We don't really need to recompute our sections, but we need to update our
+    // column count and whether we have a column. Currently, we only have one
+    // size-fit-all flag but we may have to consider splitting it.
+    setNeedsSectionRecalc();
+}
+
 void RenderTable::updateLogicalWidth()
 {
     recalcSectionsIfNeeded();
@@ -378,15 +399,20 @@ void RenderTable::layout()
 
     bool collapsing = collapseBorders();
 
-    // We ignore table col / colgroup in this iteration as they are only used to size the cell's widths during auto / fixed table layout.
-    for (RenderTableSection* section = topSection(); section; section = sectionBelow(section)) {
-        if (m_columnLogicalWidthChanged)
-            section->setChildNeedsLayout(true, MarkOnlyThis);
-        section->layoutIfNeeded();
-        totalSectionLogicalHeight += section->calcRowLogicalHeight();
-        if (collapsing)
-            section->recalcOuterBorder();
-        ASSERT(!section->needsLayout());
+    for (RenderObject* child = firstChild(); child; child = child->nextSibling()) {
+        if (child->isTableSection()) {
+            RenderTableSection* section = toRenderTableSection(child);
+            if (m_columnLogicalWidthChanged)
+                section->setChildNeedsLayout(true, MarkOnlyThis);
+            section->layoutIfNeeded();
+            totalSectionLogicalHeight += section->calcRowLogicalHeight();
+            if (collapsing)
+                section->recalcOuterBorder();
+            ASSERT(!section->needsLayout());
+        } else if (child->isRenderTableCol()) {
+            child->layoutIfNeeded();
+            ASSERT(!child->needsLayout());
+        }
     }
 
     // If any table section moved vertically, we will just repaint everything from that
@@ -690,14 +716,10 @@ RenderTableSection* RenderTable::topNonEmptySection() const
 
 void RenderTable::splitColumn(unsigned position, unsigned firstSpan)
 {
-    // we need to add a new columnStruct
-    unsigned oldSize = m_columns.size();
-    m_columns.grow(oldSize + 1);
-    unsigned oldSpan = m_columns[position].span;
-    ASSERT(oldSpan > firstSpan);
-    m_columns[position].span = firstSpan;
-    memmove(m_columns.data() + position + 1, m_columns.data() + position, (oldSize - position) * sizeof(ColumnStruct));
-    m_columns[position + 1].span = oldSpan - firstSpan;
+    // We split the column at "position", taking "firstSpan" cells from the span.
+    ASSERT(m_columns[position].span > firstSpan);
+    m_columns.insert(position, ColumnStruct(firstSpan));
+    m_columns[position + 1].span -= firstSpan;
 
     // Propagate the change in our columns representation to the sections that don't need
     // cell recalc. If they do, they will be synced up directly with m_columns later.
@@ -718,10 +740,8 @@ void RenderTable::splitColumn(unsigned position, unsigned firstSpan)
 
 void RenderTable::appendColumn(unsigned span)
 {
-    unsigned pos = m_columns.size();
-    unsigned newSize = pos + 1;
-    m_columns.grow(newSize);
-    m_columns[pos].span = span;
+    unsigned newColumnIndex = m_columns.size();
+    m_columns.append(ColumnStruct(span));
 
     // Propagate the change in our columns representation to the sections that don't need
     // cell recalc. If they do, they will be synced up directly with m_columns later.
@@ -733,7 +753,7 @@ void RenderTable::appendColumn(unsigned span)
         if (section->needsCellRecalc())
             continue;
 
-        section->appendColumn(pos);
+        section->appendColumn(newColumnIndex);
     }
 
     m_columnPos.grow(numEffCols() + 1);
@@ -754,15 +774,30 @@ RenderTableCol* RenderTable::firstColumn() const
     return 0;
 }
 
-RenderTableCol* RenderTable::slowColElement(unsigned col, bool* startEdge, bool* endEdge) const
+void RenderTable::updateColumnCache() const
 {
     ASSERT(m_hasColElements);
+    ASSERT(m_columnRenderers.isEmpty());
+    ASSERT(!m_columnRenderersValid);
 
-    unsigned columnCount = 0;
     for (RenderTableCol* columnRenderer = firstColumn(); columnRenderer; columnRenderer = columnRenderer->nextColumn()) {
         if (columnRenderer->isTableColumnGroupWithColumnChildren())
             continue;
+        m_columnRenderers.append(columnRenderer);
+    }
+    m_columnRenderersValid = true;
+}
+
+RenderTableCol* RenderTable::slowColElement(unsigned col, bool* startEdge, bool* endEdge) const
+{
+    ASSERT(m_hasColElements);
 
+    if (!m_columnRenderersValid)
+        updateColumnCache();
+
+    unsigned columnCount = 0;
+    for (unsigned i = 0; i < m_columnRenderers.size(); i++) {
+        RenderTableCol* columnRenderer = m_columnRenderers[i];
         unsigned span = columnRenderer->span();
         unsigned startCol = columnCount;
         ASSERT(span >= 1);
@@ -776,7 +811,6 @@ RenderTableCol* RenderTable::slowColElement(unsigned col, bool* startEdge, bool*
             return columnRenderer;
         }
     }
-
     return 0;
 }
 
@@ -1315,7 +1349,7 @@ RenderTable* RenderTable::createAnonymousWithParentRenderer(const RenderObject*
 const BorderValue& RenderTable::tableStartBorderAdjoiningCell(const RenderTableCell* cell) const
 {
     ASSERT(cell->isFirstOrLastCellInRow());
-    if (hasSameDirectionAs(cell->section()))
+    if (hasSameDirectionAs(cell->row()))
         return style()->borderStart();
 
     return style()->borderEnd();
@@ -1324,7 +1358,7 @@ const BorderValue& RenderTable::tableStartBorderAdjoiningCell(const RenderTableC
 const BorderValue& RenderTable::tableEndBorderAdjoiningCell(const RenderTableCell* cell) const
 {
     ASSERT(cell->isFirstOrLastCellInRow());
-    if (hasSameDirectionAs(cell->section()))
+    if (hasSameDirectionAs(cell->row()))
         return style()->borderEnd();
 
     return style()->borderStart();
diff --git a/Source/WebCore/rendering/RenderTable.h b/Source/WebCore/rendering/RenderTable.h
index 390f2b367..f9f93867f 100644
--- a/Source/WebCore/rendering/RenderTable.h
+++ b/Source/WebCore/rendering/RenderTable.h
@@ -45,8 +45,6 @@ public:
     explicit RenderTable(Node*);
     virtual ~RenderTable();
 
-    int getColumnPos(unsigned col) const { return m_columnPos[col]; }
-
     // Per CSS 3 writing-mode: "The first and second values of the 'border-spacing' property represent spacing between columns
     // and rows respectively, not necessarily the horizontal and vertical spacing respectively".
     int hBorderSpacing() const { return m_hSpacing; }
@@ -129,8 +127,8 @@ public:
     virtual void addChild(RenderObject* child, RenderObject* beforeChild = 0);
 
     struct ColumnStruct {
-        ColumnStruct()
-            : span(1)
+        explicit ColumnStruct(unsigned initialSpan = 1)
+            : span(initialSpan)
         {
         }
 
@@ -258,6 +256,8 @@ public:
 
     void addCaption(const RenderTableCaption*);
     void removeCaption(const RenderTableCaption*);
+    void addColumn(const RenderTableCol*);
+    void removeColumn(const RenderTableCol*);
 
 protected:
     virtual void styleDidChange(StyleDifference, const RenderStyle* oldStyle);
@@ -283,6 +283,9 @@ private:
 
     RenderTableCol* slowColElement(unsigned col, bool* startEdge, bool* endEdge) const;
 
+    void updateColumnCache() const;
+    void invalidateCachedColumns();
+
     virtual RenderBlock* firstLineBlock() const;
     virtual void updateFirstLetter();
     
@@ -305,6 +308,7 @@ private:
     mutable Vector<int> m_columnPos;
     mutable Vector<ColumnStruct> m_columns;
     mutable Vector<RenderTableCaption*> m_captions;
+    mutable Vector<RenderTableCol*> m_columnRenderers;
 
     mutable RenderTableSection* m_head;
     mutable RenderTableSection* m_foot;
@@ -315,10 +319,12 @@ private:
     CollapsedBorderValues m_collapsedBorders;
     const CollapsedBorderValue* m_currentBorder;
     bool m_collapsedBordersValid : 1;
-    
+
     mutable bool m_hasColElements : 1;
     mutable bool m_needsSectionRecalc : 1;
+
     bool m_columnLogicalWidthChanged : 1;
+    mutable bool m_columnRenderersValid: 1;
 
     short m_hSpacing;
     short m_vSpacing;
diff --git a/Source/WebCore/rendering/RenderTableCell.cpp b/Source/WebCore/rendering/RenderTableCell.cpp
index 683321aa7..689cf8a39 100644
--- a/Source/WebCore/rendering/RenderTableCell.cpp
+++ b/Source/WebCore/rendering/RenderTableCell.cpp
@@ -460,6 +460,28 @@ static CollapsedBorderValue chooseBorder(const CollapsedBorderValue& border1, co
     return border.style() == BHIDDEN ? CollapsedBorderValue() : border;
 }
 
+bool RenderTableCell::hasStartBorderAdjoiningTable() const
+{
+    bool isStartColumn = !col();
+    bool isEndColumn = table()->colToEffCol(col() + colSpan() - 1) == table()->numEffCols() - 1;
+    bool hasSameDirectionAsTable = hasSameDirectionAs(table());
+
+    // The table direction determines the row direction. In mixed directionality, we cannot guarantee that
+    // we have a common border with the table (think a ltr table with rtl start cell).
+    return (isStartColumn && hasSameDirectionAsTable) || (isEndColumn && !hasSameDirectionAsTable);
+}
+
+bool RenderTableCell::hasEndBorderAdjoiningTable() const
+{
+    bool isStartColumn = !col();
+    bool isEndColumn = table()->colToEffCol(col() + colSpan() - 1) == table()->numEffCols() - 1;
+    bool hasSameDirectionAsTable = hasSameDirectionAs(table());
+
+    // The table direction determines the row direction. In mixed directionality, we cannot guarantee that
+    // we have a common border with the table (think a ltr table with ltr end cell).
+    return (isStartColumn && !hasSameDirectionAsTable) || (isEndColumn && hasSameDirectionAsTable);
+}
+
 CollapsedBorderValue RenderTableCell::collapsedStartBorder(IncludeBorderColorOrNot includeColor) const
 {
     CollapsedBorderValue result = computeCollapsedStartBorder(includeColor);
@@ -486,7 +508,10 @@ CollapsedBorderValue RenderTableCell::computeCollapsedStartBorder(IncludeBorderC
         result = chooseBorder(cellBeforeAdjoiningBorder, result);
         if (!result.exists())
             return result;
-    } else {
+    }
+
+    bool startBorderAdjoinsTable = hasStartBorderAdjoiningTable();
+    if (startBorderAdjoinsTable) {
         // (3) Our row's start border.
         result = chooseBorder(result, CollapsedBorderValue(row()->borderAdjoiningStartCell(this), includeColor ? parent()->style()->visitedDependentColor(startColorProperty) : Color(), BROW));
         if (!result.exists())
@@ -545,7 +570,9 @@ CollapsedBorderValue RenderTableCell::computeCollapsedStartBorder(IncludeBorderC
                 }
             }
         }
-    } else {
+    }
+
+    if (startBorderAdjoinsTable) {
         // (7) The table's start border.
         result = chooseBorder(result, CollapsedBorderValue(table->tableStartBorderAdjoiningCell(this), includeColor ? table->style()->visitedDependentColor(startColorProperty) : Color(), BTABLE));
         if (!result.exists())
@@ -584,7 +611,10 @@ CollapsedBorderValue RenderTableCell::computeCollapsedEndBorder(IncludeBorderCol
             if (!result.exists())
                 return result;
         }
-    } else {
+    }
+
+    bool endBorderAdjoinsTable = hasEndBorderAdjoiningTable();
+    if (endBorderAdjoinsTable) {
         // (3) Our row's end border.
         result = chooseBorder(result, CollapsedBorderValue(row()->borderAdjoiningEndCell(this), includeColor ? parent()->style()->visitedDependentColor(endColorProperty) : Color(), BROW));
         if (!result.exists())
@@ -642,7 +672,9 @@ CollapsedBorderValue RenderTableCell::computeCollapsedEndBorder(IncludeBorderCol
                 }
             }
         }
-    } else {
+    }
+
+    if (endBorderAdjoinsTable) {
         // (7) The table's end border.
         result = chooseBorder(result, CollapsedBorderValue(table->tableEndBorderAdjoiningCell(this), includeColor ? table->style()->visitedDependentColor(endColorProperty) : Color(), BTABLE));
         if (!result.exists())
diff --git a/Source/WebCore/rendering/RenderTableCell.h b/Source/WebCore/rendering/RenderTableCell.h
index f2903a347..87e6d591c 100644
--- a/Source/WebCore/rendering/RenderTableCell.h
+++ b/Source/WebCore/rendering/RenderTableCell.h
@@ -164,7 +164,7 @@ public:
     // on all table parts and writing-mode on cells.
     const RenderStyle* styleForCellFlow() const
     {
-        return section()->style();
+        return row()->style();
     }
 
     const BorderValue& borderAdjoiningTableStart() const
@@ -240,6 +240,9 @@ private:
     void setIntrinsicPaddingAfter(int p) { m_intrinsicPaddingAfter = p; }
     void setIntrinsicPadding(int before, int after) { setIntrinsicPaddingBefore(before); setIntrinsicPaddingAfter(after); }
 
+    bool hasStartBorderAdjoiningTable() const;
+    bool hasEndBorderAdjoiningTable() const;
+
     CollapsedBorderValue collapsedStartBorder(IncludeBorderColorOrNot = IncludeBorderColor) const;
     CollapsedBorderValue collapsedEndBorder(IncludeBorderColorOrNot = IncludeBorderColor) const;
     CollapsedBorderValue collapsedBeforeBorder(IncludeBorderColorOrNot = IncludeBorderColor) const;
diff --git a/Source/WebCore/rendering/RenderTableCol.cpp b/Source/WebCore/rendering/RenderTableCol.cpp
index 6db54cca1..b02aa838b 100644
--- a/Source/WebCore/rendering/RenderTableCol.cpp
+++ b/Source/WebCore/rendering/RenderTableCol.cpp
@@ -49,9 +49,6 @@ void RenderTableCol::styleDidChange(StyleDifference diff, const RenderStyle* old
 {
     RenderBox::styleDidChange(diff, oldStyle);
 
-    if (diff == StyleDifferenceLayout)
-        propagateLayoutCueToTable();
-
     // If border was changed, notify table.
     if (parent()) {
         RenderTable* table = this->table();
@@ -69,19 +66,20 @@ void RenderTableCol::updateFromElement()
         m_span = tc->span();
     } else
         m_span = !(style() && style()->display() == TABLE_COLUMN_GROUP);
+    if (m_span != oldSpan && style() && parent())
+        setNeedsLayoutAndPrefWidthsRecalc();
+}
 
-    if (m_span != oldSpan && style())
-        propagateLayoutCueToTable();
+void RenderTableCol::insertedIntoTree()
+{
+    RenderBox::insertedIntoTree();
+    table()->addColumn(this);
 }
 
 void RenderTableCol::willBeRemovedFromTree()
 {
     RenderBox::willBeRemovedFromTree();
-
-    // We don't really need to recompute our sections, but we need to update our
-    // column count and whether we have a column. Currently, we only have one
-    // size-fit-all flag but we may have to consider splitting it.
-    table()->setNeedsSectionRecalc();
+    table()->removeColumn(this);
 }
 
 bool RenderTableCol::isChildAllowed(RenderObject* child, RenderStyle* style) const
@@ -118,25 +116,10 @@ void RenderTableCol::imageChanged(WrappedImagePtr, const IntRect*)
 
 void RenderTableCol::computePreferredLogicalWidths()
 {
-    // <col> and <colgroup> don't have preferred logical widths as they have
-    // no content so computing our preferred logical widths is wasteful.
-    ASSERT_NOT_REACHED();
-}
-
-void RenderTableCol::layout()
-{
-    // There is no need to layout table <col> or <colgroup> as they have no content.
-    ASSERT_NOT_REACHED();
-}
+    setPreferredLogicalWidthsDirty(false);
 
-void RenderTableCol::propagateLayoutCueToTable() const
-{
-    // Forward any layout hint to the table: this is required as the table is
-    // the one to layout / compute preferred logical widths on all the cells.
-    if (RenderTable* table = this->table()) {
-        table->setChildNeedsLayout(true);
-        table->setPreferredLogicalWidthsDirty(true);
-    }
+    for (RenderObject* child = firstChild(); child; child = child->nextSibling())
+        child->setPreferredLogicalWidthsDirty(false);
 }
 
 RenderTable* RenderTableCol::table() const
diff --git a/Source/WebCore/rendering/RenderTableCol.h b/Source/WebCore/rendering/RenderTableCol.h
index 1e8e80257..0c08f8019 100644
--- a/Source/WebCore/rendering/RenderTableCol.h
+++ b/Source/WebCore/rendering/RenderTableCol.h
@@ -37,9 +37,14 @@ class RenderTableCol : public RenderBox {
 public:
     explicit RenderTableCol(Node*);
 
+    RenderObject* firstChild() const { ASSERT(children() == virtualChildren()); return children()->firstChild(); }
+    RenderObject* lastChild() const { ASSERT(children() == virtualChildren()); return children()->lastChild(); }
+
     const RenderObjectChildList* children() const { return &m_children; }
     RenderObjectChildList* children() { return &m_children; }
 
+    virtual void computePreferredLogicalWidths();
+
     unsigned span() const { return m_span; }
     void setSpan(unsigned span) { m_span = span; }
 
@@ -75,13 +80,11 @@ private:
     virtual RenderObjectChildList* virtualChildren() { return children(); }
     virtual const RenderObjectChildList* virtualChildren() const { return children(); }
 
-    virtual void computePreferredLogicalWidths() OVERRIDE;
-    virtual void layout() OVERRIDE;
-
     virtual const char* renderName() const { return "RenderTableCol"; }
     virtual bool isRenderTableCol() const OVERRIDE { return true; }
     virtual void updateFromElement();
 
+    virtual void insertedIntoTree() OVERRIDE;
     virtual void willBeRemovedFromTree() OVERRIDE;
 
     virtual bool isChildAllowed(RenderObject*, RenderStyle*) const;
@@ -93,8 +96,6 @@ private:
 
     virtual void styleDidChange(StyleDifference, const RenderStyle* oldStyle);
 
-    void propagateLayoutCueToTable() const;
-
     RenderTable* table() const;
 
     RenderObjectChildList m_children;
diff --git a/Source/WebCore/rendering/RenderTableRow.cpp b/Source/WebCore/rendering/RenderTableRow.cpp
index c3aaf8586..f3c462e13 100644
--- a/Source/WebCore/rendering/RenderTableRow.cpp
+++ b/Source/WebCore/rendering/RenderTableRow.cpp
@@ -84,14 +84,14 @@ void RenderTableRow::styleDidChange(StyleDifference diff, const RenderStyle* old
 
 const BorderValue& RenderTableRow::borderAdjoiningStartCell(const RenderTableCell* cell) const
 {
-    ASSERT_UNUSED(cell, !table()->cellBefore(cell));
+    ASSERT_UNUSED(cell, cell->isFirstOrLastCellInRow());
     // FIXME: https://webkit.org/b/79272 - Add support for mixed directionality at the cell level.
     return style()->borderStart();
 }
 
 const BorderValue& RenderTableRow::borderAdjoiningEndCell(const RenderTableCell* cell) const
 {
-    ASSERT_UNUSED(cell, !table()->cellAfter(cell));
+    ASSERT_UNUSED(cell, cell->isFirstOrLastCellInRow());
     // FIXME: https://webkit.org/b/79272 - Add support for mixed directionality at the cell level.
     return style()->borderEnd();
 }
diff --git a/Source/WebCore/rendering/RenderTableRow.h b/Source/WebCore/rendering/RenderTableRow.h
index 80d4c17e6..b438a4c01 100644
--- a/Source/WebCore/rendering/RenderTableRow.h
+++ b/Source/WebCore/rendering/RenderTableRow.h
@@ -36,6 +36,9 @@ class RenderTableRow : public RenderBox {
 public:
     explicit RenderTableRow(Node*);
 
+    RenderObject* firstChild() const { ASSERT(children() == virtualChildren()); return children()->firstChild(); }
+    RenderObject* lastChild() const { ASSERT(children() == virtualChildren()); return children()->lastChild(); }
+
     const RenderObjectChildList* children() const { return &m_children; }
     RenderObjectChildList* children() { return &m_children; }
 
diff --git a/Source/WebCore/rendering/RenderTableSection.cpp b/Source/WebCore/rendering/RenderTableSection.cpp
index 1d628fe59..c8452a47c 100644
--- a/Source/WebCore/rendering/RenderTableSection.cpp
+++ b/Source/WebCore/rendering/RenderTableSection.cpp
@@ -987,6 +987,7 @@ LayoutRect RenderTableSection::logicalRectForWritingModeAndDirection(const Layou
         tableAlignedRect = tableAlignedRect.transposedRect();
 
     const Vector<int>& columnPos = table()->columnPositions();
+    // FIXME: The table's direction should determine our row's direction, not the section's (see bug 96691).
     if (!style()->isLeftToRightDirection())
         tableAlignedRect.setX(columnPos[columnPos.size() - 1] - tableAlignedRect.maxX());
 
@@ -1266,16 +1267,14 @@ unsigned RenderTableSection::numColumns() const
 
 const BorderValue& RenderTableSection::borderAdjoiningStartCell(const RenderTableCell* cell) const
 {
-    ASSERT_UNUSED(cell, !table()->cellBefore(cell));
-    // FIXME: https://webkit.org/b/79272 - Add support for mixed directionality at the cell level.
-    return style()->borderStart();
+    ASSERT(cell->isFirstOrLastCellInRow());
+    return hasSameDirectionAs(cell) ? style()->borderStart() : style()->borderEnd();
 }
 
 const BorderValue& RenderTableSection::borderAdjoiningEndCell(const RenderTableCell* cell) const
 {
-    ASSERT_UNUSED(cell, !table()->cellAfter(cell));
-    // FIXME: https://webkit.org/b/79272 - Add support for mixed directionality at the cell level.
-    return style()->borderEnd();
+    ASSERT(cell->isFirstOrLastCellInRow());
+    return hasSameDirectionAs(cell) ? style()->borderEnd() : style()->borderStart();
 }
 
 const RenderTableCell* RenderTableSection::firstRowCellAdjoiningTableStart() const
@@ -1429,7 +1428,8 @@ void RenderTableSection::setLogicalPositionForCell(RenderTableCell* cell, unsign
     LayoutPoint cellLocation(0, m_rowPos[cell->rowIndex()]);
     int horizontalBorderSpacing = table()->hBorderSpacing();
 
-    if (!cell->styleForCellFlow()->isLeftToRightDirection())
+    // FIXME: The table's direction should determine our row's direction, not the section's (see bug 96691).
+    if (!style()->isLeftToRightDirection())
         cellLocation.setX(table()->columnPositions()[table()->numEffCols()] - table()->columnPositions()[table()->colToEffCol(cell->col() + cell->colSpan())] + horizontalBorderSpacing);
     else
         cellLocation.setX(table()->columnPositions()[effectiveColumn] + horizontalBorderSpacing);
diff --git a/Source/WebCore/rendering/RenderTableSection.h b/Source/WebCore/rendering/RenderTableSection.h
index cd6eb9739..79cdd4a1d 100644
--- a/Source/WebCore/rendering/RenderTableSection.h
+++ b/Source/WebCore/rendering/RenderTableSection.h
@@ -65,6 +65,9 @@ public:
     RenderTableSection(Node*);
     virtual ~RenderTableSection();
 
+    RenderObject* firstChild() const { ASSERT(children() == virtualChildren()); return children()->firstChild(); }
+    RenderObject* lastChild() const { ASSERT(children() == virtualChildren()); return children()->lastChild(); }
+
     const RenderObjectChildList* children() const { return &m_children; }
     RenderObjectChildList* children() { return &m_children; }
 
diff --git a/Source/WebCore/rendering/RenderText.cpp b/Source/WebCore/rendering/RenderText.cpp
index 9a077bf30..3f8d715ea 100644
--- a/Source/WebCore/rendering/RenderText.cpp
+++ b/Source/WebCore/rendering/RenderText.cpp
@@ -1466,7 +1466,7 @@ void RenderText::setText(PassRefPtr<StringImpl> text, bool force)
     
     AXObjectCache* axObjectCache = document()->axObjectCache();
     if (axObjectCache->accessibilityEnabled())
-        axObjectCache->contentChanged(this);
+        axObjectCache->textChanged(this);
 }
 
 String RenderText::textWithoutTranscoding() const
diff --git a/Source/WebCore/rendering/RenderTheme.h b/Source/WebCore/rendering/RenderTheme.h
index b568953cb..b14749318 100644
--- a/Source/WebCore/rendering/RenderTheme.h
+++ b/Source/WebCore/rendering/RenderTheme.h
@@ -138,7 +138,7 @@ public:
     // A method asking if the platform is able to show datalist suggestions for a given input type.
     virtual bool supportsDataListUI(const AtomicString&) const { return false; }
 
-#if ENABLE(INPUT_MULTIPLE_FIELDS_UI) && ENABLE(CALENDAR_PICKER)
+#if ENABLE(INPUT_MULTIPLE_FIELDS_UI)
     // A method asking if the platform is able to show a calendar picker for a given input type.
     virtual bool supportsCalendarPicker(const AtomicString&) const { return false; }
 #endif
diff --git a/Source/WebCore/rendering/RenderThemeChromiumCommon.cpp b/Source/WebCore/rendering/RenderThemeChromiumCommon.cpp
index 359577ab4..280911073 100644
--- a/Source/WebCore/rendering/RenderThemeChromiumCommon.cpp
+++ b/Source/WebCore/rendering/RenderThemeChromiumCommon.cpp
@@ -46,7 +46,7 @@ bool RenderThemeChromiumCommon::supportsDataListUI(const AtomicString& type)
         || type == InputTypeNames::range();
 }
 
-#if ENABLE(INPUT_MULTIPLE_FIELDS_UI) && ENABLE(CALENDAR_PICKER)
+#if ENABLE(INPUT_MULTIPLE_FIELDS_UI)
 bool RenderThemeChromiumCommon::supportsCalendarPicker(const AtomicString& type)
 {
     // FIXME: We'd like to support datetime, datetime-local, month, and week too.
diff --git a/Source/WebCore/rendering/RenderThemeChromiumCommon.h b/Source/WebCore/rendering/RenderThemeChromiumCommon.h
index 8c05acf60..00a261d30 100644
--- a/Source/WebCore/rendering/RenderThemeChromiumCommon.h
+++ b/Source/WebCore/rendering/RenderThemeChromiumCommon.h
@@ -35,7 +35,7 @@ namespace WebCore {
 class RenderThemeChromiumCommon {
 public:
     static bool supportsDataListUI(const AtomicString& type);
-#if ENABLE(INPUT_MULTIPLE_FIELDS_UI) && ENABLE(CALENDAR_PICKER)
+#if ENABLE(INPUT_MULTIPLE_FIELDS_UI)
     static bool supportsCalendarPicker(const AtomicString& type);
 #endif
     static LayoutUnit sliderTickSnappingThreshold();
diff --git a/Source/WebCore/rendering/RenderThemeChromiumMac.h b/Source/WebCore/rendering/RenderThemeChromiumMac.h
index 240dcf9c0..1f5a81484 100644
--- a/Source/WebCore/rendering/RenderThemeChromiumMac.h
+++ b/Source/WebCore/rendering/RenderThemeChromiumMac.h
@@ -77,7 +77,7 @@ private:
 #if ENABLE(CALENDAR_PICKER)
     virtual CString extraCalendarPickerStyleSheet() OVERRIDE;
 #endif
-#if ENABLE(INPUT_MULTIPLE_FIELDS_UI) && ENABLE(CALENDAR_PICKER)
+#if ENABLE(INPUT_MULTIPLE_FIELDS_UI)
     virtual bool supportsCalendarPicker(const AtomicString& type) const OVERRIDE;
 #endif
     virtual bool shouldShowPlaceholderWhenFocused() const OVERRIDE;
diff --git a/Source/WebCore/rendering/RenderThemeChromiumSkia.h b/Source/WebCore/rendering/RenderThemeChromiumSkia.h
index b9da522e1..87b4e81dd 100644
--- a/Source/WebCore/rendering/RenderThemeChromiumSkia.h
+++ b/Source/WebCore/rendering/RenderThemeChromiumSkia.h
@@ -181,7 +181,7 @@ private:
 #if ENABLE(DATALIST_ELEMENT)
     virtual LayoutUnit sliderTickSnappingThreshold() const OVERRIDE;
 #endif
-#if ENABLE(INPUT_MULTIPLE_FIELDS_UI) && ENABLE(CALENDAR_PICKER)
+#if ENABLE(INPUT_MULTIPLE_FIELDS_UI)
     virtual bool supportsCalendarPicker(const AtomicString& type) const OVERRIDE;
 #endif
 
diff --git a/Source/WebCore/rendering/RenderVideo.cpp b/Source/WebCore/rendering/RenderVideo.cpp
index 02c313ba2..11269e252 100644
--- a/Source/WebCore/rendering/RenderVideo.cpp
+++ b/Source/WebCore/rendering/RenderVideo.cpp
@@ -79,7 +79,7 @@ void RenderVideo::intrinsicSizeChanged()
 
 void RenderVideo::updateIntrinsicSize()
 {
-    IntSize size = calculateIntrinsicSize();
+    LayoutSize size = calculateIntrinsicSize();
     size.scale(style()->effectiveZoom());
 
     // Never set the element size to zero when in a media document.
@@ -94,7 +94,7 @@ void RenderVideo::updateIntrinsicSize()
     setNeedsLayout(true);
 }
     
-IntSize RenderVideo::calculateIntrinsicSize()
+LayoutSize RenderVideo::calculateIntrinsicSize()
 {
     HTMLVideoElement* video = videoElement();
     
@@ -109,7 +109,7 @@ IntSize RenderVideo::calculateIntrinsicSize()
     // height of the poster frame, if that is available; otherwise it is 150 CSS pixels.
     MediaPlayer* player = mediaElement()->player();
     if (player && video->readyState() >= HTMLVideoElement::HAVE_METADATA) {
-        IntSize size = player->naturalSize();
+        LayoutSize size = player->naturalSize();
         if (!size.isEmpty())
             return size;
     }
@@ -121,14 +121,14 @@ IntSize RenderVideo::calculateIntrinsicSize()
     // width and height attributes of the video element as the intrinsic size until
     // better values become available. 
     if (video->hasAttribute(widthAttr) && video->hasAttribute(heightAttr))
-        return IntSize(video->width(), video->height());
+        return LayoutSize(video->width(), video->height());
 
     // <video> in standalone media documents should not use the default 300x150
     // size since they also have audio-only files. By setting the intrinsic
     // size to 300x1 the video will resize itself in these cases, and audio will
     // have the correct height (it needs to be > 0 for controls to render properly).
     if (video->ownerDocument() && video->ownerDocument()->isMediaDocument())
-        return IntSize(defaultSize().width(), 1);
+        return LayoutSize(defaultSize().width(), 1);
 
     return defaultSize();
 }
@@ -153,7 +153,7 @@ IntRect RenderVideo::videoBox() const
     if (m_cachedImageSize.isEmpty() && videoElement()->shouldDisplayPosterImage())
         return IntRect();
 
-    IntSize elementSize;
+    LayoutSize elementSize;
     if (videoElement()->shouldDisplayPosterImage())
         elementSize = m_cachedImageSize;
     else
@@ -163,22 +163,22 @@ IntRect RenderVideo::videoBox() const
     if (elementSize.isEmpty() || contentRect.isEmpty())
         return IntRect();
 
-    IntRect renderBox = contentRect;
-    int ratio = renderBox.width() * elementSize.height() - renderBox.height() * elementSize.width();
+    LayoutRect renderBox = contentRect;
+    LayoutUnit ratio = renderBox.width() * elementSize.height() - renderBox.height() * elementSize.width();
     if (ratio > 0) {
-        int newWidth = renderBox.height() * elementSize.width() / elementSize.height();
+        LayoutUnit newWidth = renderBox.height() * elementSize.width() / elementSize.height();
         // Just fill the whole area if the difference is one pixel or less (in both sides)
         if (renderBox.width() - newWidth > 2)
             renderBox.setWidth(newWidth);
         renderBox.move((contentRect.width() - renderBox.width()) / 2, 0);
     } else if (ratio < 0) {
-        int newHeight = renderBox.width() * elementSize.height() / elementSize.width();
+        LayoutUnit newHeight = renderBox.width() * elementSize.height() / elementSize.width();
         if (renderBox.height() - newHeight > 2)
             renderBox.setHeight(newHeight);
         renderBox.move(0, (contentRect.height() - renderBox.height()) / 2);
     }
 
-    return renderBox;
+    return pixelSnappedIntRect(renderBox);
 }
 
 bool RenderVideo::shouldDisplayVideo() const
@@ -195,13 +195,10 @@ void RenderVideo::paintReplaced(PaintInfo& paintInfo, const LayoutPoint& paintOf
     if (Frame* frame = this->frame())
         page = frame->page();
 
-    if (!displayingPoster) {
-        if (!mediaPlayer) {
-            if (page && paintInfo.phase == PaintPhaseForeground)
-                page->addRelevantUnpaintedObject(this, visualOverflowRect());
-            return;
-        }
-        updatePlayer();
+    if (!displayingPoster && !mediaPlayer) {
+        if (page && paintInfo.phase == PaintPhaseForeground)
+            page->addRelevantUnpaintedObject(this, visualOverflowRect());
+        return;
     }
 
     LayoutRect rect = videoBox();
@@ -275,7 +272,7 @@ LayoutUnit RenderVideo::computeReplacedLogicalHeight() const
     return RenderReplaced::computeReplacedLogicalHeight();
 }
 
-int RenderVideo::minimumReplacedHeight() const 
+LayoutUnit RenderVideo::minimumReplacedHeight() const 
 {
     return RenderReplaced::minimumReplacedHeight(); 
 }
diff --git a/Source/WebCore/rendering/RenderVideo.h b/Source/WebCore/rendering/RenderVideo.h
index 029176e8b..78f855068 100644
--- a/Source/WebCore/rendering/RenderVideo.h
+++ b/Source/WebCore/rendering/RenderVideo.h
@@ -56,7 +56,7 @@ private:
     inline HTMLVideoElement* videoElement() const;
 
     virtual void intrinsicSizeChanged();
-    IntSize calculateIntrinsicSize();
+    LayoutSize calculateIntrinsicSize();
     void updateIntrinsicSize();
 
     virtual void imageChanged(WrappedImagePtr, const IntRect*);
@@ -72,7 +72,7 @@ private:
 
     virtual LayoutUnit computeReplacedLogicalWidth(bool includeMaxWidth = true) const;
     virtual LayoutUnit computeReplacedLogicalHeight() const;
-    virtual int minimumReplacedHeight() const;
+    virtual LayoutUnit minimumReplacedHeight() const OVERRIDE;
 
 #if ENABLE(FULLSCREEN_API)
     virtual LayoutUnit offsetLeft() const;
@@ -83,7 +83,7 @@ private:
 
     void updatePlayer();
 
-    IntSize m_cachedImageSize;
+    LayoutSize m_cachedImageSize;
 };
 
 inline RenderVideo* toRenderVideo(RenderObject* object)
diff --git a/Source/WebCore/rendering/RenderView.cpp b/Source/WebCore/rendering/RenderView.cpp
index 7e118c7d0..19731c27a 100644
--- a/Source/WebCore/rendering/RenderView.cpp
+++ b/Source/WebCore/rendering/RenderView.cpp
@@ -305,14 +305,27 @@ static inline bool isComposited(RenderObject* object)
     return object->hasLayer() && toRenderLayerModelObject(object)->layer()->isComposited();
 }
 
-static inline bool rendererObscuresBackground(RenderObject* object)
+static inline bool rendererObscuresBackground(RenderObject* rootObject)
 {
-    return object && object->style()->visibility() == VISIBLE
-        && object->style()->opacity() == 1
-        && !object->style()->hasTransform()
-        && !isComposited(object);
-}
+    if (!rootObject)
+        return false;
+    
+    RenderStyle* style = rootObject->style();
+    if (style->visibility() != VISIBLE
+        || style->opacity() != 1
+        || style->hasTransform())
+        return false;
     
+    if (isComposited(rootObject))
+        return false;
+
+    const RenderObject* rootRenderer = rootObject->rendererForRootBackground();
+    if (rootRenderer->style()->backgroundClip() == TextFillBox)
+        return false;
+
+    return true;
+}
+
 void RenderView::paintBoxDecorations(PaintInfo& paintInfo, const LayoutPoint&)
 {
     // Check to see if we are enclosed by a layer that requires complex painting rules.  If so, we cannot blit
@@ -342,18 +355,20 @@ void RenderView::paintBoxDecorations(PaintInfo& paintInfo, const LayoutPoint&)
         return;
 
     bool rootFillsViewport = false;
+    bool rootObscuresBackground = false;
     Node* documentElement = document()->documentElement();
     if (RenderObject* rootRenderer = documentElement ? documentElement->renderer() : 0) {
         // The document element's renderer is currently forced to be a block, but may not always be.
         RenderBox* rootBox = rootRenderer->isBox() ? toRenderBox(rootRenderer) : 0;
         rootFillsViewport = rootBox && !rootBox->x() && !rootBox->y() && rootBox->width() >= width() && rootBox->height() >= height();
+        rootObscuresBackground = rendererObscuresBackground(rootRenderer);
     }
     
     Page* page = document()->page();
     float pageScaleFactor = page ? page->pageScaleFactor() : 1;
 
     // If painting will entirely fill the view, no need to fill the background.
-    if (rootFillsViewport && rendererObscuresBackground(firstChild()) && pageScaleFactor >= 1)
+    if (rootFillsViewport && rootObscuresBackground && pageScaleFactor >= 1)
         return;
 
     // This code typically only executes if the root element's visibility has been set to hidden,
diff --git a/Source/WebCore/rendering/RenderView.h b/Source/WebCore/rendering/RenderView.h
index 084d7d5a7..45444ae50 100644
--- a/Source/WebCore/rendering/RenderView.h
+++ b/Source/WebCore/rendering/RenderView.h
@@ -313,9 +313,6 @@ protected:
     typedef HashSet<RenderWidget*> RenderWidgetSet;
     RenderWidgetSet m_widgets;
 
-    typedef HashSet<RenderBox*> RenderBoxSet;
-    OwnPtr<RenderBoxSet> m_fixedPositionedElements;
-
 private:
     bool shouldUsePrintingLayout() const;
 
@@ -352,10 +349,9 @@ inline const RenderView* toRenderView(const RenderObject* object)
 // This will catch anyone doing an unnecessary cast.
 void toRenderView(const RenderView*);
 
-
-ALWAYS_INLINE RenderView* RenderObject::view() const
+ALWAYS_INLINE RenderView* Document::renderView() const
 {
-    return toRenderView(document()->renderer());
+    return toRenderView(renderer());
 }
 
 // Stack-based class to assist with LayoutState push/pop
diff --git a/Source/WebCore/rendering/RootInlineBox.cpp b/Source/WebCore/rendering/RootInlineBox.cpp
index a26025981..6c9330362 100644
--- a/Source/WebCore/rendering/RootInlineBox.cpp
+++ b/Source/WebCore/rendering/RootInlineBox.cpp
@@ -499,6 +499,10 @@ RenderObject::SelectionState RootInlineBox::selectionState()
                  ((boxState == RenderObject::SelectionStart || boxState == RenderObject::SelectionEnd) &&
                   (state == RenderObject::SelectionNone || state == RenderObject::SelectionInside)))
             state = boxState;
+        else if (boxState == RenderObject::SelectionNone && state == RenderObject::SelectionStart) {
+            // We are past the end of the selection.
+            state = RenderObject::SelectionBoth;
+        }
         if (state == RenderObject::SelectionBoth)
             break;
     }
diff --git a/Source/WebCore/rendering/mathml/RenderMathMLBlock.cpp b/Source/WebCore/rendering/mathml/RenderMathMLBlock.cpp
index 5eed89fd5..54f807057 100644
--- a/Source/WebCore/rendering/mathml/RenderMathMLBlock.cpp
+++ b/Source/WebCore/rendering/mathml/RenderMathMLBlock.cpp
@@ -32,6 +32,7 @@
 
 #include "GraphicsContext.h"
 #include "MathMLNames.h"
+#include "RenderView.h"
 
 #if ENABLE(DEBUG_MATH_LAYOUT)
 #include "PaintInfo.h"
@@ -165,25 +166,35 @@ void RenderMathMLBlock::computeChildrenPreferredLogicalHeights()
     // Ensure a full repaint will happen after layout finishes.
     setNeedsLayout(true, MarkOnlyThis);
     
-    LayoutUnit oldAvailableLogicalWidth = availableLogicalWidth();
-    setLogicalWidth(cLargeLogicalWidth);
-    
-    for (RenderObject* child = firstChild(); child; child = child->nextSibling()) {
-        if (!child->isBox())
-            continue;
+    RenderView* renderView = view();
+    bool hadLayoutState = renderView->layoutState();
+    if (!hadLayoutState)
+        renderView->pushLayoutState(this);
+    {
+        LayoutStateDisabler layoutStateDisabler(renderView);
         
-        // Because our width changed, |child| may need layout.
-        if (child->maxPreferredLogicalWidth() > oldAvailableLogicalWidth)
-            child->setNeedsLayout(true, MarkOnlyThis);
+        LayoutUnit oldAvailableLogicalWidth = availableLogicalWidth();
+        setLogicalWidth(cLargeLogicalWidth);
         
-        RenderMathMLBlock* childMathMLBlock = child->isRenderMathMLBlock() ? toRenderMathMLBlock(child) : 0;
-        if (childMathMLBlock && !childMathMLBlock->isPreferredLogicalHeightDirty())
-            continue;
-        // Layout our child to compute its preferred logical height.
-        child->layoutIfNeeded();
-        if (childMathMLBlock)
-            childMathMLBlock->setPreferredLogicalHeight(childMathMLBlock->logicalHeight());
+        for (RenderObject* child = firstChild(); child; child = child->nextSibling()) {
+            if (!child->isBox())
+                continue;
+            
+            // Because our width changed, |child| may need layout.
+            if (child->maxPreferredLogicalWidth() > oldAvailableLogicalWidth)
+                child->setNeedsLayout(true, MarkOnlyThis);
+            
+            RenderMathMLBlock* childMathMLBlock = child->isRenderMathMLBlock() ? toRenderMathMLBlock(child) : 0;
+            if (childMathMLBlock && !childMathMLBlock->isPreferredLogicalHeightDirty())
+                continue;
+            // Layout our child to compute its preferred logical height.
+            child->layoutIfNeeded();
+            if (childMathMLBlock)
+                childMathMLBlock->setPreferredLogicalHeight(childMathMLBlock->logicalHeight());
+        }
     }
+    if (!hadLayoutState)
+        renderView->popLayoutState(this);
 }
 
 LayoutUnit RenderMathMLBlock::preferredLogicalHeightAfterSizing(RenderObject* child)
diff --git a/Source/WebCore/rendering/mathml/RenderMathMLFraction.cpp b/Source/WebCore/rendering/mathml/RenderMathMLFraction.cpp
index 540846493..5603eb558 100644
--- a/Source/WebCore/rendering/mathml/RenderMathMLFraction.cpp
+++ b/Source/WebCore/rendering/mathml/RenderMathMLFraction.cpp
@@ -86,14 +86,23 @@ void RenderMathMLFraction::updateFromElement()
     lastChild()->style()->setPaddingTop(Length(static_cast<int>(m_lineThickness), Fixed));
 }
 
-void RenderMathMLFraction::addChild(RenderObject* child, RenderObject* beforeChild)
+void RenderMathMLFraction::addChild(RenderObject* child, RenderObject* /* beforeChild */)
 {
-    RenderMathMLBlock* row = createAnonymousMathMLBlock();
+    if (isEmpty()) {
+        RenderMathMLBlock* numeratorWrapper = createAnonymousMathMLBlock();
+        RenderMathMLBlock::addChild(numeratorWrapper);
+        fixChildStyle(numeratorWrapper);
+        
+        RenderMathMLBlock* denominatorWrapper = createAnonymousMathMLBlock();
+        RenderMathMLBlock::addChild(denominatorWrapper);
+        fixChildStyle(denominatorWrapper);
+    }
     
-    RenderMathMLBlock::addChild(row, beforeChild);
-    row->addChild(child);
+    if (firstChild()->isEmpty())
+        firstChild()->addChild(child);
+    else
+        lastChild()->addChild(child);
     
-    fixChildStyle(row);
     updateFromElement();
 }
 
diff --git a/Source/WebCore/rendering/mathml/RenderMathMLOperator.cpp b/Source/WebCore/rendering/mathml/RenderMathMLOperator.cpp
index 66a1621c2..6655cce9a 100644
--- a/Source/WebCore/rendering/mathml/RenderMathMLOperator.cpp
+++ b/Source/WebCore/rendering/mathml/RenderMathMLOperator.cpp
@@ -30,6 +30,7 @@
 
 #include "RenderMathMLOperator.h"
 
+#include "FontCache.h"
 #include "FontSelector.h"
 #include "MathMLNames.h"
 #include "RenderText.h"
@@ -57,7 +58,6 @@ bool RenderMathMLOperator::isChildAllowed(RenderObject*, RenderStyle*) const
     return false;
 }
 
-static const float gOperatorSpacer = 0.1f;
 static const float gOperatorExpansion = 1.2f;
 
 void RenderMathMLOperator::stretchToHeight(int height)
@@ -108,54 +108,18 @@ static struct StretchyCharacter {
     { 0x2309, 0x23a4, 0x23a5, 0x23a5, 0x0    }, // right ceiling
     { 0x230b, 0x23a5, 0x23a5, 0x23a6, 0x0    }, // right floor
     { 0x7b  , 0x23a7, 0x23aa, 0x23a9, 0x23a8 }, // left curly bracket
-    { 0x7c  , 0x23d0, 0x23d0, 0x23d0, 0x0    }, // vertical bar
+    { 0x7c  , 0x23aa, 0x23aa, 0x23aa, 0x0    }, // vertical bar
     { 0x2016, 0x2016, 0x2016, 0x2016, 0x0    }, // double vertical line
     { 0x7d  , 0x23ab, 0x23aa, 0x23ad, 0x23ac }, // right curly bracket
     { 0x222b, 0x2320, 0x23ae, 0x2321, 0x0    } // integral sign
 };
 
-// We stack glyphs using a 14px height with a displayed glyph height
-// of 10px.  The line height is set to less than the 14px so that there
-// are no blank spaces between the stacked glyphs.
-//
-// Certain glyphs (e.g. middle and bottom) need to be adjusted upwards
-// in the stack so that there isn't a gap.
-//
-// All of these settings are represented in the constants below.
-
-// FIXME: use fractions of style()->fontSize() for proper zooming/resizing.
-// FIXME: None of this should be hard-coded. Not only does this cause problems
-// with zooming, but it also sets up assumptions that break when a font contains
-// a glyph that is smaller than expected. For example, the STIX vertical bar
-// glyph is smaller than expected, and glyphHeightForCharacter() and
-// lineHeightForCharacter() were added to make smaller glyphs work in this system.
-// Really, the system should just be reconsidered.
-static const int gGlyphFontSize = 14;
-static const int gGlyphLineHeight = 11;
-static const int gMinimumStretchHeight = 24;
-static const int gGlyphHeight = 10;
-static const int gTopGlyphTopAdjust = 1;
-static const int gMiddleGlyphTopAdjust = -1;
-static const int gBottomGlyphTopAdjust = -3;
-static const float gMinimumRatioForStretch = 0.10f;
-
-// This should always be called instead of accessing gGlyphHeight directly.
+// Note glyphHeightForCharacter truncates its result to an int.
 int RenderMathMLOperator::glyphHeightForCharacter(UChar character)
 {
     GlyphData data = style()->font().glyphDataForCharacter(character, false);
     FloatRect glyphBounds = data.fontData->boundsForGlyph(data.glyph);
-    if (glyphBounds.height() && glyphBounds.height() < gGlyphHeight)
-        return glyphBounds.height();
-    return gGlyphHeight;
-}
-
-// This should always be called instead of accessing gGlyphLineHeight directly.
-int RenderMathMLOperator::lineHeightForCharacter(UChar character)
-{
-    int glyphHeight = glyphHeightForCharacter(character);
-    if (glyphHeight < gGlyphHeight)
-        return (glyphHeight - 1) > 0 ? glyphHeight - 1 : 1;
-    return gGlyphLineHeight;
+    return glyphBounds.height();
 }
 
 // FIXME: It's cleaner to only call updateFromElement when an attribute has changed. The body of
@@ -213,11 +177,28 @@ void RenderMathMLOperator::updateFromElement()
         }
     }
     
-    // We only stretch character if the stretch height is larger than a minimum size (e.g. 24px).
-    bool shouldStretch = isStretchy && m_stretchHeight>gMinimumStretchHeight;
+    // We only stack glyphs if the stretch height is larger than a minimum size.
+    bool shouldStack = isStretchy && m_stretchHeight > style()->fontSize();
+    struct StretchyCharacter* partsData = 0;
+    int topGlyphHeight = 0;
+    int extensionGlyphHeight = 0;
+    int bottomGlyphHeight = 0;
+    int middleGlyphHeight = 0;
+    if (shouldStack) {
+        partsData = &stretchyCharacters[index];
+        
+        FontCachePurgePreventer fontCachePurgePreventer;
+        
+        topGlyphHeight = glyphHeightForCharacter(partsData->topGlyph);
+        extensionGlyphHeight = glyphHeightForCharacter(partsData->extensionGlyph) - 1;
+        bottomGlyphHeight = glyphHeightForCharacter(partsData->bottomGlyph);
+        if (partsData->middleGlyph)
+            middleGlyphHeight = glyphHeightForCharacter(partsData->middleGlyph) - 1;
+        shouldStack = m_stretchHeight >= topGlyphHeight + middleGlyphHeight + bottomGlyphHeight && extensionGlyphHeight > 0;
+    }
     
     // Either stretch is disabled or we don't have a stretchable character over the minimum height
-    if (stretchDisabled || !shouldStretch) {
+    if (stretchDisabled || !shouldStack) {
         m_isStacked = false;
         RenderBlock* container = new (renderArena()) RenderMathMLBlock(node());
         
@@ -225,10 +206,8 @@ void RenderMathMLOperator::updateFromElement()
         newStyle->inheritFrom(style());
         newStyle->setDisplay(FLEX);
         
-        // Check for a stretchable character that is under the minimum height and use the
-        // font size to adjust the glyph size.
-        int currentFontSize = style()->fontSize();
-        if (!stretchDisabled && isStretchy && m_stretchHeight > 0 && m_stretchHeight <= gMinimumStretchHeight  && m_stretchHeight > currentFontSize) {
+        // Check for a stretchable character that is under the minimum height.
+        if (!stretchDisabled && isStretchy && m_stretchHeight > style()->fontSize()) {
             FontDescription desc = style()->fontDescription();
             desc.setIsAbsoluteSize(true);
             desc.setSpecifiedSize(m_stretchHeight);
@@ -257,110 +236,64 @@ void RenderMathMLOperator::updateFromElement()
     } else {
         // Build stretchable characters as a stack of glyphs.
         m_isStacked = true;
-    
-        int extensionGlyphLineHeight = lineHeightForCharacter(stretchyCharacters[index].extensionGlyph);
-        int topGlyphLineHeight = lineHeightForCharacter(stretchyCharacters[index].topGlyph);
-        int bottomGlyphLineHeight = lineHeightForCharacter(stretchyCharacters[index].bottomGlyph);
         
-        if (stretchyCharacters[index].middleGlyph) {
+        // To avoid gaps, we position glyphs after the top glyph upward by 1px. We also truncate
+        // glyph heights to ints, and then reduce all but the top & bottom such heights by 1px.
+        
+        int remaining = m_stretchHeight - topGlyphHeight - bottomGlyphHeight;
+        createGlyph(partsData->topGlyph, topGlyphHeight, 0);
+        if (partsData->middleGlyph) {
             // We have a middle glyph (e.g. a curly bracket) that requires special processing.
-            int glyphHeight = glyphHeightForCharacter(stretchyCharacters[index].middleGlyph);
-            int middleGlyphLineHeight = lineHeightForCharacter(stretchyCharacters[index].middleGlyph);
-            int half = (m_stretchHeight - glyphHeight) / 2;
-            if (half <= glyphHeight) {
-                // We only have enough space for a single middle glyph.
-                createGlyph(stretchyCharacters[index].topGlyph, topGlyphLineHeight, half, gTopGlyphTopAdjust);
-                createGlyph(stretchyCharacters[index].middleGlyph, middleGlyphLineHeight, glyphHeight, gMiddleGlyphTopAdjust);
-                createGlyph(stretchyCharacters[index].bottomGlyph, bottomGlyphLineHeight, 0, gBottomGlyphTopAdjust);
-            } else {
-                // We have to extend both the top and bottom to the middle.
-                createGlyph(stretchyCharacters[index].topGlyph, topGlyphLineHeight, glyphHeight, gTopGlyphTopAdjust);
-                int remaining = half - glyphHeight;
-                while (remaining > 0) {
-                    if (remaining < glyphHeight) {
-                        createGlyph(stretchyCharacters[index].extensionGlyph, extensionGlyphLineHeight, remaining);
-                        remaining = 0;
-                    } else {
-                        createGlyph(stretchyCharacters[index].extensionGlyph, extensionGlyphLineHeight, glyphHeight);
-                        remaining -= glyphHeight;
-                    }
-                }
-                
-                // The middle glyph in the stack.
-                createGlyph(stretchyCharacters[index].middleGlyph, middleGlyphLineHeight, glyphHeight, gMiddleGlyphTopAdjust);
-                
-                // The remaining is the top half minus the middle glyph height.
-                remaining = half - glyphHeight;
-                // We need to make sure we have the full height in case the height is odd.
-                if (m_stretchHeight % 2 == 1)
-                    remaining++;
-                
-                // Extend to the bottom glyph.
-                while (remaining > 0) {
-                    if (remaining < glyphHeight) {
-                        createGlyph(stretchyCharacters[index].extensionGlyph, extensionGlyphLineHeight, remaining);
-                        remaining = 0;
-                    } else {
-                        createGlyph(stretchyCharacters[index].extensionGlyph, extensionGlyphLineHeight, glyphHeight);
-                        remaining -= glyphHeight;
-                    }
-                }
-                
-                // The bottom glyph in the stack.
-                createGlyph(stretchyCharacters[index].bottomGlyph, bottomGlyphLineHeight, 0, gBottomGlyphTopAdjust);
+            remaining -= middleGlyphHeight;
+            int half = (remaining + 1) / 2;
+            remaining -= half;
+            while (remaining > 0) {
+                int height = std::min<int>(remaining, extensionGlyphHeight);
+                createGlyph(partsData->extensionGlyph, height, -1);
+                remaining -= height;
+            }
+            
+            // The middle glyph in the stack.
+            createGlyph(partsData->middleGlyph, middleGlyphHeight, -1);
+            
+            remaining = half;
+            while (remaining > 0) {
+                int height = std::min<int>(remaining, extensionGlyphHeight);
+                createGlyph(partsData->extensionGlyph, height, -1);
+                remaining -= height;
             }
         } else {
             // We do not have a middle glyph and so we just extend from the top to the bottom glyph.
-            int glyphHeight = glyphHeightForCharacter(stretchyCharacters[index].extensionGlyph);
-            int remaining = m_stretchHeight - 2 * glyphHeight;
-            createGlyph(stretchyCharacters[index].topGlyph, topGlyphLineHeight, glyphHeight, gTopGlyphTopAdjust);
             while (remaining > 0) {
-                if (remaining < glyphHeight) {
-                    createGlyph(stretchyCharacters[index].extensionGlyph, extensionGlyphLineHeight, remaining);
-                    remaining = 0;
-                } else {
-                    createGlyph(stretchyCharacters[index].extensionGlyph, extensionGlyphLineHeight, glyphHeight);
-                    remaining -= glyphHeight;
-                }
+                int height = std::min<int>(remaining, extensionGlyphHeight);
+                createGlyph(partsData->extensionGlyph, height, -1);
+                remaining -= height;
             }
-            createGlyph(stretchyCharacters[index].bottomGlyph, bottomGlyphLineHeight, 0, gBottomGlyphTopAdjust);
         }
+        createGlyph(partsData->bottomGlyph, bottomGlyphHeight, -1);
     }
     
     setNeedsLayoutAndPrefWidthsRecalc();
 }
 
-PassRefPtr<RenderStyle> RenderMathMLOperator::createStackableStyle(int /* lineHeight */, int maxHeightForRenderer, int topRelative)
+PassRefPtr<RenderStyle> RenderMathMLOperator::createStackableStyle(int maxHeightForRenderer)
 {
     RefPtr<RenderStyle> newStyle = RenderStyle::create();
     newStyle->inheritFrom(style());
     newStyle->setDisplay(FLEX);
     
-    FontDescription desc = style()->fontDescription();
-    desc.setIsAbsoluteSize(true);
-    desc.setSpecifiedSize(gGlyphFontSize);
-    desc.setComputedSize(gGlyphFontSize);
-    newStyle->setFontDescription(desc);
-    newStyle->font().update(style()->font().fontSelector());
-    // FIXME: With -webkit-line-box-contain, this method's lineHeight argument is no longer used. It should be removed in a future patch.
-
-    if (maxHeightForRenderer > 0)
-        newStyle->setMaxHeight(Length(maxHeightForRenderer, Fixed));
+    newStyle->setMaxHeight(Length(maxHeightForRenderer, Fixed));
     
     newStyle->setOverflowY(OHIDDEN);
     newStyle->setOverflowX(OHIDDEN);
-    if (topRelative) {
-        newStyle->setTop(Length(topRelative, Fixed));
-        newStyle->setPosition(RelativePosition);
-    }
 
     return newStyle.release();
 }
 
-RenderBlock* RenderMathMLOperator::createGlyph(UChar glyph, int lineHeight, int maxHeightForRenderer, int charRelative, int topRelative)
+RenderBlock* RenderMathMLOperator::createGlyph(UChar glyph, int maxHeightForRenderer, int charRelative)
 {
     RenderBlock* container = new (renderArena()) RenderMathMLBlock(node());
-    container->setStyle(createStackableStyle(lineHeight, maxHeightForRenderer, topRelative));
+    container->setStyle(createStackableStyle(maxHeightForRenderer));
     addChild(container);
     RenderBlock* parent = container;
     if (charRelative) {
diff --git a/Source/WebCore/rendering/mathml/RenderMathMLOperator.h b/Source/WebCore/rendering/mathml/RenderMathMLOperator.h
index e2cdd0572..40d6b7785 100644
--- a/Source/WebCore/rendering/mathml/RenderMathMLOperator.h
+++ b/Source/WebCore/rendering/mathml/RenderMathMLOperator.h
@@ -49,14 +49,13 @@ public:
         
 protected:
     virtual void computePreferredLogicalWidths() OVERRIDE;
-    PassRefPtr<RenderStyle> createStackableStyle(int lineHeight, int maxHeightForRenderer, int topRelative);
-    RenderBlock* createGlyph(UChar glyph, int lineHeight, int maxHeightForRenderer = 0, int charRelative = 0, int topRelative = 0);
+    PassRefPtr<RenderStyle> createStackableStyle(int maxHeightForRenderer);
+    RenderBlock* createGlyph(UChar glyph, int maxHeightForRenderer, int charRelative);
     
 private:
     virtual const char* renderName() const { return isAnonymous() ? "RenderMathMLOperator (anonymous)" : "RenderMathMLOperator"; }
 
     int glyphHeightForCharacter(UChar);
-    int lineHeightForCharacter(UChar);
 
     virtual void styleDidChange(StyleDifference, const RenderStyle* oldStyle) OVERRIDE;
 
diff --git a/Source/WebCore/rendering/mathml/RenderMathMLRoot.cpp b/Source/WebCore/rendering/mathml/RenderMathMLRoot.cpp
index b9346b935..cbbf251c0 100644
--- a/Source/WebCore/rendering/mathml/RenderMathMLRoot.cpp
+++ b/Source/WebCore/rendering/mathml/RenderMathMLRoot.cpp
@@ -82,7 +82,7 @@ void RenderMathMLRoot::addChild(RenderObject* newChild, RenderObject* beforeChil
     if (newChild->style()->position() == AbsolutePosition)
         RenderMathMLBlock::addChild(newChild);
     else
-        firstChild()->addChild(newChild, beforeChild && beforeChild->style()->position() != AbsolutePosition ? beforeChild : 0);
+        firstChild()->addChild(newChild, beforeChild && beforeChild->parent() == firstChild() ? beforeChild : 0);
 }
 
 RenderBoxModelObject* RenderMathMLRoot::index() const
diff --git a/Source/WebCore/rendering/mathml/RenderMathMLSubSup.cpp b/Source/WebCore/rendering/mathml/RenderMathMLSubSup.cpp
index 45642be52..aee1c3934 100644
--- a/Source/WebCore/rendering/mathml/RenderMathMLSubSup.cpp
+++ b/Source/WebCore/rendering/mathml/RenderMathMLSubSup.cpp
@@ -61,8 +61,12 @@ RenderBoxModelObject* RenderMathMLSubSup::base() const
     return toRenderBoxModelObject(base);
 }
 
-void RenderMathMLSubSup::fixScriptsStyle()
+void RenderMathMLSubSup::fixAnonymousStyles()
 {
+    // Set the base wrapper's style so that baseHeight in layout() will be an unstretched height.
+    ASSERT(firstChild() && firstChild()->style()->refCount() == 1);
+    firstChild()->style()->setAlignSelf(AlignFlexStart);
+    
     ASSERT(m_scripts && m_scripts->style()->refCount() == 1);
     RenderStyle* scriptsStyle = m_scripts->style();
     scriptsStyle->setFlexDirection(FlowColumn);
@@ -71,34 +75,31 @@ void RenderMathMLSubSup::fixScriptsStyle()
     scriptsStyle->setFontSize(static_cast<int>(0.75 * style()->fontSize()));
 }
 
-// FIXME: Handle arbitrary addChild/removeChild correctly throughout MathML, e.g. add/remove/add a base child here.
+// FIXME: Handle arbitrary addChild/removeChild correctly throughout MathML.
 void RenderMathMLSubSup::addChild(RenderObject* child, RenderObject* beforeChild)
 {
-    // Note: The RenderMathMLBlock only allows element children to be added.
-    Element* childElement = toElement(child->node());
-
-    if (childElement && !childElement->previousElementSibling()) {
-        // Position 1 is always the base of the msub/msup/msubsup.
+    if (isEmpty()) {
         RenderMathMLBlock* baseWrapper = createAnonymousMathMLBlock();
-        RenderMathMLBlock::addChild(baseWrapper, firstChild());
-        baseWrapper->addChild(child);
-            
-        // Make sure we have a script block for rendering.
-        if (!m_scripts) {
-            m_scripts = createAnonymousMathMLBlock();
-            fixScriptsStyle();
-            RenderMathMLBlock::addChild(m_scripts, beforeChild);
-        }
-    } else
-        m_scripts->addChild(child, beforeChild ? m_scripts->firstChild() : 0);
+        RenderMathMLBlock::addChild(baseWrapper);
+        
+        m_scripts = createAnonymousMathMLBlock();
+        RenderMathMLBlock::addChild(m_scripts);
+        
+        fixAnonymousStyles();
+    }
+    
+    if (firstChild()->isEmpty())
+        firstChild()->addChild(child);
+    else
+        m_scripts->addChild(child, beforeChild && beforeChild->parent() == m_scripts ? beforeChild : 0);
 }
 
 void RenderMathMLSubSup::styleDidChange(StyleDifference diff, const RenderStyle* oldStyle)
 {
     RenderMathMLBlock::styleDidChange(diff, oldStyle);
     
-    if (m_scripts)
-        fixScriptsStyle();
+    if (!isEmpty())
+        fixAnonymousStyles();
 }
 
 RenderMathMLOperator* RenderMathMLSubSup::unembellishedOperator()
diff --git a/Source/WebCore/rendering/mathml/RenderMathMLSubSup.h b/Source/WebCore/rendering/mathml/RenderMathMLSubSup.h
index 298225a87..640a86e01 100644
--- a/Source/WebCore/rendering/mathml/RenderMathMLSubSup.h
+++ b/Source/WebCore/rendering/mathml/RenderMathMLSubSup.h
@@ -44,7 +44,7 @@ protected:
     virtual void layout();
     
 private:
-    void fixScriptsStyle();
+    void fixAnonymousStyles();
     virtual void styleDidChange(StyleDifference, const RenderStyle* oldStyle) OVERRIDE;
 
     virtual const char* renderName() const { return "RenderMathMLSubSup"; }
diff --git a/Source/WebCore/rendering/style/BasicShapes.cpp b/Source/WebCore/rendering/style/BasicShapes.cpp
index 9b1245f66..29ca45d01 100644
--- a/Source/WebCore/rendering/style/BasicShapes.cpp
+++ b/Source/WebCore/rendering/style/BasicShapes.cpp
@@ -83,10 +83,10 @@ void BasicShapePolygon::path(Path& path, const FloatRect& boundingBox)
         return;
 
     path.moveTo(FloatPoint(floatValueForLength(m_values.at(0), boundingBox.width()) + boundingBox.x(),
-                           floatValueForLength(m_values.at(1), boundingBox.width()) + boundingBox.y()));
+        floatValueForLength(m_values.at(1), boundingBox.height()) + boundingBox.y()));
     for (size_t i = 2; i < length; i = i + 2) {
         path.addLineTo(FloatPoint(floatValueForLength(m_values.at(i), boundingBox.width()) + boundingBox.x(),
-                                  floatValueForLength(m_values.at(i + 1), boundingBox.width()) + boundingBox.y()));
+            floatValueForLength(m_values.at(i + 1), boundingBox.height()) + boundingBox.y()));
     }
     path.closeSubpath();
 }
diff --git a/Source/WebCore/rendering/style/CollapsedBorderValue.h b/Source/WebCore/rendering/style/CollapsedBorderValue.h
index 98cee1b07..120173bda 100644
--- a/Source/WebCore/rendering/style/CollapsedBorderValue.h
+++ b/Source/WebCore/rendering/style/CollapsedBorderValue.h
@@ -51,7 +51,7 @@ public:
     {
     }
 
-    unsigned width() const { return m_width; }
+    unsigned width() const { return m_style > BHIDDEN ? m_width : 0; }
     EBorderStyle style() const { return static_cast<EBorderStyle>(m_style); }
     bool exists() const { return m_precedence != BOFF; }
     Color color() const { return Color(m_color, m_colorIsValid); }
diff --git a/Source/WebCore/rendering/style/RenderStyle.cpp b/Source/WebCore/rendering/style/RenderStyle.cpp
index 6db4bb91c..179d32549 100644
--- a/Source/WebCore/rendering/style/RenderStyle.cpp
+++ b/Source/WebCore/rendering/style/RenderStyle.cpp
@@ -471,7 +471,7 @@ StyleDifference RenderStyle::diff(const RenderStyle* other, unsigned& changedCon
             || rareInheritedData->wordBreak != other->rareInheritedData->wordBreak
             || rareInheritedData->overflowWrap != other->rareInheritedData->overflowWrap
             || rareInheritedData->nbspMode != other->rareInheritedData->nbspMode
-            || rareInheritedData->khtmlLineBreak != other->rareInheritedData->khtmlLineBreak
+            || rareInheritedData->lineBreak != other->rareInheritedData->lineBreak
             || rareInheritedData->textSecurity != other->rareInheritedData->textSecurity
             || rareInheritedData->hyphens != other->rareInheritedData->hyphens
             || rareInheritedData->hyphenationLimitBefore != other->rareInheritedData->hyphenationLimitBefore
diff --git a/Source/WebCore/rendering/style/RenderStyle.h b/Source/WebCore/rendering/style/RenderStyle.h
index d1fd13e5e..ebe91b427 100644
--- a/Source/WebCore/rendering/style/RenderStyle.h
+++ b/Source/WebCore/rendering/style/RenderStyle.h
@@ -683,7 +683,7 @@ public:
 
     bool breakOnlyAfterWhiteSpace() const
     {
-        return whiteSpace() == PRE_WRAP || khtmlLineBreak() == AFTER_WHITE_SPACE;
+        return whiteSpace() == PRE_WRAP || lineBreak() == LineBreakAfterWhiteSpace;
     }
 
     bool breakWords() const
@@ -846,7 +846,7 @@ public:
     EWordBreak wordBreak() const { return static_cast<EWordBreak>(rareInheritedData->wordBreak); }
     EOverflowWrap overflowWrap() const { return static_cast<EOverflowWrap>(rareInheritedData->overflowWrap); }
     ENBSPMode nbspMode() const { return static_cast<ENBSPMode>(rareInheritedData->nbspMode); }
-    EKHTMLLineBreak khtmlLineBreak() const { return static_cast<EKHTMLLineBreak>(rareInheritedData->khtmlLineBreak); }
+    LineBreak lineBreak() const { return static_cast<LineBreak>(rareInheritedData->lineBreak); }
     const AtomicString& highlight() const { return rareInheritedData->highlight; }
     Hyphens hyphens() const { return static_cast<Hyphens>(rareInheritedData->hyphens); }
     short hyphenationLimitBefore() const { return rareInheritedData->hyphenationLimitBefore; }
@@ -1311,7 +1311,7 @@ public:
     void setWordBreak(EWordBreak b) { SET_VAR(rareInheritedData, wordBreak, b); }
     void setOverflowWrap(EOverflowWrap b) { SET_VAR(rareInheritedData, overflowWrap, b); }
     void setNBSPMode(ENBSPMode b) { SET_VAR(rareInheritedData, nbspMode, b); }
-    void setKHTMLLineBreak(EKHTMLLineBreak b) { SET_VAR(rareInheritedData, khtmlLineBreak, b); }
+    void setLineBreak(LineBreak b) { SET_VAR(rareInheritedData, lineBreak, b); }
     void setHighlight(const AtomicString& h) { SET_VAR(rareInheritedData, highlight, h); }
     void setHyphens(Hyphens h) { SET_VAR(rareInheritedData, hyphens, h); }
     void setHyphenationLimitBefore(short limit) { SET_VAR(rareInheritedData, hyphenationLimitBefore, limit); }
@@ -1650,7 +1650,7 @@ public:
     static EWordBreak initialWordBreak() { return NormalWordBreak; }
     static EOverflowWrap initialOverflowWrap() { return NormalOverflowWrap; }
     static ENBSPMode initialNBSPMode() { return NBNORMAL; }
-    static EKHTMLLineBreak initialKHTMLLineBreak() { return LBNORMAL; }
+    static LineBreak initialLineBreak() { return LineBreakAuto; }
     static const AtomicString& initialHighlight() { return nullAtom; }
     static ESpeak initialSpeak() { return SpeakNormal; }
     static Hyphens initialHyphens() { return HyphensManual; }
diff --git a/Source/WebCore/rendering/style/RenderStyleConstants.h b/Source/WebCore/rendering/style/RenderStyleConstants.h
index d3d34e5b4..f9f320996 100644
--- a/Source/WebCore/rendering/style/RenderStyleConstants.h
+++ b/Source/WebCore/rendering/style/RenderStyleConstants.h
@@ -210,8 +210,8 @@ enum ENBSPMode {
     NBNORMAL, SPACE
 };
 
-enum EKHTMLLineBreak {
-    LBNORMAL, AFTER_WHITE_SPACE
+enum LineBreak {
+    LineBreakAuto, LineBreakLoose, LineBreakNormal, LineBreakStrict, LineBreakAfterWhiteSpace
 };
 
 enum EResize {
diff --git a/Source/WebCore/rendering/style/StyleCachedImage.cpp b/Source/WebCore/rendering/style/StyleCachedImage.cpp
index 4e353e99a..2e5043264 100644
--- a/Source/WebCore/rendering/style/StyleCachedImage.cpp
+++ b/Source/WebCore/rendering/style/StyleCachedImage.cpp
@@ -61,7 +61,7 @@ bool StyleCachedImage::errorOccurred() const
     return m_image->errorOccurred();
 }
 
-IntSize StyleCachedImage::imageSize(const RenderObject* renderer, float multiplier) const
+LayoutSize StyleCachedImage::imageSize(const RenderObject* renderer, float multiplier) const
 {
     return m_image->imageSizeForRenderer(renderer, multiplier);
 }
diff --git a/Source/WebCore/rendering/style/StyleCachedImage.h b/Source/WebCore/rendering/style/StyleCachedImage.h
index 0943b0e67..a55b6303c 100644
--- a/Source/WebCore/rendering/style/StyleCachedImage.h
+++ b/Source/WebCore/rendering/style/StyleCachedImage.h
@@ -47,7 +47,7 @@ public:
     virtual bool canRender(const RenderObject*, float multiplier) const;
     virtual bool isLoaded() const;
     virtual bool errorOccurred() const;
-    virtual IntSize imageSize(const RenderObject*, float multiplier) const;
+    virtual LayoutSize imageSize(const RenderObject*, float multiplier) const OVERRIDE;
     virtual bool imageHasRelativeWidth() const;
     virtual bool imageHasRelativeHeight() const;
     virtual void computeIntrinsicDimensions(const RenderObject*, Length& intrinsicWidth, Length& intrinsicHeight, FloatSize& intrinsicRatio);
diff --git a/Source/WebCore/rendering/style/StyleCachedImageSet.cpp b/Source/WebCore/rendering/style/StyleCachedImageSet.cpp
index c0a9f5e2f..76a2c0951 100644
--- a/Source/WebCore/rendering/style/StyleCachedImageSet.cpp
+++ b/Source/WebCore/rendering/style/StyleCachedImageSet.cpp
@@ -69,9 +69,9 @@ bool StyleCachedImageSet::errorOccurred() const
     return m_bestFitImage->errorOccurred();
 }
 
-IntSize StyleCachedImageSet::imageSize(const RenderObject* renderer, float multiplier) const
+LayoutSize StyleCachedImageSet::imageSize(const RenderObject* renderer, float multiplier) const
 {
-    IntSize scaledImageSize = m_bestFitImage->imageSizeForRenderer(renderer, multiplier);
+    LayoutSize scaledImageSize = m_bestFitImage->imageSizeForRenderer(renderer, multiplier);
     scaledImageSize.scale(1 / m_imageScaleFactor);
     return scaledImageSize;
 }
diff --git a/Source/WebCore/rendering/style/StyleCachedImageSet.h b/Source/WebCore/rendering/style/StyleCachedImageSet.h
index 7e7cafcd2..6a2ffdb30 100644
--- a/Source/WebCore/rendering/style/StyleCachedImageSet.h
+++ b/Source/WebCore/rendering/style/StyleCachedImageSet.h
@@ -30,6 +30,7 @@
 
 #include "CachedImageClient.h"
 #include "CachedResourceHandle.h"
+#include "LayoutTypes.h"
 #include "StyleImage.h"
 
 namespace WebCore {
@@ -60,7 +61,7 @@ public:
     virtual bool canRender(const RenderObject*, float multiplier) const;
     virtual bool isLoaded() const;
     virtual bool errorOccurred() const;
-    virtual IntSize imageSize(const RenderObject*, float multiplier) const;
+    virtual LayoutSize imageSize(const RenderObject*, float multiplier) const;
     virtual bool imageHasRelativeWidth() const;
     virtual bool imageHasRelativeHeight() const;
     virtual void computeIntrinsicDimensions(const RenderObject*, Length& intrinsicWidth, Length& intrinsicHeight, FloatSize& intrinsicRatio);
diff --git a/Source/WebCore/rendering/style/StyleCustomFilterProgram.h b/Source/WebCore/rendering/style/StyleCustomFilterProgram.h
index 974024a95..ae68d954a 100644
--- a/Source/WebCore/rendering/style/StyleCustomFilterProgram.h
+++ b/Source/WebCore/rendering/style/StyleCustomFilterProgram.h
@@ -45,9 +45,9 @@ namespace WebCore {
 class StyleCustomFilterProgram : public CustomFilterProgram, public CachedResourceClient {
     WTF_MAKE_FAST_ALLOCATED;
 public:
-    static PassRefPtr<StyleCustomFilterProgram> create(PassRefPtr<StyleShader> vertexShader, PassRefPtr<StyleShader> fragmentShader, CustomFilterProgramType programType, const CustomFilterProgramMixSettings& mixSettings)
+    static PassRefPtr<StyleCustomFilterProgram> create(PassRefPtr<StyleShader> vertexShader, PassRefPtr<StyleShader> fragmentShader, CustomFilterProgramType programType, const CustomFilterProgramMixSettings& mixSettings, CustomFilterMeshType meshType)
     {
-        return adoptRef(new StyleCustomFilterProgram(vertexShader, fragmentShader, programType, mixSettings));
+        return adoptRef(new StyleCustomFilterProgram(vertexShader, fragmentShader, programType, mixSettings, meshType));
     }
     
     void setVertexShader(PassRefPtr<StyleShader> shader) { m_vertexShader = shader; }
@@ -120,14 +120,18 @@ public:
     
     virtual bool operator==(const CustomFilterProgram& o) const 
     {
+        // We don't use the != operator because that would recursively call this method.
+        if (!CustomFilterProgram::operator==(o))
+            return false;
+
         // The following cast is ugly, but StyleCustomFilterProgram is the single implementation of CustomFilterProgram.
         const StyleCustomFilterProgram* other = static_cast<const StyleCustomFilterProgram*>(&o);
         return cachedVertexShader() == other->cachedVertexShader() && cachedFragmentShader() == other->cachedFragmentShader();
     }
 
 private:
-    StyleCustomFilterProgram(PassRefPtr<StyleShader> vertexShader, PassRefPtr<StyleShader> fragmentShader, CustomFilterProgramType programType, const CustomFilterProgramMixSettings& mixSettings)
-        : CustomFilterProgram(programType, mixSettings)
+    StyleCustomFilterProgram(PassRefPtr<StyleShader> vertexShader, PassRefPtr<StyleShader> fragmentShader, CustomFilterProgramType programType, const CustomFilterProgramMixSettings& mixSettings, CustomFilterMeshType meshType)
+        : CustomFilterProgram(programType, mixSettings, meshType)
         , m_vertexShader(vertexShader)
         , m_fragmentShader(fragmentShader)
         , m_isVertexShaderLoaded(false)
diff --git a/Source/WebCore/rendering/style/StyleGeneratedImage.cpp b/Source/WebCore/rendering/style/StyleGeneratedImage.cpp
index 1a2bd3766..cd3572b55 100644
--- a/Source/WebCore/rendering/style/StyleGeneratedImage.cpp
+++ b/Source/WebCore/rendering/style/StyleGeneratedImage.cpp
@@ -42,24 +42,24 @@ PassRefPtr<CSSValue> StyleGeneratedImage::cssValue() const
     return m_imageGeneratorValue;
 }
 
-IntSize StyleGeneratedImage::imageSize(const RenderObject* renderer, float multiplier) const
+LayoutSize StyleGeneratedImage::imageSize(const RenderObject* renderer, float multiplier) const
 {
     if (m_fixedSize) {
         IntSize fixedSize = m_imageGeneratorValue->fixedSize(renderer);
         if (multiplier == 1.0f)
             return fixedSize;
 
-        int width = fixedSize.width() * multiplier;
-        int height = fixedSize.height() * multiplier;
+        LayoutUnit width = fixedSize.width() * multiplier;
+        LayoutUnit height = fixedSize.height() * multiplier;
 
         // Don't let images that have a width/height >= 1 shrink below 1 when zoomed.
         if (fixedSize.width() > 0)
-            width = max(1, width);
+            width = max<LayoutUnit>(1, width);
 
         if (fixedSize.height() > 0)
-            height = max(1, height);
+            height = max<LayoutUnit>(1, height);
 
-        return IntSize(width, height);
+        return LayoutSize(width, height);
     }
     
     return m_containerSize;
@@ -67,7 +67,8 @@ IntSize StyleGeneratedImage::imageSize(const RenderObject* renderer, float multi
 
 void StyleGeneratedImage::computeIntrinsicDimensions(const RenderObject* renderer, Length& intrinsicWidth, Length& intrinsicHeight, FloatSize& intrinsicRatio)
 {
-    IntSize size = imageSize(renderer, 1);
+    // At a zoom level of 1 the image is guaranteed to have an integer size.
+    IntSize size = flooredIntSize(imageSize(renderer, 1));
     intrinsicWidth = Length(size.width(), Fixed);
     intrinsicHeight = Length(size.height(), Fixed);
     intrinsicRatio = size;
diff --git a/Source/WebCore/rendering/style/StyleGeneratedImage.h b/Source/WebCore/rendering/style/StyleGeneratedImage.h
index d51384059..0e7a7542f 100644
--- a/Source/WebCore/rendering/style/StyleGeneratedImage.h
+++ b/Source/WebCore/rendering/style/StyleGeneratedImage.h
@@ -42,7 +42,7 @@ public:
 
     virtual PassRefPtr<CSSValue> cssValue() const;
 
-    virtual IntSize imageSize(const RenderObject*, float multiplier) const;
+    virtual LayoutSize imageSize(const RenderObject*, float multiplier) const OVERRIDE;
     virtual bool imageHasRelativeWidth() const { return !m_fixedSize; }
     virtual bool imageHasRelativeHeight() const { return !m_fixedSize; }
     virtual void computeIntrinsicDimensions(const RenderObject*, Length& intrinsicWidth, Length& intrinsicHeight, FloatSize& intrinsicRatio);
diff --git a/Source/WebCore/rendering/style/StyleImage.h b/Source/WebCore/rendering/style/StyleImage.h
index 1fc8e9759..163414408 100644
--- a/Source/WebCore/rendering/style/StyleImage.h
+++ b/Source/WebCore/rendering/style/StyleImage.h
@@ -27,6 +27,7 @@
 #include "CSSValue.h"
 #include "Image.h"
 #include "IntSize.h"
+#include "LayoutTypes.h"
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefCounted.h>
 #include <wtf/RefPtr.h>
@@ -52,7 +53,7 @@ public:
     virtual bool canRender(const RenderObject*, float /*multiplier*/) const { return true; }
     virtual bool isLoaded() const { return true; }
     virtual bool errorOccurred() const { return false; }
-    virtual IntSize imageSize(const RenderObject*, float multiplier) const = 0;
+    virtual LayoutSize imageSize(const RenderObject*, float multiplier) const = 0;
     virtual void computeIntrinsicDimensions(const RenderObject*, Length& intrinsicWidth, Length& intrinsicHeight, FloatSize& intrinsicRatio) = 0;
     virtual bool imageHasRelativeWidth() const = 0;
     virtual bool imageHasRelativeHeight() const = 0;
diff --git a/Source/WebCore/rendering/style/StylePendingImage.h b/Source/WebCore/rendering/style/StylePendingImage.h
index 6badc9238..aa3f75416 100644
--- a/Source/WebCore/rendering/style/StylePendingImage.h
+++ b/Source/WebCore/rendering/style/StylePendingImage.h
@@ -53,7 +53,7 @@ public:
     CSSImageSetValue* cssImageSetValue() const { return m_value->isImageSetValue() ? static_cast<CSSImageSetValue*>(m_value) : 0; }
 #endif
     
-    virtual IntSize imageSize(const RenderObject*, float /*multiplier*/) const { return IntSize(); }
+    virtual LayoutSize imageSize(const RenderObject*, float /*multiplier*/) const OVERRIDE { return LayoutSize(); }
     virtual bool imageHasRelativeWidth() const { return false; }
     virtual bool imageHasRelativeHeight() const { return false; }
     virtual void computeIntrinsicDimensions(const RenderObject*, Length& /* intrinsicWidth */ , Length& /* intrinsicHeight */, FloatSize& /* intrinsicRatio */) { }
diff --git a/Source/WebCore/rendering/style/StyleRareInheritedData.cpp b/Source/WebCore/rendering/style/StyleRareInheritedData.cpp
index 3962e7f6a..168022143 100644
--- a/Source/WebCore/rendering/style/StyleRareInheritedData.cpp
+++ b/Source/WebCore/rendering/style/StyleRareInheritedData.cpp
@@ -71,7 +71,7 @@ StyleRareInheritedData::StyleRareInheritedData()
     , wordBreak(RenderStyle::initialWordBreak())
     , overflowWrap(RenderStyle::initialOverflowWrap())
     , nbspMode(NBNORMAL)
-    , khtmlLineBreak(LBNORMAL)
+    , lineBreak(LineBreakAuto)
     , textSizeAdjust(RenderStyle::initialTextSizeAdjust())
     , resize(RenderStyle::initialResize())
     , userSelect(RenderStyle::initialUserSelect())
@@ -133,7 +133,7 @@ StyleRareInheritedData::StyleRareInheritedData(const StyleRareInheritedData& o)
     , wordBreak(o.wordBreak)
     , overflowWrap(o.overflowWrap)
     , nbspMode(o.nbspMode)
-    , khtmlLineBreak(o.khtmlLineBreak)
+    , lineBreak(o.lineBreak)
     , textSizeAdjust(o.textSizeAdjust)
     , resize(o.resize)
     , userSelect(o.userSelect)
@@ -214,7 +214,7 @@ bool StyleRareInheritedData::operator==(const StyleRareInheritedData& o) const
         && wordBreak == o.wordBreak
         && overflowWrap == o.overflowWrap
         && nbspMode == o.nbspMode
-        && khtmlLineBreak == o.khtmlLineBreak
+        && lineBreak == o.lineBreak
 #if ENABLE(ACCELERATED_OVERFLOW_SCROLLING)
         && useTouchOverflowScrolling == o.useTouchOverflowScrolling
 #endif
diff --git a/Source/WebCore/rendering/style/StyleRareInheritedData.h b/Source/WebCore/rendering/style/StyleRareInheritedData.h
index 27d5c9ace..a34dfb2a3 100644
--- a/Source/WebCore/rendering/style/StyleRareInheritedData.h
+++ b/Source/WebCore/rendering/style/StyleRareInheritedData.h
@@ -85,7 +85,7 @@ public:
     unsigned wordBreak : 2; // EWordBreak
     unsigned overflowWrap : 1; // EOverflowWrap
     unsigned nbspMode : 1; // ENBSPMode
-    unsigned khtmlLineBreak : 1; // EKHTMLLineBreak
+    unsigned lineBreak : 3; // LineBreak
     unsigned textSizeAdjust : 1; // An Apple extension.
     unsigned resize : 2; // EResize
     unsigned userSelect : 2; // EUserSelect
diff --git a/Source/WebCore/rendering/svg/RenderSVGContainer.h b/Source/WebCore/rendering/svg/RenderSVGContainer.h
index 335732b84..3c0fa9814 100644
--- a/Source/WebCore/rendering/svg/RenderSVGContainer.h
+++ b/Source/WebCore/rendering/svg/RenderSVGContainer.h
@@ -36,6 +36,9 @@ public:
     explicit RenderSVGContainer(SVGStyledElement*);
     virtual ~RenderSVGContainer();
 
+    RenderObject* firstChild() const { ASSERT(children() == virtualChildren()); return children()->firstChild(); }
+    RenderObject* lastChild() const { ASSERT(children() == virtualChildren()); return children()->lastChild(); }
+
     const RenderObjectChildList* children() const { return &m_children; }
     RenderObjectChildList* children() { return &m_children; }
 
diff --git a/Source/WebCore/rendering/svg/RenderSVGResourceFilter.cpp b/Source/WebCore/rendering/svg/RenderSVGResourceFilter.cpp
index 74e5b36d3..7d4eedfc9 100644
--- a/Source/WebCore/rendering/svg/RenderSVGResourceFilter.cpp
+++ b/Source/WebCore/rendering/svg/RenderSVGResourceFilter.cpp
@@ -57,25 +57,6 @@ using namespace std;
 
 namespace WebCore {
 
-class ApplyingFilterEffectGuard {
-public:
-    ApplyingFilterEffectGuard(FilterData* data)
-        : m_filterData(data)
-    {
-        // The guard must be constructed when the filter is not applying.
-        ASSERT(!m_filterData->isApplying);
-        m_filterData->isApplying = true;
-    }
-
-    ~ApplyingFilterEffectGuard()
-    {
-        ASSERT(m_filterData->isApplying);
-        m_filterData->isApplying = false;
-    }
-
-    FilterData* m_filterData;
-};
-
 RenderSVGResourceType RenderSVGResourceFilter::s_resourceType = FilterResourceType;
 
 RenderSVGResourceFilter::RenderSVGResourceFilter(SVGFilterElement* node)
@@ -108,7 +89,7 @@ void RenderSVGResourceFilter::removeClientFromCache(RenderObject* client, bool m
 
     if (FilterData* filterData = m_filter.get(client)) {
         if (filterData->savedContext)
-            filterData->markedForRemoval = true;
+            filterData->state = FilterData::MarkedForRemoval;
         else
             delete m_filter.take(client);
     }
@@ -168,14 +149,11 @@ bool RenderSVGResourceFilter::applyResource(RenderObject* object, RenderStyle*,
     ASSERT(context);
     ASSERT_UNUSED(resourceMode, resourceMode == ApplyToDefaultMode);
 
-    // Returning false here, to avoid drawings onto the context. We just want to
-    // draw the stored filter output, not the unfiltered object as well.
     if (m_filter.contains(object)) {
         FilterData* filterData = m_filter.get(object);
-        if (filterData->isBuilt || filterData->isApplying)
-            return false;
-
-        delete m_filter.take(object); // Oops, have to rebuild, go through normal code path
+        if (filterData->state == FilterData::PaintingSource || filterData->state == FilterData::Applying)
+            filterData->state = FilterData::CycleDetected;
+        return false; // Already built, or we're in a cycle, or we're marked for removal. Regardless, just do nothing more now.
     }
 
     OwnPtr<FilterData> filterData(adoptPtr(new FilterData));
@@ -292,17 +270,21 @@ void RenderSVGResourceFilter::postApplyResource(RenderObject* object, GraphicsCo
     if (!filterData)
         return;
 
-    if (filterData->markedForRemoval) {
+    switch (filterData->state) {
+    case FilterData::MarkedForRemoval:
         delete m_filter.take(object);
         return;
-    }
 
-    // We have a cycle if we are already applying the data.
-    // This can occur due to FeImage referencing a source that makes use of the FEImage itself.
-    if (filterData->isApplying)
+    case FilterData::CycleDetected:
+    case FilterData::Applying:
+        // We have a cycle if we are already applying the data.
+        // This can occur due to FeImage referencing a source that makes use of the FEImage itself.
+        // This is the first place we've hit the cycle, so set the state back to PaintingSource so the return stack
+        // will continue correctly.
+        filterData->state = FilterData::PaintingSource;
         return;
 
-    if (!filterData->isBuilt) {
+    case FilterData::PaintingSource:
         if (!filterData->savedContext) {
             removeClientFromCache(object);
             return;
@@ -310,9 +292,10 @@ void RenderSVGResourceFilter::postApplyResource(RenderObject* object, GraphicsCo
 
         context = filterData->savedContext;
         filterData->savedContext = 0;
-    }
+        break;
 
-    ApplyingFilterEffectGuard isApplyingGuard(filterData);
+    case FilterData::Built: { } // Empty
+    }
 
     FilterEffect* lastEffect = filterData->builder->lastEffect();
 
@@ -320,11 +303,12 @@ void RenderSVGResourceFilter::postApplyResource(RenderObject* object, GraphicsCo
         // This is the real filtering of the object. It just needs to be called on the
         // initial filtering process. We just take the stored filter result on a
         // second drawing.
-        if (!filterData->isBuilt)
+        if (filterData->state != FilterData::Built)
             filterData->filter->setSourceImage(filterData->sourceGraphicBuffer.release());
 
-        // Always true if filterData is just built (filterData->isBuilt is false).
+        // Always true if filterData is just built (filterData->state == FilterData::Built).
         if (!lastEffect->hasResult()) {
+            filterData->state = FilterData::Applying;
             lastEffect->apply();
             lastEffect->correctFilterResultIfNeeded();
 #if !USE(CG)
@@ -333,7 +317,7 @@ void RenderSVGResourceFilter::postApplyResource(RenderObject* object, GraphicsCo
                 resultImage->transformColorSpace(lastEffect->colorSpace(), ColorSpaceDeviceRGB);
 #endif
         }
-        filterData->isBuilt = true;
+        filterData->state = FilterData::Built;
 
         ImageBuffer* resultImage = lastEffect->asImageBuffer();
         if (resultImage) {
@@ -365,7 +349,7 @@ void RenderSVGResourceFilter::primitiveAttributeChanged(RenderObject* object, co
 
     for (; it != end; ++it) {
         FilterData* filterData = it->value;
-        if (!filterData->isBuilt)
+        if (filterData->state != FilterData::Built)
             continue;
 
         SVGFilterBuilder* builder = filterData->builder.get();
diff --git a/Source/WebCore/rendering/svg/RenderSVGResourceFilter.h b/Source/WebCore/rendering/svg/RenderSVGResourceFilter.h
index 0101bbc1e..db422c17e 100644
--- a/Source/WebCore/rendering/svg/RenderSVGResourceFilter.h
+++ b/Source/WebCore/rendering/svg/RenderSVGResourceFilter.h
@@ -42,11 +42,11 @@ namespace WebCore {
 struct FilterData {
     WTF_MAKE_FAST_ALLOCATED;
 public:
+    enum FilterDataState { PaintingSource, Applying, Built, CycleDetected, MarkedForRemoval };
+
     FilterData()
         : savedContext(0)
-        , isBuilt(false)
-        , isApplying(false)
-        , markedForRemoval(false)
+        , state(PaintingSource)
     {
     }
 
@@ -57,9 +57,7 @@ public:
     AffineTransform shearFreeAbsoluteTransform;
     FloatRect boundaries;
     FloatSize scale;
-    bool isBuilt : 1;
-    bool isApplying : 1;
-    bool markedForRemoval : 1;
+    FilterDataState state;
 };
 
 class GraphicsContext;
diff --git a/Source/WebCore/rendering/svg/RenderSVGRoot.cpp b/Source/WebCore/rendering/svg/RenderSVGRoot.cpp
index 797b70ea7..2733ae446 100644
--- a/Source/WebCore/rendering/svg/RenderSVGRoot.cpp
+++ b/Source/WebCore/rendering/svg/RenderSVGRoot.cpp
@@ -297,18 +297,22 @@ void RenderSVGRoot::paintReplaced(PaintInfo& paintInfo, const LayoutPoint& paint
     // Convert from container offsets (html renderers) to a relative transform (svg renderers).
     // Transform from our paint container's coordinate system to our local coords.
     IntPoint adjustedPaintOffset = roundedIntPoint(paintOffset);
-    childPaintInfo.applyTransform(AffineTransform::translation(adjustedPaintOffset.x() - x(), adjustedPaintOffset.y() - y()) * localToParentTransform());
+    childPaintInfo.applyTransform(AffineTransform::translation(adjustedPaintOffset.x(), adjustedPaintOffset.y()) * localToBorderBoxTransform());
+
+    // SVGRenderingContext must be destroyed before we restore the childPaintInfo.context, because a filter may have
+    // changed the context and it is only reverted when the SVGRenderingContext destructor finishes applying the filter.
+    {
+        SVGRenderingContext renderingContext;
+        bool continueRendering = true;
+        if (childPaintInfo.phase == PaintPhaseForeground) {
+            renderingContext.prepareToRenderSVGContent(this, childPaintInfo);
+            continueRendering = renderingContext.isRenderingPrepared();
+        }
 
-    SVGRenderingContext renderingContext;
-    bool continueRendering = true;
-    if (childPaintInfo.phase == PaintPhaseForeground) {
-        renderingContext.prepareToRenderSVGContent(this, childPaintInfo);
-        continueRendering = renderingContext.isRenderingPrepared();
+        if (continueRendering)
+            RenderBox::paint(childPaintInfo, LayoutPoint());
     }
 
-    if (continueRendering)
-        RenderBox::paint(childPaintInfo, LayoutPoint());
-
     childPaintInfo.context->restore();
 }
 
diff --git a/Source/WebCore/rendering/svg/RenderSVGRoot.h b/Source/WebCore/rendering/svg/RenderSVGRoot.h
index 3fadc910b..1e112a199 100644
--- a/Source/WebCore/rendering/svg/RenderSVGRoot.h
+++ b/Source/WebCore/rendering/svg/RenderSVGRoot.h
@@ -43,6 +43,10 @@ public:
     bool isEmbeddedThroughFrameContainingSVGDocument() const;
 
     virtual void computeIntrinsicRatioInformation(FloatSize& intrinsicSize, double& intrinsicRatio, bool& isPercentageIntrinsicSize) const;
+
+    RenderObject* firstChild() const { ASSERT(children() == virtualChildren()); return children()->firstChild(); }
+    RenderObject* lastChild() const { ASSERT(children() == virtualChildren()); return children()->lastChild(); }
+
     const RenderObjectChildList* children() const { return &m_children; }
     RenderObjectChildList* children() { return &m_children; }
 
diff --git a/Source/WebCore/rendering/svg/SVGTextRunRenderingContext.cpp b/Source/WebCore/rendering/svg/SVGTextRunRenderingContext.cpp
index 066ba31af..7341e69cd 100644
--- a/Source/WebCore/rendering/svg/SVGTextRunRenderingContext.cpp
+++ b/Source/WebCore/rendering/svg/SVGTextRunRenderingContext.cpp
@@ -188,6 +188,12 @@ GlyphData SVGTextRunRenderingContext::glyphDataForCharacter(const Font& font, co
         return glyphData;
     }
 
+    // Save data fromt he font fallback list because we may modify it later. Do this before the
+    // potential change to glyphData.fontData below.
+    FontFallbackList* fontList = font.fontList();
+    ASSERT(fontList);
+    FontFallbackList::GlyphPagesStateSaver glyphPagesSaver(*fontList);
+
     // Characters enclosed by an <altGlyph> element, may not be registered in the GlyphPage.
     const SimpleFontData* originalFontData = glyphData.fontData;
     if (glyphData.fontData && !glyphData.fontData->isSVGFont()) {
@@ -225,14 +231,9 @@ GlyphData SVGTextRunRenderingContext::glyphDataForCharacter(const Font& font, co
     GlyphPage* page = pair.second;
     ASSERT(page);
 
-    FontFallbackList* fontList = font.fontList();
-    ASSERT(fontList);
-
     // No suitable glyph found that is compatible with the requirments (same language, arabic-form, orientation etc.)
     // Even though our GlyphPage contains an entry for eg. glyph "a", it's not compatible. So we have to temporarily
     // remove the glyph data information from the GlyphPage, and retry the lookup, which handles font fallbacks correctly.
-    GlyphPageTreeNode* originalGlyphPageZero = fontList->glyphPageZero();
-    const FontFallbackList::GlyphPages& originalGlyphPages = fontList->glyphPages();
     page->setGlyphDataForCharacter(character, glyphData.glyph, 0);
 
     // Assure that the font fallback glyph selection worked, aka. the fallbackGlyphData font data is not the same as before.
@@ -242,8 +243,6 @@ GlyphData SVGTextRunRenderingContext::glyphDataForCharacter(const Font& font, co
     // Restore original state of the SVG Font glyph table and the current font fallback list,
     // to assure the next lookup of the same glyph won't immediately return the fallback glyph.
     page->setGlyphDataForCharacter(character, glyphData.glyph, originalFontData);
-    fontList->setGlyphPageZero(originalGlyphPageZero);
-    fontList->setGlyphPages(originalGlyphPages);
     ASSERT(fallbackGlyphData.fontData);
     return fallbackGlyphData;
 }
diff --git a/Source/WebCore/svg/SVGAnimateMotionElement.cpp b/Source/WebCore/svg/SVGAnimateMotionElement.cpp
index 544ce9663..f2e4a8a35 100644
--- a/Source/WebCore/svg/SVGAnimateMotionElement.cpp
+++ b/Source/WebCore/svg/SVGAnimateMotionElement.cpp
@@ -46,6 +46,7 @@ inline SVGAnimateMotionElement::SVGAnimateMotionElement(const QualifiedName& tag
     : SVGAnimationElement(tagName, document)
     , m_hasToPointAtEndOfDuration(false)
 {
+    setCalcMode(CalcModePaced);
     ASSERT(hasTagName(animateMotionTag));
 }
 
@@ -111,6 +112,7 @@ void SVGAnimateMotionElement::parseAttribute(const Attribute& attribute)
     if (attribute.name() == SVGNames::pathAttr) {
         m_path = Path();
         buildPathFromString(attribute.value(), m_path);
+        updateAnimationPath();
         return;
     }
 
@@ -129,21 +131,27 @@ SVGAnimateMotionElement::RotateMode SVGAnimateMotionElement::rotateMode() const
     return RotateAngle;
 }
 
-Path SVGAnimateMotionElement::animationPath() const
+void SVGAnimateMotionElement::updateAnimationPath()
 {
+    m_animationPath = Path();
+    bool foundMPath = false;
+
     for (Node* child = firstChild(); child; child = child->nextSibling()) {
         if (child->hasTagName(SVGNames::mpathTag)) {
             SVGMPathElement* mPath = static_cast<SVGMPathElement*>(child);
             SVGPathElement* pathElement = mPath->pathElement();
-            Path path;
-            if (pathElement)
-                updatePathFromGraphicsElement(pathElement, path);
-            return path;
+            if (pathElement) {
+                updatePathFromGraphicsElement(pathElement, m_animationPath);
+                foundMPath = true;
+                break;
+            }
         }
     }
-    if (fastHasAttribute(SVGNames::pathAttr))
-        return m_path;
-    return Path();
+
+    if (!foundMPath && fastHasAttribute(SVGNames::pathAttr))
+        m_animationPath = m_path;
+
+    updateAnimationMode();
 }
 
 static bool parsePoint(const String& s, FloatPoint& point)
@@ -218,19 +226,18 @@ bool SVGAnimateMotionElement::calculateFromAndByValues(const String& fromString,
 
 void SVGAnimateMotionElement::buildTransformForProgress(AffineTransform* transform, float percentage)
 {
-    Path path = animationPath();
-    ASSERT(!path.isEmpty());
+    ASSERT(!m_animationPath.isEmpty());
 
     bool ok = false;
-    float positionOnPath = path.length() * percentage;
-    FloatPoint position = path.pointAtLength(positionOnPath, ok);
+    float positionOnPath = m_animationPath.length() * percentage;
+    FloatPoint position = m_animationPath.pointAtLength(positionOnPath, ok);
     if (!ok)
         return;
     transform->translate(position.x(), position.y());
     RotateMode rotateMode = this->rotateMode();
     if (rotateMode != RotateAuto && rotateMode != RotateAutoReverse)
         return;
-    float angle = path.normalAngleAtLength(positionOnPath, ok);
+    float angle = m_animationPath.normalAngleAtLength(positionOnPath, ok);
     if (rotateMode == RotateAutoReverse)
         angle += 180;
     transform->rotate(angle);
@@ -318,5 +325,13 @@ float SVGAnimateMotionElement::calculateDistance(const String& fromString, const
     return sqrtf(diff.width() * diff.width() + diff.height() * diff.height());
 }
 
+void SVGAnimateMotionElement::updateAnimationMode()
+{
+    if (!m_animationPath.isEmpty())
+        setAnimationMode(PathAnimation);
+    else
+        SVGAnimationElement::updateAnimationMode();
+}
+
 }
 #endif // ENABLE(SVG)
diff --git a/Source/WebCore/svg/SVGAnimateMotionElement.h b/Source/WebCore/svg/SVGAnimateMotionElement.h
index a9e3ca465..67507e4d5 100644
--- a/Source/WebCore/svg/SVGAnimateMotionElement.h
+++ b/Source/WebCore/svg/SVGAnimateMotionElement.h
@@ -30,6 +30,7 @@ namespace WebCore {
 class SVGAnimateMotionElement : public SVGAnimationElement {
 public:
     static PassRefPtr<SVGAnimateMotionElement> create(const QualifiedName&, Document*);
+    void updateAnimationPath();
 
 private:
     SVGAnimateMotionElement(const QualifiedName&, Document*);
@@ -48,7 +49,6 @@ private:
     virtual void calculateAnimatedValue(float percentage, unsigned repeatCount, SVGSMILElement* resultElement);
     virtual void applyResultsToTarget();
     virtual float calculateDistance(const String& fromString, const String& toString);
-    virtual Path animationPath() const;
 
     enum RotateMode {
         RotateAngle,
@@ -60,12 +60,15 @@ private:
 
     bool m_hasToPointAtEndOfDuration;
 
+    virtual void updateAnimationMode() OVERRIDE;
+
     // Note: we do not support percentage values for to/from coords as the spec implies we should (opera doesn't either)
     FloatPoint m_fromPoint;
     FloatPoint m_toPoint;
     FloatPoint m_toPointAtEndOfDuration;
 
     Path m_path;
+    Path m_animationPath;
 };
     
 } // namespace WebCore
diff --git a/Source/WebCore/svg/SVGAnimationElement.cpp b/Source/WebCore/svg/SVGAnimationElement.cpp
index bbaadbb07..8edf81843 100644
--- a/Source/WebCore/svg/SVGAnimationElement.cpp
+++ b/Source/WebCore/svg/SVGAnimationElement.cpp
@@ -39,6 +39,7 @@
 #include "SVGNames.h"
 #include "SVGParserUtilities.h"
 #include "SVGStyledElement.h"
+#include <wtf/MathExtras.h>
 
 namespace WebCore {
 
@@ -57,6 +58,8 @@ SVGAnimationElement::SVGAnimationElement(const QualifiedName& tagName, Document*
     , m_animationValid(false)
     , m_attributeType(AttributeTypeAuto)
     , m_hasInvalidCSSAttributeType(false)
+    , m_calcMode(CalcModeLinear)
+    , m_animationMode(NoAnimation)
 {
     registerAnimatedPropertiesForSVGAnimationElement();
 }
@@ -148,6 +151,10 @@ bool SVGAnimationElement::isSupportedAttribute(const QualifiedName& attrName)
         supportedAttributes.add(SVGNames::keyPointsAttr);
         supportedAttributes.add(SVGNames::keySplinesAttr);
         supportedAttributes.add(SVGNames::attributeTypeAttr);
+        supportedAttributes.add(SVGNames::calcModeAttr);
+        supportedAttributes.add(SVGNames::fromAttr);
+        supportedAttributes.add(SVGNames::toAttr);
+        supportedAttributes.add(SVGNames::byAttr);
     }
     return supportedAttributes.contains<QualifiedName, SVGAttributeHashTranslator>(attrName);
 }
@@ -166,6 +173,8 @@ void SVGAnimationElement::parseAttribute(const Attribute& attribute)
         attribute.value().string().split(';', m_values);
         for (unsigned i = 0; i < m_values.size(); ++i)
             m_values[i] = m_values[i].stripWhiteSpace();
+
+        updateAnimationMode();
         return;
     }
 
@@ -193,6 +202,16 @@ void SVGAnimationElement::parseAttribute(const Attribute& attribute)
         return;
     }
 
+    if (attribute.name() == SVGNames::calcModeAttr) {
+        setCalcMode(attribute.value());
+        return;
+    }
+
+    if (attribute.name() == SVGNames::fromAttr || attribute.name() == SVGNames::toAttr || attribute.name() == SVGNames::byAttr) {
+        updateAnimationMode();
+        return;
+    }
+
     if (SVGTests::parseAttribute(attribute))
         return;
     if (SVGExternalResourcesRequired::parseAttribute(attribute))
@@ -240,6 +259,8 @@ void SVGAnimationElement::beginElement()
 
 void SVGAnimationElement::beginElementAt(float offset)
 {
+    if (isnan(offset))
+        return;
     SMILTime elapsed = this->elapsed();
     addBeginTime(elapsed, elapsed + offset, SMILTimeWithOrigin::ScriptOrigin);
 }
@@ -251,42 +272,41 @@ void SVGAnimationElement::endElement()
 
 void SVGAnimationElement::endElementAt(float offset)
 {
+    if (isnan(offset))
+        return;
     SMILTime elapsed = this->elapsed();
     addEndTime(elapsed, elapsed + offset, SMILTimeWithOrigin::ScriptOrigin);
 }
 
-AnimationMode SVGAnimationElement::animationMode() const
+void SVGAnimationElement::updateAnimationMode()
 {
     // http://www.w3.org/TR/2001/REC-smil-animation-20010904/#AnimFuncValues
-    if (hasTagName(SVGNames::setTag))
-        return ToAnimation;
-    if (!animationPath().isEmpty())
-        return PathAnimation;
     if (hasAttribute(SVGNames::valuesAttr))
-        return ValuesAnimation;
-    if (!toValue().isEmpty())
-        return fromValue().isEmpty() ? ToAnimation : FromToAnimation;
-    if (!byValue().isEmpty())
-        return fromValue().isEmpty() ? ByAnimation : FromByAnimation;
-    return NoAnimation;
+        setAnimationMode(ValuesAnimation);
+    else if (!toValue().isEmpty())
+        setAnimationMode(fromValue().isEmpty() ? ToAnimation : FromToAnimation);
+    else if (!byValue().isEmpty())
+        setAnimationMode(fromValue().isEmpty() ? ByAnimation : FromByAnimation);
+    else
+        setAnimationMode(NoAnimation);
 }
 
-CalcMode SVGAnimationElement::calcMode() const
-{    
+void SVGAnimationElement::setCalcMode(const AtomicString& calcMode)
+{
     DEFINE_STATIC_LOCAL(const AtomicString, discrete, ("discrete"));
     DEFINE_STATIC_LOCAL(const AtomicString, linear, ("linear"));
     DEFINE_STATIC_LOCAL(const AtomicString, paced, ("paced"));
     DEFINE_STATIC_LOCAL(const AtomicString, spline, ("spline"));
-    const AtomicString& value = fastGetAttribute(SVGNames::calcModeAttr);
-    if (value == discrete)
-        return CalcModeDiscrete;
-    if (value == linear)
-        return CalcModeLinear;
-    if (value == paced)
-        return CalcModePaced;
-    if (value == spline)
-        return CalcModeSpline;
-    return hasTagName(SVGNames::animateMotionTag) ? CalcModePaced : CalcModeLinear;
+    if (calcMode == discrete)
+        setCalcMode(CalcModeDiscrete);
+    else if (calcMode == linear)
+        setCalcMode(CalcModeLinear);
+    else if (calcMode == paced)
+        setCalcMode(CalcModePaced);
+    else if (calcMode == spline)
+        setCalcMode(CalcModeSpline);
+    else
+        setCalcMode(hasTagName(SVGNames::animateMotionTag) ? CalcModePaced : CalcModeLinear);
 }
 
 void SVGAnimationElement::setAttributeType(const AtomicString& attributeType)
diff --git a/Source/WebCore/svg/SVGAnimationElement.h b/Source/WebCore/svg/SVGAnimationElement.h
index ec5b2faa2..88a335eec 100644
--- a/Source/WebCore/svg/SVGAnimationElement.h
+++ b/Source/WebCore/svg/SVGAnimationElement.h
@@ -27,7 +27,6 @@
 
 #if ENABLE(SVG)
 #include "ElementTimeControl.h"
-#include "Path.h"
 #include "SMILTime.h"
 #include "SVGAnimatedBoolean.h"
 #include "SVGExternalResourcesRequired.h"
@@ -87,8 +86,8 @@ public:
 
     virtual bool isAdditive() const;
     bool isAccumulated() const;
-    AnimationMode animationMode() const;
-    CalcMode calcMode() const;
+    AnimationMode animationMode() const { return m_animationMode; }
+    CalcMode calcMode() const { return m_calcMode; }
 
     enum ShouldApplyAnimation {
         DontApplyAnimation,
@@ -201,6 +200,10 @@ protected:
     virtual void targetElementWillChange(SVGElement* currentTarget, SVGElement* oldTarget) OVERRIDE;
     bool hasInvalidCSSAttributeType() const { return m_hasInvalidCSSAttributeType; }
 
+    virtual void updateAnimationMode();
+    void setAnimationMode(AnimationMode animationMode) { m_animationMode = animationMode; }
+    void setCalcMode(CalcMode calcMode) { m_calcMode = calcMode; }
+
 private:
     virtual void animationAttributeChanged() OVERRIDE;
     virtual void setAttributeName(const QualifiedName&) OVERRIDE;
@@ -213,7 +216,6 @@ private:
     virtual bool calculateFromAndByValues(const String& fromString, const String& byString) = 0;
     virtual void calculateAnimatedValue(float percent, unsigned repeatCount, SVGSMILElement* resultElement) = 0;
     virtual float calculateDistance(const String& /*fromString*/, const String& /*toString*/) { return -1.f; }
-    virtual Path animationPath() const { return Path(); }
 
     void currentValuesForValuesAnimation(float percent, float& effectivePercent, String& from, String& to);
     void calculateKeyTimesForCalcModePaced();
@@ -235,6 +237,8 @@ private:
     virtual void synchronizeRequiredExtensions() { SVGTests::synchronizeRequiredExtensions(this); }
     virtual void synchronizeSystemLanguage() { SVGTests::synchronizeSystemLanguage(this); }
 
+    void setCalcMode(const AtomicString&);
+
     bool m_animationValid;
 
     AttributeType m_attributeType;
@@ -245,6 +249,8 @@ private:
     String m_lastValuesAnimationFrom;
     String m_lastValuesAnimationTo;
     bool m_hasInvalidCSSAttributeType;
+    CalcMode m_calcMode;
+    AnimationMode m_animationMode;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/svg/SVGDocumentExtensions.cpp b/Source/WebCore/svg/SVGDocumentExtensions.cpp
index ccb6323e4..db0eb72b7 100644
--- a/Source/WebCore/svg/SVGDocumentExtensions.cpp
+++ b/Source/WebCore/svg/SVGDocumentExtensions.cpp
@@ -210,7 +210,7 @@ void SVGDocumentExtensions::reportError(const String& message)
     reportMessage(m_document, ErrorMessageLevel, "Error: " + message);
 }
 
-void SVGDocumentExtensions::addPendingResource(const AtomicString& id, SVGStyledElement* element)
+void SVGDocumentExtensions::addPendingResource(const AtomicString& id, SVGElement* element)
 {
     ASSERT(element);
 
@@ -237,7 +237,7 @@ bool SVGDocumentExtensions::hasPendingResource(const AtomicString& id) const
     return m_pendingResources.contains(id);
 }
 
-bool SVGDocumentExtensions::isElementPendingResources(SVGStyledElement* element) const
+bool SVGDocumentExtensions::isElementPendingResources(SVGElement* element) const
 {
     // This algorithm takes time proportional to the number of pending resources and need not.
     // If performance becomes an issue we can keep a counted set of elements and answer the question efficiently.
@@ -255,7 +255,7 @@ bool SVGDocumentExtensions::isElementPendingResources(SVGStyledElement* element)
     return false;
 }
 
-bool SVGDocumentExtensions::isElementPendingResource(SVGStyledElement* element, const AtomicString& id) const
+bool SVGDocumentExtensions::isElementPendingResource(SVGElement* element, const AtomicString& id) const
 {
     ASSERT(element);
 
@@ -265,7 +265,7 @@ bool SVGDocumentExtensions::isElementPendingResource(SVGStyledElement* element,
     return m_pendingResources.get(id)->contains(element);
 }
 
-void SVGDocumentExtensions::removeElementFromPendingResources(SVGStyledElement* element)
+void SVGDocumentExtensions::removeElementFromPendingResources(SVGElement* element)
 {
     ASSERT(element);
 
@@ -336,7 +336,7 @@ void SVGDocumentExtensions::markPendingResourcesForRemoval(const AtomicString& i
         m_pendingResourcesForRemoval.add(id, existing);
 }
 
-SVGStyledElement* SVGDocumentExtensions::removeElementFromPendingResourcesForRemoval(const AtomicString& id)
+SVGElement* SVGDocumentExtensions::removeElementFromPendingResourcesForRemoval(const AtomicString& id)
 {
     if (id.isEmpty())
         return 0;
@@ -346,7 +346,7 @@ SVGStyledElement* SVGDocumentExtensions::removeElementFromPendingResourcesForRem
         return 0;
 
     SVGPendingElements::iterator firstElement = resourceSet->begin();
-    SVGStyledElement* element = *firstElement;
+    SVGElement* element = *firstElement;
 
     resourceSet->remove(firstElement);
 
diff --git a/Source/WebCore/svg/SVGDocumentExtensions.h b/Source/WebCore/svg/SVGDocumentExtensions.h
index 3fe83e337..b4455c529 100644
--- a/Source/WebCore/svg/SVGDocumentExtensions.h
+++ b/Source/WebCore/svg/SVGDocumentExtensions.h
@@ -40,12 +40,11 @@ class SVGFontFaceElement;
 class SVGResourcesCache;
 class SVGSMILElement;
 class SVGSVGElement;
-class SVGStyledElement;
 
 class SVGDocumentExtensions {
     WTF_MAKE_NONCOPYABLE(SVGDocumentExtensions); WTF_MAKE_FAST_ALLOCATED;
 public:
-    typedef HashSet<SVGStyledElement*> SVGPendingElements;
+    typedef HashSet<SVGElement*> SVGPendingElements;
     SVGDocumentExtensions(Document*);
     ~SVGDocumentExtensions();
     
@@ -97,17 +96,17 @@ private:
 public:
     // This HashMap contains a list of pending resources. Pending resources, are such
     // which are referenced by any object in the SVG document, but do NOT exist yet.
-    // For instance, dynamically build gradients / patterns / clippers...
-    void addPendingResource(const AtomicString& id, SVGStyledElement*);
+    // For instance, dynamically built gradients / patterns / clippers...
+    void addPendingResource(const AtomicString& id, SVGElement*);
     bool hasPendingResource(const AtomicString& id) const;
-    bool isElementPendingResources(SVGStyledElement*) const;
-    bool isElementPendingResource(SVGStyledElement*, const AtomicString& id) const;
-    void removeElementFromPendingResources(SVGStyledElement*);
+    bool isElementPendingResources(SVGElement*) const;
+    bool isElementPendingResource(SVGElement*, const AtomicString& id) const;
+    void removeElementFromPendingResources(SVGElement*);
     PassOwnPtr<SVGPendingElements> removePendingResource(const AtomicString& id);
 
     // The following two functions are used for scheduling a pending resource to be removed.
     void markPendingResourcesForRemoval(const AtomicString&);
-    SVGStyledElement* removeElementFromPendingResourcesForRemoval(const AtomicString&);
+    SVGElement* removeElementFromPendingResourcesForRemoval(const AtomicString&);
 
 private:
     PassOwnPtr<SVGPendingElements> removePendingResourceForRemoval(const AtomicString&);
diff --git a/Source/WebCore/svg/SVGElement.cpp b/Source/WebCore/svg/SVGElement.cpp
index a110f5e75..6382f71b0 100644
--- a/Source/WebCore/svg/SVGElement.cpp
+++ b/Source/WebCore/svg/SVGElement.cpp
@@ -64,6 +64,10 @@ SVGElement::~SVGElement()
     if (!hasSVGRareData())
         ASSERT(!SVGElementRareData::rareDataMap().contains(this));
     else {
+        ASSERT(document());
+        if (hasPendingResources())
+            document()->accessSVGExtensions()->removeElementFromPendingResources(this);
+        ASSERT(!hasPendingResources());
         SVGElementRareData::SVGElementRareDataMap& rareDataMap = SVGElementRareData::rareDataMap();
         SVGElementRareData::SVGElementRareDataMap::iterator it = rareDataMap.find(this);
         ASSERT(it != rareDataMap.end());
@@ -78,6 +82,7 @@ SVGElement::~SVGElement()
         delete rareData;
         rareDataMap.remove(it);
     }
+    ASSERT(document());
     document()->accessSVGExtensions()->removeAllAnimationElementsFromTarget(this);
     document()->accessSVGExtensions()->removeAllElementReferencesForTarget(this);
 }
@@ -180,6 +185,7 @@ void SVGElement::removedFrom(ContainerNode* rootParent)
     if (wasInDocument) {
         document()->accessSVGExtensions()->removeAllAnimationElementsFromTarget(this);
         document()->accessSVGExtensions()->removeAllElementReferencesForTarget(this);
+        document()->accessSVGExtensions()->removeElementFromPendingResources(this);
     }
 }
 
@@ -550,6 +556,22 @@ void SVGElement::attributeChanged(const QualifiedName& name, const AtomicString&
         svgAttributeChanged(name);
 }
 
+bool SVGElement::hasPendingResources() const
+{
+    return hasSVGRareData() && svgRareData()->hasPendingResources();
+}
+
+void SVGElement::setHasPendingResources()
+{
+    ensureSVGRareData()->setHasPendingResources(true);
+}
+
+void SVGElement::clearHasPendingResourcesIfPossible()
+{
+    if (!document()->accessSVGExtensions()->isElementPendingResources(this))
+        ensureSVGRareData()->setHasPendingResources(false);
+}
+
 void SVGElement::updateAnimatedSVGAttribute(const QualifiedName& name) const
 {
     if (isSynchronizingSVGAttributes() || areSVGAttributesValid())
diff --git a/Source/WebCore/svg/SVGElement.h b/Source/WebCore/svg/SVGElement.h
index 5720c356a..c52e52a3b 100644
--- a/Source/WebCore/svg/SVGElement.h
+++ b/Source/WebCore/svg/SVGElement.h
@@ -70,6 +70,11 @@ public:
 
     virtual void svgAttributeChanged(const QualifiedName&) { }
 
+    bool hasPendingResources() const;
+    void setHasPendingResources();
+    void clearHasPendingResourcesIfPossible();
+    virtual void buildPendingResource() { }
+
     virtual void animatedPropertyTypeForAttribute(const QualifiedName&, Vector<AnimatedPropertyType>&);
 
     void sendSVGLoadEventIfPossible(bool sendParentLoadEvents = false);
diff --git a/Source/WebCore/svg/SVGFontFaceElement.cpp b/Source/WebCore/svg/SVGFontFaceElement.cpp
index 7c676485f..249ebcecc 100644
--- a/Source/WebCore/svg/SVGFontFaceElement.cpp
+++ b/Source/WebCore/svg/SVGFontFaceElement.cpp
@@ -27,7 +27,6 @@
 #include "Attribute.h"
 #include "CSSFontFaceSrcValue.h"
 #include "CSSParser.h"
-#include "CSSProperty.h"
 #include "CSSPropertyNames.h"
 #include "CSSStyleSheet.h"
 #include "CSSValueKeywords.h"
diff --git a/Source/WebCore/svg/SVGForeignObjectElement.cpp b/Source/WebCore/svg/SVGForeignObjectElement.cpp
index f2376aff2..d4f2a828f 100644
--- a/Source/WebCore/svg/SVGForeignObjectElement.cpp
+++ b/Source/WebCore/svg/SVGForeignObjectElement.cpp
@@ -148,6 +148,24 @@ bool SVGForeignObjectElement::childShouldCreateRenderer(const NodeRenderingConte
     return StyledElement::childShouldCreateRenderer(childContext);
 }
 
+bool SVGForeignObjectElement::rendererIsNeeded(const NodeRenderingContext& context)
+{
+    // Suppress foreignObject renderers in SVG hidden containers.
+    // (https://bugs.webkit.org/show_bug.cgi?id=87297)
+    // Note that we currently do not support foreignObject instantiation via <use>, hence it is safe
+    // to use parentElement() here. If that changes, this method should be updated to use
+    // parentOrHostElement() instead.
+    Element* ancestor = parentElement();
+    while (ancestor && ancestor->isSVGElement()) {
+        if (ancestor->renderer() && ancestor->renderer()->isSVGHiddenContainer())
+            return false;
+
+        ancestor = ancestor->parentElement();
+    }
+
+    return SVGStyledTransformableElement::rendererIsNeeded(context);
+}
+
 bool SVGForeignObjectElement::selfHasRelativeLengths() const
 {
     return x().isRelative()
diff --git a/Source/WebCore/svg/SVGForeignObjectElement.h b/Source/WebCore/svg/SVGForeignObjectElement.h
index be23dd3b3..4a2519534 100644
--- a/Source/WebCore/svg/SVGForeignObjectElement.h
+++ b/Source/WebCore/svg/SVGForeignObjectElement.h
@@ -46,6 +46,7 @@ private:
     virtual void parseAttribute(const Attribute&) OVERRIDE;
     virtual void svgAttributeChanged(const QualifiedName&);
 
+    virtual bool rendererIsNeeded(const NodeRenderingContext&) OVERRIDE;
     virtual bool childShouldCreateRenderer(const NodeRenderingContext&) const;
     virtual RenderObject* createRenderer(RenderArena* arena, RenderStyle* style);
 
diff --git a/Source/WebCore/svg/SVGMPathElement.cpp b/Source/WebCore/svg/SVGMPathElement.cpp
index 71056de34..b67fb85ee 100644
--- a/Source/WebCore/svg/SVGMPathElement.cpp
+++ b/Source/WebCore/svg/SVGMPathElement.cpp
@@ -23,6 +23,7 @@
 #include "SVGMPathElement.h"
 
 #include "Document.h"
+#include "SVGAnimateMotionElement.h"
 #include "SVGNames.h"
 #include "SVGPathElement.h"
 
@@ -49,6 +50,53 @@ PassRefPtr<SVGMPathElement> SVGMPathElement::create(const QualifiedName& tagName
     return adoptRef(new SVGMPathElement(tagName, document));
 }
 
+void SVGMPathElement::buildPendingResource()
+{
+    clearResourceReferences();
+    if (!inDocument())
+        return;
+
+    String id;
+    Element* target = SVGURIReference::targetElementFromIRIString(href(), document(), &id);
+    if (!target) {
+        if (hasPendingResources())
+            return;
+
+        if (!id.isEmpty()) {
+            document()->accessSVGExtensions()->addPendingResource(id, this);
+            ASSERT(hasPendingResources());
+        }
+    } else if (target->isSVGElement()) {
+        // Register us with the target in the dependencies map. Any change of hrefElement
+        // that leads to relayout/repainting now informs us, so we can react to it.
+        document()->accessSVGExtensions()->addElementReferencingTarget(this, static_cast<SVGElement*>(target));
+    }
+
+    targetPathChanged();
+}
+
+void SVGMPathElement::clearResourceReferences()
+{
+    ASSERT(document());
+    document()->accessSVGExtensions()->removeAllTargetReferencesForElement(this);
+}
+
+Node::InsertionNotificationRequest SVGMPathElement::insertedInto(ContainerNode* rootParent)
+{
+    SVGElement::insertedInto(rootParent);
+    if (rootParent->inDocument())
+        buildPendingResource();
+    return InsertionDone;
+}
+
+void SVGMPathElement::removedFrom(ContainerNode* rootParent)
+{
+    SVGElement::removedFrom(rootParent);
+    notifyParentOfPathChange(rootParent);
+    if (rootParent->inDocument())
+        clearResourceReferences();
+}
+
 bool SVGMPathElement::isSupportedAttribute(const QualifiedName& attrName)
 {
     DEFINE_STATIC_LOCAL(HashSet<QualifiedName>, supportedAttributes, ());
@@ -74,6 +122,26 @@ void SVGMPathElement::parseAttribute(const Attribute& attribute)
     ASSERT_NOT_REACHED();
 }
 
+void SVGMPathElement::svgAttributeChanged(const QualifiedName& attrName)
+{
+    if (!isSupportedAttribute(attrName)) {
+        SVGElement::svgAttributeChanged(attrName);
+        return;
+    }
+
+    SVGElementInstance::InvalidationGuard invalidationGuard(this);
+
+    if (SVGURIReference::isKnownAttribute(attrName)) {
+        buildPendingResource();
+        return;
+    }
+
+    if (SVGExternalResourcesRequired::isKnownAttribute(attrName))
+        return;
+
+    ASSERT_NOT_REACHED();
+}
+
 SVGPathElement* SVGMPathElement::pathElement()
 {
     Element* target = targetElementFromIRIString(href(), document());
@@ -82,6 +150,17 @@ SVGPathElement* SVGMPathElement::pathElement()
     return 0;
 }
 
+void SVGMPathElement::targetPathChanged()
+{
+    notifyParentOfPathChange(parentNode());
+}
+
+void SVGMPathElement::notifyParentOfPathChange(ContainerNode* parent)
+{
+    if (parent && parent->hasTagName(SVGNames::animateMotionTag))
+        static_cast<SVGAnimateMotionElement*>(parent)->updateAnimationPath();
+}
+
 } // namespace WebCore
 
 #endif // ENABLE(SVG)
diff --git a/Source/WebCore/svg/SVGMPathElement.h b/Source/WebCore/svg/SVGMPathElement.h
index 8a9815c87..8723ec139 100644
--- a/Source/WebCore/svg/SVGMPathElement.h
+++ b/Source/WebCore/svg/SVGMPathElement.h
@@ -23,6 +23,7 @@
 #if ENABLE(SVG)
 #include "SVGAnimatedBoolean.h"
 #include "SVGAnimatedString.h"
+#include "SVGDocumentExtensions.h"
 #include "SVGExternalResourcesRequired.h"
 #include "SVGURIReference.h"
 
@@ -37,13 +38,22 @@ public:
     static PassRefPtr<SVGMPathElement> create(const QualifiedName&, Document*);
 
     SVGPathElement* pathElement();
-    
+
+    void targetPathChanged();
+
 private:
     SVGMPathElement(const QualifiedName&, Document*);
 
-    // FIXME: svgAttributeChanged missing.
+    void buildPendingResource();
+    void clearResourceReferences();
+    virtual InsertionNotificationRequest insertedInto(ContainerNode*) OVERRIDE;
+    void removedFrom(ContainerNode*);
+
     bool isSupportedAttribute(const QualifiedName&);
     virtual void parseAttribute(const Attribute&) OVERRIDE;
+    virtual void svgAttributeChanged(const QualifiedName&) OVERRIDE;
+
+    void notifyParentOfPathChange(ContainerNode*);
 
     BEGIN_DECLARE_ANIMATED_PROPERTIES(SVGMPathElement)
         DECLARE_ANIMATED_STRING(Href, href)
diff --git a/Source/WebCore/svg/SVGPathElement.cpp b/Source/WebCore/svg/SVGPathElement.cpp
index 04e25ea68..c56692b29 100644
--- a/Source/WebCore/svg/SVGPathElement.cpp
+++ b/Source/WebCore/svg/SVGPathElement.cpp
@@ -27,6 +27,7 @@
 #include "RenderSVGPath.h"
 #include "RenderSVGResource.h"
 #include "SVGElementInstance.h"
+#include "SVGMPathElement.h"
 #include "SVGNames.h"
 #include "SVGPathSegArc.h"
 #include "SVGPathSegClosePath.h"
@@ -270,12 +271,41 @@ void SVGPathElement::svgAttributeChanged(const QualifiedName& attrName)
 
         if (renderer)
             renderer->setNeedsShapeUpdate();
+
+        invalidateMPathDependencies();
     }
 
     if (renderer)
         RenderSVGResource::markForLayoutAndParentResourceInvalidation(renderer);
 }
 
+void SVGPathElement::invalidateMPathDependencies()
+{
+    // <mpath> can only reference <path> but this dependency is not handled in
+    // markForLayoutAndParentResourceInvalidation so we update any mpath dependencies manually.
+    ASSERT(document());
+    if (HashSet<SVGElement*>* dependencies = document()->accessSVGExtensions()->setOfElementsReferencingTarget(this)) {
+        HashSet<SVGElement*>::iterator end = dependencies->end();
+        for (HashSet<SVGElement*>::iterator it = dependencies->begin(); it != end; ++it) {
+            if ((*it)->hasTagName(SVGNames::mpathTag))
+                static_cast<SVGMPathElement*>(*it)->targetPathChanged();
+        }
+    }
+}
+
+Node::InsertionNotificationRequest SVGPathElement::insertedInto(ContainerNode* rootParent)
+{
+    SVGStyledTransformableElement::insertedInto(rootParent);
+    invalidateMPathDependencies();
+    return InsertionDone;
+}
+
+void SVGPathElement::removedFrom(ContainerNode* rootParent)
+{
+    SVGStyledTransformableElement::removedFrom(rootParent);
+    invalidateMPathDependencies();
+}
+
 SVGPathByteStream* SVGPathElement::pathByteStream() const
 {
     SVGAnimatedProperty* property = SVGAnimatedProperty::lookupWrapper<SVGPathElement, SVGAnimatedPathSegListPropertyTearOff>(this, dPropertyInfo());
diff --git a/Source/WebCore/svg/SVGPathElement.h b/Source/WebCore/svg/SVGPathElement.h
index 2bda9497f..f14059a4e 100644
--- a/Source/WebCore/svg/SVGPathElement.h
+++ b/Source/WebCore/svg/SVGPathElement.h
@@ -128,6 +128,11 @@ private:
 
     RenderObject* createRenderer(RenderArena*, RenderStyle*);
 
+    virtual Node::InsertionNotificationRequest insertedInto(ContainerNode*) OVERRIDE;
+    virtual void removedFrom(ContainerNode*) OVERRIDE;
+
+    void invalidateMPathDependencies();
+
 private:
     OwnPtr<SVGPathByteStream> m_pathByteStream;
     mutable SVGSynchronizableAnimatedProperty<SVGPathSegList> m_pathSegList;
diff --git a/Source/WebCore/svg/SVGSetElement.cpp b/Source/WebCore/svg/SVGSetElement.cpp
index 5f1137795..78d83250b 100644
--- a/Source/WebCore/svg/SVGSetElement.cpp
+++ b/Source/WebCore/svg/SVGSetElement.cpp
@@ -28,6 +28,7 @@ namespace WebCore {
 inline SVGSetElement::SVGSetElement(const QualifiedName& tagName, Document* document)
     : SVGAnimateElement(tagName, document)
 {
+    setAnimationMode(ToAnimation);
     ASSERT(hasTagName(SVGNames::setTag));
 }
 
@@ -36,6 +37,12 @@ PassRefPtr<SVGSetElement> SVGSetElement::create(const QualifiedName& tagName, Do
     return adoptRef(new SVGSetElement(tagName, document));
 }
 
+void SVGSetElement::updateAnimationMode()
+{
+    // No-op, as <set> has a constant animation mode of ToAnimation.
+    // See: http://www.w3.org/TR/SVG/single-page.html#animate-SetElement
+}
+
 }
 
 // vim:ts=4:noet
diff --git a/Source/WebCore/svg/SVGSetElement.h b/Source/WebCore/svg/SVGSetElement.h
index d9ba18905..7bc443815 100644
--- a/Source/WebCore/svg/SVGSetElement.h
+++ b/Source/WebCore/svg/SVGSetElement.h
@@ -33,6 +33,7 @@ public:
 
 private:
     SVGSetElement(const QualifiedName&, Document*);
+    virtual void updateAnimationMode() OVERRIDE;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/svg/SVGStyledElement.cpp b/Source/WebCore/svg/SVGStyledElement.cpp
index c765dc623..5c1dbb8f9 100644
--- a/Source/WebCore/svg/SVGStyledElement.cpp
+++ b/Source/WebCore/svg/SVGStyledElement.cpp
@@ -74,14 +74,6 @@ SVGStyledElement::SVGStyledElement(const QualifiedName& tagName, Document* docum
     registerAnimatedPropertiesForSVGStyledElement();
 }
 
-SVGStyledElement::~SVGStyledElement()
-{
-    if (hasPendingResources() && document())
-        document()->accessSVGExtensions()->removeElementFromPendingResources(this);
-
-    ASSERT(!hasPendingResources());
-}
-
 String SVGStyledElement::title() const
 {
     // According to spec, we should not return titles when hovering over root <svg> elements (those
@@ -375,7 +367,7 @@ void SVGStyledElement::buildPendingResourcesIfNeeded()
     extensions->markPendingResourcesForRemoval(resourceId);
 
     // Rebuild pending resources for each client of a pending resource that is being removed.
-    while (SVGStyledElement* clientElement = extensions->removeElementFromPendingResourcesForRemoval(resourceId)) {
+    while (SVGElement* clientElement = extensions->removeElementFromPendingResourcesForRemoval(resourceId)) {
         ASSERT(clientElement->hasPendingResources());
         if (clientElement->hasPendingResources()) {
             clientElement->buildPendingResource();
@@ -390,11 +382,6 @@ void SVGStyledElement::removedFrom(ContainerNode* rootParent)
         updateRelativeLengthsInformation(false, this);
     SVGElement::removedFrom(rootParent);
     SVGElementInstance::invalidateAllInstancesOfElement(this);
-    Document* document = this->document();
-    if (!rootParent->inDocument() || !document)
-        return;
-
-    document->accessSVGExtensions()->removeElementFromPendingResources(this);
 }
 
 void SVGStyledElement::childrenChanged(bool changedByParser, Node* beforeChange, Node* afterChange, int childCountDelta)
@@ -434,22 +421,6 @@ void SVGStyledElement::setInstanceUpdatesBlocked(bool value)
         svgRareData()->setInstanceUpdatesBlocked(value);
 }
 
-bool SVGStyledElement::hasPendingResources() const
-{
-    return hasSVGRareData() && svgRareData()->hasPendingResources();
-}
-
-void SVGStyledElement::setHasPendingResources()
-{
-    ensureSVGRareData()->setHasPendingResources(true);
-}
-
-void SVGStyledElement::clearHasPendingResourcesIfPossible()
-{
-    if (!document()->accessSVGExtensions()->isElementPendingResources(this))
-        ensureSVGRareData()->setHasPendingResources(false);
-}
-
 AffineTransform SVGStyledElement::localCoordinateSpaceTransform(SVGLocatable::CTMScope) const
 {
     // To be overriden by SVGStyledLocatableElement/SVGStyledTransformableElement (or as special case SVGTextElement and SVGPatternElement)
diff --git a/Source/WebCore/svg/SVGStyledElement.h b/Source/WebCore/svg/SVGStyledElement.h
index 037d22da6..7f5c95a3f 100644
--- a/Source/WebCore/svg/SVGStyledElement.h
+++ b/Source/WebCore/svg/SVGStyledElement.h
@@ -35,8 +35,6 @@ void mapAttributeToCSSProperty(HashMap<AtomicStringImpl*, CSSPropertyID>* proper
 class SVGStyledElement : public SVGElement,
                          public SVGStylable {
 public:
-    virtual ~SVGStyledElement();
-
     virtual String title() const;
 
     bool hasRelativeLengths() const { return !m_elementsWithRelativeLengths.isEmpty(); }
@@ -50,10 +48,6 @@ public:
     bool instanceUpdatesBlocked() const;
     void setInstanceUpdatesBlocked(bool);
 
-    bool hasPendingResources() const;
-    void setHasPendingResources();
-    void clearHasPendingResourcesIfPossible();
-
     virtual void animatedPropertyTypeForAttribute(const QualifiedName&, Vector<AnimatedPropertyType>&);
     static bool isAnimatableCSSProperty(const QualifiedName&);
 
@@ -69,7 +63,7 @@ protected:
     virtual void parseAttribute(const Attribute&) OVERRIDE;
     virtual bool isPresentationAttribute(const QualifiedName&) const OVERRIDE;
     virtual void collectStyleForAttribute(const Attribute&, StylePropertySet*) OVERRIDE;
-    virtual void svgAttributeChanged(const QualifiedName&);
+    virtual void svgAttributeChanged(const QualifiedName&) OVERRIDE;
 
     virtual InsertionNotificationRequest insertedInto(ContainerNode*) OVERRIDE;
     virtual void removedFrom(ContainerNode*) OVERRIDE;
@@ -80,7 +74,6 @@ protected:
     void updateRelativeLengthsInformation(bool hasRelativeLengths, SVGStyledElement*);
 
     virtual bool selfHasRelativeLengths() const { return false; }
-    virtual void buildPendingResource() { }
 
 private:
     virtual bool isStyled() const { return true; }
diff --git a/Source/WebCore/svg/animation/SMILTime.h b/Source/WebCore/svg/animation/SMILTime.h
index 18abdae59..dbc2d1fbd 100644
--- a/Source/WebCore/svg/animation/SMILTime.h
+++ b/Source/WebCore/svg/animation/SMILTime.h
@@ -29,13 +29,14 @@
 #if ENABLE(SVG)
 
 #include <algorithm>
+#include <wtf/MathExtras.h>
 
 namespace WebCore {
 
 class SMILTime {
 public:
     SMILTime() : m_time(0) { }
-    SMILTime(double time) : m_time(time) { }
+    SMILTime(double time) : m_time(time) { ASSERT(!isnan(time)); }
     SMILTime(const SMILTime& o) : m_time(o.m_time) { }
     
     static SMILTime unresolved() { return unresolvedValue; }
diff --git a/Source/WebCore/svg/animation/SVGSMILElement.cpp b/Source/WebCore/svg/animation/SVGSMILElement.cpp
index f4deff540..1e3b01641 100644
--- a/Source/WebCore/svg/animation/SVGSMILElement.cpp
+++ b/Source/WebCore/svg/animation/SVGSMILElement.cpp
@@ -421,9 +421,6 @@ bool SVGSMILElement::isSupportedAttribute(const QualifiedName& attrName)
         supportedAttributes.add(SVGNames::minAttr);
         supportedAttributes.add(SVGNames::maxAttr);
         supportedAttributes.add(SVGNames::attributeNameAttr);
-        supportedAttributes.add(SVGNames::fromAttr);
-        supportedAttributes.add(SVGNames::toAttr);
-        supportedAttributes.add(SVGNames::byAttr);
         supportedAttributes.add(XLinkNames::hrefAttr);
     }
     return supportedAttributes.contains<QualifiedName, SVGAttributeHashTranslator>(attrName);
@@ -713,6 +710,7 @@ SMILTime SVGSMILElement::simpleDuration() const
 
 void SVGSMILElement::addBeginTime(SMILTime eventTime, SMILTime beginTime, SMILTimeWithOrigin::Origin origin)
 {
+    ASSERT(!isnan(beginTime.value()));
     m_beginTimes.append(SMILTimeWithOrigin(beginTime, origin));
     sortTimeList(m_beginTimes);
     beginListChanged(eventTime);
@@ -720,6 +718,7 @@ void SVGSMILElement::addBeginTime(SMILTime eventTime, SMILTime beginTime, SMILTi
 
 void SVGSMILElement::addEndTime(SMILTime eventTime, SMILTime endTime, SMILTimeWithOrigin::Origin origin)
 {
+    ASSERT(!isnan(endTime.value()));
     m_endTimes.append(SMILTimeWithOrigin(endTime, origin));
     sortTimeList(m_endTimes);
     endListChanged(eventTime);
@@ -1002,9 +1001,7 @@ float SVGSMILElement::calculateAnimationPercentAndRepeat(SMILTime elapsed, unsig
     SMILTime activeTime = elapsed - m_intervalBegin;
     SMILTime repeatingDuration = this->repeatingDuration();
     if (elapsed >= m_intervalEnd || activeTime > repeatingDuration) {
-        repeat = static_cast<unsigned>(repeatingDuration.value() / simpleDuration.value());
-        if (fmod(repeatingDuration.value(), !simpleDuration.value()))
-            repeat--;
+        repeat = static_cast<unsigned>(repeatingDuration.value() / simpleDuration.value()) - 1;
 
         double percent = (m_intervalEnd.value() - m_intervalBegin.value()) / simpleDuration.value();
         percent = percent - floor(percent);
diff --git a/Source/WebCore/svg/graphics/SVGImage.cpp b/Source/WebCore/svg/graphics/SVGImage.cpp
index 6a76fa38c..2847797b6 100644
--- a/Source/WebCore/svg/graphics/SVGImage.cpp
+++ b/Source/WebCore/svg/graphics/SVGImage.cpp
@@ -31,44 +31,17 @@
 #include "SVGImage.h"
 
 #include "DocumentLoader.h"
-#include "EmptyClients.h"
 #include "FrameView.h"
 #include "ImageBuffer.h"
 #include "ImageObserver.h"
 #include "RenderSVGRoot.h"
 #include "SVGDocument.h"
+#include "SVGImageChromeClient.h"
 #include "SVGSVGElement.h"
 #include "Settings.h"
 
 namespace WebCore {
 
-class SVGImageChromeClient : public EmptyChromeClient {
-    WTF_MAKE_NONCOPYABLE(SVGImageChromeClient); WTF_MAKE_FAST_ALLOCATED;
-public:
-    SVGImageChromeClient(SVGImage* image)
-        : m_image(image)
-    {
-    }
-
-    virtual bool isSVGImageChromeClient() const { return true; }
-    SVGImage* image() const { return m_image; }
-
-private:
-    virtual void chromeDestroyed()
-    {
-        m_image = 0;
-    }
-
-    virtual void invalidateContentsAndRootView(const IntRect& r, bool)
-    {
-        // If m_image->m_page is null, we're being destructed, don't fire changedInRect() in that case.
-        if (m_image && m_image->imageObserver() && m_image->m_page)
-            m_image->imageObserver()->changedInRect(m_image, r);
-    }
-
-    SVGImage* m_image;
-};
-
 SVGImage::SVGImage(ImageObserver* observer)
     : Image(observer)
 {
@@ -180,7 +153,11 @@ void SVGImage::drawSVGToImageBuffer(ImageBuffer* buffer, const IntSize& size, fl
     if (zoom != 1)
         frame->setPageZoomFactor(1);
 
-    renderer->setContainerSize(IntSize());
+    // Renderer may have been recreated by frame->setPageZoomFactor(zoom). So fetch it again.
+    renderer = toRenderSVGRoot(rootElement->renderer());
+    if (renderer)
+        renderer->setContainerSize(IntSize());
+
     frame->view()->resize(this->size());
     if (frame->view()->needsLayout())
         frame->view()->layout();
diff --git a/Source/WebCore/svg/graphics/SVGImageChromeClient.h b/Source/WebCore/svg/graphics/SVGImageChromeClient.h
new file mode 100644
index 000000000..2b443d5d5
--- /dev/null
+++ b/Source/WebCore/svg/graphics/SVGImageChromeClient.h
@@ -0,0 +1,74 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef SVGImageChromeClient_h
+#define SVGImageChromeClient_h
+
+#if ENABLE(SVG)
+
+#include "EmptyClients.h"
+
+namespace WebCore {
+
+class SVGImageChromeClient : public EmptyChromeClient {
+    WTF_MAKE_NONCOPYABLE(SVGImageChromeClient); WTF_MAKE_FAST_ALLOCATED;
+public:
+    SVGImageChromeClient(SVGImage* image)
+        : m_image(image)
+    {
+    }
+    
+    virtual bool isSVGImageChromeClient() const { return true; }
+    SVGImage* image() const { return m_image; }
+    
+private:
+    virtual void chromeDestroyed()
+    {
+        m_image = 0;
+    }
+    
+    virtual void invalidateContentsAndRootView(const IntRect& r, bool)
+    {
+        // If m_image->m_page is null, we're being destructed, don't fire changedInRect() in that case.
+        if (m_image && m_image->imageObserver() && m_image->m_page)
+            m_image->imageObserver()->changedInRect(m_image, r);
+    }
+    
+    SVGImage* m_image;
+};
+
+inline SVGImageChromeClient* toSVGImageChromeClient(ChromeClient* client)
+{
+    ASSERT(!client || client->isSVGImageChromeClient());
+    return static_cast<SVGImageChromeClient*>(client);
+}
+    
+} 
+
+#endif // ENABLE(SVG)
+#endif // SVGImageChromeClient_h
diff --git a/Source/WebCore/svg/graphics/filters/SVGFEImage.h b/Source/WebCore/svg/graphics/filters/SVGFEImage.h
index 5bad95075..87e5837aa 100644
--- a/Source/WebCore/svg/graphics/filters/SVGFEImage.h
+++ b/Source/WebCore/svg/graphics/filters/SVGFEImage.h
@@ -54,6 +54,8 @@ private:
     RenderObject* referencedRenderer() const;
 
     RefPtr<Image> m_image;
+
+    // m_document will never be a dangling reference. See https://bugs.webkit.org/show_bug.cgi?id=99243
     Document* m_document;
     String m_href;
     SVGPreserveAspectRatio m_preserveAspectRatio;
diff --git a/Source/WebCore/testing/InternalSettings.cpp b/Source/WebCore/testing/InternalSettings.cpp
index d101e2a59..aa7703bc6 100644
--- a/Source/WebCore/testing/InternalSettings.cpp
+++ b/Source/WebCore/testing/InternalSettings.cpp
@@ -32,7 +32,6 @@
 #include "ExceptionCode.h"
 #include "Frame.h"
 #include "FrameView.h"
-#include "InspectorController.h"
 #include "Language.h"
 #include "LocaleToScriptMapping.h"
 #include "MockPagePopupDriver.h"
@@ -57,12 +56,6 @@
         return; \
     }
 
-#define InternalSettingsGuardForPageReturn(returnValue) \
-    if (!page()) { \
-        ec = INVALID_ACCESS_ERR; \
-        return returnValue; \
-    }
-
 #define InternalSettingsGuardForPage() \
     if (!page()) { \
         ec = INVALID_ACCESS_ERR; \
@@ -74,7 +67,9 @@ namespace WebCore {
 InternalSettings::Backup::Backup(Page* page, Settings* settings)
     : m_originalPasswordEchoDurationInSeconds(settings->passwordEchoDurationInSeconds())
     , m_originalPasswordEchoEnabled(settings->passwordEchoEnabled())
+    , m_originalFixedElementsLayoutRelativeToFrame(settings->fixedElementsLayoutRelativeToFrame())
     , m_originalCSSExclusionsEnabled(RuntimeEnabledFeatures::cssExclusionsEnabled())
+    , m_originalCSSVariablesEnabled(settings->cssVariablesEnabled())
 #if ENABLE(SHADOW_DOM)
     , m_originalShadowDOMEnabled(RuntimeEnabledFeatures::shadowDOMEnabled())
     , m_originalAuthorShadowDOMForAnyElementEnabled(RuntimeEnabledFeatures::authorShadowDOMForAnyElementEnabled())
@@ -86,9 +81,6 @@ InternalSettings::Backup::Backup(Page* page, Settings* settings)
     , m_originalUnifiedSpellCheckerEnabled(settings->unifiedTextCheckerEnabled())
     , m_originalFixedPositionCreatesStackingContext(settings->fixedPositionCreatesStackingContext())
     , m_originalSyncXHRInDocumentsEnabled(settings->syncXHRInDocumentsEnabled())
-#if ENABLE(INSPECTOR) && ENABLE(JAVASCRIPT_DEBUGGER)
-    , m_originalJavaScriptProfilingEnabled(page->inspectorController() && page->inspectorController()->profilerEnabled())
-#endif
     , m_originalWindowFocusRestricted(settings->windowFocusRestricted())
     , m_originalDeviceSupportsTouch(settings->deviceSupportsTouch())
     , m_originalDeviceSupportsMouse(settings->deviceSupportsMouse())
@@ -97,13 +89,24 @@ InternalSettings::Backup::Backup(Page* page, Settings* settings)
     , m_originalTextAutosizingWindowSizeOverride(settings->textAutosizingWindowSizeOverride())
     , m_originalTextAutosizingFontScaleFactor(settings->textAutosizingFontScaleFactor())
 #endif
+    , m_originalResolutionOverride(settings->resolutionOverride())
+    , m_originalMediaTypeOverride(settings->mediaTypeOverride())
 #if ENABLE(DIALOG_ELEMENT)
     , m_originalDialogElementEnabled(RuntimeEnabledFeatures::dialogElementEnabled())
 #endif
     , m_canStartMedia(page->canStartMedia())
+    , m_originalForceCompositingMode(settings->forceCompositingMode())
+    , m_originalCompositingForFixedPositionEnabled(settings->acceleratedCompositingForFixedPositionEnabled())
+    , m_originalCompositingForScrollableFramesEnabled(settings->acceleratedCompositingForScrollableFramesEnabled())
+    , m_originalAcceleratedDrawingEnabled(settings->acceleratedDrawingEnabled())
     , m_originalMockScrollbarsEnabled(settings->mockScrollbarsEnabled())
     , m_langAttributeAwareFormControlUIEnabled(RuntimeEnabledFeatures::langAttributeAwareFormControlUIEnabled())
     , m_imagesEnabled(settings->areImagesEnabled())
+#if ENABLE(VIDEO_TRACK)
+    , m_shouldDisplaySubtitles(settings->shouldDisplaySubtitles())
+    , m_shouldDisplayCaptions(settings->shouldDisplayCaptions())
+    , m_shouldDisplayTextDescriptions(settings->shouldDisplayTextDescriptions())
+#endif
 {
 }
 
@@ -112,7 +115,9 @@ void InternalSettings::Backup::restoreTo(Page* page, Settings* settings)
 {
     settings->setPasswordEchoDurationInSeconds(m_originalPasswordEchoDurationInSeconds);
     settings->setPasswordEchoEnabled(m_originalPasswordEchoEnabled);
+    settings->setFixedElementsLayoutRelativeToFrame(m_originalFixedElementsLayoutRelativeToFrame);
     RuntimeEnabledFeatures::setCSSExclusionsEnabled(m_originalCSSExclusionsEnabled);
+    settings->setCSSVariablesEnabled(m_originalCSSVariablesEnabled);
 #if ENABLE(SHADOW_DOM)
     RuntimeEnabledFeatures::setShadowDOMEnabled(m_originalShadowDOMEnabled);
     RuntimeEnabledFeatures::setAuthorShadowDOMForAnyElementEnabled(m_originalAuthorShadowDOMForAnyElementEnabled);
@@ -124,10 +129,6 @@ void InternalSettings::Backup::restoreTo(Page* page, Settings* settings)
     settings->setUnifiedTextCheckerEnabled(m_originalUnifiedSpellCheckerEnabled);
     settings->setFixedPositionCreatesStackingContext(m_originalFixedPositionCreatesStackingContext);
     settings->setSyncXHRInDocumentsEnabled(m_originalSyncXHRInDocumentsEnabled);
-#if ENABLE(INSPECTOR) && ENABLE(JAVASCRIPT_DEBUGGER)
-    if (page->inspectorController())
-        page->inspectorController()->setProfilerEnabled(m_originalJavaScriptProfilingEnabled);
-#endif
     settings->setWindowFocusRestricted(m_originalWindowFocusRestricted);
     settings->setDeviceSupportsTouch(m_originalDeviceSupportsTouch);
     settings->setDeviceSupportsMouse(m_originalDeviceSupportsMouse);
@@ -136,13 +137,24 @@ void InternalSettings::Backup::restoreTo(Page* page, Settings* settings)
     settings->setTextAutosizingWindowSizeOverride(m_originalTextAutosizingWindowSizeOverride);
     settings->setTextAutosizingFontScaleFactor(m_originalTextAutosizingFontScaleFactor);
 #endif
+    settings->setResolutionOverride(m_originalResolutionOverride);
+    settings->setMediaTypeOverride(m_originalMediaTypeOverride);
 #if ENABLE(DIALOG_ELEMENT)
     RuntimeEnabledFeatures::setDialogElementEnabled(m_originalDialogElementEnabled);
 #endif
     page->setCanStartMedia(m_canStartMedia);
+    settings->setForceCompositingMode(m_originalForceCompositingMode);
+    settings->setAcceleratedCompositingForFixedPositionEnabled(m_originalCompositingForFixedPositionEnabled);
+    settings->setAcceleratedCompositingForScrollableFramesEnabled(m_originalCompositingForScrollableFramesEnabled);
+    settings->setAcceleratedDrawingEnabled(m_originalAcceleratedDrawingEnabled);
     settings->setMockScrollbarsEnabled(m_originalMockScrollbarsEnabled);
     RuntimeEnabledFeatures::setLangAttributeAwareFormControlUIEnabled(m_langAttributeAwareFormControlUIEnabled);
     settings->setImagesEnabled(m_imagesEnabled);
+#if ENABLE(VIDEO_TRACK)
+    settings->setShouldDisplaySubtitles(m_shouldDisplaySubtitles);
+    settings->setShouldDisplayCaptions(m_shouldDisplayCaptions);
+    settings->setShouldDisplayTextDescriptions(m_shouldDisplayTextDescriptions);
+#endif
 }
 
 InternalSettings* InternalSettings::from(Page* page)
@@ -194,21 +206,6 @@ Settings* InternalSettings::settings() const
     return page()->settings();
 }
 
-void InternalSettings::setInspectorResourcesDataSizeLimits(int maximumResourcesContentSize, int maximumSingleResourceContentSize, ExceptionCode& ec)
-{
-#if ENABLE(INSPECTOR)
-    if (!page() || !page()->inspectorController()) {
-        ec = INVALID_ACCESS_ERR;
-        return;
-    }
-    page()->inspectorController()->setResourcesDataSizeLimitsFromInternals(maximumResourcesContentSize, maximumSingleResourceContentSize);
-#else
-    UNUSED_PARAM(maximumResourcesContentSize);
-    UNUSED_PARAM(maximumSingleResourceContentSize);
-    UNUSED_PARAM(ec);
-#endif
-}
-
 void InternalSettings::setForceCompositingMode(bool enabled, ExceptionCode& ec)
 {
     InternalSettingsGuardForSettings();
@@ -413,6 +410,19 @@ void InternalSettings::setTextAutosizingWindowSizeOverride(int width, int height
 #endif
 }
 
+void InternalSettings::setResolutionOverride(int dotsPerCSSInchHorizontally, int dotsPerCSSInchVertically, ExceptionCode& ec)
+{
+    InternalSettingsGuardForSettings();
+    // An empty size resets the override.
+    settings()->setResolutionOverride(IntSize(dotsPerCSSInchHorizontally, dotsPerCSSInchVertically));
+}
+
+void InternalSettings::setMediaTypeOverride(const String& mediaType, ExceptionCode& ec)
+{
+    InternalSettingsGuardForSettings();
+    settings()->setMediaTypeOverride(mediaType);
+}
+
 void InternalSettings::setTextAutosizingFontScaleFactor(float fontScaleFactor, ExceptionCode& ec)
 {
 #if ENABLE(TEXT_AUTOSIZING)
@@ -501,22 +511,6 @@ void InternalSettings::setSyncXHRInDocumentsEnabled(bool enabled, ExceptionCode&
     settings()->setSyncXHRInDocumentsEnabled(enabled);
 }
 
-void InternalSettings::setJavaScriptProfilingEnabled(bool enabled, ExceptionCode& ec)
-{
-#if ENABLE(INSPECTOR)
-    if (!page() || !page()->inspectorController()) {
-        ec = INVALID_ACCESS_ERR;
-        return;
-    }
-
-    page()->inspectorController()->setProfilerEnabled(enabled);
-#else
-    UNUSED_PARAM(enabled);
-    UNUSED_PARAM(ec);
-    return;
-#endif
-}
-
 void InternalSettings::setWindowFocusRestricted(bool restricted, ExceptionCode& ec)
 {
     InternalSettingsGuardForSettings();
diff --git a/Source/WebCore/testing/InternalSettings.h b/Source/WebCore/testing/InternalSettings.h
index 78f36e017..0bf35fe37 100644
--- a/Source/WebCore/testing/InternalSettings.h
+++ b/Source/WebCore/testing/InternalSettings.h
@@ -27,15 +27,12 @@
 #define InternalSettings_h
 
 #include "EditingBehaviorTypes.h"
+#include "IntSize.h"
 #include "RefCountedSupplement.h"
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefCounted.h>
 #include <wtf/text/WTFString.h>
 
-#if ENABLE(TEXT_AUTOSIZING)
-#include "IntSize.h"
-#endif
-
 namespace WebCore {
 
 typedef int ExceptionCode;
@@ -56,7 +53,9 @@ public:
 
         double m_originalPasswordEchoDurationInSeconds;
         bool m_originalPasswordEchoEnabled;
+        bool m_originalFixedElementsLayoutRelativeToFrame;
         bool m_originalCSSExclusionsEnabled;
+        bool m_originalCSSVariablesEnabled;
 #if ENABLE(SHADOW_DOM)
         bool m_originalShadowDOMEnabled;
         bool m_originalAuthorShadowDOMForAnyElementEnabled;
@@ -68,9 +67,6 @@ public:
         bool m_originalUnifiedSpellCheckerEnabled;
         bool m_originalFixedPositionCreatesStackingContext;
         bool m_originalSyncXHRInDocumentsEnabled;
-#if ENABLE(INSPECTOR) && ENABLE(JAVASCRIPT_DEBUGGER)
-        bool m_originalJavaScriptProfilingEnabled;
-#endif
         bool m_originalWindowFocusRestricted;
         bool m_originalDeviceSupportsTouch;
         bool m_originalDeviceSupportsMouse;
@@ -79,13 +75,24 @@ public:
         IntSize m_originalTextAutosizingWindowSizeOverride;
         float m_originalTextAutosizingFontScaleFactor;
 #endif
+        IntSize m_originalResolutionOverride;
+        String m_originalMediaTypeOverride;
 #if ENABLE(DIALOG_ELEMENT)
         bool m_originalDialogElementEnabled;
 #endif
         bool m_canStartMedia;
+        bool m_originalForceCompositingMode;
+        bool m_originalCompositingForFixedPositionEnabled;
+        bool m_originalCompositingForScrollableFramesEnabled;
+        bool m_originalAcceleratedDrawingEnabled;
         bool m_originalMockScrollbarsEnabled;
         bool m_langAttributeAwareFormControlUIEnabled;
         bool m_imagesEnabled;
+#if ENABLE(VIDEO_TRACK)
+        bool m_shouldDisplaySubtitles;
+        bool m_shouldDisplayCaptions;
+        bool m_shouldDisplayTextDescriptions;
+#endif
     };
 
     typedef RefCountedSupplement<Page, InternalSettings> SuperType;
@@ -97,7 +104,6 @@ public:
 #endif
     void reset();
 
-    void setInspectorResourcesDataSizeLimits(int maximumResourcesContentSize, int maximumSingleResourceContentSize, ExceptionCode&);
     void setForceCompositingMode(bool enabled, ExceptionCode&);
     void setEnableCompositingForFixedPosition(bool enabled, ExceptionCode&);
     void setEnableCompositingForScrollableFrames(bool enabled, ExceptionCode&);
@@ -127,6 +133,8 @@ public:
     void setTextAutosizingEnabled(bool enabled, ExceptionCode&);
     void setTextAutosizingWindowSizeOverride(int width, int height, ExceptionCode&);
     void setTextAutosizingFontScaleFactor(float fontScaleFactor, ExceptionCode&);
+    void setResolutionOverride(int dotsPerCSSInchHorizontally, int dotsPerCSSInchVertically, ExceptionCode&);
+    void setMediaTypeOverride(const String& mediaType, ExceptionCode&);
     void setEnableScrollAnimator(bool enabled, ExceptionCode&);
     bool scrollAnimatorEnabled(ExceptionCode&);
     void setCSSExclusionsEnabled(bool enabled, ExceptionCode&);
@@ -139,7 +147,6 @@ public:
     void setSyncXHRInDocumentsEnabled(bool, ExceptionCode&);
     void setWindowFocusRestricted(bool, ExceptionCode&);
     void setDialogElementEnabled(bool, ExceptionCode&);
-    void setJavaScriptProfilingEnabled(bool enabled, ExceptionCode&);
     Vector<String> userPreferredLanguages() const;
     void setUserPreferredLanguages(const Vector<String>&);
     void setPagination(const String& mode, int gap, ExceptionCode& ec) { setPagination(mode, gap, 0, ec); }
diff --git a/Source/WebCore/testing/InternalSettings.idl b/Source/WebCore/testing/InternalSettings.idl
index f3464be9a..31494119c 100644
--- a/Source/WebCore/testing/InternalSettings.idl
+++ b/Source/WebCore/testing/InternalSettings.idl
@@ -26,7 +26,6 @@
 [
     OmitConstructor
 ] interface InternalSettings {
-    void setInspectorResourcesDataSizeLimits(in long maximumResourcesContentSize, in long maximumSingleResourceContentSize) raises(DOMException);
     void setForceCompositingMode(in boolean enabled) raises(DOMException);
     void setEnableCompositingForFixedPosition(in boolean enabled) raises(DOMException);
     void setEnableCompositingForScrollableFrames(in boolean enabled) raises(DOMException);
@@ -56,6 +55,8 @@
     void setTextAutosizingEnabled(in boolean enabled) raises(DOMException);
     void setTextAutosizingWindowSizeOverride(in long width, in long height) raises(DOMException);
     void setTextAutosizingFontScaleFactor(in float fontScaleFactor) raises(DOMException);
+    void setResolutionOverride(in long dotsPerCSSInchHorizontally, in long dotsPerCSSInchVertically) raises(DOMException);
+    void setMediaTypeOverride(in DOMString mediaTypeOverride) raises(DOMException);
     void setEnableScrollAnimator(in boolean enabled) raises(DOMException);
     boolean scrollAnimatorEnabled() raises(DOMException);
     void setCSSExclusionsEnabled(in boolean enabled) raises(DOMException);
@@ -66,7 +67,6 @@
     void setEditingBehavior(in DOMString behavior) raises(DOMException);
     void setFixedPositionCreatesStackingContext(in boolean creates) raises(DOMException);
     void setSyncXHRInDocumentsEnabled(in boolean enabled) raises(DOMException);
-    void setJavaScriptProfilingEnabled(in boolean creates) raises(DOMException);
     void setWindowFocusRestricted(in boolean restricted) raises(DOMException);
     void setDialogElementEnabled(in boolean enabled) raises(DOMException);
     void setLangAttributeAwareFormControlUIEnabled(in boolean enabled);
@@ -76,10 +76,8 @@
     void setUserPreferredLanguages(in sequence<String> languages);
     void allowRoundingHacks();
     void setEnableMockPagePopup(in boolean enabled) raises(DOMException);
-#if defined(ENABLE_VIDEO_TRACK) && ENABLE_VIDEO_TRACK
-    void setShouldDisplayTrackKind(in DOMString kind, in boolean enabled) raises (DOMException);
-    boolean shouldDisplayTrackKind(in DOMString trackKind) raises (DOMException);
-#endif
+    [Conditional=VIDEO_TRACK] void setShouldDisplayTrackKind(in DOMString kind, in boolean enabled) raises (DOMException);
+    [Conditional=VIDEO_TRACK] boolean shouldDisplayTrackKind(in DOMString trackKind) raises (DOMException);
     void setMemoryInfoEnabled(in boolean enabled) raises(DOMException);
     void setStorageBlockingPolicy(in DOMString policy) raises(DOMException);
     void setImagesEnabled(in boolean enabled) raises(DOMException);
diff --git a/Source/WebCore/testing/Internals.cpp b/Source/WebCore/testing/Internals.cpp
index c26d6ea4f..b453fb7e3 100644
--- a/Source/WebCore/testing/Internals.cpp
+++ b/Source/WebCore/testing/Internals.cpp
@@ -204,6 +204,15 @@ Internals::~Internals()
 {
 }
 
+void Internals::resetToConsistentState(Page* page)
+{
+    ASSERT(page);
+#if ENABLE(INSPECTOR) && ENABLE(JAVASCRIPT_DEBUGGER)
+    if (page->inspectorController())
+        page->inspectorController()->setProfilerEnabled(false);
+#endif
+}
+
 Internals::Internals(Document* document)
     : ContextDestructionObserver(document)
 {
@@ -306,6 +315,25 @@ bool Internals::hasShadowInsertionPoint(const Node* root, ExceptionCode& ec) con
     return 0;
 }
 
+bool Internals::hasContentElement(const Node* root, ExceptionCode& ec) const
+{
+    if (root && root->isShadowRoot())
+        return toShadowRoot(root)->hasContentElement();
+
+    ec = INVALID_ACCESS_ERR;
+    return 0;
+}
+
+size_t Internals::countElementShadow(const Node* root, ExceptionCode& ec) const
+{
+    if (!root || !root->isShadowRoot()) {
+        ec = INVALID_ACCESS_ERR;
+        return 0;
+    }
+
+    return toShadowRoot(root)->countElementShadow();
+}
+
 bool Internals::attached(Node* node, ExceptionCode& ec)
 {
     if (!node) {
@@ -464,6 +492,24 @@ Internals::ShadowRootIfShadowDOMEnabledOrNode* Internals::olderShadowRoot(Node*
     return toShadowRoot(shadow)->olderShadowRoot();
 }
 
+String Internals::shadowRootType(const Node* root, ExceptionCode& ec) const
+{
+    if (!root || !root->isShadowRoot()) {
+        ec = INVALID_ACCESS_ERR;
+        return String();
+    }
+
+    switch (toShadowRoot(root)->type()) {
+    case ShadowRoot::UserAgentShadowRoot:
+        return String("UserAgentShadowRoot");
+    case ShadowRoot::AuthorShadowRoot:
+        return String("AuthorShadowRoot");
+    default:
+        ASSERT_NOT_REACHED();
+        return String("Unknown");
+    }
+}
+
 Element* Internals::includerFor(Node* node, ExceptionCode& ec)
 {
     if (!node) {
@@ -994,16 +1040,6 @@ void Internals::setUserPreferredLanguages(const Vector<String>& languages)
     settings()->setUserPreferredLanguages(languages);
 }
 
-void Internals::setShouldDisplayTrackKind(Document*, const String& kind, bool enabled, ExceptionCode& ec)
-{
-    settings()->setShouldDisplayTrackKind(kind, enabled, ec);
-}
-
-bool Internals::shouldDisplayTrackKind(Document*, const String& kind, ExceptionCode& ec)
-{
-    return settings()->shouldDisplayTrackKind(kind, ec);
-}
-
 unsigned Internals::wheelEventHandlerCount(Document* document, ExceptionCode& ec)
 {
     if (!document) {
@@ -1159,6 +1195,27 @@ void Internals::closeDummyInspectorFrontend()
     m_frontendWindow->close(m_frontendWindow->scriptExecutionContext());
     m_frontendWindow.release();
 }
+
+void Internals::setInspectorResourcesDataSizeLimits(int maximumResourcesContentSize, int maximumSingleResourceContentSize, ExceptionCode& ec)
+{
+    Page* page = contextDocument()->frame()->page();
+    if (!page || !page->inspectorController()) {
+        ec = INVALID_ACCESS_ERR;
+        return;
+    }
+    page->inspectorController()->setResourcesDataSizeLimitsFromInternals(maximumResourcesContentSize, maximumSingleResourceContentSize);
+}
+
+void Internals::setJavaScriptProfilingEnabled(bool enabled, ExceptionCode& ec)
+{
+    Page* page = contextDocument()->frame()->page();
+    if (!page || !page->inspectorController()) {
+        ec = INVALID_ACCESS_ERR;
+        return;
+    }
+
+    page->inspectorController()->setProfilerEnabled(enabled);
+}
 #endif // ENABLE(INSPECTOR)
 
 bool Internals::hasGrammarMarker(Document* document, int from, int length, ExceptionCode&)
@@ -1237,10 +1294,38 @@ String Internals::layerTreeAsText(Document* document, unsigned flags, ExceptionC
     LayerTreeFlags layerTreeFlags = 0;
     if (flags & LAYER_TREE_INCLUDES_VISIBLE_RECTS)
         layerTreeFlags |= LayerTreeFlagsIncludeVisibleRects;
+    if (flags & LAYER_TREE_INCLUDES_TILE_CACHES)
+        layerTreeFlags |= LayerTreeFlagsIncludeTileCaches;
+    if (flags & LAYER_TREE_INCLUDES_REPAINT_RECTS)
+        layerTreeFlags |= LayerTreeFlagsIncludeRepaintRects;
 
     return document->frame()->layerTreeAsText(layerTreeFlags);
 }
 
+String Internals::repaintRectsAsText(Document* document, ExceptionCode& ec) const
+{
+    if (!document || !document->frame()) {
+        ec = INVALID_ACCESS_ERR;
+        return String();
+    }
+
+    return document->frame()->trackedRepaintRectsAsText();
+}
+
+String Internals::scrollingStateTreeAsText(Document* document, ExceptionCode& ec) const
+{
+    if (!document || !document->frame()) {
+        ec = INVALID_ACCESS_ERR;
+        return String();
+    }
+
+    Page* page = document->page();
+    if (!page)
+        return String();
+
+    return page->scrollingStateTreeAsText();
+}
+
 void Internals::garbageCollectDocumentResources(Document* document, ExceptionCode& ec) const
 {
     if (!document) {
@@ -1370,4 +1455,26 @@ PassRefPtr<DOMStringList> Internals::getReferencedFilePaths() const
     return stringList.release();
 }
 
+void Internals::startTrackingRepaints(Document* document, ExceptionCode& ec)
+{
+    if (!document || !document->view()) {
+        ec = INVALID_ACCESS_ERR;
+        return;
+    }
+
+    FrameView* frameView = document->view();
+    frameView->setTracksRepaints(true);
+}
+
+void Internals::stopTrackingRepaints(Document* document, ExceptionCode& ec)
+{
+    if (!document || !document->view()) {
+        ec = INVALID_ACCESS_ERR;
+        return;
+    }
+
+    FrameView* frameView = document->view();
+    frameView->setTracksRepaints(false);
+}
+
 }
diff --git a/Source/WebCore/testing/Internals.h b/Source/WebCore/testing/Internals.h
index bbc5c5b7b..21117397c 100644
--- a/Source/WebCore/testing/Internals.h
+++ b/Source/WebCore/testing/Internals.h
@@ -46,6 +46,7 @@ class Frame;
 class InspectorFrontendChannelDummy;
 class InternalSettings;
 class Node;
+class Page;
 class PagePopupController;
 class Range;
 class ScriptExecutionContext;
@@ -61,6 +62,8 @@ public:
     static PassRefPtr<Internals> create(Document*);
     virtual ~Internals();
 
+    static void resetToConsistentState(Page*);
+
     String elementRenderTreeAsText(Element*, ExceptionCode&);
 
     String address(Node*);
@@ -80,7 +83,10 @@ public:
     ShadowRootIfShadowDOMEnabledOrNode* oldestShadowRoot(Element* host, ExceptionCode&);
     ShadowRootIfShadowDOMEnabledOrNode* youngerShadowRoot(Node* shadow, ExceptionCode&);
     ShadowRootIfShadowDOMEnabledOrNode* olderShadowRoot(Node* shadow, ExceptionCode&);
+    String shadowRootType(const Node*, ExceptionCode&) const;
     bool hasShadowInsertionPoint(const Node*, ExceptionCode&) const;
+    bool hasContentElement(const Node*, ExceptionCode&) const;
+    size_t countElementShadow(const Node*, ExceptionCode&) const;
     Element* includerFor(Node*, ExceptionCode&);
     String shadowPseudoId(Element*, ExceptionCode&);
     void setShadowPseudoId(Element*, const String&, ExceptionCode&);
@@ -156,9 +162,6 @@ public:
     Vector<String> userPreferredLanguages() const;
     void setUserPreferredLanguages(const Vector<String>&);
 
-    void setShouldDisplayTrackKind(Document*, const String& kind, bool, ExceptionCode&);
-    bool shouldDisplayTrackKind(Document*, const String& kind, ExceptionCode&);
-
     unsigned wheelEventHandlerCount(Document*, ExceptionCode&);
     unsigned touchEventHandlerCount(Document*, ExceptionCode&);
 
@@ -188,10 +191,16 @@ public:
     void resumeAnimations(Document*, ExceptionCode&) const;
 
     enum {
-        LAYER_TREE_INCLUDES_VISIBLE_RECTS = 1 // Values need to kept in sync with Internals.idl.
+        // Values need to be kept in sync with Internals.idl.
+        LAYER_TREE_INCLUDES_VISIBLE_RECTS = 1,
+        LAYER_TREE_INCLUDES_TILE_CACHES = 2,
+        LAYER_TREE_INCLUDES_REPAINT_RECTS = 4
+        
     };
     String layerTreeAsText(Document*, unsigned flags, ExceptionCode&) const;
     String layerTreeAsText(Document*, ExceptionCode&) const;
+    String repaintRectsAsText(Document*, ExceptionCode&) const;
+    String scrollingStateTreeAsText(Document*, ExceptionCode&) const;
 
     void garbageCollectDocumentResources(Document*, ExceptionCode&) const;
 
@@ -203,6 +212,8 @@ public:
     Vector<String> consoleMessageArgumentCounts(Document*) const;
     PassRefPtr<DOMWindow> openDummyInspectorFrontend(const String& url);
     void closeDummyInspectorFrontend();
+    void setInspectorResourcesDataSizeLimits(int maximumResourcesContentSize, int maximumSingleResourceContentSize, ExceptionCode&);
+    void setJavaScriptProfilingEnabled(bool enabled, ExceptionCode&);
 #endif
 
     String counterValue(Element*);
@@ -228,6 +239,9 @@ public:
 
     PassRefPtr<DOMStringList> getReferencedFilePaths() const;
 
+    void startTrackingRepaints(Document*, ExceptionCode&);
+    void stopTrackingRepaints(Document*, ExceptionCode&);
+
 private:
     explicit Internals(Document*);
     Document* contextDocument() const;
diff --git a/Source/WebCore/testing/Internals.idl b/Source/WebCore/testing/Internals.idl
index 77ba66010..7a5ab7b90 100644
--- a/Source/WebCore/testing/Internals.idl
+++ b/Source/WebCore/testing/Internals.idl
@@ -47,7 +47,10 @@
     Node oldestShadowRoot(in Element host) raises (DOMException);
     Node youngerShadowRoot(in Node root) raises (DOMException);
 #endif
+    DOMString shadowRootType(in Node root) raises (DOMException);
     boolean hasShadowInsertionPoint(in Node root) raises (DOMException);
+    boolean hasContentElement(in Node root) raises (DOMException);
+    unsigned long countElementShadow(in Node Root) raises (DOMException);
     Element includerFor(in Node node) raises (DOMException);
     DOMString shadowPseudoId(in Element element) raises (DOMException);
     void setShadowPseudoId(in Element element, in DOMString id) raises (DOMException);
@@ -125,11 +128,6 @@
     long lastSpellCheckRequestSequence(in Document document) raises (DOMException);
     long lastSpellCheckProcessedSequence(in Document document) raises (DOMException);
 
-#if defined(ENABLE_VIDEO_TRACK) && ENABLE_VIDEO_TRACK
-    void setShouldDisplayTrackKind(in Document document, in DOMString kind, in boolean enabled) raises (DOMException);
-    boolean shouldDisplayTrackKind(in Document document, in DOMString trackKind) raises (DOMException);
-#endif
-
     sequence<String> userPreferredLanguages();
     void setUserPreferredLanguages(in sequence<String> languages);
 
@@ -158,8 +156,14 @@
 
     // Flags for layerTreeAsText.
     const unsigned short LAYER_TREE_INCLUDES_VISIBLE_RECTS = 1;
+    const unsigned short LAYER_TREE_INCLUDES_TILE_CACHES = 2;
+    const unsigned short LAYER_TREE_INCLUDES_REPAINT_RECTS = 4;
     DOMString layerTreeAsText(in Document document, in [Optional] unsigned short flags) raises (DOMException);
 
+    DOMString scrollingStateTreeAsText(in Document document) raises (DOMException);
+
+    DOMString repaintRectsAsText(in Document document) raises (DOMException);
+
     void garbageCollectDocumentResources(in Document document) raises (DOMException);
 
     void allowRoundingHacks();
@@ -177,6 +181,8 @@
     [Conditional=INSPECTOR] sequence<String> consoleMessageArgumentCounts(in Document document);
     [Conditional=INSPECTOR] DOMWindow openDummyInspectorFrontend(in DOMString url);
     [Conditional=INSPECTOR] void closeDummyInspectorFrontend();
+    [Conditional=INSPECTOR] void setInspectorResourcesDataSizeLimits(in long maximumResourcesContentSize, in long maximumSingleResourceContentSize) raises(DOMException);
+    [Conditional=INSPECTOR] void setJavaScriptProfilingEnabled(in boolean creates) raises(DOMException);
 
     DOMString counterValue(in Element element);
     long pageNumber(in Element element, in [Optional] float pageWidth, in [Optional] float pageHeight);
@@ -199,4 +205,9 @@
     MallocStatistics mallocStatistics();
 
     DOMString[] getReferencedFilePaths();
+
+    // These functions both reset the tracked repaint rects. They are inteded to be used in the following order:
+    //  startTrackingRepaints, repaintRectsAsText, stopTrackingRepaints.
+    void startTrackingRepaints(in Document document) raises (DOMException);
+    void stopTrackingRepaints(in Document document) raises (DOMException);
 };
diff --git a/Source/WebCore/testing/js/WebCoreTestSupport.cpp b/Source/WebCore/testing/js/WebCoreTestSupport.cpp
index 138b429f0..20bc9306c 100644
--- a/Source/WebCore/testing/js/WebCoreTestSupport.cpp
+++ b/Source/WebCore/testing/js/WebCoreTestSupport.cpp
@@ -56,7 +56,9 @@ void resetInternalsObject(JSContextRef context)
     JSDOMGlobalObject* globalObject = jsCast<JSDOMGlobalObject*>(exec->lexicalGlobalObject());
     ScriptExecutionContext* scriptContext = globalObject->scriptExecutionContext();
     ASSERT(scriptContext->isDocument());
-    InternalSettings::from(static_cast<Document*>(scriptContext)->frame()->page())->reset();
+    Page* page = static_cast<Document*>(scriptContext)->frame()->page();
+    Internals::resetToConsistentState(page);
+    InternalSettings::from(page)->reset();
 }
 
 }
diff --git a/Source/WebCore/testing/v8/WebCoreTestSupport.cpp b/Source/WebCore/testing/v8/WebCoreTestSupport.cpp
index 41762ffe8..8633ddf0e 100644
--- a/Source/WebCore/testing/v8/WebCoreTestSupport.cpp
+++ b/Source/WebCore/testing/v8/WebCoreTestSupport.cpp
@@ -61,7 +61,9 @@ void resetInternalsObject(v8::Local<v8::Context> context)
 
     ScriptExecutionContext* scriptContext = getScriptExecutionContext();
     ASSERT(scriptContext->isDocument());
-    InternalSettings::from(static_cast<Document*>(scriptContext)->frame()->page())->reset();
+    Page* page = static_cast<Document*>(scriptContext)->frame()->page();
+    Internals::resetToConsistentState(page);
+    InternalSettings::from(page)->reset();
 }
 
 }
diff --git a/Source/WebKit2/UIProcess/API/efl/ewk_context_request_manager_client_private.h b/Source/WebCore/workers/SharedWorkerStrategy.h
index 311343890..4111e4a17 100644
--- a/Source/WebKit2/UIProcess/API/efl/ewk_context_request_manager_client_private.h
+++ b/Source/WebCore/workers/SharedWorkerStrategy.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2012 Intel Corporation. All rights reserved.
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -23,11 +23,22 @@
  * THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef ewk_context_request_manager_client_private_h
-#define ewk_context_request_manager_client_private_h
+#ifndef SharedWorkerStrategy_h
+#define SharedWorkerStrategy_h
 
-typedef struct Ewk_Context Ewk_Context;
+#if USE(PLATFORM_STRATEGIES)
 
-void ewk_context_request_manager_client_attach(Ewk_Context* context);
+namespace WebCore {
+    
+class SharedWorkerStrategy {
+public:
+protected:
+    virtual ~SharedWorkerStrategy()
+    {
+    }
+};
 
-#endif // ewk_context_request_manager_client_private_h
+}
+#endif // USE(PLATFORM_STRATEGIES)
+
+#endif // SharedWorkerStrategy_h
diff --git a/Source/WebCore/workers/WorkerContext.cpp b/Source/WebCore/workers/WorkerContext.cpp
index d6931cfec..7e8242d87 100644
--- a/Source/WebCore/workers/WorkerContext.cpp
+++ b/Source/WebCore/workers/WorkerContext.cpp
@@ -279,23 +279,23 @@ void WorkerContext::logExceptionToConsole(const String& errorMessage, const Stri
     thread()->workerReportingProxy().postExceptionToWorkerObject(errorMessage, lineNumber, sourceURL);
 }
 
-void WorkerContext::addMessage(MessageSource source, MessageType type, MessageLevel level, const String& message, const String& sourceURL, unsigned lineNumber, PassRefPtr<ScriptCallStack> callStack)
+void WorkerContext::addMessage(MessageSource source, MessageType type, MessageLevel level, const String& message, const String& sourceURL, unsigned lineNumber, PassRefPtr<ScriptCallStack> callStack, unsigned long requestIdentifier)
 {
     if (!isContextThread()) {
         postTask(AddConsoleMessageTask::create(source, type, level, message));
         return;
     }
     thread()->workerReportingProxy().postConsoleMessageToWorkerObject(source, type, level, message, lineNumber, sourceURL);
-    addMessageToWorkerConsole(source, type, level, message, sourceURL, lineNumber, callStack);
+    addMessageToWorkerConsole(source, type, level, message, sourceURL, lineNumber, callStack, requestIdentifier);
 }
 
-void WorkerContext::addMessageToWorkerConsole(MessageSource source, MessageType type, MessageLevel level, const String& message, const String& sourceURL, unsigned lineNumber, PassRefPtr<ScriptCallStack> callStack)
+void WorkerContext::addMessageToWorkerConsole(MessageSource source, MessageType type, MessageLevel level, const String& message, const String& sourceURL, unsigned lineNumber, PassRefPtr<ScriptCallStack> callStack, unsigned long requestIdentifier)
 {
     ASSERT(isContextThread());
     if (callStack)
-        InspectorInstrumentation::addMessageToConsole(this, source, type, level, message, 0, callStack);
+        InspectorInstrumentation::addMessageToConsole(this, source, type, level, message, 0, callStack, requestIdentifier);
     else
-        InspectorInstrumentation::addMessageToConsole(this, source, type, level, message, sourceURL, lineNumber);
+        InspectorInstrumentation::addMessageToConsole(this, source, type, level, message, sourceURL, lineNumber, requestIdentifier);
 }
 
 bool WorkerContext::isContextThread() const
diff --git a/Source/WebCore/workers/WorkerContext.h b/Source/WebCore/workers/WorkerContext.h
index 9841a5e1d..487f76c6c 100644
--- a/Source/WebCore/workers/WorkerContext.h
+++ b/Source/WebCore/workers/WorkerContext.h
@@ -145,7 +145,7 @@ namespace WebCore {
         void applyContentSecurityPolicyFromString(const String& contentSecurityPolicy, ContentSecurityPolicy::HeaderType);
 
         virtual void logExceptionToConsole(const String& errorMessage, const String& sourceURL, int lineNumber, PassRefPtr<ScriptCallStack>);
-        void addMessageToWorkerConsole(MessageSource, MessageType, MessageLevel, const String& message, const String& sourceURL, unsigned lineNumber, PassRefPtr<ScriptCallStack>);
+        void addMessageToWorkerConsole(MessageSource, MessageType, MessageLevel, const String& message, const String& sourceURL, unsigned lineNumber, PassRefPtr<ScriptCallStack>, unsigned long requestIdentifier = 0);
 
     private:
         virtual void refScriptExecutionContext() { ref(); }
@@ -159,7 +159,7 @@ namespace WebCore {
         virtual const KURL& virtualURL() const;
         virtual KURL virtualCompleteURL(const String&) const;
 
-        virtual void addMessage(MessageSource, MessageType, MessageLevel, const String& message, const String& sourceURL, unsigned lineNumber, PassRefPtr<ScriptCallStack>);
+        virtual void addMessage(MessageSource, MessageType, MessageLevel, const String& message, const String& sourceURL, unsigned lineNumber, PassRefPtr<ScriptCallStack>, unsigned long requestIdentifier = 0);
 
         virtual EventTarget* errorEventTarget();
 
diff --git a/Source/WebCore/workers/WorkerContext.idl b/Source/WebCore/workers/WorkerContext.idl
index 1ff5e910b..69b11f1ac 100644
--- a/Source/WebCore/workers/WorkerContext.idl
+++ b/Source/WebCore/workers/WorkerContext.idl
@@ -39,15 +39,15 @@
 
     // WorkerGlobalScope
 #if defined(LANGUAGE_JAVASCRIPT) && LANGUAGE_JAVASCRIPT
-             attribute [Replaceable] WorkerContext self;
+             [Replaceable] readonly attribute  WorkerContext self;
 #endif
-             attribute [Replaceable] WorkerLocation location;
+             [Replaceable] readonly attribute WorkerLocation location;
     void close();
              attribute EventListener onerror;
 
     // WorkerUtils
     [Custom] void importScripts(/*[Variadic] in DOMString urls */);
-             [Replaceable] attribute WorkerNavigator navigator;
+             [Replaceable] readonly attribute WorkerNavigator navigator;
 
     // Timers
     [Custom] long setTimeout(in TimeoutHandler handler, in long timeout);
diff --git a/Source/WebCore/xml/XMLHttpRequest.cpp b/Source/WebCore/xml/XMLHttpRequest.cpp
index f61690854..e79f414e6 100644
--- a/Source/WebCore/xml/XMLHttpRequest.cpp
+++ b/Source/WebCore/xml/XMLHttpRequest.cpp
@@ -3,6 +3,7 @@
  *  Copyright (C) 2005-2007 Alexey Proskuryakov <ap@webkit.org>
  *  Copyright (C) 2007, 2008 Julien Chaffraix <jchaffraix@webkit.org>
  *  Copyright (C) 2008, 2011 Google Inc. All rights reserved.
+ *  Copyright (C) 2012 Intel Corporation
  *
  *  This library is free software; you can redistribute it and/or
  *  modify it under the terms of the GNU Lesser General Public
@@ -175,6 +176,9 @@ XMLHttpRequest::XMLHttpRequest(ScriptExecutionContext* context, PassRefPtr<Secur
     : ActiveDOMObject(context, this)
     , m_async(true)
     , m_includeCredentials(false)
+#if ENABLE(XHR_TIMEOUT)
+    , m_timeoutMilliseconds(0)
+#endif
     , m_state(UNSENT)
     , m_createdDocument(false)
     , m_error(false)
@@ -326,6 +330,20 @@ ArrayBuffer* XMLHttpRequest::responseArrayBuffer(ExceptionCode& ec)
     return m_responseArrayBuffer.get();
 }
 
+#if ENABLE(XHR_TIMEOUT)
+void XMLHttpRequest::setTimeout(unsigned long timeout, ExceptionCode& ec)
+{
+    // FIXME: Need to trigger or update the timeout Timer here, if needed. http://webkit.org/b/98156
+    // XHR2 spec, 4.7.3. "This implies that the timeout attribute can be set while fetching is in progress. If that occurs it will still be measured relative to the start of fetching."
+    if (scriptExecutionContext()->isDocument() && !m_async) {
+        logConsoleError(scriptExecutionContext(), "XMLHttpRequest.timeout cannot be set for synchronous HTTP(S) requests made from the window context.");
+        ec = INVALID_ACCESS_ERR;
+        return;
+    }
+    m_timeoutMilliseconds = timeout;
+}
+#endif
+
 void XMLHttpRequest::setResponseType(const String& responseType, ExceptionCode& ec)
 {
     if (m_state >= LOADING) {
@@ -495,6 +513,15 @@ void XMLHttpRequest::open(const String& method, const KURL& url, bool async, Exc
             ec = INVALID_ACCESS_ERR;
             return;
         }
+
+#if ENABLE(XHR_TIMEOUT)
+        // Similarly, timeouts are disabled for synchronous requests as well.
+        if (m_timeoutMilliseconds > 0) {
+            logConsoleError(scriptExecutionContext(), "Synchronous XMLHttpRequests must not have a timeout value set.");
+            ec = INVALID_ACCESS_ERR;
+            return;
+        }
+#endif
     }
 
     m_method = uppercaseKnownHTTPMethod(method);
@@ -742,6 +769,11 @@ void XMLHttpRequest::createRequest(ExceptionCode& ec)
     options.crossOriginRequestPolicy = UseAccessControl;
     options.securityOrigin = securityOrigin();
 
+#if ENABLE(XHR_TIMEOUT)
+    if (m_timeoutMilliseconds)
+        request.setTimeoutInterval(m_timeoutMilliseconds / 1000.0);
+#endif
+
     m_exceptionCode = 0;
     m_error = false;
 
@@ -1058,6 +1090,13 @@ void XMLHttpRequest::didFail(const ResourceError& error)
         return;
     }
 
+#if ENABLE(XHR_TIMEOUT)
+    if (error.isTimeout()) {
+        didTimeout();
+        return;
+    }
+#endif
+
     // Network failures are already reported to Web Inspector by ResourceLoader.
     if (error.domain() == errorDomainWebKitInternal)
         logConsoleError(scriptExecutionContext(), "XMLHttpRequest cannot load " + error.failingURL() + ". " + error.localizedDescription());
@@ -1182,6 +1221,36 @@ void XMLHttpRequest::didReceiveData(const char* data, int len)
     }
 }
 
+#if ENABLE(XHR_TIMEOUT)
+void XMLHttpRequest::didTimeout()
+{
+    // internalAbort() calls dropProtection(), which may release the last reference.
+    RefPtr<XMLHttpRequest> protect(this);
+    internalAbort();
+
+    clearResponse();
+    clearRequest();
+
+    m_error = true;
+    m_exceptionCode = XMLHttpRequestException::TIMEOUT_ERR;
+
+    if (!m_async) {
+        m_state = DONE;
+        m_exceptionCode = TIMEOUT_ERR;
+        return;
+    }
+
+    changeState(DONE);
+
+    if (!m_uploadComplete) {
+        m_uploadComplete = true;
+        if (m_upload && m_uploadEventsAllowed)
+            m_upload->dispatchEventAndLoadEnd(XMLHttpRequestProgressEvent::create(eventNames().timeoutEvent));
+    }
+    m_progressEventThrottle.dispatchEventAndLoadEnd(XMLHttpRequestProgressEvent::create(eventNames().timeoutEvent));
+}
+#endif
+
 bool XMLHttpRequest::canSuspend() const
 {
     return !m_loader;
diff --git a/Source/WebCore/xml/XMLHttpRequest.h b/Source/WebCore/xml/XMLHttpRequest.h
index cc6cbc50c..c73956696 100644
--- a/Source/WebCore/xml/XMLHttpRequest.h
+++ b/Source/WebCore/xml/XMLHttpRequest.h
@@ -2,6 +2,7 @@
  *  Copyright (C) 2003, 2006, 2008 Apple Inc. All rights reserved.
  *  Copyright (C) 2005, 2006 Alexey Proskuryakov <ap@nypop.com>
  *  Copyright (C) 2011 Google Inc. All rights reserved.
+ *  Copyright (C) 2012 Intel Corporation
  *
  *  This library is free software; you can redistribute it and/or
  *  modify it under the terms of the GNU Lesser General Public
@@ -69,6 +70,9 @@ public:
     };
 
     virtual void contextDestroyed();
+#if ENABLE(XHR_TIMEOUT)
+    virtual void didTimeout();
+#endif
     virtual bool canSuspend() const;
     virtual void suspend(ReasonForSuspension);
     virtual void resume();
@@ -104,6 +108,10 @@ public:
     Document* optionalResponseXML() const { return m_responseDocument.get(); }
     Blob* responseBlob(ExceptionCode&);
     Blob* optionalResponseBlob() const { return m_responseBlob.get(); }
+#if ENABLE(XHR_TIMEOUT)
+    unsigned long timeout() const { return m_timeoutMilliseconds; }
+    void setTimeout(unsigned long timeout, ExceptionCode&);
+#endif
 
     void sendFromInspector(PassRefPtr<FormData>, ExceptionCode&);
 
@@ -133,6 +141,9 @@ public:
     DEFINE_ATTRIBUTE_EVENT_LISTENER(loadend);
     DEFINE_ATTRIBUTE_EVENT_LISTENER(loadstart);
     DEFINE_ATTRIBUTE_EVENT_LISTENER(progress);
+#if ENABLE(XHR_TIMEOUT)
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(timeout);
+#endif
 
     using RefCounted<XMLHttpRequest>::ref;
     using RefCounted<XMLHttpRequest>::deref;
@@ -191,6 +202,9 @@ private:
     String m_mimeTypeOverride;
     bool m_async;
     bool m_includeCredentials;
+#if ENABLE(XHR_TIMEOUT)
+    unsigned long m_timeoutMilliseconds;
+#endif
     RefPtr<Blob> m_responseBlob;
 
     RefPtr<ThreadableLoader> m_loader;
diff --git a/Source/WebCore/xml/XMLHttpRequest.idl b/Source/WebCore/xml/XMLHttpRequest.idl
index 37c694e75..244da04cb 100644
--- a/Source/WebCore/xml/XMLHttpRequest.idl
+++ b/Source/WebCore/xml/XMLHttpRequest.idl
@@ -43,6 +43,7 @@
     attribute EventListener onloadend;
     attribute EventListener onloadstart;
     attribute EventListener onprogress;
+    [Conditional=XHR_TIMEOUT] attribute EventListener ontimeout;
 
     // event handler attributes
     attribute EventListener onreadystatechange;
@@ -54,6 +55,8 @@
     const unsigned short LOADING = 3;
     const unsigned short DONE = 4;
 
+    [Conditional=XHR_TIMEOUT] attribute unsigned long timeout
+        setter raises(DOMException);
     readonly attribute unsigned short readyState;
 
     attribute boolean withCredentials
@@ -117,4 +120,3 @@
     boolean dispatchEvent(in Event evt)
         raises(EventException);
 };
-
diff --git a/Source/WebCore/xml/XMLHttpRequestException.cpp b/Source/WebCore/xml/XMLHttpRequestException.cpp
index c06c07c0d..b8cb2f399 100644
--- a/Source/WebCore/xml/XMLHttpRequestException.cpp
+++ b/Source/WebCore/xml/XMLHttpRequestException.cpp
@@ -36,7 +36,8 @@ static struct XMLHttpRequestExceptionNameDescription {
     const char* const description;
 } exceptions[] = {
     { "NETWORK_ERR", "A network error occurred in synchronous requests." },
-    { "ABORT_ERR", "The user aborted a request in synchronous requests." }
+    { "ABORT_ERR", "The user aborted a request in synchronous requests." },
+    { "TIMEOUT_ERR", "A timeout error occured in synchronous requests." }
 };
 
 bool XMLHttpRequestException::initializeDescription(ExceptionCode ec, ExceptionCodeDescription* description)
diff --git a/Source/WebCore/xml/XMLHttpRequestException.h b/Source/WebCore/xml/XMLHttpRequestException.h
index 7c437ef2f..940e30107 100644
--- a/Source/WebCore/xml/XMLHttpRequestException.h
+++ b/Source/WebCore/xml/XMLHttpRequestException.h
@@ -45,7 +45,8 @@ public:
 
     enum XMLHttpRequestExceptionCode {
         NETWORK_ERR = XMLHttpRequestExceptionOffset + 101,
-        ABORT_ERR
+        ABORT_ERR,
+        TIMEOUT_ERR
     };
 
     static bool initializeDescription(ExceptionCode, ExceptionCodeDescription*);
diff --git a/Source/WebCore/xml/XSLTProcessor.cpp b/Source/WebCore/xml/XSLTProcessor.cpp
index 6cf79379d..21eff80b0 100644
--- a/Source/WebCore/xml/XSLTProcessor.cpp
+++ b/Source/WebCore/xml/XSLTProcessor.cpp
@@ -49,8 +49,8 @@ namespace WebCore {
 static inline void transformTextStringToXHTMLDocumentString(String& text)
 {
     // Modify the output so that it is a well-formed XHTML document with a <pre> tag enclosing the text.
-    text.replace('&', "&amp;");
-    text.replace('<', "&lt;");
+    text.replaceWithLiteral('&', "&amp;");
+    text.replaceWithLiteral('<', "&lt;");
     text = "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n"
         "<!DOCTYPE html PUBLIC \"-//W3C//DTD XHTML 1.0 Strict//EN\" \"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd\">\n"
         "<html xmlns=\"http://www.w3.org/1999/xhtml\">\n"
diff --git a/Source/WebCore/xml/parser/MarkupTokenBase.h b/Source/WebCore/xml/parser/MarkupTokenBase.h
index 599f90cde..20eb9e973 100644
--- a/Source/WebCore/xml/parser/MarkupTokenBase.h
+++ b/Source/WebCore/xml/parser/MarkupTokenBase.h
@@ -145,7 +145,7 @@ public:
         m_data.append(character);
     }
 
-    void beginEndTag(Vector<LChar, 32> characters)
+    void beginEndTag(const Vector<LChar, 32>& characters)
     {
         ASSERT(m_type == TypeSet::Uninitialized);
         m_type = TypeSet::EndTag;
@@ -198,7 +198,7 @@ public:
         m_orAllData |= character;
     }
 
-    void appendToCharacter(Vector<LChar, 32> characters)
+    void appendToCharacter(const Vector<LChar, 32>& characters)
     {
         ASSERT(m_type == TypeSet::Character);
         m_data.appendVector(characters);
@@ -381,19 +381,19 @@ protected:
     }
 #endif // NDEBUG
 
-    inline void appendToName(UChar character)
+    void appendToName(UChar character)
     {
         ASSERT(character);
         m_data.append(character);
         m_orAllData |= character;
     }
 
-    inline const DataVector& name() const
+    const DataVector& name() const
     {
         return m_data;
     }
 
-    inline const String nameString() const
+    String nameString() const
     {
         if (!m_data.size())
             return emptyString();
diff --git a/Source/WebKit/CMakeLists.txt b/Source/WebKit/CMakeLists.txt
index a7983d9f0..5d0e361b0 100644
--- a/Source/WebKit/CMakeLists.txt
+++ b/Source/WebKit/CMakeLists.txt
@@ -43,6 +43,7 @@ SET(WebKit_INCLUDE_DIRECTORIES
     "${WEBCORE_DIR}/svg"
     "${WEBCORE_DIR}/svg/graphics"
     "${WEBCORE_DIR}/svg/properties"
+    "${WEBCORE_DIR}/workers"
     "${JAVASCRIPTCORE_DIR}"
     "${JAVASCRIPTCORE_DIR}/ForwardingHeaders"
     "${JAVASCRIPTCORE_DIR}/API"
diff --git a/Source/WebKit/ChangeLog b/Source/WebKit/ChangeLog
index 39ba4a759..3a5b65973 100644
--- a/Source/WebKit/ChangeLog
+++ b/Source/WebKit/ChangeLog
@@ -1,3 +1,137 @@
+2012-11-06  Laszlo Gombos  <l.gombos@samsung.com>
+
+        [EFL] Simplify the build system
+        https://bugs.webkit.org/show_bug.cgi?id=101392
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Use WTF_USE_3D_GRAPHICS to guard the inclusion of surfaces and textmap 
+        directories under WebCore/graphics to be consistent with 
+        WebCore/PlatformEfl.cmake.
+
+        * PlatformEfl.cmake:
+
+2012-11-04  Halton Huo  <halton.huo@intel.com>
+
+        [EFL] Use _LIBRARIES instead of _LIBRARY
+        https://bugs.webkit.org/show_bug.cgi?id=101042
+
+        Reviewed by Gyuyoung Kim.
+
+        In CMake Find files, _LIBRARY is intended for internal use, should
+        use _LIBRARIES instead.
+
+        * PlatformEfl.cmake: s/_LIBRARY}/_LIBRARIES}
+
+2012-11-01  Seonae Kim  <sunaeluv.kim@samsung.com>
+
+        [EFL][DRT] Support Geolocation
+        https://bugs.webkit.org/show_bug.cgi?id=97427
+
+        Reviewed by Gyuyoung Kim. 
+
+        Add a mock directory to use GeolocationClientMock in DumpRenderTree.
+
+        * PlatformEfl.cmake:
+
+2012-10-31  Otto Derek Cheung  <otcheung@rim.com>
+
+        [BlackBerry] Adding window.external to our port
+        https://bugs.webkit.org/show_bug.cgi?id=100868
+
+        Reviewed by Rob Buis.
+
+        Adding ExternalExtension classes to the BB cmake file.
+
+        * PlatformBlackBerry.cmake:
+
+2012-10-31  Michał Pakuła vel Rutka  <m.pakula@samsung.com>
+
+        [EFL][DRT] EventSender requires contextClick implementation
+        https://bugs.webkit.org/show_bug.cgi?id=86091
+
+        Reviewed by Gyuyoung Kim.
+
+        Add new unit test file, needed due to ewk API changes.
+
+        * PlatformEfl.cmake:
+
+2012-10-30  Peter Wang  <peter.wang@torchmobile.com.cn>
+
+        [BlackBerry] Clean the code of "JavaScriptDebuggerBlackBerry"
+        https://bugs.webkit.org/show_bug.cgi?id=100724
+
+        Reviewed by Rob Buis.
+
+        Remove the code of JavaScriptDebuggerBlackBerry.
+
+        * PlatformBlackBerry.cmake:
+
+2012-10-28  Mark Rowe  <mrowe@apple.com>
+
+        Remove references to unsupported OS and Xcode versions.
+
+        Reviewed by Anders Carlsson.
+
+        * WebKit.xcodeproj/project.pbxproj:
+
+2012-10-26  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r132601.
+        http://trac.webkit.org/changeset/132601
+        https://bugs.webkit.org/show_bug.cgi?id=100494
+
+        It broke the Qt build (Requested by Ossy on #webkit).
+
+        * PlatformEfl.cmake:
+
+2012-10-26  Xiaobo Wang  <xbwang@torchmobile.com.cn>
+
+        [BlackBerry] Support pixel tests for BlackBerry DRT
+        https://bugs.webkit.org/show_bug.cgi?id=100210
+
+        Reviewed by Rob Buis.
+
+        Adds a step to build ImageDiff from Qt for DRT. Most of the works are
+        accomplished by Christopher Wells.
+
+        * PlatformBlackBerry.cmake:
+
+2012-10-24  Alexey Proskuryakov  <ap@apple.com>
+
+        Add a strategy for shared workers
+        https://bugs.webkit.org/show_bug.cgi?id=100165
+
+        EFL build fix by Christophe Dumez.
+
+        Reviewed by Brady Eidson.
+
+        * CMakeLists.txt: Add WebCore/workers to include paths.
+
+2012-10-24  Otto Derek Cheung  <otcheung@rim.com>
+
+        [BlackBerry] Rename GeolocationControllerClientBlackBerry to GeolocationClientBlackBerry
+        https://bugs.webkit.org/show_bug.cgi?id=100250
+
+        Reviewed by Rob Buis.
+
+        Rename GeolocationControllerClientBlackBerry to GeolocationClientBlackBerry
+        to prevent confusion.
+
+        PR 230196
+
+        * PlatformBlackBerry.cmake:
+
+2012-10-23  Hyowon Kim  <hw1008.kim@samsung.com>
+
+        [Texmap][EFL] Add AcceleratedCompositingContextEfl to the build system.
+        https://bugs.webkit.org/show_bug.cgi?id=88630
+
+        Reviewed by Gyuyoung Kim.
+
+        * PlatformEfl.cmake: Add the AcceleratedCompositingContextEfl.cpp file
+        and INCLUDE paths for TEXTURE_MAPPER_GL.
+
 2012-10-18  Kangil Han  <kangil.han@samsung.com>
 
         [EFL] Add unit test for ewk_frame_source_get.
diff --git a/Source/WebKit/PlatformBlackBerry.cmake b/Source/WebKit/PlatformBlackBerry.cmake
index 5daad16a6..96ad15021 100644
--- a/Source/WebKit/PlatformBlackBerry.cmake
+++ b/Source/WebKit/PlatformBlackBerry.cmake
@@ -107,12 +107,12 @@ LIST(APPEND WebKit_SOURCES
     blackberry/WebCoreSupport/DeviceOrientationClientBlackBerry.cpp
     blackberry/WebCoreSupport/DragClientBlackBerry.cpp
     blackberry/WebCoreSupport/EditorClientBlackBerry.cpp
+    blackberry/WebCoreSupport/ExternalExtension.cpp
     blackberry/WebCoreSupport/FrameLoaderClientBlackBerry.cpp
     blackberry/WebCoreSupport/FrameNetworkingContextBlackBerry.cpp
-    blackberry/WebCoreSupport/GeolocationControllerClientBlackBerry.cpp
+    blackberry/WebCoreSupport/GeolocationClientBlackBerry.cpp
     blackberry/WebCoreSupport/IconDatabaseClientBlackBerry.cpp
     blackberry/WebCoreSupport/InspectorClientBlackBerry.cpp
-    blackberry/WebCoreSupport/JavaScriptDebuggerBlackBerry.cpp
     blackberry/WebCoreSupport/NetworkInfoClientBlackBerry.cpp
     blackberry/WebCoreSupport/NotificationPresenterImpl.cpp
     blackberry/WebCoreSupport/PagePopupBlackBerry.cpp
@@ -270,6 +270,18 @@ INSTALL(FILES ${DERIVED_SOURCES_WEBCORE_DIR}/inspectorBB.html
               ${DERIVED_SOURCES_WEBCORE_DIR}/InspectorBackendCommands.js
         DESTINATION ../../usr/share/webkit/inspector/)
 
+IF (NOT PUBLIC_BUILD)
+    # Add the custom target to build the host-side ImageDiff binary.
+    # Reuse the Qt version.
+    ADD_CUSTOM_TARGET(
+        ImageDiff ALL
+        WORKING_DIRECTORY ${TOOLS_DIR}/DumpRenderTree/blackberry/
+        COMMAND ./build
+        DEPENDS ${TOOLS_DIR}/DumpRenderTree/qt/ImageDiff.cpp
+        COMMENT "ImageDiff building..."
+    )
+ENDIF ()
+
 ADD_CUSTOM_TARGET (
     inspector ALL
     command cp ${WEBCORE_DIR}/inspector/front-end/inspector.html ${DERIVED_SOURCES_WEBCORE_DIR}/inspectorBB.html && echo '<script src="inspectorBB.js"></script>'  >> ${DERIVED_SOURCES_WEBCORE_DIR}/inspectorBB.html
diff --git a/Source/WebKit/PlatformEfl.cmake b/Source/WebKit/PlatformEfl.cmake
index baef3800b..5109ac9c6 100644
--- a/Source/WebKit/PlatformEfl.cmake
+++ b/Source/WebKit/PlatformEfl.cmake
@@ -7,6 +7,7 @@ LIST(APPEND WebKit_INCLUDE_DIRECTORIES
     "${WEBCORE_DIR}/platform/efl"
     "${WEBCORE_DIR}/platform/graphics/cairo"
     "${WEBCORE_DIR}/platform/graphics/efl"
+    "${WEBCORE_DIR}/platform/mock"
     "${WEBCORE_DIR}/platform/network/soup"
     ${CAIRO_INCLUDE_DIRS}
     ${ECORE_INCLUDE_DIRS}
@@ -78,7 +79,22 @@ IF (ENABLE_NAVIGATOR_CONTENT_UTILS)
   )
 ENDIF ()
 
+IF (WTF_USE_3D_GRAPHICS)
+  LIST(APPEND WebKit_INCLUDE_DIRECTORIES
+    "${WEBCORE_DIR}/platform/graphics/surfaces"
+    "${WEBCORE_DIR}/platform/graphics/texmap"
+    "${THIRDPARTY_DIR}/ANGLE/include/GLSLANG"
+  )
+ENDIF ()
+
+IF (ENABLE_GEOLOCATION)
+  LIST(APPEND WebKit_INCLUDE_DIRECTORIES
+    "${WEBCORE_DIR}/Modules/geolocation"
+  )
+ENDIF ()
+
 LIST(APPEND WebKit_SOURCES
+    efl/WebCoreSupport/AcceleratedCompositingContextEfl.cpp
     efl/WebCoreSupport/AssertMatchingEnums.cpp
     efl/WebCoreSupport/BatteryClientEfl.cpp
     efl/WebCoreSupport/ChromeClientEfl.cpp
@@ -144,8 +160,8 @@ LIST(APPEND WebKit_LIBRARIES
     ${LIBXML2_LIBRARIES}
     ${SQLITE_LIBRARIES}
     ${FONTCONFIG_LIBRARIES}
-    ${PNG_LIBRARY}
-    ${JPEG_LIBRARY}
+    ${PNG_LIBRARIES}
+    ${JPEG_LIBRARIES}
     ${CMAKE_DL_LIBS}
     ${GLIB_LIBRARIES}
     ${GLIB_GOBJECT_LIBRARIES}
@@ -242,6 +258,7 @@ TARGET_LINK_LIBRARIES(ewkTestUtils ${EWKUnitTests_LIBRARIES})
 SET(WEBKIT_EFL_TEST_DIR "${WEBKIT_DIR}/efl/tests/")
 
 SET(EWKUnitTests_BINARIES
+    test_ewk_contextmenu
     test_ewk_frame
     test_ewk_view
 )
diff --git a/Source/WebKit/WebKit.xcodeproj/project.pbxproj b/Source/WebKit/WebKit.xcodeproj/project.pbxproj
index b59122611..d73e32fa2 100644
--- a/Source/WebKit/WebKit.xcodeproj/project.pbxproj
+++ b/Source/WebKit/WebKit.xcodeproj/project.pbxproj
@@ -1648,8 +1648,6 @@
 				939810BB0824BF01008DF038 /* Sources */,
 				1C395DE20C6BE8E0000D1E52 /* Generate 64-bit Export File */,
 				939811270824BF01008DF038 /* Frameworks */,
-				939D054F09DA02D500984996 /* Check For Global Initializers */,
-				9337D6540EBFE54D00DA3CB5 /* Check For Exit Time Destructors */,
 				5D0D54210E98631D0029E223 /* Check For Weak VTables and Externals */,
 				3713F018142905B70036387F /* Check For Inappropriate Objective-C Class Names */,
 				5D88EE6C11407DE800BC3ABC /* Check For Framework Include Consistency */,
@@ -1819,21 +1817,6 @@
 			shellPath = /bin/sh;
 			shellScript = "if [[ \"${MACOSX_DEPLOYMENT_TARGET}\" > \"10.5\" && \"${CONFIGURATION}\" != \"Production\" && \"${ACTION}\" == \"build\" ]]; then\n    if [[ ! -e \"${CONFIGURATION_BUILD_DIR}/WebKit.framework/WebKitPluginHost.app\" ]]; then\n       ln -s /System/Library/Frameworks/WebKit.framework/WebKitPluginHost.app \"${CONFIGURATION_BUILD_DIR}/WebKit.framework/WebKitPluginHost.app\"\n    fi\nfi\n";
 		};
-		9337D6540EBFE54D00DA3CB5 /* Check For Exit Time Destructors */ = {
-			isa = PBXShellScriptBuildPhase;
-			buildActionMask = 2147483647;
-			files = (
-			);
-			inputPaths = (
-				"$(TARGET_BUILD_DIR)/$(EXECUTABLE_PATH)",
-			);
-			name = "Check For Exit Time Destructors";
-			outputPaths = (
-			);
-			runOnlyForDeploymentPostprocessing = 0;
-			shellPath = /bin/sh;
-			shellScript = "if [ \"${TARGET_GCC_VERSION}\" = \"LLVM_COMPILER\" ]; then\n    exit 0;\nfi\n\nif [ \"${ACTION}\" = \"installhdrs\" ]; then\n    exit 0;\nfi\n\nif [ -f ../../Tools/Scripts/check-for-exit-time-destructors ]; then\n    ../../Tools/Scripts/check-for-exit-time-destructors || exit $?\nfi";
-		};
 		939811300824BF01008DF038 /* Make Frameworks Symbolic Link */ = {
 			isa = PBXShellScriptBuildPhase;
 			buildActionMask = 8;
@@ -1850,21 +1833,6 @@
 			shellPath = /bin/sh;
 			shellScript = "ln -sf Versions/Current/Frameworks \"$TARGET_BUILD_DIR/WebKit.framework/Frameworks\"\n";
 		};
-		939D054F09DA02D500984996 /* Check For Global Initializers */ = {
-			isa = PBXShellScriptBuildPhase;
-			buildActionMask = 2147483647;
-			files = (
-			);
-			inputPaths = (
-				"$(TARGET_BUILD_DIR)/$(EXECUTABLE_PATH)",
-			);
-			name = "Check For Global Initializers";
-			outputPaths = (
-			);
-			runOnlyForDeploymentPostprocessing = 0;
-			shellPath = /bin/sh;
-			shellScript = "if [ \"${TARGET_GCC_VERSION}\" = \"LLVM_COMPILER\" ]; then\n    exit 0;\nfi\n\nif [ \"${ACTION}\" = \"installhdrs\" ]; then\n    exit 0;\nfi\n\nif [ -f ../../Tools/Scripts/check-for-global-initializers ]; then\n    ../../Tools/Scripts/check-for-global-initializers || exit $?\nfi";
-		};
 /* End PBXShellScriptBuildPhase section */
 
 /* Begin PBXSourcesBuildPhase section */
diff --git a/Source/WebKit/blackberry/Api/BackingStore.cpp b/Source/WebKit/blackberry/Api/BackingStore.cpp
index 0c20cdcf4..0dac9cb31 100644
--- a/Source/WebKit/blackberry/Api/BackingStore.cpp
+++ b/Source/WebKit/blackberry/Api/BackingStore.cpp
@@ -359,6 +359,10 @@ void BackingStorePrivate::resumeScreenAndBackingStoreUpdates(BackingStore::Resum
     if (op == BackingStore::None)
         return;
 #if USE(ACCELERATED_COMPOSITING)
+    // It needs layout and render before committing root layer if we set OSDS
+    if (m_webPage->d->needsOneShotDrawingSynchronization())
+        m_webPage->d->requestLayoutIfNeeded();
+
     // This will also blit since we set the OSDS flag above.
     m_webPage->d->commitRootLayerIfNeeded();
 #else
@@ -514,8 +518,7 @@ bool BackingStorePrivate::shouldPerformRegularRenderJobs() const
 }
 
 static const BlackBerry::Platform::Message::Type RenderJobMessageType = BlackBerry::Platform::Message::generateUniqueMessageType();
-class RenderJobMessage : public BlackBerry::Platform::ExecutableMessage
-{
+class RenderJobMessage : public BlackBerry::Platform::ExecutableMessage {
 public:
     RenderJobMessage(BlackBerry::Platform::MessageDelegate* delegate)
         : BlackBerry::Platform::ExecutableMessage(delegate, BlackBerry::Platform::ExecutableMessage::UniqueCoalescing, RenderJobMessageType)
@@ -1200,7 +1203,7 @@ void BackingStorePrivate::paintDefaultBackground(const Platform::IntRect& dstRec
     // make sure it is invalidated.
     const Platform::IntRect pixelContentsRect = viewportAccessor->pixelContentsRect();
     Platform::IntRectRegion overScrollRegion = Platform::IntRectRegion::subtractRegions(
-        dstRect, viewportAccessor->pixelViewportFromContents(pixelContentsRect));
+        clippedDstRect, viewportAccessor->pixelViewportFromContents(pixelContentsRect));
 
     IntRectList overScrollRects = overScrollRegion.rects();
     for (size_t i = 0; i < overScrollRects.size(); ++i) {
@@ -2327,8 +2330,10 @@ void BackingStorePrivate::blitToWindow(const Platform::IntRect& dstRect,
     BlackBerry::Platform::Graphics::Buffer* dstBuffer = buffer();
     ASSERT(dstBuffer);
     ASSERT(srcBuffer);
-    if (!dstBuffer)
-        BBLOG(BlackBerry::Platform::LogLevelWarn, "Empty window buffer, couldn't blitToWindow");
+    if (!dstBuffer) {
+        BBLOG(BlackBerry::Platform::LogLevelWarn,
+            "Empty window buffer, couldn't blitToWindow");
+    }
 
     BlackBerry::Platform::Graphics::BlendMode blendMode = blend
         ? BlackBerry::Platform::Graphics::SourceOver
@@ -2356,8 +2361,10 @@ void BackingStorePrivate::fillWindow(Platform::Graphics::FillPattern pattern,
 
     BlackBerry::Platform::Graphics::Buffer* dstBuffer = buffer();
     ASSERT(dstBuffer);
-    if (!dstBuffer)
-        BBLOG(BlackBerry::Platform::LogLevelWarn, "Empty window buffer, couldn't fillWindow");
+    if (!dstBuffer) {
+        BBLOG(BlackBerry::Platform::LogLevelWarn,
+            "Empty window buffer, couldn't fillWindow");
+    }
 
     BlackBerry::Platform::Graphics::fillBuffer(dstBuffer, pattern, dstRect, contentsOrigin, contentsScale);
 }
@@ -2441,8 +2448,10 @@ void BackingStorePrivate::clearWindow(const Platform::IntRect& rect,
 
     BlackBerry::Platform::Graphics::Buffer* dstBuffer = buffer();
     ASSERT(dstBuffer);
-    if (!dstBuffer)
-        BBLOG(BlackBerry::Platform::LogLevelWarn, "Empty window buffer, couldn't clearWindow");
+    if (!dstBuffer) {
+        BBLOG(BlackBerry::Platform::LogLevelWarn,
+            "Empty window buffer, couldn't clearWindow");
+    }
 
     windowFrontBufferState()->clearBlittedRegion(rect);
     windowBackBufferState()->addBlittedRegion(rect);
diff --git a/Source/WebKit/blackberry/Api/BlackBerryGlobal.cpp b/Source/WebKit/blackberry/Api/BlackBerryGlobal.cpp
index 32a124173..f36e1d904 100644
--- a/Source/WebKit/blackberry/Api/BlackBerryGlobal.cpp
+++ b/Source/WebKit/blackberry/Api/BlackBerryGlobal.cpp
@@ -20,7 +20,6 @@
 #include "BlackBerryGlobal.h"
 
 #include "ApplicationCacheStorage.h"
-#include "AuthenticationChallengeManager.h"
 #include "CacheClientBlackBerry.h"
 #include "CookieManager.h"
 #include "CrossOriginPreflightResultCache.h"
@@ -81,8 +80,6 @@ void globalInitialize()
     BlackBerry::Platform::Settings* settings = BlackBerry::Platform::Settings::instance();
 
     ImageSource::setMaxPixelsPerDecodedImage(settings->maxPixelsPerDecodedImage());
-
-    AuthenticationChallengeManager::init();
 }
 
 void collectJavascriptGarbageNow()
diff --git a/Source/WebKit/blackberry/Api/InRegionScroller.cpp b/Source/WebKit/blackberry/Api/InRegionScroller.cpp
index 0913405f8..db656a932 100644
--- a/Source/WebKit/blackberry/Api/InRegionScroller.cpp
+++ b/Source/WebKit/blackberry/Api/InRegionScroller.cpp
@@ -102,8 +102,7 @@ void InRegionScrollerPrivate::clearDocumentData(const Document* documentGoingAwa
 
     InRegionScrollableArea* scrollableArea = static_cast<InRegionScrollableArea*>(m_activeInRegionScrollableAreas[0]);
     ASSERT(scrollableArea);
-    Node* node = scrollableArea->layer()->enclosingElement();
-    if (node && node->document() == documentGoingAway)
+    if (scrollableArea->document() == documentGoingAway)
         reset();
 }
 
@@ -202,7 +201,7 @@ void InRegionScrollerPrivate::calculateInRegionScrollableAreasForPoint(const Web
     ASSERT(m_activeInRegionScrollableAreas.empty());
     m_needsActiveScrollableAreaCalculation = false;
 
-    HitTestResult result = m_webPage->m_mainFrame->eventHandler()->hitTestResultAtPoint(m_webPage->mapFromViewportToContents(point));
+    const HitTestResult& result = m_webPage->hitTestResult(m_webPage->mapFromViewportToContents(point));
     Node* node = result.innerNonSharedNode();
     if (!node || !node->renderer())
         return;
diff --git a/Source/WebKit/blackberry/Api/WebOverlay_p.h b/Source/WebKit/blackberry/Api/WebOverlay_p.h
index 846e5cc7a..742fe0bb1 100644
--- a/Source/WebKit/blackberry/Api/WebOverlay_p.h
+++ b/Source/WebKit/blackberry/Api/WebOverlay_p.h
@@ -167,8 +167,6 @@ public:
     virtual void notifyAnimationStarted(const WebCore::GraphicsLayer*, double time) { }
     virtual void notifyFlushRequired(const WebCore::GraphicsLayer*);
     virtual void paintContents(const WebCore::GraphicsLayer*, WebCore::GraphicsContext&, WebCore::GraphicsLayerPaintingPhase, const WebCore::IntRect& inClip);
-    virtual bool showDebugBorders(const WebCore::GraphicsLayer*) const { return false; }
-    virtual bool showRepaintCounter(const WebCore::GraphicsLayer*) const { return false; }
     virtual bool contentsVisible(const WebCore::GraphicsLayer*, const WebCore::IntRect& contentRect) const { return true; }
 
 private:
diff --git a/Source/WebKit/blackberry/Api/WebPage.cpp b/Source/WebKit/blackberry/Api/WebPage.cpp
index d008c02df..c08725fd2 100644
--- a/Source/WebKit/blackberry/Api/WebPage.cpp
+++ b/Source/WebKit/blackberry/Api/WebPage.cpp
@@ -60,7 +60,7 @@
 #if !defined(PUBLIC_BUILD) || !PUBLIC_BUILD
 #include "GeolocationClientMock.h"
 #endif
-#include "GeolocationControllerClientBlackBerry.h"
+#include "GeolocationClientBlackBerry.h"
 #include "GroupSettings.h"
 #include "HTMLAreaElement.h"
 #include "HTMLFrameOwnerElement.h"
@@ -81,7 +81,6 @@
 #include "InspectorController.h"
 #include "InspectorInstrumentation.h"
 #include "InspectorOverlay.h"
-#include "JavaScriptDebuggerBlackBerry.h"
 #include "JavaScriptVariant_p.h"
 #include "LayerWebKitThread.h"
 #if ENABLE(NETWORK_INFO)
@@ -398,11 +397,9 @@ WebPagePrivate::WebPagePrivate(WebPage* webPage, WebPageClient* client, const In
     , m_cursorEventMode(ProcessedCursorEvents)
     , m_touchEventMode(ProcessedTouchEvents)
 #endif
-#if ENABLE(FULLSCREEN_API)
-#if ENABLE(VIDEO)
+#if ENABLE(FULLSCREEN_API) && ENABLE(VIDEO)
     , m_scaleBeforeFullScreen(-1.0)
-#endif
-    , m_isTogglingFullScreenState(false)
+    , m_xScrollOffsetBeforeFullScreen(-1)
 #endif
     , m_currentCursor(Platform::CursorNone)
     , m_dumpRenderTree(0) // Lazy initialization.
@@ -432,6 +429,8 @@ WebPagePrivate::WebPagePrivate(WebPage* webPage, WebPageClient* client, const In
     , m_deferredTasksTimer(this, &WebPagePrivate::deferredTasksTimerFired)
     , m_selectPopup(0)
     , m_autofillManager(AutofillManager::create(this))
+    , m_documentStyleRecalcPostponed(false)
+    , m_documentChildNeedsStyleRecalc(false)
 {
     static bool isInitialized = false;
     if (!isInitialized) {
@@ -441,6 +440,7 @@ WebPagePrivate::WebPagePrivate(WebPage* webPage, WebPageClient* client, const In
     }
 
     AuthenticationChallengeManager::instance()->pageCreated(this);
+    clearCachedHitTestResult();
 }
 
 WebPage::WebPage(WebPageClient* client, const BlackBerry::Platform::String& pageGroupName, const Platform::IntRect& rect)
@@ -452,7 +452,6 @@ WebPage::WebPage(WebPageClient* client, const BlackBerry::Platform::String& page
 
 WebPagePrivate::~WebPagePrivate()
 {
-    AuthenticationChallengeManager::instance()->pageDeleted(this);
     // Hand the backingstore back to another owner if necessary.
     m_webPage->setVisible(false);
     if (BackingStorePrivate::currentBackingStoreOwner() == m_webPage)
@@ -494,10 +493,7 @@ WebPagePrivate::~WebPagePrivate()
     m_dumpRenderTree = 0;
 #endif
 
-#if USE(ACCELERATED_COMPOSITING)
-    deleteGuardedObject(m_selectionOverlay);
-    m_selectionOverlay = 0;
-#endif
+    AuthenticationChallengeManager::instance()->pageDeleted(this);
 }
 
 WebPage::~WebPage()
@@ -544,9 +540,8 @@ void WebPagePrivate::init(const BlackBerry::Platform::String& pageGroupName)
         WebCore::provideGeolocationTo(m_page, mock);
         mock->setController(WebCore::GeolocationController::from(m_page));
     } else
-#else
-        WebCore::provideGeolocationTo(m_page, new GeolocationControllerClientBlackBerry(this));
 #endif
+        WebCore::provideGeolocationTo(m_page, new GeolocationClientBlackBerry(this));
 #if !defined(PUBLIC_BUILD) || !PUBLIC_BUILD
     if (getenv("drtRun"))
         WebCore::provideDeviceOrientationTo(m_page, new DeviceOrientationClientMock);
@@ -785,36 +780,25 @@ bool WebPagePrivate::executeJavaScript(const BlackBerry::Platform::String& scrip
         return false;
     }
 
-    JSC::ExecState* exec = m_mainFrame->script()->globalObject(mainThreadNormalWorld())->globalExec();
-    JSGlobalContextRef context = toGlobalRef(exec);
-
-    JSC::JSLockHolder lock(exec);
-    JSType type = JSValueGetType(context, toRef(exec, value));
-
-    switch (type) {
-    case kJSTypeNull:
+    if (value.isUndefined())
+        returnType = JSUndefined;
+    else if (value.isNull())
         returnType = JSNull;
-        break;
-    case kJSTypeBoolean:
+    else if (value.isBoolean())
         returnType = JSBoolean;
-        break;
-    case kJSTypeNumber:
+    else if (value.isNumber())
         returnType = JSNumber;
-        break;
-    case kJSTypeString:
+    else if (value.isString())
         returnType = JSString;
-        break;
-    case kJSTypeObject:
+    else if (value.isObject())
         returnType = JSObject;
-        break;
-    case kJSTypeUndefined:
-    default:
+    else
         returnType = JSUndefined;
-        break;
-    }
 
-    if (returnType == JSBoolean || returnType == JSNumber || returnType == JSString || returnType == JSObject)
+    if (returnType == JSBoolean || returnType == JSNumber || returnType == JSString || returnType == JSObject) {
+        JSC::ExecState* exec = m_mainFrame->script()->globalObject(mainThreadNormalWorld())->globalExec();
         returnValue = result.toString(exec);
+    }
 
     return true;
 }
@@ -837,35 +821,25 @@ bool WebPagePrivate::executeJavaScriptInIsolatedWorld(const ScriptSourceCode& so
         return false;
     }
 
-    JSC::ExecState* exec = m_mainFrame->script()->globalObject(m_isolatedWorld.get())->globalExec();
-    JSGlobalContextRef context = toGlobalRef(exec);
-
-    JSType type = JSValueGetType(context, toRef(exec, value));
-
-    switch (type) {
-    case kJSTypeNull:
+    if (value.isUndefined())
+        returnType = JSUndefined;
+    else if (value.isNull())
         returnType = JSNull;
-        break;
-    case kJSTypeBoolean:
+    else if (value.isBoolean())
         returnType = JSBoolean;
-        break;
-    case kJSTypeNumber:
+    else if (value.isNumber())
         returnType = JSNumber;
-        break;
-    case kJSTypeString:
+    else if (value.isString())
         returnType = JSString;
-        break;
-    case kJSTypeObject:
+    else if (value.isObject())
         returnType = JSObject;
-        break;
-    case kJSTypeUndefined:
-    default:
+    else
         returnType = JSUndefined;
-        break;
-    }
 
-    if (returnType == JSBoolean || returnType == JSNumber || returnType == JSString || returnType == JSObject)
+    if (returnType == JSBoolean || returnType == JSNumber || returnType == JSString || returnType == JSObject) {
+        JSC::ExecState* exec = m_mainFrame->script()->globalObject(mainThreadNormalWorld())->globalExec();
         returnValue = result.toString(exec);
+    }
 
     return true;
 }
@@ -914,6 +888,7 @@ void WebPage::executeJavaScriptFunction(const std::vector<BlackBerry::Platform::
     JSC::ExecState* exec = root->globalObject()->globalExec();
     JSGlobalContextRef ctx = toGlobalRef(exec);
 
+    JSC::JSLockHolder lock(exec);
     WTF::Vector<JSValueRef> argListRef(args.size());
     for (unsigned i = 0; i < args.size(); ++i)
         argListRef[i] = BlackBerryJavaScriptVariantToJSValueRef(ctx, args[i]);
@@ -1280,8 +1255,6 @@ bool WebPagePrivate::zoomAboutPoint(double unclampedScale, const FloatPoint& anc
     // We need to invalidate all tiles both visible and non-visible if we're loading.
     m_backingStore->d->updateTiles(isLoading /* updateVisible */, false /* immediate */);
 
-    m_client->resetBitmapZoomScale(m_transformationMatrix->m11());
-
     bool shouldRender = !isLoading || m_userPerformedManualZoom || forceRendering;
     bool shouldClearVisibleZoom = isLoading && shouldRender;
 
@@ -1291,6 +1264,11 @@ bool WebPagePrivate::zoomAboutPoint(double unclampedScale, const FloatPoint& anc
         m_backingStore->d->clearVisibleZoom();
     }
 
+    m_client->zoomChanged(m_webPage->isMinZoomed(), m_webPage->isMaxZoomed(), !shouldZoomOnEscape(), currentScale());
+
+    if (m_pendingOrientation != -1)
+        m_client->updateInteractionViews();
+
     // Clear window to make sure there are no artifacts.
     if (shouldRender) {
         // Resume all screen updates to the backingstore and render+blit visible contents to screen.
@@ -1300,8 +1278,6 @@ bool WebPagePrivate::zoomAboutPoint(double unclampedScale, const FloatPoint& anc
         m_backingStore->d->resumeScreenAndBackingStoreUpdates(BackingStore::None);
     }
 
-    m_client->zoomChanged(m_webPage->isMinZoomed(), m_webPage->isMaxZoomed(), !shouldZoomOnEscape(), currentScale());
-
     return true;
 }
 
@@ -1733,7 +1709,7 @@ double WebPage::initialScale() const
 
 void WebPage::initializeIconDataBase()
 {
-    IconDatabaseClientBlackBerry::getInstance()->initIconDatabase(d->m_webSettings);
+    IconDatabaseClientBlackBerry::instance()->initIconDatabase(d->m_webSettings);
 }
 
 bool WebPage::isUserScalable() const
@@ -2364,12 +2340,6 @@ Platform::WebContext WebPagePrivate::webContext(TargetDetectionStrategy strategy
     if (node->isElementNode()) {
         Element* element = static_cast<Element*>(node->shadowAncestorNode());
 
-        String webWorksContext(DOMSupport::webWorksContext(element));
-        if (!webWorksContext.stripWhiteSpace().isEmpty()) {
-            context.setFlag(Platform::WebContext::IsWebWorksContext);
-            context.setWebWorksContext(webWorksContext);
-        }
-
         if (DOMSupport::isTextBasedContentEditableElement(element)) {
             if (!canStartSelection) {
                 // Input fields host node is by spec non-editable unless the field itself has content editable enabled.
@@ -2396,6 +2366,20 @@ Platform::WebContext WebPagePrivate::webContext(TargetDetectionStrategy strategy
     if (node->isFocusable())
         context.setFlag(Platform::WebContext::IsFocusable);
 
+    // Walk up the node tree looking for our custom webworks context attribute.
+    while (node) {
+        if (node->isElementNode()) {
+            Element* element = static_cast<Element*>(node->shadowAncestorNode());
+            String webWorksContext(DOMSupport::webWorksContext(element));
+            if (!webWorksContext.stripWhiteSpace().isEmpty()) {
+                context.setFlag(Platform::WebContext::IsWebWorksContext);
+                context.setWebWorksContext(webWorksContext);
+                break;
+            }
+        }
+        node = node->parentNode();
+    }
+
     return context;
 }
 
@@ -3056,8 +3040,8 @@ void WebPagePrivate::zoomBlock()
     }
 
     notifyTransformChanged();
-    m_backingStore->d->resumeScreenAndBackingStoreUpdates(BackingStore::RenderAndBlit);
     m_client->zoomChanged(m_webPage->isMinZoomed(), m_webPage->isMaxZoomed(), !shouldZoomOnEscape(), currentScale());
+    m_backingStore->d->resumeScreenAndBackingStoreUpdates(BackingStore::RenderAndBlit);
 }
 
 void WebPage::blockZoomAnimationFinished()
@@ -3851,30 +3835,6 @@ void WebPagePrivate::setViewportSize(const IntSize& transformedActualVisibleSize
         // If we need layout then render and blit, otherwise just blit as our viewport has changed.
         m_backingStore->d->resumeScreenAndBackingStoreUpdates(needsLayout ? BackingStore::RenderAndBlit : BackingStore::Blit);
     }
-
-#if ENABLE(FULLSCREEN_API)
-    if (m_isTogglingFullScreenState) {
-        if (!m_fullscreenVideoNode) {
-            // When leaving fullscreen mode, we need to restore the scroll position and
-            // zoom level it was at before fullscreen.
-            // FIXME: The cached values might get imprecise if user have rotated the
-            // device while in fullscreen.
-            if (m_scaleBeforeFullScreen > 0) {
-                // Restore the scale when leaving fullscreen. We can't use TransformationMatrix::scale(double) here, as it
-                // will multiply the scale rather than set the scale.
-                // FIXME: We can refactor this into setCurrentScale(double) if it is useful in the future.
-                m_transformationMatrix->setM11(m_scaleBeforeFullScreen);
-                m_transformationMatrix->setM22(m_scaleBeforeFullScreen);
-                m_scaleBeforeFullScreen = -1.0;
-            }
-            m_mainFrame->view()->setScrollPosition(m_scrollOffsetBeforeFullScreen);
-            notifyTransformChanged();
-        }
-
-        m_backingStore->d->resumeScreenAndBackingStoreUpdates(BackingStore::RenderAndBlit);
-        m_isTogglingFullScreenState = false;
-    }
-#endif
 }
 
 void WebPage::setViewportSize(const Platform::IntSize& viewportSize, bool ensureFocusElementVisible)
@@ -3936,15 +3896,13 @@ bool WebPage::mouseEvent(const Platform::MouseEvent& mouseEvent, bool* wheelDelt
         buttonType = MiddleButton;
 
     // Create our event.
-    PlatformMouseEvent platformMouseEvent(d->mapFromTransformed(mouseEvent.position()),
-                                          d->mapFromTransformed(mouseEvent.screenPosition()),
+    PlatformMouseEvent platformMouseEvent(d->mapFromTransformed(mouseEvent.position()), mouseEvent.screenPosition(),
                                           toWebCoreMouseEventType(mouseEvent.type()), clickCount, buttonType, PointingDevice);
     d->m_lastMouseEvent = platformMouseEvent;
     bool success = d->handleMouseEvent(platformMouseEvent);
 
     if (mouseEvent.wheelTicks()) {
-        PlatformWheelEvent wheelEvent(d->mapFromTransformed(mouseEvent.position()),
-                                      d->mapFromTransformed(mouseEvent.screenPosition()),
+        PlatformWheelEvent wheelEvent(d->mapFromTransformed(mouseEvent.position()), mouseEvent.screenPosition(),
                                       0, -mouseEvent.wheelDelta(),
                                       0, -mouseEvent.wheelTicks(),
                                       ScrollByPixelWheelEvent,
@@ -4071,17 +4029,20 @@ bool WebPage::touchEvent(const Platform::TouchEvent& event)
     Platform::TouchEvent tEvent = event;
     for (unsigned i = 0; i < event.m_points.size(); i++) {
         tEvent.m_points[i].m_pos = d->mapFromTransformed(tEvent.m_points[i].m_pos);
-        tEvent.m_points[i].m_screenPos = d->mapFromTransformed(tEvent.m_points[i].m_screenPos);
+        tEvent.m_points[i].m_screenPos = tEvent.m_points[i].m_screenPos;
     }
 
-    if (event.hasGesture(Platform::Gesture::SingleTap))
+    if (event.isSingleTap())
         d->m_pluginMayOpenNewTab = true;
     else if (tEvent.m_type == Platform::TouchEvent::TouchStart || tEvent.m_type == Platform::TouchEvent::TouchCancel)
         d->m_pluginMayOpenNewTab = false;
 
+    if (tEvent.m_type == Platform::TouchEvent::TouchStart)
+        d->clearCachedHitTestResult();
+
     bool handled = false;
 
-    if (d->m_needTouchEvents && !event.hasGesture(Platform::Gesture::Injected))
+    if (d->m_needTouchEvents && !event.m_type != Platform::TouchEvent::TouchInjected)
         handled = d->m_mainFrame->eventHandler()->handleTouchEvent(PlatformTouchEvent(&tEvent));
 
     // Unpress mouse if touch end is consumed by a JavaScript touch handler, otherwise the mouse state will remain pressed
@@ -4101,7 +4062,7 @@ bool WebPage::touchEvent(const Platform::TouchEvent& event)
         return true;
     }
 
-    if (event.hasGesture(Platform::Gesture::TouchHold))
+    if (event.isTouchHold())
         d->m_touchEventHandler->touchHoldEvent();
 #endif
 
@@ -4115,9 +4076,11 @@ void WebPagePrivate::setScrollOriginPoint(const Platform::IntPoint& point)
     if (!m_hasInRegionScrollableAreas)
         return;
 
+    postponeDocumentStyleRecalc();
     m_inRegionScroller->d->calculateInRegionScrollableAreasForPoint(point);
     if (!m_inRegionScroller->d->activeInRegionScrollableAreas().empty())
         m_client->notifyInRegionScrollableAreasChanged(m_inRegionScroller->d->activeInRegionScrollableAreas());
+    resumeDocumentStyleRecalc();
 }
 
 void WebPage::setScrollOriginPoint(const Platform::IntPoint& point)
@@ -4130,9 +4093,9 @@ bool WebPagePrivate::dispatchTouchEventToFullScreenPlugin(PluginView* plugin, co
 {
     NPTouchEvent npTouchEvent;
 
-    if (event.hasGesture(Platform::Gesture::DoubleTap))
+    if (event.isDoubleTap())
         npTouchEvent.type = TOUCH_EVENT_DOUBLETAP;
-    else if (event.hasGesture(Platform::Gesture::TouchHold))
+    else if (event.isTouchHold())
         npTouchEvent.type = TOUCH_EVENT_TOUCHHOLD;
     else {
         switch (event.m_type) {
@@ -4197,7 +4160,7 @@ bool WebPage::touchPointAsMouseEvent(const Platform::TouchPoint& point, bool use
 
     Platform::TouchPoint tPoint = point;
     tPoint.m_pos = d->mapFromTransformed(tPoint.m_pos);
-    tPoint.m_screenPos = d->mapFromTransformed(tPoint.m_screenPos);
+    tPoint.m_screenPos = tPoint.m_screenPos;
 
     return d->m_touchEventHandler->handleTouchPoint(tPoint, useFatFingers);
 }
@@ -4909,108 +4872,6 @@ void WebPage::runLayoutTests()
 #endif
 }
 
-bool WebPage::enableScriptDebugger()
-{
-#if ENABLE(JAVASCRIPT_DEBUGGER)
-    if (d->m_scriptDebugger)
-        return true;
-
-    d->m_scriptDebugger = adoptPtr(new JavaScriptDebuggerBlackBerry(this->d));
-
-    return !!d->m_scriptDebugger;
-#endif
-}
-
-bool WebPage::disableScriptDebugger()
-{
-#if ENABLE(JAVASCRIPT_DEBUGGER)
-    if (!d->m_scriptDebugger)
-        return true;
-
-    d->m_scriptDebugger.clear();
-    return true;
-#endif
-}
-
-void WebPage::addBreakpoint(const unsigned short* url, unsigned urlLength, int lineNumber, const unsigned short* condition, unsigned conditionLength)
-{
-#if ENABLE(JAVASCRIPT_DEBUGGER)
-    if (d->m_scriptDebugger)
-        d->m_scriptDebugger->addBreakpoint(url, urlLength, lineNumber, condition, conditionLength);
-#endif
-}
-
-void WebPage::updateBreakpoint(const unsigned short* url, unsigned urlLength, int lineNumber, const unsigned short* condition, unsigned conditionLength)
-{
-#if ENABLE(JAVASCRIPT_DEBUGGER)
-    if (d->m_scriptDebugger)
-        d->m_scriptDebugger->updateBreakpoint(url, urlLength, lineNumber, condition, conditionLength);
-#endif
-}
-
-void WebPage::removeBreakpoint(const unsigned short* url, unsigned urlLength, int lineNumber)
-{
-#if ENABLE(JAVASCRIPT_DEBUGGER)
-    if (d->m_scriptDebugger)
-        d->m_scriptDebugger->removeBreakpoint(url, urlLength, lineNumber);
-#endif
-}
-
-bool WebPage::pauseOnExceptions()
-{
-#if ENABLE(JAVASCRIPT_DEBUGGER)
-    return d->m_scriptDebugger ? d->m_scriptDebugger->pauseOnExceptions() : false;
-#endif
-}
-
-void WebPage::setPauseOnExceptions(bool pause)
-{
-#if ENABLE(JAVASCRIPT_DEBUGGER)
-    if (d->m_scriptDebugger)
-        d->m_scriptDebugger->setPauseOnExceptions(pause);
-#endif
-}
-
-void WebPage::pauseInDebugger()
-{
-#if ENABLE(JAVASCRIPT_DEBUGGER)
-    if (d->m_scriptDebugger)
-        d->m_scriptDebugger->pauseInDebugger();
-#endif
-}
-
-void WebPage::resumeDebugger()
-{
-#if ENABLE(JAVASCRIPT_DEBUGGER)
-    if (d->m_scriptDebugger)
-        d->m_scriptDebugger->resumeDebugger();
-#endif
-}
-
-void WebPage::stepOverStatementInDebugger()
-{
-#if ENABLE(JAVASCRIPT_DEBUGGER)
-    if (d->m_scriptDebugger)
-        d->m_scriptDebugger->stepOverStatementInDebugger();
-#endif
-}
-
-void WebPage::stepIntoStatementInDebugger()
-{
-#if ENABLE(JAVASCRIPT_DEBUGGER)
-    if (d->m_scriptDebugger)
-        d->m_scriptDebugger->stepIntoStatementInDebugger();
-#endif
-}
-
-void WebPage::stepOutOfFunctionInDebugger()
-{
-#if ENABLE(JAVASCRIPT_DEBUGGER)
-    if (d->m_scriptDebugger)
-        d->m_scriptDebugger->stepOutOfFunctionInDebugger();
-#endif
-}
-
 unsigned WebPage::timeoutForJavaScriptExecution() const
 {
     return Settings::timeoutForJavaScriptExecution(d->m_page->groupName());
@@ -5645,6 +5506,7 @@ bool WebPagePrivate::commitRootLayerIfNeeded()
         return false;
     }
 
+    willComposite();
     m_needsCommit = false;
     // We get here either due to the commit timer, which would have called
     // render if a one shot sync was needed. Or we get called from render
@@ -5677,6 +5539,7 @@ bool WebPagePrivate::commitRootLayerIfNeeded()
             contentsSizeForCompositing,
             drawsRootLayer));
 
+    didComposite();
     return true;
 }
 
@@ -5869,16 +5732,6 @@ void WebPagePrivate::notifyFlushRequired(const GraphicsLayer*)
 {
     scheduleRootLayerCommit();
 }
-
-bool WebPagePrivate::showDebugBorders(const GraphicsLayer*) const
-{
-    return m_page->settings()->showDebugBorders();
-}
-
-bool WebPagePrivate::showRepaintCounter(const GraphicsLayer*) const
-{
-    return m_page->settings()->showRepaintCounter();
-}
 #endif // USE(ACCELERATED_COMPOSITING)
 
 void WebPagePrivate::enterFullscreenForNode(Node* node)
@@ -5964,7 +5817,8 @@ void WebPagePrivate::enterFullScreenForElement(Element* element)
         // When an element goes fullscreen, the viewport size changes and the scroll
         // position might change. So we keep track of it here, in order to restore it
         // once element leaves fullscreen.
-        m_scrollOffsetBeforeFullScreen = m_mainFrame->view()->scrollPosition();
+        WebCore::IntPoint scrollPosition = m_mainFrame->view()->scrollPosition();
+        m_xScrollOffsetBeforeFullScreen = scrollPosition.x();
 
         // The current scale can be clamped to a greater minimum scale when we relayout contents during
         // the change of the viewport size. Cache the current scale so that we can restore it when
@@ -5991,6 +5845,29 @@ void WebPagePrivate::exitFullScreenForElement(Element* element)
         // The Browser chrome has its own fullscreen video widget.
         exitFullscreenForNode(element);
     } else {
+        m_backingStore->d->suspendScreenAndBackingStoreUpdates();
+
+        // When leaving fullscreen mode, we need to restore the 'x' scroll position
+        // before fullscreen.
+        // FIXME: We may need to respect 'y' position as well, because the web page always scrolls to
+        // the top when leaving fullscreen mode.
+        WebCore::IntPoint scrollPosition = m_mainFrame->view()->scrollPosition();
+        m_mainFrame->view()->setScrollPosition(
+            WebCore::IntPoint(m_xScrollOffsetBeforeFullScreen, scrollPosition.y()));
+        m_xScrollOffsetBeforeFullScreen = -1;
+
+        if (m_scaleBeforeFullScreen > 0) {
+            // Restore the scale when leaving fullscreen. We can't use TransformationMatrix::scale(double) here, as it
+            // will multiply the scale rather than set the scale.
+            // FIXME: We can refactor this into setCurrentScale(double) if it is useful in the future.
+            m_transformationMatrix->setM11(m_scaleBeforeFullScreen);
+            m_transformationMatrix->setM22(m_scaleBeforeFullScreen);
+            m_scaleBeforeFullScreen = -1.0;
+        }
+
+        notifyTransformChanged();
+        m_backingStore->d->resumeScreenAndBackingStoreUpdates(BackingStore::RenderAndBlit);
+
         // This is where we would restore the browser's chrome
         // if hidden above.
         client()->fullscreenStop();
@@ -6199,16 +6076,6 @@ WebTapHighlight* WebPage::tapHighlight() const
     return d->m_tapHighlight.get();
 }
 
-void WebPage::setTapHighlight(WebTapHighlight* tapHighlight)
-{
-    d->m_tapHighlight = adoptPtr(tapHighlight);
-}
-
-WebSelectionOverlay* WebPage::selectionOverlay() const
-{
-    return d->m_selectionOverlay;
-}
-
 void WebPage::addOverlay(WebOverlay* overlay)
 {
 #if USE(ACCELERATED_COMPOSITING)
@@ -6342,5 +6209,59 @@ IntSize WebPagePrivate::screenSize() const
     return Platform::Graphics::Screen::primaryScreen()->size();
 }
 
+void WebPagePrivate::postponeDocumentStyleRecalc()
+{
+    if (Document* document = m_mainFrame->document()) {
+        m_documentChildNeedsStyleRecalc = document->childNeedsStyleRecalc();
+        document->clearChildNeedsStyleRecalc();
+
+        m_documentStyleRecalcPostponed = document->isPendingStyleRecalc();
+        document->unscheduleStyleRecalc();
+    }
+}
+
+void WebPagePrivate::resumeDocumentStyleRecalc()
+{
+    if (Document* document = m_mainFrame->document()) {
+        if (m_documentChildNeedsStyleRecalc)
+            document->setChildNeedsStyleRecalc();
+
+        if (m_documentStyleRecalcPostponed)
+            document->scheduleStyleRecalc();
+    }
+
+    m_documentChildNeedsStyleRecalc = false;
+    m_documentStyleRecalcPostponed = false;
+}
+
+const HitTestResult& WebPagePrivate::hitTestResult(const IntPoint& contentPos)
+{
+    if (m_cachedHitTestContentPos != contentPos) {
+        m_cachedHitTestContentPos = contentPos;
+        m_cachedHitTestResult = m_mainFrame->eventHandler()->hitTestResultAtPoint(m_cachedHitTestContentPos, true /*allowShadowContent*/);
+    }
+
+    return m_cachedHitTestResult;
+}
+
+void WebPagePrivate::clearCachedHitTestResult()
+{
+    m_cachedHitTestContentPos = WebCore::IntPoint(-1, -1);
+}
+
+void WebPagePrivate::willComposite()
+{
+    if (!m_page->settings()->developerExtrasEnabled())
+        return;
+    InspectorInstrumentation::willComposite(m_page);
+}
+
+void WebPagePrivate::didComposite()
+{
+    if (!m_page->settings()->developerExtrasEnabled())
+        return;
+    InspectorInstrumentation::didComposite(m_page);
+}
+
 }
 }
diff --git a/Source/WebKit/blackberry/Api/WebPage.h b/Source/WebKit/blackberry/Api/WebPage.h
index 3d7b6c29f..ae59d8f7a 100644
--- a/Source/WebKit/blackberry/Api/WebPage.h
+++ b/Source/WebKit/blackberry/Api/WebPage.h
@@ -73,7 +73,6 @@ class WebPageClient;
 class WebPageCompositor;
 class WebPageGroupLoadDeferrer;
 class WebPagePrivate;
-class WebSelectionOverlay;
 class WebSettings;
 class WebTapHighlight;
 class WebViewportArguments;
@@ -229,27 +228,9 @@ public:
     // Case sensitivity, wrapping, and highlighting all matches are also toggleable.
     bool findNextString(const char*, bool forward, bool caseSensitive, bool wrap, bool highlightAllMatches);
 
-    // JavaScriptDebugger interface.
-    bool enableScriptDebugger();
-    bool disableScriptDebugger();
-
     JSContextRef scriptContext() const;
     JSValueRef windowObject() const;
 
-    void addBreakpoint(const unsigned short* url, unsigned urlLength, int lineNumber, const unsigned short* condition, unsigned conditionLength);
-    void updateBreakpoint(const unsigned short* url, unsigned urlLength, int lineNumber, const unsigned short* condition, unsigned conditionLength);
-    void removeBreakpoint(const unsigned short* url, unsigned urlLength, int lineNumber);
-
-    bool pauseOnExceptions();
-    void setPauseOnExceptions(bool);
-
-    void pauseInDebugger();
-    void resumeDebugger();
-
-    void stepOverStatementInDebugger();
-    void stepIntoStatementInDebugger();
-    void stepOutOfFunctionInDebugger();
-
     unsigned timeoutForJavaScriptExecution() const;
     void setTimeoutForJavaScriptExecution(unsigned ms);
 
@@ -365,9 +346,6 @@ public:
     void resetUserViewportArguments();
 
     WebTapHighlight* tapHighlight() const;
-    void setTapHighlight(WebTapHighlight*);
-
-    WebSelectionOverlay* selectionOverlay() const;
 
     // Adds an overlay that can be modified on the WebKit thread, and
     // whose attributes can be overridden on the compositing thread.
diff --git a/Source/WebKit/blackberry/Api/WebPageClient.h b/Source/WebKit/blackberry/Api/WebPageClient.h
index e3e05c83e..8da4a4f93 100644
--- a/Source/WebKit/blackberry/Api/WebPageClient.h
+++ b/Source/WebKit/blackberry/Api/WebPageClient.h
@@ -113,6 +113,9 @@ public:
     virtual void addMessageToConsole(const unsigned short* message, unsigned messageLength, const unsigned short* source, unsigned sourceLength, unsigned lineNumber) = 0;
     virtual int showAlertDialog(AlertType) = 0;
 
+    virtual BlackBerry::Platform::String serializePageCacheState() const = 0;
+    virtual void deserializePageCacheState(const BlackBerry::Platform::String& state) = 0;
+
     virtual void runJavaScriptAlert(const unsigned short* message, unsigned messageLength, const char* origin, unsigned originLength) = 0;
     virtual bool runJavaScriptConfirm(const unsigned short* message, unsigned messageLength, const char* origin, unsigned originLength) = 0;
     virtual bool runJavaScriptPrompt(const unsigned short* message, unsigned messageLength, const unsigned short* defaultValue, unsigned defaultValueLength, const char* origin, unsigned originLength, BlackBerry::Platform::String& result) = 0;
@@ -129,6 +132,7 @@ public:
     virtual void contentsSizeChanged(const Platform::IntSize&) const = 0;
     virtual void scrollChanged(const Platform::IntPoint&) const = 0;
     virtual void zoomChanged(bool isMinZoomed, bool isMaxZoomed, bool isAtInitialZoom, double newZoom) const = 0;
+    virtual void updateInteractionViews() = 0;
 
     virtual void requestUpdateViewport(int width, int height) = 0;
 
@@ -157,8 +161,10 @@ public:
 
     virtual void cursorChanged(Platform::CursorType, const char* url, int x, int y) = 0;
 
-    virtual void requestGeolocationPermission(Platform::GeoTrackerListener*, void* context, const char* origin, unsigned originLength) = 0;
-    virtual void cancelGeolocationPermission(Platform::GeoTrackerListener*, void* context) = 0;
+    virtual void requestGlobalLocalServicePermission(Platform::GeoTrackerListener*, const BlackBerry::Platform::String& origin) = 0;
+
+    virtual void requestGeolocationPermission(Platform::GeoTrackerListener*, const BlackBerry::Platform::String& origin) = 0;
+    virtual void cancelGeolocationPermission() = 0;
     virtual Platform::NetworkStreamFactory* networkStreamFactory() = 0;
 
     virtual void handleStringPattern(const unsigned short* pattern, unsigned length) = 0;
@@ -256,6 +262,9 @@ public:
     virtual bool createPopupWebView(const Platform::IntRect&) = 0;
     virtual void closePopupWebView() = 0;
 
+    virtual void addSearchProvider(const Platform::String&) = 0;
+    virtual int  isSearchProviderInstalled(const Platform::String&) = 0;
+
     // Match with ChromeClient::CustomHandlersState.
     enum ProtocolHandlersState {
         ProtocolHandlersNew,
diff --git a/Source/WebKit/blackberry/Api/WebPage_p.h b/Source/WebKit/blackberry/Api/WebPage_p.h
index eeb7775e9..de32128f0 100644
--- a/Source/WebKit/blackberry/Api/WebPage_p.h
+++ b/Source/WebKit/blackberry/Api/WebPage_p.h
@@ -20,6 +20,7 @@
 #define WebPage_p_h
 
 #include "ChromeClient.h"
+#include "HitTestResult.h"
 #include "InRegionScroller.h"
 #include "InspectorClientBlackBerry.h"
 #include "InspectorOverlay.h"
@@ -33,6 +34,7 @@
 #include "PageClientBlackBerry.h"
 #include "PlatformMouseEvent.h"
 #include "ScriptSourceCode.h"
+#include "SelectionOverlay.h"
 #include "Timer.h"
 #include "ViewportArguments.h"
 #include "WebPage.h"
@@ -51,9 +53,8 @@ class DOMWrapperWorld;
 class Document;
 class Element;
 class Frame;
-class GeolocationControllerClientBlackBerry;
+class GeolocationClientBlackBerry;
 class GraphicsLayerBlackBerry;
-class JavaScriptDebuggerBlackBerry;
 class LayerWebKitThread;
 class Node;
 class Page;
@@ -400,8 +401,6 @@ public:
     virtual void notifyAnimationStarted(const WebCore::GraphicsLayer*, double time) { }
     virtual void notifyFlushRequired(const WebCore::GraphicsLayer*);
     virtual void paintContents(const WebCore::GraphicsLayer*, WebCore::GraphicsContext&, WebCore::GraphicsLayerPaintingPhase, const WebCore::IntRect& inClip) { }
-    virtual bool showDebugBorders(const WebCore::GraphicsLayer*) const;
-    virtual bool showRepaintCounter(const WebCore::GraphicsLayer*) const;
 
     // WebKit thread, plumbed through from ChromeClientBlackBerry.
     void setRootLayerWebKitThread(WebCore::Frame*, WebCore::LayerWebKitThread*);
@@ -459,8 +458,17 @@ public:
     void applySizeOverride(int overrideWidth, int overrideHeight);
     void setTextZoomFactor(float);
 
+    void postponeDocumentStyleRecalc();
+    void resumeDocumentStyleRecalc();
+
+    const WebCore::HitTestResult& hitTestResult(const WebCore::IntPoint& contentPos);
+    void clearCachedHitTestResult();
+
     WebCore::IntSize screenSize() const;
 
+    void willComposite();
+    void didComposite();
+
     WebPage* m_webPage;
     WebPageClient* m_client;
     WebCore::InspectorClientBlackBerry* m_inspectorClient;
@@ -470,11 +478,7 @@ public:
     WebSettings* m_webSettings;
     WebCookieJar* m_cookieJar;
     OwnPtr<WebTapHighlight> m_tapHighlight;
-    WebSelectionOverlay* m_selectionOverlay;
-
-#if ENABLE(JAVASCRIPT_DEBUGGER)
-    OwnPtr<WebCore::JavaScriptDebuggerBlackBerry> m_scriptDebugger;
-#endif
+    OwnPtr<SelectionOverlay> m_selectionOverlay;
 
     bool m_visible;
     ActivationStateType m_activationState;
@@ -522,9 +526,8 @@ public:
 #if ENABLE(FULLSCREEN_API)
 #if ENABLE(VIDEO)
     double m_scaleBeforeFullScreen;
-    WebCore::IntPoint m_scrollOffsetBeforeFullScreen;
+    int m_xScrollOffsetBeforeFullScreen;
 #endif
-    bool m_isTogglingFullScreenState;
 #endif
 
     Platform::BlackBerryCursor m_currentCursor;
@@ -636,6 +639,12 @@ public:
     WebCore::PagePopupBlackBerry* m_selectPopup;
 
     RefPtr<WebCore::AutofillManager> m_autofillManager;
+
+    bool m_documentStyleRecalcPostponed;
+    bool m_documentChildNeedsStyleRecalc;
+
+    WebCore::IntPoint m_cachedHitTestContentPos;
+    WebCore::HitTestResult m_cachedHitTestResult;
 protected:
     virtual ~WebPagePrivate();
 };
diff --git a/Source/WebKit/blackberry/Api/WebViewportArguments.h b/Source/WebKit/blackberry/Api/WebViewportArguments.h
index e49c25a58..4599b9715 100644
--- a/Source/WebKit/blackberry/Api/WebViewportArguments.h
+++ b/Source/WebKit/blackberry/Api/WebViewportArguments.h
@@ -47,9 +47,8 @@ public:
     // This matches the enum found in WebCore::ViewportArguments
     enum {
         ValueAuto = -1,
-        ValueDesktopWidth = -2,
-        ValueDeviceWidth = -3,
-        ValueDeviceHeight = -4,
+        ValueDeviceWidth = -2,
+        ValueDeviceHeight = -3,
     };
 
     float initialScale() const;
diff --git a/Source/WebKit/blackberry/ChangeLog b/Source/WebKit/blackberry/ChangeLog
index 3555feadd..268a06a98 100644
--- a/Source/WebKit/blackberry/ChangeLog
+++ b/Source/WebKit/blackberry/ChangeLog
@@ -1,3 +1,794 @@
+2012-11-07  Christophe Dumez  <christophe.dumez@intel.com>
+
+        Add replaceWithLiteral() method to WTF::String
+        https://bugs.webkit.org/show_bug.cgi?id=101257
+
+        Reviewed by Benjamin Poulain.
+
+        Substitute String::replace() calls by String::replaceWithLiteral() where
+        adequate, for efficiency.
+
+        * WebCoreSupport/SelectPopupClient.cpp:
+        (WebCore::SelectPopupClient::generateHTML):
+
+2012-11-07  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Remove support for "desktop-width" in the viewport meta tag
+        https://bugs.webkit.org/show_bug.cgi?id=101217
+
+        Reviewed by Gyuyoung Kim.
+
+        Sync WebViewportArguments enum with the one in
+        WebCore::ViewportArguments
+
+        * Api/WebViewportArguments.h:
+
+2012-11-06  Genevieve Mak  <gmak@rim.com>
+
+        [BlackBerry] Crash in InRegionScrollerPrivate.
+        https://bugs.webkit.org/show_bug.cgi?id=101399
+
+        Reviewed by Rob Buis.
+
+        Add a pointer to the enclosing document as the pointer to layer
+        or node along the way may become invalid.
+        Use document pointer in clearDocumentData.
+        PR #238469
+
+        * Api/InRegionScroller.cpp:
+        (BlackBerry::WebKit::InRegionScrollerPrivate::clearDocumentData):
+        * WebKitSupport/InRegionScrollableArea.cpp:
+        (BlackBerry::WebKit::InRegionScrollableArea::InRegionScrollableArea):
+        (BlackBerry::WebKit::InRegionScrollableArea::document):
+        (WebKit):
+        * WebKitSupport/InRegionScrollableArea.h:
+        (WebCore):
+        (InRegionScrollableArea):
+
+2012-11-06  Otto Derek Cheung  <otcheung@rim.com>
+
+        [BlackBerry] Pushing window.external.* events to webplatform
+        https://bugs.webkit.org/show_bug.cgi?id=101386
+
+        Reviewed by Rob Buis.
+
+        Adding calls to trigger window.external events so we can handle them on the
+        browser side.
+
+        PR 170059
+
+        * Api/WebPageClient.h:
+        * WebCoreSupport/ChromeClientBlackBerry.cpp:
+        (WebCore::ChromeClientBlackBerry::addSearchProvider):
+        (WebCore::ChromeClientBlackBerry::isSearchProviderInstalled):
+
+2012-11-06  Otto Derek Cheung  <otcheung@rim.com>
+
+        [BlackBerry] Adding window.external to our port
+        https://bugs.webkit.org/show_bug.cgi?id=100868
+
+        Reviewed by Rob Buis.
+
+        Patching the method names to match the ones in the spec.
+
+        * WebCoreSupport/ExternalExtension.cpp:
+
+2012-11-06  Jacky Jiang  <zhajiang@rim.com>
+
+        [BlackBerry] Page can't back to whole screen after zoom out and orientation change
+        https://bugs.webkit.org/show_bug.cgi?id=101350
+
+        Reviewed by Rob Buis.
+        Internally reviewed by Arvid Nilsson.
+
+        PR: 229321
+        When rotating device during touch interaction, bitmap zooming was
+        unexpected ended by resetBitmapZoomScale() so that it couldn't bounce
+        back. The call resetBitmapZoomScale() is ancient, which just resets the
+        scale of the bitmap before. Right now it only ends the bitmap zooming
+        which caused the issue. As UI viewport will be updated by zoomChanged()
+        right after that, we can remove this trouble maker.
+        Update the interaction views if the rotation is being changed so that
+        ZoomHandler can get the updated views.
+
+        * Api/WebPage.cpp:
+        (BlackBerry::WebKit::WebPagePrivate::zoomAboutPoint):
+        * Api/WebPageClient.h:
+
+2012-11-05  Lianghui Chen  <liachen@rim.com>
+
+        [BlackBerry] Do not show error page for main loads denied by client application
+        https://bugs.webkit.org/show_bug.cgi?id=101287
+
+        Internal PR: 237574.
+        Internally reviewed by Arvid Nilsson, Joe Mason.
+        Reviewed by George Staikos.
+
+        * WebCoreSupport/FrameLoaderClientBlackBerry.cpp:
+        (WebCore::FrameLoaderClientBlackBerry::dispatchDidFailProvisionalLoad):
+
+2012-11-05  Lianghui Chen  <liachen@rim.com>
+
+        [BlackBerry] Do not display error page for failed downloads
+        https://bugs.webkit.org/show_bug.cgi?id=101246
+
+        Internal PR: 236318
+        Internal reviewed by Joe Mason, Leo Yang.
+        Reviewed by Rob Buis.
+
+        Right now when a main load, including all downloads, failed, it will
+        display an error page. This is not very user friendly, especially for
+        WebWorks application, which want to use its own user interface to info
+        user about the failure.
+        So we just stop displaying error page for downloads.
+
+        * WebCoreSupport/FrameLoaderClientBlackBerry.cpp:
+        (WebCore::FrameLoaderClientBlackBerry::dispatchDidFailProvisionalLoad):
+
+2012-11-05  Simon Fraser  <simon.fraser@apple.com>
+
+        Fix layer borders to cleaning appear and disappear on switching
+        https://bugs.webkit.org/show_bug.cgi?id=101136
+
+        Reviewed by Sam Weinig.
+
+        Remove the GraphicsLayerClient methods showDebugBorders() and
+        showRepaintCounter().
+
+        * Api/WebOverlay_p.h:
+        (WebOverlayPrivateWebKitThread):
+        * Api/WebPage.cpp:
+        (BlackBerry::WebKit::WebPagePrivate::notifyFlushRequired):
+        * Api/WebPage_p.h:
+        * WebKitSupport/DefaultTapHighlight.cpp:
+        * WebKitSupport/DefaultTapHighlight.h:
+        (DefaultTapHighlight):
+        * WebKitSupport/InspectorOverlayBlackBerry.cpp:
+        * WebKitSupport/InspectorOverlayBlackBerry.h:
+        (InspectorOverlay):
+        * WebKitSupport/SelectionOverlay.cpp:
+        * WebKitSupport/SelectionOverlay.h:
+        (SelectionOverlay):
+
+2012-11-05  Rob Buis  <rbuis@rim.com>
+
+        [BlackBerry] screenX/Y gives wrong values
+        https://bugs.webkit.org/show_bug.cgi?id=101259
+
+        Reviewed by Yong Li.
+
+        PR 237071
+
+        Reviewed internally by Gen Mak.
+
+        Do not transform screenPos coordinates.
+
+        * Api/WebPage.cpp:
+        (BlackBerry::WebKit::WebPage::mouseEvent):
+        (BlackBerry::WebKit::WebPage::touchEvent):
+        (BlackBerry::WebKit::WebPage::touchPointAsMouseEvent):
+
+2012-11-05  Rob Buis  <rbuis@rim.com>
+
+        [BlackBerry] Input date should not popup dialog when readonly is set
+        https://bugs.webkit.org/show_bug.cgi?id=101234
+
+        Reviewed by Yong Li.
+
+        PR 236114
+
+        Reviewed internally by Mike Fenton.
+
+        Suppress popup dialog if the input element has readonly attribute set.
+
+        * WebKitSupport/InputHandler.cpp:
+        (BlackBerry::WebKit::InputHandler::openDatePopup):
+        (BlackBerry::WebKit::InputHandler::openColorPopup):
+
+2012-11-05  Genevieve Mak  <gmak@rim.com>
+
+        [BLACKBERRY] Update touch code to reflect touch refactor
+        https://bugs.webkit.org/show_bug.cgi?id=101227
+
+        Reviewed by Rob Buis.
+
+        PR #2706785
+        Reviewed Internally by: Mike Lattanzio
+
+        * Api/WebPage.cpp:
+        (BlackBerry::WebKit::WebPage::touchEvent):
+        (BlackBerry::WebKit::WebPagePrivate::dispatchTouchEventToFullScreenPlugin):
+
+2012-11-05  Konrad Piascik  <kpiascik@rim.com>
+
+        [BlackBerry] Web Inspector: Add InspectorInstrumentaiton calls for timeline compositing.
+        https://bugs.webkit.org/show_bug.cgi?id=101213
+        RIM PR 178131
+
+        Reviewed by Rob Buis.
+
+        Internally Reviewed by Arvid Nilsson.
+
+        Added compositing events to the timeline for BlackBerry.
+
+        * Api/WebPage.cpp:
+        (BlackBerry::WebKit::WebPagePrivate::commitRootLayerIfNeeded):
+        (BlackBerry::WebKit::WebPagePrivate::willComposite):
+        (WebKit):
+        (BlackBerry::WebKit::WebPagePrivate::didComposite):
+        * Api/WebPage_p.h:
+        (WebPagePrivate):
+
+2012-11-03  Alexey Proskuryakov  <ap@apple.com>
+
+        Get rid of USE(CFURLSTORAGESESSIONS)
+        https://bugs.webkit.org/show_bug.cgi?id=101131
+
+        Reviewed by Sam Weinig.
+
+        * WebCoreSupport/AboutDataUseFeatures.in: Not sure what this list is about, but
+        CFURLSTORAGESESSIONS probably doesn't need to stay here.
+
+2012-11-02  Nima Ghanavatian  <nghanavatian@rim.com>
+
+        [BlackBerry] Fix compile-time warning of a possible empty-body if statement
+        https://bugs.webkit.org/show_bug.cgi?id=101095
+
+        Reviewed by Yong Li.
+        Internally reviewed by Jeff Rogers.
+
+        BBLOG might be compiled out leaving an if statement with an empty
+        body. This is giving us a warning at the moment. Simply putting braces
+        around it will fail as well because then we'd have braces around a
+        single-line if. So, in following with the style observed in other parts
+        of BackingStore.cpp, break up the log message and add braces.
+
+        * Api/BackingStore.cpp:
+        (BlackBerry::WebKit::BackingStorePrivate::blitToWindow):
+        (BlackBerry::WebKit::BackingStorePrivate::fillWindow):
+        (BlackBerry::WebKit::BackingStorePrivate::clearWindow):
+
+2012-11-02  Nima Ghanavatian  <nghanavatian@rim.com>
+
+        [BlackBerry] Optimize backspace key handling
+        https://bugs.webkit.org/show_bug.cgi?id=101083
+
+        PR233591
+        Optimize backspace key handling. Some of these calls are not
+        required by IMF since the input_service already processes the backspace key
+        and updates the state before passing us the key.
+
+        Internally reviewed by Mike Fenton.
+
+        Reviewed by Yong Li.
+
+        Blocking calls with a flag that we clear immediately after
+        processing a backspace keydown.
+
+        * WebKitSupport/InputHandler.cpp:
+        (BlackBerry::WebKit::InputHandler::nodeTextChanged):
+        (BlackBerry::WebKit::InputHandler::selectionChanged):
+        (BlackBerry::WebKit::InputHandler::handleKeyboardInput):
+        * WebKitSupport/InputHandler.h:
+        (InputHandler):
+
+2012-11-02  Otto Derek Cheung  <otcheung@rim.com>
+
+        [BlackBerry] Adding window.external to our port
+        https://bugs.webkit.org/show_bug.cgi?id=100868
+
+        Reviewed by Rob Buis.
+        PR 158809
+
+        Patch up an error where we were dereferencing a null pointer.
+
+        * WebCoreSupport/ExternalExtension.cpp:
+        (addSearchProviderMethod):
+        (IsSearchProviderInstalledMethod):
+
+2012-11-01  Peter Wang  <peter.wang@torchmobile.com.cn>
+
+        [BlackBerry] Simplify the code of returning JSValue in "BlackBerry::WebKit::WebPagePrivate::executeJavaScript"
+        https://bugs.webkit.org/show_bug.cgi?id=100941
+
+        Reviewed by Yong Li.
+
+        Remove the unnecessary steps, just directly deal with returned JSValue.
+
+        * Api/WebPage.cpp:
+        (BlackBerry::WebKit::WebPagePrivate::executeJavaScript):
+        (BlackBerry::WebKit::WebPagePrivate::executeJavaScriptInIsolatedWorld):
+
+2012-11-01  Otto Derek Cheung  <otcheung@rim.com>
+
+        [BlackBerry] Add a prompt to enable global location services
+        https://bugs.webkit.org/show_bug.cgi?id=100992
+        
+        PR 227897
+
+        Reviewed by Rob Buis.
+
+        Adding a dialog to let the user know location services isn't enabled.
+        Currently, the browser app does not check whether the global setting for
+        location service is enabled. This patch adds a dialog to allow the user
+        to open the settings app and change that setting. This infobar will only
+        show once per session. If the user fails to turn on location services after
+        the first prompt, all geolocation requests will automatically fail.
+
+        Also, adapting GeolocationClientBlackBerry to the removal of GeoTracker.
+        The class now talks directly to the geo handler singleton.
+
+        * Api/WebPageClient.h:
+        * WebCoreSupport/GeolocationClientBlackBerry.cpp:
+        (GeolocationClientBlackBerry::GeolocationClientBlackBerry):
+        (GeolocationClientBlackBerry::geolocationDestroyed):
+        (GeolocationClientBlackBerry::startUpdating):
+        (GeolocationClientBlackBerry::stopUpdating):
+        (GeolocationClientBlackBerry::requestPermission):
+        (GeolocationClientBlackBerry::setEnableHighAccuracy):
+        * WebCoreSupport/GeolocationClientBlackBerry.h:
+        (WebCore::GeolocationClientBlackBerry::requiresHighAccuracy):
+        (GeolocationClientBlackBerry):
+
+2012-11-01  Michael Matovsky  <mmatovsky@rim.com>
+
+        [BlackBerry] Web page view state should be preserved for pages loaded from page cache
+        https://bugs.webkit.org/show_bug.cgi?id=100694
+        Internal PR: 220488
+
+        Internally reviewed by Lianghui Chen, Joe Mason
+        Reviewed by Rob Buis.
+
+        The web page view specific metadata should be preserved for web pages loaded from page cache (by using back/forward).
+        This requires web page view state to be saved in and restored from the corresponding page cache history item.
+
+        * Api/WebPageClient.h:
+        * WebCoreSupport/FrameLoaderClientBlackBerry.cpp:
+        (WebCore::FrameLoaderClientBlackBerry::saveViewStateToItem):
+        (WebCore::FrameLoaderClientBlackBerry::restoreViewState):
+
+2012-11-01  Leo Yang  <leoyang@rim.com>
+
+        [BlackBerry] Use clipped background rect in backing store
+        https://bugs.webkit.org/show_bug.cgi?id=100960
+
+        Reviewed by Yong Li.
+        Reviewed internally by Arvid Nilsson.
+
+        We calculated clipped background rect but didn't really use it when painting
+        the background. Use the correct rect to avoid ASSERT failure in platform code.
+
+        * Api/BackingStore.cpp:
+        (BlackBerry::WebKit::BackingStorePrivate::paintDefaultBackground):
+
+2012-10-31  George Staikos  <staikos@webkit.org>
+
+        [BlackBerry] Crash on html popup form control when element is deleted
+        https://bugs.webkit.org/show_bug.cgi?id=100869
+
+        Reviewed by Yong Li.
+
+        Make the element pointers RefPtr so they don't go away before the popup
+        is closed.
+
+        * WebCoreSupport/ColorPickerClient.h:
+        (ColorPickerClient):
+        * WebCoreSupport/DatePickerClient.h:
+        (DatePickerClient):
+        * WebCoreSupport/SelectPopupClient.h:
+        (SelectPopupClient):
+
+2012-10-31  Genevieve Mak  <gmak@rim.com>
+
+        [BLACKBERRY] Custom WebWorks context menus don't always work.
+        https://bugs.webkit.org/show_bug.cgi?id=100891
+
+        Reviewed by Rob Buis.
+
+        Walk up the dom tree until we find the webworks attribute or run out
+        of parent nodes.
+        PR# 227732
+
+        * Api/WebPage.cpp:
+        (BlackBerry::WebKit::WebPagePrivate::webContext):
+
+2012-10-31  Otto Derek Cheung  <otcheung@rim.com>
+
+        [BlackBerry] Adding window.external to our port
+        https://bugs.webkit.org/show_bug.cgi?id=100868
+
+        Reviewed by Rob Buis.
+
+        Attaching the window.external interface to the frame when
+        it loads up.
+
+        When called, the external interface methods call stubs declared
+        in ChromeClientBlackBerry. The method passes in the url of the search
+        provider and the url of the frame. Cross-site check has to be done in the
+        implementation PR.
+
+        * WebCoreSupport/ChromeClientBlackBerry.cpp:
+        (WebCore::ChromeClientBlackBerry::addSearchProvider):
+        (WebCore):
+        (WebCore::ChromeClientBlackBerry::isSearchProviderInstalled):
+        * WebCoreSupport/ChromeClientBlackBerry.h:
+        (ChromeClientBlackBerry):
+        * WebCoreSupport/ExternalExtension.cpp: Added.
+        (addSearchProviderMethod):
+        (IsSearchProviderInstalledMethod):
+        (externalExtensionInitialize):
+        (externalExtensionFinalize):
+        * WebCoreSupport/ExternalExtension.h: Added.
+        (WebCore):
+        * WebCoreSupport/FrameLoaderClientBlackBerry.cpp:
+        (WebCore::FrameLoaderClientBlackBerry::dispatchDidClearWindowObjectInWorld):
+
+2012-10-30  Peter Wang  <peter.wang@torchmobile.com.cn>
+
+        [BlackBerry] Clean the code of "JavaScriptDebuggerBlackBerry"
+        https://bugs.webkit.org/show_bug.cgi?id=100724
+
+        Reviewed by Rob Buis.
+
+        Remove the code of JavaScriptDebuggerBlackBerry.
+
+        * Api/WebPage.cpp:
+        * Api/WebPage.h:
+        * Api/WebPage_p.h:
+        (WebCore):
+        (WebPagePrivate):
+        * WebCoreSupport/JavaScriptDebuggerBlackBerry.cpp: Removed.
+        * WebCoreSupport/JavaScriptDebuggerBlackBerry.h: Removed.
+
+2012-10-29  Rob Buis  <rbuis@rim.com>
+
+        [BlackBerry] Simplify AuthenticationChallengeManager::instance
+        https://bugs.webkit.org/show_bug.cgi?id=100614
+
+        Reviewed by Yong Li.
+        Internally reviewed by Lyon Chen.
+
+        No need to call AuthenticationChallengeManager::init anymore.
+
+        * Api/BlackBerryGlobal.cpp:
+        (BlackBerry::WebKit::globalInitialize):
+
+2012-10-29  Mike Lattanzio  <mlattanzio@rim.com>
+
+        [BlackBerry] Typo in WebPagePrivate::postponeDocumentRecalcStyle()
+        https://bugs.webkit.org/show_bug.cgi?id=100377
+
+        Reviewed by Adam Treat.
+
+        Should be void, not bool.
+
+        * Api/WebPage.cpp:
+        (BlackBerry::WebKit::WebPagePrivate::postponeDocumentStyleRecalc):
+        * Api/WebPage_p.h:
+        (WebPagePrivate):
+
+2012-10-29  Robin Cao  <robin.cao@torchmobile.com.cn>
+
+        [BlackBerry] Fix a build error
+        https://bugs.webkit.org/show_bug.cgi?id=100649
+
+        Reviewed by Kentaro Hara.
+
+        r127876 changed the signature of WebCore::EventHandler::hitTestResultAtPoint()
+        and this commit was later reverted. We need to update a call site in the
+        BlackBerry port to make it build.
+
+        * Api/WebPage.cpp:
+        (BlackBerry::WebKit::WebPagePrivate::hitTestResult):
+
+2012-10-26  Jacky Jiang  <zhajiang@rim.com>
+
+        [BlackBerry][FullScreen] entering/leaving fullscreen results in temporary glitches on the screen
+        https://bugs.webkit.org/show_bug.cgi?id=100421
+
+        Reviewed by Yong Li.
+
+        PR: 231173
+        When leaving fullscreen, we need to suspend screen and backing store
+        updates before setting scroll position and changing transformation and
+        resume after they are done. In which way, we can get rid of a noticeable
+        glitch during the transition.
+
+        * Api/WebPage.cpp:
+        (BlackBerry::WebKit::WebPagePrivate::exitFullScreenForElement):
+
+2012-10-26  Sean Wang  <Xuewen.Wang@torchmobile.com.cn>
+
+        [BlackBerry] ASSERT currentThreadIsHoldingLock() failed in MarkedAllocator::allocateSlowCase()
+        https://bugs.webkit.org/show_bug.cgi?id=100504
+
+        Reviewed by Yong Li.
+
+        PR #232038 The similar PR # 200724.
+        Reviewed internally by Petter Wang.
+
+        This issue is same as bug 95492, and this patch is same as its patch.
+        Hold the JSLock for the current thread before we call toRef to avoid
+        the ASSERT failure.
+
+        * Api/WebPage.cpp:
+        (BlackBerry::WebKit::WebPagePrivate::executeJavaScriptInIsolatedWorld):
+        (BlackBerry::WebKit::WebPage::executeJavaScriptFunction):
+
+2012-10-25  Sean Wang  <Xuewen.Wang@torchmobile.com.cn>
+
+        [BlackBerry] WebView process crashed at AuthenticationChallengeManager::pageVisibilityChanged()
+        https://bugs.webkit.org/show_bug.cgi?id=100330
+
+        Reviewed by Rob Buis.
+
+        Reviewed internally by Charles Wei.
+        PR #231232
+
+        Since AuthenticationChallengeManager keeps a map of WebPages, WebPage setting
+        visible needs AuthenticationChallengeManager to update its records, deleting
+        webpage from AuthenticationChallengeManager's map should be done after setting
+        webpage visibility.
+
+        * Api/WebPage.cpp:
+        (BlackBerry::WebKit::WebPagePrivate::~WebPagePrivate):
+
+2012-10-24  Sean Wang  <Xuewen.Wang@torchmobile.com.cn>
+
+        [BlackBerry] ASSERT(!needsOneShotDrawingSynchronization()) failed in commitRootLayerIfNeeded()
+        https://bugs.webkit.org/show_bug.cgi?id=100214
+
+        Reviewed by Rob Buis.
+
+        ViewportSize has been changed before committing root layer, it asserts
+        that it needs relayout and render if needed before committing if it
+        Needs One Shot Drawing Synchronization.
+        This patch calls requestLayoutIfNeeded() when resumeScreenAndBackingStoreUpdates().
+
+        Fix a coding style in the BackingStore.cpp as well.
+
+        Reviewed internally by Arvid Nilsson.
+        PR #230253
+
+        * Api/BackingStore.cpp:
+        (BlackBerry::WebKit::BackingStorePrivate::resumeScreenAndBackingStoreUpdates):
+
+2012-10-24  Otto Derek Cheung  <otcheung@rim.com>
+
+        [BlackBerry] Geolocation is segfaulting
+        https://bugs.webkit.org/show_bug.cgi?id=100305
+
+        Reviewed by Rob Buis.
+
+        We weren't wrapping the Geolocation object in a RefPtr when we call setIsAllowed in
+        GeolocationClientBlackBerry::onPermission.
+
+        This patch also removes all references of the Geolocation object in WebPageClientImpl.
+        One RefPtr<Geolocation> is used to store the reference of the WebCore object on our port.
+
+        We don't need a mapping between origin -> context of Geolocation because in our port,
+        one WebPage.cpp contains one GeolocationController only. 
+
+        * Api/WebPageClient.h:
+        * WebCoreSupport/GeolocationClientBlackBerry.cpp:
+        (frameOrigin):
+        (GeolocationClientBlackBerry::requestPermission):
+        (GeolocationClientBlackBerry::cancelPermissionRequest):
+        (GeolocationClientBlackBerry::onPermission):
+        * WebCoreSupport/GeolocationClientBlackBerry.h:
+        (GeolocationClientBlackBerry):
+
+2012-10-24  Jacky Jiang  <zhajiang@rim.com>
+
+        [BlackBerry][Fullscreen] Roll out changes to fullscreen which rely on viewport size change [Part II]
+        https://bugs.webkit.org/show_bug.cgi?id=100259
+
+        Reviewed by Rob Buis.
+
+        PR: 219666
+        Revert "[BlackBerry] [FullScreen] entering/leaving fullscreen results in temporary glitches on the screen"
+        This rolls out r128772.
+        The patches relies on the viewport size change of the client side to
+        resume the screen and backing store updates. However, some client
+        sides don't need or wish to resize the WebKit viewport at all which
+        will result in upexpected screen and backing store suspensions.
+
+        * Api/WebPage.cpp:
+        (BlackBerry::WebKit::WebPagePrivate::WebPagePrivate):
+        (BlackBerry::WebKit::WebPagePrivate::setViewportSize):
+        * Api/WebPage_p.h:
+        (WebPagePrivate):
+        * WebCoreSupport/ChromeClientBlackBerry.cpp:
+        (WebCore::ChromeClientBlackBerry::enterFullScreenForElement):
+        (WebCore::ChromeClientBlackBerry::exitFullScreenForElement):
+
+2012-10-24  Jacky Jiang  <zhajiang@rim.com>
+
+        [BlackBerry][Fullscreen] Roll out changes to fullscreen which rely on viewport size change
+        https://bugs.webkit.org/show_bug.cgi?id=100259
+
+        Reviewed by Rob Buis.
+
+        PR: 219666
+        Roll out r130392 and r129909.
+        The patches rely on the viewport size change of the client side to
+        update the scale and scroll position of the video. However, some client
+        sides don't need or wish to resize the WebKit viewport at all.
+
+        * Api/WebPage.cpp:
+        (BlackBerry::WebKit::WebPagePrivate::WebPagePrivate):
+        (BlackBerry::WebKit::WebPagePrivate::setViewportSize):
+        (BlackBerry::WebKit::WebPagePrivate::enterFullScreenForElement):
+        (BlackBerry::WebKit::WebPagePrivate::exitFullScreenForElement):
+        * Api/WebPage_p.h:
+        (WebPagePrivate):
+
+2012-10-24  Otto Derek Cheung  <otcheung@rim.com>
+
+        [BlackBerry] Rename GeolocationControllerClientBlackBerry to GeolocationClientBlackBerry
+        https://bugs.webkit.org/show_bug.cgi?id=100250
+
+        Reviewed by Rob Buis.
+
+        Rename GeolocationControllerClientBlackBerry to GeolocationClientBlackBerry
+        to prevent confusion.
+        PR 230196
+
+        * Api/WebPage.cpp:
+        (BlackBerry::WebKit::WebPagePrivate::init):
+        * Api/WebPage_p.h:
+        (WebCore):
+        * WebCoreSupport/ChromeClientBlackBerry.cpp:
+        * WebCoreSupport/GeolocationClientBlackBerry.cpp: Renamed from Source/WebKit/blackberry/WebCoreSupport/GeolocationControllerClientBlackBerry.cpp.
+        (frameOrigin):
+        (GeolocationClientBlackBerry::GeolocationClientBlackBerry):
+        (GeolocationClientBlackBerry::geolocationDestroyed):
+        (GeolocationClientBlackBerry::startUpdating):
+        (GeolocationClientBlackBerry::stopUpdating):
+        (GeolocationClientBlackBerry::lastPosition):
+        (GeolocationClientBlackBerry::requestPermission):
+        (GeolocationClientBlackBerry::cancelPermissionRequest):
+        (GeolocationClientBlackBerry::onLocationUpdate):
+        (GeolocationClientBlackBerry::onLocationError):
+        (GeolocationClientBlackBerry::onPermission):
+        (GeolocationClientBlackBerry::setEnableHighAccuracy):
+        * WebCoreSupport/GeolocationClientBlackBerry.h: Renamed from Source/WebKit/blackberry/WebCoreSupport/GeolocationControllerClientBlackBerry.h.
+        (WebKit):
+        (WebCore):
+        (GeolocationClientBlackBerry):
+        (WebCore::GeolocationClientBlackBerry::tracker):
+
+2012-10-24  Parth Patel  <parpatel@rim.com>
+
+        [BlackBerry] Extending existing ThreadUnsafe singletons in webkit to
+        Generic ThreadUnsafe Singleton
+        https://bugs.webkit.org/show_bug.cgi?id=100145
+
+        Reviewed by Rob Buis.
+
+        Extending the singletons to generic singleton and changing
+        getInstance() in IconDatabaseClientBlackBerry to instance()
+        to match the generic singleton template.
+
+        Reviewed Internally by Yong Li.
+
+        * Api/WebPage.cpp:
+        (BlackBerry::WebKit::WebPage::initializeIconDataBase):
+        * WebCoreSupport/IconDatabaseClientBlackBerry.cpp:
+        (WebCore):
+        * WebCoreSupport/IconDatabaseClientBlackBerry.h:
+        (IconDatabaseClientBlackBerry):
+
+2012-10-23  Robin Cao  <robin.cao@torchmobile.com.cn>
+
+        [BlackBerry] Web page renders at the wrong zoom level after viewport changes
+        https://bugs.webkit.org/show_bug.cgi?id=100096
+
+        Reviewed by Rob Buis.
+
+        Notify the client of the zoom level change before resuming screen updates.
+        Otherwise, the user interface thread may blit the content at the wrong
+        zoom level in some cases. This can also prevent potential flickering.
+
+        Reviewed internally by Arvid Nilsson.
+
+        PR #225741
+
+        * Api/WebPage.cpp:
+        (BlackBerry::WebKit::WebPagePrivate::zoomAboutPoint):
+        (BlackBerry::WebKit::WebPagePrivate::zoomBlock):
+
+2012-10-23  Mike Lattanzio  <mlattanzio@rim.com>
+
+        [BlackBerry] Cache TouchDown HitTestResult to avoid calling RenderLayer::hitTest unnecessarily
+        https://bugs.webkit.org/show_bug.cgi?id=99649
+
+        Reviewed by George Staikos.
+
+        Random latency before scroll starts on sites like http://pintrest.com
+        Internal PR225398
+
+        The chief problem here is the all the hit testing that we do for
+        touch events and simulated mouse events. If the render tree is dirty
+        hit tests can take a long time in Document::recalcStyle(). Masking
+        the flags that force style recalculations will make them fast, at the
+        expense that they might be happening on stale data.
+
+        Since we are only using these hit tests to look for event handlers -
+        we're not actually modifying anything, it is better to skip the
+        Document::recalcStyle() and save ourselves tons of time.
+
+        * Api/InRegionScroller.cpp:
+        (BlackBerry::WebKit::InRegionScrollerPrivate::calculateInRegionScrollableAreasForPoint):
+        * Api/WebPage.cpp:
+        (BlackBerry::WebKit::WebPagePrivate::WebPagePrivate):
+        (BlackBerry::WebKit::WebPage::touchEvent):
+        (BlackBerry::WebKit::WebPagePrivate::setScrollOriginPoint):
+        (BlackBerry::WebKit::WebPagePrivate::postponeDocumentStyleRecalc):
+        (WebKit):
+        (BlackBerry::WebKit::WebPagePrivate::resumeDocumentStyleRecalc):
+        (BlackBerry::WebKit::WebPagePrivate::hitTestResult):
+        (BlackBerry::WebKit::WebPagePrivate::clearCachedHitTestResult):
+        * Api/WebPage_p.h:
+        (WebPagePrivate):
+        * WebKitSupport/FatFingers.cpp:
+        (BlackBerry::WebKit::FatFingers::findBestPoint):
+        (BlackBerry::WebKit::FatFingers::getRelevantInfoFromCachedHitTest):
+        * WebKitSupport/FatFingers.h:
+        * WebKitSupport/TouchEventHandler.cpp:
+        (BlackBerry::WebKit::TouchEventHandler::handleTouchPoint):
+
+2012-10-23  Rob Buis  <rbuis@rim.com>
+
+        [BlackBerry] Make selection in search input box not overlap cancel button
+        https://bugs.webkit.org/show_bug.cgi?id=100130
+
+        Reviewed by Antonio Gomes.
+
+        This ensures that even when selection is active, the user can still press 'cancel'.
+
+        * WebKitSupport/InputHandler.cpp:
+        (BlackBerry::WebKit::InputHandler::boundingBoxForInputField):
+
+2012-10-23  Arvid Nilsson  <anilsson@rim.com>
+
+        [BlackBerry] Let WebKit manage the SelectionOverlay
+        https://bugs.webkit.org/show_bug.cgi?id=99585
+
+        Reviewed by Rob Buis.
+
+        The SelectionOverlay was exposed to clients of the BlackBerry::WebKit
+        API. However, all the information and notifications necessary to manage
+        the SelectionOverlay are available within WebKit, so the client does
+        not have to shoulder this responsibility.
+
+        Remove WebSelection and all the related plumbing. Now that nobody is
+        using the class from the user interface thread, remove the message
+        related code in SelectionOverlay.
+
+        Add two calls to SelectionOverlay::hide() that are necessary now that
+        the client is no longer responsible for hiding it.
+
+        RIM PR: 225789
+
+        Reviewed internally by Mike Fenton.
+
+        * Api/WebPage.cpp:
+        (BlackBerry::WebKit::WebPagePrivate::~WebPagePrivate):
+        * Api/WebPage.h:
+        (WebKit):
+        * Api/WebPage_p.h:
+        (WebPagePrivate):
+        * Api/WebSelectionOverlay.h: Removed.
+        * WebKitSupport/SelectionHandler.cpp:
+        (BlackBerry::WebKit::SelectionHandler::cancelSelection): Hide the overlay here, because state is reset and selection mode is no longer active
+        (BlackBerry::WebKit::SelectionHandler::selectionPositionChanged): Also hide overlay here, to go with the call to cancelSelectionVisuals
+        * WebKitSupport/SelectionOverlay.cpp:
+        (BlackBerry::WebKit::SelectionOverlay::SelectionOverlay):
+        * WebKitSupport/SelectionOverlay.h:
+        (BlackBerry::WebKit::SelectionOverlay::create):
+        (SelectionOverlay):
+
 2012-10-22  Mike Fenton  <mifenton@rim.com>
 
         [BlackBerry] Remove specialized handling for isIndex fields.
diff --git a/Source/WebKit/blackberry/WebCoreSupport/AboutDataUseFeatures.in b/Source/WebKit/blackberry/WebCoreSupport/AboutDataUseFeatures.in
index ee6a3df2b..2370f1877 100644
--- a/Source/WebKit/blackberry/WebCoreSupport/AboutDataUseFeatures.in
+++ b/Source/WebKit/blackberry/WebCoreSupport/AboutDataUseFeatures.in
@@ -17,7 +17,6 @@ CF
 CFNETWORK
 CF_NETWORK
 CFURLCACHE
-CFURLSTORAGESESSIONS
 CG
 CG_INTERPOLATION_MEDIUM
 CHROMIUM_NET
diff --git a/Source/WebKit/blackberry/WebCoreSupport/ChromeClientBlackBerry.cpp b/Source/WebKit/blackberry/WebCoreSupport/ChromeClientBlackBerry.cpp
index d259e502d..78c12b2c9 100644
--- a/Source/WebKit/blackberry/WebCoreSupport/ChromeClientBlackBerry.cpp
+++ b/Source/WebKit/blackberry/WebCoreSupport/ChromeClientBlackBerry.cpp
@@ -34,7 +34,7 @@
 #include "FrameLoadRequest.h"
 #include "FrameLoader.h"
 #include "Geolocation.h"
-#include "GeolocationControllerClientBlackBerry.h"
+#include "GeolocationClientBlackBerry.h"
 #include "GraphicsLayer.h"
 #include "HTMLInputElement.h"
 #include "HTMLNames.h"
@@ -736,11 +736,6 @@ bool ChromeClientBlackBerry::supportsFullScreenForElement(const WebCore::Element
 
 void ChromeClientBlackBerry::enterFullScreenForElement(WebCore::Element* element)
 {
-    // To avoid glitches on the screen when entering fullscreen, lets suspend the
-    // Backing Store screen updates and only resume at the next call of WebPagePrivate::setViewportSize.
-    m_webPagePrivate->m_isTogglingFullScreenState = true;
-    m_webPagePrivate->m_backingStore->d->suspendScreenAndBackingStoreUpdates();
-
     element->document()->webkitWillEnterFullScreenForElement(element);
     m_webPagePrivate->enterFullScreenForElement(element);
     element->document()->webkitDidEnterFullScreenForElement(element);
@@ -749,9 +744,6 @@ void ChromeClientBlackBerry::enterFullScreenForElement(WebCore::Element* element
 
 void ChromeClientBlackBerry::exitFullScreenForElement(WebCore::Element*)
 {
-    m_webPagePrivate->m_isTogglingFullScreenState = true;
-    m_webPagePrivate->m_backingStore->d->suspendScreenAndBackingStoreUpdates();
-
     // The element passed into this function is not reliable, i.e. it could
     // be null. In addition the parameter may be disappearing in the future.
     // So we use the reference to the element we saved above.
@@ -844,4 +836,28 @@ void ChromeClientBlackBerry::unregisterProtocolHandler(const String& scheme, con
 #endif
 #endif
 
+void ChromeClientBlackBerry::addSearchProvider(const BlackBerry::Platform::String& originURL, const BlackBerry::Platform::String& newURL)
+{
+    // See if the input URL host matches of the origin host.
+    KURL originHost = KURL(KURL(), originURL);
+    KURL url = KURL(KURL(), newURL);
+    if (url.isValid() && originHost.host() == url.host())
+        m_webPagePrivate->client()->addSearchProvider(newURL);
+}
+
+int ChromeClientBlackBerry::isSearchProviderInstalled(const BlackBerry::Platform::String& originURL, const BlackBerry::Platform::String& newURL)
+{
+//    Returns a value based on comparing url to the URLs of the results pages of the installed search engines.
+//    0 - None of the installed search engines match url.
+//    1 - One or more installed search engines match url, but none are the user's default search engine.
+//    2 - The user's default search engine matches url.
+
+    // See if the input URL host matches of the origin host.
+    KURL originHost = KURL(KURL(), originURL);
+    KURL url = KURL(KURL(), newURL);
+    if (url.isValid() && originHost.host() == url.host())
+        return m_webPagePrivate->client()->isSearchProviderInstalled(newURL);
+    return 0;
+}
+
 } // namespace WebCore
diff --git a/Source/WebKit/blackberry/WebCoreSupport/ChromeClientBlackBerry.h b/Source/WebKit/blackberry/WebCoreSupport/ChromeClientBlackBerry.h
index f35dfe40b..e129f4584 100644
--- a/Source/WebKit/blackberry/WebCoreSupport/ChromeClientBlackBerry.h
+++ b/Source/WebKit/blackberry/WebCoreSupport/ChromeClientBlackBerry.h
@@ -160,6 +160,9 @@ public:
 #endif
 #endif
 
+    virtual void addSearchProvider(const BlackBerry::Platform::String&, const BlackBerry::Platform::String&);
+    virtual int isSearchProviderInstalled(const BlackBerry::Platform::String&, const BlackBerry::Platform::String&);
+
     BlackBerry::WebKit::WebPagePrivate* webPagePrivate() const { return m_webPagePrivate; }
 
 private:
diff --git a/Source/WebKit/blackberry/WebCoreSupport/ColorPickerClient.h b/Source/WebKit/blackberry/WebCoreSupport/ColorPickerClient.h
index 84496519f..2e6fbbe77 100644
--- a/Source/WebKit/blackberry/WebCoreSupport/ColorPickerClient.h
+++ b/Source/WebKit/blackberry/WebCoreSupport/ColorPickerClient.h
@@ -53,7 +53,7 @@ private:
 
     String m_source;
     BlackBerry::WebKit::WebPagePrivate* m_webPage;
-    HTMLInputElement* m_element;
+    RefPtr<HTMLInputElement> m_element;
 };
 } // namespace WebCore
 #endif
diff --git a/Source/WebKit/blackberry/WebCoreSupport/DatePickerClient.h b/Source/WebKit/blackberry/WebCoreSupport/DatePickerClient.h
index 2e3be9ec0..66b20c9c8 100644
--- a/Source/WebKit/blackberry/WebCoreSupport/DatePickerClient.h
+++ b/Source/WebKit/blackberry/WebCoreSupport/DatePickerClient.h
@@ -55,7 +55,7 @@ private:
     BlackBerry::Platform::BlackBerryInputType m_type;
     String m_source;
     BlackBerry::WebKit::WebPagePrivate* m_webPage;
-    HTMLInputElement* m_element;
+    RefPtr<HTMLInputElement> m_element;
 };
 } // namespace WebCore
 #endif
diff --git a/Source/WebKit/blackberry/WebCoreSupport/ExternalExtension.cpp b/Source/WebKit/blackberry/WebCoreSupport/ExternalExtension.cpp
new file mode 100644
index 000000000..0bf9a090b
--- /dev/null
+++ b/Source/WebKit/blackberry/WebCoreSupport/ExternalExtension.cpp
@@ -0,0 +1,146 @@
+/*
+ * Copyright (C) 2012 Research In Motion Limited. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#include "config.h"
+#include "ExternalExtension.h"
+
+#include "Chrome.h"
+#include "ChromeClientBlackBerry.h"
+#include "Frame.h"
+#include "Page.h"
+#include "SecurityOrigin.h"
+#include "WebPageClient.h"
+#include <JavaScriptCore/API/JSCallbackObject.h>
+#include <JavaScriptCore/JSObjectRef.h>
+#include <JavaScriptCore/JSStringRef.h>
+#include <JavaScriptCore/JSValueRef.h>
+#include <JavaScriptCore/JavaScript.h>
+#include <string>
+
+using namespace WebCore;
+using namespace BlackBerry::WebKit;
+using namespace std;
+
+static JSValueRef addSearchProviderMethod(
+    JSContextRef ctx, JSObjectRef functionObject, JSObjectRef thisObject,
+    size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
+{
+    JSValueRef jsRetVal = JSValueMakeUndefined(ctx);
+    if (argumentCount < 1)
+        return jsRetVal;
+
+    // Double check if page chrome client exists
+    Frame* frame = reinterpret_cast<Frame*>(JSObjectGetPrivate(thisObject));
+    if (frame) {
+        Page* page = frame->page();
+        if (!page || !page->chrome())
+            return jsRetVal;
+
+        JSStringRef string = JSValueToStringCopy(ctx, arguments[0], 0);
+        size_t sizeUTF8 = JSStringGetMaximumUTF8CStringSize(string);
+        char* newURL = new char[sizeUTF8];
+        JSStringGetUTF8CString(string, newURL, sizeUTF8);
+        JSStringRelease(string);
+
+        String originURL = frame->document()->securityOrigin()->toString();
+        ChromeClientBlackBerry* chrome = static_cast<ChromeClientBlackBerry*> (page->chrome()->client());
+        chrome->addSearchProvider(originURL, newURL);
+    }
+
+    return jsRetVal;
+}
+
+static JSValueRef IsSearchProviderInstalledMethod(
+    JSContextRef ctx, JSObjectRef functionObject, JSObjectRef thisObject,
+    size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
+{
+    JSValueRef jsRetVal = JSValueMakeUndefined(ctx);
+    if (argumentCount < 1)
+        return jsRetVal;
+
+    // Double check if page chrome client exists
+    Frame* frame = reinterpret_cast<Frame*>(JSObjectGetPrivate(thisObject));
+    if (frame) {
+        Page* page = frame->page();
+        if (!page || !page->chrome())
+            return jsRetVal;
+
+        JSStringRef string = JSValueToStringCopy(ctx, arguments[0], 0);
+        size_t sizeUTF8 = JSStringGetMaximumUTF8CStringSize(string);
+        char* newURL = new char[sizeUTF8];
+        JSStringGetUTF8CString(string, newURL, sizeUTF8);
+        JSStringRelease(string);
+
+        String originURL = frame->document()->securityOrigin()->toString();
+        ChromeClientBlackBerry* chrome = static_cast<ChromeClientBlackBerry*> (page->chrome()->client());
+        int retVal = chrome->isSearchProviderInstalled(originURL, newURL);
+
+        jsRetVal = JSValueMakeNumber(ctx, retVal);
+    }
+
+    return jsRetVal;
+}
+
+static void externalExtensionInitialize(JSContextRef context, JSObjectRef object)
+{
+    UNUSED_PARAM(context);
+    UNUSED_PARAM(object);
+}
+
+static void externalExtensionFinalize(JSObjectRef object)
+{
+    UNUSED_PARAM(object);
+}
+
+static JSStaticFunction externalExtensionStaticFunctions[] = {
+    { "AddSearchProvider", addSearchProviderMethod, kJSPropertyAttributeNone },
+    { "IsSearchProviderInstalled", IsSearchProviderInstalledMethod, kJSPropertyAttributeReadOnly },
+    { 0, 0, 0 }
+};
+
+static JSStaticValue externalExtensionStaticValues[] = {
+    { 0, 0, 0, 0 }
+};
+
+// FIXME: Revisit the creation of this class and make sure this is the best way to approach it.
+void attachExternalExtensionObjectToFrame(Frame* frame)
+{
+    JSDOMWindow* window = frame->script()->windowShell(mainThreadNormalWorld())->window();
+
+    JSC::ExecState* exec = window->globalExec();
+    JSC::JSLockHolder lock(exec);
+
+    JSContextRef scriptCtx = toRef(exec);
+
+    JSClassDefinition definition = kJSClassDefinitionEmpty;
+    definition.staticValues = externalExtensionStaticValues;
+    definition.staticFunctions = externalExtensionStaticFunctions;
+    definition.initialize = externalExtensionInitialize;
+    definition.finalize = externalExtensionFinalize;
+    JSClassRef clientClass = JSClassCreate(&definition);
+
+    JSObjectRef clientClassObject = JSObjectMake(scriptCtx, clientClass, 0);
+    JSObjectSetPrivate(clientClassObject, reinterpret_cast<void*>(frame));
+
+    String name("external");
+
+    JSC::PutPropertySlot slot;
+    window->put(window, exec, JSC::Identifier(exec, name), toJS(clientClassObject), slot);
+
+    JSClassRelease(clientClass);
+}
diff --git a/Source/WebKit/blackberry/Api/WebSelectionOverlay.h b/Source/WebKit/blackberry/WebCoreSupport/ExternalExtension.h
index 6deec358d..660c53db2 100644
--- a/Source/WebKit/blackberry/Api/WebSelectionOverlay.h
+++ b/Source/WebKit/blackberry/WebCoreSupport/ExternalExtension.h
@@ -16,26 +16,13 @@
  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
  */
 
-#ifndef WebSelectionOverlay_h
-#define WebSelectionOverlay_h
+#ifndef ExternalExtension_h
+#define ExternalExtension_h
 
-#include "BlackBerryGlobal.h"
+namespace WebCore {
+class Frame;
+}
 
-#include <BlackBerryPlatformGuardedPointer.h>
-#include <BlackBerryPlatformIntRectRegion.h>
+void attachExternalExtensionObjectToFrame(WebCore::Frame*);
 
-namespace BlackBerry {
-namespace WebKit {
-
-class BLACKBERRY_EXPORT WebSelectionOverlay : public BlackBerry::Platform::GuardedPointerBase {
-public:
-    virtual ~WebSelectionOverlay() { }
-
-    virtual void draw(const Platform::IntRectRegion&) = 0;
-    virtual void hide() = 0;
-};
-
-} // namespace WebKit
-} // namespace BlackBerry
-
-#endif // WebSelectionOverlay_h
+#endif // ExternalExtension_h
diff --git a/Source/WebKit/blackberry/WebCoreSupport/FrameLoaderClientBlackBerry.cpp b/Source/WebKit/blackberry/WebCoreSupport/FrameLoaderClientBlackBerry.cpp
index 44ce0d63a..4b0fd9b4a 100644
--- a/Source/WebKit/blackberry/WebCoreSupport/FrameLoaderClientBlackBerry.cpp
+++ b/Source/WebKit/blackberry/WebCoreSupport/FrameLoaderClientBlackBerry.cpp
@@ -33,6 +33,7 @@
 #include "CredentialManager.h"
 #include "CredentialTransformData.h"
 #include "DumpRenderTreeClient.h"
+#include "ExternalExtension.h"
 #include "FrameNetworkingContextBlackBerry.h"
 #include "FrameView.h"
 #include "HTMLFormElement.h"
@@ -708,33 +709,44 @@ void FrameLoaderClientBlackBerry::dispatchDidFailProvisionalLoad(const ResourceE
     if (!isMainFrame())
         return;
 
-    String errorPage = m_webPagePrivate->m_client->getErrorPage(error.errorCode(), error.localizedDescription(), error.failingURL());
+    if (error.domain() == ResourceError::platformErrorDomain
+        && (error.errorCode() == BlackBerry::Platform::FilterStream::StatusDeniedByApplication)) {
+        // Do not display error page for loading DENYed by application.
+        return;
+    }
 
     // Make sure we're still in the provisionalLoad state - getErrorPage runs a
     // nested event loop while it's waiting for client resources to load so
     // there's a small window for the user to hit stop.
-    if (m_frame->loader()->provisionalDocumentLoader()) {
-        SubstituteData errorData(utf8Buffer(errorPage), "text/html", "utf-8", KURL(KURL(), error.failingURL()));
-
-        ResourceRequest originalRequest = m_frame->loader()->provisionalDocumentLoader()->originalRequest();
-
-        // Loading using SubstituteData will replace the original request with our
-        // error data. This must be done within dispatchDidFailProvisionalLoad,
-        // and do NOT call stopAllLoaders first, because the loader checks the
-        // provisionalDocumentLoader to decide the load type; if called any other
-        // way, the error page is added to the end of the history instead of
-        // replacing the failed load.
-        //
-        // If this comes from a back/forward navigation, we need to save the current viewstate
-        // to original historyitem, and prevent the restore of view state to the error page.
-        if (isBackForwardLoadType(m_frame->loader()->loadType())) {
-            m_frame->loader()->history()->saveScrollPositionAndViewStateToItem(m_frame->loader()->history()->currentItem());
-            ASSERT(m_frame->loader()->history()->provisionalItem());
-            m_frame->loader()->history()->provisionalItem()->viewState().shouldSaveViewState = false;
-        }
-        m_loadingErrorPage = true;
-        m_frame->loader()->load(originalRequest, errorData, false);
+    if (!m_frame->loader()->provisionalDocumentLoader())
+        return;
+
+    ResourceRequest originalRequest = m_frame->loader()->provisionalDocumentLoader()->originalRequest();
+
+    // Do not show error page for a failed download.
+    if (originalRequest.forceDownload())
+        return;
+
+    String errorPage = m_webPagePrivate->m_client->getErrorPage(error.errorCode(), error.localizedDescription(), error.failingURL());
+    SubstituteData errorData(utf8Buffer(errorPage), "text/html", "utf-8", KURL(KURL(), error.failingURL()));
+
+    // Loading using SubstituteData will replace the original request with our
+    // error data. This must be done within dispatchDidFailProvisionalLoad,
+    // and do NOT call stopAllLoaders first, because the loader checks the
+    // provisionalDocumentLoader to decide the load type; if called any other
+    // way, the error page is added to the end of the history instead of
+    // replacing the failed load.
+    //
+    // If this comes from a back/forward navigation, we need to save the current viewstate
+    // to original historyitem, and prevent the restore of view state to the error page.
+    if (isBackForwardLoadType(m_frame->loader()->loadType())) {
+        m_frame->loader()->history()->saveScrollPositionAndViewStateToItem(m_frame->loader()->history()->currentItem());
+        ASSERT(m_frame->loader()->history()->provisionalItem());
+        m_frame->loader()->history()->provisionalItem()->viewState().shouldSaveViewState = false;
     }
+
+    m_loadingErrorPage = true;
+    m_frame->loader()->load(originalRequest, errorData, false);
 }
 
 void FrameLoaderClientBlackBerry::dispatchWillSubmitForm(FramePolicyFunction function, PassRefPtr<FormState>)
@@ -906,6 +918,8 @@ void FrameLoaderClientBlackBerry::dispatchDidClearWindowObjectInWorld(DOMWrapper
     if (m_webPagePrivate->m_enableQnxJavaScriptObject)
         attachExtensionObjectToFrame(m_frame, m_webPagePrivate->m_client);
 
+    attachExternalExtensionObjectToFrame(m_frame);
+
     m_webPagePrivate->m_client->notifyWindowObjectCleared();
 
     if (m_webPagePrivate->m_dumpRenderTree) {
@@ -1040,6 +1054,7 @@ void FrameLoaderClientBlackBerry::saveViewStateToItem(HistoryItem* item)
         viewState.minimumScale = m_webPagePrivate->m_minimumScale;
         viewState.maximumScale = m_webPagePrivate->m_maximumScale;
         viewState.isUserScalable = m_webPagePrivate->m_userScalable;
+        viewState.webPageClientState = m_webPagePrivate->m_client->serializePageCacheState();
     }
 }
 
@@ -1057,6 +1072,9 @@ void FrameLoaderClientBlackBerry::restoreViewState()
     HistoryItemViewState& viewState = currentItem->viewState();
     if (!viewState.shouldSaveViewState)
         return;
+
+    m_webPagePrivate->m_client->deserializePageCacheState(viewState.webPageClientState);
+
     // WebPagePrivate is messing up FrameView::wasScrolledByUser() by sending
     // scroll events that look like they were user generated all the time.
     //
diff --git a/Source/WebKit/blackberry/WebCoreSupport/GeolocationClientBlackBerry.cpp b/Source/WebKit/blackberry/WebCoreSupport/GeolocationClientBlackBerry.cpp
new file mode 100644
index 000000000..111c59aae
--- /dev/null
+++ b/Source/WebKit/blackberry/WebCoreSupport/GeolocationClientBlackBerry.cpp
@@ -0,0 +1,135 @@
+/*
+ * Copyright (C) 2010, 2011, 2012 Research In Motion Limited. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#include "config.h"
+#include "GeolocationClientBlackBerry.h"
+
+#include "Chrome.h"
+#include "Geolocation.h"
+#include "GeolocationController.h"
+#include "GeolocationError.h"
+#include "Page.h"
+#include "WebPage_p.h"
+
+#include <BlackBerryPlatformString.h>
+
+using namespace WebCore;
+
+static const BlackBerry::Platform::String frameOrigin(Frame* frame)
+{
+    DOMWindow* window = frame->document()->domWindow();
+    SecurityOrigin* origin = window->document()->securityOrigin();
+    return BlackBerry::Platform::String(origin->toString().utf8().data());
+}
+
+GeolocationClientBlackBerry::GeolocationClientBlackBerry(BlackBerry::WebKit::WebPagePrivate* webPagePrivate)
+    : m_webPagePrivate(webPagePrivate)
+    , m_accuracy(false)
+    , m_isActive(false)
+{
+}
+
+void GeolocationClientBlackBerry::geolocationDestroyed()
+{
+    delete this;
+}
+
+void GeolocationClientBlackBerry::startUpdating()
+{
+    if (!m_isActive)
+        BlackBerry::Platform::GeolocationHandler::instance()->addListener(this, false);
+    m_isActive = true;
+}
+
+void GeolocationClientBlackBerry::stopUpdating()
+{
+    if (m_isActive)
+        BlackBerry::Platform::GeolocationHandler::instance()->removeListener(this);
+    m_isActive = false;
+}
+
+GeolocationPosition* GeolocationClientBlackBerry::lastPosition()
+{
+    return m_lastPosition.get();
+}
+
+void GeolocationClientBlackBerry::requestPermission(Geolocation* location)
+{
+    Frame* frame = location->frame();
+    if (!frame)
+        return;
+
+    // FIXME: The geolocation setting for WebSettings is always true. Nothing ever toggles that setting.
+    if (!m_webPagePrivate->m_webSettings->isGeolocationEnabled()) {
+        location->setIsAllowed(false);
+        return;
+    }
+
+    DOMWindow* window = frame->document()->domWindow();
+    if (!window)
+        return;
+
+    const BlackBerry::Platform::String origin = frameOrigin(frame);
+    m_pendingPermissionGeolocation = location;
+
+    // Check global location setting, if it is off then we request an infobar that invokes a location settings card.
+    // If it's on, then we request an infobar that allows the site to have permission to use geolocation.
+    if (!BlackBerry::Platform::GeolocationHandler::instance()->isGlobalServiceActive()) {
+        // We only want to ask them once per session. If we get here again, automatically fail the request.
+        if (!BlackBerry::Platform::GeolocationHandler::instance()->didAskUserForGlobalPermission()) {
+            m_webPagePrivate->m_client->requestGlobalLocalServicePermission(this, origin);
+            BlackBerry::Platform::GeolocationHandler::instance()->setAskedUserForGlobalPermission();
+        } else
+            onPermission(false);
+        return;
+    }
+
+    m_webPagePrivate->m_client->requestGeolocationPermission(this, origin);
+}
+
+void GeolocationClientBlackBerry::cancelPermissionRequest(Geolocation* location)
+{
+    m_webPagePrivate->m_client->cancelGeolocationPermission();
+}
+
+void GeolocationClientBlackBerry::onLocationUpdate(double timestamp, double latitude, double longitude, double accuracy, double altitude, bool altitudeValid,
+                                                             double altitudeAccuracy, bool altitudeAccuracyValid, double speed, bool speedValid, double heading, bool headingValid)
+{
+    m_lastPosition = GeolocationPosition::create(timestamp, latitude, longitude, accuracy, altitudeValid, altitude, altitudeAccuracyValid,
+                                                 altitudeAccuracy, headingValid, heading, speedValid, speed);
+    GeolocationController::from(m_webPagePrivate->m_page)->positionChanged(m_lastPosition.get());
+}
+
+void GeolocationClientBlackBerry::onLocationError(const char* errorStr)
+{
+    RefPtr<GeolocationError> error = GeolocationError::create(GeolocationError::PositionUnavailable, String::fromUTF8(errorStr));
+    GeolocationController::from(m_webPagePrivate->m_page)->errorOccurred(error.get());
+}
+
+void GeolocationClientBlackBerry::onPermission(bool isAllowed)
+{
+    if (m_pendingPermissionGeolocation)
+        m_pendingPermissionGeolocation->setIsAllowed(isAllowed);
+}
+
+void GeolocationClientBlackBerry::setEnableHighAccuracy(bool newAccuracy)
+{
+    // FIXME: we have to implement high accuracy on our side too
+    m_accuracy = newAccuracy;
+}
+
diff --git a/Source/WebKit/blackberry/WebCoreSupport/GeolocationControllerClientBlackBerry.h b/Source/WebKit/blackberry/WebCoreSupport/GeolocationClientBlackBerry.h
index ab56d62d3..c2f034504 100644
--- a/Source/WebKit/blackberry/WebCoreSupport/GeolocationControllerClientBlackBerry.h
+++ b/Source/WebKit/blackberry/WebCoreSupport/GeolocationClientBlackBerry.h
@@ -16,8 +16,8 @@
  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
  */
 
-#ifndef GeolocationControllerClientBlackBerry_h
-#define GeolocationControllerClientBlackBerry_h
+#ifndef GeolocationClientBlackBerry_h
+#define GeolocationClientBlackBerry_h
 
 #include <BlackBerryPlatformGeoTracker.h>
 #include <BlackBerryPlatformGeoTrackerListener.h>
@@ -32,9 +32,9 @@ class WebPagePrivate;
 
 namespace WebCore {
 
-class GeolocationControllerClientBlackBerry : public GeolocationClient, public BlackBerry::Platform::GeoTrackerListener {
+class GeolocationClientBlackBerry : public GeolocationClient, public BlackBerry::Platform::GeoTrackerListener {
 public:
-    GeolocationControllerClientBlackBerry(BlackBerry::WebKit::WebPagePrivate*);
+    GeolocationClientBlackBerry(BlackBerry::WebKit::WebPagePrivate*);
 
     virtual void geolocationDestroyed();
     virtual void startUpdating();
@@ -44,18 +44,19 @@ public:
     virtual void requestPermission(Geolocation*);
     virtual void cancelPermissionRequest(Geolocation*);
 
+    virtual bool requiresHighAccuracy() { return m_accuracy; }
     virtual void onLocationUpdate(double timestamp, double latitude, double longitude, double accuracy, double altitude, bool altitudeValid, double altitudeAccuracy,
                                   bool altitudeAccuracyValid, double speed, bool speedValid, double heading, bool headingValid);
     virtual void onLocationError(const char* error);
-    virtual void onPermission(void* context, bool isAllowed);
-    BlackBerry::Platform::GeoTracker* tracker() const { return m_tracker; }
+    virtual void onPermission(bool isAllowed);
 
 private:
     BlackBerry::WebKit::WebPagePrivate* m_webPagePrivate;
-    BlackBerry::Platform::GeoTracker* m_tracker;
+    RefPtr<Geolocation> m_pendingPermissionGeolocation;
     RefPtr<GeolocationPosition> m_lastPosition;
     bool m_accuracy;
+    bool m_isActive;
 };
 }
 
-#endif // GeolocationControllerClientBlackBerry_h
+#endif // GeolocationClientBlackBerry_h
diff --git a/Source/WebKit/blackberry/WebCoreSupport/GeolocationControllerClientBlackBerry.cpp b/Source/WebKit/blackberry/WebCoreSupport/GeolocationControllerClientBlackBerry.cpp
deleted file mode 100644
index ad7eb1b79..000000000
--- a/Source/WebKit/blackberry/WebCoreSupport/GeolocationControllerClientBlackBerry.cpp
+++ /dev/null
@@ -1,110 +0,0 @@
-/*
- * Copyright (C) 2010, 2011, 2012 Research In Motion Limited. All rights reserved.
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Lesser General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Lesser General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public
- * License along with this library; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
- */
-
-#include "config.h"
-#include "GeolocationControllerClientBlackBerry.h"
-
-#include "Chrome.h"
-#include "Geolocation.h"
-#include "GeolocationController.h"
-#include "GeolocationError.h"
-#include "Page.h"
-#include "WebPage_p.h"
-
-using namespace WebCore;
-
-GeolocationControllerClientBlackBerry::GeolocationControllerClientBlackBerry(BlackBerry::WebKit::WebPagePrivate* webPagePrivate)
-    : m_webPagePrivate(webPagePrivate)
-    , m_tracker(0)
-    , m_accuracy(false)
-{
-}
-
-void GeolocationControllerClientBlackBerry::geolocationDestroyed()
-{
-    if (m_tracker)
-        m_tracker->destroy();
-    delete this;
-}
-
-void GeolocationControllerClientBlackBerry::startUpdating()
-{
-    if (m_tracker)
-        m_tracker->resume();
-    else
-        m_tracker = BlackBerry::Platform::GeoTracker::create(this, m_accuracy);
-}
-
-void GeolocationControllerClientBlackBerry::stopUpdating()
-{
-    if (m_tracker)
-        m_tracker->suspend();
-}
-
-GeolocationPosition* GeolocationControllerClientBlackBerry::lastPosition()
-{
-    return m_lastPosition.get();
-}
-
-void GeolocationControllerClientBlackBerry::requestPermission(Geolocation* location)
-{
-    Frame* frame = location->frame();
-    if (!frame)
-        return;
-    m_webPagePrivate->m_page->chrome()->client()->requestGeolocationPermissionForFrame(frame, location);
-}
-
-void GeolocationControllerClientBlackBerry::cancelPermissionRequest(Geolocation* location)
-{
-    Frame* frame = location->frame();
-    if (!frame)
-        return;
-    m_webPagePrivate->m_page->chrome()->client()->cancelGeolocationPermissionRequestForFrame(frame, location);
-}
-
-void GeolocationControllerClientBlackBerry::onLocationUpdate(double timestamp, double latitude, double longitude, double accuracy, double altitude, bool altitudeValid,
-                                                             double altitudeAccuracy, bool altitudeAccuracyValid, double speed, bool speedValid, double heading, bool headingValid)
-{
-    m_lastPosition = GeolocationPosition::create(timestamp, latitude, longitude, accuracy, altitudeValid, altitude, altitudeAccuracyValid,
-                                                 altitudeAccuracy, headingValid, heading, speedValid, speed);
-    GeolocationController::from(m_webPagePrivate->m_page)->positionChanged(m_lastPosition.get());
-}
-
-void GeolocationControllerClientBlackBerry::onLocationError(const char* errorStr)
-{
-    RefPtr<GeolocationError> error = GeolocationError::create(GeolocationError::PositionUnavailable, String::fromUTF8(errorStr));
-    GeolocationController::from(m_webPagePrivate->m_page)->errorOccurred(error.get());
-}
-
-void GeolocationControllerClientBlackBerry::onPermission(void* context, bool isAllowed)
-{
-    Geolocation* position = static_cast<Geolocation*>(context);
-    position->setIsAllowed(isAllowed);
-}
-
-void GeolocationControllerClientBlackBerry::setEnableHighAccuracy(bool newAccuracy)
-{
-    if (m_accuracy == newAccuracy)
-        return;
-
-    m_accuracy = newAccuracy;
-
-    if (m_tracker)
-        m_tracker->setRequiresHighAccuracy(m_accuracy);
-}
-
diff --git a/Source/WebKit/blackberry/WebCoreSupport/IconDatabaseClientBlackBerry.cpp b/Source/WebKit/blackberry/WebCoreSupport/IconDatabaseClientBlackBerry.cpp
index 04c1eb0a6..35a5a5204 100644
--- a/Source/WebKit/blackberry/WebCoreSupport/IconDatabaseClientBlackBerry.cpp
+++ b/Source/WebKit/blackberry/WebCoreSupport/IconDatabaseClientBlackBerry.cpp
@@ -25,13 +25,7 @@
 
 namespace WebCore {
 
-IconDatabaseClientBlackBerry* IconDatabaseClientBlackBerry::getInstance()
-{
-    static IconDatabaseClientBlackBerry* instance = 0;
-    if (!instance)
-        instance = new IconDatabaseClientBlackBerry();
-    return instance;
-}
+SINGLETON_INITIALIZER_THREADUNSAFE(IconDatabaseClientBlackBerry)
 
 bool IconDatabaseClientBlackBerry::initIconDatabase(const BlackBerry::WebKit::WebSettings* settings)
 {
diff --git a/Source/WebKit/blackberry/WebCoreSupport/IconDatabaseClientBlackBerry.h b/Source/WebKit/blackberry/WebCoreSupport/IconDatabaseClientBlackBerry.h
index dc6d02d21..1cc08192f 100644
--- a/Source/WebKit/blackberry/WebCoreSupport/IconDatabaseClientBlackBerry.h
+++ b/Source/WebKit/blackberry/WebCoreSupport/IconDatabaseClientBlackBerry.h
@@ -19,6 +19,7 @@
 #ifndef IconDatabaseClientBlackBerry_h
 #define IconDatabaseClientBlackBerry_h
 
+#include "BlackBerryPlatformSingleton.h"
 #include "IconDatabaseClient.h"
 
 namespace BlackBerry {
@@ -29,9 +30,11 @@ class WebSettings;
 
 namespace WebCore {
 
-class IconDatabaseClientBlackBerry : public IconDatabaseClient {
+class IconDatabaseClientBlackBerry : public BlackBerry::Platform::ThreadUnsafeSingleton<IconDatabaseClientBlackBerry>
+    , public IconDatabaseClient {
+
+    SINGLETON_DEFINITION_THREADUNSAFE(IconDatabaseClientBlackBerry)
 public:
-    static IconDatabaseClientBlackBerry* getInstance();
     bool initIconDatabase(const BlackBerry::WebKit::WebSettings*);
 
     virtual void didRemoveAllIcons();
diff --git a/Source/WebKit/blackberry/WebCoreSupport/JavaScriptDebuggerBlackBerry.cpp b/Source/WebKit/blackberry/WebCoreSupport/JavaScriptDebuggerBlackBerry.cpp
deleted file mode 100644
index ea4c4266f..000000000
--- a/Source/WebKit/blackberry/WebCoreSupport/JavaScriptDebuggerBlackBerry.cpp
+++ /dev/null
@@ -1,179 +0,0 @@
-/*
- * Copyright (C) 2009 Torch Mobile Inc. http://www.torchmobile.com/
- * Copyright (C) 2010, 2011, 2012 Research In Motion Limited. All rights reserved.
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Lesser General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Lesser General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public
- * License along with this library; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
- */
-
-#include "config.h"
-
-#if ENABLE(JAVASCRIPT_DEBUGGER)
-#include "JavaScriptDebuggerBlackBerry.h"
-
-#include "JavaScriptCallFrame.h"
-#include "PageScriptDebugServer.h"
-#include "ScriptBreakpoint.h"
-#include "SourceCode.h"
-#include "WebPage_p.h"
-#include <wtf/text/WTFString.h>
-
-namespace WebCore {
-
-JavaScriptDebuggerBlackBerry::JavaScriptDebuggerBlackBerry(BlackBerry::WebKit::WebPagePrivate* webPagePrivate)
-    : m_webPagePrivate(webPagePrivate)
-    , m_debugServer(PageScriptDebugServer::shared())
-{
-    start();
-}
-
-JavaScriptDebuggerBlackBerry::~JavaScriptDebuggerBlackBerry()
-{
-    stop();
-}
-
-void JavaScriptDebuggerBlackBerry::start()
-{
-    m_debugServer.addListener(this, m_webPagePrivate->m_page);
-}
-
-void JavaScriptDebuggerBlackBerry::stop()
-{
-    m_debugServer.removeListener(this, m_webPagePrivate->m_page);
-}
-
-void JavaScriptDebuggerBlackBerry::addBreakpoint(const unsigned short* url, unsigned urlLength, int lineNumber, const unsigned short* condition, unsigned conditionLength)
-{
-    if (!url || !urlLength)
-        return;
-    if (!m_currentCallFrame)
-        return;
-
-    String sourceString(url, urlLength);
-    String conditionString(condition, conditionLength);
-    int actualLineNumber;
-    m_debugServer.setBreakpoint(sourceString, ScriptBreakpoint(lineNumber, 0, conditionString), &lineNumber, &actualLineNumber);
-}
-
-void JavaScriptDebuggerBlackBerry::updateBreakpoint(const unsigned short* url, unsigned urlLength, int lineNumber, const unsigned short* condition, unsigned conditionLength)
-{
-    if (!url || !urlLength)
-        return;
-    if (!m_currentCallFrame)
-        return;
-
-    String sourceString(url, urlLength);
-    String conditionString(condition, conditionLength);
-    int actualLineNumber;
-    m_debugServer.setBreakpoint(sourceString, ScriptBreakpoint(lineNumber, 0, conditionString), &lineNumber, &actualLineNumber);
-}
-
-
-void JavaScriptDebuggerBlackBerry::removeBreakpoint(const unsigned short* url, unsigned urlLength, int lineNumber)
-{
-    if (!url || !urlLength)
-        return;
-    if (!m_currentCallFrame)
-        return;
-
-    String sourceString(url, urlLength);
-    sourceString += ":" + lineNumber;
-    m_debugServer.removeBreakpoint(sourceString);
-}
-
-
-bool JavaScriptDebuggerBlackBerry::pauseOnExceptions()
-{
-    return m_debugServer.pauseOnExceptionsState() == ScriptDebugServer::PauseOnAllExceptions;
-}
-
-void JavaScriptDebuggerBlackBerry::setPauseOnExceptions(bool pause)
-{
-    m_debugServer.setPauseOnExceptionsState(pause ? ScriptDebugServer::PauseOnAllExceptions : ScriptDebugServer::DontPauseOnExceptions);
-}
-
-void JavaScriptDebuggerBlackBerry::pauseInDebugger()
-{
-    m_debugServer.setPauseOnNextStatement(true);
-}
-
-void JavaScriptDebuggerBlackBerry::resumeDebugger()
-{
-    m_debugServer.continueProgram();
-}
-
-void JavaScriptDebuggerBlackBerry::stepOverStatementInDebugger()
-{
-    m_debugServer.stepOverStatement();
-}
-
-void JavaScriptDebuggerBlackBerry::stepIntoStatementInDebugger()
-{
-    m_debugServer.stepIntoStatement();
-}
-
-void JavaScriptDebuggerBlackBerry::stepOutOfFunctionInDebugger()
-{
-    m_debugServer.stepOutOfFunction();
-}
-
-void JavaScriptDebuggerBlackBerry::didParseSource(const String& sourceID, const Script& script)
-{
-    m_webPagePrivate->m_client->javascriptSourceParsed(script.url.characters(), script.url.length(), script.source.characters(), script.source.length());
-}
-
-void JavaScriptDebuggerBlackBerry::failedToParseSource(const String& url, const String& data, int firstLine, int errorLine, const String& errorMessage)
-{
-    m_webPagePrivate->m_client->javascriptParsingFailed(url.impl()->characters(), url.length(), errorMessage.impl()->characters(), errorMessage.length(), errorLine);
-}
-
-void JavaScriptDebuggerBlackBerry::didPause(ScriptState*, const ScriptValue& callFrames, const ScriptValue& exception)
-{
-    String stacks;
-
-    m_currentCallFrame = m_debugServer.currentCallFrame();
-    JavaScriptCallFrame* frame = m_currentCallFrame;
-
-    while (frame && frame->isValid()) {
-        JSC::SourceProvider* provider = reinterpret_cast<JSC::SourceProvider*>(frame->sourceID());
-        String url(provider->url().characters(), provider->url().length());
-        if (url.length())
-            stacks += url;
-        stacks += ": ";
-
-        if (frame->type() == JSC::DebuggerCallFrame::FunctionType) {
-            String name = frame->functionName();
-            if (name.length())
-                stacks += name;
-        }
-        stacks += "(): ";
-
-        String line = String::number(frame->line());
-        stacks += line + "\n";
-
-        frame = frame->caller();
-    }
-
-    m_webPagePrivate->m_client->javascriptPaused(reinterpret_cast<const unsigned short*>(stacks.characters()), stacks.length());
-}
-
-void JavaScriptDebuggerBlackBerry::didContinue()
-{
-    m_currentCallFrame = 0;
-    m_webPagePrivate->m_client->javascriptContinued();
-}
-
-} // namespace WebCore
-
-#endif // ENABLE(JAVASCRIPT_DEBUGGER)
diff --git a/Source/WebKit/blackberry/WebCoreSupport/JavaScriptDebuggerBlackBerry.h b/Source/WebKit/blackberry/WebCoreSupport/JavaScriptDebuggerBlackBerry.h
deleted file mode 100644
index 2f511b2a3..000000000
--- a/Source/WebKit/blackberry/WebCoreSupport/JavaScriptDebuggerBlackBerry.h
+++ /dev/null
@@ -1,77 +0,0 @@
-/*
- * Copyright (C) 2009 Torch Mobile Inc. http://www.torchmobile.com/
- * Copyright (C) 2011, 2012 Research In Motion Limited. All rights reserved.
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Lesser General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Lesser General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public
- * License along with this library; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
- */
-
-#ifndef JavaScriptDebuggerBlackBerry_h
-#define JavaScriptDebuggerBlackBerry_h
-
-#if ENABLE(JAVASCRIPT_DEBUGGER)
-
-#include "ScriptDebugListener.h"
-
-namespace BlackBerry {
-namespace WebKit {
-class WebPagePrivate;
-}
-}
-
-namespace WebCore {
-
-class JavaScriptCallFrame;
-class PageScriptDebugServer;
-
-class JavaScriptDebuggerBlackBerry : public ScriptDebugListener {
-public:
-    JavaScriptDebuggerBlackBerry(BlackBerry::WebKit::WebPagePrivate*);
-    ~JavaScriptDebuggerBlackBerry();
-
-    void addBreakpoint(const unsigned short* url, unsigned urlLength, int lineNumber, const unsigned short* condition, unsigned conditionLength);
-    void updateBreakpoint(const unsigned short* url, unsigned urlLength, int lineNumber, const unsigned short* condition, unsigned conditionLength);
-    void removeBreakpoint(const unsigned short* url, unsigned urlLength, int lineNumber);
-
-    bool pauseOnExceptions();
-    void setPauseOnExceptions(bool);
-
-    void pauseInDebugger();
-    void resumeDebugger();
-
-    void stepOverStatementInDebugger();
-    void stepIntoStatementInDebugger();
-    void stepOutOfFunctionInDebugger();
-
-    // From ScriptDebugListener
-    virtual void didParseSource(const String&  sourceID, const Script&);
-    virtual void failedToParseSource(const String& url, const String& data, int firstLine, int errorLine, const String& errorMessage);
-    virtual void didPause(ScriptState*, const ScriptValue& callFrames, const ScriptValue& exception);
-    virtual void didContinue();
-
-protected:
-    void start();
-    void stop();
-
-private:
-    BlackBerry::WebKit::WebPagePrivate* m_webPagePrivate;
-    PageScriptDebugServer& m_debugServer;
-
-    JavaScriptCallFrame* m_currentCallFrame;
-};
-
-} // WebCore
-
-#endif // ENABLE(JAVASCRIPT_DEBUGGER)
-#endif // JavaScriptDebuggerBlackBerry_h
diff --git a/Source/WebKit/blackberry/WebCoreSupport/SelectPopupClient.cpp b/Source/WebKit/blackberry/WebCoreSupport/SelectPopupClient.cpp
index 99d1a069c..b37b5e668 100644
--- a/Source/WebKit/blackberry/WebCoreSupport/SelectPopupClient.cpp
+++ b/Source/WebKit/blackberry/WebCoreSupport/SelectPopupClient.cpp
@@ -84,7 +84,7 @@ void SelectPopupClient::generateHTML(bool multiple, int size, const ScopeArray<B
     // Add labels.
     source.append('[');
     for (int i = 0; i < size; i++) {
-        source.append("'" + String(labels[i]).replace('\\', "\\\\").replace('\'', "\\'") + "'");
+        source.append("'" + String(labels[i]).replaceWithLiteral('\\', "\\\\").replaceWithLiteral('\'', "\\'") + "'");
         // Don't append ',' to last element.
         if (i != size - 1)
             source.appendLiteral(", ");
diff --git a/Source/WebKit/blackberry/WebCoreSupport/SelectPopupClient.h b/Source/WebKit/blackberry/WebCoreSupport/SelectPopupClient.h
index 2b5f55c07..b139aeed3 100644
--- a/Source/WebKit/blackberry/WebCoreSupport/SelectPopupClient.h
+++ b/Source/WebKit/blackberry/WebCoreSupport/SelectPopupClient.h
@@ -62,7 +62,7 @@ public:
     unsigned m_size;
     String m_source;
     BlackBerry::WebKit::WebPagePrivate* m_webPage;
-    HTMLSelectElement* m_element;
+    RefPtr<HTMLSelectElement> m_element;
     WebCore::Timer<SelectPopupClient> m_notifyChangeTimer;
 };
 } // namespace WebCore
diff --git a/Source/WebKit/blackberry/WebKitSupport/DefaultTapHighlight.cpp b/Source/WebKit/blackberry/WebKitSupport/DefaultTapHighlight.cpp
index 45472aafd..77b2c75ac 100644
--- a/Source/WebKit/blackberry/WebKitSupport/DefaultTapHighlight.cpp
+++ b/Source/WebKit/blackberry/WebKitSupport/DefaultTapHighlight.cpp
@@ -148,16 +148,6 @@ void DefaultTapHighlight::paintContents(const GraphicsLayer*, GraphicsContext& c
     c.restore();
 }
 
-bool DefaultTapHighlight::showDebugBorders(const GraphicsLayer* layer) const
-{
-    return m_page->showDebugBorders(layer);
-}
-
-bool DefaultTapHighlight::showRepaintCounter(const GraphicsLayer* layer) const
-{
-    return m_page->showRepaintCounter(layer);
-}
-
 bool DefaultTapHighlight::contentsVisible(const GraphicsLayer*, const IntRect& contentRect) const
 {
     // This layer is typically small enough that we can afford to cache all tiles and never
diff --git a/Source/WebKit/blackberry/WebKitSupport/DefaultTapHighlight.h b/Source/WebKit/blackberry/WebKitSupport/DefaultTapHighlight.h
index 06c559057..90af94caa 100644
--- a/Source/WebKit/blackberry/WebKitSupport/DefaultTapHighlight.h
+++ b/Source/WebKit/blackberry/WebKitSupport/DefaultTapHighlight.h
@@ -57,8 +57,6 @@ public:
     virtual void notifyAnimationStarted(const WebCore::GraphicsLayer*, double time) { }
     virtual void notifyFlushRequired(const WebCore::GraphicsLayer*);
     virtual void paintContents(const WebCore::GraphicsLayer*, WebCore::GraphicsContext&, WebCore::GraphicsLayerPaintingPhase, const WebCore::IntRect& inClip);
-    virtual bool showDebugBorders(const WebCore::GraphicsLayer*) const;
-    virtual bool showRepaintCounter(const WebCore::GraphicsLayer*) const;
     virtual bool contentsVisible(const WebCore::GraphicsLayer*, const WebCore::IntRect& contentRect) const;
 
 private:
diff --git a/Source/WebKit/blackberry/WebKitSupport/FatFingers.cpp b/Source/WebKit/blackberry/WebKitSupport/FatFingers.cpp
index 07197b1dd..877dc2009 100644
--- a/Source/WebKit/blackberry/WebKitSupport/FatFingers.cpp
+++ b/Source/WebKit/blackberry/WebKitSupport/FatFingers.cpp
@@ -181,7 +181,7 @@ const FatFingersResult FatFingers::findBestPoint()
     // targable is actually found by ::findIntersectingRegions, then we might replace what we just set below later on.
     Element* elementUnderPoint;
     Element* clickableElementUnderPoint;
-    getRelevantInfoFromPoint(m_webPage->m_mainFrame->document(), m_contentPos, elementUnderPoint, clickableElementUnderPoint);
+    getRelevantInfoFromCachedHitTest(elementUnderPoint, clickableElementUnderPoint);
 
     if (elementUnderPoint) {
         result.m_nodeUnderFatFinger = elementUnderPoint;
@@ -500,15 +500,12 @@ void FatFingers::getNodesFromRect(Document* document, const IntPoint& contentPos
     m_cachedRectHitTestResults.add(document, intersectedNodes);
 }
 
-void FatFingers::getRelevantInfoFromPoint(Document* document, const IntPoint& contentPos, Element*& elementUnderPoint, Element*& clickableElementUnderPoint) const
+void FatFingers::getRelevantInfoFromCachedHitTest(Element*& elementUnderPoint, Element*& clickableElementUnderPoint) const
 {
     elementUnderPoint = 0;
     clickableElementUnderPoint = 0;
 
-    if (!document || !document->renderer() || !document->frame())
-        return;
-
-    HitTestResult result  = document->frame()->eventHandler()->hitTestResultAtPoint(contentPos, HitTestRequest::ReadOnly | HitTestRequest::Active | HitTestRequest::AllowShadowContent);
+    const HitTestResult& result = m_webPage->hitTestResult(m_contentPos);
     Node* node = result.innerNode();
     while (node && !node->isElementNode())
         node = node->parentNode();
diff --git a/Source/WebKit/blackberry/WebKitSupport/FatFingers.h b/Source/WebKit/blackberry/WebKitSupport/FatFingers.h
index f872e8a08..3e3c6fc3a 100644
--- a/Source/WebKit/blackberry/WebKitSupport/FatFingers.h
+++ b/Source/WebKit/blackberry/WebKitSupport/FatFingers.h
@@ -99,10 +99,7 @@ private:
     void getNodesFromRect(WebCore::Document*, const WebCore::IntPoint&, ListHashSet<RefPtr<WebCore::Node> >&);
 
     // It mimics Document::elementFromPoint, but recursively hit-tests in case an inner frame is found.
-    void getRelevantInfoFromPoint(WebCore::Document*,
-                                  const WebCore::IntPoint&,
-                                  WebCore::Element*& elementUnderPoint,
-                                  WebCore::Element*& clickableElementUnderPoint) const;
+    void getRelevantInfoFromCachedHitTest(WebCore::Element*& elementUnderPoint, WebCore::Element*& clickableElementUnderPoint) const;
 
     bool isElementClickable(WebCore::Element*) const;
 
diff --git a/Source/WebKit/blackberry/WebKitSupport/InRegionScrollableArea.cpp b/Source/WebKit/blackberry/WebKitSupport/InRegionScrollableArea.cpp
index 5b4636dfb..443db8b8c 100644
--- a/Source/WebKit/blackberry/WebKitSupport/InRegionScrollableArea.cpp
+++ b/Source/WebKit/blackberry/WebKitSupport/InRegionScrollableArea.cpp
@@ -19,6 +19,7 @@
 #include "config.h"
 #include "InRegionScrollableArea.h"
 
+#include "Document.h"
 #include "Frame.h"
 #include "LayerWebKitThread.h"
 #include "InRegionScroller_p.h"
@@ -52,11 +53,16 @@ InRegionScrollableArea::InRegionScrollableArea(WebPagePrivate* webPage, RenderLa
     : m_webPage(webPage)
     , m_layer(layer)
     , m_hasWindowVisibleRectCalculated(false)
+    , m_document(0)
 {
     ASSERT(webPage);
     ASSERT(layer);
     m_isNull = false;
 
+    // Add a pointer to the enclosing document as the pointer to layer or node along the way may become invalid.
+    if (m_layer->enclosingElement())
+        m_document = m_layer->enclosingElement()->document();
+
     // FIXME: Add an ASSERT here as the 'layer' must be scrollable.
 
     RenderObject* layerRenderer = layer->renderer();
@@ -139,5 +145,11 @@ RenderLayer* InRegionScrollableArea::layer() const
     return m_layer;
 }
 
+Document* InRegionScrollableArea::document() const
+{
+    ASSERT(!m_isNull);
+    return m_document;
+}
+
 }
 }
diff --git a/Source/WebKit/blackberry/WebKitSupport/InRegionScrollableArea.h b/Source/WebKit/blackberry/WebKitSupport/InRegionScrollableArea.h
index 443b94f5a..31fcb92e1 100644
--- a/Source/WebKit/blackberry/WebKitSupport/InRegionScrollableArea.h
+++ b/Source/WebKit/blackberry/WebKitSupport/InRegionScrollableArea.h
@@ -24,6 +24,7 @@
 #include <interaction/ScrollViewBase.h>
 
 namespace WebCore {
+class Document;
 class LayerWebKitThread;
 class Node;
 class RenderLayer;
@@ -45,10 +46,12 @@ public:
     Platform::IntRect visibleWindowRect() const;
 
     WebCore::RenderLayer* layer() const;
+    WebCore::Document* document() const;
 
 private:
     WebPagePrivate* m_webPage;
     WebCore::RenderLayer* m_layer;
+    WebCore::Document* m_document;
 
     // We either cache one here: in case of a composited scrollable layer
     // cache the LayerWebKitThread. Otherwise, the Node.
diff --git a/Source/WebKit/blackberry/WebKitSupport/InputHandler.cpp b/Source/WebKit/blackberry/WebKitSupport/InputHandler.cpp
index 0c23f4acc..e39df6e23 100644
--- a/Source/WebKit/blackberry/WebKitSupport/InputHandler.cpp
+++ b/Source/WebKit/blackberry/WebKitSupport/InputHandler.cpp
@@ -140,6 +140,7 @@ InputHandler::InputHandler(WebPagePrivate* page)
     , m_request(0)
     , m_processingTransactionId(-1)
     , m_focusZoomScale(0.0)
+    , m_receivedBackspaceKeyDown(false)
 {
 }
 
@@ -961,7 +962,7 @@ PassRefPtr<Range> InputHandler::getRangeForSpellCheckWithFineGranularity(Visible
 
 bool InputHandler::openDatePopup(HTMLInputElement* element, BlackBerryInputType type)
 {
-    if (!element || element->disabled() || !DOMSupport::isDateTimeInputField(element))
+    if (!element || element->disabled() || element->readOnly() || !DOMSupport::isDateTimeInputField(element))
         return false;
 
     if (isActiveTextEdit())
@@ -990,7 +991,7 @@ bool InputHandler::openDatePopup(HTMLInputElement* element, BlackBerryInputType
 
 bool InputHandler::openColorPopup(HTMLInputElement* element)
 {
-    if (!element || element->disabled() || !DOMSupport::isColorInputField(element))
+    if (!element || element->disabled() || element->readOnly() || !DOMSupport::isColorInputField(element))
         return false;
 
     if (isActiveTextEdit())
@@ -1018,10 +1019,7 @@ void InputHandler::setInputValue(const WTF::String& value)
 
 void InputHandler::nodeTextChanged(const Node* node)
 {
-    if (processingChange() || !node)
-        return;
-
-    if (node != m_currentFocusElement)
+    if (processingChange() || !node || node != m_currentFocusElement || m_receivedBackspaceKeyDown)
         return;
 
     InputLog(LogLevelInfo, "InputHandler::nodeTextChanged");
@@ -1041,6 +1039,11 @@ WebCore::IntRect InputHandler::boundingBoxForInputField()
     if (!m_currentFocusElement->renderer())
         return WebCore::IntRect();
 
+    // type="search" can have a 'X', so take the inner block bounding box to not include it.
+    if (HTMLInputElement* element = m_currentFocusElement->toInputElement())
+        if (element->isSearchField())
+            return element->innerBlockElement()->renderer()->absoluteBoundingBoxRect();
+
     return m_currentFocusElement->renderer()->absoluteBoundingBoxRect();
 }
 
@@ -1382,6 +1385,9 @@ void InputHandler::selectionChanged()
 
     ASSERT(m_currentFocusElement->document() && m_currentFocusElement->document()->frame());
 
+    if (m_receivedBackspaceKeyDown)
+        return;
+
     int newSelectionStart = selectionStart();
     int newSelectionEnd = selectionEnd();
 
@@ -1450,6 +1456,9 @@ bool InputHandler::handleKeyboardInput(const Platform::KeyboardEvent& keyboardEv
 {
     InputLog(LogLevelInfo, "InputHandler::handleKeyboardInput received character=%lc, type=%d", keyboardEvent.character(), keyboardEvent.type());
 
+    // Clearing the m_receivedBackspaceKeyDown state on any KeyboardEvent.
+    m_receivedBackspaceKeyDown = false;
+
     // Enable input mode if we are processing a key event.
     setInputModeEnabled();
 
@@ -1475,9 +1484,15 @@ bool InputHandler::handleKeyboardInput(const Platform::KeyboardEvent& keyboardEv
         if (isKeyChar)
             type = Platform::KeyboardEvent::KeyDown;
 
+        // If we receive the KeyDown of a Backspace, set this flag to prevent sending unnecessary selection and caret changes to IMF.
+        if (keyboardEvent.character() == KEYCODE_BACKSPACE && type == Platform::KeyboardEvent::KeyDown)
+            m_receivedBackspaceKeyDown = true;
+
         Platform::KeyboardEvent adjustedKeyboardEvent(keyboardEvent.character(), type, adjustedModifiers);
         keyboardEventHandled = focusedFrame->eventHandler()->keyEvent(PlatformKeyboardEvent(adjustedKeyboardEvent));
 
+        m_receivedBackspaceKeyDown = false;
+
         if (isKeyChar) {
             type = Platform::KeyboardEvent::KeyUp;
             adjustedKeyboardEvent = Platform::KeyboardEvent(keyboardEvent.character(), type, adjustedModifiers);
diff --git a/Source/WebKit/blackberry/WebKitSupport/InputHandler.h b/Source/WebKit/blackberry/WebKitSupport/InputHandler.h
index ad569794b..122ef9186 100644
--- a/Source/WebKit/blackberry/WebKitSupport/InputHandler.h
+++ b/Source/WebKit/blackberry/WebKitSupport/InputHandler.h
@@ -225,6 +225,8 @@ private:
 
     double m_focusZoomScale;
     WebCore::FloatPoint m_focusZoomLocation;
+
+    bool m_receivedBackspaceKeyDown;
 };
 
 }
diff --git a/Source/WebKit/blackberry/WebKitSupport/InspectorOverlayBlackBerry.cpp b/Source/WebKit/blackberry/WebKitSupport/InspectorOverlayBlackBerry.cpp
index 0815dd97b..52c9c4d2e 100644
--- a/Source/WebKit/blackberry/WebKitSupport/InspectorOverlayBlackBerry.cpp
+++ b/Source/WebKit/blackberry/WebKitSupport/InspectorOverlayBlackBerry.cpp
@@ -56,15 +56,6 @@ void InspectorOverlay::paintContents(const WebCore::GraphicsLayer*, WebCore::Gra
     context.restore();
 }
 
-bool InspectorOverlay::showDebugBorders(const WebCore::GraphicsLayer* layer) const
-{
-    return m_webPage->showDebugBorders(layer);
-}
-
-bool InspectorOverlay::showRepaintCounter(const WebCore::GraphicsLayer* layer) const
-{
-    return m_webPage->showRepaintCounter(layer);
-}
 #endif
 
 InspectorOverlay::~InspectorOverlay() { }
diff --git a/Source/WebKit/blackberry/WebKitSupport/InspectorOverlayBlackBerry.h b/Source/WebKit/blackberry/WebKitSupport/InspectorOverlayBlackBerry.h
index 91197cc0c..6df4ba62a 100644
--- a/Source/WebKit/blackberry/WebKitSupport/InspectorOverlayBlackBerry.h
+++ b/Source/WebKit/blackberry/WebKitSupport/InspectorOverlayBlackBerry.h
@@ -54,8 +54,6 @@ public:
     virtual void notifyAnimationStarted(const WebCore::GraphicsLayer*, double time) { }
     virtual void notifyFlushRequired(const WebCore::GraphicsLayer*);
     virtual void paintContents(const WebCore::GraphicsLayer*, WebCore::GraphicsContext&, WebCore::GraphicsLayerPaintingPhase, const WebCore::IntRect& inClip);
-    virtual bool showDebugBorders(const WebCore::GraphicsLayer*) const;
-    virtual bool showRepaintCounter(const WebCore::GraphicsLayer*) const;
 #endif
 
 private:
diff --git a/Source/WebKit/blackberry/WebKitSupport/SelectionHandler.cpp b/Source/WebKit/blackberry/WebKitSupport/SelectionHandler.cpp
index 2cd4ee34c..10e07359e 100644
--- a/Source/WebKit/blackberry/WebKitSupport/SelectionHandler.cpp
+++ b/Source/WebKit/blackberry/WebKitSupport/SelectionHandler.cpp
@@ -29,10 +29,10 @@
 #include "HitTestResult.h"
 #include "InputHandler.h"
 #include "IntRect.h"
+#include "SelectionOverlay.h"
 #include "TouchEventHandler.h"
 #include "WebPageClient.h"
 #include "WebPage_p.h"
-#include "WebSelectionOverlay.h"
 
 #include "htmlediting.h"
 #include "visible_units.h"
@@ -83,6 +83,9 @@ void SelectionHandler::cancelSelection()
     m_selectionActive = false;
     m_lastSelectionRegion = IntRectRegion();
 
+    if (m_webPage->m_selectionOverlay)
+        m_webPage->m_selectionOverlay->hide();
+
     SelectionLog(LogLevelInfo, "SelectionHandler::cancelSelection");
 
     if (m_webPage->m_inputHandler->isInputMode())
@@ -859,6 +862,8 @@ void SelectionHandler::selectionPositionChanged(bool forceUpdateWithoutChange)
         return;
 
     if (m_webPage->m_inputHandler->isInputMode() && m_webPage->m_inputHandler->processingChange()) {
+        if (m_webPage->m_selectionOverlay)
+            m_webPage->m_selectionOverlay->hide();
         m_webPage->m_client->cancelSelectionVisuals();
 
         // Since we're not calling notifyCaretPositionChangedIfNeeded now, we have to do so at the end of processing
diff --git a/Source/WebKit/blackberry/WebKitSupport/SelectionOverlay.cpp b/Source/WebKit/blackberry/WebKitSupport/SelectionOverlay.cpp
index e1f47010c..d352b177a 100644
--- a/Source/WebKit/blackberry/WebKitSupport/SelectionOverlay.cpp
+++ b/Source/WebKit/blackberry/WebKitSupport/SelectionOverlay.cpp
@@ -38,7 +38,6 @@ namespace WebKit {
 
 SelectionOverlay::SelectionOverlay(WebPagePrivate* page)
     : m_page(page)
-    , m_hideDispatched(false)
 {
 }
 
@@ -71,21 +70,6 @@ void SelectionOverlay::draw(const Platform::IntRectRegion& region)
 
 void SelectionOverlay::hide()
 {
-    // Track a dispatched message, we don't want to flood the webkit thread.
-    // There can be as many as one more message enqued as needed but never less.
-    if (isWebKitThread())
-        m_hideDispatched = false;
-    else if (m_hideDispatched) {
-        // Early return if there is message already pending on the webkit thread.
-        return;
-    }
-    if (!isWebKitThread()) {
-        m_hideDispatched = true;
-        // Normally, this method is called on the WebKit thread, but it can also be
-        // called from the compositing thread.
-        dispatchWebKitMessage(BlackBerry::Platform::createMethodCallMessage(&SelectionOverlay::hide, this));
-        return;
-    }
     ASSERT(BlackBerry::Platform::webKitThreadMessageClient()->isCurrentThread());
 
     if (!m_overlay)
@@ -133,16 +117,6 @@ void SelectionOverlay::paintContents(const GraphicsLayer*, GraphicsContext& c, G
     c.restore();
 }
 
-bool SelectionOverlay::showDebugBorders(const GraphicsLayer* layer) const
-{
-    return m_page->showDebugBorders(layer);
-}
-
-bool SelectionOverlay::showRepaintCounter(const GraphicsLayer* layer) const
-{
-    return m_page->showRepaintCounter(layer);
-}
-
 } // namespace WebKit
 } // namespace BlackBerry
 
diff --git a/Source/WebKit/blackberry/WebKitSupport/SelectionOverlay.h b/Source/WebKit/blackberry/WebKitSupport/SelectionOverlay.h
index c1a0f86b8..d2704dc3f 100644
--- a/Source/WebKit/blackberry/WebKitSupport/SelectionOverlay.h
+++ b/Source/WebKit/blackberry/WebKitSupport/SelectionOverlay.h
@@ -26,21 +26,21 @@
 #include "Color.h"
 #include "GraphicsLayerClient.h"
 #include "WebOverlay.h"
-#include "WebSelectionOverlay.h"
 
 #include <BlackBerryPlatformIntRectRegion.h>
 #include <wtf/OwnPtr.h>
+#include <wtf/PassOwnPtr.h>
 
 namespace BlackBerry {
 namespace WebKit {
 
 class WebPagePrivate;
 
-class SelectionOverlay : public WebSelectionOverlay, public WebCore::GraphicsLayerClient {
+class SelectionOverlay : public WebCore::GraphicsLayerClient {
 public:
-    static SelectionOverlay* create(WebPagePrivate* page)
+    static PassOwnPtr<SelectionOverlay> create(WebPagePrivate* page)
     {
-        return new SelectionOverlay(page);
+        return adoptPtr(new SelectionOverlay(page));
     }
 
     virtual ~SelectionOverlay();
@@ -52,8 +52,6 @@ public:
     virtual void notifyAnimationStarted(const WebCore::GraphicsLayer*, double time) { }
     virtual void notifyFlushRequired(const WebCore::GraphicsLayer*);
     virtual void paintContents(const WebCore::GraphicsLayer*, WebCore::GraphicsContext&, WebCore::GraphicsLayerPaintingPhase, const WebCore::IntRect& inClip);
-    virtual bool showDebugBorders(const WebCore::GraphicsLayer*) const;
-    virtual bool showRepaintCounter(const WebCore::GraphicsLayer*) const;
 
 private:
     SelectionOverlay(WebPagePrivate*);
@@ -61,7 +59,6 @@ private:
     WebPagePrivate* m_page;
     OwnPtr<WebOverlay> m_overlay;
     BlackBerry::Platform::IntRectRegion m_region;
-    bool m_hideDispatched;
 };
 
 } // namespace WebKit
diff --git a/Source/WebKit/blackberry/WebKitSupport/TouchEventHandler.cpp b/Source/WebKit/blackberry/WebKitSupport/TouchEventHandler.cpp
index d388e8d59..ace76f12d 100644
--- a/Source/WebKit/blackberry/WebKitSupport/TouchEventHandler.cpp
+++ b/Source/WebKit/blackberry/WebKitSupport/TouchEventHandler.cpp
@@ -199,6 +199,7 @@ bool TouchEventHandler::handleTouchPoint(Platform::TouchPoint& point, bool useFa
 
             IntPoint contentPos(m_webPage->mapFromViewportToContents(point.m_pos));
 
+            m_webPage->postponeDocumentStyleRecalc();
             m_lastFatFingersResult = FatFingers(m_webPage, contentPos, FatFingers::ClickableElement).findBestPoint();
 
             Element* elementUnderFatFinger = 0;
@@ -214,6 +215,8 @@ bool TouchEventHandler::handleTouchPoint(Platform::TouchPoint& point, bool useFa
             if (!possibleTargetNodeForMouseMoveEvents || (!possibleTargetNodeForMouseMoveEvents->hasEventListeners(eventNames().touchmoveEvent) && !m_convertTouchToMouse))
                 m_webPage->client()->notifyNoMouseMoveOrTouchMoveHandlers();
 
+            m_webPage->resumeDocumentStyleRecalc();
+
             if (elementUnderFatFinger)
                 drawTapHighlight();
 
diff --git a/Source/WebKit/cf/ChangeLog b/Source/WebKit/cf/ChangeLog
index 5863e92f4..9000d8170 100644
--- a/Source/WebKit/cf/ChangeLog
+++ b/Source/WebKit/cf/ChangeLog
@@ -1,3 +1,17 @@
+2012-10-29  Anders Carlsson  <andersca@apple.com>
+
+        String::createCFString should return a RetainPtr
+        https://bugs.webkit.org/show_bug.cgi?id=100419
+
+        Reviewed by Andreas Kling.
+
+        Update callers of String::createCFString.
+
+        * WebCoreSupport/WebInspectorClientCF.cpp:
+        (createKeyForPreferences):
+        (populateSetting):
+        (storeSetting):
+
 2012-09-05  Sam Weinig  <sam@webkit.org>
 
         Part 2 of removing PlatformString.h, remove PlatformString.h
diff --git a/Source/WebKit/cf/WebCoreSupport/WebInspectorClientCF.cpp b/Source/WebKit/cf/WebCoreSupport/WebInspectorClientCF.cpp
index 83747f223..337dacab2 100644
--- a/Source/WebKit/cf/WebCoreSupport/WebInspectorClientCF.cpp
+++ b/Source/WebKit/cf/WebCoreSupport/WebInspectorClientCF.cpp
@@ -63,15 +63,14 @@ using namespace WebCore;
 
 static const char* inspectorStartsAttachedSetting = "inspectorStartsAttached";
 
-static inline CFStringRef createKeyForPreferences(const String& key)
+static inline RetainPtr<CFStringRef> createKeyForPreferences(const String& key)
 {
-    RetainPtr<CFStringRef> keyCFString(AdoptCF, key.createCFString());
-    return CFStringCreateWithFormat(0, 0, CFSTR("WebKit Web Inspector Setting - %@"), keyCFString.get());
+    return adoptCF(CFStringCreateWithFormat(0, 0, CFSTR("WebKit Web Inspector Setting - %@"), key.createCFString().get()));
 }
 
 static void populateSetting(const String& key, String* setting)
 {
-    RetainPtr<CFStringRef> preferencesKey(AdoptCF, createKeyForPreferences(key));
+    RetainPtr<CFStringRef> preferencesKey = createKeyForPreferences(key);
     RetainPtr<CFPropertyListRef> value(AdoptCF, CFPreferencesCopyAppValue(preferencesKey.get(), kCFPreferencesCurrentApplication));
 
     if (!value)
@@ -88,12 +87,7 @@ static void populateSetting(const String& key, String* setting)
 
 static void storeSetting(const String& key, const String& setting)
 {
-    RetainPtr<CFPropertyListRef> objectToStore;
-    objectToStore.adoptCF(setting.createCFString());
-    ASSERT(objectToStore);
-
-    RetainPtr<CFStringRef> preferencesKey(AdoptCF, createKeyForPreferences(key));
-    CFPreferencesSetAppValue(preferencesKey.get(), objectToStore.get(), kCFPreferencesCurrentApplication);
+    CFPreferencesSetAppValue(createKeyForPreferences(key).get(), setting.createCFString().get(), kCFPreferencesCurrentApplication);
 }
 
 bool WebInspectorClient::sendMessageToFrontend(const String& message)
diff --git a/Source/WebKit/chromium/ChangeLog b/Source/WebKit/chromium/ChangeLog
index b49e64166..0ac7a7002 100644
--- a/Source/WebKit/chromium/ChangeLog
+++ b/Source/WebKit/chromium/ChangeLog
@@ -1,3 +1,1332 @@
+2012-11-07  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Remove support for "desktop-width" in the viewport meta tag
+        https://bugs.webkit.org/show_bug.cgi?id=101217
+
+        Reviewed by Gyuyoung Kim.
+
+        Remove some code trying to use the set desktop width (say 980) for
+        sites not using a viewport meta element.
+
+        Removing this code should have no effect as it ends up being set
+        to desktop width in that case anyway, by the ViewportArguments
+        algorithm.
+
+        * src/ChromeClientImpl.cpp:
+        (WebKit::ChromeClientImpl::dispatchViewportPropertiesDidChange):
+
+2012-11-06  Dan Beam  <dbeam@chromium.org>
+
+        Enable REQUEST_AUTOCOMPLETE for chromium port
+        https://bugs.webkit.org/show_bug.cgi?id=101376
+
+        Reviewed by Adam Barth.
+
+        This patch enables the feature flag REQUEST_AUTOCOMPLETE in WebKit/chromium only to allow web authors to start to use
+        HTMLFormElement#requestAutocomplete as the chrome-side work progresses further.
+
+        * features.gypi:
+
+        Turned on the *compile* time flag for REQUEST_AUTOCOMPLETE in chromium's webkit port but also added a *run* time flag
+        that functionally enables the behavior.  This means the chromium port will compile in support but will require a run
+        time flag to enable.
+
+        * public/WebRuntimeFeatures.h:
+        (WebRuntimeFeatures):
+
+        Added a method to the public chromium run time features interface to allow chrome to enable/disable this feature.
+
+        * src/WebRuntimeFeatures.cpp:
+        (WebKit::WebRuntimeFeatures::enableRequestAutocomplete):
+        (WebKit):
+
+        A setter than can be called from chrome code to change the enable/disable requestAutocomplete and associated events at
+        runtime.
+
+        (WebKit::WebRuntimeFeatures::isRequestAutocompleteEnabled):
+
+        A getter that returns whether the requestAutocomplete run time feature is enabled.
+
+2012-11-06  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r133526.
+        http://trac.webkit.org/changeset/133526
+        https://bugs.webkit.org/show_bug.cgi?id=101388
+
+        May have caused 15% memory regression in Chromium (Requested
+        by jsbell|gardener on #webkit).
+
+        * src/WebScriptController.cpp:
+
+2012-11-06  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed.  Rolled DEPS.
+
+        * DEPS:
+
+2012-11-06  Peter Beverloo  <peter@chromium.org>
+
+        [Chromium] Enable the JavaScript i18n API for Android
+        https://bugs.webkit.org/show_bug.cgi?id=101357
+
+        Reviewed by Adam Barth.
+
+        Enable the JavaScript i18n API for Chromium on Android. This adds a
+        grand total of 18.7 KiB of data to the content shell apk.
+
+        * features.gypi:
+
+2012-11-06  Stephen White  <senorblanco@chromium.org>
+
+        Unreviewed.  Rolled DEPS.
+
+        * DEPS:
+
+2012-11-05  Adam Barth  <abarth@webkit.org>
+
+        [V8] IntrusiveDOMWrapperMap should be usable for more than just Nodes
+        https://bugs.webkit.org/show_bug.cgi?id=101110
+
+        Reviewed by Kentaro Hara.
+
+        * src/WebScriptController.cpp:
+            - Remove unneeded include of deleted file.
+
+2012-11-05  Simon Fraser  <simon.fraser@apple.com>
+
+        Fix layer borders to cleaning appear and disappear on switching
+        https://bugs.webkit.org/show_bug.cgi?id=101136
+
+        Reviewed by Sam Weinig.
+
+        Remove the GraphicsLayerClient methods showDebugBorders() and
+        showRepaintCounter().
+
+        * src/NonCompositedContentHost.cpp:
+        * src/NonCompositedContentHost.h:
+        (NonCompositedContentHost):
+        * src/PageOverlay.cpp:
+        * tests/GraphicsLayerChromiumTest.cpp:
+        * tests/ImageLayerChromiumTest.cpp:
+
+2012-11-05  Bo Liu  <boliu@chromium.org>
+
+        Expose hit test related methods in public chromium port
+        https://bugs.webkit.org/show_bug.cgi?id=101204
+
+        Reviewed by Adam Barth.
+
+        The methods are needed in implementating hit test related methods in the
+        Android WebView API.
+
+        The specific methods are:
+        [Web]HitTestResult::urlElement
+        [Web]HitTestResult::absoluteImageURL
+        [Web]HitTestResult::absoluteLinkURL
+        [Web]HitTestResult::isContentEditable
+        WebViewImpl::hitTestResultAt
+
+        * public/WebHitTestResult.h:
+        (WebKit):
+        (WebHitTestResult):
+        * public/WebView.h:
+        (WebKit):
+        (WebView):
+        * src/WebHitTestResult.cpp:
+        (WebKit::WebHitTestResult::urlElement):
+        (WebKit):
+        (WebKit::WebHitTestResult::absoluteImageURL):
+        (WebKit::WebHitTestResult::absoluteLinkURL):
+        (WebKit::WebHitTestResult::isContentEditable):
+        * src/WebViewImpl.cpp:
+        (WebKit::WebViewImpl::hitTestResultAt):
+        (WebKit):
+        * src/WebViewImpl.h:
+        (WebViewImpl):
+
+2012-11-05  Alok Priyadarshi  <alokp@chromium.org>
+
+        [chromium] Pass canPaintLCDText to WebContentLayerClient::paintContents
+        https://bugs.webkit.org/show_bug.cgi?id=99083
+
+        Reviewed by Stephen White.
+
+        Use LCD text setting passed to WebContentLayerClient::paintContents instead of turning it off for all composited layers.
+
+        * src/LinkHighlight.cpp:
+        (WebKit::LinkHighlight::paintContents):
+        * src/LinkHighlight.h:
+        (LinkHighlight):
+        * src/NonCompositedContentHost.cpp:
+        (WebKit::NonCompositedContentHost::NonCompositedContentHost):
+        (WebKit::NonCompositedContentHost::setOpaque):
+        (WebKit::NonCompositedContentHost::paintContents):
+        * src/NonCompositedContentHost.h:
+        (NonCompositedContentHost):
+        * tests/OpaqueRectTrackingContentLayerDelegateTest.cpp:
+        (WebCore::TEST_F):
+
+2012-11-05  Alok Priyadarshi  <alokp@chromium.org>
+
+        Unreviewed. Rolled DEPS.
+
+        * DEPS:
+
+2012-11-05  Miguel Garcia  <miguelg@chromium.org>
+
+        [Chromium] Disable registerProtocolHandler on Android
+        https://bugs.webkit.org/show_bug.cgi?id=101199
+
+        Reviewed by Julien Chaffraix.
+
+        Chromium for Android has been exposing registerProtocolHandler, but the feature wasn't
+        actually wired up internally. Disable the feature to avoid breaking feature detection
+        until we can implement it properly.
+
+        * features.gypi:
+
+2012-11-04  MORITA Hajime  <morrita@google.com>
+
+        Shadow DOM should be able to be disabled per context.
+        https://bugs.webkit.org/show_bug.cgi?id=101173
+
+        Reviewed by Dimitri Glazkov.
+
+        * src/ContextFeaturesClientImpl.cpp:
+        (WebKit::ContextFeaturesClientImpl::askIfIsEnabled):
+
+2012-11-03  Dan Beam  <dbeam@chromium.org>
+
+        Implement HTMLFormElement#requestAutocomplete and associated events
+        https://bugs.webkit.org/show_bug.cgi?id=100557
+
+        Reviewed by Adam Barth.
+
+        Implements an initial version of the proposal for interactive autocomplete outlined in this email:
+        http://lists.whatwg.org/htdig.cgi/whatwg-whatwg.org/2012-October/037711.html
+
+        The goal of this patch is to allow web authors to call formElement.requestAutocomplete(); after subscribing for
+        autocomplete/autocompleteerror events on formElement. If the form's [autocomplete] attribute is "off" an
+        error will be dispatched. Otherwise, a request will be issued to the FrameLoaderClient.  At the moment, the
+        implementation in Chrome (https://codereview.chromium.org/11270018/) will simply dispatch an error until the
+        UI on Chrome's side is built. Both autocomplete and autocompleteerror events will be dispatched asynchronously
+        after a small delay to behave consistently in all situations and implementations.
+
+        Currently this is behind the feature flag REQUEST_AUTOCOMPLETE, which is disabled.
+
+        Test: fast/forms/form-request-autocomplete.html
+
+        * public/WebAutofillClient.h:
+        (WebKit):
+        (WebAutofillClient):
+        (WebKit::WebAutofillClient::didRequestAutocomplete):
+
+        Added WebAutofillClient::didRequestAutocomplete to chrome's public WebKit interface.
+
+        * public/WebFormElement.h:
+
+        Added an enum that matches HTMLFormElement::AutocompleteResult (and added compile time assert) and a public method
+        (WebFormElement::finishRequestAutocomplete) to WebFormElement's public interface.
+
+        * src/AssertMatchingEnums.cpp:
+
+        Added a compile time assert to guarantee the HTMLFormElement::AutocompleteResult enum matches the
+        WebFormElement::AutocompleteResult enum.
+
+        * src/FrameLoaderClientImpl.cpp:
+        (WebKit):
+        (WebKit::FrameLoaderClientImpl::didRequestAutocomplete):
+
+        Implemented the added FrameLoaderClient::didRequestAutocomplete, which simply passes through to the
+        WebAutofillClient.
+
+        * src/FrameLoaderClientImpl.h:
+        (FrameLoaderClientImpl):
+
+        Implementing FrameLoaderClient::didRequestAutocomplete.
+
+        * src/WebFormElement.cpp:
+        (WebKit::WebFormElement::finishRequestAutocomplete):
+        (WebKit):
+
+        Added WebFormElement::finishRequestAutocomplete to allow chromium's renderer a public API to call to finish the
+        autocomplete request on a WebFormElement.
+
+2012-11-02  Anders Carlsson  <andersca@apple.com>
+
+        Add a PluginInactive plug-in unavailability reason
+        https://bugs.webkit.org/show_bug.cgi?id=101089
+
+        Reviewed by Sam Weinig.
+
+        * src/LocalizedStrings.cpp:
+        (WebCore::inactivePluginText):
+        (WebCore):
+
+2012-11-02  Ian Vollick  <vollick@chromium.org>
+
+        Support invalidation tracking for composited layers
+        https://bugs.webkit.org/show_bug.cgi?id=97801
+
+        Reviewed by Simon Fraser.
+
+        GraphicsLayers now store invalidated rects and can include them in
+        the layer tree dump.
+
+        (WebKit::WebWidget::isTrackingRepaints):
+          Used by the NonCompositedContentHost to determine if we are tracking
+          repaint rects.
+        (WebKit::WebWidget::isTrackingRepaints):
+        * src/LinkHighlight.cpp:
+        (WebKit::LinkHighlight::updateGeometry):
+          Now calls GraphicsLayer::addRepaintRect when invalidated.
+        * src/NonCompositedContentHost.cpp:
+        (WebKit::NonCompositedContentHost::isTrackingRepaints):
+          Required as this is a GraphicsLayerClient.
+        * src/WebViewImpl.cpp:
+        (WebKit::WebViewImpl::isTrackingRepaints):
+          Implementation of WebWidget::isTrackingRepaints.
+
+2012-11-02  Stephen White  <senorblanco@chromium.org>
+
+        Unreviewed.  Rolled DEPS.
+
+        * DEPS:
+
+2012-11-02  Kent Tamura  <tkent@chromium.org>
+
+        Optimize DateTimeFormat::quoteAndAppendLiteral output
+        https://bugs.webkit.org/show_bug.cgi?id=101040
+
+        Reviewed by Kentaro Hara.
+
+        * tests/LocaleWinTest.cpp:
+        (TEST_F): Update test results.
+
+2012-11-01  Kent Tamura  <tkent@chromium.org>
+
+        Introduce ENABLE_DATE_AND_TIME_INPUT_TYPES, and clarify usage of other related flags
+        https://bugs.webkit.org/show_bug.cgi?id=101007
+
+        Reviewed by Kentaro Hara.
+
+        * src/ChromeClientImpl.cpp:
+        (WebKit::ChromeClientImpl::openDateTimeChooser):
+        Follow the ChromeClient::openDateTimeChooser flag change.
+        Also, add an empty implemenatation for Android.
+        * src/ChromeClientImpl.h:
+        Follow the ChromeClient::openDateTimeChooser flag change.
+        * src/DateTimeChooserImpl.cpp: Wrapped with
+        ENABLE(INPUT_MULTIPLE_FIELDS_UI). This class is not used in Android.
+        * src/DateTimeChooserImpl.h: Ditto.
+        * src/LocalizedStrings.cpp: Follow the LocalizedString.h change.
+
+2012-11-01  Alec Flett  <alecflett@chromium.org>
+
+        IndexedDB: add methods to support id-based backend APIs
+        https://bugs.webkit.org/show_bug.cgi?id=100425
+
+        Reviewed by Tony Chang.
+
+        Chromium Proxy and WebIDB* support for new int64_t-based methods.
+
+        * public/WebIDBDatabase.h:
+        (WebKit::WebIDBDatabase::deleteObjectStore):
+        (WebKit::WebIDBDatabase::transaction):
+        * public/WebIDBObjectStore.h:
+        (WebKit::WebIDBObjectStore::put):
+        (WebKit::WebIDBObjectStore::setIndexKeys):
+        (WebKit::WebIDBObjectStore::setIndexesReady):
+        (WebKit::WebIDBObjectStore::index):
+        (WebKit::WebIDBObjectStore::deleteIndex):
+        * public/WebIDBTransaction.h:
+        (WebKit::WebIDBTransaction::objectStore):
+        * src/IDBDatabaseBackendProxy.cpp:
+        (WebKit::IDBDatabaseBackendProxy::deleteObjectStore):
+        (WebKit):
+        (WebKit::IDBDatabaseBackendProxy::transaction):
+        * src/IDBDatabaseBackendProxy.h:
+        (IDBDatabaseBackendProxy):
+        * src/IDBObjectStoreBackendProxy.cpp:
+        (WebKit::IDBObjectStoreBackendProxy::put):
+        (WebKit):
+        (WebKit::IDBObjectStoreBackendProxy::setIndexKeys):
+        (WebKit::IDBObjectStoreBackendProxy::setIndexesReady):
+        (WebKit::IDBObjectStoreBackendProxy::index):
+        (WebKit::IDBObjectStoreBackendProxy::deleteIndex):
+        * src/IDBObjectStoreBackendProxy.h:
+        (IDBObjectStoreBackendProxy):
+        * src/IDBTransactionBackendProxy.cpp:
+        (WebKit::IDBTransactionBackendProxy::objectStore):
+        * src/IDBTransactionBackendProxy.h:
+        (IDBTransactionBackendProxy):
+        * src/WebIDBMetadata.cpp:
+        (WebKit::WebIDBMetadata::WebIDBMetadata):
+        (WebKit::WebIDBMetadata::operator IDBDatabaseMetadata):
+        * src/WebIDBTransactionImpl.cpp:
+        (WebKit::WebIDBTransactionImpl::objectStore):
+        (WebKit):
+        * src/WebIDBTransactionImpl.h:
+        * tests/IDBDatabaseBackendTest.cpp:
+
+2012-11-01  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed.  Rolled DEPS.
+
+        * DEPS:
+
+2012-11-01  Pavel Feldman  <pfeldman@chromium.org>
+
+        Web Inspector: expose Inspector.detached event factory to the embedder.
+        https://bugs.webkit.org/show_bug.cgi?id=100967
+
+        Reviewed by Vsevolod Vlasov.
+
+        That way embedder will be able to send messages on behalf of the backend being destructed.
+
+        * public/WebDevToolsAgent.h:
+        (WebDevToolsAgent):
+        * src/WebDevToolsAgentImpl.cpp:
+        (SerializingFrontendChannel):
+        (WebKit::SerializingFrontendChannel::sendMessageToFrontend):
+        (WebKit::WebDevToolsAgent::inspectorDetachedEvent):
+        (WebKit):
+        (WebKit::WebDevToolsAgent::workerDisconnectedFromWorkerEvent):
+        (WebKit::WebDevToolsAgent::disconnectEventAsText):
+
+2012-11-01  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        [Chromium] debug builds: Use after free under ~PageOverlay()
+        https://bugs.webkit.org/show_bug.cgi?id=100930
+
+        Reviewed by Pavel Feldman.
+
+        Changed members order in PageOverlay so that GraphicsLayer is destroyed before GraphicsLayerClient.
+
+        * src/PageOverlay.h:
+        (PageOverlay):
+
+2012-11-01  James Robinson  <jamesr@chromium.org>
+
+        [chromium] Avoid attempting to defer commits when they are already deferred
+        https://bugs.webkit.org/show_bug.cgi?id=100913
+
+        Reviewed by Adrienne Walker.
+
+        In threaded compositing mode, it's possible to load and unload FrameViews without any
+        intervening invalidations. In this case, we enter setIsAcceleratedCompositingActive
+        with commits already deferred.  There's no need to defer again and doing so trips
+        an assertion in the implementation.
+
+        * src/WebViewImpl.cpp:
+        (WebKit::WebViewImpl::setIsAcceleratedCompositingActive):
+        (WebKit):
+
+2012-11-01  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed.  Rolled DEPS.
+
+        * DEPS:
+
+2012-11-01  Yury Semikhatsky  <yurys@chromium.org>
+
+        Memory instrumentation: report memory occupied by ResourceRequest instead of its base ResourceRequestBase
+        https://bugs.webkit.org/show_bug.cgi?id=100497
+
+        Reviewed by Alexander Pavlov.
+
+        Updated MemoryInstrumentationTest.ImageObserver so that it doesn't fail
+        when instrumentation of objects referenced by CachedImage changes.
+
+        * tests/MemoryInstrumentationTest.cpp:
+
+2012-11-01  Kent Tamura  <tkent@chromium.org>
+
+        Remove unused Locale::parseDateTime
+        https://bugs.webkit.org/show_bug.cgi?id=100910
+
+        Reviewed by Kentaro Hara.
+
+        * tests/LocaleMacTest.cpp: Remove tests for parseDateTime.
+        * tests/LocaleWinTest.cpp: Ditto.
+
+2012-10-31  Keishi Hattori  <keishi@webkit.org>
+
+        [Chromium] Page popup shows up at wrong locations when root view is scrolled
+        https://bugs.webkit.org/show_bug.cgi?id=100830
+
+        Reviewed by Kent Tamura.
+
+        We need to account for the scroll position when calculating the root view rectangle in the screen.
+
+        * src/DateTimeChooserImpl.cpp:
+        (WebKit::DateTimeChooserImpl::writeDocument):
+
+2012-10-31  Stephen White  <senorblanco@chromium.org>
+
+        Unreviewed, rolling out r133122.
+        http://trac.webkit.org/changeset/133122
+        https://bugs.webkit.org/show_bug.cgi?id=99083
+
+        Broke Chromium Win, Android, ChromeOS builds
+
+        * src/LinkHighlight.cpp:
+        (WebKit::LinkHighlight::paintContents):
+        * src/LinkHighlight.h:
+        (LinkHighlight):
+        * src/NonCompositedContentHost.cpp:
+        (WebKit::NonCompositedContentHost::NonCompositedContentHost):
+        (WebKit::NonCompositedContentHost::setOpaque):
+        (WebKit::NonCompositedContentHost::paintContents):
+        * src/NonCompositedContentHost.h:
+        (NonCompositedContentHost):
+        * tests/OpaqueRectTrackingContentLayerDelegateTest.cpp:
+        (WebCore::TEST_F):
+
+2012-10-31  Alok Priyadarshi  <alokp@chromium.org>
+
+        [chromium] Pass canPaintLCDText to WebContentLayerClient::paintContents
+        https://bugs.webkit.org/show_bug.cgi?id=99083
+
+        Reviewed by James Robinson.
+
+        Use LCD text setting passed to WebContentLayerClient::paintContents instead of turning it off for all composited layers.
+
+        * src/LinkHighlight.cpp:
+        (WebKit::LinkHighlight::paintContents):
+        * src/LinkHighlight.h:
+        (LinkHighlight):
+        * src/NonCompositedContentHost.cpp:
+        (WebKit::NonCompositedContentHost::NonCompositedContentHost):
+        (WebKit::NonCompositedContentHost::setOpaque):
+        (WebKit::NonCompositedContentHost::paintContents):
+        * src/NonCompositedContentHost.h:
+        (NonCompositedContentHost):
+        * tests/OpaqueRectTrackingContentLayerDelegateTest.cpp:
+        (WebCore::TEST_F):
+
+2012-10-31  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed.  Rolled DEPS.
+
+        * DEPS:
+
+2012-10-31  Stephen White  <senorblanco@chromium.org>
+
+        Unreviewed, rolling out r133107.
+        http://trac.webkit.org/changeset/133107
+        https://bugs.webkit.org/show_bug.cgi?id=100425
+
+        Broke compile on Chromium Win
+
+        * public/WebIDBDatabase.h:
+        (WebKit::WebIDBDatabase::transaction):
+        * public/WebIDBObjectStore.h:
+        (WebKit::WebIDBObjectStore::index):
+        * public/WebIDBTransaction.h:
+        (WebKit::WebIDBTransaction::objectStore):
+        * src/IDBDatabaseBackendProxy.cpp:
+        * src/IDBDatabaseBackendProxy.h:
+        (IDBDatabaseBackendProxy):
+        * src/IDBObjectStoreBackendProxy.cpp:
+        (WebKit::IDBObjectStoreBackendProxy::setIndexesReady):
+        * src/IDBObjectStoreBackendProxy.h:
+        (IDBObjectStoreBackendProxy):
+        * src/IDBTransactionBackendProxy.cpp:
+        * src/IDBTransactionBackendProxy.h:
+        (IDBTransactionBackendProxy):
+        * src/WebIDBCallbacksImpl.cpp:
+        * src/WebIDBDatabaseImpl.cpp:
+        * src/WebIDBDatabaseImpl.h:
+        (WebIDBDatabaseImpl):
+        * src/WebIDBMetadata.cpp:
+        (WebKit::WebIDBMetadata::WebIDBMetadata):
+        (WebKit::WebIDBMetadata::operator IDBDatabaseMetadata):
+        * src/WebIDBObjectStoreImpl.cpp:
+        * src/WebIDBObjectStoreImpl.h:
+        (WebIDBObjectStoreImpl):
+        * src/WebIDBTransactionImpl.cpp:
+        * src/WebIDBTransactionImpl.h:
+        * tests/IDBDatabaseBackendTest.cpp:
+
+2012-10-31  Alec Flett  <alecflett@chromium.org>
+
+        IndexedDB: add methods to support id-based backend APIs
+        https://bugs.webkit.org/show_bug.cgi?id=100425
+
+        Reviewed by Tony Chang.
+
+        Chromium Proxy and WebIDB* support for new int64_t-based methods.
+
+        * public/WebIDBDatabase.h:
+        (WebKit::WebIDBDatabase::deleteObjectStore):
+        (WebKit::WebIDBDatabase::transaction):
+        * public/WebIDBObjectStore.h:
+        (WebKit::WebIDBObjectStore::put):
+        (WebKit::WebIDBObjectStore::setIndexKeys):
+        (WebKit::WebIDBObjectStore::setIndexesReady):
+        (WebKit::WebIDBObjectStore::index):
+        (WebKit::WebIDBObjectStore::deleteIndex):
+        * public/WebIDBTransaction.h:
+        (WebKit::WebIDBTransaction::objectStore):
+        * src/IDBDatabaseBackendProxy.cpp:
+        (WebKit::IDBDatabaseBackendProxy::deleteObjectStore):
+        (WebKit):
+        (WebKit::IDBDatabaseBackendProxy::transaction):
+        * src/IDBDatabaseBackendProxy.h:
+        (IDBDatabaseBackendProxy):
+        * src/IDBObjectStoreBackendProxy.cpp:
+        (WebKit::IDBObjectStoreBackendProxy::put):
+        (WebKit):
+        (WebKit::IDBObjectStoreBackendProxy::setIndexKeys):
+        (WebKit::IDBObjectStoreBackendProxy::setIndexesReady):
+        (WebKit::IDBObjectStoreBackendProxy::index):
+        (WebKit::IDBObjectStoreBackendProxy::deleteIndex):
+        * src/IDBObjectStoreBackendProxy.h:
+        (IDBObjectStoreBackendProxy):
+        * src/IDBTransactionBackendProxy.cpp:
+        (WebKit::IDBTransactionBackendProxy::objectStore):
+        * src/IDBTransactionBackendProxy.h:
+        (IDBTransactionBackendProxy):
+        * src/WebIDBMetadata.cpp:
+        (WebKit::WebIDBMetadata::WebIDBMetadata):
+        (WebKit::WebIDBMetadata::operator IDBDatabaseMetadata):
+        * src/WebIDBTransactionImpl.cpp:
+        (WebKit::WebIDBTransactionImpl::objectStore):
+        (WebKit):
+        * src/WebIDBTransactionImpl.h:
+        * tests/IDBDatabaseBackendTest.cpp:
+
+2012-10-31  Tien-Ren Chen  <trchen@chromium.org>
+
+        Apply transformation for highlights on non-composited contents
+        https://bugs.webkit.org/show_bug.cgi?id=100438
+
+        Reviewed by Adam Barth.
+
+        Non-composited content host layer "steals" the contents on the
+        RenderView layer, including the highlight layer.
+        The transformation for regular contents are applied by the paint
+        function of the non-composited content host however the highlight
+        uses its own WebLayer. Need to apply the same transformation to
+        the highlight layer as well.
+
+        * src/LinkHighlight.cpp:
+        (WebKit::LinkHighlight::computeEnclosingCompositingLayer):
+        * src/LinkHighlight.h:
+        (LinkHighlight):
+
+2012-10-31  Mike West  <mkwst@chromium.org>
+
+        Prefer document->addConsoleMessage to document->domWindow->console->addMessage.
+        https://bugs.webkit.org/show_bug.cgi?id=100850
+
+        Reviewed by Adam Barth.
+
+        For historical reasons, a few places in WebCore talk to Console directly
+        via 'document()->domWindow()->console()->addMessage(...)'. This is more
+        safely wrapped by calling 'addConsoleMessage' on the Document itself.
+
+        No visible functionality should change; we'll simply avoid potential
+        null dereferences in the future.
+
+        * src/WebFrameImpl.cpp:
+        (WebKit::WebFrameImpl::addMessageToConsole):
+
+2012-10-31  Kent Tamura  <tkent@chromium.org>
+
+        Remove code to hide/reshow text caret for PagePopups
+        https://bugs.webkit.org/show_bug.cgi?id=100834
+
+        Reviewed by Hajime Morita.
+
+        All of form controls supporting PagePopups don't have a text
+        caret. We don't need to hide a text caret on opening a PagePopup,
+        and don't need to reshow it on closing the PagePopup.
+
+        We had this code because an old UI of input[type=date] had a text
+        caret.
+
+        * src/WebViewImpl.cpp:
+        (WebKit::WebViewImpl::openPagePopup):
+        (WebKit::WebViewImpl::closePagePopup):
+
+2012-10-31  Mike West  <mkwst@chromium.org>
+
+        Script run from an isolated world should bypass a page's CSP.
+        https://bugs.webkit.org/show_bug.cgi?id=97398
+
+        Reviewed by Adam Barth.
+
+        * public/WebFrame.h:
+        (WebFrame):
+        * src/WebFrameImpl.cpp:
+        (WebKit::WebFrameImpl::setIsolatedWorldSecurityOrigin):
+        (WebKit):
+        (WebKit::WebFrameImpl::setIsolatedWorldContentSecurityPolicy):
+        * src/WebFrameImpl.h:
+        (WebFrameImpl):
+            Piping a Content Security Policy through WebFrame, in the same way
+            we're currently doing for SecurityOrigin. As a drive-by, this also
+            uses the static method on DOMWrapperWindow to set the security
+            origin, rather than routing through the frame's ScriptController.
+
+2012-10-30  W. James MacLean  <wjmaclean@chromium.org>
+
+        [chromium] Transform mouse/gesture event coordinates to account for pinch-zoom in compositor.
+        https://bugs.webkit.org/show_bug.cgi?id=100542
+
+        Reviewed by James Robinson.
+
+        Pinch-zoom in the compositor applies a transformation that WebCore does not know about.
+        We need to adjust mouse and gesture event coordinates to account for this in order that
+        hit testing work properly for these types while zoomed.
+
+        * src/WebViewImpl.cpp:
+        (WebKit::WebViewImpl::handleInputEvent): Modified to adjoint event coordinates to account for zoom.
+
+2012-10-30  W. James MacLean  <wjmaclean@chromium.org>
+
+        [chromium] Restrict link highlights to targets that display a hand-cursor
+        https://bugs.webkit.org/show_bug.cgi?id=99862
+
+        Reviewed by James Robinson.
+
+        To avoid applying highlights to inappropriate targets, such as large divs with
+        click handlers installed, test candidate targets and only highlight them if they
+        would normally display a hand cursor on mouse over. This is a heuristic, but has
+        been tested and found effective in practice.
+
+        * src/WebViewImpl.cpp:
+        (WebKit::WebViewImpl::handleGestureEvent):
+        (WebKit::invokesHandCursor):
+        (WebKit::WebViewImpl::bestTouchLinkNode):
+        (WebKit::WebViewImpl::enableTouchHighlight):
+        * src/WebViewImpl.h:
+        (WebViewImpl):
+        * tests/LinkHighlightTest.cpp:
+        (WebCore::TEST):
+        * tests/data/test_touch_link_highlight.html:
+
+2012-10-30  Alok Priyadarshi  <alokp@chromium.org>
+
+        Unreviewed. Rolled DEPS.
+
+        * DEPS:
+
+2012-10-30  Dan Carney  <dcarney@google.com>
+
+        Remove ensureAuxiliaryContext
+        https://bugs.webkit.org/show_bug.cgi?id=99975
+
+        Reviewed by Adam Barth.
+
+        Updated tests to use correct v8 context.
+
+        * tests/IDBBindingUtilitiesTest.cpp:
+        (WebKit::checkKeyFromValueAndKeyPathInternal):
+        (WebKit::checkKeyPathNullValue):
+        (WebKit::injectKey):
+        (WebKit::checkInjection):
+        (WebKit::checkInjectionFails):
+        (WebKit::checkKeyPathStringValue):
+        (WebKit::checkKeyPathNumberValue):
+        (WebKit::scriptExecutionContext):
+        (WebKit):
+        (WebKit::TEST):
+
+2012-10-30  Kent Tamura  <tkent@chromium.org>
+
+        Remove unused code for old input[type=date] UI
+        https://bugs.webkit.org/show_bug.cgi?id=100734
+
+        Reviewed by Hajime Morita.
+
+        * src/LocalizedStrings.cpp:
+        Follow the LocalizedStrings.h change.
+        * tests/LocaleMacTest.cpp:
+        (LocaleMacTest): Remove tests for Locale::dateFormatText.
+        * tests/LocaleWinTest.cpp:
+        (LocaleWinTest): Ditto.
+
+2012-10-30  Kent Tamura  <tkent@chromium.org>
+
+        Fix crash by calendar picker or suggestion picker
+        https://bugs.webkit.org/show_bug.cgi?id=100728
+
+        Reviewed by Hajime Morita.
+
+        * src/DateTimeChooserImpl.h:
+        (DateTimeChooserImpl): Add a factory function, and made the constructor private.
+        * src/DateTimeChooserImpl.cpp:
+        (WebKit::DateTimeChooserImpl::create): Added.
+        (WebKit::DateTimeChooserImpl::setValueAndClosePopup):
+        Protect this because JavaScript code might run during didChooseValue.
+
+        * src/ChromeClientImpl.h:
+        (ChromeClientImpl): Follow the ChromeClient change.
+        * src/ChromeClientImpl.cpp:
+        (WebKit::ChromeClientImpl::openDateTimeChooser):
+        Use DateTimeChooserImpl::create.
+
+
+2012-10-29  James Robinson  <jamesr@chromium.org>
+
+        [chromium] Null-check WebViewImpl::m_client before calling invalidateRect() on it
+        https://bugs.webkit.org/show_bug.cgi?id=100716
+
+        Reviewed by Dirk Pranke.
+
+        This check was accidentally removed in r132862 and the value is null in at least some unit tests.
+
+        * src/WebViewImpl.cpp:
+        (WebKit::WebViewImpl::invalidateRect):
+
+2012-10-29  Vincent Scheib  <scheib@chromium.org>
+
+        Unreviewed, rolling out r132845.
+        http://trac.webkit.org/changeset/132845
+        https://bugs.webkit.org/show_bug.cgi?id=99975
+
+        Broke chromium builds, linker errors from
+        IDBBindingUtilitiesTest
+
+        * tests/IDBBindingUtilitiesTest.cpp:
+        (WebCore::TEST):
+
+2012-10-29  James Robinson  <jamesr@chromium.org>
+
+        [chromium] Defer commits between page unload and first invalidation in threaded compositing mode
+        https://bugs.webkit.org/show_bug.cgi?id=100702
+
+        Reviewed by Adrienne Walker.
+
+        In threaded compositing mode, it's not terribly useful to commit after unloading a page and before receiving
+        the first invalidation for the new page since the document is likely not loaded enough to paint usefully.
+        This defers commits from the time compositing is deactivated (which in force compositing mode only happens
+        at FrameView destruction) until we get the first invalidation from WebCore.
+
+        * src/ChromeClientImpl.cpp:
+        (WebKit::ChromeClientImpl::invalidateContentsAndRootView):
+        * src/WebViewImpl.cpp:
+        (WebKit::WebViewImpl::invalidateRect):
+        (WebKit::WebViewImpl::setIsAcceleratedCompositingActive):
+        (WebKit):
+        * src/WebViewImpl.h:
+        (WebViewImpl):
+
+2012-10-29  Stephen White  <senorblanco@chromium.org>
+
+        Unreviewed.  Rolled DEPS.
+
+        * DEPS:
+
+2012-10-29  Dan Carney  <dcarney@google.com>
+
+        Remove ensureAuxiliaryContext
+        https://bugs.webkit.org/show_bug.cgi?id=99975
+
+        Reviewed by Adam Barth.
+
+        Updated tests to use correct v8 context.
+
+        * tests/IDBBindingUtilitiesTest.cpp:
+        (WebKit::checkKeyFromValueAndKeyPathInternal):
+        (WebKit::checkKeyPathNullValue):
+        (WebKit::injectKey):
+        (WebKit::checkInjection):
+        (WebKit::checkInjectionFails):
+        (WebKit::checkKeyPathStringValue):
+        (WebKit::checkKeyPathNumberValue):
+        (WebKit::scriptExecutionContext):
+        (WebKit):
+        (WebKit::TEST):
+
+2012-10-29  Patrick Dubroy  <dubroy@chromium.org>
+
+        Web Inspector: Style toolbar to match Chromium toolbar on Chromium/Mac.
+        https://bugs.webkit.org/show_bug.cgi?id=100683
+
+        Reviewed by Pavel Feldman.
+
+        When in compact mode, style the Web Inspector toolbar using the same colors & gradients
+        as the Chromium toolbar (Chromium port only).
+
+        * src/js/devTools.css:
+        (body.compact.platform-mac #toolbar):
+        (body.compact.platform-mac.inactive #toolbar):
+        (body.platform-mac.inactive #toolbar .toolbar-label):
+
+2012-10-29  Eugene Klyuchnikov  <eustas.bug@gmail.com>
+
+        Web Inspector: Timeline: make cpu-monitoring feature available only on capable browsers
+        https://bugs.webkit.org/show_bug.cgi?id=100530
+
+        Reviewed by Yury Semikhatsky.
+
+        Motivation: cpu-monitoring feature looks like a glitch,
+        when it is not supported by browser.
+
+        * src/InspectorClientImpl.cpp: Implemented capability getter.
+        * src/InspectorClientImpl.h:
+
+2012-10-29  Kent Tamura  <tkent@chromium.org>
+
+        [Chromium] Merge LocalizedNumberICUTest into LocaleICUTest
+        https://bugs.webkit.org/show_bug.cgi?id=100648
+
+        Reviewed by Kentaro Hara.
+
+        LocalizedNumberICU was removed some months ago, and its features were
+        merged to LocaleICU. We merge the test too.
+
+        * WebKit.gypi: Remove LocalizedNumberICUTest.cpp
+        * tests/LocaleICUTest.cpp:
+        Move a #if because some headers are used unconditionally.
+        (testDecimalSeparator): Moved from LocalizedNumberICUTest.cpp.
+        (TEST_F): Ditto.
+        (testNumberIsReversible): Ditto.
+        (testNumbers): Ditto.
+        * tests/LocalizedNumberICUTest.cpp: Removed.
+
+2012-10-29  Kent Tamura  <tkent@chromium.org>
+
+        [Chromium] Rename LocalizedDateICUTest.cpp to LocaleICUTest.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=100643
+
+        Reviewed by Kentaro Hara.
+
+        LocalizedDateICU was removed some months ago, and LocalizedDateICUTest
+        actually had tests for LocaleICU.
+
+        * WebKit.gypi:
+        * tests/LocaleICUTest.cpp:
+        - Renamed from Source/WebKit/chromium/tests/LocalizedDateICUTest.cpp.
+        - Rename LocalizedDateICUTest class to LocaleICUTest.
+
+2012-10-29  Kent Tamura  <tkent@chromium.org>
+
+        [Chromium-linux] Fix build.
+
+        * tests/LocalizedNumberICUTest.cpp:
+        (testNumberIsReversible): Rename an argument.
+        (testDecimalSeparator): Ditto.
+
+2012-10-28  Kent Tamura  <tkent@chromium.org>
+
+        Rename Localizer to Locale
+        https://bugs.webkit.org/show_bug.cgi?id=100634
+
+        Reviewed by Kentaro Hara.
+
+        * src/ColorChooserUIController.h:
+        (ColorChooserUIController):
+        Rename m_localizer to m_locale, and follow other renamings.
+        * src/ColorChooserUIController.cpp:
+        (WebKit::ColorChooserUIController::ColorChooserUIController): Follow renamings.
+        (WebKit::ColorChooserUIController::locale): Ditto.
+        * src/DateTimeChooserImpl.h:
+        (DateTimeChooserImpl):
+        Rename m_localizer to m_locale, and follow other renamings.
+        * src/DateTimeChooserImpl.cpp:
+        (WebKit::DateTimeChooserImpl::DateTimeChooserImpl): Follow renamings.
+        (WebKit::DateTimeChooserImpl::writeDocument): Ditto.
+        (WebKit::DateTimeChooserImpl::locale): Ditto.
+        * tests/LocaleMacTest.cpp:
+        (LocaleMacTest::formatTime): Ditto.
+        (testNumberIsReversible): Ditto.
+        * tests/LocalizedNumberICUTest.cpp:
+        (testNumberIsReversible): Ditto.
+        (testDecimalSeparator): Ditto.
+
+2012-10-29  Kent Tamura  <tkent@chromium.org>
+
+        Unreviewed.  Rolled DEPS.
+
+        * DEPS:
+
+2012-10-28  Kent Tamura  <tkent@chromium.org>
+
+        Rename Localizer.{cpp,h} to PlatformLocale.{cpp,h}
+        https://bugs.webkit.org/show_bug.cgi?id=100627
+
+        Reviewed by Yuta Kitamura.
+
+        * src/ColorChooserUIController.h: Follow the file name renaming.
+        * src/DateTimeChooserImpl.cpp: Ditto.
+
+2012-10-27  Adam Barth  <abarth@webkit.org>
+
+        [Chromium] Find-in-page reports matches in hidden iframes
+        https://bugs.webkit.org/show_bug.cgi?id=100604
+
+        Reviewed by Eric Seidel.
+
+        This is actually a regression caused by
+        http://trac.webkit.org/changeset/128784. This patch adds back some code
+        removed in WebFrameImpl::shouldScopeMatches in r128784.
+
+        This patch also introduces a test so that we don't make this mistake
+        again.
+
+        * src/WebFrameImpl.cpp:
+        (WebKit::WebFrameImpl::shouldScopeMatches):
+        * tests/WebFrameTest.cpp:
+        * tests/data/find_in_hidden_frame.html: Added.
+
+2012-10-26  Kent Tamura  <tkent@chromium.org>
+
+        [Chromium] Convert Chromium template string to an LDML date format
+        https://bugs.webkit.org/show_bug.cgi?id=100128
+
+        Reviewed by Tony Chang.
+
+        * src/LocalizedStrings.cpp:
+        (WebCore): Include WebCore/platform/text/DateTimeFormat.h.
+        (WebCore::weekFormatInLDML):
+        Replace $1 with yyyy, $2 with ww, and quote other parts.
+
+2012-10-26  James Robinson  <jamesr@chromium.org>
+
+        [chromium] Allow embedder to enter/leave force compositing mode
+        https://bugs.webkit.org/show_bug.cgi?id=100458
+
+        Reviewed by Adrienne Walker.
+
+        This adds API for the embedder to decide when to enter and leave force compositing mode since it's
+        more efficient to only toggle this setting when the embedder is about to produce a frame.
+
+        * public/WebWidget.h:
+        (WebWidget):
+        (WebKit::WebWidget::enterForceCompositingMode):
+        * src/WebFrameImpl.cpp:
+        (WebKit::WebViewImpl::enterForceCompositingMode):
+        (WebKit):
+        * src/WebViewImpl.h:
+        (WebViewImpl):
+
+2012-10-26  Dominic Mazzoni  <dmazzoni@google.com>
+
+        AX: Notification should be sent when accessibilityIsIgnored changes
+        https://bugs.webkit.org/show_bug.cgi?id=99547
+
+        Reviewed by Chris Fleizach.
+
+        Adds new accessibility notifications.
+
+        * public/WebAccessibilityNotification.h:
+        * src/AssertMatchingEnums.cpp:
+
+2012-10-26  Thiago Marcos P. Santos  <thiago.santos@intel.com>
+
+        Add feature flags for CSS Device Adaptation
+        https://bugs.webkit.org/show_bug.cgi?id=95960
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        * features.gypi:
+
+2012-10-26  Kent Tamura  <tkent@chromium.org>
+
+        Disable ENABLE_INPUT_TYPE_WEEK on Chromium/Android
+        https://bugs.webkit.org/show_bug.cgi?id=100457
+
+        Reviewed by Kentaro Hara.
+
+        It was enabled accidentally. Week input is not implemented in
+        Android.
+
+        * features.gypi: Remove ENABLE_INPUT_TYPE_WEEK=1 in the common block,
+        add ENABLE_INPUT_TYPE_WEEK=0 in Android block, and add
+        ENABLE_INPUT_TYPE_WEEK=1 in non-Android block.
+
+2012-10-26  Kent Tamura  <tkent@chromium.org>
+
+        [Chromium-Win] Support shortTimeFormat
+        https://bugs.webkit.org/show_bug.cgi?id=100471
+
+        Reviewed by Kentaro Hara.
+
+        * tests/LocaleWinTest.cpp:
+        (TEST_F): Update test expectations for the behavior change.
+
+2012-10-25  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r132514.
+        http://trac.webkit.org/changeset/132514
+        https://bugs.webkit.org/show_bug.cgi?id=100440
+
+        "Broke chromium content_browsertests AccessibilityAriaMenu
+        AccessibilityInputRange AccessibilityListMarkers" (Requested
+        by scheib on #webkit).
+
+        * public/WebAccessibilityNotification.h:
+        * src/AssertMatchingEnums.cpp:
+
+2012-10-25  James Robinson  <jamesr@chromium.org>
+
+        [chromium] Regression: navigating between composited pages doesn't cause redraw until scrolled
+        https://bugs.webkit.org/show_bug.cgi?id=100396
+
+        Reviewed by Adrienne Walker.
+
+        This partially reverts r132173.  It's not valid to suppress invalidations in commitDocumentData since for small
+        or cached pages this could load up the whole document.  Also adds and improves some of the tracing.
+
+        * src/WebFrameImpl.cpp:
+        (WebKit::WebFrameImpl::commitDocumentData):
+        (WebKit::WebFrameImpl::createFrameView):
+        * src/WebViewImpl.cpp:
+        (WebKit::WebViewImpl::scheduleComposite):
+
+2012-10-25  Sami Kyostila  <skyostil@chromium.org>
+
+        Composited/HW content have the red and blue channels inverted in DRT on Chromium Android
+        https://bugs.webkit.org/show_bug.cgi?id=98647
+
+        Reviewed by James Robinson.
+
+        WebLayerTreeView::compositeAndReadback() always gives back data in BGRA
+        ordering (i.e., the first byte in memory is blue). This matches Skia's
+        SkBitmap::kARGB_8888_Config ordering on all platforms except Android,
+        where Skia's native format is RGBA (i.e., red comes first in memory).
+
+        This mismatch causes layout test pixel comparison failures. This patch
+        fixes the problem by reordering the channels right after readback.
+
+        * src/WebViewImpl.cpp:
+        (WebKit::WebViewImpl::doPixelReadbackToCanvas):
+
+2012-10-25  Dominic Mazzoni  <dmazzoni@google.com>
+
+        AX: Notification should be sent when accessibilityIsIgnored changes
+        https://bugs.webkit.org/show_bug.cgi?id=99547
+
+        Reviewed by Chris Fleizach.
+
+        Adds new accessibility notifications.
+
+        * public/WebAccessibilityNotification.h:
+        * src/AssertMatchingEnums.cpp:
+
+2012-10-25  Dominik Röttsches  <dominik.rottsches@intel.com>
+
+        Conditionalize XHR timeout support
+        https://bugs.webkit.org/show_bug.cgi?id=100356
+
+        Reviewed by Adam Barth.
+
+        Adding XHR_TIMEOUT feature to conditionalize this on ports without network backend support.
+        Defaults to off on chromium until webkit.org/b/98397 is solved.
+
+        * features.gypi:
+
+2012-10-25  Ben Wagner  <bungeman@chromium.org>
+
+        Remove SK_DISABLE_EXTRACTSUBSET_OPAQUE_FIX define from skia_webkit.gyp, as it has been rebaselined.
+        https://bugs.webkit.org/show_bug.cgi?id=100394
+
+        Reviewed by Dirk Pranke.
+
+        The define has been removed from the Skia code and the Chromium skia.gyp.
+        The pixel tests affected have already been rebaselined. 
+
+        * skia_webkit.gyp:
+
+2012-10-22  Mikhail Naganov  <mnaganov@chromium.org>
+
+        [Chromium] Add supportMultipleWindows setting, needed for Android
+        https://bugs.webkit.org/show_bug.cgi?id=99716
+
+        Reviewed by Adam Barth.
+
+        Add supportMultipleWindows settings for reusing the same view when
+        opening popups. This is required for emulating the behavior of
+        Android WebView. Adding into WebCore, as other ports might want to
+        use this setting in the future.
+
+        * public/WebSettings.h:
+        * src/FrameLoaderClientImpl.cpp:
+        (WebKit::FrameLoaderClientImpl::dispatchCreatePage):
+        * src/WebSettingsImpl.cpp:
+        (WebKit::WebSettingsImpl::setSupportsMultipleWindows):
+        (WebKit):
+        * src/WebSettingsImpl.h:
+        (WebSettingsImpl):
+
+2012-10-24  Mihai Parparita  <mihaip@chromium.org>
+
+        [Chromium] Allow pushState and related history APIs to be disabled per context
+        https://bugs.webkit.org/show_bug.cgi?id=99780
+
+        Reviewed by Adam Barth.
+
+        Add pushState context feature.
+
+        * public/WebPermissionClient.h:
+        (WebPermissionClient):
+        (WebKit::WebPermissionClient::allowPushState):
+        * src/ContextFeaturesClientImpl.cpp:
+        (WebKit::ContextFeaturesClientImpl::askIfIsEnabled):
+
+2012-10-24  Mark Pilgrim  <pilgrim@chromium.org>
+
+        [Chromium] Remove screen-related functions from PlatformSupport
+        https://bugs.webkit.org/show_bug.cgi?id=97474
+
+        Reviewed by Adam Barth.
+
+        Screen-related functions like screenHorizontalDPI that
+        used to be on PlatformSupport are now accessed through a new
+        PlatformPageClient attached to Widget in WebCore-land, which is
+        implemented by ChromeClientImpl in WebKit-land, which proxies
+        calls to WebWidgetClient, which is actually implemented in
+        Chromium-land.
+
+        * public/WebScreenInfo.h:
+        * src/ChromeClientImpl.cpp:
+        (WebKit::ChromeClientImpl::screenInfo):
+        (WebKit):
+        * src/ChromeClientImpl.h:
+        (WebKit):
+        (WebKit::ChromeClientImpl::platformPageClient):
+        (ChromeClientImpl):
+        * src/PlatformSupport.cpp:
+        (WebCore):
+        * src/WebPagePopupImpl.cpp:
+
+2012-10-24  Sailesh Agrawal  <sail@chromium.org>
+
+        Incorrect keycodes for numpad /, -, +, .
+        https://bugs.webkit.org/show_bug.cgi?id=99188
+
+        Reviewed by Tony Chang.
+
+        In r57951 we switched to mapping keys by character code.
+        This regressed the numpad keys which no longer match the Windows virtual key codes.
+        This CL fixes this by never mapping numpad keys by character code.
+
+        * src/mac/WebInputEventFactory.mm: Disallow mapping numpad keys by character code.
+        (WebKit::windowsKeyCodeForKeyEvent):
+        * tests/WebInputEventFactoryTestMac.mm: Test to verify that all numpad keys are correctly mapped.
+        (TEST):
+
+2012-10-24  Terry Anderson  <tdanderson@chromium.org>
+
+        Handle two-finger tap gestures in the same way as long-press gestures
+        https://bugs.webkit.org/show_bug.cgi?id=99947
+
+        Reviewed by Adam Barth.
+
+        Set the area of a two-finger tap gesture to be the area of the enclosing
+        rectangle for the first finger down.
+
+        * src/WebInputEventConversion.cpp:
+        (WebKit::PlatformGestureEventBuilder::PlatformGestureEventBuilder):
+
+2012-10-24  Eric Uhrhane  <ericu@chromium.org>
+
+        https://bugs.webkit.org/show_bug.cgi?id=99202
+        [Chromium] shift-click fails to spawn new window with target=_blank
+
+        Reviewed by Adam Barth
+
+        No new tests in WebKit-land--see
+        https://codereview.chromium.org/11235048/ for tests that I'll submit
+        once this lands.
+
+        * src/ChromeClientImpl.cpp:
+        Change currentEventShouldCauseBackgroundTab to updatePolicyForEvent; we
+        were looking up the right policy, then throwing it away if it wasn't
+        forcing a background tab.
+        (WebKit::ChromeClientImpl::updatePolicyForEvent):
+        (WebKit::ChromeClientImpl::getNavigationPolicy):
+
+2012-10-24  Ben Wagner  <bungeman@chromium.org>
+
+        Create skia_webkit.gyp to improve rebaselining.
+        https://bugs.webkit.org/show_bug.cgi?id=99759
+
+        Reviewed by Dirk Pranke.
+
+        This allows for code suppressions to be lifted atomically with new baselines.
+
+        * skia_webkit.gyp: Added.
+
+2012-09-27  Yury Semikhatsky  <yurys@chromium.org>
+
+        Web Inspector: provide memory instrumentation for ListHashSet
+        https://bugs.webkit.org/show_bug.cgi?id=97786
+
+        Reviewed by Vsevolod Vlasov.
+
+        Added a test for ListHashSet memory instrumentation.
+
+        * tests/MemoryInstrumentationTest.cpp:
+        (WebCore::TEST):
+        (WebCore):
+
+2012-10-24  Noel Gordon  <noel.gordon@gmail.com>
+
+        [chromium] Plumb DRT WebkitShouldRespectImageOrientation through to page settings
+        https://bugs.webkit.org/show_bug.cgi?id=100197
+
+        Reviewed by Kent Tamura.
+
+        * public/WebSettings.h:
+        * src/WebSettingsImpl.cpp:
+        (WebKit::WebSettingsImpl::setShouldRespectImageOrientation): set the WebCore page
+        setting for shouldRespectImageOrientation.
+        (WebKit):
+        * src/WebSettingsImpl.h:
+        (WebSettingsImpl):
+
+2012-10-23  Varun Jain  <varunjain@chromium.org>
+
+        Context menu generated from touch gestures on textareas has
+        context of the cursor position instead of the position where the event occurs.
+        https://bugs.webkit.org/show_bug.cgi?id=99520
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Send a synthetic mouse down event for context menu-summoning-gesture events so
+        that textareas can correctly set cursors before receiving the context menu event.
+        Also in this change, WebInputEvent::GestureTwoFingerTap now follows the same
+        code path as WebInputEvent::GestureLongPress, hence fixing this bug for both gestures.
+
+        * src/WebViewImpl.cpp:
+        (WebKit::WebViewImpl::handleGestureEvent):
+
+2012-10-23  Alec Flett  <alecflett@chromium.org>
+
+        IndexedDB: refactor backend to use IDB*Metadata
+        https://bugs.webkit.org/show_bug.cgi?id=100055
+
+        Reviewed by Tony Chang.
+
+        Update tests to reflect refactoring.
+
+        * tests/IDBDatabaseBackendTest.cpp:
+        * tests/IDBFakeBackingStore.h:
+
+2012-10-23  Stephen White  <senorblanco@chromium.org>
+
+        [chromium] Roll chromium DEPS r163297:163557
+        https://bugs.webkit.org/show_bug.cgi?id=100146
+
+        Reviewed by Adrienne Walker.
+
+2012-10-23  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Add support for resolution media query
+        https://bugs.webkit.org/show_bug.cgi?id=99077
+
+        Reviewed by Antti Koivisto.
+
+        Add support for the RESOLUTION_MEDIA_QUERY feature flag.
+
+        * features.gypi:
+
 2012-10-23  Kent Tamura  <tkent@chromium.org>
 
         Support full month names in DateTimeEditElement, and use them in input[type=month] by default
diff --git a/Source/WebKit/chromium/DEPS b/Source/WebKit/chromium/DEPS
index ec98d6853..ac5cf1057 100644
--- a/Source/WebKit/chromium/DEPS
+++ b/Source/WebKit/chromium/DEPS
@@ -32,7 +32,7 @@
 
 vars = {
   'chromium_svn': 'http://src.chromium.org/svn/trunk/src',
-  'chromium_rev': '163297'
+  'chromium_rev': '166220'
 }
 
 deps = {
diff --git a/Source/WebKit/chromium/WebKit.gyp b/Source/WebKit/chromium/WebKit.gyp
index 3edc4a5b4..74ef9bfcf 100644
--- a/Source/WebKit/chromium/WebKit.gyp
+++ b/Source/WebKit/chromium/WebKit.gyp
@@ -710,6 +710,7 @@
                                 'tests/AssociatedURLLoaderTest.cpp',
                                 'tests/EventListenerTest.cpp',
                                 'tests/FrameTestHelpers.cpp',
+                                'tests/IDBBindingUtilitiesTest.cpp',
                                 'tests/LevelDBTest.cpp',
                                 'tests/ListenerLeakTest.cpp',
                                 'tests/LinkHighlightTest.cpp',
diff --git a/Source/WebKit/chromium/WebKit.gypi b/Source/WebKit/chromium/WebKit.gypi
index 64063a021..18c6a8c35 100644
--- a/Source/WebKit/chromium/WebKit.gypi
+++ b/Source/WebKit/chromium/WebKit.gypi
@@ -86,6 +86,7 @@
             'tests/LinkHighlightTest.cpp',
             'tests/ListenerLeakTest.cpp',
             'tests/MemoryInfo.cpp',
+            'tests/MemoryInstrumentationTest.cpp',
             'tests/OpaqueRectTrackingContentLayerDelegateTest.cpp',
             'tests/OpenTypeVerticalDataTest.cpp',
             'tests/PODArenaTest.cpp',
@@ -145,8 +146,7 @@
             }],
             ['os_posix==1 and OS!="mac"', {
                 'webkit_unittest_files': [
-                    'tests/LocalizedDateICUTest.cpp',
-                    'tests/LocalizedNumberICUTest.cpp',
+                    'tests/LocaleICUTest.cpp',
                 ],
             }],
             ['toolkit_uses_gtk == 1', {
diff --git a/Source/WebKit/chromium/features.gypi b/Source/WebKit/chromium/features.gypi
index 2d18c773d..f386deb77 100644
--- a/Source/WebKit/chromium/features.gypi
+++ b/Source/WebKit/chromium/features.gypi
@@ -42,6 +42,7 @@
       'ENABLE_CSS3_TEXT=0',
       'ENABLE_CSS_BOX_DECORATION_BREAK=1',
       'ENABLE_CSS_COMPOSITING=0',
+      'ENABLE_CSS_DEVICE_ADAPTATION=0',
       'ENABLE_CSS_EXCLUSIONS=1',
       'ENABLE_CSS_FILTERS=1',
       'ENABLE_CSS_HIERARCHIES=0',
@@ -75,8 +76,8 @@
       'ENABLE_INPUT_TYPE_DATETIMELOCAL=1',
       'ENABLE_INPUT_TYPE_MONTH=1',
       'ENABLE_INPUT_TYPE_TIME=1',
-      'ENABLE_INPUT_TYPE_WEEK=1',
       'ENABLE_JAVASCRIPT_DEBUGGER=1',
+      'ENABLE_JAVASCRIPT_I18N_API=1',
       'ENABLE_LEGACY_CSS_VENDOR_PREFIXES=0',
       'ENABLE_LEGACY_VIEWPORT_ADAPTION=1',
       'ENABLE_LEGACY_VENDOR_PREFIXES=0',
@@ -95,7 +96,9 @@
       'ENABLE_POINTER_LOCK=1',
       'ENABLE_PROGRESS_ELEMENT=1',
       'ENABLE_QUOTA=1',
+      'ENABLE_RESOLUTION_MEDIA_QUERY=0',
       'ENABLE_REQUEST_ANIMATION_FRAME=1',
+      'ENABLE_REQUEST_AUTOCOMPLETE=1',
       'ENABLE_RUBY=1',
       'ENABLE_SANDBOX=1',
       'ENABLE_SCRIPTED_SPEECH=1',
@@ -120,6 +123,7 @@
       'ENABLE_WEB_TIMING=1',
       'ENABLE_WORKERS=1',
       'ENABLE_XHR_RESPONSE_BLOB=1',
+      'ENABLE_XHR_TIMEOUT=0',
       'ENABLE_XSLT=1',
       'WTF_USE_LEVELDB=1',
       'WTF_USE_BUILTIN_UTF8_CODEC=1',
@@ -155,7 +159,7 @@
           'ENABLE_FAST_MOBILE_SCROLLING=1',
           'ENABLE_INPUT_SPEECH=0',
           'ENABLE_INPUT_TYPE_COLOR=0',
-          'ENABLE_JAVASCRIPT_I18N_API=0',
+          'ENABLE_INPUT_TYPE_WEEK=0',
           'ENABLE_LEGACY_NOTIFICATIONS=0',
           'ENABLE_MEDIA_CAPTURE=1',
           'ENABLE_MEDIA_STREAM=0',
@@ -163,6 +167,7 @@
           'ENABLE_ORIENTATION_EVENTS=1',
           'ENABLE_PAGE_POPUP=0',
           'ENABLE_PRINTING=0',
+          'ENABLE_REGISTER_PROTOCOL_HANDLER=0',
           # FIXME: Disable once the linking error has been resolved.
           # https://bugs.webkit.org/show_bug.cgi?id=88636
           'ENABLE_SHARED_WORKERS=1',
@@ -177,8 +182,8 @@
           'ENABLE_DATALIST_ELEMENT=1',
           'ENABLE_INPUT_SPEECH=1',
           'ENABLE_INPUT_TYPE_COLOR=1',
+          'ENABLE_INPUT_TYPE_WEEK=1',
           'ENABLE_INPUT_MULTIPLE_FIELDS_UI=1',
-          'ENABLE_JAVASCRIPT_I18N_API=1',
           'ENABLE_LEGACY_NOTIFICATIONS=1',
           'ENABLE_MEDIA_CAPTURE=0',
           'ENABLE_MEDIA_STREAM=1',
diff --git a/Source/WebKit/chromium/public/WebAccessibilityNotification.h b/Source/WebKit/chromium/public/WebAccessibilityNotification.h
index de68d37b0..629d988f5 100644
--- a/Source/WebKit/chromium/public/WebAccessibilityNotification.h
+++ b/Source/WebKit/chromium/public/WebAccessibilityNotification.h
@@ -54,11 +54,8 @@ enum WebAccessibilityNotification {
     WebAccessibilityNotificationRowCollapsed,
     WebAccessibilityNotificationRowExpanded,
     WebAccessibilityNotificationInvalidStatusChanged,
-
-    // FIXME: now that we're using AssertMatchingEnums, we don't need a
-    // catch-all "invalid" notification enum. Remove this once it's been
-    // removed from Chromium.
-    WebAccessibilityNotificationInvalid,
+    WebAccessibilityNotificationTextChanged,
+    WebAccessibilityNotificationAriaAttributeChanged
 };
 
 } // namespace WebKit
diff --git a/Source/WebKit/chromium/public/WebAccessibilityRole.h b/Source/WebKit/chromium/public/WebAccessibilityRole.h
index d4a4c715a..031a69da9 100644
--- a/Source/WebKit/chromium/public/WebAccessibilityRole.h
+++ b/Source/WebKit/chromium/public/WebAccessibilityRole.h
@@ -125,6 +125,7 @@ enum WebAccessibilityRole {
     WebAccessibilityRoleSplitter,
     WebAccessibilityRoleStaticText,
     WebAccessibilityRoleSystemWide,
+    WebAccessibilityRoleSVGRoot,
     WebAccessibilityRoleTabGroup,
     WebAccessibilityRoleTabList,
     WebAccessibilityRoleTabPanel,
diff --git a/Source/WebKit/chromium/public/WebAutofillClient.h b/Source/WebKit/chromium/public/WebAutofillClient.h
index 7b48f57db..7424c3fec 100644
--- a/Source/WebKit/chromium/public/WebAutofillClient.h
+++ b/Source/WebKit/chromium/public/WebAutofillClient.h
@@ -33,6 +33,8 @@
 
 namespace WebKit {
 
+class WebFormElement;
+class WebFrame;
 class WebInputElement;
 class WebKeyboardEvent;
 class WebNode;
@@ -75,6 +77,9 @@ public:
     // keys to navigate outside the range of possible selections.
     virtual void didClearAutofillSelection(const WebNode&) { }
 
+    // Informs the browser an interactive autocomplete has been requested.
+    virtual void didRequestAutocomplete(WebFrame*, const WebFormElement&) { }
+
     // Instructs the browser to remove the Autocomplete entry specified from
     // its DB.
     virtual void removeAutocompleteSuggestion(const WebString& name,
diff --git a/Source/WebKit/chromium/public/WebContentSecurityPolicy.h b/Source/WebKit/chromium/public/WebContentSecurityPolicy.h
index cafd17aba..f178d1ae9 100644
--- a/Source/WebKit/chromium/public/WebContentSecurityPolicy.h
+++ b/Source/WebKit/chromium/public/WebContentSecurityPolicy.h
@@ -34,8 +34,10 @@
 namespace WebKit {
 
 enum WebContentSecurityPolicyType {
-    WebContentSecurityPolicyTypeReportOnly,
-    WebContentSecurityPolicyTypeEnforcePolicy
+    WebContentSecurityPolicyTypeReportStableDirectives,
+    WebContentSecurityPolicyTypeEnforceStableDirectives,
+    WebContentSecurityPolicyTypeReportAllDirectives,
+    WebContentSecurityPolicyTypeEnforceAllDirectives,
 };
 
 } // namespace WebKit
diff --git a/Source/WebKit/chromium/public/WebDevToolsAgent.h b/Source/WebKit/chromium/public/WebDevToolsAgent.h
index 4f90302c8..b61105d27 100644
--- a/Source/WebKit/chromium/public/WebDevToolsAgent.h
+++ b/Source/WebKit/chromium/public/WebDevToolsAgent.h
@@ -80,8 +80,14 @@ public:
     WEBKIT_EXPORT static bool shouldInterruptForMessage(const WebString&);
     WEBKIT_EXPORT static void processPendingMessages();
 
-    // Returns a disconnect event that can be dispatched on the front-end
+    // Returns an Inspector.detached event that can be dispatched on the front-end by the embedder.
+    WEBKIT_EXPORT static WebString inspectorDetachedEvent(const WebString& reason);
+
+    // Returns a Worker.disconnectedFromWorker event that can be dispatched on the front-end
     // in order to let it know that it has disconnected from the agent.
+    WEBKIT_EXPORT static WebString workerDisconnectedFromWorkerEvent();
+
+    // FIXME: remove once migrated to workerDisconnectedFromWorkerEvent().
     WEBKIT_EXPORT static WebString disconnectEventAsText();
 };
 
diff --git a/Source/WebKit/chromium/public/WebFormElement.h b/Source/WebKit/chromium/public/WebFormElement.h
index 1ef431fa3..27c99d3a1 100644
--- a/Source/WebKit/chromium/public/WebFormElement.h
+++ b/Source/WebKit/chromium/public/WebFormElement.h
@@ -69,6 +69,9 @@ namespace WebKit {
         WEBKIT_EXPORT void getNamedElements(const WebString&, WebVector<WebNode>&);
         WEBKIT_EXPORT void getFormControlElements(WebVector<WebFormControlElement>&) const;
 
+        enum AutocompleteResult { AutocompleteResultSuccess, AutocompleteResultError };
+        WEBKIT_EXPORT void finishRequestAutocomplete(WebFormElement::AutocompleteResult);
+
 #if WEBKIT_IMPLEMENTATION
         WebFormElement(const WTF::PassRefPtr<WebCore::HTMLFormElement>&);
         WebFormElement& operator=(const WTF::PassRefPtr<WebCore::HTMLFormElement>&);
diff --git a/Source/WebKit/chromium/public/WebFrame.h b/Source/WebKit/chromium/public/WebFrame.h
index d1ea38969..6007252df 100644
--- a/Source/WebKit/chromium/public/WebFrame.h
+++ b/Source/WebKit/chromium/public/WebFrame.h
@@ -252,6 +252,16 @@ public:
     virtual void setIsolatedWorldSecurityOrigin(
         int worldID, const WebSecurityOrigin&) = 0;
 
+    // Associates a content security policy with an isolated world. This policy
+    // should be used when evaluating script in the isolated world, and should
+    // also replace a protected resource's CSP when evaluating resources
+    // injected into the DOM.
+    //
+    // FIXME: Setting this simply bypasses the protected resource's CSP. It
+    //     doesn't yet restrict the isolated world to the provided policy.
+    virtual void setIsolatedWorldContentSecurityPolicy(
+        int worldID, const WebString&) = 0;
+
     // Logs to the console associated with this frame.
     virtual void addMessageToConsole(const WebConsoleMessage&) = 0;
 
diff --git a/Source/WebKit/chromium/public/WebHitTestResult.h b/Source/WebKit/chromium/public/WebHitTestResult.h
index 8fb9838a4..d5937e355 100644
--- a/Source/WebKit/chromium/public/WebHitTestResult.h
+++ b/Source/WebKit/chromium/public/WebHitTestResult.h
@@ -34,7 +34,9 @@ class HitTestResult;
 
 namespace WebKit {
 
+class WebElement;
 class WebNode;
+class WebURL;
 struct WebPoint;
 
 // Properties of a hit test result, i.e. properties of the nodes at a given point
@@ -56,6 +58,19 @@ public:
     // Coordinates of the point that was hit. Relative to the node.
     WEBKIT_EXPORT WebPoint localPoint() const;
 
+    // If a link (eg. anchor or area tag) is hit, return the element.
+    // Return null otheriwse.
+    WEBKIT_EXPORT WebElement urlElement() const;
+
+    // If an image is hit, return the image source. Return empty otherwise.
+    WEBKIT_EXPORT WebURL absoluteImageURL() const;
+
+    // If an link is hit, return the link url source. Return empty otherwise.
+    WEBKIT_EXPORT WebURL absoluteLinkURL() const;
+
+    // Return whether an editable input element was hit.
+    WEBKIT_EXPORT bool isContentEditable() const;
+
 #if WEBKIT_IMPLEMENTATION
     WebHitTestResult(const WebCore::HitTestResult&);
     WebHitTestResult& operator=(const WebCore::HitTestResult&);
diff --git a/Source/WebKit/chromium/public/WebIDBDatabase.h b/Source/WebKit/chromium/public/WebIDBDatabase.h
index a4932ee28..f02bbf44c 100644
--- a/Source/WebKit/chromium/public/WebIDBDatabase.h
+++ b/Source/WebKit/chromium/public/WebIDBDatabase.h
@@ -56,6 +56,7 @@ public:
         return 0;
     }
     virtual void deleteObjectStore(const WebString& name, const WebIDBTransaction& transaction, WebExceptionCode& ec) { WEBKIT_ASSERT_NOT_REACHED(); }
+    virtual void deleteObjectStore(long long objectStoreId, const WebIDBTransaction& transaction, WebExceptionCode& ec) { WEBKIT_ASSERT_NOT_REACHED(); }
     virtual void setVersion(const WebString& version, WebIDBCallbacks* callbacks, WebExceptionCode&) { WEBKIT_ASSERT_NOT_REACHED(); }
     // Transfers ownership of the WebIDBTransaction to the caller.
     virtual WebIDBTransaction* transaction(const WebDOMStringList& names, unsigned short mode, WebExceptionCode& ec)
@@ -63,6 +64,11 @@ public:
         WEBKIT_ASSERT_NOT_REACHED();
         return 0;
     }
+    virtual WebIDBTransaction* transaction(const WebVector<long long>&, unsigned short mode)
+    {
+        WEBKIT_ASSERT_NOT_REACHED();
+        return 0;
+    }
     virtual void close() { WEBKIT_ASSERT_NOT_REACHED(); }
     virtual void forceClose() { WEBKIT_ASSERT_NOT_REACHED(); }
 
diff --git a/Source/WebKit/chromium/public/WebIDBObjectStore.h b/Source/WebKit/chromium/public/WebIDBObjectStore.h
index ca0103cda..7bda1a20d 100644
--- a/Source/WebKit/chromium/public/WebIDBObjectStore.h
+++ b/Source/WebKit/chromium/public/WebIDBObjectStore.h
@@ -56,6 +56,7 @@ public:
     typedef WebVector<WebIDBKey> WebIndexKeys;
 
     virtual void putWithIndexKeys(const WebSerializedScriptValue&, const WebIDBKey&, PutMode, WebIDBCallbacks*, const WebIDBTransaction&, const WebVector<WebString>& indexNames, const WebVector<WebIndexKeys>&, WebExceptionCode&) { WEBKIT_ASSERT_NOT_REACHED(); }
+    virtual void put(const WebSerializedScriptValue&, const WebIDBKey&, PutMode, WebIDBCallbacks*, const WebIDBTransaction&, const WebVector<long long>& indexIds, const WebVector<WebIndexKeys>&) { WEBKIT_ASSERT_NOT_REACHED(); }
     virtual void deleteFunction(const WebIDBKeyRange&, WebIDBCallbacks*, const WebIDBTransaction&, WebExceptionCode&) { WEBKIT_ASSERT_NOT_REACHED(); }
     virtual void clear(WebIDBCallbacks*, const WebIDBTransaction&, WebExceptionCode&) { WEBKIT_ASSERT_NOT_REACHED(); }
     virtual WebIDBIndex* createIndex(const WebString&, const WebIDBKeyPath&, bool, bool, const WebIDBTransaction&, WebExceptionCode&)
@@ -69,14 +70,22 @@ public:
         return 0;
     }
     virtual void setIndexKeys(const WebIDBKey&, const WebVector<WebString>&, const WebVector<WebIndexKeys>&, const WebIDBTransaction&) { WEBKIT_ASSERT_NOT_REACHED(); }
+    virtual void setIndexKeys(const WebIDBKey&, const WebVector<long long>&, const WebVector<WebIndexKeys>&, const WebIDBTransaction&) { WEBKIT_ASSERT_NOT_REACHED(); }
     virtual void setIndexesReady(const WebVector<WebString>&, const WebIDBTransaction&) { WEBKIT_ASSERT_NOT_REACHED(); };
+    virtual void setIndexesReady(const WebVector<long long>&, const WebIDBTransaction&) { WEBKIT_ASSERT_NOT_REACHED(); };
     // Transfers ownership of the WebIDBIndex to the caller.
     virtual WebIDBIndex* index(const WebString& name, WebExceptionCode&)
     {
         WEBKIT_ASSERT_NOT_REACHED();
         return 0;
     }
+    virtual WebIDBIndex* index(long long)
+    {
+        WEBKIT_ASSERT_NOT_REACHED();
+        return 0;
+    }
     virtual void deleteIndex(const WebString& name, const WebIDBTransaction&, WebExceptionCode&) { WEBKIT_ASSERT_NOT_REACHED(); }
+    virtual void deleteIndex(long long indexId, const WebIDBTransaction&, WebExceptionCode&) { WEBKIT_ASSERT_NOT_REACHED(); }
     virtual void openCursor(const WebIDBKeyRange&, WebIDBCursor::Direction direction, WebIDBCallbacks*, WebIDBTransaction::TaskType, const WebIDBTransaction&, WebExceptionCode&) { WEBKIT_ASSERT_NOT_REACHED(); }
     virtual void count(const WebIDBKeyRange&, WebIDBCallbacks*, const WebIDBTransaction&, WebExceptionCode&) { WEBKIT_ASSERT_NOT_REACHED(); }
 
diff --git a/Source/WebKit/chromium/public/WebIDBTransaction.h b/Source/WebKit/chromium/public/WebIDBTransaction.h
index 816a32814..bac2da88d 100644
--- a/Source/WebKit/chromium/public/WebIDBTransaction.h
+++ b/Source/WebKit/chromium/public/WebIDBTransaction.h
@@ -51,6 +51,11 @@ public:
         WEBKIT_ASSERT_NOT_REACHED();
         return 0;
     }
+    virtual WebIDBObjectStore* objectStore(long long, WebExceptionCode&)
+    {
+        WEBKIT_ASSERT_NOT_REACHED();
+        return 0;
+    }
     virtual void commit() { WEBKIT_ASSERT_NOT_REACHED(); }
     virtual void abort() { WEBKIT_ASSERT_NOT_REACHED(); }
     virtual void didCompleteTaskEvents() { WEBKIT_ASSERT_NOT_REACHED(); }
diff --git a/Source/WebKit/chromium/public/WebPermissionClient.h b/Source/WebKit/chromium/public/WebPermissionClient.h
index 5d059ef5d..0b6414b4e 100644
--- a/Source/WebKit/chromium/public/WebPermissionClient.h
+++ b/Source/WebKit/chromium/public/WebPermissionClient.h
@@ -101,6 +101,9 @@ public:
     // but it's been named for consistency with the rest of the interface.
     virtual bool allowMutationEvents(const WebDocument&, bool defaultValue) { return defaultValue; }
 
+    // Controls whether pushState and related History APIs are enabled for this frame.
+    virtual bool allowPushState(const WebDocument&) { return true; }
+
     // Notifies the client that the frame would have instantiated a plug-in if plug-ins were enabled.
     virtual void didNotAllowPlugins(WebFrame*) { }
 
diff --git a/Source/WebKit/chromium/public/WebRuntimeFeatures.h b/Source/WebKit/chromium/public/WebRuntimeFeatures.h
index 64cf829b5..a8082606c 100644
--- a/Source/WebKit/chromium/public/WebRuntimeFeatures.h
+++ b/Source/WebKit/chromium/public/WebRuntimeFeatures.h
@@ -159,6 +159,9 @@ public:
     WEBKIT_EXPORT static void enableCSSExclusions(bool);
     WEBKIT_EXPORT static bool isCSSExclusionsEnabled();
 
+    WEBKIT_EXPORT static void enableRequestAutocomplete(bool);
+    WEBKIT_EXPORT static bool isRequestAutocompleteEnabled();
+
 private:
     WebRuntimeFeatures();
 };
diff --git a/Source/WebKit/chromium/public/WebScreenInfo.h b/Source/WebKit/chromium/public/WebScreenInfo.h
index bd885f424..7db1a662c 100644
--- a/Source/WebKit/chromium/public/WebScreenInfo.h
+++ b/Source/WebKit/chromium/public/WebScreenInfo.h
@@ -28,55 +28,4 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef WebScreenInfo_h
-#define WebScreenInfo_h
-
-#include "platform/WebRect.h"
-
-namespace WebKit {
-
-struct WebScreenInfo {
-    // The horizontal screen dpi.
-    int horizontalDPI;
-
-    // The vertical screen dpi.
-    int verticalDPI;
-
-    // The screen depth in bits per pixel
-    int depth;
-
-    // The bits per colour component. This assumes that the colours are balanced
-    // equally.
-    int depthPerComponent;
-
-    // This can be true for black and white printers
-    bool isMonochrome;
-
-    // This is set from the rcMonitor member of MONITORINFOEX, to whit:
-    //   "A RECT structure that specifies the display monitor rectangle,
-    //   expressed in virtual-screen coordinates. Note that if the monitor
-    //   is not the primary display monitor, some of the rectangle's
-    //   coordinates may be negative values."
-    WebRect rect;
-
-    // This is set from the rcWork member of MONITORINFOEX, to whit:
-    //   "A RECT structure that specifies the work area rectangle of the
-    //   display monitor that can be used by applications, expressed in
-    //   virtual-screen coordinates. Windows uses this rectangle to
-    //   maximize an application on the monitor. The rest of the area in
-    //   rcMonitor contains system windows such as the task bar and side
-    //   bars. Note that if the monitor is not the primary display monitor,
-    //   some of the rectangle's coordinates may be negative values".
-    WebRect availableRect;
-
-    WebScreenInfo()
-        : horizontalDPI(0)
-        , verticalDPI(0)
-        , depth(0)
-        , depthPerComponent(0)
-        , isMonochrome(false) { }
-};
-
-} // namespace WebKit
-
-#endif
+#include "../../../Platform/chromium/public/WebScreenInfo.h"
diff --git a/Source/WebKit/chromium/public/WebSettings.h b/Source/WebKit/chromium/public/WebSettings.h
index d5d963f91..ddebd7e61 100644
--- a/Source/WebKit/chromium/public/WebSettings.h
+++ b/Source/WebKit/chromium/public/WebSettings.h
@@ -141,12 +141,14 @@ public:
     virtual void setSansSerifFontFamily(const WebString&, UScriptCode = USCRIPT_COMMON) = 0;
     virtual void setSerifFontFamily(const WebString&, UScriptCode = USCRIPT_COMMON) = 0;
     virtual void setShouldPrintBackgrounds(bool) = 0;
+    virtual void setShouldRespectImageOrientation(bool) = 0;
     virtual void setShowDebugBorders(bool) = 0;
     virtual void setShowFPSCounter(bool) = 0;
     virtual void setShowPaintRects(bool) = 0;
     virtual void setShowPlatformLayerTree(bool) = 0;
     virtual void setShrinksStandaloneImagesToFit(bool) = 0;
     virtual void setStandardFontFamily(const WebString&, UScriptCode = USCRIPT_COMMON) = 0;
+    virtual void setSupportsMultipleWindows(bool) = 0;
     virtual void setSyncXHRInDocumentsEnabled(bool) = 0;
     virtual void setTextAreasAreResizable(bool) = 0;
     virtual void setTextAutosizingEnabled(bool) = 0;
diff --git a/Source/WebKit/chromium/public/WebView.h b/Source/WebKit/chromium/public/WebView.h
index b778f296a..49aaa5138 100644
--- a/Source/WebKit/chromium/public/WebView.h
+++ b/Source/WebKit/chromium/public/WebView.h
@@ -48,16 +48,17 @@ class WebDragData;
 class WebFrame;
 class WebFrameClient;
 class WebGraphicsContext3D;
+class WebHitTestResult;
 class WebNode;
 class WebPageOverlay;
 class WebPermissionClient;
 class WebPrerendererClient;
-class WebViewBenchmarkSupport;
 class WebRange;
 class WebSettings;
 class WebSpellCheckClient;
 class WebString;
 class WebTextFieldDecoratorClient;
+class WebViewBenchmarkSupport;
 class WebViewClient;
 struct WebActiveWheelFlingParameters;
 struct WebMediaPlayerAction;
@@ -313,6 +314,9 @@ public:
 
     // Data exchange -------------------------------------------------------
 
+    // Do a hit test at given point and return the HitTestResult.
+    virtual WebHitTestResult hitTestResultAt(const WebPoint&) = 0;
+
     // Copy to the clipboard the image located at a particular point in the
     // WebView (if there is such an image)
     virtual void copyImageAt(const WebPoint&) = 0;
diff --git a/Source/WebKit/chromium/public/WebWidget.h b/Source/WebKit/chromium/public/WebWidget.h
index fa456238a..f2b394439 100644
--- a/Source/WebKit/chromium/public/WebWidget.h
+++ b/Source/WebKit/chromium/public/WebWidget.h
@@ -83,14 +83,16 @@ public:
 
     // Called to update imperative animation state. This should be called before
     // paint, although the client can rate-limit these calls.
-    //
-    // FIXME: remove this function entirely when inversion patches land.
     virtual void animate(double ignored) { }
 
     // Called to layout the WebWidget. This MUST be called before Paint,
     // and it may result in calls to WebWidgetClient::didInvalidateRect.
     virtual void layout() { }
 
+    // Called to toggle the WebWidget in or out of force compositing mode. This
+    // should be called before paint.
+    virtual void enterForceCompositingMode(bool enter) { }
+
     enum PaintOptions {
         // Attempt to fulfill the painting request by reading back from the
         // compositor, assuming we're using a compositor to render.
@@ -125,6 +127,9 @@ public:
     // animate or layout in this case.
     virtual void composite(bool finish) = 0;
 
+    // Returns true if we've started tracking repaint rectangles.
+    virtual bool isTrackingRepaints() const { return false; }
+
     // Indicates that the compositing surface associated with this WebWidget is
     // ready to use.
     virtual void setCompositorSurfaceReady() = 0;
diff --git a/Source/WebKit/chromium/skia_webkit.gyp b/Source/WebKit/chromium/skia_webkit.gyp
new file mode 100644
index 000000000..d56e81d18
--- /dev/null
+++ b/Source/WebKit/chromium/skia_webkit.gyp
@@ -0,0 +1,55 @@
+#
+# Copyright (C) 2012 Google Inc. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are
+# met:
+#
+#         * Redistributions of source code must retain the above copyright
+# notice, this list of conditions and the following disclaimer.
+#         * Redistributions in binary form must reproduce the above
+# copyright notice, this list of conditions and the following disclaimer
+# in the documentation and/or other materials provided with the
+# distribution.
+#         * Neither the name of Google Inc. nor the names of its
+# contributors may be used to endorse or promote products derived from
+# this software without specific prior written permission.
+#
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+#
+
+# This skia_webkit target is a dependency of Chromium's skia/skia.gyp.
+# It only contains code suppressions which keep Webkit tests from failing.
+{
+  'targets': [
+    {
+      'target_name': 'skia_webkit',
+      'type': 'none',
+      'direct_dependent_settings': {
+        'defines': [
+          # temporary for landing Skia rev 3077 with minimal layout test breakage
+          'SK_SIMPLE_TWOCOLOR_VERTICAL_GRADIENTS',
+
+          # Temporarily disable the Skia fix in
+          # http://code.google.com/p/skia/source/detail?r=3037 ; enabling that
+          # fix will require substantial rebaselining.
+          'SK_DRAW_POS_TEXT_IGNORE_SUBPIXEL_LEFT_ALIGN_FIX',
+
+          # Temporarily ignore fix to antialias coverage, until we can rebaseline
+          'SK_USE_LEGACY_AA_COVERAGE',
+        ],
+      },
+    },
+  ],
+}
+
diff --git a/Source/WebKit/chromium/src/AssertMatchingEnums.cpp b/Source/WebKit/chromium/src/AssertMatchingEnums.cpp
index 95e8b607d..f3e7859ee 100644
--- a/Source/WebKit/chromium/src/AssertMatchingEnums.cpp
+++ b/Source/WebKit/chromium/src/AssertMatchingEnums.cpp
@@ -48,6 +48,9 @@
 #include "FontSmoothingMode.h"
 #include "GeolocationError.h"
 #include "GeolocationPosition.h"
+#if ENABLE(REQUEST_AUTOCOMPLETE)
+#include "HTMLFormElement.h"
+#endif
 #include "HTMLInputElement.h"
 #include "IDBCursor.h"
 #include "IDBDatabaseException.h"
@@ -86,6 +89,9 @@
 #include "WebFileError.h"
 #include "WebFileInfo.h"
 #include "WebFontDescription.h"
+#if ENABLE(REQUEST_AUTOCOMPLETE)
+#include "WebFormElement.h"
+#endif
 #include "WebGeolocationError.h"
 #include "WebGeolocationPosition.h"
 #include "WebIDBCursor.h"
@@ -153,6 +159,8 @@ COMPILE_ASSERT_MATCHING_ENUM(WebAccessibilityNotificationRowCountChanged, AXObje
 COMPILE_ASSERT_MATCHING_ENUM(WebAccessibilityNotificationRowCollapsed, AXObjectCache::AXRowCollapsed);
 COMPILE_ASSERT_MATCHING_ENUM(WebAccessibilityNotificationRowExpanded, AXObjectCache::AXRowExpanded);
 COMPILE_ASSERT_MATCHING_ENUM(WebAccessibilityNotificationInvalidStatusChanged, AXObjectCache::AXInvalidStatusChanged);
+COMPILE_ASSERT_MATCHING_ENUM(WebAccessibilityNotificationTextChanged, AXObjectCache::AXTextChanged);
+COMPILE_ASSERT_MATCHING_ENUM(WebAccessibilityNotificationAriaAttributeChanged, AXObjectCache::AXAriaAttributeChanged);
 
 COMPILE_ASSERT_MATCHING_ENUM(WebAccessibilityRoleUnknown, UnknownRole);
 COMPILE_ASSERT_MATCHING_ENUM(WebAccessibilityRoleButton, ButtonRole);
@@ -260,6 +268,7 @@ COMPILE_ASSERT_MATCHING_ENUM(WebAccessibilityRoleUserInterfaceTooltip, UserInter
 COMPILE_ASSERT_MATCHING_ENUM(WebAccessibilityRoleToggleButton, ToggleButtonRole);
 COMPILE_ASSERT_MATCHING_ENUM(WebAccessibilityRoleCanvas, CanvasRole);
 COMPILE_ASSERT_MATCHING_ENUM(WebAccessibilityRoleLegend, LegendRole);
+COMPILE_ASSERT_MATCHING_ENUM(WebAccessibilityRoleSVGRoot, SVGRootRole);
 
 COMPILE_ASSERT_MATCHING_ENUM(WebApplicationCacheHost::Uncached, ApplicationCacheHost::UNCACHED);
 COMPILE_ASSERT_MATCHING_ENUM(WebApplicationCacheHost::Idle, ApplicationCacheHost::IDLE);
@@ -617,8 +626,10 @@ COMPILE_ASSERT_MATCHING_ENUM(WebReferrerPolicyDefault, ReferrerPolicyDefault);
 COMPILE_ASSERT_MATCHING_ENUM(WebReferrerPolicyNever, ReferrerPolicyNever);
 COMPILE_ASSERT_MATCHING_ENUM(WebReferrerPolicyOrigin, ReferrerPolicyOrigin);
 
-COMPILE_ASSERT_MATCHING_ENUM(WebContentSecurityPolicyTypeReportOnly, ContentSecurityPolicy::ReportOnly);
-COMPILE_ASSERT_MATCHING_ENUM(WebContentSecurityPolicyTypeEnforcePolicy, ContentSecurityPolicy::EnforcePolicy);
+COMPILE_ASSERT_MATCHING_ENUM(WebContentSecurityPolicyTypeReportStableDirectives, ContentSecurityPolicy::ReportStableDirectives);
+COMPILE_ASSERT_MATCHING_ENUM(WebContentSecurityPolicyTypeEnforceStableDirectives, ContentSecurityPolicy::EnforceStableDirectives);
+COMPILE_ASSERT_MATCHING_ENUM(WebContentSecurityPolicyTypeReportAllDirectives, ContentSecurityPolicy::ReportAllDirectives);
+COMPILE_ASSERT_MATCHING_ENUM(WebContentSecurityPolicyTypeEnforceAllDirectives, ContentSecurityPolicy::EnforceAllDirectives);
 
 COMPILE_ASSERT_MATCHING_ENUM(WebURLResponse::Unknown, ResourceResponse::Unknown);
 COMPILE_ASSERT_MATCHING_ENUM(WebURLResponse::HTTP_0_9, ResourceResponse::HTTP_0_9);
@@ -628,3 +639,8 @@ COMPILE_ASSERT_MATCHING_ENUM(WebURLResponse::HTTP_1_1, ResourceResponse::HTTP_1_
 COMPILE_ASSERT_MATCHING_ENUM(WebMediaPlayer::CORSModeUnspecified, MediaPlayerClient::Unspecified);
 COMPILE_ASSERT_MATCHING_ENUM(WebMediaPlayer::CORSModeAnonymous, MediaPlayerClient::Anonymous);
 COMPILE_ASSERT_MATCHING_ENUM(WebMediaPlayer::CORSModeUseCredentials, MediaPlayerClient::UseCredentials);
+
+#if ENABLE(REQUEST_AUTOCOMPLETE)
+COMPILE_ASSERT_MATCHING_ENUM(WebFormElement::AutocompleteResultSuccess, HTMLFormElement::AutocompleteResultSuccess);
+COMPILE_ASSERT_MATCHING_ENUM(WebFormElement::AutocompleteResultError, HTMLFormElement::AutocompleteResultError);
+#endif
diff --git a/Source/WebKit/chromium/src/ChromeClientImpl.cpp b/Source/WebKit/chromium/src/ChromeClientImpl.cpp
index 9d8a656bd..94959380a 100644
--- a/Source/WebKit/chromium/src/ChromeClientImpl.cpp
+++ b/Source/WebKit/chromium/src/ChromeClientImpl.cpp
@@ -42,6 +42,7 @@
 #include "Console.h"
 #include "Cursor.h"
 #include "DatabaseTracker.h"
+#include "DateTimeChooser.h"
 #include "DateTimeChooserImpl.h"
 #include "Document.h"
 #include "DocumentLoader.h"
@@ -265,17 +266,13 @@ Page* ChromeClientImpl::createWindow(
     return newView->page();
 }
 
-static inline bool currentEventShouldCauseBackgroundTab(const WebInputEvent* inputEvent)
+static inline void updatePolicyForEvent(const WebInputEvent* inputEvent, WebNavigationPolicy* policy)
 {
-    if (!inputEvent)
-        return false;
-
-    if (inputEvent->type != WebInputEvent::MouseUp)
-        return false;
+    if (!inputEvent || inputEvent->type != WebInputEvent::MouseUp)
+        return;
 
     const WebMouseEvent* mouseEvent = static_cast<const WebMouseEvent*>(inputEvent);
 
-    WebNavigationPolicy policy;
     unsigned short buttonNumber;
     switch (mouseEvent->button) {
     case WebMouseEvent::ButtonLeft:
@@ -288,17 +285,14 @@ static inline bool currentEventShouldCauseBackgroundTab(const WebInputEvent* inp
         buttonNumber = 2;
         break;
     default:
-        return false;
+        return;
     }
     bool ctrl = mouseEvent->modifiers & WebMouseEvent::ControlKey;
     bool shift = mouseEvent->modifiers & WebMouseEvent::ShiftKey;
     bool alt = mouseEvent->modifiers & WebMouseEvent::AltKey;
     bool meta = mouseEvent->modifiers & WebMouseEvent::MetaKey;
 
-    if (!WebViewImpl::navigationPolicyFromMouseEvent(buttonNumber, ctrl, shift, alt, meta, &policy))
-        return false;
-
-    return policy == WebNavigationPolicyNewBackgroundTab;
+    WebViewImpl::navigationPolicyFromMouseEvent(buttonNumber, ctrl, shift, alt, meta, policy);
 }
 
 WebNavigationPolicy ChromeClientImpl::getNavigationPolicy()
@@ -315,8 +309,8 @@ WebNavigationPolicy ChromeClientImpl::getNavigationPolicy()
     WebNavigationPolicy policy = WebNavigationPolicyNewForegroundTab;
     if (asPopup)
         policy = WebNavigationPolicyNewPopup;
-    if (currentEventShouldCauseBackgroundTab(WebViewImpl::currentInputEvent()))
-        policy = WebNavigationPolicyNewBackgroundTab;
+    updatePolicyForEvent(WebViewImpl::currentInputEvent(), &policy);
+
     return policy;
 }
 
@@ -502,15 +496,7 @@ void ChromeClientImpl::invalidateContentsAndRootView(const IntRect& updateRect,
 {
     if (updateRect.isEmpty())
         return;
-#if USE(ACCELERATED_COMPOSITING)
-    if (!m_webView->isAcceleratedCompositingActive()) {
-#endif
-        if (m_webView->client())
-            m_webView->client()->didInvalidateRect(updateRect);
-#if USE(ACCELERATED_COMPOSITING)
-    } else
-        m_webView->invalidateRootLayerRect(updateRect);
-#endif
+    m_webView->invalidateRect(updateRect);
 }
 
 void ChromeClientImpl::invalidateContentsForSlowScroll(const IntRect& updateRect, bool immediate)
@@ -629,13 +615,6 @@ void ChromeClientImpl::dispatchViewportPropertiesDidChange(const ViewportArgumen
     if (!m_webView->settings()->viewportEnabled() || !m_webView->isFixedLayoutModeEnabled() || !m_webView->client() || !m_webView->page())
         return;
 
-    ViewportArguments args;
-    if (arguments == args) {
-        // Default viewport arguments passed in. This is a signal to reset the viewport.
-        args.width = ViewportArguments::ValueDesktopWidth;
-    } else
-        args = arguments;
-
     FrameView* frameView = m_webView->mainFrameImpl()->frameView();
     int dpi = screenHorizontalDPI(frameView);
     ASSERT(dpi > 0);
@@ -650,7 +629,7 @@ void ChromeClientImpl::dispatchViewportPropertiesDidChange(const ViewportArgumen
     float devicePixelRatio = dpi / ViewportArguments::deprecatedTargetDPI;
     // Call the common viewport computing logic in ViewportArguments.cpp.
     ViewportAttributes computed = computeViewportAttributes(
-        args, settings->layoutFallbackWidth(), deviceRect.width, deviceRect.height,
+        arguments, settings->layoutFallbackWidth(), deviceRect.width, deviceRect.height,
         devicePixelRatio, IntSize(deviceRect.width, deviceRect.height));
 
     restrictScaleFactorToInitialScaleIfNotUserScalable(computed);
@@ -707,10 +686,15 @@ PassOwnPtr<WebColorChooser> ChromeClientImpl::createWebColorChooser(WebColorChoo
 }
 #endif
 
-#if ENABLE(CALENDAR_PICKER)
-PassOwnPtr<WebCore::DateTimeChooser> ChromeClientImpl::openDateTimeChooser(WebCore::DateTimeChooserClient* pickerClient, const WebCore::DateTimeChooserParameters& parameters)
+#if ENABLE(DATE_AND_TIME_INPUT_TYPES)
+PassRefPtr<DateTimeChooser> ChromeClientImpl::openDateTimeChooser(DateTimeChooserClient* pickerClient, const DateTimeChooserParameters& parameters)
 {
-    return adoptPtr(new DateTimeChooserImpl(this, pickerClient, parameters));
+#if ENABLE(INPUT_MULTIPLE_FIELDS_UI)
+    return DateTimeChooserImpl::create(this, pickerClient, parameters);
+#else
+    notImplemented();
+    return PassRefPtr<DateTimeChooser>();
+#endif
 }
 #endif
 
@@ -903,6 +887,11 @@ void ChromeClientImpl::postAccessibilityNotification(AccessibilityObject* obj, A
         m_webView->client()->postAccessibilityNotification(WebAccessibilityObject(obj), toWebAccessibilityNotification(notification));
 }
 
+WebKit::WebScreenInfo ChromeClientImpl::screenInfo()
+{
+    return m_webView->client()->screenInfo();
+}
+
 bool ChromeClientImpl::paintCustomOverhangArea(GraphicsContext* context, const IntRect& horizontalOverhangArea, const IntRect& verticalOverhangArea, const IntRect& dirtyRect)
 {
     Frame* frame = m_webView->mainFrameImpl()->frame();
diff --git a/Source/WebKit/chromium/src/ChromeClientImpl.h b/Source/WebKit/chromium/src/ChromeClientImpl.h
index 4a609dadd..77084f801 100644
--- a/Source/WebKit/chromium/src/ChromeClientImpl.h
+++ b/Source/WebKit/chromium/src/ChromeClientImpl.h
@@ -60,10 +60,11 @@ class WebColorChooser;
 class WebColorChooserClient;
 class WebViewImpl;
 struct WebCursorInfo;
+struct WebScreenInfo;
 struct WebPopupMenuInfo;
 
 // Handles window-level notifications from WebCore on behalf of a WebView.
-class ChromeClientImpl : public WebCore::ChromeClientChromium {
+class ChromeClientImpl : public WebCore::ChromeClientChromium, public WebCore::PageClientChromium {
 public:
     explicit ChromeClientImpl(WebViewImpl* webView);
     virtual ~ChromeClientImpl();
@@ -123,7 +124,7 @@ public:
         const WebCore::IntRect& clipRect);
     virtual WebCore::IntPoint screenToRootView(const WebCore::IntPoint&) const;
     virtual WebCore::IntRect rootViewToScreen(const WebCore::IntRect&) const;
-    virtual PlatformPageClient platformPageClient() const { return 0; }
+    virtual PlatformPageClient platformPageClient() const { return PlatformPageClient(this); }
     virtual void contentsSizeChanged(WebCore::Frame*, const WebCore::IntSize&) const;
     virtual void layoutUpdated(WebCore::Frame*) const;
     virtual void scrollRectIntoView(
@@ -146,8 +147,8 @@ public:
     virtual PassOwnPtr<WebCore::ColorChooser> createColorChooser(WebCore::ColorChooserClient*, const WebCore::Color&) OVERRIDE;
     PassOwnPtr<WebColorChooser> createWebColorChooser(WebColorChooserClient*, const WebColor&);
 #endif
-#if ENABLE(CALENDAR_PICKER)
-    virtual PassOwnPtr<WebCore::DateTimeChooser> openDateTimeChooser(WebCore::DateTimeChooserClient*, const WebCore::DateTimeChooserParameters&) OVERRIDE;
+#if ENABLE(DATE_AND_TIME_INPUT_TYPES)
+    virtual PassRefPtr<WebCore::DateTimeChooser> openDateTimeChooser(WebCore::DateTimeChooserClient*, const WebCore::DateTimeChooserParameters&) OVERRIDE;
 #endif
     virtual void runOpenPanel(WebCore::Frame*, PassRefPtr<WebCore::FileChooser>);
     virtual void loadIconForFiles(const Vector<WTF::String>&, WebCore::FileIconLoader*);
@@ -194,6 +195,9 @@ public:
     virtual void popupClosed(WebCore::PopupContainer* popupContainer);
     virtual void postAccessibilityNotification(WebCore::AccessibilityObject*, WebCore::AXObjectCache::AXNotification);
 
+    // PageClientChromium methods:
+    virtual WebScreenInfo screenInfo();
+
     // ChromeClientImpl:
     void setCursorForPlugin(const WebCursorInfo&);
     void setNewWindowNavigationPolicy(WebNavigationPolicy);
diff --git a/Source/WebKit/chromium/src/ColorChooserUIController.cpp b/Source/WebKit/chromium/src/ColorChooserUIController.cpp
index 330f59ce2..5789691e8 100644
--- a/Source/WebKit/chromium/src/ColorChooserUIController.cpp
+++ b/Source/WebKit/chromium/src/ColorChooserUIController.cpp
@@ -57,7 +57,7 @@ ColorChooserUIController::ColorChooserUIController(ChromeClientImpl* chromeClien
     : m_chromeClient(chromeClient)
     , m_client(client)
     , m_popup(0)
-    , m_localizer(Localizer::createDefault())
+    , m_locale(Locale::createDefault())
 {
     if (m_client->shouldShowSuggestions())
         openPopup();
@@ -132,9 +132,9 @@ void ColorChooserUIController::writeDocument(DocumentWriter& writer)
     PagePopupClient::addString("</script></body>\n", writer);
 }
 
-Localizer& ColorChooserUIController::localizer()
+Locale& ColorChooserUIController::locale()
 {
-    return *m_localizer;
+    return *m_locale;
 }
 
 void ColorChooserUIController::setValueAndClosePopup(int numValue, const String& stringValue)
diff --git a/Source/WebKit/chromium/src/ColorChooserUIController.h b/Source/WebKit/chromium/src/ColorChooserUIController.h
index 40c878b8e..60cecfe18 100644
--- a/Source/WebKit/chromium/src/ColorChooserUIController.h
+++ b/Source/WebKit/chromium/src/ColorChooserUIController.h
@@ -29,8 +29,8 @@
 #if ENABLE(INPUT_TYPE_COLOR)
 
 #include "ColorChooser.h"
-#include "Localizer.h"
 #include "PagePopupClient.h"
+#include "PlatformLocale.h"
 #include "WebColorChooserClient.h"
 #include <wtf/OwnPtr.h>
 #include <wtf/PassOwnPtr.h>
@@ -61,7 +61,7 @@ public:
     // PagePopupClient functions:
     virtual WebCore::IntSize contentSize() OVERRIDE;
     virtual void writeDocument(WebCore::DocumentWriter&) OVERRIDE;
-    virtual WebCore::Localizer& localizer() OVERRIDE;
+    virtual WebCore::Locale& locale() OVERRIDE;
     virtual void setValueAndClosePopup(int, const String&) OVERRIDE;
     virtual void didClosePopup() OVERRIDE;
 
@@ -74,7 +74,7 @@ private:
     WebCore::ColorChooserClient* m_client;
     OwnPtr<WebColorChooser> m_chooser;
     WebCore::PagePopup* m_popup;
-    OwnPtr<WebCore::Localizer> m_localizer;
+    OwnPtr<WebCore::Locale> m_locale;
 };
 
 }
diff --git a/Source/WebKit/chromium/src/ContextFeaturesClientImpl.cpp b/Source/WebKit/chromium/src/ContextFeaturesClientImpl.cpp
index e5795edc4..335d71d2b 100644
--- a/Source/WebKit/chromium/src/ContextFeaturesClientImpl.cpp
+++ b/Source/WebKit/chromium/src/ContextFeaturesClientImpl.cpp
@@ -140,12 +140,15 @@ bool ContextFeaturesClientImpl::askIfIsEnabled(Document* document, ContextFeatur
         return defaultValue;
 
     switch (type) {
+    case ContextFeatures::ShadowDOM:
     case ContextFeatures::StyleScoped:
         return m_client->allowWebComponents(WebDocument(document), defaultValue);
     case ContextFeatures::HTMLNotifications:
         return m_client->allowHTMLNotifications(WebDocument(document));
     case ContextFeatures::MutationEvents:
         return m_client->allowMutationEvents(WebDocument(document), defaultValue);
+    case ContextFeatures::PushState:
+        return m_client->allowPushState(WebDocument(document));
     default:
         return defaultValue;
     }
diff --git a/Source/WebKit/chromium/src/DateTimeChooserImpl.cpp b/Source/WebKit/chromium/src/DateTimeChooserImpl.cpp
index 20044add8..29d519966 100644
--- a/Source/WebKit/chromium/src/DateTimeChooserImpl.cpp
+++ b/Source/WebKit/chromium/src/DateTimeChooserImpl.cpp
@@ -29,10 +29,9 @@
  */
 
 #include "config.h"
+#if ENABLE(INPUT_MULTIPLE_FIELDS_UI)
 #include "DateTimeChooserImpl.h"
 
-#if ENABLE(CALENDAR_PICKER)
-
 #include "CalendarPicker.h"
 #include "ChromeClientImpl.h"
 #include "DateComponents.h"
@@ -40,14 +39,18 @@
 #include "FrameView.h"
 #include "InputTypeNames.h"
 #include "Language.h"
-#include "Localizer.h"
 #include "NotImplemented.h"
 #include "PickerCommon.h"
+#include "PlatformLocale.h"
 #include "RenderTheme.h"
 #include "WebViewImpl.h"
 #include <public/Platform.h>
 #include <public/WebLocalizedString.h>
 
+#if !ENABLE(CALENDAR_PICKER)
+#error "ENABLE_INPUT_MULTIPLE_FIELDS_UI requires ENABLE_CALENDAR_PICKER in Chromium."
+#endif
+
 using namespace WebCore;
 
 namespace WebKit {
@@ -57,13 +60,18 @@ DateTimeChooserImpl::DateTimeChooserImpl(ChromeClientImpl* chromeClient, WebCore
     , m_client(client)
     , m_popup(0)
     , m_parameters(parameters)
-    , m_localizer(WebCore::Localizer::createDefault())
+    , m_locale(WebCore::Locale::createDefault())
 {
     ASSERT(m_chromeClient);
     ASSERT(m_client);
     m_popup = m_chromeClient->openPagePopup(this, m_parameters.anchorRectInRootView);
 }
 
+PassRefPtr<DateTimeChooserImpl> DateTimeChooserImpl::create(ChromeClientImpl* chromeClient, WebCore::DateTimeChooserClient* client, const WebCore::DateTimeChooserParameters& parameters)
+{
+    return adoptRef(new DateTimeChooserImpl(chromeClient, client, parameters));
+}
+
 DateTimeChooserImpl::~DateTimeChooserImpl()
 {
 }
@@ -93,6 +101,7 @@ void DateTimeChooserImpl::writeDocument(WebCore::DocumentWriter& writer)
     FrameView* view = static_cast<WebViewImpl*>(m_chromeClient->webView())->page()->mainFrame()->view();
     IntRect rootViewVisibleContentRect = view->visibleContentRect(true /* include scrollbars */);
     IntRect rootViewRectInScreen = m_chromeClient->rootViewToScreen(rootViewVisibleContentRect);
+    rootViewRectInScreen.move(-view->scrollX(), -view->scrollY());
 
     addString("<!DOCTYPE html><head><meta charset='UTF-8'><style>\n", writer);
     writer.addData(WebCore::pickerCommonCss, sizeof(WebCore::pickerCommonCss));
@@ -119,10 +128,10 @@ void DateTimeChooserImpl::writeDocument(WebCore::DocumentWriter& writer)
     addProperty("locale", WebCore::defaultLanguage(), writer);
     addProperty("todayLabel", Platform::current()->queryLocalizedString(WebLocalizedString::CalendarToday), writer);
     addProperty("clearLabel", Platform::current()->queryLocalizedString(WebLocalizedString::CalendarClear), writer);
-    addProperty("weekStartDay", m_localizer->firstDayOfWeek(), writer);
-    addProperty("monthLabels", m_localizer->monthLabels(), writer);
-    addProperty("dayLabels", m_localizer->weekDayShortLabels(), writer);
-    addProperty("isCalendarRTL", m_localizer->isRTL(), writer);
+    addProperty("weekStartDay", m_locale->firstDayOfWeek(), writer);
+    addProperty("monthLabels", m_locale->monthLabels(), writer);
+    addProperty("dayLabels", m_locale->weekDayShortLabels(), writer);
+    addProperty("isCalendarRTL", m_locale->isRTL(), writer);
     addProperty("isRTL", m_parameters.isAnchorElementRTL, writer);
     if (m_parameters.suggestionValues.size()) {
         addProperty("inputWidth", static_cast<unsigned>(m_parameters.anchorRectInRootView.width()), writer);
@@ -142,13 +151,14 @@ void DateTimeChooserImpl::writeDocument(WebCore::DocumentWriter& writer)
     addString("</script></body>\n", writer);
 }
 
-WebCore::Localizer& DateTimeChooserImpl::localizer()
+WebCore::Locale& DateTimeChooserImpl::locale()
 {
-    return *m_localizer;
+    return *m_locale;
 }
 
 void DateTimeChooserImpl::setValueAndClosePopup(int numValue, const String& stringValue)
 {
+    RefPtr<DateTimeChooserImpl> protector(this);
     if (numValue >= 0)
         m_client->didChooseValue(stringValue);
     endChooser();
@@ -163,4 +173,4 @@ void DateTimeChooserImpl::didClosePopup()
 
 } // namespace WebKit
 
-#endif // ENABLE(CALENDAR_PICKER)
+#endif // ENABLE(INPUT_MULTIPLE_FIELDS_UI)
diff --git a/Source/WebKit/chromium/src/DateTimeChooserImpl.h b/Source/WebKit/chromium/src/DateTimeChooserImpl.h
index 40195ce53..224358623 100644
--- a/Source/WebKit/chromium/src/DateTimeChooserImpl.h
+++ b/Source/WebKit/chromium/src/DateTimeChooserImpl.h
@@ -31,11 +31,10 @@
 #ifndef DateTimeChooserImpl_h
 #define DateTimeChooserImpl_h
 
+#if ENABLE(INPUT_MULTIPLE_FIELDS_UI)
 #include "DateTimeChooser.h"
 #include "PagePopupClient.h"
 
-#if ENABLE(CALENDAR_PICKER)
-
 namespace WebCore {
 class PagePopup;
 class DateTimeChooserClient;
@@ -47,17 +46,18 @@ class ChromeClientImpl;
 
 class DateTimeChooserImpl : public WebCore::DateTimeChooser, public WebCore::PagePopupClient {
 public:
-    DateTimeChooserImpl(ChromeClientImpl*, WebCore::DateTimeChooserClient*, const WebCore::DateTimeChooserParameters&);
+    static PassRefPtr<DateTimeChooserImpl> create(ChromeClientImpl*, WebCore::DateTimeChooserClient*, const WebCore::DateTimeChooserParameters&);
     virtual ~DateTimeChooserImpl();
 
     // DateTimeChooser functions:
     virtual void endChooser() OVERRIDE;
 
 private:
+    DateTimeChooserImpl(ChromeClientImpl*, WebCore::DateTimeChooserClient*, const WebCore::DateTimeChooserParameters&);
     // PagePopupClient functions:
     virtual WebCore::IntSize contentSize() OVERRIDE;
     virtual void writeDocument(WebCore::DocumentWriter&) OVERRIDE;
-    virtual WebCore::Localizer& localizer() OVERRIDE;
+    virtual WebCore::Locale& locale() OVERRIDE;
     virtual void setValueAndClosePopup(int, const String&) OVERRIDE;
     virtual void didClosePopup() OVERRIDE;
 
@@ -65,11 +65,11 @@ private:
     WebCore::DateTimeChooserClient* m_client;
     WebCore::PagePopup* m_popup;
     WebCore::DateTimeChooserParameters m_parameters;
-    OwnPtr<WebCore::Localizer> m_localizer;
+    OwnPtr<WebCore::Locale> m_locale;
 };
 
 }
 
-#endif // ENABLE(CALENDAR_PICKER)
+#endif // ENABLE(INPUT_MULTIPLE_FIELDS_UI)
 
 #endif // DateTimeChooserImpl_h
diff --git a/Source/WebKit/chromium/src/FrameLoaderClientImpl.cpp b/Source/WebKit/chromium/src/FrameLoaderClientImpl.cpp
index 49e780baf..7ffe94339 100644
--- a/Source/WebKit/chromium/src/FrameLoaderClientImpl.cpp
+++ b/Source/WebKit/chromium/src/FrameLoaderClientImpl.cpp
@@ -62,6 +62,9 @@
 #endif
 #include "Settings.h"
 #include "SocketStreamHandleInternal.h"
+#if ENABLE(REQUEST_AUTOCOMPLETE)
+#include "WebAutofillClient.h"
+#endif
 #include "WebDOMEvent.h"
 #include "WebDataSourceImpl.h"
 #include "WebDevToolsAgentPrivate.h"
@@ -893,6 +896,9 @@ Frame* FrameLoaderClientImpl::dispatchCreatePage(const NavigationAction& action)
     ChromeClientImpl* chromeClient = static_cast<ChromeClientImpl*>(m_webFrame->frame()->page()->chrome()->client());
     chromeClient->setNewWindowNavigationPolicy(policy);
 
+    if (m_webFrame->frame()->settings() && !m_webFrame->frame()->settings()->supportsMultipleWindows())
+        return m_webFrame->frame();
+
     struct WindowFeatures features;
     Page* newPage = m_webFrame->frame()->page()->chrome()->createWindow(
         m_webFrame->frame(), FrameLoadRequest(m_webFrame->frame()->document()->securityOrigin()),
@@ -1648,5 +1654,12 @@ void FrameLoaderClientImpl::dispatchWillStartUsingPeerConnectionHandler(RTCPeerC
 }
 #endif
 
+#if ENABLE(REQUEST_AUTOCOMPLETE)
+void FrameLoaderClientImpl::didRequestAutocomplete(PassRefPtr<FormState> formState)
+{
+    if (m_webFrame->viewImpl() && m_webFrame->viewImpl()->autofillClient())
+        m_webFrame->viewImpl()->autofillClient()->didRequestAutocomplete(m_webFrame, WebFormElement(formState->form()));
+}
+#endif
 
 } // namespace WebKit
diff --git a/Source/WebKit/chromium/src/FrameLoaderClientImpl.h b/Source/WebKit/chromium/src/FrameLoaderClientImpl.h
index 12a76feee..6589c37bb 100644
--- a/Source/WebKit/chromium/src/FrameLoaderClientImpl.h
+++ b/Source/WebKit/chromium/src/FrameLoaderClientImpl.h
@@ -225,6 +225,10 @@ public:
     virtual void dispatchWillStartUsingPeerConnectionHandler(WebCore::RTCPeerConnectionHandler*) OVERRIDE;
 #endif
 
+#if ENABLE(REQUEST_AUTOCOMPLETE)
+    virtual void didRequestAutocomplete(PassRefPtr<WebCore::FormState>) OVERRIDE;
+#endif
+
 private:
     void makeDocumentView();
 
diff --git a/Source/WebKit/chromium/src/IDBDatabaseBackendProxy.cpp b/Source/WebKit/chromium/src/IDBDatabaseBackendProxy.cpp
index 29b8c4bf4..f6d964470 100644
--- a/Source/WebKit/chromium/src/IDBDatabaseBackendProxy.cpp
+++ b/Source/WebKit/chromium/src/IDBDatabaseBackendProxy.cpp
@@ -85,6 +85,14 @@ void IDBDatabaseBackendProxy::deleteObjectStore(const String& name, IDBTransacti
     m_webIDBDatabase->deleteObjectStore(name, *transactionProxy->getWebIDBTransaction(), ec);
 }
 
+void IDBDatabaseBackendProxy::deleteObjectStore(int64_t objectStoreId, IDBTransactionBackendInterface* transaction, ExceptionCode& ec)
+{
+    // The transaction pointer is guaranteed to be a pointer to a proxy object as, in the renderer,
+    // all implementations of IDB interfaces are proxy objects.
+    IDBTransactionBackendProxy* transactionProxy = static_cast<IDBTransactionBackendProxy*>(transaction);
+    m_webIDBDatabase->deleteObjectStore(objectStoreId, *transactionProxy->getWebIDBTransaction(), ec);
+}
+
 void IDBDatabaseBackendProxy::setVersion(const String& version, PassRefPtr<IDBCallbacks> callbacks, PassRefPtr<IDBDatabaseCallbacks> databaseCallbacks, ExceptionCode& ec)
 {
     ASSERT(m_webIDBDatabase);
@@ -102,6 +110,15 @@ PassRefPtr<IDBTransactionBackendInterface> IDBDatabaseBackendProxy::transaction(
     return IDBTransactionBackendProxy::create(transaction.release());
 }
 
+PassRefPtr<IDBTransactionBackendInterface> IDBDatabaseBackendProxy::transaction(const Vector<int64_t>& objectStoreIds, unsigned short mode)
+{
+    OwnPtr<WebIDBTransaction> transaction = adoptPtr(m_webIDBDatabase->transaction(objectStoreIds, mode));
+    if (!transaction)
+        return 0;
+
+    return IDBTransactionBackendProxy::create(transaction.release());
+}
+
 void IDBDatabaseBackendProxy::close(PassRefPtr<IDBDatabaseCallbacks>)
 {
     m_webIDBDatabase->close();
diff --git a/Source/WebKit/chromium/src/IDBDatabaseBackendProxy.h b/Source/WebKit/chromium/src/IDBDatabaseBackendProxy.h
index fc831e8de..916f833ab 100644
--- a/Source/WebKit/chromium/src/IDBDatabaseBackendProxy.h
+++ b/Source/WebKit/chromium/src/IDBDatabaseBackendProxy.h
@@ -46,8 +46,10 @@ public:
 
     virtual PassRefPtr<WebCore::IDBObjectStoreBackendInterface> createObjectStore(int64_t, const String& name, const WebCore::IDBKeyPath&, bool autoIncrement, WebCore::IDBTransactionBackendInterface*, WebCore::ExceptionCode&);
     virtual void deleteObjectStore(const String& name, WebCore::IDBTransactionBackendInterface*, WebCore::ExceptionCode&);
+    virtual void deleteObjectStore(int64_t, WebCore::IDBTransactionBackendInterface*, WebCore::ExceptionCode&);
     virtual void setVersion(const String& version, PassRefPtr<WebCore::IDBCallbacks>, PassRefPtr<WebCore::IDBDatabaseCallbacks>, WebCore::ExceptionCode&);
     virtual PassRefPtr<WebCore::IDBTransactionBackendInterface> transaction(WebCore::DOMStringList* storeNames, unsigned short mode, WebCore::ExceptionCode&);
+    virtual PassRefPtr<WebCore::IDBTransactionBackendInterface> transaction(const Vector<int64_t>&, unsigned short mode);
     virtual void close(PassRefPtr<WebCore::IDBDatabaseCallbacks>);
 
 private:
diff --git a/Source/WebKit/chromium/src/IDBObjectStoreBackendProxy.cpp b/Source/WebKit/chromium/src/IDBObjectStoreBackendProxy.cpp
index 2b9b44a7a..6a0d02772 100755
--- a/Source/WebKit/chromium/src/IDBObjectStoreBackendProxy.cpp
+++ b/Source/WebKit/chromium/src/IDBObjectStoreBackendProxy.cpp
@@ -77,6 +77,14 @@ void IDBObjectStoreBackendProxy::putWithIndexKeys(PassRefPtr<SerializedScriptVal
     m_webIDBObjectStore->putWithIndexKeys(value, key, static_cast<WebIDBObjectStore::PutMode>(putMode), new WebIDBCallbacksImpl(callbacks), *transactionProxy->getWebIDBTransaction(), webIndexNames, webIndexKeys, ec);
 }
 
+void IDBObjectStoreBackendProxy::put(PassRefPtr<SerializedScriptValue> value, PassRefPtr<IDBKey> key, PutMode putMode, PassRefPtr<IDBCallbacks> callbacks, IDBTransactionBackendInterface* transaction, const Vector<int64_t>& indexIds, const Vector<IndexKeys>& indexKeys)
+{
+    // The transaction pointer is guaranteed to be a pointer to a proxy object as, in the renderer,
+    // all implementations of IDB interfaces are proxy objects.
+    IDBTransactionBackendProxy* transactionProxy = static_cast<IDBTransactionBackendProxy*>(transaction);
+    m_webIDBObjectStore->put(value, key, static_cast<WebIDBObjectStore::PutMode>(putMode), new WebIDBCallbacksImpl(callbacks), *transactionProxy->getWebIDBTransaction(), indexIds, indexKeys);
+}
+
 void IDBObjectStoreBackendProxy::setIndexKeys(PassRefPtr<IDBKey> prpPrimaryKey, const Vector<String>& indexNames, const Vector<IndexKeys>& indexKeys, IDBTransactionBackendInterface* transaction)
 {
     // The transaction pointer is guaranteed to be a pointer to a proxy object as, in the renderer,
@@ -87,6 +95,14 @@ void IDBObjectStoreBackendProxy::setIndexKeys(PassRefPtr<IDBKey> prpPrimaryKey,
     m_webIDBObjectStore->setIndexKeys(prpPrimaryKey, webIndexNames, webIndexKeys, *transactionProxy->getWebIDBTransaction());
 }
 
+void IDBObjectStoreBackendProxy::setIndexKeys(PassRefPtr<IDBKey> prpPrimaryKey, const Vector<int64_t>& indexIds, const Vector<IndexKeys>& indexKeys, IDBTransactionBackendInterface* transaction)
+{
+    // The transaction pointer is guaranteed to be a pointer to a proxy object as, in the renderer,
+    // all implementations of IDB interfaces are proxy objects.
+    IDBTransactionBackendProxy* transactionProxy = static_cast<IDBTransactionBackendProxy*>(transaction);
+    m_webIDBObjectStore->setIndexKeys(prpPrimaryKey, WebVector<long long>(indexIds), indexKeys, *transactionProxy->getWebIDBTransaction());
+}
+
 void IDBObjectStoreBackendProxy::deleteFunction(PassRefPtr<IDBKeyRange> keyRange, PassRefPtr<IDBCallbacks> callbacks, IDBTransactionBackendInterface* transaction, ExceptionCode& ec)
 {
     // The transaction pointer is guaranteed to be a pointer to a proxy object as, in the renderer,
@@ -130,7 +146,15 @@ void IDBObjectStoreBackendProxy::setIndexesReady(const Vector<String>& indexName
     // The transaction pointer is guaranteed to be a pointer to a proxy object as, in the renderer,
     // all implementations of IDB interfaces are proxy objects.
     IDBTransactionBackendProxy* transactionProxy = static_cast<IDBTransactionBackendProxy*>(transaction);
-    m_webIDBObjectStore->setIndexesReady(indexNames, *transactionProxy->getWebIDBTransaction());
+    m_webIDBObjectStore->setIndexesReady(WebVector<WebString>(indexNames), *transactionProxy->getWebIDBTransaction());
+}
+
+void IDBObjectStoreBackendProxy::setIndexesReady(const Vector<int64_t>& indexIds, IDBTransactionBackendInterface* transaction)
+{
+    // The transaction pointer is guaranteed to be a pointer to a proxy object as, in the renderer,
+    // all implementations of IDB interfaces are proxy objects.
+    IDBTransactionBackendProxy* transactionProxy = static_cast<IDBTransactionBackendProxy*>(transaction);
+    m_webIDBObjectStore->setIndexesReady(WebVector<long long>(indexIds), *transactionProxy->getWebIDBTransaction());
 }
 
 PassRefPtr<IDBIndexBackendInterface> IDBObjectStoreBackendProxy::index(const String& name, ExceptionCode& ec)
@@ -141,6 +165,14 @@ PassRefPtr<IDBIndexBackendInterface> IDBObjectStoreBackendProxy::index(const Str
     return IDBIndexBackendProxy::create(index.release());
 }
 
+PassRefPtr<IDBIndexBackendInterface> IDBObjectStoreBackendProxy::index(int64_t indexId)
+{
+    OwnPtr<WebIDBIndex> index = adoptPtr(m_webIDBObjectStore->index(indexId));
+    if (!index)
+        return 0;
+    return IDBIndexBackendProxy::create(index.release());
+}
+
 void IDBObjectStoreBackendProxy::deleteIndex(const String& name, IDBTransactionBackendInterface* transaction, ExceptionCode& ec)
 {
     // The transaction pointer is guaranteed to be a pointer to a proxy object as, in the renderer,
@@ -149,6 +181,13 @@ void IDBObjectStoreBackendProxy::deleteIndex(const String& name, IDBTransactionB
     m_webIDBObjectStore->deleteIndex(name, *transactionProxy->getWebIDBTransaction(), ec);
 }
 
+void IDBObjectStoreBackendProxy::deleteIndex(const int64_t indexId, IDBTransactionBackendInterface* transaction, ExceptionCode& ec)
+{
+    // The transaction pointer is guaranteed to be a pointer to a proxy object as, in the renderer,
+    // all implementations of IDB interfaces are proxy objects.
+    IDBTransactionBackendProxy* transactionProxy = static_cast<IDBTransactionBackendProxy*>(transaction);
+    m_webIDBObjectStore->deleteIndex(indexId, *transactionProxy->getWebIDBTransaction(), ec);
+}
 void IDBObjectStoreBackendProxy::openCursor(PassRefPtr<IDBKeyRange> range, IDBCursor::Direction direction, PassRefPtr<IDBCallbacks> callbacks, IDBTransactionBackendInterface::TaskType taskType, IDBTransactionBackendInterface* transaction, ExceptionCode& ec)
 {
     // The transaction pointer is guaranteed to be a pointer to a proxy object as, in the renderer,
diff --git a/Source/WebKit/chromium/src/IDBObjectStoreBackendProxy.h b/Source/WebKit/chromium/src/IDBObjectStoreBackendProxy.h
index 8470c1ad9..79113ae95 100644
--- a/Source/WebKit/chromium/src/IDBObjectStoreBackendProxy.h
+++ b/Source/WebKit/chromium/src/IDBObjectStoreBackendProxy.h
@@ -45,16 +45,21 @@ public:
 
     virtual void get(PassRefPtr<WebCore::IDBKeyRange>, PassRefPtr<WebCore::IDBCallbacks>, WebCore::IDBTransactionBackendInterface*, WebCore::ExceptionCode&);
     virtual void putWithIndexKeys(PassRefPtr<WebCore::SerializedScriptValue>, PassRefPtr<WebCore::IDBKey>, PutMode, PassRefPtr<WebCore::IDBCallbacks>, WebCore::IDBTransactionBackendInterface*, const WTF::Vector<WTF::String>&, const WTF::Vector<IndexKeys>&, WebCore::ExceptionCode&);
+    virtual void put(PassRefPtr<WebCore::SerializedScriptValue>, PassRefPtr<WebCore::IDBKey>, PutMode, PassRefPtr<WebCore::IDBCallbacks>, WebCore::IDBTransactionBackendInterface*, const WTF::Vector<int64_t>&, const WTF::Vector<IndexKeys>&);
     virtual void deleteFunction(PassRefPtr<WebCore::IDBKeyRange>, PassRefPtr<WebCore::IDBCallbacks>, WebCore::IDBTransactionBackendInterface*, WebCore::ExceptionCode&);
     virtual void clear(PassRefPtr<WebCore::IDBCallbacks>, WebCore::IDBTransactionBackendInterface*, WebCore::ExceptionCode&);
 
     PassRefPtr<WebCore::IDBIndexBackendInterface> createIndex(int64_t id, const String& name, const WebCore::IDBKeyPath&, bool unique, bool multiEntry, WebCore::IDBTransactionBackendInterface*, WebCore::ExceptionCode&);
     PassRefPtr<WebCore::IDBIndexBackendInterface> createIndex(const String& name, const WebCore::IDBKeyPath&, bool unique, bool multiEntry, WebCore::IDBTransactionBackendInterface*, WebCore::ExceptionCode&);
-    virtual void setIndexKeys(PassRefPtr<WebCore::IDBKey> prpPrimaryKey, const WTF::Vector<WTF::String>&, const WTF::Vector<IndexKeys>&, WebCore::IDBTransactionBackendInterface*);
+    virtual void setIndexKeys(PassRefPtr<WebCore::IDBKey> prpPrimaryKey, const WTF::Vector<WTF::String>&, const Vector<IndexKeys>&, WebCore::IDBTransactionBackendInterface*);
+    virtual void setIndexKeys(PassRefPtr<WebCore::IDBKey> prpPrimaryKey, const WTF::Vector<int64_t>&, const Vector<IndexKeys>&, WebCore::IDBTransactionBackendInterface*);
     virtual void setIndexesReady(const Vector<String>&, WebCore::IDBTransactionBackendInterface*);
-    
+    virtual void setIndexesReady(const Vector<int64_t>&, WebCore::IDBTransactionBackendInterface*);
+
     PassRefPtr<WebCore::IDBIndexBackendInterface> index(const String& name, WebCore::ExceptionCode&);
+    PassRefPtr<WebCore::IDBIndexBackendInterface> index(int64_t);
     void deleteIndex(const String& name, WebCore::IDBTransactionBackendInterface*, WebCore::ExceptionCode&);
+    void deleteIndex(int64_t, WebCore::IDBTransactionBackendInterface*, WebCore::ExceptionCode&);
 
     virtual void openCursor(PassRefPtr<WebCore::IDBKeyRange>, WebCore::IDBCursor::Direction, PassRefPtr<WebCore::IDBCallbacks>, WebCore::IDBTransactionBackendInterface::TaskType, WebCore::IDBTransactionBackendInterface*, WebCore::ExceptionCode&);
     virtual void count(PassRefPtr<WebCore::IDBKeyRange>, PassRefPtr<WebCore::IDBCallbacks>, WebCore::IDBTransactionBackendInterface*, WebCore::ExceptionCode&);
diff --git a/Source/WebKit/chromium/src/IDBTransactionBackendProxy.cpp b/Source/WebKit/chromium/src/IDBTransactionBackendProxy.cpp
index 88f9852ac..f0837fef6 100644
--- a/Source/WebKit/chromium/src/IDBTransactionBackendProxy.cpp
+++ b/Source/WebKit/chromium/src/IDBTransactionBackendProxy.cpp
@@ -62,6 +62,14 @@ PassRefPtr<IDBObjectStoreBackendInterface> IDBTransactionBackendProxy::objectSto
     return IDBObjectStoreBackendProxy::create(objectStore.release());
 }
 
+PassRefPtr<WebCore::IDBObjectStoreBackendInterface> IDBTransactionBackendProxy::objectStore(int64_t indexId, ExceptionCode& ec)
+{
+    OwnPtr<WebIDBObjectStore> objectStore = adoptPtr(m_webIDBTransaction->objectStore(indexId, ec));
+    if (!objectStore)
+        return 0;
+    return IDBObjectStoreBackendProxy::create(objectStore.release());
+}
+
 void IDBTransactionBackendProxy::commit()
 {
     m_webIDBTransaction->commit();
diff --git a/Source/WebKit/chromium/src/IDBTransactionBackendProxy.h b/Source/WebKit/chromium/src/IDBTransactionBackendProxy.h
index 7e7486bd7..e8f2c3375 100644
--- a/Source/WebKit/chromium/src/IDBTransactionBackendProxy.h
+++ b/Source/WebKit/chromium/src/IDBTransactionBackendProxy.h
@@ -42,6 +42,7 @@ public:
     virtual ~IDBTransactionBackendProxy();
 
     virtual PassRefPtr<WebCore::IDBObjectStoreBackendInterface> objectStore(const String& name, WebCore::ExceptionCode&);
+    virtual PassRefPtr<WebCore::IDBObjectStoreBackendInterface> objectStore(int64_t, WebCore::ExceptionCode&);
     virtual void commit();
     virtual void abort();
     virtual void didCompleteTaskEvents();
diff --git a/Source/WebKit/chromium/src/InspectorClientImpl.cpp b/Source/WebKit/chromium/src/InspectorClientImpl.cpp
index f8020ef0b..c6e7b2277 100644
--- a/Source/WebKit/chromium/src/InspectorClientImpl.cpp
+++ b/Source/WebKit/chromium/src/InspectorClientImpl.cpp
@@ -131,6 +131,11 @@ void InspectorClientImpl::clearBrowserCookies()
         agent->clearBrowserCookies();
 }
 
+bool InspectorClientImpl::canMonitorMainThread()
+{
+    return true;
+}
+
 void InspectorClientImpl::startMainThreadMonitoring()
 {
     WebKit::Platform::current()->currentThread()->addTaskObserver(this);
diff --git a/Source/WebKit/chromium/src/InspectorClientImpl.h b/Source/WebKit/chromium/src/InspectorClientImpl.h
index 34de35a09..75e1e4342 100644
--- a/Source/WebKit/chromium/src/InspectorClientImpl.h
+++ b/Source/WebKit/chromium/src/InspectorClientImpl.h
@@ -69,6 +69,7 @@ public:
     virtual bool canClearBrowserCookies();
     virtual void clearBrowserCookies();
 
+    virtual bool canMonitorMainThread();
     virtual void startMainThreadMonitoring();
     virtual void stopMainThreadMonitoring();
 
diff --git a/Source/WebKit/chromium/src/LinkHighlight.cpp b/Source/WebKit/chromium/src/LinkHighlight.cpp
index 815a0c300..0d4d154f0 100644
--- a/Source/WebKit/chromium/src/LinkHighlight.cpp
+++ b/Source/WebKit/chromium/src/LinkHighlight.cpp
@@ -48,6 +48,7 @@
 #include <public/WebFloatPoint.h>
 #include <public/WebRect.h>
 #include <public/WebSize.h>
+#include <public/WebTransformationMatrix.h>
 
 using namespace WebCore;
 
@@ -125,10 +126,10 @@ RenderLayer* LinkHighlight::computeEnclosingCompositingLayer()
     if (!renderLayer || !renderLayer->isComposited())
         return 0;
 
-    m_graphicsLayerOffset = FloatPoint();
     GraphicsLayerChromium* newGraphicsLayer = static_cast<GraphicsLayerChromium*>(renderLayer->backing()->graphicsLayer());
+    m_clipLayer->setSublayerTransform(WebTransformationMatrix());
     if (!newGraphicsLayer->drawsContent()) {
-        m_graphicsLayerOffset = newGraphicsLayer->position();
+        m_clipLayer->setSublayerTransform(WebTransformationMatrix(newGraphicsLayer->transform()));
         newGraphicsLayer = static_cast<GraphicsLayerChromium*>(m_owningWebViewImpl->nonCompositedContentHost()->topLevelRootLayer());
     }
 
@@ -225,7 +226,7 @@ bool LinkHighlight::computeHighlightLayerPathAndPosition(RenderLayer* compositin
     return pathHasChanged;
 }
 
-void LinkHighlight::paintContents(WebCanvas* canvas, const WebRect& webClipRect, WebFloatRect&)
+void LinkHighlight::paintContents(WebCanvas* canvas, const WebRect& webClipRect, bool, WebFloatRect&)
 {
     if (!m_node || !m_node->renderer())
         return;
@@ -302,6 +303,9 @@ void LinkHighlight::updateGeometry()
         // We only need to invalidate the layer if the highlight size has changed, otherwise
         // we can just re-position the layer without needing to repaint.
         m_contentLayer->layer()->invalidate();
+
+        if (m_currentGraphicsLayer)
+            m_currentGraphicsLayer->addRepaintRect(FloatRect(layer()->position().x, layer()->position().y, layer()->bounds().width, layer()->bounds().height));
     }
 }
 
diff --git a/Source/WebKit/chromium/src/LinkHighlight.h b/Source/WebKit/chromium/src/LinkHighlight.h
index 3bac3c729..06d8c909f 100644
--- a/Source/WebKit/chromium/src/LinkHighlight.h
+++ b/Source/WebKit/chromium/src/LinkHighlight.h
@@ -58,7 +58,7 @@ public:
     void updateGeometry();
 
     // WebContentLayerClient implementation.
-    virtual void paintContents(WebCanvas*, const WebRect& clipRect, WebFloatRect& opaque) OVERRIDE;
+    virtual void paintContents(WebCanvas*, const WebRect& clipRect, bool canPaintLCDText, WebFloatRect& opaque) OVERRIDE;
 
     // WebAnimationDelegate implementation.
     virtual void notifyAnimationStarted(double time) OVERRIDE;
@@ -91,7 +91,6 @@ private:
 
     bool m_geometryNeedsUpdate;
     bool m_isAnimating;
-    WebCore::FloatPoint m_graphicsLayerOffset;
 };
 
 } // namespace WebKit
diff --git a/Source/WebKit/chromium/src/LocalizedStrings.cpp b/Source/WebKit/chromium/src/LocalizedStrings.cpp
index 4ef239c6f..a5c2024fa 100644
--- a/Source/WebKit/chromium/src/LocalizedStrings.cpp
+++ b/Source/WebKit/chromium/src/LocalizedStrings.cpp
@@ -31,6 +31,7 @@
 #include "config.h"
 #include "LocalizedStrings.h"
 
+#include "DateTimeFormat.h"
 #include "IntSize.h"
 #include "NotImplemented.h"
 
@@ -267,10 +268,28 @@ String placeholderForYearField()
 {
     return query(WebLocalizedString::PlaceholderForYearField);
 }
+#endif
 
+#if ENABLE(INPUT_TYPE_WEEK)
 String weekFormatInLDML()
 {
-    return query(WebLocalizedString::WeekFormatTemplate);
+    String templ = query(WebLocalizedString::WeekFormatTemplate);
+    // Converts a string like "Week $2, $1" to an LDML date format pattern like
+    // "'Week 'ww', 'yyyy".
+    StringBuilder builder;
+    unsigned literalStart = 0;
+    unsigned length = templ.length();
+    for (unsigned i = 0; i + 1 < length; ++i) {
+        if (templ[i] == '$' && (templ[i + 1] == '1' || templ[i + 1] == '2')) {
+            if (literalStart < i)
+                DateTimeFormat::quoteAndAppendLiteral(templ.substring(literalStart, i - literalStart), builder);
+            builder.append(templ[++i] == '1' ? "yyyy" : "ww");
+            literalStart = i + 1;
+        }
+    }
+    if (literalStart < length)
+        DateTimeFormat::quoteAndAppendLiteral(templ.substring(literalStart, length - literalStart), builder);
+    return builder.toString();
 }
 
 #endif
@@ -298,6 +317,12 @@ String insecurePluginVersionText()
     return String();
 }
 
+String inactivePluginText()
+{
+    notImplemented();
+    return String();
+}
+
 String multipleFileUploadText(unsigned numberOfFiles)
 {
     return query(WebLocalizedString::MultipleFileUploadText, String::number(numberOfFiles));
@@ -479,31 +504,4 @@ String validationMessageStepMismatchText(const String& base, const String& step)
     return query(WebLocalizedString::ValidationStepMismatch, base, step);
 }
 
-#if ENABLE(CALENDAR_PICKER)
-String calendarTodayText()
-{
-    return query(WebLocalizedString::CalendarToday);
-}
-
-String calendarClearText()
-{
-    return query(WebLocalizedString::CalendarClear);
-}
-
-String dateFormatYearText()
-{
-    return query(WebLocalizedString::DateFormatYearLabel);
-}
-
-String dateFormatMonthText()
-{
-    return query(WebLocalizedString::DateFormatMonthLabel);
-}
-
-String dateFormatDayInMonthText()
-{
-    return query(WebLocalizedString::DateFormatDayInMonthLabel);
-}
-#endif
-
 } // namespace WebCore
diff --git a/Source/WebKit/chromium/src/NonCompositedContentHost.cpp b/Source/WebKit/chromium/src/NonCompositedContentHost.cpp
index 21b9725b0..05a4c15d9 100644
--- a/Source/WebKit/chromium/src/NonCompositedContentHost.cpp
+++ b/Source/WebKit/chromium/src/NonCompositedContentHost.cpp
@@ -41,7 +41,6 @@ namespace WebKit {
 
 NonCompositedContentHost::NonCompositedContentHost(WebViewImpl* webView)
     : m_webView(webView)
-    , m_opaque(true)
     , m_showDebugBorders(false)
 {
     m_graphicsLayer = WebCore::GraphicsLayer::create(0, this);
@@ -50,9 +49,10 @@ NonCompositedContentHost::NonCompositedContentHost(WebViewImpl* webView)
 #endif
     m_graphicsLayer->setDrawsContent(true);
     m_graphicsLayer->setAppliesPageScale(!m_webView->page()->settings()->applyPageScaleFactorInCompositor());
+    m_graphicsLayer->setContentsOpaque(true);
+    // FIXME: Remove LCD text setting after it is implemented in chromium.
     WebContentLayer* layer = static_cast<WebCore::GraphicsLayerChromium*>(m_graphicsLayer.get())->contentLayer();
     layer->setUseLCDText(true);
-    layer->layer()->setOpaque(true);
 #if !OS(ANDROID)
     layer->setDrawCheckerboardForMissingTiles(true);
 #endif
@@ -69,8 +69,7 @@ void NonCompositedContentHost::setBackgroundColor(const WebCore::Color& color)
 
 void NonCompositedContentHost::setOpaque(bool opaque)
 {
-    m_opaque = opaque;
-    m_graphicsLayer->platformLayer()->setOpaque(opaque);
+    m_graphicsLayer->setContentsOpaque(opaque);
 }
 
 void NonCompositedContentHost::setScrollLayer(WebCore::GraphicsLayer* layer)
@@ -173,10 +172,11 @@ void NonCompositedContentHost::notifyFlushRequired(const WebCore::GraphicsLayer*
 
 void NonCompositedContentHost::paintContents(const WebCore::GraphicsLayer*, WebCore::GraphicsContext& context, WebCore::GraphicsLayerPaintingPhase, const WebCore::IntRect& clipRect)
 {
+    // FIXME: Remove LCD text setting after it is implemented in chromium.
     // On non-android platforms, we want to render text with subpixel antialiasing on the root layer
     // so long as the root is opaque. On android all text is grayscale.
 #if !OS(ANDROID)
-    if (m_opaque)
+    if (m_graphicsLayer->contentsOpaque())
         context.platformContext()->setDrawingToImageBuffer(false);
 #endif
     context.translate(-m_layerAdjust);
@@ -191,14 +191,9 @@ void NonCompositedContentHost::setShowDebugBorders(bool showDebugBorders)
     m_graphicsLayer->updateDebugIndicators();
 }
 
-bool NonCompositedContentHost::showDebugBorders(const WebCore::GraphicsLayer*) const
+bool NonCompositedContentHost::isTrackingRepaints() const
 {
-    return m_showDebugBorders;
-}
-
-bool NonCompositedContentHost::showRepaintCounter(const WebCore::GraphicsLayer*) const
-{
-    return false;
+    return m_webView->isTrackingRepaints();
 }
 
 } // namespace WebKit
diff --git a/Source/WebKit/chromium/src/NonCompositedContentHost.h b/Source/WebKit/chromium/src/NonCompositedContentHost.h
index 08e9c69b2..609538a6f 100644
--- a/Source/WebKit/chromium/src/NonCompositedContentHost.h
+++ b/Source/WebKit/chromium/src/NonCompositedContentHost.h
@@ -71,8 +71,7 @@ private:
     virtual void notifyAnimationStarted(const WebCore::GraphicsLayer*, double time);
     virtual void notifyFlushRequired(const WebCore::GraphicsLayer*);
     virtual void paintContents(const WebCore::GraphicsLayer*, WebCore::GraphicsContext&, WebCore::GraphicsLayerPaintingPhase, const WebCore::IntRect& clipRect);
-    virtual bool showDebugBorders(const WebCore::GraphicsLayer*) const;
-    virtual bool showRepaintCounter(const WebCore::GraphicsLayer*) const;
+    virtual bool isTrackingRepaints() const;
 
     bool haveScrollLayer();
     WebLayer* scrollLayer();
@@ -82,7 +81,6 @@ private:
     WebCore::IntSize m_viewportSize;
     WebCore::IntSize m_layerAdjust;
 
-    bool m_opaque;
     bool m_showDebugBorders;
 };
 
diff --git a/Source/WebKit/chromium/src/PageOverlay.cpp b/Source/WebKit/chromium/src/PageOverlay.cpp
index a16a01077..c95687af6 100644
--- a/Source/WebKit/chromium/src/PageOverlay.cpp
+++ b/Source/WebKit/chromium/src/PageOverlay.cpp
@@ -94,16 +94,6 @@ public:
         return m_webViewImpl->pageScaleFactor();
     }
 
-    virtual bool showDebugBorders(const GraphicsLayer*) const
-    {
-        return m_webViewImpl->page()->settings()->showDebugBorders();
-    }
-
-    virtual bool showRepaintCounter(const GraphicsLayer*) const
-    {
-        return m_webViewImpl->page()->settings()->showRepaintCounter();
-    }
-
 private:
     OverlayGraphicsLayerClientImpl(WebViewImpl* webViewImpl, WebPageOverlay* overlay)
         : m_overlay(overlay)
diff --git a/Source/WebKit/chromium/src/PageOverlay.h b/Source/WebKit/chromium/src/PageOverlay.h
index bf8526fcc..2101cbf5b 100644
--- a/Source/WebKit/chromium/src/PageOverlay.h
+++ b/Source/WebKit/chromium/src/PageOverlay.h
@@ -65,8 +65,8 @@ private:
 
     WebViewImpl* m_viewImpl;
     WebPageOverlay* m_overlay;
-    OwnPtr<WebCore::GraphicsLayer> m_layer;
     OwnPtr<WebCore::GraphicsLayerClient> m_layerClient;
+    OwnPtr<WebCore::GraphicsLayer> m_layer;
     int m_zOrder;
 };
 
diff --git a/Source/WebKit/chromium/src/PlatformSupport.cpp b/Source/WebKit/chromium/src/PlatformSupport.cpp
index 9eb8b68e1..a39b1e9cb 100644
--- a/Source/WebKit/chromium/src/PlatformSupport.cpp
+++ b/Source/WebKit/chromium/src/PlatformSupport.cpp
@@ -100,30 +100,6 @@ using namespace WebKit;
 
 namespace WebCore {
 
-static WebWidgetClient* toWebWidgetClient(Widget* widget)
-{
-    if (!widget)
-        return 0;
-
-    FrameView* view;
-    if (widget->isFrameView())
-        view = static_cast<FrameView*>(widget);
-    else if (widget->parent() && widget->parent()->isFrameView())
-        view = static_cast<FrameView*>(widget->parent());
-    else
-        return 0;
-
-    Page* page = view->frame() ? view->frame()->page() : 0;
-    if (!page)
-        return 0;
-
-    void* webView = page->chrome()->client()->webView();
-    if (!webView)
-        return 0;
-
-    return static_cast<WebViewImpl*>(webView)->client();
-}
-
 static WebCookieJar* getCookieJar(const Document* document)
 {
     WebFrameImpl* frameImpl = WebFrameImpl::fromFrame(document->frame());
@@ -330,62 +306,6 @@ void PlatformSupport::paintProgressBar(
 // Glue layer. Once the Glue layer moves entirely into the WebKit layer, these
 // methods will be deleted.
 
-int PlatformSupport::screenHorizontalDPI(Widget* widget)
-{
-    WebWidgetClient* client = toWebWidgetClient(widget);
-    if (!client)
-        return 0;
-    return client->screenInfo().horizontalDPI;
-}
-
-int PlatformSupport::screenVerticalDPI(Widget* widget)
-{
-    WebWidgetClient* client = toWebWidgetClient(widget);
-    if (!client)
-        return 0;
-    return client->screenInfo().verticalDPI;
-}
-
-int PlatformSupport::screenDepth(Widget* widget)
-{
-    WebWidgetClient* client = toWebWidgetClient(widget);
-    if (!client)
-        return 0;
-    return client->screenInfo().depth;
-}
-
-int PlatformSupport::screenDepthPerComponent(Widget* widget)
-{
-    WebWidgetClient* client = toWebWidgetClient(widget);
-    if (!client)
-        return 0;
-    return client->screenInfo().depthPerComponent;
-}
-
-bool PlatformSupport::screenIsMonochrome(Widget* widget)
-{
-    WebWidgetClient* client = toWebWidgetClient(widget);
-    if (!client)
-        return 0;
-    return client->screenInfo().isMonochrome;
-}
-
-IntRect PlatformSupport::screenRect(Widget* widget)
-{
-    WebWidgetClient* client = toWebWidgetClient(widget);
-    if (!client)
-        return IntRect();
-    return client->screenInfo().rect;
-}
-
-IntRect PlatformSupport::screenAvailableRect(Widget* widget)
-{
-    WebWidgetClient* client = toWebWidgetClient(widget);
-    if (!client)
-        return IntRect();
-    return client->screenInfo().availableRect;
-}
-
 #if ENABLE(WORKERS)
 WorkerContextProxy* WorkerContextProxy::create(Worker* worker)
 {
diff --git a/Source/WebKit/chromium/src/WebDevToolsAgentImpl.cpp b/Source/WebKit/chromium/src/WebDevToolsAgentImpl.cpp
index 5c25ff64e..5d6a1d09b 100644
--- a/Source/WebKit/chromium/src/WebDevToolsAgentImpl.cpp
+++ b/Source/WebKit/chromium/src/WebDevToolsAgentImpl.cpp
@@ -348,6 +348,15 @@ private:
     double m_originalZoomFactor;
 };
 
+class SerializingFrontendChannel : public InspectorFrontendChannel {
+public:
+    virtual bool sendMessageToFrontend(const String& message)
+    {
+        m_message = message;
+        return true;
+    }
+    String m_message;
+};
 
 WebDevToolsAgentImpl::WebDevToolsAgentImpl(
     WebViewImpl* webViewImpl,
@@ -685,17 +694,17 @@ void WebDevToolsAgent::processPendingMessages()
     PageScriptDebugServer::shared().runPendingTasks();
 }
 
-WebString WebDevToolsAgent::disconnectEventAsText()
+WebString WebDevToolsAgent::inspectorDetachedEvent(const WebString& reason)
 {
-    class ChannelImpl : public InspectorFrontendChannel {
-    public:
-        virtual bool sendMessageToFrontend(const String& message)
-        {
-            m_message = message;
-            return true;
-        }
-        String m_message;
-    } channel;
+    SerializingFrontendChannel channel;
+    InspectorFrontend::Inspector inspector(&channel);
+    inspector.detached(reason);
+    return channel.m_message;
+}
+
+WebString WebDevToolsAgent::workerDisconnectedFromWorkerEvent()
+{
+    SerializingFrontendChannel channel;
 #if ENABLE(WORKERS)
     InspectorFrontend::Worker inspector(&channel);
     inspector.disconnectedFromWorker();
@@ -703,4 +712,10 @@ WebString WebDevToolsAgent::disconnectEventAsText()
     return channel.m_message;
 }
 
+// FIXME: remove this once migrated to workerDisconnectedFromWorkerEvent().
+WebString WebDevToolsAgent::disconnectEventAsText()
+{
+    return WebDevToolsAgent::workerDisconnectedFromWorkerEvent();
+}
+
 } // namespace WebKit
diff --git a/Source/WebKit/chromium/src/WebFormElement.cpp b/Source/WebKit/chromium/src/WebFormElement.cpp
index cdae6620e..f6a9a67f0 100644
--- a/Source/WebKit/chromium/src/WebFormElement.cpp
+++ b/Source/WebKit/chromium/src/WebFormElement.cpp
@@ -102,6 +102,13 @@ void WebFormElement::getFormControlElements(WebVector<WebFormControlElement>& re
     result.assign(tempVector);
 }
 
+void WebFormElement::finishRequestAutocomplete(WebFormElement::AutocompleteResult result)
+{
+#if ENABLE(REQUEST_AUTOCOMPLETE)
+    unwrap<HTMLFormElement>()->finishRequestAutocomplete(static_cast<HTMLFormElement::AutocompleteResult>(result));
+#endif
+}
+
 WebFormElement::WebFormElement(const PassRefPtr<HTMLFormElement>& e)
     : WebElement(e)
 {
diff --git a/Source/WebKit/chromium/src/WebFrameImpl.cpp b/Source/WebKit/chromium/src/WebFrameImpl.cpp
index 7eef29343..1936476f3 100644
--- a/Source/WebKit/chromium/src/WebFrameImpl.cpp
+++ b/Source/WebKit/chromium/src/WebFrameImpl.cpp
@@ -82,6 +82,7 @@
 #include "DOMUtilitiesPrivate.h"
 #include "DOMWindow.h"
 #include "DOMWindowIntents.h"
+#include "DOMWrapperWorld.h"
 #include "DeliveredIntent.h"
 #include "DeliveredIntentClientImpl.h"
 #include "DirectoryEntry.h"
@@ -148,6 +149,7 @@
 #include "SubstituteData.h"
 #include "TextAffinity.h"
 #include "TextIterator.h"
+#include "TraceEvent.h"
 #include "UserGestureIndicator.h"
 #include "V8DOMFileSystem.h"
 #include "V8DirectoryEntry.h"
@@ -825,7 +827,13 @@ void WebFrameImpl::executeScriptInIsolatedWorld(int worldID, const WebScriptSour
 void WebFrameImpl::setIsolatedWorldSecurityOrigin(int worldID, const WebSecurityOrigin& securityOrigin)
 {
     ASSERT(frame());
-    frame()->script()->setIsolatedWorldSecurityOrigin(worldID, securityOrigin.get());
+    DOMWrapperWorld::setIsolatedWorldSecurityOrigin(worldID, securityOrigin.get());
+}
+
+void WebFrameImpl::setIsolatedWorldContentSecurityPolicy(int worldID, const WebString& policy)
+{
+    ASSERT(frame());
+    DOMWrapperWorld::setIsolatedWorldContentSecurityPolicy(worldID, policy);
 }
 
 void WebFrameImpl::addMessageToConsole(const WebConsoleMessage& message)
@@ -851,7 +859,7 @@ void WebFrameImpl::addMessageToConsole(const WebConsoleMessage& message)
         return;
     }
 
-    frame()->document()->domWindow()->console()->addMessage(OtherMessageSource, LogMessageType, webCoreMessageLevel, message.text);
+    frame()->document()->addConsoleMessage(OtherMessageSource, LogMessageType, webCoreMessageLevel, message.text);
 }
 
 void WebFrameImpl::collectGarbage()
@@ -1114,15 +1122,7 @@ WebURLLoader* WebFrameImpl::createAssociatedURLLoader(const WebURLLoaderOptions&
 
 void WebFrameImpl::commitDocumentData(const char* data, size_t length)
 {
-    WebViewImpl* webView = viewImpl();
-    bool isMainFrame = webView->mainFrameImpl()->frame() == frame();
-    if (isMainFrame)
-        webView->suppressInvalidations(true);
-
     frame()->loader()->documentLoader()->commitData(data, length);
-
-    if (isMainFrame)
-        webView->suppressInvalidations(false);
 }
 
 unsigned WebFrameImpl::unloadListenerCount() const
@@ -2275,6 +2275,8 @@ void WebFrameImpl::didChangeContentsSize(const IntSize& size)
 
 void WebFrameImpl::createFrameView()
 {
+    TRACE_EVENT0("webkit", "WebFrameImpl::createFrameView");
+
     ASSERT(frame()); // If frame() doesn't exist, we probably didn't init properly.
 
     WebViewImpl* webView = viewImpl();
@@ -2458,7 +2460,7 @@ bool WebFrameImpl::shouldScopeMatches(const String& searchText)
     // Don't scope if we can't find a frame or a view.
     // The user may have closed the tab/application, so abort.
     // Also ignore detached frames, as many find operations report to the main frame.
-    if (!frame() || !frame()->view() || !frame()->page())
+    if (!frame() || !frame()->view() || !frame()->page() || !hasVisibleContent())
         return false;
 
     ASSERT(frame()->document() && frame()->view());
diff --git a/Source/WebKit/chromium/src/WebFrameImpl.h b/Source/WebKit/chromium/src/WebFrameImpl.h
index 2686aad1d..722ecf559 100644
--- a/Source/WebKit/chromium/src/WebFrameImpl.h
+++ b/Source/WebKit/chromium/src/WebFrameImpl.h
@@ -114,6 +114,7 @@ public:
         int worldID, const WebScriptSource* sources, unsigned numSources,
         int extensionGroup);
     virtual void setIsolatedWorldSecurityOrigin(int worldID, const WebSecurityOrigin&);
+    virtual void setIsolatedWorldContentSecurityPolicy(int worldID, const WebString&);
     virtual void addMessageToConsole(const WebConsoleMessage&);
     virtual void collectGarbage();
     virtual bool checkIfRunInsecureContent(const WebURL&) const;
diff --git a/Source/WebKit/chromium/src/WebHitTestResult.cpp b/Source/WebKit/chromium/src/WebHitTestResult.cpp
index a839fb63e..7e5a9aefb 100644
--- a/Source/WebKit/chromium/src/WebHitTestResult.cpp
+++ b/Source/WebKit/chromium/src/WebHitTestResult.cpp
@@ -32,8 +32,10 @@
 #include "Node.h"
 #include "RenderObject.h"
 #include "VisiblePosition.h"
+#include "WebElement.h"
 #include "WebNode.h"
 #include <public/WebPoint.h>
+#include <public/WebURL.h>
 
 using namespace WebCore;
 
@@ -49,6 +51,26 @@ WebPoint WebHitTestResult::localPoint() const
     return roundedIntPoint(m_private->localPoint());
 }
 
+WebElement WebHitTestResult::urlElement() const
+{
+    return WebElement(m_private->URLElement());
+}
+
+WebURL WebHitTestResult::absoluteImageURL() const
+{
+    return m_private->absoluteImageURL();
+}
+
+WebURL WebHitTestResult::absoluteLinkURL() const
+{
+    return m_private->absoluteLinkURL();
+}
+
+bool WebHitTestResult::isContentEditable() const
+{
+    return m_private->isContentEditable();
+}
+
 WebHitTestResult::WebHitTestResult(const HitTestResult& result)
 {
     m_private.reset(new HitTestResult(result));
diff --git a/Source/WebKit/chromium/src/WebIDBCallbacksImpl.cpp b/Source/WebKit/chromium/src/WebIDBCallbacksImpl.cpp
index e09c1a3fe..8d12cfa3e 100644
--- a/Source/WebKit/chromium/src/WebIDBCallbacksImpl.cpp
+++ b/Source/WebKit/chromium/src/WebIDBCallbacksImpl.cpp
@@ -28,6 +28,7 @@
 
 #if ENABLE(INDEXED_DATABASE)
 
+#include "DOMStringList.h"
 #include "IDBCallbacks.h"
 #include "IDBCursorBackendProxy.h"
 #include "IDBDatabaseBackendProxy.h"
diff --git a/Source/WebKit/chromium/src/WebIDBDatabaseImpl.cpp b/Source/WebKit/chromium/src/WebIDBDatabaseImpl.cpp
index e71029deb..90c262389 100644
--- a/Source/WebKit/chromium/src/WebIDBDatabaseImpl.cpp
+++ b/Source/WebKit/chromium/src/WebIDBDatabaseImpl.cpp
@@ -75,6 +75,11 @@ void WebIDBDatabaseImpl::deleteObjectStore(const WebString& name, const WebIDBTr
     m_databaseBackend->deleteObjectStore(name, transaction.getIDBTransactionBackendInterface(), ec);
 }
 
+void WebIDBDatabaseImpl::deleteObjectStore(long long objectStoreId, const WebIDBTransaction& transaction, WebExceptionCode& ec)
+{
+    m_databaseBackend->deleteObjectStore(objectStoreId, transaction.getIDBTransactionBackendInterface(), ec);
+}
+
 void WebIDBDatabaseImpl::setVersion(const WebString& version, WebIDBCallbacks* callbacks, WebExceptionCode& ec)
 {
     m_databaseBackend->setVersion(version, IDBCallbacksProxy::create(adoptPtr(callbacks)), m_databaseCallbacks, ec);
@@ -91,6 +96,17 @@ WebIDBTransaction* WebIDBDatabaseImpl::transaction(const WebDOMStringList& names
     return new WebIDBTransactionImpl(transaction);
 }
 
+WebIDBTransaction* WebIDBDatabaseImpl::transaction(const WebVector<long long>& objectStoreIds, unsigned short mode)
+{
+    Vector<int64_t> objectStoreIdList(objectStoreIds.size());
+    for (size_t i = 0; i < objectStoreIds.size(); ++i)
+        objectStoreIdList[i] = objectStoreIds[i];
+    RefPtr<IDBTransactionBackendInterface> transaction = m_databaseBackend->transaction(objectStoreIdList, mode);
+    if (!transaction)
+        return 0;
+    return new WebIDBTransactionImpl(transaction);
+}
+
 void WebIDBDatabaseImpl::close()
 {
     // Use the callbacks passed in to the constructor so that the backend in
diff --git a/Source/WebKit/chromium/src/WebIDBDatabaseImpl.h b/Source/WebKit/chromium/src/WebIDBDatabaseImpl.h
index 769bdf5d0..65a19668a 100644
--- a/Source/WebKit/chromium/src/WebIDBDatabaseImpl.h
+++ b/Source/WebKit/chromium/src/WebIDBDatabaseImpl.h
@@ -54,8 +54,10 @@ public:
 
     virtual WebIDBObjectStore* createObjectStore(long long, const WebString& name, const WebIDBKeyPath&, bool autoIncrement, const WebIDBTransaction&, WebExceptionCode&);
     virtual void deleteObjectStore(const WebString& name, const WebIDBTransaction&, WebExceptionCode&);
+    virtual void deleteObjectStore(long long objectStoreId, const WebIDBTransaction&, WebExceptionCode&);
     virtual void setVersion(const WebString& version, WebIDBCallbacks*, WebExceptionCode&);
     virtual WebIDBTransaction* transaction(const WebDOMStringList& names, unsigned short mode, WebExceptionCode&);
+    virtual WebIDBTransaction* transaction(const WebVector<long long>& names, unsigned short mode);
     virtual void forceClose();
     virtual void close();
 
diff --git a/Source/WebKit/chromium/src/WebIDBMetadata.cpp b/Source/WebKit/chromium/src/WebIDBMetadata.cpp
index dd1c2c8e5..2ca5bf7c7 100644
--- a/Source/WebKit/chromium/src/WebIDBMetadata.cpp
+++ b/Source/WebKit/chromium/src/WebIDBMetadata.cpp
@@ -49,6 +49,7 @@ WebIDBMetadata::WebIDBMetadata(const WebCore::IDBDatabaseMetadata& metadata)
     for (IDBDatabaseMetadata::ObjectStoreMap::const_iterator storeIterator = metadata.objectStores.begin(); storeIterator != metadata.objectStores.end(); ++storeIterator) {
         const IDBObjectStoreMetadata& objectStore = storeIterator->value;
         ObjectStore webObjectStore;
+        webObjectStore.id = objectStore.id;
         webObjectStore.name = objectStore.name;
         webObjectStore.keyPath = objectStore.keyPath;
         webObjectStore.autoIncrement = objectStore.autoIncrement;
@@ -59,6 +60,7 @@ WebIDBMetadata::WebIDBMetadata(const WebCore::IDBDatabaseMetadata& metadata)
         for (IDBObjectStoreMetadata::IndexMap::const_iterator indexIterator = objectStore.indexes.begin(); indexIterator != objectStore.indexes.end(); ++indexIterator) {
             const IDBIndexMetadata& index = indexIterator->value;
             Index webIndex;
+            webIndex.id = index.id;
             webIndex.name = index.name;
             webIndex.keyPath = index.keyPath;
             webIndex.unique = index.unique;
@@ -79,9 +81,9 @@ WebIDBMetadata::operator IDBDatabaseMetadata() const
         for (size_t j = 0; j < webObjectStore.indexes.size(); ++j) {
             const Index webIndex = webObjectStore.indexes[j];
             IDBIndexMetadata index(webIndex.name, webIndex.id, webIndex.keyPath, webIndex.unique, webIndex.multiEntry);
-            objectStore.indexes.set(index.name, index);
+            objectStore.indexes.set(index.id, index);
         }
-        db.objectStores.set(objectStore.name, objectStore);
+        db.objectStores.set(objectStore.id, objectStore);
     }
     return db;
 }
diff --git a/Source/WebKit/chromium/src/WebIDBObjectStoreImpl.cpp b/Source/WebKit/chromium/src/WebIDBObjectStoreImpl.cpp
index d814093f0..85bac13b3 100755
--- a/Source/WebKit/chromium/src/WebIDBObjectStoreImpl.cpp
+++ b/Source/WebKit/chromium/src/WebIDBObjectStoreImpl.cpp
@@ -75,6 +75,23 @@ void WebIDBObjectStoreImpl::putWithIndexKeys(const WebSerializedScriptValue& val
     m_objectStore->putWithIndexKeys(value, key, static_cast<IDBObjectStoreBackendInterface::PutMode>(putMode), IDBCallbacksProxy::create(adoptPtr(callbacks)), transaction.getIDBTransactionBackendInterface(), indexNames, indexKeys, ec);
 }
 
+void WebIDBObjectStoreImpl::put(const WebSerializedScriptValue& value, const WebIDBKey& key, PutMode putMode, WebIDBCallbacks* callbacks, const WebIDBTransaction& transaction, const WebVector<long long>& webIndexIds, const WebVector<WebIndexKeys>& webIndexKeys)
+{
+    ASSERT(webIndexIds.size() == webIndexKeys.size());
+    Vector<int64_t> indexIds(webIndexIds.size());
+    Vector<IDBObjectStoreBackendInterface::IndexKeys> indexKeys(webIndexKeys.size());
+
+    for (size_t i = 0; i < webIndexIds.size(); ++i) {
+        indexIds[i] = webIndexIds[i];
+        Vector<RefPtr<IDBKey> > indexKeyList(webIndexKeys[i].size());
+        for (size_t j = 0; j < webIndexKeys[i].size(); ++j)
+            indexKeyList[j] = webIndexKeys[i][j];
+        indexKeys[i] = indexKeyList;
+    }
+
+    m_objectStore->put(value, key, static_cast<IDBObjectStoreBackendInterface::PutMode>(putMode), IDBCallbacksProxy::create(adoptPtr(callbacks)), transaction.getIDBTransactionBackendInterface(), indexIds, indexKeys);
+}
+
 void WebIDBObjectStoreImpl::setIndexKeys(const WebIDBKey& primaryKey, const WebVector<WebString>& webIndexNames, const WebVector<WebIndexKeys>& webIndexKeys, const WebIDBTransaction& transaction)
 {
     ASSERT(webIndexNames.size() == webIndexKeys.size());
@@ -91,6 +108,22 @@ void WebIDBObjectStoreImpl::setIndexKeys(const WebIDBKey& primaryKey, const WebV
     m_objectStore->setIndexKeys(primaryKey, indexNames, indexKeys, transaction.getIDBTransactionBackendInterface());
 }
 
+void WebIDBObjectStoreImpl::setIndexKeys(const WebIDBKey& primaryKey, const WebVector<long long>& webIndexIds, const WebVector<WebIndexKeys>& webIndexKeys, const WebIDBTransaction& transaction)
+{
+    ASSERT(webIndexIds.size() == webIndexKeys.size());
+    Vector<int64_t> indexIds(webIndexIds.size());
+    Vector<IDBObjectStoreBackendInterface::IndexKeys> indexKeys(webIndexKeys.size());
+
+    for (size_t i = 0; i < webIndexIds.size(); ++i) {
+        indexIds[i] = webIndexIds[i];
+        Vector<RefPtr<IDBKey> > indexKeyList(webIndexKeys[i].size());
+        for (size_t j = 0; j < webIndexKeys[i].size(); ++j)
+            indexKeyList[j] = webIndexKeys[i][j];
+        indexKeys[i] = indexKeyList;
+    }
+    m_objectStore->setIndexKeys(primaryKey, indexIds, indexKeys, transaction.getIDBTransactionBackendInterface());
+}
+
 void WebIDBObjectStoreImpl::setIndexesReady(const WebVector<WebString>& webIndexNames, const WebIDBTransaction& transaction)
 {
     Vector<String> indexNames(webIndexNames.size());
@@ -99,6 +132,14 @@ void WebIDBObjectStoreImpl::setIndexesReady(const WebVector<WebString>& webIndex
     m_objectStore->setIndexesReady(indexNames, transaction.getIDBTransactionBackendInterface());
 }
 
+void WebIDBObjectStoreImpl::setIndexesReady(const WebVector<long long>& webIndexNames, const WebIDBTransaction& transaction)
+{
+    Vector<int64_t> indexIds(webIndexNames.size());
+    for (size_t i = 0; i < webIndexNames.size(); ++i)
+        indexIds[i] = webIndexNames[i];
+    m_objectStore->setIndexesReady(indexIds, transaction.getIDBTransactionBackendInterface());
+}
+
 void WebIDBObjectStoreImpl::deleteFunction(const WebIDBKeyRange& keyRange, WebIDBCallbacks* callbacks, const WebIDBTransaction& transaction, WebExceptionCode& ec)
 {
     m_objectStore->deleteFunction(keyRange, IDBCallbacksProxy::create(adoptPtr(callbacks)), transaction.getIDBTransactionBackendInterface(), ec);
@@ -125,11 +166,24 @@ WebIDBIndex* WebIDBObjectStoreImpl::index(const WebString& name, WebExceptionCod
     return new WebIDBIndexImpl(index);
 }
 
+WebIDBIndex* WebIDBObjectStoreImpl::index(long long objectStoreId)
+{
+    RefPtr<IDBIndexBackendInterface> index = m_objectStore->index(objectStoreId);
+    if (!index)
+        return 0;
+    return new WebIDBIndexImpl(index);
+}
+
 void WebIDBObjectStoreImpl::deleteIndex(const WebString& name, const WebIDBTransaction& transaction, WebExceptionCode& ec)
 {
     m_objectStore->deleteIndex(name, transaction.getIDBTransactionBackendInterface(), ec);
 }
 
+void WebIDBObjectStoreImpl::deleteIndex(long long objectStoreId, const WebIDBTransaction& transaction, WebExceptionCode& ec)
+{
+    m_objectStore->deleteIndex(objectStoreId, transaction.getIDBTransactionBackendInterface(), ec);
+}
+
 void WebIDBObjectStoreImpl::openCursor(const WebIDBKeyRange& keyRange, WebIDBCursor::Direction direction, WebIDBCallbacks* callbacks, WebIDBTransaction::TaskType taskType, const WebIDBTransaction& transaction, WebExceptionCode& ec)
 {
     m_objectStore->openCursor(keyRange, static_cast<IDBCursor::Direction>(direction), IDBCallbacksProxy::create(adoptPtr(callbacks)), static_cast<IDBTransactionBackendInterface::TaskType>(taskType), transaction.getIDBTransactionBackendInterface(), ec);
diff --git a/Source/WebKit/chromium/src/WebIDBObjectStoreImpl.h b/Source/WebKit/chromium/src/WebIDBObjectStoreImpl.h
index 7e9ed2573..5de3c9a15 100644
--- a/Source/WebKit/chromium/src/WebIDBObjectStoreImpl.h
+++ b/Source/WebKit/chromium/src/WebIDBObjectStoreImpl.h
@@ -47,14 +47,19 @@ public:
 
     void get(const WebIDBKeyRange&, WebIDBCallbacks*, const WebIDBTransaction&, WebExceptionCode&);
     void putWithIndexKeys(const WebSerializedScriptValue&, const WebIDBKey&, PutMode, WebIDBCallbacks*, const WebIDBTransaction&, const WebVector<WebString>&, const WebVector<WebIndexKeys>&, WebExceptionCode&);
+    void put(const WebSerializedScriptValue&, const WebIDBKey&, PutMode, WebIDBCallbacks*, const WebIDBTransaction&, const WebVector<long long>&, const WebVector<WebIndexKeys>&);
     void setIndexKeys(const WebIDBKey&, const WebVector<WebString>& indexNames, const WebVector<WebIndexKeys>&, const WebIDBTransaction&);
+    void setIndexKeys(const WebIDBKey&, const WebVector<long long>& indexNames, const WebVector<WebIndexKeys>&, const WebIDBTransaction&);
     void setIndexesReady(const WebVector<WebString>&, const WebIDBTransaction&);
+    void setIndexesReady(const WebVector<long long>&, const WebIDBTransaction&);
     void deleteFunction(const WebIDBKeyRange&, WebIDBCallbacks*, const WebIDBTransaction&, WebExceptionCode&);
     void clear(WebIDBCallbacks*, const WebIDBTransaction&, WebExceptionCode&);
 
     WebIDBIndex* createIndex(long long, const WebString& name, const WebIDBKeyPath&, bool unique, bool multiEntry, const WebIDBTransaction&, WebExceptionCode&);
     WebIDBIndex* index(const WebString& name, WebExceptionCode&);
+    WebIDBIndex* index(long long);
     void deleteIndex(const WebString& name, const WebIDBTransaction&, WebExceptionCode&);
+    void deleteIndex(long long, const WebIDBTransaction&, WebExceptionCode&);
 
     void openCursor(const WebIDBKeyRange&, WebIDBCursor::Direction, WebIDBCallbacks*, WebIDBTransaction::TaskType, const WebIDBTransaction&, WebExceptionCode&);
     void count(const WebIDBKeyRange&, WebIDBCallbacks*, const WebIDBTransaction&, WebExceptionCode&);
diff --git a/Source/WebKit/chromium/src/WebIDBTransactionImpl.cpp b/Source/WebKit/chromium/src/WebIDBTransactionImpl.cpp
index 5cbbee663..6616d671f 100644
--- a/Source/WebKit/chromium/src/WebIDBTransactionImpl.cpp
+++ b/Source/WebKit/chromium/src/WebIDBTransactionImpl.cpp
@@ -55,6 +55,14 @@ WebIDBObjectStore* WebIDBTransactionImpl::objectStore(const WebString& name, Exc
     return new WebIDBObjectStoreImpl(objectStore);
 }
 
+WebIDBObjectStore* WebIDBTransactionImpl::objectStore(long long indexId, ExceptionCode& ec)
+{
+    RefPtr<IDBObjectStoreBackendInterface> objectStore = m_backend->objectStore(indexId, ec);
+    if (!objectStore)
+        return 0;
+    return new WebIDBObjectStoreImpl(objectStore);
+}
+
 void WebIDBTransactionImpl::commit()
 {
     m_backend->commit();
diff --git a/Source/WebKit/chromium/src/WebIDBTransactionImpl.h b/Source/WebKit/chromium/src/WebIDBTransactionImpl.h
index 66e315300..1ee6ab801 100644
--- a/Source/WebKit/chromium/src/WebIDBTransactionImpl.h
+++ b/Source/WebKit/chromium/src/WebIDBTransactionImpl.h
@@ -39,9 +39,10 @@ namespace WebKit {
 class WebIDBTransactionImpl: public WebIDBTransaction {
 public:
     WebIDBTransactionImpl(WTF::PassRefPtr<WebCore::IDBTransactionBackendInterface>);
-    virtual ~WebIDBTransactionImpl();  
+    virtual ~WebIDBTransactionImpl();
 
     virtual WebIDBObjectStore* objectStore(const WebString& name, WebExceptionCode&);
+    virtual WebIDBObjectStore* objectStore(long long indexId, WebExceptionCode&);
     virtual void commit();
     virtual void abort();
     virtual void didCompleteTaskEvents();
diff --git a/Source/WebKit/chromium/src/WebInputEventConversion.cpp b/Source/WebKit/chromium/src/WebInputEventConversion.cpp
index 0f4f6d5a8..8ff2e210d 100644
--- a/Source/WebKit/chromium/src/WebInputEventConversion.cpp
+++ b/Source/WebKit/chromium/src/WebInputEventConversion.cpp
@@ -171,6 +171,7 @@ PlatformGestureEventBuilder::PlatformGestureEventBuilder(Widget* widget, const W
         break;
     case WebInputEvent::GestureTwoFingerTap:
         m_type = PlatformEvent::GestureTwoFingerTap;
+        m_area = IntSize(e.data.twoFingerTap.firstFingerWidth, e.data.twoFingerTap.firstFingerHeight);
         break;
     case WebInputEvent::GestureLongPress:
         m_type = PlatformEvent::GestureLongPress;
diff --git a/Source/WebKit/chromium/src/WebPagePopupImpl.cpp b/Source/WebKit/chromium/src/WebPagePopupImpl.cpp
index 078ae7e86..01cacda2a 100644
--- a/Source/WebKit/chromium/src/WebPagePopupImpl.cpp
+++ b/Source/WebKit/chromium/src/WebPagePopupImpl.cpp
@@ -44,6 +44,7 @@
 #include "Settings.h"
 #include "WebInputEventConversion.h"
 #include "WebPagePopup.h"
+#include "WebViewClient.h"
 #include "WebViewImpl.h"
 #include "WebWidgetClient.h"
 
@@ -54,7 +55,7 @@ namespace WebKit {
 
 #if ENABLE(PAGE_POPUP)
 
-class PagePopupChromeClient : public EmptyChromeClient {
+class PagePopupChromeClient : public EmptyChromeClient, public WebCore::PageClientChromium {
     WTF_MAKE_NONCOPYABLE(PagePopupChromeClient);
     WTF_MAKE_FAST_ALLOCATED;
 
@@ -124,6 +125,17 @@ private:
         return FloatSize(0, 0);
     }
 
+    virtual PlatformPageClient platformPageClient() const OVERRIDE
+    {
+        return PlatformPageClient(this);
+    }
+
+    // PageClientChromium methods:
+    virtual WebKit::WebScreenInfo screenInfo() OVERRIDE
+    {
+        return m_popup->m_webView->client()->screenInfo();
+    }
+
     WebPagePopupImpl* m_popup;
 };
 
diff --git a/Source/WebKit/chromium/src/WebRuntimeFeatures.cpp b/Source/WebKit/chromium/src/WebRuntimeFeatures.cpp
index 4e64c664b..9009ff9fa 100644
--- a/Source/WebKit/chromium/src/WebRuntimeFeatures.cpp
+++ b/Source/WebKit/chromium/src/WebRuntimeFeatures.cpp
@@ -657,4 +657,22 @@ bool WebRuntimeFeatures::isCSSExclusionsEnabled()
     return RuntimeEnabledFeatures::cssExclusionsEnabled();
 }
 
+void WebRuntimeFeatures::enableRequestAutocomplete(bool enable)
+{
+#if ENABLE(REQUEST_AUTOCOMPLETE)
+    RuntimeEnabledFeatures::setRequestAutocompleteEnabled(enable);
+#else
+    UNUSED_PARAM(enable);
+#endif
+}
+
+bool WebRuntimeFeatures::isRequestAutocompleteEnabled()
+{
+#if ENABLE(REQUEST_AUTOCOMPLETE)
+    return RuntimeEnabledFeatures::requestAutocompleteEnabled();
+#else
+    return false;
+#endif
+}
+
 } // namespace WebKit
diff --git a/Source/WebKit/chromium/src/WebSettingsImpl.cpp b/Source/WebKit/chromium/src/WebSettingsImpl.cpp
index a667bedf5..b14cde32f 100644
--- a/Source/WebKit/chromium/src/WebSettingsImpl.cpp
+++ b/Source/WebKit/chromium/src/WebSettingsImpl.cpp
@@ -192,6 +192,11 @@ void WebSettingsImpl::setJavaScriptCanOpenWindowsAutomatically(bool canOpenWindo
     m_settings->setJavaScriptCanOpenWindowsAutomatically(canOpenWindows);
 }
 
+void WebSettingsImpl::setSupportsMultipleWindows(bool supportsMultipleWindows)
+{
+    m_settings->setSupportsMultipleWindows(supportsMultipleWindows);
+}
+
 void WebSettingsImpl::setLoadsImagesAutomatically(bool loadsImagesAutomatically)
 {
     m_settings->setLoadsImagesAutomatically(loadsImagesAutomatically);
@@ -636,6 +641,11 @@ void WebSettingsImpl::setShouldDisplayTextDescriptions(bool enabled)
 #endif
 }
 
+void WebSettingsImpl::setShouldRespectImageOrientation(bool enabled)
+{
+    m_settings->setShouldRespectImageOrientation(enabled);
+}
+
 void WebSettingsImpl::setAcceleratedPaintingEnabled(bool enabled)
 {
     m_settings->setAcceleratedDrawingEnabled(enabled);
diff --git a/Source/WebKit/chromium/src/WebSettingsImpl.h b/Source/WebKit/chromium/src/WebSettingsImpl.h
index 74968c4f6..ff88bac61 100644
--- a/Source/WebKit/chromium/src/WebSettingsImpl.h
+++ b/Source/WebKit/chromium/src/WebSettingsImpl.h
@@ -136,12 +136,14 @@ public:
     virtual void setShouldDisplaySubtitles(bool);
     virtual void setShouldDisplayTextDescriptions(bool);
     virtual void setShouldPrintBackgrounds(bool);
+    virtual void setShouldRespectImageOrientation(bool);
     virtual void setShowDebugBorders(bool);
     virtual void setShowFPSCounter(bool);
     virtual void setShowPaintRects(bool);
     virtual void setShowPlatformLayerTree(bool);
     virtual void setShrinksStandaloneImagesToFit(bool);
     virtual void setStandardFontFamily(const WebString&, UScriptCode = USCRIPT_COMMON);
+    virtual void setSupportsMultipleWindows(bool);
     virtual void setSyncXHRInDocumentsEnabled(bool);
     virtual void setTextAreasAreResizable(bool);
     virtual void setTextAutosizingEnabled(bool);
diff --git a/Source/WebKit/chromium/src/WebViewImpl.cpp b/Source/WebKit/chromium/src/WebViewImpl.cpp
index 5277b7b34..3f83e4cbc 100644
--- a/Source/WebKit/chromium/src/WebViewImpl.cpp
+++ b/Source/WebKit/chromium/src/WebViewImpl.cpp
@@ -419,6 +419,7 @@ WebViewImpl::WebViewImpl(WebViewClient* client)
     , m_rootLayer(0)
     , m_rootGraphicsLayer(0)
     , m_isAcceleratedCompositingActive(false)
+    , m_layerTreeViewCommitsDeferred(false)
     , m_compositorCreationFailed(false)
     , m_recreatingGraphicsContext(false)
     , m_compositorSurfaceReady(false)
@@ -672,7 +673,7 @@ bool WebViewImpl::handleGestureEvent(const WebGestureEvent& event)
         // Queue a highlight animation, then hand off to regular handler.
 #if OS(LINUX)
         if (settingsImpl()->gestureTapHighlightEnabled())
-            enableTouchHighlight(IntPoint(event.x, event.y));
+            enableTouchHighlight(event);
 #endif
         break;
     case WebInputEvent::GestureTapCancel:
@@ -744,18 +745,7 @@ bool WebViewImpl::handleGestureEvent(const WebGestureEvent& event)
 
         break;
     }
-    case WebInputEvent::GestureTwoFingerTap: {
-        if (!mainFrameImpl() || !mainFrameImpl()->frameView())
-            break;
-
-        m_page->contextMenuController()->clearContextMenu();
-        m_contextMenuAllowed = true;
-        PlatformGestureEventBuilder platformEvent(mainFrameImpl()->frameView(), event);
-        eventSwallowed = mainFrameImpl()->frame()->eventHandler()->sendContextMenuEventForGesture(platformEvent);
-        m_contextMenuAllowed = false;
-
-        break;
-    }
+    case WebInputEvent::GestureTwoFingerTap:
     case WebInputEvent::GestureLongPress: {
         if (!mainFrameImpl() || !mainFrameImpl()->frameView())
             break;
@@ -1179,15 +1169,17 @@ void WebViewImpl::computeScaleAndScrollForHitRect(const WebRect& hitRect, AutoZo
         scroll = clampOffsetAtScale(scroll, scale);
 }
 
-static bool highlightConditions(Node* node)
+static bool invokesHandCursor(Node* node, bool shiftKey, Frame* frame)
 {
-    return node->supportsFocus()
-           || node->hasEventListeners(eventNames().clickEvent)
-           || node->hasEventListeners(eventNames().mousedownEvent)
-           || node->hasEventListeners(eventNames().mouseupEvent);
+    if (!node || !node->renderer())
+        return false;
+
+    ECursor cursor = node->renderer()->style()->cursor();
+    return cursor == CURSOR_POINTER
+        || (cursor == CURSOR_AUTO && frame->eventHandler()->useHandCursor(node, node->isLink(), shiftKey));
 }
 
-Node* WebViewImpl::bestTouchLinkNode(IntPoint touchEventLocation)
+Node* WebViewImpl::bestTouchLinkNode(const WebGestureEvent& touchEvent)
 {
     if (!m_page || !m_page->mainFrame())
         return 0;
@@ -1196,27 +1188,23 @@ Node* WebViewImpl::bestTouchLinkNode(IntPoint touchEventLocation)
 
     // FIXME: Should accept a search region from the caller instead of hard-coding the size.
     IntSize touchEventSearchRegionSize(4, 2);
+    IntPoint touchEventLocation(touchEvent.x, touchEvent.y);
     m_page->mainFrame()->eventHandler()->bestClickableNodeForTouchPoint(touchEventLocation, touchEventSearchRegionSize, touchEventLocation, bestTouchNode);
     // bestClickableNodeForTouchPoint() doesn't always return a node that is a link, so let's try and find
     // a link to highlight.
-    while (bestTouchNode && !highlightConditions(bestTouchNode))
+    bool shiftKey = touchEvent.modifiers & WebGestureEvent::ShiftKey;
+    while (bestTouchNode && !invokesHandCursor(bestTouchNode, shiftKey, m_page->mainFrame()))
         bestTouchNode = bestTouchNode->parentNode();
 
-    // If the document/body have click handlers installed, we don't want to default to applying the highlight to the entire RenderView, or the
-    // entire body.
-    RenderObject* touchNodeRenderer = bestTouchNode ? bestTouchNode->renderer() : 0;
-    if (bestTouchNode && (!touchNodeRenderer || touchNodeRenderer->isRenderView() || touchNodeRenderer->isBody()))
-        return 0;
-
     return bestTouchNode;
 }
 
-void WebViewImpl::enableTouchHighlight(IntPoint touchEventLocation)
+void WebViewImpl::enableTouchHighlight(const WebGestureEvent& touchEvent)
 {
     // Always clear any existing highlight when this is invoked, even if we don't get a new target to highlight.
     m_linkHighlight.clear();
 
-    Node* touchNode = bestTouchLinkNode(touchEventLocation);
+    Node* touchNode = bestTouchLinkNode(touchEvent);
 
     if (!touchNode || !touchNode->renderer() || !touchNode->renderer()->enclosingLayer())
         return;
@@ -1448,9 +1436,6 @@ PagePopup* WebViewImpl::openPagePopup(PagePopupClient* client, const IntRect& or
         m_pagePopup->closePopup();
         m_pagePopup = 0;
     }
-
-    if (Frame* frame = focusedWebCoreFrame())
-        frame->selection()->setCaretVisible(false);
     return m_pagePopup.get();
 }
 
@@ -1463,9 +1448,6 @@ void WebViewImpl::closePagePopup(PagePopup* popup)
         return;
     m_pagePopup->closePopup();
     m_pagePopup = 0;
-
-    if (Frame* frame = focusedWebCoreFrame())
-        frame->selection()->pageActivationChanged();
 }
 #endif
 
@@ -1771,6 +1753,20 @@ void WebViewImpl::layout()
         m_linkHighlight->updateGeometry();
 }
 
+void WebViewImpl::enterForceCompositingMode(bool enter)
+{
+    TRACE_EVENT1("webkit", "WebViewImpl::enterForceCompositingMode", "enter", enter);
+    settingsImpl()->setForceCompositingMode(enter);
+    if (enter) {
+        if (!m_page)
+            return;
+        Frame* mainFrame = m_page->mainFrame();
+        if (!mainFrame)
+            return;
+        mainFrame->view()->updateCompositingLayersAfterStyleChange();
+    }
+}
+
 #if USE(ACCELERATED_COMPOSITING)
 void WebViewImpl::doPixelReadbackToCanvas(WebCanvas* canvas, const IntRect& rect)
 {
@@ -1780,6 +1776,14 @@ void WebViewImpl::doPixelReadbackToCanvas(WebCanvas* canvas, const IntRect& rect
     target.setConfig(SkBitmap::kARGB_8888_Config, rect.width(), rect.height(), rect.width() * 4);
     target.allocPixels();
     m_layerTreeView->compositeAndReadback(target.getPixels(), rect);
+#if (!SK_R32_SHIFT && SK_B32_SHIFT == 16)
+    // The compositor readback always gives back pixels in BGRA order, but for
+    // example Android's Skia uses RGBA ordering so the red and blue channels
+    // need to be swapped.
+    uint8_t* pixels = reinterpret_cast<uint8_t*>(target.getPixels());
+    for (size_t i = 0; i < target.getSize(); i += 4)
+        std::swap(pixels[i], pixels[i + 2]);
+#endif
     canvas->writePixels(target, rect.x(), rect.y());
 }
 #endif
@@ -1825,6 +1829,14 @@ void WebViewImpl::paint(WebCanvas* canvas, const WebRect& rect, PaintOptions opt
     }
 }
 
+bool WebViewImpl::isTrackingRepaints() const
+{
+    if (!page())
+        return false;
+    FrameView* view = page()->mainFrame()->view();
+    return view->isTrackingRepaints();
+}
+
 void WebViewImpl::themeChanged()
 {
     if (!page())
@@ -1988,7 +2000,29 @@ bool WebViewImpl::handleInputEvent(const WebInputEvent& inputEvent)
         return true;
     }
 
-    bool handled = PageWidgetDelegate::handleInputEvent(m_page.get(), *this, inputEvent);
+    if (!m_layerTreeView)
+        return PageWidgetDelegate::handleInputEvent(m_page.get(), *this, inputEvent);
+
+    const WebInputEvent* inputEventTransformed = &inputEvent;
+    WebMouseEvent mouseEvent;
+    WebGestureEvent gestureEvent;
+    if (WebInputEvent::isMouseEventType(inputEvent.type)) {
+        mouseEvent = *static_cast<const WebMouseEvent*>(&inputEvent);
+
+        IntPoint transformedLocation = roundedIntPoint(m_layerTreeView->adjustEventPointForPinchZoom(WebFloatPoint(mouseEvent.x, mouseEvent.y)));
+        mouseEvent.x = transformedLocation.x();
+        mouseEvent.y = transformedLocation.y();
+        inputEventTransformed = static_cast<const WebInputEvent*>(&mouseEvent);
+    } else if (WebInputEvent::isGestureEventType(inputEvent.type)) {
+        gestureEvent = *static_cast<const WebGestureEvent*>(&inputEvent);
+
+        IntPoint transformedLocation = roundedIntPoint(m_layerTreeView->adjustEventPointForPinchZoom(WebFloatPoint(gestureEvent.x, gestureEvent.y)));
+        gestureEvent.x = transformedLocation.x();
+        gestureEvent.y = transformedLocation.y();
+        inputEventTransformed = static_cast<const WebInputEvent*>(&gestureEvent);
+    }
+
+    bool handled = PageWidgetDelegate::handleInputEvent(m_page.get(), *this, *inputEventTransformed);
     return handled;
 }
 
@@ -3117,6 +3151,11 @@ void WebViewImpl::performPluginAction(const WebPluginAction& action,
     }
 }
 
+WebHitTestResult WebViewImpl::hitTestResultAt(const WebPoint& point)
+{
+    return hitTestResultForWindowPos(point);
+}
+
 void WebViewImpl::copyImageAt(const WebPoint& point)
 {
     if (!m_page)
@@ -3819,17 +3858,26 @@ void WebViewImpl::scrollRootLayerRect(const IntSize&, const IntRect&)
     updateLayerTreeViewport();
 }
 
-void WebViewImpl::invalidateRootLayerRect(const IntRect& rect)
+void WebViewImpl::invalidateRect(const IntRect& rect)
 {
-    ASSERT(m_layerTreeView);
+    if (m_layerTreeViewCommitsDeferred) {
+        // If we receive an invalidation from WebKit while in deferred commit mode,
+        // that means it's time to start producing frames again so un-defer.
+        m_layerTreeView->setDeferCommits(false);
+        m_layerTreeViewCommitsDeferred = false;
+    }
+    if (m_isAcceleratedCompositingActive) {
+        ASSERT(m_layerTreeView);
 
-    if (!page())
-        return;
+        if (!page())
+            return;
 
-    FrameView* view = page()->mainFrame()->view();
-    IntRect dirtyRect = view->windowToContents(rect);
-    updateLayerTreeViewport();
-    m_nonCompositedContentHost->invalidateRect(dirtyRect);
+        FrameView* view = page()->mainFrame()->view();
+        IntRect dirtyRect = view->windowToContents(rect);
+        updateLayerTreeViewport();
+        m_nonCompositedContentHost->invalidateRect(dirtyRect);
+    } else if (m_client)
+        m_client->didInvalidateRect(rect);
 }
 
 NonCompositedContentHost* WebViewImpl::nonCompositedContentHost()
@@ -3896,6 +3944,15 @@ void WebViewImpl::setIsAcceleratedCompositingActive(bool active)
         if (m_layerTreeView && !page()->settings()->forceCompositingMode())
             m_layerTreeView->finishAllRendering();
         m_client->didDeactivateCompositor();
+        if (!m_layerTreeViewCommitsDeferred
+            && WebKit::Platform::current()->compositorSupport()->isThreadingEnabled()) {
+            ASSERT(m_layerTreeView);
+            // In threaded compositing mode, force compositing mode is always on so setIsAcceleratedCompositingActive(false)
+            // means that we're transitioning to a new page. Suppress commits until WebKit generates invalidations so
+            // we don't attempt to paint too early in the next page load.
+            m_layerTreeView->setDeferCommits(true);
+            m_layerTreeViewCommitsDeferred = true;
+        }
     } else if (m_layerTreeView) {
         m_isAcceleratedCompositingActive = true;
         updateLayerTreeViewport();
@@ -3946,7 +4003,7 @@ void WebViewImpl::setIsAcceleratedCompositingActive(bool active)
                 WebRect asciiToRectTable[128];
                 int fontHeight;
                 SkBitmap bitmap = WebCore::CompositorHUDFontAtlas::generateFontAtlas(asciiToRectTable, fontHeight);
-                m_layerTreeView->setFontAtlas(bitmap, asciiToRectTable, fontHeight);
+                m_layerTreeView->setFontAtlas(asciiToRectTable, bitmap, fontHeight);
             }
         } else {
             m_nonCompositedContentHost.clear();
@@ -4105,7 +4162,7 @@ void WebViewImpl::didRecreateOutputSurface(bool success)
 void WebViewImpl::scheduleComposite()
 {
     if  (m_suppressInvalidations) {
-        TRACE_EVENT0("webkit", "WebViewImpl invalidations suppressed");
+        TRACE_EVENT_INSTANT0("webkit", "WebViewImpl invalidations suppressed");
         return;
     }
 
diff --git a/Source/WebKit/chromium/src/WebViewImpl.h b/Source/WebKit/chromium/src/WebViewImpl.h
index 439e0e6b1..02a1e5370 100644
--- a/Source/WebKit/chromium/src/WebViewImpl.h
+++ b/Source/WebKit/chromium/src/WebViewImpl.h
@@ -145,7 +145,9 @@ public:
     virtual void setCompositorSurfaceReady();
     virtual void animate(double);
     virtual void layout(); // Also implements WebLayerTreeViewClient::layout()
+    virtual void enterForceCompositingMode(bool enable) OVERRIDE;
     virtual void paint(WebCanvas*, const WebRect&, PaintOptions = ReadbackFromCompositorIfAvailable);
+    virtual bool isTrackingRepaints() const OVERRIDE;
     virtual void themeChanged();
     virtual void composite(bool finish);
     virtual void setNeedsRedraw();
@@ -247,6 +249,7 @@ public:
     virtual void performPluginAction(
         const WebPluginAction&,
         const WebPoint&);
+    virtual WebHitTestResult hitTestResultAt(const WebPoint&);
     virtual void copyImageAt(const WebPoint& point);
     virtual void dragSourceEndedAt(
         const WebPoint& clientPoint,
@@ -326,6 +329,7 @@ public:
     // WebViewImpl
 
     void suppressInvalidations(bool enable);
+    void invalidateRect(const WebCore::IntRect&);
 
     void setIgnoreInputEvents(bool newValue);
     WebDevToolsAgentPrivate* devToolsAgentPrivate() { return m_devToolsAgent.get(); }
@@ -531,7 +535,6 @@ public:
     void setRootGraphicsLayer(WebCore::GraphicsLayer*);
     void scheduleCompositingLayerSync();
     void scrollRootLayerRect(const WebCore::IntSize& scrollDelta, const WebCore::IntRect& clipRect);
-    void invalidateRootLayerRect(const WebCore::IntRect&);
     void paintRootLayer(WebCore::GraphicsContext&, const WebCore::IntRect& contentRect);
     NonCompositedContentHost* nonCompositedContentHost();
     void setBackgroundColor(const WebCore::Color&);
@@ -564,8 +567,8 @@ public:
 
 #if ENABLE(GESTURE_EVENTS)
     void computeScaleAndScrollForHitRect(const WebRect& hitRect, AutoZoomType, float& scale, WebPoint& scroll, bool& isAnchor);
-    WebCore::Node* bestTouchLinkNode(WebCore::IntPoint touchEventLocation);
-    void enableTouchHighlight(WebCore::IntPoint touchEventLocation);
+    WebCore::Node* bestTouchLinkNode(const WebGestureEvent& touchEvent);
+    void enableTouchHighlight(const WebGestureEvent& touchEvent);
 #endif
     void animateZoomAroundPoint(const WebCore::IntPoint&, AutoZoomType);
 
@@ -836,6 +839,7 @@ private:
     WebLayer* m_rootLayer;
     WebCore::GraphicsLayer* m_rootGraphicsLayer;
     bool m_isAcceleratedCompositingActive;
+    bool m_layerTreeViewCommitsDeferred;
     bool m_compositorCreationFailed;
     // If true, the graphics context is being restored.
     bool m_recreatingGraphicsContext;
diff --git a/Source/WebKit/chromium/src/js/devTools.css b/Source/WebKit/chromium/src/js/devTools.css
index c7aa9420d..d549de03e 100644
--- a/Source/WebKit/chromium/src/js/devTools.css
+++ b/Source/WebKit/chromium/src/js/devTools.css
@@ -11,6 +11,22 @@ body.compact #toolbar {
 
 /* Chrome theme overrides */
 
+body.compact.platform-mac #toolbar {
+  /* Match Chrome's toolbar. */
+  background-image: -webkit-gradient(linear, left top, left bottom, from(rgb(230, 229, 229)), to(rgb(206, 207, 207))) !important;
+  border-top-color: white;
+  border-bottom-color: rgb(122, 122, 122);
+}
+
+body.compact.platform-mac.inactive #toolbar {
+  background-image: -webkit-gradient(linear, left top, left bottom, from(rgb(235, 235, 235)), to(rgb(216, 216, 216))) !important;
+  border-bottom-color: rgb(142, 142, 142);
+}
+
+body.platform-mac.inactive #toolbar .toolbar-label {
+  opacity: 0.8;
+}
+
 body.platform-windows #toolbar, body.platform-windows.inactive #toolbar {
     background-image: none;
 }
diff --git a/Source/WebKit/chromium/src/mac/WebInputEventFactory.mm b/Source/WebKit/chromium/src/mac/WebInputEventFactory.mm
index 4854ae218..0f93ce661 100644
--- a/Source/WebKit/chromium/src/mac/WebInputEventFactory.mm
+++ b/Source/WebKit/chromium/src/mac/WebInputEventFactory.mm
@@ -169,7 +169,7 @@ static int windowsKeyCodeForKeyEvent(NSEvent* event)
     // 2. Keys for which there is no known Mac virtual key codes, like PrintScreen.
     // 3. Certain punctuation keys. On Windows, these are also remapped depending on current keyboard layout,
     //    but see comment in windowsKeyCodeForCharCode().
-    if ([event type] == NSKeyDown || [event type] == NSKeyUp) {
+    if (!isKeypadEvent(event) && ([event type] == NSKeyDown || [event type] == NSKeyUp)) {
         // Cmd switches Roman letters for Dvorak-QWERTY layout, so try modified characters first.
         NSString* s = [event characters];
         code = [s length] > 0 ? WebCore::windowsKeyCodeForCharCode([s characterAtIndex:0]) : 0;
diff --git a/Source/WebKit/chromium/tests/GraphicsLayerChromiumTest.cpp b/Source/WebKit/chromium/tests/GraphicsLayerChromiumTest.cpp
index 0ce84257b..b04b3a945 100644
--- a/Source/WebKit/chromium/tests/GraphicsLayerChromiumTest.cpp
+++ b/Source/WebKit/chromium/tests/GraphicsLayerChromiumTest.cpp
@@ -52,8 +52,6 @@ class MockGraphicsLayerClient : public GraphicsLayerClient {
     virtual void notifyAnimationStarted(const GraphicsLayer*, double time) OVERRIDE { }
     virtual void notifyFlushRequired(const GraphicsLayer*) OVERRIDE { }
     virtual void paintContents(const GraphicsLayer*, GraphicsContext&, GraphicsLayerPaintingPhase, const IntRect& inClip) OVERRIDE { }
-    virtual bool showDebugBorders(const GraphicsLayer*) const OVERRIDE { return false; }
-    virtual bool showRepaintCounter(const GraphicsLayer*) const OVERRIDE { return false; }
     virtual float deviceScaleFactor() const OVERRIDE { return 2; }
 };
 
diff --git a/Source/WebKit/chromium/tests/IDBBindingUtilitiesTest.cpp b/Source/WebKit/chromium/tests/IDBBindingUtilitiesTest.cpp
index 46710e745..a2a4f442d 100644
--- a/Source/WebKit/chromium/tests/IDBBindingUtilitiesTest.cpp
+++ b/Source/WebKit/chromium/tests/IDBBindingUtilitiesTest.cpp
@@ -24,11 +24,19 @@
  */
 
 #include "config.h"
+#include "Document.h"
+#include "Frame.h"
+#include "FrameTestHelpers.h"
 #include "IDBBindingUtilities.h"
 #include "IDBKey.h"
 #include "IDBKeyPath.h"
+#include "V8Binding.h"
 #include "V8PerIsolateData.h"
 #include "V8Utilities.h"
+#include "WebFrame.h"
+#include "WebFrameImpl.h"
+#include "WebView.h"
+#include "WorldContextHandle.h"
 
 #include <gtest/gtest.h>
 #include <wtf/Vector.h>
@@ -36,6 +44,7 @@
 #if ENABLE(INDEXED_DATABASE)
 
 using namespace WebCore;
+using namespace WebKit;
 
 namespace {
 
@@ -90,10 +99,21 @@ void checkKeyPathNumberValue(const ScriptValue& value, const String& keyPath, in
     ASSERT_TRUE(expected == idbKey->number());
 }
 
+static v8::Handle<v8::Context> context()
+{
+    static WebView* webView;
+    if (!webView) {
+        webView = FrameTestHelpers::createWebViewAndLoad("about:blank");
+        webView->setFocus(true);
+    }
+    ScriptExecutionContext* context = static_cast<WebFrameImpl*>(webView->mainFrame())->frame()->document();
+    return toV8Context(context, WorldContextHandle(UseCurrentWorld));
+}
+
 TEST(IDBKeyFromValueAndKeyPathTest, TopLevelPropertyStringValue)
 {
     v8::HandleScope handleScope;
-    v8::Context::Scope scope(V8PerIsolateData::current()->ensureAuxiliaryContext());
+    v8::Context::Scope scope(context());
 
     v8::Local<v8::Object> object = v8::Object::New();
     object->Set(v8::String::New("foo"), v8::String::New("zoo"));
@@ -107,7 +127,7 @@ TEST(IDBKeyFromValueAndKeyPathTest, TopLevelPropertyStringValue)
 TEST(IDBKeyFromValueAndKeyPathTest, TopLevelPropertyNumberValue)
 {
     v8::HandleScope handleScope;
-    v8::Context::Scope scope(V8PerIsolateData::current()->ensureAuxiliaryContext());
+    v8::Context::Scope scope(context());
 
     v8::Local<v8::Object> object = v8::Object::New();
     object->Set(v8::String::New("foo"), v8::Number::New(456));
@@ -121,7 +141,7 @@ TEST(IDBKeyFromValueAndKeyPathTest, TopLevelPropertyNumberValue)
 TEST(IDBKeyFromValueAndKeyPathTest, SubProperty)
 {
     v8::HandleScope handleScope;
-    v8::Context::Scope scope(V8PerIsolateData::current()->ensureAuxiliaryContext());
+    v8::Context::Scope scope(context());
 
     v8::Local<v8::Object> object = v8::Object::New();
     v8::Local<v8::Object> subProperty = v8::Object::New();
@@ -137,7 +157,7 @@ TEST(IDBKeyFromValueAndKeyPathTest, SubProperty)
 TEST(InjectIDBKeyTest, TopLevelPropertyStringValue)
 {
     v8::HandleScope handleScope;
-    v8::Context::Scope scope(V8PerIsolateData::current()->ensureAuxiliaryContext());
+    v8::Context::Scope scope(context());
 
     v8::Local<v8::Object> object = v8::Object::New();
     object->Set(v8::String::New("foo"), v8::String::New("zoo"));
@@ -152,7 +172,7 @@ TEST(InjectIDBKeyTest, TopLevelPropertyStringValue)
 TEST(InjectIDBKeyTest, SubProperty)
 {
     v8::HandleScope handleScope;
-    v8::Context::Scope scope(V8PerIsolateData::current()->ensureAuxiliaryContext());
+    v8::Context::Scope scope(context());
 
     v8::Local<v8::Object> object = v8::Object::New();
     v8::Local<v8::Object> subProperty = v8::Object::New();
diff --git a/Source/WebKit/chromium/tests/IDBDatabaseBackendTest.cpp b/Source/WebKit/chromium/tests/IDBDatabaseBackendTest.cpp
index cee089c85..e97bc7f6d 100644
--- a/Source/WebKit/chromium/tests/IDBDatabaseBackendTest.cpp
+++ b/Source/WebKit/chromium/tests/IDBDatabaseBackendTest.cpp
@@ -57,12 +57,12 @@ TEST(IDBDatabaseBackendTest, BackingStoreRetention)
     EXPECT_GT(backingStore->refCount(), 1);
 
     const bool autoIncrement = false;
-    RefPtr<IDBObjectStoreBackendImpl> store = IDBObjectStoreBackendImpl::create(db.get(), 1, "store", IDBKeyPath("keyPath"), autoIncrement, 0);
+    RefPtr<IDBObjectStoreBackendImpl> store = IDBObjectStoreBackendImpl::create(db.get(), IDBObjectStoreMetadata("store", 1, IDBKeyPath("keyPath"), autoIncrement, 0));
     EXPECT_GT(backingStore->refCount(), 1);
 
     const bool unique = false;
     const bool multiEntry = false;
-    RefPtr<IDBIndexBackendImpl> index = IDBIndexBackendImpl::create(db.get(), store.get(), -1, "index", IDBKeyPath("keyPath"), unique, multiEntry);
+    RefPtr<IDBIndexBackendImpl> index = IDBIndexBackendImpl::create(db.get(), store.get(), IDBIndexMetadata("index", -1, IDBKeyPath("keyPath"), unique, multiEntry));
     EXPECT_GT(backingStore->refCount(), 1);
 
     db.clear();
@@ -152,8 +152,10 @@ public:
     virtual IDBDatabaseMetadata metadata() const { return IDBDatabaseMetadata(); }
     virtual PassRefPtr<IDBObjectStoreBackendInterface> createObjectStore(int64_t, const String& name, const IDBKeyPath&, bool autoIncrement, IDBTransactionBackendInterface*, ExceptionCode&) { return 0; }
     virtual void deleteObjectStore(const String& name, IDBTransactionBackendInterface*, ExceptionCode&) { }
+    virtual void deleteObjectStore(int64_t, IDBTransactionBackendInterface*, ExceptionCode&) { }
     virtual void setVersion(const String& version, PassRefPtr<IDBCallbacks>, PassRefPtr<IDBDatabaseCallbacks>, ExceptionCode&) { }
     virtual PassRefPtr<IDBTransactionBackendInterface> transaction(DOMStringList* storeNames, unsigned short mode, ExceptionCode&) { return 0; }
+    virtual PassRefPtr<IDBTransactionBackendInterface> transaction(const Vector<int64_t>&, unsigned short mode) { return 0; }
 
     virtual void close(PassRefPtr<IDBDatabaseCallbacks>)
     {
diff --git a/Source/WebKit/chromium/tests/IDBFakeBackingStore.h b/Source/WebKit/chromium/tests/IDBFakeBackingStore.h
index 45cdd1cb2..1f1640841 100644
--- a/Source/WebKit/chromium/tests/IDBFakeBackingStore.h
+++ b/Source/WebKit/chromium/tests/IDBFakeBackingStore.h
@@ -32,14 +32,14 @@ namespace WebCore {
 
 class IDBFakeBackingStore : public IDBBackingStore {
 public:
-    virtual void getDatabaseNames(Vector<String>& foundNames) OVERRIDE { }
+    virtual Vector<String> getDatabaseNames() OVERRIDE { return Vector<String>(); }
     virtual bool getIDBDatabaseMetaData(const String& name, IDBDatabaseMetadata*) OVERRIDE { return false; }
     virtual bool createIDBDatabaseMetaData(const String& name, const String& version, int64_t intVersion, int64_t& rowId) OVERRIDE { return true; }
     virtual bool updateIDBDatabaseMetaData(Transaction*, int64_t rowId, const String& version) OVERRIDE { return false; }
     virtual bool updateIDBDatabaseIntVersion(Transaction*, int64_t rowId, int64_t version) OVERRIDE { return false; }
     virtual bool deleteDatabase(const String& name) OVERRIDE { return false; }
 
-    virtual void getObjectStores(int64_t databaseId, Vector<int64_t>& foundIds, Vector<String>& foundNames, Vector<IDBKeyPath>& foundKeyPaths, Vector<bool>& foundAutoIncrementFlags, Vector<int64_t>& foundMaxIndexIds) OVERRIDE { }
+    virtual Vector<IDBObjectStoreMetadata> getObjectStores(int64_t databaseId) OVERRIDE { return Vector<IDBObjectStoreMetadata>(); }
     virtual bool createObjectStore(Transaction*, int64_t databaseId, int64_t objectStoreId, const String& name, const IDBKeyPath&, bool autoIncrement) OVERRIDE { return false; };
     virtual void deleteObjectStore(Transaction*, int64_t databaseId, int64_t objectStoreId) OVERRIDE { }
 
@@ -55,7 +55,7 @@ public:
 
     virtual bool forEachObjectStoreRecord(Transaction*, int64_t databaseId, int64_t objectStoreId, ObjectStoreRecordCallback&) OVERRIDE { return false; }
 
-    virtual void getIndexes(int64_t databaseId, int64_t objectStoreId, Vector<int64_t>& foundIds, Vector<String>& foundNames, Vector<IDBKeyPath>& foundKeyPaths, Vector<bool>& foundUniqueFlags, Vector<bool>& foundMultiEntryFlags) OVERRIDE { }
+    virtual Vector<IDBIndexMetadata> getIndexes(int64_t databaseId, int64_t objectStoreId) OVERRIDE { return Vector<IDBIndexMetadata>(); }
     virtual bool createIndex(Transaction*, int64_t databaseId, int64_t objectStoreId, int64_t indexId, const String& name, const IDBKeyPath&, bool isUnique, bool isMultiEntry) OVERRIDE { return false; };
     virtual void deleteIndex(Transaction*, int64_t databaseId, int64_t objectStoreId, int64_t indexId) OVERRIDE { }
     virtual bool putIndexDataForRecord(Transaction*, int64_t databaseId, int64_t objectStoreId, int64_t indexId, const IDBKey&, const ObjectStoreRecordIdentifier*) OVERRIDE { return false; }
diff --git a/Source/WebKit/chromium/tests/ImageLayerChromiumTest.cpp b/Source/WebKit/chromium/tests/ImageLayerChromiumTest.cpp
index bfb03ed30..74c2f1669 100644
--- a/Source/WebKit/chromium/tests/ImageLayerChromiumTest.cpp
+++ b/Source/WebKit/chromium/tests/ImageLayerChromiumTest.cpp
@@ -40,8 +40,6 @@ class MockGraphicsLayerClient : public GraphicsLayerClient {
     virtual void notifyAnimationStarted(const GraphicsLayer*, double time) { }
     virtual void notifyFlushRequired(const GraphicsLayer*) { }
     virtual void paintContents(const GraphicsLayer*, GraphicsContext&, GraphicsLayerPaintingPhase, const IntRect& inClip) { }
-    virtual bool showDebugBorders(const GraphicsLayer*) const { return false; }
-    virtual bool showRepaintCounter(const GraphicsLayer*) const { return false; }
 };
 
 class TestImage : public Image {
diff --git a/Source/WebKit/chromium/tests/LinkHighlightTest.cpp b/Source/WebKit/chromium/tests/LinkHighlightTest.cpp
index eafe2307f..2fdb384ef 100644
--- a/Source/WebKit/chromium/tests/LinkHighlightTest.cpp
+++ b/Source/WebKit/chromium/tests/LinkHighlightTest.cpp
@@ -32,6 +32,7 @@
 #include "URLTestHelpers.h"
 #include "WebCompositorInitializer.h"
 #include "WebFrame.h"
+#include "WebInputEvent.h"
 #include "WebViewImpl.h"
 #include <gtest/gtest.h>
 #include <public/WebContentLayer.h>
@@ -59,28 +60,40 @@ TEST(LinkHighlightTest, verifyWebViewImplIntegration)
     webViewImpl->resize(WebSize(pageWidth, pageHeight));
     webViewImpl->layout();
 
+    WebGestureEvent touchEvent;
+
     // The coordinates below are linked to absolute positions in the referenced .html file.
-    IntPoint touchEventLocation(20, 20);
-    Node* touchNode = webViewImpl->bestTouchLinkNode(touchEventLocation);
+    touchEvent.x = 20;
+    touchEvent.y = 20;
+    Node* touchNode = webViewImpl->bestTouchLinkNode(touchEvent);
     ASSERT_TRUE(touchNode);
 
-    touchEventLocation = IntPoint(20, 40);
-    EXPECT_FALSE(webViewImpl->bestTouchLinkNode(touchEventLocation));
+    touchEvent.y = 40;
+    EXPECT_FALSE(webViewImpl->bestTouchLinkNode(touchEvent));
 
-    touchEventLocation = IntPoint(20, 20);
+    touchEvent.y = 20;
     // Shouldn't crash.
 
-    webViewImpl->enableTouchHighlight(touchEventLocation);
+    webViewImpl->enableTouchHighlight(touchEvent);
     EXPECT_TRUE(webViewImpl->linkHighlight());
     EXPECT_TRUE(webViewImpl->linkHighlight()->contentLayer());
     EXPECT_TRUE(webViewImpl->linkHighlight()->clipLayer());
 
     // Find a target inside a scrollable div
 
-    touchEventLocation = IntPoint(20, 100);
-    webViewImpl->enableTouchHighlight(touchEventLocation);
+    touchEvent.y = 100;
+    webViewImpl->enableTouchHighlight(touchEvent);
     ASSERT_TRUE(webViewImpl->linkHighlight());
 
+    // Don't highlight if no "hand cursor"
+    touchEvent.y = 220; // An A-link with cross-hair cursor.
+    webViewImpl->enableTouchHighlight(touchEvent);
+    ASSERT_FALSE(webViewImpl->linkHighlight());
+
+    touchEvent.y = 260; // A text input box.
+    webViewImpl->enableTouchHighlight(touchEvent);
+    ASSERT_FALSE(webViewImpl->linkHighlight());
+
     webViewImpl->close();
 }
 #endif
diff --git a/Source/WebKit/chromium/tests/LocalizedDateICUTest.cpp b/Source/WebKit/chromium/tests/LocaleICUTest.cpp
index 03d0e1340..09e477225 100644
--- a/Source/WebKit/chromium/tests/LocalizedDateICUTest.cpp
+++ b/Source/WebKit/chromium/tests/LocaleICUTest.cpp
@@ -29,17 +29,15 @@
  */
 
 #include "config.h"
-
-#if ENABLE(INPUT_MULTIPLE_FIELDS_UI)
-
 #include "LocaleICU.h"
+
 #include <gtest/gtest.h>
 #include <wtf/PassOwnPtr.h>
 #include <wtf/text/StringBuilder.h>
 
 using namespace WebCore;
 
-class LocalizedDateICUTest : public ::testing::Test {
+class LocaleICUTest : public ::testing::Test {
 public:
     // Labels class is used for printing results in EXPECT_EQ macro.
     class Labels {
@@ -88,6 +86,7 @@ protected:
         return Labels(labels);
     }
 
+#if ENABLE(INPUT_MULTIPLE_FIELDS_UI)
     String monthFormat(const char* localeString)
     {
         OwnPtr<LocaleICU> locale = LocaleICU::create(localeString);
@@ -135,14 +134,16 @@ protected:
         OwnPtr<LocaleICU> locale = LocaleICU::create(localeString);
         return locale->isRTL();
     }
+#endif
 };
 
-std::ostream& operator<<(std::ostream& os, const LocalizedDateICUTest::Labels& labels)
+std::ostream& operator<<(std::ostream& os, const LocaleICUTest::Labels& labels)
 {
     return os << labels.toString().utf8().data();
 }
 
-TEST_F(LocalizedDateICUTest, isRTL)
+#if ENABLE(INPUT_MULTIPLE_FIELDS_UI)
+TEST_F(LocaleICUTest, isRTL)
 {
     EXPECT_TRUE(isRTL("ar-EG"));
     EXPECT_FALSE(isRTL("en-us"));
@@ -150,14 +151,14 @@ TEST_F(LocalizedDateICUTest, isRTL)
     EXPECT_FALSE(isRTL("**invalid**"));
 }
 
-TEST_F(LocalizedDateICUTest, monthFormat)
+TEST_F(LocaleICUTest, monthFormat)
 {
     EXPECT_STREQ("MMMM yyyy", monthFormat("en_US").utf8().data());
     EXPECT_STREQ("MMMM yyyy", monthFormat("fr").utf8().data());
     EXPECT_STREQ("yyyy\xE5\xB9\xB4M\xE6\x9C\x88", monthFormat("ja").utf8().data());
 }
 
-TEST_F(LocalizedDateICUTest, localizedDateFormatText)
+TEST_F(LocaleICUTest, localizedDateFormatText)
 {
     // Note: EXPECT_EQ(String, String) doesn't print result as string.
     EXPECT_STREQ("h:mm:ss a", localizedDateFormatText("en_US").utf8().data());
@@ -165,14 +166,14 @@ TEST_F(LocalizedDateICUTest, localizedDateFormatText)
     EXPECT_STREQ("H:mm:ss", localizedDateFormatText("ja").utf8().data());
 }
 
-TEST_F(LocalizedDateICUTest, localizedShortDateFormatText)
+TEST_F(LocaleICUTest, localizedShortDateFormatText)
 {
     EXPECT_STREQ("h:mm a", localizedShortDateFormatText("en_US").utf8().data());
     EXPECT_STREQ("HH:mm", localizedShortDateFormatText("fr").utf8().data());
     EXPECT_STREQ("H:mm", localizedShortDateFormatText("ja").utf8().data());
 }
 
-TEST_F(LocalizedDateICUTest, standAloneMonthLabels)
+TEST_F(LocaleICUTest, standAloneMonthLabels)
 {
     EXPECT_STREQ("January", standAloneMonthLabel("en_US", 0).utf8().data());
     EXPECT_STREQ("June", standAloneMonthLabel("en_US", 5).utf8().data());
@@ -190,7 +191,7 @@ TEST_F(LocalizedDateICUTest, standAloneMonthLabels)
     EXPECT_STREQ("\xD0\x9C\xD0\xB0\xD0\xB9", standAloneMonthLabel("ru_RU", 4).utf8().data());
 }
 
-TEST_F(LocalizedDateICUTest, shortMonthLabels)
+TEST_F(LocaleICUTest, shortMonthLabels)
 {
     EXPECT_STREQ("Jan", shortMonthLabel("en_US", 0).utf8().data());
     EXPECT_STREQ("Jan", shortStandAloneMonthLabel("en_US", 0).utf8().data());
@@ -213,7 +214,7 @@ TEST_F(LocalizedDateICUTest, shortMonthLabels)
     EXPECT_STREQ("\xD0\xBC\xD0\xB0\xD0\xB9", shortStandAloneMonthLabel("ru_RU", 4).utf8().data());
 }
 
-TEST_F(LocalizedDateICUTest, timeAMPMLabels)
+TEST_F(LocaleICUTest, timeAMPMLabels)
 {
     EXPECT_EQ(labels("AM", "PM"), timeAMPMLabels("en_US"));
     EXPECT_EQ(labels("AM", "PM"), timeAMPMLabels("fr"));
@@ -223,4 +224,59 @@ TEST_F(LocalizedDateICUTest, timeAMPMLabels)
     EXPECT_EQ(labels(String(jaAM), String(jaPM)), timeAMPMLabels("ja"));
 }
 
+static String testDecimalSeparator(const AtomicString& localeIdentifier)
+{
+    OwnPtr<Locale> locale = Locale::create(localeIdentifier);
+    return locale->localizedDecimalSeparator();
+}
+
+TEST_F(LocaleICUTest, localizedDecimalSeparator)
+{
+    EXPECT_EQ(String("."), testDecimalSeparator("en_US"));
+    EXPECT_EQ(String(","), testDecimalSeparator("fr"));
+}
 #endif
+
+void testNumberIsReversible(const AtomicString& localeIdentifier, const char* original, const char* shouldHave = 0)
+{
+    OwnPtr<Locale> locale = Locale::create(localeIdentifier);
+    String localized = locale->convertToLocalizedNumber(original);
+    if (shouldHave)
+        EXPECT_TRUE(localized.contains(shouldHave));
+    String converted = locale->convertFromLocalizedNumber(localized);
+    EXPECT_EQ(original, converted);
+}
+
+void testNumbers(const char* localeString)
+{
+    testNumberIsReversible(localeString, "123456789012345678901234567890");
+    testNumberIsReversible(localeString, "-123.456");
+    testNumberIsReversible(localeString, ".456");
+    testNumberIsReversible(localeString, "-0.456");
+}
+
+TEST_F(LocaleICUTest, reversible)
+{
+    testNumberIsReversible("en_US", "123456789012345678901234567890");
+    testNumberIsReversible("en_US", "-123.456", ".");
+    testNumberIsReversible("en_US", ".456", ".");
+    testNumberIsReversible("en_US", "-0.456", ".");
+
+    testNumberIsReversible("fr", "123456789012345678901234567890");
+    testNumberIsReversible("fr", "-123.456", ",");
+    testNumberIsReversible("fr", ".456", ",");
+    testNumberIsReversible("fr", "-0.456", ",");
+
+    // Persian locale has a negative prefix and a negative suffix.
+    testNumbers("fa");
+
+    // Test some of major locales.
+    testNumbers("ar");
+    testNumbers("de_DE");
+    testNumbers("es_ES");
+    testNumbers("ja_JP");
+    testNumbers("ko_KR");
+    testNumbers("zh_CN");
+    testNumbers("zh_HK");
+    testNumbers("zh_TW");
+}
diff --git a/Source/WebKit/chromium/tests/LocaleMacTest.cpp b/Source/WebKit/chromium/tests/LocaleMacTest.cpp
index e9e55d81c..0d2fed154 100644
--- a/Source/WebKit/chromium/tests/LocaleMacTest.cpp
+++ b/Source/WebKit/chromium/tests/LocaleMacTest.cpp
@@ -78,22 +78,10 @@ protected:
     String formatTime(const String& localeString, int hour, int minute, int second, int millisecond, bool useShortFormat)
     {
         OwnPtr<LocaleMac> locale = LocaleMac::create(localeString);
-        return locale->formatDateTime(timeComponents(hour, minute, second, millisecond), (useShortFormat ? Localizer::FormatTypeShort : Localizer::FormatTypeMedium));
-    }
-
-    double parseDate(const String& localeString, const String& dateString)
-    {
-        OwnPtr<LocaleMac> locale = LocaleMac::create(localeString);
-        return locale->parseDateTime(dateString, DateComponents::Date);
+        return locale->formatDateTime(timeComponents(hour, minute, second, millisecond), (useShortFormat ? Locale::FormatTypeShort : Locale::FormatTypeMedium));
     }
 
 #if ENABLE(CALENDAR_PICKER)
-    String dateFormatText(const String& localeString)
-    {
-        OwnPtr<LocaleMac> locale = LocaleMac::create(localeString);
-        return locale->dateFormatText();
-    }
-
     unsigned firstDayOfWeek(const String& localeString)
     {
         OwnPtr<LocaleMac> locale = LocaleMac::create(localeString);
@@ -198,21 +186,7 @@ TEST_F(LocaleMacTest, formatTime)
     EXPECT_STREQ("\xDB\xB7:\xDB\xB0\xDB\xB7:\xDB\xB0\xDB\xB7\xD9\xAB\xDB\xB0\xDB\xB0\xDB\xB7", formatTime("fa", 07, 07, 07, 007, false).utf8().data());
 }
 
-TEST_F(LocaleMacTest, parseDate)
-{
-    EXPECT_EQ(msForDate(2005, April, 27), parseDate("en_US", "April 27, 2005"));
-    EXPECT_EQ(msForDate(2005, April, 27), parseDate("fr_FR", "27 avril 2005"));
-    EXPECT_EQ(msForDate(2005, April, 27), parseDate("ja_JP", "2005/04/27"));
-}
-
 #if ENABLE(CALENDAR_PICKER)
-TEST_F(LocaleMacTest, dateFormatText)
-{
-    EXPECT_STREQ("Month/Day/Year", dateFormatText("en_US").utf8().data());
-    EXPECT_STREQ("Day/Month/Year", dateFormatText("fr_FR").utf8().data());
-    EXPECT_STREQ("Year/Month/Day", dateFormatText("ja_JP").utf8().data());
-}
-
 TEST_F(LocaleMacTest, firstDayOfWeek)
 {
     EXPECT_EQ(Sunday, firstDayOfWeek("en_US"));
@@ -350,7 +324,7 @@ TEST_F(LocaleMacTest, invalidLocale)
 
 static void testNumberIsReversible(const AtomicString& localeString, const char* original, const char* shouldHave = 0)
 {
-    OwnPtr<Localizer> locale = Localizer::create(localeString);
+    OwnPtr<Locale> locale = Locale::create(localeString);
     String localized = locale->convertToLocalizedNumber(original);
     if (shouldHave)
         EXPECT_TRUE(localized.contains(shouldHave));
diff --git a/Source/WebKit/chromium/tests/LocaleWinTest.cpp b/Source/WebKit/chromium/tests/LocaleWinTest.cpp
index 35f064aac..bc98881db 100644
--- a/Source/WebKit/chromium/tests/LocaleWinTest.cpp
+++ b/Source/WebKit/chromium/tests/LocaleWinTest.cpp
@@ -90,19 +90,7 @@ protected:
         return locale->formatDateTime(dateComponents(year, month, day));
     }
 
-    double parseDate(LCID lcid, const String& dateString)
-    {
-        OwnPtr<LocaleWin> locale = LocaleWin::create(lcid);
-        return locale->parseDateTime(dateString, DateComponents::Date);
-    }
-
 #if ENABLE(CALENDAR_PICKER)
-    String dateFormatText(LCID lcid)
-    {
-        OwnPtr<LocaleWin> locale = LocaleWin::create(lcid);
-        return locale->dateFormatText();
-    }
-
     unsigned firstDayOfWeek(LCID lcid)
     {
         OwnPtr<LocaleWin> locale = LocaleWin::create(lcid);
@@ -167,59 +155,6 @@ protected:
 #endif
 };
 
-TEST_F(LocaleWinTest, TestLocalizedDateFormatText)
-{
-    EXPECT_STREQ("year/month/day", LocaleWin::dateFormatText("y/M/d", "year", "month", "day").utf8().data());
-    EXPECT_STREQ("year/month/day", LocaleWin::dateFormatText("yy/MM/dd", "year", "month", "day").utf8().data());
-    EXPECT_STREQ("year/month/day", LocaleWin::dateFormatText("yyy/MMM/ddd", "year", "month", "day").utf8().data());
-    EXPECT_STREQ("year/month/day", LocaleWin::dateFormatText("yyyy/MMMM/dddd", "year", "month", "day").utf8().data());
-    EXPECT_STREQ("/month/day, year", LocaleWin::dateFormatText("/MM/dd, yyyy", "year", "month", "day").utf8().data());
-    EXPECT_STREQ("month/day, year=year.", LocaleWin::dateFormatText("MM/dd, 'year='yyyy.", "year", "month", "day").utf8().data());
-    EXPECT_STREQ("month-day 'year", LocaleWin::dateFormatText("MM-dd ''yyy", "year", "month", "day").utf8().data());
-    EXPECT_STREQ("month-day aaa'bbb year", LocaleWin::dateFormatText("MM-dd 'aaa''bbb' yyy", "year", "month", "day").utf8().data());
-    EXPECT_STREQ("year/month/day/year/month/day", LocaleWin::dateFormatText("yyyy/MMMM/dddd/yyyy/MMMM/dddd", "year", "month", "day").utf8().data());
-    EXPECT_STREQ("YY/mm/DD", LocaleWin::dateFormatText("YY/mm/DD", "year", "month", "day").utf8().data());
-}
-
-TEST_F(LocaleWinTest, TestParse)
-{
-    OwnPtr<LocaleWin> locale = LocaleWin::create(EnglishUS);
-
-    EXPECT_EQ(msForDate(2012, April, 27), locale->parseDate("MM/dd/yy", 2012, "04/27/12"));
-    EXPECT_EQ(msForDate(2062, April, 27), locale->parseDate("MM/dd/yy", 2012, "04/27/62"));
-    EXPECT_EQ(msForDate(1963, April, 27), locale->parseDate("MM/dd/yy", 2012, "04/27/63"));
-    EXPECT_EQ(msForDate(2012, April, 27), locale->parseDate("MM/dd/yy", 2012, "4/27/2012"));
-    EXPECT_EQ(msForDate(2012, April, 27), locale->parseDate("MM/dd/yy", 2012, "Apr/27/2012"));
-    EXPECT_EQ(msForDate(2, April, 27), locale->parseDate("MM/d/yy", 2012, "April/27/2"));
-    EXPECT_EQ(msForDate(2, April, 27), locale->parseDate("MM/d/yy", 2012, "april/27/2"));
-    EXPECT_TRUE(isnan(locale->parseDate("MM/d/yy", 2012, "april/27")));
-    EXPECT_TRUE(isnan(locale->parseDate("MM/d/yy", 2012, "april/27/")));
-    EXPECT_TRUE(isnan(locale->parseDate("MM/d/yy", 2012, " april/27/")));
-
-    EXPECT_EQ(msForDate(12, April, 7), locale->parseDate("MMM/d/yyyy", 2012, "04/7/12"));
-    EXPECT_EQ(msForDate(62, April, 7), locale->parseDate("MMM/d/yyyy", 2012, "04/07/62"));
-    EXPECT_EQ(msForDate(63, April, 7), locale->parseDate("MMM/d/yyyy", 2012, "04/07/63"));
-    EXPECT_EQ(msForDate(2012, April, 7), locale->parseDate("MMM/d/yyyy", 2012, "4/7/2012"));
-    EXPECT_EQ(msForDate(2012, May, 7), locale->parseDate("MMM/d/yyyy", 2012, "May/007/2012"));
-    EXPECT_EQ(msForDate(2, May, 27), locale->parseDate("MM/d/yyyy", 2012, "May/0027/2"));
-    EXPECT_TRUE(isnan(locale->parseDate("MM/d/yyyy", 2012, "May///0027///2")));
-    EXPECT_TRUE(isnan(locale->parseDate("MM/d/yyyy", 2012, "Mayyyyyy/0027/2")));
-
-    EXPECT_EQ(msForDate(2012, April, 27), locale->parseDate("MMMM/dd/y", 2012, "04/27/2"));
-    EXPECT_EQ(msForDate(2017, April, 27), locale->parseDate("MMMM/dd/y", 2012, "04/27/7"));
-    EXPECT_EQ(msForDate(2008, April, 27), locale->parseDate("MMMM/dd/y", 2012, "04/27/8"));
-    EXPECT_EQ(msForDate(2012, April, 27), locale->parseDate("MMMM/dd/y", 2012, "4/27/2012"));
-    EXPECT_EQ(msForDate(2012, December, 27), locale->parseDate("MMMM/dd/y", 2012, "December/27/2012"));
-    EXPECT_EQ(msForDate(2012, November, 27), locale->parseDate("MMMM/d/y", 2012, "November/27/2"));
-    EXPECT_TRUE(isnan(locale->parseDate("MMMM/d/y", 2012, "November 27 2")));
-    EXPECT_TRUE(isnan(locale->parseDate("MMMM/d/y", 2012, "November 32 2")));
-    EXPECT_TRUE(isnan(locale->parseDate("MMMM/d/y", 2012, "-1/-1/-1")));
-
-    OwnPtr<LocaleWin> persian = LocaleWin::create(Persian);
-    // U+06F1 U+06F6 / U+06F0 U+06F8 / 2012
-    EXPECT_EQ(msForDate(2012, August, 16), persian->parseDate("dd/MM/yyyy", 2012, String::fromUTF8("\xDB\xB1\xDB\xB6/\xDB\xB0\xDB\xB8/2012")));
-}
-
 TEST_F(LocaleWinTest, formatDate)
 {
     EXPECT_STREQ("04/27/2005", formatDate(EnglishUS, 2005, April, 27).utf8().data());
@@ -227,21 +162,7 @@ TEST_F(LocaleWinTest, formatDate)
     EXPECT_STREQ("2005/04/27", formatDate(JapaneseJP, 2005, April, 27).utf8().data());
 }
 
-TEST_F(LocaleWinTest, parseDate)
-{
-    EXPECT_EQ(msForDate(2005, April, 27), parseDate(EnglishUS, "April/27/2005"));
-    EXPECT_EQ(msForDate(2005, April, 27), parseDate(FrenchFR, "27/avril/2005"));
-    EXPECT_EQ(msForDate(2005, April, 27), parseDate(JapaneseJP, "2005/04/27"));
-}
-
 #if ENABLE(CALENDAR_PICKER)
-TEST_F(LocaleWinTest, dateFormatText)
-{
-    EXPECT_STREQ("Month/Day/Year", dateFormatText(EnglishUS).utf8().data());
-    EXPECT_STREQ("Day/Month/Year", dateFormatText(FrenchFR).utf8().data());
-    EXPECT_STREQ("Year/Month/Day", dateFormatText(JapaneseJP).utf8().data());
-}
-
 TEST_F(LocaleWinTest, firstDayOfWeek)
 {
     EXPECT_EQ(Sunday, firstDayOfWeek(EnglishUS));
@@ -290,17 +211,17 @@ TEST_F(LocaleWinTest, isRTL)
 #if ENABLE(INPUT_MULTIPLE_FIELDS_UI)
 TEST_F(LocaleWinTest, dateFormat)
 {
-    EXPECT_STREQ("y'-'M'-'d", LocaleWin::dateFormat("y-M-d").utf8().data());
+    EXPECT_STREQ("y-M-d", LocaleWin::dateFormat("y-M-d").utf8().data());
     EXPECT_STREQ("''yy'-'''MM'''-'dd", LocaleWin::dateFormat("''yy-''MM''-dd").utf8().data());
     EXPECT_STREQ("yyyy'-''''-'MMM'''''-'dd", LocaleWin::dateFormat("yyyy-''''-MMM''''-dd").utf8().data());
-    EXPECT_STREQ("yyyy'-'''''MMMM'-'dd", LocaleWin::dateFormat("yyyy-''''MMMM-dd").utf8().data());
+    EXPECT_STREQ("yyyy'-'''''MMMM-dd", LocaleWin::dateFormat("yyyy-''''MMMM-dd").utf8().data());
 }
 
 TEST_F(LocaleWinTest, monthFormat)
 {
-    EXPECT_STREQ("MMMM', 'yyyy", monthFormat(EnglishUS).utf8().data());
-    EXPECT_STREQ("MMMM' 'yyyy", monthFormat(FrenchFR).utf8().data());
-    EXPECT_STREQ("yyyy'\xE5\xB9\xB4'M'\xE6\x9C\x88'", monthFormat(JapaneseJP).utf8().data());
+    EXPECT_STREQ("MMMM, yyyy", monthFormat(EnglishUS).utf8().data());
+    EXPECT_STREQ("MMMM yyyy", monthFormat(FrenchFR).utf8().data());
+    EXPECT_STREQ("yyyy\xE5\xB9\xB4M\xE6\x9C\x88", monthFormat(JapaneseJP).utf8().data());
 }
 
 TEST_F(LocaleWinTest, timeFormat)
@@ -312,9 +233,9 @@ TEST_F(LocaleWinTest, timeFormat)
 
 TEST_F(LocaleWinTest, shortTimeFormat)
 {
-    EXPECT_STREQ("h:mm:ss a", shortTimeFormat(EnglishUS).utf8().data());
-    EXPECT_STREQ("HH:mm:ss", shortTimeFormat(FrenchFR).utf8().data());
-    EXPECT_STREQ("H:mm:ss", shortTimeFormat(JapaneseJP).utf8().data());
+    EXPECT_STREQ("h:mm a", shortTimeFormat(EnglishUS).utf8().data());
+    EXPECT_STREQ("HH:mm", shortTimeFormat(FrenchFR).utf8().data());
+    EXPECT_STREQ("H:mm", shortTimeFormat(JapaneseJP).utf8().data());
 }
 
 TEST_F(LocaleWinTest, shortMonthLabels)
diff --git a/Source/WebKit/chromium/tests/LocalizedNumberICUTest.cpp b/Source/WebKit/chromium/tests/LocalizedNumberICUTest.cpp
deleted file mode 100644
index 6facdc1a1..000000000
--- a/Source/WebKit/chromium/tests/LocalizedNumberICUTest.cpp
+++ /dev/null
@@ -1,97 +0,0 @@
-/*
- * Copyright (C) 2012 Google Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions are
- * met:
- *
- *     * Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- *     * Redistributions in binary form must reproduce the above
- * copyright notice, this list of conditions and the following disclaimer
- * in the documentation and/or other materials provided with the
- * distribution.
- *     * Neither the name of Google Inc. nor the names of its
- * contributors may be used to endorse or promote products derived from
- * this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
- * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "config.h"
-
-#include "LocaleICU.h"
-#include <gtest/gtest.h>
-#include <wtf/PassOwnPtr.h>
-
-using namespace WebCore;
-
-void testNumberIsReversible(const AtomicString& locale, const char* original, const char* shouldHave = 0)
-{
-    OwnPtr<Localizer> localizer = Localizer::create(locale);
-    String localized = localizer->convertToLocalizedNumber(original);
-    if (shouldHave)
-        EXPECT_TRUE(localized.contains(shouldHave));
-    String converted = localizer->convertFromLocalizedNumber(localized);
-    EXPECT_EQ(original, converted);
-}
-
-void testNumbers(const char* localeString)
-{
-    testNumberIsReversible(localeString, "123456789012345678901234567890");
-    testNumberIsReversible(localeString, "-123.456");
-    testNumberIsReversible(localeString, ".456");
-    testNumberIsReversible(localeString, "-0.456");
-}
-
-TEST(LocalizedNumberICUTest, Reversible)
-{
-    testNumberIsReversible("en_US", "123456789012345678901234567890");
-    testNumberIsReversible("en_US", "-123.456", ".");
-    testNumberIsReversible("en_US", ".456", ".");
-    testNumberIsReversible("en_US", "-0.456", ".");
-
-    testNumberIsReversible("fr", "123456789012345678901234567890");
-    testNumberIsReversible("fr", "-123.456", ",");
-    testNumberIsReversible("fr", ".456", ",");
-    testNumberIsReversible("fr", "-0.456", ",");
-
-    // Persian locale has a negative prefix and a negative suffix.
-    testNumbers("fa");
-
-    // Test some of major locales.
-    testNumbers("ar");
-    testNumbers("de_DE");
-    testNumbers("es_ES");
-    testNumbers("ja_JP");
-    testNumbers("ko_KR");
-    testNumbers("zh_CN");
-    testNumbers("zh_HK");
-    testNumbers("zh_TW");
-}
-
-#if ENABLE(INPUT_MULTIPLE_FIELDS_UI)
-
-static String testDecimalSeparator(const AtomicString& locale)
-{
-    OwnPtr<Localizer> localizer = Localizer::create(locale);
-    return localizer->localizedDecimalSeparator();
-}
-
-TEST(LocalizedNumberICUTest, localizedDecimalSeparator)
-{
-    EXPECT_EQ(String("."), testDecimalSeparator("en_US"));
-    EXPECT_EQ(String(","), testDecimalSeparator("fr"));
-}
-
-#endif
diff --git a/Source/WebKit/chromium/tests/MemoryInstrumentationTest.cpp b/Source/WebKit/chromium/tests/MemoryInstrumentationTest.cpp
new file mode 100644
index 000000000..72aa15a30
--- /dev/null
+++ b/Source/WebKit/chromium/tests/MemoryInstrumentationTest.cpp
@@ -0,0 +1,104 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#include "CachedImage.h"
+#include "MemoryInstrumentationImpl.h"
+#include <gtest/gtest.h>
+#include <wtf/MemoryInstrumentation.h>
+#include <wtf/OwnPtr.h>
+
+using namespace WebCore;
+
+using WTF::MemoryObjectInfo;
+using WTF::MemoryClassInfo;
+using WTF::MemoryObjectType;
+
+namespace {
+
+MemoryObjectType TestType = "TestType";
+
+class ImageObserverTestHelper {
+public:
+    ImageObserverTestHelper()
+        : m_cachedImage(adoptPtr(new CachedImage(0)))
+        , m_imageOberver(m_cachedImage.get())
+    {
+    }
+    void reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
+    {
+        MemoryClassInfo info(memoryObjectInfo, this, TestType);
+        info.addMember(m_cachedImage);
+        info.addMember(m_imageOberver);
+    }
+
+    OwnPtr<CachedImage> m_cachedImage;
+    ImageObserver* m_imageOberver;
+};
+
+TEST(MemoryInstrumentationTest, ImageObserver)
+{
+    ImageObserverTestHelper helper;
+
+    class TestClient : public MemoryInstrumentationClientImpl {
+    public:
+        TestClient(const void* expectedPointer, const void* unexpectedPointer)
+            : m_expectedPointer(expectedPointer)
+            , m_unexpectedPointer(unexpectedPointer)
+            , m_expectedPointerFound(false)
+        {
+            EXPECT_NE(expectedPointer, unexpectedPointer);
+        }
+        virtual void countObjectSize(const void* pointer, MemoryObjectType type, size_t size) OVERRIDE
+        {
+            EXPECT_NE(m_unexpectedPointer, pointer);
+            if (m_expectedPointer == pointer)
+                m_expectedPointerFound = true;
+            MemoryInstrumentationClientImpl::countObjectSize(pointer, type, size);
+        }
+
+        bool expectedPointerFound() { return m_expectedPointerFound; }
+
+    private:
+        const void* m_expectedPointer;
+        const void* m_unexpectedPointer;
+        bool m_expectedPointerFound;
+    } client(helper.m_cachedImage.get(), helper.m_imageOberver);
+    MemoryInstrumentationImpl instrumentation(&client);
+    instrumentation.addRootObject(helper);
+    EXPECT_TRUE(client.expectedPointerFound());
+    EXPECT_LE(sizeof(CachedImage), client.reportedSizeForAllTypes());
+    EXPECT_LE(1u, client.totalCountedObjects());
+}
+
+
+} // namespace
+
diff --git a/Source/WebKit/chromium/tests/OpaqueRectTrackingContentLayerDelegateTest.cpp b/Source/WebKit/chromium/tests/OpaqueRectTrackingContentLayerDelegateTest.cpp
index 0cf82494b..39e36a9fb 100644
--- a/Source/WebKit/chromium/tests/OpaqueRectTrackingContentLayerDelegateTest.cpp
+++ b/Source/WebKit/chromium/tests/OpaqueRectTrackingContentLayerDelegateTest.cpp
@@ -145,7 +145,7 @@ TEST_F(OpaqueRectTrackingContentLayerDelegateTest, testOpaqueRectPresentAfterOpa
     OpaqueRectTrackingContentLayerDelegate delegate(&painter);
 
     WebFloatRect opaqueRect;
-    delegate.paintContents(skCanvas(), canvasRect(), opaqueRect);
+    delegate.paintContents(skCanvas(), canvasRect(), false, opaqueRect);
     EXPECT_EQ_RECT(WebFloatRect(0, 0, 400, 400), opaqueRect);
 }
 
@@ -156,7 +156,7 @@ TEST_F(OpaqueRectTrackingContentLayerDelegateTest, testOpaqueRectNotPresentAfter
     OpaqueRectTrackingContentLayerDelegate delegate(&painter);
 
     WebFloatRect opaqueRect;
-    delegate.paintContents(skCanvas(), canvasRect(), opaqueRect);
+    delegate.paintContents(skCanvas(), canvasRect(), false, opaqueRect);
     EXPECT_EQ_RECT(WebFloatRect(0, 0, 0, 0), opaqueRect);
 }
 
@@ -169,7 +169,7 @@ TEST_F(OpaqueRectTrackingContentLayerDelegateTest, testOpaqueRectNotPresentForOp
     delegate.setOpaque(true);
 
     WebFloatRect opaqueRect;
-    delegate.paintContents(skCanvas(), canvasRect(), opaqueRect);
+    delegate.paintContents(skCanvas(), canvasRect(), false, opaqueRect);
     EXPECT_EQ_RECT(WebFloatRect(0, 0, 0, 0), opaqueRect);
 }
 
@@ -182,7 +182,7 @@ TEST_F(OpaqueRectTrackingContentLayerDelegateTest, testOpaqueRectNotPresentForOp
     delegate.setOpaque(true);
 
     WebFloatRect opaqueRect;
-    delegate.paintContents(skCanvas(), canvasRect(), opaqueRect);
+    delegate.paintContents(skCanvas(), canvasRect(), false, opaqueRect);
     EXPECT_EQ_RECT(WebFloatRect(0, 0, 0, 0), opaqueRect);
 }
 
@@ -194,7 +194,7 @@ TEST_F(OpaqueRectTrackingContentLayerDelegateTest, testPartialOpaqueRectNoTransf
     OpaqueRectTrackingContentLayerDelegate delegate(&painter);
 
     WebFloatRect opaqueRect;
-    delegate.paintContents(skCanvas(), canvasRect(), opaqueRect);
+    delegate.paintContents(skCanvas(), canvasRect(), false, opaqueRect);
     EXPECT_EQ_RECT(WebFloatRect(partialRect.x(), partialRect.y(), partialRect.width(), partialRect.height()), opaqueRect);
 }
 
@@ -207,7 +207,7 @@ TEST_F(OpaqueRectTrackingContentLayerDelegateTest, testPartialOpaqueRectTranslat
 
     WebFloatRect opaqueRect;
     WebRect contentRect(11, 12, 389, 388);
-    delegate.paintContents(skCanvas(), contentRect, opaqueRect);
+    delegate.paintContents(skCanvas(), contentRect, false, opaqueRect);
     EXPECT_EQ_RECT(WebFloatRect(partialRect.x(), partialRect.y(), partialRect.width(), partialRect.height()), opaqueRect);
 }
 
@@ -225,7 +225,7 @@ TEST_F(OpaqueRectTrackingContentLayerDelegateTest, testHintingScaleFactorSet)
 
     IntRect rectA;
     WebFloatRect rectB;
-    delegate.paintContents(&canvas, rectA, rectB);
+    delegate.paintContents(&canvas, rectA, false, rectB);
     EXPECT_EQ(callback.hintingScale, hintingScale);
 }
 #endif
diff --git a/Source/WebKit/chromium/tests/WebFrameTest.cpp b/Source/WebKit/chromium/tests/WebFrameTest.cpp
index d4bc4819e..ffed3c203 100644
--- a/Source/WebKit/chromium/tests/WebFrameTest.cpp
+++ b/Source/WebKit/chromium/tests/WebFrameTest.cpp
@@ -1045,19 +1045,23 @@ class FindUpdateWebFrameClient : public WebFrameClient {
 public:
     FindUpdateWebFrameClient()
         : m_findResultsAreReady(false)
+        , m_count(-1)
     {
     }
 
-    virtual void reportFindInPageMatchCount(int, int, bool finalUpdate) OVERRIDE
+    virtual void reportFindInPageMatchCount(int, int count, bool finalUpdate) OVERRIDE
     {
+        m_count = count;
         if (finalUpdate)
             m_findResultsAreReady = true;
     }
 
     bool findResultsAreReady() const { return m_findResultsAreReady; }
+    int count() const { return m_count; }
 
 private:
     bool m_findResultsAreReady;
+    int m_count;
 };
 
 TEST_F(WebFrameTest, FindInPageMatchRects)
@@ -1172,6 +1176,37 @@ TEST_F(WebFrameTest, FindInPageMatchRects)
     webView->close();
 }
 
+TEST_F(WebFrameTest, FindInPageSkipsHiddenFrames)
+{
+    registerMockedHttpURLLoad("find_in_hidden_frame.html");
+
+    FindUpdateWebFrameClient client;
+    WebView* webView = FrameTestHelpers::createWebViewAndLoad(m_baseURL + "find_in_hidden_frame.html", true, &client);
+    webView->resize(WebSize(640, 480));
+    webView->layout();
+    webkit_support::RunAllPendingMessages();
+
+    static const char* kFindString = "hello";
+    static const int kFindIdentifier = 12345;
+    static const int kNumResults = 1;
+
+    WebFindOptions options;
+    WebString searchText = WebString::fromUTF8(kFindString);
+    WebFrameImpl* mainFrame = static_cast<WebFrameImpl*>(webView->mainFrame());
+    EXPECT_TRUE(mainFrame->find(kFindIdentifier, searchText, options, false, 0));
+
+    mainFrame->resetMatchCount();
+
+    for (WebFrame* frame = mainFrame; frame; frame = frame->traverseNext(false))
+        frame->scopeStringMatches(kFindIdentifier, searchText, options, true);
+
+    webkit_support::RunAllPendingMessages();
+    EXPECT_TRUE(client.findResultsAreReady());
+    EXPECT_EQ(kNumResults, client.count());
+
+    webView->close();
+}
+
 TEST_F(WebFrameTest, FindOnDetachedFrame)
 {
     registerMockedHttpURLLoad("find_in_page.html");
diff --git a/Source/WebKit/chromium/tests/WebInputEventFactoryTestMac.mm b/Source/WebKit/chromium/tests/WebInputEventFactoryTestMac.mm
index 73a29bcd1..aabaa1076 100644
--- a/Source/WebKit/chromium/tests/WebInputEventFactoryTestMac.mm
+++ b/Source/WebKit/chromium/tests/WebInputEventFactoryTestMac.mm
@@ -36,12 +36,19 @@
 #include "KeyboardEvent.h"
 #include "WebInputEvent.h"
 #include "WebInputEventFactory.h"
+#include "WindowsKeyboardCodes.h"
 
 using WebKit::WebInputEventFactory;
 using WebKit::WebKeyboardEvent;
 
 namespace {
 
+struct KeyMappingEntry {
+    int macKeyCode;
+    unichar character;
+    int windowsKeyCode;
+};
+
 NSEvent* BuildFakeKeyEvent(NSUInteger keyCode, unichar character, NSUInteger modifierFlags)
 {
     NSString* string = [NSString stringWithCharacters:&character length:1];
@@ -82,3 +89,35 @@ TEST(WebInputEventFactoryTestMac, ArrowKeyNumPad)
     webEvent = WebInputEventFactory::keyboardEvent(macEvent);
     EXPECT_EQ(0, webEvent.modifiers);
 }
+
+// Test that numpad keys get mapped correctly.
+TEST(WebInputEventFactoryTestMac, NumPadMapping)
+{
+    KeyMappingEntry table[] =
+    {
+        {65, '.', VK_DECIMAL},
+        {67, '*', VK_MULTIPLY},
+        {69, '+', VK_ADD},
+        {71, NSClearLineFunctionKey, VK_CLEAR},
+        {75, '/', VK_DIVIDE},
+        {76, 3,   VK_RETURN},
+        {78, '-', VK_SUBTRACT},
+        {81, '=', VK_OEM_PLUS},
+        {82, '0', VK_NUMPAD0},
+        {83, '1', VK_NUMPAD1},
+        {84, '2', VK_NUMPAD2},
+        {85, '3', VK_NUMPAD3},
+        {86, '4', VK_NUMPAD4},
+        {87, '5', VK_NUMPAD5},
+        {88, '6', VK_NUMPAD6},
+        {89, '7', VK_NUMPAD7},
+        {91, '8', VK_NUMPAD8},
+        {92, '9', VK_NUMPAD9},
+    };
+
+    for (size_t i = 0; i < arraysize(table); ++i) {
+        NSEvent* macEvent = BuildFakeKeyEvent(table[i].macKeyCode, table[i].character, 0);
+        WebKeyboardEvent webEvent = WebInputEventFactory::keyboardEvent(macEvent);
+        EXPECT_EQ(table[i].windowsKeyCode, webEvent.windowsKeyCode);
+    }
+}
diff --git a/Source/WebKit/chromium/tests/data/find_in_hidden_frame.html b/Source/WebKit/chromium/tests/data/find_in_hidden_frame.html
new file mode 100644
index 000000000..261f7afad
--- /dev/null
+++ b/Source/WebKit/chromium/tests/data/find_in_hidden_frame.html
@@ -0,0 +1 @@
+<div>hello</div><iframe style="display:inline;width:0;height:0;border:none" src="data:text/html,hello"></iframe>
diff --git a/Source/WebKit/chromium/tests/data/test_touch_link_highlight.html b/Source/WebKit/chromium/tests/data/test_touch_link_highlight.html
index 2394b2624..e3e29a62b 100644
--- a/Source/WebKit/chromium/tests/data/test_touch_link_highlight.html
+++ b/Source/WebKit/chromium/tests/data/test_touch_link_highlight.html
@@ -24,6 +24,11 @@
         Some stuff.<br>
         Some stuff.<br>
     </div>
+    <!-- Don't highlight if no hand cursor. -->
+    <a href="http://www.test.com" style="position: absolute; left: 20px; top: 220px; width: 200px; cursor: crosshair;">A link to *not* highlight</a>
+    <div style="position: absolute; left: 20px; top: 260px; width: 200px;">
+        <input type="text"> <!-- This will have an I-beam cursor. -->
+    </div>
 <!-- The following is the text for the iframe tag below:
 <html>
 <body>
diff --git a/Source/WebKit/efl/ChangeLog b/Source/WebKit/efl/ChangeLog
index e84aa244b..b2e8a8fd7 100644
--- a/Source/WebKit/efl/ChangeLog
+++ b/Source/WebKit/efl/ChangeLog
@@ -1,3 +1,145 @@
+2012-11-01  Seonae Kim  <sunaeluv.kim@samsung.com>
+
+        [EFL][DRT] Support Geolocation
+        https://bugs.webkit.org/show_bug.cgi?id=97427
+
+        Reviewed by Gyuyoung Kim. 
+
+        Implement methods to use GeolocationClientMock in DumpRenderTree.
+        This client attaches to the page whenever a view is created.
+
+        * WebCoreSupport/DumpRenderTreeSupportEfl.cpp:
+        (DumpRenderTreeSupportEfl::attachClientToPage):
+        (DumpRenderTreeSupportEfl::resetGeolocationClientMock):
+        (DumpRenderTreeSupportEfl::setMockGeolocationPermission):
+        (DumpRenderTreeSupportEfl::setMockGeolocationPosition):
+        (DumpRenderTreeSupportEfl::setMockGeolocationPositionUnavailableError):
+        (DumpRenderTreeSupportEfl::numberOfPendingGeolocationPermissionRequests):
+        * WebCoreSupport/DumpRenderTreeSupportEfl.h:
+
+2012-10-31  Michał Pakuła vel Rutka  <m.pakula@samsung.com>
+
+        [EFL][DRT] EventSender requires contextClick implementation
+        https://bugs.webkit.org/show_bug.cgi?id=86091
+
+        Reviewed by Gyuyoung Kim.
+
+        Add a pointer to parent menu in Ewk_Context_Menu_Item and a getter
+        function to allow selecting a context menu item without having
+        parent menu pointer in DumpRenderTree EventSender.
+        Three unit tests added due ewk API changes.
+
+        * ewk/ewk_contextmenu.cpp:
+        (_Ewk_Context_Menu_Item):
+        (ewk_context_menu_item_new):
+        (ewk_context_menu_item_parent_get):
+        (ewk_context_menu_item_append):
+        * ewk/ewk_contextmenu.h:
+        * ewk/ewk_view.cpp:
+        (ewk_view_context_menu_get):
+        * ewk/ewk_view.h:
+        * tests/test_ewk_contextmenu.cpp: Added.
+        (TEST_F):
+        * tests/test_ewk_view.cpp:
+        (TEST_F):
+
+2012-10-30  Seokju Kwon  <seokju.kwon@samsung.com>
+
+        [EFL] Fix failure to highlight nodes on web inspector
+        https://bugs.webkit.org/show_bug.cgi?id=100303
+
+        Reviewed by Gyuyoung Kim.
+
+        It is not working to highlight nodes on web inspector
+        when using 'Single Backing Store'.
+        Add code for drawing it if there is the highlighted node.
+
+        * ewk/ewk_view_single.cpp:
+        (_ewk_view_single_smart_repaints_process):
+
+2012-10-30  Jinwoo Song  <jinwoo7.song@samsung.com>
+
+        [EFL] Refactor tooltip callback signal in WebKit1
+        https://bugs.webkit.org/show_bug.cgi?id=100571
+
+        Reviewed by Gyuyoung Kim.
+
+        Separate tooltip callback signal into 'tooltip,text,set'
+        and 'tooltip,text,unset' to be consistent with WebKit2.
+
+        * ewk/ewk_view.cpp:
+        (ewk_view_tooltip_text_set):
+        * ewk/ewk_view.h:
+
+2012-10-26  Hyowon Kim  <hw1008.kim@samsung.com>
+
+        [Texmap][EFL] Implementation of AC related functions in ChromeClientEfl and ewkView.
+        https://bugs.webkit.org/show_bug.cgi?id=82315
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        This patch implements accelerated-compositing-related functions
+        to enter accelerated-compositing mode and sync layers 
+        in ChromeClientEfl and ewkView.
+
+        * WebCoreSupport/ChromeClientEfl.cpp:
+        (WebCore::ChromeClientEfl::attachRootGraphicsLayer):
+        (WebCore::ChromeClientEfl::setNeedsOneShotDrawingSynchronization):
+        (WebCore::ChromeClientEfl::scheduleCompositingLayerFlush):
+        (WebCore::ChromeClientEfl::allowedCompositingTriggers):
+        * ewk/ewk_view.cpp:
+        (_Ewk_View_Private_Data):
+        (_ewk_view_priv_new):
+        (_ewk_view_priv_del):
+        (_ewk_view_accelerated_compositing_cb):
+        Sync and render layers.
+        (_ewk_view_accelerated_compositing_context_create_if_needed):
+        Create a new AcceleratedCompositingContext.
+        (ewk_view_accelerated_compositing_object_create):
+        Create a new evas_image_object act as render target surface.
+        (ewk_view_accelerated_compositing_context_get):
+        Return the GraphicsContext3D for accelerated compositing. 
+        (ewk_view_root_graphics_layer_set):
+        Set the root layer to AcceleratedCompositingContext.
+        (ewk_view_mark_for_sync):
+        Mark the evas_image_object for accelerated compositing as dirty to make it update.
+        * ewk/ewk_view_private.h:
+        (WebCore):
+
+2012-10-24  Brady Eidson  <beidson@apple.com>
+
+        Add a strategy for loader customization.
+        https://bugs.webkit.org/show_bug.cgi?id=100278
+
+        Reviewed by Alexey Proskuryakov.
+
+        * WebCoreSupport/PlatformStrategiesEfl.cpp:
+        (PlatformStrategiesEfl::createLoaderStrategy):
+        * WebCoreSupport/PlatformStrategiesEfl.h:
+        (PlatformStrategiesEfl):
+
+2012-10-23  Alexey Proskuryakov  <ap@apple.com>
+
+        Add a strategy for shared workers
+        https://bugs.webkit.org/show_bug.cgi?id=100165
+
+        Reviewed by Brady Eidson.
+
+        * WebCoreSupport/PlatformStrategiesEfl.cpp:
+        (PlatformStrategiesEfl::createPasteboardStrategy):
+        (PlatformStrategiesEfl::createSharedWorkerStrategy):
+        (PlatformStrategiesEfl::createVisitedLinkStrategy):
+        * WebCoreSupport/PlatformStrategiesEfl.h:
+
+2012-10-23  Hyowon Kim  <hw1008.kim@samsung.com>
+
+        [Texmap][EFL] Add AcceleratedCompositingContextEfl to the build system.
+        https://bugs.webkit.org/show_bug.cgi?id=88630
+
+        Reviewed by Gyuyoung Kim.
+
+        * WebCoreSupport/AcceleratedCompositingContextEfl.cpp: Modify the #include file.
+
 2012-10-23  Andras Becsi  <andras.becsi@digia.com>
 
         Remove devicePixelRatio from ViewportAttributes
diff --git a/Source/WebKit/efl/WebCoreSupport/AcceleratedCompositingContextEfl.cpp b/Source/WebKit/efl/WebCoreSupport/AcceleratedCompositingContextEfl.cpp
index b1bff6486..08de3e0d0 100755
--- a/Source/WebKit/efl/WebCoreSupport/AcceleratedCompositingContextEfl.cpp
+++ b/Source/WebKit/efl/WebCoreSupport/AcceleratedCompositingContextEfl.cpp
@@ -29,7 +29,7 @@
 #include "PageClientEfl.h"
 #include "TextureMapperGL.h"
 #include "TextureMapperLayer.h"
-#include "ewk_private.h"
+#include "ewk_view_private.h"
 
 namespace WebCore {
 
diff --git a/Source/WebKit/efl/WebCoreSupport/ChromeClientEfl.cpp b/Source/WebKit/efl/WebCoreSupport/ChromeClientEfl.cpp
index 1f52af33a..537424a94 100644
--- a/Source/WebKit/efl/WebCoreSupport/ChromeClientEfl.cpp
+++ b/Source/WebKit/efl/WebCoreSupport/ChromeClientEfl.cpp
@@ -591,24 +591,24 @@ PassRefPtr<SearchPopupMenu> ChromeClientEfl::createSearchPopupMenu(PopupMenuClie
 }
 
 #if USE(ACCELERATED_COMPOSITING)
-void ChromeClientEfl::attachRootGraphicsLayer(Frame*, GraphicsLayer*)
+void ChromeClientEfl::attachRootGraphicsLayer(Frame*, GraphicsLayer* rootLayer)
 {
-    notImplemented();
+    ewk_view_root_graphics_layer_set(m_view, rootLayer);
 }
 
 void ChromeClientEfl::setNeedsOneShotDrawingSynchronization()
 {
-    notImplemented();
+    ewk_view_mark_for_sync(m_view);
 }
 
 void ChromeClientEfl::scheduleCompositingLayerFlush()
 {
-    notImplemented();
+    ewk_view_mark_for_sync(m_view);
 }
 
 ChromeClient::CompositingTriggerFlags ChromeClientEfl::allowedCompositingTriggers() const
 {
-    return 0;
+    return AllTriggers;
 }
 #endif
 
diff --git a/Source/WebKit/efl/WebCoreSupport/DumpRenderTreeSupportEfl.cpp b/Source/WebKit/efl/WebCoreSupport/DumpRenderTreeSupportEfl.cpp
index eee7122e7..b045ab042 100644
--- a/Source/WebKit/efl/WebCoreSupport/DumpRenderTreeSupportEfl.cpp
+++ b/Source/WebKit/efl/WebCoreSupport/DumpRenderTreeSupportEfl.cpp
@@ -62,6 +62,14 @@
 #include <workers/WorkerThread.h>
 #include <wtf/HashMap.h>
 
+#if ENABLE(GEOLOCATION)
+#include <GeolocationClientMock.h>
+#include <GeolocationController.h>
+#include <GeolocationError.h>
+#include <GeolocationPosition.h>
+#include <wtf/CurrentTime.h>
+#endif
+
 #define DRT_SUPPORT_FRAME_GET_OR_RETURN(ewkFrame, frame, ...) \
     WebCore::Frame* frame = EWKPrivate::coreFrame(ewkFrame);  \
     if (!frame)                                               \
@@ -71,7 +79,19 @@
     WebCore::Page* page = EWKPrivate::corePage(ewkView);  \
     if (!page)                                            \
         return __VA_ARGS__;
-    
+
+bool DumpRenderTreeSupportEfl::s_drtRun = false;
+
+void DumpRenderTreeSupportEfl::setDumpRenderTreeModeEnabled(bool enabled)
+{
+    s_drtRun = enabled;
+}
+
+bool DumpRenderTreeSupportEfl::dumpRenderTreeModeEnabled()
+{
+    return s_drtRun;
+}
+
 unsigned DumpRenderTreeSupportEfl::activeAnimationsCount(const Evas_Object* ewkFrame)
 {
     DRT_SUPPORT_FRAME_GET_OR_RETURN(ewkFrame, frame, 0);
@@ -779,3 +799,77 @@ void DumpRenderTreeSupportEfl::setDomainRelaxationForbiddenForURLScheme(bool for
 {
     WebCore::SchemeRegistry::setDomainRelaxationForbiddenForURLScheme(forbidden, scheme);
 }
+
+void DumpRenderTreeSupportEfl::resetGeolocationClientMock(const Evas_Object* ewkView)
+{
+#if ENABLE(GEOLOCATION)
+    DRT_SUPPRT_PAGE_GET_OR_RETURN(ewkView, page);
+
+    WebCore::GeolocationClientMock* mock = static_cast<WebCore::GeolocationClientMock*>(WebCore::GeolocationController::from(page)->client());
+    mock->reset();
+#else
+    UNUSED_PARAM(ewkView);
+#endif
+}
+
+void DumpRenderTreeSupportEfl::setMockGeolocationPermission(const Evas_Object* ewkView, bool allowed)
+{
+#if ENABLE(GEOLOCATION)
+    DRT_SUPPRT_PAGE_GET_OR_RETURN(ewkView, page);
+
+    WebCore::GeolocationClientMock* mock = static_cast<WebCore::GeolocationClientMock*>(WebCore::GeolocationController::from(page)->client());
+    mock->setPermission(allowed);
+#else
+    UNUSED_PARAM(ewkView);
+    UNUSED_PARAM(allowed);
+#endif
+}
+
+void DumpRenderTreeSupportEfl::setMockGeolocationPosition(const Evas_Object* ewkView, double latitude, double longitude, double accuracy, bool canProvideAltitude, double altitude, bool canProvideAltitudeAccuracy, double altitudeAccuracy, bool canProvideHeading, double heading, bool canProvideSpeed, double speed)
+{
+#if ENABLE(GEOLOCATION)
+    DRT_SUPPRT_PAGE_GET_OR_RETURN(ewkView, page);
+
+    WebCore::GeolocationClientMock* mock = static_cast<WebCore::GeolocationClientMock*>(WebCore::GeolocationController::from(page)->client());
+    mock->setPosition(WebCore::GeolocationPosition::create(currentTime(), latitude, longitude, accuracy, canProvideAltitude, altitude, canProvideAltitudeAccuracy, altitudeAccuracy, canProvideHeading, heading, canProvideSpeed, speed));
+#else
+    UNUSED_PARAM(ewkView);
+    UNUSED_PARAM(latitude);
+    UNUSED_PARAM(longitude);
+    UNUSED_PARAM(accuracy);
+    UNUSED_PARAM(canProvideAltitude);
+    UNUSED_PARAM(altitude);
+    UNUSED_PARAM(canProvideAltitudeAccuracy);
+    UNUSED_PARAM(altitudeAccuracy);
+    UNUSED_PARAM(canProvideHeading);
+    UNUSED_PARAM(heading);
+    UNUSED_PARAM(canProvideSpeed);
+    UNUSED_PARAM(speed);
+#endif
+}
+
+void DumpRenderTreeSupportEfl::setMockGeolocationPositionUnavailableError(const Evas_Object* ewkView, const char* errorMessage)
+{
+#if ENABLE(GEOLOCATION)
+    DRT_SUPPRT_PAGE_GET_OR_RETURN(ewkView, page);
+
+    WebCore::GeolocationClientMock* mock = static_cast<WebCore::GeolocationClientMock*>(WebCore::GeolocationController::from(page)->client());
+    mock->setPositionUnavailableError(errorMessage);
+#else
+    UNUSED_PARAM(ewkView);
+    UNUSED_PARAM(errorMessage);
+#endif
+}
+
+int DumpRenderTreeSupportEfl::numberOfPendingGeolocationPermissionRequests(const Evas_Object* ewkView)
+{
+#if ENABLE(GEOLOCATION)
+    DRT_SUPPRT_PAGE_GET_OR_RETURN(ewkView, page, -1);
+
+    WebCore::GeolocationClientMock* mock = static_cast<WebCore::GeolocationClientMock*>(WebCore::GeolocationController::from(page)->client());
+    return mock->numberOfPendingPermissionRequests();
+#else
+    UNUSED_PARAM(ewkView);
+    return 0;
+#endif
+}
diff --git a/Source/WebKit/efl/WebCoreSupport/DumpRenderTreeSupportEfl.h b/Source/WebKit/efl/WebCoreSupport/DumpRenderTreeSupportEfl.h
index 35c05001d..59a63b4b1 100644
--- a/Source/WebKit/efl/WebCoreSupport/DumpRenderTreeSupportEfl.h
+++ b/Source/WebKit/efl/WebCoreSupport/DumpRenderTreeSupportEfl.h
@@ -49,6 +49,9 @@ public:
 
     ~DumpRenderTreeSupportEfl() { }
 
+    static void setDumpRenderTreeModeEnabled(bool);
+    static bool dumpRenderTreeModeEnabled();
+
     static unsigned activeAnimationsCount(const Evas_Object* ewkFrame);
     static bool callShouldCloseOnWebView(Evas_Object* ewkFrame);
     static void clearFrameName(Evas_Object* ewkFrame);
@@ -127,6 +130,16 @@ public:
     static void confirmComposition(Evas_Object*, const char*);
     static WebCore::IntRect firstRectForCharacterRange(Evas_Object*, int, int);
     static bool selectedRange(Evas_Object*, int*, int*);
+
+    // Geolocation
+    static void resetGeolocationClientMock(const Evas_Object*);
+    static void setMockGeolocationPermission(const Evas_Object*, bool allowed);
+    static void setMockGeolocationPosition(const Evas_Object*, double latitude, double longitude, double accuracy, bool canProvideAltitude, double altitude, bool canProvideAltitudeAccuracy, double altitudeAccuracy, bool canProvideHeading, double heading, bool canProvideSpeed, double speed);
+    static void setMockGeolocationPositionUnavailableError(const Evas_Object*, const char* errorMessage);
+    static int numberOfPendingGeolocationPermissionRequests(const Evas_Object*);
+
+private:
+    static bool s_drtRun;
 };
 
 #endif // DumpRenderTreeSupportEfl_h
diff --git a/Source/WebKit/efl/WebCoreSupport/PlatformStrategiesEfl.cpp b/Source/WebKit/efl/WebCoreSupport/PlatformStrategiesEfl.cpp
index c262085c3..7138aa8d7 100644
--- a/Source/WebKit/efl/WebCoreSupport/PlatformStrategiesEfl.cpp
+++ b/Source/WebKit/efl/WebCoreSupport/PlatformStrategiesEfl.cpp
@@ -44,27 +44,35 @@ PlatformStrategiesEfl::PlatformStrategiesEfl()
 {
 }
 
-// CookiesStrategy
 CookiesStrategy* PlatformStrategiesEfl::createCookiesStrategy()
 {
     return this;
 }
 
-// PluginStrategy
+LoaderStrategy* PlatformStrategiesEfl::createLoaderStrategy()
+{
+    return this;
+}
+
+PasteboardStrategy* PlatformStrategiesEfl::createPasteboardStrategy()
+{
+    notImplemented();
+    return 0;
+}
+
 PluginStrategy* PlatformStrategiesEfl::createPluginStrategy()
 {
     return this;
 }
 
-VisitedLinkStrategy* PlatformStrategiesEfl::createVisitedLinkStrategy()
+SharedWorkerStrategy* PlatformStrategiesEfl::createSharedWorkerStrategy()
 {
     return this;
 }
 
-PasteboardStrategy* PlatformStrategiesEfl::createPasteboardStrategy()
+VisitedLinkStrategy* PlatformStrategiesEfl::createVisitedLinkStrategy()
 {
-    notImplemented();
-    return 0;
+    return this;
 }
 
 // CookiesStrategy
diff --git a/Source/WebKit/efl/WebCoreSupport/PlatformStrategiesEfl.h b/Source/WebKit/efl/WebCoreSupport/PlatformStrategiesEfl.h
index d3f26b680..01e61156c 100644
--- a/Source/WebKit/efl/WebCoreSupport/PlatformStrategiesEfl.h
+++ b/Source/WebKit/efl/WebCoreSupport/PlatformStrategiesEfl.h
@@ -21,12 +21,14 @@
 #define PlatformStrategiesEfl_h
 
 #include "CookiesStrategy.h"
+#include "LoaderStrategy.h"
 #include "PasteboardStrategy.h"
 #include "PlatformStrategies.h"
 #include "PluginStrategy.h"
+#include "SharedWorkerStrategy.h"
 #include "VisitedLinkStrategy.h"
 
-class PlatformStrategiesEfl : public WebCore::PlatformStrategies, private WebCore::CookiesStrategy, private WebCore::PluginStrategy, private WebCore::VisitedLinkStrategy {
+class PlatformStrategiesEfl : public WebCore::PlatformStrategies, private WebCore::CookiesStrategy, private WebCore::LoaderStrategy, private WebCore::PluginStrategy, private WebCore::SharedWorkerStrategy, private WebCore::VisitedLinkStrategy {
 public:
     static void initialize();
 
@@ -35,9 +37,11 @@ private:
 
     // WebCore::PlatformStrategies
     virtual WebCore::CookiesStrategy* createCookiesStrategy();
+    virtual WebCore::LoaderStrategy* createLoaderStrategy();
+    virtual WebCore::PasteboardStrategy* createPasteboardStrategy();
     virtual WebCore::PluginStrategy* createPluginStrategy();
+    virtual WebCore::SharedWorkerStrategy* createSharedWorkerStrategy();
     virtual WebCore::VisitedLinkStrategy* createVisitedLinkStrategy();
-    virtual WebCore::PasteboardStrategy* createPasteboardStrategy();
 
     // WebCore::CookiesStrategy
     virtual void notifyCookiesChanged();
diff --git a/Source/WebKit/efl/ewk/ewk_contextmenu.cpp b/Source/WebKit/efl/ewk/ewk_contextmenu.cpp
index e792c6d03..c4ad4533a 100644
--- a/Source/WebKit/efl/ewk/ewk_contextmenu.cpp
+++ b/Source/WebKit/efl/ewk/ewk_contextmenu.cpp
@@ -53,6 +53,7 @@ struct _Ewk_Context_Menu_Item {
 
     const char* title; /**< contains the title of the item */
     Ewk_Context_Menu* submenu; /**< contains the pointer to the submenu of the item */
+    Ewk_Context_Menu* parentMenu; /**< contains the pointer to parent menu of the item */
 
     bool checked : 1;
     bool enabled : 1;
@@ -98,14 +99,14 @@ const Eina_List* ewk_context_menu_item_list_get(const Ewk_Context_Menu* menu)
     return menu->items;
 }
 
-Ewk_Context_Menu_Item* ewk_context_menu_item_new(Ewk_Context_Menu_Item_Type type,
-                                                 Ewk_Context_Menu_Action action, Ewk_Context_Menu* submenu,
-                                                 const char* title, Eina_Bool checked, Eina_Bool enabled)
+Ewk_Context_Menu_Item* ewk_context_menu_item_new(Ewk_Context_Menu_Item_Type type, Ewk_Context_Menu_Action action, Ewk_Context_Menu* parentMenu,
+    Ewk_Context_Menu* submenu, const char* title, Eina_Bool checked, Eina_Bool enabled)
 {
     Ewk_Context_Menu_Item* item = new Ewk_Context_Menu_Item;
     item->type = type;
     item->action = action;
     item->title = eina_stringshare_add(title);
+    item->parentMenu = parentMenu;
     item->submenu = submenu;
     item->checked = checked;
     item->enabled = enabled;
@@ -203,6 +204,12 @@ Eina_Bool ewk_context_menu_item_enabled_set(Ewk_Context_Menu_Item* item, Eina_Bo
     return true;
 }
 
+Ewk_Context_Menu* ewk_context_menu_item_parent_get(const Ewk_Context_Menu_Item* item)
+{
+    EINA_SAFETY_ON_NULL_RETURN_VAL(item, 0);
+
+    return item->parentMenu;
+}
 
 /* internal methods ****************************************************/
 
@@ -276,9 +283,7 @@ void ewk_context_menu_item_append(Ewk_Context_Menu* menu, const WebCore::Context
     Ewk_Context_Menu_Item_Type type = static_cast<Ewk_Context_Menu_Item_Type>(core.type());
     Ewk_Context_Menu_Action action = static_cast<Ewk_Context_Menu_Action>(core.action());
 
-    Ewk_Context_Menu_Item* menu_item = ewk_context_menu_item_new
-                                           (type, action, 0, core.title().utf8().data(), core.checked(),
-                                           core.enabled());
+    Ewk_Context_Menu_Item* menu_item = ewk_context_menu_item_new(type, action, menu, 0, core.title().utf8().data(), core.checked(), core.enabled());
     EINA_SAFETY_ON_NULL_RETURN(menu_item);
 
     menu->items = eina_list_append(menu->items, menu_item);
diff --git a/Source/WebKit/efl/ewk/ewk_contextmenu.h b/Source/WebKit/efl/ewk/ewk_contextmenu.h
index af6d4a8b7..49ebad929 100644
--- a/Source/WebKit/efl/ewk/ewk_contextmenu.h
+++ b/Source/WebKit/efl/ewk/ewk_contextmenu.h
@@ -192,6 +192,7 @@ EAPI const Eina_List            *ewk_context_menu_item_list_get(const Ewk_Contex
  *
  * @param type specifies a type of the item
  * @param action specifies a action of the item
+ * @param parent_menu specifies a parent menu of the item
  * @param submenu specifies a submenu of the item
  * @param title specifies a title of the item
  * @param checked @c EINA_TRUE if the item should be toggled or @c EINA_FALSE if not
@@ -200,7 +201,7 @@ EAPI const Eina_List            *ewk_context_menu_item_list_get(const Ewk_Contex
  *
  * @note The return value @b should @b be freed after use.
  */
-EAPI Ewk_Context_Menu_Item      *ewk_context_menu_item_new(Ewk_Context_Menu_Item_Type type, Ewk_Context_Menu_Action action, Ewk_Context_Menu *submenu, const char *title, Eina_Bool checked, Eina_Bool enabled);
+EAPI Ewk_Context_Menu_Item      *ewk_context_menu_item_new(Ewk_Context_Menu_Item_Type type, Ewk_Context_Menu_Action action, Ewk_Context_Menu *parent_menu, Ewk_Context_Menu *submenu, const char *title, Eina_Bool checked, Eina_Bool enabled);
 
 /**
  * Destroys the item of the context menu object.
@@ -322,6 +323,14 @@ EAPI Eina_Bool                   ewk_context_menu_item_enabled_get(const Ewk_Con
  */
 EAPI Eina_Bool                   ewk_context_menu_item_enabled_set(Ewk_Context_Menu_Item *o, Eina_Bool enabled);
 
+/**
+ * Gets the parent menu for context menu item.
+ *
+ * @param o the context menu item object
+ * @return a context menu object on success or @c NULL on failure
+ */
+EAPI Ewk_Context_Menu           *ewk_context_menu_item_parent_get(const Ewk_Context_Menu_Item *o);
+
 #ifdef __cplusplus
 }
 #endif
diff --git a/Source/WebKit/efl/ewk/ewk_view.cpp b/Source/WebKit/efl/ewk/ewk_view.cpp
index 392199c11..faa55c202 100644
--- a/Source/WebKit/efl/ewk/ewk_view.cpp
+++ b/Source/WebKit/efl/ewk/ewk_view.cpp
@@ -31,6 +31,7 @@
 #include "ContextMenuController.h"
 #include "DocumentLoader.h"
 #include "DragClientEfl.h"
+#include "DumpRenderTreeSupportEfl.h"
 #include "EditorClientEfl.h"
 #include "EflScreenUtilities.h"
 #include "EventHandler.h"
@@ -85,6 +86,11 @@
 #include "DeviceOrientationClientEfl.h"
 #endif
 
+#if ENABLE(GEOLOCATION)
+#include "GeolocationClientMock.h"
+#include "GeolocationController.h"
+#endif
+
 #if ENABLE(VIBRATION)
 #include "VibrationClientEfl.h"
 #endif
@@ -94,7 +100,7 @@
 #endif
 
 #if USE(ACCELERATED_COMPOSITING)
-#include "NotImplemented.h"
+#include "AcceleratedCompositingContextEfl.h"
 #endif
 
 #if ENABLE(NETWORK_INFO)
@@ -158,6 +164,7 @@ static const Evas_Smart_Cb_Description _ewk_view_callback_names[] = {
     { "toolbars,visible,get", "b" },
     { "toolbars,visible,set", "b" },
     { "tooltip,text,set", "s" },
+    { "tooltip,text,unset", "s" },
     { "uri,changed", "s" },
     { "view,resized", "" },
     { "zoom,animated,end", "" },
@@ -250,6 +257,11 @@ struct _Ewk_View_Private_Data {
     WebCore::ViewportArguments viewportArguments;
     Ewk_History* history;
     OwnPtr<PageClientEfl> pageClient;
+#if USE(ACCELERATED_COMPOSITING)
+    OwnPtr<WebCore::AcceleratedCompositingContext> acceleratedCompositingContext;
+    bool isCompositingActive;
+    RefPtr<Evas_Object> compositingObject;
+#endif
 #if ENABLE(NETWORK_INFO)
     OwnPtr<WebCore::NetworkInfoClientEfl> networkInfoClient;
 #endif
@@ -778,6 +790,14 @@ static Ewk_View_Private_Data* _ewk_view_priv_new(Ewk_View_Smart_Data* smartData)
     WebCore::provideNavigatorContentUtilsTo(priv->page.get(), priv->navigatorContentUtilsClient.get());
 #endif
 
+#if ENABLE(GEOLOCATION)
+    if (DumpRenderTreeSupportEfl::dumpRenderTreeModeEnabled()) {
+        WebCore::GeolocationClientMock* mock = new WebCore::GeolocationClientMock;
+        WebCore::provideGeolocationTo(priv->page.get(), mock);
+        mock->setController(WebCore::GeolocationController::from(priv->page.get()));
+    }
+#endif
+
     priv->pageSettings = priv->page->settings();
 
     WebCore::LayoutMilestones layoutMilestones = WebCore::DidFirstLayout | WebCore::DidFirstVisuallyNonEmptyLayout;
@@ -907,6 +927,10 @@ static Ewk_View_Private_Data* _ewk_view_priv_new(Ewk_View_Smart_Data* smartData)
 
     priv->contextMenu = 0;
 
+#if USE(ACCELERATED_COMPOSITING)
+    priv->isCompositingActive = false;
+#endif
+
     return priv;
 }
 
@@ -943,6 +967,10 @@ static void _ewk_view_priv_del(Ewk_View_Private_Data* priv)
     if (priv->contextMenu)
         ewk_context_menu_free(priv->contextMenu);
 
+#if USE(ACCELERATED_COMPOSITING)
+    priv->acceleratedCompositingContext = nullptr;
+#endif
+
     delete priv;
 }
 
@@ -3478,18 +3506,14 @@ void ewk_view_menubar_visible_get(Evas_Object* ewkView, bool* visible)
 
 /**
  * @internal
- * Set tooltip text and display if it is currently hidden.
- *
- * @param ewkView View.
- * @param text Text to set tooltip to.
- *
- * Emits signal: "tooltip,text,set" with a string. If tooltip must be actually
- * removed, text will be 0 or '\0'
  */
 void ewk_view_tooltip_text_set(Evas_Object* ewkView, const char* text)
 {
     DBG("ewkView=%p text=%s", ewkView, text);
-    evas_object_smart_callback_call(ewkView, "tooltip,text,set", (void*)text);
+    if (text && *text)
+        evas_object_smart_callback_call(ewkView, "tooltip,text,set", (void*)text);
+    else
+        evas_object_smart_callback_call(ewkView, "tooltip,text,unset", 0);
 }
 
 /**
@@ -4494,16 +4518,92 @@ void ewk_view_inspector_view_set(Evas_Object* ewkView, Evas_Object* inspectorVie
 }
 
 #if USE(ACCELERATED_COMPOSITING)
-bool ewk_view_accelerated_compositing_object_create(Evas_Object*, Evas_Native_Surface*, const WebCore::IntRect& /*rect*/)
+void _ewk_view_accelerated_compositing_cb(void* data, Evas_Object*)
 {
-    notImplemented();
-    return false;
+    Ewk_View_Private_Data* priv = static_cast<Ewk_View_Private_Data*>(data);
+
+    if (priv->isCompositingActive) {
+        priv->acceleratedCompositingContext->syncLayersNow();
+        priv->acceleratedCompositingContext->renderLayers();
+    }
 }
 
-WebCore::GraphicsContext3D* ewk_view_accelerated_compositing_context_get(Evas_Object*)
+void _ewk_view_accelerated_compositing_context_create_if_needed(Evas_Object* ewkView)
 {
-    notImplemented();
-    return 0;
+    EWK_VIEW_SD_GET_OR_RETURN(ewkView, smartData);
+    EWK_VIEW_PRIV_GET_OR_RETURN(smartData, priv);
+
+    if (!priv->acceleratedCompositingContext)
+        priv->acceleratedCompositingContext = WebCore::AcceleratedCompositingContext::create(priv->page->chrome());
+}
+
+bool ewk_view_accelerated_compositing_object_create(Evas_Object* ewkView, Evas_Native_Surface* nativeSurface, const WebCore::IntRect& rect)
+{
+    EWK_VIEW_SD_GET_OR_RETURN(ewkView, smartData, false);
+    EWK_VIEW_PRIV_GET_OR_RETURN(smartData, priv, false);
+
+    if (!priv->compositingObject) {
+        priv->compositingObject = evas_object_image_add(smartData->base.evas);
+
+        evas_object_pass_events_set(priv->compositingObject.get(), true); // Just for rendering, ignore events.
+        evas_object_image_alpha_set(priv->compositingObject.get(), true);
+        evas_object_image_content_hint_set(priv->compositingObject.get(), EVAS_IMAGE_CONTENT_HINT_DYNAMIC);
+
+        // Set the pixel get callback.
+        evas_object_image_pixels_get_callback_set(priv->compositingObject.get(), _ewk_view_accelerated_compositing_cb, priv);
+
+        evas_object_smart_member_add(priv->compositingObject.get(), ewkView);
+    }
+
+    evas_object_image_size_set(priv->compositingObject.get(), rect.width(), rect.height());
+    evas_object_image_fill_set(priv->compositingObject.get(), 0, 0, rect.width(), rect.height());
+
+    evas_object_move(priv->compositingObject.get(), rect.x(), rect.y());
+    evas_object_resize(priv->compositingObject.get(), rect.width(), rect.height());
+    evas_object_hide(priv->compositingObject.get());
+
+    // Set up the native surface info to use the context and surface created in GC3DPrivate.
+    evas_object_image_native_surface_set(priv->compositingObject.get(), nativeSurface);
+    return true;
+}
+
+WebCore::GraphicsContext3D* ewk_view_accelerated_compositing_context_get(Evas_Object* ewkView)
+{
+    EWK_VIEW_SD_GET_OR_RETURN(ewkView, smartData, 0);
+    EWK_VIEW_PRIV_GET_OR_RETURN(smartData, priv, 0);
+
+    _ewk_view_accelerated_compositing_context_create_if_needed(ewkView);
+    return priv->acceleratedCompositingContext->context();
+}
+
+void ewk_view_root_graphics_layer_set(Evas_Object* ewkView, WebCore::GraphicsLayer* rootLayer)
+{
+    EWK_VIEW_SD_GET_OR_RETURN(ewkView, smartData);
+    EWK_VIEW_PRIV_GET_OR_RETURN(smartData, priv);
+
+    bool active = !!rootLayer;
+    if (priv->isCompositingActive == active)
+        return;
+
+    priv->isCompositingActive = active;
+
+    if (priv->isCompositingActive) {
+        _ewk_view_accelerated_compositing_context_create_if_needed(ewkView);
+        evas_object_show(priv->compositingObject.get());
+    } else
+        evas_object_hide(priv->compositingObject.get());
+
+    priv->acceleratedCompositingContext->attachRootGraphicsLayer(rootLayer);
+}
+
+void ewk_view_mark_for_sync(Evas_Object* ewkView)
+{
+    EWK_VIEW_SD_GET_OR_RETURN(ewkView, smartData);
+    EWK_VIEW_PRIV_GET_OR_RETURN(smartData, priv);
+
+    // Mark the image as "dirty" meaning it needs an update next time evas renders.
+    // It will call the pixel get callback then.
+    evas_object_image_pixels_dirty_set(priv->compositingObject.get(), true);
 }
 #endif
 
@@ -4647,6 +4747,14 @@ void ewk_view_fullscreen_exit(const Evas_Object* ewkView)
 }
 #endif
 
+Ewk_Context_Menu* ewk_view_context_menu_get(const Evas_Object* ewkView)
+{
+    EWK_VIEW_SD_GET_OR_RETURN(ewkView, smartData, 0);
+    EWK_VIEW_PRIV_GET_OR_RETURN(smartData, priv, 0);
+
+    return priv->contextMenu;
+}
+
 namespace EWKPrivate {
 
 WebCore::Page* corePage(const Evas_Object* ewkView)
diff --git a/Source/WebKit/efl/ewk/ewk_view.h b/Source/WebKit/efl/ewk/ewk_view.h
index c1a819fa3..106ba145e 100644
--- a/Source/WebKit/efl/ewk/ewk_view.h
+++ b/Source/WebKit/efl/ewk/ewk_view.h
@@ -103,7 +103,8 @@
  *    will be deleted.
  *  - "restore", Evas_Object *: reports that view should be restored to default conditions
  *    and it gives a frame that originated restore as an argument.
- *  - "tooltip,text,set", const char*: sets tooltip text and displays if it is currently hidden.
+ *  - "tooltip,text,set", const char*: tooltip was set.
+ *  - "tooltip,text,unset", void: tooltip was unset.
  *  - "uri,changed", const char*: uri of the main frame was changed.
  *  - "view,resized", void: view object's size was changed.
  *  - "viewport,changed", void: reports that viewport was changed.
@@ -113,6 +114,7 @@
 #ifndef ewk_view_h
 #define ewk_view_h
 
+#include "ewk_contextmenu.h"
 #include "ewk_file_chooser.h"
 #include "ewk_frame.h"
 #include "ewk_history.h"
@@ -2774,6 +2776,14 @@ EAPI Eina_Bool ewk_view_setting_enable_fullscreen_set(Evas_Object *o, Eina_Bool
  */
 EAPI Eina_Bool ewk_view_setting_enable_fullscreen_get(const Evas_Object *o);
 
+/**
+ * Gets the context menu object.
+ * @param o The view that contains context menu.
+ *
+ * @return context menu structure on success or @c NULL on failure
+ */
+EAPI Ewk_Context_Menu *ewk_view_context_menu_get(const Evas_Object *o);
+
 #ifdef __cplusplus
 }
 #endif
diff --git a/Source/WebKit/efl/ewk/ewk_view_private.h b/Source/WebKit/efl/ewk/ewk_view_private.h
index df7855d41..babd1eaa4 100644
--- a/Source/WebKit/efl/ewk/ewk_view_private.h
+++ b/Source/WebKit/efl/ewk/ewk_view_private.h
@@ -35,6 +35,10 @@ class ColorChooserClient;
 #endif
 
 class Cursor;
+#if USE(ACCELERATED_COMPOSITING)
+class GraphicsContext3D;
+class GraphicsLayer;
+#endif
 class PopupMenuClient;
 }
 
@@ -154,6 +158,8 @@ void ewk_view_mixed_content_run_set(Evas_Object* ewkView, bool hasRun);
 #if USE(ACCELERATED_COMPOSITING)
 bool ewk_view_accelerated_compositing_object_create(Evas_Object* ewkView, Evas_Native_Surface* nativeSurface, const WebCore::IntRect& rect);
 WebCore::GraphicsContext3D* ewk_view_accelerated_compositing_context_get(Evas_Object* ewkView);
+void ewk_view_root_graphics_layer_set(Evas_Object* ewkView, WebCore::GraphicsLayer* rootLayer);
+void ewk_view_mark_for_sync(Evas_Object* ewkView);
 #endif
 
 #if ENABLE(FULLSCREEN_API)
diff --git a/Source/WebKit/efl/ewk/ewk_view_single.cpp b/Source/WebKit/efl/ewk/ewk_view_single.cpp
index 294bbc8e1..de0eb897c 100644
--- a/Source/WebKit/efl/ewk/ewk_view_single.cpp
+++ b/Source/WebKit/efl/ewk/ewk_view_single.cpp
@@ -30,6 +30,11 @@
 #include <eina_safety_checks.h>
 #include <string.h>
 
+#if ENABLE(INSPECTOR)
+#include "InspectorController.h"
+#include "Page.h"
+#endif
+
 static Ewk_View_Smart_Class _parent_sc = EWK_VIEW_SMART_CLASS_INIT_NULL;
 
 static void _ewk_view_single_on_del(void* data, Evas*, Evas_Object*, void*)
@@ -266,6 +271,15 @@ static Eina_Bool _ewk_view_single_smart_repaints_process(Ewk_View_Smart_Data* sm
         evas_object_image_data_update_add(smartData->backing_store, rect->x, rect->y, rect->w, rect->h);
     }
 
+#if ENABLE(INSPECTOR)
+    WebCore::Page* page = EWKPrivate::corePage(smartData->self);
+    if (page) {
+        WebCore::InspectorController* controller = page->inspectorController();
+        if (controller->highlightedNode())
+            controller->drawHighlight(*context->graphicContext);
+    }
+#endif
+
     ewk_paint_context_restore(context);
     ewk_paint_context_free(context);
 
diff --git a/Source/WebKit/efl/tests/test_ewk_contextmenu.cpp b/Source/WebKit/efl/tests/test_ewk_contextmenu.cpp
new file mode 100644
index 000000000..02940e192
--- /dev/null
+++ b/Source/WebKit/efl/tests/test_ewk_contextmenu.cpp
@@ -0,0 +1,124 @@
+/*
+    Copyright (C) 2012 Samsung Electronics
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Lesser General Public
+    License as published by the Free Software Foundation; either
+    version 2.1 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+    Lesser General Public License for more details.
+
+    You should have received a copy of the GNU Lesser General Public License
+    along with this library; if not, write to the Free Software Foundation,
+    Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
+*/
+
+#include "config.h"
+
+#include "UnitTestUtils/EWKTestBase.h"
+#include "UnitTestUtils/EWKTestConfig.h"
+#include <EWebKit.h>
+#include <Ecore.h>
+#include <wtf/OwnPtr.h>
+#include <wtf/PassOwnPtr.h>
+
+using namespace EWKUnitTests;
+
+/**
+ * @brief Checking whether function creates proper menu item.
+ *
+ * This test creates a menu item and checks if all menu item's attributes are
+ * the same as passed to tested function.
+ */
+TEST_F(EWKTestBase, ewk_context_menu_item_new)
+{
+    loadUrl();
+
+    Evas* evas = evas_object_evas_get(webView());
+    ASSERT_TRUE(evas);
+
+    Evas_Event_Mouse_Down mouseDown;
+    mouseDown.button = 3;
+    mouseDown.output.x = 0;
+    mouseDown.output.y = 0;
+    mouseDown.canvas.x = 0;
+    mouseDown.canvas.y = 0;
+    mouseDown.data = 0;
+    mouseDown.modifiers = const_cast<Evas_Modifier*>(evas_key_modifier_get(evas));
+    mouseDown.locks = const_cast<Evas_Lock*>(evas_key_lock_get(evas));
+    mouseDown.flags = EVAS_BUTTON_NONE;
+    mouseDown.timestamp = ecore_loop_time_get();
+    mouseDown.event_flags = EVAS_EVENT_FLAG_NONE;
+    mouseDown.dev = 0;
+
+    ASSERT_TRUE(ewk_view_context_menu_forward_event(webView(), &mouseDown));
+
+    Ewk_Context_Menu* contextMenu = ewk_view_context_menu_get(webView());
+
+    ASSERT_TRUE(contextMenu);
+
+    Ewk_Context_Menu_Item_Type itemType = EWK_ACTION_TYPE;
+    Ewk_Context_Menu_Action itemAction = EWK_CONTEXT_MENU_ITEM_CUSTOM_TAG_NO_ACTION;
+    const char* itemTitle = "Test Item";
+    bool itemChecked = false;
+    bool itemEnabled = false;
+
+    Ewk_Context_Menu_Item* contextMenuItem = ewk_context_menu_item_new(itemType, itemAction, contextMenu, 0, itemTitle, itemChecked, itemEnabled);
+
+    ASSERT_TRUE(contextMenuItem);
+
+    EXPECT_EQ(itemType, ewk_context_menu_item_type_get(contextMenuItem));
+    EXPECT_EQ(itemAction, ewk_context_menu_item_action_get(contextMenuItem));
+    EXPECT_EQ(contextMenu, ewk_context_menu_item_parent_get(contextMenuItem));
+    EXPECT_STREQ(itemTitle, ewk_context_menu_item_title_get(contextMenuItem));
+    EXPECT_EQ(itemChecked, ewk_context_menu_item_checked_get(contextMenuItem));
+    EXPECT_EQ(itemEnabled, ewk_context_menu_item_enabled_get(contextMenuItem));
+
+    ewk_context_menu_item_free(contextMenuItem);
+}
+
+/**
+ * @brief Checking whether function returns proper parent menu.
+ *
+ * This test creates a context menus, and checks if created context menu's
+ * parent is the same for each of menu items.
+ */
+TEST_F(EWKTestBase, ewk_context_menu_item_parent_get)
+{
+    loadUrl();
+
+    Evas* evas = evas_object_evas_get(webView());
+    ASSERT_TRUE(evas);
+
+    Evas_Event_Mouse_Down mouseDown;
+    mouseDown.button = 3;
+    mouseDown.output.x = 0;
+    mouseDown.output.y = 0;
+    mouseDown.canvas.x = 0;
+    mouseDown.canvas.y = 0;
+    mouseDown.data = 0;
+    mouseDown.modifiers = const_cast<Evas_Modifier*>(evas_key_modifier_get(evas));
+    mouseDown.locks = const_cast<Evas_Lock*>(evas_key_lock_get(evas));
+    mouseDown.flags = EVAS_BUTTON_NONE;
+    mouseDown.timestamp = ecore_loop_time_get();
+    mouseDown.event_flags = EVAS_EVENT_FLAG_NONE;
+    mouseDown.dev = 0;
+
+    ASSERT_TRUE(ewk_view_context_menu_forward_event(webView(), &mouseDown));
+
+    Ewk_Context_Menu* contextMenu = ewk_view_context_menu_get(webView());
+
+    ASSERT_TRUE(contextMenu);
+
+    const Eina_List* contextMenuItems = ewk_context_menu_item_list_get(contextMenu);
+
+    ASSERT_TRUE(contextMenuItems);
+
+    const Eina_List* listIterator;
+    void* data;
+    EINA_LIST_FOREACH(contextMenuItems, listIterator, data)
+        EXPECT_EQ(contextMenu, ewk_context_menu_item_parent_get(static_cast<Ewk_Context_Menu_Item*>(data)));
+}
diff --git a/Source/WebKit/efl/tests/test_ewk_view.cpp b/Source/WebKit/efl/tests/test_ewk_view.cpp
index 9fa23fb00..241580182 100644
--- a/Source/WebKit/efl/tests/test_ewk_view.cpp
+++ b/Source/WebKit/efl/tests/test_ewk_view.cpp
@@ -70,3 +70,35 @@ TEST_F(EWKTestBase, ewk_view_setting_enable_fullscreen)
     ASSERT_FALSE(ewk_view_setting_enable_fullscreen_get(webView()));
 #endif
 }
+
+/**
+ * @brief Checking whether function returns proper context menu structure.
+ *
+ * This test creates a context menu and checks if context menu structure
+ * is not NULL;
+ */
+TEST_F(EWKTestBase, ewk_view_context_menu_get)
+{
+    loadUrl();
+
+    Evas* evas = evas_object_evas_get(webView());
+    ASSERT_TRUE(evas);
+
+    Evas_Event_Mouse_Down mouseDown;
+    mouseDown.button = 3;
+    mouseDown.output.x = 0;
+    mouseDown.output.y = 0;
+    mouseDown.canvas.x = 0;
+    mouseDown.canvas.y = 0;
+    mouseDown.data = 0;
+    mouseDown.modifiers = const_cast<Evas_Modifier*>(evas_key_modifier_get(evas));
+    mouseDown.locks = const_cast<Evas_Lock*>(evas_key_lock_get(evas));
+    mouseDown.flags = EVAS_BUTTON_NONE;
+    mouseDown.timestamp = ecore_loop_time_get();
+    mouseDown.event_flags = EVAS_EVENT_FLAG_NONE;
+    mouseDown.dev = 0;
+
+    ASSERT_TRUE(ewk_view_context_menu_forward_event(webView(), &mouseDown));
+
+    ASSERT_TRUE(ewk_view_context_menu_get(webView()));
+}
diff --git a/Source/WebKit/gtk/ChangeLog b/Source/WebKit/gtk/ChangeLog
index f10856446..ec1d0efc1 100644
--- a/Source/WebKit/gtk/ChangeLog
+++ b/Source/WebKit/gtk/ChangeLog
@@ -1,3 +1,110 @@
+2012-11-05  Simon Fraser  <simon.fraser@apple.com>
+
+        Fix layer borders to cleaning appear and disappear on switching
+        https://bugs.webkit.org/show_bug.cgi?id=101136
+
+        Reviewed by Sam Weinig.
+
+        Remove the GraphicsLayerClient methods showDebugBorders() and
+        showRepaintCounter().
+
+        * WebCoreSupport/AcceleratedCompositingContext.h:
+        (AcceleratedCompositingContext):
+        * WebCoreSupport/AcceleratedCompositingContextCairo.cpp:
+        * WebCoreSupport/AcceleratedCompositingContextClutter.cpp:
+        * WebCoreSupport/AcceleratedCompositingContextGL.cpp:
+
+2012-10-25  Martin Robinson  <mrobinson@igalia.com>
+
+        [GTK] Move soup authentication from GtkAuthenticationDialog to WebCore
+        https://bugs.webkit.org/show_bug.cgi?id=99914
+
+        Reviewed by Carlos Garcia Campos.
+
+        The calls which actually authenticate a soup message are gone from the GtkAuthenticationDialog. Since the
+        GtkAuthenticationDialog exposed by the WebKitSoupAuthentication class in the GTK+ API work without a
+        ResourceHandle (they are more general), we add a WebKitSoupAuthDialogAuthenticationClient added to avoid
+        breaking API. This is unused by either Epiphany or internally in WebKitGTK+.
+
+        * WebCoreSupport/FrameLoaderClientGtk.cpp:
+        (WebKit::FrameLoaderClient::dispatchDidReceiveAuthenticationChallenge): The authentication dialog
+        now just takes the AuthenticationChallenge instead of the libsoup objects.
+        * webkit/webkitsoupauthdialog.cpp:
+        (WebKitSoupAuthDialogAuthenticationClient): Added this helper.
+        (sessionAuthenticate): Use the new WebKitSoupAuthDialogAuthenticationClient.
+
+2012-11-02  Martin Robinson  <mrobinson@igalia.com>
+
+        [GTK] Remove dependency on SoupPasswordManager
+        https://bugs.webkit.org/show_bug.cgi?id=100775
+
+        Reviewed by Carlos Garcia Campos.
+
+        Add a libsecret dependency to the build. This is necessary so that we can remove
+        a dependency on SoupPasswordManager.
+
+        * GNUmakefile.am: Use libsecret libs during WebKit1 library compilation.
+
+2012-10-24  Brady Eidson  <beidson@apple.com>
+
+        Add a strategy for loader customization.
+        https://bugs.webkit.org/show_bug.cgi?id=100278
+
+        Reviewed by Alexey Proskuryakov.
+
+        * WebCoreSupport/PlatformStrategiesGtk.cpp:
+        (PlatformStrategiesGtk::createLoaderStrategy):
+        * WebCoreSupport/PlatformStrategiesGtk.h:
+        (PlatformStrategiesGtk):
+
+2012-10-23  Alexey Proskuryakov  <ap@apple.com>
+
+        Add a strategy for shared workers
+        https://bugs.webkit.org/show_bug.cgi?id=100165
+
+        Reviewed by Brady Eidson.
+
+        * WebCoreSupport/PlatformStrategiesGtk.cpp:
+        (PlatformStrategiesGtk::createPasteboardStrategy):
+        (PlatformStrategiesGtk::createSharedWorkerStrategy):
+        (PlatformStrategiesGtk::createVisitedLinkStrategy):
+        * WebCoreSupport/PlatformStrategiesGtk.h:
+
+2012-10-24  Priit Laes  <plaes@plaes.org>
+
+        [GTK] Typos in user-visible strings: "coordintate"
+        https://bugs.webkit.org/show_bug.cgi?id=100252
+
+        Reviewed by Martin Robinson.
+
+        s/coordintate/coordinate
+
+        * webkit/webkithittestresult.cpp:
+        (webkit_hit_test_result_class_init):
+
+2012-10-23  Martin Robinson  <mrobinson@igalia.com>
+
+        [GTK][Soup] Implement the default authentication dialog via WebCoreSupport
+        https://bugs.webkit.org/show_bug.cgi?id=99351
+
+        Reviewed by Carlos Garcia Campos.
+
+        Instead of using a custom SoupSessionFeature to show the authentication dialog,
+        show it using the corresponding WebCore message.
+
+        * WebCoreSupport/FrameLoaderClientGtk.cpp:
+        (WebKit::FrameLoaderClient::dispatchDidReceiveAuthenticationChallenge):
+        Show the dialog when we need to authenticate. Also, so not show the dialog
+        if we are in DRT mode.
+        * webkit/webkitglobals.cpp:
+        (webkitInit): No longer install our SoupFeature.
+
+2012-10-23  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        Unreviewed. Update NEWS and configure.ac for 1.11.1 release
+
+        * NEWS: Added release notes for 1.11.1.
+
 2012-10-23  Andras Becsi  <andras.becsi@digia.com>
 
         Remove devicePixelRatio from ViewportAttributes
diff --git a/Source/WebKit/gtk/GNUmakefile.am b/Source/WebKit/gtk/GNUmakefile.am
index 5be9eb548..8997703cf 100644
--- a/Source/WebKit/gtk/GNUmakefile.am
+++ b/Source/WebKit/gtk/GNUmakefile.am
@@ -95,6 +95,7 @@ libwebkitgtk_@WEBKITGTK_API_MAJOR_VERSION@_@WEBKITGTK_API_MINOR_VERSION@_la_LIBA
 	$(GSTREAMER_LIBS) \
 	$(GTK_LIBS) \
 	$(JPEG_LIBS) \
+	$(LIBSECRET_LIBS) \
 	$(LIBSOUP_LIBS) \
 	$(LIBXML_LIBS) \
 	$(LIBXSLT_LIBS) \
@@ -329,7 +330,10 @@ gir_DATA = $(WEBKIT_GIRSOURCES) $(JSCORE_GIRSOURCES)
 typelibsdir += $(libdir)/girepository-1.0
 typelibs_DATA += $(JSCORE_GIRSOURCES:.gir=.typelib) $(WEBKIT_GIRSOURCES:.gir=.typelib)
 
-%.typelib: %.gir $(G_IR_COMPILER)
+WebKit-@WEBKITGTK_API_VERSION@.typelib: WebKit-@WEBKITGTK_API_VERSION@.gir $(G_IR_COMPILER)
+	$(AM_V_GEN)$(G_IR_COMPILER) --includedir $(WebKit) --includedir $(top_builddir) $< -o $@
+
+JSCore-@WEBKITGTK_API_VERSION@.typelib: JSCore-@WEBKITGTK_API_VERSION@.gir $(G_IR_COMPILER)
 	$(AM_V_GEN)$(G_IR_COMPILER) --includedir $(WebKit) --includedir $(top_builddir) $< -o $@
 
 CLEANFILES += $(JSCORE_GIRSOURCES) $(WEBKIT_GIRSOURCES) $(typelibs_DATA)
diff --git a/Source/WebKit/gtk/NEWS b/Source/WebKit/gtk/NEWS
index 9f86b12ad..74e1dd22e 100644
--- a/Source/WebKit/gtk/NEWS
+++ b/Source/WebKit/gtk/NEWS
@@ -1,4 +1,74 @@
 =================
+WebKitGTK+ 1.11.1
+=================
+
+What's new in WebKitGTK+ 1.11.1?
+
+  - Make WebKitWebView work again inside a GtkOverlay by not using a
+    native window for Accelerated Compositing implementation.
+  - Use XDamage to improve accelerated compositing performance.
+  - Enable the edge distance anti-aliasing for accelerated compositing
+    layers.
+  - Add support to build with EGL OpenGL backend.
+  - Add support for WebAudio.
+  - Fix several API breaks in DOM bindings introduced in 1.9.6.
+  - Save the original URI for downloaded files as GIO metadata of the
+    destination file.
+  - Add API for controlling the user agent to WebKit2.
+  - Add API to WebKit2 to allow running JavaScripts from a
+    WebKitWebView using a GResource containing the script.
+  - Add Undo/Redo and SelectAll predefined editing commands to WebKit2
+    GTK+ API.
+  - Add a setting to enable/disable smooth scrolling to WebKit2 GTK+
+    API.
+  - Add API to get the web view that initiated a custom URI request to
+    WebKit2 GTK+.
+  - Implement ViewState methods of WebKitWebView in WebKit2.
+  - Add API to get/set the security policy of a given URI scheme to
+    WebKit2 GTK+.
+  - Add WebKitWebView:is-loading property to WebKit2 GTK+ API.
+  - Change spellchecker languages API in WebKit2 to use a GStrv for
+    the list of languages to make the API more consistent and
+    convenient to use.
+  - Add destroy notify parameter to
+    webkit_web_context_register_uri_scheme in WebKit2 GTK+ API.
+  - Replace webkit_web_view_replace_content with
+    webkit_web_view_load_alternate_html in WebKit2 GTK+ API.
+  - Rename WebKitWebView "print-requested" signal to "print" in
+    WebKit2 GTK+ API for consistenty.
+  - Add API to set preferred languages to WebKit2 GTK+.
+  - Add webkit_uri_response_get_suggested_filename to WebKit2 GTK+
+    API.
+  - Add API to save a web page in MHTML format to WebKit2 GTK+.
+  - Implement smart separators for context menu in WebKit2 GTK+.
+  - Sanitize the suggested filename when building the download
+    destination URI in WebKit2.
+  - Fix disk cache in WebKit2 to actually dump the contents to disk.
+  - Fix a crash in WebKit2 when navigating between pages in the
+    history cache.
+  - Fix a crash in WebKit2 when a download initiated by the policy
+    checker fails.
+  - Fix a crash in network backend with non-UTF8 HTTP header names.
+  - Properly close audio device after playing sound.
+  - Purge unused favicons from IconDatabase after 30 days.
+  - Properly expose <legend> elements to ATs.
+  - The new accessibility CanvasRole is now mapped to ATK_ROLE_CANVAS.
+  - Fix an infinite loop in accessibility code.
+  - Fix a crash in
+    AccessibilityObject::accessibilityPlatformIncludesObject().
+  - Fix a crash in WebCore::HTMLSelectElement::selectedIndex().
+  - Fix caret-moved events not emitted for certain content.
+  - Fix incorrect/unexpected characters in the text of certain
+    accessibles.
+  - Implement AccessibilityUIElement::titleUIElement() and
+    AccessibilityUIElement::stringValue().
+  - Expose ROLE_TOGGLE_BUTTON instead of ROLE_PUSH_BUTTON when
+    aria-pressed is present.
+  - Fix LLint build with -g -02.
+  - Properly process GDK_SMOOTH_SCROLL events.
+  - Fix several memory leaks.
+
+=================
 WebKitGTK+ 1.9.6
 =================
 
diff --git a/Source/WebKit/gtk/WebCoreSupport/AcceleratedCompositingContext.h b/Source/WebKit/gtk/WebCoreSupport/AcceleratedCompositingContext.h
index 6572ea5ea..02597d16d 100644
--- a/Source/WebKit/gtk/WebCoreSupport/AcceleratedCompositingContext.h
+++ b/Source/WebKit/gtk/WebCoreSupport/AcceleratedCompositingContext.h
@@ -60,8 +60,6 @@ public:
     virtual void notifyAnimationStarted(const WebCore::GraphicsLayer*, double time);
     virtual void notifyFlushRequired(const WebCore::GraphicsLayer*);
     virtual void paintContents(const WebCore::GraphicsLayer*, WebCore::GraphicsContext&, WebCore::GraphicsLayerPaintingPhase, const WebCore::IntRect& rectToPaint);
-    virtual bool showDebugBorders(const WebCore::GraphicsLayer*) const;
-    virtual bool showRepaintCounter(const WebCore::GraphicsLayer*) const;
 
     void initialize();
 
diff --git a/Source/WebKit/gtk/WebCoreSupport/AcceleratedCompositingContextCairo.cpp b/Source/WebKit/gtk/WebCoreSupport/AcceleratedCompositingContextCairo.cpp
index 378903426..cc6942ee8 100644
--- a/Source/WebKit/gtk/WebCoreSupport/AcceleratedCompositingContextCairo.cpp
+++ b/Source/WebKit/gtk/WebCoreSupport/AcceleratedCompositingContextCairo.cpp
@@ -169,16 +169,6 @@ void AcceleratedCompositingContext::paintContents(const GraphicsLayer*, Graphics
     copyRectFromCairoSurfaceToContext(m_webView->priv->backingStore->cairoSurface(), cr, IntSize(), rectToPaint);
 }
 
-bool AcceleratedCompositingContext::showDebugBorders(const GraphicsLayer*) const
-{
-    return false;
-}
-
-bool AcceleratedCompositingContext::showRepaintCounter(const GraphicsLayer*) const
-{
-    return false;
-}
-
 } // namespace WebKit
 
 #endif // USE(ACCELERATED_COMPOSITING) && USE(TEXTURE_MAPPER_CAIRO)
diff --git a/Source/WebKit/gtk/WebCoreSupport/AcceleratedCompositingContextClutter.cpp b/Source/WebKit/gtk/WebCoreSupport/AcceleratedCompositingContextClutter.cpp
index 87ceb6ea0..9fcae5257 100644
--- a/Source/WebKit/gtk/WebCoreSupport/AcceleratedCompositingContextClutter.cpp
+++ b/Source/WebKit/gtk/WebCoreSupport/AcceleratedCompositingContextClutter.cpp
@@ -165,18 +165,6 @@ void AcceleratedCompositingContext::paintContents(const WebCore::GraphicsLayer*,
     ASSERT_NOT_REACHED();
 }
 
-bool AcceleratedCompositingContext::showDebugBorders(const WebCore::GraphicsLayer*) const
-{
-    ASSERT_NOT_REACHED();
-    return false;
-}
-
-bool AcceleratedCompositingContext::showRepaintCounter(const WebCore::GraphicsLayer*) const
-{
-    ASSERT_NOT_REACHED();
-    return false;
-}
-
 } // namespace WebKit
 
 #endif // USE(ACCELERATED_COMPOSITING) && USE(CLUTTER)
diff --git a/Source/WebKit/gtk/WebCoreSupport/AcceleratedCompositingContextGL.cpp b/Source/WebKit/gtk/WebCoreSupport/AcceleratedCompositingContextGL.cpp
index efc206193..d130a3fb7 100644
--- a/Source/WebKit/gtk/WebCoreSupport/AcceleratedCompositingContextGL.cpp
+++ b/Source/WebKit/gtk/WebCoreSupport/AcceleratedCompositingContextGL.cpp
@@ -383,16 +383,6 @@ void AcceleratedCompositingContext::paintContents(const GraphicsLayer*, Graphics
     context.restore();
 }
 
-bool AcceleratedCompositingContext::showDebugBorders(const GraphicsLayer*) const
-{
-    return false;
-}
-
-bool AcceleratedCompositingContext::showRepaintCounter(const GraphicsLayer*) const
-{
-    return false;
-}
-
 } // namespace WebKit
 
 #endif // USE(ACCELERATED_COMPOSITING) && USE(TEXTURE_MAPPER_GL)
diff --git a/Source/WebKit/gtk/WebCoreSupport/FrameLoaderClientGtk.cpp b/Source/WebKit/gtk/WebCoreSupport/FrameLoaderClientGtk.cpp
index d154b1d31..f3ccfc17f 100644
--- a/Source/WebKit/gtk/WebCoreSupport/FrameLoaderClientGtk.cpp
+++ b/Source/WebKit/gtk/WebCoreSupport/FrameLoaderClientGtk.cpp
@@ -32,6 +32,7 @@
 #include "DOMObjectCache.h"
 #include "DocumentLoader.h"
 #include "DocumentLoaderGtk.h"
+#include "DumpRenderTreeSupportGtk.h"
 #include "ErrorsGtk.h"
 #include "FileSystem.h"
 #include "FormState.h"
@@ -39,7 +40,9 @@
 #include "FrameNetworkingContextGtk.h"
 #include "FrameTree.h"
 #include "FrameView.h"
+#include "GtkAuthenticationDialog.h"
 #include "GtkPluginWidget.h"
+#include "GtkUtilities.h"
 #include "HTMLAppletElement.h"
 #include "HTMLFormElement.h"
 #include "HTMLFrameElement.h"
@@ -196,9 +199,17 @@ FrameLoaderClient::shouldUseCredentialStorage(WebCore::DocumentLoader*, unsigned
     return false;
 }
 
-void FrameLoaderClient::dispatchDidReceiveAuthenticationChallenge(WebCore::DocumentLoader*, unsigned long  identifier, const AuthenticationChallenge&)
+void FrameLoaderClient::dispatchDidReceiveAuthenticationChallenge(WebCore::DocumentLoader*, unsigned long  identifier, const AuthenticationChallenge& challenge)
 {
-    notImplemented();
+    if (DumpRenderTreeSupportGtk::dumpRenderTreeModeEnabled()) {
+        challenge.authenticationClient()->receivedRequestToContinueWithoutCredential(challenge);
+        return;
+    }
+
+    GtkWidget* toplevel = gtk_widget_get_toplevel(GTK_WIDGET(webkit_web_frame_get_web_view(m_frame)));
+    GtkWindow* toplevelWindow = widgetIsOnscreenToplevelWindow(toplevel) ? GTK_WINDOW(toplevel) : 0;
+    GtkAuthenticationDialog* dialog = new GtkAuthenticationDialog(toplevelWindow, challenge);
+    dialog->show();
 }
 
 void FrameLoaderClient::dispatchDidCancelAuthenticationChallenge(WebCore::DocumentLoader*, unsigned long  identifier, const AuthenticationChallenge&)
diff --git a/Source/WebKit/gtk/WebCoreSupport/PlatformStrategiesGtk.cpp b/Source/WebKit/gtk/WebCoreSupport/PlatformStrategiesGtk.cpp
index 9103c8460..00a7062c9 100644
--- a/Source/WebKit/gtk/WebCoreSupport/PlatformStrategiesGtk.cpp
+++ b/Source/WebKit/gtk/WebCoreSupport/PlatformStrategiesGtk.cpp
@@ -42,21 +42,31 @@ CookiesStrategy* PlatformStrategiesGtk::createCookiesStrategy()
     return this;
 }
 
+LoaderStrategy* PlatformStrategiesGtk::createLoaderStrategy()
+{
+    return this;
+}
+
+PasteboardStrategy* PlatformStrategiesGtk::createPasteboardStrategy()
+{
+    // This is currently used only by Mac code.
+    notImplemented();
+    return 0;
+}
+
 PluginStrategy* PlatformStrategiesGtk::createPluginStrategy()
 {
     return this;
 }
 
-VisitedLinkStrategy* PlatformStrategiesGtk::createVisitedLinkStrategy()
+SharedWorkerStrategy* PlatformStrategiesGtk::createSharedWorkerStrategy()
 {
     return this;
 }
 
-PasteboardStrategy* PlatformStrategiesGtk::createPasteboardStrategy()
+VisitedLinkStrategy* PlatformStrategiesGtk::createVisitedLinkStrategy()
 {
-    // This is currently used only by mac code.
-    notImplemented();
-    return 0;
+    return this;
 }
 
 // CookiesStrategy
diff --git a/Source/WebKit/gtk/WebCoreSupport/PlatformStrategiesGtk.h b/Source/WebKit/gtk/WebCoreSupport/PlatformStrategiesGtk.h
index 5506d172e..cf34ae24b 100644
--- a/Source/WebKit/gtk/WebCoreSupport/PlatformStrategiesGtk.h
+++ b/Source/WebKit/gtk/WebCoreSupport/PlatformStrategiesGtk.h
@@ -20,12 +20,14 @@
 #define PlatformStrategiesGtk_h
 
 #include "CookiesStrategy.h"
+#include "LoaderStrategy.h"
 #include "PasteboardStrategy.h"
 #include "PlatformStrategies.h"
 #include "PluginStrategy.h"
+#include "SharedWorkerStrategy.h"
 #include "VisitedLinkStrategy.h"
 
-class PlatformStrategiesGtk : public WebCore::PlatformStrategies, private WebCore::CookiesStrategy, private WebCore::PluginStrategy, private WebCore::VisitedLinkStrategy {
+class PlatformStrategiesGtk : public WebCore::PlatformStrategies, private WebCore::CookiesStrategy, private WebCore::LoaderStrategy, private WebCore::PluginStrategy, private WebCore::SharedWorkerStrategy, private WebCore::VisitedLinkStrategy {
 public:
     static void initialize();
 
@@ -34,9 +36,11 @@ private:
 
     // WebCore::PlatformStrategies
     virtual WebCore::CookiesStrategy* createCookiesStrategy();
+    virtual WebCore::LoaderStrategy* createLoaderStrategy();
+    virtual WebCore::PasteboardStrategy* createPasteboardStrategy();
     virtual WebCore::PluginStrategy* createPluginStrategy();
+    virtual WebCore::SharedWorkerStrategy* createSharedWorkerStrategy();
     virtual WebCore::VisitedLinkStrategy* createVisitedLinkStrategy();
-    virtual WebCore::PasteboardStrategy* createPasteboardStrategy();
 
     // WebCore::CookiesStrategy
     virtual void notifyCookiesChanged();
diff --git a/Source/WebKit/gtk/po/ChangeLog b/Source/WebKit/gtk/po/ChangeLog
index 47f47c130..fce5cdfce 100644
--- a/Source/WebKit/gtk/po/ChangeLog
+++ b/Source/WebKit/gtk/po/ChangeLog
@@ -1,3 +1,46 @@
+2012-11-05  Sandeep Shedmake  <sshedmak@redhat.com>
+
+        [l10n] [mr] Updated WebKitGTK+ Translation(s) in Marathi [mr] language
+        https://bugs.webkit.org/show_bug.cgi?id=100817
+
+        Rubber-stamped by Gustavo Noronha.
+
+        * mr.po: updated.
+
+2012-11-05  Andika Triwidada  <andika@gmail.com>
+
+        [l10n] updated id.po for WebKitGTK+
+        https://bugs.webkit.org/show_bug.cgi?id=100264
+
+        Rubber-stamped by Gustavo Noronha.
+
+        * id.po: updated.
+
+2012-10-26  Christian Kirbach  <Christian.Kirbach@gmail.com>
+
+        German de.po translation needs update
+        https://bugs.webkit.org/show_bug.cgi?id=91349
+
+        Rubber-stamped by Gustavo Noronha.
+
+        * de.po: updated with proof-read version.
+
+2012-10-23  Martin Robinson  <mrobinson@igalia.com>
+
+        POTFILES.in/.skip need updates for translators
+        https://bugs.webkit.org/show_bug.cgi?id=67580
+
+        Reviewed by Xan Lopez.
+
+        Move POTFILES to POTFILES.in to satisfy intltools-update and also update
+        the list of files with translations. Since the way the path is calculated
+        is different now, we also need to change the gettext invocation in
+        GNUmakefile.am.
+
+        * GNUmakefile.am:
+        * POTFILES: Removed.
+        * POTFILES.in: Added.
+
 2012-06-11  Arnaud Renevier  <arno@renevier.net>
 
         Replace obsolete mkdir_p variables with MKDIR_P
diff --git a/Source/WebKit/gtk/po/GNUmakefile.am b/Source/WebKit/gtk/po/GNUmakefile.am
index e524db090..ef718edda 100644
--- a/Source/WebKit/gtk/po/GNUmakefile.am
+++ b/Source/WebKit/gtk/po/GNUmakefile.am
@@ -69,7 +69,7 @@ stamp-po: $(top_builddir)/Source/WebKit/gtk/po/$(DOMAIN).pot $(MOFILES)
 
 # This target rebuilds $(DOMAIN).pot; it is an expensive operation.
 # Note that $(DOMAIN).pot is not touched if it doesn't need to be changed.
-$(DOMAIN).pot-update: $(POTFILES) $(srcdir)/Source/WebKit/gtk/po/POTFILES
+$(DOMAIN).pot-update: $(POTFILES) $(top_builddir)/Source/WebKit/gtk/po/POTFILES
 	test -d Source/WebKit/gtk/po/ || mkdir -p Source/WebKit/gtk/po/
 	package_gnu=''; \
 	if test -n '$(MSGID_BUGS_ADDRESS)' || test '$(PACKAGE_BUGREPORT)' = '@'PACKAGE_BUGREPORT'@'; then \
@@ -79,22 +79,32 @@ $(DOMAIN).pot-update: $(POTFILES) $(srcdir)/Source/WebKit/gtk/po/POTFILES
 	fi; \
 	case `$(XGETTEXT) --version | sed 1q | sed -e 's,^[^0-9]*,,'` in \
 	  '' | 0.[0-9] | 0.[0-9].* | 0.1[0-5] | 0.1[0-5].* | 0.16 | 0.16.[0-1]*) \
-	    $(XGETTEXT) --default-domain=$(DOMAIN) --directory=$(srcdir) \
-	      --add-comments=TRANSLATORS: $(XGETTEXT_OPTIONS) \
-	      --files-from=$(srcdir)/Source/WebKit/gtk/po/POTFILES \
-	      --copyright-holder='$(COPYRIGHT_HOLDER)' \
-	      --msgid-bugs-address="$$msgid_bugs_address" \
-	      --keyword=_ --keyword=N_ -o $(top_builddir)/Source/WebKit/gtk/po/$(DOMAIN).pot \
+	    $(XGETTEXT) \
+	        --default-domain=$(DOMAIN) \
+	        --directory=$(srcdir) \
+	        --directory=$(srcdir)/Source/WebKit/gtk \
+	        --add-comments=TRANSLATORS: $(XGETTEXT_OPTIONS) \
+	        --files-from=$(top_builddir)/Source/WebKit/gtk/po/POTFILES \
+	        --copyright-holder='$(COPYRIGHT_HOLDER)' \
+	        --msgid-bugs-address="$$msgid_bugs_address" \
+	        --keyword=_ \
+	        --keyword=N_ \
+	        -o $(top_builddir)/Source/WebKit/gtk/po/$(DOMAIN).pot \
 	    ;; \
 	  *) \
-	    $(XGETTEXT) --default-domain=$(DOMAIN) --directory=$(srcdir) \
-	      --add-comments=TRANSLATORS: $(XGETTEXT_OPTIONS) \
-	      --files-from=$(srcdir)/Source/WebKit/gtk/po/POTFILES \
-	      --copyright-holder='$(COPYRIGHT_HOLDER)' \
-	      --package-name="$${package_gnu}@PACKAGE@" \
-	      --package-version='@VERSION@' \
-	      --msgid-bugs-address="$$msgid_bugs_address" \
-	      --keyword=_ --keyword=N_ -o $(top_builddir)/Source/WebKit/gtk/po/$(DOMAIN).pot \
+	    $(XGETTEXT) \
+	        --default-domain=$(DOMAIN) \
+	        --directory=$(srcdir) \
+	        --directory=$(srcdir)/Source/WebKit/gtk \
+	        --add-comments=TRANSLATORS: $(XGETTEXT_OPTIONS) \
+	        --files-from=$(top_builddir)/Source/WebKit/gtk/po/POTFILES \
+	        --copyright-holder='$(COPYRIGHT_HOLDER)' \
+	        --package-name="$${package_gnu}@PACKAGE@" \
+	        --package-version='@VERSION@' \
+	        --msgid-bugs-address="$$msgid_bugs_address" \
+	        --keyword=_ \
+	        --keyword=N_ \
+	        -o $(top_builddir)/Source/WebKit/gtk/po/$(DOMAIN).pot \
 	    ;; \
 	esac
 
diff --git a/Source/WebKit/gtk/po/POTFILES b/Source/WebKit/gtk/po/POTFILES
deleted file mode 100644
index b4ac5b04e..000000000
--- a/Source/WebKit/gtk/po/POTFILES
+++ /dev/null
@@ -1,14 +0,0 @@
-# List of source files which contain translatable strings.
-Source/WebKit/gtk/WebCoreSupport/ChromeClientGtk.cpp
-Source/WebKit/gtk/WebCoreSupport/ContextMenuClientGtk.cpp
-Source/WebKit/gtk/WebCoreSupport/FullscreenVideoController.cpp
-Source/WebKit/gtk/webkit/webkitdownload.cpp
-Source/WebKit/gtk/webkit/webkitsoupauthdialog.cpp
-Source/WebKit/gtk/webkit/webkitwebframe.cpp
-Source/WebKit/gtk/webkit/webkitwebhistoryitem.cpp
-Source/WebKit/gtk/webkit/webkitwebinspector.cpp
-Source/WebKit/gtk/webkit/webkitwebnavigationaction.cpp
-Source/WebKit/gtk/webkit/webkitwebsettings.cpp
-Source/WebKit/gtk/webkit/webkitwebview.cpp
-Source/WebCore/platform/gtk/ErrorsGtk.cpp
-Source/WebCore/platform/gtk/LocalizedStringsGtk.cpp
diff --git a/Source/WebKit/gtk/po/POTFILES.in b/Source/WebKit/gtk/po/POTFILES.in
new file mode 100644
index 000000000..fa4718102
--- /dev/null
+++ b/Source/WebKit/gtk/po/POTFILES.in
@@ -0,0 +1,26 @@
+# List of source files which contain translatable strings.
+../../WebCore/platform/gtk/ErrorsGtk.cpp
+../../WebCore/platform/gtk/GtkAuthenticationDialog.cpp
+../../WebCore/platform/gtk/LocalizedStringsGtk.cpp
+WebCoreSupport/ChromeClientGtk.cpp
+WebCoreSupport/ContextMenuClientGtk.cpp
+WebCoreSupport/FullscreenVideoController.cpp
+webkit/webkitdownload.cpp
+webkit/webkitfavicondatabase.cpp
+webkit/webkitfilechooserrequest.cpp
+webkit/webkithittestresult.cpp
+webkit/webkiticondatabase.cpp
+webkit/webkitnetworkrequest.cpp
+webkit/webkitnetworkresponse.cpp
+webkit/webkitsecurityorigin.cpp
+webkit/webkitsoupauthdialog.cpp
+webkit/webkitviewportattributes.cpp
+webkit/webkitwebdatabase.cpp
+webkit/webkitwebframe.cpp
+webkit/webkitwebhistoryitem.cpp
+webkit/webkitwebinspector.cpp
+webkit/webkitwebnavigationaction.cpp
+webkit/webkitwebplugin.cpp
+webkit/webkitwebresource.cpp
+webkit/webkitwebsettings.cpp
+webkit/webkitwebview.cpp
diff --git a/Source/WebKit/gtk/po/de.po b/Source/WebKit/gtk/po/de.po
index b52beb55e..bdbb589d8 100644
--- a/Source/WebKit/gtk/po/de.po
+++ b/Source/WebKit/gtk/po/de.po
@@ -2,22 +2,25 @@
 # This file is put in the public domain.
 # Copyright (C) 2009 Christian Dywan <christian@twotoasts.de>, 2009.
 # Mario Blättermann <mario.blaettermann@gmail.com>, 2010, 2012.
-# Christian Kirbach <Christian.Kirbach@googlemail.com>, 2010, 2012.
+# Christian Kirbach <Christian.Kirbach@gmail.com>, 2010, 2012.
+# Wolfgang Stöggl <c72578@yahoo.de>, 2012.
 #
 msgid ""
 msgstr ""
 "Project-Id-Version: webkit HEAD\n"
 "Report-Msgid-Bugs-To: http://bugs.webkit.org\n"
 "POT-Creation-Date: 2010-12-27 15:26+0000\n"
-"PO-Revision-Date: 2012-01-29 19:03+0100\n"
-"Last-Translator: Christian Kirbach <Christian.Kirbach@googlemail.com>\n"
+"PO-Revision-Date: 2012-10-07 06:30+0200\n"
+"Last-Translator: Christian Kirbach <Christian.Kirbach@gmail.com>\n"
 "Language-Team: Deutsch <gnome-de@gnome.org>\n"
+"Language: de\n"
 "MIME-Version: 1.0\n"
 "Content-Type: text/plain; charset=UTF-8\n"
 "Content-Transfer-Encoding: 8bit\n"
 "Plural-Forms: nplurals=2; plural=(n != 1)\n"
 "X-Poedit-Language: German\n"
 "X-Poedit-Country: GERMANY\n"
+"X-Generator: Gtranslator 2.91.5\n"
 
 #: ../WebCoreSupport/ChromeClientGtk.cpp:589
 msgid "Upload File"
@@ -42,7 +45,7 @@ msgstr "LRE Von-links-nach-rechts-_Einbettung"
 
 #: ../WebCoreSupport/ContextMenuClientGtk.cpp:83
 msgid "RLE Right-to-left e_mbedding"
-msgstr "RLE Von-rechts-nach-Links-E_inbettung"
+msgstr "RLE Von-rechts-nach-links-E_inbettung"
 
 #: ../WebCoreSupport/ContextMenuClientGtk.cpp:84
 msgid "LRO Left-to-right _override"
@@ -211,11 +214,10 @@ msgid "Link URI"
 msgstr "Adresse des Verweises"
 
 #: ../webkit/webkithittestresult.cpp:172
-#, fuzzy
 msgid "The URI to which the target that received the event points, if any."
 msgstr ""
-"Die Adresse zum Ziel ?, welches die Ereignispunkte erhalten hat, falls "
-"überhaupt."
+"Die Adresse zu der das Ziel, welches das Ereignis erhielt, zeigt (falls "
+"verfügbar)."
 
 #: ../webkit/webkithittestresult.cpp:185
 msgid "Image URI"
@@ -247,7 +249,7 @@ msgstr "Innerer Knoten"
 
 #: ../webkit/webkithittestresult.cpp:222
 msgid "The inner DOM node associated with the hit test result."
-msgstr "Der innere DOM-Knoten, der mit Trefferergebnis verknüpft ist."
+msgstr "Der innere DOM-Knoten, der mit dem Trefferergebnis verknüpft ist."
 
 #: ../webkit/webkitnetworkrequest.cpp:134
 #: ../webkit/webkitnetworkresponse.cpp:134 ../webkit/webkitwebframe.cpp:323
@@ -282,45 +284,40 @@ msgid "Protocol"
 msgstr "Protokoll"
 
 #: ../webkit/webkitsecurityorigin.cpp:151
-#, fuzzy
 msgid "The protocol of the security origin"
-msgstr "Das Protokoll der ?"
+msgstr "Das Protokoll des Sicherheitsursprungs"
 
 #: ../webkit/webkitsecurityorigin.cpp:164
 msgid "Host"
 msgstr "Rechner"
 
 #: ../webkit/webkitsecurityorigin.cpp:165
-#, fuzzy
 msgid "The host of the security origin"
-msgstr "Der Rechner der ?"
+msgstr "Der Rechner des Sicherheitsursprungs"
 
 #: ../webkit/webkitsecurityorigin.cpp:178
 msgid "Port"
 msgstr "Port"
 
 #: ../webkit/webkitsecurityorigin.cpp:179
-#, fuzzy
 msgid "The port of the security origin"
-msgstr "Der Port der ?"
+msgstr "Der Port des Sicherheitsursprungs"
 
 #: ../webkit/webkitsecurityorigin.cpp:192
 msgid "Web Database Usage"
 msgstr "Verwendung der Web-Datenbank"
 
 #: ../webkit/webkitsecurityorigin.cpp:193
-#, fuzzy
 msgid "The cumulative size of all web databases in the security origin"
-msgstr "Die Gesamtgröße aller Web-Datenbanken im ?"
+msgstr "Die Gesamtgröße aller Web-Datenbanken im Sicherheitsursprung"
 
 #: ../webkit/webkitsecurityorigin.cpp:205
 msgid "Web Database Quota"
 msgstr "Speicherplatzbegrenzung der Web-Datenbank"
 
 #: ../webkit/webkitsecurityorigin.cpp:206
-#, fuzzy
 msgid "The web database quota of the security origin in bytes"
-msgstr "Die Speicherplatzbegrenzung des ? in Bytes"
+msgstr "Die Speicherplatzbegrenzung des Sicherheitsursprungs in Bytes"
 
 #: ../webkit/webkitsoupauthdialog.c:264
 #, c-format
@@ -345,12 +342,11 @@ msgstr "An Passwort _erinnern"
 
 #: ../webkit/webkitwebdatabase.cpp:173
 msgid "Security Origin"
-msgstr ""
+msgstr "Sicherheitsursprung"
 
 #: ../webkit/webkitwebdatabase.cpp:174
-#, fuzzy
 msgid "The security origin of the database"
-msgstr "Das ? der Datenbank"
+msgstr "Der Sicherheitsursprung der Datenbank"
 
 #: ../webkit/webkitwebdatabase.cpp:187 ../webkit/webkitwebframe.cpp:309
 msgid "Name"
@@ -720,7 +716,7 @@ msgstr "Schrittweite für Größenänderungen"
 
 #: ../webkit/webkitwebsettings.cpp:441
 msgid "The value by which the zoom level is changed when zooming in or out."
-msgstr "Der Wert für Größenänderungensstufen beim Vergrößern oder Verkleinern."
+msgstr "Der Wert für Größenänderungsstufen beim Vergrößern oder Verkleinern."
 
 #: ../webkit/webkitwebsettings.cpp:459
 msgid "Enable Developer Extras"
@@ -922,10 +918,8 @@ msgid "Enable Hyperlink Auditing"
 msgstr "Hyperlink-Auditing aktivieren"
 
 #: ../webkit/webkitwebsettings.cpp:902
-#, fuzzy
-#| msgid "Whether the page cache should be used"
 msgid "Whether <a ping> should be able to send pings"
-msgstr "Legt fest, ob <ein ping> pings senden können soll"
+msgstr "Legt fest, ob <a ping> Pings senden darf"
 
 #: ../webkit/webkitwebsettings.cpp:910
 msgid "Enable Fullscreen"
diff --git a/Source/WebKit/gtk/po/id.po b/Source/WebKit/gtk/po/id.po
index 199312e04..b7f5cb55d 100644
--- a/Source/WebKit/gtk/po/id.po
+++ b/Source/WebKit/gtk/po/id.po
@@ -1,1385 +1,1798 @@
 # Indonesian translation for webkit.
 # Copyright (C) 2010 webkit's COPYRIGHT HOLDER
 # This file is distributed under the same license as the webkit package.
-# Andika Triwidada <andika@gmail.com>, 2010.
+# Andika Triwidada <andika@gmail.com>, 2010, 2012.
 #
 msgid ""
 msgstr ""
 "Project-Id-Version: webkit HEAD\n"
 "Report-Msgid-Bugs-To: http://bugs.webkit.org\n"
-"POT-Creation-Date: 2010-09-22 03:26+0000\n"
-"PO-Revision-Date: 2010-09-24 14:25+0700\n"
+"POT-Creation-Date: 2012-10-24 06:37+0000\n"
+"PO-Revision-Date: 2012-10-24 21:03+0700\n"
 "Last-Translator: Andika Triwidada <andika@gmail.com>\n"
 "Language-Team: GNOME Indonesian Translation Team <gnome@i15n.org>\n"
+"Language: id_ID\n"
 "MIME-Version: 1.0\n"
 "Content-Type: text/plain; charset=UTF-8\n"
 "Content-Transfer-Encoding: 8bit\n"
-"X-Poedit-Language: Indonesian\n"
-"X-Poedit-Country: Indonesia\n"
+"Plural-Forms: nplurals=1; plural=0;\n"
+"X-Generator: Poedit 1.5.4\n"
 
-#: ../WebCoreSupport/ChromeClientGtk.cpp:569
-msgid "Upload File"
-msgstr "Unggah Berkas"
+#: ../../../WebCore/platform/gtk/ErrorsGtk.cpp:36
+msgid "Load request cancelled"
+msgstr "Permintaan memuat dibatalkan"
+
+#: ../../../WebCore/platform/gtk/ErrorsGtk.cpp:42
+msgid "Not allowed to use restricted network port"
+msgstr "Tak diijinkan memakai port jaringan yang dibatasi"
+
+#: ../../../WebCore/platform/gtk/ErrorsGtk.cpp:48
+msgid "URL cannot be shown"
+msgstr "URL tak bisa ditampilkan"
+
+#: ../../../WebCore/platform/gtk/ErrorsGtk.cpp:54
+msgid "Frame load was interrupted"
+msgstr "Pemuatan rangka terputus"
+
+#: ../../../WebCore/platform/gtk/ErrorsGtk.cpp:60
+msgid "Content with the specified MIME type cannot be shown"
+msgstr "Isi dengan jenis MIME yang dinyatakan tidak dapat ditampilkan"
+
+#: ../../../WebCore/platform/gtk/ErrorsGtk.cpp:66
+msgid "File does not exist"
+msgstr "Berkas tak ada"
+
+#: ../../../WebCore/platform/gtk/ErrorsGtk.cpp:72
+msgid "Plugin will handle load"
+msgstr "Plugin akan menangani beban"
+
+#: ../../../WebCore/platform/gtk/ErrorsGtk.cpp:84
+msgid "User cancelled the download"
+msgstr "Pengguna membatalkan pengunduhan"
+
+#: ../../../WebCore/platform/gtk/ErrorsGtk.cpp:104
+msgid "Printer not found"
+msgstr "Pencetak tak ditemukan"
+
+#: ../../../WebCore/platform/gtk/ErrorsGtk.cpp:111
+#| msgid "Enable page cache"
+msgid "Invalid page range"
+msgstr "Kisaran halaman tak valid"
+
+#: ../../../WebCore/platform/gtk/GtkAuthenticationDialog.cpp:123
+#, c-format
+msgid "A username and password are being requested by the site %s"
+msgstr "Suatu nama pengguna dan kata sandi sedang diminta oleh situs %s"
+
+#: ../../../WebCore/platform/gtk/GtkAuthenticationDialog.cpp:158
+msgid "Server message:"
+msgstr "Pesan server:"
+
+#: ../../../WebCore/platform/gtk/GtkAuthenticationDialog.cpp:181
+#: ../../../WebCore/platform/gtk/GtkAuthenticationDialog.cpp:184
+msgid "Username:"
+msgstr "Nama Pengguna:"
+
+#: ../../../WebCore/platform/gtk/GtkAuthenticationDialog.cpp:182
+#: ../../../WebCore/platform/gtk/GtkAuthenticationDialog.cpp:185
+msgid "Password:"
+msgstr "Kata Sandi:"
+
+#: ../../../WebCore/platform/gtk/GtkAuthenticationDialog.cpp:198
+msgid "_Remember password"
+msgstr "Ingat _sandi"
 
-#: ../WebCoreSupport/ContextMenuClientGtk.cpp:61
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:194
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:56
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:61
+msgid "Submit"
+msgstr "Kirim"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:66
+msgid "Reset"
+msgstr "Reset"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:71
+msgid "Details"
+msgstr "Rincian"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:76
+msgid "This is a searchable index. Enter search keywords: "
+msgstr "Ini adalah indeks yang dapat dicari. Masukkan kata kunci pencarian:"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:81
+msgid "Choose File"
+msgstr "Pilih Berkas"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:86
+#| msgid "Choose File"
+msgid "Choose Files"
+msgstr "Pilih Berkas"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:91
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:96
+msgid "(None)"
+msgstr "(Tidak ada)"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:101
+msgid "Open Link in New _Window"
+msgstr "Buka Taut di _Jendela Baru"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:106
+msgid "_Download Linked File"
+msgstr "Un_duh Berkas Tertaut"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:111
+msgid "Copy Link Loc_ation"
+msgstr "Salin Lokasi T_aut"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:116
+msgid "Open _Image in New Window"
+msgstr "Buka Gambar d_i Jendela Baru"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:121
+msgid "Sa_ve Image As"
+msgstr "Sim_pan Gambar Sebagai"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:126
+msgid "Cop_y Image"
+msgstr "Sal_in Gambar"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:131
+#| msgid "Cop_y Image"
+msgid "Copy Image _Address"
+msgstr "Salin _Alamat Gambar"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:136
+msgid "Open _Video in New Window"
+msgstr "Buka _Video pada Jendela Baru"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:141
+msgid "Open _Audio in New Window"
+msgstr "Buka Suar_a pada Jendela Baru"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:146
+msgid "Cop_y Video Link Location"
+msgstr "Salin Lokasi T_aut Video"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:151
+msgid "Cop_y Audio Link Location"
+msgstr "Salin Lokasi T_aut Suara"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:156
+msgid "_Toggle Media Controls"
+msgstr "Jungki_tkan Kendali Media"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:161
+msgid "Toggle Media _Loop Playback"
+msgstr "Jungkitkan Pengu_langan Memutar Media"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:166
+msgid "Switch Video to _Fullscreen"
+msgstr "Tukar Video ke Mode Layar _Penuh"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:171
+msgid "_Play"
+msgstr "_Putar"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:176
+msgid "_Pause"
+msgstr "_Jeda"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:181
+msgid "_Mute"
+msgstr "_Senyap"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:186
+msgid "Open _Frame in New Window"
+msgstr "Buka _Frame di Jendela Baru"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:209
+msgid "_Insert Unicode Control Character"
+msgstr "S_isipkan karakter Kontrol Unicode"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:214
 msgid "Input _Methods"
 msgstr "_Metoda Masukan"
 
-#: ../WebCoreSupport/ContextMenuClientGtk.cpp:78
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:237
+msgid "_Reload"
+msgstr "_Muat Ulang"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:254
+msgid "No Guesses Found"
+msgstr "Tebakan Tak Ditemukan"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:259
+msgid "_Ignore Spelling"
+msgstr "Aba_ikan Ejaan"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:264
+msgid "_Learn Spelling"
+msgstr "Pe_lajari Ejaan"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:269
+msgid "_Search the Web"
+msgstr "_Cari Web"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:274
+msgid "_Look Up in Dictionary"
+msgstr "_Lihat Di Kamus"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:279
+msgid "_Open Link"
+msgstr "_Buka Taut"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:284
+msgid "Ignore _Grammar"
+msgstr "Abaikan Tata _Bahasa"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:289
+msgid "Spelling and _Grammar"
+msgstr "Ejaan dan Tata _Bahasa"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:294
+msgid "_Show Spelling and Grammar"
+msgstr "Tampilkan Ejaan dan Tata Baha_sa"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:294
+msgid "_Hide Spelling and Grammar"
+msgstr "Sembunyikan Ejaan dan Tata Ba_hasa"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:299
+msgid "_Check Document Now"
+msgstr "Periksa Do_kumen Sekarang"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:304
+msgid "Check Spelling While _Typing"
+msgstr "Periksa Ejaan Ketika Menge_tik"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:309
+msgid "Check _Grammar With Spelling"
+msgstr "Periksa Tata _Bahasa Bersama Dengan Ejaan"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:314
+msgid "_Font"
+msgstr "_Fonta"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:337
+msgid "_Outline"
+msgstr "_Outline"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:342
+msgid "Inspect _Element"
+msgstr "Periksa _Elemen"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:347
 msgid "LRM _Left-to-right mark"
 msgstr "LRM _Left-to-right mark"
 
-#: ../WebCoreSupport/ContextMenuClientGtk.cpp:79
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:352
 msgid "RLM _Right-to-left mark"
 msgstr "RLM _Right-to-left mark"
 
-#: ../WebCoreSupport/ContextMenuClientGtk.cpp:80
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:357
 msgid "LRE Left-to-right _embedding"
 msgstr "LRE Left-to-right _embedding"
 
-#: ../WebCoreSupport/ContextMenuClientGtk.cpp:81
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:362
 msgid "RLE Right-to-left e_mbedding"
 msgstr "RLE Right-to-left e_mbedding"
 
-#: ../WebCoreSupport/ContextMenuClientGtk.cpp:82
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:367
 msgid "LRO Left-to-right _override"
 msgstr "LRO Left-to-right _override"
 
-#: ../WebCoreSupport/ContextMenuClientGtk.cpp:83
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:372
 msgid "RLO Right-to-left o_verride"
 msgstr "RLO Right-to-left o_verride"
 
-#: ../WebCoreSupport/ContextMenuClientGtk.cpp:84
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:377
 msgid "PDF _Pop directional formatting"
 msgstr "PDF _Pop directional formatting"
 
-#: ../WebCoreSupport/ContextMenuClientGtk.cpp:85
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:382
 msgid "ZWS _Zero width space"
 msgstr "ZWS _Zero width space"
 
-#: ../WebCoreSupport/ContextMenuClientGtk.cpp:86
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:387
 msgid "ZWJ Zero width _joiner"
 msgstr "ZWJ Zero width _joiner"
 
-#: ../WebCoreSupport/ContextMenuClientGtk.cpp:87
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:392
 msgid "ZWNJ Zero width _non-joiner"
 msgstr "ZWNJ Zero width _non-joiner"
 
-#: ../WebCoreSupport/ContextMenuClientGtk.cpp:109
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:189
-msgid "_Insert Unicode Control Character"
-msgstr "S_isipkan karakter Kontrol Unicode"
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:397
+msgid "No recent searches"
+msgstr "Tak ada pencarian terkini"
 
-#: ../WebCoreSupport/FrameLoaderClientGtk.cpp:1140
-msgid "Load request cancelled"
-msgstr "Permintaan memuat dibatalkan"
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:402
+msgid "Recent searches"
+msgstr "Pencarian terkini"
 
-#: ../WebCoreSupport/FrameLoaderClientGtk.cpp:1146
-msgid "Not allowed to use restricted network port"
-msgstr "Tak diijinkan memakai port jaringan yang dibatasi"
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:407
+msgid "_Clear recent searches"
+msgstr "_Bersihkan pencarian terkini"
 
-#: ../WebCoreSupport/FrameLoaderClientGtk.cpp:1152
-msgid "URL cannot be shown"
-msgstr "URL tak bisa ditampilkan"
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:412
+msgid "term"
+msgstr "istilah"
 
-#: ../WebCoreSupport/FrameLoaderClientGtk.cpp:1158
-msgid "Frame load was interrupted"
-msgstr "Pemuatan rangka terputus"
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:417
+msgid "definition"
+msgstr "definisi"
 
-#: ../WebCoreSupport/FrameLoaderClientGtk.cpp:1164
-msgid "Content with the specified MIME type cannot be shown"
-msgstr "Isi dengan jenis MIME yang dinyatakan tidak dapat ditampilkan"
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:422
+msgid "footer"
+msgstr "kaki"
 
-#: ../WebCoreSupport/FrameLoaderClientGtk.cpp:1170
-msgid "File does not exist"
-msgstr "Berkas tak ada"
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:427
+msgid "press"
+msgstr "tekan"
 
-#: ../WebCoreSupport/FrameLoaderClientGtk.cpp:1176
-msgid "Plugin will handle load"
-msgstr "Plugin akan menangani beban"
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:432
+msgid "select"
+msgstr "pilih"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:437
+msgid "activate"
+msgstr "aktifkan"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:442
+msgid "uncheck"
+msgstr "hapus contreng"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:447
+msgid "check"
+msgstr "contreng"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:452
+msgid "jump"
+msgstr "lompat"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:467
+msgid "Missing Plug-in"
+msgstr "Kehilangan Plug-in"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:473
+msgid "Plug-in Failure"
+msgstr "Kegagalan Plug-in"
+
+#. FIXME: If this file gets localized, this should really be localized as one string with a wildcard for the number.
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:491
+msgid " files"
+msgstr " berkas"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:496
+msgid "Unknown"
+msgstr "Tidak dikenal"
 
-#: ../WebCoreSupport/FullscreenVideoController.cpp:386
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:501
+#, c-format
+msgctxt "Title string for images"
+msgid "%s  (%dx%d pixels)"
+msgstr "%s  (%dx%d piksel)"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:513
+msgid "Loading..."
+msgstr "Sedang memuat..."
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:518
+msgid "Live Broadcast"
+msgstr "Siaran Langsung"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:524
+msgid "audio element controller"
+msgstr "pengendali elemen audio"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:526
+msgid "video element controller"
+msgstr "pengendali elemen video"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:528
+msgid "mute"
+msgstr "senyap"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:530
+msgid "unmute"
+msgstr "usai senyap"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:532
+msgid "play"
+msgstr "putar"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:534
+msgid "pause"
+msgstr "jeda"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:536
+msgid "movie time"
+msgstr "waktu film"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:538
+msgid "timeline slider thumb"
+msgstr "jempol penggeser waktu"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:540
+msgid "back 30 seconds"
+msgstr "mundur 30 detik"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:542
+msgid "return to realtime"
+msgstr "kembali ke waktu nyata"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:544
+msgid "elapsed time"
+msgstr "waktu berjalan"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:546
+msgid "remaining time"
+msgstr "sisa waktu"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:548
+msgid "status"
+msgstr "status"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:550
+#| msgid "fullscreen"
+msgid "enter fullscreen"
+msgstr "masuk mode layar penuh"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:552
+#| msgid "Exit Fullscreen"
+msgid "exit fullscreen"
+msgstr "keluar mode layar penuh"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:554
+msgid "fast forward"
+msgstr "maju cepat"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:556
+msgid "fast reverse"
+msgstr "mundur cepat"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:558
+msgid "show closed captions"
+msgstr "tampilkan takarir gambar"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:560
+msgid "hide closed captions"
+msgstr "sembunyikan takarir gambar"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:562
+#| msgid "_Toggle Media Controls"
+msgid "media controls"
+msgstr "kendali media"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:571
+msgid "audio element playback controls and status display"
+msgstr "tampilan status dan kendali main ulang elemen suara"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:573
+msgid "video element playback controls and status display"
+msgstr "tampilan status dan kendali main ulang elemen video"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:575
+msgid "mute audio tracks"
+msgstr "bisukan trek suara"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:577
+msgid "unmute audio tracks"
+msgstr "bunyikan trek suara"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:579
+msgid "begin playback"
+msgstr "mulai memutar"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:581
+msgid "pause playback"
+msgstr "jeda memutar"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:583
+msgid "movie time scrubber"
+msgstr "pembersih waktu film"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:585
+msgid "movie time scrubber thumb"
+msgstr "jempol pembersih waktu film"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:587
+msgid "seek movie back 30 seconds"
+msgstr "seem film mundur 30 detik"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:589
+msgid "return streaming movie to real time"
+msgstr "kembalikan film mengalir ke waktu nyata"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:591
+msgid "current movie time in seconds"
+msgstr "waktu film kini dalam detik"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:593
+msgid "number of seconds of movie remaining"
+msgstr "cacah detik sisa film"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:595
+msgid "current movie status"
+msgstr "status film kini"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:597
+msgid "seek quickly back"
+msgstr "seek mundur cepat"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:599
+msgid "seek quickly forward"
+msgstr "seek maju cepat"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:601
+msgid "Play movie in fullscreen mode"
+msgstr "Mainkan film pada mode layar penuh"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:603
+#| msgid "Exit from fullscreen mode"
+msgid "Exit fullscreen mode"
+msgstr "Keluar dari mode layar penuh"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:605
+msgid "start displaying closed captions"
+msgstr "mulai tampilkan takarir gambar"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:607
+msgid "stop displaying closed captions"
+msgstr "tak tampilkan lagi takarir gambar"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:616
+msgid "indefinite time"
+msgstr "waktu tak tentu"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:646
+msgid "value missing"
+msgstr "nilai hilang"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:682
+msgid "type mismatch"
+msgstr "jenis tak cocok"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:705
+msgid "pattern mismatch"
+msgstr "pola tak cocok"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:710
+msgid "too long"
+msgstr "terlalu panjang"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:715
+msgid "range underflow"
+msgstr "limpah bawah rentang"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:720
+msgid "range overflow"
+msgstr "limpah atas rentang"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:725
+msgid "step mismatch"
+msgstr "langkah tak cocok"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:730
+msgid "Unacceptable TLS certificate"
+msgstr "Sertifikat TLS tak dapat diterima"
+
+#: ../WebCoreSupport/FullscreenVideoController.cpp:389
 msgid "Play"
 msgstr "Putar"
 
-#: ../WebCoreSupport/FullscreenVideoController.cpp:388
+#: ../WebCoreSupport/FullscreenVideoController.cpp:391
 msgid "Pause"
 msgstr "Jeda"
 
-#: ../WebCoreSupport/FullscreenVideoController.cpp:534
+#: ../WebCoreSupport/FullscreenVideoController.cpp:541
 msgid "Play / Pause"
 msgstr "Putar / Jeda"
 
-#: ../WebCoreSupport/FullscreenVideoController.cpp:534
+#: ../WebCoreSupport/FullscreenVideoController.cpp:541
 msgid "Play or pause the media"
 msgstr "Putar atau tahan media"
 
-#: ../WebCoreSupport/FullscreenVideoController.cpp:542
+#: ../WebCoreSupport/FullscreenVideoController.cpp:549
 msgid "Time:"
 msgstr "Waktu:"
 
-#: ../WebCoreSupport/FullscreenVideoController.cpp:566
+#: ../WebCoreSupport/FullscreenVideoController.cpp:576
 msgid "Exit Fullscreen"
 msgstr "Keluar Mode Layar Penuh"
 
-#: ../WebCoreSupport/FullscreenVideoController.cpp:566
+#: ../WebCoreSupport/FullscreenVideoController.cpp:576
 msgid "Exit from fullscreen mode"
 msgstr "Keluar dari mode layar penuh"
 
-#: ../webkit/webkitdownload.cpp:272
+#: ../webkit/webkitdownload.cpp:276
 msgid "Network Request"
 msgstr "Request Jaringan"
 
-#: ../webkit/webkitdownload.cpp:273
+#: ../webkit/webkitdownload.cpp:277
 msgid "The network request for the URI that should be downloaded"
 msgstr "Request jaringan bagi URI yang mesti diunduh"
 
-#: ../webkit/webkitdownload.cpp:287
+#: ../webkit/webkitdownload.cpp:291
 msgid "Network Response"
 msgstr "Respon Jaringan"
 
-#: ../webkit/webkitdownload.cpp:288
+#: ../webkit/webkitdownload.cpp:292
 msgid "The network response for the URI that should be downloaded"
 msgstr "Respon jaringan bagi URI yang mesti diunduh"
 
-#: ../webkit/webkitdownload.cpp:302
+#: ../webkit/webkitdownload.cpp:306
 msgid "Destination URI"
 msgstr "URI tujuan"
 
-#: ../webkit/webkitdownload.cpp:303
+#: ../webkit/webkitdownload.cpp:307
 msgid "The destination URI where to save the file"
 msgstr "URI tujuan tempat menyimpan berkas"
 
-#: ../webkit/webkitdownload.cpp:317
+#: ../webkit/webkitdownload.cpp:321
 msgid "Suggested Filename"
 msgstr "Nama Berkas Yang Disarankan"
 
-#: ../webkit/webkitdownload.cpp:318
+#: ../webkit/webkitdownload.cpp:322
 msgid "The filename suggested as default when saving"
 msgstr "Nama berkas yang disarankan sebagai bawaan ketika menyimpan"
 
-#: ../webkit/webkitdownload.cpp:335
+#: ../webkit/webkitdownload.cpp:339
 msgid "Progress"
 msgstr "Kemajuan"
 
-#: ../webkit/webkitdownload.cpp:336
+#: ../webkit/webkitdownload.cpp:340
 msgid "Determines the current progress of the download"
 msgstr "Menyatakan tingkat kemajuan pengunduhan"
 
-#: ../webkit/webkitdownload.cpp:349
+#: ../webkit/webkitdownload.cpp:353
 msgid "Status"
 msgstr "Status"
 
-#: ../webkit/webkitdownload.cpp:350
+#: ../webkit/webkitdownload.cpp:354
 msgid "Determines the current status of the download"
 msgstr "Menyatakan status pengunduhan kini"
 
-#: ../webkit/webkitdownload.cpp:365
+#: ../webkit/webkitdownload.cpp:369
 msgid "Current Size"
 msgstr "Ukuran Kini"
 
-#: ../webkit/webkitdownload.cpp:366
+#: ../webkit/webkitdownload.cpp:370
 msgid "The length of the data already downloaded"
 msgstr "Panjang data yang telah diunduh"
 
-#: ../webkit/webkitdownload.cpp:380
+#: ../webkit/webkitdownload.cpp:384
 msgid "Total Size"
 msgstr "Ukuran Total"
 
-#: ../webkit/webkitdownload.cpp:381
+#: ../webkit/webkitdownload.cpp:385
 msgid "The total size of the file"
 msgstr "Ukuran total berkas"
 
-#: ../webkit/webkitdownload.cpp:533
-msgid "User cancelled the download"
-msgstr "Pengguna membatalkan pengunduhan"
-
-#: ../webkit/webkithittestresult.cpp:148
+#: ../webkit/webkitfavicondatabase.cpp:146
+#: ../webkit/webkitfavicondatabase.cpp:581
+msgid "Operation was cancelled"
+msgstr "Operasi dibatalkan"
+
+#: ../webkit/webkitfavicondatabase.cpp:255
+#: ../webkit/webkiticondatabase.cpp:150
+msgid "Path"
+msgstr "Path"
+
+#: ../webkit/webkitfavicondatabase.cpp:256
+#: ../webkit/webkiticondatabase.cpp:151
+#| msgid "The absolute filename of the Web Storage database"
+msgid "The absolute path of the icon database folder"
+msgstr "Path absolut dari folder basis data ikon"
+
+#: ../webkit/webkitfilechooserrequest.cpp:129
+#| msgid "MIME Type"
+msgid "MIME types filter"
+msgstr "Penyaring tipe MIME"
+
+#: ../webkit/webkitfilechooserrequest.cpp:130
+#| msgid "The inner DOM node associated with the hit test result."
+msgid "The filter currently associated with the request"
+msgstr "Penyaring yang kini terkait dengan permintaan"
+
+#: ../webkit/webkitfilechooserrequest.cpp:145
+#| msgid "MIME Type"
+msgid "MIME types"
+msgstr "Tipe MIME"
+
+#: ../webkit/webkitfilechooserrequest.cpp:146
+#| msgid "The inner DOM node associated with the hit test result."
+msgid "The list of MIME types associated with the request"
+msgstr "Daftar tipe MIME yang terkait dengan permintaan"
+
+#: ../webkit/webkitfilechooserrequest.cpp:161
+msgid "Select multiple files"
+msgstr "Pilih beberapa berkas"
+
+#: ../webkit/webkitfilechooserrequest.cpp:162
+msgid "Whether the file chooser should allow selecting multiple files"
+msgstr "Apakah pemilih berkas diperbolehkan memilih berkas berganda"
+
+#: ../webkit/webkitfilechooserrequest.cpp:177
+#| msgid " files"
+msgid "Selected files"
+msgstr "Berkas yang dipilih"
+
+#: ../webkit/webkitfilechooserrequest.cpp:178
+#| msgid "The inner DOM node associated with the hit test result."
+msgid "The list of selected files associated with the request"
+msgstr "Daftar berkas yang dipilih terkat dengan permintaan"
+
+#: ../webkit/webkithittestresult.cpp:175
 msgid "Context"
 msgstr "Konteks"
 
-#: ../webkit/webkithittestresult.cpp:149
+#: ../webkit/webkithittestresult.cpp:176
 msgid "Flags indicating the kind of target that received the event."
 msgstr "Flag yang mengindikasikan jenis target yang menerima kejadian."
 
-#: ../webkit/webkithittestresult.cpp:163
+#: ../webkit/webkithittestresult.cpp:190
 msgid "Link URI"
 msgstr "URI Taut"
 
-#: ../webkit/webkithittestresult.cpp:164
+#: ../webkit/webkithittestresult.cpp:191
 msgid "The URI to which the target that received the event points, if any."
 msgstr ""
 "URI tautan yang menjadi bagian dari target yang menerima kejadian, bila ada."
 
-#: ../webkit/webkithittestresult.cpp:177
+#: ../webkit/webkithittestresult.cpp:204
 msgid "Image URI"
 msgstr "URI Gambar"
 
-#: ../webkit/webkithittestresult.cpp:178
+#: ../webkit/webkithittestresult.cpp:205
 msgid ""
 "The URI of the image that is part of the target that received the event, if "
 "any."
 msgstr ""
 "URI gambar yang menjadi bagian dari target yang menerima kejadian, bila ada."
 
-#: ../webkit/webkithittestresult.cpp:191
+#: ../webkit/webkithittestresult.cpp:218
 msgid "Media URI"
 msgstr "URI Media"
 
-#: ../webkit/webkithittestresult.cpp:192
+#: ../webkit/webkithittestresult.cpp:219
 msgid ""
 "The URI of the media that is part of the target that received the event, if "
 "any."
 msgstr ""
 "URI media yang menjadi bagian dari target yang menerima kejadian, bila ada."
 
-#: ../webkit/webkithittestresult.cpp:213
+#: ../webkit/webkithittestresult.cpp:240
 msgid "Inner node"
 msgstr "Node dalam"
 
-#: ../webkit/webkithittestresult.cpp:214
+#: ../webkit/webkithittestresult.cpp:241
 msgid "The inner DOM node associated with the hit test result."
 msgstr "Node DOM dalam yang terkait dengan hasil uji hit."
 
-#: ../webkit/webkitnetworkrequest.cpp:136
-#: ../webkit/webkitnetworkresponse.cpp:134 ../webkit/webkitwebframe.cpp:315
-#: ../webkit/webkitwebhistoryitem.cpp:178 ../webkit/webkitwebresource.cpp:126
-#: ../webkit/webkitwebview.cpp:2603
+#: ../webkit/webkithittestresult.cpp:254
+msgid "X coordinate"
+msgstr "Koordinat X"
+
+# typo: coordintate -> coordinate
+#: ../webkit/webkithittestresult.cpp:255
+msgid "The x coordintate of the event relative to the view's window."
+msgstr "Koordinat x dari kejadian relatif terhadap jendela tilikan."
+
+#: ../webkit/webkithittestresult.cpp:268
+msgid "Y coordinate"
+msgstr "Koordinat Y"
+
+# typo: coordintate -> coordinate
+#: ../webkit/webkithittestresult.cpp:269
+msgid "The y coordintate of the event relative to the view's window."
+msgstr "Koordinat y dari kejadian relatif terhadap jendela tilikan."
+
+#: ../webkit/webkitnetworkrequest.cpp:134
+#: ../webkit/webkitnetworkresponse.cpp:143 ../webkit/webkitwebframe.cpp:484
+#: ../webkit/webkitwebhistoryitem.cpp:176 ../webkit/webkitwebresource.cpp:209
+#: ../webkit/webkitwebview.cpp:3103
 msgid "URI"
 msgstr "URI"
 
-#: ../webkit/webkitnetworkrequest.cpp:137
+#: ../webkit/webkitnetworkrequest.cpp:135
 msgid "The URI to which the request will be made."
 msgstr "URI kemana permintaan akan dibuat."
 
-#: ../webkit/webkitnetworkrequest.cpp:150
-#: ../webkit/webkitnetworkresponse.cpp:148
+#: ../webkit/webkitnetworkrequest.cpp:148
+#: ../webkit/webkitnetworkresponse.cpp:157
 msgid "Message"
 msgstr "Pesan"
 
-#: ../webkit/webkitnetworkrequest.cpp:151
+#: ../webkit/webkitnetworkrequest.cpp:149
 msgid "The SoupMessage that backs the request."
 msgstr "SoupMessage yang mendukung permintaan."
 
-#: ../webkit/webkitnetworkresponse.cpp:135
+#: ../webkit/webkitnetworkresponse.cpp:144
 msgid "The URI to which the response will be made."
 msgstr "URI kemana respon akan dibuat."
 
-#: ../webkit/webkitnetworkresponse.cpp:149
+#: ../webkit/webkitnetworkresponse.cpp:158
 msgid "The SoupMessage that backs the response."
 msgstr "SoupMessage yang mendukung respon."
 
-#: ../webkit/webkitsecurityorigin.cpp:151
+#: ../webkit/webkitnetworkresponse.cpp:171
+#| msgid "Suggested Filename"
+msgid "Suggested filename"
+msgstr "Nama berkas yang disarankan"
+
+#: ../webkit/webkitnetworkresponse.cpp:172
+#| msgid "The text encoding name of the resource"
+msgid "The suggested filename for the response."
+msgstr "Nama berkas yang disarankan bagi respon."
+
+#: ../webkit/webkitsecurityorigin.cpp:150
 msgid "Protocol"
 msgstr "Protokol"
 
-#: ../webkit/webkitsecurityorigin.cpp:152
+#: ../webkit/webkitsecurityorigin.cpp:151
 msgid "The protocol of the security origin"
 msgstr "Protokol dari asal keamanan"
 
-#: ../webkit/webkitsecurityorigin.cpp:165
+#: ../webkit/webkitsecurityorigin.cpp:164
 msgid "Host"
 msgstr "Host"
 
-#: ../webkit/webkitsecurityorigin.cpp:166
+#: ../webkit/webkitsecurityorigin.cpp:165
 msgid "The host of the security origin"
 msgstr "Host dari asal keamanan"
 
-#: ../webkit/webkitsecurityorigin.cpp:179
+#: ../webkit/webkitsecurityorigin.cpp:178
 msgid "Port"
 msgstr "Port"
 
-#: ../webkit/webkitsecurityorigin.cpp:180
+#: ../webkit/webkitsecurityorigin.cpp:179
 msgid "The port of the security origin"
 msgstr "Port dari asal keamanan"
 
-#: ../webkit/webkitsecurityorigin.cpp:193
+#: ../webkit/webkitsecurityorigin.cpp:192
 msgid "Web Database Usage"
 msgstr "Penggunaan Basis Data Web"
 
-#: ../webkit/webkitsecurityorigin.cpp:194
+#: ../webkit/webkitsecurityorigin.cpp:193
 msgid "The cumulative size of all web databases in the security origin"
 msgstr "Ukuran kumulatif dari semua basis data web dalam asal keamanan"
 
-#: ../webkit/webkitsecurityorigin.cpp:206
+#: ../webkit/webkitsecurityorigin.cpp:205
 msgid "Web Database Quota"
 msgstr "Kuota Basis Data Web"
 
-#: ../webkit/webkitsecurityorigin.cpp:207
+#: ../webkit/webkitsecurityorigin.cpp:206
 msgid "The web database quota of the security origin in bytes"
 msgstr "Kuota basis data web dari asal keamanan dalam byte"
 
-#: ../webkit/webkitsoupauthdialog.c:251
-#, c-format
-msgid "A username and password are being requested by the site %s"
-msgstr "Suatu nama pengguna dan kata sandi sedang diminta oleh situs %s"
+#: ../webkit/webkitviewportattributes.cpp:139
+msgid "Device Width"
+msgstr "Lebar Perangkat"
 
-#: ../webkit/webkitsoupauthdialog.c:281
-msgid "Server message:"
-msgstr "Pesan server:"
+#: ../webkit/webkitviewportattributes.cpp:140
+#| msgid "The uri of the resource"
+msgid "The width of the screen."
+msgstr "Lebar layar."
 
-#: ../webkit/webkitsoupauthdialog.c:294
-msgid "Username:"
-msgstr "Nama Pengguna:"
+#: ../webkit/webkitviewportattributes.cpp:161
+msgid "Device Height"
+msgstr "Tinggi Perangkat"
 
-#: ../webkit/webkitsoupauthdialog.c:296
-msgid "Password:"
-msgstr "Kata Sandi:"
+#: ../webkit/webkitviewportattributes.cpp:162
+#| msgid "The uri of the resource"
+msgid "The height of the screen."
+msgstr "Tinggi layar."
 
-#: ../webkit/webkitsoupauthdialog.c:305
-msgid "_Remember password"
-msgstr "Ingat _sandi"
+#: ../webkit/webkitviewportattributes.cpp:185
+msgid "Available Width"
+msgstr "Lebar Tersedia"
+
+#: ../webkit/webkitviewportattributes.cpp:186
+#| msgid "The title of the history item"
+msgid "The width of the visible area."
+msgstr "Lebar wilayah yang nampak."
 
-#: ../webkit/webkitwebdatabase.cpp:176
+#: ../webkit/webkitviewportattributes.cpp:209
+msgid "Available Height"
+msgstr "Tinggi Tersedia"
+
+#: ../webkit/webkitviewportattributes.cpp:210
+#| msgid "The title of the history item"
+msgid "The height of the visible area."
+msgstr "Lebar wilayah yang nampak."
+
+#: ../webkit/webkitviewportattributes.cpp:231
+msgid "Desktop Width"
+msgstr "Lebar Desktop"
+
+#: ../webkit/webkitviewportattributes.cpp:232
+msgid ""
+"The width of viewport that works well for most web pages designed for "
+"desktop."
+msgstr ""
+"Lebar viewport yang bekerja baik bagi kebanyakan halaman web yang dirancang "
+"untuk desktop."
+
+#: ../webkit/webkitviewportattributes.cpp:254
+msgid "Device DPI"
+msgstr "DPI Perangkat"
+
+#: ../webkit/webkitviewportattributes.cpp:255
+msgid "The number of dots per inch of the screen."
+msgstr "Banyaknya dot per inci layar."
+
+#: ../webkit/webkitviewportattributes.cpp:273
+msgid "Width"
+msgstr "Lebar"
+
+#: ../webkit/webkitviewportattributes.cpp:274
+#| msgid "The title of the history item"
+msgid "The width of the viewport."
+msgstr "Lebar viewport."
+
+#: ../webkit/webkitviewportattributes.cpp:292
+msgid "Height"
+msgstr "Tinggi"
+
+#: ../webkit/webkitviewportattributes.cpp:293
+#| msgid "The title of the history item"
+msgid "The height of the viewport."
+msgstr "Tinggi viewport."
+
+#: ../webkit/webkitviewportattributes.cpp:311
+msgid "Initial Scale Factor"
+msgstr "Faktor Skala Awal"
+
+#: ../webkit/webkitviewportattributes.cpp:312
+#| msgid "The total size of the file"
+msgid "The initial scale of the viewport."
+msgstr "Skala awal viewport."
+
+#: ../webkit/webkitviewportattributes.cpp:330
+#| msgid "Minimum Logical Font Size"
+msgid "Minimum Scale Factor"
+msgstr "Faktor Skala Minimum"
+
+#: ../webkit/webkitviewportattributes.cpp:331
+#| msgid "The title of the history item"
+msgid "The minimum scale of the viewport."
+msgstr "Skala minimum viewport."
+
+#: ../webkit/webkitviewportattributes.cpp:349
+msgid "Maximum Scale Factor"
+msgstr "Faktor Skala Maksimum"
+
+#: ../webkit/webkitviewportattributes.cpp:350
+#| msgid "The frame name of the resource"
+msgid "The maximum scale of the viewport."
+msgstr "Skala maksimum viewport."
+
+#: ../webkit/webkitviewportattributes.cpp:368
+msgid "Device Pixel Ratio"
+msgstr "Rasio Piksel Perangkat"
+
+#: ../webkit/webkitviewportattributes.cpp:369
+msgid "The device pixel ratio of the viewport."
+msgstr "Rasio piksel perangkat dari viewport."
+
+#: ../webkit/webkitviewportattributes.cpp:387
+msgid "user-scalable"
+msgstr "user-scalable"
+
+#: ../webkit/webkitviewportattributes.cpp:388
+msgid "User Scalable"
+msgstr "Dapat Diskala Oleh Pengguna"
+
+#: ../webkit/webkitviewportattributes.cpp:389
+msgid "Determines whether or not the user can zoom in and out."
+msgstr "Menentukan apakah pengguna dapat memperbesar dan memperkecil."
+
+#: ../webkit/webkitviewportattributes.cpp:406
+msgid "valid"
+msgstr "valid"
+
+#: ../webkit/webkitviewportattributes.cpp:407
+msgid "Valid"
+msgstr "Valid"
+
+#: ../webkit/webkitviewportattributes.cpp:408
+msgid "Determines whether or not the attributes are valid, and can be used."
+msgstr "Menentukan apakah atribut valid atau tidak, dan dapat dipakai."
+
+#: ../webkit/webkitwebdatabase.cpp:173
 msgid "Security Origin"
 msgstr "Asal Keamanan"
 
-#: ../webkit/webkitwebdatabase.cpp:177
+#: ../webkit/webkitwebdatabase.cpp:174
 msgid "The security origin of the database"
 msgstr "Asal keamanan dari basis data"
 
-#: ../webkit/webkitwebdatabase.cpp:190 ../webkit/webkitwebframe.cpp:301
+#: ../webkit/webkitwebdatabase.cpp:187 ../webkit/webkitwebframe.cpp:470
 msgid "Name"
 msgstr "Nama"
 
-#: ../webkit/webkitwebdatabase.cpp:191
+#: ../webkit/webkitwebdatabase.cpp:188
 msgid "The name of the Web Database database"
 msgstr "Nama dari basis data Basis Data Web"
 
-#: ../webkit/webkitwebdatabase.cpp:204
+#: ../webkit/webkitwebdatabase.cpp:201
 msgid "Display Name"
 msgstr "Nama Tampilan"
 
-#: ../webkit/webkitwebdatabase.cpp:205
+#: ../webkit/webkitwebdatabase.cpp:202
 msgid "The display name of the Web Storage database"
 msgstr "Nama tampilan dari basis data Penyimpanan Web"
 
-#: ../webkit/webkitwebdatabase.cpp:218
+#: ../webkit/webkitwebdatabase.cpp:215
 msgid "Expected Size"
 msgstr "Ukuran Diharapkan"
 
-#: ../webkit/webkitwebdatabase.cpp:219
+#: ../webkit/webkitwebdatabase.cpp:216
 msgid "The expected size of the Web Database database"
 msgstr "Ukuran yang diharapkan dari basis data Basis Data Web"
 
-#: ../webkit/webkitwebdatabase.cpp:231
+#: ../webkit/webkitwebdatabase.cpp:228
 msgid "Size"
 msgstr "Ukuran"
 
-#: ../webkit/webkitwebdatabase.cpp:232
+#: ../webkit/webkitwebdatabase.cpp:229
 msgid "The current size of the Web Database database"
 msgstr "Ukuran kini dari basis data Basis Data Web"
 
-#: ../webkit/webkitwebdatabase.cpp:244
+#: ../webkit/webkitwebdatabase.cpp:241
 msgid "Filename"
 msgstr "Nama berkas"
 
-#: ../webkit/webkitwebdatabase.cpp:245
+#: ../webkit/webkitwebdatabase.cpp:242
 msgid "The absolute filename of the Web Storage database"
 msgstr "Nama berkas absolut dari basis data Penyimpanan Web"
 
-#: ../webkit/webkitwebframe.cpp:302
+#: ../webkit/webkitwebframe.cpp:471
 msgid "The name of the frame"
 msgstr "Nama rangka"
 
-#: ../webkit/webkitwebframe.cpp:308 ../webkit/webkitwebhistoryitem.cpp:146
-#: ../webkit/webkitwebview.cpp:2589
+#: ../webkit/webkitwebframe.cpp:477 ../webkit/webkitwebhistoryitem.cpp:144
+#: ../webkit/webkitwebview.cpp:3089
 msgid "Title"
 msgstr "Judul"
 
-#: ../webkit/webkitwebframe.cpp:309
+#: ../webkit/webkitwebframe.cpp:478
 msgid "The document title of the frame"
 msgstr "Judul dokumen dari rangka"
 
-#: ../webkit/webkitwebframe.cpp:316
+#: ../webkit/webkitwebframe.cpp:485
 msgid "The current URI of the contents displayed by the frame"
 msgstr "URI kini dari isi yang ditampilkan oleh rangka"
 
-#: ../webkit/webkitwebframe.cpp:347
+#: ../webkit/webkitwebframe.cpp:516
 msgid "Horizontal Scrollbar Policy"
 msgstr "Kebijakan Penggulungan Horisontal"
 
-#: ../webkit/webkitwebframe.cpp:348
+#: ../webkit/webkitwebframe.cpp:517
 msgid ""
 "Determines the current policy for the horizontal scrollbar of the frame."
 msgstr ""
 "Menentukan kebijakan kini bagi bilah penggulung horisontal dari bingkai. "
 
-#: ../webkit/webkitwebframe.cpp:365
+#: ../webkit/webkitwebframe.cpp:534
 msgid "Vertical Scrollbar Policy"
 msgstr "Kebijakan Penggulungan Vertikal"
 
-#: ../webkit/webkitwebframe.cpp:366
+#: ../webkit/webkitwebframe.cpp:535
 msgid "Determines the current policy for the vertical scrollbar of the frame."
 msgstr ""
 "Menentukan kebijakan kini bagi bilah penggulung horisontal dari bingkai."
 
-#: ../webkit/webkitwebhistoryitem.cpp:147
+#: ../webkit/webkitwebhistoryitem.cpp:145
 msgid "The title of the history item"
 msgstr "Judul butir riwayat"
 
-#: ../webkit/webkitwebhistoryitem.cpp:162
+#: ../webkit/webkitwebhistoryitem.cpp:160
 msgid "Alternate Title"
 msgstr "Judul Alternatif"
 
-#: ../webkit/webkitwebhistoryitem.cpp:163
+#: ../webkit/webkitwebhistoryitem.cpp:161
 msgid "The alternate title of the history item"
 msgstr "Judul alternatif dari butir riwayat"
 
-#: ../webkit/webkitwebhistoryitem.cpp:179
+#: ../webkit/webkitwebhistoryitem.cpp:177
 msgid "The URI of the history item"
 msgstr "URI dari butir riwayat"
 
-#: ../webkit/webkitwebhistoryitem.cpp:194
-#: ../webkit/webkitwebnavigationaction.cpp:173
+#: ../webkit/webkitwebhistoryitem.cpp:192
+#: ../webkit/webkitwebnavigationaction.cpp:163
 msgid "Original URI"
 msgstr "URI Asli"
 
-#: ../webkit/webkitwebhistoryitem.cpp:195
+#: ../webkit/webkitwebhistoryitem.cpp:193
 msgid "The original URI of the history item"
 msgstr "URI asli dari butir riwayat"
 
-#: ../webkit/webkitwebhistoryitem.cpp:210
+#: ../webkit/webkitwebhistoryitem.cpp:208
 msgid "Last visited Time"
 msgstr "Waktu kunjungan terakhir"
 
-#: ../webkit/webkitwebhistoryitem.cpp:211
+#: ../webkit/webkitwebhistoryitem.cpp:209
 msgid "The time at which the history item was last visited"
 msgstr "Waktu saat butir riwayat terakhir kali dikunjungi"
 
-#: ../webkit/webkitwebinspector.cpp:269
+#: ../webkit/webkitwebinspector.cpp:273
 msgid "Web View"
 msgstr "Tilikan Web"
 
-#: ../webkit/webkitwebinspector.cpp:270
+#: ../webkit/webkitwebinspector.cpp:274
 msgid "The Web View that renders the Web Inspector itself"
 msgstr "Tilikan Web yang merender Pemeriksa Web itu sendiri"
 
-#: ../webkit/webkitwebinspector.cpp:283
+#: ../webkit/webkitwebinspector.cpp:287
 msgid "Inspected URI"
 msgstr "URI yang diperiksa"
 
-#: ../webkit/webkitwebinspector.cpp:284
+#: ../webkit/webkitwebinspector.cpp:288
 msgid "The URI that is currently being inspected"
 msgstr "URI yang kini sedang diperiksa"
 
-#: ../webkit/webkitwebinspector.cpp:300
+#: ../webkit/webkitwebinspector.cpp:304
 msgid "Enable JavaScript profiling"
 msgstr "Aktifkan pemrofilan JavaScript"
 
-#: ../webkit/webkitwebinspector.cpp:301
+#: ../webkit/webkitwebinspector.cpp:305
 msgid "Profile the executed JavaScript."
 msgstr "Profilkan JavaScript yang dieksekusi."
 
-#: ../webkit/webkitwebinspector.cpp:316
+#: ../webkit/webkitwebinspector.cpp:320
 msgid "Enable Timeline profiling"
 msgstr "Aktifkan pemrofilan Timeline"
 
-#: ../webkit/webkitwebinspector.cpp:317
+#: ../webkit/webkitwebinspector.cpp:321
 msgid "Profile the WebCore instrumentation."
 msgstr "Profilkan instrumentasi WebCore."
 
-#: ../webkit/webkitwebnavigationaction.cpp:158
+#: ../webkit/webkitwebnavigationaction.cpp:148
 msgid "Reason"
 msgstr "Alasan"
 
-#: ../webkit/webkitwebnavigationaction.cpp:159
+#: ../webkit/webkitwebnavigationaction.cpp:149
 msgid "The reason why this navigation is occurring"
 msgstr "Alasan kenapa navigasi ini terjadi"
 
-#: ../webkit/webkitwebnavigationaction.cpp:174
+#: ../webkit/webkitwebnavigationaction.cpp:164
 msgid "The URI that was requested as the target for the navigation"
 msgstr "URI yang diminta sebagai target navigasi"
 
-#: ../webkit/webkitwebnavigationaction.cpp:188
+#: ../webkit/webkitwebnavigationaction.cpp:178
 msgid "Button"
 msgstr "Tombol"
 
-#: ../webkit/webkitwebnavigationaction.cpp:189
+#: ../webkit/webkitwebnavigationaction.cpp:179
 msgid "The button used to click"
 msgstr "Tombol yang dipakai untuk mengklik"
 
-#: ../webkit/webkitwebnavigationaction.cpp:204
+#: ../webkit/webkitwebnavigationaction.cpp:194
 msgid "Modifier state"
 msgstr "Keadaan perubah"
 
-#: ../webkit/webkitwebnavigationaction.cpp:205
+#: ../webkit/webkitwebnavigationaction.cpp:195
 msgid "A bitmask representing the state of the modifier keys"
 msgstr "Suatu bitmask yang mewakili keadaan dari kunci pengubah"
 
-#: ../webkit/webkitwebnavigationaction.cpp:220
+#: ../webkit/webkitwebnavigationaction.cpp:210
 msgid "Target frame"
 msgstr "Bingkai target"
 
-#: ../webkit/webkitwebnavigationaction.cpp:221
+#: ../webkit/webkitwebnavigationaction.cpp:211
 msgid "The target frame for the navigation"
 msgstr "Bingkai target bagi navigasi"
 
-#: ../webkit/webkitwebresource.cpp:127
-msgid "The uri of the resource"
+#: ../webkit/webkitwebplugin.cpp:115
+#| msgid "Editable"
+msgid "Enabled"
+msgstr "Difungsikan"
+
+#: ../webkit/webkitwebplugin.cpp:116
+#| msgid "Whether the page cache should be used"
+msgid "Whether the plugin is enabled"
+msgstr "Apakah pengaya difungsikan"
+
+#: ../webkit/webkitwebresource.cpp:210
+#| msgid "The uri of the resource"
+msgid "The URI of the resource"
 msgstr "URI dari sumber daya"
 
-#: ../webkit/webkitwebresource.cpp:141
+#: ../webkit/webkitwebresource.cpp:224
 msgid "MIME Type"
 msgstr "Jenis MIME"
 
-#: ../webkit/webkitwebresource.cpp:142
+#: ../webkit/webkitwebresource.cpp:225
 msgid "The MIME type of the resource"
 msgstr "Jenis MIME dari sumber daya"
 
-#: ../webkit/webkitwebresource.cpp:156 ../webkit/webkitwebview.cpp:2724
+#: ../webkit/webkitwebresource.cpp:239 ../webkit/webkitwebview.cpp:3238
 msgid "Encoding"
 msgstr "Pengkodean"
 
-#: ../webkit/webkitwebresource.cpp:157
+#: ../webkit/webkitwebresource.cpp:240
 msgid "The text encoding name of the resource"
 msgstr "Nama pengkodean teks dari sumber daya"
 
-#: ../webkit/webkitwebresource.cpp:172
+#: ../webkit/webkitwebresource.cpp:255
 msgid "Frame Name"
 msgstr "Nama Rangka"
 
-#: ../webkit/webkitwebresource.cpp:173
+#: ../webkit/webkitwebresource.cpp:256
 msgid "The frame name of the resource"
 msgstr "Nama rangka dari sumber daya"
 
-#: ../webkit/webkitwebsettings.cpp:247
+#: ../webkit/webkitwebsettings.cpp:147
 msgid "Default Encoding"
 msgstr "Pengkodean Bawaan"
 
-#: ../webkit/webkitwebsettings.cpp:248
+#: ../webkit/webkitwebsettings.cpp:148
 msgid "The default encoding used to display text."
 msgstr "Pengkodean bawaan yang dipakai untuk menampilkan teks."
 
-#: ../webkit/webkitwebsettings.cpp:256
+#: ../webkit/webkitwebsettings.cpp:156
 msgid "Cursive Font Family"
 msgstr "Keluarga Fonta Cursive"
 
-#: ../webkit/webkitwebsettings.cpp:257
+#: ../webkit/webkitwebsettings.cpp:157
 msgid "The default Cursive font family used to display text."
 msgstr "Keluarga fonta Cursive bawaan yang dipakai untuk menampilkan teks."
 
-#: ../webkit/webkitwebsettings.cpp:265
+#: ../webkit/webkitwebsettings.cpp:165
 msgid "Default Font Family"
 msgstr "Keluarga Fonta Bawaan"
 
-#: ../webkit/webkitwebsettings.cpp:266
+#: ../webkit/webkitwebsettings.cpp:166
 msgid "The default font family used to display text."
 msgstr "Keluarga fonta bawaan yang dipakai untuk menampilkan teks."
 
-#: ../webkit/webkitwebsettings.cpp:274
+#: ../webkit/webkitwebsettings.cpp:174
 msgid "Fantasy Font Family"
 msgstr "Keluarga Fonta Fantasy"
 
-#: ../webkit/webkitwebsettings.cpp:275
+#: ../webkit/webkitwebsettings.cpp:175
 msgid "The default Fantasy font family used to display text."
 msgstr "Keluarga fonta Fantasy bawaan yang dipakai untuk menampilkan teks."
 
-#: ../webkit/webkitwebsettings.cpp:283
+#: ../webkit/webkitwebsettings.cpp:183
 msgid "Monospace Font Family"
 msgstr "Keluarga Fonta Monospace"
 
-#: ../webkit/webkitwebsettings.cpp:284
+#: ../webkit/webkitwebsettings.cpp:184
 msgid "The default font family used to display monospace text."
 msgstr ""
 "Keluarga fonta bawaan yang dipakai untuk menampilkan teks lebar-seragam."
 
-#: ../webkit/webkitwebsettings.cpp:292
+#: ../webkit/webkitwebsettings.cpp:192
 msgid "Sans Serif Font Family"
 msgstr "Keluarga Fonta Sans Serif"
 
-#: ../webkit/webkitwebsettings.cpp:293
+#: ../webkit/webkitwebsettings.cpp:193
 msgid "The default Sans Serif font family used to display text."
 msgstr "Keluarga fonta Sans Serif bawaan yang dipakai untuk menampilkan teks."
 
-#: ../webkit/webkitwebsettings.cpp:301
+#: ../webkit/webkitwebsettings.cpp:201
 msgid "Serif Font Family"
 msgstr "Keluarga Fonta Serif"
 
-#: ../webkit/webkitwebsettings.cpp:302
+#: ../webkit/webkitwebsettings.cpp:202
 msgid "The default Serif font family used to display text."
 msgstr "Keluarga fonta Serif bawaan yang dipakai untuk menampilkan teks."
 
-#: ../webkit/webkitwebsettings.cpp:310
+#: ../webkit/webkitwebsettings.cpp:210
 msgid "Default Font Size"
 msgstr "Ukuran Fonta Bawaan"
 
-#: ../webkit/webkitwebsettings.cpp:311
+#: ../webkit/webkitwebsettings.cpp:211
 msgid "The default font size used to display text."
 msgstr "Ukuran fonta bawaan yang dipakai untuk menampilkan teks."
 
-#: ../webkit/webkitwebsettings.cpp:319
+#: ../webkit/webkitwebsettings.cpp:219
 msgid "Default Monospace Font Size"
 msgstr "Ukuran Fonta Lebar-Seragam Bawaan"
 
-#: ../webkit/webkitwebsettings.cpp:320
+#: ../webkit/webkitwebsettings.cpp:220
 msgid "The default font size used to display monospace text."
 msgstr "Ukuran fonta bawaan yang dipakai untuk menampilkan teks lebar-seragam."
 
-#: ../webkit/webkitwebsettings.cpp:328
+#: ../webkit/webkitwebsettings.cpp:228
 msgid "Minimum Font Size"
 msgstr "Ukuran Fonta Minimum"
 
-#: ../webkit/webkitwebsettings.cpp:329
+#: ../webkit/webkitwebsettings.cpp:229
 msgid "The minimum font size used to display text."
 msgstr "Ukuran fonta minimum yang dipakai untuk menampilkan teks."
 
-#: ../webkit/webkitwebsettings.cpp:337
+#: ../webkit/webkitwebsettings.cpp:237
 msgid "Minimum Logical Font Size"
 msgstr "Ukuran Fonta Lojik Minimum"
 
-#: ../webkit/webkitwebsettings.cpp:338
+#: ../webkit/webkitwebsettings.cpp:238
 msgid "The minimum logical font size used to display text."
 msgstr "Ukuran fonta lojik minimum yang dipakai untuk menampilkan teks."
 
-#: ../webkit/webkitwebsettings.cpp:357
+#: ../webkit/webkitwebsettings.cpp:257
 msgid "Enforce 96 DPI"
 msgstr "Paksakan 96 DPI"
 
-#: ../webkit/webkitwebsettings.cpp:358
+#: ../webkit/webkitwebsettings.cpp:258
 msgid "Enforce a resolution of 96 DPI"
 msgstr "Paksakan resolusi 96 DPI"
 
-#: ../webkit/webkitwebsettings.cpp:366
+#: ../webkit/webkitwebsettings.cpp:266
 msgid "Auto Load Images"
 msgstr "Muat Otomatis Gambar"
 
-#: ../webkit/webkitwebsettings.cpp:367
+#: ../webkit/webkitwebsettings.cpp:267
 msgid "Load images automatically."
 msgstr "Muat gambar secara otomatis."
 
-#: ../webkit/webkitwebsettings.cpp:375
+#: ../webkit/webkitwebsettings.cpp:275
 msgid "Auto Shrink Images"
 msgstr "Perkecil Gambar Otomatis"
 
-#: ../webkit/webkitwebsettings.cpp:376
+#: ../webkit/webkitwebsettings.cpp:276
 msgid "Automatically shrink standalone images to fit."
 msgstr "Otomatis memperkecil gambar agar pas."
 
-#: ../webkit/webkitwebsettings.cpp:384
+#: ../webkit/webkitwebsettings.cpp:284
 msgid "Print Backgrounds"
 msgstr "Cetak Latar"
 
-#: ../webkit/webkitwebsettings.cpp:385
+#: ../webkit/webkitwebsettings.cpp:285
 msgid "Whether background images should be printed."
 msgstr "Apakah gambar latar mesti dicetak."
 
-#: ../webkit/webkitwebsettings.cpp:393
+#: ../webkit/webkitwebsettings.cpp:293
 msgid "Enable Scripts"
 msgstr "Aktifkan Skrip"
 
-#: ../webkit/webkitwebsettings.cpp:394
+#: ../webkit/webkitwebsettings.cpp:294
 msgid "Enable embedded scripting languages."
 msgstr "Aktifkan bahasa skrip tertempel."
 
-#: ../webkit/webkitwebsettings.cpp:402
+#: ../webkit/webkitwebsettings.cpp:302
 msgid "Enable Plugins"
 msgstr "Aktifkan Pengaya"
 
-#: ../webkit/webkitwebsettings.cpp:403
+#: ../webkit/webkitwebsettings.cpp:303
 msgid "Enable embedded plugin objects."
 msgstr "Aktifkan objek pengaya tertempel."
 
-#: ../webkit/webkitwebsettings.cpp:411
+#: ../webkit/webkitwebsettings.cpp:311
 msgid "Resizable Text Areas"
 msgstr "Wilayah Teks Yang Dapat Diubah Ukurannya"
 
-#: ../webkit/webkitwebsettings.cpp:412
+#: ../webkit/webkitwebsettings.cpp:312
 msgid "Whether text areas are resizable."
 msgstr "Apakah wilayah teks dapat diubah ukurannya."
 
-#: ../webkit/webkitwebsettings.cpp:419
+#: ../webkit/webkitwebsettings.cpp:319
 msgid "User Stylesheet URI"
 msgstr "URI Stylesheet Pengguna"
 
-#: ../webkit/webkitwebsettings.cpp:420
+#: ../webkit/webkitwebsettings.cpp:320
 msgid "The URI of a stylesheet that is applied to every page."
 msgstr "URI dari stylesheet yang diterapkan pada setiap halaman."
 
-#: ../webkit/webkitwebsettings.cpp:435
+#: ../webkit/webkitwebsettings.cpp:335
 msgid "Zoom Stepping Value"
 msgstr "Nilai Langkah Zum"
 
-#: ../webkit/webkitwebsettings.cpp:436
+#: ../webkit/webkitwebsettings.cpp:336
 msgid "The value by which the zoom level is changed when zooming in or out."
 msgstr "Nilai perubahan aras zum ketika memperbesar atau memperkecil."
 
-#: ../webkit/webkitwebsettings.cpp:454
+#: ../webkit/webkitwebsettings.cpp:354
 msgid "Enable Developer Extras"
 msgstr "Aktifkan Tambahan Bagi Pengembang"
 
-#: ../webkit/webkitwebsettings.cpp:455
+#: ../webkit/webkitwebsettings.cpp:355
 msgid "Enables special extensions that help developers"
 msgstr "Aktifkan perluasan khusus untuk membantu para pengembang"
 
-#: ../webkit/webkitwebsettings.cpp:475
+#: ../webkit/webkitwebsettings.cpp:375
 msgid "Enable Private Browsing"
 msgstr "Aktifkan Penjelajahan Privat"
 
-#: ../webkit/webkitwebsettings.cpp:476
+#: ../webkit/webkitwebsettings.cpp:376
 msgid "Enables private browsing mode"
 msgstr "Aktifkan mode penjelajahan privat"
 
-#: ../webkit/webkitwebsettings.cpp:491
+#: ../webkit/webkitwebsettings.cpp:391
 msgid "Enable Spell Checking"
 msgstr "Aktifkan Pemeriksaan Ejaan"
 
-#: ../webkit/webkitwebsettings.cpp:492
+#: ../webkit/webkitwebsettings.cpp:392
 msgid "Enables spell checking while typing"
 msgstr "Aktifkan pemeriksaan ejaan ketika mengetik"
 
-#: ../webkit/webkitwebsettings.cpp:515
+#: ../webkit/webkitwebsettings.cpp:415
 msgid "Languages to use for spell checking"
 msgstr "Bahasa yang dipakai untuk memeriksa ejaan"
 
-#: ../webkit/webkitwebsettings.cpp:516
+#: ../webkit/webkitwebsettings.cpp:416
 msgid "Comma separated list of languages to use for spell checking"
 msgstr "Daftar bahasa, dipisah dengan koma, yang dipakai untuk memeriksa ejaan"
 
-#: ../webkit/webkitwebsettings.cpp:530
+#: ../webkit/webkitwebsettings.cpp:430
 msgid "Enable Caret Browsing"
 msgstr "Aktifkan Perambanan Caret"
 
-#: ../webkit/webkitwebsettings.cpp:531
+#: ../webkit/webkitwebsettings.cpp:431
 msgid "Whether to enable accessibility enhanced keyboard navigation"
 msgstr "Apakah mengaktifkan navigasi papan tik bagi aksesabilitas"
 
-#: ../webkit/webkitwebsettings.cpp:546
+#: ../webkit/webkitwebsettings.cpp:446
 msgid "Enable HTML5 Database"
 msgstr "Aktifkan Basis Data HTML5"
 
-#: ../webkit/webkitwebsettings.cpp:547
+#: ../webkit/webkitwebsettings.cpp:447
 msgid "Whether to enable HTML5 database support"
 msgstr "Apakah mengaktifkan dukungan basis data HTML5"
 
-#: ../webkit/webkitwebsettings.cpp:562
+#: ../webkit/webkitwebsettings.cpp:462
 msgid "Enable HTML5 Local Storage"
 msgstr "Aktifkan Penyimpanan Lokal HTML5"
 
-#: ../webkit/webkitwebsettings.cpp:563
+#: ../webkit/webkitwebsettings.cpp:463
 msgid "Whether to enable HTML5 Local Storage support"
 msgstr "Apakah mengaktifkan dukungan Penyimpanan Lokal HTML5"
 
-#: ../webkit/webkitwebsettings.cpp:577
+#: ../webkit/webkitwebsettings.cpp:478
+msgid "Local Storage Database Path"
+msgstr "Path Basis Data Penyimpanan Lokal"
+
+#: ../webkit/webkitwebsettings.cpp:479
+#| msgid "Whether to enable HTML5 Local Storage support"
+msgid "The path to where HTML5 Local Storage databases are stored."
+msgstr "Path dimana basis data Penyimpanan Lokal HTML5 terletak."
+
+#: ../webkit/webkitwebsettings.cpp:493
 msgid "Enable XSS Auditor"
 msgstr "Aktifkan Auditor XSS"
 
-#: ../webkit/webkitwebsettings.cpp:578
+#: ../webkit/webkitwebsettings.cpp:494
 msgid "Whether to enable the XSS auditor"
 msgstr "Apakah auditor XSS diaktifkan"
 
-#: ../webkit/webkitwebsettings.cpp:596
+#: ../webkit/webkitwebsettings.cpp:512
 msgid "Enable Spatial Navigation"
 msgstr "Aktifkan Navigasi Spasial"
 
-#: ../webkit/webkitwebsettings.cpp:597
+#: ../webkit/webkitwebsettings.cpp:513
 msgid "Whether to enable Spatial Navigation"
 msgstr "Apakah mengaktifkan Navigasi Spasial"
 
-#: ../webkit/webkitwebsettings.cpp:614
+#: ../webkit/webkitwebsettings.cpp:531
+#| msgid "Enable Private Browsing"
+msgid "Enable Frame Flattening"
+msgstr "Fungsikan Frame Flattening"
+
+#: ../webkit/webkitwebsettings.cpp:532
+#| msgid "Whether to enable DOM paste"
+msgid "Whether to enable Frame Flattening"
+msgstr "Apakah memfungsikan Frame Flattening"
+
+#: ../webkit/webkitwebsettings.cpp:549
 msgid "User Agent"
 msgstr "User Agent"
 
-#: ../webkit/webkitwebsettings.cpp:615
+#: ../webkit/webkitwebsettings.cpp:550
 msgid "The User-Agent string used by WebKitGtk"
 msgstr "String User-Agent yang dipakai oleh WebKitGtk"
 
-#: ../webkit/webkitwebsettings.cpp:630
+#: ../webkit/webkitwebsettings.cpp:565
 msgid "JavaScript can open windows automatically"
 msgstr "JavaScript dapat otomatis membuka jendela"
 
-#: ../webkit/webkitwebsettings.cpp:631
+#: ../webkit/webkitwebsettings.cpp:566
 msgid "Whether JavaScript can open windows automatically"
 msgstr "Apakah JavaScript dapat otomatis membuka jendela"
 
-#: ../webkit/webkitwebsettings.cpp:645
+#: ../webkit/webkitwebsettings.cpp:580
 msgid "JavaScript can access Clipboard"
 msgstr "JavaScript dapat mengakses Papan Klip"
 
-#: ../webkit/webkitwebsettings.cpp:646
+#: ../webkit/webkitwebsettings.cpp:581
 msgid "Whether JavaScript can access Clipboard"
 msgstr "Apakah JavaScript dapat mengakses Papan Klip"
 
-#: ../webkit/webkitwebsettings.cpp:662
+#: ../webkit/webkitwebsettings.cpp:597
 msgid "Enable offline web application cache"
 msgstr "Aktifkan singgahan aplikasi web luring"
 
-#: ../webkit/webkitwebsettings.cpp:663
+#: ../webkit/webkitwebsettings.cpp:598
 msgid "Whether to enable offline web application cache"
 msgstr "Apakah mengaktifkan singgahan aplikasi web luring"
 
-#: ../webkit/webkitwebsettings.cpp:690
+#: ../webkit/webkitwebsettings.cpp:623
 msgid "Editing behavior"
 msgstr "Perilaku penyuntingan"
 
-#: ../webkit/webkitwebsettings.cpp:691
+#: ../webkit/webkitwebsettings.cpp:624
 msgid "The behavior mode to use in editing mode"
 msgstr "Mode perilaku yang dipakai pada mode penyuntingan"
 
-#: ../webkit/webkitwebsettings.cpp:707
+#: ../webkit/webkitwebsettings.cpp:640
 msgid "Enable universal access from file URIs"
 msgstr "Aktifkan akses universal dari URI berkas"
 
-#: ../webkit/webkitwebsettings.cpp:708
+#: ../webkit/webkitwebsettings.cpp:641
 msgid "Whether to allow universal access from file URIs"
 msgstr "Apakah mengaktifkan akses universal dari URI berkas"
 
-#: ../webkit/webkitwebsettings.cpp:723
+#: ../webkit/webkitwebsettings.cpp:656
 msgid "Enable DOM paste"
 msgstr "Aktifkan tempel DOM"
 
-#: ../webkit/webkitwebsettings.cpp:724
+#: ../webkit/webkitwebsettings.cpp:657
 msgid "Whether to enable DOM paste"
 msgstr "Apakah mengaktifkan penempelan DOM"
 
-#: ../webkit/webkitwebsettings.cpp:742
+#: ../webkit/webkitwebsettings.cpp:675
 msgid "Tab key cycles through elements"
 msgstr "Kunci tab menggilir antar elemen"
 
-#: ../webkit/webkitwebsettings.cpp:743
+#: ../webkit/webkitwebsettings.cpp:676
 msgid "Whether the tab key cycles through elements on the page."
 msgstr "Apakah kunci tab menggilir antar elemen pada halaman itu."
 
-#: ../webkit/webkitwebsettings.cpp:763
+#: ../webkit/webkitwebsettings.cpp:698
 msgid "Enable Default Context Menu"
 msgstr "Aktifkan Menu Konteks Bawaan"
 
-#: ../webkit/webkitwebsettings.cpp:764
+#: ../webkit/webkitwebsettings.cpp:699
 msgid ""
 "Enables the handling of right-clicks for the creation of the default context "
 "menu"
 msgstr "Mengaktifkan penanganan klik kanan untuk pembuatan menu konteks bawaan"
 
-#: ../webkit/webkitwebsettings.cpp:784
+#: ../webkit/webkitwebsettings.cpp:719
 msgid "Enable Site Specific Quirks"
 msgstr "Aktifkan Perilaku Khusus Situs"
 
-#: ../webkit/webkitwebsettings.cpp:785
+#: ../webkit/webkitwebsettings.cpp:720
 msgid "Enables the site-specific compatibility workarounds"
 msgstr "Aktifkan pengakalan kompatibilitas spesifik situs"
 
-#: ../webkit/webkitwebsettings.cpp:807
+#: ../webkit/webkitwebsettings.cpp:742
 msgid "Enable page cache"
 msgstr "Aktifkan singgahan halaman"
 
-#: ../webkit/webkitwebsettings.cpp:808
+#: ../webkit/webkitwebsettings.cpp:743
 msgid "Whether the page cache should be used"
 msgstr "Apakah mengaktifkan singgahan halaman"
 
-#: ../webkit/webkitwebsettings.cpp:828
+#: ../webkit/webkitwebsettings.cpp:763
 msgid "Auto Resize Window"
 msgstr "Otomatis Ubah Ukuran Jendela"
 
-#: ../webkit/webkitwebsettings.cpp:829
+#: ../webkit/webkitwebsettings.cpp:764
 msgid "Automatically resize the toplevel window when a page requests it"
 msgstr ""
 "Otomatis ubah ukuran jendela aras puncak ketika suatu halaman memintanya"
 
-#: ../webkit/webkitwebsettings.cpp:861
+#: ../webkit/webkitwebsettings.cpp:796
 msgid "Enable Java Applet"
 msgstr "Aktifkan Aplet Java"
 
-#: ../webkit/webkitwebsettings.cpp:862
+#: ../webkit/webkitwebsettings.cpp:797
 msgid "Whether Java Applet support through <applet> should be enabled"
 msgstr "Apakah dukungan Aplet Java melalui <applet> mesti diaktifkan"
 
-#: ../webkit/webkitwebview.cpp:2590
+#: ../webkit/webkitwebsettings.cpp:811
+#| msgid "Enable Timeline profiling"
+msgid "Enable Hyperlink Auditing"
+msgstr "Fungsikan Audit Hyperlink"
+
+#: ../webkit/webkitwebsettings.cpp:812
+#| msgid "Whether the page cache should be used"
+msgid "Whether <a ping> should be able to send pings"
+msgstr "Apakah <a ping> mesti bisa mengirim ping"
+
+#: ../webkit/webkitwebsettings.cpp:820
+#| msgid "Exit Fullscreen"
+msgid "Enable Fullscreen"
+msgstr "Fungsikan Layar Penuh"
+
+#: ../webkit/webkitwebsettings.cpp:821
+#| msgid "Whether the page cache should be used"
+msgid "Whether the Mozilla style API should be enabled."
+msgstr "Apakah API gaya Mozilla mesti difungsikan."
+
+#: ../webkit/webkitwebsettings.cpp:836
+msgid "Enable WebGL"
+msgstr "Fungsikan WebGL"
+
+#: ../webkit/webkitwebsettings.cpp:837
+#| msgid "Whether background images should be printed."
+msgid "Whether WebGL content should be rendered"
+msgstr "Apakah isi WebGL mesti dirender"
+
+#: ../webkit/webkitwebsettings.cpp:853
+#| msgid "Enable Private Browsing"
+msgid "Enable accelerated compositing"
+msgstr "Aktifkan pengkomposisian yang dipercepat"
+
+#: ../webkit/webkitwebsettings.cpp:854
+#| msgid "Whether Java Applet support through <applet> should be enabled"
+msgid "Whether accelerated compositing should be enabled"
+msgstr ""
+"Apakah pengkomposisian yang dipercepat (accelerated compositing) mesti "
+"difungsikan"
+
+#: ../webkit/webkitwebsettings.cpp:872
+#| msgid "Enable XSS Auditor"
+msgid "Enable WebAudio"
+msgstr "Fungsikan WebAudio"
+
+#: ../webkit/webkitwebsettings.cpp:873
+#| msgid "Whether the page cache should be used"
+msgid "Whether WebAudio content should be handled"
+msgstr "Apakah isi WebAudio mesti ditangani"
+
+#: ../webkit/webkitwebsettings.cpp:889
+msgid "WebKit prefetches domain names"
+msgstr "WebKet mem-prefetch nama domain"
+
+#: ../webkit/webkitwebsettings.cpp:890
+msgid "Whether WebKit prefetches domain names"
+msgstr "Apakah WebKit mengambil nama-nama domain lebih dahulu"
+
+#: ../webkit/webkitwebsettings.cpp:908
+#| msgid "Enable DOM paste"
+msgid "Enable Media Stream"
+msgstr "Fungsikan Stream Media"
+
+#: ../webkit/webkitwebsettings.cpp:909
+#| msgid "Whether the page cache should be used"
+msgid "Whether Media Stream should be enabled"
+msgstr "Apakah Stream Media mesti difungsikan"
+
+#: ../webkit/webkitwebsettings.cpp:924
+#| msgid "Enable Caret Browsing"
+msgid "Enable smooth scrolling"
+msgstr "Fungsikan gulir mulus"
+
+#: ../webkit/webkitwebsettings.cpp:925
+#| msgid "Whether to enable the XSS auditor"
+msgid "Whether to enable smooth scrolling"
+msgstr "Apakah pengguliran mulus difungsikan"
+
+#: ../webkit/webkitwebsettings.cpp:943
+msgid "Media playback requires user gesture"
+msgstr "Pemutaran media memerlukan gestur pengguna"
+
+#: ../webkit/webkitwebsettings.cpp:944
+msgid "Whether media playback requires user gesture"
+msgstr "Apakah pemutaran media memerlukan gestur pengguna"
+
+#: ../webkit/webkitwebsettings.cpp:960
+msgid "Media playback allows inline"
+msgstr "Pemutaran media mengijinkan inline"
+
+#: ../webkit/webkitwebsettings.cpp:961
+msgid "Whether media playback allows inline"
+msgstr "Apakah pemutaran media mengijinkan inline"
+
+#: ../webkit/webkitwebsettings.cpp:979
+#| msgid "Enable XSS Auditor"
+msgid "Enable CSS shaders"
+msgstr "Fungsikan shader CSS"
+
+#: ../webkit/webkitwebsettings.cpp:980
+#| msgid "Whether to enable DOM paste"
+msgid "Whether to enable css shaders"
+msgstr "Apakah memfungsikan shader CSS"
+
+#: ../webkit/webkitwebview.cpp:1311
+msgid "Select Files"
+msgstr "Pilih Berkas"
+
+#: ../webkit/webkitwebview.cpp:1311
+msgid "Select File"
+msgstr "Pilih Berkas"
+
+#: ../webkit/webkitwebview.cpp:3090
 msgid "Returns the @web_view's document title"
 msgstr "Mengembalikan judul dokumen @web_view"
 
-#: ../webkit/webkitwebview.cpp:2604
+#: ../webkit/webkitwebview.cpp:3104
 msgid "Returns the current URI of the contents displayed by the @web_view"
 msgstr "Mengembalikan URI kini dari isi yang ditampilkan oleh @web_view"
 
-#: ../webkit/webkitwebview.cpp:2617
+#: ../webkit/webkitwebview.cpp:3117
 msgid "Copy target list"
 msgstr "Daftar target salin"
 
-#: ../webkit/webkitwebview.cpp:2618
+#: ../webkit/webkitwebview.cpp:3118
 msgid "The list of targets this web view supports for clipboard copying"
 msgstr "Daftar target yang didukung tilikan web ini bagi penyalinan clipboard"
 
-#: ../webkit/webkitwebview.cpp:2631
+#: ../webkit/webkitwebview.cpp:3131
 msgid "Paste target list"
 msgstr "Daftar target tempel"
 
-#: ../webkit/webkitwebview.cpp:2632
+#: ../webkit/webkitwebview.cpp:3132
 msgid "The list of targets this web view supports for clipboard pasting"
 msgstr "Daftar target yang didukung tilikan web ini bagi penempelan clipboard"
 
-#: ../webkit/webkitwebview.cpp:2638
+#: ../webkit/webkitwebview.cpp:3138
 msgid "Settings"
 msgstr "Tatanan"
 
-#: ../webkit/webkitwebview.cpp:2639
+#: ../webkit/webkitwebview.cpp:3139
 msgid "An associated WebKitWebSettings instance"
 msgstr "Instansi WebKitWebSettings yang terkait"
 
-#: ../webkit/webkitwebview.cpp:2652
+#: ../webkit/webkitwebview.cpp:3152
 msgid "Web Inspector"
 msgstr "Pemeriksa Web"
 
-#: ../webkit/webkitwebview.cpp:2653
+#: ../webkit/webkitwebview.cpp:3153
 msgid "The associated WebKitWebInspector instance"
 msgstr "Instansi WebKitWebInspector yang terkait"
 
-#: ../webkit/webkitwebview.cpp:2673
+#: ../webkit/webkitwebview.cpp:3166
+msgid "Viewport Attributes"
+msgstr "Atribut Viewport"
+
+#: ../webkit/webkitwebview.cpp:3167
+#| msgid "The associated WebKitWebInspector instance"
+msgid "The associated WebKitViewportAttributes instance"
+msgstr "Instansi WebKitWebSettings yang terkait"
+
+#: ../webkit/webkitwebview.cpp:3187
 msgid "Editable"
 msgstr "Dapat diedit"
 
-#: ../webkit/webkitwebview.cpp:2674
+#: ../webkit/webkitwebview.cpp:3188
 msgid "Whether content can be modified by the user"
 msgstr "Apakah isi dapat diubah oleh pengguna"
 
-#: ../webkit/webkitwebview.cpp:2680
+#: ../webkit/webkitwebview.cpp:3194
 msgid "Transparent"
 msgstr "Transparan"
 
-#: ../webkit/webkitwebview.cpp:2681
+#: ../webkit/webkitwebview.cpp:3195
 msgid "Whether content has a transparent background"
 msgstr "Apakah isi memiliki latar transparan"
 
-#: ../webkit/webkitwebview.cpp:2694
+#: ../webkit/webkitwebview.cpp:3208
 msgid "Zoom level"
 msgstr "Tingkat zum"
 
-#: ../webkit/webkitwebview.cpp:2695
+#: ../webkit/webkitwebview.cpp:3209
 msgid "The level of zoom of the content"
 msgstr "Aras zum dari isi"
 
-#: ../webkit/webkitwebview.cpp:2710
+#: ../webkit/webkitwebview.cpp:3224
 msgid "Full content zoom"
 msgstr "Zum seluruh isi"
 
-#: ../webkit/webkitwebview.cpp:2711
+#: ../webkit/webkitwebview.cpp:3225
 msgid "Whether the full content is scaled when zooming"
 msgstr "Apakah seluruh isi diskalakan ketika dizum"
 
-#: ../webkit/webkitwebview.cpp:2725
+#: ../webkit/webkitwebview.cpp:3239
 msgid "The default encoding of the web view"
 msgstr "Pengkodean bawaan dari tilikan web"
 
-#: ../webkit/webkitwebview.cpp:2738
+#: ../webkit/webkitwebview.cpp:3252
 msgid "Custom Encoding"
 msgstr "Pengkodean Gubahan"
 
-#: ../webkit/webkitwebview.cpp:2739
+#: ../webkit/webkitwebview.cpp:3253
 msgid "The custom encoding of the web view"
 msgstr "Pengkodean gubahan dari tilikan web"
 
-#: ../webkit/webkitwebview.cpp:2791
+#: ../webkit/webkitwebview.cpp:3305
 msgid "Icon URI"
 msgstr "URI Ikon"
 
-#: ../webkit/webkitwebview.cpp:2792
+#: ../webkit/webkitwebview.cpp:3306
 msgid "The URI for the favicon for the #WebKitWebView."
 msgstr "URI bagi favicon bagi #WebKitWebView."
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:56
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:61
-msgid "Submit"
-msgstr "Kirim"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:66
-msgid "Reset"
-msgstr "Reset"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:71
-msgid "This is a searchable index. Enter search keywords: "
-msgstr "Ini adalah indeks yang dapat dicari. Masukkan kata kunci pencarian:"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:76
-msgid "Choose File"
-msgstr "Pilih Berkas"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:81
-msgid "(None)"
-msgstr "(Tidak ada)"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:86
-msgid "Open Link in New _Window"
-msgstr "Buka Taut di _Jendela Baru"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:91
-msgid "_Download Linked File"
-msgstr "Un_duh Berkas Tertaut"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:96
-msgid "Copy Link Loc_ation"
-msgstr "Salin Lokasi T_aut"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:101
-msgid "Open _Image in New Window"
-msgstr "Buka Gambar d_i Jendela Baru"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:106
-msgid "Sa_ve Image As"
-msgstr "Sim_pan Gambar Sebagai"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:111
-msgid "Cop_y Image"
-msgstr "Sal_in Gambar"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:116
-msgid "Open _Video in New Window"
-msgstr "Buka _Video pada Jendela Baru"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:121
-msgid "Open _Audio in New Window"
-msgstr "Buka Suar_a pada Jendela Baru"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:126
-msgid "Cop_y Video Link Location"
-msgstr "Salin Lokasi T_aut Video"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:131
-msgid "Cop_y Audio Link Location"
-msgstr "Salin Lokasi T_aut Suara"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:136
-msgid "_Toggle Media Controls"
-msgstr "Jungki_tkan Kendali Media"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:141
-msgid "Toggle Media _Loop Playback"
-msgstr "Jungkitkan Pengu_langan Memutar Media"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:146
-msgid "Switch Video to _Fullscreen"
-msgstr "Tukar Video ke Mode Layar _Penuh"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:151
-msgid "_Play"
-msgstr "_Putar"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:156
-msgid "_Pause"
-msgstr "_Jeda"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:161
-msgid "_Mute"
-msgstr "_Senyap"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:166
-msgid "Open _Frame in New Window"
-msgstr "Buka _Frame di Jendela Baru"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:217
-msgid "_Reload"
-msgstr "_Muat Ulang"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:234
-msgid "No Guesses Found"
-msgstr "Tebakan Tak Ditemukan"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:239
-msgid "_Ignore Spelling"
-msgstr "Aba_ikan Ejaan"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:244
-msgid "_Learn Spelling"
-msgstr "Pe_lajari Ejaan"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:249
-msgid "_Search the Web"
-msgstr "_Cari Web"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:254
-msgid "_Look Up in Dictionary"
-msgstr "_Lihat Di Kamus"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:259
-msgid "_Open Link"
-msgstr "_Buka Taut"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:264
-msgid "Ignore _Grammar"
-msgstr "Abaikan Tata _Bahasa"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:269
-msgid "Spelling and _Grammar"
-msgstr "Ejaan dan Tata _Bahasa"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:274
-msgid "_Show Spelling and Grammar"
-msgstr "Tampilkan Ejaan dan Tata Baha_sa"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:274
-msgid "_Hide Spelling and Grammar"
-msgstr "Sembunyikan Ejaan dan Tata Ba_hasa"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:279
-msgid "_Check Document Now"
-msgstr "Periksa Do_kumen Sekarang"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:284
-msgid "Check Spelling While _Typing"
-msgstr "Periksa Ejaan Ketika Menge_tik"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:289
-msgid "Check _Grammar With Spelling"
-msgstr "Periksa Tata _Bahasa Bersama Dengan Ejaan"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:294
-msgid "_Font"
-msgstr "_Fonta"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:317
-msgid "_Outline"
-msgstr "_Outline"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:322
-msgid "Inspect _Element"
-msgstr "Periksa _Elemen"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:327
-msgid "No recent searches"
-msgstr "Tak ada pencarian terkini"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:332
-msgid "Recent searches"
-msgstr "Pencarian terkini"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:337
-msgid "_Clear recent searches"
-msgstr "_Bersihkan pencarian terkini"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:342
-msgid "term"
-msgstr "istilah"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:347
-msgid "definition"
-msgstr "definisi"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:352
-msgid "press"
-msgstr "tekan"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:357
-msgid "select"
-msgstr "pilih"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:362
-msgid "activate"
-msgstr "aktifkan"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:367
-msgid "uncheck"
-msgstr "hapus contreng"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:372
-msgid "check"
-msgstr "contreng"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:377
-msgid "jump"
-msgstr "lompat"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:392
-msgid "Missing Plug-in"
-msgstr "Kehilangan Plug-in"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:398
-msgid "Plug-in Failure"
-msgstr "Kegagalan Plug-in"
-
-#. FIXME: If this file gets localized, this should really be localized as one string with a wildcard for the number.
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:404
-msgid " files"
-msgstr " berkas"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:409
-msgid "Unknown"
-msgstr "Tidak dikenal"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:414
-#, c-format
-msgctxt "Title string for images"
-msgid "%s  (%dx%d pixels)"
-msgstr "%s  (%dx%d piksel)"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:426
-msgid "Loading..."
-msgstr "Sedang memuat..."
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:431
-msgid "Live Broadcast"
-msgstr "Siaran Langsung"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:437
-msgid "audio element controller"
-msgstr "pengendali elemen audio"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:439
-msgid "video element controller"
-msgstr "pengendali elemen video"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:441
-msgid "mute"
-msgstr "senyap"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:443
-msgid "unmute"
-msgstr "usai senyap"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:445
-msgid "play"
-msgstr "putar"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:447
-msgid "pause"
-msgstr "jeda"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:449
-msgid "movie time"
-msgstr "waktu film"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:451
-msgid "timeline slider thumb"
-msgstr "jempol penggeser waktu"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:453
-msgid "back 30 seconds"
-msgstr "mundur 30 detik"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:455
-msgid "return to realtime"
-msgstr "kembali ke waktu nyata"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:457
-msgid "elapsed time"
-msgstr "waktu berjalan"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:459
-msgid "remaining time"
-msgstr "sisa waktu"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:461
-msgid "status"
-msgstr "status"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:463
-msgid "fullscreen"
-msgstr "layar penuh"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:465
-msgid "fast forward"
-msgstr "maju cepat"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:467
-msgid "fast reverse"
-msgstr "mundur cepat"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:469
-msgid "show closed captions"
-msgstr "tampilkan takarir gambar"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:471
-msgid "hide closed captions"
-msgstr "sembunyikan takarir gambar"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:480
-msgid "audio element playback controls and status display"
-msgstr "tampilan status dan kendali main ulang elemen suara"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:482
-msgid "video element playback controls and status display"
-msgstr "tampilan status dan kendali main ulang elemen video"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:484
-msgid "mute audio tracks"
-msgstr "bisukan trek suara"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:486
-msgid "unmute audio tracks"
-msgstr "bunyikan trek suara"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:488
-msgid "begin playback"
-msgstr "mulai memutar"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:490
-msgid "pause playback"
-msgstr "jeda memutar"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:492
-msgid "movie time scrubber"
-msgstr "pembersih waktu film"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:494
-msgid "movie time scrubber thumb"
-msgstr "jempol pembersih waktu film"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:496
-msgid "seek movie back 30 seconds"
-msgstr "seem film mundur 30 detik"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:498
-msgid "return streaming movie to real time"
-msgstr "kembalikan film mengalir ke waktu nyata"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:500
-msgid "current movie time in seconds"
-msgstr "waktu film kini dalam detik"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:502
-msgid "number of seconds of movie remaining"
-msgstr "cacah detik sisa film"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:504
-msgid "current movie status"
-msgstr "status film kini"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:506
-msgid "seek quickly back"
-msgstr "seek mundur cepat"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:508
-msgid "seek quickly forward"
-msgstr "seek maju cepat"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:510
-msgid "Play movie in fullscreen mode"
-msgstr "Mainkan film pada mode layar penuh"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:512
-msgid "start displaying closed captions"
-msgstr "mulai tampilkan takarir gambar"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:514
-msgid "stop displaying closed captions"
-msgstr "tak tampilkan lagi takarir gambar"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:523
-msgid "indefinite time"
-msgstr "waktu tak tentu"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:553
-msgid "value missing"
-msgstr "nilai hilang"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:559
-msgid "type mismatch"
-msgstr "jenis tak cocok"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:564
-msgid "pattern mismatch"
-msgstr "pola tak cocok"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:569
-msgid "too long"
-msgstr "terlalu panjang"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:574
-msgid "range underflow"
-msgstr "limpah bawah rentang"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:579
-msgid "range overflow"
-msgstr "limpah atas rentang"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:584
-msgid "step mismatch"
-msgstr "langkah tak cocok"
diff --git a/Source/WebKit/gtk/po/mr.po b/Source/WebKit/gtk/po/mr.po
index 2552ef0e5..1717fbead 100644
--- a/Source/WebKit/gtk/po/mr.po
+++ b/Source/WebKit/gtk/po/mr.po
@@ -7,245 +7,788 @@ msgid ""
 msgstr ""
 "Project-Id-Version: webkit.HEAD.mr\n"
 "Report-Msgid-Bugs-To: http://bugs.webkit.org\n"
-"POT-Creation-Date: 2010-12-27 15:26+0000\n"
-"PO-Revision-Date: 2012-03-22 16:38+0530\n"
+"POT-Creation-Date: 2012-10-24 18:00+0000\n"
+"PO-Revision-Date: 2012-10-31 11:36+0530\n"
 "Last-Translator: Sandeep Shedmake <sshedmak@redhat.com>\n"
 "Language-Team: Marathi <kde-i18n-doc@kde.org>\n"
+"Language: mr\n"
 "MIME-Version: 1.0\n"
 "Content-Type: text/plain; charset=UTF-8\n"
 "Content-Transfer-Encoding: 8bit\n"
-"Language: mr\n"
-"X-Generator: Lokalize 1.2\n"
+"X-Generator: Lokalize 1.5\n"
 "Plural-Forms: nplurals=2; plural=n != 1;\n"
 
-#: ../WebCoreSupport/ChromeClientGtk.cpp:589
-msgid "Upload File"
-msgstr "फाइल अपलोड करा"
+#: ../../../WebCore/platform/gtk/ErrorsGtk.cpp:36
+msgid "Load request cancelled"
+msgstr "लोड विनंती रद्द केली"
+
+#: ../../../WebCore/platform/gtk/ErrorsGtk.cpp:42
+msgid "Not allowed to use restricted network port"
+msgstr "प्रतिबंधित नेटवर्क पोर्टच्या वापरकरीता परवानगी नाही"
+
+#: ../../../WebCore/platform/gtk/ErrorsGtk.cpp:48
+msgid "URL cannot be shown"
+msgstr "URL दाखवणे अशक्य"
+
+#: ../../../WebCore/platform/gtk/ErrorsGtk.cpp:54
+msgid "Frame load was interrupted"
+msgstr "फ्रेम लोडमध्ये व्यत्यय आढळले"
+
+#: ../../../WebCore/platform/gtk/ErrorsGtk.cpp:60
+msgid "Content with the specified MIME type cannot be shown"
+msgstr "ठराविक MIME प्रकारसह कंटेंट दाखवणे अशक्य"
+
+#: ../../../WebCore/platform/gtk/ErrorsGtk.cpp:66
+msgid "File does not exist"
+msgstr "फाइल अस्तित्वात नाही"
+
+#: ../../../WebCore/platform/gtk/ErrorsGtk.cpp:72
+msgid "Plugin will handle load"
+msgstr "प्लगइन लोड हाताळेल"
+
+#: ../../../WebCore/platform/gtk/ErrorsGtk.cpp:84
+msgid "User cancelled the download"
+msgstr "वापरकर्त्याने डाऊनलोड रद्द केले"
+
+#: ../../../WebCore/platform/gtk/ErrorsGtk.cpp:104
+msgid "Printer not found"
+msgstr "प्रिंटर आढळले नाही"
+
+#: ../../../WebCore/platform/gtk/ErrorsGtk.cpp:111
+#| msgid "Enable page cache"
+msgid "Invalid page range"
+msgstr "अवैध पृष्ठ व्याप्ति"
+
+#: ../../../WebCore/platform/gtk/GtkAuthenticationDialog.cpp:123
+#, c-format
+msgid "A username and password are being requested by the site %s"
+msgstr "वापरकर्तानाव व पासवर्ड स्थळ %s तर्फे विनंती केले जात आहे"
+
+#: ../../../WebCore/platform/gtk/GtkAuthenticationDialog.cpp:158
+msgid "Server message:"
+msgstr "सर्व्हर संदेश:"
+
+#: ../../../WebCore/platform/gtk/GtkAuthenticationDialog.cpp:181
+#: ../../../WebCore/platform/gtk/GtkAuthenticationDialog.cpp:184
+msgid "Username:"
+msgstr "वापरकर्तानाव:"
+
+#: ../../../WebCore/platform/gtk/GtkAuthenticationDialog.cpp:182
+#: ../../../WebCore/platform/gtk/GtkAuthenticationDialog.cpp:185
+msgid "Password:"
+msgstr "पासवर्ड:"
+
+#: ../../../WebCore/platform/gtk/GtkAuthenticationDialog.cpp:198
+msgid "_Remember password"
+msgstr "पासवर्ड लक्षात ठेवा (_R)"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:56
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:61
+msgid "Submit"
+msgstr "सादर करा"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:66
+msgid "Reset"
+msgstr "पूर्ववत् करा"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:71
+msgid "Details"
+msgstr "तपशील"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:76
+msgid "This is a searchable index. Enter search keywords: "
+msgstr "हे शोधण्याजोगी इंडेक्स आहे. शोध मुख्यशब्दे द्या: "
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:81
+msgid "Choose File"
+msgstr "फाइल पसंत करा"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:86
+#| msgid "Choose File"
+msgid "Choose Files"
+msgstr "फाइल्स् पसंत करा"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:91
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:96
+msgid "(None)"
+msgstr "(काहिच नाही)"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:101
+msgid "Open Link in New _Window"
+msgstr "नवीन पटलात दुवा उघडा (_W)"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:106
+msgid "_Download Linked File"
+msgstr "लिंक केलेली फाइल डाऊनलोड करा (_D)"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:111
+msgid "Copy Link Loc_ation"
+msgstr "दुवाच्या ठिकाणाचे प्रत बनवा (_a)"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:116
+msgid "Open _Image in New Window"
+msgstr "प्रतिमाला नविन पटलात उघडा (_I)"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:121
+msgid "Sa_ve Image As"
+msgstr "प्रतिमाला असे साठवा (_v)"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:126
+msgid "Cop_y Image"
+msgstr "प्रतिमाचे प्रत बनवा (_y)"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:131
+#| msgid "Cop_y Image"
+msgid "Copy Image _Address"
+msgstr "प्रतिमा पत्याचे प्रत बनवा (_A)"
 
-#: ../WebCoreSupport/ContextMenuClientGtk.cpp:63
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:194
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:136
+msgid "Open _Video in New Window"
+msgstr "नविन पटलात व्हिडीओ उघडा (_V)"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:141
+msgid "Open _Audio in New Window"
+msgstr "नवीन पटलात ऑडिओ उघडा (_A)"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:146
+msgid "Cop_y Video Link Location"
+msgstr "व्हिडीओ दुवा ठिकाणाचे प्रत बनवा (_y)"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:151
+msgid "Cop_y Audio Link Location"
+msgstr "ऑडीओ दुवा ठिकाणाचे प्रत बनवा (_y)"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:156
+msgid "_Toggle Media Controls"
+msgstr "मिडीया कंट्रोल्स् बदलवा (_T)"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:161
+msgid "Toggle Media _Loop Playback"
+msgstr "मिडीया लूप प्लेबॅक बदला (_L)"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:166
+msgid "Switch Video to _Fullscreen"
+msgstr "व्हिडीओ पडदाभर वापरा (_F)"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:171
+msgid "_Play"
+msgstr "चालवा (_P)"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:176
+msgid "_Pause"
+msgstr "थांबवा (_P)"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:181
+msgid "_Mute"
+msgstr "मंद करा (_M)"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:186
+msgid "Open _Frame in New Window"
+msgstr "फ्रेमला नविन पटलात उघडा (_F)"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:209
+msgid "_Insert Unicode Control Character"
+msgstr "युनिकोड कंट्रोल कॅरेक्टर द्या (_I)"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:214
 msgid "Input _Methods"
 msgstr "इंपुट पद्धती (_M)"
 
-#: ../WebCoreSupport/ContextMenuClientGtk.cpp:80
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:237
+msgid "_Reload"
+msgstr "पुनःलोड करा (_R)"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:254
+msgid "No Guesses Found"
+msgstr "अनुमान आढळले नाही"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:259
+msgid "_Ignore Spelling"
+msgstr "वर्णलेखनकडे दुर्लक्ष करा (_I)"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:264
+msgid "_Learn Spelling"
+msgstr "शुध्दलेखन शिका (_L)"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:269
+msgid "_Search the Web"
+msgstr "वेब शोधा (_S)"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:274
+msgid "_Look Up in Dictionary"
+msgstr "शब्दकोषात पहा (_L)"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:279
+msgid "_Open Link"
+msgstr "दुवा उघडा (_O)"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:284
+msgid "Ignore _Grammar"
+msgstr "व्याकरणकडे दुर्लक्ष करा (_G)"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:289
+msgid "Spelling and _Grammar"
+msgstr "शुध्दलेखन व व्याकरण (_G)"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:294
+msgid "_Show Spelling and Grammar"
+msgstr "शुध्दलेखन व व्याकरण दाखवा (_S)"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:294
+msgid "_Hide Spelling and Grammar"
+msgstr "शुध्दलेखन व व्याकरण लपवा (_H)"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:299
+msgid "_Check Document Now"
+msgstr "आत्ता दस्तऐवज तपासा (_C)"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:304
+msgid "Check Spelling While _Typing"
+msgstr "टाइपिंग करतेवेळी शुध्दलेखन तपासा (_T)"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:309
+msgid "Check _Grammar With Spelling"
+msgstr "शुध्दलेखनसह व्याकरण तपासा (_G)"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:314
+msgid "_Font"
+msgstr "फाँट (_F)"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:337
+msgid "_Outline"
+msgstr "रूपरेषा (_O)"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:342
+msgid "Inspect _Element"
+msgstr "एलिमेंटची चौकशी करा (_E)"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:347
 msgid "LRM _Left-to-right mark"
 msgstr "LRM डावे-ते-उजवे चिन्ह (_L)"
 
-#: ../WebCoreSupport/ContextMenuClientGtk.cpp:81
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:352
 msgid "RLM _Right-to-left mark"
 msgstr "RLM उजवे-ते-डावे चिन्ह (_R)"
 
-#: ../WebCoreSupport/ContextMenuClientGtk.cpp:82
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:357
 msgid "LRE Left-to-right _embedding"
 msgstr "LRE डावे-ते-उजवे एम्बेडिंग (_e)"
 
-#: ../WebCoreSupport/ContextMenuClientGtk.cpp:83
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:362
 msgid "RLE Right-to-left e_mbedding"
 msgstr "RLE उजवे-ते-डावे एम्बेडिंग (_m)"
 
-#: ../WebCoreSupport/ContextMenuClientGtk.cpp:84
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:367
 msgid "LRO Left-to-right _override"
 msgstr "LRO डावे-ते-उजवे ओव्हरराइड (_o)"
 
-#: ../WebCoreSupport/ContextMenuClientGtk.cpp:85
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:372
 msgid "RLO Right-to-left o_verride"
 msgstr "RLO उजवे-ते-डावे ओव्हरराइड (_v)"
 
-#: ../WebCoreSupport/ContextMenuClientGtk.cpp:86
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:377
 msgid "PDF _Pop directional formatting"
 msgstr "PDF पॉप डाइरेक्शनल रूपण (_P)"
 
-#: ../WebCoreSupport/ContextMenuClientGtk.cpp:87
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:382
 msgid "ZWS _Zero width space"
 msgstr "ZWS झिरो विड्थ् स्पेस् (_Z)"
 
-#: ../WebCoreSupport/ContextMenuClientGtk.cpp:88
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:387
 msgid "ZWJ Zero width _joiner"
 msgstr "ZWJ झिरो विड्थ् जाइनर (_j)"
 
-#: ../WebCoreSupport/ContextMenuClientGtk.cpp:89
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:392
 msgid "ZWNJ Zero width _non-joiner"
 msgstr "ZWNJ झिरो विड्थ् नॉन जॉइनर (_n)"
 
-#: ../WebCoreSupport/ContextMenuClientGtk.cpp:111
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:189
-msgid "_Insert Unicode Control Character"
-msgstr "युनिकोड कंट्रोल कॅरेक्टर द्या (_I)"
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:397
+msgid "No recent searches"
+msgstr "नविन शोध आढळले नाही"
 
-#: ../WebCoreSupport/FrameLoaderClientGtk.cpp:1180
-msgid "Load request cancelled"
-msgstr "लोड विनंती रद्द केली"
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:402
+msgid "Recent searches"
+msgstr "नविन शोध"
 
-#: ../WebCoreSupport/FrameLoaderClientGtk.cpp:1186
-msgid "Not allowed to use restricted network port"
-msgstr "प्रतिबंधित नेटवर्क पोर्टच्या वापरकरीता परवानगी नाही"
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:407
+msgid "_Clear recent searches"
+msgstr "नविन शोध नष्ट करा (_C)"
 
-#: ../WebCoreSupport/FrameLoaderClientGtk.cpp:1192
-msgid "URL cannot be shown"
-msgstr "URL दाखवणे अशक्य"
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:412
+msgid "term"
+msgstr "संज्ञा"
 
-#: ../WebCoreSupport/FrameLoaderClientGtk.cpp:1198
-msgid "Frame load was interrupted"
-msgstr "फ्रेम लोडमध्ये व्यत्यय आढळले"
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:417
+msgid "definition"
+msgstr "वर्णन"
 
-#: ../WebCoreSupport/FrameLoaderClientGtk.cpp:1204
-msgid "Content with the specified MIME type cannot be shown"
-msgstr "ठराविक MIME प्रकारसह कंटेंट दाखवणे अशक्य"
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:422
+msgid "footer"
+msgstr "फूटर"
 
-#: ../WebCoreSupport/FrameLoaderClientGtk.cpp:1210
-msgid "File does not exist"
-msgstr "फाइल अस्तित्वात नाही"
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:427
+msgid "press"
+msgstr "दाबा"
 
-#: ../WebCoreSupport/FrameLoaderClientGtk.cpp:1216
-msgid "Plugin will handle load"
-msgstr "प्लगइन लोड हाताळेल"
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:432
+msgid "select"
+msgstr "निवडा"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:437
+msgid "activate"
+msgstr "सुरू करा"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:442
+msgid "uncheck"
+msgstr "निवड अशक्य करा"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:447
+msgid "check"
+msgstr "तपासणी करा"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:452
+msgid "jump"
+msgstr "येथे जा"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:467
+msgid "Missing Plug-in"
+msgstr "प्लगइन आढळले नाही"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:473
+msgid "Plug-in Failure"
+msgstr "प्लगइन अपयश"
+
+#. FIXME: If this file gets localized, this should really be localized as one string with a wildcard for the number.
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:491
+msgid " files"
+msgstr " फाइल्स्"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:496
+msgid "Unknown"
+msgstr "अपरिचीत"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:501
+#, c-format
+msgctxt "Title string for images"
+msgid "%s  (%dx%d pixels)"
+msgstr "%s  (%dx%d पिक्सेल्स्)"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:513
+msgid "Loading..."
+msgstr "लोड करत आहे..."
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:518
+msgid "Live Broadcast"
+msgstr "लाइव्ह ब्रॉडकास्ट"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:524
+msgid "audio element controller"
+msgstr "ऑडिओ एलिमेंट कंट्रोलर"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:526
+msgid "video element controller"
+msgstr "व्हिडीओ एलिमेंट कंट्रोलर"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:528
+msgid "mute"
+msgstr "मंद करा"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:530
+msgid "unmute"
+msgstr "मंद अशक्य करा"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:532
+msgid "play"
+msgstr "चालवा"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:534
+msgid "pause"
+msgstr "थांबा"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:536
+msgid "movie time"
+msgstr "चित्रपट वेळ"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:538
+msgid "timeline slider thumb"
+msgstr "टाइमलाइन स्लाइडर थंब"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:540
+msgid "back 30 seconds"
+msgstr "मागे 30 सेकंद"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:542
+msgid "return to realtime"
+msgstr "रिअलटाइमकडे जा"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:544
+msgid "elapsed time"
+msgstr "गेलेला वेळ"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:546
+msgid "remaining time"
+msgstr "उर्वरित वेळ"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:548
+msgid "status"
+msgstr "स्थिती"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:550
+#| msgid "fullscreen"
+msgid "enter fullscreen"
+msgstr "पडदाभर वापर करा"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:552
+#| msgid "Exit Fullscreen"
+msgid "exit fullscreen"
+msgstr "पडदाभरपासून बाहेर पडा"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:554
+msgid "fast forward"
+msgstr "फास्ट फॉरवर्ड"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:556
+msgid "fast reverse"
+msgstr "फास्ट रिव्हर्स्"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:558
+msgid "show closed captions"
+msgstr "क्लोस्ड कॅपशन्स् दाखवा"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:560
+msgid "hide closed captions"
+msgstr "क्लोस्ड् कॅप्शन्स् लपवा"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:562
+#| msgid "_Toggle Media Controls"
+msgid "media controls"
+msgstr "मिडीया कंट्रोल्स्"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:571
+msgid "audio element playback controls and status display"
+msgstr "ऑडिओ एलिमेंट प्लेबॅक कंट्रोल्स् व स्थिती डिस्पले"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:573
+msgid "video element playback controls and status display"
+msgstr "व्हिडीओ एलिमेंट प्लेबॅक कंट्रोल्स् व स्थिती डिस्पले"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:575
+msgid "mute audio tracks"
+msgstr "ऑडिओ ट्रॅक्स् मंद करा"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:577
+msgid "unmute audio tracks"
+msgstr "ऑडिओ ट्रॅक्स् मंद अशक्य करा"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:579
+msgid "begin playback"
+msgstr "प्लेबॅक सुरू करा"
 
-#: ../WebCoreSupport/FullscreenVideoController.cpp:385
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:581
+msgid "pause playback"
+msgstr "प्लेबॅक थांबवा"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:583
+msgid "movie time scrubber"
+msgstr "चित्रपट वेळ स्क्रुबर"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:585
+msgid "movie time scrubber thumb"
+msgstr "चित्रपट वेळ स्क्रुबर थंब"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:587
+msgid "seek movie back 30 seconds"
+msgstr "सीक मुव्हि मागे 30 सेकंद"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:589
+msgid "return streaming movie to real time"
+msgstr "स्ट्रिमिंग मुव्हि ते रिअल टाइम पुरवा"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:591
+msgid "current movie time in seconds"
+msgstr "सध्याचे सेकंदातील मुव्हि वेळ"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:593
+msgid "number of seconds of movie remaining"
+msgstr "उर्वरित चित्रपटकरीता सेकंदातील वेळ"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:595
+msgid "current movie status"
+msgstr "चित्रपटची सध्याची स्थिती"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:597
+msgid "seek quickly back"
+msgstr "पटकन मागे सीक करा"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:599
+msgid "seek quickly forward"
+msgstr "पटकन पुढे सीक करा"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:601
+msgid "Play movie in fullscreen mode"
+msgstr "चित्रपटला पडदाभर मोडमध्ये चालवा"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:603
+#| msgid "Exit from fullscreen mode"
+msgid "Exit fullscreen mode"
+msgstr "पडदाभर मोडपासून बाहेर पडा"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:605
+msgid "start displaying closed captions"
+msgstr "बंद कॅपशन्स् दाखवायला सुरू करा"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:607
+msgid "stop displaying closed captions"
+msgstr "बंद कॅपशन्स् दाखवणे बंद करा"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:616
+msgid "indefinite time"
+msgstr "अमर्यादीत वेळ"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:646
+msgid "value missing"
+msgstr "मूल्य आढळले नाही"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:682
+msgid "type mismatch"
+msgstr "टाइप जुळले नाही"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:705
+msgid "pattern mismatch"
+msgstr "पॅटर्न जुळले नाही"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:710
+msgid "too long"
+msgstr "खूपच लांब"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:715
+msgid "range underflow"
+msgstr "रेंज अंडरफ्लो"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:720
+msgid "range overflow"
+msgstr "रेंज ओव्हरफ्लो"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:725
+msgid "step mismatch"
+msgstr "स्टेप जुळले नाही"
+
+#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:730
+msgid "Unacceptable TLS certificate"
+msgstr "अस्वीकार्य TLS प्रमाणपत्र"
+
+#: ../WebCoreSupport/FullscreenVideoController.cpp:389
 msgid "Play"
 msgstr "चालवा"
 
-#: ../WebCoreSupport/FullscreenVideoController.cpp:387
+#: ../WebCoreSupport/FullscreenVideoController.cpp:391
 msgid "Pause"
 msgstr "थांबा"
 
-#: ../WebCoreSupport/FullscreenVideoController.cpp:533
+#: ../WebCoreSupport/FullscreenVideoController.cpp:541
 msgid "Play / Pause"
 msgstr "चालवा किंवा थांबवा"
 
-#: ../WebCoreSupport/FullscreenVideoController.cpp:533
+#: ../WebCoreSupport/FullscreenVideoController.cpp:541
 msgid "Play or pause the media"
 msgstr "मिडीयाला चालवा किंवा थांबवा"
 
-#: ../WebCoreSupport/FullscreenVideoController.cpp:541
+#: ../WebCoreSupport/FullscreenVideoController.cpp:549
 msgid "Time:"
 msgstr "वेळ:"
 
-#: ../WebCoreSupport/FullscreenVideoController.cpp:565
+#: ../WebCoreSupport/FullscreenVideoController.cpp:576
 msgid "Exit Fullscreen"
 msgstr "पडदाभरपासून बाहेर पडा"
 
-#: ../WebCoreSupport/FullscreenVideoController.cpp:565
+#: ../WebCoreSupport/FullscreenVideoController.cpp:576
 msgid "Exit from fullscreen mode"
 msgstr "पडदाभर मोडपासून बाहेर पडा"
 
-#: ../webkit/webkitdownload.cpp:273
+#: ../webkit/webkitdownload.cpp:276
 msgid "Network Request"
 msgstr "नेवटवर्क विनंती"
 
-#: ../webkit/webkitdownload.cpp:274
+#: ../webkit/webkitdownload.cpp:277
 msgid "The network request for the URI that should be downloaded"
 msgstr "डाऊनलोड करण्याजोगी URI करीता नेटवर्क विनंती"
 
-#: ../webkit/webkitdownload.cpp:288
+#: ../webkit/webkitdownload.cpp:291
 msgid "Network Response"
 msgstr "नेटवर्क प्रतिसाद"
 
-#: ../webkit/webkitdownload.cpp:289
+#: ../webkit/webkitdownload.cpp:292
 msgid "The network response for the URI that should be downloaded"
 msgstr "डाऊनलोड करण्याजोगी URI करीता नेटवर्क प्रतिसाद"
 
-#: ../webkit/webkitdownload.cpp:303
+#: ../webkit/webkitdownload.cpp:306
 msgid "Destination URI"
 msgstr "लक्ष्य URI"
 
-#: ../webkit/webkitdownload.cpp:304
+#: ../webkit/webkitdownload.cpp:307
 msgid "The destination URI where to save the file"
 msgstr "फाइल साठवण्याकरीता लक्ष्य URI"
 
-#: ../webkit/webkitdownload.cpp:318
+#: ../webkit/webkitdownload.cpp:321
 msgid "Suggested Filename"
 msgstr "सूचवलेले फाइलचेनाव"
 
-#: ../webkit/webkitdownload.cpp:319
+#: ../webkit/webkitdownload.cpp:322
 msgid "The filename suggested as default when saving"
 msgstr "साठवतेवेळी पूर्वनिर्धारित सूचवलेले फाइलचे नाव"
 
-#: ../webkit/webkitdownload.cpp:336
+#: ../webkit/webkitdownload.cpp:339
 msgid "Progress"
 msgstr "प्रगती"
 
-#: ../webkit/webkitdownload.cpp:337
+#: ../webkit/webkitdownload.cpp:340
 msgid "Determines the current progress of the download"
 msgstr "डाऊनलोडची सध्याची प्रगती ओळखतो"
 
-#: ../webkit/webkitdownload.cpp:350
+#: ../webkit/webkitdownload.cpp:353
 msgid "Status"
 msgstr "स्थिती"
 
-#: ../webkit/webkitdownload.cpp:351
+#: ../webkit/webkitdownload.cpp:354
 msgid "Determines the current status of the download"
 msgstr "डाऊनलोडची सध्याची स्थिती ओळखतो"
 
-#: ../webkit/webkitdownload.cpp:366
+#: ../webkit/webkitdownload.cpp:369
 msgid "Current Size"
 msgstr "सध्याचे आकार"
 
-#: ../webkit/webkitdownload.cpp:367
+#: ../webkit/webkitdownload.cpp:370
 msgid "The length of the data already downloaded"
 msgstr "आधिपासूनच डाऊनलोड केलेल्या डाटाची लांबी"
 
-#: ../webkit/webkitdownload.cpp:381
+#: ../webkit/webkitdownload.cpp:384
 msgid "Total Size"
 msgstr "एकूण आकार"
 
-#: ../webkit/webkitdownload.cpp:382
+#: ../webkit/webkitdownload.cpp:385
 msgid "The total size of the file"
 msgstr "फाइलचे एकूण आकार"
 
-#: ../webkit/webkitdownload.cpp:534
-msgid "User cancelled the download"
-msgstr "वापरकर्त्याने डाऊनलोड रद्द केले"
+#: ../webkit/webkitfavicondatabase.cpp:146
+#: ../webkit/webkitfavicondatabase.cpp:581
+msgid "Operation was cancelled"
+msgstr "कार्य रद्द केले"
+
+#: ../webkit/webkitfavicondatabase.cpp:255
+#: ../webkit/webkiticondatabase.cpp:150
+msgid "Path"
+msgstr "मार्ग"
+
+#: ../webkit/webkitfavicondatabase.cpp:256
+#: ../webkit/webkiticondatabase.cpp:151
+#| msgid "The absolute filename of the Web Storage database"
+msgid "The absolute path of the icon database folder"
+msgstr "चिन्ह डाटाबेस फोल्डरचे ॲबसोल्युट मार्ग"
+
+#: ../webkit/webkitfilechooserrequest.cpp:129
+#| msgid "MIME Type"
+msgid "MIME types filter"
+msgstr "MIME प्रकारचे फिल्टर"
+
+#: ../webkit/webkitfilechooserrequest.cpp:130
+#| msgid "The inner DOM node associated with the hit test result."
+msgid "The filter currently associated with the request"
+msgstr "विनंतीसह संबंधित सध्याचे फिल्टर"
+
+#: ../webkit/webkitfilechooserrequest.cpp:145
+#| msgid "MIME Type"
+msgid "MIME types"
+msgstr "MIME प्रकार"
+
+#: ../webkit/webkitfilechooserrequest.cpp:146
+#| msgid "The inner DOM node associated with the hit test result."
+msgid "The list of MIME types associated with the request"
+msgstr "विनंतीसह संबंधित MIME प्रकारची सूची"
+
+#: ../webkit/webkitfilechooserrequest.cpp:161
+msgid "Select multiple files"
+msgstr "एकापेक्षा जास्त फाइल्स्ची नीवड करा"
+
+#: ../webkit/webkitfilechooserrequest.cpp:162
+msgid "Whether the file chooser should allow selecting multiple files"
+msgstr "फाइल चूजरने एकापेक्षा जास्त फाइल्स् पसंत करण्यास परवानगी द्यायची"
+
+#: ../webkit/webkitfilechooserrequest.cpp:177
+#| msgid " files"
+msgid "Selected files"
+msgstr "नीवडलेले फाइल्स्"
 
-#: ../webkit/webkithittestresult.cpp:156
+#: ../webkit/webkitfilechooserrequest.cpp:178
+#| msgid "The inner DOM node associated with the hit test result."
+msgid "The list of selected files associated with the request"
+msgstr "विनंतीसह संबंधित नीवडलेल्या फाइल्स्ची सूची."
+
+#: ../webkit/webkithittestresult.cpp:175
 msgid "Context"
 msgstr "संदर्भ"
 
-#: ../webkit/webkithittestresult.cpp:157
+#: ../webkit/webkithittestresult.cpp:176
 msgid "Flags indicating the kind of target that received the event."
 msgstr "लक्ष्यचे प्रकार निर्देशीत करणारे फ्लॅग ज्यास इव्हेंट प्राप्त झाले."
 
-#: ../webkit/webkithittestresult.cpp:171
+#: ../webkit/webkithittestresult.cpp:190
 msgid "Link URI"
 msgstr "दुवा URI"
 
-#: ../webkit/webkithittestresult.cpp:172
+#: ../webkit/webkithittestresult.cpp:191
 msgid "The URI to which the target that received the event points, if any."
 msgstr "लक्ष्यकरीता प्राप्त इव्हेंट पॉईंटस्, असल्यास करीताचे URI."
 
-#: ../webkit/webkithittestresult.cpp:185
+#: ../webkit/webkithittestresult.cpp:204
 msgid "Image URI"
 msgstr "प्रतिमा URI"
 
-#: ../webkit/webkithittestresult.cpp:186
+#: ../webkit/webkithittestresult.cpp:205
 msgid ""
 "The URI of the image that is part of the target that received the event, if "
 "any."
 msgstr ""
 "लक्ष्याचे भाग असलेल्या प्रतिमाचे URI ज्यास इव्हेंट प्राप्त झाले, असल्यास."
 
-#: ../webkit/webkithittestresult.cpp:199
+#: ../webkit/webkithittestresult.cpp:218
 msgid "Media URI"
 msgstr "मीडिया URI"
 
-#: ../webkit/webkithittestresult.cpp:200
+#: ../webkit/webkithittestresult.cpp:219
 msgid ""
 "The URI of the media that is part of the target that received the event, if "
 "any."
 msgstr ""
 "लक्ष्याचे भाग असलेल्या मिडीयाचे URI ज्यास इव्हेंट प्राप्त झाले, असल्यास."
 
-#: ../webkit/webkithittestresult.cpp:221
+#: ../webkit/webkithittestresult.cpp:240
 msgid "Inner node"
 msgstr "आंतरिक नोड"
 
-#: ../webkit/webkithittestresult.cpp:222
+#: ../webkit/webkithittestresult.cpp:241
 msgid "The inner DOM node associated with the hit test result."
 msgstr "हिट चाचणी परिणामसह संबंधित आंतरिक DOM नोड."
 
+#: ../webkit/webkithittestresult.cpp:254
+msgid "X coordinate"
+msgstr "X कोऑर्डिनेट"
+
+#: ../webkit/webkithittestresult.cpp:255
+msgid "The x coordinate of the event relative to the view's window."
+msgstr "अवलोकनच्या पटलाशी संबंधित घटनाचे x कोऑर्डिनेट."
+
+#: ../webkit/webkithittestresult.cpp:268
+msgid "Y coordinate"
+msgstr "Y कोऑर्डिनेट"
+
+#: ../webkit/webkithittestresult.cpp:269
+msgid "The y coordinate of the event relative to the view's window."
+msgstr "अवलोकनच्या पटलाशी संबंधित घटनाचे y कोऑर्डिनेट."
+
 #: ../webkit/webkitnetworkrequest.cpp:134
-#: ../webkit/webkitnetworkresponse.cpp:134 ../webkit/webkitwebframe.cpp:323
-#: ../webkit/webkitwebhistoryitem.cpp:176 ../webkit/webkitwebresource.cpp:126
-#: ../webkit/webkitwebview.cpp:2997
+#: ../webkit/webkitnetworkresponse.cpp:143 ../webkit/webkitwebframe.cpp:484
+#: ../webkit/webkitwebhistoryitem.cpp:176 ../webkit/webkitwebresource.cpp:209
+#: ../webkit/webkitwebview.cpp:3103
 msgid "URI"
 msgstr "URI"
 
@@ -254,7 +797,7 @@ msgid "The URI to which the request will be made."
 msgstr "URI ज्याकरीता विनंती केली जाईल."
 
 #: ../webkit/webkitnetworkrequest.cpp:148
-#: ../webkit/webkitnetworkresponse.cpp:148
+#: ../webkit/webkitnetworkresponse.cpp:157
 msgid "Message"
 msgstr "संदेश"
 
@@ -262,14 +805,24 @@ msgstr "संदेश"
 msgid "The SoupMessage that backs the request."
 msgstr "SoupMessage जे विनंतीला पाठिंबा पुरवते."
 
-#: ../webkit/webkitnetworkresponse.cpp:135
+#: ../webkit/webkitnetworkresponse.cpp:144
 msgid "The URI to which the response will be made."
 msgstr "प्रतिसाद सादर करण्याजोगी URI."
 
-#: ../webkit/webkitnetworkresponse.cpp:149
+#: ../webkit/webkitnetworkresponse.cpp:158
 msgid "The SoupMessage that backs the response."
 msgstr "SoupMessage जे विनंतीला पाठिंबा पुरवते."
 
+#: ../webkit/webkitnetworkresponse.cpp:171
+#| msgid "Suggested Filename"
+msgid "Suggested filename"
+msgstr "शिफारसीय फाइलनाव"
+
+#: ../webkit/webkitnetworkresponse.cpp:172
+#| msgid "The text encoding name of the resource"
+msgid "The suggested filename for the response."
+msgstr "प्रतिसादकरीता शिफारसीय फाइलनाव."
+
 #: ../webkit/webkitsecurityorigin.cpp:150
 msgid "Protocol"
 msgstr "प्रोटोकॉल"
@@ -310,26 +863,139 @@ msgstr "वेब डाटाबेस कोटा"
 msgid "The web database quota of the security origin in bytes"
 msgstr "सुरक्षात्मक उगमचे वेब डाटाबेस कोटाचे बाइट्स्मधील आकार"
 
-#: ../webkit/webkitsoupauthdialog.c:264
-#, c-format
-msgid "A username and password are being requested by the site %s"
-msgstr "वापरकर्तानाव व पासवर्ड स्थळ %s तर्फे विनंती केले जात आहे"
+#: ../webkit/webkitviewportattributes.cpp:139
+msgid "Device Width"
+msgstr "साधनाची रूंदी"
 
-#: ../webkit/webkitsoupauthdialog.c:294
-msgid "Server message:"
-msgstr "सर्व्हर संदेश:"
+#: ../webkit/webkitviewportattributes.cpp:140
+#| msgid "The uri of the resource"
+msgid "The width of the screen."
+msgstr "स्क्रीनची रूंदी."
 
-#: ../webkit/webkitsoupauthdialog.c:307
-msgid "Username:"
-msgstr "वापरकर्तानाव:"
+#: ../webkit/webkitviewportattributes.cpp:161
+msgid "Device Height"
+msgstr "साधनाची ऊंची"
 
-#: ../webkit/webkitsoupauthdialog.c:309
-msgid "Password:"
-msgstr "पासवर्ड:"
+#: ../webkit/webkitviewportattributes.cpp:162
+#| msgid "The uri of the resource"
+msgid "The height of the screen."
+msgstr "स्क्रीनची ऊंची."
 
-#: ../webkit/webkitsoupauthdialog.c:318
-msgid "_Remember password"
-msgstr "पासवर्ड लक्षात ठेवा (_R)"
+#: ../webkit/webkitviewportattributes.cpp:185
+msgid "Available Width"
+msgstr "उपलब्ध रूंदी"
+
+#: ../webkit/webkitviewportattributes.cpp:186
+#| msgid "The title of the history item"
+msgid "The width of the visible area."
+msgstr "दृष्यासप्द क्षेत्राची रूंदी."
+
+#: ../webkit/webkitviewportattributes.cpp:209
+msgid "Available Height"
+msgstr "उपलब्ध ऊंची"
+
+#: ../webkit/webkitviewportattributes.cpp:210
+#| msgid "The title of the history item"
+msgid "The height of the visible area."
+msgstr "दृष्यास्पद क्षेत्रीची ऊंची."
+
+#: ../webkit/webkitviewportattributes.cpp:231
+msgid "Desktop Width"
+msgstr "डेस्कटॉप रूंदी"
+
+#: ../webkit/webkitviewportattributes.cpp:232
+msgid ""
+"The width of viewport that works well for most web pages designed for "
+"desktop."
+msgstr ""
+"डेस्कटॉपकरीता डिजाइन केलेल्या बहुतांश वेब पृष्ठांकरीता योग्य प्रकारे कार्य "
+"करणाऱ्या व्युउपोर्टची रूंदी."
+
+#: ../webkit/webkitviewportattributes.cpp:254
+msgid "Device DPI"
+msgstr "साधन DPI"
+
+#: ../webkit/webkitviewportattributes.cpp:255
+msgid "The number of dots per inch of the screen."
+msgstr "स्क्रीनचे डॉट्स् पर इंचची संख्या."
+
+#: ../webkit/webkitviewportattributes.cpp:273
+msgid "Width"
+msgstr "रूंदी"
+
+#: ../webkit/webkitviewportattributes.cpp:274
+#| msgid "The title of the history item"
+msgid "The width of the viewport."
+msgstr "व्युउपोर्टची रूंदी."
+
+#: ../webkit/webkitviewportattributes.cpp:292
+msgid "Height"
+msgstr "ऊंची"
+
+#: ../webkit/webkitviewportattributes.cpp:293
+#| msgid "The title of the history item"
+msgid "The height of the viewport."
+msgstr "व्युउपोर्टची ऊंची."
+
+#: ../webkit/webkitviewportattributes.cpp:311
+msgid "Initial Scale Factor"
+msgstr "प्रारंभिक स्केल प्रमाण"
+
+#: ../webkit/webkitviewportattributes.cpp:312
+#| msgid "The total size of the file"
+msgid "The initial scale of the viewport."
+msgstr "व्युउपोर्टची प्रारंभिक प्रमाण."
+
+#: ../webkit/webkitviewportattributes.cpp:330
+#| msgid "Minimum Logical Font Size"
+msgid "Minimum Scale Factor"
+msgstr "किमान स्केल प्रमाण"
+
+#: ../webkit/webkitviewportattributes.cpp:331
+#| msgid "The title of the history item"
+msgid "The minimum scale of the viewport."
+msgstr "व्युउपोर्टचे किमान स्केल."
+
+#: ../webkit/webkitviewportattributes.cpp:349
+msgid "Maximum Scale Factor"
+msgstr "कमाल स्केल प्रमाण"
+
+#: ../webkit/webkitviewportattributes.cpp:350
+#| msgid "The frame name of the resource"
+msgid "The maximum scale of the viewport."
+msgstr "व्युउपोर्टचे कमाल प्रमाण."
+
+#: ../webkit/webkitviewportattributes.cpp:368
+msgid "Device Pixel Ratio"
+msgstr "साधन पिक्सेल प्रमाण"
+
+#: ../webkit/webkitviewportattributes.cpp:369
+msgid "The device pixel ratio of the viewport."
+msgstr "व्युउपोर्टचे साधन पिक्सेल प्रमाण."
+
+#: ../webkit/webkitviewportattributes.cpp:387
+msgid "user-scalable"
+msgstr "युजर-स्केलेबल"
+
+#: ../webkit/webkitviewportattributes.cpp:388
+msgid "User Scalable"
+msgstr "युजर स्केलेबल"
+
+#: ../webkit/webkitviewportattributes.cpp:389
+msgid "Determines whether or not the user can zoom in and out."
+msgstr "वापरकर्ता मोठे व छोटे करू शकतो, ते ओळखतो."
+
+#: ../webkit/webkitviewportattributes.cpp:406
+msgid "valid"
+msgstr "वैध"
+
+#: ../webkit/webkitviewportattributes.cpp:407
+msgid "Valid"
+msgstr "वैध"
+
+#: ../webkit/webkitviewportattributes.cpp:408
+msgid "Determines whether or not the attributes are valid, and can be used."
+msgstr "गुणधर्म वैध आहे किंवा नाही हे ओळखतो, व त्याचा वापर करणे शक्य आहे."
 
 #: ../webkit/webkitwebdatabase.cpp:173
 msgid "Security Origin"
@@ -339,7 +1005,7 @@ msgstr "सुरक्षात्मक उगम"
 msgid "The security origin of the database"
 msgstr "डाटाबेसचे सुरक्षात्मक उगम"
 
-#: ../webkit/webkitwebdatabase.cpp:187 ../webkit/webkitwebframe.cpp:309
+#: ../webkit/webkitwebdatabase.cpp:187 ../webkit/webkitwebframe.cpp:470
 msgid "Name"
 msgstr "नाव"
 
@@ -379,37 +1045,37 @@ msgstr "फाइलनाव"
 msgid "The absolute filename of the Web Storage database"
 msgstr "वेब स्टोरेज डाटाबेसचे ॲब्सोल्युट फाइलनाव"
 
-#: ../webkit/webkitwebframe.cpp:310
+#: ../webkit/webkitwebframe.cpp:471
 msgid "The name of the frame"
 msgstr "फ्रेमचे नाव"
 
-#: ../webkit/webkitwebframe.cpp:316 ../webkit/webkitwebhistoryitem.cpp:144
-#: ../webkit/webkitwebview.cpp:2983
+#: ../webkit/webkitwebframe.cpp:477 ../webkit/webkitwebhistoryitem.cpp:144
+#: ../webkit/webkitwebview.cpp:3089
 msgid "Title"
 msgstr "शीर्षक"
 
-#: ../webkit/webkitwebframe.cpp:317
+#: ../webkit/webkitwebframe.cpp:478
 msgid "The document title of the frame"
 msgstr "फ्रेमचे दस्तऐवज शीर्षक"
 
-#: ../webkit/webkitwebframe.cpp:324
+#: ../webkit/webkitwebframe.cpp:485
 msgid "The current URI of the contents displayed by the frame"
 msgstr "फ्रेमतर्फे दाखवण्याजोगी कंटेंटस्चे सध्याचे URI"
 
-#: ../webkit/webkitwebframe.cpp:355
+#: ../webkit/webkitwebframe.cpp:516
 msgid "Horizontal Scrollbar Policy"
 msgstr "आडवे स्क्रोपट्टी करार"
 
-#: ../webkit/webkitwebframe.cpp:356
+#: ../webkit/webkitwebframe.cpp:517
 msgid ""
 "Determines the current policy for the horizontal scrollbar of the frame."
 msgstr "फ्रेमच्या आडव्या स्क्रोलपट्टीकरीता सध्याचे करार ओळखतो."
 
-#: ../webkit/webkitwebframe.cpp:373
+#: ../webkit/webkitwebframe.cpp:534
 msgid "Vertical Scrollbar Policy"
 msgstr "उभे स्क्रोपट्टी करार"
 
-#: ../webkit/webkitwebframe.cpp:374
+#: ../webkit/webkitwebframe.cpp:535
 msgid "Determines the current policy for the vertical scrollbar of the frame."
 msgstr "फ्रेमच्या उभ्या स्क्रोलपट्टीकरीता सध्याचे करार ओळखतो."
 
@@ -430,7 +1096,7 @@ msgid "The URI of the history item"
 msgstr "इतिहास घटकाचे URI"
 
 #: ../webkit/webkitwebhistoryitem.cpp:192
-#: ../webkit/webkitwebnavigationaction.cpp:171
+#: ../webkit/webkitwebnavigationaction.cpp:163
 msgid "Original URI"
 msgstr "मूळ URI"
 
@@ -446,972 +1112,677 @@ msgstr "शेवटच्यावेळी भेट दिलेली वे
 msgid "The time at which the history item was last visited"
 msgstr "शेवटच्यावेळी इतिहास घटाकाला भेट दिल्याची वेळ"
 
-#: ../webkit/webkitwebinspector.cpp:270
+#: ../webkit/webkitwebinspector.cpp:273
 msgid "Web View"
 msgstr "वेब दृष्य"
 
-#: ../webkit/webkitwebinspector.cpp:271
+#: ../webkit/webkitwebinspector.cpp:274
 msgid "The Web View that renders the Web Inspector itself"
 msgstr "वेब इंस्पेक्टर दाखवणारे वेब दृष्य"
 
-#: ../webkit/webkitwebinspector.cpp:284
+#: ../webkit/webkitwebinspector.cpp:287
 msgid "Inspected URI"
 msgstr "तपासलेले URI"
 
-#: ../webkit/webkitwebinspector.cpp:285
+#: ../webkit/webkitwebinspector.cpp:288
 msgid "The URI that is currently being inspected"
 msgstr "सद्या तपासले जाणारे URI"
 
-#: ../webkit/webkitwebinspector.cpp:301
+#: ../webkit/webkitwebinspector.cpp:304
 msgid "Enable JavaScript profiling"
 msgstr "जावास्क्रिप्ट प्रोफाइलिंग सुरु करा"
 
-#: ../webkit/webkitwebinspector.cpp:302
+#: ../webkit/webkitwebinspector.cpp:305
 msgid "Profile the executed JavaScript."
 msgstr "चालवलेल्या जावास्क्रिप्टची संक्षिप्त माहिती."
 
-#: ../webkit/webkitwebinspector.cpp:317
+#: ../webkit/webkitwebinspector.cpp:320
 msgid "Enable Timeline profiling"
 msgstr "टाइमलाइन प्रोफाइलिंग सुरू करा"
 
-#: ../webkit/webkitwebinspector.cpp:318
+#: ../webkit/webkitwebinspector.cpp:321
 msgid "Profile the WebCore instrumentation."
 msgstr "वेबकोर इंस्ट्रुमेंटेशनची संक्षिप्त माहिती द्या."
 
-#: ../webkit/webkitwebnavigationaction.cpp:156
+#: ../webkit/webkitwebnavigationaction.cpp:148
 msgid "Reason"
 msgstr "कारण"
 
-#: ../webkit/webkitwebnavigationaction.cpp:157
+#: ../webkit/webkitwebnavigationaction.cpp:149
 msgid "The reason why this navigation is occurring"
 msgstr "हे संचारन होण्याचे कारण द्या"
 
-#: ../webkit/webkitwebnavigationaction.cpp:172
+#: ../webkit/webkitwebnavigationaction.cpp:164
 msgid "The URI that was requested as the target for the navigation"
 msgstr "संचारनकरीता निवडलेले लक्ष्य ज्यास URI म्हणून विनंती केले"
 
-#: ../webkit/webkitwebnavigationaction.cpp:186
+#: ../webkit/webkitwebnavigationaction.cpp:178
 msgid "Button"
 msgstr "बटन"
 
-#: ../webkit/webkitwebnavigationaction.cpp:187
+#: ../webkit/webkitwebnavigationaction.cpp:179
 msgid "The button used to click"
 msgstr "क्लिक करण्यासाठीचे बटन"
 
-#: ../webkit/webkitwebnavigationaction.cpp:202
+#: ../webkit/webkitwebnavigationaction.cpp:194
 msgid "Modifier state"
 msgstr "मॉडिफायर स्तर"
 
-#: ../webkit/webkitwebnavigationaction.cpp:203
+#: ../webkit/webkitwebnavigationaction.cpp:195
 msgid "A bitmask representing the state of the modifier keys"
 msgstr "मॉडिफायर किज्चे स्तर प्रस्तुत करणारे बिटमास्क"
 
-#: ../webkit/webkitwebnavigationaction.cpp:218
+#: ../webkit/webkitwebnavigationaction.cpp:210
 msgid "Target frame"
 msgstr "टार्गेट फ्रेम"
 
-#: ../webkit/webkitwebnavigationaction.cpp:219
+#: ../webkit/webkitwebnavigationaction.cpp:211
 msgid "The target frame for the navigation"
 msgstr "संचारनकरीता लक्ष्य फ्रेम"
 
-#: ../webkit/webkitwebresource.cpp:127
-msgid "The uri of the resource"
-msgstr "स्रोतचे uri"
+#: ../webkit/webkitwebplugin.cpp:115
+#| msgid "Editable"
+msgid "Enabled"
+msgstr "सुरू केले"
+
+#: ../webkit/webkitwebplugin.cpp:116
+#| msgid "Whether the page cache should be used"
+msgid "Whether the plugin is enabled"
+msgstr "प्लगइन सुरू केले आहे"
 
-#: ../webkit/webkitwebresource.cpp:141
+#: ../webkit/webkitwebresource.cpp:210
+#| msgid "The uri of the resource"
+msgid "The URI of the resource"
+msgstr "स्रोतचे URI"
+
+#: ../webkit/webkitwebresource.cpp:224
 msgid "MIME Type"
 msgstr "MIME प्रकार"
 
-#: ../webkit/webkitwebresource.cpp:142
+#: ../webkit/webkitwebresource.cpp:225
 msgid "The MIME type of the resource"
 msgstr "स्रोतचे MIME प्रकार"
 
-#: ../webkit/webkitwebresource.cpp:156 ../webkit/webkitwebview.cpp:3132
+#: ../webkit/webkitwebresource.cpp:239 ../webkit/webkitwebview.cpp:3238
 msgid "Encoding"
 msgstr "एंकोडिंग"
 
-#: ../webkit/webkitwebresource.cpp:157
+#: ../webkit/webkitwebresource.cpp:240
 msgid "The text encoding name of the resource"
 msgstr "स्रोतचे मजकूर एंकोडिंग नाव"
 
-#: ../webkit/webkitwebresource.cpp:172
+#: ../webkit/webkitwebresource.cpp:255
 msgid "Frame Name"
 msgstr "फ्रेमचे नाव"
 
-#: ../webkit/webkitwebresource.cpp:173
+#: ../webkit/webkitwebresource.cpp:256
 msgid "The frame name of the resource"
 msgstr "स्रोतचे फ्रेम नाव"
 
-#: ../webkit/webkitwebsettings.cpp:252
+#: ../webkit/webkitwebsettings.cpp:147
 msgid "Default Encoding"
 msgstr "पूर्वनिर्धारित एंकोडिंग"
 
-#: ../webkit/webkitwebsettings.cpp:253
+#: ../webkit/webkitwebsettings.cpp:148
 msgid "The default encoding used to display text."
 msgstr "मजकूर दाखवण्यासाठी वापरलेले पूर्वनिर्धारित एंकोडिंग."
 
-#: ../webkit/webkitwebsettings.cpp:261
+#: ../webkit/webkitwebsettings.cpp:156
 msgid "Cursive Font Family"
 msgstr "कर्सिव्ह फाँट फॅमिलि"
 
-#: ../webkit/webkitwebsettings.cpp:262
+#: ../webkit/webkitwebsettings.cpp:157
 msgid "The default Cursive font family used to display text."
 msgstr "मजकूर दाखवण्यासाठी वापरण्याजोगी पूर्वनिर्धारित कर्सिव्ह फाँट फॅमिलि."
 
-#: ../webkit/webkitwebsettings.cpp:270
+#: ../webkit/webkitwebsettings.cpp:165
 msgid "Default Font Family"
 msgstr "पूर्वनिर्धारित फाँट फॅमिलि"
 
-#: ../webkit/webkitwebsettings.cpp:271
+#: ../webkit/webkitwebsettings.cpp:166
 msgid "The default font family used to display text."
 msgstr "मजकूर दाखवण्यासाठी वापरण्याजोगी पूर्वनिर्धारित फाँट फॅमिलि."
 
-#: ../webkit/webkitwebsettings.cpp:279
+#: ../webkit/webkitwebsettings.cpp:174
 msgid "Fantasy Font Family"
 msgstr "फँटसि फाँट फॅमिलि"
 
-#: ../webkit/webkitwebsettings.cpp:280
+#: ../webkit/webkitwebsettings.cpp:175
 msgid "The default Fantasy font family used to display text."
 msgstr "मजकूर दाखवण्यासाठी वापरण्याजोगी पूर्वनिर्धारित फँटसि फाँट फॅमिलि."
 
-#: ../webkit/webkitwebsettings.cpp:288
+#: ../webkit/webkitwebsettings.cpp:183
 msgid "Monospace Font Family"
 msgstr "मोनोस्पेस् फाँट फॅमिलि"
 
-#: ../webkit/webkitwebsettings.cpp:289
+#: ../webkit/webkitwebsettings.cpp:184
 msgid "The default font family used to display monospace text."
 msgstr "मोनोस्पेस् मजकूर दाखवण्यासाठी पूर्वनिर्धारित फाँट फॅमिलि."
 
-#: ../webkit/webkitwebsettings.cpp:297
+#: ../webkit/webkitwebsettings.cpp:192
 msgid "Sans Serif Font Family"
 msgstr "सँस् सेरिफ फाँट फॅमिलि"
 
-#: ../webkit/webkitwebsettings.cpp:298
+#: ../webkit/webkitwebsettings.cpp:193
 msgid "The default Sans Serif font family used to display text."
 msgstr "मजकूर दाखवण्यासाठी वापरण्याजोगी पूर्वनिर्धारित सँस सेरिफ फाँट फॅमिलि."
 
-#: ../webkit/webkitwebsettings.cpp:306
+#: ../webkit/webkitwebsettings.cpp:201
 msgid "Serif Font Family"
 msgstr "सेरिफ फाँट फॅमिलि"
 
-#: ../webkit/webkitwebsettings.cpp:307
+#: ../webkit/webkitwebsettings.cpp:202
 msgid "The default Serif font family used to display text."
 msgstr "मजकूर दाखवण्यासाठी वापरण्याजोगी पूर्वनिर्धारित सेरिफ फाँट फॅमिलि."
 
-#: ../webkit/webkitwebsettings.cpp:315
+#: ../webkit/webkitwebsettings.cpp:210
 msgid "Default Font Size"
 msgstr "पूर्वनिर्धारित फाँट आकार"
 
-#: ../webkit/webkitwebsettings.cpp:316
+#: ../webkit/webkitwebsettings.cpp:211
 msgid "The default font size used to display text."
 msgstr "मजकूर दाखवण्यासाठी वापरण्याजोगी पूर्वनिर्धारित फाँट आकार."
 
-#: ../webkit/webkitwebsettings.cpp:324
+#: ../webkit/webkitwebsettings.cpp:219
 msgid "Default Monospace Font Size"
 msgstr "पूर्वनिर्धारित मोनोस्पेस् फाँट आकार"
 
-#: ../webkit/webkitwebsettings.cpp:325
+#: ../webkit/webkitwebsettings.cpp:220
 msgid "The default font size used to display monospace text."
 msgstr "मोनोस्पेस् मजकूर दाखवण्यासाठी पूर्वनिर्धारित फाँट आकार."
 
-#: ../webkit/webkitwebsettings.cpp:333
+#: ../webkit/webkitwebsettings.cpp:228
 msgid "Minimum Font Size"
 msgstr "किमान फाँट आकार"
 
-#: ../webkit/webkitwebsettings.cpp:334
+#: ../webkit/webkitwebsettings.cpp:229
 msgid "The minimum font size used to display text."
 msgstr "मजकूर दाखवण्यासाठी वापरण्याजोगी किमान फाँट आकार."
 
-#: ../webkit/webkitwebsettings.cpp:342
+#: ../webkit/webkitwebsettings.cpp:237
 msgid "Minimum Logical Font Size"
 msgstr "किमान लॉजिकल फाँट आकार"
 
-#: ../webkit/webkitwebsettings.cpp:343
+#: ../webkit/webkitwebsettings.cpp:238
 msgid "The minimum logical font size used to display text."
 msgstr "मजकूर दाखवण्यासाठी वापरण्याजोगी किमान लॉजिकल फाँट आकार."
 
-#: ../webkit/webkitwebsettings.cpp:362
+#: ../webkit/webkitwebsettings.cpp:257
 msgid "Enforce 96 DPI"
 msgstr "96 DPI जबरनपणे लागू करा"
 
-#: ../webkit/webkitwebsettings.cpp:363
+#: ../webkit/webkitwebsettings.cpp:258
 msgid "Enforce a resolution of 96 DPI"
 msgstr "96 DPI चे रेजोल्युशन जबरनपणे लागू करा"
 
-#: ../webkit/webkitwebsettings.cpp:371
+#: ../webkit/webkitwebsettings.cpp:266
 msgid "Auto Load Images"
 msgstr "प्रतिमा स्वयं लोड करा"
 
-#: ../webkit/webkitwebsettings.cpp:372
+#: ../webkit/webkitwebsettings.cpp:267
 msgid "Load images automatically."
 msgstr "प्रतिमा स्वयं लोड करा."
 
-#: ../webkit/webkitwebsettings.cpp:380
+#: ../webkit/webkitwebsettings.cpp:275
 msgid "Auto Shrink Images"
 msgstr "प्रतिमा स्वयं लहान करा"
 
-#: ../webkit/webkitwebsettings.cpp:381
+#: ../webkit/webkitwebsettings.cpp:276
 msgid "Automatically shrink standalone images to fit."
 msgstr "घट बसवण्याकरीता स्टँडअलोन प्रतिमांना स्वयं लहान करा."
 
-#: ../webkit/webkitwebsettings.cpp:389
+#: ../webkit/webkitwebsettings.cpp:284
 msgid "Print Backgrounds"
 msgstr "पार्श्वभूमीची छपाई करा"
 
-#: ../webkit/webkitwebsettings.cpp:390
+#: ../webkit/webkitwebsettings.cpp:285
 msgid "Whether background images should be printed."
 msgstr "पार्श्वभूमी प्रतिमांची छपाई करायची."
 
-#: ../webkit/webkitwebsettings.cpp:398
+#: ../webkit/webkitwebsettings.cpp:293
 msgid "Enable Scripts"
 msgstr "स्क्रिप्टस् सुरू करा"
 
-#: ../webkit/webkitwebsettings.cpp:399
+#: ../webkit/webkitwebsettings.cpp:294
 msgid "Enable embedded scripting languages."
 msgstr "एम्बेडेड स्क्रिप्टिंग भाषा सुरू करा."
 
-#: ../webkit/webkitwebsettings.cpp:407
+#: ../webkit/webkitwebsettings.cpp:302
 msgid "Enable Plugins"
 msgstr "प्लगईन्स् सुरू करा"
 
-#: ../webkit/webkitwebsettings.cpp:408
+#: ../webkit/webkitwebsettings.cpp:303
 msgid "Enable embedded plugin objects."
 msgstr "एम्बेडेड् प्लगइन ऑब्जेक्टस् सुरू करा."
 
-#: ../webkit/webkitwebsettings.cpp:416
+#: ../webkit/webkitwebsettings.cpp:311
 msgid "Resizable Text Areas"
 msgstr "पुनःआकार मजकूर क्षेत्र"
 
-#: ../webkit/webkitwebsettings.cpp:417
+#: ../webkit/webkitwebsettings.cpp:312
 msgid "Whether text areas are resizable."
 msgstr "मजकूर क्षेत्र पुनःआकारजोगी आहेत."
 
-#: ../webkit/webkitwebsettings.cpp:424
+#: ../webkit/webkitwebsettings.cpp:319
 msgid "User Stylesheet URI"
 msgstr "वापरकर्ता स्टाइनशीट URI"
 
-#: ../webkit/webkitwebsettings.cpp:425
+#: ../webkit/webkitwebsettings.cpp:320
 msgid "The URI of a stylesheet that is applied to every page."
 msgstr "स्टाइलशीटचे URI जे प्रत्येक पृष्ठकरीता लागू होते."
 
-#: ../webkit/webkitwebsettings.cpp:440
+#: ../webkit/webkitwebsettings.cpp:335
 msgid "Zoom Stepping Value"
 msgstr "स्टेपिंग मूल्य वाढवा"
 
-#: ../webkit/webkitwebsettings.cpp:441
+#: ../webkit/webkitwebsettings.cpp:336
 msgid "The value by which the zoom level is changed when zooming in or out."
 msgstr ""
 "झूम शक्य किंवा अशक्य करतेवेळी झूम लेव्हल ज्या स्तराने बदलले जाते ते मूल्य."
 
-#: ../webkit/webkitwebsettings.cpp:459
+#: ../webkit/webkitwebsettings.cpp:354
 msgid "Enable Developer Extras"
 msgstr "डेव्हलपर एक्सट्राज सुरू करा"
 
-#: ../webkit/webkitwebsettings.cpp:460
+#: ../webkit/webkitwebsettings.cpp:355
 msgid "Enables special extensions that help developers"
 msgstr "डेव्हलपर्सला मदत पुरवणारे विशेष एक्सटेंशन्स् सुरू करा"
 
-#: ../webkit/webkitwebsettings.cpp:480
+#: ../webkit/webkitwebsettings.cpp:375
 msgid "Enable Private Browsing"
 msgstr "प्राइव्हेट ब्राऊजिंग सुरू करा"
 
-#: ../webkit/webkitwebsettings.cpp:481
+#: ../webkit/webkitwebsettings.cpp:376
 msgid "Enables private browsing mode"
 msgstr "प्राइव्हेट ब्राऊजिंग मोड सुरू करा"
 
-#: ../webkit/webkitwebsettings.cpp:496
+#: ../webkit/webkitwebsettings.cpp:391
 msgid "Enable Spell Checking"
 msgstr "शुध्दलेखन तपासणी सुरू करा"
 
-#: ../webkit/webkitwebsettings.cpp:497
+#: ../webkit/webkitwebsettings.cpp:392
 msgid "Enables spell checking while typing"
 msgstr "टाइप करतेवेळी शुध्दलेखन तपासणी सुरू करा"
 
-#: ../webkit/webkitwebsettings.cpp:520
+#: ../webkit/webkitwebsettings.cpp:415
 msgid "Languages to use for spell checking"
 msgstr "शुध्दलेखन तपासणीकरीता वापरण्याजोगी भाषा"
 
-#: ../webkit/webkitwebsettings.cpp:521
+#: ../webkit/webkitwebsettings.cpp:416
 msgid "Comma separated list of languages to use for spell checking"
 msgstr "शुध्दलेखनच्या वापरकरीता वापरण्याजोगी स्वल्पिविराम विभाजीत सूची"
 
-#: ../webkit/webkitwebsettings.cpp:535
+#: ../webkit/webkitwebsettings.cpp:430
 msgid "Enable Caret Browsing"
 msgstr "कॅरेट ब्राऊजिंग सुरू करा"
 
-#: ../webkit/webkitwebsettings.cpp:536
-msgid "Whether to enable accesibility enhanced keyboard navigation"
+#: ../webkit/webkitwebsettings.cpp:431
+#| msgid "Whether to enable accesibility enhanced keyboard navigation"
+msgid "Whether to enable accessibility enhanced keyboard navigation"
 msgstr "ॲक्सेसिबिलिटि सुधारित कळफलक संचारन सुरू करायचे"
 
-#: ../webkit/webkitwebsettings.cpp:551
+#: ../webkit/webkitwebsettings.cpp:446
 msgid "Enable HTML5 Database"
 msgstr "HTML5 डाटाबेस सुरू करा"
 
-#: ../webkit/webkitwebsettings.cpp:552
+#: ../webkit/webkitwebsettings.cpp:447
 msgid "Whether to enable HTML5 database support"
 msgstr "HTML5 डाटाबेस समर्थन सुरू करायचे"
 
-#: ../webkit/webkitwebsettings.cpp:567
+#: ../webkit/webkitwebsettings.cpp:462
 msgid "Enable HTML5 Local Storage"
 msgstr "HTML5 स्थानीय स्टोरेज सुरू करा"
 
-#: ../webkit/webkitwebsettings.cpp:568
+#: ../webkit/webkitwebsettings.cpp:463
 msgid "Whether to enable HTML5 Local Storage support"
 msgstr "HTML5 स्थानीय स्टोरेज समर्थन सुरू करायचे"
 
-#: ../webkit/webkitwebsettings.cpp:582
+#: ../webkit/webkitwebsettings.cpp:478
+msgid "Local Storage Database Path"
+msgstr "स्थानीय स्टोरेज डाटाबेस मार्ग"
+
+#: ../webkit/webkitwebsettings.cpp:479
+#| msgid "Whether to enable HTML5 Local Storage support"
+msgid "The path to where HTML5 Local Storage databases are stored."
+msgstr "HTML5 लोकल स्टोरेज डाटाबेसेस् साठवले जाते ते मार्ग."
+
+#: ../webkit/webkitwebsettings.cpp:493
 msgid "Enable XSS Auditor"
 msgstr "XSS ऑडिटर सुरू करा"
 
-#: ../webkit/webkitwebsettings.cpp:583
+#: ../webkit/webkitwebsettings.cpp:494
 msgid "Whether to enable the XSS auditor"
 msgstr "XSS ऑडिटर सुरू करायचे"
 
-#: ../webkit/webkitwebsettings.cpp:601
+#: ../webkit/webkitwebsettings.cpp:512
 msgid "Enable Spatial Navigation"
 msgstr "स्पेस्शल संचारन सुरू करा"
 
-#: ../webkit/webkitwebsettings.cpp:602
+#: ../webkit/webkitwebsettings.cpp:513
 msgid "Whether to enable Spatial Navigation"
 msgstr "स्पेस्शल संचारन सुरू करायचे"
 
-#: ../webkit/webkitwebsettings.cpp:620
+#: ../webkit/webkitwebsettings.cpp:531
 msgid "Enable Frame Flattening"
 msgstr "फ्रेम फ्लॅटनिंग सुरू करा"
 
-#: ../webkit/webkitwebsettings.cpp:621
+#: ../webkit/webkitwebsettings.cpp:532
 msgid "Whether to enable Frame Flattening"
 msgstr "फ्रेम फ्लॅटनिंग सुरू करायचे"
 
-#: ../webkit/webkitwebsettings.cpp:638
+#: ../webkit/webkitwebsettings.cpp:549
 msgid "User Agent"
 msgstr "युजर एजंट"
 
-#: ../webkit/webkitwebsettings.cpp:639
+#: ../webkit/webkitwebsettings.cpp:550
 msgid "The User-Agent string used by WebKitGtk"
 msgstr "WebKitGtk तर्फे वापरण्याजोगी युजर एजंट स्ट्रिंग"
 
-#: ../webkit/webkitwebsettings.cpp:654
+#: ../webkit/webkitwebsettings.cpp:565
 msgid "JavaScript can open windows automatically"
 msgstr "जावास्क्रिप्ट पटल स्वयंपणे उघडू शकतो"
 
-#: ../webkit/webkitwebsettings.cpp:655
+#: ../webkit/webkitwebsettings.cpp:566
 msgid "Whether JavaScript can open windows automatically"
 msgstr "जावास्क्रिप्ट पटल स्वयंपणे उघडू शकतो का"
 
-#: ../webkit/webkitwebsettings.cpp:669
+#: ../webkit/webkitwebsettings.cpp:580
 msgid "JavaScript can access Clipboard"
 msgstr "जावास्क्रिप्ट क्लिपबोर्डकरीता प्रवेश प्राप्त करू शकतो"
 
-#: ../webkit/webkitwebsettings.cpp:670
+#: ../webkit/webkitwebsettings.cpp:581
 msgid "Whether JavaScript can access Clipboard"
 msgstr "जावास्क्रिप्ट क्लिपबोर्डकरीता प्रवेश प्राप्त करू शकतो"
 
-#: ../webkit/webkitwebsettings.cpp:686
+#: ../webkit/webkitwebsettings.cpp:597
 msgid "Enable offline web application cache"
 msgstr "Enable offline web application cache"
 
-#: ../webkit/webkitwebsettings.cpp:687
+#: ../webkit/webkitwebsettings.cpp:598
 msgid "Whether to enable offline web application cache"
 msgstr "ऑफलाइन वेब ॲप्लिकेशन कॅशे सुरू करायचे"
 
-#: ../webkit/webkitwebsettings.cpp:715
+#: ../webkit/webkitwebsettings.cpp:623
 msgid "Editing behavior"
 msgstr "वर्तन संपादित करायचे"
 
-#: ../webkit/webkitwebsettings.cpp:716
+#: ../webkit/webkitwebsettings.cpp:624
 msgid "The behavior mode to use in editing mode"
 msgstr "संपादन मोडमध्ये वापरण्याजोगी वर्तन मोड"
 
-#: ../webkit/webkitwebsettings.cpp:732
+#: ../webkit/webkitwebsettings.cpp:640
 msgid "Enable universal access from file URIs"
 msgstr "फाइल URI पासून युनिवर्सल प्रवेश सुरू करा"
 
-#: ../webkit/webkitwebsettings.cpp:733
+#: ../webkit/webkitwebsettings.cpp:641
 msgid "Whether to allow universal access from file URIs"
 msgstr "फाइल URI पासून युनिवर्सल प्रवेशकरीता परवानगी द्यायची"
 
-#: ../webkit/webkitwebsettings.cpp:748
+#: ../webkit/webkitwebsettings.cpp:656
 msgid "Enable DOM paste"
 msgstr "DOM पेस्ट सुरू करा"
 
-#: ../webkit/webkitwebsettings.cpp:749
+#: ../webkit/webkitwebsettings.cpp:657
 msgid "Whether to enable DOM paste"
 msgstr "DOM पेस्ट सुरू करायचे"
 
-#: ../webkit/webkitwebsettings.cpp:767
+#: ../webkit/webkitwebsettings.cpp:675
 msgid "Tab key cycles through elements"
 msgstr "टॅब कि इलिमेंटस् चाळते"
 
-#: ../webkit/webkitwebsettings.cpp:768
+#: ../webkit/webkitwebsettings.cpp:676
 msgid "Whether the tab key cycles through elements on the page."
 msgstr "टॅब कि पृष्ठावरील एलिमेंटस् चाळते."
 
-#: ../webkit/webkitwebsettings.cpp:788
+#: ../webkit/webkitwebsettings.cpp:698
 msgid "Enable Default Context Menu"
 msgstr "पूर्वनिर्धारित संदर्भ मेन्यु सुरू करा"
 
-#: ../webkit/webkitwebsettings.cpp:789
+#: ../webkit/webkitwebsettings.cpp:699
 msgid ""
 "Enables the handling of right-clicks for the creation of the default context "
 "menu"
 msgstr ""
 "पूर्वनिर्धारित संदर्भ मेन्युच्या निर्माणकरीता उजव्या-क्लिकची हाताळणी सुरू करतो"
 
-#: ../webkit/webkitwebsettings.cpp:809
+#: ../webkit/webkitwebsettings.cpp:719
 msgid "Enable Site Specific Quirks"
 msgstr "स्थळ निर्देशीत क्वर्क्स् सुरू करा"
 
-#: ../webkit/webkitwebsettings.cpp:810
+#: ../webkit/webkitwebsettings.cpp:720
 msgid "Enables the site-specific compatibility workarounds"
 msgstr "स्थळ-निर्देशीत सहत्वता पर्याय सुरू करतो"
 
-#: ../webkit/webkitwebsettings.cpp:832
+#: ../webkit/webkitwebsettings.cpp:742
 msgid "Enable page cache"
 msgstr "पृष्ठ कॅशे सुरू करतो"
 
-#: ../webkit/webkitwebsettings.cpp:833
+#: ../webkit/webkitwebsettings.cpp:743
 msgid "Whether the page cache should be used"
 msgstr "पृष्ठ कॅशेचा वापर करायचे"
 
-#: ../webkit/webkitwebsettings.cpp:853
+#: ../webkit/webkitwebsettings.cpp:763
 msgid "Auto Resize Window"
 msgstr "स्वयं पुनःआकार पटल"
 
-#: ../webkit/webkitwebsettings.cpp:854
+#: ../webkit/webkitwebsettings.cpp:764
 msgid "Automatically resize the toplevel window when a page requests it"
 msgstr "पृष्ठ विनंती करतेवेळी स्वयंरित्या उच्चस्तरिय पटलला पुनःआकार द्या"
 
-#: ../webkit/webkitwebsettings.cpp:886
+#: ../webkit/webkitwebsettings.cpp:796
 msgid "Enable Java Applet"
 msgstr "जावा ॲप्लेट सुरू करा"
 
-#: ../webkit/webkitwebsettings.cpp:887
+#: ../webkit/webkitwebsettings.cpp:797
 msgid "Whether Java Applet support through <applet> should be enabled"
-msgstr "<applet> तर्फे जावा ॲप्लेट समर्थन सुरू करायचे"
+msgstr "<applet> तर्फे जावा ॲप्लेट समर्थन सुरू करायचे?"
 
-#: ../webkit/webkitwebsettings.cpp:901
+#: ../webkit/webkitwebsettings.cpp:811
 msgid "Enable Hyperlink Auditing"
 msgstr "हायपरलिंक ऑडिटिंग सुरू करा"
 
-#: ../webkit/webkitwebsettings.cpp:902
+#: ../webkit/webkitwebsettings.cpp:812
 msgid "Whether <a ping> should be able to send pings"
 msgstr "<a ping> ने पिंग पाठवायचे"
 
-#: ../webkit/webkitwebsettings.cpp:910
+#: ../webkit/webkitwebsettings.cpp:820
 msgid "Enable Fullscreen"
 msgstr "पडदाभर सुरू करा"
 
-#: ../webkit/webkitwebsettings.cpp:911
+#: ../webkit/webkitwebsettings.cpp:821
 msgid "Whether the Mozilla style API should be enabled."
-msgstr "मोझीला शैलीचे API सुरू करायचे."
+msgstr "मोझीला शैलीचे API सुरू करायचे?"
+
+#: ../webkit/webkitwebsettings.cpp:836
+msgid "Enable WebGL"
+msgstr "WebGL सुरू करा"
+
+#: ../webkit/webkitwebsettings.cpp:837
+#| msgid "Whether background images should be printed."
+msgid "Whether WebGL content should be rendered"
+msgstr "WebGL अंतर्भुत माहिती दाखवायची?"
+
+#: ../webkit/webkitwebsettings.cpp:853
+#| msgid "Enable Private Browsing"
+msgid "Enable accelerated compositing"
+msgstr "ॲक्सिलरेटेड कम्पोजिटिंग सुरू करा"
 
-#: ../webkit/webkitwebview.cpp:2984
+#: ../webkit/webkitwebsettings.cpp:854
+#| msgid "Whether the Mozilla style API should be enabled."
+msgid "Whether accelerated compositing should be enabled"
+msgstr "ॲक्सिलरेटेड कम्पोजिटिंग सुरू करायचे?"
+
+#: ../webkit/webkitwebsettings.cpp:872
+#| msgid "Enable XSS Auditor"
+msgid "Enable WebAudio"
+msgstr "WebAudio सुरू करा"
+
+#: ../webkit/webkitwebsettings.cpp:873
+#| msgid "Whether the page cache should be used"
+msgid "Whether WebAudio content should be handled"
+msgstr "WebAudio अंतर्भुत माहिती हाताळायची?"
+
+#: ../webkit/webkitwebsettings.cpp:889
+msgid "WebKit prefetches domain names"
+msgstr "WebKit डोमेन नाव प्रिफेच करतो"
+
+#: ../webkit/webkitwebsettings.cpp:890
+msgid "Whether WebKit prefetches domain names"
+msgstr "WebKit डोमेन नाव प्रिफेच करतो"
+
+#: ../webkit/webkitwebsettings.cpp:908
+#| msgid "Enable DOM paste"
+msgid "Enable Media Stream"
+msgstr "मिडीया स्ट्रिम सुरू करा"
+
+#: ../webkit/webkitwebsettings.cpp:909
+#| msgid "Whether the Mozilla style API should be enabled."
+msgid "Whether Media Stream should be enabled"
+msgstr "मिडीया स्ट्रिम सुरू करायचे?"
+
+#: ../webkit/webkitwebsettings.cpp:924
+#| msgid "Enable Caret Browsing"
+msgid "Enable smooth scrolling"
+msgstr "गुळगुळीत स्क्रोलिंग सुरू करायचे"
+
+#: ../webkit/webkitwebsettings.cpp:925
+#| msgid "Whether to enable Frame Flattening"
+msgid "Whether to enable smooth scrolling"
+msgstr "गुळगुळीत स्क्रोलिंग सुरू करायचे"
+
+#: ../webkit/webkitwebsettings.cpp:943
+msgid "Media playback requires user gesture"
+msgstr "मिडीया प्लेबॅकला वापरकर्ता गेस्चर आवश्यक आहे"
+
+#: ../webkit/webkitwebsettings.cpp:944
+msgid "Whether media playback requires user gesture"
+msgstr "मिडीया प्लेबॅकला वापरकर्ता गेस्चर आवश्यक आहे"
+
+#: ../webkit/webkitwebsettings.cpp:960
+msgid "Media playback allows inline"
+msgstr "मिडीया प्लेबॅक इंलाइन स्वीकारतो"
+
+#: ../webkit/webkitwebsettings.cpp:961
+msgid "Whether media playback allows inline"
+msgstr "मिडीया प्लेबॅक इंलाइन स्वीकारायचे"
+
+#: ../webkit/webkitwebsettings.cpp:979
+#| msgid "Enable XSS Auditor"
+msgid "Enable CSS shaders"
+msgstr "CSS शेडर्स् सुरू करा"
+
+#: ../webkit/webkitwebsettings.cpp:980
+#| msgid "Whether to enable DOM paste"
+msgid "Whether to enable css shaders"
+msgstr "css शेडर्स् सुरू करायचे"
+
+#: ../webkit/webkitwebview.cpp:1311
+msgid "Select Files"
+msgstr "फाइल्स् पसंत करा"
+
+#: ../webkit/webkitwebview.cpp:1311
+msgid "Select File"
+msgstr "फाइल पसंत करा"
+
+#: ../webkit/webkitwebview.cpp:3090
 msgid "Returns the @web_view's document title"
 msgstr "@web_viewचे दस्तऐवज शीर्षक पुरवते"
 
-#: ../webkit/webkitwebview.cpp:2998
+#: ../webkit/webkitwebview.cpp:3104
 msgid "Returns the current URI of the contents displayed by the @web_view"
 msgstr "@web_view तर्फे दाखवलेल्या अंतर्भुत माहितीचे सद्याचे URI पुरवतो"
 
-#: ../webkit/webkitwebview.cpp:3011
+#: ../webkit/webkitwebview.cpp:3117
 msgid "Copy target list"
 msgstr "लक्ष्य सूचीचे प्रत बनवा"
 
-#: ../webkit/webkitwebview.cpp:3012
+#: ../webkit/webkitwebview.cpp:3118
 msgid "The list of targets this web view supports for clipboard copying"
 msgstr "क्लिपबोर्ड कॉपिइंगकरीता वेब दृष्यतर्फे समर्थीत लक्ष्यांची सूची"
 
-#: ../webkit/webkitwebview.cpp:3025
+#: ../webkit/webkitwebview.cpp:3131
 msgid "Paste target list"
 msgstr "लक्ष्य सूची चिकटवा"
 
-#: ../webkit/webkitwebview.cpp:3026
+#: ../webkit/webkitwebview.cpp:3132
 msgid "The list of targets this web view supports for clipboard pasting"
 msgstr "क्लिपबोर्ड चिकटवण्याकरीता या वेब दृष्यतर्फे समर्थीत लक्ष्यांची सूची"
 
-#: ../webkit/webkitwebview.cpp:3032
+#: ../webkit/webkitwebview.cpp:3138
 msgid "Settings"
 msgstr "सेटिंग्स्"
 
-#: ../webkit/webkitwebview.cpp:3033
+#: ../webkit/webkitwebview.cpp:3139
 msgid "An associated WebKitWebSettings instance"
 msgstr "संबंधित WebKitWebSettings बाब"
 
-#: ../webkit/webkitwebview.cpp:3046
+#: ../webkit/webkitwebview.cpp:3152
 msgid "Web Inspector"
 msgstr "वेब इंस्पेक्टर"
 
-#: ../webkit/webkitwebview.cpp:3047
+#: ../webkit/webkitwebview.cpp:3153
 msgid "The associated WebKitWebInspector instance"
 msgstr "संबंधित WebKitWebInspector बाब"
 
-#: ../webkit/webkitwebview.cpp:3060
+#: ../webkit/webkitwebview.cpp:3166
 msgid "Viewport Attributes"
 msgstr "व्युपोर्ट गुणधर्मे"
 
-#: ../webkit/webkitwebview.cpp:3061
+#: ../webkit/webkitwebview.cpp:3167
 msgid "The associated WebKitViewportAttributes instance"
 msgstr "संबंधित WebKitViewportAttributes instance"
 
-#: ../webkit/webkitwebview.cpp:3081
+#: ../webkit/webkitwebview.cpp:3187
 msgid "Editable"
 msgstr "संपादनजोगी"
 
-#: ../webkit/webkitwebview.cpp:3082
+#: ../webkit/webkitwebview.cpp:3188
 msgid "Whether content can be modified by the user"
 msgstr "वापरकर्तातर्फे कंटेंट संपादनजोगी आहे का"
 
-#: ../webkit/webkitwebview.cpp:3088
+#: ../webkit/webkitwebview.cpp:3194
 msgid "Transparent"
 msgstr "पारदर्शक"
 
-#: ../webkit/webkitwebview.cpp:3089
+#: ../webkit/webkitwebview.cpp:3195
 msgid "Whether content has a transparent background"
 msgstr "अंतर्भुत माहितीची पारदर्शक पार्श्वभूमी आहे का"
 
-#: ../webkit/webkitwebview.cpp:3102
+#: ../webkit/webkitwebview.cpp:3208
 msgid "Zoom level"
 msgstr "झूम स्तर"
 
-#: ../webkit/webkitwebview.cpp:3103
+#: ../webkit/webkitwebview.cpp:3209
 msgid "The level of zoom of the content"
 msgstr "अंतर्भुत माहितीचे झूम स्तर"
 
-#: ../webkit/webkitwebview.cpp:3118
+#: ../webkit/webkitwebview.cpp:3224
 msgid "Full content zoom"
 msgstr "संपूर्ण कंटेंट झूम"
 
-#: ../webkit/webkitwebview.cpp:3119
+#: ../webkit/webkitwebview.cpp:3225
 msgid "Whether the full content is scaled when zooming"
 msgstr "झूम करतेवेळी पूर्ण कंटेंट स्केल करायचे"
 
-#: ../webkit/webkitwebview.cpp:3133
+#: ../webkit/webkitwebview.cpp:3239
 msgid "The default encoding of the web view"
 msgstr "वेब दृष्याचे पूर्वनिर्धारित एंकोडिंग"
 
-#: ../webkit/webkitwebview.cpp:3146
+#: ../webkit/webkitwebview.cpp:3252
 msgid "Custom Encoding"
 msgstr "पसंतीचे एंकोडिंग"
 
-#: ../webkit/webkitwebview.cpp:3147
+#: ../webkit/webkitwebview.cpp:3253
 msgid "The custom encoding of the web view"
 msgstr "वेब दृष्याचे पसंतीचे एंकोडिंग"
 
-#: ../webkit/webkitwebview.cpp:3199
+#: ../webkit/webkitwebview.cpp:3305
 msgid "Icon URI"
 msgstr "चिन्ह URI"
 
-#: ../webkit/webkitwebview.cpp:3200
+#: ../webkit/webkitwebview.cpp:3306
 msgid "The URI for the favicon for the #WebKitWebView."
 msgstr "#WebKitWebView करीता चिन्हाचे URI."
 
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:56
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:61
-msgid "Submit"
-msgstr "सादर करा"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:66
-msgid "Reset"
-msgstr "पूर्ववत् करा"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:71
-msgid "This is a searchable index. Enter search keywords: "
-msgstr "हे शोधण्याजोगी इंडेक्स आहे. शोध मुख्यशब्दे द्या: "
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:76
-msgid "Choose File"
-msgstr "फाइल पसंत करा"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:81
-msgid "(None)"
-msgstr "(काहिच नाही)"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:86
-msgid "Open Link in New _Window"
-msgstr "नवीन पटलात दुवा उघडा (_W)"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:91
-msgid "_Download Linked File"
-msgstr "लिंक केलेली फाइल डाऊनलोड करा (_D)"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:96
-msgid "Copy Link Loc_ation"
-msgstr "दुवाच्या ठिकाणाचे प्रत बनवा (_a)"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:101
-msgid "Open _Image in New Window"
-msgstr "प्रतिमाला नविन पटलात उघडा (_I)"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:106
-msgid "Sa_ve Image As"
-msgstr "प्रतिमाला असे साठवा (_v)"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:111
-msgid "Cop_y Image"
-msgstr "प्रतिमाचे प्रत बनवा (_y)"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:116
-msgid "Open _Video in New Window"
-msgstr "नविन पटलात व्हिडीओ उघडा (_V)"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:121
-msgid "Open _Audio in New Window"
-msgstr "नवीन पटलात ऑडिओ उघडा (_A)"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:126
-msgid "Cop_y Video Link Location"
-msgstr "व्हिडीओ दुवा ठिकाणाचे प्रत बनवा (_y)"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:131
-msgid "Cop_y Audio Link Location"
-msgstr "ऑडीओ दुवा ठिकाणाचे प्रत बनवा (_y)"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:136
-msgid "_Toggle Media Controls"
-msgstr "मिडीया कंट्रोल्स् बदलवा (_T)"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:141
-msgid "Toggle Media _Loop Playback"
-msgstr "मिडीया लूप प्लेबॅक बदला (_L)"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:146
-msgid "Switch Video to _Fullscreen"
-msgstr "व्हिडीओ पडदाभर वापरा (_F)"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:151
-msgid "_Play"
-msgstr "चालवा (_P)"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:156
-msgid "_Pause"
-msgstr "थांबवा (_P)"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:161
-msgid "_Mute"
-msgstr "मंद करा (_M)"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:166
-msgid "Open _Frame in New Window"
-msgstr "फ्रेमला नविन पटलात उघडा (_F)"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:217
-msgid "_Reload"
-msgstr "पुनःलोड करा (_R)"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:234
-msgid "No Guesses Found"
-msgstr "अनुमान आढळले नाही"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:239
-msgid "_Ignore Spelling"
-msgstr "वर्णलेखनकडे दुर्लक्ष करा (_I)"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:244
-msgid "_Learn Spelling"
-msgstr "शुध्दलेखन शिका (_L)"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:249
-msgid "_Search the Web"
-msgstr "वेब शोधा (_S)"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:254
-msgid "_Look Up in Dictionary"
-msgstr "शब्दकोषात पहा (_L)"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:259
-msgid "_Open Link"
-msgstr "दुवा उघडा (_O)"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:264
-msgid "Ignore _Grammar"
-msgstr "व्याकरणकडे दुर्लक्ष करा (_G)"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:269
-msgid "Spelling and _Grammar"
-msgstr "शुध्दलेखन व व्याकरण (_G)"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:274
-msgid "_Show Spelling and Grammar"
-msgstr "शुध्दलेखन व व्याकरण दाखवा (_S)"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:274
-msgid "_Hide Spelling and Grammar"
-msgstr "शुध्दलेखन व व्याकरण लपवा (_H)"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:279
-msgid "_Check Document Now"
-msgstr "आत्ता दस्तऐवज तपासा (_C)"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:284
-msgid "Check Spelling While _Typing"
-msgstr "टाइपिंग करतेवेळी शुध्दलेखन तपासा (_T)"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:289
-msgid "Check _Grammar With Spelling"
-msgstr "शुध्दलेखनसह व्याकरण तपासा (_G)"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:294
-msgid "_Font"
-msgstr "फाँट (_F)"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:317
-msgid "_Outline"
-msgstr "रूपरेषा (_O)"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:322
-msgid "Inspect _Element"
-msgstr "एलिमेंटची चौकशी करा (_E)"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:327
-msgid "No recent searches"
-msgstr "नविन शोध आढळले नाही"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:332
-msgid "Recent searches"
-msgstr "नविन शोध"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:337
-msgid "_Clear recent searches"
-msgstr "नविन शोध नष्ट करा (_C)"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:342
-msgid "term"
-msgstr "संज्ञा"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:347
-msgid "definition"
-msgstr "वर्णन"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:352
-msgid "press"
-msgstr "दाबा"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:357
-msgid "select"
-msgstr "निवडा"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:362
-msgid "activate"
-msgstr "सुरू करा"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:367
-msgid "uncheck"
-msgstr "निवड अशक्य करा"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:372
-msgid "check"
-msgstr "तपासणी करा"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:377
-msgid "jump"
-msgstr "येथे जा"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:392
-msgid "Missing Plug-in"
-msgstr "प्लगइन आढळले नाही"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:398
-msgid "Plug-in Failure"
-msgstr "प्लगइन अपयश"
-
-#. FIXME: If this file gets localized, this should really be localized as one string with a wildcard for the number.
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:404
-msgid " files"
-msgstr " फाइल्स्"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:409
-msgid "Unknown"
-msgstr "अपरिचीत"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:414
-#, c-format
-msgctxt "Title string for images"
-msgid "%s  (%dx%d pixels)"
-msgstr "%s  (%dx%d पिक्सेल्स्)"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:426
-msgid "Loading..."
-msgstr "लोड करत आहे..."
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:431
-msgid "Live Broadcast"
-msgstr "लाइव्ह ब्रॉडकास्ट"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:437
-msgid "audio element controller"
-msgstr "ऑडिओ एलिमेंट कंट्रोलर"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:439
-msgid "video element controller"
-msgstr "व्हिडीओ एलिमेंट कंट्रोलर"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:441
-msgid "mute"
-msgstr "मंद करा"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:443
-msgid "unmute"
-msgstr "मंद अशक्य करा"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:445
-msgid "play"
-msgstr "चालवा"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:447
-msgid "pause"
-msgstr "थांबा"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:449
-msgid "movie time"
-msgstr "चित्रपट वेळ"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:451
-msgid "timeline slider thumb"
-msgstr "टाइमलाइन स्लाइडर थंब"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:453
-msgid "back 30 seconds"
-msgstr "मागे 30 सेकंद"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:455
-msgid "return to realtime"
-msgstr "रिअलटाइमकडे जा"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:457
-msgid "elapsed time"
-msgstr "गेलेला वेळ"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:459
-msgid "remaining time"
-msgstr "उर्वरित वेळ"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:461
-msgid "status"
-msgstr "स्थिती"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:463
-msgid "fullscreen"
-msgstr "पडदाभर"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:465
-msgid "fast forward"
-msgstr "फास्ट फॉरवर्ड"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:467
-msgid "fast reverse"
-msgstr "फास्ट रिव्हर्स्"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:469
-msgid "show closed captions"
-msgstr "क्लोस्ड कॅपशन्स् दाखवा"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:471
-msgid "hide closed captions"
-msgstr "क्लोस्ड् कॅप्शन्स् लपवा"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:480
-msgid "audio element playback controls and status display"
-msgstr "ऑडिओ एलिमेंट प्लेबॅक कंट्रोल्स् व स्थिती डिस्पले"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:482
-msgid "video element playback controls and status display"
-msgstr "व्हिडीओ एलिमेंट प्लेबॅक कंट्रोल्स् व स्थिती डिस्पले"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:484
-msgid "mute audio tracks"
-msgstr "ऑडिओ ट्रॅक्स् मंद करा"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:486
-msgid "unmute audio tracks"
-msgstr "ऑडिओ ट्रॅक्स् मंद अशक्य करा"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:488
-msgid "begin playback"
-msgstr "प्लेबॅक सुरू करा"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:490
-msgid "pause playback"
-msgstr "प्लेबॅक थांबवा"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:492
-msgid "movie time scrubber"
-msgstr "चित्रपट वेळ स्क्रुबर"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:494
-msgid "movie time scrubber thumb"
-msgstr "चित्रपट वेळ स्क्रुबर थंब"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:496
-msgid "seek movie back 30 seconds"
-msgstr "सीक मुव्हि मागे 30 सेकंद"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:498
-msgid "return streaming movie to real time"
-msgstr "स्ट्रिमिंग मुव्हि ते रिअल टाइम पुरवा"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:500
-msgid "current movie time in seconds"
-msgstr "सध्याचे सेकंदातील मुव्हि वेळ"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:502
-msgid "number of seconds of movie remaining"
-msgstr "उर्वरित चित्रपटकरीता सेकंदातील वेळ"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:504
-msgid "current movie status"
-msgstr "चित्रपटची सध्याची स्थिती"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:506
-msgid "seek quickly back"
-msgstr "पटकन मागे सीक करा"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:508
-msgid "seek quickly forward"
-msgstr "पटकन पुढे सीक करा"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:510
-msgid "Play movie in fullscreen mode"
-msgstr "चित्रपटला पडदाभर मोडमध्ये चालवा"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:512
-msgid "start displaying closed captions"
-msgstr "बंद कॅपशन्स् दाखवायला सुरू करा"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:514
-msgid "stop displaying closed captions"
-msgstr "बंद कॅपशन्स् दाखवणे बंद करा"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:523
-msgid "indefinite time"
-msgstr "अमर्यादीत वेळ"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:553
-msgid "value missing"
-msgstr "मूल्य आढळले नाही"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:589
-msgid "type mismatch"
-msgstr "टाइप जुळले नाही"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:612
-msgid "pattern mismatch"
-msgstr "पॅटर्न जुळले नाही"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:617
-msgid "too long"
-msgstr "खूपच लांब"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:622
-msgid "range underflow"
-msgstr "रेंज अंडरफ्लो"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:627
-msgid "range overflow"
-msgstr "रेंज ओव्हरफ्लो"
-
-#: ../../../WebCore/platform/gtk/LocalizedStringsGtk.cpp:632
-msgid "step mismatch"
-msgstr "स्टेप जुळले नाही"
-
-
+#~ msgid "Upload File"
+#~ msgstr "फाइल अपलोड करा"
diff --git a/Source/WebKit/gtk/webkit/webkitglobals.cpp b/Source/WebKit/gtk/webkit/webkitglobals.cpp
index d2715a6a1..886292169 100644
--- a/Source/WebKit/gtk/webkit/webkitglobals.cpp
+++ b/Source/WebKit/gtk/webkit/webkitglobals.cpp
@@ -25,7 +25,6 @@
 #include "Chrome.h"
 #include "ContextMenuItem.h"
 #include "FrameNetworkingContextGtk.h"
-#include "GtkUtilities.h"
 #include "IconDatabase.h"
 #include "Logging.h"
 #include "MemoryCache.h"
@@ -45,7 +44,6 @@
 #include "webkitfavicondatabase.h"
 #include "webkitglobalsprivate.h"
 #include "webkiticondatabase.h"
-#include "webkitsoupauthdialog.h"
 #include "webkitspellchecker.h"
 #include "webkitspellcheckerenchant.h"
 #include "webkitwebdatabase.h"
@@ -207,32 +205,6 @@ WebKitWebPluginDatabase* webkit_get_web_plugin_database()
     return database;
 }
 
-
-static GtkWidget* currentToplevelCallback(WebKitSoupAuthDialog* feature, SoupMessage* message, gpointer userData)
-{
-    gpointer messageData = g_object_get_data(G_OBJECT(message), "resourceHandle");
-    if (!messageData)
-        return NULL;
-
-    ResourceHandle* handle = static_cast<ResourceHandle*>(messageData);
-    if (!handle)
-        return NULL;
-
-    ResourceHandleInternal* d = handle->getInternal();
-    if (!d)
-        return NULL;
-
-    WebKit::FrameNetworkingContextGtk* context = static_cast<WebKit::FrameNetworkingContextGtk*>(d->m_context.get());
-    if (!context)
-        return NULL;
-
-    if (!context->coreFrame())
-        return NULL;
-
-    GtkWidget* toplevel =  gtk_widget_get_toplevel(GTK_WIDGET(context->coreFrame()->page()->chrome()->platformPageClient()));
-    return widgetIsOnscreenToplevelWindow(toplevel) ? toplevel : 0;
-}
-
 /**
  * webkit_get_icon_database:
  *
@@ -590,13 +562,6 @@ void webkitInit()
     GOwnPtr<gchar> iconDatabasePath(g_build_filename(g_get_user_data_dir(), "webkit", "icondatabase", NULL));
     webkit_icon_database_set_path(webkit_get_icon_database(), iconDatabasePath.get());
 
-    SoupSession* session = webkit_get_default_session();
-
-    SoupSessionFeature* authDialog = static_cast<SoupSessionFeature*>(g_object_new(WEBKIT_TYPE_SOUP_AUTH_DIALOG, NULL));
-    g_signal_connect(authDialog, "current-toplevel", G_CALLBACK(currentToplevelCallback), NULL);
-    soup_session_add_feature(session, authDialog);
-    g_object_unref(authDialog);
-
     WebCore::ResourceHandle::setIgnoreSSLErrors(true);
 
 #if USE(CLUTTER)
diff --git a/Source/WebKit/gtk/webkit/webkithittestresult.cpp b/Source/WebKit/gtk/webkit/webkithittestresult.cpp
index 3b6a77a67..1a9434af0 100644
--- a/Source/WebKit/gtk/webkit/webkithittestresult.cpp
+++ b/Source/WebKit/gtk/webkit/webkithittestresult.cpp
@@ -245,28 +245,28 @@ static void webkit_hit_test_result_class_init(WebKitHitTestResultClass* webHitTe
     /**
      * WebKitHitTestResult:x:
      *
-     * The x coordintate of the event relative to the view's window.
+     * The x coordinate of the event relative to the view's window.
      *
      * Since: 1.10
      */
     g_object_class_install_property(objectClass, PROP_X,
                                     g_param_spec_int("x",
                                                      _("X coordinate"),
-                                                     _("The x coordintate of the event relative to the view's window."),
+                                                     _("The x coordinate of the event relative to the view's window."),
                                                      G_MININT, G_MAXINT, 0,
                                                      static_cast<GParamFlags>(WEBKIT_PARAM_READWRITE | G_PARAM_CONSTRUCT_ONLY)));
 
     /**
      * WebKitHitTestResult:y:
      *
-     * The x coordintate of the event relative to the view's window.
+     * The x coordinate of the event relative to the view's window.
      *
      * Since: 1.10
      */
     g_object_class_install_property(objectClass, PROP_Y,
                                     g_param_spec_int("y",
                                                      _("Y coordinate"),
-                                                     _("The y coordintate of the event relative to the view's window."),
+                                                     _("The y coordinate of the event relative to the view's window."),
                                                      G_MININT, G_MAXINT, 0,
                                                      static_cast<GParamFlags>(WEBKIT_PARAM_READWRITE | G_PARAM_CONSTRUCT_ONLY)));
 
diff --git a/Source/WebKit/gtk/webkit/webkitsoupauthdialog.cpp b/Source/WebKit/gtk/webkit/webkitsoupauthdialog.cpp
index 2b4b7772e..da161147e 100644
--- a/Source/WebKit/gtk/webkit/webkitsoupauthdialog.cpp
+++ b/Source/WebKit/gtk/webkit/webkitsoupauthdialog.cpp
@@ -20,7 +20,9 @@
 #include "config.h"
 #include "webkitsoupauthdialog.h"
 
+#include "AuthenticationClient.h"
 #include "GtkAuthenticationDialog.h"
+#include "ResourceHandle.h"
 #include "webkitmarshal.h"
 
 using namespace WebCore;
@@ -35,6 +37,46 @@ using namespace WebCore;
  * handling HTTP basic auth.
  */
 
+
+// This class exists only for API compatibility reasons. WebKitSoupAuthDialog was exposed
+// in the public API, so we must provide this "fake" AuthenticationClient in order to
+// continue using GtkAuthenticationDialog with the new authentication architecture.
+class WebKitSoupAuthDialogAuthenticationClient : public WebCore::AuthenticationClient, public RefCounted<WebKitSoupAuthDialogAuthenticationClient> {
+using RefCounted<WebKitSoupAuthDialogAuthenticationClient>::ref;
+using RefCounted<WebKitSoupAuthDialogAuthenticationClient>::deref;
+public:
+    virtual void didReceiveAuthenticationChallenge(const AuthenticationChallenge& challenge)
+    {
+    }
+
+    virtual void receivedRequestToContinueWithoutCredential(const AuthenticationChallenge& challenge)
+    {
+        soup_session_unpause_message(challenge.soupSession(), challenge.soupMessage());
+    }
+
+    virtual void receivedCredential(const AuthenticationChallenge& challenge, const Credential& credential)
+    {
+        soup_auth_authenticate(challenge.soupAuth(), credential.user().utf8().data(), credential.password().utf8().data());
+        soup_session_unpause_message(challenge.soupSession(), challenge.soupMessage());
+    }
+
+    virtual void receivedCancellation(const AuthenticationChallenge& challenge)
+    {
+        soup_session_unpause_message(challenge.soupSession(), challenge.soupMessage());
+    }
+
+    // This seems necessary to make the compiler happy. Both AuthenticationClient and
+    // RefCounted<T> expose a ref/deref method, which interferes with the use of a RefPtr.
+    void derefWebKitSoupAuthDialogAuthenticationClient()
+    {
+        deref();
+    }
+
+private:
+    virtual void refAuthenticationClient() { ref(); }
+    virtual void derefAuthenticationClient() { deref(); }
+};
+
 static void webkit_soup_auth_dialog_session_feature_init(SoupSessionFeatureInterface*, gpointer);
 static void attach(SoupSessionFeature*, SoupSession*);
 static void detach(SoupSessionFeature*, SoupSession*);
@@ -88,15 +130,20 @@ static void webkit_soup_auth_dialog_session_feature_init(SoupSessionFeatureInter
     featureInterface->detach = detach;
 }
 
-static void sessionAuthenticate(SoupSession* session, SoupMessage* message, SoupAuth* auth, gboolean, SoupSessionFeature* manager)
+static void sessionAuthenticate(SoupSession* session, SoupMessage* message, SoupAuth* auth, gboolean retrying, SoupSessionFeature* manager)
 {
-    GtkAuthenticationDialog* authDialog;
-    GtkWidget* toplevel = 0;
-
-    /* Get the current toplevel */
+    GtkWindow* toplevel = 0;
     g_signal_emit(manager, signals[CURRENT_TOPLEVEL], 0, message, &toplevel);
 
-    authDialog = new GtkAuthenticationDialog(toplevel ? GTK_WINDOW(toplevel) : 0, session, message, auth);
+    WebKitSoupAuthDialogAuthenticationClient* client = new WebKitSoupAuthDialogAuthenticationClient();
+    AuthenticationChallenge challenge(session, message, auth, retrying, client);
+    soup_session_unpause_message(session, message);
+
+    // A RefPtr would be better here, but it seems that accessing RefCounted::deref from this context is
+    // impossible with gcc, due to WebKitSoupAuthDialogAuthenticationClient's two superclasses.
+    client->derefWebKitSoupAuthDialogAuthenticationClient();
+
+    GtkAuthenticationDialog* authDialog = new GtkAuthenticationDialog(toplevel, challenge);
     authDialog->show();
 }
 
diff --git a/Source/WebKit/mac/ChangeLog b/Source/WebKit/mac/ChangeLog
index 8aa53eb80..6ba1ac715 100644
--- a/Source/WebKit/mac/ChangeLog
+++ b/Source/WebKit/mac/ChangeLog
@@ -1,3 +1,346 @@
+2012-11-06  Adam Barth  <abarth@webkit.org>
+
+        Unreviewed attempt to fix the chromium-mac build.
+
+        * WebCoreSupport/WebSystemInterface.mm:
+        (InitWebCoreSystemInterface):
+
+2012-11-06  Anders Carlsson  <andersca@apple.com>
+
+        Update Java related WKSI function names
+        https://bugs.webkit.org/show_bug.cgi?id=101414
+
+        Reviewed by Sam Weinig.
+
+        * WebCoreSupport/WebChromeClient.mm:
+        (WebChromeClient::unavailablePluginButtonClicked):
+        * WebCoreSupport/WebFrameLoaderClient.mm:
+        (isPlugInInactive):
+
+2012-11-06  Alexey Proskuryakov  <ap@apple.com>
+
+        Clean up which storage cookie jar functions use
+        https://bugs.webkit.org/show_bug.cgi?id=101395
+
+        Reviewed by Brady Eidson.
+
+        * WebCoreSupport/WebSystemInterface.mm: (InitWebCoreSystemInterface): Updated for
+        two new functions.
+
+2012-11-06  Andrey Lushnikov  <lushnikov@google.com>
+
+        Added console.clear() method
+
+        Web Inspector: add console.clear()
+        https://bugs.webkit.org/show_bug.cgi?id=101021
+
+        Reviewed by Vsevolod Vlasov.
+
+        * WebCoreSupport/WebChromeClient.mm:
+        (stringForMessageType): Added ClearMessageType case to switch
+
+2012-11-05  Alexey Proskuryakov  <ap@apple.com>
+
+        Get rid of setCookieStoragePrivateBrowsingEnabled.
+        https://bugs.webkit.org/show_bug.cgi?id=101247
+
+        Reviewed by Brady Eidson.
+
+        * WebCoreSupport/WebSystemInterface.mm: (InitWebCoreSystemInterface): We no longer
+        have this function.
+
+2012-11-03  Alexey Proskuryakov  <ap@apple.com>
+
+        Get rid of USE(CFURLSTORAGESESSIONS)
+        https://bugs.webkit.org/show_bug.cgi?id=101131
+
+        Reviewed by Sam Weinig.
+
+        * WebView/WebPreferences.mm:
+        (+[WebPreferences _switchNetworkLoaderToNewTestingSession]):
+        (+[WebPreferences _setCurrentNetworkLoaderSessionCookieAcceptPolicy:]):
+        * WebView/WebView.mm:
+        (-[WebView _cachedResponseForURL:]):
+
+2012-11-02  Anders Carlsson  <andersca@apple.com>
+
+        Don't instantiate the Java plug-in if it's inactive
+        https://bugs.webkit.org/show_bug.cgi?id=101102
+        <rdar://problem/12595679>
+
+        Reviewed by Andreas Kling.
+
+        * WebCoreSupport/WebChromeClient.mm:
+        (WebChromeClient::shouldUnavailablePluginMessageBeButton):
+        The RenderEmbeddedObject::PluginInactive reason should always result in a button being shown.
+
+        (WebChromeClient::unavailablePluginButtonClicked):
+        If the Java plug-in is inactive, call WKJLReportWebComponentsUsed() to reactivate the plug-in and
+        then reload the page.
+
+        * WebCoreSupport/WebFrameLoaderClient.mm:
+        (isOracleJavaPlugIn):
+        (isPlugInInactive):
+        Helper functions.
+
+        (WebFrameLoaderClient::createPlugin):
+        If the plug-in is inactive, set the appropriate unavailability reason on the renderer.
+
+2012-11-02  Simon Fraser  <simon.fraser@apple.com>
+
+        Enable SUBPIXEL_LAYOUT on Mac
+        https://bugs.webkit.org/show_bug.cgi?id=101076
+
+        Reviewed by Dave Hyatt.
+
+        Define ENABLE_SUBPIXEL_LAYOUT and include it in FEATURE_DEFINES.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2012-11-02  Adam Barth  <abarth@webkit.org>
+
+        ENABLE(UNDO_MANAGER) is disabled everywhere and is not under active development
+        https://bugs.webkit.org/show_bug.cgi?id=100711
+
+        Reviewed by Eric Seidel.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2012-11-01  Adam Roben  <aroben@webkit.org>
+
+        [WK1] Fixed-position elements jiggle up and down slightly during scrolling on a Retina display
+        https://bugs.webkit.org/show_bug.cgi?id=100957
+
+        Reviewed by Simon Fraser.
+
+        WebCore doesn't yet support subpixel scrolling. WebKit2 forces
+        scrolling to always be integral. Now WebKit1 forces this as well.
+
+        I'm not sure how to write a test for this.
+
+        * WebView/WebDynamicScrollBarsView.mm:
+        (shouldRoundScrollOrigin): Returns YES if there are any position:fixed
+        or position:sticky elements in the page.
+        (-[WebDynamicScrollBarsView scrollClipView:toPoint:]): Round the
+        scroll origin to the nearest pixel if needed.
+
+2012-10-31  Anders Carlsson  <andersca@apple.com>
+
+        Fix build.
+        <rdar://problem/12612207>.
+
+        Reviewed by Sam Weinig.
+
+        * Panels/WebAuthenticationPanel.m:
+        (-[WebAuthenticationPanel loadNib]):
+
+2012-10-30  Joseph Pecoraro  <pecoraro@apple.com>
+
+        [Mac] Sync up FeatureDefine Configuration Files
+        https://bugs.webkit.org/show_bug.cgi?id=100171
+
+        Reviewed by David Kilzer.
+
+        Follow up to better coordinate with iOS feature defines. Make:
+
+          - ENABLE_FILTERS always on
+          - ENABLE_INPUT_* iphonesimulator values point to the iphoneos values
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2012-10-30  Joseph Pecoraro  <pecoraro@apple.com>
+
+        [Mac] Sync up FeatureDefine Configuration Files
+        https://bugs.webkit.org/show_bug.cgi?id=100171
+
+        Reviewed by David Kilzer.
+
+        Ensure an identical FeatureDefine files across all projects. Changes:
+
+          - ENABLE_CSS_BOX_DECORATION_BREAK should be in all
+          - ENABLE_PDFKIT_PLUGIN should be in all
+          - ENABLE_RESOLUTION_MEDIA_QUERY should be in all
+          - ENABLE_ENCRYPTED_MEDIA should be in all
+          - ENABLE_HIDDEN_PAGE_DOM_TIMER_THROTTLING with corrected value
+          - Some alphabetical ordering cleanup
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2012-10-29  Anders Carlsson  <andersca@apple.com>
+
+        Build WebKit as C++11 on Mac
+        https://bugs.webkit.org/show_bug.cgi?id=100720
+
+        Reviewed by Daniel Bates.
+
+        * Configurations/Base.xcconfig:
+        Add CLANG_CXX_LANGUAGE_STANDARD=gnu++0x.
+
+        * History/WebBackForwardList.mm:
+        (-[WebBackForwardList description]):
+        * History/WebHistoryItem.mm:
+        (-[WebHistoryItem description]):
+        Add static_casts to prevent implicit type conversions in non-constant initializer lists.
+
+2012-10-28  Mark Rowe  <mrowe@apple.com>
+
+        Simplify Xcode configuration settings that used to vary between OS versions.
+
+        Reviewed by Dan Bernstein.
+
+        * Configurations/Base.xcconfig:
+        * Configurations/DebugRelease.xcconfig:
+        * Configurations/WebKit.xcconfig:
+
+2012-10-28  Mark Rowe  <mrowe@apple.com>
+
+        Remove references to unsupported OS and Xcode versions.
+
+        Reviewed by Anders Carlsson.
+
+        * Configurations/Base.xcconfig:
+        * Configurations/CompilerVersion.xcconfig: Removed.
+        * Configurations/DebugRelease.xcconfig:
+        * Configurations/Version.xcconfig:
+
+2012-10-29  Enrica Casucci  <enrica@apple.com>
+
+        Add ENABLE_USERSELECT_ALL feature flag.
+        https://bugs.webkit.org/show_bug.cgi?id=100559
+
+        Reviewed by Eric Seidel.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2012-10-27  Alexey Proskuryakov  <ap@apple.com>
+
+        All tests crash in WebKit1 mode
+        https://bugs.webkit.org/show_bug.cgi?id=100602
+
+        Reviewed by Sam Weinig.
+
+        * WebView/WebView.mm: (+[WebView _setLoadResourcesSerially:]): Resource load
+        scheduler is created via a strategy, so strategies need to be initialized before
+        using it.
+
+2012-10-27  Dan Bernstein  <mitz@apple.com>
+
+        REAL_PLATFORM_NAME build setting is no longer needed
+        https://bugs.webkit.org/show_bug.cgi?id=100587
+
+        Reviewed by Mark Rowe.
+
+        Removed the definition of REAL_PLATFORM_NAME and replaced references to it with references
+        to PLATFORM_NAME.
+
+        * Configurations/Base.xcconfig:
+        * Configurations/CompilerVersion.xcconfig:
+        * Configurations/DebugRelease.xcconfig:
+        * Configurations/FeatureDefines.xcconfig:
+        * Configurations/Version.xcconfig:
+        * Configurations/WebKit.xcconfig:
+
+2012-10-26  Thiago Marcos P. Santos  <thiago.santos@intel.com>
+
+        Add feature flags for CSS Device Adaptation
+        https://bugs.webkit.org/show_bug.cgi?id=95960
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2012-10-25  Dominik Röttsches  <dominik.rottsches@intel.com>
+
+        Conditionalize XHR timeout support
+        https://bugs.webkit.org/show_bug.cgi?id=100356
+
+        Reviewed by Adam Barth.
+
+        Adding XHR_TIMEOUT feature to conditionalize this on ports without network backend support.
+        Defaults to ON on Mac since the Mac NSUrlConnection based backend has setTimeoutInterval support.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2012-10-24  Timothy Hatcher  <timothy@apple.com>
+
+        Fix a crash seen during the Inspector tests on the WebKit1 bots.
+
+        Reviewed by Filip Pizlo.
+
+        * WebCoreSupport/WebInspectorClient.mm:
+        (WebInspectorFrontendClient::bringToFront): Use the window from the WebView since m_windowController's window
+        is not the same when the Inspector is docked.
+
+2012-10-24  Brady Eidson  <beidson@apple.com>
+
+        Add a strategy for loader customization.
+        https://bugs.webkit.org/show_bug.cgi?id=100278
+
+        Reviewed by Alexey Proskuryakov.
+
+        * WebCoreSupport/WebPlatformStrategies.h:
+        (WebPlatformStrategies):
+        * WebCoreSupport/WebPlatformStrategies.mm:
+        (WebPlatformStrategies::createLoaderStrategy):
+
+2012-10-24  Timothy Hatcher  <timothy@apple.com>
+
+        Make the Inspector WKView/WebView become the first responder when bringToFront is called.
+
+        https://bugs.webkit.org/show_bug.cgi?id=100209
+
+        Reviewed by Joseph Pecoraro.
+
+        * WebCoreSupport/WebInspectorClient.mm:
+        (WebInspectorFrontendClient::bringToFront): Make the Inspector WebView become the first responder.
+
+2012-10-23  Alexey Proskuryakov  <ap@apple.com>
+
+        Add a strategy for shared workers
+        https://bugs.webkit.org/show_bug.cgi?id=100165
+
+        Reviewed by Brady Eidson.
+
+        * WebCoreSupport/WebPlatformStrategies.h:
+        * WebCoreSupport/WebPlatformStrategies.mm:
+        (WebPlatformStrategies::createPasteboardStrategy):
+        (WebPlatformStrategies::createSharedWorkerStrategy):
+        (WebPlatformStrategies::createVisitedLinkStrategy):
+
+2012-10-24  Eric Carlson  <eric.carlson@apple.com>
+
+        Allow ports to override text track rendering style
+        https://bugs.webkit.org/show_bug.cgi?id=97800
+        <rdar://problem/12044964>
+
+        Reviewed by Maciej Stachowiak.
+
+        * WebCoreSupport/WebSystemInterface.mm:
+        (InitWebCoreSystemInterface): Initialize new WKSI function pointers.
+
+2012-10-23  Dan Bernstein  <mitz@apple.com>
+
+        WebKit/mac part of <rdar://problem/2966974> [mac] Kerning and ligatures are not enabled by default
+        https://bugs.webkit.org/show_bug.cgi?id=100188
+
+        Reviewed by Sam Weinig.
+
+        * WebView/WebView.mm:
+        (+[WebView initialize]): Added a local variable to hold the standard user defaults. Added
+        code to register a value of YES for the WebKitKerningAndLigaturesEnabledByDefault user
+        default. Changed to refer to that default key by name.
+
+2012-10-23  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Add support for resolution media query
+        https://bugs.webkit.org/show_bug.cgi?id=99077
+
+        Reviewed by Antti Koivisto.
+
+        Add support for the RESOLUTION_MEDIA_QUERY feature flag.
+
+        * Configurations/FeatureDefines.xcconfig:
+
 2012-10-21  Andreas Kling  <kling@webkit.org>
 
         Remove Page::javaScriptURLsAreAllowed setting.
diff --git a/Source/WebKit/mac/Configurations/Base.xcconfig b/Source/WebKit/mac/Configurations/Base.xcconfig
index d35aea68a..30068f10e 100644
--- a/Source/WebKit/mac/Configurations/Base.xcconfig
+++ b/Source/WebKit/mac/Configurations/Base.xcconfig
@@ -21,11 +21,8 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 
-#include "CompilerVersion.xcconfig"
-
-COMPILER_SPECIFIC_WARNING_CFLAGS = $(COMPILER_SPECIFIC_WARNING_CFLAGS_$(TARGET_GCC_VERSION));
-COMPILER_SPECIFIC_WARNING_CFLAGS_LLVM_COMPILER = -Wexit-time-destructors -Wglobal-constructors -Wtautological-compare;
-
+CLANG_CXX_LANGUAGE_STANDARD = gnu++0x;
+CLANG_CXX_LIBRARY = libc++;
 CLANG_WARN_CXX0X_EXTENSIONS = NO;
 DEBUG_INFORMATION_FORMAT = dwarf-with-dsym;
 GCC_C_LANGUAGE_STANDARD = gnu99;
@@ -34,19 +31,20 @@ GCC_DYNAMIC_NO_PIC = NO;
 GCC_ENABLE_CPP_EXCEPTIONS = NO;
 GCC_ENABLE_CPP_RTTI = NO;
 GCC_ENABLE_OBJC_EXCEPTIONS = YES;
-GCC_ENABLE_OBJC_GC = $(GCC_ENABLE_OBJC_GC_$(REAL_PLATFORM_NAME));
+GCC_ENABLE_OBJC_GC = $(GCC_ENABLE_OBJC_GC_$(PLATFORM_NAME));
 GCC_ENABLE_OBJC_GC_iphoneos = NO;
 GCC_ENABLE_OBJC_GC_iphonesimulator = NO;
 GCC_ENABLE_OBJC_GC_macosx = supported;
 GCC_ENABLE_SYMBOL_SEPARATION = NO;
 GCC_FAST_OBJC_DISPATCH = YES;
 GCC_GENERATE_DEBUGGING_SYMBOLS = YES;
-GCC_MODEL_TUNING = $(GCC_MODEL_TUNING_$(REAL_PLATFORM_NAME));
+GCC_MODEL_TUNING = $(GCC_MODEL_TUNING_$(PLATFORM_NAME));
 GCC_MODEL_TUNING_macosx = G5;
 GCC_OBJC_CALL_CXX_CDTORS = YES;
 GCC_PRECOMPILE_PREFIX_HEADER = YES;
 GCC_THREADSAFE_STATICS = NO;
 GCC_TREAT_WARNINGS_AS_ERRORS = YES;
+GCC_VERSION = com.apple.compilers.llvm.clang.1_0;
 GCC_WARN_ABOUT_DEPRECATED_FUNCTIONS = NO;
 GCC_WARN_ABOUT_MISSING_NEWLINE = YES;
 GCC_WARN_ABOUT_MISSING_PROTOTYPES = YES;
@@ -55,29 +53,17 @@ GCC_WARN_SIGN_COMPARE = YES;
 LINKER_DISPLAYS_MANGLED_NAMES = YES;
 OTHER_MIGFLAGS = -F$(BUILT_PRODUCTS_DIR);
 PREBINDING = NO;
-VALID_ARCHS = $(VALID_ARCHS_$(REAL_PLATFORM_NAME));
+VALID_ARCHS = $(VALID_ARCHS_$(PLATFORM_NAME));
 VALID_ARCHS_iphoneos = $(ARCHS_STANDARD_32_BIT);
 VALID_ARCHS_iphonesimulator = $(ARCHS_STANDARD_32_BIT);
 VALID_ARCHS_macosx = i386 ppc x86_64 ppc64;
 // FIXME: <rdar://problem/5070292> WebKit should build with -Wshorten-64-to-32
-WARNING_CFLAGS_BASE = -Wall -Wextra -Wchar-subscripts -Wextra-tokens -Wformat-security -Winit-self -Wmissing-format-attribute -Wmissing-noreturn -Wno-unused-parameter -Wpacked -Wpointer-arith -Wredundant-decls -Wundef -Wwrite-strings;
-WARNING_CFLAGS = $(WARNING_CFLAGS_$(REAL_PLATFORM_NAME)) $(COMPILER_SPECIFIC_WARNING_CFLAGS);
+WARNING_CFLAGS_BASE = -Wall -Wextra -Wchar-subscripts -Wextra-tokens -Wformat-security -Winit-self -Wmissing-format-attribute -Wmissing-noreturn -Wno-unused-parameter -Wpacked -Wpointer-arith -Wredundant-decls -Wundef -Wwrite-strings -Wexit-time-destructors -Wglobal-constructors -Wtautological-compare;
+WARNING_CFLAGS = $(WARNING_CFLAGS_$(PLATFORM_NAME));
 WARNING_CFLAGS_iphoneos = $(WARNING_CFLAGS_BASE);
 WARNING_CFLAGS_iphonesimulator = $(WARNING_CFLAGS_BASE);
 WARNING_CFLAGS_macosx = $(WARNING_CFLAGS_BASE);
 
-CLANG_CXX_LIBRARY = $(CLANG_CXX_LIBRARY_$(TARGET_MAC_OS_X_VERSION_MAJOR));
-CLANG_CXX_LIBRARY_1060 = libstdc++;
-CLANG_CXX_LIBRARY_1070 = libc++;
-CLANG_CXX_LIBRARY_1080 = libc++;
-CLANG_CXX_LIBRARY_1090 = libc++;
-
-REAL_PLATFORM_NAME = $(REAL_PLATFORM_NAME_$(PLATFORM_NAME));
-REAL_PLATFORM_NAME_ = $(REAL_PLATFORM_NAME_macosx);
-REAL_PLATFORM_NAME_iphoneos = iphoneos;
-REAL_PLATFORM_NAME_iphonesimulator = iphonesimulator;
-REAL_PLATFORM_NAME_macosx = macosx;
-
 TARGET_MAC_OS_X_VERSION_MAJOR = $(MAC_OS_X_VERSION_MAJOR);
 
 
@@ -102,7 +88,6 @@ DEAD_CODE_STRIPPING = YES;
 SECTORDER_FLAGS = -Wl,-order_file,mac/WebKit.order;
 
 TARGETING_SAME_OS_X_VERSION = $(TARGETING_SAME_OS_X_VERSION_$(MAC_OS_X_VERSION_MAJOR)_$(TARGET_MAC_OS_X_VERSION_MAJOR));
-TARGETING_SAME_OS_X_VERSION_1060_1060 = YES;
 TARGETING_SAME_OS_X_VERSION_1070_1070 = YES;
 TARGETING_SAME_OS_X_VERSION_1080_1080 = YES;
 TARGETING_SAME_OS_X_VERSION_1090_1090 = YES;
diff --git a/Source/WebKit/mac/Configurations/CompilerVersion.xcconfig b/Source/WebKit/mac/Configurations/CompilerVersion.xcconfig
deleted file mode 100644
index a8c7f75a0..000000000
--- a/Source/WebKit/mac/Configurations/CompilerVersion.xcconfig
+++ /dev/null
@@ -1,84 +0,0 @@
-// Copyright (C) 2009, 2010, 2011 Apple Inc. All rights reserved.
-//
-// Redistribution and use in source and binary forms, with or without
-// modification, are permitted provided that the following conditions
-// are met:
-// 1. Redistributions of source code must retain the above copyright
-//    notice, this list of conditions and the following disclaimer.
-// 2. Redistributions in binary form must reproduce the above copyright
-//    notice, this list of conditions and the following disclaimer in the
-//    documentation and/or other materials provided with the distribution.
-//
-// THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
-// EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
-// IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
-// PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
-// CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
-// EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
-// PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
-// PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
-// OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
-
-IS_XCODE_0400 = $(IS_XCODE_0400_$(XCODE_VERSION_MINOR));
-IS_XCODE_0400_0400 = YES;
-
-IS_XCODE_0400_OR_0410 = $(IS_XCODE_0400_OR_0410_$(XCODE_VERSION_MINOR));
-IS_XCODE_0400_OR_0410_0400 = YES;
-IS_XCODE_0400_OR_0410_0410 = YES;
-
-// The version of the LLVM Compiler in Xcode 4.0 and earlier have difficulty compiling our code.
-LLVM_COMPILER_UNSUITABLE_FOR_DEBUG_BUILDS = $(LLVM_COMPILER_UNSUITABLE_FOR_DEBUG_BUILDS_$(XCODE_VERSION_MAJOR));
-LLVM_COMPILER_UNSUITABLE_FOR_DEBUG_BUILDS_0300 = YES;
-LLVM_COMPILER_UNSUITABLE_FOR_DEBUG_BUILDS_0400 = $(LLVM_COMPILER_UNSUITABLE_FOR_DEBUG_BUILDS_IS_XCODE_0400_$(IS_XCODE_0400));
-LLVM_COMPILER_UNSUITABLE_FOR_DEBUG_BUILDS_IS_XCODE_0400_YES = YES;
-
-// The version of the LLVM Compiler in Xcode 4.1 and earlier do not generate fast enough code.
-LLVM_COMPILER_UNSUITABLE_FOR_OPTIMIZED_BUILDS = $(LLVM_COMPILER_UNSUITABLE_FOR_OPTIMIZED_BUILDS_$(XCODE_VERSION_MAJOR));
-LLVM_COMPILER_UNSUITABLE_FOR_OPTIMIZED_BUILDS_0300 = YES;
-LLVM_COMPILER_UNSUITABLE_FOR_OPTIMIZED_BUILDS_0400 = $(LLVM_COMPILER_UNSUITABLE_FOR_OPTIMIZED_BUILDS_IS_XCODE_0400_OR_0410_$(IS_XCODE_0400_OR_0410));
-LLVM_COMPILER_UNSUITABLE_FOR_OPTIMIZED_BUILDS_IS_XCODE_0400_OR_0410_YES = YES;
-
-LLVM_COMPILER_SUITABLE_FOR_DEBUG_BUILDS = $(LLVM_COMPILER_SUITABLE_FOR_DEBUG_BUILDS_$(LLVM_COMPILER_UNSUITABLE_FOR_DEBUG_BUILDS));
-LLVM_COMPILER_SUITABLE_FOR_DEBUG_BUILDS_ = YES;
-LLVM_COMPILER_SUITABLE_FOR_DEBUG_BUILDS_YES = NO;
-
-LLVM_COMPILER_SUITABLE_FOR_OPTIMIZED_BUILDS = $(LLVM_COMPILER_SUITABLE_FOR_OPTIMIZED_BUILDS_$(LLVM_COMPILER_UNSUITABLE_FOR_OPTIMIZED_BUILDS));
-LLVM_COMPILER_SUITABLE_FOR_OPTIMIZED_BUILDS_ = YES;
-LLVM_COMPILER_SUITABLE_FOR_OPTIMIZED_BUILDS_YES = NO;
-
-
-// Use GCC 4.2 with Xcode 3.1, which includes GCC 4.2 but defaults to GCC 4.0.
-// Note that Xcode versions as new as 3.1.2 use XCODE_VERSION_ACTUAL for the minor version
-// number.  Newer versions of Xcode use XCODE_VERSION_MINOR for the minor version, and
-// XCODE_VERSION_ACTUAL for the full version number.
-TARGET_GCC_VERSION = $(TARGET_GCC_VERSION_$(REAL_PLATFORM_NAME));
-TARGET_GCC_VERSION_iphoneos = LLVM_GCC_42;
-TARGET_GCC_VERSION_iphonesimulator = GCC_42;
-TARGET_GCC_VERSION_macosx = $(TARGET_GCC_VERSION_macosx_$(TARGET_MAC_OS_X_VERSION_MAJOR));
-
-TARGET_GCC_VERSION_macosx_1050 = $(TARGET_GCC_VERSION_macosx_1050_$(XCODE_VERSION_MINOR));
-TARGET_GCC_VERSION_macosx_1050_ = $(TARGET_GCC_VERSION_macosx_1050_$(XCODE_VERSION_ACTUAL));
-TARGET_GCC_VERSION_macosx_1050_0310 = GCC_42;
-TARGET_GCC_VERSION_macosx_1050_0320 = GCC_42;
-
-TARGET_GCC_VERSION_macosx_1060 = $(TARGET_GCC_VERSION_macosx_1060_AND_1070_$(CONFIGURATION));
-TARGET_GCC_VERSION_macosx_1070 = $(TARGET_GCC_VERSION_macosx_1060_AND_1070_$(CONFIGURATION));
-TARGET_GCC_VERSION_macosx_1060_AND_1070_Debug = $(TARGET_GCC_VERSION_macosx_USE_LLVM_COMPILER_$(LLVM_COMPILER_SUITABLE_FOR_DEBUG_BUILDS));
-TARGET_GCC_VERSION_macosx_1060_AND_1070_Release = $(TARGET_GCC_VERSION_macosx_USE_LLVM_COMPILER_$(LLVM_COMPILER_SUITABLE_FOR_OPTIMIZED_BUILDS));
-TARGET_GCC_VERSION_macosx_1060_AND_1070_Production = $(TARGET_GCC_VERSION_macosx_USE_LLVM_COMPILER_$(LLVM_COMPILER_SUITABLE_FOR_OPTIMIZED_BUILDS));
-TARGET_GCC_VERSION_macosx_1060_NON_LLVM_FALLBACK = GCC_42;
-TARGET_GCC_VERSION_macosx_1070_NON_LLVM_FALLBACK = LLVM_GCC_42;
-
-TARGET_GCC_VERSION_macosx_USE_LLVM_COMPILER_YES = LLVM_COMPILER;
-TARGET_GCC_VERSION_macosx_USE_LLVM_COMPILER_NO = $(TARGET_GCC_VERSION_macosx_$(TARGET_MAC_OS_X_VERSION_MAJOR)_NON_LLVM_FALLBACK);
-
-TARGET_GCC_VERSION_macosx_1080 = LLVM_COMPILER;
-TARGET_GCC_VERSION_macosx_1090 = LLVM_COMPILER;
-
-GCC_VERSION = $(GCC_VERSION_$(TARGET_GCC_VERSION));
-GCC_VERSION_GCC_40 = 4.0;
-GCC_VERSION_GCC_42 = 4.2;
-GCC_VERSION_LLVM_GCC_42 = com.apple.compilers.llvmgcc42;
-GCC_VERSION_LLVM_COMPILER = com.apple.compilers.llvm.clang.1_0;
diff --git a/Source/WebKit/mac/Configurations/DebugRelease.xcconfig b/Source/WebKit/mac/Configurations/DebugRelease.xcconfig
index 086c31aa8..645d2786f 100644
--- a/Source/WebKit/mac/Configurations/DebugRelease.xcconfig
+++ b/Source/WebKit/mac/Configurations/DebugRelease.xcconfig
@@ -23,24 +23,17 @@
 
 #include "Base.xcconfig"
 
-ARCHS = $(ARCHS_$(REAL_PLATFORM_NAME));
+ARCHS = $(ARCHS_$(PLATFORM_NAME));
 ARCHS_iphoneos = $(ARCHS_STANDARD_32_BIT);
 ARCHS_iphonesimulator = $(ARCHS_STANDARD_32_BIT);
-ARCHS_macosx = $(ARCHS_macosx_$(TARGET_MAC_OS_X_VERSION_MAJOR));
-ARCHS_macosx_1050 = $(NATIVE_ARCH);
-ARCHS_macosx_1060 = $(ARCHS_STANDARD_32_64_BIT);
-ARCHS_macosx_1070 = $(ARCHS_STANDARD_32_64_BIT);
-ARCHS_macosx_1080 = $(ARCHS_STANDARD_32_64_BIT);
-ARCHS_macosx_1090 = $(ARCHS_STANDARD_32_64_BIT);
+ARCHS_macosx = $(ARCHS_STANDARD_32_64_BIT);
 
 ONLY_ACTIVE_ARCH = YES;
 
-MACOSX_DEPLOYMENT_TARGET = $(MACOSX_DEPLOYMENT_TARGET_$(REAL_PLATFORM_NAME));
+MACOSX_DEPLOYMENT_TARGET = $(MACOSX_DEPLOYMENT_TARGET_$(PLATFORM_NAME));
 MACOSX_DEPLOYMENT_TARGET_iphoneos = 10.5;
 MACOSX_DEPLOYMENT_TARGET_iphonesimulator = 10.5;
 MACOSX_DEPLOYMENT_TARGET_macosx = $(MACOSX_DEPLOYMENT_TARGET_macosx_$(TARGET_MAC_OS_X_VERSION_MAJOR));
-MACOSX_DEPLOYMENT_TARGET_macosx_1050 = 10.5;
-MACOSX_DEPLOYMENT_TARGET_macosx_1060 = 10.6;
 MACOSX_DEPLOYMENT_TARGET_macosx_1070 = 10.7;
 MACOSX_DEPLOYMENT_TARGET_macosx_1080 = 10.8;
 MACOSX_DEPLOYMENT_TARGET_macosx_1090 = 10.9;
@@ -50,12 +43,10 @@ DEBUG_INFORMATION_FORMAT = dwarf;
 
 SECTORDER_FLAGS = ;
 
-WEBKIT_SYSTEM_INTERFACE_LIBRARY = $(WEBKIT_SYSTEM_INTERFACE_LIBRARY_$(REAL_PLATFORM_NAME));
+WEBKIT_SYSTEM_INTERFACE_LIBRARY = $(WEBKIT_SYSTEM_INTERFACE_LIBRARY_$(PLATFORM_NAME));
 WEBKIT_SYSTEM_INTERFACE_LIBRARY_iphoneos = WebKitSystemInterface;
 WEBKIT_SYSTEM_INTERFACE_LIBRARY_iphonesimulator = $(WEBKIT_SYSTEM_INTERFACE_LIBRARY_iphoneos);
 WEBKIT_SYSTEM_INTERFACE_LIBRARY_macosx = $(WEBKIT_SYSTEM_INTERFACE_LIBRARY_macosx_$(TARGET_MAC_OS_X_VERSION_MAJOR));
-WEBKIT_SYSTEM_INTERFACE_LIBRARY_macosx_1050 = WebKitSystemInterfaceLeopard;
-WEBKIT_SYSTEM_INTERFACE_LIBRARY_macosx_1060 = WebKitSystemInterfaceSnowLeopard;
 WEBKIT_SYSTEM_INTERFACE_LIBRARY_macosx_1070 = WebKitSystemInterfaceLion;
 WEBKIT_SYSTEM_INTERFACE_LIBRARY_macosx_1080 = WebKitSystemInterfaceMountainLion;
 WEBKIT_SYSTEM_INTERFACE_LIBRARY_macosx_1090 = WebKitSystemInterfaceMountainLion;
diff --git a/Source/WebKit/mac/Configurations/FeatureDefines.xcconfig b/Source/WebKit/mac/Configurations/FeatureDefines.xcconfig
index eee0fe431..a4f8ca0c0 100644
--- a/Source/WebKit/mac/Configurations/FeatureDefines.xcconfig
+++ b/Source/WebKit/mac/Configurations/FeatureDefines.xcconfig
@@ -38,6 +38,8 @@ ENABLE_BLOB = ENABLE_BLOB;
 ENABLE_CHANNEL_MESSAGING = ENABLE_CHANNEL_MESSAGING;
 ENABLE_CSP_NEXT = ;
 ENABLE_CSS_BOX_DECORATION_BREAK = ENABLE_CSS_BOX_DECORATION_BREAK;
+ENABLE_CSS_COMPOSITING = ENABLE_CSS_COMPOSITING;
+ENABLE_CSS_DEVICE_ADAPTATION = ;
 ENABLE_CSS_EXCLUSIONS = ENABLE_CSS_EXCLUSIONS;
 ENABLE_CSS_FILTERS = ENABLE_CSS_FILTERS;
 ENABLE_CSS_HIERARCHIES = ;
@@ -45,13 +47,12 @@ ENABLE_CSS_IMAGE_ORIENTATION = ;
 ENABLE_CSS_IMAGE_RESOLUTION = ;
 ENABLE_CSS_REGIONS = ENABLE_CSS_REGIONS;
 ENABLE_CSS_SHADERS = ENABLE_CSS_SHADERS;
-ENABLE_CSS_COMPOSITING = ENABLE_CSS_COMPOSITING;
 ENABLE_CSS_STICKY_POSITION = ENABLE_CSS_STICKY_POSITION;
 ENABLE_CSS_VARIABLES = ;
 ENABLE_CSS3_CONDITIONAL_RULES = ;
 ENABLE_CSS3_TEXT = ;
 ENABLE_CUSTOM_SCHEME_HANDLER = ;
-ENABLE_DASHBOARD_SUPPORT = $(ENABLE_DASHBOARD_SUPPORT_$(REAL_PLATFORM_NAME));
+ENABLE_DASHBOARD_SUPPORT = $(ENABLE_DASHBOARD_SUPPORT_$(PLATFORM_NAME));
 ENABLE_DASHBOARD_SUPPORT_macosx = ENABLE_DASHBOARD_SUPPORT;
 ENABLE_DATALIST_ELEMENT = ;
 ENABLE_DATA_TRANSFER_ITEMS = ;
@@ -60,42 +61,46 @@ ENABLE_DEVICE_ORIENTATION = ;
 ENABLE_DIALOG_ELEMENT = ;
 ENABLE_DIRECTORY_UPLOAD = ;
 ENABLE_DRAGGABLE_REGION = ;
+ENABLE_ENCRYPTED_MEDIA = $(ENABLE_ENCRYPTED_MEDIA_$(PLATFORM_NAME));
+ENABLE_ENCRYPTED_MEDIA_macosx = $(ENABLE_ENCRYPTED_MEDIA_macosx_$(TARGET_MAC_OS_X_VERSION_MAJOR));
+ENABLE_ENCRYPTED_MEDIA_macosx_1070 = ;
+ENABLE_ENCRYPTED_MEDIA_macosx_1080 = ;
+ENABLE_ENCRYPTED_MEDIA_macosx_1090 = ENABLE_ENCRYPTED_MEDIA;
 ENABLE_FILE_SYSTEM = ;
-ENABLE_FILTERS = $(ENABLE_FILTERS_$(REAL_PLATFORM_NAME));
-ENABLE_FILTERS_macosx = ENABLE_FILTERS;
+ENABLE_FILTERS = ENABLE_FILTERS;
 ENABLE_FULLSCREEN_API = ENABLE_FULLSCREEN_API;
 ENABLE_GAMEPAD = ;
 ENABLE_GEOLOCATION = ENABLE_GEOLOCATION;
-ENABLE_HIDDEN_PAGE_DOM_TIMER_THROTTLING = $(ENABLE_HIDDEN_PAGE_DOM_TIMER_THROTTLING_$(REAL_PLATFORM_NAME));
+ENABLE_HIDDEN_PAGE_DOM_TIMER_THROTTLING = $(ENABLE_HIDDEN_PAGE_DOM_TIMER_THROTTLING_$(PLATFORM_NAME));
 ENABLE_HIDDEN_PAGE_DOM_TIMER_THROTTLING_macosx = ENABLE_HIDDEN_PAGE_DOM_TIMER_THROTTLING;
 ENABLE_HIGH_DPI_CANVAS = ENABLE_HIGH_DPI_CANVAS;
-ENABLE_ICONDATABASE = $(ENABLE_ICONDATABASE_$(REAL_PLATFORM_NAME));
+ENABLE_ICONDATABASE = $(ENABLE_ICONDATABASE_$(PLATFORM_NAME));
 ENABLE_ICONDATABASE_macosx = ENABLE_ICONDATABASE;
 ENABLE_IFRAME_SEAMLESS = ENABLE_IFRAME_SEAMLESS;
 ENABLE_INDEXED_DATABASE = ;
 ENABLE_INPUT_SPEECH = ;
 ENABLE_INPUT_TYPE_COLOR = ;
-ENABLE_INPUT_TYPE_DATE = $(ENABLE_INPUT_TYPE_DATE_$(REAL_PLATFORM_NAME));
+ENABLE_INPUT_TYPE_DATE = $(ENABLE_INPUT_TYPE_DATE_$(PLATFORM_NAME));
 ENABLE_INPUT_TYPE_DATE_iphoneos = ENABLE_INPUT_TYPE_DATE;
-ENABLE_INPUT_TYPE_DATE_iphonesimulator = ENABLE_INPUT_TYPE_DATE;
-ENABLE_INPUT_TYPE_DATETIME = $(ENABLE_INPUT_TYPE_DATETIME_$(REAL_PLATFORM_NAME));
+ENABLE_INPUT_TYPE_DATE_iphonesimulator = $(ENABLE_INPUT_TYPE_DATE_iphoneos);
+ENABLE_INPUT_TYPE_DATETIME = $(ENABLE_INPUT_TYPE_DATETIME_$(PLATFORM_NAME));
 ENABLE_INPUT_TYPE_DATETIME_iphoneos = ENABLE_INPUT_TYPE_DATETIME;
-ENABLE_INPUT_TYPE_DATETIME_iphonesimulator = ENABLE_INPUT_TYPE_DATETIME;
-ENABLE_INPUT_TYPE_DATETIMELOCAL = $(ENABLE_INPUT_TYPE_DATETIMELOCAL_$(REAL_PLATFORM_NAME));
+ENABLE_INPUT_TYPE_DATETIME_iphonesimulator = $(ENABLE_INPUT_TYPE_DATETIME_iphoneos);
+ENABLE_INPUT_TYPE_DATETIMELOCAL = $(ENABLE_INPUT_TYPE_DATETIMELOCAL_$(PLATFORM_NAME));
 ENABLE_INPUT_TYPE_DATETIMELOCAL_iphoneos = ENABLE_INPUT_TYPE_DATETIMELOCAL;
-ENABLE_INPUT_TYPE_DATETIMELOCAL_iphonesimulator = ENABLE_INPUT_TYPE_DATETIMELOCAL;
-ENABLE_INPUT_TYPE_MONTH = $(ENABLE_INPUT_TYPE_MONTH_$(REAL_PLATFORM_NAME));
+ENABLE_INPUT_TYPE_DATETIMELOCAL_iphonesimulator = $(ENABLE_INPUT_TYPE_DATETIMELOCAL_iphoneos);
+ENABLE_INPUT_TYPE_MONTH = $(ENABLE_INPUT_TYPE_MONTH_$(PLATFORM_NAME));
 ENABLE_INPUT_TYPE_MONTH_iphoneos = ENABLE_INPUT_TYPE_MONTH;
-ENABLE_INPUT_TYPE_MONTH_iphonesimulator = ENABLE_INPUT_TYPE_MONTH;
-ENABLE_INPUT_TYPE_TIME = $(ENABLE_INPUT_TYPE_TIME_$(REAL_PLATFORM_NAME));
+ENABLE_INPUT_TYPE_MONTH_iphonesimulator = $(ENABLE_INPUT_TYPE_MONTH_iphoneos);
+ENABLE_INPUT_TYPE_TIME = $(ENABLE_INPUT_TYPE_TIME_$(PLATFORM_NAME));
 ENABLE_INPUT_TYPE_TIME_iphoneos = ENABLE_INPUT_TYPE_TIME;
-ENABLE_INPUT_TYPE_TIME_iphonesimulator = ENABLE_INPUT_TYPE_TIME;
-ENABLE_INPUT_TYPE_WEEK = $(ENABLE_INPUT_TYPE_WEEK_$(REAL_PLATFORM_NAME));
+ENABLE_INPUT_TYPE_TIME_iphonesimulator = $(ENABLE_INPUT_TYPE_TIME_iphoneos);
+ENABLE_INPUT_TYPE_WEEK = $(ENABLE_INPUT_TYPE_WEEK_$(PLATFORM_NAME));
 ENABLE_INPUT_TYPE_WEEK_iphoneos = ENABLE_INPUT_TYPE_WEEK;
-ENABLE_INPUT_TYPE_WEEK_iphonesimulator = ENABLE_INPUT_TYPE_WEEK;
+ENABLE_INPUT_TYPE_WEEK_iphonesimulator = $(ENABLE_INPUT_TYPE_WEEK_iphoneos);
 ENABLE_JAVASCRIPT_DEBUGGER = ENABLE_JAVASCRIPT_DEBUGGER;
 ENABLE_LEGACY_CSS_VENDOR_PREFIXES = ENABLE_LEGACY_CSS_VENDOR_PREFIXES;
-ENABLE_LEGACY_NOTIFICATIONS = $(ENABLE_LEGACY_NOTIFICATIONS_$(REAL_PLATFORM_NAME));
+ENABLE_LEGACY_NOTIFICATIONS = $(ENABLE_LEGACY_NOTIFICATIONS_$(PLATFORM_NAME));
 ENABLE_LEGACY_NOTIFICATIONS_macosx = $(ENABLE_LEGACY_NOTIFICATIONS_macosx_$(TARGET_MAC_OS_X_VERSION_MAJOR));
 ENABLE_LEGACY_NOTIFICATIONS_macosx_1070 = ;
 ENABLE_LEGACY_NOTIFICATIONS_macosx_1080 = ENABLE_LEGACY_NOTIFICATIONS;
@@ -112,36 +117,44 @@ ENABLE_MHTML = ;
 ENABLE_MICRODATA = ;
 ENABLE_MUTATION_OBSERVERS = ENABLE_MUTATION_OBSERVERS;
 ENABLE_NAVIGATOR_CONTENT_UTILS = ;
-ENABLE_NOTIFICATIONS = $(ENABLE_NOTIFICATIONS_$(REAL_PLATFORM_NAME));
+ENABLE_NOTIFICATIONS = $(ENABLE_NOTIFICATIONS_$(PLATFORM_NAME));
 ENABLE_NOTIFICATIONS_macosx = $(ENABLE_NOTIFICATIONS_macosx_$(TARGET_MAC_OS_X_VERSION_MAJOR));
 ENABLE_NOTIFICATIONS_macosx_1070 = ;
 ENABLE_NOTIFICATIONS_macosx_1080 = ENABLE_NOTIFICATIONS;
 ENABLE_NOTIFICATIONS_macosx_1090 = ENABLE_NOTIFICATIONS;
 ENABLE_PAGE_VISIBILITY_API = ;
+ENABLE_PDFKIT_PLUGIN = $(ENABLE_PDFKIT_PLUGIN_$(PLATFORM_NAME));
+ENABLE_PDFKIT_PLUGIN_macosx = $(ENABLE_PDFKIT_PLUGIN_macosx_$(TARGET_MAC_OS_X_VERSION_MAJOR));
+ENABLE_PDFKIT_PLUGIN_macosx_1070 = ;
+ENABLE_PDFKIT_PLUGIN_macosx_1080 = ;
+ENABLE_PDFKIT_PLUGIN_macosx_1090 = ENABLE_PDFKIT_PLUGIN;
 ENABLE_PROGRESS_ELEMENT = ENABLE_PROGRESS_ELEMENT;
 ENABLE_QUOTA = ;
 ENABLE_REQUEST_ANIMATION_FRAME = ENABLE_REQUEST_ANIMATION_FRAME;
+ENABLE_RESOLUTION_MEDIA_QUERY = ;
 ENABLE_SCRIPTED_SPEECH = ;
 ENABLE_SHADOW_DOM = ;
 ENABLE_SHARED_WORKERS = ENABLE_SHARED_WORKERS;
 ENABLE_SQL_DATABASE = ENABLE_SQL_DATABASE;
 ENABLE_STYLE_SCOPED = ;
+ENABLE_SUBPIXEL_LAYOUT = ENABLE_SUBPIXEL_LAYOUT;
 ENABLE_SVG = ENABLE_SVG;
-ENABLE_SVG_DOM_OBJC_BINDINGS = $(ENABLE_SVG_DOM_OBJC_BINDINGS_$(REAL_PLATFORM_NAME));
+ENABLE_SVG_DOM_OBJC_BINDINGS = $(ENABLE_SVG_DOM_OBJC_BINDINGS_$(PLATFORM_NAME));
 ENABLE_SVG_DOM_OBJC_BINDINGS_macosx = ENABLE_SVG_DOM_OBJC_BINDINGS;
 ENABLE_SVG_FONTS = ENABLE_SVG_FONTS;
 ENABLE_TEXT_AUTOSIZING = ;
 ENABLE_TEXT_NOTIFICATIONS_ONLY = ENABLE_TEXT_NOTIFICATIONS_ONLY;
 ENABLE_TOUCH_ICON_LOADING = ;
-ENABLE_UNDO_MANAGER = ;
+ENABLE_USERSELECT_ALL = ENABLE_USERSELECT_ALL;
 ENABLE_VIDEO = ENABLE_VIDEO;
-ENABLE_VIDEO_TRACK = $(ENABLE_VIDEO_TRACK_$(REAL_PLATFORM_NAME));
+ENABLE_VIDEO_TRACK = $(ENABLE_VIDEO_TRACK_$(PLATFORM_NAME));
 ENABLE_VIDEO_TRACK_macosx = ENABLE_VIDEO_TRACK;
 ENABLE_WEBGL = ENABLE_WEBGL;
 ENABLE_WEB_AUDIO = ENABLE_WEB_AUDIO;
 ENABLE_WEB_SOCKETS = ENABLE_WEB_SOCKETS;
 ENABLE_WEB_TIMING = ;
 ENABLE_WORKERS = ENABLE_WORKERS;
+ENABLE_XHR_TIMEOUT = ENABLE_XHR_TIMEOUT;
 ENABLE_XSLT = ENABLE_XSLT;
 
-FEATURE_DEFINES = $(ENABLE_3D_RENDERING) $(ENABLE_ACCELERATED_2D_CANVAS) $(ENABLE_ANIMATION_API) $(ENABLE_BLOB) $(ENABLE_CHANNEL_MESSAGING) $(ENABLE_CSP_NEXT) $(ENABLE_CSS_BOX_DECORATION_BREAK) $(ENABLE_CSS_EXCLUSIONS) $(ENABLE_CSS_FILTERS) $(ENABLE_CSS_HIERARCHIES) $(ENABLE_CSS_IMAGE_ORIENTATION) $(ENABLE_CSS_IMAGE_RESOLUTION) $(ENABLE_CSS_REGIONS) $(ENABLE_CSS_SHADERS) $(ENABLE_CSS_COMPOSITING) $(ENABLE_CSS_STICKY_POSITION) $(ENABLE_CSS_VARIABLES) $(ENABLE_CSS3_CONDITIONAL_RULES) $(ENABLE_CSS3_TEXT) $(ENABLE_CUSTOM_SCHEME_HANDLER) $(ENABLE_DASHBOARD_SUPPORT) $(ENABLE_DATALIST_ELEMENT) $(ENABLE_DATA_TRANSFER_ITEMS) $(ENABLE_DETAILS_ELEMENT) $(ENABLE_DEVICE_ORIENTATION) $(ENABLE_DIALOG_ELEMENT) $(ENABLE_DIRECTORY_UPLOAD) $(ENABLE_DRAGGABLE_REGION) $(ENABLE_FILE_SYSTEM) $(ENABLE_FILTERS) $(ENABLE_FULLSCREEN_API) $(ENABLE_GAMEPAD) $(ENABLE_GEOLOCATION) $(ENABLE_HIDDEN_PAGE_DOM_TIMER_THROTTLING) $(ENABLE_HIGH_DPI_CANVAS) $(ENABLE_ICONDATABASE) $(ENABLE_IFRAME_SEAMLESS) $(ENABLE_INDEXED_DATABASE) $(ENABLE_INPUT_SPEECH) $(ENABLE_INPUT_TYPE_COLOR) $(ENABLE_INPUT_TYPE_DATE) $(ENABLE_INPUT_TYPE_DATETIME) $(ENABLE_INPUT_TYPE_DATETIMELOCAL) $(ENABLE_INPUT_TYPE_MONTH) $(ENABLE_INPUT_TYPE_TIME) $(ENABLE_INPUT_TYPE_WEEK) $(ENABLE_JAVASCRIPT_DEBUGGER) $(ENABLE_LEGACY_CSS_VENDOR_PREFIXES) $(ENABLE_LEGACY_NOTIFICATIONS) $(ENABLE_LEGACY_VENDOR_PREFIXES) $(ENABLE_LEGACY_WEB_AUDIO) $(ENABLE_LINK_PREFETCH) $(ENABLE_LINK_PRERENDER) $(ENABLE_MATHML) $(ENABLE_MEDIA_SOURCE) $(ENABLE_MEDIA_STATISTICS) $(ENABLE_METER_ELEMENT) $(ENABLE_MHTML) $(ENABLE_MICRODATA) $(ENABLE_MUTATION_OBSERVERS) $(ENABLE_NAVIGATOR_CONTENT_UTILS) $(ENABLE_NOTIFICATIONS) $(ENABLE_PAGE_VISIBILITY_API) $(ENABLE_PROGRESS_ELEMENT) $(ENABLE_QUOTA) $(ENABLE_REQUEST_ANIMATION_FRAME) $(ENABLE_SCRIPTED_SPEECH) $(ENABLE_SHADOW_DOM) $(ENABLE_SHARED_WORKERS) $(ENABLE_SQL_DATABASE) $(ENABLE_STYLE_SCOPED) $(ENABLE_SVG) $(ENABLE_SVG_DOM_OBJC_BINDINGS) $(ENABLE_SVG_FONTS) $(ENABLE_TEXT_AUTOSIZING) $(ENABLE_TEXT_NOTIFICATIONS_ONLY) $(ENABLE_TOUCH_ICON_LOADING) $(ENABLE_UNDO_MANAGER) $(ENABLE_VIDEO) $(ENABLE_VIDEO_TRACK) $(ENABLE_WEBGL) $(ENABLE_WEB_AUDIO) $(ENABLE_WEB_SOCKETS) $(ENABLE_WEB_TIMING) $(ENABLE_WORKERS) $(ENABLE_XSLT);
+FEATURE_DEFINES = $(ENABLE_3D_RENDERING) $(ENABLE_ACCELERATED_2D_CANVAS) $(ENABLE_ANIMATION_API) $(ENABLE_BLOB) $(ENABLE_CHANNEL_MESSAGING) $(ENABLE_CSP_NEXT) $(ENABLE_CSS_BOX_DECORATION_BREAK) $(ENABLE_CSS_DEVICE_ADAPTATION) $(ENABLE_CSS_EXCLUSIONS) $(ENABLE_CSS_FILTERS) $(ENABLE_CSS_HIERARCHIES) $(ENABLE_CSS_IMAGE_ORIENTATION) $(ENABLE_CSS_IMAGE_RESOLUTION) $(ENABLE_CSS_REGIONS) $(ENABLE_CSS_SHADERS) $(ENABLE_CSS_COMPOSITING) $(ENABLE_CSS_STICKY_POSITION) $(ENABLE_CSS_VARIABLES) $(ENABLE_CSS3_CONDITIONAL_RULES) $(ENABLE_CSS3_TEXT) $(ENABLE_CUSTOM_SCHEME_HANDLER) $(ENABLE_DASHBOARD_SUPPORT) $(ENABLE_DATALIST_ELEMENT) $(ENABLE_DATA_TRANSFER_ITEMS) $(ENABLE_DETAILS_ELEMENT) $(ENABLE_DEVICE_ORIENTATION) $(ENABLE_DIALOG_ELEMENT) $(ENABLE_DIRECTORY_UPLOAD) $(ENABLE_DRAGGABLE_REGION) $(ENABLE_ENCRYPTED_MEDIA) $(ENABLE_FILE_SYSTEM) $(ENABLE_FILTERS) $(ENABLE_FULLSCREEN_API) $(ENABLE_GAMEPAD) $(ENABLE_GEOLOCATION) $(ENABLE_HIDDEN_PAGE_DOM_TIMER_THROTTLING) $(ENABLE_HIGH_DPI_CANVAS) $(ENABLE_ICONDATABASE) $(ENABLE_IFRAME_SEAMLESS) $(ENABLE_INDEXED_DATABASE) $(ENABLE_INPUT_SPEECH) $(ENABLE_INPUT_TYPE_COLOR) $(ENABLE_INPUT_TYPE_DATE) $(ENABLE_INPUT_TYPE_DATETIME) $(ENABLE_INPUT_TYPE_DATETIMELOCAL) $(ENABLE_INPUT_TYPE_MONTH) $(ENABLE_INPUT_TYPE_TIME) $(ENABLE_INPUT_TYPE_WEEK) $(ENABLE_JAVASCRIPT_DEBUGGER) $(ENABLE_LEGACY_CSS_VENDOR_PREFIXES) $(ENABLE_LEGACY_NOTIFICATIONS) $(ENABLE_LEGACY_VENDOR_PREFIXES) $(ENABLE_LEGACY_WEB_AUDIO) $(ENABLE_LINK_PREFETCH) $(ENABLE_LINK_PRERENDER) $(ENABLE_MATHML) $(ENABLE_MEDIA_SOURCE) $(ENABLE_MEDIA_STATISTICS) $(ENABLE_METER_ELEMENT) $(ENABLE_MHTML) $(ENABLE_MICRODATA) $(ENABLE_MUTATION_OBSERVERS) $(ENABLE_NAVIGATOR_CONTENT_UTILS) $(ENABLE_NOTIFICATIONS) $(ENABLE_PAGE_VISIBILITY_API) $(ENABLE_PDFKIT_PLUGIN) $(ENABLE_PROGRESS_ELEMENT) $(ENABLE_QUOTA) $(ENABLE_REQUEST_ANIMATION_FRAME) $(ENABLE_RESOLUTION_MEDIA_QUERY) $(ENABLE_SCRIPTED_SPEECH) $(ENABLE_SHADOW_DOM) $(ENABLE_SHARED_WORKERS) $(ENABLE_SQL_DATABASE) $(ENABLE_STYLE_SCOPED) $(ENABLE_SUBPIXEL_LAYOUT) $(ENABLE_SVG) $(ENABLE_SVG_DOM_OBJC_BINDINGS) $(ENABLE_SVG_FONTS) $(ENABLE_TEXT_AUTOSIZING) $(ENABLE_TEXT_NOTIFICATIONS_ONLY) $(ENABLE_TOUCH_ICON_LOADING) $(ENABLE_USERSELECT_ALL) $(ENABLE_VIDEO) $(ENABLE_VIDEO_TRACK) $(ENABLE_WEBGL) $(ENABLE_WEB_AUDIO) $(ENABLE_WEB_SOCKETS) $(ENABLE_WEB_TIMING) $(ENABLE_WORKERS) $(ENABLE_XHR_TIMEOUT) $(ENABLE_XSLT);
diff --git a/Source/WebKit/mac/Configurations/Version.xcconfig b/Source/WebKit/mac/Configurations/Version.xcconfig
index 815ca99ce..6ab4112ae 100644
--- a/Source/WebKit/mac/Configurations/Version.xcconfig
+++ b/Source/WebKit/mac/Configurations/Version.xcconfig
@@ -22,7 +22,7 @@
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 
 MAJOR_VERSION = 537;
-MINOR_VERSION = 16;
+MINOR_VERSION = 18;
 TINY_VERSION = 0;
 FULL_VERSION = $(MAJOR_VERSION).$(MINOR_VERSION);
 
@@ -31,12 +31,10 @@ BUNDLE_VERSION = $(BUNDLE_VERSION_$(CONFIGURATION));
 SHORT_VERSION_STRING = $(SHORT_VERSION_STRING_$(CONFIGURATION))
 
 // The system version prefix is based on the current system version.
-SYSTEM_VERSION_PREFIX = $(SYSTEM_VERSION_PREFIX_$(REAL_PLATFORM_NAME));
+SYSTEM_VERSION_PREFIX = $(SYSTEM_VERSION_PREFIX_$(PLATFORM_NAME));
 SYSTEM_VERSION_PREFIX_iphoneos = 6; // iPhone OS is most like SnowLeopard currently.
 SYSTEM_VERSION_PREFIX_iphonesimulator = $(SYSTEM_VERSION_PREFIX_iphoneos);
 SYSTEM_VERSION_PREFIX_macosx = $(SYSTEM_VERSION_PREFIX_macosx_$(TARGET_MAC_OS_X_VERSION_MAJOR));
-SYSTEM_VERSION_PREFIX_macosx_1050 = 5;
-SYSTEM_VERSION_PREFIX_macosx_1060 = 6;
 SYSTEM_VERSION_PREFIX_macosx_1070 = 7;
 SYSTEM_VERSION_PREFIX_macosx_1080 = 8;
 SYSTEM_VERSION_PREFIX_macosx_1090 = 9;
diff --git a/Source/WebKit/mac/Configurations/WebKit.xcconfig b/Source/WebKit/mac/Configurations/WebKit.xcconfig
index 2b3141e83..fd8573bbd 100644
--- a/Source/WebKit/mac/Configurations/WebKit.xcconfig
+++ b/Source/WebKit/mac/Configurations/WebKit.xcconfig
@@ -24,7 +24,7 @@
 #include "FeatureDefines.xcconfig"
 #include "Version.xcconfig"
 
-EXCLUDED_SOURCE_FILE_NAMES = $(EXCLUDED_SOURCE_FILE_NAMES_$(REAL_PLATFORM_NAME));
+EXCLUDED_SOURCE_FILE_NAMES = $(EXCLUDED_SOURCE_FILE_NAMES_$(PLATFORM_NAME));
 EXCLUDED_SOURCE_FILE_NAMES_iphoneos = *.nib *.tiff;
 EXCLUDED_SOURCE_FILE_NAMES_iphonesimulator = $(EXCLUDED_SOURCE_FILE_NAMES_iphoneos);
 
@@ -34,10 +34,9 @@ EXPORTED_SYMBOLS_FILE_armv6 = $(BUILT_PRODUCTS_DIR)/DerivedSources/WebKit/WebKit
 EXPORTED_SYMBOLS_FILE_armv7 = $(BUILT_PRODUCTS_DIR)/DerivedSources/WebKit/WebKit.generated.exp;
 EXPORTED_SYMBOLS_FILE_i386 = mac/WebKit.exp;
 EXPORTED_SYMBOLS_FILE_ppc = mac/WebKit.exp;
-EXPORTED_SYMBOLS_FILE_ppc64 = $(BUILT_PRODUCTS_DIR)/DerivedSources/WebKit/WebKit.LP64.exp;
 EXPORTED_SYMBOLS_FILE_x86_64 = $(BUILT_PRODUCTS_DIR)/DerivedSources/WebKit/WebKit.LP64.exp;
 
-FRAMEWORK_SEARCH_PATHS = $(FRAMEWORK_SEARCH_PATHS_$(REAL_PLATFORM_NAME));
+FRAMEWORK_SEARCH_PATHS = $(FRAMEWORK_SEARCH_PATHS_$(PLATFORM_NAME));
 FRAMEWORK_SEARCH_PATHS_iphoneos = $(FRAMEWORK_SEARCH_PATHS_iphoneos_$(CONFIGURATION));
 FRAMEWORK_SEARCH_PATHS_iphoneos_Debug = $(BUILT_PRODUCTS_DIR) $(PRODUCTION_FRAMEWORKS_DIR);
 FRAMEWORK_SEARCH_PATHS_iphoneos_Release = $(FRAMEWORK_SEARCH_PATHS_iphoneos_Debug);
@@ -52,13 +51,13 @@ GCC_PREFIX_HEADER = mac/WebKitPrefix.h;
 GCC_PREPROCESSOR_DEFINITIONS = $(DEBUG_DEFINES) $(FEATURE_DEFINES) FRAMEWORK_NAME=WebKit WEBKIT_VERSION_MIN_REQUIRED=WEBKIT_VERSION_LATEST $(GCC_PREPROCESSOR_DEFINITIONS);
 HEADER_SEARCH_PATHS = $(WEBKITSYSTEMINTERFACE_STATIC_LIBRARY_HEADERS_FOLDER_PATH) $(WEBCORE_PRIVATE_HEADERS_DIR)/ForwardingHeaders $(WEBCORE_PRIVATE_HEADERS_DIR)/icu "${BUILT_PRODUCTS_DIR}/DerivedSources/WebKit" $(HEADER_SEARCH_PATHS);
 INFOPLIST_FILE = mac/Info.plist;
-INSTALL_PATH = $(INSTALL_PATH_$(REAL_PLATFORM_NAME));
+INSTALL_PATH = $(INSTALL_PATH_$(PLATFORM_NAME));
 INSTALL_PATH_iphoneos = $(SYSTEM_LIBRARY_DIR)/PrivateFrameworks;
 INSTALL_PATH_iphonesimulator = $(INDIGO_INSTALL_PATH_PREFIX)$(INSTALL_PATH_ACTUAL);
 INSTALL_PATH_macosx = $(WEBKIT_FRAMEWORKS_DIR);
-INSTALL_PATH_ACTUAL = $(INSTALL_PATH_ACTUAL_$(REAL_PLATFORM_NAME));
+INSTALL_PATH_ACTUAL = $(INSTALL_PATH_ACTUAL_$(PLATFORM_NAME));
 INSTALL_PATH_ACTUAL_iphonesimulator = $(INSTALL_PATH_iphoneos);
-DYLIB_INSTALL_NAME_BASE = $(DYLIB_INSTALL_NAME_BASE_$(REAL_PLATFORM_NAME));
+DYLIB_INSTALL_NAME_BASE = $(DYLIB_INSTALL_NAME_BASE_$(PLATFORM_NAME));
 DYLIB_INSTALL_NAME_BASE_macosx = $(NORMAL_WEBKIT_FRAMEWORKS_DIR);
 DYLIB_INSTALL_NAME_BASE_iphoneos = $(SYSTEM_LIBRARY_DIR)/PrivateFrameworks;
 DYLIB_INSTALL_NAME_BASE_iphonesimulator =  $(SDKROOT)$(DYLIB_INSTALL_NAME_BASE_iphoneos);
@@ -68,20 +67,17 @@ PRODUCT_NAME = WebKit;
 UMBRELLA_FRAMEWORKS_DIR = $(PRODUCTION_FRAMEWORKS_DIR)/WebKit.framework/Versions/A/Frameworks;
 
 OTHER_LDFLAGS_BASE = -licucore -framework JavaScriptCore -framework QuartzCore -framework WebCore;
-OTHER_LDFLAGS = $(OTHER_LDFLAGS_BASE) $(OTHER_LDFLAGS_$(REAL_PLATFORM_NAME));
+OTHER_LDFLAGS = $(OTHER_LDFLAGS_BASE) $(OTHER_LDFLAGS_$(PLATFORM_NAME));
 OTHER_LDFLAGS_iphoneos = -lobjc -framework CFNetwork -framework CoreFoundation -framework CoreGraphics -framework CoreText -framework Foundation -framework GraphicsServices -framework ImageIO;
 OTHER_LDFLAGS_iphonesimulator = $(OTHER_LDFLAGS_iphoneos);
-OTHER_LDFLAGS_macosx = -sub_umbrella WebCore -framework Carbon -framework Cocoa -framework DiskArbitration -framework IOKit -framework OpenGL -framework Security $(OTHER_LDFLAGS_macosx_$(TARGET_MAC_OS_X_VERSION_MAJOR));
-OTHER_LDFLAGS_macosx_1070 = -Xlinker -objc_gc_compaction;
-OTHER_LDFLAGS_macosx_1080 = $(OTHER_LDFLAGS_macosx_1070);
-OTHER_LDFLAGS_macosx_1090 = $(OTHER_LDFLAGS_macosx_1070);
+OTHER_LDFLAGS_macosx = -sub_umbrella WebCore -framework Carbon -framework Cocoa -framework DiskArbitration -framework IOKit -framework OpenGL -framework Security;
 
-NORMAL_WEBKIT_FRAMEWORKS_DIR = $(NORMAL_WEBKIT_FRAMEWORKS_DIR_$(REAL_PLATFORM_NAME));
+NORMAL_WEBKIT_FRAMEWORKS_DIR = $(NORMAL_WEBKIT_FRAMEWORKS_DIR_$(PLATFORM_NAME));
 NORMAL_WEBKIT_FRAMEWORKS_DIR_iphoneos = $(PRODUCTION_FRAMEWORKS_DIR);
 NORMAL_WEBKIT_FRAMEWORKS_DIR_iphonesimulator = $(PRODUCTION_FRAMEWORKS_DIR);
 NORMAL_WEBKIT_FRAMEWORKS_DIR_macosx = $(SYSTEM_LIBRARY_DIR)/Frameworks;
 
-WEBKIT_FRAMEWORKS_DIR = $(WEBKIT_FRAMEWORKS_DIR_$(REAL_PLATFORM_NAME));
+WEBKIT_FRAMEWORKS_DIR = $(WEBKIT_FRAMEWORKS_DIR_$(PLATFORM_NAME));
 WEBKIT_FRAMEWORKS_DIR_iphoneos = $(NORMAL_WEBKIT_FRAMEWORKS_DIR_iphoneos);
 WEBKIT_FRAMEWORKS_DIR_iphonesimulator = $(WEBKIT_FRAMEWORKS_DIR_iphoneos);
 WEBKIT_FRAMEWORKS_DIR_macosx = $(WEBKIT_FRAMEWORKS_DIR_macosx_USE_STAGING_INSTALL_PATH_$(USE_STAGING_INSTALL_PATH));
@@ -89,12 +85,12 @@ WEBKIT_FRAMEWORKS_DIR_macosx_USE_STAGING_INSTALL_PATH_ = $(WEBKIT_FRAMEWORKS_DIR
 WEBKIT_FRAMEWORKS_DIR_macosx_USE_STAGING_INSTALL_PATH_NO = $(NORMAL_WEBKIT_FRAMEWORKS_DIR);
 WEBKIT_FRAMEWORKS_DIR_macosx_USE_STAGING_INSTALL_PATH_YES = $(SYSTEM_LIBRARY_DIR)/StagedFrameworks/Safari;
 
-NORMAL_PRODUCTION_FRAMEWORKS_DIR = $(NORMAL_PRODUCTION_FRAMEWORKS_DIR_$(REAL_PLATFORM_NAME));
+NORMAL_PRODUCTION_FRAMEWORKS_DIR = $(NORMAL_PRODUCTION_FRAMEWORKS_DIR_$(PLATFORM_NAME));
 NORMAL_PRODUCTION_FRAMEWORKS_DIR_iphoneos = $(SDKROOT)$(SYSTEM_LIBRARY_DIR)/PrivateFrameworks;
 NORMAL_PRODUCTION_FRAMEWORKS_DIR_iphonesimulator = $(NORMAL_PRODUCTION_FRAMEWORKS_DIR_iphoneos);
 NORMAL_PRODUCTION_FRAMEWORKS_DIR_macosx = $(NEXT_ROOT)$(SYSTEM_LIBRARY_DIR)/Frameworks;
 
-PRODUCTION_FRAMEWORKS_DIR = $(PRODUCTION_FRAMEWORKS_DIR_$(REAL_PLATFORM_NAME));
+PRODUCTION_FRAMEWORKS_DIR = $(PRODUCTION_FRAMEWORKS_DIR_$(PLATFORM_NAME));
 PRODUCTION_FRAMEWORKS_DIR_iphoneos = $(NORMAL_PRODUCTION_FRAMEWORKS_DIR_iphoneos);
 PRODUCTION_FRAMEWORKS_DIR_iphonesimulator = $(PRODUCTION_FRAMEWORKS_DIR_iphoneos);
 PRODUCTION_FRAMEWORKS_DIR_macosx = $(PRODUCTION_FRAMEWORKS_DIR_macosx_USE_STAGING_INSTALL_PATH_$(USE_STAGING_INSTALL_PATH));
@@ -111,7 +107,7 @@ PRODUCTION_ROOT_macosx = $(NEXT_ROOT);
 WEBCORE_PRIVATE_HEADERS_DIR = $(WEBCORE_PRIVATE_HEADERS_DIR_$(CONFIGURATION));
 WEBCORE_PRIVATE_HEADERS_DIR_Release = $(WEBCORE_PRIVATE_HEADERS_engineering);
 WEBCORE_PRIVATE_HEADERS_DIR_Debug = $(WEBCORE_PRIVATE_HEADERS_engineering);
-WEBCORE_PRIVATE_HEADERS_DIR_Production = $(WEBCORE_PRIVATE_HEADERS_DIR_Production_$(REAL_PLATFORM_NAME));
+WEBCORE_PRIVATE_HEADERS_DIR_Production = $(WEBCORE_PRIVATE_HEADERS_DIR_Production_$(PLATFORM_NAME));
 WEBCORE_PRIVATE_HEADERS_DIR_Production_iphoneos = $(PRODUCTION_FRAMEWORKS_DIR)/WebCore.framework/PrivateHeaders;
 WEBCORE_PRIVATE_HEADERS_DIR_Production_iphonesimulator = $(WEBCORE_PRIVATE_HEADERS_DIR_Production_iphoneos);
 WEBCORE_PRIVATE_HEADERS_DIR_Production_macosx = $(WEBCORE_PRIVATE_HEADERS_DIR_Production_macosx_USE_STAGING_INSTALL_PATH_$(USE_STAGING_INSTALL_PATH));
@@ -124,7 +120,7 @@ WEBKITSYSTEMINTERFACE_STATIC_LIBRARY_HEADERS_FOLDER_PATH = $(WEBKITSYSTEMINTERFA
 WEBKITSYSTEMINTERFACE_STATIC_LIBRARY_HEADERS_FOLDER_PATH_Debug = $(WEBKITSYSTEMINTERFACE_STATIC_LIBRARY_HEADERS_FOLDER_PATH_engineering);
 WEBKITSYSTEMINTERFACE_STATIC_LIBRARY_HEADERS_FOLDER_PATH_Release = $(WEBKITSYSTEMINTERFACE_STATIC_LIBRARY_HEADERS_FOLDER_PATH_engineering);
 WEBKITSYSTEMINTERFACE_STATIC_LIBRARY_HEADERS_FOLDER_PATH_Production = $(PRODUCTION_ROOT)/usr/local/include;
-WEBKITSYSTEMINTERFACE_STATIC_LIBRARY_HEADERS_FOLDER_PATH_engineering = $(WEBKITSYSTEMINTERFACE_STATIC_LIBRARY_HEADERS_FOLDER_PATH_engineering_$(REAL_PLATFORM_NAME));
+WEBKITSYSTEMINTERFACE_STATIC_LIBRARY_HEADERS_FOLDER_PATH_engineering = $(WEBKITSYSTEMINTERFACE_STATIC_LIBRARY_HEADERS_FOLDER_PATH_engineering_$(PLATFORM_NAME));
 WEBKITSYSTEMINTERFACE_STATIC_LIBRARY_HEADERS_FOLDER_PATH_engineering_iphoneos = $(BUILT_PRODUCTS_DIR)/usr/local/include;
 WEBKITSYSTEMINTERFACE_STATIC_LIBRARY_HEADERS_FOLDER_PATH_engineering_iphonesimulator = $(BUILT_PRODUCTS_DIR)$(PRODUCTION_ROOT_iphonesimulator)/usr/local/include;
 WEBKITSYSTEMINTERFACE_STATIC_LIBRARY_HEADERS_FOLDER_PATH_engineering_macosx = $(BUILT_PRODUCTS_DIR)/usr/local/include;
diff --git a/Source/WebKit/mac/History/WebBackForwardList.mm b/Source/WebKit/mac/History/WebBackForwardList.mm
index 64b1785ef..683b9a85d 100644
--- a/Source/WebKit/mac/History/WebBackForwardList.mm
+++ b/Source/WebKit/mac/History/WebBackForwardList.mm
@@ -282,7 +282,7 @@ static bool bumperCarBackForwardHackNeeded()
         [result appendString:[kit(entries[i].get()) description]];
 
         // shift all the contents over.  a bit slow, but this is for debugging
-        NSRange replRange = {currPos, [result length]-currPos};
+        NSRange replRange = { static_cast<NSUInteger>(currPos), [result length] - currPos };
         [result replaceOccurrencesOfString:@"\n" withString:@"\n        " options:0 range:replRange];
         
         [result appendString:@"\n"];
diff --git a/Source/WebKit/mac/History/WebHistoryItem.mm b/Source/WebKit/mac/History/WebHistoryItem.mm
index f2374bd3d..7c10c6ac4 100644
--- a/Source/WebKit/mac/History/WebHistoryItem.mm
+++ b/Source/WebKit/mac/History/WebHistoryItem.mm
@@ -232,7 +232,7 @@ void WKNotifyHistoryItemChanged(HistoryItem*)
             [result appendString:[child description]];
         }
         // shift all the contents over.  A bit slow, but hey, this is for debugging.
-        NSRange replRange = {currPos, [result length]-currPos};
+        NSRange replRange = { static_cast<NSUInteger>(currPos), [result length] - currPos };
         [result replaceOccurrencesOfString:@"\n" withString:@"\n    " options:0 range:replRange];
     }
     
diff --git a/Source/WebKit/mac/Panels/WebAuthenticationPanel.m b/Source/WebKit/mac/Panels/WebAuthenticationPanel.m
index f843f3208..3dada58f9 100644
--- a/Source/WebKit/mac/Panels/WebAuthenticationPanel.m
+++ b/Source/WebKit/mac/Panels/WebAuthenticationPanel.m
@@ -102,7 +102,10 @@
 - (BOOL)loadNib
 {
     if (!nibLoaded) {
+#pragma clang diagnostic push
+#pragma clang diagnostic ignored "-Wdeprecated-declarations"
         if ([NSBundle loadNibNamed:WebAuthenticationPanelNibName owner:self]) {
+#pragma clang diagnostic pop
             nibLoaded = YES;
             [imageView setImage:[NSImage imageNamed:@"NSApplicationIcon"]];
         } else {
diff --git a/Source/WebKit/mac/WebCoreSupport/WebChromeClient.mm b/Source/WebKit/mac/WebCoreSupport/WebChromeClient.mm
index 806d62d75..f0bcda529 100644
--- a/Source/WebKit/mac/WebCoreSupport/WebChromeClient.mm
+++ b/Source/WebKit/mac/WebCoreSupport/WebChromeClient.mm
@@ -31,6 +31,7 @@
 
 #import "DOMElementInternal.h"
 #import "DOMNodeInternal.h"
+#import "WebBasePluginPackage.h"
 #import "WebDefaultUIDelegate.h"
 #import "WebDelegateImplementationCaching.h"
 #import "WebElementDictionary.h"
@@ -63,6 +64,7 @@
 #import <WebCore/FrameLoadRequest.h>
 #import <WebCore/FrameView.h>
 #import <WebCore/HTMLNames.h>
+#import <WebCore/HTMLPlugInImageElement.h>
 #import <WebCore/HitTestResult.h>
 #import <WebCore/Icon.h>
 #import <WebCore/IntPoint.h>
@@ -97,6 +99,7 @@ NSString *WebConsoleMessageOtherMessageSource = @"OtherMessageSource";
 
 NSString *WebConsoleMessageLogMessageType = @"LogMessageType";
 NSString *WebConsoleMessageDirMessageType = @"DirMessageType";
+NSString *WebConsoleMessageClearMessageType = @"ClearMessageType";
 NSString *WebConsoleMessageDirXMLMessageType = @"DirXMLMessageType";
 NSString *WebConsoleMessageTraceMessageType = @"TraceMessageType";
 NSString *WebConsoleMessageStartGroupMessageType = @"StartGroupMessageType";
@@ -128,6 +131,7 @@ NSString *WebConsoleMessageDebugMessageLevel = @"DebugMessageLevel";
 @end
 
 using namespace WebCore;
+using namespace HTMLNames;
 
 WebChromeClient::WebChromeClient(WebView *webView) 
     : m_webView(webView)
@@ -357,6 +361,8 @@ inline static NSString *stringForMessageType(MessageType type)
     switch (type) {
     case LogMessageType:
         return WebConsoleMessageLogMessageType;
+    case ClearMessageType:
+        return WebConsoleMessageClearMessageType;
     case DirMessageType:
         return WebConsoleMessageDirMessageType;
     case DirXMLMessageType:
@@ -592,6 +598,9 @@ void WebChromeClient::scrollRectIntoView(const IntRect& r) const
 
 bool WebChromeClient::shouldUnavailablePluginMessageBeButton(RenderEmbeddedObject::PluginUnavailabilityReason pluginUnavailabilityReason) const
 {
+    if (pluginUnavailabilityReason == RenderEmbeddedObject::PluginInactive)
+        return true;
+
     if (pluginUnavailabilityReason == RenderEmbeddedObject::PluginMissing)
         return [[m_webView UIDelegate] respondsToSelector:@selector(webView:didPressMissingPluginButton:)];
 
@@ -600,7 +609,30 @@ bool WebChromeClient::shouldUnavailablePluginMessageBeButton(RenderEmbeddedObjec
 
 void WebChromeClient::unavailablePluginButtonClicked(Element* element, RenderEmbeddedObject::PluginUnavailabilityReason pluginUnavailabilityReason) const
 {
-    ASSERT_UNUSED(pluginUnavailabilityReason, pluginUnavailabilityReason == RenderEmbeddedObject::PluginMissing);
+    ASSERT(element->hasTagName(objectTag) || element->hasTagName(embedTag) || element->hasTagName(appletTag));
+
+    if (pluginUnavailabilityReason == RenderEmbeddedObject::PluginInactive) {
+        HTMLPlugInImageElement* pluginElement = static_cast<HTMLPlugInImageElement*>(element);
+
+        WebBasePluginPackage *pluginPackage = nil;
+        if (!pluginElement->serviceType().isEmpty())
+            pluginPackage = [m_webView _pluginForMIMEType:pluginElement->serviceType()];
+
+        NSURL *url = pluginElement->document()->completeURL(pluginElement->url());
+        NSString *extension = [[url path] pathExtension];
+        if (!pluginPackage && [extension length])
+            pluginPackage = [m_webView _pluginForExtension:extension];
+
+        if (pluginPackage && [pluginPackage bundleIdentifier] == "com.oracle.java.JavaAppletPlugin") {
+            // Reactivate the plug-in and reload the page so the plug-in will be instantiated correctly.
+            WKActivateJavaPlugIn();
+            [m_webView reload:nil];
+        }
+
+        return;
+    }
+
+    ASSERT(pluginUnavailabilityReason == RenderEmbeddedObject::PluginMissing || pluginUnavailabilityReason == RenderEmbeddedObject::PluginInactive);
     CallUIDelegate(m_webView, @selector(webView:didPressMissingPluginButton:), kit(element));
 }
 
diff --git a/Source/WebKit/mac/WebCoreSupport/WebFrameLoaderClient.mm b/Source/WebKit/mac/WebCoreSupport/WebFrameLoaderClient.mm
index 72dd7a974..62d565fb5 100644
--- a/Source/WebKit/mac/WebCoreSupport/WebFrameLoaderClient.mm
+++ b/Source/WebKit/mac/WebCoreSupport/WebFrameLoaderClient.mm
@@ -1596,6 +1596,19 @@ private:
 
 #endif // ENABLE(NETSCAPE_PLUGIN_API)
 
+static bool isOracleJavaPlugIn(NSString *bundleIdentifier)
+{
+    return [bundleIdentifier isEqualToString:@"com.oracle.java.JavaAppletPlugin"];
+}
+
+static bool isPlugInInactive(NSString *bundleIdentifier)
+{
+    if (isOracleJavaPlugIn(bundleIdentifier) && !WKIsJavaPlugInActive())
+        return true;
+
+    return false;
+}
+
 PassRefPtr<Widget> WebFrameLoaderClient::createPlugin(const IntSize& size, HTMLPlugInElement* element, const KURL& url,
     const Vector<String>& paramNames, const Vector<String>& paramValues, const String& mimeType, bool loadManually)
 {
@@ -1667,7 +1680,15 @@ PassRefPtr<Widget> WebFrameLoaderClient::createPlugin(const IntSize& size, HTMLP
     NSView *view = nil;
 
     if (pluginPackage) {
-        if (!WKShouldBlockPlugin([pluginPackage bundleIdentifier], [pluginPackage bundleVersion])) {
+        if (WKShouldBlockPlugin([pluginPackage bundleIdentifier], [pluginPackage bundleVersion])) {
+            errorCode = WebKitErrorBlockedPlugInVersion;
+            if (element->renderer()->isEmbeddedObject())
+                toRenderEmbeddedObject(element->renderer())->setPluginUnavailabilityReason(RenderEmbeddedObject::InsecurePluginVersion);
+        } else if (isPlugInInactive([pluginPackage bundleIdentifier])) {
+            if (element->renderer()->isEmbeddedObject())
+                toRenderEmbeddedObject(element->renderer())->setPluginUnavailabilityReason(RenderEmbeddedObject::PluginInactive);
+            return 0;
+        } else {
             if ([pluginPackage isKindOfClass:[WebPluginPackage class]])
                 view = pluginView(m_webFrame.get(), (WebPluginPackage *)pluginPackage, attributeKeys, kit(paramValues), baseURL, kit(element), loadManually);
 
@@ -1687,10 +1708,6 @@ PassRefPtr<Widget> WebFrameLoaderClient::createPlugin(const IntSize& size, HTMLP
                 return adoptRef(new NetscapePluginWidget(pluginView));
             }
 #endif
-        } else {
-            errorCode = WebKitErrorBlockedPlugInVersion;
-            if (element->renderer()->isEmbeddedObject())
-                toRenderEmbeddedObject(element->renderer())->setPluginUnavailabilityReason(RenderEmbeddedObject::InsecurePluginVersion);
         }
     } else
         errorCode = WebKitErrorCannotFindPlugIn;
@@ -1770,7 +1787,15 @@ PassRefPtr<Widget> WebFrameLoaderClient::createJavaAppletWidget(const IntSize& s
     int errorCode = WebKitErrorJavaUnavailable;
 
     if (pluginPackage) {
-        if (!WKShouldBlockPlugin([pluginPackage bundleIdentifier], [pluginPackage bundleVersion])) {
+        if (WKShouldBlockPlugin([pluginPackage bundleIdentifier], [pluginPackage bundleVersion])) {
+            errorCode = WebKitErrorBlockedPlugInVersion;
+            if (element->renderer()->isEmbeddedObject())
+                toRenderEmbeddedObject(element->renderer())->setPluginUnavailabilityReason(RenderEmbeddedObject::InsecurePluginVersion);
+        } else if (isPlugInInactive([pluginPackage bundleIdentifier])) {
+            if (element->renderer()->isEmbeddedObject())
+                toRenderEmbeddedObject(element->renderer())->setPluginUnavailabilityReason(RenderEmbeddedObject::PluginInactive);
+            return 0;
+        } else {
     #if ENABLE(NETSCAPE_PLUGIN_API)
             if ([pluginPackage isKindOfClass:[WebNetscapePluginPackage class]]) {
                 view = [[[NETSCAPE_PLUGIN_VIEW alloc] initWithFrame:NSMakeRect(0, 0, size.width(), size.height())
@@ -1786,10 +1811,6 @@ PassRefPtr<Widget> WebFrameLoaderClient::createJavaAppletWidget(const IntSize& s
                     return adoptRef(new NetscapePluginWidget(static_cast<WebBaseNetscapePluginView *>(view)));
             }
     #endif
-        } else {
-            errorCode = WebKitErrorBlockedPlugInVersion;
-            if (element->renderer()->isEmbeddedObject())
-                toRenderEmbeddedObject(element->renderer())->setPluginUnavailabilityReason(RenderEmbeddedObject::InsecurePluginVersion);
         }
     }
 
diff --git a/Source/WebKit/mac/WebCoreSupport/WebInspectorClient.mm b/Source/WebKit/mac/WebCoreSupport/WebInspectorClient.mm
index 97d331c34..f432cd51f 100644
--- a/Source/WebKit/mac/WebCoreSupport/WebInspectorClient.mm
+++ b/Source/WebKit/mac/WebCoreSupport/WebInspectorClient.mm
@@ -200,7 +200,13 @@ String WebInspectorFrontendClient::hiddenPanels()
 void WebInspectorFrontendClient::bringToFront()
 {
     updateWindowTitle();
+
     [m_windowController.get() showWindow:nil];
+
+    // Use the window from the WebView since m_windowController's window
+    // is not the same when the Inspector is docked.
+    WebView *webView = [m_windowController.get() webView];
+    [[webView window] makeFirstResponder:webView];
 }
 
 void WebInspectorFrontendClient::closeWindow()
diff --git a/Source/WebKit/mac/WebCoreSupport/WebPlatformStrategies.h b/Source/WebKit/mac/WebCoreSupport/WebPlatformStrategies.h
index 22fabfd90..7bcf4256b 100644
--- a/Source/WebKit/mac/WebCoreSupport/WebPlatformStrategies.h
+++ b/Source/WebKit/mac/WebCoreSupport/WebPlatformStrategies.h
@@ -27,12 +27,14 @@
 #define WebPlatformStrategies_h
 
 #include <WebCore/CookiesStrategy.h>
+#include <WebCore/LoaderStrategy.h>
 #include <WebCore/PasteboardStrategy.h>
 #include <WebCore/PlatformStrategies.h>
 #include <WebCore/PluginStrategy.h>
+#include <WebCore/SharedWorkerStrategy.h>
 #include <WebCore/VisitedLinkStrategy.h>
 
-class WebPlatformStrategies : public WebCore::PlatformStrategies, private WebCore::CookiesStrategy, private WebCore::PluginStrategy, private WebCore::VisitedLinkStrategy, private WebCore::PasteboardStrategy {
+class WebPlatformStrategies : public WebCore::PlatformStrategies, private WebCore::CookiesStrategy, private WebCore::LoaderStrategy, private WebCore::PasteboardStrategy, private WebCore::PluginStrategy, private WebCore::SharedWorkerStrategy, private WebCore::VisitedLinkStrategy {
 public:
     static void initialize();
     
@@ -41,9 +43,11 @@ private:
     
     // WebCore::PlatformStrategies
     virtual WebCore::CookiesStrategy* createCookiesStrategy() OVERRIDE;
+    virtual WebCore::LoaderStrategy* createLoaderStrategy() OVERRIDE;
+    virtual WebCore::PasteboardStrategy* createPasteboardStrategy() OVERRIDE;
     virtual WebCore::PluginStrategy* createPluginStrategy() OVERRIDE;
+    virtual WebCore::SharedWorkerStrategy* createSharedWorkerStrategy() OVERRIDE;
     virtual WebCore::VisitedLinkStrategy* createVisitedLinkStrategy() OVERRIDE;
-    virtual WebCore::PasteboardStrategy* createPasteboardStrategy() OVERRIDE;
 
     // WebCore::CookiesStrategy
     virtual void notifyCookiesChanged() OVERRIDE;
@@ -72,7 +76,6 @@ private:
     virtual void setBufferForType(PassRefPtr<WebCore::SharedBuffer>, const String& pasteboardType, const String& pasteboardName) OVERRIDE;
     virtual void setPathnamesForType(const Vector<String>&, const String& pasteboardType, const String& pasteboardName) OVERRIDE;
     virtual void setStringForType(const String&, const String& pasteboardType, const String& pasteboardName) OVERRIDE;
-    
 };
 
 #endif // WebPlatformStrategies_h
diff --git a/Source/WebKit/mac/WebCoreSupport/WebPlatformStrategies.mm b/Source/WebKit/mac/WebCoreSupport/WebPlatformStrategies.mm
index 6f6567ab0..79bdc45d7 100644
--- a/Source/WebKit/mac/WebCoreSupport/WebPlatformStrategies.mm
+++ b/Source/WebKit/mac/WebCoreSupport/WebPlatformStrategies.mm
@@ -50,17 +50,27 @@ CookiesStrategy* WebPlatformStrategies::createCookiesStrategy()
     return this;
 }
 
+LoaderStrategy* WebPlatformStrategies::createLoaderStrategy()
+{
+    return this;
+}
+
+PasteboardStrategy* WebPlatformStrategies::createPasteboardStrategy()
+{
+    return this;
+}
+
 PluginStrategy* WebPlatformStrategies::createPluginStrategy()
 {
     return this;
 }
 
-VisitedLinkStrategy* WebPlatformStrategies::createVisitedLinkStrategy()
+SharedWorkerStrategy* WebPlatformStrategies::createSharedWorkerStrategy()
 {
     return this;
 }
 
-PasteboardStrategy* WebPlatformStrategies::createPasteboardStrategy()
+VisitedLinkStrategy* WebPlatformStrategies::createVisitedLinkStrategy()
 {
     return this;
 }
diff --git a/Source/WebKit/mac/WebCoreSupport/WebSystemInterface.mm b/Source/WebKit/mac/WebCoreSupport/WebSystemInterface.mm
index a7dbd0cc0..a0318e359 100644
--- a/Source/WebKit/mac/WebCoreSupport/WebSystemInterface.mm
+++ b/Source/WebKit/mac/WebCoreSupport/WebSystemInterface.mm
@@ -93,7 +93,6 @@ void InitWebCoreSystemInterface(void)
     INIT(SetCGFontRenderingMode);
     INIT(SetCONNECTProxyAuthorizationForStream);
     INIT(SetCONNECTProxyForStream);
-    INIT(SetCookieStoragePrivateBrowsingEnabled);
     INIT(SetDragImage);
     INIT(SetHTTPPipeliningMaximumPriority);
     INIT(SetHTTPPipeliningPriority);
@@ -166,8 +165,14 @@ void InitWebCoreSystemInterface(void)
     INIT(CopyRequestWithStorageSession);
     INIT(CopyHTTPCookieStorage);
     INIT(GetHTTPCookieAcceptPolicy);
+#if PLATFORM(MAC)
+    INIT(HTTPCookies);
+#endif
     INIT(HTTPCookiesForURL);
     INIT(SetHTTPCookiesForURL);
+#if PLATFORM(MAC)
+    INIT(DeleteAllHTTPCookies);
+#endif
     INIT(DeleteHTTPCookie);
 
     INIT(GetCFURLResponseMIMEType);
@@ -211,6 +216,19 @@ void InitWebCoreSystemInterface(void)
     INIT(NSReboundDeltaForElasticDelta);
 #endif
 
+    INIT(CaptionAppearanceHasUserPreferences);
+    INIT(CaptionAppearanceShowCaptionsWhenAvailable);
+    INIT(CaptionAppearanceCopyForegroundColor);
+    INIT(CaptionAppearanceCopyBackgroundColor);
+    INIT(CaptionAppearanceCopyWindowColor);
+    INIT(CaptionAppearanceGetForegroundOpacity);
+    INIT(CaptionAppearanceGetBackgroundOpacity);
+    INIT(CaptionAppearanceGetWindowOpacity);
+    INIT(CaptionAppearanceCopyFontForStyle);
+    INIT(CaptionAppearanceGetRelativeCharacterSize);
+    INIT(CaptionAppearanceGetTextEdgeStyle);
+    INIT(CaptionAppearanceGetSettingsChangedNotification);
+
 #endif
     didInit = true;
 }
diff --git a/Source/WebKit/mac/WebView/WebDynamicScrollBarsView.mm b/Source/WebKit/mac/WebView/WebDynamicScrollBarsView.mm
index 839b54f67..03ed5f719 100644
--- a/Source/WebKit/mac/WebView/WebDynamicScrollBarsView.mm
+++ b/Source/WebKit/mac/WebView/WebDynamicScrollBarsView.mm
@@ -29,7 +29,6 @@
 #import "WebFrameInternal.h"
 #import "WebFrameView.h"
 #import "WebHTMLViewInternal.h"
-#import <WebCore/Frame.h>
 #import <WebCore/FrameView.h>
 #import <WebKitSystemInterface.h>
 
@@ -188,6 +187,36 @@ static Class customScrollerClass;
     return _private->verticalScrollingAllowedButScrollerHidden || [self hasVerticalScroller];
 }
 
+static BOOL shouldRoundScrollOrigin(WebDynamicScrollBarsView *view)
+{
+    NSView *documentView = [view documentView];
+    if (![documentView isKindOfClass:[WebHTMLView class]])
+        return NO;
+
+    Frame* frame = core([(WebHTMLView *)documentView _frame]);
+    if (!frame)
+        return NO;
+    
+    FrameView *frameView = frame->view();
+    if (!frameView)
+        return NO;
+
+    return frameView->hasViewportConstrainedObjects();
+}
+
+- (void)scrollClipView:(NSClipView *)clipView toPoint:(NSPoint)point
+{
+    if (shouldRoundScrollOrigin(self)) {
+        // WebCore isn't yet able to handle subpixel scrolling, as can happen on Retina displays. For
+        // now we'll round to the nearest pixel. Once subpixel layout is enabled in WebCore we may be
+        // able to remove this method entirely.
+        point.x = round(point.x);
+        point.y = round(point.y);
+    }
+
+    [super scrollClipView:clipView toPoint:point];
+}
+
 @end
 
 @implementation WebDynamicScrollBarsView (WebInternal)
diff --git a/Source/WebKit/mac/WebView/WebPreferences.mm b/Source/WebKit/mac/WebView/WebPreferences.mm
index 599dc5878..9fb305b6b 100644
--- a/Source/WebKit/mac/WebView/WebPreferences.mm
+++ b/Source/WebKit/mac/WebView/WebPreferences.mm
@@ -1285,21 +1285,17 @@ static NSString *classIBCreatorID = nil;
 
 + (void)_switchNetworkLoaderToNewTestingSession
 {
-#if USE(CFURLSTORAGESESSIONS)
     // Set a private session for testing to avoid interfering with global cookies. This should be different from private browsing session.
     RetainPtr<CFURLStorageSessionRef> session = ResourceHandle::createPrivateBrowsingStorageSession(CFSTR("WebKit Testing Session"));
     ResourceHandle::setDefaultStorageSession(session.get());
-#endif
 }
 
 + (void)_setCurrentNetworkLoaderSessionCookieAcceptPolicy:(NSHTTPCookieAcceptPolicy)policy
 {
     [[NSHTTPCookieStorage sharedHTTPCookieStorage] setCookieAcceptPolicy:policy];
 
-#if USE(CFURLSTORAGESESSIONS)
     if (RetainPtr<CFHTTPCookieStorageRef> cookieStorage = currentCFHTTPCookieStorage())
         WKSetHTTPCookieAcceptPolicy(cookieStorage.get(), policy);
-#endif
 }
 
 - (BOOL)isDOMPasteAllowed
diff --git a/Source/WebKit/mac/WebView/WebView.mm b/Source/WebKit/mac/WebView/WebView.mm
index dadf1533d..3ff7275c1 100644
--- a/Source/WebKit/mac/WebView/WebView.mm
+++ b/Source/WebKit/mac/WebView/WebView.mm
@@ -466,6 +466,8 @@ NSString *_WebMainFrameDocumentKey =    @"mainFrameDocument";
 
 NSString *_WebViewDidStartAcceleratedCompositingNotification = @"_WebViewDidStartAcceleratedCompositing";
 
+NSString *WebKitKerningAndLigaturesEnabledByDefaultDefaultsKey = @"WebKitKerningAndLigaturesEnabledByDefault";
+
 @interface WebProgressItem : NSObject
 {
 @public
@@ -1998,11 +2000,9 @@ static inline IMP getMethod(id o, SEL s)
     NSMutableURLRequest *request = [[NSMutableURLRequest alloc] initWithURL:URL];
     [request _web_setHTTPUserAgent:[self userAgentForURL:URL]];
     NSCachedURLResponse *cachedResponse;
-#if USE(CFURLSTORAGESESSIONS)
     if (CFURLStorageSessionRef storageSession = ResourceHandle::currentStorageSession())
         cachedResponse = WKCachedResponseForRequest(storageSession, request);
     else
-#endif
         cachedResponse = [[NSURLCache sharedURLCache] cachedResponseForRequest:request];
     [request release];
     return cachedResponse;
@@ -3027,6 +3027,7 @@ static Vector<String> toStringVector(NSArray* patterns)
 
 + (void)_setLoadResourcesSerially:(BOOL)serialize 
 {
+    WebPlatformStrategies::initialize();
     resourceLoadScheduler()->setSerialLoadingEnabled(serialize);
 }
 
@@ -3118,23 +3119,29 @@ static Vector<String> toStringVector(NSArray* patterns)
     [[NSNotificationCenter defaultCenter] addObserver:self selector:@selector(_cacheModelChangedNotification:) name:WebPreferencesCacheModelChangedInternalNotification object:nil];
     [[NSNotificationCenter defaultCenter] addObserver:self selector:@selector(_preferencesRemovedNotification:) name:WebPreferencesRemovedNotification object:nil];    
 
-    continuousSpellCheckingEnabled = [[NSUserDefaults standardUserDefaults] boolForKey:WebContinuousSpellCheckingEnabled];
-    grammarCheckingEnabled = [[NSUserDefaults standardUserDefaults] boolForKey:WebGrammarCheckingEnabled];
+    NSUserDefaults *defaults = [NSUserDefaults standardUserDefaults];
+
+#if __MAC_OS_X_VERSION_MIN_REQUIRED >= 1090
+    [defaults registerDefaults:[NSDictionary dictionaryWithObject:[NSNumber numberWithBool:YES] forKey:WebKitKerningAndLigaturesEnabledByDefaultDefaultsKey]];
+#endif
+
+    continuousSpellCheckingEnabled = [defaults boolForKey:WebContinuousSpellCheckingEnabled];
+    grammarCheckingEnabled = [defaults boolForKey:WebGrammarCheckingEnabled];
 
-    Font::setDefaultTypesettingFeatures([[NSUserDefaults standardUserDefaults] boolForKey:@"WebKitKerningAndLigaturesEnabledByDefault"] ? Kerning | Ligatures : 0);
+    Font::setDefaultTypesettingFeatures([defaults boolForKey:WebKitKerningAndLigaturesEnabledByDefaultDefaultsKey] ? Kerning | Ligatures : 0);
 
 #if __MAC_OS_X_VERSION_MIN_REQUIRED >= 1060
-    automaticQuoteSubstitutionEnabled = [[NSUserDefaults standardUserDefaults] boolForKey:WebAutomaticQuoteSubstitutionEnabled];
-    automaticLinkDetectionEnabled = [[NSUserDefaults standardUserDefaults] boolForKey:WebAutomaticLinkDetectionEnabled];
-    automaticDashSubstitutionEnabled = [[NSUserDefaults standardUserDefaults] boolForKey:WebAutomaticDashSubstitutionEnabled];
-    automaticTextReplacementEnabled = [[NSUserDefaults standardUserDefaults] boolForKey:WebAutomaticTextReplacementEnabled];
-    automaticSpellingCorrectionEnabled = [[NSUserDefaults standardUserDefaults] boolForKey:WebAutomaticSpellingCorrectionEnabled];
+    automaticQuoteSubstitutionEnabled = [defaults boolForKey:WebAutomaticQuoteSubstitutionEnabled];
+    automaticLinkDetectionEnabled = [defaults boolForKey:WebAutomaticLinkDetectionEnabled];
+    automaticDashSubstitutionEnabled = [defaults boolForKey:WebAutomaticDashSubstitutionEnabled];
+    automaticTextReplacementEnabled = [defaults boolForKey:WebAutomaticTextReplacementEnabled];
+    automaticSpellingCorrectionEnabled = [defaults boolForKey:WebAutomaticSpellingCorrectionEnabled];
 #endif
 
 #if __MAC_OS_X_VERSION_MIN_REQUIRED >= 1070
-    if (![[NSUserDefaults standardUserDefaults] objectForKey:WebAutomaticTextReplacementEnabled])
+    if (![defaults objectForKey:WebAutomaticTextReplacementEnabled])
         automaticTextReplacementEnabled = [NSSpellChecker isAutomaticTextReplacementEnabled];
-    if (![[NSUserDefaults standardUserDefaults] objectForKey:WebAutomaticSpellingCorrectionEnabled])
+    if (![defaults objectForKey:WebAutomaticSpellingCorrectionEnabled])
         automaticSpellingCorrectionEnabled = [NSSpellChecker isAutomaticSpellingCorrectionEnabled];
 #endif
 }
diff --git a/Source/WebKit/qt/Api/qwebsettings.cpp b/Source/WebKit/qt/Api/qwebsettings.cpp
index ba7187df7..768c80256 100644
--- a/Source/WebKit/qt/Api/qwebsettings.cpp
+++ b/Source/WebKit/qt/Api/qwebsettings.cpp
@@ -267,6 +267,14 @@ void QWebSettingsPrivate::apply()
         settings->setEnableScrollAnimator(value);
 #endif
 
+        value = attributes.value(QWebSettings::CaretBrowsingEnabled,
+                                      global->attributes.value(QWebSettings::CaretBrowsingEnabled));
+        settings->setCaretBrowsingEnabled(value);
+
+        value = attributes.value(QWebSettings::NotificationsEnabled,
+                                      global->attributes.value(QWebSettings::NotificationsEnabled));
+        settings->setNotificationsEnabled(value);
+
         value = attributes.value(QWebSettings::SiteSpecificQuirksEnabled,
                                       global->attributes.value(QWebSettings::SiteSpecificQuirksEnabled));
         settings->setNeedsSiteSpecificQuirks(value);
@@ -480,6 +488,9 @@ QWebSettings* QWebSettings::globalSettings()
     \value SiteSpecificQuirksEnabled This setting enables WebKit's workaround for broken sites. It is
         enabled by default.
     \value ScrollAnimatorEnabled This setting enables animated scrolling. It is disabled by default.
+    \value CaretBrowsingEnabled This setting enables caret browsing. It is disabled by default.
+    \value NotificationsEnabled Specifies whether support for the HTML 5 web notifications is enabled
+        or not. This is enabled by default.
 */
 
 /*!
@@ -532,6 +543,8 @@ QWebSettings::QWebSettings()
     d->attributes.insert(QWebSettings::FrameFlatteningEnabled, false);
     d->attributes.insert(QWebSettings::SiteSpecificQuirksEnabled, true);
     d->attributes.insert(QWebSettings::ScrollAnimatorEnabled, false);
+    d->attributes.insert(QWebSettings::CaretBrowsingEnabled, false);
+    d->attributes.insert(QWebSettings::NotificationsEnabled, true);
     d->offlineStorageDefaultQuota = 5 * 1024 * 1024;
     d->defaultTextEncoding = QLatin1String("iso-8859-1");
     d->thirdPartyCookiePolicy = AlwaysAllowThirdPartyCookies;
diff --git a/Source/WebKit/qt/Api/qwebsettings.h b/Source/WebKit/qt/Api/qwebsettings.h
index 5b6497afb..5e7d3e1b4 100644
--- a/Source/WebKit/qt/Api/qwebsettings.h
+++ b/Source/WebKit/qt/Api/qwebsettings.h
@@ -80,7 +80,9 @@ public:
         CSSRegionsEnabled,
         HyperlinkAuditingEnabled,
         CSSGridLayoutEnabled,
-        ScrollAnimatorEnabled
+        ScrollAnimatorEnabled,
+        CaretBrowsingEnabled,
+        NotificationsEnabled
     };
     enum WebGraphic {
         MissingImageGraphic,
diff --git a/Source/WebKit/qt/ChangeLog b/Source/WebKit/qt/ChangeLog
index 9a085047c..43b99b3d3 100644
--- a/Source/WebKit/qt/ChangeLog
+++ b/Source/WebKit/qt/ChangeLog
@@ -1,3 +1,102 @@
+2012-11-01  Stephen White  <senorblanco@chromium.org>
+
+        Unreviewed, rolling out r133143.
+        http://trac.webkit.org/changeset/133143
+        https://bugs.webkit.org/show_bug.cgi?id=96894
+
+        Causing content_browsertests failures
+
+        * WebCoreSupport/DumpRenderTreeSupportQt.cpp:
+        (DumpRenderTreeSupportQt::setMockDeviceOrientation):
+
+2012-11-01  Kihong Kwon  <kihong.kwon@samsung.com>
+
+        Add DeviceController base-class to remove duplication of DeviceXXXControler
+        https://bugs.webkit.org/show_bug.cgi?id=96894
+
+        Reviewed by Hajime Morita.
+
+        Change client() to deviceOrientationClient() to get DeviceOrientationClient*.
+
+        * WebCoreSupport/DumpRenderTreeSupportQt.cpp:
+        (DumpRenderTreeSupportQt::setMockDeviceOrientation):
+
+2012-10-31  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r133016.
+        http://trac.webkit.org/changeset/133016
+        https://bugs.webkit.org/show_bug.cgi?id=100856
+
+        broke compile-webkit on several bots (Requested by podivilov
+        on #webkit).
+
+        * WebCoreSupport/DumpRenderTreeSupportQt.cpp:
+        (DumpRenderTreeSupportQt::setMockDeviceOrientation):
+
+2012-10-31  Kihong Kwon  <kihong.kwon@samsung.com>
+
+        Add DeviceController base-class to remove duplication of DeviceXXXControler
+        https://bugs.webkit.org/show_bug.cgi?id=96894
+
+        Reviewed by Hajime Morita.
+
+        Change client() to deviceOrientationClient() to get DeviceOrientationClient*.
+
+        * WebCoreSupport/DumpRenderTreeSupportQt.cpp:
+        (DumpRenderTreeSupportQt::setMockDeviceOrientation):
+
+2012-10-30  Mikhail Pozdnyakov  <mikhail.pozdnyakov@intel.com>
+
+        [QT][DRT] Remove unneeded testRunner.setMediaType() implementation
+        https://bugs.webkit.org/show_bug.cgi?id=100740
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Removed unneeded testRunner.setMediaType() implementation, as tests use
+        cross-platform window.internals.settings.setMediaTypeOverride instead.
+
+        * WebCoreSupport/DumpRenderTreeSupportQt.cpp:
+        * WebCoreSupport/DumpRenderTreeSupportQt.h:
+
+2012-10-24  Brady Eidson  <beidson@apple.com>
+
+        Add a strategy for loader customization.
+        https://bugs.webkit.org/show_bug.cgi?id=100278
+
+        Reviewed by Alexey Proskuryakov.
+
+        * WebCoreSupport/PlatformStrategiesQt.cpp:
+        (PlatformStrategiesQt::createLoaderStrategy):
+        * WebCoreSupport/PlatformStrategiesQt.h:
+        (PlatformStrategiesQt):
+
+2012-10-23  Alexey Proskuryakov  <ap@apple.com>
+
+        Add a strategy for shared workers
+        https://bugs.webkit.org/show_bug.cgi?id=100165
+
+        Reviewed by Brady Eidson.
+
+        * WebCoreSupport/PlatformStrategiesQt.cpp:
+        (PlatformStrategiesQt::createPasteboardStrategy):
+        (PlatformStrategiesQt::createSharedWorkerStrategy):
+        (PlatformStrategiesQt::createVisitedLinkStrategy):
+        * WebCoreSupport/PlatformStrategiesQt.h:
+
+2012-10-24  Allan Sandfeld Jensen  <allan.jensen@digia.com>
+
+        [Qt] Expose useful WebCore::Settings
+        https://bugs.webkit.org/show_bug.cgi?id=100239
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Expose the two settings CaretBrowsingEnabled and NotificationsEnabled.
+
+        * Api/qwebsettings.cpp:
+        (QWebSettingsPrivate::apply):
+        (QWebSettings::QWebSettings):
+        * Api/qwebsettings.h:
+
 2012-10-23  Andras Becsi  <andras.becsi@digia.com>
 
         Remove devicePixelRatio from ViewportAttributes
diff --git a/Source/WebKit/qt/WebCoreSupport/DumpRenderTreeSupportQt.cpp b/Source/WebKit/qt/WebCoreSupport/DumpRenderTreeSupportQt.cpp
index c5adc9aac..da793111f 100644
--- a/Source/WebKit/qt/WebCoreSupport/DumpRenderTreeSupportQt.cpp
+++ b/Source/WebKit/qt/WebCoreSupport/DumpRenderTreeSupportQt.cpp
@@ -429,15 +429,6 @@ void DumpRenderTreeSupportQt::setAuthorAndUserStylesEnabled(QWebPage* page, bool
     page->handle()->page->settings()->setAuthorAndUserStylesEnabled(value);
 }
 
-void DumpRenderTreeSupportQt::setMediaType(QWebFrame* frame, const QString& type)
-{
-    WebCore::Frame* coreFrame = QWebFramePrivate::core(frame);
-    WebCore::FrameView* view = coreFrame->view();
-    view->setMediaType(type);
-    coreFrame->document()->styleResolverChanged(RecalcStyleImmediately);
-    view->layout();
-}
-
 void DumpRenderTreeSupportQt::setSmartInsertDeleteEnabled(QWebPage* page, bool enabled)
 {
     page->d->smartInsertDeleteEnabled = enabled;
diff --git a/Source/WebKit/qt/WebCoreSupport/DumpRenderTreeSupportQt.h b/Source/WebKit/qt/WebCoreSupport/DumpRenderTreeSupportQt.h
index 8874a942e..d0600ffa7 100644
--- a/Source/WebKit/qt/WebCoreSupport/DumpRenderTreeSupportQt.h
+++ b/Source/WebKit/qt/WebCoreSupport/DumpRenderTreeSupportQt.h
@@ -107,7 +107,6 @@ public:
     static void setFrameFlatteningEnabled(QWebPage*, bool);
     static void setCaretBrowsingEnabled(QWebPage* page, bool value);
     static void setAuthorAndUserStylesEnabled(QWebPage*, bool);
-    static void setMediaType(QWebFrame* qframe, const QString& type);
     static void setDumpRenderTreeModeEnabled(bool b);
 
     static void garbageCollectorCollect();
diff --git a/Source/WebKit/qt/WebCoreSupport/PlatformStrategiesQt.cpp b/Source/WebKit/qt/WebCoreSupport/PlatformStrategiesQt.cpp
index 7d4b0b75f..c31d9b007 100644
--- a/Source/WebKit/qt/WebCoreSupport/PlatformStrategiesQt.cpp
+++ b/Source/WebKit/qt/WebCoreSupport/PlatformStrategiesQt.cpp
@@ -63,19 +63,29 @@ CookiesStrategy* PlatformStrategiesQt::createCookiesStrategy()
     return this;
 }
 
+LoaderStrategy* PlatformStrategiesQt::createLoaderStrategy()
+{
+    return this;
+}
+
+PasteboardStrategy* PlatformStrategiesQt::createPasteboardStrategy()
+{
+    return 0;
+}
+
 PluginStrategy* PlatformStrategiesQt::createPluginStrategy()
 {
     return this;
 }
 
-VisitedLinkStrategy* PlatformStrategiesQt::createVisitedLinkStrategy()
+SharedWorkerStrategy* PlatformStrategiesQt::createSharedWorkerStrategy()
 {
     return this;
 }
 
-PasteboardStrategy* PlatformStrategiesQt::createPasteboardStrategy()
+VisitedLinkStrategy* PlatformStrategiesQt::createVisitedLinkStrategy()
 {
-    return 0;
+    return this;
 }
 
 void PlatformStrategiesQt::notifyCookiesChanged()
diff --git a/Source/WebKit/qt/WebCoreSupport/PlatformStrategiesQt.h b/Source/WebKit/qt/WebCoreSupport/PlatformStrategiesQt.h
index 9dd7e79cf..2fe8fe62c 100644
--- a/Source/WebKit/qt/WebCoreSupport/PlatformStrategiesQt.h
+++ b/Source/WebKit/qt/WebCoreSupport/PlatformStrategiesQt.h
@@ -29,16 +29,17 @@
 #define PlatformStrategiesQt_h
 
 #include <CookiesStrategy.h>
+#include <LoaderStrategy.h>
 #include <PlatformStrategies.h>
 #include <PluginStrategy.h>
+#include <SharedWorkerStrategy.h>
 #include <VisitedLinkStrategy.h>
 
 namespace WebCore {
-class Page;
 class PasteboardStrategy;
 }
 
-class PlatformStrategiesQt : public WebCore::PlatformStrategies, private WebCore::CookiesStrategy, private WebCore::PluginStrategy, private WebCore::VisitedLinkStrategy {
+class PlatformStrategiesQt : public WebCore::PlatformStrategies, private WebCore::CookiesStrategy, private WebCore::LoaderStrategy, private WebCore::PluginStrategy, private WebCore::SharedWorkerStrategy, private WebCore::VisitedLinkStrategy {
 public:
     static void initialize();
 
@@ -47,9 +48,11 @@ private:
 
     // WebCore::PlatformStrategies
     virtual WebCore::CookiesStrategy* createCookiesStrategy();
+    virtual WebCore::LoaderStrategy* createLoaderStrategy();
+    virtual WebCore::PasteboardStrategy* createPasteboardStrategy();
     virtual WebCore::PluginStrategy* createPluginStrategy();
+    virtual WebCore::SharedWorkerStrategy* createSharedWorkerStrategy();
     virtual WebCore::VisitedLinkStrategy* createVisitedLinkStrategy();
-    virtual WebCore::PasteboardStrategy* createPasteboardStrategy();
     
     // WebCore::CookiesStrategy
     virtual void notifyCookiesChanged();
diff --git a/Source/WebKit/win/ChangeLog b/Source/WebKit/win/ChangeLog
index d12c28de8..26351743b 100644
--- a/Source/WebKit/win/ChangeLog
+++ b/Source/WebKit/win/ChangeLog
@@ -1,3 +1,72 @@
+2012-11-05  Simon Fraser  <simon.fraser@apple.com>
+
+        Fix layer borders to cleaning appear and disappear on switching
+        https://bugs.webkit.org/show_bug.cgi?id=101136
+
+        Reviewed by Sam Weinig.
+
+        Remove the GraphicsLayerClient methods showDebugBorders() and
+        showRepaintCounter().
+
+        * WebView.cpp:
+        * WebView.h:
+
+2012-10-29  Anders Carlsson  <andersca@apple.com>
+
+        String::createCFString should return a RetainPtr
+        https://bugs.webkit.org/show_bug.cgi?id=100419
+
+        Reviewed by Andreas Kling.
+
+        Update callers of String::createCFString.
+
+        * WebCoreSupport/WebFrameLoaderClient.cpp:
+        (WebFrameLoaderClient::dispatchDidFailToStartPlugin):
+        * WebDatabaseManager.cpp:
+        (WebDatabaseManager::dispatchDidModifyDatabase):
+        * WebHistory.cpp:
+        (WebHistory::visitedURL):
+        (WebHistory::itemForURLString):
+        * WebHistoryItem.cpp:
+        (WebHistoryItem::dictionaryRepresentation):
+        * WebIconDatabase.cpp:
+        (WebIconDatabase::iconDatabaseNotificationUserInfoURLKey):
+        (postDidAddIconNotification):
+        * WebLocalizableStrings.cpp:
+        (createWebKitBundle):
+        (copyLocalizedStringFromBundle):
+        * WebPreferences.cpp:
+        (WebPreferences::initializeDefaultSettings):
+        * WebView.cpp:
+        (WebView::setCacheModel):
+        (WebView::notifyPreferencesChanged):
+
+2012-10-24  Brady Eidson  <beidson@apple.com>
+
+        Add a strategy for loader customization.
+        https://bugs.webkit.org/show_bug.cgi?id=100278
+
+        Reviewed by Alexey Proskuryakov.
+
+        * WebCoreSupport/WebPlatformStrategies.cpp:
+        (WebPlatformStrategies::createLoaderStrategy):
+        * WebCoreSupport/WebPlatformStrategies.h:
+        (WebPlatformStrategies):
+
+2012-10-23  Alexey Proskuryakov  <ap@apple.com>
+
+        Add a strategy for shared workers
+        https://bugs.webkit.org/show_bug.cgi?id=100165
+
+        Reviewed by Brady Eidson.
+
+        * WebCoreSupport/WebPlatformStrategies.cpp:
+        (WebPlatformStrategies::createPasteboardStrategy):
+        (WebPlatformStrategies::createSharedWorkerStrategy):
+        (WebPlatformStrategies::createVisitedLinkStrategy):
+        * WebCoreSupport/WebPlatformStrategies.h:
+        (WebPlatformStrategies):
+
 2012-10-22  Jocelyn Turcotte  <jocelyn.turcotte@digia.com>
 
         [Qt] Fix "ASSERTION FAILED: !document->inPageCache()" when loading a page
diff --git a/Source/WebKit/win/WebCoreSupport/WebFrameLoaderClient.cpp b/Source/WebKit/win/WebCoreSupport/WebFrameLoaderClient.cpp
index 0e4b10656..5f283504c 100644
--- a/Source/WebKit/win/WebCoreSupport/WebFrameLoaderClient.cpp
+++ b/Source/WebKit/win/WebCoreSupport/WebFrameLoaderClient.cpp
@@ -792,24 +792,20 @@ void WebFrameLoaderClient::dispatchDidFailToStartPlugin(const PluginView* plugin
         KURL pluginPageURL = frame->document()->completeURL(stripLeadingAndTrailingHTMLSpaces(pluginView->pluginsPage()));
         if (pluginPageURL.protocolIsInHTTPFamily()) {
             static CFStringRef key = MarshallingHelpers::LPCOLESTRToCFStringRef(WebKitErrorPlugInPageURLStringKey);
-            RetainPtr<CFStringRef> str(AdoptCF, pluginPageURL.string().createCFString());
-            CFDictionarySetValue(userInfo.get(), key, str.get());
+            CFDictionarySetValue(userInfo.get(), key, pluginPageURL.string().createCFString().get());
         }
     }
 
     if (!pluginView->mimeType().isNull()) {
         static CFStringRef key = MarshallingHelpers::LPCOLESTRToCFStringRef(WebKitErrorMIMETypeKey);
-
-        RetainPtr<CFStringRef> str(AdoptCF, pluginView->mimeType().createCFString());
-        CFDictionarySetValue(userInfo.get(), key, str.get());
+        CFDictionarySetValue(userInfo.get(), key, pluginView->mimeType().createCFString().get());
     }
 
     if (pluginView->plugin()) {
         String pluginName = pluginView->plugin()->name();
         if (!pluginName.isNull()) {
             static CFStringRef key = MarshallingHelpers::LPCOLESTRToCFStringRef(WebKitErrorPlugInNameKey);
-            RetainPtr<CFStringRef> str(AdoptCF, pluginName.createCFString());
-            CFDictionarySetValue(userInfo.get(), key, str.get());
+            CFDictionarySetValue(userInfo.get(), key, pluginName.createCFString().get());
         }
     }
 
diff --git a/Source/WebKit/win/WebCoreSupport/WebPlatformStrategies.cpp b/Source/WebKit/win/WebCoreSupport/WebPlatformStrategies.cpp
index f130f76bd..fb57612ec 100644
--- a/Source/WebKit/win/WebCoreSupport/WebPlatformStrategies.cpp
+++ b/Source/WebKit/win/WebCoreSupport/WebPlatformStrategies.cpp
@@ -47,19 +47,29 @@ CookiesStrategy* WebPlatformStrategies::createCookiesStrategy()
     return this;
 }
 
+LoaderStrategy* WebPlatformStrategies::createLoaderStrategy()
+{
+    return this;
+}
+
+PasteboardStrategy* WebPlatformStrategies::createPasteboardStrategy()
+{
+    return 0;
+}
+
 PluginStrategy* WebPlatformStrategies::createPluginStrategy()
 {
     return this;
 }
 
-VisitedLinkStrategy* WebPlatformStrategies::createVisitedLinkStrategy()
+SharedWorkerStrategy* WebPlatformStrategies::createSharedWorkerStrategy()
 {
     return this;
 }
 
-PasteboardStrategy* WebPlatformStrategies::createPasteboardStrategy()
+VisitedLinkStrategy* WebPlatformStrategies::createVisitedLinkStrategy()
 {
-    return 0;
+    return this;
 }
 
 void WebPlatformStrategies::notifyCookiesChanged()
diff --git a/Source/WebKit/win/WebCoreSupport/WebPlatformStrategies.h b/Source/WebKit/win/WebCoreSupport/WebPlatformStrategies.h
index 274124213..9b43de3ad 100644
--- a/Source/WebKit/win/WebCoreSupport/WebPlatformStrategies.h
+++ b/Source/WebKit/win/WebCoreSupport/WebPlatformStrategies.h
@@ -27,11 +27,13 @@
 #define WebPlatformStrategies_h
 
 #include <WebCore/CookiesStrategy.h>
+#include <WebCore/LoaderStrategy.h>
 #include <WebCore/PlatformStrategies.h>
 #include <WebCore/PluginStrategy.h>
+#include <WebCore/SharedWorkerStrategy.h>
 #include <WebCore/VisitedLinkStrategy.h>
 
-class WebPlatformStrategies : public WebCore::PlatformStrategies, private WebCore::CookiesStrategy, private WebCore::PluginStrategy, private WebCore::VisitedLinkStrategy {
+class WebPlatformStrategies : public WebCore::PlatformStrategies, private WebCore::CookiesStrategy, private WebCore::LoaderStrategy, private WebCore::PluginStrategy, private WebCore::SharedWorkerStrategy, private WebCore::VisitedLinkStrategy {
 public:
     static void initialize();
     
@@ -40,9 +42,11 @@ private:
     
     // WebCore::PlatformStrategies
     virtual WebCore::CookiesStrategy* createCookiesStrategy();
+    virtual WebCore::LoaderStrategy* createLoaderStrategy();
+    virtual WebCore::PasteboardStrategy* createPasteboardStrategy();
     virtual WebCore::PluginStrategy* createPluginStrategy();
+    virtual WebCore::SharedWorkerStrategy* createSharedWorkerStrategy();
     virtual WebCore::VisitedLinkStrategy* createVisitedLinkStrategy();
-    virtual WebCore::PasteboardStrategy* createPasteboardStrategy();
 
     // WebCore::CookiesStrategy
     virtual void notifyCookiesChanged();
diff --git a/Source/WebKit/win/WebDatabaseManager.cpp b/Source/WebKit/win/WebDatabaseManager.cpp
index 6e687f193..15872e34f 100644
--- a/Source/WebKit/win/WebDatabaseManager.cpp
+++ b/Source/WebKit/win/WebDatabaseManager.cpp
@@ -401,8 +401,7 @@ void WebDatabaseManager::dispatchDidModifyDatabase(SecurityOrigin* origin, const
     RetainPtr<CFMutableDictionaryRef> userInfo(AdoptCF, CFDictionaryCreateMutable(0, 0, &kCFTypeDictionaryKeyCallBacks, &kCFTypeDictionaryValueCallBacks));
 
     static CFStringRef databaseNameKey = MarshallingHelpers::LPCOLESTRToCFStringRef(WebDatabaseNameKey);
-    RetainPtr<CFStringRef> str(AdoptCF, databaseName.createCFString());
-    CFDictionarySetValue(userInfo.get(), databaseNameKey, str.get());
+    CFDictionarySetValue(userInfo.get(), databaseNameKey, databaseName.createCFString().get());
 
     COMPtr<CFDictionaryPropertyBag> userInfoBag = CFDictionaryPropertyBag::createInstance();
     userInfoBag->setDictionary(userInfo.get());
diff --git a/Source/WebKit/win/WebHistory.cpp b/Source/WebKit/win/WebHistory.cpp
index 1f7a572c3..a7310b80b 100644
--- a/Source/WebKit/win/WebHistory.cpp
+++ b/Source/WebKit/win/WebHistory.cpp
@@ -693,9 +693,9 @@ HRESULT WebHistory::addItem(IWebHistoryItem* entry, bool discardDuplicate, bool*
 
 void WebHistory::visitedURL(const KURL& url, const String& title, const String& httpMethod, bool wasFailure, bool increaseVisitCount)
 {
-    RetainPtr<CFStringRef> urlString(AdoptCF, url.string().createCFString());
+    RetainPtr<CFStringRef> urlString = url.string().createCFString();
 
-    IWebHistoryItem* entry = (IWebHistoryItem*) CFDictionaryGetValue(m_entriesByURL.get(), urlString.get());
+    IWebHistoryItem* entry = (IWebHistoryItem*)CFDictionaryGetValue(m_entriesByURL.get(), urlString.get());
     if (entry) {
         COMPtr<IWebHistoryItemPrivate> entryPrivate(Query, entry);
         if (!entryPrivate)
@@ -786,11 +786,10 @@ HRESULT WebHistory::removeItemForURLString(CFStringRef urlString)
 
 COMPtr<IWebHistoryItem> WebHistory::itemForURLString(const String& urlString) const
 {
-    RetainPtr<CFStringRef> urlCFString(AdoptCF, urlString.createCFString());
-    if (!urlCFString)
+    if (!urlString)
         return 0;
     COMPtr<IWebHistoryItem> item;
-    if (FAILED(itemForURLString(urlCFString.get(), &item)))
+    if (FAILED(itemForURLString(urlString.createCFString().get(), &item)))
         return 0;
     return item;
 }
diff --git a/Source/WebKit/win/WebHistoryItem.cpp b/Source/WebKit/win/WebHistoryItem.cpp
index a2643089d..8bfe9bd7c 100644
--- a/Source/WebKit/win/WebHistoryItem.cpp
+++ b/Source/WebKit/win/WebHistoryItem.cpp
@@ -214,7 +214,7 @@ HRESULT STDMETHODCALLTYPE WebHistoryItem::dictionaryRepresentation(void** dictio
 
     if (!m_historyItem->urlString().isEmpty()) {
         keys[keyCount] = urlKey;
-        values[keyCount++] = m_historyItem->urlString().createCFString();
+        values[keyCount++] = m_historyItem->urlString().createCFString().leakRef();
     }
 
     keys[keyCount] = lastVisitedDateKey;
@@ -222,7 +222,7 @@ HRESULT STDMETHODCALLTYPE WebHistoryItem::dictionaryRepresentation(void** dictio
 
     if (!m_historyItem->title().isEmpty()) {
         keys[keyCount] = titleKey;
-        values[keyCount++] = m_historyItem->title().createCFString();
+        values[keyCount++] = m_historyItem->title().createCFString().leakRef();
     }
 
     keys[keyCount] = visitCountKey;
@@ -245,7 +245,7 @@ HRESULT STDMETHODCALLTYPE WebHistoryItem::dictionaryRepresentation(void** dictio
         ASSERT(size);
         CFStringRef* items = new CFStringRef[size];
         for (size_t i = 0; i < size; ++i)
-            items[i] = redirectURLs->at(i).createCFString();
+            items[i] = redirectURLs->at(i).createCFString().leakRef();
         CFArrayRef result = CFArrayCreate(0, (const void**)items, size, &kCFTypeArrayCallBacks);
         for (size_t i = 0; i < size; ++i)
             CFRelease(items[i]);
diff --git a/Source/WebKit/win/WebIconDatabase.cpp b/Source/WebKit/win/WebIconDatabase.cpp
index 25d7ec09b..05a94908a 100644
--- a/Source/WebKit/win/WebIconDatabase.cpp
+++ b/Source/WebKit/win/WebIconDatabase.cpp
@@ -366,7 +366,7 @@ BSTR WebIconDatabase::iconDatabaseDidAddIconNotification()
 
 CFStringRef WebIconDatabase::iconDatabaseNotificationUserInfoURLKey()
 {
-    static CFStringRef iconUserInfoURLKey = String(WebIconNotificationUserInfoURLKey).createCFString();
+    static CFStringRef iconUserInfoURLKey = String(WebIconNotificationUserInfoURLKey).createCFString().leakRef();
     return iconUserInfoURLKey;
 }
 
@@ -387,8 +387,7 @@ static void postDidAddIconNotification(const String& pageURL, WebIconDatabase* i
     RetainPtr<CFMutableDictionaryRef> dictionary(AdoptCF, 
     CFDictionaryCreateMutable(0, 0, &kCFTypeDictionaryKeyCallBacks, &kCFTypeDictionaryValueCallBacks));
 
-    RetainPtr<CFStringRef> url(AdoptCF, pageURL.createCFString());
-    CFDictionaryAddValue(dictionary.get(), WebIconDatabase::iconDatabaseNotificationUserInfoURLKey(), url.get());
+    CFDictionaryAddValue(dictionary.get(), WebIconDatabase::iconDatabaseNotificationUserInfoURLKey(), pageURL.createCFString().get());
 
     COMPtr<CFDictionaryPropertyBag> userInfo = CFDictionaryPropertyBag::createInstance();
     userInfo->setDictionary(dictionary.get());
diff --git a/Source/WebKit/win/WebLocalizableStrings.cpp b/Source/WebKit/win/WebLocalizableStrings.cpp
index fd61a01fb..dfb714b46 100644
--- a/Source/WebKit/win/WebLocalizableStrings.cpp
+++ b/Source/WebKit/win/WebLocalizableStrings.cpp
@@ -132,12 +132,10 @@ static CFBundleRef createWebKitBundle()
         return 0;
 
     String bundlePathString(pathStr);
-    CFStringRef bundlePathCFString = bundlePathString.createCFString();
-    if (!bundlePathCFString)
+    if (!bundlePathString)
         return 0;
 
-    CFURLRef bundleURLRef = CFURLCreateWithFileSystemPath(0, bundlePathCFString, kCFURLWindowsPathStyle, true);
-    CFRelease(bundlePathCFString);
+    CFURLRef bundleURLRef = CFURLCreateWithFileSystemPath(0, bundlePathString.createCFString().get(), kCFURLWindowsPathStyle, true);
     if (!bundleURLRef)
         return 0;
 
@@ -168,8 +166,7 @@ static CFStringRef copyLocalizedStringFromBundle(WebLocalizableStringsBundle* st
     if (!bundle)
         return notFound;
 
-    RetainPtr<CFStringRef> keyString(AdoptCF, key.createCFString());
-    CFStringRef result = CFCopyLocalizedStringWithDefaultValue(keyString.get(), 0, bundle, notFound, 0);
+    CFStringRef result = CFCopyLocalizedStringWithDefaultValue(key.createCFString().get(), 0, bundle, notFound, 0);
 
     ASSERT_WITH_MESSAGE(result != notFound, "could not find localizable string %s in bundle", key);
     return result;
diff --git a/Source/WebKit/win/WebPreferences.cpp b/Source/WebKit/win/WebPreferences.cpp
index 5634a15b3..8967b0b30 100644
--- a/Source/WebKit/win/WebPreferences.cpp
+++ b/Source/WebKit/win/WebPreferences.cpp
@@ -196,7 +196,7 @@ void WebPreferences::initializeDefaultSettings()
     CFDictionaryAddValue(defaults, CFSTR(WebKitDefaultFixedFontSizePreferenceKey), CFSTR("13"));
 
     String defaultDefaultEncoding(WEB_UI_STRING("ISO-8859-1", "The default, default character encoding"));
-    CFDictionaryAddValue(defaults, CFSTR(WebKitDefaultTextEncodingNamePreferenceKey), defaultDefaultEncoding.createCFString());
+    CFDictionaryAddValue(defaults, CFSTR(WebKitDefaultTextEncodingNamePreferenceKey), defaultDefaultEncoding.createCFString().get());
 
     CFDictionaryAddValue(defaults, CFSTR(WebKitUserStyleSheetEnabledPreferenceKey), kCFBooleanFalse);
     CFDictionaryAddValue(defaults, CFSTR(WebKitUserStyleSheetLocationPreferenceKey), CFSTR(""));
diff --git a/Source/WebKit/win/WebView.cpp b/Source/WebKit/win/WebView.cpp
index 6b1bade4a..dd7008eb3 100644
--- a/Source/WebKit/win/WebView.cpp
+++ b/Source/WebKit/win/WebView.cpp
@@ -471,7 +471,7 @@ void WebView::setCacheModel(WebCacheModel cacheModel)
     RetainPtr<CFURLCacheRef> cfurlCache(AdoptCF, CFURLCacheCopySharedURLCache());
     RetainPtr<CFStringRef> cfurlCacheDirectory(AdoptCF, wkCopyFoundationCacheDirectory(0));
     if (!cfurlCacheDirectory)
-        cfurlCacheDirectory.adoptCF(WebCore::localUserSpecificStorageDirectory().createCFString());
+        cfurlCacheDirectory = WebCore::localUserSpecificStorageDirectory().createCFString();
 
     // As a fudge factor, use 1000 instead of 1024, in case the reported byte 
     // count doesn't align exactly to a megabyte boundary.
@@ -4712,8 +4712,7 @@ HRESULT WebView::notifyPreferencesChanged(IWebNotification* notification)
         if (FAILED(hr))
             return hr;
 
-        RetainPtr<CFStringRef> urlString(AdoptCF, toString(str).createCFString());
-        RetainPtr<CFURLRef> url(AdoptCF, CFURLCreateWithString(kCFAllocatorDefault, urlString.get(), 0));
+        RetainPtr<CFURLRef> url(AdoptCF, CFURLCreateWithString(kCFAllocatorDefault, toString(str).createCFString().get(), 0));
 
         // Check if the passed in string is a path and convert it to a URL.
         // FIXME: This is a workaround for nightly builds until we can get Safari to pass 
@@ -6646,16 +6645,6 @@ void WebView::paintContents(const GraphicsLayer*, GraphicsContext& context, Grap
     context.restore();
 }
 
-bool WebView::showDebugBorders(const GraphicsLayer*) const
-{
-    return m_page->settings()->showDebugBorders();
-}
-
-bool WebView::showRepaintCounter(const GraphicsLayer*) const
-{
-    return m_page->settings()->showRepaintCounter();
-}
-
 void WebView::flushPendingGraphicsLayerChanges()
 {
     Frame* coreFrame = core(m_mainFrame);
diff --git a/Source/WebKit/win/WebView.h b/Source/WebKit/win/WebView.h
index 98fcbb3e1..c9373462f 100644
--- a/Source/WebKit/win/WebView.h
+++ b/Source/WebKit/win/WebView.h
@@ -1020,8 +1020,6 @@ private:
     virtual void notifyAnimationStarted(const WebCore::GraphicsLayer*, double time);
     virtual void notifyFlushRequired(const WebCore::GraphicsLayer*);
     virtual void paintContents(const WebCore::GraphicsLayer*, WebCore::GraphicsContext&, WebCore::GraphicsLayerPaintingPhase, const WebCore::IntRect& inClip);
-    virtual bool showDebugBorders(const WebCore::GraphicsLayer*) const;
-    virtual bool showRepaintCounter(const WebCore::GraphicsLayer*) const;
 
     // CACFLayerTreeHostClient
     virtual void flushPendingGraphicsLayerChanges();
diff --git a/Source/WebKit/wince/ChangeLog b/Source/WebKit/wince/ChangeLog
index dbecfc31f..2fa3f132d 100644
--- a/Source/WebKit/wince/ChangeLog
+++ b/Source/WebKit/wince/ChangeLog
@@ -1,3 +1,28 @@
+2012-10-24  Brady Eidson  <beidson@apple.com>
+
+        Add a strategy for loader customization.
+        https://bugs.webkit.org/show_bug.cgi?id=100278
+
+        Reviewed by Alexey Proskuryakov.
+
+        * WebCoreSupport/PlatformStrategiesWinCE.cpp:
+        (PlatformStrategiesWinCE::createLoaderStrategy):
+        * WebCoreSupport/PlatformStrategiesWinCE.h:
+        (PlatformStrategiesWinCE):
+
+2012-10-23  Alexey Proskuryakov  <ap@apple.com>
+
+        Add a strategy for shared workers
+        https://bugs.webkit.org/show_bug.cgi?id=100165
+
+        Reviewed by Brady Eidson.
+
+        * WebCoreSupport/PlatformStrategiesWinCE.cpp:
+        (PlatformStrategiesWinCE::createPasteboardStrategy):
+        (PlatformStrategiesWinCE::createSharedWorkerStrategy):
+        (PlatformStrategiesWinCE::createVisitedLinkStrategy):
+        * WebCoreSupport/PlatformStrategiesWinCE.h:
+
 2012-10-10  Jon Lee  <jonlee@apple.com>
 
         [WK2] Activate plugins when user clicks on snapshot
diff --git a/Source/WebKit/wince/WebCoreSupport/PlatformStrategiesWinCE.cpp b/Source/WebKit/wince/WebCoreSupport/PlatformStrategiesWinCE.cpp
index d55797231..425b0f3a8 100644
--- a/Source/WebKit/wince/WebCoreSupport/PlatformStrategiesWinCE.cpp
+++ b/Source/WebKit/wince/WebCoreSupport/PlatformStrategiesWinCE.cpp
@@ -48,19 +48,29 @@ CookiesStrategy* PlatformStrategiesWinCE::createCookiesStrategy()
     return this;
 }
 
+LoaderStrategy* PlatformStrategiesWinCE::createLoaderStrategy()
+{
+    return this;
+}
+
+PasteboardStrategy* PlatformStrategiesWinCE::createPasteboardStrategy()
+{
+    return 0;
+}
+
 PluginStrategy* PlatformStrategiesWinCE::createPluginStrategy()
 {
     return this;
 }
 
-VisitedLinkStrategy* PlatformStrategiesWinCE::createVisitedLinkStrategy()
+SharedWorkerStrategy* PlatformStrategiesWinCE::createSharedWorkerStrategy()
 {
     return this;
 }
 
-PasteboardStrategy* PlatformStrategiesWinCE::createPasteboardStrategy()
+VisitedLinkStrategy* PlatformStrategiesWinCE::createVisitedLinkStrategy()
 {
-    return 0;
+    return this;
 }
 
 void PlatformStrategiesWinCE::notifyCookiesChanged()
diff --git a/Source/WebKit/wince/WebCoreSupport/PlatformStrategiesWinCE.h b/Source/WebKit/wince/WebCoreSupport/PlatformStrategiesWinCE.h
index 344635690..2ce48203c 100644
--- a/Source/WebKit/wince/WebCoreSupport/PlatformStrategiesWinCE.h
+++ b/Source/WebKit/wince/WebCoreSupport/PlatformStrategiesWinCE.h
@@ -26,11 +26,13 @@
 #define PlatformStrategiesWinCE_h
 
 #include "CookiesStrategy.h"
+#include "LoaderStrategy.h"
 #include "PlatformStrategies.h"
 #include "PluginStrategy.h"
+#include "SharedWorkerStrategy.h"
 #include "VisitedLinkStrategy.h"
 
-class PlatformStrategiesWinCE : public WebCore::PlatformStrategies, private WebCore::CookiesStrategy, private WebCore::PluginStrategy, private WebCore::VisitedLinkStrategy {
+class PlatformStrategiesWinCE : public WebCore::PlatformStrategies, private WebCore::CookiesStrategy, private WebCore::LoaderStrategy, private WebCore::PluginStrategy, private WebCore::SharedWorkerStrategy, private WebCore::VisitedLinkStrategy {
 public:
     static void initialize();
 
@@ -39,9 +41,11 @@ private:
 
     // WebCore::PlatformStrategies
     virtual WebCore::CookiesStrategy* createCookiesStrategy();
+    virtual WebCore::LoaderStrategy* createLoaderStrategy();
+    virtual WebCore::PasteboardStrategy* createPasteboardStrategy();
     virtual WebCore::PluginStrategy* createPluginStrategy();
+    virtual WebCore::SharedWorkerStrategy* createSharedWorkerStrategy();
     virtual WebCore::VisitedLinkStrategy* createVisitedLinkStrategy();
-    virtual WebCore::PasteboardStrategy* createPasteboardStrategy();
 
     // WebCore::CookiesStrategy
     virtual void notifyCookiesChanged();
diff --git a/Source/WebKit2/CMakeLists.txt b/Source/WebKit2/CMakeLists.txt
index b6bfc7c6f..6e46f48a9 100644
--- a/Source/WebKit2/CMakeLists.txt
+++ b/Source/WebKit2/CMakeLists.txt
@@ -237,6 +237,7 @@ SET(WebKit2_SOURCES
     UIProcess/GeolocationPermissionRequestManagerProxy.cpp
     UIProcess/GeolocationPermissionRequestProxy.cpp
 
+    UIProcess/PageViewportController.cpp
     UIProcess/ResponsivenessTimer.cpp
     UIProcess/VisitedLinkProvider.cpp
     UIProcess/WebApplicationCacheManagerProxy.cpp
diff --git a/Source/WebKit2/ChangeLog b/Source/WebKit2/ChangeLog
index 04a92a04e..4253caa5f 100644
--- a/Source/WebKit2/ChangeLog
+++ b/Source/WebKit2/ChangeLog
@@ -1,3 +1,6082 @@
+2012-11-07  Christophe Dumez  <christophe.dumez@intel.com>
+
+        Add replaceWithLiteral() method to WTF::String
+        https://bugs.webkit.org/show_bug.cgi?id=101257
+
+        Reviewed by Benjamin Poulain.
+
+        Substitute String::replace() calls by String::replaceWithLiteral() where
+        adequate, for efficiency.
+
+        * WebProcess/Plugins/Netscape/NetscapeBrowserFuncs.cpp:
+        (WebKit::makeURLString):
+
+2012-11-06  Vivek Galatage  <vivekgalatage@gmail.com>
+
+        Move DrawingAreaImpl methods graphicsLayerFactory, setRootCompositingLayer & scheduleCompositingLayerSync under ACCELERATED_COMPOSITING
+        https://bugs.webkit.org/show_bug.cgi?id=101427
+
+        Reviewed by Anders Carlsson.
+
+        Moving these methods under the ACCELERATED_COMPOSITING flag.
+        This fixes broken wincairo due to use of override specifier.
+
+        * WebProcess/WebPage/DrawingAreaImpl.cpp:
+        (WebKit):
+        * WebProcess/WebPage/DrawingAreaImpl.h:
+        (DrawingAreaImpl):
+
+2012-11-06  Viatcheslav Ostapenko  <v.ostapenko@samsung.com>
+
+        [EFL][WK2] API test crash with accelerated compositing on.
+        https://bugs.webkit.org/show_bug.cgi?id=101384
+
+        Reviewed by Gyuyoung Kim.
+
+        If accelerated compositing is enabled API tests should create GL evas engine
+        instead of default one.
+        Also, in API tests first window resize and display often comes earlier
+        than enterAcceleratedCompositingMode call, so let's create GL surface in
+        _ewk_view_smart_calculate on first window resize.
+
+        * UIProcess/API/efl/ewk_view.cpp:
+        (_ewk_view_smart_calculate):
+        * UIProcess/API/efl/tests/UnitTestUtils/EWK2UnitTestBase.cpp:
+        (EWK2UnitTest::EWK2UnitTestBase::SetUp):
+
+2012-11-06  Anders Carlsson  <andersca@apple.com>
+
+        Update Java related WKSI function names
+        https://bugs.webkit.org/show_bug.cgi?id=101414
+
+        Reviewed by Sam Weinig.
+
+        * UIProcess/Plugins/mac/PluginInfoStoreMac.mm:
+        (WebKit::PluginInfoStore::shouldUsePlugin):
+        (WebKit::PluginInfoStore::policyForPlugin):
+        (WebKit::PluginInfoStore::reactivateInactivePlugin):
+
+2012-11-06  Kiran Muppala  <cmuppala@apple.com>
+
+        Add application occlusion criterion to enable/disable process suppression on Mac
+        https://bugs.webkit.org/show_bug.cgi?id=100997
+
+        Reviewed by Alexey Proskuryakov.
+
+        Provide support for enabling and disabling process suppression when application is completely occluded on Mac.
+
+        * NetworkProcess/NetworkProcess.messages.in: Added message to update application occlusion status.
+        * NetworkProcess/mac/NetworkProcessMainMac.mm:
+        (WebKit::NetworkProcessMain): Removed call to take process suppression assertion since ChildProcess
+        takes one on constrution.
+        * PluginProcess/PluginProcess.messages.in: Added message to update application occlusion status.
+        * PluginProcess/mac/PluginProcessMainMac.mm:
+        (WebKit::PluginProcessMain): Removed call to take process suppression assertion since ChildProcess
+        takes one on construction.
+        * Shared/ChildProcess.cpp:
+        (WebKit::ChildProcess::ChildProcess): Take process suppression assertion on construction.
+        * Shared/ChildProcess.h:
+        (WebKit::ChildProcess::applicationIsOccluded):
+        * Shared/mac/ChildProcessMac.mm: Added.
+        (WebKit::ChildProcess::setApplicationIsOccluded): Release process suppression assertion if application
+        becomes occluded or take a new assertion if application becomes visible.
+        (WebKit::ChildProcess::disableProcessSuppression):
+        (WebKit::ChildProcess::enableProcessSuppression):
+        Helper methods to take and release process suppression assertion.
+        * SharedWorkerProcess/SharedWorkerProcess.messages.in: Added message to update application occlusion status.
+        * SharedWorkerProcess/mac/SharedWorkerProcessMainMac.mm:
+        (WebKit::SharedWorkerProcessMain): Removed call to take process suppression assertion since ChildProcess
+        takes one on construction.
+        * UIProcess/Network/NetworkProcessManager.h:
+        * UIProcess/Network/NetworkProcessProxy.cpp:
+        (WebKit::NetworkProcessProxy::didFinishLaunching): Update application occlusion status post launch.
+        * UIProcess/Network/NetworkProcessProxy.h:
+        (WebKit::NetworkProcessProxy::isValid):
+        * UIProcess/Network/mac/NetworkProcessManagerMac.mm: Added.
+        (WebKit::NetworkProcessManager::setApplicationIsOccluded):
+        * UIProcess/Network/mac/NetworkProcessProxyMac.mm:
+        (WebKit::NetworkProcessProxy::setApplicationIsOccluded):
+        * UIProcess/Plugins/PluginProcessManager.h:
+        * UIProcess/Plugins/PluginProcessProxy.cpp:
+        (WebKit::PluginProcessProxy::didFinishLaunching): Update application occlusion status post launch.
+        * UIProcess/Plugins/PluginProcessProxy.h:
+        (WebKit::PluginProcessProxy::isValid):
+        * UIProcess/Plugins/mac/PluginProcessManagerMac.mm: Added.
+        (WebKit::PluginProcessManager::setApplicationIsOccluded):
+        * UIProcess/Plugins/mac/PluginProcessProxyMac.mm:
+        (WebKit::PluginProcessProxy::setApplicationIsOccluded):
+        * UIProcess/SharedWorkers/SharedWorkerProcessManager.h:
+        * UIProcess/SharedWorkers/SharedWorkerProcessProxy.cpp:
+        (WebKit::SharedWorkerProcessProxy::didFinishLaunching): Update application occlusion status post launch.
+        * UIProcess/SharedWorkers/SharedWorkerProcessProxy.h:
+        (WebKit::SharedWorkerProcessProxy::isValid):
+        * UIProcess/SharedWorkers/mac/SharedWorkerProcessManagerMac.mm: Added.
+        (WebKit::SharedWorkerProcessManager::setApplicationIsOccluded):
+        * UIProcess/SharedWorkers/mac/SharedWorkerProcessProxyMac.mm: Added.
+        (WebKit::SharedWorkerProcessProxy::setApplicationIsOccluded):
+        * UIProcess/WebContext.cpp:
+        (WebKit::WebContext::create): Added call to initialize process suppression support.
+        * UIProcess/WebContext.h:
+        (WebKit::WebContext::applicationIsOccluded):
+        * UIProcess/WebProcessProxy.cpp:
+        (WebKit::WebProcessProxy::didFinishLaunching): Update application occlusion status post launch.
+        * UIProcess/mac/WebContextMac.mm:
+        (WebKit::WebContext::applicationBecameVisible):
+        (WebKit::WebContext::applicationBecameOccluded):
+        Notification handlers for informing non UI WebKit2 processes of changes to application occlusion state.
+        (WebKit::WebContext::registerOcclusionNotificationHandlers):
+        (WebKit::WebContext::initializeProcessSuppressionSupport):
+        Helper method to register occlusion notification handlers if process suppression support is enabled.
+        * WebKit2.xcodeproj/project.pbxproj:
+        * WebProcess/WebProcess.messages.in: Added message to update application occlusion status.
+        * WebProcess/mac/WebProcessInitialization.mm:
+        (WebKit::InitializeWebProcess): Removed call to take process supression assertion since ChildProcess
+        takes one on construction.
+
+2012-11-06  Alexey Proskuryakov  <ap@apple.com>
+
+        Clean up which storage cookie jar functions use
+        https://bugs.webkit.org/show_bug.cgi?id=101395
+
+        Reviewed by Brady Eidson.
+
+        * WebProcess/WebCoreSupport/mac/WebSystemInterface.mm: (InitWebCoreSystemInterface):
+        Updated for two new functions.
+
+2012-11-06  Jihye Kang  <jye.kang@samsung.com>
+
+        [EFL][WK2] Add ewk_database_manager APIs
+        https://bugs.webkit.org/show_bug.cgi?id=101193
+
+        Reviewed by Gyuyoung Kim.
+
+        Add ewk_database_manager to manage web database and
+        ewk_database_manaager_origins_get to get origins list of web storage.
+        Add unit tests for ewk_database_manager APIs.
+
+        * PlatformEfl.cmake:
+        * UIProcess/API/efl/ewk_context.cpp:
+        (Ewk_Context::Ewk_Context):
+        (Ewk_Context::databaseManager):
+        (ewk_context_database_manager_get):
+        * UIProcess/API/efl/ewk_context.h:
+        * UIProcess/API/efl/ewk_context_private.h:
+        (Ewk_Context):
+        * UIProcess/API/efl/ewk_database_manager.cpp: Added.
+        (Ewk_Database_Manager::Ewk_Database_Manager):
+        (Ewk_Database_Manager::getDatabaseOrigins):
+        (Ewk_Database_Manager::createOriginList):
+        (Ewk_Database_Origins_Async_Get_Context):
+        (Ewk_Database_Origins_Async_Get_Context::Ewk_Database_Origins_Async_Get_Context):
+        (getDatabaseOriginsCallback):
+        (ewk_database_manager_origins_get):
+        * UIProcess/API/efl/ewk_database_manager.h: Added.
+        * UIProcess/API/efl/ewk_database_manager_private.h: Added.
+        (Ewk_Database_Manager):
+        (Ewk_Database_Manager::create):
+        * UIProcess/API/efl/tests/test_ewk2_context.cpp:
+        (TEST_F):
+        * UIProcess/API/efl/tests/test_ewk2_database_manager.cpp: Added.
+        (OriginData):
+        (OriginData::OriginData):
+        (getDatabaseOriginsCallback):
+        (timerCallback):
+        (TEST_F):
+
+2012-11-06  Mikhail Pozdnyakov  <mikhail.pozdnyakov@intel.com>
+
+        [EFL][WK2] Refactor Ewk_Auth_Request, Ewk_Url_Scheme_Request and Ewk_Download_Job to be Ewk_Objects
+        https://bugs.webkit.org/show_bug.cgi?id=101383
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Ewk_Auth_Request, Ewk_Url_Scheme_Request and Ewk_Download_Job are Ewk_Objects now.
+
+        * UIProcess/API/efl/EwkViewCallbacks.h:
+        * UIProcess/API/efl/EwkViewImpl.h:
+        * UIProcess/API/efl/ewk_auth_request.cpp:
+        (EwkAuthRequest::EwkAuthRequest):
+        (EwkAuthRequest::~EwkAuthRequest):
+        (EwkAuthRequest::suggestedUsername):
+        (EwkAuthRequest::realm):
+        (EwkAuthRequest::host):
+        (EwkAuthRequest::continueWithoutCredential):
+        (EwkAuthRequest::authenticate):
+        (EwkAuthRequest::isRetrying):
+        (ewk_auth_request_suggested_username_get):
+        (ewk_auth_request_cancel):
+        (ewk_auth_request_authenticate):
+        (ewk_auth_request_retrying_get):
+        (ewk_auth_request_realm_get):
+        (ewk_auth_request_host_get):
+        * UIProcess/API/efl/ewk_auth_request.h:
+        * UIProcess/API/efl/ewk_auth_request_private.h:
+        (EwkAuthRequest):
+        (EwkAuthRequest::create):
+        * UIProcess/API/efl/ewk_back_forward_list.h:
+        * UIProcess/API/efl/ewk_context_private.h:
+        (EwkContext):
+        * UIProcess/API/efl/ewk_download_job.cpp:
+        (EwkDownloadJob::EwkDownloadJob):
+        (EwkDownloadJob::id):
+        (EwkDownloadJob::viewImpl):
+        (ewk_download_job_state_get):
+        (EwkDownloadJob::state):
+        (ewk_download_job_request_get):
+        (EwkDownloadJob::request):
+        (ewk_download_job_response_get):
+        (EwkDownloadJob::response):
+        (ewk_download_job_destination_get):
+        (EwkDownloadJob::destination):
+        (ewk_download_job_destination_set):
+        (EwkDownloadJob::setDestination):
+        (ewk_download_job_suggested_filename_get):
+        (EwkDownloadJob::suggestedFileName):
+        (ewk_download_job_cancel):
+        (EwkDownloadJob::cancel):
+        (ewk_download_job_estimated_progress_get):
+        (EwkDownloadJob::estimatedProgress):
+        (ewk_download_job_elapsed_time_get):
+        (EwkDownloadJob::elapsedTime):
+        (EwkDownloadJob::setResponse):
+        (EwkDownloadJob::setSuggestedFileName):
+        (EwkDownloadJob::incrementReceivedData):
+        (EwkDownloadJob::setState):
+        * UIProcess/API/efl/ewk_download_job.h:
+        * UIProcess/API/efl/ewk_download_job_private.h:
+        (EwkDownloadJob):
+        (EwkDownloadJob::create):
+        * UIProcess/API/efl/ewk_url_scheme_request.cpp:
+        (EwkUrlSchemeRequest::EwkUrlSchemeRequest):
+        (EwkUrlSchemeRequest::id):
+        (EwkUrlSchemeRequest::url):
+        (EwkUrlSchemeRequest::scheme):
+        (EwkUrlSchemeRequest::path):
+        (EwkUrlSchemeRequest::finish):
+        (ewk_url_scheme_request_scheme_get):
+        (ewk_url_scheme_request_url_get):
+        (ewk_url_scheme_request_path_get):
+        (ewk_url_scheme_request_finish):
+        * UIProcess/API/efl/ewk_url_scheme_request.h:
+        * UIProcess/API/efl/ewk_url_scheme_request_private.h:
+        (EwkUrlSchemeRequest):
+        (EwkUrlSchemeRequest::create):
+        * UIProcess/API/efl/tests/test_ewk2_auth_request.cpp:
+        (onAuthenticationRequest):
+        (TEST_F):
+        * UIProcess/efl/DownloadManagerEfl.cpp:
+        (WebKit::DownloadManagerEfl::decideDestinationWithSuggestedFilename):
+        (WebKit::DownloadManagerEfl::didReceiveResponse):
+        (WebKit::DownloadManagerEfl::didCreateDestination):
+        (WebKit::DownloadManagerEfl::didReceiveData):
+        (WebKit::DownloadManagerEfl::didFail):
+        (WebKit::DownloadManagerEfl::didCancel):
+        (WebKit::DownloadManagerEfl::didFinish):
+        (WebKit::DownloadManagerEfl::registerDownload):
+        (WebKit::DownloadManagerEfl::downloadJob):
+        * UIProcess/efl/DownloadManagerEfl.h:
+        (DownloadManagerEfl):
+        * UIProcess/efl/PageLoadClientEfl.cpp:
+        (WebKit::PageLoadClientEfl::didReceiveAuthenticationChallengeInFrame):
+        * UIProcess/efl/RequestManagerClientEfl.cpp:
+        (WebKit::RequestManagerClientEfl::didReceiveURIRequest):
+
+2012-11-06  Yael Aharon  <yael.aharon@intel.com>
+
+        [WK2] Wrong scroll position when going back in history
+        https://bugs.webkit.org/show_bug.cgi?id=101358
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Reset the contentsSize after a new load was committed. We should not continue
+        to use the contentsSize of the previous page in any calculation.
+
+        * UIProcess/PageViewportController.cpp:
+        (WebKit::PageViewportController::didCommitLoad):
+
+2012-11-06  Christophe Dumez  <christophe.dumez@intel.com>
+
+        [EFL][WK2] Declare all smart callbacks in EwkViewCallbacks.h
+        https://bugs.webkit.org/show_bug.cgi?id=101360
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Declare all EwkView smart callbacks in EwkViewCallbacks.h
+        and remove remaining calls to evas_object_smart_callback_call().
+        It is a good idea to have all the callbacks declared in one
+        place for convenience and consistency. We also have better
+        argument type checking if we use the new callback mechanism.
+
+        * UIProcess/API/efl/EwkViewCallbacks.h:
+        (EwkViewCallbacks::CallBack::call):
+        (CallBack):
+        (EwkViewCallbacks):
+        * UIProcess/API/efl/EwkViewImpl.cpp:
+        (EwkViewImpl::informIconChange):
+        (EwkViewImpl::informURLChange):
+        (EwkViewImpl::createNewPage):
+        (EwkViewImpl::closePage):
+
+2012-11-05  Anders Carlsson  <andersca@apple.com>
+
+        Hook up the remote layer tree drawing area to an environment variable
+        https://bugs.webkit.org/show_bug.cgi?id=101267
+
+        Reviewed by Andreas Kling.
+
+        * UIProcess/API/mac/WKView.mm:
+        * UIProcess/mac/RemoteLayerTreeDrawingAreaProxy.mm:
+        (WebKit::RemoteLayerTreeDrawingAreaProxy::sizeDidChange):
+        (WebKit::RemoteLayerTreeDrawingAreaProxy::deviceScaleFactorDidChange):
+
+2012-11-06  Andras Becsi  <andras.becsi@digia.com>
+
+        [Qt][WK2] Fit-to-width broken on pages with viewport meta tag
+        https://bugs.webkit.org/show_bug.cgi?id=99715
+
+        Reviewed by Jocelyn Turcotte.
+
+        The initial scale from the viewport attributes should only
+        be applied if the scale was explicitly specified in the
+        viewport meta tag.
+        If the initial scale is auto it should be calculated using
+        the final contents size, which might be larger than the
+        layout size, so that the content fits horizontally into
+        the view.
+
+        Also add QML unit tests that cover this functionality.
+
+        * UIProcess/API/qt/tests/qmltests/WebView/tst_fitToView.qml:
+        * UIProcess/API/qt/tests/qmltests/common/test5.html: Added.
+        * UIProcess/PageViewportController.cpp:
+        (WebKit::PageViewportController::PageViewportController):
+        (WebKit::PageViewportController::pageTransitionViewportReady):
+
+2012-11-06  Huang Dongsung  <luxtella@company100.net>
+
+        Coordinated Graphics: Remove a parent member in WebLayerInfo.
+        https://bugs.webkit.org/show_bug.cgi?id=101142
+
+        Reviewed by Noam Rosenthal.
+
+        The parent member is not used in UI Process, and GraphicsLayer::setParent is
+        internally used only, so we don't need to send the parent layer id to UI Process.
+
+        * Shared/WebLayerTreeInfo.h:
+        (WebKit::WebLayerInfo::WebLayerInfo):
+        * WebProcess/WebPage/CoordinatedGraphics/CoordinatedGraphicsLayer.cpp:
+        (WebCore::CoordinatedGraphicsLayer::syncLayerState):
+
+2012-11-06  Huang Dongsung  <luxtella@company100.net>
+
+        Coordinated Graphics: Remove two methods' virtual modifiers in CoordinatedGraphicsLayer.
+        https://bugs.webkit.org/show_bug.cgi?id=101141
+
+        Reviewed by Noam Rosenthal.
+
+        The methods exist for only CoordinatedGraphicsLayer and we have no plan to
+        extend CoordinatedGraphicsLayer.
+
+        * WebProcess/WebPage/CoordinatedGraphics/CoordinatedGraphicsLayer.h:
+        (CoordinatedGraphicsLayer):
+
+2012-11-06  Balazs Kelemen  <kbalazs@webkit.org>
+
+        [CoordinatedGraphics] Access to LayerTreeRenderer::m_renderQueue should be thread safe
+        https://bugs.webkit.org/show_bug.cgi?id=101341
+
+        Reviewed by Noam Rosenthal.
+
+        The queue can be accessed from public API so we should make
+        sure it is not updated concurrently with a threaded render loop.
+
+        * UIProcess/CoordinatedGraphics/LayerTreeRenderer.cpp:
+        (WebKit::LayerTreeRenderer::syncRemoteContent):
+        (WebKit::LayerTreeRenderer::appendUpdate):
+        * UIProcess/CoordinatedGraphics/LayerTreeRenderer.h:
+        (LayerTreeRenderer):
+
+2012-11-06  Mikhail Pozdnyakov  <mikhail.pozdnyakov@intel.com>
+
+        [EFL][WK2] Make Ewk_Context Ewk_Object
+        https://bugs.webkit.org/show_bug.cgi?id=101322
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Ewk_Context is Ewk_Object now and using common ref/unref API.
+
+        * UIProcess/API/efl/EwkViewImpl.cpp:
+        (EwkViewImpl::EwkViewImpl):
+        * UIProcess/API/efl/EwkViewImpl.h:
+        (EwkViewImpl::ewkContext):
+        (EwkViewImpl):
+        * UIProcess/API/efl/ewk_context.cpp:
+        (EwkContext::EwkContext):
+        (EwkContext::~EwkContext):
+        (EwkContext::create):
+        (EwkContext::defaultContext):
+        (EwkContext::cookieManager):
+        (EwkContext::ensureFaviconDatabase):
+        (EwkContext::setFaviconDatabaseDirectoryPath):
+        (EwkContext::faviconDatabase):
+        (EwkContext::storageManager):
+        (EwkContext::requestManager):
+        (EwkContext::vibrationProvider):
+        (EwkContext::addVisitedLink):
+        (EwkContext::setCacheModel):
+        (EwkContext::cacheModel):
+        (ewk_context_cookie_manager_get):
+        (ewk_context_favicon_database_directory_set):
+        (ewk_context_favicon_database_get):
+        (ewk_context_storage_manager_get):
+        (EwkContext::wkContext):
+        (EwkContext::downloadManager):
+        (EwkContext::historyClient):
+        (ewk_context_default_get):
+        (ewk_context_new):
+        (ewk_context_new_with_injected_bundle_path):
+        (ewk_context_url_scheme_register):
+        (ewk_context_vibration_client_callbacks_set):
+        (ewk_context_history_callbacks_set):
+        (ewk_context_visited_link_add):
+        (ewk_context_cache_model_set):
+        (ewk_context_cache_model_get):
+        * UIProcess/API/efl/ewk_context.h:
+        * UIProcess/API/efl/ewk_context_private.h:
+        (EwkContext):
+        * UIProcess/API/efl/ewk_view.cpp:
+        (createEwkView):
+        (ewk_view_base_add):
+        (ewk_view_smart_add):
+        (ewk_view_add_with_context):
+        * UIProcess/API/efl/tests/test_ewk2_context.cpp:
+        (TEST_F):
+        * UIProcess/efl/DownloadManagerEfl.cpp:
+        (WebKit::DownloadManagerEfl::DownloadManagerEfl):
+        * UIProcess/efl/DownloadManagerEfl.h:
+        (WebKit::DownloadManagerEfl::create):
+        (DownloadManagerEfl):
+        * UIProcess/efl/PageClientBase.cpp:
+        (WebKit::PageClientBase::handleDownloadRequest):
+        * UIProcess/efl/RequestManagerClientEfl.cpp:
+        (WebKit::RequestManagerClientEfl::RequestManagerClientEfl):
+        * UIProcess/efl/RequestManagerClientEfl.h:
+        (WebKit::RequestManagerClientEfl::create):
+        (RequestManagerClientEfl):
+
+2012-11-06  Balazs Kelemen  <kbalazs@webkit.org>
+
+        [CoordinatedGraphics] compositing/iframes/connect-compositing-iframe.html crashes
+        https://bugs.webkit.org/show_bug.cgi?id=101232
+
+        Reviewed by Jocelyn Turcotte.
+
+        The crash is happening in CoordinatedGraphicsLayer::flushCompositingState
+        because we dereferencing a null m_coordinatedGraphicsLayerClient.
+        This happens when the root layer became composited because it has content overlapping
+        with an inner iframe that is composited. In this case the RenderLayerCompositor attaches
+        the layer with RootLayerAttachedViaEnclosingFrame attachment flag and do not call
+        ChromeClient::attachRootGraphcisLayer so we don't have a chance to set m_coordinatedGraphicsLayerClient.
+        The solution is to set the client early in the factory method.
+
+        * WebProcess/WebPage/CoordinatedGraphics/LayerTreeCoordinator.cpp:
+        (WebKit::LayerTreeCoordinator::createGraphicsLayer):
+
+2012-11-06  Viatcheslav Ostapenko  <v.ostapenko@samsung.com>
+
+        [EFL] [WK2] Random crash in Minibrowser
+        https://bugs.webkit.org/show_bug.cgi?id=101241
+
+        Reviewed by Gyuyoung Kim.
+
+        Do not clear GL context and GL surface in exitAcceleratedCompositing.
+
+        * UIProcess/API/efl/EwkViewImpl.cpp:
+        (EwkViewImpl::createGLSurface):
+        (EwkViewImpl::enterAcceleratedCompositingMode):
+        (EwkViewImpl::exitAcceleratedCompositingMode):
+
+2012-11-05  Sam Weinig  <sam@webkit.org>
+
+        Need a way to send and receive messages between the WKWebProcessPlugIn object and the client
+        https://bugs.webkit.org/show_bug.cgi?id=101282
+
+        Reviewed by Anders Carlsson.
+
+        API wise, this adds:
+            - A connection property on the WKWebProcessPlugInController
+            - A method to send messages across a WKConnection (sendMessageWithName:body).
+
+        It also implements message sending and receiving for WKConnection. Message bodies are currently
+        restricted to being object graphs with values that are property list types, but in the future, should
+        support all types conforming to the NSSecureCoding protocol.
+
+        * Shared/WebConnection.cpp:
+        (WebKit::WebConnection::postMessage):
+        (WebKit::WebConnection::handleMessage):
+        * Shared/WebConnection.h:
+        (WebConnection):
+        * Shared/WebConnection.messages.in:
+        Switch HandleMessage to be a variadic message to avoid an extra copy and support attachments correctly.
+
+        * Shared/mac/ArgumentCodersMac.h:
+        * Shared/mac/ArgumentCodersMac.mm:
+        (CoreIPC::typeFromObject):
+        (CoreIPC::encode):
+        (CoreIPC::decode):
+        Add support for encoding/decoding NSArray, NSDate and NSData.
+
+        * UIProcess/API/mac/WKConnection.h:
+        * UIProcess/API/mac/WKConnection.mm:
+        (-[WKConnection sendMessageWithName:body:]):
+        (didReceiveMessage):
+        Implement message sending and receiving.
+
+        * WebProcess/InjectedBundle/API/mac/WKWebProcessPlugIn.h:
+        * WebProcess/InjectedBundle/API/mac/WKWebProcessPlugIn.mm:
+        (-[WKWebProcessPlugInController _initWithPrincipalClassInstance:bundleRef:]):
+        (-[WKWebProcessPlugInController connection]):
+        Add a wrapper for the WKConnectionRef vended via WKBundleGetApplicationConnection() and expose it as
+        API on the WKWebProcessPlugInController.
+
+2012-11-05  Jinwoo Song  <jinwoo7.song@samsung.com>
+
+        [EFL][WK2] Fix wrong coding style in the boilerplates
+        https://bugs.webkit.org/show_bug.cgi?id=101283
+
+        Reviewed by Gyuyoung Kim.
+
+        Fix boilerplate which have wrong coding style.
+
+        * UIProcess/efl/InputMethodContextEfl.cpp:
+        * UIProcess/efl/InputMethodContextEfl.h:
+        * UIProcess/efl/PageClientDefaultImpl.cpp:
+        * UIProcess/efl/PageClientDefaultImpl.h:
+        * UIProcess/efl/PageClientLegacyImpl.cpp:
+        * UIProcess/efl/PageClientLegacyImpl.h:
+
+2012-11-05  KyungTae Kim  <ktf.kim@samsung.com>
+
+        [EFL][WK2] Fix build warning in PageClientLegacyImpl.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=101266
+
+        Reviewed by Laszlo Gombos.
+
+        The 'size' is not used when !USE(TILED_BACKING_STORE)
+        Use UNUSED_PARAM macro for removing -Wunused-parameter warning
+
+        * UIProcess/efl/PageClientLegacyImpl.cpp:
+        (WebKit::PageClientLegacyImpl::updateViewportSize):
+
+2012-11-05  Anders Carlsson  <andersca@apple.com>
+
+        Begin stubbing out the new remote layer tree drawing area
+        https://bugs.webkit.org/show_bug.cgi?id=101256
+
+        Reviewed by Andreas Kling.
+
+        * Shared/DrawingAreaInfo.h:
+        * UIProcess/mac/RemoteLayerTreeDrawingAreaProxy.h:
+        * UIProcess/mac/RemoteLayerTreeDrawingAreaProxy.mm:
+        * WebKit2.xcodeproj/project.pbxproj:
+        * WebProcess/WebPage/DrawingArea.cpp:
+        * WebProcess/WebPage/mac/RemoteLayerTreeDrawingArea.h:
+        * WebProcess/WebPage/mac/RemoteLayerTreeDrawingArea.mm:
+
+2012-11-05  Alexey Proskuryakov  <ap@apple.com>
+
+        Get rid of setCookieStoragePrivateBrowsingEnabled.
+        https://bugs.webkit.org/show_bug.cgi?id=101247
+
+        Reviewed by Brady Eidson.
+
+        * WebProcess/InjectedBundle/InjectedBundle.cpp:
+        (WebKit::InjectedBundle::switchNetworkLoaderToNewTestingSession): Added a FIXME.
+
+        * WebProcess/WebCoreSupport/mac/WebSystemInterface.mm: (InitWebCoreSystemInterface):
+        We no longer have this function.
+
+2012-11-05  Simon Fraser  <simon.fraser@apple.com>
+
+        Fix layer borders to cleaning appear and disappear on switching
+        https://bugs.webkit.org/show_bug.cgi?id=101136
+
+        Reviewed by Sam Weinig.
+        
+        Remove the GraphicsLayerClient methods showDebugBorders() and
+        showRepaintCounter().
+        
+        * UIProcess/CoordinatedGraphics/LayerTreeRenderer.h:
+        * WebProcess/WebPage/CoordinatedGraphics/LayerTreeCoordinator.cpp:
+        * WebProcess/WebPage/CoordinatedGraphics/LayerTreeCoordinator.h:
+        (LayerTreeCoordinator):
+        * WebProcess/WebPage/ca/LayerTreeHostCA.cpp:
+        * WebProcess/WebPage/ca/LayerTreeHostCA.h:
+        (LayerTreeHostCA):
+        * WebProcess/WebPage/gtk/LayerTreeHostGtk.cpp:
+        * WebProcess/WebPage/gtk/LayerTreeHostGtk.h:
+        (LayerTreeHostGtk):
+        * WebProcess/WebPage/mac/TiledCoreAnimationDrawingArea.h:
+        (TiledCoreAnimationDrawingArea):
+        * WebProcess/WebPage/mac/TiledCoreAnimationDrawingArea.mm:
+
+2012-11-05  Yael Aharon  <yael.aharon@intel.com>
+
+        [EFL][WK2] Allow using ACCELERATED_COMPOSITING without COORDINATED_GRAPHICS
+        https://bugs.webkit.org/show_bug.cgi?id=100674
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Make a distinction between calling ewk_view_base_add and ewk_view_smart_add.
+        Calling ewk_view_base_add creates a desktop style view, that does not support
+        fixed layout size, while calling ewk_view_smart_add does support fixed layout size.
+        As a result, WebKitTestRunner and the inspector window do not support
+        fixed layout size, while MiniBrowser does. This change allows many DumpAsText
+        layout tests to pass without modification, when AC is enabled.
+
+        * PlatformEfl.cmake:
+        * UIProcess/API/efl/EwkViewImpl.cpp:
+        (EwkViewImpl::EwkViewImpl):
+        (EwkViewImpl::transformFromScene):
+        (EwkViewImpl::informLoadCommitted):
+        (EwkViewImpl::enterAcceleratedCompositingMode):
+        (EwkViewImpl::informContentsSizeChange):
+        * UIProcess/API/efl/EwkViewImpl.h:
+        (WebKit):
+        (EwkViewImpl):
+        (EwkViewImpl::pageClient):
+        (EwkViewImpl::setScaleFactor):
+        (EwkViewImpl::scaleFactor):
+        (EwkViewImpl::setScrollPosition):
+        (EwkViewImpl::scrollPosition):
+        * UIProcess/API/efl/ewk_view.cpp:
+        (_ewk_view_smart_calculate):
+        (createEwkView):
+        (ewk_view_base_add):
+        * UIProcess/efl/PageClientBase.cpp: Copied from Source/WebKit2/UIProcess/efl/PageClientImpl.cpp.
+        (WebKit::PageClientBase::PageClientBase):
+        (WebKit::PageClientBase::~PageClientBase):
+        (WebKit::PageClientBase::viewImpl):
+        (WebKit::PageClientBase::createDrawingAreaProxy):
+        (WebKit::PageClientBase::setViewNeedsDisplay):
+        (WebKit::PageClientBase::displayView):
+        (WebKit::PageClientBase::scrollView):
+        (WebKit::PageClientBase::viewSize):
+        (WebKit::PageClientBase::isViewWindowActive):
+        (WebKit::PageClientBase::isViewFocused):
+        (WebKit::PageClientBase::isViewVisible):
+        (WebKit::PageClientBase::isViewInWindow):
+        (WebKit::PageClientBase::processDidCrash):
+        (WebKit::PageClientBase::didRelaunchProcess):
+        (WebKit::PageClientBase::pageClosed):
+        (WebKit::PageClientBase::toolTipChanged):
+        (WebKit::PageClientBase::setCursor):
+        (WebKit::PageClientBase::setCursorHiddenUntilMouseMoves):
+        (WebKit::PageClientBase::registerEditCommand):
+        (WebKit::PageClientBase::clearAllEditCommands):
+        (WebKit::PageClientBase::canUndoRedo):
+        (WebKit::PageClientBase::executeUndoRedo):
+        (WebKit::PageClientBase::convertToDeviceSpace):
+        (WebKit::PageClientBase::convertToUserSpace):
+        (WebKit::PageClientBase::screenToWindow):
+        (WebKit::PageClientBase::windowToScreen):
+        (WebKit::PageClientBase::doneWithKeyEvent):
+        (WebKit::PageClientBase::doneWithTouchEvent):
+        (WebKit::PageClientBase::createPopupMenuProxy):
+        (WebKit::PageClientBase::createContextMenuProxy):
+        (WebKit::PageClientBase::createColorChooserProxy):
+        (WebKit::PageClientBase::setFindIndicator):
+        (WebKit::PageClientBase::enterAcceleratedCompositingMode):
+        (WebKit::PageClientBase::exitAcceleratedCompositingMode):
+        (WebKit::PageClientBase::updateAcceleratedCompositingMode):
+        (WebKit::PageClientBase::didChangeScrollbarsForMainFrame):
+        (WebKit::PageClientBase::didCommitLoadForMainFrame):
+        (WebKit::PageClientBase::didFinishLoadingDataForCustomRepresentation):
+        (WebKit::PageClientBase::customRepresentationZoomFactor):
+        (WebKit::PageClientBase::setCustomRepresentationZoomFactor):
+        (WebKit::PageClientBase::flashBackingStoreUpdates):
+        (WebKit::PageClientBase::findStringInCustomRepresentation):
+        (WebKit::PageClientBase::countStringMatchesInCustomRepresentation):
+        (WebKit::PageClientBase::updateTextInputState):
+        (WebKit::PageClientBase::handleDownloadRequest):
+        * UIProcess/efl/PageClientBase.h: Copied from Source/WebKit2/UIProcess/efl/PageClientImpl.h.
+        (PageClientBase):
+        * UIProcess/efl/PageClientDefaultImpl.cpp: Added.
+        (WebKit):
+        (WebKit::PageClientDefaultImpl::PageClientDefaultImpl):
+        (WebKit::PageClientDefaultImpl::didCommitLoad):
+        (WebKit::PageClientDefaultImpl::updateViewportSize):
+        (WebKit::PageClientDefaultImpl::didChangeViewportProperties):
+        (WebKit::PageClientDefaultImpl::didChangeContentsSize):
+        (WebKit::PageClientDefaultImpl::pageDidRequestScroll):
+        (WebKit::PageClientDefaultImpl::didRenderFrame):
+        (WebKit::PageClientDefaultImpl::pageTransitionViewportReady):
+        * UIProcess/efl/PageClientDefaultImpl.h: Added.
+        (WebKit):
+        (PageClientDefaultImpl):
+        (WebKit::PageClientDefaultImpl::create):
+        (WebKit::PageClientDefaultImpl::~PageClientDefaultImpl):
+        * UIProcess/efl/PageClientImpl.cpp: Removed.
+        * UIProcess/efl/PageClientImpl.h: Removed.
+        * UIProcess/efl/PageClientLegacyImpl.cpp: Added.
+        (WebKit):
+        (WebKit::PageClientLegacyImpl::PageClientLegacyImpl):
+        (WebKit::PageClientLegacyImpl::didCommitLoad):
+        (WebKit::PageClientLegacyImpl::updateViewportSize):
+        (WebKit::PageClientLegacyImpl::didChangeViewportProperties):
+        (WebKit::PageClientLegacyImpl::didChangeContentsSize):
+        (WebKit::PageClientLegacyImpl::pageDidRequestScroll):
+        (WebKit::PageClientLegacyImpl::didRenderFrame):
+        (WebKit::PageClientLegacyImpl::pageTransitionViewportReady):
+        * UIProcess/efl/PageClientLegacyImpl.h: Added.
+        (WebKit):
+        (PageClientLegacyImpl):
+        (WebKit::PageClientLegacyImpl::create):
+        (WebKit::PageClientLegacyImpl::~PageClientLegacyImpl):
+        * UIProcess/efl/PageViewportControllerClientEfl.cpp:
+        (WebKit::PageViewportControllerClientEfl::updateViewportSize):
+        (WebKit::PageViewportControllerClientEfl::didChangeContentsSize):
+        (WebKit::PageViewportControllerClientEfl::setViewportPosition):
+        (WebKit::PageViewportControllerClientEfl::setContentsScale):
+        * UIProcess/efl/PageViewportControllerClientEfl.h:
+        * UIProcess/efl/WebPageProxyEfl.cpp:
+        (WebKit::WebPageProxy::viewWidget):
+
+2012-11-05  Mikhail Pozdnyakov  <mikhail.pozdnyakov@intel.com>
+
+        [EFL][WK2] Make Ewk_Url_Request, Ewk_Url_Response, Ewk_Navigation_Data  Ewk_Objects
+        https://bugs.webkit.org/show_bug.cgi?id=101205
+
+        Reviewed by Gyuyoung Kim.
+
+        Ewk_Url_Request, Ewk_Url_Response, Ewk_Navigation_Data are using common Ewk_Object interface now.
+
+        * UIProcess/API/efl/EwkViewImpl.h:
+        * UIProcess/API/efl/ewk_download_job.cpp:
+        (Ewk_Download_Job::request):
+        (Ewk_Download_Job::response):
+        (Ewk_Download_Job::setResponse):
+        * UIProcess/API/efl/ewk_download_job_private.h:
+        (Ewk_Download_Job):
+        * UIProcess/API/efl/ewk_navigation_data.cpp:
+        (EwkNavigationData::EwkNavigationData):
+        (EwkNavigationData::originalRequest):
+        (EwkNavigationData::title):
+        (EwkNavigationData::url):
+        (ewk_navigation_data_title_get):
+        (ewk_navigation_data_original_request_get):
+        (ewk_navigation_data_url_get):
+        * UIProcess/API/efl/ewk_navigation_data.h:
+        * UIProcess/API/efl/ewk_navigation_data_private.h:
+        (EwkNavigationData):
+        (EwkNavigationData::create):
+        * UIProcess/API/efl/ewk_navigation_policy_decision.cpp:
+        (Ewk_Navigation_Policy_Decision::Ewk_Navigation_Policy_Decision):
+        (Ewk_Navigation_Policy_Decision::request):
+        * UIProcess/API/efl/ewk_navigation_policy_decision_private.h:
+        (Ewk_Navigation_Policy_Decision::create):
+        (Ewk_Navigation_Policy_Decision):
+        * UIProcess/API/efl/ewk_url_request.cpp:
+        (EwkUrlRequest::EwkUrlRequest):
+        (EwkUrlRequest::url):
+        (EwkUrlRequest::firstParty):
+        (EwkUrlRequest::httpMethod):
+        (ewk_url_request_url_get):
+        (ewk_request_cookies_first_party_get):
+        (ewk_url_request_http_method_get):
+        * UIProcess/API/efl/ewk_url_request.h:
+        * UIProcess/API/efl/ewk_url_request_private.h:
+        (EwkUrlRequest):
+        (EwkUrlRequest::create):
+        * UIProcess/API/efl/ewk_url_response.cpp:
+        (EwkUrlResponse::EwkUrlResponse):
+        (EwkUrlResponse::httpStatusCode):
+        (EwkUrlResponse::url):
+        (EwkUrlResponse::mimeType):
+        (EwkUrlResponse::contentLength):
+        (ewk_url_response_url_get):
+        (ewk_url_response_status_code_get):
+        (ewk_url_response_mime_type_get):
+        (ewk_url_response_content_length_get):
+        * UIProcess/API/efl/ewk_url_response.h:
+        * UIProcess/API/efl/ewk_url_response_private.h:
+        (EwkUrlResponse):
+        (EwkUrlResponse::create):
+        * UIProcess/efl/ContextHistoryClientEfl.cpp:
+        (WebKit::ContextHistoryClientEfl::didNavigateWithNavigationData):
+        * UIProcess/efl/DownloadManagerEfl.cpp:
+        (WebKit::DownloadManagerEfl::didReceiveResponse):
+        * UIProcess/efl/ResourceLoadClientEfl.cpp:
+        (WebKit::ResourceLoadClientEfl::didInitiateLoadForResource):
+        (WebKit::ResourceLoadClientEfl::didSendRequestForResource):
+        (WebKit::ResourceLoadClientEfl::didReceiveResponseForResource):
+
+2012-11-05  Christophe Dumez  <christophe.dumez@intel.com>
+
+        [EFL][WK2] EWK2UnitTestBase.ewk_auth_request_cancel API test is failing after r133389
+        https://bugs.webkit.org/show_bug.cgi?id=101203
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Attempt for continue without credential when the client cancels
+        authentication (or does not handle the authentication request)
+        instead of cancelling the load. We now get a 402 error when
+        when cancelling the authentication, which is the behavior we
+        want (and the behavior we used to have before r133389).
+
+        * UIProcess/API/efl/ewk_auth_request.cpp:
+        (Ewk_Auth_Request::~Ewk_Auth_Request):
+        (Ewk_Auth_Request::continueWithoutCredential):
+        (ewk_auth_request_cancel):
+        * UIProcess/API/efl/ewk_auth_request_private.h:
+        (Ewk_Auth_Request):
+        * UIProcess/API/efl/tests/test_ewk2_auth_request.cpp:
+        (TEST_F):
+
+2012-11-05  Christophe Dumez  <christophe.dumez@intel.com>
+
+        [EFL][WK2] The icon database path should be set by the client
+        https://bugs.webkit.org/show_bug.cgi?id=101182
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        No longer set the favicon database path in database instance getter.
+        Instead, a new ewk_context_favicon_database_directory_set() API
+        function was added to let the client set the icon database path.
+        This is needed because the icon database path can only be set once
+        and setting it unconditionally in the getter prevents the client
+        from setting it.
+
+        This will also avoid crashes in WebKitTestRunner since WKTR was
+        setting the path once and ewk_context was attempting to override it.
+
+        Note that the favicon database functionality is disabled until the
+        client sets its path.
+
+        * UIProcess/API/efl/ewk_context.cpp:
+        (Ewk_Context::ensureFaviconDatabase):
+        (Ewk_Context::setFaviconDatabaseDirectoryPath):
+        (Ewk_Context::faviconDatabase):
+        (ewk_context_favicon_database_directory_set):
+        * UIProcess/API/efl/ewk_context.h:
+        * UIProcess/API/efl/ewk_context_private.h:
+        (Ewk_Context):
+        * UIProcess/API/efl/ewk_favicon_database.cpp:
+        (Ewk_Favicon_Database::Ewk_Favicon_Database):
+        (Ewk_Favicon_Database::~Ewk_Favicon_Database):
+        (Ewk_Favicon_Database::iconURLForPageURL):
+        (Ewk_Favicon_Database::iconForPageURL):
+        (Ewk_Favicon_Database::getIconSurfaceSynchronously):
+        * UIProcess/API/efl/ewk_favicon_database_private.h:
+        (WebKit):
+        (Ewk_Favicon_Database::create):
+        (Ewk_Favicon_Database):
+        * UIProcess/API/efl/tests/test_ewk2_favicon_database.cpp:
+        (TEST_F):
+
+2012-11-04  Halton Huo  <halton.huo@intel.com>
+
+        [EFL] Use _LIBRARIES instead of _LIBRARY
+        https://bugs.webkit.org/show_bug.cgi?id=101042
+
+        Reviewed by Gyuyoung Kim.
+
+        In CMake Find files, _LIBRARY is intended for internal use, should
+        use _LIBRARIES instead.
+
+        * PlatformEfl.cmake: s/_LIBRARY}/_LIBRARIES}
+
+2012-11-04  Jon Lee  <jonlee@apple.com>
+
+        Expose security origin to BundleFrame
+        https://bugs.webkit.org/show_bug.cgi?id=101139
+        <rdar://problem/12629900>
+
+        Reviewed by Darin Adler.
+
+        Create a WebSecurityOrigin instance, sharing the security origin instance
+        that comes directly from the frame's document. We can do this because the
+        WK2 API only retrieves information about the origin, and because those
+        results are returned as copies. The security origin holds no references
+        that could lead to a retain cycle, avoiding the possibility that the
+        injected bundle accidentally keeps something alive.
+
+        * Shared/API/c/WKSharedAPICast.h:
+        (WebKit::toCopiedAPI): Create copied API for WebCore::SecurityOrigin
+        instances.
+        * Shared/WebSecurityOrigin.h:
+        (WebKit::WebSecurityOrigin::create): Add a new create() function that
+        takes a PassRefPtr to a WebCore SecurityOrigin instance.
+        (WebKit::WebSecurityOrigin::createFromString): Refactor to use new create()
+        function.
+        (WebKit::WebSecurityOrigin::createFromDatabaseIdentifier): Refactor to
+        use new create() function.
+        (WebKit::WebSecurityOrigin::create): Refactor to use new create()
+        function.
+        * WebProcess/InjectedBundle/API/c/WKBundleFrame.cpp:
+        (WKBundleFrameCopySecurityOrigin): Add function to retrieve the security
+        origin as a WK2 API object.
+        * WebProcess/InjectedBundle/API/c/WKBundleFrame.h:
+
+2012-11-02  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        [EFL] Unify transforms in WK2
+        https://bugs.webkit.org/show_bug.cgi?id=101051
+
+        Reviewed by Simon Hausmann.
+
+        Move our transforms into EwkViewImpl and use them
+        everywhere needed.
+
+        * UIProcess/API/efl/EwkViewImpl.cpp:
+        (EwkViewImpl::smartData):
+        (EwkViewImpl::transformFromScene):
+        (EwkViewImpl::transformToScene):
+        (EwkViewImpl::transformToScreen):
+        (EwkViewImpl::displayTimerFired):
+        * UIProcess/API/efl/EwkViewImpl.h:
+        (WebCore):
+        (EwkViewImpl):
+        (EwkViewImpl::pageViewportControllerClient):
+        (EwkViewImpl::pageViewportController):
+        * UIProcess/API/efl/ewk_view.cpp:
+        (_ewk_view_smart_mouse_wheel):
+        (_ewk_view_smart_mouse_down):
+        (_ewk_view_smart_mouse_up):
+        (_ewk_view_smart_mouse_move):
+        (ewk_view_feed_touch_event):
+
+2012-11-03  Alexey Proskuryakov  <ap@apple.com>
+
+        Get rid of USE(CFURLSTORAGESESSIONS)
+        https://bugs.webkit.org/show_bug.cgi?id=101131
+
+        Reviewed by Sam Weinig.
+
+        * Shared/WebProcessCreationParameters.cpp:
+        (WebKit::WebProcessCreationParameters::encode):
+        (WebKit::WebProcessCreationParameters::decode):
+        * Shared/WebProcessCreationParameters.h:
+        (WebProcessCreationParameters):
+        * UIProcess/win/WebContextWin.cpp:
+        (WebKit::WebContext::platformInitializeWebProcess):
+        * WebProcess/Cookies/mac/WebCookieManagerMac.mm:
+        (WebKit::WebCookieManager::platformSetHTTPCookieAcceptPolicy):
+        * WebProcess/InjectedBundle/InjectedBundle.cpp:
+        (WebKit::InjectedBundle::switchNetworkLoaderToNewTestingSession):
+        * WebProcess/WebPage/mac/WebPageMac.mm:
+        (WebKit::WebPage::platformHasLocalDataForURL):
+        (WebKit::cachedResponseForURL):
+        * WebProcess/WebPage/win/WebPageWin.cpp:
+        (WebKit::cachedResponseForURL):
+        * WebProcess/WebProcess.cpp:
+        (WebKit::WebProcess::initializeWebProcess):
+        * WebProcess/win/WebProcessWin.cpp:
+        (WebKit::WebProcess::platformSetCacheModel):
+        (WebKit::WebProcess::platformClearResourceCaches):
+
+2012-11-03  Pavel Feldman  <pfeldman@chromium.org>
+
+        REGRESSION (r132014-r132047): Webkit Inspector Window docking broken
+        https://bugs.webkit.org/show_bug.cgi?id=101125
+
+        Reviewed by Vsevolod Vlasov.
+
+        Migrated from ?docked= to ?dockSide= format.
+
+        * UIProcess/WebInspectorProxy.cpp:
+        (WebKit::WebInspectorProxy::createInspectorPage):
+
+2012-10-25  Martin Robinson  <mrobinson@igalia.com>
+
+        [GTK] Move soup authentication from GtkAuthenticationDialog to WebCore
+        https://bugs.webkit.org/show_bug.cgi?id=99914
+
+        Reviewed by Carlos Garcia Campos.
+
+        Instead of passing the libsoup objects to the GtkAuthenticationDialog, pass the
+        AuthenticationChallenge itself.
+
+        * WebProcess/WebCoreSupport/gtk/WebFrameLoaderClientGtk.cpp:
+        (WebKit::WebFrameLoaderClient::dispatchDidReceiveAuthenticationChallenge):
+
+2012-11-02  Anders Carlsson  <andersca@apple.com>
+
+        Very speculative ArgumentDecoder crash fix
+        https://bugs.webkit.org/show_bug.cgi?id=101130
+        <rdar://problem/11917046>
+
+        Reviewed by Sam Weinig.
+
+        Switch from fastMalloc/fastFree to system malloc/free in the hopes that it'll give more information about
+        a crash inside TCMalloc when freeing the argument data. (It seems unlikely that this is a bug in TCMalloc, but
+        switching to the system malloc could potentially give better error reporting).
+
+        * Platform/CoreIPC/ArgumentDecoder.cpp:
+        (CoreIPC::ArgumentDecoder::~ArgumentDecoder):
+        (CoreIPC::ArgumentDecoder::initialize):
+
+2012-11-02  Anders Carlsson  <andersca@apple.com>
+
+        Don't instantiate the Java plug-in if it's inactive
+        https://bugs.webkit.org/show_bug.cgi?id=101102
+        <rdar://problem/12595679>
+
+        Reviewed by Andreas Kling.
+
+        * Shared/Plugins/PluginModuleInfo.h:
+        Add a PluginModuleLoadPolicy enum.
+
+        * UIProcess/Plugins/PluginInfoStore.cpp:
+        (WebKit::PluginInfoStore::policyForPlugin):
+        * UIProcess/Plugins/PluginInfoStore.h:
+        (PluginInfoStore):
+        Rename shouldBlockPlugin to policyForPlugin and make it return an enum so we can handle inactive plug-ins.
+        
+        * UIProcess/Plugins/mac/PluginInfoStoreMac.mm:
+        (WebKit::shouldBlockPlugin):
+        Add helper function.
+
+        (WebKit::PluginInfoStore::policyForPlugin):
+        If the Java plug-in is inactive, return PluginModuleInactive.
+
+        (WebKit::PluginInfoStore::reactivateInactivePlugin):
+        If the given plug-in is the Java plug-in, call WKJLReportWebComponentsUsed() to reactivate it.
+
+        * UIProcess/WebPageProxy.cpp:
+        (WebKit::WebPageProxy::unavailablePluginButtonClicked):
+        If the plug-in is inactive, try to reactivate it and reload the page if reactivation succeeded.
+
+        * UIProcess/WebProcessProxy.cpp:
+        (WebKit::WebProcessProxy::getPluginPath):
+        * UIProcess/WebProcessProxy.h:
+        This now returns a plug-in load policy.
+
+        * UIProcess/WebProcessProxy.messages.in:
+        GetPluginPack now returns a load policy enum.
+
+        * WebProcess/WebCoreSupport/WebChromeClient.cpp:
+        (WebKit::WebChromeClient::shouldUnavailablePluginMessageBeButton):
+        Change this to a switch statement and always return true for RenderEmbeddedObject::PluginInactive.
+
+        (WebKit::WebChromeClient::unavailablePluginButtonClicked):
+        Add RenderEmbeddedObject::PluginInactive to the assertion.
+
+        * WebProcess/WebPage/WebPage.cpp:
+        (WebKit::WebPage::createPlugin):
+        Update now that GetPluginPath returns a pluginLoadPolicy enum.
+
+        (WebKit::canPluginHandleResponse):
+        Ditto.
+
+2012-11-02  Alexey Proskuryakov  <ap@apple.com>
+
+        [Mac] ResourceHandle changes for network process
+        https://bugs.webkit.org/show_bug.cgi?id=101111
+
+        Reviewed by Jessie Berlin.
+
+        * NetworkProcess/mac/NetworkProcessMainMac.mm: (WebKit::NetworkProcessMain):
+        We want to use WebKitSystemInterface in network process.
+        * NetworkProcess/mac/RemoteNetworkingContext.h:
+        (WebKit::RemoteNetworkingContext::create): Added a constructor and a create function.
+        Switched from scheduledRunLoopPairs() to the new scheduledOperationQueue().
+
+        * NetworkProcess/mac/RemoteNetworkingContext.mm:
+        (WebKit::RemoteNetworkingContext::RemoteNetworkingContext):
+        (WebKit::RemoteNetworkingContext::scheduledOperationQueue):
+        Ditto.
+
+2012-11-02  Simon Fraser  <simon.fraser@apple.com>
+
+        Enable SUBPIXEL_LAYOUT on Mac
+        https://bugs.webkit.org/show_bug.cgi?id=101076
+
+        Reviewed by Dave Hyatt.
+
+        Define ENABLE_SUBPIXEL_LAYOUT and include it in FEATURE_DEFINES.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2012-11-02  Anders Carlsson  <andersca@apple.com>
+
+        Add a PluginInactive plug-in unavailability reason
+        https://bugs.webkit.org/show_bug.cgi?id=101089
+
+        Reviewed by Sam Weinig.
+
+        * UIProcess/WebPageProxy.cpp:
+        (WebKit::WebPageProxy::unavailablePluginButtonClicked):
+
+2012-11-02  Adam Barth  <abarth@webkit.org>
+
+        ENABLE(UNDO_MANAGER) is disabled everywhere and is not under active development
+        https://bugs.webkit.org/show_bug.cgi?id=100711
+
+        Reviewed by Eric Seidel.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2012-11-02  Christophe Dumez  <christophe.dumez@intel.com>
+
+        [WK2][EFL] Crash when calling WebOpenPanelResultListenerProxy::cancel() after PageClient is destroyed
+        https://bugs.webkit.org/show_bug.cgi?id=100977
+
+        Reviewed by Alexey Proskuryakov.
+
+        Call WebPageProxy::close() in EwkViewImpl's destructor to avoid crashes
+        if other objects keep a reference to the WebPageProxy and try to use
+        it after the view (and therefore the PageClient) is destroyed.
+
+        * UIProcess/API/efl/EwkViewImpl.cpp:
+        (EwkViewImpl::~EwkViewImpl):
+
+2012-11-02  Martin Robinson  <mrobinson@igalia.com>
+
+        [GTK] Remove dependency on SoupPasswordManager
+        https://bugs.webkit.org/show_bug.cgi?id=100775
+
+        Reviewed by Carlos Garcia Campos.
+
+        Add a libsecret dependency to the build. This is necessary so that we can remove
+        a dependency on SoupPasswordManager.
+
+        * GNUmakefile.am: Add libsecret CFLAGS to the WebKit2 build.
+
+2012-11-02  Byungwoo Lee  <bw80.lee@samsung.com>
+
+        [EFL][WK2] Change the scope of locking in WorkQueueEfl.cpp.
+        https://bugs.webkit.org/show_bug.cgi?id=98978
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Release the m_workItemQueueLock and m_timerWorkItemsLock mutexes
+        immediately after the protected resource is no longer modified to
+        prevent a possible source of a deadlock.
+
+        And additional mutex locker for the m_writeToPipeDescriptor is added
+        to ensure thread-safety of the sendMessageToThread() function.
+
+        * Platform/WorkQueue.h:
+        (WorkQueue):
+        * Platform/efl/WorkQueueEfl.cpp:
+        (WorkQueue::insertTimerWorkItem):
+        (WorkQueue::performTimerWork):
+        (WorkQueue::sendMessageToThread):
+        (WorkQueue::dispatch):
+        (WorkQueue::dispatchAfterDelay):
+
+2012-11-02  Mikhail Pozdnyakov  <mikhail.pozdnyakov@intel.com>
+
+        [EFL][WK2] Add API unit tests for Ewk_Object
+        https://bugs.webkit.org/show_bug.cgi?id=101037
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Added API unit tests for Ewk_Object.
+
+        * PlatformEfl.cmake:
+        * UIProcess/API/efl/tests/test_ewk2_object.cpp: Added.
+        (TestEwkObject1):
+        (TestEwkObject1::create):
+        (TestEwkObject1::~TestEwkObject1):
+        (TestEwkObject2):
+        (TestEwkObject2::create):
+        (TEST_F):
+
+2012-11-02  Sudarsana Nagineni  <sudarsana.nagineni@intel.com>
+
+        REGRESSION (r133075): plugins/plugin-javascript-access.html is failing
+        https://bugs.webkit.org/show_bug.cgi?id=101045
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Encode the plugin filename in ArgumentCoder<PluginInfo> so that
+        plugin.filename returns the filename instead of name of the plugin.
+
+        * Shared/WebCoreArgumentCoders.cpp:
+        (CoreIPC::::encode):
+
+2012-11-01  Yael Aharon  <yael.aharon@intel.com>
+
+        [EFL][WK2][AC] Wrong translation of mouse events
+        https://bugs.webkit.org/show_bug.cgi?id=100983
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        The transform that we build for mouse events is scaled by the scale factor.
+        The url bar should not be scaled, so it should be scaled in the oposite
+        direction to compensate for that.
+
+        * UIProcess/API/efl/ewk_view.cpp:
+        (toWebContentTransform):
+
+2012-11-02  Andras Becsi  <andras.becsi@digia.com>
+
+        [Qt][WK2] Add missing variable initialization in PageViewportController
+
+        Reviewed by Jocelyn Turcotte.
+
+        Updating the viewport state depends on uninitialized booleans
+        which it should not.
+
+        * UIProcess/PageViewportController.cpp:
+        (WebKit::PageViewportController::PageViewportController):
+
+2012-11-02  Byungwoo Lee  <bw80.lee@samsung.com>
+
+        [EFL][WK2] Use MutexLocker instead of lock()/unlock().
+        https://bugs.webkit.org/show_bug.cgi?id=101015
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Instead of lock()/unlock(), use MutexLocker in WorkQueue::performWork()
+        and WorkQueue::performTimerWork().
+
+        The locking scope will be more clear and simple with using MutexLocker.
+
+        * Platform/efl/WorkQueueEfl.cpp:
+        (WorkQueue::performWork):
+        (WorkQueue::insertTimerWorkItem):
+        (WorkQueue::performTimerWork):
+        (WorkQueue::dispatchAfterDelay):
+
+2012-11-02  Mikhail Pozdnyakov  <mikhail.pozdnyakov@intel.com>
+
+        [EFL][WK2] Common ref and unref functions for EFL WK2 objects
+        https://bugs.webkit.org/show_bug.cgi?id=100751
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Added common Ewk_Object class with ref/unref API also added several aux functions for safe
+        Ewk_Object conversion. Used new approach on ewk_back_forward_list_item as example.
+
+        * PlatformEfl.cmake:
+        * UIProcess/API/efl/EWebKit2.h:
+        * UIProcess/API/efl/ewk_back_forward_list.cpp:
+        (Ewk_Back_Forward_List::getFromCacheOrCreate):
+        (Ewk_Back_Forward_List::createEinaList):
+        * UIProcess/API/efl/ewk_back_forward_list_item.cpp:
+        (EwkBackForwardListItem::EwkBackForwardListItem):
+        (EwkBackForwardListItem::url):
+        (EwkBackForwardListItem::title):
+        (EwkBackForwardListItem::originalURL):
+        (ewk_back_forward_list_item_url_get):
+        (ewk_back_forward_list_item_title_get):
+        (ewk_back_forward_list_item_original_url_get):
+        * UIProcess/API/efl/ewk_back_forward_list_item.h:
+        * UIProcess/API/efl/ewk_back_forward_list_item_private.h:
+        (EwkBackForwardListItem):
+        (EwkBackForwardListItem::create):
+        * UIProcess/API/efl/ewk_back_forward_list_private.h:
+        * UIProcess/API/efl/ewk_object.cpp: Copied from Source/WebKit2/UIProcess/API/efl/ewk_back_forward_list_item_private.h.
+        (ewk_object_ref):
+        (ewk_object_unref):
+        * UIProcess/API/efl/ewk_object.h: Copied from Source/WebKit2/UIProcess/API/efl/ewk_back_forward_list_item_private.h.
+        * UIProcess/API/efl/ewk_object_private.h: Added.
+        (Ewk_Object):
+        (Ewk_Object::~Ewk_Object):
+        (ewk_object_is_of_type):
+        (ewk_object_cast_check):
+        (ewk_object_cast):
+        * UIProcess/API/efl/tests/test_ewk2_back_forward_list.cpp:
+        (freeEinaList):
+
+2012-11-02  Nandor Huszka  <hnandor@inf.u-szeged.hu>
+
+        [Qt][Mac][Win] Unreviewed build fix after r133182
+        https://bugs.webkit.org/show_bug.cgi?id=100995
+
+        Remove two methods' OVERRIDE and virtual modifiers, because they cannot be found in any base class.
+        Also relocate their prototypes, because they mix with the overridden ones.
+
+        * WebProcess/WebPage/CoordinatedGraphics/CoordinatedGraphicsLayer.h:
+        (CoordinatedGraphicsLayer):
+
+2012-11-02  Jihye Kang  <jye.kang@samsung.com>
+
+        [EFL][WK2] Add ewk_security_origin and ewk_storage_manager APIs
+        https://bugs.webkit.org/show_bug.cgi?id=92827
+
+        Reviewed by Gyuyoung Kim.
+
+        Add ewk_security_origin APIs to get security origin.
+        These APIs will be used to get host, protocol and port of security
+        origin.
+        Add ewk_storage_manager to manage web storage and
+        ewk_storage_manager_origins_get to get origins list of web storage.
+        Add Unit tests for ewk_storage_manager and ewk_security_origin APIs.
+
+        * PlatformEfl.cmake:
+        * UIProcess/API/efl/EWebKit2.h:
+        * UIProcess/API/efl/ewk_context.cpp:
+        (Ewk_Context::storageManager):
+        (ewk_context_storage_manager_get):
+        * UIProcess/API/efl/ewk_context.h:
+        * UIProcess/API/efl/ewk_context_private.h:
+        (Ewk_Context):
+        * UIProcess/API/efl/ewk_security_origin.cpp: Added.
+        (Ewk_Security_Origin::Ewk_Security_Origin):
+        (Ewk_Security_Origin::host):
+        (Ewk_Security_Origin::protocol):
+        (Ewk_Security_Origin::port):
+        (ewk_security_origin_ref):
+        (ewk_security_origin_unref):
+        (ewk_security_origin_host_get):
+        (ewk_security_origin_protocol_get):
+        (ewk_security_origin_port_get):
+        * UIProcess/API/efl/ewk_security_origin.h: Added.
+        * UIProcess/API/efl/ewk_security_origin_private.h: Added.
+        (Ewk_Security_Origin):
+        (Ewk_Security_Origin::create):
+        * UIProcess/API/efl/ewk_storage_manager.cpp: Added.
+        (Ewk_Storage_Manager::Ewk_Storage_Manager):
+        (Ewk_Storage_Manager::getStorageOrigins):
+        (Ewk_Storage_Manager::createOriginList):
+        (_Ewk_Storage_Origins_Async_Get_Context):
+        (_Ewk_Storage_Origins_Async_Get_Context::_Ewk_Storage_Origins_Async_Get_Context):
+        (getStorageOriginsCallback):
+        (ewk_storage_manager_origins_get):
+        * UIProcess/API/efl/ewk_storage_manager.h: Added.
+        * UIProcess/API/efl/ewk_storage_manager_private.h: Added.
+        (Ewk_Storage_Manager):
+        (Ewk_Storage_Manager::create):
+        * UIProcess/API/efl/tests/test_ewk2_context.cpp:
+        (TEST_F):
+        * UIProcess/API/efl/tests/test_ewk2_storage_manager.cpp: Added.
+        (getStorageOriginsCallback):
+        (TEST_F):
+
+2012-11-02  Huang Dongsung  <luxtella@company100.net>
+
+        Coordinated Graphics: Manage the lifecycle of shareable surfaces precisely.
+        https://bugs.webkit.org/show_bug.cgi?id=100797
+
+        Reviewed by Noam Rosenthal.
+
+        Internal Review by Gwang Yoon Hwang and Jae Hyun Park.
+
+        This patch makes UpdateAtlas manage the lifecycle of shareable surfaces
+        containing the updates in the way how CoordinatedTile manages the lifecycle of
+        tiles. Currently, UI Process creates the shareable surface when receiving an
+        UpdateTileForLayer message, but there is no exact point to remove the shareable
+        surface. Now, we introduce new two messages to handle the lifecycle:
+        CreateUpdateAtlas and RemoveUpdateAtlas.
+
+        This patch gives us two benefits.
+        1. Reduce file and mmap operations. Web Process does not need to duplicate a
+        file handle every tile update. UI Process does not need to create a
+        ShareableSurface every UpdateTileForLayer message.
+        2. Save memory. We can remove a ShareableSurface in UI Process when UpdateAtlas
+        in Web Process is removed.
+
+        * Shared/SurfaceUpdateInfo.cpp:
+        (WebKit::SurfaceUpdateInfo::encode):
+        (WebKit::SurfaceUpdateInfo::decode):
+        * Shared/SurfaceUpdateInfo.h:
+        (SurfaceUpdateInfo):
+        * UIProcess/CoordinatedGraphics/LayerTreeCoordinatorProxy.cpp:
+        (WebKit::LayerTreeCoordinatorProxy::updateTileForLayer):
+        (WebKit::LayerTreeCoordinatorProxy::createUpdateAtlas):
+        (WebKit):
+        (WebKit::LayerTreeCoordinatorProxy::removeUpdateAtlas):
+        (WebKit::LayerTreeCoordinatorProxy::purgeBackingStores):
+        * UIProcess/CoordinatedGraphics/LayerTreeCoordinatorProxy.h:
+        (LayerTreeCoordinatorProxy):
+        * UIProcess/CoordinatedGraphics/LayerTreeCoordinatorProxy.messages.in:
+        * WebProcess/WebPage/CoordinatedGraphics/CoordinatedGraphicsLayer.cpp:
+        (WebCore::CoordinatedGraphicsLayer::beginContentUpdate):
+        * WebProcess/WebPage/CoordinatedGraphics/CoordinatedGraphicsLayer.h:
+        (CoordinatedGraphicsLayerClient):
+        (CoordinatedGraphicsLayer):
+        * WebProcess/WebPage/CoordinatedGraphics/CoordinatedTile.cpp:
+        (WebKit::CoordinatedTile::updateBackBuffer):
+        * WebProcess/WebPage/CoordinatedGraphics/CoordinatedTile.h:
+        (CoordinatedTileClient):
+        * WebProcess/WebPage/CoordinatedGraphics/LayerTreeCoordinator.cpp:
+        (WebKit::LayerTreeCoordinator::createUpdateAtlas):
+        (WebKit):
+        (WebKit::LayerTreeCoordinator::removeUpdateAtlas):
+        (WebKit::LayerTreeCoordinator::beginContentUpdate):
+        * WebProcess/WebPage/CoordinatedGraphics/LayerTreeCoordinator.h:
+        (LayerTreeCoordinator):
+        * WebProcess/WebPage/UpdateAtlas.cpp:
+        (WebKit::UpdateAtlas::UpdateAtlas):
+        (WebKit):
+        (WebKit::UpdateAtlas::~UpdateAtlas):
+        (WebKit::UpdateAtlas::beginPaintingOnAvailableBuffer):
+        * WebProcess/WebPage/UpdateAtlas.h:
+        (UpdateAtlasClient):
+        (WebKit):
+        (UpdateAtlas):
+
+2012-11-02  Jinwoo Song  <jinwoo7.song@samsung.com>
+
+        [EFL][WK2] Remove redundant internal function
+        https://bugs.webkit.org/show_bug.cgi?id=100969
+
+        Reviewed by Gyuyoung Kim.
+
+        Remove ewk_view_text_found() in ewk_view.cpp which is not used anymore.
+        Now, "text,found" signal is emitted by DECLARE_EWK_VIEW_CALLBACK(TextFound, "text,found", unsigned) 
+        in EwkViewCallback.h
+
+        * UIProcess/API/efl/ewk_view.cpp:
+
+2012-11-01  Anders Carlsson  <andersca@apple.com>
+
+        Reformat the annotationStyle initializer to appease update-webkit-localizable-strings.
+
+        Rubber-stamped by Dan Bernstein.
+
+        * WebProcess/Plugins/PDF/PDFPlugin.mm:
+
+2012-11-01  Alexandru Chiculita  <achicu@adobe.com>
+
+        [CSS Shaders] Move MeshBoxType out of CustomFilterOperation
+        https://bugs.webkit.org/show_bug.cgi?id=100782
+
+        Reviewed by Dean Jackson.
+
+        Renamed the CustomFilterOperation::MeshBoxType to CustomFilterMeshBoxType.
+
+        * Shared/CoordinatedGraphics/CoordinatedGraphicsArgumentCoders.cpp:
+        (CoreIPC::::decode):
+
+2012-11-01  Beth Dakin  <bdakin@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=100917
+        There should be a way to dump the scrolling tree from the layout tests
+        
+        Reviewed by Simon Fraser.
+
+        * win/WebKit2.def:
+        * win/WebKit2CFLite.def:
+
+2012-11-01  Huang Dongsung  <luxtella@company100.net>
+
+        Coordinated Graphics: Clean up headers of Coordinated Graphics.
+        https://bugs.webkit.org/show_bug.cgi?id=100907
+
+        Reviewed by Noam Rosenthal.
+
+        This patch performs:
+        1. Remove unused methods.
+        2. Change public methods to private if needed.
+        3. Put virtual, OVERRIDE and explicit keywords if needed.
+
+        * UIProcess/CoordinatedGraphics/LayerTreeCoordinatorProxy.h:
+        (LayerTreeCoordinatorProxy):
+        * UIProcess/CoordinatedGraphics/LayerTreeRenderer.h:
+        (LayerTreeRenderer):
+        * WebProcess/WebPage/CoordinatedGraphics/CoordinatedGraphicsLayer.cpp:
+        * WebProcess/WebPage/CoordinatedGraphics/CoordinatedGraphicsLayer.h:
+        (CoordinatedGraphicsLayer):
+        (WebCore::CoordinatedGraphicsLayer::fixedToViewport):
+        (WebCore::CoordinatedGraphicsLayer::setMaskTarget):
+        * WebProcess/WebPage/CoordinatedGraphics/LayerTreeCoordinator.h:
+        (LayerTreeCoordinator):
+
+2012-11-01  Christophe Dumez  <christophe.dumez@intel.com>
+
+        [EFL][WK2] Add Ewk_Auth_Request API
+        https://bugs.webkit.org/show_bug.cgi?id=100858
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Add Ewk_Auth_Request API for the client to handle
+        HTTP authentication.
+
+        * PlatformEfl.cmake:
+        * UIProcess/API/efl/EWebKit2.h:
+        * UIProcess/API/efl/EwkViewCallbacks.h:
+        (EwkViewCallbacks):
+        * UIProcess/API/efl/ewk_auth_request.cpp: Added.
+        (Ewk_Auth_Request::Ewk_Auth_Request):
+        (Ewk_Auth_Request::~Ewk_Auth_Request):
+        (Ewk_Auth_Request::suggestedUsername):
+        (Ewk_Auth_Request::realm):
+        (Ewk_Auth_Request::host):
+        (Ewk_Auth_Request::cancel):
+        (Ewk_Auth_Request::authenticate):
+        (Ewk_Auth_Request::isRetrying):
+        (ewk_auth_request_ref):
+        (ewk_auth_request_unref):
+        (ewk_auth_request_suggested_username_get):
+        (ewk_auth_request_cancel):
+        (ewk_auth_request_authenticate):
+        (ewk_auth_request_retrying_get):
+        (ewk_auth_request_realm_get):
+        (ewk_auth_request_host_get):
+        * UIProcess/API/efl/ewk_auth_request.h: Added.
+        * UIProcess/API/efl/ewk_auth_request_private.h: Added.
+        (WebKit):
+        (Ewk_Auth_Request):
+        (Ewk_Auth_Request::create):
+        * UIProcess/API/efl/ewk_view.h:
+        * UIProcess/API/efl/tests/test_ewk2_auth_request.cpp: Added corresponding API tests.
+        (serverCallback):
+        (onAuthenticationRequest):
+        (TEST_F):
+        (onResourceLoadResponse):
+        * UIProcess/efl/PageLoadClientEfl.cpp:
+        (WebKit::PageLoadClientEfl::didReceiveAuthenticationChallengeInFrame):
+        (WebKit):
+        (WebKit::PageLoadClientEfl::PageLoadClientEfl):
+        * UIProcess/efl/PageLoadClientEfl.h:
+        (PageLoadClientEfl):
+
+2012-11-01  Jocelyn Turcotte  <jocelyn.turcotte@digia.com>
+
+        Fix the Mac breakage
+        https://bugs.webkit.org/show_bug.cgi?id=100383
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        acceleratedCompositingForFixedPositionEnabled needs to be enabled
+        for fixed layout to work efficiently but it's wrong to force it
+        to false if fixed layout isn't enabled.
+
+        Separate hard requirements for fixed layout from rendering optimizations
+        and guard the later with USE(COORDINATED_GRAPHICS).
+        Also add an early return to make sure that ports always having a false
+        useFixedLayout creation parameter won't get their settings adjusted.
+
+        * WebProcess/WebPage/WebPage.cpp:
+        (WebKit::WebPage::setUseFixedLayout):
+
+2012-10-24  Jocelyn Turcotte  <jocelyn.turcotte@digia.com>
+
+        WebIconDatabase: Properly clean up on destruction
+        https://bugs.webkit.org/show_bug.cgi?id=100237
+
+        Reviewed by Brady Eidson.
+
+        * UIProcess/WebIconDatabase.cpp:
+        (WebKit::WebIconDatabase::invalidate):
+        Make sure that IconDatabaseBase::iconDatabase won't return a dangling pointer.
+
+2012-11-01  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        [EFL] Fix event mapping for WebKit2 with coordinated graphics
+        https://bugs.webkit.org/show_bug.cgi?id=100956
+
+        Reviewed by Alexis Menard.
+
+        Apply scale after translation.
+
+        * UIProcess/API/efl/ewk_view.cpp:
+        (toWebContentTransform):
+
+2012-11-01  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        [EFL] Correct our use of the coordinated graphics
+        https://bugs.webkit.org/show_bug.cgi?id=100947
+
+        Reviewed by Alexis Menard.
+
+        Replace the display(...) call with a regular update() on the view.
+        In the coordinated graphics case this updates our view using
+        paintToCurrentGLContext with our viewmodel matrix and clips it to
+        the viewport. This avoid the need to manually joining update regions.
+
+        Unneeded update calls have also been removed and the resizing
+        logic has been improved.
+
+        * UIProcess/API/efl/EwkViewImpl.cpp:
+        (EwkViewImpl::displayTimerFired):
+        (EwkViewImpl::update):
+        * UIProcess/API/efl/EwkViewImpl.h:
+        (WebCore):
+        (EwkViewImpl):
+        (EwkViewImpl::clearEvasGLSurface):
+        * UIProcess/API/efl/ewk_view.cpp:
+        (_ewk_view_smart_calculate):
+        * UIProcess/efl/PageClientImpl.cpp:
+        (WebKit::PageClientImpl::setViewNeedsDisplay):
+        * UIProcess/efl/PageViewportControllerClientEfl.cpp:
+        (WebKit::PageViewportControllerClientEfl::setVisibleContentsRect):
+        (WebKit::PageViewportControllerClientEfl::didChangeContentsSize):
+        (WebKit::PageViewportControllerClientEfl::didChangeVisibleContents):
+        * UIProcess/efl/PageViewportControllerClientEfl.h:
+        (PageViewportControllerClientEfl):
+
+2012-11-01  Jocelyn Turcotte  <jocelyn.turcotte@digia.com>
+
+        [Qt] Double clicks/taps aren't passed down to the page
+        https://bugs.webkit.org/show_bug.cgi?id=100949
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Since we are passing double click events as press events and that
+        they are preceeded by a real press event, double clicks are passed
+        down to the page as triple clicks.
+
+        Ignore double click events and let WebCore::EventHandler handle it
+        through press and release events.
+
+        * Shared/qt/WebEventFactoryQt.cpp:
+        (WebKit::webEventTypeForEvent):
+        * UIProcess/API/qt/qquickwebview.cpp:
+        (QQuickWebViewPrivate::handleMouseEvent):
+        * UIProcess/qt/QtWebPageEventHandler.cpp:
+        (WebKit::QtWebPageEventHandler::handleInputEvent):
+
+2012-11-01  Mikhail Pozdnyakov  <mikhail.pozdnyakov@intel.com>
+
+        [AC][EFL][WK2] Rename PageViewportControllerClientEfl::m_pageViewportController to m_controller
+        https://bugs.webkit.org/show_bug.cgi?id=100933
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        PageViewportControllerClientEfl::m_pageViewportController has to be renamed to m_controller
+        to keep consistency with other ports. Assertinons were also added.
+
+        * UIProcess/efl/PageViewportControllerClientEfl.cpp:
+        (WebKit::PageViewportControllerClientEfl::PageViewportControllerClientEfl):
+        (WebKit::PageViewportControllerClientEfl::updateViewportSize):
+        (WebKit::PageViewportControllerClientEfl::setVisibleContentsRect):
+        (WebKit::PageViewportControllerClientEfl::didResumeContent):
+        (WebKit::PageViewportControllerClientEfl::setController):
+        * UIProcess/efl/PageViewportControllerClientEfl.h:
+        (PageViewportControllerClientEfl):
+
+2012-11-01  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r133126.
+        http://trac.webkit.org/changeset/133126
+        https://bugs.webkit.org/show_bug.cgi?id=100925
+
+        This made EFL API test break on EFL buildbots (Requested by
+        gyuyoung on #webkit).
+
+        * PlatformEfl.cmake:
+        * UIProcess/API/efl/EWebKit2.h:
+        * UIProcess/API/efl/ewk_context.cpp:
+        (Ewk_Context::Ewk_Context):
+        * UIProcess/API/efl/ewk_context.h:
+        * UIProcess/API/efl/ewk_context_private.h:
+        (Ewk_Context):
+        * UIProcess/API/efl/ewk_security_origin.cpp: Removed.
+        * UIProcess/API/efl/ewk_security_origin.h: Removed.
+        * UIProcess/API/efl/ewk_security_origin_private.h: Removed.
+        * UIProcess/API/efl/ewk_storage_manager.cpp: Removed.
+        * UIProcess/API/efl/ewk_storage_manager.h: Removed.
+        * UIProcess/API/efl/ewk_storage_manager_private.h: Removed.
+        * UIProcess/API/efl/tests/test_ewk2_context.cpp:
+        * UIProcess/API/efl/tests/test_ewk2_storage_manager.cpp: Removed.
+
+2012-11-01  Yuni Jeong  <yhnet.jung@samsung.com>
+
+        [WK2] Add APIs to get/set encoding detector
+        https://bugs.webkit.org/show_bug.cgi?id=100066
+
+        Reviewed by Gyuyoung Kim.
+
+        Add setting APIs for encoding dector and a unit test.
+
+        * Shared/WebPreferencesStore.h:
+        (WebKit):
+        * UIProcess/API/C/WKPreferences.cpp:
+        (WKPreferencesSetUsesEncodingDetector):
+        (WKPreferencesGetUsesEncodingDetector):
+        * UIProcess/API/C/WKPreferences.h:
+        * UIProcess/API/efl/ewk_settings.cpp:
+        (ewk_setting_uses_encoding_detector_set):
+        (ewk_setting_uses_encoding_detector_get):
+        * UIProcess/API/efl/ewk_settings.h:
+        * UIProcess/API/efl/tests/test_ewk2_settings.cpp:
+        (TEST_F):
+
+2012-10-31  Jihye Kang  <jye.kang@samsung.com>
+
+        [EFL][WK2] Add ewk_security_origin and ewk_storage_manager APIs
+        https://bugs.webkit.org/show_bug.cgi?id=92827
+
+        Reviewed by Gyuyoung Kim.
+
+        Add ewk_security_origin APIs to get security origin.
+        These APIs will be used to get host, protocol and port of security
+        origin.
+        Add ewk_storage_manager to manage web storage and
+        ewk_storage_manager_origins_get to get origins list of web storage.
+        Add Unit tests for ewk_storage_manager and ewk_security_origin APIs.
+
+        * PlatformEfl.cmake:
+        * UIProcess/API/efl/EWebKit2.h:
+        * UIProcess/API/efl/ewk_context.cpp:
+        (Ewk_Context::storageManager):
+        (ewk_context_storage_manager_get):
+        * UIProcess/API/efl/ewk_context.h:
+        * UIProcess/API/efl/ewk_context_private.h:
+        (Ewk_Context):
+        * UIProcess/API/efl/ewk_security_origin.cpp: Added.
+        (Ewk_Security_Origin::Ewk_Security_Origin):
+        (Ewk_Security_Origin::host):
+        (Ewk_Security_Origin::protocol):
+        (Ewk_Security_Origin::port):
+        (ewk_security_origin_ref):
+        (ewk_security_origin_unref):
+        (ewk_security_origin_host_get):
+        (ewk_security_origin_protocol_get):
+        (ewk_security_origin_port_get):
+        * UIProcess/API/efl/ewk_security_origin.h: Added.
+        * UIProcess/API/efl/ewk_security_origin_private.h: Added.
+        (Ewk_Security_Origin):
+        (Ewk_Security_Origin::create):
+        * UIProcess/API/efl/ewk_storage_manager.cpp: Added.
+        (Ewk_Storage_Manager::Ewk_Storage_Manager):
+        (Ewk_Storage_Manager::getStorageOrigins):
+        (Ewk_Storage_Manager::createOriginList):
+        (_Ewk_Storage_Origins_Async_Get_Context):
+        (_Ewk_Storage_Origins_Async_Get_Context::_Ewk_Storage_Origins_Async_Get_Context):
+        (getStorageOriginsCallback):
+        (ewk_storage_manager_origins_get):
+        * UIProcess/API/efl/ewk_storage_manager.h: Added.
+        * UIProcess/API/efl/ewk_storage_manager_private.h: Added.
+        (Ewk_Storage_Manager):
+        (Ewk_Storage_Manager::create):
+        * UIProcess/API/efl/tests/test_ewk2_context.cpp:
+        (TEST_F):
+        * UIProcess/API/efl/tests/test_ewk2_storage_manager.cpp: Added.
+        (getStorageOriginsCallback):
+        (TEST_F):
+
+2012-10-31  Alexandru Chiculita  <achicu@adobe.com>
+
+        CustomFilterOperation parameters list is not decoded correctly in CoordinatedGraphicsArgumentCoders
+        https://bugs.webkit.org/show_bug.cgi?id=100889
+
+        Reviewed by Noam Rosenthal.
+
+        The custom filters parameters list was initialized with a specific size and then
+        the decoder was expected to fill it with all the decoded parameters. The decoder was
+        using the append command which added the paramters at the end, so it doubled the size
+        of the vector leaving empty spaces at the beginning of the list. Fixed it by writting
+        directly into the allocated space.
+
+        No new tests, the code path is not activated yet.
+
+        * Shared/CoordinatedGraphics/CoordinatedGraphicsArgumentCoders.cpp:
+        (CoreIPC::::decode):
+
+2012-10-31  Sam Weinig  <sam@webkit.org>
+
+        Convert the rest of the encoders to take the encoder as a reference
+        https://bugs.webkit.org/show_bug.cgi?id=100821
+
+        Reviewed by Anders Carlsson.
+
+        * Platform/CoreIPC/ArgumentCoders.h:
+        (CoreIPC::SimpleArgumentCoder::encode):
+        * Shared/CoordinatedGraphics/CoordinatedGraphicsArgumentCoders.cpp:
+        (CoreIPC::::encode):
+        (CoreIPC::encodeTimingFunction):
+        * Shared/CoordinatedGraphics/CoordinatedGraphicsArgumentCoders.h:
+        * Shared/PrintInfo.cpp:
+        (WebKit::PrintInfo::encode):
+        * Shared/SessionState.cpp:
+        * Shared/UserMessageCoders.h:
+        (WebKit::UserMessageDecoder::baseDecode):
+        * Shared/WebCoreArgumentCoders.cpp:
+        (CoreIPC::::encode):
+        * Shared/WebCoreArgumentCoders.h:
+        * Shared/WebGeolocationPosition.cpp:
+        (WebKit::WebGeolocationPosition::Data::encode):
+        * Shared/WebLayerTreeInfo.cpp:
+        (WebKit::WebLayerInfo::encode):
+        * Shared/gtk/ArgumentCodersGtk.cpp:
+        (CoreIPC::encodeImage):
+        (CoreIPC::encodeDataObject):
+        (CoreIPC::::encode):
+        (CoreIPC::encodeGKeyFile):
+        (CoreIPC::encode):
+        * Shared/gtk/ArgumentCodersGtk.h:
+        * Shared/mac/WebCoreArgumentCodersMac.mm:
+        (CoreIPC::::encodePlatformData):
+        (CoreIPC::::encode):
+        * Shared/qt/ArgumentCodersQt.cpp:
+        (CoreIPC::::encode):
+        * Shared/qt/ArgumentCodersQt.h:
+        (CoreIPC):
+        * Shared/qt/WebCoreArgumentCodersQt.cpp:
+        (CoreIPC::::encodePlatformData):
+        * Shared/soup/WebCoreArgumentCodersSoup.cpp:
+        (CoreIPC::::encodePlatformData):
+        * Shared/win/WebCoreArgumentCodersWin.cpp:
+        (CoreIPC::::encodePlatformData):
+        * WebProcess/WebPage/DecoderAdapter.cpp:
+        (WebKit::DecoderAdapter::decodeBytes):
+        * WebProcess/WebPage/EncoderAdapter.cpp:
+        (WebKit::EncoderAdapter::encodeBytes):
+
+2012-10-31  Jesse van den Kieboom  <jessevdk@gnome.org>
+
+        Enable webkit2 introspection
+        https://bugs.webkit.org/show_bug.cgi?id=94313
+
+        Reviewed by Martin Robinson.
+
+        This patch enables generation of introspection information for webkit2
+        in the same was as it is done for webkit. The resulting gir and
+        typelib file are named WebKit2-3.0.{gir,typelib}.
+
+        * GNUmakefile.am:
+        * UIProcess/API/gtk/WebKitBackForwardList.cpp:
+
+2012-10-31  Christophe Dumez  <christophe.dumez@intel.com>
+
+        [EFL][WK2] Add Ewk_File_Chooser_Request API
+        https://bugs.webkit.org/show_bug.cgi?id=100818
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Add Ewk_File_Chooser_Request API so that the client
+        can handle file chooser requests (e.g. Show a file
+        picker dialog) when the user clicks on an input
+        element of type "file".
+
+        * PlatformEfl.cmake:
+        * UIProcess/API/efl/EWebKit2.h:
+        * UIProcess/API/efl/EwkViewCallbacks.h:
+        (EwkViewCallbacks):
+        * UIProcess/API/efl/ewk_file_chooser_request.cpp: Added.
+        (Ewk_File_Chooser_Request::Ewk_File_Chooser_Request):
+        (Ewk_File_Chooser_Request::~Ewk_File_Chooser_Request):
+        (Ewk_File_Chooser_Request::allowMultipleFiles):
+        (Ewk_File_Chooser_Request::acceptedMIMETypes):
+        (Ewk_File_Chooser_Request::cancel):
+        (Ewk_File_Chooser_Request::chooseFiles):
+        (ewk_file_chooser_request_ref):
+        (ewk_file_chooser_request_unref):
+        (ewk_file_chooser_request_allow_multiple_files_get):
+        (ewk_file_chooser_request_accepted_mimetypes_get):
+        (ewk_file_chooser_request_cancel):
+        (ewk_file_chooser_request_files_choose):
+        (ewk_file_chooser_request_file_choose):
+        * UIProcess/API/efl/ewk_file_chooser_request.h: Added.
+        * UIProcess/API/efl/ewk_file_chooser_request_private.h: Added.
+        (WebKit):
+        (Ewk_File_Chooser_Request):
+        (Ewk_File_Chooser_Request::create):
+        (Ewk_File_Chooser_Request::wasHandled):
+        * UIProcess/API/efl/ewk_view.h:
+        * UIProcess/API/efl/tests/resources/file_chooser.html: Added.
+        * UIProcess/API/efl/tests/test_ewk2_file_chooser_request.cpp: Added corresponding
+        unit tests.
+        (onFileChooserRequest):
+        (compareStrings):
+        (freeStringList):
+        (TEST_F):
+        * UIProcess/efl/PageUIClientEfl.cpp:
+        (WebKit::PageUIClientEfl::runOpenPanel):
+        (WebKit):
+        (WebKit::PageUIClientEfl::PageUIClientEfl):
+        * UIProcess/efl/PageUIClientEfl.h:
+        (PageUIClientEfl):
+
+2012-10-31  Noam Rosenthal  <noam.rosenthal@nokia.com>
+
+        [Texmap] Enable filter animations in GraphicsLayerAnimation
+        https://bugs.webkit.org/show_bug.cgi?id=100318
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Encode/decode KeyframeValues of type FilterOperations.
+
+        * Shared/CoordinatedGraphics/CoordinatedGraphicsArgumentCoders.cpp:
+        (CoreIPC::::encode):
+        (CoreIPC::::decode):
+
+2012-10-31  Christophe Dumez  <christophe.dumez@intel.com>
+
+        [EFL][WK2][AC] Avoid storing dirty rects in a Vector inside EwkViewImpl
+        https://bugs.webkit.org/show_bug.cgi?id=100736
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        No longer store dirty rectangles in a temporary Vector and construct
+        a WebCore::Region directly from them instead. This avoid having to
+        iterate over the Vector in EwkViewImpl::displayTimerFired() to construct
+        a Region object, which should be more efficient.
+
+        * UIProcess/API/efl/EwkViewImpl.cpp:
+        (EwkViewImpl::displayTimerFired):
+        (EwkViewImpl::redrawRegion):
+        * UIProcess/API/efl/EwkViewImpl.h:
+        (WebCore):
+        (EwkViewImpl):
+
+2012-10-30  Anders Carlsson  <andersca@apple.com>
+
+        Connection::Client::didReceiveInvalidMessage should take the full message name
+        https://bugs.webkit.org/show_bug.cgi?id=100788
+
+        Reviewed by Sam Weinig.
+
+        Change Connection::Client::didReceiveInvalidMessage to take the message receiver name and message name as parameters
+        and make WebProcessProxy::didReceiveInvalidMessage print out the full message name.
+
+        * NetworkProcess/NetworkConnectionToWebProcess.cpp:
+        (WebKit::NetworkConnectionToWebProcess::didReceiveInvalidMessage):
+        * NetworkProcess/NetworkConnectionToWebProcess.h:
+        (NetworkConnectionToWebProcess):
+        * NetworkProcess/NetworkProcess.cpp:
+        (WebKit::NetworkProcess::didReceiveInvalidMessage):
+        * NetworkProcess/NetworkProcess.h:
+        (NetworkProcess):
+        * Platform/CoreIPC/Connection.cpp:
+        (CoreIPC::Connection::dispatchMessage):
+        * Platform/CoreIPC/Connection.h:
+        (Client):
+        * Platform/CoreIPC/StringReference.cpp:
+        (CoreIPC::StringReference::toString):
+        (CoreIPC):
+        * Platform/CoreIPC/StringReference.h:
+        (StringReference):
+        * PluginProcess/PluginProcess.cpp:
+        (WebKit::PluginProcess::didReceiveInvalidMessage):
+        * PluginProcess/PluginProcess.h:
+        (PluginProcess):
+        * PluginProcess/WebProcessConnection.cpp:
+        (WebKit::WebProcessConnection::didReceiveInvalidMessage):
+        * PluginProcess/WebProcessConnection.h:
+        (WebProcessConnection):
+        * SharedWorkerProcess/SharedWorkerProcess.cpp:
+        (WebKit::SharedWorkerProcess::didReceiveInvalidMessage):
+        * SharedWorkerProcess/SharedWorkerProcess.h:
+        (SharedWorkerProcess):
+        * UIProcess/Network/NetworkProcessProxy.cpp:
+        (WebKit::NetworkProcessProxy::didReceiveInvalidMessage):
+        * UIProcess/Network/NetworkProcessProxy.h:
+        (NetworkProcessProxy):
+        * UIProcess/Plugins/PluginProcessProxy.cpp:
+        (WebKit::PluginProcessProxy::didReceiveInvalidMessage):
+        * UIProcess/Plugins/PluginProcessProxy.h:
+        (PluginProcessProxy):
+        * UIProcess/SharedWorkers/SharedWorkerProcessProxy.cpp:
+        (WebKit::SharedWorkerProcessProxy::didReceiveInvalidMessage):
+        * UIProcess/SharedWorkers/SharedWorkerProcessProxy.h:
+        (SharedWorkerProcessProxy):
+        * UIProcess/WebConnectionToWebProcess.cpp:
+        (WebKit::WebConnectionToWebProcess::didReceiveInvalidMessage):
+        * UIProcess/WebConnectionToWebProcess.h:
+        (WebConnectionToWebProcess):
+        * UIProcess/WebProcessProxy.cpp:
+        (WebKit::WebProcessProxy::didReceiveInvalidMessage):
+        * UIProcess/WebProcessProxy.h:
+        (WebProcessProxy):
+        * WebProcess/Network/NetworkProcessConnection.cpp:
+        (WebKit::NetworkProcessConnection::didReceiveInvalidMessage):
+        * WebProcess/Network/NetworkProcessConnection.h:
+        (NetworkProcessConnection):
+        * WebProcess/Plugins/PluginProcessConnection.cpp:
+        (WebKit::PluginProcessConnection::didReceiveInvalidMessage):
+        * WebProcess/Plugins/PluginProcessConnection.h:
+        (PluginProcessConnection):
+        * WebProcess/WebConnectionToUIProcess.cpp:
+        (WebKit::WebConnectionToUIProcess::didReceiveInvalidMessage):
+        * WebProcess/WebConnectionToUIProcess.h:
+        (WebConnectionToUIProcess):
+        * WebProcess/WebProcess.cpp:
+        (WebKit::WebProcess::didReceiveInvalidMessage):
+        * WebProcess/WebProcess.h:
+        (WebProcess):
+
+2012-10-31  Christophe Dumez  <christophe.dumez@intel.com>
+
+        [EFL][WK2][AC] Use smart pointers for Evas_GL types
+        https://bugs.webkit.org/show_bug.cgi?id=100745
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Replace raw pointers to Evas_GL, Evas_GL_Context and
+        Evas_GL_Surface by smart pointers in EwkViewImpl.
+
+        C++ wrappers were added for Evas_GL_Context and
+        Evas_GL_Surface in order to use OwnPtr. This is needed
+        because their destroy functions need the Evas_GL.
+
+        * PlatformEfl.cmake:
+        * UIProcess/API/efl/EvasGLContext.cpp: Added.
+        (WebKit):
+        (WebKit::EvasGLContext::EvasGLContext):
+        (WebKit::EvasGLContext::~EvasGLContext):
+        * UIProcess/API/efl/EvasGLContext.h: Added.
+        (WebKit):
+        (EvasGLContext):
+        (WebKit::EvasGLContext::create):
+        (WebKit::EvasGLContext::context):
+        * UIProcess/API/efl/EvasGLSurface.cpp: Added.
+        (WebKit):
+        (WebKit::EvasGLSurface::EvasGLSurface):
+        (WebKit::EvasGLSurface::~EvasGLSurface):
+        * UIProcess/API/efl/EvasGLSurface.h: Added.
+        (WebKit):
+        (EvasGLSurface):
+        (WebKit::EvasGLSurface::create):
+        (WebKit::EvasGLSurface::surface):
+        * UIProcess/API/efl/EwkViewImpl.cpp:
+        (EwkViewImpl::EwkViewImpl):
+        (EwkViewImpl::displayTimerFired):
+        (EwkViewImpl::createGLSurface):
+        (EwkViewImpl::enterAcceleratedCompositingMode):
+        (EwkViewImpl::exitAcceleratedCompositingMode):
+        * UIProcess/API/efl/EwkViewImpl.h:
+        (EwkViewImpl::evasGL):
+        (EwkViewImpl::evasGLContext):
+        (EwkViewImpl::evasGLSurface):
+        (EwkViewImpl::resetEvasGLSurface):
+        (EwkViewImpl):
+        * UIProcess/API/efl/ewk_view.cpp:
+        (_ewk_view_smart_calculate):
+
+2012-10-31  Balazs Kelemen  <kbalazs@webkit.org>
+
+        [Qt][WK2] Fix "Unable to find a renderable master window QQuickView" warnings in tst_QQuickWebView
+        https://bugs.webkit.org/show_bug.cgi?id=100247
+
+        Reviewed by Jocelyn Turcotte.
+
+        Make sure we have a visible window for tests that want to render.
+
+        * UIProcess/API/qt/tests/qquickwebview/tst_qquickwebview.cpp:
+        (tst_QQuickWebView::showWebView):
+        (tst_QQuickWebView::removeFromCanvas):
+        (tst_QQuickWebView::multipleWebViewWindows):
+        (tst_QQuickWebView::multipleWebViews):
+        (tst_QQuickWebView::basicRenderingSanity):
+        (tst_QQuickWebView::transparentWebViews):
+        Removed some unnecessary resize now that the window have a default size.
+        * UIProcess/API/qt/tests/testwindow.h:
+        (TestWindow): Resize the window to a default size at construction.
+
+2012-10-31  Thiago Marcos P. Santos  <thiago.santos@intel.com>
+
+        [EFL] WebContext::platformDefaultIconDatabasePath() should return a path to a file
+        https://bugs.webkit.org/show_bug.cgi?id=100679
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        This patch aligns the EFL implementation with other ports. Before
+        that, we had an inconsistence: the return value of the getter could
+        not be used on the setter (the setter expects a full path, not a
+        directory).
+
+        * UIProcess/API/efl/ewk_context.cpp:
+        (Ewk_Context::faviconDatabase):
+        * UIProcess/efl/WebContextEfl.cpp:
+        (WebKit::WebContext::platformDefaultIconDatabasePath):
+
+2012-10-31  Ian Vollick  <vollick@chromium.org>
+
+        Add support for text-based repaint testing
+        https://bugs.webkit.org/show_bug.cgi?id=100584
+
+        Reviewed by Simon Fraser.
+
+        Allows tracked repaint rects to be dumped as text.
+
+        * mac/WebKit2.order:
+        * win/WebKit2.def:
+        * win/WebKit2CFLite.def:
+          Exports for:
+            FrameView::setTracksRepaints(bool)
+            Frame::trackedRepaintRectsAsText() const
+
+2012-10-31  Sudarsana Nagineni  <sudarsana.nagineni@intel.com>
+
+        [EFL] Skip EWK2UnitTestBase.ewk_context_vibration_client_callbacks_set API test
+        https://bugs.webkit.org/show_bug.cgi?id=100839
+
+        Unreviewed, Skip EWK2UnitTestBase.ewk_context_vibration_client_callbacks_set
+        API test since it is failing on the bots.
+
+        * UIProcess/API/efl/tests/test_ewk2_context.cpp:
+        (TEST_F):
+
+2012-10-31  KyungTae Kim  <ktf.kim@samsung.com>
+
+        [WK2][EFL] Assert check need to be changed in InputMethodContextEfl::InputMethodContextEfl
+        https://bugs.webkit.org/show_bug.cgi?id=100840
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Because 'context' is already set to 'm_context', assert check need to be done for m_context.
+
+        * UIProcess/efl/InputMethodContextEfl.cpp:
+        (WebKit::InputMethodContextEfl::InputMethodContextEfl):
+
+2012-10-31  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        [WK2/EFL] Make sure all our events are transformed correctly
+        https://bugs.webkit.org/show_bug.cgi?id=100836
+
+        Reviewed by Alexis Menard.
+
+        When moving to using the tiled backing store, we need to
+        transform our events before sending them to the web process.
+
+        We needed to do that before as well, as the webkit view
+        doesn't have to be positioned at (0,0), but it was done in
+        a hacking way in the WebEvent creating.
+
+        Now we generate two transforms, one for transforming points
+        to the web content, and one for transforming them into the
+        device screen coordinate system.
+
+        This fixes the global position which was wrong before.
+
+        * Shared/NativeWebMouseEvent.h:
+        (NativeWebMouseEvent):
+        * Shared/NativeWebTouchEvent.h:
+        (NativeWebTouchEvent):
+        * Shared/NativeWebWheelEvent.h:
+        (NativeWebWheelEvent):
+        * Shared/efl/NativeWebMouseEventEfl.cpp:
+        (WebKit::NativeWebMouseEvent::NativeWebMouseEvent):
+        * Shared/efl/NativeWebTouchEventEfl.cpp:
+        (WebKit::NativeWebTouchEvent::NativeWebTouchEvent):
+        * Shared/efl/NativeWebWheelEventEfl.cpp:
+        (WebKit::NativeWebWheelEvent::NativeWebWheelEvent):
+        * Shared/efl/WebEventFactory.cpp:
+        (WebKit::WebEventFactory::createWebMouseEvent):
+        (WebKit::WebEventFactory::createWebWheelEvent):
+        (WebKit::WebEventFactory::createWebTouchEvent):
+        * Shared/efl/WebEventFactory.h:
+        (WebEventFactory):
+        * UIProcess/API/efl/ewk_view.cpp:
+        (toDeviceScreenTransform):
+        (toWebContentTransform):
+        (_ewk_view_smart_mouse_wheel):
+        (_ewk_view_smart_mouse_down):
+        (_ewk_view_smart_mouse_up):
+        (_ewk_view_smart_mouse_move):
+        (ewk_view_feed_touch_event):
+
+2012-10-31  Byungwoo Lee  <bw80.lee@samsung.com>
+
+        [WK2] Change the scope of locking in CoreIPC::Connection class.
+        https://bugs.webkit.org/show_bug.cgi?id=98998
+
+        Reviewed by Laszlo Gombos.
+
+        Release the m_incomingMessagesLock and m_outgoingMessagesLock mutexes
+        immediately after the protected resource is no longer modified to
+        prevent a possible source of a deadlock.
+
+        The change allows the EFL port to prevent an actual dead-lock
+        situation with some upcoming changes.
+
+        * Platform/CoreIPC/Connection.cpp:
+        (CoreIPC::Connection::sendMessage):
+        (CoreIPC::Connection::enqueueIncomingMessage):
+
+2012-10-31  Tim Horton  <timothy_horton@apple.com>
+
+        Unreviewed, fix header sorting in r132992.
+
+        * WebProcess/Plugins/PDF/PDFPluginAnnotation.mm:
+        * WebProcess/Plugins/PDF/PDFPluginTextAnnotation.mm:
+
+2012-10-31  Tim Horton  <timothy_horton@apple.com>
+
+        Unreviewed, fix 32bit build breakage.
+
+        * WebProcess/Plugins/PDF/PDFPluginAnnotation.mm:
+        (WebKit::PDFPluginAnnotation::updateGeometry):
+
+2012-10-31  Tim Horton  <timothy_horton@apple.com>
+
+        Full-page PDFPlugin should support inline form editing
+        https://bugs.webkit.org/show_bug.cgi?id=100155
+
+        Reviewed by Dan Bernstein.
+
+        Add form controls corresponding to Text and Choice PDF annotations,
+        allowing for single- and multi-line text input, and <select>-like input.
+
+        Currently, forms are only implemented for full-page PDF documents.
+
+        * Shared/mac/PDFKitImports.h:
+        (WebKit): Add pdfAnnotationTextWidgetClass and pdfAnnotationChoiceWidgetClass.
+        * Shared/mac/PDFKitImports.mm:
+        (WebKit::pdfAnnotationTextWidgetClass): Add pdfAnnotationTextWidgetClass.
+        (WebKit::pdfAnnotationChoiceWidgetClass): Add pdfAnnotationChoiceWidgetClass.
+        * WebKit2.xcodeproj/project.pbxproj: Add PDFLayerControllerDetails, PDFPluginTextAnnotation, PDFPluginChoiceAnnotation,
+        and PDFPluginAnnotation.
+        * WebProcess/Plugins/PDF/PDFLayerControllerDetails.h: Added. Extract PDFLayerController details category into a header.
+        * WebProcess/Plugins/PDF/PDFPlugin.h:
+        (PDFPlugin): Add m_activeAnnotation, to keep track of the active PDFPluginAnnotation, and m_annotationContainer,
+        the <div> that form controls are inserted into.
+        * WebProcess/Plugins/PDF/PDFPlugin.mm:
+        (-[WKPDFLayerControllerDelegate pdfLayerController:didChangeActiveAnnotation:]): Forward active annotation changes to PDFPlugin.
+        (WebKit::PDFPlugin::PDFPlugin): Add a <div> to the PluginDocument <body>, which will contain <input>, <select>, and <textarea> elements
+        corresponding to the active annotation. This div is made to fit to the body, and is "overflow: hidden" so that form elements scrolled
+        out of the viewport do not cause the Document to expand to be larger than the Plugin.
+        (WebKit::PDFPlugin::pdfDocumentDidLoad): Update PDFPlugin's notion of the scroll position immediately after the document loads, in case
+        the scroll position is constrained by PDFKit.
+        (WebKit::PDFPlugin::destroy): Tear down any forms for the active annotation.
+        (WebKit::PDFPlugin::geometryDidChange): Notify the current annotation that it should update its geometry when the Plugin's geometry changes.
+        (WebKit::PDFPlugin::setScrollOffset): Notify the current annotation that it should update its geometry when we scroll.
+        (WebKit::PDFPlugin::setActiveAnnotation): Commit changes to the current annotation, if there is one, then make a new PDFPluginAnnotation
+        corresponding to the newly active annotation, and attach it to our document.
+        * WebProcess/Plugins/PDF/PDFPluginAnnotation.h: Added.
+        (WebKit::PDFPluginAnnotation::element): Return the Element corresponding to this object.
+        (WebKit::PDFPluginAnnotation::annotation): Return the PDFAnnotation corresponding to this object.
+        (WebKit::PDFPluginAnnotation::plugin): Return the Plugin that created this object.
+        (WebKit::PDFPluginAnnotation::commit): Commit changes from the form to the PDFAnnotation. This is implemented in subclasses.
+        (WebKit::PDFPluginAnnotation::attach): Attach a PDFPluginAnnotation to its parent Element.
+        (WebKit::PDFPluginAnnotation::parent): Return the parent Element that we're attach()ed to.
+        (WebKit::PDFPluginAnnotation::pdfLayerController): Return the pdfLayerController that the PDFAnnotation comes from.
+        (PDFPluginAnnotationEventListener): Add an event listener to respond to "change" and "blur" events from m_element.
+        * WebProcess/Plugins/PDF/PDFPluginAnnotation.mm: Added.
+        (WebKit::PDFPluginAnnotation::create): Create the appropriate PDFPluginAnnotation subclass (PDFPluginTextAnnotation or
+        PDFPluginChoiceAnnotation based on the class of the PDFAnnotation).
+        (WebKit::PDFPluginAnnotation::attach): Lazily create the HTML form element corresponding to this annotation. Add it to its parent
+        element. Add event listeners for "change" and "blur".
+        (WebKit::PDFPluginAnnotation::~PDFPluginAnnotation): Tear down the annotation, by removing event listeners and removing
+        the form element from its parent element.
+        (WebKit::PDFPluginAnnotation::updateGeometry): Update the size and position of the form element, given the current PDF scale and scrolling position.
+        (WebKit::PDFPluginAnnotation::PDFPluginAnnotationEventListener::handleEvent): If we get a blur or change event, we should remove the
+        form control to match the behavior of PDFKit.
+        * WebProcess/Plugins/PDF/PDFPluginChoiceAnnotation.h: Added.
+        (WebKit::PDFPluginChoiceAnnotation::choiceAnnotation): Return annotation() with the appropriate cast.
+        * WebProcess/Plugins/PDF/PDFPluginChoiceAnnotation.mm: Added.
+        (WebKit::PDFPluginChoiceAnnotation::updateGeometry): Update the font size of the choice widget given the current PDF scale.
+        (WebKit::PDFPluginChoiceAnnotation::commit): Save the value of the currently selected <option> into the PDFAnnotationChoiceWidget.
+        (WebKit::PDFPluginChoiceAnnotation::createAnnotationElement): Create a <select> element, populated with <option> elements
+        for the PDFAnnotationChoiceWidget's available choices. Select the correct <option> initially.
+        * WebProcess/Plugins/PDF/PDFPluginTextAnnotation.h: Added.
+        (WebKit::PDFPluginTextAnnotation::textAnnotation): Return annotation() with the appropriate cast.
+        * WebProcess/Plugins/PDF/PDFPluginTextAnnotation.mm: Added.
+        (WebKit::cssAlignmentValueForNSTextAlignment): Return the CSS alignment value for a given NSTextAlignment.
+        (WebKit::PDFPluginTextAnnotation::createAnnotationElement): Create a <textarea> or <input> element, depending on whether the
+        PDFAnnotationTextWidget supports multiline editing or not.
+        (WebKit::PDFPluginTextAnnotation::updateGeometry): Update the font size of the text widget given the current PDF scale.
+        (WebKit::PDFPluginTextAnnotation::commit): Save the current string in the form element into the PDFAnnotationTextWidget.
+        * WebProcess/WebPage/WebPage.cpp:
+        (WebKit::focusedPluginViewForFrame): Return the PluginView for a Frame only if the Plugin's element is focused.
+        (WebKit::WebPage::executeEditingCommand): Only forward editing commands to PluginView if the plugin itself is focused.
+        (WebKit::WebPage::isEditingCommandEnabled): Ditto.
+        (WebKit::WebPage::validateCommand): Ditto.
+
+2012-10-30  Joseph Pecoraro  <pecoraro@apple.com>
+
+        [Mac] Make WebKit2 Build with NETWORK_PROCESS disabled
+        https://bugs.webkit.org/show_bug.cgi?id=100798
+
+        Reviewed by David Kilzer.
+
+        Wrap a few remaining NetworkProcess files and related code in
+        ENABLE(NETWORK_PROCESS) guards to avoid being compiled when disabled.
+
+        * NetworkProcess/HostRecord.cpp:
+        * NetworkProcess/HostRecord.h:
+        * NetworkProcess/NetworkRequest.cpp:
+        * NetworkProcess/NetworkRequest.h:
+        * NetworkProcess/mac/NetworkResourceLoadSchedulerMac.mm:
+        * UIProcess/Network/NetworkProcessManager.cpp:
+        * UIProcess/Network/NetworkProcessManager.h:
+        Wrap files in guards.
+
+        * UIProcess/Launcher/ProcessLauncher.h:
+        * UIProcess/Launcher/ProcessLauncher.cpp:
+        (WebKit::ProcessLauncher::processTypeAsString):
+        (WebKit::ProcessLauncher::getProcessTypeFromString):
+        Wrap NetworkProcess enum access in guards.
+
+        * WebProcess/WebKitMain.cpp:
+        (WebKitMain):
+        Wrap NetworkProcess enum switch case in guards.
+
+        * WebKit2Prefix.h:
+        Remove an extraneous close and reopen of the same guard.
+
+2012-10-30  Jae Hyun Park  <jae.park@company100.net>
+
+        Coordinated Graphics: Remove unused methods
+        https://bugs.webkit.org/show_bug.cgi?id=100799
+
+        Reviewed by Noam Rosenthal.
+
+        Currently, there are several unused methods regarding Coordinated
+        Graphics. This patch removes those unused methods.
+
+        * UIProcess/CoordinatedGraphics/LayerTreeCoordinatorProxy.h:
+        (LayerTreeCoordinatorProxy):
+        * UIProcess/DrawingAreaProxy.h:
+
+2012-10-30  Joseph Pecoraro  <pecoraro@apple.com>
+
+        [Mac] Sync up FeatureDefine Configuration Files
+        https://bugs.webkit.org/show_bug.cgi?id=100171
+
+        Reviewed by David Kilzer.
+
+        Follow up to better coordinate with iOS feature defines. Make:
+
+          - ENABLE_FILTERS always on
+          - ENABLE_INPUT_* iphonesimulator values point to the iphoneos values
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2012-10-30  Joseph Pecoraro  <pecoraro@apple.com>
+
+        [Mac] Sync up FeatureDefine Configuration Files
+        https://bugs.webkit.org/show_bug.cgi?id=100171
+
+        Reviewed by David Kilzer.
+
+        Ensure an identical FeatureDefine files across all projects. Changes:
+
+          - ENABLE_CSS_BOX_DECORATION_BREAK should be in all
+          - ENABLE_PDFKIT_PLUGIN should be in all
+          - ENABLE_RESOLUTION_MEDIA_QUERY should be in all
+          - ENABLE_ENCRYPTED_MEDIA should be in all
+          - ENABLE_HIDDEN_PAGE_DOM_TIMER_THROTTLING with corrected value
+          - Some alphabetical ordering cleanup
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2012-10-30  Christophe Dumez  <christophe.dumez@intel.com>
+
+        Regression(r132887): Caused segfault in a EWK2UnitTestBase.ewk_view_text_find
+        https://bugs.webkit.org/show_bug.cgi?id=100781
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Make sure we pass a pointer to zero instead of a NULL pointer
+        as parameter to the "text,found" in case the text could not
+        be found. This prevents crashing in
+        EWK2UnitTestBase.ewk_view_text_find when trying to dereference
+        the parameter pointer.
+
+        * UIProcess/efl/FindClientEfl.cpp:
+        (WebKit::FindClientEfl::didFailToFindString):
+
+2012-10-30  Brady Eidson  <beidson@apple.com>
+
+        Crash in WebProcess at com.apple.WebCore: WebCore::ResourceLoader::start
+        <rdar://problem/12596761> and https://webkit.org/b/100792
+
+        Reviewed by Tim Hatcher.
+
+        In release builds we can sometimes end up with a null ResourceLoader due to a race condition
+        with the WebProcess telling the NetworkProcess to remove a resource load at the very same time
+        the NetworkProcess is about to start that load.
+
+        Until we can resolve that race condition an early return will be necessary.
+
+        * WebProcess/Network/WebResourceLoadScheduler.cpp:
+        (WebKit::WebResourceLoadScheduler::startResourceLoad):
+
+2012-10-30  Jesse van den Kieboom  <jessevdk@gnome.org>
+
+        Fixed transfer annotation for default web context
+        https://bugs.webkit.org/show_bug.cgi?id=94314
+
+        Reviewed by Martin Robinson.
+
+        Add a missing colon which prevented the transfer annotation of
+        webkit_web_context_get_default to be parsed correctly.
+
+        * UIProcess/API/gtk/WebKitWebContext.cpp:
+
+2012-10-30  Anders Carlsson  <andersca@apple.com>
+
+        Use the message name when dispatching messages
+        https://bugs.webkit.org/show_bug.cgi?id=100774
+
+        Reviewed by Andreas Kling.
+
+        Change the message generator to decide which function to call based on the message name instead
+        of the MessageID. This is yet another step towards eliminating MessageID completely.
+
+        * Scripts/webkit2/messages.py:
+        (async_message_statement):
+        (sync_message_statement):
+        (generate_message_handler):
+        * Scripts/webkit2/messages_unittest.py:
+        * UIProcess/WebProcessProxy.h:
+        (WebKit::WebProcessProxy::send):
+        * WebProcess/InjectedBundle/InjectedBundle.cpp:
+        (WebKit::InjectedBundle::postMessage):
+        (WebKit::InjectedBundle::postSynchronousMessage):
+
+2012-10-29  Sam Weinig  <sam@webkit.org>
+
+        Switch more class to use the new << form of encode
+        https://bugs.webkit.org/show_bug.cgi?id=100725
+
+        Reviewed by Anders Carlsson.
+
+        - Switches many uses of encoder.encode(foo) to encoder << foo.
+        - Switches a few places to take an ArgumentEncoder& rather than an ArgumentEncoder*.
+        - Switches a few places away from using encoder.encodeVariableLengthByteArray(foo) to
+          using encoder << CoreIPC::DataReference(foo).
+
+        * Platform/CoreIPC/HandleMessage.h:
+        (CoreIPC::handleMessage):
+        (CoreIPC::handleMessageVariadic):
+        * Platform/CoreIPC/StringReference.cpp:
+        (CoreIPC::StringReference::encode):
+        (CoreIPC::StringReference::decode):
+        * Platform/CoreIPC/mac/MachPort.h:
+        (CoreIPC::MachPort::encode):
+        * Platform/mac/SharedMemoryMac.cpp:
+        (WebKit::SharedMemory::Handle::encode):
+        * PluginProcess/PluginCreationParameters.cpp:
+        (WebKit::PluginCreationParameters::encode):
+        * Shared/DictionaryPopupInfo.cpp:
+        (WebKit::DictionaryPopupInfo::encode):
+        * Shared/EditorState.cpp:
+        (WebKit::EditorState::encode):
+        * Shared/FontInfo.cpp:
+        (WebKit::FontInfo::encode):
+        * Shared/Network/NetworkProcessCreationParameters.cpp:
+        (WebKit::NetworkProcessCreationParameters::encode):
+        * Shared/OriginAndDatabases.cpp:
+        (WebKit::OriginAndDatabases::encode):
+        * Shared/PlatformPopupMenuData.cpp:
+        (WebKit::PlatformPopupMenuData::encode):
+        * Shared/Plugins/NPIdentifierData.cpp:
+        (WebKit::NPIdentifierData::encode):
+        * Shared/Plugins/NPVariantData.cpp:
+        (WebKit::NPVariantData::encode):
+        * Shared/Plugins/PluginProcessCreationParameters.cpp:
+        (WebKit::PluginProcessCreationParameters::encode):
+        * Shared/PrintInfo.cpp:
+        (WebKit::PrintInfo::encode):
+        * Shared/SecurityOriginData.cpp:
+        (WebKit::SecurityOriginData::encode):
+        * Shared/SessionState.cpp:
+        (WebKit::SessionState::encode):
+        * Shared/ShareableBitmap.cpp:
+        (WebKit::ShareableBitmap::Handle::encode):
+        * Shared/SharedWorkerProcessCreationParameters.cpp:
+        (WebKit::SharedWorkerProcessCreationParameters::encode):
+        * Shared/StatisticsData.cpp:
+        (WebKit::StatisticsData::encode):
+        * Shared/StringPairVector.h:
+        (WebKit::StringPairVector::encode):
+        * Shared/UpdateInfo.cpp:
+        (WebKit::UpdateInfo::encode):
+        * Shared/UserMessageCoders.h:
+        (WebKit::UserMessageEncoder::baseEncode):
+        * Shared/WebBackForwardListItem.cpp:
+        (WebKit::WebBackForwardListItem::encode):
+        * Shared/WebContextMenuItemData.cpp:
+        (WebKit::WebContextMenuItemData::encode):
+        * Shared/WebEvent.cpp:
+        (WebKit::WebEvent::encode):
+        * Shared/WebGestureEvent.cpp:
+        (WebKit::WebGestureEvent::encode):
+        * Shared/WebHitTestResult.cpp:
+        (WebKit::WebHitTestResult::Data::encode):
+        * Shared/WebKeyboardEvent.cpp:
+        (WebKit::WebKeyboardEvent::encode):
+        * Shared/WebMouseEvent.cpp:
+        (WebKit::WebMouseEvent::encode):
+        * Shared/WebNavigationDataStore.h:
+        (WebKit::WebNavigationDataStore::encode):
+        * Shared/WebPageCreationParameters.cpp:
+        (WebKit::WebPageCreationParameters::encode):
+        * Shared/WebPageGroupData.cpp:
+        (WebKit::WebPageGroupData::encode):
+        * Shared/WebPlatformTouchPoint.cpp:
+        (WebKit::WebPlatformTouchPoint::encode):
+        * Shared/WebPopupItem.cpp:
+        (WebKit::WebPopupItem::encode):
+        * Shared/WebPreferencesStore.cpp:
+        (WebKit::WebPreferencesStore::encode):
+        * Shared/WebProcessCreationParameters.cpp:
+        (WebKit::WebProcessCreationParameters::encode):
+        * Shared/WebTouchEvent.cpp:
+        (WebKit::WebTouchEvent::encode):
+        * Shared/WebWheelEvent.cpp:
+        (WebKit::WebWheelEvent::encode):
+        * Shared/cf/ArgumentCodersCF.cpp:
+        (CoreIPC::encode):
+        (CoreIPC::decode):
+        * Shared/cf/ArgumentCodersCF.h:
+        (CoreIPC):
+        * Shared/mac/ArgumentCodersMac.h:
+        (CoreIPC):
+        * Shared/mac/ArgumentCodersMac.mm:
+        (CoreIPC::encode):
+        * Shared/mac/AttributedString.mm:
+        (WebKit::AttributedString::encode):
+        * Shared/mac/ColorSpaceData.mm:
+        (WebKit::ColorSpaceData::encode):
+        * Shared/mac/KeychainAttribute.cpp:
+        (CoreIPC::encode):
+        * Shared/mac/KeychainAttribute.h:
+        (CoreIPC):
+        * Shared/mac/LayerTreeContextMac.mm:
+        (WebKit::LayerTreeContext::encode):
+        * Shared/mac/PlatformCertificateInfo.mm:
+        (WebKit::PlatformCertificateInfo::encode):
+        * Shared/mac/SandboxExtensionMac.mm:
+        (WebKit::SandboxExtension::Handle::encode):
+        (WebKit::SandboxExtension::Handle::decode):
+        (WebKit::SandboxExtension::HandleArray::encode):
+        (WebKit::SandboxExtension::HandleArray::decode):
+        * Shared/mac/SecItemRequestData.cpp:
+        (WebKit::SecItemRequestData::encode):
+        * Shared/mac/SecItemResponseData.cpp:
+        (WebKit::SecItemResponseData::encode):
+        * Shared/mac/SecKeychainItemRequestData.cpp:
+        (WebKit::SecKeychainItemRequestData::encode):
+        (WebKit::SecKeychainItemRequestData::decode):
+        * Shared/mac/SecKeychainItemResponseData.cpp:
+        (WebKit::SecKeychainItemResponseData::encode):
+        * Shared/mac/WebCoreArgumentCodersMac.mm:
+        (CoreIPC::::encodePlatformData):
+        * UIProcess/WebConnectionToWebProcess.cpp:
+        (WebKit::WebConnectionToWebProcess::encodeMessageBody):
+        * UIProcess/WebContextUserMessageCoders.h:
+        (WebKit::WebContextUserMessageEncoder::encode):
+        * WebProcess/InjectedBundle/InjectedBundleUserMessageCoders.h:
+        (WebKit::InjectedBundleUserMessageEncoder::encode):
+        * WebProcess/Plugins/Plugin.cpp:
+        (WebKit::Plugin::Parameters::encode):
+        * WebProcess/WebConnectionToUIProcess.cpp:
+        (WebKit::WebConnectionToUIProcess::encodeMessageBody):
+
+2012-10-29  Anders Carlsson  <andersca@apple.com>
+
+        Build WebKit as C++11 on Mac
+        https://bugs.webkit.org/show_bug.cgi?id=100720
+
+        Reviewed by Daniel Bates.
+
+        * Configurations/Base.xcconfig:
+        Add CLANG_CXX_LANGUAGE_STANDARD=gnu++0x.
+
+        * UIProcess/mac/WebCookieManagerProxyMac.mm:
+        (WebKit::WebCookieManagerProxy::persistHTTPCookieAcceptPolicy):
+        * WebProcess/Cookies/mac/WebCookieManagerMac.mm:
+        (WebKit::WebCookieManager::platformSetHTTPCookieAcceptPolicy):
+        Add explicit casts to NSHTTPCookieAcceptPolicy.
+
+2012-10-30  Sergio Villar Senin  <svillar@igalia.com>
+
+        [WK2][Qt] Enable hover and mouse events in flickable WebView
+        https://bugs.webkit.org/show_bug.cgi?id=100296
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Flickable WebView is now allowed to handle both hover and mouse
+        events. Flickable was initially meant to be the mobile interface and
+        was only handling touch events, but now the idea is that it will be
+        the WebView for both mobile and desktop environments.
+
+        * UIProcess/API/qt/qquickwebview.cpp:
+        (QQuickWebViewPrivate::initialize): refactored hover and mouse
+        event handling from children classes.
+        (QQuickWebViewLegacyPrivate::initialize):
+        (QQuickWebViewFlickablePrivate::QQuickWebViewFlickablePrivate):
+
+2012-10-29  Anders Carlsson  <andersca@apple.com>
+
+        String::createCFString should return a RetainPtr
+        https://bugs.webkit.org/show_bug.cgi?id=100419
+
+        Reviewed by Andreas Kling.
+
+        Update callers of String::createCFString.
+
+        * Platform/mac/ModuleMac.mm:
+        (WebKit::Module::load):
+        * PluginProcess/mac/PluginProcessMac.mm:
+        (WebKit::initializeSandbox):
+        * Shared/Plugins/Netscape/mac/NetscapePluginModuleMac.mm:
+        (WebKit::NetscapePluginModule::getPluginInfo):
+        (WebKit::NetscapePluginModule::createPluginMIMETypesPreferences):
+        * UIProcess/cf/WebBackForwardListCF.cpp:
+        (WebKit::WebBackForwardList::createCFDictionaryRepresentation):
+        * UIProcess/cf/WebPageProxyCF.cpp:
+        (WebKit::WebPageProxy::sessionStateData):
+        (WebKit::autosaveKey):
+        (WebKit::WebPageProxy::saveRecentSearches):
+        * WebProcess/ResourceCache/WebResourceCacheManager.cpp:
+        (WebKit::WebResourceCacheManager::clearCacheForOrigin):
+        * WebProcess/WebPage/win/WebPageWin.cpp:
+        (WebKit::cachedResponseForURL):
+        * WebProcess/win/WebProcessWin.cpp:
+        (WebKit::WebProcess::platformSetCacheModel):
+        (WebKit::WebProcess::platformInitializeWebProcess):
+
+2012-10-30  Kondapally Kalyan  <kalyan.kondapally@intel.com>
+
+        Regression(r132647)-Enable WebGL in EwkView.
+        https://bugs.webkit.org/show_bug.cgi?id=100552.
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        WebGL is enabled with following changeset: http://trac.webkit.org/changeset/132627.
+        Some changes are lost after the following changeset: http://trac.webkit.org/changeset/132647
+        i.e setWebGLEnabled(true);  in EwkViewImpl.cpp.
+        This patch re-applies the lost changes.
+
+        * UIProcess/API/efl/EwkViewImpl.cpp:
+        (EwkViewImpl::EwkViewImpl):
+
+2012-10-30  No'am Rosenthal  <noam.rosenthal@nokia.com>
+
+        [Qt] Animations jump when the page is suspended
+        https://bugs.webkit.org/show_bug.cgi?id=100673
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        GraphicsLayerAnimations::pause() should accept time from start and not an offset.
+
+        * WebProcess/WebPage/CoordinatedGraphics/CoordinatedGraphicsLayer.cpp:
+        (WebCore::CoordinatedGraphicsLayer::addAnimation):
+        (WebCore::CoordinatedGraphicsLayer::pauseAnimation):
+        (WebCore::CoordinatedGraphicsLayer::animationStartedTimerFired):
+        * WebProcess/WebPage/CoordinatedGraphics/CoordinatedGraphicsLayer.h:
+        (CoordinatedGraphicsLayer):
+
+2012-10-30  Mikhail Pozdnyakov  <mikhail.pozdnyakov@intel.com>
+
+        [EFL][WK2] Fix EFL build after r132887
+        https://bugs.webkit.org/show_bug.cgi?id=100748
+
+        Reviewed by Gyuyoung Kim.
+
+        Fixed EFL build failure with WTF_USE_TILED_BACKING_STORE enabled caused by http://trac.webkit.org/changeset/132887.
+
+        * UIProcess/efl/PageLoadClientEfl.cpp:
+        (WebKit::PageLoadClientEfl::didCommitLoadForFrame):
+
+2012-10-30  Max Vujovic  <mvujovic@adobe.com>
+
+        [CSS Shaders] Reject vertex shaders with custom attributes
+        https://bugs.webkit.org/show_bug.cgi?id=98973
+
+        Reviewed by Dean Jackson.
+
+        Replace CustomFilterOperation::MeshType with CustomFilterMeshType from
+        CustomFilterConstants.h.
+
+        * Shared/CoordinatedGraphics/CoordinatedGraphicsArgumentCoders.cpp:
+        (CoreIPC::::encode):
+            Read the shader strings directly from the CustomFilterProgram instead of asking for a
+            CustomFilterProgramInfo object. Also, encode the meshType earlier so that decoding can
+            can use it to create a WebCustomFilterProgram, which now requires a meshType.
+        (CoreIPC::::decode):
+            Decode the meshType earlier to pass it to the new WebCustomFilterProgram constructor.
+        * Shared/CoordinatedGraphics/WebCustomFilterProgram.h:
+        (WebKit::WebCustomFilterProgram::create):
+            Add a meshType parameter to pass to the base class constructor.
+        (WebKit::WebCustomFilterProgram::WebCustomFilterProgram): Ditto.
+
+2012-10-30  Andras Becsi  <andras.becsi@digia.com>
+
+        [Qt][WK2] Remove ViewportUpdateDeferrer from PageViewportController
+        https://bugs.webkit.org/show_bug.cgi?id=100665
+
+        Reviewed by Jocelyn Turcotte.
+
+        Since the original use case of delayed viewport updates and the issue
+        of infinite loop conditions between the programmatic adjustmet of the
+        viewport and the Qt notification signals are not present any more the
+        ViewportUpdateDeferrer became an unnecessary legacy and can be removed.
+
+        * UIProcess/PageViewportController.cpp:
+        (WebKit::PageViewportController::PageViewportController):
+        (WebKit::PageViewportController::pageDidRequestScroll):
+        * UIProcess/PageViewportController.h:
+        (WebKit):
+        (PageViewportController):
+        * UIProcess/qt/PageViewportControllerClientQt.cpp:
+        (WebKit::PageViewportControllerClientQt::PageViewportControllerClientQt):
+        (WebKit::PageViewportControllerClientQt::animateContentRectVisible):
+        (WebKit::PageViewportControllerClientQt::flickMoveStarted):
+        (WebKit::PageViewportControllerClientQt::flickMoveEnded):
+        (WebKit::PageViewportControllerClientQt::scaleAnimationStateChanged):
+        (WebKit::PageViewportControllerClientQt::touchBegin):
+        (WebKit::PageViewportControllerClientQt::touchEnd):
+        (WebKit::PageViewportControllerClientQt::setContentsRectToNearestValidBounds):
+        (WebKit::PageViewportControllerClientQt::pinchGestureStarted):
+        (WebKit::PageViewportControllerClientQt::pinchGestureEnded):
+        (WebKit::PageViewportControllerClientQt::pinchGestureCancelled):
+        * UIProcess/qt/PageViewportControllerClientQt.h:
+        (PageViewportControllerClientQt):
+
+2012-10-30  Mikhail Pozdnyakov  <mikhail.pozdnyakov@intel.com>
+
+        [EFL][WK2] Simplify signal emitting API in EwkViewImpl
+        https://bugs.webkit.org/show_bug.cgi?id=100506
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Now signal emitting API in EwkViewImpl is simplified so that
+        there is one EwkViewImpl::smartCallback template method
+        returning EwkViewCallbacks::CallBack class instance
+        which encapsulates Ewk_view callback info and also provide
+        arguments type checking.
+
+        * UIProcess/API/efl/EwkViewCallbacks.h: Added.
+        (EwkViewCallbacks):
+        (CallBackInfo):
+        (EwkViewCallbacks::CallBackInfo::name):
+        (EwkViewCallbacks::CallBackInfo::hasArguments):
+        (CallBack):
+        (EwkViewCallbacks::CallBack::CallBack):
+        (EwkViewCallbacks::CallBack::call):
+        * UIProcess/API/efl/EwkViewImpl.cpp:
+        * UIProcess/API/efl/EwkViewImpl.h:
+        (EwkViewImpl):
+        (EwkViewImpl::smartCallback):
+        * UIProcess/efl/DownloadManagerEfl.cpp:
+        (WebKit::DownloadManagerEfl::decideDestinationWithSuggestedFilename):
+        (WebKit::DownloadManagerEfl::didFail):
+        (WebKit::DownloadManagerEfl::didCancel):
+        (WebKit::DownloadManagerEfl::didFinish):
+        * UIProcess/efl/FindClientEfl.cpp:
+        (WebKit::FindClientEfl::didFindString):
+        (WebKit::FindClientEfl::didFailToFindString):
+        * UIProcess/efl/FormClientEfl.cpp:
+        (WebKit::FormClientEfl::willSubmitForm):
+        * UIProcess/efl/PageClientImpl.cpp:
+        (WebKit::PageClientImpl::processDidCrash):
+        (WebKit::PageClientImpl::toolTipChanged):
+        * UIProcess/efl/PageLoadClientEfl.cpp:
+        (WebKit::PageLoadClientEfl::didReceiveTitleForFrame):
+        (WebKit::PageLoadClientEfl::didReceiveIntentForFrame):
+        (WebKit::PageLoadClientEfl::registerIntentServiceForFrame):
+        (WebKit::PageLoadClientEfl::didChangeProgress):
+        (WebKit::PageLoadClientEfl::didFinishLoadForFrame):
+        (WebKit::PageLoadClientEfl::didFailLoadWithErrorForFrame):
+        (WebKit::PageLoadClientEfl::didStartProvisionalLoadForFrame):
+        (WebKit::PageLoadClientEfl::didReceiveServerRedirectForProvisionalLoadForFrame):
+        (WebKit::PageLoadClientEfl::didFailProvisionalLoadWithErrorForFrame):
+        (WebKit::PageLoadClientEfl::didCommitLoadForFrame):
+        (WebKit::PageLoadClientEfl::didChangeBackForwardList):
+        * UIProcess/efl/PagePolicyClientEfl.cpp:
+        (WebKit::PagePolicyClientEfl::decidePolicyForNavigationAction):
+        (WebKit::PagePolicyClientEfl::decidePolicyForNewWindowAction):
+        * UIProcess/efl/ResourceLoadClientEfl.cpp:
+        (WebKit::ResourceLoadClientEfl::didInitiateLoadForResource):
+        (WebKit::ResourceLoadClientEfl::didSendRequestForResource):
+        (WebKit::ResourceLoadClientEfl::didReceiveResponseForResource):
+        (WebKit::ResourceLoadClientEfl::didFinishLoadForResource):
+        (WebKit::ResourceLoadClientEfl::didFailLoadForResource):
+        (WebKit::ResourceLoadClientEfl::ResourceLoadClientEfl):
+        (WebKit::ResourceLoadClientEfl::~ResourceLoadClientEfl):
+
+2012-10-30  Jocelyn Turcotte  <jocelyn.turcotte@digia.com>
+
+        Coordinated Graphics: Unrelease adopted images
+        https://bugs.webkit.org/show_bug.cgi?id=100671
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Reloading could cause a crash since r132640 where the directly composited
+        image would be re-adopted with the same key before it was properly released
+        in the UI process.
+        Cancel the release when this happens rather than creating a new image.
+
+        * WebProcess/WebPage/CoordinatedGraphics/LayerTreeCoordinator.cpp:
+        (WebKit::LayerTreeCoordinator::adoptImageBackingStore):
+
+2012-10-30  Christophe Dumez  <christophe.dumez@intel.com>
+
+        [EFL][WK2] Let Ecore_Evas own the cursor object
+        https://bugs.webkit.org/show_bug.cgi?id=100731
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Ecore_Evas takes care of calling evas_object_del() on
+        the cursor object when it is no longer used (e.g. when
+        it is replaced by another cursor object). Therefore,
+        we don't need to keep a RefPtr to the cursor Evas
+        Object as a data member of EwkViewImpl. We pass
+        ownership of the cursor object to Ecore_Evas.
+
+        * UIProcess/API/efl/EwkViewImpl.cpp:
+        (EwkViewImpl::setCursor):
+        * UIProcess/API/efl/EwkViewImpl.h:
+        (EwkViewImpl):
+
+2012-10-30  Mikhail Pozdnyakov  <mikhail.pozdnyakov@intel.com>
+
+        [EFL][WK2] Simplify getting impl from ewk_view evas object instance
+        https://bugs.webkit.org/show_bug.cgi?id=100505
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Macros are removed from EwkViewImpl.h. New macro added to EwkViewImpl.cpp
+        so that it's possible to get impl directly from ewk view.
+
+        * UIProcess/API/efl/EwkViewImpl.cpp:
+        (EwkViewImpl::displayTimerFired):
+        * UIProcess/API/efl/EwkViewImpl.h:
+        * UIProcess/API/efl/ewk_view.cpp:
+        (_ewk_view_smart_focus_in):
+        (_ewk_view_smart_focus_out):
+        (mapToWebContent):
+        (_ewk_view_smart_mouse_wheel):
+        (_ewk_view_smart_mouse_down):
+        (_ewk_view_smart_mouse_up):
+        (_ewk_view_smart_mouse_move):
+        (_ewk_view_smart_key_down):
+        (_ewk_view_smart_key_up):
+        (_ewk_view_on_show):
+        (_ewk_view_on_hide):
+        (_ewk_view_smart_calculate):
+        (_ewk_view_smart_color_set):
+        (ewk_view_context_get):
+        (ewk_view_url_set):
+        (ewk_view_url_get):
+        (ewk_view_icon_url_get):
+        (ewk_view_reload):
+        (ewk_view_reload_bypass_cache):
+        (ewk_view_stop):
+        (ewk_view_settings_get):
+        (ewk_view_title_get):
+        (ewk_view_load_progress_get):
+        (ewk_view_scale_set):
+        (ewk_view_scale_get):
+        (ewk_view_device_pixel_ratio_set):
+        (ewk_view_device_pixel_ratio_get):
+        (ewk_view_theme_set):
+        (ewk_view_theme_get):
+        (ewk_view_back):
+        (ewk_view_forward):
+        (ewk_view_intent_deliver):
+        (ewk_view_back_possible):
+        (ewk_view_forward_possible):
+        (ewk_view_back_forward_list_get):
+        (ewk_view_html_string_load):
+        (ewk_view_setting_encoding_custom_get):
+        (ewk_view_setting_encoding_custom_set):
+        (ewk_view_text_find):
+        (ewk_view_text_find_highlight_clear):
+        (ewk_view_text_matches_count):
+        (ewk_view_mouse_events_enabled_set):
+        (ewk_view_mouse_events_enabled_get):
+        (ewk_view_feed_touch_event):
+        (ewk_view_touch_events_enabled_set):
+        (ewk_view_touch_events_enabled_get):
+        (ewk_view_inspector_show):
+        (ewk_view_inspector_close):
+        (ewk_view_pagination_mode_set):
+        (ewk_view_pagination_mode_get):
+
+2012-10-30  Byungwoo Lee  <bw80.lee@samsung.com>
+
+        [WK2] Remove incorrect use of preprocessor macro in API headers.
+        https://bugs.webkit.org/show_bug.cgi?id=100722
+
+        Reviewed by Gyuyoung Kim.
+
+        Remove the preprocessor macro ENABLE(INSPECTOR) from the WKAPICast.h
+        and WKInspector.h.
+
+        * UIProcess/API/C/WKAPICast.h:
+        (WebKit):
+        * UIProcess/API/C/WKInspector.cpp:
+        (WKInspectorGetTypeID):
+        (WKInspectorGetPage):
+        (WKInspectorIsVisible):
+        (WKInspectorIsFront):
+        (WKInspectorShow):
+        (WKInspectorClose):
+        (WKInspectorShowConsole):
+        (WKInspectorShowResources):
+        (WKInspectorShowMainResourceForFrame):
+        (WKInspectorIsAttached):
+        (WKInspectorAttach):
+        (WKInspectorDetach):
+        (WKInspectorIsDebuggingJavaScript):
+        (WKInspectorToggleJavaScriptDebugging):
+        (WKInspectorIsProfilingJavaScript):
+        (WKInspectorToggleJavaScriptProfiling):
+        (WKInspectorIsProfilingPage):
+        (WKInspectorTogglePageProfiling):
+        * UIProcess/API/C/WKInspector.h:
+
+2012-10-29  Sergio Villar Senin  <svillar@igalia.com>
+
+        REGRESSION(r130755): All WebKit2 unit tests are failing in WebKit2 bot
+        https://bugs.webkit.org/show_bug.cgi?id=98864
+
+        Reviewed by Martin Robinson.
+
+        Use a dedicated directory to store WebKit2 generated resources.
+
+        * UIProcess/API/gtk/tests/GNUmakefile.am:
+        * UIProcess/API/gtk/tests/TestMain.cpp:
+        (registerGResource): load the resource from the new directory.
+
+2012-10-29  Huang Dongsung  <luxtella@company100.net>
+
+        Coordinated Graphics: Delete cached ShareableSurfaces when purging backingStores.
+        https://bugs.webkit.org/show_bug.cgi?id=100705
+
+        Reviewed by Noam Rosenthal.
+
+        LayerTreeCoordinatorProxy can be used after calling
+        LayerTreeCoordinatorProxy::purgeBackingStores(). So we should clear cached
+        ShareableSurfaces.
+
+        * UIProcess/CoordinatedGraphics/LayerTreeCoordinatorProxy.cpp:
+        (WebKit::LayerTreeCoordinatorProxy::purgeBackingStores):
+
+2012-10-28  Mark Rowe  <mrowe@apple.com>
+
+        Simplify Xcode configuration settings that used to vary between OS versions.
+
+        Reviewed by Dan Bernstein.
+
+        * Configurations/Base.xcconfig:
+        * Configurations/WebKit2.xcconfig:
+
+2012-10-28  Mark Rowe  <mrowe@apple.com>
+
+        Remove references to unsupported OS and Xcode versions.
+
+        Reviewed by Anders Carlsson.
+
+        * Configurations/Base.xcconfig:
+        * Configurations/CompilerVersion.xcconfig: Removed.
+        * Configurations/DebugRelease.xcconfig:
+        * Configurations/Version.xcconfig:
+        * DerivedSources.make:
+        * WebKit2.xcodeproj/project.pbxproj:
+
+2012-10-29  Alexey Proskuryakov  <ap@apple.com>
+
+        [WK2] Add a NetworkingContext for NetworkProcess
+        https://bugs.webkit.org/show_bug.cgi?id=100708
+
+        Reviewed by Anders Carlsson.
+
+        Each request will have a context, because these are so lightweight on Mac, and
+        other platforms will need ResourceHandle refactored anyway to use NetworkProcess.
+
+        * NetworkProcess/mac/RemoteNetworkingContext.h: Added.
+        * NetworkProcess/mac/RemoteNetworkingContext.mm: Added.
+        These go mac/ subdirectory, because NetworkingContext interface is different on
+        each platform, as ResourceHandle needs dictate.
+
+        * WebKit2.xcodeproj/project.pbxproj:
+
+2012-10-29  Michael Saboff  <msaboff@apple.com>
+
+        buildHTTPHeaders() should use a StringBuilder.appendLiteral() for separator
+        https://bugs.webkit.org/show_bug.cgi?id=100689
+
+        Reviewed by Darin Adler.
+
+        Changed from using a String temporary for the separator to using StringBuilder.appendLiteral(": ").
+
+        * WebProcess/Plugins/PluginView.cpp:
+        (WebKit::buildHTTPHeaders):
+
+2012-10-29  Michael Saboff  <msaboff@apple.com>
+
+        WKStringCopyCFString() should directly use 8 bit Strings data instead of up converting
+        https://bugs.webkit.org/show_bug.cgi?id=100579
+
+        Reviewed by Oliver Hunt.
+
+        Changed to use CFStringCreateWithBytes() for 8 bit strings using characters8() for an 8 bit argument string.
+        Changed the current call to characters16().
+
+        * Shared/API/c/cf/WKStringCF.cpp:
+        (WKStringCopyCFString):
+
+2012-10-29  Enrica Casucci  <enrica@apple.com>
+
+        Add ENABLE_USERSELECT_ALL feature flag.
+        https://bugs.webkit.org/show_bug.cgi?id=100559
+
+        Reviewed by Eric Seidel.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2012-10-29  Christophe Dumez  <christophe.dumez@intel.com>
+
+        [WK2][WKTR] Enable Shadow DOM at runtime if compiled with SHADOW_DOM support
+        https://bugs.webkit.org/show_bug.cgi?id=100668
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Add Bundle API to enable Shadow DOM functionality. This is
+        now needed by WebKitTestRunner.
+
+        * WebProcess/InjectedBundle/API/c/WKBundle.cpp:
+        (WKBundleSetShadowDOMEnabled):
+        * WebProcess/InjectedBundle/API/c/WKBundlePrivate.h:
+        * WebProcess/InjectedBundle/InjectedBundle.cpp:
+        (WebKit::InjectedBundle::setShadowDOMEnabled):
+        (WebKit):
+        * WebProcess/InjectedBundle/InjectedBundle.h:
+        (InjectedBundle):
+
+2012-10-29  Christophe Dumez  <christophe.dumez@intel.com>
+
+        [EFL][WK2] Fix cursor change detection in EwkViewImpl::setCursor()
+        https://bugs.webkit.org/show_bug.cgi?id=100662
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Cursor change detection in EwkViewImpl::setCursor() relies on
+        addresses returned by Cursor::platformCursor(). However, the
+        value returned is currently assigned to a WKEinaSharedString
+        instead of a raw pointer. Therefore, the address is always
+        different and we keep recreating Evas Objects for the same
+        cursor.
+
+        * UIProcess/API/efl/EwkViewImpl.cpp:
+        (EwkViewImpl::EwkViewImpl):
+        (EwkViewImpl::setCursor): Call smartData() after same cursor
+        detection since it is not needed if the cursor has not changed
+        and it may affect performance.
+        * UIProcess/API/efl/EwkViewImpl.h:
+        (EwkViewImpl):
+
+2012-10-29  Jocelyn Turcotte  <jocelyn.turcotte@digia.com>
+
+        Coordinated Graphics: Make sure that we release images immediately when purging resources
+        https://bugs.webkit.org/show_bug.cgi?id=100661
+
+        Reviewed by Noam Rosenthal.
+
+        When we purge, we do both on the UI and web process at the same time,
+        both are expected to release references of the other process.
+        This creates problem when delaying the release of directly composited
+        images.
+
+        Release them immediately in that case.
+
+        Fixes the tst_QQuickWebView::removeFromCanvas API test.
+
+        * WebProcess/WebPage/CoordinatedGraphics/LayerTreeCoordinator.cpp:
+        (WebKit::LayerTreeCoordinator::flushPendingLayerChanges):
+        (WebKit::LayerTreeCoordinator::purgeReleasedImages):
+        (WebKit):
+        (WebKit::LayerTreeCoordinator::purgeBackingStores):
+        * WebProcess/WebPage/CoordinatedGraphics/LayerTreeCoordinator.h:
+        (LayerTreeCoordinator):
+
+2012-10-29  Christophe Dumez  <christophe.dumez@intel.com>
+
+        [EFL][WK2] Avoid useless assignment in EwkViewImpl::setCustomTextEncodingName()
+        https://bugs.webkit.org/show_bug.cgi?id=100667
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Remove useless m_customEncoding assignment in EwkViewImpl::setCustomTextEncodingName()
+        since the member is anyway assigned in EwkViewImpl::customTextEncodingName().
+
+        Have EwkViewImpl::setCustomTextEncodingName() take a String in argument instead
+        of a const char* to make the API more C++ and since we don't need a const char*
+        to assign to m_customEncoding anymore.
+
+        * UIProcess/API/efl/EwkViewImpl.cpp:
+        (EwkViewImpl::setCustomTextEncodingName):
+        * UIProcess/API/efl/EwkViewImpl.h:
+        (EwkViewImpl):
+        * UIProcess/API/efl/ewk_view.cpp:
+        (ewk_view_setting_encoding_custom_set):
+
+2012-10-29  Jocelyn Turcotte  <jocelyn.turcotte@digia.com>
+
+        [WK2] Enable delegated scrolling as soon as the FrameView is created when using fixed layout
+        https://bugs.webkit.org/show_bug.cgi?id=100383
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Scroll requests and PageTransitionViewportReady messages depend on
+        delegated scrolling being set properly on the FrameView to behave
+        properly. Since we were waiting for the viewport information to be
+        ready before setting the flag this could cause those messages to be avoided.
+
+        This patch takes most of the flag set by setResizesToContentsUsingLayoutSize
+        and apply them as soon as possible in WebPage::setUseFixedLayout and
+        WebFrameLoaderClient::transitionToCommittedForNewPage.
+
+        The behavior should be the same except for the following settings which are
+        now set outside of USE(TILED_BACKING_STORE) if we're using fixed layout:
+        - setAcceleratedCompositingForFixedPositionEnabled
+        - setFixedElementsLayoutRelativeToFrame
+        - setFixedPositionCreatesStackingContext
+
+        This fixes the tst_QQuickWebView::scrollRequest auto test and improves the
+        reliability of the loadVisuallyCommitted signal with pages loaded from disk.
+
+        * WebProcess/WebCoreSupport/WebFrameLoaderClient.cpp:
+        (WebKit::WebFrameLoaderClient::transitionToCommittedForNewPage):
+        * WebProcess/WebPage/WebPage.cpp:
+        (WebKit::WebPage::sendViewportAttributesChanged):
+        (WebKit::WebPage::setUseFixedLayout):
+        (WebKit::WebPage::setFixedLayoutSize):
+        * WebProcess/WebPage/WebPage.h:
+        (WebPage):
+
+2012-10-29  Raphael Kubo da Costa  <raphael.kubo.da.costa@intel.com>
+
+        Unreviewed build fix after r132709.
+
+        * Shared/WebMemorySampler.cpp: Include unistd.h for getpid(3).
+
+2012-10-28  Byungwoo Lee  <bw80.lee@samsung.com>
+
+        [WK2] Fix the incorrect use of preprocessor statement in API header.
+        https://bugs.webkit.org/show_bug.cgi?id=100610
+
+        Reviewed by Timothy Hatcher.
+
+        Remove the preprocessor statement to check 'ENABLE_INSPECTOR' feature
+        from the WKPage.h.
+
+        * UIProcess/API/C/WKPage.cpp:
+        (WKPageGetInspector):
+        * UIProcess/API/C/WKPage.h:
+
+2012-10-28  Yael Aharon  <yael.aharon@intel.com>
+
+        [EFL][WK2][AC] Viewport size does not change when the window size changes
+        https://bugs.webkit.org/show_bug.cgi?id=100573
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        The viewport size is set when we create the window the first time
+        and does not change automatically afterwards. When we change the window size,
+        we need to explicitly change the viewport size as well.
+
+        * UIProcess/API/efl/EwkViewImpl.cpp:
+        (EwkViewImpl::createGLSurface):
+
+2012-10-27  Noam Rosenthal  <noam.rosenthal@nokia.com>
+
+        Unreviewed build fix for breakage to minimal bot caused by r132742.
+
+        * WebProcess/WebPage/LayerTreeHost.h:
+        (LayerTreeHost):
+            Added appropriate ENABLE(REQUEST_ANIMATION_FRAME) flag.
+
+2012-10-27  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r132740.
+        http://trac.webkit.org/changeset/132740
+        https://bugs.webkit.org/show_bug.cgi?id=100603
+
+        "Causing many crashes" (Requested by weinig on #webkit).
+
+        * UIProcess/Downloads/DownloadProxy.cpp:
+        (WebKit::DownloadProxy::DownloadProxy):
+        (WebKit::DownloadProxy::invalidate):
+        (WebKit):
+        * UIProcess/Downloads/DownloadProxy.h:
+        (DownloadProxy):
+        * UIProcess/WebContext.cpp:
+        (WebKit::WebContext::createDownloadProxy):
+        (WebKit::WebContext::downloadFinished):
+        (WebKit::WebContext::didReceiveMessage):
+        (WebKit::WebContext::didReceiveSyncMessage):
+        * UIProcess/WebContext.h:
+        (WebKit):
+        * UIProcess/WebPageProxy.cpp:
+        (WebKit::WebPageProxy::WebPageProxy):
+        (WebKit::WebPageProxy::~WebPageProxy):
+        (WebKit::WebPageProxy::didReceiveMessage):
+        (WebKit::WebPageProxy::didReceiveSyncMessage):
+        * UIProcess/WebPageProxy.h:
+        (CoreIPC):
+        (WebPageProxy):
+        * UIProcess/WebProcessProxy.cpp:
+        (WebKit::WebProcessProxy::didReceiveMessage):
+        (WebKit::WebProcessProxy::didReceiveSyncMessage):
+        * UIProcess/WebProcessProxy.h:
+        (WebProcessProxy):
+        * WebProcess/WebPage/WebPageGroupProxy.cpp:
+        (WebKit::WebPageGroupProxy::~WebPageGroupProxy):
+        (WebKit):
+        (WebKit::WebPageGroupProxy::didReceiveMessage):
+        (WebKit::WebPageGroupProxy::WebPageGroupProxy):
+        * WebProcess/WebPage/WebPageGroupProxy.h:
+        (CoreIPC):
+        (WebPageGroupProxy):
+        * WebProcess/WebProcess.cpp:
+        (WebKit::WebProcess::didReceiveSyncMessage):
+        (WebKit::WebProcess::didReceiveMessage):
+
+2012-10-27  Noam Rosenthal  <noam.rosenthal@nokia.com>
+
+        Coordinated Graphics: Animation jerkiness when rAF is enabled
+        https://bugs.webkit.org/show_bug.cgi?id=100536
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        The jerkiness comes from the fact that we schedule animations excessively; That's because
+        the previous patch broke requestAnimationFrame behavior during CSS animations, since the
+        frame returns right away instead of waiting till the previous frame is actually rendered.
+
+        This patch makes sure that when animations are scheduled, they're only serviced after the
+        UI process has actually painted the previous frame. We do so by sending a
+        RequestAnimationFrame message to the UI process, which responds with AnimationFrameReady
+        after the UI process paints.
+
+        New test: fast/animations/request-animation-frame-too-rapid.html
+        Tests that we don't receive an unreasonably high number of callbacks from
+        requestAnimationFrame (> 1000FPS).
+
+        * UIProcess/CoordinatedGraphics/LayerTreeCoordinatorProxy.cpp:
+        (WebKit):
+        (WebKit::LayerTreeCoordinatorProxy::requestAnimationFrame):
+        (WebKit::LayerTreeCoordinatorProxy::animationFrameReady):
+        * UIProcess/CoordinatedGraphics/LayerTreeCoordinatorProxy.h:
+        (LayerTreeCoordinatorProxy):
+        * UIProcess/CoordinatedGraphics/LayerTreeCoordinatorProxy.messages.in:
+        * UIProcess/CoordinatedGraphics/LayerTreeRenderer.cpp:
+        (WebKit::LayerTreeRenderer::LayerTreeRenderer):
+        (WebKit::LayerTreeRenderer::paintToCurrentGLContext):
+        (WebKit):
+        (WebKit::LayerTreeRenderer::animationFrameReady):
+        (WebKit::LayerTreeRenderer::requestAnimationFrame):
+        * UIProcess/CoordinatedGraphics/LayerTreeRenderer.h:
+        (LayerTreeRenderer):
+        * WebProcess/WebPage/CoordinatedGraphics/LayerTreeCoordinator.cpp:
+        (WebKit):
+        (WebKit::LayerTreeCoordinator::scheduleAnimation):
+        (WebKit::LayerTreeCoordinator::animationFrameReady):
+        * WebProcess/WebPage/CoordinatedGraphics/LayerTreeCoordinator.h:
+        (LayerTreeCoordinator):
+        * WebProcess/WebPage/CoordinatedGraphics/LayerTreeCoordinator.messages.in:
+
+2012-10-27  Sam Weinig  <sam@webkit.org>
+
+        Yet more MessageReceivering
+        https://bugs.webkit.org/show_bug.cgi?id=100325
+
+        Reviewed by Anders Carlsson.
+
+        Make DownloadProxy, WebPageProxy, and WebPageGroupProxy MessageReceivers.
+
+        * UIProcess/Downloads/DownloadProxy.cpp:
+        (WebKit::DownloadProxy::DownloadProxy):
+        (WebKit::DownloadProxy::invalidate):
+        (WebKit::DownloadProxy::didReceiveMessage):
+        (WebKit::DownloadProxy::didReceiveSyncMessage):
+        * UIProcess/Downloads/DownloadProxy.h:
+        (DownloadProxy):
+        Make a MessageReceiver.
+
+        * UIProcess/WebContext.cpp:
+        (WebKit::WebContext::WebContext):
+        (WebKit::WebContext::addMessageReceiver):
+        (WebKit::WebContext::removeMessageReceiver):
+        (WebKit::WebContext::didReceiveMessage):
+        (WebKit::WebContext::didReceiveSyncMessage):
+        * UIProcess/WebContext.h:
+        Add additional MessageReceiverMap forwards, and stop dealing with DownloadProxy explicitly.
+        
+        * UIProcess/WebPageProxy.cpp:
+        (WebKit::WebPageProxy::WebPageProxy):
+        (WebKit::WebPageProxy::~WebPageProxy):
+        (WebKit::WebPageProxy::didReceiveMessage):
+        (WebKit::WebPageProxy::didReceiveSyncMessage):
+        * UIProcess/WebPageProxy.h:
+        Make a MessageReceiver, but keep sub objects using didReceiveMessage for now (like WebPage).
+        
+        * UIProcess/WebProcessProxy.cpp:
+        (WebKit::WebProcessProxy::addMessageReceiver):
+        (WebKit::WebProcessProxy::removeMessageReceiver):
+        (WebKit::WebProcessProxy::didReceiveMessage):
+        (WebKit::WebProcessProxy::didReceiveSyncMessage):
+        * UIProcess/WebProcessProxy.h:
+        Give WebProcessProxy a MessageReceiverMap and all the appropriate forwarding methods.
+        
+        * WebProcess/WebPage/WebPageGroupProxy.cpp:
+        (WebKit::WebPageGroupProxy::WebPageGroupProxy):
+        (WebKit::WebPageGroupProxy::~WebPageGroupProxy):
+        (WebKit::WebPageGroupProxy::didReceiveMessage):
+        * WebProcess/WebPage/WebPageGroupProxy.h:
+        (WebKit::WebPageGroupProxy::isVisibleToHistoryClient):
+        (WebPageGroupProxy):
+        Make a MessageReceiver and register/unregister with the WebProcess.
+
+        * WebProcess/WebProcess.cpp:
+        (WebKit::WebProcess::didReceiveSyncMessage):
+        Remove extraneous return statement.
+        (WebKit::WebProcess::didReceiveMessage):
+        Stop handling WebPageGroupProxy special.
+
+2012-10-27  Sam Weinig  <sam@webkit.org>
+
+        Completely roll out https://bugs.webkit.org/show_bug.cgi?id=99251 (r131686)
+
+        It has caused too many crashes.
+
+        * UIProcess/API/mac/PageClientImpl.mm:
+        * UIProcess/API/mac/WKView.mm:
+        * UIProcess/API/mac/WKViewInternal.h:
+        * UIProcess/API/mac/WKViewPrivate.h:
+        * UIProcess/mac/CorrectionPanel.mm:
+        * UIProcess/mac/WKFullScreenWindowController.mm:
+        * UIProcess/mac/WebFullScreenManagerProxyMac.mm:
+
+2012-10-27  Michael Saboff  <msaboff@apple.com>
+
+        buildHTTPHeaders() should use a StringBuilder instead of a Vector<UChar>
+        https://bugs.webkit.org/show_bug.cgi?id=100580
+
+        Reviewed by Oliver Hunt.
+
+        Replaced Vector<UChar> with StringBuilder in the HTTP header construction function buildHTTPHeaders.
+        This eliminates 8 -> 16 bit up conversion of the strings involved.
+
+        * WebProcess/Plugins/PluginView.cpp:
+        (WebKit::buildHTTPHeaders):
+
+2012-10-27  Dan Bernstein  <mitz@apple.com>
+
+        REAL_PLATFORM_NAME build setting is no longer needed
+        https://bugs.webkit.org/show_bug.cgi?id=100587
+
+        Reviewed by Mark Rowe.
+
+        Removed the definition of REAL_PLATFORM_NAME and replaced references to it with references
+        to PLATFORM_NAME.
+
+        * Configurations/Base.xcconfig:
+        * Configurations/BaseTarget.xcconfig:
+        * Configurations/CompilerVersion.xcconfig:
+        * Configurations/FeatureDefines.xcconfig:
+        * Configurations/WebKit2.xcconfig:
+
+2012-10-26  Brady Eidson  <beidson@apple.com>
+
+        Have NetworkProcess manage resource load scheduling.
+        https://bugs.webkit.org/show_bug.cgi?id=100479
+
+        Reviewed by Alexey Proskuryakov.
+
+        Implement a ResourceLoadScheduler that models the same behavior as WebCore::ResourceLoadScheduler.
+        
+        The WebProcess scheduler acts as a marshall to the NetworkProcess scheduler via CoreIPC messaging.
+
+        Besides MainResourceLoads which are started directly in the WebProcess, all other loads are now
+        started only when the NetworkProcess tells them to start.
+
+        Build-system and messaging related stuff:
+        * DerivedSources.make:
+        * Platform/CoreIPC/MessageID.h:
+        * WebKit2.xcodeproj/project.pbxproj:
+
+        Add a new Network logging channel.
+        * Platform/Logging.cpp:
+        (WebKit::getChannelFromName):
+        * Platform/Logging.h:
+
+        Modeled after ResourceLoadScheduler::HostInformation but more specifically geared towards what NetworkProcess needs to track:
+        * NetworkProcess/HostRecord.cpp: Added.
+        (WebKit::HostRecord::HostRecord):
+        (WebKit::HostRecord::~HostRecord):
+        (WebKit::HostRecord::schedule):
+        (WebKit::HostRecord::addLoadInProgress):
+        (WebKit::HostRecord::remove):
+        (WebKit::HostRecord::hasRequests):
+        (WebKit::HostRecord::limitRequests):
+        * NetworkProcess/HostRecord.h:
+        (WebKit::HostRecord::name):
+        (WebKit::HostRecord::requestsPending):
+
+        Gateway messaging from the WebResourceLoadScheduler to the NetworkResourceLoadScheduler:
+        * NetworkProcess/NetworkConnectionToWebProcess.cpp:
+        (WebKit::NetworkConnectionToWebProcess::NetworkConnectionToWebProcess):
+        (WebKit::NetworkConnectionToWebProcess::~NetworkConnectionToWebProcess):
+        (WebKit::NetworkConnectionToWebProcess::registerObserver):
+        (WebKit::NetworkConnectionToWebProcess::unregisterObserver):
+        (WebKit::NetworkConnectionToWebProcess::didReceiveMessage):
+        (WebKit::NetworkConnectionToWebProcess::didReceiveSyncMessage):
+        (WebKit::NetworkConnectionToWebProcess::didClose):
+        (WebKit::NetworkConnectionToWebProcess::scheduleNetworkRequest):
+        (WebKit::NetworkConnectionToWebProcess::addLoadInProgress):
+        (WebKit::NetworkConnectionToWebProcess::removeLoadIdentifier):
+        (WebKit::NetworkConnectionToWebProcess::crossOriginRedirectReceived):
+        (WebKit::NetworkConnectionToWebProcess::servePendingRequests):
+        (WebKit::NetworkConnectionToWebProcess::suspendPendingRequests):
+        (WebKit::NetworkConnectionToWebProcess::resumePendingRequests):
+        (WebKit::NetworkConnectionToWebProcess::setSerialLoadingEnabled):
+        * NetworkProcess/NetworkConnectionToWebProcess.h:
+        (NetworkConnectionToWebProcessObserver): Add an observer interface so arbitrary objects can be notified if
+          a Network->WebProcess connection closes.
+        (WebKit::NetworkConnectionToWebProcessObserver::~NetworkConnectionToWebProcessObserver):
+        (WebKit::NetworkConnectionToWebProcess::isSerialLoadingEnabled):
+        * NetworkProcess/NetworkConnectionToWebProcess.messages.in:
+
+        Represents a request,  ResourceLoadIdentifier, and connection that all correspond to the same pending NetworkLoad:
+        * NetworkProcess/NetworkRequest.cpp:
+        (WebKit::NetworkRequest::NetworkRequest):
+        (WebKit::NetworkRequest::~NetworkRequest):
+        (WebKit::NetworkRequest::connectionToWebProcessDidClose): Using the NetworkConnectionToWebProcessObserver interface,
+          if the connection closes then clear out the connection pointer for this request that is now irrelevant.
+        * NetworkProcess/NetworkRequest.h:
+        (WebKit::NetworkRequest::create):
+        (WebKit::NetworkRequest::identifier):
+        (WebKit::NetworkRequest::connectionToWebProcess):
+
+        Manages connection-per-host scheduling with the same structure as WebCore::ResourceLoadScheduling but also with IPC:
+        * NetworkProcess/NetworkResourceLoadScheduler.cpp: Added.
+        (WebKit::NetworkResourceLoadScheduler::NetworkResourceLoadScheduler):
+        (WebKit::NetworkResourceLoadScheduler::scheduleServePendingRequests):
+        (WebKit::NetworkResourceLoadScheduler::requestTimerFired):
+        (WebKit::NetworkResourceLoadScheduler::scheduleNetworkRequest):
+        (WebKit::NetworkResourceLoadScheduler::addLoadInProgress):
+        (WebKit::NetworkResourceLoadScheduler::hostForURL):
+        (WebKit::NetworkResourceLoadScheduler::removeLoadIdentifier):
+        (WebKit::NetworkResourceLoadScheduler::crossOriginRedirectReceived):
+        (WebKit::NetworkResourceLoadScheduler::servePendingRequests):
+        (WebKit::NetworkResourceLoadScheduler::servePendingRequestsForHost): Serve as many requests for the host as we should,
+          skipping the NetworkRequests who have lost their connection to their WebProcess.
+        (WebKit::NetworkResourceLoadScheduler::suspendPendingRequests):
+        (WebKit::NetworkResourceLoadScheduler::resumePendingRequests):
+        * NetworkProcess/NetworkResourceLoadScheduler.h: Added.
+        * NetworkProcess/mac/NetworkResourceLoadSchedulerMac.mm: Added.
+        (WebKit::NetworkResourceLoadScheduler::platformInitializeMaximumHTTPConnectionCountPerHost):
+
+        * NetworkProcess/NetworkProcess.h:
+        (WebKit::NetworkProcess::networkResourceLoadScheduler): Add a scheduler global to the NetworkProcess.
+
+        A thin derivation of WebCore::ResourceLoadScheduler, most of what WebResourceLoadScheduler does is handle IPC to the NetworkProcess:
+        * WebProcess/Network/WebResourceLoadScheduler.cpp:
+        (WebKit::WebResourceLoadScheduler::WebResourceLoadScheduler):
+        (WebKit::WebResourceLoadScheduler::scheduleSubresourceLoad):
+        (WebKit::WebResourceLoadScheduler::schedulePluginStreamLoad):
+        (WebKit::WebResourceLoadScheduler::scheduleLoad):
+        (WebKit::WebResourceLoadScheduler::addMainResourceLoad):
+        (WebKit::WebResourceLoadScheduler::remove):
+        (WebKit::WebResourceLoadScheduler::crossOriginRedirectReceived):
+        (WebKit::WebResourceLoadScheduler::servePendingRequests):
+        (WebKit::WebResourceLoadScheduler::suspendPendingRequests):
+        (WebKit::WebResourceLoadScheduler::resumePendingRequests):
+        (WebKit::WebResourceLoadScheduler::setSerialLoadingEnabled):
+        (WebKit::WebResourceLoadScheduler::startResourceLoad):
+        * WebProcess/Network/WebResourceLoadScheduler.h:
+
+        Add the ability for the NetworkProcess to message back to the WebProcess telling it to start a resource load:
+        * WebProcess/Network/NetworkProcessConnection.cpp:
+        (WebKit::NetworkProcessConnection::didReceiveMessage):
+        (WebKit::NetworkProcessConnection::didReceiveSyncMessage):
+        (WebKit::NetworkProcessConnection::startResourceLoad):
+        * WebProcess/Network/NetworkProcessConnection.h:
+        * WebProcess/Network/NetworkProcessConnection.messages.in:
+
+        * WebProcess/WebCoreSupport/WebPlatformStrategies.cpp:
+        (WebKit::WebPlatformStrategies::resourceLoadScheduler): Only return the WebResourceLoadScheduler if NetworkProcess is enabled.
+
+        * WebProcess/WebProcess.cpp:
+        (WebKit::WebProcess::ensureNetworkProcessConnection): Actually keep the NetworkProcessConnection around in a member variable.
+        (WebKit::WebProcess::networkConnection):
+        * WebProcess/WebProcess.h:
+        (WebKit::WebProcess::usesNetworkProcess): Expose this for platform strategies sake.
+
+2012-10-26  Brady Eidson  <beidson@apple.com>
+
+        Crash in WebProces at WebCore::ResourceLoadScheduler::crossOriginRedirectReceived + 78
+        https://bugs.webkit.org/show_bug.cgi?id=100554
+
+        Reviewed by Alexey Proskuryakov.
+
+        For now, just have WebPlatformStrategies return the same default resourceLoadScheduler that
+        WebCore knows about.
+
+        * WebProcess/WebCoreSupport/WebPlatformStrategies.cpp:
+        (WebKit::WebPlatformStrategies::resourceLoadScheduler):
+
+2012-10-26  Anders Carlsson  <andersca@apple.com>
+
+        Crash when making NPRuntime calls with a null NPP pointer
+        https://bugs.webkit.org/show_bug.cgi?id=100569
+        <rdar://problem/11726426>
+        <rdar://problem/12352836>
+
+        Reviewed by Darin Adler.
+
+        Finally bite the bullet and remove the assertion from NetscapePlugin::fromNPP. The WebKit1 equivalent of this
+        function used to return the plug-in currently being initialized in NPP_New, but we've never done that in WebKit2
+        and it has never been necessary. The crashes fixed here are not from calls underneath NPP_New so fixing it wouldn't
+        do us any good anyway.
+        
+        Also, make the PluginDestructionProtector handle a null plug-in gracefully.
+
+        * WebProcess/Plugins/Netscape/NetscapeBrowserFuncs.cpp:
+        (WebKit::PluginDestructionProtector::PluginDestructionProtector):
+        (PluginDestructionProtector):
+        * WebProcess/Plugins/Netscape/NetscapePlugin.cpp:
+        (WebKit::NetscapePlugin::fromNPP):
+
+2012-10-26  Stephanie Lewis  <slewis@apple.com>
+
+        Add pids to WebMemorySampleFiles.
+        https://bugs.webkit.org/show_bug.cgi?id=100449.
+
+        Reviewed by Tim Horton.
+
+        Make it easier to associate WebMemorySamples with a process.  Add the pid to the filename and header.
+
+        * Shared/WebMemorySampler.cpp:
+        (WebKit::WebMemorySampler::initializeTimers): Update notification.
+        (WebKit::WebMemorySampler::stop): Update notification.
+        (WebKit::WebMemorySampler::writeHeaders): dump pid in the header.
+        * UIProcess/WebContext.cpp:
+        (WebKit::WebContext::processDidFinishLaunching): append pid to filename.
+
+2012-10-26  Yael Aharon  <yael.aharon@intel.com>
+
+        [EFL][WK2][AC] Build fix after r132647.
+        https://bugs.webkit.org/show_bug.cgi?id=100540
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        AC enabled build is broken after the latest refactoring of EFL WK2.
+
+        * UIProcess/API/efl/EwkViewImpl.cpp:
+        (EwkViewImpl::EwkViewImpl):
+        (EwkViewImpl::displayTimerFired):
+        (EwkViewImpl::informLoadCommitted):
+        (EwkViewImpl::createGLSurface):
+        (EwkViewImpl::enterAcceleratedCompositingMode):
+        (EwkViewImpl::exitAcceleratedCompositingMode):
+        (EwkViewImpl::informContentsSizeChange):
+        * UIProcess/API/efl/EwkViewImpl.h:
+        (EwkViewImpl):
+        (EwkViewImpl::pageViewportControllerClient):
+        (EwkViewImpl::pageViewportController):
+        (EwkViewImpl::evasGl):
+        (EwkViewImpl::evasGlContext):
+        (EwkViewImpl::evasGlSurface):
+        (EwkViewImpl::resetEvasGlSurface):
+        * UIProcess/API/efl/ewk_view.cpp:
+        (mapToWebContent):
+        (_ewk_view_smart_calculate):
+
+2012-10-26  Christophe Dumez  <christophe.dumez@intel.com>
+
+        [EFL][WK2] Get rid of C'ism in text checker API
+        https://bugs.webkit.org/show_bug.cgi?id=100513
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Make Ewk_Text_Checker a C++ class and move the
+        WebKitTextChecker code to this new class. This
+        gets rid of the C'ism in the text checker code
+        and make it consistent with other Ewk classes.
+
+        * PlatformEfl.cmake:
+        * UIProcess/API/efl/ewk_context.cpp:
+        (Ewk_Context::Ewk_Context):
+        * UIProcess/API/efl/ewk_settings.cpp:
+        (spellCheckingLanguagesSetUpdate):
+        (ewk_settings_continuous_spell_checking_enabled_set):
+        (ewk_settings_spell_checking_available_languages_get):
+        (ewk_settings_spell_checking_languages_get):
+        * UIProcess/API/efl/ewk_text_checker.cpp:
+        (ClientCallbacks):
+        (textCheckerEnchant):
+        (clientCallbacks):
+        (isContinuousSpellCheckingEnabled):
+        (setContinuousSpellCheckingEnabled):
+        (uniqueSpellDocumentTag):
+        (closeSpellDocumentWithTag):
+        (checkSpellingOfString):
+        (guessesForWord):
+        (learnWord):
+        (ignoreWord):
+        (Ewk_Text_Checker):
+        (Ewk_Text_Checker::availableSpellCheckingLanguages):
+        (Ewk_Text_Checker::updateSpellCheckingLanguages):
+        (Ewk_Text_Checker::loadedSpellCheckingLanguages):
+        (Ewk_Text_Checker::initialize):
+        * UIProcess/API/efl/ewk_text_checker_private.h:
+        (Ewk_Text_Checker):
+        * UIProcess/efl/WebKitTextChecker.cpp: Removed.
+        * UIProcess/efl/WebKitTextChecker.h: Removed.
+
+2012-10-26  Mikhail Pozdnyakov  <mikhail.pozdnyakov@intel.com>
+
+        [EFL][WK2] Clean up construction/destruction code in Ewk_view
+        https://bugs.webkit.org/show_bug.cgi?id=100232
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Simplified a lot of initialization and destruction code of Ewk_view and EwkViewImpl
+        put all the impl stuff to its constructor and destructor, also made EwkViewImpl member
+        variables private.
+
+        * UIProcess/API/efl/EwkViewImpl.cpp:
+        (pageViewMap):
+        (EwkViewImpl::addToPageViewMap):
+        (EwkViewImpl::removeFromPageViewMap):
+        (EwkViewImpl::viewFromPageViewMap):
+        (EwkViewImpl::EwkViewImpl):
+        (EwkViewImpl::~EwkViewImpl):
+        (EwkViewImpl::wkPage):
+        (EwkViewImpl::title):
+        (EwkViewImpl::setThemePath):
+        (EwkViewImpl::customTextEncodingName):
+        (EwkViewImpl::setCustomTextEncodingName):
+        (EwkViewImpl::informIconChange):
+        (EwkViewImpl::informWebProcessCrashed):
+        (EwkViewImpl::updateTextInputState):
+        (EwkViewImpl::informURLChange):
+        (EwkViewImpl::onFaviconChanged):
+        * UIProcess/API/efl/EwkViewImpl.h:
+        (WebKit):
+        (EwkViewImpl):
+        (EwkViewImpl::view):
+        (EwkViewImpl::page):
+        (EwkViewImpl::ewkContext):
+        (EwkViewImpl::backForwardList):
+        * UIProcess/API/efl/ewk_settings.cpp:
+        (Ewk_Settings::preferences):
+        * UIProcess/API/efl/ewk_view.cpp:
+        (_ewk_view_smart_focus_in):
+        (_ewk_view_smart_focus_out):
+        (_ewk_view_smart_mouse_wheel):
+        (_ewk_view_smart_mouse_down):
+        (_ewk_view_smart_mouse_up):
+        (_ewk_view_smart_mouse_move):
+        (_ewk_view_smart_key_down):
+        (_ewk_view_smart_key_up):
+        (_ewk_view_on_show):
+        (_ewk_view_on_hide):
+        (_ewk_view_smart_add):
+        (_ewk_view_smart_del):
+        (_ewk_view_smart_calculate):
+        (_ewk_view_smart_color_set):
+        (createEwkViewSmartClass):
+        (createEwkView):
+        (ewk_view_base_add):
+        (ewk_view_smart_add):
+        (ewk_view_add_with_context):
+        (ewk_view_url_set):
+        (ewk_view_reload):
+        (ewk_view_reload_bypass_cache):
+        (ewk_view_stop):
+        (ewk_view_load_progress_get):
+        (ewk_view_scale_set):
+        (ewk_view_scale_get):
+        (ewk_view_device_pixel_ratio_set):
+        (ewk_view_device_pixel_ratio_get):
+        (ewk_view_back):
+        (ewk_view_forward):
+        (ewk_view_intent_deliver):
+        (ewk_view_back_possible):
+        (ewk_view_forward_possible):
+        (ewk_view_back_forward_list_get):
+        (ewk_view_html_string_load):
+        (ewk_view_text_find):
+        (ewk_view_text_find_highlight_clear):
+        (ewk_view_text_matches_count):
+        (ewk_view_feed_touch_event):
+        (ewk_view_inspector_show):
+        (ewk_view_inspector_close):
+        (ewk_view_pagination_mode_set):
+        (ewk_view_pagination_mode_get):
+
+2012-10-26  Christophe Dumez  <christophe.dumez@intel.com>
+
+        [EFL][WK2] Initialize Ewk_Context class members in initialization list
+        https://bugs.webkit.org/show_bug.cgi?id=100503
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Move Ewk_Context class members initialization from the
+        constructor body to the initialization list for
+        efficiency.
+
+        * UIProcess/API/efl/ewk_context.cpp:
+        (Ewk_Context::Ewk_Context):
+
+2012-10-26  Jocelyn Turcotte  <jocelyn.turcotte@digia.com>
+
+        LayerTreeCoordinator: Make sure that dependent layers are deleted before their directly composited image
+        https://bugs.webkit.org/show_bug.cgi?id=100495
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Since r128980 layers removals are delayed until we flush the layer tree.
+        This causes a crash if such a layer had a directly composited image since
+        the image is now deleted while the layer is still active in the UI process
+        and tries to access a deleted backing store.
+
+        Fix it by delaying the directly composited image removal as well.
+
+        Fixes a crash in tst_QQuickWebView::basicRenderingSanity since showWebView is
+        called first and loads direct-image-compositing.html.
+
+        * UIProcess/CoordinatedGraphics/LayerTreeRenderer.h: 
+        (LayerTreeRenderer): Remove unused variable.
+        * WebProcess/WebPage/CoordinatedGraphics/LayerTreeCoordinator.cpp:
+        (WebKit::LayerTreeCoordinator::flushPendingLayerChanges):
+        (WebKit::LayerTreeCoordinator::releaseImageBackingStore):
+        * WebProcess/WebPage/CoordinatedGraphics/LayerTreeCoordinator.h:
+        (LayerTreeCoordinator):
+
+2012-10-26  Regina Chung  <heejin.r.chung@samsung.com>
+
+        [EFL][WK2] Enable WebGL
+        https://bugs.webkit.org/show_bug.cgi?id=97652
+
+        Reviewed by Gyuyoung Kim.
+
+        Set WebGLEnabled to true when WebGL is enabled.
+
+        * UIProcess/API/efl/ewk_view.cpp:
+        (_ewk_view_initialize):
+
+2012-10-26  Christophe Dumez  <christophe.dumez@intel.com>
+
+        [EFL][WK2] Add Ewk_Color_Picker API
+        https://bugs.webkit.org/show_bug.cgi?id=100472
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Move the color picker code out of EwkViewImpl and into
+        a new Ewk_Color_Picker class to avoid cluttering the
+        view code.
+
+        * PlatformEfl.cmake:
+        * UIProcess/API/efl/EWebKit2.h:
+        * UIProcess/API/efl/EwkViewImpl.cpp:
+        (EwkViewImpl::requestColorPicker):
+        (EwkViewImpl::dismissColorPicker):
+        * UIProcess/API/efl/EwkViewImpl.h:
+        (EwkViewImpl):
+        * UIProcess/API/efl/ewk_color_picker.cpp: Added.
+        (Ewk_Color_Picker::Ewk_Color_Picker):
+        (Ewk_Color_Picker::setColor):
+        (Ewk_Color_Picker::color):
+        (ewk_color_picker_color_set):
+        (ewk_color_picker_color_get):
+        * UIProcess/API/efl/ewk_color_picker.h: Added.
+        * UIProcess/API/efl/ewk_color_picker_private.h: Added.
+        (Ewk_Color_Picker):
+        (Ewk_Color_Picker::create):
+        * UIProcess/API/efl/ewk_view.cpp:
+        * UIProcess/API/efl/ewk_view.h:
+        * UIProcess/API/efl/tests/test_ewk2_color_picker.cpp: Added.
+        (onColorPickerDone):
+        (setColorPickerColor):
+        (showColorPicker):
+        (hideColorPicker):
+        (hideColorPickerByRemovingElement):
+        (TEST_F):
+        * UIProcess/API/efl/tests/test_ewk2_view.cpp:
+        * UIProcess/efl/PageUIClientEfl.cpp:
+        (WebKit::PageUIClientEfl::showColorPicker):
+
+2012-10-26  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r132601.
+        http://trac.webkit.org/changeset/132601
+        https://bugs.webkit.org/show_bug.cgi?id=100494
+
+        It broke the Qt build (Requested by Ossy on #webkit).
+
+        * UIProcess/API/efl/ewk_view.cpp:
+        (_ewk_view_initialize):
+
+2012-10-26  Regina Chung  <heejin.r.chung@samsung.com>
+
+        [EFL][WK2] Enable WebGL
+        https://bugs.webkit.org/show_bug.cgi?id=97652
+
+        Reviewed by Gyuyoung Kim.
+
+        Set WebGLEnabled to true when WebGL is enabled.
+
+        * UIProcess/API/efl/ewk_view.cpp:
+        (_ewk_view_initialize):
+
+2012-10-26  Thiago Marcos P. Santos  <thiago.santos@intel.com>
+
+        Add feature flags for CSS Device Adaptation
+        https://bugs.webkit.org/show_bug.cgi?id=95960
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2012-10-26  Christophe Dumez  <christophe.dumez@intel.com>
+
+        [EFL][WK2] Move input method code out of EwkViewImpl
+        https://bugs.webkit.org/show_bug.cgi?id=100468
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Move input method code out of EwkViewImpl and into
+        a new InputMethodContextEfl class to avoid cluttering
+        the view code.
+
+        * PlatformEfl.cmake:
+        * UIProcess/API/efl/EwkViewImpl.cpp:
+        (EwkViewImpl::EwkViewImpl):
+        (EwkViewImpl::inputMethodContext):
+        * UIProcess/API/efl/EwkViewImpl.h:
+        (WebKit):
+        (EwkViewImpl):
+        * UIProcess/API/efl/ewk_view.cpp:
+        (_ewk_view_smart_mouse_up):
+        (_ewk_view_smart_key_down):
+        * UIProcess/efl/InputMethodContextEfl.cpp: Added.
+        (WebKit):
+        (WebKit::InputMethodContextEfl::InputMethodContextEfl):
+        (WebKit::InputMethodContextEfl::~InputMethodContextEfl):
+        (WebKit::InputMethodContextEfl::onIMFInputSequenceComplete):
+        (WebKit::InputMethodContextEfl::onIMFPreeditSequenceChanged):
+        (WebKit::InputMethodContextEfl::createIMFContext):
+        (WebKit::InputMethodContextEfl::handleMouseUpEvent):
+        (WebKit::InputMethodContextEfl::handleKeyDownEvent):
+        (WebKit::InputMethodContextEfl::updateTextInputState):
+        * UIProcess/efl/InputMethodContextEfl.h: Added.
+        (WebKit):
+        (InputMethodContextEfl):
+        (WebKit::InputMethodContextEfl::create):
+        * UIProcess/efl/PageClientImpl.cpp:
+        (WebKit::PageClientImpl::updateTextInputState):
+
+2012-10-26  Jaehun Lim  <ljaehun.lim@samsung.com>
+
+        Implement {get,set}FloatValueForKey
+        https://bugs.webkit.org/show_bug.cgi?id=100452
+
+        Reviewed by Anders Carlsson.
+
+        Implement missing functions in WebPreferencesStore.
+
+        * Shared/WebPreferencesStore.cpp:
+        (WebKit::WebPreferencesStore::setFloatValueForKey):
+        (WebKit):
+        (WebKit::WebPreferencesStore::getFloatValueForKey):
+
+2012-10-25  Byungwoo Lee  <bw80.lee@samsung.com>
+
+        [WK2] Use per destination ID message receivers for DownloadProxy.
+        https://bugs.webkit.org/show_bug.cgi?id=100342
+
+        Reviewed by Anders Carlsson.
+
+        Per destination ID message receivers were proposed in r132386.
+        IPC messages of DownloadProxy use download ID for destination ID,
+        so the messages should be handled by the messsage receiver that was
+        newly proposed.
+
+        * UIProcess/WebContext.cpp:
+        (WebKit::WebContext::WebContext):
+        (WebKit::WebContext::createDownloadProxy):
+        (WebKit::WebContext::downloadFinished):
+        (WebKit::WebContext::addMessageReceiver):
+        (WebKit):
+        (WebKit::WebContext::removeMessageReceiver):
+        * UIProcess/WebContext.h:
+        (WebContext):
+
+2012-10-25  Christophe Dumez  <christophe.dumez@intel.com>
+
+        [EFL][WK2] Add Ewk_Popup_Menu API
+        https://bugs.webkit.org/show_bug.cgi?id=100404
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Add new Ewk_Popup_Menu API to complete the existing
+        Ewk_Popup_Menu_Item one. This way, we can move the
+        popup menu code out of Ewk_View.
+
+        * PlatformEfl.cmake:
+        * UIProcess/API/efl/EWebKit2.h:
+        * UIProcess/API/efl/EwkViewImpl.cpp:
+        (EwkViewImpl::EwkViewImpl):
+        (EwkViewImpl::~EwkViewImpl):
+        (EwkViewImpl::requestPopupMenu):
+        (EwkViewImpl::closePopupMenu):
+        * UIProcess/API/efl/EwkViewImpl.h:
+        (EwkViewImpl):
+        * UIProcess/API/efl/ewk_popup_menu.cpp: Added.
+        (Ewk_Popup_Menu::Ewk_Popup_Menu):
+        (Ewk_Popup_Menu::~Ewk_Popup_Menu):
+        (Ewk_Popup_Menu::close):
+        (Ewk_Popup_Menu::items):
+        (Ewk_Popup_Menu::selectedIndex):
+        (Ewk_Popup_Menu::setSelectedIndex):
+        (ewk_popup_menu_close):
+        (ewk_popup_menu_selected_index_set):
+        (ewk_popup_menu_selected_index_get):
+        (ewk_popup_menu_items_get):
+        * UIProcess/API/efl/ewk_popup_menu.h: Added.
+        * UIProcess/API/efl/ewk_popup_menu_private.h: Copied from Source/WebKit2/UIProcess/efl/WebPopupMenuProxyEfl.cpp.
+        (WebKit):
+        (Ewk_Popup_Menu):
+        (Ewk_Popup_Menu::create):
+        * UIProcess/API/efl/ewk_view.cpp:
+        * UIProcess/API/efl/ewk_view.h:
+        * UIProcess/API/efl/tests/test_ewk2_popup_menu.cpp: Added.
+        (checkBasicPopupMenuItem):
+        (selectItemAfterDelayed):
+        (showPopupMenu):
+        (TEST_F):
+        * UIProcess/API/efl/tests/test_ewk2_view.cpp:
+        * UIProcess/efl/WebPopupMenuProxyEfl.cpp:
+        (WebKit::WebPopupMenuProxyEfl::hidePopupMenu):
+
+2012-10-25  Jocelyn Turcotte  <jocelyn.turcotte@digia.com>
+
+        [Qt] Close the IconDatabase before the WebContext gets destroyed
+        https://bugs.webkit.org/show_bug.cgi?id=100389
+
+        Reviewed by Alexis Menard.
+
+        The WebContext normally gets destroyed 60 seconds after the last page is
+        closed and will take down the WebIconDatabase with itself if nothing
+        holds a reference to it at this moment.
+        We need to close the IconDatabase explicitely before this happens
+        to terminate it cleanly and avoid leaking its thread.
+
+        * UIProcess/qt/QtWebIconDatabaseClient.cpp:
+        (WebKit::QtWebIconDatabaseClient::~QtWebIconDatabaseClient):
+
+2012-10-25  Dominik Röttsches  <dominik.rottsches@intel.com>
+
+        Conditionalize XHR timeout support
+        https://bugs.webkit.org/show_bug.cgi?id=100356
+
+        Reviewed by Adam Barth.
+
+        Adding XHR_TIMEOUT feature to conditionalize this on ports without network backend support.
+        Defaults to ON on Mac since the Mac NSUrlConnection based backend has setTimeoutInterval support.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2012-10-25  Tim Horton  <timothy_horton@apple.com>
+
+        Only full-page PDFPlugins should purport to handle page scale changes
+        https://bugs.webkit.org/show_bug.cgi?id=99635
+
+        Reviewed by Sam Weinig.
+
+        PDFPlugin should only handle page scale factor changes itself if it's in the main frame.
+        Subframe PDFs will act like images, zooming with the page.
+
+        * WebProcess/Plugins/PDF/PDFPlugin.h:
+        (PDFPlugin): Move implementation of handlesPageScaleFactor() to PDFPlugin.mm.
+        * WebProcess/Plugins/PDF/PDFPlugin.mm:
+        (WebKit::PDFPlugin::pdfDocumentDidLoad): Only copy PDFLayerController's default autoscale magnification to PluginView's
+        notion of the current scale factor if we're supposed to be handling page scale factor changes.
+        (WebKit::PDFPlugin::geometryDidChange): Only update PDFLayerController's magnification from the page scale factor
+        if we're supposed to be handling page scale factor changes.
+        (WebKit::PDFPlugin::handlesPageScaleFactor): We should only handle page scale factor changes if we're in the main frame.
+
+2012-10-25  Christophe Dumez  <christophe.dumez@intel.com>
+
+        [EFL][WK2] Move non-API classes out of UIProcess/API/efl
+        https://bugs.webkit.org/show_bug.cgi?id=100391
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Move non-API classes from UIProcess/API/efl to
+        UIProcess/efl for clarity.
+
+        * PlatformEfl.cmake:
+        * UIProcess/efl/BatteryProvider.cpp: Renamed from Source/WebKit2/UIProcess/API/efl/BatteryProvider.cpp.
+        (toBatteryProvider):
+        (startUpdatingCallback):
+        (stopUpdatingCallback):
+        (BatteryProvider::~BatteryProvider):
+        (BatteryProvider::create):
+        (BatteryProvider::BatteryProvider):
+        (BatteryProvider::startUpdating):
+        (BatteryProvider::stopUpdating):
+        (BatteryProvider::didChangeBatteryStatus):
+        * UIProcess/efl/BatteryProvider.h: Renamed from Source/WebKit2/UIProcess/API/efl/BatteryProvider.h.
+        (WebKit):
+        (BatteryProvider):
+        * UIProcess/efl/NetworkInfoProvider.cpp: Renamed from Source/WebKit2/UIProcess/API/efl/NetworkInfoProvider.cpp.
+        (toNetworkInfoProvider):
+        (startUpdatingCallback):
+        (stopUpdatingCallback):
+        (getBandwidthCallback):
+        (isMeteredCallback):
+        (NetworkInfoProvider::create):
+        (NetworkInfoProvider::NetworkInfoProvider):
+        (NetworkInfoProvider::~NetworkInfoProvider):
+        (NetworkInfoProvider::bandwidth):
+        (NetworkInfoProvider::metered):
+        (NetworkInfoProvider::startUpdating):
+        (NetworkInfoProvider::stopUpdating):
+        * UIProcess/efl/NetworkInfoProvider.h: Renamed from Source/WebKit2/UIProcess/API/efl/NetworkInfoProvider.h.
+        (WebKit):
+        (NetworkInfoProvider):
+        * UIProcess/efl/PageClientImpl.cpp: Renamed from Source/WebKit2/UIProcess/API/efl/PageClientImpl.cpp.
+        (WebKit):
+        (WebKit::PageClientImpl::PageClientImpl):
+        (WebKit::PageClientImpl::~PageClientImpl):
+        (WebKit::PageClientImpl::viewImpl):
+        (WebKit::PageClientImpl::createDrawingAreaProxy):
+        (WebKit::PageClientImpl::setViewNeedsDisplay):
+        (WebKit::PageClientImpl::displayView):
+        (WebKit::PageClientImpl::scrollView):
+        (WebKit::PageClientImpl::viewSize):
+        (WebKit::PageClientImpl::isViewWindowActive):
+        (WebKit::PageClientImpl::isViewFocused):
+        (WebKit::PageClientImpl::isViewVisible):
+        (WebKit::PageClientImpl::isViewInWindow):
+        (WebKit::PageClientImpl::processDidCrash):
+        (WebKit::PageClientImpl::didRelaunchProcess):
+        (WebKit::PageClientImpl::pageClosed):
+        (WebKit::PageClientImpl::toolTipChanged):
+        (WebKit::PageClientImpl::setCursor):
+        (WebKit::PageClientImpl::setCursorHiddenUntilMouseMoves):
+        (WebKit::PageClientImpl::didChangeViewportProperties):
+        (WebKit::PageClientImpl::registerEditCommand):
+        (WebKit::PageClientImpl::clearAllEditCommands):
+        (WebKit::PageClientImpl::canUndoRedo):
+        (WebKit::PageClientImpl::executeUndoRedo):
+        (WebKit::PageClientImpl::convertToDeviceSpace):
+        (WebKit::PageClientImpl::convertToUserSpace):
+        (WebKit::PageClientImpl::screenToWindow):
+        (WebKit::PageClientImpl::windowToScreen):
+        (WebKit::PageClientImpl::doneWithKeyEvent):
+        (WebKit::PageClientImpl::doneWithTouchEvent):
+        (WebKit::PageClientImpl::createPopupMenuProxy):
+        (WebKit::PageClientImpl::createContextMenuProxy):
+        (WebKit::PageClientImpl::createColorChooserProxy):
+        (WebKit::PageClientImpl::setFindIndicator):
+        (WebKit::PageClientImpl::enterAcceleratedCompositingMode):
+        (WebKit::PageClientImpl::exitAcceleratedCompositingMode):
+        (WebKit::PageClientImpl::updateAcceleratedCompositingMode):
+        (WebKit::PageClientImpl::didChangeScrollbarsForMainFrame):
+        (WebKit::PageClientImpl::didCommitLoadForMainFrame):
+        (WebKit::PageClientImpl::didFinishLoadingDataForCustomRepresentation):
+        (WebKit::PageClientImpl::customRepresentationZoomFactor):
+        (WebKit::PageClientImpl::setCustomRepresentationZoomFactor):
+        (WebKit::PageClientImpl::flashBackingStoreUpdates):
+        (WebKit::PageClientImpl::findStringInCustomRepresentation):
+        (WebKit::PageClientImpl::countStringMatchesInCustomRepresentation):
+        (WebKit::PageClientImpl::updateTextInputState):
+        (WebKit::PageClientImpl::handleDownloadRequest):
+        (WebKit::PageClientImpl::pageDidRequestScroll):
+        (WebKit::PageClientImpl::didChangeContentsSize):
+        (WebKit::PageClientImpl::didRenderFrame):
+        (WebKit::PageClientImpl::pageTransitionViewportReady):
+        * UIProcess/efl/PageClientImpl.h: Renamed from Source/WebKit2/UIProcess/API/efl/PageClientImpl.h.
+        (WebKit):
+        (PageClientImpl):
+        (WebKit::PageClientImpl::create):
+        (WebKit::PageClientImpl::setPageViewportController):
+        * UIProcess/efl/PageViewportControllerClientEfl.cpp: Renamed from Source/WebKit2/UIProcess/API/efl/PageViewportControllerClientEfl.cpp.
+        (WebKit):
+        (WebKit::PageViewportControllerClientEfl::PageViewportControllerClientEfl):
+        (WebKit::PageViewportControllerClientEfl::~PageViewportControllerClientEfl):
+        (WebKit::PageViewportControllerClientEfl::drawingArea):
+        (WebKit::PageViewportControllerClientEfl::setRendererActive):
+        (WebKit::PageViewportControllerClientEfl::display):
+        (WebKit::PageViewportControllerClientEfl::updateViewportSize):
+        (WebKit::PageViewportControllerClientEfl::setVisibleContentsRect):
+        (WebKit::PageViewportControllerClientEfl::didChangeContentsSize):
+        (WebKit::PageViewportControllerClientEfl::setViewportPosition):
+        (WebKit::PageViewportControllerClientEfl::setContentsScale):
+        (WebKit::PageViewportControllerClientEfl::didResumeContent):
+        (WebKit::PageViewportControllerClientEfl::didChangeVisibleContents):
+        (WebKit::PageViewportControllerClientEfl::didChangeViewportAttributes):
+        (WebKit::PageViewportControllerClientEfl::setController):
+        * UIProcess/efl/PageViewportControllerClientEfl.h: Renamed from Source/WebKit2/UIProcess/API/efl/PageViewportControllerClientEfl.h.
+        (WebKit):
+        (PageViewportControllerClientEfl):
+        (WebKit::PageViewportControllerClientEfl::create):
+        (WebKit::PageViewportControllerClientEfl::viewSize):
+        (WebKit::PageViewportControllerClientEfl::scaleFactor):
+        (WebKit::PageViewportControllerClientEfl::scrollPosition):
+        * UIProcess/efl/VibrationProvider.cpp: Renamed from Source/WebKit2/UIProcess/API/efl/VibrationProvider.cpp.
+        (Ewk_Vibration_Client):
+        (Ewk_Vibration_Client::Ewk_Vibration_Client):
+        (toVibrationProvider):
+        (vibrateCallback):
+        (cancelVibrationCallback):
+        (VibrationProvider::create):
+        (VibrationProvider::VibrationProvider):
+        (VibrationProvider::~VibrationProvider):
+        (VibrationProvider::vibrate):
+        (VibrationProvider::cancelVibration):
+        (VibrationProvider::setVibrationClientCallbacks):
+        * UIProcess/efl/VibrationProvider.h: Renamed from Source/WebKit2/UIProcess/API/efl/VibrationProvider.h.
+        (WebKit):
+        (VibrationProvider):
+        * UIProcess/efl/WebKitTextChecker.cpp: Renamed from Source/WebKit2/UIProcess/API/efl/WebKitTextChecker.cpp.
+        (WebKit):
+        (WebKit::isContinuousSpellCheckingEnabled):
+        (WebKit::setContinuousSpellCheckingEnabled):
+        (WebKit::uniqueSpellDocumentTag):
+        (WebKit::closeSpellDocumentWithTag):
+        (WebKit::checkSpellingOfString):
+        (WebKit::guessesForWord):
+        (WebKit::learnWord):
+        (WebKit::ignoreWord):
+        (WebKit::availableSpellCheckingLanguages):
+        (WebKit::updateSpellCheckingLanguages):
+        (WebKit::loadedSpellCheckingLanguages):
+        * UIProcess/efl/WebKitTextChecker.h: Renamed from Source/WebKit2/UIProcess/API/efl/WebKitTextChecker.h.
+        (WebKit):
+
+2012-10-25  Brady Eidson  <beidson@apple.com>
+
+        Allow LoaderStrategy to override the ResourceLoadScheduler
+        https://bugs.webkit.org/show_bug.cgi?id=100355
+
+        Reviewed by Anders Carlsson.
+
+        Add a WebKit2 subclass of ResourceLoadScheduler that currently adds no new functionality:
+        * WebProcess/Network/WebResourceLoadScheduler.cpp: 
+        (WebKit::WebResourceLoadScheduler::~WebResourceLoadScheduler):
+        * WebProcess/Network/WebResourceLoadScheduler.h: 
+
+        WebProcess hangs on to the default shared WebResourceLoadScheduler:
+        * WebProcess/WebProcess.h:
+        (WebKit::WebProcess::webResourceLoadScheduler):
+
+        If the NetworkProcess is enabled, return the new WebResourceLoadScheduler:
+        * WebProcess/WebCoreSupport/WebPlatformStrategies.cpp:
+        (WebKit::WebPlatformStrategies::resourceLoadScheduler):
+        * WebProcess/WebCoreSupport/WebPlatformStrategies.h:
+
+        * WebKit2.xcodeproj/project.pbxproj:
+
+2012-10-25  Christophe Dumez  <christophe.dumez@intel.com>
+
+        [EFL][WK2] Remove some C'ism from EwkView
+        https://bugs.webkit.org/show_bug.cgi?id=100370
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Remove a lot of C'ism from EwkView:
+        - Make more members private and add C++ methods to
+        EwkViewImpl for the public C API to use
+        - Use smart pointers when possible instead of raw
+        ones
+        - Use C++ naming conventions for callback functions
+        and define them as static methods in EwkViewImpl.
+
+        * UIProcess/API/efl/EwkViewImpl.cpp:
+        (EwkViewImpl::onIMFInputSequenceComplete):
+        (EwkViewImpl::onIMFPreeditSequenceChanged):
+        (EwkViewImpl::createIMFContext):
+        (EwkViewImpl::EwkViewImpl):
+        (EwkViewImpl::~EwkViewImpl):
+        (EwkViewImpl::setCursor):
+        (EwkViewImpl::setColorPickerColor):
+        (EwkViewImpl::isFocused):
+        (EwkViewImpl::isVisible):
+        (EwkViewImpl::title):
+        (EwkViewImpl::inputMethodContext):
+        (EwkViewImpl::themePath):
+        (EwkViewImpl::setThemePath):
+        (EwkViewImpl::customTextEncodingName):
+        (EwkViewImpl::setCustomTextEncodingName):
+        (EwkViewImpl::setMouseEventsEnabled):
+        (EwkViewImpl::setTouchEventsEnabled):
+        (EwkViewImpl::informIconChange):
+        (EwkViewImpl::requestColorPicker):
+        (EwkViewImpl::dismissColorPicker):
+        (EwkViewImpl::updateTextInputState):
+        (EwkViewImpl::informURLChange):
+        (EwkViewImpl::onMouseDown):
+        (EwkViewImpl::onMouseUp):
+        (EwkViewImpl::onMouseMove):
+        (EwkViewImpl::feedTouchEvents):
+        (EwkViewImpl::onTouchDown):
+        (EwkViewImpl::onTouchUp):
+        (EwkViewImpl::onTouchMove):
+        * UIProcess/API/efl/EwkViewImpl.h:
+        (WebCore):
+        (EwkViewImpl::ewkContext):
+        (EwkViewImpl::settings):
+        (EwkViewImpl):
+        (EwkViewImpl::url):
+        (EwkViewImpl::faviconURL):
+        (EwkViewImpl::mouseEventsEnabled):
+        (EwkViewImpl::touchEventsEnabled):
+        * UIProcess/API/efl/PageClientImpl.cpp:
+        (WebKit::PageClientImpl::isViewFocused):
+        (WebKit::PageClientImpl::isViewVisible):
+        (WebKit::PageClientImpl::didRelaunchProcess):
+        (WebKit::PageClientImpl::handleDownloadRequest):
+        * UIProcess/API/efl/ewk_settings_private.h:
+        (Ewk_Settings::create):
+        (Ewk_Settings::Ewk_Settings):
+        (Ewk_Settings):
+        * UIProcess/API/efl/ewk_view.cpp:
+        (_ewk_view_smart_mouse_up):
+        (_ewk_view_smart_key_down):
+        (_ewk_view_smart_add):
+        (ewk_view_context_get):
+        (ewk_view_url_get):
+        (ewk_view_icon_url_get):
+        (ewk_view_settings_get):
+        (ewk_view_title_get):
+        (ewk_view_theme_set):
+        (ewk_view_theme_get):
+        (ewk_view_setting_encoding_custom_get):
+        (ewk_view_setting_encoding_custom_set):
+        (ewk_view_mouse_events_enabled_set):
+        (ewk_view_mouse_events_enabled_get):
+        (ewk_view_color_picker_color_set):
+        (ewk_view_touch_events_enabled_set):
+        (ewk_view_touch_events_enabled_get):
+        * UIProcess/efl/WebInspectorProxyEfl.cpp:
+        (WebKit::WebInspectorProxy::platformCreateInspectorPage):
+
+2012-10-25  Anders Carlsson  <andersca@apple.com>
+
+        Assertion failure trying to dispatch notification messages
+        https://bugs.webkit.org/show_bug.cgi?id=100387
+        <rdar://problem/12573195>
+
+        Reviewed by Jessie Berlin.
+
+        Pass a zero destination ID when sending WebNotificationManagerProxy messages; they are not
+        used by the UI process and since the WebNotificationManagerProxy message receiver is global
+        passing a non-zero destination ID would cause the aforementioned assertion failure.
+
+        * WebProcess/Notifications/WebNotificationManager.cpp:
+        (WebKit::WebNotificationManager::cancel):
+        (WebKit::WebNotificationManager::clearNotifications):
+        (WebKit::WebNotificationManager::didDestroyNotification):
+
+2012-10-25  Alexey Proskuryakov  <ap@apple.com>
+
+        REGRESSION (r131686): Crashes in NSToolTipManager
+        https://bugs.webkit.org/show_bug.cgi?id=99792
+
+        Now that NSToolTip related parts of this change have been rolled out, roll out
+        the initial crash fix, too. We have no direct evidence that it's to blame, but it
+        doesn't serve any specific purpose any more.
+
+        * UIProcess/API/mac/WKView.mm: (-[WKView viewDidMoveToWindow]):
+
+2012-10-25  Christophe Dumez  <christophe.dumez@intel.com>
+
+        [EFL][WK2] Memory leak in _ewk_view_preedit_changed()
+        https://bugs.webkit.org/show_bug.cgi?id=100380
+
+        Reviewed by Antonio Gomes.
+
+        Fix memory leak in _ewk_view_preedit_changed(). The buffer
+        returned by ecore_imf_context_preedit_string_get() is never
+        freed.
+
+        * UIProcess/API/efl/EwkViewImpl.cpp:
+        (_ewk_view_preedit_changed):
+
+2012-10-25  Yael Aharon  <yael.aharon@intel.com>
+
+        [EFL][WK2][AC] Regression(132392) infinite loop when displaying certain animations.
+        https://bugs.webkit.org/show_bug.cgi?id=100288
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        When PageClientImpl::setViewNeedsDisplay is called, start a 0 length timer.
+        That breaks the synchronous loop we were experiencing when ewk_view_display
+        was called directly.
+
+        * UIProcess/API/efl/EwkViewImpl.cpp:
+        (EwkViewImpl::EwkViewImpl):
+        (EwkViewImpl::displayTimerFired):
+        (EwkViewImpl::redrawRegion):
+        * UIProcess/API/efl/EwkViewImpl.h:
+        (EwkViewImpl):
+
+2012-10-25  Mikhail Pozdnyakov  <mikhail.pozdnyakov@intel.com>
+
+        Add setMediaTypeOverride to window.internals.settings
+        https://bugs.webkit.org/show_bug.cgi?id=100249
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Exported WebCore::Settings::setMediaTypeOverride(WTF::String const&) for WIN port.
+
+        * win/WebKit2.def:
+
+2012-10-25  KyungTae Kim  <ktf.kim@samsung.com>
+
+        [WK2][EFL] Add ewk_view_pagination_mode_set/get() APIs
+        https://bugs.webkit.org/show_bug.cgi?id=100213
+
+        Reviewed by Gyuyoung Kim.
+
+        Add ewk_view_pagination_mode_set/get() APIs for paginated display.
+
+        * UIProcess/API/efl/ewk_view.cpp:
+        (ewk_view_pagination_mode_set):
+        (ewk_view_pagination_mode_get):
+        * UIProcess/API/efl/ewk_view.h:
+        * UIProcess/API/efl/tests/test_ewk2_view.cpp:
+        (TEST_F):
+
+2012-10-25  Sudarsana Nagineni  <sudarsana.nagineni@intel.com>
+
+        [EFL][AC] Fix build break when AC is enabled
+        https://bugs.webkit.org/show_bug.cgi?id=100367
+
+        Unreviewed build fix after r132405.
+
+        * UIProcess/API/efl/PageViewportControllerClientEfl.cpp:
+        (WebKit::PageViewportControllerClientEfl::PageViewportControllerClientEfl):
+
+2012-10-25  Byungwoo Lee  <bw80.lee@samsung.com>
+
+        [EFL][WK2] Add missing namespace.
+        https://bugs.webkit.org/show_bug.cgi?id=100251
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Add 'WebKit' namespace for BatteryProvider, NetworkInfoProvider and
+        VibrationProvider.
+
+        * UIProcess/API/efl/BatteryProvider.h:
+        (WebKit):
+        * UIProcess/API/efl/NetworkInfoProvider.cpp:
+        * UIProcess/API/efl/NetworkInfoProvider.h:
+        (WebKit):
+        * UIProcess/API/efl/VibrationProvider.cpp:
+        * UIProcess/API/efl/VibrationProvider.h:
+        (WebKit):
+        * UIProcess/API/efl/ewk_context_private.h:
+        (WebKit):
+        (Ewk_Context):
+
+2012-10-25  Jocelyn Turcotte  <jocelyn.turcotte@digia.com>
+
+        [Qt] Detach WebContext's clients from QtWebContext
+        https://bugs.webkit.org/show_bug.cgi?id=100224
+
+        Reviewed by Simon Hausmann.
+
+        The lifetime of WebContext isn't bound to QtWebContext and we wouldn't
+        keep a reference to our WebContext and would create a new one if a new
+        QQuickWebView/QtWebContext was created after we destroyed our QtWebContext.
+        This would cause a new WebContext and a new web process and somehow the
+        new WebContext could pick the IPC messages from the old WebProcess
+        and this would cause the new download client to receive messages about
+        downloads he doesn't know about and crash.
+
+        We assumed in the past that we would need multiple WebContext to allow
+        multiple web processes but this assumption doesn't hold anymore with
+        the work on ProcessModelMultipleSecondaryProcesses.
+        This patch enforces the use of a single WebContext by:
+        - Holding a single instance of QtWebIconDatabaseClient and QtDownloadManager
+        statically in QtWebContext
+        - Removing the context ID from QWebIconImageProvider's URLs
+        - Using QtWebContext as a temporary wrapper handle on WebContext to
+        initialize the WebContext's clients and allow us creating the first web page
+
+        platformInvalidateContext is used to clean up static global instances
+        when the WebContext is getting destroyed.
+
+        * UIProcess/API/qt/qquickwebview.cpp:
+        (QQuickWebViewPrivate::handleDownloadRequest):
+        * UIProcess/API/qt/qwebiconimageprovider.cpp:
+        (QWebIconImageProvider::iconURLForPageURLInContext):
+        (QWebIconImageProvider::requestImage):
+        * UIProcess/qt/QtWebContext.cpp:
+        (WebKit):
+        (WebKit::QtWebContext::QtWebContext):
+        (WebKit::QtWebContext::~QtWebContext):
+        (WebKit::QtWebContext::create):
+        (WebKit::QtWebContext::defaultContext):
+        (WebKit::QtWebContext::downloadManager):
+        (WebKit::QtWebContext::iconDatabase):
+        (WebKit::QtWebContext::invalidateContext):
+        * UIProcess/qt/QtWebContext.h:
+        (QtWebContext):
+        * UIProcess/qt/QtWebIconDatabaseClient.cpp:
+        (WebKit::QtWebIconDatabaseClient::QtWebIconDatabaseClient):
+        * UIProcess/qt/QtWebIconDatabaseClient.h:
+        (WebKit):
+        (QtWebIconDatabaseClient):
+        * UIProcess/qt/WebContextQt.cpp:
+        (WebKit::WebContext::platformInvalidateContext):
+
+2012-10-25  Jocelyn Turcotte  <jocelyn.turcotte@digia.com>
+
+        [Qt] Make the context injected bundle client static
+        https://bugs.webkit.org/show_bug.cgi?id=100223
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        It doesn't need any data from QtWebContext.
+
+        * UIProcess/qt/QtWebContext.cpp:
+        (WebKit::didReceiveMessageFromInjectedBundle):
+        (WebKit):
+        (WebKit::initializeContextInjectedBundleClient):
+        (WebKit::QtWebContext::defaultContext):
+        * UIProcess/qt/QtWebContext.h:
+        (QtWebContext):
+
+2012-10-25  Christophe Dumez  <christophe.dumez@intel.com>
+
+        [EFL][WK2] Get rid of Ewk_View private C API (Part 2)
+        https://bugs.webkit.org/show_bug.cgi?id=100331
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Convert most of the remaining Ewk_View private C API
+        into C++ methods in EwkViewImpl class. Only one private
+        C function remains but it will be taken care of in a
+        later patch to clean up the view construction code.
+
+        * UIProcess/API/efl/EwkViewImpl.cpp:
+        (EwkViewImpl::addToPageViewMap):
+        (EwkViewImpl::removeFromPageViewMap):
+        (EwkViewImpl::viewFromPageViewMap):
+        (EwkViewImpl::fromEvasObject):
+        (EwkViewImpl::informLoadFinished):
+        (EwkViewImpl::informProvisionalLoadRedirect):
+        (EwkViewImpl::informProvisionalLoadStarted):
+        (EwkViewImpl::informWebProcessCrashed):
+        (EwkViewImpl::informContentsSizeChange):
+        (EwkViewImpl::requestPopupMenu):
+        (EwkViewImpl::requestJSAlertPopup):
+        (EwkViewImpl::requestJSConfirmPopup):
+        (EwkViewImpl::requestJSPromptPopup):
+        (EwkViewImpl::informDatabaseQuotaReached):
+        (EwkViewImpl::updateTextInputState):
+        (EwkViewImpl::informURLChange):
+        (EwkViewImpl::createNewPage):
+        (EwkViewImpl::closePage):
+        * UIProcess/API/efl/EwkViewImpl.h:
+        (WebKit):
+        (EwkViewImpl):
+        * UIProcess/API/efl/PageClientImpl.cpp:
+        (WebKit::PageClientImpl::processDidCrash):
+        (WebKit::PageClientImpl::createPopupMenuProxy):
+        (WebKit::PageClientImpl::updateTextInputState):
+        (WebKit::PageClientImpl::didChangeContentsSize):
+        * UIProcess/API/efl/ewk_view.cpp:
+        (_ewk_view_smart_del):
+        (_ewk_view_initialize):
+        (ewk_view_url_set):
+        (ewk_view_reload):
+        (ewk_view_reload_bypass_cache):
+        (ewk_view_html_string_load):
+        * UIProcess/API/efl/ewk_view_private.h:
+        * UIProcess/efl/ContextHistoryClientEfl.cpp:
+        (WebKit::ContextHistoryClientEfl::didNavigateWithNavigationData):
+        (WebKit::ContextHistoryClientEfl::didPerformClientRedirect):
+        (WebKit::ContextHistoryClientEfl::didPerformServerRedirect):
+        (WebKit::ContextHistoryClientEfl::didUpdateHistoryTitle):
+        * UIProcess/efl/FindClientEfl.cpp:
+        * UIProcess/efl/FormClientEfl.cpp:
+        * UIProcess/efl/PageLoadClientEfl.cpp:
+        (WebKit::PageLoadClientEfl::didSameDocumentNavigationForFrame):
+        * UIProcess/efl/PageLoadClientEfl.h:
+        * UIProcess/efl/PagePolicyClientEfl.cpp:
+        * UIProcess/efl/PagePolicyClientEfl.h:
+        * UIProcess/efl/PageUIClientEfl.cpp:
+        (WebKit::PageUIClientEfl::closePage):
+        (WebKit::PageUIClientEfl::createNewPage):
+        (WebKit::PageUIClientEfl::runJavaScriptAlert):
+        (WebKit::PageUIClientEfl::runJavaScriptConfirm):
+        (WebKit::PageUIClientEfl::runJavaScriptPrompt):
+        (WebKit::PageUIClientEfl::exceededDatabaseQuota):
+        * UIProcess/efl/PageUIClientEfl.h:
+        * UIProcess/efl/ResourceLoadClientEfl.h:
+        * UIProcess/efl/WebPopupMenuProxyEfl.cpp:
+        (WebKit::WebPopupMenuProxyEfl::WebPopupMenuProxyEfl):
+        (WebKit::WebPopupMenuProxyEfl::showPopupMenu):
+        (WebKit::WebPopupMenuProxyEfl::hidePopupMenu):
+        * UIProcess/efl/WebPopupMenuProxyEfl.h:
+        (WebKit::WebPopupMenuProxyEfl::create):
+        (WebPopupMenuProxyEfl):
+
+2012-10-24  Joone Hur  <joone.hur@intel.com>
+
+        [EFL][AC] Unreviewed, fix build break when AC is enabled
+
+        Fix build break after r132405.
+
+        * UIProcess/API/efl/EwkViewImpl.cpp:
+        (EwkViewImpl::enterAcceleratedCompositingMode):
+        * UIProcess/API/efl/PageViewportControllerClientEfl.cpp:
+        (WebKit::PageViewportControllerClientEfl::didChangeContentsSize):
+        (WebKit::PageViewportControllerClientEfl::didChangeVisibleContents):
+        * UIProcess/API/efl/ewk_view.cpp:
+        (_ewk_view_smart_calculate):
+
+2012-10-24  Anders Carlsson  <andersca@apple.com>
+
+        Make it a compile error to send a sync message as async (and vice versa)
+        https://bugs.webkit.org/show_bug.cgi?id=100285
+
+        Reviewed by Sam Weinig.
+
+        Add an "isSync" boolean to each generated message struct and add compile asserts to the message senders.
+
+        * Platform/CoreIPC/Connection.h:
+        (CoreIPC::Connection::send):
+        (CoreIPC::Connection::sendSync):
+        * Platform/CoreIPC/MessageSender.h:
+        (CoreIPC::MessageSender::send):
+        (CoreIPC::MessageSender::sendSync):
+        * Scripts/webkit2/messages.py:
+        (message_to_struct_declaration):
+        * Scripts/webkit2/messages_unittest.py:
+        * UIProcess/WebProcessProxy.h:
+        (WebKit::WebProcessProxy::send):
+        (WebKit::WebProcessProxy::sendSync):
+
+2012-10-24  Kiran Muppala  <cmuppala@apple.com>
+
+        Disable auto termination of WebKit2 processes on mac
+        https://bugs.webkit.org/show_bug.cgi?id=100176
+
+        Reviewed by Alexey Proskuryakov.
+
+        Disable WebKit2 auto termination by taking corresponding assertion
+        until UI process is enhanced to determine when it is safe to enable it.
+
+        * NetworkProcess/mac/NetworkProcessMainMac.mm:
+        (WebKit::NetworkProcessMain):
+        * PluginProcess/mac/PluginProcessMainMac.mm:
+        (WebKit::PluginProcessMain):
+        * SharedWorkerProcess/mac/SharedWorkerProcessMainMac.mm:
+        (WebKit::SharedWorkerProcessMain):
+        * WebProcess/mac/WebProcessInitialization.mm:
+        (WebKit::InitializeWebProcess):
+
+2012-10-24  Christophe Dumez  <christophe.dumez@intel.com>
+
+        [EFL][WK2] Get rid of Ewk_View private C API (Part 1)
+        https://bugs.webkit.org/show_bug.cgi?id=100230
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Remove part of the Ewk_View private C API and replace
+        it by C++ methods in EwkViewImpl class. Eventually,
+        all the private C functions will be removed but it
+        will be done in several patches.
+
+        * UIProcess/API/C/efl/WKView.cpp:
+        (WKViewGetPage):
+        * UIProcess/API/efl/EwkViewImpl.cpp:
+        (_ewk_view_commit):
+        (_ewk_view_preedit_changed):
+        (EwkViewImpl::EwkViewImpl):
+        (EwkViewImpl::smartData):
+        (EwkViewImpl::fromEvasObject):
+        (EwkViewImpl::wkPage):
+        (EwkViewImpl::setCursor):
+        (EwkViewImpl::redrawRegion):
+        (EwkViewImpl::informDownloadJobCancelled):
+        (EwkViewImpl::informDownloadJobFailed):
+        (EwkViewImpl::informDownloadJobFinished):
+        (EwkViewImpl::informDownloadJobRequested):
+        (EwkViewImpl::informNewFormSubmissionRequest):
+        (EwkViewImpl::enterFullScreen):
+        (EwkViewImpl::exitFullScreen):
+        (EwkViewImpl::setImageData):
+        (EwkViewImpl::informLoadError):
+        (EwkViewImpl::informLoadFinished):
+        (EwkViewImpl::informLoadProgress):
+        (EwkViewImpl::informProvisionalLoadFailed):
+        (EwkViewImpl::informLoadCommitted):
+        (EwkViewImpl::informProvisionalLoadRedirect):
+        (EwkViewImpl::informProvisionalLoadStarted):
+        (EwkViewImpl::informNavigationPolicyDecision):
+        (EwkViewImpl::informNewWindowPolicyDecision):
+        (EwkViewImpl::informResourceLoadStarted):
+        (EwkViewImpl::informResourceLoadResponse):
+        (EwkViewImpl::informResourceLoadFailed):
+        (EwkViewImpl::informResourceLoadFinished):
+        (EwkViewImpl::informResourceRequestSent):
+        (EwkViewImpl::informTitleChange):
+        (EwkViewImpl::informTooltipTextChange):
+        (EwkViewImpl::informTextFound):
+        (EwkViewImpl::size):
+        (EwkViewImpl::informIconChange):
+        (EwkViewImpl::informIntentRequest):
+        (EwkViewImpl::informIntentServiceRegistration):
+        (EwkViewImpl::createGLSurface):
+        (EwkViewImpl::enterAcceleratedCompositingMode):
+        (EwkViewImpl::exitAcceleratedCompositingMode):
+        (EwkViewImpl::requestColorPicker):
+        (EwkViewImpl::dismissColorPicker):
+        (EwkViewImpl::informBackForwardListChange):
+        * UIProcess/API/efl/EwkViewImpl.h:
+        (WebCore):
+        (EwkViewImpl):
+        (EwkViewImpl::view):
+        (EwkViewImpl::page):
+        * UIProcess/API/efl/PageClientImpl.cpp:
+        (WebKit::PageClientImpl::PageClientImpl):
+        (WebKit::PageClientImpl::viewImpl):
+        (WebKit):
+        (WebKit::PageClientImpl::createDrawingAreaProxy):
+        (WebKit::PageClientImpl::setViewNeedsDisplay):
+        (WebKit::PageClientImpl::viewSize):
+        (WebKit::PageClientImpl::isViewFocused):
+        (WebKit::PageClientImpl::isViewVisible):
+        (WebKit::PageClientImpl::processDidCrash):
+        (WebKit::PageClientImpl::didRelaunchProcess):
+        (WebKit::PageClientImpl::toolTipChanged):
+        (WebKit::PageClientImpl::setCursor):
+        (WebKit::PageClientImpl::createPopupMenuProxy):
+        (WebKit::PageClientImpl::enterAcceleratedCompositingMode):
+        (WebKit::PageClientImpl::exitAcceleratedCompositingMode):
+        (WebKit::PageClientImpl::updateTextInputState):
+        (WebKit::PageClientImpl::handleDownloadRequest):
+        (WebKit::PageClientImpl::didChangeContentsSize):
+        * UIProcess/API/efl/PageClientImpl.h:
+        (WebKit::PageClientImpl::create):
+        (PageClientImpl):
+        * UIProcess/API/efl/PageViewportControllerClientEfl.cpp:
+        (WebKit::PageViewportControllerClientEfl::PageViewportControllerClientEfl):
+        (WebKit::PageViewportControllerClientEfl::drawingArea):
+        (WebKit::PageViewportControllerClientEfl::updateViewportSize):
+        (WebKit::PageViewportControllerClientEfl::didChangeContentsSize):
+        (WebKit::PageViewportControllerClientEfl::didChangeVisibleContents):
+        * UIProcess/API/efl/PageViewportControllerClientEfl.h:
+        (WebKit::PageViewportControllerClientEfl::create):
+        (PageViewportControllerClientEfl):
+        * UIProcess/API/efl/ewk_download_job.cpp:
+        (Ewk_Download_Job::Ewk_Download_Job):
+        (Ewk_Download_Job::viewImpl):
+        * UIProcess/API/efl/ewk_download_job_private.h:
+        (Ewk_Download_Job::create):
+        (Ewk_Download_Job):
+        * UIProcess/API/efl/ewk_view.cpp:
+        (pageViewMap):
+        (addToPageViewMap):
+        (removeFromPageViewMap):
+        (_ewk_view_on_favicon_changed):
+        (_ewk_view_smart_focus_in):
+        (_ewk_view_smart_focus_out):
+        (mapToWebContent):
+        (_ewk_view_smart_mouse_wheel):
+        (_ewk_view_smart_mouse_down):
+        (_ewk_view_smart_mouse_up):
+        (_ewk_view_smart_mouse_move):
+        (_ewk_view_smart_key_down):
+        (_ewk_view_smart_key_up):
+        (_ewk_view_on_show):
+        (_ewk_view_on_hide):
+        (_ewk_view_impl_del):
+        (_ewk_view_smart_del):
+        (_ewk_view_smart_calculate):
+        (_ewk_view_smart_color_set):
+        (_ewk_view_initialize):
+        (_ewk_view_add_with_smart):
+        (ewk_view_context_get):
+        (ewk_view_url_update):
+        (ewk_view_url_set):
+        (ewk_view_url_get):
+        (ewk_view_icon_url_get):
+        (ewk_view_reload):
+        (ewk_view_reload_bypass_cache):
+        (ewk_view_stop):
+        (ewk_view_settings_get):
+        (ewk_view_title_get):
+        (ewk_view_text_input_state_update):
+        (ewk_view_load_progress_get):
+        (ewk_view_scale_set):
+        (ewk_view_scale_get):
+        (ewk_view_device_pixel_ratio_set):
+        (ewk_view_device_pixel_ratio_get):
+        (ewk_view_theme_set):
+        (ewk_view_theme_get):
+        (ewk_view_back):
+        (ewk_view_forward):
+        (ewk_view_intent_deliver):
+        (ewk_view_back_possible):
+        (ewk_view_forward_possible):
+        (ewk_view_back_forward_list_get):
+        (ewk_view_html_string_load):
+        (ewk_view_setting_encoding_custom_get):
+        (ewk_view_setting_encoding_custom_set):
+        (ewk_view_page_create):
+        (ewk_view_text_find):
+        (ewk_view_text_find_highlight_clear):
+        (ewk_view_text_matches_count):
+        (ewk_view_contents_size_changed):
+        (ewk_view_popup_menu_request):
+        (ewk_view_popup_menu_close):
+        (ewk_view_popup_menu_select):
+        (ewk_view_mouse_events_enabled_set):
+        (ewk_view_mouse_events_enabled_get):
+        (ewk_view_webprocess_crashed):
+        (ewk_view_color_picker_color_set):
+        (ewk_view_feed_touch_event):
+        (ewk_view_touch_events_enabled_set):
+        (ewk_view_touch_events_enabled_get):
+        (ewk_view_inspector_show):
+        (ewk_view_inspector_close):
+        * UIProcess/API/efl/ewk_view_private.h:
+        * UIProcess/cairo/BackingStoreCairo.cpp:
+        (WebKit::BackingStore::incorporateUpdate):
+        * UIProcess/efl/DownloadManagerEfl.cpp:
+        (WebKit::DownloadManagerEfl::decideDestinationWithSuggestedFilename):
+        (WebKit::DownloadManagerEfl::didFail):
+        (WebKit::DownloadManagerEfl::didCancel):
+        (WebKit::DownloadManagerEfl::didFinish):
+        (WebKit::DownloadManagerEfl::registerDownload):
+        * UIProcess/efl/DownloadManagerEfl.h:
+        (DownloadManagerEfl):
+        * UIProcess/efl/FindClientEfl.cpp:
+        (WebKit::FindClientEfl::didFindString):
+        (WebKit::FindClientEfl::didFailToFindString):
+        (WebKit::FindClientEfl::FindClientEfl):
+        * UIProcess/efl/FindClientEfl.h:
+        (WebKit::FindClientEfl::create):
+        (FindClientEfl):
+        * UIProcess/efl/FormClientEfl.cpp:
+        (WebKit::FormClientEfl::willSubmitForm):
+        (WebKit::FormClientEfl::FormClientEfl):
+        * UIProcess/efl/FormClientEfl.h:
+        (WebKit::FormClientEfl::create):
+        (FormClientEfl):
+        * UIProcess/efl/PageLoadClientEfl.cpp:
+        (WebKit::PageLoadClientEfl::didReceiveTitleForFrame):
+        (WebKit::PageLoadClientEfl::didReceiveIntentForFrame):
+        (WebKit::PageLoadClientEfl::registerIntentServiceForFrame):
+        (WebKit::PageLoadClientEfl::didChangeProgress):
+        (WebKit::PageLoadClientEfl::didFinishLoadForFrame):
+        (WebKit::PageLoadClientEfl::didFailLoadWithErrorForFrame):
+        (WebKit::PageLoadClientEfl::didStartProvisionalLoadForFrame):
+        (WebKit::PageLoadClientEfl::didReceiveServerRedirectForProvisionalLoadForFrame):
+        (WebKit::PageLoadClientEfl::didFailProvisionalLoadWithErrorForFrame):
+        (WebKit::PageLoadClientEfl::didCommitLoadForFrame):
+        (WebKit::PageLoadClientEfl::didChangeBackForwardList):
+        (WebKit::PageLoadClientEfl::didSameDocumentNavigationForFrame):
+        (WebKit::PageLoadClientEfl::PageLoadClientEfl):
+        * UIProcess/efl/PageLoadClientEfl.h:
+        (WebKit::PageLoadClientEfl::create):
+        (PageLoadClientEfl):
+        (WebKit::PageLoadClientEfl::viewImpl):
+        * UIProcess/efl/PagePolicyClientEfl.cpp:
+        (WebKit::PagePolicyClientEfl::decidePolicyForNavigationAction):
+        (WebKit::PagePolicyClientEfl::decidePolicyForNewWindowAction):
+        (WebKit::PagePolicyClientEfl::PagePolicyClientEfl):
+        * UIProcess/efl/PagePolicyClientEfl.h:
+        (WebKit::PagePolicyClientEfl::create):
+        (PagePolicyClientEfl):
+        * UIProcess/efl/PageUIClientEfl.cpp:
+        (WebKit::PageUIClientEfl::closePage):
+        (WebKit::PageUIClientEfl::createNewPage):
+        (WebKit::PageUIClientEfl::runJavaScriptAlert):
+        (WebKit::PageUIClientEfl::runJavaScriptConfirm):
+        (WebKit::PageUIClientEfl::runJavaScriptPrompt):
+        (WebKit::PageUIClientEfl::showColorPicker):
+        (WebKit::PageUIClientEfl::hideColorPicker):
+        (WebKit::PageUIClientEfl::exceededDatabaseQuota):
+        (WebKit::PageUIClientEfl::focus):
+        (WebKit::PageUIClientEfl::unfocus):
+        (WebKit::PageUIClientEfl::takeFocus):
+        (WebKit::PageUIClientEfl::getWindowFrame):
+        (WebKit::PageUIClientEfl::setWindowFrame):
+        (WebKit::PageUIClientEfl::PageUIClientEfl):
+        * UIProcess/efl/PageUIClientEfl.h:
+        (WebKit::PageUIClientEfl::create):
+        (PageUIClientEfl):
+        * UIProcess/efl/ResourceLoadClientEfl.cpp:
+        (WebKit::ResourceLoadClientEfl::didInitiateLoadForResource):
+        (WebKit::ResourceLoadClientEfl::didSendRequestForResource):
+        (WebKit::ResourceLoadClientEfl::didReceiveResponseForResource):
+        (WebKit::ResourceLoadClientEfl::didFinishLoadForResource):
+        (WebKit::ResourceLoadClientEfl::didFailLoadForResource):
+        (WebKit::ResourceLoadClientEfl::ResourceLoadClientEfl):
+        (WebKit::ResourceLoadClientEfl::~ResourceLoadClientEfl):
+        * UIProcess/efl/ResourceLoadClientEfl.h:
+        (WebKit::ResourceLoadClientEfl::create):
+        (ResourceLoadClientEfl):
+        * UIProcess/efl/WebFullScreenManagerProxyEfl.cpp:
+        (WebKit::WebFullScreenManagerProxy::enterFullScreen):
+        (WebKit::WebFullScreenManagerProxy::exitFullScreen):
+        * UIProcess/efl/WebInspectorProxyEfl.cpp:
+        (WebKit::WebInspectorProxy::platformCreateInspectorPage):
+        * UIProcess/efl/WebPageProxyEfl.cpp:
+        (WebKit::WebPageProxy::viewWidget):
+
+2012-10-24  Brady Eidson  <beidson@apple.com>
+
+        Add a strategy for loader customization.
+        https://bugs.webkit.org/show_bug.cgi?id=100278
+
+        Reviewed by Alexey Proskuryakov.
+
+        * WebProcess/WebCoreSupport/WebPlatformStrategies.cpp:
+        (WebKit::WebPlatformStrategies::createLoaderStrategy):
+        * WebProcess/WebCoreSupport/WebPlatformStrategies.h:
+        (WebPlatformStrategies):
+
+2012-10-24  No'am Rosenthal  <noam.rosenthal@nokia.com>
+
+        Coordinated Graphics: Enable threaded/IPC animations
+        https://bugs.webkit.org/show_bug.cgi?id=93146
+
+        Reviewed by Caio Marcelo de Oliveira Filho.
+
+        In some cases there are pending changes in the layers, but no actual changes to the frame.
+        In that case we should unlock the animations.
+
+        * WebProcess/WebPage/CoordinatedGraphics/LayerTreeCoordinator.cpp:
+        (WebKit::LayerTreeCoordinator::flushPendingLayerChanges):
+
+2012-10-24  Noam Rosenthal  <noam.rosenthal@nokia.com>
+
+        [Qt-on-Mac] GraphicsSurfaces should not create a global IOSurface handle
+        https://bugs.webkit.org/show_bug.cgi?id=89885
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Use mach_port instead of global tokens for IOSurfaces.
+        Global IOSurfaces are accessible from other processes, while mach_ports can only be shared
+        directly via IPC.
+
+        * Shared/CoordinatedGraphics/CoordinatedGraphicsArgumentCoders.cpp:
+        (CoreIPC::::encode):
+        (CoreIPC::::decode):
+
+2012-10-24  Anders Carlsson  <andersca@apple.com>
+
+        Add per destination ID message receivers
+        https://bugs.webkit.org/show_bug.cgi?id=100276
+
+        Reviewed by Andreas Kling.
+
+        Extend MessageReceiverMap to handle adding message receivers for a given destinationID/receiver name pair.
+        Use this to make every WebPage object a message receiver.
+
+        * Platform/CoreIPC/MessageReceiverMap.cpp:
+        (CoreIPC::MessageReceiverMap::addMessageReceiver):
+        (CoreIPC):
+        (CoreIPC::MessageReceiverMap::removeMessageReceiver):
+        (CoreIPC::MessageReceiverMap::invalidate):
+        (CoreIPC::MessageReceiverMap::dispatchMessage):
+        (CoreIPC::MessageReceiverMap::dispatchSyncMessage):
+        * Platform/CoreIPC/MessageReceiverMap.h:
+        (MessageReceiverMap):
+        * WebProcess/WebPage/WebPage.cpp:
+        (WebKit::WebPage::WebPage):
+        (WebKit::WebPage::~WebPage):
+        * WebProcess/WebPage/WebPage.h:
+        (WebPage):
+        * WebProcess/WebProcess.cpp:
+        (WebKit::WebProcess::addMessageReceiver):
+        (WebKit):
+        (WebKit::WebProcess::removeMessageReceiver):
+        (WebKit::WebProcess::didReceiveSyncMessage):
+        (WebKit::WebProcess::didReceiveMessage):
+        * WebProcess/WebProcess.h:
+        (WebProcess):
+
+2012-10-24  Timothy Hatcher  <timothy@apple.com>
+
+        Make the Inspector WKView/WebView become the first responder when bringToFront is called.
+
+        https://bugs.webkit.org/show_bug.cgi?id=100209
+
+        Reviewed by Joseph Pecoraro.
+
+        * UIProcess/mac/WebInspectorProxyMac.mm:
+        (WebKit::WebInspectorProxy::platformBringToFront): Make the Inspector WKView become the first responder.
+
+2012-10-23  Alexey Proskuryakov  <ap@apple.com>
+
+        Add a strategy for shared workers
+        https://bugs.webkit.org/show_bug.cgi?id=100165
+
+        Reviewed by Brady Eidson.
+
+        * WebProcess/WebCoreSupport/WebPlatformStrategies.cpp:
+        (WebKit::WebPlatformStrategies::createPasteboardStrategy):
+        (WebKit::WebPlatformStrategies::createSharedWorkerStrategy):
+        (WebKit::WebPlatformStrategies::createVisitedLinkStrategy):
+        * WebProcess/WebCoreSupport/WebPlatformStrategies.h:
+
+2012-10-23  Sam Weinig  <sam@webkit.org>
+
+        Move a few more WebProcess sub-objects to be MessageReceivers
+        https://bugs.webkit.org/show_bug.cgi?id=100186
+
+        Reviewed by Anders Carlsson.
+
+        * WebProcess/Battery/WebBatteryManager.cpp:
+        (WebKit::WebBatteryManager::WebBatteryManager):
+        * WebProcess/Battery/WebBatteryManager.h:
+        (WebBatteryManager):
+        * WebProcess/IconDatabase/WebIconDatabaseProxy.cpp:
+        (WebKit::WebIconDatabaseProxy::WebIconDatabaseProxy):
+        (WebKit):
+        * WebProcess/IconDatabase/WebIconDatabaseProxy.h:
+        (WebIconDatabaseProxy):
+        * WebProcess/NetworkInfo/WebNetworkInfoManager.cpp:
+        (WebKit::WebNetworkInfoManager::WebNetworkInfoManager):
+        * WebProcess/NetworkInfo/WebNetworkInfoManager.h:
+        (WebNetworkInfoManager):
+        * WebProcess/Notifications/WebNotificationManager.cpp:
+        (WebKit::WebNotificationManager::WebNotificationManager):
+        * WebProcess/Notifications/WebNotificationManager.h:
+        (WebNotificationManager):
+        * WebProcess/WebProcess.cpp:
+        (WebKit::WebProcess::didReceiveMessage):
+        * WebProcess/soup/WebSoupRequestManager.cpp:
+        (WebKit::WebSoupRequestManager::WebSoupRequestManager):
+        * WebProcess/soup/WebSoupRequestManager.h:
+        (WebSoupRequestManager):
+
+2012-10-23  Anders Carlsson  <andersca@apple.com>
+
+        encode should take an ArgumentEncoder reference
+        https://bugs.webkit.org/show_bug.cgi?id=100183
+
+        Reviewed by Jessie Berlin.
+
+        * Platform/CoreIPC/ArgumentCoder.h:
+        (CoreIPC::ArgumentCoder::encode):
+        * Platform/CoreIPC/Arguments.h:
+        (CoreIPC::Arguments0::encode):
+        (CoreIPC::Arguments1::encode):
+        (CoreIPC::Arguments2::encode):
+        (CoreIPC::Arguments3::encode):
+        (CoreIPC::Arguments4::encode):
+        (CoreIPC::Arguments5::encode):
+        (CoreIPC::Arguments6::encode):
+        (CoreIPC::Arguments7::encode):
+        (CoreIPC::Arguments8::encode):
+        (CoreIPC::Arguments10::encode):
+        * Platform/CoreIPC/Attachment.cpp:
+        (CoreIPC::Attachment::encode):
+        * Platform/CoreIPC/Attachment.h:
+        (Attachment):
+        * Platform/CoreIPC/DataReference.cpp:
+        (CoreIPC::DataReference::encode):
+        * Platform/CoreIPC/DataReference.h:
+        (DataReference):
+        * Platform/CoreIPC/StringReference.cpp:
+        (CoreIPC::StringReference::encode):
+        * Platform/CoreIPC/StringReference.h:
+        (StringReference):
+        * Platform/CoreIPC/mac/MachPort.h:
+        (CoreIPC::MachPort::encode):
+        * Platform/SharedMemory.h:
+        (Handle):
+        * Platform/mac/SharedMemoryMac.cpp:
+        (WebKit::SharedMemory::Handle::encode):
+        * PluginProcess/PluginCreationParameters.cpp:
+        (WebKit::PluginCreationParameters::encode):
+        * PluginProcess/PluginCreationParameters.h:
+        (PluginCreationParameters):
+        * Shared/DictionaryPopupInfo.cpp:
+        (WebKit::DictionaryPopupInfo::encode):
+        * Shared/DictionaryPopupInfo.h:
+        (DictionaryPopupInfo):
+        * Shared/EditorState.cpp:
+        (WebKit::EditorState::encode):
+        * Shared/EditorState.h:
+        (EditorState):
+        * Shared/FontInfo.cpp:
+        (WebKit::FontInfo::encode):
+        * Shared/FontInfo.h:
+        (FontInfo):
+        * Shared/LayerTreeContext.h:
+        (LayerTreeContext):
+        * Shared/Network/NetworkProcessCreationParameters.cpp:
+        (WebKit::NetworkProcessCreationParameters::encode):
+        * Shared/Network/NetworkProcessCreationParameters.h:
+        (NetworkProcessCreationParameters):
+        * Shared/OriginAndDatabases.cpp:
+        (WebKit::OriginAndDatabases::encode):
+        * Shared/OriginAndDatabases.h:
+        (OriginAndDatabases):
+        * Shared/PlatformPopupMenuData.cpp:
+        (WebKit::PlatformPopupMenuData::encode):
+        * Shared/PlatformPopupMenuData.h:
+        (PlatformPopupMenuData):
+        * Shared/Plugins/NPIdentifierData.cpp:
+        (WebKit::NPIdentifierData::encode):
+        * Shared/Plugins/NPIdentifierData.h:
+        (NPIdentifierData):
+        * Shared/Plugins/NPVariantData.cpp:
+        (WebKit::NPVariantData::encode):
+        * Shared/Plugins/NPVariantData.h:
+        (NPVariantData):
+        * Shared/Plugins/PluginProcessCreationParameters.cpp:
+        (WebKit::PluginProcessCreationParameters::encode):
+        * Shared/Plugins/PluginProcessCreationParameters.h:
+        (PluginProcessCreationParameters):
+        * Shared/PrintInfo.cpp:
+        (WebKit::PrintInfo::encode):
+        * Shared/PrintInfo.h:
+        (PrintInfo):
+        * Shared/SandboxExtension.h:
+        (Handle):
+        (HandleArray):
+        * Shared/SecurityOriginData.cpp:
+        (WebKit::SecurityOriginData::encode):
+        * Shared/SecurityOriginData.h:
+        (SecurityOriginData):
+        * Shared/SessionState.cpp:
+        (WebKit::SessionState::encode):
+        * Shared/SessionState.h:
+        (SessionState):
+        * Shared/ShareableBitmap.cpp:
+        (WebKit::ShareableBitmap::Handle::encode):
+        * Shared/ShareableBitmap.h:
+        (Handle):
+        * Shared/SharedWorkerProcessCreationParameters.cpp:
+        (WebKit::SharedWorkerProcessCreationParameters::encode):
+        * Shared/SharedWorkerProcessCreationParameters.h:
+        (SharedWorkerProcessCreationParameters):
+        * Shared/StatisticsData.cpp:
+        (WebKit::StatisticsData::encode):
+        * Shared/StatisticsData.h:
+        (StatisticsData):
+        * Shared/StringPairVector.h:
+        (WebKit::StringPairVector::encode):
+        * Shared/UpdateInfo.cpp:
+        (WebKit::UpdateInfo::encode):
+        * Shared/UpdateInfo.h:
+        (UpdateInfo):
+        * Shared/UserMessageCoders.h:
+        (WebKit::UserMessageEncoder::baseEncode):
+        * Shared/WebContextMenuItemData.cpp:
+        (WebKit::WebContextMenuItemData::encode):
+        * Shared/WebContextMenuItemData.h:
+        (WebContextMenuItemData):
+        * Shared/WebEvent.cpp:
+        (WebKit::WebEvent::encode):
+        * Shared/WebEvent.h:
+        (WebEvent):
+        (WebMouseEvent):
+        (WebWheelEvent):
+        (WebKeyboardEvent):
+        (WebGestureEvent):
+        (WebPlatformTouchPoint):
+        (WebTouchEvent):
+        * Shared/WebGeolocationPosition.cpp:
+        (WebKit::WebGeolocationPosition::Data::encode):
+        * Shared/WebGeolocationPosition.h:
+        (Data):
+        * Shared/WebGestureEvent.cpp:
+        (WebKit::WebGestureEvent::encode):
+        * Shared/WebHitTestResult.cpp:
+        (WebKit::WebHitTestResult::Data::encode):
+        * Shared/WebHitTestResult.h:
+        (Data):
+        * Shared/WebKeyboardEvent.cpp:
+        (WebKit::WebKeyboardEvent::encode):
+        * Shared/WebMouseEvent.cpp:
+        (WebKit::WebMouseEvent::encode):
+        * Shared/WebNavigationDataStore.h:
+        (WebKit::WebNavigationDataStore::encode):
+        * Shared/WebPageCreationParameters.cpp:
+        (WebKit::WebPageCreationParameters::encode):
+        * Shared/WebPageCreationParameters.h:
+        (WebPageCreationParameters):
+        * Shared/WebPageGroupData.cpp:
+        (WebKit::WebPageGroupData::encode):
+        * Shared/WebPageGroupData.h:
+        (WebPageGroupData):
+        * Shared/WebPopupItem.cpp:
+        (WebKit::WebPopupItem::encode):
+        * Shared/WebPopupItem.h:
+        * Shared/WebPreferencesStore.cpp:
+        (WebKit::WebPreferencesStore::encode):
+        * Shared/WebPreferencesStore.h:
+        (WebPreferencesStore):
+        * Shared/WebProcessCreationParameters.cpp:
+        (WebKit::WebProcessCreationParameters::encode):
+        * Shared/WebProcessCreationParameters.h:
+        (WebProcessCreationParameters):
+        * Shared/WebWheelEvent.cpp:
+        (WebKit::WebWheelEvent::encode):
+        * Shared/mac/AttributedString.h:
+        (AttributedString):
+        * Shared/mac/AttributedString.mm:
+        (WebKit::AttributedString::encode):
+        * Shared/mac/ColorSpaceData.h:
+        (ColorSpaceData):
+        * Shared/mac/ColorSpaceData.mm:
+        (WebKit::ColorSpaceData::encode):
+        * Shared/mac/LayerTreeContextMac.mm:
+        (WebKit::LayerTreeContext::encode):
+        * Shared/mac/PlatformCertificateInfo.h:
+        (PlatformCertificateInfo):
+        * Shared/mac/PlatformCertificateInfo.mm:
+        (WebKit::PlatformCertificateInfo::encode):
+        * Shared/mac/SandboxExtensionMac.mm:
+        (WebKit::SandboxExtension::Handle::encode):
+        (WebKit::SandboxExtension::HandleArray::encode):
+        * Shared/mac/SecItemRequestData.cpp:
+        (WebKit::SecItemRequestData::encode):
+        * Shared/mac/SecItemRequestData.h:
+        * Shared/mac/SecItemResponseData.cpp:
+        (WebKit::SecItemResponseData::encode):
+        * Shared/mac/SecItemResponseData.h:
+        (SecItemResponseData):
+        * Shared/mac/SecKeychainItemRequestData.cpp:
+        (WebKit::SecKeychainItemRequestData::encode):
+        * Shared/mac/SecKeychainItemRequestData.h:
+        * Shared/mac/SecKeychainItemResponseData.cpp:
+        (WebKit::SecKeychainItemResponseData::encode):
+        * Shared/mac/SecKeychainItemResponseData.h:
+        (SecKeychainItemResponseData):
+        * UIProcess/WebContextUserMessageCoders.h:
+        (WebKit::WebContextUserMessageEncoder::encode):
+        * WebProcess/InjectedBundle/InjectedBundleUserMessageCoders.h:
+        (WebKit::InjectedBundleUserMessageEncoder::encode):
+        * WebProcess/Plugins/Plugin.cpp:
+        (WebKit::Plugin::Parameters::encode):
+        * WebProcess/Plugins/Plugin.h:
+        (Parameters):
+
+2012-10-24  Jocelyn Turcotte  <jocelyn.turcotte@digia.com>
+
+        [Qt] Move the QQuickWebViewExperimental pointer to QQuickWebViewPrivate
+        https://bugs.webkit.org/show_bug.cgi?id=100253
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        We'll need to avoid placing data in QQuickWebView to preserve
+        its binary compatibility once it's public.
+        Also make the QQuickWebViewExperimental constructor private.
+
+        * UIProcess/API/qt/qquickwebview.cpp:
+        (QQuickWebViewPrivate::QQuickWebViewPrivate):
+        (QQuickWebViewExperimental::QQuickWebViewExperimental):
+        (QQuickWebView::QQuickWebView):
+        (QQuickWebView::experimental):
+        * UIProcess/API/qt/qquickwebview_p.h:
+        * UIProcess/API/qt/qquickwebview_p_p.h:
+        (QQuickWebViewPrivate):
+
+2012-10-24  Mikhail Pozdnyakov  <mikhail.pozdnyakov@intel.com>
+
+        [EFL][WK2] Ewk_Settings refactoring
+        https://bugs.webkit.org/show_bug.cgi?id=100233
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Ewk_Settings private implementation is now C++ class which allows direct internal
+        access to WebKit::WebPreferences.
+
+        * UIProcess/API/efl/EwkViewImpl.cpp:
+        (EwkViewImpl::EwkViewImpl):
+        * UIProcess/API/efl/ewk_settings.cpp:
+        (Ewk_Settings::preferences):
+        (ewk_settings_fullscreen_enabled_set):
+        (ewk_settings_fullscreen_enabled_get):
+        (ewk_settings_javascript_enabled_set):
+        (ewk_settings_javascript_enabled_get):
+        (ewk_settings_loads_images_automatically_set):
+        (ewk_settings_loads_images_automatically_get):
+        (ewk_settings_developer_extras_enabled_set):
+        (ewk_settings_developer_extras_enabled_get):
+        (ewk_settings_file_access_from_file_urls_allowed_set):
+        (ewk_settings_file_access_from_file_urls_allowed_get):
+        (ewk_settings_frame_flattening_enabled_set):
+        (ewk_settings_frame_flattening_enabled_get):
+        (ewk_settings_dns_prefetching_enabled_set):
+        (ewk_settings_dns_prefetching_enabled_get):
+        * UIProcess/API/efl/ewk_settings_private.h:
+        (WebKit):
+        (Ewk_Settings):
+        (Ewk_Settings::Ewk_Settings):
+        * UIProcess/API/efl/ewk_view.cpp:
+        (_ewk_view_initialize):
+
+2012-10-24  Sudarsana Nagineni  <sudarsana.nagineni@intel.com>
+
+        [EFL][AC] Fix build break when AC is enabled
+        https://bugs.webkit.org/show_bug.cgi?id=100245
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Fix build break after r132337.
+
+        * UIProcess/API/efl/EwkViewImpl.h:
+        * UIProcess/API/efl/ewk_view.cpp:
+
+2012-10-24  Thiago Marcos P. Santos  <thiago.santos@intel.com>
+
+        [EFL] run-webkit-tests writes garbage on stderr when running on Xvfb
+        https://bugs.webkit.org/show_bug.cgi?id=100243
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        These errors generate noise on the reports and in some cases, like when
+        running perf tests, makes the test fail. By using Xext, we can add a
+        dummy handler to ignore these errors.
+
+        * PlatformEfl.cmake:
+        * WebProcess/efl/WebProcessMainEfl.cpp:
+        (dummyExtensionErrorHandler):
+        (WebKit::WebProcessMainEfl):
+
+2012-10-24  Eric Carlson  <eric.carlson@apple.com>
+
+        Allow ports to override text track rendering style
+        https://bugs.webkit.org/show_bug.cgi?id=97800
+        <rdar://problem/12044964>
+
+        Reviewed by Maciej Stachowiak.
+
+        * WebProcess/WebCoreSupport/mac/WebSystemInterface.mm:
+        (InitWebCoreSystemInterface): Initialize new WKSI function pointers.
+
+2012-10-24  Allan Sandfeld Jensen  <allan.jensen@digia.com>
+
+        [Qt] Expose useful WebCore::Settings
+        https://bugs.webkit.org/show_bug.cgi?id=100239
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Expose the two settings CaretBrowsingEnabled and NotificationsEnabled.
+
+        * UIProcess/API/qt/qwebpreferences.cpp:
+        (QWebPreferencesPrivate::testAttribute):
+        (QWebPreferencesPrivate::setAttribute):
+        (QWebPreferences::caretBrowsingEnabled):
+        (QWebPreferences::setCaretBrowsingEnabled):
+        (QWebPreferences::notificationsEnabled):
+        (QWebPreferences::setNotificationsEnabled):
+        * UIProcess/API/qt/qwebpreferences_p.h:
+        * UIProcess/API/qt/qwebpreferences_p_p.h:
+
+2012-10-24  Zeno Albisser  <zeno@webkit.org>
+
+        Implement GraphicsSurface for Windows.
+        https://bugs.webkit.org/show_bug.cgi?id=98147
+
+        Add encode and decode implementation for GraphicsSurfaceToken on Windows.
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        * Shared/CoordinatedGraphics/CoordinatedGraphicsArgumentCoders.cpp:
+        (CoreIPC::::encode):
+        (CoreIPC::::decode):
+
+2012-10-24  Sudarsana Nagineni  <sudarsana.nagineni@intel.com>
+
+        [EFL][WK2] ASSERTION FAILED: edje(): could not paint native HTML part due to missing theme
+        https://bugs.webkit.org/show_bug.cgi?id=100227
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Browser crashes on loading any page due to missing theme after
+        the web process has crashed and recovered.
+
+        This patch reset the theme when the web process is recovered to
+        avoid a crash.
+
+        * UIProcess/API/efl/PageClientImpl.cpp:
+        (WebKit::PageClientImpl::didRelaunchProcess):
+
+2012-10-24  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r132333.
+        http://trac.webkit.org/changeset/132333
+        https://bugs.webkit.org/show_bug.cgi?id=100234
+
+        Crashes many tests on the EFL-WK2 bot. (Requested by rakuco on
+        #webkit).
+
+        * Target.pri:
+        * UIProcess/WebProcessProxy.cpp:
+        (WebKit::WebProcessProxy::updateTextCheckerState):
+
+2012-10-24  Christophe Dumez  <christophe.dumez@intel.com> and Mikhail Pozdnyakov  <mikhail.pozdnyakov@intel.com>
+
+        [EFL][WK2] Move Ewk_View_Private_Data out of ewk_view.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=100228
+
+        Reviewed by Gyuyoung Kim.
+
+        Move Ewk_View_Private_Data out of ewk_view.cpp and
+        rename it to EwkViewImpl. This is a first step towards
+        getting rid of C'ism in Ewk_View.
+
+        In a future, we will make EwkViewImpl a proper C++
+        class and get rid of the private ewk_view C API so
+        that WebKit code interacts with EwkViewImpl instead
+        of Evas_Object.
+
+        * PlatformEfl.cmake:
+        * UIProcess/API/efl/EwkViewImpl.cpp: Added.
+        (_ewk_view_commit):
+        (_ewk_view_preedit_changed):
+        (_ewk_view_imf_context_destroy):
+        (_ewk_view_imf_context_create):
+        (EwkViewImpl::EwkViewImpl):
+        (EwkViewImpl::~EwkViewImpl):
+        * UIProcess/API/efl/EwkViewImpl.h: Added.
+        (WebKit):
+        (EwkViewImpl):
+        * UIProcess/API/efl/ewk_view.cpp:
+        (_ewk_view_priv_del):
+        (_ewk_view_smart_add):
+        * UIProcess/API/efl/ewk_view.h:
+
+2012-10-24  Ryuan Choi  <ryuan.choi@gmail.com>
+
+        [EFL][WK2] Crash when passing NULL instead of ewk_view instance
+        https://bugs.webkit.org/show_bug.cgi?id=100078
+
+        Reviewed by Gyuyoung Kim.
+
+        Although applications should pass valid ewk_view to call ewk_view_XXX,
+        ewk_view_XXX should not be crashed.
+
+        * UIProcess/API/efl/ewk_view.cpp:
+        Checked null and early exited from EWK_VIEW_TYPE_CHECK if error occured.
+        * UIProcess/API/efl/tests/test_ewk2_view.cpp: Added test case.
+        (TEST_F):
+
+2012-10-24  Christophe Dumez  <christophe.dumez@intel.com>
+
+        [EFL][WK2] Make find and form clients C++ classes
+        https://bugs.webkit.org/show_bug.cgi?id=100199
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Make form and find client C++ classes to move away
+        from C'ism in WK2 EFL port. The new classes have been
+        moved up to UIProcess/efl instead of UIProcess/API/efl
+        since it is not part of the public API.
+
+        * PlatformEfl.cmake:
+        * UIProcess/API/efl/ewk_view.cpp:
+        (Ewk_View_Private_Data):
+        (_ewk_view_initialize):
+        * UIProcess/efl/FindClientEfl.cpp: Renamed from Source/WebKit2/UIProcess/API/efl/ewk_view_find_client.cpp.
+        (WebKit):
+        (WebKit::toFindClientEfl):
+        (WebKit::FindClientEfl::didFindString):
+        (WebKit::FindClientEfl::didFailToFindString):
+        (WebKit::FindClientEfl::FindClientEfl):
+        * UIProcess/efl/FindClientEfl.h: Renamed from Source/WebKit2/UIProcess/API/efl/ewk_view_find_client_private.h.
+        (WebKit):
+        (FindClientEfl):
+        (WebKit::FindClientEfl::create):
+        * UIProcess/efl/FormClientEfl.cpp: Renamed from Source/WebKit2/UIProcess/API/efl/ewk_view_form_client.cpp.
+        (WebKit):
+        (WebKit::toFormClientEfl):
+        (WebKit::FormClientEfl::willSubmitForm):
+        (WebKit::FormClientEfl::FormClientEfl):
+        * UIProcess/efl/FormClientEfl.h: Renamed from Source/WebKit2/UIProcess/API/efl/ewk_view_form_client_private.h.
+        (WebKit):
+        (FormClientEfl):
+        (WebKit::FormClientEfl::create):
+
+2012-10-24  Grzegorz Czajkowski  <g.czajkowski@samsung.com>
+
+        [EFL] WebKitTestRunner needs to turn on 'setContinuousSpellCheckingEnabled'
+        https://bugs.webkit.org/show_bug.cgi?id=93611
+
+        Reviewed by Hajime Morita.
+
+        When WebKitTestRunner turns on the spelling feature with the resetStateToConsistentValues() method,
+        it happens that the WebProcess is still not launched (although it is already created).
+        In this case, isValid() method returns false.
+
+        This fix sends a message to the WebProcess messages queue, and the message
+        will be handled once the WebProcess is ready.
+
+        * Target.pri:
+        Adds missing files to compile spellcheking feature for WebKit2-Qt
+        to use WebKit C API from WKTextChecker.h.
+
+        * UIProcess/WebProcessProxy.cpp:
+        (WebKit::WebProcessProxy::updateTextCheckerState):
+        Uses canSendMessage() method instead of isValid() to check whether the message to
+        the WebProcess can be sent.
+
+2012-10-24  Yael Aharon  <yael.aharon@intel.com>
+
+        [EFL][WK2][AC] Black screen in web inspector window with AC on
+        https://bugs.webkit.org/show_bug.cgi?id=100168
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        When ACCELERATED_COMPOSITING flag is turned on, and using X11,
+        pass "opengl_x11" engine name to ecore_evas_new when creating a
+        web inspector window. It is guaranteed to be available, because
+        we wouldn't be able to create a main window if it wasn't.
+
+        (WebKit::WebInspectorProxy::platformCreateInspectorPage):
+
+2012-10-24  Mikhail Pozdnyakov  <mikhail.pozdnyakov@intel.com>
+
+        [EFL][WK2] Make History client a C++ class
+        https://bugs.webkit.org/show_bug.cgi?id=100104
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Created ContextHistoryClientEfl class to encapsulate history client code for EFL.
+
+        * PlatformEfl.cmake:
+        * UIProcess/API/efl/ewk_context.cpp:
+        (Ewk_Context::Ewk_Context):
+        (ewk_context_history_callbacks_set):
+        * UIProcess/API/efl/ewk_context_history_client.cpp: Removed.
+        * UIProcess/API/efl/ewk_context_history_client_private.h: Removed.
+        * UIProcess/API/efl/ewk_context_private.h:
+        (WebKit):
+        (Ewk_Context):
+        * UIProcess/efl/ContextHistoryClientEfl.cpp: Added.
+        (WebKit):
+        (WebKit::toContextHistoryClientEfl):
+        (WebKit::ContextHistoryClientEfl::didNavigateWithNavigationData):
+        (WebKit::ContextHistoryClientEfl::didPerformClientRedirect):
+        (WebKit::ContextHistoryClientEfl::didPerformServerRedirect):
+        (WebKit::ContextHistoryClientEfl::didUpdateHistoryTitle):
+        (WebKit::ContextHistoryClientEfl::populateVisitedLinks):
+        (WebKit::ContextHistoryClientEfl::ContextHistoryClientEfl):
+        (WebKit::ContextHistoryClientEfl::setCallbacks):
+        * UIProcess/efl/ContextHistoryClientEfl.h: Added.
+        (WebKit):
+        (ContextHistoryClientEfl):
+        (WebKit::ContextHistoryClientEfl::create):
+
+2012-10-23  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        [GTK] Add API to get the WebKitWebView associated to a WebKitDownload to WebKit2 GTK+
+        https://bugs.webkit.org/show_bug.cgi?id=99836
+
+        Reviewed by Martin Robinson.
+
+        Add webkit_download_get_web_view() to get the WebKitWebView that
+        initiated the download and webkit_web_view_download_uri() to start
+        a new download associated to a WebKitWebView.
+
+        * UIProcess/API/gtk/PageClientImpl.cpp:
+        (WebKit::PageClientImpl::handleDownloadRequest): Call
+        webkitWebViewBaseHandleDownloadRequest().
+        * UIProcess/API/gtk/PageClientImpl.h:
+        (PageClientImpl): Add handleDownloadRequest().
+        * UIProcess/API/gtk/WebKitDownload.cpp:
+        (webkitDownloadSetWebView): Set the WebKitWebView associated to
+        the download.
+        (webkit_download_get_web_view): Public method to get the
+        WebKitWebView associated to the download.
+        * UIProcess/API/gtk/WebKitDownload.h:
+        * UIProcess/API/gtk/WebKitDownloadPrivate.h:
+        * UIProcess/API/gtk/WebKitWebContext.cpp:
+        (webkit_web_context_download_uri): Use the new helper
+        webkitWebContextStartDownload().
+        (webkitWebContextStartDownload): Helper function to start a new
+        download that is also used by WebKitWebView.
+        * UIProcess/API/gtk/WebKitWebContextPrivate.h:
+        * UIProcess/API/gtk/WebKitWebView.cpp:
+        (webkitWebViewHandleDownloadRequest): Call
+        webkitDownloadSetWebView() to associate the download with the
+        WebKitWebView.
+        (webkitWebViewConstructed): Set a download request handler.
+        (webkit_web_view_download_uri): Public method to start a new
+        download associated to the web view.
+        * UIProcess/API/gtk/WebKitWebView.h:
+        * UIProcess/API/gtk/WebKitWebViewBase.cpp:
+        (webkitWebViewBaseSetDownloadRequestHandler): Set a function
+        pointer to be called when a new download is request for the web
+        view.
+        (webkitWebViewBaseHandleDownloadRequest): Call the download
+        request handler if any.
+        * UIProcess/API/gtk/WebKitWebViewBasePrivate.h:
+        * UIProcess/API/gtk/docs/webkit2gtk-sections.txt: Add new symbols.
+        * UIProcess/API/gtk/tests/TestDownloads.cpp:
+        (testDownloadLocalFile):
+        (testDownloadLocalFileError):
+        (testDownloadRemoteFile):
+        (testDownloadRemoteFileError):
+        (testWebViewDownloadURI):
+        (testPolicyResponseDownload):
+        (beforeAll):
+        * UIProcess/PageClient.h:
+        (PageClient):
+        * UIProcess/WebPageProxy.cpp:
+        (WebKit::WebPageProxy::receivedPolicyDecision):
+        (WebKit):
+        * UIProcess/WebPageProxy.h:
+        (WebPageProxy):
+
+2012-10-23  Dan Bernstein  <mitz@apple.com>
+
+        WebKit2 part of <rdar://problem/2966974> [mac] Kerning and ligatures are not enabled by default
+        https://bugs.webkit.org/show_bug.cgi?id=100188
+
+        Reviewed by Sam Weinig.
+
+        * UIProcess/mac/WebContextMac.mm:
+        (WebKit::registerUserDefaultsIfNeeded): Added. Registers a value of YES for the
+        WebKitKerningAndLigaturesEnabledByDefault user default if it has not been registered yet.
+        (WebKit::WebContext::platformInitializeWebProcess): Added a call to
+        registerUserDefaultsIfNeeded, and changed to refer to the defaults key by name.
+
+2012-10-23  No'am Rosenthal  <noam.rosenthal@nokia.com>
+
+        Coordinated Graphics: Enable threaded/IPC animations
+        https://bugs.webkit.org/show_bug.cgi?id=93146
+
+        Unreviewed build fix, some function names changed between review and landing.
+
+        * Shared/CoordinatedGraphics/CoordinatedGraphicsArgumentCoders.cpp:
+        (CoreIPC::encodeTimingFunction):
+        (CoreIPC::decodeTimingFunction):
+        (CoreIPC::::encode):
+        * Shared/CoordinatedGraphics/CoordinatedGraphicsArgumentCoders.h:
+        (WebCore):
+
+2012-10-23  Sam Weinig  <sam@webkit.org>
+
+        Stop using NSHomeDirectory() to get the home directory, it doesn't always return what we want
+        https://bugs.webkit.org/show_bug.cgi?id=100180
+
+        Reviewed by Anders Carlsson.
+
+        NSHomeDirectory() doesn't return the real home directory if the host process
+        is App Sandboxed, so drop down and use getpwuid_r instead.
+
+        * WebProcess/mac/WebProcessMac.mm:
+        (WebKit::appendReadwriteSandboxDirectory):
+        There is no reason anymore to try to create the directory.
+
+        (WebKit::WebProcess::initializeSandbox):
+        Switch to getpwuid_r.
+
+2012-10-23  Martin Robinson  <mrobinson@igalia.com>
+
+        [GTK][Soup] Implement the default authentication dialog via WebCoreSupport
+        https://bugs.webkit.org/show_bug.cgi?id=99351
+
+        Reviewed by Carlos Garcia Campos.
+
+        Instead of using a custom SoupSessionFeature to show the authentication
+        dialog, show it using the corresponding WebCore message.
+
+        * GNUmakefile.list.am: Removed the SoupSessionFeature files.
+        * WebProcess/WebCoreSupport/WebFrameLoaderClient.cpp:
+        (WebKit): Only use the default dispatchDidReceiveAuthenticationChallenge
+        for non-GTK+ ports.
+        * WebProcess/WebCoreSupport/gtk/WebFrameLoaderClientGtk.cpp: Added.
+        (WebKit::WebFrameLoaderClient::dispatchDidReceiveAuthenticationChallenge): Added
+        a GTK+-specific implementation that shows the GtkAuthenticationDialog.
+        * WebProcess/gtk/WebAuthDialog.cpp: Removed.
+        * WebProcess/gtk/WebAuthDialog.h: Removed.
+        * WebProcess/gtk/WebProcessMainGtk.cpp:
+        (WebKit::WebProcessMainGtk): Don't install the custom session feature.
+
+2012-10-23  Anders Carlsson  <andersca@apple.com>
+
+        Remove deprecatedSend
+        https://bugs.webkit.org/show_bug.cgi?id=100127
+
+        Reviewed by Andreas Kling.
+
+        deprecatedSend is no longer used anywhere, remove it.
+
+        * Platform/CoreIPC/Connection.h:
+        (Connection):
+        * UIProcess/WebProcessProxy.h:
+        (WebProcessProxy):
+
+2012-10-23  Andy Estes  <aestes@apple.com>
+
+        [WebKit2 API] Add properties to get textRects from a WKDOMRange or WKDOMNode
+        https://bugs.webkit.org/show_bug.cgi?id=100162
+
+        Reviewed by Sam Weinig.
+
+        * WebProcess/InjectedBundle/API/mac/WKDOMInternals.h:
+        * WebProcess/InjectedBundle/API/mac/WKDOMInternals.mm:
+        (WebKit::toNSArray): Added a helper function to convert a Vector of IntRects to an NSArray.
+        * WebProcess/InjectedBundle/API/mac/WKDOMNode.h:
+        * WebProcess/InjectedBundle/API/mac/WKDOMNode.mm:
+        (-[WKDOMNode textRects]):
+        * WebProcess/InjectedBundle/API/mac/WKDOMRange.h:
+        * WebProcess/InjectedBundle/API/mac/WKDOMRange.mm:
+        (-[WKDOMRange textRects]):
+
+2012-10-23  No'am Rosenthal  <noam.rosenthal@nokia.com>
+
+        Coordinated Graphics: Enable threaded/IPC animations
+        https://bugs.webkit.org/show_bug.cgi?id=93146
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Re-enable UI-process animations for Coordinated-Graphics/TextureMapper.
+        - Added an argument coder for GraphicsLayerAnimations.
+        - Allow LayerTreeCoordinator to manage the animations per layer with the proxy,
+          as opposed to applying the animation values in the web process as before.
+        - LayerTreeRenderer now calls updateViewport() after painting when an animation is active.
+
+        To overcome the problem we've had in the past with synchronizing UI-side and web-side
+        animations, we now lock the animations in the UI process when a frame starts rendering,
+        and unlock it when the frame finishes rendering, or if after the layout there is no visible
+        changes pending on the screen.
+
+        * Scripts/webkit2/messages.py:
+        (headers_for_type):
+        * Shared/CoordinatedGraphics/CoordinatedGraphicsArgumentCoders.cpp:
+        (CoreIPC):
+        (CoreIPC::encodeTimingFunction):
+        (CoreIPC::decodeTimingFunction):
+        (CoreIPC::::encode):
+        (CoreIPC::::decode):
+        * Shared/CoordinatedGraphics/CoordinatedGraphicsArgumentCoders.h:
+        (WebCore):
+            Added argument coders for GraphicsLayerAnimations.
+
+        * UIProcess/CoordinatedGraphics/LayerTreeCoordinatorProxy.cpp:
+        (WebKit::LayerTreeCoordinatorProxy::setLayerAnimations):
+        (WebKit::LayerTreeCoordinatorProxy::setAnimationsLocked):
+        * UIProcess/CoordinatedGraphics/LayerTreeCoordinatorProxy.h:
+        (LayerTreeCoordinatorProxy):
+        * UIProcess/CoordinatedGraphics/LayerTreeCoordinatorProxy.messages.in:
+            Added an option to sync the layer's animations, and also to lock/unlock animations.
+
+        * UIProcess/CoordinatedGraphics/LayerTreeRenderer.cpp:
+        (WebKit::LayerTreeRenderer::LayerTreeRenderer):
+        (WebKit::LayerTreeRenderer::paintToCurrentGLContext):
+            Sync animations if they're not locked, and call updateViewport() if we have animations.
+
+        (WebKit::LayerTreeRenderer::flushLayerChanges):
+        (WebKit::LayerTreeRenderer::setLayerAnimations):
+        (WebKit::LayerTreeRenderer::setAnimationsLocked):
+
+        * UIProcess/CoordinatedGraphics/LayerTreeRenderer.h:
+        (LayerTreeRenderer):
+        * WebProcess/WebPage/CoordinatedGraphics/CoordinatedGraphicsLayer.cpp:
+        (WebCore::CoordinatedGraphicsLayer::didChangeAnimations):
+        (WebCore::CoordinatedGraphicsLayer::setShouldUpdateVisibleRect):
+        (WebCore::CoordinatedGraphicsLayer::CoordinatedGraphicsLayer):
+        (WebCore::CoordinatedGraphicsLayer::syncLayerState):
+        (WebCore::CoordinatedGraphicsLayer::syncAnimations):
+        (WebCore::CoordinatedGraphicsLayer::flushCompositingStateForThisLayerOnly):
+        (WebCore::CoordinatedGraphicsLayer::addAnimation):
+        (WebCore::CoordinatedGraphicsLayer::pauseAnimation):
+        (WebCore::CoordinatedGraphicsLayer::removeAnimation):
+        (WebCore::CoordinatedGraphicsLayer::animationStartedTimerFired):
+        (WebCore):
+            Pass the animation info to the UI process instead of applying it in the web process.
+
+        (WebCore::CoordinatedGraphicsLayer::hasPendingVisibleChanges):
+            Compute whether a layer tree might have sync issues or flickers if rendered while
+            background animations are ongoing.
+
+        (WebCore::CoordinatedGraphicsLayer::computeTransformedVisibleRect):
+        (WebCore::CoordinatedGraphicsLayer::selfOrAncestorHaveNonAffineTransforms):
+            Don't allow progressive tiling for layers with animations.
+
+        * WebProcess/WebPage/CoordinatedGraphics/CoordinatedGraphicsLayer.h:
+        (WebCore):
+        (CoordinatedGraphicsLayerClient):
+        (CoordinatedGraphicsLayer):
+        * WebProcess/WebPage/CoordinatedGraphics/LayerTreeCoordinator.cpp:
+        (WebKit::LayerTreeCoordinator::LayerTreeCoordinator):
+        (WebKit::LayerTreeCoordinator::lockAnimations):
+        (WebKit):
+        (WebKit::LayerTreeCoordinator::unlockAnimations):
+        (WebKit::LayerTreeCoordinator::performScheduledLayerFlush):
+        (WebKit::LayerTreeCoordinator::setLayerAnimations):
+        * WebProcess/WebPage/CoordinatedGraphics/LayerTreeCoordinator.h:
+        (LayerTreeCoordinator):
+
+2012-10-23  Allan Sandfeld Jensen  <allan.jensen@digia.com>
+
+        [Qt][WK2] Add preference for enabling scroll animators
+        https://bugs.webkit.org/show_bug.cgi?id=100124
+
+        Reviewed by Jocelyn Turcotte.
+
+        Expose the ScollAnimatorEnabled setting in QWebPreferences.
+
+        * UIProcess/API/qt/qwebpreferences.cpp:
+        (QWebPreferencesPrivate::testAttribute):
+        (QWebPreferencesPrivate::setAttribute):
+        (QWebPreferences::scrollAnimatorEnabled):
+        (QWebPreferences::setScrollAnimatorEnabled):
+        * UIProcess/API/qt/qwebpreferences_p.h:
+        * UIProcess/API/qt/qwebpreferences_p_p.h:
+
+2012-10-23  Yael Aharon  <yael.aharon@intel.com>
+
+        [EFL][WK2] Use the port independent PageViewportController
+        https://bugs.webkit.org/show_bug.cgi?id=99850
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Take PageViewportController into use, and rely on it to calculate
+        scroll position and zoom level.
+        With this patch, we can do intra page navigation and use the scrollwheel
+        to scroll, when WTF_USE_TILED_BACKING_STORE and all related flags are enabled.
+
+        * CMakeLists.txt:
+        * UIProcess/API/efl/PageClientImpl.cpp:
+        (WebKit::PageClientImpl::didChangeViewportProperties):
+        (WebKit::PageClientImpl::pageDidRequestScroll):
+        (WebKit::PageClientImpl::didChangeContentsSize):
+        (WebKit):
+        (WebKit::PageClientImpl::didRenderFrame):
+        (WebKit::PageClientImpl::pageTransitionViewportReady):
+        * UIProcess/API/efl/PageClientImpl.h:
+        (WebKit):
+        (PageClientImpl):
+        (WebKit::PageClientImpl::setPageViewportController):
+        * UIProcess/API/efl/PageViewportControllerClientEfl.cpp:
+        (WebKit::PageViewportControllerClientEfl::PageViewportControllerClientEfl):
+        (WebKit::PageViewportControllerClientEfl::display):
+        (WebKit::PageViewportControllerClientEfl::updateViewportSize):
+        (WebKit::PageViewportControllerClientEfl::setVisibleContentsRect):
+        (WebKit::PageViewportControllerClientEfl::didChangeContentsSize):
+        (WebKit::PageViewportControllerClientEfl::setViewportPosition):
+        (WebKit::PageViewportControllerClientEfl::setContentsScale):
+        (WebKit::PageViewportControllerClientEfl::didResumeContent):
+        (WebKit::PageViewportControllerClientEfl::didChangeVisibleContents):
+        (WebKit::PageViewportControllerClientEfl::setController):
+        * UIProcess/API/efl/PageViewportControllerClientEfl.h:
+        (WebKit::PageViewportControllerClientEfl::scaleFactor):
+        (WebKit::PageViewportControllerClientEfl::scrollPosition):
+        (PageViewportControllerClientEfl):
+        * UIProcess/API/efl/ewk_view.cpp:
+        (Ewk_View_Private_Data):
+        (mapToWebContent):
+        (_ewk_view_smart_mouse_wheel):
+        (_ewk_view_smart_mouse_down):
+        (_ewk_view_smart_mouse_up):
+        (_ewk_view_smart_mouse_move):
+        (_ewk_view_initialize):
+        (ewk_view_load_committed):
+        (ewk_view_feed_touch_event):
+        * UIProcess/API/efl/ewk_view_private.h:
+        * UIProcess/CoordinatedGraphics/LayerTreeCoordinatorProxy.cpp:
+        (WebKit::LayerTreeCoordinatorProxy::didRenderFrame):
+        * UIProcess/PageClient.h:
+        (PageClient):
+        * UIProcess/PageViewportController.cpp:
+        * UIProcess/PageViewportController.h:
+        * UIProcess/WebPageProxy.cpp:
+        (WebKit):
+        (WebKit::WebPageProxy::pageTransitionViewportReady):
+        (WebKit::WebPageProxy::didRenderFrame):
+        * UIProcess/WebPageProxy.h:
+        (WebPageProxy):
+        * UIProcess/WebPageProxy.messages.in:
+        * UIProcess/efl/PageLoadClientEfl.cpp:
+        (WebKit):
+        (WebKit::PageLoadClientEfl::didCommitLoadForFrame):
+        (WebKit::PageLoadClientEfl::PageLoadClientEfl):
+        * UIProcess/efl/PageLoadClientEfl.h:
+        (PageLoadClientEfl):
+        * UIProcess/qt/WebPageProxyQt.cpp:
+        (WebKit):
+        (WebKit::WebPageProxy::setUserScripts):
+        * WebProcess/WebPage/WebPage.cpp:
+        (WebKit::WebPage::didCompletePageTransition):
+
+2012-10-16  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Add support for resolution media query
+        https://bugs.webkit.org/show_bug.cgi?id=99077
+
+        Reviewed by Antti Koivisto.
+
+        * win/WebKit2.def:
+
+            Add exports for the WebCore::Settings setting.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+            Add support for the RESOLUTION_MEDIA_QUERY feature flag.
+
+2012-10-23  Allan Sandfeld Jensen  <allan.jensen@digia.com>
+
+        [Qt] Port QWebPreferences to C++
+        https://bugs.webkit.org/show_bug.cgi?id=100121
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Port all the WebPreference calls to using the direct API instead of going through
+        the auto-generated C API.
+
+        * UIProcess/API/qt/qwebpreferences.cpp:
+        (QWebPreferencesPrivate::testAttribute):
+        (QWebPreferencesPrivate::setAttribute):
+        (QWebPreferencesPrivate::setFontFamily):
+        (QWebPreferencesPrivate::fontFamily):
+        (QWebPreferencesPrivate::setFontSize):
+        (QWebPreferencesPrivate::fontSize):
+        (QWebPreferencesPrivate::preferences):
+        * UIProcess/API/qt/qwebpreferences_p_p.h:
+
+2012-10-23  Eunmi Lee  <eunmi15.lee@samsung.com>
+
+        [EFL][WK2] Convert WebEvent's timestamp from millisecond to second.
+        https://bugs.webkit.org/show_bug.cgi?id=100101
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Convert timestamp to second to create WebEvent from Evas event because
+        the unit of timestamp from Evas Event is millisecond, but the unit of
+        timestamp for WebEvent is second.
+
+        * Shared/efl/WebEventFactory.cpp:
+        (WebKit::convertMillisecondToSecond):
+        (WebKit):
+        (WebKit::WebEventFactory::createWebMouseEvent):
+        (WebKit::WebEventFactory::createWebWheelEvent):
+        (WebKit::WebEventFactory::createWebKeyboardEvent):
+
+2012-10-23  Christophe Dumez  <christophe.dumez@intel.com>
+
+        [EFL][WK2] Make request manager client a C++ class
+        https://bugs.webkit.org/show_bug.cgi?id=100093
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Make EFL's request manager client a C++ class and
+        move URL scheme handling code to it. The new
+        RequestManagerClientEfl is now in UIProcess/efl
+        instead of UIProcess/API/efl since it is not
+        part of the public API.
+
+        * PlatformEfl.cmake:
+        * UIProcess/API/efl/ewk_context.cpp:
+        (Ewk_Context::Ewk_Context):
+        (Ewk_Context::requestManager):
+        (ewk_context_url_scheme_register):
+        * UIProcess/API/efl/ewk_context_private.h:
+        (WebKit):
+        (Ewk_Context):
+        * UIProcess/efl/RequestManagerClientEfl.cpp: Renamed from Source/WebKit2/UIProcess/API/efl/ewk_context_request_manager_client.cpp.
+        (WebKit):
+        (Ewk_Url_Scheme_Handler):
+        (WebKit::Ewk_Url_Scheme_Handler::Ewk_Url_Scheme_Handler):
+        (WebKit::toRequestManagerClientEfl):
+        (WebKit::RequestManagerClientEfl::didReceiveURIRequest):
+        (WebKit::RequestManagerClientEfl::RequestManagerClientEfl):
+        (WebKit::RequestManagerClientEfl::~RequestManagerClientEfl):
+        (WebKit::RequestManagerClientEfl::registerURLSchemeHandler):
+        * UIProcess/efl/RequestManagerClientEfl.h: Renamed from Source/WebKit2/UIProcess/API/efl/ewk_context_request_manager_client_private.h.
+        (WebKit):
+        (RequestManagerClientEfl):
+        (WebKit::RequestManagerClientEfl::create):
+
+2012-10-23  Alexander Shalamov  <alexander.shalamov@intel.com>
+
+        [EFL][WK2] ecore_x should be initialised in WebProcess to avoid re-initialization by PlatformScreenEfl utilities and systemBeep() function
+        https://bugs.webkit.org/show_bug.cgi?id=100110
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        PlatformScreenEfl functions and systemBeep() depend on ecore_x functionality, therefore,
+        ecore_x should be initialized when web process starts to avoid re-initialization.
+
+        * WebProcess/efl/WebProcessMainEfl.cpp:
+        (WebKit::WebProcessMainEfl): Initialized ecore_x module.
+
+2012-10-23  Ryuan Choi  <ryuan.choi@samsung.com>
+
+        [EFL][WK2] Add support for IMF composition
+        https://bugs.webkit.org/show_bug.cgi?id=89552
+
+        Reviewed by Gyuyoung Kim.
+
+        Implemented basic IMF support.
+
+        * PlatformEfl.cmake:
+        * Shared/NativeWebKeyboardEvent.h:
+        (NativeWebKeyboardEvent):
+        (WebKit::NativeWebKeyboardEvent::isFiltered):
+        Added to determine whether current keyboard event is compositing.
+        * Shared/efl/NativeWebKeyboardEventEfl.cpp:
+        (WebKit::NativeWebKeyboardEvent::NativeWebKeyboardEvent):
+        * UIProcess/API/efl/PageClientImpl.cpp:
+        (WebKit::PageClientImpl::updateTextInputState):
+        Added to change input state.
+        * UIProcess/API/efl/PageClientImpl.h:
+        (PageClientImpl):
+        * UIProcess/API/efl/ewk_main.cpp:
+        (ewk_init): Called ecore_imf_init.
+        (ewk_shutdown): Called ecore_imf_shutdown.
+        * UIProcess/API/efl/ewk_view.cpp:
+        (_Ewk_View_Private_Data):
+        (_Ewk_View_Private_Data::_Ewk_View_Private_Data):
+        (_Ewk_View_Private_Data::~_Ewk_View_Private_Data):
+        (_ewk_view_smart_key_down): Modified to send keyboard event to IMF.
+        (_ewk_view_smart_mouse_up): Modified to reset input method context.
+        (_ewk_view_preedit_changed): Added to send composition string.
+        (_ewk_view_commit): Added to send a message that composition is finished.
+        (_ewk_view_imf_context_create): Added to create Ecore_IMF_Context.
+        (_ewk_view_imf_context_destroy): Added to destroy Ecore_IMF_Context.
+        (ewk_view_text_input_state_update): Added to update input state.
+        * UIProcess/API/efl/ewk_view_private.h:
+        * UIProcess/PageClient.h: Moved updateTextInputState() to share with EFL port.
+        (PageClient):
+        * UIProcess/WebPageProxy.cpp:
+        (WebKit::WebPageProxy::editorStateChanged):
+        Added PLATFORM(EFL) to call updateTextInputState()
+        * UIProcess/WebPageProxy.h:
+        (WebPageProxy):
+        * UIProcess/WebPageProxy.messages.in:
+        Added HandleInputMethodKeydown message to determine whether keydown is handled.
+        * UIProcess/efl/WebPageProxyEfl.cpp:
+        (WebKit::WebPageProxy::handleInputMethodKeydown):
+        Added to check whether input method handled keydown.
+        (WebKit::WebPageProxy::confirmComposition): Added to support composition.
+        (WebKit::WebPageProxy::setComposition): Ditto.
+        (WebKit::WebPageProxy::cancelComposition): Ditto.
+        * WebProcess/WebCoreSupport/efl/WebEditorClientEfl.cpp:
+        (WebKit::WebEditorClient::handleInputMethodKeydown):
+        Added to check whether input method handled keydown.
+        * WebProcess/WebPage/WebPage.h:
+        (WebPage):
+        * WebProcess/WebPage/WebPage.messages.in: Added messages to support composition.
+        * WebProcess/WebPage/efl/WebPageEfl.cpp:
+        (WebKit::targetFrameForEditing): Referenced from QT port to get focused frame.
+        (WebKit::WebPage::confirmComposition): Added to support composition.
+        (WebKit::WebPage::setComposition): Ditto.
+        (WebKit::WebPage::cancelComposition): Ditto.
+
+2012-10-23  Jussi Kukkonen  <jussi.kukkonen@intel.com>
+
+        [EFL] Make plugin process debugging easier (PLUGIN_PROCESS_COMMAND_PREFIX)
+        https://bugs.webkit.org/show_bug.cgi?id=99297
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Add support for PLUGIN_PROCESS_COMMAND_PREFIX environment variable, to allow easier
+        plugin debugging with e.g.:
+        $ PLUGIN_PROCESS_COMMAND_PREFIX="xterm gdb --args" MiniBrowser
+
+        * UIProcess/Plugins/unix/PluginProcessProxyUnix.cpp:
+        (WebKit::PluginProcessProxy::platformInitializeLaunchOptions):
+        (WebKit):
+
+2012-10-23  Mikhail Pozdnyakov  <mikhail.pozdnyakov@intel.com>
+
+        [EFL][WK2] Make Policy client a C++ class
+        https://bugs.webkit.org/show_bug.cgi?id=100089
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Make page policy client a C++ class and remove it from API folder.
+
+        * PlatformEfl.cmake:
+        * UIProcess/API/efl/ewk_view.cpp:
+        (Ewk_View_Private_Data):
+        (_ewk_view_initialize):
+        * UIProcess/efl/PagePolicyClientEfl.cpp: Renamed from Source/WebKit2/UIProcess/API/efl/ewk_view_policy_client.cpp.
+        (WebKit):
+        (WebKit::toPagePolicyClientEfl):
+        (WebKit::PagePolicyClientEfl::decidePolicyForNavigationAction):
+        (WebKit::PagePolicyClientEfl::decidePolicyForNewWindowAction):
+        (WebKit::PagePolicyClientEfl::decidePolicyForResponseCallback):
+        (WebKit::PagePolicyClientEfl::PagePolicyClientEfl):
+        * UIProcess/efl/PagePolicyClientEfl.h: Renamed from Source/WebKit2/UIProcess/API/efl/ewk_view_policy_client_private.h.
+        (WebKit):
+        (PagePolicyClientEfl):
+        (WebKit::PagePolicyClientEfl::create):
+        (WebKit::PagePolicyClientEfl::view):
+
+2012-10-23  Mikhail Pozdnyakov  <mikhail.pozdnyakov@intel.com>
+
+        [EFL][WK2] Make UI client a C++ class
+        https://bugs.webkit.org/show_bug.cgi?id=100099
+
+        Reviewed by Gyuyoung Kim.
+
+        Made page UI client a C++ class and removed it from API directory.
+
+        * PlatformEfl.cmake:
+        * UIProcess/API/efl/ewk_view.cpp:
+        (Ewk_View_Private_Data):
+        (_ewk_view_initialize):
+        * UIProcess/API/efl/ewk_view_ui_client.cpp: Removed.
+        * UIProcess/API/efl/ewk_view_ui_client_private.h: Removed.
+        * UIProcess/efl/PageUIClientEfl.cpp: Added.
+        (WebKit):
+        (WebKit::toPageUIClientEfl):
+        (WebKit::PageUIClientEfl::closePage):
+        (WebKit::PageUIClientEfl::createNewPage):
+        (WebKit::PageUIClientEfl::runJavaScriptAlert):
+        (WebKit::PageUIClientEfl::runJavaScriptConfirm):
+        (WebKit::PageUIClientEfl::runJavaScriptPrompt):
+        (WebKit::PageUIClientEfl::showColorPicker):
+        (WebKit::PageUIClientEfl::hideColorPicker):
+        (WebKit::PageUIClientEfl::exceededDatabaseQuota):
+        (WebKit::PageUIClientEfl::focus):
+        (WebKit::PageUIClientEfl::unfocus):
+        (WebKit::PageUIClientEfl::takeFocus):
+        (WebKit::PageUIClientEfl::getWindowFrame):
+        (WebKit::PageUIClientEfl::setWindowFrame):
+        (WebKit::PageUIClientEfl::PageUIClientEfl):
+        * UIProcess/efl/PageUIClientEfl.h: Added.
+        (WebKit):
+        (PageUIClientEfl):
+        (WebKit::PageUIClientEfl::create):
+
+2012-10-23  Andreas Kling  <kling@webkit.org>
+
+        [WK2] REGRESSION(r132169): It broke all plugin related test.
+        <http://webkit.org/b/100094>
+
+        Unreviewed test fix, make the CoreIPC encode/decode functions for CString match again.
+
+        * Platform/CoreIPC/ArgumentCoders.cpp:
+        (CoreIPC::::encode):
+
+2012-10-23  Christophe Dumez  <christophe.dumez@intel.com>
+
+        [EFL][WK2] Make a download client a C++ class
+        https://bugs.webkit.org/show_bug.cgi?id=100005
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Make EFL's Download client a C++ class and move
+        the id <-> download mapping from Ewk_Context to
+        DownloadManagerEfl.
+
+        The Download client was also moved to
+        UIProcess/efl/ instead of UIProcess/API/efl/
+        since it is not part of the public API.
+
+        * PlatformEfl.cmake:
+        * UIProcess/API/efl/PageClientImpl.cpp:
+        (WebKit::PageClientImpl::handleDownloadRequest):
+        * UIProcess/API/efl/ewk_context.cpp:
+        (Ewk_Context::Ewk_Context):
+        (Ewk_Context::downloadManager):
+        * UIProcess/API/efl/ewk_context_download_client_private.h: Removed.
+        * UIProcess/API/efl/ewk_context_private.h:
+        (Ewk_Context):
+        * UIProcess/API/efl/ewk_download_job_private.h:
+        * UIProcess/efl/DownloadManagerEfl.cpp: Renamed from Source/WebKit2/UIProcess/API/efl/ewk_context_download_client.cpp.
+        (WebKit):
+        (WebKit::toDownloadManagerEfl):
+        (WebKit::DownloadManagerEfl::decideDestinationWithSuggestedFilename):
+        (WebKit::DownloadManagerEfl::didReceiveResponse):
+        (WebKit::DownloadManagerEfl::didCreateDestination):
+        (WebKit::DownloadManagerEfl::didReceiveData):
+        (WebKit::DownloadManagerEfl::didFail):
+        (WebKit::DownloadManagerEfl::didCancel):
+        (WebKit::DownloadManagerEfl::didFinish):
+        (WebKit::DownloadManagerEfl::DownloadManagerEfl):
+        (WebKit::DownloadManagerEfl::registerDownload):
+        (WebKit::DownloadManagerEfl::downloadJob):
+        (WebKit::DownloadManagerEfl::unregisterDownloadJob):
+        * UIProcess/efl/DownloadManagerEfl.h: Added.
+        (WebKit):
+        (DownloadManagerEfl):
+        (WebKit::DownloadManagerEfl::create):
+
 2012-10-23  Andras Becsi  <andras.becsi@digia.com>
 
         Remove devicePixelRatio from ViewportAttributes
diff --git a/Source/WebKit2/Configurations/Base.xcconfig b/Source/WebKit2/Configurations/Base.xcconfig
index ab4fec7fb..360574206 100644
--- a/Source/WebKit2/Configurations/Base.xcconfig
+++ b/Source/WebKit2/Configurations/Base.xcconfig
@@ -21,11 +21,8 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 
-#include "CompilerVersion.xcconfig"
-
-COMPILER_SPECIFIC_WARNING_CFLAGS = $(COMPILER_SPECIFIC_WARNING_CFLAGS_$(TARGET_GCC_VERSION));
-COMPILER_SPECIFIC_WARNING_CFLAGS_LLVM_COMPILER = -Wexit-time-destructors -Wglobal-constructors -Wtautological-compare;
-
+CLANG_CXX_LANGUAGE_STANDARD = gnu++0x;
+CLANG_CXX_LIBRARY = libc++;
 CLANG_WARN_CXX0X_EXTENSIONS = NO;
 DEBUG_INFORMATION_FORMAT = dwarf-with-dsym;
 GCC_C_LANGUAGE_STANDARD = gnu99;
@@ -44,6 +41,7 @@ GCC_PRECOMPILE_PREFIX_HEADER = YES;
 GCC_SYMBOLS_PRIVATE_EXTERN = YES;
 GCC_THREADSAFE_STATICS = NO;
 GCC_TREAT_WARNINGS_AS_ERRORS = YES;
+GCC_VERSION = com.apple.compilers.llvm.clang.1_0;
 GCC_WARN_ABOUT_DEPRECATED_FUNCTIONS = NO;
 GCC_WARN_ABOUT_MISSING_NEWLINE = YES;
 GCC_WARN_ABOUT_MISSING_PROTOTYPES = YES;
@@ -56,23 +54,11 @@ OTHER_MIGFLAGS = -F$(BUILT_PRODUCTS_DIR);
 PREBINDING = NO;
 VALID_ARCHS = i386 x86_64;
 // FIXME: <rdar://problem/5070292> WebKit should build with -Wshorten-64-to-32
-WARNING_CFLAGS = -Wall -Wextra -Wchar-subscripts -Wextra-tokens -Wformat-security -Winit-self -Wmissing-format-attribute -Wmissing-noreturn -Wno-unused-parameter -Wpacked -Wpointer-arith -Wredundant-decls -Wundef -Wwrite-strings $(COMPILER_SPECIFIC_WARNING_CFLAGS);
+WARNING_CFLAGS = -Wall -Wextra -Wchar-subscripts -Wextra-tokens -Wformat-security -Winit-self -Wmissing-format-attribute -Wmissing-noreturn -Wno-unused-parameter -Wpacked -Wpointer-arith -Wredundant-decls -Wundef -Wwrite-strings -Wexit-time-destructors -Wglobal-constructors -Wtautological-compare;
 
 // Prevent C++ standard library operator new, delete and their related exception types from being exported as weak symbols.
 OTHER_LDFLAGS = -Wl,-unexported_symbol -Wl,__ZTISt9bad_alloc -Wl,-unexported_symbol -Wl,__ZTISt9exception -Wl,-unexported_symbol -Wl,__ZTSSt9bad_alloc -Wl,-unexported_symbol -Wl,__ZTSSt9exception -Wl,-unexported_symbol -Wl,__ZdlPvS_ -Wl,-unexported_symbol -Wl,__ZnwmPv -Wl,-unexported_symbol -Wl,__Znwm;
 
-CLANG_CXX_LIBRARY = $(CLANG_CXX_LIBRARY_$(TARGET_MAC_OS_X_VERSION_MAJOR));
-CLANG_CXX_LIBRARY_1060 = libstdc++;
-CLANG_CXX_LIBRARY_1070 = libc++;
-CLANG_CXX_LIBRARY_1080 = libc++;
-CLANG_CXX_LIBRARY_1090 = libc++;
-
-REAL_PLATFORM_NAME = $(REAL_PLATFORM_NAME_$(PLATFORM_NAME));
-REAL_PLATFORM_NAME_ = $(REAL_PLATFORM_NAME_macosx);
-REAL_PLATFORM_NAME_iphoneos = iphoneos;
-REAL_PLATFORM_NAME_iphonesimulator = iphonesimulator;
-REAL_PLATFORM_NAME_macosx = macosx;
-
 TARGET_MAC_OS_X_VERSION_MAJOR = $(MAC_OS_X_VERSION_MAJOR);
 
 
@@ -98,7 +84,6 @@ DEAD_CODE_STRIPPING = YES;
 SECTORDER_FLAGS = -Wl,-order_file,mac/WebKit2.order;
 
 TARGETING_SAME_OS_X_VERSION = $(TARGETING_SAME_OS_X_VERSION_$(MAC_OS_X_VERSION_MAJOR)_$(TARGET_MAC_OS_X_VERSION_MAJOR));
-TARGETING_SAME_OS_X_VERSION_1060_1060 = YES;
 TARGETING_SAME_OS_X_VERSION_1070_1070 = YES;
 TARGETING_SAME_OS_X_VERSION_1080_1080 = YES;
 TARGETING_SAME_OS_X_VERSION_1090_1090 = YES;
diff --git a/Source/WebKit2/Configurations/BaseTarget.xcconfig b/Source/WebKit2/Configurations/BaseTarget.xcconfig
index 6a8b8bd63..bf0870363 100644
--- a/Source/WebKit2/Configurations/BaseTarget.xcconfig
+++ b/Source/WebKit2/Configurations/BaseTarget.xcconfig
@@ -29,16 +29,16 @@ GCC_PREFIX_HEADER = WebKit2Prefix.h;
 GCC_PREPROCESSOR_DEFINITIONS = $(DEBUG_DEFINES) $(FEATURE_DEFINES) FRAMEWORK_NAME=WebKit2
 HEADER_SEARCH_PATHS = $(BUILT_PRODUCTS_DIR)/usr/local/include $(WEBCORE_PRIVATE_HEADERS_DIR)/ForwardingHeaders $(WEBCORE_PRIVATE_HEADERS_DIR)/icu $(BUILT_PRODUCTS_DIR)/DerivedSources/WebKit2 $(HEADER_SEARCH_PATHS);
 
-NORMAL_WEBKIT2_FRAMEWORKS_DIR = $(NORMAL_WEBKIT2_FRAMEWORKS_DIR_$(REAL_PLATFORM_NAME));
+NORMAL_WEBKIT2_FRAMEWORKS_DIR = $(NORMAL_WEBKIT2_FRAMEWORKS_DIR_$(PLATFORM_NAME));
 NORMAL_WEBKIT2_FRAMEWORKS_DIR_macosx = $(SYSTEM_LIBRARY_DIR)/PrivateFrameworks;
 
-WEBKIT2_FRAMEWORKS_DIR = $(WEBKIT2_FRAMEWORKS_DIR_$(REAL_PLATFORM_NAME));
+WEBKIT2_FRAMEWORKS_DIR = $(WEBKIT2_FRAMEWORKS_DIR_$(PLATFORM_NAME));
 WEBKIT2_FRAMEWORKS_DIR_macosx = $(WEBKIT2_FRAMEWORKS_DIR_macosx_USE_STAGING_INSTALL_PATH_$(USE_STAGING_INSTALL_PATH));
 WEBKIT2_FRAMEWORKS_DIR_macosx_USE_STAGING_INSTALL_PATH_ = $(WEBKIT2_FRAMEWORKS_DIR_macosx_USE_STAGING_INSTALL_PATH_NO);
 WEBKIT2_FRAMEWORKS_DIR_macosx_USE_STAGING_INSTALL_PATH_NO = $(NORMAL_WEBKIT2_FRAMEWORKS_DIR);
 WEBKIT2_FRAMEWORKS_DIR_macosx_USE_STAGING_INSTALL_PATH_YES = $(SYSTEM_LIBRARY_DIR)/StagedFrameworks/Safari;
 
-UMBRELLA_FRAMEWORKS_DIR = $(UMBRELLA_FRAMEWORKS_DIR_$(REAL_PLATFORM_NAME)_$(CONFIGURATION));
+UMBRELLA_FRAMEWORKS_DIR = $(UMBRELLA_FRAMEWORKS_DIR_$(PLATFORM_NAME)_$(CONFIGURATION));
 UMBRELLA_FRAMEWORKS_DIR_macosx_Release = $(UMBRELLA_FRAMEWORKS_DIR_engineering);
 UMBRELLA_FRAMEWORKS_DIR_macosx_Debug = $(UMBRELLA_FRAMEWORKS_DIR_engineering);
 UMBRELLA_FRAMEWORKS_DIR_macosx_Production = $(UMBRELLA_FRAMEWORKS_DIR_macosx_Production_USE_STAGING_INSTALL_PATH_$(USE_STAGING_INSTALL_PATH));
diff --git a/Source/WebKit2/Configurations/CompilerVersion.xcconfig b/Source/WebKit2/Configurations/CompilerVersion.xcconfig
deleted file mode 100644
index a8c7f75a0..000000000
--- a/Source/WebKit2/Configurations/CompilerVersion.xcconfig
+++ /dev/null
@@ -1,84 +0,0 @@
-// Copyright (C) 2009, 2010, 2011 Apple Inc. All rights reserved.
-//
-// Redistribution and use in source and binary forms, with or without
-// modification, are permitted provided that the following conditions
-// are met:
-// 1. Redistributions of source code must retain the above copyright
-//    notice, this list of conditions and the following disclaimer.
-// 2. Redistributions in binary form must reproduce the above copyright
-//    notice, this list of conditions and the following disclaimer in the
-//    documentation and/or other materials provided with the distribution.
-//
-// THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
-// EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
-// IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
-// PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
-// CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
-// EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
-// PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
-// PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
-// OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
-
-IS_XCODE_0400 = $(IS_XCODE_0400_$(XCODE_VERSION_MINOR));
-IS_XCODE_0400_0400 = YES;
-
-IS_XCODE_0400_OR_0410 = $(IS_XCODE_0400_OR_0410_$(XCODE_VERSION_MINOR));
-IS_XCODE_0400_OR_0410_0400 = YES;
-IS_XCODE_0400_OR_0410_0410 = YES;
-
-// The version of the LLVM Compiler in Xcode 4.0 and earlier have difficulty compiling our code.
-LLVM_COMPILER_UNSUITABLE_FOR_DEBUG_BUILDS = $(LLVM_COMPILER_UNSUITABLE_FOR_DEBUG_BUILDS_$(XCODE_VERSION_MAJOR));
-LLVM_COMPILER_UNSUITABLE_FOR_DEBUG_BUILDS_0300 = YES;
-LLVM_COMPILER_UNSUITABLE_FOR_DEBUG_BUILDS_0400 = $(LLVM_COMPILER_UNSUITABLE_FOR_DEBUG_BUILDS_IS_XCODE_0400_$(IS_XCODE_0400));
-LLVM_COMPILER_UNSUITABLE_FOR_DEBUG_BUILDS_IS_XCODE_0400_YES = YES;
-
-// The version of the LLVM Compiler in Xcode 4.1 and earlier do not generate fast enough code.
-LLVM_COMPILER_UNSUITABLE_FOR_OPTIMIZED_BUILDS = $(LLVM_COMPILER_UNSUITABLE_FOR_OPTIMIZED_BUILDS_$(XCODE_VERSION_MAJOR));
-LLVM_COMPILER_UNSUITABLE_FOR_OPTIMIZED_BUILDS_0300 = YES;
-LLVM_COMPILER_UNSUITABLE_FOR_OPTIMIZED_BUILDS_0400 = $(LLVM_COMPILER_UNSUITABLE_FOR_OPTIMIZED_BUILDS_IS_XCODE_0400_OR_0410_$(IS_XCODE_0400_OR_0410));
-LLVM_COMPILER_UNSUITABLE_FOR_OPTIMIZED_BUILDS_IS_XCODE_0400_OR_0410_YES = YES;
-
-LLVM_COMPILER_SUITABLE_FOR_DEBUG_BUILDS = $(LLVM_COMPILER_SUITABLE_FOR_DEBUG_BUILDS_$(LLVM_COMPILER_UNSUITABLE_FOR_DEBUG_BUILDS));
-LLVM_COMPILER_SUITABLE_FOR_DEBUG_BUILDS_ = YES;
-LLVM_COMPILER_SUITABLE_FOR_DEBUG_BUILDS_YES = NO;
-
-LLVM_COMPILER_SUITABLE_FOR_OPTIMIZED_BUILDS = $(LLVM_COMPILER_SUITABLE_FOR_OPTIMIZED_BUILDS_$(LLVM_COMPILER_UNSUITABLE_FOR_OPTIMIZED_BUILDS));
-LLVM_COMPILER_SUITABLE_FOR_OPTIMIZED_BUILDS_ = YES;
-LLVM_COMPILER_SUITABLE_FOR_OPTIMIZED_BUILDS_YES = NO;
-
-
-// Use GCC 4.2 with Xcode 3.1, which includes GCC 4.2 but defaults to GCC 4.0.
-// Note that Xcode versions as new as 3.1.2 use XCODE_VERSION_ACTUAL for the minor version
-// number.  Newer versions of Xcode use XCODE_VERSION_MINOR for the minor version, and
-// XCODE_VERSION_ACTUAL for the full version number.
-TARGET_GCC_VERSION = $(TARGET_GCC_VERSION_$(REAL_PLATFORM_NAME));
-TARGET_GCC_VERSION_iphoneos = LLVM_GCC_42;
-TARGET_GCC_VERSION_iphonesimulator = GCC_42;
-TARGET_GCC_VERSION_macosx = $(TARGET_GCC_VERSION_macosx_$(TARGET_MAC_OS_X_VERSION_MAJOR));
-
-TARGET_GCC_VERSION_macosx_1050 = $(TARGET_GCC_VERSION_macosx_1050_$(XCODE_VERSION_MINOR));
-TARGET_GCC_VERSION_macosx_1050_ = $(TARGET_GCC_VERSION_macosx_1050_$(XCODE_VERSION_ACTUAL));
-TARGET_GCC_VERSION_macosx_1050_0310 = GCC_42;
-TARGET_GCC_VERSION_macosx_1050_0320 = GCC_42;
-
-TARGET_GCC_VERSION_macosx_1060 = $(TARGET_GCC_VERSION_macosx_1060_AND_1070_$(CONFIGURATION));
-TARGET_GCC_VERSION_macosx_1070 = $(TARGET_GCC_VERSION_macosx_1060_AND_1070_$(CONFIGURATION));
-TARGET_GCC_VERSION_macosx_1060_AND_1070_Debug = $(TARGET_GCC_VERSION_macosx_USE_LLVM_COMPILER_$(LLVM_COMPILER_SUITABLE_FOR_DEBUG_BUILDS));
-TARGET_GCC_VERSION_macosx_1060_AND_1070_Release = $(TARGET_GCC_VERSION_macosx_USE_LLVM_COMPILER_$(LLVM_COMPILER_SUITABLE_FOR_OPTIMIZED_BUILDS));
-TARGET_GCC_VERSION_macosx_1060_AND_1070_Production = $(TARGET_GCC_VERSION_macosx_USE_LLVM_COMPILER_$(LLVM_COMPILER_SUITABLE_FOR_OPTIMIZED_BUILDS));
-TARGET_GCC_VERSION_macosx_1060_NON_LLVM_FALLBACK = GCC_42;
-TARGET_GCC_VERSION_macosx_1070_NON_LLVM_FALLBACK = LLVM_GCC_42;
-
-TARGET_GCC_VERSION_macosx_USE_LLVM_COMPILER_YES = LLVM_COMPILER;
-TARGET_GCC_VERSION_macosx_USE_LLVM_COMPILER_NO = $(TARGET_GCC_VERSION_macosx_$(TARGET_MAC_OS_X_VERSION_MAJOR)_NON_LLVM_FALLBACK);
-
-TARGET_GCC_VERSION_macosx_1080 = LLVM_COMPILER;
-TARGET_GCC_VERSION_macosx_1090 = LLVM_COMPILER;
-
-GCC_VERSION = $(GCC_VERSION_$(TARGET_GCC_VERSION));
-GCC_VERSION_GCC_40 = 4.0;
-GCC_VERSION_GCC_42 = 4.2;
-GCC_VERSION_LLVM_GCC_42 = com.apple.compilers.llvmgcc42;
-GCC_VERSION_LLVM_COMPILER = com.apple.compilers.llvm.clang.1_0;
diff --git a/Source/WebKit2/Configurations/DebugRelease.xcconfig b/Source/WebKit2/Configurations/DebugRelease.xcconfig
index e5d40bff4..c8e72f360 100644
--- a/Source/WebKit2/Configurations/DebugRelease.xcconfig
+++ b/Source/WebKit2/Configurations/DebugRelease.xcconfig
@@ -28,8 +28,6 @@ ARCHS = $(ARCHS_STANDARD_32_64_BIT);
 ONLY_ACTIVE_ARCH = YES;
 
 MACOSX_DEPLOYMENT_TARGET = $(MACOSX_DEPLOYMENT_TARGET_$(TARGET_MAC_OS_X_VERSION_MAJOR));
-MACOSX_DEPLOYMENT_TARGET_1050 = 10.5;
-MACOSX_DEPLOYMENT_TARGET_1060 = 10.6;
 MACOSX_DEPLOYMENT_TARGET_1070 = 10.7;
 MACOSX_DEPLOYMENT_TARGET_1080 = 10.8;
 MACOSX_DEPLOYMENT_TARGET_1090 = 10.9;
@@ -40,8 +38,6 @@ DEBUG_INFORMATION_FORMAT = dwarf;
 SECTORDER_FLAGS = ;
 
 WEBKIT_SYSTEM_INTERFACE_LIBRARY = $(WEBKIT_SYSTEM_INTERFACE_LIBRARY_$(TARGET_MAC_OS_X_VERSION_MAJOR));
-WEBKIT_SYSTEM_INTERFACE_LIBRARY_1050 = WebKitSystemInterfaceLeopard;
-WEBKIT_SYSTEM_INTERFACE_LIBRARY_1060 = WebKitSystemInterfaceSnowLeopard;
 WEBKIT_SYSTEM_INTERFACE_LIBRARY_1070 = WebKitSystemInterfaceLion;
 WEBKIT_SYSTEM_INTERFACE_LIBRARY_1080 = WebKitSystemInterfaceMountainLion;
 WEBKIT_SYSTEM_INTERFACE_LIBRARY_1090 = WebKitSystemInterfaceMountainLion;
diff --git a/Source/WebKit2/Configurations/FeatureDefines.xcconfig b/Source/WebKit2/Configurations/FeatureDefines.xcconfig
index ce0af8680..a4f8ca0c0 100644
--- a/Source/WebKit2/Configurations/FeatureDefines.xcconfig
+++ b/Source/WebKit2/Configurations/FeatureDefines.xcconfig
@@ -39,6 +39,7 @@ ENABLE_CHANNEL_MESSAGING = ENABLE_CHANNEL_MESSAGING;
 ENABLE_CSP_NEXT = ;
 ENABLE_CSS_BOX_DECORATION_BREAK = ENABLE_CSS_BOX_DECORATION_BREAK;
 ENABLE_CSS_COMPOSITING = ENABLE_CSS_COMPOSITING;
+ENABLE_CSS_DEVICE_ADAPTATION = ;
 ENABLE_CSS_EXCLUSIONS = ENABLE_CSS_EXCLUSIONS;
 ENABLE_CSS_FILTERS = ENABLE_CSS_FILTERS;
 ENABLE_CSS_HIERARCHIES = ;
@@ -51,7 +52,7 @@ ENABLE_CSS_VARIABLES = ;
 ENABLE_CSS3_CONDITIONAL_RULES = ;
 ENABLE_CSS3_TEXT = ;
 ENABLE_CUSTOM_SCHEME_HANDLER = ;
-ENABLE_DASHBOARD_SUPPORT = $(ENABLE_DASHBOARD_SUPPORT_$(REAL_PLATFORM_NAME));
+ENABLE_DASHBOARD_SUPPORT = $(ENABLE_DASHBOARD_SUPPORT_$(PLATFORM_NAME));
 ENABLE_DASHBOARD_SUPPORT_macosx = ENABLE_DASHBOARD_SUPPORT;
 ENABLE_DATALIST_ELEMENT = ;
 ENABLE_DATA_TRANSFER_ITEMS = ;
@@ -60,42 +61,46 @@ ENABLE_DEVICE_ORIENTATION = ;
 ENABLE_DIALOG_ELEMENT = ;
 ENABLE_DIRECTORY_UPLOAD = ;
 ENABLE_DRAGGABLE_REGION = ;
+ENABLE_ENCRYPTED_MEDIA = $(ENABLE_ENCRYPTED_MEDIA_$(PLATFORM_NAME));
+ENABLE_ENCRYPTED_MEDIA_macosx = $(ENABLE_ENCRYPTED_MEDIA_macosx_$(TARGET_MAC_OS_X_VERSION_MAJOR));
+ENABLE_ENCRYPTED_MEDIA_macosx_1070 = ;
+ENABLE_ENCRYPTED_MEDIA_macosx_1080 = ;
+ENABLE_ENCRYPTED_MEDIA_macosx_1090 = ENABLE_ENCRYPTED_MEDIA;
 ENABLE_FILE_SYSTEM = ;
-ENABLE_FILTERS = $(ENABLE_FILTERS_$(REAL_PLATFORM_NAME));
-ENABLE_FILTERS_macosx = ENABLE_FILTERS;
+ENABLE_FILTERS = ENABLE_FILTERS;
 ENABLE_FULLSCREEN_API = ENABLE_FULLSCREEN_API;
 ENABLE_GAMEPAD = ;
 ENABLE_GEOLOCATION = ENABLE_GEOLOCATION;
-ENABLE_HIDDEN_PAGE_DOM_TIMER_THROTTLING = $(ENABLE_HIDDEN_PAGE_DOM_TIMER_THROTTLING_$(REAL_PLATFORM_NAME));
+ENABLE_HIDDEN_PAGE_DOM_TIMER_THROTTLING = $(ENABLE_HIDDEN_PAGE_DOM_TIMER_THROTTLING_$(PLATFORM_NAME));
 ENABLE_HIDDEN_PAGE_DOM_TIMER_THROTTLING_macosx = ENABLE_HIDDEN_PAGE_DOM_TIMER_THROTTLING;
 ENABLE_HIGH_DPI_CANVAS = ENABLE_HIGH_DPI_CANVAS;
-ENABLE_ICONDATABASE = $(ENABLE_ICONDATABASE_$(REAL_PLATFORM_NAME));
+ENABLE_ICONDATABASE = $(ENABLE_ICONDATABASE_$(PLATFORM_NAME));
 ENABLE_ICONDATABASE_macosx = ENABLE_ICONDATABASE;
 ENABLE_IFRAME_SEAMLESS = ENABLE_IFRAME_SEAMLESS;
 ENABLE_INDEXED_DATABASE = ;
 ENABLE_INPUT_SPEECH = ;
 ENABLE_INPUT_TYPE_COLOR = ;
-ENABLE_INPUT_TYPE_DATE = $(ENABLE_INPUT_TYPE_DATE_$(REAL_PLATFORM_NAME));
+ENABLE_INPUT_TYPE_DATE = $(ENABLE_INPUT_TYPE_DATE_$(PLATFORM_NAME));
 ENABLE_INPUT_TYPE_DATE_iphoneos = ENABLE_INPUT_TYPE_DATE;
-ENABLE_INPUT_TYPE_DATE_iphonesimulator = ENABLE_INPUT_TYPE_DATE;
-ENABLE_INPUT_TYPE_DATETIME = $(ENABLE_INPUT_TYPE_DATETIME_$(REAL_PLATFORM_NAME));
+ENABLE_INPUT_TYPE_DATE_iphonesimulator = $(ENABLE_INPUT_TYPE_DATE_iphoneos);
+ENABLE_INPUT_TYPE_DATETIME = $(ENABLE_INPUT_TYPE_DATETIME_$(PLATFORM_NAME));
 ENABLE_INPUT_TYPE_DATETIME_iphoneos = ENABLE_INPUT_TYPE_DATETIME;
-ENABLE_INPUT_TYPE_DATETIME_iphonesimulator = ENABLE_INPUT_TYPE_DATETIME;
-ENABLE_INPUT_TYPE_DATETIMELOCAL = $(ENABLE_INPUT_TYPE_DATETIMELOCAL_$(REAL_PLATFORM_NAME));
+ENABLE_INPUT_TYPE_DATETIME_iphonesimulator = $(ENABLE_INPUT_TYPE_DATETIME_iphoneos);
+ENABLE_INPUT_TYPE_DATETIMELOCAL = $(ENABLE_INPUT_TYPE_DATETIMELOCAL_$(PLATFORM_NAME));
 ENABLE_INPUT_TYPE_DATETIMELOCAL_iphoneos = ENABLE_INPUT_TYPE_DATETIMELOCAL;
-ENABLE_INPUT_TYPE_DATETIMELOCAL_iphonesimulator = ENABLE_INPUT_TYPE_DATETIMELOCAL;
-ENABLE_INPUT_TYPE_MONTH = $(ENABLE_INPUT_TYPE_MONTH_$(REAL_PLATFORM_NAME));
+ENABLE_INPUT_TYPE_DATETIMELOCAL_iphonesimulator = $(ENABLE_INPUT_TYPE_DATETIMELOCAL_iphoneos);
+ENABLE_INPUT_TYPE_MONTH = $(ENABLE_INPUT_TYPE_MONTH_$(PLATFORM_NAME));
 ENABLE_INPUT_TYPE_MONTH_iphoneos = ENABLE_INPUT_TYPE_MONTH;
-ENABLE_INPUT_TYPE_MONTH_iphonesimulator = ENABLE_INPUT_TYPE_MONTH;
-ENABLE_INPUT_TYPE_TIME = $(ENABLE_INPUT_TYPE_TIME_$(REAL_PLATFORM_NAME));
+ENABLE_INPUT_TYPE_MONTH_iphonesimulator = $(ENABLE_INPUT_TYPE_MONTH_iphoneos);
+ENABLE_INPUT_TYPE_TIME = $(ENABLE_INPUT_TYPE_TIME_$(PLATFORM_NAME));
 ENABLE_INPUT_TYPE_TIME_iphoneos = ENABLE_INPUT_TYPE_TIME;
-ENABLE_INPUT_TYPE_TIME_iphonesimulator = ENABLE_INPUT_TYPE_TIME;
-ENABLE_INPUT_TYPE_WEEK = $(ENABLE_INPUT_TYPE_WEEK_$(REAL_PLATFORM_NAME));
+ENABLE_INPUT_TYPE_TIME_iphonesimulator = $(ENABLE_INPUT_TYPE_TIME_iphoneos);
+ENABLE_INPUT_TYPE_WEEK = $(ENABLE_INPUT_TYPE_WEEK_$(PLATFORM_NAME));
 ENABLE_INPUT_TYPE_WEEK_iphoneos = ENABLE_INPUT_TYPE_WEEK;
-ENABLE_INPUT_TYPE_WEEK_iphonesimulator = ENABLE_INPUT_TYPE_WEEK;
+ENABLE_INPUT_TYPE_WEEK_iphonesimulator = $(ENABLE_INPUT_TYPE_WEEK_iphoneos);
 ENABLE_JAVASCRIPT_DEBUGGER = ENABLE_JAVASCRIPT_DEBUGGER;
 ENABLE_LEGACY_CSS_VENDOR_PREFIXES = ENABLE_LEGACY_CSS_VENDOR_PREFIXES;
-ENABLE_LEGACY_NOTIFICATIONS = $(ENABLE_LEGACY_NOTIFICATIONS_$(REAL_PLATFORM_NAME));
+ENABLE_LEGACY_NOTIFICATIONS = $(ENABLE_LEGACY_NOTIFICATIONS_$(PLATFORM_NAME));
 ENABLE_LEGACY_NOTIFICATIONS_macosx = $(ENABLE_LEGACY_NOTIFICATIONS_macosx_$(TARGET_MAC_OS_X_VERSION_MAJOR));
 ENABLE_LEGACY_NOTIFICATIONS_macosx_1070 = ;
 ENABLE_LEGACY_NOTIFICATIONS_macosx_1080 = ENABLE_LEGACY_NOTIFICATIONS;
@@ -112,13 +117,13 @@ ENABLE_MHTML = ;
 ENABLE_MICRODATA = ;
 ENABLE_MUTATION_OBSERVERS = ENABLE_MUTATION_OBSERVERS;
 ENABLE_NAVIGATOR_CONTENT_UTILS = ;
-ENABLE_NOTIFICATIONS = $(ENABLE_NOTIFICATIONS_$(REAL_PLATFORM_NAME));
+ENABLE_NOTIFICATIONS = $(ENABLE_NOTIFICATIONS_$(PLATFORM_NAME));
 ENABLE_NOTIFICATIONS_macosx = $(ENABLE_NOTIFICATIONS_macosx_$(TARGET_MAC_OS_X_VERSION_MAJOR));
 ENABLE_NOTIFICATIONS_macosx_1070 = ;
 ENABLE_NOTIFICATIONS_macosx_1080 = ENABLE_NOTIFICATIONS;
 ENABLE_NOTIFICATIONS_macosx_1090 = ENABLE_NOTIFICATIONS;
 ENABLE_PAGE_VISIBILITY_API = ;
-ENABLE_PDFKIT_PLUGIN = $(ENABLE_PDFKIT_PLUGIN_$(REAL_PLATFORM_NAME));
+ENABLE_PDFKIT_PLUGIN = $(ENABLE_PDFKIT_PLUGIN_$(PLATFORM_NAME));
 ENABLE_PDFKIT_PLUGIN_macosx = $(ENABLE_PDFKIT_PLUGIN_macosx_$(TARGET_MAC_OS_X_VERSION_MAJOR));
 ENABLE_PDFKIT_PLUGIN_macosx_1070 = ;
 ENABLE_PDFKIT_PLUGIN_macosx_1080 = ;
@@ -126,27 +131,30 @@ ENABLE_PDFKIT_PLUGIN_macosx_1090 = ENABLE_PDFKIT_PLUGIN;
 ENABLE_PROGRESS_ELEMENT = ENABLE_PROGRESS_ELEMENT;
 ENABLE_QUOTA = ;
 ENABLE_REQUEST_ANIMATION_FRAME = ENABLE_REQUEST_ANIMATION_FRAME;
+ENABLE_RESOLUTION_MEDIA_QUERY = ;
 ENABLE_SCRIPTED_SPEECH = ;
 ENABLE_SHADOW_DOM = ;
 ENABLE_SHARED_WORKERS = ENABLE_SHARED_WORKERS;
 ENABLE_SQL_DATABASE = ENABLE_SQL_DATABASE;
 ENABLE_STYLE_SCOPED = ;
+ENABLE_SUBPIXEL_LAYOUT = ENABLE_SUBPIXEL_LAYOUT;
 ENABLE_SVG = ENABLE_SVG;
-ENABLE_SVG_DOM_OBJC_BINDINGS = $(ENABLE_SVG_DOM_OBJC_BINDINGS_$(REAL_PLATFORM_NAME));
+ENABLE_SVG_DOM_OBJC_BINDINGS = $(ENABLE_SVG_DOM_OBJC_BINDINGS_$(PLATFORM_NAME));
 ENABLE_SVG_DOM_OBJC_BINDINGS_macosx = ENABLE_SVG_DOM_OBJC_BINDINGS;
 ENABLE_SVG_FONTS = ENABLE_SVG_FONTS;
 ENABLE_TEXT_AUTOSIZING = ;
 ENABLE_TEXT_NOTIFICATIONS_ONLY = ENABLE_TEXT_NOTIFICATIONS_ONLY;
 ENABLE_TOUCH_ICON_LOADING = ;
-ENABLE_UNDO_MANAGER = ;
+ENABLE_USERSELECT_ALL = ENABLE_USERSELECT_ALL;
 ENABLE_VIDEO = ENABLE_VIDEO;
-ENABLE_VIDEO_TRACK = $(ENABLE_VIDEO_TRACK_$(REAL_PLATFORM_NAME));
+ENABLE_VIDEO_TRACK = $(ENABLE_VIDEO_TRACK_$(PLATFORM_NAME));
 ENABLE_VIDEO_TRACK_macosx = ENABLE_VIDEO_TRACK;
 ENABLE_WEBGL = ENABLE_WEBGL;
 ENABLE_WEB_AUDIO = ENABLE_WEB_AUDIO;
 ENABLE_WEB_SOCKETS = ENABLE_WEB_SOCKETS;
 ENABLE_WEB_TIMING = ;
 ENABLE_WORKERS = ENABLE_WORKERS;
+ENABLE_XHR_TIMEOUT = ENABLE_XHR_TIMEOUT;
 ENABLE_XSLT = ENABLE_XSLT;
 
-FEATURE_DEFINES = $(ENABLE_3D_RENDERING) $(ENABLE_ACCELERATED_2D_CANVAS) $(ENABLE_ANIMATION_API) $(ENABLE_BLOB) $(ENABLE_CHANNEL_MESSAGING) $(ENABLE_CSP_NEXT) $(ENABLE_CSS_BOX_DECORATION_BREAK) $(ENABLE_CSS_EXCLUSIONS) $(ENABLE_CSS_COMPOSITING) $(ENABLE_CSS_FILTERS) $(ENABLE_CSS_HIERARCHIES) $(ENABLE_CSS_IMAGE_ORIENTATION) $(ENABLE_CSS_IMAGE_RESOLUTION) $(ENABLE_CSS_REGIONS) $(ENABLE_CSS_SHADERS) $(ENABLE_CSS_STICKY_POSITION) $(ENABLE_CSS_VARIABLES) $(ENABLE_CSS3_CONDITIONAL_RULES) $(ENABLE_CSS3_TEXT) $(ENABLE_CUSTOM_SCHEME_HANDLER) $(ENABLE_DASHBOARD_SUPPORT) $(ENABLE_DATALIST_ELEMENT) $(ENABLE_DATA_TRANSFER_ITEMS) $(ENABLE_DETAILS_ELEMENT) $(ENABLE_DEVICE_ORIENTATION) $(ENABLE_DIALOG_ELEMENT) $(ENABLE_DIRECTORY_UPLOAD) $(ENABLE_DRAGGABLE_REGION) $(ENABLE_FILE_SYSTEM) $(ENABLE_FILTERS) $(ENABLE_FULLSCREEN_API) $(ENABLE_GAMEPAD) $(ENABLE_GEOLOCATION) $(ENABLE_HIDDEN_PAGE_DOM_TIMER_THROTTLING) $(ENABLE_HIGH_DPI_CANVAS) $(ENABLE_ICONDATABASE) $(ENABLE_IFRAME_SEAMLESS) $(ENABLE_INDEXED_DATABASE) $(ENABLE_INPUT_SPEECH) $(ENABLE_INPUT_TYPE_COLOR) $(ENABLE_INPUT_TYPE_DATE) $(ENABLE_INPUT_TYPE_DATETIME) $(ENABLE_INPUT_TYPE_DATETIMELOCAL) $(ENABLE_INPUT_TYPE_MONTH) $(ENABLE_INPUT_TYPE_TIME) $(ENABLE_INPUT_TYPE_WEEK) $(ENABLE_JAVASCRIPT_DEBUGGER) $(ENABLE_LEGACY_CSS_VENDOR_PREFIXES) $(ENABLE_LEGACY_NOTIFICATIONS) $(LEGACY_VENDOR_PREFIXES) $(ENABLE_LEGACY_WEB_AUDIO) $(ENABLE_LINK_PREFETCH) $(ENABLE_LINK_PRERENDER) $(ENABLE_MATHML) $(ENABLE_MEDIA_SOURCE) $(ENABLE_MEDIA_STATISTICS) $(ENABLE_METER_ELEMENT) $(ENABLE_MHTML) $(ENABLE_MICRODATA) $(ENABLE_MUTATION_OBSERVERS) $(ENABLE_NAVIGATOR_CONTENT_UTILS) $(ENABLE_NOTIFICATIONS) $(ENABLE_PAGE_VISIBILITY_API) $(ENABLE_PDFKIT_PLUGIN) $(ENABLE_PROGRESS_ELEMENT) $(ENABLE_QUOTA) $(ENABLE_REQUEST_ANIMATION_FRAME) $(ENABLE_SCRIPTED_SPEECH) $(ENABLE_SHADOW_DOM) $(ENABLE_SHARED_WORKERS) $(ENABLE_SQL_DATABASE) $(ENABLE_STYLE_SCOPED) $(ENABLE_SVG) $(ENABLE_SVG_DOM_OBJC_BINDINGS) $(ENABLE_SVG_FONTS) $(ENABLE_TEXT_AUTOSIZING) $(ENABLE_TEXT_NOTIFICATIONS_ONLY) $(ENABLE_TOUCH_ICON_LOADING) $(ENABLE_UNDO_MANAGER) $(ENABLE_VIDEO) $(ENABLE_VIDEO_TRACK) $(ENABLE_WEBGL) $(ENABLE_WEB_AUDIO) $(ENABLE_WEB_SOCKETS) $(ENABLE_WEB_TIMING) $(ENABLE_WORKERS) $(ENABLE_XSLT);
+FEATURE_DEFINES = $(ENABLE_3D_RENDERING) $(ENABLE_ACCELERATED_2D_CANVAS) $(ENABLE_ANIMATION_API) $(ENABLE_BLOB) $(ENABLE_CHANNEL_MESSAGING) $(ENABLE_CSP_NEXT) $(ENABLE_CSS_BOX_DECORATION_BREAK) $(ENABLE_CSS_DEVICE_ADAPTATION) $(ENABLE_CSS_EXCLUSIONS) $(ENABLE_CSS_FILTERS) $(ENABLE_CSS_HIERARCHIES) $(ENABLE_CSS_IMAGE_ORIENTATION) $(ENABLE_CSS_IMAGE_RESOLUTION) $(ENABLE_CSS_REGIONS) $(ENABLE_CSS_SHADERS) $(ENABLE_CSS_COMPOSITING) $(ENABLE_CSS_STICKY_POSITION) $(ENABLE_CSS_VARIABLES) $(ENABLE_CSS3_CONDITIONAL_RULES) $(ENABLE_CSS3_TEXT) $(ENABLE_CUSTOM_SCHEME_HANDLER) $(ENABLE_DASHBOARD_SUPPORT) $(ENABLE_DATALIST_ELEMENT) $(ENABLE_DATA_TRANSFER_ITEMS) $(ENABLE_DETAILS_ELEMENT) $(ENABLE_DEVICE_ORIENTATION) $(ENABLE_DIALOG_ELEMENT) $(ENABLE_DIRECTORY_UPLOAD) $(ENABLE_DRAGGABLE_REGION) $(ENABLE_ENCRYPTED_MEDIA) $(ENABLE_FILE_SYSTEM) $(ENABLE_FILTERS) $(ENABLE_FULLSCREEN_API) $(ENABLE_GAMEPAD) $(ENABLE_GEOLOCATION) $(ENABLE_HIDDEN_PAGE_DOM_TIMER_THROTTLING) $(ENABLE_HIGH_DPI_CANVAS) $(ENABLE_ICONDATABASE) $(ENABLE_IFRAME_SEAMLESS) $(ENABLE_INDEXED_DATABASE) $(ENABLE_INPUT_SPEECH) $(ENABLE_INPUT_TYPE_COLOR) $(ENABLE_INPUT_TYPE_DATE) $(ENABLE_INPUT_TYPE_DATETIME) $(ENABLE_INPUT_TYPE_DATETIMELOCAL) $(ENABLE_INPUT_TYPE_MONTH) $(ENABLE_INPUT_TYPE_TIME) $(ENABLE_INPUT_TYPE_WEEK) $(ENABLE_JAVASCRIPT_DEBUGGER) $(ENABLE_LEGACY_CSS_VENDOR_PREFIXES) $(ENABLE_LEGACY_NOTIFICATIONS) $(ENABLE_LEGACY_VENDOR_PREFIXES) $(ENABLE_LEGACY_WEB_AUDIO) $(ENABLE_LINK_PREFETCH) $(ENABLE_LINK_PRERENDER) $(ENABLE_MATHML) $(ENABLE_MEDIA_SOURCE) $(ENABLE_MEDIA_STATISTICS) $(ENABLE_METER_ELEMENT) $(ENABLE_MHTML) $(ENABLE_MICRODATA) $(ENABLE_MUTATION_OBSERVERS) $(ENABLE_NAVIGATOR_CONTENT_UTILS) $(ENABLE_NOTIFICATIONS) $(ENABLE_PAGE_VISIBILITY_API) $(ENABLE_PDFKIT_PLUGIN) $(ENABLE_PROGRESS_ELEMENT) $(ENABLE_QUOTA) $(ENABLE_REQUEST_ANIMATION_FRAME) $(ENABLE_RESOLUTION_MEDIA_QUERY) $(ENABLE_SCRIPTED_SPEECH) $(ENABLE_SHADOW_DOM) $(ENABLE_SHARED_WORKERS) $(ENABLE_SQL_DATABASE) $(ENABLE_STYLE_SCOPED) $(ENABLE_SUBPIXEL_LAYOUT) $(ENABLE_SVG) $(ENABLE_SVG_DOM_OBJC_BINDINGS) $(ENABLE_SVG_FONTS) $(ENABLE_TEXT_AUTOSIZING) $(ENABLE_TEXT_NOTIFICATIONS_ONLY) $(ENABLE_TOUCH_ICON_LOADING) $(ENABLE_USERSELECT_ALL) $(ENABLE_VIDEO) $(ENABLE_VIDEO_TRACK) $(ENABLE_WEBGL) $(ENABLE_WEB_AUDIO) $(ENABLE_WEB_SOCKETS) $(ENABLE_WEB_TIMING) $(ENABLE_WORKERS) $(ENABLE_XHR_TIMEOUT) $(ENABLE_XSLT);
diff --git a/Source/WebKit2/Configurations/Version.xcconfig b/Source/WebKit2/Configurations/Version.xcconfig
index 92bebd83a..c2328d04b 100644
--- a/Source/WebKit2/Configurations/Version.xcconfig
+++ b/Source/WebKit2/Configurations/Version.xcconfig
@@ -22,7 +22,7 @@
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 
 MAJOR_VERSION = 537;
-MINOR_VERSION = 16;
+MINOR_VERSION = 18;
 TINY_VERSION = 0;
 FULL_VERSION = $(MAJOR_VERSION).$(MINOR_VERSION);
 
@@ -32,8 +32,6 @@ SHORT_VERSION_STRING = $(SHORT_VERSION_STRING_$(CONFIGURATION))
 
 // The system version prefix is based on the current system version.
 SYSTEM_VERSION_PREFIX = $(SYSTEM_VERSION_PREFIX_$(TARGET_MAC_OS_X_VERSION_MAJOR));
-SYSTEM_VERSION_PREFIX_1050 = 5;
-SYSTEM_VERSION_PREFIX_1060 = 6;
 SYSTEM_VERSION_PREFIX_1070 = 7;
 SYSTEM_VERSION_PREFIX_1080 = 8;
 SYSTEM_VERSION_PREFIX_1090 = 9;
diff --git a/Source/WebKit2/Configurations/WebKit2.xcconfig b/Source/WebKit2/Configurations/WebKit2.xcconfig
index 752b3c5b7..3e4588c62 100644
--- a/Source/WebKit2/Configurations/WebKit2.xcconfig
+++ b/Source/WebKit2/Configurations/WebKit2.xcconfig
@@ -31,8 +31,5 @@ DYLIB_INSTALL_NAME_BASE = $(NORMAL_WEBKIT2_FRAMEWORKS_DIR);
 
 FRAMEWORK_AND_LIBRARY_LDFLAGS = -framework ApplicationServices -framework Carbon -framework Cocoa -framework CoreServices -framework IOKit -framework JavaScriptCore -licucore -framework QuartzCore -framework Security -framework WebCore;
 
-OTHER_LDFLAGS = $(OTHER_LDFLAGS_$(REAL_PLATFORM_NAME)) $(OTHER_LDFLAGS);
-OTHER_LDFLAGS_macosx = $(OTHER_LDFLAGS_macosx_$(TARGET_MAC_OS_X_VERSION_MAJOR)) $(FRAMEWORK_AND_LIBRARY_LDFLAGS);
-OTHER_LDFLAGS_macosx_1070 = -Xlinker -objc_gc_compaction;
-OTHER_LDFLAGS_macosx_1080 = $(OTHER_LDFLAGS_macosx_1070);
-OTHER_LDFLAGS_macosx_1090 = $(OTHER_LDFLAGS_macosx_1070);
+OTHER_LDFLAGS = $(OTHER_LDFLAGS_$(PLATFORM_NAME)) $(OTHER_LDFLAGS);
+OTHER_LDFLAGS_macosx = $(FRAMEWORK_AND_LIBRARY_LDFLAGS);
diff --git a/Source/WebKit2/DerivedSources.make b/Source/WebKit2/DerivedSources.make
index 35976969c..03d7269d7 100644
--- a/Source/WebKit2/DerivedSources.make
+++ b/Source/WebKit2/DerivedSources.make
@@ -36,6 +36,7 @@ VPATH = \
     $(WebKit2)/WebProcess/IconDatabase \
     $(WebKit2)/WebProcess/KeyValueStorage \
     $(WebKit2)/WebProcess/MediaCache \
+    $(WebKit2)/WebProcess/Network \
     $(WebKit2)/WebProcess/Notifications \
     $(WebKit2)/WebProcess/Plugins \
     $(WebKit2)/WebProcess/ResourceCache \
@@ -57,6 +58,7 @@ MESSAGE_RECEIVERS = \
     DownloadProxy \
     EventDispatcher \
     NetworkProcess \
+    NetworkProcessConnection \
     NetworkProcessProxy \
     NPObjectMessageReceiver \
     PluginControllerProxy \
@@ -129,12 +131,7 @@ ifeq ($(OS),MACOS)
 
 FRAMEWORK_FLAGS = $(shell echo $(BUILT_PRODUCTS_DIR) $(FRAMEWORK_SEARCH_PATHS) | perl -e 'print "-F " . join(" -F ", split(" ", <>));')
 HEADER_FLAGS = $(shell echo $(BUILT_PRODUCTS_DIR) $(HEADER_SEARCH_PATHS) | perl -e 'print "-I" . join(" -I", split(" ", <>));')
-
-ifeq ($(TARGET_GCC_VERSION),LLVM_COMPILER)
-	TEXT_PREPROCESSOR_FLAGS=-E -P -x c -traditional -w
-else
-	TEXT_PREPROCESSOR_FLAGS=-E -P -x c -std=c89
-endif
+TEXT_PREPROCESSOR_FLAGS=-E -P -x c -traditional -w
 
 ifneq ($(SDKROOT),)
 	SDK_FLAGS=-isysroot $(SDKROOT)
diff --git a/Source/WebKit2/GNUmakefile.am b/Source/WebKit2/GNUmakefile.am
index f956d0edd..0bbfeae8e 100644
--- a/Source/WebKit2/GNUmakefile.am
+++ b/Source/WebKit2/GNUmakefile.am
@@ -175,6 +175,7 @@ libwebkit2gtk_@WEBKITGTK_API_MAJOR_VERSION@_@WEBKITGTK_API_MINOR_VERSION@_la_LIB
 	$(GTK_LIBS) \
 	$(GTK_UNIX_PRINTING_LIBS) \
 	$(JPEG_LIBS) \
+	$(LIBSECRET_LIBS) \
 	$(LIBSOUP_LIBS) \
 	$(LIBXML_LIBS) \
 	$(LIBXSLT_LIBS) \
@@ -203,6 +204,55 @@ if ENABLE_WEBKIT2
 pkgconfig_DATA += Source/WebKit2/webkit2gtk-@WEBKITGTK_API_VERSION@.pc
 endif
 
+if ENABLE_INTROSPECTION
+
+WebKit2-@WEBKITGTK_API_VERSION@.gir: $(G_IR_SCANNER) libwebkit2gtk-@WEBKITGTK_API_MAJOR_VERSION@.@WEBKITGTK_API_MINOR_VERSION@.la
+	$(AM_V_GEN)$(G_IR_SCANNER) -v --warn-all \
+	     --symbol-prefix=webkit \
+	     --identifier-prefix=WebKit \
+	     --namespace=WebKit2 \
+	     --nsversion=@WEBKITGTK_API_VERSION@ \
+	     --include=GObject-2.0 \
+	     --include=Gtk-3.0 \
+	     --include=Soup-2.4 \
+	     --library=webkit2gtk-@WEBKITGTK_API_VERSION@ \
+	     --library=javascriptcoregtk-@WEBKITGTK_API_VERSION@ \
+	     --libtool="$(LIBTOOL)" \
+	     --pkg=gobject-2.0 \
+	     --pkg=gtk+-@GTK_API_VERSION@ \
+	     --pkg=libsoup-2.4 \
+	     --pkg-export=webkit2gtk-@WEBKITGTK_API_VERSION@ \
+	     --output=$@ \
+	     --add-include-path=$(WebKit2) \
+	     --add-include-path=$(top_builddir) \
+	     --c-include="webkit2/webkit2.h" \
+	     -I$(srcdir)/Source \
+	     -I$(WebKit2) \
+	     -I$(GENSOURCES) \
+	     -I$(GENSOURCES_WEBKIT2) \
+	     -I$(top_builddir)/Source/WebKit2/UIProcess/API/gtk \
+	     -I$(top_srcdir)/Source/JavaScriptCore/ForwardingHeaders \
+	     -I$(top_srcdir) \
+	     -I$(GENSOURCES_WEBKIT2)/webkit2gtk/include \
+	     -I$(GENSOURCES_WEBKIT2)/webkit2gtk \
+	     -DWEBKIT2_COMPILATION \
+	     $(GENSOURCES_WEBKIT2)/webkit2gtk/webkit2/WebKitEnumTypes.h \
+	     $(webkit2gtk_h_api) \
+	     $(WebKit2)/UIProcess/API/gtk/*.cpp
+
+gir2dir = $(datadir)/gir-1.0
+gir2_DATA = WebKit2-@WEBKITGTK_API_VERSION@.gir
+
+typelibs2dir = $(libdir)/girepository-1.0
+typelibs2_DATA = WebKit2-@WEBKITGTK_API_VERSION@.typelib
+
+WebKit2-@WEBKITGTK_API_VERSION@.typelib: WebKit2-@WEBKITGTK_API_VERSION@.gir $(G_IR_COMPILER)
+	$(AM_V_GEN)$(G_IR_COMPILER) --includedir $(WebKit2) --includedir $(top_builddir) $< -o $@
+
+CLEANFILES += WebKit2-@WEBKITGTK_API_VERSION@.gir WebKit2-@WEBKITGTK_API_VERSION@.typelib
+
+endif
+
 # WebKit2 specific variables
 forwarding_headers := $(GENSOURCES_WEBKIT2)/include
 generate-webkit2-forwarding-headers: $(WebKit2)/Scripts/generate-forwarding-headers.pl $(libWebKit2_la_SOURCES)
@@ -409,6 +459,7 @@ libWebCoreGtk2_la_CPPFLAGS = \
 	$(GLIB_CFLAGS) \
 	$(GSTREAMER_CFLAGS) \
 	$(GTK2_CFLAGS) \
+	$(LIBSECRET_CFLAGS) \
 	$(LIBSOUP_CFLAGS) \
 	$(LIBXML_CFLAGS) \
 	$(LIBXSLT_CFLAGS) \
diff --git a/Source/WebKit2/GNUmakefile.list.am b/Source/WebKit2/GNUmakefile.list.am
index 416cf26c5..9d47b768d 100644
--- a/Source/WebKit2/GNUmakefile.list.am
+++ b/Source/WebKit2/GNUmakefile.list.am
@@ -965,8 +965,6 @@ webkit2_sources += \
 	Source/WebKit2/WebProcess/Geolocation/GeolocationPermissionRequestManager.h \
 	Source/WebKit2/WebProcess/Geolocation/WebGeolocationManager.cpp \
 	Source/WebKit2/WebProcess/Geolocation/WebGeolocationManager.h \
-	Source/WebKit2/WebProcess/gtk/WebAuthDialog.cpp \
-	Source/WebKit2/WebProcess/gtk/WebAuthDialog.h \
 	Source/WebKit2/WebProcess/gtk/WebProcessMainGtk.cpp \
 	Source/WebKit2/WebProcess/gtk/WebProcessMainGtk.h \
 	Source/WebKit2/WebProcess/IconDatabase/WebIconDatabaseProxy.cpp \
@@ -1106,6 +1104,7 @@ webkit2_sources += \
 	Source/WebKit2/WebProcess/WebCoreSupport/gtk/WebDragClientGtk.cpp \
 	Source/WebKit2/WebProcess/WebCoreSupport/gtk/WebEditorClientGtk.cpp \
 	Source/WebKit2/WebProcess/WebCoreSupport/gtk/WebErrorsGtk.cpp \
+	Source/WebKit2/WebProcess/WebCoreSupport/gtk/WebFrameLoaderClientGtk.cpp \
 	Source/WebKit2/WebProcess/WebCoreSupport/gtk/WebPopupMenuGtk.cpp \
 	Source/WebKit2/WebProcess/WebCoreSupport/soup/WebFrameNetworkingContext.cpp \
 	Source/WebKit2/WebProcess/WebCoreSupport/soup/WebFrameNetworkingContext.h \
diff --git a/Source/WebKit2/NetworkProcess/HostRecord.cpp b/Source/WebKit2/NetworkProcess/HostRecord.cpp
new file mode 100644
index 000000000..32ba59638
--- /dev/null
+++ b/Source/WebKit2/NetworkProcess/HostRecord.cpp
@@ -0,0 +1,107 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "HostRecord.h"
+
+#include "Logging.h"
+#include "NetworkConnectionToWebProcess.h"
+#include "NetworkProcess.h"
+#include "NetworkRequest.h"
+#include "NetworkResourceLoadScheduler.h"
+
+#if ENABLE(NETWORK_PROCESS)
+
+using namespace WebCore;
+
+namespace WebKit {
+
+HostRecord::HostRecord(const String& name, int maxRequestsInFlight)
+    : m_name(name)
+    , m_maxRequestsInFlight(maxRequestsInFlight)
+{
+}
+
+HostRecord::~HostRecord()
+{
+#ifndef NDEBUG
+    ASSERT(m_requestsLoading.isEmpty());
+    for (unsigned p = 0; p <= ResourceLoadPriorityHighest; p++)
+        ASSERT(m_requestsPending[p].isEmpty());
+#endif
+}
+
+void HostRecord::schedule(PassRefPtr<NetworkRequest> record,  ResourceLoadPriority priority)
+{
+    m_requestsPending[priority].append(record);
+}
+
+void HostRecord::addLoadInProgress(ResourceLoadIdentifier identifier)
+{
+    m_requestsLoading.add(identifier);
+}
+
+void HostRecord::remove(ResourceLoadIdentifier identifier)
+{
+    if (m_requestsLoading.contains(identifier)) {
+        m_requestsLoading.remove(identifier);
+        return;
+    }
+    
+    for (int priority = ResourceLoadPriorityHighest; priority >= ResourceLoadPriorityLowest; --priority) {  
+        RequestQueue::iterator end = m_requestsPending[priority].end();
+        for (RequestQueue::iterator it = m_requestsPending[priority].begin(); it != end; ++it) {
+            if (it->get()->identifier() == identifier) {
+                m_requestsPending[priority].remove(it);
+                return;
+            }
+        }
+    }
+}
+
+bool HostRecord::hasRequests() const
+{
+    if (!m_requestsLoading.isEmpty())
+        return true;
+
+    for (unsigned p = 0; p <= ResourceLoadPriorityHighest; p++) {
+        if (!m_requestsPending[p].isEmpty())
+            return true;
+    }
+
+    return false;
+}
+
+bool HostRecord::limitRequests(ResourceLoadPriority priority, bool serialLoadingEnabled) const
+{
+    if (priority == ResourceLoadPriorityVeryLow && !m_requestsLoading.isEmpty())
+        return true;
+
+    return m_requestsLoading.size() >= (serialLoadingEnabled ? 1 : m_maxRequestsInFlight);
+}
+
+} // namespace WebKit
+
+#endif // ENABLE(NETWORK_PROCESS)
diff --git a/Source/WebKit2/NetworkProcess/HostRecord.h b/Source/WebKit2/NetworkProcess/HostRecord.h
new file mode 100644
index 000000000..bed5df522
--- /dev/null
+++ b/Source/WebKit2/NetworkProcess/HostRecord.h
@@ -0,0 +1,70 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef HostRecord_h
+#define HostRecord_h
+
+#if ENABLE(NETWORK_PROCESS)
+
+#include <WebCore/ResourceRequest.h>
+#include <wtf/Deque.h>
+#include <wtf/HashSet.h>
+#include <wtf/text/WTFString.h>
+
+namespace WebKit {
+
+class NetworkRequest;
+typedef uint64_t ResourceLoadIdentifier;
+
+class HostRecord {
+    WTF_MAKE_NONCOPYABLE(HostRecord); WTF_MAKE_FAST_ALLOCATED;
+public:
+    HostRecord(const String& name, int maxRequestsInFlight);
+    ~HostRecord();
+    
+    const String& name() const { return m_name; }
+    void schedule(PassRefPtr<NetworkRequest>,  WebCore::ResourceLoadPriority = WebCore::ResourceLoadPriorityVeryLow);
+    void addLoadInProgress(ResourceLoadIdentifier);
+    void remove(ResourceLoadIdentifier);
+    bool hasRequests() const;
+    bool limitRequests(WebCore::ResourceLoadPriority, bool serialLoadingEnabled) const;
+
+    typedef Deque<RefPtr<NetworkRequest> > RequestQueue;
+    RequestQueue& requestsPending(WebCore::ResourceLoadPriority priority) { return m_requestsPending[priority]; }
+
+private:                    
+    RequestQueue m_requestsPending[WebCore::ResourceLoadPriorityHighest + 1];
+    typedef HashSet<ResourceLoadIdentifier> RequestIdentifierMap;
+    RequestIdentifierMap m_requestsLoading;
+
+    const String m_name;
+    int m_maxRequestsInFlight;
+};
+
+} // namespace WebKit
+
+#endif // ENABLE(NETWORK_PROCESS)
+
+#endif // #ifndef HostRecord_h
diff --git a/Source/WebKit2/NetworkProcess/NetworkConnectionToWebProcess.cpp b/Source/WebKit2/NetworkProcess/NetworkConnectionToWebProcess.cpp
index 1fdce180b..f9bd5af55 100644
--- a/Source/WebKit2/NetworkProcess/NetworkConnectionToWebProcess.cpp
+++ b/Source/WebKit2/NetworkProcess/NetworkConnectionToWebProcess.cpp
@@ -28,6 +28,7 @@
 
 #include "ConnectionStack.h"
 #include "NetworkProcess.h"
+#include <WebCore/ResourceRequest.h>
 #include <WebCore/RunLoop.h>
 
 #if ENABLE(NETWORK_PROCESS)
@@ -42,6 +43,7 @@ PassRefPtr<NetworkConnectionToWebProcess> NetworkConnectionToWebProcess::create(
 }
 
 NetworkConnectionToWebProcess::NetworkConnectionToWebProcess(CoreIPC::Connection::Identifier connectionIdentifier)
+    : m_serialLoadingEnabled(false)
 {
     m_connection = CoreIPC::Connection::createServerConnection(connectionIdentifier, this, RunLoop::main());
     m_connection->setOnlySendMessagesAsDispatchWhenWaitingForSyncReplyWhenProcessingSuchAMessage(true);
@@ -51,22 +53,36 @@ NetworkConnectionToWebProcess::NetworkConnectionToWebProcess(CoreIPC::Connection
 NetworkConnectionToWebProcess::~NetworkConnectionToWebProcess()
 {
     ASSERT(!m_connection);
+    ASSERT(m_observers.isEmpty());
 }
 
-void NetworkConnectionToWebProcess::didReceiveMessage(CoreIPC::Connection* connection, CoreIPC::MessageID messageID, CoreIPC::MessageDecoder& decoder)
+void NetworkConnectionToWebProcess::registerObserver(NetworkConnectionToWebProcessObserver* observer)
 {
-    ConnectionStack::CurrentConnectionPusher currentConnection(ConnectionStack::shared(), connection);
+    ASSERT(!m_observers.contains(observer));
+    m_observers.add(observer);
+}
 
+void NetworkConnectionToWebProcess::unregisterObserver(NetworkConnectionToWebProcessObserver* observer)
+{
+    ASSERT(m_observers.contains(observer));
+    m_observers.remove(observer);
+}
+    
+void NetworkConnectionToWebProcess::didReceiveMessage(CoreIPC::Connection* connection, CoreIPC::MessageID messageID, CoreIPC::MessageDecoder& decoder)
+{
     if (messageID.is<CoreIPC::MessageClassNetworkConnectionToWebProcess>()) {
         didReceiveNetworkConnectionToWebProcessMessage(connection, messageID, decoder);
         return;
     }
-
     ASSERT_NOT_REACHED();
 }
 
-void NetworkConnectionToWebProcess::didReceiveSyncMessage(CoreIPC::Connection* connection, CoreIPC::MessageID messageID, CoreIPC::MessageDecoder& arguments, OwnPtr<CoreIPC::MessageEncoder>& reply)
+void NetworkConnectionToWebProcess::didReceiveSyncMessage(CoreIPC::Connection* connection, CoreIPC::MessageID messageID, CoreIPC::MessageDecoder& decoder, OwnPtr<CoreIPC::MessageEncoder>& reply)
 {
+    if (messageID.is<CoreIPC::MessageClassNetworkConnectionToWebProcess>()) {
+        didReceiveSyncNetworkConnectionToWebProcessMessage(connection, messageID, decoder, reply);
+        return;
+    }
     ASSERT_NOT_REACHED();
 }
 
@@ -77,16 +93,59 @@ void NetworkConnectionToWebProcess::didClose(CoreIPC::Connection*)
     
     NetworkProcess::shared().removeNetworkConnectionToWebProcess(this);
     
+    Vector<NetworkConnectionToWebProcessObserver*> observers;
+    copyToVector(m_observers, observers);
+    for (size_t i = 0; i < observers.size(); ++i)
+        observers[i]->connectionToWebProcessDidClose(this);
+    
+    // FIXME (NetworkProcess): We might consider actively clearing out all requests for this connection.
+    // But that might not be necessary as the observer mechanism used above is much more direct.
+    
     m_connection = 0;
 }
 
-void NetworkConnectionToWebProcess::didReceiveInvalidMessage(CoreIPC::Connection*, CoreIPC::MessageID)
+void NetworkConnectionToWebProcess::didReceiveInvalidMessage(CoreIPC::Connection*, CoreIPC::StringReference, CoreIPC::StringReference)
+{
+}
+
+void NetworkConnectionToWebProcess::scheduleNetworkRequest(const ResourceRequest& request, uint32_t resourceLoadPriority, ResourceLoadIdentifier& resourceLoadIdentifier)
+{
+    resourceLoadIdentifier = NetworkProcess::shared().networkResourceLoadScheduler().scheduleNetworkRequest(request, static_cast<ResourceLoadPriority>(resourceLoadPriority), this);
+}
+
+void NetworkConnectionToWebProcess::addLoadInProgress(const WebCore::KURL& url, ResourceLoadIdentifier& identifier)
+{
+    identifier = NetworkProcess::shared().networkResourceLoadScheduler().addLoadInProgress(url);
+}
+
+void NetworkConnectionToWebProcess::removeLoadIdentifier(ResourceLoadIdentifier identifier)
+{
+    NetworkProcess::shared().networkResourceLoadScheduler().removeLoadIdentifier(identifier);
+}
+
+void NetworkConnectionToWebProcess::crossOriginRedirectReceived(ResourceLoadIdentifier identifier, const KURL& redirectURL)
+{
+    NetworkProcess::shared().networkResourceLoadScheduler().crossOriginRedirectReceived(identifier, redirectURL);
+}
+
+void NetworkConnectionToWebProcess::servePendingRequests(uint32_t resourceLoadPriority)
+{
+    NetworkProcess::shared().networkResourceLoadScheduler().servePendingRequests(static_cast<ResourceLoadPriority>(resourceLoadPriority));
+}
+
+void NetworkConnectionToWebProcess::suspendPendingRequests()
+{
+    NetworkProcess::shared().networkResourceLoadScheduler().suspendPendingRequests();
+}
+
+void NetworkConnectionToWebProcess::resumePendingRequests()
 {
+    NetworkProcess::shared().networkResourceLoadScheduler().resumePendingRequests();
 }
 
-void NetworkConnectionToWebProcess::didReceiveNetworkConnectionToWebProcessMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::MessageDecoder&)
+void NetworkConnectionToWebProcess::setSerialLoadingEnabled(bool enabled)
 {
-    // Empty for now - There are no messages to handle.
+    m_serialLoadingEnabled = enabled;
 }
 
 } // namespace WebKit
diff --git a/Source/WebKit2/NetworkProcess/NetworkConnectionToWebProcess.h b/Source/WebKit2/NetworkProcess/NetworkConnectionToWebProcess.h
index 635136094..23ee9846e 100644
--- a/Source/WebKit2/NetworkProcess/NetworkConnectionToWebProcess.h
+++ b/Source/WebKit2/NetworkProcess/NetworkConnectionToWebProcess.h
@@ -30,17 +30,36 @@
 
 #include "Connection.h"
 #include "NetworkConnectionToWebProcessMessages.h"
+#include <WebCore/ResourceLoadPriority.h>
 #include <wtf/HashSet.h>
 #include <wtf/RefCounted.h>
 
+namespace WebCore {
+class ResourceRequest;
+}
+
 namespace WebKit {
 
+class NetworkConnectionToWebProcess;
+typedef uint64_t ResourceLoadIdentifier;
+
+class NetworkConnectionToWebProcessObserver {
+public:
+    virtual ~NetworkConnectionToWebProcessObserver() { }
+    virtual void connectionToWebProcessDidClose(NetworkConnectionToWebProcess*) = 0;
+};
+
 class NetworkConnectionToWebProcess : public RefCounted<NetworkConnectionToWebProcess>, CoreIPC::Connection::Client {
 public:
     static PassRefPtr<NetworkConnectionToWebProcess> create(CoreIPC::Connection::Identifier);
     virtual ~NetworkConnectionToWebProcess();
 
     CoreIPC::Connection* connection() const { return m_connection.get(); }
+    
+    void registerObserver(NetworkConnectionToWebProcessObserver*);
+    void unregisterObserver(NetworkConnectionToWebProcessObserver*);
+
+    bool isSerialLoadingEnabled() const { return m_serialLoadingEnabled; }
 
 private:
     NetworkConnectionToWebProcess(CoreIPC::Connection::Identifier);
@@ -49,12 +68,26 @@ private:
     virtual void didReceiveMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::MessageDecoder&);
     virtual void didReceiveSyncMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::MessageDecoder&, OwnPtr<CoreIPC::MessageEncoder>&);
     virtual void didClose(CoreIPC::Connection*);
-    virtual void didReceiveInvalidMessage(CoreIPC::Connection*, CoreIPC::MessageID);
+    virtual void didReceiveInvalidMessage(CoreIPC::Connection*, CoreIPC::StringReference messageReceiverName, CoreIPC::StringReference messageName);
 
     // Message handlers.
     void didReceiveNetworkConnectionToWebProcessMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::MessageDecoder&);
-
+    void didReceiveSyncNetworkConnectionToWebProcessMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::MessageDecoder&, OwnPtr<CoreIPC::MessageEncoder>&);
+    
+    void scheduleNetworkRequest(const WebCore::ResourceRequest&, uint32_t resourceLoadPriority, ResourceLoadIdentifier&);
+    void addLoadInProgress(const WebCore::KURL&, ResourceLoadIdentifier&);
+    void removeLoadIdentifier(ResourceLoadIdentifier);
+    void crossOriginRedirectReceived(ResourceLoadIdentifier, const WebCore::KURL& redirectURL);
+    void servePendingRequests(uint32_t resourceLoadPriority);
+    void suspendPendingRequests();
+    void resumePendingRequests();
+    void setSerialLoadingEnabled(bool);
+    
     RefPtr<CoreIPC::Connection> m_connection;
+    
+    HashSet<NetworkConnectionToWebProcessObserver*> m_observers;
+    
+    bool m_serialLoadingEnabled;
 };
 
 } // namespace WebKit
diff --git a/Source/WebKit2/NetworkProcess/NetworkConnectionToWebProcess.messages.in b/Source/WebKit2/NetworkProcess/NetworkConnectionToWebProcess.messages.in
index a1047c83a..df785a1b6 100644
--- a/Source/WebKit2/NetworkProcess/NetworkConnectionToWebProcess.messages.in
+++ b/Source/WebKit2/NetworkProcess/NetworkConnectionToWebProcess.messages.in
@@ -24,6 +24,24 @@
 
 messages -> NetworkConnectionToWebProcess {
 
+    // FIXME (NetworkProcess): At least some of these synchronous messages are synchronous due to the requirement
+    // that we synchronously get an identifier for new ResourceLoaders as they are created.
+    // There's possible ResourceLoader identifier refactoring that can remove that requirement.
+    // We might also have the NetworkProcess divvy up identifiers in blocks to each WebProcess beforehand.
+    ScheduleNetworkRequest(WebCore::ResourceRequest request, uint32_t resourceLoadPriority) -> (uint64_t resourceLoadIdentifier)
+    AddLoadInProgress(WebCore::KURL url) -> (uint64_t resourceLoadIdentifier)
+    RemoveLoadIdentifier(uint64_t resourceLoadIdentifier)
+
+    // It's possible that we will be able to do away with this message and have the NetworkProcess
+    // manage it internally.
+    crossOriginRedirectReceived(uint64_t resourceLoadIdentifier, WebCore::KURL redirectURL) -> ()
+    
+    ServePendingRequests(uint32_t resourceLoadPriority)
+
+    SuspendPendingRequests() -> ()
+    ResumePendingRequests() -> ()
+    
+    SetSerialLoadingEnabled(bool enabled) -> ()
 }
 
 #endif // ENABLE(NETWORK_PROCESS)
diff --git a/Source/WebKit2/NetworkProcess/NetworkProcess.cpp b/Source/WebKit2/NetworkProcess/NetworkProcess.cpp
index 5be2e9b21..634333559 100644
--- a/Source/WebKit2/NetworkProcess/NetworkProcess.cpp
+++ b/Source/WebKit2/NetworkProcess/NetworkProcess.cpp
@@ -87,7 +87,7 @@ void NetworkProcess::didClose(CoreIPC::Connection*)
     RunLoop::current()->stop();
 }
 
-void NetworkProcess::didReceiveInvalidMessage(CoreIPC::Connection*, CoreIPC::MessageID)
+void NetworkProcess::didReceiveInvalidMessage(CoreIPC::Connection*, CoreIPC::StringReference, CoreIPC::StringReference)
 {
     RunLoop::current()->stop();
 }
diff --git a/Source/WebKit2/NetworkProcess/NetworkProcess.h b/Source/WebKit2/NetworkProcess/NetworkProcess.h
index 5828e1f5e..66a1185e9 100644
--- a/Source/WebKit2/NetworkProcess/NetworkProcess.h
+++ b/Source/WebKit2/NetworkProcess/NetworkProcess.h
@@ -29,6 +29,7 @@
 #if ENABLE(NETWORK_PROCESS)
 
 #include "ChildProcess.h"
+#include "NetworkResourceLoadScheduler.h"
 #include <wtf/Forward.h>
 
 namespace WebCore {
@@ -49,6 +50,8 @@ public:
 
     void removeNetworkConnectionToWebProcess(NetworkConnectionToWebProcess*);
 
+    NetworkResourceLoadScheduler& networkResourceLoadScheduler() { return m_networkResourceLoadScheduler; }
+
 private:
     NetworkProcess();
     ~NetworkProcess();
@@ -61,7 +64,7 @@ private:
     // CoreIPC::Connection::Client
     virtual void didReceiveMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::MessageDecoder&);
     virtual void didClose(CoreIPC::Connection*);
-    virtual void didReceiveInvalidMessage(CoreIPC::Connection*, CoreIPC::MessageID);
+    virtual void didReceiveInvalidMessage(CoreIPC::Connection*, CoreIPC::StringReference messageReceiverName, CoreIPC::StringReference messageName);
     virtual void syncMessageSendTimedOut(CoreIPC::Connection*);
 
     // Message Handlers
@@ -75,6 +78,7 @@ private:
     // Connections to WebProcesses.
     Vector<RefPtr<NetworkConnectionToWebProcess> > m_webProcessConnections;
 
+    NetworkResourceLoadScheduler m_networkResourceLoadScheduler;
 };
 
 } // namespace WebKit
diff --git a/Source/WebKit2/NetworkProcess/NetworkProcess.messages.in b/Source/WebKit2/NetworkProcess/NetworkProcess.messages.in
index 029536a34..d243bd44f 100644
--- a/Source/WebKit2/NetworkProcess/NetworkProcess.messages.in
+++ b/Source/WebKit2/NetworkProcess/NetworkProcess.messages.in
@@ -28,6 +28,10 @@ messages -> NetworkProcess {
 
     # Creates a connection for communication with a WebProcess
     CreateNetworkConnectionToWebProcess()
+
+#if PLATFORM(MAC)
+    SetApplicationIsOccluded(bool flag)
+#endif
 }
 
 #endif // ENABLE(NETWORK_PROCESS)
diff --git a/Source/WebKit2/NetworkProcess/NetworkRequest.cpp b/Source/WebKit2/NetworkProcess/NetworkRequest.cpp
new file mode 100644
index 000000000..79e74cf19
--- /dev/null
+++ b/Source/WebKit2/NetworkProcess/NetworkRequest.cpp
@@ -0,0 +1,58 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "NetworkRequest.h"
+
+#if ENABLE(NETWORK_PROCESS)
+
+#include "NetworkConnectionToWebProcess.h"
+
+namespace WebKit {
+
+NetworkRequest::NetworkRequest(const WebCore::ResourceRequest& request, ResourceLoadIdentifier identifier, NetworkConnectionToWebProcess* connection)
+    : m_request(request)
+    , m_identifier(identifier)
+    , m_connection(connection)
+{
+    connection->registerObserver(this);
+}
+
+NetworkRequest::~NetworkRequest()
+{
+    if (m_connection)
+        m_connection->unregisterObserver(this);
+}
+
+void NetworkRequest::connectionToWebProcessDidClose(NetworkConnectionToWebProcess* connection)
+{
+    ASSERT_ARG(connection, connection == m_connection.get());
+    m_connection->unregisterObserver(this);
+    m_connection = 0;
+}
+
+} // namespace WebKit
+
+#endif // ENABLE(NETWORK_PROCESS)
diff --git a/Source/WebKit2/NetworkProcess/NetworkRequest.h b/Source/WebKit2/NetworkProcess/NetworkRequest.h
new file mode 100644
index 000000000..683e832c2
--- /dev/null
+++ b/Source/WebKit2/NetworkProcess/NetworkRequest.h
@@ -0,0 +1,66 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef NetworkRequest_h
+#define NetworkRequest_h
+
+#if ENABLE(NETWORK_PROCESS)
+
+#include "NetworkConnectionToWebProcess.h"
+#include <WebCore/ResourceRequest.h>
+
+namespace WebKit {
+
+typedef uint64_t ResourceLoadIdentifier;
+
+class NetworkRequest : public RefCounted<NetworkRequest>, public NetworkConnectionToWebProcessObserver {
+public:
+    static RefPtr<NetworkRequest> create(const WebCore::ResourceRequest& request, ResourceLoadIdentifier identifier, NetworkConnectionToWebProcess* connection)
+    {
+        return adoptRef(new NetworkRequest(request, identifier, connection));
+    }
+    
+    ~NetworkRequest();
+
+    void connectionToWebProcessDidClose(NetworkConnectionToWebProcess*);
+    
+    ResourceLoadIdentifier identifier() { return m_identifier; }
+    
+    NetworkConnectionToWebProcess* connectionToWebProcess() { return m_connection.get(); }
+
+private:
+    NetworkRequest(const WebCore::ResourceRequest&, ResourceLoadIdentifier, NetworkConnectionToWebProcess*);
+
+    WebCore::ResourceRequest m_request;
+    ResourceLoadIdentifier m_identifier;
+
+    RefPtr<NetworkConnectionToWebProcess> m_connection;
+};
+
+} // namespace WebKit
+
+#endif // ENABLE(NETWORK_PROCESS)
+
+#endif // NetworkRequest_h
diff --git a/Source/WebKit2/NetworkProcess/NetworkResourceLoadScheduler.cpp b/Source/WebKit2/NetworkProcess/NetworkResourceLoadScheduler.cpp
new file mode 100644
index 000000000..ccc3d76b9
--- /dev/null
+++ b/Source/WebKit2/NetworkProcess/NetworkResourceLoadScheduler.cpp
@@ -0,0 +1,205 @@
+#include "config.h"
+#include "NetworkResourceLoadScheduler.h"
+
+#include "HostRecord.h"
+#include "Logging.h"
+#include "NetworkConnectionToWebProcess.h"
+#include "NetworkProcessconnectionMessages.h"
+#include "NetworkRequest.h"
+#include <wtf/text/CString.h>
+
+#if ENABLE(NETWORK_PROCESS)
+
+using namespace WebCore;
+
+namespace WebKit {
+
+static const unsigned maxRequestsInFlightForNonHTTPProtocols = 20;
+static unsigned maxRequestsInFlightPerHost;
+static ResourceLoadIdentifier s_currentResourceLoadIdentifier;
+
+NetworkResourceLoadScheduler::NetworkResourceLoadScheduler()
+    : m_nonHTTPProtocolHost(new HostRecord(String(), maxRequestsInFlightForNonHTTPProtocols))
+    , m_requestTimer(this, &NetworkResourceLoadScheduler::requestTimerFired)
+
+{
+    maxRequestsInFlightPerHost = platformInitializeMaximumHTTPConnectionCountPerHost();
+}
+
+void NetworkResourceLoadScheduler::scheduleServePendingRequests()
+{
+    if (!m_requestTimer.isActive())
+        m_requestTimer.startOneShot(0);
+}
+
+void NetworkResourceLoadScheduler::requestTimerFired(WebCore::Timer<NetworkResourceLoadScheduler>*)
+{
+    servePendingRequests();
+}
+
+ResourceLoadIdentifier NetworkResourceLoadScheduler::scheduleNetworkRequest(const ResourceRequest& request, ResourceLoadPriority priority, NetworkConnectionToWebProcess* connection)
+{    
+    ResourceLoadIdentifier identifier = ++s_currentResourceLoadIdentifier;
+
+    LOG(Network, "(NetworkProcess) NetworkResourceLoadScheduler::scheduleNetworkRequest resource %llu '%s'", identifier, request.url().string().utf8().data());
+
+    HostRecord* host = hostForURL(request.url(), CreateIfNotFound);
+    bool hadRequests = host->hasRequests();
+    host->schedule(NetworkRequest::create(request, identifier, connection), priority);
+    m_identifiers.add(identifier, host);
+
+    if (priority > ResourceLoadPriorityLow || !request.url().protocolIsInHTTPFamily() || (priority == ResourceLoadPriorityLow && !hadRequests)) {
+        // Try to request important resources immediately.
+        servePendingRequestsForHost(host, priority);
+        return identifier;
+    }
+    
+    // Handle asynchronously so early low priority requests don't get scheduled before later high priority ones.
+    scheduleServePendingRequests();
+    return identifier;
+}
+
+ResourceLoadIdentifier NetworkResourceLoadScheduler::addLoadInProgress(const WebCore::KURL& url)
+{
+    ResourceLoadIdentifier identifier = ++s_currentResourceLoadIdentifier;
+
+    LOG(Network, "(NetworkProcess) NetworkResourceLoadScheduler::addLoadInProgress resource %llu with url '%s'", identifier, url.string().utf8().data());
+
+    HostRecord* host = hostForURL(url, CreateIfNotFound);
+    host->addLoadInProgress(identifier);
+    m_identifiers.add(identifier, host);
+    
+    return identifier;
+}
+
+HostRecord* NetworkResourceLoadScheduler::hostForURL(const WebCore::KURL& url, CreateHostPolicy createHostPolicy)
+{
+    if (!url.protocolIsInHTTPFamily())
+        return m_nonHTTPProtocolHost;
+
+    m_hosts.checkConsistency();
+    String hostName = url.host();
+    HostRecord* host = m_hosts.get(hostName);
+    if (!host && createHostPolicy == CreateIfNotFound) {
+        host = new HostRecord(hostName, maxRequestsInFlightPerHost);
+        m_hosts.add(hostName, host);
+    }
+    
+    return host;
+}
+
+void NetworkResourceLoadScheduler::removeLoadIdentifier(ResourceLoadIdentifier identifier)
+{
+    ASSERT(identifier);
+
+    LOG(Network, "(NetworkProcess) NetworkResourceLoadScheduler::removeLoadIdentifier removing load identifier %llu", identifier);
+
+    HostRecord* host = m_identifiers.take(identifier);
+    ASSERT(host);
+    if (host)
+        host->remove(identifier);
+
+    scheduleServePendingRequests();
+}
+
+void NetworkResourceLoadScheduler::crossOriginRedirectReceived(ResourceLoadIdentifier identifier, const WebCore::KURL& redirectURL)
+{
+    LOG(Network, "(NetworkProcess) NetworkResourceLoadScheduler::crossOriginRedirectReceived resource %llu redirected to '%s'", identifier, redirectURL.string().utf8().data());
+
+    HostRecord* oldHost = m_identifiers.get(identifier);
+    HostRecord* newHost = hostForURL(redirectURL, CreateIfNotFound);
+    ASSERT(oldHost);
+    
+    if (oldHost->name() == newHost->name())
+        return;
+    
+    newHost->addLoadInProgress(identifier);
+    m_identifiers.set(identifier, newHost);
+
+    oldHost->remove(identifier);    
+}
+
+void NetworkResourceLoadScheduler::servePendingRequests(ResourceLoadPriority minimumPriority)
+{
+    if (m_suspendPendingRequestsCount)
+        return;
+
+    LOG(Network, "(NetworkProcess) NetworkResourceLoadScheduler::servePendingRequests Serving requests for up to %i hosts", m_hosts.size());
+
+    m_requestTimer.stop();
+    
+    servePendingRequestsForHost(m_nonHTTPProtocolHost, minimumPriority);
+
+    m_hosts.checkConsistency();
+    Vector<HostRecord*> hostsToServe;
+    copyValuesToVector(m_hosts, hostsToServe);
+
+    size_t size = hostsToServe.size();
+    for (size_t i = 0; i < size; ++i) {
+        HostRecord* host = hostsToServe[i];
+        if (host->hasRequests())
+            servePendingRequestsForHost(host, minimumPriority);
+        else
+            delete m_hosts.take(host->name());
+    }
+}
+
+void NetworkResourceLoadScheduler::servePendingRequestsForHost(HostRecord* host, ResourceLoadPriority minimumPriority)
+{
+    LOG(Network, "NetworkResourceLoadScheduler::servePendingRequests Host name='%s'", host->name().utf8().data());
+
+    for (int priority = ResourceLoadPriorityHighest; priority >= minimumPriority; --priority) {
+        HostRecord::RequestQueue& requestsPending = host->requestsPending(ResourceLoadPriority(priority));
+
+        while (!requestsPending.isEmpty()) {
+            RefPtr<NetworkRequest> request = requestsPending.first();
+            
+            // This request might be from WebProcess we've lost our connection to.
+            // If so we should just skip it.
+            if (!request->connectionToWebProcess()) {
+                requestsPending.removeFirst();
+                continue;
+            }
+
+            // For named hosts - which are only http(s) hosts - we should always enforce the connection limit.
+            // For non-named hosts - everything but http(s) - we should only enforce the limit if the document
+            // isn't done parsing and we don't know all stylesheets yet.
+
+            // FIXME (NetworkProcess): The above comment about document parsing and stylesheets is a holdover
+            // from the WebCore::ResourceLoadScheduler.
+            // The behavior described was at one time important for WebCore's single threadedness.
+            // It's possible that we don't care about it with the NetworkProcess.
+            // We should either decide it's not important and change the above comment, or decide it is
+            // still important and somehow account for it.
+
+            bool shouldLimitRequests = !host->name().isNull();
+            if (shouldLimitRequests && host->limitRequests(ResourceLoadPriority(priority), request->connectionToWebProcess()->isSerialLoadingEnabled()))
+                return;
+
+            requestsPending.removeFirst();
+            host->addLoadInProgress(request->identifier());
+            
+            request->connectionToWebProcess()->connection()->send(Messages::NetworkProcessConnection::StartResourceLoad(request->identifier()), 0);
+        }
+    }
+}
+
+void NetworkResourceLoadScheduler::suspendPendingRequests()
+{
+    ++m_suspendPendingRequestsCount;
+}
+
+void NetworkResourceLoadScheduler::resumePendingRequests()
+{
+    ASSERT(m_suspendPendingRequestsCount);
+    --m_suspendPendingRequestsCount;
+    if (m_suspendPendingRequestsCount)
+        return;
+
+    if (!m_hosts.isEmpty() || m_nonHTTPProtocolHost->hasRequests())
+        scheduleServePendingRequests();
+}
+
+} // namespace WebKit
+
+#endif // ENABLE(NETWORK_PROCESS)
diff --git a/Source/WebKit2/NetworkProcess/NetworkResourceLoadScheduler.h b/Source/WebKit2/NetworkProcess/NetworkResourceLoadScheduler.h
new file mode 100644
index 000000000..a16a38847
--- /dev/null
+++ b/Source/WebKit2/NetworkProcess/NetworkResourceLoadScheduler.h
@@ -0,0 +1,93 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef NetworkResourceLoadScheduler_h
+#define NetworkResourceLoadScheduler_h
+
+#include <WebCore/ResourceRequest.h>
+#include <WebCore/Timer.h>
+
+#if ENABLE(NETWORK_PROCESS)
+
+namespace WebKit {
+
+class HostRecord;
+class NetworkConnectionToWebProcess;
+typedef uint64_t ResourceLoadIdentifier;
+
+class NetworkResourceLoadScheduler {
+    WTF_MAKE_NONCOPYABLE(NetworkResourceLoadScheduler); WTF_MAKE_FAST_ALLOCATED;
+
+public:
+    NetworkResourceLoadScheduler();
+    
+    // Adds the request to the queue for its host and create a unique identifier for it.
+    ResourceLoadIdentifier scheduleNetworkRequest(const WebCore::ResourceRequest&, WebCore::ResourceLoadPriority, NetworkConnectionToWebProcess*);
+    
+    // Creates a unique identifier for an already-in-progress load.
+    ResourceLoadIdentifier addLoadInProgress(const WebCore::KURL&);
+
+    // Called by the WebProcess when a ResourceLoader is being cleaned up.
+    void removeLoadIdentifier(ResourceLoadIdentifier);
+
+    void crossOriginRedirectReceived(ResourceLoadIdentifier, const WebCore::KURL& redirectURL);
+    void servePendingRequests(WebCore::ResourceLoadPriority = WebCore::ResourceLoadPriorityVeryLow);
+    void suspendPendingRequests();
+    void resumePendingRequests();
+    
+private:
+    enum CreateHostPolicy {
+        CreateIfNotFound,
+        FindOnly
+    };
+    
+    HostRecord* hostForURL(const WebCore::KURL&, CreateHostPolicy = FindOnly);
+    
+    void scheduleServePendingRequests();
+    void requestTimerFired(WebCore::Timer<NetworkResourceLoadScheduler>*);
+
+    void servePendingRequestsForHost(HostRecord*, WebCore::ResourceLoadPriority);
+
+    unsigned platformInitializeMaximumHTTPConnectionCountPerHost();
+
+    typedef HashMap<String, HostRecord*, StringHash> HostMap;
+    HostMap m_hosts;
+
+    typedef HashMap<ResourceLoadIdentifier, HostRecord*> IdentifierHostMap;
+    IdentifierHostMap m_identifiers;
+
+    HostRecord* m_nonHTTPProtocolHost;
+
+    unsigned m_suspendPendingRequestsCount;
+    bool m_isSerialLoadingEnabled;
+
+    WebCore::Timer<NetworkResourceLoadScheduler> m_requestTimer;
+};
+
+} // namespace WebKit
+
+#endif // ENABLE(NETWORK_PROCESS)
+
+#endif // NetworkResourceLoadScheduler_h
diff --git a/Source/WebKit2/NetworkProcess/mac/NetworkProcessMainMac.mm b/Source/WebKit2/NetworkProcess/mac/NetworkProcessMainMac.mm
index 537126f66..c56f80a2a 100644
--- a/Source/WebKit2/NetworkProcess/mac/NetworkProcessMainMac.mm
+++ b/Source/WebKit2/NetworkProcess/mac/NetworkProcessMainMac.mm
@@ -33,6 +33,7 @@
 #import "NetworkProcess.h"
 #import <WebCore/RunLoop.h>
 #import <WebKitSystemInterface.h>
+#import <WebSystemInterface.h>
 #import <mach/mach_error.h>
 #import <runtime/InitializeThreading.h>
 #import <servers/bootstrap.h>
@@ -78,7 +79,7 @@ int NetworkProcessMain(const CommandLine& commandLine)
     signal(SIGSEGV, _exit);
 #endif
 
-
+    InitWebCoreSystemInterface();
     JSC::initializeThreading();
     WTF::initializeMainThread();
     RunLoop::initializeMainRunLoop();
diff --git a/Source/WebKit2/NetworkProcess/mac/NetworkResourceLoadSchedulerMac.mm b/Source/WebKit2/NetworkProcess/mac/NetworkResourceLoadSchedulerMac.mm
new file mode 100644
index 000000000..14b3657b9
--- /dev/null
+++ b/Source/WebKit2/NetworkProcess/mac/NetworkResourceLoadSchedulerMac.mm
@@ -0,0 +1,71 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#import "config.h"
+#import "NetworkResourceLoadScheduler.h"
+
+#import <WebCore/ResourceRequest.h>
+#import <WebCore/ResourceRequestCFNet.h>
+#import <WebCore/WebCoreSystemInterface.h>
+#import <WebKitSystemInterface.h>
+
+#if ENABLE(NETWORK_PROCESS)
+
+using namespace WebCore;
+
+namespace WebKit {
+
+unsigned NetworkResourceLoadScheduler::platformInitializeMaximumHTTPConnectionCountPerHost()
+{
+    wkInitializeMaximumHTTPConnectionCountPerHost = WKInitializeMaximumHTTPConnectionCountPerHost;
+    wkSetHTTPPipeliningMaximumPriority = WKSetHTTPPipeliningMaximumPriority;
+    wkSetHTTPPipeliningMinimumFastLanePriority = WKSetHTTPPipeliningMinimumFastLanePriority;
+
+    static const unsigned preferredConnectionCount = 6;
+    static const unsigned unlimitedConnectionCount = 10000;
+
+    // Always set the connection count per host, even when pipelining.
+    unsigned maximumHTTPConnectionCountPerHost = wkInitializeMaximumHTTPConnectionCountPerHost(preferredConnectionCount);
+
+    Boolean keyExistsAndHasValidFormat = false;
+    Boolean prefValue = CFPreferencesGetAppBooleanValue(CFSTR("WebKitEnableHTTPPipelining"), kCFPreferencesCurrentApplication, &keyExistsAndHasValidFormat);
+    
+    if (keyExistsAndHasValidFormat)
+        ResourceRequest::setHTTPPipeliningEnabled(prefValue);
+
+    if (ResourceRequest::httpPipeliningEnabled()) {
+        wkSetHTTPPipeliningMaximumPriority(toHTTPPipeliningPriority(ResourceLoadPriorityHighest));
+        wkSetHTTPPipeliningMinimumFastLanePriority(toHTTPPipeliningPriority(ResourceLoadPriorityMedium));
+
+        // When pipelining do not rate-limit requests sent from WebCore since CFNetwork handles that.
+        return unlimitedConnectionCount;
+    }
+
+    return maximumHTTPConnectionCountPerHost;
+}
+
+} // namespace WebKit
+
+#endif // ENABLE(NETWORK_PROCESS)
diff --git a/Source/WebKit2/NetworkProcess/mac/RemoteNetworkingContext.h b/Source/WebKit2/NetworkProcess/mac/RemoteNetworkingContext.h
new file mode 100644
index 000000000..2c1827861
--- /dev/null
+++ b/Source/WebKit2/NetworkProcess/mac/RemoteNetworkingContext.h
@@ -0,0 +1,57 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef RemoteNetworkingContext_h
+#define RemoteNetworkingContext_h
+
+#include <WebCore/NetworkingContext.h>
+
+namespace WebKit {
+
+class RemoteNetworkingContext : public WebCore::NetworkingContext {
+public:
+    static PassRefPtr<RemoteNetworkingContext> create(bool needsSiteSpecificQuirks, bool localFileContentSniffingEnabled)
+    {
+        return adoptRef(new RemoteNetworkingContext(needsSiteSpecificQuirks, localFileContentSniffingEnabled));
+    }
+    virtual ~RemoteNetworkingContext();
+
+private:
+    RemoteNetworkingContext(bool needsSiteSpecificQuirks, bool localFileContentSniffingEnabled);
+
+    virtual bool isValid() const OVERRIDE;
+
+    virtual bool needsSiteSpecificQuirks() const OVERRIDE;
+    virtual bool localFileContentSniffingEnabled() const OVERRIDE;
+    virtual NSOperationQueue *scheduledOperationQueue() const OVERRIDE;
+    virtual WebCore::ResourceError blockedError(const WebCore::ResourceRequest&) const OVERRIDE;
+
+    bool m_needsSiteSpecificQuirks;
+    bool m_localFileContentSniffingEnabled;
+};
+
+}
+
+#endif // RemoteNetworkingContext_h
diff --git a/Source/WebKit2/NetworkProcess/mac/RemoteNetworkingContext.mm b/Source/WebKit2/NetworkProcess/mac/RemoteNetworkingContext.mm
new file mode 100644
index 000000000..7b29773cf
--- /dev/null
+++ b/Source/WebKit2/NetworkProcess/mac/RemoteNetworkingContext.mm
@@ -0,0 +1,77 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#import "config.h"
+#import "RemoteNetworkingContext.h"
+
+#import "WebCore/ResourceError.h"
+#import "WebErrors.h"
+
+using namespace WebCore;
+
+namespace WebKit {
+
+RemoteNetworkingContext::RemoteNetworkingContext(bool needsSiteSpecificQuirks, bool localFileContentSniffingEnabled)
+    : m_needsSiteSpecificQuirks(needsSiteSpecificQuirks)
+    , m_localFileContentSniffingEnabled(localFileContentSniffingEnabled)
+{
+}
+
+RemoteNetworkingContext::~RemoteNetworkingContext()
+{
+}
+
+bool RemoteNetworkingContext::isValid() const
+{
+    return true;
+}
+
+bool RemoteNetworkingContext::needsSiteSpecificQuirks() const
+{
+    return m_needsSiteSpecificQuirks;
+}
+
+bool RemoteNetworkingContext::localFileContentSniffingEnabled() const
+{
+    return m_localFileContentSniffingEnabled;
+}
+
+NSOperationQueue *RemoteNetworkingContext::scheduledOperationQueue() const
+{
+    static NSOperationQueue *queue;
+    if (!queue) {
+        queue = [[NSOperationQueue alloc] init];
+        // Default concurrent operation count depends on current system workload, but delegate methods are mostly idling in IPC, so we can run as many as needed.
+        [queue setMaxConcurrentOperationCount:NSIntegerMax];
+    }
+    return queue;
+}
+
+ResourceError RemoteNetworkingContext::blockedError(const ResourceRequest& request) const
+{
+    return WebKit::blockedError(request);
+}
+
+}
diff --git a/Source/WebKit2/Platform/CoreIPC/ArgumentCoder.h b/Source/WebKit2/Platform/CoreIPC/ArgumentCoder.h
index bd15f516c..4baab9fe4 100644
--- a/Source/WebKit2/Platform/CoreIPC/ArgumentCoder.h
+++ b/Source/WebKit2/Platform/CoreIPC/ArgumentCoder.h
@@ -34,7 +34,7 @@ class ArgumentDecoder;
 class ArgumentEncoder;
     
 template<typename T> struct ArgumentCoder {
-    static void encode(ArgumentEncoder* encoder, const T& t)
+    static void encode(ArgumentEncoder& encoder, const T& t)
     {
         t.encode(encoder);
     }
diff --git a/Source/WebKit2/Platform/CoreIPC/ArgumentCoders.cpp b/Source/WebKit2/Platform/CoreIPC/ArgumentCoders.cpp
index 7153c2748..0f25af9c0 100644
--- a/Source/WebKit2/Platform/CoreIPC/ArgumentCoders.cpp
+++ b/Source/WebKit2/Platform/CoreIPC/ArgumentCoders.cpp
@@ -56,7 +56,8 @@ void ArgumentCoder<CString>::encode(ArgumentEncoder& encoder, const CString& str
     }
 
     uint32_t length = string.length();
-    encoder << length << CoreIPC::DataReference(reinterpret_cast<const uint8_t*>(string.data()), length);
+    encoder << length;
+    encoder.encodeFixedLengthData(reinterpret_cast<const uint8_t*>(string.data()), length, 1);
 }
 
 bool ArgumentCoder<CString>::decode(ArgumentDecoder* decoder, CString& result)
diff --git a/Source/WebKit2/Platform/CoreIPC/ArgumentCoders.h b/Source/WebKit2/Platform/CoreIPC/ArgumentCoders.h
index 339cd2d1e..3b184f888 100644
--- a/Source/WebKit2/Platform/CoreIPC/ArgumentCoders.h
+++ b/Source/WebKit2/Platform/CoreIPC/ArgumentCoders.h
@@ -38,9 +38,9 @@ namespace CoreIPC {
 
 // An argument coder works on POD types
 template<typename T> struct SimpleArgumentCoder {
-    static void encode(ArgumentEncoder* encoder, const T& t)
+    static void encode(ArgumentEncoder& encoder, const T& t)
     {
-        encoder->encodeFixedLengthData(reinterpret_cast<const uint8_t*>(&t), sizeof(T), __alignof(T));
+        encoder.encodeFixedLengthData(reinterpret_cast<const uint8_t*>(&t), sizeof(T), __alignof(T));
     }
 
     static bool decode(ArgumentDecoder* decoder, T& t)
@@ -50,10 +50,9 @@ template<typename T> struct SimpleArgumentCoder {
 };
 
 template<typename T, typename U> struct ArgumentCoder<std::pair<T, U> > {
-    static void encode(ArgumentEncoder* encoder, const std::pair<T, U>& pair)
+    static void encode(ArgumentEncoder& encoder, const std::pair<T, U>& pair)
     {
-        encoder->encode(pair.first);
-        encoder->encode(pair.second);
+        encoder << pair.first << pair.second;
     }
 
     static bool decode(ArgumentDecoder* decoder, std::pair<T, U>& pair)
@@ -73,10 +72,9 @@ template<typename T, typename U> struct ArgumentCoder<std::pair<T, U> > {
 };
 
 template<typename KeyType, typename ValueType> struct ArgumentCoder<WTF::KeyValuePair<KeyType, ValueType> > {
-    static void encode(ArgumentEncoder* encoder, const WTF::KeyValuePair<KeyType, ValueType>& pair)
+    static void encode(ArgumentEncoder& encoder, const WTF::KeyValuePair<KeyType, ValueType>& pair)
     {
-        encoder->encode(pair.key);
-        encoder->encode(pair.value);
+        encoder << pair.key << pair.value;
     }
 
     static bool decode(ArgumentDecoder* decoder, WTF::KeyValuePair<KeyType, ValueType>& pair)
@@ -98,11 +96,11 @@ template<typename KeyType, typename ValueType> struct ArgumentCoder<WTF::KeyValu
 template<bool fixedSizeElements, typename T> struct VectorArgumentCoder;
 
 template<typename T> struct VectorArgumentCoder<false, T> {
-    static void encode(ArgumentEncoder* encoder, const Vector<T>& vector)
+    static void encode(ArgumentEncoder& encoder, const Vector<T>& vector)
     {
-        encoder->encode(static_cast<uint64_t>(vector.size()));
+        encoder << static_cast<uint64_t>(vector.size());
         for (size_t i = 0; i < vector.size(); ++i)
-            encoder->encode(vector[i]);
+            encoder << vector[i];
     }
 
     static bool decode(ArgumentDecoder* decoder, Vector<T>& vector)
@@ -127,10 +125,10 @@ template<typename T> struct VectorArgumentCoder<false, T> {
 };
 
 template<typename T> struct VectorArgumentCoder<true, T> {
-    static void encode(ArgumentEncoder* encoder, const Vector<T>& vector)
+    static void encode(ArgumentEncoder& encoder, const Vector<T>& vector)
     {
-        encoder->encode(static_cast<uint64_t>(vector.size()));
-        encoder->encodeFixedLengthData(reinterpret_cast<const uint8_t*>(vector.data()), vector.size() * sizeof(T), __alignof(T));
+        encoder << static_cast<uint64_t>(vector.size());
+        encoder.encodeFixedLengthData(reinterpret_cast<const uint8_t*>(vector.data()), vector.size() * sizeof(T), __alignof(T));
     }
     
     static bool decode(ArgumentDecoder* decoder, Vector<T>& vector)
@@ -162,11 +160,11 @@ template<typename T> struct ArgumentCoder<Vector<T> > : VectorArgumentCoder<WTF:
 template<typename KeyArg, typename MappedArg, typename HashArg, typename KeyTraitsArg, typename MappedTraitsArg> struct ArgumentCoder<HashMap<KeyArg, MappedArg, HashArg, KeyTraitsArg, MappedTraitsArg> > {
     typedef HashMap<KeyArg, MappedArg, HashArg, KeyTraitsArg, MappedTraitsArg> HashMapType;
 
-    static void encode(ArgumentEncoder* encoder, const HashMapType& hashMap)
+    static void encode(ArgumentEncoder& encoder, const HashMapType& hashMap)
     {
-        encoder->encode(static_cast<uint64_t>(hashMap.size()));
+        encoder << static_cast<uint64_t>(hashMap.size());
         for (typename HashMapType::const_iterator it = hashMap.begin(), end = hashMap.end(); it != end; ++it)
-            encoder->encode(*it);
+            encoder << *it;
     }
 
     static bool decode(ArgumentDecoder* decoder, HashMapType& hashMap)
diff --git a/Source/WebKit2/Platform/CoreIPC/ArgumentDecoder.cpp b/Source/WebKit2/Platform/CoreIPC/ArgumentDecoder.cpp
index 9d7ff3bcb..681858008 100644
--- a/Source/WebKit2/Platform/CoreIPC/ArgumentDecoder.cpp
+++ b/Source/WebKit2/Platform/CoreIPC/ArgumentDecoder.cpp
@@ -47,7 +47,7 @@ ArgumentDecoder::ArgumentDecoder(const uint8_t* buffer, size_t bufferSize, Deque
 ArgumentDecoder::~ArgumentDecoder()
 {
     ASSERT(m_allocatedBase);
-    fastFree(m_allocatedBase);
+    free(m_allocatedBase);
 #if !USE(UNIX_DOMAIN_SOCKETS)
     // FIXME: We need to dispose of the mach ports in cases of failure.
 #else
@@ -70,7 +70,7 @@ void ArgumentDecoder::initialize(const uint8_t* buffer, size_t bufferSize)
 {
     // This is the largest primitive type we expect to unpack from the message.
     const size_t expectedAlignment = sizeof(uint64_t);
-    m_allocatedBase = static_cast<uint8_t*>(fastMalloc(bufferSize + expectedAlignment));
+    m_allocatedBase = static_cast<uint8_t*>(malloc(bufferSize + expectedAlignment));
     m_buffer = roundUpToAlignment(m_allocatedBase, expectedAlignment);
     ASSERT(!(reinterpret_cast<uintptr_t>(m_buffer) % expectedAlignment));
 
diff --git a/Source/WebKit2/Platform/CoreIPC/Arguments.h b/Source/WebKit2/Platform/CoreIPC/Arguments.h
index 1d4c5dc4e..7ed94d8b9 100644
--- a/Source/WebKit2/Platform/CoreIPC/Arguments.h
+++ b/Source/WebKit2/Platform/CoreIPC/Arguments.h
@@ -35,7 +35,7 @@ namespace CoreIPC {
 struct Arguments0 {
     typedef Arguments0 ValueType;
 
-    void encode(ArgumentEncoder*) const 
+    void encode(ArgumentEncoder&) const 
     {
     }
 
@@ -57,9 +57,9 @@ template<typename T1> struct Arguments1 {
     {
     }
 
-    void encode(ArgumentEncoder* encoder) const 
+    void encode(ArgumentEncoder& encoder) const
     {
-        encoder->encode(argument1);
+        encoder.encode(argument1);
     }
 
     static bool decode(ArgumentDecoder* decoder, Arguments1& result)
@@ -84,10 +84,10 @@ template<typename T1, typename T2> struct Arguments2 : Arguments1<T1> {
     {
     }
 
-    void encode(ArgumentEncoder* encoder) const 
+    void encode(ArgumentEncoder& encoder) const
     {
         Arguments1<T1>::encode(encoder);
-        encoder->encode(argument2);
+        encoder.encode(argument2);
     }
 
     static bool decode(ArgumentDecoder* decoder, Arguments2& result)
@@ -116,10 +116,10 @@ template<typename T1, typename T2, typename T3> struct Arguments3 : Arguments2<T
     {
     }
 
-    void encode(ArgumentEncoder* encoder) const 
+    void encode(ArgumentEncoder& encoder) const
     {
         Arguments2<T1, T2>::encode(encoder);
-        encoder->encode(argument3);
+        encoder.encode(argument3);
     }
 
     static bool decode(ArgumentDecoder* decoder, Arguments3& result)
@@ -149,10 +149,10 @@ template<typename T1, typename T2, typename T3, typename T4> struct Arguments4 :
     {
     }
 
-    void encode(ArgumentEncoder* encoder) const
+    void encode(ArgumentEncoder& encoder) const
     {
         Arguments3<T1, T2, T3>::encode(encoder);
-        encoder->encode(argument4);
+        encoder.encode(argument4);
     }
     
     static bool decode(ArgumentDecoder* decoder, Arguments4& result)
@@ -183,10 +183,10 @@ template<typename T1, typename T2, typename T3, typename T4, typename T5> struct
     {
     }
 
-    void encode(ArgumentEncoder* encoder) const
+    void encode(ArgumentEncoder& encoder) const
     {
         Arguments4<T1, T2, T3, T4>::encode(encoder);
-        encoder->encode(argument5);
+        encoder.encode(argument5);
     }
     
     static bool decode(ArgumentDecoder* decoder, Arguments5& result)
@@ -218,10 +218,10 @@ template<typename T1, typename T2, typename T3, typename T4, typename T5, typena
     {
     }
 
-    void encode(ArgumentEncoder* encoder) const
+    void encode(ArgumentEncoder& encoder) const
     {
         Arguments5<T1, T2, T3, T4, T5>::encode(encoder);
-        encoder->encode(argument6);
+        encoder.encode(argument6);
     }
     
     static bool decode(ArgumentDecoder* decoder, Arguments6& result)
@@ -254,10 +254,10 @@ template<typename T1, typename T2, typename T3, typename T4, typename T5, typena
     {
     }
 
-    void encode(ArgumentEncoder* encoder) const
+    void encode(ArgumentEncoder& encoder) const
     {
         Arguments6<T1, T2, T3, T4, T5, T6>::encode(encoder);
-        encoder->encode(argument7);
+        encoder.encode(argument7);
     }
     
     static bool decode(ArgumentDecoder* decoder, Arguments7& result)
@@ -289,10 +289,10 @@ template<typename T1, typename T2, typename T3, typename T4, typename T5, typena
     {
     }
 
-    void encode(ArgumentEncoder* encoder) const
+    void encode(ArgumentEncoder& encoder) const
     {
         Arguments7<T1, T2, T3, T4, T5, T6, T7>::encode(encoder);
-        encoder->encode(argument8);
+        encoder.encode(argument8);
     }
 
     static bool decode(ArgumentDecoder* decoder, Arguments8& result)
@@ -327,11 +327,11 @@ template<typename T1, typename T2, typename T3, typename T4, typename T5, typena
     {
     }
 
-    void encode(ArgumentEncoder* encoder) const
+    void encode(ArgumentEncoder& encoder) const
     {
         Arguments8<T1, T2, T3, T4, T5, T6, T7, T8>::encode(encoder);
-        encoder->encode(argument9);
-        encoder->encode(argument10);
+        encoder.encode(argument9);
+        encoder.encode(argument10);
     }
 
     static bool decode(ArgumentDecoder* decoder, Arguments10& result)
diff --git a/Source/WebKit2/Platform/CoreIPC/Attachment.cpp b/Source/WebKit2/Platform/CoreIPC/Attachment.cpp
index d6952ae46..8f4774858 100644
--- a/Source/WebKit2/Platform/CoreIPC/Attachment.cpp
+++ b/Source/WebKit2/Platform/CoreIPC/Attachment.cpp
@@ -59,9 +59,9 @@ void Attachment::release()
 }
 #endif
 
-void Attachment::encode(ArgumentEncoder* encoder) const
+void Attachment::encode(ArgumentEncoder& encoder) const
 {
-    encoder->addAttachment(*this);
+    encoder.addAttachment(*this);
 }
 
 bool Attachment::decode(ArgumentDecoder* decoder, Attachment& attachment)
diff --git a/Source/WebKit2/Platform/CoreIPC/Attachment.h b/Source/WebKit2/Platform/CoreIPC/Attachment.h
index 05ab90793..dd26b3a76 100644
--- a/Source/WebKit2/Platform/CoreIPC/Attachment.h
+++ b/Source/WebKit2/Platform/CoreIPC/Attachment.h
@@ -82,7 +82,7 @@ public:
     void dispose();
 #endif
 
-    void encode(ArgumentEncoder*) const;
+    void encode(ArgumentEncoder&) const;
     static bool decode(ArgumentDecoder*, Attachment&);
     
 private:
diff --git a/Source/WebKit2/Platform/CoreIPC/Connection.cpp b/Source/WebKit2/Platform/CoreIPC/Connection.cpp
index 934583417..f0220a0ff 100644
--- a/Source/WebKit2/Platform/CoreIPC/Connection.cpp
+++ b/Source/WebKit2/Platform/CoreIPC/Connection.cpp
@@ -304,8 +304,10 @@ bool Connection::sendMessage(MessageID messageID, PassOwnPtr<MessageEncoder> enc
             || m_inDispatchMessageMarkedDispatchWhenWaitingForSyncReplyCount))
         messageID = messageID.messageIDWithAddedFlags(MessageID::DispatchMessageWhenWaitingForSyncReply);
 
-    MutexLocker locker(m_outgoingMessagesLock);
-    m_outgoingMessages.append(OutgoingMessage(messageID, encoder));
+    {
+        MutexLocker locker(m_outgoingMessagesLock);
+        m_outgoingMessages.append(OutgoingMessage(messageID, encoder));
+    }
     
     // FIXME: We should add a boolean flag so we don't call this when work has already been scheduled.
     m_connectionQueue.dispatch(WTF::bind(&Connection::sendOutgoingMessages, this));
@@ -648,8 +650,10 @@ void Connection::didFailToSendSyncMessage()
 
 void Connection::enqueueIncomingMessage(IncomingMessage& incomingMessage)
 {
-    MutexLocker locker(m_incomingMessagesLock);
-    m_incomingMessages.append(incomingMessage);
+    {
+        MutexLocker locker(m_incomingMessagesLock);
+        m_incomingMessages.append(incomingMessage);
+    }
 
     m_clientRunLoop->dispatch(WTF::bind(&Connection::dispatchOneMessage, this));
 }
@@ -688,7 +692,7 @@ void Connection::dispatchMessage(IncomingMessage& message)
         m_inDispatchMessageMarkedDispatchWhenWaitingForSyncReplyCount--;
 
     if (m_didReceiveInvalidMessage && m_client)
-        m_client->didReceiveInvalidMessage(this, message.messageID());
+        m_client->didReceiveInvalidMessage(this, arguments->messageReceiverName(), arguments->messageName());
 
     m_didReceiveInvalidMessage = oldDidReceiveInvalidMessage;
 }
diff --git a/Source/WebKit2/Platform/CoreIPC/Connection.h b/Source/WebKit2/Platform/CoreIPC/Connection.h
index 4a7a3a818..0af465036 100644
--- a/Source/WebKit2/Platform/CoreIPC/Connection.h
+++ b/Source/WebKit2/Platform/CoreIPC/Connection.h
@@ -88,7 +88,7 @@ public:
     class Client : public MessageReceiver {
     public:
         virtual void didClose(Connection*) = 0;
-        virtual void didReceiveInvalidMessage(Connection*, MessageID) = 0;
+        virtual void didReceiveInvalidMessage(Connection*, StringReference messageReceiverName, StringReference messageName) = 0;
 
 #if PLATFORM(WIN)
         virtual Vector<HWND> windowsToReceiveSentMessagesWhileWaitingForSyncReply() = 0;
@@ -190,11 +190,6 @@ public:
     PassOwnPtr<MessageDecoder> sendSyncMessage(MessageID, uint64_t syncRequestID, PassOwnPtr<MessageEncoder>, double timeout, unsigned syncSendFlags = 0);
     bool sendSyncReply(PassOwnPtr<MessageEncoder>);
 
-    // FIXME: These variants of send, sendSync and waitFor are all deprecated.
-    // All clients should move to the overloads that take a message type.
-    template<typename E, typename T> bool deprecatedSend(E messageID, uint64_t destinationID, const T& arguments);
-    template<typename E, typename T, typename U> bool deprecatedSendSync(E messageID, uint64_t destinationID, const T& arguments, const U& reply, double timeout = NoTimeout);
-    
     void wakeUpRunLoop();
 
     void incrementDispatchMessageMarkedDispatchWhenWaitingForSyncReplyCount() { ++m_inDispatchMessageMarkedDispatchWhenWaitingForSyncReplyCount; }
@@ -402,6 +397,8 @@ private:
 
 template<typename T> bool Connection::send(const T& message, uint64_t destinationID, unsigned messageSendFlags)
 {
+    COMPILE_ASSERT(!T::isSync, AsyncMessageExpected);
+
     OwnPtr<MessageEncoder> encoder = MessageEncoder::create(T::receiverName(), T::name(), destinationID);
     encoder->encode(message);
     
@@ -410,6 +407,8 @@ template<typename T> bool Connection::send(const T& message, uint64_t destinatio
 
 template<typename T> bool Connection::sendSync(const T& message, const typename T::Reply& reply, uint64_t destinationID, double timeout, unsigned syncSendFlags)
 {
+    COMPILE_ASSERT(T::isSync, SyncMessageExpected);
+
     uint64_t syncRequestID = 0;
     OwnPtr<MessageEncoder> encoder = createSyncMessageEncoder(T::receiverName(), T::name(), destinationID, syncRequestID);
     
@@ -436,35 +435,6 @@ template<typename T> bool Connection::waitForAndDispatchImmediately(uint64_t des
     return true;
 }
 
-// These three member functions are all deprecated.
-
-template<typename E, typename T, typename U>
-inline bool Connection::deprecatedSendSync(E messageID, uint64_t destinationID, const T& arguments, const U& reply, double timeout)
-{
-    uint64_t syncRequestID = 0;
-    OwnPtr<MessageEncoder> encoder = createSyncMessageEncoder(CoreIPC::MessageKindTraits<E>::messageReceiverName(), "", destinationID, syncRequestID);
-
-    // Encode the input arguments.
-    encoder->encode(arguments);
-    
-    // Now send the message and wait for a reply.
-    OwnPtr<MessageDecoder> replyDecoder = sendSyncMessage(MessageID(messageID), syncRequestID, encoder.release(), timeout);
-    if (!replyDecoder)
-        return false;
-    
-    // Decode the reply.
-    return replyDecoder->decode(const_cast<U&>(reply));
-}
-
-template<typename E, typename T>
-bool Connection::deprecatedSend(E messageID, uint64_t destinationID, const T& arguments)
-{
-    OwnPtr<MessageEncoder> encoder = MessageEncoder::create(CoreIPC::MessageKindTraits<E>::messageReceiverName(), "", destinationID);
-    encoder->encode(arguments);
-
-    return sendMessage(MessageID(messageID), encoder.release());
-}
-
 } // namespace CoreIPC
 
 #endif // Connection_h
diff --git a/Source/WebKit2/Platform/CoreIPC/DataReference.cpp b/Source/WebKit2/Platform/CoreIPC/DataReference.cpp
index 0798c3e0e..a1449862c 100644
--- a/Source/WebKit2/Platform/CoreIPC/DataReference.cpp
+++ b/Source/WebKit2/Platform/CoreIPC/DataReference.cpp
@@ -31,9 +31,9 @@
 
 namespace CoreIPC {
 
-void DataReference::encode(ArgumentEncoder* encoder) const
+void DataReference::encode(ArgumentEncoder& encoder) const
 {
-    encoder->encodeVariableLengthByteArray(*this);
+    encoder.encodeVariableLengthByteArray(*this);
 }
 
 bool DataReference::decode(ArgumentDecoder* decoder, DataReference& dataReference)
diff --git a/Source/WebKit2/Platform/CoreIPC/DataReference.h b/Source/WebKit2/Platform/CoreIPC/DataReference.h
index 5ed0443c3..a0ce8c319 100644
--- a/Source/WebKit2/Platform/CoreIPC/DataReference.h
+++ b/Source/WebKit2/Platform/CoreIPC/DataReference.h
@@ -72,7 +72,7 @@ public:
         return result;
     }
 
-    void encode(ArgumentEncoder* encoder) const;
+    void encode(ArgumentEncoder&) const;
     static bool decode(ArgumentDecoder* decoder, DataReference& dataReference);
 
 private:
diff --git a/Source/WebKit2/Platform/CoreIPC/HandleMessage.h b/Source/WebKit2/Platform/CoreIPC/HandleMessage.h
index 77401c12a..f3934c4d5 100644
--- a/Source/WebKit2/Platform/CoreIPC/HandleMessage.h
+++ b/Source/WebKit2/Platform/CoreIPC/HandleMessage.h
@@ -331,7 +331,7 @@ void handleMessage(MessageDecoder& decoder, MessageEncoder& replyEncoder, C* obj
 
     typename T::Reply::ValueType replyArguments;
     callMemberFunction(arguments, replyArguments, object, function);
-    replyEncoder.encode(replyArguments);
+    replyEncoder << replyArguments;
 }
 
 template<typename T, typename C, typename MF>
@@ -361,7 +361,7 @@ void handleMessageVariadic(MessageDecoder& decoder, MessageEncoder& replyEncoder
 
     typename T::Reply::ValueType replyArguments;
     callMemberFunction(arguments, decoder, replyArguments, object, function);
-    replyEncoder.encode(replyArguments);
+    replyEncoder << replyArguments;
 }
 
 template<typename T, typename C, typename MF>
diff --git a/Source/WebKit2/Platform/CoreIPC/MessageID.h b/Source/WebKit2/Platform/CoreIPC/MessageID.h
index a89e64f5c..dd3fcb0c9 100644
--- a/Source/WebKit2/Platform/CoreIPC/MessageID.h
+++ b/Source/WebKit2/Platform/CoreIPC/MessageID.h
@@ -115,6 +115,9 @@ enum MessageClass {
     // Messages sent by the web process to the network process.
     MessageClassNetworkConnectionToWebProcess,
 
+    // Messages sent by the network process to a web process.
+    MessageClassNetworkProcessConnection,
+    
 #if ENABLE(SHARED_WORKER_PROCESS)
     // Messages sent by the UI process to the shared worker process.
     MessageClassSharedWorkerProcess,
diff --git a/Source/WebKit2/Platform/CoreIPC/MessageReceiverMap.cpp b/Source/WebKit2/Platform/CoreIPC/MessageReceiverMap.cpp
index f123b3dda..06dfbc74e 100644
--- a/Source/WebKit2/Platform/CoreIPC/MessageReceiverMap.cpp
+++ b/Source/WebKit2/Platform/CoreIPC/MessageReceiverMap.cpp
@@ -45,14 +45,44 @@ void MessageReceiverMap::addMessageReceiver(StringReference messageReceiverName,
     m_globalMessageReceivers.set(messageReceiverName, messageReceiver);
 }
 
+void MessageReceiverMap::addMessageReceiver(StringReference messageReceiverName, uint64_t destinationID, MessageReceiver* messageReceiver)
+{
+    ASSERT(!m_messageReceivers.contains(std::make_pair(messageReceiverName, destinationID)));
+    ASSERT(!m_globalMessageReceivers.contains(messageReceiverName));
+
+    m_messageReceivers.set(std::make_pair(messageReceiverName, destinationID), messageReceiver);
+}
+
+void MessageReceiverMap::removeMessageReceiver(StringReference messageReceiverName)
+{
+    ASSERT(m_globalMessageReceivers.contains(messageReceiverName));
+
+    m_globalMessageReceivers.remove(messageReceiverName);
+}
+
+void MessageReceiverMap::removeMessageReceiver(StringReference messageReceiverName, uint64_t destinationID)
+{
+    ASSERT(m_messageReceivers.contains(std::make_pair(messageReceiverName, destinationID)));
+
+    m_messageReceivers.remove(std::make_pair(messageReceiverName, destinationID));
+}
+
 void MessageReceiverMap::invalidate()
 {
     m_globalMessageReceivers.clear();
+    m_messageReceivers.clear();
 }
 
 bool MessageReceiverMap::dispatchMessage(Connection* connection, MessageID messageID, MessageDecoder& decoder)
 {
     if (MessageReceiver* messageReceiver = m_globalMessageReceivers.get(decoder.messageReceiverName())) {
+        ASSERT(!decoder.destinationID());
+
+        messageReceiver->didReceiveMessage(connection, messageID, decoder);
+        return true;
+    }
+
+    if (MessageReceiver* messageReceiver = m_messageReceivers.get(std::make_pair(decoder.messageReceiverName(), decoder.destinationID()))) {
         messageReceiver->didReceiveMessage(connection, messageID, decoder);
         return true;
     }
@@ -63,6 +93,13 @@ bool MessageReceiverMap::dispatchMessage(Connection* connection, MessageID messa
 bool MessageReceiverMap::dispatchSyncMessage(Connection* connection, MessageID messageID, MessageDecoder& decoder, OwnPtr<MessageEncoder>& replyEncoder)
 {
     if (MessageReceiver* messageReceiver = m_globalMessageReceivers.get(decoder.messageReceiverName())) {
+        ASSERT(!decoder.destinationID());
+
+        messageReceiver->didReceiveSyncMessage(connection, messageID, decoder, replyEncoder);
+        return true;
+    }
+
+    if (MessageReceiver* messageReceiver = m_messageReceivers.get(std::make_pair(decoder.messageReceiverName(), decoder.destinationID()))) {
         messageReceiver->didReceiveSyncMessage(connection, messageID, decoder, replyEncoder);
         return true;
     }
diff --git a/Source/WebKit2/Platform/CoreIPC/MessageReceiverMap.h b/Source/WebKit2/Platform/CoreIPC/MessageReceiverMap.h
index 3844ef1b5..0be40ebe9 100644
--- a/Source/WebKit2/Platform/CoreIPC/MessageReceiverMap.h
+++ b/Source/WebKit2/Platform/CoreIPC/MessageReceiverMap.h
@@ -44,6 +44,10 @@ public:
     ~MessageReceiverMap();
 
     void addMessageReceiver(StringReference messageReceiverName, MessageReceiver*);
+    void addMessageReceiver(StringReference messageReceiverName, uint64_t destinationID, MessageReceiver*);
+
+    void removeMessageReceiver(StringReference messageReceiverName);
+    void removeMessageReceiver(StringReference messageReceiverName, uint64_t destinationID);
 
     void invalidate();
 
@@ -53,6 +57,8 @@ public:
 private:
     // Message receivers that don't require a destination ID.
     HashMap<StringReference, MessageReceiver*> m_globalMessageReceivers;
+
+    HashMap<std::pair<StringReference, uint64_t>, MessageReceiver*> m_messageReceivers;
 };
 
 };
diff --git a/Source/WebKit2/Platform/CoreIPC/MessageSender.h b/Source/WebKit2/Platform/CoreIPC/MessageSender.h
index d806d2b73..b47c8193f 100644
--- a/Source/WebKit2/Platform/CoreIPC/MessageSender.h
+++ b/Source/WebKit2/Platform/CoreIPC/MessageSender.h
@@ -40,6 +40,7 @@ public:
 
     template<typename U> bool send(const U& message, uint64_t destinationID)
     {
+        COMPILE_ASSERT(!U::isSync, AsyncMessageExpected);
         OwnPtr<MessageEncoder> encoder = MessageEncoder::create(U::receiverName(), U::name(), destinationID);
         encoder->encode(message);
         
@@ -56,6 +57,7 @@ public:
 
     template<typename U> bool sendSync(const U& message, const typename U::Reply& reply, double timeout = Connection::NoTimeout)
     {
+        COMPILE_ASSERT(U::isSync, SyncMessageExpected);
         return sendSync(message, reply, static_cast<T*>(this)->destinationID(), timeout);
     }
     
diff --git a/Source/WebKit2/Platform/CoreIPC/StringReference.cpp b/Source/WebKit2/Platform/CoreIPC/StringReference.cpp
index 56e8c1a37..d466f3fbd 100644
--- a/Source/WebKit2/Platform/CoreIPC/StringReference.cpp
+++ b/Source/WebKit2/Platform/CoreIPC/StringReference.cpp
@@ -30,18 +30,24 @@
 #include "ArgumentEncoder.h"
 #include "DataReference.h"
 #include <wtf/StringHasher.h>
+#include <wtf/text/CString.h>
 
 namespace CoreIPC {
 
-void StringReference::encode(ArgumentEncoder* encoder) const
+CString StringReference::toString() const
 {
-    encoder->encodeVariableLengthByteArray(DataReference(reinterpret_cast<const uint8_t*>(m_data), m_size));
+    return WTF::CString(m_data, m_size);
+}
+
+void StringReference::encode(ArgumentEncoder& encoder) const
+{
+    encoder << DataReference(reinterpret_cast<const uint8_t*>(m_data), m_size);
 }
 
 bool StringReference::decode(ArgumentDecoder* decoder, StringReference& result)
 {
     DataReference dataReference;
-    if (!decoder->decodeVariableLengthByteArray(dataReference))
+    if (!decoder->decode(dataReference))
         return false;
 
     result.m_data = reinterpret_cast<const char*>(dataReference.data());
diff --git a/Source/WebKit2/Platform/CoreIPC/StringReference.h b/Source/WebKit2/Platform/CoreIPC/StringReference.h
index ed482e53f..47235c1c9 100644
--- a/Source/WebKit2/Platform/CoreIPC/StringReference.h
+++ b/Source/WebKit2/Platform/CoreIPC/StringReference.h
@@ -26,6 +26,7 @@
 #ifndef StringReference_h
 #define StringReference_h
 
+#include <wtf/Forward.h>
 #include <wtf/HashTraits.h>
 
 namespace CoreIPC {
@@ -59,12 +60,14 @@ public:
     size_t size() const { return m_size; }
     const char* data() const { return m_data; }
 
+    CString toString() const;
+
     friend bool operator==(const StringReference& a, const StringReference& b)
     {
         return a.m_size == b.m_size && !memcmp(a.m_data, b.m_data, a.m_size);
     }
 
-    void encode(ArgumentEncoder*) const;
+    void encode(ArgumentEncoder&) const;
     static bool decode(ArgumentDecoder*, StringReference&);
 
     struct Hash {
diff --git a/Source/WebKit2/Platform/CoreIPC/mac/MachPort.h b/Source/WebKit2/Platform/CoreIPC/mac/MachPort.h
index ecce16e74..fa4474e05 100644
--- a/Source/WebKit2/Platform/CoreIPC/mac/MachPort.h
+++ b/Source/WebKit2/Platform/CoreIPC/mac/MachPort.h
@@ -46,9 +46,9 @@ public:
     {
     }
 
-    void encode(ArgumentEncoder* encoder) const
+    void encode(ArgumentEncoder& encoder) const
     {
-        encoder->encode(Attachment(m_port, m_disposition));
+        encoder << Attachment(m_port, m_disposition);
     }
 
     static bool decode(ArgumentDecoder* decoder, MachPort& p)
diff --git a/Source/WebKit2/Platform/Logging.cpp b/Source/WebKit2/Platform/Logging.cpp
index df98e724e..6cd04b99a 100644
--- a/Source/WebKit2/Platform/Logging.cpp
+++ b/Source/WebKit2/Platform/Logging.cpp
@@ -38,6 +38,7 @@ WTFLogChannel LogView         = { 0x00000008, "WebKit2LogLevel", WTFLogChannelOf
 WTFLogChannel LogIconDatabase = { 0x00000010, "WebKit2LogLevel", WTFLogChannelOff };
 WTFLogChannel LogKeyHandling  = { 0x00000020, "WebKit2LogLevel", WTFLogChannelOff };
 WTFLogChannel LogPlugins      = { 0x00000040, "WebKit2LogLevel", WTFLogChannelOff };
+WTFLogChannel LogNetwork      = { 0x00000080, "WebKit2LogLevel", WTFLogChannelOff };
 
 #if !PLATFORM(MAC) && !PLATFORM(GTK) && !PLATFORM(QT) && !PLATFORM(EFL)
 void initializeLogChannel(WTFLogChannel* channel)
@@ -73,6 +74,9 @@ WTFLogChannel* getChannelFromName(const String& channelName)
     if (equalIgnoringCase(channelName, String("Plugins")))
         return &LogPlugins;
 
+    if (equalIgnoringCase(channelName, String("Network")))
+        return &LogNetwork;
+
     return 0;
 }
 #endif
diff --git a/Source/WebKit2/Platform/Logging.h b/Source/WebKit2/Platform/Logging.h
index 603686f3d..ca998c2b8 100644
--- a/Source/WebKit2/Platform/Logging.h
+++ b/Source/WebKit2/Platform/Logging.h
@@ -44,6 +44,7 @@ extern WTFLogChannel LogPlugins;
 extern WTFLogChannel LogSessionState;
 extern WTFLogChannel LogTextInput;
 extern WTFLogChannel LogView;
+extern WTFLogChannel LogNetwork;
 
 void initializeLogChannel(WTFLogChannel*);
 void initializeLogChannelsIfNecessary(void);
diff --git a/Source/WebKit2/Platform/SharedMemory.h b/Source/WebKit2/Platform/SharedMemory.h
index 0d56bacc6..46d032a51 100644
--- a/Source/WebKit2/Platform/SharedMemory.h
+++ b/Source/WebKit2/Platform/SharedMemory.h
@@ -57,7 +57,7 @@ public:
 
         bool isNull() const;
 
-        void encode(CoreIPC::ArgumentEncoder*) const;
+        void encode(CoreIPC::ArgumentEncoder&) const;
         static bool decode(CoreIPC::ArgumentDecoder*, Handle&);
 
 #if USE(UNIX_DOMAIN_SOCKETS)
diff --git a/Source/WebKit2/Platform/WorkQueue.h b/Source/WebKit2/Platform/WorkQueue.h
index 6a5c756b3..b7813481d 100644
--- a/Source/WebKit2/Platform/WorkQueue.h
+++ b/Source/WebKit2/Platform/WorkQueue.h
@@ -206,6 +206,8 @@ private:
     int m_maxFileDescriptor;
     int m_readFromPipeDescriptor;
     int m_writeToPipeDescriptor;
+    Mutex m_writeToPipeDescriptorLock;
+
     bool m_threadLoop;
 
     Vector<Function<void()> > m_workItemQueue;
diff --git a/Source/WebKit2/Platform/efl/WorkQueueEfl.cpp b/Source/WebKit2/Platform/efl/WorkQueueEfl.cpp
index 6c505b41c..06daf68b8 100644
--- a/Source/WebKit2/Platform/efl/WorkQueueEfl.cpp
+++ b/Source/WebKit2/Platform/efl/WorkQueueEfl.cpp
@@ -68,18 +68,20 @@ void WorkQueue::platformInvalidate()
 
 void WorkQueue::performWork()
 {
-    m_workItemQueueLock.lock();
-
-    while (!m_workItemQueue.isEmpty()) {
+    while (true) {
         Vector<Function<void()> > workItemQueue;
-        m_workItemQueue.swap(workItemQueue);
 
-        m_workItemQueueLock.unlock();
+        {
+            MutexLocker locker(m_workItemQueueLock);
+            if (m_workItemQueue.isEmpty())
+                return;
+
+            m_workItemQueue.swap(workItemQueue);
+        }
+
         for (size_t i = 0; i < workItemQueue.size(); ++i)
             workItemQueue[i]();
-        m_workItemQueueLock.lock();
     }
-    m_workItemQueueLock.unlock();
 }
 
 void WorkQueue::performFileDescriptorWork()
@@ -125,6 +127,7 @@ void WorkQueue::insertTimerWorkItem(PassOwnPtr<TimerWorkItem> item)
 
     size_t position = 0;
 
+    MutexLocker locker(m_timerWorkItemsLock);
     // m_timerWorkItems should be ordered by expire time.
     for (; position < m_timerWorkItems.size(); ++position)
         if (item->expireTime() < m_timerWorkItems[position]->expireTime())
@@ -135,19 +138,19 @@ void WorkQueue::insertTimerWorkItem(PassOwnPtr<TimerWorkItem> item)
 
 void WorkQueue::performTimerWork()
 {
-    // Protects m_timerWorkItems.
-    m_timerWorkItemsLock.lock();
+    Vector<OwnPtr<TimerWorkItem> > timerWorkItems;
 
-    if (m_timerWorkItems.isEmpty()) {
-        m_timerWorkItemsLock.unlock();
-        return;
+    {
+        // Protects m_timerWorkItems.
+        MutexLocker locker(m_timerWorkItemsLock);
+        if (m_timerWorkItems.isEmpty())
+            return;
+
+        // Copies all the timer work items in m_timerWorkItems to local vector.
+        m_timerWorkItems.swap(timerWorkItems);
     }
 
     double current = currentTime();
-    Vector<OwnPtr<TimerWorkItem> > timerWorkItems;
-
-    // Copies all the timer work items in m_timerWorkItems to local vector.
-    m_timerWorkItems.swap(timerWorkItems);
 
     for (size_t i = 0; i < timerWorkItems.size(); ++i) {
         if (!timerWorkItems[i]->expired(current)) {
@@ -158,18 +161,13 @@ void WorkQueue::performTimerWork()
         }
 
         // If a timer work item expired, dispatch the function of the work item.
-        // Before dispatching, m_timerWorkItemsLock should unlock for preventing deadlock,
-        // because it can be accessed inside the function of the timer work item dispatched.
-        m_timerWorkItemsLock.unlock();
         timerWorkItems[i]->dispatch();
-        m_timerWorkItemsLock.lock();
     }
-
-    m_timerWorkItemsLock.unlock();
 }
 
 void WorkQueue::sendMessageToThread(const char* message)
 {
+    MutexLocker locker(m_writeToPipeDescriptorLock);
     if (write(m_writeToPipeDescriptor, message, threadMessageSize) == -1)
         LOG_ERROR("Failed to wake up WorkQueue Thread");
 }
@@ -212,8 +210,11 @@ void WorkQueue::unregisterSocketEventHandler(int fileDescriptor)
 
 void WorkQueue::dispatch(const Function<void()>& function)
 {
-    MutexLocker locker(m_workItemQueueLock);
-    m_workItemQueue.append(function);
+    {
+        MutexLocker locker(m_workItemQueueLock);
+        m_workItemQueue.append(function);
+    }
+
     sendMessageToThread(wakupThreadMessage);
 }
 
@@ -222,7 +223,6 @@ void WorkQueue::dispatchAfterDelay(const Function<void()>& function, double dela
     if (delay < 0)
         return;
 
-    MutexLocker locker(m_timerWorkItemsLock);
     OwnPtr<TimerWorkItem> timerWorkItem = TimerWorkItem::create(function, currentTime() + delay);
     if (!timerWorkItem)
         return;
diff --git a/Source/WebKit2/Platform/gtk/SharedMemoryGtk.cpp b/Source/WebKit2/Platform/gtk/SharedMemoryGtk.cpp
index faccf103e..9354306c2 100644
--- a/Source/WebKit2/Platform/gtk/SharedMemoryGtk.cpp
+++ b/Source/WebKit2/Platform/gtk/SharedMemoryGtk.cpp
@@ -41,7 +41,7 @@ SharedMemory::Handle::~Handle()
     notImplemented();
 }
 
-void SharedMemory::Handle::encode(CoreIPC::ArgumentEncoder* encoder) const
+void SharedMemory::Handle::encode(CoreIPC::ArgumentEncoder& encoder) const
 {
     notImplemented();
 }
diff --git a/Source/WebKit2/Platform/mac/ModuleMac.mm b/Source/WebKit2/Platform/mac/ModuleMac.mm
index 4a35b6a2d..368753151 100644
--- a/Source/WebKit2/Platform/mac/ModuleMac.mm
+++ b/Source/WebKit2/Platform/mac/ModuleMac.mm
@@ -30,12 +30,11 @@ namespace WebKit {
 
 bool Module::load()
 {
-    RetainPtr<CFStringRef> bundlePath(AdoptCF, m_path.createCFString());
-    RetainPtr<CFURLRef> bundleURL(AdoptCF, CFURLCreateWithFileSystemPath(kCFAllocatorDefault, bundlePath.get(), kCFURLPOSIXPathStyle, FALSE));
+    RetainPtr<CFURLRef> bundleURL = adoptCF(CFURLCreateWithFileSystemPath(kCFAllocatorDefault, m_path.createCFString().get(), kCFURLPOSIXPathStyle, FALSE));
     if (!bundleURL)
         return false;
 
-    RetainPtr<CFBundleRef> bundle(AdoptCF, CFBundleCreate(kCFAllocatorDefault, bundleURL.get()));
+    RetainPtr<CFBundleRef> bundle = adoptCF(CFBundleCreate(kCFAllocatorDefault, bundleURL.get()));
     if (!bundle)
         return false;
 
diff --git a/Source/WebKit2/Platform/mac/SharedMemoryMac.cpp b/Source/WebKit2/Platform/mac/SharedMemoryMac.cpp
index 4019a8d85..62ed297f4 100644
--- a/Source/WebKit2/Platform/mac/SharedMemoryMac.cpp
+++ b/Source/WebKit2/Platform/mac/SharedMemoryMac.cpp
@@ -55,10 +55,10 @@ bool SharedMemory::Handle::isNull() const
     return !m_port;
 }
 
-void SharedMemory::Handle::encode(CoreIPC::ArgumentEncoder* encoder) const
+void SharedMemory::Handle::encode(CoreIPC::ArgumentEncoder& encoder) const
 {
-    encoder->encode(static_cast<uint64_t>(m_size));
-    encoder->encode(CoreIPC::MachPort(m_port, MACH_MSG_TYPE_MOVE_SEND));
+    encoder << static_cast<uint64_t>(m_size);
+    encoder << CoreIPC::MachPort(m_port, MACH_MSG_TYPE_MOVE_SEND);
     m_port = MACH_PORT_NULL;
 }
 
diff --git a/Source/WebKit2/Platform/unix/SharedMemoryUnix.cpp b/Source/WebKit2/Platform/unix/SharedMemoryUnix.cpp
index c432d3301..f565b76ec 100644
--- a/Source/WebKit2/Platform/unix/SharedMemoryUnix.cpp
+++ b/Source/WebKit2/Platform/unix/SharedMemoryUnix.cpp
@@ -63,9 +63,9 @@ bool SharedMemory::Handle::isNull() const
     return m_fileDescriptor == -1;
 }
 
-void SharedMemory::Handle::encode(CoreIPC::ArgumentEncoder* encoder) const
+void SharedMemory::Handle::encode(CoreIPC::ArgumentEncoder& encoder) const
 {
-    encoder->encode(releaseToAttachment());
+    encoder.encode(releaseToAttachment());
 }
 
 bool SharedMemory::Handle::decode(CoreIPC::ArgumentDecoder* decoder, Handle& handle)
diff --git a/Source/WebKit2/Platform/win/SharedMemoryWin.cpp b/Source/WebKit2/Platform/win/SharedMemoryWin.cpp
index 2aa28f8c0..f59dba504 100644
--- a/Source/WebKit2/Platform/win/SharedMemoryWin.cpp
+++ b/Source/WebKit2/Platform/win/SharedMemoryWin.cpp
@@ -51,18 +51,18 @@ bool SharedMemory::Handle::isNull() const
     return !m_handle;
 }
 
-void SharedMemory::Handle::encode(CoreIPC::ArgumentEncoder* encoder) const
+void SharedMemory::Handle::encode(CoreIPC::ArgumentEncoder& encoder) const
 {
-    encoder->encode(static_cast<uint64_t>(m_size));
+    encoder.encode(static_cast<uint64_t>(m_size));
 
     // Hand off ownership of our HANDLE to the receiving process. It will close it for us.
     // FIXME: If the receiving process crashes before it receives the memory, the memory will be
     // leaked. See <http://webkit.org/b/47502>.
-    encoder->encode(reinterpret_cast<uint64_t>(m_handle));
+    encoder.encode(reinterpret_cast<uint64_t>(m_handle));
     m_handle = 0;
 
     // Send along our PID so that the receiving process can duplicate the HANDLE for its own use.
-    encoder->encode(static_cast<uint32_t>(::GetCurrentProcessId()));
+    encoder.encode(static_cast<uint32_t>(::GetCurrentProcessId()));
 }
 
 static bool getDuplicatedHandle(HANDLE sourceHandle, DWORD sourcePID, HANDLE& duplicatedHandle)
diff --git a/Source/WebKit2/PlatformEfl.cmake b/Source/WebKit2/PlatformEfl.cmake
index 3b062ae11..0d74a4494 100644
--- a/Source/WebKit2/PlatformEfl.cmake
+++ b/Source/WebKit2/PlatformEfl.cmake
@@ -41,46 +41,59 @@ LIST(APPEND WebKit2_SOURCES
     UIProcess/API/C/soup/WKContextSoup.cpp
     UIProcess/API/C/soup/WKSoupRequestManager.cpp
 
-    UIProcess/API/efl/BatteryProvider.cpp
-    UIProcess/API/efl/PageViewportControllerClientEfl.cpp
-    UIProcess/API/efl/NetworkInfoProvider.cpp
-    UIProcess/API/efl/PageClientImpl.cpp
-    UIProcess/API/efl/VibrationProvider.cpp
-    UIProcess/API/efl/WebKitTextChecker.cpp
+    UIProcess/API/efl/EwkViewImpl.cpp
+    UIProcess/API/efl/EvasGLContext.cpp
+    UIProcess/API/efl/EvasGLSurface.cpp
+    UIProcess/API/efl/ewk_auth_request.cpp
     UIProcess/API/efl/ewk_back_forward_list.cpp
     UIProcess/API/efl/ewk_back_forward_list_item.cpp
+    UIProcess/API/efl/ewk_color_picker.cpp
     UIProcess/API/efl/ewk_context.cpp
-    UIProcess/API/efl/ewk_context_download_client.cpp
-    UIProcess/API/efl/ewk_context_history_client.cpp
-    UIProcess/API/efl/ewk_context_request_manager_client.cpp
     UIProcess/API/efl/ewk_cookie_manager.cpp
+    UIProcess/API/efl/ewk_database_manager.cpp
     UIProcess/API/efl/ewk_download_job.cpp
     UIProcess/API/efl/ewk_error.cpp
     UIProcess/API/efl/ewk_favicon_database.cpp
+    UIProcess/API/efl/ewk_file_chooser_request.cpp
     UIProcess/API/efl/ewk_form_submission_request.cpp
     UIProcess/API/efl/ewk_intent.cpp
     UIProcess/API/efl/ewk_intent_service.cpp
     UIProcess/API/efl/ewk_main.cpp
     UIProcess/API/efl/ewk_navigation_data.cpp
     UIProcess/API/efl/ewk_navigation_policy_decision.cpp
+    UIProcess/API/efl/ewk_object.cpp
+    UIProcess/API/efl/ewk_popup_menu.cpp
     UIProcess/API/efl/ewk_popup_menu_item.cpp
     UIProcess/API/efl/ewk_resource.cpp
+    UIProcess/API/efl/ewk_security_origin.cpp
     UIProcess/API/efl/ewk_settings.cpp
+    UIProcess/API/efl/ewk_storage_manager.cpp
     UIProcess/API/efl/ewk_text_checker.cpp
     UIProcess/API/efl/ewk_url_request.cpp
     UIProcess/API/efl/ewk_url_response.cpp
     UIProcess/API/efl/ewk_url_scheme_request.cpp
     UIProcess/API/efl/ewk_view.cpp
-    UIProcess/API/efl/ewk_view_find_client.cpp
-    UIProcess/API/efl/ewk_view_form_client.cpp
-    UIProcess/API/efl/ewk_view_policy_client.cpp
-    UIProcess/API/efl/ewk_view_ui_client.cpp
 
     UIProcess/cairo/BackingStoreCairo.cpp
 
+    UIProcess/efl/BatteryProvider.cpp
+    UIProcess/efl/ContextHistoryClientEfl.cpp
+    UIProcess/efl/DownloadManagerEfl.cpp
+    UIProcess/efl/FindClientEfl.cpp
+    UIProcess/efl/FormClientEfl.cpp
+    UIProcess/efl/InputMethodContextEfl.cpp
+    UIProcess/efl/NetworkInfoProvider.cpp
+    UIProcess/efl/PageClientBase.cpp
+    UIProcess/efl/PageClientLegacyImpl.cpp
+    UIProcess/efl/PageClientDefaultImpl.cpp
     UIProcess/efl/PageLoadClientEfl.cpp
+    UIProcess/efl/PagePolicyClientEfl.cpp
+    UIProcess/efl/PageUIClientEfl.cpp
+    UIProcess/efl/PageViewportControllerClientEfl.cpp
+    UIProcess/efl/RequestManagerClientEfl.cpp
     UIProcess/efl/ResourceLoadClientEfl.cpp
     UIProcess/efl/TextCheckerEfl.cpp
+    UIProcess/efl/VibrationProvider.cpp
     UIProcess/efl/WebContextEfl.cpp
     UIProcess/efl/WebFullScreenManagerProxyEfl.cpp
     UIProcess/efl/WebInspectorProxyEfl.cpp
@@ -192,8 +205,8 @@ LIST(APPEND WebKit2_LIBRARIES
     ${OPENGL_LIBRARIES}
     ${SQLITE_LIBRARIES}
     ${FONTCONFIG_LIBRARIES}
-    ${PNG_LIBRARY}
-    ${JPEG_LIBRARY}
+    ${PNG_LIBRARIES}
+    ${JPEG_LIBRARIES}
     ${CMAKE_DL_LIBS}
     ${GLIB_LIBRARIES}
     ${GLIB_GIO_LIBRARIES}
@@ -207,7 +220,7 @@ LIST (APPEND WebProcess_SOURCES
 
 LIST (APPEND WebProcess_LIBRARIES
     ${CAIRO_LIBRARIES}
-    ${ECORE_X_LIBRARIES}
+    ${ECORE_IMF_LIBRARIES}
     ${EDJE_LIBRARIES}
     ${EFLDEPS_LIBRARIES}
     ${EVAS_LIBRARIES}
@@ -217,6 +230,12 @@ LIST (APPEND WebProcess_LIBRARIES
     ${SQLITE_LIBRARIES}
 )
 
+IF (ENABLE_ECORE_X)
+    LIST(APPEND WebProcess_LIBRARIES
+        ${ECORE_X_LIBRARIES}
+        ${X11_Xext_LIB})
+ENDIF ()
+
 ADD_CUSTOM_TARGET(forwarding-headerEfl
     COMMAND ${PERL_EXECUTABLE} ${WEBKIT2_DIR}/Scripts/generate-forwarding-headers.pl ${WEBKIT2_DIR} ${DERIVED_SOURCES_WEBKIT2_DIR}/include efl
 )
@@ -230,22 +249,30 @@ SET(ForwardingNetworkHeaders_NAME forwarding-headerSoup)
 CONFIGURE_FILE(efl/ewebkit2.pc.in ${CMAKE_BINARY_DIR}/WebKit2/efl/ewebkit2.pc @ONLY)
 SET (EWebKit2_HEADERS
     "${CMAKE_CURRENT_SOURCE_DIR}/UIProcess/API/efl/EWebKit2.h"
+    "${CMAKE_CURRENT_SOURCE_DIR}/UIProcess/API/efl/ewk_auth_request.h"
     "${CMAKE_CURRENT_SOURCE_DIR}/UIProcess/API/efl/ewk_back_forward_list.h"
     "${CMAKE_CURRENT_SOURCE_DIR}/UIProcess/API/efl/ewk_back_forward_list_item.h"
+    "${CMAKE_CURRENT_SOURCE_DIR}/UIProcess/API/efl/ewk_color_picker.h"
     "${CMAKE_CURRENT_SOURCE_DIR}/UIProcess/API/efl/ewk_context.h"
     "${CMAKE_CURRENT_SOURCE_DIR}/UIProcess/API/efl/ewk_cookie_manager.h"
+    "${CMAKE_CURRENT_SOURCE_DIR}/UIProcess/API/efl/ewk_database_manager.h"
     "${CMAKE_CURRENT_SOURCE_DIR}/UIProcess/API/efl/ewk_download_job.h"
     "${CMAKE_CURRENT_SOURCE_DIR}/UIProcess/API/efl/ewk_error.h"
     "${CMAKE_CURRENT_SOURCE_DIR}/UIProcess/API/efl/ewk_favicon_database.h"
+    "${CMAKE_CURRENT_SOURCE_DIR}/UIProcess/API/efl/ewk_file_chooser_request.h"
     "${CMAKE_CURRENT_SOURCE_DIR}/UIProcess/API/efl/ewk_form_submission_request.h"
     "${CMAKE_CURRENT_SOURCE_DIR}/UIProcess/API/efl/ewk_intent.h"
     "${CMAKE_CURRENT_SOURCE_DIR}/UIProcess/API/efl/ewk_intent_service.h"
     "${CMAKE_CURRENT_SOURCE_DIR}/UIProcess/API/efl/ewk_main.h"
     "${CMAKE_CURRENT_SOURCE_DIR}/UIProcess/API/efl/ewk_navigation_data.h"
     "${CMAKE_CURRENT_SOURCE_DIR}/UIProcess/API/efl/ewk_navigation_policy_decision.h"
+    "${CMAKE_CURRENT_SOURCE_DIR}/UIProcess/API/efl/ewk_object.h"
+    "${CMAKE_CURRENT_SOURCE_DIR}/UIProcess/API/efl/ewk_popup_menu.h"
     "${CMAKE_CURRENT_SOURCE_DIR}/UIProcess/API/efl/ewk_popup_menu_item.h"
     "${CMAKE_CURRENT_SOURCE_DIR}/UIProcess/API/efl/ewk_resource.h"
+    "${CMAKE_CURRENT_SOURCE_DIR}/UIProcess/API/efl/ewk_security_origin.h"
     "${CMAKE_CURRENT_SOURCE_DIR}/UIProcess/API/efl/ewk_settings.h"
+    "${CMAKE_CURRENT_SOURCE_DIR}/UIProcess/API/efl/ewk_storage_manager.h"
     "${CMAKE_CURRENT_SOURCE_DIR}/UIProcess/API/efl/ewk_text_checker.h"
     "${CMAKE_CURRENT_SOURCE_DIR}/UIProcess/API/efl/ewk_touch.h"
     "${CMAKE_CURRENT_SOURCE_DIR}/UIProcess/API/efl/ewk_url_request.h"
@@ -330,16 +357,23 @@ TARGET_LINK_LIBRARIES(ewk2UnitTestUtils ${EWK2UnitTests_LIBRARIES})
 # The "ewk" on the test name needs to be suffixed with "2", otherwise it
 # will clash with tests from the WebKit 1 test suite.
 SET(EWK2UnitTests_BINARIES
+    test_ewk2_auth_request
     test_ewk2_back_forward_list
+    test_ewk2_color_picker
     test_ewk2_context
     test_ewk2_context_history_callbacks
     test_ewk2_cookie_manager
+    test_ewk2_database_manager
     test_ewk2_download_job
     test_ewk2_eina_shared_string
     test_ewk2_favicon_database
-    test_ewk2_refptr_evas_object
+    test_ewk2_file_chooser_request
     test_ewk2_intents
+    test_ewk2_object
+    test_ewk2_popup_menu
+    test_ewk2_refptr_evas_object
     test_ewk2_settings
+    test_ewk2_storage_manager
     test_ewk2_text_checker
     test_ewk2_view
 )
diff --git a/Source/WebKit2/PluginProcess/PluginCreationParameters.cpp b/Source/WebKit2/PluginProcess/PluginCreationParameters.cpp
index bc2e9929c..15650fae6 100644
--- a/Source/WebKit2/PluginProcess/PluginCreationParameters.cpp
+++ b/Source/WebKit2/PluginProcess/PluginCreationParameters.cpp
@@ -45,19 +45,19 @@ PluginCreationParameters::PluginCreationParameters()
 {
 }
 
-void PluginCreationParameters::encode(CoreIPC::ArgumentEncoder* encoder) const
+void PluginCreationParameters::encode(CoreIPC::ArgumentEncoder& encoder) const
 {
-    encoder->encode(pluginInstanceID);
-    encoder->encode(windowNPObjectID);
-    encoder->encode(parameters);
-    encoder->encode(userAgent);
-    encoder->encode(contentsScaleFactor);
-    encoder->encode(isPrivateBrowsingEnabled);
-    encoder->encode(asynchronousCreationIncomplete);
-    encoder->encode(artificialPluginInitializationDelayEnabled);
+    encoder << pluginInstanceID;
+    encoder << windowNPObjectID;
+    encoder << parameters;
+    encoder << userAgent;
+    encoder << contentsScaleFactor;
+    encoder << isPrivateBrowsingEnabled;
+    encoder << asynchronousCreationIncomplete;
+    encoder << artificialPluginInitializationDelayEnabled;
 
 #if USE(ACCELERATED_COMPOSITING)
-    encoder->encode(isAcceleratedCompositingEnabled);
+    encoder << isAcceleratedCompositingEnabled;
 #endif
 }
 
diff --git a/Source/WebKit2/PluginProcess/PluginCreationParameters.h b/Source/WebKit2/PluginProcess/PluginCreationParameters.h
index 6f05bdaab..1387f140e 100644
--- a/Source/WebKit2/PluginProcess/PluginCreationParameters.h
+++ b/Source/WebKit2/PluginProcess/PluginCreationParameters.h
@@ -40,7 +40,7 @@ namespace WebKit {
 struct PluginCreationParameters {
     PluginCreationParameters();
 
-    void encode(CoreIPC::ArgumentEncoder*) const;
+    void encode(CoreIPC::ArgumentEncoder&) const;
     static bool decode(CoreIPC::ArgumentDecoder*, PluginCreationParameters&);
 
     // The unique ID of this plug-in instance.
diff --git a/Source/WebKit2/PluginProcess/PluginProcess.cpp b/Source/WebKit2/PluginProcess/PluginProcess.cpp
index 03c6f00b9..7b45c09fb 100644
--- a/Source/WebKit2/PluginProcess/PluginProcess.cpp
+++ b/Source/WebKit2/PluginProcess/PluginProcess.cpp
@@ -146,7 +146,7 @@ void PluginProcess::didClose(CoreIPC::Connection*)
     RunLoop::current()->stop();
 }
 
-void PluginProcess::didReceiveInvalidMessage(CoreIPC::Connection*, CoreIPC::MessageID)
+void PluginProcess::didReceiveInvalidMessage(CoreIPC::Connection*, CoreIPC::StringReference, CoreIPC::StringReference)
 {
 }
 
diff --git a/Source/WebKit2/PluginProcess/PluginProcess.h b/Source/WebKit2/PluginProcess/PluginProcess.h
index 0d855429d..d60c94b92 100644
--- a/Source/WebKit2/PluginProcess/PluginProcess.h
+++ b/Source/WebKit2/PluginProcess/PluginProcess.h
@@ -76,7 +76,7 @@ private:
     // CoreIPC::Connection::Client
     virtual void didReceiveMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::MessageDecoder&) OVERRIDE;
     virtual void didClose(CoreIPC::Connection*) OVERRIDE;
-    virtual void didReceiveInvalidMessage(CoreIPC::Connection*, CoreIPC::MessageID) OVERRIDE;
+    virtual void didReceiveInvalidMessage(CoreIPC::Connection*, CoreIPC::StringReference messageReceiverName, CoreIPC::StringReference messageName) OVERRIDE;
 
     // Message handlers.
     void didReceivePluginProcessMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::MessageDecoder&);
diff --git a/Source/WebKit2/PluginProcess/PluginProcess.messages.in b/Source/WebKit2/PluginProcess/PluginProcess.messages.in
index e4ef45072..41226b14d 100644
--- a/Source/WebKit2/PluginProcess/PluginProcess.messages.in
+++ b/Source/WebKit2/PluginProcess/PluginProcess.messages.in
@@ -38,6 +38,10 @@ messages -> PluginProcess {
     # Asks the plug-in to clear data for the given sites. The plug-in process sends back
     # a DidClearSiteData message when done.
     ClearSiteData(Vector<WTF::String> sites, uint64_t flags, uint64_t maxAgeInSeconds, uint64_t callbackID)
+
+#if PLATFORM(MAC)
+    SetApplicationIsOccluded(bool flag);
+#endif
 }
 
 #endif
diff --git a/Source/WebKit2/PluginProcess/WebProcessConnection.cpp b/Source/WebKit2/PluginProcess/WebProcessConnection.cpp
index 21a867038..ef574e6eb 100644
--- a/Source/WebKit2/PluginProcess/WebProcessConnection.cpp
+++ b/Source/WebKit2/PluginProcess/WebProcessConnection.cpp
@@ -188,7 +188,7 @@ void WebProcessConnection::destroyPlugin(uint64_t pluginInstanceID, bool asynchr
     destroyPluginControllerProxy(pluginControllerProxy);
 }
 
-void WebProcessConnection::didReceiveInvalidMessage(CoreIPC::Connection*, CoreIPC::MessageID)
+void WebProcessConnection::didReceiveInvalidMessage(CoreIPC::Connection*, CoreIPC::StringReference, CoreIPC::StringReference)
 {
     // FIXME: Implement.
 }
diff --git a/Source/WebKit2/PluginProcess/WebProcessConnection.h b/Source/WebKit2/PluginProcess/WebProcessConnection.h
index 8a15c9c2b..aba4c5742 100644
--- a/Source/WebKit2/PluginProcess/WebProcessConnection.h
+++ b/Source/WebKit2/PluginProcess/WebProcessConnection.h
@@ -65,7 +65,7 @@ private:
     virtual void didReceiveMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::MessageDecoder&) OVERRIDE;
     virtual void didReceiveSyncMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::MessageDecoder&, OwnPtr<CoreIPC::MessageEncoder>&) OVERRIDE;
     virtual void didClose(CoreIPC::Connection*);
-    virtual void didReceiveInvalidMessage(CoreIPC::Connection*, CoreIPC::MessageID);
+    virtual void didReceiveInvalidMessage(CoreIPC::Connection*, CoreIPC::StringReference messageReceiverName, CoreIPC::StringReference messageName);
 
     // Message handlers.
     void didReceiveWebProcessConnectionMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::MessageDecoder&);
diff --git a/Source/WebKit2/PluginProcess/mac/PluginProcessMac.mm b/Source/WebKit2/PluginProcess/mac/PluginProcessMac.mm
index de7d5831f..671f20d6d 100644
--- a/Source/WebKit2/PluginProcess/mac/PluginProcessMac.mm
+++ b/Source/WebKit2/PluginProcess/mac/PluginProcessMac.mm
@@ -279,8 +279,7 @@ static void initializeSandbox(const String& pluginPath, const String& sandboxPro
     if (sandboxProfileDirectoryPath.isEmpty())
         return;
 
-    RetainPtr<CFStringRef> cfPluginPath = adoptCF(pluginPath.createCFString());
-    RetainPtr<CFURLRef> pluginURL = adoptCF(CFURLCreateWithFileSystemPath(0, cfPluginPath.get(), kCFURLPOSIXPathStyle, false));
+    RetainPtr<CFURLRef> pluginURL = adoptCF(CFURLCreateWithFileSystemPath(0, pluginPath.createCFString().get(), kCFURLPOSIXPathStyle, false));
     if (!pluginURL)
         return;
 
@@ -292,8 +291,7 @@ static void initializeSandbox(const String& pluginPath, const String& sandboxPro
     if (!bundleIdentifier)
         return;
 
-    RetainPtr<CFStringRef> cfSandboxProfileDirectoryPath = adoptCF(sandboxProfileDirectoryPath.createCFString());
-    RetainPtr<CFURLRef> sandboxProfileDirectory = adoptCF(CFURLCreateWithFileSystemPath(0, cfSandboxProfileDirectoryPath.get(), kCFURLPOSIXPathStyle, TRUE));
+    RetainPtr<CFURLRef> sandboxProfileDirectory = adoptCF(CFURLCreateWithFileSystemPath(0, sandboxProfileDirectoryPath.createCFString().get(), kCFURLPOSIXPathStyle, TRUE));
 
     RetainPtr<CFStringRef> sandboxFileName = CFStringCreateWithFormat(0, 0, CFSTR("%@.sb"), bundleIdentifier);
     RetainPtr<CFURLRef> sandboxURL = adoptCF(CFURLCreateWithFileSystemPathRelativeToBase(0, sandboxFileName.get(), kCFURLPOSIXPathStyle, FALSE, sandboxProfileDirectory.get()));
diff --git a/Source/WebKit2/Scripts/webkit2/messages.py b/Source/WebKit2/Scripts/webkit2/messages.py
index f1cd50389..69a9e352e 100644
--- a/Source/WebKit2/Scripts/webkit2/messages.py
+++ b/Source/WebKit2/Scripts/webkit2/messages.py
@@ -131,6 +131,7 @@ def message_to_struct_declaration(message):
     result.append('    static const Kind messageID = %s;\n' % message.id())
     result.append('    static CoreIPC::StringReference receiverName() { return messageReceiverName(); }\n')
     result.append('    static CoreIPC::StringReference name() { return CoreIPC::StringReference("%s"); }\n' % message.name)
+    result.append('    static const bool isSync = %s;\n' % ('false', 'true')[message.reply_parameters != None])
     result.append('\n')
     if message.reply_parameters != None:
         if message.has_attribute(DELAYED_ATTRIBUTE):
@@ -317,7 +318,7 @@ def handler_function(receiver, message):
     return '%s::%s' % (receiver.name, message.name[0].lower() + message.name[1:])
 
 
-def async_case_statement(receiver, message):
+def async_message_statement(receiver, message):
     dispatch_function_args = ['decoder', 'this', '&%s' % handler_function(receiver, message)]
     dispatch_function = 'handleMessage'
     if message.has_attribute(VARIADIC_ATTRIBUTE):
@@ -327,16 +328,16 @@ def async_case_statement(receiver, message):
         dispatch_function_args.insert(0, 'connection')
         
     result = []
-    result.append('    case Messages::%s::%s:\n' % (receiver.name, message.id()))
-
+    result.append('    if (decoder.messageName() == Messages::%s::%s::name()) {\n' % (receiver.name, message.name))
     result.append('        CoreIPC::%s<Messages::%s::%s>(%s);\n' % (dispatch_function, receiver.name, message.name, ', '.join(dispatch_function_args)))
     if message.has_attribute(DISPATCH_ON_CONNECTION_QUEUE_ATTRIBUTE):
         result.append('        didHandleMessage = true;\n')
     result.append('        return;\n')
+    result.append('    }\n')
     return surround_in_condition(''.join(result), message.condition)
 
 
-def sync_case_statement(receiver, message):
+def sync_message_statement(receiver, message):
     dispatch_function = 'handleMessage'
     if message.has_attribute(DELAYED_ATTRIBUTE):
         dispatch_function += 'Delayed'
@@ -344,10 +345,10 @@ def sync_case_statement(receiver, message):
         dispatch_function += 'Variadic'
 
     result = []
-    result.append('    case Messages::%s::%s:\n' % (receiver.name, message.id()))
+    result.append('    if (decoder.messageName() == Messages::%s::%s::name()) {\n' % (receiver.name, message.name))
     result.append('        CoreIPC::%s<Messages::%s::%s>(%sdecoder, %sreplyEncoder, this, &%s);\n' % (dispatch_function, receiver.name, message.name, 'connection, ' if message.has_attribute(DELAYED_ATTRIBUTE) else '', '' if message.has_attribute(DELAYED_ATTRIBUTE) else '*', handler_function(receiver, message)))
     result.append('        return;\n')
-
+    result.append('    }\n')
     return surround_in_condition(''.join(result), message.condition)
 
 
@@ -387,6 +388,7 @@ def headers_for_type(type):
         'WTF::String': ['<wtf/text/WTFString.h>'],
         'WebCore::CompositionUnderline': ['<WebCore/Editor.h>'],
         'WebCore::GrammarDetail': ['<WebCore/TextCheckerClient.h>'],
+        'WebCore::GraphicsLayerAnimations': ['<WebCore/GraphicsLayerAnimation.h>'],
         'WebCore::KeyframeValueList': ['<WebCore/GraphicsLayer.h>'],
         'WebCore::KeypressCommand': ['<WebCore/KeyboardEvent.h>'],
         'WebCore::FileChooserSettings': ['<WebCore/FileChooser.h>'],
@@ -545,42 +547,30 @@ def generate_message_handler(file):
                 async_messages.append(message)
 
     if async_dispatch_on_connection_queue_messages:
-        result.append('void %s::didReceive%sMessageOnConnectionWorkQueue(CoreIPC::Connection* connection, CoreIPC::MessageID messageID, CoreIPC::MessageDecoder& decoder, bool& didHandleMessage)\n' % (receiver.name, receiver.name))
+        result.append('void %s::didReceive%sMessageOnConnectionWorkQueue(CoreIPC::Connection* connection, CoreIPC::MessageID, CoreIPC::MessageDecoder& decoder, bool& didHandleMessage)\n' % (receiver.name, receiver.name))
         result.append('{\n')
         result.append('#if COMPILER(MSVC)\n')
         result.append('#pragma warning(push)\n')
         result.append('#pragma warning(disable: 4065)\n')
         result.append('#endif\n')
-        result.append('    switch (messageID.get<Messages::%s::Kind>()) {\n' % receiver.name)
-        result += [async_case_statement(receiver, message) for message in async_dispatch_on_connection_queue_messages]
-        result.append('    default:\n')
-        result.append('        return;\n')
-        result.append('    }\n')
+        result += [async_message_statement(receiver, message) for message in async_dispatch_on_connection_queue_messages]
         result.append('#if COMPILER(MSVC)\n')
         result.append('#pragma warning(pop)\n')
         result.append('#endif\n')
         result.append('}\n\n')
 
     if async_messages:
-        result.append('void %s::didReceive%sMessage(CoreIPC::Connection*, CoreIPC::MessageID messageID, CoreIPC::MessageDecoder& decoder)\n' % (receiver.name, receiver.name))
+        result.append('void %s::didReceive%sMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::MessageDecoder& decoder)\n' % (receiver.name, receiver.name))
         result.append('{\n')
-        result.append('    switch (messageID.get<Messages::%s::Kind>()) {\n' % receiver.name)
-        result += [async_case_statement(receiver, message) for message in async_messages]
-        result.append('    default:\n')
-        result.append('        break;\n')
-        result.append('    }\n\n')
+        result += [async_message_statement(receiver, message) for message in async_messages]
         result.append('    ASSERT_NOT_REACHED();\n')
         result.append('}\n')
 
     if sync_messages:
         result.append('\n')
-        result.append('void %s::didReceiveSync%sMessage(CoreIPC::Connection*%s, CoreIPC::MessageID messageID, CoreIPC::MessageDecoder& decoder, OwnPtr<CoreIPC::MessageEncoder>& replyEncoder)\n' % (receiver.name, receiver.name, ' connection' if sync_delayed_messages else ''))
+        result.append('void %s::didReceiveSync%sMessage(CoreIPC::Connection*%s, CoreIPC::MessageID, CoreIPC::MessageDecoder& decoder, OwnPtr<CoreIPC::MessageEncoder>& replyEncoder)\n' % (receiver.name, receiver.name, ' connection' if sync_delayed_messages else ''))
         result.append('{\n')
-        result.append('    switch (messageID.get<Messages::%s::Kind>()) {\n' % receiver.name)
-        result += [sync_case_statement(receiver, message) for message in sync_messages]
-        result.append('    default:\n')
-        result.append('        break;\n')
-        result.append('    }\n\n')
+        result += [sync_message_statement(receiver, message) for message in sync_messages]
         result.append('    ASSERT_NOT_REACHED();\n')
         result.append('}\n')
 
diff --git a/Source/WebKit2/Scripts/webkit2/messages_unittest.py b/Source/WebKit2/Scripts/webkit2/messages_unittest.py
index f4fa1eee8..6b1ebfd2f 100644
--- a/Source/WebKit2/Scripts/webkit2/messages_unittest.py
+++ b/Source/WebKit2/Scripts/webkit2/messages_unittest.py
@@ -382,6 +382,7 @@ struct LoadURL : CoreIPC::Arguments1<const WTF::String&> {
     static const Kind messageID = LoadURLID;
     static CoreIPC::StringReference receiverName() { return messageReceiverName(); }
     static CoreIPC::StringReference name() { return CoreIPC::StringReference("LoadURL"); }
+    static const bool isSync = false;
 
     typedef CoreIPC::Arguments1<const WTF::String&> DecodeType;
     explicit LoadURL(const WTF::String& url)
@@ -395,6 +396,7 @@ struct TouchEvent : CoreIPC::Arguments1<const WebKit::WebTouchEvent&> {
     static const Kind messageID = TouchEventID;
     static CoreIPC::StringReference receiverName() { return messageReceiverName(); }
     static CoreIPC::StringReference name() { return CoreIPC::StringReference("TouchEvent"); }
+    static const bool isSync = false;
 
     typedef CoreIPC::Arguments1<const WebKit::WebTouchEvent&> DecodeType;
     explicit TouchEvent(const WebKit::WebTouchEvent& event)
@@ -408,6 +410,7 @@ struct DidReceivePolicyDecision : CoreIPC::Arguments3<uint64_t, uint64_t, uint32
     static const Kind messageID = DidReceivePolicyDecisionID;
     static CoreIPC::StringReference receiverName() { return messageReceiverName(); }
     static CoreIPC::StringReference name() { return CoreIPC::StringReference("DidReceivePolicyDecision"); }
+    static const bool isSync = false;
 
     typedef CoreIPC::Arguments3<uint64_t, uint64_t, uint32_t> DecodeType;
     DidReceivePolicyDecision(uint64_t frameID, uint64_t listenerID, uint32_t policyAction)
@@ -420,6 +423,7 @@ struct Close : CoreIPC::Arguments0 {
     static const Kind messageID = CloseID;
     static CoreIPC::StringReference receiverName() { return messageReceiverName(); }
     static CoreIPC::StringReference name() { return CoreIPC::StringReference("Close"); }
+    static const bool isSync = false;
 
     typedef CoreIPC::Arguments0 DecodeType;
 };
@@ -428,6 +432,7 @@ struct PreferencesDidChange : CoreIPC::Arguments1<const WebKit::WebPreferencesSt
     static const Kind messageID = PreferencesDidChangeID;
     static CoreIPC::StringReference receiverName() { return messageReceiverName(); }
     static CoreIPC::StringReference name() { return CoreIPC::StringReference("PreferencesDidChange"); }
+    static const bool isSync = false;
 
     typedef CoreIPC::Arguments1<const WebKit::WebPreferencesStore&> DecodeType;
     explicit PreferencesDidChange(const WebKit::WebPreferencesStore& store)
@@ -440,6 +445,7 @@ struct SendDoubleAndFloat : CoreIPC::Arguments2<double, float> {
     static const Kind messageID = SendDoubleAndFloatID;
     static CoreIPC::StringReference receiverName() { return messageReceiverName(); }
     static CoreIPC::StringReference name() { return CoreIPC::StringReference("SendDoubleAndFloat"); }
+    static const bool isSync = false;
 
     typedef CoreIPC::Arguments2<double, float> DecodeType;
     SendDoubleAndFloat(double d, float f)
@@ -452,6 +458,7 @@ struct SendInts : CoreIPC::Arguments2<const Vector<uint64_t>&, const Vector<Vect
     static const Kind messageID = SendIntsID;
     static CoreIPC::StringReference receiverName() { return messageReceiverName(); }
     static CoreIPC::StringReference name() { return CoreIPC::StringReference("SendInts"); }
+    static const bool isSync = false;
 
     typedef CoreIPC::Arguments2<const Vector<uint64_t>&, const Vector<Vector<uint64_t> >&> DecodeType;
     SendInts(const Vector<uint64_t>& ints, const Vector<Vector<uint64_t> >& intVectors)
@@ -464,6 +471,7 @@ struct CreatePlugin : CoreIPC::Arguments2<uint64_t, const WebKit::Plugin::Parame
     static const Kind messageID = CreatePluginID;
     static CoreIPC::StringReference receiverName() { return messageReceiverName(); }
     static CoreIPC::StringReference name() { return CoreIPC::StringReference("CreatePlugin"); }
+    static const bool isSync = true;
 
     typedef CoreIPC::Arguments1<bool&> Reply;
     typedef CoreIPC::Arguments2<uint64_t, const WebKit::Plugin::Parameters&> DecodeType;
@@ -477,6 +485,7 @@ struct RunJavaScriptAlert : CoreIPC::Arguments2<uint64_t, const WTF::String&> {
     static const Kind messageID = RunJavaScriptAlertID;
     static CoreIPC::StringReference receiverName() { return messageReceiverName(); }
     static CoreIPC::StringReference name() { return CoreIPC::StringReference("RunJavaScriptAlert"); }
+    static const bool isSync = true;
 
     typedef CoreIPC::Arguments0 Reply;
     typedef CoreIPC::Arguments2<uint64_t, const WTF::String&> DecodeType;
@@ -490,6 +499,7 @@ struct GetPlugins : CoreIPC::Arguments1<bool> {
     static const Kind messageID = GetPluginsID;
     static CoreIPC::StringReference receiverName() { return messageReceiverName(); }
     static CoreIPC::StringReference name() { return CoreIPC::StringReference("GetPlugins"); }
+    static const bool isSync = true;
 
     typedef CoreIPC::Arguments1<Vector<WebCore::PluginInfo>&> Reply;
     typedef CoreIPC::Arguments1<bool> DecodeType;
@@ -503,6 +513,7 @@ struct GetPluginProcessConnection : CoreIPC::Arguments1<const WTF::String&> {
     static const Kind messageID = GetPluginProcessConnectionID;
     static CoreIPC::StringReference receiverName() { return messageReceiverName(); }
     static CoreIPC::StringReference name() { return CoreIPC::StringReference("GetPluginProcessConnection"); }
+    static const bool isSync = true;
 
     struct DelayedReply : public ThreadSafeRefCounted<DelayedReply> {
         DelayedReply(PassRefPtr<CoreIPC::Connection>, PassOwnPtr<CoreIPC::MessageEncoder>);
@@ -527,6 +538,7 @@ struct TestMultipleAttributes : CoreIPC::Arguments0 {
     static const Kind messageID = TestMultipleAttributesID;
     static CoreIPC::StringReference receiverName() { return messageReceiverName(); }
     static CoreIPC::StringReference name() { return CoreIPC::StringReference("TestMultipleAttributes"); }
+    static const bool isSync = true;
 
     struct DelayedReply : public ThreadSafeRefCounted<DelayedReply> {
         DelayedReply(PassRefPtr<CoreIPC::Connection>, PassOwnPtr<CoreIPC::MessageEncoder>);
@@ -547,6 +559,7 @@ struct TestConnectionQueue : CoreIPC::Arguments1<uint64_t> {
     static const Kind messageID = TestConnectionQueueID;
     static CoreIPC::StringReference receiverName() { return messageReceiverName(); }
     static CoreIPC::StringReference name() { return CoreIPC::StringReference("TestConnectionQueue"); }
+    static const bool isSync = false;
 
     typedef CoreIPC::Arguments1<uint64_t> DecodeType;
     explicit TestConnectionQueue(uint64_t pluginID)
@@ -559,6 +572,7 @@ struct TestParameterAttributes : CoreIPC::Arguments3<uint64_t, double, double> {
     static const Kind messageID = TestParameterAttributesID;
     static CoreIPC::StringReference receiverName() { return messageReceiverName(); }
     static CoreIPC::StringReference name() { return CoreIPC::StringReference("TestParameterAttributes"); }
+    static const bool isSync = false;
 
     typedef CoreIPC::Arguments3<uint64_t, double, double> DecodeType;
     TestParameterAttributes(uint64_t foo, double bar, double baz)
@@ -572,6 +586,7 @@ struct DidCreateWebProcessConnection : CoreIPC::Arguments1<const CoreIPC::MachPo
     static const Kind messageID = DidCreateWebProcessConnectionID;
     static CoreIPC::StringReference receiverName() { return messageReceiverName(); }
     static CoreIPC::StringReference name() { return CoreIPC::StringReference("DidCreateWebProcessConnection"); }
+    static const bool isSync = false;
 
     typedef CoreIPC::Arguments1<const CoreIPC::MachPort&> DecodeType;
     explicit DidCreateWebProcessConnection(const CoreIPC::MachPort& connectionIdentifier)
@@ -586,6 +601,7 @@ struct InterpretKeyEvent : CoreIPC::Arguments1<uint32_t> {
     static const Kind messageID = InterpretKeyEventID;
     static CoreIPC::StringReference receiverName() { return messageReceiverName(); }
     static CoreIPC::StringReference name() { return CoreIPC::StringReference("InterpretKeyEvent"); }
+    static const bool isSync = true;
 
     typedef CoreIPC::Arguments1<Vector<WebCore::KeypressCommand>&> Reply;
     typedef CoreIPC::Arguments1<uint32_t> DecodeType;
@@ -601,6 +617,7 @@ struct DeprecatedOperation : CoreIPC::Arguments1<const CoreIPC::DummyType&> {
     static const Kind messageID = DeprecatedOperationID;
     static CoreIPC::StringReference receiverName() { return messageReceiverName(); }
     static CoreIPC::StringReference name() { return CoreIPC::StringReference("DeprecatedOperation"); }
+    static const bool isSync = false;
 
     typedef CoreIPC::Arguments1<const CoreIPC::DummyType&> DecodeType;
     explicit DeprecatedOperation(const CoreIPC::DummyType& dummy)
@@ -615,6 +632,7 @@ struct ExperimentalOperation : CoreIPC::Arguments1<const CoreIPC::DummyType&> {
     static const Kind messageID = ExperimentalOperationID;
     static CoreIPC::StringReference receiverName() { return messageReceiverName(); }
     static CoreIPC::StringReference name() { return CoreIPC::StringReference("ExperimentalOperation"); }
+    static const bool isSync = false;
 
     typedef CoreIPC::Arguments1<const CoreIPC::DummyType&> DecodeType;
     explicit ExperimentalOperation(const CoreIPC::DummyType& dummy)
@@ -743,97 +761,99 @@ bool TestMultipleAttributes::DelayedReply::send()
 
 namespace WebKit {
 
-void WebPage::didReceiveWebPageMessageOnConnectionWorkQueue(CoreIPC::Connection* connection, CoreIPC::MessageID messageID, CoreIPC::MessageDecoder& decoder, bool& didHandleMessage)
+void WebPage::didReceiveWebPageMessageOnConnectionWorkQueue(CoreIPC::Connection* connection, CoreIPC::MessageID, CoreIPC::MessageDecoder& decoder, bool& didHandleMessage)
 {
 #if COMPILER(MSVC)
 #pragma warning(push)
 #pragma warning(disable: 4065)
 #endif
-    switch (messageID.get<Messages::WebPage::Kind>()) {
-    case Messages::WebPage::TestConnectionQueueID:
+    if (decoder.messageName() == Messages::WebPage::TestConnectionQueue::name()) {
         CoreIPC::handleMessageOnConnectionQueue<Messages::WebPage::TestConnectionQueue>(connection, decoder, this, &WebPage::testConnectionQueue);
         didHandleMessage = true;
         return;
-    default:
-        return;
     }
 #if COMPILER(MSVC)
 #pragma warning(pop)
 #endif
 }
 
-void WebPage::didReceiveWebPageMessage(CoreIPC::Connection*, CoreIPC::MessageID messageID, CoreIPC::MessageDecoder& decoder)
+void WebPage::didReceiveWebPageMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::MessageDecoder& decoder)
 {
-    switch (messageID.get<Messages::WebPage::Kind>()) {
-    case Messages::WebPage::LoadURLID:
+    if (decoder.messageName() == Messages::WebPage::LoadURL::name()) {
         CoreIPC::handleMessage<Messages::WebPage::LoadURL>(decoder, this, &WebPage::loadURL);
         return;
+    }
 #if ENABLE(TOUCH_EVENTS)
-    case Messages::WebPage::TouchEventID:
+    if (decoder.messageName() == Messages::WebPage::TouchEvent::name()) {
         CoreIPC::handleMessage<Messages::WebPage::TouchEvent>(decoder, this, &WebPage::touchEvent);
         return;
+    }
 #endif
-    case Messages::WebPage::DidReceivePolicyDecisionID:
+    if (decoder.messageName() == Messages::WebPage::DidReceivePolicyDecision::name()) {
         CoreIPC::handleMessage<Messages::WebPage::DidReceivePolicyDecision>(decoder, this, &WebPage::didReceivePolicyDecision);
         return;
-    case Messages::WebPage::CloseID:
+    }
+    if (decoder.messageName() == Messages::WebPage::Close::name()) {
         CoreIPC::handleMessage<Messages::WebPage::Close>(decoder, this, &WebPage::close);
         return;
-    case Messages::WebPage::PreferencesDidChangeID:
+    }
+    if (decoder.messageName() == Messages::WebPage::PreferencesDidChange::name()) {
         CoreIPC::handleMessage<Messages::WebPage::PreferencesDidChange>(decoder, this, &WebPage::preferencesDidChange);
         return;
-    case Messages::WebPage::SendDoubleAndFloatID:
+    }
+    if (decoder.messageName() == Messages::WebPage::SendDoubleAndFloat::name()) {
         CoreIPC::handleMessage<Messages::WebPage::SendDoubleAndFloat>(decoder, this, &WebPage::sendDoubleAndFloat);
         return;
-    case Messages::WebPage::SendIntsID:
+    }
+    if (decoder.messageName() == Messages::WebPage::SendInts::name()) {
         CoreIPC::handleMessage<Messages::WebPage::SendInts>(decoder, this, &WebPage::sendInts);
         return;
-    case Messages::WebPage::TestParameterAttributesID:
+    }
+    if (decoder.messageName() == Messages::WebPage::TestParameterAttributes::name()) {
         CoreIPC::handleMessage<Messages::WebPage::TestParameterAttributes>(decoder, this, &WebPage::testParameterAttributes);
         return;
+    }
 #if PLATFORM(MAC)
-    case Messages::WebPage::DidCreateWebProcessConnectionID:
+    if (decoder.messageName() == Messages::WebPage::DidCreateWebProcessConnection::name()) {
         CoreIPC::handleMessage<Messages::WebPage::DidCreateWebProcessConnection>(decoder, this, &WebPage::didCreateWebProcessConnection);
         return;
+    }
 #endif
 #if ENABLE(DEPRECATED_FEATURE)
-    case Messages::WebPage::DeprecatedOperationID:
+    if (decoder.messageName() == Messages::WebPage::DeprecatedOperation::name()) {
         CoreIPC::handleMessage<Messages::WebPage::DeprecatedOperation>(decoder, this, &WebPage::deprecatedOperation);
         return;
+    }
 #endif
 #if ENABLE(EXPERIMENTAL_FEATURE)
-    case Messages::WebPage::ExperimentalOperationID:
+    if (decoder.messageName() == Messages::WebPage::ExperimentalOperation::name()) {
         CoreIPC::handleMessage<Messages::WebPage::ExperimentalOperation>(decoder, this, &WebPage::experimentalOperation);
         return;
-#endif
-    default:
-        break;
     }
-
+#endif
     ASSERT_NOT_REACHED();
 }
 
-void WebPage::didReceiveSyncWebPageMessage(CoreIPC::Connection* connection, CoreIPC::MessageID messageID, CoreIPC::MessageDecoder& decoder, OwnPtr<CoreIPC::MessageEncoder>& replyEncoder)
+void WebPage::didReceiveSyncWebPageMessage(CoreIPC::Connection* connection, CoreIPC::MessageID, CoreIPC::MessageDecoder& decoder, OwnPtr<CoreIPC::MessageEncoder>& replyEncoder)
 {
-    switch (messageID.get<Messages::WebPage::Kind>()) {
-    case Messages::WebPage::CreatePluginID:
+    if (decoder.messageName() == Messages::WebPage::CreatePlugin::name()) {
         CoreIPC::handleMessage<Messages::WebPage::CreatePlugin>(decoder, *replyEncoder, this, &WebPage::createPlugin);
         return;
-    case Messages::WebPage::RunJavaScriptAlertID:
+    }
+    if (decoder.messageName() == Messages::WebPage::RunJavaScriptAlert::name()) {
         CoreIPC::handleMessage<Messages::WebPage::RunJavaScriptAlert>(decoder, *replyEncoder, this, &WebPage::runJavaScriptAlert);
         return;
-    case Messages::WebPage::GetPluginProcessConnectionID:
+    }
+    if (decoder.messageName() == Messages::WebPage::GetPluginProcessConnection::name()) {
         CoreIPC::handleMessageDelayed<Messages::WebPage::GetPluginProcessConnection>(connection, decoder, replyEncoder, this, &WebPage::getPluginProcessConnection);
         return;
+    }
 #if PLATFORM(MAC)
-    case Messages::WebPage::InterpretKeyEventID:
+    if (decoder.messageName() == Messages::WebPage::InterpretKeyEvent::name()) {
         CoreIPC::handleMessage<Messages::WebPage::InterpretKeyEvent>(decoder, *replyEncoder, this, &WebPage::interpretKeyEvent);
         return;
-#endif
-    default:
-        break;
     }
-
+#endif
     ASSERT_NOT_REACHED();
 }
 
diff --git a/Source/WebKit2/Shared/API/c/WKSharedAPICast.h b/Source/WebKit2/Shared/API/c/WKSharedAPICast.h
index ff9a50fe3..380cd25c2 100644
--- a/Source/WebKit2/Shared/API/c/WKSharedAPICast.h
+++ b/Source/WebKit2/Shared/API/c/WKSharedAPICast.h
@@ -39,6 +39,7 @@
 #include "WebEvent.h"
 #include "WebFindOptions.h"
 #include "WebNumber.h"
+#include "WebSecurityOrigin.h"
 #include "WebString.h"
 #include "WebURL.h"
 #include "WebURLRequest.h"
@@ -48,6 +49,7 @@
 #include <WebCore/FrameLoaderTypes.h>
 #include <WebCore/IntRect.h>
 #include <WebCore/LayoutMilestones.h>
+#include <WebCore/SecurityOrigin.h>
 #include <WebCore/UserContentTypes.h>
 #include <WebCore/UserScriptTypes.h>
 #include <wtf/TypeTraits.h>
@@ -197,6 +199,13 @@ inline ProxyingRefPtr<WebURLResponse> toAPI(const WebCore::ResourceResponse& res
     return ProxyingRefPtr<WebURLResponse>(WebURLResponse::create(response));
 }
 
+inline WKSecurityOriginRef toCopiedAPI(WebCore::SecurityOrigin* origin)
+{
+    if (!origin)
+        return 0;
+    return toAPI(WebSecurityOrigin::create(origin).leakRef());
+}
+
 /* Geometry conversions */
 
 inline WebCore::FloatRect toFloatRect(const WKRect& wkRect)
diff --git a/Source/WebKit2/Shared/API/c/cf/WKStringCF.cpp b/Source/WebKit2/Shared/API/c/cf/WKStringCF.cpp
index 9a49e5ad4..f5ab62908 100644
--- a/Source/WebKit2/Shared/API/c/cf/WKStringCF.cpp
+++ b/Source/WebKit2/Shared/API/c/cf/WKStringCF.cpp
@@ -44,5 +44,7 @@ CFStringRef WKStringCopyCFString(CFAllocatorRef allocatorRef, WKStringRef string
 
     // NOTE: This does not use StringImpl::createCFString() since that function
     // expects to be called on the thread running WebCore.
-    return CFStringCreateWithCharacters(allocatorRef, reinterpret_cast<const UniChar*>(toImpl(stringRef)->string().characters()), toImpl(stringRef)->string().length());
+    if (toImpl(stringRef)->string().is8Bit())
+        return CFStringCreateWithBytes(allocatorRef, reinterpret_cast<const UInt8*>(toImpl(stringRef)->string().characters8()), toImpl(stringRef)->string().length(), kCFStringEncodingISOLatin1, true);
+    return CFStringCreateWithCharacters(allocatorRef, reinterpret_cast<const UniChar*>(toImpl(stringRef)->string().characters16()), toImpl(stringRef)->string().length());
 }
diff --git a/Source/WebKit2/Shared/ChildProcess.cpp b/Source/WebKit2/Shared/ChildProcess.cpp
index b65eebe2c..344d54c91 100644
--- a/Source/WebKit2/Shared/ChildProcess.cpp
+++ b/Source/WebKit2/Shared/ChildProcess.cpp
@@ -60,9 +60,15 @@ ChildProcess::ChildProcess()
     : m_terminationTimeout(0)
     , m_terminationCounter(0)
     , m_terminationTimer(RunLoop::main(), this, &ChildProcess::terminationTimerFired)
+#if PLATFORM(MAC)
+    , m_applicationIsOccluded(false)
+#endif
 {
     // FIXME: The termination timer should not be scheduled on the main run loop.
     // It won't work with the threaded mode, but it's not really useful anyway as is.
+#if PLATFORM(MAC)
+    disableProcessSuppression(processSuppressionVisibleApplicationReason);
+#endif
 }
 
 ChildProcess::~ChildProcess()
diff --git a/Source/WebKit2/Shared/ChildProcess.h b/Source/WebKit2/Shared/ChildProcess.h
index 9ec1a50d9..4428a40ab 100644
--- a/Source/WebKit2/Shared/ChildProcess.h
+++ b/Source/WebKit2/Shared/ChildProcess.h
@@ -29,6 +29,10 @@
 #include "Connection.h"
 #include <WebCore/RunLoop.h>
 
+#if PLATFORM(MAC)
+OBJC_CLASS NSString;
+#endif
+
 namespace WebKit {
 
 class ChildProcess : protected CoreIPC::Connection::Client {
@@ -57,6 +61,11 @@ public:
         ChildProcess& m_childProcess;
     };
 
+#if PLATFORM(MAC)
+    bool applicationIsOccluded() const { return m_applicationIsOccluded; }
+    void setApplicationIsOccluded(bool);
+#endif
+
     static void didCloseOnConnectionWorkQueue(WorkQueue&, CoreIPC::Connection*);
 
 protected:
@@ -71,6 +80,13 @@ private:
     virtual bool shouldTerminate() = 0;
     virtual void terminate();
 
+#if PLATFORM(MAC)
+    void disableProcessSuppression(NSString *reason);
+    void enableProcessSuppression(NSString *reason);
+
+    static NSString * const processSuppressionVisibleApplicationReason;
+#endif
+
     // The timeout, in seconds, before this process will be terminated if termination
     // has been enabled. If the timeout is 0 seconds, the process will be terminated immediately.
     double m_terminationTimeout;
@@ -80,6 +96,10 @@ private:
     unsigned m_terminationCounter;
 
     WebCore::RunLoop::Timer<ChildProcess> m_terminationTimer;
+
+#if PLATFORM(MAC)
+    bool m_applicationIsOccluded;
+#endif
 };
 
 } // namespace WebKit
diff --git a/Source/WebKit2/Shared/CoordinatedGraphics/CoordinatedGraphicsArgumentCoders.cpp b/Source/WebKit2/Shared/CoordinatedGraphics/CoordinatedGraphicsArgumentCoders.cpp
index a237288b4..0ffe40659 100644
--- a/Source/WebKit2/Shared/CoordinatedGraphics/CoordinatedGraphicsArgumentCoders.cpp
+++ b/Source/WebKit2/Shared/CoordinatedGraphics/CoordinatedGraphicsArgumentCoders.cpp
@@ -33,9 +33,19 @@
 #include <WebCore/Animation.h>
 #include <WebCore/Color.h>
 #include <WebCore/FloatPoint3D.h>
+#include <WebCore/GraphicsLayerAnimation.h>
+#include <WebCore/IdentityTransformOperation.h>
 #include <WebCore/IntPoint.h>
 #include <WebCore/Length.h>
+#include <WebCore/Matrix3DTransformOperation.h>
+#include <WebCore/MatrixTransformOperation.h>
+#include <WebCore/PerspectiveTransformOperation.h>
+#include <WebCore/RotateTransformOperation.h>
+#include <WebCore/ScaleTransformOperation.h>
+#include <WebCore/SkewTransformOperation.h>
+#include <WebCore/TimingFunction.h>
 #include <WebCore/TransformationMatrix.h>
+#include <WebCore/TranslateTransformOperation.h>
 
 #if ENABLE(CSS_FILTERS)
 #include <WebCore/FilterOperations.h>
@@ -44,20 +54,14 @@
 #if ENABLE(CSS_SHADERS)
 #include "WebCustomFilterProgram.h"
 #include <WebCore/CustomFilterArrayParameter.h>
+#include <WebCore/CustomFilterConstants.h>
 #include <WebCore/CustomFilterNumberParameter.h>
 #include <WebCore/CustomFilterOperation.h>
 #include <WebCore/CustomFilterProgram.h>
 #include <WebCore/CustomFilterTransformParameter.h>
-#include <WebCore/IdentityTransformOperation.h>
-#include <WebCore/Matrix3DTransformOperation.h>
-#include <WebCore/MatrixTransformOperation.h>
-#include <WebCore/PerspectiveTransformOperation.h>
-#include <WebCore/RotateTransformOperation.h>
-#include <WebCore/ScaleTransformOperation.h>
-#include <WebCore/SkewTransformOperation.h>
-#include <WebCore/TranslateTransformOperation.h>
 #endif
 
+
 #if USE(GRAPHICS_SURFACE)
 #include <WebCore/GraphicsSurface.h>
 #endif
@@ -69,7 +73,7 @@ using namespace WebKit;
 
 namespace CoreIPC {
 
-void ArgumentCoder<FloatPoint3D>::encode(ArgumentEncoder* encoder, const FloatPoint3D& floatPoint3D)
+void ArgumentCoder<FloatPoint3D>::encode(ArgumentEncoder& encoder, const FloatPoint3D& floatPoint3D)
 {
     SimpleArgumentCoder<FloatPoint3D>::encode(encoder, floatPoint3D);
 }
@@ -79,7 +83,7 @@ bool ArgumentCoder<FloatPoint3D>::decode(ArgumentDecoder* decoder, FloatPoint3D&
     return SimpleArgumentCoder<FloatPoint3D>::decode(decoder, floatPoint3D);
 }
 
-void ArgumentCoder<Length>::encode(ArgumentEncoder* encoder, const Length& length)
+void ArgumentCoder<Length>::encode(ArgumentEncoder& encoder, const Length& length)
 {
     SimpleArgumentCoder<Length>::encode(encoder, length);
 }
@@ -89,7 +93,7 @@ bool ArgumentCoder<Length>::decode(ArgumentDecoder* decoder, Length& length)
     return SimpleArgumentCoder<Length>::decode(decoder, length);
 }
 
-void ArgumentCoder<TransformationMatrix>::encode(ArgumentEncoder* encoder, const TransformationMatrix& transformationMatrix)
+void ArgumentCoder<TransformationMatrix>::encode(ArgumentEncoder& encoder, const TransformationMatrix& transformationMatrix)
 {
     SimpleArgumentCoder<TransformationMatrix>::encode(encoder, transformationMatrix);
 }
@@ -100,25 +104,25 @@ bool ArgumentCoder<TransformationMatrix>::decode(ArgumentDecoder* decoder, Trans
 }
 
 #if ENABLE(CSS_FILTERS)
-void ArgumentCoder<WebCore::FilterOperations>::encode(ArgumentEncoder* encoder, const WebCore::FilterOperations& filters)
+void ArgumentCoder<WebCore::FilterOperations>::encode(ArgumentEncoder& encoder, const WebCore::FilterOperations& filters)
 {
-    encoder->encode(static_cast<uint32_t>(filters.size()));
+    encoder << static_cast<uint32_t>(filters.size());
     for (size_t i = 0; i < filters.size(); ++i) {
         const FilterOperation* filter = filters.at(i);
         FilterOperation::OperationType type = filter->getOperationType();
-        encoder->encodeEnum(type);
+        encoder.encodeEnum(type);
         switch (type) {
         case FilterOperation::GRAYSCALE:
         case FilterOperation::SEPIA:
         case FilterOperation::SATURATE:
         case FilterOperation::HUE_ROTATE:
-            encoder->encode(static_cast<double>(static_cast<const BasicColorMatrixFilterOperation*>(filter)->amount()));
+            encoder << static_cast<double>(static_cast<const BasicColorMatrixFilterOperation*>(filter)->amount());
             break;
         case FilterOperation::INVERT:
         case FilterOperation::BRIGHTNESS:
         case FilterOperation::CONTRAST:
         case FilterOperation::OPACITY:
-            encoder->encode(static_cast<double>(static_cast<const BasicComponentTransferFilterOperation*>(filter)->amount()));
+            encoder << static_cast<double>(static_cast<const BasicComponentTransferFilterOperation*>(filter)->amount());
             break;
         case FilterOperation::BLUR:
             ArgumentCoder<Length>::encode(encoder, static_cast<const BlurFilterOperation*>(filter)->stdDeviation());
@@ -126,7 +130,7 @@ void ArgumentCoder<WebCore::FilterOperations>::encode(ArgumentEncoder* encoder,
         case FilterOperation::DROP_SHADOW: {
             const DropShadowFilterOperation* shadow = static_cast<const DropShadowFilterOperation*>(filter);
             ArgumentCoder<IntPoint>::encode(encoder, shadow->location());
-            encoder->encode(static_cast<int32_t>(shadow->stdDeviation()));
+            encoder << static_cast<int32_t>(shadow->stdDeviation());
             ArgumentCoder<Color>::encode(encoder, shadow->color());
             break;
         }
@@ -137,34 +141,34 @@ void ArgumentCoder<WebCore::FilterOperations>::encode(ArgumentEncoder* encoder,
             ASSERT(customOperation->program());
             RefPtr<CustomFilterProgram> program = customOperation->program();
             ASSERT(program->isLoaded());
-            CustomFilterProgramInfo programInfo = program->programInfo();
-            encoder->encode(programInfo.vertexShaderString());
-            encoder->encode(programInfo.fragmentShaderString());
-            encoder->encodeEnum(program->programType());
-            CustomFilterProgramMixSettings mixSettings = programInfo.mixSettings();
-            encoder->encodeEnum(mixSettings.blendMode);
-            encoder->encodeEnum(mixSettings.compositeOperator);
+            encoder << program->vertexShaderString();
+            encoder << program->fragmentShaderString();
+            encoder.encodeEnum(program->programType());
+            CustomFilterProgramMixSettings mixSettings = program->mixSettings();
+            encoder.encodeEnum(mixSettings.blendMode);
+            encoder.encodeEnum(mixSettings.compositeOperator);
+            encoder.encodeEnum(program->meshType());
 
             CustomFilterParameterList parameters = customOperation->parameters();
-            encoder->encode(static_cast<uint32_t>(parameters.size()));
+            encoder << static_cast<uint32_t>(parameters.size());
             for (size_t i = 0; i < parameters.size(); ++i) {
                 RefPtr<CustomFilterParameter> parameter = parameters[i];
-                encoder->encode(parameter->name());
-                encoder->encodeEnum(parameter->parameterType());
+                encoder << parameter->name();
+                encoder.encodeEnum(parameter->parameterType());
 
                 switch (parameter->parameterType()) {
                 case CustomFilterParameter::ARRAY: {
                     CustomFilterArrayParameter* arrayParameter = static_cast<CustomFilterArrayParameter*>(parameter.get());
-                    encoder->encode(static_cast<uint32_t>(arrayParameter->size()));
+                    encoder << static_cast<uint32_t>(arrayParameter->size());
                     for (size_t j = 0; j < arrayParameter->size(); ++j)
-                        encoder->encode(arrayParameter->valueAt(j));
+                        encoder << arrayParameter->valueAt(j);
                     break;
                 }
                 case CustomFilterParameter::NUMBER: {
                     CustomFilterNumberParameter* nubmerParameter = static_cast<CustomFilterNumberParameter*>(parameter.get());
-                    encoder->encode(static_cast<uint32_t>(nubmerParameter->size()));
+                    encoder << static_cast<uint32_t>(nubmerParameter->size());
                     for (size_t j = 0; j < nubmerParameter->size(); ++j)
-                        encoder->encode(nubmerParameter->valueAt(j));
+                        encoder << nubmerParameter->valueAt(j);
                     break;
                 }
                 case CustomFilterParameter::TRANSFORM: {
@@ -175,10 +179,9 @@ void ArgumentCoder<WebCore::FilterOperations>::encode(ArgumentEncoder* encoder,
                 }
             }
 
-            encoder->encode(customOperation->meshRows());
-            encoder->encode(customOperation->meshColumns());
-            encoder->encodeEnum(customOperation->meshBoxType());
-            encoder->encodeEnum(customOperation->meshType());
+            encoder << customOperation->meshRows();
+            encoder << customOperation->meshColumns();
+            encoder.encodeEnum(customOperation->meshBoxType());
             break;
         }
 #endif
@@ -249,6 +252,7 @@ bool ArgumentCoder<WebCore::FilterOperations>::decode(ArgumentDecoder* decoder,
             String fragmentShaderString;
             CustomFilterProgramType programType;
             CustomFilterProgramMixSettings mixSettings;
+            CustomFilterMeshType meshType;
             if (!decoder->decode(vertexShaderString))
                 return false;
             if (!decoder->decode(fragmentShaderString))
@@ -259,7 +263,9 @@ bool ArgumentCoder<WebCore::FilterOperations>::decode(ArgumentDecoder* decoder,
                 return false;
             if (!decoder->decodeEnum(mixSettings.compositeOperator))
                 return false;
-            RefPtr<CustomFilterProgram> program = WebCustomFilterProgram::create(vertexShaderString, fragmentShaderString, programType, mixSettings);
+            if (!decoder->decodeEnum(meshType))
+                return false;
+            RefPtr<CustomFilterProgram> program = WebCustomFilterProgram::create(vertexShaderString, fragmentShaderString, programType, mixSettings, meshType);
 
             uint32_t parametersSize;
             if (!decoder->decodeUInt32(parametersSize))
@@ -277,7 +283,6 @@ bool ArgumentCoder<WebCore::FilterOperations>::decode(ArgumentDecoder* decoder,
                 switch (parameterType) {
                 case CustomFilterParameter::ARRAY: {
                     RefPtr<CustomFilterArrayParameter> arrayParameter = CustomFilterArrayParameter::create(name);
-                    parameters.append(arrayParameter);
                     uint32_t arrayParameterSize;
                     if (!decoder->decodeUInt32(arrayParameterSize))
                         return false;
@@ -287,11 +292,11 @@ bool ArgumentCoder<WebCore::FilterOperations>::decode(ArgumentDecoder* decoder,
                             return false;
                         arrayParameter->addValue(arrayParameterValue);
                     }
+                    parameters[i] = arrayParameter.release();
                     break;
                 }
                 case CustomFilterParameter::NUMBER: {
                     RefPtr<CustomFilterNumberParameter> numberParameter = CustomFilterNumberParameter::create(name);
-                    parameters.append(numberParameter);
                     uint32_t numberParameterSize;
                     if (!decoder->decodeUInt32(numberParameterSize))
                         return false;
@@ -301,15 +306,16 @@ bool ArgumentCoder<WebCore::FilterOperations>::decode(ArgumentDecoder* decoder,
                             return false;
                         numberParameter->addValue(numberParameterValue);
                     }
+                    parameters[i] = numberParameter.release();
                     break;
                 }
                 case CustomFilterParameter::TRANSFORM: {
                     RefPtr<CustomFilterTransformParameter> transformParameter = CustomFilterTransformParameter::create(name);
-                    parameters.append(transformParameter);
                     TransformOperations operations;
                     if (!ArgumentCoder<TransformOperations>::decode(decoder, operations))
                         return false;
                     transformParameter->setOperations(operations);
+                    parameters[i] = transformParameter.release();
                     break;
                 }
                 }
@@ -317,16 +323,13 @@ bool ArgumentCoder<WebCore::FilterOperations>::decode(ArgumentDecoder* decoder,
 
             unsigned meshRows;
             unsigned meshColumns;
-            CustomFilterOperation::MeshBoxType meshBoxType;
-            CustomFilterOperation::MeshType meshType;
+            CustomFilterMeshBoxType meshBoxType;
             if (!decoder->decode(meshRows))
                 return false;
             if (!decoder->decode(meshColumns))
                 return false;
             if (!decoder->decodeEnum(meshBoxType))
                 return false;
-            if (!decoder->decodeEnum(meshType))
-                return false;
 
             filter = CustomFilterOperation::create(program, parameters, meshRows, meshColumns, meshBoxType, meshType);
             break;
@@ -344,13 +347,12 @@ bool ArgumentCoder<WebCore::FilterOperations>::decode(ArgumentDecoder* decoder,
 }
 #endif
 
-#if ENABLE(CSS_SHADERS)
-void ArgumentCoder<TransformOperations>::encode(ArgumentEncoder* encoder, const TransformOperations& transformOperations)
+void ArgumentCoder<TransformOperations>::encode(ArgumentEncoder& encoder, const TransformOperations& transformOperations)
 {
-    encoder->encode(static_cast<uint32_t>(transformOperations.size()));
+    encoder << static_cast<uint32_t>(transformOperations.size());
     for (size_t i = 0; i < transformOperations.size(); ++i) {
         const TransformOperation* operation = transformOperations.at(i);
-        encoder->encodeEnum(operation->getOperationType());
+        encoder.encodeEnum(operation->getOperationType());
 
         switch (operation->getOperationType()) {
         case TransformOperation::SCALE_X:
@@ -358,9 +360,9 @@ void ArgumentCoder<TransformOperations>::encode(ArgumentEncoder* encoder, const
         case TransformOperation::SCALE:
         case TransformOperation::SCALE_Z:
         case TransformOperation::SCALE_3D:
-            encoder->encode(static_cast<const ScaleTransformOperation*>(operation)->x());
-            encoder->encode(static_cast<const ScaleTransformOperation*>(operation)->y());
-            encoder->encode(static_cast<const ScaleTransformOperation*>(operation)->z());
+            encoder << static_cast<const ScaleTransformOperation*>(operation)->x();
+            encoder << static_cast<const ScaleTransformOperation*>(operation)->y();
+            encoder << static_cast<const ScaleTransformOperation*>(operation)->z();
             break;
         case TransformOperation::TRANSLATE_X:
         case TransformOperation::TRANSLATE_Y:
@@ -375,16 +377,16 @@ void ArgumentCoder<TransformOperations>::encode(ArgumentEncoder* encoder, const
         case TransformOperation::ROTATE_X:
         case TransformOperation::ROTATE_Y:
         case TransformOperation::ROTATE_3D:
-            encoder->encode(static_cast<const RotateTransformOperation*>(operation)->x());
-            encoder->encode(static_cast<const RotateTransformOperation*>(operation)->y());
-            encoder->encode(static_cast<const RotateTransformOperation*>(operation)->z());
-            encoder->encode(static_cast<const RotateTransformOperation*>(operation)->angle());
+            encoder << static_cast<const RotateTransformOperation*>(operation)->x();
+            encoder << static_cast<const RotateTransformOperation*>(operation)->y();
+            encoder << static_cast<const RotateTransformOperation*>(operation)->z();
+            encoder << static_cast<const RotateTransformOperation*>(operation)->angle();
             break;
         case TransformOperation::SKEW_X:
         case TransformOperation::SKEW_Y:
         case TransformOperation::SKEW:
-            encoder->encode(static_cast<const SkewTransformOperation*>(operation)->angleX());
-            encoder->encode(static_cast<const SkewTransformOperation*>(operation)->angleY());
+            encoder << static_cast<const SkewTransformOperation*>(operation)->angleX();
+            encoder << static_cast<const SkewTransformOperation*>(operation)->angleY();
             break;
         case TransformOperation::MATRIX:
             ArgumentCoder<TransformationMatrix>::encode(encoder, static_cast<const MatrixTransformOperation*>(operation)->matrix());
@@ -504,30 +506,262 @@ bool ArgumentCoder<TransformOperations>::decode(ArgumentDecoder* decoder, Transf
     }
     return true;
 }
+
+static void encodeTimingFunction(ArgumentEncoder& encoder, const TimingFunction* timingFunction)
+{
+    if (!timingFunction) {
+        encoder.encodeEnum(TimingFunction::TimingFunctionType(-1));
+        return;
+    }
+
+    TimingFunction::TimingFunctionType type = timingFunction ? timingFunction->type() : TimingFunction::LinearFunction;
+    encoder.encodeEnum(type);
+    switch (type) {
+    case TimingFunction::LinearFunction:
+        break;
+    case TimingFunction::CubicBezierFunction: {
+        const CubicBezierTimingFunction* cubic = static_cast<const CubicBezierTimingFunction*>(timingFunction);
+        encoder << cubic->x1();
+        encoder << cubic->y1();
+        encoder << cubic->x2();
+        encoder << cubic->y2();
+        break;
+    }
+    case TimingFunction::StepsFunction: {
+        const StepsTimingFunction* steps = static_cast<const StepsTimingFunction*>(timingFunction);
+        encoder << static_cast<uint32_t>(steps->numberOfSteps());
+        encoder << steps->stepAtStart();
+        break;
+    }
+    }
+}
+
+bool decodeTimingFunction(ArgumentDecoder* decoder, RefPtr<TimingFunction>& timingFunction)
+{
+    TimingFunction::TimingFunctionType type;
+    if (!decoder->decodeEnum(type))
+        return false;
+
+    if (type == TimingFunction::TimingFunctionType(-1))
+        return true;
+
+    switch (type) {
+    case TimingFunction::LinearFunction:
+        timingFunction = LinearTimingFunction::create();
+        return true;
+    case TimingFunction::CubicBezierFunction: {
+        double x1, y1, x2, y2;
+        if (!decoder->decodeDouble(x1))
+            return false;
+        if (!decoder->decodeDouble(y1))
+            return false;
+        if (!decoder->decodeDouble(x2))
+            return false;
+        if (!decoder->decodeDouble(y2))
+            return false;
+
+        timingFunction = CubicBezierTimingFunction::create(x1, y1, x2, y2);
+        return true;
+    }
+    case TimingFunction::StepsFunction: {
+        uint32_t numberOfSteps;
+        bool stepAtStart;
+        if (!decoder->decodeUInt32(numberOfSteps))
+            return false;
+        if (!decoder->decodeBool(stepAtStart))
+            return false;
+
+        timingFunction = StepsTimingFunction::create(numberOfSteps, stepAtStart);
+        return true;
+    }
+    }
+
+    return false;
+}
+
+void ArgumentCoder<GraphicsLayerAnimation>::encode(ArgumentEncoder& encoder, const GraphicsLayerAnimation& animation)
+{
+    encoder << animation.name();
+    encoder << animation.boxSize();
+    encoder.encodeEnum(animation.state());
+    encoder << animation.startTime();
+    encoder << animation.pauseTime();
+    encoder << animation.listsMatch();
+
+    RefPtr<Animation> animationObject = animation.animation();
+    encoder.encodeEnum(animationObject->direction());
+    encoder << static_cast<uint32_t>(animationObject->fillMode());
+    encoder << animationObject->duration();
+    encoder << animationObject->iterationCount();
+    encodeTimingFunction(encoder, animationObject->timingFunction().get());
+
+    const KeyframeValueList& keyframes = animation.keyframes();
+    encoder.encodeEnum(keyframes.property());
+    encoder << static_cast<uint32_t>(keyframes.size());
+    for (size_t i = 0; i < keyframes.size(); ++i) {
+        const AnimationValue* value = keyframes.at(i);
+        encoder << value->keyTime();
+        encodeTimingFunction(encoder, value->timingFunction());
+        switch (keyframes.property()) {
+        case AnimatedPropertyOpacity:
+            encoder << static_cast<const FloatAnimationValue*>(value)->value();
+            break;
+        case AnimatedPropertyWebkitTransform:
+            encoder << *static_cast<const TransformAnimationValue*>(value)->value();
+            break;
+#if ENABLE(CSS_FILTERS)
+        case AnimatedPropertyWebkitFilter:
+            encoder << *static_cast<const FilterAnimationValue*>(value)->value();
+            break;
 #endif
+        default:
+            break;
+        }
+    }
+}
+
+bool ArgumentCoder<GraphicsLayerAnimation>::decode(ArgumentDecoder* decoder, GraphicsLayerAnimation& animation)
+{
+    String name;
+    IntSize boxSize;
+    GraphicsLayerAnimation::AnimationState state;
+    double startTime;
+    double pauseTime;
+    bool listsMatch;
+
+    Animation::AnimationDirection direction;
+    unsigned fillMode;
+    double duration;
+    double iterationCount;
+    RefPtr<TimingFunction> timingFunction;
+    RefPtr<Animation> animationObject;
+
+    if (!decoder->decode(name))
+        return false;
+    if (!decoder->decode(boxSize))
+        return false;
+    if (!decoder->decodeEnum(state))
+        return false;
+    if (!decoder->decodeDouble(startTime))
+        return false;
+    if (!decoder->decodeDouble(pauseTime))
+        return false;
+    if (!decoder->decodeBool(listsMatch))
+        return false;
+    if (!decoder->decodeEnum(direction))
+        return false;
+    if (!decoder->decodeUInt32(fillMode))
+        return false;
+    if (!decoder->decodeDouble(duration))
+        return false;
+    if (!decoder->decodeDouble(iterationCount))
+        return false;
+    if (!decodeTimingFunction(decoder, timingFunction))
+        return false;
+
+    animationObject = Animation::create();
+    animationObject->setDirection(direction);
+    animationObject->setFillMode(fillMode);
+    animationObject->setDuration(duration);
+    animationObject->setIterationCount(iterationCount);
+    if (timingFunction)
+        animationObject->setTimingFunction(timingFunction);
+
+    AnimatedPropertyID property;
+    if (!decoder->decodeEnum(property))
+        return false;
+    KeyframeValueList keyframes(property);
+    unsigned keyframesSize;
+    if (!decoder->decodeUInt32(keyframesSize))
+        return false;
+    for (unsigned i = 0; i < keyframesSize; ++i) {
+        float keyTime;
+        RefPtr<TimingFunction> timingFunction;
+        if (!decoder->decode(keyTime))
+            return false;
+        if (!decodeTimingFunction(decoder, timingFunction))
+            return false;
+
+        switch (property) {
+        case AnimatedPropertyOpacity: {
+            float value;
+            if (!decoder->decodeFloat(value))
+                return false;
+            keyframes.insert(new FloatAnimationValue(keyTime, value, timingFunction));
+            break;
+        }
+        case AnimatedPropertyWebkitTransform: {
+            TransformOperations transform;
+            if (!decoder->decode(transform))
+                return false;
+            keyframes.insert(new TransformAnimationValue(keyTime, &transform, timingFunction));
+            break;
+        }
+#if ENABLE(CSS_FILTERS)
+        case AnimatedPropertyWebkitFilter: {
+            FilterOperations filter;
+            if (!decoder->decode(filter))
+                return false;
+            keyframes.insert(new FilterAnimationValue(keyTime, &filter, timingFunction));
+            break;
+        }
+#endif
+        default:
+            break;
+        }
+    }
+
+    animation = GraphicsLayerAnimation(name, keyframes, boxSize, animationObject.get(), startTime, listsMatch);
+    animation.setState(state, pauseTime);
+
+    return true;
+}
+
+void ArgumentCoder<GraphicsLayerAnimations>::encode(ArgumentEncoder& encoder, const GraphicsLayerAnimations& animations)
+{
+    encoder << animations.animations();
+}
+
+bool ArgumentCoder<GraphicsLayerAnimations>::decode(ArgumentDecoder* decoder, GraphicsLayerAnimations& animations)
+{
+    return decoder->decode(animations.animations());
+}
 
 #if USE(GRAPHICS_SURFACE)
-void ArgumentCoder<WebCore::GraphicsSurfaceToken>::encode(ArgumentEncoder* encoder, const WebCore::GraphicsSurfaceToken& token)
+void ArgumentCoder<WebCore::GraphicsSurfaceToken>::encode(ArgumentEncoder& encoder, const WebCore::GraphicsSurfaceToken& token)
 {
 #if OS(DARWIN)
-    encoder->encode(static_cast<uint32_t>(token.frontBufferHandle));
-    encoder->encode(static_cast<uint32_t>(token.backBufferHandle));
-#endif
-#if OS(LINUX)
-    encoder->encode(static_cast<uint32_t>(token.frontBufferHandle));
+    encoder << Attachment(token.frontBufferHandle, MACH_MSG_TYPE_MOVE_SEND);
+    encoder << Attachment(token.backBufferHandle, MACH_MSG_TYPE_MOVE_SEND);
+#elif OS(WINDOWS)
+    encoder << reinterpret_cast<uint64_t>(token.frontBufferHandle);
+    encoder << reinterpret_cast<uint64_t>(token.backBufferHandle);
+#elif OS(LINUX)
+    encoder << token.frontBufferHandle;
 #endif
 }
 
 bool ArgumentCoder<WebCore::GraphicsSurfaceToken>::decode(ArgumentDecoder* decoder, WebCore::GraphicsSurfaceToken& token)
 {
-#if OS(DARWIN)
-    if (!decoder->decodeUInt32(token.frontBufferHandle))
+#if OS(WINDOWS)
+    uint64_t frontBufferHandle;
+    if (!decoder->decode(frontBufferHandle))
         return false;
-    if (!decoder->decodeUInt32(token.backBufferHandle))
+    token.frontBufferHandle = reinterpret_cast<GraphicsSurfaceToken::BufferHandle>(frontBufferHandle);
+    uint64_t backBufferHandle;
+    if (!decoder->decode(backBufferHandle))
         return false;
-#endif
-#if OS(LINUX)
-    if (!decoder->decodeUInt32(token.frontBufferHandle))
+    token.backBufferHandle = reinterpret_cast<GraphicsSurfaceToken::BufferHandle>(backBufferHandle);
+#elif OS(DARWIN)
+    Attachment frontAttachment, backAttachment;
+    if (!decoder->decode(frontAttachment))
+        return false;
+    if (!decoder->decode(backAttachment))
+        return false;
+
+    token = GraphicsSurfaceToken(frontAttachment.port(), backAttachment.port());
+#elif OS(LINUX)
+    if (!decoder->decode(token.frontBufferHandle))
         return false;
 #endif
     return true;
@@ -535,4 +769,5 @@ bool ArgumentCoder<WebCore::GraphicsSurfaceToken>::decode(ArgumentDecoder* decod
 #endif
 
 } // namespace CoreIPC
+
 #endif // USE(COORDINATED_GRAPHICS)
diff --git a/Source/WebKit2/Shared/CoordinatedGraphics/CoordinatedGraphicsArgumentCoders.h b/Source/WebKit2/Shared/CoordinatedGraphics/CoordinatedGraphicsArgumentCoders.h
index 87b4c5fe7..8544a5342 100644
--- a/Source/WebKit2/Shared/CoordinatedGraphics/CoordinatedGraphicsArgumentCoders.h
+++ b/Source/WebKit2/Shared/CoordinatedGraphics/CoordinatedGraphicsArgumentCoders.h
@@ -33,17 +33,16 @@
 
 namespace WebCore {
 class FloatPoint3D;
+class GraphicsLayerAnimation;
+class GraphicsLayerAnimations;
 class TransformationMatrix;
+class TransformOperations;
 struct Length;
 
 #if ENABLE(CSS_FILTERS)
 class FilterOperations;
 #endif
 
-#if ENABLE(CSS_SHADERS)
-class TransformOperations;
-#endif
-
 #if USE(GRAPHICS_SURFACE)
 struct GraphicsSurfaceToken;
 #endif
@@ -52,42 +51,51 @@ struct GraphicsSurfaceToken;
 namespace CoreIPC {
 
 template<> struct ArgumentCoder<WebCore::FloatPoint3D> {
-    static void encode(ArgumentEncoder*, const WebCore::FloatPoint3D&);
+    static void encode(ArgumentEncoder&, const WebCore::FloatPoint3D&);
     static bool decode(ArgumentDecoder*, WebCore::FloatPoint3D&);
 };
 
 template<> struct ArgumentCoder<WebCore::Length> {
-    static void encode(ArgumentEncoder*, const WebCore::Length&);
+    static void encode(ArgumentEncoder&, const WebCore::Length&);
     static bool decode(ArgumentDecoder*, WebCore::Length&);
 };
 
 template<> struct ArgumentCoder<WebCore::TransformationMatrix> {
-    static void encode(ArgumentEncoder*, const WebCore::TransformationMatrix&);
+    static void encode(ArgumentEncoder&, const WebCore::TransformationMatrix&);
     static bool decode(ArgumentDecoder*, WebCore::TransformationMatrix&);
 };
 
 #if ENABLE(CSS_FILTERS)
 template<> struct ArgumentCoder<WebCore::FilterOperations> {
-    static void encode(ArgumentEncoder*, const WebCore::FilterOperations&);
+    static void encode(ArgumentEncoder&, const WebCore::FilterOperations&);
     static bool decode(ArgumentDecoder*, WebCore::FilterOperations&);
 };
 #endif
 
-#if ENABLE(CSS_SHADERS)
 template<> struct ArgumentCoder<WebCore::TransformOperations> {
-    static void encode(ArgumentEncoder*, const WebCore::TransformOperations&);
+    static void encode(ArgumentEncoder&, const WebCore::TransformOperations&);
     static bool decode(ArgumentDecoder*, WebCore::TransformOperations&);
 };
-#endif
+
+template<> struct ArgumentCoder<WebCore::GraphicsLayerAnimations> {
+    static void encode(ArgumentEncoder&, const WebCore::GraphicsLayerAnimations&);
+    static bool decode(ArgumentDecoder*, WebCore::GraphicsLayerAnimations&);
+};
+
+template<> struct ArgumentCoder<WebCore::GraphicsLayerAnimation> {
+    static void encode(ArgumentEncoder&, const WebCore::GraphicsLayerAnimation&);
+    static bool decode(ArgumentDecoder*, WebCore::GraphicsLayerAnimation&);
+};
 
 #if USE(GRAPHICS_SURFACE)
 template<> struct ArgumentCoder<WebCore::GraphicsSurfaceToken> {
-    static void encode(ArgumentEncoder*, const WebCore::GraphicsSurfaceToken&);
+    static void encode(ArgumentEncoder&, const WebCore::GraphicsSurfaceToken&);
     static bool decode(ArgumentDecoder*, WebCore::GraphicsSurfaceToken&);
 };
 #endif
 
 } // namespace CoreIPC
+
 #endif // USE(COORDINATED_GRAPHICS)
 
 #endif // CoordinatedGraphicsArgumentCoders_h
diff --git a/Source/WebKit2/Shared/CoordinatedGraphics/WebCustomFilterProgram.h b/Source/WebKit2/Shared/CoordinatedGraphics/WebCustomFilterProgram.h
index eb097c295..603618dcb 100644
--- a/Source/WebKit2/Shared/CoordinatedGraphics/WebCustomFilterProgram.h
+++ b/Source/WebKit2/Shared/CoordinatedGraphics/WebCustomFilterProgram.h
@@ -27,15 +27,16 @@
 #define WebCustomFilterProgram_h
 
 #if USE(COORDINATED_GRAPHICS) && ENABLE(CSS_SHADERS)
+#include <WebCore/CustomFilterConstants.h>
 #include <WebCore/CustomFilterProgram.h>
 
 namespace WebKit {
 
 class WebCustomFilterProgram : public WebCore::CustomFilterProgram {
 public:
-    static PassRefPtr<WebCustomFilterProgram> create(String vertexShaderString, String m_fragmentShaderString, WebCore::CustomFilterProgramType programType, WebCore::CustomFilterProgramMixSettings mixSettings)
+    static PassRefPtr<WebCustomFilterProgram> create(String vertexShaderString, String m_fragmentShaderString, WebCore::CustomFilterProgramType programType, WebCore::CustomFilterProgramMixSettings mixSettings, WebCore::CustomFilterMeshType meshType)
     {
-        return adoptRef(new WebCustomFilterProgram(vertexShaderString, m_fragmentShaderString, programType, mixSettings));
+        return adoptRef(new WebCustomFilterProgram(vertexShaderString, m_fragmentShaderString, programType, mixSettings, meshType));
     }
 
     virtual bool isLoaded() const OVERRIDE { return true; }
@@ -55,8 +56,8 @@ protected:
     virtual void didRemoveLastClient() OVERRIDE { }
 
 private:
-    WebCustomFilterProgram(String vertexShaderString, String fragmentShaderString, WebCore::CustomFilterProgramType programType, WebCore::CustomFilterProgramMixSettings mixSettings)
-        : WebCore::CustomFilterProgram(programType, mixSettings)
+    WebCustomFilterProgram(String vertexShaderString, String fragmentShaderString, WebCore::CustomFilterProgramType programType, WebCore::CustomFilterProgramMixSettings mixSettings, WebCore::CustomFilterMeshType meshType)
+        : WebCore::CustomFilterProgram(programType, mixSettings, meshType)
         , m_vertexShaderString(vertexShaderString)
         , m_fragmentShaderString(fragmentShaderString)
     {
diff --git a/Source/WebKit2/Shared/DictionaryPopupInfo.cpp b/Source/WebKit2/Shared/DictionaryPopupInfo.cpp
index 7e6df3a5c..f14eea3c7 100644
--- a/Source/WebKit2/Shared/DictionaryPopupInfo.cpp
+++ b/Source/WebKit2/Shared/DictionaryPopupInfo.cpp
@@ -34,15 +34,15 @@
 
 namespace WebKit {
 
-void DictionaryPopupInfo::encode(CoreIPC::ArgumentEncoder* encoder) const
+void DictionaryPopupInfo::encode(CoreIPC::ArgumentEncoder& encoder) const
 {
-    encoder->encode(origin);
-    encoder->encode(fontInfo);
-    encoder->encodeEnum(type);
+    encoder << origin;
+    encoder << fontInfo;
+    encoder.encodeEnum(type);
 
 #if PLATFORM(MAC) && __MAC_OS_X_VERSION_MIN_REQUIRED >= 1070
     bool hadOptions = options;
-    encoder->encode(hadOptions);
+    encoder << hadOptions;
     if (hadOptions)
         CoreIPC::encode(encoder, options.get());
 #endif
diff --git a/Source/WebKit2/Shared/DictionaryPopupInfo.h b/Source/WebKit2/Shared/DictionaryPopupInfo.h
index bcec04c45..27eb6db37 100644
--- a/Source/WebKit2/Shared/DictionaryPopupInfo.h
+++ b/Source/WebKit2/Shared/DictionaryPopupInfo.h
@@ -41,7 +41,7 @@ namespace CoreIPC {
 namespace WebKit {
 
 struct DictionaryPopupInfo {
-    void encode(CoreIPC::ArgumentEncoder*) const;
+    void encode(CoreIPC::ArgumentEncoder&) const;
     static bool decode(CoreIPC::ArgumentDecoder*, DictionaryPopupInfo&);
 
     enum Type {
diff --git a/Source/WebKit2/Shared/DrawingAreaInfo.h b/Source/WebKit2/Shared/DrawingAreaInfo.h
index c0e11658f..ae4ed76b4 100644
--- a/Source/WebKit2/Shared/DrawingAreaInfo.h
+++ b/Source/WebKit2/Shared/DrawingAreaInfo.h
@@ -33,6 +33,9 @@ enum DrawingAreaType {
 #if PLATFORM(MAC) && ENABLE(THREADED_SCROLLING)
     DrawingAreaTypeTiledCoreAnimation,
 #endif
+#if PLATFORM(MAC)
+    DrawingAreaTypeRemoteLayerTree,
+#endif
 };
 
 } // namespace WebKit
diff --git a/Source/WebKit2/Shared/EditorState.cpp b/Source/WebKit2/Shared/EditorState.cpp
index 6e44a0f15..f7bde2a5c 100644
--- a/Source/WebKit2/Shared/EditorState.cpp
+++ b/Source/WebKit2/Shared/EditorState.cpp
@@ -31,25 +31,25 @@
 
 namespace WebKit {
 
-void EditorState::encode(CoreIPC::ArgumentEncoder* encoder) const
+void EditorState::encode(CoreIPC::ArgumentEncoder& encoder) const
 {
-    encoder->encode(shouldIgnoreCompositionSelectionChange);
-    encoder->encode(selectionIsNone);
-    encoder->encode(selectionIsRange);
-    encoder->encode(isContentEditable);
-    encoder->encode(isContentRichlyEditable);
-    encoder->encode(isInPasswordField);
-    encoder->encode(hasComposition);
+    encoder << shouldIgnoreCompositionSelectionChange;
+    encoder << selectionIsNone;
+    encoder << selectionIsRange;
+    encoder << isContentEditable;
+    encoder << isContentRichlyEditable;
+    encoder << isInPasswordField;
+    encoder << hasComposition;
 
 #if PLATFORM(QT)
-    encoder->encode(cursorPosition);
-    encoder->encode(anchorPosition);
-    encoder->encode(editorRect);
-    encoder->encode(cursorRect);
-    encoder->encode(compositionRect);
-    encoder->encode(inputMethodHints);
-    encoder->encode(selectedText);
-    encoder->encode(surroundingText);
+    encoder << cursorPosition;
+    encoder << anchorPosition;
+    encoder << editorRect;
+    encoder << cursorRect;
+    encoder << compositionRect;
+    encoder << inputMethodHints;
+    encoder << selectedText;
+    encoder << surroundingText;
 #endif
 }
 
diff --git a/Source/WebKit2/Shared/EditorState.h b/Source/WebKit2/Shared/EditorState.h
index ac1d793ac..06ea087b8 100644
--- a/Source/WebKit2/Shared/EditorState.h
+++ b/Source/WebKit2/Shared/EditorState.h
@@ -74,7 +74,7 @@ struct EditorState {
     WTF::String surroundingText;
 #endif
 
-    void encode(CoreIPC::ArgumentEncoder*) const;
+    void encode(CoreIPC::ArgumentEncoder&) const;
     static bool decode(CoreIPC::ArgumentDecoder*, EditorState&);
 };
 
diff --git a/Source/WebKit2/Shared/FontInfo.cpp b/Source/WebKit2/Shared/FontInfo.cpp
index cd0263045..33ed47428 100644
--- a/Source/WebKit2/Shared/FontInfo.cpp
+++ b/Source/WebKit2/Shared/FontInfo.cpp
@@ -34,10 +34,10 @@
 
 namespace WebKit {
 
-void FontInfo::encode(CoreIPC::ArgumentEncoder* encoder) const
+void FontInfo::encode(CoreIPC::ArgumentEncoder& encoder) const
 {
 #if PLATFORM(MAC)
-    encoder->encode(static_cast<bool>(fontAttributeDictionary));
+    encoder << static_cast<bool>(fontAttributeDictionary);
     if (fontAttributeDictionary)
         CoreIPC::encode(encoder, fontAttributeDictionary.get());
 #else
diff --git a/Source/WebKit2/Shared/FontInfo.h b/Source/WebKit2/Shared/FontInfo.h
index 23ea945ca..ae11d1275 100644
--- a/Source/WebKit2/Shared/FontInfo.h
+++ b/Source/WebKit2/Shared/FontInfo.h
@@ -38,7 +38,7 @@ namespace CoreIPC {
 namespace WebKit {
     
 struct FontInfo {
-    void encode(CoreIPC::ArgumentEncoder*) const;
+    void encode(CoreIPC::ArgumentEncoder&) const;
     static bool decode(CoreIPC::ArgumentDecoder*, FontInfo&);
     
 #if PLATFORM(MAC)
diff --git a/Source/WebKit2/Shared/IntentData.cpp b/Source/WebKit2/Shared/IntentData.cpp
index 41078747c..757819e45 100644
--- a/Source/WebKit2/Shared/IntentData.cpp
+++ b/Source/WebKit2/Shared/IntentData.cpp
@@ -56,15 +56,15 @@ IntentData::IntentData(Intent* coreIntent)
     }
 }
 
-void IntentData::encode(CoreIPC::ArgumentEncoder* encoder) const
+void IntentData::encode(CoreIPC::ArgumentEncoder& encoder) const
 {
-    encoder->encode(action);
-    encoder->encode(type);
-    encoder->encode(service);
-    encoder->encode(CoreIPC::DataReference(data));
-    encoder->encode(extras);
-    encoder->encode(suggestions);
-    encoder->encode(messagePorts);
+    encoder.encode(action);
+    encoder.encode(type);
+    encoder.encode(service);
+    encoder.encode(CoreIPC::DataReference(data));
+    encoder.encode(extras);
+    encoder.encode(suggestions);
+    encoder.encode(messagePorts);
 }
 
 bool IntentData::decode(CoreIPC::ArgumentDecoder* decoder, IntentData& intentData)
diff --git a/Source/WebKit2/Shared/IntentData.h b/Source/WebKit2/Shared/IntentData.h
index e8435c284..e3adb190e 100644
--- a/Source/WebKit2/Shared/IntentData.h
+++ b/Source/WebKit2/Shared/IntentData.h
@@ -48,7 +48,7 @@ struct IntentData {
     IntentData() { }
     explicit IntentData(WebCore::Intent*);
 
-    void encode(CoreIPC::ArgumentEncoder*) const;
+    void encode(CoreIPC::ArgumentEncoder&) const;
     static bool decode(CoreIPC::ArgumentDecoder*, IntentData&);
 
     String action;
diff --git a/Source/WebKit2/Shared/IntentServiceInfo.cpp b/Source/WebKit2/Shared/IntentServiceInfo.cpp
index bd954847f..340200ed1 100644
--- a/Source/WebKit2/Shared/IntentServiceInfo.cpp
+++ b/Source/WebKit2/Shared/IntentServiceInfo.cpp
@@ -35,13 +35,13 @@ using namespace WebCore;
 
 namespace WebKit {
 
-void IntentServiceInfo::encode(CoreIPC::ArgumentEncoder* encoder) const
+void IntentServiceInfo::encode(CoreIPC::ArgumentEncoder& encoder) const
 {
-    encoder->encode(action);
-    encoder->encode(type);
-    encoder->encode(href);
-    encoder->encode(title);
-    encoder->encode(disposition);
+    encoder.encode(action);
+    encoder.encode(type);
+    encoder.encode(href);
+    encoder.encode(title);
+    encoder.encode(disposition);
 }
 
 bool IntentServiceInfo::decode(CoreIPC::ArgumentDecoder* decoder, IntentServiceInfo& intentServiceInfo)
diff --git a/Source/WebKit2/Shared/IntentServiceInfo.h b/Source/WebKit2/Shared/IntentServiceInfo.h
index 59c0470c5..ff13d3b8e 100644
--- a/Source/WebKit2/Shared/IntentServiceInfo.h
+++ b/Source/WebKit2/Shared/IntentServiceInfo.h
@@ -40,7 +40,7 @@ class ArgumentEncoder;
 namespace WebKit {
 
 struct IntentServiceInfo {
-    void encode(CoreIPC::ArgumentEncoder*) const;
+    void encode(CoreIPC::ArgumentEncoder&) const;
     static bool decode(CoreIPC::ArgumentDecoder*, IntentServiceInfo&);
 
     String action;
diff --git a/Source/WebKit2/Shared/LayerTreeContext.h b/Source/WebKit2/Shared/LayerTreeContext.h
index 5206a373c..f8e2fce61 100644
--- a/Source/WebKit2/Shared/LayerTreeContext.h
+++ b/Source/WebKit2/Shared/LayerTreeContext.h
@@ -47,7 +47,7 @@ public:
     LayerTreeContext();
     ~LayerTreeContext();
 
-    void encode(CoreIPC::ArgumentEncoder*) const;
+    void encode(CoreIPC::ArgumentEncoder&) const;
     static bool decode(CoreIPC::ArgumentDecoder*, LayerTreeContext&);
 
     bool isEmpty() const;
diff --git a/Source/WebKit2/Shared/NativeWebKeyboardEvent.h b/Source/WebKit2/Shared/NativeWebKeyboardEvent.h
index 2d3bb10d2..ff54eda36 100644
--- a/Source/WebKit2/Shared/NativeWebKeyboardEvent.h
+++ b/Source/WebKit2/Shared/NativeWebKeyboardEvent.h
@@ -56,7 +56,7 @@ public:
     NativeWebKeyboardEvent(const NativeWebKeyboardEvent&);
     NativeWebKeyboardEvent(GdkEvent*);
 #elif PLATFORM(EFL)
-    NativeWebKeyboardEvent(const Evas_Event_Key_Down*);
+    NativeWebKeyboardEvent(const Evas_Event_Key_Down*, bool);
     NativeWebKeyboardEvent(const Evas_Event_Key_Up*);
 #endif
 
@@ -70,6 +70,7 @@ public:
     GdkEvent* nativeEvent() const { return m_nativeEvent.get(); }
 #elif PLATFORM(EFL)
     const void* nativeEvent() const { return m_nativeEvent; }
+    bool isFiltered() const { return m_isFiltered; }
 #endif
 
 private:
@@ -83,6 +84,7 @@ private:
     GOwnPtr<GdkEvent> m_nativeEvent;
 #elif PLATFORM(EFL)
     const void* m_nativeEvent;
+    bool m_isFiltered;
 #endif
 };
 
diff --git a/Source/WebKit2/Shared/NativeWebMouseEvent.h b/Source/WebKit2/Shared/NativeWebMouseEvent.h
index 2de5c6ce7..c23d2f8f2 100644
--- a/Source/WebKit2/Shared/NativeWebMouseEvent.h
+++ b/Source/WebKit2/Shared/NativeWebMouseEvent.h
@@ -38,6 +38,7 @@ OBJC_CLASS NSView;
 typedef union _GdkEvent GdkEvent;
 #elif PLATFORM(EFL)
 #include <Evas.h>
+#include <WebCore/AffineTransform.h>
 #endif
 
 namespace WebKit {
@@ -54,9 +55,9 @@ public:
     NativeWebMouseEvent(const NativeWebMouseEvent&);
     NativeWebMouseEvent(GdkEvent*, int);
 #elif PLATFORM(EFL)
-    NativeWebMouseEvent(const Evas_Event_Mouse_Down*, const Evas_Point*);
-    NativeWebMouseEvent(const Evas_Event_Mouse_Up*, const Evas_Point*);
-    NativeWebMouseEvent(const Evas_Event_Mouse_Move*, const Evas_Point*);
+    NativeWebMouseEvent(const Evas_Event_Mouse_Down*, const WebCore::AffineTransform&, const WebCore::AffineTransform&);
+    NativeWebMouseEvent(const Evas_Event_Mouse_Up*, const WebCore::AffineTransform&, const WebCore::AffineTransform&);
+    NativeWebMouseEvent(const Evas_Event_Mouse_Move*, const WebCore::AffineTransform&, const WebCore::AffineTransform&);
 #endif
 
 #if USE(APPKIT)
diff --git a/Source/WebKit2/Shared/NativeWebTouchEvent.h b/Source/WebKit2/Shared/NativeWebTouchEvent.h
index 49bbf8010..c63d1cf07 100644
--- a/Source/WebKit2/Shared/NativeWebTouchEvent.h
+++ b/Source/WebKit2/Shared/NativeWebTouchEvent.h
@@ -33,6 +33,7 @@
 #elif PLATFORM(EFL)
 #include "ewk_touch.h"
 #include <Evas.h>
+#include <WebCore/AffineTransform.h>
 #endif
 
 namespace WebKit {
@@ -42,7 +43,7 @@ public:
 #if PLATFORM(QT)
     explicit NativeWebTouchEvent(const QTouchEvent*, const QTransform& fromItemTransform);
 #elif PLATFORM(EFL)
-    NativeWebTouchEvent(Ewk_Touch_Event_Type, const Eina_List*, const Evas_Modifier*, const Evas_Point*, double timestamp);
+    NativeWebTouchEvent(Ewk_Touch_Event_Type, const Eina_List*, const Evas_Modifier*, const WebCore::AffineTransform& toWebContent, const WebCore::AffineTransform& toDeviceScreen, double timestamp);
 #endif
 
 #if PLATFORM(QT)
diff --git a/Source/WebKit2/Shared/NativeWebWheelEvent.h b/Source/WebKit2/Shared/NativeWebWheelEvent.h
index 3721e941b..43d708e30 100644
--- a/Source/WebKit2/Shared/NativeWebWheelEvent.h
+++ b/Source/WebKit2/Shared/NativeWebWheelEvent.h
@@ -38,6 +38,7 @@ OBJC_CLASS NSView;
 typedef union _GdkEvent GdkEvent;
 #elif PLATFORM(EFL)
 #include <Evas.h>
+#include <WebCore/AffineTransform.h>
 #endif
 
 namespace WebKit {
@@ -54,7 +55,7 @@ public:
     NativeWebWheelEvent(const NativeWebWheelEvent&);
     NativeWebWheelEvent(GdkEvent*);
 #elif PLATFORM(EFL)
-    NativeWebWheelEvent(const Evas_Event_Mouse_Wheel*, const Evas_Point*);
+    NativeWebWheelEvent(const Evas_Event_Mouse_Wheel*, const WebCore::AffineTransform& toWebContent, const WebCore::AffineTransform& toDeviceScreen);
 #endif
 
 #if USE(APPKIT)
diff --git a/Source/WebKit2/Shared/Network/NetworkProcessCreationParameters.cpp b/Source/WebKit2/Shared/Network/NetworkProcessCreationParameters.cpp
index efbe3572d..8ea946724 100644
--- a/Source/WebKit2/Shared/Network/NetworkProcessCreationParameters.cpp
+++ b/Source/WebKit2/Shared/Network/NetworkProcessCreationParameters.cpp
@@ -36,10 +36,10 @@ NetworkProcessCreationParameters::NetworkProcessCreationParameters()
 {
 }
 
-void NetworkProcessCreationParameters::encode(CoreIPC::ArgumentEncoder* encoder) const
+void NetworkProcessCreationParameters::encode(CoreIPC::ArgumentEncoder& encoder) const
 {
 #if PLATFORM(MAC)
-    encoder->encode(parentProcessName);
+    encoder << parentProcessName;
 #endif
 }
 
diff --git a/Source/WebKit2/Shared/Network/NetworkProcessCreationParameters.h b/Source/WebKit2/Shared/Network/NetworkProcessCreationParameters.h
index 4f59e2941..ebc03a7ed 100644
--- a/Source/WebKit2/Shared/Network/NetworkProcessCreationParameters.h
+++ b/Source/WebKit2/Shared/Network/NetworkProcessCreationParameters.h
@@ -40,7 +40,7 @@ namespace WebKit {
 struct NetworkProcessCreationParameters {
     NetworkProcessCreationParameters();
 
-    void encode(CoreIPC::ArgumentEncoder*) const;
+    void encode(CoreIPC::ArgumentEncoder&) const;
     static bool decode(CoreIPC::ArgumentDecoder*, NetworkProcessCreationParameters&);
 
 #if PLATFORM(MAC)
diff --git a/Source/WebKit2/Shared/OriginAndDatabases.cpp b/Source/WebKit2/Shared/OriginAndDatabases.cpp
index 0ad0549ad..5d86c2b65 100644
--- a/Source/WebKit2/Shared/OriginAndDatabases.cpp
+++ b/Source/WebKit2/Shared/OriginAndDatabases.cpp
@@ -34,12 +34,12 @@ using namespace WebCore;
 
 namespace WebKit {
 
-void OriginAndDatabases::encode(CoreIPC::ArgumentEncoder* encoder) const
+void OriginAndDatabases::encode(CoreIPC::ArgumentEncoder& encoder) const
 {
-    encoder->encode(originIdentifier);
-    encoder->encode(originQuota);
-    encoder->encode(originUsage);
-    encoder->encode(databases);
+    encoder << originIdentifier;
+    encoder << originQuota;
+    encoder << originUsage;
+    encoder << databases;
 }
 
 bool OriginAndDatabases::decode(CoreIPC::ArgumentDecoder* decoder, OriginAndDatabases& originAndDatabases)
diff --git a/Source/WebKit2/Shared/OriginAndDatabases.h b/Source/WebKit2/Shared/OriginAndDatabases.h
index 51ef4fae7..ec064f91c 100644
--- a/Source/WebKit2/Shared/OriginAndDatabases.h
+++ b/Source/WebKit2/Shared/OriginAndDatabases.h
@@ -40,7 +40,7 @@ namespace CoreIPC {
 namespace WebKit {
 
 struct OriginAndDatabases {
-    void encode(CoreIPC::ArgumentEncoder*) const;
+    void encode(CoreIPC::ArgumentEncoder&) const;
     static bool decode(CoreIPC::ArgumentDecoder*, OriginAndDatabases&);
 
     String originIdentifier;
diff --git a/Source/WebKit2/Shared/PlatformPopupMenuData.cpp b/Source/WebKit2/Shared/PlatformPopupMenuData.cpp
index 1decaacc5..9cb223c54 100644
--- a/Source/WebKit2/Shared/PlatformPopupMenuData.cpp
+++ b/Source/WebKit2/Shared/PlatformPopupMenuData.cpp
@@ -44,28 +44,28 @@ PlatformPopupMenuData::PlatformPopupMenuData()
 {
 }
 
-void PlatformPopupMenuData::encode(CoreIPC::ArgumentEncoder* encoder) const
+void PlatformPopupMenuData::encode(CoreIPC::ArgumentEncoder& encoder) const
 {
 #if PLATFORM(WIN)
-    encoder->encode(m_clientPaddingLeft);
-    encoder->encode(m_clientPaddingRight);
-    encoder->encode(m_clientInsetLeft);
-    encoder->encode(m_clientInsetRight);
-    encoder->encode(m_popupWidth);
-    encoder->encode(m_itemHeight);
+    encoder << m_clientPaddingLeft;
+    encoder << m_clientPaddingRight;
+    encoder << m_clientInsetLeft;
+    encoder << m_clientInsetRight;
+    encoder << m_popupWidth;
+    encoder << m_itemHeight;
 
     ShareableBitmap::Handle notSelectedBackingStoreHandle;
     m_notSelectedBackingStore->createHandle(notSelectedBackingStoreHandle);
-    encoder->encode(notSelectedBackingStoreHandle);
+    encoder << notSelectedBackingStoreHandle;
 
     ShareableBitmap::Handle selectedBackingStoreHandle;
     m_selectedBackingStore->createHandle(selectedBackingStoreHandle);
-    encoder->encode(selectedBackingStoreHandle);
+    encoder << selectedBackingStoreHandle;
 #elif PLATFORM(MAC)
-    encoder->encode(fontInfo);
-    encoder->encode(shouldPopOver);
+    encoder << fontInfo;
+    encoder << shouldPopOver;
 #elif PLATFORM(QT)
-    encoder->encode(multipleSelections);
+    encoder << multipleSelections;
 #else
     UNUSED_PARAM(encoder);
 #endif
diff --git a/Source/WebKit2/Shared/PlatformPopupMenuData.h b/Source/WebKit2/Shared/PlatformPopupMenuData.h
index 21abde4ff..7d9d94d2a 100644
--- a/Source/WebKit2/Shared/PlatformPopupMenuData.h
+++ b/Source/WebKit2/Shared/PlatformPopupMenuData.h
@@ -40,7 +40,7 @@ namespace WebKit {
 struct PlatformPopupMenuData {
     PlatformPopupMenuData();
 
-    void encode(CoreIPC::ArgumentEncoder*) const;
+    void encode(CoreIPC::ArgumentEncoder&) const;
     static bool decode(CoreIPC::ArgumentDecoder*, PlatformPopupMenuData&);
 
 #if PLATFORM(WIN)
diff --git a/Source/WebKit2/Shared/Plugins/NPIdentifierData.cpp b/Source/WebKit2/Shared/Plugins/NPIdentifierData.cpp
index ff2bef140..a297bc438 100644
--- a/Source/WebKit2/Shared/Plugins/NPIdentifierData.cpp
+++ b/Source/WebKit2/Shared/Plugins/NPIdentifierData.cpp
@@ -67,13 +67,13 @@ NPIdentifier NPIdentifierData::createNPIdentifier() const
     return static_cast<NPIdentifier>(IdentifierRep::get(m_number));
 }
 
-void NPIdentifierData::encode(CoreIPC::ArgumentEncoder* encoder) const
+void NPIdentifierData::encode(CoreIPC::ArgumentEncoder& encoder) const
 {
-    encoder->encode(m_isString);
+    encoder << m_isString;
     if (m_isString)
-        encoder->encode(m_string);
+        encoder << m_string;
     else
-        encoder->encode(m_number);
+        encoder << m_number;
 }
 
 bool NPIdentifierData::decode(CoreIPC::ArgumentDecoder* decoder, NPIdentifierData& result)
diff --git a/Source/WebKit2/Shared/Plugins/NPIdentifierData.h b/Source/WebKit2/Shared/Plugins/NPIdentifierData.h
index 1a7c772a7..56d57fc96 100644
--- a/Source/WebKit2/Shared/Plugins/NPIdentifierData.h
+++ b/Source/WebKit2/Shared/Plugins/NPIdentifierData.h
@@ -47,7 +47,7 @@ public:
     static NPIdentifierData fromNPIdentifier(NPIdentifier);
     NPIdentifier createNPIdentifier() const;
 
-    void encode(CoreIPC::ArgumentEncoder*) const;
+    void encode(CoreIPC::ArgumentEncoder&) const;
     static bool decode(CoreIPC::ArgumentDecoder*, NPIdentifierData&);
 
 private:
diff --git a/Source/WebKit2/Shared/Plugins/NPVariantData.cpp b/Source/WebKit2/Shared/Plugins/NPVariantData.cpp
index 04bb3f5bd..db96dc71f 100644
--- a/Source/WebKit2/Shared/Plugins/NPVariantData.cpp
+++ b/Source/WebKit2/Shared/Plugins/NPVariantData.cpp
@@ -118,31 +118,31 @@ NPVariantData NPVariantData::makeRemoteNPObjectID(uint64_t value)
     return npVariantData;
 }
 
-void NPVariantData::encode(CoreIPC::ArgumentEncoder* encoder) const
+void NPVariantData::encode(CoreIPC::ArgumentEncoder& encoder) const
 {
-    encoder->encode(m_type);
+    encoder << m_type;
 
     switch (type()) {
     case NPVariantData::Void:
     case NPVariantData::Null:
         break;
     case NPVariantData::Bool:
-        encoder->encode(boolValue());
+        encoder << boolValue();
         break;
     case NPVariantData::Int32:
-        encoder->encode(int32Value());
+        encoder << int32Value();
         break;
     case NPVariantData::Double:
-        encoder->encode(doubleValue());
+        encoder << doubleValue();
         break;
     case NPVariantData::String:
-        encoder->encode(stringValue());
+        encoder << stringValue();
         break;
     case NPVariantData::LocalNPObjectID:
-        encoder->encode(localNPObjectIDValue());
+        encoder << localNPObjectIDValue();
         break;
     case NPVariantData::RemoteNPObjectID:
-        encoder->encode(remoteNPObjectIDValue());
+        encoder << remoteNPObjectIDValue();
         break;
     }
 }
diff --git a/Source/WebKit2/Shared/Plugins/NPVariantData.h b/Source/WebKit2/Shared/Plugins/NPVariantData.h
index 805640e9e..a23204616 100644
--- a/Source/WebKit2/Shared/Plugins/NPVariantData.h
+++ b/Source/WebKit2/Shared/Plugins/NPVariantData.h
@@ -100,7 +100,7 @@ public:
         return m_remoteNPObjectIDValue;
     }
 
-    void encode(CoreIPC::ArgumentEncoder*) const;
+    void encode(CoreIPC::ArgumentEncoder&) const;
     static bool decode(CoreIPC::ArgumentDecoder*, NPVariantData&);
 
 private:
diff --git a/Source/WebKit2/Shared/Plugins/Netscape/mac/NetscapePluginModuleMac.mm b/Source/WebKit2/Shared/Plugins/Netscape/mac/NetscapePluginModuleMac.mm
index 81b38e0ec..3dc377c44 100644
--- a/Source/WebKit2/Shared/Plugins/Netscape/mac/NetscapePluginModuleMac.mm
+++ b/Source/WebKit2/Shared/Plugins/Netscape/mac/NetscapePluginModuleMac.mm
@@ -352,11 +352,10 @@ static bool getPluginInfoFromCarbonResources(CFBundleRef bundle, PluginModuleInf
 
 bool NetscapePluginModule::getPluginInfo(const String& pluginPath, PluginModuleInfo& plugin)
 {
-    RetainPtr<CFStringRef> bundlePath(AdoptCF, pluginPath.createCFString());
-    RetainPtr<CFURLRef> bundleURL(AdoptCF, CFURLCreateWithFileSystemPath(kCFAllocatorDefault, bundlePath.get(), kCFURLPOSIXPathStyle, false));
+    RetainPtr<CFURLRef> bundleURL = adoptCF(CFURLCreateWithFileSystemPath(kCFAllocatorDefault, pluginPath.createCFString().get(), kCFURLPOSIXPathStyle, false));
     
     // Try to initialize the bundle.
-    RetainPtr<CFBundleRef> bundle(AdoptCF, CFBundleCreate(kCFAllocatorDefault, bundleURL.get()));
+    RetainPtr<CFBundleRef> bundle = adoptCF(CFBundleCreate(kCFAllocatorDefault, bundleURL.get()));
     if (!bundle)
         return false;
     
@@ -395,11 +394,9 @@ bool NetscapePluginModule::getPluginInfo(const String& pluginPath, PluginModuleI
 
 bool NetscapePluginModule::createPluginMIMETypesPreferences(const String& pluginPath)
 {
-    RetainPtr<CFStringRef> bundlePath(AdoptCF, pluginPath.createCFString());
-    RetainPtr<CFURLRef> bundleURL(AdoptCF, CFURLCreateWithFileSystemPath(kCFAllocatorDefault, bundlePath.get(), kCFURLPOSIXPathStyle, false));
+    RetainPtr<CFURLRef> bundleURL = adoptCF(CFURLCreateWithFileSystemPath(kCFAllocatorDefault, pluginPath.createCFString().get(), kCFURLPOSIXPathStyle, false));
     
-    // Try to initialize the bundle.
-    RetainPtr<CFBundleRef> bundle(AdoptCF, CFBundleCreate(kCFAllocatorDefault, bundleURL.get()));
+    RetainPtr<CFBundleRef> bundle = adoptCF(CFBundleCreate(kCFAllocatorDefault, bundleURL.get()));
     if (!bundle)
         return false;
 
diff --git a/Source/WebKit2/Shared/Plugins/PluginModuleInfo.h b/Source/WebKit2/Shared/Plugins/PluginModuleInfo.h
index a232db3c1..9e50f6396 100644
--- a/Source/WebKit2/Shared/Plugins/PluginModuleInfo.h
+++ b/Source/WebKit2/Shared/Plugins/PluginModuleInfo.h
@@ -34,6 +34,18 @@
 
 namespace WebKit {
 
+enum PluginModuleLoadPolicy {
+    // The plug-in module should be loaded normally.
+    PluginModuleLoadNormally,
+
+    // The plug-in should be blocked from being instantiated.
+    // Note that the plug-in will still be seen by e.g. navigator.plugins
+    PluginModuleBlocked,
+
+    // The plug-in module is inactive and should not be instantiated unless the user explicitly allows it.
+    PluginModuleInactive
+};
+
 struct PluginModuleInfo {
     String path;
     WebCore::PluginInfo info;
diff --git a/Source/WebKit2/Shared/Plugins/PluginProcessCreationParameters.cpp b/Source/WebKit2/Shared/Plugins/PluginProcessCreationParameters.cpp
index 1a0a52c41..f53c26e6b 100644
--- a/Source/WebKit2/Shared/Plugins/PluginProcessCreationParameters.cpp
+++ b/Source/WebKit2/Shared/Plugins/PluginProcessCreationParameters.cpp
@@ -37,17 +37,17 @@ PluginProcessCreationParameters::PluginProcessCreationParameters()
 {
 }
 
-void PluginProcessCreationParameters::encode(CoreIPC::ArgumentEncoder* encoder) const
+void PluginProcessCreationParameters::encode(CoreIPC::ArgumentEncoder& encoder) const
 {
-    encoder->encode(pluginPath);
-    encoder->encode(supportsAsynchronousPluginInitialization);
-    encoder->encode(minimumLifetime);
-    encoder->encode(terminationTimeout);
+    encoder << pluginPath;
+    encoder << supportsAsynchronousPluginInitialization;
+    encoder << minimumLifetime;
+    encoder << terminationTimeout;
 
 #if PLATFORM(MAC)
-    encoder->encode(parentProcessName);
-    encoder->encode(acceleratedCompositingPort);
-    encoder->encode(sandboxProfileDirectoryPath);
+    encoder << parentProcessName;
+    encoder << acceleratedCompositingPort;
+    encoder << sandboxProfileDirectoryPath;
 #endif
 }
 
diff --git a/Source/WebKit2/Shared/Plugins/PluginProcessCreationParameters.h b/Source/WebKit2/Shared/Plugins/PluginProcessCreationParameters.h
index 544374ad1..a414212be 100644
--- a/Source/WebKit2/Shared/Plugins/PluginProcessCreationParameters.h
+++ b/Source/WebKit2/Shared/Plugins/PluginProcessCreationParameters.h
@@ -44,7 +44,7 @@ namespace WebKit {
 struct PluginProcessCreationParameters {
     PluginProcessCreationParameters();
 
-    void encode(CoreIPC::ArgumentEncoder*) const;
+    void encode(CoreIPC::ArgumentEncoder&) const;
     static bool decode(CoreIPC::ArgumentDecoder*, PluginProcessCreationParameters&);
 
     String pluginPath;
diff --git a/Source/WebKit2/Shared/PrintInfo.cpp b/Source/WebKit2/Shared/PrintInfo.cpp
index 107884a07..faf008c79 100644
--- a/Source/WebKit2/Shared/PrintInfo.cpp
+++ b/Source/WebKit2/Shared/PrintInfo.cpp
@@ -43,11 +43,11 @@ PrintInfo::PrintInfo()
 {
 }
 
-void PrintInfo::encode(CoreIPC::ArgumentEncoder* encoder) const
+void PrintInfo::encode(CoreIPC::ArgumentEncoder& encoder) const
 {
-    encoder->encode(pageSetupScaleFactor);
-    encoder->encode(availablePaperWidth);
-    encoder->encode(availablePaperHeight);
+    encoder << pageSetupScaleFactor;
+    encoder << availablePaperWidth;
+    encoder << availablePaperHeight;
 
 #if PLATFORM(GTK)
     CoreIPC::encode(encoder, printSettings.get());
diff --git a/Source/WebKit2/Shared/PrintInfo.h b/Source/WebKit2/Shared/PrintInfo.h
index b73b7c5e3..97facebd0 100644
--- a/Source/WebKit2/Shared/PrintInfo.h
+++ b/Source/WebKit2/Shared/PrintInfo.h
@@ -63,7 +63,7 @@ struct PrintInfo {
     GRefPtr<GtkPageSetup> pageSetup;
 #endif
 
-    void encode(CoreIPC::ArgumentEncoder*) const;
+    void encode(CoreIPC::ArgumentEncoder&) const;
     static bool decode(CoreIPC::ArgumentDecoder*, PrintInfo&);
 };
 
diff --git a/Source/WebKit2/Shared/SandboxExtension.h b/Source/WebKit2/Shared/SandboxExtension.h
index 4fdb1ed63..e1a904af1 100644
--- a/Source/WebKit2/Shared/SandboxExtension.h
+++ b/Source/WebKit2/Shared/SandboxExtension.h
@@ -58,7 +58,7 @@ public:
         Handle();
         ~Handle();
 
-        void encode(CoreIPC::ArgumentEncoder*) const;
+        void encode(CoreIPC::ArgumentEncoder&) const;
         static bool decode(CoreIPC::ArgumentDecoder*, Handle&);
 
     private:
@@ -78,7 +78,7 @@ public:
         Handle& operator[](size_t i);
         const Handle& operator[](size_t i) const;
         size_t size() const;
-        void encode(CoreIPC::ArgumentEncoder*) const;
+        void encode(CoreIPC::ArgumentEncoder&) const;
         static bool decode(CoreIPC::ArgumentDecoder*, HandleArray&);
        
     private:
@@ -114,7 +114,7 @@ private:
 #if !ENABLE(WEB_PROCESS_SANDBOX)
 inline SandboxExtension::Handle::Handle() { }
 inline SandboxExtension::Handle::~Handle() { }
-inline void SandboxExtension::Handle::encode(CoreIPC::ArgumentEncoder*) const { }
+inline void SandboxExtension::Handle::encode(CoreIPC::ArgumentEncoder&) const { }
 inline bool SandboxExtension::Handle::decode(CoreIPC::ArgumentDecoder*, Handle&) { return true; }
 inline SandboxExtension::HandleArray::HandleArray() { }
 inline SandboxExtension::HandleArray::~HandleArray() { }
@@ -122,7 +122,7 @@ inline void SandboxExtension::HandleArray::allocate(size_t) { }
 inline size_t SandboxExtension::HandleArray::size() const { return 0; }    
 inline const SandboxExtension::Handle& SandboxExtension::HandleArray::operator[](size_t) const { return m_emptyHandle; }
 inline SandboxExtension::Handle& SandboxExtension::HandleArray::operator[](size_t) { return m_emptyHandle; }
-inline void SandboxExtension::HandleArray::encode(CoreIPC::ArgumentEncoder*) const { }
+inline void SandboxExtension::HandleArray::encode(CoreIPC::ArgumentEncoder&) const { }
 inline bool SandboxExtension::HandleArray::decode(CoreIPC::ArgumentDecoder*, HandleArray&) { return true; }
 inline PassRefPtr<SandboxExtension> SandboxExtension::create(const Handle&) { return 0; }
 inline void SandboxExtension::createHandle(const String&, Type, Handle&) { }
diff --git a/Source/WebKit2/Shared/SecurityOriginData.cpp b/Source/WebKit2/Shared/SecurityOriginData.cpp
index cf9551bfc..4968036f7 100644
--- a/Source/WebKit2/Shared/SecurityOriginData.cpp
+++ b/Source/WebKit2/Shared/SecurityOriginData.cpp
@@ -35,11 +35,11 @@ using namespace WebCore;
 
 namespace WebKit {
 
-void SecurityOriginData::encode(CoreIPC::ArgumentEncoder* encoder) const
+void SecurityOriginData::encode(CoreIPC::ArgumentEncoder& encoder) const
 {
-    encoder->encode(protocol);
-    encoder->encode(host);
-    encoder->encode(port);
+    encoder << protocol;
+    encoder << host;
+    encoder << port;
 }
 
 bool SecurityOriginData::decode(CoreIPC::ArgumentDecoder* decoder, SecurityOriginData& securityOriginData)
diff --git a/Source/WebKit2/Shared/SecurityOriginData.h b/Source/WebKit2/Shared/SecurityOriginData.h
index 692a96e15..93909bc6e 100644
--- a/Source/WebKit2/Shared/SecurityOriginData.h
+++ b/Source/WebKit2/Shared/SecurityOriginData.h
@@ -40,7 +40,7 @@ namespace WebKit {
 typedef GenericCallback<WKArrayRef> ArrayCallback;
 
 struct SecurityOriginData {
-    void encode(CoreIPC::ArgumentEncoder*) const;
+    void encode(CoreIPC::ArgumentEncoder&) const;
     static bool decode(CoreIPC::ArgumentDecoder*, SecurityOriginData&);
 
     // FIXME <rdar://9018386>: We should be sending more state across the wire than just the protocol,
diff --git a/Source/WebKit2/Shared/SessionState.cpp b/Source/WebKit2/Shared/SessionState.cpp
index b25289a32..c08e9aa95 100644
--- a/Source/WebKit2/Shared/SessionState.cpp
+++ b/Source/WebKit2/Shared/SessionState.cpp
@@ -30,9 +30,9 @@ namespace CoreIPC {
 
 // This assumes that when we encode a RefPtr we want to encode the object it points to and it is never null.
 template<typename T> struct ArgumentCoder<RefPtr<T> > {
-    static void encode(ArgumentEncoder* encoder, const RefPtr<T>& item)
+    static void encode(ArgumentEncoder& encoder, const RefPtr<T>& item)
     {
-        item->encode(*encoder);
+        item->encode(encoder);
     }
 
     static bool decode(ArgumentDecoder* decoder, RefPtr<T>& item)
@@ -64,10 +64,10 @@ bool SessionState::isEmpty() const
     return m_list.isEmpty();
 }
     
-void SessionState::encode(CoreIPC::ArgumentEncoder* encoder) const
+void SessionState::encode(CoreIPC::ArgumentEncoder& encoder) const
 {
-    encoder->encode(m_list);
-    encoder->encode(m_currentIndex);
+    encoder << m_list;
+    encoder << m_currentIndex;
 }
 
 bool SessionState::decode(CoreIPC::ArgumentDecoder* decoder, SessionState& state)
diff --git a/Source/WebKit2/Shared/SessionState.h b/Source/WebKit2/Shared/SessionState.h
index 8aa18948d..19422a1f0 100644
--- a/Source/WebKit2/Shared/SessionState.h
+++ b/Source/WebKit2/Shared/SessionState.h
@@ -45,7 +45,7 @@ public:
 
     bool isEmpty() const;
 
-    void encode(CoreIPC::ArgumentEncoder*) const;
+    void encode(CoreIPC::ArgumentEncoder&) const;
     static bool decode(CoreIPC::ArgumentDecoder*, SessionState&);
 
 private:
diff --git a/Source/WebKit2/Shared/ShareableBitmap.cpp b/Source/WebKit2/Shared/ShareableBitmap.cpp
index cde3aa165..acae74ff6 100644
--- a/Source/WebKit2/Shared/ShareableBitmap.cpp
+++ b/Source/WebKit2/Shared/ShareableBitmap.cpp
@@ -39,11 +39,11 @@ ShareableBitmap::Handle::Handle()
 {
 }
 
-void ShareableBitmap::Handle::encode(CoreIPC::ArgumentEncoder* encoder) const
+void ShareableBitmap::Handle::encode(CoreIPC::ArgumentEncoder& encoder) const
 {
-    encoder->encode(m_handle);
-    encoder->encode(m_size);
-    encoder->encode(m_flags);
+    encoder << m_handle;
+    encoder << m_size;
+    encoder << m_flags;
 }
 
 bool ShareableBitmap::Handle::decode(CoreIPC::ArgumentDecoder* decoder, Handle& handle)
diff --git a/Source/WebKit2/Shared/ShareableBitmap.h b/Source/WebKit2/Shared/ShareableBitmap.h
index 2af228e6f..8dbf1ddfe 100644
--- a/Source/WebKit2/Shared/ShareableBitmap.h
+++ b/Source/WebKit2/Shared/ShareableBitmap.h
@@ -72,7 +72,7 @@ public:
 
         bool isNull() const { return m_handle.isNull(); }
 
-        void encode(CoreIPC::ArgumentEncoder*) const;
+        void encode(CoreIPC::ArgumentEncoder&) const;
         static bool decode(CoreIPC::ArgumentDecoder*, Handle&);
 
     private:
diff --git a/Source/WebKit2/Shared/ShareableSurface.cpp b/Source/WebKit2/Shared/ShareableSurface.cpp
index f70769895..bf8fa1069 100644
--- a/Source/WebKit2/Shared/ShareableSurface.cpp
+++ b/Source/WebKit2/Shared/ShareableSurface.cpp
@@ -37,16 +37,16 @@ ShareableSurface::Handle::Handle()
 {
 }
 
-void ShareableSurface::Handle::encode(CoreIPC::ArgumentEncoder* encoder) const
+void ShareableSurface::Handle::encode(CoreIPC::ArgumentEncoder& encoder) const
 {
-    encoder->encode(m_size);
-    encoder->encode(m_flags);
+    encoder.encode(m_size);
+    encoder.encode(m_flags);
 #if USE(GRAPHICS_SURFACE)
-    encoder->encode(m_graphicsSurfaceToken);
+    encoder.encode(m_graphicsSurfaceToken);
     if (m_graphicsSurfaceToken.isValid())
         return;
 #endif
-    encoder->encode(m_bitmapHandle);
+    encoder.encode(m_bitmapHandle);
 }
 
 bool ShareableSurface::Handle::decode(CoreIPC::ArgumentDecoder* decoder, Handle& handle)
diff --git a/Source/WebKit2/Shared/ShareableSurface.h b/Source/WebKit2/Shared/ShareableSurface.h
index 598dc5911..e0e7a39f2 100644
--- a/Source/WebKit2/Shared/ShareableSurface.h
+++ b/Source/WebKit2/Shared/ShareableSurface.h
@@ -51,7 +51,7 @@ public:
 
         bool isNull() const;
 
-        void encode(CoreIPC::ArgumentEncoder*) const;
+        void encode(CoreIPC::ArgumentEncoder&) const;
         static bool decode(CoreIPC::ArgumentDecoder*, Handle&);
 
 #if USE(GRAPHICS_SURFACE)
diff --git a/Source/WebKit2/Shared/SharedWorkerProcessCreationParameters.cpp b/Source/WebKit2/Shared/SharedWorkerProcessCreationParameters.cpp
index b669307eb..87f496d8a 100644
--- a/Source/WebKit2/Shared/SharedWorkerProcessCreationParameters.cpp
+++ b/Source/WebKit2/Shared/SharedWorkerProcessCreationParameters.cpp
@@ -36,13 +36,13 @@ SharedWorkerProcessCreationParameters::SharedWorkerProcessCreationParameters()
 {
 }
 
-void SharedWorkerProcessCreationParameters::encode(CoreIPC::ArgumentEncoder* encoder) const
+void SharedWorkerProcessCreationParameters::encode(CoreIPC::ArgumentEncoder& encoder) const
 {
-    encoder->encode(minimumLifetime);
-    encoder->encode(terminationTimeout);
+    encoder << minimumLifetime;
+    encoder << terminationTimeout;
 
 #if PLATFORM(MAC)
-    encoder->encode(parentProcessName);
+    encoder << parentProcessName;
 #endif
 }
 
diff --git a/Source/WebKit2/Shared/SharedWorkerProcessCreationParameters.h b/Source/WebKit2/Shared/SharedWorkerProcessCreationParameters.h
index 3fef97535..ccd257eb9 100644
--- a/Source/WebKit2/Shared/SharedWorkerProcessCreationParameters.h
+++ b/Source/WebKit2/Shared/SharedWorkerProcessCreationParameters.h
@@ -44,7 +44,7 @@ namespace WebKit {
 struct SharedWorkerProcessCreationParameters {
     SharedWorkerProcessCreationParameters();
 
-    void encode(CoreIPC::ArgumentEncoder*) const;
+    void encode(CoreIPC::ArgumentEncoder&) const;
     static bool decode(CoreIPC::ArgumentDecoder*, SharedWorkerProcessCreationParameters&);
 
     double minimumLifetime;
diff --git a/Source/WebKit2/Shared/StatisticsData.cpp b/Source/WebKit2/Shared/StatisticsData.cpp
index 59fef7a77..17dcdd9ec 100644
--- a/Source/WebKit2/Shared/StatisticsData.cpp
+++ b/Source/WebKit2/Shared/StatisticsData.cpp
@@ -30,12 +30,12 @@
 
 namespace WebKit {
 
-void StatisticsData::encode(CoreIPC::ArgumentEncoder* encoder) const
+void StatisticsData::encode(CoreIPC::ArgumentEncoder& encoder) const
 {
-    encoder->encode(statisticsNumbers);
-    encoder->encode(javaScriptProtectedObjectTypeCounts);
-    encoder->encode(javaScriptObjectTypeCounts);
-    encoder->encode(webCoreCacheStatistics);
+    encoder << statisticsNumbers;
+    encoder << javaScriptProtectedObjectTypeCounts;
+    encoder << javaScriptObjectTypeCounts;
+    encoder << webCoreCacheStatistics;
 }
 
 bool StatisticsData::decode(CoreIPC::ArgumentDecoder* decoder, StatisticsData& statisticsData)
diff --git a/Source/WebKit2/Shared/StatisticsData.h b/Source/WebKit2/Shared/StatisticsData.h
index 2c82c28bd..7315ed250 100644
--- a/Source/WebKit2/Shared/StatisticsData.h
+++ b/Source/WebKit2/Shared/StatisticsData.h
@@ -36,7 +36,7 @@
 namespace WebKit {
 
 struct StatisticsData {
-    void encode(CoreIPC::ArgumentEncoder*) const;
+    void encode(CoreIPC::ArgumentEncoder&) const;
     static bool decode(CoreIPC::ArgumentDecoder*, StatisticsData&);
     
     HashMap<String, uint64_t> statisticsNumbers;
diff --git a/Source/WebKit2/Shared/StringPairVector.h b/Source/WebKit2/Shared/StringPairVector.h
index ce2da4a09..8cfd19d01 100644
--- a/Source/WebKit2/Shared/StringPairVector.h
+++ b/Source/WebKit2/Shared/StringPairVector.h
@@ -45,9 +45,9 @@ public:
         m_stringPairVector.swap(stringPairVector);
     }
 
-    void encode(CoreIPC::ArgumentEncoder* encoder) const
+    void encode(CoreIPC::ArgumentEncoder& encoder) const
     {
-        encoder->encode(m_stringPairVector);
+        encoder << m_stringPairVector;
     }
 
     static bool decode(CoreIPC::ArgumentDecoder* decoder, StringPairVector& stringPairVector)
diff --git a/Source/WebKit2/Shared/SurfaceUpdateInfo.cpp b/Source/WebKit2/Shared/SurfaceUpdateInfo.cpp
index 15333793c..4147ceaa7 100644
--- a/Source/WebKit2/Shared/SurfaceUpdateInfo.cpp
+++ b/Source/WebKit2/Shared/SurfaceUpdateInfo.cpp
@@ -24,12 +24,12 @@
 
 namespace WebKit {
 
-void SurfaceUpdateInfo::encode(CoreIPC::ArgumentEncoder* encoder) const
+void SurfaceUpdateInfo::encode(CoreIPC::ArgumentEncoder& encoder) const
 {
-    encoder->encode(updateRect);
-    encoder->encode(scaleFactor);
-    encoder->encode(surfaceHandle);
-    encoder->encode(surfaceOffset);
+    encoder.encode(updateRect);
+    encoder.encode(scaleFactor);
+    encoder.encode(atlasID);
+    encoder.encode(surfaceOffset);
 }
 
 bool SurfaceUpdateInfo::decode(CoreIPC::ArgumentDecoder* decoder, SurfaceUpdateInfo& result)
@@ -38,7 +38,7 @@ bool SurfaceUpdateInfo::decode(CoreIPC::ArgumentDecoder* decoder, SurfaceUpdateI
         return false;
     if (!decoder->decode(result.scaleFactor))
         return false;
-    if (!decoder->decode(result.surfaceHandle))
+    if (!decoder->decode(result.atlasID))
         return false;
     if (!decoder->decode(result.surfaceOffset))
         return false;
diff --git a/Source/WebKit2/Shared/SurfaceUpdateInfo.h b/Source/WebKit2/Shared/SurfaceUpdateInfo.h
index 01d60d242..e08967d96 100644
--- a/Source/WebKit2/Shared/SurfaceUpdateInfo.h
+++ b/Source/WebKit2/Shared/SurfaceUpdateInfo.h
@@ -20,7 +20,6 @@
 #ifndef SurfaceUpdateInfo_h
 #define SurfaceUpdateInfo_h
 
-#include "ShareableSurface.h"
 #include <WebCore/IntRect.h>
 #include <wtf/Noncopyable.h>
 
@@ -37,7 +36,7 @@ class SurfaceUpdateInfo {
 public:
     SurfaceUpdateInfo() { }
 
-    void encode(CoreIPC::ArgumentEncoder*) const;
+    void encode(CoreIPC::ArgumentEncoder&) const;
     static bool decode(CoreIPC::ArgumentDecoder*, SurfaceUpdateInfo&);
 
     // The rect to be updated.
@@ -46,8 +45,8 @@ public:
     // The page scale factor used to render this update.
     float scaleFactor;
 
-    // The handle of the shareable bitmap containing the updates. Will be null if there are no updates.
-    ShareableSurface::Handle surfaceHandle;
+    // The id of the update atlas including the shareable bitmap containing the updates.
+    int atlasID;
 
     // The offset in the bitmap where the rendered contents are.
     WebCore::IntPoint surfaceOffset;
diff --git a/Source/WebKit2/Shared/UpdateInfo.cpp b/Source/WebKit2/Shared/UpdateInfo.cpp
index 5bb189597..cf6b90620 100644
--- a/Source/WebKit2/Shared/UpdateInfo.cpp
+++ b/Source/WebKit2/Shared/UpdateInfo.cpp
@@ -30,17 +30,17 @@
 
 namespace WebKit {
 
-void UpdateInfo::encode(CoreIPC::ArgumentEncoder* encoder) const
+void UpdateInfo::encode(CoreIPC::ArgumentEncoder& encoder) const
 {
-    encoder->encode(viewSize);
-    encoder->encode(deviceScaleFactor);
-    encoder->encode(scrollRect);
-    encoder->encode(scrollOffset);
-    encoder->encode(updateRectBounds);
-    encoder->encode(updateRects);
-    encoder->encode(updateScaleFactor);
-    encoder->encode(bitmapHandle);
-    encoder->encode(bitmapOffset);
+    encoder << viewSize;
+    encoder << deviceScaleFactor;
+    encoder << scrollRect;
+    encoder << scrollOffset;
+    encoder << updateRectBounds;
+    encoder << updateRects;
+    encoder << updateScaleFactor;
+    encoder << bitmapHandle;
+    encoder << bitmapOffset;
 }
 
 bool UpdateInfo::decode(CoreIPC::ArgumentDecoder* decoder, UpdateInfo& result)
diff --git a/Source/WebKit2/Shared/UpdateInfo.h b/Source/WebKit2/Shared/UpdateInfo.h
index e3a8de278..c11aa3542 100644
--- a/Source/WebKit2/Shared/UpdateInfo.h
+++ b/Source/WebKit2/Shared/UpdateInfo.h
@@ -43,7 +43,7 @@ class UpdateInfo {
 public:
     UpdateInfo() { }
 
-    void encode(CoreIPC::ArgumentEncoder*) const;
+    void encode(CoreIPC::ArgumentEncoder&) const;
     static bool decode(CoreIPC::ArgumentDecoder*, UpdateInfo&);
 
     // The size of the web view.
diff --git a/Source/WebKit2/Shared/UserMessageCoders.h b/Source/WebKit2/Shared/UserMessageCoders.h
index 9d8ac5c6b..76236359a 100644
--- a/Source/WebKit2/Shared/UserMessageCoders.h
+++ b/Source/WebKit2/Shared/UserMessageCoders.h
@@ -67,119 +67,119 @@ namespace WebKit {
 template<typename Owner>
 class UserMessageEncoder {
 public:
-    bool baseEncode(CoreIPC::ArgumentEncoder* encoder, APIObject::Type& type) const 
+    bool baseEncode(CoreIPC::ArgumentEncoder& encoder, APIObject::Type& type) const
     {
         if (!m_root) {
-            encoder->encode(static_cast<uint32_t>(APIObject::TypeNull));
+            encoder << static_cast<uint32_t>(APIObject::TypeNull);
             return true;
         }
 
         type = m_root->type();
-        encoder->encode(static_cast<uint32_t>(type));
+        encoder << static_cast<uint32_t>(type);
 
         switch (type) {
         case APIObject::TypeArray: {
             ImmutableArray* array = static_cast<ImmutableArray*>(m_root);
-            encoder->encode(static_cast<uint64_t>(array->size()));
+            encoder << static_cast<uint64_t>(array->size());
             for (size_t i = 0; i < array->size(); ++i)
-                encoder->encode(Owner(array->at(i)));
+                encoder << Owner(array->at(i));
             return true;
         }
         case APIObject::TypeDictionary: {
             ImmutableDictionary* dictionary = static_cast<ImmutableDictionary*>(m_root);
             const ImmutableDictionary::MapType& map = dictionary->map();
-            encoder->encode(static_cast<uint64_t>(map.size()));
+            encoder << static_cast<uint64_t>(map.size());
 
             ImmutableDictionary::MapType::const_iterator it = map.begin();
             ImmutableDictionary::MapType::const_iterator end = map.end();
             for (; it != end; ++it) {
-                encoder->encode(it->key);
-                encoder->encode(Owner(it->value.get()));
+                encoder << it->key;
+                encoder << Owner(it->value.get());
             }
             return true;
         }
         case APIObject::TypeString: {
             WebString* string = static_cast<WebString*>(m_root);
-            encoder->encode(string->string());
+            encoder << string->string();
             return true;
         }
         case APIObject::TypeSerializedScriptValue: {
             WebSerializedScriptValue* scriptValue = static_cast<WebSerializedScriptValue*>(m_root);
-            encoder->encodeVariableLengthByteArray(scriptValue->dataReference());
+            encoder << scriptValue->dataReference();
             return true;
         }
         case APIObject::TypeBoolean: {
             WebBoolean* booleanObject = static_cast<WebBoolean*>(m_root);
-            encoder->encode(booleanObject->value());
+            encoder << booleanObject->value();
             return true;
         }
         case APIObject::TypeDouble: {
             WebDouble* doubleObject = static_cast<WebDouble*>(m_root);
-            encoder->encode(doubleObject->value());
+            encoder << doubleObject->value();
             return true;
         }
         case APIObject::TypeUInt64: {
             WebUInt64* uint64Object = static_cast<WebUInt64*>(m_root);
-            encoder->encode(uint64Object->value());
+            encoder << uint64Object->value();
             return true;
         }
         case APIObject::TypePoint: {
             WebPoint* pointObject = static_cast<WebPoint*>(m_root);
-            encoder->encode(pointObject->point().x);
-            encoder->encode(pointObject->point().y);
+            encoder << pointObject->point().x;
+            encoder << pointObject->point().y;
             return true;
         }
         case APIObject::TypeSize: {
             WebSize* sizeObject = static_cast<WebSize*>(m_root);
-            encoder->encode(sizeObject->size().width);
-            encoder->encode(sizeObject->size().height);
+            encoder << sizeObject->size().width;
+            encoder << sizeObject->size().height;
             return true;
         }
         case APIObject::TypeRect: {
             WebRect* rectObject = static_cast<WebRect*>(m_root);
-            encoder->encode(rectObject->rect().origin.x);
-            encoder->encode(rectObject->rect().origin.y);
-            encoder->encode(rectObject->rect().size.width);
-            encoder->encode(rectObject->rect().size.height);
+            encoder << rectObject->rect().origin.x;
+            encoder << rectObject->rect().origin.y;
+            encoder << rectObject->rect().size.width;
+            encoder << rectObject->rect().size.height;
             return true;
         }
         case APIObject::TypeRenderLayer: {
             WebRenderLayer* renderLayer = static_cast<WebRenderLayer*>(m_root);
-            encoder->encode(Owner(renderLayer->renderer()));
-            encoder->encode(renderLayer->isReflection());
-            encoder->encode(renderLayer->isClipping());
-            encoder->encode(renderLayer->isClipped());
-            encoder->encode(static_cast<uint32_t>(renderLayer->compositingLayerType()));
-            encoder->encode(renderLayer->absoluteBoundingBox());
-            encoder->encode(Owner(renderLayer->negativeZOrderList()));
-            encoder->encode(Owner(renderLayer->normalFlowList()));
-            encoder->encode(Owner(renderLayer->positiveZOrderList()));
+            encoder << Owner(renderLayer->renderer());
+            encoder << renderLayer->isReflection();
+            encoder << renderLayer->isClipping();
+            encoder << renderLayer->isClipped();
+            encoder << static_cast<uint32_t>(renderLayer->compositingLayerType());
+            encoder << renderLayer->absoluteBoundingBox();
+            encoder << Owner(renderLayer->negativeZOrderList());
+            encoder << Owner(renderLayer->normalFlowList());
+            encoder << Owner(renderLayer->positiveZOrderList());
             return true;
         }
         case APIObject::TypeRenderObject: {
             WebRenderObject* renderObject = static_cast<WebRenderObject*>(m_root);
-            encoder->encode(renderObject->name());
-            encoder->encode(renderObject->elementTagName());
-            encoder->encode(renderObject->elementID());
-            encoder->encode(Owner(renderObject->elementClassNames()));
-            encoder->encode(renderObject->absolutePosition());
-            encoder->encode(renderObject->frameRect());
-            encoder->encode(Owner(renderObject->children().get()));
+            encoder << renderObject->name();
+            encoder << renderObject->elementTagName();
+            encoder << renderObject->elementID();
+            encoder << Owner(renderObject->elementClassNames());
+            encoder << renderObject->absolutePosition();
+            encoder << renderObject->frameRect();
+            encoder << Owner(renderObject->children().get());
             return true;
         }
         case APIObject::TypeURL: {
             WebURL* urlObject = static_cast<WebURL*>(m_root);
-            encoder->encode(urlObject->string());
+            encoder << urlObject->string();
             return true;
         }
         case APIObject::TypeURLRequest: {
             WebURLRequest* urlRequestObject = static_cast<WebURLRequest*>(m_root);
-            encoder->encode(urlRequestObject->resourceRequest());
+            encoder << urlRequestObject->resourceRequest();
             return true;
         }
         case APIObject::TypeUserContentURLPattern: {
             WebUserContentURLPattern* urlPattern = static_cast<WebUserContentURLPattern*>(m_root);
-            encoder->encode(urlPattern->patternString());
+            encoder << urlPattern->patternString();
             return true;
         }
         case APIObject::TypeImage: {
@@ -189,24 +189,24 @@ public:
             ASSERT(!image->bitmap() || image->bitmap()->isBackedBySharedMemory());            
             if (!image->bitmap() || !image->bitmap()->isBackedBySharedMemory() || !image->bitmap()->createHandle(handle)) {
                 // Initial false indicates no allocated bitmap or is not shareable.
-                encoder->encode(false);
+                encoder << false;
                 return true;
             }
 
             // Initial true indicates a bitmap was allocated and is shareable.
-            encoder->encode(true);
+            encoder << true;
 
-            encoder->encode(handle);
+            encoder << handle;
             return true;
         }
         case APIObject::TypeData: {
             WebData* data = static_cast<WebData*>(m_root);
-            encoder->encodeVariableLengthByteArray(data->dataReference());
+            encoder << data->dataReference();
             return true;
         }
         case APIObject::TypeCertificateInfo: {
             WebCertificateInfo* certificateInfo = static_cast<WebCertificateInfo*>(m_root);
-            encoder->encode(certificateInfo->platformCertificateInfo());
+            encoder << certificateInfo->platformCertificateInfo();
             return true;
         }
         default:
@@ -303,7 +303,7 @@ public:
         }
         case APIObject::TypeSerializedScriptValue: {
             CoreIPC::DataReference dataReference;
-            if (!decoder->decodeVariableLengthByteArray(dataReference))
+            if (!decoder->decode(dataReference))
                 return false;
             
             Vector<uint8_t> vector = dataReference.vector();
@@ -475,7 +475,7 @@ public:
         }
         case APIObject::TypeData: {
             CoreIPC::DataReference dataReference;
-            if (!decoder->decodeVariableLengthByteArray(dataReference))
+            if (!decoder->decode(dataReference))
                 return false;
             coder.m_root = WebData::create(dataReference.data(), dataReference.size());
             break;
diff --git a/Source/WebKit2/Shared/WebBackForwardListItem.cpp b/Source/WebKit2/Shared/WebBackForwardListItem.cpp
index 817825347..e5ae67a3e 100644
--- a/Source/WebKit2/Shared/WebBackForwardListItem.cpp
+++ b/Source/WebKit2/Shared/WebBackForwardListItem.cpp
@@ -63,11 +63,11 @@ void WebBackForwardListItem::setBackForwardData(const uint8_t* data, size_t size
 
 void WebBackForwardListItem::encode(CoreIPC::ArgumentEncoder& encoder) const
 {
-    encoder.encode(m_originalURL);
-    encoder.encode(m_url);
-    encoder.encode(m_title);
-    encoder.encode(m_itemID);
-    encoder.encode(CoreIPC::DataReference(m_backForwardData));
+    encoder << m_originalURL;
+    encoder << m_url;
+    encoder << m_title;
+    encoder << m_itemID;
+    encoder << CoreIPC::DataReference(m_backForwardData);
 }
 
 PassRefPtr<WebBackForwardListItem> WebBackForwardListItem::decode(CoreIPC::ArgumentDecoder& decoder)
diff --git a/Source/WebKit2/Shared/WebBatteryStatus.cpp b/Source/WebKit2/Shared/WebBatteryStatus.cpp
index 30a5e59a1..32af01edd 100644
--- a/Source/WebKit2/Shared/WebBatteryStatus.cpp
+++ b/Source/WebKit2/Shared/WebBatteryStatus.cpp
@@ -45,12 +45,12 @@ WebBatteryStatus::~WebBatteryStatus()
 {
 }
 
-void WebBatteryStatus::Data::encode(CoreIPC::ArgumentEncoder* encoder) const
+void WebBatteryStatus::Data::encode(CoreIPC::ArgumentEncoder& encoder) const
 {
-    encoder->encode(isCharging);
-    encoder->encode(chargingTime);
-    encoder->encode(dischargingTime);
-    encoder->encode(level);
+    encoder.encode(isCharging);
+    encoder.encode(chargingTime);
+    encoder.encode(dischargingTime);
+    encoder.encode(level);
 }
 
 bool WebBatteryStatus::Data::decode(CoreIPC::ArgumentDecoder* decoder, Data& result)
diff --git a/Source/WebKit2/Shared/WebBatteryStatus.h b/Source/WebKit2/Shared/WebBatteryStatus.h
index fd1d7932d..6b630f708 100644
--- a/Source/WebKit2/Shared/WebBatteryStatus.h
+++ b/Source/WebKit2/Shared/WebBatteryStatus.h
@@ -40,7 +40,7 @@ public:
     static const Type APIType = TypeBatteryStatus;
 
     struct Data {
-        void encode(CoreIPC::ArgumentEncoder*) const;
+        void encode(CoreIPC::ArgumentEncoder&) const;
         static bool decode(CoreIPC::ArgumentDecoder*, Data&);
 
         bool isCharging;
diff --git a/Source/WebKit2/Shared/WebConnection.cpp b/Source/WebKit2/Shared/WebConnection.cpp
index 92e63c4fc..e2263ee16 100644
--- a/Source/WebKit2/Shared/WebConnection.cpp
+++ b/Source/WebKit2/Shared/WebConnection.cpp
@@ -53,23 +53,21 @@ void WebConnection::postMessage(const String& messageName, APIObject* messageBod
     if (!m_connection)
         return;
 
-    OwnPtr<CoreIPC::ArgumentEncoder> messageData = CoreIPC::ArgumentEncoder::create();
-    messageData->encode(messageName);
-    encodeMessageBody(*messageData, messageBody);
+    OwnPtr<CoreIPC::MessageEncoder> encoder = CoreIPC::MessageEncoder::create(Messages::WebConnection::HandleMessage::receiverName(), Messages::WebConnection::HandleMessage::name(), 0);
+    encoder->encode(messageName);
+    encodeMessageBody(*encoder, messageBody);
 
-    m_connection->send(Messages::WebConnection::HandleMessage(CoreIPC::DataReference(messageData->buffer(), messageData->bufferSize())), 0);
+    m_connection->sendMessage(CoreIPC::MessageID(Messages::WebConnection::HandleMessage::messageID), encoder.release());
 }
 
-void WebConnection::handleMessage(const CoreIPC::DataReference& messageData)
+void WebConnection::handleMessage(CoreIPC::MessageDecoder& decoder)
 {
-    OwnPtr<CoreIPC::ArgumentDecoder> decoder = CoreIPC::ArgumentDecoder::create(messageData.data(), messageData.size());
-
     String messageName;
-    if (!decoder->decode(messageName))
+    if (!decoder.decode(messageName))
         return;
 
     RefPtr<APIObject> messageBody;
-    if (!decodeMessageBody(*decoder, messageBody))
+    if (!decodeMessageBody(decoder, messageBody))
         return;
 
     m_client.didReceiveMessage(this, messageName, messageBody.get());
diff --git a/Source/WebKit2/Shared/WebConnection.h b/Source/WebKit2/Shared/WebConnection.h
index 06a0134dc..3a2b531a0 100644
--- a/Source/WebKit2/Shared/WebConnection.h
+++ b/Source/WebKit2/Shared/WebConnection.h
@@ -63,7 +63,7 @@ protected:
 
     // Implemented in generated WebConnectionMessageReceiver.cpp
     void didReceiveWebConnectionMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::MessageDecoder&);
-    void handleMessage(const CoreIPC::DataReference& messageData);
+    void handleMessage(CoreIPC::MessageDecoder&);
 
     RefPtr<CoreIPC::Connection> m_connection;
     WebConnectionClient m_client;
diff --git a/Source/WebKit2/Shared/WebConnection.messages.in b/Source/WebKit2/Shared/WebConnection.messages.in
index 6e17707e1..65ec5b898 100644
--- a/Source/WebKit2/Shared/WebConnection.messages.in
+++ b/Source/WebKit2/Shared/WebConnection.messages.in
@@ -21,5 +21,5 @@
 # OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 messages -> WebConnection {
-    HandleMessage(CoreIPC::DataReference messageData)
+    HandleMessage() Variadic
 }
diff --git a/Source/WebKit2/Shared/WebContextMenuItemData.cpp b/Source/WebKit2/Shared/WebContextMenuItemData.cpp
index 901ce9c47..23290b376 100644
--- a/Source/WebKit2/Shared/WebContextMenuItemData.cpp
+++ b/Source/WebKit2/Shared/WebContextMenuItemData.cpp
@@ -104,14 +104,14 @@ void WebContextMenuItemData::setUserData(APIObject* userData)
     m_userData = userData;
 }
     
-void WebContextMenuItemData::encode(CoreIPC::ArgumentEncoder* encoder) const
+void WebContextMenuItemData::encode(CoreIPC::ArgumentEncoder& encoder) const
 {
-    encoder->encodeEnum(m_type);
-    encoder->encodeEnum(m_action);
-    encoder->encode(m_title);
-    encoder->encode(m_checked);
-    encoder->encode(m_enabled);
-    encoder->encode(m_submenu);
+    encoder.encodeEnum(m_type);
+    encoder.encodeEnum(m_action);
+    encoder << m_title;
+    encoder << m_checked;
+    encoder << m_enabled;
+    encoder << m_submenu;
 }
 
 bool WebContextMenuItemData::decode(CoreIPC::ArgumentDecoder* decoder, WebContextMenuItemData& item)
diff --git a/Source/WebKit2/Shared/WebContextMenuItemData.h b/Source/WebKit2/Shared/WebContextMenuItemData.h
index 106bdf016..9212e2813 100644
--- a/Source/WebKit2/Shared/WebContextMenuItemData.h
+++ b/Source/WebKit2/Shared/WebContextMenuItemData.h
@@ -63,7 +63,7 @@ public:
     APIObject* userData() const;
     void setUserData(APIObject*);
     
-    void encode(CoreIPC::ArgumentEncoder*) const;
+    void encode(CoreIPC::ArgumentEncoder&) const;
     static bool decode(CoreIPC::ArgumentDecoder*, WebContextMenuItemData&);
 
 private:
diff --git a/Source/WebKit2/Shared/WebCoreArgumentCoders.cpp b/Source/WebKit2/Shared/WebCoreArgumentCoders.cpp
index 957313587..497eaee88 100644
--- a/Source/WebKit2/Shared/WebCoreArgumentCoders.cpp
+++ b/Source/WebKit2/Shared/WebCoreArgumentCoders.cpp
@@ -56,7 +56,7 @@ using namespace WebKit;
 
 namespace CoreIPC {
 
-void ArgumentCoder<AffineTransform>::encode(ArgumentEncoder* encoder, const AffineTransform& affineTransform)
+void ArgumentCoder<AffineTransform>::encode(ArgumentEncoder& encoder, const AffineTransform& affineTransform)
 {
     SimpleArgumentCoder<AffineTransform>::encode(encoder, affineTransform);
 }
@@ -67,7 +67,7 @@ bool ArgumentCoder<AffineTransform>::decode(ArgumentDecoder* decoder, AffineTran
 }
 
 
-void ArgumentCoder<FloatPoint>::encode(ArgumentEncoder* encoder, const FloatPoint& floatPoint)
+void ArgumentCoder<FloatPoint>::encode(ArgumentEncoder& encoder, const FloatPoint& floatPoint)
 {
     SimpleArgumentCoder<FloatPoint>::encode(encoder, floatPoint);
 }
@@ -78,7 +78,7 @@ bool ArgumentCoder<FloatPoint>::decode(ArgumentDecoder* decoder, FloatPoint& flo
 }
 
 
-void ArgumentCoder<FloatRect>::encode(ArgumentEncoder* encoder, const FloatRect& floatRect)
+void ArgumentCoder<FloatRect>::encode(ArgumentEncoder& encoder, const FloatRect& floatRect)
 {
     SimpleArgumentCoder<FloatRect>::encode(encoder, floatRect);
 }
@@ -89,7 +89,7 @@ bool ArgumentCoder<FloatRect>::decode(ArgumentDecoder* decoder, FloatRect& float
 }
 
 
-void ArgumentCoder<FloatSize>::encode(ArgumentEncoder* encoder, const FloatSize& floatSize)
+void ArgumentCoder<FloatSize>::encode(ArgumentEncoder& encoder, const FloatSize& floatSize)
 {
     SimpleArgumentCoder<FloatSize>::encode(encoder, floatSize);
 }
@@ -100,7 +100,7 @@ bool ArgumentCoder<FloatSize>::decode(ArgumentDecoder* decoder, FloatSize& float
 }
 
 
-void ArgumentCoder<IntPoint>::encode(ArgumentEncoder* encoder, const IntPoint& intPoint)
+void ArgumentCoder<IntPoint>::encode(ArgumentEncoder& encoder, const IntPoint& intPoint)
 {
     SimpleArgumentCoder<IntPoint>::encode(encoder, intPoint);
 }
@@ -111,7 +111,7 @@ bool ArgumentCoder<IntPoint>::decode(ArgumentDecoder* decoder, IntPoint& intPoin
 }
 
 
-void ArgumentCoder<IntRect>::encode(ArgumentEncoder* encoder, const IntRect& intRect)
+void ArgumentCoder<IntRect>::encode(ArgumentEncoder& encoder, const IntRect& intRect)
 {
     SimpleArgumentCoder<IntRect>::encode(encoder, intRect);
 }
@@ -122,7 +122,7 @@ bool ArgumentCoder<IntRect>::decode(ArgumentDecoder* decoder, IntRect& intRect)
 }
 
 
-void ArgumentCoder<IntSize>::encode(ArgumentEncoder* encoder, const IntSize& intSize)
+void ArgumentCoder<IntSize>::encode(ArgumentEncoder& encoder, const IntSize& intSize)
 {
     SimpleArgumentCoder<IntSize>::encode(encoder, intSize);
 }
@@ -132,7 +132,8 @@ bool ArgumentCoder<IntSize>::decode(ArgumentDecoder* decoder, IntSize& intSize)
     return SimpleArgumentCoder<IntSize>::decode(decoder, intSize);
 }
 
-void ArgumentCoder<ViewportAttributes>::encode(ArgumentEncoder* encoder, const ViewportAttributes& viewportAttributes)
+
+void ArgumentCoder<ViewportAttributes>::encode(ArgumentEncoder& encoder, const ViewportAttributes& viewportAttributes)
 {
     SimpleArgumentCoder<ViewportAttributes>::encode(encoder, viewportAttributes);
 }
@@ -142,11 +143,10 @@ bool ArgumentCoder<ViewportAttributes>::decode(ArgumentDecoder* decoder, Viewpor
     return SimpleArgumentCoder<ViewportAttributes>::decode(decoder, viewportAttributes);
 }
 
-void ArgumentCoder<MimeClassInfo>::encode(ArgumentEncoder* encoder, const MimeClassInfo& mimeClassInfo)
+
+void ArgumentCoder<MimeClassInfo>::encode(ArgumentEncoder& encoder, const MimeClassInfo& mimeClassInfo)
 {
-    encoder->encode(mimeClassInfo.type);
-    encoder->encode(mimeClassInfo.desc);
-    encoder->encode(mimeClassInfo.extensions);
+    encoder << mimeClassInfo.type << mimeClassInfo.desc << mimeClassInfo.extensions;
 }
 
 bool ArgumentCoder<MimeClassInfo>::decode(ArgumentDecoder* decoder, MimeClassInfo& mimeClassInfo)
@@ -162,12 +162,9 @@ bool ArgumentCoder<MimeClassInfo>::decode(ArgumentDecoder* decoder, MimeClassInf
 }
 
 
-void ArgumentCoder<PluginInfo>::encode(ArgumentEncoder* encoder, const PluginInfo& pluginInfo)
+void ArgumentCoder<PluginInfo>::encode(ArgumentEncoder& encoder, const PluginInfo& pluginInfo)
 {
-    encoder->encode(pluginInfo.name);
-    encoder->encode(pluginInfo.file);
-    encoder->encode(pluginInfo.desc);
-    encoder->encode(pluginInfo.mimes);
+    encoder << pluginInfo.name << pluginInfo.file << pluginInfo.desc << pluginInfo.mimes;
 }
     
 bool ArgumentCoder<PluginInfo>::decode(ArgumentDecoder* decoder, PluginInfo& pluginInfo)
@@ -185,9 +182,9 @@ bool ArgumentCoder<PluginInfo>::decode(ArgumentDecoder* decoder, PluginInfo& plu
 }
 
 
-void ArgumentCoder<HTTPHeaderMap>::encode(ArgumentEncoder* encoder, const HTTPHeaderMap& headerMap)
+void ArgumentCoder<HTTPHeaderMap>::encode(ArgumentEncoder& encoder, const HTTPHeaderMap& headerMap)
 {
-    encoder->encode(static_cast<const HashMap<AtomicString, String, CaseFoldingHash>&>(headerMap));
+    encoder << static_cast<const HashMap<AtomicString, String, CaseFoldingHash>&>(headerMap);
 }
 
 bool ArgumentCoder<HTTPHeaderMap>::decode(ArgumentDecoder* decoder, HTTPHeaderMap& headerMap)
@@ -196,13 +193,9 @@ bool ArgumentCoder<HTTPHeaderMap>::decode(ArgumentDecoder* decoder, HTTPHeaderMa
 }
 
 
-void ArgumentCoder<AuthenticationChallenge>::encode(ArgumentEncoder* encoder, const AuthenticationChallenge& challenge)
+void ArgumentCoder<AuthenticationChallenge>::encode(ArgumentEncoder& encoder, const AuthenticationChallenge& challenge)
 {
-    encoder->encode(challenge.protectionSpace());
-    encoder->encode(challenge.proposedCredential());
-    encoder->encode(challenge.previousFailureCount());
-    encoder->encode(challenge.failureResponse());
-    encoder->encode(challenge.error());
+    encoder << challenge.protectionSpace() << challenge.proposedCredential() << challenge.previousFailureCount() << challenge.failureResponse() << challenge.error();
 }
 
 bool ArgumentCoder<AuthenticationChallenge>::decode(ArgumentDecoder* decoder, AuthenticationChallenge& challenge)
@@ -232,13 +225,11 @@ bool ArgumentCoder<AuthenticationChallenge>::decode(ArgumentDecoder* decoder, Au
 }
 
 
-void ArgumentCoder<ProtectionSpace>::encode(ArgumentEncoder* encoder, const ProtectionSpace& space)
+void ArgumentCoder<ProtectionSpace>::encode(ArgumentEncoder& encoder, const ProtectionSpace& space)
 {
-    encoder->encode(space.host());
-    encoder->encode(space.port());
-    encoder->encodeEnum(space.serverType());
-    encoder->encode(space.realm());
-    encoder->encodeEnum(space.authenticationScheme());
+    encoder << space.host() << space.port() << space.realm();
+    encoder.encodeEnum(space.authenticationScheme());
+    encoder.encodeEnum(space.serverType());
 }
 
 bool ArgumentCoder<ProtectionSpace>::decode(ArgumentDecoder* decoder, ProtectionSpace& space)
@@ -251,10 +242,6 @@ bool ArgumentCoder<ProtectionSpace>::decode(ArgumentDecoder* decoder, Protection
     if (!decoder->decode(port))
         return false;
 
-    ProtectionSpaceServerType serverType;
-    if (!decoder->decodeEnum(serverType))
-        return false;
-
     String realm;
     if (!decoder->decode(realm))
         return false;
@@ -263,15 +250,18 @@ bool ArgumentCoder<ProtectionSpace>::decode(ArgumentDecoder* decoder, Protection
     if (!decoder->decodeEnum(authenticationScheme))
         return false;
 
+    ProtectionSpaceServerType serverType;
+    if (!decoder->decodeEnum(serverType))
+        return false;
+
     space = ProtectionSpace(host, port, serverType, realm, authenticationScheme);
     return true;
 }
 
-void ArgumentCoder<Credential>::encode(ArgumentEncoder* encoder, const Credential& credential)
+void ArgumentCoder<Credential>::encode(ArgumentEncoder& encoder, const Credential& credential)
 {
-    encoder->encode(credential.user());
-    encoder->encode(credential.password());
-    encoder->encodeEnum(credential.persistence());
+    encoder << credential.user() << credential.password();
+    encoder.encodeEnum(credential.persistence());
 }
 
 bool ArgumentCoder<Credential>::decode(ArgumentDecoder* decoder, Credential& credential)
@@ -292,7 +282,7 @@ bool ArgumentCoder<Credential>::decode(ArgumentDecoder* decoder, Credential& cre
     return true;
 }
 
-static void encodeImage(ArgumentEncoder* encoder, Image* image)
+static void encodeImage(ArgumentEncoder& encoder, Image* image)
 {
     RefPtr<ShareableBitmap> bitmap = ShareableBitmap::createShareable(image->size(), ShareableBitmap::SupportsAlpha);
     bitmap->createGraphicsContext()->drawImage(image, ColorSpaceDeviceRGB, IntPoint());
@@ -300,7 +290,7 @@ static void encodeImage(ArgumentEncoder* encoder, Image* image)
     ShareableBitmap::Handle handle;
     bitmap->createHandle(handle);
 
-    encoder->encode(handle);
+    encoder << handle;
 }
 
 static bool decodeImage(ArgumentDecoder* decoder, RefPtr<Image>& image)
@@ -318,21 +308,21 @@ static bool decodeImage(ArgumentDecoder* decoder, RefPtr<Image>& image)
     return true;
 }
 
-void ArgumentCoder<Cursor>::encode(ArgumentEncoder* encoder, const Cursor& cursor)
+void ArgumentCoder<Cursor>::encode(ArgumentEncoder& encoder, const Cursor& cursor)
 {
-    encoder->encodeEnum(cursor.type());
+    encoder.encodeEnum(cursor.type());
         
     if (cursor.type() != Cursor::Custom)
         return;
 
     if (cursor.image()->isNull()) {
-        encoder->encode(false); // There is no valid image being encoded.
+        encoder << false; // There is no valid image being encoded.
         return;
     }
 
-    encoder->encode(true);
+    encoder << true;
     encodeImage(encoder, cursor.image());
-    encoder->encode(cursor.hotSpot());
+    encoder << cursor.hotSpot();
 }
 
 bool ArgumentCoder<Cursor>::decode(ArgumentDecoder* decoder, Cursor& cursor)
@@ -378,21 +368,19 @@ bool ArgumentCoder<Cursor>::decode(ArgumentDecoder* decoder, Cursor& cursor)
     return true;
 }
 
-void ArgumentCoder<ResourceRequest>::encode(ArgumentEncoder* encoder, const ResourceRequest& resourceRequest)
+void ArgumentCoder<ResourceRequest>::encode(ArgumentEncoder& encoder, const ResourceRequest& resourceRequest)
 {
     if (kShouldSerializeWebCoreData) {
-        encoder->encode(resourceRequest.url().string());
-        encoder->encode(resourceRequest.httpMethod());
-
-        const HTTPHeaderMap& headers = resourceRequest.httpHeaderFields();
-        encoder->encode(headers);
+        encoder << resourceRequest.url().string();
+        encoder << resourceRequest.httpMethod();
+        encoder << resourceRequest.httpHeaderFields();
 
         FormData* httpBody = resourceRequest.httpBody();
-        encoder->encode(static_cast<bool>(httpBody));
+        encoder << static_cast<bool>(httpBody);
         if (httpBody)
-            encoder->encode(httpBody->flattenToString());
+            encoder << httpBody->flattenToString();
 
-        encoder->encode(resourceRequest.firstPartyForCookies().string());
+        encoder << resourceRequest.firstPartyForCookies().string();
     }
 
     encodePlatformData(encoder, resourceRequest);
@@ -439,25 +427,23 @@ bool ArgumentCoder<ResourceRequest>::decode(ArgumentDecoder* decoder, ResourceRe
     return decodePlatformData(decoder, resourceRequest);
 }
 
-void ArgumentCoder<ResourceResponse>::encode(ArgumentEncoder* encoder, const ResourceResponse& resourceResponse)
+void ArgumentCoder<ResourceResponse>::encode(ArgumentEncoder& encoder, const ResourceResponse& resourceResponse)
 {
     if (kShouldSerializeWebCoreData) {
         bool responseIsNull = resourceResponse.isNull();
-        encoder->encode(responseIsNull);
+        encoder << responseIsNull;
         if (responseIsNull)
             return;
 
-        encoder->encode(resourceResponse.url().string());
-        encoder->encode(static_cast<int32_t>(resourceResponse.httpStatusCode()));
-
-        const HTTPHeaderMap& headers = resourceResponse.httpHeaderFields();
-        encoder->encode(headers);
+        encoder << resourceResponse.url().string();
+        encoder << static_cast<int32_t>(resourceResponse.httpStatusCode());
+        encoder << resourceResponse.httpHeaderFields();
 
-        encoder->encode(resourceResponse.mimeType());
-        encoder->encode(resourceResponse.textEncodingName());
-        encoder->encode(static_cast<int64_t>(resourceResponse.expectedContentLength()));
-        encoder->encode(resourceResponse.httpStatusText());
-        encoder->encode(resourceResponse.suggestedFilename());
+        encoder << resourceResponse.mimeType();
+        encoder << resourceResponse.textEncodingName();
+        encoder << static_cast<int64_t>(resourceResponse.expectedContentLength());
+        encoder << resourceResponse.httpStatusText();
+        encoder << resourceResponse.suggestedFilename();
     }
 
     encodePlatformData(encoder, resourceResponse);
@@ -523,20 +509,20 @@ bool ArgumentCoder<ResourceResponse>::decode(ArgumentDecoder* decoder, ResourceR
     return decodePlatformData(decoder, resourceResponse);
 }
 
-void ArgumentCoder<ResourceError>::encode(ArgumentEncoder* encoder, const ResourceError& resourceError)
+void ArgumentCoder<ResourceError>::encode(ArgumentEncoder& encoder, const ResourceError& resourceError)
 {
     if (kShouldSerializeWebCoreData) {
         bool errorIsNull = resourceError.isNull();
-        encoder->encode(errorIsNull);
+        encoder << errorIsNull;
         if (errorIsNull)
             return;
 
-        encoder->encode(resourceError.domain());
-        encoder->encode(resourceError.errorCode());
-        encoder->encode(resourceError.failingURL());
-        encoder->encode(resourceError.localizedDescription());
-        encoder->encode(resourceError.isCancellation());
-        encoder->encode(resourceError.isTimeout());
+        encoder << resourceError.domain();
+        encoder << resourceError.errorCode();
+        encoder << resourceError.failingURL();
+        encoder << resourceError.localizedDescription();
+        encoder << resourceError.isCancellation();
+        encoder << resourceError.isTimeout();
     }
 
     encodePlatformData(encoder, resourceError);
@@ -585,24 +571,24 @@ bool ArgumentCoder<ResourceError>::decode(ArgumentDecoder* decoder, ResourceErro
     return decodePlatformData(decoder, resourceError);
 }
 
-void ArgumentCoder<WindowFeatures>::encode(ArgumentEncoder* encoder, const WindowFeatures& windowFeatures)
+void ArgumentCoder<WindowFeatures>::encode(ArgumentEncoder& encoder, const WindowFeatures& windowFeatures)
 {
-    encoder->encode(windowFeatures.x);
-    encoder->encode(windowFeatures.y);
-    encoder->encode(windowFeatures.width);
-    encoder->encode(windowFeatures.height);
-    encoder->encode(windowFeatures.xSet);
-    encoder->encode(windowFeatures.ySet);
-    encoder->encode(windowFeatures.widthSet);
-    encoder->encode(windowFeatures.heightSet);
-    encoder->encode(windowFeatures.menuBarVisible);
-    encoder->encode(windowFeatures.statusBarVisible);
-    encoder->encode(windowFeatures.toolBarVisible);
-    encoder->encode(windowFeatures.locationBarVisible);
-    encoder->encode(windowFeatures.scrollbarsVisible);
-    encoder->encode(windowFeatures.resizable);
-    encoder->encode(windowFeatures.fullscreen);
-    encoder->encode(windowFeatures.dialog);
+    encoder << windowFeatures.x;
+    encoder << windowFeatures.y;
+    encoder << windowFeatures.width;
+    encoder << windowFeatures.height;
+    encoder << windowFeatures.xSet;
+    encoder << windowFeatures.ySet;
+    encoder << windowFeatures.widthSet;
+    encoder << windowFeatures.heightSet;
+    encoder << windowFeatures.menuBarVisible;
+    encoder << windowFeatures.statusBarVisible;
+    encoder << windowFeatures.toolBarVisible;
+    encoder << windowFeatures.locationBarVisible;
+    encoder << windowFeatures.scrollbarsVisible;
+    encoder << windowFeatures.resizable;
+    encoder << windowFeatures.fullscreen;
+    encoder << windowFeatures.dialog;
 }
 
 bool ArgumentCoder<WindowFeatures>::decode(ArgumentDecoder* decoder, WindowFeatures& windowFeatures)
@@ -643,15 +629,15 @@ bool ArgumentCoder<WindowFeatures>::decode(ArgumentDecoder* decoder, WindowFeatu
 }
 
 
-void ArgumentCoder<Color>::encode(ArgumentEncoder* encoder, const Color& color)
+void ArgumentCoder<Color>::encode(ArgumentEncoder& encoder, const Color& color)
 {
     if (!color.isValid()) {
-        encoder->encode(false);
+        encoder << false;
         return;
     }
 
-    encoder->encode(true);
-    encoder->encode(color.rgb());
+    encoder << true;
+    encoder << color.rgb();
 }
 
 bool ArgumentCoder<Color>::decode(ArgumentDecoder* decoder, Color& color)
@@ -674,12 +660,12 @@ bool ArgumentCoder<Color>::decode(ArgumentDecoder* decoder, Color& color)
 }
 
 
-void ArgumentCoder<CompositionUnderline>::encode(ArgumentEncoder* encoder, const CompositionUnderline& underline)
+void ArgumentCoder<CompositionUnderline>::encode(ArgumentEncoder& encoder, const CompositionUnderline& underline)
 {
-    encoder->encode(underline.startOffset);
-    encoder->encode(underline.endOffset);
-    encoder->encode(underline.thick);
-    encoder->encode(underline.color);
+    encoder << underline.startOffset;
+    encoder << underline.endOffset;
+    encoder << underline.thick;
+    encoder << underline.color;
 }
 
 bool ArgumentCoder<CompositionUnderline>::decode(ArgumentDecoder* decoder, CompositionUnderline& underline)
@@ -697,12 +683,12 @@ bool ArgumentCoder<CompositionUnderline>::decode(ArgumentDecoder* decoder, Compo
 }
 
 #if ENABLE(SQL_DATABASE)
-void ArgumentCoder<DatabaseDetails>::encode(ArgumentEncoder* encoder, const DatabaseDetails& details)
+void ArgumentCoder<DatabaseDetails>::encode(ArgumentEncoder& encoder, const DatabaseDetails& details)
 {
-    encoder->encode(details.name());
-    encoder->encode(details.displayName());
-    encoder->encode(details.expectedUsage());
-    encoder->encode(details.currentUsage());
+    encoder << details.name();
+    encoder << details.displayName();
+    encoder << details.expectedUsage();
+    encoder << details.currentUsage();
 }
     
 bool ArgumentCoder<DatabaseDetails>::decode(ArgumentDecoder* decoder, DatabaseDetails& details)
@@ -728,11 +714,11 @@ bool ArgumentCoder<DatabaseDetails>::decode(ArgumentDecoder* decoder, DatabaseDe
 }
 #endif
 
-void ArgumentCoder<DictationAlternative>::encode(ArgumentEncoder* encoder, const DictationAlternative& dictationAlternative)
+void ArgumentCoder<DictationAlternative>::encode(ArgumentEncoder& encoder, const DictationAlternative& dictationAlternative)
 {
-    encoder->encode(dictationAlternative.rangeStart);
-    encoder->encode(dictationAlternative.rangeLength);
-    encoder->encode(dictationAlternative.dictationContext);
+    encoder << dictationAlternative.rangeStart;
+    encoder << dictationAlternative.rangeLength;
+    encoder << dictationAlternative.dictationContext;
 }
 
 bool ArgumentCoder<DictationAlternative>::decode(ArgumentDecoder* decoder, DictationAlternative& dictationAlternative)
@@ -747,16 +733,16 @@ bool ArgumentCoder<DictationAlternative>::decode(ArgumentDecoder* decoder, Dicta
 }
 
 
-void ArgumentCoder<FileChooserSettings>::encode(ArgumentEncoder* encoder, const FileChooserSettings& settings)
+void ArgumentCoder<FileChooserSettings>::encode(ArgumentEncoder& encoder, const FileChooserSettings& settings)
 {
-    encoder->encode(settings.allowsMultipleFiles);
+    encoder << settings.allowsMultipleFiles;
 #if ENABLE(DIRECTORY_UPLOAD)
-    encoder->encode(settings.allowsDirectoryUpload);
+    encoder << settings.allowsDirectoryUpload;
 #endif
-    encoder->encode(settings.acceptMIMETypes);
-    encoder->encode(settings.selectedFiles);
+    encoder << settings.acceptMIMETypes;
+    encoder << settings.selectedFiles;
 #if ENABLE(MEDIA_CAPTURE)
-    encoder->encode(settings.capture);
+    encoder << settings.capture;
 #endif
 }
 
@@ -781,12 +767,12 @@ bool ArgumentCoder<FileChooserSettings>::decode(ArgumentDecoder* decoder, FileCh
 }
 
 
-void ArgumentCoder<GrammarDetail>::encode(ArgumentEncoder* encoder, const GrammarDetail& detail)
+void ArgumentCoder<GrammarDetail>::encode(ArgumentEncoder& encoder, const GrammarDetail& detail)
 {
-    encoder->encode(detail.location);
-    encoder->encode(detail.length);
-    encoder->encode(detail.guesses);
-    encoder->encode(detail.userDescription);
+    encoder << detail.location;
+    encoder << detail.length;
+    encoder << detail.guesses;
+    encoder << detail.userDescription;
 }
 
 bool ArgumentCoder<GrammarDetail>::decode(ArgumentDecoder* decoder, GrammarDetail& detail)
@@ -804,13 +790,13 @@ bool ArgumentCoder<GrammarDetail>::decode(ArgumentDecoder* decoder, GrammarDetai
 }
 
 
-void ArgumentCoder<TextCheckingResult>::encode(ArgumentEncoder* encoder, const TextCheckingResult& result)
+void ArgumentCoder<TextCheckingResult>::encode(ArgumentEncoder& encoder, const TextCheckingResult& result)
 {
-    encoder->encodeEnum(result.type);
-    encoder->encode(result.location);
-    encoder->encode(result.length);
-    encoder->encode(result.details);
-    encoder->encode(result.replacement);
+    encoder.encodeEnum(result.type);
+    encoder << result.location;
+    encoder << result.length;
+    encoder << result.details;
+    encoder << result.replacement;
 }
 
 bool ArgumentCoder<TextCheckingResult>::decode(ArgumentDecoder* decoder, TextCheckingResult& result)
@@ -828,11 +814,11 @@ bool ArgumentCoder<TextCheckingResult>::decode(ArgumentDecoder* decoder, TextChe
     return true;
 }
 
-void ArgumentCoder<DragSession>::encode(ArgumentEncoder* encoder, const DragSession& result)
+void ArgumentCoder<DragSession>::encode(ArgumentEncoder& encoder, const DragSession& result)
 {
-    encoder->encodeEnum(result.operation);
-    encoder->encode(result.mouseIsOverFileInput);
-    encoder->encode(result.numberOfItemsToBeAccepted);
+    encoder.encodeEnum(result.operation);
+    encoder << result.mouseIsOverFileInput;
+    encoder << result.numberOfItemsToBeAccepted;
 }
 
 bool ArgumentCoder<DragSession>::decode(ArgumentDecoder* decoder, DragSession& result)
@@ -846,9 +832,9 @@ bool ArgumentCoder<DragSession>::decode(ArgumentDecoder* decoder, DragSession& r
     return true;
 }
 
-void ArgumentCoder<KURL>::encode(ArgumentEncoder* encoder, const KURL& result)
+void ArgumentCoder<KURL>::encode(ArgumentEncoder& encoder, const KURL& result)
 {
-    encoder->encode(result.string());
+    encoder << result.string();
 }
     
 bool ArgumentCoder<KURL>::decode(ArgumentDecoder* decoder, KURL& result)
@@ -860,14 +846,14 @@ bool ArgumentCoder<KURL>::decode(ArgumentDecoder* decoder, KURL& result)
     return true;
 }
 
-void ArgumentCoder<WebCore::UserStyleSheet>::encode(ArgumentEncoder* encoder, const WebCore::UserStyleSheet& userStyleSheet)
+void ArgumentCoder<WebCore::UserStyleSheet>::encode(ArgumentEncoder& encoder, const WebCore::UserStyleSheet& userStyleSheet)
 {
-    encoder->encode(userStyleSheet.source());
-    encoder->encode(userStyleSheet.url());
-    encoder->encode(userStyleSheet.whitelist());
-    encoder->encode(userStyleSheet.blacklist());
-    encoder->encodeEnum(userStyleSheet.injectedFrames());
-    encoder->encodeEnum(userStyleSheet.level());
+    encoder << userStyleSheet.source();
+    encoder << userStyleSheet.url();
+    encoder << userStyleSheet.whitelist();
+    encoder << userStyleSheet.blacklist();
+    encoder.encodeEnum(userStyleSheet.injectedFrames());
+    encoder.encodeEnum(userStyleSheet.level());
 }
 
 bool ArgumentCoder<WebCore::UserStyleSheet>::decode(ArgumentDecoder* decoder, WebCore::UserStyleSheet& userStyleSheet)
@@ -900,14 +886,14 @@ bool ArgumentCoder<WebCore::UserStyleSheet>::decode(ArgumentDecoder* decoder, We
     return true;
 }
 
-void ArgumentCoder<WebCore::UserScript>::encode(ArgumentEncoder* encoder, const WebCore::UserScript& userScript)
+void ArgumentCoder<WebCore::UserScript>::encode(ArgumentEncoder& encoder, const WebCore::UserScript& userScript)
 {
-    encoder->encode(userScript.source());
-    encoder->encode(userScript.url());
-    encoder->encode(userScript.whitelist());
-    encoder->encode(userScript.blacklist());
-    encoder->encodeEnum(userScript.injectionTime());
-    encoder->encodeEnum(userScript.injectedFrames());
+    encoder << userScript.source();
+    encoder << userScript.url();
+    encoder << userScript.whitelist();
+    encoder << userScript.blacklist();
+    encoder.encodeEnum(userScript.injectionTime());
+    encoder.encodeEnum(userScript.injectedFrames());
 }
 
 bool ArgumentCoder<WebCore::UserScript>::decode(ArgumentDecoder* decoder, WebCore::UserScript& userScript)
diff --git a/Source/WebKit2/Shared/WebCoreArgumentCoders.h b/Source/WebKit2/Shared/WebCoreArgumentCoders.h
index 6850d6bc7..e25314758 100644
--- a/Source/WebKit2/Shared/WebCoreArgumentCoders.h
+++ b/Source/WebKit2/Shared/WebCoreArgumentCoders.h
@@ -72,77 +72,77 @@ namespace WebCore {
 namespace CoreIPC {
 
 template<> struct ArgumentCoder<WebCore::AffineTransform> {
-    static void encode(ArgumentEncoder*, const WebCore::AffineTransform&);
+    static void encode(ArgumentEncoder&, const WebCore::AffineTransform&);
     static bool decode(ArgumentDecoder*, WebCore::AffineTransform&);
 };
 
 template<> struct ArgumentCoder<WebCore::FloatPoint> {
-    static void encode(ArgumentEncoder*, const WebCore::FloatPoint&);
+    static void encode(ArgumentEncoder&, const WebCore::FloatPoint&);
     static bool decode(ArgumentDecoder*, WebCore::FloatPoint&);
 };
 
 template<> struct ArgumentCoder<WebCore::FloatRect> {
-    static void encode(ArgumentEncoder*, const WebCore::FloatRect&);
+    static void encode(ArgumentEncoder&, const WebCore::FloatRect&);
     static bool decode(ArgumentDecoder*, WebCore::FloatRect&);
 };
 
 template<> struct ArgumentCoder<WebCore::FloatSize> {
-    static void encode(ArgumentEncoder*, const WebCore::FloatSize&);
+    static void encode(ArgumentEncoder&, const WebCore::FloatSize&);
     static bool decode(ArgumentDecoder*, WebCore::FloatSize&);
 };
 
 template<> struct ArgumentCoder<WebCore::IntPoint> {
-    static void encode(ArgumentEncoder*, const WebCore::IntPoint&);
+    static void encode(ArgumentEncoder&, const WebCore::IntPoint&);
     static bool decode(ArgumentDecoder*, WebCore::IntPoint&);
 };
 
 template<> struct ArgumentCoder<WebCore::IntRect> {
-    static void encode(ArgumentEncoder*, const WebCore::IntRect&);
+    static void encode(ArgumentEncoder&, const WebCore::IntRect&);
     static bool decode(ArgumentDecoder*, WebCore::IntRect&);
 };
 
 template<> struct ArgumentCoder<WebCore::IntSize> {
-    static void encode(ArgumentEncoder*, const WebCore::IntSize&);
+    static void encode(ArgumentEncoder&, const WebCore::IntSize&);
     static bool decode(ArgumentDecoder*, WebCore::IntSize&);
 };
 
 template<> struct ArgumentCoder<WebCore::ViewportAttributes> {
-    static void encode(ArgumentEncoder*, const WebCore::ViewportAttributes&);
+    static void encode(ArgumentEncoder&, const WebCore::ViewportAttributes&);
     static bool decode(ArgumentDecoder*, WebCore::ViewportAttributes&);
 };
 
 template<> struct ArgumentCoder<WebCore::MimeClassInfo> {
-    static void encode(ArgumentEncoder*, const WebCore::MimeClassInfo&);
+    static void encode(ArgumentEncoder&, const WebCore::MimeClassInfo&);
     static bool decode(ArgumentDecoder*, WebCore::MimeClassInfo&);
 };
 
 template<> struct ArgumentCoder<WebCore::PluginInfo> {
-    static void encode(ArgumentEncoder*, const WebCore::PluginInfo&);
+    static void encode(ArgumentEncoder&, const WebCore::PluginInfo&);
     static bool decode(ArgumentDecoder*, WebCore::PluginInfo&);
 };
 
 template<> struct ArgumentCoder<WebCore::HTTPHeaderMap> {
-    static void encode(ArgumentEncoder*, const WebCore::HTTPHeaderMap&);
+    static void encode(ArgumentEncoder&, const WebCore::HTTPHeaderMap&);
     static bool decode(ArgumentDecoder*, WebCore::HTTPHeaderMap&);
 };
 
 template<> struct ArgumentCoder<WebCore::AuthenticationChallenge> {
-    static void encode(ArgumentEncoder*, const WebCore::AuthenticationChallenge&);
+    static void encode(ArgumentEncoder&, const WebCore::AuthenticationChallenge&);
     static bool decode(ArgumentDecoder*, WebCore::AuthenticationChallenge&);
 };
 
 template<> struct ArgumentCoder<WebCore::ProtectionSpace> {
-    static void encode(ArgumentEncoder*, const WebCore::ProtectionSpace&);
+    static void encode(ArgumentEncoder&, const WebCore::ProtectionSpace&);
     static bool decode(ArgumentDecoder*, WebCore::ProtectionSpace&);
 };
 
 template<> struct ArgumentCoder<WebCore::Credential> {
-    static void encode(ArgumentEncoder*, const WebCore::Credential&);
+    static void encode(ArgumentEncoder&, const WebCore::Credential&);
     static bool decode(ArgumentDecoder*, WebCore::Credential&);
 };
 
 template<> struct ArgumentCoder<WebCore::Cursor> {
-    static void encode(ArgumentEncoder*, const WebCore::Cursor&);
+    static void encode(ArgumentEncoder&, const WebCore::Cursor&);
     static bool decode(ArgumentDecoder*, WebCore::Cursor&);
 };
 
@@ -153,9 +153,9 @@ template<> struct ArgumentCoder<WebCore::ResourceRequest> {
     static const bool kShouldSerializeWebCoreData = true;
 #endif
 
-    static void encode(ArgumentEncoder*, const WebCore::ResourceRequest&);
+    static void encode(ArgumentEncoder&, const WebCore::ResourceRequest&);
     static bool decode(ArgumentDecoder*, WebCore::ResourceRequest&);
-    static void encodePlatformData(ArgumentEncoder*, const WebCore::ResourceRequest&);
+    static void encodePlatformData(ArgumentEncoder&, const WebCore::ResourceRequest&);
     static bool decodePlatformData(ArgumentDecoder*, WebCore::ResourceRequest&);
 };
 
@@ -166,9 +166,9 @@ template<> struct ArgumentCoder<WebCore::ResourceResponse> {
     static const bool kShouldSerializeWebCoreData = true;
 #endif
 
-    static void encode(ArgumentEncoder*, const WebCore::ResourceResponse&);
+    static void encode(ArgumentEncoder&, const WebCore::ResourceResponse&);
     static bool decode(ArgumentDecoder*, WebCore::ResourceResponse&);
-    static void encodePlatformData(ArgumentEncoder*, const WebCore::ResourceResponse&);
+    static void encodePlatformData(ArgumentEncoder&, const WebCore::ResourceResponse&);
     static bool decodePlatformData(ArgumentDecoder*, WebCore::ResourceResponse&);
 };
 
@@ -179,76 +179,76 @@ template<> struct ArgumentCoder<WebCore::ResourceError> {
     static const bool kShouldSerializeWebCoreData = true;
 #endif
 
-    static void encode(ArgumentEncoder*, const WebCore::ResourceError&);
+    static void encode(ArgumentEncoder&, const WebCore::ResourceError&);
     static bool decode(ArgumentDecoder*, WebCore::ResourceError&);
-    static void encodePlatformData(ArgumentEncoder*, const WebCore::ResourceError&);
+    static void encodePlatformData(ArgumentEncoder&, const WebCore::ResourceError&);
     static bool decodePlatformData(ArgumentDecoder*, WebCore::ResourceError&);
 };
 
 template<> struct ArgumentCoder<WebCore::WindowFeatures> {
-    static void encode(ArgumentEncoder*, const WebCore::WindowFeatures&);
+    static void encode(ArgumentEncoder&, const WebCore::WindowFeatures&);
     static bool decode(ArgumentDecoder*, WebCore::WindowFeatures&);
 };
 
 template<> struct ArgumentCoder<WebCore::Color> {
-    static void encode(ArgumentEncoder*, const WebCore::Color&);
+    static void encode(ArgumentEncoder&, const WebCore::Color&);
     static bool decode(ArgumentDecoder*, WebCore::Color&);
 };
 
 #if PLATFORM(MAC)
 template<> struct ArgumentCoder<WebCore::KeypressCommand> {
-    static void encode(ArgumentEncoder*, const WebCore::KeypressCommand&);
+    static void encode(ArgumentEncoder&, const WebCore::KeypressCommand&);
     static bool decode(ArgumentDecoder*, WebCore::KeypressCommand&);
 };
 #endif
 
 template<> struct ArgumentCoder<WebCore::CompositionUnderline> {
-    static void encode(ArgumentEncoder*, const WebCore::CompositionUnderline&);
+    static void encode(ArgumentEncoder&, const WebCore::CompositionUnderline&);
     static bool decode(ArgumentDecoder*, WebCore::CompositionUnderline&);
 };
 
 template<> struct ArgumentCoder<WebCore::DatabaseDetails> {
-    static void encode(ArgumentEncoder*, const WebCore::DatabaseDetails&);
+    static void encode(ArgumentEncoder&, const WebCore::DatabaseDetails&);
     static bool decode(ArgumentDecoder*, WebCore::DatabaseDetails&);
 };
 
 template<> struct ArgumentCoder<WebCore::DictationAlternative> {
-    static void encode(ArgumentEncoder*, const WebCore::DictationAlternative&);
+    static void encode(ArgumentEncoder&, const WebCore::DictationAlternative&);
     static bool decode(ArgumentDecoder*, WebCore::DictationAlternative&);
 };
 
 template<> struct ArgumentCoder<WebCore::FileChooserSettings> {
-    static void encode(ArgumentEncoder*, const WebCore::FileChooserSettings&);
+    static void encode(ArgumentEncoder&, const WebCore::FileChooserSettings&);
     static bool decode(ArgumentDecoder*, WebCore::FileChooserSettings&);
 };
 
 template<> struct ArgumentCoder<WebCore::GrammarDetail> {
-    static void encode(ArgumentEncoder*, const WebCore::GrammarDetail&);
+    static void encode(ArgumentEncoder&, const WebCore::GrammarDetail&);
     static bool decode(ArgumentDecoder*, WebCore::GrammarDetail&);
 };
 
 template<> struct ArgumentCoder<WebCore::TextCheckingResult> {
-    static void encode(ArgumentEncoder*, const WebCore::TextCheckingResult&);
+    static void encode(ArgumentEncoder&, const WebCore::TextCheckingResult&);
     static bool decode(ArgumentDecoder*, WebCore::TextCheckingResult&);
 };
     
 template<> struct ArgumentCoder<WebCore::DragSession> {
-    static void encode(ArgumentEncoder*, const WebCore::DragSession&);
+    static void encode(ArgumentEncoder&, const WebCore::DragSession&);
     static bool decode(ArgumentDecoder*, WebCore::DragSession&);
 };
 
 template<> struct ArgumentCoder<WebCore::KURL> {
-    static void encode(ArgumentEncoder*, const WebCore::KURL&);
+    static void encode(ArgumentEncoder&, const WebCore::KURL&);
     static bool decode(ArgumentDecoder*, WebCore::KURL&);
 };
 
 template<> struct ArgumentCoder<WebCore::UserStyleSheet> {
-    static void encode(ArgumentEncoder*, const WebCore::UserStyleSheet&);
+    static void encode(ArgumentEncoder&, const WebCore::UserStyleSheet&);
     static bool decode(ArgumentDecoder*, WebCore::UserStyleSheet&);
 };
 
 template<> struct ArgumentCoder<WebCore::UserScript> {
-    static void encode(ArgumentEncoder*, const WebCore::UserScript&);
+    static void encode(ArgumentEncoder&, const WebCore::UserScript&);
     static bool decode(ArgumentDecoder*, WebCore::UserScript&);
 };
 
diff --git a/Source/WebKit2/Shared/WebEvent.cpp b/Source/WebKit2/Shared/WebEvent.cpp
index 70bffa2c1..df3ed4ef4 100644
--- a/Source/WebKit2/Shared/WebEvent.cpp
+++ b/Source/WebKit2/Shared/WebEvent.cpp
@@ -46,11 +46,11 @@ WebEvent::WebEvent(Type type, Modifiers modifiers, double timestamp)
 {
 }
 
-void WebEvent::encode(CoreIPC::ArgumentEncoder* encoder) const
+void WebEvent::encode(CoreIPC::ArgumentEncoder& encoder) const
 {
-    encoder->encode(m_type);
-    encoder->encode(m_modifiers);
-    encoder->encode(m_timestamp);
+    encoder << m_type;
+    encoder << m_modifiers;
+    encoder << m_timestamp;
 }
 
 bool WebEvent::decode(CoreIPC::ArgumentDecoder* decoder, WebEvent& result)
diff --git a/Source/WebKit2/Shared/WebEvent.h b/Source/WebKit2/Shared/WebEvent.h
index 8111d5160..9681dc160 100644
--- a/Source/WebKit2/Shared/WebEvent.h
+++ b/Source/WebKit2/Shared/WebEvent.h
@@ -103,7 +103,7 @@ protected:
 
     WebEvent(Type, Modifiers, double timestamp);
 
-    void encode(CoreIPC::ArgumentEncoder*) const;
+    void encode(CoreIPC::ArgumentEncoder&) const;
     static bool decode(CoreIPC::ArgumentDecoder*, WebEvent&);
 
 private:
@@ -140,7 +140,7 @@ public:
     bool didActivateWebView() const { return m_didActivateWebView; }
 #endif
 
-    void encode(CoreIPC::ArgumentEncoder*) const;
+    void encode(CoreIPC::ArgumentEncoder&) const;
     static bool decode(CoreIPC::ArgumentDecoder*, WebMouseEvent&);
 
 private:
@@ -199,7 +199,7 @@ public:
     const WebCore::FloatSize& unacceleratedScrollingDelta() const { return m_unacceleratedScrollingDelta; }
 #endif
 
-    void encode(CoreIPC::ArgumentEncoder*) const;
+    void encode(CoreIPC::ArgumentEncoder&) const;
     static bool decode(CoreIPC::ArgumentDecoder*, WebWheelEvent&);
 
 private:
@@ -237,7 +237,7 @@ public:
     bool isKeypad() const { return m_isKeypad; }
     bool isSystemKey() const { return m_isSystemKey; }
 
-    void encode(CoreIPC::ArgumentEncoder*) const;
+    void encode(CoreIPC::ArgumentEncoder&) const;
     static bool decode(CoreIPC::ArgumentDecoder*, WebKeyboardEvent&);
 
     static bool isKeyboardEventType(Type);
@@ -268,7 +268,7 @@ public:
     const WebCore::IntSize area() const { return m_area; }
     const WebCore::FloatPoint delta() const { return m_delta; }
 
-    void encode(CoreIPC::ArgumentEncoder*) const;
+    void encode(CoreIPC::ArgumentEncoder&) const;
     static bool decode(CoreIPC::ArgumentDecoder*, WebGestureEvent&);
 
 private:
@@ -313,7 +313,7 @@ public:
 
     void setState(TouchPointState state) { m_state = state; }
 
-    void encode(CoreIPC::ArgumentEncoder*) const;
+    void encode(CoreIPC::ArgumentEncoder&) const;
     static bool decode(CoreIPC::ArgumentDecoder*, WebPlatformTouchPoint&);
 
 private:
@@ -336,7 +336,7 @@ public:
 
     const Vector<WebPlatformTouchPoint>& touchPoints() const { return m_touchPoints; }
 
-    void encode(CoreIPC::ArgumentEncoder*) const;
+    void encode(CoreIPC::ArgumentEncoder&) const;
     static bool decode(CoreIPC::ArgumentDecoder*, WebTouchEvent&);
   
 private:
diff --git a/Source/WebKit2/Shared/WebGeolocationPosition.cpp b/Source/WebKit2/Shared/WebGeolocationPosition.cpp
index 77d524cf4..645e8c0a3 100644
--- a/Source/WebKit2/Shared/WebGeolocationPosition.cpp
+++ b/Source/WebKit2/Shared/WebGeolocationPosition.cpp
@@ -51,7 +51,7 @@ WebGeolocationPosition::~WebGeolocationPosition()
 {
 }
 
-void WebGeolocationPosition::Data::encode(CoreIPC::ArgumentEncoder* encoder) const
+void WebGeolocationPosition::Data::encode(CoreIPC::ArgumentEncoder& encoder) const
 {
     CoreIPC::SimpleArgumentCoder<WebGeolocationPosition::Data>::encode(encoder, *this);
 }
diff --git a/Source/WebKit2/Shared/WebGeolocationPosition.h b/Source/WebKit2/Shared/WebGeolocationPosition.h
index a87bb062d..52ebed992 100644
--- a/Source/WebKit2/Shared/WebGeolocationPosition.h
+++ b/Source/WebKit2/Shared/WebGeolocationPosition.h
@@ -38,7 +38,7 @@ public:
     static const Type APIType = TypeGeolocationPosition;
 
     struct Data {
-        void encode(CoreIPC::ArgumentEncoder*) const;
+        void encode(CoreIPC::ArgumentEncoder&) const;
         static bool decode(CoreIPC::ArgumentDecoder*, Data&);
 
         double timestamp;
diff --git a/Source/WebKit2/Shared/WebGestureEvent.cpp b/Source/WebKit2/Shared/WebGestureEvent.cpp
index d491a5707..a9089e2bb 100644
--- a/Source/WebKit2/Shared/WebGestureEvent.cpp
+++ b/Source/WebKit2/Shared/WebGestureEvent.cpp
@@ -53,14 +53,14 @@ WebGestureEvent::WebGestureEvent(Type type, const IntPoint& position, const IntP
     ASSERT(isGestureEventType(type));
 }
 
-void WebGestureEvent::encode(CoreIPC::ArgumentEncoder* encoder) const
+void WebGestureEvent::encode(CoreIPC::ArgumentEncoder& encoder) const
 {
     WebEvent::encode(encoder);
 
-    encoder->encode(m_position);
-    encoder->encode(m_globalPosition);
-    encoder->encode(m_area);
-    encoder->encode(m_delta);
+    encoder << m_position;
+    encoder << m_globalPosition;
+    encoder << m_area;
+    encoder << m_delta;
 }
 
 bool WebGestureEvent::decode(CoreIPC::ArgumentDecoder* decoder, WebGestureEvent& t)
diff --git a/Source/WebKit2/Shared/WebHitTestResult.cpp b/Source/WebKit2/Shared/WebHitTestResult.cpp
index 799ed5220..c2f054e12 100644
--- a/Source/WebKit2/Shared/WebHitTestResult.cpp
+++ b/Source/WebKit2/Shared/WebHitTestResult.cpp
@@ -34,16 +34,16 @@ PassRefPtr<WebHitTestResult> WebHitTestResult::create(const WebHitTestResult::Da
     return adoptRef(new WebHitTestResult(hitTestResultData));
 }
 
-void WebHitTestResult::Data::encode(CoreIPC::ArgumentEncoder* encoder) const
+void WebHitTestResult::Data::encode(CoreIPC::ArgumentEncoder& encoder) const
 {
-    encoder->encode(absoluteImageURL);
-    encoder->encode(absolutePDFURL);
-    encoder->encode(absoluteLinkURL);
-    encoder->encode(absoluteMediaURL);
-    encoder->encode(linkLabel);
-    encoder->encode(linkTitle);
-    encoder->encode(isContentEditable);
-    encoder->encode(elementBoundingBox);
+    encoder << absoluteImageURL;
+    encoder << absolutePDFURL;
+    encoder << absoluteLinkURL;
+    encoder << absoluteMediaURL;
+    encoder << linkLabel;
+    encoder << linkTitle;
+    encoder << isContentEditable;
+    encoder << elementBoundingBox;
 }
 
 bool WebHitTestResult::Data::decode(CoreIPC::ArgumentDecoder* decoder, WebHitTestResult::Data& hitTestResultData)
diff --git a/Source/WebKit2/Shared/WebHitTestResult.h b/Source/WebKit2/Shared/WebHitTestResult.h
index e53a5c7e2..739050e11 100644
--- a/Source/WebKit2/Shared/WebHitTestResult.h
+++ b/Source/WebKit2/Shared/WebHitTestResult.h
@@ -86,7 +86,7 @@ public:
         {
         }
 
-        void encode(CoreIPC::ArgumentEncoder*) const;
+        void encode(CoreIPC::ArgumentEncoder&) const;
         static bool decode(CoreIPC::ArgumentDecoder*, WebHitTestResult::Data&);
     };
 
diff --git a/Source/WebKit2/Shared/WebKeyboardEvent.cpp b/Source/WebKit2/Shared/WebKeyboardEvent.cpp
index 119b86416..02056ff58 100644
--- a/Source/WebKit2/Shared/WebKeyboardEvent.cpp
+++ b/Source/WebKit2/Shared/WebKeyboardEvent.cpp
@@ -45,19 +45,19 @@ WebKeyboardEvent::WebKeyboardEvent(Type type, const String& text, const String&
     ASSERT(isKeyboardEventType(type));
 }
 
-void WebKeyboardEvent::encode(CoreIPC::ArgumentEncoder* encoder) const
+void WebKeyboardEvent::encode(CoreIPC::ArgumentEncoder& encoder) const
 {
     WebEvent::encode(encoder);
 
-    encoder->encode(m_text);
-    encoder->encode(m_unmodifiedText);
-    encoder->encode(m_keyIdentifier);
-    encoder->encode(m_windowsVirtualKeyCode);
-    encoder->encode(m_nativeVirtualKeyCode);
-    encoder->encode(m_macCharCode);
-    encoder->encode(m_isAutoRepeat);
-    encoder->encode(m_isKeypad);
-    encoder->encode(m_isSystemKey);
+    encoder << m_text;
+    encoder << m_unmodifiedText;
+    encoder << m_keyIdentifier;
+    encoder << m_windowsVirtualKeyCode;
+    encoder << m_nativeVirtualKeyCode;
+    encoder << m_macCharCode;
+    encoder << m_isAutoRepeat;
+    encoder << m_isKeypad;
+    encoder << m_isSystemKey;
 }
 
 bool WebKeyboardEvent::decode(CoreIPC::ArgumentDecoder* decoder, WebKeyboardEvent& result)
diff --git a/Source/WebKit2/Shared/WebLayerTreeInfo.cpp b/Source/WebKit2/Shared/WebLayerTreeInfo.cpp
index e08364006..d1b131fea 100644
--- a/Source/WebKit2/Shared/WebLayerTreeInfo.cpp
+++ b/Source/WebKit2/Shared/WebLayerTreeInfo.cpp
@@ -30,7 +30,7 @@ using namespace CoreIPC;
 
 namespace WebKit {
 
-void WebLayerInfo::encode(CoreIPC::ArgumentEncoder* encoder) const
+void WebLayerInfo::encode(CoreIPC::ArgumentEncoder& encoder) const
 {
     SimpleArgumentCoder<WebLayerInfo>::encode(encoder, *this);
 }
diff --git a/Source/WebKit2/Shared/WebLayerTreeInfo.h b/Source/WebKit2/Shared/WebLayerTreeInfo.h
index df44778a8..58e07bc02 100644
--- a/Source/WebKit2/Shared/WebLayerTreeInfo.h
+++ b/Source/WebKit2/Shared/WebLayerTreeInfo.h
@@ -37,14 +37,12 @@ enum { InvalidWebLayerID = 0 };
 // NOTE: WebLayerInfo should only use POD types, as to make serialization faster.
 struct WebLayerInfo {
     WebLayerInfo()
-        : parent(InvalidWebLayerID)
-        , replica(InvalidWebLayerID)
+        : replica(InvalidWebLayerID)
         , mask(InvalidWebLayerID)
         , imageBackingStoreID(0)
         , opacity(0)
         , flags(0) { }
 
-    WebLayerID parent;
     WebLayerID replica;
     WebLayerID mask;
     int64_t imageBackingStoreID;
@@ -71,7 +69,7 @@ struct WebLayerInfo {
         unsigned int flags;
     };
 
-    void encode(CoreIPC::ArgumentEncoder*) const;
+    void encode(CoreIPC::ArgumentEncoder&) const;
     static bool decode(CoreIPC::ArgumentDecoder*, WebLayerInfo&);
 };
 
diff --git a/Source/WebKit2/Shared/WebMemorySampler.cpp b/Source/WebKit2/Shared/WebMemorySampler.cpp
index 344f7f573..2cfd19b44 100644
--- a/Source/WebKit2/Shared/WebMemorySampler.cpp
+++ b/Source/WebKit2/Shared/WebMemorySampler.cpp
@@ -29,6 +29,7 @@
 #if ENABLE(MEMORY_SAMPLER)
 
 #include <stdio.h>
+#include <unistd.h>
 #include <wtf/text/CString.h>
 #include <wtf/text/StringBuilder.h>
 
@@ -82,7 +83,7 @@ void WebMemorySampler::start(const SandboxExtension::Handle& sampleLogFileHandle
 void WebMemorySampler::initializeTimers(double interval)
 {
     m_sampleTimer.startRepeating(1);
-    printf("Started memory sampler for process %s", processName().utf8().data());
+    printf("Started memory sampler for process %s %d", processName().utf8().data(), getpid());
     if (interval > 0) {
         m_stopTimer.startOneShot(interval);
         printf(" for a interval of %g seconds", interval);
@@ -98,7 +99,7 @@ void WebMemorySampler::stop()
         return;
     m_sampleTimer.stop();
     m_sampleLogFile = 0;
-    printf("Stopped memory sampler for process %s\n", processName().utf8().data());
+    printf("Stopped memory sampler for process %s %d\n", processName().utf8().data(), getpid());
     // Flush stdout buffer so python script can be guaranteed to read up to this point.
     fflush(stdout);
     m_isRunning = false;
@@ -135,7 +136,7 @@ void WebMemorySampler::initializeSandboxedLogFile(const SandboxExtension::Handle
 
 void WebMemorySampler::writeHeaders()
 {
-    String processDetails = "Process: " + processName() + '\n';
+    String processDetails = String::format("Process: %s Pid: %d\n", processName().utf8().data(), getpid());
 
     CString utf8String = processDetails.utf8();
     writeToFile(m_sampleLogFile, utf8String.data(), utf8String.length());
diff --git a/Source/WebKit2/Shared/WebMouseEvent.cpp b/Source/WebKit2/Shared/WebMouseEvent.cpp
index 32e6ac1f3..fb02ac39e 100644
--- a/Source/WebKit2/Shared/WebMouseEvent.cpp
+++ b/Source/WebKit2/Shared/WebMouseEvent.cpp
@@ -78,20 +78,20 @@ WebMouseEvent::WebMouseEvent(Type type, Button button, const IntPoint& position,
 }
 #endif
 
-void WebMouseEvent::encode(CoreIPC::ArgumentEncoder* encoder) const
+void WebMouseEvent::encode(CoreIPC::ArgumentEncoder& encoder) const
 {
     WebEvent::encode(encoder);
 
-    encoder->encode(m_button);
-    encoder->encode(m_position);
-    encoder->encode(m_globalPosition);
-    encoder->encode(m_deltaX);
-    encoder->encode(m_deltaY);
-    encoder->encode(m_deltaZ);
-    encoder->encode(m_clickCount);
+    encoder << m_button;
+    encoder << m_position;
+    encoder << m_globalPosition;
+    encoder << m_deltaX;
+    encoder << m_deltaY;
+    encoder << m_deltaZ;
+    encoder << m_clickCount;
 
 #if PLATFORM(WIN)
-    encoder->encode(m_didActivateWebView);
+    encoder << m_didActivateWebView;
 #endif
 }
 
diff --git a/Source/WebKit2/Shared/WebNavigationDataStore.h b/Source/WebKit2/Shared/WebNavigationDataStore.h
index 947d090c9..f521a582c 100644
--- a/Source/WebKit2/Shared/WebNavigationDataStore.h
+++ b/Source/WebKit2/Shared/WebNavigationDataStore.h
@@ -35,11 +35,11 @@
 namespace WebKit {
 
 struct WebNavigationDataStore {
-    void encode(CoreIPC::ArgumentEncoder* encoder) const
+    void encode(CoreIPC::ArgumentEncoder& encoder) const
     {
-        encoder->encode(url);
-        encoder->encode(title);
-        encoder->encode(originalRequest);
+        encoder << url;
+        encoder << title;
+        encoder << originalRequest;
     }
 
     static bool decode(CoreIPC::ArgumentDecoder* decoder, WebNavigationDataStore& store)
diff --git a/Source/WebKit2/Shared/WebNetworkInfo.cpp b/Source/WebKit2/Shared/WebNetworkInfo.cpp
index a2852341a..9b133f815 100644
--- a/Source/WebKit2/Shared/WebNetworkInfo.cpp
+++ b/Source/WebKit2/Shared/WebNetworkInfo.cpp
@@ -43,10 +43,10 @@ WebNetworkInfo::~WebNetworkInfo()
 {
 }
 
-void WebNetworkInfo::Data::encode(CoreIPC::ArgumentEncoder* encoder) const
+void WebNetworkInfo::Data::encode(CoreIPC::ArgumentEncoder& encoder) const
 {
-    encoder->encode(bandwidth);
-    encoder->encode(metered);
+    encoder.encode(bandwidth);
+    encoder.encode(metered);
 }
 
 bool WebNetworkInfo::Data::decode(CoreIPC::ArgumentDecoder* decoder, Data& result)
diff --git a/Source/WebKit2/Shared/WebNetworkInfo.h b/Source/WebKit2/Shared/WebNetworkInfo.h
index 4c1617374..b31bbe367 100644
--- a/Source/WebKit2/Shared/WebNetworkInfo.h
+++ b/Source/WebKit2/Shared/WebNetworkInfo.h
@@ -40,7 +40,7 @@ public:
     static const Type APIType = TypeNetworkInfo;
 
     struct Data {
-        void encode(CoreIPC::ArgumentEncoder*) const;
+        void encode(CoreIPC::ArgumentEncoder&) const;
         static bool decode(CoreIPC::ArgumentDecoder*, Data&);
 
         double bandwidth;
diff --git a/Source/WebKit2/Shared/WebPageCreationParameters.cpp b/Source/WebKit2/Shared/WebPageCreationParameters.cpp
index 27d55434a..2a4afd938 100644
--- a/Source/WebKit2/Shared/WebPageCreationParameters.cpp
+++ b/Source/WebKit2/Shared/WebPageCreationParameters.cpp
@@ -30,42 +30,42 @@
 
 namespace WebKit {
 
-void WebPageCreationParameters::encode(CoreIPC::ArgumentEncoder* encoder) const
+void WebPageCreationParameters::encode(CoreIPC::ArgumentEncoder& encoder) const
 {
-    encoder->encode(viewSize);
-    encoder->encode(isActive);
-    encoder->encode(isFocused);
-    encoder->encode(isVisible);
-    encoder->encode(isInWindow);
+    encoder << viewSize;
+    encoder << isActive;
+    encoder << isFocused;
+    encoder << isVisible;
+    encoder << isInWindow;
 
-    encoder->encode(store);
-    encoder->encodeEnum(drawingAreaType);
-    encoder->encode(pageGroupData);
-    encoder->encode(drawsBackground);
-    encoder->encode(drawsTransparentBackground);
-    encoder->encode(areMemoryCacheClientCallsEnabled);
-    encoder->encode(useFixedLayout);
-    encoder->encode(fixedLayoutSize);
-    encoder->encodeEnum(paginationMode);
-    encoder->encode(paginationBehavesLikeColumns);
-    encoder->encode(pageLength);
-    encoder->encode(gapBetweenPages);
-    encoder->encode(userAgent);
-    encoder->encode(sessionState);
-    encoder->encode(highestUsedBackForwardItemID);
-    encoder->encode(canRunBeforeUnloadConfirmPanel);
-    encoder->encode(canRunModal);
-    encoder->encode(deviceScaleFactor);
-    encoder->encode(mediaVolume);
+    encoder << store;
+    encoder.encodeEnum(drawingAreaType);
+    encoder << pageGroupData;
+    encoder << drawsBackground;
+    encoder << drawsTransparentBackground;
+    encoder << areMemoryCacheClientCallsEnabled;
+    encoder << useFixedLayout;
+    encoder << fixedLayoutSize;
+    encoder.encodeEnum(paginationMode);
+    encoder << paginationBehavesLikeColumns;
+    encoder << pageLength;
+    encoder << gapBetweenPages;
+    encoder << userAgent;
+    encoder << sessionState;
+    encoder << highestUsedBackForwardItemID;
+    encoder << canRunBeforeUnloadConfirmPanel;
+    encoder << canRunModal;
+    encoder << deviceScaleFactor;
+    encoder << mediaVolume;
 
 #if PLATFORM(MAC)
-    encoder->encode(isSmartInsertDeleteEnabled);
-    encoder->encodeEnum(layerHostingMode);
-    encoder->encode(colorSpace);
+    encoder << isSmartInsertDeleteEnabled;
+    encoder.encodeEnum(layerHostingMode);
+    encoder << colorSpace;
 #endif
 
 #if PLATFORM(WIN)
-    encoder->encode(reinterpret_cast<uint64_t>(nativeWindow));
+    encoder << reinterpret_cast<uint64_t>(nativeWindow);
 #endif
 }
 
diff --git a/Source/WebKit2/Shared/WebPageCreationParameters.h b/Source/WebKit2/Shared/WebPageCreationParameters.h
index 08c3bcd21..214c04c50 100644
--- a/Source/WebKit2/Shared/WebPageCreationParameters.h
+++ b/Source/WebKit2/Shared/WebPageCreationParameters.h
@@ -45,7 +45,7 @@ namespace CoreIPC {
 namespace WebKit {
 
 struct WebPageCreationParameters {
-    void encode(CoreIPC::ArgumentEncoder*) const;
+    void encode(CoreIPC::ArgumentEncoder&) const;
     static bool decode(CoreIPC::ArgumentDecoder*, WebPageCreationParameters&);
 
     WebCore::IntSize viewSize;
diff --git a/Source/WebKit2/Shared/WebPageGroupData.cpp b/Source/WebKit2/Shared/WebPageGroupData.cpp
index c227d8596..871b4d1d8 100644
--- a/Source/WebKit2/Shared/WebPageGroupData.cpp
+++ b/Source/WebKit2/Shared/WebPageGroupData.cpp
@@ -30,14 +30,14 @@
 
 namespace WebKit {
 
-void WebPageGroupData::encode(CoreIPC::ArgumentEncoder* encoder) const
+void WebPageGroupData::encode(CoreIPC::ArgumentEncoder& encoder) const
 {
-    encoder->encode(identifer);
-    encoder->encode(pageGroupID);
-    encoder->encode(visibleToInjectedBundle);
-    encoder->encode(visibleToHistoryClient);
-    encoder->encode(userStyleSheets);
-    encoder->encode(userScripts);
+    encoder << identifer;
+    encoder << pageGroupID;
+    encoder << visibleToInjectedBundle;
+    encoder << visibleToHistoryClient;
+    encoder << userStyleSheets;
+    encoder << userScripts;
 }
 
 bool WebPageGroupData::decode(CoreIPC::ArgumentDecoder* decoder, WebPageGroupData& data)
diff --git a/Source/WebKit2/Shared/WebPageGroupData.h b/Source/WebKit2/Shared/WebPageGroupData.h
index b9aa0f8f5..4dbfd2c31 100644
--- a/Source/WebKit2/Shared/WebPageGroupData.h
+++ b/Source/WebKit2/Shared/WebPageGroupData.h
@@ -39,7 +39,7 @@ class ArgumentEncoder;
 namespace WebKit {
 
 struct WebPageGroupData {
-    void encode(CoreIPC::ArgumentEncoder*) const;
+    void encode(CoreIPC::ArgumentEncoder&) const;
     static bool decode(CoreIPC::ArgumentDecoder*, WebPageGroupData&);
 
     String identifer;
diff --git a/Source/WebKit2/Shared/WebPlatformTouchPoint.cpp b/Source/WebKit2/Shared/WebPlatformTouchPoint.cpp
index 39026e0f5..bae8d65b0 100644
--- a/Source/WebKit2/Shared/WebPlatformTouchPoint.cpp
+++ b/Source/WebKit2/Shared/WebPlatformTouchPoint.cpp
@@ -57,15 +57,15 @@ WebPlatformTouchPoint::WebPlatformTouchPoint(unsigned id, TouchPointState state,
 {
 }
 
-void WebPlatformTouchPoint::encode(CoreIPC::ArgumentEncoder* encoder) const
+void WebPlatformTouchPoint::encode(CoreIPC::ArgumentEncoder& encoder) const
 {
-    encoder->encode(m_id);
-    encoder->encode(m_state);
-    encoder->encode(m_screenPosition);
-    encoder->encode(m_position);
-    encoder->encode(m_radius);
-    encoder->encode(m_rotationAngle);
-    encoder->encode(m_force);
+    encoder << m_id;
+    encoder << m_state;
+    encoder << m_screenPosition;
+    encoder << m_position;
+    encoder << m_radius;
+    encoder << m_rotationAngle;
+    encoder << m_force;
 }
 
 bool WebPlatformTouchPoint::decode(CoreIPC::ArgumentDecoder* decoder, WebPlatformTouchPoint& result)
diff --git a/Source/WebKit2/Shared/WebPopupItem.cpp b/Source/WebKit2/Shared/WebPopupItem.cpp
index 07a29e416..bbe48fbb7 100644
--- a/Source/WebKit2/Shared/WebPopupItem.cpp
+++ b/Source/WebKit2/Shared/WebPopupItem.cpp
@@ -66,17 +66,17 @@ WebPopupItem::WebPopupItem(Type type, const String& text, TextDirection textDire
 {
 }
 
-void WebPopupItem::encode(CoreIPC::ArgumentEncoder* encoder) const
+void WebPopupItem::encode(CoreIPC::ArgumentEncoder& encoder) const
 {
-    encoder->encodeEnum(m_type);
-    encoder->encode(m_text);
-    encoder->encodeEnum(m_textDirection);
-    encoder->encode(m_hasTextDirectionOverride);
-    encoder->encode(m_toolTip);
-    encoder->encode(m_accessibilityText);
-    encoder->encode(m_isEnabled);
-    encoder->encode(m_isLabel);
-    encoder->encode(m_isSelected);
+    encoder.encodeEnum(m_type);
+    encoder << m_text;
+    encoder.encodeEnum(m_textDirection);
+    encoder << m_hasTextDirectionOverride;
+    encoder << m_toolTip;
+    encoder << m_accessibilityText;
+    encoder << m_isEnabled;
+    encoder << m_isLabel;
+    encoder << m_isSelected;
 }
 
 bool WebPopupItem::decode(CoreIPC::ArgumentDecoder* decoder, WebPopupItem& item)
diff --git a/Source/WebKit2/Shared/WebPopupItem.h b/Source/WebKit2/Shared/WebPopupItem.h
index d8584bea5..6f8ecb101 100644
--- a/Source/WebKit2/Shared/WebPopupItem.h
+++ b/Source/WebKit2/Shared/WebPopupItem.h
@@ -46,7 +46,7 @@ struct WebPopupItem {
     WebPopupItem(Type);
     WebPopupItem(Type, const String& text, WebCore::TextDirection, bool hasTextDirectionOverride, const String& toolTip, const String& accessibilityText, bool isEnabled, bool isLabel, bool isSelected);
 
-    void encode(CoreIPC::ArgumentEncoder*) const;
+    void encode(CoreIPC::ArgumentEncoder&) const;
     static bool decode(CoreIPC::ArgumentDecoder*, WebPopupItem&);
 
     Type m_type;
diff --git a/Source/WebKit2/Shared/WebPreferencesStore.cpp b/Source/WebKit2/Shared/WebPreferencesStore.cpp
index 740a971aa..e73c0f679 100644
--- a/Source/WebKit2/Shared/WebPreferencesStore.cpp
+++ b/Source/WebKit2/Shared/WebPreferencesStore.cpp
@@ -59,13 +59,13 @@ WebPreferencesStore::WebPreferencesStore()
 {
 }
 
-void WebPreferencesStore::encode(CoreIPC::ArgumentEncoder* encoder) const
+void WebPreferencesStore::encode(CoreIPC::ArgumentEncoder& encoder) const
 {
-    encoder->encode(m_stringValues);
-    encoder->encode(m_boolValues);
-    encoder->encode(m_uint32Values);
-    encoder->encode(m_doubleValues);
-    encoder->encode(m_floatValues);
+    encoder << m_stringValues;
+    encoder << m_boolValues;
+    encoder << m_uint32Values;
+    encoder << m_doubleValues;
+    encoder << m_floatValues;
 }
 
 bool WebPreferencesStore::decode(CoreIPC::ArgumentDecoder* decoder, WebPreferencesStore& result)
@@ -227,4 +227,14 @@ double WebPreferencesStore::getDoubleValueForKey(const String& key) const
     return valueForKey(m_doubleValues, key);
 }
 
+bool WebPreferencesStore::setFloatValueForKey(const String& key, float value) 
+{
+    return setValueForKey(m_floatValues, key, value);
+}
+
+float WebPreferencesStore::getFloatValueForKey(const String& key) const
+{
+    return valueForKey(m_floatValues, key);
+}
+
 } // namespace WebKit
diff --git a/Source/WebKit2/Shared/WebPreferencesStore.h b/Source/WebKit2/Shared/WebPreferencesStore.h
index 7bbcae0c2..07d62ac69 100644
--- a/Source/WebKit2/Shared/WebPreferencesStore.h
+++ b/Source/WebKit2/Shared/WebPreferencesStore.h
@@ -138,6 +138,7 @@ namespace WebKit {
     macro(CookieEnabled, cookieEnabled, Bool, bool, true) \
     macro(PlugInSnapshottingEnabled, plugInSnapshottingEnabled, Bool, bool, false) \
     macro(PDFPluginEnabled, pdfPluginEnabled, Bool, bool, false) \
+    macro(UsesEncodingDetector, usesEncodingDetector, Bool, bool, false) \
     \
 
 #define FOR_EACH_WEBKIT_DOUBLE_PREFERENCE(macro) \
@@ -233,7 +234,7 @@ FOR_EACH_WEBKIT_PREFERENCE(DECLARE_KEY_GETTERS)
 struct WebPreferencesStore {
     WebPreferencesStore();
 
-    void encode(CoreIPC::ArgumentEncoder*) const;
+    void encode(CoreIPC::ArgumentEncoder&) const;
     static bool decode(CoreIPC::ArgumentDecoder*, WebPreferencesStore&);
 
     // NOTE: The getters in this class have non-standard names to aid in the use of the preference macros.
diff --git a/Source/WebKit2/Shared/WebProcessCreationParameters.cpp b/Source/WebKit2/Shared/WebProcessCreationParameters.cpp
index c3fcee6c2..56383f749 100644
--- a/Source/WebKit2/Shared/WebProcessCreationParameters.cpp
+++ b/Source/WebKit2/Shared/WebProcessCreationParameters.cpp
@@ -27,7 +27,7 @@
 #include "WebProcessCreationParameters.h"
 
 #include "ArgumentCoders.h"
-#if USE(CFURLSTORAGESESSIONS) && PLATFORM(WIN)
+#if PLATFORM(WIN) && USE(CFNETWORK)
 #include "ArgumentCodersCF.h"
 #endif
 
@@ -52,69 +52,69 @@ WebProcessCreationParameters::WebProcessCreationParameters()
 {
 }
 
-void WebProcessCreationParameters::encode(CoreIPC::ArgumentEncoder* encoder) const
+void WebProcessCreationParameters::encode(CoreIPC::ArgumentEncoder& encoder) const
 {
-    encoder->encode(injectedBundlePath);
-    encoder->encode(injectedBundlePathExtensionHandle);
-    encoder->encode(applicationCacheDirectory);
-    encoder->encode(applicationCacheDirectoryExtensionHandle);
-    encoder->encode(databaseDirectory);
-    encoder->encode(databaseDirectoryExtensionHandle);
-    encoder->encode(localStorageDirectory);
-    encoder->encode(localStorageDirectoryExtensionHandle);
-    encoder->encode(diskCacheDirectory);
-    encoder->encode(diskCacheDirectoryExtensionHandle);
-    encoder->encode(cookieStorageDirectory);
-    encoder->encode(cookieStorageDirectoryExtensionHandle);
-    encoder->encode(urlSchemesRegistererdAsEmptyDocument);
-    encoder->encode(urlSchemesRegisteredAsSecure);
-    encoder->encode(urlSchemesForWhichDomainRelaxationIsForbidden);
-    encoder->encode(urlSchemesRegisteredAsLocal);
-    encoder->encode(urlSchemesRegisteredAsNoAccess);
-    encoder->encode(urlSchemesRegisteredAsDisplayIsolated);
-    encoder->encode(urlSchemesRegisteredAsCORSEnabled);
-    encoder->encodeEnum(cacheModel);
-    encoder->encode(shouldTrackVisitedLinks);
-    encoder->encode(shouldAlwaysUseComplexTextCodePath);
-    encoder->encode(shouldUseFontSmoothing);
-    encoder->encode(iconDatabaseEnabled);
-    encoder->encode(terminationTimeout);
-    encoder->encode(languages);
-    encoder->encode(textCheckerState);
-    encoder->encode(fullKeyboardAccessEnabled);
-    encoder->encode(defaultRequestTimeoutInterval);
-#if PLATFORM(MAC) || USE(CFURLSTORAGESESSIONS)
-    encoder->encode(uiProcessBundleIdentifier);
+    encoder << injectedBundlePath;
+    encoder << injectedBundlePathExtensionHandle;
+    encoder << applicationCacheDirectory;
+    encoder << applicationCacheDirectoryExtensionHandle;
+    encoder << databaseDirectory;
+    encoder << databaseDirectoryExtensionHandle;
+    encoder << localStorageDirectory;
+    encoder << localStorageDirectoryExtensionHandle;
+    encoder << diskCacheDirectory;
+    encoder << diskCacheDirectoryExtensionHandle;
+    encoder << cookieStorageDirectory;
+    encoder << cookieStorageDirectoryExtensionHandle;
+    encoder << urlSchemesRegistererdAsEmptyDocument;
+    encoder << urlSchemesRegisteredAsSecure;
+    encoder << urlSchemesForWhichDomainRelaxationIsForbidden;
+    encoder << urlSchemesRegisteredAsLocal;
+    encoder << urlSchemesRegisteredAsNoAccess;
+    encoder << urlSchemesRegisteredAsDisplayIsolated;
+    encoder << urlSchemesRegisteredAsCORSEnabled;
+    encoder.encodeEnum(cacheModel);
+    encoder << shouldTrackVisitedLinks;
+    encoder << shouldAlwaysUseComplexTextCodePath;
+    encoder << shouldUseFontSmoothing;
+    encoder << iconDatabaseEnabled;
+    encoder << terminationTimeout;
+    encoder << languages;
+    encoder << textCheckerState;
+    encoder << fullKeyboardAccessEnabled;
+    encoder << defaultRequestTimeoutInterval;
+#if PLATFORM(MAC) || USE(CFNETWORK)
+    encoder << uiProcessBundleIdentifier;
 #endif
 #if PLATFORM(MAC)
-    encoder->encode(parentProcessName);
-    encoder->encode(presenterApplicationPid);
-    encoder->encode(nsURLCacheMemoryCapacity);
-    encoder->encode(nsURLCacheDiskCapacity);
-    encoder->encode(acceleratedCompositingPort);
-    encoder->encode(uiProcessBundleResourcePath);
-    encoder->encode(uiProcessBundleResourcePathExtensionHandle);
-    encoder->encode(shouldForceScreenFontSubstitution);
-    encoder->encode(shouldEnableKerningAndLigaturesByDefault);
+    encoder << parentProcessName;
+    encoder << presenterApplicationPid;
+    encoder << nsURLCacheMemoryCapacity;
+    encoder << nsURLCacheDiskCapacity;
+    encoder << acceleratedCompositingPort;
+    encoder << uiProcessBundleResourcePath;
+    encoder << uiProcessBundleResourcePathExtensionHandle;
+    encoder << shouldForceScreenFontSubstitution;
+    encoder << shouldEnableKerningAndLigaturesByDefault;
 #elif PLATFORM(WIN)
-    encoder->encode(shouldPaintNativeControls);
-    encoder->encode(cfURLCacheDiskCapacity);
-    encoder->encode(cfURLCacheMemoryCapacity);
-    encoder->encode(initialHTTPCookieAcceptPolicy);
-#if USE(CFURLSTORAGESESSIONS)
+    encoder << shouldPaintNativeControls;
+    encoder << cfURLCacheDiskCapacity;
+    encoder << cfURLCacheMemoryCapacity;
+    encoder << initialHTTPCookieAcceptPolicy;
+#if PLATFORM(MAC) || USE(CFNETWORK)
     CFDataRef storageSession = serializedDefaultStorageSession.get();
-    encoder->encode(static_cast<bool>(storageSession));
+    encoder << static_cast<bool>(storageSession);
     if (storageSession)
         CoreIPC::encode(encoder, storageSession);
-#endif // USE(CFURLSTORAGESESSIONS)
+#endif
 #endif
 
 #if ENABLE(NOTIFICATIONS) || ENABLE(LEGACY_NOTIFICATIONS)
-    encoder->encode(notificationPermissions);
+    encoder << notificationPermissions;
 #endif
 
 #if ENABLE(NETWORK_PROCESS)
-    encoder->encode(usesNetworkProcess);
+    encoder << usesNetworkProcess;
 #endif
 }
 
@@ -178,7 +178,7 @@ bool WebProcessCreationParameters::decode(CoreIPC::ArgumentDecoder* decoder, Web
         return false;
     if (!decoder->decode(parameters.defaultRequestTimeoutInterval))
         return false;
-#if PLATFORM(MAC) || USE(CFURLSTORAGESESSIONS)
+#if PLATFORM(MAC) || USE(CFNETWORK)
     if (!decoder->decode(parameters.uiProcessBundleIdentifier))
         return false;
 #endif
@@ -211,13 +211,13 @@ bool WebProcessCreationParameters::decode(CoreIPC::ArgumentDecoder* decoder, Web
         return false;
     if (!decoder->decode(parameters.initialHTTPCookieAcceptPolicy))
         return false;
-#if USE(CFURLSTORAGESESSIONS)
+#if PLATFORM(MAC) || USE(CFNETWORK)
     bool hasStorageSession = false;
     if (!decoder->decode(hasStorageSession))
         return false;
     if (hasStorageSession && !CoreIPC::decode(decoder, parameters.serializedDefaultStorageSession))
         return false;
-#endif // USE(CFURLSTORAGESESSIONS)
+#endif
 #endif
 
 #if ENABLE(NOTIFICATIONS) || ENABLE(LEGACY_NOTIFICATIONS)
diff --git a/Source/WebKit2/Shared/WebProcessCreationParameters.h b/Source/WebKit2/Shared/WebProcessCreationParameters.h
index 1f4880369..de5f9f32f 100644
--- a/Source/WebKit2/Shared/WebProcessCreationParameters.h
+++ b/Source/WebKit2/Shared/WebProcessCreationParameters.h
@@ -48,7 +48,7 @@ namespace WebKit {
 struct WebProcessCreationParameters {
     WebProcessCreationParameters();
 
-    void encode(CoreIPC::ArgumentEncoder*) const;
+    void encode(CoreIPC::ArgumentEncoder&) const;
     static bool decode(CoreIPC::ArgumentDecoder*, WebProcessCreationParameters&);
 
     String injectedBundlePath;
@@ -91,7 +91,7 @@ struct WebProcessCreationParameters {
 
     double defaultRequestTimeoutInterval;
 
-#if PLATFORM(MAC) || USE(CFURLSTORAGESESSIONS)
+#if PLATFORM(MAC) || USE(CFNETWORK)
     String uiProcessBundleIdentifier;
 #endif
 
@@ -119,9 +119,9 @@ struct WebProcessCreationParameters {
 
     bool shouldPaintNativeControls;
 
-#if USE(CFURLSTORAGESESSIONS)
+#if USE(CFNETWORK)
     RetainPtr<CFDataRef> serializedDefaultStorageSession;
-#endif // USE(CFURLSTORAGESESSIONS)
+#endif
 #endif // PLATFORM(WIN)
 
 #if ENABLE(NOTIFICATIONS) || ENABLE(LEGACY_NOTIFICATIONS)
diff --git a/Source/WebKit2/Shared/WebSecurityOrigin.h b/Source/WebKit2/Shared/WebSecurityOrigin.h
index 66074c54a..b6ec1c9c9 100644
--- a/Source/WebKit2/Shared/WebSecurityOrigin.h
+++ b/Source/WebKit2/Shared/WebSecurityOrigin.h
@@ -38,26 +38,24 @@ public:
 
     static PassRefPtr<WebSecurityOrigin> createFromString(const String& string)
     {
-        RefPtr<WebCore::SecurityOrigin> securityOrigin = WebCore::SecurityOrigin::createFromString(string);
-        if (!securityOrigin)
-            return 0;
-        return adoptRef(new WebSecurityOrigin(securityOrigin.release()));
+        return create(WebCore::SecurityOrigin::createFromString(string));
     }
 
     static PassRefPtr<WebSecurityOrigin> createFromDatabaseIdentifier(const String& identifier)
     {
-        RefPtr<WebCore::SecurityOrigin> securityOrigin = WebCore::SecurityOrigin::createFromDatabaseIdentifier(identifier);
-        if (!securityOrigin)
-            return 0;
-        return adoptRef(new WebSecurityOrigin(securityOrigin.release()));
+        return create(WebCore::SecurityOrigin::createFromDatabaseIdentifier(identifier));
     }
 
     static PassRefPtr<WebSecurityOrigin> create(const String& protocol, const String& host, int port)
     {
-        RefPtr<WebCore::SecurityOrigin> securityOrigin = WebCore::SecurityOrigin::create(protocol, host, port);
+        return create(WebCore::SecurityOrigin::create(protocol, host, port));
+    }
+
+    static PassRefPtr<WebSecurityOrigin> create(PassRefPtr<WebCore::SecurityOrigin> securityOrigin)
+    {
         if (!securityOrigin)
             return 0;
-        return adoptRef(new WebSecurityOrigin(securityOrigin.release()));
+        return adoptRef(new WebSecurityOrigin(securityOrigin));
     }
 
     const String protocol() const { return m_securityOrigin->protocol(); }
diff --git a/Source/WebKit2/Shared/WebTouchEvent.cpp b/Source/WebKit2/Shared/WebTouchEvent.cpp
index 7213c78db..1f7e9f7e5 100644
--- a/Source/WebKit2/Shared/WebTouchEvent.cpp
+++ b/Source/WebKit2/Shared/WebTouchEvent.cpp
@@ -40,11 +40,11 @@ WebTouchEvent::WebTouchEvent(WebEvent::Type type, Vector<WebPlatformTouchPoint>
     ASSERT(isTouchEventType(type));
 }
 
-void WebTouchEvent::encode(CoreIPC::ArgumentEncoder* encoder) const
+void WebTouchEvent::encode(CoreIPC::ArgumentEncoder& encoder) const
 {
     WebEvent::encode(encoder);
 
-    encoder->encode(m_touchPoints);
+    encoder << m_touchPoints;
 }
 
 bool WebTouchEvent::decode(CoreIPC::ArgumentDecoder* decoder, WebTouchEvent& result)
diff --git a/Source/WebKit2/Shared/WebWheelEvent.cpp b/Source/WebKit2/Shared/WebWheelEvent.cpp
index 37c691e64..3bd19f4ea 100644
--- a/Source/WebKit2/Shared/WebWheelEvent.cpp
+++ b/Source/WebKit2/Shared/WebWheelEvent.cpp
@@ -69,22 +69,22 @@ WebWheelEvent::WebWheelEvent(Type type, const IntPoint& position, const IntPoint
 }
 #endif
 
-void WebWheelEvent::encode(CoreIPC::ArgumentEncoder* encoder) const
+void WebWheelEvent::encode(CoreIPC::ArgumentEncoder& encoder) const
 {
     WebEvent::encode(encoder);
 
-    encoder->encode(m_position);
-    encoder->encode(m_globalPosition);
-    encoder->encode(m_delta);
-    encoder->encode(m_wheelTicks);
-    encoder->encode(m_granularity);
-    encoder->encode(m_directionInvertedFromDevice);
+    encoder << m_position;
+    encoder << m_globalPosition;
+    encoder << m_delta;
+    encoder << m_wheelTicks;
+    encoder << m_granularity;
+    encoder << m_directionInvertedFromDevice;
 #if PLATFORM(MAC)
-    encoder->encode(m_phase);
-    encoder->encode(m_momentumPhase);
-    encoder->encode(m_hasPreciseScrollingDeltas);
-    encoder->encode(m_scrollCount);
-    encoder->encode(m_unacceleratedScrollingDelta);
+    encoder << m_phase;
+    encoder << m_momentumPhase;
+    encoder << m_hasPreciseScrollingDeltas;
+    encoder << m_scrollCount;
+    encoder << m_unacceleratedScrollingDelta;
 #endif
 }
 
diff --git a/Source/WebKit2/Shared/cairo/LayerTreeContextCairo.cpp b/Source/WebKit2/Shared/cairo/LayerTreeContextCairo.cpp
index 915997660..5d37a3ccb 100644
--- a/Source/WebKit2/Shared/cairo/LayerTreeContextCairo.cpp
+++ b/Source/WebKit2/Shared/cairo/LayerTreeContextCairo.cpp
@@ -40,7 +40,7 @@ LayerTreeContext::~LayerTreeContext()
     notImplemented();
 }
 
-void LayerTreeContext::encode(CoreIPC::ArgumentEncoder*) const
+void LayerTreeContext::encode(CoreIPC::ArgumentEncoder&) const
 {
     notImplemented();
 }
diff --git a/Source/WebKit2/Shared/cf/ArgumentCodersCF.cpp b/Source/WebKit2/Shared/cf/ArgumentCodersCF.cpp
index 7261abda6..1f01de4e9 100644
--- a/Source/WebKit2/Shared/cf/ArgumentCodersCF.cpp
+++ b/Source/WebKit2/Shared/cf/ArgumentCodersCF.cpp
@@ -98,10 +98,10 @@ static CFType typeFromCFTypeRef(CFTypeRef type)
     return Unknown;
 }
 
-void encode(ArgumentEncoder* encoder, CFTypeRef typeRef)
+void encode(ArgumentEncoder& encoder, CFTypeRef typeRef)
 {
     CFType type = typeFromCFTypeRef(typeRef);
-    encoder->encodeEnum(type);
+    encoder.encodeEnum(type);
 
     switch (type) {
     case CFArray:
@@ -240,14 +240,15 @@ bool decode(ArgumentDecoder* decoder, RetainPtr<CFTypeRef>& result)
     return false;
 }
 
-void encode(ArgumentEncoder* encoder, CFArrayRef array)
+void encode(ArgumentEncoder& encoder, CFArrayRef array)
 {
     CFIndex size = CFArrayGetCount(array);
     Vector<CFTypeRef, 32> values(size);
 
     CFArrayGetValues(array, CFRangeMake(0, size), values.data());
 
-    encoder->encode(static_cast<uint64_t>(size));
+    encoder << static_cast<uint64_t>(size);
+
     for (CFIndex i = 0; i < size; ++i) {
         ASSERT(values[i]);
 
@@ -275,9 +276,9 @@ bool decode(ArgumentDecoder* decoder, RetainPtr<CFArrayRef>& result)
     return true;
 }
 
-void encode(ArgumentEncoder* encoder, CFBooleanRef boolean)
+void encode(ArgumentEncoder& encoder, CFBooleanRef boolean)
 {
-    encoder->encode(static_cast<bool>(CFBooleanGetValue(boolean)));
+    encoder << static_cast<bool>(CFBooleanGetValue(boolean));
 }
 
 bool decode(ArgumentDecoder* decoder, RetainPtr<CFBooleanRef>& result)
@@ -290,12 +291,12 @@ bool decode(ArgumentDecoder* decoder, RetainPtr<CFBooleanRef>& result)
     return true;
 }
 
-void encode(ArgumentEncoder* encoder, CFDataRef data)
+void encode(ArgumentEncoder& encoder, CFDataRef data)
 {
     CFIndex length = CFDataGetLength(data);
     const UInt8* bytePtr = CFDataGetBytePtr(data);
 
-    encoder->encodeVariableLengthByteArray(CoreIPC::DataReference(bytePtr, length));
+    encoder << CoreIPC::DataReference(bytePtr, length);
 }
 
 bool decode(ArgumentDecoder* decoder, RetainPtr<CFDataRef>& result)
@@ -308,9 +309,9 @@ bool decode(ArgumentDecoder* decoder, RetainPtr<CFDataRef>& result)
     return true;
 }
 
-void encode(ArgumentEncoder* encoder, CFDateRef date)
+void encode(ArgumentEncoder& encoder, CFDateRef date)
 {
-    encoder->encode(static_cast<double>(CFDateGetAbsoluteTime(date)));
+    encoder << static_cast<double>(CFDateGetAbsoluteTime(date));
 }
 
 bool decode(ArgumentDecoder* decoder, RetainPtr<CFDateRef>& result)
@@ -323,7 +324,7 @@ bool decode(ArgumentDecoder* decoder, RetainPtr<CFDateRef>& result)
     return true;
 }
 
-void encode(ArgumentEncoder* encoder, CFDictionaryRef dictionary)
+void encode(ArgumentEncoder& encoder, CFDictionaryRef dictionary)
 {
     CFIndex size = CFDictionaryGetCount(dictionary);
     Vector<CFTypeRef, 32> keys(size);
@@ -331,7 +332,7 @@ void encode(ArgumentEncoder* encoder, CFDictionaryRef dictionary)
     
     CFDictionaryGetKeysAndValues(dictionary, keys.data(), values.data());
 
-    encoder->encode(static_cast<uint64_t>(size));
+    encoder << static_cast<uint64_t>(size);
 
     for (CFIndex i = 0; i < size; ++i) {
         ASSERT(keys[i]);
@@ -371,7 +372,7 @@ bool decode(ArgumentDecoder* decoder, RetainPtr<CFDictionaryRef>& result)
     return true;
 }
 
-void encode(ArgumentEncoder* encoder, CFNumberRef number)
+void encode(ArgumentEncoder& encoder, CFNumberRef number)
 {
     CFNumberType numberType = CFNumberGetType(number);
 
@@ -379,8 +380,8 @@ void encode(ArgumentEncoder* encoder, CFNumberRef number)
     bool result = CFNumberGetValue(number, numberType, buffer.data());
     ASSERT_UNUSED(result, result);
 
-    encoder->encodeEnum(numberType);
-    encoder->encodeVariableLengthByteArray(buffer);
+    encoder.encodeEnum(numberType);
+    encoder << CoreIPC::DataReference(buffer);
 }
 
 static size_t sizeForNumberType(CFNumberType numberType)
@@ -452,7 +453,7 @@ bool decode(ArgumentDecoder* decoder, RetainPtr<CFNumberRef>& result)
     return true;
 }
 
-void encode(ArgumentEncoder* encoder, CFStringRef string)
+void encode(ArgumentEncoder& encoder, CFStringRef string)
 {
     CFIndex length = CFStringGetLength(string);
     CFStringEncoding encoding = CFStringGetFastestEncoding(string);
@@ -467,8 +468,8 @@ void encode(ArgumentEncoder* encoder, CFStringRef string)
     numConvertedBytes = CFStringGetBytes(string, range, encoding, 0, false, buffer.data(), buffer.size(), &bufferLength);
     ASSERT(numConvertedBytes == length);
 
-    encoder->encodeEnum(encoding);
-    encoder->encodeVariableLengthByteArray(buffer);
+    encoder.encodeEnum(encoding);
+    encoder << CoreIPC::DataReference(buffer);
 }
 
 bool decode(ArgumentDecoder* decoder, RetainPtr<CFStringRef>& result)
@@ -492,10 +493,10 @@ bool decode(ArgumentDecoder* decoder, RetainPtr<CFStringRef>& result)
     return true;
 }
 
-void encode(ArgumentEncoder* encoder, CFURLRef url)
+void encode(ArgumentEncoder& encoder, CFURLRef url)
 {
     CFURLRef baseURL = CFURLGetBaseURL(url);
-    encoder->encode(static_cast<bool>(baseURL));
+    encoder << static_cast<bool>(baseURL);
     if (baseURL)
         encode(encoder, baseURL);
 
@@ -536,7 +537,7 @@ bool decode(ArgumentDecoder* decoder, RetainPtr<CFURLRef>& result)
 }
 
 #if USE(SECURITY_FRAMEWORK)
-void encode(ArgumentEncoder* encoder, SecCertificateRef certificate)
+void encode(ArgumentEncoder& encoder, SecCertificateRef certificate)
 {
     RetainPtr<CFDataRef> data(AdoptCF, SecCertificateCopyData(certificate));
     encode(encoder, data.get());
@@ -552,7 +553,7 @@ bool decode(ArgumentDecoder* decoder, RetainPtr<SecCertificateRef>& result)
     return true;
 }
 
-void encode(ArgumentEncoder* encoder, SecKeychainItemRef keychainItem)
+void encode(ArgumentEncoder& encoder, SecKeychainItemRef keychainItem)
 {
     CFDataRef data;
     if (SecKeychainItemCreatePersistentReference(keychainItem, &data) == errSecSuccess) {
@@ -574,7 +575,6 @@ bool decode(ArgumentDecoder* decoder, RetainPtr<SecKeychainItemRef>& result)
     result.adoptCF(item);
     return true;
 }
-
 #endif
 
 } // namespace CoreIPC
diff --git a/Source/WebKit2/Shared/cf/ArgumentCodersCF.h b/Source/WebKit2/Shared/cf/ArgumentCodersCF.h
index 8f92f6205..514fa86bf 100644
--- a/Source/WebKit2/Shared/cf/ArgumentCodersCF.h
+++ b/Source/WebKit2/Shared/cf/ArgumentCodersCF.h
@@ -39,48 +39,48 @@ class ArgumentEncoder;
 class ArgumentDecoder;
 
 // CFArrayRef
-void encode(ArgumentEncoder*, CFArrayRef);
+void encode(ArgumentEncoder&, CFArrayRef);
 bool decode(ArgumentDecoder*, RetainPtr<CFArrayRef>& result);
 
 // CFBooleanRef
-void encode(ArgumentEncoder*, CFBooleanRef);
+void encode(ArgumentEncoder&, CFBooleanRef);
 bool decode(ArgumentDecoder*, RetainPtr<CFBooleanRef>& result);
 
 // CFDataRef
-void encode(ArgumentEncoder*, CFDataRef);
+void encode(ArgumentEncoder&, CFDataRef);
 bool decode(ArgumentDecoder*, RetainPtr<CFDataRef>& result);
 
 // CFDateRef
-void encode(ArgumentEncoder*, CFDateRef);
+void encode(ArgumentEncoder&, CFDateRef);
 bool decode(ArgumentDecoder*, RetainPtr<CFDateRef>& result);
 
 // CFDictionaryRef
-void encode(ArgumentEncoder*, CFDictionaryRef);
+void encode(ArgumentEncoder&, CFDictionaryRef);
 bool decode(ArgumentDecoder*, RetainPtr<CFDictionaryRef>& result);
 
 // CFNumberRef
-void encode(ArgumentEncoder*, CFNumberRef);
+void encode(ArgumentEncoder&, CFNumberRef);
 bool decode(ArgumentDecoder*, RetainPtr<CFNumberRef>& result);
 
 // CFStringRef
-void encode(ArgumentEncoder*, CFStringRef);
+void encode(ArgumentEncoder&, CFStringRef);
 bool decode(ArgumentDecoder*, RetainPtr<CFStringRef>& result);
 
 // CFTypeRef
-void encode(ArgumentEncoder*, CFTypeRef);
+void encode(ArgumentEncoder&, CFTypeRef);
 bool decode(ArgumentDecoder*, RetainPtr<CFTypeRef>& result);
 
 // CFURLRef
-void encode(ArgumentEncoder*, CFURLRef);
+void encode(ArgumentEncoder&, CFURLRef);
 bool decode(ArgumentDecoder*, RetainPtr<CFURLRef>& result);
 
 #if USE(SECURITY_FRAMEWORK)
 // SecCertificateRef
-void encode(ArgumentEncoder*, SecCertificateRef);
+void encode(ArgumentEncoder&, SecCertificateRef);
 bool decode(ArgumentDecoder*, RetainPtr<SecCertificateRef>& result);
 
 // SecKeychainItemRef
-void encode(ArgumentEncoder*, SecKeychainItemRef);
+void encode(ArgumentEncoder&, SecKeychainItemRef);
 bool decode(ArgumentDecoder*, RetainPtr<SecKeychainItemRef>& result);
 #endif
 
diff --git a/Source/WebKit2/Shared/efl/LayerTreeContextEfl.cpp b/Source/WebKit2/Shared/efl/LayerTreeContextEfl.cpp
index 881d78782..32fa970a8 100644
--- a/Source/WebKit2/Shared/efl/LayerTreeContextEfl.cpp
+++ b/Source/WebKit2/Shared/efl/LayerTreeContextEfl.cpp
@@ -40,9 +40,9 @@ LayerTreeContext::~LayerTreeContext()
 {
 }
 
-void LayerTreeContext::encode(CoreIPC::ArgumentEncoder* encoder) const
+void LayerTreeContext::encode(CoreIPC::ArgumentEncoder& encoder) const
 {
-    encoder->encode(webLayerID);
+    encoder.encode(webLayerID);
 }
 
 bool LayerTreeContext::decode(CoreIPC::ArgumentDecoder* decoder, LayerTreeContext& context)
diff --git a/Source/WebKit2/Shared/efl/NativeWebKeyboardEventEfl.cpp b/Source/WebKit2/Shared/efl/NativeWebKeyboardEventEfl.cpp
index 1ef02ba99..344a37c82 100644
--- a/Source/WebKit2/Shared/efl/NativeWebKeyboardEventEfl.cpp
+++ b/Source/WebKit2/Shared/efl/NativeWebKeyboardEventEfl.cpp
@@ -30,15 +30,17 @@
 
 namespace WebKit {
 
-NativeWebKeyboardEvent::NativeWebKeyboardEvent(const Evas_Event_Key_Down* event)
+NativeWebKeyboardEvent::NativeWebKeyboardEvent(const Evas_Event_Key_Down* event, bool isFiltered)
     : WebKeyboardEvent(WebEventFactory::createWebKeyboardEvent(event))
     , m_nativeEvent(event)
+    , m_isFiltered(isFiltered)
 {
 }
 
 NativeWebKeyboardEvent::NativeWebKeyboardEvent(const Evas_Event_Key_Up* event)
     : WebKeyboardEvent(WebEventFactory::createWebKeyboardEvent(event))
     , m_nativeEvent(event)
+    , m_isFiltered(false)
 {
 }
 
diff --git a/Source/WebKit2/Shared/efl/NativeWebMouseEventEfl.cpp b/Source/WebKit2/Shared/efl/NativeWebMouseEventEfl.cpp
index 2a4d6014d..0ba44bfa0 100644
--- a/Source/WebKit2/Shared/efl/NativeWebMouseEventEfl.cpp
+++ b/Source/WebKit2/Shared/efl/NativeWebMouseEventEfl.cpp
@@ -30,20 +30,20 @@
 
 namespace WebKit {
 
-NativeWebMouseEvent::NativeWebMouseEvent(const Evas_Event_Mouse_Down* event, const Evas_Point* position)
-    : WebMouseEvent(WebEventFactory::createWebMouseEvent(event, position))
+NativeWebMouseEvent::NativeWebMouseEvent(const Evas_Event_Mouse_Down* event, const WebCore::AffineTransform& toWebContent, const WebCore::AffineTransform& toDeviceScreen)
+    : WebMouseEvent(WebEventFactory::createWebMouseEvent(event, toWebContent, toDeviceScreen))
     , m_nativeEvent(event)
 {
 }
 
-NativeWebMouseEvent::NativeWebMouseEvent(const Evas_Event_Mouse_Up* event, const Evas_Point* position)
-    : WebMouseEvent(WebEventFactory::createWebMouseEvent(event, position))
+NativeWebMouseEvent::NativeWebMouseEvent(const Evas_Event_Mouse_Up* event, const WebCore::AffineTransform& toWebContent, const WebCore::AffineTransform& toDeviceScreen)
+    : WebMouseEvent(WebEventFactory::createWebMouseEvent(event, toWebContent, toDeviceScreen))
     , m_nativeEvent(event)
 {
 }
 
-NativeWebMouseEvent::NativeWebMouseEvent(const Evas_Event_Mouse_Move* event, const Evas_Point* position)
-    : WebMouseEvent(WebEventFactory::createWebMouseEvent(event, position))
+NativeWebMouseEvent::NativeWebMouseEvent(const Evas_Event_Mouse_Move* event, const WebCore::AffineTransform& toWebContent, const WebCore::AffineTransform& toDeviceScreen)
+    : WebMouseEvent(WebEventFactory::createWebMouseEvent(event, toWebContent, toDeviceScreen))
     , m_nativeEvent(event)
 {
 }
diff --git a/Source/WebKit2/Shared/efl/NativeWebTouchEventEfl.cpp b/Source/WebKit2/Shared/efl/NativeWebTouchEventEfl.cpp
index 70d8bb7c7..004ca3515 100644
--- a/Source/WebKit2/Shared/efl/NativeWebTouchEventEfl.cpp
+++ b/Source/WebKit2/Shared/efl/NativeWebTouchEventEfl.cpp
@@ -32,8 +32,8 @@
 
 namespace WebKit {
 
-NativeWebTouchEvent::NativeWebTouchEvent(Ewk_Touch_Event_Type type, const Eina_List* points, const Evas_Modifier* modifiers, const Evas_Point* position, double timestamp)
-    : WebTouchEvent(WebEventFactory::createWebTouchEvent(type, points, modifiers, position, timestamp))
+NativeWebTouchEvent::NativeWebTouchEvent(Ewk_Touch_Event_Type type, const Eina_List* points, const Evas_Modifier* modifiers, const WebCore::AffineTransform& toWebContent, const WebCore::AffineTransform& toDeviceScreen, double timestamp)
+    : WebTouchEvent(WebEventFactory::createWebTouchEvent(type, points, modifiers, toWebContent, toDeviceScreen, timestamp))
 {
 }
 
diff --git a/Source/WebKit2/Shared/efl/NativeWebWheelEventEfl.cpp b/Source/WebKit2/Shared/efl/NativeWebWheelEventEfl.cpp
index 265d7d2b5..893ead8e4 100644
--- a/Source/WebKit2/Shared/efl/NativeWebWheelEventEfl.cpp
+++ b/Source/WebKit2/Shared/efl/NativeWebWheelEventEfl.cpp
@@ -30,8 +30,8 @@
 
 namespace WebKit {
 
-NativeWebWheelEvent::NativeWebWheelEvent(const Evas_Event_Mouse_Wheel* event, const Evas_Point* position)
-    : WebWheelEvent(WebEventFactory::createWebWheelEvent(event, position))
+NativeWebWheelEvent::NativeWebWheelEvent(const Evas_Event_Mouse_Wheel* event, const WebCore::AffineTransform& toWebContent, const WebCore::AffineTransform& toDeviceScreen)
+    : WebWheelEvent(WebEventFactory::createWebWheelEvent(event, toWebContent, toDeviceScreen))
     , m_nativeEvent(event)
 {
 }
diff --git a/Source/WebKit2/Shared/efl/WebEventFactory.cpp b/Source/WebKit2/Shared/efl/WebEventFactory.cpp
index 2b0d951cb..042958714 100644
--- a/Source/WebKit2/Shared/efl/WebEventFactory.cpp
+++ b/Source/WebKit2/Shared/efl/WebEventFactory.cpp
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2011 Samsung Electronics
+ * Copyright (C) 2012 Intel Corporation
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -27,6 +28,7 @@
 #include "WebEventFactory.h"
 
 #include "EflKeyboardUtilities.h"
+#include <WebCore/AffineTransform.h>
 #include <WebCore/Scrollbar.h>
 
 using namespace WebCore;
@@ -84,49 +86,57 @@ static inline int clickCountForEvent(const Evas_Button_Flags flags)
     return 1;
 }
 
-WebMouseEvent WebEventFactory::createWebMouseEvent(const Evas_Event_Mouse_Down* event, const Evas_Point* position)
+static inline double convertMillisecondToSecond(unsigned timestamp)
 {
+    return static_cast<double>(timestamp) / 1000;
+}
+
+WebMouseEvent WebEventFactory::createWebMouseEvent(const Evas_Event_Mouse_Down* event, const AffineTransform& toWebContent, const AffineTransform& toDeviceScreen)
+{
+    IntPoint pos(event->canvas.x, event->canvas.y);
     return WebMouseEvent(WebEvent::MouseDown,
-                         buttonForEvent(event->button),
-                         IntPoint(event->canvas.x - position->x, event->canvas.y - position->y),
-                         IntPoint(event->canvas.x, event->canvas.y),
-                         0 /* deltaX */,
-                         0 /* deltaY */,
-                         0 /* deltaZ */,
-                         clickCountForEvent(event->flags),
-                         modifiersForEvent(event->modifiers),
-                         event->timestamp);
+        buttonForEvent(event->button),
+        toWebContent.mapPoint(pos),
+        toDeviceScreen.mapPoint(pos),
+        0 /* deltaX */,
+        0 /* deltaY */,
+        0 /* deltaZ */,
+        clickCountForEvent(event->flags),
+        modifiersForEvent(event->modifiers),
+        convertMillisecondToSecond(event->timestamp));
 }
 
-WebMouseEvent WebEventFactory::createWebMouseEvent(const Evas_Event_Mouse_Up* event, const Evas_Point* position)
+WebMouseEvent WebEventFactory::createWebMouseEvent(const Evas_Event_Mouse_Up* event, const AffineTransform& toWebContent, const AffineTransform& toDeviceScreen)
 {
+    IntPoint pos(event->canvas.x, event->canvas.y);
     return WebMouseEvent(WebEvent::MouseUp,
-                         buttonForEvent(event->button),
-                         IntPoint(event->canvas.x - position->x, event->canvas.y - position->y),
-                         IntPoint(event->canvas.x, event->canvas.y),
-                         0 /* deltaX */,
-                         0 /* deltaY */,
-                         0 /* deltaZ */,
-                         clickCountForEvent(event->flags),
-                         modifiersForEvent(event->modifiers),
-                         event->timestamp);
+        buttonForEvent(event->button),
+        toWebContent.mapPoint(pos),
+        toDeviceScreen.mapPoint(pos),
+        0 /* deltaX */,
+        0 /* deltaY */,
+        0 /* deltaZ */,
+        clickCountForEvent(event->flags),
+        modifiersForEvent(event->modifiers),
+        convertMillisecondToSecond(event->timestamp));
 }
 
-WebMouseEvent WebEventFactory::createWebMouseEvent(const Evas_Event_Mouse_Move* event, const Evas_Point* position)
+WebMouseEvent WebEventFactory::createWebMouseEvent(const Evas_Event_Mouse_Move* event, const AffineTransform& toWebContent, const AffineTransform& toDeviceScreen)
 {
+    IntPoint pos(event->cur.canvas.x, event->cur.canvas.y);
     return WebMouseEvent(WebEvent::MouseMove,
-                         buttonForEvent(event->buttons),
-                         IntPoint(event->cur.canvas.x - position->x, event->cur.canvas.y - position->y),
-                         IntPoint(event->cur.canvas.x, event->cur.canvas.y),
-                         0 /* deltaX */,
-                         0 /* deltaY */,
-                         0 /* deltaZ */,
-                         0 /* clickCount */,
-                         modifiersForEvent(event->modifiers),
-                         event->timestamp);
+        buttonForEvent(event->buttons),
+        toWebContent.mapPoint(pos),
+        toDeviceScreen.mapPoint(pos),
+        0 /* deltaX */,
+        0 /* deltaY */,
+        0 /* deltaZ */,
+        0 /* clickCount */,
+        modifiersForEvent(event->modifiers),
+        convertMillisecondToSecond(event->timestamp));
 }
 
-WebWheelEvent WebEventFactory::createWebWheelEvent(const Evas_Event_Mouse_Wheel* event, const Evas_Point* position)
+WebWheelEvent WebEventFactory::createWebWheelEvent(const Evas_Event_Mouse_Wheel* event, const AffineTransform& toWebContent, const AffineTransform& toDeviceScreen)
 {
     float deltaX = 0;
     float deltaY = 0;
@@ -148,48 +158,50 @@ WebWheelEvent WebEventFactory::createWebWheelEvent(const Evas_Event_Mouse_Wheel*
     deltaX *= static_cast<float>(Scrollbar::pixelsPerLineStep());
     deltaY *= static_cast<float>(Scrollbar::pixelsPerLineStep());
 
+    IntPoint pos(event->canvas.x, event->canvas.y);
+
     return WebWheelEvent(WebEvent::Wheel,
-                         IntPoint(event->canvas.x - position->x, event->canvas.y - position->y),
-                         IntPoint(event->canvas.x, event->canvas.y),
-                         FloatSize(deltaX, deltaY),
-                         FloatSize(wheelTicksX, wheelTicksY),
-                         WebWheelEvent::ScrollByPixelWheelEvent,
-                         modifiersForEvent(event->modifiers),
-                         event->timestamp);
+        toWebContent.mapPoint(pos),
+        toDeviceScreen.mapPoint(pos),
+        FloatSize(deltaX, deltaY),
+        FloatSize(wheelTicksX, wheelTicksY),
+        WebWheelEvent::ScrollByPixelWheelEvent,
+        modifiersForEvent(event->modifiers),
+        convertMillisecondToSecond(event->timestamp));
 }
 
 WebKeyboardEvent WebEventFactory::createWebKeyboardEvent(const Evas_Event_Key_Down* event)
 {
     const String keyName(event->key);
     return WebKeyboardEvent(WebEvent::KeyDown,
-                            String::fromUTF8(event->string),
-                            String::fromUTF8(event->string),
-                            keyIdentifierForEvasKeyName(keyName),
-                            windowsKeyCodeForEvasKeyName(keyName),
-                            0 /* FIXME: nativeVirtualKeyCode */,
-                            0 /* macCharCode */,
-                            false /* FIXME: isAutoRepeat */,
-                            keyName.startsWith(keyPadPrefix),
-                            false /* isSystemKey */,
-                            modifiersForEvent(event->modifiers),
-                            event->timestamp);
+        String::fromUTF8(event->string),
+        String::fromUTF8(event->string),
+        keyIdentifierForEvasKeyName(keyName),
+        windowsKeyCodeForEvasKeyName(keyName),
+        0 /* FIXME: nativeVirtualKeyCode */,
+        0 /* macCharCode */,
+        false /* FIXME: isAutoRepeat */,
+        keyName.startsWith(keyPadPrefix),
+        false /* isSystemKey */,
+        modifiersForEvent(event->modifiers),
+        convertMillisecondToSecond(event->timestamp));
 }
 
 WebKeyboardEvent WebEventFactory::createWebKeyboardEvent(const Evas_Event_Key_Up* event)
 {
     const String keyName(event->key);
     return WebKeyboardEvent(WebEvent::KeyUp,
-                            String::fromUTF8(event->string),
-                            String::fromUTF8(event->string),
-                            keyIdentifierForEvasKeyName(keyName),
-                            windowsKeyCodeForEvasKeyName(keyName),
-                            0 /* FIXME: nativeVirtualKeyCode */,
-                            0 /* macCharCode */,
-                            false /* FIXME: isAutoRepeat */,
-                            keyName.startsWith(keyPadPrefix),
-                            false /* isSystemKey */,
-                            modifiersForEvent(event->modifiers),
-                            event->timestamp);
+        String::fromUTF8(event->string),
+        String::fromUTF8(event->string),
+        keyIdentifierForEvasKeyName(keyName),
+        windowsKeyCodeForEvasKeyName(keyName),
+        0 /* FIXME: nativeVirtualKeyCode */,
+        0 /* macCharCode */,
+        false /* FIXME: isAutoRepeat */,
+        keyName.startsWith(keyPadPrefix),
+        false /* isSystemKey */,
+        modifiersForEvent(event->modifiers),
+        convertMillisecondToSecond(event->timestamp));
 }
 
 #if ENABLE(TOUCH_EVENTS)
@@ -207,7 +219,7 @@ static inline WebEvent::Type typeForTouchEvent(Ewk_Touch_Event_Type type)
     return WebEvent::NoType;
 }
 
-WebTouchEvent WebEventFactory::createWebTouchEvent(Ewk_Touch_Event_Type type, const Eina_List* points, const Evas_Modifier* modifiers, const Evas_Point* position, double timestamp)
+WebTouchEvent WebEventFactory::createWebTouchEvent(Ewk_Touch_Event_Type type, const Eina_List* points, const Evas_Modifier* modifiers, const AffineTransform& toWebContent, const AffineTransform& toDeviceScreen, double timestamp)
 {
     Vector<WebPlatformTouchPoint> touchPoints;
     WebPlatformTouchPoint::TouchPointState state;
@@ -237,7 +249,8 @@ WebTouchEvent WebEventFactory::createWebTouchEvent(Ewk_Touch_Event_Type type, co
             continue;
         }
 
-        touchPoints.append(WebPlatformTouchPoint(point->id, state, IntPoint(point->x, point->y), IntPoint(point->x - position->x, point->y - position->y)));
+        IntPoint pos(point->x, point->y);
+        touchPoints.append(WebPlatformTouchPoint(point->id, state, toWebContent.mapPoint(pos), toDeviceScreen.mapPoint(pos)));
     }
 
     return WebTouchEvent(typeForTouchEvent(type), touchPoints, modifiersForEvent(modifiers), timestamp);
diff --git a/Source/WebKit2/Shared/efl/WebEventFactory.h b/Source/WebKit2/Shared/efl/WebEventFactory.h
index 9a8b1d6bd..e444db29d 100644
--- a/Source/WebKit2/Shared/efl/WebEventFactory.h
+++ b/Source/WebKit2/Shared/efl/WebEventFactory.h
@@ -29,19 +29,20 @@
 #include "WebEvent.h"
 #include "ewk_touch.h"
 #include <Evas.h>
+#include <WebCore/AffineTransform.h>
 
 namespace WebKit {
 
 class WebEventFactory {
 public:
-    static WebMouseEvent createWebMouseEvent(const Evas_Event_Mouse_Down*, const Evas_Point*);
-    static WebMouseEvent createWebMouseEvent(const Evas_Event_Mouse_Up*, const Evas_Point*);
-    static WebMouseEvent createWebMouseEvent(const Evas_Event_Mouse_Move*, const Evas_Point*);
-    static WebWheelEvent createWebWheelEvent(const Evas_Event_Mouse_Wheel*, const Evas_Point*);
+    static WebMouseEvent createWebMouseEvent(const Evas_Event_Mouse_Down*, const WebCore::AffineTransform&, const WebCore::AffineTransform&);
+    static WebMouseEvent createWebMouseEvent(const Evas_Event_Mouse_Up*, const WebCore::AffineTransform&, const WebCore::AffineTransform&);
+    static WebMouseEvent createWebMouseEvent(const Evas_Event_Mouse_Move*, const WebCore::AffineTransform&, const WebCore::AffineTransform&);
+    static WebWheelEvent createWebWheelEvent(const Evas_Event_Mouse_Wheel*, const WebCore::AffineTransform&, const WebCore::AffineTransform&);
     static WebKeyboardEvent createWebKeyboardEvent(const Evas_Event_Key_Down*);
     static WebKeyboardEvent createWebKeyboardEvent(const Evas_Event_Key_Up*);
 #if ENABLE(TOUCH_EVENTS)
-    static WebTouchEvent createWebTouchEvent(Ewk_Touch_Event_Type, const Eina_List*, const Evas_Modifier*, const Evas_Point*, double timestamp);
+    static WebTouchEvent createWebTouchEvent(Ewk_Touch_Event_Type, const Eina_List*, const Evas_Modifier*, const WebCore::AffineTransform&, const WebCore::AffineTransform&, double timestamp);
 #endif
 };
 
diff --git a/Source/WebKit2/Shared/gtk/ArgumentCodersGtk.cpp b/Source/WebKit2/Shared/gtk/ArgumentCodersGtk.cpp
index 7bcd33f9c..9cd20700c 100644
--- a/Source/WebKit2/Shared/gtk/ArgumentCodersGtk.cpp
+++ b/Source/WebKit2/Shared/gtk/ArgumentCodersGtk.cpp
@@ -41,7 +41,7 @@ using namespace WebKit;
 
 namespace CoreIPC {
 
-static void encodeImage(ArgumentEncoder* encoder, const GdkPixbuf* pixbuf)
+static void encodeImage(ArgumentEncoder& encoder, const GdkPixbuf* pixbuf)
 {
     IntSize imageSize(gdk_pixbuf_get_width(pixbuf), gdk_pixbuf_get_height(pixbuf));
     RefPtr<ShareableBitmap> bitmap = ShareableBitmap::createShareable(imageSize, ShareableBitmap::SupportsAlpha);
@@ -54,7 +54,7 @@ static void encodeImage(ArgumentEncoder* encoder, const GdkPixbuf* pixbuf)
     ShareableBitmap::Handle handle;
     bitmap->createHandle(handle);
 
-    encoder->encode(handle);
+    encoder << handle;
 }
 
 static bool decodeImage(ArgumentDecoder* decoder, GRefPtr<GdkPixbuf>& pixbuf)
@@ -85,30 +85,30 @@ static bool decodeImage(ArgumentDecoder* decoder, GRefPtr<GdkPixbuf>& pixbuf)
     return true;
 }
 
-static void encodeDataObject(ArgumentEncoder* encoder, const DataObjectGtk* dataObject)
+static void encodeDataObject(ArgumentEncoder& encoder, const DataObjectGtk* dataObject)
 {
     bool hasText = dataObject->hasText();
-    encoder->encode(hasText);
+    encoder << hasText;
     if (hasText)
-        encoder->encode(dataObject->text());
+        encoder << dataObject->text();
 
     bool hasMarkup = dataObject->hasMarkup();
-    encoder->encode(hasMarkup);
+    encoder << hasMarkup;
     if (hasMarkup)
-        encoder->encode(dataObject->markup());
+        encoder << dataObject->markup();
 
     bool hasURL = dataObject->hasURL();
-    encoder->encode(hasURL);
+    encoder << hasURL;
     if (hasURL)
-        encoder->encode(dataObject->url().string());
+        encoder << dataObject->url().string();
 
     bool hasURIList = dataObject->hasURIList();
-    encoder->encode(hasURIList);
+    encoder << hasURIList;
     if (hasURIList)
-        encoder->encode(dataObject->uriList());
+        encoder << dataObject->uriList();
 
     bool hasImage = dataObject->hasImage();
-    encoder->encode(hasImage);
+    encoder << hasImage;
     if (hasImage)
         encodeImage(encoder, dataObject->image());
 }
@@ -172,15 +172,15 @@ static bool decodeDataObject(ArgumentDecoder* decoder, RefPtr<DataObjectGtk>& da
     return true;
 }
 
-void ArgumentCoder<DragData>::encode(ArgumentEncoder* encoder, const DragData& dragData)
+void ArgumentCoder<DragData>::encode(ArgumentEncoder& encoder, const DragData& dragData)
 {
-    encoder->encode(dragData.clientPosition());
-    encoder->encode(dragData.globalPosition());
-    encoder->encode(static_cast<uint64_t>(dragData.draggingSourceOperationMask()));
-    encoder->encode(static_cast<uint64_t>(dragData.flags()));
+    encoder << dragData.clientPosition();
+    encoder << dragData.globalPosition();
+    encoder << static_cast<uint64_t>(dragData.draggingSourceOperationMask());
+    encoder << static_cast<uint64_t>(dragData.flags());
 
     DataObjectGtk* platformData = dragData.platformData();
-    encoder->encode(static_cast<bool>(platformData));
+    encoder << static_cast<bool>(platformData);
     if (platformData)
         encodeDataObject(encoder, platformData);
 }
@@ -219,12 +219,11 @@ bool ArgumentCoder<DragData>::decode(ArgumentDecoder* decoder, DragData& dragDat
     return true;
 }
 
-static void encodeGKeyFile(ArgumentEncoder* encoder, GKeyFile* keyFile)
+static void encodeGKeyFile(ArgumentEncoder& encoder, GKeyFile* keyFile)
 {
     gsize dataSize;
     GOwnPtr<char> data(g_key_file_to_data(keyFile, &dataSize, 0));
-    DataReference dataReference(reinterpret_cast<uint8_t*>(data.get()), dataSize);
-    encoder->encode(dataReference);
+    encoder << DataReference(reinterpret_cast<uint8_t*>(data.get()), dataSize);
 }
 
 static bool decodeGKeyFile(ArgumentDecoder* decoder, GOwnPtr<GKeyFile>& keyFile)
@@ -245,7 +244,7 @@ static bool decodeGKeyFile(ArgumentDecoder* decoder, GOwnPtr<GKeyFile>& keyFile)
     return true;
 }
 
-void encode(ArgumentEncoder* encoder, GtkPrintSettings* printSettings)
+void encode(ArgumentEncoder& encoder, GtkPrintSettings* printSettings)
 {
     GOwnPtr<GKeyFile> keyFile(g_key_file_new());
     gtk_print_settings_to_key_file(printSettings, keyFile.get(), "Print Settings");
@@ -268,7 +267,7 @@ bool decode(ArgumentDecoder* decoder, GRefPtr<GtkPrintSettings>& printSettings)
     return printSettings;
 }
 
-void encode(ArgumentEncoder* encoder, GtkPageSetup* pageSetup)
+void encode(ArgumentEncoder& encoder, GtkPageSetup* pageSetup)
 {
     GOwnPtr<GKeyFile> keyFile(g_key_file_new());
     gtk_page_setup_to_key_file(pageSetup, keyFile.get(), "Page Setup");
diff --git a/Source/WebKit2/Shared/gtk/ArgumentCodersGtk.h b/Source/WebKit2/Shared/gtk/ArgumentCodersGtk.h
index 888424562..6ddff0076 100644
--- a/Source/WebKit2/Shared/gtk/ArgumentCodersGtk.h
+++ b/Source/WebKit2/Shared/gtk/ArgumentCodersGtk.h
@@ -40,14 +40,14 @@ class DragData;
 namespace CoreIPC {
 
 template<> struct ArgumentCoder<WebCore::DragData> {
-    static void encode(ArgumentEncoder*, const WebCore::DragData&);
+    static void encode(ArgumentEncoder&, const WebCore::DragData&);
     static bool decode(ArgumentDecoder*, WebCore::DragData&);
 };
 
-void encode(ArgumentEncoder*, GtkPrintSettings*);
+void encode(ArgumentEncoder&, GtkPrintSettings*);
 bool decode(ArgumentDecoder*, GRefPtr<GtkPrintSettings>&);
 
-void encode(ArgumentEncoder*, GtkPageSetup*);
+void encode(ArgumentEncoder&, GtkPageSetup*);
 bool decode(ArgumentDecoder*, GRefPtr<GtkPageSetup>&);
 
 } // namespace CoreIPC
diff --git a/Source/WebKit2/Shared/gtk/LayerTreeContextGtk.cpp b/Source/WebKit2/Shared/gtk/LayerTreeContextGtk.cpp
index e7d918a70..38a0d54a6 100644
--- a/Source/WebKit2/Shared/gtk/LayerTreeContextGtk.cpp
+++ b/Source/WebKit2/Shared/gtk/LayerTreeContextGtk.cpp
@@ -40,9 +40,9 @@ LayerTreeContext::~LayerTreeContext()
 {
 }
 
-void LayerTreeContext::encode(CoreIPC::ArgumentEncoder* encoder) const
+void LayerTreeContext::encode(CoreIPC::ArgumentEncoder& encoder) const
 {
-    encoder->encode(windowHandle);
+    encoder.encode(windowHandle);
 }
 
 bool LayerTreeContext::decode(CoreIPC::ArgumentDecoder* decoder, LayerTreeContext& context)
diff --git a/Source/WebKit2/Shared/mac/ArgumentCodersMac.h b/Source/WebKit2/Shared/mac/ArgumentCodersMac.h
index 14f1dee98..07c4060a4 100644
--- a/Source/WebKit2/Shared/mac/ArgumentCodersMac.h
+++ b/Source/WebKit2/Shared/mac/ArgumentCodersMac.h
@@ -33,34 +33,50 @@ namespace CoreIPC {
 class ArgumentEncoder;
 class ArgumentDecoder;
 
+// id
+void encode(ArgumentEncoder&, id);
+bool decode(ArgumentDecoder*, RetainPtr<id>&);
+
 // NSAttributedString
-void encode(ArgumentEncoder*, NSAttributedString *);
+void encode(ArgumentEncoder&, NSAttributedString *);
 bool decode(ArgumentDecoder*, RetainPtr<NSAttributedString>&);
 
 #if USE(APPKIT)
 // NSColor
-void encode(ArgumentEncoder*, NSColor *);
+void encode(ArgumentEncoder&, NSColor *);
 bool decode(ArgumentDecoder*, RetainPtr<NSColor>&);
 #endif
 
 // NSDictionary
-void encode(ArgumentEncoder*, NSDictionary *);
+void encode(ArgumentEncoder&, NSDictionary *);
 bool decode(ArgumentDecoder*, RetainPtr<NSDictionary>&);
 
+// NSArray
+void encode(ArgumentEncoder&, NSArray *);
+bool decode(ArgumentDecoder*, RetainPtr<NSArray>&);
+
 #if USE(APPKIT)
 // NSFont
-void encode(ArgumentEncoder*, NSFont *);
+void encode(ArgumentEncoder&, NSFont *);
 bool decode(ArgumentDecoder*, RetainPtr<NSFont>&);
 #endif
 
 // NSNumber
-void encode(ArgumentEncoder*, NSNumber *);
+void encode(ArgumentEncoder&, NSNumber *);
 bool decode(ArgumentDecoder*, RetainPtr<NSNumber>&);
 
 // NSString
-void encode(ArgumentEncoder*, NSString *);
+void encode(ArgumentEncoder&, NSString *);
 bool decode(ArgumentDecoder*, RetainPtr<NSString>&);
 
+// NSDate
+void encode(ArgumentEncoder&, NSDate *);
+bool decode(ArgumentDecoder*, RetainPtr<NSDate>&);
+
+// NSData
+void encode(ArgumentEncoder&, NSData *);
+bool decode(ArgumentDecoder*, RetainPtr<NSData>&);
+
 } // namespace CoreIPC
 
 #endif // ArgumentCodersMac_h
diff --git a/Source/WebKit2/Shared/mac/ArgumentCodersMac.mm b/Source/WebKit2/Shared/mac/ArgumentCodersMac.mm
index ec6d38be4..c0817d556 100644
--- a/Source/WebKit2/Shared/mac/ArgumentCodersMac.mm
+++ b/Source/WebKit2/Shared/mac/ArgumentCodersMac.mm
@@ -43,11 +43,14 @@ enum NSType {
     NSColorType,
 #endif
     NSDictionaryType,
+    NSArrayType,
 #if USE(APPKIT)
     NSFontType,
 #endif
     NSNumberType,
     NSStringType,
+    NSDateType,
+    NSDataType,
     Unknown,
 };
 
@@ -71,15 +74,21 @@ static NSType typeFromObject(id object)
         return NSNumberType;
     if ([object isKindOfClass:[NSString class]])
         return NSStringType;
+    if ([object isKindOfClass:[NSArray class]])
+        return NSArrayType;
+    if ([object isKindOfClass:[NSDate class]])
+        return NSDateType;
+    if ([object isKindOfClass:[NSData class]])
+        return NSDataType;
 
     ASSERT_NOT_REACHED();
     return Unknown;
 }
 
-static void encode(ArgumentEncoder* encoder, id object)
+void encode(ArgumentEncoder& encoder, id object)
 {
     NSType type = typeFromObject(object);
-    encoder->encodeEnum(type);
+    encoder.encodeEnum(type);
 
     switch (type) {
     case NSAttributedStringType:
@@ -104,6 +113,15 @@ static void encode(ArgumentEncoder* encoder, id object)
     case NSStringType:
         encode(encoder, static_cast<NSString *>(object));
         return;
+    case NSArrayType:
+        encode(encoder, static_cast<NSArray *>(object));
+        return;
+    case NSDateType:
+        encode(encoder, static_cast<NSDate *>(object));
+        return;
+    case NSDataType:
+        encode(encoder, static_cast<NSData *>(object));
+        return;
     case Unknown:
         break;
     }
@@ -111,7 +129,7 @@ static void encode(ArgumentEncoder* encoder, id object)
     ASSERT_NOT_REACHED();
 }
 
-static bool decode(ArgumentDecoder* decoder, RetainPtr<id>& result)
+bool decode(ArgumentDecoder* decoder, RetainPtr<id>& result)
 {
     NSType type;
     if (!decoder->decodeEnum(type))
@@ -164,6 +182,27 @@ static bool decode(ArgumentDecoder* decoder, RetainPtr<id>& result)
         result = string;
         return true;
     }
+    case NSArrayType: {
+        RetainPtr<NSArray> array;
+        if (!decode(decoder, array))
+            return false;
+        result = array;
+        return true;
+    }
+    case NSDateType: {
+        RetainPtr<NSDate> date;
+        if (!decode(decoder, date))
+            return false;
+        result = date;
+        return true;
+    }
+    case NSDataType: {
+        RetainPtr<NSData> data;
+        if (!decode(decoder, data))
+            return false;
+        result = data;
+        return true;
+    }
     case Unknown:
         ASSERT_NOT_REACHED();
         return false;
@@ -172,7 +211,7 @@ static bool decode(ArgumentDecoder* decoder, RetainPtr<id>& result)
     return false;
 }
 
-void encode(ArgumentEncoder* encoder, NSAttributedString *string)
+void encode(ArgumentEncoder& encoder, NSAttributedString *string)
 {
     // Even though NSAttributedString is toll free bridged with CFAttributedStringRef, attributes' values may be not, so we should stay within this file's code.
 
@@ -196,11 +235,11 @@ void encode(ArgumentEncoder* encoder, NSAttributedString *string)
         position = NSMaxRange(effectiveRange);
     }
 
-    encoder->encode(static_cast<uint64_t>(ranges.size()));
+    encoder << static_cast<uint64_t>(ranges.size());
 
     for (size_t i = 0; i < ranges.size(); ++i) {
-        encoder->encode(static_cast<uint64_t>(ranges[i].first.location));
-        encoder->encode(static_cast<uint64_t>(ranges[i].first.length));
+        encoder << static_cast<uint64_t>(ranges[i].first.location);
+        encoder << static_cast<uint64_t>(ranges[i].first.length);
         CoreIPC::encode(encoder, ranges[i].second.get());
     }
 }
@@ -243,9 +282,9 @@ bool decode(ArgumentDecoder* decoder, RetainPtr<NSAttributedString>& result)
 }
 
 #if USE(APPKIT)
-void encode(ArgumentEncoder* encoder, NSColor *color)
+void encode(ArgumentEncoder& encoder, NSColor *color)
 {
-    encoder->encode(colorFromNSColor(color));
+    encoder << colorFromNSColor(color);
 }
 
 bool decode(ArgumentDecoder* decoder, RetainPtr<NSColor>& result)
@@ -259,7 +298,7 @@ bool decode(ArgumentDecoder* decoder, RetainPtr<NSColor>& result)
 }
 #endif
 
-void encode(ArgumentEncoder* encoder, NSDictionary *dictionary)
+void encode(ArgumentEncoder& encoder, NSDictionary *dictionary)
 {
     // Even though NSDictionary is toll free bridged with CFDictionaryRef, values may be not, so we should stay within this file's code.
 
@@ -267,7 +306,7 @@ void encode(ArgumentEncoder* encoder, NSDictionary *dictionary)
     NSArray *keys = [dictionary allKeys];
     NSArray *values = [dictionary allValues];
 
-    encoder->encode(static_cast<uint64_t>(size));
+    encoder << static_cast<uint64_t>(size);
 
     for (NSUInteger i = 0; i < size; ++i) {
         id key = [keys objectAtIndex:i];
@@ -310,7 +349,7 @@ bool decode(ArgumentDecoder* decoder, RetainPtr<NSDictionary>& result)
 }
 
 #if USE(APPKIT)
-void encode(ArgumentEncoder* encoder, NSFont *font)
+void encode(ArgumentEncoder& encoder, NSFont *font)
 {
     // NSFont could use CTFontRef code if we had it in ArgumentCodersCF.
     encode(encoder, [[font fontDescriptor] fontAttributes]);
@@ -329,7 +368,7 @@ bool decode(ArgumentDecoder* decoder, RetainPtr<NSFont>& result)
 }
 #endif
 
-void encode(ArgumentEncoder* encoder, NSNumber *number)
+void encode(ArgumentEncoder& encoder, NSNumber *number)
 {
     encode(encoder, (CFNumberRef)number);
 }
@@ -344,7 +383,7 @@ bool decode(ArgumentDecoder* decoder, RetainPtr<NSNumber>& result)
     return true;
 }
 
-void encode(ArgumentEncoder* encoder, NSString *string)
+void encode(ArgumentEncoder& encoder, NSString *string)
 {
     encode(encoder, (CFStringRef)string);
 }
@@ -359,4 +398,69 @@ bool decode(ArgumentDecoder* decoder, RetainPtr<NSString>& result)
     return true;
 }
 
+void encode(ArgumentEncoder& encoder, NSArray *array)
+{
+    NSUInteger size = [array count];
+    encoder << static_cast<uint64_t>(size);
+
+    for (NSUInteger i = 0; i < size; ++i) {
+        id value = [array objectAtIndex:i];
+
+        // Ignore values we don't recognize.
+        if (typeFromObject(value) == Unknown)
+            continue;
+
+        encode(encoder, value);
+    }
+}
+
+bool decode(ArgumentDecoder* decoder, RetainPtr<NSArray>& result)
+{
+    uint64_t size;
+    if (!decoder->decodeUInt64(size))
+        return false;
+
+    RetainPtr<NSMutableArray> array = adoptNS([[NSMutableArray alloc] initWithCapacity:size]);
+    for (uint64_t i = 0; i < size; ++i) {
+        RetainPtr<id> value;
+        if (!decode(decoder, value))
+            return false;
+
+        [array.get() addObject:value.get()];
+    }
+
+    result.adoptNS(array.leakRef());
+    return true;
+}
+
+void encode(ArgumentEncoder& encoder, NSDate *date)
+{
+    encode(encoder, (CFDateRef)date);
+}
+
+bool decode(ArgumentDecoder* decoder, RetainPtr<NSDate>& result)
+{
+    RetainPtr<CFDateRef> date;
+    if (!decode(decoder, date))
+        return false;
+
+    result.adoptCF((NSDate *)date.leakRef());
+    return true;
+}
+
+void encode(ArgumentEncoder& encoder, NSData *data)
+{
+    encode(encoder, (CFDataRef)data);
+}
+
+bool decode(ArgumentDecoder* decoder, RetainPtr<NSData>& result)
+{
+    RetainPtr<CFDataRef> data;
+    if (!decode(decoder, data))
+        return false;
+
+    result.adoptCF((NSData *)data.leakRef());
+    return true;
+}
+
 } // namespace CoreIPC
diff --git a/Source/WebKit2/Shared/mac/AttributedString.h b/Source/WebKit2/Shared/mac/AttributedString.h
index 6c8a8ae25..6d3507f6a 100644
--- a/Source/WebKit2/Shared/mac/AttributedString.h
+++ b/Source/WebKit2/Shared/mac/AttributedString.h
@@ -38,7 +38,7 @@ namespace CoreIPC {
 namespace WebKit {
 
 struct AttributedString {
-    void encode(CoreIPC::ArgumentEncoder*) const;
+    void encode(CoreIPC::ArgumentEncoder&) const;
     static bool decode(CoreIPC::ArgumentDecoder*, AttributedString&);
     
     RetainPtr<NSAttributedString> string;
diff --git a/Source/WebKit2/Shared/mac/AttributedString.mm b/Source/WebKit2/Shared/mac/AttributedString.mm
index bc7cfd086..34c17ad8c 100644
--- a/Source/WebKit2/Shared/mac/AttributedString.mm
+++ b/Source/WebKit2/Shared/mac/AttributedString.mm
@@ -32,9 +32,9 @@
 
 namespace WebKit {
 
-void AttributedString::encode(CoreIPC::ArgumentEncoder* encoder) const
+void AttributedString::encode(CoreIPC::ArgumentEncoder& encoder) const
 {
-    encoder->encode(!string);
+    encoder << static_cast<bool>(!string);
     if (!string)
         return;
     CoreIPC::encode(encoder, string.get());
diff --git a/Source/WebKit2/Shared/mac/ChildProcessMac.mm b/Source/WebKit2/Shared/mac/ChildProcessMac.mm
new file mode 100644
index 000000000..0801f5d89
--- /dev/null
+++ b/Source/WebKit2/Shared/mac/ChildProcessMac.mm
@@ -0,0 +1,65 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#import "config.h"
+#import "ChildProcess.h"
+
+namespace WebKit {
+
+NSString * const ChildProcess::processSuppressionVisibleApplicationReason = @"Application is Visible";
+
+void ChildProcess::setApplicationIsOccluded(bool applicationIsOccluded)
+{
+    if (m_applicationIsOccluded == applicationIsOccluded)
+        return;
+
+#if __MAC_OS_X_VERSION_MIN_REQUIRED >= 1090
+    m_applicationIsOccluded = applicationIsOccluded;
+    if (m_applicationIsOccluded)
+        enableProcessSuppression(processSuppressionVisibleApplicationReason);
+    else
+        disableProcessSuppression(processSuppressionVisibleApplicationReason);
+#endif
+}
+
+void ChildProcess::disableProcessSuppression(NSString *reason)
+{
+#if __MAC_OS_X_VERSION_MIN_REQUIRED >= 1090
+    // The following assumes that a process enabling AutomaticTerminationSupport also
+    // takes a AutomaticTermination assertion for the lifetime of the process.
+    [[NSProcessInfo processInfo] disableAutomaticTermination:reason];
+#endif
+}
+
+void ChildProcess::enableProcessSuppression(NSString *reason)
+{
+#if __MAC_OS_X_VERSION_MIN_REQUIRED >= 1090
+    // The following assumes that a process enabling AutomaticTerminationSupport also
+    // takes a AutomaticTermination assertion for the lifetime of the process.
+    [[NSProcessInfo processInfo] enableAutomaticTermination:reason];
+#endif
+}
+
+}
diff --git a/Source/WebKit2/Shared/mac/ColorSpaceData.h b/Source/WebKit2/Shared/mac/ColorSpaceData.h
index cdea86ee5..afe5b7736 100644
--- a/Source/WebKit2/Shared/mac/ColorSpaceData.h
+++ b/Source/WebKit2/Shared/mac/ColorSpaceData.h
@@ -36,7 +36,7 @@ namespace CoreIPC {
 namespace WebKit {
 
 struct ColorSpaceData {
-    void encode(CoreIPC::ArgumentEncoder*) const;
+    void encode(CoreIPC::ArgumentEncoder&) const;
     static bool decode(CoreIPC::ArgumentDecoder*, ColorSpaceData&);
 
     RetainPtr<CGColorSpaceRef> cgColorSpace;
diff --git a/Source/WebKit2/Shared/mac/ColorSpaceData.mm b/Source/WebKit2/Shared/mac/ColorSpaceData.mm
index 796c06d0a..0cecb473b 100644
--- a/Source/WebKit2/Shared/mac/ColorSpaceData.mm
+++ b/Source/WebKit2/Shared/mac/ColorSpaceData.mm
@@ -38,26 +38,26 @@ enum EncodedDataType {
     Data,
 };
 
-void ColorSpaceData::encode(CoreIPC::ArgumentEncoder* encoder) const
+void ColorSpaceData::encode(CoreIPC::ArgumentEncoder& encoder) const
 {
     if (cgColorSpace) {
         // Try to encode the name.
         if (RetainPtr<CFStringRef> name = adoptCF(CGColorSpaceCopyName(cgColorSpace.get()))) {
-            encoder->encodeEnum(Name);
+            encoder.encodeEnum(Name);
             CoreIPC::encode(encoder, name.get());
             return;
         }
 
         // Failing that, just encode the ICC data.
         if (RetainPtr<CFDataRef> profileData = adoptCF(CGColorSpaceCopyICCProfile(cgColorSpace.get()))) {
-            encoder->encodeEnum(Data);
+            encoder.encodeEnum(Data);
             CoreIPC::encode(encoder, profileData.get());
             return;
         }
     }
 
     // The color space was null or failed to be encoded.
-    encoder->encodeEnum(Null);
+    encoder.encodeEnum(Null);
 }
 
 bool ColorSpaceData::decode(CoreIPC::ArgumentDecoder* decoder, ColorSpaceData& colorSpaceData)
diff --git a/Source/WebKit2/Shared/mac/KeychainAttribute.cpp b/Source/WebKit2/Shared/mac/KeychainAttribute.cpp
index eb284bcf7..672f15e5d 100644
--- a/Source/WebKit2/Shared/mac/KeychainAttribute.cpp
+++ b/Source/WebKit2/Shared/mac/KeychainAttribute.cpp
@@ -51,10 +51,10 @@ KeychainAttribute::KeychainAttribute(const SecKeychainAttribute& secKeychainAttr
 
 namespace CoreIPC {
 
-void encode(CoreIPC::ArgumentEncoder* encoder, const WebKit::KeychainAttribute& attribute)
+void encode(CoreIPC::ArgumentEncoder& encoder, const WebKit::KeychainAttribute& attribute)
 {
-    encoder->encode(static_cast<uint32_t>(attribute.tag));
-    encoder->encode(static_cast<bool>(attribute.data));
+    encoder << static_cast<uint32_t>(attribute.tag);
+    encoder << static_cast<bool>(attribute.data);
     if (attribute.data)
         CoreIPC::encode(encoder, attribute.data.get());
 }
diff --git a/Source/WebKit2/Shared/mac/KeychainAttribute.h b/Source/WebKit2/Shared/mac/KeychainAttribute.h
index d5f1f42a9..e79103cb9 100644
--- a/Source/WebKit2/Shared/mac/KeychainAttribute.h
+++ b/Source/WebKit2/Shared/mac/KeychainAttribute.h
@@ -47,7 +47,7 @@ namespace CoreIPC {
 class ArgumentDecoder;
 class ArgumentEncoder;
 
-void encode(ArgumentEncoder*, const WebKit::KeychainAttribute&);
+void encode(ArgumentEncoder&, const WebKit::KeychainAttribute&);
 bool decode(ArgumentDecoder*, WebKit::KeychainAttribute&);
 
 } // namespace CoreIPC
diff --git a/Source/WebKit2/Shared/mac/LayerTreeContextMac.mm b/Source/WebKit2/Shared/mac/LayerTreeContextMac.mm
index e4ad1ce0b..531d245dc 100644
--- a/Source/WebKit2/Shared/mac/LayerTreeContextMac.mm
+++ b/Source/WebKit2/Shared/mac/LayerTreeContextMac.mm
@@ -40,9 +40,9 @@ LayerTreeContext::~LayerTreeContext()
 {
 }
 
-void LayerTreeContext::encode(CoreIPC::ArgumentEncoder* encoder) const
+void LayerTreeContext::encode(CoreIPC::ArgumentEncoder& encoder) const
 {
-    encoder->encode(contextID);
+    encoder << contextID;
 }
 
 bool LayerTreeContext::decode(CoreIPC::ArgumentDecoder* decoder, LayerTreeContext& result)
diff --git a/Source/WebKit2/Shared/mac/PDFKitImports.h b/Source/WebKit2/Shared/mac/PDFKitImports.h
index c9a1e0a25..a1a13d3d8 100644
--- a/Source/WebKit2/Shared/mac/PDFKitImports.h
+++ b/Source/WebKit2/Shared/mac/PDFKitImports.h
@@ -35,6 +35,8 @@ Class pdfDocumentClass();
 
 #if ENABLE(PDFKIT_PLUGIN)
 Class pdfLayerControllerClass();
+Class pdfAnnotationTextWidgetClass();
+Class pdfAnnotationChoiceWidgetClass();
 #endif
 
 }
diff --git a/Source/WebKit2/Shared/mac/PDFKitImports.mm b/Source/WebKit2/Shared/mac/PDFKitImports.mm
index bccfbefda..16697b448 100644
--- a/Source/WebKit2/Shared/mac/PDFKitImports.mm
+++ b/Source/WebKit2/Shared/mac/PDFKitImports.mm
@@ -62,6 +62,20 @@ Class pdfLayerControllerClass()
     ASSERT(pdfLayerControllerClass);
     return pdfLayerControllerClass;
 }
+
+Class pdfAnnotationTextWidgetClass()
+{
+    static Class pdfAnnotationTextWidgetClass = classFromPDFKit(@"PDFAnnotationTextWidget");
+    ASSERT(pdfAnnotationTextWidgetClass);
+    return pdfAnnotationTextWidgetClass;
+}
+
+Class pdfAnnotationChoiceWidgetClass()
+{
+    static Class pdfAnnotationChoiceWidgetClass = classFromPDFKit(@"PDFAnnotationChoiceWidget");
+    ASSERT(pdfAnnotationChoiceWidgetClass);
+    return pdfAnnotationChoiceWidgetClass;
+}
 #endif
 
 }
diff --git a/Source/WebKit2/Shared/mac/PlatformCertificateInfo.h b/Source/WebKit2/Shared/mac/PlatformCertificateInfo.h
index 7ef5b3770..93f09f369 100644
--- a/Source/WebKit2/Shared/mac/PlatformCertificateInfo.h
+++ b/Source/WebKit2/Shared/mac/PlatformCertificateInfo.h
@@ -44,7 +44,7 @@ public:
 
     CFArrayRef certificateChain() const { return m_certificateChain.get(); }
 
-    void encode(CoreIPC::ArgumentEncoder* encoder) const;
+    void encode(CoreIPC::ArgumentEncoder&) const;
     static bool decode(CoreIPC::ArgumentDecoder* decoder, PlatformCertificateInfo& t);
 
 #ifndef NDEBUG
diff --git a/Source/WebKit2/Shared/mac/PlatformCertificateInfo.mm b/Source/WebKit2/Shared/mac/PlatformCertificateInfo.mm
index db2b90e75..ecffbe63e 100644
--- a/Source/WebKit2/Shared/mac/PlatformCertificateInfo.mm
+++ b/Source/WebKit2/Shared/mac/PlatformCertificateInfo.mm
@@ -49,14 +49,14 @@ PlatformCertificateInfo::PlatformCertificateInfo(CFArrayRef certificateChain)
 {
 }
 
-void PlatformCertificateInfo::encode(CoreIPC::ArgumentEncoder* encoder) const
+void PlatformCertificateInfo::encode(CoreIPC::ArgumentEncoder& encoder) const
 {
     if (!m_certificateChain) {
-        encoder->encode(false);
+        encoder << false;
         return;
     }
 
-    encoder->encode(true);
+    encoder << true;
     CoreIPC::encode(encoder, m_certificateChain.get());
 }
 
diff --git a/Source/WebKit2/Shared/mac/SandboxExtensionMac.mm b/Source/WebKit2/Shared/mac/SandboxExtensionMac.mm
index 109d1eb88..d00058d8c 100644
--- a/Source/WebKit2/Shared/mac/SandboxExtensionMac.mm
+++ b/Source/WebKit2/Shared/mac/SandboxExtensionMac.mm
@@ -53,10 +53,10 @@ SandboxExtension::Handle::~Handle()
     }
 }
 
-void SandboxExtension::Handle::encode(CoreIPC::ArgumentEncoder* encoder) const
+void SandboxExtension::Handle::encode(CoreIPC::ArgumentEncoder& encoder) const
 {
     if (!m_sandboxExtension) {
-        encoder->encodeVariableLengthByteArray(CoreIPC::DataReference());
+        encoder << CoreIPC::DataReference();
         return;
     }
 
@@ -64,7 +64,7 @@ void SandboxExtension::Handle::encode(CoreIPC::ArgumentEncoder* encoder) const
     const char *serializedFormat = WKSandboxExtensionGetSerializedFormat(m_sandboxExtension, &length);
     ASSERT(serializedFormat);
 
-    encoder->encodeVariableLengthByteArray(CoreIPC::DataReference(reinterpret_cast<const uint8_t*>(serializedFormat), length));
+    encoder << CoreIPC::DataReference(reinterpret_cast<const uint8_t*>(serializedFormat), length);
 
     // Encoding will destroy the sandbox extension locally.
     WKSandboxExtensionDestroy(m_sandboxExtension);
@@ -76,7 +76,7 @@ bool SandboxExtension::Handle::decode(CoreIPC::ArgumentDecoder* decoder, Handle&
     ASSERT(!result.m_sandboxExtension);
 
     CoreIPC::DataReference dataReference;
-    if (!decoder->decodeVariableLengthByteArray(dataReference))
+    if (!decoder->decode(dataReference))
         return false;
 
     if (dataReference.isEmpty())
@@ -126,11 +126,11 @@ size_t SandboxExtension::HandleArray::size() const
     return m_size;
 }
 
-void SandboxExtension::HandleArray::encode(CoreIPC::ArgumentEncoder* encoder) const
+void SandboxExtension::HandleArray::encode(CoreIPC::ArgumentEncoder& encoder) const
 {
-    encoder->encode(static_cast<uint64_t>(size()));
+    encoder << static_cast<uint64_t>(size());
     for (size_t i = 0; i < m_size; ++i)
-        encoder->encode(m_data[i]);
+        encoder << m_data[i];
     
 }
 
@@ -140,9 +140,10 @@ bool SandboxExtension::HandleArray::decode(CoreIPC::ArgumentDecoder* decoder, Sa
     if (!decoder->decodeUInt64(size))
         return false;
     handles.allocate(size);
-    for (size_t i = 0; i < size; i++)
+    for (size_t i = 0; i < size; i++) {
         if (!decoder->decode(handles[i]))
             return false;
+    }
     return true;
 }
 
diff --git a/Source/WebKit2/Shared/mac/SecItemRequestData.cpp b/Source/WebKit2/Shared/mac/SecItemRequestData.cpp
index 2fb2f2845..797e13080 100644
--- a/Source/WebKit2/Shared/mac/SecItemRequestData.cpp
+++ b/Source/WebKit2/Shared/mac/SecItemRequestData.cpp
@@ -49,13 +49,13 @@ SecItemRequestData::SecItemRequestData(Type type, CFDictionaryRef query, CFDicti
 {
 }
 
-void SecItemRequestData::encode(CoreIPC::ArgumentEncoder* encoder) const
+void SecItemRequestData::encode(CoreIPC::ArgumentEncoder& encoder) const
 {
-    encoder->encodeEnum(m_type);
+    encoder.encodeEnum(m_type);
 
     CoreIPC::encode(encoder, m_queryDictionary.get());
 
-    encoder->encode(static_cast<bool>(m_attributesToMatch));
+    encoder << static_cast<bool>(m_attributesToMatch);
     if (m_attributesToMatch)
         CoreIPC::encode(encoder, m_attributesToMatch.get());
 }
diff --git a/Source/WebKit2/Shared/mac/SecItemRequestData.h b/Source/WebKit2/Shared/mac/SecItemRequestData.h
index 57b18cfc6..cae2c0aca 100644
--- a/Source/WebKit2/Shared/mac/SecItemRequestData.h
+++ b/Source/WebKit2/Shared/mac/SecItemRequestData.h
@@ -50,7 +50,7 @@ public:
     SecItemRequestData(Type, CFDictionaryRef query);
     SecItemRequestData(Type, CFDictionaryRef query, CFDictionaryRef attributesToMatch);
 
-    void encode(CoreIPC::ArgumentEncoder*) const;
+    void encode(CoreIPC::ArgumentEncoder&) const;
     static bool decode(CoreIPC::ArgumentDecoder*, SecItemRequestData&);
 
     Type type() const { return m_type; }
diff --git a/Source/WebKit2/Shared/mac/SecItemResponseData.cpp b/Source/WebKit2/Shared/mac/SecItemResponseData.cpp
index 0cc8f1347..89dca7963 100644
--- a/Source/WebKit2/Shared/mac/SecItemResponseData.cpp
+++ b/Source/WebKit2/Shared/mac/SecItemResponseData.cpp
@@ -41,10 +41,10 @@ SecItemResponseData::SecItemResponseData(OSStatus resultCode, CFTypeRef resultOb
 {
 }
 
-void SecItemResponseData::encode(CoreIPC::ArgumentEncoder* encoder) const
+void SecItemResponseData::encode(CoreIPC::ArgumentEncoder& encoder) const
 {
-    encoder->encode(static_cast<int64_t>(m_resultCode));
-    encoder->encode(static_cast<bool>(m_resultObject.get()));
+    encoder << static_cast<int64_t>(m_resultCode);
+    encoder << static_cast<bool>(m_resultObject.get());
     if (m_resultObject)
         CoreIPC::encode(encoder, m_resultObject.get());
 }
diff --git a/Source/WebKit2/Shared/mac/SecItemResponseData.h b/Source/WebKit2/Shared/mac/SecItemResponseData.h
index 5c9433692..cf5c9ee7a 100644
--- a/Source/WebKit2/Shared/mac/SecItemResponseData.h
+++ b/Source/WebKit2/Shared/mac/SecItemResponseData.h
@@ -40,7 +40,7 @@ public:
     SecItemResponseData();
     SecItemResponseData(OSStatus, CFTypeRef result);
 
-    void encode(CoreIPC::ArgumentEncoder*) const;
+    void encode(CoreIPC::ArgumentEncoder&) const;
     static bool decode(CoreIPC::ArgumentDecoder*, SecItemResponseData&);
 
     RetainPtr<CFTypeRef>& resultObject() { return m_resultObject; }
diff --git a/Source/WebKit2/Shared/mac/SecKeychainItemRequestData.cpp b/Source/WebKit2/Shared/mac/SecKeychainItemRequestData.cpp
index dcbf99458..4f6d29a51 100644
--- a/Source/WebKit2/Shared/mac/SecKeychainItemRequestData.cpp
+++ b/Source/WebKit2/Shared/mac/SecKeychainItemRequestData.cpp
@@ -123,20 +123,20 @@ SecKeychainAttributeList* SecKeychainItemRequestData::attributeList() const
     return m_attrs->m_attributeList.get();
 }
 
-void SecKeychainItemRequestData::encode(CoreIPC::ArgumentEncoder* encoder) const
+void SecKeychainItemRequestData::encode(CoreIPC::ArgumentEncoder& encoder) const
 {
-    encoder->encodeEnum(m_type);
+    encoder.encodeEnum(m_type);
 
-    encoder->encode(static_cast<bool>(m_keychainItem));
+    encoder << static_cast<bool>(m_keychainItem);
     if (m_keychainItem)
         CoreIPC::encode(encoder, m_keychainItem.get());
 
-    encoder->encode(static_cast<int32_t>(m_keychainAttributes.size()));
+    encoder << static_cast<int32_t>(m_keychainAttributes.size());
     for (size_t i = 0, count = m_keychainAttributes.size(); i < count; ++i)
         CoreIPC::encode(encoder, m_keychainAttributes[i]);
     
-    encoder->encode(static_cast<uint64_t>(m_itemClass));
-    m_dataReference.encode(encoder);
+    encoder << static_cast<uint64_t>(m_itemClass);
+    encoder << m_dataReference;
 }
 
 bool SecKeychainItemRequestData::decode(CoreIPC::ArgumentDecoder* decoder, SecKeychainItemRequestData& secKeychainItemRequestData)
@@ -171,9 +171,9 @@ bool SecKeychainItemRequestData::decode(CoreIPC::ArgumentDecoder* decoder, SecKe
     
     secKeychainItemRequestData.m_itemClass = static_cast<SecItemClass>(itemClass);
 
-    if (!CoreIPC::DataReference::decode(decoder, secKeychainItemRequestData.m_dataReference))
+    if (decoder->decode(secKeychainItemRequestData.m_dataReference))
         return false;
-        
+
     return true;
 }
 
diff --git a/Source/WebKit2/Shared/mac/SecKeychainItemRequestData.h b/Source/WebKit2/Shared/mac/SecKeychainItemRequestData.h
index 512ea54bd..181231bd6 100644
--- a/Source/WebKit2/Shared/mac/SecKeychainItemRequestData.h
+++ b/Source/WebKit2/Shared/mac/SecKeychainItemRequestData.h
@@ -58,7 +58,7 @@ public:
     SecKeychainItemRequestData(Type, SecItemClass, SecKeychainAttributeList*, UInt32 length, const void* data);
     ~SecKeychainItemRequestData();
 
-    void encode(CoreIPC::ArgumentEncoder*) const;
+    void encode(CoreIPC::ArgumentEncoder&) const;
     static bool decode(CoreIPC::ArgumentDecoder*, SecKeychainItemRequestData&);
 
     Type type() const { return m_type; }
diff --git a/Source/WebKit2/Shared/mac/SecKeychainItemResponseData.cpp b/Source/WebKit2/Shared/mac/SecKeychainItemResponseData.cpp
index 247f89b6a..1dea63bea 100644
--- a/Source/WebKit2/Shared/mac/SecKeychainItemResponseData.cpp
+++ b/Source/WebKit2/Shared/mac/SecKeychainItemResponseData.cpp
@@ -63,19 +63,19 @@ SecKeychainItemResponseData::SecKeychainItemResponseData(OSStatus resultCode)
 {
 }
 
-void SecKeychainItemResponseData::encode(CoreIPC::ArgumentEncoder* encoder) const
+void SecKeychainItemResponseData::encode(CoreIPC::ArgumentEncoder& encoder) const
 {
-    encoder->encode(static_cast<int64_t>(m_resultCode));
-    encoder->encode(static_cast<uint32_t>(m_itemClass));
-    encoder->encode(static_cast<uint32_t>(m_attributes.size()));
+    encoder << static_cast<int64_t>(m_resultCode);
+    encoder << static_cast<uint32_t>(m_itemClass);
+    encoder << static_cast<uint32_t>(m_attributes.size());
     for (size_t i = 0, count = m_attributes.size(); i < count; ++i)
         CoreIPC::encode(encoder, m_attributes[i]);
 
-    encoder->encode(static_cast<bool>(m_data));
+    encoder << static_cast<bool>(m_data);
     if (m_data)
         CoreIPC::encode(encoder, m_data.get());
 
-    encoder->encode(static_cast<bool>(m_keychainItem));
+    encoder << static_cast<bool>(m_keychainItem);
     if (m_keychainItem)
         CoreIPC::encode(encoder, m_keychainItem.get());
 }
diff --git a/Source/WebKit2/Shared/mac/SecKeychainItemResponseData.h b/Source/WebKit2/Shared/mac/SecKeychainItemResponseData.h
index 09b38f0ae..cddcfc218 100644
--- a/Source/WebKit2/Shared/mac/SecKeychainItemResponseData.h
+++ b/Source/WebKit2/Shared/mac/SecKeychainItemResponseData.h
@@ -47,7 +47,7 @@ public:
     SecKeychainItemResponseData(OSStatus, RetainPtr<SecKeychainItemRef>);
     SecKeychainItemResponseData(OSStatus);
 
-    void encode(CoreIPC::ArgumentEncoder*) const;
+    void encode(CoreIPC::ArgumentEncoder&) const;
     static bool decode(CoreIPC::ArgumentDecoder*, SecKeychainItemResponseData&);
 
     SecItemClass itemClass() const { return m_itemClass; }
diff --git a/Source/WebKit2/Shared/mac/WebCoreArgumentCodersMac.mm b/Source/WebKit2/Shared/mac/WebCoreArgumentCodersMac.mm
index 9f04ef95e..cc26dceaf 100644
--- a/Source/WebKit2/Shared/mac/WebCoreArgumentCodersMac.mm
+++ b/Source/WebKit2/Shared/mac/WebCoreArgumentCodersMac.mm
@@ -38,10 +38,10 @@ using namespace WebKit;
 
 namespace CoreIPC {
 
-void ArgumentCoder<ResourceRequest>::encodePlatformData(ArgumentEncoder* encoder, const ResourceRequest& resourceRequest)
+void ArgumentCoder<ResourceRequest>::encodePlatformData(ArgumentEncoder& encoder, const ResourceRequest& resourceRequest)
 {
     bool requestIsPresent = resourceRequest.nsURLRequest();
-    encoder->encode(requestIsPresent);
+    encoder << requestIsPresent;
 
     if (!requestIsPresent)
         return;
@@ -73,10 +73,10 @@ bool ArgumentCoder<ResourceRequest>::decodePlatformData(ArgumentDecoder* decoder
     return true;
 }
 
-void ArgumentCoder<ResourceResponse>::encodePlatformData(ArgumentEncoder* encoder, const ResourceResponse& resourceResponse)
+void ArgumentCoder<ResourceResponse>::encodePlatformData(ArgumentEncoder& encoder, const ResourceResponse& resourceResponse)
 {
     bool responseIsPresent = resourceResponse.nsURLResponse();
-    encoder->encode(responseIsPresent);
+    encoder << responseIsPresent;
 
     if (!responseIsPresent)
         return;
@@ -113,10 +113,10 @@ static NSString* nsString(const String& string)
     return string.impl() ? [NSString stringWithCharacters:reinterpret_cast<const UniChar*>(string.characters()) length:string.length()] : @"";
 }
 
-void ArgumentCoder<ResourceError>::encodePlatformData(ArgumentEncoder* encoder, const ResourceError& resourceError)
+void ArgumentCoder<ResourceError>::encodePlatformData(ArgumentEncoder& encoder, const ResourceError& resourceError)
 {
     bool errorIsNull = resourceError.isNull();
-    encoder->encode(errorIsNull);
+    encoder << errorIsNull;
 
     if (errorIsNull)
         return;
@@ -124,10 +124,10 @@ void ArgumentCoder<ResourceError>::encodePlatformData(ArgumentEncoder* encoder,
     NSError *nsError = resourceError.nsError();
 
     String domain = [nsError domain];
-    encoder->encode(domain);
-    
+    encoder << domain;
+
     int64_t code = [nsError code];
-    encoder->encode(code);
+    encoder << code;
 
     HashMap<String, String> stringUserInfoMap;
 
@@ -140,11 +140,11 @@ void ArgumentCoder<ResourceError>::encodePlatformData(ArgumentEncoder* encoder,
         stringUserInfoMap.set(key, (NSString *)value);
         continue;
     }
-    encoder->encode(stringUserInfoMap);
+    encoder << stringUserInfoMap;
 
     id peerCertificateChain = [userInfo objectForKey:@"NSErrorPeerCertificateChainKey"];
     ASSERT(!peerCertificateChain || [peerCertificateChain isKindOfClass:[NSArray class]]);
-    encoder->encode(PlatformCertificateInfo((CFArrayRef)peerCertificateChain));
+    encoder << PlatformCertificateInfo((CFArrayRef)peerCertificateChain);
 }
 
 bool ArgumentCoder<ResourceError>::decodePlatformData(ArgumentDecoder* decoder, ResourceError& resourceError)
@@ -194,10 +194,9 @@ bool ArgumentCoder<ResourceError>::decodePlatformData(ArgumentDecoder* decoder,
     return true;
 }
 
-void ArgumentCoder<KeypressCommand>::encode(ArgumentEncoder* encoder, const KeypressCommand& keypressCommand)
+void ArgumentCoder<KeypressCommand>::encode(ArgumentEncoder& encoder, const KeypressCommand& keypressCommand)
 {
-    encoder->encode(keypressCommand.commandName);
-    encoder->encode(keypressCommand.text);
+    encoder << keypressCommand.commandName << keypressCommand.text;
 }
     
 bool ArgumentCoder<KeypressCommand>::decode(ArgumentDecoder* decoder, KeypressCommand& keypressCommand)
diff --git a/Source/WebKit2/Shared/qt/ArgumentCodersQt.cpp b/Source/WebKit2/Shared/qt/ArgumentCodersQt.cpp
index 67dad4829..9ec19d32a 100644
--- a/Source/WebKit2/Shared/qt/ArgumentCodersQt.cpp
+++ b/Source/WebKit2/Shared/qt/ArgumentCodersQt.cpp
@@ -33,15 +33,15 @@ namespace CoreIPC {
 
 typedef HashMap<String , Vector<uint8_t> > MIMEDataHashMap;
 
-void ArgumentCoder<WebCore::DragData>::encode(ArgumentEncoder* encoder, const DragData& dragData)
+void ArgumentCoder<WebCore::DragData>::encode(ArgumentEncoder& encoder, const DragData& dragData)
 {
-    encoder->encode(dragData.clientPosition());
-    encoder->encode(dragData.globalPosition());
-    encoder->encode((uint64_t)dragData.draggingSourceOperationMask());
-    encoder->encode((uint64_t)dragData.flags());
+    encoder << dragData.clientPosition();
+    encoder << dragData.globalPosition();
+    encoder << (uint64_t)dragData.draggingSourceOperationMask();
+    encoder << (uint64_t)dragData.flags();
 
     bool hasPlatformData = dragData.platformData();
-    encoder->encode(hasPlatformData);
+    encoder << hasPlatformData;
     if (!hasPlatformData)
         return;
 
@@ -54,7 +54,7 @@ void ArgumentCoder<WebCore::DragData>::encode(ArgumentEncoder* encoder, const Dr
         vdata.append((uint8_t*)(bytes.data()), bytes.size());
         map.add(String(formats[i]), vdata);
     }
-    encoder->encode(map);
+    encoder << map;
 }
 
 bool ArgumentCoder<WebCore::DragData>::decode(ArgumentDecoder* decoder, DragData& dragData)
diff --git a/Source/WebKit2/Shared/qt/ArgumentCodersQt.h b/Source/WebKit2/Shared/qt/ArgumentCodersQt.h
index 4d15cc071..ad85799fb 100644
--- a/Source/WebKit2/Shared/qt/ArgumentCodersQt.h
+++ b/Source/WebKit2/Shared/qt/ArgumentCodersQt.h
@@ -26,11 +26,11 @@
 
 namespace CoreIPC {
 
-void encode(ArgumentEncoder*, const WebCore::DragData&);
+void encode(ArgumentEncoder&, const WebCore::DragData&);
 bool decode(ArgumentDecoder*, WebCore::DragData&);
 
 template<> struct ArgumentCoder<WebCore::DragData> {
-    static void encode(ArgumentEncoder*, const WebCore::DragData&);
+    static void encode(ArgumentEncoder&, const WebCore::DragData&);
     static bool decode(ArgumentDecoder*, WebCore::DragData&);
 };
 
diff --git a/Source/WebKit2/Shared/qt/LayerTreeContextQt.cpp b/Source/WebKit2/Shared/qt/LayerTreeContextQt.cpp
index d37d79cb2..00ea8735f 100644
--- a/Source/WebKit2/Shared/qt/LayerTreeContextQt.cpp
+++ b/Source/WebKit2/Shared/qt/LayerTreeContextQt.cpp
@@ -40,9 +40,9 @@ LayerTreeContext::~LayerTreeContext()
 {
 }
 
-void LayerTreeContext::encode(CoreIPC::ArgumentEncoder* encoder) const
+void LayerTreeContext::encode(CoreIPC::ArgumentEncoder& encoder) const
 {
-    encoder->encode(webLayerID);
+    encoder.encode(webLayerID);
 }
 
 bool LayerTreeContext::decode(CoreIPC::ArgumentDecoder* decoder, LayerTreeContext& context)
diff --git a/Source/WebKit2/Shared/qt/PlatformCertificateInfo.h b/Source/WebKit2/Shared/qt/PlatformCertificateInfo.h
index 32776f742..9c542a11d 100644
--- a/Source/WebKit2/Shared/qt/PlatformCertificateInfo.h
+++ b/Source/WebKit2/Shared/qt/PlatformCertificateInfo.h
@@ -42,7 +42,7 @@ public:
     {
     }
 
-    void encode(CoreIPC::ArgumentEncoder*) const
+    void encode(CoreIPC::ArgumentEncoder&) const
     {
     }
 
diff --git a/Source/WebKit2/Shared/qt/QtNetworkReplyData.cpp b/Source/WebKit2/Shared/qt/QtNetworkReplyData.cpp
index 90f68e78f..b11dc2f63 100644
--- a/Source/WebKit2/Shared/qt/QtNetworkReplyData.cpp
+++ b/Source/WebKit2/Shared/qt/QtNetworkReplyData.cpp
@@ -41,13 +41,13 @@ QtNetworkReplyData::QtNetworkReplyData()
     : m_contentLength(0)
 { }
 
-void QtNetworkReplyData::encode(CoreIPC::ArgumentEncoder* encoder) const
+void QtNetworkReplyData::encode(CoreIPC::ArgumentEncoder& encoder) const
 {
-    encoder->encode(m_urlString);
-    encoder->encode(m_contentType);
-    encoder->encode(static_cast<uint64_t>(m_contentLength));
-    encoder->encode(m_replyUuid);
-    encoder->encode(m_dataHandle);
+    encoder.encode(m_urlString);
+    encoder.encode(m_contentType);
+    encoder.encode(static_cast<uint64_t>(m_contentLength));
+    encoder.encode(m_replyUuid);
+    encoder.encode(m_dataHandle);
 }
 
 bool QtNetworkReplyData::decode(CoreIPC::ArgumentDecoder* decoder, QtNetworkReplyData& destination)
diff --git a/Source/WebKit2/Shared/qt/QtNetworkReplyData.h b/Source/WebKit2/Shared/qt/QtNetworkReplyData.h
index 457d7be27..02e5a1545 100644
--- a/Source/WebKit2/Shared/qt/QtNetworkReplyData.h
+++ b/Source/WebKit2/Shared/qt/QtNetworkReplyData.h
@@ -42,7 +42,7 @@ namespace WebKit {
 struct QtNetworkReplyData {
     QtNetworkReplyData();
 
-    void encode(CoreIPC::ArgumentEncoder*) const;
+    void encode(CoreIPC::ArgumentEncoder&) const;
     static bool decode(CoreIPC::ArgumentDecoder*, QtNetworkReplyData&);
 
     WTF::String m_urlString;
diff --git a/Source/WebKit2/Shared/qt/QtNetworkRequestData.cpp b/Source/WebKit2/Shared/qt/QtNetworkRequestData.cpp
index 8a80fb369..4c216db4f 100644
--- a/Source/WebKit2/Shared/qt/QtNetworkRequestData.cpp
+++ b/Source/WebKit2/Shared/qt/QtNetworkRequestData.cpp
@@ -50,11 +50,11 @@ QtNetworkRequestData::QtNetworkRequestData(const QNetworkRequest& request, QNetw
     m_replyUuid = QUuid::createUuid().toString();
 }
 
-void QtNetworkRequestData::encode(CoreIPC::ArgumentEncoder* encoder) const
+void QtNetworkRequestData::encode(CoreIPC::ArgumentEncoder& encoder) const
 {
-    encoder->encode(m_scheme);
-    encoder->encode(m_urlString);
-    encoder->encode(m_replyUuid);
+    encoder.encode(m_scheme);
+    encoder.encode(m_urlString);
+    encoder.encode(m_replyUuid);
 }
 
 bool QtNetworkRequestData::decode(CoreIPC::ArgumentDecoder* decoder, QtNetworkRequestData& destination)
diff --git a/Source/WebKit2/Shared/qt/QtNetworkRequestData.h b/Source/WebKit2/Shared/qt/QtNetworkRequestData.h
index 9bcaac767..6583945ca 100644
--- a/Source/WebKit2/Shared/qt/QtNetworkRequestData.h
+++ b/Source/WebKit2/Shared/qt/QtNetworkRequestData.h
@@ -44,7 +44,7 @@ namespace WebKit {
 struct QtNetworkRequestData {
     QtNetworkRequestData();
     QtNetworkRequestData(const QNetworkRequest&, QNetworkReply*);
-    void encode(CoreIPC::ArgumentEncoder*) const;
+    void encode(CoreIPC::ArgumentEncoder&) const;
     static bool decode(CoreIPC::ArgumentDecoder*, QtNetworkRequestData&);
 
     String m_scheme;
diff --git a/Source/WebKit2/Shared/qt/WebCoreArgumentCodersQt.cpp b/Source/WebKit2/Shared/qt/WebCoreArgumentCodersQt.cpp
index f8d643b98..adf1f2145 100644
--- a/Source/WebKit2/Shared/qt/WebCoreArgumentCodersQt.cpp
+++ b/Source/WebKit2/Shared/qt/WebCoreArgumentCodersQt.cpp
@@ -34,7 +34,7 @@ using namespace WebCore;
  
 namespace CoreIPC {
 
-void ArgumentCoder<ResourceRequest>::encodePlatformData(ArgumentEncoder* encoder, const ResourceRequest& resourceRequest)
+void ArgumentCoder<ResourceRequest>::encodePlatformData(ArgumentEncoder& encoder, const ResourceRequest& resourceRequest)
 {
 }
 
@@ -44,7 +44,7 @@ bool ArgumentCoder<ResourceRequest>::decodePlatformData(ArgumentDecoder* decoder
 }
 
 
-void ArgumentCoder<ResourceResponse>::encodePlatformData(ArgumentEncoder* encoder, const ResourceResponse& resourceResponse)
+void ArgumentCoder<ResourceResponse>::encodePlatformData(ArgumentEncoder& encoder, const ResourceResponse& resourceResponse)
 {
 }
 
@@ -54,7 +54,7 @@ bool ArgumentCoder<ResourceResponse>::decodePlatformData(ArgumentDecoder* decode
 }
 
 
-void ArgumentCoder<ResourceError>::encodePlatformData(ArgumentEncoder* encoder, const ResourceError& resourceError)
+void ArgumentCoder<ResourceError>::encodePlatformData(ArgumentEncoder& encoder, const ResourceError& resourceError)
 {
 }
 
diff --git a/Source/WebKit2/Shared/qt/WebEventFactoryQt.cpp b/Source/WebKit2/Shared/qt/WebEventFactoryQt.cpp
index 45fc34ae6..0240729c0 100644
--- a/Source/WebKit2/Shared/qt/WebEventFactoryQt.cpp
+++ b/Source/WebKit2/Shared/qt/WebEventFactoryQt.cpp
@@ -66,7 +66,6 @@ static WebMouseEvent::Button mouseButtonForEvent(QMouseEvent *event)
 static WebEvent::Type webEventTypeForEvent(const QEvent* event)
 {
     switch (event->type()) {
-    case QEvent::MouseButtonDblClick:
     case QEvent::MouseButtonPress:
         return WebEvent::MouseDown;
     case QEvent::MouseButtonRelease:
@@ -89,6 +88,9 @@ static WebEvent::Type webEventTypeForEvent(const QEvent* event)
     case QEvent::TouchCancel:
         return WebEvent::TouchCancel;
 #endif
+    case QEvent::MouseButtonDblClick:
+        ASSERT_NOT_REACHED();
+        return WebEvent::NoType;
     default:
         // assert
         return WebEvent::MouseMove;
diff --git a/Source/WebKit2/Shared/soup/PlatformCertificateInfo.cpp b/Source/WebKit2/Shared/soup/PlatformCertificateInfo.cpp
index 388be7ad8..816920e6d 100644
--- a/Source/WebKit2/Shared/soup/PlatformCertificateInfo.cpp
+++ b/Source/WebKit2/Shared/soup/PlatformCertificateInfo.cpp
@@ -51,24 +51,24 @@ PlatformCertificateInfo::~PlatformCertificateInfo()
 {
 }
 
-void PlatformCertificateInfo::encode(CoreIPC::ArgumentEncoder* encoder) const
+void PlatformCertificateInfo::encode(CoreIPC::ArgumentEncoder& encoder) const
 {
     if (!m_certificate) {
-        encoder->encode(false);
+        encoder.encode(false);
         return;
     }
 
     GByteArray* certificateData = 0;
     g_object_get(G_OBJECT(m_certificate.get()), "certificate", &certificateData, NULL);
     if (!certificateData) {
-        encoder->encode(false);
+        encoder.encode(false);
         return;
     }
 
-    encoder->encode(true);
+    encoder.encode(true);
     GRefPtr<GByteArray> certificate = adoptGRef(certificateData);
-    encoder->encodeVariableLengthByteArray(CoreIPC::DataReference(certificate->data, certificate->len));
-    encoder->encode(static_cast<uint32_t>(m_tlsErrors));
+    encoder.encodeVariableLengthByteArray(CoreIPC::DataReference(certificate->data, certificate->len));
+    encoder.encode(static_cast<uint32_t>(m_tlsErrors));
 }
 
 bool PlatformCertificateInfo::decode(CoreIPC::ArgumentDecoder* decoder, PlatformCertificateInfo& certificateInfo)
diff --git a/Source/WebKit2/Shared/soup/PlatformCertificateInfo.h b/Source/WebKit2/Shared/soup/PlatformCertificateInfo.h
index 0e76a3e94..9f19a2fab 100644
--- a/Source/WebKit2/Shared/soup/PlatformCertificateInfo.h
+++ b/Source/WebKit2/Shared/soup/PlatformCertificateInfo.h
@@ -50,7 +50,7 @@ public:
     GTlsCertificate* certificate() const { return m_certificate.get(); }
     GTlsCertificateFlags tlsErrors() const { return m_tlsErrors; }
 
-    void encode(CoreIPC::ArgumentEncoder*) const;
+    void encode(CoreIPC::ArgumentEncoder&) const;
     static bool decode(CoreIPC::ArgumentDecoder*, PlatformCertificateInfo&);
 
 private:
diff --git a/Source/WebKit2/Shared/soup/WebCoreArgumentCodersSoup.cpp b/Source/WebKit2/Shared/soup/WebCoreArgumentCodersSoup.cpp
index 4df15dc84..2e9a1968e 100644
--- a/Source/WebKit2/Shared/soup/WebCoreArgumentCodersSoup.cpp
+++ b/Source/WebKit2/Shared/soup/WebCoreArgumentCodersSoup.cpp
@@ -36,9 +36,9 @@ using namespace WebCore;
 
 namespace CoreIPC {
 
-void ArgumentCoder<ResourceRequest>::encodePlatformData(ArgumentEncoder* encoder, const ResourceRequest& resourceRequest)
+void ArgumentCoder<ResourceRequest>::encodePlatformData(ArgumentEncoder& encoder, const ResourceRequest& resourceRequest)
 {
-    encoder->encode(static_cast<uint32_t>(resourceRequest.soupMessageFlags()));
+    encoder << static_cast<uint32_t>(resourceRequest.soupMessageFlags());
 }
 
 bool ArgumentCoder<ResourceRequest>::decodePlatformData(ArgumentDecoder* decoder, ResourceRequest& resourceRequest)
@@ -51,9 +51,9 @@ bool ArgumentCoder<ResourceRequest>::decodePlatformData(ArgumentDecoder* decoder
 }
 
 
-void ArgumentCoder<ResourceResponse>::encodePlatformData(ArgumentEncoder* encoder, const ResourceResponse& resourceResponse)
+void ArgumentCoder<ResourceResponse>::encodePlatformData(ArgumentEncoder& encoder, const ResourceResponse& resourceResponse)
 {
-    encoder->encode(static_cast<uint32_t>(resourceResponse.soupMessageFlags()));
+    encoder << static_cast<uint32_t>(resourceResponse.soupMessageFlags());
 }
 
 bool ArgumentCoder<ResourceResponse>::decodePlatformData(ArgumentDecoder* decoder, ResourceResponse& resourceResponse)
@@ -66,7 +66,7 @@ bool ArgumentCoder<ResourceResponse>::decodePlatformData(ArgumentDecoder* decode
 }
 
 
-void ArgumentCoder<ResourceError>::encodePlatformData(ArgumentEncoder*, const ResourceError&)
+void ArgumentCoder<ResourceError>::encodePlatformData(ArgumentEncoder&, const ResourceError&)
 {
 }
 
diff --git a/Source/WebKit2/Shared/win/LayerTreeContextWin.cpp b/Source/WebKit2/Shared/win/LayerTreeContextWin.cpp
index ad05c1d03..5dd7c667e 100644
--- a/Source/WebKit2/Shared/win/LayerTreeContextWin.cpp
+++ b/Source/WebKit2/Shared/win/LayerTreeContextWin.cpp
@@ -39,9 +39,9 @@ LayerTreeContext::~LayerTreeContext()
 {
 }
 
-void LayerTreeContext::encode(CoreIPC::ArgumentEncoder* encoder) const
+void LayerTreeContext::encode(CoreIPC::ArgumentEncoder& encoder) const
 {
-    encoder->encode(reinterpret_cast<uint64_t>(window));
+    encoder.encode(reinterpret_cast<uint64_t>(window));
 }
 
 bool LayerTreeContext::decode(CoreIPC::ArgumentDecoder* decoder, LayerTreeContext& context)
diff --git a/Source/WebKit2/Shared/win/PlatformCertificateInfo.cpp b/Source/WebKit2/Shared/win/PlatformCertificateInfo.cpp
index 08cd4e2b3..5b0d20a84 100644
--- a/Source/WebKit2/Shared/win/PlatformCertificateInfo.cpp
+++ b/Source/WebKit2/Shared/win/PlatformCertificateInfo.cpp
@@ -106,19 +106,19 @@ PlatformCertificateInfo& PlatformCertificateInfo::operator=(const PlatformCertif
     return *this;
 }
 
-void PlatformCertificateInfo::encode(CoreIPC::ArgumentEncoder* encoder) const
+void PlatformCertificateInfo::encode(CoreIPC::ArgumentEncoder& encoder) const
 {
     // Special case no certificates
     if (m_certificateChain.isEmpty()) {
-        encoder->encode(std::numeric_limits<uint64_t>::max());
+        encoder.encode(std::numeric_limits<uint64_t>::max());
         return;
     }
 
     uint64_t length = m_certificateChain.size();
-    encoder->encode(length);
+    encoder.encode(length);
 
     for (size_t i = 0; i < length; ++i)
-        encoder->encodeVariableLengthByteArray(CoreIPC::DataReference(static_cast<uint8_t*>(m_certificateChain[i]->pbCertEncoded), m_certificateChain[i]->cbCertEncoded));
+        encoder.encodeVariableLengthByteArray(CoreIPC::DataReference(static_cast<uint8_t*>(m_certificateChain[i]->pbCertEncoded), m_certificateChain[i]->cbCertEncoded));
 }
 
 bool PlatformCertificateInfo::decode(CoreIPC::ArgumentDecoder* decoder, PlatformCertificateInfo& c)
diff --git a/Source/WebKit2/Shared/win/PlatformCertificateInfo.h b/Source/WebKit2/Shared/win/PlatformCertificateInfo.h
index dd999ef25..7637bbbc5 100644
--- a/Source/WebKit2/Shared/win/PlatformCertificateInfo.h
+++ b/Source/WebKit2/Shared/win/PlatformCertificateInfo.h
@@ -51,7 +51,7 @@ public:
 
     const Vector<PCCERT_CONTEXT>& certificateChain() const { return m_certificateChain; }
 
-    void encode(CoreIPC::ArgumentEncoder* encoder) const;
+    void encode(CoreIPC::ArgumentEncoder&) const;
     static bool decode(CoreIPC::ArgumentDecoder* decoder, PlatformCertificateInfo& t);
 
 private:
diff --git a/Source/WebKit2/Shared/win/WebCoreArgumentCodersWin.cpp b/Source/WebKit2/Shared/win/WebCoreArgumentCodersWin.cpp
index a61409194..7f04db08f 100644
--- a/Source/WebKit2/Shared/win/WebCoreArgumentCodersWin.cpp
+++ b/Source/WebKit2/Shared/win/WebCoreArgumentCodersWin.cpp
@@ -49,11 +49,11 @@ namespace CoreIPC {
 
 // FIXME: These coders should really go in a WebCoreArgumentCodersCFNetwork file.
 
-void ArgumentCoder<ResourceRequest>::encodePlatformData(ArgumentEncoder* encoder, const ResourceRequest& resourceRequest)
+void ArgumentCoder<ResourceRequest>::encodePlatformData(ArgumentEncoder& encoder, const ResourceRequest& resourceRequest)
 {
 #if USE(CFNETWORK)
     bool requestIsPresent = resourceRequest.cfURLRequest();
-    encoder->encode(requestIsPresent);
+    encoder << requestIsPresent;
 
     if (!requestIsPresent)
         return;
@@ -95,11 +95,11 @@ bool ArgumentCoder<ResourceRequest>::decodePlatformData(ArgumentDecoder* decoder
 }
 
 
-void ArgumentCoder<ResourceResponse>::encodePlatformData(ArgumentEncoder* encoder, const ResourceResponse& resourceResponse)
+void ArgumentCoder<ResourceResponse>::encodePlatformData(ArgumentEncoder& encoder, const ResourceResponse& resourceResponse)
 {
 #if USE(CFNETWORK)
     bool responseIsPresent = resourceResponse.cfURLResponse();
-    encoder->encode(responseIsPresent);
+    encoder << responseIsPresent;
 
     if (!responseIsPresent)
         return;
@@ -137,10 +137,10 @@ bool ArgumentCoder<ResourceResponse>::decodePlatformData(ArgumentDecoder* decode
 }
 
 
-void ArgumentCoder<ResourceError>::encodePlatformData(ArgumentEncoder* encoder, const ResourceError& resourceError)
+void ArgumentCoder<ResourceError>::encodePlatformData(ArgumentEncoder& encoder, const ResourceError& resourceError)
 {
 #if USE(CFNETWORK)
-    encoder->encode(PlatformCertificateInfo(resourceError.certificate()));
+    encoder << PlatformCertificateInfo(resourceError.certificate());
 #endif
 }
 
diff --git a/Source/WebKit2/Shared/win/WindowGeometry.cpp b/Source/WebKit2/Shared/win/WindowGeometry.cpp
index 73caa05dd..da40d246f 100644
--- a/Source/WebKit2/Shared/win/WindowGeometry.cpp
+++ b/Source/WebKit2/Shared/win/WindowGeometry.cpp
@@ -36,12 +36,12 @@ WindowGeometry::WindowGeometry()
 {
 }
 
-void WindowGeometry::encode(CoreIPC::ArgumentEncoder* encoder) const
+void WindowGeometry::encode(CoreIPC::ArgumentEncoder& encoder) const
 {
-    encoder->encode(reinterpret_cast<uint64_t>(window));
-    encoder->encode(visible);
-    encoder->encode(frame);
-    encoder->encode(clipRect);
+    encoder.encode(reinterpret_cast<uint64_t>(window));
+    encoder.encode(visible);
+    encoder.encode(frame);
+    encoder.encode(clipRect);
 }
 
 bool WindowGeometry::decode(CoreIPC::ArgumentDecoder* decoder, WindowGeometry& geometry)
diff --git a/Source/WebKit2/Shared/win/WindowGeometry.h b/Source/WebKit2/Shared/win/WindowGeometry.h
index c5542bd26..9194e531f 100644
--- a/Source/WebKit2/Shared/win/WindowGeometry.h
+++ b/Source/WebKit2/Shared/win/WindowGeometry.h
@@ -38,7 +38,7 @@ namespace WebKit {
 struct WindowGeometry {
     WindowGeometry();
 
-    void encode(CoreIPC::ArgumentEncoder*) const;
+    void encode(CoreIPC::ArgumentEncoder&) const;
     static bool decode(CoreIPC::ArgumentDecoder*, WindowGeometry&);
 
     HWND window;
diff --git a/Source/WebKit2/SharedWorkerProcess/SharedWorkerProcess.cpp b/Source/WebKit2/SharedWorkerProcess/SharedWorkerProcess.cpp
index a533d25bc..c8decb4a2 100644
--- a/Source/WebKit2/SharedWorkerProcess/SharedWorkerProcess.cpp
+++ b/Source/WebKit2/SharedWorkerProcess/SharedWorkerProcess.cpp
@@ -114,7 +114,7 @@ void SharedWorkerProcess::didClose(CoreIPC::Connection*)
     RunLoop::current()->stop();
 }
 
-void SharedWorkerProcess::didReceiveInvalidMessage(CoreIPC::Connection*, CoreIPC::MessageID)
+void SharedWorkerProcess::didReceiveInvalidMessage(CoreIPC::Connection*, CoreIPC::StringReference, CoreIPC::StringReference)
 {
 }
 
diff --git a/Source/WebKit2/SharedWorkerProcess/SharedWorkerProcess.h b/Source/WebKit2/SharedWorkerProcess/SharedWorkerProcess.h
index d5b5c81c8..7ebd357e4 100644
--- a/Source/WebKit2/SharedWorkerProcess/SharedWorkerProcess.h
+++ b/Source/WebKit2/SharedWorkerProcess/SharedWorkerProcess.h
@@ -59,7 +59,7 @@ private:
     // CoreIPC::Connection::Client
     virtual void didReceiveMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::MessageDecoder&);
     virtual void didClose(CoreIPC::Connection*);
-    virtual void didReceiveInvalidMessage(CoreIPC::Connection*, CoreIPC::MessageID);
+    virtual void didReceiveInvalidMessage(CoreIPC::Connection*, CoreIPC::StringReference messageReceiverName, CoreIPC::StringReference messageName) OVERRIDE;
 
     // Message handlers.
     void didReceiveSharedWorkerProcessMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::MessageDecoder&);
diff --git a/Source/WebKit2/SharedWorkerProcess/SharedWorkerProcess.messages.in b/Source/WebKit2/SharedWorkerProcess/SharedWorkerProcess.messages.in
index 3cd75337b..789bbb318 100644
--- a/Source/WebKit2/SharedWorkerProcess/SharedWorkerProcess.messages.in
+++ b/Source/WebKit2/SharedWorkerProcess/SharedWorkerProcess.messages.in
@@ -30,6 +30,10 @@ messages -> SharedWorkerProcess {
     # The shared worker process sends back a DidCreateWebProcessConnection message with
     # a connection identifier.
     CreateWebProcessConnection()
+
+#if PLATFORM(MAC)
+    SetApplicationIsOccluded(bool flag)
+#endif
 }
 
 #endif // ENABLE(SHARED_WORKER_PROCESS)
diff --git a/Source/WebKit2/UIProcess/API/C/WKAPICast.h b/Source/WebKit2/UIProcess/API/C/WKAPICast.h
index ba627708e..713b4f896 100644
--- a/Source/WebKit2/UIProcess/API/C/WKAPICast.h
+++ b/Source/WebKit2/UIProcess/API/C/WKAPICast.h
@@ -142,10 +142,7 @@ WK_ADD_API_MAPPING(WKRenderLayerRef, WebRenderLayer)
 WK_ADD_API_MAPPING(WKRenderObjectRef, WebRenderObject)
 WK_ADD_API_MAPPING(WKTextCheckerRef, WebTextChecker)
 WK_ADD_API_MAPPING(WKVibrationRef, WebVibrationProxy)
-
-#if ENABLE(INSPECTOR)
 WK_ADD_API_MAPPING(WKInspectorRef, WebInspectorProxy)
-#endif
 
 /* Enum conversions */
 
diff --git a/Source/WebKit2/UIProcess/API/C/WKInspector.cpp b/Source/WebKit2/UIProcess/API/C/WKInspector.cpp
index 7e2187dda..891388c9a 100644
--- a/Source/WebKit2/UIProcess/API/C/WKInspector.cpp
+++ b/Source/WebKit2/UIProcess/API/C/WKInspector.cpp
@@ -26,8 +26,6 @@
 #include "config.h"
 #include "WKInspector.h"
 
-#if ENABLE(INSPECTOR)
-
 #include "WKAPICast.h"
 #include "WebInspectorProxy.h"
 
@@ -35,92 +33,142 @@ using namespace WebKit;
 
 WKTypeID WKInspectorGetTypeID()
 {
+#if ENABLE(INSPECTOR)
     return toAPI(WebInspectorProxy::APIType);
+#else
+    return 0;
+#endif
 }
 
 WKPageRef WKInspectorGetPage(WKInspectorRef inspectorRef)
 {
+#if ENABLE(INSPECTOR)
     return toAPI(toImpl(inspectorRef)->page());
+#else
+    return 0;
+#endif
 }
 
 bool WKInspectorIsVisible(WKInspectorRef inspectorRef)
 {
+#if ENABLE(INSPECTOR)
     return toImpl(inspectorRef)->isVisible();
+#else
+    return false;
+#endif
 }
 
 bool WKInspectorIsFront(WKInspectorRef inspectorRef)
 {
+#if ENABLE(INSPECTOR)
     return toImpl(inspectorRef)->isFront();
+#else
+    return false;
+#endif
 }
 
 void WKInspectorShow(WKInspectorRef inspectorRef)
 {
+#if ENABLE(INSPECTOR)
     toImpl(inspectorRef)->show();
+#endif
 }
 
 void WKInspectorClose(WKInspectorRef inspectorRef)
 {
+#if ENABLE(INSPECTOR)
     toImpl(inspectorRef)->close();
+#endif
 }
 
 void WKInspectorShowConsole(WKInspectorRef inspectorRef)
 {
+#if ENABLE(INSPECTOR)
     toImpl(inspectorRef)->showConsole();
+#endif
 }
 
 void WKInspectorShowResources(WKInspectorRef inspectorRef)
 {
+#if ENABLE(INSPECTOR)
     toImpl(inspectorRef)->showResources();
+#endif
 }
 
 void WKInspectorShowMainResourceForFrame(WKInspectorRef inspectorRef, WKFrameRef frameRef)
 {
+#if ENABLE(INSPECTOR)
     toImpl(inspectorRef)->showMainResourceForFrame(toImpl(frameRef));
+#endif
 }
 
 bool WKInspectorIsAttached(WKInspectorRef inspectorRef)
 {
+#if ENABLE(INSPECTOR)
     return toImpl(inspectorRef)->isAttached();
+#else
+    return false;
+#endif
 }
 
 void WKInspectorAttach(WKInspectorRef inspectorRef)
 {
+#if ENABLE(INSPECTOR)
     toImpl(inspectorRef)->attach();
+#endif
 }
 
 void WKInspectorDetach(WKInspectorRef inspectorRef)
 {
+#if ENABLE(INSPECTOR)
     toImpl(inspectorRef)->detach();
+#endif
 }
 
 bool WKInspectorIsDebuggingJavaScript(WKInspectorRef inspectorRef)
 {
+#if ENABLE(INSPECTOR)
     return toImpl(inspectorRef)->isDebuggingJavaScript();
+#else
+    return false;
+#endif
 }
 
 void WKInspectorToggleJavaScriptDebugging(WKInspectorRef inspectorRef)
 {
+#if ENABLE(INSPECTOR)
     toImpl(inspectorRef)->toggleJavaScriptDebugging();
+#endif
 }
 
 bool WKInspectorIsProfilingJavaScript(WKInspectorRef inspectorRef)
 {
+#if ENABLE(INSPECTOR)
     return toImpl(inspectorRef)->isProfilingJavaScript();
+#else
+    return false;
+#endif
 }
 
 void WKInspectorToggleJavaScriptProfiling(WKInspectorRef inspectorRef)
 {
+#if ENABLE(INSPECTOR)
     toImpl(inspectorRef)->toggleJavaScriptProfiling();
+#endif
 }
 
 bool WKInspectorIsProfilingPage(WKInspectorRef inspectorRef)
 {
+#if ENABLE(INSPECTOR)
     return toImpl(inspectorRef)->isProfilingPage();
+#else
+    return false;
+#endif
 }
 
 void WKInspectorTogglePageProfiling(WKInspectorRef inspectorRef)
 {
+#if ENABLE(INSPECTOR)
     toImpl(inspectorRef)->togglePageProfiling();
+#endif
 }
-
-#endif // ENABLE(INSPECTOR)
diff --git a/Source/WebKit2/UIProcess/API/C/WKInspector.h b/Source/WebKit2/UIProcess/API/C/WKInspector.h
index a00d103de..fd3438afa 100644
--- a/Source/WebKit2/UIProcess/API/C/WKInspector.h
+++ b/Source/WebKit2/UIProcess/API/C/WKInspector.h
@@ -28,8 +28,6 @@
 
 #include <WebKit2/WKBase.h>
 
-#if ENABLE(INSPECTOR)
-
 #ifndef __cplusplus
 #include <stdbool.h>
 #endif
@@ -68,6 +66,4 @@ WK_EXPORT void WKInspectorTogglePageProfiling(WKInspectorRef inspector);
 }
 #endif
 
-#endif // ENABLE(INSPECTOR)
-
 #endif // WKInspector_h
diff --git a/Source/WebKit2/UIProcess/API/C/WKPage.cpp b/Source/WebKit2/UIProcess/API/C/WKPage.cpp
index 52e1cebf8..bdbcb554d 100644
--- a/Source/WebKit2/UIProcess/API/C/WKPage.cpp
+++ b/Source/WebKit2/UIProcess/API/C/WKPage.cpp
@@ -182,12 +182,14 @@ uint64_t WKPageGetRenderTreeSize(WKPageRef page)
     return toImpl(page)->renderTreeSize();
 }
 
-#if defined(ENABLE_INSPECTOR) && ENABLE_INSPECTOR
 WKInspectorRef WKPageGetInspector(WKPageRef pageRef)
 {
+#if defined(ENABLE_INSPECTOR) && ENABLE_INSPECTOR
     return toAPI(toImpl(pageRef)->inspector());
-}
+#else
+    return 0;
 #endif
+}
 
 double WKPageGetEstimatedProgress(WKPageRef pageRef)
 {
diff --git a/Source/WebKit2/UIProcess/API/C/WKPage.h b/Source/WebKit2/UIProcess/API/C/WKPage.h
index 9dfd52e3c..dadebbc91 100644
--- a/Source/WebKit2/UIProcess/API/C/WKPage.h
+++ b/Source/WebKit2/UIProcess/API/C/WKPage.h
@@ -387,9 +387,7 @@ WK_EXPORT uint64_t WKPageGetRenderTreeSize(WKPageRef page);
 
 WK_EXPORT void WKPageSetMemoryCacheClientCallsEnabled(WKPageRef page, bool memoryCacheClientCallsEnabled);
 
-#if defined(ENABLE_INSPECTOR) && ENABLE_INSPECTOR
 WK_EXPORT WKInspectorRef WKPageGetInspector(WKPageRef page);
-#endif
 
 WK_EXPORT WKStringRef WKPageCopyUserAgent(WKPageRef page);
 
diff --git a/Source/WebKit2/UIProcess/API/C/WKPreferences.cpp b/Source/WebKit2/UIProcess/API/C/WKPreferences.cpp
index 532d82caf..068563d1f 100644
--- a/Source/WebKit2/UIProcess/API/C/WKPreferences.cpp
+++ b/Source/WebKit2/UIProcess/API/C/WKPreferences.cpp
@@ -943,3 +943,13 @@ bool WKPreferencesGetPDFPluginEnabled(WKPreferencesRef preferencesRef)
 {
     return toImpl(preferencesRef)->pdfPluginEnabled();
 }
+
+void WKPreferencesSetEncodingDetectorEnabled(WKPreferencesRef preferencesRef, bool enabled)
+{
+    toImpl(preferencesRef)->setUsesEncodingDetector(enabled);
+}
+
+bool WKPreferencesGetEncodingDetectorEnabled(WKPreferencesRef preferencesRef)
+{
+    return toImpl(preferencesRef)->usesEncodingDetector();
+}
diff --git a/Source/WebKit2/UIProcess/API/C/WKPreferences.h b/Source/WebKit2/UIProcess/API/C/WKPreferences.h
index d91b82d83..ff2e0a006 100644
--- a/Source/WebKit2/UIProcess/API/C/WKPreferences.h
+++ b/Source/WebKit2/UIProcess/API/C/WKPreferences.h
@@ -220,6 +220,10 @@ WK_EXPORT WKStorageBlockingPolicy WKPreferencesGetStorageBlockingPolicy(WKPrefer
 WK_EXPORT void WKPreferencesSetPlugInSnapshottingEnabled(WKPreferencesRef preferencesRef, bool enabled);
 WK_EXPORT bool WKPreferencesGetPlugInSnapshottingEnabled(WKPreferencesRef preferencesRef);
 
+// Defaults to false.
+WK_EXPORT void WKPreferencesSetEncodingDetectorEnabled(WKPreferencesRef preferencesRef, bool enabled);
+WK_EXPORT bool WKPreferencesGetEncodingDetectorEnabled(WKPreferencesRef preferencesRef);
+
 #ifdef __cplusplus
 }
 #endif
diff --git a/Source/WebKit2/UIProcess/API/C/efl/WKView.cpp b/Source/WebKit2/UIProcess/API/C/efl/WKView.cpp
index 03f6930dd..a03d189df 100644
--- a/Source/WebKit2/UIProcess/API/C/efl/WKView.cpp
+++ b/Source/WebKit2/UIProcess/API/C/efl/WKView.cpp
@@ -20,6 +20,7 @@
 #include "config.h"
 #include "WKView.h"
 
+#include "EwkViewImpl.h"
 #include "WKAPICast.h"
 #include "ewk_view_private.h"
 
@@ -32,5 +33,7 @@ WKViewRef WKViewCreate(Evas* canvas, WKContextRef contextRef, WKPageGroupRef pag
 
 WKPageRef WKViewGetPage(WKViewRef viewRef)
 {
-    return toAPI(ewk_view_page_get(toImpl(viewRef)));
+    EwkViewImpl* viewImpl = EwkViewImpl::fromEvasObject(toImpl(viewRef));
+
+    return viewImpl->wkPage();
 }
diff --git a/Source/WebKit2/UIProcess/API/efl/EWebKit2.h b/Source/WebKit2/UIProcess/API/efl/EWebKit2.h
index 17afb115d..07ca12935 100644
--- a/Source/WebKit2/UIProcess/API/efl/EWebKit2.h
+++ b/Source/WebKit2/UIProcess/API/efl/EWebKit2.h
@@ -28,22 +28,30 @@
 #ifndef EWebKit2_h
 #define EWebKit2_h
 
+#include "ewk_auth_request.h"
 #include "ewk_back_forward_list.h"
 #include "ewk_back_forward_list_item.h"
+#include "ewk_color_picker.h"
 #include "ewk_context.h"
 #include "ewk_cookie_manager.h"
+#include "ewk_database_manager.h"
 #include "ewk_download_job.h"
 #include "ewk_error.h"
 #include "ewk_favicon_database.h"
+#include "ewk_file_chooser_request.h"
 #include "ewk_form_submission_request.h"
 #include "ewk_intent.h"
 #include "ewk_intent_service.h"
 #include "ewk_main.h"
 #include "ewk_navigation_data.h"
 #include "ewk_navigation_policy_decision.h"
+#include "ewk_object.h"
+#include "ewk_popup_menu.h"
 #include "ewk_popup_menu_item.h"
 #include "ewk_resource.h"
+#include "ewk_security_origin.h"
 #include "ewk_settings.h"
+#include "ewk_storage_manager.h"
 #include "ewk_text_checker.h"
 #include "ewk_touch.h"
 #include "ewk_url_request.h"
diff --git a/Source/WebKit2/UIProcess/API/efl/ewk_view_policy_client_private.h b/Source/WebKit2/UIProcess/API/efl/EvasGLContext.cpp
index c67248d96..98a7e6a8e 100644
--- a/Source/WebKit2/UIProcess/API/efl/ewk_view_policy_client_private.h
+++ b/Source/WebKit2/UIProcess/API/efl/EvasGLContext.cpp
@@ -23,12 +23,26 @@
  * THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef ewk_view_policy_client_private_h
-#define ewk_view_policy_client_private_h
+#include "config.h"
+#include "EvasGLContext.h"
 
-#include <Evas.h>
-#include <WebKit2/WKBase.h>
+#if USE(ACCELERATED_COMPOSITING)
 
-void ewk_view_policy_client_attach(WKPageRef pageRef, Evas_Object* ewkView);
+namespace WebKit {
 
-#endif // ewk_view_policy_client_private_h
+EvasGLContext::EvasGLContext(Evas_GL* evasGL, Evas_GL_Context* passContext)
+    : m_evasGL(evasGL)
+    , m_context(passContext)
+{
+    ASSERT(evasGL);
+    ASSERT(passContext);
+}
+
+EvasGLContext::~EvasGLContext()
+{
+    evas_gl_context_destroy(m_evasGL, m_context);
+}
+
+} // namespace WebKit
+
+#endif // USE(ACCELERATED_COMPOSITING)
diff --git a/Source/WebKit2/UIProcess/API/efl/EvasGLContext.h b/Source/WebKit2/UIProcess/API/efl/EvasGLContext.h
new file mode 100644
index 000000000..9899a81f4
--- /dev/null
+++ b/Source/WebKit2/UIProcess/API/efl/EvasGLContext.h
@@ -0,0 +1,62 @@
+/*
+ * Copyright (C) 2012 Intel Corporation. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef EvasGLContext_h
+#define EvasGLContext_h
+
+#if USE(ACCELERATED_COMPOSITING)
+#include <Evas_GL.h>
+#include <wtf/PassOwnPtr.h>
+
+namespace WebKit {
+
+class EvasGLContext {
+public:
+    static PassOwnPtr<EvasGLContext> create(Evas_GL* evasGL)
+    {
+        ASSERT(evasGL);
+        Evas_GL_Context* context = evas_gl_context_create(evasGL, 0);
+        if (!context)
+            return nullptr;
+
+        // Ownership of context is passed to EvasGLContext.
+        return adoptPtr(new EvasGLContext(evasGL, context));
+    }
+    ~EvasGLContext();
+
+    inline Evas_GL_Context* context() const { return m_context; }
+
+private:
+    EvasGLContext(Evas_GL* evasGL, Evas_GL_Context* passContext);
+
+    Evas_GL* m_evasGL;
+    Evas_GL_Context* m_context;
+};
+
+} // namespace WebKit
+
+#endif // USE(ACCELERATED_COMPOSITING)
+
+#endif // EvasGLContext_h
diff --git a/Source/WebKit2/UIProcess/API/efl/ewk_view_form_client_private.h b/Source/WebKit2/UIProcess/API/efl/EvasGLSurface.cpp
index 9feb4a138..d5d138390 100644
--- a/Source/WebKit2/UIProcess/API/efl/ewk_view_form_client_private.h
+++ b/Source/WebKit2/UIProcess/API/efl/EvasGLSurface.cpp
@@ -23,12 +23,26 @@
  * THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef ewk_view_form_client_private_h
-#define ewk_view_form_client_private_h
+#include "config.h"
+#include "EvasGLSurface.h"
 
-#include <Evas.h>
-#include <WebKit2/WKBase.h>
+#if USE(ACCELERATED_COMPOSITING)
 
-void ewk_view_form_client_attach(WKPageRef pageRef, Evas_Object* ewkView);
+namespace WebKit {
 
-#endif // ewk_view_form_client_private_h
+EvasGLSurface::EvasGLSurface(Evas_GL* evasGL, Evas_GL_Surface* passSurface)
+    : m_evasGL(evasGL)
+    , m_surface(passSurface)
+{
+    ASSERT(evasGL);
+    ASSERT(passSurface);
+}
+
+EvasGLSurface::~EvasGLSurface()
+{
+    evas_gl_surface_destroy(m_evasGL, m_surface);
+}
+
+} // namespace WebKit
+
+#endif // USE(ACCELERATED_COMPOSITING)
diff --git a/Source/WebKit2/UIProcess/API/efl/EvasGLSurface.h b/Source/WebKit2/UIProcess/API/efl/EvasGLSurface.h
new file mode 100644
index 000000000..9ab3062c4
--- /dev/null
+++ b/Source/WebKit2/UIProcess/API/efl/EvasGLSurface.h
@@ -0,0 +1,64 @@
+/*
+ * Copyright (C) 2012 Intel Corporation. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef EvasGLSurface_h
+#define EvasGLSurface_h
+
+#if USE(ACCELERATED_COMPOSITING)
+#include <Evas_GL.h>
+#include <WebCore/IntSize.h>
+#include <wtf/PassOwnPtr.h>
+
+namespace WebKit {
+
+class EvasGLSurface {
+public:
+    static PassOwnPtr<EvasGLSurface> create(Evas_GL* evasGL, Evas_GL_Config* cfg, const WebCore::IntSize& size)
+    {
+        ASSERT(evasGL);
+        ASSERT(cfg);
+        Evas_GL_Surface* surface = evas_gl_surface_create(evasGL, cfg, size.width(), size.height());
+        if (!surface)
+            return nullptr;
+
+        // Ownership of surface is passed to EvasGLSurface.
+        return adoptPtr(new EvasGLSurface(evasGL, surface));
+    }
+    ~EvasGLSurface();
+
+    inline Evas_GL_Surface* surface() const { return m_surface; }
+
+private:
+    EvasGLSurface(Evas_GL* evasGL, Evas_GL_Surface* passSurface);
+
+    Evas_GL* m_evasGL;
+    Evas_GL_Surface* m_surface;
+};
+
+} // namespace WebKit
+
+#endif // USE(ACCELERATED_COMPOSITING)
+
+#endif // EvasGLSurface_h
diff --git a/Source/WebKit2/UIProcess/API/efl/EwkViewCallbacks.h b/Source/WebKit2/UIProcess/API/efl/EwkViewCallbacks.h
new file mode 100644
index 000000000..7f5512753
--- /dev/null
+++ b/Source/WebKit2/UIProcess/API/efl/EwkViewCallbacks.h
@@ -0,0 +1,200 @@
+/*
+ * Copyright (C) 2012 Intel Corporation. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef EwkViewCallbacks_h
+#define EwkViewCallbacks_h
+
+#include "WKEinaSharedString.h"
+#include "ewk_private.h"
+#include <Evas.h>
+#include <wtf/text/CString.h>
+#include <wtf/text/WTFString.h>
+
+typedef struct Ewk_Object Ewk_Auth_Request;
+typedef struct Ewk_Object Ewk_Download_Job;
+struct Ewk_Download_Job_Error;
+struct Ewk_File_Chooser_Request;
+struct Ewk_Form_Submission_Request;
+struct Ewk_Error;
+struct Ewk_Resource_Request;
+struct Ewk_Resource_Load_Response;
+struct Ewk_Resource_Load_Error;
+struct Ewk_Resource;
+struct Ewk_Navigation_Policy_Decision;
+#if ENABLE(WEB_INTENTS)
+struct Ewk_Intent;
+#endif
+#if ENABLE(WEB_INTENTS_TAG)
+struct Ewk_Intent_Service;
+#endif
+
+namespace EwkViewCallbacks {
+
+enum CallbackType {
+    AuthenticationRequest,
+    BackForwardListChange,
+    CloseWindow,
+    CreateWindow,
+    DownloadJobCancelled,
+    DownloadJobFailed,
+    DownloadJobFinished,
+    DownloadJobRequested,
+    FileChooserRequest,
+    NewFormSubmissionRequest,
+    IconChanged,
+    LoadError,
+    LoadFinished,
+    LoadProgress,
+    ProvisionalLoadFailed,
+    ProvisionalLoadRedirect,
+    ProvisionalLoadStarted,
+    ResourceLoadStarted,
+    ResourceLoadResponse,
+    ResourceLoadFailed,
+    ResourceLoadFinished,
+    ResourceRequestSent,
+    NavigationPolicyDecision,
+    NewWindowPolicyDecision,
+    TextFound,
+    TitleChange,
+    TooltipTextUnset,
+    TooltipTextSet,
+    URLChanged,
+    WebProcessCrashed,
+#if ENABLE(WEB_INTENTS)
+    IntentRequest,
+#endif
+#if ENABLE(WEB_INTENTS_TAG)
+    IntentServiceRegistration,
+#endif
+};
+
+template<typename T>
+inline bool callbackArgumentsExpected()
+{
+    return true;
+}
+
+template<>
+inline bool callbackArgumentsExpected<void>()
+{
+    return false;
+}
+
+template <CallbackType>
+struct CallBackInfo {
+    typedef void* Type;
+
+    static inline const char* name()
+    {
+        ASSERT_NOT_REACHED();
+        return "";
+    }
+};
+
+template <CallbackType callbackType>
+class CallBack {
+public:
+    typedef typename CallBackInfo<callbackType>::Type ArgType;
+
+    explicit CallBack(Evas_Object* view)
+        : m_view(view)
+    {
+        ASSERT(m_view);
+    }
+
+    void call(ArgType* argument = 0)
+    {
+        if (argument && !callbackArgumentsExpected<ArgType>()) {
+            CRITICAL("should not pass arguments for this callback!");
+            ASSERT_NOT_REACHED();
+            return;
+        }
+
+        evas_object_smart_callback_call(m_view, CallBackInfo<callbackType>::name(), static_cast<void*>(argument));
+    }
+
+    void call(const String& arg)
+    {
+        call(const_cast<char*>(arg.utf8().data()));
+    }
+
+    void call(const WKEinaSharedString& arg)
+    {
+        call(const_cast<char*>(static_cast<const char*>(arg)));
+    }
+
+private:
+    Evas_Object* m_view;
+};
+
+#define DECLARE_EWK_VIEW_CALLBACK(callbackType, string, type) \
+template <>                                                   \
+struct CallBackInfo<callbackType> {                           \
+    typedef type Type;                                        \
+    static inline const char* name() { return string; }       \
+}
+
+// Note: type 'void' means that no arguments are expected.
+DECLARE_EWK_VIEW_CALLBACK(AuthenticationRequest, "authentication,request", Ewk_Auth_Request);
+DECLARE_EWK_VIEW_CALLBACK(BackForwardListChange, "back,forward,list,changed", void);
+DECLARE_EWK_VIEW_CALLBACK(CloseWindow, "close,window", void);
+DECLARE_EWK_VIEW_CALLBACK(CreateWindow, "create,window", Evas_Object*);
+DECLARE_EWK_VIEW_CALLBACK(DownloadJobCancelled, "download,cancelled", Ewk_Download_Job);
+DECLARE_EWK_VIEW_CALLBACK(DownloadJobFailed, "download,failed", Ewk_Download_Job_Error);
+DECLARE_EWK_VIEW_CALLBACK(DownloadJobFinished, "download,finished", Ewk_Download_Job);
+DECLARE_EWK_VIEW_CALLBACK(DownloadJobRequested, "download,request", Ewk_Download_Job);
+DECLARE_EWK_VIEW_CALLBACK(FileChooserRequest, "file,chooser,request", Ewk_File_Chooser_Request);
+DECLARE_EWK_VIEW_CALLBACK(NewFormSubmissionRequest, "form,submission,request", Ewk_Form_Submission_Request);
+DECLARE_EWK_VIEW_CALLBACK(IconChanged, "icon,changed", void);
+DECLARE_EWK_VIEW_CALLBACK(LoadError, "load,error", Ewk_Error);
+DECLARE_EWK_VIEW_CALLBACK(LoadFinished, "load,finished", void);
+DECLARE_EWK_VIEW_CALLBACK(LoadProgress, "load,progress", double);
+DECLARE_EWK_VIEW_CALLBACK(ProvisionalLoadFailed, "load,provisional,failed", Ewk_Error);
+DECLARE_EWK_VIEW_CALLBACK(ProvisionalLoadRedirect, "load,provisional,redirect", void);
+DECLARE_EWK_VIEW_CALLBACK(ProvisionalLoadStarted, "load,provisional,started", void);
+DECLARE_EWK_VIEW_CALLBACK(NavigationPolicyDecision, "policy,decision,navigation", Ewk_Navigation_Policy_Decision);
+DECLARE_EWK_VIEW_CALLBACK(NewWindowPolicyDecision, "policy,decision,new,window", Ewk_Navigation_Policy_Decision);
+DECLARE_EWK_VIEW_CALLBACK(ResourceLoadStarted, "resource,request,new", Ewk_Resource_Request);
+DECLARE_EWK_VIEW_CALLBACK(ResourceLoadResponse, "resource,request,response", Ewk_Resource_Load_Response);
+DECLARE_EWK_VIEW_CALLBACK(ResourceLoadFailed, "resource,request,failed", Ewk_Resource_Load_Error);
+DECLARE_EWK_VIEW_CALLBACK(ResourceLoadFinished, "resource,request,finished", Ewk_Resource);
+DECLARE_EWK_VIEW_CALLBACK(ResourceRequestSent, "resource,request,sent", Ewk_Resource_Request);
+DECLARE_EWK_VIEW_CALLBACK(TextFound, "text,found", unsigned);
+DECLARE_EWK_VIEW_CALLBACK(TitleChange, "title,changed", char);
+DECLARE_EWK_VIEW_CALLBACK(TooltipTextUnset, "tooltip,text,unset", void);
+DECLARE_EWK_VIEW_CALLBACK(TooltipTextSet, "tooltip,text,set", char);
+DECLARE_EWK_VIEW_CALLBACK(URLChanged, "url,changed", char);
+DECLARE_EWK_VIEW_CALLBACK(WebProcessCrashed, "webprocess,crashed", bool);
+#if ENABLE(WEB_INTENTS)
+DECLARE_EWK_VIEW_CALLBACK(IntentRequest, "intent,request,new", Ewk_Intent);
+#endif
+#if ENABLE(WEB_INTENTS_TAG)
+DECLARE_EWK_VIEW_CALLBACK(IntentServiceRegistration, "intent,service,register", Ewk_Intent_Service);
+#endif
+
+}
+
+#endif // #ifndef EwkViewCallbacks_h
diff --git a/Source/WebKit2/UIProcess/API/efl/EwkViewImpl.cpp b/Source/WebKit2/UIProcess/API/efl/EwkViewImpl.cpp
new file mode 100644
index 000000000..42166c98c
--- /dev/null
+++ b/Source/WebKit2/UIProcess/API/efl/EwkViewImpl.cpp
@@ -0,0 +1,834 @@
+/*
+   Copyright (C) 2011 Samsung Electronics
+   Copyright (C) 2012 Intel Corporation. All rights reserved.
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#include "config.h"
+#include "EwkViewImpl.h"
+
+#include "EflScreenUtilities.h"
+#include "FindClientEfl.h"
+#include "FormClientEfl.h"
+#include "InputMethodContextEfl.h"
+#include "LayerTreeCoordinatorProxy.h"
+#include "LayerTreeRenderer.h"
+#include "PageClientBase.h"
+#include "PageClientDefaultImpl.h"
+#include "PageClientLegacyImpl.h"
+#include "PageLoadClientEfl.h"
+#include "PagePolicyClientEfl.h"
+#include "PageUIClientEfl.h"
+#include "ResourceLoadClientEfl.h"
+#include "WKString.h"
+#include "WebContext.h"
+#include "WebPageGroup.h"
+#include "WebPageProxy.h"
+#include "WebPopupMenuProxyEfl.h"
+#include "WebPreferences.h"
+#include "ewk_back_forward_list_private.h"
+#include "ewk_color_picker_private.h"
+#include "ewk_context_private.h"
+#include "ewk_favicon_database_private.h"
+#include "ewk_popup_menu_item_private.h"
+#include "ewk_popup_menu_private.h"
+#include "ewk_private.h"
+#include "ewk_settings_private.h"
+#include "ewk_view.h"
+#include "ewk_view_private.h"
+#include <Ecore_Evas.h>
+#include <Ecore_X.h>
+#include <Edje.h>
+#include <WebCore/Cursor.h>
+
+
+#if ENABLE(FULLSCREEN_API)
+#include "WebFullScreenManagerProxy.h"
+#endif
+
+#if USE(ACCELERATED_COMPOSITING)
+#include <Evas_GL.h>
+#endif
+
+using namespace EwkViewCallbacks;
+using namespace WebCore;
+using namespace WebKit;
+
+static const int defaultCursorSize = 16;
+
+typedef HashMap<WKPageRef, Evas_Object*> PageViewMap;
+
+static inline PageViewMap& pageViewMap()
+{
+    DEFINE_STATIC_LOCAL(PageViewMap, map, ());
+    return map;
+}
+
+void EwkViewImpl::addToPageViewMap(EwkViewImpl* viewImpl)
+{
+    PageViewMap::AddResult result = pageViewMap().add(viewImpl->wkPage(), viewImpl->view());
+    ASSERT_UNUSED(result, result.isNewEntry);
+}
+
+void EwkViewImpl::removeFromPageViewMap(EwkViewImpl* viewImpl)
+{
+    ASSERT(pageViewMap().contains(viewImpl->wkPage()));
+    pageViewMap().remove(viewImpl->wkPage());
+}
+
+const Evas_Object* EwkViewImpl::viewFromPageViewMap(const WKPageRef page)
+{
+    ASSERT(page);
+
+    return pageViewMap().get(page);
+}
+
+EwkViewImpl::EwkViewImpl(Evas_Object* view, PassRefPtr<EwkContext> context, PassRefPtr<WebPageGroup> pageGroup, ViewBehavior behavior)
+    : m_view(view)
+    , m_context(context)
+    , m_pageClient(behavior == DefaultBehavior ? PageClientDefaultImpl::create(this) : PageClientLegacyImpl::create(this))
+    , m_pageProxy(toImpl(m_context->wkContext())->createWebPage(m_pageClient.get(), pageGroup.get()))
+    , m_pageLoadClient(PageLoadClientEfl::create(this))
+    , m_pagePolicyClient(PagePolicyClientEfl::create(this))
+    , m_pageUIClient(PageUIClientEfl::create(this))
+    , m_resourceLoadClient(ResourceLoadClientEfl::create(this))
+    , m_findClient(FindClientEfl::create(this))
+    , m_formClient(FormClientEfl::create(this))
+    , m_backForwardList(Ewk_Back_Forward_List::create(toAPI(m_pageProxy->backForwardList())))
+#if USE(TILED_BACKING_STORE)
+    , m_scaleFactor(1)
+#endif
+    , m_settings(Ewk_Settings::create(this))
+    , m_cursorGroup(0)
+    , m_mouseEventsEnabled(false)
+#if ENABLE(TOUCH_EVENTS)
+    , m_touchEventsEnabled(false)
+#endif
+    , m_displayTimer(this, &EwkViewImpl::displayTimerFired)
+    , m_inputMethodContext(InputMethodContextEfl::create(this, smartData()->base.evas))
+{
+    ASSERT(m_view);
+    ASSERT(m_context);
+    ASSERT(m_pageProxy);
+
+#if USE(COORDINATED_GRAPHICS)
+    m_pageProxy->pageGroup()->preferences()->setAcceleratedCompositingEnabled(true);
+    m_pageProxy->pageGroup()->preferences()->setForceCompositingMode(true);
+#if ENABLE(WEBGL)
+    m_pageProxy->pageGroup()->preferences()->setWebGLEnabled(true);
+#endif
+    if (behavior == DefaultBehavior)
+        m_pageProxy->setUseFixedLayout(true);
+#endif
+
+    m_pageProxy->initializeWebPage();
+
+#if ENABLE(FULLSCREEN_API)
+    m_pageProxy->fullScreenManager()->setWebView(m_view);
+    m_pageProxy->pageGroup()->preferences()->setFullScreenEnabled(true);
+#endif
+
+    // Enable mouse events by default
+    setMouseEventsEnabled(true);
+
+    // Listen for favicon changes.
+    Ewk_Favicon_Database* iconDatabase = m_context->faviconDatabase();
+    ASSERT(iconDatabase);
+
+    iconDatabase->watchChanges(IconChangeCallbackData(EwkViewImpl::onFaviconChanged, this));
+
+    EwkViewImpl::addToPageViewMap(this);
+}
+
+EwkViewImpl::~EwkViewImpl()
+{
+    m_pageProxy->close();
+
+    // Unregister icon change callback.
+    Ewk_Favicon_Database* iconDatabase = m_context->faviconDatabase();
+    ASSERT(iconDatabase);
+
+    iconDatabase->unwatchChanges(EwkViewImpl::onFaviconChanged);
+
+    EwkViewImpl::removeFromPageViewMap(this);
+}
+
+Ewk_View_Smart_Data* EwkViewImpl::smartData() const
+{
+    return static_cast<Ewk_View_Smart_Data*>(evas_object_smart_data_get(m_view));
+}
+
+EwkViewImpl* EwkViewImpl::fromEvasObject(const Evas_Object* view)
+{
+    ASSERT(view);
+    Ewk_View_Smart_Data* sd = static_cast<Ewk_View_Smart_Data*>(evas_object_smart_data_get(view));
+    ASSERT(sd);
+    ASSERT(sd->priv);
+    return sd->priv;
+}
+
+/**
+ * @internal
+ * Retrieves the internal WKPage for this view.
+ */
+WKPageRef EwkViewImpl::wkPage()
+{
+    return toAPI(m_pageProxy.get());
+}
+
+void EwkViewImpl::setCursor(const Cursor& cursor)
+{
+    const char* group = cursor.platformCursor();
+    if (!group || group == m_cursorGroup)
+        return;
+
+    m_cursorGroup = group;
+    Ewk_View_Smart_Data* sd = smartData();
+    RefPtr<Evas_Object> cursorObject = adoptRef(edje_object_add(sd->base.evas));
+
+    Ecore_Evas* ecoreEvas = ecore_evas_ecore_evas_get(sd->base.evas);
+    if (!m_theme || !edje_object_file_set(cursorObject.get(), m_theme, group)) {
+        ecore_evas_object_cursor_set(ecoreEvas, 0, 0, 0, 0);
+#ifdef HAVE_ECORE_X
+        if (WebCore::isUsingEcoreX(sd->base.evas))
+            WebCore::applyFallbackCursor(ecoreEvas, group);
+#endif
+        return;
+    }
+
+    // Set cursor size.
+    Evas_Coord width, height;
+    edje_object_size_min_get(cursorObject.get(), &width, &height);
+    if (width <= 0 || height <= 0)
+        edje_object_size_min_calc(cursorObject.get(), &width, &height);
+    if (width <= 0 || height <= 0) {
+        width = defaultCursorSize;
+        height = defaultCursorSize;
+    }
+    evas_object_resize(cursorObject.get(), width, height);
+
+    // Get cursor hot spot.
+    const char* data;
+    int hotspotX = 0;
+    data = edje_object_data_get(cursorObject.get(), "hot.x");
+    if (data)
+        hotspotX = atoi(data);
+
+    int hotspotY = 0;
+    data = edje_object_data_get(cursorObject.get(), "hot.y");
+    if (data)
+        hotspotY = atoi(data);
+
+    // ecore_evas takes care of freeing the cursor object.
+    ecore_evas_object_cursor_set(ecoreEvas, cursorObject.release().leakRef(), EVAS_LAYER_MAX, hotspotX, hotspotY);
+}
+
+AffineTransform EwkViewImpl::transformFromScene() const
+{
+    AffineTransform transform;
+
+#if USE(TILED_BACKING_STORE)
+    transform.translate(m_scrollPosition.x(), m_scrollPosition.y());
+    transform.scale(1 / m_scaleFactor);
+#endif
+
+    Ewk_View_Smart_Data* sd = smartData();
+    transform.translate(-sd->view.x, -sd->view.y);
+
+    return transform;
+}
+
+AffineTransform EwkViewImpl::transformToScene() const
+{
+    return transformFromScene().inverse();
+}
+
+AffineTransform EwkViewImpl::transformToScreen() const
+{
+    AffineTransform transform;
+
+    int windowGlobalX = 0;
+    int windowGlobalY = 0;
+
+    Ewk_View_Smart_Data* sd = smartData();
+
+#ifdef HAVE_ECORE_X
+    Ecore_Evas* ecoreEvas = ecore_evas_ecore_evas_get(sd->base.evas);
+    Ecore_X_Window window = ecore_evas_software_x11_window_get(ecoreEvas); // Returns 0 if none.
+
+    int x, y; // x, y are relative to parent (in a reparenting window manager).
+    while (window) {
+        ecore_x_window_geometry_get(window, &x, &y, 0, 0);
+        windowGlobalX += x;
+        windowGlobalY += y;
+        window = ecore_x_window_parent_get(window);
+    }
+#endif
+
+    transform.translate(-sd->view.x, -sd->view.y);
+    transform.translate(windowGlobalX, windowGlobalY);
+
+    return transform;
+}
+
+void EwkViewImpl::displayTimerFired(Timer<EwkViewImpl>*)
+{
+#if USE(COORDINATED_GRAPHICS)
+    Ewk_View_Smart_Data* sd = smartData();
+
+    evas_gl_make_current(evasGL(), evasGLSurface(), evasGLContext());
+
+    // We are supposed to clip to the actual viewport, nothing less.
+    IntRect viewport(sd->view.x, sd->view.y, sd->view.w, sd->view.h);
+
+    LayerTreeRenderer* renderer = page()->drawingArea()->layerTreeCoordinatorProxy()->layerTreeRenderer();
+    renderer->setActive(true);
+    renderer->syncRemoteContent();
+
+    renderer->paintToCurrentGLContext(transformToScene().toTransformationMatrix(), /* opacity */ 1, viewport);
+
+    evas_object_image_data_update_add(sd->image, viewport.x(), viewport.y(), viewport.width(), viewport.height());
+#endif
+}
+
+void EwkViewImpl::update(const IntRect& rect)
+{
+#if USE(COORDINATED_GRAPHICS)
+    // Coordinated graphices needs to schedule an full update, not
+    // repainting of a region. Update in the event loop.
+    UNUSED_PARAM(rect);
+    if (!m_displayTimer.isActive())
+        m_displayTimer.startOneShot(0);
+#else
+    Ewk_View_Smart_Data* sd = smartData();
+    if (!sd->image)
+        return;
+
+    evas_object_image_data_update_add(sd->image, rect.x(), rect.y(), rect.width(), rect.height());
+#endif
+}
+
+#if ENABLE(FULLSCREEN_API)
+/**
+ * @internal
+ * Calls fullscreen_enter callback or falls back to default behavior and enables fullscreen mode.
+ */
+void EwkViewImpl::enterFullScreen()
+{
+    Ewk_View_Smart_Data* sd = smartData();
+
+    if (!sd->api->fullscreen_enter || !sd->api->fullscreen_enter(sd)) {
+        Ecore_Evas* ecoreEvas = ecore_evas_ecore_evas_get(sd->base.evas);
+        ecore_evas_fullscreen_set(ecoreEvas, true);
+    }
+}
+
+/**
+ * @internal
+ * Calls fullscreen_exit callback or falls back to default behavior and disables fullscreen mode.
+ */
+void EwkViewImpl::exitFullScreen()
+{
+    Ewk_View_Smart_Data* sd = smartData();
+
+    if (!sd->api->fullscreen_exit || !sd->api->fullscreen_exit(sd)) {
+        Ecore_Evas* ecoreEvas = ecore_evas_ecore_evas_get(sd->base.evas);
+        ecore_evas_fullscreen_set(ecoreEvas, false);
+    }
+}
+#endif
+
+void EwkViewImpl::setImageData(void* imageData, const IntSize& size)
+{
+    Ewk_View_Smart_Data* sd = smartData();
+    if (!imageData || !sd->image)
+        return;
+
+    evas_object_resize(sd->image, size.width(), size.height());
+    evas_object_image_size_set(sd->image, size.width(), size.height());
+    evas_object_image_data_copy_set(sd->image, imageData);
+}
+
+#if USE(TILED_BACKING_STORE)
+void EwkViewImpl::informLoadCommitted()
+{
+    m_pageClient->didCommitLoad();
+}
+#endif
+
+IntSize EwkViewImpl::size() const
+{
+    int width, height;
+    evas_object_geometry_get(m_view, 0, 0, &width, &height);
+    return IntSize(width, height);
+}
+
+bool EwkViewImpl::isFocused() const
+{
+    return evas_object_focus_get(m_view);
+}
+
+bool EwkViewImpl::isVisible() const
+{
+    return evas_object_visible_get(m_view);
+}
+
+const char* EwkViewImpl::title() const
+{
+    m_title = m_pageProxy->pageTitle().utf8().data();
+
+    return m_title;
+}
+
+/**
+ * @internal
+ * This function may return @c NULL.
+ */
+InputMethodContextEfl* EwkViewImpl::inputMethodContext()
+{
+    return m_inputMethodContext.get();
+}
+
+const char* EwkViewImpl::themePath() const
+{
+    return m_theme;
+}
+
+void EwkViewImpl::setThemePath(const char* theme)
+{
+    if (m_theme != theme) {
+        m_theme = theme;
+        m_pageProxy->setThemePath(theme);
+    }
+}
+
+const char* EwkViewImpl::customTextEncodingName() const
+{
+    String customEncoding = m_pageProxy->customTextEncodingName();
+    if (customEncoding.isEmpty())
+        return 0;
+
+    m_customEncoding = customEncoding.utf8().data();
+
+    return m_customEncoding;
+}
+
+void EwkViewImpl::setCustomTextEncodingName(const String& encoding)
+{
+    m_pageProxy->setCustomTextEncodingName(encoding);
+}
+
+void EwkViewImpl::setMouseEventsEnabled(bool enabled)
+{
+    if (m_mouseEventsEnabled == enabled)
+        return;
+
+    m_mouseEventsEnabled = enabled;
+    if (enabled) {
+        Ewk_View_Smart_Data* sd = smartData();
+        evas_object_event_callback_add(m_view, EVAS_CALLBACK_MOUSE_DOWN, onMouseDown, sd);
+        evas_object_event_callback_add(m_view, EVAS_CALLBACK_MOUSE_UP, onMouseUp, sd);
+        evas_object_event_callback_add(m_view, EVAS_CALLBACK_MOUSE_MOVE, onMouseMove, sd);
+    } else {
+        evas_object_event_callback_del(m_view, EVAS_CALLBACK_MOUSE_DOWN, onMouseDown);
+        evas_object_event_callback_del(m_view, EVAS_CALLBACK_MOUSE_UP, onMouseUp);
+        evas_object_event_callback_del(m_view, EVAS_CALLBACK_MOUSE_MOVE, onMouseMove);
+    }
+}
+
+#if ENABLE(TOUCH_EVENTS)
+void EwkViewImpl::setTouchEventsEnabled(bool enabled)
+{
+    if (m_touchEventsEnabled == enabled)
+        return;
+
+    m_touchEventsEnabled = enabled;
+
+    if (enabled) {
+        // FIXME: We have to connect touch callbacks with mouse and multi events
+        // because the Evas creates mouse events for first touch and multi events
+        // for second and third touches. Below codes should be fixed when the Evas
+        // supports the touch events.
+        // See https://bugs.webkit.org/show_bug.cgi?id=97785 for details.
+        Ewk_View_Smart_Data* sd = smartData();
+        evas_object_event_callback_add(m_view, EVAS_CALLBACK_MOUSE_DOWN, onTouchDown, sd);
+        evas_object_event_callback_add(m_view, EVAS_CALLBACK_MOUSE_UP, onTouchUp, sd);
+        evas_object_event_callback_add(m_view, EVAS_CALLBACK_MOUSE_MOVE, onTouchMove, sd);
+        evas_object_event_callback_add(m_view, EVAS_CALLBACK_MULTI_DOWN, onTouchDown, sd);
+        evas_object_event_callback_add(m_view, EVAS_CALLBACK_MULTI_UP, onTouchUp, sd);
+        evas_object_event_callback_add(m_view, EVAS_CALLBACK_MULTI_MOVE, onTouchMove, sd);
+    } else {
+        evas_object_event_callback_del(m_view, EVAS_CALLBACK_MOUSE_DOWN, onTouchDown);
+        evas_object_event_callback_del(m_view, EVAS_CALLBACK_MOUSE_UP, onTouchUp);
+        evas_object_event_callback_del(m_view, EVAS_CALLBACK_MOUSE_MOVE, onTouchMove);
+        evas_object_event_callback_del(m_view, EVAS_CALLBACK_MULTI_DOWN, onTouchDown);
+        evas_object_event_callback_del(m_view, EVAS_CALLBACK_MULTI_UP, onTouchUp);
+        evas_object_event_callback_del(m_view, EVAS_CALLBACK_MULTI_MOVE, onTouchMove);
+    }
+}
+#endif
+
+/**
+ * @internal
+ * Update the view's favicon and emits a "icon,changed" signal if it has
+ * changed.
+ *
+ * This function is called whenever the URL has changed or when the icon for
+ * the current page URL has changed.
+ */
+void EwkViewImpl::informIconChange()
+{
+    Ewk_Favicon_Database* iconDatabase = m_context->faviconDatabase();
+    ASSERT(iconDatabase);
+
+    m_faviconURL = ewk_favicon_database_icon_url_get(iconDatabase, m_url);
+    smartCallback<IconChanged>().call();
+}
+
+#if USE(ACCELERATED_COMPOSITING)
+bool EwkViewImpl::createGLSurface(const IntSize& viewSize)
+{
+    if (!m_evasGL) {
+        Evas* evas = evas_object_evas_get(m_view);
+        m_evasGL = adoptPtr(evas_gl_new(evas));
+        if (!m_evasGL)
+            return false;
+    }
+
+    if (!m_evasGLContext) {
+        m_evasGLContext = EvasGLContext::create(evasGL());
+        if (!m_evasGLContext) {
+            WARN("Failed to create GLContext.");
+            return false;
+        }
+    }
+
+    Ewk_View_Smart_Data* sd = smartData();
+
+    Evas_GL_Config evasGLConfig = {
+        EVAS_GL_RGBA_8888,
+        EVAS_GL_DEPTH_BIT_8,
+        EVAS_GL_STENCIL_NONE,
+        EVAS_GL_OPTIONS_NONE,
+        EVAS_GL_MULTISAMPLE_NONE
+    };
+
+    ASSERT(!m_evasGLSurface);
+    m_evasGLSurface = EvasGLSurface::create(evasGL(), &evasGLConfig, viewSize);
+    if (!m_evasGLSurface)
+        return false;
+
+    Evas_Native_Surface nativeSurface;
+    evas_gl_native_surface_get(evasGL(), evasGLSurface(), &nativeSurface);
+    evas_object_image_native_surface_set(sd->image, &nativeSurface);
+
+    evas_gl_make_current(evasGL(), evasGLSurface(), evasGLContext());
+
+    Evas_GL_API* gl = evas_gl_api_get(evasGL());
+    gl->glViewport(0, 0, viewSize.width() + sd->view.x, viewSize.height() + sd->view.y);
+
+    return true;
+}
+
+bool EwkViewImpl::enterAcceleratedCompositingMode()
+{
+    if (!m_evasGLSurface) {
+        if (!createGLSurface(size())) {
+            WARN("Failed to create GLSurface.");
+            return false;
+        }
+    }
+
+    page()->drawingArea()->layerTreeCoordinatorProxy()->layerTreeRenderer()->setActive(true);
+    return true;
+}
+
+bool EwkViewImpl::exitAcceleratedCompositingMode()
+{
+    return true;
+}
+#endif
+
+#if ENABLE(INPUT_TYPE_COLOR)
+/**
+ * @internal
+ * Requests to show external color picker.
+ */
+void EwkViewImpl::requestColorPicker(WKColorPickerResultListenerRef listener, const WebCore::Color& color)
+{
+    Ewk_View_Smart_Data* sd = smartData();
+    EINA_SAFETY_ON_NULL_RETURN(sd->api->input_picker_color_request);
+
+    if (!sd->api->input_picker_color_request)
+        return;
+
+    if (m_colorPicker)
+        dismissColorPicker();
+
+    m_colorPicker = Ewk_Color_Picker::create(listener, color);
+
+    sd->api->input_picker_color_request(sd, m_colorPicker.get());
+}
+
+/**
+ * @internal
+ * Requests to hide external color picker.
+ */
+void EwkViewImpl::dismissColorPicker()
+{
+    if (!m_colorPicker)
+        return;
+
+    Ewk_View_Smart_Data* sd = smartData();
+    EINA_SAFETY_ON_NULL_RETURN(sd->api->input_picker_color_dismiss);
+
+    if (sd->api->input_picker_color_dismiss)
+        sd->api->input_picker_color_dismiss(sd);
+
+    m_colorPicker.clear();
+}
+#endif
+
+void EwkViewImpl::informContentsSizeChange(const IntSize& size)
+{
+#if USE(COORDINATED_GRAPHICS)
+    m_pageClient->didChangeContentsSize(size);
+#else
+    UNUSED_PARAM(size);
+#endif
+}
+
+COMPILE_ASSERT_MATCHING_ENUM(EWK_TEXT_DIRECTION_RIGHT_TO_LEFT, RTL);
+COMPILE_ASSERT_MATCHING_ENUM(EWK_TEXT_DIRECTION_LEFT_TO_RIGHT, LTR);
+
+void EwkViewImpl::requestPopupMenu(WebPopupMenuProxyEfl* popupMenuProxy, const IntRect& rect, TextDirection textDirection, double pageScaleFactor, const Vector<WebPopupItem>& items, int32_t selectedIndex)
+{
+    Ewk_View_Smart_Data* sd = smartData();
+    ASSERT(sd->api);
+
+    ASSERT(popupMenuProxy);
+
+    if (!sd->api->popup_menu_show)
+        return;
+
+    if (m_popupMenu)
+        closePopupMenu();
+
+    m_popupMenu = Ewk_Popup_Menu::create(this, popupMenuProxy, items, selectedIndex);
+
+    sd->api->popup_menu_show(sd, rect, static_cast<Ewk_Text_Direction>(textDirection), pageScaleFactor, m_popupMenu.get());
+}
+
+void EwkViewImpl::closePopupMenu()
+{
+    if (!m_popupMenu)
+        return;
+
+    Ewk_View_Smart_Data* sd = smartData();
+    ASSERT(sd->api);
+
+    if (sd->api->popup_menu_hide)
+        sd->api->popup_menu_hide(sd);
+
+    m_popupMenu.clear();
+}
+
+/**
+ * @internal
+ * Calls a smart member function for javascript alert().
+ */
+void EwkViewImpl::requestJSAlertPopup(const WKEinaSharedString& message)
+{
+    Ewk_View_Smart_Data* sd = smartData();
+    ASSERT(sd->api);
+
+    if (!sd->api->run_javascript_alert)
+        return;
+
+    sd->api->run_javascript_alert(sd, message);
+}
+
+/**
+ * @internal
+ * Calls a smart member function for javascript confirm() and returns a value from the function. Returns false by default.
+ */
+bool EwkViewImpl::requestJSConfirmPopup(const WKEinaSharedString& message)
+{
+    Ewk_View_Smart_Data* sd = smartData();
+    ASSERT(sd->api);
+
+    if (!sd->api->run_javascript_confirm)
+        return false;
+
+    return sd->api->run_javascript_confirm(sd, message);
+}
+
+/**
+ * @internal
+ * Calls a smart member function for javascript prompt() and returns a value from the function. Returns null string by default.
+ */
+WKEinaSharedString EwkViewImpl::requestJSPromptPopup(const WKEinaSharedString& message, const WKEinaSharedString& defaultValue)
+{
+    Ewk_View_Smart_Data* sd = smartData();
+    ASSERT(sd->api);
+
+    if (!sd->api->run_javascript_prompt)
+        return WKEinaSharedString();
+
+    return WKEinaSharedString::adopt(sd->api->run_javascript_prompt(sd, message, defaultValue));
+}
+
+#if ENABLE(SQL_DATABASE)
+/**
+ * @internal
+ * Calls exceeded_database_quota callback or falls back to default behavior returns default database quota.
+ */
+unsigned long long EwkViewImpl::informDatabaseQuotaReached(const String& databaseName, const String& displayName, unsigned long long currentQuota, unsigned long long currentOriginUsage, unsigned long long currentDatabaseUsage, unsigned long long expectedUsage)
+{
+    Ewk_View_Smart_Data* sd = smartData();
+    ASSERT(sd->api);
+
+    static const unsigned long long defaultQuota = 5 * 1024 * 1204; // 5 MB
+    if (sd->api->exceeded_database_quota)
+        return sd->api->exceeded_database_quota(sd, databaseName.utf8().data(), displayName.utf8().data(), currentQuota, currentOriginUsage, currentDatabaseUsage, expectedUsage);
+
+    return defaultQuota;
+}
+#endif
+
+/**
+ * @internal
+ * The url of view was changed by the frame loader.
+ *
+ * Emits signal: "url,changed" with pointer to new url string.
+ */
+void EwkViewImpl::informURLChange()
+{
+    String activeURL = m_pageProxy->activeURL();
+    if (activeURL.isEmpty())
+        return;
+
+    CString rawActiveURL = activeURL.utf8();
+    if (m_url == rawActiveURL.data())
+        return;
+
+    m_url = rawActiveURL.data();
+    smartCallback<URLChanged>().call(m_url);
+
+    // Update the view's favicon.
+    informIconChange();
+}
+
+WKPageRef EwkViewImpl::createNewPage()
+{
+    Evas_Object* newEwkView = 0;
+    smartCallback<CreateWindow>().call(&newEwkView);
+
+    if (!newEwkView)
+        return 0;
+
+    EwkViewImpl* newViewImpl = EwkViewImpl::fromEvasObject(newEwkView);
+    ASSERT(newViewImpl);
+
+    return static_cast<WKPageRef>(WKRetain(newViewImpl->page()));
+}
+
+void EwkViewImpl::closePage()
+{
+    smartCallback<CloseWindow>().call();
+}
+
+void EwkViewImpl::onMouseDown(void* data, Evas*, Evas_Object*, void* eventInfo)
+{
+    Evas_Event_Mouse_Down* downEvent = static_cast<Evas_Event_Mouse_Down*>(eventInfo);
+    Ewk_View_Smart_Data* sd = static_cast<Ewk_View_Smart_Data*>(data);
+    EINA_SAFETY_ON_NULL_RETURN(sd->api);
+    EINA_SAFETY_ON_NULL_RETURN(sd->api->mouse_down);
+    sd->api->mouse_down(sd, downEvent);
+}
+
+void EwkViewImpl::onMouseUp(void* data, Evas*, Evas_Object*, void* eventInfo)
+{
+    Evas_Event_Mouse_Up* upEvent = static_cast<Evas_Event_Mouse_Up*>(eventInfo);
+    Ewk_View_Smart_Data* sd = static_cast<Ewk_View_Smart_Data*>(data);
+    EINA_SAFETY_ON_NULL_RETURN(sd->api);
+    EINA_SAFETY_ON_NULL_RETURN(sd->api->mouse_up);
+    sd->api->mouse_up(sd, upEvent);
+}
+
+void EwkViewImpl::onMouseMove(void* data, Evas*, Evas_Object*, void* eventInfo)
+{
+    Evas_Event_Mouse_Move* moveEvent = static_cast<Evas_Event_Mouse_Move*>(eventInfo);
+    Ewk_View_Smart_Data* sd = static_cast<Ewk_View_Smart_Data*>(data);
+    EINA_SAFETY_ON_NULL_RETURN(sd->api);
+    EINA_SAFETY_ON_NULL_RETURN(sd->api->mouse_move);
+    sd->api->mouse_move(sd, moveEvent);
+}
+
+#if ENABLE(TOUCH_EVENTS)
+void EwkViewImpl::feedTouchEvents(Ewk_Touch_Event_Type type)
+{
+    Ewk_View_Smart_Data* sd = smartData();
+
+    unsigned count = evas_touch_point_list_count(sd->base.evas);
+    if (!count)
+        return;
+
+    Eina_List* points = 0;
+    for (unsigned i = 0; i < count; ++i) {
+        Ewk_Touch_Point* point = new Ewk_Touch_Point;
+        point->id = evas_touch_point_list_nth_id_get(sd->base.evas, i);
+        evas_touch_point_list_nth_xy_get(sd->base.evas, i, &point->x, &point->y);
+        point->state = evas_touch_point_list_nth_state_get(sd->base.evas, i);
+        points = eina_list_append(points, point);
+    }
+
+    ewk_view_feed_touch_event(m_view, type, points, evas_key_modifier_get(sd->base.evas));
+
+    void* data;
+    EINA_LIST_FREE(points, data)
+        delete static_cast<Ewk_Touch_Point*>(data);
+}
+
+void EwkViewImpl::onTouchDown(void* /* data */, Evas* /* canvas */, Evas_Object* ewkView, void* /* eventInfo */)
+{
+    EwkViewImpl* viewImpl = EwkViewImpl::fromEvasObject(ewkView);
+    viewImpl->feedTouchEvents(EWK_TOUCH_START);
+}
+
+void EwkViewImpl::onTouchUp(void* /* data */, Evas* /* canvas */, Evas_Object* ewkView, void* /* eventInfo */)
+{
+    EwkViewImpl* viewImpl = EwkViewImpl::fromEvasObject(ewkView);
+    viewImpl->feedTouchEvents(EWK_TOUCH_END);
+}
+
+void EwkViewImpl::onTouchMove(void* /* data */, Evas* /* canvas */, Evas_Object* ewkView, void* /* eventInfo */)
+{
+    EwkViewImpl* viewImpl = EwkViewImpl::fromEvasObject(ewkView);
+    viewImpl->feedTouchEvents(EWK_TOUCH_MOVE);
+}
+#endif
+
+void EwkViewImpl::onFaviconChanged(const char* pageURL, void* eventInfo)
+{
+    EwkViewImpl* viewImpl = static_cast<EwkViewImpl*>(eventInfo);
+
+    if (!viewImpl->url() || strcasecmp(viewImpl->url(), pageURL))
+        return;
+
+    viewImpl->informIconChange();
+}
diff --git a/Source/WebKit2/UIProcess/API/efl/EwkViewImpl.h b/Source/WebKit2/UIProcess/API/efl/EwkViewImpl.h
new file mode 100644
index 000000000..918fe22f9
--- /dev/null
+++ b/Source/WebKit2/UIProcess/API/efl/EwkViewImpl.h
@@ -0,0 +1,255 @@
+/*
+   Copyright (C) 2011 Samsung Electronics
+   Copyright (C) 2012 Intel Corporation. All rights reserved.
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#ifndef EwkViewImpl_h
+#define EwkViewImpl_h
+
+#include "EwkViewCallbacks.h"
+#include "RefPtrEfl.h"
+#include "WKEinaSharedString.h"
+#include "WKRetainPtr.h"
+#include <Evas.h>
+#include <WebCore/IntRect.h>
+#include <WebCore/TextDirection.h>
+#include <WebCore/Timer.h>
+#include <WebKit2/WKBase.h>
+#include <wtf/HashMap.h>
+#include <wtf/OwnPtr.h>
+#include <wtf/RefPtr.h>
+#include <wtf/text/WTFString.h>
+
+#if ENABLE(TOUCH_EVENTS)
+#include "ewk_touch.h"
+#endif
+
+#if USE(ACCELERATED_COMPOSITING)
+#include "EvasGLContext.h"
+#include "EvasGLSurface.h"
+#endif
+
+namespace WebKit {
+class FindClientEfl;
+class FormClientEfl;
+class InputMethodContextEfl;
+class PageClientBase;
+class PageLoadClientEfl;
+class PagePolicyClientEfl;
+class PageUIClientEfl;
+class ResourceLoadClientEfl;
+class WebPageGroup;
+class WebPageProxy;
+class WebPopupItem;
+class WebPopupMenuProxyEfl;
+}
+
+namespace WebCore {
+class AffineTransform;
+class Color;
+class Cursor;
+class IntSize;
+}
+
+class EwkContext;
+
+class Ewk_Back_Forward_List;
+class Ewk_Color_Picker;
+class Ewk_Error;
+class Ewk_Form_Submission_Request;
+class Ewk_Intent;
+class Ewk_Intent_Service;
+class Ewk_Resource;
+class Ewk_Popup_Menu;
+class Ewk_Settings;
+
+#if USE(ACCELERATED_COMPOSITING)
+typedef struct _Evas_GL_Context Evas_GL_Context;
+typedef struct _Evas_GL_Surface Evas_GL_Surface;
+#endif
+
+typedef struct Ewk_View_Smart_Data Ewk_View_Smart_Data;
+
+class EwkViewImpl {
+public:
+
+    enum ViewBehavior {
+        LegacyBehavior,
+        DefaultBehavior
+    };
+    EwkViewImpl(Evas_Object* view, PassRefPtr<EwkContext> context, PassRefPtr<WebKit::WebPageGroup> pageGroup, ViewBehavior);
+    ~EwkViewImpl();
+
+    static EwkViewImpl* fromEvasObject(const Evas_Object* view);
+
+    Evas_Object* view() { return m_view; }
+    WKPageRef wkPage();
+    WebKit::WebPageProxy* page() { return m_pageProxy.get(); }
+    EwkContext* ewkContext() { return m_context.get(); }
+    Ewk_Settings* settings() { return m_settings.get(); }
+    Ewk_Back_Forward_List* backForwardList() { return m_backForwardList.get(); }
+
+    WebCore::IntSize size() const;
+    bool isFocused() const;
+    bool isVisible() const;
+
+    WebCore::AffineTransform transformToScene() const;
+    WebCore::AffineTransform transformFromScene() const;
+    WebCore::AffineTransform transformToScreen() const;
+
+    const char* url() const { return m_url; }
+    const char* faviconURL() const { return m_faviconURL; }
+    const char* title() const;
+    WebKit::InputMethodContextEfl* inputMethodContext();
+
+    const char* themePath() const;
+    void setThemePath(const char* theme);
+    const char* customTextEncodingName() const;
+    void setCustomTextEncodingName(const String& encoding);
+
+    bool mouseEventsEnabled() const { return m_mouseEventsEnabled; }
+    void setMouseEventsEnabled(bool enabled);
+#if ENABLE(TOUCH_EVENTS)
+    bool touchEventsEnabled() const { return m_touchEventsEnabled; }
+    void setTouchEventsEnabled(bool enabled);
+#endif
+
+    void setCursor(const WebCore::Cursor& cursor);
+    void setImageData(void* imageData, const WebCore::IntSize& size);
+
+    void update(const WebCore::IntRect& rect = WebCore::IntRect());
+
+    static void addToPageViewMap(EwkViewImpl* viewImpl);
+    static void removeFromPageViewMap(EwkViewImpl* viewImpl);
+    static const Evas_Object* viewFromPageViewMap(const WKPageRef);
+
+#if ENABLE(FULLSCREEN_API)
+    void enterFullScreen();
+    void exitFullScreen();
+#endif
+
+#if USE(ACCELERATED_COMPOSITING)
+    bool createGLSurface(const WebCore::IntSize& viewSize);
+    bool enterAcceleratedCompositingMode();
+    bool exitAcceleratedCompositingMode();
+#endif
+
+#if ENABLE(INPUT_TYPE_COLOR)
+    void requestColorPicker(WKColorPickerResultListenerRef listener, const WebCore::Color&);
+    void dismissColorPicker();
+#endif
+
+    WKPageRef createNewPage();
+    void closePage();
+
+    void requestPopupMenu(WebKit::WebPopupMenuProxyEfl*, const WebCore::IntRect&, WebCore::TextDirection, double pageScaleFactor, const Vector<WebKit::WebPopupItem>& items, int32_t selectedIndex);
+    void closePopupMenu();
+
+    void updateTextInputState();
+
+    void requestJSAlertPopup(const WKEinaSharedString& message);
+    bool requestJSConfirmPopup(const WKEinaSharedString& message);
+    WKEinaSharedString requestJSPromptPopup(const WKEinaSharedString& message, const WKEinaSharedString& defaultValue);
+
+    template<EwkViewCallbacks::CallbackType callbackType>
+    EwkViewCallbacks::CallBack<callbackType> smartCallback() const
+    {
+        return EwkViewCallbacks::CallBack<callbackType>(m_view);
+    }
+
+#if USE(TILED_BACKING_STORE)
+    void informLoadCommitted();
+#endif
+    void informContentsSizeChange(const WebCore::IntSize& size);
+    unsigned long long informDatabaseQuotaReached(const String& databaseName, const String& displayName, unsigned long long currentQuota, unsigned long long currentOriginUsage, unsigned long long currentDatabaseUsage, unsigned long long expectedUsage);
+
+#if USE(TILED_BACKING_STORE)
+    WebKit::PageClientBase* pageClient() { return m_pageClient.get(); }
+
+    void setScaleFactor(float scaleFactor) { m_scaleFactor = scaleFactor; }
+    float scaleFactor() const { return m_scaleFactor; }
+
+    void setScrollPosition(WebCore::IntPoint position) { m_scrollPosition = position; }
+    const WebCore::IntPoint scrollPosition() const { return m_scrollPosition; }
+#endif
+#if USE(ACCELERATED_COMPOSITING)
+    Evas_GL* evasGL() { return m_evasGL.get(); }
+    Evas_GL_Context* evasGLContext() { return m_evasGLContext ? m_evasGLContext->context() : 0; }
+    Evas_GL_Surface* evasGLSurface() { return m_evasGLSurface ? m_evasGLSurface->surface() : 0; }
+    void clearEvasGLSurface() { m_evasGLSurface.clear(); }
+#endif
+
+    // FIXME: needs refactoring (split callback invoke)
+    void informURLChange();
+
+private:
+    inline Ewk_View_Smart_Data* smartData() const;
+    void displayTimerFired(WebCore::Timer<EwkViewImpl>*);
+
+    void informIconChange();
+
+    static void onMouseDown(void* data, Evas*, Evas_Object*, void* eventInfo);
+    static void onMouseUp(void* data, Evas*, Evas_Object*, void* eventInfo);
+    static void onMouseMove(void* data, Evas*, Evas_Object*, void* eventInfo);
+#if ENABLE(TOUCH_EVENTS)
+    void feedTouchEvents(Ewk_Touch_Event_Type type);
+    static void onTouchDown(void* /* data */, Evas* /* canvas */, Evas_Object* ewkView, void* /* eventInfo */);
+    static void onTouchUp(void* /* data */, Evas* /* canvas */, Evas_Object* ewkView, void* /* eventInfo */);
+    static void onTouchMove(void* /* data */, Evas* /* canvas */, Evas_Object* ewkView, void* /* eventInfo */);
+#endif
+    static void onFaviconChanged(const char* pageURL, void* eventInfo);
+
+    // Note, initialization matters.
+    Evas_Object* m_view;
+    RefPtr<EwkContext> m_context;
+#if USE(ACCELERATED_COMPOSITING)
+    OwnPtr<Evas_GL> m_evasGL;
+    OwnPtr<WebKit::EvasGLContext> m_evasGLContext;
+    OwnPtr<WebKit::EvasGLSurface> m_evasGLSurface;
+#endif
+    OwnPtr<WebKit::PageClientBase> m_pageClient;
+    RefPtr<WebKit::WebPageProxy> m_pageProxy;
+    OwnPtr<WebKit::PageLoadClientEfl> m_pageLoadClient;
+    OwnPtr<WebKit::PagePolicyClientEfl> m_pagePolicyClient;
+    OwnPtr<WebKit::PageUIClientEfl> m_pageUIClient;
+    OwnPtr<WebKit::ResourceLoadClientEfl> m_resourceLoadClient;
+    OwnPtr<WebKit::FindClientEfl> m_findClient;
+    OwnPtr<WebKit::FormClientEfl> m_formClient;
+    OwnPtr<Ewk_Back_Forward_List> m_backForwardList;
+#if USE(TILED_BACKING_STORE)
+    float m_scaleFactor;
+    WebCore::IntPoint m_scrollPosition;
+#endif
+    OwnPtr<Ewk_Settings> m_settings;
+    const char* m_cursorGroup; // This is an address, do not free it or use WKEinaSharedString.
+    WKEinaSharedString m_faviconURL;
+    WKEinaSharedString m_url;
+    mutable WKEinaSharedString m_title;
+    WKEinaSharedString m_theme;
+    mutable WKEinaSharedString m_customEncoding;
+    bool m_mouseEventsEnabled;
+#if ENABLE(TOUCH_EVENTS)
+    bool m_touchEventsEnabled;
+#endif
+    WebCore::Timer<EwkViewImpl> m_displayTimer;
+    OwnPtr<Ewk_Popup_Menu> m_popupMenu;
+    OwnPtr<WebKit::InputMethodContextEfl> m_inputMethodContext;
+    OwnPtr<Ewk_Color_Picker> m_colorPicker;
+};
+
+#endif // EwkViewImpl_h
diff --git a/Source/WebKit2/UIProcess/API/efl/PageClientImpl.cpp b/Source/WebKit2/UIProcess/API/efl/PageClientImpl.cpp
deleted file mode 100644
index 054bfcbf7..000000000
--- a/Source/WebKit2/UIProcess/API/efl/PageClientImpl.cpp
+++ /dev/null
@@ -1,302 +0,0 @@
-/*
- * Copyright (C) 2011 Samsung Electronics
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
- * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
- * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
- * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
- * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
- * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
- * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
- * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
- * THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "config.h"
-#include "PageClientImpl.h"
-
-#include "DrawingAreaProxyImpl.h"
-#include "NativeWebKeyboardEvent.h"
-#include "NotImplemented.h"
-#include "WebContext.h"
-#include "WebContextMenuProxy.h"
-#include "WebPageGroup.h"
-#include "WebPageProxy.h"
-#include "WebPopupMenuProxyEfl.h"
-#include "WebPreferences.h"
-#include "ewk_context.h"
-#include "ewk_context_private.h"
-#include "ewk_download_job.h"
-#include "ewk_download_job_private.h"
-#include "ewk_view.h"
-#include "ewk_view_private.h"
-
-using namespace WebCore;
-
-namespace WebKit {
-
-PageClientImpl::PageClientImpl(Evas_Object* viewWidget)
-    : m_viewWidget(viewWidget)
-{
-}
-
-PageClientImpl::~PageClientImpl()
-{
-}
-
-// PageClient
-PassOwnPtr<DrawingAreaProxy> PageClientImpl::createDrawingAreaProxy()
-{
-    return DrawingAreaProxyImpl::create(ewk_view_page_get(m_viewWidget));
-}
-
-void PageClientImpl::setViewNeedsDisplay(const WebCore::IntRect& rect)
-{
-    ewk_view_display(m_viewWidget, rect);
-}
-
-void PageClientImpl::displayView()
-{
-    notImplemented();
-}
-
-void PageClientImpl::scrollView(const WebCore::IntRect& scrollRect, const WebCore::IntSize&)
-{
-    setViewNeedsDisplay(scrollRect);
-}
-
-WebCore::IntSize PageClientImpl::viewSize()
-{
-    return ewk_view_size_get(m_viewWidget);
-}
-
-bool PageClientImpl::isViewWindowActive()
-{
-    notImplemented();
-    return true;
-}
-
-bool PageClientImpl::isViewFocused()
-{
-    return evas_object_focus_get(m_viewWidget);
-}
-
-bool PageClientImpl::isViewVisible()
-{
-    return evas_object_visible_get(m_viewWidget);
-}
-
-bool PageClientImpl::isViewInWindow()
-{
-    notImplemented();
-    return true;
-}
-
-void PageClientImpl::processDidCrash()
-{
-    // Check if loading was ongoing, when web process crashed.
-    double loadProgress = ewk_view_load_progress_get(m_viewWidget);
-    if (loadProgress >= 0 && loadProgress < 1)
-        ewk_view_load_progress_changed(m_viewWidget, 1);
-
-    ewk_view_webprocess_crashed(m_viewWidget);
-}
-
-void PageClientImpl::didRelaunchProcess()
-{
-    notImplemented();
-}
-
-void PageClientImpl::pageClosed()
-{
-    notImplemented();
-}
-
-void PageClientImpl::toolTipChanged(const String&, const String& newToolTip)
-{
-    ewk_view_tooltip_text_set(m_viewWidget, newToolTip.utf8().data());
-}
-
-void PageClientImpl::setCursor(const Cursor& cursor)
-{
-    ewk_view_cursor_set(m_viewWidget, cursor);
-}
-
-void PageClientImpl::setCursorHiddenUntilMouseMoves(bool)
-{
-    notImplemented();
-}
-
-void PageClientImpl::didChangeViewportProperties(const WebCore::ViewportAttributes&)
-{
-    notImplemented();
-}
-
-void PageClientImpl::registerEditCommand(PassRefPtr<WebEditCommandProxy> command, WebPageProxy::UndoOrRedo undoOrRedo)
-{
-    m_undoController.registerEditCommand(command, undoOrRedo);
-}
-
-void PageClientImpl::clearAllEditCommands()
-{
-    m_undoController.clearAllEditCommands();
-}
-
-bool PageClientImpl::canUndoRedo(WebPageProxy::UndoOrRedo undoOrRedo)
-{
-    return m_undoController.canUndoRedo(undoOrRedo);
-}
-
-void PageClientImpl::executeUndoRedo(WebPageProxy::UndoOrRedo undoOrRedo)
-{
-    m_undoController.executeUndoRedo(undoOrRedo);
-}
-
-FloatRect PageClientImpl::convertToDeviceSpace(const FloatRect& viewRect)
-{
-    notImplemented();
-    return viewRect;
-}
-
-FloatRect PageClientImpl::convertToUserSpace(const FloatRect& viewRect)
-{
-    notImplemented();
-    return viewRect;
-}
-
-IntPoint PageClientImpl::screenToWindow(const IntPoint& point)
-{
-    notImplemented();
-    return point;
-}
-
-IntRect PageClientImpl::windowToScreen(const IntRect&)
-{
-    notImplemented();
-    return IntRect();
-}
-
-void PageClientImpl::doneWithKeyEvent(const NativeWebKeyboardEvent&, bool)
-{
-    notImplemented();
-}
-
-#if ENABLE(TOUCH_EVENTS)
-void PageClientImpl::doneWithTouchEvent(const NativeWebTouchEvent&, bool /*wasEventHandled*/)
-{
-    notImplemented();
-}
-#endif
-
-PassRefPtr<WebPopupMenuProxy> PageClientImpl::createPopupMenuProxy(WebPageProxy* page)
-{
-    return WebPopupMenuProxyEfl::create(m_viewWidget, page);
-}
-
-PassRefPtr<WebContextMenuProxy> PageClientImpl::createContextMenuProxy(WebPageProxy*)
-{
-    notImplemented();
-    return 0;
-}
-
-#if ENABLE(INPUT_TYPE_COLOR)
-PassRefPtr<WebColorChooserProxy> PageClientImpl::createColorChooserProxy(WebPageProxy*, const WebCore::Color&, const WebCore::IntRect&)
-{
-    notImplemented();
-    return 0;
-}
-#endif
-
-void PageClientImpl::setFindIndicator(PassRefPtr<FindIndicator>, bool, bool)
-{
-    notImplemented();
-}
-
-#if USE(ACCELERATED_COMPOSITING)
-void PageClientImpl::enterAcceleratedCompositingMode(const LayerTreeContext&)
-{
-    ewk_view_accelerated_compositing_mode_enter(m_viewWidget);
-}
-
-void PageClientImpl::exitAcceleratedCompositingMode()
-{
-    ewk_view_accelerated_compositing_mode_exit(m_viewWidget);
-}
-
-void PageClientImpl::updateAcceleratedCompositingMode(const LayerTreeContext&)
-{
-    notImplemented();
-}
-#endif // USE(ACCELERATED_COMPOSITING)
-
-void PageClientImpl::didChangeScrollbarsForMainFrame() const
-{
-    notImplemented();
-}
-
-void PageClientImpl::didCommitLoadForMainFrame(bool)
-{
-    notImplemented();
-}
-
-void PageClientImpl::didFinishLoadingDataForCustomRepresentation(const String&, const CoreIPC::DataReference&)
-{
-    notImplemented();
-}
-
-double PageClientImpl::customRepresentationZoomFactor()
-{
-    notImplemented();
-    return 0;
-}
-
-void PageClientImpl::setCustomRepresentationZoomFactor(double)
-{
-    notImplemented();
-}
-
-void PageClientImpl::flashBackingStoreUpdates(const Vector<IntRect>&)
-{
-    notImplemented();
-}
-
-void PageClientImpl::findStringInCustomRepresentation(const String&, FindOptions, unsigned)
-{
-    notImplemented();
-}
-
-void PageClientImpl::countStringMatchesInCustomRepresentation(const String&, FindOptions, unsigned)
-{
-    notImplemented();
-}
-
-void PageClientImpl::handleDownloadRequest(DownloadProxy* download)
-{
-    RefPtr<Ewk_Download_Job> ewkDownload = Ewk_Download_Job::create(download, m_viewWidget);
-    ewk_view_context_get(m_viewWidget)->addDownloadJob(ewkDownload.get());
-}
-
-#if USE(TILED_BACKING_STORE)
-void PageClientImpl::pageDidRequestScroll(const IntPoint&)
-{
-    notImplemented();
-}
-#endif
-
-void PageClientImpl::didChangeContentsSize(const WebCore::IntSize& size)
-{
-    ewk_view_contents_size_changed(m_viewWidget, size);
-}
-
-} // namespace WebKit
diff --git a/Source/WebKit2/UIProcess/API/efl/WebKitTextChecker.cpp b/Source/WebKit2/UIProcess/API/efl/WebKitTextChecker.cpp
deleted file mode 100644
index 2ff39c4df..000000000
--- a/Source/WebKit2/UIProcess/API/efl/WebKitTextChecker.cpp
+++ /dev/null
@@ -1,139 +0,0 @@
-/*
- * Copyright (C) 2012 Samsung Electronics
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
- * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT HOLDER OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
- * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
- * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "config.h"
-#include "WebKitTextChecker.h"
-
-#if ENABLE(SPELLCHECK)
-
-#include "NotImplemented.h"
-#include "WKAPICast.h"
-#include "WKMutableArray.h"
-#include "WKRetainPtr.h"
-#include "WebPageProxy.h"
-#include "WebString.h"
-#include "ewk_settings.h"
-#include "ewk_text_checker_private.h"
-#include <Eina.h>
-#include <wtf/OwnPtr.h>
-#include <wtf/text/CString.h>
-
-namespace WebKit {
-
-static OwnPtr<WebCore::TextCheckerEnchant> textCheckerEnchant = WebCore::TextCheckerEnchant::create();
-
-static Ewk_Text_Checker* ewkTextCheckerCallbacks = ewk_text_checker_callbacks_get();
-
-bool isContinuousSpellCheckingEnabled(const void*)
-{
-    return ewk_settings_continuous_spell_checking_enabled_get();
-}
-
-void setContinuousSpellCheckingEnabled(bool enabled, const void*)
-{
-    ewk_settings_continuous_spell_checking_enabled_set(enabled);
-}
-
-uint64_t uniqueSpellDocumentTag(WKPageRef page, const void*)
-{
-    if (ewkTextCheckerCallbacks->unique_spell_document_tag_get)
-        return ewkTextCheckerCallbacks->unique_spell_document_tag_get(toImpl(page)->viewWidget());
-
-    return 0;
-}
-
-void closeSpellDocumentWithTag(uint64_t tag, const void*)
-{
-    if (ewkTextCheckerCallbacks->unique_spell_document_tag_close)
-        ewkTextCheckerCallbacks->unique_spell_document_tag_close(tag);
-}
-
-void checkSpellingOfString(uint64_t tag, WKStringRef text, int32_t* misspellingLocation, int32_t* misspellingLength, const void*)
-{
-    if (ewkTextCheckerCallbacks->string_spelling_check)
-        ewkTextCheckerCallbacks->string_spelling_check(tag, toImpl(text)->string().utf8().data(), misspellingLocation, misspellingLength);
-    else
-        textCheckerEnchant->checkSpellingOfString(toImpl(text)->string(), *misspellingLocation, *misspellingLength);
-}
-
-WKArrayRef guessesForWord(uint64_t tag, WKStringRef word, const void*)
-{
-    WKMutableArrayRef suggestionsForWord = WKMutableArrayCreate();
-
-    if (ewkTextCheckerCallbacks->word_guesses_get) {
-        Eina_List* list = ewkTextCheckerCallbacks->word_guesses_get(tag, toImpl(word)->string().utf8().data());
-        void* item;
-
-        EINA_LIST_FREE(list, item) {
-            WKRetainPtr<WKStringRef> suggestion(AdoptWK, WKStringCreateWithUTF8CString(static_cast<char*>(item)));
-            WKArrayAppendItem(suggestionsForWord, suggestion.get());
-            free(item);
-        }
-    } else {
-        Vector<String> guesses = textCheckerEnchant->getGuessesForWord(toImpl(word)->string());
-        size_t numberOfGuesses = guesses.size();
-        for (size_t i = 0; i < numberOfGuesses; ++i) {
-            WKRetainPtr<WKStringRef> suggestion(AdoptWK, WKStringCreateWithUTF8CString(guesses[i].utf8().data()));
-            WKArrayAppendItem(suggestionsForWord, suggestion.get());
-        }
-    }
-
-    return suggestionsForWord;
-}
-
-void learnWord(uint64_t tag, WKStringRef word, const void*)
-{
-    if (ewkTextCheckerCallbacks->word_learn)
-        ewkTextCheckerCallbacks->word_learn(tag, toImpl(word)->string().utf8().data());
-    else
-        textCheckerEnchant->learnWord(toImpl(word)->string());
-}
-
-void ignoreWord(uint64_t tag, WKStringRef word, const void*)
-{
-    if (ewkTextCheckerCallbacks->word_ignore)
-        ewkTextCheckerCallbacks->word_ignore(tag, toImpl(word)->string().utf8().data());
-    else
-        textCheckerEnchant->ignoreWord(toImpl(word)->string());
-}
-
-Vector<String> availableSpellCheckingLanguages()
-{
-    return textCheckerEnchant->availableSpellCheckingLanguages();
-}
-
-void updateSpellCheckingLanguages(const Vector<String>& languages)
-{
-    textCheckerEnchant->updateSpellCheckingLanguages(languages);
-}
-
-Vector<String> loadedSpellCheckingLanguages()
-{
-    return textCheckerEnchant->loadedSpellCheckingLanguages();
-}
-
-} // namespace WebKit
-
-#endif // ENABLE(SPELLCHECK)
diff --git a/Source/WebKit2/UIProcess/API/efl/ewk_auth_request.cpp b/Source/WebKit2/UIProcess/API/efl/ewk_auth_request.cpp
new file mode 100644
index 000000000..20279e3a6
--- /dev/null
+++ b/Source/WebKit2/UIProcess/API/efl/ewk_auth_request.cpp
@@ -0,0 +1,171 @@
+/*
+ * Copyright (C) 2012 Intel Corporation. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "ewk_auth_request.h"
+
+#include "AuthenticationChallengeProxy.h"
+#include "AuthenticationDecisionListener.h"
+#include "WebCredential.h"
+#include "WebProtectionSpace.h"
+#include "WebString.h"
+#include "ewk_auth_request_private.h"
+#include <wtf/text/CString.h>
+
+using namespace WebKit;
+using namespace WebCore;
+
+EwkAuthRequest::EwkAuthRequest(AuthenticationChallengeProxy* authenticationChallenge)
+    : m_authenticationChallenge(authenticationChallenge)
+    , m_wasHandled(false)
+{
+    ASSERT(m_authenticationChallenge);
+}
+
+EwkAuthRequest::~EwkAuthRequest()
+{
+    if (!m_wasHandled)
+        continueWithoutCredential();
+}
+
+const char* EwkAuthRequest::suggestedUsername() const
+{
+    if (!m_suggestedUsername) {
+        WebCredential* credential = m_authenticationChallenge->proposedCredential();
+        ASSERT(credential);
+
+        const String& suggestedUsername = credential->user();
+        if (suggestedUsername.isEmpty())
+            return 0;
+
+        m_suggestedUsername = suggestedUsername.utf8().data();
+    }
+
+    return m_suggestedUsername;
+}
+
+const char* EwkAuthRequest::realm() const
+{
+    if (!m_realm) {
+        WebProtectionSpace* protectionSpace = m_authenticationChallenge->protectionSpace();
+        ASSERT(protectionSpace);
+
+        const String& realm = protectionSpace->realm();
+        if (realm.isEmpty())
+            return 0;
+
+        m_realm = realm.utf8().data();
+    }
+
+    return m_realm;
+}
+
+const char* EwkAuthRequest::host() const
+{
+    if (!m_host) {
+        WebProtectionSpace* protectionSpace = m_authenticationChallenge->protectionSpace();
+        ASSERT(protectionSpace);
+
+        const String& host = protectionSpace->host();
+        if (host.isEmpty())
+            return 0;
+
+        m_host = host.utf8().data();
+    }
+
+    return m_host;
+}
+
+bool EwkAuthRequest::continueWithoutCredential()
+{
+    if (m_wasHandled)
+        return false;
+
+    m_wasHandled = true;
+    m_authenticationChallenge->useCredential(0);
+
+    return true;
+}
+
+bool EwkAuthRequest::authenticate(const String& username, const String& password)
+{
+    if (m_wasHandled)
+        return false;
+
+    m_wasHandled = true;
+    RefPtr<WebCredential> credential = WebCredential::create(WebString::create(username).get(), WebString::create(password).get(), CredentialPersistenceForSession);
+    m_authenticationChallenge->useCredential(credential.get());
+
+    return true;
+}
+
+bool EwkAuthRequest::isRetrying() const
+{
+    return m_authenticationChallenge->previousFailureCount() > 0;
+}
+
+const char* ewk_auth_request_suggested_username_get(const Ewk_Auth_Request* request)
+{
+    EWK_OBJ_GET_IMPL_OR_RETURN(const EwkAuthRequest, request, impl, 0);
+
+    return impl->suggestedUsername();
+}
+
+Eina_Bool ewk_auth_request_cancel(Ewk_Auth_Request* request)
+{
+    EWK_OBJ_GET_IMPL_OR_RETURN(EwkAuthRequest, request, impl, false);
+
+    return impl->continueWithoutCredential();
+}
+
+Eina_Bool ewk_auth_request_authenticate(Ewk_Auth_Request* request, const char* username, const char* password)
+{
+    EWK_OBJ_GET_IMPL_OR_RETURN(EwkAuthRequest, request, impl, false);
+    EINA_SAFETY_ON_NULL_RETURN_VAL(username, false);
+    EINA_SAFETY_ON_NULL_RETURN_VAL(password, false);
+
+    return impl->authenticate(String::fromUTF8(username), String::fromUTF8(password));
+}
+
+Eina_Bool ewk_auth_request_retrying_get(const Ewk_Auth_Request* request)
+{
+    EWK_OBJ_GET_IMPL_OR_RETURN(const EwkAuthRequest, request, impl, false);
+
+    return impl->isRetrying();
+}
+
+const char* ewk_auth_request_realm_get(const Ewk_Auth_Request* request)
+{
+    EWK_OBJ_GET_IMPL_OR_RETURN(const EwkAuthRequest, request, impl, 0);
+
+    return impl->realm();
+}
+
+const char* ewk_auth_request_host_get(const Ewk_Auth_Request* request)
+{
+    EWK_OBJ_GET_IMPL_OR_RETURN(const EwkAuthRequest, request, impl, 0);
+
+    return impl->host();
+}
diff --git a/Source/WebKit2/UIProcess/API/efl/ewk_auth_request.h b/Source/WebKit2/UIProcess/API/efl/ewk_auth_request.h
new file mode 100644
index 000000000..78abb2b38
--- /dev/null
+++ b/Source/WebKit2/UIProcess/API/efl/ewk_auth_request.h
@@ -0,0 +1,118 @@
+/*
+ * Copyright (C) 2012 Intel Corporation. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+/**
+ * @file    ewk_auth_request.h
+ * @brief   Describes the Ewk Authentication Request API.
+ */
+
+#ifndef ewk_auth_request_h
+#define ewk_auth_request_h
+
+#include <Eina.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/**
+ * Declare Ewk_Auth_Request as Ewk_Object.
+ *
+ * @see Ewk_Object
+ */
+typedef struct Ewk_Object Ewk_Auth_Request;
+
+/**
+ * Queries the suggested username to be used for authenticating.
+ *
+ * @param request request object to query
+ *
+ * @return the username pointer, that may be @c NULL. This pointer is
+ *         guaranteed to be eina_stringshare, so whenever possible
+ *         save yourself some cpu cycles and use
+ *         eina_stringshare_ref() instead of eina_stringshare_add() or
+ *         strdup()
+ */
+EAPI const char *ewk_auth_request_suggested_username_get(const Ewk_Auth_Request *request);
+
+/**
+ * Queries if this an authentication attempt retrying.
+ *
+ * @param request request object to query
+ *
+ * @return @c EINA_TRUE if this is not the first authentication attempt
+ *         and we are trying, @c EINA_FALSE otherwise.
+ */
+EAPI Eina_Bool ewk_auth_request_retrying_get(const Ewk_Auth_Request *request);
+
+/**
+ * Queries the authentication realm.
+ *
+ * @param request request object to query
+ *
+ * @return the realm pointer, that may be @c NULL. This pointer is
+ *         guaranteed to be eina_stringshare, so whenever possible
+ *         save yourself some cpu cycles and use
+ *         eina_stringshare_ref() instead of eina_stringshare_add() or
+ *         strdup()
+ */
+EAPI const char *ewk_auth_request_realm_get(const Ewk_Auth_Request *request);
+
+/**
+ * Queries the host requiring the authentication.
+ *
+ * @param request request object to query
+ *
+ * @return the host pointer, that may be @c NULL. This pointer is
+ *         guaranteed to be eina_stringshare, so whenever possible
+ *         save yourself some cpu cycles and use
+ *         eina_stringshare_ref() instead of eina_stringshare_add() or
+ *         strdup()
+ */
+EAPI const char *ewk_auth_request_host_get(const Ewk_Auth_Request *request);
+
+/**
+ * Cancels the authentication request.
+ *
+ * @param request request object to cancel
+ *
+ * @return @c EINA_TRUE if successful, @c EINA_FALSE otherwise
+ */
+EAPI Eina_Bool ewk_auth_request_cancel(Ewk_Auth_Request *request);
+
+/**
+ * Set credential for the authentication request.
+ *
+ * @param request request object to update
+ *
+ * @return @c EINA_TRUE if the credential was successfuly sent, @c EINA_FALSE otherwise.
+ */
+EAPI Eina_Bool ewk_auth_request_authenticate(Ewk_Auth_Request *request, const char *username, const char *password);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* ewk_auth_request_h */
diff --git a/Source/WebKit2/UIProcess/API/efl/ewk_auth_request_private.h b/Source/WebKit2/UIProcess/API/efl/ewk_auth_request_private.h
new file mode 100644
index 000000000..ad1277cd0
--- /dev/null
+++ b/Source/WebKit2/UIProcess/API/efl/ewk_auth_request_private.h
@@ -0,0 +1,67 @@
+/*
+ * Copyright (C) 2012 Intel Corporation. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef ewk_auth_request_private_h
+#define ewk_auth_request_private_h
+
+#include "WKEinaSharedString.h"
+#include "ewk_object_private.h"
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+#include <wtf/text/WTFString.h>
+
+namespace WebKit {
+class AuthenticationChallengeProxy;
+}
+
+class EwkAuthRequest : public Ewk_Object {
+public:
+    EWK_OBJECT_DECLARE(EwkAuthRequest)
+
+    static PassRefPtr<EwkAuthRequest> create(WebKit::AuthenticationChallengeProxy* authenticationChallenge)
+    {
+        return adoptRef(new EwkAuthRequest(authenticationChallenge));
+    }
+    ~EwkAuthRequest();
+
+    const char* suggestedUsername() const;
+    const char* realm() const;
+    const char* host() const;
+    bool isRetrying() const;
+
+    bool continueWithoutCredential();
+    bool authenticate(const String& username, const String& password);
+
+private:
+    explicit EwkAuthRequest(WebKit::AuthenticationChallengeProxy* authenticationChallenge);
+
+    RefPtr<WebKit::AuthenticationChallengeProxy> m_authenticationChallenge;
+    bool m_wasHandled;
+    mutable WKEinaSharedString m_suggestedUsername;
+    mutable WKEinaSharedString m_realm;
+    mutable WKEinaSharedString m_host;
+};
+
+#endif // ewk_auth_request_private_h
diff --git a/Source/WebKit2/UIProcess/API/efl/ewk_back_forward_list.cpp b/Source/WebKit2/UIProcess/API/efl/ewk_back_forward_list.cpp
index 12dbb8f4b..dd3ae623b 100644
--- a/Source/WebKit2/UIProcess/API/efl/ewk_back_forward_list.cpp
+++ b/Source/WebKit2/UIProcess/API/efl/ewk_back_forward_list.cpp
@@ -30,6 +30,7 @@
 #include "WKArray.h"
 #include "WKBackForwardList.h"
 #include "ewk_back_forward_list_private.h"
+#include "ewk_object.h"
 #include <wtf/text/CString.h>
 
 using namespace WebKit;
@@ -90,7 +91,7 @@ Ewk_Back_Forward_List_Item* Ewk_Back_Forward_List::getFromCacheOrCreate(WKBackFo
 
     RefPtr<Ewk_Back_Forward_List_Item> item = m_wrapperCache.get(wkItem);
     if (!item) {
-        item = Ewk_Back_Forward_List_Item::create(wkItem);
+        item = EwkBackForwardListItem::create(wkItem);
         m_wrapperCache.set(wkItem, item);
     }
 
@@ -108,7 +109,7 @@ Eina_List* Ewk_Back_Forward_List::createEinaList(WKArrayRef wkList) const
     for (size_t i = 0; i < count; ++i) {
         WKBackForwardListItemRef wkItem = static_cast<WKBackForwardListItemRef>(WKArrayGetItemAtIndex(wkList, i));
         Ewk_Back_Forward_List_Item* item = getFromCacheOrCreate(wkItem);
-        result = eina_list_append(result, ewk_back_forward_list_item_ref(item));
+        result = eina_list_append(result, ewk_object_ref(item));
     }
 
     return result;
diff --git a/Source/WebKit2/UIProcess/API/efl/ewk_back_forward_list.h b/Source/WebKit2/UIProcess/API/efl/ewk_back_forward_list.h
index 09dbc5ab6..9a791ba2d 100644
--- a/Source/WebKit2/UIProcess/API/efl/ewk_back_forward_list.h
+++ b/Source/WebKit2/UIProcess/API/efl/ewk_back_forward_list.h
@@ -96,7 +96,7 @@ EAPI unsigned ewk_back_forward_list_count(Ewk_Back_Forward_List *list);
  * @param limit the number of items to retrieve
  *
  * @return @c Eina_List containing @c Ewk_Back_Forward_List_Item elements or @c NULL in case of error,
- *            the Eina_List and its items should be freed after use. Use ewk_back_forward_list_item_unref()
+ *            the Eina_List and its items should be freed after use. Use ewk_object_unref()
  *            to free the items
  */
 EAPI Eina_List *ewk_back_forward_list_n_back_items_copy(const Ewk_Back_Forward_List *list, int limit);
@@ -111,7 +111,7 @@ EAPI Eina_List *ewk_back_forward_list_n_back_items_copy(const Ewk_Back_Forward_L
  * @param limit the number of items to retrieve
  *
  * @return @c Eina_List containing @c Ewk_Back_Forward_List_Item elements or @c NULL in case of error,
- *            the Eina_List and its items should be freed after use. Use ewk_back_forward_list_item_unref()
+ *            the Eina_List and its items should be freed after use. Use ewk_object_unref()
  *            to free the items
  */
 EAPI Eina_List *ewk_back_forward_list_n_forward_items_copy(const Ewk_Back_Forward_List *list, int limit);
@@ -124,7 +124,7 @@ EAPI Eina_List *ewk_back_forward_list_n_forward_items_copy(const Ewk_Back_Forwar
  * @param list the back-forward list instance
  *
  * @return @c Eina_List containing @c Ewk_Back_Forward_List_Item elements or @c NULL in case of error,
- *            the Eina_List and its items should be freed after use. Use ewk_back_forward_list_item_unref()
+ *            the Eina_List and its items should be freed after use. Use ewk_object_unref()
  *            to free the items
  *
  * @see ewk_back_forward_list_n_back_items_copy
@@ -140,7 +140,7 @@ EAPI Eina_List *ewk_back_forward_list_n_forward_items_copy(const Ewk_Back_Forwar
  * @param list the back-forward list instance
  *
  * @return @c Eina_List containing @c Ewk_Back_Forward_List_Item elements or @c NULL in case of error,
- *            the Eina_List and its items should be freed after use. Use ewk_back_forward_list_item_unref()
+ *            the Eina_List and its items should be freed after use. Use ewk_object_unref()
  *            to free the items
  *
  * @see ewk_back_forward_list_n_forward_items_copy
diff --git a/Source/WebKit2/UIProcess/API/efl/ewk_back_forward_list_item.cpp b/Source/WebKit2/UIProcess/API/efl/ewk_back_forward_list_item.cpp
index 5ec236033..43f29c96c 100644
--- a/Source/WebKit2/UIProcess/API/efl/ewk_back_forward_list_item.cpp
+++ b/Source/WebKit2/UIProcess/API/efl/ewk_back_forward_list_item.cpp
@@ -32,63 +32,48 @@
 
 using namespace WebKit;
 
-Ewk_Back_Forward_List_Item::Ewk_Back_Forward_List_Item(WKBackForwardListItemRef itemRef)
+EwkBackForwardListItem::EwkBackForwardListItem(WKBackForwardListItemRef itemRef)
     : m_wkItem(itemRef)
 { }
 
-const char* Ewk_Back_Forward_List_Item::url() const
+const char* EwkBackForwardListItem::url() const
 {
     m_url = WKEinaSharedString(AdoptWK, WKBackForwardListItemCopyURL(m_wkItem.get()));
 
     return m_url;
 }
 
-const char* Ewk_Back_Forward_List_Item::title() const
+const char* EwkBackForwardListItem::title() const
 {
     m_title = WKEinaSharedString(AdoptWK, WKBackForwardListItemCopyTitle(m_wkItem.get()));
 
     return m_title;
 }
 
-const char* Ewk_Back_Forward_List_Item::originalURL() const
+const char* EwkBackForwardListItem::originalURL() const
 {
     m_originalURL = WKEinaSharedString(AdoptWK, WKBackForwardListItemCopyOriginalURL(m_wkItem.get()));
 
     return m_originalURL;
 }
 
-Ewk_Back_Forward_List_Item* ewk_back_forward_list_item_ref(Ewk_Back_Forward_List_Item* item)
-{
-    EINA_SAFETY_ON_NULL_RETURN_VAL(item, 0);
-    item->ref();
-
-    return item;
-}
-
-void ewk_back_forward_list_item_unref(Ewk_Back_Forward_List_Item* item)
-{
-    EINA_SAFETY_ON_NULL_RETURN(item);
-
-    item->deref();
-}
-
 const char* ewk_back_forward_list_item_url_get(const Ewk_Back_Forward_List_Item* item)
 {
-    EINA_SAFETY_ON_NULL_RETURN_VAL(item, 0);
+    EWK_OBJ_GET_IMPL_OR_RETURN(const EwkBackForwardListItem, item, impl, 0);
 
-    return item->url();
+    return impl->url();
 }
 
 const char* ewk_back_forward_list_item_title_get(const Ewk_Back_Forward_List_Item* item)
 {
-    EINA_SAFETY_ON_NULL_RETURN_VAL(item, 0);
+    EWK_OBJ_GET_IMPL_OR_RETURN(const EwkBackForwardListItem, item, impl, 0);
 
-    return item->title();
+    return impl->title();
 }
 
 const char* ewk_back_forward_list_item_original_url_get(const Ewk_Back_Forward_List_Item* item)
 {
-    EINA_SAFETY_ON_NULL_RETURN_VAL(item, 0);
+    EWK_OBJ_GET_IMPL_OR_RETURN(const EwkBackForwardListItem, item, impl, 0);
 
-    return item->originalURL();
+    return impl->originalURL();
 }
diff --git a/Source/WebKit2/UIProcess/API/efl/ewk_back_forward_list_item.h b/Source/WebKit2/UIProcess/API/efl/ewk_back_forward_list_item.h
index 8d0724d4a..18bc61146 100644
--- a/Source/WebKit2/UIProcess/API/efl/ewk_back_forward_list_item.h
+++ b/Source/WebKit2/UIProcess/API/efl/ewk_back_forward_list_item.h
@@ -37,26 +37,12 @@
 extern "C" {
 #endif
 
-/** Creates a type name for Ewk_Back_Forward_List_Item */
-typedef struct Ewk_Back_Forward_List_Item Ewk_Back_Forward_List_Item;
-
 /**
- * Increases the reference count of the given object.
- *
- * @param item the back-forward list item instance to increase the reference count
- *
- * @return a pointer to the object on success, @c NULL otherwise.
- */
-EAPI Ewk_Back_Forward_List_Item *ewk_back_forward_list_item_ref(Ewk_Back_Forward_List_Item *item);
-
-/**
- * Decreases the reference count of the given object, possibly freeing it.
- *
- * When the reference count reaches 0, the item is freed.
+ * Declare Ewk_Back_Forward_List_Item as Ewk_Object.
  *
- * @param item the back-forward list item instance to decrease the reference count
+ * @see Ewk_Object
  */
-EAPI void ewk_back_forward_list_item_unref(Ewk_Back_Forward_List_Item *item);
+typedef struct Ewk_Object Ewk_Back_Forward_List_Item;
 
 /**
  * Returns URL of the item.
diff --git a/Source/WebKit2/UIProcess/API/efl/ewk_back_forward_list_item_private.h b/Source/WebKit2/UIProcess/API/efl/ewk_back_forward_list_item_private.h
index 50718bc26..87525169b 100644
--- a/Source/WebKit2/UIProcess/API/efl/ewk_back_forward_list_item_private.h
+++ b/Source/WebKit2/UIProcess/API/efl/ewk_back_forward_list_item_private.h
@@ -27,19 +27,21 @@
 #define ewk_back_forward_list_item_private_h
 
 #include "WKEinaSharedString.h"
+#include "ewk_object_private.h"
 #include <WebKit2/WKBase.h>
 #include <wtf/PassRefPtr.h>
-#include <wtf/RefCounted.h>
 
 /**
  * \struct  Ewk_Back_Forward_List
  * @brief   Contains the Back Forward List data.
  */
-class Ewk_Back_Forward_List_Item : public RefCounted<Ewk_Back_Forward_List_Item> {
+class EwkBackForwardListItem : public Ewk_Object {
 public:
-    static PassRefPtr<Ewk_Back_Forward_List_Item> create(WKBackForwardListItemRef itemRef)
+    EWK_OBJECT_DECLARE(EwkBackForwardListItem)
+
+    static PassRefPtr<EwkBackForwardListItem> create(WKBackForwardListItemRef itemRef)
     {
-        return adoptRef(new Ewk_Back_Forward_List_Item(itemRef));
+        return adoptRef(new EwkBackForwardListItem(itemRef));
     }
 
     const char* url() const;
@@ -47,7 +49,7 @@ public:
     const char* originalURL() const;
 
 private:
-    explicit Ewk_Back_Forward_List_Item(WKBackForwardListItemRef itemRef);
+    explicit EwkBackForwardListItem(WKBackForwardListItemRef itemRef);
 
     WKRetainPtr<WKBackForwardListItemRef> m_wkItem;
     mutable WKEinaSharedString m_url;
diff --git a/Source/WebKit2/UIProcess/API/efl/ewk_back_forward_list_private.h b/Source/WebKit2/UIProcess/API/efl/ewk_back_forward_list_private.h
index 7aad46700..fd0db1247 100644
--- a/Source/WebKit2/UIProcess/API/efl/ewk_back_forward_list_private.h
+++ b/Source/WebKit2/UIProcess/API/efl/ewk_back_forward_list_private.h
@@ -27,6 +27,7 @@
 #define ewk_back_forward_list_private_h
 
 #include "WKRetainPtr.h"
+#include "ewk_back_forward_list_item.h"
 #include "ewk_back_forward_list_item_private.h"
 #include <WebKit2/WKBase.h>
 #include <wtf/HashMap.h>
diff --git a/Source/WebKit2/UIProcess/API/efl/ewk_color_picker.cpp b/Source/WebKit2/UIProcess/API/efl/ewk_color_picker.cpp
new file mode 100644
index 000000000..24bd0ed60
--- /dev/null
+++ b/Source/WebKit2/UIProcess/API/efl/ewk_color_picker.cpp
@@ -0,0 +1,84 @@
+/*
+   Copyright (C) 2011 Samsung Electronics
+   Copyright (C) 2012 Intel Corporation. All rights reserved.
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#include "config.h"
+#include "ewk_color_picker.h"
+
+#include "WKColorPickerResultListener.h"
+#include "WKString.h"
+#include "ewk_color_picker_private.h"
+#include <WebCore/Color.h>
+#include <wtf/text/CString.h>
+#include <wtf/text/WTFString.h>
+
+using namespace WebCore;
+
+#if ENABLE(INPUT_TYPE_COLOR)
+Ewk_Color_Picker::Ewk_Color_Picker(WKColorPickerResultListenerRef colorPickerListener, const Color& initialColor)
+    : m_colorPickerListener(colorPickerListener)
+    , m_color(initialColor)
+{
+}
+
+void Ewk_Color_Picker::setColor(const Color& color)
+{
+    WKRetainPtr<WKStringRef> colorString(AdoptWK, WKStringCreateWithUTF8CString(color.serialized().utf8().data()));
+    WKColorPickerResultListenerSetColor(m_colorPickerListener.get(), colorString.get());
+}
+
+const Color& Ewk_Color_Picker::color() const
+{
+    return m_color;
+}
+#endif
+
+Eina_Bool ewk_color_picker_color_set(Ewk_Color_Picker* colorPicker, int r, int g, int b, int a)
+{
+#if ENABLE(INPUT_TYPE_COLOR)
+    EINA_SAFETY_ON_NULL_RETURN_VAL(colorPicker, false);
+
+    colorPicker->setColor(Color(r, g, b, a));
+
+    return true;
+#else
+    return false;
+#endif
+}
+
+Eina_Bool ewk_color_picker_color_get(const Ewk_Color_Picker* colorPicker, int* r, int* g, int* b, int* a)
+{
+#if ENABLE(INPUT_TYPE_COLOR)
+    EINA_SAFETY_ON_NULL_RETURN_VAL(colorPicker, false);
+    EINA_SAFETY_ON_NULL_RETURN_VAL(r, false);
+    EINA_SAFETY_ON_NULL_RETURN_VAL(g, false);
+    EINA_SAFETY_ON_NULL_RETURN_VAL(b, false);
+    EINA_SAFETY_ON_NULL_RETURN_VAL(a, false);
+
+    const Color& color = colorPicker->color();
+    *r = color.red();
+    *g = color.green();
+    *b = color.blue();
+    *a = color.alpha();
+
+    return true;
+#else
+    return false;
+#endif
+}
diff --git a/Source/WebKit2/UIProcess/API/efl/ewk_color_picker.h b/Source/WebKit2/UIProcess/API/efl/ewk_color_picker.h
new file mode 100644
index 000000000..e13c37e3e
--- /dev/null
+++ b/Source/WebKit2/UIProcess/API/efl/ewk_color_picker.h
@@ -0,0 +1,67 @@
+/*
+   Copyright (C) 2011 Samsung Electronics
+   Copyright (C) 2012 Intel Corporation. All rights reserved.
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#ifndef ewk_color_picker_h
+#define ewk_color_picker_h
+
+#include <Evas.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/** Creates a type name for @a Ewk_Color_Picker. */
+typedef struct Ewk_Color_Picker Ewk_Color_Picker;
+
+/**
+ * Sets the selected color.
+ *
+ * The function should only be called when a color has been requested by the document.
+ * If called when this is not the case or when the input picker has been dismissed, this
+ * function will fail and return EINA_FALSE.
+ *
+ * @param color_picker color picker object
+ * @param r red channel value to be set
+ * @param g green channel value to be set
+ * @param b blue channel value to be set
+ * @param a alpha channel value to be set
+ *
+ * @return @c EINA_TRUE on success @c EINA_FALSE otherwise
+ */
+EAPI Eina_Bool ewk_color_picker_color_set(Ewk_Color_Picker *color_picker, int r, int g, int b, int a);
+
+/**
+ * Gets the currently selected color.
+ *
+ * @param color_picker color picker object
+ * @param r red channel value to be get
+ * @param g green channel value to be get
+ * @param b blue channel value to be get
+ * @param a alpha channel value to be get
+ *
+ * @return @c EINA_TRUE on success @c EINA_FALSE otherwise
+ */
+EAPI Eina_Bool ewk_color_picker_color_get(const Ewk_Color_Picker *color_picker, int *r, int *g, int *b, int *a);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* ewk_color_picker_h */
diff --git a/Source/WebKit2/UIProcess/API/efl/ewk_color_picker_private.h b/Source/WebKit2/UIProcess/API/efl/ewk_color_picker_private.h
new file mode 100644
index 000000000..273140bd4
--- /dev/null
+++ b/Source/WebKit2/UIProcess/API/efl/ewk_color_picker_private.h
@@ -0,0 +1,49 @@
+/*
+   Copyright (C) 2011 Samsung Electronics
+   Copyright (C) 2012 Intel Corporation. All rights reserved.
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#ifndef ewk_color_picker_private_h
+#define ewk_color_picker_private_h
+
+#if ENABLE(INPUT_TYPE_COLOR)
+
+#include "WKRetainPtr.h"
+#include <WebCore/Color.h>
+#include <wtf/PassOwnPtr.h>
+
+class Ewk_Color_Picker {
+public:
+    static PassOwnPtr<Ewk_Color_Picker> create(WKColorPickerResultListenerRef colorPickerListener, const WebCore::Color& initialColor)
+    {
+        return adoptPtr(new Ewk_Color_Picker(colorPickerListener, initialColor));
+    }
+
+    const WebCore::Color& color() const;
+    void setColor(const WebCore::Color&);
+
+private:
+    Ewk_Color_Picker(WKColorPickerResultListenerRef colorPickerListener, const WebCore::Color& initialColor);
+
+    WKRetainPtr<WKColorPickerResultListenerRef> m_colorPickerListener;
+    WebCore::Color m_color;
+};
+
+#endif // ENABLE(INPUT_TYPE_COLOR)
+
+#endif // ewk_color_picker_private_h
diff --git a/Source/WebKit2/UIProcess/API/efl/ewk_context.cpp b/Source/WebKit2/UIProcess/API/efl/ewk_context.cpp
index 32991c5c8..2dbf37857 100644
--- a/Source/WebKit2/UIProcess/API/efl/ewk_context.cpp
+++ b/Source/WebKit2/UIProcess/API/efl/ewk_context.cpp
@@ -22,7 +22,9 @@
 #include "ewk_context.h"
 
 #include "BatteryProvider.h"
+#include "ContextHistoryClientEfl.h"
 #include "NetworkInfoProvider.h"
+#include "RequestManagerClientEfl.h"
 #include "VibrationProvider.h"
 #include "WKAPICast.h"
 #include "WKContextSoup.h"
@@ -32,15 +34,12 @@
 #include "WebContext.h"
 #include "WebIconDatabase.h"
 #include "WebSoupRequestManagerProxy.h"
-#include "ewk_context_download_client_private.h"
-#include "ewk_context_history_client_private.h"
 #include "ewk_context_private.h"
-#include "ewk_context_request_manager_client_private.h"
 #include "ewk_cookie_manager_private.h"
-#include "ewk_download_job.h"
-#include "ewk_download_job_private.h"
+#include "ewk_database_manager_private.h"
 #include "ewk_favicon_database_private.h"
 #include "ewk_private.h"
+#include "ewk_storage_manager_private.h"
 #include "ewk_url_scheme_request_private.h"
 #include <WebCore/FileSystem.h>
 #include <WebCore/IconDatabase.h>
@@ -55,22 +54,7 @@
 using namespace WebCore;
 using namespace WebKit;
 
-struct Ewk_Url_Scheme_Handler {
-    Ewk_Url_Scheme_Request_Cb callback;
-    void* userData;
-
-    Ewk_Url_Scheme_Handler()
-        : callback(0)
-        , userData(0)
-    { }
-
-    Ewk_Url_Scheme_Handler(Ewk_Url_Scheme_Request_Cb callback, void* userData)
-        : callback(callback)
-        , userData(userData)
-    { }
-};
-
-typedef HashMap<WKContextRef, Ewk_Context*> ContextMap;
+typedef HashMap<WKContextRef, EwkContext*> ContextMap;
 
 static inline ContextMap& contextMap()
 {
@@ -78,25 +62,25 @@ static inline ContextMap& contextMap()
     return map;
 }
 
-Ewk_Context::Ewk_Context(WKContextRef context)
+EwkContext::EwkContext(WKContextRef context)
     : m_context(context)
-    , m_requestManager(WKContextGetSoupRequestManager(context))
-    , m_historyClient()
-{
-    ContextMap::AddResult result = contextMap().add(context, this);
-    ASSERT_UNUSED(result, result.isNewEntry);
-
+    , m_databaseManager(Ewk_Database_Manager::create(WKContextGetDatabaseManager(m_context.get())))
+    , m_storageManager(Ewk_Storage_Manager::create(WKContextGetKeyValueStorageManager(m_context.get())))
 #if ENABLE(BATTERY_STATUS)
-    m_batteryProvider = BatteryProvider::create(context);
+    , m_batteryProvider(BatteryProvider::create(context))
 #endif
-
 #if ENABLE(NETWORK_INFO)
-    m_networkInfoProvider = NetworkInfoProvider::create(context);
+    , m_networkInfoProvider(NetworkInfoProvider::create(context))
 #endif
-
 #if ENABLE(VIBRATION)
-    m_vibrationProvider = VibrationProvider::create(context);
+    , m_vibrationProvider(VibrationProvider::create(context))
 #endif
+    , m_downloadManager(DownloadManagerEfl::create(this))
+    , m_requestManagerClient(RequestManagerClientEfl::create(this))
+    , m_historyClient(ContextHistoryClientEfl::create(context))
+{
+    ContextMap::AddResult result = contextMap().add(context, this);
+    ASSERT_UNUSED(result, result.isNewEntry);
 
 #if ENABLE(MEMORY_SAMPLER)
     static bool initializeMemorySampler = false;
@@ -110,38 +94,34 @@ Ewk_Context::Ewk_Context(WKContextRef context)
 #endif
 
 #if ENABLE(SPELLCHECK)
-    ewk_text_checker_client_attach();
+    Ewk_Text_Checker::initialize();
     if (ewk_settings_continuous_spell_checking_enabled_get()) {
         // Load the default language.
         ewk_settings_spell_checking_languages_set(0);
     }
 #endif
-
-    ewk_context_request_manager_client_attach(this);
-    ewk_context_download_client_attach(this);
-    ewk_context_history_client_attach(this);
 }
 
-Ewk_Context::~Ewk_Context()
+EwkContext::~EwkContext()
 {
     ASSERT(contextMap().get(m_context.get()) == this);
     contextMap().remove(m_context.get());
 }
 
-PassRefPtr<Ewk_Context> Ewk_Context::create(WKContextRef context)
+PassRefPtr<EwkContext> EwkContext::create(WKContextRef context)
 {
     if (contextMap().contains(context))
         return contextMap().get(context); // Will be ref-ed automatically.
 
-    return adoptRef(new Ewk_Context(context));
+    return adoptRef(new EwkContext(context));
 }
 
-PassRefPtr<Ewk_Context> Ewk_Context::create()
+PassRefPtr<EwkContext> EwkContext::create()
 {
     return create(adoptWK(WKContextCreate()).get());
 }
 
-PassRefPtr<Ewk_Context> Ewk_Context::create(const String& injectedBundlePath)
+PassRefPtr<EwkContext> EwkContext::create(const String& injectedBundlePath)
 {   
     if (!fileExists(injectedBundlePath))
         return 0;
@@ -152,14 +132,14 @@ PassRefPtr<Ewk_Context> Ewk_Context::create(const String& injectedBundlePath)
     return create(contextWK.get());
 }
 
-PassRefPtr<Ewk_Context> Ewk_Context::defaultContext()
+PassRefPtr<EwkContext> EwkContext::defaultContext()
 {
-    static RefPtr<Ewk_Context> defaultInstance = create(adoptWK(WKContextCreate()).get());
+    static RefPtr<EwkContext> defaultInstance = create(adoptWK(WKContextCreate()).get());
 
     return defaultInstance;
 }
 
-Ewk_Cookie_Manager* Ewk_Context::cookieManager()
+Ewk_Cookie_Manager* EwkContext::cookieManager()
 {
     if (!m_cookieManager)
         m_cookieManager = Ewk_Cookie_Manager::create(WKContextGetCookieManager(m_context.get()));
@@ -167,206 +147,177 @@ Ewk_Cookie_Manager* Ewk_Context::cookieManager()
     return m_cookieManager.get();
 }
 
-Ewk_Favicon_Database* Ewk_Context::faviconDatabase()
+Ewk_Database_Manager* EwkContext::databaseManager()
 {
-    if (!m_faviconDatabase) {
-        WKRetainPtr<WKIconDatabaseRef> iconDatabase = WKContextGetIconDatabase(m_context.get());
-        // Set the database path if it is not open yet.
-        if (!toImpl(iconDatabase.get())->isOpen()) {
-            WebContext* webContext = toImpl(m_context.get());
-            String databasePath = webContext->iconDatabasePath() + "/" + WebCore::IconDatabase::defaultDatabaseFilename();
-            webContext->setIconDatabasePath(databasePath);
-        }
-        m_faviconDatabase = Ewk_Favicon_Database::create(iconDatabase.get());
-    }
+    return m_databaseManager.get();
+}
 
-    return m_faviconDatabase.get();
+void EwkContext::ensureFaviconDatabase()
+{
+    if (m_faviconDatabase)
+        return;
+
+    m_faviconDatabase = Ewk_Favicon_Database::create(toImpl(m_context.get())->iconDatabase());
 }
 
-bool Ewk_Context::registerURLScheme(const String& scheme, Ewk_Url_Scheme_Request_Cb callback, void* userData)
+bool EwkContext::setFaviconDatabaseDirectoryPath(const String& databaseDirectory)
 {
-    EINA_SAFETY_ON_NULL_RETURN_VAL(callback, false);
+    ensureFaviconDatabase();
+
+    WebContext* webContext = toImpl(m_context.get());
 
-    m_urlSchemeHandlers.set(scheme, Ewk_Url_Scheme_Handler(callback, userData));
-    toImpl(m_requestManager.get())->registerURIScheme(scheme);
+    // The database path is already open so its path was
+    // already set.
+    if (webContext->iconDatabase()->isOpen())
+        return false;
+
+    // If databaseDirectory is empty, we use the default database path for the platform.
+    String databasePath = databaseDirectory.isEmpty() ? webContext->iconDatabasePath() : pathByAppendingComponent(databaseDirectory, WebCore::IconDatabase::defaultDatabaseFilename());
+    webContext->setIconDatabasePath(databasePath);
 
     return true;
 }
 
+Ewk_Favicon_Database* EwkContext::faviconDatabase()
+{
+    ensureFaviconDatabase();
+    ASSERT(m_faviconDatabase);
+
+    return m_faviconDatabase.get();
+}
+
+Ewk_Storage_Manager* EwkContext::storageManager() const
+{
+    return m_storageManager.get();
+}
+
+RequestManagerClientEfl* EwkContext::requestManager()
+{
+    return m_requestManagerClient.get();
+}
+
 #if ENABLE(VIBRATION)
-PassRefPtr<VibrationProvider> Ewk_Context::vibrationProvider()
+PassRefPtr<VibrationProvider> EwkContext::vibrationProvider()
 {
     return m_vibrationProvider;
 }
 #endif
 
-void Ewk_Context::addVisitedLink(const String& visitedURL)
+void EwkContext::addVisitedLink(const String& visitedURL)
 {
     toImpl(m_context.get())->addVisitedLink(visitedURL);
 }
 
-void Ewk_Context::setCacheModel(Ewk_Cache_Model cacheModel)
+void EwkContext::setCacheModel(Ewk_Cache_Model cacheModel)
 {
     WKContextSetCacheModel(m_context.get(), static_cast<Ewk_Cache_Model>(cacheModel));
 }
 
-Ewk_Cache_Model Ewk_Context::cacheModel() const
+Ewk_Cache_Model EwkContext::cacheModel() const
 {
     return static_cast<Ewk_Cache_Model>(WKContextGetCacheModel(m_context.get()));
 }
 
-Ewk_Context* ewk_context_ref(Ewk_Context* ewkContext)
+Ewk_Cookie_Manager* ewk_context_cookie_manager_get(const Ewk_Context* ewkContext)
 {
-    EINA_SAFETY_ON_NULL_RETURN_VAL(ewkContext, 0);
+    EWK_OBJ_GET_IMPL_OR_RETURN(const EwkContext, ewkContext, impl, 0);
 
-    ewkContext->ref();
-
-    return ewkContext;
+    return const_cast<EwkContext*>(impl)->cookieManager();
 }
 
-void ewk_context_unref(Ewk_Context* ewkContext)
+Ewk_Database_Manager* ewk_context_database_manager_get(const Ewk_Context* ewkContext)
 {
-    EINA_SAFETY_ON_NULL_RETURN(ewkContext);
+    EWK_OBJ_GET_IMPL_OR_RETURN(const EwkContext, ewkContext, impl, 0);
 
-    ewkContext->deref();
+    return const_cast<EwkContext*>(impl)->databaseManager();
 }
 
-Ewk_Cookie_Manager* ewk_context_cookie_manager_get(const Ewk_Context* ewkContext)
+Eina_Bool ewk_context_favicon_database_directory_set(Ewk_Context* ewkContext, const char* directoryPath)
 {
-    EINA_SAFETY_ON_NULL_RETURN_VAL(ewkContext, 0);
+    EWK_OBJ_GET_IMPL_OR_RETURN(EwkContext, ewkContext, impl, false);
 
-    return const_cast<Ewk_Context*>(ewkContext)->cookieManager();
+    return impl->setFaviconDatabaseDirectoryPath(String::fromUTF8(directoryPath));
 }
 
 Ewk_Favicon_Database* ewk_context_favicon_database_get(const Ewk_Context* ewkContext)
 {
-    EINA_SAFETY_ON_NULL_RETURN_VAL(ewkContext, 0);
+    EWK_OBJ_GET_IMPL_OR_RETURN(const EwkContext, ewkContext, impl, 0);
 
-    return const_cast<Ewk_Context*>(ewkContext)->faviconDatabase();
+    return const_cast<EwkContext*>(impl)->faviconDatabase();
 }
 
-WKContextRef Ewk_Context::wkContext()
+Ewk_Storage_Manager* ewk_context_storage_manager_get(const Ewk_Context* ewkContext)
 {
-    return m_context.get();
-}
-
-/**
- * @internal
- * Registers that a new download has been requested.
- */
-void Ewk_Context::addDownloadJob(Ewk_Download_Job* ewkDownload)
-{
-    EINA_SAFETY_ON_NULL_RETURN(ewkDownload);
-
-    uint64_t downloadId = ewkDownload->id();
-    if (m_downloadJobs.contains(downloadId))
-        return;
-
-    m_downloadJobs.add(downloadId, ewkDownload);
-}
+    EWK_OBJ_GET_IMPL_OR_RETURN(const EwkContext, ewkContext, impl, 0);
 
-/**
- * @internal
- * Returns the #Ewk_Download_Job with the given @a downloadId, or
- * @c 0 in case of failure.
- */
-Ewk_Download_Job* Ewk_Context::downloadJob(uint64_t downloadId)
-{
-    return m_downloadJobs.get(downloadId).get();
+    return impl->storageManager();
 }
 
-/**
- * @internal
- * Removes the #Ewk_Download_Job with the given @a downloadId from the internal
- * HashMap.
- */
-void Ewk_Context::removeDownloadJob(uint64_t downloadId)
+WKContextRef EwkContext::wkContext()
 {
-    m_downloadJobs.remove(downloadId);
+    return m_context.get();
 }
 
-/**
- * Retrieve the request manager for @a ewkContext.
- *
- * @param ewkContext a #Ewk_Context object.
- */
-WKSoupRequestManagerRef Ewk_Context::requestManager()
+DownloadManagerEfl* EwkContext::downloadManager() const
 {
-    return m_requestManager.get();
+    return m_downloadManager.get();
 }
 
-/**
- * @internal
- * A new URL request was received.
- *
- * @param ewkContext a #Ewk_Context object.
- * @param schemeRequest a #Ewk_Url_Scheme_Request object.
- */
-void Ewk_Context::urlSchemeRequestReceived(Ewk_Url_Scheme_Request* schemeRequest)
+ContextHistoryClientEfl* EwkContext::historyClient()
 {
-    EINA_SAFETY_ON_NULL_RETURN(schemeRequest);
-
-    Ewk_Url_Scheme_Handler handler = m_urlSchemeHandlers.get(schemeRequest->scheme());
-    if (!handler.callback)
-        return;
-
-    handler.callback(schemeRequest, handler.userData);
+    return m_historyClient.get();
 }
 
 Ewk_Context* ewk_context_default_get()
 {
-    return Ewk_Context::defaultContext().get();
+    return EwkContext::defaultContext().get();
 }
 
 Ewk_Context* ewk_context_new()
 {
-    return Ewk_Context::create().leakRef();
+    return EwkContext::create().leakRef();
 }
 
 Ewk_Context* ewk_context_new_with_injected_bundle_path(const char* path)
 {
     EINA_SAFETY_ON_NULL_RETURN_VAL(path, 0);
 
-    return Ewk_Context::create(String::fromUTF8(path)).leakRef();
+    return EwkContext::create(String::fromUTF8(path)).leakRef();
 }
 
 Eina_Bool ewk_context_url_scheme_register(Ewk_Context* ewkContext, const char* scheme, Ewk_Url_Scheme_Request_Cb callback, void* userData)
 {
-    EINA_SAFETY_ON_NULL_RETURN_VAL(ewkContext, false);
+    EWK_OBJ_GET_IMPL_OR_RETURN(EwkContext, ewkContext, impl, false);
     EINA_SAFETY_ON_NULL_RETURN_VAL(scheme, false);
+    EINA_SAFETY_ON_NULL_RETURN_VAL(callback, false);
 
-    return ewkContext->registerURLScheme(String::fromUTF8(scheme), callback, userData);
+    impl->requestManager()->registerURLSchemeHandler(String::fromUTF8(scheme), callback, userData);
+
+    return true;
 }
 
 void ewk_context_vibration_client_callbacks_set(Ewk_Context* ewkContext, Ewk_Vibration_Client_Vibrate_Cb vibrate, Ewk_Vibration_Client_Vibration_Cancel_Cb cancel, void* data)
 {
-    EINA_SAFETY_ON_NULL_RETURN(ewkContext);
+    EWK_OBJ_GET_IMPL_OR_RETURN(EwkContext, ewkContext, impl);
 
 #if ENABLE(VIBRATION)
-    ewkContext->vibrationProvider()->setVibrationClientCallbacks(vibrate, cancel, data);
+    impl->vibrationProvider()->setVibrationClientCallbacks(vibrate, cancel, data);
 #endif
 }
 
 void ewk_context_history_callbacks_set(Ewk_Context* ewkContext, Ewk_History_Navigation_Cb navigate, Ewk_History_Client_Redirection_Cb clientRedirect, Ewk_History_Server_Redirection_Cb serverRedirect, Ewk_History_Title_Update_Cb titleUpdate, Ewk_History_Populate_Visited_Links_Cb populateVisitedLinks, void* data)
 {
-    EINA_SAFETY_ON_NULL_RETURN(ewkContext);
+    EWK_OBJ_GET_IMPL_OR_RETURN(EwkContext, ewkContext, impl);
 
-    Ewk_Context_History_Client& historyClient = ewkContext->historyClient();
-    historyClient.navigate_func = navigate;
-    historyClient.client_redirect_func = clientRedirect;
-    historyClient.server_redirect_func = serverRedirect;
-    historyClient.title_update_func = titleUpdate;
-    historyClient.populate_visited_links_func = populateVisitedLinks;
-    historyClient.user_data = data;
+    impl->historyClient()->setCallbacks(navigate, clientRedirect, serverRedirect, titleUpdate, populateVisitedLinks, data);
 }
 
-
 void ewk_context_visited_link_add(Ewk_Context* ewkContext, const char* visitedURL)
 {
-    EINA_SAFETY_ON_NULL_RETURN(ewkContext);
+    EWK_OBJ_GET_IMPL_OR_RETURN(EwkContext, ewkContext, impl);
     EINA_SAFETY_ON_NULL_RETURN(visitedURL);
 
-    ewkContext->addVisitedLink(visitedURL);
+    impl->addVisitedLink(visitedURL);
 }
 
 // Ewk_Cache_Model enum validation
@@ -376,17 +327,17 @@ COMPILE_ASSERT_MATCHING_ENUM(EWK_CACHE_MODEL_PRIMARY_WEBBROWSER, kWKCacheModelPr
 
 Eina_Bool ewk_context_cache_model_set(Ewk_Context* ewkContext, Ewk_Cache_Model cacheModel)
 {
-    EINA_SAFETY_ON_NULL_RETURN_VAL(ewkContext, false);
+    EWK_OBJ_GET_IMPL_OR_RETURN(EwkContext, ewkContext, impl, false);
 
-    ewkContext->setCacheModel(cacheModel);
+    impl->setCacheModel(cacheModel);
 
     return true;
 }
 
 Ewk_Cache_Model ewk_context_cache_model_get(const Ewk_Context* ewkContext)
 {
-    EINA_SAFETY_ON_NULL_RETURN_VAL(ewkContext, EWK_CACHE_MODEL_DOCUMENT_VIEWER);
+    EWK_OBJ_GET_IMPL_OR_RETURN(const EwkContext, ewkContext, impl, EWK_CACHE_MODEL_DOCUMENT_VIEWER);
 
-    return ewkContext->cacheModel();
+    return impl->cacheModel();
 }
 
diff --git a/Source/WebKit2/UIProcess/API/efl/ewk_context.h b/Source/WebKit2/UIProcess/API/efl/ewk_context.h
index f6b8bb67d..4a8e95655 100644
--- a/Source/WebKit2/UIProcess/API/efl/ewk_context.h
+++ b/Source/WebKit2/UIProcess/API/efl/ewk_context.h
@@ -38,8 +38,10 @@
 #define ewk_context_h
 
 #include "ewk_cookie_manager.h"
+#include "ewk_database_manager.h"
 #include "ewk_favicon_database.h"
 #include "ewk_navigation_data.h"
+#include "ewk_storage_manager.h"
 #include "ewk_url_scheme_request.h"
 #include <Evas.h>
 
@@ -47,8 +49,12 @@
 extern "C" {
 #endif
 
-/** Creates a type name for @a Ewk_Context. */
-typedef struct Ewk_Context Ewk_Context;
+/**
+ * Declare Ewk_Context as Ewk_Object.
+ *
+ * @see Ewk_Object
+ */
+typedef struct Ewk_Object Ewk_Context;
 
 /**
  * \enum    Ewk_Cache_Model
@@ -120,24 +126,6 @@ typedef void (*Ewk_History_Title_Update_Cb)(const Evas_Object *view, const char
 typedef void (*Ewk_History_Populate_Visited_Links_Cb)(void *user_data);
 
 /**
- * Increases the reference count of the given object.
- *
- * @param context context object to increase the reference count
- *
- * @return Ewk_Context object on success or @c NULL on failure
- */
-EAPI Ewk_Context *ewk_context_ref(Ewk_Context *context);
-
-/**
- * Decreases the reference count of the given object, possibly freeing it.
- *
- * When the reference count it's reached 0, the Ewk_Context is freed.
- *
- * @param context context object to decrease the reference count
- */
-EAPI void ewk_context_unref(Ewk_Context *context);
-
-/**
  * Gets default Ewk_Context instance.
  *
  * The returned Ewk_Context object @b should not be unref'ed if application
@@ -183,6 +171,34 @@ EAPI Ewk_Context *ewk_context_new_with_injected_bundle_path(const char *path);
 EAPI Ewk_Cookie_Manager *ewk_context_cookie_manager_get(const Ewk_Context *context);
 
 /**
+ * Gets the database manager instance for this @a context.
+ *
+ * @param context context object to query
+ *
+ * @return Ewk_Database_Manager object instance or @c NULL in case of failure
+ */
+EAPI Ewk_Database_Manager *ewk_context_database_manager_get(const Ewk_Context *context);
+
+/**
+ * Sets the favicon database directory for this @a context.
+ *
+ * Sets the directory path to be used to store the favicons database
+ * for @a context on disk. Passing @c NULL as @a directory_path will
+ * result in using the default directory for the platform.
+ *
+ * Calling this method also means enabling the favicons database for
+ * its use from the applications, it is therefore expected to be
+ * called only once. Further calls for the same instance of
+ * @a context will not have any effect.
+ *
+ * @param context context object to update
+ * @param directory_path database directory path to set
+ *
+ * @return @c EINA_TRUE if successful, @c EINA_FALSE otherwise
+ */
+EAPI Eina_Bool ewk_context_favicon_database_directory_set(Ewk_Context *context, const char *directory_path);
+
+/**
  * Gets the favicon database instance for this @a context.
  *
  * @param context context object to query.
@@ -192,6 +208,15 @@ EAPI Ewk_Cookie_Manager *ewk_context_cookie_manager_get(const Ewk_Context *conte
 EAPI Ewk_Favicon_Database *ewk_context_favicon_database_get(const Ewk_Context *context);
 
 /**
+ * Gets the storage manager instance for this @a context.
+ *
+ * @param context context object to query.
+ *
+ * @return Ewk_Storage_Manager object instance or @c NULL in case of failure.
+ */
+EAPI Ewk_Storage_Manager *ewk_context_storage_manager_get(const Ewk_Context *context);
+
+/**
  * Register @a scheme in @a context.
  *
  * When an URL request with @a scheme is made in the #Ewk_Context, the callback
diff --git a/Source/WebKit2/UIProcess/API/efl/ewk_context_download_client.cpp b/Source/WebKit2/UIProcess/API/efl/ewk_context_download_client.cpp
deleted file mode 100644
index 2fa86e9a7..000000000
--- a/Source/WebKit2/UIProcess/API/efl/ewk_context_download_client.cpp
+++ /dev/null
@@ -1,142 +0,0 @@
-/*
- * Copyright (C) 2012 Intel Corporation. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
- * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
- * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
- * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
- * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
- * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
- * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
- * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
- * THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "config.h"
-
-#include "DownloadProxy.h"
-#include "WKAPICast.h"
-#include "WKContext.h"
-#include "WKString.h"
-#include "ewk_context_download_client_private.h"
-#include "ewk_context_private.h"
-#include "ewk_download_job.h"
-#include "ewk_download_job_private.h"
-#include "ewk_error_private.h"
-#include "ewk_url_response.h"
-#include "ewk_url_response_private.h"
-#include "ewk_view_private.h"
-#include <string.h>
-#include <wtf/OwnPtr.h>
-#include <wtf/text/CString.h>
-
-using namespace WebKit;
-
-static inline Ewk_Context* toEwkContext(const void* clientInfo)
-{
-    return static_cast<Ewk_Context*>(const_cast<void*>(clientInfo));
-}
-
-static WKStringRef decideDestinationWithSuggestedFilename(WKContextRef, WKDownloadRef wkDownload, WKStringRef filename, bool* /*allowOverwrite*/, const void* clientInfo)
-{
-    Ewk_Download_Job* download = toEwkContext(clientInfo)->downloadJob(toImpl(wkDownload)->downloadID());
-    ASSERT(download);
-
-    download->setSuggestedFileName(toImpl(filename)->string().utf8().data());
-
-    // We send the new download signal on the Ewk_View only once we have received the response
-    // and the suggested file name.
-    ewk_view_download_job_requested(download->view(), download);
-
-    // DownloadSoup expects the destination to be a URL.
-    String destination = ASCIILiteral("file://") + String::fromUTF8(download->destination());
-
-    return WKStringCreateWithUTF8CString(destination.utf8().data());
-}
-
-static void didReceiveResponse(WKContextRef, WKDownloadRef wkDownload, WKURLResponseRef wkResponse, const void* clientInfo)
-{
-    Ewk_Download_Job* download = toEwkContext(clientInfo)->downloadJob(toImpl(wkDownload)->downloadID());
-    ASSERT(download);
-    download->setResponse(Ewk_Url_Response::create(wkResponse));
-}
-
-static void didCreateDestination(WKContextRef, WKDownloadRef wkDownload, WKStringRef /*path*/, const void* clientInfo)
-{
-    Ewk_Download_Job* download = toEwkContext(clientInfo)->downloadJob(toImpl(wkDownload)->downloadID());
-    ASSERT(download);
-
-    download->setState(EWK_DOWNLOAD_JOB_STATE_DOWNLOADING);
-}
-
-static void didReceiveData(WKContextRef, WKDownloadRef wkDownload, uint64_t length, const void* clientInfo)
-{
-    Ewk_Download_Job* download = toEwkContext(clientInfo)->downloadJob(toImpl(wkDownload)->downloadID());
-    ASSERT(download);
-    download->incrementReceivedData(length);
-}
-
-static void didFail(WKContextRef, WKDownloadRef wkDownload, WKErrorRef error, const void* clientInfo)
-{
-    uint64_t downloadId = toImpl(wkDownload)->downloadID();
-    Ewk_Download_Job* download = toEwkContext(clientInfo)->downloadJob(downloadId);
-    ASSERT(download);
-
-    OwnPtr<Ewk_Error> ewkError = Ewk_Error::create(error);
-    download->setState(EWK_DOWNLOAD_JOB_STATE_FAILED);
-    ewk_view_download_job_failed(download->view(), download, ewkError.get());
-    toEwkContext(clientInfo)->removeDownloadJob(downloadId);
-}
-
-static void didCancel(WKContextRef, WKDownloadRef wkDownload, const void* clientInfo)
-{
-    uint64_t downloadId = toImpl(wkDownload)->downloadID();
-    Ewk_Download_Job* download = toEwkContext(clientInfo)->downloadJob(downloadId);
-    ASSERT(download);
-
-    download->setState(EWK_DOWNLOAD_JOB_STATE_CANCELLED);
-    ewk_view_download_job_cancelled(download->view(), download);
-    toEwkContext(clientInfo)->removeDownloadJob(downloadId);
-}
-
-static void didFinish(WKContextRef, WKDownloadRef wkDownload, const void* clientInfo)
-{
-    uint64_t downloadId = toImpl(wkDownload)->downloadID();
-    Ewk_Download_Job* download = toEwkContext(clientInfo)->downloadJob(downloadId);
-    ASSERT(download);
-
-    download->setState(EWK_DOWNLOAD_JOB_STATE_FINISHED);
-    ewk_view_download_job_finished(download->view(), download);
-    toEwkContext(clientInfo)->removeDownloadJob(downloadId);
-}
-
-void ewk_context_download_client_attach(Ewk_Context* ewkContext)
-{
-    WKContextDownloadClient wkDownloadClient;
-    memset(&wkDownloadClient, 0, sizeof(WKContextDownloadClient));
-
-    wkDownloadClient.version = kWKContextDownloadClientCurrentVersion;
-    wkDownloadClient.clientInfo = ewkContext;
-    wkDownloadClient.didCancel = didCancel;
-    wkDownloadClient.decideDestinationWithSuggestedFilename = decideDestinationWithSuggestedFilename;
-    wkDownloadClient.didCreateDestination = didCreateDestination;
-    wkDownloadClient.didReceiveResponse = didReceiveResponse;
-    wkDownloadClient.didReceiveData = didReceiveData;
-    wkDownloadClient.didFail = didFail;
-    wkDownloadClient.didFinish = didFinish;
-
-    WKContextSetDownloadClient(ewkContext->wkContext(), &wkDownloadClient);
-}
-
-
diff --git a/Source/WebKit2/UIProcess/API/efl/ewk_context_history_client.cpp b/Source/WebKit2/UIProcess/API/efl/ewk_context_history_client.cpp
deleted file mode 100644
index 4f793b9d0..000000000
--- a/Source/WebKit2/UIProcess/API/efl/ewk_context_history_client.cpp
+++ /dev/null
@@ -1,125 +0,0 @@
-/*
- * Copyright (C) 2012 Intel Corporation. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
- * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
- * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
- * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
- * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
- * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
- * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
- * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
- * THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "config.h"
-#include "ewk_context.h"
-
-#include "DownloadProxy.h"
-#include "WKAPICast.h"
-#include "WKContext.h"
-#include "WKEinaSharedString.h"
-#include "WKString.h"
-#include "ewk_context_history_client_private.h"
-#include "ewk_context_private.h"
-#include "ewk_navigation_data.h"
-#include "ewk_navigation_data_private.h"
-#include "ewk_url_response.h"
-#include "ewk_url_response_private.h"
-#include "ewk_view_private.h"
-
-using namespace WebKit;
-
-static inline const Ewk_Context_History_Client& getEwkHistoryClient(const void* clientInfo)
-{
-    ASSERT(clientInfo);
-    return static_cast<const Ewk_Context*>(clientInfo)->historyClient();
-}
-
-static void didNavigateWithNavigationData(WKContextRef, WKPageRef page, WKNavigationDataRef navigationData, WKFrameRef, const void* clientInfo)
-{
-    const Ewk_Context_History_Client& historyClient = getEwkHistoryClient(clientInfo);
-
-    if (!historyClient.navigate_func)
-        return;
-
-    RefPtr<Ewk_Navigation_Data> navigationDataEwk = Ewk_Navigation_Data::create(navigationData);
-    historyClient.navigate_func(ewk_view_from_page_get(toImpl(page)), navigationDataEwk.get(), historyClient.user_data);
-}
-
-static void didPerformClientRedirect(WKContextRef, WKPageRef page, WKURLRef sourceURL, WKURLRef destinationURL, WKFrameRef, const void* clientInfo)
-{
-    const Ewk_Context_History_Client& historyClient = getEwkHistoryClient(clientInfo);
-
-    if (!historyClient.client_redirect_func)
-        return;
-
-    WKEinaSharedString sourceURLString(sourceURL);
-    WKEinaSharedString destinationURLString(destinationURL);
-
-    historyClient.client_redirect_func(ewk_view_from_page_get(toImpl(page)), sourceURLString, destinationURLString, historyClient.user_data);
-}
-
-static void didPerformServerRedirect(WKContextRef, WKPageRef page, WKURLRef sourceURL, WKURLRef destinationURL, WKFrameRef, const void* clientInfo)
-{
-    const Ewk_Context_History_Client& historyClient = getEwkHistoryClient(clientInfo);
-
-    if (!historyClient.server_redirect_func)
-        return;
-
-    WKEinaSharedString sourceURLString(sourceURL);
-    WKEinaSharedString destinationURLString(destinationURL);
-
-    historyClient.server_redirect_func(ewk_view_from_page_get(toImpl(page)), sourceURLString, destinationURLString, historyClient.user_data);
-}
-
-static void didUpdateHistoryTitle(WKContextRef, WKPageRef page, WKStringRef title, WKURLRef URL, WKFrameRef, const void* clientInfo)
-{
-    const Ewk_Context_History_Client& historyClient = getEwkHistoryClient(clientInfo);
-
-    if (!historyClient.title_update_func)
-        return;
-
-    WKEinaSharedString titleString(title);
-    WKEinaSharedString stringURL(URL);
-
-    historyClient.title_update_func(ewk_view_from_page_get(toImpl(page)), titleString, stringURL, historyClient.user_data);
-}
-
-static void populateVisitedLinks(WKContextRef, const void* clientInfo)
-{
-    const Ewk_Context_History_Client& historyClient = getEwkHistoryClient(clientInfo);
-
-    if (!historyClient.populate_visited_links_func)
-        return;
-
-    historyClient.populate_visited_links_func(historyClient.user_data);
-}
-
-void ewk_context_history_client_attach(Ewk_Context* ewkContext)
-{
-    WKContextHistoryClient wkHistoryClient;
-    memset(&wkHistoryClient, 0, sizeof(WKContextHistoryClient));
-
-    wkHistoryClient.version = kWKContextHistoryClientCurrentVersion;
-    wkHistoryClient.clientInfo = ewkContext;
-
-    wkHistoryClient.didNavigateWithNavigationData = didNavigateWithNavigationData;
-    wkHistoryClient.didPerformClientRedirect = didPerformClientRedirect;
-    wkHistoryClient.didPerformServerRedirect = didPerformServerRedirect;
-    wkHistoryClient.didUpdateHistoryTitle = didUpdateHistoryTitle;
-    wkHistoryClient.populateVisitedLinks = populateVisitedLinks;
-
-    WKContextSetHistoryClient(ewkContext->wkContext(), &wkHistoryClient);
-}
diff --git a/Source/WebKit2/UIProcess/API/efl/ewk_context_private.h b/Source/WebKit2/UIProcess/API/efl/ewk_context_private.h
index 489f05189..4ddb65324 100644
--- a/Source/WebKit2/UIProcess/API/efl/ewk_context_private.h
+++ b/Source/WebKit2/UIProcess/API/efl/ewk_context_private.h
@@ -20,14 +20,18 @@
 #ifndef ewk_context_private_h
 #define ewk_context_private_h
 
+#include "DownloadManagerEfl.h"
 #include "WKAPICast.h"
 #include "WKRetainPtr.h"
-#include "ewk_context_history_client_private.h"
+#include "ewk_context.h"
+#include "ewk_object_private.h"
 
-class Ewk_Download_Job;
-class Ewk_Url_Scheme_Request;
 class Ewk_Cookie_Manager;
 class Ewk_Favicon_Database;
+
+namespace WebKit {
+class ContextHistoryClientEfl;
+class RequestManagerClientEfl;
 #if ENABLE(BATTERY_STATUS)
 class BatteryProvider;
 #endif
@@ -37,25 +41,33 @@ class NetworkInfoProvider;
 #if ENABLE(VIBRATION)
 class VibrationProvider;
 #endif
+}
 
-class Ewk_Context : public RefCounted<Ewk_Context> {
+class EwkContext : public Ewk_Object {
 public:
-    static PassRefPtr<Ewk_Context> create(WKContextRef context);
-    static PassRefPtr<Ewk_Context> create();
-    static PassRefPtr<Ewk_Context> create(const String& injectedBundlePath);
+    EWK_OBJECT_DECLARE(EwkContext)
+
+    static PassRefPtr<EwkContext> create(WKContextRef context);
+    static PassRefPtr<EwkContext> create();
+    static PassRefPtr<EwkContext> create(const String& injectedBundlePath);
 
-    static PassRefPtr<Ewk_Context> defaultContext();
+    static PassRefPtr<EwkContext> defaultContext();
 
-    ~Ewk_Context();
+    ~EwkContext();
 
     Ewk_Cookie_Manager* cookieManager();
 
+    Ewk_Database_Manager* databaseManager();
+
+    bool setFaviconDatabaseDirectoryPath(const String& databaseDirectory);
     Ewk_Favicon_Database* faviconDatabase();
 
-    bool registerURLScheme(const String& scheme, Ewk_Url_Scheme_Request_Cb callback, void* userData);
+    Ewk_Storage_Manager* storageManager() const;
+
+    WebKit::RequestManagerClientEfl* requestManager();
 
 #if ENABLE(VIBRATION)
-    PassRefPtr<VibrationProvider> vibrationProvider();
+    PassRefPtr<WebKit::VibrationProvider> vibrationProvider();
 #endif
 
     void addVisitedLink(const String& visitedURL);
@@ -66,41 +78,34 @@ public:
 
     WKContextRef wkContext();
 
-    WKSoupRequestManagerRef requestManager();
-
-    void urlSchemeRequestReceived(Ewk_Url_Scheme_Request*);
+    WebKit::DownloadManagerEfl* downloadManager() const;
 
-    void addDownloadJob(Ewk_Download_Job*);
-    Ewk_Download_Job* downloadJob(uint64_t downloadId);
-    void removeDownloadJob(uint64_t downloadId);
-
-    const Ewk_Context_History_Client& historyClient() const  { return m_historyClient; }
-    Ewk_Context_History_Client& historyClient() { return m_historyClient; }
+    WebKit::ContextHistoryClientEfl* historyClient();
 
 private:
-    explicit Ewk_Context(WKContextRef);
+    explicit EwkContext(WKContextRef);
+
+    void ensureFaviconDatabase();
 
     WKRetainPtr<WKContextRef> m_context;
 
     OwnPtr<Ewk_Cookie_Manager> m_cookieManager;
+    OwnPtr<Ewk_Database_Manager> m_databaseManager;
     OwnPtr<Ewk_Favicon_Database> m_faviconDatabase;
+    OwnPtr<Ewk_Storage_Manager> m_storageManager;
 #if ENABLE(BATTERY_STATUS)
-    RefPtr<BatteryProvider> m_batteryProvider;
+    RefPtr<WebKit::BatteryProvider> m_batteryProvider;
 #endif
 #if ENABLE(NETWORK_INFO)
-    RefPtr<NetworkInfoProvider> m_networkInfoProvider;
+    RefPtr<WebKit::NetworkInfoProvider> m_networkInfoProvider;
 #endif
 #if ENABLE(VIBRATION)
-    RefPtr<VibrationProvider> m_vibrationProvider;
+    RefPtr<WebKit::VibrationProvider> m_vibrationProvider;
 #endif
-    HashMap<uint64_t, RefPtr<Ewk_Download_Job> > m_downloadJobs;
-
-    WKRetainPtr<WKSoupRequestManagerRef> m_requestManager;
-
-    typedef HashMap<String, class Ewk_Url_Scheme_Handler> URLSchemeHandlerMap;
-    URLSchemeHandlerMap m_urlSchemeHandlers;
+    OwnPtr<WebKit::DownloadManagerEfl> m_downloadManager;
+    OwnPtr<WebKit::RequestManagerClientEfl> m_requestManagerClient;
 
-    Ewk_Context_History_Client m_historyClient;
+    OwnPtr<WebKit::ContextHistoryClientEfl> m_historyClient;
 };
 
 #endif // ewk_context_private_h
diff --git a/Source/WebKit2/UIProcess/API/efl/ewk_database_manager.cpp b/Source/WebKit2/UIProcess/API/efl/ewk_database_manager.cpp
new file mode 100644
index 000000000..ddc13b494
--- /dev/null
+++ b/Source/WebKit2/UIProcess/API/efl/ewk_database_manager.cpp
@@ -0,0 +1,96 @@
+/*
+ * Copyright (C) 2012 Samsung Electronics. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT HOLDER OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
+ * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "ewk_database_manager.h"
+
+#include "WKAPICast.h"
+#include "WKArray.h"
+#include "WKDatabaseManager.h"
+#include "ewk_database_manager_private.h"
+#include "ewk_error_private.h"
+#include "ewk_security_origin.h"
+#include "ewk_security_origin_private.h"
+#include <wtf/RefCounted.h>
+
+using namespace WebKit;
+
+Ewk_Database_Manager::Ewk_Database_Manager(WKDatabaseManagerRef databaseManagerRef)
+    : m_databaseManager(databaseManagerRef)
+{ }
+
+void Ewk_Database_Manager::getDatabaseOrigins(WKDatabaseManagerGetDatabaseOriginsFunction callback, void* context) const
+{
+    WKDatabaseManagerGetDatabaseOrigins(m_databaseManager.get(), context, callback);
+}
+
+Eina_List* Ewk_Database_Manager::createOriginList(WKArrayRef origins) const
+{
+    Eina_List* originList = 0;
+    const size_t length = WKArrayGetSize(origins);
+
+    for (size_t i = 0; i < length; ++i) {
+        WKSecurityOriginRef wkOriginRef = static_cast<WKSecurityOriginRef>(WKArrayGetItemAtIndex(origins, i));
+        RefPtr<Ewk_Security_Origin> origin = m_wrapperCache.get(wkOriginRef);
+        if (!origin) {
+            origin = Ewk_Security_Origin::create(wkOriginRef);
+            m_wrapperCache.set(wkOriginRef, origin);
+        }
+        originList = eina_list_append(originList, origin.release().leakRef());
+    }
+
+    return originList;
+}
+
+struct Ewk_Database_Origins_Async_Get_Context {
+    const Ewk_Database_Manager* manager;
+    Ewk_Database_Origins_Get_Cb callback;
+    void* userData;
+
+    Ewk_Database_Origins_Async_Get_Context(const Ewk_Database_Manager* manager, Ewk_Database_Origins_Get_Cb callback, void* userData)
+        : manager(manager)
+        , callback(callback)
+        , userData(userData)
+    { }
+};
+
+static void getDatabaseOriginsCallback(WKArrayRef origins, WKErrorRef wkError, void* context)
+{
+    OwnPtr<Ewk_Database_Origins_Async_Get_Context*> webDatabaseContext = adoptPtr(static_cast<Ewk_Database_Origins_Async_Get_Context*>(context));
+    Eina_List* originList = webDatabaseContext->manager->createOriginList(origins);
+    OwnPtr<Ewk_Error> ewkError = Ewk_Error::create(wkError);
+    webDatabaseContext->callback(originList, ewkError.get(), webDatabaseContext->userData);
+}
+
+Eina_Bool ewk_database_manager_origins_get(const Ewk_Database_Manager* ewkDatabaseManager, Ewk_Database_Origins_Get_Cb callback, void* userData)
+{
+    EINA_SAFETY_ON_NULL_RETURN_VAL(ewkDatabaseManager, false);
+    EINA_SAFETY_ON_NULL_RETURN_VAL(callback, false);
+
+    Ewk_Database_Origins_Async_Get_Context* context = new Ewk_Database_Origins_Async_Get_Context(ewkDatabaseManager, callback, userData);
+    ewkDatabaseManager->getDatabaseOrigins(getDatabaseOriginsCallback, context);
+
+    return true;
+}
diff --git a/Source/WebKit2/UIProcess/API/efl/ewk_database_manager.h b/Source/WebKit2/UIProcess/API/efl/ewk_database_manager.h
new file mode 100644
index 000000000..dc8236c5b
--- /dev/null
+++ b/Source/WebKit2/UIProcess/API/efl/ewk_database_manager.h
@@ -0,0 +1,73 @@
+/*
+ * Copyright (C) 2012 Samsung Electronics. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT HOLDER OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
+ * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+/**
+ * @file   ewk_database_manager.h
+ * @brief  Describes the Ewk Database Manager API.
+ *
+ * Ewk Database Manager manages web database.
+ */
+
+#ifndef ewk_database_manager_h
+#define ewk_database_manager_h
+
+#include "ewk_error.h"
+#include <Eina.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/** Creates a type name for Ewk_Database_Manager. */
+typedef struct Ewk_Database_Manager Ewk_Database_Manager;
+
+/**
+ * @typedef Ewk_Database_Origins_Get_Cb Ewk_Database_Origins_Get_Cb
+ * @brief Callback type for use with ewk_database_manager_origins_get()
+ *
+ * @param origins @c Eina_List containing @c Ewk_Security_Origin elements or @c NULL in case of error,
+ *                        the Eina_List and its items should be freed after use. Use ewk_security_origin_unref()
+ *                        to free the items
+ */
+typedef void (*Ewk_Database_Origins_Get_Cb)(Eina_List *origins, Ewk_Error *error, void *user_data);
+
+/**
+ * Gets list of origins using web database asynchronously.
+ *
+ * This function allocates memory for context structure made from callback and user_data.
+ *
+ * @param manager Ewk_Database_Manager object
+ * @param callback callback to get database origins
+ * @param user_data user_data will be passed when result_callback is called,
+ *    -i.e., user data will be kept until callback is called
+ *
+ * @return @c EINA_TRUE on success, @c EINA_FALSE on failure
+ */
+EAPI Eina_Bool ewk_database_manager_origins_get(const Ewk_Database_Manager *manager, Ewk_Database_Origins_Get_Cb callback, void *user_data);
+
+#ifdef __cplusplus
+}
+#endif
+#endif // ewk_database_manager_h
diff --git a/Source/WebKit2/UIProcess/API/efl/ewk_database_manager_private.h b/Source/WebKit2/UIProcess/API/efl/ewk_database_manager_private.h
new file mode 100644
index 000000000..1b4a66164
--- /dev/null
+++ b/Source/WebKit2/UIProcess/API/efl/ewk_database_manager_private.h
@@ -0,0 +1,51 @@
+/*
+ * Copyright (C) 2012 Samsung Electronics. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT HOLDER OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
+ * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef ewk_database_manager_private_h
+#define ewk_database_manager_private_h
+
+#include "WKDatabaseManager.h"
+#include "WKRetainPtr.h"
+#include "ewk_security_origin_private.h"
+#include <WebKit2/WKBase.h>
+#include <wtf/PassOwnPtr.h>
+
+class Ewk_Database_Manager {
+public:
+    static PassOwnPtr<Ewk_Database_Manager> create(WKDatabaseManagerRef databaseManagerRef)
+    {
+        return adoptPtr(new Ewk_Database_Manager(databaseManagerRef));
+    }
+
+    Eina_List* createOriginList(WKArrayRef wkList) const;
+    void getDatabaseOrigins(WKDatabaseManagerGetDatabaseOriginsFunction callback, void* context) const;
+
+private:
+    explicit Ewk_Database_Manager(WKDatabaseManagerRef);
+
+    WKRetainPtr<WKDatabaseManagerRef> m_databaseManager;
+    mutable HashMap<WKSecurityOriginRef, RefPtr<Ewk_Security_Origin> > m_wrapperCache;
+};
+#endif // ewk_database_manager_private_h
diff --git a/Source/WebKit2/UIProcess/API/efl/ewk_download_job.cpp b/Source/WebKit2/UIProcess/API/efl/ewk_download_job.cpp
index 7dc3a1784..3ad7d4dbc 100644
--- a/Source/WebKit2/UIProcess/API/efl/ewk_download_job.cpp
+++ b/Source/WebKit2/UIProcess/API/efl/ewk_download_job.cpp
@@ -36,36 +36,20 @@
 
 using namespace WebKit;
 
-Ewk_Download_Job::Ewk_Download_Job(WebKit::DownloadProxy* download, Evas_Object* ewkView)
+EwkDownloadJob::EwkDownloadJob(WebKit::DownloadProxy* download, EwkViewImpl* viewImpl)
     : m_downloadProxy(download)
-    , m_view(ewkView)
+    , m_viewImpl(viewImpl)
     , m_state(EWK_DOWNLOAD_JOB_STATE_NOT_STARTED)
     , m_startTime(-1)
     , m_endTime(-1)
     , m_downloaded(0)
 { }
 
-Ewk_Download_Job* ewk_download_job_ref(Ewk_Download_Job* download)
-{
-    EINA_SAFETY_ON_NULL_RETURN_VAL(download, 0);
-
-    download->ref();
-
-    return download;
-}
-
-void ewk_download_job_unref(Ewk_Download_Job* download)
-{
-    EINA_SAFETY_ON_NULL_RETURN(download);
-
-    download->deref();
-}
-
 /**
  * @internal
  * Queries the identifier for this download
  */
-uint64_t Ewk_Download_Job::id() const
+uint64_t EwkDownloadJob::id() const
 {
     return m_downloadProxy->downloadID();
 }
@@ -75,35 +59,35 @@ uint64_t Ewk_Download_Job::id() const
  * Returns the view this download is attached to.
  * The view is needed to send notification signals.
  */
-Evas_Object* Ewk_Download_Job::view() const
+EwkViewImpl* EwkDownloadJob::viewImpl() const
 {
-    return m_view;
+    return m_viewImpl;
 }
 
 Ewk_Download_Job_State ewk_download_job_state_get(const Ewk_Download_Job* download)
 {
-    EINA_SAFETY_ON_NULL_RETURN_VAL(download, EWK_DOWNLOAD_JOB_STATE_UNKNOWN);
+    EWK_OBJ_GET_IMPL_OR_RETURN(const EwkDownloadJob, download, impl, EWK_DOWNLOAD_JOB_STATE_UNKNOWN);
 
-    return download->state();
+    return impl->state();
 }
 
-Ewk_Download_Job_State Ewk_Download_Job::state() const
+Ewk_Download_Job_State EwkDownloadJob::state() const
 {
     return m_state;
 }
 
 Ewk_Url_Request* ewk_download_job_request_get(const Ewk_Download_Job* download)
 {
-    EINA_SAFETY_ON_NULL_RETURN_VAL(download, 0);
+    EWK_OBJ_GET_IMPL_OR_RETURN(const EwkDownloadJob, download, impl, 0);
 
-    return download->request();
+    return impl->request();
 }
 
-Ewk_Url_Request* Ewk_Download_Job::request() const
+EwkUrlRequest* EwkDownloadJob::request() const
 {
     if (!m_request) {
         WKRetainPtr<WKURLRequestRef> wkURLRequest(AdoptWK, toAPI(WebURLRequest::create(m_downloadProxy->request()).leakRef()));
-        m_request = Ewk_Url_Request::create(wkURLRequest.get());
+        m_request = EwkUrlRequest::create(wkURLRequest.get());
     }
 
     return m_request.get();
@@ -111,63 +95,63 @@ Ewk_Url_Request* Ewk_Download_Job::request() const
 
 Ewk_Url_Response* ewk_download_job_response_get(const Ewk_Download_Job* download)
 {
-    EINA_SAFETY_ON_NULL_RETURN_VAL(download, 0);
+    EWK_OBJ_GET_IMPL_OR_RETURN(const EwkDownloadJob, download, impl, 0);
 
-    return download->response();
+    return impl->response();
 }
 
-Ewk_Url_Response* Ewk_Download_Job::response() const
+EwkUrlResponse* EwkDownloadJob::response() const
 {
     return m_response.get();
 }
 
 const char* ewk_download_job_destination_get(const Ewk_Download_Job* download)
 {
-    EINA_SAFETY_ON_NULL_RETURN_VAL(download, 0);
+    EWK_OBJ_GET_IMPL_OR_RETURN(const EwkDownloadJob, download, impl, 0);
 
-    return download->destination();
+    return impl->destination();
 }
 
-const char* Ewk_Download_Job::destination() const
+const char* EwkDownloadJob::destination() const
 {
     return m_destination;
 }
 
 Eina_Bool ewk_download_job_destination_set(Ewk_Download_Job* download, const char* destination)
 {
-    EINA_SAFETY_ON_NULL_RETURN_VAL(download, false);
+    EWK_OBJ_GET_IMPL_OR_RETURN(EwkDownloadJob, download, impl, false);
     EINA_SAFETY_ON_NULL_RETURN_VAL(destination, false);
 
-    download->setDestination(destination);
+    impl->setDestination(destination);
 
     return true;
 }
 
-void Ewk_Download_Job::setDestination(const char* destination)
+void EwkDownloadJob::setDestination(const char* destination)
 {
     m_destination = destination;
 }
 
 const char* ewk_download_job_suggested_filename_get(const Ewk_Download_Job* download)
 {
-    EINA_SAFETY_ON_NULL_RETURN_VAL(download, 0);
+    EWK_OBJ_GET_IMPL_OR_RETURN(const EwkDownloadJob, download, impl, 0);
 
-    return download->suggestedFileName();
+    return impl->suggestedFileName();
 }
 
-const char* Ewk_Download_Job::suggestedFileName() const
+const char* EwkDownloadJob::suggestedFileName() const
 {
     return m_suggestedFilename;
 }
 
 Eina_Bool ewk_download_job_cancel(Ewk_Download_Job* download)
 {
-    EINA_SAFETY_ON_NULL_RETURN_VAL(download, false);
+    EWK_OBJ_GET_IMPL_OR_RETURN(EwkDownloadJob, download, impl, false);
 
-    return download->cancel();
+    return impl->cancel();
 }
 
-bool Ewk_Download_Job::cancel()
+bool EwkDownloadJob::cancel()
 {
     if (m_state != EWK_DOWNLOAD_JOB_STATE_DOWNLOADING)
         return false;
@@ -179,12 +163,12 @@ bool Ewk_Download_Job::cancel()
 
 double ewk_download_job_estimated_progress_get(const Ewk_Download_Job* download)
 {
-    EINA_SAFETY_ON_NULL_RETURN_VAL(download, 0);
+    EWK_OBJ_GET_IMPL_OR_RETURN(const EwkDownloadJob, download, impl, 0);
 
-    return download->estimatedProgress();
+    return impl->estimatedProgress();
 }
 
-double Ewk_Download_Job::estimatedProgress() const
+double EwkDownloadJob::estimatedProgress() const
 {
     if (!m_response)
         return 0;
@@ -198,12 +182,12 @@ double Ewk_Download_Job::estimatedProgress() const
 
 double ewk_download_job_elapsed_time_get(const Ewk_Download_Job* download)
 {
-    EINA_SAFETY_ON_NULL_RETURN_VAL(download, 0);
+    EWK_OBJ_GET_IMPL_OR_RETURN(const EwkDownloadJob, download, impl, 0);
 
-    return download->elapsedTime();
+    return impl->elapsedTime();
 }
 
-double Ewk_Download_Job::elapsedTime() const
+double EwkDownloadJob::elapsedTime() const
 {
     // Download has not started yet.
     if (m_startTime < 0)
@@ -222,7 +206,7 @@ double Ewk_Download_Job::elapsedTime() const
  * @internal
  * Sets the URL @a response for this @a download.
  */
-void Ewk_Download_Job::setResponse(PassRefPtr<Ewk_Url_Response> response)
+void EwkDownloadJob::setResponse(PassRefPtr<EwkUrlResponse> response)
 {
     ASSERT(response);
 
@@ -233,7 +217,7 @@ void Ewk_Download_Job::setResponse(PassRefPtr<Ewk_Url_Response> response)
  * @internal
  * Sets the suggested file name for this @a download.
  */
-void Ewk_Download_Job::setSuggestedFileName(const char* suggestedFilename)
+void EwkDownloadJob::setSuggestedFileName(const char* suggestedFilename)
 {
     m_suggestedFilename = suggestedFilename;
 }
@@ -242,7 +226,7 @@ void Ewk_Download_Job::setSuggestedFileName(const char* suggestedFilename)
  * @internal
  * Report a given amount of data was received.
  */
-void Ewk_Download_Job::incrementReceivedData(uint64_t length)
+void EwkDownloadJob::incrementReceivedData(uint64_t length)
 {
     m_downloaded += length;
 }
@@ -251,7 +235,7 @@ void Ewk_Download_Job::incrementReceivedData(uint64_t length)
  * @internal
  * Sets the state of the download.
  */
-void Ewk_Download_Job::setState(Ewk_Download_Job_State state)
+void EwkDownloadJob::setState(Ewk_Download_Job_State state)
 {
     m_state = state;
 
diff --git a/Source/WebKit2/UIProcess/API/efl/ewk_download_job.h b/Source/WebKit2/UIProcess/API/efl/ewk_download_job.h
index 156f29a26..4784fc598 100644
--- a/Source/WebKit2/UIProcess/API/efl/ewk_download_job.h
+++ b/Source/WebKit2/UIProcess/API/efl/ewk_download_job.h
@@ -43,8 +43,12 @@
 extern "C" {
 #endif
 
-/** Creates a type name for Ewk_Download_Job */
-typedef struct Ewk_Download_Job Ewk_Download_Job;
+/**
+ * Declare Ewk_Download_Job as Ewk_Object.
+ *
+ * @see Ewk_Object
+ */
+typedef struct Ewk_Object Ewk_Download_Job;
 
 /// Defines the possible states of a download.
 enum Ewk_Download_Job_State {
@@ -67,24 +71,6 @@ enum Ewk_Download_Job_State {
 typedef enum Ewk_Download_Job_State Ewk_Download_Job_State;
 
 /**
- * Increases the reference count of the given object.
- *
- * @param download the download object to increase the reference count
- *
- * @return a pointer to the object on success, @c NULL otherwise.
- */
-EAPI Ewk_Download_Job *ewk_download_job_ref(Ewk_Download_Job *download);
-
-/**
- * Decreases the reference count of the given object, possibly freeing it.
- *
- * When the reference count reaches 0, the download is freed.
- *
- * @param download the download object to decrease the reference count
- */
-EAPI void ewk_download_job_unref(Ewk_Download_Job *download);
-
-/**
  * Query the state for this download.
  *
  * @param download a #Ewk_Download_Job to query.
diff --git a/Source/WebKit2/UIProcess/API/efl/ewk_download_job_private.h b/Source/WebKit2/UIProcess/API/efl/ewk_download_job_private.h
index e2501d125..d903874e6 100644
--- a/Source/WebKit2/UIProcess/API/efl/ewk_download_job_private.h
+++ b/Source/WebKit2/UIProcess/API/efl/ewk_download_job_private.h
@@ -28,6 +28,7 @@
 
 #include "WKBase.h"
 #include "WKEinaSharedString.h"
+#include "ewk_download_job.h"
 #include "ewk_url_request_private.h"
 #include "ewk_url_response_private.h"
 #include <Evas.h>
@@ -37,22 +38,26 @@ namespace WebKit {
 class DownloadProxy;
 }
 
-class Ewk_Download_Job : public RefCounted<Ewk_Download_Job> {
+class EwkViewImpl;
+
+class EwkDownloadJob : public Ewk_Object {
 public:
-    static PassRefPtr<Ewk_Download_Job> create(WebKit::DownloadProxy* download, Evas_Object* ewkView)
+    EWK_OBJECT_DECLARE(EwkDownloadJob)
+
+    static PassRefPtr<EwkDownloadJob> create(WebKit::DownloadProxy* download, EwkViewImpl* viewImpl)
     {
-        return adoptRef(new Ewk_Download_Job(download, ewkView));
+        return adoptRef(new EwkDownloadJob(download, viewImpl));
     }
 
     uint64_t id() const;
-    Evas_Object* view() const;
+    EwkViewImpl* viewImpl() const;
 
     Ewk_Download_Job_State state() const;
     void setState(Ewk_Download_Job_State);
 
-    Ewk_Url_Request* request() const;
-    Ewk_Url_Response* response() const;
-    void setResponse(PassRefPtr<Ewk_Url_Response>);
+    EwkUrlRequest* request() const;
+    EwkUrlResponse* response() const;
+    void setResponse(PassRefPtr<EwkUrlResponse>);
 
     const char* destination() const;
     void setDestination(const char* destination);
@@ -67,13 +72,13 @@ public:
     void incrementReceivedData(uint64_t length);
 
 private:
-    Ewk_Download_Job(WebKit::DownloadProxy* download, Evas_Object* ewkView);
+    EwkDownloadJob(WebKit::DownloadProxy* download, EwkViewImpl* viewImpl);
 
     WebKit::DownloadProxy* m_downloadProxy;
-    Evas_Object* m_view;
+    EwkViewImpl* m_viewImpl;
     Ewk_Download_Job_State m_state;
-    mutable RefPtr<Ewk_Url_Request> m_request;
-    RefPtr<Ewk_Url_Response> m_response;
+    mutable RefPtr<EwkUrlRequest> m_request;
+    RefPtr<EwkUrlResponse> m_response;
     double m_startTime;
     double m_endTime;
     uint64_t m_downloaded; // length already downloaded
diff --git a/Source/WebKit2/UIProcess/API/efl/ewk_favicon_database.cpp b/Source/WebKit2/UIProcess/API/efl/ewk_favicon_database.cpp
index 17c99c442..b22afc89d 100644
--- a/Source/WebKit2/UIProcess/API/efl/ewk_favicon_database.cpp
+++ b/Source/WebKit2/UIProcess/API/efl/ewk_favicon_database.cpp
@@ -27,6 +27,7 @@
 #include "ewk_favicon_database.h"
 
 #include "WKAPICast.h"
+#include "WKIconDatabase.h"
 #include "WKURL.h"
 #include "WebIconDatabase.h"
 #include "WebURL.h"
@@ -38,8 +39,8 @@
 
 using namespace WebKit;
 
-Ewk_Favicon_Database::Ewk_Favicon_Database(WKIconDatabaseRef iconDatabaseRef)
-    :  m_wkIconDatabase(iconDatabaseRef)
+Ewk_Favicon_Database::Ewk_Favicon_Database(WebIconDatabase* iconDatabase)
+    : m_iconDatabase(iconDatabase)
 {
     WKIconDatabaseClient iconDatabaseClient;
     memset(&iconDatabaseClient, 0, sizeof(WKIconDatabaseClient));
@@ -47,13 +48,17 @@ Ewk_Favicon_Database::Ewk_Favicon_Database(WKIconDatabaseRef iconDatabaseRef)
     iconDatabaseClient.clientInfo = this;
     iconDatabaseClient.didChangeIconForPageURL = didChangeIconForPageURL;
     iconDatabaseClient.iconDataReadyForPageURL = iconDataReadyForPageURL;
-    WKIconDatabaseSetIconDatabaseClient(m_wkIconDatabase.get(), &iconDatabaseClient);
+    WKIconDatabaseSetIconDatabaseClient(toAPI(m_iconDatabase.get()), &iconDatabaseClient);
+}
+
+Ewk_Favicon_Database::~Ewk_Favicon_Database()
+{
 }
 
 String Ewk_Favicon_Database::iconURLForPageURL(const String& pageURL) const
 {
     String iconURL;
-    toImpl(m_wkIconDatabase.get())->synchronousIconURLForPageURL(pageURL, iconURL);
+    m_iconDatabase->synchronousIconURLForPageURL(pageURL, iconURL);
 
     return iconURL;
 }
@@ -99,8 +104,6 @@ static Eina_Bool respond_icon_request_idle(void* data)
 
 void Ewk_Favicon_Database::iconForPageURL(const String& pageURL, const IconRequestCallbackData& callbackData)
 {
-    WebIconDatabase* webIconDatabase = toImpl(m_wkIconDatabase.get());
-
     // We ask for the icon directly. If we don't get the icon data now,
     // we'll be notified later (even if the database is still importing icons).
     RefPtr<cairo_surface_t> surface = getIconSurfaceSynchronously(pageURL);
@@ -110,7 +113,7 @@ void Ewk_Favicon_Database::iconForPageURL(const String& pageURL, const IconReque
     // finished yet, we need to wait for iconDataReadyForPageURL to be
     // called before making and informed decision.
     String iconURL = iconURLForPageURL(pageURL);
-    if (!surface && (!iconURL.isEmpty() || !webIconDatabase->isUrlImportCompleted())) {
+    if (!surface && (!iconURL.isEmpty() || !m_iconDatabase->isUrlImportCompleted())) {
         PendingIconRequestVector requests = m_iconRequests.get(pageURL);
         requests.append(callbackData);
         m_iconRequests.set(pageURL, requests);
@@ -139,13 +142,11 @@ void Ewk_Favicon_Database::didChangeIconForPageURL(WKIconDatabaseRef, WKURLRef p
 
 PassRefPtr<cairo_surface_t> Ewk_Favicon_Database::getIconSurfaceSynchronously(const String& pageURL) const
 {
-    WebIconDatabase* webIconDatabase = toImpl(m_wkIconDatabase.get());
-
-    webIconDatabase->retainIconForPageURL(pageURL);
+    m_iconDatabase->retainIconForPageURL(pageURL);
 
-    WebCore::NativeImagePtr icon = webIconDatabase->nativeImageForPageURL(pageURL);
+    WebCore::NativeImagePtr icon = m_iconDatabase->nativeImageForPageURL(pageURL);
     if (!icon) {
-        webIconDatabase->releaseIconForPageURL(pageURL);
+        m_iconDatabase->releaseIconForPageURL(pageURL);
         return 0;
     }
 
diff --git a/Source/WebKit2/UIProcess/API/efl/ewk_favicon_database_private.h b/Source/WebKit2/UIProcess/API/efl/ewk_favicon_database_private.h
index b8ba4f666..34da50375 100644
--- a/Source/WebKit2/UIProcess/API/efl/ewk_favicon_database_private.h
+++ b/Source/WebKit2/UIProcess/API/efl/ewk_favicon_database_private.h
@@ -26,12 +26,14 @@
 #ifndef ewk_favicon_database_private_h
 #define ewk_favicon_database_private_h
 
-#include "WKIconDatabase.h"
-#include "WKRetainPtr.h"
 #include "ewk_favicon_database.h"
 #include <WebKit2/WKBase.h>
 #include <wtf/HashMap.h>
 
+namespace WebKit {
+class WebIconDatabase;
+}
+
 struct IconChangeCallbackData {
     Ewk_Favicon_Database_Icon_Change_Cb callback;
     void* userData;
@@ -71,10 +73,11 @@ typedef HashMap<String /* pageURL */, PendingIconRequestVector> PendingIconReque
 
 class Ewk_Favicon_Database {
 public:
-    static PassOwnPtr<Ewk_Favicon_Database> create(WKIconDatabaseRef iconDatabaseRef)
+    static PassOwnPtr<Ewk_Favicon_Database> create(WebKit::WebIconDatabase* iconDatabase)
     {
-        return adoptPtr(new Ewk_Favicon_Database(iconDatabaseRef));
+        return adoptPtr(new Ewk_Favicon_Database(iconDatabase));
     }
+    ~Ewk_Favicon_Database();
 
     String iconURLForPageURL(const String& pageURL) const;
     void iconForPageURL(const String& pageURL, const IconRequestCallbackData& callbackData);
@@ -83,14 +86,14 @@ public:
     void unwatchChanges(Ewk_Favicon_Database_Icon_Change_Cb callback);
 
 private:
-    explicit Ewk_Favicon_Database(WKIconDatabaseRef iconDatabaseRef);
+    explicit Ewk_Favicon_Database(WebKit::WebIconDatabase* iconDatabase);
 
     PassRefPtr<cairo_surface_t> getIconSurfaceSynchronously(const String& pageURL) const;
 
     static void didChangeIconForPageURL(WKIconDatabaseRef iconDatabase, WKURLRef pageURL, const void* clientInfo);
     static void iconDataReadyForPageURL(WKIconDatabaseRef iconDatabase, WKURLRef pageURL, const void* clientInfo);
 
-    WKRetainPtr<WKIconDatabaseRef> m_wkIconDatabase;
+    RefPtr<WebKit::WebIconDatabase> m_iconDatabase;
     ChangeListenerMap m_changeListeners;
     PendingIconRequestMap m_iconRequests;
 };
diff --git a/Source/WebKit2/UIProcess/API/efl/ewk_file_chooser_request.cpp b/Source/WebKit2/UIProcess/API/efl/ewk_file_chooser_request.cpp
new file mode 100644
index 000000000..a990b1b05
--- /dev/null
+++ b/Source/WebKit2/UIProcess/API/efl/ewk_file_chooser_request.cpp
@@ -0,0 +1,167 @@
+/*
+ * Copyright (C) 2012 Intel Corporation. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "ewk_file_chooser_request.h"
+
+#include "ImmutableArray.h"
+#include "MutableArray.h"
+#include "WebOpenPanelParameters.h"
+#include "WebOpenPanelResultListenerProxy.h"
+#include "WebString.h"
+#include "WebURL.h"
+#include "ewk_file_chooser_request_private.h"
+#include <wtf/text/CString.h>
+
+using namespace WebKit;
+
+Ewk_File_Chooser_Request::Ewk_File_Chooser_Request(WebOpenPanelParameters* parameters, WebOpenPanelResultListenerProxy* listener)
+    : m_parameters(parameters)
+    , m_listener(listener)
+    , m_wasRequestHandled(false)
+{
+    ASSERT(parameters);
+    ASSERT(listener);
+}
+
+Ewk_File_Chooser_Request::~Ewk_File_Chooser_Request()
+{
+    if (!m_wasRequestHandled)
+        m_listener->cancel();
+}
+
+bool Ewk_File_Chooser_Request::allowMultipleFiles() const
+{
+    return m_parameters->allowMultipleFiles();
+}
+
+PassRefPtr<ImmutableArray> Ewk_File_Chooser_Request::acceptedMIMETypes() const
+{
+    return m_parameters->acceptMIMETypes();
+}
+
+void Ewk_File_Chooser_Request::cancel()
+{
+    m_wasRequestHandled = true;
+
+    return m_listener->cancel();
+}
+
+void Ewk_File_Chooser_Request::chooseFiles(Vector< RefPtr<APIObject> >& fileURLs)
+{
+    ASSERT(!fileURLs.isEmpty());
+    ASSERT(fileURLs.size() == 1 || m_parameters->allowMultipleFiles());
+
+    m_wasRequestHandled = true;
+    m_listener->chooseFiles(ImmutableArray::adopt(fileURLs).get());
+}
+
+Ewk_File_Chooser_Request* ewk_file_chooser_request_ref(Ewk_File_Chooser_Request* request)
+{
+    EINA_SAFETY_ON_NULL_RETURN_VAL(request, 0);
+
+    request->ref();
+
+    return request;
+}
+
+void ewk_file_chooser_request_unref(Ewk_File_Chooser_Request* request)
+{
+    EINA_SAFETY_ON_NULL_RETURN(request);
+
+    request->deref();
+}
+
+Eina_Bool ewk_file_chooser_request_allow_multiple_files_get(const Ewk_File_Chooser_Request* request)
+{
+    EINA_SAFETY_ON_NULL_RETURN_VAL(request, false);
+
+    return request->allowMultipleFiles();
+}
+
+Eina_List* ewk_file_chooser_request_accepted_mimetypes_get(const Ewk_File_Chooser_Request* request)
+{
+    EINA_SAFETY_ON_NULL_RETURN_VAL(request, 0);
+
+    Eina_List* mimeTypeList = 0;
+    RefPtr<ImmutableArray> mimeTypes = request->acceptedMIMETypes();
+
+    const size_t size = mimeTypes->size();
+    for (size_t i = 0; i < size; ++i) {
+        String mimeTypeString = static_cast<WebString*>(mimeTypes->at(i))->string();
+        if (mimeTypeString.isEmpty())
+            continue;
+        mimeTypeList = eina_list_append(mimeTypeList, eina_stringshare_add(mimeTypeString.utf8().data()));
+    }
+
+    return mimeTypeList;
+}
+
+Eina_Bool ewk_file_chooser_request_cancel(Ewk_File_Chooser_Request* request)
+{
+    EINA_SAFETY_ON_NULL_RETURN_VAL(request, false);
+    EINA_SAFETY_ON_TRUE_RETURN_VAL(request->wasHandled(), false);
+
+    request->cancel();
+
+    return true;
+}
+
+Eina_Bool ewk_file_chooser_request_files_choose(Ewk_File_Chooser_Request* request, const Eina_List* chosenFiles)
+{
+    EINA_SAFETY_ON_NULL_RETURN_VAL(request, false);
+    EINA_SAFETY_ON_NULL_RETURN_VAL(chosenFiles, false);
+    EINA_SAFETY_ON_FALSE_RETURN_VAL(eina_list_count(chosenFiles) == 1 || request->allowMultipleFiles(), false);
+    EINA_SAFETY_ON_TRUE_RETURN_VAL(request->wasHandled(), false);
+
+    Vector< RefPtr<APIObject> > fileURLs;
+
+    const Eina_List* l;
+    void* data;
+    EINA_LIST_FOREACH(chosenFiles, l, data) {
+        EINA_SAFETY_ON_NULL_RETURN_VAL(data, false);
+        String fileURL = "file://" + String::fromUTF8(static_cast<char*>(data));
+        fileURLs.append(WebURL::create(fileURL));
+    }
+
+    request->chooseFiles(fileURLs);
+
+    return true;
+}
+
+Eina_Bool ewk_file_chooser_request_file_choose(Ewk_File_Chooser_Request* request, const char* chosenFile)
+{
+    EINA_SAFETY_ON_NULL_RETURN_VAL(request, false);
+    EINA_SAFETY_ON_NULL_RETURN_VAL(chosenFile, false);
+    EINA_SAFETY_ON_TRUE_RETURN_VAL(request->wasHandled(), false);
+
+    Vector< RefPtr<APIObject> > fileURLs;
+    String fileURL = "file://" + String::fromUTF8(chosenFile);
+    fileURLs.append(WebURL::create(fileURL));
+
+    request->chooseFiles(fileURLs);
+
+    return true;
+}
diff --git a/Source/WebKit2/UIProcess/API/efl/ewk_file_chooser_request.h b/Source/WebKit2/UIProcess/API/efl/ewk_file_chooser_request.h
new file mode 100644
index 000000000..9c23a6bf6
--- /dev/null
+++ b/Source/WebKit2/UIProcess/API/efl/ewk_file_chooser_request.h
@@ -0,0 +1,125 @@
+/*
+ * Copyright (C) 2012 Intel Corporation. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+/**
+ * @file    ewk_file_chooser_request.h
+ * @brief   Describes the Ewk File Chooser API.
+ */
+
+#ifndef ewk_file_chooser_request_h
+#define ewk_file_chooser_request_h
+
+#include <Eina.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/** Creates a type name for Ewk_File_Chooser_Request */
+typedef struct Ewk_File_Chooser_Request Ewk_File_Chooser_Request;
+
+/**
+ * Increases the reference count of the given object.
+ *
+ * @param request the request object to increase the reference count
+ *
+ * @return a pointer to the object on success, @c NULL otherwise
+ */
+EAPI Ewk_File_Chooser_Request *ewk_file_chooser_request_ref(Ewk_File_Chooser_Request *request);
+
+/**
+ * Decreases the reference count of the given object, possibly freeing it.
+ *
+ * When the reference count reaches 0, the file chooser request is freed. The request
+ * will be cancelled by default if the client did not act on it.
+ *
+ * @param request the request object to decrease the reference count
+ */
+EAPI void ewk_file_chooser_request_unref(Ewk_File_Chooser_Request *request);
+
+/**
+ * Queries if it is allowed to select multiple files or not.
+ *
+ * @param request request object to query
+ *
+ * @return @c EINA_TRUE if it is allowed to select multiple files,
+ *         @c EINA_FALSE otherwise
+ */
+EAPI Eina_Bool ewk_file_chooser_request_allow_multiple_files_get(const Ewk_File_Chooser_Request *request);
+
+/**
+ * Queries the list of accepted MIME types.
+ *
+ * Possible MIME types are:
+ * - "audio\/\*": All sound files are accepted
+ * - "video\/\*": All video files are accepted
+ * - "image\/\*": All image files are accepted
+ * - standard IANA MIME type (see http://www.iana.org/assignments/media-types/ for a complete list)
+ *
+ * @param request request object to query
+ *
+ * @return The list of accepted MIME types. The list items are guaranteed to be stringshared.
+ * The caller needs to free the list and its items after use
+ */
+EAPI Eina_List *ewk_file_chooser_request_accepted_mimetypes_get(const Ewk_File_Chooser_Request *request);
+
+/**
+ * Cancels the file chooser request.
+ *
+ * @param request request object to cancel
+ *
+ * @return @c EINA_TRUE if successful, @c EINA_FALSE otherwise
+ */
+EAPI Eina_Bool ewk_file_chooser_request_cancel(Ewk_File_Chooser_Request *request);
+
+/**
+ * Sets the files chosen by the user.
+ *
+ * @param request request object to update
+ *
+ * @return @c EINA_TRUE if successful, @c EINA_FALSE otherwise
+ *
+ * @see ewk_file_chooser_request_file_choose()
+ */
+EAPI Eina_Bool ewk_file_chooser_request_files_choose(Ewk_File_Chooser_Request *request, const Eina_List *chosen_files);
+
+/**
+ * Sets the file chosen by the user.
+ *
+ * This is a convenience function in case only one file needs to be set.
+ *
+ * @param request request object to update
+ *
+ * @return @c EINA_TRUE if successful, @c EINA_FALSE otherwise
+ *
+ * @see ewk_file_chooser_request_files_choose()
+ */
+EAPI Eina_Bool ewk_file_chooser_request_file_choose(Ewk_File_Chooser_Request *request, const char *chosen_file);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* ewk_file_chooser_request_h */
diff --git a/Source/WebKit2/UIProcess/API/efl/ewk_context_request_manager_client.cpp b/Source/WebKit2/UIProcess/API/efl/ewk_file_chooser_request_private.h
index fe801ce6b..6afb7c945 100644
--- a/Source/WebKit2/UIProcess/API/efl/ewk_context_request_manager_client.cpp
+++ b/Source/WebKit2/UIProcess/API/efl/ewk_file_chooser_request_private.h
@@ -23,35 +23,42 @@
  * THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#include "config.h"
-
-#include "WKBase.h"
-#include "WKSoupRequestManager.h"
-#include "WKURL.h"
-#include "ewk_context_private.h"
-#include "ewk_context_request_manager_client_private.h"
-#include "ewk_url_scheme_request.h"
-#include "ewk_url_scheme_request_private.h"
-
-static inline Ewk_Context* toEwkContext(const void* clientInfo)
-{
-    return static_cast<Ewk_Context*>(const_cast<void*>(clientInfo));
-}
+#ifndef ewk_file_chooser_request_private_h
+#define ewk_file_chooser_request_private_h
+
+#include "APIObject.h"
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+#include <wtf/RefPtr.h>
+#include <wtf/Vector.h>
 
-static void didReceiveURIRequest(WKSoupRequestManagerRef soupRequestManagerRef, WKURLRef urlRef, WKPageRef, uint64_t requestID, const void* clientInfo)
-{
-    RefPtr<Ewk_Url_Scheme_Request> schemeRequest = Ewk_Url_Scheme_Request::create(soupRequestManagerRef, urlRef, requestID);
-    toEwkContext(clientInfo)->urlSchemeRequestReceived(schemeRequest.get());
+namespace WebKit {
+class ImmutableArray;
+class WebOpenPanelParameters;
+class WebOpenPanelResultListenerProxy;
 }
 
-void ewk_context_request_manager_client_attach(Ewk_Context* context)
-{
-    WKSoupRequestManagerClient wkRequestManagerClient;
-    memset(&wkRequestManagerClient, 0, sizeof(WKSoupRequestManagerClient));
+class Ewk_File_Chooser_Request : public RefCounted<Ewk_File_Chooser_Request> {
+public:
+    static PassRefPtr<Ewk_File_Chooser_Request> create(WebKit::WebOpenPanelParameters* parameters, WebKit::WebOpenPanelResultListenerProxy* listener)
+    {
+        return adoptRef(new Ewk_File_Chooser_Request(parameters, listener));
+    }
 
-    wkRequestManagerClient.version = kWKSoupRequestManagerClientCurrentVersion;
-    wkRequestManagerClient.clientInfo = context;
-    wkRequestManagerClient.didReceiveURIRequest = didReceiveURIRequest;
+    ~Ewk_File_Chooser_Request();
 
-    WKSoupRequestManagerSetClient(context->requestManager(), &wkRequestManagerClient);
-}
+    bool allowMultipleFiles() const;
+    PassRefPtr<WebKit::ImmutableArray> acceptedMIMETypes() const;
+    inline bool wasHandled() const { return m_wasRequestHandled; }
+    void cancel();
+    void chooseFiles(Vector< RefPtr<WebKit::APIObject> >& fileURLs);
+
+private:
+    Ewk_File_Chooser_Request(WebKit::WebOpenPanelParameters* parameters, WebKit::WebOpenPanelResultListenerProxy* listener);
+
+    RefPtr<WebKit::WebOpenPanelParameters> m_parameters;
+    RefPtr<WebKit::WebOpenPanelResultListenerProxy> m_listener;
+    bool m_wasRequestHandled;
+};
+
+#endif // ewk_file_chooser_request_private_h
diff --git a/Source/WebKit2/UIProcess/API/efl/ewk_main.cpp b/Source/WebKit2/UIProcess/API/efl/ewk_main.cpp
index 17e2b1eea..890bc699a 100644
--- a/Source/WebKit2/UIProcess/API/efl/ewk_main.cpp
+++ b/Source/WebKit2/UIProcess/API/efl/ewk_main.cpp
@@ -25,6 +25,7 @@
 #include "ewk_private.h"
 #include <Ecore.h>
 #include <Ecore_Evas.h>
+#include <Ecore_IMF.h>
 #include <Edje.h>
 #include <Eina.h>
 #include <Evas.h>
@@ -72,6 +73,11 @@ int ewk_init(void)
         goto error_ecore_evas;
     }
 
+    if (!ecore_imf_init()) {
+        CRITICAL("could not init ecore_imf.");
+        goto error_ecore_imf;
+    }
+
 #ifdef HAVE_ECORE_X
     if (!ecore_x_init(0)) {
         CRITICAL("could not init ecore_x.");
@@ -90,8 +96,10 @@ int ewk_init(void)
 
 #ifdef HAVE_ECORE_X
 error_ecore_x:
-    ecore_evas_shutdown();
+    ecore_imf_shutdown();
 #endif
+error_ecore_imf:
+    ecore_evas_shutdown();
 error_ecore_evas:
     ecore_shutdown();
 error_ecore:
@@ -113,6 +121,7 @@ int ewk_shutdown(void)
 #ifdef HAVE_ECORE_X
     ecore_x_shutdown();
 #endif
+    ecore_imf_shutdown();
     ecore_evas_shutdown();
     ecore_shutdown();
     evas_shutdown();
diff --git a/Source/WebKit2/UIProcess/API/efl/ewk_navigation_data.cpp b/Source/WebKit2/UIProcess/API/efl/ewk_navigation_data.cpp
index 3d1f05f8f..a2ae9a4ef 100644
--- a/Source/WebKit2/UIProcess/API/efl/ewk_navigation_data.cpp
+++ b/Source/WebKit2/UIProcess/API/efl/ewk_navigation_data.cpp
@@ -30,60 +30,44 @@
 
 using namespace WebKit;
 
-Ewk_Navigation_Data::Ewk_Navigation_Data(WKNavigationDataRef dataRef)
-    : m_request(Ewk_Url_Request::create(adoptWK(WKNavigationDataCopyOriginalRequest(dataRef)).get()))
+EwkNavigationData::EwkNavigationData(WKNavigationDataRef dataRef)
+    : m_request(EwkUrlRequest::create(adoptWK(WKNavigationDataCopyOriginalRequest(dataRef)).get()))
     , m_title(AdoptWK, WKNavigationDataCopyTitle(dataRef))
     , m_url(AdoptWK, WKNavigationDataCopyURL(dataRef))
 { }
 
-Ewk_Url_Request* Ewk_Navigation_Data::originalRequest() const
+EwkUrlRequest* EwkNavigationData::originalRequest() const
 {
     return m_request.get();
 }
 
-const char* Ewk_Navigation_Data::title() const
+const char* EwkNavigationData::title() const
 {
     return m_title;
 }
 
-const char* Ewk_Navigation_Data::url() const
+const char* EwkNavigationData::url() const
 {
     return m_url;
 }
 
-Ewk_Navigation_Data* ewk_navigation_data_ref(Ewk_Navigation_Data* data)
-{
-    EINA_SAFETY_ON_NULL_RETURN_VAL(data, 0);
-
-    data->ref();
-
-    return data;
-}
-
-void ewk_navigation_data_unref(Ewk_Navigation_Data* data)
-{
-    EINA_SAFETY_ON_NULL_RETURN(data);
-
-    data->deref();
-}
-
 const char* ewk_navigation_data_title_get(const Ewk_Navigation_Data* data)
 {
-    EINA_SAFETY_ON_NULL_RETURN_VAL(data, 0);
+    EWK_OBJ_GET_IMPL_OR_RETURN(const EwkNavigationData, data, impl, 0);
 
-    return data->title();
+    return impl->title();
 }
 
 Ewk_Url_Request* ewk_navigation_data_original_request_get(const Ewk_Navigation_Data* data)
 {
-    EINA_SAFETY_ON_NULL_RETURN_VAL(data, 0);
+    EWK_OBJ_GET_IMPL_OR_RETURN(const EwkNavigationData, data, impl, 0);
 
-    return data->originalRequest();
+    return impl->originalRequest();
 }
 
 const char* ewk_navigation_data_url_get(const Ewk_Navigation_Data* data)
 {
-    EINA_SAFETY_ON_NULL_RETURN_VAL(data, 0);
+    EWK_OBJ_GET_IMPL_OR_RETURN(const EwkNavigationData, data, impl, 0);
 
-    return data->url();
+    return impl->url();
 }
diff --git a/Source/WebKit2/UIProcess/API/efl/ewk_navigation_data.h b/Source/WebKit2/UIProcess/API/efl/ewk_navigation_data.h
index b3b5c26fc..16f7bc5b8 100644
--- a/Source/WebKit2/UIProcess/API/efl/ewk_navigation_data.h
+++ b/Source/WebKit2/UIProcess/API/efl/ewk_navigation_data.h
@@ -38,26 +38,12 @@
 extern "C" {
 #endif
 
-/** Creates a type name for Ewk_Navigation_Data */
-typedef struct Ewk_Navigation_Data Ewk_Navigation_Data;
-
 /**
- * Increases the reference count of the given object.
- *
- * @param data the navigation data object to increase the reference count
- *
- * @return a pointer to the object on success, @c NULL otherwise.
- */
-EAPI Ewk_Navigation_Data *ewk_navigation_data_ref(Ewk_Navigation_Data *data);
-
-/**
- * Decreases the reference count of the given object, possibly freeing it.
- *
- * When the reference count reaches 0, the object is freed.
+ * Declare Ewk_Navigation_Data as Ewk_Object.
  *
- * @param data the navigation data object to decrease the reference count
+ * @see Ewk_Object
  */
-EAPI void ewk_navigation_data_unref(Ewk_Navigation_Data *data);
+typedef struct Ewk_Object Ewk_Navigation_Data;
 
 /**
  * Returns title for this navigation data.
diff --git a/Source/WebKit2/UIProcess/API/efl/ewk_navigation_data_private.h b/Source/WebKit2/UIProcess/API/efl/ewk_navigation_data_private.h
index 0d0ecb043..59e0c6976 100644
--- a/Source/WebKit2/UIProcess/API/efl/ewk_navigation_data_private.h
+++ b/Source/WebKit2/UIProcess/API/efl/ewk_navigation_data_private.h
@@ -36,25 +36,27 @@
 #include <wtf/RefCounted.h>
 
 /**
- * \struct  Ewk_Navigation_Data
+ * \struct  EwkNavigationData
  * @brief   Contains the navigation data details.
  */
-class Ewk_Navigation_Data : public RefCounted<Ewk_Navigation_Data> {
+class EwkNavigationData : public Ewk_Object {
 public:
-    static PassRefPtr<Ewk_Navigation_Data> create(WKNavigationDataRef dataRef)
+    EWK_OBJECT_DECLARE(EwkNavigationData)
+
+    static PassRefPtr<EwkNavigationData> create(WKNavigationDataRef dataRef)
     {
-        return adoptRef(new Ewk_Navigation_Data(dataRef));
+        return adoptRef(new EwkNavigationData(dataRef));
     }
 
-    Ewk_Url_Request* originalRequest() const;
+    EwkUrlRequest* originalRequest() const;
 
     const char* title() const;
     const char* url() const;
 
 private:
-    explicit Ewk_Navigation_Data(WKNavigationDataRef dataRef);
+    explicit EwkNavigationData(WKNavigationDataRef dataRef);
 
-    RefPtr<Ewk_Url_Request> m_request;
+    RefPtr<EwkUrlRequest> m_request;
     WKEinaSharedString m_title;
     WKEinaSharedString m_url;
 };
diff --git a/Source/WebKit2/UIProcess/API/efl/ewk_navigation_policy_decision.cpp b/Source/WebKit2/UIProcess/API/efl/ewk_navigation_policy_decision.cpp
index 5c4f24c5b..ad2deefbd 100644
--- a/Source/WebKit2/UIProcess/API/efl/ewk_navigation_policy_decision.cpp
+++ b/Source/WebKit2/UIProcess/API/efl/ewk_navigation_policy_decision.cpp
@@ -32,7 +32,7 @@
 
 using namespace WebKit;
 
-Ewk_Navigation_Policy_Decision::Ewk_Navigation_Policy_Decision(WKFramePolicyListenerRef listener, Ewk_Navigation_Type navigationType, Event_Mouse_Button mouseButton, Event_Modifier_Keys modifiers, PassRefPtr<Ewk_Url_Request> request, const char* frameName)
+Ewk_Navigation_Policy_Decision::Ewk_Navigation_Policy_Decision(WKFramePolicyListenerRef listener, Ewk_Navigation_Type navigationType, Event_Mouse_Button mouseButton, Event_Modifier_Keys modifiers, PassRefPtr<EwkUrlRequest> request, const char* frameName)
     : m_listener(listener)
     , m_actedUponByClient(false)
     , m_navigationType(navigationType)
@@ -69,7 +69,7 @@ const char* Ewk_Navigation_Policy_Decision::frameName() const
     return m_frameName;
 }
 
-Ewk_Url_Request* Ewk_Navigation_Policy_Decision::request() const
+EwkUrlRequest* Ewk_Navigation_Policy_Decision::request() const
 {
     return m_request.get();
 }
diff --git a/Source/WebKit2/UIProcess/API/efl/ewk_navigation_policy_decision_private.h b/Source/WebKit2/UIProcess/API/efl/ewk_navigation_policy_decision_private.h
index 95a18b7c2..66feb3151 100644
--- a/Source/WebKit2/UIProcess/API/efl/ewk_navigation_policy_decision_private.h
+++ b/Source/WebKit2/UIProcess/API/efl/ewk_navigation_policy_decision_private.h
@@ -46,8 +46,7 @@ public:
 
     static PassRefPtr<Ewk_Navigation_Policy_Decision> create(WKFrameNavigationType navigationType, WKEventMouseButton mouseButton, WKEventModifiers modifiers, WKURLRequestRef requestRef, const char* frameName, WKFramePolicyListenerRef listener)
     {
-        RefPtr<Ewk_Url_Request> request = Ewk_Url_Request::create(requestRef);
-        return adoptRef(new Ewk_Navigation_Policy_Decision(listener, static_cast<Ewk_Navigation_Type>(navigationType), static_cast<Event_Mouse_Button>(mouseButton), static_cast<Event_Modifier_Keys>(modifiers), request.release(), frameName));
+        return adoptRef(new Ewk_Navigation_Policy_Decision(listener, static_cast<Ewk_Navigation_Type>(navigationType), static_cast<Event_Mouse_Button>(mouseButton), static_cast<Event_Modifier_Keys>(modifiers), EwkUrlRequest::create(requestRef), frameName));
     }
 
     void accept();
@@ -58,17 +57,17 @@ public:
     Event_Mouse_Button mouseButton() const;
     Event_Modifier_Keys modifiers() const;
     const char* frameName() const;
-    Ewk_Url_Request* request() const;
+    EwkUrlRequest* request() const;
 
 private:
-    Ewk_Navigation_Policy_Decision(WKFramePolicyListenerRef listener, Ewk_Navigation_Type navigationType, Event_Mouse_Button mouseButton, Event_Modifier_Keys modifiers, PassRefPtr<Ewk_Url_Request> request, const char* frameName);
+    Ewk_Navigation_Policy_Decision(WKFramePolicyListenerRef listener, Ewk_Navigation_Type navigationType, Event_Mouse_Button mouseButton, Event_Modifier_Keys modifiers, PassRefPtr<EwkUrlRequest> request, const char* frameName);
 
     WKRetainPtr<WKFramePolicyListenerRef> m_listener;
     bool m_actedUponByClient;
     Ewk_Navigation_Type m_navigationType;
     Event_Mouse_Button m_mouseButton;
     Event_Modifier_Keys m_modifiers;
-    RefPtr<Ewk_Url_Request> m_request;
+    RefPtr<EwkUrlRequest> m_request;
     WKEinaSharedString m_frameName;
 };
 
diff --git a/Source/WebKit2/UIProcess/API/efl/ewk_object.cpp b/Source/WebKit2/UIProcess/API/efl/ewk_object.cpp
new file mode 100644
index 000000000..f25d668d2
--- /dev/null
+++ b/Source/WebKit2/UIProcess/API/efl/ewk_object.cpp
@@ -0,0 +1,44 @@
+/*
+ * Copyright (C) 2012 Intel Corporation. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this item of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this item of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "ewk_object.h"
+
+#include "ewk_object_private.h"
+
+Ewk_Object* ewk_object_ref(Ewk_Object* object)
+{
+    EINA_SAFETY_ON_NULL_RETURN_VAL(object, 0);
+    object->ref();
+
+    return object;
+}
+
+void ewk_object_unref(Ewk_Object* object)
+{
+    EINA_SAFETY_ON_NULL_RETURN(object);
+
+    object->deref();
+}
diff --git a/Source/WebKit2/UIProcess/API/efl/ewk_object.h b/Source/WebKit2/UIProcess/API/efl/ewk_object.h
new file mode 100644
index 000000000..0349493c8
--- /dev/null
+++ b/Source/WebKit2/UIProcess/API/efl/ewk_object.h
@@ -0,0 +1,65 @@
+/*
+ * Copyright (C) 2012 Intel Corporation. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+/**
+ * @file    ewk_object.h
+ * @brief   Describes the Ewk Ref Counted API.
+ */
+
+#ifndef ewk_object_h
+#define ewk_object_h
+
+#include <Eina.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/** Creates a type name for Ewk_Object */
+typedef struct Ewk_Object Ewk_Object;
+
+/**
+ * Increases the reference count of the given Ewk_Object.
+ *
+ * @param object the Ewk_Object instance to increase the reference count
+ *
+ * @return a pointer to the object on success, @c NULL otherwise.
+ */
+EAPI Ewk_Object *ewk_object_ref(Ewk_Object *object);
+
+/**
+ * Decreases the reference count of the given Ewk_Object, possibly freeing it.
+ *
+ * When the reference count reaches 0, the item is freed.
+ *
+ * @param object the Ewk_Object instance to decrease the reference count
+ */
+EAPI void ewk_object_unref(Ewk_Object *object);
+
+
+#ifdef __cplusplus
+}
+#endif
+#endif // ewk_object_h
diff --git a/Source/WebKit2/UIProcess/API/efl/ewk_object_private.h b/Source/WebKit2/UIProcess/API/efl/ewk_object_private.h
new file mode 100644
index 000000000..4d4ccfabc
--- /dev/null
+++ b/Source/WebKit2/UIProcess/API/efl/ewk_object_private.h
@@ -0,0 +1,87 @@
+/*
+ * Copyright (C) 2012 Intel Corporation. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef ewk_object_private_h
+#define ewk_object_private_h
+
+#include <wtf/RefCounted.h>
+
+class Ewk_Object : public RefCounted<Ewk_Object> {
+public:
+    virtual ~Ewk_Object() { }
+    virtual const char* instanceClassName() const = 0;
+};
+
+template <class T>
+inline bool ewk_object_is_of_type(const Ewk_Object* object)
+{
+    return (reinterpret_cast<T>(0)->className() == object->instanceClassName());
+}
+
+template <class T>
+inline bool ewk_object_cast_check(const Ewk_Object* object)
+{
+    EINA_SAFETY_ON_NULL_RETURN_VAL(object, false);
+
+    if (!ewk_object_is_of_type<T>(object)) {
+        EINA_LOG_CRIT("attempt to convert object of type %s to type %s",
+            object->instanceClassName(), reinterpret_cast<T>(0)->className());
+        ASSERT_NOT_REACHED();
+        return false;
+    }
+
+    return true;
+}
+
+template <class T>
+inline const T ewk_object_cast(const Ewk_Object* object)
+{
+    return ewk_object_cast_check<T>(object) ? static_cast<T>(object) : 0;
+}
+
+template <class T>
+inline T ewk_object_cast(Ewk_Object* object)
+{
+    return ewk_object_cast_check<T>(object) ? static_cast<T>(object) : 0;
+}
+
+#define EWK_OBJ_GET_IMPL_OR_RETURN(ImplClass, object, impl, ...)           \
+    ImplClass* impl = ewk_object_cast<ImplClass*>(object);                 \
+    if (!impl)                                                             \
+        return __VA_ARGS__
+
+
+#define EWK_OBJECT_DECLARE(_className)                                     \
+static const char* className()                                             \
+{                                                                          \
+    static const char* name = #_className;                                 \
+    return name;                                                           \
+}                                                                          \
+virtual const char* instanceClassName() const                              \
+{                                                                          \
+    return className();                                                    \
+}
+
+#endif // ewk_object_private_h
diff --git a/Source/WebKit2/UIProcess/API/efl/ewk_popup_menu.cpp b/Source/WebKit2/UIProcess/API/efl/ewk_popup_menu.cpp
new file mode 100644
index 000000000..765114e6d
--- /dev/null
+++ b/Source/WebKit2/UIProcess/API/efl/ewk_popup_menu.cpp
@@ -0,0 +1,115 @@
+/*
+ * Copyright (C) 2012 Intel Corporation
+ * Copyright (C) 2012 Samsung Electronics
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT HOLDER OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
+ * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "ewk_popup_menu.h"
+
+#include "EwkViewImpl.h"
+#include "WebPopupMenuProxyEfl.h"
+#include "ewk_popup_menu_item_private.h"
+#include "ewk_popup_menu_private.h"
+
+using namespace WebKit;
+
+Ewk_Popup_Menu::Ewk_Popup_Menu(EwkViewImpl* viewImpl, WebPopupMenuProxyEfl* popupMenuProxy, const Vector<WebKit::WebPopupItem>& items, unsigned selectedIndex)
+    : m_viewImpl(viewImpl)
+    , m_popupMenuProxy(popupMenuProxy)
+    , m_popupMenuItems(0)
+    , m_selectedIndex(selectedIndex)
+{
+    const size_t size = items.size();
+    for (size_t i = 0; i < size; ++i)
+        m_popupMenuItems = eina_list_append(m_popupMenuItems, Ewk_Popup_Menu_Item::create(items[i]).leakPtr());
+}
+
+Ewk_Popup_Menu::~Ewk_Popup_Menu()
+{
+    void* item;
+    EINA_LIST_FREE(m_popupMenuItems, item)
+        delete static_cast<Ewk_Popup_Menu_Item*>(item);
+}
+
+void Ewk_Popup_Menu::close()
+{
+    m_viewImpl->closePopupMenu();
+}
+
+const Eina_List* Ewk_Popup_Menu::items() const
+{
+    return m_popupMenuItems;
+}
+
+unsigned Ewk_Popup_Menu::selectedIndex() const
+{
+    return m_selectedIndex;
+}
+
+bool Ewk_Popup_Menu::setSelectedIndex(unsigned selectedIndex)
+{
+    if (!m_popupMenuProxy)
+        return false;
+
+    if (selectedIndex >= eina_list_count(m_popupMenuItems))
+        return false;
+
+    if (m_selectedIndex == selectedIndex)
+        return true;
+
+    m_selectedIndex = selectedIndex;
+    m_popupMenuProxy->valueChanged(selectedIndex);
+
+    return true;
+}
+
+Eina_Bool ewk_popup_menu_close(Ewk_Popup_Menu* popupMenu)
+{
+    EINA_SAFETY_ON_NULL_RETURN_VAL(popupMenu, false);
+
+    popupMenu->close();
+
+    return true;
+}
+
+Eina_Bool ewk_popup_menu_selected_index_set(Ewk_Popup_Menu* popupMenu, unsigned selectedIndex)
+{
+    EINA_SAFETY_ON_NULL_RETURN_VAL(popupMenu, false);
+
+    return popupMenu->setSelectedIndex(selectedIndex);
+}
+
+unsigned ewk_popup_menu_selected_index_get(const Ewk_Popup_Menu* popupMenu)
+{
+    EINA_SAFETY_ON_NULL_RETURN_VAL(popupMenu, 0);
+
+    return popupMenu->selectedIndex();
+}
+
+const Eina_List* ewk_popup_menu_items_get(const Ewk_Popup_Menu* popupMenu)
+{
+    EINA_SAFETY_ON_NULL_RETURN_VAL(popupMenu, 0);
+
+    return popupMenu->items();
+}
diff --git a/Source/WebKit2/UIProcess/API/efl/ewk_popup_menu.h b/Source/WebKit2/UIProcess/API/efl/ewk_popup_menu.h
new file mode 100644
index 000000000..04e17688c
--- /dev/null
+++ b/Source/WebKit2/UIProcess/API/efl/ewk_popup_menu.h
@@ -0,0 +1,87 @@
+/*
+ * Copyright (C) 2012 Intel Corporation
+ * Copyright (C) 2012 Samsung Electronics
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT HOLDER OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
+ * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+/**
+ * @file    ewk_popup_menu.h
+ * @brief   Describes the Ewk Popup Menu API.
+ */
+
+#ifndef ewk_popup_menu_h
+#define ewk_popup_menu_h
+
+#include <Eina.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/** Creates a type name for Ewk_Popup_Menu */
+typedef struct Ewk_Popup_Menu Ewk_Popup_Menu;
+
+/**
+ * Selects index of current popup menu.
+ *
+ * @param popup_menu popup menu object
+ * @param index index of item to select
+ *
+ * @return @c EINA_TRUE on success, @c EINA_FALSE on failure (e.g. the index is out of range)
+ */
+EAPI Eina_Bool ewk_popup_menu_selected_index_set(Ewk_Popup_Menu *popup_menu, unsigned index);
+
+/**
+ * Returns the index of the currently selected item in the popup menu.
+ *
+ * @param popup_menu popup menu object
+ *
+ * @return index of the currently selected popup item on success, @c 0 otherwise
+ */
+EAPI unsigned ewk_popup_menu_selected_index_get(const Ewk_Popup_Menu *popup_menu);
+
+/**
+ * Closes current popup menu.
+ *
+ * The Ewk_Popup_Menu object becomes invalid after calling this function.
+ *
+ * @param popup_menu popup menu object
+ *
+ * @return @c EINA_TRUE on success, @c EINA_FALSE on failure
+ */
+EAPI Eina_Bool ewk_popup_menu_close(Ewk_Popup_Menu *popup_menu);
+
+/**
+ * Retrieve the popup menu items
+ *
+ * @param popup_menu popup menu object
+ *
+ * @return @c list of popup menu items on success, @c NULL otherwise
+ */
+EAPI const Eina_List *ewk_popup_menu_items_get(const Ewk_Popup_Menu *popup_menu);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* ewk_popup_menu_h */
diff --git a/Source/WebKit2/UIProcess/API/efl/WebKitTextChecker.h b/Source/WebKit2/UIProcess/API/efl/ewk_popup_menu_private.h
index 4123244c3..bdadc5ec3 100644
--- a/Source/WebKit2/UIProcess/API/efl/WebKitTextChecker.h
+++ b/Source/WebKit2/UIProcess/API/efl/ewk_popup_menu_private.h
@@ -1,4 +1,5 @@
 /*
+ * Copyright (C) 2012 Intel Corporation
  * Copyright (C) 2012 Samsung Electronics
  *
  * Redistribution and use in source and binary forms, with or without
@@ -23,38 +24,42 @@
  * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef WebKitTextChecker_h
-#define WebKitTextChecker_h
+#ifndef ewk_popup_menu_private_h
+#define ewk_popup_menu_private_h
 
-#if ENABLE(SPELLCHECK)
-
-#include "TextCheckerEnchant.h"
-#include "WKArray.h"
-#include "WKPage.h"
-#include "WKString.h"
+#include <Eina.h>
+#include <wtf/PassOwnPtr.h>
+#include <wtf/Vector.h>
 
 namespace WebKit {
+class WebPopupItem;
+class WebPopupMenuProxyEfl;
+}
+
+class EwkViewImpl;
 
-// The functions mainly choose between client's implementation of spelling and the WebKit one.
+class Ewk_Popup_Menu {
+public:
+    static PassOwnPtr<Ewk_Popup_Menu> create(EwkViewImpl* viewImpl, WebKit::WebPopupMenuProxyEfl* popupMenuProxy, const Vector<WebKit::WebPopupItem>& items, unsigned selectedIndex)
+    {
+        return adoptPtr(new Ewk_Popup_Menu(viewImpl, popupMenuProxy, items, selectedIndex));
+    }
+    ~Ewk_Popup_Menu();
 
-// Callbacks required by WKTextChecker.
-bool isContinuousSpellCheckingEnabled(const void* clientInfo);
-void setContinuousSpellCheckingEnabled(bool enabled, const void* clientInfo);
+    void close();
 
-uint64_t uniqueSpellDocumentTag(WKPageRef page, const void* clientInfo);
-void closeSpellDocumentWithTag(uint64_t tag, const void* clientInfo);
+    const Eina_List* items() const;
 
-void checkSpellingOfString(uint64_t tag, WKStringRef text, int32_t* misspellingLocation, int32_t* misspellingLength, const void* clientInfo);
-WKArrayRef guessesForWord(uint64_t tag, WKStringRef word, const void* clientInfo);
-void learnWord(uint64_t tag, WKStringRef word, const void* clientInfo);
-void ignoreWord(uint64_t tag, WKStringRef word, const void* clientInfo);
+    bool setSelectedIndex(unsigned selectedIndex);
+    unsigned selectedIndex() const;
 
-// Enchant's helper.
-Vector<String> availableSpellCheckingLanguages();
-void updateSpellCheckingLanguages(const Vector<String>& languages);
-Vector<String> loadedSpellCheckingLanguages();
+private:
+    Ewk_Popup_Menu(EwkViewImpl* viewImpl, WebKit::WebPopupMenuProxyEfl*, const Vector<WebKit::WebPopupItem>& items, unsigned selectedIndex);
 
-} // namespace WebKit
+    EwkViewImpl* m_viewImpl;
+    WebKit::WebPopupMenuProxyEfl* m_popupMenuProxy;
+    Eina_List* m_popupMenuItems;
+    unsigned m_selectedIndex;
+};
 
-#endif // ENABLE(SPELLCHECK)
-#endif // WebKitTextChecker_h
+#endif // ewk_popup_menu_private_h
diff --git a/Source/WebKit2/UIProcess/API/efl/ewk_security_origin.cpp b/Source/WebKit2/UIProcess/API/efl/ewk_security_origin.cpp
new file mode 100644
index 000000000..bc0f8c7ae
--- /dev/null
+++ b/Source/WebKit2/UIProcess/API/efl/ewk_security_origin.cpp
@@ -0,0 +1,90 @@
+/*
+ * Copyright (C) 2012 Samsung Electronics. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT HOLDER OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
+ * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "ewk_security_origin.h"
+
+#include "WKAPICast.h"
+#include "WKSecurityOrigin.h"
+#include "ewk_security_origin_private.h"
+
+using namespace WebKit;
+
+Ewk_Security_Origin::Ewk_Security_Origin(WKSecurityOriginRef originRef)
+    : m_wkOrigin(originRef)
+    , m_host(AdoptWK, WKSecurityOriginCopyHost(originRef))
+    , m_protocol(AdoptWK, WKSecurityOriginCopyProtocol(originRef))
+{ }
+
+const char* Ewk_Security_Origin::host() const
+{
+    return m_host;
+}
+
+const char* Ewk_Security_Origin::protocol() const
+{
+    return m_protocol;
+}
+
+uint32_t Ewk_Security_Origin::port() const
+{
+    return WKSecurityOriginGetPort(m_wkOrigin.get());
+}
+
+Ewk_Security_Origin* ewk_security_origin_ref(Ewk_Security_Origin* origin)
+{
+    EINA_SAFETY_ON_NULL_RETURN_VAL(origin, 0);
+
+    origin->ref();
+    return origin;
+}
+
+void ewk_security_origin_unref(Ewk_Security_Origin* origin)
+{
+    EINA_SAFETY_ON_NULL_RETURN(origin);
+
+    origin->deref();
+}
+
+const char* ewk_security_origin_host_get(const Ewk_Security_Origin* origin)
+{
+    EINA_SAFETY_ON_NULL_RETURN_VAL(origin, 0);
+
+    return origin->host();
+}
+
+const char* ewk_security_origin_protocol_get(const Ewk_Security_Origin* origin)
+{
+    EINA_SAFETY_ON_NULL_RETURN_VAL(origin, 0);
+
+    return origin->protocol();
+}
+
+uint32_t ewk_security_origin_port_get(const Ewk_Security_Origin* origin)
+{
+    EINA_SAFETY_ON_NULL_RETURN_VAL(origin, 0);
+
+    return origin->port();
+}
diff --git a/Source/WebKit2/UIProcess/API/efl/ewk_security_origin.h b/Source/WebKit2/UIProcess/API/efl/ewk_security_origin.h
new file mode 100644
index 000000000..5be84165b
--- /dev/null
+++ b/Source/WebKit2/UIProcess/API/efl/ewk_security_origin.h
@@ -0,0 +1,102 @@
+/*
+ * Copyright (C) 2012 Intel Corporation. All rights reserved.
+ * Copyright (C) 2012 Samsung Electronics. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT HOLDER OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
+ * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+/**
+ * @file    ewk_security_origin.h
+ * @brief   Security Origin API.
+ *
+ * Security Origin is the mechanism that defines the access limits of a website.
+ * Based on information such as domain, protocol and port, you can or cannot grant
+ * authorization for accessing data and performing certain tasks.
+ */
+
+#ifndef ewk_security_origin_h
+#define ewk_security_origin_h
+
+#include <Eina.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/** Creates a type name for Ewk_Security_Origin. */
+typedef struct Ewk_Security_Origin Ewk_Security_Origin;
+
+/**
+ * Increases the reference count of the given object.
+ *
+ * @param origin the origin object to increase the reference count
+ *
+ * @return a pointer to the object on success, @c NULL otherwise
+ */
+EAPI Ewk_Security_Origin *ewk_security_origin_ref(Ewk_Security_Origin *o);
+
+/**
+ * Decreases the reference count of the given object, possibly freeing it.
+ *
+ * When the reference count reaches 0, the origin is freed.
+ *
+ * @param origin the origin object to decrease the reference count
+ */
+EAPI void ewk_security_origin_unref(Ewk_Security_Origin *o);
+
+/**
+ * Returns the host of the security origin.
+ *
+ * @param o security origin object
+ *
+ * @return the host domain pointer or @c NULL if there is not a host scheme.
+ *         This pointer is guaranteed to be eina_stringshare, so whenever possible
+ *         save yourself from cpu cycles and use eina_stringshare_ref()
+ *         instead of eina_stringshare_add() or strdup().
+ */
+EAPI const char *ewk_security_origin_host_get(const Ewk_Security_Origin *o);
+
+/**
+ * Returns the port of the security origin.
+ *
+ * @param o security origin object
+ *
+ * @return the port number or @c 0 if there is not a proper security origin scheme
+ */
+EAPI uint32_t ewk_security_origin_port_get(const Ewk_Security_Origin *o);
+
+/**
+ * Returns the protocol of the security origin.
+ *
+ * @param o security origin object
+ *
+ * @return the protocol scheme pointer or @c NULL if there is not a protocol scheme.
+ *         This pointer is guaranteed to be eina_stringshare, so whenever possible
+ *         save yourself from cpu cycles and use eina_stringshare_ref()
+ *         instead of eina_stringshare_add() or strdup().
+ */
+EAPI const char *ewk_security_origin_protocol_get(const Ewk_Security_Origin *o);
+
+#ifdef __cplusplus
+}
+#endif
+#endif // ewk_security_origin_h
diff --git a/Source/WebKit2/UIProcess/API/efl/ewk_security_origin_private.h b/Source/WebKit2/UIProcess/API/efl/ewk_security_origin_private.h
new file mode 100644
index 000000000..04012410e
--- /dev/null
+++ b/Source/WebKit2/UIProcess/API/efl/ewk_security_origin_private.h
@@ -0,0 +1,54 @@
+/*
+ * Copyright (C) 2012 Samsung Electronics. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT HOLDER OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
+ * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef ewk_security_origin_private_h
+#define ewk_security_origin_private_h
+
+#include "WKEinaSharedString.h"
+#include "WKSecurityOrigin.h"
+#include <WebKit2/WKBase.h>
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+
+class Ewk_Security_Origin : public RefCounted<Ewk_Security_Origin> {
+public:
+    static PassRefPtr<Ewk_Security_Origin> create(WKSecurityOriginRef originRef)
+    {
+        return adoptRef(new Ewk_Security_Origin(originRef));
+    }
+
+    const char* host() const;
+    const char* protocol() const;
+    uint32_t port() const;
+
+private:
+    explicit Ewk_Security_Origin(WKSecurityOriginRef originRef);
+
+    WKRetainPtr<WKSecurityOriginRef> m_wkOrigin;
+    WKEinaSharedString m_host;
+    WKEinaSharedString m_protocol;
+};
+
+#endif // ewk_security_origin_private_h
diff --git a/Source/WebKit2/UIProcess/API/efl/ewk_settings.cpp b/Source/WebKit2/UIProcess/API/efl/ewk_settings.cpp
index 803761168..0b5083f8a 100644
--- a/Source/WebKit2/UIProcess/API/efl/ewk_settings.cpp
+++ b/Source/WebKit2/UIProcess/API/efl/ewk_settings.cpp
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2012 Samsung Electronics
+ * Copyright (C) 2012 Intel Corporation. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -26,13 +27,15 @@
 #include "config.h"
 #include "ewk_settings.h"
 
+#include "EwkViewImpl.h"
 #include "ewk_settings_private.h"
-#include <WebKit2/WKPreferences.h>
-#include <WebKit2/WKPreferencesPrivate.h>
+#include <WebKit2/WebPageGroup.h>
+#include <WebKit2/WebPageProxy.h>
+#include <WebKit2/WebPreferences.h>
 
 #if ENABLE(SPELLCHECK)
 #include "WKTextChecker.h"
-#include "WebKitTextChecker.h"
+#include "ewk_text_checker_private.h"
 #include <Ecore.h>
 #include <wtf/Vector.h>
 #include <wtf/text/CString.h>
@@ -40,6 +43,16 @@
 
 using namespace WebKit;
 
+const WebKit::WebPreferences* Ewk_Settings::preferences() const
+{
+    return m_viewImpl->page()->pageGroup()->preferences();
+}
+
+WebKit::WebPreferences* Ewk_Settings::preferences()
+{
+    return m_viewImpl->page()->pageGroup()->preferences();
+}
+
 #if ENABLE(SPELLCHECK)
 static struct {
     bool isContinuousSpellCheckingEnabled : 1;
@@ -58,7 +71,7 @@ static Eina_Bool onContinuousSpellCheckingIdler(void*)
 static Eina_Bool spellCheckingLanguagesSetUpdate(void*)
 {
     // FIXME: Consider to delegate calling of this method in WebProcess to do not delay/block UIProcess.
-    updateSpellCheckingLanguages(ewkTextCheckerSettings.spellCheckingLanguages);
+    Ewk_Text_Checker::updateSpellCheckingLanguages(ewkTextCheckerSettings.spellCheckingLanguages);
     return ECORE_CALLBACK_CANCEL;
 }
 
@@ -73,7 +86,7 @@ Eina_Bool ewk_settings_fullscreen_enabled_set(Ewk_Settings* settings, Eina_Bool
 {
 #if ENABLE(FULLSCREEN_API)
     EINA_SAFETY_ON_NULL_RETURN_VAL(settings, false);
-    WKPreferencesSetFullScreenEnabled(settings->preferences.get(), enable);
+    settings->preferences()->setFullScreenEnabled(enable);
     return true;
 #else
     return false;
@@ -84,7 +97,7 @@ Eina_Bool ewk_settings_fullscreen_enabled_get(const Ewk_Settings* settings)
 {
 #if ENABLE(FULLSCREEN_API)
     EINA_SAFETY_ON_NULL_RETURN_VAL(settings, false);
-    return WKPreferencesGetFullScreenEnabled(settings->preferences.get());
+    return settings->preferences()->fullScreenEnabled();
 #else
     return false;
 #endif
@@ -94,7 +107,7 @@ Eina_Bool ewk_settings_javascript_enabled_set(Ewk_Settings* settings, Eina_Bool
 {
     EINA_SAFETY_ON_NULL_RETURN_VAL(settings, false);
 
-    WKPreferencesSetJavaScriptEnabled(settings->preferences.get(), enable);
+    settings->preferences()->setJavaScriptEnabled(enable);
 
     return true;
 }
@@ -103,14 +116,14 @@ Eina_Bool ewk_settings_javascript_enabled_get(const Ewk_Settings* settings)
 {
     EINA_SAFETY_ON_NULL_RETURN_VAL(settings, false);
 
-    return WKPreferencesGetJavaScriptEnabled(settings->preferences.get());
+    return settings->preferences()->javaScriptEnabled();
 }
 
 Eina_Bool ewk_settings_loads_images_automatically_set(Ewk_Settings* settings, Eina_Bool automatic)
 {
     EINA_SAFETY_ON_NULL_RETURN_VAL(settings, false);
 
-    WKPreferencesSetLoadsImagesAutomatically(settings->preferences.get(), automatic);
+    settings->preferences()->setLoadsImagesAutomatically(automatic);
 
     return true;
 }
@@ -119,14 +132,14 @@ Eina_Bool ewk_settings_loads_images_automatically_get(const Ewk_Settings* settin
 {
     EINA_SAFETY_ON_NULL_RETURN_VAL(settings, false);
 
-    return WKPreferencesGetLoadsImagesAutomatically(settings->preferences.get());
+    return settings->preferences()->loadsImagesAutomatically();
 }
 
 Eina_Bool ewk_settings_developer_extras_enabled_set(Ewk_Settings* settings, Eina_Bool enable)
 {
     EINA_SAFETY_ON_NULL_RETURN_VAL(settings, false);
 
-    WKPreferencesSetDeveloperExtrasEnabled(settings->preferences.get(), enable);
+    settings->preferences()->setDeveloperExtrasEnabled(enable);
 
     return true;
 }
@@ -135,14 +148,14 @@ Eina_Bool ewk_settings_developer_extras_enabled_get(const Ewk_Settings* settings
 {
     EINA_SAFETY_ON_NULL_RETURN_VAL(settings, false);
 
-    return WKPreferencesGetDeveloperExtrasEnabled(settings->preferences.get());
+    return settings->preferences()->developerExtrasEnabled();
 }
 
 Eina_Bool ewk_settings_file_access_from_file_urls_allowed_set(Ewk_Settings* settings, Eina_Bool enable)
 {
     EINA_SAFETY_ON_NULL_RETURN_VAL(settings, false);
 
-    WKPreferencesSetFileAccessFromFileURLsAllowed(settings->preferences.get(), enable);
+    settings->preferences()->setAllowFileAccessFromFileURLs(enable);
 
     return true;
 }
@@ -151,14 +164,14 @@ Eina_Bool ewk_settings_file_access_from_file_urls_allowed_get(const Ewk_Settings
 {
     EINA_SAFETY_ON_NULL_RETURN_VAL(settings, false);
 
-    return WKPreferencesGetFileAccessFromFileURLsAllowed(settings->preferences.get());
+    return settings->preferences()->allowFileAccessFromFileURLs();
 }
 
 Eina_Bool ewk_settings_frame_flattening_enabled_set(Ewk_Settings* settings, Eina_Bool enable)
 {
     EINA_SAFETY_ON_NULL_RETURN_VAL(settings, false);
 
-    WKPreferencesSetFrameFlatteningEnabled(settings->preferences.get(), enable);
+    settings->preferences()->setFrameFlatteningEnabled(enable);
 
     return true;
 }
@@ -167,14 +180,14 @@ Eina_Bool ewk_settings_frame_flattening_enabled_get(const Ewk_Settings* settings
 {
     EINA_SAFETY_ON_NULL_RETURN_VAL(settings, false);
 
-    return WKPreferencesGetFrameFlatteningEnabled(settings->preferences.get());
+    return settings->preferences()->frameFlatteningEnabled();
 }
 
 Eina_Bool ewk_settings_dns_prefetching_enabled_set(Ewk_Settings* settings, Eina_Bool enable)
 {
     EINA_SAFETY_ON_NULL_RETURN_VAL(settings, false);
 
-    WKPreferencesSetDNSPrefetchingEnabled(settings->preferences.get(), enable);
+    settings->preferences()->setDNSPrefetchingEnabled(enable);
 
     return true;
 }
@@ -183,7 +196,7 @@ Eina_Bool ewk_settings_dns_prefetching_enabled_get(const Ewk_Settings* settings)
 {
     EINA_SAFETY_ON_NULL_RETURN_VAL(settings, false);
 
-    return WKPreferencesGetDNSPrefetchingEnabled(settings->preferences.get());
+    return settings->preferences()->dnsPrefetchingEnabled();
 }
 
 void ewk_settings_continuous_spell_checking_change_cb_set(Ewk_Settings_Continuous_Spell_Checking_Change_Cb callback)
@@ -212,7 +225,7 @@ void ewk_settings_continuous_spell_checking_enabled_set(Eina_Bool enable)
         WKTextCheckerContinuousSpellCheckingEnabledStateChanged(enable);
 
         // Sets the default language if user didn't specify any.
-        if (enable && loadedSpellCheckingLanguages().isEmpty())
+        if (enable && Ewk_Text_Checker::loadedSpellCheckingLanguages().isEmpty())
             spellCheckingLanguagesSet(Vector<String>());
 
         if (ewkTextCheckerSettings.onContinuousSpellChecking)
@@ -225,7 +238,7 @@ Eina_List* ewk_settings_spell_checking_available_languages_get()
 {
     Eina_List* listOflanguages = 0;
 #if ENABLE(SPELLCHECK)
-    Vector<String> languages = availableSpellCheckingLanguages();
+    const Vector<String>& languages = Ewk_Text_Checker::availableSpellCheckingLanguages();
     size_t numberOfLanuages = languages.size();
 
     for (size_t i = 0; i < numberOfLanuages; ++i)
@@ -248,7 +261,7 @@ Eina_List* ewk_settings_spell_checking_languages_get()
 {
     Eina_List* listOflanguages = 0;
 #if ENABLE(SPELLCHECK)
-    Vector<String> languages = loadedSpellCheckingLanguages();
+    Vector<String> languages = Ewk_Text_Checker::loadedSpellCheckingLanguages();
     size_t numberOfLanuages = languages.size();
 
     for (size_t i = 0; i < numberOfLanuages; ++i)
@@ -257,3 +270,19 @@ Eina_List* ewk_settings_spell_checking_languages_get()
 #endif
     return listOflanguages;
 }
+
+Eina_Bool ewk_setting_encoding_detector_enabled_set(Ewk_Settings* settings, Eina_Bool enable)
+{
+    EINA_SAFETY_ON_NULL_RETURN_VAL(settings, false);
+
+    settings->preferences()->setUsesEncodingDetector(enable);
+
+    return true;
+}
+
+Eina_Bool ewk_setting_encoding_detector_enabled_get(const Ewk_Settings* settings)
+{
+    EINA_SAFETY_ON_NULL_RETURN_VAL(settings, false);
+
+    return settings->preferences()->usesEncodingDetector();
+}
diff --git a/Source/WebKit2/UIProcess/API/efl/ewk_settings.h b/Source/WebKit2/UIProcess/API/efl/ewk_settings.h
index 861b9917f..5eea469b2 100644
--- a/Source/WebKit2/UIProcess/API/efl/ewk_settings.h
+++ b/Source/WebKit2/UIProcess/API/efl/ewk_settings.h
@@ -298,6 +298,29 @@ EAPI void ewk_settings_spell_checking_languages_set(const char *languages);
  */
 EAPI Eina_List *ewk_settings_spell_checking_languages_get(void);
 
+/**
+ * Enables/disables the encoding detector.
+ *
+ * By default, the encoding detector is disabled.
+ *
+ * @param settings settings object to set the encoding detector
+ * @param enable @c EINA_TRUE to enable the encoding detector,
+ *        @c EINA_FALSE to disable
+ *
+ * @return @c EINA_TRUE on success or @c EINA_FALSE on failure
+ */
+EAPI Eina_Bool ewk_setting_encoding_detector_enabled_set(Ewk_Settings *settings, Eina_Bool enable);
+
+/**
+* Returns whether the encoding detector is enabled or not.
+ *
+ * @param settings settings object to query whether encoding detector is enabled
+ *
+ * @return @c EINA_TRUE if the encoding detector is enabled
+ *         @c EINA_FALSE if not or on failure
+ */
+EAPI Eina_Bool ewk_setting_encoding_detector_enabled_get(const Ewk_Settings *settings);
+
 #ifdef __cplusplus
 }
 #endif
diff --git a/Source/WebKit2/UIProcess/API/efl/ewk_settings_private.h b/Source/WebKit2/UIProcess/API/efl/ewk_settings_private.h
index 40ae3b781..ea29a8575 100644
--- a/Source/WebKit2/UIProcess/API/efl/ewk_settings_private.h
+++ b/Source/WebKit2/UIProcess/API/efl/ewk_settings_private.h
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2012 Samsung Electronics
+ * Copyright (C) 2012 Intel Corporation. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -26,21 +27,34 @@
 #ifndef ewk_settings_private_h
 #define ewk_settings_private_h
 
-#include "ewk_settings.h"
-#include <WebKit2/WKPreferences.h>
-#include <WebKit2/WKRetainPtr.h>
 #include <wtf/PassOwnPtr.h>
 
+namespace WebKit {
+class WebPreferences;
+}
+class EwkViewImpl;
 /**
  * \struct  Ewk_Settings
  * @brief   Contains the settings data.
  */
-struct Ewk_Settings {
-    WKRetainPtr<WKPreferencesRef> preferences;
+class Ewk_Settings {
+public:
+    static PassOwnPtr<Ewk_Settings> create(EwkViewImpl* viewImpl)
+    {
+        return adoptPtr(new Ewk_Settings(viewImpl));
+    }
 
-    explicit Ewk_Settings(WKPreferencesRef wkPreferences)
-        : preferences(wkPreferences)
-    { }
+    const WebKit::WebPreferences* preferences() const;
+    WebKit::WebPreferences* preferences();
+
+private:
+    explicit Ewk_Settings(EwkViewImpl* viewImpl)
+        : m_viewImpl(viewImpl)
+    {
+        ASSERT(m_viewImpl);
+    }
+
+    EwkViewImpl* m_viewImpl;
 };
 
 #endif // ewk_settings_private_h
diff --git a/Source/WebKit2/UIProcess/API/efl/ewk_storage_manager.cpp b/Source/WebKit2/UIProcess/API/efl/ewk_storage_manager.cpp
new file mode 100644
index 000000000..1632b2e6b
--- /dev/null
+++ b/Source/WebKit2/UIProcess/API/efl/ewk_storage_manager.cpp
@@ -0,0 +1,99 @@
+/*
+ * Copyright (C) 2012 Samsung Electronics. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT HOLDER OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
+ * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "ewk_storage_manager.h"
+
+#include "WKAPICast.h"
+#include "WKArray.h"
+#include "WKKeyValueStorageManager.h"
+#include "ewk_error_private.h"
+#include "ewk_security_origin.h"
+#include "ewk_security_origin_private.h"
+#include "ewk_storage_manager_private.h"
+#include <wtf/RefCounted.h>
+
+using namespace WebKit;
+
+Ewk_Storage_Manager::Ewk_Storage_Manager(WKKeyValueStorageManagerRef wkStorageManagerRef)
+    : m_wkStorageManager(wkStorageManagerRef)
+{ }
+
+void Ewk_Storage_Manager::getStorageOrigins(void* context, WKKeyValueStorageManagerGetKeyValueStorageOriginsFunction callback) const
+{
+    WKKeyValueStorageManagerGetKeyValueStorageOrigins(m_wkStorageManager.get(), context, callback);
+}
+
+Eina_List* Ewk_Storage_Manager::createOriginList(WKArrayRef origins) const
+{
+    Eina_List* originList = 0;
+    const size_t length = WKArrayGetSize(origins);
+
+    for (size_t i = 0; i < length; ++i) {
+        WKSecurityOriginRef wkOriginRef = static_cast<WKSecurityOriginRef>(WKArrayGetItemAtIndex(origins, i));
+        RefPtr<Ewk_Security_Origin> origin = m_wrapperCache.get(wkOriginRef);
+        if (!origin) {
+            origin = Ewk_Security_Origin::create(wkOriginRef);
+            m_wrapperCache.set(wkOriginRef, origin);
+        }
+        originList = eina_list_append(originList, origin.release().leakRef());
+    }
+
+    return originList;
+}
+
+struct Ewk_Storage_Origins_Async_Get_Context {
+    const Ewk_Storage_Manager* manager;
+    Ewk_Storage_Origins_Get_Cb callback;
+    void* userData;
+
+    Ewk_Storage_Origins_Async_Get_Context(const Ewk_Storage_Manager* manager, Ewk_Storage_Origins_Get_Cb callback, void* userData)
+        : manager(manager)
+        , callback(callback)
+        , userData(userData)
+    { }
+};
+
+static void getStorageOriginsCallback(WKArrayRef origins, WKErrorRef wkError, void* context)
+{
+    Eina_List* originList = 0;
+    OwnPtr<Ewk_Storage_Origins_Async_Get_Context*> webStorageContext = adoptPtr(static_cast<Ewk_Storage_Origins_Async_Get_Context*>(context));
+
+    originList = webStorageContext->manager->createOriginList(origins);
+
+    OwnPtr<Ewk_Error> ewkError = Ewk_Error::create(wkError);
+    webStorageContext->callback(originList, ewkError.get(), webStorageContext->userData);
+}
+
+Eina_Bool ewk_storage_manager_origins_get(const Ewk_Storage_Manager* ewkStorageManager, Ewk_Storage_Origins_Get_Cb callback, void* userData)
+{
+    EINA_SAFETY_ON_NULL_RETURN_VAL(ewkStorageManager, false);
+    EINA_SAFETY_ON_NULL_RETURN_VAL(callback, false);
+
+    Ewk_Storage_Origins_Async_Get_Context* context = new Ewk_Storage_Origins_Async_Get_Context(ewkStorageManager, callback, userData);
+    ewkStorageManager->getStorageOrigins(context, getStorageOriginsCallback);
+
+    return true;
+}
diff --git a/Source/WebKit2/UIProcess/API/efl/ewk_storage_manager.h b/Source/WebKit2/UIProcess/API/efl/ewk_storage_manager.h
new file mode 100644
index 000000000..d94a556b6
--- /dev/null
+++ b/Source/WebKit2/UIProcess/API/efl/ewk_storage_manager.h
@@ -0,0 +1,73 @@
+/*
+ * Copyright (C) 2012 Samsung Electronics. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT HOLDER OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
+ * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+/**
+ * @file   ewk_storage_manager.h
+ * @brief  Describes the Ewk Storage Manager API.
+ *
+ * Ewk Storage Manager manages web storage.
+ */
+
+#ifndef ewk_storage_manager_h
+#define ewk_storage_manager_h
+
+#include "ewk_error.h"
+#include <Eina.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/** Creates a type name for Ewk_Storage_Manager. */
+typedef struct Ewk_Storage_Manager Ewk_Storage_Manager;
+
+/**
+ * @typedef Ewk_Storage_Origins_Get_Cb Ewk_Storage_Origins_Get_Cb
+ * @brief Callback type for use with ewk_storage_manager_origins_get().
+ *
+ * @param origins @c Eina_List containing @c Ewk_Security_Origin elements or @c NULL in case of error,
+ *                        the Eina_List and its items should be freed after use. Use ewk_security_origin_unref()
+ *                        to free the items
+ */
+typedef void (*Ewk_Storage_Origins_Get_Cb)(Eina_List *origins, Ewk_Error *error, void *user_data);
+
+/**
+ * Gets list of origins that are stored in storage db asynchronously.
+ *
+ * This function allocates memory for context structure made from callback and user_data.
+ *
+ * @param manager Ewk_Storage_Manager object
+ * @param callback callback to get storage origins
+ * @param user_data user_data will be passed when result_callback is called,
+ *    -i.e., user data will be kept until callback is called
+ *
+ * @return @c EINA_TRUE on success, @c EINA_FALSE on failure
+ */
+EAPI Eina_Bool ewk_storage_manager_origins_get(const Ewk_Storage_Manager *manager, Ewk_Storage_Origins_Get_Cb callback, void *user_data);
+
+#ifdef __cplusplus
+}
+#endif
+#endif // ewk_storage_manager_h
diff --git a/Source/WebKit2/UIProcess/API/efl/ewk_storage_manager_private.h b/Source/WebKit2/UIProcess/API/efl/ewk_storage_manager_private.h
new file mode 100644
index 000000000..5eeea4913
--- /dev/null
+++ b/Source/WebKit2/UIProcess/API/efl/ewk_storage_manager_private.h
@@ -0,0 +1,52 @@
+/*
+ * Copyright (C) 2012 Samsung Electronics. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT HOLDER OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
+ * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef ewk_storage_manager_private_h
+#define ewk_storage_manager_private_h
+
+#include "WKKeyValueStorageManager.h"
+#include "WKRetainPtr.h"
+#include "ewk_security_origin_private.h"
+#include <WebKit2/WKBase.h>
+#include <wtf/PassOwnPtr.h>
+
+class Ewk_Storage_Manager {
+public:
+    static PassOwnPtr<Ewk_Storage_Manager> create(WKKeyValueStorageManagerRef wkStorageManagerRef)
+    {
+        return adoptPtr(new Ewk_Storage_Manager(wkStorageManagerRef));
+    }
+
+    Eina_List* createOriginList(WKArrayRef wkList) const;
+    void getStorageOrigins(void* context, WKKeyValueStorageManagerGetKeyValueStorageOriginsFunction callback) const;
+
+private:
+    explicit Ewk_Storage_Manager(WKKeyValueStorageManagerRef wkStorageManagerRef);
+
+    WKRetainPtr<WKKeyValueStorageManagerRef> m_wkStorageManager;
+    mutable HashMap<WKSecurityOriginRef, RefPtr<Ewk_Security_Origin> > m_wrapperCache;
+};
+
+#endif // ewk_storage_manager_private_h
diff --git a/Source/WebKit2/UIProcess/API/efl/ewk_text_checker.cpp b/Source/WebKit2/UIProcess/API/efl/ewk_text_checker.cpp
index 525d6d4db..e15b8fc1a 100644
--- a/Source/WebKit2/UIProcess/API/efl/ewk_text_checker.cpp
+++ b/Source/WebKit2/UIProcess/API/efl/ewk_text_checker.cpp
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2012 Samsung Electronics
+ * Copyright (C) 2012 Intel Corporation
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -28,38 +29,149 @@
 
 #if ENABLE(SPELLCHECK)
 
+#include "TextCheckerEnchant.h"
+#include "WKAPICast.h"
+#include "WKMutableArray.h"
+#include "WKRetainPtr.h"
+#include "WKString.h"
 #include "WKTextChecker.h"
-#include "WebKitTextChecker.h"
+#include "WebPageProxy.h"
+#include "WebString.h"
+#include "ewk_settings.h"
 #include "ewk_text_checker_private.h"
+#include <Eina.h>
+#include <wtf/OwnPtr.h>
+#include <wtf/text/CString.h>
 
+using namespace WebCore;
 using namespace WebKit;
 
-// Initializes the client's functions to @c 0 to be sure that they are not defined.
-static Ewk_Text_Checker ewkTextCheckerCallbacks = {
-    0, // unique_spell_document_tag_get
-    0, // unique_spell_document_tag_close
-    0, // string_spelling_check
-    0, // word_guesses_get
-    0, // word_learn
-    0 // word_ignore
+/**
+ * @brief Structure to store client callback functions.
+ *
+ * @internal
+ */
+struct ClientCallbacks {
+    Ewk_Text_Checker_Unique_Spell_Document_Tag_Get_Cb unique_spell_document_tag_get;
+    Ewk_Text_Checker_Unique_Spell_Document_Tag_Close_Cb unique_spell_document_tag_close;
+    Ewk_Text_Checker_String_Spelling_Check_Cb string_spelling_check;
+    Ewk_Text_Checker_Word_Guesses_Get_Cb word_guesses_get;
+    Ewk_Text_Checker_Word_Learn_Cb word_learn;
+    Ewk_Text_Checker_Word_Ignore_Cb word_ignore;
 };
 
-#define EWK_TEXT_CHECKER_CALLBACK_SET(TYPE_NAME, NAME)  \
-void ewk_text_checker_##NAME##_cb_set(TYPE_NAME cb)     \
-{                                                       \
-    ewkTextCheckerCallbacks.NAME = cb;                  \
+static inline TextCheckerEnchant* textCheckerEnchant()
+{
+    static OwnPtr<TextCheckerEnchant> textCheckerEnchant = TextCheckerEnchant::create();
+    return textCheckerEnchant.get();
+}
+
+static inline ClientCallbacks& clientCallbacks()
+{
+    DEFINE_STATIC_LOCAL(ClientCallbacks, clientCallbacks, ());
+    return clientCallbacks;
+}
+
+static bool isContinuousSpellCheckingEnabled(const void*)
+{
+    return ewk_settings_continuous_spell_checking_enabled_get();
+}
+
+static void setContinuousSpellCheckingEnabled(bool enabled, const void*)
+{
+    ewk_settings_continuous_spell_checking_enabled_set(enabled);
+}
+
+static uint64_t uniqueSpellDocumentTag(WKPageRef page, const void*)
+{
+    if (clientCallbacks().unique_spell_document_tag_get)
+        return clientCallbacks().unique_spell_document_tag_get(toImpl(page)->viewWidget());
+
+    return 0;
+}
+
+static void closeSpellDocumentWithTag(uint64_t tag, const void*)
+{
+    if (clientCallbacks().unique_spell_document_tag_close)
+        clientCallbacks().unique_spell_document_tag_close(tag);
+}
+
+static void checkSpellingOfString(uint64_t tag, WKStringRef text, int32_t* misspellingLocation, int32_t* misspellingLength, const void*)
+{
+    if (clientCallbacks().string_spelling_check)
+        clientCallbacks().string_spelling_check(tag, toImpl(text)->string().utf8().data(), misspellingLocation, misspellingLength);
+    else
+        textCheckerEnchant()->checkSpellingOfString(toImpl(text)->string(), *misspellingLocation, *misspellingLength);
+}
+
+static WKArrayRef guessesForWord(uint64_t tag, WKStringRef word, const void*)
+{
+    WKMutableArrayRef suggestionsForWord = WKMutableArrayCreate();
+
+    if (clientCallbacks().word_guesses_get) {
+        Eina_List* list = clientCallbacks().word_guesses_get(tag, toImpl(word)->string().utf8().data());
+        void* item;
+
+        EINA_LIST_FREE(list, item) {
+            WKRetainPtr<WKStringRef> suggestion(AdoptWK, WKStringCreateWithUTF8CString(static_cast<const char*>(item)));
+            WKArrayAppendItem(suggestionsForWord, suggestion.get());
+            free(item);
+        }
+    } else {
+        const Vector<String>& guesses = textCheckerEnchant()->getGuessesForWord(toImpl(word)->string());
+        size_t numberOfGuesses = guesses.size();
+        for (size_t i = 0; i < numberOfGuesses; ++i) {
+            WKRetainPtr<WKStringRef> suggestion(AdoptWK, WKStringCreateWithUTF8CString(guesses[i].utf8().data()));
+            WKArrayAppendItem(suggestionsForWord, suggestion.get());
+        }
+    }
+
+    return suggestionsForWord;
+}
+
+static void learnWord(uint64_t tag, WKStringRef word, const void*)
+{
+    if (clientCallbacks().word_learn)
+        clientCallbacks().word_learn(tag, toImpl(word)->string().utf8().data());
+    else
+        textCheckerEnchant()->learnWord(toImpl(word)->string());
+}
+
+static void ignoreWord(uint64_t tag, WKStringRef word, const void*)
+{
+    if (clientCallbacks().word_ignore)
+        clientCallbacks().word_ignore(tag, toImpl(word)->string().utf8().data());
+    else
+        textCheckerEnchant()->ignoreWord(toImpl(word)->string());
+}
+
+namespace Ewk_Text_Checker {
+
+Vector<String> availableSpellCheckingLanguages()
+{
+    return textCheckerEnchant()->availableSpellCheckingLanguages();
+}
+
+void updateSpellCheckingLanguages(const Vector<String>& languages)
+{
+    textCheckerEnchant()->updateSpellCheckingLanguages(languages);
+}
+
+Vector<String> loadedSpellCheckingLanguages()
+{
+    return textCheckerEnchant()->loadedSpellCheckingLanguages();
 }
 
 /**
- * Attaches spellchecker feature.
+ * Initializes spellcheck feature.
  *
  * @internal
  *
- * The default spellchecker feature is based on Enchant library.
- * Client may use own implementation of spellchecker previously set
+ * The default spellcheck feature is based on Enchant library.
+ * Client may use own spellcheck implementation previously set
  * through the callback functions.
  */
-void ewk_text_checker_client_attach()
+void initialize()
 {
     static bool didInitializeTextCheckerClient = false;
     if (didInitializeTextCheckerClient)
@@ -90,21 +202,12 @@ void ewk_text_checker_client_attach()
     didInitializeTextCheckerClient = true;
 }
 
-/*
- * Gets the client's callbacks.
- *
- * @internal
- *
- * The client't callbacks are not defined by default.
- * If the client hasn't set the callback, the corresponding callback will
- * return @c 0 and the default WebKit implementation will be used for this
- * functionality.
- *
- * @return the struct with the client's callbacks.
- */
-Ewk_Text_Checker* ewk_text_checker_callbacks_get()
-{
-    return &ewkTextCheckerCallbacks;
+} // namespace Ewk_Text_Checker
+
+#define EWK_TEXT_CHECKER_CALLBACK_SET(TYPE_NAME, NAME)  \
+void ewk_text_checker_##NAME##_cb_set(TYPE_NAME cb)     \
+{                                                       \
+    clientCallbacks().NAME = cb;      \
 }
 
 #else
diff --git a/Source/WebKit2/UIProcess/API/efl/ewk_text_checker_private.h b/Source/WebKit2/UIProcess/API/efl/ewk_text_checker_private.h
index e74810613..462d314f4 100644
--- a/Source/WebKit2/UIProcess/API/efl/ewk_text_checker_private.h
+++ b/Source/WebKit2/UIProcess/API/efl/ewk_text_checker_private.h
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2012 Samsung Electronics
+ * Copyright (C) 2012 Intel Corporation
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -30,24 +31,16 @@
 
 #include "ewk_text_checker.h"
 
-/**
- * @brief Structure keeps client's callback functions.
- *
- * @internal
- */
-struct Ewk_Text_Checker {
-    Ewk_Text_Checker_Unique_Spell_Document_Tag_Get_Cb unique_spell_document_tag_get;
-    Ewk_Text_Checker_Unique_Spell_Document_Tag_Close_Cb unique_spell_document_tag_close;
-    Ewk_Text_Checker_String_Spelling_Check_Cb string_spelling_check;
-    Ewk_Text_Checker_Word_Guesses_Get_Cb word_guesses_get;
-    Ewk_Text_Checker_Word_Learn_Cb word_learn;
-    Ewk_Text_Checker_Word_Ignore_Cb word_ignore;
-};
-
-Ewk_Text_Checker* ewk_text_checker_callbacks_get();
-
-// Makes it visible for WTR.
-EAPI void ewk_text_checker_client_attach();
+namespace Ewk_Text_Checker {
+
+void initialize();
+
+// Enchant helpers.
+Vector<String> availableSpellCheckingLanguages();
+void updateSpellCheckingLanguages(const Vector<String>& languages);
+Vector<String> loadedSpellCheckingLanguages();
+
+}
 
 #endif // ENABLE(SPELLCHECK)
 #endif // ewk_text_checker_private_h
diff --git a/Source/WebKit2/UIProcess/API/efl/ewk_url_request.cpp b/Source/WebKit2/UIProcess/API/efl/ewk_url_request.cpp
index 55a6801ab..879791a59 100644
--- a/Source/WebKit2/UIProcess/API/efl/ewk_url_request.cpp
+++ b/Source/WebKit2/UIProcess/API/efl/ewk_url_request.cpp
@@ -30,59 +30,44 @@
 
 using namespace WebKit;
 
-Ewk_Url_Request::Ewk_Url_Request(WKURLRequestRef requestRef)
+EwkUrlRequest::EwkUrlRequest(WKURLRequestRef requestRef)
     : m_url(AdoptWK, WKURLRequestCopyURL(requestRef))
     , m_firstParty(AdoptWK, WKURLRequestCopyFirstPartyForCookies(requestRef))
     , m_httpMethod(AdoptWK, WKURLRequestCopyHTTPMethod(requestRef))
 { }
 
-const char* Ewk_Url_Request::url() const
+const char* EwkUrlRequest::url() const
 {
     return m_url;
 }
 
-const char* Ewk_Url_Request::firstParty() const
+const char* EwkUrlRequest::firstParty() const
 {
     return m_firstParty;
 }
 
-const char* Ewk_Url_Request::httpMethod() const
+const char* EwkUrlRequest::httpMethod() const
 {
     return m_httpMethod;
 }
 
-Ewk_Url_Request* ewk_url_request_ref(Ewk_Url_Request* request)
-{
-    EINA_SAFETY_ON_NULL_RETURN_VAL(request, 0);
-    request->ref();
-
-    return request;
-}
-
-void ewk_url_request_unref(Ewk_Url_Request* request)
-{
-    EINA_SAFETY_ON_NULL_RETURN(request);
-
-    request->deref();
-}
-
 const char* ewk_url_request_url_get(const Ewk_Url_Request* request)
 {
-    EINA_SAFETY_ON_NULL_RETURN_VAL(request, 0);
+    EWK_OBJ_GET_IMPL_OR_RETURN(const EwkUrlRequest, request, impl, 0);
 
-    return request->url();
+    return impl->url();
 }
 
 const char* ewk_request_cookies_first_party_get(const Ewk_Url_Request* request)
 {
-    EINA_SAFETY_ON_NULL_RETURN_VAL(request, 0);
+    EWK_OBJ_GET_IMPL_OR_RETURN(const EwkUrlRequest, request, impl, 0);
 
-    return request->firstParty();
+    return impl->firstParty();
 }
 
 const char* ewk_url_request_http_method_get(const Ewk_Url_Request* request)
 {
-    EINA_SAFETY_ON_NULL_RETURN_VAL(request, 0);
+    EWK_OBJ_GET_IMPL_OR_RETURN(const EwkUrlRequest, request, impl, 0);
 
-    return request->httpMethod();
+    return impl->httpMethod();
 }
diff --git a/Source/WebKit2/UIProcess/API/efl/ewk_url_request.h b/Source/WebKit2/UIProcess/API/efl/ewk_url_request.h
index 987bd8f05..e696dc83d 100644
--- a/Source/WebKit2/UIProcess/API/efl/ewk_url_request.h
+++ b/Source/WebKit2/UIProcess/API/efl/ewk_url_request.h
@@ -37,26 +37,12 @@
 extern "C" {
 #endif
 
-/** Creates a type name for Ewk_Url_Request */
-typedef struct Ewk_Url_Request Ewk_Url_Request;
-
 /**
- * Increases the reference count of the given object.
- *
- * @param request the URL request object to increase the reference count
- *
- * @return a pointer to the object on success, @c NULL otherwise.
- */
-EAPI Ewk_Url_Request *ewk_url_request_ref(Ewk_Url_Request *request);
-
-/**
- * Decreases the reference count of the given object, possibly freeing it.
- *
- * When the reference count reaches 0, the URL request is freed.
+ * Declare Ewk_Url_Request as Ewk_Object.
  *
- * @param request the URL request object to decrease the reference count
+ * @see Ewk_Object
  */
-EAPI void ewk_url_request_unref(Ewk_Url_Request *request);
+typedef struct Ewk_Object Ewk_Url_Request;
 
 /**
  * Query URL for this request.
diff --git a/Source/WebKit2/UIProcess/API/efl/ewk_url_request_private.h b/Source/WebKit2/UIProcess/API/efl/ewk_url_request_private.h
index 31a1bea4e..e9911054b 100644
--- a/Source/WebKit2/UIProcess/API/efl/ewk_url_request_private.h
+++ b/Source/WebKit2/UIProcess/API/efl/ewk_url_request_private.h
@@ -30,17 +30,20 @@
 #include "WKURL.h"
 #include "WKURLRequest.h"
 #include "WebURLRequest.h"
+#include "ewk_object_private.h"
 #include <wtf/PassRefPtr.h>
 
 /**
- * \struct  Ewk_Url_Request
+ * \struct  EwkUrlRequest
  * @brief   Contains the URL request data.
  */
-class Ewk_Url_Request : public RefCounted<Ewk_Url_Request> {
+class EwkUrlRequest : public Ewk_Object {
 public:
-    static PassRefPtr<Ewk_Url_Request> create(WKURLRequestRef requestRef)
+    EWK_OBJECT_DECLARE(EwkUrlRequest)
+
+    static PassRefPtr<EwkUrlRequest> create(WKURLRequestRef requestRef)
     {
-        return adoptRef(new Ewk_Url_Request(requestRef));
+        return adoptRef(new EwkUrlRequest(requestRef));
     }
 
     const char* url() const;
@@ -48,7 +51,7 @@ public:
     const char* httpMethod() const;
 
 private:
-    explicit Ewk_Url_Request(WKURLRequestRef requestRef);
+    explicit EwkUrlRequest(WKURLRequestRef requestRef);
 
     WKEinaSharedString m_url;
     WKEinaSharedString m_firstParty;
diff --git a/Source/WebKit2/UIProcess/API/efl/ewk_url_response.cpp b/Source/WebKit2/UIProcess/API/efl/ewk_url_response.cpp
index 04e176b84..6d5b87652 100644
--- a/Source/WebKit2/UIProcess/API/efl/ewk_url_response.cpp
+++ b/Source/WebKit2/UIProcess/API/efl/ewk_url_response.cpp
@@ -31,71 +31,56 @@
 
 using namespace WebKit;
 
-Ewk_Url_Response::Ewk_Url_Response(const WebCore::ResourceResponse& coreResponse)
+EwkUrlResponse::EwkUrlResponse(const WebCore::ResourceResponse& coreResponse)
     : m_coreResponse(coreResponse)
     , m_url(AdoptWK, WKURLResponseCopyURL(WebKit::toAPI(coreResponse)))
     , m_mimeType(AdoptWK, WKURLResponseCopyMIMEType(WebKit::toAPI(coreResponse)))
 { }
 
-int Ewk_Url_Response::httpStatusCode() const
+int EwkUrlResponse::httpStatusCode() const
 {
     return m_coreResponse.httpStatusCode();
 }
 
-const char* Ewk_Url_Response::url() const
+const char* EwkUrlResponse::url() const
 {
     return m_url;
 }
 
-const char* Ewk_Url_Response::mimeType() const
+const char* EwkUrlResponse::mimeType() const
 {
     return m_mimeType;
 }
 
-unsigned long Ewk_Url_Response::contentLength() const
+unsigned long EwkUrlResponse::contentLength() const
 {
     return m_coreResponse.expectedContentLength();
 }
 
-Ewk_Url_Response* ewk_url_response_ref(Ewk_Url_Response* response)
-{
-    EINA_SAFETY_ON_NULL_RETURN_VAL(response, 0);
-    response->ref();
-
-    return response;
-}
-
-void ewk_url_response_unref(Ewk_Url_Response* response)
-{
-    EINA_SAFETY_ON_NULL_RETURN(response);
-
-    response->deref();
-}
-
 const char* ewk_url_response_url_get(const Ewk_Url_Response* response)
 {
-    EINA_SAFETY_ON_NULL_RETURN_VAL(response, 0);
+    EWK_OBJ_GET_IMPL_OR_RETURN(const EwkUrlResponse, response, impl, 0);
 
-    return response->url();
+    return impl->url();
 }
 
 int ewk_url_response_status_code_get(const Ewk_Url_Response* response)
 {
-    EINA_SAFETY_ON_NULL_RETURN_VAL(response, 0);
+    EWK_OBJ_GET_IMPL_OR_RETURN(const EwkUrlResponse, response, impl, 0);
 
-    return response->httpStatusCode();
+    return impl->httpStatusCode();
 }
 
 const char* ewk_url_response_mime_type_get(const Ewk_Url_Response* response)
 {
-    EINA_SAFETY_ON_NULL_RETURN_VAL(response, 0);
+    EWK_OBJ_GET_IMPL_OR_RETURN(const EwkUrlResponse, response, impl, 0);
 
-    return response->mimeType();
+    return impl->mimeType();
 }
 
 unsigned long ewk_url_response_content_length_get(const Ewk_Url_Response* response)
 {
-    EINA_SAFETY_ON_NULL_RETURN_VAL(response, 0);
+    EWK_OBJ_GET_IMPL_OR_RETURN(const EwkUrlResponse, response, impl, 0);
 
-    return response->contentLength();
+    return impl->contentLength();
 }
diff --git a/Source/WebKit2/UIProcess/API/efl/ewk_url_response.h b/Source/WebKit2/UIProcess/API/efl/ewk_url_response.h
index cad8e0f76..2f34171ee 100644
--- a/Source/WebKit2/UIProcess/API/efl/ewk_url_response.h
+++ b/Source/WebKit2/UIProcess/API/efl/ewk_url_response.h
@@ -37,26 +37,12 @@
 extern "C" {
 #endif
 
-/** Creates a type name for Ewk_Url_Response */
-typedef struct Ewk_Url_Response Ewk_Url_Response;
-
 /**
- * Increases the reference count of the given object.
- *
- * @param response the URL response object to increase the reference count
- *
- * @return a pointer to the object on success, @c NULL otherwise.
- */
-EAPI Ewk_Url_Response *ewk_url_response_ref(Ewk_Url_Response *response);
-
-/**
- * Decreases the reference count of the given object, possibly freeing it.
- *
- * When the reference count reaches 0, the URL response is freed.
+ * Declare Ewk_Url_Response as Ewk_Object.
  *
- * @param response the URL response object to decrease the reference count
+ * @see Ewk_Object
  */
-EAPI void ewk_url_response_unref(Ewk_Url_Response *response);
+typedef struct Ewk_Object Ewk_Url_Response;
 
 /**
  * Query URL for this response.
diff --git a/Source/WebKit2/UIProcess/API/efl/ewk_url_response_private.h b/Source/WebKit2/UIProcess/API/efl/ewk_url_response_private.h
index 2d918a8fb..fc512d127 100644
--- a/Source/WebKit2/UIProcess/API/efl/ewk_url_response_private.h
+++ b/Source/WebKit2/UIProcess/API/efl/ewk_url_response_private.h
@@ -29,21 +29,24 @@
 #include "WKAPICast.h"
 #include "WKEinaSharedString.h"
 #include "WKURLResponse.h"
+#include "ewk_object_private.h"
 #include <WebCore/ResourceResponse.h>
 #include <wtf/PassRefPtr.h>
 
 /**
- * \struct  Ewk_Url_Response
+ * \struct  EwkUrlResponse
  * @brief   Contains the URL response data.
  */
-class Ewk_Url_Response : public RefCounted<Ewk_Url_Response> {
+class EwkUrlResponse : public Ewk_Object {
 public:
-    static PassRefPtr<Ewk_Url_Response> create(WKURLResponseRef wkResponse)
+    EWK_OBJECT_DECLARE(EwkUrlResponse)
+
+    static PassRefPtr<EwkUrlResponse> create(WKURLResponseRef wkResponse)
     {
         if (!wkResponse)
             return 0;
 
-        return adoptRef(new Ewk_Url_Response(WebKit::toImpl(wkResponse)->resourceResponse()));
+        return adoptRef(new EwkUrlResponse(WebKit::toImpl(wkResponse)->resourceResponse()));
     }
 
     int httpStatusCode() const;
@@ -52,7 +55,7 @@ public:
     unsigned long contentLength() const;
 
 private:
-    explicit Ewk_Url_Response(const WebCore::ResourceResponse& coreResponse);
+    explicit EwkUrlResponse(const WebCore::ResourceResponse& coreResponse);
 
     WebCore::ResourceResponse m_coreResponse;
     WKEinaSharedString m_url;
diff --git a/Source/WebKit2/UIProcess/API/efl/ewk_url_scheme_request.cpp b/Source/WebKit2/UIProcess/API/efl/ewk_url_scheme_request.cpp
index 04d9118d6..889173088 100644
--- a/Source/WebKit2/UIProcess/API/efl/ewk_url_scheme_request.cpp
+++ b/Source/WebKit2/UIProcess/API/efl/ewk_url_scheme_request.cpp
@@ -33,7 +33,7 @@
 
 using namespace WebKit;
 
-Ewk_Url_Scheme_Request::Ewk_Url_Scheme_Request(WKSoupRequestManagerRef manager, WKURLRef url, uint64_t requestID)
+EwkUrlSchemeRequest::EwkUrlSchemeRequest(WKSoupRequestManagerRef manager, WKURLRef url, uint64_t requestID)
     : m_wkRequestManager(manager)
     , m_url(url)
     , m_requestID(requestID)
@@ -43,27 +43,27 @@ Ewk_Url_Scheme_Request::Ewk_Url_Scheme_Request(WKSoupRequestManagerRef manager,
     m_path = soupURI->path;
 }
 
-uint64_t Ewk_Url_Scheme_Request::id() const
+uint64_t EwkUrlSchemeRequest::id() const
 {
     return m_requestID;
 }
 
-const char* Ewk_Url_Scheme_Request::url() const
+const char* EwkUrlSchemeRequest::url() const
 {
     return m_url;
 }
 
-const char* Ewk_Url_Scheme_Request::scheme() const
+const char* EwkUrlSchemeRequest::scheme() const
 {
     return m_scheme;
 }
 
-const char* Ewk_Url_Scheme_Request::path() const
+const char* EwkUrlSchemeRequest::path() const
 {
     return m_path;
 }
 
-void Ewk_Url_Scheme_Request::finish(const void* contentData, uint64_t contentLength, const char* mimeType)
+void EwkUrlSchemeRequest::finish(const void* contentData, uint64_t contentLength, const char* mimeType)
 {
     WKRetainPtr<WKDataRef> wkData(AdoptWK, WKDataCreate(contentLength ? reinterpret_cast<const unsigned char*>(contentData) : 0, contentLength));
     WKRetainPtr<WKStringRef> wkMimeType = mimeType ? adoptWK(WKStringCreateWithUTF8CString(mimeType)) : 0;
@@ -72,47 +72,32 @@ void Ewk_Url_Scheme_Request::finish(const void* contentData, uint64_t contentLen
     WKSoupRequestManagerDidHandleURIRequest(m_wkRequestManager.get(), wkData.get(), contentLength, wkMimeType.get(), m_requestID);
 }
 
-Ewk_Url_Scheme_Request* ewk_url_scheme_request_ref(Ewk_Url_Scheme_Request* request)
-{
-    EINA_SAFETY_ON_NULL_RETURN_VAL(request, 0);
-    request->ref();
-
-    return request;
-}
-
-void ewk_url_scheme_request_unref(Ewk_Url_Scheme_Request* request)
-{
-    EINA_SAFETY_ON_NULL_RETURN(request);
-
-    request->deref();
-}
-
 const char* ewk_url_scheme_request_scheme_get(const Ewk_Url_Scheme_Request* request)
 {
-    EINA_SAFETY_ON_NULL_RETURN_VAL(request, 0);
+    EWK_OBJ_GET_IMPL_OR_RETURN(const EwkUrlSchemeRequest, request, impl, 0);
 
-    return request->scheme();
+    return impl->scheme();
 }
 
 const char* ewk_url_scheme_request_url_get(const Ewk_Url_Scheme_Request* request)
 {
-    EINA_SAFETY_ON_NULL_RETURN_VAL(request, 0);
+    EWK_OBJ_GET_IMPL_OR_RETURN(const EwkUrlSchemeRequest, request, impl, 0);
 
-    return request->url();
+    return impl->url();
 }
 
 const char* ewk_url_scheme_request_path_get(const Ewk_Url_Scheme_Request* request)
 {
-    EINA_SAFETY_ON_NULL_RETURN_VAL(request, 0);
+    EWK_OBJ_GET_IMPL_OR_RETURN(const EwkUrlSchemeRequest, request, impl, 0);
 
-    return request->path();
+    return impl->path();
 }
 
 Eina_Bool ewk_url_scheme_request_finish(Ewk_Url_Scheme_Request* request, const void* contentData, uint64_t contentLength, const char* mimeType)
 {
-    EINA_SAFETY_ON_NULL_RETURN_VAL(request, false);
+    EWK_OBJ_GET_IMPL_OR_RETURN(EwkUrlSchemeRequest, request, impl, false);
 
-    request->finish(contentData, contentLength, mimeType);
+    impl->finish(contentData, contentLength, mimeType);
 
     return true;
 }
diff --git a/Source/WebKit2/UIProcess/API/efl/ewk_url_scheme_request.h b/Source/WebKit2/UIProcess/API/efl/ewk_url_scheme_request.h
index ce01afc31..62b72158b 100644
--- a/Source/WebKit2/UIProcess/API/efl/ewk_url_scheme_request.h
+++ b/Source/WebKit2/UIProcess/API/efl/ewk_url_scheme_request.h
@@ -37,26 +37,12 @@
 extern "C" {
 #endif
 
-/** Creates a type name for Ewk_Url_Scheme_Request */
-typedef struct Ewk_Url_Scheme_Request Ewk_Url_Scheme_Request;
-
 /**
- * Increases the reference count of the given object.
- *
- * @param request the URL scheme request object to increase the reference count
- *
- * @return a pointer to the object on success, @c NULL otherwise.
- */
-EAPI Ewk_Url_Scheme_Request *ewk_url_scheme_request_ref(Ewk_Url_Scheme_Request *request);
-
-/**
- * Decreases the reference count of the given object, possibly freeing it.
- *
- * When the reference count it's reached 0, the URL scheme request is freed.
+ * Declare Ewk_Url_Scheme_Request as Ewk_Object.
  *
- * @param request the URL request object to decrease the reference count
+ * @see Ewk_Object
  */
-EAPI void ewk_url_scheme_request_unref(Ewk_Url_Scheme_Request *request);
+typedef struct Ewk_Object Ewk_Url_Scheme_Request;
 
 /**
  * Query the URL scheme for this request.
diff --git a/Source/WebKit2/UIProcess/API/efl/ewk_url_scheme_request_private.h b/Source/WebKit2/UIProcess/API/efl/ewk_url_scheme_request_private.h
index 30fd6f514..65fc9f94a 100644
--- a/Source/WebKit2/UIProcess/API/efl/ewk_url_scheme_request_private.h
+++ b/Source/WebKit2/UIProcess/API/efl/ewk_url_scheme_request_private.h
@@ -31,18 +31,21 @@
 #include "WKEinaSharedString.h"
 #include "WKRetainPtr.h"
 #include "WKSoupRequestManager.h"
+#include "ewk_object_private.h"
 
 /**
- * \struct  Ewk_Url_Scheme_Request
+ * \struct  EwkUrlSchemeRequest
  * @brief   Contains the URL scheme request data.
  */
-struct Ewk_Url_Scheme_Request : public RefCounted<Ewk_Url_Scheme_Request> {
-    static PassRefPtr<Ewk_Url_Scheme_Request> create(WKSoupRequestManagerRef manager, WKURLRef url, uint64_t requestID)
+class EwkUrlSchemeRequest : public Ewk_Object {
+public:
+    EWK_OBJECT_DECLARE(EwkUrlSchemeRequest)
+    static PassRefPtr<EwkUrlSchemeRequest> create(WKSoupRequestManagerRef manager, WKURLRef url, uint64_t requestID)
     {
         if (!manager || !url)
             return 0;
 
-        return adoptRef(new Ewk_Url_Scheme_Request(manager, url, requestID));
+        return adoptRef(new EwkUrlSchemeRequest(manager, url, requestID));
     }
 
     uint64_t id() const;
@@ -53,7 +56,7 @@ struct Ewk_Url_Scheme_Request : public RefCounted<Ewk_Url_Scheme_Request> {
     void finish(const void* contentData, uint64_t contentLength, const char* mimeType);
 
 private:
-    Ewk_Url_Scheme_Request(WKSoupRequestManagerRef manager, WKURLRef urlRef, uint64_t requestID);
+    EwkUrlSchemeRequest(WKSoupRequestManagerRef manager, WKURLRef urlRef, uint64_t requestID);
 
     WKRetainPtr<WKSoupRequestManagerRef> m_wkRequestManager;
     WKEinaSharedString m_url;
diff --git a/Source/WebKit2/UIProcess/API/efl/ewk_view.cpp b/Source/WebKit2/UIProcess/API/efl/ewk_view.cpp
index e77751934..429185cef 100644
--- a/Source/WebKit2/UIProcess/API/efl/ewk_view.cpp
+++ b/Source/WebKit2/UIProcess/API/efl/ewk_view.cpp
@@ -21,61 +21,44 @@
 #include "config.h"
 #include "ewk_view.h"
 
+#include "EwkViewImpl.h"
+#include "FindClientEfl.h"
+#include "FormClientEfl.h"
+#include "InputMethodContextEfl.h"
 #include "NativeWebKeyboardEvent.h"
 #include "NativeWebMouseEvent.h"
 #include "NativeWebWheelEvent.h"
-#include "PageClientImpl.h"
+#include "PageClientBase.h"
 #include "PageLoadClientEfl.h"
-#include "RefPtrEfl.h"
+#include "PagePolicyClientEfl.h"
+#include "PageUIClientEfl.h"
 #include "ResourceLoadClientEfl.h"
 #include "WKAPICast.h"
-#include "WKColorPickerResultListener.h"
 #include "WKEinaSharedString.h"
 #include "WKFindOptions.h"
 #include "WKRetainPtr.h"
 #include "WKString.h"
-#include "WKURL.h"
 #include "WebContext.h"
 #include "WebPageGroup.h"
-#include "WebPopupItem.h"
-#include "WebPopupMenuProxyEfl.h"
 #include "WebPreferences.h"
 #include "ewk_back_forward_list_private.h"
 #include "ewk_context.h"
 #include "ewk_context_private.h"
 #include "ewk_favicon_database_private.h"
 #include "ewk_intent_private.h"
-#include "ewk_popup_menu_item.h"
-#include "ewk_popup_menu_item_private.h"
 #include "ewk_private.h"
-#include "ewk_resource.h"
-#include "ewk_resource_private.h"
 #include "ewk_settings_private.h"
-#include "ewk_view_find_client_private.h"
-#include "ewk_view_form_client_private.h"
-#include "ewk_view_policy_client_private.h"
 #include "ewk_view_private.h"
-#include "ewk_view_ui_client_private.h"
 #include <Ecore_Evas.h>
-#include <Edje.h>
-#include <WebCore/Cursor.h>
-#include <WebCore/EflScreenUtilities.h>
 #include <WebKit2/WKPageGroup.h>
 #include <wtf/text/CString.h>
 
-#if ENABLE(FULLSCREEN_API)
-#include "WebFullScreenManagerProxy.h"
-#endif
-
 #if ENABLE(INSPECTOR)
 #include "WebInspectorProxy.h"
 #endif
 
-#if USE(ACCELERATED_COMPOSITING)
-#include <Evas_GL.h>
-#endif
-
-#if USE(COORDINATED_GRAPHICS)
+#if USE(TILED_BACKING_STORE)
+#include "PageViewportController.h"
 #include "PageViewportControllerClientEfl.h"
 #endif
 
@@ -84,104 +67,14 @@ using namespace WebCore;
 
 static const char EWK_VIEW_TYPE_STR[] = "EWK2_View";
 
-static const int defaultCursorSize = 16;
-
-static void _ewk_view_on_favicon_changed(const char* pageURL, void* eventInfo);
-
-typedef HashMap<const WebPageProxy*, const Evas_Object*> PageViewMap;
-
-static inline PageViewMap& pageViewMap()
-{
-    DEFINE_STATIC_LOCAL(PageViewMap, map, ());
-    return map;
-}
-
-static inline void addToPageViewMap(const Evas_Object* ewkView)
-{
-    ASSERT(ewkView);
-    ASSERT(ewk_view_page_get(ewkView));
-    PageViewMap::AddResult result = pageViewMap().add(ewk_view_page_get(ewkView), ewkView);
-    ASSERT_UNUSED(result, result.isNewEntry);
-}
-
-static inline void removeFromPageViewMap(const Evas_Object* ewkView)
-{
-    ASSERT(ewkView);
-    ASSERT(ewk_view_page_get(ewkView));
-    ASSERT(pageViewMap().contains(ewk_view_page_get(ewkView)));
-    pageViewMap().remove(ewk_view_page_get(ewkView));
-}
-
-struct Ewk_View_Private_Data {
-    OwnPtr<PageClientImpl> pageClient;
-#if USE(COORDINATED_GRAPHICS)
-    OwnPtr<PageViewportControllerClientEfl> pageViewportControllerClient;
-#endif
-    RefPtr<WebPageProxy> pageProxy;
-    OwnPtr<PageLoadClientEfl> pageLoadClient;
-    OwnPtr<ResourceLoadClientEfl> resourceLoadClient;
-
-    WKEinaSharedString url;
-    WKEinaSharedString title;
-    WKEinaSharedString theme;
-    WKEinaSharedString customEncoding;
-    WKEinaSharedString cursorGroup;
-    WKEinaSharedString faviconURL;
-    RefPtr<Evas_Object> cursorObject;
-    OwnPtr<Ewk_Back_Forward_List> backForwardList;
-    OwnPtr<Ewk_Settings> settings;
-    bool areMouseEventsEnabled;
-    WKRetainPtr<WKColorPickerResultListenerRef> colorPickerResultListener;
-    RefPtr<Ewk_Context> context;
-#if ENABLE(TOUCH_EVENTS)
-    bool areTouchEventsEnabled;
-#endif
-
-    WebPopupMenuProxyEfl* popupMenuProxy;
-    Eina_List* popupMenuItems;
-
-#ifdef HAVE_ECORE_X
-    bool isUsingEcoreX;
-#endif
-
-#if USE(ACCELERATED_COMPOSITING)
-    Evas_GL* evasGl;
-    Evas_GL_Context* evasGlContext;
-    Evas_GL_Surface* evasGlSurface;
-#endif
-
-    Ewk_View_Private_Data()
-        : areMouseEventsEnabled(false)
-#if ENABLE(TOUCH_EVENTS)
-        , areTouchEventsEnabled(false)
-#endif
-        , popupMenuProxy(0)
-        , popupMenuItems(0)
-#ifdef HAVE_ECORE_X
-        , isUsingEcoreX(false)
-#endif
-#if USE(ACCELERATED_COMPOSITING)
-        , evasGl(0)
-        , evasGlContext(0)
-        , evasGlSurface(0)
-#endif
-    { }
-
-    ~Ewk_View_Private_Data()
-    {
-        /* Unregister icon change callback */
-        Ewk_Favicon_Database* iconDatabase = context->faviconDatabase();
-        iconDatabase->unwatchChanges(_ewk_view_on_favicon_changed);
-
-        void* item;
-        EINA_LIST_FREE(popupMenuItems, item)
-            delete static_cast<Ewk_Popup_Menu_Item*>(item);
-    }
-};
-
 #define EWK_VIEW_TYPE_CHECK(ewkView, result)                                   \
     bool result = true;                                                        \
     do {                                                                       \
+        if (!ewkView) {                                                        \
+            EINA_LOG_CRIT("null is not a ewk_view");                           \
+            result = false;                                                    \
+            break;                                                             \
+        }                                                                      \
         const char* _tmp_otype = evas_object_type_get(ewkView);                \
         const Evas_Smart* _tmp_s = evas_object_smart_smart_get(ewkView);       \
         if (EINA_UNLIKELY(!_tmp_s)) {                                          \
@@ -189,6 +82,7 @@ struct Ewk_View_Private_Data {
                 ("%p (%s) is not a smart object!",                             \
                  ewkView, _tmp_otype ? _tmp_otype : "(null)");                 \
             result = false;                                                    \
+            break;                                                             \
         }                                                                      \
         const Evas_Smart_Class* _tmp_sc = evas_smart_class_get(_tmp_s);        \
         if (EINA_UNLIKELY(!_tmp_sc)) {                                         \
@@ -196,6 +90,7 @@ struct Ewk_View_Private_Data {
                 ("%p (%s) is not a smart object!",                             \
                  ewkView, _tmp_otype ? _tmp_otype : "(null)");                 \
             result = false;                                                    \
+            break;                                                             \
         }                                                                      \
         if (EINA_UNLIKELY(_tmp_sc->data != EWK_VIEW_TYPE_STR)) {               \
             EINA_LOG_CRIT                                                      \
@@ -222,19 +117,28 @@ struct Ewk_View_Private_Data {
         }                                                                      \
     } while (0)
 
-#define EWK_VIEW_PRIV_GET(smartData, priv)                                     \
-    Ewk_View_Private_Data* priv = smartData->priv
-
-#define EWK_VIEW_PRIV_GET_OR_RETURN(smartData, priv, ...)                      \
+#define EWK_VIEW_IMPL_GET_BY_SD_OR_RETURN(smartData, impl, ...)                \
     if (!smartData) {                                                          \
         EINA_LOG_CRIT("smart data is null");                                   \
         return __VA_ARGS__;                                                    \
     }                                                                          \
-    EWK_VIEW_PRIV_GET(smartData, priv);                                        \
+    EwkViewImpl* impl = smartData->priv;                                       \
     do {                                                                       \
-        if (!priv) {                                                           \
+        if (!impl) {                                                           \
             EINA_LOG_CRIT("no private data for object %p (%s)",                \
-                     smartData->self, evas_object_type_get(smartData->self));  \
+                smartData->self, evas_object_type_get(smartData->self));       \
+            return __VA_ARGS__;                                                \
+        }                                                                      \
+    } while (0)
+
+#define EWK_VIEW_IMPL_GET_OR_RETURN(ewkView, impl, ...)                        \
+    EwkViewImpl* impl = 0;                                                     \
+    do {                                                                       \
+        EWK_VIEW_SD_GET_OR_RETURN(ewkView, smartData, __VA_ARGS__);            \
+        impl = smartData->priv;                                                \
+        if (!impl) {                                                           \
+            EINA_LOG_CRIT("no private data for object %p (%s)",                \
+                smartData->self, evas_object_type_get(smartData->self));       \
             return __VA_ARGS__;                                                \
         }                                                                      \
     } while (0)
@@ -247,83 +151,78 @@ static void _ewk_view_smart_changed(Ewk_View_Smart_Data* smartData)
     evas_object_smart_changed(smartData->self);
 }
 
-static void _ewk_view_on_favicon_changed(const char* pageURL, void* eventInfo)
-{
-    Evas_Object* ewkView = static_cast<Evas_Object*>(eventInfo);
-
-    const char* view_url = ewk_view_url_get(ewkView);
-    if (!view_url || strcasecmp(view_url, pageURL))
-        return;
-
-    ewk_view_update_icon(ewkView);
-}
-
 // Default Event Handling.
 static Eina_Bool _ewk_view_smart_focus_in(Ewk_View_Smart_Data* smartData)
 {
-    EWK_VIEW_PRIV_GET_OR_RETURN(smartData, priv, false);
+    EWK_VIEW_IMPL_GET_BY_SD_OR_RETURN(smartData, impl, false);
 
-    priv->pageProxy->viewStateDidChange(WebPageProxy::ViewIsFocused | WebPageProxy::ViewWindowIsActive);
+    impl->page()->viewStateDidChange(WebPageProxy::ViewIsFocused | WebPageProxy::ViewWindowIsActive);
     return true;
 }
 
 static Eina_Bool _ewk_view_smart_focus_out(Ewk_View_Smart_Data* smartData)
 {
-    EWK_VIEW_PRIV_GET_OR_RETURN(smartData, priv, false);
+    EWK_VIEW_IMPL_GET_BY_SD_OR_RETURN(smartData, impl, false);
 
-    priv->pageProxy->viewStateDidChange(WebPageProxy::ViewIsFocused | WebPageProxy::ViewWindowIsActive);
+    impl->page()->viewStateDidChange(WebPageProxy::ViewIsFocused | WebPageProxy::ViewWindowIsActive);
     return true;
 }
 
 static Eina_Bool _ewk_view_smart_mouse_wheel(Ewk_View_Smart_Data* smartData, const Evas_Event_Mouse_Wheel* wheelEvent)
 {
-    EWK_VIEW_PRIV_GET_OR_RETURN(smartData, priv, false);
+    EWK_VIEW_IMPL_GET_BY_SD_OR_RETURN(smartData, impl, false);
 
-    Evas_Point position = {smartData->view.x, smartData->view.y};
-    priv->pageProxy->handleWheelEvent(NativeWebWheelEvent(wheelEvent, &position));
+    impl->page()->handleWheelEvent(NativeWebWheelEvent(wheelEvent, impl->transformFromScene(), impl->transformToScreen()));
     return true;
 }
 
 static Eina_Bool _ewk_view_smart_mouse_down(Ewk_View_Smart_Data* smartData, const Evas_Event_Mouse_Down* downEvent)
 {
-    EWK_VIEW_PRIV_GET_OR_RETURN(smartData, priv, false);
+    EWK_VIEW_IMPL_GET_BY_SD_OR_RETURN(smartData, impl, false);
 
-    Evas_Point position = {smartData->view.x, smartData->view.y};
-    priv->pageProxy->handleMouseEvent(NativeWebMouseEvent(downEvent, &position));
+    impl->page()->handleMouseEvent(NativeWebMouseEvent(downEvent, impl->transformFromScene(), impl->transformToScreen()));
     return true;
 }
 
 static Eina_Bool _ewk_view_smart_mouse_up(Ewk_View_Smart_Data* smartData, const Evas_Event_Mouse_Up* upEvent)
 {
-    EWK_VIEW_PRIV_GET_OR_RETURN(smartData, priv, false);
+    EWK_VIEW_IMPL_GET_BY_SD_OR_RETURN(smartData, impl, false);
+
+    impl->page()->handleMouseEvent(NativeWebMouseEvent(upEvent, impl->transformFromScene(), impl->transformToScreen()));
+
+    InputMethodContextEfl* inputMethodContext = impl->inputMethodContext();
+    if (inputMethodContext)
+        inputMethodContext->handleMouseUpEvent(upEvent);
 
-    Evas_Point position = {smartData->view.x, smartData->view.y};
-    priv->pageProxy->handleMouseEvent(NativeWebMouseEvent(upEvent, &position));
     return true;
 }
 
 static Eina_Bool _ewk_view_smart_mouse_move(Ewk_View_Smart_Data* smartData, const Evas_Event_Mouse_Move* moveEvent)
 {
-    EWK_VIEW_PRIV_GET_OR_RETURN(smartData, priv, false);
+    EWK_VIEW_IMPL_GET_BY_SD_OR_RETURN(smartData, impl, false);
 
-    Evas_Point position = {smartData->view.x, smartData->view.y};
-    priv->pageProxy->handleMouseEvent(NativeWebMouseEvent(moveEvent, &position));
+    impl->page()->handleMouseEvent(NativeWebMouseEvent(moveEvent, impl->transformFromScene(), impl->transformToScreen()));
     return true;
 }
 
 static Eina_Bool _ewk_view_smart_key_down(Ewk_View_Smart_Data* smartData, const Evas_Event_Key_Down* downEvent)
 {
-    EWK_VIEW_PRIV_GET_OR_RETURN(smartData, priv, false);
+    EWK_VIEW_IMPL_GET_BY_SD_OR_RETURN(smartData, impl, false);
+
+    bool isFiltered = false;
+    InputMethodContextEfl* inputMethodContext = impl->inputMethodContext();
+    if (inputMethodContext)
+        inputMethodContext->handleKeyDownEvent(downEvent, &isFiltered);
 
-    priv->pageProxy->handleKeyboardEvent(NativeWebKeyboardEvent(downEvent));
+    impl->page()->handleKeyboardEvent(NativeWebKeyboardEvent(downEvent, isFiltered));
     return true;
 }
 
 static Eina_Bool _ewk_view_smart_key_up(Ewk_View_Smart_Data* smartData, const Evas_Event_Key_Up* upEvent)
 {
-    EWK_VIEW_PRIV_GET_OR_RETURN(smartData, priv, false);
+    EWK_VIEW_IMPL_GET_BY_SD_OR_RETURN(smartData, impl, false);
 
-    priv->pageProxy->handleKeyboardEvent(NativeWebKeyboardEvent(upEvent));
+    impl->page()->handleKeyboardEvent(NativeWebKeyboardEvent(upEvent));
     return true;
 }
 
@@ -353,33 +252,6 @@ static void _ewk_view_on_mouse_wheel(void* data, Evas*, Evas_Object*, void* even
     smartData->api->mouse_wheel(smartData, wheelEvent);
 }
 
-static void _ewk_view_on_mouse_down(void* data, Evas*, Evas_Object*, void* eventInfo)
-{
-    Evas_Event_Mouse_Down* downEvent = static_cast<Evas_Event_Mouse_Down*>(eventInfo);
-    Ewk_View_Smart_Data* smartData = static_cast<Ewk_View_Smart_Data*>(data);
-    EINA_SAFETY_ON_NULL_RETURN(smartData->api);
-    EINA_SAFETY_ON_NULL_RETURN(smartData->api->mouse_down);
-    smartData->api->mouse_down(smartData, downEvent);
-}
-
-static void _ewk_view_on_mouse_up(void* data, Evas*, Evas_Object*, void* eventInfo)
-{
-    Evas_Event_Mouse_Up* upEvent = static_cast<Evas_Event_Mouse_Up*>(eventInfo);
-    Ewk_View_Smart_Data* smartData = static_cast<Ewk_View_Smart_Data*>(data);
-    EINA_SAFETY_ON_NULL_RETURN(smartData->api);
-    EINA_SAFETY_ON_NULL_RETURN(smartData->api->mouse_up);
-    smartData->api->mouse_up(smartData, upEvent);
-}
-
-static void _ewk_view_on_mouse_move(void* data, Evas*, Evas_Object*, void* eventInfo)
-{
-    Evas_Event_Mouse_Move* moveEvent = static_cast<Evas_Event_Mouse_Move*>(eventInfo);
-    Ewk_View_Smart_Data* smartData = static_cast<Ewk_View_Smart_Data*>(data);
-    EINA_SAFETY_ON_NULL_RETURN(smartData->api);
-    EINA_SAFETY_ON_NULL_RETURN(smartData->api->mouse_move);
-    smartData->api->mouse_move(smartData, moveEvent);
-}
-
 static void _ewk_view_on_key_down(void* data, Evas*, Evas_Object*, void* eventInfo)
 {
     Evas_Event_Key_Down* downEvent = static_cast<Evas_Event_Key_Down*>(eventInfo);
@@ -401,84 +273,23 @@ static void _ewk_view_on_key_up(void* data, Evas*, Evas_Object*, void* eventInfo
 static void _ewk_view_on_show(void* data, Evas*, Evas_Object*, void* /*eventInfo*/)
 {
     Ewk_View_Smart_Data* smartData = static_cast<Ewk_View_Smart_Data*>(data);
-    EWK_VIEW_PRIV_GET_OR_RETURN(smartData, priv);
-    priv->pageProxy->viewStateDidChange(WebPageProxy::ViewIsVisible);
+    EWK_VIEW_IMPL_GET_BY_SD_OR_RETURN(smartData, impl);
+    impl->page()->viewStateDidChange(WebPageProxy::ViewIsVisible);
 }
 
 static void _ewk_view_on_hide(void* data, Evas*, Evas_Object*, void* /*eventInfo*/)
 {
     Ewk_View_Smart_Data* smartData = static_cast<Ewk_View_Smart_Data*>(data);
-    EWK_VIEW_PRIV_GET_OR_RETURN(smartData, priv);
+    EWK_VIEW_IMPL_GET_BY_SD_OR_RETURN(smartData, impl);
 
     // This call may look wrong, but we really need to pass ViewIsVisible here.
     // viewStateDidChange() itself is responsible for actually setting the visibility to Visible or Hidden
     // depending on what WebPageProxy::isViewVisible() returns, this simply triggers the process.
-    priv->pageProxy->viewStateDidChange(WebPageProxy::ViewIsVisible);
+    impl->page()->viewStateDidChange(WebPageProxy::ViewIsVisible);
 }
 
-#if ENABLE(TOUCH_EVENTS)
-static inline void _ewk_view_feed_touch_event_using_touch_point_list_of_evas(Evas_Object* ewkView, Ewk_Touch_Event_Type type)
-{
-    EWK_VIEW_SD_GET_OR_RETURN(ewkView, smartData);
-
-    unsigned count = evas_touch_point_list_count(smartData->base.evas);
-    if (!count)
-        return;
-
-    Eina_List* points = 0;
-    for (unsigned i = 0; i < count; ++i) {
-        Ewk_Touch_Point* point = new Ewk_Touch_Point;
-        point->id = evas_touch_point_list_nth_id_get(smartData->base.evas, i);
-        evas_touch_point_list_nth_xy_get(smartData->base.evas, i, &point->x, &point->y);
-        point->state = evas_touch_point_list_nth_state_get(smartData->base.evas, i);
-        points = eina_list_append(points, point);
-    }
-
-    ewk_view_feed_touch_event(ewkView, type, points, evas_key_modifier_get(smartData->base.evas));
-
-    void* data;
-    EINA_LIST_FREE(points, data)
-        delete static_cast<Ewk_Touch_Point*>(data);
-}
-
-static void _ewk_view_on_touch_down(void* /* data */, Evas* /* canvas */, Evas_Object* ewkView, void* /* eventInfo */)
-{
-    _ewk_view_feed_touch_event_using_touch_point_list_of_evas(ewkView, EWK_TOUCH_START);
-}
-
-static void _ewk_view_on_touch_up(void* /* data */, Evas* /* canvas */, Evas_Object* ewkView, void* /* eventInfo */)
-{
-    _ewk_view_feed_touch_event_using_touch_point_list_of_evas(ewkView, EWK_TOUCH_END);
-}
-
-static void _ewk_view_on_touch_move(void* /* data */, Evas* /* canvas */, Evas_Object* ewkView, void* /* eventInfo */)
-{
-    _ewk_view_feed_touch_event_using_touch_point_list_of_evas(ewkView, EWK_TOUCH_MOVE);
-}
-#endif
-
 static Evas_Smart_Class g_parentSmartClass = EVAS_SMART_CLASS_INIT_NULL;
 
-static Ewk_View_Private_Data* _ewk_view_priv_new(Ewk_View_Smart_Data* smartData)
-{
-    Ewk_View_Private_Data* priv = new Ewk_View_Private_Data;
-    if (!priv) {
-        EINA_LOG_CRIT("could not allocate Ewk_View_Private_Data");
-        return 0;
-    }
-
-#ifdef HAVE_ECORE_X
-    priv->isUsingEcoreX = WebCore::isUsingEcoreX(smartData->base.evas);
-#endif
-
-    return priv;
-}
-
-static void _ewk_view_priv_del(Ewk_View_Private_Data* priv)
-{
-    delete priv;
-}
-
 static void _ewk_view_smart_add(Evas_Object* ewkView)
 {
     const Evas_Smart* smart = evas_object_smart_smart_get(ewkView);
@@ -500,13 +311,7 @@ static void _ewk_view_smart_add(Evas_Object* ewkView)
 
     g_parentSmartClass.add(ewkView);
 
-    smartData->priv = _ewk_view_priv_new(smartData);
-    if (!smartData->priv) {
-        EINA_LOG_CRIT("could not allocate Ewk_View_Private_Data");
-        evas_object_smart_data_set(ewkView, 0);
-        free(smartData);
-        return;
-    }
+    smartData->priv = 0;
 
     // Create evas_object_image to draw web contents.
     smartData->image = evas_object_image_add(smartData->base.evas);
@@ -515,8 +320,6 @@ static void _ewk_view_smart_add(Evas_Object* ewkView)
     evas_object_smart_member_add(smartData->image, ewkView);
     evas_object_show(smartData->image);
 
-    ewk_view_mouse_events_enabled_set(ewkView, true);
-
 #define CONNECT(s, c) evas_object_event_callback_add(ewkView, s, c, smartData)
     CONNECT(EVAS_CALLBACK_FOCUS_IN, _ewk_view_on_focus_in);
     CONNECT(EVAS_CALLBACK_FOCUS_OUT, _ewk_view_on_focus_out);
@@ -530,10 +333,9 @@ static void _ewk_view_smart_add(Evas_Object* ewkView)
 
 static void _ewk_view_smart_del(Evas_Object* ewkView)
 {
-    removeFromPageViewMap(ewkView);
     EWK_VIEW_SD_GET(ewkView, smartData);
-    if (smartData && smartData->priv)
-        _ewk_view_priv_del(smartData->priv);
+    if (smartData)
+        delete smartData->priv;
 
     g_parentSmartClass.del(ewkView);
 }
@@ -558,143 +360,42 @@ static void _ewk_view_smart_move(Evas_Object* ewkView, Evas_Coord /*x*/, Evas_Co
     _ewk_view_smart_changed(smartData);
 }
 
-IntSize ewk_view_size_get(const Evas_Object* ewkView)
-{
-    int width, height;
-    evas_object_geometry_get(ewkView, 0, 0, &width, &height);
-    return IntSize(width, height);
-}
-
-#if USE(ACCELERATED_COMPOSITING)
-static bool ewk_view_create_gl_surface(const Evas_Object* ewkView, const IntSize& viewSize)
-{
-    EWK_VIEW_SD_GET_OR_RETURN(ewkView, smartData, false);
-    EWK_VIEW_PRIV_GET_OR_RETURN(smartData, priv, false);
-
-    Evas_GL_Config evasGlConfig = {
-        EVAS_GL_RGBA_8888,
-        EVAS_GL_DEPTH_BIT_8,
-        EVAS_GL_STENCIL_NONE,
-        EVAS_GL_OPTIONS_NONE,
-        EVAS_GL_MULTISAMPLE_NONE
-    };
-
-    ASSERT(!priv->evasGlSurface);
-    priv->evasGlSurface = evas_gl_surface_create(priv->evasGl, &evasGlConfig, viewSize.width(), viewSize.height());
-    if (!priv->evasGlSurface)
-        return false;
-
-    Evas_Native_Surface nativeSurface;
-    evas_gl_native_surface_get(priv->evasGl, priv->evasGlSurface, &nativeSurface);
-    evas_object_image_native_surface_set(smartData->image, &nativeSurface);
-
-    return true;
-}
-
-bool ewk_view_accelerated_compositing_mode_enter(const Evas_Object* ewkView)
-{
-    EWK_VIEW_SD_GET_OR_RETURN(ewkView, smartData, false);
-    EWK_VIEW_PRIV_GET_OR_RETURN(smartData, priv, false);
-
-    if (priv->evasGl) {
-        EINA_LOG_DOM_WARN(_ewk_log_dom, "Accelerated compositing mode already entered.");
-        return false;
-    }
-
-    Evas* evas = evas_object_evas_get(ewkView);
-    priv->evasGl = evas_gl_new(evas);
-    if (!priv->evasGl)
-        return false;
-
-    priv->evasGlContext = evas_gl_context_create(priv->evasGl, 0);
-    if (!priv->evasGlContext) {
-        evas_gl_free(priv->evasGl);
-        priv->evasGl = 0;
-        return false;
-    }
-
-    if (!ewk_view_create_gl_surface(ewkView, ewk_view_size_get(ewkView))) {
-        evas_gl_context_destroy(priv->evasGl, priv->evasGlContext);
-        priv->evasGlContext = 0;
-
-        evas_gl_free(priv->evasGl);
-        priv->evasGl = 0;
-        return false;
-    }
-
-    priv->pageViewportControllerClient->setRendererActive(true);
-    return true;
-}
-
-bool ewk_view_accelerated_compositing_mode_exit(const Evas_Object* ewkView)
-{
-    EWK_VIEW_SD_GET_OR_RETURN(ewkView, smartData, false);
-    EWK_VIEW_PRIV_GET_OR_RETURN(smartData, priv, false);
-
-    EINA_SAFETY_ON_NULL_RETURN_VAL(priv->evasGl, false);
-
-    if (priv->evasGlSurface) {
-        evas_gl_surface_destroy(priv->evasGl, priv->evasGlSurface);
-        priv->evasGlSurface = 0;
-    }
-
-    if (priv->evasGlContext) {
-        evas_gl_context_destroy(priv->evasGl, priv->evasGlContext);
-        priv->evasGlContext = 0;
-    }
-
-    evas_gl_free(priv->evasGl);
-    priv->evasGl = 0;
-
-    return true;
-}
-#endif
-
 static void _ewk_view_smart_calculate(Evas_Object* ewkView)
 {
     EWK_VIEW_SD_GET_OR_RETURN(ewkView, smartData);
-    EWK_VIEW_PRIV_GET_OR_RETURN(smartData, priv);
-
-#if USE(ACCELERATED_COMPOSITING)
-    bool needsNewSurface = false;
-#endif
+    EWK_VIEW_IMPL_GET_BY_SD_OR_RETURN(smartData, impl);
 
     smartData->changed.any = false;
 
     Evas_Coord x, y, width, height;
     evas_object_geometry_get(ewkView, &x, &y, &width, &height);
 
-    if (smartData->changed.size) {
-#if USE(COORDINATED_GRAPHICS)
-        priv->pageViewportControllerClient->updateViewportSize(IntSize(width, height));
-#endif
-#if USE(ACCELERATED_COMPOSITING)
-        needsNewSurface = priv->evasGlSurface;
-#endif
-
-        if (priv->pageProxy->drawingArea())
-            priv->pageProxy->drawingArea()->setSize(IntSize(width, height), IntSize());
-
-        smartData->view.w = width;
-        smartData->view.h = height;
-        smartData->changed.size = false;
-    }
-
     if (smartData->changed.position) {
-        evas_object_move(smartData->image, x, y);
+        smartData->changed.position = false;
         smartData->view.x = x;
         smartData->view.y = y;
-        smartData->changed.position = false;
+        evas_object_move(smartData->image, x, y);
     }
 
+    if (smartData->changed.size) {
+        smartData->changed.size = false;
+        smartData->view.w = width;
+        smartData->view.h = height;
+
+        if (impl->page()->drawingArea())
+            impl->page()->drawingArea()->setSize(IntSize(width, height), IntSize());
+
 #if USE(ACCELERATED_COMPOSITING)
-    if (needsNewSurface) {
-        evas_gl_surface_destroy(priv->evasGl, priv->evasGlSurface);
-        priv->evasGlSurface = 0;
-        ewk_view_create_gl_surface(ewkView, IntSize(width, height));
-        ewk_view_display(ewkView, IntRect(IntPoint(), IntSize(width, height)));
-    }
+        // Recreate surface if needed.
+        if (impl->evasGLSurface())
+            impl->clearEvasGLSurface();
+
+        impl->createGLSurface(IntSize(width, height));
 #endif
+#if USE(TILED_BACKING_STORE)
+        impl->pageClient()->updateViewportSize(IntSize(width, height));
+#endif
+    }
 }
 
 static void _ewk_view_smart_show(Evas_Object* ewkView)
@@ -717,7 +418,7 @@ static void _ewk_view_smart_hide(Evas_Object* ewkView)
 static void _ewk_view_smart_color_set(Evas_Object* ewkView, int red, int green, int blue, int alpha)
 {
     EWK_VIEW_SD_GET_OR_RETURN(ewkView, smartData);
-    EWK_VIEW_PRIV_GET_OR_RETURN(smartData, priv);
+    EWK_VIEW_IMPL_GET_BY_SD_OR_RETURN(smartData, impl);
 
     if (alpha < 0)
         alpha = 0;
@@ -735,8 +436,8 @@ static void _ewk_view_smart_color_set(Evas_Object* ewkView, int red, int green,
 #undef CHECK_COLOR
 
     evas_object_image_alpha_set(smartData->image, alpha < 255);
-    priv->pageProxy->setDrawsBackground(red || green || blue);
-    priv->pageProxy->setDrawsTransparentBackground(alpha < 255);
+    impl->page()->setDrawsBackground(red || green || blue);
+    impl->page()->setDrawsTransparentBackground(alpha < 255);
 
     g_parentSmartClass.color_set(ewkView, red, green, blue, alpha);
 }
@@ -780,7 +481,7 @@ Eina_Bool ewk_view_smart_class_set(Ewk_View_Smart_Class* api)
     return true;
 }
 
-static inline Evas_Smart* _ewk_view_smart_class_new(void)
+static inline Evas_Smart* createEwkViewSmartClass(void)
 {
     static Ewk_View_Smart_Class api = EWK_VIEW_SMART_CLASS_INIT_NAME_VERSION("Ewk_View");
     static Evas_Smart* smart = 0;
@@ -793,65 +494,14 @@ static inline Evas_Smart* _ewk_view_smart_class_new(void)
     return smart;
 }
 
-static void _ewk_view_initialize(Evas_Object* ewkView, PassRefPtr<Ewk_Context> context, WKPageGroupRef pageGroupRef)
-{
-    EWK_VIEW_SD_GET_OR_RETURN(ewkView, smartData);
-    EWK_VIEW_PRIV_GET_OR_RETURN(smartData, priv);
-    EINA_SAFETY_ON_NULL_RETURN(context);
-
-    if (priv->pageClient)
-        return;
-
-    priv->pageClient = PageClientImpl::create(ewkView);
-
-    if (pageGroupRef)
-        priv->pageProxy = toImpl(context->wkContext())->createWebPage(priv->pageClient.get(), toImpl(pageGroupRef));
-    else
-        priv->pageProxy = toImpl(context->wkContext())->createWebPage(priv->pageClient.get(), WebPageGroup::create().get());
-
-    addToPageViewMap(ewkView);
-
-#if USE(COORDINATED_GRAPHICS)
-    priv->pageProxy->pageGroup()->preferences()->setAcceleratedCompositingEnabled(true);
-    priv->pageProxy->pageGroup()->preferences()->setForceCompositingMode(true);
-    priv->pageProxy->setUseFixedLayout(true);
-#endif
-    priv->pageProxy->initializeWebPage();
-
-    priv->backForwardList = Ewk_Back_Forward_List::create(toAPI(priv->pageProxy->backForwardList()));
-    priv->settings = adoptPtr(new Ewk_Settings(WKPageGroupGetPreferences(WKPageGetPageGroup(toAPI(priv->pageProxy.get())))));
-    priv->context = context;
-
-#if USE(COORDINATED_GRAPHICS)
-    priv->pageViewportControllerClient = PageViewportControllerClientEfl::create(ewkView);
-#endif
-
-    // Initialize page clients.
-    WKPageRef wkPage = toAPI(priv->pageProxy.get());
-    ewk_view_find_client_attach(wkPage, ewkView);
-    ewk_view_form_client_attach(wkPage, ewkView);
-    ewk_view_policy_client_attach(wkPage, ewkView);
-    ewk_view_ui_client_attach(wkPage, ewkView);
-#if ENABLE(FULLSCREEN_API)
-    priv->pageProxy->fullScreenManager()->setWebView(ewkView);
-    ewk_settings_fullscreen_enabled_set(priv->settings.get(), true);
-#endif
-    priv->pageLoadClient = PageLoadClientEfl::create(ewkView);
-    priv->resourceLoadClient = ResourceLoadClientEfl::create(ewkView);
-
-    /* Listen for favicon changes */
-    Ewk_Favicon_Database* iconDatabase = priv->context->faviconDatabase();
-    iconDatabase->watchChanges(IconChangeCallbackData(_ewk_view_on_favicon_changed, ewkView));
-}
-
-static Evas_Object* _ewk_view_add_with_smart(Evas* canvas, Evas_Smart* smart)
+static inline Evas_Object* createEwkView(Evas* canvas, Evas_Smart* smart, PassRefPtr<EwkContext> context, WKPageGroupRef pageGroupRef = 0, EwkViewImpl::ViewBehavior behavior = EwkViewImpl::DefaultBehavior)
 {
     EINA_SAFETY_ON_NULL_RETURN_VAL(canvas, 0);
     EINA_SAFETY_ON_NULL_RETURN_VAL(smart, 0);
+    EINA_SAFETY_ON_NULL_RETURN_VAL(context, 0);
 
     Evas_Object* ewkView = evas_object_smart_add(canvas, smart);
-    if (!ewkView)
-        return 0;
+    EINA_SAFETY_ON_NULL_RETURN_VAL(ewkView, 0);
 
     EWK_VIEW_SD_GET(ewkView, smartData);
     if (!smartData) {
@@ -859,12 +509,9 @@ static Evas_Object* _ewk_view_add_with_smart(Evas* canvas, Evas_Smart* smart)
         return 0;
     }
 
-    EWK_VIEW_PRIV_GET(smartData, priv);
-    if (!priv) {
-        evas_object_del(ewkView);
-        return 0;
-    }
-
+    ASSERT(!smartData->priv);
+    RefPtr<WebPageGroup> pageGroup = pageGroupRef ? toImpl(pageGroupRef) : WebPageGroup::create();
+    smartData->priv = new EwkViewImpl(ewkView, context, pageGroup, behavior);
     return ewkView;
 }
 
@@ -874,36 +521,17 @@ static Evas_Object* _ewk_view_add_with_smart(Evas* canvas, Evas_Smart* smart)
  */
 Evas_Object* ewk_view_base_add(Evas* canvas, WKContextRef contextRef, WKPageGroupRef pageGroupRef)
 {
-    EINA_SAFETY_ON_NULL_RETURN_VAL(canvas, 0);
-    EINA_SAFETY_ON_NULL_RETURN_VAL(contextRef, 0);
-    Evas_Object* ewkView = _ewk_view_add_with_smart(canvas, _ewk_view_smart_class_new());
-    if (!ewkView)
-        return 0;
-
-    _ewk_view_initialize(ewkView, Ewk_Context::create(contextRef), pageGroupRef);
-
-    return ewkView;
+    return createEwkView(canvas, createEwkViewSmartClass(), EwkContext::create(contextRef), pageGroupRef, EwkViewImpl::LegacyBehavior);
 }
 
 Evas_Object* ewk_view_smart_add(Evas* canvas, Evas_Smart* smart, Ewk_Context* context)
 {
-    EINA_SAFETY_ON_NULL_RETURN_VAL(canvas, 0);
-    EINA_SAFETY_ON_NULL_RETURN_VAL(smart, 0);
-    EINA_SAFETY_ON_NULL_RETURN_VAL(context, 0);
-
-    Evas_Object* ewkView = _ewk_view_add_with_smart(canvas, smart);
-    if (!ewkView)
-        return 0;
-
-    _ewk_view_initialize(ewkView, context, 0);
-
-    return ewkView;
+    return createEwkView(canvas, smart, ewk_object_cast<EwkContext*>(context));
 }
 
 Evas_Object* ewk_view_add_with_context(Evas* canvas, Ewk_Context* context)
 {
-    EINA_SAFETY_ON_NULL_RETURN_VAL(context, 0);
-    return ewk_view_smart_add(canvas, _ewk_view_smart_class_new(), context);
+    return ewk_view_smart_add(canvas, createEwkViewSmartClass(), ewk_object_cast<EwkContext*>(context));
 }
 
 Evas_Object* ewk_view_add(Evas* canvas)
@@ -913,470 +541,136 @@ Evas_Object* ewk_view_add(Evas* canvas)
 
 Ewk_Context* ewk_view_context_get(const Evas_Object* ewkView)
 {
-    EWK_VIEW_SD_GET_OR_RETURN(ewkView, smartData, 0);
-    EWK_VIEW_PRIV_GET_OR_RETURN(smartData, priv, 0);
+    EWK_VIEW_IMPL_GET_OR_RETURN(ewkView, impl, 0);
 
-    return priv->context.get();
-}
-
-/**
- * @internal
- * The url of view was changed by the frame loader.
- *
- * Emits signal: "url,changed" with pointer to new url string.
- */
-void ewk_view_url_update(Evas_Object* ewkView)
-{
-    EWK_VIEW_SD_GET_OR_RETURN(ewkView, smartData);
-    EWK_VIEW_PRIV_GET_OR_RETURN(smartData, priv);
-
-    String activeURL = priv->pageProxy->activeURL();
-    if (activeURL.isEmpty())
-        return;
-
-    if (priv->url == activeURL.utf8().data())
-        return;
-
-    priv->url = activeURL.utf8().data();
-    const char* callbackArgument = static_cast<const char*>(priv->url);
-    evas_object_smart_callback_call(ewkView, "url,changed", const_cast<char*>(callbackArgument));
-
-    // Update the view's favicon.
-    ewk_view_update_icon(ewkView);
+    return impl->ewkContext();
 }
 
 Eina_Bool ewk_view_url_set(Evas_Object* ewkView, const char* url)
 {
-    EWK_VIEW_SD_GET_OR_RETURN(ewkView, smartData, false);
-    EWK_VIEW_PRIV_GET_OR_RETURN(smartData, priv, false);
+    EWK_VIEW_IMPL_GET_OR_RETURN(ewkView, impl, false);
     EINA_SAFETY_ON_NULL_RETURN_VAL(url, false);
 
-    priv->pageProxy->loadURL(url);
-    ewk_view_url_update(ewkView);
+    impl->page()->loadURL(url);
+    impl->informURLChange();
 
     return true;
 }
 
 const char* ewk_view_url_get(const Evas_Object* ewkView)
 {
-    EWK_VIEW_SD_GET_OR_RETURN(ewkView, smartData, 0);
-    EWK_VIEW_PRIV_GET_OR_RETURN(smartData, priv, 0);
+    EWK_VIEW_IMPL_GET_OR_RETURN(ewkView, impl, 0);
 
-    return priv->url;
+    return impl->url();
 }
 
 const char *ewk_view_icon_url_get(const Evas_Object *ewkView)
 {
-    EWK_VIEW_SD_GET_OR_RETURN(ewkView, smartData, 0);
-    EWK_VIEW_PRIV_GET_OR_RETURN(smartData, priv, 0);
+    EWK_VIEW_IMPL_GET_OR_RETURN(ewkView, impl, 0);
 
-    return priv->faviconURL;
+    return impl->faviconURL();
 }
 
 Eina_Bool ewk_view_reload(Evas_Object* ewkView)
 {
-    EWK_VIEW_SD_GET_OR_RETURN(ewkView, smartData, false);
-    EWK_VIEW_PRIV_GET_OR_RETURN(smartData, priv, false);
+    EWK_VIEW_IMPL_GET_OR_RETURN(ewkView, impl, false);
 
-    priv->pageProxy->reload(/*reloadFromOrigin*/ false);
-    ewk_view_url_update(ewkView);
+    impl->page()->reload(/*reloadFromOrigin*/ false);
+    impl->informURLChange();
 
     return true;
 }
 
 Eina_Bool ewk_view_reload_bypass_cache(Evas_Object* ewkView)
 {
-    EWK_VIEW_SD_GET_OR_RETURN(ewkView, smartData, false);
-    EWK_VIEW_PRIV_GET_OR_RETURN(smartData, priv, false);
+    EWK_VIEW_IMPL_GET_OR_RETURN(ewkView, impl, false);
 
-    priv->pageProxy->reload(/*reloadFromOrigin*/ true);
-    ewk_view_url_update(ewkView);
+    impl->page()->reload(/*reloadFromOrigin*/ true);
+    impl->informURLChange();
 
     return true;
 }
 
 Eina_Bool ewk_view_stop(Evas_Object* ewkView)
 {
-    EWK_VIEW_SD_GET_OR_RETURN(ewkView, smartData, false);
-    EWK_VIEW_PRIV_GET_OR_RETURN(smartData, priv, false);
+    EWK_VIEW_IMPL_GET_OR_RETURN(ewkView, impl, false);
 
-    priv->pageProxy->stopLoading();
+    impl->page()->stopLoading();
 
     return true;
 }
 
 Ewk_Settings* ewk_view_settings_get(const Evas_Object* ewkView)
 {
-    EWK_VIEW_SD_GET_OR_RETURN(ewkView, smartData, 0);
-    EWK_VIEW_PRIV_GET_OR_RETURN(smartData, priv, 0);
+    EWK_VIEW_IMPL_GET_OR_RETURN(ewkView, impl, 0);
 
-    return priv->settings.get();
-}
-
-/**
- * @internal
- * Retrieves the internal WKPage for this view.
- */
-WKPageRef ewk_view_wkpage_get(const Evas_Object* ewkView)
-{
-    EWK_VIEW_SD_GET_OR_RETURN(ewkView, smartData, 0);
-    EWK_VIEW_PRIV_GET_OR_RETURN(smartData, priv, 0);
-
-    return toAPI(priv->pageProxy.get());
-}
-
-/**
- * @internal
- * Load was initiated for a resource in the view.
- *
- * Emits signal: "resource,request,new" with pointer to resource request.
- */
-void ewk_view_resource_load_initiated(Evas_Object* ewkView, Ewk_Resource* resource, Ewk_Url_Request* request)
-{
-    Ewk_Resource_Request resourceRequest = {resource, request, 0};
-
-    evas_object_smart_callback_call(ewkView, "resource,request,new", &resourceRequest);
-}
-
-/**
- * @internal
- * Received a response to a resource load request in the view.
- *
- * Emits signal: "resource,request,response" with pointer to resource response.
- */
-void ewk_view_resource_load_response(Evas_Object* ewkView, Ewk_Resource* resource, Ewk_Url_Response* response)
-{
-    Ewk_Resource_Load_Response resourceLoadResponse = {resource, response};
-    evas_object_smart_callback_call(ewkView, "resource,request,response", &resourceLoadResponse);
-}
-
-/**
- * @internal
- * Failed loading a resource in the view.
- *
- * Emits signal: "resource,request,finished" with pointer to the resource load error.
- */
-void ewk_view_resource_load_failed(Evas_Object* ewkView, Ewk_Resource* resource, Ewk_Error* error)
-{
-    Ewk_Resource_Load_Error resourceLoadError = {resource, error};
-    evas_object_smart_callback_call(ewkView, "resource,request,failed", &resourceLoadError);
-}
-
-/**
- * @internal
- * Finished loading a resource in the view.
- *
- * Emits signal: "resource,request,finished" with pointer to the resource.
- */
-void ewk_view_resource_load_finished(Evas_Object* ewkView, Ewk_Resource* resource)
-{
-    evas_object_smart_callback_call(ewkView, "resource,request,finished", resource);
-}
-
-/**
- * @internal
- * Request was sent for a resource in the view.
- *
- * Emits signal: "resource,request,sent" with pointer to resource request and possible redirect response.
- */
-void ewk_view_resource_request_sent(Evas_Object* ewkView, Ewk_Resource* resource, Ewk_Url_Request* request, Ewk_Url_Response* redirectResponse)
-{
-    Ewk_Resource_Request resourceRequest = {resource, request, redirectResponse};
-    evas_object_smart_callback_call(ewkView, "resource,request,sent", &resourceRequest);
+    return impl->settings();
 }
 
 const char* ewk_view_title_get(const Evas_Object* ewkView)
 {
-    EWK_VIEW_SD_GET_OR_RETURN(ewkView, smartData, 0);
-    EWK_VIEW_PRIV_GET_OR_RETURN(smartData, priv, 0);
+    EWK_VIEW_IMPL_GET_OR_RETURN(ewkView, impl, 0);
 
-    CString title = priv->pageProxy->pageTitle().utf8();
-    priv->title = title.data();
-
-    return priv->title;
-}
-
-/**
- * @internal
- * Reports that the requested text was found.
- *
- * Emits signal: "text,found" with the number of matches.
- */
-void ewk_view_text_found(Evas_Object* ewkView, unsigned int matchCount)
-{
-    evas_object_smart_callback_call(ewkView, "text,found", &matchCount);
-}
-
-/**
- * @internal
- * The view title was changed by the frame loader.
- *
- * Emits signal: "title,changed" with pointer to new title string.
- */
-void ewk_view_title_changed(Evas_Object* ewkView, const char* title)
-{
-    evas_object_smart_callback_call(ewkView, "title,changed", const_cast<char*>(title));
-}
-
-/**
- * @internal
- */
-void ewk_view_tooltip_text_set(Evas_Object* ewkView, const char* text)
-{
-    if (text && *text)
-        evas_object_smart_callback_call(ewkView, "tooltip,text,set", const_cast<char*>(text));
-    else
-        evas_object_smart_callback_call(ewkView, "tooltip,text,unset", 0);
+    return impl->title();
 }
 
 double ewk_view_load_progress_get(const Evas_Object* ewkView)
 {
-    EWK_VIEW_SD_GET_OR_RETURN(ewkView, smartData, -1.0);
-    EWK_VIEW_PRIV_GET_OR_RETURN(smartData, priv, -1.0);
+    EWK_VIEW_IMPL_GET_OR_RETURN(ewkView, impl, -1.0);
 
-    return priv->pageProxy->estimatedProgress();
+    return impl->page()->estimatedProgress();
 }
 
 Eina_Bool ewk_view_scale_set(Evas_Object* ewkView, double scaleFactor, int x, int y)
 {
-    EWK_VIEW_SD_GET_OR_RETURN(ewkView, smartData, false);
-    EWK_VIEW_PRIV_GET_OR_RETURN(smartData, priv, false);
+    EWK_VIEW_IMPL_GET_OR_RETURN(ewkView, impl, false);
 
-    priv->pageProxy->scalePage(scaleFactor, IntPoint(x, y));
+    impl->page()->scalePage(scaleFactor, IntPoint(x, y));
     return true;
 }
 
 double ewk_view_scale_get(const Evas_Object* ewkView)
 {
-    EWK_VIEW_SD_GET_OR_RETURN(ewkView, smartData, -1);
-    EWK_VIEW_PRIV_GET_OR_RETURN(smartData, priv, -1);
+    EWK_VIEW_IMPL_GET_OR_RETURN(ewkView, impl, -1);
 
-    return priv->pageProxy->pageScaleFactor();
+    return impl->page()->pageScaleFactor();
 }
 
 Eina_Bool ewk_view_device_pixel_ratio_set(Evas_Object* ewkView, float ratio)
 {
-    EWK_VIEW_SD_GET_OR_RETURN(ewkView, smartData, false);
-    EWK_VIEW_PRIV_GET_OR_RETURN(smartData, priv, false);
+    EWK_VIEW_IMPL_GET_OR_RETURN(ewkView, impl, false);
 
-    priv->pageProxy->setCustomDeviceScaleFactor(ratio);
+    impl->page()->setCustomDeviceScaleFactor(ratio);
 
     return true;
 }
 
 float ewk_view_device_pixel_ratio_get(const Evas_Object* ewkView)
 {
-    EWK_VIEW_SD_GET_OR_RETURN(ewkView, smartData, -1.0);
-    EWK_VIEW_PRIV_GET_OR_RETURN(smartData, priv, -1.0);
-
-    return priv->pageProxy->deviceScaleFactor();
-}
-
-/**
- * @internal
- * Reports load progress changed.
- *
- * Emits signal: "load,progress" with pointer to a double from 0.0 to 1.0.
- */
-void ewk_view_load_progress_changed(Evas_Object* ewkView, double progress)
-{
-    evas_object_smart_callback_call(ewkView, "load,progress", &progress);
-}
+    EWK_VIEW_IMPL_GET_OR_RETURN(ewkView, impl, -1.0);
 
-/**
- * @internal
- * The view received a new intent request.
- *
- * Emits signal: "intent,request,new" with pointer to a Ewk_Intent.
- */
-void ewk_view_intent_request_new(Evas_Object* ewkView, const Ewk_Intent* ewkIntent)
-{
-#if ENABLE(WEB_INTENTS)
-    evas_object_smart_callback_call(ewkView, "intent,request,new", const_cast<Ewk_Intent*>(ewkIntent));
-#endif
+    return impl->page()->deviceScaleFactor();
 }
 
 void ewk_view_theme_set(Evas_Object* ewkView, const char* path)
 {
-    EWK_VIEW_SD_GET_OR_RETURN(ewkView, smartData);
-    EWK_VIEW_PRIV_GET_OR_RETURN(smartData, priv);
+    EWK_VIEW_IMPL_GET_OR_RETURN(ewkView, impl);
 
-    if (priv->theme != path) {
-        priv->theme = path;
-        priv->pageProxy->setThemePath(path);
-    }
+    impl->setThemePath(path);
 }
 
 const char* ewk_view_theme_get(const Evas_Object* ewkView)
 {
-    EWK_VIEW_SD_GET_OR_RETURN(ewkView, smartData, 0);
-    EWK_VIEW_PRIV_GET_OR_RETURN(smartData, priv, 0);
-
-    return priv->theme;
-}
-
-void ewk_view_cursor_set(Evas_Object* ewkView, const Cursor& cursor)
-{
-    EWK_VIEW_SD_GET_OR_RETURN(ewkView, smartData);
-    EWK_VIEW_PRIV_GET_OR_RETURN(smartData, priv);
-
-    const char* group = cursor.platformCursor();
-    if (!group || group == priv->cursorGroup)
-        return;
-
-    priv->cursorGroup = group;
-    priv->cursorObject = adoptRef(edje_object_add(smartData->base.evas));
-
-    Ecore_Evas* ecoreEvas = ecore_evas_ecore_evas_get(smartData->base.evas);
-    if (!priv->theme || !edje_object_file_set(priv->cursorObject.get(), priv->theme, group)) {
-        priv->cursorObject.clear();
-
-        ecore_evas_object_cursor_set(ecoreEvas, 0, 0, 0, 0);
-#ifdef HAVE_ECORE_X
-        if (priv->isUsingEcoreX)
-            WebCore::applyFallbackCursor(ecoreEvas, group);
-#endif
-        return;
-    }
-
-    Evas_Coord width, height;
-    edje_object_size_min_get(priv->cursorObject.get(), &width, &height);
-    if (width <= 0 || height <= 0)
-        edje_object_size_min_calc(priv->cursorObject.get(), &width, &height);
-    if (width <= 0 || height <= 0) {
-        width = defaultCursorSize;
-        height = defaultCursorSize;
-    }
-    evas_object_resize(priv->cursorObject.get(), width, height);
-
-    const char* data;
-    int hotspotX = 0;
-    data = edje_object_data_get(priv->cursorObject.get(), "hot.x");
-    if (data)
-        hotspotX = atoi(data);
-
-    int hotspotY = 0;
-    data = edje_object_data_get(priv->cursorObject.get(), "hot.y");
-    if (data)
-        hotspotY = atoi(data);
-
-    ecore_evas_object_cursor_set(ecoreEvas, priv->cursorObject.get(), EVAS_LAYER_MAX, hotspotX, hotspotY);
-}
-
-void ewk_view_display(Evas_Object* ewkView, const IntRect& rect)
-{
-    EWK_VIEW_SD_GET_OR_RETURN(ewkView, smartData);
-    if (!smartData->image)
-        return;
-
-#if USE(COORDINATED_GRAPHICS)
-    EWK_VIEW_PRIV_GET_OR_RETURN(smartData, priv);
-
-    evas_gl_make_current(priv->evasGl, priv->evasGlSurface, priv->evasGlContext);
-    priv->pageViewportControllerClient->display(rect, IntPoint(smartData->view.x, smartData->view.y));
-#endif
-
-    evas_object_image_data_update_add(smartData->image, rect.x(), rect.y(), rect.width(), rect.height());
-}
-
-#if ENABLE(FULLSCREEN_API)
-/**
- * @internal
- * Calls fullscreen_enter callback or falls back to default behavior and enables fullscreen mode.
- */
-void ewk_view_full_screen_enter(Evas_Object* ewkView)
-{
-    EWK_VIEW_SD_GET_OR_RETURN(ewkView, smartData);
-
-    if (!smartData->api->fullscreen_enter || !smartData->api->fullscreen_enter(smartData)) {
-        Ecore_Evas* ecoreEvas = ecore_evas_ecore_evas_get(smartData->base.evas);
-        ecore_evas_fullscreen_set(ecoreEvas, true);
-    }
-}
-
-/**
- * @internal
- * Calls fullscreen_exit callback or falls back to default behavior and disables fullscreen mode.
- */
-void ewk_view_full_screen_exit(Evas_Object* ewkView)
-{
-    EWK_VIEW_SD_GET_OR_RETURN(ewkView, smartData);
+    EWK_VIEW_IMPL_GET_OR_RETURN(ewkView, impl, 0);
 
-    if (!smartData->api->fullscreen_exit || !smartData->api->fullscreen_exit(smartData)) {
-        Ecore_Evas* ecoreEvas = ecore_evas_ecore_evas_get(smartData->base.evas);
-        ecore_evas_fullscreen_set(ecoreEvas, false);
-    }
-}
-#endif
-
-#if ENABLE(SQL_DATABASE)
-/**
- * @internal
- * Calls exceeded_database_quota callback or falls back to default behavior returns default database quota.
- */
-unsigned long long ewk_view_database_quota_exceeded(Evas_Object* ewkView, const char* databaseName, const char* displayName, unsigned long long currentQuota, unsigned long long currentOriginUsage, unsigned long long currentDatabaseUsage, unsigned long long expectedUsage)
-{
-    EWK_VIEW_SD_GET_OR_RETURN(ewkView, smartData, 0);
-
-    static const unsigned long long defaultQuota = 5 * 1024 * 1204; // 5 MB
-    if (smartData->api->exceeded_database_quota)
-        return smartData->api->exceeded_database_quota(smartData, databaseName, displayName, currentQuota, currentOriginUsage, currentDatabaseUsage, expectedUsage);
-
-    return defaultQuota;
-}
-#endif
-
-/**
- * @internal
- * A download for that view was cancelled.
- *
- * Emits signal: "download,cancelled" with pointer to a Ewk_Download_Job.
- */
-void ewk_view_download_job_cancelled(Evas_Object* ewkView, Ewk_Download_Job* download)
-{
-    evas_object_smart_callback_call(ewkView, "download,cancelled", download);
-}
-
-/**
- * @internal
- * A new download has been requested for that view.
- *
- * Emits signal: "download,request" with pointer to a Ewk_Download_Job.
- */
-void ewk_view_download_job_requested(Evas_Object* ewkView, Ewk_Download_Job* download)
-{
-     evas_object_smart_callback_call(ewkView, "download,request", download);
-}
-
-/**
- * @internal
- * A download for that view has failed.
- *
- * Emits signal: "download,failed" with pointer to a Ewk_Download_Job_Error.
- */
-void ewk_view_download_job_failed(Evas_Object* ewkView, Ewk_Download_Job* download, Ewk_Error* error)
-{
-    Ewk_Download_Job_Error downloadError = { download, error };
-    evas_object_smart_callback_call(ewkView, "download,failed", &downloadError);
-}
-
-/**
- * @internal
- * A download for that view finished successfully.
- *
- * Emits signal: "download,finished" with pointer to a Ewk_Download_Job.
- */
-void ewk_view_download_job_finished(Evas_Object* ewkView, Ewk_Download_Job* download)
-{
-     evas_object_smart_callback_call(ewkView, "download,finished", download);
+    return impl->themePath();
 }
 
 Eina_Bool ewk_view_back(Evas_Object* ewkView)
 {
-    EWK_VIEW_SD_GET_OR_RETURN(ewkView, smartData, false);
-    EWK_VIEW_PRIV_GET_OR_RETURN(smartData, priv, false);
+    EWK_VIEW_IMPL_GET_OR_RETURN(ewkView, impl, false);
 
-    WebPageProxy* page = priv->pageProxy.get();
+    WebPageProxy* page = impl->page();
     if (page->canGoBack()) {
         page->goBack();
         return true;
@@ -1387,10 +681,9 @@ Eina_Bool ewk_view_back(Evas_Object* ewkView)
 
 Eina_Bool ewk_view_forward(Evas_Object* ewkView)
 {
-    EWK_VIEW_SD_GET_OR_RETURN(ewkView, smartData, false);
-    EWK_VIEW_PRIV_GET_OR_RETURN(smartData, priv, false);
+    EWK_VIEW_IMPL_GET_OR_RETURN(ewkView, impl, false);
 
-    WebPageProxy* page = priv->pageProxy.get();
+    WebPageProxy* page = impl->page();
     if (page->canGoForward()) {
         page->goForward();
         return true;
@@ -1402,11 +695,10 @@ Eina_Bool ewk_view_forward(Evas_Object* ewkView)
 Eina_Bool ewk_view_intent_deliver(Evas_Object* ewkView, Ewk_Intent* intent)
 {
 #if ENABLE(WEB_INTENTS)
-    EWK_VIEW_SD_GET_OR_RETURN(ewkView, smartData, false);
-    EWK_VIEW_PRIV_GET_OR_RETURN(smartData, priv, false);
+    EWK_VIEW_IMPL_GET_OR_RETURN(ewkView, impl, false);
     EINA_SAFETY_ON_NULL_RETURN_VAL(intent, false);
 
-    WebPageProxy* page = priv->pageProxy.get();
+    WebPageProxy* page = impl->page();
     page->deliverIntentToFrame(page->mainFrame(), intent->webIntentData());
 
     return true;
@@ -1417,245 +709,56 @@ Eina_Bool ewk_view_intent_deliver(Evas_Object* ewkView, Ewk_Intent* intent)
 
 Eina_Bool ewk_view_back_possible(Evas_Object* ewkView)
 {
-    EWK_VIEW_SD_GET_OR_RETURN(ewkView, smartData, false);
-    EWK_VIEW_PRIV_GET_OR_RETURN(smartData, priv, false);
+    EWK_VIEW_IMPL_GET_OR_RETURN(ewkView, impl, false);
 
-    return priv->pageProxy->canGoBack();
+    return impl->page()->canGoBack();
 }
 
 Eina_Bool ewk_view_forward_possible(Evas_Object* ewkView)
 {
-    EWK_VIEW_SD_GET_OR_RETURN(ewkView, smartData, false);
-    EWK_VIEW_PRIV_GET_OR_RETURN(smartData, priv, false);
+    EWK_VIEW_IMPL_GET_OR_RETURN(ewkView, impl, false);
 
-    return priv->pageProxy->canGoForward();
+    return impl->page()->canGoForward();
 }
 
 Ewk_Back_Forward_List* ewk_view_back_forward_list_get(const Evas_Object* ewkView)
 {
-    EWK_VIEW_SD_GET_OR_RETURN(ewkView, smartData, 0);
-    EWK_VIEW_PRIV_GET_OR_RETURN(smartData, priv, 0);
-
-    return priv->backForwardList.get();
-}
-
-void ewk_view_image_data_set(Evas_Object* ewkView, void* imageData, const IntSize& size)
-{
-    EWK_VIEW_SD_GET_OR_RETURN(ewkView, smartData);
-    if (!imageData || !smartData->image)
-        return;
-
-    evas_object_resize(smartData->image, size.width(), size.height());
-    evas_object_image_size_set(smartData->image, size.width(), size.height());
-    evas_object_image_data_copy_set(smartData->image, imageData);
-}
-
-/**
- * @internal
- * Reports that a form request is about to be submitted.
- *
- * Emits signal: "form,submission,request" with pointer to Ewk_Form_Submission_Request.
- */
-void ewk_view_form_submission_request_new(Evas_Object* ewkView, Ewk_Form_Submission_Request* request)
-{
-    evas_object_smart_callback_call(ewkView, "form,submission,request", request);
-}
+    EWK_VIEW_IMPL_GET_OR_RETURN(ewkView, impl, 0);
 
-/**
- * @internal
- * Reports load failed with error information.
- *
- * Emits signal: "load,error" with pointer to Ewk_Error.
- */
-void ewk_view_load_error(Evas_Object* ewkView, const Ewk_Error* error)
-{
-    evas_object_smart_callback_call(ewkView, "load,error", const_cast<Ewk_Error*>(error));
-}
-
-/**
- * @internal
- * Reports load finished.
- *
- * Emits signal: "load,finished".
- */
-void ewk_view_load_finished(Evas_Object* ewkView)
-{
-    ewk_view_url_update(ewkView);
-    evas_object_smart_callback_call(ewkView, "load,finished", 0);
-}
-
-/**
- * @internal
- * Reports view provisional load failed with error information.
- *
- * Emits signal: "load,provisional,failed" with pointer to Ewk_Error.
- */
-void ewk_view_load_provisional_failed(Evas_Object* ewkView, const Ewk_Error* error)
-{
-    evas_object_smart_callback_call(ewkView, "load,provisional,failed", const_cast<Ewk_Error*>(error));
-}
-
-/**
- * @internal
- * Reports view received redirect for provisional load.
- *
- * Emits signal: "load,provisional,redirect".
- */
-void ewk_view_load_provisional_redirect(Evas_Object* ewkView)
-{
-    ewk_view_url_update(ewkView);
-    evas_object_smart_callback_call(ewkView, "load,provisional,redirect", 0);
-}
-
-/**
- * @internal
- * Reports view provisional load started.
- *
- * Emits signal: "load,provisional,started".
- */
-void ewk_view_load_provisional_started(Evas_Object* ewkView)
-{
-    ewk_view_url_update(ewkView);
-    evas_object_smart_callback_call(ewkView, "load,provisional,started", 0);
-}
-
-/**
- * @internal
- * Reports that the view's back / forward list has changed.
- *
- * Emits signal: "back,forward,list,changed".
- */
-void ewk_view_back_forward_list_changed(Evas_Object* ewkView)
-{
-    evas_object_smart_callback_call(ewkView, "back,forward,list,changed", 0);
-}
-
-/**
- * @internal
- * Update the view's favicon and emits a "icon,changed" signal if it has
- * changed.
- *
- * This function is called whenever the URL has changed or when the icon for
- * the current page URL has changed.
- */
-void ewk_view_update_icon(Evas_Object* ewkView)
-{
-    EWK_VIEW_SD_GET_OR_RETURN(ewkView, smartData);
-    EWK_VIEW_PRIV_GET_OR_RETURN(smartData, priv);
-
-    Ewk_Favicon_Database* iconDatabase = priv->context->faviconDatabase();
-    ASSERT(iconDatabase);
-
-    priv->faviconURL = ewk_favicon_database_icon_url_get(iconDatabase, priv->url);
-    evas_object_smart_callback_call(ewkView, "icon,changed", 0);
-}
-
-/**
- * @internal
- * Reports that a navigation policy decision should be taken.
- *
- * Emits signal: "policy,decision,navigation".
- */
-void ewk_view_navigation_policy_decision(Evas_Object* ewkView, Ewk_Navigation_Policy_Decision* decision)
-{
-    evas_object_smart_callback_call(ewkView, "policy,decision,navigation", decision);
-}
-
-/**
- * @internal
- * Reports that a new window policy decision should be taken.
- *
- * Emits signal: "policy,decision,new,window".
- */
-void ewk_view_new_window_policy_decision(Evas_Object* ewkView, Ewk_Navigation_Policy_Decision* decision)
-{
-    evas_object_smart_callback_call(ewkView, "policy,decision,new,window", decision);
+    return impl->backForwardList();
 }
 
 Eina_Bool ewk_view_html_string_load(Evas_Object* ewkView, const char* html, const char* baseUrl, const char* unreachableUrl)
 {
-    EWK_VIEW_SD_GET_OR_RETURN(ewkView, smartData, false);
-    EWK_VIEW_PRIV_GET_OR_RETURN(smartData, priv, false);
+    EWK_VIEW_IMPL_GET_OR_RETURN(ewkView, impl, false);
     EINA_SAFETY_ON_NULL_RETURN_VAL(html, false);
 
     if (unreachableUrl && *unreachableUrl)
-        priv->pageProxy->loadAlternateHTMLString(String::fromUTF8(html), baseUrl ? String::fromUTF8(baseUrl) : "", String::fromUTF8(unreachableUrl));
+        impl->page()->loadAlternateHTMLString(String::fromUTF8(html), baseUrl ? String::fromUTF8(baseUrl) : "", String::fromUTF8(unreachableUrl));
     else
-        priv->pageProxy->loadHTMLString(String::fromUTF8(html), baseUrl ? String::fromUTF8(baseUrl) : "");
-    ewk_view_url_update(ewkView);
-
-    return true;
-}
-
-#if ENABLE(WEB_INTENTS_TAG)
-/**
- * @internal
- * The view received a new intent service registration.
- *
- * Emits signal: "intent,service,register" with pointer to a Ewk_Intent_Service.
- */
-void ewk_view_intent_service_register(Evas_Object* ewkView, const Ewk_Intent_Service* ewkIntentService)
-{
-    evas_object_smart_callback_call(ewkView, "intent,service,register", const_cast<Ewk_Intent_Service*>(ewkIntentService));
-}
-#endif // ENABLE(WEB_INTENTS_TAG)
-
-const Evas_Object* ewk_view_from_page_get(const WebKit::WebPageProxy* page)
-{
-    EINA_SAFETY_ON_NULL_RETURN_VAL(page, 0);
+        impl->page()->loadHTMLString(String::fromUTF8(html), baseUrl ? String::fromUTF8(baseUrl) : "");
 
-    return pageViewMap().get(page);
-}
-
-WebPageProxy* ewk_view_page_get(const Evas_Object* ewkView)
-{
-    EWK_VIEW_SD_GET_OR_RETURN(ewkView, smartData, 0);
-    EWK_VIEW_PRIV_GET_OR_RETURN(smartData, priv, 0);
+    impl->informURLChange();
 
-    return priv->pageProxy.get();
+    return true;
 }
 
 const char* ewk_view_setting_encoding_custom_get(const Evas_Object* ewkView)
 {
-    EWK_VIEW_SD_GET_OR_RETURN(ewkView, smartData, 0);
-    EWK_VIEW_PRIV_GET_OR_RETURN(smartData, priv, 0);
-
-    String customEncoding = priv->pageProxy->customTextEncodingName();
-    if (customEncoding.isEmpty())
-        return 0;
-
-    priv->customEncoding = customEncoding.utf8().data();
+    EWK_VIEW_IMPL_GET_OR_RETURN(ewkView, impl, 0);
 
-    return priv->customEncoding;
+    return impl->customTextEncodingName();
 }
 
 Eina_Bool ewk_view_setting_encoding_custom_set(Evas_Object* ewkView, const char* encoding)
 {
-    EWK_VIEW_SD_GET_OR_RETURN(ewkView, smartData, false);
-    EWK_VIEW_PRIV_GET_OR_RETURN(smartData, priv, false);
+    EWK_VIEW_IMPL_GET_OR_RETURN(ewkView, impl, false);
 
-    priv->customEncoding = encoding;
-    priv->pageProxy->setCustomTextEncodingName(encoding ? encoding : String());
+    impl->setCustomTextEncodingName(encoding ? encoding : String());
 
     return true;
 }
 
-void ewk_view_page_close(Evas_Object* ewkView)
-{
-    evas_object_smart_callback_call(ewkView, "close,window", 0);
-}
-
-WKPageRef ewk_view_page_create(Evas_Object* ewkView)
-{
-    Evas_Object* newEwkView = 0;
-    evas_object_smart_callback_call(ewkView, "create,window", &newEwkView);
-
-    if (!newEwkView)
-        return 0;
-
-    return static_cast<WKPageRef>(WKRetain(ewk_view_page_get(newEwkView)));
-}
-
 // EwkFindOptions should be matched up orders with WkFindOptions.
 COMPILE_ASSERT_MATCHING_ENUM(EWK_FIND_OPTIONS_CASE_INSENSITIVE, kWKFindOptionsCaseInsensitive);
 COMPILE_ASSERT_MATCHING_ENUM(EWK_FIND_OPTIONS_AT_WORD_STARTS, kWKFindOptionsAtWordStarts);
@@ -1668,258 +771,47 @@ COMPILE_ASSERT_MATCHING_ENUM(EWK_FIND_OPTIONS_SHOW_HIGHLIGHT, kWKFindOptionsShow
 
 Eina_Bool ewk_view_text_find(Evas_Object* ewkView, const char* text, Ewk_Find_Options options, unsigned maxMatchCount)
 {
-    EWK_VIEW_SD_GET_OR_RETURN(ewkView, smartData, false);
-    EWK_VIEW_PRIV_GET_OR_RETURN(smartData, priv, false);
+    EWK_VIEW_IMPL_GET_OR_RETURN(ewkView, impl, false);
     EINA_SAFETY_ON_NULL_RETURN_VAL(text, false);
 
-    priv->pageProxy->findString(String::fromUTF8(text), static_cast<WebKit::FindOptions>(options), maxMatchCount);
+    impl->page()->findString(String::fromUTF8(text), static_cast<WebKit::FindOptions>(options), maxMatchCount);
 
     return true;
 }
 
 Eina_Bool ewk_view_text_find_highlight_clear(Evas_Object* ewkView)
 {
-    EWK_VIEW_SD_GET_OR_RETURN(ewkView, smartData, false);
-    EWK_VIEW_PRIV_GET_OR_RETURN(smartData, priv, false);
+    EWK_VIEW_IMPL_GET_OR_RETURN(ewkView, impl, false);
 
-    priv->pageProxy->hideFindUI();
+    impl->page()->hideFindUI();
 
     return true;
 }
 
 Eina_Bool ewk_view_text_matches_count(Evas_Object* ewkView, const char* text, Ewk_Find_Options options, unsigned maxMatchCount)
 {
-    EWK_VIEW_SD_GET_OR_RETURN(ewkView, smartData, false);
-    EWK_VIEW_PRIV_GET_OR_RETURN(smartData, priv, false);
+    EWK_VIEW_IMPL_GET_OR_RETURN(ewkView, impl, false);
     EINA_SAFETY_ON_NULL_RETURN_VAL(text, false);
 
-    priv->pageProxy->countStringMatches(String::fromUTF8(text), static_cast<WebKit::FindOptions>(options), maxMatchCount);
-
-    return true;
-}
-
-void ewk_view_contents_size_changed(const Evas_Object* ewkView, const IntSize& size)
-{
-#if USE(COORDINATED_GRAPHICS)
-    EWK_VIEW_SD_GET_OR_RETURN(ewkView, smartData);
-    EWK_VIEW_PRIV_GET_OR_RETURN(smartData, priv);
-
-    priv->pageViewportControllerClient->didChangeContentsSize(size);
-#else
-    UNUSED_PARAM(ewkView);
-    UNUSED_PARAM(size);
-#endif
-}
-
-COMPILE_ASSERT_MATCHING_ENUM(EWK_TEXT_DIRECTION_RIGHT_TO_LEFT, RTL);
-COMPILE_ASSERT_MATCHING_ENUM(EWK_TEXT_DIRECTION_LEFT_TO_RIGHT, LTR);
-
-void ewk_view_popup_menu_request(Evas_Object* ewkView, WebPopupMenuProxyEfl* popupMenu, const IntRect& rect, TextDirection textDirection, double pageScaleFactor, const Vector<WebPopupItem>& items, int32_t selectedIndex)
-{
-    EWK_VIEW_SD_GET_OR_RETURN(ewkView, smartData);
-    EWK_VIEW_PRIV_GET_OR_RETURN(smartData, priv);
-    EINA_SAFETY_ON_NULL_RETURN(smartData->api);
-
-    ASSERT(popupMenu);
-
-    if (!smartData->api->popup_menu_show)
-        return;
-
-    if (priv->popupMenuProxy)
-        ewk_view_popup_menu_close(ewkView);
-    priv->popupMenuProxy = popupMenu;
-
-    Eina_List* popupItems = 0;
-    size_t size = items.size();
-    for (size_t i = 0; i < size; ++i)
-        popupItems = eina_list_append(popupItems, Ewk_Popup_Menu_Item::create(items[i]).leakPtr());
-    priv->popupMenuItems = popupItems;
-
-    smartData->api->popup_menu_show(smartData, rect, static_cast<Ewk_Text_Direction>(textDirection), pageScaleFactor, popupItems, selectedIndex);
-}
-
-Eina_Bool ewk_view_popup_menu_close(Evas_Object* ewkView)
-{
-    EWK_VIEW_SD_GET_OR_RETURN(ewkView, smartData, false);
-    EWK_VIEW_PRIV_GET_OR_RETURN(smartData, priv, false);
-    EINA_SAFETY_ON_NULL_RETURN_VAL(smartData->api, false);
-
-    if (!priv->popupMenuProxy)
-        return false;
-
-    priv->popupMenuProxy = 0;
-
-    if (smartData->api->popup_menu_hide)
-        smartData->api->popup_menu_hide(smartData);
-
-    void* item;
-    EINA_LIST_FREE(priv->popupMenuItems, item)
-        delete static_cast<Ewk_Popup_Menu_Item*>(item);
-
-    return true;
-}
-
-Eina_Bool ewk_view_popup_menu_select(Evas_Object* ewkView, unsigned int selectedIndex)
-{
-    EWK_VIEW_SD_GET_OR_RETURN(ewkView, smartData, false);
-    EWK_VIEW_PRIV_GET_OR_RETURN(smartData, priv, false);
-    EINA_SAFETY_ON_NULL_RETURN_VAL(priv->popupMenuProxy, false);
-
-    if (selectedIndex >= eina_list_count(priv->popupMenuItems))
-        return false;
-
-    priv->popupMenuProxy->valueChanged(selectedIndex);
+    impl->page()->countStringMatches(String::fromUTF8(text), static_cast<WebKit::FindOptions>(options), maxMatchCount);
 
     return true;
 }
 
 Eina_Bool ewk_view_mouse_events_enabled_set(Evas_Object* ewkView, Eina_Bool enabled)
 {
-    EWK_VIEW_SD_GET_OR_RETURN(ewkView, smartData, false);
-    EWK_VIEW_PRIV_GET_OR_RETURN(smartData, priv, false);
+    EWK_VIEW_IMPL_GET_OR_RETURN(ewkView, impl, false);
 
-    enabled = !!enabled;
-    if (priv->areMouseEventsEnabled == enabled)
-        return true;
-
-    priv->areMouseEventsEnabled = enabled;
-    if (enabled) {
-        evas_object_event_callback_add(ewkView, EVAS_CALLBACK_MOUSE_DOWN, _ewk_view_on_mouse_down, smartData);
-        evas_object_event_callback_add(ewkView, EVAS_CALLBACK_MOUSE_UP, _ewk_view_on_mouse_up, smartData);
-        evas_object_event_callback_add(ewkView, EVAS_CALLBACK_MOUSE_MOVE, _ewk_view_on_mouse_move, smartData);
-    } else {
-        evas_object_event_callback_del(ewkView, EVAS_CALLBACK_MOUSE_DOWN, _ewk_view_on_mouse_down);
-        evas_object_event_callback_del(ewkView, EVAS_CALLBACK_MOUSE_UP, _ewk_view_on_mouse_up);
-        evas_object_event_callback_del(ewkView, EVAS_CALLBACK_MOUSE_MOVE, _ewk_view_on_mouse_move);
-    }
+    impl->setMouseEventsEnabled(!!enabled);
 
     return true;
 }
 
 Eina_Bool ewk_view_mouse_events_enabled_get(const Evas_Object* ewkView)
 {
-    EWK_VIEW_SD_GET_OR_RETURN(ewkView, smartData, false);
-    EWK_VIEW_PRIV_GET_OR_RETURN(smartData, priv, false);
+    EWK_VIEW_IMPL_GET_OR_RETURN(ewkView, impl, false);
 
-    return priv->areMouseEventsEnabled;
-}
-
-/**
- * @internal
- * Web process has crashed.
- *
- * Emits signal: "webprocess,crashed" with pointer to crash handling boolean.
- */
-void ewk_view_webprocess_crashed(Evas_Object* ewkView)
-{
-    EWK_VIEW_SD_GET_OR_RETURN(ewkView, smartData);
-    EWK_VIEW_PRIV_GET_OR_RETURN(smartData, priv);
-
-    bool handled = false;
-    evas_object_smart_callback_call(ewkView, "webprocess,crashed", &handled);
-
-    if (!handled) {
-        CString url = priv->pageProxy->urlAtProcessExit().utf8();
-        WARN("WARNING: The web process experienced a crash on '%s'.\n", url.data());
-
-        // Display an error page
-        ewk_view_html_string_load(ewkView, "The web process has crashed.", 0, url.data());
-    }
-}
-
-/**
- * @internal
- * Calls a smart member function for javascript alert().
- */
-void ewk_view_run_javascript_alert(Evas_Object* ewkView, const WKEinaSharedString& message)
-{
-    EWK_VIEW_SD_GET_OR_RETURN(ewkView, smartData);
-    EINA_SAFETY_ON_NULL_RETURN(smartData->api);
-
-    if (!smartData->api->run_javascript_alert)
-        return;
-
-    smartData->api->run_javascript_alert(smartData, message);
-}
-
-/**
- * @internal
- * Calls a smart member function for javascript confirm() and returns a value from the function. Returns false by default.
- */
-bool ewk_view_run_javascript_confirm(Evas_Object* ewkView, const WKEinaSharedString& message)
-{
-    EWK_VIEW_SD_GET_OR_RETURN(ewkView, smartData, false);
-    EINA_SAFETY_ON_NULL_RETURN_VAL(smartData->api, false);
-
-    if (!smartData->api->run_javascript_confirm)
-        return false;
-
-    return smartData->api->run_javascript_confirm(smartData, message);
-}
-
-/**
- * @internal
- * Calls a smart member function for javascript prompt() and returns a value from the function. Returns null string by default.
- */
-WKEinaSharedString ewk_view_run_javascript_prompt(Evas_Object* ewkView, const WKEinaSharedString& message, const WKEinaSharedString& defaultValue)
-{
-    EWK_VIEW_SD_GET_OR_RETURN(ewkView, smartData, WKEinaSharedString());
-    EINA_SAFETY_ON_NULL_RETURN_VAL(smartData->api, WKEinaSharedString());
-
-    if (!smartData->api->run_javascript_prompt)
-        return WKEinaSharedString();
-
-    return WKEinaSharedString::adopt(smartData->api->run_javascript_prompt(smartData, message, defaultValue));
-}
-
-#if ENABLE(INPUT_TYPE_COLOR)
-/**
- * @internal
- * Requests to show external color picker.
- */
-void ewk_view_color_picker_request(Evas_Object* ewkView, int r, int g, int b, int a, WKColorPickerResultListenerRef listener)
-{
-    EWK_VIEW_SD_GET_OR_RETURN(ewkView, smartData);
-    EWK_VIEW_PRIV_GET_OR_RETURN(smartData, priv);
-    EINA_SAFETY_ON_NULL_RETURN(smartData->api->input_picker_color_request);
-
-    priv->colorPickerResultListener = listener;
-
-    smartData->api->input_picker_color_request(smartData, r, g, b, a);
-}
-
-/**
- * @internal
- * Requests to hide external color picker.
- */
-void ewk_view_color_picker_dismiss(Evas_Object* ewkView)
-{
-    EWK_VIEW_SD_GET_OR_RETURN(ewkView, smartData);
-    EWK_VIEW_PRIV_GET_OR_RETURN(smartData, priv);
-    EINA_SAFETY_ON_NULL_RETURN(smartData->api->input_picker_color_dismiss);
-
-    priv->colorPickerResultListener.clear();
-
-    smartData->api->input_picker_color_dismiss(smartData);
-}
-#endif
-
-Eina_Bool ewk_view_color_picker_color_set(Evas_Object* ewkView, int r, int g, int b, int a)
-{
-#if ENABLE(INPUT_TYPE_COLOR)
-    EWK_VIEW_SD_GET_OR_RETURN(ewkView, smartData, false);
-    EWK_VIEW_PRIV_GET_OR_RETURN(smartData, priv, false);
-    EINA_SAFETY_ON_NULL_RETURN_VAL(priv->colorPickerResultListener, false);
-
-    WebCore::Color color = WebCore::Color(r, g, b, a);
-    WKRetainPtr<WKStringRef> colorString(AdoptWK, WKStringCreateWithUTF8CString(color.serialized().utf8().data()));
-    WKColorPickerResultListenerSetColor(priv->colorPickerResultListener.get(), colorString.get());
-    priv->colorPickerResultListener.clear();
-
-    return true;
-#else
-    return false;
-#endif
+    return impl->mouseEventsEnabled();
 }
 
 Eina_Bool ewk_view_feed_touch_event(Evas_Object* ewkView, Ewk_Touch_Event_Type type, const Eina_List* points, const Evas_Modifier* modifiers)
@@ -1927,10 +819,9 @@ Eina_Bool ewk_view_feed_touch_event(Evas_Object* ewkView, Ewk_Touch_Event_Type t
 #if ENABLE(TOUCH_EVENTS)
     EINA_SAFETY_ON_NULL_RETURN_VAL(points, false);
     EWK_VIEW_SD_GET_OR_RETURN(ewkView, smartData, false);
-    EWK_VIEW_PRIV_GET_OR_RETURN(smartData, priv, false);
+    EWK_VIEW_IMPL_GET_BY_SD_OR_RETURN(smartData, impl, false);
 
-    Evas_Point position = { smartData->view.x, smartData->view.y };
-    priv->pageProxy->handleTouchEvent(NativeWebTouchEvent(type, points, modifiers, &position, ecore_time_get()));
+    impl->page()->handleTouchEvent(NativeWebTouchEvent(type, points, modifiers, impl->transformFromScene(), impl->transformToScreen(), ecore_time_get()));
 
     return true;
 #else
@@ -1941,34 +832,9 @@ Eina_Bool ewk_view_feed_touch_event(Evas_Object* ewkView, Ewk_Touch_Event_Type t
 Eina_Bool ewk_view_touch_events_enabled_set(Evas_Object* ewkView, Eina_Bool enabled)
 {
 #if ENABLE(TOUCH_EVENTS)
-    EWK_VIEW_SD_GET_OR_RETURN(ewkView, smartData, false);
-    EWK_VIEW_PRIV_GET_OR_RETURN(smartData, priv, false);
-
-    enabled = !!enabled;
-    if (priv->areTouchEventsEnabled == enabled)
-        return true;
+    EWK_VIEW_IMPL_GET_OR_RETURN(ewkView, impl, false);
 
-    priv->areTouchEventsEnabled = enabled;
-    if (enabled) {
-        // FIXME: We have to connect touch callbacks with mouse and multi events
-        // because the Evas creates mouse events for first touch and multi events
-        // for second and third touches. Below codes should be fixed when the Evas
-        // supports the touch events.
-        // See https://bugs.webkit.org/show_bug.cgi?id=97785 for details.
-        evas_object_event_callback_add(ewkView, EVAS_CALLBACK_MOUSE_DOWN, _ewk_view_on_touch_down, smartData);
-        evas_object_event_callback_add(ewkView, EVAS_CALLBACK_MOUSE_UP, _ewk_view_on_touch_up, smartData);
-        evas_object_event_callback_add(ewkView, EVAS_CALLBACK_MOUSE_MOVE, _ewk_view_on_touch_move, smartData);
-        evas_object_event_callback_add(ewkView, EVAS_CALLBACK_MULTI_DOWN, _ewk_view_on_touch_down, smartData);
-        evas_object_event_callback_add(ewkView, EVAS_CALLBACK_MULTI_UP, _ewk_view_on_touch_up, smartData);
-        evas_object_event_callback_add(ewkView, EVAS_CALLBACK_MULTI_MOVE, _ewk_view_on_touch_move, smartData);
-    } else {
-        evas_object_event_callback_del(ewkView, EVAS_CALLBACK_MOUSE_DOWN, _ewk_view_on_touch_down);
-        evas_object_event_callback_del(ewkView, EVAS_CALLBACK_MOUSE_UP, _ewk_view_on_touch_up);
-        evas_object_event_callback_del(ewkView, EVAS_CALLBACK_MOUSE_MOVE, _ewk_view_on_touch_move);
-        evas_object_event_callback_del(ewkView, EVAS_CALLBACK_MULTI_DOWN, _ewk_view_on_touch_down);
-        evas_object_event_callback_del(ewkView, EVAS_CALLBACK_MULTI_UP, _ewk_view_on_touch_up);
-        evas_object_event_callback_del(ewkView, EVAS_CALLBACK_MULTI_MOVE, _ewk_view_on_touch_move);
-    }
+    impl->setTouchEventsEnabled(!!enabled);
 
     return true;
 #else
@@ -1979,10 +845,9 @@ Eina_Bool ewk_view_touch_events_enabled_set(Evas_Object* ewkView, Eina_Bool enab
 Eina_Bool ewk_view_touch_events_enabled_get(const Evas_Object* ewkView)
 {
 #if ENABLE(TOUCH_EVENTS)
-    EWK_VIEW_SD_GET_OR_RETURN(ewkView, smartData, false);
-    EWK_VIEW_PRIV_GET_OR_RETURN(smartData, priv, false);
+    EWK_VIEW_IMPL_GET_OR_RETURN(ewkView, impl, false);
 
-    return priv->areTouchEventsEnabled;
+    return impl->touchEventsEnabled();
 #else
     return false;
 #endif
@@ -1991,10 +856,9 @@ Eina_Bool ewk_view_touch_events_enabled_get(const Evas_Object* ewkView)
 Eina_Bool ewk_view_inspector_show(Evas_Object* ewkView)
 {
 #if ENABLE(INSPECTOR)
-    EWK_VIEW_SD_GET_OR_RETURN(ewkView, smartData, false);
-    EWK_VIEW_PRIV_GET_OR_RETURN(smartData, priv, false);
+    EWK_VIEW_IMPL_GET_OR_RETURN(ewkView, impl, false);
 
-    WebInspectorProxy* inspector = priv->pageProxy->inspector();
+    WebInspectorProxy* inspector = impl->page()->inspector();
     if (inspector)
         inspector->show();
 
@@ -2007,10 +871,9 @@ Eina_Bool ewk_view_inspector_show(Evas_Object* ewkView)
 Eina_Bool ewk_view_inspector_close(Evas_Object* ewkView)
 {
 #if ENABLE(INSPECTOR)
-    EWK_VIEW_SD_GET_OR_RETURN(ewkView, smartData, false);
-    EWK_VIEW_PRIV_GET_OR_RETURN(smartData, priv, false);
+    EWK_VIEW_IMPL_GET_OR_RETURN(ewkView, impl, false);
 
-    WebInspectorProxy* inspector = priv->pageProxy->inspector();
+    WebInspectorProxy* inspector = impl->page()->inspector();
     if (inspector)
         inspector->close();
 
@@ -2019,3 +882,26 @@ Eina_Bool ewk_view_inspector_close(Evas_Object* ewkView)
     return false;
 #endif
 }
+
+// Ewk_Pagination_Mode should be matched up orders with WebCore::Pagination::Mode.
+COMPILE_ASSERT_MATCHING_ENUM(EWK_PAGINATION_MODE_UNPAGINATED, WebCore::Pagination::Unpaginated);
+COMPILE_ASSERT_MATCHING_ENUM(EWK_PAGINATION_MODE_LEFT_TO_RIGHT, WebCore::Pagination::LeftToRightPaginated);
+COMPILE_ASSERT_MATCHING_ENUM(EWK_PAGINATION_MODE_RIGHT_TO_LEFT, WebCore::Pagination::RightToLeftPaginated);
+COMPILE_ASSERT_MATCHING_ENUM(EWK_PAGINATION_MODE_TOP_TO_BOTTOM, WebCore::Pagination::TopToBottomPaginated);
+COMPILE_ASSERT_MATCHING_ENUM(EWK_PAGINATION_MODE_BOTTOM_TO_TOP, WebCore::Pagination::BottomToTopPaginated);
+
+Eina_Bool ewk_view_pagination_mode_set(Evas_Object* ewkView, Ewk_Pagination_Mode mode)
+{
+    EWK_VIEW_IMPL_GET_OR_RETURN(ewkView, impl, false);
+    
+    impl->page()->setPaginationMode(static_cast<WebCore::Pagination::Mode>(mode));
+
+    return true;
+}
+
+Ewk_Pagination_Mode ewk_view_pagination_mode_get(const Evas_Object* ewkView)
+{
+    EWK_VIEW_IMPL_GET_OR_RETURN(ewkView, impl, EWK_PAGINATION_MODE_INVALID);
+
+    return static_cast<Ewk_Pagination_Mode>(impl->page()->paginationMode());
+}
diff --git a/Source/WebKit2/UIProcess/API/efl/ewk_view.h b/Source/WebKit2/UIProcess/API/efl/ewk_view.h
index 59809fab6..175c28cf2 100644
--- a/Source/WebKit2/UIProcess/API/efl/ewk_view.h
+++ b/Source/WebKit2/UIProcess/API/efl/ewk_view.h
@@ -26,6 +26,8 @@
  *
  * The following signals (see evas_object_smart_callback_add()) are emitted:
  *
+ * - "authentication,request", Ewk_Auth_Request*: reports that user authentication was requested. Call
+ *   ewk_auth_request_ref() on the request object to process the authentication asynchronously.
  * - "back,forward,list,changed", void: reports that the view's back / forward list had changed.
  * - "close,window", void: window is closed.
  * - "create,window", Evas_Object**: a new window is created.
@@ -34,6 +36,9 @@
  * - "download,finished", Ewk_Download_Job*: reports that a download completed successfully.
  * - "download,request", Ewk_Download_Job*: reports that a new download has been requested. The client should set the
  *   destination path by calling ewk_download_job_destination_set() or the download will fail.
+ * - "file,chooser,request", Ewk_File_Chooser_Request*: reports that a request has been made for the user to choose
+ *   a file (or several) on the file system. Call ewk_file_chooser_request_ref() on the request object to process it
+ *   asynchronously.
  * - "form,submission,request", Ewk_Form_Submission_Request*: Reports that a form request is about to be submitted.
  *   The Ewk_Form_Submission_Request passed contains information about the text fields of the form. This
  *   is typically used to store login information that can be used later to pre-fill the form.
@@ -75,10 +80,12 @@
 #define ewk_view_h
 
 #include "ewk_back_forward_list.h"
+#include "ewk_color_picker.h"
 #include "ewk_context.h"
 #include "ewk_download_job.h"
 #include "ewk_error.h"
 #include "ewk_intent.h"
+#include "ewk_popup_menu.h"
 #include "ewk_resource.h"
 #include "ewk_settings.h"
 #include "ewk_touch.h"
@@ -104,7 +111,7 @@ struct Ewk_View_Smart_Class {
     Evas_Smart_Class sc; /**< all but 'data' is free to be changed. */
     unsigned long version;
 
-    Eina_Bool (*popup_menu_show)(Ewk_View_Smart_Data *sd, Eina_Rectangle rect, Ewk_Text_Direction text_direction, double page_scale_factor, Eina_List *items, int selected_index);
+    Eina_Bool (*popup_menu_show)(Ewk_View_Smart_Data *sd, Eina_Rectangle rect, Ewk_Text_Direction text_direction, double page_scale_factor, Ewk_Popup_Menu *menu);
     Eina_Bool (*popup_menu_hide)(Ewk_View_Smart_Data *sd);
 
     // event handling:
@@ -129,7 +136,7 @@ struct Ewk_View_Smart_Class {
 
     // color picker:
     //   - Shows and hides color picker.
-    Eina_Bool (*input_picker_color_request)(Ewk_View_Smart_Data *sd, int r, int g, int b, int a);
+    Eina_Bool (*input_picker_color_request)(Ewk_View_Smart_Data *sd, Ewk_Color_Picker *color_picker);
     Eina_Bool (*input_picker_color_dismiss)(Ewk_View_Smart_Data *sd);
 
     // storage:
@@ -182,7 +189,7 @@ struct Ewk_View_Smart_Class {
  */
 #define EWK_VIEW_SMART_CLASS_INIT_NAME_VERSION(name) EWK_VIEW_SMART_CLASS_INIT(EVAS_SMART_CLASS_INIT_NAME_VERSION(name))
 
-typedef struct Ewk_View_Private_Data Ewk_View_Private_Data;
+typedef struct EwkViewImpl EwkViewImpl;
 /**
  * @brief Contains an internal View data.
  *
@@ -194,7 +201,7 @@ struct Ewk_View_Smart_Data {
     const Ewk_View_Smart_Class* api; /**< reference to casted class instance */
     Evas_Object* self; /**< reference to owner object */
     Evas_Object* image; /**< reference to evas_object_image for drawing web contents */
-    Ewk_View_Private_Data* priv; /**< should never be accessed, c++ stuff */
+    EwkViewImpl* priv; /**< should never be accessed, c++ stuff */
     struct {
         Evas_Coord x, y, w, h; /**< last used viewport */
     } view;
@@ -271,6 +278,18 @@ enum Ewk_Find_Options {
 typedef enum Ewk_Find_Options Ewk_Find_Options;
 
 /**
+ * Enum values used to set pagination mode.
+ */
+typedef enum {
+    EWK_PAGINATION_MODE_INVALID = -1, /**< invalid pagination mode that will be returned when error occured. */
+    EWK_PAGINATION_MODE_UNPAGINATED, /**< default mode for pagination. not paginated  */
+    EWK_PAGINATION_MODE_LEFT_TO_RIGHT, /**< go to the next page with scrolling left to right horizontally. */
+    EWK_PAGINATION_MODE_RIGHT_TO_LEFT, /**< go to the next page with scrolling right to left horizontally. */
+    EWK_PAGINATION_MODE_TOP_TO_BOTTOM, /**< go to the next page with scrolling top to bottom vertically. */
+    EWK_PAGINATION_MODE_BOTTOM_TO_TOP /**< go to the next page with scrolling bottom to top vertically. */
+} Ewk_Pagination_Mode;
+
+/**
  * Sets the smart class APIs, enabling view to be inherited.
  *
  * @param api class definition to set, all members with the
@@ -677,27 +696,6 @@ EAPI Eina_Bool ewk_view_text_find_highlight_clear(Evas_Object *o);
 EAPI Eina_Bool ewk_view_text_matches_count(Evas_Object *o, const char *text, Ewk_Find_Options options, unsigned max_match_count);
 
 /**
- * Selects index of current popup menu.
- *
- * @param o view object contains popup menu.
- * @param index index of item to select
- *
- * @return @c EINA_TRUE on success, @c EINA_FALSE on failure (probably
- *         popup menu is not selected or index is out of range)
- */
-EAPI Eina_Bool ewk_view_popup_menu_select(Evas_Object *o, unsigned int index);
-
-/**
- * Closes current popup menu.
- *
- * @param o view object contains popup menu.
- *
- * @return @c EINA_TRUE on success, @c EINA_FALSE on failure (probably
- *         popup menu is not selected)
- */
-EAPI Eina_Bool ewk_view_popup_menu_close(Evas_Object *o);
-
-/**
  * Sets whether the ewk_view supports the mouse events or not.
  *
  * The ewk_view will support the mouse events if EINA_TRUE or not support the
@@ -719,23 +717,6 @@ EAPI Eina_Bool ewk_view_mouse_events_enabled_set(Evas_Object *o, Eina_Bool enabl
  */
 EAPI Eina_Bool ewk_view_mouse_events_enabled_get(const Evas_Object *o);
 
-/*
- * Sets the user chosen color. To be used when implementing a color picker.
- *
- * The function should only be called when a color has been requested by the document.
- * If called when this is not the case or when the input picker has been dismissed, this
- * function will fail and return EINA_FALSE.
- *
- * @param o view object contains color picker
- * @param r red channel value to be set
- * @param g green channel value to be set
- * @param b blue channel value to be set
- * @param a alpha channel value to be set
- *
- * @return @c EINA_TRUE on success @c EINA_FALSE otherwise
- */
-EAPI Eina_Bool ewk_view_color_picker_color_set(Evas_Object *o, int r, int g, int b, int a);
-
 /**
  * Feeds the touch event to the view.
  *
@@ -793,6 +774,28 @@ EAPI Eina_Bool ewk_view_inspector_show(Evas_Object *o);
  */
 EAPI Eina_Bool ewk_view_inspector_close(Evas_Object *o);
 
+/**
+ * Set pagination mode to the current web page.
+ *
+ * @param o view object to set the pagenation mode
+ * @param mode The Ewk_Pagination_Mode to set
+ *
+ * @return @c EINA_TRUE on success or @c EINA_FALSE on failure
+ */
+EAPI Eina_Bool ewk_view_pagination_mode_set(Evas_Object *o, Ewk_Pagination_Mode mode);
+
+/**
+ * Get pagination mode of the current web page. 
+ * 
+ * The default value is EWK_PAGINATION_MODE_UNPAGINATED.
+ * When error occured, EWK_PAGINATION_MODE_INVALID is returned. 
+ *
+ * @param o view object to get the pagination mode
+ *
+ * @return The pagination mode of the current web page
+ */
+EAPI Ewk_Pagination_Mode ewk_view_pagination_mode_get(const Evas_Object *o);
+
 #ifdef __cplusplus
 }
 #endif
diff --git a/Source/WebKit2/UIProcess/API/efl/ewk_view_private.h b/Source/WebKit2/UIProcess/API/efl/ewk_view_private.h
index 2066f9eff..28038857f 100644
--- a/Source/WebKit2/UIProcess/API/efl/ewk_view_private.h
+++ b/Source/WebKit2/UIProcess/API/efl/ewk_view_private.h
@@ -21,107 +21,9 @@
 #ifndef ewk_view_private_h
 #define ewk_view_private_h
 
-#include "WebPageProxy.h"
 #include <Evas.h>
-#include <WKEinaSharedString.h>
-#include <WebCore/TextDirection.h>
 #include <WebKit2/WKBase.h>
-#include <wtf/Vector.h>
-
-namespace WebCore {
-class Cursor;
-class IntRect;
-class IntSize;
-}
-
-namespace WebKit {
-class WebPopupItem;
-class WebPopupMenuProxyEfl;
-}
-
-typedef struct Ewk_Download_Job Ewk_Download_Job;
-typedef struct Ewk_Form_Submission_Request Ewk_Form_Submission_Request;
-typedef struct Ewk_Url_Request Ewk_Url_Request;
-typedef struct Ewk_Url_Response Ewk_Url_Response;
-typedef struct Ewk_Error Ewk_Error;
-typedef struct Ewk_Resource Ewk_Resource;
-typedef struct Ewk_Navigation_Policy_Decision Ewk_Navigation_Policy_Decision;
-#if ENABLE(WEB_INTENTS)
-typedef struct Ewk_Intent Ewk_Intent;
-#endif
-#if ENABLE(WEB_INTENTS_TAG)
-typedef struct Ewk_Intent_Service Ewk_Intent_Service;
-#endif
-
-void ewk_view_cursor_set(Evas_Object* ewkView, const WebCore::Cursor& cursor);
-void ewk_view_display(Evas_Object* ewkView, const WebCore::IntRect& rect);
-void ewk_view_download_job_cancelled(Evas_Object* ewkView, Ewk_Download_Job*);
-void ewk_view_download_job_failed(Evas_Object* ewkView, Ewk_Download_Job*, Ewk_Error*);
-void ewk_view_download_job_finished(Evas_Object* ewkView, Ewk_Download_Job*);
-void ewk_view_download_job_requested(Evas_Object* ewkView, Ewk_Download_Job*);
-void ewk_view_form_submission_request_new(Evas_Object* ewkView, Ewk_Form_Submission_Request*);
-#if ENABLE(FULLSCREEN_API)
-void ewk_view_full_screen_enter(Evas_Object* ewkView);
-void ewk_view_full_screen_exit(Evas_Object* ewkView);
-#endif
-void ewk_view_image_data_set(Evas_Object* ewkView, void* imageData, const WebCore::IntSize& size);
-void ewk_view_load_error(Evas_Object* ewkView, const Ewk_Error* error);
-void ewk_view_load_finished(Evas_Object* ewkView);
-void ewk_view_load_progress_changed(Evas_Object* ewkView, double progress);
-void ewk_view_load_provisional_failed(Evas_Object* ewkView, const Ewk_Error* error);
-void ewk_view_load_provisional_redirect(Evas_Object* ewkView);
-void ewk_view_load_provisional_started(Evas_Object* ewkView);
-void ewk_view_navigation_policy_decision(Evas_Object* ewkView, Ewk_Navigation_Policy_Decision* decision);
-void ewk_view_new_window_policy_decision(Evas_Object* ewkView, Ewk_Navigation_Policy_Decision* decision);
-void ewk_view_page_close(Evas_Object* ewkView);
-WKPageRef ewk_view_page_create(Evas_Object* ewkView);
-void ewk_view_title_changed(Evas_Object* ewkView, const char* title);
-void ewk_view_tooltip_text_set(Evas_Object* ewkView, const char* text);
-void ewk_view_resource_load_failed(Evas_Object* ewkView, Ewk_Resource* resource, Ewk_Error* error);
-void ewk_view_resource_load_finished(Evas_Object* ewkView, Ewk_Resource* resource);
-void ewk_view_resource_load_initiated(Evas_Object* ewkView, Ewk_Resource* resource, Ewk_Url_Request* request);
-void ewk_view_resource_load_response(Evas_Object* ewkView, Ewk_Resource* resource, Ewk_Url_Response* response);
-void ewk_view_resource_request_sent(Evas_Object* ewkView, Ewk_Resource* resource, Ewk_Url_Request* request, Ewk_Url_Response* redirectResponse);
-void ewk_view_text_found(Evas_Object* ewkView, unsigned int matchCount);
-void ewk_view_url_update(Evas_Object* ewkView);
-void ewk_view_contents_size_changed(const Evas_Object* ewkView, const WebCore::IntSize&);
-void ewk_view_back_forward_list_changed(Evas_Object* ewkView);
-void ewk_view_update_icon(Evas_Object* ewkView);
-
-WKPageRef ewk_view_wkpage_get(const Evas_Object* ewkView);
 
 Evas_Object* ewk_view_base_add(Evas* canvas, WKContextRef, WKPageGroupRef);
 
-#if ENABLE(WEB_INTENTS)
-void ewk_view_intent_request_new(Evas_Object* ewkView, const Ewk_Intent* ewkIntent);
-#endif
-#if ENABLE(WEB_INTENTS_TAG)
-void ewk_view_intent_service_register(Evas_Object* ewkView, const Ewk_Intent_Service* ewkIntentService);
-#endif
-
-const Evas_Object* ewk_view_from_page_get(const WebKit::WebPageProxy*);
-WebKit::WebPageProxy* ewk_view_page_get(const Evas_Object* ewkView);
-WebCore::IntSize ewk_view_size_get(const Evas_Object* ewkView);
-
-#if USE(ACCELERATED_COMPOSITING)
-bool ewk_view_accelerated_compositing_mode_enter(const Evas_Object* ewkView);
-bool ewk_view_accelerated_compositing_mode_exit(const Evas_Object* ewkView);
-#endif
-
-void ewk_view_popup_menu_request(Evas_Object* ewkView, WebKit::WebPopupMenuProxyEfl* popupMenu, const WebCore::IntRect&, WebCore::TextDirection, double pageScaleFactor, const Vector<WebKit::WebPopupItem>& items, int32_t selectedIndex);
-void ewk_view_webprocess_crashed(Evas_Object* ewkView);
-
-void ewk_view_run_javascript_alert(Evas_Object* ewkView, const WKEinaSharedString& message);
-bool ewk_view_run_javascript_confirm(Evas_Object* ewkView, const WKEinaSharedString& message);
-WKEinaSharedString ewk_view_run_javascript_prompt(Evas_Object* ewkView, const WKEinaSharedString& message, const WKEinaSharedString& defaultValue);
-
-#if ENABLE(INPUT_TYPE_COLOR)
-void ewk_view_color_picker_request(Evas_Object* ewkView, int r, int g, int b, int a, WKColorPickerResultListenerRef listener);
-void ewk_view_color_picker_dismiss(Evas_Object* ewkView);
-#endif
-
-#if ENABLE(SQL_DATABASE)
-unsigned long long ewk_view_database_quota_exceeded(Evas_Object* ewkView, const char* databaseName, const char* displayName, unsigned long long currentQuota, unsigned long long currentOriginUsage, unsigned long long currentDatabaseUsage, unsigned long long expectedUsage);
-#endif
-
 #endif // ewk_view_private_h
diff --git a/Source/WebKit2/UIProcess/API/efl/ewk_view_ui_client.cpp b/Source/WebKit2/UIProcess/API/efl/ewk_view_ui_client.cpp
deleted file mode 100644
index 0f7bd9277..000000000
--- a/Source/WebKit2/UIProcess/API/efl/ewk_view_ui_client.cpp
+++ /dev/null
@@ -1,142 +0,0 @@
-/*
- * Copyright (C) 2012 Samsung Electronics. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
- * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
- * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
- * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
- * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
- * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
- * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
- * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
- * THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "config.h"
-
-#include "WKString.h"
-#include "ewk_view_private.h"
-#include "ewk_view_ui_client_private.h"
-#include <Ecore_Evas.h>
-
-static inline Evas_Object* toEwkView(const void* clientInfo)
-{
-    return static_cast<Evas_Object*>(const_cast<void*>(clientInfo));
-}
-
-static void closePage(WKPageRef, const void* clientInfo)
-{
-    ewk_view_page_close(toEwkView(clientInfo));
-}
-
-static WKPageRef createNewPage(WKPageRef, WKURLRequestRef, WKDictionaryRef, WKEventModifiers, WKEventMouseButton, const void* clientInfo)
-{
-     return ewk_view_page_create(toEwkView(clientInfo));
-}
-
-static void runJavaScriptAlert(WKPageRef, WKStringRef alertText, WKFrameRef, const void* clientInfo)
-{
-    ewk_view_run_javascript_alert(toEwkView(clientInfo), WKEinaSharedString(alertText));
-}
-
-static bool runJavaScriptConfirm(WKPageRef, WKStringRef message, WKFrameRef, const void* clientInfo)
-{
-    return ewk_view_run_javascript_confirm(toEwkView(clientInfo), WKEinaSharedString(message));
-}
-
-static WKStringRef runJavaScriptPrompt(WKPageRef, WKStringRef message, WKStringRef defaultValue, WKFrameRef, const void* clientInfo)
-{
-    WKEinaSharedString value = ewk_view_run_javascript_prompt(toEwkView(clientInfo), WKEinaSharedString(message), WKEinaSharedString(defaultValue));
-    return value ? WKStringCreateWithUTF8CString(value) : 0;
-}
-
-#if ENABLE(INPUT_TYPE_COLOR)
-static void showColorPicker(WKPageRef, WKStringRef initialColor, WKColorPickerResultListenerRef listener, const void* clientInfo)
-{
-    WebCore::Color color = WebCore::Color(WebKit::toWTFString(initialColor));
-    ewk_view_color_picker_request(toEwkView(clientInfo), color.red(), color.green(), color.blue(), color.alpha(), listener);
-}
-
-static void hideColorPicker(WKPageRef, const void* clientInfo)
-{
-    ewk_view_color_picker_dismiss(toEwkView(clientInfo));
-}
-#endif
-
-#if ENABLE(SQL_DATABASE)
-static unsigned long long exceededDatabaseQuota(WKPageRef, WKFrameRef, WKSecurityOriginRef, WKStringRef databaseName, WKStringRef displayName, unsigned long long currentQuota, unsigned long long currentOriginUsage, unsigned long long currentDatabaseUsage, unsigned long long expectedUsage, const void* clientInfo)
-{
-    return ewk_view_database_quota_exceeded(toEwkView(clientInfo), WKEinaSharedString(databaseName), WKEinaSharedString(displayName), currentQuota, currentOriginUsage, currentDatabaseUsage, expectedUsage);
-}
-#endif
-
-static void focus(WKPageRef, const void* clientInfo)
-{
-    evas_object_focus_set(toEwkView(clientInfo), true);
-}
-
-static void unfocus(WKPageRef, const void* clientInfo)
-{
-    evas_object_focus_set(toEwkView(clientInfo), false);
-}
-
-static void takeFocus(WKPageRef, WKFocusDirection, const void* clientInfo)
-{
-    // FIXME: this is only a partial implementation.
-    evas_object_focus_set(toEwkView(clientInfo), false);
-}
-
-static WKRect getWindowFrame(WKPageRef, const void* clientInfo)
-{
-    int x, y, width, height;
-
-    Ecore_Evas* ee = ecore_evas_ecore_evas_get(evas_object_evas_get(toEwkView(clientInfo)));
-    ecore_evas_request_geometry_get(ee, &x, &y, &width, &height);
-
-    return WKRectMake(x, y, width, height);
-}
-
-static void setWindowFrame(WKPageRef, WKRect frame, const void* clientInfo)
-{
-    Ecore_Evas* ee = ecore_evas_ecore_evas_get(evas_object_evas_get(toEwkView(clientInfo)));
-    ecore_evas_move_resize(ee, frame.origin.x, frame.origin.y, frame.size.width, frame.size.height);
-}
-
-void ewk_view_ui_client_attach(WKPageRef pageRef, Evas_Object* ewkView)
-{
-    WKPageUIClient uiClient;
-    memset(&uiClient, 0, sizeof(WKPageUIClient));
-    uiClient.version = kWKPageUIClientCurrentVersion;
-    uiClient.clientInfo = ewkView;
-    uiClient.close = closePage;
-    uiClient.createNewPage = createNewPage;
-    uiClient.runJavaScriptAlert = runJavaScriptAlert;
-    uiClient.runJavaScriptConfirm = runJavaScriptConfirm;
-    uiClient.runJavaScriptPrompt = runJavaScriptPrompt;
-    uiClient.takeFocus = takeFocus;
-    uiClient.focus = focus;
-    uiClient.unfocus = unfocus;
-    uiClient.getWindowFrame = getWindowFrame;
-    uiClient.setWindowFrame = setWindowFrame;
-#if ENABLE(SQL_DATABASE)
-    uiClient.exceededDatabaseQuota = exceededDatabaseQuota;
-#endif
-
-#if ENABLE(INPUT_TYPE_COLOR)
-    uiClient.showColorPicker = showColorPicker;
-    uiClient.hideColorPicker = hideColorPicker;
-#endif
-
-    WKPageSetPageUIClient(pageRef, &uiClient);
-}
diff --git a/Source/WebKit2/UIProcess/API/efl/tests/UnitTestUtils/EWK2UnitTestBase.cpp b/Source/WebKit2/UIProcess/API/efl/tests/UnitTestUtils/EWK2UnitTestBase.cpp
index 63d315050..82280fcd4 100644
--- a/Source/WebKit2/UIProcess/API/efl/tests/UnitTestUtils/EWK2UnitTestBase.cpp
+++ b/Source/WebKit2/UIProcess/API/efl/tests/UnitTestUtils/EWK2UnitTestBase.cpp
@@ -48,7 +48,12 @@ void EWK2UnitTestBase::SetUp()
     unsigned int width = environment->defaultWidth();
     unsigned int height = environment->defaultHeight();
 
+#if defined(WTF_USE_ACCELERATED_COMPOSITING) && defined(HAVE_ECORE_X)
+    const char* engine = "opengl_x11";
+    m_ecoreEvas = ecore_evas_new(engine, 0, 0, width, height, 0);
+#else
     m_ecoreEvas = ecore_evas_new(0, 0, 0, width, height, 0);
+#endif
 
     ecore_evas_show(m_ecoreEvas);
     Evas* evas = ecore_evas_get(m_ecoreEvas);
diff --git a/Source/WebKit2/UIProcess/API/efl/tests/resources/file_chooser.html b/Source/WebKit2/UIProcess/API/efl/tests/resources/file_chooser.html
new file mode 100644
index 000000000..4418c6477
--- /dev/null
+++ b/Source/WebKit2/UIProcess/API/efl/tests/resources/file_chooser.html
@@ -0,0 +1,21 @@
+<html>
+<head>
+<title>File chooser test</title>
+<script>
+function updateTitle()
+{
+  var myinput = document.getElementById('myInput');
+  var title = ""
+  for (var i = 0; i < myinput.files.length; i++) {
+    title += myinput.files[i].name;
+    if (i < (myinput.files.length - 1))
+      title += "|";
+  }
+  document.title = title;
+}
+</script>
+</head>
+<body>
+<input type="file" id="myInput" name="Upload media" accept="image/*,video/*" multiple="multiple" onchange="updateTitle()" style="top: 10; left: 10;"/>
+</body>
+</html>
diff --git a/Source/WebKit2/UIProcess/API/efl/tests/test_ewk2_auth_request.cpp b/Source/WebKit2/UIProcess/API/efl/tests/test_ewk2_auth_request.cpp
new file mode 100644
index 000000000..093b507e6
--- /dev/null
+++ b/Source/WebKit2/UIProcess/API/efl/tests/test_ewk2_auth_request.cpp
@@ -0,0 +1,198 @@
+/*
+ * Copyright (C) 2012 Intel Corporation. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#include "UnitTestUtils/EWK2UnitTestBase.h"
+#include "UnitTestUtils/EWK2UnitTestEnvironment.h"
+#include "UnitTestUtils/EWK2UnitTestServer.h"
+#include <EWebKit2.h>
+#include <Ecore.h>
+#include <wtf/PassOwnPtr.h>
+
+using namespace EWK2UnitTest;
+
+extern EWK2UnitTestEnvironment* environment;
+
+static const char TEST_USERNAME[] = "username";
+static const char TEST_PASSWORD[] = "password";
+static const char EXPECTED_AUTHORIZATION[] = "Basic dXNlcm5hbWU6cGFzc3dvcmQ="; // Base64 encoding of "username:password".
+static const char INDEX_HTML_STRING[] =
+    "<html>"
+    "<head><title>EFLWebKit2 Authentication test</title></head>"
+    "<body></body></html>";
+
+static void serverCallback(SoupServer*, SoupMessage* message, const char* path, GHashTable*, SoupClientContext*, void*)
+{
+    if (message->method != SOUP_METHOD_GET) {
+        soup_message_set_status(message, SOUP_STATUS_NOT_IMPLEMENTED);
+        return;
+    }
+
+    if (!strcmp(path, "/index.html")) {
+        const char* authorization = soup_message_headers_get_one(message->request_headers, "Authorization");
+        // Require authentication
+        if (authorization && !strcmp(authorization, EXPECTED_AUTHORIZATION)) {
+            // Successful authentication.
+            soup_message_set_status(message, SOUP_STATUS_OK);
+            soup_message_body_append(message->response_body, SOUP_MEMORY_COPY, INDEX_HTML_STRING, strlen(INDEX_HTML_STRING));
+        } else {
+            // No (valid) authorization header provided by the client, request authentication.
+            soup_message_set_status(message, SOUP_STATUS_UNAUTHORIZED);
+            soup_message_headers_append(message->response_headers, "WWW-Authenticate", "Basic realm=\"my realm\"");
+        }
+    } else
+        soup_message_set_status(message, SOUP_STATUS_NOT_FOUND);
+
+    soup_message_body_complete(message->response_body);
+}
+
+static void onAuthenticationRequest(void* userData, Evas_Object*, void* eventInfo)
+{
+    Ewk_Auth_Request** returnRequest = static_cast<Ewk_Auth_Request**>(userData);
+    ASSERT_TRUE(returnRequest);
+
+    Ewk_Auth_Request* request = static_cast<Ewk_Auth_Request*>(eventInfo);
+    ASSERT_TRUE(request);
+
+    *returnRequest = ewk_object_ref(request);
+}
+
+TEST_F(EWK2UnitTestBase, ewk_auth_request_success)
+{
+    OwnPtr<EWK2UnitTestServer> httpServer = adoptPtr(new EWK2UnitTestServer);
+    httpServer->run(serverCallback);
+
+    Ewk_Auth_Request* authenticationRequest = 0;
+    evas_object_smart_callback_add(webView(), "authentication,request", onAuthenticationRequest, &authenticationRequest);
+
+    ewk_view_url_set(webView(), httpServer->getURLForPath("/index.html").data());
+
+    while (!authenticationRequest)
+        ecore_main_loop_iterate();
+
+    ASSERT_TRUE(authenticationRequest);
+    evas_object_smart_callback_del(webView(), "authentication,request", onAuthenticationRequest);
+
+    EXPECT_STREQ("my realm", ewk_auth_request_realm_get(authenticationRequest));
+    EXPECT_STREQ("127.0.0.1", ewk_auth_request_host_get(authenticationRequest));
+    EXPECT_FALSE(ewk_auth_request_retrying_get(authenticationRequest));
+
+    ASSERT_TRUE(ewk_auth_request_authenticate(authenticationRequest, TEST_USERNAME, TEST_PASSWORD));
+
+    ewk_object_unref(authenticationRequest);
+
+    ASSERT_TRUE(waitUntilTitleChangedTo("EFLWebKit2 Authentication test"));
+}
+
+TEST_F(EWK2UnitTestBase, ewk_auth_request_failure_then_success)
+{
+    OwnPtr<EWK2UnitTestServer> httpServer = adoptPtr(new EWK2UnitTestServer);
+    httpServer->run(serverCallback);
+
+    Ewk_Auth_Request* authenticationRequest = 0;
+    evas_object_smart_callback_add(webView(), "authentication,request", onAuthenticationRequest, &authenticationRequest);
+
+    ewk_view_url_set(webView(), httpServer->getURLForPath("/index.html").data());
+
+    while (!authenticationRequest)
+        ecore_main_loop_iterate();
+
+    ASSERT_TRUE(authenticationRequest);
+
+    EXPECT_STREQ("my realm", ewk_auth_request_realm_get(authenticationRequest));
+    EXPECT_STREQ("127.0.0.1", ewk_auth_request_host_get(authenticationRequest));
+    EXPECT_FALSE(ewk_auth_request_retrying_get(authenticationRequest));
+
+    ASSERT_TRUE(ewk_auth_request_authenticate(authenticationRequest, TEST_USERNAME, "wrongpassword"));
+
+    ewk_object_unref(authenticationRequest);
+    authenticationRequest = 0;
+
+    // We expect a second authentication request since the first one failed.
+    while (!authenticationRequest)
+        ecore_main_loop_iterate();
+    evas_object_smart_callback_del(webView(), "authentication,request", onAuthenticationRequest);
+
+    EXPECT_STREQ("my realm", ewk_auth_request_realm_get(authenticationRequest));
+    EXPECT_STREQ("127.0.0.1", ewk_auth_request_host_get(authenticationRequest));
+    EXPECT_TRUE(ewk_auth_request_retrying_get(authenticationRequest));
+
+    // Now provide the right password.
+    ASSERT_TRUE(ewk_auth_request_authenticate(authenticationRequest, TEST_USERNAME, TEST_PASSWORD));
+
+    ewk_object_unref(authenticationRequest);
+
+    ASSERT_TRUE(waitUntilTitleChangedTo("EFLWebKit2 Authentication test"));
+}
+
+static void onResourceLoadResponse(void* userData, Evas_Object*, void* eventInfo)
+{
+    int* statusCode = static_cast<int*>(userData);
+    ASSERT_TRUE(statusCode);
+
+    Ewk_Resource_Load_Response* response = static_cast<Ewk_Resource_Load_Response*>(eventInfo);
+    ASSERT_TRUE(response);
+
+    if (!ewk_resource_main_resource_get(response->resource))
+        return;
+
+    *statusCode = ewk_url_response_status_code_get(response->response);
+}
+
+TEST_F(EWK2UnitTestBase, ewk_auth_request_cancel)
+{
+    OwnPtr<EWK2UnitTestServer> httpServer = adoptPtr(new EWK2UnitTestServer);
+    httpServer->run(serverCallback);
+
+    Ewk_Auth_Request* authenticationRequest = 0;
+    evas_object_smart_callback_add(webView(), "authentication,request", onAuthenticationRequest, &authenticationRequest);
+
+    ewk_view_url_set(webView(), httpServer->getURLForPath("/index.html").data());
+
+    while (!authenticationRequest)
+        ecore_main_loop_iterate();
+
+    ASSERT_TRUE(authenticationRequest);
+    evas_object_smart_callback_del(webView(), "authentication,request", onAuthenticationRequest);
+
+    EXPECT_STREQ("my realm", ewk_auth_request_realm_get(authenticationRequest));
+    EXPECT_STREQ("127.0.0.1", ewk_auth_request_host_get(authenticationRequest));
+    EXPECT_FALSE(ewk_auth_request_retrying_get(authenticationRequest));
+
+    int statusCode = 0;
+    evas_object_smart_callback_add(webView(), "resource,request,response", onResourceLoadResponse, &statusCode);
+
+    // Will attempt to continue without authentication by default.
+    ewk_object_unref(authenticationRequest);
+
+    while (!statusCode)
+        ecore_main_loop_iterate();
+
+    // We should get a "402 Unauthorized" error.
+    EXPECT_EQ(SOUP_STATUS_UNAUTHORIZED, statusCode);
+
+    evas_object_smart_callback_del(webView(), "resource,request,response", onResourceLoadResponse);
+}
diff --git a/Source/WebKit2/UIProcess/API/efl/tests/test_ewk2_back_forward_list.cpp b/Source/WebKit2/UIProcess/API/efl/tests/test_ewk2_back_forward_list.cpp
index 80d7755ec..ec4a4d90a 100644
--- a/Source/WebKit2/UIProcess/API/efl/tests/test_ewk2_back_forward_list.cpp
+++ b/Source/WebKit2/UIProcess/API/efl/tests/test_ewk2_back_forward_list.cpp
@@ -83,7 +83,7 @@ static inline void freeEinaList(Eina_List* list)
 {
     void* data = 0;
     EINA_LIST_FREE(list, data)
-        ewk_back_forward_list_item_unref(static_cast<Ewk_Back_Forward_List_Item*>(data));
+        ewk_object_unref(static_cast<Ewk_Object*>(data));
 }
 
 TEST_F(EWK2UnitTestBase, ewk_back_forward_list_current_item_get)
diff --git a/Source/WebKit2/UIProcess/API/efl/tests/test_ewk2_color_picker.cpp b/Source/WebKit2/UIProcess/API/efl/tests/test_ewk2_color_picker.cpp
new file mode 100644
index 000000000..7f59c33f6
--- /dev/null
+++ b/Source/WebKit2/UIProcess/API/efl/tests/test_ewk2_color_picker.cpp
@@ -0,0 +1,164 @@
+/*
+    Copyright (C) 2012 Samsung Electronics
+    Copyright (C) 2012 Intel Corporation. All rights reserved.
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Lesser General Public
+    License as published by the Free Software Foundation; either
+    version 2.1 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+    Lesser General Public License for more details.
+
+    You should have received a copy of the GNU Lesser General Public License
+    along with this library; if not, write to the Free Software Foundation,
+    Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
+*/
+
+#include "config.h"
+
+#include "UnitTestUtils/EWK2UnitTestBase.h"
+#include "UnitTestUtils/EWK2UnitTestEnvironment.h"
+#include <EWebKit2.h>
+#include <Ecore.h>
+
+using namespace EWK2UnitTest;
+
+extern EWK2UnitTestEnvironment* environment;
+
+#if ENABLE(INPUT_TYPE_COLOR)
+static const int initialRed = 0x12;
+static const int initialGreen = 0x34;
+static const int initialBlue = 0x56;
+static const int initialAlpha = 0xff;
+static const int changedRed = 0x98;
+static const int changedGreen = 0x76;
+static const int changedBlue = 0x54;
+static const int changedAlpha = 0xff;
+
+static bool s_isColorPickerShown = false;
+static Ewk_Color_Picker* s_colorPicker = 0;
+
+
+static void onColorPickerDone(void* userData, Evas_Object*, void*)
+{
+    bool* handled = static_cast<bool*>(userData);
+
+    *handled = true;
+}
+
+static unsigned char setColorPickerColor(void* data)
+{
+    Ewk_View_Smart_Data* smartData = static_cast<Ewk_View_Smart_Data*>(data);
+
+    // 4. Change color to changed color.
+    EXPECT_TRUE(ewk_color_picker_color_set(s_colorPicker, changedRed, changedGreen, changedBlue, changedAlpha));
+
+    evas_object_smart_callback_call(smartData->self, "input,type,color,request", 0);
+
+    return 0;
+}
+
+static Eina_Bool showColorPicker(Ewk_View_Smart_Data* smartData, Ewk_Color_Picker* colorPicker)
+{
+    static bool isFirstRun = true;
+
+    s_colorPicker = colorPicker;
+    s_isColorPickerShown = true;
+
+    int r, g, b, a;
+    EXPECT_TRUE(ewk_color_picker_color_get(colorPicker, &r, &g, &b, &a));
+
+    if (isFirstRun) {
+        // 2. Check initial value from html file.
+        EXPECT_EQ(initialRed, r);
+        EXPECT_EQ(initialGreen, g);
+        EXPECT_EQ(initialBlue, b);
+        EXPECT_EQ(initialAlpha, a);
+
+        isFirstRun = false;
+    } else {
+        // 7. Input values should be same as changed color.
+        EXPECT_EQ(changedRed, r);
+        EXPECT_EQ(changedGreen, g);
+        EXPECT_EQ(changedBlue, b);
+        EXPECT_EQ(changedAlpha, a);
+
+        evas_object_smart_callback_call(smartData->self, "input,type,color,request", 0);
+        return true;
+    }
+
+    // 3. Return after making a color picker.
+    ecore_timer_add(0.0, setColorPickerColor, smartData);
+    return true;
+}
+
+static Eina_Bool hideColorPicker(Ewk_View_Smart_Data*)
+{
+    // 5. Test color picker is shown.
+    EXPECT_TRUE(s_isColorPickerShown);
+    s_isColorPickerShown = false;
+}
+
+static Eina_Bool hideColorPickerByRemovingElement(Ewk_View_Smart_Data* smartData)
+{
+    // 9. input_picker_color_dismiss() is called if the element is removed.
+    EXPECT_TRUE(s_isColorPickerShown);
+    s_isColorPickerShown = false;
+    evas_object_smart_callback_call(smartData->self, "input,type,color,request", 0);
+}
+
+TEST_F(EWK2UnitTestBase, ewk_color_picker_color_set)
+{
+    Ewk_View_Smart_Class* api = ewkViewClass();
+    api->input_picker_color_request = showColorPicker;
+    api->input_picker_color_dismiss = hideColorPicker;
+
+    const char colorPickerHTML[] =
+        "<!DOCTYPE html>"
+        "<html>"
+        "<head>"
+        "<script>function removeInputElement(){"
+        "var parentElement = document.getElementById('parent');"
+        "var inputElement = document.getElementById('color');"
+        "parentElement.removeChild(inputElement);"
+        "}</script>"
+        "</head>"
+        "<body>"
+        "<div id='parent'>"
+        "<input type='color' value='#123456' id='color'>"
+        "<button onclick='removeInputElement();'>Remove Element</button>"
+        "</div>"
+        "</body>"
+        "</html>";
+
+    ewk_view_html_string_load(webView(), colorPickerHTML, 0, 0);
+    waitUntilLoadFinished();
+
+    // 1. Click input element to show color picker.
+    mouseClick(30, 20);
+
+    bool handled = false;
+    evas_object_smart_callback_add(webView(), "input,type,color,request", onColorPickerDone, &handled);
+    while (!handled)
+        ecore_main_loop_iterate();
+
+    // 6. Click input element to show color picker again.
+    mouseClick(30, 20);
+
+    handled = false;
+    while (!handled)
+        ecore_main_loop_iterate();
+
+    // 8. Click button to remove input element durlng color picker is shown.
+    api->input_picker_color_dismiss = hideColorPickerByRemovingElement;
+    mouseClick(80, 20);
+
+    handled = false;
+    while (!handled)
+        ecore_main_loop_iterate();
+    evas_object_smart_callback_del(webView(), "input,type,color,request", onColorPickerDone);
+}
+#endif // ENABLE(INPUT_TYPE_COLOR)
diff --git a/Source/WebKit2/UIProcess/API/efl/tests/test_ewk2_context.cpp b/Source/WebKit2/UIProcess/API/efl/tests/test_ewk2_context.cpp
index 27e46dc1e..b02a8d26e 100644
--- a/Source/WebKit2/UIProcess/API/efl/tests/test_ewk2_context.cpp
+++ b/Source/WebKit2/UIProcess/API/efl/tests/test_ewk2_context.cpp
@@ -53,6 +53,14 @@ TEST_F(EWK2UnitTestBase, ewk_context_cookie_manager_get)
     ASSERT_EQ(cookieManager, ewk_context_cookie_manager_get(context));
 }
 
+TEST_F(EWK2UnitTestBase, ewk_context_database_manager_get)
+{
+    Ewk_Context* context = ewk_view_context_get(webView());
+    Ewk_Database_Manager* databaseManager = ewk_context_database_manager_get(context);
+    ASSERT_TRUE(databaseManager);
+    ASSERT_EQ(databaseManager, ewk_context_database_manager_get(context));
+}
+
 TEST_F(EWK2UnitTestBase, ewk_context_favicon_database_get)
 {
     Ewk_Context* context = ewk_view_context_get(webView());
@@ -61,6 +69,14 @@ TEST_F(EWK2UnitTestBase, ewk_context_favicon_database_get)
     ASSERT_EQ(faviconDatabase, ewk_context_favicon_database_get(context));
 }
 
+TEST_F(EWK2UnitTestBase, ewk_context_storage_manager_get)
+{
+    Ewk_Context* context = ewk_view_context_get(webView());
+    Ewk_Storage_Manager* storageManager = ewk_context_storage_manager_get(context);
+    ASSERT_TRUE(storageManager);
+    ASSERT_EQ(storageManager, ewk_context_storage_manager_get(context));
+}
+
 static void schemeRequestCallback(Ewk_Url_Scheme_Request* request, void* userData)
 {
     const char* scheme = ewk_url_scheme_request_scheme_get(request);
@@ -121,7 +137,7 @@ static void loadVibrationHTMLString(Evas_Object* webView, const char* vibrationP
         ecore_main_loop_iterate();
 }
 
-TEST_F(EWK2UnitTestBase, ewk_context_vibration_client_callbacks_set)
+TEST_F(EWK2UnitTestBase, DISABLED_ewk_context_vibration_client_callbacks_set)
 {
     VibrationCbData data = { false, false, 0, 5000 };
     ewk_context_vibration_client_callbacks_set(ewk_view_context_get(webView()), vibrateCallback, cancelVibrationCallback, &data);
@@ -179,21 +195,12 @@ TEST_F(EWK2UnitTestBase, ewk_context_new)
 {
     Ewk_Context* context = ewk_context_new();
     ASSERT_TRUE(context);
-    ewk_context_unref(context);
+    ewk_object_unref(context);
 }
 
 TEST_F(EWK2UnitTestBase, ewk_context_new_with_injected_bundle_path)
 {
     Ewk_Context* context = ewk_context_new_with_injected_bundle_path(environment->injectedBundleSample());
     ASSERT_TRUE(context);
-    ewk_context_unref(context);
-}
-
-TEST_F(EWK2UnitTestBase, ewk_context_ref)
-{
-    Ewk_Context* context = ewk_context_new();
-    ASSERT_EQ(context, ewk_context_ref(context));
-    ewk_context_unref(context);
-    ewk_context_unref(context);
+    ewk_object_unref(context);
 }
-
diff --git a/Source/WebKit2/UIProcess/API/efl/tests/test_ewk2_database_manager.cpp b/Source/WebKit2/UIProcess/API/efl/tests/test_ewk2_database_manager.cpp
new file mode 100644
index 000000000..dd9b4b079
--- /dev/null
+++ b/Source/WebKit2/UIProcess/API/efl/tests/test_ewk2_database_manager.cpp
@@ -0,0 +1,113 @@
+/*
+ * Copyright (C) 2012 Samsung Electronics
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#include "UnitTestUtils/EWK2UnitTestBase.h"
+#include <EWebKit2.h>
+#include <Ecore.h>
+
+using namespace EWK2UnitTest;
+
+struct OriginData {
+    Eina_List* originList;
+    Ewk_Database_Manager* manager;
+    bool didReceiveOriginsCallback;
+    bool isSynchronized;
+    unsigned timeoutSeconds;
+
+    OriginData()
+        : originList(0)
+        , manager(0)
+        , didReceiveOriginsCallback(false)
+        , isSynchronized(false)
+        , timeoutSeconds(10)
+    { }
+};
+
+static void getDatabaseOriginsCallback(Eina_List* origins, Ewk_Error* error, void* userData)
+{
+    ASSERT_FALSE(error);
+
+    OriginData* originData = static_cast<OriginData*>(userData);
+    originData->didReceiveOriginsCallback = true;
+
+    Eina_List* l;
+    void* data;
+    EINA_LIST_FOREACH(origins, l, data) {
+        originData->originList = eina_list_append(originData->originList, data);
+        Ewk_Security_Origin* origin = static_cast<Ewk_Security_Origin*>(data);
+        if (!strcmp(ewk_security_origin_protocol_get(origin), "http")
+            && !strcmp(ewk_security_origin_host_get(origin), "www.databasetest.com")
+            && !ewk_security_origin_port_get(origin)) {
+                originData->isSynchronized = true;
+                ecore_main_loop_quit();
+        }
+    }
+}
+
+static bool timerCallback(void* userData)
+{
+    OriginData* originData = static_cast<OriginData*>(userData);
+
+    if (originData->isSynchronized || !--(originData->timeoutSeconds)) {
+        ecore_main_loop_quit();
+        return ECORE_CALLBACK_CANCEL;
+    }
+
+    if (originData->didReceiveOriginsCallback) {
+        originData->didReceiveOriginsCallback = false;
+        ewk_database_manager_origins_get(originData->manager, getDatabaseOriginsCallback, originData);
+    }
+
+    return ECORE_CALLBACK_RENEW;
+}
+
+TEST_F(EWK2UnitTestBase, ewk_database_manager_origins_get)
+{
+    Evas_Object* view = webView();
+    const char* databaseHTML =
+        "<html><head><title>original title</title></head>"
+        "<body>"
+        "<script type='text/javascript'>"
+        " var db = openDatabase(\"DBTest\", \"1.0\", \"HTML5 Database example\", 200000);"
+        "</script>"
+        "</body></html>";
+
+    ASSERT_TRUE(ewk_view_html_string_load(view, databaseHTML, "http://www.databasetest.com", 0));
+    ASSERT_TRUE(waitUntilLoadFinished());
+
+    OriginData originData;
+    originData.manager = ewk_context_database_manager_get(ewk_view_context_get(view));
+    ASSERT_TRUE(ewk_database_manager_origins_get(originData.manager, getDatabaseOriginsCallback, &originData));
+    Ecore_Timer* database_timer = ecore_timer_add(1, reinterpret_cast<Ecore_Task_Cb>(timerCallback), &originData);
+
+    ecore_main_loop_begin();
+    if (database_timer)
+        ecore_timer_del(database_timer);
+
+    ASSERT_TRUE(originData.isSynchronized);
+    ASSERT_LE(1, eina_list_count(originData.originList));
+}
diff --git a/Source/WebKit2/UIProcess/API/efl/tests/test_ewk2_favicon_database.cpp b/Source/WebKit2/UIProcess/API/efl/tests/test_ewk2_favicon_database.cpp
index 7a57b9122..cda6efa06 100644
--- a/Source/WebKit2/UIProcess/API/efl/tests/test_ewk2_favicon_database.cpp
+++ b/Source/WebKit2/UIProcess/API/efl/tests/test_ewk2_favicon_database.cpp
@@ -89,6 +89,10 @@ TEST_F(EWK2UnitTestBase, ewk_favicon_database_url_get)
     OwnPtr<EWK2UnitTestServer> httpServer = adoptPtr(new EWK2UnitTestServer);
     httpServer->run(serverCallback);
 
+    // Set favicon database path and enable functionality.
+    Ewk_Context* context = ewk_view_context_get(webView());
+    ewk_context_favicon_database_directory_set(context, 0);
+
     bool iconChanged = false;
     evas_object_smart_callback_add(webView(), "icon,changed", onIconChanged, &iconChanged);
 
@@ -103,7 +107,6 @@ TEST_F(EWK2UnitTestBase, ewk_favicon_database_url_get)
     evas_object_smart_callback_del(webView(), "icon,changed", onIconChanged);
 
     // Check the API retrieving a favicon URL.
-    Ewk_Context* context = ewk_view_context_get(webView());
     Ewk_Favicon_Database* faviconDatabase = ewk_context_favicon_database_get(context);
     ASSERT_TRUE(faviconDatabase);
 
@@ -146,6 +149,10 @@ TEST_F(EWK2UnitTestBase, ewk_favicon_database_async_icon_get)
     OwnPtr<EWK2UnitTestServer> httpServer = adoptPtr(new EWK2UnitTestServer);
     httpServer->run(serverCallback);
 
+    // Set favicon database path and enable functionality.
+    Ewk_Context* context = ewk_view_context_get(webView());
+    ewk_context_favicon_database_directory_set(context, 0);
+
     IconRequestData data = { webView(), 0 };
     evas_object_smart_callback_add(webView(), "icon,changed", requestFaviconData, &data);
 
diff --git a/Source/WebKit2/UIProcess/API/efl/tests/test_ewk2_file_chooser_request.cpp b/Source/WebKit2/UIProcess/API/efl/tests/test_ewk2_file_chooser_request.cpp
new file mode 100644
index 000000000..a562d74c2
--- /dev/null
+++ b/Source/WebKit2/UIProcess/API/efl/tests/test_ewk2_file_chooser_request.cpp
@@ -0,0 +1,171 @@
+/*
+ * Copyright (C) 2012 Intel Corporation. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#include "UnitTestUtils/EWK2UnitTestBase.h"
+#include "UnitTestUtils/EWK2UnitTestEnvironment.h"
+#include "UnitTestUtils/EWK2UnitTestServer.h"
+#include <EWebKit2.h>
+#include <Ecore.h>
+
+using namespace EWK2UnitTest;
+
+extern EWK2UnitTestEnvironment* environment;
+
+static void onFileChooserRequest(void* userData, Evas_Object*, void* eventInfo)
+{
+    Ewk_File_Chooser_Request** returnRequest = static_cast<Ewk_File_Chooser_Request**>(userData);
+    ASSERT_TRUE(returnRequest);
+    Ewk_File_Chooser_Request* request = static_cast<Ewk_File_Chooser_Request*>(eventInfo);
+    ASSERT_TRUE(request);
+
+    // Ref the request to process asynchronously.
+    *returnRequest = ewk_file_chooser_request_ref(request);
+}
+
+static int compareStrings(const void* string1, const void* string2)
+{
+    ASSERT(string1);
+    ASSERT(string2);
+
+    return strcmp(static_cast<const char*>(string1), static_cast<const char*>(string2));
+}
+
+static void freeStringList(Eina_List** list)
+{
+    void* data;
+    EINA_LIST_FREE(*list, data) {
+        eina_stringshare_del(static_cast<char*>(data));
+    }
+}
+
+TEST_F(EWK2UnitTestBase, ewk_file_chooser_request_files_choose)
+{
+    Ewk_File_Chooser_Request* request = 0;
+    evas_object_smart_callback_add(webView(), "file,chooser,request", onFileChooserRequest, &request);
+    ASSERT_TRUE(loadUrlSync(environment->urlForResource("file_chooser.html").data()));
+
+    // Click on the file input.
+    mouseClick(15, 15);
+
+    // Wait for the file chooser request.
+    while (!request)
+        ecore_main_loop_iterate();
+
+    evas_object_smart_callback_del(webView(), "file,chooser,request", onFileChooserRequest);
+    ASSERT_TRUE(request);
+    // Validate file chooser request.
+    EXPECT_TRUE(ewk_file_chooser_request_allow_multiple_files_get(request));
+    Eina_List* mimeTypes = ewk_file_chooser_request_accepted_mimetypes_get(request);
+    mimeTypes = eina_list_sort(mimeTypes, eina_list_count(mimeTypes), compareStrings);
+
+    ASSERT_EQ(2, eina_list_count(mimeTypes));
+    EXPECT_STREQ("image/*", static_cast<char*>(eina_list_nth(mimeTypes, 0)));
+    EXPECT_STREQ("video/*", static_cast<char*>(eina_list_nth(mimeTypes, 1)));
+    freeStringList(&mimeTypes);
+
+    ASSERT_FALSE(ewk_file_chooser_request_files_choose(request, 0));
+    Eina_List* files = 0;
+    files = eina_list_append(files, eina_stringshare_add("/tmp/file1.png"));
+    files = eina_list_append(files, eina_stringshare_add("/tmp/file2.png"));
+    ASSERT_TRUE(ewk_file_chooser_request_files_choose(request, files));
+    ASSERT_FALSE(ewk_file_chooser_request_files_choose(request, files));
+    freeStringList(&files);
+
+    ewk_file_chooser_request_unref(request);
+
+    // Check that the JS side received the files.
+    EXPECT_TRUE(waitUntilTitleChangedTo("file1.png|file2.png"));
+}
+
+TEST_F(EWK2UnitTestBase, ewk_file_chooser_request_file_choose)
+{
+    Ewk_File_Chooser_Request* request = 0;
+    evas_object_smart_callback_add(webView(), "file,chooser,request", onFileChooserRequest, &request);
+    ASSERT_TRUE(loadUrlSync(environment->urlForResource("file_chooser.html").data()));
+
+    // Click on the file input.
+    mouseClick(15, 15);
+
+    // Wait for the file chooser request.
+    while (!request)
+        ecore_main_loop_iterate();
+
+    evas_object_smart_callback_del(webView(), "file,chooser,request", onFileChooserRequest);
+    ASSERT_TRUE(request);
+
+    ASSERT_FALSE(ewk_file_chooser_request_file_choose(request, 0));
+    ASSERT_TRUE(ewk_file_chooser_request_file_choose(request, "/tmp/file3.png"));
+    ASSERT_FALSE(ewk_file_chooser_request_file_choose(request, "/tmp/file3.png"));
+
+    ewk_file_chooser_request_unref(request);
+
+    // Check that the JS side received the file.
+    EXPECT_TRUE(waitUntilTitleChangedTo("file3.png"));
+}
+
+TEST_F(EWK2UnitTestBase, ewk_file_chooser_request_file_cancel)
+{
+    Ewk_File_Chooser_Request* request = 0;
+    evas_object_smart_callback_add(webView(), "file,chooser,request", onFileChooserRequest, &request);
+    ASSERT_TRUE(loadUrlSync(environment->urlForResource("file_chooser.html").data()));
+
+    // Click on the file input.
+    mouseClick(15, 15);
+
+    // Wait for the file chooser request.
+    while (!request)
+        ecore_main_loop_iterate();
+
+    evas_object_smart_callback_del(webView(), "file,chooser,request", onFileChooserRequest);
+    ASSERT_TRUE(request);
+
+    ASSERT_TRUE(ewk_file_chooser_request_cancel(request));
+    ASSERT_FALSE(ewk_file_chooser_request_cancel(request));
+
+    ewk_file_chooser_request_unref(request);
+
+    ecore_main_loop_iterate();
+    EXPECT_STREQ("File chooser test", ewk_view_title_get(webView()));
+
+    // Default behavior is to cancel if the client does not act on the request.
+    request = 0;
+    evas_object_smart_callback_add(webView(), "file,chooser,request", onFileChooserRequest, &request);
+    // Click on the file input.
+    mouseClick(15, 15);
+
+    // Wait for the file chooser request.
+    while (!request)
+        ecore_main_loop_iterate();
+
+    evas_object_smart_callback_del(webView(), "file,chooser,request", onFileChooserRequest);
+    ASSERT_TRUE(request);
+
+    ewk_file_chooser_request_unref(request);
+
+    ecore_main_loop_iterate();
+    EXPECT_STREQ("File chooser test", ewk_view_title_get(webView()));
+}
diff --git a/Source/WebKit2/UIProcess/API/efl/tests/test_ewk2_object.cpp b/Source/WebKit2/UIProcess/API/efl/tests/test_ewk2_object.cpp
new file mode 100644
index 000000000..1c96f2e80
--- /dev/null
+++ b/Source/WebKit2/UIProcess/API/efl/tests/test_ewk2_object.cpp
@@ -0,0 +1,115 @@
+/*
+ * Copyright (C) 2012 Intel Corporation. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#include "UnitTestUtils/EWK2UnitTestBase.h"
+#include "UnitTestUtils/EWK2UnitTestEnvironment.h"
+#include "UnitTestUtils/EWK2UnitTestServer.h"
+#include "WKEinaSharedString.h"
+#include "ewk_object_private.h"
+#include <EWebKit2.h>
+#include <gtest/gtest.h>
+#include <wtf/PassRefPtr.h>
+
+using namespace EWK2UnitTest;
+using namespace WTF;
+
+extern EWK2UnitTestEnvironment* environment;
+
+class TestEwkObject1 : public Ewk_Object {
+public:
+    EWK_OBJECT_DECLARE(TestEwkObject)
+
+    static PassRefPtr<TestEwkObject1> create()
+    {
+        wasDeleted = false;
+        return adoptRef(new TestEwkObject1());
+    }
+
+    static bool wasDeleted; // We always test only one instance of TestEwkObject.
+
+    ~TestEwkObject1()
+    {
+        wasDeleted = true;
+    }
+};
+
+bool TestEwkObject1::wasDeleted = false;
+
+class TestEwkObject2 : public Ewk_Object {
+public:
+    EWK_OBJECT_DECLARE(TestEwkObject2)
+
+    static PassRefPtr<TestEwkObject2> create()
+    {
+        return adoptRef(new TestEwkObject2());
+    }
+};
+
+TEST_F(EWK2UnitTestBase, ewk_object_ref)
+{
+    Ewk_Object* objectRef = 0;
+
+    {
+        RefPtr<Ewk_Object> object = TestEwkObject1::create();
+        ASSERT_FALSE(TestEwkObject1::wasDeleted);
+        ASSERT_EQ(1, object->refCount());
+
+        objectRef = object.get();
+        ewk_object_ref(objectRef);
+        ASSERT_EQ(2, objectRef->refCount());
+    }
+
+    ASSERT_FALSE(TestEwkObject1::wasDeleted);
+    ASSERT_EQ(1, objectRef->refCount());
+
+    ewk_object_unref(objectRef);
+    ASSERT_TRUE(TestEwkObject1::wasDeleted);
+}
+
+TEST_F(EWK2UnitTestBase, ewk_object_is_of_type)
+{
+    RefPtr<Ewk_Object> object1 = TestEwkObject1::create();
+    RefPtr<Ewk_Object> object2 = TestEwkObject2::create();
+
+    ASSERT_TRUE(ewk_object_is_of_type<TestEwkObject1*>(object1.get()));
+    ASSERT_TRUE(ewk_object_is_of_type<TestEwkObject2*>(object2.get()));
+
+    ASSERT_FALSE(ewk_object_is_of_type<TestEwkObject1*>(object2.get()));
+    ASSERT_FALSE(ewk_object_is_of_type<TestEwkObject2*>(object1.get()));
+}
+
+TEST_F(EWK2UnitTestBase, ewk_object_cast)
+{
+    RefPtr<Ewk_Object> object1 = TestEwkObject1::create();
+    RefPtr<Ewk_Object> object2 = TestEwkObject2::create();
+
+    TestEwkObject1* objectRef1 = ewk_object_cast<TestEwkObject1*>(object1.get());
+    ASSERT_TRUE(objectRef1);
+
+    TestEwkObject2* objectRef2 = ewk_object_cast<TestEwkObject2*>(object2.get());
+    ASSERT_TRUE(objectRef2);
+}
diff --git a/Source/WebKit2/UIProcess/API/efl/tests/test_ewk2_popup_menu.cpp b/Source/WebKit2/UIProcess/API/efl/tests/test_ewk2_popup_menu.cpp
new file mode 100644
index 000000000..7a033519a
--- /dev/null
+++ b/Source/WebKit2/UIProcess/API/efl/tests/test_ewk2_popup_menu.cpp
@@ -0,0 +1,105 @@
+/*
+    Copyright (C) 2012 Samsung Electronics
+    Copyright (C) 2012 Intel Corporation. All rights reserved.
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Lesser General Public
+    License as published by the Free Software Foundation; either
+    version 2.1 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+    Lesser General Public License for more details.
+
+    You should have received a copy of the GNU Lesser General Public License
+    along with this library; if not, write to the Free Software Foundation,
+    Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
+*/
+
+#include "config.h"
+
+#include "UnitTestUtils/EWK2UnitTestBase.h"
+#include "UnitTestUtils/EWK2UnitTestEnvironment.h"
+#include <EWebKit2.h>
+#include <Ecore.h>
+
+using namespace EWK2UnitTest;
+
+extern EWK2UnitTestEnvironment* environment;
+
+static Ewk_Popup_Menu* s_popupMenu = 0;
+
+static inline void checkBasicPopupMenuItem(Ewk_Popup_Menu_Item* item, const char* title, bool enabled)
+{
+    EXPECT_EQ(EWK_POPUP_MENU_ITEM, ewk_popup_menu_item_type_get(item));
+    EXPECT_STREQ(title, ewk_popup_menu_item_text_get(item));
+    EXPECT_EQ(enabled, ewk_popup_menu_item_enabled_get(item));
+}
+
+static Eina_Bool selectItemAfterDelayed(void* data)
+{
+    EXPECT_TRUE(ewk_popup_menu_selected_index_set(static_cast<Ewk_Popup_Menu*>(data), 0));
+    return ECORE_CALLBACK_CANCEL;
+}
+
+static Eina_Bool showPopupMenu(Ewk_View_Smart_Data* smartData, Eina_Rectangle, Ewk_Text_Direction, double, Ewk_Popup_Menu* popupMenu)
+{
+    s_popupMenu = popupMenu;
+
+    EXPECT_EQ(2, ewk_popup_menu_selected_index_get(popupMenu));
+
+    const Eina_List* list = ewk_popup_menu_items_get(popupMenu);
+
+    Ewk_Popup_Menu_Item* item = static_cast<Ewk_Popup_Menu_Item*>(eina_list_nth(list, 0));
+    checkBasicPopupMenuItem(item, "first", true);
+    EXPECT_EQ(EWK_TEXT_DIRECTION_LEFT_TO_RIGHT, ewk_popup_menu_item_text_direction_get(item));
+    EXPECT_STREQ("", ewk_popup_menu_item_tooltip_get(item));
+    EXPECT_STREQ("", ewk_popup_menu_item_accessibility_text_get(item));
+    EXPECT_FALSE(ewk_popup_menu_item_is_label_get(item));
+    EXPECT_FALSE(ewk_popup_menu_item_selected_get(item));
+
+    item = static_cast<Ewk_Popup_Menu_Item*>(eina_list_nth(list, 1));
+    checkBasicPopupMenuItem(item, "second", false);
+    EXPECT_FALSE(ewk_popup_menu_item_enabled_get(item));
+
+    item = static_cast<Ewk_Popup_Menu_Item*>(eina_list_nth(list, 2));
+    checkBasicPopupMenuItem(item, "third", true);
+    EXPECT_EQ(EWK_TEXT_DIRECTION_RIGHT_TO_LEFT, ewk_popup_menu_item_text_direction_get(item));
+    EXPECT_STREQ("tooltip", ewk_popup_menu_item_tooltip_get(item));
+    EXPECT_STREQ("aria", ewk_popup_menu_item_accessibility_text_get(item));
+    EXPECT_TRUE(ewk_popup_menu_item_selected_get(item));
+
+    item = static_cast<Ewk_Popup_Menu_Item*>(eina_list_nth(list, 3));
+    checkBasicPopupMenuItem(item, "label", false);
+    EXPECT_TRUE(ewk_popup_menu_item_is_label_get(item));
+
+    item = static_cast<Ewk_Popup_Menu_Item*>(eina_list_nth(list, 4));
+    checkBasicPopupMenuItem(item, "    forth", true);
+
+    item = static_cast<Ewk_Popup_Menu_Item*>(eina_list_nth(list, 5));
+    EXPECT_EQ(EWK_POPUP_MENU_UNKNOWN, ewk_popup_menu_item_type_get(item));
+    EXPECT_STREQ(0, ewk_popup_menu_item_text_get(item));
+
+    ecore_timer_add(0, selectItemAfterDelayed, popupMenu);
+    return true;
+}
+
+TEST_F(EWK2UnitTestBase, ewk_popup_menu_select_item)
+{
+    const char* selectHTML =
+        "<!doctype html><body><select onchange=\"document.title=this.value;\">"
+        "<option>first</option><option disabled>second</option><option selected dir=\"rtl\" title=\"tooltip\" aria-label=\"aria\">third</option>"
+        "<optgroup label=\"label\"><option>forth</option></optgroup>"
+        "</select></body>";
+
+    ewkViewClass()->popup_menu_show = showPopupMenu;
+
+    ewk_view_html_string_load(webView(), selectHTML, "file:///", 0);
+    ASSERT_TRUE(waitUntilLoadFinished());
+    mouseClick(30, 20);
+    ASSERT_TRUE(waitUntilTitleChangedTo("first"));
+
+    ASSERT_TRUE(s_popupMenu);
+    EXPECT_TRUE(ewk_popup_menu_close(s_popupMenu));
+}
diff --git a/Source/WebKit2/UIProcess/API/efl/tests/test_ewk2_settings.cpp b/Source/WebKit2/UIProcess/API/efl/tests/test_ewk2_settings.cpp
index 32f981788..d3312f8fe 100644
--- a/Source/WebKit2/UIProcess/API/efl/tests/test_ewk2_settings.cpp
+++ b/Source/WebKit2/UIProcess/API/efl/tests/test_ewk2_settings.cpp
@@ -157,3 +157,17 @@ TEST_F(EWK2UnitTestBase, ewk_settings_dns_prefetching_enabled)
     ASSERT_TRUE(ewk_settings_dns_prefetching_enabled_set(settings, false));
     ASSERT_FALSE(ewk_settings_dns_prefetching_enabled_get(settings));
 }
+
+TEST_F(EWK2UnitTestBase, ewk_setting_encoding_detector_enabled)
+{
+    Ewk_Settings* settings = ewk_view_settings_get(webView());
+
+    // The encoding detector is disabled by default.
+    ASSERT_FALSE(ewk_setting_encoding_detector_enabled_get(settings));
+
+    ASSERT_TRUE(ewk_setting_encoding_detector_enabled_set(settings, true));
+    ASSERT_TRUE(ewk_setting_encoding_detector_enabled_get(settings));
+
+    ASSERT_TRUE(ewk_setting_encoding_detector_enabled_set(settings, false));
+    ASSERT_FALSE(ewk_setting_encoding_detector_enabled_get(settings));
+}
diff --git a/Source/WebKit2/UIProcess/API/efl/tests/test_ewk2_storage_manager.cpp b/Source/WebKit2/UIProcess/API/efl/tests/test_ewk2_storage_manager.cpp
new file mode 100644
index 000000000..b5d962a9a
--- /dev/null
+++ b/Source/WebKit2/UIProcess/API/efl/tests/test_ewk2_storage_manager.cpp
@@ -0,0 +1,134 @@
+/*
+ * Copyright (C) 2012 Samsung Electronics
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#include "UnitTestUtils/EWK2UnitTestBase.h"
+#include <EWebKit2.h>
+#include <Ecore.h>
+#include <gtest/gtest.h>
+
+using namespace EWK2UnitTest;
+
+struct OriginData {
+    Eina_List* originList;
+    Ewk_Storage_Manager* manager;
+    bool didReceiveOriginsCallback;
+    bool isSynchronized;
+    unsigned timeToCheck;
+
+    OriginData()
+        : originList(0)
+        , manager(0)
+        , didReceiveOriginsCallback(false)
+        , isSynchronized(false)
+        , timeToCheck(10)
+    { }
+};
+
+static void getStorageOriginsCallback(Eina_List* origins, Ewk_Error* error, void* userData)
+{
+    ASSERT_FALSE(error);
+
+    OriginData* originData = static_cast<OriginData*>(userData);
+    originData->didReceiveOriginsCallback = true;
+
+    Eina_List* l;
+    void* data;
+    EINA_LIST_FOREACH(origins, l, data) {
+        originData->originList = eina_list_append(originData->originList, data);
+        Ewk_Security_Origin* origin = static_cast<Ewk_Security_Origin*>(data);
+        if (!strcmp(ewk_security_origin_protocol_get(origin), "http")
+            && !strcmp(ewk_security_origin_host_get(origin), "www.storagetest.com")
+            && !ewk_security_origin_port_get(origin)) {
+                originData->isSynchronized = true;
+                ecore_main_loop_quit();
+        }
+    }
+}
+
+static bool timerCallback(void* userData)
+{
+    OriginData* originData = static_cast<OriginData*>(userData);
+
+    if (originData->isSynchronized || !--(originData->timeToCheck)) {
+        ecore_main_loop_quit();
+        return ECORE_CALLBACK_CANCEL;
+    }
+
+    if (originData->didReceiveOriginsCallback) {
+        originData->didReceiveOriginsCallback = false;
+        ewk_storage_manager_origins_get(originData->manager, getStorageOriginsCallback, originData);
+    }
+
+    return ECORE_CALLBACK_RENEW;
+}
+
+static bool checkOrigin(Eina_List* origins, Ewk_Security_Origin** origin)
+{
+    Eina_List* l;
+    void* data;
+    EINA_LIST_FOREACH(origins, l, data) {
+        *origin = static_cast<Ewk_Security_Origin*>(data);
+        if (!strcmp(ewk_security_origin_protocol_get(*origin), "http")
+            && !strcmp(ewk_security_origin_host_get(*origin), "www.storagetest.com")
+            && !ewk_security_origin_port_get(*origin))
+            return true;
+    }
+
+    return false;
+}
+
+TEST_F(EWK2UnitTestBase, ewk_storage_manager_origins_get)
+{
+    Evas_Object* view = webView();
+    const char* storageHTML =
+        "<html><head><title>original title</title></head>"
+        "<body>"
+        "<script type='text/javascript'>"
+        " localStorage.setItem('item', 'storage');"
+        "</script>"
+        "</body></html>";
+
+    ewk_view_html_string_load(view, storageHTML, "http://www.storagetest.com", 0);
+
+    OriginData originData;
+    originData.manager = ewk_context_storage_manager_get(ewk_view_context_get(view));
+    ASSERT_TRUE(ewk_storage_manager_origins_get(originData.manager, getStorageOriginsCallback, &originData));
+    Ecore_Timer* storage_timer = ecore_timer_add(1, reinterpret_cast<Ecore_Task_Cb>(timerCallback), &originData);
+
+    ecore_main_loop_begin();
+    if (storage_timer)
+        ecore_timer_del(storage_timer);
+
+    ASSERT_TRUE(originData.isSynchronized);
+    ASSERT_LE(1, eina_list_count(originData.originList));
+
+    Ewk_Security_Origin* origin = 0;
+    EXPECT_TRUE(checkOrigin(originData.originList, &origin));
+
+    EXPECT_EQ(origin, ewk_security_origin_ref(origin));
+    ewk_security_origin_unref(origin);
+}
diff --git a/Source/WebKit2/UIProcess/API/efl/tests/test_ewk2_view.cpp b/Source/WebKit2/UIProcess/API/efl/tests/test_ewk2_view.cpp
index d4bb70fbf..80240d2ae 100644
--- a/Source/WebKit2/UIProcess/API/efl/tests/test_ewk2_view.cpp
+++ b/Source/WebKit2/UIProcess/API/efl/tests/test_ewk2_view.cpp
@@ -38,6 +38,14 @@ using namespace EWK2UnitTest;
 extern EWK2UnitTestEnvironment* environment;
 bool fullScreenCallbackCalled;
 
+TEST_F(EWK2UnitTestBase, ewk_view_type_check)
+{
+    ASSERT_FALSE(ewk_view_context_get(0));
+
+    Evas_Object* rectangle = evas_object_rectangle_add(canvas());
+    ASSERT_FALSE(ewk_view_url_set(rectangle, 0));
+}
+
 static void onLoadFinishedForRedirection(void* userData, Evas_Object*, void*)
 {
     int* countLoadFinished = static_cast<int*>(userData);
@@ -193,76 +201,6 @@ TEST_F(EWK2UnitTestBase, ewk_view_form_submission_request)
     evas_object_smart_callback_del(webView(), "form,submission,request", onFormAboutToBeSubmitted);
 }
 
-static inline void checkBasicPopupMenuItem(Ewk_Popup_Menu_Item* item, const char* title, bool enabled)
-{
-    EXPECT_EQ(EWK_POPUP_MENU_ITEM, ewk_popup_menu_item_type_get(item));
-    EXPECT_STREQ(title, ewk_popup_menu_item_text_get(item));
-    EXPECT_EQ(enabled, ewk_popup_menu_item_enabled_get(item));
-}
-
-static Eina_Bool selectItemAfterDelayed(void* data)
-{
-    EXPECT_TRUE(ewk_view_popup_menu_select(static_cast<Evas_Object*>(data), 0));
-    return ECORE_CALLBACK_CANCEL;
-}
-
-static Eina_Bool showPopupMenu(Ewk_View_Smart_Data* smartData, Eina_Rectangle, Ewk_Text_Direction, double, Eina_List* list, int selectedIndex)
-{
-    EXPECT_EQ(2, selectedIndex);
-
-    Ewk_Popup_Menu_Item* item = static_cast<Ewk_Popup_Menu_Item*>(eina_list_nth(list, 0));
-    checkBasicPopupMenuItem(item, "first", true);
-    EXPECT_EQ(EWK_TEXT_DIRECTION_LEFT_TO_RIGHT, ewk_popup_menu_item_text_direction_get(item));
-    EXPECT_STREQ("", ewk_popup_menu_item_tooltip_get(item));
-    EXPECT_STREQ("", ewk_popup_menu_item_accessibility_text_get(item));
-    EXPECT_FALSE(ewk_popup_menu_item_is_label_get(item));
-    EXPECT_FALSE(ewk_popup_menu_item_selected_get(item));
-
-    item = static_cast<Ewk_Popup_Menu_Item*>(eina_list_nth(list, 1));
-    checkBasicPopupMenuItem(item, "second", false);
-    EXPECT_FALSE(ewk_popup_menu_item_enabled_get(item));
-
-    item = static_cast<Ewk_Popup_Menu_Item*>(eina_list_nth(list, 2));
-    checkBasicPopupMenuItem(item, "third", true);
-    EXPECT_EQ(EWK_TEXT_DIRECTION_RIGHT_TO_LEFT, ewk_popup_menu_item_text_direction_get(item));
-    EXPECT_STREQ("tooltip", ewk_popup_menu_item_tooltip_get(item));
-    EXPECT_STREQ("aria", ewk_popup_menu_item_accessibility_text_get(item));
-    EXPECT_TRUE(ewk_popup_menu_item_selected_get(item));
-
-    item = static_cast<Ewk_Popup_Menu_Item*>(eina_list_nth(list, 3));
-    checkBasicPopupMenuItem(item, "label", false);
-    EXPECT_TRUE(ewk_popup_menu_item_is_label_get(item));
-
-    item = static_cast<Ewk_Popup_Menu_Item*>(eina_list_nth(list, 4));
-    checkBasicPopupMenuItem(item, "    forth", true);
-
-    item = static_cast<Ewk_Popup_Menu_Item*>(eina_list_nth(list, 5));
-    EXPECT_EQ(EWK_POPUP_MENU_UNKNOWN, ewk_popup_menu_item_type_get(item));
-    EXPECT_STREQ(0, ewk_popup_menu_item_text_get(item));
-
-    ecore_timer_add(0, selectItemAfterDelayed, smartData->self);
-    return true;
-}
-
-TEST_F(EWK2UnitTestBase, ewk_view_popup_menu_select)
-{
-    const char* selectHTML =
-        "<!doctype html><body><select onchange=\"document.title=this.value;\">"
-        "<option>first</option><option disabled>second</option><option selected dir=\"rtl\" title=\"tooltip\" aria-label=\"aria\">third</option>"
-        "<optgroup label=\"label\"><option>forth</option></optgroup>"
-        "</select></body>";
-
-    ewkViewClass()->popup_menu_show = showPopupMenu;
-
-    ewk_view_html_string_load(webView(), selectHTML, "file:///", 0);
-    ASSERT_TRUE(waitUntilLoadFinished());
-    mouseClick(30, 20);
-    ASSERT_TRUE(waitUntilTitleChangedTo("first"));
-
-    EXPECT_TRUE(ewk_view_popup_menu_close(webView()));
-    EXPECT_FALSE(ewk_view_popup_menu_select(webView(), 0));
-}
-
 TEST_F(EWK2UnitTestBase, ewk_view_settings_get)
 {
     Ewk_Settings* settings = ewk_view_settings_get(webView());
@@ -612,135 +550,6 @@ TEST_F(EWK2UnitTestBase, ewk_view_run_javascript_prompt)
     EXPECT_FALSE(promptCallbackData.called);
 }
 
-#if ENABLE(INPUT_TYPE_COLOR)
-static const int initialRed = 0x12;
-static const int initialGreen = 0x34;
-static const int initialBlue = 0x56;
-static const int initialAlpha = 0xff;
-static const int changedRed = 0x98;
-static const int changedGreen = 0x76;
-static const int changedBlue = 0x54;
-static const int changedAlpha = 0xff;
-
-static bool isColorPickerShown = false;
-
-static void onColorPickerDone(void* userData, Evas_Object*, void*)
-{
-    bool* handled = static_cast<bool*>(userData);
-
-    *handled = true;
-}
-
-static unsigned char setColorPickerColor(void* data)
-{
-    Ewk_View_Smart_Data* smartData = static_cast<Ewk_View_Smart_Data*>(data);
-
-    // 4. Change color to changed color.
-    EXPECT_TRUE(ewk_view_color_picker_color_set(smartData->self, changedRed, changedGreen, changedBlue, changedAlpha));
-
-    evas_object_smart_callback_call(smartData->self, "input,type,color,request", 0);
-
-    return 0;
-}
-
-static Eina_Bool showColorPicker(Ewk_View_Smart_Data* smartData, int r, int g, int b, int a)
-{
-    static bool isFirstRun = true;
-
-    isColorPickerShown = true;
-
-    if (isFirstRun) {
-        // 2. Check initial value from html file.
-        EXPECT_EQ(initialRed, r);
-        EXPECT_EQ(initialGreen, g);
-        EXPECT_EQ(initialBlue, b);
-        EXPECT_EQ(initialAlpha, a);
-
-        isFirstRun = false;
-    } else {
-        // 7. Input values should be same as changed color.
-        EXPECT_EQ(changedRed, r);
-        EXPECT_EQ(changedGreen, g);
-        EXPECT_EQ(changedBlue, b);
-        EXPECT_EQ(changedAlpha, a);
-
-        evas_object_smart_callback_call(smartData->self, "input,type,color,request", 0);
-        return true;
-    }
-
-    // 3. Return after making a color picker.
-    ecore_timer_add(0.0, setColorPickerColor, smartData);
-    return true;
-}
-
-static Eina_Bool hideColorPicker(Ewk_View_Smart_Data*)
-{
-    // 5. Test color picker is shown.
-    EXPECT_TRUE(isColorPickerShown);
-    isColorPickerShown = false;
-}
-
-static Eina_Bool hideColorPickerByRemovingElement(Ewk_View_Smart_Data* smartData)
-{
-    // 9. input_picker_color_dismiss() is called if the element is removed.
-    EXPECT_TRUE(isColorPickerShown);
-    isColorPickerShown = false;
-    evas_object_smart_callback_call(smartData->self, "input,type,color,request", 0);
-}
-
-TEST_F(EWK2UnitTestBase, ewk_view_color_picker_color_set)
-{
-    Ewk_View_Smart_Class* api = ewkViewClass();
-    api->input_picker_color_request = showColorPicker;
-    api->input_picker_color_dismiss = hideColorPicker;
-
-    const char colorPickerHTML[] =
-        "<!DOCTYPE html>"
-        "<html>"
-        "<head>"
-        "<script>function removeInputElement(){"
-        "var parentElement = document.getElementById('parent');"
-        "var inputElement = document.getElementById('color');"
-        "parentElement.removeChild(inputElement);"
-        "}</script>"
-        "</head>"
-        "<body>"
-        "<div id='parent'>"
-        "<input type='color' value='#123456' id='color'>"
-        "<button onclick='removeInputElement();'>Remove Element</button>"
-        "</div>"
-        "</body>"
-        "</html>";
-
-    ewk_view_html_string_load(webView(), colorPickerHTML, 0, 0);
-    waitUntilLoadFinished();
-
-    // 1. Click input element to show color picker.
-    mouseClick(30, 20);
-
-    bool handled = false;
-    evas_object_smart_callback_add(webView(), "input,type,color,request", onColorPickerDone, &handled);
-    while (!handled)
-        ecore_main_loop_iterate();
-
-    // 6. Click input element to show color picker again.
-    mouseClick(30, 20);
-
-    handled = false;
-    while (!handled)
-        ecore_main_loop_iterate();
-
-    // 8. Click button to remove input element durlng color picker is shown.
-    api->input_picker_color_dismiss = hideColorPickerByRemovingElement;
-    mouseClick(80, 20);
-
-    handled = false;
-    while (!handled)
-        ecore_main_loop_iterate();
-    evas_object_smart_callback_del(webView(), "input,type,color,request", onColorPickerDone);
-}
-#endif // ENABLE(INPUT_TYPE_COLOR)
-
 TEST_F(EWK2UnitTestBase, ewk_view_context_get)
 {
     Ewk_Context* context = ewk_view_context_get(webView());
@@ -959,3 +768,32 @@ TEST_F(EWK2UnitTestBase, ewk_view_scale)
     ASSERT_TRUE(loadUrlSync(environment->defaultTestPageUrl()));
     ASSERT_FLOAT_EQ(1, ewk_view_scale_get(webView()));
 }
+
+TEST_F(EWK2UnitTestBase, ewk_view_pagination)
+{
+    ASSERT_TRUE(loadUrlSync(environment->defaultTestPageUrl()));
+
+    // Default pagination value is EWK_PAGINATION_MODE_UNPAGINATED
+    ASSERT_EQ(EWK_PAGINATION_MODE_UNPAGINATED, ewk_view_pagination_mode_get(webView()));
+
+    ASSERT_TRUE(ewk_view_pagination_mode_set(webView(), EWK_PAGINATION_MODE_LEFT_TO_RIGHT));
+    // Reload page to check the pagination mode.
+    ASSERT_TRUE(loadUrlSync(environment->defaultTestPageUrl()));
+    ASSERT_EQ(EWK_PAGINATION_MODE_LEFT_TO_RIGHT, ewk_view_pagination_mode_get(webView()));
+
+    ASSERT_TRUE(ewk_view_pagination_mode_set(webView(), EWK_PAGINATION_MODE_RIGHT_TO_LEFT));
+    ASSERT_TRUE(loadUrlSync(environment->defaultTestPageUrl()));
+    ASSERT_EQ(EWK_PAGINATION_MODE_RIGHT_TO_LEFT, ewk_view_pagination_mode_get(webView()));
+
+    ASSERT_TRUE(ewk_view_pagination_mode_set(webView(), EWK_PAGINATION_MODE_TOP_TO_BOTTOM));
+    ASSERT_TRUE(loadUrlSync(environment->defaultTestPageUrl()));
+    ASSERT_EQ(EWK_PAGINATION_MODE_TOP_TO_BOTTOM, ewk_view_pagination_mode_get(webView()));
+
+    ASSERT_TRUE(ewk_view_pagination_mode_set(webView(),  EWK_PAGINATION_MODE_BOTTOM_TO_TOP));
+    ASSERT_TRUE(loadUrlSync(environment->defaultTestPageUrl()));
+    ASSERT_EQ(EWK_PAGINATION_MODE_BOTTOM_TO_TOP, ewk_view_pagination_mode_get(webView()));
+
+    ASSERT_TRUE(ewk_view_pagination_mode_set(webView(), EWK_PAGINATION_MODE_UNPAGINATED));
+    ASSERT_TRUE(loadUrlSync(environment->defaultTestPageUrl()));
+    ASSERT_EQ(EWK_PAGINATION_MODE_UNPAGINATED, ewk_view_pagination_mode_get(webView()));
+}
diff --git a/Source/WebKit2/UIProcess/API/gtk/PageClientImpl.cpp b/Source/WebKit2/UIProcess/API/gtk/PageClientImpl.cpp
index d42b8b703..248d07284 100644
--- a/Source/WebKit2/UIProcess/API/gtk/PageClientImpl.cpp
+++ b/Source/WebKit2/UIProcess/API/gtk/PageClientImpl.cpp
@@ -306,4 +306,9 @@ void PageClientImpl::startDrag(const WebCore::DragData& dragData, PassRefPtr<Sha
     webkitWebViewBaseStartDrag(WEBKIT_WEB_VIEW_BASE(m_viewWidget), dragData, dragImage);
 }
 
+void PageClientImpl::handleDownloadRequest(DownloadProxy* download)
+{
+    webkitWebViewBaseHandleDownloadRequest(WEBKIT_WEB_VIEW_BASE(m_viewWidget), download);
+}
+
 } // namespace WebKit
diff --git a/Source/WebKit2/UIProcess/API/gtk/PageClientImpl.h b/Source/WebKit2/UIProcess/API/gtk/PageClientImpl.h
index f4afd06d9..d9b34c52b 100644
--- a/Source/WebKit2/UIProcess/API/gtk/PageClientImpl.h
+++ b/Source/WebKit2/UIProcess/API/gtk/PageClientImpl.h
@@ -103,6 +103,8 @@ private:
     virtual double customRepresentationZoomFactor();
     virtual void setCustomRepresentationZoomFactor(double);
 
+    virtual void handleDownloadRequest(DownloadProxy*);
+
     // Members of PageClientImpl class
     GtkWidget* m_viewWidget;
     WebCore::KeyBindingTranslator m_keyBindingTranslator;
diff --git a/Source/WebKit2/UIProcess/API/gtk/WebKitBackForwardList.cpp b/Source/WebKit2/UIProcess/API/gtk/WebKitBackForwardList.cpp
index 602d37999..56eae4437 100644
--- a/Source/WebKit2/UIProcess/API/gtk/WebKitBackForwardList.cpp
+++ b/Source/WebKit2/UIProcess/API/gtk/WebKitBackForwardList.cpp
@@ -248,7 +248,7 @@ guint webkit_back_forward_list_get_length(WebKitBackForwardList* backForwardList
  * webkit_back_forward_list_get_back_list:
  * @back_forward_list: a #WebKitBackForwardList
  *
- * Returns: (element-type WebKit.BackForwardListItem) (transfer container): a #GList of
+ * Returns: (element-type WebKit2.BackForwardListItem) (transfer container): a #GList of
  *    items preceding the current item.
  */
 GList* webkit_back_forward_list_get_back_list(WebKitBackForwardList* backForwardList)
@@ -263,7 +263,7 @@ GList* webkit_back_forward_list_get_back_list(WebKitBackForwardList* backForward
  * @back_forward_list: a #WebKitBackForwardList
  * @limit: the number of items to retrieve
  *
- * Returns: (element-type WebKit.BackForwardListItem) (transfer container): a #GList of
+ * Returns: (element-type WebKit2.BackForwardListItem) (transfer container): a #GList of
  *    items preceding the current item limited by @limit.
  */
 GList* webkit_back_forward_list_get_back_list_with_limit(WebKitBackForwardList* backForwardList, guint limit)
@@ -278,7 +278,7 @@ GList* webkit_back_forward_list_get_back_list_with_limit(WebKitBackForwardList*
  * webkit_back_forward_list_get_forward_list:
  * @back_forward_list: a #WebKitBackForwardList
  *
- * Returns: (element-type WebKit.BackForwardListItem) (transfer container): a #GList of
+ * Returns: (element-type WebKit2.BackForwardListItem) (transfer container): a #GList of
  *    items following the current item.
  */
 GList* webkit_back_forward_list_get_forward_list(WebKitBackForwardList* backForwardList)
@@ -293,7 +293,7 @@ GList* webkit_back_forward_list_get_forward_list(WebKitBackForwardList* backForw
  * @back_forward_list: a #WebKitBackForwardList
  * @limit: the number of items to retrieve
  *
- * Returns: (element-type WebKit.BackForwardListItem) (transfer container): a #GList of
+ * Returns: (element-type WebKit2.BackForwardListItem) (transfer container): a #GList of
  *    items following the current item limited by @limit.
  */
 GList* webkit_back_forward_list_get_forward_list_with_limit(WebKitBackForwardList* backForwardList, guint limit)
diff --git a/Source/WebKit2/UIProcess/API/gtk/WebKitDownload.cpp b/Source/WebKit2/UIProcess/API/gtk/WebKitDownload.cpp
index cc3b51f52..a6754de06 100644
--- a/Source/WebKit2/UIProcess/API/gtk/WebKitDownload.cpp
+++ b/Source/WebKit2/UIProcess/API/gtk/WebKitDownload.cpp
@@ -57,6 +57,7 @@ struct _WebKitDownloadPrivate {
 
     GRefPtr<WebKitURIRequest> request;
     GRefPtr<WebKitURIResponse> response;
+    WebKitWebView* webView;
     CString destinationURI;
     guint64 currentSize;
     bool isCancelled;
@@ -71,7 +72,10 @@ G_DEFINE_TYPE(WebKitDownload, webkit_download, G_TYPE_OBJECT)
 
 static void webkitDownloadFinalize(GObject* object)
 {
-    WEBKIT_DOWNLOAD(object)->priv->~WebKitDownloadPrivate();
+    WebKitDownloadPrivate* priv = WEBKIT_DOWNLOAD(object)->priv;
+    if (priv->webView)
+        g_object_remove_weak_pointer(G_OBJECT(priv->webView), reinterpret_cast<void**>(&priv->webView));
+    priv->~WebKitDownloadPrivate();
     G_OBJECT_CLASS(webkit_download_parent_class)->finalize(object);
 }
 
@@ -278,6 +282,12 @@ void webkitDownloadSetResponse(WebKitDownload* download, WebKitURIResponse* resp
     g_object_notify(G_OBJECT(download), "response");
 }
 
+void webkitDownloadSetWebView(WebKitDownload* download, WebKitWebView* webView)
+{
+    download->priv->webView = webView;
+    g_object_add_weak_pointer(G_OBJECT(webView), reinterpret_cast<void**>(&download->priv->webView));
+}
+
 bool webkitDownloadIsCancelled(WebKitDownload* download)
 {
     return download->priv->isCancelled;
@@ -530,3 +540,19 @@ guint64 webkit_download_get_received_data_length(WebKitDownload* download)
 
     return download->priv->currentSize;
 }
+
+/**
+ * webkit_download_get_web_view:
+ * @download: a #WebKitDownload
+ *
+ * Get the #WebKitWebView that initiated the download.
+ *
+ * Returns: (transfer none): the #WebKitWebView that initiated @download,
+ *    or %NULL if @download was not initiated by a #WebKitWebView.
+ */
+WebKitWebView* webkit_download_get_web_view(WebKitDownload* download)
+{
+    g_return_val_if_fail(WEBKIT_IS_DOWNLOAD(download), 0);
+
+    return download->priv->webView;
+}
diff --git a/Source/WebKit2/UIProcess/API/gtk/WebKitDownload.h b/Source/WebKit2/UIProcess/API/gtk/WebKitDownload.h
index a02aa57fd..448bebf6b 100644
--- a/Source/WebKit2/UIProcess/API/gtk/WebKitDownload.h
+++ b/Source/WebKit2/UIProcess/API/gtk/WebKitDownload.h
@@ -81,7 +81,10 @@ WEBKIT_API gdouble
 webkit_download_get_elapsed_time         (WebKitDownload *download);
 
 WEBKIT_API guint64
-webkit_download_get_received_data_length (WebKitDownload* download);
+webkit_download_get_received_data_length (WebKitDownload *download);
+
+WEBKIT_API WebKitWebView *
+webkit_download_get_web_view             (WebKitDownload *download);
 
 G_END_DECLS
 
diff --git a/Source/WebKit2/UIProcess/API/gtk/WebKitDownloadPrivate.h b/Source/WebKit2/UIProcess/API/gtk/WebKitDownloadPrivate.h
index 215f565d5..d7b43050c 100644
--- a/Source/WebKit2/UIProcess/API/gtk/WebKitDownloadPrivate.h
+++ b/Source/WebKit2/UIProcess/API/gtk/WebKitDownloadPrivate.h
@@ -28,6 +28,7 @@
 WebKitDownload* webkitDownloadCreate(WebKit::DownloadProxy*);
 bool webkitDownloadIsCancelled(WebKitDownload*);
 void webkitDownloadSetResponse(WebKitDownload*, WebKitURIResponse*);
+void webkitDownloadSetWebView(WebKitDownload*, WebKitWebView*);
 void webkitDownloadNotifyProgress(WebKitDownload*, guint64 bytesReceived);
 void webkitDownloadFailed(WebKitDownload*, const WebCore::ResourceError&);
 void webkitDownloadCancelled(WebKitDownload*);
diff --git a/Source/WebKit2/UIProcess/API/gtk/WebKitWebContext.cpp b/Source/WebKit2/UIProcess/API/gtk/WebKitWebContext.cpp
index ca60a5dc2..7707c70ab 100644
--- a/Source/WebKit2/UIProcess/API/gtk/WebKitWebContext.cpp
+++ b/Source/WebKit2/UIProcess/API/gtk/WebKitWebContext.cpp
@@ -179,7 +179,7 @@ static gpointer createDefaultWebContext(gpointer)
  *
  * Gets the default web context
  *
- * Returns: (transfer none) a #WebKitWebContext
+ * Returns: (transfer none): a #WebKitWebContext
  */
 WebKitWebContext* webkit_web_context_get_default(void)
 {
@@ -290,7 +290,10 @@ static DownloadsMap& downloadsMap()
  * @context: a #WebKitWebContext
  * @uri: the URI to download
  *
- * Requests downloading of the specified URI string.
+ * Requests downloading of the specified URI string. The download operation
+ * will not be associated to any #WebKitWebView, if you are interested in
+ * starting a download from a particular #WebKitWebView use
+ * webkit_web_view_download_uri() instead.
  *
  * Returns: (transfer full): a new #WebKitDownload representing the
  *    the download operation.
@@ -300,10 +303,7 @@ WebKitDownload* webkit_web_context_download_uri(WebKitWebContext* context, const
     g_return_val_if_fail(WEBKIT_IS_WEB_CONTEXT(context), 0);
     g_return_val_if_fail(uri, 0);
 
-    DownloadProxy* downloadProxy = context->priv->context->download(0, WebCore::ResourceRequest(String::fromUTF8(uri)));
-    WebKitDownload* download = webkitDownloadCreate(downloadProxy);
-    downloadsMap().set(downloadProxy, download);
-    return download;
+    return webkitWebContextStartDownload(context, uri, 0);
 }
 
 /**
@@ -695,6 +695,14 @@ WebKitDownload* webkitWebContextGetOrCreateDownload(DownloadProxy* downloadProxy
     return download.get();
 }
 
+WebKitDownload* webkitWebContextStartDownload(WebKitWebContext* context, const char* uri, WebPageProxy* initiatingPage)
+{
+    DownloadProxy* downloadProxy = context->priv->context->download(initiatingPage, WebCore::ResourceRequest(String::fromUTF8(uri)));
+    WebKitDownload* download = webkitDownloadCreate(downloadProxy);
+    downloadsMap().set(downloadProxy, download);
+    return download;
+}
+
 void webkitWebContextRemoveDownload(DownloadProxy* downloadProxy)
 {
     downloadsMap().remove(downloadProxy);
diff --git a/Source/WebKit2/UIProcess/API/gtk/WebKitWebContextPrivate.h b/Source/WebKit2/UIProcess/API/gtk/WebKitWebContextPrivate.h
index ace23df4f..f97e167ed 100644
--- a/Source/WebKit2/UIProcess/API/gtk/WebKitWebContextPrivate.h
+++ b/Source/WebKit2/UIProcess/API/gtk/WebKitWebContextPrivate.h
@@ -35,6 +35,7 @@
 
 WebKit::WebContext* webkitWebContextGetContext(WebKitWebContext*);
 WebKitDownload* webkitWebContextGetOrCreateDownload(WebKit::DownloadProxy*);
+WebKitDownload* webkitWebContextStartDownload(WebKitWebContext*, const char* uri, WebKit::WebPageProxy*);
 void webkitWebContextRemoveDownload(WebKit::DownloadProxy*);
 void webkitWebContextDownloadStarted(WebKitWebContext*, WebKitDownload*);
 WebKit::WebSoupRequestManagerProxy* webkitWebContextGetRequestManager(WebKitWebContext*);
diff --git a/Source/WebKit2/UIProcess/API/gtk/WebKitWebView.cpp b/Source/WebKit2/UIProcess/API/gtk/WebKitWebView.cpp
index de0f28dce..506f11a55 100644
--- a/Source/WebKit2/UIProcess/API/gtk/WebKitWebView.cpp
+++ b/Source/WebKit2/UIProcess/API/gtk/WebKitWebView.cpp
@@ -28,6 +28,7 @@
 #include "WebKitContextMenuClient.h"
 #include "WebKitContextMenuItemPrivate.h"
 #include "WebKitContextMenuPrivate.h"
+#include "WebKitDownloadPrivate.h"
 #include "WebKitEnumTypes.h"
 #include "WebKitError.h"
 #include "WebKitFaviconDatabasePrivate.h"
@@ -390,6 +391,12 @@ static gboolean webkitWebViewRunFileChooser(WebKitWebView* webView, WebKitFileCh
     return TRUE;
 }
 
+static void webkitWebViewHandleDownloadRequest(WebKitWebViewBase* webViewBase, DownloadProxy* downloadProxy)
+{
+    GRefPtr<WebKitDownload> download = webkitWebContextGetOrCreateDownload(downloadProxy);
+    webkitDownloadSetWebView(download.get(), WEBKIT_WEB_VIEW(webViewBase));
+}
+
 static void webkitWebViewConstructed(GObject* object)
 {
     if (G_OBJECT_CLASS(webkit_web_view_parent_class)->constructed)
@@ -400,6 +407,7 @@ static void webkitWebViewConstructed(GObject* object)
     WebKitWebViewBase* webViewBase = WEBKIT_WEB_VIEW_BASE(webView);
 
     webkitWebViewBaseCreateWebPage(webViewBase, webkitWebContextGetContext(priv->context), 0);
+    webkitWebViewBaseSetDownloadRequestHandler(webViewBase, webkitWebViewHandleDownloadRequest);
 
     attachLoaderClientToView(webView);
     attachUIClientToView(webView);
@@ -2758,3 +2766,24 @@ gboolean webkit_web_view_save_to_file_finish(WebKitWebView* webView, GAsyncResul
 
     return TRUE;
 }
+
+/**
+ * webkit_web_view_download_uri:
+ * @web_view: a #WebKitWebView
+ * @uri: the URI to download
+ *
+ * Requests downloading of the specified URI string for @web_view.
+ *
+ * Returns: (transfer full): a new #WebKitDownload representing the
+ *    the download operation.
+ */
+WebKitDownload* webkit_web_view_download_uri(WebKitWebView* webView, const char* uri)
+{
+    g_return_val_if_fail(WEBKIT_IS_WEB_VIEW(webView), 0);
+    g_return_val_if_fail(uri, 0);
+
+    WebKitDownload* download = webkitWebContextStartDownload(webView->priv->context, uri, getPage(webView));
+    webkitDownloadSetWebView(download, webView);
+
+    return download;
+}
diff --git a/Source/WebKit2/UIProcess/API/gtk/WebKitWebView.h b/Source/WebKit2/UIProcess/API/gtk/WebKitWebView.h
index ac2e2813f..7c8381329 100644
--- a/Source/WebKit2/UIProcess/API/gtk/WebKitWebView.h
+++ b/Source/WebKit2/UIProcess/API/gtk/WebKitWebView.h
@@ -371,6 +371,10 @@ webkit_web_view_save_to_file_finish                  (WebKitWebView
                                                       GAsyncResult              *result,
                                                       GError                   **error);
 
+WEBKIT_API WebKitDownload *
+webkit_web_view_download_uri                         (WebKitWebView             *web_view,
+                                                      const char                *uri);
+
 G_END_DECLS
 
 #endif
diff --git a/Source/WebKit2/UIProcess/API/gtk/WebKitWebViewBase.cpp b/Source/WebKit2/UIProcess/API/gtk/WebKitWebViewBase.cpp
index e5bac671e..015f668cd 100644
--- a/Source/WebKit2/UIProcess/API/gtk/WebKitWebViewBase.cpp
+++ b/Source/WebKit2/UIProcess/API/gtk/WebKitWebViewBase.cpp
@@ -108,6 +108,8 @@ struct _WebKitWebViewBasePrivate {
     bool isFocused : 1;
     bool isVisible : 1;
 
+    WebKitWebViewBaseDownloadRequestHandler downloadHandler;
+
 #if ENABLE(FULLSCREEN_API)
     bool fullScreenModeActive;
     WebFullScreenClientGtk fullScreenClient;
@@ -978,3 +980,14 @@ bool webkitWebViewBaseIsInWindow(WebKitWebViewBase* webViewBase)
 {
     return webViewBase->priv->toplevelOnScreenWindow;
 }
+
+void webkitWebViewBaseSetDownloadRequestHandler(WebKitWebViewBase* webViewBase, WebKitWebViewBaseDownloadRequestHandler downloadHandler)
+{
+    webViewBase->priv->downloadHandler = downloadHandler;
+}
+
+void webkitWebViewBaseHandleDownloadRequest(WebKitWebViewBase* webViewBase, DownloadProxy* download)
+{
+    if (webViewBase->priv->downloadHandler)
+        webViewBase->priv->downloadHandler(webViewBase, download);
+}
diff --git a/Source/WebKit2/UIProcess/API/gtk/WebKitWebViewBasePrivate.h b/Source/WebKit2/UIProcess/API/gtk/WebKitWebViewBasePrivate.h
index ddb3e1451..ef05f2289 100644
--- a/Source/WebKit2/UIProcess/API/gtk/WebKitWebViewBasePrivate.h
+++ b/Source/WebKit2/UIProcess/API/gtk/WebKitWebViewBasePrivate.h
@@ -60,4 +60,8 @@ bool webkitWebViewBaseIsFocused(WebKitWebViewBase*);
 bool webkitWebViewBaseIsVisible(WebKitWebViewBase*);
 bool webkitWebViewBaseIsInWindow(WebKitWebViewBase*);
 
+typedef void (*WebKitWebViewBaseDownloadRequestHandler) (WebKitWebViewBase*, WebKit::DownloadProxy*);
+void webkitWebViewBaseSetDownloadRequestHandler(WebKitWebViewBase*, WebKitWebViewBaseDownloadRequestHandler);
+void webkitWebViewBaseHandleDownloadRequest(WebKitWebViewBase*, WebKit::DownloadProxy*);
+
 #endif // WebKitWebViewBasePrivate_h
diff --git a/Source/WebKit2/UIProcess/API/gtk/docs/webkit2gtk-sections.txt b/Source/WebKit2/UIProcess/API/gtk/docs/webkit2gtk-sections.txt
index f56267b9a..2f6f54b0d 100644
--- a/Source/WebKit2/UIProcess/API/gtk/docs/webkit2gtk-sections.txt
+++ b/Source/WebKit2/UIProcess/API/gtk/docs/webkit2gtk-sections.txt
@@ -122,6 +122,7 @@ webkit_web_view_save
 webkit_web_view_save_finish
 webkit_web_view_save_to_file
 webkit_web_view_save_to_file_finish
+webkit_web_view_download_uri
 
 <SUBSECTION WebKitJavascriptResult>
 WebKitJavascriptResult
@@ -395,6 +396,7 @@ webkit_download_cancel
 webkit_download_get_estimated_progress
 webkit_download_get_elapsed_time
 webkit_download_get_received_data_length
+webkit_download_get_web_view
 
 <SUBSECTION Standard>
 WebKitDownloadClass
diff --git a/Source/WebKit2/UIProcess/API/gtk/tests/GNUmakefile.am b/Source/WebKit2/UIProcess/API/gtk/tests/GNUmakefile.am
index 734024250..1db90a628 100644
--- a/Source/WebKit2/UIProcess/API/gtk/tests/GNUmakefile.am
+++ b/Source/WebKit2/UIProcess/API/gtk/tests/GNUmakefile.am
@@ -58,11 +58,11 @@ webkit2_tests_ldflags = \
 	-no-install \
 	-no-fast-install
 
-DerivedSources/WebKit2/webkit2gtk-tests-resources.gresource: Source/WebKit2/UIProcess/API/gtk/tests/resources/webkit2gtk-tests.gresource.xml $(shell $(GLIB_COMPILE_RESOURCES) --sourcedir=$(srcdir) --generate-dependencies $(srcdir)/Source/WebKit2/UIProcess/API/gtk/tests/resources/webkit2gtk-tests.gresource.xml)
+Programs/resources/webkit2gtk-tests-resources.gresource: Source/WebKit2/UIProcess/API/gtk/tests/resources/webkit2gtk-tests.gresource.xml $(shell $(GLIB_COMPILE_RESOURCES) --sourcedir=$(srcdir) --generate-dependencies $(srcdir)/Source/WebKit2/UIProcess/API/gtk/tests/resources/webkit2gtk-tests.gresource.xml)
 	$(AM_V_GEN) $(GLIB_COMPILE_RESOURCES) --target=$@ --sourcedir=$(srcdir) $<
 
-DISTCLEANFILES += DerivedSources/WebKit2/webkit2gtk-tests-resources.gresource
-noinst_DATA += DerivedSources/WebKit2/webkit2gtk-tests-resources.gresource
+DISTCLEANFILES += Programs/resources/webkit2gtk-tests-resources.gresource
+noinst_DATA += Programs/resources/webkit2gtk-tests-resources.gresource
 
 noinst_LTLIBRARIES += Libraries/libWebKit2APITestCore.la
 Libraries_libWebKit2APITestCore_la_SOURCES = \
diff --git a/Source/WebKit2/UIProcess/API/gtk/tests/TestDownloads.cpp b/Source/WebKit2/UIProcess/API/gtk/tests/TestDownloads.cpp
index 9c3262b53..56a62cd09 100644
--- a/Source/WebKit2/UIProcess/API/gtk/tests/TestDownloads.cpp
+++ b/Source/WebKit2/UIProcess/API/gtk/tests/TestDownloads.cpp
@@ -19,8 +19,8 @@
 
 #include "config.h"
 
-#include "TestMain.h"
 #include "WebKitTestServer.h"
+#include "WebViewTest.h"
 #include <glib/gstdio.h>
 #include <gtk/gtk.h>
 #include <libsoup/soup.h>
@@ -184,6 +184,7 @@ static void testDownloadLocalFile(DownloadTest* test, gconstpointer)
     GRefPtr<WebKitDownload> download = adoptGRef(webkit_web_context_download_uri(test->m_webContext, sourceURI.get()));
     test->assertObjectIsDeletedWhenTestFinishes(G_OBJECT(download.get()));
     test->waitUntilDownloadFinishes();
+    g_assert(!webkit_download_get_web_view(download.get()));
 
     Vector<DownloadTest::DownloadEvent>& events = test->m_downloadEvents;
     g_assert_cmpint(events.size(), ==, 5);
@@ -248,6 +249,7 @@ static void testDownloadLocalFileError(DownloadErrorTest* test, gconstpointer)
     GRefPtr<WebKitDownload> download = adoptGRef(webkit_web_context_download_uri(test->m_webContext, "file:///foo/bar"));
     test->assertObjectIsDeletedWhenTestFinishes(G_OBJECT(download.get()));
     test->waitUntilDownloadFinishes();
+    g_assert(!webkit_download_get_web_view(download.get()));
 
     Vector<DownloadTest::DownloadEvent>& events = test->m_downloadEvents;
     g_assert_cmpint(events.size(), ==, 3);
@@ -264,6 +266,7 @@ static void testDownloadLocalFileError(DownloadErrorTest* test, gconstpointer)
     download = adoptGRef(webkit_web_context_download_uri(test->m_webContext, uri.get()));
     test->assertObjectIsDeletedWhenTestFinishes(G_OBJECT(download.get()));
     test->waitUntilDownloadFinishes();
+    g_assert(!webkit_download_get_web_view(download.get()));
 
     events = test->m_downloadEvents;
     g_assert_cmpint(events.size(), ==, 4);
@@ -279,6 +282,7 @@ static void testDownloadLocalFileError(DownloadErrorTest* test, gconstpointer)
     download = adoptGRef(webkit_web_context_download_uri(test->m_webContext, uri.get()));
     test->assertObjectIsDeletedWhenTestFinishes(G_OBJECT(download.get()));
     test->waitUntilDownloadFinishes();
+    g_assert(!webkit_download_get_web_view(download.get()));
 
     events = test->m_downloadEvents;
     g_assert_cmpint(events.size(), ==, 4);
@@ -324,6 +328,7 @@ static void testDownloadRemoteFile(DownloadTest* test, gconstpointer)
     GRefPtr<WebKitDownload> download = adoptGRef(webkit_web_context_download_uri(test->m_webContext, kServer->getURIForPath("/test.pdf").data()));
     test->assertObjectIsDeletedWhenTestFinishes(G_OBJECT(download.get()));
     test->waitUntilDownloadFinishes();
+    g_assert(!webkit_download_get_web_view(download.get()));
 
     Vector<DownloadTest::DownloadEvent>& events = test->m_downloadEvents;
     g_assert_cmpint(events.size(), ==, 5);
@@ -351,6 +356,7 @@ static void testDownloadRemoteFileError(DownloadErrorTest* test, gconstpointer)
                                                                                  kServer->getURIForPath("/foo").data()));
     test->assertObjectIsDeletedWhenTestFinishes(G_OBJECT(download.get()));
     test->waitUntilDownloadFinishes();
+    g_assert(!webkit_download_get_web_view(download.get()));
 
     Vector<DownloadTest::DownloadEvent>& events = test->m_downloadEvents;
     g_assert_cmpint(events.size(), ==, 4);
@@ -367,6 +373,7 @@ static void testDownloadRemoteFileError(DownloadErrorTest* test, gconstpointer)
     download = adoptGRef(webkit_web_context_download_uri(test->m_webContext, kServer->getURIForPath("/test.pdf").data()));
     test->assertObjectIsDeletedWhenTestFinishes(G_OBJECT(download.get()));
     test->waitUntilDownloadFinishes();
+    g_assert(!webkit_download_get_web_view(download.get()));
 
     events = test->m_downloadEvents;
     g_assert_cmpint(events.size(), ==, 4);
@@ -382,6 +389,7 @@ static void testDownloadRemoteFileError(DownloadErrorTest* test, gconstpointer)
     download = adoptGRef(webkit_web_context_download_uri(test->m_webContext, kServer->getURIForPath("/test.pdf").data()));
     test->assertObjectIsDeletedWhenTestFinishes(G_OBJECT(download.get()));
     test->waitUntilDownloadFinishes();
+    g_assert(!webkit_download_get_web_view(download.get()));
 
     events = test->m_downloadEvents;
     g_assert_cmpint(events.size(), ==, 4);
@@ -394,6 +402,110 @@ static void testDownloadRemoteFileError(DownloadErrorTest* test, gconstpointer)
     test->checkDestinationAndDeleteFile(download.get(), kServerSuggestedFilename);
 }
 
+class WebViewDownloadTest: public WebViewTest {
+public:
+    MAKE_GLIB_TEST_FIXTURE(WebViewDownloadTest);
+
+    static void downloadStartedCallback(WebKitWebContext* context, WebKitDownload* download, WebViewDownloadTest* test)
+    {
+        test->m_download = download;
+        test->assertObjectIsDeletedWhenTestFinishes(G_OBJECT(download));
+        test->quitMainLoop();
+    }
+
+    WebViewDownloadTest()
+    {
+        g_signal_connect(webkit_web_view_get_context(m_webView), "download-started", G_CALLBACK(downloadStartedCallback), this);
+    }
+
+    ~WebViewDownloadTest()
+    {
+        g_signal_handlers_disconnect_matched(webkit_web_view_get_context(m_webView), G_SIGNAL_MATCH_DATA, 0, 0, 0, 0, this);
+    }
+
+    void waitUntilDownloadStarted()
+    {
+        m_download = 0;
+        g_main_loop_run(m_mainLoop);
+        g_assert(m_download.get());
+    }
+
+    static gboolean downloadDecideDestinationCallback(WebKitDownload* download, const gchar* suggestedFilename, WebViewDownloadTest* test)
+    {
+        GOwnPtr<char> destination(g_build_filename(kTempDirectory, suggestedFilename, NULL));
+        GOwnPtr<char> destinationURI(g_filename_to_uri(destination.get(), 0, 0));
+        webkit_download_set_destination(download, destinationURI.get());
+        return TRUE;
+    }
+
+    static void downloadFinishedCallback(WebKitDownload* download, WebViewDownloadTest* test)
+    {
+        test->quitMainLoop();
+    }
+
+    void waitUntilDownloadFinished()
+    {
+        g_signal_connect(m_download.get(), "decide-destination", G_CALLBACK(downloadDecideDestinationCallback), this);
+        g_signal_connect(m_download.get(), "finished", G_CALLBACK(downloadFinishedCallback), this);
+        g_main_loop_run(m_mainLoop);
+    }
+
+    GRefPtr<WebKitDownload> m_download;
+};
+
+static void testWebViewDownloadURI(WebViewDownloadTest* test, gconstpointer)
+{
+    GRefPtr<WebKitDownload> download = adoptGRef(webkit_web_view_download_uri(test->m_webView, kServer->getURIForPath("/test.pdf").data()));
+    test->waitUntilDownloadStarted();
+    g_assert(test->m_webView == webkit_download_get_web_view(download.get()));
+    test->waitUntilDownloadFinished();
+
+    GRefPtr<GFile> downloadFile = adoptGRef(g_file_new_for_uri(webkit_download_get_destination(download.get())));
+    GRefPtr<GFileInfo> downloadFileInfo = adoptGRef(g_file_query_info(downloadFile.get(), G_FILE_ATTRIBUTE_STANDARD_SIZE, static_cast<GFileQueryInfoFlags>(0), 0, 0));
+    g_assert_cmpint(g_file_info_get_size(downloadFileInfo.get()), >, 0);
+    g_file_delete(downloadFile.get(), 0, 0);
+}
+
+class PolicyResponseDownloadTest: public WebViewDownloadTest {
+public:
+    MAKE_GLIB_TEST_FIXTURE(PolicyResponseDownloadTest);
+
+    static gboolean decidePolicyCallback(WebKitWebView* webView, WebKitPolicyDecision* decision, WebKitPolicyDecisionType type, PolicyResponseDownloadTest* test)
+    {
+        if (type != WEBKIT_POLICY_DECISION_TYPE_RESPONSE)
+            return FALSE;
+
+        webkit_policy_decision_download(decision);
+        return TRUE;
+    }
+
+    PolicyResponseDownloadTest()
+    {
+        g_signal_connect(m_webView, "decide-policy", G_CALLBACK(decidePolicyCallback), this);
+    }
+
+    ~PolicyResponseDownloadTest()
+    {
+        g_signal_handlers_disconnect_matched(m_webView, G_SIGNAL_MATCH_DATA, 0, 0, 0, 0, this);
+    }
+
+    void cancelDownloadAndWaitUntilFinished()
+    {
+        webkit_download_cancel(m_download.get());
+        waitUntilDownloadFinished();
+        m_download = 0;
+    }
+};
+
+static void testPolicyResponseDownload(PolicyResponseDownloadTest* test, gconstpointer)
+{
+    // Test that a download started by the the policy checker contains the web view.
+    test->loadURI(kServer->getURIForPath("/test.pdf").data());
+    test->waitUntilDownloadStarted();
+    g_assert(test->m_webView == webkit_download_get_web_view(test->m_download.get()));
+    test->cancelDownloadAndWaitUntilFinished();
+}
+
 void beforeAll()
 {
     kServer = new WebKitTestServer();
@@ -406,6 +518,8 @@ void beforeAll()
     DownloadErrorTest::add("Downloads", "local-file-error", testDownloadLocalFileError);
     DownloadTest::add("Downloads", "remote-file", testDownloadRemoteFile);
     DownloadErrorTest::add("Downloads", "remote-file-error", testDownloadRemoteFileError);
+    WebViewDownloadTest::add("WebKitWebView", "download-uri", testWebViewDownloadURI);
+    PolicyResponseDownloadTest::add("Downloads", "policy-decision-download", testPolicyResponseDownload);
 }
 
 void afterAll()
diff --git a/Source/WebKit2/UIProcess/API/gtk/tests/TestMain.cpp b/Source/WebKit2/UIProcess/API/gtk/tests/TestMain.cpp
index 9db47f82b..2044ab52e 100644
--- a/Source/WebKit2/UIProcess/API/gtk/tests/TestMain.cpp
+++ b/Source/WebKit2/UIProcess/API/gtk/tests/TestMain.cpp
@@ -27,7 +27,7 @@ void afterAll();
 
 static void registerGResource(void)
 {
-    GOwnPtr<char> resourcesPath(g_build_filename(WEBKIT_DERIVED_SRC_DIR, "WebKit2", "webkit2gtk-tests-resources.gresource", NULL));
+    GOwnPtr<char> resourcesPath(g_build_filename(WEBKIT_EXEC_PATH, "resources", "webkit2gtk-tests-resources.gresource", NULL));
     GResource* resource = g_resource_load(resourcesPath.get(), 0);
     g_assert(resource);
 
diff --git a/Source/WebKit2/UIProcess/API/mac/PageClientImpl.mm b/Source/WebKit2/UIProcess/API/mac/PageClientImpl.mm
index ba88107e1..7b54b4bd7 100644
--- a/Source/WebKit2/UIProcess/API/mac/PageClientImpl.mm
+++ b/Source/WebKit2/UIProcess/API/mac/PageClientImpl.mm
@@ -139,7 +139,7 @@ PageClientImpl::~PageClientImpl()
 
 PassOwnPtr<DrawingAreaProxy> PageClientImpl::createDrawingAreaProxy()
 {
-    return [m_wkView _wk_createDrawingAreaProxy];
+    return [m_wkView _createDrawingAreaProxy];
 }
 
 void PageClientImpl::setViewNeedsDisplay(const WebCore::IntRect& rect)
@@ -156,7 +156,7 @@ void PageClientImpl::scrollView(const IntRect& scrollRect, const IntSize& scroll
 {
     NSRect clippedScrollRect = NSIntersectionRect(scrollRect, NSOffsetRect(scrollRect, -scrollOffset.width(), -scrollOffset.height()));
 
-    [m_wkView _wk_cacheWindowBottomCornerRect];
+    [m_wkView _cacheWindowBottomCornerRect];
 
     [m_wkView translateRectsNeedingDisplayInRect:clippedScrollRect by:scrollOffset];
     [m_wkView scrollRect:clippedScrollRect by:scrollOffset];
@@ -174,7 +174,7 @@ bool PageClientImpl::isViewWindowActive()
 
 bool PageClientImpl::isViewFocused()
 {
-    return [m_wkView _wk_isFocused];
+    return [m_wkView _isFocused];
 }
 
 void PageClientImpl::makeFirstResponder()
@@ -220,17 +220,17 @@ LayerHostingMode PageClientImpl::viewLayerHostingMode()
 
 ColorSpaceData PageClientImpl::colorSpace()
 {
-    return [m_wkView _wk_colorSpace];
+    return [m_wkView _colorSpace];
 }
 
 void PageClientImpl::processDidCrash()
 {
-    [m_wkView _wk_processDidCrash];
+    [m_wkView _processDidCrash];
 }
 
 void PageClientImpl::pageClosed()
 {
-    [m_wkView _wk_pageClosed];
+    [m_wkView _pageClosed];
 #if USE(DICTATION_ALTERNATIVES)
     m_alternativeTextUIController->clear();
 #endif
@@ -238,18 +238,18 @@ void PageClientImpl::pageClosed()
 
 void PageClientImpl::didRelaunchProcess()
 {
-    [m_wkView _wk_didRelaunchProcess];
+    [m_wkView _didRelaunchProcess];
 }
 
 void PageClientImpl::toolTipChanged(const String& oldToolTip, const String& newToolTip)
 {
-    [m_wkView _wk_toolTipChangedFrom:nsStringFromWebCoreString(oldToolTip) to:nsStringFromWebCoreString(newToolTip)];
+    [m_wkView _toolTipChangedFrom:nsStringFromWebCoreString(oldToolTip) to:nsStringFromWebCoreString(newToolTip)];
 }
 
 void PageClientImpl::setCursor(const WebCore::Cursor& cursor)
 {
     if (![NSApp _cursorRectCursor])
-        [m_wkView _wk_setCursor:cursor.platformCursor()];
+        [m_wkView _setCursor:cursor.platformCursor()];
 }
 
 void PageClientImpl::setCursorHiddenUntilMouseMoves(bool hiddenUntilMouseMoves)
@@ -291,7 +291,7 @@ void PageClientImpl::executeUndoRedo(WebPageProxy::UndoOrRedo undoOrRedo)
 
 bool PageClientImpl::interpretKeyEvent(const NativeWebKeyboardEvent& event, Vector<WebCore::KeypressCommand>& commands)
 {
-    return [m_wkView _wk_interpretKeyEvent:event.nativeEvent() savingCommandsTo:commands];
+    return [m_wkView _interpretKeyEvent:event.nativeEvent() savingCommandsTo:commands];
 }
 
 void PageClientImpl::setDragImage(const IntPoint& clientPosition, PassRefPtr<ShareableBitmap> dragImage, bool isLinkDrag)
@@ -299,34 +299,34 @@ void PageClientImpl::setDragImage(const IntPoint& clientPosition, PassRefPtr<Sha
     RetainPtr<CGImageRef> dragCGImage = dragImage->makeCGImage();
     RetainPtr<NSImage> dragNSImage(AdoptNS, [[NSImage alloc] initWithCGImage:dragCGImage.get() size:dragImage->size()]);
 
-    [m_wkView _wk_setDragImage:dragNSImage.get() at:clientPosition linkDrag:isLinkDrag];
+    [m_wkView _setDragImage:dragNSImage.get() at:clientPosition linkDrag:isLinkDrag];
 }
 
 void PageClientImpl::setPromisedData(const String& pasteboardName, PassRefPtr<SharedBuffer> imageBuffer, const String& filename, const String& extension, const String& title, const String& url, const String& visibleUrl, PassRefPtr<SharedBuffer> archiveBuffer)
 {
     RefPtr<Image> image = BitmapImage::create();
     image->setData(imageBuffer.get(), true);
-    [m_wkView _wk_setPromisedData:image.get() withFileName:filename withExtension:extension withTitle:title withURL:url withVisibleURL:visibleUrl withArchive:archiveBuffer.get() forPasteboard:pasteboardName];
+    [m_wkView _setPromisedData:image.get() withFileName:filename withExtension:extension withTitle:title withURL:url withVisibleURL:visibleUrl withArchive:archiveBuffer.get() forPasteboard:pasteboardName];
 }
 
 void PageClientImpl::updateTextInputState(bool updateSecureInputState)
 {
-    [m_wkView _wk_updateTextInputStateIncludingSecureInputState:updateSecureInputState];
+    [m_wkView _updateTextInputStateIncludingSecureInputState:updateSecureInputState];
 }
 
 void PageClientImpl::resetTextInputState()
 {
-    [m_wkView _wk_resetTextInputState];
+    [m_wkView _resetTextInputState];
 }
 
 FloatRect PageClientImpl::convertToDeviceSpace(const FloatRect& rect)
 {
-    return [m_wkView _wk_convertToDeviceSpace:rect];
+    return [m_wkView _convertToDeviceSpace:rect];
 }
 
 FloatRect PageClientImpl::convertToUserSpace(const FloatRect& rect)
 {
-    return [m_wkView _wk_convertToUserSpace:rect];
+    return [m_wkView _convertToUserSpace:rect];
 }
    
 IntPoint PageClientImpl::screenToWindow(const IntPoint& point)
@@ -352,7 +352,7 @@ void PageClientImpl::doneWithGestureEvent(const WebGestureEvent&, bool wasEventH
 
 void PageClientImpl::doneWithKeyEvent(const NativeWebKeyboardEvent& event, bool eventWasHandled)
 {
-    [m_wkView _wk_doneWithKeyEvent:event.nativeEvent() eventWasHandled:eventWasHandled];
+    [m_wkView _doneWithKeyEvent:event.nativeEvent() eventWasHandled:eventWasHandled];
 }
 
 PassRefPtr<WebPopupMenuProxy> PageClientImpl::createPopupMenuProxy(WebPageProxy* page)
@@ -375,40 +375,40 @@ PassRefPtr<WebColorChooserProxy> PageClientImpl::createColorChooserProxy(WebPage
 
 void PageClientImpl::setFindIndicator(PassRefPtr<FindIndicator> findIndicator, bool fadeOut, bool animate)
 {
-    [m_wkView _wk_setFindIndicator:findIndicator fadeOut:fadeOut animate:animate];
+    [m_wkView _setFindIndicator:findIndicator fadeOut:fadeOut animate:animate];
 }
 
 void PageClientImpl::accessibilityWebProcessTokenReceived(const CoreIPC::DataReference& data)
 {
-    NSData *remoteToken = [NSData dataWithBytes:data.data() length:data.size()];
-    [m_wkView _wk_setAccessibilityWebProcessToken:remoteToken];
+    NSData* remoteToken = [NSData dataWithBytes:data.data() length:data.size()];
+    [m_wkView _setAccessibilityWebProcessToken:remoteToken];
 }
     
 #if USE(ACCELERATED_COMPOSITING)
 void PageClientImpl::enterAcceleratedCompositingMode(const LayerTreeContext& layerTreeContext)
 {
-    [m_wkView _wk_enterAcceleratedCompositingMode:layerTreeContext];
+    [m_wkView _enterAcceleratedCompositingMode:layerTreeContext];
 }
 
 void PageClientImpl::exitAcceleratedCompositingMode()
 {
-    [m_wkView _wk_exitAcceleratedCompositingMode];
+    [m_wkView _exitAcceleratedCompositingMode];
 }
 
 void PageClientImpl::updateAcceleratedCompositingMode(const LayerTreeContext& layerTreeContext)
 {
-    [m_wkView _wk_updateAcceleratedCompositingMode:layerTreeContext];
+    [m_wkView _updateAcceleratedCompositingMode:layerTreeContext];
 }
 #endif // USE(ACCELERATED_COMPOSITING)
 
 void PageClientImpl::pluginFocusOrWindowFocusChanged(uint64_t pluginComplexTextInputIdentifier, bool pluginHasFocusAndWindowHasFocus)
 {
-    [m_wkView _wk_pluginFocusOrWindowFocusChanged:pluginHasFocusAndWindowHasFocus pluginComplexTextInputIdentifier:pluginComplexTextInputIdentifier];
+    [m_wkView _pluginFocusOrWindowFocusChanged:pluginHasFocusAndWindowHasFocus pluginComplexTextInputIdentifier:pluginComplexTextInputIdentifier];
 }
 
 void PageClientImpl::setPluginComplexTextInputState(uint64_t pluginComplexTextInputIdentifier, PluginComplexTextInputState pluginComplexTextInputState)
 {
-    [m_wkView _wk_setPluginComplexTextInputState:pluginComplexTextInputState pluginComplexTextInputIdentifier:pluginComplexTextInputIdentifier];
+    [m_wkView _setPluginComplexTextInputState:pluginComplexTextInputState pluginComplexTextInputIdentifier:pluginComplexTextInputIdentifier];
 }
 
 CGContextRef PageClientImpl::containingWindowGraphicsContext()
@@ -424,37 +424,37 @@ CGContextRef PageClientImpl::containingWindowGraphicsContext()
 
 void PageClientImpl::didChangeScrollbarsForMainFrame() const
 {
-    [m_wkView _wk_didChangeScrollbarsForMainFrame];
+    [m_wkView _didChangeScrollbarsForMainFrame];
 }
 
 void PageClientImpl::didCommitLoadForMainFrame(bool useCustomRepresentation)
 {
-    [m_wkView _wk_setPageHasCustomRepresentation:useCustomRepresentation];
+    [m_wkView _setPageHasCustomRepresentation:useCustomRepresentation];
 }
 
 void PageClientImpl::didFinishLoadingDataForCustomRepresentation(const String& suggestedFilename, const CoreIPC::DataReference& dataReference)
 {
-    [m_wkView _wk_didFinishLoadingDataForCustomRepresentationWithSuggestedFilename:suggestedFilename dataReference:dataReference];
+    [m_wkView _didFinishLoadingDataForCustomRepresentationWithSuggestedFilename:suggestedFilename dataReference:dataReference];
 }
 
 double PageClientImpl::customRepresentationZoomFactor()
 {
-    return [m_wkView _wk_customRepresentationZoomFactor];
+    return [m_wkView _customRepresentationZoomFactor];
 }
 
 void PageClientImpl::setCustomRepresentationZoomFactor(double zoomFactor)
 {
-    [m_wkView _wk_setCustomRepresentationZoomFactor:zoomFactor];
+    [m_wkView _setCustomRepresentationZoomFactor:zoomFactor];
 }
 
 void PageClientImpl::findStringInCustomRepresentation(const String& string, FindOptions options, unsigned maxMatchCount)
 {
-    [m_wkView _wk_findStringInCustomRepresentation:string withFindOptions:options maxMatchCount:maxMatchCount];
+    [m_wkView _findStringInCustomRepresentation:string withFindOptions:options maxMatchCount:maxMatchCount];
 }
 
 void PageClientImpl::countStringMatchesInCustomRepresentation(const String& string, FindOptions options, unsigned maxMatchCount)
 {
-    [m_wkView _wk_countStringMatchesInCustomRepresentation:string withFindOptions:options maxMatchCount:maxMatchCount];
+    [m_wkView _countStringMatchesInCustomRepresentation:string withFindOptions:options maxMatchCount:maxMatchCount];
 }
 
 void PageClientImpl::flashBackingStoreUpdates(const Vector<IntRect>&)
@@ -555,11 +555,10 @@ void PageClientImpl::recommendedScrollbarStyleDidChange(int32_t newStyle)
 
 bool PageClientImpl::executeSavedCommandBySelector(const String& selectorString)
 {
-    return [m_wkView _wk_executeSavedCommandBySelector:NSSelectorFromString(selectorString)];
+    return [m_wkView _executeSavedCommandBySelector:NSSelectorFromString(selectorString)];
 }
 
 #if USE(DICTATION_ALTERNATIVES)
-
 uint64_t PageClientImpl::addDictationAlternatives(const RetainPtr<NSTextAlternatives>& alternatives)
 {
     return m_alternativeTextUIController->addAlternatives(alternatives);
@@ -575,7 +574,7 @@ void PageClientImpl::showDictationAlternativeUI(const WebCore::FloatRect& boundi
     if (!isViewVisible() || !isViewInWindow())
         return;
     m_alternativeTextUIController->showAlternatives(m_wkView, boundingBoxOfDictatedText, dictationContext, ^(NSString* acceptedAlternative){
-        [m_wkView _wk_handleAcceptedAlternativeText:acceptedAlternative];
+        [m_wkView handleAcceptedAlternativeText:acceptedAlternative];
     });
 }
 
@@ -588,7 +587,6 @@ void PageClientImpl::dismissDictationAlternativeUI()
 {
     m_alternativeTextUIController->dismissAlternatives();
 }
-
 #endif
 
 } // namespace WebKit
diff --git a/Source/WebKit2/UIProcess/API/mac/WKConnection.h b/Source/WebKit2/UIProcess/API/mac/WKConnection.h
index bf582b303..52bd85c66 100644
--- a/Source/WebKit2/UIProcess/API/mac/WKConnection.h
+++ b/Source/WebKit2/UIProcess/API/mac/WKConnection.h
@@ -41,6 +41,8 @@ WK_EXPORT
     WKConnectionData *_data;
 }
 
+- (void)sendMessageWithName:(NSString *)messageName body:(id)messageBody;
+
 #pragma mark Delegates
 
 @property(assign) id<WKConnectionDelegate> delegate;
diff --git a/Source/WebKit2/UIProcess/API/mac/WKConnection.mm b/Source/WebKit2/UIProcess/API/mac/WKConnection.mm
index 626ec85e6..8040a6781 100644
--- a/Source/WebKit2/UIProcess/API/mac/WKConnection.mm
+++ b/Source/WebKit2/UIProcess/API/mac/WKConnection.mm
@@ -27,11 +27,18 @@
 #import "WKConnection.h"
 #import "WKConnectionInternal.h"
 
+#import "ArgumentCodersMac.h"
+#import "ArgumentDecoder.h"
+#import "ArgumentEncoder.h"
 #import "WKConnectionRef.h"
+#import "WKData.h"
 #import "WKRetainPtr.h"
+#import "WKString.h"
 #import "WKStringCF.h"
 #import <wtf/RetainPtr.h>
 
+using namespace WebKit;
+
 @interface WKConnectionData : NSObject {
 @public
     // Underlying connection object.
@@ -55,6 +62,17 @@
     [super dealloc];
 }
 
+- (void)sendMessageWithName:(NSString *)messageName body:(id)messageBody
+{
+    OwnPtr<CoreIPC::ArgumentEncoder> messageData = CoreIPC::ArgumentEncoder::create();
+    encode(*messageData, messageBody);
+
+    WKRetainPtr<WKStringRef> wkMessageName = adoptWK(WKStringCreateWithCFString((CFStringRef)messageName));
+    WKRetainPtr<WKDataRef> wkMessageBody = adoptWK(WKDataCreate(messageData->buffer(), messageData->bufferSize()));
+
+    WKConnectionPostMessage(_data->_connectionRef.get(), wkMessageName.get(), wkMessageBody.get());
+}
+
 #pragma mark Delegates
 
 - (id<WKConnectionDelegate>)delegate
@@ -75,9 +93,17 @@ static void didReceiveMessage(WKConnectionRef, WKStringRef messageName, WKTypeRe
 {
     WKConnection *connection = (WKConnection *)clientInfo;
     if ([connection.delegate respondsToSelector:@selector(connection:didReceiveMessageWithName:body:)]) {
-        // FIXME: Add messageBody conversion.
         RetainPtr<CFStringRef> cfMessageName = adoptCF(WKStringCopyCFString(kCFAllocatorDefault, messageName));
-        [connection.delegate connection:connection didReceiveMessageWithName:(NSString *)cfMessageName.get() body:nil];
+
+        WKDataRef messageData = (WKDataRef)messageBody;
+        OwnPtr<CoreIPC::ArgumentDecoder> decoder = CoreIPC::ArgumentDecoder::create(WKDataGetBytes(messageData), WKDataGetSize(messageData));
+
+        RetainPtr<id> messageDictionary;
+        // FIXME: Don't just silently drop decoding failures on the ground.
+        if (!decode(decoder.get(), messageDictionary))
+            return;
+
+        [connection.delegate connection:connection didReceiveMessageWithName:(NSString *)cfMessageName.get() body:messageDictionary.get()];
     }
 }
 
diff --git a/Source/WebKit2/UIProcess/API/mac/WKView.mm b/Source/WebKit2/UIProcess/API/mac/WKView.mm
index ac037fb30..5fd169c84 100644
--- a/Source/WebKit2/UIProcess/API/mac/WKView.mm
+++ b/Source/WebKit2/UIProcess/API/mac/WKView.mm
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2010, 2011, 2012 Apple Inc. All rights reserved.
+ * Copyright (C) 2010, 2011 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -26,6 +26,11 @@
 #import "config.h"
 #import "WKView.h"
 
+#if USE(DICTATION_ALTERNATIVES)
+#import <AppKit/NSTextAlternatives.h>
+#import <AppKit/NSAttributedString.h>
+#endif
+
 #import "AttributedString.h"
 #import "ColorSpaceData.h"
 #import "DataReference.h"
@@ -41,16 +46,14 @@
 #import "PDFViewController.h"
 #import "PageClientImpl.h"
 #import "PasteboardTypes.h"
+#import "RemoteLayerTreeDrawingAreaProxy.h"
 #import "StringUtilities.h"
 #import "TextChecker.h"
 #import "TextCheckerState.h"
 #import "TiledCoreAnimationDrawingAreaProxy.h"
 #import "WKAPICast.h"
-#import "WKBrowsingContextControllerInternal.h"
-#import "WKBrowsingContextGroupInternal.h"
 #import "WKFullScreenWindowController.h"
 #import "WKPrintingView.h"
-#import "WKProcessGroupInternal.h"
 #import "WKStringCF.h"
 #import "WKTextInputWindowController.h"
 #import "WKViewInternal.h"
@@ -67,7 +70,6 @@
 #import <WebCore/DragController.h>
 #import <WebCore/DragData.h>
 #import <WebCore/DragSession.h>
-#import <WebCore/FileSystem.h>
 #import <WebCore/FloatRect.h>
 #import <WebCore/Image.h>
 #import <WebCore/IntRect.h>
@@ -80,14 +82,17 @@
 #import <WebCore/SharedBuffer.h>
 #import <WebCore/TextAlternativeWithRange.h>
 #import <WebCore/WebCoreNSStringExtras.h>
+#import <WebCore/FileSystem.h>
 #import <WebKitSystemInterface.h>
 #import <sys/stat.h>
 #import <wtf/RefPtr.h>
 #import <wtf/RetainPtr.h>
 
-#if USE(DICTATION_ALTERNATIVES)
-#import <AppKit/NSTextAlternatives.h>
-#endif
+/* API internals. */
+#import "WKBrowsingContextControllerInternal.h"
+#import "WKBrowsingContextGroupInternal.h"
+#import "WKProcessGroupInternal.h"
+
 
 @interface NSApplication (WKNSApplicationDetails)
 - (void)speakString:(NSString *)string;
@@ -130,12 +135,13 @@ struct WKViewInterpretKeyEventsParameters {
 };
 
 @interface WKView ()
-- (void)_wk_accessibilityRegisterUIProcessTokens;
-- (void)_wk_disableComplexTextInputIfNecessary;
-- (float)_wk_intrinsicDeviceScaleFactor;
-- (void)_wk_postFakeMouseMovedEventForFlagsChangedEvent:(NSEvent *)flagsChangedEvent;
-- (void)_wk_setDrawingAreaSize:(NSSize)size;
-- (void)_wk_setPluginComplexTextInputState:(PluginComplexTextInputState)pluginComplexTextInputState;
+- (void)_accessibilityRegisterUIProcessTokens;
+- (void)_disableComplexTextInputIfNecessary;
+- (float)_intrinsicDeviceScaleFactor;
+- (void)_postFakeMouseMovedEventForFlagsChangedEvent:(NSEvent *)flagsChangedEvent;
+- (void)_setDrawingAreaSize:(NSSize)size;
+- (void)_setPluginComplexTextInputState:(PluginComplexTextInputState)pluginComplexTextInputState;
+- (BOOL)_shouldUseTiledDrawingArea;
 @end
 
 @interface WKViewData : NSObject {
@@ -209,8 +215,6 @@ struct WKViewInterpretKeyEventsParameters {
     RefPtr<WebCore::Image> _promisedImage;
     String _promisedFilename;
     String _promisedURL;
-
-    RetainPtr<NSMutableArray> _observers;
 }
 
 @end
@@ -218,6 +222,7 @@ struct WKViewInterpretKeyEventsParameters {
 @implementation WKViewData
 @end
 
+
 @interface WKResponderChainSink : NSResponder {
     NSResponder *_lastResponderInChain;
     bool _didReceiveUnhandledCommand;
@@ -303,7 +308,7 @@ struct WKViewInterpretKeyEventsParameters {
 
     _data->_inBecomeFirstResponder = true;
     
-    [self _wk_updateSecureInputState];
+    [self _updateSecureInputState];
     _data->_page->viewStateDidChange(WebPageProxy::ViewIsFocused);
 
     _data->_inBecomeFirstResponder = false;
@@ -324,7 +329,7 @@ struct WKViewInterpretKeyEventsParameters {
 
     if (_data->_page->editorState().hasComposition && !_data->_page->editorState().shouldIgnoreCompositionSelectionChange)
         _data->_page->cancelComposition();
-    [self _wk_resetTextInputState];
+    [self _resetTextInputState];
     
     if (!_data->_page->maintainsInactiveSelection())
         _data->_page->clearSelection();
@@ -359,10 +364,10 @@ struct WKViewInterpretKeyEventsParameters {
     [super setFrameSize:size];
     
     if (![self frameSizeUpdatesDisabled])
-        [self _wk_setDrawingAreaSize:size];
+        [self _setDrawingAreaSize:size];
 }
 
-- (void)_wk_updateWindowAndViewFrames
+- (void)_updateWindowAndViewFrames
 {
     NSWindow *window = [self window];
     ASSERT(window);
@@ -381,12 +386,12 @@ struct WKViewInterpretKeyEventsParameters {
 
     // Update the view frame.
     if ([self window])
-        [self _wk_updateWindowAndViewFrames];
+        [self _updateWindowAndViewFrames];
 
     [super renewGState];
 }
 
-- (void)_wk_setPluginComplexTextInputState:(PluginComplexTextInputState)pluginComplexTextInputState
+- (void)_setPluginComplexTextInputState:(PluginComplexTextInputState)pluginComplexTextInputState
 {
     _data->_pluginComplexTextInputState = pluginComplexTextInputState;
     
@@ -649,7 +654,7 @@ static void validateCommandCallback(WKStringRef commandName, bool isEnabled, int
     WKView* wkView = static_cast<WKView*>(context);
     ASSERT(wkView);
     
-    [wkView _wk_setUserInterfaceItemState:nsStringFromWebCoreString(toImpl(commandName)->string()) enabled:isEnabled state:state];
+    [wkView _setUserInterfaceItemState:nsStringFromWebCoreString(toImpl(commandName)->string()) enabled:isEnabled state:state];
 }
 
 - (BOOL)validateUserInterfaceItem:(id <NSValidatedUserInterfaceItem>)item
@@ -960,7 +965,7 @@ static void speakString(WKStringRef string, WKErrorRef error, void*)
 {
 #if __MAC_OS_X_VERSION_MIN_REQUIRED >= 1070
     // FIXME: We should remove this code when <rdar://problem/9362085> is resolved. In the meantime,
-    // it is necessary to disable screen updates so we get a chance to redraw the corners before this
+    // it is necessary to disable scren updates so we get a chance to redraw the corners before this 
     // display is visible.
     NSWindow *window = [self window];
     BOOL shouldMaskWindow = window && !NSIsEmptyRect(_data->_windowBottomCornerIntersectionRect);
@@ -988,7 +993,7 @@ static void speakString(WKStringRef string, WKErrorRef error, void*)
     return YES;
 }
 
-- (void)_wk_setMouseDownEvent:(NSEvent *)event
+- (void)_setMouseDownEvent:(NSEvent *)event
 {
     ASSERT(!event || [event type] == NSLeftMouseDown || [event type] == NSRightMouseDown || [event type] == NSOtherMouseDown);
     
@@ -1012,10 +1017,10 @@ static void speakString(WKStringRef string, WKErrorRef error, void*)
 
 NATIVE_MOUSE_EVENT_HANDLER(mouseEntered)
 NATIVE_MOUSE_EVENT_HANDLER(mouseExited)
-NATIVE_MOUSE_EVENT_HANDLER(_wk_mouseMovedInternal)
-NATIVE_MOUSE_EVENT_HANDLER(_wk_mouseDownInternal)
-NATIVE_MOUSE_EVENT_HANDLER(_wk_mouseUpInternal)
-NATIVE_MOUSE_EVENT_HANDLER(_wk_mouseDraggedInternal)
+NATIVE_MOUSE_EVENT_HANDLER(mouseMovedInternal)
+NATIVE_MOUSE_EVENT_HANDLER(mouseDownInternal)
+NATIVE_MOUSE_EVENT_HANDLER(mouseUpInternal)
+NATIVE_MOUSE_EVENT_HANDLER(mouseDraggedInternal)
 NATIVE_MOUSE_EVENT_HANDLER(otherMouseDown)
 NATIVE_MOUSE_EVENT_HANDLER(otherMouseDragged)
 NATIVE_MOUSE_EVENT_HANDLER(otherMouseMoved)
@@ -1043,27 +1048,27 @@ NATIVE_EVENT_HANDLER(scrollWheel, Wheel)
     if (self == [[self window] firstResponder] && !NSPointInRect([self convertPoint:[event locationInWindow] fromView:nil], [self visibleRect]))
         return;
 
-    [self _wk_mouseMovedInternal:event];
+    [self mouseMovedInternal:event];
 }
 
 - (void)mouseDown:(NSEvent *)event
 {
-    [self _wk_setMouseDownEvent:event];
+    [self _setMouseDownEvent:event];
     _data->_ignoringMouseDraggedEvents = NO;
-    [self _wk_mouseDownInternal:event];
+    [self mouseDownInternal:event];
 }
 
 - (void)mouseUp:(NSEvent *)event
 {
-    [self _wk_setMouseDownEvent:nil];
-    [self _wk_mouseUpInternal:event];
+    [self _setMouseDownEvent:nil];
+    [self mouseUpInternal:event];
 }
 
 - (void)mouseDragged:(NSEvent *)event
 {
     if (_data->_ignoringMouseDraggedEvents)
         return;
-    [self _wk_mouseDraggedInternal:event];
+    [self mouseDraggedInternal:event];
 }
 
 - (BOOL)acceptsFirstMouse:(NSEvent *)event
@@ -1076,9 +1081,9 @@ NATIVE_EVENT_HANDLER(scrollWheel, Wheel)
     if (![self hitTest:[event locationInWindow]])
         return NO;
     
-    [self _wk_setMouseDownEvent:event];
+    [self _setMouseDownEvent:event];
     bool result = _data->_page->acceptsFirstMouse([event eventNumber], WebEventFactory::createWebMouseEvent(event, self));
-    [self _wk_setMouseDownEvent:nil];
+    [self _setMouseDownEvent:nil];
     return result;
 }
 
@@ -1097,9 +1102,9 @@ NATIVE_EVENT_HANDLER(scrollWheel, Wheel)
     if (![self hitTest:[event locationInWindow]])
         return NO;
     
-    [self _wk_setMouseDownEvent:event];
+    [self _setMouseDownEvent:event];
     bool result = _data->_page->shouldDelayWindowOrderingForEvent(WebEventFactory::createWebMouseEvent(event, self));
-    [self _wk_setMouseDownEvent:nil];
+    [self _setMouseDownEvent:nil];
     return result;
 }
 
@@ -1136,7 +1141,6 @@ static const short kIOHIDEventTypeScroll = 6;
         }];
     }
 }
-
 #endif
 
 - (void)doCommandBySelector:(SEL)selector
@@ -1223,7 +1227,7 @@ static const short kIOHIDEventTypeScroll = 6;
         parameters->eventInterpretationHadSideEffects |= eventHandled;
 }
 
-- (BOOL)_wk_handleStyleKeyEquivalent:(NSEvent *)event
+- (BOOL)_handleStyleKeyEquivalent:(NSEvent *)event
 {
     if (!_data->_page->editorState().isContentEditable)
         return NO;
@@ -1259,7 +1263,7 @@ static const short kIOHIDEventTypeScroll = 6;
     BOOL eventWasSentToWebCore = (_data->_keyDownEventBeingResent == event);
 
     if (!eventWasSentToWebCore)
-        [self _wk_disableComplexTextInputIfNecessary];
+        [self _disableComplexTextInputIfNecessary];
 
     // Pass key combos through WebCore if there is a key binding available for
     // this event. This lets web pages have a crack at intercepting key-modified keypresses.
@@ -1270,7 +1274,7 @@ static const short kIOHIDEventTypeScroll = 6;
         return YES;
     }
     
-    return [self _wk_handleStyleKeyEquivalent:event] || [super performKeyEquivalent:event];
+    return [self _handleStyleKeyEquivalent:event] || [super performKeyEquivalent:event];
 }
 
 - (void)keyUp:(NSEvent *)theEvent
@@ -1279,7 +1283,7 @@ static const short kIOHIDEventTypeScroll = 6;
     _data->_page->handleKeyboardEvent(NativeWebKeyboardEvent(theEvent, self));
 }
 
-- (void)_wk_disableComplexTextInputIfNecessary
+- (void)_disableComplexTextInputIfNecessary
 {
     if (!_data->_pluginComplexTextInputIdentifier)
         return;
@@ -1289,10 +1293,10 @@ static const short kIOHIDEventTypeScroll = 6;
 
     // Check if the text input window has been dismissed.
     if (![[WKTextInputWindowController sharedTextInputWindowController] hasMarkedText])
-        [self _wk_setPluginComplexTextInputState:PluginComplexTextInputDisabled];
+        [self _setPluginComplexTextInputState:PluginComplexTextInputDisabled];
 }
 
-- (BOOL)_wk_handlePluginComplexTextInputKeyDown:(NSEvent *)event
+- (BOOL)_handlePluginComplexTextInputKeyDown:(NSEvent *)event
 {
     ASSERT(_data->_pluginComplexTextInputIdentifier);
     ASSERT(_data->_pluginComplexTextInputState != PluginComplexTextInputDisabled);
@@ -1312,18 +1316,18 @@ static const short kIOHIDEventTypeScroll = 6;
     return didHandleEvent;
 }
 
-- (BOOL)_wk_tryHandlePluginComplexTextInputKeyDown:(NSEvent *)event
+- (BOOL)_tryHandlePluginComplexTextInputKeyDown:(NSEvent *)event
 {
     if (!_data->_pluginComplexTextInputIdentifier || _data->_pluginComplexTextInputState == PluginComplexTextInputDisabled)
         return NO;
 
     // Check if the text input window has been dismissed and let the plug-in process know.
     // This is only valid with the updated Cocoa text input spec.
-    [self _wk_disableComplexTextInputIfNecessary];
+    [self _disableComplexTextInputIfNecessary];
 
     // Try feeding the keyboard event directly to the plug-in.
     if (_data->_pluginComplexTextInputState == PluginComplexTextInputEnabledLegacy)
-        return [self _wk_handlePluginComplexTextInputKeyDown:event];
+        return [self _handlePluginComplexTextInputKeyDown:event];
 
     return NO;
 }
@@ -1337,7 +1341,7 @@ static const short kIOHIDEventTypeScroll = 6;
     // the current event prevents that from causing a problem inside WebKit or AppKit code.
     [[theEvent retain] autorelease];
 
-    if ([self _wk_tryHandlePluginComplexTextInputKeyDown:theEvent]) {
+    if ([self _tryHandlePluginComplexTextInputKeyDown:theEvent]) {
         LOG(TextInput, "...handled by plug-in");
         return;
     }
@@ -1371,7 +1375,7 @@ static const short kIOHIDEventTypeScroll = 6;
     _data->_page->handleKeyboardEvent(NativeWebKeyboardEvent(theEvent, self));
 }
 
-- (void)_wk_executeSavedKeypressCommands
+- (void)_executeSavedKeypressCommands
 {
     WKViewInterpretKeyEventsParameters* parameters = _data->_interpretKeyEventsParameters;
     if (!parameters || parameters->commands->isEmpty())
@@ -1392,7 +1396,7 @@ static const short kIOHIDEventTypeScroll = 6;
     LOG(TextInput, "...done executing saved keypress commands.");
 }
 
-- (void)_wk_notifyInputContextAboutDiscardedComposition
+- (void)_notifyInputContextAboutDiscardedComposition
 {
     // <rdar://problem/9359055>: -discardMarkedText can only be called for active contexts.
     // FIXME: We fail to ever notify the input context if something (e.g. a navigation) happens while the window is not key.
@@ -1420,7 +1424,7 @@ static const short kIOHIDEventTypeScroll = 6;
 
 - (NSRange)selectedRange
 {
-    [self _wk_executeSavedKeypressCommands];
+    [self _executeSavedKeypressCommands];
 
     uint64_t selectionStart;
     uint64_t selectionLength;
@@ -1444,7 +1448,7 @@ static const short kIOHIDEventTypeScroll = 6;
         result = _data->_page->editorState().hasComposition;
         if (result) {
             // A saved command can confirm a composition, but it cannot start a new one.
-            [self _wk_executeSavedKeypressCommands];
+            [self _executeSavedKeypressCommands];
             result = _data->_page->editorState().hasComposition;
         }
     } else {
@@ -1460,7 +1464,7 @@ static const short kIOHIDEventTypeScroll = 6;
 
 - (void)unmarkText
 {
-    [self _wk_executeSavedKeypressCommands];
+    [self _executeSavedKeypressCommands];
 
     LOG(TextInput, "unmarkText");
 
@@ -1519,7 +1523,7 @@ static void extractUnderlines(NSAttributedString *string, Vector<CompositionUnde
 
 - (void)setMarkedText:(id)string selectedRange:(NSRange)newSelRange replacementRange:(NSRange)replacementRange
 {
-    [self _wk_executeSavedKeypressCommands];
+    [self _executeSavedKeypressCommands];
 
     BOOL isAttributedString = [string isKindOfClass:[NSAttributedString class]];
     ASSERT(isAttributedString || [string isKindOfClass:[NSString class]]);
@@ -1548,7 +1552,7 @@ static void extractUnderlines(NSAttributedString *string, Vector<CompositionUnde
         // In password fields, we only allow ASCII dead keys, and don't allow inline input, matching NSSecureTextInputField.
         // Allowing ASCII dead keys is necessary to enable full Roman input when using a Vietnamese keyboard.
         ASSERT(!_data->_page->editorState().hasComposition);
-        [self _wk_notifyInputContextAboutDiscardedComposition];
+        [self _notifyInputContextAboutDiscardedComposition];
         if ([text length] == 1 && [[text decomposedStringWithCanonicalMapping] characterAtIndex:0] < 0x80) {
             _data->_page->insertText(text, replacementRange.location, NSMaxRange(replacementRange));
         } else
@@ -1561,7 +1565,7 @@ static void extractUnderlines(NSAttributedString *string, Vector<CompositionUnde
 
 - (NSRange)markedRange
 {
-    [self _wk_executeSavedKeypressCommands];
+    [self _executeSavedKeypressCommands];
 
     uint64_t location;
     uint64_t length;
@@ -1573,7 +1577,7 @@ static void extractUnderlines(NSAttributedString *string, Vector<CompositionUnde
 
 - (NSAttributedString *)attributedSubstringForProposedRange:(NSRange)nsRange actualRange:(NSRangePointer)actualRange
 {
-    [self _wk_executeSavedKeypressCommands];
+    [self _executeSavedKeypressCommands];
 
     if (!_data->_page->editorState().isContentEditable) {
         LOG(TextInput, "attributedSubstringFromRange:(%u, %u) -> nil", nsRange.location, nsRange.length);
@@ -1597,7 +1601,7 @@ static void extractUnderlines(NSAttributedString *string, Vector<CompositionUnde
 
 - (NSUInteger)characterIndexForPoint:(NSPoint)thePoint
 {
-    [self _wk_executeSavedKeypressCommands];
+    [self _executeSavedKeypressCommands];
 
     NSWindow *window = [self window];
     
@@ -1612,7 +1616,7 @@ static void extractUnderlines(NSAttributedString *string, Vector<CompositionUnde
 
 - (NSRect)firstRectForCharacterRange:(NSRange)theRange actualRange:(NSRangePointer)actualRange
 { 
-    [self _wk_executeSavedKeypressCommands];
+    [self _executeSavedKeypressCommands];
 
     // Just to match NSTextView's behavior. Regression tests cannot detect this;
     // to reproduce, use a test application from http://bugs.webkit.org/show_bug.cgi?id=4682
@@ -1637,7 +1641,6 @@ static void extractUnderlines(NSAttributedString *string, Vector<CompositionUnde
 }
 
 #if ENABLE(DRAG_SUPPORT)
-
 - (void)draggedImage:(NSImage *)anImage endedAt:(NSPoint)aPoint operation:(NSDragOperation)operation
 {
     NSPoint windowImageLoc = [[self window] convertScreenToBase:aPoint];
@@ -1779,7 +1782,6 @@ static void createSandboxExtensionsForFileUpload(NSPasteboard *pasteboard, Sandb
         return self;
     return nil;
 }
-
 #endif // ENABLE(DRAG_SUPPORT)
 
 - (BOOL)_windowResizeMouseLocationIsInVisibleScrollerThumb:(NSPoint)loc
@@ -1789,14 +1791,13 @@ static void createSandboxExtensionsForFileUpload(NSPasteboard *pasteboard, Sandb
     return NSMouseInRect(localPoint, visibleThumbRect, [self isFlipped]);
 }
 
-- (void)_wk_updateWindowVisibility
+- (void)_updateWindowVisibility
 {
     _data->_page->updateWindowIsVisible([[self window] isVisible]);
 }
 
 
 #if __MAC_OS_X_VERSION_MIN_REQUIRED == 1060
-
 - (BOOL)_ownsWindowGrowBox
 {
     NSWindow* window = [self window];
@@ -1845,45 +1846,54 @@ static void createSandboxExtensionsForFileUpload(NSPasteboard *pasteboard, Sandb
 
     return ownsGrowBox;
 }
-
 #endif
 
 // FIXME: Use AppKit constants for these when they are available.
-static NSString * const windowDidBecomeVisibleNotification = @"_NSWindowDidBecomeVisible";
-static NSString * const windowDidOrderOffScreenNotification = @"NSWindowDidOrderOffScreenNotification";
 static NSString * const windowDidChangeBackingPropertiesNotification = @"NSWindowDidChangeBackingPropertiesNotification";
 static NSString * const backingPropertyOldScaleFactorKey = @"NSBackingPropertyOldScaleFactorKey";
 
-- (void)_wk_updateWindowObserversForWindow:(NSWindow *)window
+- (void)addWindowObserversForWindow:(NSWindow *)window
+{
+    if (window) {
+        [[NSNotificationCenter defaultCenter] addObserver:self selector:@selector(_windowDidBecomeKey:)
+                                                     name:NSWindowDidBecomeKeyNotification object:nil];
+        [[NSNotificationCenter defaultCenter] addObserver:self selector:@selector(_windowDidResignKey:)
+                                                     name:NSWindowDidResignKeyNotification object:nil];
+        [[NSNotificationCenter defaultCenter] addObserver:self selector:@selector(_windowDidMiniaturize:) 
+                                                     name:NSWindowDidMiniaturizeNotification object:window];
+        [[NSNotificationCenter defaultCenter] addObserver:self selector:@selector(_windowDidDeminiaturize:)
+                                                     name:NSWindowDidDeminiaturizeNotification object:window];
+        [[NSNotificationCenter defaultCenter] addObserver:self selector:@selector(_windowDidMove:)
+                                                     name:NSWindowDidMoveNotification object:window];
+        [[NSNotificationCenter defaultCenter] addObserver:self selector:@selector(_windowDidResize:) 
+                                                     name:NSWindowDidResizeNotification object:window];
+        [[NSNotificationCenter defaultCenter] addObserver:self selector:@selector(_windowDidOrderOffScreen:) 
+                                                     name:@"NSWindowDidOrderOffScreenNotification" object:window];
+        [[NSNotificationCenter defaultCenter] addObserver:self selector:@selector(_windowDidOrderOnScreen:) 
+                                                     name:@"_NSWindowDidBecomeVisible" object:window];
+        [[NSNotificationCenter defaultCenter] addObserver:self selector:@selector(_windowDidChangeBackingProperties:)
+                                                     name:windowDidChangeBackingPropertiesNotification object:window];
+        [[NSNotificationCenter defaultCenter] addObserver:self selector:@selector(_windowDidChangeScreen:)
+                                                     name:NSWindowDidChangeScreenNotification object:window];
+    }
+}
+
+- (void)removeWindowObservers
 {
-    for (id observer in _data->_observers.get())
-        [[NSNotificationCenter defaultCenter] removeObserver:observer];
-    [_data->_observers.get() removeAllObjects];
-
+    NSWindow *window = [self window];
     if (!window)
         return;
 
-    if (!_data->_observers)
-        _data->_observers = adoptNS([[NSMutableArray alloc] init]);
-
-    #define ADD_OBSERVER(selectorName, notificationName, notificationObject) \
-        [_data->_observers.get() addObject:[[NSNotificationCenter defaultCenter] \
-            addObserverForName:notificationName object:notificationObject queue:[NSOperationQueue mainQueue] \
-            usingBlock:^(NSNotification *notification){ [self selectorName:notification]; }] \
-        ];
-
-    ADD_OBSERVER(_wk_windowDidBecomeKey, NSWindowDidBecomeKeyNotification, nil);
-    ADD_OBSERVER(_wk_windowDidChangeBackingProperties, windowDidChangeBackingPropertiesNotification, window);
-    ADD_OBSERVER(_wk_windowDidChangeScreen, NSWindowDidChangeScreenNotification, window);
-    ADD_OBSERVER(_wk_windowDidDeminiaturize, NSWindowDidDeminiaturizeNotification, window);
-    ADD_OBSERVER(_wk_windowDidMiniaturize, NSWindowDidMiniaturizeNotification, window);
-    ADD_OBSERVER(_wk_windowDidMove, NSWindowDidMoveNotification, window);
-    ADD_OBSERVER(_wk_windowDidOrderOffScreen, windowDidOrderOffScreenNotification, window);
-    ADD_OBSERVER(_wk_windowDidOrderOnScreen, windowDidBecomeVisibleNotification, window);
-    ADD_OBSERVER(_wk_windowDidResignKey, NSWindowDidResignKeyNotification, nil);
-    ADD_OBSERVER(_wk_windowDidResize, NSWindowDidResizeNotification, window);
-
-    #undef ADD_OBSERVER
+    [[NSNotificationCenter defaultCenter] removeObserver:self name:NSWindowDidBecomeKeyNotification object:nil];
+    [[NSNotificationCenter defaultCenter] removeObserver:self name:NSWindowDidResignKeyNotification object:nil];
+    [[NSNotificationCenter defaultCenter] removeObserver:self name:NSWindowDidMiniaturizeNotification object:window];
+    [[NSNotificationCenter defaultCenter] removeObserver:self name:NSWindowDidDeminiaturizeNotification object:window];
+    [[NSNotificationCenter defaultCenter] removeObserver:self name:NSWindowDidMoveNotification object:window];
+    [[NSNotificationCenter defaultCenter] removeObserver:self name:NSWindowDidResizeNotification object:window];
+    [[NSNotificationCenter defaultCenter] removeObserver:self name:@"NSWindowDidOrderOffScreenNotification" object:window];
+    [[NSNotificationCenter defaultCenter] removeObserver:self name:@"_NSWindowDidBecomeVisible" object:window];
+    [[NSNotificationCenter defaultCenter] removeObserver:self name:windowDidChangeBackingPropertiesNotification object:window];
+    [[NSNotificationCenter defaultCenter] removeObserver:self name:NSWindowDidChangeScreenNotification object:window];
 }
 
 - (void)viewWillMoveToWindow:(NSWindow *)window
@@ -1903,7 +1913,8 @@ static NSString * const backingPropertyOldScaleFactorKey = @"NSBackingPropertyOl
 #endif
         _data->_pageClient->viewWillMoveToAnotherWindow();
     
-    [self _wk_updateWindowObserversForWindow:window];
+    [self removeWindowObservers];
+    [self addWindowObserversForWindow:window];
 
 #if __MAC_OS_X_VERSION_MIN_REQUIRED == 1060
     if ([currentWindow _growBoxOwner] == self)
@@ -1913,28 +1924,26 @@ static NSString * const backingPropertyOldScaleFactorKey = @"NSBackingPropertyOl
 
 - (void)viewDidMoveToWindow
 {
-    [self removeAllToolTips];
-    
     // We want to make sure to update the active state while hidden, so if the view is about to become visible, we
     // update the active state first and then make it visible. If the view is about to be hidden, we hide it first and then
     // update the active state.
     if ([self window]) {
         _data->_windowHasValidBackingStore = NO;
-        [self _wk_updateWindowVisibility];
+        [self _updateWindowVisibility];
         _data->_page->viewStateDidChange(WebPageProxy::ViewWindowIsActive);
         _data->_page->viewStateDidChange(WebPageProxy::ViewIsVisible | WebPageProxy::ViewIsInWindow);
-        [self _wk_updateWindowAndViewFrames];
+        [self _updateWindowAndViewFrames];
 
         if (!_data->_flagsChangedEventMonitor) {
             _data->_flagsChangedEventMonitor = [NSEvent addLocalMonitorForEventsMatchingMask:NSFlagsChangedMask handler:^(NSEvent *flagsChangedEvent) {
-                [self _wk_postFakeMouseMovedEventForFlagsChangedEvent:flagsChangedEvent];
+                [self _postFakeMouseMovedEventForFlagsChangedEvent:flagsChangedEvent];
                 return flagsChangedEvent;
             }];
         }
 
-        [self _wk_accessibilityRegisterUIProcessTokens];
+        [self _accessibilityRegisterUIProcessTokens];
     } else {
-        [self _wk_updateWindowVisibility];
+        [self _updateWindowVisibility];
         _data->_page->viewStateDidChange(WebPageProxy::ViewIsVisible);
         _data->_page->viewStateDidChange(WebPageProxy::ViewWindowIsActive | WebPageProxy::ViewIsInWindow);
 
@@ -1952,67 +1961,67 @@ static NSString * const backingPropertyOldScaleFactorKey = @"NSBackingPropertyOl
 #endif
     }
 
-    _data->_page->setIntrinsicDeviceScaleFactor([self _wk_intrinsicDeviceScaleFactor]);
+    _data->_page->setIntrinsicDeviceScaleFactor([self _intrinsicDeviceScaleFactor]);
 }
 
-- (void)_wk_windowScreenDidChange
+- (void)doWindowDidChangeScreen
 {
     _data->_page->windowScreenDidChange((PlatformDisplayID)[[[[[self window] screen] deviceDescription] objectForKey:@"NSScreenNumber"] intValue]);
 }
 
-- (void)_wk_windowDidBecomeKey:(NSNotification *)notification
+- (void)_windowDidBecomeKey:(NSNotification *)notification
 {
     NSWindow *keyWindow = [notification object];
     if (keyWindow == [self window] || keyWindow == [[self window] attachedSheet]) {
-        [self _wk_updateSecureInputState];
+        [self _updateSecureInputState];
         _data->_page->viewStateDidChange(WebPageProxy::ViewWindowIsActive);
     }
 
     // Send a change screen to make sure the initial displayID is set
-    [self _wk_windowScreenDidChange];
+    [self doWindowDidChangeScreen];
 }
 
-- (void)_wk_windowDidChangeScreen:(NSNotification *)notification
+- (void)_windowDidChangeScreen:(NSNotification *)notification
 {
-    [self _wk_windowScreenDidChange];
+    [self doWindowDidChangeScreen];
 }
 
-- (void)_wk_windowDidResignKey:(NSNotification *)notification
+- (void)_windowDidResignKey:(NSNotification *)notification
 {
     NSWindow *formerKeyWindow = [notification object];
     if (formerKeyWindow == [self window] || formerKeyWindow == [[self window] attachedSheet]) {
-        [self _wk_updateSecureInputState];
+        [self _updateSecureInputState];
         _data->_page->viewStateDidChange(WebPageProxy::ViewWindowIsActive);
     }
 }
 
-- (void)_wk_windowDidMiniaturize:(NSNotification *)notification
+- (void)_windowDidMiniaturize:(NSNotification *)notification
 {
     _data->_windowHasValidBackingStore = NO;
 
-    [self _wk_updateWindowVisibility];
+    [self _updateWindowVisibility];
 }
 
-- (void)_wk_windowDidDeminiaturize:(NSNotification *)notification
+- (void)_windowDidDeminiaturize:(NSNotification *)notification
 {
-    [self _wk_updateWindowVisibility];
+    [self _updateWindowVisibility];
 }
 
-- (void)_wk_windowDidMove:(NSNotification *)notification
+- (void)_windowDidMove:(NSNotification *)notification
 {
-    [self _wk_updateWindowAndViewFrames];
+    [self _updateWindowAndViewFrames];    
 }
 
-- (void)_wk_windowDidResize:(NSNotification *)notification
+- (void)_windowDidResize:(NSNotification *)notification
 {
     _data->_windowHasValidBackingStore = NO;
 
-    [self _wk_updateWindowAndViewFrames];
+    [self _updateWindowAndViewFrames];
 }
 
-- (void)_wk_windowDidOrderOffScreen:(NSNotification *)notification
+- (void)_windowDidOrderOffScreen:(NSNotification *)notification
 {
-    [self _wk_updateWindowVisibility];
+    [self _updateWindowVisibility];
 
     // We want to make sure to update the active state while hidden, so since the view is about to be hidden,
     // we hide it first and then update the active state.
@@ -2020,9 +2029,9 @@ static NSString * const backingPropertyOldScaleFactorKey = @"NSBackingPropertyOl
     _data->_page->viewStateDidChange(WebPageProxy::ViewWindowIsActive);
 }
 
-- (void)_wk_windowDidOrderOnScreen:(NSNotification *)notification
+- (void)_windowDidOrderOnScreen:(NSNotification *)notification
 {
-    [self _wk_updateWindowVisibility];
+    [self _updateWindowVisibility];
 
     // We want to make sure to update the active state while hidden, so since the view is about to become visible,
     // we update the active state first and then make it visible.
@@ -2030,10 +2039,10 @@ static NSString * const backingPropertyOldScaleFactorKey = @"NSBackingPropertyOl
     _data->_page->viewStateDidChange(WebPageProxy::ViewIsVisible);
 }
 
-- (void)_wk_windowDidChangeBackingProperties:(NSNotification *)notification
+- (void)_windowDidChangeBackingProperties:(NSNotification *)notification
 {
     CGFloat oldBackingScaleFactor = [[notification.userInfo objectForKey:backingPropertyOldScaleFactorKey] doubleValue];
-    CGFloat newBackingScaleFactor = [self _wk_intrinsicDeviceScaleFactor];
+    CGFloat newBackingScaleFactor = [self _intrinsicDeviceScaleFactor]; 
     if (oldBackingScaleFactor == newBackingScaleFactor)
         return; 
 
@@ -2130,7 +2139,7 @@ static void drawPageBackground(CGContextRef context, WebPageProxy* page, const I
         drawingArea->colorSpaceDidChange();
 }
 
-- (void)_wk_accessibilityRegisterUIProcessTokens
+- (void)_accessibilityRegisterUIProcessTokens
 {
     // Initialize remote accessibility when the window connection has been established.
     NSData *remoteElementToken = WKAXRemoteTokenForElement(self);
@@ -2140,7 +2149,7 @@ static void drawPageBackground(CGContextRef context, WebPageProxy* page, const I
     _data->_page->registerUIProcessAccessibilityTokens(elementToken, windowToken);
 }
 
-- (void)_wk_updateRemoteAccessibilityRegistration:(BOOL)registerProcess
+- (void)_updateRemoteAccessibilityRegistration:(BOOL)registerProcess
 {
     // When the tree is connected/disconnected, the remote accessibility registration
     // needs to be updated with the pid of the remote process. If the process is going
@@ -2212,7 +2221,7 @@ static void drawPageBackground(CGContextRef context, WebPageProxy* page, const I
     return hitView;
 }
 
-- (void)_wk_postFakeMouseMovedEventForFlagsChangedEvent:(NSEvent *)flagsChangedEvent
+- (void)_postFakeMouseMovedEventForFlagsChangedEvent:(NSEvent *)flagsChangedEvent
 {
     NSEvent *fakeEvent = [NSEvent mouseEventWithType:NSMouseMoved location:[[flagsChangedEvent window] convertScreenToBase:[NSEvent mouseLocation]]
         modifierFlags:[flagsChangedEvent modifierFlags] timestamp:[flagsChangedEvent timestamp] windowNumber:[flagsChangedEvent windowNumber]
@@ -2226,7 +2235,7 @@ static void drawPageBackground(CGContextRef context, WebPageProxy* page, const I
     return (NSInteger)self;
 }
 
-- (float)_wk_intrinsicDeviceScaleFactor
+- (float)_intrinsicDeviceScaleFactor
 {
     NSWindow *window = [self window];
 #if __MAC_OS_X_VERSION_MIN_REQUIRED >= 1070
@@ -2240,7 +2249,7 @@ static void drawPageBackground(CGContextRef context, WebPageProxy* page, const I
 #endif
 }
 
-- (void)_wk_setDrawingAreaSize:(NSSize)size
+- (void)_setDrawingAreaSize:(NSSize)size
 {
     if (!_data->_page->drawingArea())
         return;
@@ -2249,6 +2258,11 @@ static void drawPageBackground(CGContextRef context, WebPageProxy* page, const I
     _data->_resizeScrollOffset = NSZeroSize;
 }
 
+- (BOOL)_shouldUseTiledDrawingArea
+{
+    return NO;
+}
+
 #if __MAC_OS_X_VERSION_MIN_REQUIRED >= 1080
 - (void)quickLookWithEvent:(NSEvent *)event
 {
@@ -2261,17 +2275,21 @@ static void drawPageBackground(CGContextRef context, WebPageProxy* page, const I
 
 @implementation WKView (Internal)
 
-- (PassOwnPtr<WebKit::DrawingAreaProxy>)_wk_createDrawingAreaProxy
+- (PassOwnPtr<WebKit::DrawingAreaProxy>)_createDrawingAreaProxy
 {
 #if ENABLE(THREADED_SCROLLING)
-    if ([self _shouldUseTiledDrawingArea])
+    if ([self _shouldUseTiledDrawingArea]) {
+        if (getenv("WK_USE_REMOTE_LAYER_TREE_DRAWING_AREA"))
+            return RemoteLayerTreeDrawingAreaProxy::create(_data->_page.get());
+
         return TiledCoreAnimationDrawingAreaProxy::create(_data->_page.get());
+    }
 #endif
 
     return DrawingAreaProxyImpl::create(_data->_page.get());
 }
 
-- (BOOL)_wk_isFocused
+- (BOOL)_isFocused
 {
     if (_data->_inBecomeFirstResponder)
         return YES;
@@ -2280,7 +2298,7 @@ static void drawPageBackground(CGContextRef context, WebPageProxy* page, const I
     return [[self window] firstResponder] == self;
 }
 
-- (WebKit::ColorSpaceData)_wk_colorSpace
+- (WebKit::ColorSpaceData)_colorSpace
 {
     if (!_data->_colorSpace) {
         if ([self window])
@@ -2295,32 +2313,32 @@ static void drawPageBackground(CGContextRef context, WebPageProxy* page, const I
     return colorSpaceData;    
 }
 
-- (void)_wk_processDidCrash
+- (void)_processDidCrash
 {
     if (_data->_layerHostingView)
-        [self _wk_exitAcceleratedCompositingMode];
+        [self _exitAcceleratedCompositingMode];
 
-    [self _wk_updateRemoteAccessibilityRegistration:NO];
+    [self _updateRemoteAccessibilityRegistration:NO];
 }
 
-- (void)_wk_pageClosed
+- (void)_pageClosed
 {
-    [self _wk_updateRemoteAccessibilityRegistration:NO];
+    [self _updateRemoteAccessibilityRegistration:NO];
 }
 
-- (void)_wk_didRelaunchProcess
+- (void)_didRelaunchProcess
 {
-    [self _wk_accessibilityRegisterUIProcessTokens];
+    [self _accessibilityRegisterUIProcessTokens];
 }
 
-- (void)_wk_setCursor:(NSCursor *)cursor
+- (void)_setCursor:(NSCursor *)cursor
 {
     if ([NSCursor currentCursor] == cursor)
         return;
     [cursor set];
 }
 
-- (void)_wk_setUserInterfaceItemState:(NSString *)commandName enabled:(BOOL)isEnabled state:(int)newState
+- (void)_setUserInterfaceItemState:(NSString *)commandName enabled:(BOOL)isEnabled state:(int)newState
 {
     ValidationVector items = _data->_validationMap.take(commandName);
     size_t size = items.size();
@@ -2333,7 +2351,7 @@ static void drawPageBackground(CGContextRef context, WebPageProxy* page, const I
     }
 }
 
-- (BOOL)_wk_tryPostProcessPluginComplexTextInputKeyDown:(NSEvent *)event
+- (BOOL)_tryPostProcessPluginComplexTextInputKeyDown:(NSEvent *)event
 {
     if (!_data->_pluginComplexTextInputIdentifier || _data->_pluginComplexTextInputState == PluginComplexTextInputDisabled)
         return NO;
@@ -2342,15 +2360,15 @@ static void drawPageBackground(CGContextRef context, WebPageProxy* page, const I
     if (_data->_pluginComplexTextInputState == PluginComplexTextInputEnabledLegacy)
         return NO;
 
-    return [self _wk_handlePluginComplexTextInputKeyDown:event];
+    return [self _handlePluginComplexTextInputKeyDown:event];
 }
 
-- (void)_wk_doneWithKeyEvent:(NSEvent *)event eventWasHandled:(BOOL)eventWasHandled
+- (void)_doneWithKeyEvent:(NSEvent *)event eventWasHandled:(BOOL)eventWasHandled
 {
     if ([event type] != NSKeyDown)
         return;
 
-    if ([self _wk_tryPostProcessPluginComplexTextInputKeyDown:event])
+    if ([self _tryPostProcessPluginComplexTextInputKeyDown:event])
         return;
     
     if (eventWasHandled) {
@@ -2369,7 +2387,7 @@ static void drawPageBackground(CGContextRef context, WebPageProxy* page, const I
     _data->_keyDownEventBeingResent = nullptr;
 }
 
-- (BOOL)_wk_interpretKeyEvent:(NSEvent *)event savingCommandsTo:(Vector<WebCore::KeypressCommand>&)commands
+- (BOOL)_interpretKeyEvent:(NSEvent *)event savingCommandsTo:(Vector<WebCore::KeypressCommand>&)commands
 {
     ASSERT(!_data->_interpretKeyEventsParameters);
     ASSERT(commands.isEmpty());
@@ -2404,12 +2422,12 @@ static void drawPageBackground(CGContextRef context, WebPageProxy* page, const I
     return parameters.eventInterpretationHadSideEffects;
 }
 
-- (NSRect)_wk_convertToDeviceSpace:(NSRect)rect
+- (NSRect)_convertToDeviceSpace:(NSRect)rect
 {
     return toDeviceSpace(rect, [self window]);
 }
 
-- (NSRect)_wk_convertToUserSpace:(NSRect)rect
+- (NSRect)_convertToUserSpace:(NSRect)rect
 {
     return toUserSpace(rect, [self window]);
 }
@@ -2425,7 +2443,7 @@ static void drawPageBackground(CGContextRef context, WebPageProxy* page, const I
     return TRACKING_RECT_TAG;
 }
 
-- (NSTrackingRectTag)_wk_addTrackingRect:(NSRect)rect owner:(id)owner userData:(void *)data assumeInside:(BOOL)assumeInside useTrackingNum:(int)tag
+- (NSTrackingRectTag)_addTrackingRect:(NSRect)rect owner:(id)owner userData:(void *)data assumeInside:(BOOL)assumeInside useTrackingNum:(int)tag
 {
     ASSERT(tag == 0 || tag == TRACKING_RECT_TAG);
     ASSERT(_data->_trackingRectOwner == nil);
@@ -2434,7 +2452,7 @@ static void drawPageBackground(CGContextRef context, WebPageProxy* page, const I
     return TRACKING_RECT_TAG;
 }
 
-- (void)_wk_addTrackingRects:(NSRect *)rects owner:(id)owner userDataList:(void **)userDataList assumeInsideList:(BOOL *)assumeInsideList trackingNums:(NSTrackingRectTag *)trackingNums count:(int)count
+- (void)_addTrackingRects:(NSRect *)rects owner:(id)owner userDataList:(void **)userDataList assumeInsideList:(BOOL *)assumeInsideList trackingNums:(NSTrackingRectTag *)trackingNums count:(int)count
 {
     ASSERT(count == 1);
     ASSERT(trackingNums[0] == 0 || trackingNums[0] == TRACKING_RECT_TAG);
@@ -2468,7 +2486,7 @@ static void drawPageBackground(CGContextRef context, WebPageProxy* page, const I
     ASSERT_NOT_REACHED();
 }
 
-- (void)_wk_removeTrackingRects:(NSTrackingRectTag *)tags count:(int)count
+- (void)_removeTrackingRects:(NSTrackingRectTag *)tags count:(int)count
 {
     int i;
     for (i = 0; i < count; ++i) {
@@ -2482,7 +2500,7 @@ static void drawPageBackground(CGContextRef context, WebPageProxy* page, const I
     }
 }
 
-- (void)_wk_sendToolTipMouseExited
+- (void)_sendToolTipMouseExited
 {
     // Nothing matters except window, trackingNumber, and userData.
     NSEvent *fakeEvent = [NSEvent enterExitEventWithType:NSMouseExited
@@ -2497,7 +2515,7 @@ static void drawPageBackground(CGContextRef context, WebPageProxy* page, const I
     [_data->_trackingRectOwner mouseExited:fakeEvent];
 }
 
-- (void)_wk_sendToolTipMouseEntered
+- (void)_sendToolTipMouseEntered
 {
     // Nothing matters except window, trackingNumber, and userData.
     NSEvent *fakeEvent = [NSEvent enterExitEventWithType:NSMouseEntered
@@ -2517,21 +2535,21 @@ static void drawPageBackground(CGContextRef context, WebPageProxy* page, const I
     return nsStringFromWebCoreString(_data->_page->toolTip());
 }
 
-- (void)_wk_toolTipChangedFrom:(NSString *)oldToolTip to:(NSString *)newToolTip
+- (void)_toolTipChangedFrom:(NSString *)oldToolTip to:(NSString *)newToolTip
 {
     if (oldToolTip)
-        [self _wk_sendToolTipMouseExited];
+        [self _sendToolTipMouseExited];
 
     if (newToolTip && [newToolTip length] > 0) {
         // See radar 3500217 for why we remove all tooltips rather than just the single one we created.
         [self removeAllToolTips];
         NSRect wideOpenRect = NSMakeRect(-100000, -100000, 200000, 200000);
         _data->_lastToolTipTag = [self addToolTipRect:wideOpenRect owner:self userData:NULL];
-        [self _wk_sendToolTipMouseEntered];
+        [self _sendToolTipMouseEntered];
     }
 }
 
-- (void)_wk_setFindIndicator:(PassRefPtr<FindIndicator>)findIndicator fadeOut:(BOOL)fadeOut animate:(BOOL)animate
+- (void)_setFindIndicator:(PassRefPtr<FindIndicator>)findIndicator fadeOut:(BOOL)fadeOut animate:(BOOL)animate
 {
     if (!findIndicator) {
         _data->_findIndicatorWindow = nullptr;
@@ -2544,7 +2562,7 @@ static void drawPageBackground(CGContextRef context, WebPageProxy* page, const I
     _data->_findIndicatorWindow->setFindIndicator(findIndicator, fadeOut, animate);
 }
 
-- (void)_wk_enterAcceleratedCompositingMode:(const LayerTreeContext&)layerTreeContext
+- (void)_enterAcceleratedCompositingMode:(const LayerTreeContext&)layerTreeContext
 {
     ASSERT(!_data->_layerHostingView);
     ASSERT(!layerTreeContext.isEmpty());
@@ -2573,7 +2591,7 @@ static void drawPageBackground(CGContextRef context, WebPageProxy* page, const I
     [CATransaction commit];
 }
 
-- (void)_wk_exitAcceleratedCompositingMode
+- (void)_exitAcceleratedCompositingMode
 {
     ASSERT(_data->_layerHostingView);
 
@@ -2584,7 +2602,7 @@ static void drawPageBackground(CGContextRef context, WebPageProxy* page, const I
     _data->_layerHostingView = nullptr;
 }
 
-- (void)_wk_updateAcceleratedCompositingMode:(const WebKit::LayerTreeContext&)layerTreeContext
+- (void)_updateAcceleratedCompositingMode:(const WebKit::LayerTreeContext&)layerTreeContext
 {
     if (_data->_layerHostingView) {
         // Wrap the call to setSublayers: in a CATransaction with actions disabled to
@@ -2597,18 +2615,18 @@ static void drawPageBackground(CGContextRef context, WebPageProxy* page, const I
 
         [CATransaction commit];
     } else {
-        [self _wk_exitAcceleratedCompositingMode];
-        [self _wk_enterAcceleratedCompositingMode:layerTreeContext];
+        [self _exitAcceleratedCompositingMode];
+        [self _enterAcceleratedCompositingMode:layerTreeContext];
     }
 }
 
-- (void)_wk_setAccessibilityWebProcessToken:(NSData *)data
+- (void)_setAccessibilityWebProcessToken:(NSData *)data
 {
     _data->_remoteAccessibilityChild = WKAXRemoteElementForToken(data);
-    [self _wk_updateRemoteAccessibilityRegistration:YES];
+    [self _updateRemoteAccessibilityRegistration:YES];
 }
 
-- (void)_wk_pluginFocusOrWindowFocusChanged:(BOOL)pluginHasFocusAndWindowHasFocus pluginComplexTextInputIdentifier:(uint64_t)pluginComplexTextInputIdentifier
+- (void)_pluginFocusOrWindowFocusChanged:(BOOL)pluginHasFocusAndWindowHasFocus pluginComplexTextInputIdentifier:(uint64_t)pluginComplexTextInputIdentifier
 {
     BOOL inputSourceChanged = _data->_pluginComplexTextInputIdentifier;
 
@@ -2636,17 +2654,17 @@ static void drawPageBackground(CGContextRef context, WebPageProxy* page, const I
     [NSApp updateWindows];
 }
 
-- (void)_wk_setPluginComplexTextInputState:(PluginComplexTextInputState)pluginComplexTextInputState pluginComplexTextInputIdentifier:(uint64_t)pluginComplexTextInputIdentifier
+- (void)_setPluginComplexTextInputState:(PluginComplexTextInputState)pluginComplexTextInputState pluginComplexTextInputIdentifier:(uint64_t)pluginComplexTextInputIdentifier
 {
     if (pluginComplexTextInputIdentifier != _data->_pluginComplexTextInputIdentifier) {
         // We're asked to update the state for a plug-in that doesn't have focus.
         return;
     }
 
-    [self _wk_setPluginComplexTextInputState:pluginComplexTextInputState];
+    [self _setPluginComplexTextInputState:pluginComplexTextInputState];
 }
 
-- (void)_wk_setPageHasCustomRepresentation:(BOOL)pageHasCustomRepresentation
+- (void)_setPageHasCustomRepresentation:(BOOL)pageHasCustomRepresentation
 {
     bool hadPDFView = _data->_pdfViewController;
     _data->_pdfViewController = nullptr;
@@ -2658,14 +2676,14 @@ static void drawPageBackground(CGContextRef context, WebPageProxy* page, const I
         _data->_page->drawingArea()->pageCustomRepresentationChanged();
 }
 
-- (void)_wk_didFinishLoadingDataForCustomRepresentationWithSuggestedFilename:(const String&)suggestedFilename dataReference:(const CoreIPC::DataReference&)dataReference
+- (void)_didFinishLoadingDataForCustomRepresentationWithSuggestedFilename:(const String&)suggestedFilename dataReference:(const CoreIPC::DataReference&)dataReference
 {
     ASSERT(_data->_pdfViewController);
 
     _data->_pdfViewController->setPDFDocumentData(_data->_page->mainFrame()->mimeType(), suggestedFilename, dataReference);
 }
 
-- (double)_wk_customRepresentationZoomFactor
+- (double)_customRepresentationZoomFactor
 {
     if (!_data->_pdfViewController)
         return 1;
@@ -2673,7 +2691,7 @@ static void drawPageBackground(CGContextRef context, WebPageProxy* page, const I
     return _data->_pdfViewController->zoomFactor();
 }
 
-- (void)_wk_setCustomRepresentationZoomFactor:(double)zoomFactor
+- (void)_setCustomRepresentationZoomFactor:(double)zoomFactor
 {
     if (!_data->_pdfViewController)
         return;
@@ -2681,7 +2699,7 @@ static void drawPageBackground(CGContextRef context, WebPageProxy* page, const I
     _data->_pdfViewController->setZoomFactor(zoomFactor);
 }
 
-- (void)_wk_findStringInCustomRepresentation:(NSString *)string withFindOptions:(WebKit::FindOptions)options maxMatchCount:(NSUInteger)count
+- (void)_findStringInCustomRepresentation:(NSString *)string withFindOptions:(WebKit::FindOptions)options maxMatchCount:(NSUInteger)count
 {
     if (!_data->_pdfViewController)
         return;
@@ -2689,7 +2707,7 @@ static void drawPageBackground(CGContextRef context, WebPageProxy* page, const I
     _data->_pdfViewController->findString(string, options, count);
 }
 
-- (void)_wk_countStringMatchesInCustomRepresentation:(NSString *)string withFindOptions:(WebKit::FindOptions)options maxMatchCount:(NSUInteger)count
+- (void)_countStringMatchesInCustomRepresentation:(NSString *)string withFindOptions:(WebKit::FindOptions)options maxMatchCount:(NSUInteger)count
 {
     if (!_data->_pdfViewController)
         return;
@@ -2697,7 +2715,7 @@ static void drawPageBackground(CGContextRef context, WebPageProxy* page, const I
     _data->_pdfViewController->countStringMatches(string, options, count);
 }
 
-- (void)_wk_setDragImage:(NSImage *)image at:(NSPoint)clientPoint linkDrag:(BOOL)linkDrag
+- (void)_setDragImage:(NSImage *)image at:(NSPoint)clientPoint linkDrag:(BOOL)linkDrag
 {
     IntSize size([image size]);
     size.scale(1.0 / _data->_page->deviceScaleFactor());
@@ -2722,7 +2740,7 @@ static bool matchesExtensionOrEquivalent(NSString *filename, NSString *extension
                                                                      && hasCaseInsensitiveSuffix(filename, @".jpg"));
 }
 
-- (void)_wk_setPromisedData:(WebCore::Image *)image withFileName:(NSString *)filename withExtension:(NSString *)extension withTitle:(NSString *)title withURL:(NSString *)url withVisibleURL:(NSString *)visibleUrl withArchive:(WebCore::SharedBuffer*) archiveBuffer forPasteboard:(NSString *)pasteboardName
+- (void)_setPromisedData:(WebCore::Image *)image withFileName:(NSString *)filename withExtension:(NSString *)extension withTitle:(NSString *)title withURL:(NSString *)url withVisibleURL:(NSString *)visibleUrl withArchive:(WebCore::SharedBuffer*) archiveBuffer forPasteboard:(NSString *)pasteboardName
 
 {
     NSPasteboard *pasteboard = [NSPasteboard pasteboardWithName:pasteboardName];
@@ -2830,9 +2848,9 @@ static NSString *pathWithUniqueFilenameForPath(NSString *path)
     return [NSArray arrayWithObject:[path lastPathComponent]];
 }
 
-- (void)_wk_updateSecureInputState
+- (void)_updateSecureInputState
 {
-    if (![[self window] isKeyWindow] || ![self _wk_isFocused]) {
+    if (![[self window] isKeyWindow] || ![self _isFocused]) {
         if (_data->_inSecureInputState) {
             DisableSecureEventInput();
             _data->_inSecureInputState = NO;
@@ -2858,13 +2876,13 @@ static NSString *pathWithUniqueFilenameForPath(NSString *path)
     _data->_inSecureInputState = isInPasswordField;
 }
 
-- (void)_wk_updateTextInputStateIncludingSecureInputState:(BOOL)updateSecureInputState
+- (void)_updateTextInputStateIncludingSecureInputState:(BOOL)updateSecureInputState
 {
     const EditorState& editorState = _data->_page->editorState();
     if (updateSecureInputState) {
         // This is a temporary state when editing. Flipping secure input state too quickly can expose race conditions.
         if (!editorState.selectionIsNone)
-            [self _wk_updateSecureInputState];
+            [self _updateSecureInputState];
     }
 
     if (!editorState.hasComposition || editorState.shouldIgnoreCompositionSelectionChange)
@@ -2872,12 +2890,12 @@ static NSString *pathWithUniqueFilenameForPath(NSString *path)
 
     _data->_page->cancelComposition();
 
-    [self _wk_notifyInputContextAboutDiscardedComposition];
+    [self _notifyInputContextAboutDiscardedComposition];
 }
 
-- (void)_wk_resetTextInputState
+- (void)_resetTextInputState
 {
-    [self _wk_notifyInputContextAboutDiscardedComposition];
+    [self _notifyInputContextAboutDiscardedComposition];
 
     if (_data->_inSecureInputState) {
         DisableSecureEventInput();
@@ -2885,7 +2903,7 @@ static NSString *pathWithUniqueFilenameForPath(NSString *path)
     }
 }
 
-- (void)_wk_didChangeScrollbarsForMainFrame
+- (void)_didChangeScrollbarsForMainFrame
 {
 #if __MAC_OS_X_VERSION_MIN_REQUIRED == 1060
     [self _updateGrowBoxForWindowFrameChange];
@@ -2893,13 +2911,12 @@ static NSString *pathWithUniqueFilenameForPath(NSString *path)
 }
 
 #if ENABLE(FULLSCREEN_API)
-
-- (BOOL)_wk_hasFullScreenWindowController
+- (BOOL)hasFullScreenWindowController
 {
     return (bool)_data->_fullScreenWindowController;
 }
 
-- (WKFullScreenWindowController*)_wk_fullScreenWindowController
+- (WKFullScreenWindowController*)fullScreenWindowController
 {
     if (!_data->_fullScreenWindowController) {
         _data->_fullScreenWindowController.adoptNS([[WKFullScreenWindowController alloc] init]);
@@ -2908,17 +2925,16 @@ static NSString *pathWithUniqueFilenameForPath(NSString *path)
     return _data->_fullScreenWindowController.get();
 }
 
-- (void)_wk_closeFullScreenWindowController
+- (void)closeFullScreenWindowController
 {
     if (!_data->_fullScreenWindowController)
         return;
     [_data->_fullScreenWindowController.get() close];
     _data->_fullScreenWindowController = nullptr;
 }
-
 #endif
 
-- (bool)_wk_executeSavedCommandBySelector:(SEL)selector
+- (bool)_executeSavedCommandBySelector:(SEL)selector
 {
     // The sink does two things: 1) Tells us if the responder went unhandled, and
     // 2) prevents any NSBeep; we don't ever want to beep here.
@@ -2928,7 +2944,7 @@ static NSString *pathWithUniqueFilenameForPath(NSString *path)
     return ![sink.get() didReceiveUnhandledCommand];
 }
 
-- (void)_wk_cacheWindowBottomCornerRect
+- (void)_cacheWindowBottomCornerRect
 {
 #if __MAC_OS_X_VERSION_MIN_REQUIRED >= 1070
     // FIXME: We should remove this code when <rdar://problem/9362085> is resolved. 
@@ -2942,7 +2958,7 @@ static NSString *pathWithUniqueFilenameForPath(NSString *path)
 #endif
 }
 
-- (NSInteger)_wk_spellCheckerDocumentTag
+- (NSInteger)spellCheckerDocumentTag
 {
     if (!_data->_hasSpellCheckerDocumentTag) {
         _data->_spellCheckerDocumentTag = [NSSpellChecker uniqueSpellDocumentTag];
@@ -2951,17 +2967,17 @@ static NSString *pathWithUniqueFilenameForPath(NSString *path)
     return _data->_spellCheckerDocumentTag;
 }
 
-- (void)_wk_handleAcceptedAlternativeText:(NSString*)text
+- (void)handleAcceptedAlternativeText:(NSString*)text
 {
     _data->_page->handleAlternativeTextUIResult(text);
 }
 
-- (void)_wk_setSuppressVisibilityUpdates:(BOOL)suppressVisibilityUpdates
+- (void)_setSuppressVisibilityUpdates:(BOOL)suppressVisibilityUpdates
 {
     _data->_page->setSuppressVisibilityUpdates(suppressVisibilityUpdates);
 }
 
-- (BOOL)_wk_suppressVisibilityUpdates
+- (BOOL)_suppressVisibilityUpdates
 {
     return _data->_page->suppressVisibilityUpdates();
 }
@@ -2970,7 +2986,7 @@ static NSString *pathWithUniqueFilenameForPath(NSString *path)
 
 @implementation WKView (Private)
 
-- (void)_wk_registerDraggedTypes
+- (void)_registerDraggedTypes
 {
     NSMutableSet *types = [[NSMutableSet alloc] initWithArray:PasteboardTypes::forEditing()];
     [types addObjectsFromArray:PasteboardTypes::forURL()];
@@ -3016,7 +3032,7 @@ static NSString *pathWithUniqueFilenameForPath(NSString *path)
 
     _data->_pageClient = PageClientImpl::create(self);
     _data->_page = toImpl(contextRef)->createWebPage(_data->_pageClient.get(), toImpl(pageGroupRef), toImpl(relatedPage));
-    _data->_page->setIntrinsicDeviceScaleFactor([self _wk_intrinsicDeviceScaleFactor]);
+    _data->_page->setIntrinsicDeviceScaleFactor([self _intrinsicDeviceScaleFactor]);
     _data->_page->initializeWebPage();
 #if ENABLE(FULLSCREEN_API)
     _data->_page->fullScreenManager()->setWebView(self);
@@ -3024,7 +3040,7 @@ static NSString *pathWithUniqueFilenameForPath(NSString *path)
     _data->_mouseDownEvent = nil;
     _data->_ignoringMouseDraggedEvents = NO;
 
-    [self _wk_registerDraggedTypes];
+    [self _registerDraggedTypes];
 
     if ([self _shouldUseTiledDrawingArea]) {
         self.wantsLayer = YES;
@@ -3039,7 +3055,6 @@ static NSString *pathWithUniqueFilenameForPath(NSString *path)
 }
 
 #if __MAC_OS_X_VERSION_MIN_REQUIRED >= 1080
-
 - (BOOL)wantsUpdateLayer
 {
     return [self _shouldUseTiledDrawingArea];
@@ -3052,7 +3067,6 @@ static NSString *pathWithUniqueFilenameForPath(NSString *path)
     if (DrawingAreaProxy* drawingArea = _data->_page->drawingArea())
         drawingArea->waitForPossibleGeometryUpdate();
 }
-
 #endif
 
 - (WKPageRef)pageRef
@@ -3107,7 +3121,7 @@ static NSString *pathWithUniqueFilenameForPath(NSString *path)
         return;
     
     if (!(--_data->_frameSizeUpdatesDisabledCount))
-        [self _wk_setDrawingAreaSize:[self frame].size];
+        [self _setDrawingAreaSize:[self frame].size];
 }
 
 - (BOOL)frameSizeUpdatesDisabled
@@ -3131,11 +3145,6 @@ static NSString *pathWithUniqueFilenameForPath(NSString *path)
 #endif
 }
 
-- (BOOL)_shouldUseTiledDrawingArea
-{
-    return NO;
-}
-
 @end
 
 @implementation WKResponderChainSink
diff --git a/Source/WebKit2/UIProcess/API/mac/WKViewInternal.h b/Source/WebKit2/UIProcess/API/mac/WKViewInternal.h
index f2b681649..2e99e7976 100644
--- a/Source/WebKit2/UIProcess/API/mac/WKViewInternal.h
+++ b/Source/WebKit2/UIProcess/API/mac/WKViewInternal.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2010, 2011, 2012 Apple Inc. All rights reserved.
+ * Copyright (C) 2010 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -50,59 +50,58 @@ namespace WebKit {
 @class WKFullScreenWindowController;
 
 @interface WKView (Internal)
-
-- (PassOwnPtr<WebKit::DrawingAreaProxy>)_wk_createDrawingAreaProxy;
-- (BOOL)_wk_isFocused;
-- (void)_wk_processDidCrash;
-- (void)_wk_pageClosed;
-- (void)_wk_didRelaunchProcess;
-- (void)_wk_toolTipChangedFrom:(NSString *)oldToolTip to:(NSString *)newToolTip;
-- (void)_wk_setCursor:(NSCursor *)cursor;
-- (void)_wk_setUserInterfaceItemState:(NSString *)commandName enabled:(BOOL)isEnabled state:(int)newState;
-- (BOOL)_wk_interpretKeyEvent:(NSEvent *)theEvent savingCommandsTo:(Vector<WebCore::KeypressCommand>&)commands;
-- (void)_wk_doneWithKeyEvent:(NSEvent *)event eventWasHandled:(BOOL)eventWasHandled;
-- (bool)_wk_executeSavedCommandBySelector:(SEL)selector;
-- (NSRect)_wk_convertToDeviceSpace:(NSRect)rect;
-- (NSRect)_wk_convertToUserSpace:(NSRect)rect;
-- (void)_wk_setFindIndicator:(PassRefPtr<WebKit::FindIndicator>)findIndicator fadeOut:(BOOL)fadeOut animate:(BOOL)animate;
-
-- (void)_wk_enterAcceleratedCompositingMode:(const WebKit::LayerTreeContext&)layerTreeContext;
-- (void)_wk_exitAcceleratedCompositingMode;
-- (void)_wk_updateAcceleratedCompositingMode:(const WebKit::LayerTreeContext&)layerTreeContext;
-
-- (void)_wk_setAccessibilityWebProcessToken:(NSData *)data;
-
-- (void)_wk_pluginFocusOrWindowFocusChanged:(BOOL)pluginHasFocusAndWindowHasFocus pluginComplexTextInputIdentifier:(uint64_t)pluginComplexTextInputIdentifier;
-- (void)_wk_setPluginComplexTextInputState:(WebKit::PluginComplexTextInputState)pluginComplexTextInputState pluginComplexTextInputIdentifier:(uint64_t)pluginComplexTextInputIdentifier;
-
-- (void)_wk_setPageHasCustomRepresentation:(BOOL)pageHasCustomRepresentation;
-- (void)_wk_didFinishLoadingDataForCustomRepresentationWithSuggestedFilename:(const String&)suggestedFilename dataReference:(const CoreIPC::DataReference&)dataReference;
-- (double)_wk_customRepresentationZoomFactor;
-- (void)_wk_setCustomRepresentationZoomFactor:(double)zoomFactor;
-- (void)_wk_findStringInCustomRepresentation:(NSString *)string withFindOptions:(WebKit::FindOptions)options maxMatchCount:(NSUInteger)count;
-- (void)_wk_countStringMatchesInCustomRepresentation:(NSString *)string withFindOptions:(WebKit::FindOptions)options maxMatchCount:(NSUInteger)count;
-- (void)_wk_setDragImage:(NSImage *)image at:(NSPoint)clientPoint linkDrag:(BOOL)linkDrag;
-- (void)_wk_setPromisedData:(WebCore::Image *)image withFileName:(NSString *)filename withExtension:(NSString *)extension withTitle:(NSString *)title withURL:(NSString *)url withVisibleURL:(NSString *)visibleUrl withArchive:(WebCore::SharedBuffer*) archiveBuffer forPasteboard:(NSString *)pasteboardName;
-- (void)_wk_updateSecureInputState;
-- (void)_wk_updateTextInputStateIncludingSecureInputState:(BOOL)updateSecureInputState;
-- (void)_wk_resetTextInputState;
-
-- (void)_wk_didChangeScrollbarsForMainFrame;
-
-- (WebKit::ColorSpaceData)_wk_colorSpace;
+- (PassOwnPtr<WebKit::DrawingAreaProxy>)_createDrawingAreaProxy;
+- (BOOL)_isFocused;
+- (void)_processDidCrash;
+- (void)_pageClosed;
+- (void)_didRelaunchProcess;
+- (void)_toolTipChangedFrom:(NSString *)oldToolTip to:(NSString *)newToolTip;
+- (void)_setCursor:(NSCursor *)cursor;
+- (void)_setUserInterfaceItemState:(NSString *)commandName enabled:(BOOL)isEnabled state:(int)newState;
+- (BOOL)_interpretKeyEvent:(NSEvent *)theEvent savingCommandsTo:(Vector<WebCore::KeypressCommand>&)commands;
+- (void)_doneWithKeyEvent:(NSEvent *)event eventWasHandled:(BOOL)eventWasHandled;
+- (bool)_executeSavedCommandBySelector:(SEL)selector;
+- (NSRect)_convertToDeviceSpace:(NSRect)rect;
+- (NSRect)_convertToUserSpace:(NSRect)rect;
+- (void)_setFindIndicator:(PassRefPtr<WebKit::FindIndicator>)findIndicator fadeOut:(BOOL)fadeOut animate:(BOOL)animate;
+
+- (void)_enterAcceleratedCompositingMode:(const WebKit::LayerTreeContext&)layerTreeContext;
+- (void)_exitAcceleratedCompositingMode;
+- (void)_updateAcceleratedCompositingMode:(const WebKit::LayerTreeContext&)layerTreeContext;
+
+- (void)_setAccessibilityWebProcessToken:(NSData *)data;
+
+- (void)_pluginFocusOrWindowFocusChanged:(BOOL)pluginHasFocusAndWindowHasFocus pluginComplexTextInputIdentifier:(uint64_t)pluginComplexTextInputIdentifier;
+- (void)_setPluginComplexTextInputState:(WebKit::PluginComplexTextInputState)pluginComplexTextInputState pluginComplexTextInputIdentifier:(uint64_t)pluginComplexTextInputIdentifier;
+
+- (void)_setPageHasCustomRepresentation:(BOOL)pageHasCustomRepresentation;
+- (void)_didFinishLoadingDataForCustomRepresentationWithSuggestedFilename:(const String&)suggestedFilename dataReference:(const CoreIPC::DataReference&)dataReference;
+- (double)_customRepresentationZoomFactor;
+- (void)_setCustomRepresentationZoomFactor:(double)zoomFactor;
+- (void)_findStringInCustomRepresentation:(NSString *)string withFindOptions:(WebKit::FindOptions)options maxMatchCount:(NSUInteger)count;
+- (void)_countStringMatchesInCustomRepresentation:(NSString *)string withFindOptions:(WebKit::FindOptions)options maxMatchCount:(NSUInteger)count;
+- (void)_setDragImage:(NSImage *)image at:(NSPoint)clientPoint linkDrag:(BOOL)linkDrag;
+- (void)_setPromisedData:(WebCore::Image *)image withFileName:(NSString *)filename withExtension:(NSString *)extension withTitle:(NSString *)title withURL:(NSString *)url withVisibleURL:(NSString *)visibleUrl withArchive:(WebCore::SharedBuffer*) archiveBuffer forPasteboard:(NSString *)pasteboardName;
+- (void)_updateSecureInputState;
+- (void)_updateTextInputStateIncludingSecureInputState:(BOOL)updateSecureInputState;
+- (void)_resetTextInputState;
+
+- (void)_didChangeScrollbarsForMainFrame;
+
+- (WebKit::ColorSpaceData)_colorSpace;
 
 #if ENABLE(FULLSCREEN_API)
-- (BOOL)_wk_hasFullScreenWindowController;
-- (WKFullScreenWindowController*)_wk_fullScreenWindowController;
-- (void)_wk_closeFullScreenWindowController;
+- (BOOL)hasFullScreenWindowController;
+- (WKFullScreenWindowController*)fullScreenWindowController;
+- (void)closeFullScreenWindowController;
 #endif
 
-- (void)_wk_cacheWindowBottomCornerRect;
+- (void)_cacheWindowBottomCornerRect;
 
-- (NSInteger)_wk_spellCheckerDocumentTag;
-- (void)_wk_handleAcceptedAlternativeText:(NSString*)text;
+- (NSInteger)spellCheckerDocumentTag;
+- (void)handleAcceptedAlternativeText:(NSString*)text;
 
-- (void)_wk_setSuppressVisibilityUpdates:(BOOL)suppressVisibilityUpdates;
-- (BOOL)_wk_suppressVisibilityUpdates;
+- (void)_setSuppressVisibilityUpdates:(BOOL)suppressVisibilityUpdates;
+- (BOOL)_suppressVisibilityUpdates;
 
 @end
diff --git a/Source/WebKit2/UIProcess/API/mac/WKViewPrivate.h b/Source/WebKit2/UIProcess/API/mac/WKViewPrivate.h
index 035b1ea2c..51578764f 100644
--- a/Source/WebKit2/UIProcess/API/mac/WKViewPrivate.h
+++ b/Source/WebKit2/UIProcess/API/mac/WKViewPrivate.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2011, 2012 Apple Inc. All rights reserved.
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -50,8 +50,4 @@
 - (void)performDictionaryLookupAtCurrentMouseLocation;
 + (void)hideWordDefinitionWindow;
 
-// FIXME: This method currently overridden by Safari to turn tiled drawing area on.
-// We should come up with a cleaner SPI or API for this.
-- (BOOL)_shouldUseTiledDrawingArea;
-
 @end
diff --git a/Source/WebKit2/UIProcess/API/qt/qquickwebview.cpp b/Source/WebKit2/UIProcess/API/qt/qquickwebview.cpp
index 9a0433b66..21ed5be10 100644
--- a/Source/WebKit2/UIProcess/API/qt/qquickwebview.cpp
+++ b/Source/WebKit2/UIProcess/API/qt/qquickwebview.cpp
@@ -258,6 +258,7 @@ QPointF QQuickWebViewPrivate::FlickableAxisLocker::adjust(const QPointF& positio
 
 QQuickWebViewPrivate::QQuickWebViewPrivate(QQuickWebView* viewport)
     : q_ptr(viewport)
+    , experimental(new QQuickWebViewExperimental(viewport, this))
     , alertDialog(0)
     , confirmDialog(0)
     , promptDialog(0)
@@ -321,6 +322,9 @@ void QQuickWebViewPrivate::initialize(WKContextRef contextRef, WKPageGroupRef pa
 
     pageClient.initialize(q_ptr, pageViewPrivate->eventHandler.data(), &undoController);
     webPageProxy->initializeWebPage();
+
+    q_ptr->setAcceptedMouseButtons(Qt::MouseButtonMask);
+    q_ptr->setAcceptHoverEvents(true);
 }
 
 void QQuickWebViewPrivate::loadDidStop()
@@ -419,9 +423,6 @@ void QQuickWebViewPrivate::handleMouseEvent(QMouseEvent* event)
 {
     switch (event->type()) {
     case QEvent::MouseButtonPress:
-    case QEvent::MouseButtonDblClick:
-        // If a MouseButtonDblClick was received then we got a MouseButtonPress before
-        // handleMousePressEvent will take care of double clicks.
         pageView->eventHandler()->handleMousePressEvent(event);
         break;
     case QEvent::MouseMove:
@@ -430,6 +431,11 @@ void QQuickWebViewPrivate::handleMouseEvent(QMouseEvent* event)
     case QEvent::MouseButtonRelease:
         pageView->eventHandler()->handleMouseReleaseEvent(event);
         break;
+    case QEvent::MouseButtonDblClick:
+        // If a MouseButtonDblClick was received then we got a MouseButtonPress before.
+        // WebCore will build double-clicks out of press events.
+        event->accept();
+        break;
     default:
         ASSERT_NOT_REACHED();
         break;
@@ -503,7 +509,7 @@ void QQuickWebViewPrivate::handleDownloadRequest(DownloadProxy* download)
     downloadItem->d->downloadProxy = download;
 
     q->connect(downloadItem->d, SIGNAL(receivedResponse(QWebDownloadItem*)), q, SLOT(_q_onReceivedResponseFromDownload(QWebDownloadItem*)));
-    context->downloadManager()->addDownload(download, downloadItem);
+    QtWebContext::downloadManager()->addDownload(download, downloadItem);
 }
 
 void QQuickWebViewPrivate::_q_onVisibleChanged()
@@ -805,12 +811,8 @@ QQuickWebViewLegacyPrivate::QQuickWebViewLegacyPrivate(QQuickWebView* viewport)
 
 void QQuickWebViewLegacyPrivate::initialize(WKContextRef contextRef, WKPageGroupRef pageGroupRef)
 {
-    Q_Q(QQuickWebView);
     QQuickWebViewPrivate::initialize(contextRef, pageGroupRef);
 
-    q->setAcceptedMouseButtons(Qt::MouseButtonMask);
-    q->setAcceptHoverEvents(true);
-
     // Trigger setting of correct visibility flags after everything was allocated and initialized.
     _q_onVisibleChanged();
 }
@@ -847,7 +849,6 @@ void QQuickWebViewLegacyPrivate::setZoomFactor(qreal factor)
 QQuickWebViewFlickablePrivate::QQuickWebViewFlickablePrivate(QQuickWebView* viewport)
     : QQuickWebViewPrivate(viewport)
 {
-    viewport->setAcceptHoverEvents(false);
 }
 
 void QQuickWebViewFlickablePrivate::initialize(WKContextRef contextRef, WKPageGroupRef pageGroupRef)
@@ -897,12 +898,12 @@ void QQuickWebViewFlickablePrivate::handleMouseEvent(QMouseEvent* event)
     pageView->eventHandler()->handleInputEvent(event);
 }
 
-QQuickWebViewExperimental::QQuickWebViewExperimental(QQuickWebView *webView)
+QQuickWebViewExperimental::QQuickWebViewExperimental(QQuickWebView *webView, QQuickWebViewPrivate* webViewPrivate)
     : QObject(webView)
     , q_ptr(webView)
-    , d_ptr(webView->d_ptr.data())
+    , d_ptr(webViewPrivate)
     , schemeParent(new QObject(this))
-    , m_test(new QWebKitTest(webView->d_ptr.data(), this))
+    , m_test(new QWebKitTest(webViewPrivate, this))
 {
 }
 
@@ -1473,7 +1474,6 @@ QQuickWebPage* QQuickWebViewExperimental::page()
 QQuickWebView::QQuickWebView(QQuickItem* parent)
     : QQuickFlickable(parent)
     , d_ptr(createPrivateObject(this))
-    , m_experimental(new QQuickWebViewExperimental(this))
 {
     Q_D(QQuickWebView);
     d->initialize();
@@ -1482,7 +1482,6 @@ QQuickWebView::QQuickWebView(QQuickItem* parent)
 QQuickWebView::QQuickWebView(WKContextRef contextRef, WKPageGroupRef pageGroupRef, QQuickItem* parent)
     : QQuickFlickable(parent)
     , d_ptr(createPrivateObject(this))
-    , m_experimental(new QQuickWebViewExperimental(this))
 {
     Q_D(QQuickWebView);
     d->initialize(contextRef, pageGroupRef);
@@ -1762,7 +1761,8 @@ QVariant QQuickWebView::inputMethodQuery(Qt::InputMethodQuery property) const
 */
 QQuickWebViewExperimental* QQuickWebView::experimental() const
 {
-    return m_experimental;
+    Q_D(const QQuickWebView);
+    return d->experimental;
 }
 
 /*!
diff --git a/Source/WebKit2/UIProcess/API/qt/qquickwebview_p.h b/Source/WebKit2/UIProcess/API/qt/qquickwebview_p.h
index 89e7fbc99..dfe7ad88e 100644
--- a/Source/WebKit2/UIProcess/API/qt/qquickwebview_p.h
+++ b/Source/WebKit2/UIProcess/API/qt/qquickwebview_p.h
@@ -213,9 +213,9 @@ private:
     Q_PRIVATE_SLOT(d_func(), void _q_onUrlChanged());
     Q_PRIVATE_SLOT(d_func(), void _q_onReceivedResponseFromDownload(QWebDownloadItem*));
     Q_PRIVATE_SLOT(d_func(), void _q_onIconChangedForPageURL(const QString&));
+
     // Hides QObject::d_ptr allowing us to use the convenience macros.
     QScopedPointer<QQuickWebViewPrivate> d_ptr;
-    QQuickWebViewExperimental* m_experimental;
 
     friend class QWebKitTest;
     friend class WebKit::PageViewportControllerClientQt;
@@ -284,7 +284,6 @@ public:
         DownloadRequest = QQuickWebView::IgnoreRequest - 1
     };
 
-    QQuickWebViewExperimental(QQuickWebView* webView);
     virtual ~QQuickWebViewExperimental();
 
     QQmlComponent* alertDialog() const;
@@ -380,6 +379,7 @@ Q_SIGNALS:
     void remoteInspectorUrlChanged();
 
 private:
+    QQuickWebViewExperimental(QQuickWebView* webView, QQuickWebViewPrivate* webViewPrivate);
     QQuickWebView* q_ptr;
     QQuickWebViewPrivate* d_ptr;
     QObject* schemeParent;
diff --git a/Source/WebKit2/UIProcess/API/qt/qquickwebview_p_p.h b/Source/WebKit2/UIProcess/API/qt/qquickwebview_p_p.h
index 15bf818d7..adedb6a31 100644
--- a/Source/WebKit2/UIProcess/API/qt/qquickwebview_p_p.h
+++ b/Source/WebKit2/UIProcess/API/qt/qquickwebview_p_p.h
@@ -171,6 +171,7 @@ protected:
 
     QScopedPointer<QQuickWebPage> pageView;
     QQuickWebView* q_ptr;
+    QQuickWebViewExperimental* experimental;
 
     FlickableAxisLocker axisLocker;
 
diff --git a/Source/WebKit2/UIProcess/API/qt/qwebiconimageprovider.cpp b/Source/WebKit2/UIProcess/API/qt/qwebiconimageprovider.cpp
index 63dce28d0..aa26c0737 100644
--- a/Source/WebKit2/UIProcess/API/qt/qwebiconimageprovider.cpp
+++ b/Source/WebKit2/UIProcess/API/qt/qwebiconimageprovider.cpp
@@ -49,13 +49,8 @@ WTF::String QWebIconImageProvider::iconURLForPageURLInContext(const WTF::String
     QUrl url;
     url.setScheme(QStringLiteral("image"));
     url.setHost(QWebIconImageProvider::identifier());
-
-    QString path;
-    path.append(QLatin1Char('/'));
-    path.append(QString::number(context->contextID()));
-    path.append(QLatin1Char('/'));
-    path.append(QString::number(WTF::StringHash::hash(iconURL)));
-    url.setPath(path);
+    // Make sure that QML doesn't show cached versions of the previous icon if the icon location changed.
+    url.setPath(QLatin1Char('/') + QString::number(WTF::StringHash::hash(iconURL)));
 
     // FIXME: Use QUrl::DecodedMode when landed in Qt
     url.setFragment(QString::fromLatin1(QByteArray(QString(pageURL).toUtf8()).toBase64()));
@@ -70,21 +65,12 @@ WTF::String QWebIconImageProvider::iconURLForPageURLInContext(const WTF::String
 
 QImage QWebIconImageProvider::requestImage(const QString& id, QSize* size, const QSize& requestedSize)
 {
-    // The string identifier has the leading image://webicon/ already stripped, so we just
-    // need to truncate from the first slash to get the context id.
-    QString contextIDString = id.left(id.indexOf(QLatin1Char('/')));
-    bool ok = false;
-    uint64_t contextId = contextIDString.toUInt(&ok);
-    if (!ok)
-        return QImage();
+    QString pageURL = QString::fromUtf8(QByteArray::fromBase64(id.midRef(id.indexOf('#') + 1).toLatin1()));
 
-    QtWebContext* context = QtWebContext::contextByID(contextId);
-    if (!context)
+    QtWebIconDatabaseClient* iconDatabase = QtWebContext::iconDatabase();
+    if (!iconDatabase)
         return QImage();
 
-    QString pageURL = QString::fromUtf8(QByteArray::fromBase64(id.midRef(id.indexOf('#') + 1).toLatin1()));
-
-    QtWebIconDatabaseClient* iconDatabase = context->iconDatabase();
     QImage icon = requestedSize.isValid() ? iconDatabase->iconImageForPageURL(pageURL, requestedSize) : iconDatabase->iconImageForPageURL(pageURL);
     ASSERT(!icon.isNull());
 
diff --git a/Source/WebKit2/UIProcess/API/qt/qwebpreferences.cpp b/Source/WebKit2/UIProcess/API/qt/qwebpreferences.cpp
index e27f51264..7ddfd9269 100644
--- a/Source/WebKit2/UIProcess/API/qt/qwebpreferences.cpp
+++ b/Source/WebKit2/UIProcess/API/qt/qwebpreferences.cpp
@@ -20,11 +20,8 @@
 #include "config.h"
 #include "qwebpreferences_p.h"
 
-#include "WKPageGroup.h"
-#include "WKPreferences.h"
-#include "WKPreferencesPrivate.h"
-#include "WKRetainPtr.h"
-#include "WKStringQt.h"
+#include "WebPageGroup.h"
+#include "WebPageProxy.h"
 #include "qquickwebview_p_p.h"
 #include "qwebpreferences_p_p.h"
 
@@ -40,41 +37,49 @@ bool QWebPreferencesPrivate::testAttribute(QWebPreferencesPrivate::WebAttribute
 {
     switch (attr) {
     case AutoLoadImages:
-        return WKPreferencesGetLoadsImagesAutomatically(preferencesRef());
+        return preferences()->loadsImagesAutomatically();
 #if ENABLE(FULLSCREEN_API)
     case FullScreenEnabled:
-        return WKPreferencesGetFullScreenEnabled(preferencesRef());
+        return preferences()->fullScreenEnabled();
 #endif
     case JavascriptEnabled:
-        return WKPreferencesGetJavaScriptEnabled(preferencesRef());
+        return preferences()->javaScriptEnabled();
     case PluginsEnabled:
-        return WKPreferencesGetPluginsEnabled(preferencesRef());
+        return preferences()->pluginsEnabled();
     case OfflineWebApplicationCacheEnabled:
-        return WKPreferencesGetOfflineWebApplicationCacheEnabled(preferencesRef());
+        return preferences()->offlineWebApplicationCacheEnabled();
     case LocalStorageEnabled:
-        return WKPreferencesGetLocalStorageEnabled(preferencesRef());
+        return preferences()->localStorageEnabled();
     case XSSAuditingEnabled:
-        return WKPreferencesGetXSSAuditorEnabled(preferencesRef());
+        return preferences()->xssAuditorEnabled();
     case PrivateBrowsingEnabled:
-        return WKPreferencesGetPrivateBrowsingEnabled(preferencesRef());
+        return preferences()->privateBrowsingEnabled();
     case DnsPrefetchEnabled:
-        return WKPreferencesGetDNSPrefetchingEnabled(preferencesRef());
+        return preferences()->dnsPrefetchingEnabled();
     case FrameFlatteningEnabled:
-        return WKPreferencesGetFrameFlatteningEnabled(preferencesRef());
+        return preferences()->frameFlatteningEnabled();
     case DeveloperExtrasEnabled:
-        return WKPreferencesGetDeveloperExtrasEnabled(preferencesRef());
+        return preferences()->developerExtrasEnabled();
 #if ENABLE(WEBGL)
     case WebGLEnabled:
-        return WKPreferencesGetWebGLEnabled(preferencesRef());
+        return preferences()->webGLEnabled();
 #if ENABLE(CSS_SHADERS)
     case CSSCustomFilterEnabled:
-        return WKPreferencesGetCSSCustomFilterEnabled(preferencesRef());
+        return preferences()->cssCustomFilterEnabled();
 #endif
 #endif
 #if ENABLE(WEB_AUDIO)
     case WebAudioEnabled:
-        return WKPreferencesGetWebAudioEnabled(preferencesRef());
+        return preferences()->webAudioEnabled();
 #endif
+#if ENABLE(SMOOTH_SCROLLING)
+    case ScrollAnimatorEnabled:
+        return preferences()->scrollAnimatorEnabled();
+#endif
+    case CaretBrowsingEnabled:
+        return preferences()->caretBrowsingEnabled();
+    case NotificationsEnabled:
+        return preferences()->notificationsEnabled();
     default:
         ASSERT_NOT_REACHED();
         return false;
@@ -85,54 +90,66 @@ void QWebPreferencesPrivate::setAttribute(QWebPreferencesPrivate::WebAttribute a
 {
     switch (attr) {
     case AutoLoadImages:
-        WKPreferencesSetLoadsImagesAutomatically(preferencesRef(), enable);
+        preferences()->setLoadsImagesAutomatically(enable);
         break;
 #if ENABLE(FULLSCREEN_API)
     case FullScreenEnabled:
-        WKPreferencesSetFullScreenEnabled(preferencesRef(), enable);
+        preferences()->setFullScreenEnabled(enable);
         break;
 #endif
     case JavascriptEnabled:
-        WKPreferencesSetJavaScriptEnabled(preferencesRef(), enable);
+        preferences()->setJavaScriptEnabled(enable);
         break;
     case PluginsEnabled:
-        WKPreferencesSetPluginsEnabled(preferencesRef(), enable);
+        preferences()->setPluginsEnabled(enable);
         break;
     case OfflineWebApplicationCacheEnabled:
-        WKPreferencesSetOfflineWebApplicationCacheEnabled(preferencesRef(), enable);
+        preferences()->setOfflineWebApplicationCacheEnabled(enable);
         break;
     case LocalStorageEnabled:
-        WKPreferencesSetLocalStorageEnabled(preferencesRef(), enable);
+        preferences()->setLocalStorageEnabled(enable);
         break;
     case XSSAuditingEnabled:
-        WKPreferencesSetXSSAuditorEnabled(preferencesRef(), enable);
+        preferences()->setXSSAuditorEnabled(enable);
         break;
     case PrivateBrowsingEnabled:
-        WKPreferencesSetPrivateBrowsingEnabled(preferencesRef(), enable);
+        preferences()->setPrivateBrowsingEnabled(enable);
         break;
     case DnsPrefetchEnabled:
-        WKPreferencesSetDNSPrefetchingEnabled(preferencesRef(), enable);
+        preferences()->setDNSPrefetchingEnabled(enable);
         break;
     case FrameFlatteningEnabled:
-        WKPreferencesSetFrameFlatteningEnabled(preferencesRef(), enable);
+        preferences()->setFrameFlatteningEnabled(enable);
     case DeveloperExtrasEnabled:
-        WKPreferencesSetDeveloperExtrasEnabled(preferencesRef(), enable);
+        preferences()->setDeveloperExtrasEnabled(enable);
         break;
 #if ENABLE(WEBGL)
     case WebGLEnabled:
-        WKPreferencesSetWebGLEnabled(preferencesRef(), enable);
+        preferences()->setWebGLEnabled(enable);
         break;
 #if ENABLE(CSS_SHADERS)
     case CSSCustomFilterEnabled:
-        WKPreferencesSetCSSCustomFilterEnabled(preferencesRef(), enable);
+        preferences()->setCSSCustomFilterEnabled(enable);
         break;
 #endif
 #endif
 #if ENABLE(WEB_AUDIO)
     case WebAudioEnabled:
-        WKPreferencesSetWebAudioEnabled(preferencesRef(), enable);
+        preferences()->setWebAudioEnabled(enable);
+        break;
+#endif
+#if ENABLE(SMOOTH_SCROLLING)
+    case ScrollAnimatorEnabled:
+        preferences()->setScrollAnimatorEnabled(enable);
         break;
 #endif
+    case CaretBrowsingEnabled:
+        // FIXME: Caret browsing doesn't make much sense in touch mode.
+        preferences()->setCaretBrowsingEnabled(enable);
+        break;
+    case NotificationsEnabled:
+        preferences()->setNotificationsEnabled(enable);
+        break;
     default:
         ASSERT_NOT_REACHED();
     }
@@ -166,22 +183,22 @@ void QWebPreferencesPrivate::setFontFamily(QWebPreferencesPrivate::FontFamily wh
 {
     switch (which) {
     case StandardFont:
-        WKPreferencesSetStandardFontFamily(preferencesRef(), WKStringCreateWithQString(family));
+        preferences()->setStandardFontFamily(family);
         break;
     case FixedFont:
-        WKPreferencesSetFixedFontFamily(preferencesRef(), WKStringCreateWithQString(family));
+        preferences()->setFixedFontFamily(family);
         break;
     case SerifFont:
-        WKPreferencesSetSerifFontFamily(preferencesRef(), WKStringCreateWithQString(family));
+        preferences()->setSerifFontFamily(family);
         break;
     case SansSerifFont:
-        WKPreferencesSetSansSerifFontFamily(preferencesRef(), WKStringCreateWithQString(family));
+        preferences()->setSansSerifFontFamily(family);
         break;
     case CursiveFont:
-        WKPreferencesSetCursiveFontFamily(preferencesRef(), WKStringCreateWithQString(family));
+        preferences()->setCursiveFontFamily(family);
         break;
     case FantasyFont:
-        WKPreferencesSetFantasyFontFamily(preferencesRef(), WKStringCreateWithQString(family));
+        preferences()->setFantasyFontFamily(family);
         break;
     default:
         break;
@@ -191,30 +208,18 @@ void QWebPreferencesPrivate::setFontFamily(QWebPreferencesPrivate::FontFamily wh
 QString QWebPreferencesPrivate::fontFamily(QWebPreferencesPrivate::FontFamily which) const
 {
     switch (which) {
-    case StandardFont: {
-        WKRetainPtr<WKStringRef> stringRef(AdoptWK, WKPreferencesCopyStandardFontFamily(preferencesRef()));
-        return WKStringCopyQString(stringRef.get());
-    }
-    case FixedFont: {
-        WKRetainPtr<WKStringRef> stringRef(AdoptWK, WKPreferencesCopyFixedFontFamily(preferencesRef()));
-        return WKStringCopyQString(stringRef.get());
-    }
-    case SerifFont: {
-        WKRetainPtr<WKStringRef> stringRef(AdoptWK, WKPreferencesCopySerifFontFamily(preferencesRef()));
-        return WKStringCopyQString(stringRef.get());
-    }
-    case SansSerifFont: {
-        WKRetainPtr<WKStringRef> stringRef(AdoptWK, WKPreferencesCopySansSerifFontFamily(preferencesRef()));
-        return WKStringCopyQString(stringRef.get());
-    }
-    case CursiveFont: {
-        WKRetainPtr<WKStringRef> stringRef(AdoptWK, WKPreferencesCopyCursiveFontFamily(preferencesRef()));
-        return WKStringCopyQString(stringRef.get());
-    }
-    case FantasyFont: {
-        WKRetainPtr<WKStringRef> stringRef(AdoptWK, WKPreferencesCopyFantasyFontFamily(preferencesRef()));
-        return WKStringCopyQString(stringRef.get());
-    }
+    case StandardFont:
+        return preferences()->standardFontFamily();
+    case FixedFont:
+        return preferences()->fixedFontFamily();
+    case SerifFont:
+        return preferences()->serifFontFamily();
+    case SansSerifFont:
+        return preferences()->sansSerifFontFamily();
+    case CursiveFont:
+        return preferences()->cursiveFontFamily();
+    case FantasyFont:
+        return preferences()->fantasyFontFamily();
     default:
         return QString();
     }
@@ -224,14 +229,14 @@ void QWebPreferencesPrivate::setFontSize(QWebPreferencesPrivate::FontSizeType ty
 {
     switch (type) {
     case MinimumFontSize:
-         WKPreferencesSetMinimumFontSize(preferencesRef(), size);
-         break;
+        preferences()->setMinimumFontSize(size);
+        break;
     case DefaultFontSize:
-         WKPreferencesSetDefaultFontSize(preferencesRef(), size);
-         break;
+        preferences()->setDefaultFontSize(size);
+        break;
     case DefaultFixedFontSize:
-         WKPreferencesSetDefaultFixedFontSize(preferencesRef(), size);
-         break;
+        preferences()->setDefaultFixedFontSize(size);
+        break;
     default:
         ASSERT_NOT_REACHED();
     }
@@ -241,11 +246,11 @@ unsigned QWebPreferencesPrivate::fontSize(QWebPreferencesPrivate::FontSizeType t
 {
     switch (type) {
     case MinimumFontSize:
-         return WKPreferencesGetMinimumFontSize(preferencesRef());
+        return preferences()->minimumFontSize();
     case DefaultFontSize:
-         return WKPreferencesGetDefaultFontSize(preferencesRef());
+        return preferences()->defaultFontSize();
     case DefaultFixedFontSize:
-         return WKPreferencesGetDefaultFixedFontSize(preferencesRef());
+        return preferences()->defaultFixedFontSize();
     default:
         ASSERT_NOT_REACHED();
         return false;
@@ -541,10 +546,50 @@ void QWebPreferences::setWebAudioEnabled(bool enable)
 #endif
 }
 
-WKPreferencesRef QWebPreferencesPrivate::preferencesRef() const
+bool QWebPreferences::scrollAnimatorEnabled() const
+{
+#if ENABLE(SMOOTH_SCROLLING)
+    return d->testAttribute(QWebPreferencesPrivate::ScrollAnimatorEnabled);
+#else
+    return false;
+#endif
+}
+
+void QWebPreferences::setScrollAnimatorEnabled(bool enable)
+{
+#if ENABLE(SMOOTH_SCROLLING)
+    d->setAttribute(QWebPreferencesPrivate::ScrollAnimatorEnabled, enable);
+    emit scrollAnimatorEnabledChanged();
+#else
+    UNUSED_PARAM(enable);
+#endif
+}
+
+bool QWebPreferences::caretBrowsingEnabled() const
+{
+    return d->testAttribute(QWebPreferencesPrivate::CaretBrowsingEnabled);
+}
+
+void QWebPreferences::setCaretBrowsingEnabled(bool enable)
+{
+    d->setAttribute(QWebPreferencesPrivate::CaretBrowsingEnabled, enable);
+    emit caretBrowsingEnabledChanged();
+}
+
+bool QWebPreferences::notificationsEnabled() const
+{
+    return d->testAttribute(QWebPreferencesPrivate::NotificationsEnabled);
+}
+
+void QWebPreferences::setNotificationsEnabled(bool enable)
+{
+    d->setAttribute(QWebPreferencesPrivate::NotificationsEnabled, enable);
+    emit notificationsEnabledChanged();
+}
+
+WebKit::WebPreferences* QWebPreferencesPrivate::preferences() const
 {
-    WKPageGroupRef pageGroupRef = toAPI(webViewPrivate->webPageProxy->pageGroup());
-    return WKPageGroupGetPreferences(pageGroupRef);
+    return webViewPrivate->webPageProxy->pageGroup()->preferences();
 }
 
 QWebPreferencesPrivate* QWebPreferencesPrivate::get(QWebPreferences* preferences)
diff --git a/Source/WebKit2/UIProcess/API/qt/qwebpreferences_p.h b/Source/WebKit2/UIProcess/API/qt/qwebpreferences_p.h
index 373df7504..e3fab79ab 100644
--- a/Source/WebKit2/UIProcess/API/qt/qwebpreferences_p.h
+++ b/Source/WebKit2/UIProcess/API/qt/qwebpreferences_p.h
@@ -45,6 +45,9 @@ public:
     Q_PROPERTY(bool developerExtrasEnabled READ developerExtrasEnabled WRITE setDeveloperExtrasEnabled NOTIFY developerExtrasEnabledChanged FINAL)
     Q_PROPERTY(bool webGLEnabled READ webGLEnabled WRITE setWebGLEnabled NOTIFY webGLEnabledChanged FINAL)
     Q_PROPERTY(bool webAudioEnabled READ webAudioEnabled WRITE setWebAudioEnabled NOTIFY webAudioEnabledChanged FINAL)
+    Q_PROPERTY(bool scrollAnimatorEnabled READ scrollAnimatorEnabled WRITE setScrollAnimatorEnabled NOTIFY scrollAnimatorEnabledChanged FINAL)
+    Q_PROPERTY(bool caretBrowsingEnabled READ caretBrowsingEnabled WRITE setCaretBrowsingEnabled NOTIFY caretBrowsingEnabledChanged FINAL)
+    Q_PROPERTY(bool notificationsEnabled READ notificationsEnabled WRITE setNotificationsEnabled NOTIFY notificationsEnabledChanged FINAL)
 
     Q_PROPERTY(QString standardFontFamily READ standardFontFamily WRITE setStandardFontFamily NOTIFY standardFontFamilyChanged FINAL)
     Q_PROPERTY(QString fixedFontFamily READ fixedFontFamily WRITE setFixedFontFamily NOTIFY fixedFontFamilyChanged FINAL)
@@ -99,6 +102,15 @@ public:
     bool webAudioEnabled() const;
     void setWebAudioEnabled(bool enable);
 
+    bool scrollAnimatorEnabled() const;
+    void setScrollAnimatorEnabled(bool enable);
+
+    bool caretBrowsingEnabled() const;
+    void setCaretBrowsingEnabled(bool enable);
+
+    bool notificationsEnabled() const;
+    void setNotificationsEnabled(bool enable);
+
     QString standardFontFamily() const;
     void setStandardFontFamily(const QString& family);
 
@@ -141,6 +153,9 @@ Q_SIGNALS:
     void developerExtrasEnabledChanged();
     void webGLEnabledChanged();
     void webAudioEnabledChanged();
+    void scrollAnimatorEnabledChanged();
+    void caretBrowsingEnabledChanged();
+    void notificationsEnabledChanged();
 
     void standardFontFamilyChanged();
     void fixedFontFamilyChanged();
diff --git a/Source/WebKit2/UIProcess/API/qt/qwebpreferences_p_p.h b/Source/WebKit2/UIProcess/API/qt/qwebpreferences_p_p.h
index c606bbe89..c8098b50e 100644
--- a/Source/WebKit2/UIProcess/API/qt/qwebpreferences_p_p.h
+++ b/Source/WebKit2/UIProcess/API/qt/qwebpreferences_p_p.h
@@ -20,7 +20,7 @@
 #ifndef qwebpreferences_p_p_h
 #define qwebpreferences_p_p_h
 
-#include "WKPreferences.h"
+#include "WebPreferences.h"
 
 class QQuickWebViewPrivate;
 
@@ -41,7 +41,10 @@ public:
         DeveloperExtrasEnabled,
         WebGLEnabled,
         CSSCustomFilterEnabled,
-        WebAudioEnabled
+        WebAudioEnabled,
+        ScrollAnimatorEnabled,
+        CaretBrowsingEnabled,
+        NotificationsEnabled
     };
 
     enum FontFamily {
@@ -71,7 +74,7 @@ public:
     void setFontSize(FontSizeType type, unsigned size);
     unsigned fontSize(FontSizeType type) const;
 
-    WKPreferencesRef preferencesRef() const;
+    WebKit::WebPreferences* preferences() const;
 
     QQuickWebViewPrivate* webViewPrivate;
 
diff --git a/Source/WebKit2/UIProcess/API/qt/tests/qmltests/WebView/tst_fitToView.qml b/Source/WebKit2/UIProcess/API/qt/tests/qmltests/WebView/tst_fitToView.qml
index fcd3d9301..01192a8af 100644
--- a/Source/WebKit2/UIProcess/API/qt/tests/qmltests/WebView/tst_fitToView.qml
+++ b/Source/WebKit2/UIProcess/API/qt/tests/qmltests/WebView/tst_fitToView.qml
@@ -93,5 +93,39 @@ Item {
             compare(documentSize(), "960x1440")
             compare(test.contentsScale, 1.0)
         }
+
+        function test_localPageDeviceWidth() {
+            webView.url = "about:blank"
+            verify(webView.waitForLoadSucceeded())
+
+            webView.url = "../common/test5.html"
+            verify(webView.waitForLoadSucceeded())
+            compare(test.contentsScale, 0.5)
+
+            // Add user interaction.
+            test.touchTap(webView, 10, 10)
+
+            webView.reload()
+            verify(webView.waitForLoadSucceeded())
+            // The page should still fit to view after a reload
+            compare(test.contentsScale, 0.5)
+        }
+
+        function test_localPageInitialScale() {
+            webView.url = "about:blank"
+            verify(webView.waitForLoadSucceeded())
+
+            webView.url = "../common/test4.html"
+            verify(webView.waitForLoadSucceeded())
+
+            compare(test.contentsScale, 2.0)
+
+            // Add user interaction.
+            test.touchTap(webView, 10, 10)
+
+            webView.reload()
+            verify(webView.waitForLoadSucceeded())
+            compare(test.contentsScale, 2.0)
+        }
     }
 }
diff --git a/Source/WebKit2/UIProcess/API/qt/tests/qmltests/common/test4.html b/Source/WebKit2/UIProcess/API/qt/tests/qmltests/common/test4.html
index e31d689d8..8f75af606 100644
--- a/Source/WebKit2/UIProcess/API/qt/tests/qmltests/common/test4.html
+++ b/Source/WebKit2/UIProcess/API/qt/tests/qmltests/common/test4.html
@@ -9,6 +9,7 @@
                  font-size: 50px;
             }
         </style>
+        <meta name="viewport" content="initial-scale=2.0"/>
     </head>
     <body>
         <div id="content">
diff --git a/Source/WebKit2/UIProcess/API/qt/tests/qmltests/common/test5.html b/Source/WebKit2/UIProcess/API/qt/tests/qmltests/common/test5.html
new file mode 100644
index 000000000..3630ea6bd
--- /dev/null
+++ b/Source/WebKit2/UIProcess/API/qt/tests/qmltests/common/test5.html
@@ -0,0 +1,10 @@
+<html>
+  <head>
+    <title>Local page with viewport meta tag: width=device-width</title>
+    <meta name="viewport" content="width=device-width"/>
+  </head>
+  <body>
+    <style type="text/css">body {width: 960px; height: 1440px; margin: 0; padding: 0;}</style>
+    <div>blah</div>
+  </body>
+</html>
diff --git a/Source/WebKit2/UIProcess/API/qt/tests/qquickwebview/tst_qquickwebview.cpp b/Source/WebKit2/UIProcess/API/qt/tests/qquickwebview/tst_qquickwebview.cpp
index 558053729..6e2c342cb 100644
--- a/Source/WebKit2/UIProcess/API/qt/tests/qquickwebview/tst_qquickwebview.cpp
+++ b/Source/WebKit2/UIProcess/API/qt/tests/qquickwebview/tst_qquickwebview.cpp
@@ -258,11 +258,8 @@ void tst_QQuickWebView::show()
 
 void tst_QQuickWebView::showWebView()
 {
-    webView()->setSize(QSizeF(300, 400));
-
     webView()->setUrl(QUrl::fromLocalFile(QLatin1String(TESTS_SOURCE_DIR "/html/direct-image-compositing.html")));
     QVERIFY(waitForLoadSucceeded(webView()));
-
     m_window->show();
     // This should not crash.
     webView()->setVisible(true);
@@ -295,13 +292,11 @@ void tst_QQuickWebView::multipleWebViewWindows()
     QQuickWebView* webView2 = newWebView();
     QScopedPointer<TestWindow> window2(new TestWindow(webView2));
 
-    webView1->setSize(QSizeF(300, 400));
     webView1->setUrl(QUrl::fromLocalFile(QLatin1String(TESTS_SOURCE_DIR "/html/scroll.html")));
     QVERIFY(waitForLoadSucceeded(webView1));
     window1->show();
     webView1->setVisible(true);
 
-    webView2->setSize(QSizeF(300, 400));
     webView2->setUrl(QUrl::fromLocalFile(QLatin1String(TESTS_SOURCE_DIR "/html/basic_page.html")));
     QVERIFY(waitForLoadSucceeded(webView2));
     window2->show();
@@ -334,14 +329,10 @@ void tst_QQuickWebView::multipleWebViews()
 void tst_QQuickWebView::basicRenderingSanity()
 {
     showWebView();
-    webView()->setSize(QSizeF(300, 400));
 
     webView()->setUrl(QUrl(QString::fromUtf8("data:text/html,<html><body bgcolor=\"#00ff00\"></body></html>")));
     QVERIFY(waitForLoadSucceeded(webView()));
 
-    // We have to explicitly move the window into the screen, otherwise it's not rendered.
-    m_window->setGeometry(0, 0, 300, 400);
-    m_window->show();
     // This should not crash.
     webView()->setVisible(true);
     QTest::qWait(200);
diff --git a/Source/WebKit2/UIProcess/API/qt/tests/testwindow.h b/Source/WebKit2/UIProcess/API/qt/tests/testwindow.h
index 4b2cfcf11..9d5d656e9 100644
--- a/Source/WebKit2/UIProcess/API/qt/tests/testwindow.h
+++ b/Source/WebKit2/UIProcess/API/qt/tests/testwindow.h
@@ -44,6 +44,7 @@ inline TestWindow::TestWindow(QQuickItem* webView)
 {
     Q_ASSERT(webView);
     webView->setParentItem(contentItem());
+    resize(300, 400);
 }
 
 inline void TestWindow::resizeEvent(QResizeEvent* event)
diff --git a/Source/WebKit2/UIProcess/CoordinatedGraphics/LayerTreeCoordinatorProxy.cpp b/Source/WebKit2/UIProcess/CoordinatedGraphics/LayerTreeCoordinatorProxy.cpp
index 1953afb61..4d43feb81 100644
--- a/Source/WebKit2/UIProcess/CoordinatedGraphics/LayerTreeCoordinatorProxy.cpp
+++ b/Source/WebKit2/UIProcess/CoordinatedGraphics/LayerTreeCoordinatorProxy.cpp
@@ -64,22 +64,9 @@ void LayerTreeCoordinatorProxy::createTileForLayer(int layerID, int tileID, cons
 
 void LayerTreeCoordinatorProxy::updateTileForLayer(int layerID, int tileID, const IntRect& targetRect, const WebKit::SurfaceUpdateInfo& updateInfo)
 {
-    RefPtr<ShareableSurface> surface;
-#if USE(GRAPHICS_SURFACE)
-    GraphicsSurfaceToken token = updateInfo.surfaceHandle.graphicsSurfaceToken();
-    if (token.isValid()) {
-        HashMap<GraphicsSurfaceToken::BufferHandle, RefPtr<ShareableSurface> >::iterator it = m_surfaces.find(token.frontBufferHandle);
-        if (it == m_surfaces.end()) {
-            surface = ShareableSurface::create(updateInfo.surfaceHandle);
-            m_surfaces.add(token.frontBufferHandle, surface);
-        } else
-            surface = it->value;
-    } else
-        surface = ShareableSurface::create(updateInfo.surfaceHandle);
-#else
-    surface = ShareableSurface::create(updateInfo.surfaceHandle);
-#endif
-    dispatchUpdate(bind(&LayerTreeRenderer::updateTile, m_renderer.get(), layerID, tileID, LayerTreeRenderer::TileUpdate(updateInfo.updateRect, targetRect, surface, updateInfo.surfaceOffset)));
+    SurfaceMap::iterator it = m_surfaces.find(updateInfo.atlasID);
+    ASSERT(it != m_surfaces.end());
+    dispatchUpdate(bind(&LayerTreeRenderer::updateTile, m_renderer.get(), layerID, tileID, LayerTreeRenderer::TileUpdate(updateInfo.updateRect, targetRect, it->value, updateInfo.surfaceOffset)));
 }
 
 void LayerTreeCoordinatorProxy::removeTileForLayer(int layerID, int tileID)
@@ -87,6 +74,18 @@ void LayerTreeCoordinatorProxy::removeTileForLayer(int layerID, int tileID)
     dispatchUpdate(bind(&LayerTreeRenderer::removeTile, m_renderer.get(), layerID, tileID));
 }
 
+void LayerTreeCoordinatorProxy::createUpdateAtlas(int atlasID, const ShareableSurface::Handle& handle)
+{
+    ASSERT(!m_surfaces.contains(atlasID));
+    m_surfaces.add(atlasID, ShareableSurface::create(handle));
+}
+
+void LayerTreeCoordinatorProxy::removeUpdateAtlas(int atlasID)
+{
+    ASSERT(m_surfaces.contains(atlasID));
+    m_surfaces.remove(atlasID);
+}
+
 void LayerTreeCoordinatorProxy::deleteCompositingLayer(WebLayerID id)
 {
     dispatchUpdate(bind(&LayerTreeRenderer::deleteLayer, m_renderer.get(), id));
@@ -120,7 +119,7 @@ void LayerTreeCoordinatorProxy::didRenderFrame(const WebCore::IntSize& contentsS
 {
     dispatchUpdate(bind(&LayerTreeRenderer::flushLayerChanges, m_renderer.get()));
     updateViewport();
-#if PLATFORM(QT)
+#if USE(TILED_BACKING_STORE)
     m_drawingAreaProxy->page()->didRenderFrame(contentsSize, coveredRect);
 #else
     UNUSED_PARAM(contentsSize);
@@ -144,14 +143,14 @@ void LayerTreeCoordinatorProxy::setContentsSize(const FloatSize& contentsSize)
     dispatchUpdate(bind(&LayerTreeRenderer::setContentsSize, m_renderer.get(), contentsSize));
 }
 
-void LayerTreeCoordinatorProxy::setLayerAnimatedOpacity(uint32_t id, float opacity)
+void LayerTreeCoordinatorProxy::setLayerAnimations(WebLayerID id, const GraphicsLayerAnimations& animations)
 {
-    dispatchUpdate(bind(&LayerTreeRenderer::setAnimatedOpacity, m_renderer.get(), id, opacity));
+    dispatchUpdate(bind(&LayerTreeRenderer::setLayerAnimations, m_renderer.get(), id, animations));
 }
 
-void LayerTreeCoordinatorProxy::setLayerAnimatedTransform(uint32_t id, const WebCore::TransformationMatrix& transform)
+void LayerTreeCoordinatorProxy::setAnimationsLocked(bool locked)
 {
-    dispatchUpdate(bind(&LayerTreeRenderer::setAnimatedTransform, m_renderer.get(), id, transform));
+    dispatchUpdate(bind(&LayerTreeRenderer::setAnimationsLocked, m_renderer.get(), locked));
 }
 
 void LayerTreeCoordinatorProxy::setVisibleContentsRect(const FloatRect& rect, float scale, const FloatPoint& trajectoryVector)
@@ -175,6 +174,19 @@ void LayerTreeCoordinatorProxy::renderNextFrame()
     m_drawingAreaProxy->page()->process()->send(Messages::LayerTreeCoordinator::RenderNextFrame(), m_drawingAreaProxy->page()->pageID());
 }
 
+#if ENABLE(REQUEST_ANIMATION_FRAME)
+void LayerTreeCoordinatorProxy::requestAnimationFrame()
+{
+    dispatchUpdate(bind(&LayerTreeRenderer::requestAnimationFrame, m_renderer.get()));
+    updateViewport();
+}
+
+void LayerTreeCoordinatorProxy::animationFrameReady()
+{
+    m_drawingAreaProxy->page()->process()->send(Messages::LayerTreeCoordinator::AnimationFrameReady(), m_drawingAreaProxy->page()->pageID());
+}
+#endif
+
 void LayerTreeCoordinatorProxy::didChangeScrollPosition(const IntPoint& position)
 {
     dispatchUpdate(bind(&LayerTreeRenderer::didChangeScrollPosition, m_renderer.get(), position));
diff --git a/Source/WebKit2/UIProcess/CoordinatedGraphics/LayerTreeCoordinatorProxy.h b/Source/WebKit2/UIProcess/CoordinatedGraphics/LayerTreeCoordinatorProxy.h
index 3738ea4c3..646801168 100644
--- a/Source/WebKit2/UIProcess/CoordinatedGraphics/LayerTreeCoordinatorProxy.h
+++ b/Source/WebKit2/UIProcess/CoordinatedGraphics/LayerTreeCoordinatorProxy.h
@@ -26,10 +26,12 @@
 #include "CoordinatedGraphicsArgumentCoders.h"
 #include "DrawingAreaProxy.h"
 #include "Region.h"
+#include "ShareableSurface.h"
 #include "SurfaceUpdateInfo.h"
 #include "WebLayerTreeInfo.h"
 #include <WebCore/GraphicsContext.h>
 #include <WebCore/GraphicsLayer.h>
+#include <WebCore/GraphicsLayerAnimation.h>
 #include <WebCore/GraphicsSurfaceToken.h>
 #include <WebCore/IntRect.h>
 #include <WebCore/IntSize.h>
@@ -38,12 +40,6 @@
 #include <wtf/Functional.h>
 #include <wtf/HashSet.h>
 
-#if PLATFORM(QT)
-QT_BEGIN_NAMESPACE
-class QSGNode;
-QT_END_NAMESPACE
-#endif
-
 namespace WebKit {
 
 class WebLayerInfo;
@@ -51,9 +47,11 @@ class LayerTreeRenderer;
 class WebLayerUpdateInfo;
 
 class LayerTreeCoordinatorProxy {
+    WTF_MAKE_NONCOPYABLE(LayerTreeCoordinatorProxy);
+    WTF_MAKE_FAST_ALLOCATED;
 public:
-    LayerTreeCoordinatorProxy(DrawingAreaProxy*);
-    virtual ~LayerTreeCoordinatorProxy();
+    explicit LayerTreeCoordinatorProxy(DrawingAreaProxy*);
+    ~LayerTreeCoordinatorProxy();
     void setCompositingLayerState(WebLayerID, const WebLayerInfo&);
     void setCompositingLayerChildren(WebLayerID, const Vector<WebLayerID>&);
 #if ENABLE(CSS_FILTERS)
@@ -61,14 +59,14 @@ public:
 #endif
     void deleteCompositingLayer(WebLayerID);
     void setRootCompositingLayer(WebLayerID);
-    void didReceiveMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::MessageDecoder&);
-    void purgeGLResources();
     void setContentsSize(const WebCore::FloatSize&);
     void setVisibleContentsRect(const WebCore::FloatRect&, float scale, const WebCore::FloatPoint& trajectoryVector);
     void didRenderFrame(const WebCore::IntSize& contentsSize, const WebCore::IntRect& coveredRect);
     void createTileForLayer(int layerID, int tileID, const WebCore::IntRect&, const SurfaceUpdateInfo&);
     void updateTileForLayer(int layerID, int tileID, const WebCore::IntRect&, const SurfaceUpdateInfo&);
     void removeTileForLayer(int layerID, int tileID);
+    void createUpdateAtlas(int atlasID, const ShareableSurface::Handle&);
+    void removeUpdateAtlas(int atlasID);
     void createDirectlyCompositedImage(int64_t, const WebKit::ShareableBitmap::Handle&);
     void destroyDirectlyCompositedImage(int64_t);
     void didReceiveLayerTreeCoordinatorProxyMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::MessageDecoder&);
@@ -80,8 +78,12 @@ public:
 #endif
     void purgeBackingStores();
     LayerTreeRenderer* layerTreeRenderer() const { return m_renderer.get(); }
-    void setLayerAnimatedOpacity(uint32_t, float);
-    void setLayerAnimatedTransform(uint32_t, const WebCore::TransformationMatrix&);
+    void setLayerAnimations(WebLayerID, const WebCore::GraphicsLayerAnimations&);
+    void setAnimationsLocked(bool);
+#if ENABLE(REQUEST_ANIMATION_FRAME)
+    void requestAnimationFrame();
+    void animationFrameReady();
+#endif
 
 protected:
     void dispatchUpdate(const Function<void()>&);
@@ -91,9 +93,8 @@ protected:
     WebCore::IntRect m_lastSentVisibleRect;
     float m_lastSentScale;
     WebCore::FloatPoint m_lastSentTrajectoryVector;
-#if USE(GRAPHICS_SURFACE)
-    HashMap<WebCore::GraphicsSurfaceToken::BufferHandle, RefPtr<ShareableSurface> > m_surfaces;
-#endif
+    typedef HashMap<int /* atlasID */, RefPtr<ShareableSurface> > SurfaceMap;
+    SurfaceMap m_surfaces;
 };
 
 }
diff --git a/Source/WebKit2/UIProcess/CoordinatedGraphics/LayerTreeCoordinatorProxy.messages.in b/Source/WebKit2/UIProcess/CoordinatedGraphics/LayerTreeCoordinatorProxy.messages.in
index b73960021..ba88de53f 100644
--- a/Source/WebKit2/UIProcess/CoordinatedGraphics/LayerTreeCoordinatorProxy.messages.in
+++ b/Source/WebKit2/UIProcess/CoordinatedGraphics/LayerTreeCoordinatorProxy.messages.in
@@ -29,14 +29,21 @@ messages -> LayerTreeCoordinatorProxy {
     CreateTileForLayer(uint32_t layerID, int tileID, WebCore::IntRect targetRect, WebKit::SurfaceUpdateInfo updateInfo)
     UpdateTileForLayer(uint32_t layerID, int tileID, WebCore::IntRect targetRect, WebKit::SurfaceUpdateInfo updateInfo)
     RemoveTileForLayer(uint32_t layerID, int tileID)
+    CreateUpdateAtlas(int atlasID, WebKit::ShareableSurface::Handle handle)
+    RemoveUpdateAtlas(int atlasID)
     CreateDirectlyCompositedImage(int64_t key, WebKit::ShareableBitmap::Handle handle)
     DestroyDirectlyCompositedImage(int64_t key)
     DidRenderFrame(WebCore::IntSize contentsSize, WebCore::IntRect coveredRect)
     DidChangeScrollPosition(WebCore::IntPoint position)
+    SetLayerAnimations(uint32_t id, WebCore::GraphicsLayerAnimations animations)
+    SetAnimationsLocked(bool locked)
+
+#if ENABLE(REQUEST_ANIMATION_FRAME)
+    RequestAnimationFrame()
+#endif
+
 #if USE(GRAPHICS_SURFACE)
     SyncCanvas(uint32_t id, WebCore::IntSize canvasSize, WebCore::GraphicsSurfaceToken token, uint32_t frontBuffer)
 #endif
-    SetLayerAnimatedOpacity(uint32_t id, float opacity)
-    SetLayerAnimatedTransform(uint32_t id, WebCore::TransformationMatrix transform)
 }
 #endif
diff --git a/Source/WebKit2/UIProcess/CoordinatedGraphics/LayerTreeRenderer.cpp b/Source/WebKit2/UIProcess/CoordinatedGraphics/LayerTreeRenderer.cpp
index 82e58f3f2..bd92f7249 100644
--- a/Source/WebKit2/UIProcess/CoordinatedGraphics/LayerTreeRenderer.cpp
+++ b/Source/WebKit2/UIProcess/CoordinatedGraphics/LayerTreeRenderer.cpp
@@ -88,6 +88,10 @@ LayerTreeRenderer::LayerTreeRenderer(LayerTreeCoordinatorProxy* layerTreeCoordin
     : m_layerTreeCoordinatorProxy(layerTreeCoordinatorProxy)
     , m_rootLayerID(InvalidWebLayerID)
     , m_isActive(false)
+    , m_animationsLocked(false)
+#if ENABLE(REQUEST_ANIMATION_FRAME)
+    , m_animationFrameRequested(false)
+#endif
 {
 }
 
@@ -120,6 +124,8 @@ void LayerTreeRenderer::paintToCurrentGLContext(const TransformationMatrix& matr
         return;
 
     layer->setTextureMapper(m_textureMapper.get());
+    if (!m_animationsLocked)
+        layer->applyAnimationsRecursively();
     m_textureMapper->beginPainting(PaintFlags);
     m_textureMapper->beginClip(TransformationMatrix(), clipRect);
 
@@ -132,8 +138,31 @@ void LayerTreeRenderer::paintToCurrentGLContext(const TransformationMatrix& matr
     layer->paint();
     m_textureMapper->endClip();
     m_textureMapper->endPainting();
+
+    if (layer->descendantsOrSelfHaveRunningAnimations())
+        dispatchOnMainThread(bind(&LayerTreeRenderer::updateViewport, this));
+
+#if ENABLE(REQUEST_ANIMATION_FRAME)
+    if (m_animationFrameRequested) {
+        m_animationFrameRequested = false;
+        dispatchOnMainThread(bind(&LayerTreeRenderer::animationFrameReady, this));
+    }
+#endif
+}
+
+#if ENABLE(REQUEST_ANIMATION_FRAME)
+void LayerTreeRenderer::animationFrameReady()
+{
+    if (m_layerTreeCoordinatorProxy)
+        m_layerTreeCoordinatorProxy->animationFrameReady();
 }
 
+void LayerTreeRenderer::requestAnimationFrame()
+{
+    m_animationFrameRequested = true;
+}
+#endif
+
 void LayerTreeRenderer::paintToGraphicsContext(BackingStore::PlatformGraphicsContext painter)
 {
     if (!m_textureMapper)
@@ -393,6 +422,9 @@ void LayerTreeRenderer::flushLayerChanges()
 {
     m_renderedContentsScrollPosition = m_pendingRenderedContentsScrollPosition;
 
+    // Since the frame has now been rendered, we can safely unlock the animations until the next layout.
+    setAnimationsLocked(false);
+
     m_rootLayer->flushCompositingState(FloatRect());
     commitTileOperations();
 
@@ -430,8 +462,16 @@ void LayerTreeRenderer::syncRemoteContent()
     // We enqueue messages and execute them during paint, as they require an active GL context.
     ensureRootLayer();
 
-    for (size_t i = 0; i < m_renderQueue.size(); ++i)
-        m_renderQueue[i]();
+    Vector<Function<void()> > renderQueue;
+    bool calledOnMainThread = WTF::isMainThread();
+    if (!calledOnMainThread)
+        m_renderQueueMutex.lock();
+    renderQueue.swap(m_renderQueue);
+    if (!calledOnMainThread)
+        m_renderQueueMutex.unlock();
+
+    for (size_t i = 0; i < renderQueue.size(); ++i)
+        renderQueue[i]();
 
     m_renderQueue.clear();
 }
@@ -461,20 +501,17 @@ void LayerTreeRenderer::purgeGLResources()
     dispatchOnMainThread(bind(&LayerTreeRenderer::purgeBackingStores, this));
 }
 
-void LayerTreeRenderer::setAnimatedOpacity(uint32_t id, float opacity)
+void LayerTreeRenderer::setLayerAnimations(WebLayerID id, const GraphicsLayerAnimations& animations)
 {
-    GraphicsLayer* layer = layerByID(id);
-    ASSERT(layer);
-
-    layer->setOpacity(opacity);
+    GraphicsLayerTextureMapper* layer = toGraphicsLayerTextureMapper(layerByID(id));
+    if (!layer)
+        return;
+    layer->setAnimations(animations);
 }
 
-void LayerTreeRenderer::setAnimatedTransform(uint32_t id, const WebCore::TransformationMatrix& transform)
+void LayerTreeRenderer::setAnimationsLocked(bool locked)
 {
-    GraphicsLayer* layer = layerByID(id);
-    ASSERT(layer);
-
-    layer->setTransform(transform);
+    m_animationsLocked = locked;
 }
 
 void LayerTreeRenderer::purgeBackingStores()
@@ -493,6 +530,8 @@ void LayerTreeRenderer::appendUpdate(const Function<void()>& function)
     if (!m_isActive)
         return;
 
+    ASSERT(isMainThread());
+    MutexLocker locker(m_renderQueueMutex);
     m_renderQueue.append(function);
 }
 
diff --git a/Source/WebKit2/UIProcess/CoordinatedGraphics/LayerTreeRenderer.h b/Source/WebKit2/UIProcess/CoordinatedGraphics/LayerTreeRenderer.h
index 0a6ae3b88..ebe4ca391 100644
--- a/Source/WebKit2/UIProcess/CoordinatedGraphics/LayerTreeRenderer.h
+++ b/Source/WebKit2/UIProcess/CoordinatedGraphics/LayerTreeRenderer.h
@@ -28,6 +28,7 @@
 #include "WebLayerTreeInfo.h"
 #include <WebCore/GraphicsContext.h>
 #include <WebCore/GraphicsLayer.h>
+#include <WebCore/GraphicsLayerAnimation.h>
 #include <WebCore/GraphicsSurface.h>
 #include <WebCore/IntRect.h>
 #include <WebCore/IntSize.h>
@@ -59,7 +60,7 @@ public:
         {
         }
     };
-    LayerTreeRenderer(LayerTreeCoordinatorProxy*);
+    explicit LayerTreeRenderer(LayerTreeCoordinatorProxy*);
     virtual ~LayerTreeRenderer();
     void purgeGLResources();
     void paintToCurrentGLContext(const WebCore::TransformationMatrix&, float, const WebCore::FloatRect&, WebCore::TextureMapper::PaintFlags = 0);
@@ -74,7 +75,6 @@ public:
 
     void detach();
     void appendUpdate(const Function<void()>&);
-    void updateViewport();
     void setActive(bool);
 
     void deleteLayer(WebLayerID);
@@ -91,8 +91,13 @@ public:
     void flushLayerChanges();
     void createImage(int64_t, PassRefPtr<ShareableBitmap>);
     void destroyImage(int64_t);
-    void setAnimatedOpacity(uint32_t, float);
-    void setAnimatedTransform(uint32_t, const WebCore::TransformationMatrix&);
+    void setLayerAnimations(WebLayerID, const WebCore::GraphicsLayerAnimations&);
+    void setAnimationsLocked(bool);
+
+#if ENABLE(REQUEST_ANIMATION_FRAME)
+    void requestAnimationFrame();
+    void animationFrameReady();
+#endif
 
 private:
     PassOwnPtr<WebCore::GraphicsLayer> createLayer(WebLayerID);
@@ -103,18 +108,25 @@ private:
     // Reimplementations from WebCore::GraphicsLayerClient.
     virtual void notifyAnimationStarted(const WebCore::GraphicsLayer*, double) { }
     virtual void notifyFlushRequired(const WebCore::GraphicsLayer*) { }
-    virtual bool showDebugBorders(const WebCore::GraphicsLayer*) const { return false; }
-    virtual bool showRepaintCounter(const WebCore::GraphicsLayer*) const { return false; }
     void paintContents(const WebCore::GraphicsLayer*, WebCore::GraphicsContext&, WebCore::GraphicsLayerPaintingPhase, const WebCore::IntRect&) { }
+    void updateViewport();
     void dispatchOnMainThread(const Function<void()>&);
     void adjustPositionForFixedLayers();
 
+    void assignImageToLayer(WebCore::GraphicsLayer*, int64_t imageID);
+    void ensureRootLayer();
+    void ensureLayer(WebLayerID);
+    void commitTileOperations();
+    void renderNextFrame();
+    void purgeBackingStores();
+
     typedef HashMap<WebLayerID, WebCore::GraphicsLayer*> LayerMap;
     WebCore::FloatSize m_contentsSize;
     WebCore::FloatRect m_visibleContentsRect;
 
     // Render queue can be accessed ony from main thread or updatePaintNode call stack!
     Vector<Function<void()> > m_renderQueue;
+    Mutex m_renderQueueMutex;
 
 #if USE(TEXTURE_MAPPER)
     OwnPtr<WebCore::TextureMapper> m_textureMapper;
@@ -127,19 +139,8 @@ private:
     SurfaceBackingStoreMap m_surfaceBackingStores;
 #endif
 
-    void scheduleWebViewUpdate();
-    void synchronizeViewport();
-    void assignImageToLayer(WebCore::GraphicsLayer*, int64_t imageID);
-    void ensureRootLayer();
-    void ensureLayer(WebLayerID);
-    void commitTileOperations();
-    void syncAnimations();
-    void renderNextFrame();
-    void purgeBackingStores();
-
     LayerTreeCoordinatorProxy* m_layerTreeCoordinatorProxy;
     OwnPtr<WebCore::GraphicsLayer> m_rootLayer;
-    Vector<WebLayerID> m_layersToDelete;
 
     LayerMap m_layers;
     LayerMap m_fixedLayers;
@@ -147,6 +148,10 @@ private:
     WebCore::IntPoint m_renderedContentsScrollPosition;
     WebCore::IntPoint m_pendingRenderedContentsScrollPosition;
     bool m_isActive;
+    bool m_animationsLocked;
+#if ENABLE(REQUEST_ANIMATION_FRAME)
+    bool m_animationFrameRequested;
+#endif
 };
 
 };
diff --git a/Source/WebKit2/UIProcess/DrawingAreaProxy.h b/Source/WebKit2/UIProcess/DrawingAreaProxy.h
index 450816a34..74a87a455 100644
--- a/Source/WebKit2/UIProcess/DrawingAreaProxy.h
+++ b/Source/WebKit2/UIProcess/DrawingAreaProxy.h
@@ -35,14 +35,6 @@
 #include <stdint.h>
 #include <wtf/Noncopyable.h>
 
-#if PLATFORM(QT)
-QT_BEGIN_NAMESPACE
-class QPainter;
-QT_END_NAMESPACE
-#elif PLATFORM(GTK)
-typedef struct _cairo cairo_t;
-#endif
-
 namespace CoreIPC {
     class Connection;
     class MessageDecoder;
@@ -94,12 +86,8 @@ public:
     virtual void updateViewport();
     virtual WebCore::IntRect viewportVisibleRect() const { return contentsRect(); }
     virtual WebCore::IntRect contentsRect() const;
-    virtual bool isBackingStoreReady() const { return true; }
     LayerTreeCoordinatorProxy* layerTreeCoordinatorProxy() const { return m_layerTreeCoordinatorProxy.get(); }
     virtual void setVisibleContentsRect(const WebCore::FloatRect& /* visibleContentsRect */, float /* scale */, const WebCore::FloatPoint& /* trajectoryVector */) { }
-    virtual void createTileForLayer(int /* layerID */, int /* tileID */, const WebKit::UpdateInfo&) { }
-    virtual void updateTileForLayer(int /* layerID */, int /* tileID */, const WebKit::UpdateInfo&) { }
-    virtual void removeTileForLayer(int /* layerID */, int /* tileID */) { }
     virtual void didReceiveLayerTreeCoordinatorProxyMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::MessageDecoder&);
 
     WebPageProxy* page() { return m_webPageProxy; }
diff --git a/Source/WebKit2/UIProcess/Launcher/ProcessLauncher.cpp b/Source/WebKit2/UIProcess/Launcher/ProcessLauncher.cpp
index ee4e3c38b..31f0de425 100644
--- a/Source/WebKit2/UIProcess/Launcher/ProcessLauncher.cpp
+++ b/Source/WebKit2/UIProcess/Launcher/ProcessLauncher.cpp
@@ -77,8 +77,10 @@ const char* ProcessLauncher::processTypeAsString(ProcessType processType)
     case PluginProcess:
         return "pluginprocess";
 #endif
+#if ENABLE(NETWORK_PROCESS)
     case NetworkProcess:
         return "networkprocess";
+#endif
 #if ENABLE(SHARED_WORKER_PROCESS)
     case SharedWorkerProcess:
         return "sharedworkerprocess";
@@ -103,10 +105,12 @@ bool ProcessLauncher::getProcessTypeFromString(const char* string, ProcessType&
     }
 #endif
 
+#if ENABLE(NETWORK_PROCESS)
     if (!strcmp(string, "networkprocess")) {
         processType = NetworkProcess;
         return true;
     }
+#endif
 
 #if ENABLE(SHARED_WORKER_PROCESS)
     if (!strcmp(string, "sharedworkerprocess")) {
diff --git a/Source/WebKit2/UIProcess/Launcher/ProcessLauncher.h b/Source/WebKit2/UIProcess/Launcher/ProcessLauncher.h
index dd4f45d39..3ccdf6c7c 100644
--- a/Source/WebKit2/UIProcess/Launcher/ProcessLauncher.h
+++ b/Source/WebKit2/UIProcess/Launcher/ProcessLauncher.h
@@ -51,7 +51,9 @@ public:
 #if ENABLE(PLUGIN_PROCESS)
         PluginProcess,
 #endif
+#if ENABLE(NETWORK_PROCESS)
         NetworkProcess,
+#endif
 #if ENABLE(SHARED_WORKER_PROCESS)
         SharedWorkerProcess
 #endif
diff --git a/Source/WebKit2/UIProcess/Network/NetworkProcessManager.cpp b/Source/WebKit2/UIProcess/Network/NetworkProcessManager.cpp
index 00f16f457..4340da394 100644
--- a/Source/WebKit2/UIProcess/Network/NetworkProcessManager.cpp
+++ b/Source/WebKit2/UIProcess/Network/NetworkProcessManager.cpp
@@ -28,6 +28,8 @@
 
 #include "NetworkProcessProxy.h"
 
+#if ENABLE(NETWORK_PROCESS)
+
 namespace WebKit {
 
 NetworkProcessManager& NetworkProcessManager::shared()
@@ -68,3 +70,5 @@ void NetworkProcessManager::removeNetworkProcessProxy(NetworkProcessProxy* netwo
 
 
 } // namespace WebKit
+
+#endif // ENABLE(NETWORK_PROCESS)
diff --git a/Source/WebKit2/UIProcess/Network/NetworkProcessManager.h b/Source/WebKit2/UIProcess/Network/NetworkProcessManager.h
index 08d422b25..957e45f3e 100644
--- a/Source/WebKit2/UIProcess/Network/NetworkProcessManager.h
+++ b/Source/WebKit2/UIProcess/Network/NetworkProcessManager.h
@@ -26,6 +26,8 @@
 #ifndef NetworkProcessManager_h
 #define NetworkProcessManager_h
 
+#if ENABLE(NETWORK_PROCESS)
+
 #include "Connection.h"
 #include "WebProcessProxyMessages.h"
 #include <wtf/RefCounted.h>
@@ -48,6 +50,10 @@ public:
     
     void removeNetworkProcessProxy(NetworkProcessProxy*);
 
+#if PLATFORM(MAC)
+    void setApplicationIsOccluded(bool);
+#endif
+
 private:
     NetworkProcessManager();
 
@@ -56,4 +62,6 @@ private:
 
 } // namespace WebKit
 
+#endif // ENABLE(NETWORK_PROCESS)
+
 #endif // NetworkProcessManager_h
diff --git a/Source/WebKit2/UIProcess/Network/NetworkProcessProxy.cpp b/Source/WebKit2/UIProcess/Network/NetworkProcessProxy.cpp
index d1a0135f5..1f9ce89ed 100644
--- a/Source/WebKit2/UIProcess/Network/NetworkProcessProxy.cpp
+++ b/Source/WebKit2/UIProcess/Network/NetworkProcessProxy.cpp
@@ -112,7 +112,7 @@ void NetworkProcessProxy::didClose(CoreIPC::Connection*)
     networkProcessCrashedOrFailedToLaunch();
 }
 
-void NetworkProcessProxy::didReceiveInvalidMessage(CoreIPC::Connection*, CoreIPC::MessageID)
+void NetworkProcessProxy::didReceiveInvalidMessage(CoreIPC::Connection*, CoreIPC::StringReference, CoreIPC::StringReference)
 {
 
 }
@@ -162,6 +162,11 @@ void NetworkProcessProxy::didFinishLaunching(ProcessLauncher*, CoreIPC::Connecti
         m_connection->send(Messages::NetworkProcess::CreateNetworkConnectionToWebProcess(), 0);
     
     m_numPendingConnectionRequests = 0;
+
+#if PLATFORM(MAC)
+    if (WebContext::applicationIsOccluded())
+        m_connection->send(Messages::NetworkProcess::SetApplicationIsOccluded(true), 0);
+#endif
 }
 
 } // namespace WebKit
diff --git a/Source/WebKit2/UIProcess/Network/NetworkProcessProxy.h b/Source/WebKit2/UIProcess/Network/NetworkProcessProxy.h
index 1840a8e91..13fdfd89a 100644
--- a/Source/WebKit2/UIProcess/Network/NetworkProcessProxy.h
+++ b/Source/WebKit2/UIProcess/Network/NetworkProcessProxy.h
@@ -45,6 +45,12 @@ public:
 
     void getNetworkProcessConnection(PassRefPtr<Messages::WebProcessProxy::GetNetworkProcessConnection::DelayedReply>);
 
+    bool isValid() const { return m_connection; }
+
+#if PLATFORM(MAC)
+    void setApplicationIsOccluded(bool);
+#endif
+
 private:
     NetworkProcessProxy(NetworkProcessManager*);
 
@@ -55,7 +61,7 @@ private:
     // CoreIPC::Connection::Client
     virtual void didReceiveMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::MessageDecoder&);
     virtual void didClose(CoreIPC::Connection*);
-    virtual void didReceiveInvalidMessage(CoreIPC::Connection*, CoreIPC::MessageID);
+    virtual void didReceiveInvalidMessage(CoreIPC::Connection*, CoreIPC::StringReference messageReceiverName, CoreIPC::StringReference messageName);
     virtual void syncMessageSendTimedOut(CoreIPC::Connection*);
 
     // Message handlers
diff --git a/Source/WebKit2/UIProcess/Network/mac/NetworkProcessManagerMac.mm b/Source/WebKit2/UIProcess/Network/mac/NetworkProcessManagerMac.mm
new file mode 100644
index 000000000..eaf9888a5
--- /dev/null
+++ b/Source/WebKit2/UIProcess/Network/mac/NetworkProcessManagerMac.mm
@@ -0,0 +1,43 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#import "config.h"
+#import "NetworkProcessManager.h"
+
+#if ENABLE(NETWORK_PROCESS)
+
+#import "NetworkProcessProxy.h"
+
+namespace WebKit {
+
+void NetworkProcessManager::setApplicationIsOccluded(bool applicationIsOccluded)
+{
+    if (m_networkProcess)
+        return m_networkProcess->setApplicationIsOccluded(applicationIsOccluded);
+}
+
+} // namespace WebKit
+
+#endif // ENABLE(NETWORK_PROCESS)
diff --git a/Source/WebKit2/UIProcess/Network/mac/NetworkProcessProxyMac.mm b/Source/WebKit2/UIProcess/Network/mac/NetworkProcessProxyMac.mm
index 440cc429f..02534e9b9 100644
--- a/Source/WebKit2/UIProcess/Network/mac/NetworkProcessProxyMac.mm
+++ b/Source/WebKit2/UIProcess/Network/mac/NetworkProcessProxyMac.mm
@@ -27,6 +27,7 @@
 #import "NetworkProcessProxy.h"
 
 #import "NetworkProcessCreationParameters.h"
+#import "NetworkProcessMessages.h"
 
 #if ENABLE(NETWORK_PROCESS)
 
@@ -39,6 +40,14 @@ void NetworkProcessProxy::platformInitializeNetworkProcess(NetworkProcessCreatio
     parameters.parentProcessName = [[NSProcessInfo processInfo] processName];
 }
 
+void NetworkProcessProxy::setApplicationIsOccluded(bool applicationIsOccluded)
+{
+    if (!isValid())
+        return;
+    
+    m_connection->send(Messages::NetworkProcess::SetApplicationIsOccluded(applicationIsOccluded), 0);
+}
+
 } // namespace WebKit
 
 #endif // ENABLE(NETWORK_PROCESS)
diff --git a/Source/WebKit2/UIProcess/PageClient.h b/Source/WebKit2/UIProcess/PageClient.h
index c6fb91882..9552aa1c5 100644
--- a/Source/WebKit2/UIProcess/PageClient.h
+++ b/Source/WebKit2/UIProcess/PageClient.h
@@ -116,22 +116,25 @@ public:
 
 #if USE(TILED_BACKING_STORE)
     virtual void pageDidRequestScroll(const WebCore::IntPoint&) = 0;
-#endif
-#if PLATFORM(QT)
     virtual void didRenderFrame(const WebCore::IntSize& contentsSize, const WebCore::IntRect& coveredRect) = 0;
     virtual void pageTransitionViewportReady() = 0;
+#endif
+#if PLATFORM(QT)
     virtual void didFindZoomableArea(const WebCore::IntPoint&, const WebCore::IntRect&) = 0;
     virtual void didReceiveMessageFromNavigatorQtObject(const String&) = 0;
-    virtual void updateTextInputState() = 0;
     virtual void handleAuthenticationRequiredRequest(const String& hostname, const String& realm, const String& prefilledUsername, String& username, String& password) = 0;
     virtual void handleCertificateVerificationRequest(const String& hostname, bool& ignoreErrors) = 0;
     virtual void handleProxyAuthenticationRequiredRequest(const String& hostname, uint16_t port, const String& prefilledUsername, String& username, String& password) = 0;
 #endif // PLATFORM(QT).
 
 #if PLATFORM(QT) || PLATFORM(EFL)
-    virtual void handleDownloadRequest(DownloadProxy*) = 0;
+    virtual void updateTextInputState() = 0;
 #endif // PLATFORM(QT) || PLATFORM(EFL)
 
+#if PLATFORM(QT) || PLATFORM(EFL) || PLATFORM(GTK)
+    virtual void handleDownloadRequest(DownloadProxy*) = 0;
+#endif // PLATFORM(QT) || PLATFORM(EFL) || PLATFORM(GTK)
+
 #if PLATFORM(QT) || PLATFORM(EFL)
     virtual void didChangeContentsSize(const WebCore::IntSize&) = 0;
 #endif
diff --git a/Source/WebKit2/UIProcess/PageViewportController.cpp b/Source/WebKit2/UIProcess/PageViewportController.cpp
index 88d52ba62..92091632f 100644
--- a/Source/WebKit2/UIProcess/PageViewportController.cpp
+++ b/Source/WebKit2/UIProcess/PageViewportController.cpp
@@ -22,6 +22,8 @@
 #include "config.h"
 #include "PageViewportController.h"
 
+#if USE(TILED_BACKING_STORE)
+
 #include "PageViewportControllerClient.h"
 #include "WebPageProxy.h"
 #include <WebCore/FloatRect.h>
@@ -37,34 +39,16 @@ bool fuzzyCompare(float a, float b, float epsilon)
     return std::abs(a - b) < epsilon;
 }
 
-ViewportUpdateDeferrer::ViewportUpdateDeferrer(PageViewportController* PageViewportController, SuspendContentFlag suspendContentFlag)
-    : m_controller(PageViewportController)
-{
-    m_controller->m_activeDeferrerCount++;
-
-    // There is no need to suspend content for immediate updates
-    // only during animations or longer gestures.
-    if (suspendContentFlag == DeferUpdateAndSuspendContent)
-        m_controller->suspendContent();
-}
-
-ViewportUpdateDeferrer::~ViewportUpdateDeferrer()
-{
-    if (--(m_controller->m_activeDeferrerCount))
-        return;
-
-    m_controller->resumeContent();
-}
-
 PageViewportController::PageViewportController(WebKit::WebPageProxy* proxy, PageViewportControllerClient* client)
     : m_webPageProxy(proxy)
     , m_client(client)
     , m_allowsUserScaling(false)
     , m_minimumScaleToFit(1)
-    , m_activeDeferrerCount(0)
     , m_hasSuspendedContent(false)
     , m_hadUserInteraction(false)
     , m_effectiveScale(1)
+    , m_viewportPosIsLocked(false)
+    , m_effectiveScaleIsLocked(false)
 {
     // Initializing Viewport Raw Attributes to avoid random negative or infinity scale factors
     // if there is a race condition between the first layout and setting the viewport attributes for the first time.
@@ -72,6 +56,7 @@ PageViewportController::PageViewportController(WebKit::WebPageProxy* proxy, Page
     m_rawAttributes.minimumScale = 1;
     m_rawAttributes.maximumScale = 1;
     m_rawAttributes.userScalable = m_allowsUserScaling;
+    m_rawAttributes.initiallyFitToViewport = true;
 
     ASSERT(m_client);
     m_client->setController(this);
@@ -111,6 +96,9 @@ void PageViewportController::didCommitLoad()
     // Do not count the previous committed page contents as covered.
     m_lastFrameCoveredRect = FloatRect();
 
+    // Do not continue to use the content size of the previous page.
+    m_contentsSize = IntSize();
+
     // Reset the position to the top, page/history scroll requests may override this before we re-enable rendering.
     applyPositionAfterRenderingContents(FloatPoint());
 }
@@ -157,7 +145,8 @@ void PageViewportController::pageTransitionViewportReady()
 {
     if (!m_rawAttributes.layoutSize.isEmpty()) {
         m_hadUserInteraction = false;
-        applyScaleAfterRenderingContents(innerBoundedViewportScale(toViewportScale(m_rawAttributes.initialScale)));
+        float initialScale = m_rawAttributes.initiallyFitToViewport ? m_minimumScaleToFit : m_rawAttributes.initialScale;
+        applyScaleAfterRenderingContents(innerBoundedViewportScale(toViewportScale(initialScale)));
     }
 
     // At this point we should already have received the first viewport arguments and the requested scroll
@@ -170,7 +159,7 @@ void PageViewportController::pageTransitionViewportReady()
 void PageViewportController::pageDidRequestScroll(const IntPoint& cssPosition)
 {
     // Ignore the request if suspended. Can only happen due to delay in event delivery.
-    if (m_activeDeferrerCount)
+    if (m_hasSuspendedContent)
         return;
 
     FloatRect endVisibleContentRect(clampViewportToContents(cssPosition, m_effectiveScale), viewportSizeInContentsCoordinates());
@@ -289,3 +278,5 @@ void PageViewportController::updateMinimumScaleToFit()
 }
 
 } // namespace WebKit
+
+#endif
diff --git a/Source/WebKit2/UIProcess/PageViewportController.h b/Source/WebKit2/UIProcess/PageViewportController.h
index d38ddb914..97463216b 100644
--- a/Source/WebKit2/UIProcess/PageViewportController.h
+++ b/Source/WebKit2/UIProcess/PageViewportController.h
@@ -22,6 +22,8 @@
 #ifndef PageViewportController_h
 #define PageViewportController_h
 
+#if USE(TILED_BACKING_STORE)
+
 #include <WebCore/FloatPoint.h>
 #include <WebCore/FloatRect.h>
 #include <WebCore/FloatSize.h>
@@ -38,32 +40,6 @@ class WebPageProxy;
 class PageViewportController;
 class PageViewportControllerClient;
 
-// When interacting with the content, either by animating or by the hand of the user,
-// it is important to ensure smooth animations of at least 60fps in order to give a
-// good user experience.
-//
-// In order to do this we need to get rid of unknown factors. These include device
-// sensors (geolocation, orientation updates etc), CSS3 animations, JavaScript
-// exectution, sub resource loads etc.
-// We do this by sending suspend and resume notifications to the web process.
-//
-// For this purpose the ViewportUpdateDeferrer guard can be used when interacting
-// with or animating the content to scope suspend / resume and defer update
-// notifications.
-//
-// If something should only be executed when the content is suspended, it is possible
-// to check for that using ASSERT(hasSuspendedContent()).
-
-class ViewportUpdateDeferrer {
-public:
-    enum SuspendContentFlag { DeferUpdate, DeferUpdateAndSuspendContent };
-    ViewportUpdateDeferrer(PageViewportController*, SuspendContentFlag = DeferUpdate);
-    ~ViewportUpdateDeferrer();
-
-private:
-    PageViewportController* const m_controller;
-};
-
 class PageViewportController {
     WTF_MAKE_NONCOPYABLE(PageViewportController);
 
@@ -119,7 +95,6 @@ private:
     bool m_allowsUserScaling;
     float m_minimumScaleToFit;
 
-    int m_activeDeferrerCount;
     bool m_hasSuspendedContent;
     bool m_hadUserInteraction;
 
@@ -132,12 +107,12 @@ private:
     bool m_viewportPosIsLocked;
     bool m_effectiveScaleIsLocked;
     WebCore::FloatRect m_lastFrameCoveredRect;
-
-    friend class ViewportUpdateDeferrer;
 };
 
 bool fuzzyCompare(float, float, float epsilon);
 
 } // namespace WebKit
 
+#endif
+
 #endif // PageViewportController_h
diff --git a/Source/WebKit2/UIProcess/Plugins/PluginInfoStore.cpp b/Source/WebKit2/UIProcess/Plugins/PluginInfoStore.cpp
index 804455490..95f589b5f 100644
--- a/Source/WebKit2/UIProcess/Plugins/PluginInfoStore.cpp
+++ b/Source/WebKit2/UIProcess/Plugins/PluginInfoStore.cpp
@@ -189,7 +189,12 @@ static inline String pathExtension(const KURL& url)
 }
 
 #if !PLATFORM(MAC)
-bool PluginInfoStore::shouldBlockPlugin(const PluginModuleInfo&)
+PluginModuleLoadPolicy PluginInfoStore::policyForPlugin(const PluginModuleInfo&)
+{
+    return PluginModuleLoadNormally;
+}
+
+bool PluginInfoStore::reactivateInactivePlugin(const PluginModuleInfo&)
 {
     return false;
 }
diff --git a/Source/WebKit2/UIProcess/Plugins/PluginInfoStore.h b/Source/WebKit2/UIProcess/Plugins/PluginInfoStore.h
index 287ec9262..9a6bd9f5c 100644
--- a/Source/WebKit2/UIProcess/Plugins/PluginInfoStore.h
+++ b/Source/WebKit2/UIProcess/Plugins/PluginInfoStore.h
@@ -56,9 +56,8 @@ public:
     // Returns the info for the plug-in with the given path.
     PluginModuleInfo infoForPluginWithPath(const String& pluginPath) const;
 
-    // Return whether this plug-in should be blocked from being instantiated.
-    // Note that the plug-in will still be seen by e.g. navigator.plugins
-    static bool shouldBlockPlugin(const PluginModuleInfo&);
+    static PluginModuleLoadPolicy policyForPlugin(const PluginModuleInfo&);
+    static bool reactivateInactivePlugin(const PluginModuleInfo&);
 
 private:
     PluginModuleInfo findPluginForMIMEType(const String& mimeType) const;
diff --git a/Source/WebKit2/UIProcess/Plugins/PluginProcessManager.h b/Source/WebKit2/UIProcess/Plugins/PluginProcessManager.h
index 37824c4aa..5e519427b 100644
--- a/Source/WebKit2/UIProcess/Plugins/PluginProcessManager.h
+++ b/Source/WebKit2/UIProcess/Plugins/PluginProcessManager.h
@@ -56,6 +56,10 @@ public:
     void getSitesWithData(const PluginModuleInfo&, WebPluginSiteDataManager*, uint64_t callbackID);
     void clearSiteData(const PluginModuleInfo&, WebPluginSiteDataManager*, const Vector<String>& sites, uint64_t flags, uint64_t maxAgeInSeconds, uint64_t callbackID);
 
+#if PLATFORM(MAC)
+    void setApplicationIsOccluded(bool);
+#endif
+
 private:
     PluginProcessManager();
 
diff --git a/Source/WebKit2/UIProcess/Plugins/PluginProcessProxy.cpp b/Source/WebKit2/UIProcess/Plugins/PluginProcessProxy.cpp
index e51eed7df..0c2e8689e 100644
--- a/Source/WebKit2/UIProcess/Plugins/PluginProcessProxy.cpp
+++ b/Source/WebKit2/UIProcess/Plugins/PluginProcessProxy.cpp
@@ -179,7 +179,7 @@ void PluginProcessProxy::didClose(CoreIPC::Connection*)
     pluginProcessCrashedOrFailedToLaunch();
 }
 
-void PluginProcessProxy::didReceiveInvalidMessage(CoreIPC::Connection*, CoreIPC::MessageID)
+void PluginProcessProxy::didReceiveInvalidMessage(CoreIPC::Connection*, CoreIPC::StringReference, CoreIPC::StringReference)
 {
 }
 
@@ -228,6 +228,11 @@ void PluginProcessProxy::didFinishLaunching(ProcessLauncher*, CoreIPC::Connectio
         m_connection->send(Messages::PluginProcess::CreateWebProcessConnection(), 0);
     
     m_numPendingConnectionRequests = 0;
+
+#if PLATFORM(MAC)
+    if (WebContext::applicationIsOccluded())
+        m_connection->send(Messages::PluginProcess::SetApplicationIsOccluded(true), 0);
+#endif
 }
 
 void PluginProcessProxy::didCreateWebProcessConnection(const CoreIPC::Attachment& connectionIdentifier, bool supportsAsynchronousPluginInitialization)
diff --git a/Source/WebKit2/UIProcess/Plugins/PluginProcessProxy.h b/Source/WebKit2/UIProcess/Plugins/PluginProcessProxy.h
index bdade27e5..1357e6c7f 100644
--- a/Source/WebKit2/UIProcess/Plugins/PluginProcessProxy.h
+++ b/Source/WebKit2/UIProcess/Plugins/PluginProcessProxy.h
@@ -80,7 +80,11 @@ public:
     // Terminates the plug-in process.
     void terminate();
 
+    bool isValid() const { return m_connection; }
+
 #if PLATFORM(MAC)
+    void setApplicationIsOccluded(bool);
+
     // Returns whether the plug-in needs the heap to be marked executable.
     static bool pluginNeedsExecutableHeap(const PluginModuleInfo&);
 
@@ -100,7 +104,7 @@ private:
     // CoreIPC::Connection::Client
     virtual void didReceiveMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::MessageDecoder&) OVERRIDE;
     virtual void didClose(CoreIPC::Connection*) OVERRIDE;
-    virtual void didReceiveInvalidMessage(CoreIPC::Connection*, CoreIPC::MessageID) OVERRIDE;
+    virtual void didReceiveInvalidMessage(CoreIPC::Connection*, CoreIPC::StringReference messageReceiverName, CoreIPC::StringReference messageName) OVERRIDE;
 
     // ProcessLauncher::Client
     virtual void didFinishLaunching(ProcessLauncher*, CoreIPC::Connection::Identifier);
diff --git a/Source/WebKit2/UIProcess/Plugins/mac/PluginInfoStoreMac.mm b/Source/WebKit2/UIProcess/Plugins/mac/PluginInfoStoreMac.mm
index 5bacc2c2a..6ebde6476 100644
--- a/Source/WebKit2/UIProcess/Plugins/mac/PluginInfoStoreMac.mm
+++ b/Source/WebKit2/UIProcess/Plugins/mac/PluginInfoStoreMac.mm
@@ -36,6 +36,8 @@
 
 using namespace WebCore;
 
+static const char* const oracleJavaAppletPluginBundleIdentifier =  "com.oracle.java.JavaAppletPlugin";
+
 namespace WebKit {
 
 Vector<String> PluginInfoStore::pluginsDirectories()
@@ -105,6 +107,11 @@ static bool checkForPreferredPlugin(Vector<PluginModuleInfo>& alreadyLoadedPlugi
     return true;
 }
 
+static bool shouldBlockPlugin(const PluginModuleInfo& plugin)
+{
+    return PluginInfoStore::policyForPlugin(plugin) == PluginModuleBlocked;
+}
+
 bool PluginInfoStore::shouldUsePlugin(Vector<PluginModuleInfo>& alreadyLoadedPlugins, const PluginModuleInfo& plugin)
 {
     for (size_t i = 0; i < alreadyLoadedPlugins.size(); ++i) {
@@ -122,11 +129,11 @@ bool PluginInfoStore::shouldUsePlugin(Vector<PluginModuleInfo>& alreadyLoadedPlu
     }
 
     // Prefer the Oracle Java plug-in over the Apple java plug-in.
-    if (!checkForPreferredPlugin(alreadyLoadedPlugins, plugin, "com.apple.java.JavaAppletPlugin", "com.oracle.java.JavaAppletPlugin"))
+    if (!checkForPreferredPlugin(alreadyLoadedPlugins, plugin, "com.apple.java.JavaAppletPlugin",  oracleJavaAppletPluginBundleIdentifier))
         return false;
 
 #if MAC_OS_X_VERSION_MIN_REQUIRED >= 1070
-    if (plugin.bundleIdentifier == "com.apple.java.JavaAppletPlugin" && shouldBlockPlugin(plugin) && !WKJLIsRuntimeAndWebComponentsInstalled()) {
+    if (plugin.bundleIdentifier == "com.apple.java.JavaAppletPlugin" && shouldBlockPlugin(plugin) && !WKIsJavaPlugInActive()) {
         // If the Apple Java plug-in is blocked and there's no Java runtime installed, just pretend that the plug-in doesn't exist.
         return false;
     }
@@ -135,9 +142,27 @@ bool PluginInfoStore::shouldUsePlugin(Vector<PluginModuleInfo>& alreadyLoadedPlu
     return true;
 }
 
-bool PluginInfoStore::shouldBlockPlugin(const PluginModuleInfo& plugin)
+PluginModuleLoadPolicy PluginInfoStore::policyForPlugin(const PluginModuleInfo& plugin)
 {
-    return WKShouldBlockPlugin(plugin.bundleIdentifier, plugin.versionString);
+    if (WKShouldBlockPlugin(plugin.bundleIdentifier, plugin.versionString))
+        return PluginModuleBlocked;
+
+    if (plugin.bundleIdentifier == oracleJavaAppletPluginBundleIdentifier && !WKIsJavaPlugInActive())
+        return PluginModuleInactive;
+
+    return PluginModuleLoadNormally;
+}
+
+bool PluginInfoStore::reactivateInactivePlugin(const PluginModuleInfo& plugin)
+{
+#if MAC_OS_X_VERSION_MIN_REQUIRED >= 1070
+    if (plugin.bundleIdentifier == oracleJavaAppletPluginBundleIdentifier) {
+        WKActivateJavaPlugIn();
+        return true;
+    }
+#endif
+
+    return false;
 }
 
 String PluginInfoStore::getMIMETypeForExtension(const String& extension)
diff --git a/Source/WebKit2/UIProcess/Plugins/mac/PluginProcessManagerMac.mm b/Source/WebKit2/UIProcess/Plugins/mac/PluginProcessManagerMac.mm
new file mode 100644
index 000000000..6a974dad7
--- /dev/null
+++ b/Source/WebKit2/UIProcess/Plugins/mac/PluginProcessManagerMac.mm
@@ -0,0 +1,44 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#import "config.h"
+#import "PluginProcessManager.h"
+
+#if ENABLE(PLUGIN_PROCESS)
+
+#import "PluginProcessProxy.h"
+
+namespace WebKit {
+
+void PluginProcessManager::setApplicationIsOccluded(bool applicationIsOccluded)
+{
+    size_t processCount = m_pluginProcesses.size();
+    for (size_t i = 0; i < processCount; ++i)
+        m_pluginProcesses[i]->setApplicationIsOccluded(applicationIsOccluded);
+}
+
+} // namespace WebKit
+
+#endif // ENABLE(PLUGIN_PROCESS)
diff --git a/Source/WebKit2/UIProcess/Plugins/mac/PluginProcessProxyMac.mm b/Source/WebKit2/UIProcess/Plugins/mac/PluginProcessProxyMac.mm
index 207eca2c9..e92ef9e76 100644
--- a/Source/WebKit2/UIProcess/Plugins/mac/PluginProcessProxyMac.mm
+++ b/Source/WebKit2/UIProcess/Plugins/mac/PluginProcessProxyMac.mm
@@ -30,6 +30,7 @@
 
 #import "EnvironmentVariables.h"
 #import "PluginProcessCreationParameters.h"
+#import "PluginProcessMessages.h"
 #import "WebKitSystemInterface.h"
 #import <WebCore/FileSystem.h>
 #import <spawn.h>
@@ -315,6 +316,13 @@ void PluginProcessProxy::applicationDidBecomeActive()
     makePluginProcessTheFrontProcess();
 }
 
+void PluginProcessProxy::setApplicationIsOccluded(bool applicationIsOccluded)
+{
+    if (!isValid())
+        return;
+
+    m_connection->send(Messages::PluginProcess::SetApplicationIsOccluded(applicationIsOccluded), 0);
+}
 
 } // namespace WebKit
 
diff --git a/Source/WebKit2/UIProcess/Plugins/unix/PluginProcessProxyUnix.cpp b/Source/WebKit2/UIProcess/Plugins/unix/PluginProcessProxyUnix.cpp
index 64c7bc485..189e21379 100644
--- a/Source/WebKit2/UIProcess/Plugins/unix/PluginProcessProxyUnix.cpp
+++ b/Source/WebKit2/UIProcess/Plugins/unix/PluginProcessProxyUnix.cpp
@@ -43,8 +43,15 @@ using namespace WebCore;
 
 namespace WebKit {
 
-void PluginProcessProxy::platformInitializeLaunchOptions(ProcessLauncher::LaunchOptions&, const PluginModuleInfo&)
+void PluginProcessProxy::platformInitializeLaunchOptions(ProcessLauncher::LaunchOptions& launchOptions, const PluginModuleInfo&)
 {
+#if PLATFORM(EFL) && !defined(NDEBUG)
+    const char* commandPrefix = getenv("PLUGIN_PROCESS_COMMAND_PREFIX");
+    if (commandPrefix && *commandPrefix)
+        launchOptions.processCmdPrefix = String::fromUTF8(commandPrefix);
+#else
+    UNUSED_PARAM(launchOptions);
+#endif
 }
 
 void PluginProcessProxy::platformInitializePluginProcess(PluginProcessCreationParameters&)
diff --git a/Source/WebKit2/UIProcess/SharedWorkers/SharedWorkerProcessManager.h b/Source/WebKit2/UIProcess/SharedWorkers/SharedWorkerProcessManager.h
index ba06c7cbb..c2555ea4e 100644
--- a/Source/WebKit2/UIProcess/SharedWorkers/SharedWorkerProcessManager.h
+++ b/Source/WebKit2/UIProcess/SharedWorkers/SharedWorkerProcessManager.h
@@ -53,6 +53,10 @@ public:
     void getSharedWorkerProcessConnection(const String& url, const String& name, PassRefPtr<Messages::WebProcessProxy::GetSharedWorkerProcessConnection::DelayedReply>);
     void removeSharedWorkerProcessProxy(SharedWorkerProcessProxy*);
 
+#if PLATFORM(MAC)
+    void setApplicationIsOccluded(bool);
+#endif
+
 private:
     SharedWorkerProcessManager();
 
diff --git a/Source/WebKit2/UIProcess/SharedWorkers/SharedWorkerProcessProxy.cpp b/Source/WebKit2/UIProcess/SharedWorkers/SharedWorkerProcessProxy.cpp
index 3247dc131..b808efbac 100644
--- a/Source/WebKit2/UIProcess/SharedWorkers/SharedWorkerProcessProxy.cpp
+++ b/Source/WebKit2/UIProcess/SharedWorkers/SharedWorkerProcessProxy.cpp
@@ -128,7 +128,7 @@ void SharedWorkerProcessProxy::didClose(CoreIPC::Connection*)
     sharedWorkerProcessCrashedOrFailedToLaunch();
 }
 
-void SharedWorkerProcessProxy::didReceiveInvalidMessage(CoreIPC::Connection*, CoreIPC::MessageID)
+void SharedWorkerProcessProxy::didReceiveInvalidMessage(CoreIPC::Connection*, CoreIPC::StringReference, CoreIPC::StringReference)
 {
 }
 
@@ -164,6 +164,11 @@ void SharedWorkerProcessProxy::didFinishLaunching(ProcessLauncher*, CoreIPC::Con
         m_connection->send(Messages::SharedWorkerProcess::CreateWebProcessConnection(), 0);
     
     m_numPendingConnectionRequests = 0;
+
+#if PLATFORM(MAC)
+    if (WebContext::applicationIsOccluded())
+        m_connection->send(Messages::SharedWorkerProcess::SetApplicationIsOccluded(true), 0);
+#endif
 }
 
 void SharedWorkerProcessProxy::didCreateWebProcessConnection(const CoreIPC::Attachment& connectionIdentifier)
diff --git a/Source/WebKit2/UIProcess/SharedWorkers/SharedWorkerProcessProxy.h b/Source/WebKit2/UIProcess/SharedWorkers/SharedWorkerProcessProxy.h
index f20551425..6e9f20a86 100644
--- a/Source/WebKit2/UIProcess/SharedWorkers/SharedWorkerProcessProxy.h
+++ b/Source/WebKit2/UIProcess/SharedWorkers/SharedWorkerProcessProxy.h
@@ -56,6 +56,12 @@ public:
     // Terminates the shared worker process.
     void terminate();
 
+    bool isValid() const { return m_connection; }
+
+#if PLATFORM(MAC)
+    void setApplicationIsOccluded(bool);
+#endif
+
 private:
     SharedWorkerProcessProxy(SharedWorkerProcessManager*, const String& url, const String& name);
 
@@ -64,7 +70,7 @@ private:
     // CoreIPC::Connection::Client
     virtual void didReceiveMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::MessageDecoder&);
     virtual void didClose(CoreIPC::Connection*);
-    virtual void didReceiveInvalidMessage(CoreIPC::Connection*, CoreIPC::MessageID);
+    virtual void didReceiveInvalidMessage(CoreIPC::Connection*, CoreIPC::StringReference messageReceiverName, CoreIPC::StringReference messageName);
 
     // ProcessLauncher::Client
     virtual void didFinishLaunching(ProcessLauncher*, CoreIPC::Connection::Identifier);
diff --git a/Source/WebKit2/UIProcess/SharedWorkers/mac/SharedWorkerProcessManagerMac.mm b/Source/WebKit2/UIProcess/SharedWorkers/mac/SharedWorkerProcessManagerMac.mm
new file mode 100644
index 000000000..e63907ce6
--- /dev/null
+++ b/Source/WebKit2/UIProcess/SharedWorkers/mac/SharedWorkerProcessManagerMac.mm
@@ -0,0 +1,44 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#import "config.h"
+#import "SharedWorkerProcessManager.h"
+
+#if ENABLE(SHARED_WORKER_PROCESS)
+
+#import "SharedWorkerProcessProxy.h"
+
+namespace WebKit {
+
+void SharedWorkerProcessManager::setApplicationIsOccluded(bool applicationIsOccluded)
+{
+    size_t processCount = m_sharedWorkerProcesses.size();
+    for (size_t i = 0; i < processCount; ++i)
+        m_sharedWorkerProcesses[i]->setApplicationIsOccluded(applicationIsOccluded);
+}
+
+} // namespace WebKit
+
+#endif // ENABLE(SHARED_WORKER_PROCESS)
diff --git a/Source/WebKit2/UIProcess/SharedWorkers/mac/SharedWorkerProcessProxyMac.mm b/Source/WebKit2/UIProcess/SharedWorkers/mac/SharedWorkerProcessProxyMac.mm
new file mode 100644
index 000000000..5b3dd4639
--- /dev/null
+++ b/Source/WebKit2/UIProcess/SharedWorkers/mac/SharedWorkerProcessProxyMac.mm
@@ -0,0 +1,45 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#import "config.h"
+#import "SharedWorkerProcessProxy.h"
+
+#if ENABLE(SHARED_WORKER_PROCESS)
+
+#import "SharedWorkerProcessMessages.h"
+
+namespace WebKit {
+
+void SharedWorkerProcessProxy::setApplicationIsOccluded(bool applicationIsOccluded)
+{
+    if (!isValid())
+        return;
+
+    m_connection->send(Messages::SharedWorkerProcess::SetApplicationIsOccluded(applicationIsOccluded), 0);
+}
+
+} // namespace WebKit
+
+#endif // ENABLE(SHARED_WORKER_PROCESS)
diff --git a/Source/WebKit2/UIProcess/WebConnectionToWebProcess.cpp b/Source/WebKit2/UIProcess/WebConnectionToWebProcess.cpp
index 6202608bd..a80cfbc30 100644
--- a/Source/WebKit2/UIProcess/WebConnectionToWebProcess.cpp
+++ b/Source/WebKit2/UIProcess/WebConnectionToWebProcess.cpp
@@ -54,7 +54,7 @@ WebConnectionToWebProcess::WebConnectionToWebProcess(WebProcessProxy* process, C
 
 void WebConnectionToWebProcess::encodeMessageBody(CoreIPC::ArgumentEncoder& encoder, APIObject* messageBody)
 {
-    encoder.encode(WebContextUserMessageEncoder(messageBody));
+    encoder << WebContextUserMessageEncoder(messageBody);
 }
 
 bool WebConnectionToWebProcess::decodeMessageBody(CoreIPC::ArgumentDecoder& decoder, RefPtr<APIObject>& messageBody)
@@ -94,14 +94,14 @@ void WebConnectionToWebProcess::didClose(CoreIPC::Connection* connection)
     m_client.didClose(this);
 }
 
-void WebConnectionToWebProcess::didReceiveInvalidMessage(CoreIPC::Connection* connection, CoreIPC::MessageID messageID)
+void WebConnectionToWebProcess::didReceiveInvalidMessage(CoreIPC::Connection* connection, CoreIPC::StringReference messageReceiverName, CoreIPC::StringReference messageName)
 {
     RefPtr<WebConnectionToWebProcess> protector = this;
     RefPtr<WebProcessProxy> process = m_process;
 
     // This will invalidate the CoreIPC::Connection and the WebProcessProxy member
     // variables, so we should be careful not to use them after this call.
-    process->didReceiveInvalidMessage(connection, messageID);
+    process->didReceiveInvalidMessage(connection, messageReceiverName, messageName);
 
     // Since we've invalidated the connection we'll never get a CoreIPC::Connection::Client::didClose
     // callback so we'll explicitly call it here instead.
diff --git a/Source/WebKit2/UIProcess/WebConnectionToWebProcess.h b/Source/WebKit2/UIProcess/WebConnectionToWebProcess.h
index 0b1fc09f8..b601283cf 100644
--- a/Source/WebKit2/UIProcess/WebConnectionToWebProcess.h
+++ b/Source/WebKit2/UIProcess/WebConnectionToWebProcess.h
@@ -49,7 +49,7 @@ private:
     virtual void didReceiveMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::MessageDecoder&);
     virtual void didReceiveSyncMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::MessageDecoder&, OwnPtr<CoreIPC::MessageEncoder>&);
     virtual void didClose(CoreIPC::Connection*);
-    virtual void didReceiveInvalidMessage(CoreIPC::Connection*, CoreIPC::MessageID);
+    virtual void didReceiveInvalidMessage(CoreIPC::Connection*, CoreIPC::StringReference messageReceiverName, CoreIPC::StringReference messageName);
 #if PLATFORM(WIN)
     virtual Vector<HWND> windowsToReceiveSentMessagesWhileWaitingForSyncReply();
 #endif
diff --git a/Source/WebKit2/UIProcess/WebContext.cpp b/Source/WebKit2/UIProcess/WebContext.cpp
index 56a017c6f..8ddc93d83 100644
--- a/Source/WebKit2/UIProcess/WebContext.cpp
+++ b/Source/WebKit2/UIProcess/WebContext.cpp
@@ -100,6 +100,9 @@ PassRefPtr<WebContext> WebContext::create(const String& injectedBundlePath)
     JSC::initializeThreading();
     WTF::initializeMainThread();
     RunLoop::initializeMainRunLoop();
+#if PLATFORM(MAC)
+    WebContext::initializeProcessSuppressionSupport();
+#endif
     return adoptRef(new WebContext(ProcessModelSharedSecondaryProcess, injectedBundlePath));
 }
 
@@ -136,7 +139,6 @@ WebContext::WebContext(ProcessModel processModel, const String& injectedBundlePa
 #endif
 {
     addMessageReceiver(Messages::WebContext::messageReceiverName(), this);
-    addMessageReceiver(Messages::DownloadProxy::messageReceiverName(), this);
     addMessageReceiver(CoreIPC::MessageKindTraits<WebContextLegacyMessage::Kind>::messageReceiverName(), this);
 
     // NOTE: These sub-objects must be initialized after m_messageReceiverMap..
@@ -498,7 +500,7 @@ void WebContext::processDidFinishLaunching(WebProcessProxy* process)
     if (m_memorySamplerEnabled) {
         SandboxExtension::Handle sampleLogSandboxHandle;        
         double now = WTF::currentTime();
-        String sampleLogFilePath = String::format("WebProcess%llu", static_cast<unsigned long long>(now));
+        String sampleLogFilePath = String::format("WebProcess%llupid%d", static_cast<unsigned long long>(now), process->processIdentifier());
         sampleLogFilePath = SandboxExtension::createHandleForTemporaryFile(sampleLogFilePath, SandboxExtension::WriteOnly, sampleLogSandboxHandle);
         
         process->send(Messages::WebProcess::StartMemorySampler(sampleLogSandboxHandle, sampleLogFilePath, m_memorySamplerInterval), 0);
@@ -762,6 +764,7 @@ DownloadProxy* WebContext::createDownloadProxy()
 {
     RefPtr<DownloadProxy> downloadProxy = DownloadProxy::create(this);
     m_downloads.set(downloadProxy->downloadID(), downloadProxy);
+    addMessageReceiver(Messages::DownloadProxy::messageReceiverName(), downloadProxy->downloadID(), this);
     return downloadProxy.get();
 }
 
@@ -770,6 +773,7 @@ void WebContext::downloadFinished(DownloadProxy* downloadProxy)
     ASSERT(m_downloads.contains(downloadProxy->downloadID()));
 
     downloadProxy->invalidate();
+    removeMessageReceiver(Messages::DownloadProxy::messageReceiverName(), downloadProxy->downloadID());
     m_downloads.remove(downloadProxy->downloadID());
 }
 
@@ -790,6 +794,16 @@ void WebContext::addMessageReceiver(CoreIPC::StringReference messageReceiverName
     m_messageReceiverMap.addMessageReceiver(messageReceiverName, messageReceiver);
 }
 
+void WebContext::addMessageReceiver(CoreIPC::StringReference messageReceiverName, uint64_t destinationID, CoreIPC::MessageReceiver* messageReceiver)
+{
+    m_messageReceiverMap.addMessageReceiver(messageReceiverName, destinationID, messageReceiver);
+}
+
+void WebContext::removeMessageReceiver(CoreIPC::StringReference messageReceiverName, uint64_t destinationID)
+{
+    m_messageReceiverMap.removeMessageReceiver(messageReceiverName, destinationID);
+}
+
 bool WebContext::dispatchMessage(CoreIPC::Connection* connection, CoreIPC::MessageID messageID, CoreIPC::MessageDecoder& decoder)
 {
     return m_messageReceiverMap.dispatchMessage(connection, messageID, decoder);
diff --git a/Source/WebKit2/UIProcess/WebContext.h b/Source/WebKit2/UIProcess/WebContext.h
index 93dc68e70..7a55023f0 100644
--- a/Source/WebKit2/UIProcess/WebContext.h
+++ b/Source/WebKit2/UIProcess/WebContext.h
@@ -87,6 +87,9 @@ public:
     static const Vector<WebContext*>& allContexts();
 
     void addMessageReceiver(CoreIPC::StringReference messageReceiverName, CoreIPC::MessageReceiver*);
+    void addMessageReceiver(CoreIPC::StringReference messageReceiverName, uint64_t destinationID, CoreIPC::MessageReceiver*);
+    void removeMessageReceiver(CoreIPC::StringReference messageReceiverName, uint64_t destinationID);
+
     bool dispatchMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::MessageDecoder&);
     bool dispatchSyncMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::MessageDecoder&, OwnPtr<CoreIPC::MessageEncoder>&);
 
@@ -245,6 +248,10 @@ public:
 
     void setUsesNetworkProcess(bool);
 
+#if PLATFORM(MAC)
+    static bool applicationIsOccluded() { return s_applicationIsOccluded; }
+#endif
+
 private:
     WebContext(ProcessModel, const String& injectedBundlePath);
 
@@ -299,6 +306,13 @@ private:
     String cookieStorageDirectory() const;
     String platformDefaultCookieStorageDirectory() const;
 
+#if PLATFORM(MAC)
+    static void applicationBecameVisible(uint32_t, void*, uint32_t, void*, uint32_t);
+    static void applicationBecameOccluded(uint32_t, void*, uint32_t, void*, uint32_t);
+    static void initializeProcessSuppressionSupport();
+    static void registerOcclusionNotificationHandlers();
+#endif
+
     ProcessModel m_processModel;
     
     Vector<RefPtr<WebProcessProxy> > m_processes;
@@ -393,6 +407,10 @@ private:
     HashMap<uint64_t, RefPtr<DictionaryCallback> > m_dictionaryCallbacks;
 
     CoreIPC::MessageReceiverMap m_messageReceiverMap;
+
+#if PLATFORM(MAC)
+    static bool s_applicationIsOccluded;
+#endif
 };
 
 template<typename U> inline void WebContext::sendToAllProcesses(const U& message)
diff --git a/Source/WebKit2/UIProcess/WebContextUserMessageCoders.h b/Source/WebKit2/UIProcess/WebContextUserMessageCoders.h
index ffe322811..761c4a49c 100644
--- a/Source/WebKit2/UIProcess/WebContextUserMessageCoders.h
+++ b/Source/WebKit2/UIProcess/WebContextUserMessageCoders.h
@@ -46,7 +46,7 @@ public:
     {
     }
 
-    void encode(CoreIPC::ArgumentEncoder* encoder) const 
+    void encode(CoreIPC::ArgumentEncoder& encoder) const
     {
         APIObject::Type type = APIObject::TypeNull;
         if (baseEncode(encoder, type))
@@ -55,17 +55,17 @@ public:
         switch (type) {
         case APIObject::TypePage: {
             WebPageProxy* page = static_cast<WebPageProxy*>(m_root);
-            encoder->encode(page->pageID());
+            encoder << page->pageID();
             break;
         }
         case APIObject::TypeFrame: {
             WebFrameProxy* frame = static_cast<WebFrameProxy*>(m_root);
-            encoder->encode(frame->frameID());
+            encoder << frame->frameID();
             break;
         }
         case APIObject::TypePageGroup: {
             WebPageGroup* pageGroup = static_cast<WebPageGroup*>(m_root);
-            encoder->encode(pageGroup->data());
+            encoder << pageGroup->data();
             break;
         }
         default:
diff --git a/Source/WebKit2/UIProcess/WebIconDatabase.cpp b/Source/WebKit2/UIProcess/WebIconDatabase.cpp
index 40158f4a0..655921084 100644
--- a/Source/WebKit2/UIProcess/WebIconDatabase.cpp
+++ b/Source/WebKit2/UIProcess/WebIconDatabase.cpp
@@ -60,6 +60,7 @@ WebIconDatabase::WebIconDatabase(WebContext* context)
 
 void WebIconDatabase::invalidate()
 {
+    setGlobalIconDatabase(0);
 }
 
 void WebIconDatabase::setDatabasePath(const String& path)
diff --git a/Source/WebKit2/UIProcess/WebInspectorProxy.cpp b/Source/WebKit2/UIProcess/WebInspectorProxy.cpp
index 4ef85f25a..345ceca80 100644
--- a/Source/WebKit2/UIProcess/WebInspectorProxy.cpp
+++ b/Source/WebKit2/UIProcess/WebInspectorProxy.cpp
@@ -328,8 +328,8 @@ void WebInspectorProxy::createInspectorPage(uint64_t& inspectorPageID, WebPageCr
     inspectorPage->initializePolicyClient(&policyClient);
 
     String url = inspectorPageURL();
-    if (m_isAttached)
-        url.append("?docked=true");
+    url.append("?dockSide=");
+    url.append(m_isAttached ? "bottom" : "undocked");
 
     m_page->process()->assumeReadAccessToBaseURL(inspectorBaseURL());
 
diff --git a/Source/WebKit2/UIProcess/WebPageProxy.cpp b/Source/WebKit2/UIProcess/WebPageProxy.cpp
index 56c7cfea5..24d326853 100644
--- a/Source/WebKit2/UIProcess/WebPageProxy.cpp
+++ b/Source/WebKit2/UIProcess/WebPageProxy.cpp
@@ -1283,7 +1283,7 @@ void WebPageProxy::receivedPolicyDecision(PolicyAction action, WebFrameProxy* fr
         // Create a download proxy.
         DownloadProxy* download = m_process->context()->createDownloadProxy();
         downloadID = download->downloadID();
-#if PLATFORM(QT) || PLATFORM(EFL)
+#if PLATFORM(QT) || PLATFORM(EFL) || PLATFORM(GTK)
         // Our design does not suppport downloads without a WebPage.
         handleDownloadRequest(download);
 #endif
@@ -2592,6 +2592,19 @@ void WebPageProxy::unavailablePluginButtonClicked(uint32_t opaquePluginUnavailab
         pluginUnavailabilityReason = kWKPluginUnavailabilityReasonPluginCrashed;
         break;
 
+    case RenderEmbeddedObject::PluginInactive: {
+#if ENABLE(NETSCAPE_PLUGIN_API)
+        String newMimeType = mimeType;
+        PluginModuleInfo plugin = m_process->context()->pluginInfoStore().findPlugin(newMimeType, KURL(KURL(), url));
+
+        if (!plugin.path.isEmpty() && PluginInfoStore::reactivateInactivePlugin(plugin)) {
+            // The plug-in has been reactivated now; reload the page so it'll be instantiated.
+            reload(false);
+        }
+        return;
+#endif
+    }
+
     case RenderEmbeddedObject::PluginBlockedByContentSecurityPolicy:
         ASSERT_NOT_REACHED();
     }
@@ -2675,6 +2688,17 @@ void WebPageProxy::pageDidRequestScroll(const IntPoint& point)
 {
     m_pageClient->pageDidRequestScroll(point);
 }
+
+void WebPageProxy::pageTransitionViewportReady()
+{
+    m_pageClient->pageTransitionViewportReady();
+}
+
+void WebPageProxy::didRenderFrame(const WebCore::IntSize& contentsSize, const WebCore::IntRect& coveredRect)
+{
+    m_pageClient->didRenderFrame(contentsSize, coveredRect);
+}
+
 #endif
 
 void WebPageProxy::didChangeViewportProperties(const ViewportAttributes& attr)
@@ -2742,12 +2766,12 @@ void WebPageProxy::setMediaVolume(float volume)
     m_process->send(Messages::WebPage::SetMediaVolume(volume), m_pageID);    
 }
 
-#if PLATFORM(QT) || PLATFORM(EFL)
+#if PLATFORM(QT) || PLATFORM(EFL) || PLATFORM(GTK)
 void WebPageProxy::handleDownloadRequest(DownloadProxy* download)
 {
     m_pageClient->handleDownloadRequest(download);
 }
-#endif // PLATFORM(QT) || PLATFORM(EFL)
+#endif // PLATFORM(QT) || PLATFORM(EFL) || PLATFORM(GTK)
 
 #if PLATFORM(QT) || PLATFORM(EFL)
 void WebPageProxy::didChangeContentsSize(const IntSize& size)
@@ -2899,7 +2923,7 @@ void WebPageProxy::editorStateChanged(const EditorState& editorState)
 
 #if PLATFORM(MAC)
     m_pageClient->updateTextInputState(couldChangeSecureInputState);
-#elif PLATFORM(QT)
+#elif PLATFORM(QT) || PLATFORM(EFL)
     m_pageClient->updateTextInputState();
 #endif
 }
diff --git a/Source/WebKit2/UIProcess/WebPageProxy.h b/Source/WebKit2/UIProcess/WebPageProxy.h
index 95528ab7f..b8e34bc90 100644
--- a/Source/WebKit2/UIProcess/WebPageProxy.h
+++ b/Source/WebKit2/UIProcess/WebPageProxy.h
@@ -355,8 +355,10 @@ public:
     
     bool maintainsInactiveSelection() const { return m_maintainsInactiveSelection; }
     void setMaintainsInactiveSelection(bool);
-#if PLATFORM(QT)
+#if USE(TILED_BACKING_STORE) 
     void didRenderFrame(const WebCore::IntSize& contentsSize, const WebCore::IntRect& coveredRect);
+#endif
+#if PLATFORM(QT)
     void registerApplicationScheme(const String& scheme);
     void resolveApplicationSchemeRequest(QtNetworkRequestData);
     void sendApplicationSchemeReply(const QQuickNetworkReply*);
@@ -414,6 +416,12 @@ public:
 
     HWND nativeWindow() const;
 #endif
+#if PLATFORM(EFL)
+    void handleInputMethodKeydown(bool& handled);
+    void confirmComposition(const String&);
+    void setComposition(const String&, Vector<WebCore::CompositionUnderline>&, int);
+    void cancelComposition();
+#endif
 #if USE(CAIRO) && !PLATFORM(WIN_CAIRO)
     PlatformWidget viewWidget();
 #endif
@@ -653,7 +661,7 @@ public:
     void didReceiveMessageFromNavigatorQtObject(const String&);
 #endif
 
-#if PLATFORM(QT) || PLATFORM(EFL)
+#if PLATFORM(QT) || PLATFORM(EFL) || PLATFORM(GTK)
     void handleDownloadRequest(DownloadProxy*);
 #endif
 
@@ -852,10 +860,9 @@ private:
     
 #if USE(TILED_BACKING_STORE)
     void pageDidRequestScroll(const WebCore::IntPoint&);
+    void pageTransitionViewportReady();
 #endif
-
 #if PLATFORM(QT)
-    void pageTransitionViewportReady();
     void didFindZoomableArea(const WebCore::IntPoint&, const WebCore::IntRect&);
 #endif
 
diff --git a/Source/WebKit2/UIProcess/WebPageProxy.messages.in b/Source/WebKit2/UIProcess/WebPageProxy.messages.in
index 77ac830f2..197f20d9d 100644
--- a/Source/WebKit2/UIProcess/WebPageProxy.messages.in
+++ b/Source/WebKit2/UIProcess/WebPageProxy.messages.in
@@ -69,11 +69,15 @@ messages -> WebPageProxy {
     DidBlockInsecurePluginVersion(WTF::String mimeType, WTF::String urlString)
     SetCanShortCircuitHorizontalWheelEvents(bool canShortCircuitHorizontalWheelEvents)
 
+#if PLATFORM(EFL)
+    HandleInputMethodKeydown() -> (bool handled)
+#endif
+
 #if USE(TILED_BACKING_STORE)
     PageDidRequestScroll(WebCore::IntPoint point)
+    PageTransitionViewportReady()
 #endif
 #if PLATFORM(QT)
-    PageTransitionViewportReady()
     DidFindZoomableArea(WebCore::IntPoint target, WebCore::IntRect area)
     AuthenticationRequiredRequest(WTF::String hostname, WTF::String realm, WTF::String prefilledUsername) -> (WTF::String username, WTF::String password)
     CertificateVerificationRequest(WTF::String hostname) -> (bool ignoreErrors)
diff --git a/Source/WebKit2/UIProcess/WebProcessProxy.cpp b/Source/WebKit2/UIProcess/WebProcessProxy.cpp
index f75616563..39b699ae6 100644
--- a/Source/WebKit2/UIProcess/WebProcessProxy.cpp
+++ b/Source/WebKit2/UIProcess/WebProcessProxy.cpp
@@ -359,21 +359,20 @@ void WebProcessProxy::getPlugins(CoreIPC::Connection*, uint64_t requestID, bool
     pluginWorkQueue().dispatch(bind(&WebProcessProxy::handleGetPlugins, this, requestID, refresh));
 }
 
-void WebProcessProxy::getPluginPath(const String& mimeType, const String& urlString, String& pluginPath, bool& blocked)
+void WebProcessProxy::getPluginPath(const String& mimeType, const String& urlString, String& pluginPath, uint32_t& pluginLoadPolicy)
 {
     MESSAGE_CHECK_URL(urlString);
 
     String newMimeType = mimeType.lower();
 
-    blocked = false;
+    pluginLoadPolicy = PluginModuleLoadNormally;
     PluginModuleInfo plugin = m_context->pluginInfoStore().findPlugin(newMimeType, KURL(KURL(), urlString));
     if (!plugin.path)
         return;
 
-    if (m_context->pluginInfoStore().shouldBlockPlugin(plugin)) {
-        blocked = true;
+    pluginLoadPolicy = PluginInfoStore::policyForPlugin(plugin);
+    if (pluginLoadPolicy != PluginModuleLoadNormally)
         return;
-    }
 
     pluginPath = plugin.path;
 }
@@ -477,9 +476,9 @@ void WebProcessProxy::didClose(CoreIPC::Connection*)
         pages[i]->processDidCrash();
 }
 
-void WebProcessProxy::didReceiveInvalidMessage(CoreIPC::Connection*, CoreIPC::MessageID messageID)
+void WebProcessProxy::didReceiveInvalidMessage(CoreIPC::Connection*, CoreIPC::StringReference messageReceiverName, CoreIPC::StringReference messageName)
 {
-    WTFLogAlways("Received an invalid message from the web process with message ID %x\n", messageID.toInt());
+    WTFLogAlways("Received an invalid message \"%s.%s\" from the web process.\n", messageReceiverName.toString().data(), messageName.toString().data());
 
     // Terminate the WebProcesses.
     terminate();
@@ -532,6 +531,11 @@ void WebProcessProxy::didFinishLaunching(CoreIPC::Connection::Identifier connect
 
     // Tell the context that we finished launching.
     m_context->processDidFinishLaunching(this);
+
+#if PLATFORM(MAC)
+    if (WebContext::applicationIsOccluded())
+        connection()->send(Messages::WebProcess::SetApplicationIsOccluded(true), 0);
+#endif
 }
 
 WebFrameProxy* WebProcessProxy::webFrame(uint64_t frameID) const
diff --git a/Source/WebKit2/UIProcess/WebProcessProxy.h b/Source/WebKit2/UIProcess/WebProcessProxy.h
index afa5bd4b2..a0120ef5a 100644
--- a/Source/WebKit2/UIProcess/WebProcessProxy.h
+++ b/Source/WebKit2/UIProcess/WebProcessProxy.h
@@ -118,9 +118,6 @@ public:
 
     static bool fullKeyboardAccessEnabled();
 
-    // FIXME: This variant of send is deprecated. All clients should move to an overload that take a message type.
-    template<typename E, typename T> bool deprecatedSend(E messageID, uint64_t destinationID, const T& arguments);
-
 private:
     explicit WebProcessProxy(PassRefPtr<WebContext>);
 
@@ -143,7 +140,7 @@ private:
     // Plugins
 #if ENABLE(NETSCAPE_PLUGIN_API)
     void getPlugins(CoreIPC::Connection*, uint64_t requestID, bool refresh);
-    void getPluginPath(const String& mimeType, const String& urlString, String& pluginPath, bool& blocked);
+    void getPluginPath(const String& mimeType, const String& urlString, String& pluginPath, uint32_t& pluginLoadPolicy);
     void handleGetPlugins(uint64_t requestID, bool refresh);
     void sendDidGetPlugins(uint64_t requestID, PassOwnPtr<Vector<WebCore::PluginInfo> >);
 #endif // ENABLE(NETSCAPE_PLUGIN_API)
@@ -170,7 +167,7 @@ private:
     virtual void didReceiveMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::MessageDecoder&);
     virtual void didReceiveSyncMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::MessageDecoder&, OwnPtr<CoreIPC::MessageEncoder>&);
     virtual void didClose(CoreIPC::Connection*);
-    virtual void didReceiveInvalidMessage(CoreIPC::Connection*, CoreIPC::MessageID);
+    virtual void didReceiveInvalidMessage(CoreIPC::Connection*, CoreIPC::StringReference messageReceiverName, CoreIPC::StringReference messageName);
 #if PLATFORM(WIN)
     virtual Vector<HWND> windowsToReceiveSentMessagesWhileWaitingForSyncReply();
 #endif
@@ -218,19 +215,12 @@ private:
     WebBackForwardListItemMap m_backForwardListItemMap;
 };
 
-template<typename E, typename T>
-bool WebProcessProxy::deprecatedSend(E messageID, uint64_t destinationID, const T& arguments)
-{
-    OwnPtr<CoreIPC::MessageEncoder> encoder = CoreIPC::MessageEncoder::create(CoreIPC::MessageKindTraits<E>::messageReceiverName(), "", destinationID);
-    encoder->encode(arguments);
-
-    return sendMessage(CoreIPC::MessageID(messageID), encoder.release(), 0);
-}
-
 template<typename T>
 bool WebProcessProxy::send(const T& message, uint64_t destinationID, unsigned messageSendFlags)
 {
-    OwnPtr<CoreIPC::MessageEncoder> encoder = CoreIPC::MessageEncoder::create(T::receiverName(), "", destinationID);
+    COMPILE_ASSERT(!T::isSync, AsyncMessageExpected);
+
+    OwnPtr<CoreIPC::MessageEncoder> encoder = CoreIPC::MessageEncoder::create(T::receiverName(), T::name(), destinationID);
     encoder->encode(message);
 
     return sendMessage(CoreIPC::MessageID(T::messageID), encoder.release(), messageSendFlags);
@@ -239,6 +229,8 @@ bool WebProcessProxy::send(const T& message, uint64_t destinationID, unsigned me
 template<typename U> 
 bool WebProcessProxy::sendSync(const U& message, const typename U::Reply& reply, uint64_t destinationID, double timeout)
 {
+    COMPILE_ASSERT(U::isSync, SyncMessageExpected);
+
     if (!m_connection)
         return false;
 
diff --git a/Source/WebKit2/UIProcess/WebProcessProxy.messages.in b/Source/WebKit2/UIProcess/WebProcessProxy.messages.in
index e72138893..22e2f08ea 100644
--- a/Source/WebKit2/UIProcess/WebProcessProxy.messages.in
+++ b/Source/WebKit2/UIProcess/WebProcessProxy.messages.in
@@ -36,7 +36,7 @@ messages -> WebProcessProxy {
     # Plugin messages.
 #if ENABLE(NETSCAPE_PLUGIN_API)
     GetPlugins(uint64_t requestID, bool refresh) DispatchOnConnectionQueue
-    GetPluginPath(WTF::String mimeType, WTF::String urlString) -> (WTF::String pluginPath, bool blocked)
+    GetPluginPath(WTF::String mimeType, WTF::String urlString) -> (WTF::String pluginPath, uint32_t pluginLoadPolicy)
 #endif // ENABLE(NETSCAPE_PLUGIN_API)
 #if ENABLE(PLUGIN_PROCESS)
     GetPluginProcessConnection(WTF::String pluginPath) -> (CoreIPC::Attachment connectionHandle, bool supportsAsynchronousInitialization) Delayed
diff --git a/Source/WebKit2/UIProcess/cairo/BackingStoreCairo.cpp b/Source/WebKit2/UIProcess/cairo/BackingStoreCairo.cpp
index 4d98f9f0c..71f48e7f0 100644
--- a/Source/WebKit2/UIProcess/cairo/BackingStoreCairo.cpp
+++ b/Source/WebKit2/UIProcess/cairo/BackingStoreCairo.cpp
@@ -34,7 +34,7 @@
 #include <cairo.h>
 
 #if PLATFORM(EFL)
-#include "ewk_view_private.h"
+#include "EwkViewImpl.h"
 #endif
 
 using namespace WebCore;
@@ -71,7 +71,8 @@ void BackingStore::incorporateUpdate(ShareableBitmap* bitmap, const UpdateInfo&
 
 #if PLATFORM(EFL)
     // Update ewk_view with new backingStore image.
-    ewk_view_image_data_set(m_webPageProxy->viewWidget(), cairo_image_surface_get_data(m_backingStore->cairoSurface()), m_size);
+    EwkViewImpl* viewImpl = EwkViewImpl::fromEvasObject(m_webPageProxy->viewWidget());
+    viewImpl->setImageData(cairo_image_surface_get_data(m_backingStore->cairoSurface()), m_size);
 #endif
 }
 
diff --git a/Source/WebKit2/UIProcess/cf/WebBackForwardListCF.cpp b/Source/WebKit2/UIProcess/cf/WebBackForwardListCF.cpp
index cdff34469..7c1f240ec 100644
--- a/Source/WebKit2/UIProcess/cf/WebBackForwardListCF.cpp
+++ b/Source/WebKit2/UIProcess/cf/WebBackForwardListCF.cpp
@@ -94,9 +94,9 @@ CFDictionaryRef WebBackForwardList::createCFDictionaryRepresentation(WebPageProx
             continue;
         }
         
-        RetainPtr<CFStringRef> url(AdoptCF, m_entries[i]->url().createCFString());
-        RetainPtr<CFStringRef> title(AdoptCF, m_entries[i]->title().createCFString());
-        RetainPtr<CFStringRef> originalURL(AdoptCF, m_entries[i]->originalURL().createCFString());
+        RetainPtr<CFStringRef> url = m_entries[i]->url().createCFString();
+        RetainPtr<CFStringRef> title = m_entries[i]->title().createCFString();
+        RetainPtr<CFStringRef> originalURL = m_entries[i]->originalURL().createCFString();
 
         // FIXME: This uses the CoreIPC data encoding format, which means that whenever we change the CoreIPC encoding we need to bump the CurrentSessionStateDataVersion
         // constant in WebPageProxyCF.cpp. The CoreIPC data format is meant to be an implementation detail, and not something that should be written to disk.
diff --git a/Source/WebKit2/UIProcess/cf/WebPageProxyCF.cpp b/Source/WebKit2/UIProcess/cf/WebPageProxyCF.cpp
index 79dd8ced0..fac02c1b4 100644
--- a/Source/WebKit2/UIProcess/cf/WebPageProxyCF.cpp
+++ b/Source/WebKit2/UIProcess/cf/WebPageProxyCF.cpp
@@ -65,7 +65,7 @@ PassRefPtr<WebData> WebPageProxy::sessionStateData(WebPageProxySessionStateFilte
         if (provisionalURL.isEmpty())
             provisionalURL = m_mainFrame->provisionalURL();
         if (!provisionalURL.isEmpty()) {
-            provisionalURLString.adoptCF(provisionalURL.createCFString());
+            provisionalURLString = provisionalURL.createCFString();
             keys[numValues] = ProvisionalURLKey();
             values[numValues] = provisionalURLString.get();
             ++numValues;
@@ -179,8 +179,7 @@ void WebPageProxy::restoreFromSessionStateData(WebData* webData)
 
 static RetainPtr<CFStringRef> autosaveKey(const String& name)
 {
-    String key = "com.apple.WebKit.searchField:" + name;
-    return RetainPtr<CFStringRef>(AdoptCF, key.createCFString());
+    return String("com.apple.WebKit.searchField:" + name).createCFString();
 }
 
 void WebPageProxy::saveRecentSearches(const String& name, const Vector<String>& searchItems)
@@ -192,10 +191,8 @@ void WebPageProxy::saveRecentSearches(const String& name, const Vector<String>&
 
     if (size_t size = searchItems.size()) {
         items.adoptCF(CFArrayCreateMutable(0, size, &kCFTypeArrayCallBacks));
-        for (size_t i = 0; i < size; ++i) {
-            RetainPtr<CFStringRef> item(AdoptCF, searchItems[i].createCFString());
-            CFArrayAppendValue(items.get(), item.get());
-        }
+        for (size_t i = 0; i < size; ++i)
+            CFArrayAppendValue(items.get(), searchItems[i].createCFString().get());
     }
 
     CFPreferencesSetAppValue(autosaveKey(name).get(), items.get(), kCFPreferencesCurrentApplication);
diff --git a/Source/WebKit2/UIProcess/API/efl/BatteryProvider.cpp b/Source/WebKit2/UIProcess/efl/BatteryProvider.cpp
index 810711597..810711597 100644
--- a/Source/WebKit2/UIProcess/API/efl/BatteryProvider.cpp
+++ b/Source/WebKit2/UIProcess/efl/BatteryProvider.cpp
diff --git a/Source/WebKit2/UIProcess/API/efl/BatteryProvider.h b/Source/WebKit2/UIProcess/efl/BatteryProvider.h
index c54414e68..b829d7ed5 100644
--- a/Source/WebKit2/UIProcess/API/efl/BatteryProvider.h
+++ b/Source/WebKit2/UIProcess/efl/BatteryProvider.h
@@ -35,6 +35,8 @@
 #include <WebKit2/WKBase.h>
 #include <wtf/PassRefPtr.h>
 
+namespace WebKit {
+
 class BatteryProvider : public RefCounted<BatteryProvider>, public WebCore::BatteryProviderEflClient {
 public:
     virtual ~BatteryProvider();
@@ -53,6 +55,8 @@ private:
     WebCore::BatteryProviderEfl m_provider;
 };
 
+} // namespace WebKit
+
 #endif // ENABLE(BATTERY_STATUS)
 
 #endif // BatteryProvider_h
diff --git a/Source/WebKit2/UIProcess/efl/ContextHistoryClientEfl.cpp b/Source/WebKit2/UIProcess/efl/ContextHistoryClientEfl.cpp
new file mode 100644
index 000000000..c008a6395
--- /dev/null
+++ b/Source/WebKit2/UIProcess/efl/ContextHistoryClientEfl.cpp
@@ -0,0 +1,144 @@
+/*
+ * Copyright (C) 2012 Intel Corporation. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "ContextHistoryClientEfl.h"
+
+#include "DownloadProxy.h"
+#include "EwkViewImpl.h"
+#include "WKAPICast.h"
+#include "WKContext.h"
+#include "WKEinaSharedString.h"
+#include "WKString.h"
+#include "ewk_context_private.h"
+#include "ewk_navigation_data.h"
+#include "ewk_navigation_data_private.h"
+#include "ewk_url_response.h"
+#include "ewk_url_response_private.h"
+
+namespace WebKit {
+
+static inline const ContextHistoryClientEfl* toContextHistoryClientEfl(const void* clientInfo)
+{
+    ASSERT(clientInfo);
+    return static_cast<const ContextHistoryClientEfl*>(clientInfo);
+}
+
+void ContextHistoryClientEfl::didNavigateWithNavigationData(WKContextRef, WKPageRef page, WKNavigationDataRef navigationData, WKFrameRef, const void* clientInfo)
+{
+    const ContextHistoryClientEfl* historyClient = toContextHistoryClientEfl(clientInfo);
+
+    if (!historyClient->m_navigate)
+        return;
+
+    RefPtr<Ewk_Navigation_Data> navigationDataEwk = EwkNavigationData::create(navigationData);
+    historyClient->m_navigate(EwkViewImpl::viewFromPageViewMap(page), navigationDataEwk.get(), historyClient->m_userData);
+}
+
+void ContextHistoryClientEfl::didPerformClientRedirect(WKContextRef, WKPageRef page, WKURLRef sourceURL, WKURLRef destinationURL, WKFrameRef, const void* clientInfo)
+{
+    const ContextHistoryClientEfl* historyClient = toContextHistoryClientEfl(clientInfo);
+
+    if (!historyClient->m_clientRedirect)
+        return;
+
+    WKEinaSharedString sourceURLString(sourceURL);
+    WKEinaSharedString destinationURLString(destinationURL);
+
+    historyClient->m_clientRedirect(EwkViewImpl::viewFromPageViewMap(page), sourceURLString, destinationURLString, historyClient->m_userData);
+}
+
+void ContextHistoryClientEfl::didPerformServerRedirect(WKContextRef, WKPageRef page, WKURLRef sourceURL, WKURLRef destinationURL, WKFrameRef, const void* clientInfo)
+{
+    const ContextHistoryClientEfl* historyClient = toContextHistoryClientEfl(clientInfo);
+
+    if (!historyClient->m_serverRedirect)
+        return;
+
+    WKEinaSharedString sourceURLString(sourceURL);
+    WKEinaSharedString destinationURLString(destinationURL);
+
+    historyClient->m_serverRedirect(EwkViewImpl::viewFromPageViewMap(page), sourceURLString, destinationURLString, historyClient->m_userData);
+}
+
+void ContextHistoryClientEfl::didUpdateHistoryTitle(WKContextRef, WKPageRef page, WKStringRef title, WKURLRef URL, WKFrameRef, const void* clientInfo)
+{
+    const ContextHistoryClientEfl* historyClient = toContextHistoryClientEfl(clientInfo);
+
+    if (!historyClient->m_titleUpdated)
+        return;
+
+    WKEinaSharedString titleString(title);
+    WKEinaSharedString stringURL(URL);
+
+    historyClient->m_titleUpdated(EwkViewImpl::viewFromPageViewMap(page), titleString, stringURL, historyClient->m_userData);
+}
+
+void ContextHistoryClientEfl::populateVisitedLinks(WKContextRef, const void* clientInfo)
+{
+    const ContextHistoryClientEfl* historyClient = toContextHistoryClientEfl(clientInfo);
+
+    if (!historyClient->m_populateVisitedLinks)
+        return;
+
+    historyClient->m_populateVisitedLinks(historyClient->m_userData);
+}
+
+ContextHistoryClientEfl::ContextHistoryClientEfl(WKContextRef context)
+    : m_userData(0)
+    , m_navigate(0)
+    , m_clientRedirect(0)
+    , m_serverRedirect(0)
+    , m_titleUpdated(0)
+    , m_populateVisitedLinks(0)
+{
+    ASSERT(context);
+
+    WKContextHistoryClient wkHistoryClient;
+    memset(&wkHistoryClient, 0, sizeof(WKContextHistoryClient));
+
+    wkHistoryClient.version = kWKContextHistoryClientCurrentVersion;
+    wkHistoryClient.clientInfo = this;
+
+    wkHistoryClient.didNavigateWithNavigationData = didNavigateWithNavigationData;
+    wkHistoryClient.didPerformClientRedirect = didPerformClientRedirect;
+    wkHistoryClient.didPerformServerRedirect = didPerformServerRedirect;
+    wkHistoryClient.didUpdateHistoryTitle = didUpdateHistoryTitle;
+    wkHistoryClient.populateVisitedLinks = populateVisitedLinks;
+
+    WKContextSetHistoryClient(context, &wkHistoryClient);
+}
+
+void ContextHistoryClientEfl::setCallbacks(Ewk_History_Navigation_Cb navigate, Ewk_History_Client_Redirection_Cb clientRedirect, Ewk_History_Server_Redirection_Cb serverRedirect, Ewk_History_Title_Update_Cb titleUpdate, Ewk_History_Populate_Visited_Links_Cb populateVisitedLinks, void* data)
+{
+    m_navigate = navigate;
+    m_clientRedirect = clientRedirect;
+    m_serverRedirect = serverRedirect;
+    m_titleUpdated = titleUpdate;
+    m_populateVisitedLinks = populateVisitedLinks;
+    m_userData = data;
+}
+
+} // namespace WebKit
diff --git a/Source/WebKit2/UIProcess/efl/ContextHistoryClientEfl.h b/Source/WebKit2/UIProcess/efl/ContextHistoryClientEfl.h
new file mode 100644
index 000000000..32032565a
--- /dev/null
+++ b/Source/WebKit2/UIProcess/efl/ContextHistoryClientEfl.h
@@ -0,0 +1,63 @@
+/*
+ * Copyright (C) 2012 Intel Corporation. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef ContextHistoryClientEfl_h
+#define ContextHistoryClientEfl_h
+
+#include "ewk_context.h"
+#include <WebKit2/WKBase.h>
+#include <wtf/PassOwnPtr.h>
+
+namespace WebKit {
+
+class ContextHistoryClientEfl {
+public:
+    static PassOwnPtr<ContextHistoryClientEfl> create(WKContextRef context)
+    {
+        return adoptPtr(new ContextHistoryClientEfl(context));
+    }
+
+    void setCallbacks(Ewk_History_Navigation_Cb, Ewk_History_Client_Redirection_Cb, Ewk_History_Server_Redirection_Cb, Ewk_History_Title_Update_Cb, Ewk_History_Populate_Visited_Links_Cb, void*);
+
+private:
+    explicit ContextHistoryClientEfl(WKContextRef);
+
+    static void didNavigateWithNavigationData(WKContextRef, WKPageRef, WKNavigationDataRef, WKFrameRef, const void*);
+    static void didPerformClientRedirect(WKContextRef, WKPageRef, WKURLRef sourceURL, WKURLRef, WKFrameRef, const void*);
+    static void didPerformServerRedirect(WKContextRef, WKPageRef, WKURLRef sourceURL, WKURLRef, WKFrameRef, const void*);
+    static void didUpdateHistoryTitle(WKContextRef, WKPageRef, WKStringRef, WKURLRef, WKFrameRef, const void*);
+    static void populateVisitedLinks(WKContextRef, const void*);
+
+    void* m_userData;
+    Ewk_History_Navigation_Cb m_navigate;
+    Ewk_History_Client_Redirection_Cb m_clientRedirect;
+    Ewk_History_Server_Redirection_Cb m_serverRedirect;
+    Ewk_History_Title_Update_Cb m_titleUpdated;
+    Ewk_History_Populate_Visited_Links_Cb m_populateVisitedLinks;
+};
+
+} // namespace WebKit
+
+#endif // ContextHistoryClientEfl_h
diff --git a/Source/WebKit2/UIProcess/efl/DownloadManagerEfl.cpp b/Source/WebKit2/UIProcess/efl/DownloadManagerEfl.cpp
new file mode 100644
index 000000000..869e44f3a
--- /dev/null
+++ b/Source/WebKit2/UIProcess/efl/DownloadManagerEfl.cpp
@@ -0,0 +1,162 @@
+/*
+ * Copyright (C) 2012 Intel Corporation. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "DownloadManagerEfl.h"
+
+#include "DownloadProxy.h"
+#include "EwkViewImpl.h"
+#include "WKContext.h"
+#include "WKString.h"
+#include "ewk_context_private.h"
+#include "ewk_error_private.h"
+#include "ewk_view.h"
+
+using namespace EwkViewCallbacks;
+
+namespace WebKit {
+
+static inline DownloadManagerEfl* toDownloadManagerEfl(const void* clientInfo)
+{
+    return static_cast<DownloadManagerEfl*>(const_cast<void*>(clientInfo));
+}
+
+WKStringRef DownloadManagerEfl::decideDestinationWithSuggestedFilename(WKContextRef, WKDownloadRef wkDownload, WKStringRef filename, bool* /*allowOverwrite*/, const void* clientInfo)
+{
+    EwkDownloadJob* download = toDownloadManagerEfl(clientInfo)->downloadJob(toImpl(wkDownload)->downloadID());
+    ASSERT(download);
+
+    download->setSuggestedFileName(toImpl(filename)->string().utf8().data());
+
+    // We send the new download signal on the Ewk_View only once we have received the response
+    // and the suggested file name.
+    download->viewImpl()->smartCallback<DownloadJobRequested>().call(download);
+
+    // DownloadSoup expects the destination to be a URL.
+    String destination = ASCIILiteral("file://") + String::fromUTF8(download->destination());
+
+    return WKStringCreateWithUTF8CString(destination.utf8().data());
+}
+
+void DownloadManagerEfl::didReceiveResponse(WKContextRef, WKDownloadRef wkDownload, WKURLResponseRef wkResponse, const void* clientInfo)
+{
+    EwkDownloadJob* download = toDownloadManagerEfl(clientInfo)->downloadJob(toImpl(wkDownload)->downloadID());
+    ASSERT(download);
+    download->setResponse(EwkUrlResponse::create(wkResponse));
+}
+
+void DownloadManagerEfl::didCreateDestination(WKContextRef, WKDownloadRef wkDownload, WKStringRef /*path*/, const void* clientInfo)
+{
+    EwkDownloadJob* download = toDownloadManagerEfl(clientInfo)->downloadJob(toImpl(wkDownload)->downloadID());
+    ASSERT(download);
+
+    download->setState(EWK_DOWNLOAD_JOB_STATE_DOWNLOADING);
+}
+
+void DownloadManagerEfl::didReceiveData(WKContextRef, WKDownloadRef wkDownload, uint64_t length, const void* clientInfo)
+{
+    EwkDownloadJob* download = toDownloadManagerEfl(clientInfo)->downloadJob(toImpl(wkDownload)->downloadID());
+    ASSERT(download);
+    download->incrementReceivedData(length);
+}
+
+void DownloadManagerEfl::didFail(WKContextRef, WKDownloadRef wkDownload, WKErrorRef error, const void* clientInfo)
+{
+    DownloadManagerEfl* downloadManager = toDownloadManagerEfl(clientInfo);
+    uint64_t downloadId = toImpl(wkDownload)->downloadID();
+    EwkDownloadJob* download = downloadManager->downloadJob(downloadId);
+    ASSERT(download);
+
+    OwnPtr<Ewk_Error> ewkError = Ewk_Error::create(error);
+    download->setState(EWK_DOWNLOAD_JOB_STATE_FAILED);
+    Ewk_Download_Job_Error downloadError = { download, ewkError.get() };
+    download->viewImpl()->smartCallback<DownloadJobFailed>().call(&downloadError);
+    downloadManager->unregisterDownloadJob(downloadId);
+}
+
+void DownloadManagerEfl::didCancel(WKContextRef, WKDownloadRef wkDownload, const void* clientInfo)
+{
+    DownloadManagerEfl* downloadManager = toDownloadManagerEfl(clientInfo);
+    uint64_t downloadId = toImpl(wkDownload)->downloadID();
+    EwkDownloadJob* download = downloadManager->downloadJob(downloadId);
+    ASSERT(download);
+
+    download->setState(EWK_DOWNLOAD_JOB_STATE_CANCELLED);
+    download->viewImpl()->smartCallback<DownloadJobCancelled>().call(download);
+    downloadManager->unregisterDownloadJob(downloadId);
+}
+
+void DownloadManagerEfl::didFinish(WKContextRef, WKDownloadRef wkDownload, const void* clientInfo)
+{
+    DownloadManagerEfl* downloadManager = toDownloadManagerEfl(clientInfo);
+    uint64_t downloadId = toImpl(wkDownload)->downloadID();
+    EwkDownloadJob* download = downloadManager->downloadJob(downloadId);
+    ASSERT(download);
+
+    download->setState(EWK_DOWNLOAD_JOB_STATE_FINISHED);
+    download->viewImpl()->smartCallback<DownloadJobFinished>().call(download);
+    downloadManager->unregisterDownloadJob(downloadId);
+}
+
+DownloadManagerEfl::DownloadManagerEfl(EwkContext* context)
+    : m_context(context)
+{
+    WKContextDownloadClient wkDownloadClient;
+    memset(&wkDownloadClient, 0, sizeof(WKContextDownloadClient));
+
+    wkDownloadClient.version = kWKContextDownloadClientCurrentVersion;
+    wkDownloadClient.clientInfo = this;
+    wkDownloadClient.didCancel = didCancel;
+    wkDownloadClient.decideDestinationWithSuggestedFilename = decideDestinationWithSuggestedFilename;
+    wkDownloadClient.didCreateDestination = didCreateDestination;
+    wkDownloadClient.didReceiveResponse = didReceiveResponse;
+    wkDownloadClient.didReceiveData = didReceiveData;
+    wkDownloadClient.didFail = didFail;
+    wkDownloadClient.didFinish = didFinish;
+
+    WKContextSetDownloadClient(context->wkContext(), &wkDownloadClient);
+}
+
+void DownloadManagerEfl::registerDownload(DownloadProxy* download, EwkViewImpl* viewImpl)
+{
+    uint64_t downloadId = download->downloadID();
+    if (m_downloadJobs.contains(downloadId))
+        return;
+
+    RefPtr<EwkDownloadJob> ewkDownload = EwkDownloadJob::create(download, viewImpl);
+    m_downloadJobs.add(downloadId, ewkDownload);
+}
+
+EwkDownloadJob* DownloadManagerEfl::downloadJob(uint64_t id) const
+{
+    return m_downloadJobs.get(id).get();
+}
+
+void DownloadManagerEfl::unregisterDownloadJob(uint64_t id)
+{
+    m_downloadJobs.remove(id);
+}
+
+} // namespace WebKit
diff --git a/Source/WebKit2/UIProcess/efl/DownloadManagerEfl.h b/Source/WebKit2/UIProcess/efl/DownloadManagerEfl.h
new file mode 100644
index 000000000..dfc627a62
--- /dev/null
+++ b/Source/WebKit2/UIProcess/efl/DownloadManagerEfl.h
@@ -0,0 +1,68 @@
+/*
+ * Copyright (C) 2012 Intel Corporation. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef DownloadManagerEfl_h
+#define DownloadManagerEfl_h
+
+#include "ewk_download_job_private.h"
+#include <wtf/HashMap.h>
+#include <wtf/PassOwnPtr.h>
+#include <wtf/RefPtr.h>
+
+class EwkContext;
+class EwkDownloadJob;
+
+namespace WebKit {
+
+class DownloadManagerEfl {
+public:
+    static PassOwnPtr<DownloadManagerEfl> create(EwkContext* context)
+    {
+        return adoptPtr(new DownloadManagerEfl(context));
+    }
+
+    void registerDownload(DownloadProxy*, EwkViewImpl*);
+
+private:
+    DownloadManagerEfl(EwkContext*);
+
+    EwkDownloadJob* downloadJob(uint64_t id) const;
+    void unregisterDownloadJob(uint64_t id);
+
+    static WKStringRef decideDestinationWithSuggestedFilename(WKContextRef, WKDownloadRef, WKStringRef filename, bool* allowOverwrite, const void* clientInfo);
+    static void didReceiveResponse(WKContextRef, WKDownloadRef, WKURLResponseRef, const void* clientInfo);
+    static void didCreateDestination(WKContextRef, WKDownloadRef, WKStringRef path, const void* clientInfo);
+    static void didReceiveData(WKContextRef, WKDownloadRef, uint64_t length, const void* clientInfo);
+    static void didFail(WKContextRef, WKDownloadRef, WKErrorRef, const void* clientInfo);
+    static void didCancel(WKContextRef, WKDownloadRef, const void* clientInfo);
+    static void didFinish(WKContextRef, WKDownloadRef, const void* clientInfo);
+
+    EwkContext* m_context;
+    HashMap<uint64_t, RefPtr<EwkDownloadJob> > m_downloadJobs;
+};
+
+} // namespace WebKit
+
+#endif // DownloadManagerEfl_h
diff --git a/Source/WebKit2/UIProcess/API/efl/ewk_view_find_client.cpp b/Source/WebKit2/UIProcess/efl/FindClientEfl.cpp
index 1edc3cbfd..5b2e88ea2 100644
--- a/Source/WebKit2/UIProcess/API/efl/ewk_view_find_client.cpp
+++ b/Source/WebKit2/UIProcess/efl/FindClientEfl.cpp
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2012 Samsung Electronics. All rights reserved.
+ * Copyright (C) 2012 Intel Corporation. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -24,39 +25,47 @@
  */
 
 #include "config.h"
+#include "FindClientEfl.h"
 
+#include "EwkViewImpl.h"
 #include "WKPage.h"
-#include "ewk_view_find_client_private.h"
-#include "ewk_view_private.h"
 
-static inline Evas_Object* toEwkView(const void* clientInfo)
-{
-    return static_cast<Evas_Object*>(const_cast<void*>(clientInfo));
-}
+using namespace EwkViewCallbacks;
+
+namespace WebKit {
 
-static void didFindString(WKPageRef, WKStringRef, unsigned matchCount, const void* clientInfo)
+static inline FindClientEfl* toFindClientEfl(const void* clientInfo)
 {
-    ewk_view_text_found(toEwkView(clientInfo), matchCount);
+    return static_cast<FindClientEfl*>(const_cast<void*>(clientInfo));
 }
 
-static void didFailToFindString(WKPageRef, WKStringRef, const void* clientInfo)
+void FindClientEfl::didFindString(WKPageRef, WKStringRef, unsigned matchCount, const void* clientInfo)
 {
-    ewk_view_text_found(toEwkView(clientInfo), 0);
+    FindClientEfl* findClient = toFindClientEfl(clientInfo);
+    findClient->m_viewImpl->smartCallback<TextFound>().call(&matchCount);
 }
 
-static void didCountStringMatches(WKPageRef, WKStringRef, unsigned matchCount, const void* clientInfo)
+void FindClientEfl::didFailToFindString(WKPageRef, WKStringRef, const void* clientInfo)
 {
-    ewk_view_text_found(toEwkView(clientInfo), matchCount);
+    FindClientEfl* findClient = toFindClientEfl(clientInfo);
+    unsigned matchCount = 0;
+    findClient->m_viewImpl->smartCallback<TextFound>().call(&matchCount);
 }
 
-void ewk_view_find_client_attach(WKPageRef pageRef, Evas_Object* ewkView)
+FindClientEfl::FindClientEfl(EwkViewImpl* viewImpl)
+    : m_viewImpl(viewImpl)
 {
+    WKPageRef pageRef = m_viewImpl->wkPage();
+    ASSERT(pageRef);
+
     WKPageFindClient findClient;
     memset(&findClient, 0, sizeof(WKPageFindClient));
     findClient.version = kWKPageFindClientCurrentVersion;
-    findClient.clientInfo = ewkView;
+    findClient.clientInfo = this;
     findClient.didFindString = didFindString;
     findClient.didFailToFindString = didFailToFindString;
-    findClient.didCountStringMatches = didCountStringMatches;
+    findClient.didCountStringMatches = didFindString;
     WKPageSetPageFindClient(pageRef, &findClient);
 }
+
+} // namespace WebKit
diff --git a/Source/WebKit2/UIProcess/API/efl/ewk_view_ui_client_private.h b/Source/WebKit2/UIProcess/efl/FindClientEfl.h
index 4c9c492a5..274460b1a 100644
--- a/Source/WebKit2/UIProcess/API/efl/ewk_view_ui_client_private.h
+++ b/Source/WebKit2/UIProcess/efl/FindClientEfl.h
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2012 Samsung Electronics. All rights reserved.
+ * Copyright (C) 2012 Intel Corporation. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -23,12 +24,32 @@
  * THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef ewk_view_ui_client_private_h
-#define ewk_view_ui_client_private_h
+#ifndef FindClientEfl_h
+#define FindClientEfl_h
 
-#include <Evas.h>
 #include <WebKit2/WKBase.h>
+#include <wtf/PassOwnPtr.h>
 
-void ewk_view_ui_client_attach(WKPageRef pageRef, Evas_Object* ewkView);
+class EwkViewImpl;
 
-#endif // ewk_view_ui_client_private_h
+namespace WebKit {
+
+class FindClientEfl {
+public:
+    static PassOwnPtr<FindClientEfl> create(EwkViewImpl* viewImpl)
+    {
+        return adoptPtr(new FindClientEfl(viewImpl));
+    }
+
+private:
+    explicit FindClientEfl(EwkViewImpl*);
+
+    static void didFindString(WKPageRef, WKStringRef, unsigned matchCount, const void* clientInfo);
+    static void didFailToFindString(WKPageRef, WKStringRef, const void* clientInfo);
+
+    EwkViewImpl* m_viewImpl;
+};
+
+} // namespace WebKit
+
+#endif // FindClientEfl_h
diff --git a/Source/WebKit2/UIProcess/API/efl/ewk_view_form_client.cpp b/Source/WebKit2/UIProcess/efl/FormClientEfl.cpp
index 7509ed96d..5b893092d 100644
--- a/Source/WebKit2/UIProcess/API/efl/ewk_view_form_client.cpp
+++ b/Source/WebKit2/UIProcess/efl/FormClientEfl.cpp
@@ -24,27 +24,41 @@
  */
 
 #include "config.h"
+#include "FormClientEfl.h"
 
+#include "EwkViewImpl.h"
 #include "WKPage.h"
-#include "ewk_form_submission_request.h"
 #include "ewk_form_submission_request_private.h"
-#include "ewk_view_form_client_private.h"
-#include "ewk_view_private.h"
 
-static void willSubmitForm(WKPageRef, WKFrameRef /*frame*/, WKFrameRef /*sourceFrame*/, WKDictionaryRef values, WKTypeRef /*userData*/, WKFormSubmissionListenerRef listener, const void* clientInfo)
+using namespace EwkViewCallbacks;
+
+namespace WebKit {
+
+static inline FormClientEfl* toFormClientEfl(const void* clientInfo)
 {
-    Evas_Object* ewkView = static_cast<Evas_Object*>(const_cast<void*>(clientInfo));
+    return static_cast<FormClientEfl*>(const_cast<void*>(clientInfo));
+}
+
+void FormClientEfl::willSubmitForm(WKPageRef, WKFrameRef /*frame*/, WKFrameRef /*sourceFrame*/, WKDictionaryRef values, WKTypeRef /*userData*/, WKFormSubmissionListenerRef listener, const void* clientInfo)
+{
+    FormClientEfl* formClient = toFormClientEfl(clientInfo);
 
     RefPtr<Ewk_Form_Submission_Request> request = Ewk_Form_Submission_Request::create(values, listener);
-    ewk_view_form_submission_request_new(ewkView, request.get());
+    formClient->m_viewImpl->smartCallback<NewFormSubmissionRequest>().call(request.get());
 }
 
-void ewk_view_form_client_attach(WKPageRef pageRef, Evas_Object* ewkView)
+FormClientEfl::FormClientEfl(EwkViewImpl* viewImpl)
+    : m_viewImpl(viewImpl)
 {
+    WKPageRef pageRef = m_viewImpl->wkPage();
+    ASSERT(pageRef);
+
     WKPageFormClient formClient;
     memset(&formClient, 0, sizeof(WKPageFormClient));
     formClient.version = kWKPageFormClientCurrentVersion;
-    formClient.clientInfo = ewkView;
+    formClient.clientInfo = this;
     formClient.willSubmitForm = willSubmitForm;
     WKPageSetPageFormClient(pageRef, &formClient);
 }
+
+} // namespace WebKit
diff --git a/Source/WebKit2/UIProcess/API/efl/ewk_context_history_client_private.h b/Source/WebKit2/UIProcess/efl/FormClientEfl.h
index 0b470dcaf..66e060c14 100644
--- a/Source/WebKit2/UIProcess/API/efl/ewk_context_history_client_private.h
+++ b/Source/WebKit2/UIProcess/efl/FormClientEfl.h
@@ -23,20 +23,31 @@
  * THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef ewk_context_history_client_private_h
-#define ewk_context_history_client_private_h
-
-#include "ewk_context.h"
-
-struct Ewk_Context_History_Client {
-    void* user_data;
-    Ewk_History_Navigation_Cb navigate_func;
-    Ewk_History_Client_Redirection_Cb client_redirect_func;
-    Ewk_History_Server_Redirection_Cb server_redirect_func;
-    Ewk_History_Title_Update_Cb title_update_func;
-    Ewk_History_Populate_Visited_Links_Cb populate_visited_links_func;
+#ifndef FormClientEfl_h
+#define FormClientEfl_h
+
+#include <WebKit2/WKBase.h>
+#include <wtf/PassOwnPtr.h>
+
+class EwkViewImpl;
+
+namespace WebKit {
+
+class FormClientEfl {
+public:
+    static PassOwnPtr<FormClientEfl> create(EwkViewImpl* viewImpl)
+    {
+        return adoptPtr(new FormClientEfl(viewImpl));
+    }
+
+private:
+    explicit FormClientEfl(EwkViewImpl*);
+
+    static void willSubmitForm(WKPageRef, WKFrameRef, WKFrameRef, WKDictionaryRef values, WKTypeRef userData, WKFormSubmissionListenerRef, const void* clientInfo);
+
+    EwkViewImpl* m_viewImpl;
 };
 
-void ewk_context_history_client_attach(Ewk_Context*);
+} // namespace WebKit
 
-#endif // ewk_context_history_client_private_h
+#endif // FormClientEfl_h
diff --git a/Source/WebKit2/UIProcess/efl/InputMethodContextEfl.cpp b/Source/WebKit2/UIProcess/efl/InputMethodContextEfl.cpp
new file mode 100644
index 000000000..531e3bead
--- /dev/null
+++ b/Source/WebKit2/UIProcess/efl/InputMethodContextEfl.cpp
@@ -0,0 +1,132 @@
+/*
+ * Copyright (C) 2011 Samsung Electronics
+ * Copyright (C) 2012 Intel Corporation. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#include "config.h"
+#include "InputMethodContextEfl.h"
+
+#include "EwkViewImpl.h"
+#include "WebPageProxy.h"
+#include <Ecore_Evas.h>
+#include <Ecore_IMF_Evas.h>
+
+using namespace WebCore;
+
+namespace WebKit {
+
+InputMethodContextEfl::InputMethodContextEfl(EwkViewImpl* viewImpl, PassOwnPtr<Ecore_IMF_Context> context)
+    : m_viewImpl(viewImpl)
+    , m_context(context)
+    , m_focused(false)
+{
+    ASSERT(m_context);
+    ecore_imf_context_event_callback_add(m_context.get(), ECORE_IMF_CALLBACK_PREEDIT_CHANGED, onIMFPreeditSequenceChanged, this);
+    ecore_imf_context_event_callback_add(m_context.get(), ECORE_IMF_CALLBACK_COMMIT, onIMFInputSequenceComplete, this);
+}
+
+InputMethodContextEfl::~InputMethodContextEfl()
+{
+}
+
+void InputMethodContextEfl::onIMFInputSequenceComplete(void* data, Ecore_IMF_Context*, void* eventInfo)
+{
+    InputMethodContextEfl* inputMethodContext = static_cast<InputMethodContextEfl*>(data);
+    if (!eventInfo || !inputMethodContext->m_focused)
+        return;
+
+    inputMethodContext->m_viewImpl->page()->confirmComposition(String::fromUTF8(static_cast<char*>(eventInfo)));
+}
+
+void InputMethodContextEfl::onIMFPreeditSequenceChanged(void* data, Ecore_IMF_Context* context, void*)
+{
+    InputMethodContextEfl* inputMethodContext = static_cast<InputMethodContextEfl*>(data);
+
+    if (!inputMethodContext->m_viewImpl->page()->focusedFrame() || !inputMethodContext->m_focused)
+        return;
+
+    char* buffer = 0;
+    ecore_imf_context_preedit_string_get(context, &buffer, 0);
+    if (!buffer)
+        return;
+
+    String preeditString = String::fromUTF8(buffer);
+    free(buffer);
+    Vector<CompositionUnderline> underlines;
+    underlines.append(CompositionUnderline(0, preeditString.length(), Color(0, 0, 0), false));
+    inputMethodContext->m_viewImpl->page()->setComposition(preeditString, underlines, 0);
+}
+
+PassOwnPtr<Ecore_IMF_Context> InputMethodContextEfl::createIMFContext(Evas* canvas)
+{
+    const char* defaultContextID = ecore_imf_context_default_id_get();
+    if (!defaultContextID)
+        return nullptr;
+
+    OwnPtr<Ecore_IMF_Context> imfContext = adoptPtr(ecore_imf_context_add(defaultContextID));
+    if (!imfContext)
+        return nullptr;
+
+    Ecore_Evas* ecoreEvas = ecore_evas_ecore_evas_get(canvas);
+    ecore_imf_context_client_window_set(imfContext.get(), reinterpret_cast<void*>(ecore_evas_window_get(ecoreEvas)));
+    ecore_imf_context_client_canvas_set(imfContext.get(), canvas);
+
+    return imfContext.release();
+}
+
+void InputMethodContextEfl::handleMouseUpEvent(const Evas_Event_Mouse_Up*)
+{
+    ecore_imf_context_reset(m_context.get());
+}
+
+void InputMethodContextEfl::handleKeyDownEvent(const Evas_Event_Key_Down* downEvent, bool* isFiltered)
+{
+    Ecore_IMF_Event inputMethodEvent;
+    ecore_imf_evas_event_key_down_wrap(const_cast<Evas_Event_Key_Down*>(downEvent), &inputMethodEvent.key_down);
+
+    *isFiltered = ecore_imf_context_filter_event(m_context.get(), ECORE_IMF_EVENT_KEY_DOWN, &inputMethodEvent);
+}
+
+void InputMethodContextEfl::updateTextInputState()
+{
+    if (!m_context)
+        return;
+
+    const EditorState& editor = m_viewImpl->page()->editorState();
+
+    if (editor.isContentEditable) {
+        if (m_focused)
+            return;
+
+        ecore_imf_context_reset(m_context.get());
+        ecore_imf_context_focus_in(m_context.get());
+        m_focused = true;
+    } else {
+        if (!m_focused)
+            return;
+
+        if (editor.hasComposition)
+            m_viewImpl->page()->cancelComposition();
+
+        m_focused = false;
+        ecore_imf_context_reset(m_context.get());
+        ecore_imf_context_focus_out(m_context.get());
+    }
+}
+
+}
diff --git a/Source/WebKit2/UIProcess/efl/InputMethodContextEfl.h b/Source/WebKit2/UIProcess/efl/InputMethodContextEfl.h
new file mode 100644
index 000000000..aaf51b936
--- /dev/null
+++ b/Source/WebKit2/UIProcess/efl/InputMethodContextEfl.h
@@ -0,0 +1,65 @@
+/*
+ * Copyright (C) 2011 Samsung Electronics
+ * Copyright (C) 2012 Intel Corporation. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#ifndef InputMethodContextEfl_h
+#define InputMethodContextEfl_h
+
+#include <Ecore_IMF.h>
+#include <Evas.h>
+#include <wtf/OwnPtr.h>
+#include <wtf/PassOwnPtr.h>
+
+class EwkViewImpl;
+
+namespace WebKit {
+
+class WebPageProxy;
+
+class InputMethodContextEfl {
+public:
+    static PassOwnPtr<InputMethodContextEfl> create(EwkViewImpl* viewImpl, Evas* canvas)
+    {
+        OwnPtr<Ecore_IMF_Context> context = createIMFContext(canvas);
+        if (!context)
+            return nullptr;
+
+        return adoptPtr(new InputMethodContextEfl(viewImpl, context.release()));
+    }
+    ~InputMethodContextEfl();
+
+    void handleMouseUpEvent(const Evas_Event_Mouse_Up* upEvent);
+    void handleKeyDownEvent(const Evas_Event_Key_Down* downEvent, bool* isFiltered);
+    void updateTextInputState();
+
+private:
+    InputMethodContextEfl(EwkViewImpl*, PassOwnPtr<Ecore_IMF_Context>);
+
+    static PassOwnPtr<Ecore_IMF_Context> createIMFContext(Evas* canvas);
+    static void onIMFInputSequenceComplete(void* data, Ecore_IMF_Context*, void* eventInfo);
+    static void onIMFPreeditSequenceChanged(void* data, Ecore_IMF_Context*, void* eventInfo);
+
+    EwkViewImpl* m_viewImpl;
+    OwnPtr<Ecore_IMF_Context> m_context;
+    bool m_focused;
+};
+
+} // namespace WebKit
+
+#endif // InputMethodContextEfl_h
diff --git a/Source/WebKit2/UIProcess/API/efl/NetworkInfoProvider.cpp b/Source/WebKit2/UIProcess/efl/NetworkInfoProvider.cpp
index 1431c83a7..f5456f9b8 100644
--- a/Source/WebKit2/UIProcess/API/efl/NetworkInfoProvider.cpp
+++ b/Source/WebKit2/UIProcess/efl/NetworkInfoProvider.cpp
@@ -32,6 +32,8 @@
 #include "WKNetworkInfoManager.h"
 #include <NotImplemented.h>
 
+using namespace WebKit;
+
 static inline NetworkInfoProvider* toNetworkInfoProvider(const void* clientInfo)
 {
     return static_cast<NetworkInfoProvider*>(const_cast<void*>(clientInfo));
diff --git a/Source/WebKit2/UIProcess/API/efl/NetworkInfoProvider.h b/Source/WebKit2/UIProcess/efl/NetworkInfoProvider.h
index 0a5d60e4f..57631193f 100644
--- a/Source/WebKit2/UIProcess/API/efl/NetworkInfoProvider.h
+++ b/Source/WebKit2/UIProcess/efl/NetworkInfoProvider.h
@@ -34,6 +34,8 @@
 #include <WebKit2/WKRetainPtr.h>
 #include <wtf/PassRefPtr.h>
 
+namespace WebKit {
+
 class NetworkInfoProvider : public RefCounted<NetworkInfoProvider>, public WebCore::NetworkInfoClient {
 public:
     virtual ~NetworkInfoProvider();
@@ -53,6 +55,8 @@ private:
     WebCore::NetworkInfoProviderEfl m_provider;
 };
 
+} // namespace WebKit
+
 #endif // ENABLE(NETWORK_INFO)
 
 #endif // NetworkInfoProvider_h
diff --git a/Source/WebKit2/UIProcess/efl/PageClientBase.cpp b/Source/WebKit2/UIProcess/efl/PageClientBase.cpp
new file mode 100644
index 000000000..b597d29e0
--- /dev/null
+++ b/Source/WebKit2/UIProcess/efl/PageClientBase.cpp
@@ -0,0 +1,316 @@
+/*
+ * Copyright (C) 2011 Samsung Electronics
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "PageClientBase.h"
+
+#include "DrawingAreaProxyImpl.h"
+#include "EwkViewImpl.h"
+#include "InputMethodContextEfl.h"
+#include "NativeWebKeyboardEvent.h"
+#include "NotImplemented.h"
+#include "WebContext.h"
+#include "WebContextMenuProxy.h"
+#include "WebPageGroup.h"
+#include "WebPageProxy.h"
+#include "WebPopupMenuProxyEfl.h"
+#include "WebPreferences.h"
+#include "ewk_context.h"
+#include "ewk_context_private.h"
+#include "ewk_download_job.h"
+#include "ewk_download_job_private.h"
+#include "ewk_private.h"
+#include "ewk_view.h"
+
+using namespace WebCore;
+using namespace EwkViewCallbacks;
+
+namespace WebKit {
+
+PageClientBase::PageClientBase(EwkViewImpl* viewImpl)
+    : m_viewImpl(viewImpl)
+{
+}
+
+PageClientBase::~PageClientBase()
+{
+}
+
+EwkViewImpl* PageClientBase::viewImpl() const
+{
+    return m_viewImpl;
+}
+
+// PageClient
+PassOwnPtr<DrawingAreaProxy> PageClientBase::createDrawingAreaProxy()
+{
+    return DrawingAreaProxyImpl::create(m_viewImpl->page());
+}
+
+void PageClientBase::setViewNeedsDisplay(const WebCore::IntRect& rect)
+{
+    m_viewImpl->update(rect);
+}
+
+void PageClientBase::displayView()
+{
+    notImplemented();
+}
+
+void PageClientBase::scrollView(const WebCore::IntRect& scrollRect, const WebCore::IntSize&)
+{
+    setViewNeedsDisplay(scrollRect);
+}
+
+WebCore::IntSize PageClientBase::viewSize()
+{
+    return m_viewImpl->size();
+}
+
+bool PageClientBase::isViewWindowActive()
+{
+    notImplemented();
+    return true;
+}
+
+bool PageClientBase::isViewFocused()
+{
+    return m_viewImpl->isFocused();
+}
+
+bool PageClientBase::isViewVisible()
+{
+    return m_viewImpl->isVisible();
+}
+
+bool PageClientBase::isViewInWindow()
+{
+    notImplemented();
+    return true;
+}
+
+void PageClientBase::processDidCrash()
+{
+    // Check if loading was ongoing, when web process crashed.
+    double loadProgress = ewk_view_load_progress_get(m_viewImpl->view());
+    if (loadProgress >= 0 && loadProgress < 1) {
+        loadProgress = 1;
+        m_viewImpl->smartCallback<LoadProgress>().call(&loadProgress);
+    }
+
+    bool handled = false;
+    m_viewImpl->smartCallback<WebProcessCrashed>().call(&handled);
+
+    if (!handled) {
+        CString url = m_viewImpl->page()->urlAtProcessExit().utf8();
+        WARN("WARNING: The web process experienced a crash on '%s'.\n", url.data());
+
+        // Display an error page
+        ewk_view_html_string_load(m_viewImpl->view(), "The web process has crashed.", 0, url.data());
+    }
+}
+
+void PageClientBase::didRelaunchProcess()
+{
+    const char* themePath = m_viewImpl->themePath();
+    if (themePath)
+        m_viewImpl->page()->setThemePath(themePath);
+}
+
+void PageClientBase::pageClosed()
+{
+    notImplemented();
+}
+
+void PageClientBase::toolTipChanged(const String&, const String& newToolTip)
+{
+    if (newToolTip.isEmpty())
+        m_viewImpl->smartCallback<TooltipTextUnset>().call();
+    else
+        m_viewImpl->smartCallback<TooltipTextSet>().call(newToolTip);
+}
+
+void PageClientBase::setCursor(const Cursor& cursor)
+{
+    m_viewImpl->setCursor(cursor);
+}
+
+void PageClientBase::setCursorHiddenUntilMouseMoves(bool)
+{
+    notImplemented();
+}
+
+void PageClientBase::registerEditCommand(PassRefPtr<WebEditCommandProxy> command, WebPageProxy::UndoOrRedo undoOrRedo)
+{
+    m_undoController.registerEditCommand(command, undoOrRedo);
+}
+
+void PageClientBase::clearAllEditCommands()
+{
+    m_undoController.clearAllEditCommands();
+}
+
+bool PageClientBase::canUndoRedo(WebPageProxy::UndoOrRedo undoOrRedo)
+{
+    return m_undoController.canUndoRedo(undoOrRedo);
+}
+
+void PageClientBase::executeUndoRedo(WebPageProxy::UndoOrRedo undoOrRedo)
+{
+    m_undoController.executeUndoRedo(undoOrRedo);
+}
+
+FloatRect PageClientBase::convertToDeviceSpace(const FloatRect& viewRect)
+{
+    notImplemented();
+    return viewRect;
+}
+
+FloatRect PageClientBase::convertToUserSpace(const FloatRect& viewRect)
+{
+    notImplemented();
+    return viewRect;
+}
+
+IntPoint PageClientBase::screenToWindow(const IntPoint& point)
+{
+    notImplemented();
+    return point;
+}
+
+IntRect PageClientBase::windowToScreen(const IntRect&)
+{
+    notImplemented();
+    return IntRect();
+}
+
+void PageClientBase::doneWithKeyEvent(const NativeWebKeyboardEvent&, bool)
+{
+    notImplemented();
+}
+
+#if ENABLE(TOUCH_EVENTS)
+void PageClientBase::doneWithTouchEvent(const NativeWebTouchEvent&, bool /*wasEventHandled*/)
+{
+    notImplemented();
+}
+#endif
+
+PassRefPtr<WebPopupMenuProxy> PageClientBase::createPopupMenuProxy(WebPageProxy* page)
+{
+    return WebPopupMenuProxyEfl::create(m_viewImpl, page);
+}
+
+PassRefPtr<WebContextMenuProxy> PageClientBase::createContextMenuProxy(WebPageProxy*)
+{
+    notImplemented();
+    return 0;
+}
+
+#if ENABLE(INPUT_TYPE_COLOR)
+PassRefPtr<WebColorChooserProxy> PageClientBase::createColorChooserProxy(WebPageProxy*, const WebCore::Color&, const WebCore::IntRect&)
+{
+    notImplemented();
+    return 0;
+}
+#endif
+
+void PageClientBase::setFindIndicator(PassRefPtr<FindIndicator>, bool, bool)
+{
+    notImplemented();
+}
+
+#if USE(ACCELERATED_COMPOSITING)
+void PageClientBase::enterAcceleratedCompositingMode(const LayerTreeContext&)
+{
+    m_viewImpl->enterAcceleratedCompositingMode();
+}
+
+void PageClientBase::exitAcceleratedCompositingMode()
+{
+    m_viewImpl->exitAcceleratedCompositingMode();
+}
+
+void PageClientBase::updateAcceleratedCompositingMode(const LayerTreeContext&)
+{
+    notImplemented();
+}
+#endif // USE(ACCELERATED_COMPOSITING)
+
+void PageClientBase::didChangeScrollbarsForMainFrame() const
+{
+    notImplemented();
+}
+
+void PageClientBase::didCommitLoadForMainFrame(bool)
+{
+    notImplemented();
+}
+
+void PageClientBase::didFinishLoadingDataForCustomRepresentation(const String&, const CoreIPC::DataReference&)
+{
+    notImplemented();
+}
+
+double PageClientBase::customRepresentationZoomFactor()
+{
+    notImplemented();
+    return 0;
+}
+
+void PageClientBase::setCustomRepresentationZoomFactor(double)
+{
+    notImplemented();
+}
+
+void PageClientBase::flashBackingStoreUpdates(const Vector<IntRect>&)
+{
+    notImplemented();
+}
+
+void PageClientBase::findStringInCustomRepresentation(const String&, FindOptions, unsigned)
+{
+    notImplemented();
+}
+
+void PageClientBase::countStringMatchesInCustomRepresentation(const String&, FindOptions, unsigned)
+{
+    notImplemented();
+}
+
+void PageClientBase::updateTextInputState()
+{
+    InputMethodContextEfl* inputMethodContext = m_viewImpl->inputMethodContext();
+    if (inputMethodContext)
+        inputMethodContext->updateTextInputState();
+}
+
+void PageClientBase::handleDownloadRequest(DownloadProxy* download)
+{
+    EwkContext* context = m_viewImpl->ewkContext();
+    context->downloadManager()->registerDownload(download, m_viewImpl);
+}
+
+} // namespace WebKit
diff --git a/Source/WebKit2/UIProcess/API/efl/PageClientImpl.h b/Source/WebKit2/UIProcess/efl/PageClientBase.h
index 8f03b09f4..6ea7405e8 100644
--- a/Source/WebKit2/UIProcess/API/efl/PageClientImpl.h
+++ b/Source/WebKit2/UIProcess/efl/PageClientBase.h
@@ -23,28 +23,30 @@
  * THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef PageClientImpl_h
-#define PageClientImpl_h
+#ifndef PageClientBase_h
+#define PageClientBase_h
 
 #include "DefaultUndoController.h"
 #include "PageClient.h"
 #include <Evas.h>
 
+class EwkViewImpl;
+
 namespace WebKit {
 
-class PageClientImpl : public PageClient {
+class PageClientBase : public PageClient {
 public:
-    static PassOwnPtr<PageClientImpl> create(Evas_Object* viewWidget)
-    {
-        return adoptPtr(new PageClientImpl(viewWidget));
-    }
-    ~PageClientImpl();
+    virtual ~PageClientBase();
 
-    Evas_Object* viewWidget() const { return m_viewWidget; }
+    // Called from the view
+    virtual void didCommitLoad() = 0;
+    virtual void updateViewportSize(const WebCore::IntSize&) = 0;
+    virtual void didChangeContentsSize(const WebCore::IntSize&) = 0;
 
+    EwkViewImpl* viewImpl() const;
 
-private:
-    explicit PageClientImpl(Evas_Object*);
+protected:
+    explicit PageClientBase(EwkViewImpl*);
 
     // PageClient
     virtual PassOwnPtr<DrawingAreaProxy> createDrawingAreaProxy();
@@ -65,7 +67,7 @@ private:
 
     virtual void setCursor(const WebCore::Cursor&);
     virtual void setCursorHiddenUntilMouseMoves(bool);
-    virtual void didChangeViewportProperties(const WebCore::ViewportAttributes&);
+    virtual void didChangeViewportProperties(const WebCore::ViewportAttributes&) = 0;
 
     virtual void registerEditCommand(PassRefPtr<WebEditCommandProxy>, WebPageProxy::UndoOrRedo);
     virtual void clearAllEditCommands();
@@ -76,6 +78,7 @@ private:
     virtual WebCore::IntPoint screenToWindow(const WebCore::IntPoint&);
     virtual WebCore::IntRect windowToScreen(const WebCore::IntRect&);
 
+    void updateTextInputState();
     virtual void handleDownloadRequest(DownloadProxy*);
 
     virtual void doneWithKeyEvent(const NativeWebKeyboardEvent&, bool);
@@ -109,16 +112,16 @@ private:
     virtual void countStringMatchesInCustomRepresentation(const String&, FindOptions, unsigned);
 
 #if USE(TILED_BACKING_STORE)
-    virtual void pageDidRequestScroll(const WebCore::IntPoint&);
+    virtual void pageDidRequestScroll(const WebCore::IntPoint&) = 0;
+    virtual void didRenderFrame(const WebCore::IntSize& contentsSize, const WebCore::IntRect& coveredRect) = 0;
+    virtual void pageTransitionViewportReady() = 0;
 #endif
 
-    virtual void didChangeContentsSize(const WebCore::IntSize&);
-
-private:
-    Evas_Object* m_viewWidget;
+protected:
+    EwkViewImpl* m_viewImpl;
     DefaultUndoController m_undoController;
 };
 
 } // namespace WebKit
 
-#endif // PageClientImpl_h
+#endif // PageClientBase_h
diff --git a/Source/WebKit2/UIProcess/efl/PageClientDefaultImpl.cpp b/Source/WebKit2/UIProcess/efl/PageClientDefaultImpl.cpp
new file mode 100644
index 000000000..7a470ff84
--- /dev/null
+++ b/Source/WebKit2/UIProcess/efl/PageClientDefaultImpl.cpp
@@ -0,0 +1,108 @@
+/*
+ * Copyright (C) 2011 Samsung Electronics
+ * Copyright (C) 2012 Intel Corporation. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "PageClientDefaultImpl.h"
+
+#include "EwkViewImpl.h"
+
+#if USE(TILED_BACKING_STORE)
+#include "PageViewportController.h"
+#include "PageViewportControllerClientEfl.h"
+#endif
+
+using namespace WebCore;
+using namespace EwkViewCallbacks;
+
+namespace WebKit {
+
+PageClientDefaultImpl::PageClientDefaultImpl(EwkViewImpl* viewImpl)
+    : PageClientBase(viewImpl)
+{
+}
+
+void PageClientDefaultImpl::didCommitLoad()
+{
+#if USE(TILED_BACKING_STORE)
+    ASSERT(m_pageViewportController);
+    m_pageViewportController->didCommitLoad();
+#endif
+}
+
+void PageClientDefaultImpl::updateViewportSize(const WebCore::IntSize& size)
+{
+#if USE(TILED_BACKING_STORE)
+    if (!m_pageViewportControllerClient) {
+        m_pageViewportControllerClient = PageViewportControllerClientEfl::create(m_viewImpl);
+        m_pageViewportController = adoptPtr(new PageViewportController(m_viewImpl->page(), m_pageViewportControllerClient.get()));
+    }
+    m_pageViewportControllerClient->updateViewportSize(size);
+#else
+    UNUSED_PARAM(size);
+#endif
+}
+
+void PageClientDefaultImpl::didChangeViewportProperties(const WebCore::ViewportAttributes& attr)
+{
+#if USE(TILED_BACKING_STORE)
+    ASSERT(m_pageViewportController);
+    m_pageViewportController->didChangeViewportAttributes(attr);
+#else
+    UNUSED_PARAM(attr);
+#endif
+}
+
+void PageClientDefaultImpl::didChangeContentsSize(const WebCore::IntSize& size)
+{
+#if USE(TILED_BACKING_STORE)
+    ASSERT(m_pageViewportController);
+    m_pageViewportController->didChangeContentsSize(size);
+#else
+    m_viewImpl->informContentsSizeChange(size);
+#endif
+}
+
+#if USE(TILED_BACKING_STORE)
+void PageClientDefaultImpl::pageDidRequestScroll(const IntPoint& position)
+{
+    ASSERT(m_pageViewportController);
+    m_pageViewportController->pageDidRequestScroll(position);
+}
+
+void PageClientDefaultImpl::didRenderFrame(const WebCore::IntSize& contentsSize, const WebCore::IntRect& coveredRect)
+{
+    ASSERT(m_pageViewportController);
+    m_pageViewportController->didRenderFrame(contentsSize, coveredRect);
+}
+
+void PageClientDefaultImpl::pageTransitionViewportReady()
+{
+    ASSERT(m_pageViewportController);
+    m_pageViewportController->pageTransitionViewportReady();
+}
+#endif
+
+} // namespace WebKit
diff --git a/Source/WebKit2/UIProcess/efl/PageClientDefaultImpl.h b/Source/WebKit2/UIProcess/efl/PageClientDefaultImpl.h
new file mode 100644
index 000000000..b69703411
--- /dev/null
+++ b/Source/WebKit2/UIProcess/efl/PageClientDefaultImpl.h
@@ -0,0 +1,66 @@
+/*
+ * Copyright (C) 2011 Samsung Electronics
+ * Copyright (C) 2012 Intel Corporation. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef PageClientDefaultImpl_h
+#define PageClientDefaultImpl_h
+
+#include "PageClientBase.h"
+#include "PageViewportController.h"
+#include "PageViewportControllerClientEfl.h"
+
+
+namespace WebKit {
+
+class PageClientDefaultImpl : public PageClientBase {
+public:
+    static PassOwnPtr<PageClientBase> create(EwkViewImpl* viewImpl)
+    {
+        return adoptPtr(new PageClientDefaultImpl(viewImpl));
+    }
+
+    virtual ~PageClientDefaultImpl() { }
+
+    virtual void didCommitLoad();
+    virtual void updateViewportSize(const WebCore::IntSize&);
+
+private:
+    explicit PageClientDefaultImpl(EwkViewImpl*);
+
+    virtual void didChangeViewportProperties(const WebCore::ViewportAttributes&);
+    virtual void didChangeContentsSize(const WebCore::IntSize&);
+#if USE(TILED_BACKING_STORE)
+    virtual void pageDidRequestScroll(const WebCore::IntPoint&);
+    virtual void didRenderFrame(const WebCore::IntSize& contentsSize, const WebCore::IntRect& coveredRect);
+    virtual void pageTransitionViewportReady();
+
+    OwnPtr<WebKit::PageViewportControllerClientEfl> m_pageViewportControllerClient;
+    OwnPtr<WebKit::PageViewportController> m_pageViewportController;
+#endif
+};
+
+} // namespace WebKit
+
+#endif // PageClientDefaultImpl_h
diff --git a/Source/WebKit2/UIProcess/efl/PageClientLegacyImpl.cpp b/Source/WebKit2/UIProcess/efl/PageClientLegacyImpl.cpp
new file mode 100644
index 000000000..2e0a5b26e
--- /dev/null
+++ b/Source/WebKit2/UIProcess/efl/PageClientLegacyImpl.cpp
@@ -0,0 +1,91 @@
+/*
+ * Copyright (C) 2011 Samsung Electronics
+ * Copyright (C) 2012 Intel Corporation. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "PageClientLegacyImpl.h"
+
+#include "EwkViewImpl.h"
+#include "LayerTreeCoordinatorProxy.h"
+
+using namespace WebCore;
+using namespace EwkViewCallbacks;
+
+namespace WebKit {
+
+PageClientLegacyImpl::PageClientLegacyImpl(EwkViewImpl* viewImpl)
+    : PageClientBase(viewImpl)
+{
+}
+
+void PageClientLegacyImpl::didCommitLoad()
+{
+    m_viewImpl->update();
+}
+
+void PageClientLegacyImpl::updateViewportSize(const WebCore::IntSize& size)
+{
+#if USE(TILED_BACKING_STORE)
+    m_viewImpl->page()->drawingArea()->setVisibleContentsRect(IntRect(m_viewImpl->scrollPosition(), size), m_viewImpl->scaleFactor(), FloatPoint());
+#else
+    UNUSED_PARAM(size);
+#endif
+}
+
+void PageClientLegacyImpl::didChangeViewportProperties(const WebCore::ViewportAttributes&)
+{
+    m_viewImpl->update();
+}
+
+void PageClientLegacyImpl::didChangeContentsSize(const WebCore::IntSize& size)
+{
+#if USE(TILED_BACKING_STORE)
+    // m_viewImpl->informContentSizeChanged will be called as a result of setContentsSize
+    m_viewImpl->page()->drawingArea()->layerTreeCoordinatorProxy()->setContentsSize(FloatSize(size.width(), size.height()));
+    m_viewImpl->update();
+#else
+    m_viewImpl->informContentsSizeChange(size);
+#endif
+}
+
+#if USE(TILED_BACKING_STORE)
+void PageClientLegacyImpl::pageDidRequestScroll(const IntPoint& position)
+{
+    m_viewImpl->setScrollPosition(position);
+    m_viewImpl->update();
+}
+
+void PageClientLegacyImpl::didRenderFrame(const WebCore::IntSize&, const WebCore::IntRect&)
+{
+    m_viewImpl->update();
+}
+
+void PageClientLegacyImpl::pageTransitionViewportReady()
+{
+    m_viewImpl->update();
+}
+#endif
+
+} // namespace WebKit
diff --git a/Source/WebKit2/UIProcess/efl/PageClientLegacyImpl.h b/Source/WebKit2/UIProcess/efl/PageClientLegacyImpl.h
new file mode 100644
index 000000000..e098aa47c
--- /dev/null
+++ b/Source/WebKit2/UIProcess/efl/PageClientLegacyImpl.h
@@ -0,0 +1,60 @@
+/*
+ * Copyright (C) 2011 Samsung Electronics
+ * Copyright (C) 2012 Intel Corporation. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef PageClientLegacyImpl_h
+#define PageClientLegacyImpl_h
+
+#include "PageClientBase.h"
+
+namespace WebKit {
+
+class PageClientLegacyImpl : public PageClientBase {
+public:
+    static PassOwnPtr<PageClientBase> create(EwkViewImpl* viewImpl)
+    {
+        return adoptPtr(new PageClientLegacyImpl(viewImpl));
+    }
+
+    virtual ~PageClientLegacyImpl() { }
+
+    virtual void didCommitLoad();
+    virtual void updateViewportSize(const WebCore::IntSize&);
+
+private:
+    explicit PageClientLegacyImpl(EwkViewImpl*);
+
+    virtual void didChangeViewportProperties(const WebCore::ViewportAttributes&);
+    virtual void didChangeContentsSize(const WebCore::IntSize&);
+#if USE(TILED_BACKING_STORE)
+    virtual void pageDidRequestScroll(const WebCore::IntPoint&);
+    virtual void didRenderFrame(const WebCore::IntSize& contentsSize, const WebCore::IntRect& coveredRect);
+    virtual void pageTransitionViewportReady();
+#endif
+};
+
+} // namespace WebKit
+
+#endif // PageClientLegacyImpl_h
diff --git a/Source/WebKit2/UIProcess/efl/PageLoadClientEfl.cpp b/Source/WebKit2/UIProcess/efl/PageLoadClientEfl.cpp
index 2425b157d..f1b49b780 100644
--- a/Source/WebKit2/UIProcess/efl/PageLoadClientEfl.cpp
+++ b/Source/WebKit2/UIProcess/efl/PageLoadClientEfl.cpp
@@ -26,14 +26,19 @@
 #include "config.h"
 #include "PageLoadClientEfl.h"
 
+#include "EwkViewImpl.h"
+#include "WKAPICast.h"
 #include "WKFrame.h"
 #include "WKPage.h"
+#include "ewk_auth_request_private.h"
 #include "ewk_back_forward_list_private.h"
 #include "ewk_error_private.h"
 #include "ewk_intent_private.h"
 #include "ewk_intent_service_private.h"
 #include "ewk_view.h"
 
+using namespace EwkViewCallbacks;
+
 namespace WebKit {
 
 static inline PageLoadClientEfl* toPageLoadClientEfl(const void* clientInfo)
@@ -46,32 +51,33 @@ void PageLoadClientEfl::didReceiveTitleForFrame(WKPageRef, WKStringRef title, WK
     if (!WKFrameIsMainFrame(frame))
         return;
 
-    Evas_Object* ewkView = toPageLoadClientEfl(clientInfo)->view();
-    ewk_view_title_changed(ewkView, toImpl(title)->string().utf8().data());
+    EwkViewImpl* viewImpl = toPageLoadClientEfl(clientInfo)->viewImpl();
+    viewImpl->smartCallback<TitleChange>().call(toImpl(title)->string());
 }
 
 #if ENABLE(WEB_INTENTS)
 void PageLoadClientEfl::didReceiveIntentForFrame(WKPageRef, WKFrameRef, WKIntentDataRef intent, WKTypeRef, const void* clientInfo)
 {
-    Evas_Object* ewkView = toPageLoadClientEfl(clientInfo)->view();
+    EwkViewImpl* viewImpl = toPageLoadClientEfl(clientInfo)->viewImpl();
     RefPtr<Ewk_Intent> ewkIntent = Ewk_Intent::create(intent);
-    ewk_view_intent_request_new(ewkView, ewkIntent.get());
+    viewImpl->smartCallback<IntentRequest>().call(ewkIntent.get());
 }
 #endif
 
 #if ENABLE(WEB_INTENTS_TAG)
 void PageLoadClientEfl::registerIntentServiceForFrame(WKPageRef, WKFrameRef, WKIntentServiceInfoRef serviceInfo, WKTypeRef, const void* clientInfo)
 {
-    Evas_Object* ewkView = toPageLoadClientEfl(clientInfo)->view();
+    EwkViewImpl* viewImpl = toPageLoadClientEfl(clientInfo)->viewImpl();
     RefPtr<Ewk_Intent_Service> ewkIntentService = Ewk_Intent_Service::create(serviceInfo);
-    ewk_view_intent_service_register(ewkView, ewkIntentService.get());
+    viewImpl->smartCallback<IntentServiceRegistration>().call(ewkIntentService.get());
 }
 #endif
 
 void PageLoadClientEfl::didChangeProgress(WKPageRef page, const void* clientInfo)
 {
-    Evas_Object* ewkView = toPageLoadClientEfl(clientInfo)->view();
-    ewk_view_load_progress_changed(ewkView, WKPageGetEstimatedProgress(page));
+    EwkViewImpl* viewImpl = toPageLoadClientEfl(clientInfo)->viewImpl();
+    double progress = WKPageGetEstimatedProgress(page);
+    viewImpl->smartCallback<LoadProgress>().call(&progress);
 }
 
 void PageLoadClientEfl::didFinishLoadForFrame(WKPageRef, WKFrameRef frame, WKTypeRef /*userData*/, const void* clientInfo)
@@ -79,8 +85,8 @@ void PageLoadClientEfl::didFinishLoadForFrame(WKPageRef, WKFrameRef frame, WKTyp
     if (!WKFrameIsMainFrame(frame))
         return;
 
-    Evas_Object* ewkView = toPageLoadClientEfl(clientInfo)->view();
-    ewk_view_load_finished(ewkView);
+    EwkViewImpl* viewImpl = toPageLoadClientEfl(clientInfo)->viewImpl();
+    viewImpl->smartCallback<LoadFinished>().call();
 }
 
 void PageLoadClientEfl::didFailLoadWithErrorForFrame(WKPageRef, WKFrameRef frame, WKErrorRef error, WKTypeRef, const void* clientInfo)
@@ -88,10 +94,10 @@ void PageLoadClientEfl::didFailLoadWithErrorForFrame(WKPageRef, WKFrameRef frame
     if (!WKFrameIsMainFrame(frame))
         return;
 
-    Evas_Object* ewkView = toPageLoadClientEfl(clientInfo)->view();
+    EwkViewImpl* viewImpl = toPageLoadClientEfl(clientInfo)->viewImpl();
     OwnPtr<Ewk_Error> ewkError = Ewk_Error::create(error);
-    ewk_view_load_error(ewkView, ewkError.get());
-    ewk_view_load_finished(ewkView);
+    viewImpl->smartCallback<LoadError>().call(ewkError.get());
+    viewImpl->smartCallback<LoadFinished>().call();
 }
 
 void PageLoadClientEfl::didStartProvisionalLoadForFrame(WKPageRef, WKFrameRef frame, WKTypeRef /*userData*/, const void* clientInfo)
@@ -99,8 +105,9 @@ void PageLoadClientEfl::didStartProvisionalLoadForFrame(WKPageRef, WKFrameRef fr
     if (!WKFrameIsMainFrame(frame))
         return;
 
-    Evas_Object* ewkView = toPageLoadClientEfl(clientInfo)->view();
-    ewk_view_load_provisional_started(ewkView);
+    EwkViewImpl* viewImpl = toPageLoadClientEfl(clientInfo)->viewImpl();
+    viewImpl->informURLChange();
+    viewImpl->smartCallback<ProvisionalLoadStarted>().call();
 }
 
 void PageLoadClientEfl::didReceiveServerRedirectForProvisionalLoadForFrame(WKPageRef, WKFrameRef frame, WKTypeRef /*userData*/, const void* clientInfo)
@@ -108,8 +115,9 @@ void PageLoadClientEfl::didReceiveServerRedirectForProvisionalLoadForFrame(WKPag
     if (!WKFrameIsMainFrame(frame))
         return;
 
-    Evas_Object* ewkView = toPageLoadClientEfl(clientInfo)->view();
-    ewk_view_load_provisional_redirect(ewkView);
+    EwkViewImpl* viewImpl = toPageLoadClientEfl(clientInfo)->viewImpl();
+    viewImpl->informURLChange();
+    viewImpl->smartCallback<ProvisionalLoadRedirect>().call();
 }
 
 void PageLoadClientEfl::didFailProvisionalLoadWithErrorForFrame(WKPageRef, WKFrameRef frame, WKErrorRef error, WKTypeRef, const void* clientInfo)
@@ -117,21 +125,32 @@ void PageLoadClientEfl::didFailProvisionalLoadWithErrorForFrame(WKPageRef, WKFra
     if (!WKFrameIsMainFrame(frame))
         return;
 
-    Evas_Object* ewkView = toPageLoadClientEfl(clientInfo)->view();
+    EwkViewImpl* viewImpl = toPageLoadClientEfl(clientInfo)->viewImpl();
     OwnPtr<Ewk_Error> ewkError = Ewk_Error::create(error);
-    ewk_view_load_provisional_failed(ewkView, ewkError.get());
+    viewImpl->smartCallback<ProvisionalLoadFailed>().call(ewkError.get());
 }
 
+#if USE(TILED_BACKING_STORE)
+void PageLoadClientEfl::didCommitLoadForFrame(WKPageRef, WKFrameRef frame, WKTypeRef, const void* clientInfo)
+{
+    if (!WKFrameIsMainFrame(frame))
+        return;
+
+    EwkViewImpl* viewImpl = toPageLoadClientEfl(clientInfo)->viewImpl();
+    viewImpl->informLoadCommitted();
+}
+#endif
+
 void PageLoadClientEfl::didChangeBackForwardList(WKPageRef, WKBackForwardListItemRef addedItem, WKArrayRef removedItems, const void* clientInfo)
 {
-    Evas_Object* ewkView = toPageLoadClientEfl(clientInfo)->view();
-    ASSERT(ewkView);
+    EwkViewImpl* viewImpl = toPageLoadClientEfl(clientInfo)->viewImpl();
+    ASSERT(viewImpl);
 
-    Ewk_Back_Forward_List* list = ewk_view_back_forward_list_get(ewkView);
+    Ewk_Back_Forward_List* list = ewk_view_back_forward_list_get(viewImpl->view());
     ASSERT(list);
     list->update(addedItem, removedItems);
 
-    ewk_view_back_forward_list_changed(ewkView);
+    viewImpl->smartCallback<BackForwardListChange>().call();
 }
 
 void PageLoadClientEfl::didSameDocumentNavigationForFrame(WKPageRef, WKFrameRef frame, WKSameDocumentNavigationType, WKTypeRef, const void* clientInfo)
@@ -139,14 +158,22 @@ void PageLoadClientEfl::didSameDocumentNavigationForFrame(WKPageRef, WKFrameRef
     if (!WKFrameIsMainFrame(frame))
         return;
 
-    Evas_Object* ewkView = toPageLoadClientEfl(clientInfo)->view();
-    ewk_view_url_update(ewkView);
+    EwkViewImpl* viewImpl = toPageLoadClientEfl(clientInfo)->viewImpl();
+    viewImpl->informURLChange();
+}
+
+void PageLoadClientEfl::didReceiveAuthenticationChallengeInFrame(WKPageRef, WKFrameRef, WKAuthenticationChallengeRef authenticationChallenge, const void* clientInfo)
+{
+    EwkViewImpl* viewImpl = toPageLoadClientEfl(clientInfo)->viewImpl();
+
+    RefPtr<Ewk_Auth_Request> authenticationRequest = EwkAuthRequest::create(toImpl(authenticationChallenge));
+    viewImpl->smartCallback<AuthenticationRequest>().call(authenticationRequest.get());
 }
 
-PageLoadClientEfl::PageLoadClientEfl(Evas_Object* view)
-    : m_view(view)
+PageLoadClientEfl::PageLoadClientEfl(EwkViewImpl* viewImpl)
+    : m_viewImpl(viewImpl)
 {
-    WKPageRef pageRef = ewk_view_wkpage_get(m_view);
+    WKPageRef pageRef = m_viewImpl->wkPage();
     ASSERT(pageRef);
 
     WKPageLoaderClient loadClient;
@@ -168,8 +195,12 @@ PageLoadClientEfl::PageLoadClientEfl(Evas_Object* view)
     loadClient.didStartProvisionalLoadForFrame = didStartProvisionalLoadForFrame;
     loadClient.didReceiveServerRedirectForProvisionalLoadForFrame = didReceiveServerRedirectForProvisionalLoadForFrame;
     loadClient.didFailProvisionalLoadWithErrorForFrame = didFailProvisionalLoadWithErrorForFrame;
+#if USE(TILED_BACKING_STORE)
+    loadClient.didCommitLoadForFrame = didCommitLoadForFrame;
+#endif
     loadClient.didChangeBackForwardList = didChangeBackForwardList;
     loadClient.didSameDocumentNavigationForFrame = didSameDocumentNavigationForFrame;
+    loadClient.didReceiveAuthenticationChallengeInFrame = didReceiveAuthenticationChallengeInFrame;
     WKPageSetPageLoaderClient(pageRef, &loadClient);
 }
 
diff --git a/Source/WebKit2/UIProcess/efl/PageLoadClientEfl.h b/Source/WebKit2/UIProcess/efl/PageLoadClientEfl.h
index 68cc17d6a..cd713a3cd 100644
--- a/Source/WebKit2/UIProcess/efl/PageLoadClientEfl.h
+++ b/Source/WebKit2/UIProcess/efl/PageLoadClientEfl.h
@@ -26,22 +26,25 @@
 #ifndef PageLoadClientEfl_h
 #define PageLoadClientEfl_h
 
-#include "ewk_view_private.h"
+#include "WKPageLoadTypes.h"
+#include <WebKit2/WKBase.h>
 #include <wtf/PassOwnPtr.h>
 
+class EwkViewImpl;
+
 namespace WebKit {
 
 class PageLoadClientEfl {
 public:
-    static PassOwnPtr<PageLoadClientEfl> create(Evas_Object* view)
+    static PassOwnPtr<PageLoadClientEfl> create(EwkViewImpl* viewImpl)
     {
-        return adoptPtr(new PageLoadClientEfl(view));
+        return adoptPtr(new PageLoadClientEfl(viewImpl));
     }
 
 private:
-    explicit PageLoadClientEfl(Evas_Object* view);
+    explicit PageLoadClientEfl(EwkViewImpl*);
 
-    inline Evas_Object* view() const { return m_view; }
+    inline EwkViewImpl* viewImpl() const { return m_viewImpl; }
 
     static void didReceiveTitleForFrame(WKPageRef, WKStringRef title, WKFrameRef, WKTypeRef, const void* clientInfo);
 #if ENABLE(WEB_INTENTS)
@@ -56,10 +59,14 @@ private:
     static void didStartProvisionalLoadForFrame(WKPageRef, WKFrameRef, WKTypeRef userData, const void* clientInfo);
     static void didReceiveServerRedirectForProvisionalLoadForFrame(WKPageRef, WKFrameRef, WKTypeRef userData, const void* clientInfo);
     static void didFailProvisionalLoadWithErrorForFrame(WKPageRef, WKFrameRef, WKErrorRef, WKTypeRef userData, const void* clientInfo);
+#if USE(TILED_BACKING_STORE)
+    static void didCommitLoadForFrame(WKPageRef, WKFrameRef, WKTypeRef userData, const void* clientInfo);
+#endif
     static void didChangeBackForwardList(WKPageRef, WKBackForwardListItemRef addedItem, WKArrayRef removedItems, const void* clientInfo);
     static void didSameDocumentNavigationForFrame(WKPageRef, WKFrameRef, WKSameDocumentNavigationType, WKTypeRef, const void* clientInfo);
+    static void didReceiveAuthenticationChallengeInFrame(WKPageRef, WKFrameRef, WKAuthenticationChallengeRef, const void* clientInfo);
 
-    Evas_Object* m_view;
+    EwkViewImpl* m_viewImpl;
 };
 
 } // namespace WebKit
diff --git a/Source/WebKit2/UIProcess/API/efl/ewk_view_policy_client.cpp b/Source/WebKit2/UIProcess/efl/PagePolicyClientEfl.cpp
index bdec9f625..254f29a6e 100644
--- a/Source/WebKit2/UIProcess/API/efl/ewk_view_policy_client.cpp
+++ b/Source/WebKit2/UIProcess/efl/PagePolicyClientEfl.cpp
@@ -24,38 +24,46 @@
  */
 
 #include "config.h"
+#include "PagePolicyClientEfl.h"
 
+#include "EwkViewImpl.h"
 #include "WKFrame.h"
 #include "WKFramePolicyListener.h"
+#include "WebFrameProxy.h"
 #include "ewk_navigation_policy_decision.h"
 #include "ewk_navigation_policy_decision_private.h"
-#include "ewk_view_policy_client_private.h"
-#include "ewk_view_private.h"
 #include <WebCore/HTTPStatusCodes.h>
 #include <wtf/text/CString.h>
 
-using namespace WebCore;
-using namespace WebKit;
+using namespace EwkViewCallbacks;
 
-static inline Evas_Object* toEwkView(const void* clientInfo)
+namespace WebKit {
+
+static inline PagePolicyClientEfl* toPagePolicyClientEfl(const void* clientInfo)
 {
-    return static_cast<Evas_Object*>(const_cast<void*>(clientInfo));
+    return static_cast<PagePolicyClientEfl*>(const_cast<void*>(clientInfo));
 }
 
-static void decidePolicyForNavigationAction(WKPageRef, WKFrameRef, WKFrameNavigationType navigationType, WKEventModifiers modifiers, WKEventMouseButton mouseButton, WKURLRequestRef request, WKFramePolicyListenerRef listener, WKTypeRef /*userData*/, const void* clientInfo)
+void PagePolicyClientEfl::decidePolicyForNavigationAction(WKPageRef, WKFrameRef, WKFrameNavigationType navigationType, WKEventModifiers modifiers, WKEventMouseButton mouseButton, WKURLRequestRef request, WKFramePolicyListenerRef listener, WKTypeRef /*userData*/, const void* clientInfo)
 {
+    PagePolicyClientEfl* policyClient = toPagePolicyClientEfl(clientInfo);
+
     RefPtr<Ewk_Navigation_Policy_Decision> decision = Ewk_Navigation_Policy_Decision::create(navigationType, mouseButton, modifiers, request, 0, listener);
-    ewk_view_navigation_policy_decision(toEwkView(clientInfo), decision.get());
+    policyClient->m_viewImpl->smartCallback<NavigationPolicyDecision>().call(decision.get());
 }
 
-static void decidePolicyForNewWindowAction(WKPageRef, WKFrameRef, WKFrameNavigationType navigationType, WKEventModifiers modifiers, WKEventMouseButton mouseButton, WKURLRequestRef request, WKStringRef frameName, WKFramePolicyListenerRef listener, WKTypeRef /*userData*/, const void* clientInfo)
+void PagePolicyClientEfl::decidePolicyForNewWindowAction(WKPageRef, WKFrameRef, WKFrameNavigationType navigationType, WKEventModifiers modifiers, WKEventMouseButton mouseButton, WKURLRequestRef request, WKStringRef frameName, WKFramePolicyListenerRef listener, WKTypeRef /*userData*/, const void* clientInfo)
 {
+    PagePolicyClientEfl* policyClient = toPagePolicyClientEfl(clientInfo);
+
     RefPtr<Ewk_Navigation_Policy_Decision> decision = Ewk_Navigation_Policy_Decision::create(navigationType, mouseButton, modifiers, request, toImpl(frameName)->string().utf8().data(), listener);
-    ewk_view_new_window_policy_decision(toEwkView(clientInfo), decision.get());
+    policyClient->m_viewImpl->smartCallback<NewWindowPolicyDecision>().call(decision.get());
 }
 
-static void decidePolicyForResponseCallback(WKPageRef, WKFrameRef frame, WKURLResponseRef response, WKURLRequestRef, WKFramePolicyListenerRef listener, WKTypeRef /*userData*/, const void* /*clientInfo*/)
+void PagePolicyClientEfl::decidePolicyForResponseCallback(WKPageRef, WKFrameRef frame, WKURLResponseRef response, WKURLRequestRef, WKFramePolicyListenerRef listener, WKTypeRef /*userData*/, const void* /*clientInfo*/)
 {
+    using namespace WebCore;
+
     const ResourceResponse resourceResponse = toImpl(response)->resourceResponse();
 
     // Ignore responses with an HTTP status code of 204 (No Content)
@@ -94,15 +102,21 @@ static void decidePolicyForResponseCallback(WKPageRef, WKFrameRef frame, WKURLRe
     WKFramePolicyListenerUse(listener);
 }
 
-void ewk_view_policy_client_attach(WKPageRef pageRef, Evas_Object* ewkView)
+PagePolicyClientEfl::PagePolicyClientEfl(EwkViewImpl* viewImpl)
+    : m_viewImpl(viewImpl)
 {
+    WKPageRef pageRef = m_viewImpl->wkPage();
+    ASSERT(pageRef);
+
     WKPagePolicyClient policyClient;
     memset(&policyClient, 0, sizeof(WKPagePolicyClient));
     policyClient.version = kWKPagePolicyClientCurrentVersion;
-    policyClient.clientInfo = ewkView;
+    policyClient.clientInfo = this;
     policyClient.decidePolicyForNavigationAction = decidePolicyForNavigationAction;
     policyClient.decidePolicyForNewWindowAction = decidePolicyForNewWindowAction;
     policyClient.decidePolicyForResponse = decidePolicyForResponseCallback;
 
     WKPageSetPagePolicyClient(pageRef, &policyClient);
 }
+
+} // namespace WebKit
diff --git a/Source/WebKit2/UIProcess/efl/PagePolicyClientEfl.h b/Source/WebKit2/UIProcess/efl/PagePolicyClientEfl.h
new file mode 100644
index 000000000..68d9a9ee9
--- /dev/null
+++ b/Source/WebKit2/UIProcess/efl/PagePolicyClientEfl.h
@@ -0,0 +1,57 @@
+/*
+ * Copyright (C) 2012 Intel Corporation. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef PagePolicyClientEfl_h
+#define PagePolicyClientEfl_h
+
+#include "WKEvent.h"
+#include "WKPageLoadTypes.h"
+#include <WebKit2/WKBase.h>
+#include <wtf/PassOwnPtr.h>
+
+class EwkViewImpl;
+
+namespace WebKit {
+
+class PagePolicyClientEfl {
+public:
+    static PassOwnPtr<PagePolicyClientEfl> create(EwkViewImpl* viewImpl)
+    {
+        return adoptPtr(new PagePolicyClientEfl(viewImpl));
+    }
+
+private:
+    explicit PagePolicyClientEfl(EwkViewImpl*);
+
+    static void decidePolicyForNavigationAction(WKPageRef, WKFrameRef, WKFrameNavigationType, WKEventModifiers, WKEventMouseButton, WKURLRequestRef, WKFramePolicyListenerRef, WKTypeRef, const void*);
+    static void decidePolicyForNewWindowAction(WKPageRef, WKFrameRef, WKFrameNavigationType, WKEventModifiers, WKEventMouseButton, WKURLRequestRef, WKStringRef, WKFramePolicyListenerRef, WKTypeRef, const void*);
+    static void decidePolicyForResponseCallback(WKPageRef, WKFrameRef, WKURLResponseRef, WKURLRequestRef, WKFramePolicyListenerRef, WKTypeRef, const void*);
+
+    EwkViewImpl* m_viewImpl;
+};
+
+} // namespace WebKit
+
+#endif // PagePolicyClientEfl_h
diff --git a/Source/WebKit2/UIProcess/efl/PageUIClientEfl.cpp b/Source/WebKit2/UIProcess/efl/PageUIClientEfl.cpp
new file mode 100644
index 000000000..4110b6b96
--- /dev/null
+++ b/Source/WebKit2/UIProcess/efl/PageUIClientEfl.cpp
@@ -0,0 +1,168 @@
+/*
+ * Copyright (C) 2012 Samsung Electronics. All rights reserved.
+ * Copyright (C) 2012 Intel Corporation. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "PageUIClientEfl.h"
+
+#include "EwkViewImpl.h"
+#include "WKAPICast.h"
+#include "WKEvent.h"
+#include "WKString.h"
+#include "ewk_file_chooser_request_private.h"
+#include <Ecore_Evas.h>
+#include <WebCore/Color.h>
+
+using namespace EwkViewCallbacks;
+
+namespace WebKit {
+
+static inline PageUIClientEfl* toPageUIClientEfl(const void* clientInfo)
+{
+    return static_cast<PageUIClientEfl*>(const_cast<void*>(clientInfo));
+}
+
+void PageUIClientEfl::closePage(WKPageRef, const void* clientInfo)
+{
+    toPageUIClientEfl(clientInfo)->m_viewImpl->closePage();
+}
+
+WKPageRef PageUIClientEfl::createNewPage(WKPageRef, WKURLRequestRef, WKDictionaryRef, WKEventModifiers, WKEventMouseButton, const void* clientInfo)
+{
+    return toPageUIClientEfl(clientInfo)->m_viewImpl->createNewPage();
+}
+
+void PageUIClientEfl::runJavaScriptAlert(WKPageRef, WKStringRef alertText, WKFrameRef, const void* clientInfo)
+{
+    toPageUIClientEfl(clientInfo)->m_viewImpl->requestJSAlertPopup(WKEinaSharedString(alertText));
+}
+
+bool PageUIClientEfl::runJavaScriptConfirm(WKPageRef, WKStringRef message, WKFrameRef, const void* clientInfo)
+{
+    return toPageUIClientEfl(clientInfo)->m_viewImpl->requestJSConfirmPopup(WKEinaSharedString(message));
+}
+
+WKStringRef PageUIClientEfl::runJavaScriptPrompt(WKPageRef, WKStringRef message, WKStringRef defaultValue, WKFrameRef, const void* clientInfo)
+{
+    WKEinaSharedString value = toPageUIClientEfl(clientInfo)->m_viewImpl->requestJSPromptPopup(WKEinaSharedString(message), WKEinaSharedString(defaultValue));
+    return value ? WKStringCreateWithUTF8CString(value) : 0;
+}
+
+#if ENABLE(INPUT_TYPE_COLOR)
+void PageUIClientEfl::showColorPicker(WKPageRef, WKStringRef initialColor, WKColorPickerResultListenerRef listener, const void* clientInfo)
+{
+    PageUIClientEfl* pageUIClient = toPageUIClientEfl(clientInfo);
+    WebCore::Color color = WebCore::Color(WebKit::toWTFString(initialColor));
+    pageUIClient->m_viewImpl->requestColorPicker(listener, color);
+}
+
+void PageUIClientEfl::hideColorPicker(WKPageRef, const void* clientInfo)
+{
+    PageUIClientEfl* pageUIClient = toPageUIClientEfl(clientInfo);
+    pageUIClient->m_viewImpl->dismissColorPicker();
+}
+#endif
+
+#if ENABLE(SQL_DATABASE)
+unsigned long long PageUIClientEfl::exceededDatabaseQuota(WKPageRef, WKFrameRef, WKSecurityOriginRef, WKStringRef databaseName, WKStringRef displayName, unsigned long long currentQuota, unsigned long long currentOriginUsage, unsigned long long currentDatabaseUsage, unsigned long long expectedUsage, const void* clientInfo)
+{
+    EwkViewImpl* viewImpl = toPageUIClientEfl(clientInfo)->m_viewImpl;
+    return viewImpl->informDatabaseQuotaReached(toImpl(databaseName)->string(), toImpl(displayName)->string(), currentQuota, currentOriginUsage, currentDatabaseUsage, expectedUsage);
+}
+#endif
+
+void PageUIClientEfl::focus(WKPageRef, const void* clientInfo)
+{
+    evas_object_focus_set(toPageUIClientEfl(clientInfo)->m_viewImpl->view(), true);
+}
+
+void PageUIClientEfl::unfocus(WKPageRef, const void* clientInfo)
+{
+    evas_object_focus_set(toPageUIClientEfl(clientInfo)->m_viewImpl->view(), false);
+}
+
+void PageUIClientEfl::takeFocus(WKPageRef, WKFocusDirection, const void* clientInfo)
+{
+    // FIXME: this is only a partial implementation.
+    evas_object_focus_set(toPageUIClientEfl(clientInfo)->m_viewImpl->view(), false);
+}
+
+WKRect PageUIClientEfl::getWindowFrame(WKPageRef, const void* clientInfo)
+{
+    int x, y, width, height;
+
+    Ecore_Evas* ee = ecore_evas_ecore_evas_get(evas_object_evas_get(toPageUIClientEfl(clientInfo)->m_viewImpl->view()));
+    ecore_evas_request_geometry_get(ee, &x, &y, &width, &height);
+
+    return WKRectMake(x, y, width, height);
+}
+
+void PageUIClientEfl::setWindowFrame(WKPageRef, WKRect frame, const void* clientInfo)
+{
+    Ecore_Evas* ee = ecore_evas_ecore_evas_get(evas_object_evas_get(toPageUIClientEfl(clientInfo)->m_viewImpl->view()));
+    ecore_evas_move_resize(ee, frame.origin.x, frame.origin.y, frame.size.width, frame.size.height);
+}
+
+void PageUIClientEfl::runOpenPanel(WKPageRef, WKFrameRef, WKOpenPanelParametersRef parameters, WKOpenPanelResultListenerRef listener, const void* clientInfo)
+{
+    EwkViewImpl* viewImpl = toPageUIClientEfl(clientInfo)->m_viewImpl;
+    RefPtr<Ewk_File_Chooser_Request> fileChooserRequest = Ewk_File_Chooser_Request::create(toImpl(parameters), toImpl(listener));
+    viewImpl->smartCallback<FileChooserRequest>().call(fileChooserRequest.get());
+}
+
+PageUIClientEfl::PageUIClientEfl(EwkViewImpl* viewImpl)
+    : m_viewImpl(viewImpl)
+{
+    WKPageRef pageRef = m_viewImpl->wkPage();
+    ASSERT(pageRef);
+
+    WKPageUIClient uiClient;
+    memset(&uiClient, 0, sizeof(WKPageUIClient));
+    uiClient.version = kWKPageUIClientCurrentVersion;
+    uiClient.clientInfo = this;
+    uiClient.close = closePage;
+    uiClient.createNewPage = createNewPage;
+    uiClient.runJavaScriptAlert = runJavaScriptAlert;
+    uiClient.runJavaScriptConfirm = runJavaScriptConfirm;
+    uiClient.runJavaScriptPrompt = runJavaScriptPrompt;
+    uiClient.takeFocus = takeFocus;
+    uiClient.focus = focus;
+    uiClient.unfocus = unfocus;
+    uiClient.getWindowFrame = getWindowFrame;
+    uiClient.setWindowFrame = setWindowFrame;
+    uiClient.runOpenPanel = runOpenPanel;
+#if ENABLE(SQL_DATABASE)
+    uiClient.exceededDatabaseQuota = exceededDatabaseQuota;
+#endif
+
+#if ENABLE(INPUT_TYPE_COLOR)
+    uiClient.showColorPicker = showColorPicker;
+    uiClient.hideColorPicker = hideColorPicker;
+#endif
+
+    WKPageSetPageUIClient(pageRef, &uiClient);
+}
+
+} // namespace WebKit
diff --git a/Source/WebKit2/UIProcess/efl/PageUIClientEfl.h b/Source/WebKit2/UIProcess/efl/PageUIClientEfl.h
new file mode 100644
index 000000000..2f54192a2
--- /dev/null
+++ b/Source/WebKit2/UIProcess/efl/PageUIClientEfl.h
@@ -0,0 +1,72 @@
+/*
+ * Copyright (C) 2012 Samsung Electronics. All rights reserved.
+ * Copyright (C) 2012 Intel Corporation. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef PageUIClientEfl_h
+#define PageUIClientEfl_h
+
+#include "WKPage.h"
+#include <WebKit2/WKBase.h>
+#include <wtf/PassOwnPtr.h>
+
+class EwkViewImpl;
+
+namespace WebKit {
+
+class PageUIClientEfl {
+public:
+    static PassOwnPtr<PageUIClientEfl> create(EwkViewImpl* viewImpl)
+    {
+        return adoptPtr(new PageUIClientEfl(viewImpl));
+    }
+
+private:
+    explicit PageUIClientEfl(EwkViewImpl*);
+
+    static void closePage(WKPageRef, const void*);
+    static WKPageRef createNewPage(WKPageRef, WKURLRequestRef, WKDictionaryRef, WKEventModifiers, WKEventMouseButton, const void*);
+    static void runJavaScriptAlert(WKPageRef, WKStringRef, WKFrameRef, const void*);
+    static bool runJavaScriptConfirm(WKPageRef, WKStringRef, WKFrameRef, const void*);
+    static WKStringRef runJavaScriptPrompt(WKPageRef, WKStringRef, WKStringRef, WKFrameRef, const void*);
+#if ENABLE(INPUT_TYPE_COLOR)
+    static void showColorPicker(WKPageRef, WKStringRef initialColor, WKColorPickerResultListenerRef, const void*);
+    static void hideColorPicker(WKPageRef, const void*);
+#endif
+#if ENABLE(SQL_DATABASE)
+    static unsigned long long exceededDatabaseQuota(WKPageRef, WKFrameRef, WKSecurityOriginRef, WKStringRef, WKStringRef, unsigned long long currentQuota, unsigned long long, unsigned long long, unsigned long long, const void*);
+#endif
+    static void focus(WKPageRef, const void*);
+    static void unfocus(WKPageRef, const void*);
+    static void takeFocus(WKPageRef, WKFocusDirection, const void*);
+    static WKRect getWindowFrame(WKPageRef, const void*);
+    static void setWindowFrame(WKPageRef, WKRect, const void*);
+    static void runOpenPanel(WKPageRef, WKFrameRef, WKOpenPanelParametersRef, WKOpenPanelResultListenerRef, const void*);
+
+    EwkViewImpl* m_viewImpl;
+};
+
+} // namespace WebKit
+
+#endif // PageUIClientEfl_h
diff --git a/Source/WebKit2/UIProcess/API/efl/PageViewportControllerClientEfl.cpp b/Source/WebKit2/UIProcess/efl/PageViewportControllerClientEfl.cpp
index 99160c4a3..65006c288 100644
--- a/Source/WebKit2/UIProcess/API/efl/PageViewportControllerClientEfl.cpp
+++ b/Source/WebKit2/UIProcess/efl/PageViewportControllerClientEfl.cpp
@@ -26,10 +26,12 @@
 #include "config.h"
 #include "PageViewportControllerClientEfl.h"
 
-#if USE(COORDINATED_GRAPHICS)
+#if USE(TILED_BACKING_STORE)
 
+#include "EwkViewImpl.h"
 #include "LayerTreeCoordinatorProxy.h"
 #include "LayerTreeRenderer.h"
+#include "PageViewportController.h"
 #include "TransformationMatrix.h"
 #include "ewk_view_private.h"
 
@@ -37,11 +39,12 @@ using namespace WebCore;
 
 namespace WebKit {
 
-PageViewportControllerClientEfl::PageViewportControllerClientEfl(Evas_Object* viewWidget)
-    : m_viewWidget(viewWidget)
+PageViewportControllerClientEfl::PageViewportControllerClientEfl(EwkViewImpl* viewImpl)
+    : m_viewImpl(viewImpl)
     , m_scaleFactor(1)
+    , m_controller(0)
 {
-    ASSERT(m_viewWidget);
+    ASSERT(m_viewImpl);
 }
 
 PageViewportControllerClientEfl::~PageViewportControllerClientEfl()
@@ -50,7 +53,7 @@ PageViewportControllerClientEfl::~PageViewportControllerClientEfl()
 
 DrawingAreaProxy* PageViewportControllerClientEfl::drawingArea() const
 {
-    return ewk_view_page_get(m_viewWidget)->drawingArea();
+    return m_viewImpl->page()->drawingArea();
 }
 
 void PageViewportControllerClientEfl::setRendererActive(bool active)
@@ -58,79 +61,65 @@ void PageViewportControllerClientEfl::setRendererActive(bool active)
     drawingArea()->layerTreeCoordinatorProxy()->layerTreeRenderer()->setActive(active);
 }
 
-void PageViewportControllerClientEfl::display(const IntRect& rect, const IntPoint& viewPosition)
-{
-    WebCore::TransformationMatrix matrix;
-    matrix.setMatrix(m_scaleFactor, 0, 0, m_scaleFactor, -m_visibleContentRect.x() + viewPosition.x(), -m_visibleContentRect.y() + viewPosition.y());
-
-    LayerTreeRenderer* renderer = drawingArea()->layerTreeCoordinatorProxy()->layerTreeRenderer();
-    renderer->setActive(true);
-    renderer->syncRemoteContent();
-    IntRect clipRect(rect);
-    clipRect.move(viewPosition.x(), viewPosition.y());
-    renderer->paintToCurrentGLContext(matrix, 1, clipRect);
-}
-
 void PageViewportControllerClientEfl::updateViewportSize(const IntSize& viewportSize)
 {
     m_viewportSize = viewportSize;
-    ewk_view_page_get(m_viewWidget)->setViewportSize(viewportSize);
-    setVisibleContentsRect(m_visibleContentRect.location(), m_scaleFactor, FloatPoint());
+
+    ASSERT(m_controller);
+    m_controller->didChangeViewportSize(viewportSize);
 }
 
 void PageViewportControllerClientEfl::setVisibleContentsRect(const IntPoint& newScrollPosition, float newScale, const FloatPoint& trajectory)
 {
     m_scaleFactor = newScale;
-    m_visibleContentRect = IntRect(newScrollPosition, m_viewportSize);
-
-    // Move visibleContentRect inside contentsRect when visibleContentRect goes outside contentsRect. 
-    IntSize contentsSize = m_contentsSize;
-    contentsSize.scale(m_scaleFactor);
-    if (m_visibleContentRect.x() > contentsSize.width() - m_visibleContentRect.width())
-        m_visibleContentRect.setX(contentsSize.width() - m_visibleContentRect.width());
-    if (m_visibleContentRect.x() < 0)
-        m_visibleContentRect.setX(0);
-    if (m_visibleContentRect.y() > contentsSize.height() - m_visibleContentRect.height())
-        m_visibleContentRect.setY(contentsSize.height() - m_visibleContentRect.height());
-    if (m_visibleContentRect.y() < 0)
-        m_visibleContentRect.setY(0);
-
-    FloatRect mapRectToWebContent = m_visibleContentRect;
-    mapRectToWebContent.scale(1 / m_scaleFactor);
-    drawingArea()->setVisibleContentsRect(enclosingIntRect(mapRectToWebContent), m_scaleFactor, trajectory);
+    m_scrollPosition = newScrollPosition;
+
+    ASSERT(m_controller);
+    m_controller->didChangeContentsVisibility(m_scrollPosition, m_scaleFactor, trajectory);
 }
 
-void PageViewportControllerClientEfl::didChangeContentsSize(const WebCore::IntSize& size)
+void PageViewportControllerClientEfl::didChangeContentsSize(const WebCore::IntSize&)
 {
-    m_contentsSize = size;
-    setVisibleContentsRect(m_visibleContentRect.location(), m_scaleFactor, FloatPoint());
-    drawingArea()->layerTreeCoordinatorProxy()->setContentsSize(WebCore::FloatSize(size.width(), size.height()));
+    m_viewImpl->update();
 }
 
-void PageViewportControllerClientEfl::setViewportPosition(const WebCore::FloatPoint& /*contentsPoint*/)
+void PageViewportControllerClientEfl::setViewportPosition(const WebCore::FloatPoint& contentsPoint)
 {
+    IntPoint position(contentsPoint.x(), contentsPoint.y());
+    setVisibleContentsRect(position, m_scaleFactor, FloatPoint());
+    m_viewImpl->setScrollPosition(position);
 }
 
-void PageViewportControllerClientEfl::setContentsScale(float, bool /*treatAsInitialValue*/)
+void PageViewportControllerClientEfl::setContentsScale(float newScale, bool treatAsInitialValue)
 {
+    if (treatAsInitialValue) {
+        m_scrollPosition = IntPoint();
+        m_viewImpl->setScrollPosition(IntPoint());
+    }
+    m_scaleFactor = newScale;
+    m_viewImpl->setScaleFactor(newScale);
 }
 
 void PageViewportControllerClientEfl::didResumeContent()
 {
+    ASSERT(m_controller);
+    m_controller->didChangeContentsVisibility(m_scrollPosition, m_scaleFactor);
 }
 
 void PageViewportControllerClientEfl::didChangeVisibleContents()
 {
+    m_viewImpl->update();
 }
 
 void PageViewportControllerClientEfl::didChangeViewportAttributes()
 {
 }
 
-void PageViewportControllerClientEfl::setController(PageViewportController* pageViewportController)
+void PageViewportControllerClientEfl::setController(PageViewportController* controller)
 {
+    m_controller = controller;
 }
 
 } // namespace WebKit
-#endif // USE(COORDINATED_GRAPHICS)
+#endif // USE(TILED_BACKING_STORE)
 
diff --git a/Source/WebKit2/UIProcess/API/efl/PageViewportControllerClientEfl.h b/Source/WebKit2/UIProcess/efl/PageViewportControllerClientEfl.h
index 943452651..ee9d37690 100644
--- a/Source/WebKit2/UIProcess/API/efl/PageViewportControllerClientEfl.h
+++ b/Source/WebKit2/UIProcess/efl/PageViewportControllerClientEfl.h
@@ -26,26 +26,29 @@
 #ifndef PageViewportControllerClientEfl_h
 #define PageViewportControllerClientEfl_h
 
-#if USE(COORDINATED_GRAPHICS)
+#if USE(TILED_BACKING_STORE)
 
-#include "PageClientImpl.h"
+#include "PageClientBase.h"
 #include "PageViewportControllerClient.h"
 #include <wtf/PassOwnPtr.h>
 
+class EwkViewImpl;
+
 namespace WebKit {
 
 class PageViewportControllerClientEfl : public PageViewportControllerClient {
 public:
-    static PassOwnPtr<PageViewportControllerClientEfl> create(Evas_Object* viewWidget)
+    static PassOwnPtr<PageViewportControllerClientEfl> create(EwkViewImpl* viewImpl)
     {
-        return adoptPtr(new PageViewportControllerClientEfl(viewWidget));
+        return adoptPtr(new PageViewportControllerClientEfl(viewImpl));
     }
     ~PageViewportControllerClientEfl();
 
     DrawingAreaProxy* drawingArea() const;
     WebCore::IntSize viewSize() { return m_viewportSize; }
+    float scaleFactor() const { return m_scaleFactor; }
+    WebCore::IntPoint scrollPosition() { return m_scrollPosition; }
 
-    void display(const WebCore::IntRect& rect, const WebCore::IntPoint& viewPosition);
     void updateViewportSize(const WebCore::IntSize& viewportSize);
     void setVisibleContentsRect(const WebCore::IntPoint&, float, const WebCore::FloatPoint&);
     void setRendererActive(bool);
@@ -61,13 +64,13 @@ public:
     virtual void setController(PageViewportController*);
 
 private:
-    explicit PageViewportControllerClientEfl(Evas_Object*);
+    explicit PageViewportControllerClientEfl(EwkViewImpl*);
 
-    Evas_Object* m_viewWidget;
-    WebCore::IntRect m_visibleContentRect;
-    WebCore::IntSize m_contentsSize;
+    EwkViewImpl* m_viewImpl;
     WebCore::IntSize m_viewportSize;
+    WebCore::IntPoint m_scrollPosition;
     float m_scaleFactor;
+    PageViewportController* m_controller;
 };
 
 } // namespace WebKit
diff --git a/Source/WebKit2/UIProcess/efl/RequestManagerClientEfl.cpp b/Source/WebKit2/UIProcess/efl/RequestManagerClientEfl.cpp
new file mode 100644
index 000000000..3fb32c647
--- /dev/null
+++ b/Source/WebKit2/UIProcess/efl/RequestManagerClientEfl.cpp
@@ -0,0 +1,96 @@
+/*
+ * Copyright (C) 2012 Intel Corporation. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "RequestManagerClientEfl.h"
+
+#include "WKContextSoup.h"
+#include "WKSoupRequestManager.h"
+#include "WebSoupRequestManagerProxy.h"
+#include "ewk_context_private.h"
+#include "ewk_url_scheme_request_private.h"
+
+namespace WebKit {
+
+struct Ewk_Url_Scheme_Handler {
+    Ewk_Url_Scheme_Request_Cb callback;
+    void* userData;
+
+    Ewk_Url_Scheme_Handler()
+        : callback(0)
+        , userData(0)
+    { }
+
+    Ewk_Url_Scheme_Handler(Ewk_Url_Scheme_Request_Cb callback, void* userData)
+        : callback(callback)
+        , userData(userData)
+    { }
+};
+
+static inline RequestManagerClientEfl* toRequestManagerClientEfl(const void* clientInfo)
+{
+    return static_cast<RequestManagerClientEfl*>(const_cast<void*>(clientInfo));
+}
+
+void RequestManagerClientEfl::didReceiveURIRequest(WKSoupRequestManagerRef soupRequestManagerRef, WKURLRef urlRef, WKPageRef, uint64_t requestID, const void* clientInfo)
+{
+    RequestManagerClientEfl* requestManager = toRequestManagerClientEfl(clientInfo);
+
+    RefPtr<EwkUrlSchemeRequest> schemeRequest = EwkUrlSchemeRequest::create(soupRequestManagerRef, urlRef, requestID);
+    Ewk_Url_Scheme_Handler handler = requestManager->m_urlSchemeHandlers.get(schemeRequest->scheme());
+    if (!handler.callback)
+        return;
+
+    handler.callback(schemeRequest.get(), handler.userData);
+}
+
+RequestManagerClientEfl::RequestManagerClientEfl(EwkContext* context)
+    : m_soupRequestManager(WKContextGetSoupRequestManager(context->wkContext()))
+{
+    ASSERT(context);
+
+    WKSoupRequestManagerClient wkRequestManagerClient;
+    memset(&wkRequestManagerClient, 0, sizeof(WKSoupRequestManagerClient));
+
+    wkRequestManagerClient.version = kWKSoupRequestManagerClientCurrentVersion;
+    wkRequestManagerClient.clientInfo = this;
+    wkRequestManagerClient.didReceiveURIRequest = didReceiveURIRequest;
+
+    WKSoupRequestManagerSetClient(m_soupRequestManager.get(), &wkRequestManagerClient);
+}
+
+RequestManagerClientEfl::~RequestManagerClientEfl()
+{
+}
+
+void RequestManagerClientEfl::registerURLSchemeHandler(const String& scheme, Ewk_Url_Scheme_Request_Cb callback, void* userData)
+{
+    ASSERT(callback);
+
+    m_urlSchemeHandlers.set(scheme, Ewk_Url_Scheme_Handler(callback, userData));
+    toImpl(m_soupRequestManager.get())->registerURIScheme(scheme);
+}
+
+} // namespace WebKit
diff --git a/Source/WebKit2/UIProcess/efl/RequestManagerClientEfl.h b/Source/WebKit2/UIProcess/efl/RequestManagerClientEfl.h
new file mode 100644
index 000000000..71aaedf7c
--- /dev/null
+++ b/Source/WebKit2/UIProcess/efl/RequestManagerClientEfl.h
@@ -0,0 +1,59 @@
+/*
+ * Copyright (C) 2012 Intel Corporation. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef RequestManagerClientEfl_h
+#define RequestManagerClientEfl_h
+
+#include "WKRetainPtr.h"
+#include "ewk_context_private.h"
+#include <WebKit2/WKBase.h>
+#include <wtf/HashMap.h>
+#include <wtf/PassOwnPtr.h>
+#include <wtf/text/WTFString.h>
+
+namespace WebKit {
+
+class RequestManagerClientEfl {
+public:
+    ~RequestManagerClientEfl();
+    static PassOwnPtr<RequestManagerClientEfl> create(EwkContext* context)
+    {
+        return adoptPtr(new RequestManagerClientEfl(context));
+    }
+
+    void registerURLSchemeHandler(const String& scheme, Ewk_Url_Scheme_Request_Cb callback, void* userData);
+
+private:
+    explicit RequestManagerClientEfl(EwkContext*);
+
+    static void didReceiveURIRequest(WKSoupRequestManagerRef, WKURLRef, WKPageRef, uint64_t requestID, const void* clientInfo);
+
+    WKRetainPtr<WKSoupRequestManagerRef> m_soupRequestManager;
+    HashMap<String, class Ewk_Url_Scheme_Handler> m_urlSchemeHandlers;
+};
+
+} // namespace WebKit
+
+#endif // RequestManagerClientEfl_h
diff --git a/Source/WebKit2/UIProcess/efl/ResourceLoadClientEfl.cpp b/Source/WebKit2/UIProcess/efl/ResourceLoadClientEfl.cpp
index 6539cce36..a5b689813 100644
--- a/Source/WebKit2/UIProcess/efl/ResourceLoadClientEfl.cpp
+++ b/Source/WebKit2/UIProcess/efl/ResourceLoadClientEfl.cpp
@@ -26,6 +26,7 @@
 #include "config.h"
 #include "ResourceLoadClientEfl.h"
 
+#include "EwkViewImpl.h"
 #include "WKAPICast.h"
 #include "WKFrame.h"
 #include "WKPage.h"
@@ -33,8 +34,10 @@
 #include "ewk_error_private.h"
 #include "ewk_url_request_private.h"
 #include "ewk_url_response_private.h"
+#include "ewk_view.h"
 
 using namespace WebCore;
+using namespace EwkViewCallbacks;
 
 namespace WebKit {
 
@@ -54,8 +57,9 @@ void ResourceLoadClientEfl::didInitiateLoadForResource(WKPageRef, WKFrameRef wkF
     // Keep the resource internally to reuse it later.
     resourceLoadClient->m_loadingResourcesMap.add(resourceIdentifier, resource);
 
-    RefPtr<Ewk_Url_Request> request = Ewk_Url_Request::create(wkRequest);
-    ewk_view_resource_load_initiated(resourceLoadClient->m_view, resource.get(), request.get());
+    RefPtr<Ewk_Url_Request> request = EwkUrlRequest::create(wkRequest);
+    Ewk_Resource_Request resourceRequest = {resource.get(), request.get(), 0};
+    resourceLoadClient->m_viewImpl->smartCallback<ResourceLoadStarted>().call(&resourceRequest);
 }
 
 void ResourceLoadClientEfl::didSendRequestForResource(WKPageRef, WKFrameRef, uint64_t resourceIdentifier, WKURLRequestRef wkRequest, WKURLResponseRef wkRedirectResponse, const void* clientInfo)
@@ -67,9 +71,10 @@ void ResourceLoadClientEfl::didSendRequestForResource(WKPageRef, WKFrameRef, uin
     if (!resource)
         return;
 
-    RefPtr<Ewk_Url_Request> request = Ewk_Url_Request::create(wkRequest);
-    RefPtr<Ewk_Url_Response> redirectResponse = Ewk_Url_Response::create(wkRedirectResponse);
-    ewk_view_resource_request_sent(resourceLoadClient->m_view, resource.get(), request.get(), redirectResponse.get());
+    RefPtr<Ewk_Url_Request> request = EwkUrlRequest::create(wkRequest);
+    RefPtr<Ewk_Url_Response> redirectResponse = EwkUrlResponse::create(wkRedirectResponse);
+    Ewk_Resource_Request resourceRequest = {resource.get(), request.get(), redirectResponse.get()};
+    resourceLoadClient->m_viewImpl->smartCallback<ResourceRequestSent>().call(&resourceRequest);
 }
 
 void ResourceLoadClientEfl::didReceiveResponseForResource(WKPageRef, WKFrameRef, uint64_t resourceIdentifier, WKURLResponseRef wkResponse, const void* clientInfo)
@@ -81,8 +86,9 @@ void ResourceLoadClientEfl::didReceiveResponseForResource(WKPageRef, WKFrameRef,
     if (!resource)
         return;
 
-    RefPtr<Ewk_Url_Response> response = Ewk_Url_Response::create(wkResponse);
-    ewk_view_resource_load_response(resourceLoadClient->m_view, resource.get(), response.get());
+    RefPtr<Ewk_Url_Response> response = EwkUrlResponse::create(wkResponse);
+    Ewk_Resource_Load_Response resourceLoadResponse = {resource.get(), response.get()};
+    resourceLoadClient->m_viewImpl->smartCallback<ResourceLoadResponse>().call(&resourceLoadResponse);
 }
 
 void ResourceLoadClientEfl::didFinishLoadForResource(WKPageRef, WKFrameRef, uint64_t resourceIdentifier, const void* clientInfo)
@@ -94,7 +100,7 @@ void ResourceLoadClientEfl::didFinishLoadForResource(WKPageRef, WKFrameRef, uint
     if (!resource)
         return;
 
-    ewk_view_resource_load_finished(resourceLoadClient->m_view, resource.get());
+    resourceLoadClient->m_viewImpl->smartCallback<ResourceLoadFinished>().call(resource.get());
 }
 
 void ResourceLoadClientEfl::didFailLoadForResource(WKPageRef, WKFrameRef, uint64_t resourceIdentifier, WKErrorRef wkError, const void* clientInfo)
@@ -107,8 +113,9 @@ void ResourceLoadClientEfl::didFailLoadForResource(WKPageRef, WKFrameRef, uint64
         return;
 
     OwnPtr<Ewk_Error> ewkError = Ewk_Error::create(wkError);
-    ewk_view_resource_load_failed(resourceLoadClient->m_view, resource.get(), ewkError.get());
-    ewk_view_resource_load_finished(resourceLoadClient->m_view, resource.get());
+    Ewk_Resource_Load_Error resourceLoadError = {resource.get(), ewkError.get()};
+    resourceLoadClient->m_viewImpl->smartCallback<ResourceLoadFailed>().call(&resourceLoadError);
+    resourceLoadClient->m_viewImpl->smartCallback<ResourceLoadFinished>().call(resource.get());
 }
 
 void ResourceLoadClientEfl::onViewProvisionalLoadStarted(void* userData, Evas_Object*, void*)
@@ -119,13 +126,13 @@ void ResourceLoadClientEfl::onViewProvisionalLoadStarted(void* userData, Evas_Ob
     resourceLoadClient->m_loadingResourcesMap.clear();
 }
 
-ResourceLoadClientEfl::ResourceLoadClientEfl(Evas_Object* view)
-    : m_view(view)
+ResourceLoadClientEfl::ResourceLoadClientEfl(EwkViewImpl* viewImpl)
+    : m_viewImpl(viewImpl)
 {
     // Listen for "load,provisional,started" on the view to clear internal resources map.
-    evas_object_smart_callback_add(m_view, "load,provisional,started", onViewProvisionalLoadStarted, this);
+    evas_object_smart_callback_add(m_viewImpl->view(), CallBackInfo<ProvisionalLoadStarted>::name(), onViewProvisionalLoadStarted, this);
 
-    WKPageRef pageRef = ewk_view_wkpage_get(m_view);
+    WKPageRef pageRef = m_viewImpl->wkPage();
     ASSERT(pageRef);
 
     WKPageResourceLoadClient wkResourceLoadClient;
@@ -143,7 +150,7 @@ ResourceLoadClientEfl::ResourceLoadClientEfl(Evas_Object* view)
 
 ResourceLoadClientEfl::~ResourceLoadClientEfl()
 {
-    evas_object_smart_callback_del(m_view, "load,provisional,started", onViewProvisionalLoadStarted);
+    evas_object_smart_callback_del(m_viewImpl->view(), CallBackInfo<ProvisionalLoadStarted>::name(), onViewProvisionalLoadStarted);
 }
 
 } // namespace WebKit
diff --git a/Source/WebKit2/UIProcess/efl/ResourceLoadClientEfl.h b/Source/WebKit2/UIProcess/efl/ResourceLoadClientEfl.h
index 58f52b4b7..7a5525b6a 100644
--- a/Source/WebKit2/UIProcess/efl/ResourceLoadClientEfl.h
+++ b/Source/WebKit2/UIProcess/efl/ResourceLoadClientEfl.h
@@ -27,23 +27,24 @@
 #define ResourceLoadClientEfl_h
 
 #include "ewk_resource_private.h"
-#include "ewk_view_private.h"
 #include <wtf/HashMap.h>
 #include <wtf/PassOwnPtr.h>
 
+class EwkViewImpl;
+
 namespace WebKit {
 
 class ResourceLoadClientEfl {
 public:
     ~ResourceLoadClientEfl();
 
-    static PassOwnPtr<ResourceLoadClientEfl> create(Evas_Object* view)
+    static PassOwnPtr<ResourceLoadClientEfl> create(EwkViewImpl* viewImpl)
     {
-        return adoptPtr(new ResourceLoadClientEfl(view));
+        return adoptPtr(new ResourceLoadClientEfl(viewImpl));
     }
 
 private:
-    explicit ResourceLoadClientEfl(Evas_Object* view);
+    explicit ResourceLoadClientEfl(EwkViewImpl*);
 
     static void didInitiateLoadForResource(WKPageRef, WKFrameRef, uint64_t resourceIdentifier, WKURLRequestRef, bool pageIsProvisionallyLoading, const void* clientInfo);
     static void didSendRequestForResource(WKPageRef, WKFrameRef, uint64_t resourceIdentifier, WKURLRequestRef, WKURLResponseRef, const void* clientInfo);
@@ -53,7 +54,7 @@ private:
 
     static void onViewProvisionalLoadStarted(void* userData, Evas_Object* view, void* clientInfo);
 
-    Evas_Object* m_view;
+    EwkViewImpl* m_viewImpl;
     HashMap< uint64_t, RefPtr<Ewk_Resource> > m_loadingResourcesMap;
 };
 
diff --git a/Source/WebKit2/UIProcess/API/efl/VibrationProvider.cpp b/Source/WebKit2/UIProcess/efl/VibrationProvider.cpp
index 9d8feb1fe..2de62968c 100644
--- a/Source/WebKit2/UIProcess/API/efl/VibrationProvider.cpp
+++ b/Source/WebKit2/UIProcess/efl/VibrationProvider.cpp
@@ -34,6 +34,7 @@
 #include <Evas.h>
 
 using namespace WebCore;
+using namespace WebKit;
 
 /**
  * \struct  Ewk_Vibration_Client
diff --git a/Source/WebKit2/UIProcess/API/efl/VibrationProvider.h b/Source/WebKit2/UIProcess/efl/VibrationProvider.h
index fadd58a1b..5810393de 100644
--- a/Source/WebKit2/UIProcess/API/efl/VibrationProvider.h
+++ b/Source/WebKit2/UIProcess/efl/VibrationProvider.h
@@ -35,6 +35,8 @@
 
 typedef struct Ewk_Vibration_Client Ewk_Vibration_Client;
 
+namespace WebKit {
+
 class VibrationProvider : public RefCounted<VibrationProvider> {
 public:
     static PassRefPtr<VibrationProvider> create(WKContextRef);
@@ -51,6 +53,8 @@ private:
     OwnPtr<Ewk_Vibration_Client> m_vibrationClient;
 };
 
+} // namespace WebKit
+
 #endif // ENABLE(VIBRATION)
 
 #endif // VibrationProvider_h
diff --git a/Source/WebKit2/UIProcess/efl/WebContextEfl.cpp b/Source/WebKit2/UIProcess/efl/WebContextEfl.cpp
index d53f83560..d43145caf 100644
--- a/Source/WebKit2/UIProcess/efl/WebContextEfl.cpp
+++ b/Source/WebKit2/UIProcess/efl/WebContextEfl.cpp
@@ -28,6 +28,7 @@
 
 #include <Efreet.h>
 #include <WebCore/ApplicationCacheStorage.h>
+#include <WebCore/IconDatabase.h>
 #include <WebCore/NotImplemented.h>
 
 namespace WebKit {
@@ -54,7 +55,7 @@ String WebContext::platformDefaultDatabaseDirectory() const
 
 String WebContext::platformDefaultIconDatabasePath() const
 {
-    return String::fromUTF8(efreet_data_home_get()) + "/WebKitEfl/IconDatabase";
+    return String::fromUTF8(efreet_data_home_get()) + "/WebKitEfl/IconDatabase/" + WebCore::IconDatabase::defaultDatabaseFilename();
 }
 
 String WebContext::platformDefaultLocalStorageDirectory() const
diff --git a/Source/WebKit2/UIProcess/efl/WebFullScreenManagerProxyEfl.cpp b/Source/WebKit2/UIProcess/efl/WebFullScreenManagerProxyEfl.cpp
index 254340de5..468cbf884 100644
--- a/Source/WebKit2/UIProcess/efl/WebFullScreenManagerProxyEfl.cpp
+++ b/Source/WebKit2/UIProcess/efl/WebFullScreenManagerProxyEfl.cpp
@@ -25,10 +25,10 @@
 
 #include "config.h"
 #include "WebFullScreenManagerProxy.h"
-#include "ewk_view_private.h"
 
 #if ENABLE(FULLSCREEN_API)
 
+#include "EwkViewImpl.h"
 #include <WebCore/NotImplemented.h>
 
 using namespace WebCore;
@@ -57,7 +57,7 @@ void WebFullScreenManagerProxy::enterFullScreen()
         return;
 
     willEnterFullScreen();
-    ewk_view_full_screen_enter(m_webView);
+    EwkViewImpl::fromEvasObject(m_webView)->enterFullScreen();
     didEnterFullScreen();
 }
 
@@ -66,8 +66,9 @@ void WebFullScreenManagerProxy::exitFullScreen()
     if (!m_webView)
         return;
 
+
     willExitFullScreen();
-    ewk_view_full_screen_exit(m_webView);
+    EwkViewImpl::fromEvasObject(m_webView)->exitFullScreen();
     didExitFullScreen();
 }
 
diff --git a/Source/WebKit2/UIProcess/efl/WebInspectorProxyEfl.cpp b/Source/WebKit2/UIProcess/efl/WebInspectorProxyEfl.cpp
index ffd6aa5f9..82f83c86d 100644
--- a/Source/WebKit2/UIProcess/efl/WebInspectorProxyEfl.cpp
+++ b/Source/WebKit2/UIProcess/efl/WebInspectorProxyEfl.cpp
@@ -28,6 +28,7 @@
 
 #if ENABLE(INSPECTOR)
 
+#include "EwkViewImpl.h"
 #include "WebProcessProxy.h"
 #include "ewk_settings.h"
 #include "ewk_view.h"
@@ -86,17 +87,23 @@ WebPageProxy* WebInspectorProxy::platformCreateInspectorPage()
 {
     ASSERT(m_page);
 
+#if USE(ACCELERATED_COMPOSITING) && defined HAVE_ECORE_X
+    const char* engine = "opengl_x11";
+    m_inspectorWindow = ecore_evas_new(engine, 0, 0, initialWindowWidth, initialWindowHeight, 0);
+#else
     m_inspectorWindow = ecore_evas_new(0, 0, 0, initialWindowWidth, initialWindowHeight, 0);
+#endif
     if (!m_inspectorWindow)
         return 0;
 
     m_inspectorView = ewk_view_base_add(ecore_evas_get(m_inspectorWindow), toAPI(page()->process()->context()), toAPI(inspectorPageGroup()));
-    ewk_view_theme_set(m_inspectorView, TEST_THEME_DIR"/default.edj");
+    EwkViewImpl* inspectorViewImpl = EwkViewImpl::fromEvasObject(m_inspectorView);
+    inspectorViewImpl->setThemePath(TEST_THEME_DIR "/default.edj");
 
-    Ewk_Settings* settings = ewk_view_settings_get(m_inspectorView);
+    Ewk_Settings* settings = inspectorViewImpl->settings();
     ewk_settings_file_access_from_file_urls_allowed_set(settings, true);
 
-    return ewk_view_page_get(m_inspectorView);
+    return inspectorViewImpl->page();
 }
 
 void WebInspectorProxy::platformOpen()
diff --git a/Source/WebKit2/UIProcess/efl/WebPageProxyEfl.cpp b/Source/WebKit2/UIProcess/efl/WebPageProxyEfl.cpp
index 8981ceeb1..befa247c2 100644
--- a/Source/WebKit2/UIProcess/efl/WebPageProxyEfl.cpp
+++ b/Source/WebKit2/UIProcess/efl/WebPageProxyEfl.cpp
@@ -26,8 +26,10 @@
 #include "config.h"
 #include "WebPageProxy.h"
 
+#include "EwkViewImpl.h"
+#include "NativeWebKeyboardEvent.h"
 #include "NotImplemented.h"
-#include "PageClientImpl.h"
+#include "PageClientBase.h"
 #include "WebKitVersion.h"
 #include "WebPageMessages.h"
 #include "WebProcessProxy.h"
@@ -38,7 +40,7 @@ namespace WebKit {
 
 Evas_Object* WebPageProxy::viewWidget()
 {
-    return static_cast<PageClientImpl*>(m_pageClient)->viewWidget();
+    return static_cast<PageClientBase*>(m_pageClient)->viewImpl()->view();
 }
 
 String WebPageProxy::standardUserAgent(const String& /*applicationNameForUserAgent*/)
@@ -93,4 +95,33 @@ void WebPageProxy::windowedPluginGeometryDidChange(const WebCore::IntRect&, cons
     notImplemented();
 }
 
+void WebPageProxy::handleInputMethodKeydown(bool& handled)
+{
+    handled = m_keyEventQueue.first().isFiltered();
+}
+
+void WebPageProxy::confirmComposition(const String& compositionString)
+{
+    if (!isValid())
+        return;
+
+    process()->send(Messages::WebPage::ConfirmComposition(compositionString), m_pageID, 0);
+}
+
+void WebPageProxy::setComposition(const String& compositionString, Vector<WebCore::CompositionUnderline>& underlines, int cursorPosition)
+{
+    if (!isValid())
+        return;
+
+    process()->send(Messages::WebPage::SetComposition(compositionString, underlines, cursorPosition), m_pageID, 0);
+}
+
+void WebPageProxy::cancelComposition()
+{
+    if (!isValid())
+        return;
+
+    process()->send(Messages::WebPage::CancelComposition(), m_pageID, 0);
+}
+
 } // namespace WebKit
diff --git a/Source/WebKit2/UIProcess/efl/WebPopupMenuProxyEfl.cpp b/Source/WebKit2/UIProcess/efl/WebPopupMenuProxyEfl.cpp
index 03d504ba4..f5b104d9f 100644
--- a/Source/WebKit2/UIProcess/efl/WebPopupMenuProxyEfl.cpp
+++ b/Source/WebKit2/UIProcess/efl/WebPopupMenuProxyEfl.cpp
@@ -26,30 +26,30 @@
 #include "config.h"
 #include "WebPopupMenuProxyEfl.h"
 
+#include "EwkViewImpl.h"
 #include "NativeWebMouseEvent.h"
 #include "WebPopupItem.h"
 #include "ewk_view.h"
-#include "ewk_view_private.h"
 #include <wtf/text/CString.h>
 
 using namespace WebCore;
 
 namespace WebKit {
 
-WebPopupMenuProxyEfl::WebPopupMenuProxyEfl(Evas_Object* webView, WebPopupMenuProxy::Client* client)
+WebPopupMenuProxyEfl::WebPopupMenuProxyEfl(EwkViewImpl* viewImpl, WebPopupMenuProxy::Client* client)
     : WebPopupMenuProxy(client)
-    , m_webView(webView)
+    , m_viewImpl(viewImpl)
 {
 }
 
 void WebPopupMenuProxyEfl::showPopupMenu(const IntRect& rect, TextDirection textDirection, double pageScaleFactor, const Vector<WebPopupItem>& items, const PlatformPopupMenuData&, int32_t selectedIndex)
 {
-    ewk_view_popup_menu_request(m_webView, this, rect, textDirection, pageScaleFactor, items, selectedIndex);
+    m_viewImpl->requestPopupMenu(this, rect, textDirection, pageScaleFactor, items, selectedIndex);
 }
 
 void WebPopupMenuProxyEfl::hidePopupMenu()
 {
-    ewk_view_popup_menu_close(m_webView);
+    m_viewImpl->closePopupMenu();
 }
 
 void WebPopupMenuProxyEfl::valueChanged(int newSelectedIndex)
diff --git a/Source/WebKit2/UIProcess/efl/WebPopupMenuProxyEfl.h b/Source/WebKit2/UIProcess/efl/WebPopupMenuProxyEfl.h
index ab4074ab2..e4edb9635 100644
--- a/Source/WebKit2/UIProcess/efl/WebPopupMenuProxyEfl.h
+++ b/Source/WebKit2/UIProcess/efl/WebPopupMenuProxyEfl.h
@@ -34,15 +34,17 @@ namespace WebCore {
 class IntRect;
 }
 
+class EwkViewImpl;
+
 namespace WebKit {
 
 class WebPageProxy;
 
 class WebPopupMenuProxyEfl : public WebPopupMenuProxy {
 public:
-    static PassRefPtr<WebPopupMenuProxyEfl> create(Evas_Object* webView, WebPopupMenuProxy::Client* client)
+    static PassRefPtr<WebPopupMenuProxyEfl> create(EwkViewImpl* viewImpl, WebPopupMenuProxy::Client* client)
     {
-        return adoptRef(new WebPopupMenuProxyEfl(webView, client));
+        return adoptRef(new WebPopupMenuProxyEfl(viewImpl, client));
     }
 
     void showPopupMenu(const WebCore::IntRect&, WebCore::TextDirection, double pageScaleFactor, const Vector<WebPopupItem>&, const PlatformPopupMenuData&, int32_t selectedIndex);
@@ -51,9 +53,9 @@ public:
     void valueChanged(int newSelectedIndex);
 
 private:
-    WebPopupMenuProxyEfl(Evas_Object*, WebPopupMenuProxy::Client*);
+    WebPopupMenuProxyEfl(EwkViewImpl*, WebPopupMenuProxy::Client*);
 
-    Evas_Object* m_webView;
+    EwkViewImpl* m_viewImpl;
 };
 
 } // namespace WebKit
diff --git a/Source/WebKit2/UIProcess/mac/CorrectionPanel.mm b/Source/WebKit2/UIProcess/mac/CorrectionPanel.mm
index 79053ed70..33f3fe982 100644
--- a/Source/WebKit2/UIProcess/mac/CorrectionPanel.mm
+++ b/Source/WebKit2/UIProcess/mac/CorrectionPanel.mm
@@ -109,7 +109,7 @@ String CorrectionPanel::dismissInternal(ReasonForDismissingAlternativeText reaso
 
 void CorrectionPanel::recordAutocorrectionResponse(WKView* view, NSCorrectionResponse response, const String& replacedString, const String& replacementString)
 {
-    [[NSSpellChecker sharedSpellChecker] recordResponse:response toCorrection:replacementString forWord:replacedString language:nil inSpellDocumentWithTag:[view _wk_spellCheckerDocumentTag]];
+    [[NSSpellChecker sharedSpellChecker] recordResponse:response toCorrection:replacementString forWord:replacedString language:nil inSpellDocumentWithTag:[view spellCheckerDocumentTag]];
 }
 
 void CorrectionPanel::handleAcceptedReplacement(NSString* acceptedReplacement, NSString* replaced, NSString* proposedReplacement,  NSCorrectionIndicatorType correctionIndicatorType)
@@ -118,7 +118,7 @@ void CorrectionPanel::handleAcceptedReplacement(NSString* acceptedReplacement, N
         return;
 
     NSSpellChecker* spellChecker = [NSSpellChecker sharedSpellChecker];
-    NSInteger documentTag = [m_view.get() _wk_spellCheckerDocumentTag];
+    NSInteger documentTag = [m_view.get() spellCheckerDocumentTag];
     
     switch (correctionIndicatorType) {
     case NSCorrectionIndicatorTypeDefault:
@@ -141,7 +141,7 @@ void CorrectionPanel::handleAcceptedReplacement(NSString* acceptedReplacement, N
         break;
     }
 
-    [m_view.get() _wk_handleAcceptedAlternativeText:acceptedReplacement];
+    [m_view.get() handleAcceptedAlternativeText:acceptedReplacement];
     m_view.clear();
     if (acceptedReplacement)
         m_resultForDismissal.adoptNS([acceptedReplacement copy]);
diff --git a/Source/WebKit2/UIProcess/mac/RemoteLayerTreeDrawingAreaProxy.h b/Source/WebKit2/UIProcess/mac/RemoteLayerTreeDrawingAreaProxy.h
new file mode 100644
index 000000000..4f7ca6647
--- /dev/null
+++ b/Source/WebKit2/UIProcess/mac/RemoteLayerTreeDrawingAreaProxy.h
@@ -0,0 +1,47 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef RemoteLayerTreeDrawingAreaProxy_h
+#define RemoteLayerTreeDrawingAreaProxy_h
+
+#include "DrawingAreaProxy.h"
+
+namespace WebKit {
+
+class RemoteLayerTreeDrawingAreaProxy : public DrawingAreaProxy {
+public:
+    static PassOwnPtr<RemoteLayerTreeDrawingAreaProxy> create(WebPageProxy*);
+    virtual ~RemoteLayerTreeDrawingAreaProxy();
+
+private:
+    explicit RemoteLayerTreeDrawingAreaProxy(WebPageProxy*);
+
+    virtual void sizeDidChange() OVERRIDE;
+    virtual void deviceScaleFactorDidChange() OVERRIDE;
+};
+
+} // namespace WebKit
+
+#endif // RemoteLayerTreeDrawingAreaProxy_h
diff --git a/Source/WebKit2/UIProcess/mac/RemoteLayerTreeDrawingAreaProxy.mm b/Source/WebKit2/UIProcess/mac/RemoteLayerTreeDrawingAreaProxy.mm
new file mode 100644
index 000000000..d8720a100
--- /dev/null
+++ b/Source/WebKit2/UIProcess/mac/RemoteLayerTreeDrawingAreaProxy.mm
@@ -0,0 +1,53 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "RemoteLayerTreeDrawingAreaProxy.h"
+
+namespace WebKit {
+
+PassOwnPtr<RemoteLayerTreeDrawingAreaProxy> RemoteLayerTreeDrawingAreaProxy::create(WebPageProxy* webPageProxy)
+{
+    return adoptPtr(new RemoteLayerTreeDrawingAreaProxy(webPageProxy));
+}
+
+RemoteLayerTreeDrawingAreaProxy::RemoteLayerTreeDrawingAreaProxy(WebPageProxy* webPageProxy)
+    : DrawingAreaProxy(DrawingAreaTypeRemoteLayerTree, webPageProxy)
+{
+}
+
+RemoteLayerTreeDrawingAreaProxy::~RemoteLayerTreeDrawingAreaProxy()
+{
+}
+
+void RemoteLayerTreeDrawingAreaProxy::sizeDidChange()
+{
+}
+
+void RemoteLayerTreeDrawingAreaProxy::deviceScaleFactorDidChange()
+{
+}
+
+} // namespace WebKit
diff --git a/Source/WebKit2/UIProcess/mac/WKFullScreenWindowController.mm b/Source/WebKit2/UIProcess/mac/WKFullScreenWindowController.mm
index eb82134ef..238a67516 100644
--- a/Source/WebKit2/UIProcess/mac/WKFullScreenWindowController.mm
+++ b/Source/WebKit2/UIProcess/mac/WKFullScreenWindowController.mm
@@ -242,7 +242,7 @@ static RetainPtr<CGImageRef> createImageWithCopiedData(CGImageRef sourceImage)
     // unnecessary in the full-screen animation case, and can cause bugs; see
     // https://bugs.webkit.org/show_bug.cgi?id=88940 and https://bugs.webkit.org/show_bug.cgi?id=88374
     // We will resume the normal behavior in _startEnterFullScreenAnimationWithDuration:
-    [_webView _wk_setSuppressVisibilityUpdates:YES];
+    [_webView _setSuppressVisibilityUpdates:YES];
 
     // Swap the webView placeholder into place.
     if (!_webViewPlaceholder) {
@@ -334,7 +334,7 @@ static RetainPtr<CGImageRef> createImageWithCopiedData(CGImageRef sourceImage)
 
     // See the related comment in enterFullScreen:
     // We will resume the normal behavior in _startExitFullScreenAnimationWithDuration:
-    [_webView _wk_setSuppressVisibilityUpdates:YES];
+    [_webView _setSuppressVisibilityUpdates:YES];
 
     [self _manager]->setAnimatingFullScreen(true);
     [self _manager]->willExitFullScreen();
@@ -581,7 +581,7 @@ static NSRect windowFrameFromApparentFrames(NSRect screenFrame, NSRect initialFr
 
     [_backgroundWindow.get() orderWindow:NSWindowBelow relativeTo:[[self window] windowNumber]];
 
-    [_webView _wk_setSuppressVisibilityUpdates:NO];
+    [_webView _setSuppressVisibilityUpdates:NO];
     [[self window] setAutodisplay:YES];
     [[self window] displayIfNeeded];
     NSEnableScreenUpdates();
@@ -626,7 +626,7 @@ static NSRect windowFrameFromApparentFrames(NSRect screenFrame, NSRect initialFr
     finalBounds.origin = [[self window] convertScreenToBase:finalBounds.origin];
     WKWindowSetClipRect([self window], finalBounds);
 
-    [_webView _wk_setSuppressVisibilityUpdates:NO];
+    [_webView _setSuppressVisibilityUpdates:NO];
     [[self window] setAutodisplay:YES];
     [[self window] displayIfNeeded];
     NSEnableScreenUpdates();
diff --git a/Source/WebKit2/UIProcess/mac/WebContextMac.mm b/Source/WebKit2/UIProcess/mac/WebContextMac.mm
index 9a9232cb0..11b75c9d0 100644
--- a/Source/WebKit2/UIProcess/mac/WebContextMac.mm
+++ b/Source/WebKit2/UIProcess/mac/WebContextMac.mm
@@ -26,8 +26,12 @@
 #import "config.h"
 #import "WebContext.h"
 
+#import "NetworkProcessManager.h"
+#import "PluginProcessManager.h"
+#import "SharedWorkerProcessManager.h"
 #import "WebKitSystemInterface.h"
 #import "WebProcessCreationParameters.h"
+#import "WebProcessMessages.h"
 #import <WebCore/Color.h>
 #import <WebCore/FileSystem.h>
 #include <WebCore/NotImplemented.h>
@@ -43,6 +47,7 @@ using namespace WebCore;
 NSString *WebDatabaseDirectoryDefaultsKey = @"WebDatabaseDirectory";
 NSString *WebKitLocalCacheDefaultsKey = @"WebKitLocalCache";
 NSString *WebStorageDirectoryDefaultsKey = @"WebKitLocalStorageDatabasePathPreferenceKey";
+NSString *WebKitKerningAndLigaturesEnabledByDefaultDefaultsKey = @"WebKitKerningAndLigaturesEnabledByDefault";
 
 static NSString *WebKitApplicationDidChangeAccessibilityEnhancedUserInterfaceNotification = @"NSApplicationDidChangeAccessibilityEnhancedUserInterfaceNotification";
 
@@ -51,6 +56,8 @@ NSString *WebIconDatabaseDirectoryDefaultsKey = @"WebIconDatabaseDirectoryDefaul
 
 namespace WebKit {
 
+bool WebContext::s_applicationIsOccluded = false;
+
 String WebContext::applicationCacheDirectory()
 {
     NSString *appName = [[NSBundle mainBundle] bundleIdentifier];
@@ -73,6 +80,17 @@ String WebContext::applicationCacheDirectory()
     return [cacheDir stringByAppendingPathComponent:appName];
 }
 
+static void registerUserDefaultsIfNeeded()
+{
+    static bool didRegister;
+    if (didRegister)
+        return;
+
+    didRegister = true;
+#if __MAC_OS_X_VERSION_MIN_REQUIRED >= 1090
+    [[NSUserDefaults standardUserDefaults] registerDefaults:[NSDictionary dictionaryWithObject:[NSNumber numberWithBool:YES] forKey:WebKitKerningAndLigaturesEnabledByDefaultDefaultsKey]];
+#endif
+}
 
 void WebContext::platformInitializeWebProcess(WebProcessCreationParameters& parameters)
 {
@@ -84,10 +102,11 @@ void WebContext::platformInitializeWebProcess(WebProcessCreationParameters& para
     parameters.nsURLCacheMemoryCapacity = [urlCache memoryCapacity];
     parameters.nsURLCacheDiskCapacity = [urlCache diskCapacity];
 
+    registerUserDefaultsIfNeeded();
 #if __MAC_OS_X_VERSION_MIN_REQUIRED >= 1090
     parameters.shouldForceScreenFontSubstitution = [[NSUserDefaults standardUserDefaults] boolForKey:@"NSFontDefaultScreenFontSubstitutionEnabled"];
 #endif
-    parameters.shouldEnableKerningAndLigaturesByDefault = [[NSUserDefaults standardUserDefaults] boolForKey:@"WebKitKerningAndLigaturesEnabledByDefault"];
+    parameters.shouldEnableKerningAndLigaturesByDefault = [[NSUserDefaults standardUserDefaults] boolForKey:WebKitKerningAndLigaturesEnabledByDefaultDefaultsKey];
 
 #if USE(ACCELERATED_COMPOSITING) && HAVE(HOSTED_CORE_ANIMATION)
 #if __MAC_OS_X_VERSION_MIN_REQUIRED >= 1070
@@ -244,5 +263,72 @@ void WebContext::setPasteboardBufferForType(const String& pasteboardName, const
     PlatformPasteboard(pasteboardName).setBufferForType(buffer, pasteboardType);
 }
 
-} // namespace WebKit
+void WebContext::applicationBecameVisible(uint32_t, void*, uint32_t, void*, uint32_t)
+{
+    if (s_applicationIsOccluded) {
+        s_applicationIsOccluded = false;
+
+        const Vector<WebContext*>& contexts = WebContext::allContexts();
+        for (size_t i = 0, count = contexts.size(); i < count; ++i)
+            contexts[i]->sendToAllProcesses(Messages::WebProcess::SetApplicationIsOccluded(false));
 
+#if ENABLE(PLUGIN_PROCESS)
+        PluginProcessManager::shared().setApplicationIsOccluded(false);
+#endif
+#if ENABLE(NETWORK_PROCESS)
+        NetworkProcessManager::shared().setApplicationIsOccluded(false);
+#endif
+#if ENABLE(SHARED_WORKER_PROCESS)
+        SharedWorkerProcessManager::shared().setApplicationIsOccluded(false);
+#endif
+    }
+}
+
+void WebContext::applicationBecameOccluded(uint32_t, void*, uint32_t, void*, uint32_t)
+{
+    if (!s_applicationIsOccluded) {
+        s_applicationIsOccluded = true;
+        const Vector<WebContext*>& contexts = WebContext::allContexts();
+        for (size_t i = 0, count = contexts.size(); i < count; ++i)
+            contexts[i]->sendToAllProcesses(Messages::WebProcess::SetApplicationIsOccluded(true));
+
+#if ENABLE(PLUGIN_PROCESS)
+        PluginProcessManager::shared().setApplicationIsOccluded(true);
+#endif
+#if ENABLE(NETWORK_PROCESS)
+        NetworkProcessManager::shared().setApplicationIsOccluded(true);
+#endif
+#if ENABLE(SHARED_WORKER_PROCESS)
+        SharedWorkerProcessManager::shared().setApplicationIsOccluded(true);
+#endif
+    }
+}
+
+void WebContext::initializeProcessSuppressionSupport()
+{
+    static bool didInitialize = false;
+    if (didInitialize)
+        return;
+
+    didInitialize = true;
+    // A temporary default until process suppression is enabled by default, at which point a context setting can be added with the
+    // interpretation that any context disabling process suppression disables it for plugin/network and shared worker processes.
+    bool processSuppressionSupportEnabled = [[NSUserDefaults standardUserDefaults] boolForKey:@"WebKitProcessSuppressionSupportEnabled"];
+    if (processSuppressionSupportEnabled)
+        registerOcclusionNotificationHandlers();
+}
+
+void WebContext::registerOcclusionNotificationHandlers()
+{
+#if __MAC_OS_X_VERSION_MIN_REQUIRED >= 1090
+    if (!WKRegisterOcclusionNotificationHandler(WKOcclusionNotificationTypeApplicationBecameVisible, applicationBecameVisible)) {
+        WTFLogAlways("Registeration of \"App Became Visible\" notification handler failed.\n");
+        return;
+    }
+
+    if (!WKRegisterOcclusionNotificationHandler(WKOcclusionNotificationTypeApplicationBecameOccluded, applicationBecameOccluded))
+        WTFLogAlways("Registeration of \"App Became Occluded\" notification handler failed.\n");
+#endif
+}
+
+} // namespace WebKit
diff --git a/Source/WebKit2/UIProcess/mac/WebCookieManagerProxyMac.mm b/Source/WebKit2/UIProcess/mac/WebCookieManagerProxyMac.mm
index 6a3134647..6fd2f9a7b 100644
--- a/Source/WebKit2/UIProcess/mac/WebCookieManagerProxyMac.mm
+++ b/Source/WebKit2/UIProcess/mac/WebCookieManagerProxyMac.mm
@@ -33,7 +33,7 @@ void WebCookieManagerProxy::persistHTTPCookieAcceptPolicy(HTTPCookieAcceptPolicy
     // FIXME: The sandbox appears to prevent persisting the new policy to disk, so we must set the
     // policy in the UI Process as well as in the Web Process (to make sure it gets set on any
     // Private Browsing Cookie Storage).
-    [[NSHTTPCookieStorage sharedHTTPCookieStorage] setCookieAcceptPolicy:policy];
+    [[NSHTTPCookieStorage sharedHTTPCookieStorage] setCookieAcceptPolicy:static_cast<NSHTTPCookieAcceptPolicy>(policy)];
 }
 
 } // namespace WebKit
diff --git a/Source/WebKit2/UIProcess/mac/WebFullScreenManagerProxyMac.mm b/Source/WebKit2/UIProcess/mac/WebFullScreenManagerProxyMac.mm
index 581a74d03..b8427d56f 100644
--- a/Source/WebKit2/UIProcess/mac/WebFullScreenManagerProxyMac.mm
+++ b/Source/WebKit2/UIProcess/mac/WebFullScreenManagerProxyMac.mm
@@ -42,7 +42,7 @@ void WebFullScreenManagerProxy::invalidate()
     if (!m_webView)
         return;
     
-    [m_webView _wk_closeFullScreenWindowController];
+    [m_webView closeFullScreenWindowController];
     m_webView = 0;
 }
 
@@ -50,43 +50,43 @@ void WebFullScreenManagerProxy::close()
 {
     if (!m_webView)
         return;
-    [[m_webView _wk_fullScreenWindowController] close];
+    [[m_webView fullScreenWindowController] close];
 }
 
 bool WebFullScreenManagerProxy::isFullScreen()
 {
     if (!m_webView)
         return false;
-    if (![m_webView _wk_hasFullScreenWindowController])
+    if (![m_webView hasFullScreenWindowController])
         return false;
 
-    return [[m_webView _wk_fullScreenWindowController] isFullScreen];
+    return [[m_webView fullScreenWindowController] isFullScreen];
 }
 
 void WebFullScreenManagerProxy::enterFullScreen()
 {
     if (!m_webView)
         return;
-    [[m_webView _wk_fullScreenWindowController] enterFullScreen:nil];
+    [[m_webView fullScreenWindowController] enterFullScreen:nil];
 }
 
 void WebFullScreenManagerProxy::exitFullScreen()
 {
     if (!m_webView)
         return;
-    [[m_webView _wk_fullScreenWindowController] exitFullScreen];
+    [[m_webView fullScreenWindowController] exitFullScreen];
 }
     
 void WebFullScreenManagerProxy::beganEnterFullScreen(const IntRect& initialFrame, const IntRect& finalFrame)
 {
     if (m_webView)
-        [[m_webView _wk_fullScreenWindowController] beganEnterFullScreenWithInitialFrame:initialFrame finalFrame:finalFrame];
+        [[m_webView fullScreenWindowController] beganEnterFullScreenWithInitialFrame:initialFrame finalFrame:finalFrame];
 }
 
 void WebFullScreenManagerProxy::beganExitFullScreen(const IntRect& initialFrame, const IntRect& finalFrame)
 {
     if (m_webView)
-        [[m_webView _wk_fullScreenWindowController] beganExitFullScreenWithInitialFrame:initialFrame finalFrame:finalFrame];
+        [[m_webView fullScreenWindowController] beganExitFullScreenWithInitialFrame:initialFrame finalFrame:finalFrame];
 }
 
 } // namespace WebKit
diff --git a/Source/WebKit2/UIProcess/mac/WebInspectorProxyMac.mm b/Source/WebKit2/UIProcess/mac/WebInspectorProxyMac.mm
index 530a2f587..0a2b9b0c3 100644
--- a/Source/WebKit2/UIProcess/mac/WebInspectorProxyMac.mm
+++ b/Source/WebKit2/UIProcess/mac/WebInspectorProxyMac.mm
@@ -230,6 +230,7 @@ void WebInspectorProxy::platformBringToFront()
 {
     // FIXME <rdar://problem/10937688>: this will not bring a background tab in Safari to the front, only its window.
     [m_inspectorView.get().window makeKeyAndOrderFront:nil];
+    [m_inspectorView.get().window makeFirstResponder:m_inspectorView.get()];
 }
 
 bool WebInspectorProxy::platformIsFront()
diff --git a/Source/WebKit2/UIProcess/qt/PageViewportControllerClientQt.cpp b/Source/WebKit2/UIProcess/qt/PageViewportControllerClientQt.cpp
index bfb87abc3..a55fd9197 100644
--- a/Source/WebKit2/UIProcess/qt/PageViewportControllerClientQt.cpp
+++ b/Source/WebKit2/UIProcess/qt/PageViewportControllerClientQt.cpp
@@ -45,6 +45,7 @@ PageViewportControllerClientQt::PageViewportControllerClientQt(QQuickWebView* vi
     , m_pinchStartScale(-1)
     , m_lastCommittedScale(-1)
     , m_zoomOutScale(0)
+    , m_isUserInteracting(false)
     , m_ignoreViewportChanges(true)
 {
     m_scaleAnimation->setDuration(kScaleAnimationDurationMillis);
@@ -102,7 +103,7 @@ void PageViewportControllerClientQt::animateContentRectVisible(const QRectF& con
 
     QRectF viewportRectInContentCoords = m_viewportItem->mapRectToWebContent(m_viewportItem->boundingRect());
     if (contentRect == viewportRectInContentCoords) {
-        updateViewportController();
+        m_controller->resumeContent();
         return;
     }
 
@@ -120,8 +121,7 @@ void PageViewportControllerClientQt::animateContentRectVisible(const QRectF& con
 
 void PageViewportControllerClientQt::flickMoveStarted()
 {
-    Q_ASSERT(m_viewportItem->isMoving());
-    m_scrollUpdateDeferrer.reset(new ViewportUpdateDeferrer(m_controller, ViewportUpdateDeferrer::DeferUpdateAndSuspendContent));
+    m_controller->suspendContent();
 
     m_lastScrollPosition = m_viewportItem->contentPos();
 
@@ -130,12 +130,11 @@ void PageViewportControllerClientQt::flickMoveStarted()
 
 void PageViewportControllerClientQt::flickMoveEnded()
 {
-    Q_ASSERT(!m_viewportItem->isMoving());
     // This method is called on the end of the pan or pan kinetic animation.
 
     m_ignoreViewportChanges = true;
-
-    m_scrollUpdateDeferrer.reset();
+    if (!m_isUserInteracting)
+        m_controller->resumeContent();
 }
 
 void PageViewportControllerClientQt::pageItemPositionChanged()
@@ -155,11 +154,10 @@ void PageViewportControllerClientQt::scaleAnimationStateChanged(QAbstractAnimati
     switch (newState) {
     case QAbstractAnimation::Running:
         m_viewportItem->cancelFlick();
-        ASSERT(!m_animationUpdateDeferrer);
-        m_animationUpdateDeferrer.reset(new ViewportUpdateDeferrer(m_controller, ViewportUpdateDeferrer::DeferUpdateAndSuspendContent));
+        m_controller->suspendContent();
         break;
     case QAbstractAnimation::Stopped:
-        m_animationUpdateDeferrer.reset();
+        m_controller->resumeContent();
         break;
     default:
         break;
@@ -170,14 +168,13 @@ void PageViewportControllerClientQt::touchBegin()
 {
     m_controller->setHadUserInteraction(true);
 
-    // Prevents resuming the page between the user's flicks of the page while the animation is running.
-    if (scrollAnimationActive())
-        m_touchUpdateDeferrer.reset(new ViewportUpdateDeferrer(m_controller, ViewportUpdateDeferrer::DeferUpdateAndSuspendContent));
+    // Prevents resuming the page between the user's flicks of the page.
+    m_isUserInteracting = true;
 }
 
 void PageViewportControllerClientQt::touchEnd()
 {
-    m_touchUpdateDeferrer.reset();
+    m_isUserInteracting = false;
 }
 
 void PageViewportControllerClientQt::focusEditableArea(const QRectF& caretArea, const QRectF& targetArea)
@@ -326,9 +323,9 @@ void PageViewportControllerClientQt::setContentsScale(float localScale, bool tre
 
 void PageViewportControllerClientQt::setContentsRectToNearestValidBounds()
 {
-    ViewportUpdateDeferrer guard(m_controller);
     float targetScale = m_controller->innerBoundedViewportScale(m_pageItem->contentsScale());
     setContentRectVisiblePositionAtScale(nearestValidVisibleContentsRect().topLeft(), targetScale);
+    updateViewportController();
 }
 
 void PageViewportControllerClientQt::didResumeContent()
@@ -421,7 +418,7 @@ void PageViewportControllerClientQt::pinchGestureStarted(const QPointF& pinchCen
     m_scaleStack.clear();
     m_zoomOutScale = 0.0;
 
-    m_scaleUpdateDeferrer.reset(new ViewportUpdateDeferrer(m_controller, ViewportUpdateDeferrer::DeferUpdateAndSuspendContent));
+    m_controller->suspendContent();
 
     m_lastPinchCenterInViewportCoordinates = pinchCenterInViewportCoordinates;
     m_pinchStartScale = m_pageItem->contentsScale();
@@ -457,14 +454,14 @@ void PageViewportControllerClientQt::pinchGestureEnded()
 
     m_pinchStartScale = -1;
 
+    // This will take care of resuming the content, even if no animation was performed.
     animateContentRectVisible(nearestValidVisibleContentsRect());
-    m_scaleUpdateDeferrer.reset(); // Clear after starting potential animation, which takes over deferring.
 }
 
 void PageViewportControllerClientQt::pinchGestureCancelled()
 {
     m_pinchStartScale = -1;
-    m_scaleUpdateDeferrer.reset();
+    m_controller->resumeContent();
 }
 
 void PageViewportControllerClientQt::didChangeContentsSize(const IntSize& newSize)
diff --git a/Source/WebKit2/UIProcess/qt/PageViewportControllerClientQt.h b/Source/WebKit2/UIProcess/qt/PageViewportControllerClientQt.h
index 7c5ceea58..6255f9429 100644
--- a/Source/WebKit2/UIProcess/qt/PageViewportControllerClientQt.h
+++ b/Source/WebKit2/UIProcess/qt/PageViewportControllerClientQt.h
@@ -129,11 +129,6 @@ private:
     void animateContentRectVisible(const QRectF& contentRect);
     void scaleContent(qreal itemScale, const QPointF& centerInCSSCoordinates = QPointF());
 
-    QScopedPointer<ViewportUpdateDeferrer> m_scaleUpdateDeferrer;
-    QScopedPointer<ViewportUpdateDeferrer> m_scrollUpdateDeferrer;
-    QScopedPointer<ViewportUpdateDeferrer> m_touchUpdateDeferrer;
-    QScopedPointer<ViewportUpdateDeferrer> m_animationUpdateDeferrer;
-
     ScaleAnimation* m_scaleAnimation;
     QPointF m_lastPinchCenterInViewportCoordinates;
     QPointF m_lastScrollPosition;
@@ -141,6 +136,7 @@ private:
     qreal m_lastCommittedScale;
     qreal m_zoomOutScale;
     QList<ScaleStackItem> m_scaleStack;
+    bool m_isUserInteracting;
     bool m_ignoreViewportChanges;
 };
 
diff --git a/Source/WebKit2/UIProcess/qt/QtWebContext.cpp b/Source/WebKit2/UIProcess/qt/QtWebContext.cpp
index f8d384cc2..7eb3b7196 100644
--- a/Source/WebKit2/UIProcess/qt/QtWebContext.cpp
+++ b/Source/WebKit2/UIProcess/qt/QtWebContext.cpp
@@ -35,15 +35,10 @@
 
 namespace WebKit {
 
-static uint64_t generateContextID()
-{
-    static uint64_t uniqueContextID = 1;
-    return uniqueContextID++;
-}
-
-static HashMap<uint64_t, QtWebContext*> contextMap;
-
-QtWebContext* QtWebContext::s_defaultContext = 0;
+static WebContext* s_defaultWebContext = 0;
+static QtWebContext* s_defaultQtWebContext = 0;
+static OwnPtr<QtDownloadManager> s_downloadManager;
+static OwnPtr<QtWebIconDatabaseClient> s_iconDatabase;
 
 static void initInspectorServer()
 {
@@ -87,44 +82,86 @@ static void globalInitialization()
     initialized = true;
 }
 
+static void didReceiveMessageFromInjectedBundle(WKContextRef, WKStringRef messageName, WKTypeRef messageBody, const void*)
+{
+    if (!WKStringIsEqualToUTF8CString(messageName, "MessageFromNavigatorQtObject"))
+        return;
+
+    ASSERT(messageBody);
+    ASSERT(WKGetTypeID(messageBody) == WKArrayGetTypeID());
+
+    WKArrayRef body = static_cast<WKArrayRef>(messageBody);
+    ASSERT(WKArrayGetSize(body) == 2);
+    ASSERT(WKGetTypeID(WKArrayGetItemAtIndex(body, 0)) == WKPageGetTypeID());
+    ASSERT(WKGetTypeID(WKArrayGetItemAtIndex(body, 1)) == WKStringGetTypeID());
+
+    WKPageRef page = static_cast<WKPageRef>(WKArrayGetItemAtIndex(body, 0));
+    WKStringRef str = static_cast<WKStringRef>(WKArrayGetItemAtIndex(body, 1));
+
+    toImpl(page)->didReceiveMessageFromNavigatorQtObject(toImpl(str)->string());
+}
+
+static void initializeContextInjectedBundleClient(WebContext* context)
+{
+    WKContextInjectedBundleClient injectedBundleClient;
+    memset(&injectedBundleClient, 0, sizeof(WKContextInjectedBundleClient));
+    injectedBundleClient.version = kWKContextInjectedBundleClientCurrentVersion;
+    injectedBundleClient.didReceiveMessageFromInjectedBundle = didReceiveMessageFromInjectedBundle;
+    WKContextSetInjectedBundleClient(toAPI(context), &injectedBundleClient);
+}
+
 QtWebContext::QtWebContext(WebContext* context)
-    : m_contextID(generateContextID())
-    , m_context(context)
-    , m_downloadManager(adoptPtr(new QtDownloadManager(context)))
-    , m_iconDatabase(adoptPtr(new QtWebIconDatabaseClient(this)))
+    : m_context(context)
 {
-    contextMap.set(m_contextID, this);
 }
 
 QtWebContext::~QtWebContext()
 {
-    if (s_defaultContext == this)
-        s_defaultContext = 0;
-    contextMap.remove(m_contextID);
+    ASSERT(!s_defaultQtWebContext || s_defaultQtWebContext == this);
+    s_defaultQtWebContext = 0;
 }
 
-// Used only by WebKitTestRunner. It avoids calling initialize(), so that we don't register any clients.
+// Used directly only by WebKitTestRunner.
 PassRefPtr<QtWebContext> QtWebContext::create(WebContext* context)
 {
     globalInitialization();
+    // The lifetime of WebContext is a bit special, it is bound to the reference held
+    // by QtWebContext at first and then enters a circular dependency with WebProcessProxy
+    // once the first page is created until the web process exits. Because of this we can't
+    // assume that destroying the last QtWebContext will destroy the WebContext and we
+    // have to make sure that WebContext's clients follow its lifetime and aren't attached
+    // to QtWebContext. QtWebContext itself is only attached to QQuickWebView.
+    // Since we only support one WebContext at a time, initialize those clients globally
+    // here. They have to be available to views spawned by WebKitTestRunner as well.
+    if (!s_downloadManager)
+        s_downloadManager = adoptPtr(new QtDownloadManager(context));
+    if (!s_iconDatabase)
+        s_iconDatabase = adoptPtr(new QtWebIconDatabaseClient(context));
     return adoptRef(new QtWebContext(context));
 }
 
 PassRefPtr<QtWebContext> QtWebContext::defaultContext()
 {
-    if (s_defaultContext)
-        return PassRefPtr<QtWebContext>(s_defaultContext);
-
-    RefPtr<WebContext> context = WebContext::create(String());
-    // A good all-around default.
-    context->setCacheModel(CacheModelDocumentBrowser);
+    // Keep local references until we can return a ref to QtWebContext holding the WebContext.
+    RefPtr<WebContext> webContext(s_defaultWebContext);
+    RefPtr<QtWebContext> qtWebContext(s_defaultQtWebContext);
+
+    if (!webContext) {
+        webContext = WebContext::create(String());
+        s_defaultWebContext = webContext.get();
+        // Make sure for WebKitTestRunner that the injected bundle client isn't initialized
+        // and that the page cache isn't enabled (defaultContext isn't used there).
+        initializeContextInjectedBundleClient(webContext.get());
+        // A good all-around default.
+        webContext->setCacheModel(CacheModelDocumentBrowser);
+    }
 
-    RefPtr<QtWebContext> defaultContext = QtWebContext::create(context.get());
-    s_defaultContext = defaultContext.get();
-    // Make sure that this doesn't get called in WebKitTestRunner (defaultContext isn't used there).
-    defaultContext->initializeContextInjectedBundleClient();
+    if (!qtWebContext) {
+        qtWebContext = QtWebContext::create(webContext.get());
+        s_defaultQtWebContext = qtWebContext.get();
+    }
 
-    return defaultContext.release();
+    return qtWebContext.release();
 }
 
 PassRefPtr<WebPageProxy> QtWebContext::createWebPage(PageClient* client, WebPageGroup* pageGroup)
@@ -152,49 +189,26 @@ void QtWebContext::postMessageToNavigatorQtObject(WebPageProxy* webPageProxy, co
     m_context->postMessageToInjectedBundle(messageName, body.get());
 }
 
-QtWebContext* QtWebContext::contextByID(uint64_t id)
-{
-    return contextMap.get(id);
-}
-
-void QtWebContext::initializeContextInjectedBundleClient()
-{
-    WKContextInjectedBundleClient injectedBundleClient;
-    memset(&injectedBundleClient, 0, sizeof(WKContextInjectedBundleClient));
-    injectedBundleClient.version = kWKContextInjectedBundleClientCurrentVersion;
-    injectedBundleClient.clientInfo = this;
-    injectedBundleClient.didReceiveMessageFromInjectedBundle = didReceiveMessageFromInjectedBundle;
-    WKContextSetInjectedBundleClient(toAPI(m_context.get()), &injectedBundleClient);
-}
-
-static QtWebContext* toQtWebContext(const void* clientInfo)
+QtDownloadManager* QtWebContext::downloadManager()
 {
-    ASSERT(clientInfo);
-    return reinterpret_cast<QtWebContext*>(const_cast<void*>(clientInfo));
+    ASSERT(s_downloadManager);
+    return s_downloadManager.get();
 }
 
-void QtWebContext::didReceiveMessageFromInjectedBundle(WKContextRef, WKStringRef messageName, WKTypeRef messageBody, const void* clientInfo)
+QtWebIconDatabaseClient* QtWebContext::iconDatabase()
 {
-    toQtWebContext(clientInfo)->didReceiveMessageFromInjectedBundle(messageName, messageBody);
+    ASSERT(s_iconDatabase);
+    return s_iconDatabase.get();
 }
 
-void QtWebContext::didReceiveMessageFromInjectedBundle(WKStringRef messageName, WKTypeRef messageBody)
+void QtWebContext::invalidateContext(WebContext* context)
 {
-    if (!WKStringIsEqualToUTF8CString(messageName, "MessageFromNavigatorQtObject"))
-        return;
-
-    ASSERT(messageBody);
-    ASSERT(WKGetTypeID(messageBody) == WKArrayGetTypeID());
-
-    WKArrayRef body = static_cast<WKArrayRef>(messageBody);
-    ASSERT(WKArrayGetSize(body) == 2);
-    ASSERT(WKGetTypeID(WKArrayGetItemAtIndex(body, 0)) == WKPageGetTypeID());
-    ASSERT(WKGetTypeID(WKArrayGetItemAtIndex(body, 1)) == WKStringGetTypeID());
-
-    WKPageRef page = static_cast<WKPageRef>(WKArrayGetItemAtIndex(body, 0));
-    WKStringRef str = static_cast<WKStringRef>(WKArrayGetItemAtIndex(body, 1));
-
-    toImpl(page)->didReceiveMessageFromNavigatorQtObject(toImpl(str)->string());
+    UNUSED_PARAM(context);
+    ASSERT(!s_defaultQtWebContext);
+    ASSERT(!s_defaultWebContext || s_defaultWebContext == context);
+    s_downloadManager.clear();
+    s_iconDatabase.clear();
+    s_defaultWebContext = 0;
 }
 
 } // namespace WebKit
diff --git a/Source/WebKit2/UIProcess/qt/QtWebContext.h b/Source/WebKit2/UIProcess/qt/QtWebContext.h
index a1e12ff0f..2fa39f8c0 100644
--- a/Source/WebKit2/UIProcess/qt/QtWebContext.h
+++ b/Source/WebKit2/UIProcess/qt/QtWebContext.h
@@ -51,30 +51,18 @@ public:
     PassRefPtr<WebPageProxy> createWebPage(PageClient*, WebPageGroup*);
 
     WebContext* context() { return m_context.get(); }
-    QtDownloadManager* downloadManager() { return m_downloadManager.get(); }
-    QtWebIconDatabaseClient* iconDatabase() { return m_iconDatabase.get(); }
 
     void setNavigatorQtObjectEnabled(WebPageProxy*, bool);
     void postMessageToNavigatorQtObject(WebPageProxy*, const QString&);
 
-    uint64_t contextID() const { return m_contextID; }
-
-    static QtWebContext* contextByID(uint64_t id);
+    static QtDownloadManager* downloadManager();
+    static QtWebIconDatabaseClient* iconDatabase();
+    static void invalidateContext(WebContext*);
 
 private:
     explicit QtWebContext(WebContext*);
 
-    void initializeContextInjectedBundleClient();
-
-    static void didReceiveMessageFromInjectedBundle(WKContextRef, WKStringRef messageName, WKTypeRef messageBody, const void*);
-    void didReceiveMessageFromInjectedBundle(WKStringRef messageName, WKTypeRef messageBody);
-
-    static QtWebContext* s_defaultContext;
-
-    uint64_t m_contextID;
     RefPtr<WebContext> m_context;
-    OwnPtr<QtDownloadManager> m_downloadManager;
-    OwnPtr<QtWebIconDatabaseClient> m_iconDatabase;
 };
 
 } // namespace WebKit
diff --git a/Source/WebKit2/UIProcess/qt/QtWebIconDatabaseClient.cpp b/Source/WebKit2/UIProcess/qt/QtWebIconDatabaseClient.cpp
index 592bb371c..7dbb273fd 100644
--- a/Source/WebKit2/UIProcess/qt/QtWebIconDatabaseClient.cpp
+++ b/Source/WebKit2/UIProcess/qt/QtWebIconDatabaseClient.cpp
@@ -22,7 +22,6 @@
 
 #include "Image.h"
 #include "KURL.h"
-#include "QtWebContext.h"
 #include "SharedBuffer.h"
 #include "WKURLQt.h"
 #include "WebContext.h"
@@ -40,11 +39,9 @@ static inline QtWebIconDatabaseClient* toQtWebIconDatabaseClient(const void* cli
     return reinterpret_cast<QtWebIconDatabaseClient*>(const_cast<void*>(clientInfo));
 }
 
-QtWebIconDatabaseClient::QtWebIconDatabaseClient(QtWebContext *qtWebContext)
+QtWebIconDatabaseClient::QtWebIconDatabaseClient(WebContext *context)
 {
-    m_contextId = qtWebContext->contextID();
     // The setter calls the getter here as it triggers the startup of the icon database.
-    WebContext* context = qtWebContext->context();
     if (!context->iconDatabase()->isOpen())
         context->setIconDatabasePath(context->iconDatabasePath());
     m_iconDatabase = context->iconDatabase();
@@ -59,6 +56,7 @@ QtWebIconDatabaseClient::QtWebIconDatabaseClient(QtWebContext *qtWebContext)
 
 QtWebIconDatabaseClient::~QtWebIconDatabaseClient()
 {
+    m_iconDatabase->close();
     WKIconDatabaseSetIconDatabaseClient(toAPI(m_iconDatabase.get()), 0);
 }
 
diff --git a/Source/WebKit2/UIProcess/qt/QtWebIconDatabaseClient.h b/Source/WebKit2/UIProcess/qt/QtWebIconDatabaseClient.h
index 65e86e18c..97197d8d6 100644
--- a/Source/WebKit2/UIProcess/qt/QtWebIconDatabaseClient.h
+++ b/Source/WebKit2/UIProcess/qt/QtWebIconDatabaseClient.h
@@ -39,14 +39,14 @@ class String;
 
 namespace WebKit {
 
-class QtWebContext;
+class WebContext;
 class WebIconDatabase;
 
 class QtWebIconDatabaseClient : public QObject {
     Q_OBJECT
 
 public:
-    QtWebIconDatabaseClient(QtWebContext*);
+    QtWebIconDatabaseClient(WebContext*);
     ~QtWebIconDatabaseClient();
 
     WTF::String iconForPageURL(const WTF::String& pageURL);
@@ -60,7 +60,6 @@ public:
 
 private:
     static void didChangeIconForPageURL(WKIconDatabaseRef, WKURLRef pageURL, const void* clientInfo);
-    uint64_t m_contextId;
     RefPtr<WebKit::WebIconDatabase> m_iconDatabase;
     Mutex m_imageLock;
 };
diff --git a/Source/WebKit2/UIProcess/qt/QtWebPageEventHandler.cpp b/Source/WebKit2/UIProcess/qt/QtWebPageEventHandler.cpp
index fdc92355f..88dae15b8 100644
--- a/Source/WebKit2/UIProcess/qt/QtWebPageEventHandler.cpp
+++ b/Source/WebKit2/UIProcess/qt/QtWebPageEventHandler.cpp
@@ -500,6 +500,7 @@ void QtWebPageEventHandler::handleInputEvent(const QInputEvent* event)
         m_isMouseButtonPressed = false;
         break;
     case QEvent::MouseButtonDblClick:
+        ASSERT_NOT_REACHED();
         return;
     default:
         break;
diff --git a/Source/WebKit2/UIProcess/qt/WebContextQt.cpp b/Source/WebKit2/UIProcess/qt/WebContextQt.cpp
index 45329db44..157e67a7d 100644
--- a/Source/WebKit2/UIProcess/qt/WebContextQt.cpp
+++ b/Source/WebKit2/UIProcess/qt/WebContextQt.cpp
@@ -30,6 +30,7 @@
 #include "ApplicationCacheStorage.h"
 #include "FileSystem.h"
 #include "QtDefaultDataLocation.h"
+#include "QtWebContext.h"
 #include "WKSharedAPICast.h"
 #if ENABLE(GEOLOCATION)
 #include "WebGeolocationProviderQt.h"
@@ -78,6 +79,7 @@ void WebContext::platformInitializeWebProcess(WebProcessCreationParameters& para
 
 void WebContext::platformInvalidateContext()
 {
+    QtWebContext::invalidateContext(this);
 }
 
 String WebContext::platformDefaultDatabaseDirectory() const
diff --git a/Source/WebKit2/UIProcess/qt/WebPageProxyQt.cpp b/Source/WebKit2/UIProcess/qt/WebPageProxyQt.cpp
index e5a7829c0..46429461f 100644
--- a/Source/WebKit2/UIProcess/qt/WebPageProxyQt.cpp
+++ b/Source/WebKit2/UIProcess/qt/WebPageProxyQt.cpp
@@ -85,11 +85,6 @@ void WebPageProxy::cancelComposition()
     process()->send(Messages::WebPage::CancelComposition(), m_pageID);
 }
 
-void WebPageProxy::didRenderFrame(const WebCore::IntSize& contentsSize, const WebCore::IntRect& coveredRect)
-{
-    m_pageClient->didRenderFrame(contentsSize, coveredRect);
-}
-
 void WebPageProxy::registerApplicationScheme(const String& scheme)
 {
     process()->send(Messages::WebPage::RegisterApplicationScheme(scheme), m_pageID);
@@ -121,11 +116,6 @@ void WebPageProxy::setUserScripts(const Vector<String>& scripts)
     process()->send(Messages::WebPage::SetUserScripts(scripts), m_pageID);
 }
 
-void WebPageProxy::pageTransitionViewportReady()
-{
-    m_pageClient->pageTransitionViewportReady();
-}
-
 void WebPageProxy::didFindZoomableArea(const IntPoint& target, const IntRect& area)
 {
     m_pageClient->didFindZoomableArea(target, area);
diff --git a/Source/WebKit2/UIProcess/win/WebContextWin.cpp b/Source/WebKit2/UIProcess/win/WebContextWin.cpp
index 9dd056820..0d2e9542e 100644
--- a/Source/WebKit2/UIProcess/win/WebContextWin.cpp
+++ b/Source/WebKit2/UIProcess/win/WebContextWin.cpp
@@ -68,10 +68,8 @@ void WebContext::platformInitializeWebProcess(WebProcessCreationParameters& para
     if (parameters.diskCacheDirectory.endsWith(UChar('\\')))
         parameters.diskCacheDirectory.remove(parameters.diskCacheDirectory.length() - 1);
 
-#if USE(CFURLSTORAGESESSIONS)
     parameters.uiProcessBundleIdentifier = String(reinterpret_cast<CFStringRef>(CFBundleGetValueForInfoDictionaryKey(CFBundleGetMainBundle(), kCFBundleIdentifierKey)));
     parameters.serializedDefaultStorageSession.adoptCF(wkCopySerializedDefaultStorageSession());
-#endif // USE(CFURLSTORAGESESSIONS)
 
     parameters.initialHTTPCookieAcceptPolicy = m_initialHTTPCookieAcceptPolicy;
 
diff --git a/Source/WebKit2/WebKit2.xcodeproj/project.pbxproj b/Source/WebKit2/WebKit2.xcodeproj/project.pbxproj
index 9b5ac7bcc..7bca663ed 100644
--- a/Source/WebKit2/WebKit2.xcodeproj/project.pbxproj
+++ b/Source/WebKit2/WebKit2.xcodeproj/project.pbxproj
@@ -216,6 +216,10 @@
 		1AAF0C4B12B16334008E49E2 /* ArgumentCodersCF.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1AAF0C4912B16334008E49E2 /* ArgumentCodersCF.cpp */; };
 		1AAF263814687C39004A1E8A /* TiledCoreAnimationDrawingArea.mm in Sources */ = {isa = PBXBuildFile; fileRef = 1AAF263614687C39004A1E8A /* TiledCoreAnimationDrawingArea.mm */; };
 		1AAF263914687C39004A1E8A /* TiledCoreAnimationDrawingArea.h in Headers */ = {isa = PBXBuildFile; fileRef = 1AAF263714687C39004A1E8A /* TiledCoreAnimationDrawingArea.h */; };
+		1AB16ADD1648598400290D62 /* RemoteLayerTreeDrawingArea.mm in Sources */ = {isa = PBXBuildFile; fileRef = 1AB16ADB1648598400290D62 /* RemoteLayerTreeDrawingArea.mm */; };
+		1AB16ADE1648598400290D62 /* RemoteLayerTreeDrawingArea.h in Headers */ = {isa = PBXBuildFile; fileRef = 1AB16ADC1648598400290D62 /* RemoteLayerTreeDrawingArea.h */; };
+		1AB16AE11648656D00290D62 /* RemoteLayerTreeDrawingAreaProxy.mm in Sources */ = {isa = PBXBuildFile; fileRef = 1AB16ADF1648656D00290D62 /* RemoteLayerTreeDrawingAreaProxy.mm */; };
+		1AB16AE21648656D00290D62 /* RemoteLayerTreeDrawingAreaProxy.h in Headers */ = {isa = PBXBuildFile; fileRef = 1AB16AE01648656D00290D62 /* RemoteLayerTreeDrawingAreaProxy.h */; };
 		1AB7D4CA1288AAA700CFD08C /* DownloadProxy.h in Headers */ = {isa = PBXBuildFile; fileRef = 1AB7D4C81288AAA700CFD08C /* DownloadProxy.h */; };
 		1AB7D4CB1288AAA700CFD08C /* DownloadProxy.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1AB7D4C91288AAA700CFD08C /* DownloadProxy.cpp */; };
 		1AB7D6191288B9D900CFD08C /* DownloadProxyMessageReceiver.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1AB7D6171288B9D900CFD08C /* DownloadProxyMessageReceiver.cpp */; };
@@ -269,6 +273,9 @@
 		29CD55AB128E294F00133C85 /* WKAccessibilityWebPageObject.mm in Sources */ = {isa = PBXBuildFile; fileRef = 29CD55A9128E294F00133C85 /* WKAccessibilityWebPageObject.mm */; };
 		29D55DF1161BF9F10031A2E3 /* WebPageGroupProxyMessageReceiver.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 29D55DEF161BF9F10031A2E3 /* WebPageGroupProxyMessageReceiver.cpp */; };
 		29D55DF2161BF9F10031A2E3 /* WebPageGroupProxyMessages.h in Headers */ = {isa = PBXBuildFile; fileRef = 29D55DF0161BF9F10031A2E3 /* WebPageGroupProxyMessages.h */; };
+		2D2ADF0916362DD500197E47 /* PDFPluginTextAnnotation.mm in Sources */ = {isa = PBXBuildFile; fileRef = 2D2ADF0616362DC700197E47 /* PDFPluginTextAnnotation.mm */; };
+		2D2ADF0B16362DDB00197E47 /* PDFPluginAnnotation.mm in Sources */ = {isa = PBXBuildFile; fileRef = 2D2ADF031636243500197E47 /* PDFPluginAnnotation.mm */; };
+		2D2ADF1016364D8200197E47 /* PDFPluginChoiceAnnotation.mm in Sources */ = {isa = PBXBuildFile; fileRef = 2D2ADF0E16364D8200197E47 /* PDFPluginChoiceAnnotation.mm */; };
 		2D870D1016234FFE000A3F20 /* PDFPlugin.mm in Sources */ = {isa = PBXBuildFile; fileRef = 2D870D0E1622B7F9000A3F20 /* PDFPlugin.mm */; };
 		31099973146C75A20029DEB9 /* WebNotificationClient.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 31099971146C759B0029DEB9 /* WebNotificationClient.cpp */; };
 		310999C7146C9E3D0029DEB9 /* WebNotificationClient.h in Headers */ = {isa = PBXBuildFile; fileRef = 31099968146C71F50029DEB9 /* WebNotificationClient.h */; };
@@ -372,6 +379,9 @@
 		512935D81288D19400A4B695 /* WebContextMenuItem.h in Headers */ = {isa = PBXBuildFile; fileRef = 512935D61288D19400A4B695 /* WebContextMenuItem.h */; };
 		512935E31288D97800A4B695 /* InjectedBundlePageContextMenuClient.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 512935E11288D97800A4B695 /* InjectedBundlePageContextMenuClient.cpp */; };
 		512935E41288D97800A4B695 /* InjectedBundlePageContextMenuClient.h in Headers */ = {isa = PBXBuildFile; fileRef = 512935E21288D97800A4B695 /* InjectedBundlePageContextMenuClient.h */; };
+		512C06881638F67E00ABB911 /* HostRecord.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 512C06861638F67E00ABB911 /* HostRecord.cpp */; };
+		512C06891638F67E00ABB911 /* HostRecord.h in Headers */ = {isa = PBXBuildFile; fileRef = 512C06871638F67E00ABB911 /* HostRecord.h */; };
+		512C069016390E6900ABB911 /* NetworkResourceLoadSchedulerMac.mm in Sources */ = {isa = PBXBuildFile; fileRef = 512C068F16390E6900ABB911 /* NetworkResourceLoadSchedulerMac.mm */; };
 		512DF6D8138C181A00A22FC6 /* KeychainItemShimMethods.h in Headers */ = {isa = PBXBuildFile; fileRef = 512DF6D6138C181A00A22FC6 /* KeychainItemShimMethods.h */; };
 		512DF6D9138C181A00A22FC6 /* KeychainItemShimMethods.mm in Sources */ = {isa = PBXBuildFile; fileRef = 512DF6D7138C181A00A22FC6 /* KeychainItemShimMethods.mm */; };
 		512DF6FE138C254600A22FC6 /* SecKeychainItemRequestData.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 5112CA4713858D4B0030867D /* SecKeychainItemRequestData.cpp */; };
@@ -433,6 +443,12 @@
 		5179556E162877B300FA43B6 /* NetworkProcessProxy.h in Headers */ = {isa = PBXBuildFile; fileRef = 510CC7EB16138E7200D03ED3 /* NetworkProcessProxy.h */; };
 		51795570162877CF00FA43B6 /* NetworkProcessCreationParameters.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 51A8A6121627F325000D90E9 /* NetworkProcessCreationParameters.cpp */; };
 		51795571162877D200FA43B6 /* NetworkProcessCreationParameters.h in Headers */ = {isa = PBXBuildFile; fileRef = 51A8A60F1627F2BD000D90E9 /* NetworkProcessCreationParameters.h */; };
+		517CF0DF163A444C00C2950E /* NetworkRequest.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 517CF0DD163A444C00C2950E /* NetworkRequest.cpp */; };
+		517CF0E0163A444C00C2950E /* NetworkRequest.h in Headers */ = {isa = PBXBuildFile; fileRef = 517CF0DE163A444C00C2950E /* NetworkRequest.h */; };
+		517CF0E3163A486C00C2950E /* NetworkProcessConnectionMessageReceiver.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 517CF0E1163A486C00C2950E /* NetworkProcessConnectionMessageReceiver.cpp */; };
+		517CF0E4163A486C00C2950E /* NetworkProcessConnectionMessages.h in Headers */ = {isa = PBXBuildFile; fileRef = 517CF0E2163A486C00C2950E /* NetworkProcessConnectionMessages.h */; };
+		51829DA51637C70C000953D6 /* NetworkResourceLoadScheduler.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 51829DA31637C70C000953D6 /* NetworkResourceLoadScheduler.cpp */; };
+		51829DA61637C70C000953D6 /* NetworkResourceLoadScheduler.h in Headers */ = {isa = PBXBuildFile; fileRef = 51829DA41637C70C000953D6 /* NetworkResourceLoadScheduler.h */; };
 		51834592134532E90092B696 /* WebIconDatabaseClient.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 51834590134532E80092B696 /* WebIconDatabaseClient.cpp */; };
 		51834593134532E90092B696 /* WebIconDatabaseClient.h in Headers */ = {isa = PBXBuildFile; fileRef = 51834591134532E80092B696 /* WebIconDatabaseClient.h */; };
 		5183B3921379F7B800E8754E /* WebProcessShim.dylib in Copy Web Process Shim */ = {isa = PBXBuildFile; fileRef = 510031F61379CACB00C8DFE4 /* WebProcessShim.dylib */; };
@@ -479,9 +495,12 @@
 		51D130551382EAC000351EDD /* SecItemResponseData.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 51D130511382EAC000351EDD /* SecItemResponseData.cpp */; };
 		51D130561382EAC000351EDD /* SecItemResponseData.h in Headers */ = {isa = PBXBuildFile; fileRef = 51D130521382EAC000351EDD /* SecItemResponseData.h */; };
 		51D130581382F10500351EDD /* WebProcessProxyMac.mm in Sources */ = {isa = PBXBuildFile; fileRef = 51D130571382F10500351EDD /* WebProcessProxyMac.mm */; };
+		51DD9F2816367DA2001578E9 /* NetworkConnectionToWebProcessMessageReceiver.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 51DD9F2616367DA2001578E9 /* NetworkConnectionToWebProcessMessageReceiver.cpp */; };
+		51DD9F2916367DA2001578E9 /* NetworkConnectionToWebProcessMessages.h in Headers */ = {isa = PBXBuildFile; fileRef = 51DD9F2716367DA2001578E9 /* NetworkConnectionToWebProcessMessages.h */; };
 		51EFC1CF1524E62500C9A938 /* WKBundleDOMWindowExtension.h in Headers */ = {isa = PBXBuildFile; fileRef = 51FA2D541521118600C1BA0B /* WKBundleDOMWindowExtension.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		51FA2D7415212DF100C1BA0B /* InjectedBundleDOMWindowExtension.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 51FA2D5C15211A5000C1BA0B /* InjectedBundleDOMWindowExtension.cpp */; };
 		51FA2D7715212E2600C1BA0B /* WKBundleDOMWindowExtension.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 51FA2D7515212E1E00C1BA0B /* WKBundleDOMWindowExtension.cpp */; };
+		51FB08FF1639DE1A00EC324A /* WebResourceLoadScheduler.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 51ABF65616392F1500132A7A /* WebResourceLoadScheduler.cpp */; };
 		5272B28A1406985D0096A5D0 /* StatisticsData.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 5272B2881406985D0096A5D0 /* StatisticsData.cpp */; };
 		5272B28B1406985D0096A5D0 /* StatisticsData.h in Headers */ = {isa = PBXBuildFile; fileRef = 5272B2891406985D0096A5D0 /* StatisticsData.h */; };
 		5D1A239115E75B220023E981 /* webkit2 in Copy Message Generation Scripts */ = {isa = PBXBuildFile; fileRef = 5D1A238E15E75AD50023E981 /* webkit2 */; };
@@ -516,6 +535,11 @@
 		93FC67BE12D3CCF200A60610 /* DecoderAdapter.h in Headers */ = {isa = PBXBuildFile; fileRef = 93FC679E12D3CC7400A60610 /* DecoderAdapter.h */; };
 		93FC67BF12D3CCF200A60610 /* EncoderAdapter.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 93FC679F12D3CC7400A60610 /* EncoderAdapter.cpp */; };
 		93FC67C012D3CCF200A60610 /* EncoderAdapter.h in Headers */ = {isa = PBXBuildFile; fileRef = 93FC67A012D3CC7400A60610 /* EncoderAdapter.h */; };
+		9F4F59421648B40700493B7E /* SharedWorkerProcessManagerMac.mm in Sources */ = {isa = PBXBuildFile; fileRef = 9F4F59411648B40700493B7E /* SharedWorkerProcessManagerMac.mm */; };
+		9F4F59441648B67F00493B7E /* SharedWorkerProcessProxyMac.mm in Sources */ = {isa = PBXBuildFile; fileRef = 9F4F59431648B67F00493B7E /* SharedWorkerProcessProxyMac.mm */; };
+		9F4F59461648BA8E00493B7E /* NetworkProcessManagerMac.mm in Sources */ = {isa = PBXBuildFile; fileRef = 9F4F59451648BA8E00493B7E /* NetworkProcessManagerMac.mm */; };
+		9F54F88F16488E87007DF81A /* ChildProcessMac.mm in Sources */ = {isa = PBXBuildFile; fileRef = 9F54F88E16488E87007DF81A /* ChildProcessMac.mm */; };
+		9F54F8951648AE0F007DF81A /* PluginProcessManagerMac.mm in Sources */ = {isa = PBXBuildFile; fileRef = 9F54F8941648AE0E007DF81A /* PluginProcessManagerMac.mm */; };
 		B62E7310143047A60069EC35 /* WKHitTestResult.cpp in Sources */ = {isa = PBXBuildFile; fileRef = B62E730F143047A60069EC35 /* WKHitTestResult.cpp */; };
 		B62E7312143047B00069EC35 /* WKHitTestResult.h in Headers */ = {isa = PBXBuildFile; fileRef = B62E7311143047B00069EC35 /* WKHitTestResult.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		B63403F914910D57001070B5 /* APIObject.cpp in Sources */ = {isa = PBXBuildFile; fileRef = B63403F814910D57001070B5 /* APIObject.cpp */; };
@@ -978,6 +1002,8 @@
 		E1A31735134CEA80007C9A4F /* AttributedString.mm in Sources */ = {isa = PBXBuildFile; fileRef = E1A31734134CEA80007C9A4F /* AttributedString.mm */; };
 		E1AEA22F14687BDB00804569 /* WKFullKeyboardAccessWatcher.h in Headers */ = {isa = PBXBuildFile; fileRef = E1AEA22D14687BDB00804569 /* WKFullKeyboardAccessWatcher.h */; };
 		E1AEA23014687BDB00804569 /* WKFullKeyboardAccessWatcher.mm in Sources */ = {isa = PBXBuildFile; fileRef = E1AEA22E14687BDB00804569 /* WKFullKeyboardAccessWatcher.mm */; };
+		E1B78471163F24690007B692 /* RemoteNetworkingContext.h in Headers */ = {isa = PBXBuildFile; fileRef = E1B78470163F24690007B692 /* RemoteNetworkingContext.h */; };
+		E1B78473163F253E0007B692 /* RemoteNetworkingContext.mm in Sources */ = {isa = PBXBuildFile; fileRef = E1B78472163F253E0007B692 /* RemoteNetworkingContext.mm */; };
 		E1CC1B9012D7EADF00625838 /* PrintInfo.h in Headers */ = {isa = PBXBuildFile; fileRef = E1CC1B8E12D7EADF00625838 /* PrintInfo.h */; };
 		E1CC1B9112D7EADF00625838 /* PrintInfoMac.mm in Sources */ = {isa = PBXBuildFile; fileRef = E1CC1B8F12D7EADF00625838 /* PrintInfoMac.mm */; };
 		E1EDFDA61628868E0039ECDA /* MainMacProcess.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1A6FA31011E3921E00DB1371 /* MainMacProcess.cpp */; };
@@ -1366,6 +1392,10 @@
 		1AAF0C4912B16334008E49E2 /* ArgumentCodersCF.cpp */ = {isa = PBXFileReference; explicitFileType = sourcecode.cpp.objcpp; fileEncoding = 4; path = ArgumentCodersCF.cpp; sourceTree = "<group>"; };
 		1AAF263614687C39004A1E8A /* TiledCoreAnimationDrawingArea.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = TiledCoreAnimationDrawingArea.mm; sourceTree = "<group>"; };
 		1AAF263714687C39004A1E8A /* TiledCoreAnimationDrawingArea.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = TiledCoreAnimationDrawingArea.h; sourceTree = "<group>"; };
+		1AB16ADB1648598400290D62 /* RemoteLayerTreeDrawingArea.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = RemoteLayerTreeDrawingArea.mm; sourceTree = "<group>"; };
+		1AB16ADC1648598400290D62 /* RemoteLayerTreeDrawingArea.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = RemoteLayerTreeDrawingArea.h; sourceTree = "<group>"; };
+		1AB16ADF1648656D00290D62 /* RemoteLayerTreeDrawingAreaProxy.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = RemoteLayerTreeDrawingAreaProxy.mm; sourceTree = "<group>"; };
+		1AB16AE01648656D00290D62 /* RemoteLayerTreeDrawingAreaProxy.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = RemoteLayerTreeDrawingAreaProxy.h; sourceTree = "<group>"; };
 		1AB7D4C81288AAA700CFD08C /* DownloadProxy.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DownloadProxy.h; sourceTree = "<group>"; };
 		1AB7D4C91288AAA700CFD08C /* DownloadProxy.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = DownloadProxy.cpp; sourceTree = "<group>"; };
 		1AB7D5E91288B8C000CFD08C /* DownloadProxy.messages.in */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = DownloadProxy.messages.in; sourceTree = "<group>"; };
@@ -1425,6 +1455,13 @@
 		29D55DEE161BF8780031A2E3 /* WebPageGroupProxy.messages.in */ = {isa = PBXFileReference; lastKnownFileType = text; path = WebPageGroupProxy.messages.in; sourceTree = "<group>"; };
 		29D55DEF161BF9F10031A2E3 /* WebPageGroupProxyMessageReceiver.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WebPageGroupProxyMessageReceiver.cpp; sourceTree = "<group>"; };
 		29D55DF0161BF9F10031A2E3 /* WebPageGroupProxyMessages.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebPageGroupProxyMessages.h; sourceTree = "<group>"; };
+		2D2ADF021636243500197E47 /* PDFPluginAnnotation.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = PDFPluginAnnotation.h; path = PDF/PDFPluginAnnotation.h; sourceTree = "<group>"; };
+		2D2ADF031636243500197E47 /* PDFPluginAnnotation.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; name = PDFPluginAnnotation.mm; path = PDF/PDFPluginAnnotation.mm; sourceTree = "<group>"; };
+		2D2ADF0516362DC700197E47 /* PDFPluginTextAnnotation.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = PDFPluginTextAnnotation.h; path = PDF/PDFPluginTextAnnotation.h; sourceTree = "<group>"; };
+		2D2ADF0616362DC700197E47 /* PDFPluginTextAnnotation.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; name = PDFPluginTextAnnotation.mm; path = PDF/PDFPluginTextAnnotation.mm; sourceTree = "<group>"; };
+		2D2ADF0C16363DEC00197E47 /* PDFLayerControllerDetails.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; name = PDFLayerControllerDetails.h; path = PDF/PDFLayerControllerDetails.h; sourceTree = "<group>"; };
+		2D2ADF0D16364D8200197E47 /* PDFPluginChoiceAnnotation.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = PDFPluginChoiceAnnotation.h; path = PDF/PDFPluginChoiceAnnotation.h; sourceTree = "<group>"; };
+		2D2ADF0E16364D8200197E47 /* PDFPluginChoiceAnnotation.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; name = PDFPluginChoiceAnnotation.mm; path = PDF/PDFPluginChoiceAnnotation.mm; sourceTree = "<group>"; };
 		2D870D0D1622B7F9000A3F20 /* PDFPlugin.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = PDFPlugin.h; path = PDF/PDFPlugin.h; sourceTree = "<group>"; };
 		2D870D0E1622B7F9000A3F20 /* PDFPlugin.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; name = PDFPlugin.mm; path = PDF/PDFPlugin.mm; sourceTree = "<group>"; };
 		31099968146C71F50029DEB9 /* WebNotificationClient.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; path = WebNotificationClient.h; sourceTree = "<group>"; };
@@ -1554,6 +1591,9 @@
 		512935D61288D19400A4B695 /* WebContextMenuItem.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebContextMenuItem.h; sourceTree = "<group>"; };
 		512935E11288D97800A4B695 /* InjectedBundlePageContextMenuClient.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = InjectedBundlePageContextMenuClient.cpp; sourceTree = "<group>"; };
 		512935E21288D97800A4B695 /* InjectedBundlePageContextMenuClient.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InjectedBundlePageContextMenuClient.h; sourceTree = "<group>"; };
+		512C06861638F67E00ABB911 /* HostRecord.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = HostRecord.cpp; path = NetworkProcess/HostRecord.cpp; sourceTree = "<group>"; };
+		512C06871638F67E00ABB911 /* HostRecord.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = HostRecord.h; path = NetworkProcess/HostRecord.h; sourceTree = "<group>"; };
+		512C068F16390E6900ABB911 /* NetworkResourceLoadSchedulerMac.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = NetworkResourceLoadSchedulerMac.mm; sourceTree = "<group>"; };
 		512DF6D6138C181A00A22FC6 /* KeychainItemShimMethods.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = KeychainItemShimMethods.h; sourceTree = "<group>"; };
 		512DF6D7138C181A00A22FC6 /* KeychainItemShimMethods.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = KeychainItemShimMethods.mm; sourceTree = "<group>"; };
 		512E3520130B550100ABD19A /* WebApplicationCacheManagerProxy.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WebApplicationCacheManagerProxy.cpp; sourceTree = "<group>"; };
@@ -1602,6 +1642,12 @@
 		516A4A5B120A2CCD00C05B7F /* WebError.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebError.h; sourceTree = "<group>"; };
 		517A33B3130B308C00F80CB5 /* WKApplicationCacheManager.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WKApplicationCacheManager.cpp; sourceTree = "<group>"; };
 		517A33B4130B308C00F80CB5 /* WKApplicationCacheManager.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WKApplicationCacheManager.h; sourceTree = "<group>"; };
+		517CF0DD163A444C00C2950E /* NetworkRequest.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = NetworkRequest.cpp; path = NetworkProcess/NetworkRequest.cpp; sourceTree = "<group>"; };
+		517CF0DE163A444C00C2950E /* NetworkRequest.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = NetworkRequest.h; path = NetworkProcess/NetworkRequest.h; sourceTree = "<group>"; };
+		517CF0E1163A486C00C2950E /* NetworkProcessConnectionMessageReceiver.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = NetworkProcessConnectionMessageReceiver.cpp; sourceTree = "<group>"; };
+		517CF0E2163A486C00C2950E /* NetworkProcessConnectionMessages.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = NetworkProcessConnectionMessages.h; sourceTree = "<group>"; };
+		51829DA31637C70C000953D6 /* NetworkResourceLoadScheduler.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = NetworkResourceLoadScheduler.cpp; path = NetworkProcess/NetworkResourceLoadScheduler.cpp; sourceTree = "<group>"; };
+		51829DA41637C70C000953D6 /* NetworkResourceLoadScheduler.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = NetworkResourceLoadScheduler.h; path = NetworkProcess/NetworkResourceLoadScheduler.h; sourceTree = "<group>"; };
 		51834590134532E80092B696 /* WebIconDatabaseClient.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WebIconDatabaseClient.cpp; sourceTree = "<group>"; };
 		51834591134532E80092B696 /* WebIconDatabaseClient.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebIconDatabaseClient.h; sourceTree = "<group>"; };
 		5183B3931379F85C00E8754E /* Shim.xcconfig */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.xcconfig; path = Shim.xcconfig; sourceTree = "<group>"; };
@@ -1636,6 +1682,8 @@
 		51A9E1251315ED35009E7031 /* WebKeyValueStorageManagerMessages.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebKeyValueStorageManagerMessages.h; sourceTree = "<group>"; };
 		51A9E1261315ED35009E7031 /* WebKeyValueStorageManagerProxyMessageReceiver.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WebKeyValueStorageManagerProxyMessageReceiver.cpp; sourceTree = "<group>"; };
 		51A9E1271315ED35009E7031 /* WebKeyValueStorageManagerProxyMessages.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebKeyValueStorageManagerProxyMessages.h; sourceTree = "<group>"; };
+		51ABF65616392F1500132A7A /* WebResourceLoadScheduler.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = WebResourceLoadScheduler.cpp; path = Network/WebResourceLoadScheduler.cpp; sourceTree = "<group>"; };
+		51ABF65716392F1500132A7A /* WebResourceLoadScheduler.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = WebResourceLoadScheduler.h; path = Network/WebResourceLoadScheduler.h; sourceTree = "<group>"; };
 		51ACBB81127A8BAD00D203B9 /* WebContextMenuProxy.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebContextMenuProxy.h; sourceTree = "<group>"; };
 		51ACBB9E127A8F2C00D203B9 /* WebContextMenuProxyMac.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebContextMenuProxyMac.h; sourceTree = "<group>"; };
 		51ACBB9F127A8F2C00D203B9 /* WebContextMenuProxyMac.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = WebContextMenuProxyMac.mm; sourceTree = "<group>"; };
@@ -1656,10 +1704,13 @@
 		51D130511382EAC000351EDD /* SecItemResponseData.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SecItemResponseData.cpp; sourceTree = "<group>"; };
 		51D130521382EAC000351EDD /* SecItemResponseData.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SecItemResponseData.h; sourceTree = "<group>"; };
 		51D130571382F10500351EDD /* WebProcessProxyMac.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = WebProcessProxyMac.mm; sourceTree = "<group>"; };
+		51DD9F2616367DA2001578E9 /* NetworkConnectionToWebProcessMessageReceiver.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = NetworkConnectionToWebProcessMessageReceiver.cpp; sourceTree = "<group>"; };
+		51DD9F2716367DA2001578E9 /* NetworkConnectionToWebProcessMessages.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = NetworkConnectionToWebProcessMessages.h; sourceTree = "<group>"; };
 		51FA2D541521118600C1BA0B /* WKBundleDOMWindowExtension.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WKBundleDOMWindowExtension.h; sourceTree = "<group>"; };
 		51FA2D5A15211A1E00C1BA0B /* InjectedBundleDOMWindowExtension.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InjectedBundleDOMWindowExtension.h; sourceTree = "<group>"; };
 		51FA2D5C15211A5000C1BA0B /* InjectedBundleDOMWindowExtension.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = InjectedBundleDOMWindowExtension.cpp; sourceTree = "<group>"; };
 		51FA2D7515212E1E00C1BA0B /* WKBundleDOMWindowExtension.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WKBundleDOMWindowExtension.cpp; sourceTree = "<group>"; };
+		51FB0902163A3B1C00EC324A /* NetworkProcessConnection.messages.in */ = {isa = PBXFileReference; lastKnownFileType = text; name = NetworkProcessConnection.messages.in; path = Network/NetworkProcessConnection.messages.in; sourceTree = "<group>"; };
 		5272B2881406985D0096A5D0 /* StatisticsData.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = StatisticsData.cpp; sourceTree = "<group>"; };
 		5272B2891406985D0096A5D0 /* StatisticsData.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = StatisticsData.h; sourceTree = "<group>"; };
 		5D1A238E15E75AD50023E981 /* webkit2 */ = {isa = PBXFileReference; lastKnownFileType = folder; path = webkit2; sourceTree = "<group>"; };
@@ -1700,6 +1751,11 @@
 		93FC679E12D3CC7400A60610 /* DecoderAdapter.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DecoderAdapter.h; sourceTree = "<group>"; };
 		93FC679F12D3CC7400A60610 /* EncoderAdapter.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = EncoderAdapter.cpp; sourceTree = "<group>"; };
 		93FC67A012D3CC7400A60610 /* EncoderAdapter.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = EncoderAdapter.h; sourceTree = "<group>"; };
+		9F4F59411648B40700493B7E /* SharedWorkerProcessManagerMac.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = SharedWorkerProcessManagerMac.mm; sourceTree = "<group>"; };
+		9F4F59431648B67F00493B7E /* SharedWorkerProcessProxyMac.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = SharedWorkerProcessProxyMac.mm; sourceTree = "<group>"; };
+		9F4F59451648BA8E00493B7E /* NetworkProcessManagerMac.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; name = NetworkProcessManagerMac.mm; path = mac/NetworkProcessManagerMac.mm; sourceTree = "<group>"; };
+		9F54F88E16488E87007DF81A /* ChildProcessMac.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = ChildProcessMac.mm; sourceTree = "<group>"; };
+		9F54F8941648AE0E007DF81A /* PluginProcessManagerMac.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = PluginProcessManagerMac.mm; sourceTree = "<group>"; };
 		A72D5D7F1236CBA800A88B15 /* WebSerializedScriptValue.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebSerializedScriptValue.h; sourceTree = "<group>"; };
 		B396EA5512E0ED2D00F4FEB7 /* config.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = config.h; sourceTree = "<group>"; };
 		B62E730F143047A60069EC35 /* WKHitTestResult.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WKHitTestResult.cpp; sourceTree = "<group>"; };
@@ -1985,7 +2041,6 @@
 		BCAC111E12C92C1F00B08EEE /* WebDatabaseManagerProxyClient.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WebDatabaseManagerProxyClient.cpp; sourceTree = "<group>"; };
 		BCAE9DE9160C097400A33217 /* com.apple.WebKit2.WebProcessServiceForWebKitDevelopment.xpc */ = {isa = PBXFileReference; explicitFileType = wrapper.cfbundle; includeInIndex = 0; path = com.apple.WebKit2.WebProcessServiceForWebKitDevelopment.xpc; sourceTree = BUILT_PRODUCTS_DIR; };
 		BCAE9DEF160C097500A33217 /* Info.plist */ = {isa = PBXFileReference; lastKnownFileType = text.plist.xml; path = Info.plist; sourceTree = "<group>"; };
-		BCAE9DFF160C0B4100A33217 /* CompilerVersion.xcconfig */ = {isa = PBXFileReference; lastKnownFileType = text.xcconfig; path = CompilerVersion.xcconfig; sourceTree = "<group>"; };
 		BCAE9E00160C0B4100A33217 /* WebProcessServiceForWebKitDevelopment.xcconfig */ = {isa = PBXFileReference; lastKnownFileType = text.xcconfig; path = WebProcessServiceForWebKitDevelopment.xcconfig; sourceTree = "<group>"; };
 		BCAE9E01160C12DA00A33217 /* Info.plist */ = {isa = PBXFileReference; lastKnownFileType = text.plist.xml; name = Info.plist; path = WebProcessService/Info.plist; sourceTree = "<group>"; };
 		BCAE9E04160C137800A33217 /* WebProcessServiceForWebKitDevelopmentMain.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = WebProcessServiceForWebKitDevelopmentMain.mm; sourceTree = "<group>"; };
@@ -2204,6 +2259,8 @@
 		E1A31734134CEA80007C9A4F /* AttributedString.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = AttributedString.mm; sourceTree = "<group>"; };
 		E1AEA22D14687BDB00804569 /* WKFullKeyboardAccessWatcher.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WKFullKeyboardAccessWatcher.h; sourceTree = "<group>"; };
 		E1AEA22E14687BDB00804569 /* WKFullKeyboardAccessWatcher.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = WKFullKeyboardAccessWatcher.mm; sourceTree = "<group>"; };
+		E1B78470163F24690007B692 /* RemoteNetworkingContext.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = RemoteNetworkingContext.h; sourceTree = "<group>"; };
+		E1B78472163F253E0007B692 /* RemoteNetworkingContext.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = RemoteNetworkingContext.mm; sourceTree = "<group>"; };
 		E1CC1B8E12D7EADF00625838 /* PrintInfo.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PrintInfo.h; sourceTree = "<group>"; };
 		E1CC1B8F12D7EADF00625838 /* PrintInfoMac.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = PrintInfoMac.mm; sourceTree = "<group>"; };
 		E1EDFD9816287BD10039ECDA /* SharedWorkerProcessMain.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SharedWorkerProcessMain.h; sourceTree = "<group>"; };
@@ -2468,7 +2525,6 @@
 			children = (
 				1A4F976A100E7B6600637A18 /* Base.xcconfig */,
 				5DAD73F1116FF90C00EE5396 /* BaseTarget.xcconfig */,
-				BCAE9DFF160C0B4100A33217 /* CompilerVersion.xcconfig */,
 				1A4F976B100E7B6600637A18 /* DebugRelease.xcconfig */,
 				1A4F976C100E7B6600637A18 /* FeatureDefines.xcconfig */,
 				510CC8461613C7C600D03ED3 /* NetworkProcess.xcconfig */,
@@ -2860,6 +2916,7 @@
 		1AEFCC0D11D01F41008219D3 /* mac */ = {
 			isa = PBXGroup;
 			children = (
+				9F54F8941648AE0E007DF81A /* PluginProcessManagerMac.mm */,
 				1AEFCCBC11D02C5E008219D3 /* PluginInfoStoreMac.mm */,
 				1A2D90BA1281C931001EB962 /* PluginProcessProxyMac.mm */,
 			);
@@ -2952,6 +3009,9 @@
 			children = (
 				5105B0D4162F7A7A00E27709 /* NetworkProcessConnection.cpp */,
 				5105B0D5162F7A7A00E27709 /* NetworkProcessConnection.h */,
+				51FB0902163A3B1C00EC324A /* NetworkProcessConnection.messages.in */,
+				51ABF65616392F1500132A7A /* WebResourceLoadScheduler.cpp */,
+				51ABF65716392F1500132A7A /* WebResourceLoadScheduler.h */,
 			);
 			name = Network;
 			sourceTree = "<group>";
@@ -2960,6 +3020,8 @@
 			isa = PBXGroup;
 			children = (
 				510CC7DC16138E2900D03ED3 /* mac */,
+				512C06861638F67E00ABB911 /* HostRecord.cpp */,
+				512C06871638F67E00ABB911 /* HostRecord.h */,
 				513A16491630A9BF005D7D22 /* NetworkConnectionToWebProcess.cpp */,
 				513A164A1630A9BF005D7D22 /* NetworkConnectionToWebProcess.h */,
 				513A164B1630A9BF005D7D22 /* NetworkConnectionToWebProcess.messages.in */,
@@ -2967,6 +3029,10 @@
 				510CC7E016138E2900D03ED3 /* NetworkProcess.h */,
 				51A8A6171627F5BB000D90E9 /* NetworkProcess.messages.in */,
 				510CC7E116138E2900D03ED3 /* NetworkProcessMain.h */,
+				517CF0DD163A444C00C2950E /* NetworkRequest.cpp */,
+				517CF0DE163A444C00C2950E /* NetworkRequest.h */,
+				51829DA31637C70C000953D6 /* NetworkResourceLoadScheduler.cpp */,
+				51829DA41637C70C000953D6 /* NetworkResourceLoadScheduler.h */,
 			);
 			name = NetworkProcess;
 			sourceTree = "<group>";
@@ -2976,6 +3042,9 @@
 			children = (
 				51A8A6151627F3F9000D90E9 /* NetworkProcessMac.mm */,
 				510CC7DD16138E2900D03ED3 /* NetworkProcessMainMac.mm */,
+				512C068F16390E6900ABB911 /* NetworkResourceLoadSchedulerMac.mm */,
+				E1B78470163F24690007B692 /* RemoteNetworkingContext.h */,
+				E1B78472163F253E0007B692 /* RemoteNetworkingContext.mm */,
 			);
 			name = mac;
 			path = NetworkProcess/mac;
@@ -3050,6 +3119,7 @@
 		516319931628980E00E22F00 /* mac */ = {
 			isa = PBXGroup;
 			children = (
+				9F4F59451648BA8E00493B7E /* NetworkProcessManagerMac.mm */,
 				516319911628980A00E22F00 /* NetworkProcessProxyMac.mm */,
 			);
 			name = mac;
@@ -3121,6 +3191,15 @@
 			name = mac;
 			sourceTree = "<group>";
 		};
+		9F4F59401648B40700493B7E /* mac */ = {
+			isa = PBXGroup;
+			children = (
+				9F4F59411648B40700493B7E /* SharedWorkerProcessManagerMac.mm */,
+				9F4F59431648B67F00493B7E /* SharedWorkerProcessProxyMac.mm */,
+			);
+			path = mac;
+			sourceTree = "<group>";
+		};
 		BC017D1016260FFD007054F5 /* DOM */ = {
 			isa = PBXGroup;
 			children = (
@@ -3580,6 +3659,7 @@
 				E179FD9E134D38250015B883 /* ArgumentCodersMac.mm */,
 				E1A31731134CEA6C007C9A4F /* AttributedString.h */,
 				E1A31734134CEA80007C9A4F /* AttributedString.mm */,
+				9F54F88E16488E87007DF81A /* ChildProcessMac.mm */,
 				1A2A4AFE158693920090C9E9 /* ColorSpaceData.h */,
 				1A2A4AFD158693920090C9E9 /* ColorSpaceData.mm */,
 				1A6F9FB611E1408500DB1371 /* CommandLineMac.cpp */,
@@ -3830,6 +3910,8 @@
 		BC963D6C113DD19500574BE2 /* mac */ = {
 			isa = PBXGroup;
 			children = (
+				1AB16ADC1648598400290D62 /* RemoteLayerTreeDrawingArea.h */,
+				1AB16ADB1648598400290D62 /* RemoteLayerTreeDrawingArea.mm */,
 				1AAF263714687C39004A1E8A /* TiledCoreAnimationDrawingArea.h */,
 				1AAF263614687C39004A1E8A /* TiledCoreAnimationDrawingArea.mm */,
 				1C8E2DAD1278C5B200BC7BD0 /* WebInspectorMac.mm */,
@@ -3896,6 +3978,8 @@
 				1A64292C12DE5F9800CAAE2C /* BackingStoreMac.mm */,
 				B878B613133428DC006888E9 /* CorrectionPanel.h */,
 				B878B614133428DC006888E9 /* CorrectionPanel.mm */,
+				1AB16AE01648656D00290D62 /* RemoteLayerTreeDrawingAreaProxy.h */,
+				1AB16ADF1648656D00290D62 /* RemoteLayerTreeDrawingAreaProxy.mm */,
 				1AA417ED12C00D87002BE67B /* TextCheckerMac.mm */,
 				1AF05D8514688348008B1E81 /* TiledCoreAnimationDrawingAreaProxy.h */,
 				1AF05D8414688348008B1E81 /* TiledCoreAnimationDrawingAreaProxy.mm */,
@@ -4044,6 +4128,10 @@
 				1A64230712DD09EB00CAAE2C /* DrawingAreaProxyMessages.h */,
 				1AA575FF1496B7C000A4EE06 /* EventDispatcherMessageReceiver.cpp */,
 				1AA576001496B7C000A4EE06 /* EventDispatcherMessages.h */,
+				51DD9F2616367DA2001578E9 /* NetworkConnectionToWebProcessMessageReceiver.cpp */,
+				51DD9F2716367DA2001578E9 /* NetworkConnectionToWebProcessMessages.h */,
+				517CF0E1163A486C00C2950E /* NetworkProcessConnectionMessageReceiver.cpp */,
+				517CF0E2163A486C00C2950E /* NetworkProcessConnectionMessages.h */,
 				51ACC9341628064800342550 /* NetworkProcessMessageReceiver.cpp */,
 				51ACC9351628064800342550 /* NetworkProcessMessages.h */,
 				513A163A163088F6005D7D22 /* NetworkProcessProxyMessageReceiver.cpp */,
@@ -4196,6 +4284,13 @@
 		E199875B142BF9CF00BB2DE7 /* PDF */ = {
 			isa = PBXGroup;
 			children = (
+				2D2ADF0D16364D8200197E47 /* PDFPluginChoiceAnnotation.h */,
+				2D2ADF0E16364D8200197E47 /* PDFPluginChoiceAnnotation.mm */,
+				2D2ADF0C16363DEC00197E47 /* PDFLayerControllerDetails.h */,
+				2D2ADF021636243500197E47 /* PDFPluginAnnotation.h */,
+				2D2ADF031636243500197E47 /* PDFPluginAnnotation.mm */,
+				2D2ADF0516362DC700197E47 /* PDFPluginTextAnnotation.h */,
+				2D2ADF0616362DC700197E47 /* PDFPluginTextAnnotation.mm */,
 				2D870D0D1622B7F9000A3F20 /* PDFPlugin.h */,
 				2D870D0E1622B7F9000A3F20 /* PDFPlugin.mm */,
 				E199875C142BFC9700BB2DE7 /* SimplePDFPlugin.mm */,
@@ -4225,6 +4320,7 @@
 		E1EDFDAA1628878E0039ECDA /* SharedWorkers */ = {
 			isa = PBXGroup;
 			children = (
+				9F4F59401648B40700493B7E /* mac */,
 				E1EDFE0F1628CF4E0039ECDA /* SharedWorkerProcessManager.h */,
 				E1EDFE111628CFB20039ECDA /* SharedWorkerProcessManager.cpp */,
 				E1EDFDAB162887B00039ECDA /* SharedWorkerProcessProxy.messages.in */,
@@ -4743,6 +4839,14 @@
 				513A163D163088F6005D7D22 /* NetworkProcessProxyMessages.h in Headers */,
 				513A164D1630A9BF005D7D22 /* NetworkConnectionToWebProcess.h in Headers */,
 				1A13BEB41635A9C800F19C03 /* StringReference.h in Headers */,
+				51DD9F2916367DA2001578E9 /* NetworkConnectionToWebProcessMessages.h in Headers */,
+				51829DA61637C70C000953D6 /* NetworkResourceLoadScheduler.h in Headers */,
+				512C06891638F67E00ABB911 /* HostRecord.h in Headers */,
+				517CF0E0163A444C00C2950E /* NetworkRequest.h in Headers */,
+				517CF0E4163A486C00C2950E /* NetworkProcessConnectionMessages.h in Headers */,
+				E1B78471163F24690007B692 /* RemoteNetworkingContext.h in Headers */,
+				1AB16ADE1648598400290D62 /* RemoteLayerTreeDrawingArea.h in Headers */,
+				1AB16AE21648656D00290D62 /* RemoteLayerTreeDrawingAreaProxy.h in Headers */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
@@ -4829,8 +4933,6 @@
 				5D1A239215E760590023E981 /* Remove Compiled Python Files */,
 				8DC2EF540486A6940098B216 /* Sources */,
 				8DC2EF560486A6940098B216 /* Frameworks */,
-				5DF408C0131DD37C00130071 /* Check For Global Initializers */,
-				5DF408C4131DD3DB00130071 /* Check For Exit Time Destructors */,
 				5DF408C5131DD46700130071 /* Check For Weak VTables and Externals */,
 				3713F0231429063D0036387F /* Check For Inappropriate Objective-C Class Names */,
 				5DF408C6131DD49700130071 /* Check For Framework Include Consistency */,
@@ -5048,36 +5150,6 @@
 			shellPath = /bin/sh;
 			shellScript = "find \"${BUILT_PRODUCTS_DIR}/${PRIVATE_HEADERS_FOLDER_PATH}\" -name '*.pyc' -delete";
 		};
-		5DF408C0131DD37C00130071 /* Check For Global Initializers */ = {
-			isa = PBXShellScriptBuildPhase;
-			buildActionMask = 2147483647;
-			files = (
-			);
-			inputPaths = (
-				"$(TARGET_BUILD_DIR)/$(EXECUTABLE_PATH)",
-			);
-			name = "Check For Global Initializers";
-			outputPaths = (
-			);
-			runOnlyForDeploymentPostprocessing = 0;
-			shellPath = /bin/sh;
-			shellScript = "if [ \"${TARGET_GCC_VERSION}\" = \"LLVM_COMPILER\" ]; then\n    exit 0;\nfi\n\nif [ \"${ACTION}\" = \"installhdrs\" ]; then\n    exit 0;\nfi\n\nif [ -f ../../Tools/Scripts/check-for-global-initializers ]; then\n    ../../Tools/Scripts/check-for-global-initializers || exit $?\nfi";
-		};
-		5DF408C4131DD3DB00130071 /* Check For Exit Time Destructors */ = {
-			isa = PBXShellScriptBuildPhase;
-			buildActionMask = 2147483647;
-			files = (
-			);
-			inputPaths = (
-				"$(TARGET_BUILD_DIR)/$(EXECUTABLE_PATH)",
-			);
-			name = "Check For Exit Time Destructors";
-			outputPaths = (
-			);
-			runOnlyForDeploymentPostprocessing = 0;
-			shellPath = /bin/sh;
-			shellScript = "if [ \"${TARGET_GCC_VERSION}\" = \"LLVM_COMPILER\" ]; then\n    exit 0;\nfi\n\nif [ \"${ACTION}\" = \"installhdrs\" ]; then\n    exit 0;\nfi\n\nif [ -f ../../Tools/Scripts/check-for-exit-time-destructors ]; then\n    ../../Tools/Scripts/check-for-exit-time-destructors || exit $?\nfi";
-		};
 		5DF408C5131DD46700130071 /* Check For Weak VTables and Externals */ = {
 			isa = PBXShellScriptBuildPhase;
 			buildActionMask = 2147483647;
@@ -5166,7 +5238,7 @@
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 			shellPath = /bin/sh;
-			shellScript = "mkdir -p \"${BUILT_PRODUCTS_DIR}/DerivedSources/WebKit2\"\ncd \"${BUILT_PRODUCTS_DIR}/DerivedSources/WebKit2\"\n\nexport WebKit2=\"${SRCROOT}\"\n\nif [ ! $CC ]; then\n    case $TARGET_GCC_VERSION in\n        (LLVM_GCC_42)\n            export CC=\"`xcrun -find llvm-gcc-4.2`\";;\n        (LLVM_COMPILER)\n            export CC=\"`xcrun -find clang`\";;\n    esac\nfi\n\nif [ \"${ACTION}\" = \"build\" -o \"${ACTION}\" = \"install\" -o \"${ACTION}\" = \"installhdrs\" ]; then\n    make --no-builtin-rules -f \"${WebKit2}/DerivedSources.make\" -j `/usr/sbin/sysctl -n hw.availcpu`\nfi\n";
+			shellScript = "mkdir -p \"${BUILT_PRODUCTS_DIR}/DerivedSources/WebKit2\"\ncd \"${BUILT_PRODUCTS_DIR}/DerivedSources/WebKit2\"\n\nexport WebKit2=\"${SRCROOT}\"\n\nif [ ! $CC ]; then\n    export CC=\"`xcrun -find clang`\"\nfi\n\nif [ \"${ACTION}\" = \"build\" -o \"${ACTION}\" = \"install\" -o \"${ACTION}\" = \"installhdrs\" ]; then\n    make --no-builtin-rules -f \"${WebKit2}/DerivedSources.make\" -j `/usr/sbin/sysctl -n hw.availcpu`\nfi\n";
 		};
 		E14E99FA14D879DB001D221F /* Add Entitlements */ = {
 			isa = PBXShellScriptBuildPhase;
@@ -5694,6 +5766,24 @@
 				513A164C1630A9BF005D7D22 /* NetworkConnectionToWebProcess.cpp in Sources */,
 				5183DDEC1630BDFC008BE5C7 /* NetworkProcessConnection.cpp in Sources */,
 				1A13BEB31635A9C800F19C03 /* StringReference.cpp in Sources */,
+				51DD9F2816367DA2001578E9 /* NetworkConnectionToWebProcessMessageReceiver.cpp in Sources */,
+				51829DA51637C70C000953D6 /* NetworkResourceLoadScheduler.cpp in Sources */,
+				512C06881638F67E00ABB911 /* HostRecord.cpp in Sources */,
+				512C069016390E6900ABB911 /* NetworkResourceLoadSchedulerMac.mm in Sources */,
+				51FB08FF1639DE1A00EC324A /* WebResourceLoadScheduler.cpp in Sources */,
+				517CF0DF163A444C00C2950E /* NetworkRequest.cpp in Sources */,
+				517CF0E3163A486C00C2950E /* NetworkProcessConnectionMessageReceiver.cpp in Sources */,
+				E1B78473163F253E0007B692 /* RemoteNetworkingContext.mm in Sources */,
+				2D2ADF0916362DD500197E47 /* PDFPluginTextAnnotation.mm in Sources */,
+				2D2ADF0B16362DDB00197E47 /* PDFPluginAnnotation.mm in Sources */,
+				2D2ADF1016364D8200197E47 /* PDFPluginChoiceAnnotation.mm in Sources */,
+				1AB16ADD1648598400290D62 /* RemoteLayerTreeDrawingArea.mm in Sources */,
+				1AB16AE11648656D00290D62 /* RemoteLayerTreeDrawingAreaProxy.mm in Sources */,
+				9F54F88F16488E87007DF81A /* ChildProcessMac.mm in Sources */,
+				9F54F8951648AE0F007DF81A /* PluginProcessManagerMac.mm in Sources */,
+				9F4F59421648B40700493B7E /* SharedWorkerProcessManagerMac.mm in Sources */,
+				9F4F59441648B67F00493B7E /* SharedWorkerProcessProxyMac.mm in Sources */,
+				9F4F59461648BA8E00493B7E /* NetworkProcessManagerMac.mm in Sources */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
diff --git a/Source/WebKit2/WebKit2Prefix.h b/Source/WebKit2/WebKit2Prefix.h
index 8f6b099f1..0673ec86d 100644
--- a/Source/WebKit2/WebKit2Prefix.h
+++ b/Source/WebKit2/WebKit2Prefix.h
@@ -55,10 +55,6 @@
 #endif
 #endif
 
-#endif // PLATFORM(MAC)
-
-#if PLATFORM(MAC)
-
 #if ENABLE(PLUGIN_PROCESS)
 #define ENABLE_SHARED_WORKER_PROCESS 1
 #endif
diff --git a/Source/WebKit2/WebProcess/Battery/WebBatteryManager.cpp b/Source/WebKit2/WebProcess/Battery/WebBatteryManager.cpp
index 0892f2178..3cb06b398 100644
--- a/Source/WebKit2/WebProcess/Battery/WebBatteryManager.cpp
+++ b/Source/WebKit2/WebProcess/Battery/WebBatteryManager.cpp
@@ -28,6 +28,7 @@
 
 #if ENABLE(BATTERY_STATUS)
 
+#include "WebBatteryManagerMessages.h"
 #include "WebBatteryManagerProxyMessages.h"
 #include "WebPage.h"
 #include "WebProcess.h"
@@ -42,6 +43,7 @@ namespace WebKit {
 WebBatteryManager::WebBatteryManager(WebProcess* process)
     : m_process(process)
 {
+    m_process->addMessageReceiver(Messages::WebBatteryManager::messageReceiverName(), this);
 }
 
 WebBatteryManager::~WebBatteryManager()
diff --git a/Source/WebKit2/WebProcess/Battery/WebBatteryManager.h b/Source/WebKit2/WebProcess/Battery/WebBatteryManager.h
index 45fab18c1..d47dea4d1 100644
--- a/Source/WebKit2/WebProcess/Battery/WebBatteryManager.h
+++ b/Source/WebKit2/WebProcess/Battery/WebBatteryManager.h
@@ -28,24 +28,19 @@
 
 #if ENABLE(BATTERY_STATUS)
 
-#include "MessageID.h"
+#include "MessageReceiver.h"
 #include "WebBatteryStatus.h"
 #include "WebCoreArgumentCoders.h"
 #include <wtf/HashSet.h>
 #include <wtf/Noncopyable.h>
 #include <wtf/text/AtomicString.h>
 
-namespace CoreIPC {
-class Connection;
-class MessageDecoder;
-}
-
 namespace WebKit {
 
 class WebPage;
 class WebProcess;
 
-class WebBatteryManager {
+class WebBatteryManager : private CoreIPC::MessageReceiver {
     WTF_MAKE_NONCOPYABLE(WebBatteryManager);
 
 public:
@@ -58,9 +53,10 @@ public:
     void didChangeBatteryStatus(const WTF::AtomicString& eventType, const WebBatteryStatus::Data&);
     void updateBatteryStatus(const WebBatteryStatus::Data&);
 
-    void didReceiveMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::MessageDecoder&);
-
 private:
+    // CoreIPC::MessageReceiver
+    void didReceiveMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::MessageDecoder&) OVERRIDE;
+
     // Implemented in generated WebBatteryManagerMessageReceiver.cpp
     void didReceiveWebBatteryManagerMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::MessageDecoder&);
 
diff --git a/Source/WebKit2/WebProcess/Cookies/mac/WebCookieManagerMac.mm b/Source/WebKit2/WebProcess/Cookies/mac/WebCookieManagerMac.mm
index daf39cdc7..0584307d6 100644
--- a/Source/WebKit2/WebProcess/Cookies/mac/WebCookieManagerMac.mm
+++ b/Source/WebKit2/WebProcess/Cookies/mac/WebCookieManagerMac.mm
@@ -34,12 +34,10 @@ namespace WebKit {
 
 void WebCookieManager::platformSetHTTPCookieAcceptPolicy(HTTPCookieAcceptPolicy policy)
 {
-    [[NSHTTPCookieStorage sharedHTTPCookieStorage] setCookieAcceptPolicy:policy];
+    [[NSHTTPCookieStorage sharedHTTPCookieStorage] setCookieAcceptPolicy:static_cast<NSHTTPCookieAcceptPolicy>(policy)];
 
-#if USE(CFURLSTORAGESESSIONS)
     if (RetainPtr<CFHTTPCookieStorageRef> cookieStorage = currentCFHTTPCookieStorage())
         WKSetHTTPCookieAcceptPolicy(cookieStorage.get(), policy);
-#endif
 }
 
 HTTPCookieAcceptPolicy WebCookieManager::platformGetHTTPCookieAcceptPolicy()
diff --git a/Source/WebKit2/WebProcess/IconDatabase/WebIconDatabaseProxy.cpp b/Source/WebKit2/WebProcess/IconDatabase/WebIconDatabaseProxy.cpp
index a04793eb4..c9360b3ee 100644
--- a/Source/WebKit2/WebProcess/IconDatabase/WebIconDatabaseProxy.cpp
+++ b/Source/WebKit2/WebProcess/IconDatabase/WebIconDatabaseProxy.cpp
@@ -27,8 +27,8 @@
 #include "WebIconDatabaseProxy.h"
 
 #include "DataReference.h"
-#include "MessageID.h"
 #include "WebIconDatabaseMessages.h"
+#include "WebIconDatabaseProxyMessages.h"
 #include "WebProcess.h"
 #include <WebCore/SharedBuffer.h>
 #include <wtf/text/WTFString.h>
@@ -45,6 +45,7 @@ WebIconDatabaseProxy::WebIconDatabaseProxy(WebProcess* process)
     : m_isEnabled(false)
     , m_process(process)
 {
+    m_process->addMessageReceiver(Messages::WebIconDatabaseProxy::messageReceiverName(), this);
 }
 
 bool WebIconDatabaseProxy::isEnabled() const
@@ -61,7 +62,6 @@ void WebIconDatabaseProxy::setEnabled(bool enabled)
     setGlobalIconDatabase(enabled ? this : 0);
 }
 
-
 void WebIconDatabaseProxy::retainIconForPageURL(const String& pageURL)
 {
     m_process->connection()->send(Messages::WebIconDatabase::RetainIconForPageURL(pageURL), 0);
diff --git a/Source/WebKit2/WebProcess/IconDatabase/WebIconDatabaseProxy.h b/Source/WebKit2/WebProcess/IconDatabase/WebIconDatabaseProxy.h
index cd9f7176e..16f8ea7a1 100644
--- a/Source/WebKit2/WebProcess/IconDatabase/WebIconDatabaseProxy.h
+++ b/Source/WebKit2/WebProcess/IconDatabase/WebIconDatabaseProxy.h
@@ -27,33 +27,25 @@
 #define WebIconDatabaseProxy_h
 
 #include "APIObject.h"
-
+#include "MessageReceiver.h"
 #include <WebCore/IconDatabaseBase.h>
-
 #include <wtf/HashMap.h>
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefPtr.h>
 #include <wtf/Vector.h>
 
-namespace CoreIPC {
-class Connection;
-class MessageDecoder;
-class MessageID;
-}
-
 namespace WebKit {
 
 class WebProcess;
 
-class WebIconDatabaseProxy : public WebCore::IconDatabaseBase {
+class WebIconDatabaseProxy : public WebCore::IconDatabaseBase, private CoreIPC::MessageReceiver {
 public:
     explicit WebIconDatabaseProxy(WebProcess*);
     virtual ~WebIconDatabaseProxy();
 
     virtual bool isEnabled() const;
     void setEnabled(bool);
-    
-    
+
     virtual void retainIconForPageURL(const String&);
     virtual void releaseIconForPageURL(const String&);
     virtual void setIconURLForPageURL(const String&, const String&);
@@ -69,10 +61,12 @@ public:
     virtual void loadDecisionForIconURL(const String&, PassRefPtr<WebCore::IconLoadDecisionCallback>);
     void receivedIconLoadDecision(int decision, uint64_t callbackID);
     virtual void iconDataForIconURL(const String&, PassRefPtr<WebCore::IconDataCallback>);
-        
-    void didReceiveMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::MessageDecoder&);
-    
+
 private:
+    // CoreIPC::MessageReceiver
+    void didReceiveMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::MessageDecoder&) OVERRIDE;
+
+    // Implemented in generated WebIconDatabaseProxyMessageReceiver.cpp
     void didReceiveWebIconDatabaseProxyMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::MessageDecoder&);
     
     // Callbacks from the UIProcess
diff --git a/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundle.cpp b/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundle.cpp
index 7210a9d9e..95273a704 100644
--- a/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundle.cpp
+++ b/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundle.cpp
@@ -329,6 +329,11 @@ void WKBundleSetSerialLoadingEnabled(WKBundleRef bundleRef, bool enabled)
     toImpl(bundleRef)->setSerialLoadingEnabled(enabled);
 }
 
+void WKBundleSetShadowDOMEnabled(WKBundleRef bundleRef, bool enabled)
+{
+    toImpl(bundleRef)->setShadowDOMEnabled(enabled);
+}
+
 void WKBundleDispatchPendingLoadRequests(WKBundleRef bundleRef)
 {
     toImpl(bundleRef)->dispatchPendingLoadRequests();
diff --git a/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundleFrame.cpp b/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundleFrame.cpp
index 24188fff2..f00e03539 100644
--- a/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundleFrame.cpp
+++ b/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundleFrame.cpp
@@ -32,6 +32,7 @@
 #include "WKBundleAPICast.h"
 #include "WKData.h"
 #include "WebFrame.h"
+#include "WebSecurityOrigin.h"
 #include <WebCore/Frame.h>
 #include <WebCore/FrameView.h>
 
@@ -286,3 +287,12 @@ WKBundleHitTestResultRef WKBundleFrameCreateHitTestResult(WKBundleFrameRef frame
 {
     return toAPI(toImpl(frameRef)->hitTest(toIntPoint(point)).leakRef());
 }
+
+WKSecurityOriginRef WKBundleFrameCopySecurityOrigin(WKBundleFrameRef frameRef)
+{
+    Frame* coreFrame = toImpl(frameRef)->coreFrame();
+    if (!coreFrame)
+        return 0;
+
+    return toCopiedAPI(coreFrame->document()->securityOrigin());
+}
diff --git a/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundleFrame.h b/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundleFrame.h
index 021aec0ed..8c2b875f5 100644
--- a/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundleFrame.h
+++ b/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundleFrame.h
@@ -44,6 +44,7 @@ WK_EXPORT WKArrayRef WKBundleFrameCopyChildFrames(WKBundleFrameRef frame);
 WK_EXPORT WKStringRef WKBundleFrameCopyName(WKBundleFrameRef frame);
 WK_EXPORT WKURLRef WKBundleFrameCopyURL(WKBundleFrameRef frame);
 WK_EXPORT WKURLRef WKBundleFrameCopyProvisionalURL(WKBundleFrameRef frame);
+WK_EXPORT WKSecurityOriginRef WKBundleFrameCopySecurityOrigin(WKBundleFrameRef frame);
 
 WK_EXPORT WKFrameLoadState WKBundleFrameGetFrameLoadState(WKBundleFrameRef frame); 
 
diff --git a/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundlePrivate.h b/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundlePrivate.h
index 369c4302f..15b2e7c85 100644
--- a/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundlePrivate.h
+++ b/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundlePrivate.h
@@ -102,6 +102,7 @@ WK_EXPORT size_t WKBundleGetWorkerThreadCount(WKBundleRef bundle);
 
 WK_EXPORT void WKBundleSetTabKeyCyclesThroughElements(WKBundleRef bundle, WKBundlePageRef page, bool enabled);
 WK_EXPORT void WKBundleSetSerialLoadingEnabled(WKBundleRef bundle, bool enabled);
+WK_EXPORT void WKBundleSetShadowDOMEnabled(WKBundleRef bundle, bool enabled);
 WK_EXPORT void WKBundleDispatchPendingLoadRequests(WKBundleRef bundle);
 
 #ifdef __cplusplus
diff --git a/Source/WebKit2/WebProcess/InjectedBundle/API/mac/WKDOMInternals.h b/Source/WebKit2/WebProcess/InjectedBundle/API/mac/WKDOMInternals.h
index f33e454cd..7407a9137 100644
--- a/Source/WebKit2/WebProcess/InjectedBundle/API/mac/WKDOMInternals.h
+++ b/Source/WebKit2/WebProcess/InjectedBundle/API/mac/WKDOMInternals.h
@@ -111,6 +111,10 @@ WKDOMText *toWKDOMText(WebCore::Text*);
 WebCore::Range* toWebCoreRange(WKDOMRange *);
 WKDOMRange *toWKDOMRange(WebCore::Range*);
 
+// -- Helpers --
+
+NSArray *toNSArray(const Vector<WebCore::IntRect>&);
+
 } // namespace WebKit
 
 #endif // defined(__LP64__) && defined(__clang__)
diff --git a/Source/WebKit2/WebProcess/InjectedBundle/API/mac/WKDOMInternals.mm b/Source/WebKit2/WebProcess/InjectedBundle/API/mac/WKDOMInternals.mm
index ab9046613..70369afb6 100644
--- a/Source/WebKit2/WebProcess/InjectedBundle/API/mac/WKDOMInternals.mm
+++ b/Source/WebKit2/WebProcess/InjectedBundle/API/mac/WKDOMInternals.mm
@@ -165,6 +165,15 @@ static WKDOMType toWKDOMType(WebCoreType impl, DOMCache<WebCoreType, WKDOMType>&
     return [wrapper autorelease];
 }
 
+NSArray *toNSArray(const Vector<WebCore::IntRect>& rects)
+{
+    size_t size = rects.size();
+    NSMutableArray *array = [NSMutableArray arrayWithCapacity:size];
+    for (size_t i = 0; i < size; ++i)
+        [array addObject:[NSValue valueWithRect:rects[i]]];
+    return array;
+}
+
 } // namespace WebKit
 
 #endif // defined(__LP64__) && defined(__clang__)
diff --git a/Source/WebKit2/WebProcess/InjectedBundle/API/mac/WKDOMNode.h b/Source/WebKit2/WebProcess/InjectedBundle/API/mac/WKDOMNode.h
index 40a8f9c90..d804d9641 100644
--- a/Source/WebKit2/WebProcess/InjectedBundle/API/mac/WKDOMNode.h
+++ b/Source/WebKit2/WebProcess/InjectedBundle/API/mac/WKDOMNode.h
@@ -43,6 +43,7 @@ WK_EXPORT
 @property(readonly) WKDOMNode *lastChild;
 @property(readonly) WKDOMNode *previousSibling;
 @property(readonly) WKDOMNode *nextSibling;
+@property(readonly) NSArray *textRects;
 
 @end
 
diff --git a/Source/WebKit2/WebProcess/InjectedBundle/API/mac/WKDOMNode.mm b/Source/WebKit2/WebProcess/InjectedBundle/API/mac/WKDOMNode.mm
index a3296bfc0..5b86f746d 100644
--- a/Source/WebKit2/WebProcess/InjectedBundle/API/mac/WKDOMNode.mm
+++ b/Source/WebKit2/WebProcess/InjectedBundle/API/mac/WKDOMNode.mm
@@ -30,6 +30,7 @@
 #import "WKDOMNode.h"
 
 #import "WKDOMInternals.h"
+#import <WebCore/Document.h>
 
 @implementation WKDOMNode
 
@@ -102,6 +103,16 @@
     return WebKit::toWKDOMNode(_impl->nextSibling());
 }
 
+- (NSArray *)textRects
+{
+    _impl->document()->updateLayoutIgnorePendingStylesheets();
+    if (!_impl->renderer())
+        return nil;
+    Vector<WebCore::IntRect> rects;
+    _impl->textRects(rects);
+    return WebKit::toNSArray(rects);
+}
+
 @end
 
 #endif // defined(__LP64__) && defined(__clang__)
diff --git a/Source/WebKit2/WebProcess/InjectedBundle/API/mac/WKDOMRange.h b/Source/WebKit2/WebProcess/InjectedBundle/API/mac/WKDOMRange.h
index 64ed00ce2..43b9a1c43 100644
--- a/Source/WebKit2/WebProcess/InjectedBundle/API/mac/WKDOMRange.h
+++ b/Source/WebKit2/WebProcess/InjectedBundle/API/mac/WKDOMRange.h
@@ -47,6 +47,7 @@ WK_EXPORT
 @property(readonly) NSInteger endOffset;
 @property(readonly, copy) NSString *text;
 @property(readonly) BOOL isCollapsed;
+@property(readonly) NSArray *textRects;
 
 @end
 
diff --git a/Source/WebKit2/WebProcess/InjectedBundle/API/mac/WKDOMRange.mm b/Source/WebKit2/WebProcess/InjectedBundle/API/mac/WKDOMRange.mm
index 1cc408408..81f066ca1 100644
--- a/Source/WebKit2/WebProcess/InjectedBundle/API/mac/WKDOMRange.mm
+++ b/Source/WebKit2/WebProcess/InjectedBundle/API/mac/WKDOMRange.mm
@@ -137,6 +137,14 @@
     return _impl->collapsed(ec);
 }
 
+- (NSArray *)textRects
+{
+    _impl->ownerDocument()->updateLayoutIgnorePendingStylesheets();
+    Vector<WebCore::IntRect> rects;
+    _impl->textRects(rects);
+    return WebKit::toNSArray(rects);
+}
+
 @end
 
 #endif // defined(__LP64__) && defined(__clang__)
diff --git a/Source/WebKit2/WebProcess/InjectedBundle/API/mac/WKWebProcessPlugIn.h b/Source/WebKit2/WebProcess/InjectedBundle/API/mac/WKWebProcessPlugIn.h
index 4a7cc50a6..f65e73b35 100644
--- a/Source/WebKit2/WebProcess/InjectedBundle/API/mac/WKWebProcessPlugIn.h
+++ b/Source/WebKit2/WebProcess/InjectedBundle/API/mac/WKWebProcessPlugIn.h
@@ -28,6 +28,7 @@
 #import <Foundation/Foundation.h>
 #import <WebKit2/WKBase.h>
 
+@class WKConnection;
 @class WKWebProcessPlugInController;
 @class WKWebProcessPlugInBrowserContextController;
 
@@ -40,6 +41,9 @@
 
 WK_EXPORT
 @interface WKWebProcessPlugInController : NSObject
+
+@property(readonly) WKConnection *connection;
+
 @end
 
 #endif // defined(__LP64__) && defined(__clang__)
diff --git a/Source/WebKit2/WebProcess/InjectedBundle/API/mac/WKWebProcessPlugIn.mm b/Source/WebKit2/WebProcess/InjectedBundle/API/mac/WKWebProcessPlugIn.mm
index d967ec29b..cbcc8492e 100644
--- a/Source/WebKit2/WebProcess/InjectedBundle/API/mac/WKWebProcessPlugIn.mm
+++ b/Source/WebKit2/WebProcess/InjectedBundle/API/mac/WKWebProcessPlugIn.mm
@@ -31,6 +31,7 @@
 #import "WKWebProcessPlugInInternal.h"
 
 #import "InjectedBundle.h"
+#import "WKConnectionInternal.h"
 #import "WKBundle.h"
 #import "WKBundleAPICast.h"
 #import "WKRetainPtr.h"
@@ -43,6 +44,7 @@ typedef HashMap<WKBundlePageRef, RetainPtr<WKWebProcessPlugInBrowserContextContr
     RetainPtr<id<WKWebProcessPlugIn> > _principalClassInstance;
     WKRetainPtr<WKBundleRef> _bundleRef;
     BundlePageWrapperCache _bundlePageWrapperCache;
+    RetainPtr<WKConnection *> _connectionWrapper;
 }
 @end
 
@@ -111,6 +113,7 @@ static WKWebProcessPlugInController *sharedInstance;
 
     _principalClassInstance = principalClassInstance;
     _bundleRef = bundleRef;
+    _connectionWrapper = adoptNS([[WKConnection alloc] _initWithConnectionRef:WKBundleGetApplicationConnection(_bundleRef.get())]);
 
     ASSERT_WITH_MESSAGE(!sharedInstance, "WKWebProcessPlugInController initialized multiple times.");
     sharedInstance = self;
@@ -124,6 +127,11 @@ static WKWebProcessPlugInController *sharedInstance;
 
 @implementation WKWebProcessPlugInController
 
+- (WKConnection *)connection
+{
+    return _connectionWrapper.get();
+}
+
 @end
 
 #endif // defined(__LP64__) && defined(__clang__)
diff --git a/Source/WebKit2/WebProcess/InjectedBundle/InjectedBundle.cpp b/Source/WebKit2/WebProcess/InjectedBundle/InjectedBundle.cpp
index 4d0aa56a3..82c122036 100644
--- a/Source/WebKit2/WebProcess/InjectedBundle/InjectedBundle.cpp
+++ b/Source/WebKit2/WebProcess/InjectedBundle/InjectedBundle.cpp
@@ -70,6 +70,10 @@
 #include <wtf/OwnArrayPtr.h>
 #include <wtf/PassOwnArrayPtr.h>
 
+#if ENABLE(SHADOW_DOM)
+#include <WebCore/RuntimeEnabledFeatures.h>
+#endif
+
 using namespace WebCore;
 using namespace JSC;
 
@@ -93,7 +97,7 @@ void InjectedBundle::initializeClient(WKBundleClient* client)
 
 void InjectedBundle::postMessage(const String& messageName, APIObject* messageBody)
 {
-    OwnPtr<CoreIPC::MessageEncoder> encoder = CoreIPC::MessageEncoder::create(CoreIPC::MessageKindTraits<WebContextLegacyMessage::Kind>::messageReceiverName(), "", 0);
+    OwnPtr<CoreIPC::MessageEncoder> encoder = CoreIPC::MessageEncoder::create(CoreIPC::MessageKindTraits<WebContextLegacyMessage::Kind>::messageReceiverName(), CoreIPC::StringReference("PostMessage"), 0);
     encoder->encode(messageName);
     encoder->encode(InjectedBundleUserMessageEncoder(messageBody));
 
@@ -105,7 +109,7 @@ void InjectedBundle::postSynchronousMessage(const String& messageName, APIObject
     InjectedBundleUserMessageDecoder messageDecoder(returnData);
 
     uint64_t syncRequestID;
-    OwnPtr<CoreIPC::MessageEncoder> encoder = WebProcess::shared().connection()->createSyncMessageEncoder(CoreIPC::MessageKindTraits<WebContextLegacyMessage::Kind>::messageReceiverName(), "", 0, syncRequestID);
+    OwnPtr<CoreIPC::MessageEncoder> encoder = WebProcess::shared().connection()->createSyncMessageEncoder(CoreIPC::MessageKindTraits<WebContextLegacyMessage::Kind>::messageReceiverName(), CoreIPC::StringReference("PostSynchronousMessage"), 0, syncRequestID);
     encoder->encode(messageName);
     encoder->encode(InjectedBundleUserMessageEncoder(messageBody));
 
@@ -279,8 +283,9 @@ void InjectedBundle::setPopupBlockingEnabled(WebPageGroupProxy* pageGroup, bool
 
 void InjectedBundle::switchNetworkLoaderToNewTestingSession()
 {
-#if USE(CFURLSTORAGESESSIONS)
+#if PLATFORM(MAC) || USE(CFNETWORK)
     // Set a private session for testing to avoid interfering with global cookies. This should be different from private browsing session.
+    // FIXME (NetworkProcess): Do this in network process, too.
     RetainPtr<CFURLStorageSessionRef> session = ResourceHandle::createPrivateBrowsingStorageSession(CFSTR("Private WebKit Session"));
     ResourceHandle::setDefaultStorageSession(session.get());
 #endif
@@ -622,6 +627,15 @@ void InjectedBundle::setSerialLoadingEnabled(bool enabled)
     resourceLoadScheduler()->setSerialLoadingEnabled(enabled);
 }
 
+void InjectedBundle::setShadowDOMEnabled(bool enabled)
+{
+#if ENABLE(SHADOW_DOM)
+    RuntimeEnabledFeatures::setShadowDOMEnabled(enabled);
+#else
+    UNUSED_PARAM(enabled);
+#endif
+}
+
 void InjectedBundle::dispatchPendingLoadRequests()
 {
     resourceLoadScheduler()->servePendingRequests();
diff --git a/Source/WebKit2/WebProcess/InjectedBundle/InjectedBundle.h b/Source/WebKit2/WebProcess/InjectedBundle/InjectedBundle.h
index 754b13320..c621f2483 100644
--- a/Source/WebKit2/WebProcess/InjectedBundle/InjectedBundle.h
+++ b/Source/WebKit2/WebProcess/InjectedBundle/InjectedBundle.h
@@ -178,6 +178,7 @@ public:
 
     void setTabKeyCyclesThroughElements(WebPage*, bool enabled);
     void setSerialLoadingEnabled(bool);
+    void setShadowDOMEnabled(bool);
     void dispatchPendingLoadRequests();
 
 private:
diff --git a/Source/WebKit2/WebProcess/InjectedBundle/InjectedBundleUserMessageCoders.h b/Source/WebKit2/WebProcess/InjectedBundle/InjectedBundleUserMessageCoders.h
index 49d66966a..c3fb18d30 100644
--- a/Source/WebKit2/WebProcess/InjectedBundle/InjectedBundleUserMessageCoders.h
+++ b/Source/WebKit2/WebProcess/InjectedBundle/InjectedBundleUserMessageCoders.h
@@ -49,7 +49,7 @@ public:
     {
     }
 
-    void encode(CoreIPC::ArgumentEncoder* encoder) const 
+    void encode(CoreIPC::ArgumentEncoder& encoder) const
     {
         APIObject::Type type = APIObject::TypeNull;
         if (baseEncode(encoder, type))
@@ -58,17 +58,17 @@ public:
         switch (type) {
         case APIObject::TypeBundlePage: {
             WebPage* page = static_cast<WebPage*>(m_root);
-            encoder->encode(page->pageID());
+            encoder << page->pageID();
             break;
         }
         case APIObject::TypeBundleFrame: {
             WebFrame* frame = static_cast<WebFrame*>(m_root);
-            encoder->encode(frame->frameID());
+            encoder << frame->frameID();
             break;
         }
         case APIObject::TypeBundlePageGroup: {
             WebPageGroupProxy* pageGroup = static_cast<WebPageGroupProxy*>(m_root);
-            encoder->encode(pageGroup->pageGroupID());
+            encoder << pageGroup->pageGroupID();
             break;
         }
         default:
diff --git a/Source/WebKit2/WebProcess/Network/NetworkProcessConnection.cpp b/Source/WebKit2/WebProcess/Network/NetworkProcessConnection.cpp
index dd9d6cbbc..10d672208 100644
--- a/Source/WebKit2/WebProcess/Network/NetworkProcessConnection.cpp
+++ b/Source/WebKit2/WebProcess/Network/NetworkProcessConnection.cpp
@@ -42,12 +42,18 @@ NetworkProcessConnection::~NetworkProcessConnection()
 {
 }
 
-void NetworkProcessConnection::didReceiveMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::MessageDecoder&)
+void NetworkProcessConnection::didReceiveMessage(CoreIPC::Connection* connection, CoreIPC::MessageID messageID, CoreIPC::MessageDecoder& decoder)
 {
+    if (messageID.is<CoreIPC::MessageClassNetworkProcessConnection>()) {
+        didReceiveNetworkProcessConnectionMessage(connection, messageID, decoder);
+        return;
+    }
+    ASSERT_NOT_REACHED();
 }
 
 void NetworkProcessConnection::didReceiveSyncMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::MessageDecoder&, OwnPtr<CoreIPC::MessageEncoder>&)
 {
+    ASSERT_NOT_REACHED();
 }
 
 void NetworkProcessConnection::didClose(CoreIPC::Connection*)
@@ -56,10 +62,14 @@ void NetworkProcessConnection::didClose(CoreIPC::Connection*)
     WebProcess::shared().networkProcessConnectionClosed(this);
 }
 
-void NetworkProcessConnection::didReceiveInvalidMessage(CoreIPC::Connection*, CoreIPC::MessageID)
+void NetworkProcessConnection::didReceiveInvalidMessage(CoreIPC::Connection*, CoreIPC::StringReference, CoreIPC::StringReference)
 {
 }
 
+void NetworkProcessConnection::startResourceLoad(ResourceLoadIdentifier resourceLoadIdentifier)
+{
+    WebProcess::shared().webResourceLoadScheduler().startResourceLoad(resourceLoadIdentifier);
+}
     
 } // namespace WebKit
 
diff --git a/Source/WebKit2/WebProcess/Network/NetworkProcessConnection.h b/Source/WebKit2/WebProcess/Network/NetworkProcessConnection.h
index 65e259843..6d6a98fdd 100644
--- a/Source/WebKit2/WebProcess/Network/NetworkProcessConnection.h
+++ b/Source/WebKit2/WebProcess/Network/NetworkProcessConnection.h
@@ -34,6 +34,8 @@
 
 namespace WebKit {
 
+typedef uint64_t ResourceLoadIdentifier;
+
 class NetworkProcessConnection : public RefCounted<NetworkProcessConnection>, CoreIPC::Connection::Client {
 public:
     static PassRefPtr<NetworkProcessConnection> create(CoreIPC::Connection::Identifier connectionIdentifier)
@@ -51,7 +53,11 @@ private:
     virtual void didReceiveMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::MessageDecoder&);
     virtual void didReceiveSyncMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::MessageDecoder&, OwnPtr<CoreIPC::MessageEncoder>&);
     virtual void didClose(CoreIPC::Connection*);
-    virtual void didReceiveInvalidMessage(CoreIPC::Connection*, CoreIPC::MessageID);
+    virtual void didReceiveInvalidMessage(CoreIPC::Connection*, CoreIPC::StringReference messageReceiverName, CoreIPC::StringReference messageName) OVERRIDE;
+
+    void didReceiveNetworkProcessConnectionMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::MessageDecoder&);
+
+    void startResourceLoad(ResourceLoadIdentifier);
 
     // The connection from the web process to the network process.
     RefPtr<CoreIPC::Connection> m_connection;
diff --git a/Source/WebKit2/WebProcess/Network/NetworkProcessConnection.messages.in b/Source/WebKit2/WebProcess/Network/NetworkProcessConnection.messages.in
new file mode 100644
index 000000000..69aeabb24
--- /dev/null
+++ b/Source/WebKit2/WebProcess/Network/NetworkProcessConnection.messages.in
@@ -0,0 +1,32 @@
+# Copyright (C) 2012 Apple Inc. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+# 1.  Redistributions of source code must retain the above copyright
+#     notice, this list of conditions and the following disclaimer.
+# 2.  Redistributions in binary form must reproduce the above copyright
+#     notice, this list of conditions and the following disclaimer in the
+#     documentation and/or other materials provided with the distribution.
+#
+# THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND
+# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+# WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+# DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR
+# ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+# SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+# CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+# OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+#if ENABLE(NETWORK_PROCESS)
+
+messages -> NetworkProcessConnection {
+
+    // FIXME (NetworkProcess): This message is for the NetworkProcess to tell the WebProcess to start a load.
+    // Once the NetworkProcess is doing the loading itself then we should remove it.
+    StartResourceLoad(uint64_t resourceLoadIdentifier)
+}
+
+#endif // ENABLE(NETWORK_PROCESS)
diff --git a/Source/WebKit2/WebProcess/Network/WebResourceLoadScheduler.cpp b/Source/WebKit2/WebProcess/Network/WebResourceLoadScheduler.cpp
new file mode 100644
index 000000000..def60e45a
--- /dev/null
+++ b/Source/WebKit2/WebProcess/Network/WebResourceLoadScheduler.cpp
@@ -0,0 +1,213 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WebResourceLoadScheduler.h"
+
+#include "Logging.h"
+#include "NetworkConnectionToWebProcessMessages.h"
+#include "NetworkProcessConnection.h"
+#include "WebCoreArgumentCoders.h"
+#include "WebProcess.h"
+#include <WebCore/DocumentLoader.h>
+#include <WebCore/Frame.h>
+#include <WebCore/FrameLoader.h>
+#include <WebCore/NetscapePlugInStreamLoader.h>
+#include <WebCore/ResourceLoader.h>
+#include <WebCore/SubresourceLoader.h>
+#include <wtf/text/CString.h>
+
+#if ENABLE(NETWORK_PROCESS)
+
+using namespace WebCore;
+
+namespace WebKit {
+
+WebResourceLoadScheduler::WebResourceLoadScheduler()
+    : m_suspendPendingRequestsCount(0)
+{
+}
+
+WebResourceLoadScheduler::~WebResourceLoadScheduler()
+{
+}
+
+PassRefPtr<SubresourceLoader> WebResourceLoadScheduler::scheduleSubresourceLoad(Frame* frame, CachedResource* resource, const ResourceRequest& request, ResourceLoadPriority priority, const ResourceLoaderOptions& options)
+{
+    RefPtr<SubresourceLoader> loader = SubresourceLoader::create(frame, resource, request, options);
+    if (loader)
+        scheduleLoad(loader.get(), priority);
+    return loader.release();
+}
+
+PassRefPtr<NetscapePlugInStreamLoader> WebResourceLoadScheduler::schedulePluginStreamLoad(Frame* frame, NetscapePlugInStreamLoaderClient* client, const ResourceRequest& request)
+{
+    RefPtr<NetscapePlugInStreamLoader> loader = NetscapePlugInStreamLoader::create(frame, client, request);
+    if (loader)
+        scheduleLoad(loader.get(), ResourceLoadPriorityLow);
+    return loader.release();
+}
+
+void WebResourceLoadScheduler::scheduleLoad(ResourceLoader* resourceLoader, ResourceLoadPriority priority)
+{
+    LOG(Network, "(WebProcess) WebResourceLoadScheduler::scheduleLoad, url '%s' priority %i", resourceLoader->url().string().utf8().data(), priority);
+
+    ASSERT(resourceLoader);
+    ASSERT(priority != ResourceLoadPriorityUnresolved);
+    priority = ResourceLoadPriorityHighest;
+
+    // If there's a web archive resource for this URL, we don't need to schedule the load since it will never touch the network.
+    if (resourceLoader->documentLoader()->archiveResourceForURL(resourceLoader->request().url())) {
+        startResourceLoader(resourceLoader);
+        return;
+    }
+    
+    ResourceLoadIdentifier identifier;
+    
+    ResourceRequest request = resourceLoader->request();
+    
+    // We want the network process involved in scheduling data URL loads but it doesn't need to know the full (often long) URL.
+    if (request.url().protocolIsData()) {
+        DEFINE_STATIC_LOCAL(KURL, dataURL, (KURL(), "data:"));
+        request.setURL(dataURL);
+    }
+
+    if (!WebProcess::shared().networkConnection()->connection()->sendSync(Messages::NetworkConnectionToWebProcess::ScheduleNetworkRequest(request, priority), Messages::NetworkConnectionToWebProcess::ScheduleNetworkRequest::Reply(identifier), 0)) {
+        // FIXME (NetworkProcess): What should we do if this fails?
+        ASSERT_NOT_REACHED();
+    }
+    
+    resourceLoader->setIdentifier(identifier);
+    m_pendingResourceLoaders.set(identifier, resourceLoader);
+    
+    notifyDidScheduleResourceRequest(resourceLoader);
+}
+
+void WebResourceLoadScheduler::addMainResourceLoad(ResourceLoader* resourceLoader)
+{
+    LOG(Network, "(WebProcess) WebResourceLoadScheduler::addMainResourceLoad, url '%s'", resourceLoader->url().string().utf8().data());
+
+    ResourceLoadIdentifier identifier;
+
+    if (!WebProcess::shared().networkConnection()->connection()->sendSync(Messages::NetworkConnectionToWebProcess::AddLoadInProgress(resourceLoader->url()), Messages::NetworkConnectionToWebProcess::AddLoadInProgress::Reply(identifier), 0)) {
+        // FIXME (NetworkProcess): What should we do if this fails?
+        ASSERT_NOT_REACHED();
+    }
+
+    resourceLoader->setIdentifier(identifier);
+    
+    m_activeResourceLoaders.set(identifier, resourceLoader);
+}
+
+void WebResourceLoadScheduler::remove(ResourceLoader* resourceLoader)
+{
+    ASSERT(resourceLoader);
+    LOG(Network, "(WebProcess) WebResourceLoadScheduler::remove, url '%s'", resourceLoader->url().string().utf8().data());
+
+    // FIXME (NetworkProcess): It's possible for a resourceLoader to be removed before it ever started,
+    // meaning before it even has an identifier.
+    // We should make this not be possible.
+    // The ResourceLoader code path should always for an identifier to ResourceLoaders.
+    
+    ResourceLoadIdentifier identifier = resourceLoader->identifier();
+    if (!identifier) {
+        LOG_ERROR("WebResourceLoadScheduler removing a ResourceLoader that has no identifier.");
+        return;
+    }
+    
+    WebProcess::shared().networkConnection()->connection()->send(Messages::NetworkConnectionToWebProcess::RemoveLoadIdentifier(identifier), 0);
+    
+    ASSERT(m_pendingResourceLoaders.contains(identifier) || m_activeResourceLoaders.contains(identifier));
+    m_pendingResourceLoaders.remove(identifier);
+    m_activeResourceLoaders.remove(identifier);
+}
+
+void WebResourceLoadScheduler::crossOriginRedirectReceived(ResourceLoader* resourceLoader, const KURL& redirectURL)
+{
+    LOG(Network, "(WebProcess) WebResourceLoadScheduler::crossOriginRedirectReceived. From '%s' to '%s'", resourceLoader->url().string().utf8().data(), redirectURL.string().utf8().data());
+
+    ASSERT(resourceLoader);
+    ASSERT(resourceLoader->identifier());
+
+    if (!WebProcess::shared().networkConnection()->connection()->sendSync(Messages::NetworkConnectionToWebProcess::crossOriginRedirectReceived(resourceLoader->identifier(), redirectURL), Messages::NetworkConnectionToWebProcess::crossOriginRedirectReceived::Reply(), 0)) {
+        // FIXME (NetworkProcess): What should we do if this fails?
+        ASSERT_NOT_REACHED();
+    }
+}
+
+void WebResourceLoadScheduler::servePendingRequests(ResourceLoadPriority minimumPriority)
+{
+    LOG(Network, "(WebProcess) WebResourceLoadScheduler::servePendingRequests");
+    
+    // If this WebProcess has its own request suspension count then we don't even
+    // have to bother messaging the NetworkProcess.
+    if (m_suspendPendingRequestsCount)
+        return;
+
+    WebProcess::shared().networkConnection()->connection()->send(Messages::NetworkConnectionToWebProcess::ServePendingRequests(minimumPriority), 0);
+}
+
+void WebResourceLoadScheduler::suspendPendingRequests()
+{
+    WebProcess::shared().networkConnection()->connection()->sendSync(Messages::NetworkConnectionToWebProcess::SuspendPendingRequests(), Messages::NetworkConnectionToWebProcess::SuspendPendingRequests::Reply(), 0);
+
+    ++m_suspendPendingRequestsCount;
+}
+
+void WebResourceLoadScheduler::resumePendingRequests()
+{
+    WebProcess::shared().networkConnection()->connection()->sendSync(Messages::NetworkConnectionToWebProcess::ResumePendingRequests(), Messages::NetworkConnectionToWebProcess::ResumePendingRequests::Reply(), 0);
+
+    ASSERT(m_suspendPendingRequestsCount);
+    --m_suspendPendingRequestsCount;
+}
+
+void WebResourceLoadScheduler::setSerialLoadingEnabled(bool enabled)
+{
+    WebProcess::shared().networkConnection()->connection()->sendSync(Messages::NetworkConnectionToWebProcess::SetSerialLoadingEnabled(enabled), Messages::NetworkConnectionToWebProcess::SetSerialLoadingEnabled::Reply(), 0);
+}
+
+void WebResourceLoadScheduler::startResourceLoad(ResourceLoadIdentifier identifier)
+{
+    RefPtr<ResourceLoader> loader = m_pendingResourceLoaders.take(identifier);
+    
+    // <rdar://problem/12596761> and http://webkit.org/b/100792
+    // There is a race condition where the WebProcess might tell the NetworkProcess to remove a resource load identifier
+    // at the very time the NetworkProcess is telling the WebProcess to start that particular load.
+    // We'd like to remove that race condition but it makes sense for release builds to do an early return.
+    ASSERT(loader);
+    if (!loader)
+        return;
+    
+    LOG(Network, "(WebProcess) WebResourceLoadScheduler::startResourceLoad starting load for '%s'", loader->url().string().utf8().data());
+
+    m_activeResourceLoaders.set(identifier, loader);
+
+    startResourceLoader(loader.get());
+}
+
+} // namespace WebKit
+
+#endif // ENABLE(NETWORK_PROCESS)
diff --git a/Source/WebKit2/WebProcess/Network/WebResourceLoadScheduler.h b/Source/WebKit2/WebProcess/Network/WebResourceLoadScheduler.h
new file mode 100644
index 000000000..422427bc6
--- /dev/null
+++ b/Source/WebKit2/WebProcess/Network/WebResourceLoadScheduler.h
@@ -0,0 +1,80 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebResourceLoadScheduler_h
+#define WebResourceLoadScheduler_h
+
+#include <WebCore/ResourceLoadPriority.h>
+#include <WebCore/ResourceLoadScheduler.h>
+#include <WebCore/ResourceLoader.h>
+
+#if ENABLE(NETWORK_PROCESS)
+
+namespace WebKit {
+
+class NetworkProcessConnection;
+typedef uint64_t ResourceLoadIdentifier;
+
+class WebResourceLoadScheduler : public WebCore::ResourceLoadScheduler {
+    WTF_MAKE_NONCOPYABLE(WebResourceLoadScheduler); WTF_MAKE_FAST_ALLOCATED;
+public:
+    WebResourceLoadScheduler();
+    virtual ~WebResourceLoadScheduler();
+    
+    virtual PassRefPtr<WebCore::SubresourceLoader> scheduleSubresourceLoad(WebCore::Frame*, WebCore::CachedResource*, const WebCore::ResourceRequest&, WebCore::ResourceLoadPriority, const WebCore::ResourceLoaderOptions&) OVERRIDE;
+    virtual PassRefPtr<WebCore::NetscapePlugInStreamLoader> schedulePluginStreamLoad(WebCore::Frame*, WebCore::NetscapePlugInStreamLoaderClient*, const WebCore::ResourceRequest&) OVERRIDE;
+    
+    virtual void addMainResourceLoad(WebCore::ResourceLoader*) OVERRIDE;
+    virtual void remove(WebCore::ResourceLoader*) OVERRIDE;
+    virtual void crossOriginRedirectReceived(WebCore::ResourceLoader*, const WebCore::KURL& redirectURL) OVERRIDE;
+    
+    virtual void servePendingRequests(WebCore::ResourceLoadPriority minimumPriority = WebCore::ResourceLoadPriorityVeryLow) OVERRIDE;
+
+    virtual void suspendPendingRequests() OVERRIDE;
+    virtual void resumePendingRequests() OVERRIDE;
+
+    virtual void setSerialLoadingEnabled(bool) OVERRIDE;
+
+private:
+    void scheduleLoad(WebCore::ResourceLoader*, WebCore::ResourceLoadPriority);
+
+    // NetworkProcessConnection gets to tell loads to actually start.
+    // FIXME (NetworkProcess): Once actual loading takes place in the NetworkProcess we won't need this.
+    friend class NetworkProcessConnection;
+    void startResourceLoad(ResourceLoadIdentifier);
+    
+    typedef HashMap<unsigned long, RefPtr<WebCore::ResourceLoader> > ResourceLoaderMap;
+    ResourceLoaderMap m_pendingResourceLoaders;
+    ResourceLoaderMap m_activeResourceLoaders;
+    
+    unsigned m_suspendPendingRequestsCount;
+
+};
+
+} // namespace WebKit
+
+#endif // ENABLE(NETWORK_PROCESS)
+
+#endif // WebResourceLoadScheduler_h
diff --git a/Source/WebKit2/WebProcess/NetworkInfo/WebNetworkInfoManager.cpp b/Source/WebKit2/WebProcess/NetworkInfo/WebNetworkInfoManager.cpp
index 631f02234..cba67fedb 100644
--- a/Source/WebKit2/WebProcess/NetworkInfo/WebNetworkInfoManager.cpp
+++ b/Source/WebKit2/WebProcess/NetworkInfo/WebNetworkInfoManager.cpp
@@ -28,6 +28,7 @@
 
 #if ENABLE(NETWORK_INFO)
 
+#include "WebNetworkInfoManagerMessages.h"
 #include "WebNetworkInfoManagerProxyMessages.h"
 #include "WebPage.h"
 #include "WebProcess.h"
@@ -42,6 +43,7 @@ namespace WebKit {
 WebNetworkInfoManager::WebNetworkInfoManager(WebProcess* process)
     : m_process(process)
 {
+    m_process->addMessageReceiver(Messages::WebNetworkInfoManager::messageReceiverName(), this);
 }
 
 WebNetworkInfoManager::~WebNetworkInfoManager()
diff --git a/Source/WebKit2/WebProcess/NetworkInfo/WebNetworkInfoManager.h b/Source/WebKit2/WebProcess/NetworkInfo/WebNetworkInfoManager.h
index dfe9afa95..ee3282f4f 100644
--- a/Source/WebKit2/WebProcess/NetworkInfo/WebNetworkInfoManager.h
+++ b/Source/WebKit2/WebProcess/NetworkInfo/WebNetworkInfoManager.h
@@ -28,24 +28,19 @@
 
 #if ENABLE(NETWORK_INFO)
 
-#include "MessageID.h"
+#include "MessageReceiver.h"
 #include "WebCoreArgumentCoders.h"
 #include "WebNetworkInfo.h"
 #include <wtf/HashSet.h>
 #include <wtf/Noncopyable.h>
 #include <wtf/text/AtomicString.h>
 
-namespace CoreIPC {
-class Connection;
-class MessageDecoder;
-}
-
 namespace WebKit {
 
 class WebProcess;
 class WebPage;
 
-class WebNetworkInfoManager {
+class WebNetworkInfoManager : private CoreIPC::MessageReceiver {
     WTF_MAKE_NONCOPYABLE(WebNetworkInfoManager);
 public:
     explicit WebNetworkInfoManager(WebProcess*);
@@ -56,10 +51,10 @@ public:
 
     double bandwidth(WebPage*) const;
     bool metered(WebPage*) const;
-
-    void didReceiveMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::MessageDecoder&);
-
 private:
+    // CoreIPC::MessageReceiver
+    void didReceiveMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::MessageDecoder&) OVERRIDE;
+
     // Implemented in generated WebNetworkInfoManagerMessageReceiver.cpp
     void didReceiveWebNetworkInfoManagerMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::MessageDecoder&);
 
diff --git a/Source/WebKit2/WebProcess/Notifications/WebNotificationManager.cpp b/Source/WebKit2/WebProcess/Notifications/WebNotificationManager.cpp
index fb42bcc43..35070e144 100644
--- a/Source/WebKit2/WebProcess/Notifications/WebNotificationManager.cpp
+++ b/Source/WebKit2/WebProcess/Notifications/WebNotificationManager.cpp
@@ -31,6 +31,7 @@
 
 #if ENABLE(NOTIFICATIONS) || ENABLE(LEGACY_NOTIFICATIONS)
 #include "WebNotification.h"
+#include "WebNotificationManagerMessages.h"
 #include "WebNotificationManagerProxyMessages.h"
 #include "WebPageProxyMessages.h"
 #include <WebCore/Document.h>
@@ -57,6 +58,9 @@ static uint64_t generateNotificationID()
 WebNotificationManager::WebNotificationManager(WebProcess* process)
     : m_process(process)
 {
+#if ENABLE(NOTIFICATIONS) || ENABLE(LEGACY_NOTIFICATIONS)
+    m_process->addMessageReceiver(Messages::WebNotificationManager::messageReceiverName(), this);
+#endif
 }
 
 WebNotificationManager::~WebNotificationManager()
@@ -170,7 +174,7 @@ void WebNotificationManager::cancel(Notification* notification, WebPage* page)
     if (!notificationID)
         return;
     
-    m_process->connection()->send(Messages::WebNotificationManagerProxy::Cancel(notificationID), page->pageID());
+    m_process->connection()->send(Messages::WebNotificationManagerProxy::Cancel(notificationID), 0);
 #else
     UNUSED_PARAM(notification);
     UNUSED_PARAM(page);
@@ -185,7 +189,7 @@ void WebNotificationManager::clearNotifications(WebCore::ScriptExecutionContext*
         return;
     
     Vector<uint64_t>& notificationIDs = it->value;
-    m_process->connection()->send(Messages::WebNotificationManagerProxy::ClearNotifications(notificationIDs), page->pageID());
+    m_process->connection()->send(Messages::WebNotificationManagerProxy::ClearNotifications(notificationIDs), 0);
     size_t count = notificationIDs.size();
     for (size_t i = 0; i < count; ++i) {
         RefPtr<Notification> notification = m_notificationIDMap.take(notificationIDs[i]);
@@ -211,7 +215,7 @@ void WebNotificationManager::didDestroyNotification(Notification* notification,
 
     m_notificationIDMap.remove(notificationID);
     removeNotificationFromContextMap(notificationID, notification);
-    m_process->connection()->send(Messages::WebNotificationManagerProxy::DidDestroyNotification(notificationID), page->pageID());
+    m_process->connection()->send(Messages::WebNotificationManagerProxy::DidDestroyNotification(notificationID), 0);
 #else
     UNUSED_PARAM(notification);
     UNUSED_PARAM(page);
diff --git a/Source/WebKit2/WebProcess/Notifications/WebNotificationManager.h b/Source/WebKit2/WebProcess/Notifications/WebNotificationManager.h
index a3f658f24..9f505aa90 100644
--- a/Source/WebKit2/WebProcess/Notifications/WebNotificationManager.h
+++ b/Source/WebKit2/WebProcess/Notifications/WebNotificationManager.h
@@ -26,7 +26,7 @@
 #ifndef WebNotificationManager_h
 #define WebNotificationManager_h
 
-#include "MessageID.h"
+#include "MessageReceiver.h"
 #include <WebCore/NotificationClient.h>
 #include <wtf/HashMap.h>
 #include <wtf/Noncopyable.h>
@@ -34,11 +34,6 @@
 #include <wtf/Vector.h>
 #include <wtf/text/StringHash.h>
 
-namespace CoreIPC {
-class Connection;
-class MessageDecoder;
-}
-
 namespace WebCore {
 class Notification;
 class SecurityOrigin;
@@ -49,7 +44,7 @@ namespace WebKit {
 class WebPage;
 class WebProcess;
 
-class WebNotificationManager {
+class WebNotificationManager : private CoreIPC::MessageReceiver {
     WTF_MAKE_NONCOPYABLE(WebNotificationManager);
 public:
     explicit WebNotificationManager(WebProcess*);
@@ -63,7 +58,6 @@ public:
     // This callback comes from WebCore, not messaged from the UI process.
     void didDestroyNotification(WebCore::Notification*, WebPage*);
 
-    void didReceiveMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::MessageDecoder&);
     void didUpdateNotificationDecision(const String& originString, bool allowed);
 
     // Looks in local cache for permission. If not found, returns DefaultDenied.
@@ -73,6 +67,9 @@ public:
     uint64_t notificationIDForTesting(WebCore::Notification*);
 
 private:
+    // CoreIPC::MessageReceiver
+    void didReceiveMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::MessageDecoder&) OVERRIDE;
+
     // Implemented in generated WebNotificationManagerMessageReceiver.cpp
     void didReceiveWebNotificationManagerMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::MessageDecoder&);
     
diff --git a/Source/WebKit2/WebProcess/Plugins/Netscape/NetscapeBrowserFuncs.cpp b/Source/WebKit2/WebProcess/Plugins/Netscape/NetscapeBrowserFuncs.cpp
index 27b10e726..5da43a7e4 100644
--- a/Source/WebKit2/WebProcess/Plugins/Netscape/NetscapeBrowserFuncs.cpp
+++ b/Source/WebKit2/WebProcess/Plugins/Netscape/NetscapeBrowserFuncs.cpp
@@ -52,12 +52,13 @@ namespace WebKit {
 class PluginDestructionProtector {
 public:
     explicit PluginDestructionProtector(NetscapePlugin* plugin)
-        : m_protector(static_cast<Plugin*>(plugin)->controller())
     {
+        if (plugin)
+            m_protector = adoptPtr(new PluginController::PluginDestructionProtector(static_cast<Plugin*>(plugin)->controller()));
     }
     
 private:
-    PluginController::PluginDestructionProtector m_protector;
+    OwnPtr<PluginController::PluginDestructionProtector> m_protector;
 };
 
 static bool startsWithBlankLine(const char* bytes, unsigned length)
@@ -272,8 +273,8 @@ static String makeURLString(const char* url)
     String urlString(url);
     
     // Strip return characters.
-    urlString.replace('\r', "");
-    urlString.replace('\n', "");
+    urlString.replaceWithLiteral('\r', "");
+    urlString.replaceWithLiteral('\n', "");
 
     return urlString;
 }
diff --git a/Source/WebKit2/WebProcess/Plugins/Netscape/NetscapePlugin.cpp b/Source/WebKit2/WebProcess/Plugins/Netscape/NetscapePlugin.cpp
index 374eb4414..3b9c6125b 100644
--- a/Source/WebKit2/WebProcess/Plugins/Netscape/NetscapePlugin.cpp
+++ b/Source/WebKit2/WebProcess/Plugins/Netscape/NetscapePlugin.cpp
@@ -112,12 +112,10 @@ NetscapePlugin::~NetscapePlugin()
 
 PassRefPtr<NetscapePlugin> NetscapePlugin::fromNPP(NPP npp)
 {
-    if (npp)
-        return static_cast<NetscapePlugin*>(npp->ndata);
+    if (!npp)
+        return 0;
 
-    // FIXME: Return the current NetscapePlugin here.
-    ASSERT_NOT_REACHED();
-    return 0;
+    return static_cast<NetscapePlugin*>(npp->ndata);
 }
 
 void NetscapePlugin::invalidate(const NPRect* invalidRect)
diff --git a/Source/WebKit2/WebProcess/Plugins/PDF/PDFLayerControllerDetails.h b/Source/WebKit2/WebProcess/Plugins/PDF/PDFLayerControllerDetails.h
new file mode 100644
index 000000000..6e7b52af2
--- /dev/null
+++ b/Source/WebKit2/WebProcess/Plugins/PDF/PDFLayerControllerDetails.h
@@ -0,0 +1,89 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#import <PDFKit/PDFKit.h>
+
+@protocol PDFLayerControllerDelegate <NSObject>
+
+- (void)updateScrollPosition:(CGPoint)newPosition;
+- (void)writeItemsToPasteboard:(NSArray *)items withTypes:(NSArray *)types;
+- (void)showDefinitionForAttributedString:(NSAttributedString *)string atPoint:(CGPoint)point;
+- (void)performWebSearch:(NSString *)string;
+- (void)openWithPreview;
+- (void)saveToPDF;
+
+- (void)pdfLayerController:(PDFLayerController *)pdfLayerController didChangeActiveAnnotation:(PDFAnnotation *)annotation;
+
+@end
+
+@interface PDFLayerController : NSObject
+@end
+
+@interface PDFLayerController (Details)
+
+@property(retain) CALayer *parentLayer;
+@property(retain) PDFDocument *document;
+@property(retain) id<PDFLayerControllerDelegate> delegate;
+
+- (void)setFrameSize:(CGSize)size;
+
+- (void)setDisplayMode:(int)mode;
+- (void)setDisplaysPageBreaks:(BOOL)pageBreaks;
+
+- (CGFloat)tileScaleFactor;
+- (void)setTileScaleFactor:(CGFloat)scaleFactor;
+
+- (CGSize)contentSize;
+- (CGSize)contentSizeRespectingZoom;
+
+- (void)snapshotInContext:(CGContextRef)context;
+
+- (void)magnifyWithMagnification:(CGFloat)magnification atPoint:(CGPoint)point immediately:(BOOL)immediately;
+
+- (CGPoint)scrollPosition;
+- (void)setScrollPosition:(CGPoint)newPosition;
+- (void)scrollWithDelta:(CGSize)delta;
+
+- (void)mouseDown:(NSEvent *)event;
+- (void)mouseMoved:(NSEvent *)event;
+- (void)mouseUp:(NSEvent *)event;
+- (void)mouseDragged:(NSEvent *)event;
+- (void)mouseEntered:(NSEvent *)event;
+- (void)mouseExited:(NSEvent *)event;
+
+- (NSArray *)findString:(NSString *)string caseSensitive:(BOOL)isCaseSensitive highlightMatches:(BOOL)shouldHighlightMatches;
+
+- (id)currentSelection;
+- (void)copySelection;
+- (void)selectAll;
+
+- (bool)keyDown:(NSEvent *)event;
+
+- (void)setHUDEnabled:(BOOL)enabled;
+- (BOOL)hudEnabled;
+
+- (CGRect)boundsForAnnotation:(PDFAnnotation *)annotation;
+
+@end
diff --git a/Source/WebKit2/WebProcess/Plugins/PDF/PDFPlugin.h b/Source/WebKit2/WebProcess/Plugins/PDF/PDFPlugin.h
index cd58d8721..d3641b66b 100644
--- a/Source/WebKit2/WebProcess/Plugins/PDF/PDFPlugin.h
+++ b/Source/WebKit2/WebProcess/Plugins/PDF/PDFPlugin.h
@@ -38,15 +38,18 @@ typedef const struct OpaqueJSContext* JSContextRef;
 typedef struct OpaqueJSValue* JSObjectRef;
 typedef const struct OpaqueJSValue* JSValueRef;
 
+OBJC_CLASS PDFAnnotation;
 OBJC_CLASS PDFLayerController;
 OBJC_CLASS WKPDFLayerControllerDelegate;
 
 namespace WebCore {
+class Element;
 struct PluginInfo;
 }
 
 namespace WebKit {
 
+class PDFPluginAnnotation;
 class PluginView;
 class WebFrame;
 
@@ -56,6 +59,7 @@ public:
     ~PDFPlugin();
 
     void paintControlForLayerInContext(CALayer *, CGContextRef);
+    void setActiveAnnotation(PDFAnnotation *);
     
     using ScrollableArea::notifyScrollPositionChanged;
 
@@ -77,13 +81,15 @@ private:
     virtual bool handleKeyboardEvent(const WebKeyboardEvent&) OVERRIDE;
     virtual bool handleEditingCommand(const String& commandName, const String& argument) OVERRIDE;
     virtual bool isEditingCommandEnabled(const String&) OVERRIDE;
-    virtual bool handlesPageScaleFactor() OVERRIDE { return true; }
+    virtual bool handlesPageScaleFactor() OVERRIDE;
 
     // ScrollableArea functions.
     virtual void setScrollOffset(const WebCore::IntPoint&) OVERRIDE;
     virtual void invalidateScrollbarRect(WebCore::Scrollbar*, const WebCore::IntRect&) OVERRIDE;
     virtual void invalidateScrollCornerRect(const WebCore::IntRect&) OVERRIDE;
 
+    bool supportsForms();
+
     RetainPtr<CALayer> m_containerLayer;
     RetainPtr<CALayer> m_contentLayer;
     RetainPtr<CALayer> m_horizontalScrollbarLayer;
@@ -91,6 +97,9 @@ private:
     RetainPtr<CALayer> m_scrollCornerLayer;
     RetainPtr<PDFLayerController> m_pdfLayerController;
     
+    RefPtr<PDFPluginAnnotation> m_activeAnnotation;
+    RefPtr<WebCore::Element> m_annotationContainer;
+
     WebCore::AffineTransform m_rootViewToPluginTransform;
     WebCore::IntPoint m_lastMousePoint;
     
diff --git a/Source/WebKit2/WebProcess/Plugins/PDF/PDFPlugin.mm b/Source/WebKit2/WebProcess/Plugins/PDF/PDFPlugin.mm
index c5a3469cd..b09c80b6c 100644
--- a/Source/WebKit2/WebProcess/Plugins/PDF/PDFPlugin.mm
+++ b/Source/WebKit2/WebProcess/Plugins/PDF/PDFPlugin.mm
@@ -29,6 +29,8 @@
 #import "PDFPlugin.h"
 
 #import "PDFKitImports.h"
+#import "PDFLayerControllerDetails.h"
+#import "PDFPluginAnnotation.h"
 #import "PluginView.h"
 #import "ShareableBitmap.h"
 #import "WebEvent.h"
@@ -36,12 +38,15 @@
 #import <PDFKit/PDFKit.h>
 #import <QuartzCore/QuartzCore.h>
 #import <WebCore/ArchiveResource.h>
+#import <WebCore/CSSPrimitiveValue.h>
+#import <WebCore/CSSPropertyNames.h>
 #import <WebCore/Chrome.h>
 #import <WebCore/DocumentLoader.h>
 #import <WebCore/FocusController.h>
 #import <WebCore/Frame.h>
 #import <WebCore/FrameView.h>
 #import <WebCore/GraphicsContext.h>
+#import <WebCore/HTMLElement.h>
 #import <WebCore/HTTPHeaderMap.h>
 #import <WebCore/LocalizedStrings.h>
 #import <WebCore/Page.h>
@@ -51,73 +56,35 @@
 #import <WebCore/ScrollAnimator.h>
 #import <WebCore/ScrollbarTheme.h>
 
-@protocol PDFLayerControllerDelegate <NSObject>
-
-- (void)updateScrollPosition:(CGPoint)newPosition;
-- (void)writeItemsToPasteboard:(NSArray *)items withTypes:(NSArray *)types;
-- (void)showDefinitionForAttributedString:(NSAttributedString *)string atPoint:(CGPoint)point;
-- (void)performWebSearch:(NSString *)string;
-- (void)openWithPreview;
-- (void)saveToPDF;
-
-@end
-
-@interface PDFLayerController : NSObject
-@end
-
-@interface PDFLayerController (Details)
-
-@property (retain) CALayer *parentLayer;
-@property (retain) PDFDocument *document;
-@property (retain) id<PDFLayerControllerDelegate> delegate;
-
-- (void)setFrameSize:(CGSize)size;
-
-- (void)setDisplayMode:(int)mode;
-- (void)setDisplaysPageBreaks:(BOOL)pageBreaks;
-
-- (CGFloat)tileScaleFactor;
-- (void)setTileScaleFactor:(CGFloat)scaleFactor;
-
-- (CGSize)contentSize;
-- (CGSize)contentSizeRespectingZoom;
-
-- (void)snapshotInContext:(CGContextRef)context;
-
-- (void)magnifyWithMagnification:(CGFloat)magnification atPoint:(CGPoint)point immediately:(BOOL)immediately;
-
-- (CGPoint)scrollPosition;
-- (void)setScrollPosition:(CGPoint)newPosition;
-- (void)scrollWithDelta:(CGSize)delta;
-
-- (void)mouseDown:(NSEvent *)event;
-- (void)mouseMoved:(NSEvent *)event;
-- (void)mouseUp:(NSEvent *)event;
-- (void)mouseDragged:(NSEvent *)event;
-- (void)mouseEntered:(NSEvent *)event;
-- (void)mouseExited:(NSEvent *)event;
-
-- (NSArray *)findString:(NSString *)string caseSensitive:(BOOL)isCaseSensitive highlightMatches:(BOOL)shouldHighlightMatches;
-
-- (id)currentSelection;
-- (void)copySelection;
-- (void)selectAll;
-
-- (bool)keyDown:(NSEvent *)event;
-
-- (void)setHUDEnabled:(BOOL)enabled;
-- (BOOL)hudEnabled;
-
-@end
-
 using namespace WebCore;
 
+// Set overflow: hidden on the annotation container so <input> elements scrolled out of view don't show
+// scrollbars on the body. We can't add annotations directly to the body, because overflow: hidden on the body
+// will break rubber-banding.
+static const char* annotationStyle =
+"#annotationContainer {"
+"    overflow: hidden; "
+"    position: absolute; "
+"    pointer-events: none; "
+"    top: 0; "
+"    left: 0; "
+"    right: 0; "
+"    bottom: 0; "
+"} "
+".annotation { "
+"    position: absolute; "
+"    pointer-events: auto; "
+"} "
+"textarea.annotation { "
+"    resize: none; "
+"}";
+
 @interface WKPDFPluginScrollbarLayer : CALayer
 {
     WebKit::PDFPlugin* _pdfPlugin;
 }
 
-@property (assign) WebKit::PDFPlugin* pdfPlugin;
+@property(assign) WebKit::PDFPlugin* pdfPlugin;
 
 @end
 
@@ -152,7 +119,7 @@ using namespace WebCore;
     WebKit::PDFPlugin* _pdfPlugin;
 }
 
-@property (assign) WebKit::PDFPlugin* pdfPlugin;
+@property(assign) WebKit::PDFPlugin* pdfPlugin;
 
 @end
 
@@ -208,10 +175,17 @@ using namespace WebCore;
     // FIXME: Implement.
 }
 
+- (void)pdfLayerController:(PDFLayerController *)pdfLayerController didChangeActiveAnnotation:(PDFAnnotation *)annotation
+{
+    _pdfPlugin->setActiveAnnotation(annotation);
+}
+
 @end
 
 namespace WebKit {
 
+using namespace HTMLNames;
+
 PassRefPtr<PDFPlugin> PDFPlugin::create(WebFrame* frame)
 {
     return adoptRef(new PDFPlugin(frame));
@@ -227,7 +201,19 @@ PDFPlugin::PDFPlugin(WebFrame* frame)
 {
     m_pdfLayerController.get().delegate = m_pdfLayerControllerDelegate.get();
     m_pdfLayerController.get().parentLayer = m_contentLayer.get();
-    
+
+    if (supportsForms()) {
+        Document* document = webFrame()->coreFrame()->document();
+        m_annotationContainer = document->createElement(divTag, false);
+        m_annotationContainer->setAttribute(idAttr, "annotationContainer");
+
+        RefPtr<Element> m_annotationStyle = document->createElement(styleTag, false);
+        m_annotationStyle->setTextContent(annotationStyle, ASSERT_NO_EXCEPTION);
+
+        m_annotationContainer->appendChild(m_annotationStyle.get());
+        document->body()->appendChild(m_annotationContainer.get());
+    }
+
     [m_containerLayer.get() addSublayer:m_contentLayer.get()];
     [m_containerLayer.get() addSublayer:m_scrollCornerLayer.get()];
 }
@@ -298,7 +284,10 @@ void PDFPlugin::pdfDocumentDidLoad()
     [m_pdfLayerController.get() setFrameSize:size()];
     m_pdfLayerController.get().document = document.get();
     
-    pluginView()->setPageScaleFactor([m_pdfLayerController.get() tileScaleFactor], IntPoint());
+    if (handlesPageScaleFactor())
+        pluginView()->setPageScaleFactor([m_pdfLayerController.get() tileScaleFactor], IntPoint());
+
+    notifyScrollPositionChanged(IntPoint([m_pdfLayerController.get() scrollPosition]));
 
     calculateSizes();
     updateScrollbars();
@@ -325,6 +314,9 @@ void PDFPlugin::destroy()
             frameView->removeScrollableArea(this);
     }
 
+    m_activeAnnotation = 0;
+    m_annotationContainer = 0;
+
     destroyScrollbar(HorizontalScrollbar);
     destroyScrollbar(VerticalScrollbar);
     
@@ -400,16 +392,24 @@ void PDFPlugin::geometryDidChange(const IntSize& pluginSize, const IntRect&, con
     [CATransaction begin];
     [CATransaction setDisableActions:YES];
     CATransform3D transform = CATransform3DMakeScale(1, -1, 1);
+    transform = CATransform3DTranslate(transform, 0, -pluginSize.height(), 0);
     
-    CGFloat magnification = pluginView()->pageScaleFactor() - [m_pdfLayerController.get() tileScaleFactor];
-    
-    // FIXME: Instead of m_lastMousePoint, we should use the zoom origin from PluginView::setPageScaleFactor.
-    [m_pdfLayerController.get() magnifyWithMagnification:magnification atPoint:m_lastMousePoint immediately:YES];
-    [m_contentLayer.get() setSublayerTransform:CATransform3DTranslate(transform, 0, -pluginSize.height(), 0)];
-    [CATransaction commit];
+    if (handlesPageScaleFactor()) {
+        CGFloat magnification = pluginView()->pageScaleFactor() - [m_pdfLayerController.get() tileScaleFactor];
+
+        // FIXME: Instead of m_lastMousePoint, we should use the zoom origin from PluginView::setPageScaleFactor.
+        if (magnification)
+            [m_pdfLayerController.get() magnifyWithMagnification:magnification atPoint:m_lastMousePoint immediately:YES];
+    }
 
     calculateSizes();
     updateScrollbars();
+
+    if (m_activeAnnotation)
+        m_activeAnnotation->updateGeometry();
+
+    [m_contentLayer.get() setSublayerTransform:transform];
+    [CATransaction commit];
 }
     
 static NSUInteger modifierFlagsFromWebEvent(const WebEvent& event)
@@ -561,7 +561,14 @@ bool PDFPlugin::isEditingCommandEnabled(const String& commandName)
 void PDFPlugin::setScrollOffset(const IntPoint& offset)
 {
     SimplePDFPlugin::setScrollOffset(offset);
+
+    [CATransaction begin];
     [m_pdfLayerController.get() setScrollPosition:offset];
+
+    if (m_activeAnnotation)
+        m_activeAnnotation->updateGeometry();
+
+    [CATransaction commit];
 }
 
 void PDFPlugin::invalidateScrollbarRect(Scrollbar* scrollbar, const IntRect& rect)
@@ -577,6 +584,32 @@ void PDFPlugin::invalidateScrollCornerRect(const IntRect& rect)
     [m_scrollCornerLayer.get() setNeedsDisplay];
 }
 
+bool PDFPlugin::handlesPageScaleFactor()
+{
+    return webFrame()->isMainFrame();
+}
+
+void PDFPlugin::setActiveAnnotation(PDFAnnotation *annotation)
+{
+    if (!supportsForms())
+        return;
+
+    if (m_activeAnnotation)
+        m_activeAnnotation->commit();
+
+    if (annotation) {
+        m_activeAnnotation = PDFPluginAnnotation::create(annotation, m_pdfLayerController.get(), this);
+        m_activeAnnotation->attach(m_annotationContainer.get());
+    } else
+        m_activeAnnotation = 0;
+}
+
+bool PDFPlugin::supportsForms()
+{
+    // FIXME: Should we support forms for inline PDFs? Since we touch the document, this might be difficult.
+    return webFrame()->isMainFrame();
+}
+
 } // namespace WebKit
 
 #endif // ENABLE(PDFKIT_PLUGIN)
diff --git a/Source/WebKit2/WebProcess/Plugins/PDF/PDFPluginAnnotation.h b/Source/WebKit2/WebProcess/Plugins/PDF/PDFPluginAnnotation.h
new file mode 100644
index 000000000..d6e3ee661
--- /dev/null
+++ b/Source/WebKit2/WebProcess/Plugins/PDF/PDFPluginAnnotation.h
@@ -0,0 +1,113 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef PDFPluginAnnotation_h
+#define PDFPluginAnnotation_h
+
+#if ENABLE(PDFKIT_PLUGIN)
+
+#include <WebCore/EventListener.h>
+#include <wtf/RefCounted.h>
+#include <wtf/RetainPtr.h>
+
+namespace WebCore {
+class Document;
+class Element;
+}
+
+OBJC_CLASS PDFAnnotation;
+OBJC_CLASS PDFLayerController;
+
+namespace WebKit {
+
+class PDFPlugin;
+
+class PDFPluginAnnotation : public RefCounted<PDFPluginAnnotation> {
+public:
+    static PassRefPtr<PDFPluginAnnotation> create(PDFAnnotation *, PDFLayerController *, PDFPlugin*);
+    virtual ~PDFPluginAnnotation();
+
+    WebCore::Element* element() const { return m_element.get(); }
+    PDFAnnotation *annotation() const { return m_annotation.get(); }
+    PDFPlugin* plugin() const { return m_plugin; }
+
+    virtual void updateGeometry();
+    virtual void commit() = 0;
+
+    void attach(WebCore::Element*);
+
+protected:
+    PDFPluginAnnotation(PDFAnnotation *annotation, PDFLayerController *pdfLayerController, PDFPlugin* plugin)
+        : m_annotation(annotation)
+        , m_eventListener(PDFPluginAnnotationEventListener::create(this))
+        , m_pdfLayerController(pdfLayerController)
+        , m_plugin(plugin)
+    {
+    }
+
+    WebCore::Element* parent() const { return m_parent; }
+    PDFLayerController *pdfLayerController() const { return m_pdfLayerController; }
+
+private:
+    virtual PassRefPtr<WebCore::Element> createAnnotationElement() = 0;
+
+    class PDFPluginAnnotationEventListener : public WebCore::EventListener {
+    public:
+        static PassRefPtr<PDFPluginAnnotationEventListener> create(PDFPluginAnnotation* annotation)
+        {
+            return adoptRef(new PDFPluginAnnotationEventListener(annotation));
+        }
+
+        virtual bool operator==(const EventListener& listener) OVERRIDE { return this == &listener; }
+
+    private:
+
+        PDFPluginAnnotationEventListener(PDFPluginAnnotation* annotation)
+            : WebCore::EventListener(WebCore::EventListener::CPPEventListenerType)
+            , m_annotation(annotation)
+        {
+        }
+
+        virtual void handleEvent(WebCore::ScriptExecutionContext*, WebCore::Event*) OVERRIDE;
+
+        PDFPluginAnnotation* m_annotation;
+    };
+
+    WebCore::Element* m_parent;
+
+    RefPtr<WebCore::Element> m_element;
+    RetainPtr<PDFAnnotation> m_annotation;
+
+    RefPtr<PDFPluginAnnotationEventListener> m_eventListener;
+
+    PDFLayerController *m_pdfLayerController;
+    PDFPlugin* m_plugin;
+};
+
+} // namespace WebKit
+
+#endif // ENABLE(PDFKIT_PLUGIN)
+
+#endif // PDFPluginAnnotation_h
diff --git a/Source/WebKit2/WebProcess/Plugins/PDF/PDFPluginAnnotation.mm b/Source/WebKit2/WebProcess/Plugins/PDF/PDFPluginAnnotation.mm
new file mode 100644
index 000000000..efbc19d0b
--- /dev/null
+++ b/Source/WebKit2/WebProcess/Plugins/PDF/PDFPluginAnnotation.mm
@@ -0,0 +1,112 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#if ENABLE(PDFKIT_PLUGIN)
+
+#import "config.h"
+#import "PDFPluginAnnotation.h"
+
+#import "PDFKitImports.h"
+#import "PDFLayerControllerDetails.h"
+#import "PDFPlugin.h"
+#import "PDFPluginChoiceAnnotation.h"
+#import "PDFPluginTextAnnotation.h"
+#import <PDFKit/PDFKit.h>
+#import <WebCore/CSSPrimitiveValue.h>
+#import <WebCore/CSSPropertyNames.h>
+#import <WebCore/ColorMac.h>
+#import <WebCore/HTMLElement.h>
+#import <WebCore/HTMLInputElement.h>
+#import <WebCore/HTMLNames.h>
+#import <WebCore/HTMLOptionElement.h>
+#import <WebCore/HTMLSelectElement.h>
+#import <WebCore/HTMLTextAreaElement.h>
+#import <WebCore/Page.h>
+
+using namespace WebCore;
+
+namespace WebKit {
+
+using namespace HTMLNames;
+
+PassRefPtr<PDFPluginAnnotation> PDFPluginAnnotation::create(PDFAnnotation *annotation, PDFLayerController *pdfLayerController, PDFPlugin* plugin)
+{
+    if ([annotation isKindOfClass:pdfAnnotationTextWidgetClass()])
+        return PDFPluginTextAnnotation::create(annotation, pdfLayerController, plugin);
+    if ([annotation isKindOfClass:pdfAnnotationChoiceWidgetClass()])
+        return PDFPluginChoiceAnnotation::create(annotation, pdfLayerController, plugin);
+
+    return 0;
+}
+
+void PDFPluginAnnotation::attach(Element* parent)
+{
+    ASSERT(!m_parent);
+
+    m_parent = parent;
+    m_element = createAnnotationElement();
+
+    m_element->setAttribute(classAttr, "annotation");
+    m_element->addEventListener("change", m_eventListener, false);
+    m_element->addEventListener("blur", m_eventListener, false);
+
+    updateGeometry();
+
+    m_parent->appendChild(m_element);
+
+    // FIXME: The text cursor doesn't blink after this. Why?
+    m_element->focus();
+}
+
+PDFPluginAnnotation::~PDFPluginAnnotation()
+{
+    m_element->removeEventListener(eventNames().changeEvent, m_eventListener.get(), false);
+    m_element->removeEventListener(eventNames().blurEvent, m_eventListener.get(), false);
+
+    m_parent->removeChild(element());
+}
+
+void PDFPluginAnnotation::updateGeometry()
+{
+    IntSize documentSize(m_pdfLayerController.contentSizeRespectingZoom);
+    IntPoint scrollPosition(m_pdfLayerController.scrollPosition);
+    NSRect annotationRect = NSRectFromCGRect([m_pdfLayerController boundsForAnnotation:m_annotation.get()]);
+
+    StyledElement* styledElement = static_cast<StyledElement*>(element());
+    styledElement->setInlineStyleProperty(CSSPropertyWidth, annotationRect.size.width, CSSPrimitiveValue::CSS_PX);
+    styledElement->setInlineStyleProperty(CSSPropertyHeight, annotationRect.size.height, CSSPrimitiveValue::CSS_PX);
+    styledElement->setInlineStyleProperty(CSSPropertyLeft, annotationRect.origin.x - scrollPosition.x(), CSSPrimitiveValue::CSS_PX);
+    styledElement->setInlineStyleProperty(CSSPropertyTop, documentSize.height() - annotationRect.origin.y - annotationRect.size.height - scrollPosition.y(), CSSPrimitiveValue::CSS_PX);
+}
+
+void PDFPluginAnnotation::PDFPluginAnnotationEventListener::handleEvent(ScriptExecutionContext*, Event* event)
+{
+    if (event->type() == eventNames().blurEvent || event->type() == eventNames().changeEvent)
+        m_annotation->plugin()->setActiveAnnotation(0);
+}
+
+} // namespace WebKit
+
+#endif // ENABLE(PDFKIT_PLUGIN)
diff --git a/Source/WebKit2/WebProcess/Plugins/PDF/PDFPluginChoiceAnnotation.h b/Source/WebKit2/WebProcess/Plugins/PDF/PDFPluginChoiceAnnotation.h
new file mode 100644
index 000000000..ea0e8308e
--- /dev/null
+++ b/Source/WebKit2/WebProcess/Plugins/PDF/PDFPluginChoiceAnnotation.h
@@ -0,0 +1,63 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef PDFPluginChoiceAnnotation_h
+#define PDFPluginChoiceAnnotation_h
+
+#if ENABLE(PDFKIT_PLUGIN)
+
+#include "PDFPluginAnnotation.h"
+
+namespace WebCore {
+class Element;
+}
+
+OBJC_CLASS PDFAnnotationChoiceWidget;
+
+namespace WebKit {
+
+class PDFPluginChoiceAnnotation : public PDFPluginAnnotation {
+public:
+    static PassRefPtr<PDFPluginChoiceAnnotation> create(PDFAnnotation *, PDFLayerController *, PDFPlugin*);
+
+    virtual void updateGeometry() OVERRIDE;
+    virtual void commit() OVERRIDE;
+
+private:
+    PDFPluginChoiceAnnotation(PDFAnnotation *annotation, PDFLayerController *pdfLayerController, PDFPlugin* plugin)
+        : PDFPluginAnnotation(annotation, pdfLayerController, plugin)
+    {
+    }
+
+    virtual PassRefPtr<WebCore::Element> createAnnotationElement() OVERRIDE;
+
+    PDFAnnotationChoiceWidget *choiceAnnotation() { return static_cast<PDFAnnotationChoiceWidget *>(annotation()); }
+};
+
+} // namespace WebKit
+
+#endif // ENABLE(PDFKIT_PLUGIN)
+
+#endif // PDFPluginChoiceAnnotation_h
diff --git a/Source/WebKit2/WebProcess/Plugins/PDF/PDFPluginChoiceAnnotation.mm b/Source/WebKit2/WebProcess/Plugins/PDF/PDFPluginChoiceAnnotation.mm
new file mode 100644
index 000000000..fe996967e
--- /dev/null
+++ b/Source/WebKit2/WebProcess/Plugins/PDF/PDFPluginChoiceAnnotation.mm
@@ -0,0 +1,99 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#if ENABLE(PDFKIT_PLUGIN)
+
+#import "config.h"
+#import "PDFPluginChoiceAnnotation.h"
+
+#import "PDFKitImports.h"
+#import "PDFLayerControllerDetails.h"
+#import <PDFKit/PDFKit.h>
+#import <WebCore/CSSPrimitiveValue.h>
+#import <WebCore/CSSPropertyNames.h>
+#import <WebCore/ColorMac.h>
+#import <WebCore/HTMLElement.h>
+#import <WebCore/HTMLNames.h>
+#import <WebCore/HTMLOptionElement.h>
+#import <WebCore/HTMLSelectElement.h>
+#import <WebCore/Page.h>
+
+using namespace WebCore;
+
+namespace WebKit {
+
+using namespace HTMLNames;
+
+PassRefPtr<PDFPluginChoiceAnnotation> PDFPluginChoiceAnnotation::create(PDFAnnotation *annotation, PDFLayerController *pdfLayerController, PDFPlugin* plugin)
+{
+    return adoptRef(new PDFPluginChoiceAnnotation(annotation, pdfLayerController, plugin));
+}
+
+void PDFPluginChoiceAnnotation::updateGeometry()
+{
+    PDFPluginAnnotation::updateGeometry();
+
+    StyledElement* styledElement = static_cast<StyledElement*>(element());
+    styledElement->setInlineStyleProperty(CSSPropertyFontSize, choiceAnnotation().font.pointSize * pdfLayerController().tileScaleFactor, CSSPrimitiveValue::CSS_PX);
+}
+
+void PDFPluginChoiceAnnotation::commit()
+{
+    choiceAnnotation().stringValue = static_cast<HTMLSelectElement*>(element())->value();
+}
+
+PassRefPtr<Element> PDFPluginChoiceAnnotation::createAnnotationElement()
+{
+    Document* document = parent()->ownerDocument();
+    PDFAnnotationChoiceWidget *choiceAnnotation = this->choiceAnnotation();
+
+    RefPtr<Element> element = document->createElement(selectTag, false);
+
+    StyledElement* styledElement = static_cast<StyledElement*>(element.get());
+
+    // FIXME: Match font weight and style as well?
+    styledElement->setInlineStyleProperty(CSSPropertyColor, colorFromNSColor(choiceAnnotation.fontColor).serialized());
+    styledElement->setInlineStyleProperty(CSSPropertyFontFamily, choiceAnnotation.font.familyName);
+
+    NSArray *choices = choiceAnnotation.choices;
+    NSString *selectedChoice = choiceAnnotation.stringValue;
+
+    for (NSString *choice in choices) {
+        RefPtr<Element> choiceOption = document->createElement(optionTag, false);
+        choiceOption->setAttribute(valueAttr, choice);
+        choiceOption->setTextContent(choice, ASSERT_NO_EXCEPTION);
+
+        if (choice == selectedChoice)
+            choiceOption->setAttribute(selectedAttr, "selected");
+
+        styledElement->appendChild(choiceOption);
+    }
+
+    return element;
+}
+
+} // namespace WebKit
+
+#endif // ENABLE(PDFKIT_PLUGIN)
diff --git a/Source/WebKit2/WebProcess/Plugins/PDF/PDFPluginTextAnnotation.h b/Source/WebKit2/WebProcess/Plugins/PDF/PDFPluginTextAnnotation.h
new file mode 100644
index 000000000..626628ebe
--- /dev/null
+++ b/Source/WebKit2/WebProcess/Plugins/PDF/PDFPluginTextAnnotation.h
@@ -0,0 +1,63 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef PDFPluginTextAnnotation_h
+#define PDFPluginTextAnnotation_h
+
+#if ENABLE(PDFKIT_PLUGIN)
+
+#include "PDFPluginAnnotation.h"
+
+namespace WebCore {
+class Element;
+}
+
+OBJC_CLASS PDFAnnotationTextWidget;
+
+namespace WebKit {
+
+class PDFPluginTextAnnotation : public PDFPluginAnnotation {
+public:
+    static PassRefPtr<PDFPluginTextAnnotation> create(PDFAnnotation *, PDFLayerController *, PDFPlugin*);
+
+    virtual void updateGeometry() OVERRIDE;
+    virtual void commit() OVERRIDE;
+
+private:
+    PDFPluginTextAnnotation(PDFAnnotation *annotation, PDFLayerController *pdfLayerController, PDFPlugin* plugin)
+        : PDFPluginAnnotation(annotation, pdfLayerController, plugin)
+    {
+    }
+
+    virtual PassRefPtr<WebCore::Element> createAnnotationElement() OVERRIDE;
+
+    PDFAnnotationTextWidget * textAnnotation() { return static_cast<PDFAnnotationTextWidget *>(annotation()); }
+};
+
+} // namespace WebKit
+
+#endif // ENABLE(PDFKIT_PLUGIN)
+
+#endif // PDFPluginTextAnnotation_h
diff --git a/Source/WebKit2/WebProcess/Plugins/PDF/PDFPluginTextAnnotation.mm b/Source/WebKit2/WebProcess/Plugins/PDF/PDFPluginTextAnnotation.mm
new file mode 100644
index 000000000..c94ea15f6
--- /dev/null
+++ b/Source/WebKit2/WebProcess/Plugins/PDF/PDFPluginTextAnnotation.mm
@@ -0,0 +1,125 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#if ENABLE(PDFKIT_PLUGIN)
+
+#import "config.h"
+#import "PDFPluginTextAnnotation.h"
+
+#import "PDFKitImports.h"
+#import "PDFLayerControllerDetails.h"
+#import <PDFKit/PDFKit.h>
+#import <WebCore/CSSPrimitiveValue.h>
+#import <WebCore/CSSPropertyNames.h>
+#import <WebCore/ColorMac.h>
+#import <WebCore/HTMLElement.h>
+#import <WebCore/HTMLInputElement.h>
+#import <WebCore/HTMLNames.h>
+#import <WebCore/HTMLTextAreaElement.h>
+#import <WebCore/Page.h>
+
+@interface PDFAnnotationTextWidget (Details)
+- (BOOL)isMultiline;
+@end
+
+using namespace WebCore;
+
+namespace WebKit {
+
+using namespace HTMLNames;
+
+static const String cssAlignmentValueForNSTextAlignment(NSTextAlignment alignment)
+{
+    switch (alignment) {
+    case NSLeftTextAlignment:
+        return "left";
+    case NSRightTextAlignment:
+        return "right";
+    case NSCenterTextAlignment:
+        return "center";
+    case NSJustifiedTextAlignment:
+        return "justify";
+    case NSNaturalTextAlignment:
+        return "-webkit-start";
+    }
+
+    ASSERT_NOT_REACHED();
+    return String();
+}
+
+PassRefPtr<PDFPluginTextAnnotation> PDFPluginTextAnnotation::create(PDFAnnotation *annotation, PDFLayerController *pdfLayerController, PDFPlugin* plugin)
+{
+    return adoptRef(new PDFPluginTextAnnotation(annotation, pdfLayerController, plugin));
+}
+
+PassRefPtr<Element> PDFPluginTextAnnotation::createAnnotationElement()
+{
+    RefPtr<Element> element;
+
+    Document* document = parent()->ownerDocument();
+    PDFAnnotationTextWidget *textAnnotation = this->textAnnotation();
+    bool isMultiline = textAnnotation.isMultiline;
+
+    if (isMultiline)
+        element = document->createElement(textareaTag, false);
+    else
+        element = document->createElement(inputTag, false);
+
+    StyledElement* styledElement = static_cast<StyledElement*>(element.get());
+
+    // FIXME: Match font weight and style as well?
+    styledElement->setInlineStyleProperty(CSSPropertyColor, colorFromNSColor(textAnnotation.fontColor).serialized());
+    styledElement->setInlineStyleProperty(CSSPropertyFontFamily, textAnnotation.font.familyName);
+    styledElement->setInlineStyleProperty(CSSPropertyTextAlign, cssAlignmentValueForNSTextAlignment(textAnnotation.alignment));
+
+    if (isMultiline)
+        static_cast<HTMLTextAreaElement*>(styledElement)->setValue(textAnnotation.stringValue);
+    else
+        static_cast<HTMLInputElement*>(styledElement)->setValue(textAnnotation.stringValue);
+
+    return element;
+}
+
+void PDFPluginTextAnnotation::updateGeometry()
+{
+    PDFPluginAnnotation::updateGeometry();
+
+    StyledElement* styledElement = static_cast<StyledElement*>(element());
+    styledElement->setInlineStyleProperty(CSSPropertyFontSize, textAnnotation().font.pointSize * pdfLayerController().tileScaleFactor, CSSPrimitiveValue::CSS_PX);
+}
+
+void PDFPluginTextAnnotation::commit()
+{
+    PDFAnnotationTextWidget *textAnnotation = this->textAnnotation();
+
+    if (textAnnotation.isMultiline)
+        textAnnotation.stringValue = static_cast<HTMLTextAreaElement*>(element())->value();
+    else
+        textAnnotation.stringValue = static_cast<HTMLInputElement*>(element())->value();
+}
+
+} // namespace WebKit
+
+#endif // ENABLE(PDFKIT_PLUGIN)
diff --git a/Source/WebKit2/WebProcess/Plugins/Plugin.cpp b/Source/WebKit2/WebProcess/Plugins/Plugin.cpp
index bc884b962..12e0b3d31 100644
--- a/Source/WebKit2/WebProcess/Plugins/Plugin.cpp
+++ b/Source/WebKit2/WebProcess/Plugins/Plugin.cpp
@@ -32,16 +32,16 @@ using namespace WebCore;
 
 namespace WebKit {
 
-void Plugin::Parameters::encode(CoreIPC::ArgumentEncoder* encoder) const
+void Plugin::Parameters::encode(CoreIPC::ArgumentEncoder& encoder) const
 {
-    encoder->encode(url.string());
-    encoder->encode(names);
-    encoder->encode(values);
-    encoder->encode(mimeType);
-    encoder->encode(isFullFramePlugin);
-    encoder->encode(shouldUseManualLoader);
+    encoder << url.string();
+    encoder << names;
+    encoder << values;
+    encoder << mimeType;
+    encoder << isFullFramePlugin;
+    encoder << shouldUseManualLoader;
 #if PLATFORM(MAC)
-    encoder->encodeEnum(layerHostingMode);
+    encoder.encodeEnum(layerHostingMode);
 #endif
 }
 
diff --git a/Source/WebKit2/WebProcess/Plugins/Plugin.h b/Source/WebKit2/WebProcess/Plugins/Plugin.h
index 98f8770c1..ded53d157 100644
--- a/Source/WebKit2/WebProcess/Plugins/Plugin.h
+++ b/Source/WebKit2/WebProcess/Plugins/Plugin.h
@@ -77,7 +77,7 @@ public:
         LayerHostingMode layerHostingMode;
 #endif
 
-        void encode(CoreIPC::ArgumentEncoder*) const;
+        void encode(CoreIPC::ArgumentEncoder&) const;
         static bool decode(CoreIPC::ArgumentDecoder*, Parameters&);
     };
 
diff --git a/Source/WebKit2/WebProcess/Plugins/PluginProcessConnection.cpp b/Source/WebKit2/WebProcess/Plugins/PluginProcessConnection.cpp
index fcfb249ad..648a51eb8 100644
--- a/Source/WebKit2/WebProcess/Plugins/PluginProcessConnection.cpp
+++ b/Source/WebKit2/WebProcess/Plugins/PluginProcessConnection.cpp
@@ -129,7 +129,7 @@ void PluginProcessConnection::didClose(CoreIPC::Connection*)
     }
 }
 
-void PluginProcessConnection::didReceiveInvalidMessage(CoreIPC::Connection*, CoreIPC::MessageID)
+void PluginProcessConnection::didReceiveInvalidMessage(CoreIPC::Connection*, CoreIPC::StringReference, CoreIPC::StringReference)
 {
 }
 
diff --git a/Source/WebKit2/WebProcess/Plugins/PluginProcessConnection.h b/Source/WebKit2/WebProcess/Plugins/PluginProcessConnection.h
index 2dc2cca59..bc6558ffd 100644
--- a/Source/WebKit2/WebProcess/Plugins/PluginProcessConnection.h
+++ b/Source/WebKit2/WebProcess/Plugins/PluginProcessConnection.h
@@ -67,7 +67,7 @@ private:
     virtual void didReceiveMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::MessageDecoder&) OVERRIDE;
     virtual void didReceiveSyncMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::MessageDecoder&, OwnPtr<CoreIPC::MessageEncoder>&) OVERRIDE;
     virtual void didClose(CoreIPC::Connection*);
-    virtual void didReceiveInvalidMessage(CoreIPC::Connection*, CoreIPC::MessageID);
+    virtual void didReceiveInvalidMessage(CoreIPC::Connection*, CoreIPC::StringReference messageReceiverName, CoreIPC::StringReference messageName) OVERRIDE;
 
     // Message handlers.
     void didReceiveSyncPluginProcessConnectionMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::MessageDecoder&, OwnPtr<CoreIPC::MessageEncoder>&);
diff --git a/Source/WebKit2/WebProcess/Plugins/PluginView.cpp b/Source/WebKit2/WebProcess/Plugins/PluginView.cpp
index d0a5e1e2c..e82704105 100644
--- a/Source/WebKit2/WebProcess/Plugins/PluginView.cpp
+++ b/Source/WebKit2/WebProcess/Plugins/PluginView.cpp
@@ -61,6 +61,7 @@
 #include <WebCore/SecurityPolicy.h>
 #include <WebCore/Settings.h>
 #include <WebCore/UserGestureIndicator.h>
+#include <wtf/text/StringBuilder.h>
 
 using namespace JSC;
 using namespace WebCore;
@@ -162,23 +163,22 @@ static String buildHTTPHeaders(const ResourceResponse& response, long long& expe
     if (!response.isHTTP())
         return String();
 
-    Vector<UChar> stringBuilder;
-    String separator(": ");
+    StringBuilder stringBuilder;
     
     String statusLine = String::format("HTTP %d ", response.httpStatusCode());
-    stringBuilder.append(statusLine.characters(), statusLine.length());
-    stringBuilder.append(response.httpStatusText().characters(), response.httpStatusText().length());
+    stringBuilder.append(statusLine);
+    stringBuilder.append(response.httpStatusText());
     stringBuilder.append('\n');
     
     HTTPHeaderMap::const_iterator end = response.httpHeaderFields().end();
     for (HTTPHeaderMap::const_iterator it = response.httpHeaderFields().begin(); it != end; ++it) {
-        stringBuilder.append(it->key.characters(), it->key.length());
-        stringBuilder.append(separator.characters(), separator.length());
-        stringBuilder.append(it->value.characters(), it->value.length());
+        stringBuilder.append(it->key);
+        stringBuilder.appendLiteral(": ");
+        stringBuilder.append(it->value);
         stringBuilder.append('\n');
     }
     
-    String headers = String::adopt(stringBuilder);
+    String headers = stringBuilder.toString();
     
     // If the content is encoded (most likely compressed), then don't send its length to the plugin,
     // which is only interested in the decoded length, not yet known at the moment.
diff --git a/Source/WebKit2/WebProcess/ResourceCache/WebResourceCacheManager.cpp b/Source/WebKit2/WebProcess/ResourceCache/WebResourceCacheManager.cpp
index 6810f0abd..395649c50 100644
--- a/Source/WebKit2/WebProcess/ResourceCache/WebResourceCacheManager.cpp
+++ b/Source/WebKit2/WebProcess/ResourceCache/WebResourceCacheManager.cpp
@@ -118,8 +118,7 @@ void WebResourceCacheManager::clearCacheForOrigin(SecurityOriginData originData,
 #if USE(CFURLCACHE)
     if (resourceCachesToClear != InMemoryResourceCachesOnly) { 
         RetainPtr<CFMutableArrayRef> hostArray(AdoptCF, CFArrayCreateMutable(0, 0, &kCFTypeArrayCallBacks));
-        RetainPtr<CFStringRef> host(AdoptCF, origin->host().createCFString());
-        CFArrayAppendValue(hostArray.get(), host.get());
+        CFArrayAppendValue(hostArray.get(), origin->host().createCFString().get());
 
         clearCFURLCacheForHostNames(hostArray.get());
     }
diff --git a/Source/WebKit2/WebProcess/WebConnectionToUIProcess.cpp b/Source/WebKit2/WebProcess/WebConnectionToUIProcess.cpp
index 538007d4f..9c142d8a8 100644
--- a/Source/WebKit2/WebProcess/WebConnectionToUIProcess.cpp
+++ b/Source/WebKit2/WebProcess/WebConnectionToUIProcess.cpp
@@ -51,7 +51,7 @@ WebConnectionToUIProcess::WebConnectionToUIProcess(WebProcess* process, CoreIPC:
 
 void WebConnectionToUIProcess::encodeMessageBody(CoreIPC::ArgumentEncoder& encoder, APIObject* messageBody)
 {
-    encoder.encode(InjectedBundleUserMessageEncoder(messageBody));
+    encoder << InjectedBundleUserMessageEncoder(messageBody);
 }
 
 bool WebConnectionToUIProcess::decodeMessageBody(CoreIPC::ArgumentDecoder& decoder, RefPtr<APIObject>& messageBody)
@@ -81,9 +81,9 @@ void WebConnectionToUIProcess::didClose(CoreIPC::Connection* connection)
     m_process->didClose(connection);
 }
 
-void WebConnectionToUIProcess::didReceiveInvalidMessage(CoreIPC::Connection* connection, CoreIPC::MessageID messageID)
+void WebConnectionToUIProcess::didReceiveInvalidMessage(CoreIPC::Connection* connection, CoreIPC::StringReference messageReceiverName, CoreIPC::StringReference messageName)
 {
-    m_process->didReceiveInvalidMessage(connection, messageID);
+    m_process->didReceiveInvalidMessage(connection, messageReceiverName, messageName);
 }
 
 #if PLATFORM(WIN)
diff --git a/Source/WebKit2/WebProcess/WebConnectionToUIProcess.h b/Source/WebKit2/WebProcess/WebConnectionToUIProcess.h
index af591115b..7f3f1fdb1 100644
--- a/Source/WebKit2/WebProcess/WebConnectionToUIProcess.h
+++ b/Source/WebKit2/WebProcess/WebConnectionToUIProcess.h
@@ -48,7 +48,7 @@ private:
     virtual void didReceiveMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::MessageDecoder&) OVERRIDE;
     virtual void didReceiveSyncMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::MessageDecoder&, OwnPtr<CoreIPC::MessageEncoder>&) OVERRIDE;
     virtual void didClose(CoreIPC::Connection*);
-    virtual void didReceiveInvalidMessage(CoreIPC::Connection*, CoreIPC::MessageID)  OVERRIDE;
+    virtual void didReceiveInvalidMessage(CoreIPC::Connection*, CoreIPC::StringReference messageReceiverName, CoreIPC::StringReference messageName) OVERRIDE;
 #if PLATFORM(WIN)
     virtual Vector<HWND> windowsToReceiveSentMessagesWhileWaitingForSyncReply();
 #endif
diff --git a/Source/WebKit2/WebProcess/WebCoreSupport/WebChromeClient.cpp b/Source/WebKit2/WebProcess/WebCoreSupport/WebChromeClient.cpp
index ac3daa908..3e7fe3294 100644
--- a/Source/WebKit2/WebProcess/WebCoreSupport/WebChromeClient.cpp
+++ b/Source/WebKit2/WebProcess/WebCoreSupport/WebChromeClient.cpp
@@ -473,19 +473,28 @@ void WebChromeClient::scrollRectIntoView(const IntRect&) const
 
 bool WebChromeClient::shouldUnavailablePluginMessageBeButton(RenderEmbeddedObject::PluginUnavailabilityReason pluginUnavailabilityReason) const
 {
-    if (pluginUnavailabilityReason == RenderEmbeddedObject::PluginMissing || pluginUnavailabilityReason == RenderEmbeddedObject::InsecurePluginVersion) {
+    switch (pluginUnavailabilityReason) {
+    case RenderEmbeddedObject::PluginMissing:
         // FIXME: <rdar://problem/8794397> We should only return true when there is a
         // missingPluginButtonClicked callback defined on the Page UI client.
+    case RenderEmbeddedObject::InsecurePluginVersion:
+    case RenderEmbeddedObject::PluginInactive:
         return true;
+
+
+    case RenderEmbeddedObject::PluginCrashed:
+    case RenderEmbeddedObject::PluginBlockedByContentSecurityPolicy:
+        return false;
     }
 
+    ASSERT_NOT_REACHED();
     return false;
 }
     
 void WebChromeClient::unavailablePluginButtonClicked(Element* element, RenderEmbeddedObject::PluginUnavailabilityReason pluginUnavailabilityReason) const
 {
     ASSERT(element->hasTagName(objectTag) || element->hasTagName(embedTag) || element->hasTagName(appletTag));
-    ASSERT(pluginUnavailabilityReason == RenderEmbeddedObject::PluginMissing || pluginUnavailabilityReason == RenderEmbeddedObject::InsecurePluginVersion);
+    ASSERT(pluginUnavailabilityReason == RenderEmbeddedObject::PluginMissing || pluginUnavailabilityReason == RenderEmbeddedObject::InsecurePluginVersion || pluginUnavailabilityReason == RenderEmbeddedObject::PluginInactive);
 
     HTMLPlugInImageElement* pluginElement = static_cast<HTMLPlugInImageElement*>(element);
 
diff --git a/Source/WebKit2/WebProcess/WebCoreSupport/WebFrameLoaderClient.cpp b/Source/WebKit2/WebProcess/WebCoreSupport/WebFrameLoaderClient.cpp
index 1a1206a4b..dd3e50926 100644
--- a/Source/WebKit2/WebProcess/WebCoreSupport/WebFrameLoaderClient.cpp
+++ b/Source/WebKit2/WebProcess/WebCoreSupport/WebFrameLoaderClient.cpp
@@ -201,6 +201,7 @@ bool WebFrameLoaderClient::shouldUseCredentialStorage(DocumentLoader*, unsigned
     return webPage->injectedBundleResourceLoadClient().shouldUseCredentialStorage(webPage, m_frame, identifier);
 }
 
+#if !PLATFORM(GTK)
 void WebFrameLoaderClient::dispatchDidReceiveAuthenticationChallenge(DocumentLoader*, unsigned long, const AuthenticationChallenge& challenge)
 {
     // FIXME: Authentication is a per-resource concept, but we don't do per-resource handling in the UIProcess at the API level quite yet.
@@ -212,6 +213,7 @@ void WebFrameLoaderClient::dispatchDidReceiveAuthenticationChallenge(DocumentLoa
 
     AuthenticationManager::shared().didReceiveAuthenticationChallenge(m_frame, challenge);
 }
+#endif
 
 void WebFrameLoaderClient::dispatchDidCancelAuthenticationChallenge(DocumentLoader*, unsigned long /*identifier*/, const AuthenticationChallenge&)    
 {
@@ -1234,6 +1236,11 @@ void WebFrameLoaderClient::transitionToCommittedForNewPage()
 
     m_frame->coreFrame()->createView(webPage->size(), backgroundColor, /* transparent */ false, IntSize(), currentFixedVisibleContentRect, shouldUseFixedLayout);
     m_frame->coreFrame()->view()->setTransparent(!webPage->drawsBackground());
+
+#if USE(TILED_BACKING_STORE)
+    m_frame->coreFrame()->view()->setDelegatesScrolling(shouldUseFixedLayout);
+    m_frame->coreFrame()->view()->setPaintsEntireContents(shouldUseFixedLayout);
+#endif
 }
 
 void WebFrameLoaderClient::didSaveToPageCache()
diff --git a/Source/WebKit2/WebProcess/WebCoreSupport/WebPlatformStrategies.cpp b/Source/WebKit2/WebProcess/WebCoreSupport/WebPlatformStrategies.cpp
index 62f900400..f12b85196 100644
--- a/Source/WebKit2/WebProcess/WebCoreSupport/WebPlatformStrategies.cpp
+++ b/Source/WebKit2/WebProcess/WebCoreSupport/WebPlatformStrategies.cpp
@@ -37,6 +37,7 @@
 #include "WebProcessProxyMessages.h"
 #include <WebCore/Color.h>
 #include <WebCore/KURL.h>
+#include <WebCore/LoaderStrategy.h>
 #include <WebCore/Page.h>
 #include <WebCore/PlatformPasteboard.h>
 #include <wtf/Atomics.h>
@@ -68,17 +69,27 @@ CookiesStrategy* WebPlatformStrategies::createCookiesStrategy()
     return this;
 }
 
+LoaderStrategy* WebPlatformStrategies::createLoaderStrategy()
+{
+    return this;
+}
+
+PasteboardStrategy* WebPlatformStrategies::createPasteboardStrategy()
+{
+    return this;
+}
+
 PluginStrategy* WebPlatformStrategies::createPluginStrategy()
 {
     return this;
 }
 
-VisitedLinkStrategy* WebPlatformStrategies::createVisitedLinkStrategy()
+SharedWorkerStrategy* WebPlatformStrategies::createSharedWorkerStrategy()
 {
     return this;
 }
 
-PasteboardStrategy* WebPlatformStrategies::createPasteboardStrategy()
+VisitedLinkStrategy* WebPlatformStrategies::createVisitedLinkStrategy()
 {
     return this;
 }
@@ -90,6 +101,23 @@ void WebPlatformStrategies::notifyCookiesChanged()
     WebCookieManager::shared().dispatchCookiesDidChange();
 }
 
+// LoaderStrategy
+
+#if ENABLE(NETWORK_PROCESS)
+ResourceLoadScheduler* WebPlatformStrategies::resourceLoadScheduler()
+{
+    static ResourceLoadScheduler* scheduler;
+    if (!scheduler) {
+        if (WebProcess::shared().usesNetworkProcess())
+            scheduler = &WebProcess::shared().webResourceLoadScheduler();
+        else
+            scheduler = WebCore::resourceLoadScheduler();
+    }
+    
+    return scheduler;
+}
+#endif
+
 // PluginStrategy
 
 void WebPlatformStrategies::refreshPlugins()
diff --git a/Source/WebKit2/WebProcess/WebCoreSupport/WebPlatformStrategies.h b/Source/WebKit2/WebProcess/WebCoreSupport/WebPlatformStrategies.h
index dfbcc334c..bb644b1ab 100644
--- a/Source/WebKit2/WebProcess/WebCoreSupport/WebPlatformStrategies.h
+++ b/Source/WebKit2/WebProcess/WebCoreSupport/WebPlatformStrategies.h
@@ -29,14 +29,16 @@
 #if USE(PLATFORM_STRATEGIES)
 
 #include <WebCore/CookiesStrategy.h>
+#include <WebCore/LoaderStrategy.h>
 #include <WebCore/PasteboardStrategy.h>
 #include <WebCore/PlatformStrategies.h>
 #include <WebCore/PluginStrategy.h>
+#include <WebCore/SharedWorkerStrategy.h>
 #include <WebCore/VisitedLinkStrategy.h>
 
 namespace WebKit {
 
-class WebPlatformStrategies : public WebCore::PlatformStrategies, private WebCore::CookiesStrategy, private WebCore::PluginStrategy, private WebCore::VisitedLinkStrategy, private WebCore::PasteboardStrategy {
+class WebPlatformStrategies : public WebCore::PlatformStrategies, private WebCore::CookiesStrategy, private WebCore::LoaderStrategy, private WebCore::PasteboardStrategy, private WebCore::PluginStrategy, private WebCore::SharedWorkerStrategy, private WebCore::VisitedLinkStrategy {
 public:
     static void initialize();
     
@@ -45,13 +47,20 @@ private:
     
     // WebCore::PlatformStrategies
     virtual WebCore::CookiesStrategy* createCookiesStrategy() OVERRIDE;
+    virtual WebCore::LoaderStrategy* createLoaderStrategy() OVERRIDE;
+    virtual WebCore::PasteboardStrategy* createPasteboardStrategy() OVERRIDE;
     virtual WebCore::PluginStrategy* createPluginStrategy() OVERRIDE;
+    virtual WebCore::SharedWorkerStrategy* createSharedWorkerStrategy() OVERRIDE;
     virtual WebCore::VisitedLinkStrategy* createVisitedLinkStrategy() OVERRIDE;
-    virtual WebCore::PasteboardStrategy* createPasteboardStrategy() OVERRIDE;
 
     // WebCore::CookiesStrategy
     virtual void notifyCookiesChanged() OVERRIDE;
 
+    // WebCore::LoaderStrategy
+#if ENABLE(NETWORK_PROCESS)
+    virtual WebCore::ResourceLoadScheduler* resourceLoadScheduler() OVERRIDE;
+#endif
+
     // WebCore::PluginStrategy
     virtual void refreshPlugins() OVERRIDE;
     virtual void getPluginInfo(const WebCore::Page*, Vector<WebCore::PluginInfo>&) OVERRIDE;
diff --git a/Source/WebKit2/WebProcess/WebCoreSupport/efl/WebEditorClientEfl.cpp b/Source/WebKit2/WebProcess/WebCoreSupport/efl/WebEditorClientEfl.cpp
index 22a5cf453..8dc90d00d 100644
--- a/Source/WebKit2/WebProcess/WebCoreSupport/efl/WebEditorClientEfl.cpp
+++ b/Source/WebKit2/WebProcess/WebCoreSupport/efl/WebEditorClientEfl.cpp
@@ -27,12 +27,15 @@
 #include "WebEditorClient.h"
 
 #include "Frame.h"
+#include "NativeWebKeyboardEvent.h"
 #include "PlatformKeyboardEvent.h"
 #include "WebPage.h"
 #include "WebPageProxyMessages.h"
 #include "WebProcess.h"
+#include <WebCore/FocusController.h>
 #include <WebCore/KeyboardEvent.h>
 #include <WebCore/NotImplemented.h>
+#include <WebCore/Page.h>
 
 using namespace WebCore;
 
@@ -44,9 +47,18 @@ void WebEditorClient::handleKeyboardEvent(KeyboardEvent* event)
         event->setDefaultHandled();
 }
 
-void WebEditorClient::handleInputMethodKeydown(KeyboardEvent*)
+void WebEditorClient::handleInputMethodKeydown(KeyboardEvent* event)
 {
-    notImplemented();
+    Frame* frame = m_page->corePage()->focusController()->focusedOrMainFrame();
+    if (!frame || !frame->editor()->canEdit())
+        return;
+
+    // FIXME: sending sync message might make input lagging.
+    bool handled = false;
+    m_page->sendSync(Messages::WebPageProxy::HandleInputMethodKeydown(), Messages::WebPageProxy::HandleInputMethodKeydown::Reply(handled));
+
+    if (handled)
+        event->setDefaultHandled();
 }
 
 }
diff --git a/Source/WebKit2/WebProcess/WebCoreSupport/gtk/WebFrameLoaderClientGtk.cpp b/Source/WebKit2/WebProcess/WebCoreSupport/gtk/WebFrameLoaderClientGtk.cpp
new file mode 100644
index 000000000..a6ff36e5f
--- /dev/null
+++ b/Source/WebKit2/WebProcess/WebCoreSupport/gtk/WebFrameLoaderClientGtk.cpp
@@ -0,0 +1,43 @@
+/*
+ * Copyright (C) 2012, Igalia S.L.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY IGALIA S.L. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+#include "config.h"
+#include "WebFrameLoaderClient.h"
+
+#include <WebCore/AuthenticationChallenge.h>
+#include <WebCore/GtkAuthenticationDialog.h>
+#include <WebCore/ResourceHandle.h>
+
+namespace WebKit {
+
+using WebCore::GtkAuthenticationDialog;
+using WebCore::AuthenticationChallenge;
+
+void WebFrameLoaderClient::dispatchDidReceiveAuthenticationChallenge(WebCore::DocumentLoader*, unsigned long, const AuthenticationChallenge& challenge)
+{
+    GtkAuthenticationDialog* dialog = new GtkAuthenticationDialog(0, challenge);
+    dialog->show();
+}
+
+} // namespace WebKit
diff --git a/Source/WebKit2/WebProcess/WebCoreSupport/mac/WebSystemInterface.mm b/Source/WebKit2/WebProcess/WebCoreSupport/mac/WebSystemInterface.mm
index aef59ca86..08db0ad3b 100644
--- a/Source/WebKit2/WebProcess/WebCoreSupport/mac/WebSystemInterface.mm
+++ b/Source/WebKit2/WebProcess/WebCoreSupport/mac/WebSystemInterface.mm
@@ -100,7 +100,6 @@ void InitWebCoreSystemInterface(void)
         INIT(SetCGFontRenderingMode);
         INIT(SetCONNECTProxyAuthorizationForStream);
         INIT(SetCONNECTProxyForStream);
-        INIT(SetCookieStoragePrivateBrowsingEnabled);
         INIT(SetDragImage);
         INIT(SetHTTPPipeliningMaximumPriority);
         INIT(SetHTTPPipeliningPriority);
@@ -117,8 +116,10 @@ void InitWebCoreSystemInterface(void)
         INIT(CopyHTTPCookieStorage);
         INIT(GetHTTPCookieAcceptPolicy);
         INIT(SetHTTPCookieAcceptPolicy);
+        INIT(HTTPCookies);
         INIT(HTTPCookiesForURL);
         INIT(SetHTTPCookiesForURL);
+        INIT(DeleteAllHTTPCookies);
         INIT(DeleteHTTPCookie);
 
         INIT(SetMetadataURL);
@@ -192,5 +193,17 @@ void InitWebCoreSystemInterface(void)
         INIT(NSReboundDeltaForElasticDelta);
 #endif
 
+        INIT(CaptionAppearanceHasUserPreferences);
+        INIT(CaptionAppearanceShowCaptionsWhenAvailable);
+        INIT(CaptionAppearanceCopyForegroundColor);
+        INIT(CaptionAppearanceCopyBackgroundColor);
+        INIT(CaptionAppearanceCopyWindowColor);
+        INIT(CaptionAppearanceGetForegroundOpacity);
+        INIT(CaptionAppearanceGetBackgroundOpacity);
+        INIT(CaptionAppearanceGetWindowOpacity);
+        INIT(CaptionAppearanceCopyFontForStyle);
+        INIT(CaptionAppearanceGetRelativeCharacterSize);
+        INIT(CaptionAppearanceGetTextEdgeStyle);
+        INIT(CaptionAppearanceGetSettingsChangedNotification);
     });
 }
diff --git a/Source/WebKit2/WebProcess/WebKitMain.cpp b/Source/WebKit2/WebProcess/WebKitMain.cpp
index c3fa98ebe..0d2a0e193 100644
--- a/Source/WebKit2/WebProcess/WebKitMain.cpp
+++ b/Source/WebKit2/WebProcess/WebKitMain.cpp
@@ -60,11 +60,9 @@ static int WebKitMain(const CommandLine& commandLine)
         case ProcessLauncher::PluginProcess:
             return PluginProcessMain(commandLine);
 #endif
-        case ProcessLauncher::NetworkProcess:
 #if ENABLE(NETWORK_PROCESS)
+        case ProcessLauncher::NetworkProcess:
             return NetworkProcessMain(commandLine);
-#else
-            break;
 #endif
 #if ENABLE(SHARED_WORKER_PROCESS)
         case ProcessLauncher::SharedWorkerProcess:
diff --git a/Source/WebKit2/WebProcess/WebPage/CoordinatedGraphics/CoordinatedGraphicsLayer.cpp b/Source/WebKit2/WebProcess/WebPage/CoordinatedGraphics/CoordinatedGraphicsLayer.cpp
index 79c8eec5c..26e48d61c 100644
--- a/Source/WebKit2/WebProcess/WebPage/CoordinatedGraphics/CoordinatedGraphicsLayer.cpp
+++ b/Source/WebKit2/WebProcess/WebPage/CoordinatedGraphics/CoordinatedGraphicsLayer.cpp
@@ -47,15 +47,6 @@ static HashMap<WebLayerID, CoordinatedGraphicsLayer*>& layerByIDMap()
     return globalMap;
 }
 
-CoordinatedGraphicsLayer* CoordinatedGraphicsLayer::layerByID(WebKit::WebLayerID id)
-{
-    HashMap<WebLayerID, CoordinatedGraphicsLayer*>& table = layerByIDMap();
-    HashMap<WebLayerID, CoordinatedGraphicsLayer*>::iterator it = table.find(id);
-    if (it == table.end())
-        return 0;
-    return it->value;
-}
-
 static WebLayerID toWebLayerID(GraphicsLayer* layer)
 {
     return layer ? toCoordinatedGraphicsLayer(layer)->id() : 0;
@@ -68,9 +59,9 @@ void CoordinatedGraphicsLayer::didChangeLayerState()
         client()->notifyFlushRequired(this);
 }
 
-void CoordinatedGraphicsLayer::didChangeAnimatedProperties()
+void CoordinatedGraphicsLayer::didChangeAnimations()
 {
-    m_shouldSyncAnimatedProperties = true;
+    m_shouldSyncAnimations = true;
     if (client())
         client()->notifyFlushRequired(this);
 }
@@ -93,9 +84,6 @@ void CoordinatedGraphicsLayer::didChangeFilters()
 
 void CoordinatedGraphicsLayer::setShouldUpdateVisibleRect()
 {
-    if (!transform().isAffine())
-        return;
-
     m_shouldUpdateVisibleRect = true;
     for (size_t i = 0; i < children().size(); ++i)
         toCoordinatedGraphicsLayer(children()[i])->setShouldUpdateVisibleRect();
@@ -117,7 +105,7 @@ CoordinatedGraphicsLayer::CoordinatedGraphicsLayer(GraphicsLayerClient* client)
     , m_shouldSyncLayerState(true)
     , m_shouldSyncChildren(true)
     , m_shouldSyncFilters(true)
-    , m_shouldSyncAnimatedProperties(true)
+    , m_shouldSyncAnimations(true)
     , m_fixedToViewport(false)
     , m_canvasNeedsDisplay(false)
     , m_CoordinatedGraphicsLayerClient(0)
@@ -141,11 +129,6 @@ CoordinatedGraphicsLayer::~CoordinatedGraphicsLayer()
     willBeDestroyed();
 }
 
-void CoordinatedGraphicsLayer::willBeDestroyed()
-{
-    GraphicsLayer::willBeDestroyed();
-}
-
 bool CoordinatedGraphicsLayer::setChildren(const Vector<GraphicsLayer*>& children)
 {
     bool ok = GraphicsLayer::setChildren(children);
@@ -493,32 +476,23 @@ void CoordinatedGraphicsLayer::syncLayerState()
     m_layerInfo.mask = toWebLayerID(maskLayer());
     m_layerInfo.masksToBounds = masksToBounds();
     m_layerInfo.opacity = opacity();
-    m_layerInfo.parent = toWebLayerID(parent());
     m_layerInfo.pos = position();
     m_layerInfo.preserves3D = preserves3D();
     m_layerInfo.replica = toWebLayerID(replicaLayer());
     m_layerInfo.size = size();
     m_layerInfo.transform = transform();
-    if (!m_animations.hasActiveAnimationsOfType(AnimatedPropertyWebkitTransform))
-        m_effectiveTransform = transform();
-    if (!m_animations.hasActiveAnimationsOfType(AnimatedPropertyOpacity))
-        m_effectiveOpacity = opacity();
     m_CoordinatedGraphicsLayerClient->syncLayerState(m_id, m_layerInfo);
 }
 
-void CoordinatedGraphicsLayer::syncAnimatedProperties()
+void CoordinatedGraphicsLayer::syncAnimations()
 {
-    m_animations.apply(this);
-    if (!m_shouldSyncAnimatedProperties)
+    if (!m_shouldSyncAnimations)
         return;
 
-    m_shouldSyncAnimatedProperties = false;
-    if (m_effectiveOpacity != opacity())
-        m_CoordinatedGraphicsLayerClient->setLayerAnimatedOpacity(id(), m_effectiveOpacity);
-    if (m_effectiveTransform != transform())
-        m_CoordinatedGraphicsLayerClient->setLayerAnimatedTransform(id(), m_effectiveTransform);
-}
+    m_shouldSyncAnimations = false;
 
+    m_CoordinatedGraphicsLayerClient->setLayerAnimations(m_id, m_animations);
+}
 
 void CoordinatedGraphicsLayer::syncCanvas()
 {
@@ -550,7 +524,7 @@ void CoordinatedGraphicsLayer::flushCompositingStateForThisLayerOnly()
     // The remote image might have been released by purgeBackingStores.
     ensureImageBackingStore();
     syncLayerState();
-    syncAnimatedProperties();
+    syncAnimations();
     computeTransformedVisibleRect();
     syncChildren();
 #if ENABLE(CSS_FILTERS)
@@ -662,9 +636,9 @@ Color CoordinatedGraphicsLayer::tiledBackingStoreBackgroundColor() const
     return contentsOpaque() ? Color::white : Color::transparent;
 }
 
-PassOwnPtr<WebCore::GraphicsContext> CoordinatedGraphicsLayer::beginContentUpdate(const WebCore::IntSize& size, ShareableSurface::Handle& handle, WebCore::IntPoint& offset)
+PassOwnPtr<WebCore::GraphicsContext> CoordinatedGraphicsLayer::beginContentUpdate(const WebCore::IntSize& size, int& atlas, WebCore::IntPoint& offset)
 {
-    return m_CoordinatedGraphicsLayerClient->beginContentUpdate(size, contentsOpaque() ? 0 : ShareableBitmap::SupportsAlpha, handle, offset);
+    return m_CoordinatedGraphicsLayerClient->beginContentUpdate(size, contentsOpaque() ? 0 : ShareableBitmap::SupportsAlpha, atlas, offset);
 }
 
 void CoordinatedGraphicsLayer::createTile(int tileID, const SurfaceUpdateInfo& updateInfo, const IntRect& targetRect)
@@ -749,12 +723,30 @@ void CoordinatedGraphicsLayer::adjustVisibleRect()
         m_mainBackingStore->coverWithTilesIfNeeded();
 }
 
+bool CoordinatedGraphicsLayer::hasPendingVisibleChanges()
+{
+    if (opacity() < 0.01 && !m_animations.hasActiveAnimationsOfType(AnimatedPropertyOpacity))
+        return false;
+
+    for (size_t i = 0; i < children().size(); ++i) {
+        if (toCoordinatedGraphicsLayer(children()[i])->hasPendingVisibleChanges())
+            return true;
+    }
+
+    if (!m_shouldSyncLayerState && !m_shouldSyncChildren && !m_shouldSyncFilters && !m_shouldSyncAnimations && !m_canvasNeedsDisplay)
+        return false;
+
+    return selfOrAncestorHaveNonAffineTransforms() || !tiledBackingStoreVisibleRect().isEmpty();
+
+}
+
 void CoordinatedGraphicsLayer::computeTransformedVisibleRect()
 {
     if (!m_shouldUpdateVisibleRect)
         return;
+
     m_shouldUpdateVisibleRect = false;
-    m_layerTransform.setLocalTransform(m_effectiveTransform);
+    m_layerTransform.setLocalTransform(transform());
     m_layerTransform.setPosition(position());
     m_layerTransform.setAnchorPoint(anchorPoint());
     m_layerTransform.setSize(size());
@@ -779,13 +771,16 @@ void CoordinatedGraphicsLayer::initFactory()
 
 bool CoordinatedGraphicsLayer::selfOrAncestorHaveNonAffineTransforms()
 {
+    if (m_animations.hasActiveAnimationsOfType(AnimatedPropertyWebkitTransform))
+        return true;
+
     if (!m_layerTransform.combined().isAffine())
         return true;
 
     return false;
 }
 
-bool CoordinatedGraphicsLayer::addAnimation(const KeyframeValueList& valueList, const IntSize& boxSize, const Animation* anim, const String& keyframesName, double timeOffset)
+bool CoordinatedGraphicsLayer::addAnimation(const KeyframeValueList& valueList, const IntSize& boxSize, const Animation* anim, const String& keyframesName, double delayAsNegativeTimeOffset)
 {
     ASSERT(!keyframesName.isEmpty());
 
@@ -798,39 +793,28 @@ bool CoordinatedGraphicsLayer::addAnimation(const KeyframeValueList& valueList,
     if (valueList.property() == AnimatedPropertyWebkitTransform)
         listsMatch = validateTransformOperations(valueList, ignoredHasBigRotation) >= 0;
 
-    m_animations.add(GraphicsLayerAnimation(keyframesName, valueList, boxSize, anim, timeOffset, listsMatch));
+    m_lastAnimationStartTime = WTF::currentTime() - delayAsNegativeTimeOffset;
+    m_animations.add(GraphicsLayerAnimation(keyframesName, valueList, boxSize, anim, m_lastAnimationStartTime, listsMatch));
     m_animationStartedTimer.startOneShot(0);
-    didChangeLayerState();
+    didChangeAnimations();
     return true;
 }
 
-void CoordinatedGraphicsLayer::pauseAnimation(const String& animationName, double timeOffset)
+void CoordinatedGraphicsLayer::pauseAnimation(const String& animationName, double time)
 {
-    m_animations.pause(animationName, timeOffset);
+    m_animations.pause(animationName, time);
+    didChangeAnimations();
 }
 
 void CoordinatedGraphicsLayer::removeAnimation(const String& animationName)
 {
     m_animations.remove(animationName);
+    didChangeAnimations();
 }
 
 void CoordinatedGraphicsLayer::animationStartedTimerFired(Timer<CoordinatedGraphicsLayer>*)
 {
-    client()->notifyAnimationStarted(this, /* DOM time */ WTF::currentTime());
+    client()->notifyAnimationStarted(this, m_lastAnimationStartTime);
 }
-
-void CoordinatedGraphicsLayer::setAnimatedTransform(const TransformationMatrix& transform)
-{
-    m_effectiveTransform = transform;
-    didChangeAnimatedProperties();
-    m_shouldUpdateVisibleRect = true;
-}
-
-void CoordinatedGraphicsLayer::setAnimatedOpacity(float opacity)
-{
-    m_effectiveOpacity = opacity;
-    didChangeAnimatedProperties();
-}
-
 }
 #endif
diff --git a/Source/WebKit2/WebProcess/WebPage/CoordinatedGraphics/CoordinatedGraphicsLayer.h b/Source/WebKit2/WebProcess/WebPage/CoordinatedGraphics/CoordinatedGraphicsLayer.h
index 049991070..1188aa75f 100644
--- a/Source/WebKit2/WebProcess/WebPage/CoordinatedGraphics/CoordinatedGraphicsLayer.h
+++ b/Source/WebKit2/WebProcess/WebPage/CoordinatedGraphics/CoordinatedGraphicsLayer.h
@@ -42,6 +42,7 @@
 #if USE(COORDINATED_GRAPHICS)
 namespace WebCore {
 class CoordinatedGraphicsLayer;
+class GraphicsLayerAnimations;
 }
 
 namespace WebKit {
@@ -66,117 +67,130 @@ public:
     virtual void syncCanvas(WebLayerID, const WebCore::IntSize& canvasSize, const WebCore::GraphicsSurfaceToken&, uint32_t frontBuffer) = 0;
 #endif
 
-    virtual void setLayerAnimatedOpacity(WebLayerID, float) = 0;
-    virtual void setLayerAnimatedTransform(WebLayerID, const WebCore::TransformationMatrix&) = 0;
+    virtual void setLayerAnimations(WebLayerID, const WebCore::GraphicsLayerAnimations&) = 0;
 
     virtual void attachLayer(WebCore::CoordinatedGraphicsLayer*) = 0;
     virtual void detachLayer(WebCore::CoordinatedGraphicsLayer*) = 0;
     virtual void syncFixedLayers() = 0;
-    virtual PassOwnPtr<WebCore::GraphicsContext> beginContentUpdate(const WebCore::IntSize&, ShareableBitmap::Flags, ShareableSurface::Handle&, WebCore::IntPoint&) = 0;
+    virtual PassOwnPtr<WebCore::GraphicsContext> beginContentUpdate(const WebCore::IntSize&, ShareableBitmap::Flags, int& atlasID, WebCore::IntPoint&) = 0;
 };
 }
 
 namespace WebCore {
 
-class CoordinatedGraphicsLayer : public WebCore::GraphicsLayer
-                       , public TiledBackingStoreClient
-                       , public WebKit::CoordinatedTileClient
-                       , public GraphicsLayerAnimation::Client {
+class CoordinatedGraphicsLayer : public GraphicsLayer
+    , public TiledBackingStoreClient
+    , public WebKit::CoordinatedTileClient {
 public:
     CoordinatedGraphicsLayer(GraphicsLayerClient*);
     virtual ~CoordinatedGraphicsLayer();
 
     // Reimplementations from GraphicsLayer.h.
-    bool setChildren(const Vector<GraphicsLayer*>&);
-    void addChild(GraphicsLayer*);
-    void addChildAtIndex(GraphicsLayer*, int);
-    void addChildAbove(GraphicsLayer*, GraphicsLayer*);
-    void addChildBelow(GraphicsLayer*, GraphicsLayer*);
-    bool replaceChild(GraphicsLayer*, GraphicsLayer*);
-    void removeFromParent();
-    void setPosition(const FloatPoint&);
-    void setAnchorPoint(const FloatPoint3D&);
-    void setSize(const FloatSize&);
-    void setTransform(const TransformationMatrix&);
-    void setChildrenTransform(const TransformationMatrix&);
-    void setPreserves3D(bool);
-    void setMasksToBounds(bool);
-    void setDrawsContent(bool);
-    void setContentsVisible(bool);
-    void setContentsOpaque(bool);
-    void setBackfaceVisibility(bool);
-    void setOpacity(float);
-    void setContentsRect(const IntRect&);
-    void setContentsToImage(Image*);
-    void setContentsToCanvas(PlatformLayer*);
-    void setMaskLayer(GraphicsLayer*);
-    void setReplicatedByLayer(GraphicsLayer*);
-    void setNeedsDisplay();
-    void setNeedsDisplayInRect(const FloatRect&);
-    void setContentsNeedsDisplay();
-    void setContentsScale(float);
-    void setVisibleContentRectTrajectoryVector(const FloatPoint&);
-    virtual void flushCompositingState(const FloatRect&);
-    virtual void flushCompositingStateForThisLayerOnly();
+    virtual bool setChildren(const Vector<GraphicsLayer*>&) OVERRIDE;
+    virtual void addChild(GraphicsLayer*) OVERRIDE;
+    virtual void addChildAtIndex(GraphicsLayer*, int) OVERRIDE;
+    virtual void addChildAbove(GraphicsLayer*, GraphicsLayer*) OVERRIDE;
+    virtual void addChildBelow(GraphicsLayer*, GraphicsLayer*) OVERRIDE;
+    virtual bool replaceChild(GraphicsLayer*, GraphicsLayer*) OVERRIDE;
+    virtual void removeFromParent() OVERRIDE;
+    virtual void setPosition(const FloatPoint&) OVERRIDE;
+    virtual void setAnchorPoint(const FloatPoint3D&) OVERRIDE;
+    virtual void setSize(const FloatSize&) OVERRIDE;
+    virtual void setTransform(const TransformationMatrix&) OVERRIDE;
+    virtual void setChildrenTransform(const TransformationMatrix&) OVERRIDE;
+    virtual void setPreserves3D(bool) OVERRIDE;
+    virtual void setMasksToBounds(bool) OVERRIDE;
+    virtual void setDrawsContent(bool) OVERRIDE;
+    virtual void setContentsVisible(bool) OVERRIDE;
+    virtual void setContentsOpaque(bool) OVERRIDE;
+    virtual void setBackfaceVisibility(bool) OVERRIDE;
+    virtual void setOpacity(float) OVERRIDE;
+    virtual void setContentsRect(const IntRect&) OVERRIDE;
+    virtual void setContentsToImage(Image*) OVERRIDE;
+    virtual void setContentsToCanvas(PlatformLayer*) OVERRIDE;
+    virtual void setMaskLayer(GraphicsLayer*) OVERRIDE;
+    virtual void setReplicatedByLayer(GraphicsLayer*) OVERRIDE;
+    virtual void setNeedsDisplay() OVERRIDE;
+    virtual void setNeedsDisplayInRect(const FloatRect&) OVERRIDE;
+    virtual void setContentsNeedsDisplay() OVERRIDE;
+    virtual void flushCompositingState(const FloatRect&) OVERRIDE;
+    virtual void flushCompositingStateForThisLayerOnly() OVERRIDE;
 #if ENABLE(CSS_FILTERS)
-    bool setFilters(const FilterOperations&);
+    virtual bool setFilters(const FilterOperations&) OVERRIDE;
 #endif
+    virtual bool addAnimation(const KeyframeValueList&, const IntSize&, const Animation*, const String&, double) OVERRIDE;
+    virtual void pauseAnimation(const String&, double) OVERRIDE;
+    virtual void removeAnimation(const String&) OVERRIDE;
+    
+    void setContentsScale(float);
+    void setVisibleContentRectTrajectoryVector(const FloatPoint&);
 
     void setRootLayer(bool);
 
     WebKit::WebLayerID id() const;
-    static CoordinatedGraphicsLayer* layerByID(WebKit::WebLayerID);
-    void didSynchronize();
-    Image* image() { return m_image.get(); }
 
-    bool fixedToViewport() const { return m_fixedToViewport; }
     void setFixedToViewport(bool isFixed) { m_fixedToViewport = isFixed; }
 
-    GraphicsLayer* maskTarget() const { return m_maskTarget; }
-    void setMaskTarget(GraphicsLayer* layer) { m_maskTarget = layer; }
     IntRect coverRect() const { return m_mainBackingStore ? m_mainBackingStore->mapToContents(m_mainBackingStore->coverRect()) : IntRect(); }
 
     static void initFactory();
 
     // TiledBackingStoreClient
-    virtual void tiledBackingStorePaintBegin();
-    virtual void tiledBackingStorePaint(GraphicsContext*, const IntRect&);
-    virtual void tiledBackingStorePaintEnd(const Vector<IntRect>& paintedArea);
-    virtual bool tiledBackingStoreUpdatesAllowed() const;
-    virtual IntRect tiledBackingStoreContentsRect();
-    virtual IntRect tiledBackingStoreVisibleRect();
-    virtual Color tiledBackingStoreBackgroundColor() const;
+    virtual void tiledBackingStorePaintBegin() OVERRIDE;
+    virtual void tiledBackingStorePaint(GraphicsContext*, const IntRect&) OVERRIDE;
+    virtual void tiledBackingStorePaintEnd(const Vector<IntRect>& paintedArea) OVERRIDE;
+    virtual bool tiledBackingStoreUpdatesAllowed() const OVERRIDE;
+    virtual IntRect tiledBackingStoreContentsRect() OVERRIDE;
+    virtual IntRect tiledBackingStoreVisibleRect() OVERRIDE;
+    virtual Color tiledBackingStoreBackgroundColor() const OVERRIDE;
 
     // CoordinatedTileClient
-    virtual void createTile(int tileID, const WebKit::SurfaceUpdateInfo&, const WebCore::IntRect&);
-    virtual void updateTile(int tileID, const WebKit::SurfaceUpdateInfo&, const WebCore::IntRect&);
-    virtual void removeTile(int tileID);
-    virtual PassOwnPtr<WebCore::GraphicsContext> beginContentUpdate(const WebCore::IntSize&, WebKit::ShareableSurface::Handle&, WebCore::IntPoint&);
+    virtual void createTile(int tileID, const WebKit::SurfaceUpdateInfo&, const IntRect&) OVERRIDE;
+    virtual void updateTile(int tileID, const WebKit::SurfaceUpdateInfo&, const IntRect&) OVERRIDE;
+    virtual void removeTile(int tileID) OVERRIDE;
+    virtual PassOwnPtr<GraphicsContext> beginContentUpdate(const IntSize&, int& atlasID, IntPoint&) OVERRIDE;
 
     void setCoordinatedGraphicsLayerClient(WebKit::CoordinatedGraphicsLayerClient*);
-    void syncChildren();
+
+    void adjustVisibleRect();
+    void purgeBackingStores();
+    bool hasPendingVisibleChanges();
+
+private:
+    bool fixedToViewport() const { return m_fixedToViewport; }
+    void setMaskTarget(GraphicsLayer* layer) { m_maskTarget = layer; }
+
+    void notifyChange();
+    void didChangeLayerState();
+    void didChangeAnimations();
+    void didChangeGeometry();
+    void didChangeChildren();
+#if ENABLE(CSS_FILTERS)
+    void didChangeFilters();
+#endif
+
     void syncLayerState();
+    void syncAnimations();
+    void syncChildren();
 #if ENABLE(CSS_FILTERS)
     void syncFilters();
 #endif
     void syncCanvas();
     void ensureImageBackingStore();
-
-    void adjustVisibleRect();
-    bool isReadyForTileBufferSwap() const;
+    void computeTransformedVisibleRect();
     void updateContentBuffers();
-    void purgeBackingStores();
 
-    // GraphicsLayerAnimation::Client
-    virtual void setAnimatedTransform(const TransformationMatrix&);
-    virtual void setAnimatedOpacity(float);
+    void createBackingStore();
 
-    virtual bool addAnimation(const KeyframeValueList&, const IntSize&, const Animation*, const String&, double);
-    virtual void pauseAnimation(const String&, double);
-    virtual void removeAnimation(const String&);
+    bool selfOrAncestorHaveNonAffineTransforms();
+    bool shouldUseTiledBackingStore();
+    void adjustContentsScale();
+
+    void setShouldUpdateVisibleRect();
+    float effectiveContentsScale();
+
+    void animationStartedTimerFired(Timer<CoordinatedGraphicsLayer>*);
 
-private:
-    virtual void willBeDestroyed();
     WebKit::WebLayerID m_id;
     WebKit::WebLayerInfo m_layerInfo;
     RefPtr<Image> m_image;
@@ -188,42 +202,21 @@ private:
     bool m_shouldSyncLayerState: 1;
     bool m_shouldSyncChildren: 1;
     bool m_shouldSyncFilters: 1;
-    bool m_shouldSyncAnimatedProperties: 1;
+    bool m_shouldSyncAnimations: 1;
     bool m_fixedToViewport : 1;
     bool m_canvasNeedsDisplay : 1;
 
-    void notifyChange();
-    void didChangeAnimatedProperties();
-    void didChangeGeometry();
-    void didChangeLayerState();
-    void didChangeChildren();
-#if ENABLE(CSS_FILTERS)
-    void didChangeFilters();
-#endif
-
     float m_effectiveOpacity;
     TransformationMatrix m_effectiveTransform;
 
-    void createBackingStore();
-
-    bool selfOrAncestorHaveNonAffineTransforms();
-    bool shouldUseTiledBackingStore();
-    void adjustContentsScale();
-    void computeTransformedVisibleRect();
-    void syncLayerParameters();
-    void syncAnimatedProperties();
-    void setShouldUpdateVisibleRect();
-    float effectiveContentsScale();
-
-    void animationStartedTimerFired(WebCore::Timer<CoordinatedGraphicsLayer>*);
-
     WebKit::CoordinatedGraphicsLayerClient* m_CoordinatedGraphicsLayerClient;
-    OwnPtr<WebCore::TiledBackingStore> m_mainBackingStore;
-    OwnPtr<WebCore::TiledBackingStore> m_previousBackingStore;
+    OwnPtr<TiledBackingStore> m_mainBackingStore;
+    OwnPtr<TiledBackingStore> m_previousBackingStore;
     float m_contentsScale;
     PlatformLayer* m_canvasPlatformLayer;
     Timer<CoordinatedGraphicsLayer> m_animationStartedTimer;
     GraphicsLayerAnimations m_animations;
+    double m_lastAnimationStartTime;
 };
 
 CoordinatedGraphicsLayer* toCoordinatedGraphicsLayer(GraphicsLayer*);
diff --git a/Source/WebKit2/WebProcess/WebPage/CoordinatedGraphics/CoordinatedTile.cpp b/Source/WebKit2/WebProcess/WebPage/CoordinatedGraphics/CoordinatedTile.cpp
index 668ca5d9e..548d49d32 100644
--- a/Source/WebKit2/WebProcess/WebPage/CoordinatedGraphics/CoordinatedTile.cpp
+++ b/Source/WebKit2/WebProcess/WebPage/CoordinatedGraphics/CoordinatedTile.cpp
@@ -73,7 +73,7 @@ Vector<IntRect> CoordinatedTile::updateBackBuffer()
         return Vector<IntRect>();
 
     SurfaceUpdateInfo updateInfo;
-    OwnPtr<GraphicsContext> graphicsContext = m_client->beginContentUpdate(m_dirtyRect.size(), updateInfo.surfaceHandle, updateInfo.surfaceOffset);
+    OwnPtr<GraphicsContext> graphicsContext = m_client->beginContentUpdate(m_dirtyRect.size(), updateInfo.atlasID, updateInfo.surfaceOffset);
     if (!graphicsContext)
         return Vector<IntRect>();
     graphicsContext->translate(-m_dirtyRect.x(), -m_dirtyRect.y());
diff --git a/Source/WebKit2/WebProcess/WebPage/CoordinatedGraphics/CoordinatedTile.h b/Source/WebKit2/WebProcess/WebPage/CoordinatedGraphics/CoordinatedTile.h
index 84d1134f0..32ff4e7c7 100644
--- a/Source/WebKit2/WebProcess/WebPage/CoordinatedGraphics/CoordinatedTile.h
+++ b/Source/WebKit2/WebProcess/WebPage/CoordinatedGraphics/CoordinatedTile.h
@@ -28,7 +28,6 @@
 
 #if USE(TILED_BACKING_STORE)
 
-#include "ShareableSurface.h"
 #include "Tile.h"
 #include "TiledBackingStore.h"
 #include "WebCore/IntRect.h"
@@ -79,7 +78,7 @@ public:
     virtual void createTile(int tileID, const SurfaceUpdateInfo&, const WebCore::IntRect&) = 0;
     virtual void updateTile(int tileID, const SurfaceUpdateInfo&, const WebCore::IntRect&) = 0;
     virtual void removeTile(int tileID) = 0;
-    virtual PassOwnPtr<WebCore::GraphicsContext> beginContentUpdate(const WebCore::IntSize&, ShareableSurface::Handle&, WebCore::IntPoint&) = 0;
+    virtual PassOwnPtr<WebCore::GraphicsContext> beginContentUpdate(const WebCore::IntSize&, int& atlasID, WebCore::IntPoint&) = 0;
 };
 
 class CoordinatedTileBackend : public WebCore::TiledBackingStoreBackend {
diff --git a/Source/WebKit2/WebProcess/WebPage/CoordinatedGraphics/LayerTreeCoordinator.cpp b/Source/WebKit2/WebProcess/WebPage/CoordinatedGraphics/LayerTreeCoordinator.cpp
index aaa1c38d5..5d9b3ef38 100644
--- a/Source/WebKit2/WebProcess/WebPage/CoordinatedGraphics/LayerTreeCoordinator.cpp
+++ b/Source/WebKit2/WebProcess/WebPage/CoordinatedGraphics/LayerTreeCoordinator.cpp
@@ -82,6 +82,7 @@ LayerTreeCoordinator::LayerTreeCoordinator(WebPage* webPage)
     , m_releaseInactiveAtlasesTimer(this, &LayerTreeCoordinator::releaseInactiveAtlasesTimerFired)
     , m_layerFlushSchedulingEnabled(true)
     , m_forceRepaintAsyncCallbackID(0)
+    , m_animationsLocked(false)
 {
     // Create a root layer.
     m_rootLayer = GraphicsLayer::create(this, this);
@@ -266,6 +267,8 @@ bool LayerTreeCoordinator::flushPendingLayerChanges()
 
     m_rootLayer->flushCompositingStateForThisLayerOnly();
 
+    purgeReleasedImages();
+
     if (m_shouldSyncRootLayer) {
         m_webPage->send(Messages::LayerTreeCoordinatorProxy::SetRootCompositingLayer(toCoordinatedGraphicsLayer(m_rootLayer.get())->id()));
         m_shouldSyncRootLayer = false;
@@ -279,7 +282,8 @@ bool LayerTreeCoordinator::flushPendingLayerChanges()
         m_webPage->send(Messages::LayerTreeCoordinatorProxy::DidRenderFrame(contentsSize, coveredRect));
         m_waitingForUIProcess = true;
         m_shouldSyncFrame = false;
-    }
+    } else
+        unlockAnimations();
 
     if (m_forceRepaintAsyncCallbackID) {
         m_webPage->send(Messages::WebPageProxy::VoidCallback(m_forceRepaintAsyncCallbackID));
@@ -387,13 +391,37 @@ void LayerTreeCoordinator::syncFixedLayers()
         updateOffsetFromViewportForLayer(rootRenderLayer->firstChild());
 }
 
+void LayerTreeCoordinator::lockAnimations()
+{
+    m_animationsLocked = true;
+    m_webPage->send(Messages::LayerTreeCoordinatorProxy::SetAnimationsLocked(true));
+}
+
+void LayerTreeCoordinator::unlockAnimations()
+{
+    if (!m_animationsLocked)
+        return;
+
+    m_animationsLocked = false;
+    m_webPage->send(Messages::LayerTreeCoordinatorProxy::SetAnimationsLocked(false));
+}
+
 void LayerTreeCoordinator::performScheduledLayerFlush()
 {
     if (m_isSuspended || m_waitingForUIProcess)
         return;
 
+    // We lock the animations while performing layout, to avoid flickers caused by animations continuing in the UI process while
+    // the web process layout wants to cancel them.
+    lockAnimations();
     syncDisplayState();
 
+    // We can unlock the animations before flushing if there are no visible changes, for example if there are content updates
+    // in a layer with opacity 0.
+    bool canUnlockBeforeFlush = !m_isValid || !toCoordinatedGraphicsLayer(m_rootLayer.get())->hasPendingVisibleChanges();
+    if (canUnlockBeforeFlush)
+        unlockAnimations();
+
     if (!m_isValid)
         return;
 
@@ -419,6 +447,13 @@ void LayerTreeCoordinator::didPerformScheduledLayerFlush()
     }
 }
 
+void LayerTreeCoordinator::purgeReleasedImages()
+{
+    for (size_t i = 0; i < m_releasedDirectlyCompositedImages.size(); ++i)
+        m_webPage->send(Messages::LayerTreeCoordinatorProxy::DestroyDirectlyCompositedImage(m_releasedDirectlyCompositedImages[i]));
+    m_releasedDirectlyCompositedImages.clear();
+}
+
 void LayerTreeCoordinator::layerFlushTimerFired(Timer<LayerTreeCoordinator>*)
 {
     performScheduledLayerFlush();
@@ -477,15 +512,20 @@ int64_t LayerTreeCoordinator::adoptImageBackingStore(Image* image)
         return key;
     }
 
-    RefPtr<ShareableBitmap> bitmap = ShareableBitmap::createShareable(image->size(), (image->currentFrameHasAlpha() ? ShareableBitmap::SupportsAlpha : 0));
-    {
-        OwnPtr<WebCore::GraphicsContext> graphicsContext = bitmap->createGraphicsContext();
-        graphicsContext->drawImage(image, ColorSpaceDeviceRGB, IntPoint::zero());
-    }
+    // Check if we were going to release this image during the next flush.
+    size_t releasedIndex = m_releasedDirectlyCompositedImages.find(key);
+    if (releasedIndex == notFound) {
+        RefPtr<ShareableBitmap> bitmap = ShareableBitmap::createShareable(image->size(), (image->currentFrameHasAlpha() ? ShareableBitmap::SupportsAlpha : 0));
+        {
+            OwnPtr<WebCore::GraphicsContext> graphicsContext = bitmap->createGraphicsContext();
+            graphicsContext->drawImage(image, ColorSpaceDeviceRGB, IntPoint::zero());
+        }
+        ShareableBitmap::Handle handle;
+        bitmap->createHandle(handle);
+        m_webPage->send(Messages::LayerTreeCoordinatorProxy::CreateDirectlyCompositedImage(key, handle));
+    } else
+        m_releasedDirectlyCompositedImages.remove(releasedIndex);
 
-    ShareableBitmap::Handle handle;
-    bitmap->createHandle(handle);
-    m_webPage->send(Messages::LayerTreeCoordinatorProxy::CreateDirectlyCompositedImage(key, handle));
     m_directlyCompositedImageRefCounts.add(key, 1);
     return key;
 }
@@ -503,13 +543,15 @@ void LayerTreeCoordinator::releaseImageBackingStore(int64_t key)
     if (it->value)
         return;
 
-    m_directlyCompositedImageRefCounts.remove(it);
 #if USE(CAIRO)
     // Complement the referencing in adoptImageBackingStore().
     cairo_surface_t* cairoSurface = reinterpret_cast<cairo_surface_t*>(key);
     cairo_surface_destroy(cairoSurface);
 #endif
-    m_webPage->send(Messages::LayerTreeCoordinatorProxy::DestroyDirectlyCompositedImage(key));
+
+    m_directlyCompositedImageRefCounts.remove(it);
+    m_releasedDirectlyCompositedImages.append(key);
+    scheduleLayerFlush();
 }
 
 
@@ -536,19 +578,11 @@ void LayerTreeCoordinator::paintContents(const WebCore::GraphicsLayer* graphicsL
     }
 }
 
-bool LayerTreeCoordinator::showDebugBorders(const WebCore::GraphicsLayer*) const
-{
-    return m_webPage->corePage()->settings()->showDebugBorders();
-}
-
-bool LayerTreeCoordinator::showRepaintCounter(const WebCore::GraphicsLayer*) const
-{
-    return m_webPage->corePage()->settings()->showRepaintCounter();
-}
-
 PassOwnPtr<GraphicsLayer> LayerTreeCoordinator::createGraphicsLayer(GraphicsLayerClient* client)
 {
-    return adoptPtr(new CoordinatedGraphicsLayer(client));
+    CoordinatedGraphicsLayer* newLayer = new CoordinatedGraphicsLayer(client);
+    newLayer->setCoordinatedGraphicsLayerClient(this);
+    return adoptPtr(newLayer);
 }
 
 bool LayerTreeHost::supportsAcceleratedCompositing()
@@ -574,22 +608,26 @@ void LayerTreeCoordinator::removeTile(WebLayerID layerID, int tileID)
     m_webPage->send(Messages::LayerTreeCoordinatorProxy::RemoveTileForLayer(layerID, tileID));
 }
 
-WebCore::IntRect LayerTreeCoordinator::visibleContentsRect() const
+void LayerTreeCoordinator::createUpdateAtlas(int atlasID, const ShareableSurface::Handle& handle)
 {
-    return m_visibleContentsRect;
+    m_webPage->send(Messages::LayerTreeCoordinatorProxy::CreateUpdateAtlas(atlasID, handle));
 }
 
+void LayerTreeCoordinator::removeUpdateAtlas(int atlasID)
+{
+    m_webPage->send(Messages::LayerTreeCoordinatorProxy::RemoveUpdateAtlas(atlasID));
+}
 
-void LayerTreeCoordinator::setLayerAnimatedOpacity(WebLayerID id, float opacity)
+WebCore::IntRect LayerTreeCoordinator::visibleContentsRect() const
 {
-    m_shouldSyncFrame = true;
-    m_webPage->send(Messages::LayerTreeCoordinatorProxy::SetLayerAnimatedOpacity(id, opacity));
+    return m_visibleContentsRect;
 }
 
-void LayerTreeCoordinator::setLayerAnimatedTransform(WebLayerID id, const TransformationMatrix& transform)
+
+void LayerTreeCoordinator::setLayerAnimations(WebLayerID layerID, const GraphicsLayerAnimations& animations)
 {
     m_shouldSyncFrame = true;
-    m_webPage->send(Messages::LayerTreeCoordinatorProxy::SetLayerAnimatedTransform(id, transform));
+    m_webPage->send(Messages::LayerTreeCoordinatorProxy::SetLayerAnimations(layerID, animations.getActiveAnimations()));
 }
 
 void LayerTreeCoordinator::setVisibleContentsRect(const IntRect& rect, float scale, const FloatPoint& trajectoryVector)
@@ -625,10 +663,17 @@ GraphicsLayerFactory* LayerTreeCoordinator::graphicsLayerFactory()
     return this;
 }
 
+#if ENABLE(REQUEST_ANIMATION_FRAME)
 void LayerTreeCoordinator::scheduleAnimation()
 {
+    m_webPage->send(Messages::LayerTreeCoordinatorProxy::RequestAnimationFrame());
+}
+
+void LayerTreeCoordinator::animationFrameReady()
+{
     scheduleLayerFlush();
 }
+#endif
 
 void LayerTreeCoordinator::renderNextFrame()
 {
@@ -649,27 +694,30 @@ void LayerTreeCoordinator::purgeBackingStores()
     for (HashSet<WebCore::CoordinatedGraphicsLayer*>::iterator it = m_registeredLayers.begin(); it != end; ++it)
         (*it)->purgeBackingStores();
 
+    purgeReleasedImages();
+
     ASSERT(!m_directlyCompositedImageRefCounts.size());
+    ASSERT(!m_releasedDirectlyCompositedImages.size());
     m_updateAtlases.clear();
 }
 
-PassOwnPtr<WebCore::GraphicsContext> LayerTreeCoordinator::beginContentUpdate(const WebCore::IntSize& size, ShareableBitmap::Flags flags, ShareableSurface::Handle& handle, WebCore::IntPoint& offset)
+PassOwnPtr<WebCore::GraphicsContext> LayerTreeCoordinator::beginContentUpdate(const WebCore::IntSize& size, ShareableBitmap::Flags flags, int& atlasID, WebCore::IntPoint& offset)
 {
     OwnPtr<WebCore::GraphicsContext> graphicsContext;
     for (unsigned i = 0; i < m_updateAtlases.size(); ++i) {
         UpdateAtlas* atlas = m_updateAtlases[i].get();
         if (atlas->flags() == flags) {
             // This will return null if there is no available buffer space.
-            graphicsContext = atlas->beginPaintingOnAvailableBuffer(handle, size, offset);
+            graphicsContext = atlas->beginPaintingOnAvailableBuffer(atlasID, size, offset);
             if (graphicsContext)
                 return graphicsContext.release();
         }
     }
 
     static const int ScratchBufferDimension = 1024; // Should be a power of two.
-    m_updateAtlases.append(adoptPtr(new UpdateAtlas(ScratchBufferDimension, flags)));
+    m_updateAtlases.append(adoptPtr(new UpdateAtlas(this, ScratchBufferDimension, flags)));
     scheduleReleaseInactiveAtlases();
-    return m_updateAtlases.last()->beginPaintingOnAvailableBuffer(handle, size, offset);
+    return m_updateAtlases.last()->beginPaintingOnAvailableBuffer(atlasID, size, offset);
 }
 
 const double ReleaseInactiveAtlasesTimerInterval = 0.5;
diff --git a/Source/WebKit2/WebProcess/WebPage/CoordinatedGraphics/LayerTreeCoordinator.h b/Source/WebKit2/WebProcess/WebPage/CoordinatedGraphics/LayerTreeCoordinator.h
index 776a8d97e..cacb68eaa 100644
--- a/Source/WebKit2/WebProcess/WebPage/CoordinatedGraphics/LayerTreeCoordinator.h
+++ b/Source/WebKit2/WebProcess/WebPage/CoordinatedGraphics/LayerTreeCoordinator.h
@@ -38,14 +38,13 @@ class UpdateInfo;
 class WebPage;
 
 class LayerTreeCoordinator : public LayerTreeHost, WebCore::GraphicsLayerClient
-                           , public CoordinatedGraphicsLayerClient
-                           , public WebCore::GraphicsLayerFactory {
+    , public CoordinatedGraphicsLayerClient
+    , public UpdateAtlasClient
+    , public WebCore::GraphicsLayerFactory {
 public:
     static PassRefPtr<LayerTreeCoordinator> create(WebPage*);
     virtual ~LayerTreeCoordinator();
 
-    static bool supportsAcceleratedCompositing();
-
     virtual const LayerTreeContext& layerTreeContext() { return m_layerTreeContext; }
     virtual void setLayerFlushSchedulingEnabled(bool);
     virtual void scheduleLayerFlush();
@@ -84,8 +83,7 @@ public:
 
     virtual void syncLayerState(WebLayerID, const WebLayerInfo&);
     virtual void syncLayerChildren(WebLayerID, const Vector<WebLayerID>&);
-    virtual void setLayerAnimatedOpacity(WebLayerID, float);
-    virtual void setLayerAnimatedTransform(WebLayerID, const WebCore::TransformationMatrix&);
+    virtual void setLayerAnimations(WebLayerID, const WebCore::GraphicsLayerAnimations&);
 #if ENABLE(CSS_FILTERS)
     virtual void syncLayerFilters(WebLayerID, const WebCore::FilterOperations&);
 #endif
@@ -96,8 +94,15 @@ public:
     virtual void detachLayer(WebCore::CoordinatedGraphicsLayer*);
     virtual void syncFixedLayers();
 
-    virtual PassOwnPtr<WebCore::GraphicsContext> beginContentUpdate(const WebCore::IntSize&, ShareableBitmap::Flags, ShareableSurface::Handle&, WebCore::IntPoint&);
+    virtual PassOwnPtr<WebCore::GraphicsContext> beginContentUpdate(const WebCore::IntSize&, ShareableBitmap::Flags, int& atlasID, WebCore::IntPoint&);
+
+    // UpdateAtlasClient
+    virtual void createUpdateAtlas(int atlasID, const ShareableSurface::Handle&);
+    virtual void removeUpdateAtlas(int atlasID);
+
+#if ENABLE(REQUEST_ANIMATION_FRAME)
     virtual void scheduleAnimation() OVERRIDE;
+#endif
 
 protected:
     explicit LayerTreeCoordinator(WebPage*);
@@ -107,8 +112,6 @@ private:
     virtual void notifyAnimationStarted(const WebCore::GraphicsLayer*, double time);
     virtual void notifyFlushRequired(const WebCore::GraphicsLayer*);
     virtual void paintContents(const WebCore::GraphicsLayer*, WebCore::GraphicsContext&, WebCore::GraphicsLayerPaintingPhase, const WebCore::IntRect& clipRect);
-    virtual bool showDebugBorders(const WebCore::GraphicsLayer*) const;
-    virtual bool showRepaintCounter(const WebCore::GraphicsLayer*) const;
 
     // GraphicsLayerFactory
     virtual PassOwnPtr<WebCore::GraphicsLayer> createGraphicsLayer(WebCore::GraphicsLayerClient*) OVERRIDE;
@@ -121,10 +124,17 @@ private:
     void performScheduledLayerFlush();
     void didPerformScheduledLayerFlush();
     void syncDisplayState();
+    void lockAnimations();
+    void unlockAnimations();
+    void purgeReleasedImages();
 
     void layerFlushTimerFired(WebCore::Timer<LayerTreeCoordinator>*);
 
     void scheduleReleaseInactiveAtlases();
+#if ENABLE(REQUEST_ANIMATION_FRAME)
+    void animationFrameReady();
+#endif
+
     void releaseInactiveAtlasesTimerFired(WebCore::Timer<LayerTreeCoordinator>*);
 
     OwnPtr<WebCore::GraphicsLayer> m_rootLayer;
@@ -138,6 +148,7 @@ private:
     HashSet<WebCore::CoordinatedGraphicsLayer*> m_registeredLayers;
     Vector<WebLayerID> m_detachedLayers;
     HashMap<int64_t, int> m_directlyCompositedImageRefCounts;
+    Vector<int64_t> m_releasedDirectlyCompositedImages;
     Vector<OwnPtr<UpdateAtlas> > m_updateAtlases;
 
     bool m_notifyAfterScheduledLayerFlush;
@@ -156,6 +167,7 @@ private:
     WebCore::Timer<LayerTreeCoordinator> m_releaseInactiveAtlasesTimer;
     bool m_layerFlushSchedulingEnabled;
     uint64_t m_forceRepaintAsyncCallbackID;
+    bool m_animationsLocked;
 };
 
 }
diff --git a/Source/WebKit2/WebProcess/WebPage/CoordinatedGraphics/LayerTreeCoordinator.messages.in b/Source/WebKit2/WebProcess/WebPage/CoordinatedGraphics/LayerTreeCoordinator.messages.in
index 7b9c2acdf..6ac372562 100644
--- a/Source/WebKit2/WebProcess/WebPage/CoordinatedGraphics/LayerTreeCoordinator.messages.in
+++ b/Source/WebKit2/WebProcess/WebPage/CoordinatedGraphics/LayerTreeCoordinator.messages.in
@@ -23,5 +23,8 @@ messages -> LayerTreeCoordinator {
     SetVisibleContentsRect(WebCore::IntRect visibleContentsRect, float scale, WebCore::FloatPoint trajectoryVectory)
     RenderNextFrame()
     PurgeBackingStores()
+#if ENABLE(REQUEST_ANIMATION_FRAME)
+    AnimationFrameReady()
+#endif
 }
 #endif
diff --git a/Source/WebKit2/WebProcess/WebPage/DecoderAdapter.cpp b/Source/WebKit2/WebProcess/WebPage/DecoderAdapter.cpp
index 63417720c..4179c982c 100644
--- a/Source/WebKit2/WebProcess/WebPage/DecoderAdapter.cpp
+++ b/Source/WebKit2/WebProcess/WebPage/DecoderAdapter.cpp
@@ -45,7 +45,7 @@ DecoderAdapter::DecoderAdapter(const uint8_t* buffer, size_t bufferSize)
 bool DecoderAdapter::decodeBytes(Vector<uint8_t>& bytes)
 {
     CoreIPC::DataReference dataReference;
-    if (!m_decoder->decodeVariableLengthByteArray(dataReference))
+    if (!m_decoder->decode(dataReference))
         return false;
 
     bytes = dataReference.vector();
diff --git a/Source/WebKit2/WebProcess/WebPage/DrawingArea.cpp b/Source/WebKit2/WebProcess/WebPage/DrawingArea.cpp
index 11e893faf..ed6cface2 100644
--- a/Source/WebKit2/WebProcess/WebPage/DrawingArea.cpp
+++ b/Source/WebKit2/WebProcess/WebPage/DrawingArea.cpp
@@ -33,6 +33,10 @@
 #include "TiledCoreAnimationDrawingArea.h"
 #endif
 
+#if PLATFORM(MAC)
+#include "RemoteLayerTreeDrawingArea.h"
+#endif
+
 #include "WebPageCreationParameters.h"
 
 namespace WebKit {
@@ -46,6 +50,10 @@ PassOwnPtr<DrawingArea> DrawingArea::create(WebPage* webPage, const WebPageCreat
     case DrawingAreaTypeTiledCoreAnimation:
         return TiledCoreAnimationDrawingArea::create(webPage, parameters);
 #endif
+#if PLATFORM(MAC)
+    case DrawingAreaTypeRemoteLayerTree:
+        return RemoteLayerTreeDrawingArea::create(webPage, parameters);
+#endif
     }
 
     return nullptr;
diff --git a/Source/WebKit2/WebProcess/WebPage/DrawingAreaImpl.cpp b/Source/WebKit2/WebProcess/WebPage/DrawingAreaImpl.cpp
index 71916909d..5e70c9448 100644
--- a/Source/WebKit2/WebProcess/WebPage/DrawingAreaImpl.cpp
+++ b/Source/WebKit2/WebProcess/WebPage/DrawingAreaImpl.cpp
@@ -307,6 +307,7 @@ void DrawingAreaImpl::layerHostDidFlushLayers()
 #endif
 }
 
+#if USE(ACCELERATED_COMPOSITING)
 GraphicsLayerFactory* DrawingAreaImpl::graphicsLayerFactory()
 {
     if (m_layerTreeHost)
@@ -361,6 +362,7 @@ void DrawingAreaImpl::scheduleCompositingLayerFlush()
         return;
     m_layerTreeHost->scheduleLayerFlush();
 }
+#endif
 
 void DrawingAreaImpl::updateBackingStoreState(uint64_t stateID, bool respondImmediately, float deviceScaleFactor, const WebCore::IntSize& size, const WebCore::IntSize& scrollOffset)
 {
diff --git a/Source/WebKit2/WebProcess/WebPage/DrawingAreaImpl.h b/Source/WebKit2/WebProcess/WebPage/DrawingAreaImpl.h
index ba93954f9..6d49719f7 100644
--- a/Source/WebKit2/WebProcess/WebPage/DrawingAreaImpl.h
+++ b/Source/WebKit2/WebProcess/WebPage/DrawingAreaImpl.h
@@ -68,9 +68,11 @@ private:
     virtual void setPaintingEnabled(bool);
     virtual void updatePreferences(const WebPreferencesStore&) OVERRIDE;
 
+#if USE(ACCELERATED_COMPOSITING)
     virtual WebCore::GraphicsLayerFactory* graphicsLayerFactory() OVERRIDE;
     virtual void setRootCompositingLayer(WebCore::GraphicsLayer*) OVERRIDE;
     virtual void scheduleCompositingLayerFlush() OVERRIDE;
+#endif
 
 #if PLATFORM(WIN)
     virtual void scheduleChildWindowGeometryUpdate(const WindowGeometry&);
diff --git a/Source/WebKit2/WebProcess/WebPage/EncoderAdapter.cpp b/Source/WebKit2/WebProcess/WebPage/EncoderAdapter.cpp
index b7269caa1..ed6dc210e 100644
--- a/Source/WebKit2/WebProcess/WebPage/EncoderAdapter.cpp
+++ b/Source/WebKit2/WebProcess/WebPage/EncoderAdapter.cpp
@@ -47,7 +47,7 @@ CoreIPC::DataReference EncoderAdapter::dataReference() const
 
 void EncoderAdapter::encodeBytes(const uint8_t* bytes, size_t size)
 {
-    m_encoder->encodeVariableLengthByteArray(CoreIPC::DataReference(bytes, size));
+    m_encoder->encode(CoreIPC::DataReference(bytes, size));
 }
 
 void EncoderAdapter::encodeBool(bool value)
diff --git a/Source/WebKit2/WebProcess/WebPage/LayerTreeHost.h b/Source/WebKit2/WebProcess/WebPage/LayerTreeHost.h
index 68d158236..7a1ca6cf6 100644
--- a/Source/WebKit2/WebProcess/WebPage/LayerTreeHost.h
+++ b/Source/WebKit2/WebProcess/WebPage/LayerTreeHost.h
@@ -109,7 +109,7 @@ public:
     virtual WebCore::GraphicsDeviceAdapter* graphicsDeviceAdapter() const { return 0; }
 #endif
 
-#if USE(COORDINATED_GRAPHICS)
+#if USE(COORDINATED_GRAPHICS) && ENABLE(REQUEST_ANIMATION_FRAME)
     virtual void scheduleAnimation() = 0;
 #endif
 
diff --git a/Source/WebKit2/WebProcess/WebPage/UpdateAtlas.cpp b/Source/WebKit2/WebProcess/WebPage/UpdateAtlas.cpp
index 27500635d..9a5418f1e 100644
--- a/Source/WebKit2/WebProcess/WebPage/UpdateAtlas.cpp
+++ b/Source/WebKit2/WebProcess/WebPage/UpdateAtlas.cpp
@@ -30,12 +30,28 @@ using namespace WebCore;
 
 namespace WebKit {
 
-UpdateAtlas::UpdateAtlas(int dimension, ShareableBitmap::Flags flags)
-    : m_flags(flags)
+UpdateAtlas::UpdateAtlas(UpdateAtlasClient* client, int dimension, ShareableBitmap::Flags flags)
+    : m_client(client)
+    , m_flags(flags)
     , m_inactivityInSeconds(0)
+    , m_isVaild(true)
 {
+    static int nextID = 0;
+    m_ID = ++nextID;
     IntSize size = nextPowerOfTwo(IntSize(dimension, dimension));
     m_surface = ShareableSurface::create(size, flags, ShareableSurface::SupportsGraphicsSurface);
+
+    if (!m_surface->createHandle(m_handle)) {
+        m_isVaild = false;
+        return;
+    }
+    m_client->createUpdateAtlas(m_ID, m_handle);
+}
+
+UpdateAtlas::~UpdateAtlas()
+{
+    if (m_isVaild)
+        m_client->removeUpdateAtlas(m_ID);
 }
 
 void UpdateAtlas::buildLayoutIfNeeded()
@@ -51,7 +67,7 @@ void UpdateAtlas::didSwapBuffers()
     m_areaAllocator.clear();
 }
 
-PassOwnPtr<GraphicsContext> UpdateAtlas::beginPaintingOnAvailableBuffer(ShareableSurface::Handle& handle, const WebCore::IntSize& size, IntPoint& offset)
+PassOwnPtr<GraphicsContext> UpdateAtlas::beginPaintingOnAvailableBuffer(int& atlasID, const WebCore::IntSize& size, IntPoint& offset)
 {
     m_inactivityInSeconds = 0;
     buildLayoutIfNeeded();
@@ -61,8 +77,10 @@ PassOwnPtr<GraphicsContext> UpdateAtlas::beginPaintingOnAvailableBuffer(Shareabl
     if (rect.isEmpty())
         return PassOwnPtr<GraphicsContext>();
 
-    if (!m_surface->createHandle(handle))
-        return PassOwnPtr<WebCore::GraphicsContext>();
+    if (!m_isVaild)
+        return PassOwnPtr<GraphicsContext>();
+
+    atlasID = m_ID;
 
     // FIXME: Use tri-state buffers, to allow faster updates.
     offset = rect.location();
diff --git a/Source/WebKit2/WebProcess/WebPage/UpdateAtlas.h b/Source/WebKit2/WebProcess/WebPage/UpdateAtlas.h
index 00e850b83..7cefe9c97 100644
--- a/Source/WebKit2/WebProcess/WebPage/UpdateAtlas.h
+++ b/Source/WebKit2/WebProcess/WebPage/UpdateAtlas.h
@@ -32,15 +32,22 @@ class IntPoint;
 
 namespace WebKit {
 
+class UpdateAtlasClient {
+public:
+    virtual void createUpdateAtlas(int atlasID, const ShareableSurface::Handle&) = 0;
+    virtual void removeUpdateAtlas(int atlasID) = 0;
+};
+
 class UpdateAtlas {
     WTF_MAKE_NONCOPYABLE(UpdateAtlas);
 public:
-    UpdateAtlas(int dimension, ShareableBitmap::Flags);
+    UpdateAtlas(UpdateAtlasClient*, int dimension, ShareableBitmap::Flags);
+    ~UpdateAtlas();
 
     inline WebCore::IntSize size() const { return m_surface->size(); }
 
     // Returns a null pointer of there is no available buffer.
-    PassOwnPtr<WebCore::GraphicsContext> beginPaintingOnAvailableBuffer(ShareableSurface::Handle&, const WebCore::IntSize&, WebCore::IntPoint& offset);
+    PassOwnPtr<WebCore::GraphicsContext> beginPaintingOnAvailableBuffer(int& atlasID, const WebCore::IntSize&, WebCore::IntPoint& offset);
     void didSwapBuffers();
     ShareableBitmap::Flags flags() const { return m_flags; }
 
@@ -60,10 +67,14 @@ private:
     void buildLayoutIfNeeded();
 
 private:
+    UpdateAtlasClient* m_client;
     OwnPtr<GeneralAreaAllocator> m_areaAllocator;
     ShareableBitmap::Flags m_flags;
     RefPtr<ShareableSurface> m_surface;
+    ShareableSurface::Handle m_handle;
     double m_inactivityInSeconds;
+    int m_ID;
+    bool m_isVaild;
 };
 
 }
diff --git a/Source/WebKit2/WebProcess/WebPage/WebPage.cpp b/Source/WebKit2/WebProcess/WebPage/WebPage.cpp
index 3d8583d8d..2312e84c3 100644
--- a/Source/WebKit2/WebProcess/WebPage/WebPage.cpp
+++ b/Source/WebKit2/WebProcess/WebPage/WebPage.cpp
@@ -31,6 +31,7 @@
 #include "DataReference.h"
 #include "DecoderAdapter.h"
 #include "DrawingArea.h"
+#include "DrawingAreaMessages.h"
 #include "InjectedBundle.h"
 #include "InjectedBundleBackForwardList.h"
 #include "InjectedBundleUserMessageCoders.h"
@@ -60,15 +61,18 @@
 #include "WebEventConversion.h"
 #include "WebFrame.h"
 #include "WebFullScreenManager.h"
+#include "WebFullScreenManagerMessages.h"
 #include "WebGeolocationClient.h"
 #include "WebGeometry.h"
 #include "WebImage.h"
 #include "WebInspector.h"
 #include "WebInspectorClient.h"
+#include "WebInspectorMessages.h"
 #include "WebNotificationClient.h"
 #include "WebOpenPanelResultListener.h"
 #include "WebPageCreationParameters.h"
 #include "WebPageGroupProxy.h"
+#include "WebPageMessages.h"
 #include "WebPageProxyMessages.h"
 #include "WebPopupMenu.h"
 #include "WebPreferencesStore.h"
@@ -176,6 +180,10 @@
 #include <wtf/RefCountedLeakCounter.h>
 #endif
 
+#if USE(COORDINATED_GRAPHICS)
+#include "LayerTreeCoordinatorMessages.h"
+#endif
+
 using namespace JSC;
 using namespace WebCore;
 using namespace std;
@@ -355,6 +363,20 @@ WebPage::WebPage(uint64_t pageID, const WebPageCreationParameters& parameters)
     
     setMediaVolume(parameters.mediaVolume);
 
+    WebProcess::shared().addMessageReceiver(Messages::WebPage::messageReceiverName(), m_pageID, this);
+
+    // FIXME: This should be done in the object constructors, and the objects themselves should be message receivers.
+    WebProcess::shared().addMessageReceiver(Messages::DrawingArea::messageReceiverName(), m_pageID, this);
+#if USE(COORDINATED_GRAPHICS)
+    WebProcess::shared().addMessageReceiver(Messages::LayerTreeCoordinator::messageReceiverName(), m_pageID, this);
+#endif
+#if ENABLE(INSPECTOR)
+    WebProcess::shared().addMessageReceiver(Messages::WebInspector::messageReceiverName(), m_pageID, this);
+#endif
+#if ENABLE(FULLSCREEN_API)
+    WebProcess::shared().addMessageReceiver(Messages::WebFullScreenManager::messageReceiverName(), m_pageID, this);
+#endif
+
 #ifndef NDEBUG
     webPageCounter.increment();
 #endif
@@ -372,6 +394,20 @@ WebPage::~WebPage()
     for (HashSet<PluginView*>::const_iterator it = m_pluginViews.begin(), end = m_pluginViews.end(); it != end; ++it)
         (*it)->webPageDestroyed();
 
+    WebProcess::shared().removeMessageReceiver(Messages::WebPage::messageReceiverName(), m_pageID);
+
+    // FIXME: This should be done in the object destructors, and the objects themselves should be message receivers.
+    WebProcess::shared().removeMessageReceiver(Messages::DrawingArea::messageReceiverName(), m_pageID);
+#if USE(COORDINATED_GRAPHICS)
+    WebProcess::shared().removeMessageReceiver(Messages::LayerTreeCoordinator::messageReceiverName(), m_pageID);
+#endif
+#if ENABLE(INSPECTOR)
+    WebProcess::shared().removeMessageReceiver(Messages::WebInspector::messageReceiverName(), m_pageID);
+#endif
+#if ENABLE(FULLSCREEN_API)
+    WebProcess::shared().removeMessageReceiver(Messages::WebFullScreenManager::messageReceiverName(), m_pageID);
+#endif
+
 #ifndef NDEBUG
     webPageCounter.decrement();
 #endif
@@ -455,20 +491,28 @@ void WebPage::initializeInjectedBundleDiagnosticLoggingClient(WKBundlePageDiagno
 PassRefPtr<Plugin> WebPage::createPlugin(WebFrame* frame, HTMLPlugInElement* pluginElement, const Plugin::Parameters& parameters)
 {
     String pluginPath;
-    bool blocked;
-
+    uint32_t pluginLoadPolicy;
     if (!WebProcess::shared().connection()->sendSync(
             Messages::WebProcessProxy::GetPluginPath(parameters.mimeType, parameters.url.string()),
-            Messages::WebProcessProxy::GetPluginPath::Reply(pluginPath, blocked), 0)) {
+            Messages::WebProcessProxy::GetPluginPath::Reply(pluginPath, pluginLoadPolicy), 0)) {
         return 0;
     }
 
-    if (blocked) {
+    switch (static_cast<PluginModuleLoadPolicy>(pluginLoadPolicy)) {
+    case PluginModuleLoadNormally:
+        break;
+
+    case PluginModuleBlocked:
         if (pluginElement->renderer()->isEmbeddedObject())
             toRenderEmbeddedObject(pluginElement->renderer())->setPluginUnavailabilityReason(RenderEmbeddedObject::InsecurePluginVersion);
 
         send(Messages::WebPageProxy::DidBlockInsecurePluginVersion(parameters.mimeType, parameters.url.string()));
         return 0;
+
+    case PluginModuleInactive:
+        if (pluginElement->renderer()->isEmbeddedObject())
+            toRenderEmbeddedObject(pluginElement->renderer())->setPluginUnavailabilityReason(RenderEmbeddedObject::PluginInactive);
+        return 0;
     }
 
     if (pluginPath.isNull()) {
@@ -630,6 +674,20 @@ PassRefPtr<ImmutableArray> WebPage::trackedRepaintRects()
     return ImmutableArray::adopt(vector);
 }
 
+static PluginView* focusedPluginViewForFrame(Frame* frame)
+{
+    if (!frame->document()->isPluginDocument())
+        return 0;
+
+    PluginDocument* pluginDocument = static_cast<PluginDocument*>(frame->document());
+
+    if (pluginDocument->focusedNode() != pluginDocument->pluginNode())
+        return 0;
+
+    PluginView* pluginView = static_cast<PluginView*>(pluginDocument->pluginWidget());
+    return pluginView;
+}
+
 static PluginView* pluginViewForFrame(Frame* frame)
 {
     if (!frame->document()->isPluginDocument())
@@ -646,7 +704,7 @@ void WebPage::executeEditingCommand(const String& commandName, const String& arg
     if (!frame)
         return;
 
-    if (PluginView* pluginView = pluginViewForFrame(frame)) {
+    if (PluginView* pluginView = focusedPluginViewForFrame(frame)) {
         pluginView->handleEditingCommand(commandName, argument);
         return;
     }
@@ -660,7 +718,7 @@ bool WebPage::isEditingCommandEnabled(const String& commandName)
     if (!frame)
         return false;
 
-    if (PluginView* pluginView = pluginViewForFrame(frame))
+    if (PluginView* pluginView = focusedPluginViewForFrame(frame))
         return pluginView->isEditingCommandEnabled(commandName);
     
     Editor::Command command = frame->editor()->command(commandName);
@@ -926,32 +984,6 @@ void WebPage::setFixedVisibleContentRect(const IntRect& rect)
     m_page->mainFrame()->view()->setFixedVisibleContentRect(rect);
 }
 
-void WebPage::setResizesToContentsUsingLayoutSize(const IntSize& targetLayoutSize)
-{
-    ASSERT(m_useFixedLayout);
-    ASSERT(!targetLayoutSize.isEmpty());
-
-    FrameView* view = m_page->mainFrame()->view();
-
-    view->setDelegatesScrolling(true);
-    view->setUseFixedLayout(true);
-    view->setPaintsEntireContents(true);
-
-    if (view->fixedLayoutSize() == targetLayoutSize)
-        return;
-
-    m_page->settings()->setAcceleratedCompositingForFixedPositionEnabled(true);
-    m_page->settings()->setFixedElementsLayoutRelativeToFrame(true);
-    m_page->settings()->setFixedPositionCreatesStackingContext(true);
-#if ENABLE(SMOOTH_SCROLLING)
-    // Ensure we don't do animated scrolling in the WebProcess when scrolling is delegated.
-    m_page->settings()->setEnableScrollAnimator(false);
-#endif
-
-    // Always reset even when empty. This also takes care of the relayout.
-    setFixedLayoutSize(targetLayoutSize);
-}
-
 void WebPage::resizeToContentsIfNeeded()
 {
     ASSERT(m_useFixedLayout);
@@ -990,7 +1022,8 @@ void WebPage::sendViewportAttributesChanged()
 
     ViewportAttributes attr = computeViewportAttributes(m_page->viewportArguments(), minimumLayoutFallbackWidth, deviceWidth, deviceHeight, m_page->deviceScaleFactor(), m_viewportSize);
 
-    setResizesToContentsUsingLayoutSize(IntSize(static_cast<int>(attr.layoutSize.width()), static_cast<int>(attr.layoutSize.height())));
+    // This also takes care of the relayout.
+    setFixedLayoutSize(IntSize(static_cast<int>(attr.layoutSize.width()), static_cast<int>(attr.layoutSize.height())));
     send(Messages::WebPageProxy::DidChangeViewportProperties(attr));
 }
 
@@ -1152,12 +1185,31 @@ float WebPage::deviceScaleFactor() const
 
 void WebPage::setUseFixedLayout(bool fixed)
 {
+    // Do not overwrite current settings if initially setting it to false.
+    if (m_useFixedLayout == fixed)
+        return;
     m_useFixedLayout = fixed;
 
+    m_page->settings()->setFixedElementsLayoutRelativeToFrame(fixed);
+#if USE(COORDINATED_GRAPHICS)
+    m_page->settings()->setAcceleratedCompositingForFixedPositionEnabled(fixed);
+    m_page->settings()->setFixedPositionCreatesStackingContext(fixed);
+#endif
+
+#if USE(TILED_BACKING_STORE) && ENABLE(SMOOTH_SCROLLING)
+    // Delegated scrolling will be enabled when the FrameView is created if fixed layout is enabled.
+    // Ensure we don't do animated scrolling in the WebProcess in that case.
+    m_page->settings()->setEnableScrollAnimator(!fixed);
+#endif
+
     FrameView* view = mainFrameView();
     if (!view)
         return;
 
+#if USE(TILED_BACKING_STORE)
+    view->setDelegatesScrolling(fixed);
+    view->setPaintsEntireContents(fixed);
+#endif
     view->setUseFixedLayout(fixed);
     if (!fixed)
         setFixedLayoutSize(IntSize());
@@ -1166,7 +1218,7 @@ void WebPage::setUseFixedLayout(bool fixed)
 void WebPage::setFixedLayoutSize(const IntSize& size)
 {
     FrameView* view = mainFrameView();
-    if (!view)
+    if (!view || view->fixedLayoutSize() == size)
         return;
 
     view->setFixedLayoutSize(size);
@@ -1573,7 +1625,7 @@ void WebPage::validateCommand(const String& commandName, uint64_t callbackID)
     int32_t state = 0;
     Frame* frame = m_page->focusController()->focusedOrMainFrame();
     if (frame) {
-        if (PluginView* pluginView = pluginViewForFrame(frame))
+        if (PluginView* pluginView = focusedPluginViewForFrame(frame))
             isEnabled = pluginView->isEditingCommandEnabled(commandName);
         else {
             Editor::Command command = frame->editor()->command(commandName);
@@ -1854,7 +1906,7 @@ void WebPage::didStartPageTransition()
 
 void WebPage::didCompletePageTransition()
 {
-#if PLATFORM(QT)
+#if USE(TILED_BACKING_STORE)
     if (m_mainFrame->coreFrame()->view()->delegatesScrolling())
         // Wait until the UI process sent us the visible rect it wants rendered.
         send(Messages::WebPageProxy::PageTransitionViewportReady());
@@ -3449,12 +3501,12 @@ static bool canPluginHandleResponse(const ResourceResponse& response)
 {
 #if ENABLE(NETSCAPE_PLUGIN_API)
     String pluginPath;
-    bool blocked;
+    uint32_t pluginLoadPolicy;
     
-    if (!WebProcess::shared().connection()->sendSync(Messages::WebProcessProxy::GetPluginPath(response.mimeType(), response.url().string()), Messages::WebProcessProxy::GetPluginPath::Reply(pluginPath, blocked), 0))
+    if (!WebProcess::shared().connection()->sendSync(Messages::WebProcessProxy::GetPluginPath(response.mimeType(), response.url().string()), Messages::WebProcessProxy::GetPluginPath::Reply(pluginPath, pluginLoadPolicy), 0))
         return false;
-    
-    return !blocked && !pluginPath.isEmpty();
+
+    return pluginLoadPolicy != PluginModuleBlocked && !pluginPath.isEmpty();
 #else
     return false;
 #endif
diff --git a/Source/WebKit2/WebProcess/WebPage/WebPage.h b/Source/WebKit2/WebProcess/WebPage/WebPage.h
index 74be313e7..eafc8716c 100644
--- a/Source/WebKit2/WebProcess/WebPage/WebPage.h
+++ b/Source/WebKit2/WebProcess/WebPage/WebPage.h
@@ -43,6 +43,7 @@
 #include "InjectedBundlePagePolicyClient.h"
 #include "InjectedBundlePageResourceLoadClient.h"
 #include "InjectedBundlePageUIClient.h"
+#include "MessageReceiver.h"
 #include "MessageSender.h"
 #include "TapHighlightController.h"
 #include "Plugin.h"
@@ -162,7 +163,7 @@ class WebGestureEvent;
 class WebTouchEvent;
 #endif
 
-class WebPage : public APIObject, public CoreIPC::MessageSender<WebPage> {
+class WebPage : public APIObject, public CoreIPC::MessageReceiver, public CoreIPC::MessageSender<WebPage> {
 public:
     static const Type APIType = TypeBundlePage;
 
@@ -238,9 +239,8 @@ public:
     WebOpenPanelResultListener* activeOpenPanelResultListener() const { return m_activeOpenPanelResultListener.get(); }
     void setActiveOpenPanelResultListener(PassRefPtr<WebOpenPanelResultListener>);
 
-    // -- Called from WebProcess.
-    void didReceiveMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::MessageDecoder&);
-    void didReceiveSyncMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::MessageDecoder&, OwnPtr<CoreIPC::MessageEncoder>&);
+    void didReceiveMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::MessageDecoder&) OVERRIDE;
+    void didReceiveSyncMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::MessageDecoder&, OwnPtr<CoreIPC::MessageEncoder>&) OVERRIDE;
 
     // -- InjectedBundle methods
 #if ENABLE(CONTEXT_MENUS)
@@ -378,7 +378,6 @@ public:
 #if USE(TILED_BACKING_STORE)
     void pageDidRequestScroll(const WebCore::IntPoint&);
     void setFixedVisibleContentRect(const WebCore::IntRect&);
-    void setResizesToContentsUsingLayoutSize(const WebCore::IntSize&);
     void resizeToContentsIfNeeded();
     void sendViewportAttributesChanged();
     void setViewportSize(const WebCore::IntSize&);
@@ -465,7 +464,10 @@ public:
     void gestureWillBegin(const WebCore::IntPoint&, bool& canBeginPanning);
     void gestureDidScroll(const WebCore::IntSize&);
     void gestureDidEnd();
-
+#elif PLATFORM(EFL)
+    void confirmComposition(const String& compositionString);
+    void setComposition(const WTF::String& compositionString, const WTF::Vector<WebCore::CompositionUnderline>& underlines, uint64_t cursorPosition);
+    void cancelComposition();
 #elif PLATFORM(GTK)
     void updateAccessibilityTree();
 #if USE(TEXTURE_MAPPER_GL)
diff --git a/Source/WebKit2/WebProcess/WebPage/WebPage.messages.in b/Source/WebKit2/WebProcess/WebPage/WebPage.messages.in
index e891890ac..0933aa1aa 100644
--- a/Source/WebKit2/WebProcess/WebPage/WebPage.messages.in
+++ b/Source/WebKit2/WebProcess/WebPage/WebPage.messages.in
@@ -292,6 +292,11 @@ messages -> WebPage {
     GestureDidScroll(WebCore::IntSize size)
     GestureDidEnd()
 #endif
+#if PLATFORM(EFL)
+    ConfirmComposition(WTF::String compositionString)
+    SetComposition(WTF::String compositionString, WTF::Vector<WebCore::CompositionUnderline> underlines, uint64_t cursorPosition)
+    CancelComposition()
+#endif
 #if PLATFORM(QT)
     FindZoomableAreaForPoint(WebCore::IntPoint point, WebCore::IntSize area)
 #endif
diff --git a/Source/WebKit2/WebProcess/WebPage/ca/LayerTreeHostCA.cpp b/Source/WebKit2/WebProcess/WebPage/ca/LayerTreeHostCA.cpp
index 0872f4355..dba55c212 100644
--- a/Source/WebKit2/WebProcess/WebPage/ca/LayerTreeHostCA.cpp
+++ b/Source/WebKit2/WebProcess/WebPage/ca/LayerTreeHostCA.cpp
@@ -203,16 +203,6 @@ void LayerTreeHostCA::paintContents(const GraphicsLayer* graphicsLayer, Graphics
     }
 }
 
-bool LayerTreeHostCA::showDebugBorders(const GraphicsLayer*) const
-{
-    return m_webPage->corePage()->settings()->showDebugBorders();
-}
-
-bool LayerTreeHostCA::showRepaintCounter(const GraphicsLayer*) const
-{
-    return m_webPage->corePage()->settings()->showRepaintCounter();
-}
-
 float LayerTreeHostCA::deviceScaleFactor() const
 {
     return m_webPage->corePage()->deviceScaleFactor();
diff --git a/Source/WebKit2/WebProcess/WebPage/ca/LayerTreeHostCA.h b/Source/WebKit2/WebProcess/WebPage/ca/LayerTreeHostCA.h
index 9cb8ca6a5..21b13da1c 100644
--- a/Source/WebKit2/WebProcess/WebPage/ca/LayerTreeHostCA.h
+++ b/Source/WebKit2/WebProcess/WebPage/ca/LayerTreeHostCA.h
@@ -76,8 +76,6 @@ private:
     virtual void notifyAnimationStarted(const WebCore::GraphicsLayer*, double time);
     virtual void notifyFlushRequired(const WebCore::GraphicsLayer*);
     virtual void paintContents(const WebCore::GraphicsLayer*, WebCore::GraphicsContext&, WebCore::GraphicsLayerPaintingPhase, const WebCore::IntRect& clipRect);
-    virtual bool showDebugBorders(const WebCore::GraphicsLayer*) const;
-    virtual bool showRepaintCounter(const WebCore::GraphicsLayer*) const;
     virtual float deviceScaleFactor() const;
     virtual void didCommitChangesForLayer(const WebCore::GraphicsLayer*) const { }
 
diff --git a/Source/WebKit2/WebProcess/WebPage/efl/WebPageEfl.cpp b/Source/WebKit2/WebProcess/WebPage/efl/WebPageEfl.cpp
index 0057e86ac..520ce8576 100644
--- a/Source/WebKit2/WebProcess/WebPage/efl/WebPageEfl.cpp
+++ b/Source/WebKit2/WebProcess/WebPage/efl/WebPageEfl.cpp
@@ -28,6 +28,7 @@
 #include "config.h"
 #include "WebPage.h"
 
+#include "EditorState.h"
 #include "NotImplemented.h"
 #include "WebEvent.h"
 #include "WindowsKeyboardCodes.h"
@@ -152,4 +153,56 @@ void WebPage::setThemePath(const String& themePath)
     theme->setThemePath(themePath);
 }
 
+static Frame* targetFrameForEditing(WebPage* page)
+{
+    Frame* frame = page->corePage()->focusController()->focusedOrMainFrame();
+    if (!frame)
+        return 0;
+
+    Editor* editor = frame->editor();
+    if (!editor->canEdit())
+        return 0;
+
+    if (editor->hasComposition()) {
+        // We should verify the parent node of this IME composition node are
+        // editable because JavaScript may delete a parent node of the composition
+        // node. In this case, WebKit crashes while deleting texts from the parent
+        // node, which doesn't exist any longer.
+        if (PassRefPtr<Range> range = editor->compositionRange()) {
+            Node* node = range->startContainer();
+            if (!node || !node->isContentEditable())
+                return 0;
+        }
+    }
+
+    return frame;
+}
+
+void WebPage::confirmComposition(const String& compositionString)
+{
+    Frame* targetFrame = targetFrameForEditing(this);
+    if (!targetFrame)
+        return;
+
+    targetFrame->editor()->confirmComposition(compositionString);
+}
+
+void WebPage::setComposition(const String& compositionString, const Vector<WebCore::CompositionUnderline>& underlines, uint64_t cursorPosition)
+{
+    Frame* targetFrame = targetFrameForEditing(this);
+    if (!targetFrame)
+        return;
+
+    targetFrame->editor()->setComposition(compositionString, underlines, cursorPosition, 0);
+}
+
+void WebPage::cancelComposition()
+{
+    Frame* frame = m_page->focusController()->focusedOrMainFrame();
+    if (!frame)
+        return;
+
+    frame->editor()->cancelComposition();
+}
+
 } // namespace WebKit
diff --git a/Source/WebKit2/WebProcess/WebPage/gtk/LayerTreeHostGtk.cpp b/Source/WebKit2/WebProcess/WebPage/gtk/LayerTreeHostGtk.cpp
index af2ae89bf..07fe12855 100644
--- a/Source/WebKit2/WebProcess/WebPage/gtk/LayerTreeHostGtk.cpp
+++ b/Source/WebKit2/WebProcess/WebPage/gtk/LayerTreeHostGtk.cpp
@@ -258,16 +258,6 @@ void LayerTreeHostGtk::paintContents(const GraphicsLayer* graphicsLayer, Graphic
     }
 }
 
-bool LayerTreeHostGtk::showDebugBorders(const GraphicsLayer*) const
-{
-    return m_webPage->corePage()->settings()->showDebugBorders();
-}
-
-bool LayerTreeHostGtk::showRepaintCounter(const GraphicsLayer*) const
-{
-    return m_webPage->corePage()->settings()->showRepaintCounter();
-}
-
 gboolean LayerTreeHostGtk::layerFlushTimerFiredCallback(LayerTreeHostGtk* layerTreeHost)
 {
     layerTreeHost->layerFlushTimerFired();
diff --git a/Source/WebKit2/WebProcess/WebPage/gtk/LayerTreeHostGtk.h b/Source/WebKit2/WebProcess/WebPage/gtk/LayerTreeHostGtk.h
index 61b9fa671..840ada813 100644
--- a/Source/WebKit2/WebProcess/WebPage/gtk/LayerTreeHostGtk.h
+++ b/Source/WebKit2/WebProcess/WebPage/gtk/LayerTreeHostGtk.h
@@ -77,8 +77,6 @@ private:
     virtual void notifyAnimationStarted(const WebCore::GraphicsLayer*, double time);
     virtual void notifyFlushRequired(const WebCore::GraphicsLayer*);
     virtual void paintContents(const WebCore::GraphicsLayer*, WebCore::GraphicsContext&, WebCore::GraphicsLayerPaintingPhase, const WebCore::IntRect& clipRect);
-    virtual bool showDebugBorders(const WebCore::GraphicsLayer*) const;
-    virtual bool showRepaintCounter(const WebCore::GraphicsLayer*) const;
     virtual void didCommitChangesForLayer(const WebCore::GraphicsLayer*) const { }
 
     void createPageOverlayLayer();
diff --git a/Source/WebKit2/WebProcess/WebPage/mac/RemoteLayerTreeDrawingArea.h b/Source/WebKit2/WebProcess/WebPage/mac/RemoteLayerTreeDrawingArea.h
new file mode 100644
index 000000000..c6163c1d6
--- /dev/null
+++ b/Source/WebKit2/WebProcess/WebPage/mac/RemoteLayerTreeDrawingArea.h
@@ -0,0 +1,52 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef RemoteLayerTreeDrawingArea_h
+#define RemoteLayerTreeDrawingArea_h
+
+#include "DrawingArea.h"
+#include <wtf/PassOwnPtr.h>
+
+namespace WebKit {
+
+class RemoteLayerTreeDrawingArea : public DrawingArea {
+public:
+    static PassOwnPtr<RemoteLayerTreeDrawingArea> create(WebPage*, const WebPageCreationParameters&);
+    virtual ~RemoteLayerTreeDrawingArea();
+
+private:
+    RemoteLayerTreeDrawingArea(WebPage*, const WebPageCreationParameters&);
+
+    // DrawingArea
+    virtual void setNeedsDisplay(const WebCore::IntRect&) OVERRIDE;
+    virtual void scroll(const WebCore::IntRect& scrollRect, const WebCore::IntSize& scrollOffset) OVERRIDE;
+
+    virtual void setRootCompositingLayer(WebCore::GraphicsLayer*) OVERRIDE;
+    virtual void scheduleCompositingLayerFlush() OVERRIDE;
+};
+
+} // namespace WebKit
+
+#endif // RemoteLayerTreeDrawingArea_h
diff --git a/Source/WebKit2/WebProcess/WebPage/mac/RemoteLayerTreeDrawingArea.mm b/Source/WebKit2/WebProcess/WebPage/mac/RemoteLayerTreeDrawingArea.mm
new file mode 100644
index 000000000..318b3815a
--- /dev/null
+++ b/Source/WebKit2/WebProcess/WebPage/mac/RemoteLayerTreeDrawingArea.mm
@@ -0,0 +1,63 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "RemoteLayerTreeDrawingArea.h"
+
+using namespace WebCore;
+
+namespace WebKit {
+
+PassOwnPtr<RemoteLayerTreeDrawingArea> RemoteLayerTreeDrawingArea::create(WebPage* webPage, const WebPageCreationParameters& parameters)
+{
+    return adoptPtr(new RemoteLayerTreeDrawingArea(webPage, parameters));
+}
+
+RemoteLayerTreeDrawingArea::RemoteLayerTreeDrawingArea(WebPage* webPage, const WebPageCreationParameters&)
+    : DrawingArea(DrawingAreaTypeRemoteLayerTree, webPage)
+{
+}
+
+RemoteLayerTreeDrawingArea::~RemoteLayerTreeDrawingArea()
+{
+}
+
+void RemoteLayerTreeDrawingArea::setNeedsDisplay(const IntRect&)
+{
+}
+
+void RemoteLayerTreeDrawingArea::scroll(const IntRect& scrollRect, const IntSize& scrollOffset)
+{
+}
+
+void RemoteLayerTreeDrawingArea::setRootCompositingLayer(GraphicsLayer*)
+{
+}
+
+void RemoteLayerTreeDrawingArea::scheduleCompositingLayerFlush()
+{
+}
+
+} // namespace WebKit
diff --git a/Source/WebKit2/WebProcess/WebPage/mac/TiledCoreAnimationDrawingArea.h b/Source/WebKit2/WebProcess/WebPage/mac/TiledCoreAnimationDrawingArea.h
index f5048a985..7d5b3be96 100644
--- a/Source/WebKit2/WebProcess/WebPage/mac/TiledCoreAnimationDrawingArea.h
+++ b/Source/WebKit2/WebProcess/WebPage/mac/TiledCoreAnimationDrawingArea.h
@@ -72,8 +72,6 @@ private:
     virtual void notifyAnimationStarted(const WebCore::GraphicsLayer*, double time) OVERRIDE;
     virtual void notifyFlushRequired(const WebCore::GraphicsLayer*) OVERRIDE;
     virtual void paintContents(const WebCore::GraphicsLayer*, WebCore::GraphicsContext&, WebCore::GraphicsLayerPaintingPhase, const WebCore::IntRect& clipRect) OVERRIDE;
-    virtual bool showDebugBorders(const WebCore::GraphicsLayer*) const OVERRIDE;
-    virtual bool showRepaintCounter(const WebCore::GraphicsLayer*) const OVERRIDE;
     virtual float deviceScaleFactor() const OVERRIDE;
 
     // WebCore::LayerFlushSchedulerClient
diff --git a/Source/WebKit2/WebProcess/WebPage/mac/TiledCoreAnimationDrawingArea.mm b/Source/WebKit2/WebProcess/WebPage/mac/TiledCoreAnimationDrawingArea.mm
index fcd72cac9..cf5d23e01 100644
--- a/Source/WebKit2/WebProcess/WebPage/mac/TiledCoreAnimationDrawingArea.mm
+++ b/Source/WebKit2/WebProcess/WebPage/mac/TiledCoreAnimationDrawingArea.mm
@@ -273,16 +273,6 @@ void TiledCoreAnimationDrawingArea::paintContents(const GraphicsLayer* graphicsL
     m_webPage->drawPageOverlay(graphicsContext, clipRect);
 }
 
-bool TiledCoreAnimationDrawingArea::showDebugBorders(const GraphicsLayer*) const
-{
-    return m_webPage->corePage()->settings()->showDebugBorders();
-}
-
-bool TiledCoreAnimationDrawingArea::showRepaintCounter(const GraphicsLayer*) const
-{
-    return m_webPage->corePage()->settings()->showRepaintCounter();
-}
-
 float TiledCoreAnimationDrawingArea::deviceScaleFactor() const
 {
     return m_webPage->corePage()->deviceScaleFactor();
diff --git a/Source/WebKit2/WebProcess/WebPage/mac/WebPageMac.mm b/Source/WebKit2/WebProcess/WebPage/mac/WebPageMac.mm
index 2acf85b0e..b524daf0c 100644
--- a/Source/WebKit2/WebProcess/WebPage/mac/WebPageMac.mm
+++ b/Source/WebKit2/WebProcess/WebPage/mac/WebPageMac.mm
@@ -679,11 +679,9 @@ bool WebPage::platformHasLocalDataForURL(const WebCore::KURL& url)
     NSMutableURLRequest* request = [[NSMutableURLRequest alloc] initWithURL:url];
     [request setValue:(NSString*)userAgent() forHTTPHeaderField:@"User-Agent"];
     NSCachedURLResponse *cachedResponse;
-#if USE(CFURLSTORAGESESSIONS)
     if (CFURLStorageSessionRef storageSession = ResourceHandle::currentStorageSession())
         cachedResponse = WKCachedResponseForRequest(storageSession, request);
     else
-#endif
         cachedResponse = [[NSURLCache sharedURLCache] cachedResponseForRequest:request];
     [request release];
     
@@ -695,10 +693,8 @@ static NSCachedURLResponse *cachedResponseForURL(WebPage* webPage, const KURL& u
     RetainPtr<NSMutableURLRequest> request(AdoptNS, [[NSMutableURLRequest alloc] initWithURL:url]);
     [request.get() setValue:(NSString *)webPage->userAgent() forHTTPHeaderField:@"User-Agent"];
 
-#if USE(CFURLSTORAGESESSIONS)
     if (CFURLStorageSessionRef storageSession = ResourceHandle::currentStorageSession())
         return WKCachedResponseForRequest(storageSession, request.get());
-#endif
 
     return [[NSURLCache sharedURLCache] cachedResponseForRequest:request.get()];
 }
diff --git a/Source/WebKit2/WebProcess/WebPage/win/WebPageWin.cpp b/Source/WebKit2/WebProcess/WebPage/win/WebPageWin.cpp
index 6294f00d8..212fe6d4d 100644
--- a/Source/WebKit2/WebProcess/WebPage/win/WebPageWin.cpp
+++ b/Source/WebKit2/WebProcess/WebPage/win/WebPageWin.cpp
@@ -266,19 +266,14 @@ static RetainPtr<CFCachedURLResponseRef> cachedResponseForURL(WebPage* webPage,
 {
     RetainPtr<CFURLRef> cfURL(AdoptCF, url.createCFURL());
     RetainPtr<CFMutableURLRequestRef> request(AdoptCF, CFURLRequestCreateMutable(0, cfURL.get(), kCFURLRequestCachePolicyReloadIgnoringCache, 60, 0));
-#if USE(CFURLSTORAGESESSIONS)
     wkSetRequestStorageSession(ResourceHandle::currentStorageSession(), request.get());
-#endif
 
-    RetainPtr<CFStringRef> userAgent(AdoptCF, webPage->userAgent().createCFString());
-    CFURLRequestSetHTTPHeaderFieldValue(request.get(), CFSTR("User-Agent"), userAgent.get());
+    CFURLRequestSetHTTPHeaderFieldValue(request.get(), CFSTR("User-Agent"), webPage->userAgent().createCFString().get());
 
     RetainPtr<CFURLCacheRef> cache;
-#if USE(CFURLSTORAGESESSIONS)
     if (CFURLStorageSessionRef currentStorageSession = ResourceHandle::currentStorageSession())
         cache.adoptCF(wkCopyURLCache(currentStorageSession));
     else
-#endif
         cache.adoptCF(CFURLCacheCopySharedURLCache());
 
     RetainPtr<CFCachedURLResponseRef> response(AdoptCF, CFURLCacheCopyResponseForRequest(cache.get(), request.get()));
diff --git a/Source/WebKit2/WebProcess/WebProcess.cpp b/Source/WebKit2/WebProcess/WebProcess.cpp
index 33be75989..60fe731b9 100644
--- a/Source/WebKit2/WebProcess/WebProcess.cpp
+++ b/Source/WebKit2/WebProcess/WebProcess.cpp
@@ -199,6 +199,16 @@ void WebProcess::addMessageReceiver(CoreIPC::StringReference messageReceiverName
     m_messageReceiverMap.addMessageReceiver(messageReceiverName, messageReceiver);
 }
 
+void WebProcess::addMessageReceiver(CoreIPC::StringReference messageReceiverName, uint64_t destinationID, CoreIPC::MessageReceiver* messageReceiver)
+{
+    m_messageReceiverMap.addMessageReceiver(messageReceiverName, destinationID, messageReceiver);
+}
+
+void WebProcess::removeMessageReceiver(CoreIPC::StringReference messageReceiverName, uint64_t destinationID)
+{
+    m_messageReceiverMap.removeMessageReceiver(messageReceiverName, destinationID);
+}
+
 void WebProcess::initializeWebProcess(const WebProcessCreationParameters& parameters, CoreIPC::MessageDecoder& decoder)
 {
     ASSERT(m_pageMap.isEmpty());
@@ -264,7 +274,8 @@ void WebProcess::initializeWebProcess(const WebProcessCreationParameters& parame
     if (parameters.shouldUseFontSmoothing)
         setShouldUseFontSmoothing(true);
 
-#if USE(CFURLSTORAGESESSIONS)
+#if PLATFORM(MAC) || USE(CFNETWORK)
+    // FIXME (NetworkProcess): Send this identifier to network process.
     WebCore::ResourceHandle::setPrivateBrowsingStorageSessionIdentifierBase(parameters.uiProcessBundleIdentifier);
 #endif
 
@@ -297,8 +308,7 @@ void WebProcess::ensureNetworkProcessConnection()
 #else
     ASSERT_NOT_REACHED();
 #endif
-
-    RefPtr<NetworkProcessConnection> m_networkProcessConnection = NetworkProcessConnection::create(connectionIdentifier);
+    m_networkProcessConnection = NetworkProcessConnection::create(connectionIdentifier);
 }
 #endif // ENABLE(NETWORK_PROCESS)
 
@@ -651,18 +661,8 @@ void WebProcess::terminate()
 
 void WebProcess::didReceiveSyncMessage(CoreIPC::Connection* connection, CoreIPC::MessageID messageID, CoreIPC::MessageDecoder& decoder, OwnPtr<CoreIPC::MessageEncoder>& replyEncoder)
 {
-    if (m_messageReceiverMap.dispatchSyncMessage(connection, messageID, decoder, replyEncoder))
-        return;
-
-    uint64_t pageID = decoder.destinationID();
-    if (!pageID)
-        return;
-    
-    WebPage* page = webPage(pageID);
-    if (!page)
+    m_messageReceiverMap.dispatchSyncMessage(connection, messageID, decoder, replyEncoder);
         return;
-    
-    page->didReceiveSyncMessage(connection, messageID, decoder, replyEncoder);
 }
 
 void WebProcess::didReceiveMessage(CoreIPC::Connection* connection, CoreIPC::MessageID messageID, CoreIPC::MessageDecoder& decoder)
@@ -692,25 +692,6 @@ void WebProcess::didReceiveMessage(CoreIPC::Connection* connection, CoreIPC::Mes
     }
 #endif
 
-#if ENABLE(BATTERY_STATUS)
-    if (messageID.is<CoreIPC::MessageClassWebBatteryManager>()) {
-        m_batteryManager.didReceiveMessage(connection, messageID, decoder);
-        return;
-    }
-#endif
-
-#if ENABLE(NETWORK_INFO)
-    if (messageID.is<CoreIPC::MessageClassWebNetworkInfoManager>()) {
-        m_networkInfoManager.didReceiveMessage(connection, messageID, decoder);
-        return;
-    }
-#endif
-
-    if (messageID.is<CoreIPC::MessageClassWebIconDatabaseProxy>()) {
-        m_iconDatabaseProxy.didReceiveMessage(connection, messageID, decoder);
-        return;
-    }
-
     if (messageID.is<CoreIPC::MessageClassWebKeyValueStorageManager>()) {
         WebKeyValueStorageManager::shared().didReceiveMessage(connection, messageID, decoder);
         return;
@@ -720,25 +701,11 @@ void WebProcess::didReceiveMessage(CoreIPC::Connection* connection, CoreIPC::Mes
         WebMediaCacheManager::shared().didReceiveMessage(connection, messageID, decoder);
         return;
     }
-
-#if ENABLE(NOTIFICATIONS) || ENABLE(LEGACY_NOTIFICATIONS)
-    if (messageID.is<CoreIPC::MessageClassWebNotificationManager>()) {
-        m_notificationManager.didReceiveMessage(connection, messageID, decoder);
-        return;
-    }
-#endif
     
     if (messageID.is<CoreIPC::MessageClassWebResourceCacheManager>()) {
         WebResourceCacheManager::shared().didReceiveMessage(connection, messageID, decoder);
         return;
     }
-
-#if USE(SOUP)
-    if (messageID.is<CoreIPC::MessageClassWebSoupRequestManager>()) {
-        m_soupRequestManager.didReceiveMessage(connection, messageID, decoder);
-        return;
-    }
-#endif
     
     if (messageID.is<CoreIPC::MessageClassWebPageGroupProxy>()) {
         uint64_t pageGroupID = decoder.destinationID();
@@ -751,16 +718,6 @@ void WebProcess::didReceiveMessage(CoreIPC::Connection* connection, CoreIPC::Mes
         
         pageGroupProxy->didReceiveMessage(connection, messageID, decoder);
     }
-
-    uint64_t pageID = decoder.destinationID();
-    if (!pageID)
-        return;
-    
-    WebPage* page = webPage(pageID);
-    if (!page)
-        return;
-    
-    page->didReceiveMessage(connection, messageID, decoder);
 }
 
 void WebProcess::didClose(CoreIPC::Connection*)
@@ -786,7 +743,7 @@ void WebProcess::didClose(CoreIPC::Connection*)
     m_runLoop->stop();
 }
 
-void WebProcess::didReceiveInvalidMessage(CoreIPC::Connection*, CoreIPC::MessageID)
+void WebProcess::didReceiveInvalidMessage(CoreIPC::Connection*, CoreIPC::StringReference, CoreIPC::StringReference)
 {
     // We received an invalid message, but since this is from the UI process (which we trust),
     // we'll let it slide.
@@ -1075,8 +1032,18 @@ void WebProcess::postInjectedBundleMessage(const CoreIPC::DataReference& message
 }
 
 #if ENABLE(NETWORK_PROCESS)
+NetworkProcessConnection* WebProcess::networkConnection()
+{
+    // FIXME (NetworkProcess): How do we handle not having the connection when the WebProcess needs it?
+    // If the NetworkProcess crashed, for example.  Do we respawn it?
+    ASSERT(m_networkProcessConnection);
+    return m_networkProcessConnection.get();
+}
+
 void WebProcess::networkProcessConnectionClosed(NetworkProcessConnection* connection)
 {
+    // FIXME (NetworkProcess): How do we handle not having the connection when the WebProcess needs it?
+    // If the NetworkProcess crashed, for example.  Do we respawn it?
     ASSERT(m_networkProcessConnection);
     ASSERT(m_networkProcessConnection == connection);
 
@@ -1085,6 +1052,8 @@ void WebProcess::networkProcessConnectionClosed(NetworkProcessConnection* connec
 
 void WebProcess::networkProcessCrashed(CoreIPC::Connection*)
 {
+    // FIXME (NetworkProcess): How do we handle not having the connection when the WebProcess needs it?
+    // If the NetworkProcess crashed, for example.  Do we respawn it?
     ASSERT(m_networkProcessConnection);
     
     networkProcessConnectionClosed(m_networkProcessConnection.get());
diff --git a/Source/WebKit2/WebProcess/WebProcess.h b/Source/WebKit2/WebProcess/WebProcess.h
index 88b5f5799..0b3c0fb99 100644
--- a/Source/WebKit2/WebProcess/WebProcess.h
+++ b/Source/WebKit2/WebProcess/WebProcess.h
@@ -72,6 +72,10 @@ QT_END_NAMESPACE
 #include "WebNotificationManager.h"
 #endif
 
+#if ENABLE(NETWORK_PROCESS)
+#include "WebResourceLoadScheduler.h"
+#endif
+
 #if ENABLE(PLUGIN_PROCESS)
 #include "PluginProcessConnectionManager.h"
 #endif
@@ -115,6 +119,9 @@ public:
     WebCore::RunLoop* runLoop() const { return m_runLoop; }
 
     void addMessageReceiver(CoreIPC::StringReference messageReceiverName, CoreIPC::MessageReceiver*);
+    void addMessageReceiver(CoreIPC::StringReference messageReceiverName, uint64_t destinationID, CoreIPC::MessageReceiver*);
+
+    void removeMessageReceiver(CoreIPC::StringReference messageReceiverName, uint64_t destinationID);
 
     WebConnectionToUIProcess* webConnectionToUIProcess() const { return m_connection.get(); }
 
@@ -196,7 +203,10 @@ public:
 #endif
 
 #if ENABLE(NETWORK_PROCESS)
+    NetworkProcessConnection* networkConnection();
     void networkProcessConnectionClosed(NetworkProcessConnection*);
+    bool usesNetworkProcess() const { return m_usesNetworkProcess; }
+    WebResourceLoadScheduler& webResourceLoadScheduler() { return m_webResourceLoadScheduler; }
 #endif
 
 private:
@@ -278,7 +288,7 @@ private:
     virtual void didReceiveMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::MessageDecoder&);
     virtual void didReceiveSyncMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::MessageDecoder&, OwnPtr<CoreIPC::MessageEncoder>&);
     virtual void didClose(CoreIPC::Connection*);
-    virtual void didReceiveInvalidMessage(CoreIPC::Connection*, CoreIPC::MessageID);
+    virtual void didReceiveInvalidMessage(CoreIPC::Connection*, CoreIPC::StringReference messageReceiverName, CoreIPC::StringReference messageName) OVERRIDE;
 #if PLATFORM(WIN)
     virtual Vector<HWND> windowsToReceiveSentMessagesWhileWaitingForSyncReply();
 #endif
@@ -354,6 +364,7 @@ private:
     void ensureNetworkProcessConnection();
     RefPtr<NetworkProcessConnection> m_networkProcessConnection;
     bool m_usesNetworkProcess;
+    WebResourceLoadScheduler m_webResourceLoadScheduler;
 #endif
 
 #if ENABLE(PLUGIN_PROCESS)
diff --git a/Source/WebKit2/WebProcess/WebProcess.messages.in b/Source/WebKit2/WebProcess/WebProcess.messages.in
index 2cc1e6280..2c1b43052 100644
--- a/Source/WebKit2/WebProcess/WebProcess.messages.in
+++ b/Source/WebKit2/WebProcess/WebProcess.messages.in
@@ -97,4 +97,8 @@ messages -> WebProcess {
     SecItemResponse(uint64_t requestID, WebKit::SecItemResponseData response) DispatchOnConnectionQueue
     SecKeychainItemResponse(uint64_t requestID, WebKit::SecKeychainItemResponseData response) DispatchOnConnectionQueue
 #endif
+
+#if PLATFORM(MAC)
+    SetApplicationIsOccluded(bool flag);
+#endif
 }
diff --git a/Source/WebKit2/WebProcess/efl/WebProcessMainEfl.cpp b/Source/WebKit2/WebProcess/efl/WebProcessMainEfl.cpp
index 589aa70fe..e4a807bca 100644
--- a/Source/WebKit2/WebProcess/efl/WebProcessMainEfl.cpp
+++ b/Source/WebKit2/WebProcess/efl/WebProcessMainEfl.cpp
@@ -41,6 +41,17 @@
 #include <wtf/MainThread.h>
 #include <wtf/text/CString.h>
 
+#ifdef HAVE_ECORE_X
+#include <Ecore_X.h>
+#include <X11/Xlib.h>
+#include <X11/extensions/Xext.h>
+
+static int dummyExtensionErrorHandler(Display*, _Xconst char*, _Xconst char*)
+{
+    return 0;
+}
+#endif
+
 #if USE(COORDINATED_GRAPHICS)
 #include "CoordinatedGraphicsLayer.h"
 #endif
@@ -64,6 +75,19 @@ WK_EXPORT int WebProcessMainEfl(int argc, char* argv[])
         return 1;
     }
 
+#ifdef HAVE_ECORE_X
+    XSetExtensionErrorHandler(dummyExtensionErrorHandler);
+
+    if (!ecore_x_init(0)) {
+        // Could not init ecore_x.
+        // PlatformScreenEfl and systemBeep() functions
+        // depend on ecore_x functionality.
+        ecore_shutdown();
+        eina_shutdown();
+        return 1;
+    }
+#endif
+
 #if ENABLE(GLIB_SUPPORT)
     g_type_init();
 
@@ -105,6 +129,10 @@ WK_EXPORT int WebProcessMainEfl(int argc, char* argv[])
     soup_cache_dump(soupCache);
     g_object_unref(soupCache);
 
+    ecore_x_shutdown();
+    ecore_shutdown();
+    eina_shutdown();
+
     return 0;
 
 }
diff --git a/Source/WebKit2/WebProcess/gtk/WebAuthDialog.cpp b/Source/WebKit2/WebProcess/gtk/WebAuthDialog.cpp
deleted file mode 100644
index f3c3eab9c..000000000
--- a/Source/WebKit2/WebProcess/gtk/WebAuthDialog.cpp
+++ /dev/null
@@ -1,67 +0,0 @@
-/*
- * Copyright (C) 2011 Igalia S.L.
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Library General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Library General Public License for more details.
- *
- * You should have received a copy of the GNU Library General Public License
- * along with this library; see the file COPYING.LIB.  If not, write to
- * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
- * Boston, MA 02110-1301, USA.
- */
-
-#include "config.h"
-#include "WebAuthDialog.h"
-
-#include <WebCore/GtkAuthenticationDialog.h>
-
-typedef struct {
-    GObject parent;
-} WebAuthDialog;
-
-typedef struct {
-    GObjectClass parent;
-} WebAuthDialogClass;
-
-static void webAuthDialogSessionFeatureInit(SoupSessionFeatureInterface*, gpointer);
-
-G_DEFINE_TYPE_WITH_CODE(WebAuthDialog, web_auth_dialog, G_TYPE_OBJECT,
-                        G_IMPLEMENT_INTERFACE(SOUP_TYPE_SESSION_FEATURE,
-                                              webAuthDialogSessionFeatureInit))
-
-static void web_auth_dialog_class_init(WebAuthDialogClass*)
-{
-}
-
-static void web_auth_dialog_init(WebAuthDialog*)
-{
-}
-
-static void sessionAuthenticate(SoupSession* session, SoupMessage* message, SoupAuth* auth, gboolean, gpointer)
-{
-    WebCore::GtkAuthenticationDialog* authDialog = new WebCore::GtkAuthenticationDialog(0, session, message, auth);
-    authDialog->show();
-}
-
-static void attach(SoupSessionFeature*, SoupSession* session)
-{
-    g_signal_connect(session, "authenticate", G_CALLBACK(sessionAuthenticate), 0);
-}
-
-static void detach(SoupSessionFeature*, SoupSession* session)
-{
-    g_signal_handlers_disconnect_by_func(session, reinterpret_cast<gpointer>(sessionAuthenticate), 0);
-}
-
-static void webAuthDialogSessionFeatureInit(SoupSessionFeatureInterface* feature, gpointer)
-{
-    feature->attach = attach;
-    feature->detach = detach;
-}
diff --git a/Source/WebKit2/WebProcess/gtk/WebAuthDialog.h b/Source/WebKit2/WebProcess/gtk/WebAuthDialog.h
deleted file mode 100644
index 9eafea10c..000000000
--- a/Source/WebKit2/WebProcess/gtk/WebAuthDialog.h
+++ /dev/null
@@ -1,29 +0,0 @@
-/*
- * Copyright (C) 2011 Igalia S.L.
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Library General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Library General Public License for more details.
- *
- * You should have received a copy of the GNU Library General Public License
- * along with this library; see the file COPYING.LIB.  If not, write to
- * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
- * Boston, MA 02110-1301, USA.
- */
-
-#ifndef WebAuthDialog_h
-#define WebAuthDialog_h
-
-#include <glib-object.h>
-
-#define WEB_TYPE_AUTH_DIALOG (web_auth_dialog_get_type())
-
-GType web_auth_dialog_get_type();
-
-#endif // WebAuthDialog_h
diff --git a/Source/WebKit2/WebProcess/gtk/WebProcessMainGtk.cpp b/Source/WebKit2/WebProcess/gtk/WebProcessMainGtk.cpp
index 7dacc226e..f17ac6cee 100644
--- a/Source/WebKit2/WebProcess/gtk/WebProcessMainGtk.cpp
+++ b/Source/WebKit2/WebProcess/gtk/WebProcessMainGtk.cpp
@@ -29,9 +29,7 @@
 
 #define LIBSOUP_USE_UNSTABLE_REQUEST_API
 
-#include "WebAuthDialog.h"
 #include "WKBase.h"
-#include <WebCore/GtkAuthenticationDialog.h>
 #include <WebCore/ResourceHandle.h>
 #include <WebCore/RunLoop.h>
 #include <WebKit2/WebProcess.h>
@@ -66,12 +64,10 @@ WK_EXPORT int WebProcessMainGtk(int argc, char* argv[])
     int socket = atoi(argv[1]);
     WebProcess::shared().initialize(socket, RunLoop::main());
 
-    SoupSession* session = WebCore::ResourceHandle::defaultSession();
-    soup_session_add_feature_by_type(session, WEB_TYPE_AUTH_DIALOG);
-
     // Despite using system CAs to validate certificates we're
     // accepting invalid certificates by default. New API will be
     // added later to let client accept/discard invalid certificates.
+    SoupSession* session = WebCore::ResourceHandle::defaultSession();
     g_object_set(session, SOUP_SESSION_SSL_USE_SYSTEM_CA_FILE, TRUE,
                  SOUP_SESSION_SSL_STRICT, FALSE, NULL);
 
diff --git a/Source/WebKit2/WebProcess/mac/WebProcessMac.mm b/Source/WebKit2/WebProcess/mac/WebProcessMac.mm
index 10766d2cc..001deb4c8 100644
--- a/Source/WebKit2/WebProcess/mac/WebProcessMac.mm
+++ b/Source/WebKit2/WebProcess/mac/WebProcessMac.mm
@@ -53,6 +53,7 @@
 #endif
 
 #if ENABLE(WEB_PROCESS_SANDBOX)
+#import <pwd.h>
 #import <stdlib.h>
 #import <sysexits.h>
 
@@ -168,15 +169,9 @@ static void appendReadonlySandboxDirectory(Vector<const char*>& vector, const ch
     appendSandboxParameterPathInternal(vector, name, [path length] ? [(NSString *)path fileSystemRepresentation] : "");
 }
 
-static void appendReadwriteSandboxDirectory(Vector<const char*>& vector, const char* name, NSString *path)
+static void appendReadwriteSandboxDirectory(Vector<const char*>& vector, const char* name, const char* path)
 {
-    NSError *error = nil;
-
-    // This is very unlikely to fail, but in case it actually happens, we'd like some sort of output in the console.
-    if (![[NSFileManager defaultManager] createDirectoryAtPath:path withIntermediateDirectories:YES attributes:nil error:&error])
-        NSLog(@"could not create \"%@\", error %@", path, error);
-
-    appendSandboxParameterPathInternal(vector, name, [(NSString *)path fileSystemRepresentation]);
+    appendSandboxParameterPathInternal(vector, name, path);
 }
 
 #endif
@@ -215,8 +210,17 @@ void WebProcess::initializeSandbox(const String& clientIdentifier)
     appendReadwriteConfDirectory(sandboxParameters, "DARWIN_USER_TEMP_DIR", _CS_DARWIN_USER_TEMP_DIR);
     appendReadwriteConfDirectory(sandboxParameters, "DARWIN_USER_CACHE_DIR", _CS_DARWIN_USER_CACHE_DIR);
 
+    char buffer[4096];
+    int bufferSize = sizeof(buffer);
+    struct passwd pwd;
+    struct passwd* result = 0;
+    if (getpwuid_r(getuid(), &pwd, buffer, bufferSize, &result) || !result) {
+        WTFLogAlways("WebProcess: Couldn't find home directory\n");
+        exit(EX_NOPERM);
+    }
+
     // These are read-write paths.
-    appendReadwriteSandboxDirectory(sandboxParameters, "HOME_DIR", NSHomeDirectory());
+    appendReadwriteSandboxDirectory(sandboxParameters, "HOME_DIR", pwd.pw_dir);
 
     sandboxParameters.append(static_cast<const char*>(0));
 
@@ -224,7 +228,7 @@ void WebProcess::initializeSandbox(const String& clientIdentifier)
 
     char* errorBuf;
     if (sandbox_init_with_parameters(profilePath, SANDBOX_NAMED_EXTERNAL, sandboxParameters.data(), &errorBuf)) {
-        WTFLogAlways("WebProcess: couldn't initialize sandbox profile [%s] error '%s'\n", profilePath, errorBuf);
+        WTFLogAlways("WebProcess: Couldn't initialize sandbox profile [%s] error '%s'\n", profilePath, errorBuf);
         for (size_t i = 0; sandboxParameters[i]; i += 2)
             WTFLogAlways("%s=%s\n", sandboxParameters[i], sandboxParameters[i + 1]);
         exit(EX_NOPERM);
@@ -236,7 +240,7 @@ void WebProcess::initializeSandbox(const String& clientIdentifier)
     // This will override LSFileQuarantineEnabled from Info.plist unless sandbox quarantine is globally disabled.
     OSStatus error = WKEnableSandboxStyleFileQuarantine();
     if (error) {
-        WTFLogAlways("WebProcess: couldn't enable sandbox style file quarantine: %ld\n", (long)error);
+        WTFLogAlways("WebProcess: Couldn't enable sandbox style file quarantine: %ld\n", (long)error);
         exit(EX_NOPERM);
     }
 #endif
diff --git a/Source/WebKit2/WebProcess/soup/WebSoupRequestManager.cpp b/Source/WebKit2/WebProcess/soup/WebSoupRequestManager.cpp
index b9b3587f4..c7d10c6b3 100644
--- a/Source/WebKit2/WebProcess/soup/WebSoupRequestManager.cpp
+++ b/Source/WebKit2/WebProcess/soup/WebSoupRequestManager.cpp
@@ -27,6 +27,7 @@
 #include "WebKitSoupRequestInputStream.h"
 #include "WebPageProxyMessages.h"
 #include "WebProcess.h"
+#include "WebSoupRequestManagerMessages.h"
 #include "WebSoupRequestManagerProxyMessages.h"
 #include <WebCore/ResourceHandle.h>
 #include <WebCore/ResourceRequest.h>
@@ -80,6 +81,7 @@ WebSoupRequestManager::WebSoupRequestManager(WebProcess* process)
     : m_process(process)
     , m_schemes(adoptGRef(g_ptr_array_new_with_free_func(g_free)))
 {
+    m_process->addMessageReceiver(Messages::WebSoupRequestManager::messageReceiverName(), this);
 }
 
 WebSoupRequestManager::~WebSoupRequestManager()
diff --git a/Source/WebKit2/WebProcess/soup/WebSoupRequestManager.h b/Source/WebKit2/WebProcess/soup/WebSoupRequestManager.h
index cae652ecf..8178411a6 100644
--- a/Source/WebKit2/WebProcess/soup/WebSoupRequestManager.h
+++ b/Source/WebKit2/WebProcess/soup/WebSoupRequestManager.h
@@ -20,6 +20,8 @@
 #ifndef WebSoupRequestManager_h
 #define WebSoupRequestManager_h
 
+#include "DataReference.h"
+#include "MessageReceiver.h"
 #include <wtf/HashMap.h>
 #include <wtf/Noncopyable.h>
 #include <wtf/OwnPtr.h>
@@ -29,19 +31,12 @@
 typedef struct _GInputStream GInputStream;
 typedef struct _GSimpleAsyncResult GSimpleAsyncResult;
 
-namespace CoreIPC {
-class Connection;
-class DataReference;
-class MessageDecoder;
-class MessageID;
-}
-
 namespace WebKit {
 
 class WebProcess;
 struct WebSoupRequestAsyncData;
 
-class WebSoupRequestManager {
+class WebSoupRequestManager : private CoreIPC::MessageReceiver {
     WTF_MAKE_NONCOPYABLE(WebSoupRequestManager);
 public:
     explicit WebSoupRequestManager(WebProcess*);
@@ -50,9 +45,11 @@ public:
     void send(GSimpleAsyncResult*, GCancellable*);
     GInputStream* finish(GSimpleAsyncResult*);
 
-    void didReceiveMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::MessageDecoder&);
-
 private:
+    // CoreIPC::MessageReceiver
+    void didReceiveMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::MessageDecoder&) OVERRIDE;
+
+    // Implemented in generated WebSoupRequestManagerMessageReceiver.cpp
     void didReceiveWebSoupRequestManagerMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::MessageDecoder&);
 
     void registerURIScheme(const String& scheme);
diff --git a/Source/WebKit2/WebProcess/win/WebProcessWin.cpp b/Source/WebKit2/WebProcess/win/WebProcessWin.cpp
index 25dbc36c4..40066a276 100644
--- a/Source/WebKit2/WebProcess/win/WebProcessWin.cpp
+++ b/Source/WebKit2/WebProcess/win/WebProcessWin.cpp
@@ -71,15 +71,13 @@ void WebProcess::platformSetCacheModel(CacheModel cacheModel)
 {
 #if USE(CFNETWORK)
     RetainPtr<CFStringRef> cfurlCacheDirectory;
-#if USE(CFURLSTORAGESESSIONS)
     if (CFURLStorageSessionRef defaultStorageSession = ResourceHandle::defaultStorageSession())
         cfurlCacheDirectory.adoptCF(wkCopyFoundationCacheDirectory(defaultStorageSession));
     else
-#endif
         cfurlCacheDirectory.adoptCF(wkCopyFoundationCacheDirectory(0));
 
     if (!cfurlCacheDirectory)
-        cfurlCacheDirectory.adoptCF(WebCore::localUserSpecificStorageDirectory().createCFString());
+        cfurlCacheDirectory = WebCore::localUserSpecificStorageDirectory().createCFString();
 
     // As a fudge factor, use 1000 instead of 1024, in case the reported byte 
     // count doesn't align exactly to a megabyte boundary.
@@ -103,11 +101,9 @@ void WebProcess::platformSetCacheModel(CacheModel cacheModel)
     pageCache()->setCapacity(pageCacheCapacity);
 
     RetainPtr<CFURLCacheRef> cfurlCache;
-#if USE(CFURLSTORAGESESSIONS)
     if (CFURLStorageSessionRef defaultStorageSession = ResourceHandle::defaultStorageSession())
         cfurlCache.adoptCF(wkCopyURLCache(defaultStorageSession));
     else
-#endif // USE(CFURLSTORAGESESSIONS)
         cfurlCache.adoptCF(CFURLCacheCopySharedURLCache());
 
     CFURLCacheSetMemoryCapacity(cfurlCache.get(), urlCacheMemoryCapacity);
@@ -122,11 +118,9 @@ void WebProcess::platformClearResourceCaches(ResourceCachesToClear cachesToClear
         return;
 
     RetainPtr<CFURLCacheRef> cache;
-#if USE(CFURLSTORAGESESSIONS)
     if (CFURLStorageSessionRef defaultStorageSession = ResourceHandle::defaultStorageSession())
         cache.adoptCF(wkCopyURLCache(defaultStorageSession));
     else
-#endif // USE(CFURLSTORAGESESSIONS)
         cache.adoptCF(CFURLCacheCopySharedURLCache());
 
     CFURLCacheRemoveAllCachedResponses(cache.get());
@@ -148,13 +142,12 @@ void WebProcess::platformInitializeWebProcess(const WebProcessCreationParameters
     if (defaultStorageSession)
         return;
 
-    RetainPtr<CFStringRef> cachePath(AdoptCF, parameters.diskCacheDirectory.createCFString());
-    if (!cachePath)
+    if (!parameters.diskCacheDirectory)
         return;
 
     CFIndex cacheDiskCapacity = parameters.cfURLCacheDiskCapacity;
     CFIndex cacheMemoryCapacity = parameters.cfURLCacheMemoryCapacity;
-    RetainPtr<CFURLCacheRef> uiProcessCache(AdoptCF, CFURLCacheCreate(kCFAllocatorDefault, cacheMemoryCapacity, cacheDiskCapacity, cachePath.get()));
+    RetainPtr<CFURLCacheRef> uiProcessCache(AdoptCF, CFURLCacheCreate(kCFAllocatorDefault, cacheMemoryCapacity, cacheDiskCapacity, parameters.diskCacheDirectory.createCFString().get()));
     CFURLCacheSetSharedURLCache(uiProcessCache.get());
 #endif // USE(CFNETWORK)
 }
diff --git a/Source/WebKit2/mac/WebKit2.order b/Source/WebKit2/mac/WebKit2.order
index 21ca2ff6c..0c2c53582 100644
--- a/Source/WebKit2/mac/WebKit2.order
+++ b/Source/WebKit2/mac/WebKit2.order
@@ -3384,3 +3384,5 @@ _WKAdvanceDefaultButtonPulseAnimation
 _WKAppKitDrawDecoyWindow_isKeyWindow
 __ZN6WebKit7WebPage36suspendActiveDOMObjectsAndAnimationsEv
 __ZN6WebKit7WebPage35resumeActiveDOMObjectsAndAnimationsEv
+__ZNK7WebCore5Frame25trackedRepaintRectsAsTextEv
+__ZN7WebCore9FrameView17setTracksRepaintsEb
diff --git a/Source/WebKit2/win/WebKit2.def b/Source/WebKit2/win/WebKit2.def
index 5fe9caf05..19389a9c5 100644
--- a/Source/WebKit2/win/WebKit2.def
+++ b/Source/WebKit2/win/WebKit2.def
@@ -216,6 +216,7 @@ EXPORTS
         ?scriptExecutionContext@JSDOMGlobalObject@WebCore@@QBEPAVScriptExecutionContext@2@XZ
         ?scriptNameToCode@WebCore@@YA?AW4UScriptCode@@ABVString@WTF@@@Z
         ?scrollElementToRect@FrameView@WebCore@@QAEXPAVElement@2@ABVIntRect@2@@Z
+        ?scrollingStateTreeAsText@Page@WebCore@@QAE?AVString@WTF@@XZ
         ?setCanStartMedia@Page@WebCore@@QAEX_N@Z
         ?setCursiveFontFamily@Settings@WebCore@@QAEXABVAtomicString@WTF@@W4UScriptCode@@@Z
         ?setDeviceScaleFactor@Page@WebCore@@QAEXM@Z
@@ -241,6 +242,8 @@ EXPORTS
         ?setStorageBlockingPolicy@Settings@WebCore@@QAEXW4StorageBlockingPolicy@SecurityOrigin@2@@Z
         ?setSuggestedValue@HTMLInputElement@WebCore@@QAEXABVString@WTF@@@Z
         ?setEditingValue@HTMLInputElement@WebCore@@QAEXABVString@WTF@@@Z
+        ?setResolutionOverride@Settings@WebCore@@QAEXABVIntSize@2@@Z
+        ?setMediaTypeOverride@Settings@WebCore@@QAEXABVString@WTF@@@Z
         ?settings@Document@WebCore@@QBEPAVSettings@2@XZ
         ?settings@Frame@WebCore@@QBEPAVSettings@2@XZ
         ?setFixedElementsLayoutRelativeToFrame@Settings@WebCore@@QAEX_N@Z
@@ -311,4 +314,6 @@ EXPORTS
         ?toJS@WebCore@@YA?AVJSValue@JSC@@PAVExecState@3@PAVJSDOMGlobalObject@1@PAVDOMWindow@1@@Z
         ?windowObjectCleared@InspectorFrontendClientLocal@WebCore@@UAEXXZ
         ?layerTreeAsText@Frame@WebCore@@QBE?AVString@WTF@@I@Z
+        ?trackedRepaintRectsAsText@Frame@WebCore@@QBE?AVString@WTF@@XZ
+        ?setTracksRepaints@FrameView@WebCore@@QAEX_N@Z
 
diff --git a/Source/WebKit2/win/WebKit2CFLite.def b/Source/WebKit2/win/WebKit2CFLite.def
index 5a9d4bc77..a3152e218 100644
--- a/Source/WebKit2/win/WebKit2CFLite.def
+++ b/Source/WebKit2/win/WebKit2CFLite.def
@@ -209,6 +209,7 @@ EXPORTS
         ?scriptExecutionContext@JSDOMGlobalObject@WebCore@@QBEPAVScriptExecutionContext@2@XZ
         ?scriptNameToCode@WebCore@@YA?AW4UScriptCode@@ABVString@WTF@@@Z
         ?scrollElementToRect@FrameView@WebCore@@QAEXPAVElement@2@ABVIntRect@2@@Z
+        ?scrollingStateTreeAsText@Page@WebCore@@QAE?AVString@WTF@@XZ
         ?setCanStartMedia@Page@WebCore@@QAEX_N@Z
         ?setCursiveFontFamily@Settings@WebCore@@QAEXABVAtomicString@WTF@@W4UScriptCode@@@Z
         ?setDeviceScaleFactor@Page@WebCore@@QAEXM@Z
@@ -299,3 +300,5 @@ EXPORTS
         ?setProperty@Settings@InspectorFrontendClientLocal@WebCore@@UAEXABVString@WTF@@0@Z
         ?toJS@WebCore@@YA?AVJSValue@JSC@@PAVExecState@3@PAVJSDOMGlobalObject@1@PAVDOMWindow@1@@Z
         ?windowObjectCleared@InspectorFrontendClientLocal@WebCore@@UAEXXZ
+        ?trackedRepaintRectsAsText@Frame@WebCore@@QBE?AVString@WTF@@XZ
+        ?setTracksRepaints@FrameView@WebCore@@QAEX_N@Z
diff --git a/Source/autotools/symbols.filter b/Source/autotools/symbols.filter
index 8c5dab0d2..39ceedea0 100644
--- a/Source/autotools/symbols.filter
+++ b/Source/autotools/symbols.filter
@@ -30,6 +30,7 @@ _ZN24DumpRenderTreeSupportGtk*;
 _ZN7WebCore4Page13setPaginationERKNS_10PaginationE;
 _ZN7WebCore4Page18setPageScaleFactorEfRKNS_8IntPointE;
 _ZN7WebCore4Page20setDeviceScaleFactorEf;
+_ZN7WebCore4Page24scrollingStateTreeAsTextEv;
 _ZN7WebCore4Page16setCanStartMediaEb;
 _ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_17JSDOMGlobalObjectEPNS_10ClientRectE;
 _ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_17JSDOMGlobalObjectEPNS_10ShadowRootE;
@@ -174,6 +175,8 @@ _ZN7WebCore8Settings24setMockScrollbarsEnabledEb;
 _ZN7WebCore8Settings24setUsesOverlayScrollbarsEb;
 _ZN7WebCore8Settings24setStorageBlockingPolicyENS_14SecurityOrigin21StorageBlockingPolicyE;
 _ZN7WebCore8Settings37setFixedElementsLayoutRelativeToFrameEb;
+_ZN7WebCore8Settings21setResolutionOverrideERKNS_7IntSizeE;
+_ZN7WebCore8Settings20setMediaTypeOverrideERKN3WTF6StringE;
 _ZN7WebCore9FrameView17paintControlTintsEv;
 _ZN7WebCore9FrameView19scrollElementToRectEPNS_7ElementERKNS_7IntRectE;
 _ZN7WebCore22RuntimeEnabledFeatures31isMultipleShadowSubtreesEnabledE;
@@ -204,6 +207,8 @@ _ZN7WebCore12PrintContext26pageSizeAndMarginsInPixelsEPNS_5FrameEiiiiiii;
 _ZNK7WebCore9DOMWindow8documentEv;
 _ZTVN7WebCore28InspectorFrontendClientLocal8SettingsE;
 _ZNK7WebCore5Frame15layerTreeAsTextEj;
+_ZN7WebCore9FrameView17setTracksRepaintsEb;
+_ZNK7WebCore5Frame25trackedRepaintRectsAsTextEv;
 
 local:
 _Z*;
diff --git a/Source/cmake/FindEcore.cmake b/Source/cmake/FindEcore.cmake
index ec76b6585..38bbf0fd8 100644
--- a/Source/cmake/FindEcore.cmake
+++ b/Source/cmake/FindEcore.cmake
@@ -67,6 +67,11 @@ FIND_EFL_LIBRARY(ECORE_X
     HEADER_PREFIXES ecore-1
     LIBRARY ecore_x
 )
+FIND_EFL_LIBRARY(ECORE_IMF
+    HEADERS Ecore_IMF.h Ecore_IMF_Evas.h
+    HEADER_PREFIXES ecore-1
+    LIBRARY ecore_imf
+)
 
 FOREACH(_component ${Ecore_FIND_COMPONENTS})
     SET(_ecore_component "ECORE_${_component}")
diff --git a/Source/cmake/OptionsBlackBerry.cmake b/Source/cmake/OptionsBlackBerry.cmake
index b946014c6..cef0ffa5c 100644
--- a/Source/cmake/OptionsBlackBerry.cmake
+++ b/Source/cmake/OptionsBlackBerry.cmake
@@ -122,9 +122,19 @@ IF (TARGETING_PLAYBOOK)
     SET(CMAKE_C_FLAGS "-mfpu=neon ${CMAKE_C_FLAGS}")
     SET(CMAKE_CXX_FLAGS "-mthumb -mthumb-interwork ${CMAKE_CXX_FLAGS}")
     SET(CMAKE_C_FLAGS "-mthumb -mthumb-interwork ${CMAKE_C_FLAGS}")
+    # check for BB_RELEASE_FLAGS or BB_DEBUG_FLAGS to set CMAKE_C_FLAGS{DEBUG|RELEASE} CMAKE_CXX_FLAGS{DEBUG|RELEASE}
+    if( DEFINED ENV{BB_RELEASE_FLAGS} )
+        set(CMAKE_CXX_FLAGS_RELEASE  "$ENV{BB_RELEASE_FLAGS} -DNDEBUG")
+        set(CMAKE_C_FLAGS_RELEASE  "$ENV{BB_RELEASE_FLAGS} -DNDEBUG")
+        message( "== ENV override RELEASE ${CMAKE_CXX_FLAGS_RELEASE}" )
+    endif()
+    if( DEFINED ENV{BB_DEBUG_FLAGS} )
+        set(CMAKE_CXX_FLAGS_DEBUG "$ENV{BB_DEBUG_FLAGS}")
+        set(CMAKE_C_FLAGS_DEBUG "$ENV{BB_DEBUG_FLAGS}")
+        message( "== ENV override DEBUG ${CMAKE_CXX_FLAGS_DEBUG}")
+    endif()
 ENDIF ()
 
-ADD_DEFINITIONS(-DRESOURCE_PATH="/usr/share/webkit/resources/")
 INCLUDE_DIRECTORIES(${CMAKE_INCLUDE_PATH})
 
 SET(JSC_EXECUTABLE_NAME jsc)
diff --git a/Source/cmake/OptionsEfl.cmake b/Source/cmake/OptionsEfl.cmake
index 0f366d798..5dbd9e06c 100644
--- a/Source/cmake/OptionsEfl.cmake
+++ b/Source/cmake/OptionsEfl.cmake
@@ -56,6 +56,7 @@ WEBKIT_OPTION_DEFAULT_PORT_VALUE(ENABLE_API_TESTS ON)
 WEBKIT_OPTION_DEFAULT_PORT_VALUE(ENABLE_BATTERY_STATUS ON)
 WEBKIT_OPTION_DEFAULT_PORT_VALUE(ENABLE_BLOB ON)
 WEBKIT_OPTION_DEFAULT_PORT_VALUE(ENABLE_CSS3_TEXT ON)
+WEBKIT_OPTION_DEFAULT_PORT_VALUE(ENABLE_CSS_DEVICE_ADAPTATION ON)
 WEBKIT_OPTION_DEFAULT_PORT_VALUE(ENABLE_CSS_IMAGE_SET ON)
 WEBKIT_OPTION_DEFAULT_PORT_VALUE(ENABLE_CSS_STICKY_POSITION ON)
 WEBKIT_OPTION_DEFAULT_PORT_VALUE(ENABLE_CSS_VARIABLES ON)
@@ -78,6 +79,7 @@ WEBKIT_OPTION_DEFAULT_PORT_VALUE(ENABLE_NAVIGATOR_CONTENT_UTILS ON)
 WEBKIT_OPTION_DEFAULT_PORT_VALUE(ENABLE_NETSCAPE_PLUGIN_API ON)
 WEBKIT_OPTION_DEFAULT_PORT_VALUE(ENABLE_NETWORK_INFO ON)
 WEBKIT_OPTION_DEFAULT_PORT_VALUE(ENABLE_PAGE_VISIBILITY_API ON)
+WEBKIT_OPTION_DEFAULT_PORT_VALUE(ENABLE_RESOLUTION_MEDIA_QUERY ON)
 WEBKIT_OPTION_DEFAULT_PORT_VALUE(ENABLE_REGIONS ON)
 WEBKIT_OPTION_DEFAULT_PORT_VALUE(ENABLE_REQUEST_ANIMATION_FRAME ON)
 WEBKIT_OPTION_DEFAULT_PORT_VALUE(ENABLE_SHADOW_DOM ON)
@@ -91,6 +93,7 @@ WEBKIT_OPTION_DEFAULT_PORT_VALUE(ENABLE_WEB_INTENTS ON)
 WEBKIT_OPTION_DEFAULT_PORT_VALUE(ENABLE_WEB_INTENTS_TAG ON)
 WEBKIT_OPTION_DEFAULT_PORT_VALUE(ENABLE_WEB_TIMING ON)
 WEBKIT_OPTION_DEFAULT_PORT_VALUE(ENABLE_WORKERS ON)
+WEBKIT_OPTION_DEFAULT_PORT_VALUE(ENABLE_XHR_TIMEOUT ON)
 
 # FIXME: Perhaps we need a more generic way of defining dependencies between features.
 # VIDEO_TRACK depends on VIDEO.
@@ -102,6 +105,11 @@ WEBKIT_OPTION_END()
 
 OPTION(ENABLE_ECORE_X "Enable Ecore_X specific usage (cursor, bell)" ON)
 IF (ENABLE_ECORE_X)
+    # We need Xext.h to disable Xlib error messages  when running WTR on Xvfb.
+    # These errors are dumped on stderr and makes the test driver thinks that
+    # the test case has failed.
+    FIND_PACKAGE(X11 REQUIRED)
+
     LIST(APPEND ECORE_ADDITIONAL_COMPONENTS X)
     ADD_DEFINITIONS(-DHAVE_ECORE_X)
 ENDIF ()
@@ -167,21 +175,23 @@ ENDIF ()
 SET(CPACK_SOURCE_GENERATOR TBZ2)
 
 IF (WTF_USE_TILED_BACKING_STORE)
-  SET(WTF_USE_ACCELERATED_COMPOSITING 1)
   ADD_DEFINITIONS(-DWTF_USE_ACCELERATED_COMPOSITING=1)
 
-  SET(WTF_USE_COORDINATED_GRAPHICS 1)
   ADD_DEFINITIONS(-DWTF_USE_COORDINATED_GRAPHICS=1)
 
   SET(WTF_USE_TEXTURE_MAPPER 1)
   ADD_DEFINITIONS(-DWTF_USE_TEXTURE_MAPPER=1)
 
-  SET(WTF_USE_TEXTURE_MAPPER_GL 1)
-  ADD_DEFINITIONS(-DWTF_USE_TEXTURE_MAPPER_GL=1)
-
   SET(WTF_USE_3D_GRAPHICS 1)
   ADD_DEFINITIONS(-DWTF_USE_3D_GRAPHICS=1)
 
+  SET(ENABLE_3D_RENDERING 1)
+  ADD_DEFINITIONS(-DENABLE_3D_RENDERING=1)
+
+  SET (ENABLE_WEBGL 1)
+  ADD_DEFINITIONS(-DWTF_USE_GRAPHICS_SURFACE=1)
+  ADD_DEFINITIONS(-DHAVE_GLX)
+
   FIND_PACKAGE(OpenGL REQUIRED)
 ENDIF()
 
diff --git a/Source/cmake/WebKitFeatures.cmake b/Source/cmake/WebKitFeatures.cmake
index adefd884e..8a3677bd6 100644
--- a/Source/cmake/WebKitFeatures.cmake
+++ b/Source/cmake/WebKitFeatures.cmake
@@ -24,6 +24,7 @@ MACRO (WEBKIT_OPTION_BEGIN)
     WEBKIT_OPTION_DEFINE(ENABLE_CSS3_TEXT "Toggle CSS3 Text support" OFF)
     WEBKIT_OPTION_DEFINE(ENABLE_CSS_BOX_DECORATION_BREAK "Toggle Box Decoration Break (CSS Backgrounds and Borders) support" ON)
     WEBKIT_OPTION_DEFINE(ENABLE_CSS_COMPOSITING "Toggle CSS COMPOSITING support" OFF)
+    WEBKIT_OPTION_DEFINE(ENABLE_CSS_DEVICE_ADAPTATION "Toggle CSS Device Adaptation support" OFF)
     WEBKIT_OPTION_DEFINE(ENABLE_CSS_EXCLUSIONS "Toggle CSS Exclusion support" OFF)
     WEBKIT_OPTION_DEFINE(ENABLE_CSS_FILTERS "Toggle CSS Filters support" OFF)
     WEBKIT_OPTION_DEFINE(ENABLE_CSS_HIERARCHIES "Toggle CSS Hierarchies support" OFF)
@@ -96,6 +97,7 @@ MACRO (WEBKIT_OPTION_BEGIN)
     WEBKIT_OPTION_DEFINE(ENABLE_QUOTA "Toggle Quota support" OFF)
     WEBKIT_OPTION_DEFINE(ENABLE_REPAINT_THROTTLING "Toggle repaint throttling support" OFF)
     WEBKIT_OPTION_DEFINE(ENABLE_REQUEST_ANIMATION_FRAME "Toggle requestAnimationFrame support" OFF)
+    WEBKIT_OPTION_DEFINE(ENABLE_RESOLUTION_MEDIA_QUERY "Toggle resolution media query support" OFF)
     WEBKIT_OPTION_DEFINE(ENABLE_SCRIPTED_SPEECH "Toggle Scripted Speech API support" OFF)
     WEBKIT_OPTION_DEFINE(ENABLE_SHADOW_DOM "Toggle Shadow DOM support" OFF)
     WEBKIT_OPTION_DEFINE(ENABLE_SHARED_WORKERS "Toggle SharedWorkers support" OFF)
@@ -108,7 +110,6 @@ MACRO (WEBKIT_OPTION_BEGIN)
     WEBKIT_OPTION_DEFINE(ENABLE_TEXT_AUTOSIZING "Toggle Text auto sizing support" OFF)
     WEBKIT_OPTION_DEFINE(ENABLE_TOUCH_EVENTS "Toggle Touch Events support" OFF)
     WEBKIT_OPTION_DEFINE(ENABLE_TOUCH_ICON_LOADING "Toggle Touch Icon Loading Support" OFF)
-    WEBKIT_OPTION_DEFINE(ENABLE_UNDO_MANAGER "Toggle Undo Manager support" OFF)
     WEBKIT_OPTION_DEFINE(ENABLE_VIBRATION "Toggle Vibration API support" OFF)
     WEBKIT_OPTION_DEFINE(ENABLE_VIDEO "Toggle Video support" OFF)
     WEBKIT_OPTION_DEFINE(ENABLE_VIDEO_TRACK "Toggle Track support for HTML5 video" OFF)
@@ -119,6 +120,7 @@ MACRO (WEBKIT_OPTION_BEGIN)
     WEBKIT_OPTION_DEFINE(ENABLE_WEB_SOCKETS "Toggle Web Sockets support" ON)
     WEBKIT_OPTION_DEFINE(ENABLE_WEB_TIMING "Toggle Web Timing support" OFF)
     WEBKIT_OPTION_DEFINE(ENABLE_WORKERS "Toggle Web Workers support" OFF)
+    WEBKIT_OPTION_DEFINE(ENABLE_XHR_TIMEOUT "Toggle XHR timeout support" OFF)
     WEBKIT_OPTION_DEFINE(ENABLE_XSLT "Toggle XSLT support" ON)
     WEBKIT_OPTION_DEFINE(USE_SYSTEM_MALLOC "Toggle system allocator instead of TCmalloc" OFF)
     WEBKIT_OPTION_DEFINE(WTF_USE_TILED_BACKING_STORE "Toggle Tiled Backing Store support" OFF)
diff --git a/Source/cmakeconfig.h.cmake b/Source/cmakeconfig.h.cmake
index 5966b45fb..39bb02b2d 100644
--- a/Source/cmakeconfig.h.cmake
+++ b/Source/cmakeconfig.h.cmake
@@ -15,6 +15,7 @@
 #cmakedefine01 ENABLE_CSP_NEXT
 #cmakedefine01 ENABLE_CSS3_TEXT
 #cmakedefine01 ENABLE_CSS_BOX_DECORATION_BREAK
+#cmakedefine01 ENABLE_CSS_DEVICE_ADAPTATION
 #cmakedefine01 ENABLE_CSS_COMPOSITING
 #cmakedefine01 ENABLE_CSS_EXCLUSIONS
 #cmakedefine01 ENABLE_CSS_FILTERS
@@ -91,6 +92,7 @@
 #cmakedefine01 ENABLE_QUOTA
 #cmakedefine01 ENABLE_REPAINT_THROTTLING
 #cmakedefine01 ENABLE_REQUEST_ANIMATION_FRAME
+#cmakedefine01 ENABLE_RESOLUTION_MEDIA_QUERY
 #cmakedefine01 ENABLE_SCRIPTED_SPEECH
 #cmakedefine01 ENABLE_SHADOW_DOM
 #cmakedefine01 ENABLE_SHARED_WORKERS
@@ -104,7 +106,6 @@
 #cmakedefine01 ENABLE_TEXT_AUTOSIZING
 #cmakedefine01 ENABLE_TOUCH_EVENTS
 #cmakedefine01 ENABLE_TOUCH_ICON_LOADING
-#cmakedefine01 ENABLE_UNDO_MANAGER
 #cmakedefine01 ENABLE_VIBRATION
 #cmakedefine01 ENABLE_VIDEO
 #cmakedefine01 ENABLE_VIDEO_TRACK
@@ -117,6 +118,7 @@
 #cmakedefine01 ENABLE_WEB_TIMING
 #cmakedefine01 ENABLE_WORKERS
 #cmakedefine01 ENABLE_XHR_RESPONSE_BLOB
+#cmakedefine01 ENABLE_XHR_TIMEOUT
 #cmakedefine01 ENABLE_XSLT
 #cmakedefine01 USE_SYSTEM_MALLOC
 #cmakedefine01 WTF_USE_TILED_BACKING_STORE
diff --git a/Tools/BuildSlaveSupport/build.webkit.org-config/master.cfg b/Tools/BuildSlaveSupport/build.webkit.org-config/master.cfg
index 72e7deaeb..ae4df92f1 100644
--- a/Tools/BuildSlaveSupport/build.webkit.org-config/master.cfg
+++ b/Tools/BuildSlaveSupport/build.webkit.org-config/master.cfg
@@ -174,6 +174,12 @@ class CleanupChromiumCrashLogs(shell.ShellCommand):
     command = ["python", "./Tools/BuildSlaveSupport/chromium/remove-crash-logs"]
     haltOnFailure = False
 
+class OutputAndroidDeviceStatus(shell.ShellCommand):
+    name = "android device status"
+    description = ["outputting android device status"]
+    descriptionDone = ["outputted android device status"]
+    command = ["python", "./Tools/BuildSlaveSupport/chromium/output-android-device-status"]
+    haltOnFailure = False
 
 def appendCustomBuildFlags(step, platform, fullPlatform=""):
     if fullPlatform == "chromium-android":
@@ -753,6 +759,8 @@ class TestFactory(Factory):
         Factory.__init__(self, platform, configuration, architectures, False, SVNMirror)
         if platform.startswith("chromium"):
             self.addStep(CleanupChromiumCrashLogs())
+        if platform == "chromium-android":
+            self.addStep(OutputAndroidDeviceStatus())
         self.addStep(DownloadBuiltProduct())
         self.addStep(ExtractBuiltProduct())
         if not platform.startswith("chromium"):
diff --git a/Tools/BuildSlaveSupport/build.webkit.org-config/public_html/TestFailures/garden-o-matic.html b/Tools/BuildSlaveSupport/build.webkit.org-config/public_html/TestFailures/garden-o-matic.html
index 904e5edd0..19e156bda 100644
--- a/Tools/BuildSlaveSupport/build.webkit.org-config/public_html/TestFailures/garden-o-matic.html
+++ b/Tools/BuildSlaveSupport/build.webkit.org-config/public_html/TestFailures/garden-o-matic.html
@@ -32,9 +32,9 @@ James, a web developer from Birmingham, UK.
                                          script-src 'self' file: https://ajax.googleapis.com;
                                          style-src 'self' 'unsafe-inline' file: https://ajax.googleapis.com http://fonts.googleapis.com;
                                          font-src http://themes.googleusercontent.com;
-                                         img-src 'self' https://ajax.googleapis.com http://build.chromium.org http://build.webkit.org file:;
-                                         media-src http://build.chromium.org http://build.webkit.org;
-                                         frame-src http://build.chromium.org http://build.webkit.org http://test-results.appspot.com;
+                                         img-src 'self' https://ajax.googleapis.com http://build.chromium.org http://build.webkit.org file: http://127.0.0.1:8127;
+                                         media-src http://build.chromium.org http://build.webkit.org http://127.0.0.1:8127;
+                                         frame-src http://build.chromium.org http://build.webkit.org http://test-results.appspot.com http://127.0.0.1:8127;
                                          connect-src http://trac.webkit.org http://build.chromium.org http://build.webkit.org http://127.0.0.1:8127">
 <title>Garden-O-Matic</title>
 <link rel="stylesheet" href="http://fonts.googleapis.com/css?family=Open+Sans:400,700">
@@ -50,8 +50,8 @@ James, a web developer from Birmingham, UK.
 <body>
 <script src="https://ajax.googleapis.com/ajax/libs/jquery/1.6.2/jquery.min.js"></script>
 <script src="https://ajax.googleapis.com/ajax/libs/jqueryui/1.8.15/jquery-ui.min.js"></script>
-<script src="scripts/config.js"></script>
 <script src="scripts/base.js"></script>
+<script src="scripts/config.js"></script>
 <script src="scripts/net.js"></script>
 <script src="scripts/Trac.js"></script>
 <script src="scripts/Bugzilla.js"></script>
diff --git a/Tools/BuildSlaveSupport/build.webkit.org-config/public_html/TestFailures/run-unittests.html b/Tools/BuildSlaveSupport/build.webkit.org-config/public_html/TestFailures/run-unittests.html
index ce2e6cd9d..2ce6e71d3 100644
--- a/Tools/BuildSlaveSupport/build.webkit.org-config/public_html/TestFailures/run-unittests.html
+++ b/Tools/BuildSlaveSupport/build.webkit.org-config/public_html/TestFailures/run-unittests.html
@@ -39,8 +39,8 @@ THE POSSIBILITY OF SUCH DAMAGE.
 
 <link rel="stylesheet" href="styles/results.css">
 
-<script src="scripts/config.js"></script>
 <script src="scripts/base.js"></script>
+<script src="scripts/config.js"></script>
 <script src="scripts/base_unittests.js"></script>
 <script src="scripts/net.js"></script>
 <script src="scripts/net_unittests.js"></script>
diff --git a/Tools/BuildSlaveSupport/build.webkit.org-config/public_html/TestFailures/scripts/builders.js b/Tools/BuildSlaveSupport/build.webkit.org-config/public_html/TestFailures/scripts/builders.js
index b65895afa..7f5b36c21 100644
--- a/Tools/BuildSlaveSupport/build.webkit.org-config/public_html/TestFailures/scripts/builders.js
+++ b/Tools/BuildSlaveSupport/build.webkit.org-config/public_html/TestFailures/scripts/builders.js
@@ -97,7 +97,7 @@ function fetchMostRecentBuildInfoByBuilder(platform, callback)
         var builderNames = Object.keys(builderStatus);
         var requestTracker = new base.RequestTracker(builderNames.length, callback, [buildInfoByBuilder]);
         builderNames.forEach(function(builderName) {
-            if (!config.kPlatforms[config.currentPlatform].builderApplies(builderName)) {
+            if (!config.builderApplies(builderName)) {
                 requestTracker.requestComplete();
                 return;
             }
diff --git a/Tools/BuildSlaveSupport/build.webkit.org-config/public_html/TestFailures/scripts/config.js b/Tools/BuildSlaveSupport/build.webkit.org-config/public_html/TestFailures/scripts/config.js
index 92fa03a00..8daa4255e 100644
--- a/Tools/BuildSlaveSupport/build.webkit.org-config/public_html/TestFailures/scripts/config.js
+++ b/Tools/BuildSlaveSupport/build.webkit.org-config/public_html/TestFailures/scripts/config.js
@@ -52,7 +52,7 @@ config.kPlatforms = {
         resultsDirectoryForBuildNumber: function(buildNumber, revision) {
             return encodeURIComponent('r' + revision + ' (' + buildNumber + ')');
         },
-        builderApplies: function(builderName) {
+        _builderApplies: function(builderName) {
             return builderName.indexOf('Apple') != -1;
         },
     },
@@ -84,7 +84,7 @@ config.kPlatforms = {
         resultsDirectoryForBuildNumber: function(buildNumber, revision) {
             return buildNumber;
         },
-        builderApplies: function(builderName) {
+        _builderApplies: function(builderName) {
             // FIXME: Should garden-o-matic show these? I can imagine showing the deps bots being useful at least so
             // that the gardener only need to look at garden-o-matic and never at the waterfall. Not really sure who
             // watches the GPU bots.
@@ -115,7 +115,7 @@ config.kPlatforms = {
         resultsDirectoryForBuildNumber: function(buildNumber, revision) {
             return encodeURIComponent('r' + revision + ' (' + buildNumber + ')');
         },
-        builderApplies: function(builderName) {
+        _builderApplies: function(builderName) {
             return builderName.indexOf('GTK') != -1;
         },
     },
@@ -136,7 +136,7 @@ config.kPlatforms = {
         resultsDirectoryForBuildNumber: function(buildNumber, revision) {
             return encodeURIComponent('r' + revision + ' (' + buildNumber + ')');
         },
-        builderApplies: function(builderName) {
+        _builderApplies: function(builderName) {
             return builderName.indexOf('Qt') != -1;
         },
     },
@@ -159,10 +159,29 @@ config.kRelativeTimeUpdateFrequency = 1000 * 60;
 
 config.kExperimentalFeatures = window.location.search.search('enableExperiments=1') != -1;
 
-config.currentPlatform = 'chromium';
+config.currentPlatform = base.getURLParameter('platform') || 'chromium';
 
-config.setPlatform = function(platform)
-{
+// FIXME: We should add a way to restrict the results to a subset of the builders
+// (or maybe just a single builder) in the UI as well as via an URL parameter.
+config.currentBuilder = base.getURLParameter('builder');
+
+config.currentBuilders = function() {
+    var current_builders = {};
+    if (config.currentBuilder) {
+        current_builders[config.currentBuilder] = config.kPlatforms[config.currentPlatform].builders[config.currentBuilder];
+        return current_builders;
+    } else {
+        return config.kPlatforms[config.currentPlatform].builders;
+    }
+};
+
+config.builderApplies = function(builderName) {
+    if (config.currentBuilder)
+        return builderName == config.currentBuilder;
+    return config.kPlatforms[config.currentPlatform]._builderApplies(builderName);
+};
+
+config.setPlatform = function(platform) {
     if (!this.kPlatforms[platform]) {
         window.console.log(platform + ' is not a recognized platform');
         return;
@@ -170,4 +189,6 @@ config.setPlatform = function(platform)
     config.currentPlatform = platform;
 };
 
+config.useLocalResults = Boolean(base.getURLParameter('useLocalResults')) || false;
+
 })();
diff --git a/Tools/BuildSlaveSupport/build.webkit.org-config/public_html/TestFailures/scripts/garden-o-matic.js b/Tools/BuildSlaveSupport/build.webkit.org-config/public_html/TestFailures/scripts/garden-o-matic.js
index ac2d9d1a6..ebd4d5d32 100644
--- a/Tools/BuildSlaveSupport/build.webkit.org-config/public_html/TestFailures/scripts/garden-o-matic.js
+++ b/Tools/BuildSlaveSupport/build.webkit.org-config/public_html/TestFailures/scripts/garden-o-matic.js
@@ -77,6 +77,11 @@ function update()
             updatePartyTime();
             g_unexpectedFailuresController.purge();
 
+            Object.keys(config.currentBuilders()).forEach(function(builderName) {
+                if (!model.state.resultsByBuilder[builderName])
+                    g_info.add(new ui.notifications.Info('Could not find test results for ' + builderName + ' in the last ' + config.kBuildNumberLimit + ' runs.'));            
+            });
+
             updating.dismiss();
 
             g_revisionHint = new ui.notifications.Info('');
diff --git a/Tools/BuildSlaveSupport/build.webkit.org-config/public_html/TestFailures/scripts/model.js b/Tools/BuildSlaveSupport/build.webkit.org-config/public_html/TestFailures/scripts/model.js
index 476e94e1d..3c3f85243 100644
--- a/Tools/BuildSlaveSupport/build.webkit.org-config/public_html/TestFailures/scripts/model.js
+++ b/Tools/BuildSlaveSupport/build.webkit.org-config/public_html/TestFailures/scripts/model.js
@@ -158,7 +158,7 @@ model.latestRevisionWithNoBuildersInFlight = function()
 
 model.updateResultsByBuilder = function(callback)
 {
-    var platformBuilders = config.kPlatforms[config.currentPlatform].builders;
+    var platformBuilders = config.currentBuilders();
     results.fetchResultsByBuilder(Object.keys(platformBuilders), function(resultsByBuilder) {
         model.state.resultsByBuilder = resultsByBuilder;
         callback();
diff --git a/Tools/BuildSlaveSupport/build.webkit.org-config/public_html/TestFailures/scripts/results.js b/Tools/BuildSlaveSupport/build.webkit.org-config/public_html/TestFailures/scripts/results.js
index a7af2e084..012df032a 100644
--- a/Tools/BuildSlaveSupport/build.webkit.org-config/public_html/TestFailures/scripts/results.js
+++ b/Tools/BuildSlaveSupport/build.webkit.org-config/public_html/TestFailures/scripts/results.js
@@ -27,7 +27,6 @@ var results = results || {};
 
 (function() {
 
-var kLayoutTestResultsPath = '/results/layout-test-results/';
 var kResultsName = 'full_results.json';
 
 var kBuildLinkRegexp = /a href="\d+\/"/g;
@@ -188,7 +187,9 @@ results.directoryForBuilder = function(builderName)
 
 function resultsDirectoryURL(platform, builderName)
 {
-    return layoutTestResultsURL(platform) + '/' + results.directoryForBuilder(builderName) + kLayoutTestResultsPath;
+    if (config.useLocalResults)
+        return config.kLocalServerURL + '/localresult?path=';
+    return resultsDirectoryListingURL(platform, builderName) + 'results/layout-test-results/';
 }
 
 function resultsDirectoryListingURL(platform, builderName)
@@ -626,6 +627,11 @@ results.fetchResultsForMostRecentCompletedBuildOnBuilder = function(builderName,
         var resultsCallback = function(buildResults) {
             if ($.isEmptyObject(buildResults)) {
                 ++currentIndex;
+                if (currentIndex >= buildLocations.length) {
+                    callback(null);
+                    return;
+                }
+
                 net.jsonp(buildLocations[currentIndex].url, resultsCallback);
                 return;
             }
@@ -658,7 +664,8 @@ results.fetchResultsByBuilder = function(builderNameList, callback)
                     // FIXME: use RequestTracker
                     ++requestsInFlight;
                     results.fetchResultsForMostRecentCompletedBuildOnBuilder(builderName, function(resultsTree) {
-                        resultsByBuilder[builderName] = resultsTree;
+                        if (resultsTree)
+                            resultsByBuilder[builderName] = resultsTree;
                         --requestsInFlight;
                         if (!requestsInFlight)
                             callback(resultsByBuilder);
diff --git a/Tools/BuildSlaveSupport/build.webkit.org-config/public_html/TestFailures/scripts/results_unittests.js b/Tools/BuildSlaveSupport/build.webkit.org-config/public_html/TestFailures/scripts/results_unittests.js
index 3f23bc349..e15e73982 100644
--- a/Tools/BuildSlaveSupport/build.webkit.org-config/public_html/TestFailures/scripts/results_unittests.js
+++ b/Tools/BuildSlaveSupport/build.webkit.org-config/public_html/TestFailures/scripts/results_unittests.js
@@ -533,4 +533,76 @@ test("fetchResultsURLs", 5, function() {
     ]);
 });
 
+test("fetchResultsByBuilder", 5, function() {
+    var simulator = new NetworkSimulator();
+
+    var probedURLs = [];
+    simulator.jsonp = function(url, callback)
+    {
+        simulator.scheduleCallback(function() {
+            probedURLs.push(url);
+            if (base.endsWith(url, 'MockBuilder2/r1%20(1)/full_results.json'))
+                callback({'MockBuildResults': true});
+            else
+                callback({});
+        });
+    };
+
+    config.currentPlatform = 'gtk';
+
+    var oldCachedBuildInfos = builders.cachedBuildInfos;
+    builders.cachedBuildInfos = function(platform, builderName, callback) {
+        callback(
+        {
+            1: {
+                sourceStamp: {
+                    revision: 1
+                }
+            },
+            2: {
+                sourceStamp: {
+                    revision: 2
+                }
+            }
+
+        });
+    };
+
+    var oldRecentBuildInfos = builders.recentBuildInfos;
+    builders.recentBuildInfos = function(callback) {
+        callback({
+            'MockBuilder1': true,
+            'MockBuilder2': true
+        });
+    };
+
+    simulator.runTest(function() {
+        results.fetchResultsByBuilder(['MockBuilder1', 'MockBuilder2'], function(resultsByBuilder) {
+            deepEqual(resultsByBuilder, {
+                "MockBuilder2": {
+                    "MockBuildResults": true,
+                    "_buildLocation": {
+                        "buildNumber": "1",
+                        "revision": 1,
+                        "url": "http://build.webkit.org/results/MockBuilder2/r1%20(1)/full_results.json"
+                    }
+                }
+            });
+        });
+    });
+
+    deepEqual(probedURLs, [
+        "http://build.webkit.org/results/MockBuilder1/r2%20(2)/full_results.json",
+        "http://build.webkit.org/results/MockBuilder2/r2%20(2)/full_results.json",
+        "http://build.webkit.org/results/MockBuilder1/r1%20(1)/full_results.json",
+        "http://build.webkit.org/results/MockBuilder2/r1%20(1)/full_results.json"
+    ]);
+
+    builders.cachedBuildInfos = oldCachedBuildInfos;
+    equal(builders.cachedBuildInfos, oldCachedBuildInfos, "Failed to restore real base!");
+
+    builders.recentBuildInfos = oldRecentBuildInfos;
+    equal(builders.recentBuildInfos, oldRecentBuildInfos, "Failed to restore real base!");
+});
+
 })();
diff --git a/Tools/BuildSlaveSupport/build.webkit.org-config/public_html/TestFailures/scripts/summary-mock.js b/Tools/BuildSlaveSupport/build.webkit.org-config/public_html/TestFailures/scripts/summary-mock.js
index 5e732cf25..eb3c2a2a1 100644
--- a/Tools/BuildSlaveSupport/build.webkit.org-config/public_html/TestFailures/scripts/summary-mock.js
+++ b/Tools/BuildSlaveSupport/build.webkit.org-config/public_html/TestFailures/scripts/summary-mock.js
@@ -96,7 +96,7 @@ var testNames = new Cycler([
     'tables/mozilla/bugs/bug52505.html'
 ]);
 
-var builders = new Cycler(Object.keys(config.kPlatforms[config.currentPlatform].builders), 3);
+var builders = new Cycler(Object.keys(config.currentBuilders()), 3);
 
 var expectations = new Cycler([
     'TEXT',
diff --git a/Tools/BuildSlaveSupport/build.webkit.org-config/public_html/TestFailures/scripts/ui/failures.js b/Tools/BuildSlaveSupport/build.webkit.org-config/public_html/TestFailures/scripts/ui/failures.js
index 77ecda3c2..b4948b28c 100644
--- a/Tools/BuildSlaveSupport/build.webkit.org-config/public_html/TestFailures/scripts/ui/failures.js
+++ b/Tools/BuildSlaveSupport/build.webkit.org-config/public_html/TestFailures/scripts/ui/failures.js
@@ -33,7 +33,7 @@ var kBuildingResult = 'BUILDING';
 ui.failures.Builder = base.extends('a', {
     init: function(builderName, failures)
     {
-        var platformBuilders = config.kPlatforms[config.currentPlatform].builders;
+        var platformBuilders = config.currentBuilders();
         var configuration = platformBuilders[builderName];
         if (configuration) {
             if (configuration.version)
diff --git a/Tools/BuildSlaveSupport/chromium/output-android-device-status b/Tools/BuildSlaveSupport/chromium/output-android-device-status
new file mode 100755
index 000000000..d716c026b
--- /dev/null
+++ b/Tools/BuildSlaveSupport/chromium/output-android-device-status
@@ -0,0 +1,81 @@
+#!/usr/bin/env python
+# Copyright (C) 2012 Google Inc. All Rights Reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+# 1. Redistributions of source code must retain the above copyright
+#    notice, this list of conditions and the following disclaimer.
+# 2. Redistributions in binary form must reproduce the above copyright
+#    notice, this list of conditions and the following disclaimer in the
+#    documentation and/or other materials provided with the distribution.
+#
+# THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+# EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+# PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+# CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+# EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+# PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+# PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+# OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+import re
+import subprocess
+import sys
+
+def GetAttachedDevices():
+    re_device = re.compile('^([a-zA-Z0-9_:.-]+)\tdevice$', re.MULTILINE)
+    process = subprocess.Popen(['adb', 'devices'], stdout=subprocess.PIPE)
+    return re_device.findall(process.communicate()[0])
+
+
+class AndroidDeviceStatus(object):
+    def __init__(self, device_serial):
+        self._device_serial = device_serial
+
+    def _run_adb_command(self, command):
+        full_command = ['adb', '-s', self._device_serial] + command
+        stdout, _ = subprocess.Popen(full_command, stdout=subprocess.PIPE).communicate()
+        return stdout.strip()
+
+    def device_type(self):
+        return self._run_adb_command(['shell', 'getprop', 'ro.build.product'])
+
+    def device_build(self):
+        return self._run_adb_command(['shell', 'getprop', 'ro.build.id'])
+
+    def device_fingerprint(self):
+        return self._run_adb_command(['shell', 'getprop', 'ro.build.fingerprint'])
+
+    def battery_level(self):
+        return self._run_adb_command(['shell', 'cat', '/sys/class/power_supply/battery/capacity'])
+
+    def battery_temperature(self):
+        temperature = self._run_adb_command(['shell', 'dumpsys', 'battery'])
+        re_temperature = re.compile('temperature:\s+(\d+)')
+        return re_temperature.findall(temperature)[0]
+
+    def username(self):
+        username = self._run_adb_command(['shell', 'id'])
+        re_username = re.compile('uid=\d+\((.+?)\)')
+        return re_username.findall(username)[0]
+
+
+def main():
+    devices = GetAttachedDevices()
+    for device_serial in devices:
+        device_status = AndroidDeviceStatus(device_serial)
+
+        print 'Device %s (%s)' % (device_serial, device_status.device_type())
+        print '  Build: %s (%s)' % (device_status.device_build(), device_status.device_fingerprint())
+        print '  Battery: %s%%' % device_status.battery_level()
+        print '  Battery temp: %s' % device_status.battery_temperature()
+        print '  Username: %s' % device_status.username()
+        print ''
+
+
+if __name__ == '__main__':
+    sys.exit(main())
diff --git a/Tools/ChangeLog b/Tools/ChangeLog
index ac5353b60..f77335d83 100644
--- a/Tools/ChangeLog
+++ b/Tools/ChangeLog
@@ -1,3 +1,20 @@
+2012-11-07  Christophe Dumez  <christophe.dumez@intel.com>
+
+        Add replaceWithLiteral() method to WTF::String
+        https://bugs.webkit.org/show_bug.cgi?id=101257
+
+        Reviewed by Benjamin Poulain.
+
+        Add API tests for String::replaceWithLiteral() and corresponding
+        StringImpl methods.
+
+        * TestWebKitAPI/CMakeLists.txt: Add WTFString API tests to CMake.
+        * TestWebKitAPI/Tests/WTF/StringImpl.cpp:
+        (TestWebKitAPI::TEST):
+        (TestWebKitAPI):
+        * TestWebKitAPI/Tests/WTF/WTFString.cpp:
+        (TestWebKitAPI::TEST):
+
 2012-11-07  Oswald Buddenhagen <oswald.buddenhagen@nokia.com>
 
         [Qt] Fix build of modules depending on QtWebKit when using prefix
@@ -9,18 +26,3280 @@
 
         * qmake/mkspecs/features/default_pre.prf:
 
-2012-10-25  Simon Hausmann  <simon.hausmann@digia.com>
+2012-11-06  Dan Beam  <dbeam@chromium.org>
+
+        Enable REQUEST_AUTOCOMPLETE for chromium port
+        https://bugs.webkit.org/show_bug.cgi?id=101376
+
+        Reviewed by Adam Barth.
+
+        This patch enables the feature flag REQUEST_AUTOCOMPLETE in WebKit/chromium only to allow web authors to start to use
+        HTMLFormElement#requestAutocomplete as the chrome-side work progresses further.
+
+        * DumpRenderTree/chromium/TestShell.cpp:
+        (TestShell::TestShell):
+
+        Enables the requestAutocomplete runtime feature flag during tests.
+
+2012-11-06  KyungTae Kim  <ktf.kim@samsung.com>
+
+        [WK2][EFL] Add shortcut for setting a pagination mode on Minibrowser
+        https://bugs.webkit.org/show_bug.cgi?id=100301
+
+        Reviewed by Gyuyoung Kim.
+
+        Setting pagination modes is for a paginated view - left to right / right to left / top to bottom / bottom to top.
+        Assign a shortcut "F7" to set pagination modes for tests.
+
+        * MiniBrowser/efl/main.c:
+        (on_key_down):
+
+2012-11-06  KyungTae Kim  <ktf.kim@samsung.com>
+
+        [EFL][EWebLauncher] Use Ctrl +/-  to zoom in EWebLauncher
+        https://bugs.webkit.org/show_bug.cgi?id=100207
+
+        Reviewed by Gyuyoung Kim.
+
+        Use "Ctrl -" instead of "F7" to zoom out, and use "Ctrl +" instead of "F8" to zoom in, 
+        and use "Ctrl 0" to set to default zoom level.
+        They are more common shortcuts on usual browsers.
+
+        * EWebLauncher/main.c:
+        (on_key_down):
+
+2012-11-06  Oliver Hunt  <oliver@apple.com>
+
+        Don't warn about RefPtr* parameters
+        https://bugs.webkit.org/show_bug.cgi?id=101403
+
+        Reviewed by Gavin Barraclough.
+
+        RefPtr<>* is a valid parameter type.
+
+        * Scripts/webkitpy/style/checkers/cpp.py:
+        (check_function_definition_and_pass_ptr):
+        * Scripts/webkitpy/style/checkers/cpp_unittest.py:
+        (PassPtrTest.test_ref_ptr_parameter_value):
+
+2012-11-06  Raphael Kubo da Costa  <raphael.kubo.da.costa@intel.com>
+
+        [WTR] Reset EventSender before running each test.
+        https://bugs.webkit.org/show_bug.cgi?id=101353
+
+        Reviewed by Simon Fraser.
+
+        Contrary to what was done to at least some ports in DumpRenderTree,
+        EventSender did not currently reset its values in WTR. This caused
+        flakiness if a test such as editing/selection/fake-doubleclick.html was
+        run twice in a row, since the click count was not reset across each
+        run.
+
+        * WebKitTestRunner/TestController.cpp:
+        (WTR::TestController::TestController): Do not create m_eventSenderProxy
+        in the constructor anymore, it is created in
+        resetStateToConsistentValues now.
+        (WTR::TestController::resetStateToConsistentValues): Recreate
+        m_eventSenderProxy every time this method is run.
+        * WebKitTestRunner/TestController.h: Make m_eventSenderProxy an OwnPtr
+        and guard it with a platform #ifdef.
+        * WebKitTestRunner/gtk/EventSenderProxyGtk.cpp:
+        (WTR::EventSenderProxy::~EventSenderProxy): Add an empty
+        implementation.
+        * WebKitTestRunner/mac/EventSenderProxy.mm:
+        (WTR::EventSenderProxy::~EventSenderProxy): Ditto.
+        * WebKitTestRunner/qt/EventSenderProxyQt.cpp:
+        (WTR::EventSenderProxy::~EventSenderProxy): Ditto.
+
+2012-11-06  Mikhail Pozdnyakov  <mikhail.pozdnyakov@intel.com>
+
+        [EFL][WK2] Refactor Ewk_Auth_Request, Ewk_Url_Scheme_Request and Ewk_Download_Job to be Ewk_Objects
+        https://bugs.webkit.org/show_bug.cgi?id=101383
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Ewk_Auth_Request, Ewk_Url_Scheme_Request and Ewk_Download_Job are Ewk_Objects now.
+
+        * MiniBrowser/efl/main.c:
+        (auth_popup_close):
+        (on_authentication_request):
+
+2012-11-06  Tommy Widenflycht  <tommyw@google.com>
+
+        [chromium] MediaStream API: Remove the valgrind issue with MockWebRTCPeerConnectionHandler
+        https://bugs.webkit.org/show_bug.cgi?id=101336
+
+        Reviewed by Andreas Kling.
+
+        This patch changes the delete to delete [] to match the new[].
+
+        * DumpRenderTree/chromium/MockWebRTCPeerConnectionHandler.cpp:
+
+2012-11-06  Mihai Balan  <mibalan@adobe.com>
+
+        Add Adobe's bug tracker to committers.py
+        https://bugs.webkit.org/show_bug.cgi?id=101338
+
+        Reviewed by Kentaro Hara.
+
+        Adding Adobe's bug tracker mailing list to committers.py
+        to enable its inclusion in the autocomplete list.
+
+        * Scripts/webkitpy/common/config/committers.py:
+
+2012-11-06  Sami Kyostila  <skyostil@chromium.org>
+
+        [chromium] Enable fixed position compositing on Android DRT
+        https://bugs.webkit.org/show_bug.cgi?id=100263
+
+        Reviewed by James Robinson.
+
+        Chrome on Android forces composited mode for every page and creates
+        stacking contexts and graphics layers for fixed positioned elements.
+        Change the DumpRenderTree settings to match this.
+
+        * DumpRenderTree/chromium/DumpRenderTree.cpp:
+        (main):
+        * DumpRenderTree/chromium/TestShell.cpp:
+        (TestShell::TestShell):
+        (TestShell::resetWebSettings):
+        * DumpRenderTree/chromium/TestShell.h:
+        (TestShell::setAcceleratedCompositingForFixedPositionEnabled):
+        (TestShell):
+        * DumpRenderTree/chromium/WebPreferences.cpp:
+        (WebPreferences::reset):
+        (WebPreferences::applyTo):
+        * DumpRenderTree/chromium/WebPreferences.h:
+        (WebPreferences):
+        * Scripts/webkitpy/layout_tests/port/chromium_android.py:
+        (ChromiumAndroidPort.additional_drt_flag):
+
+2012-11-06  Raphael Kubo da Costa  <raphael.kubo.da.costa@intel.com>
+
+        [EFL][WTR] EventSender: Get rid of the WTRMouseButton enum.
+        https://bugs.webkit.org/show_bug.cgi?id=101340
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Get rid of an enum which was basically a duplicate of the
+        WKEventMouseButton one in the shared API.
+
+        The only difference is that it also had a case for a 4th mouse
+        button that we treat in a special way in evasMouseButton() now.
+
+        * WebKitTestRunner/EventSenderProxy.h:
+        (EventSenderProxy):
+        * WebKitTestRunner/efl/EventSenderProxyEfl.cpp:
+        (WTR::evasMouseButton):
+        (WTR::EventSenderProxy::EventSenderProxy):
+        (WTR::EventSenderProxy::mouseUp):
+        (WTR::EventSenderProxy::mouseMoveTo):
+        (WTR::EventSenderProxy::mouseScrollBy):
+        (WTR::EventSenderProxy::leapForward):
+
+2012-11-06  Jussi Kukkonen  <jussi.kukkonen@intel.com>
+
+        [EFL][WK2] Minibrowser forgets http variables when url includes ampersand
+        https://bugs.webkit.org/show_bug.cgi?id=101061
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Elementary entry only returns 'markup' text, meaning ampersands
+        in a url will become "&amp;". Use elm_entry_markup_to_utf8() and
+        elm_entry_utf8_to_markup() when interacting with the entry.
+
+        * MiniBrowser/efl/main.c:
+        (on_url_changed):
+        (on_url_bar_activated):
+
+2012-11-06  Balazs Kelemen  <kbalazs@webkit.org>
+
+        DumpRenderTree should have --pixel-tests option again
+        https://bugs.webkit.org/show_bug.cgi?id=98648
+
+        Reviewed by Dirk Pranke.
+
+        Add back the --pixel-tests command line option to DumpRenderTree.
+        It was removed r124581 because tools don't use it after that patch.
+        However, it turned out that it is useful for debugging and working
+        with pixel tests.
+
+        * DumpRenderTree/efl/DumpRenderTree.cpp:
+        (parseCommandLineOptions):
+        (runTest):
+        * DumpRenderTree/gtk/DumpRenderTree.cpp:
+        (initializeGlobalsFromCommandLineOptions):
+        (runTest):
+        * DumpRenderTree/mac/DumpRenderTree.mm:
+        (initializeGlobalsFromCommandLineOptions):
+        (runTest):
+        * DumpRenderTree/qt/DumpRenderTreeMain.cpp:
+        (isOption):
+        (printUsage):
+        (main):
+        * DumpRenderTree/qt/DumpRenderTreeQt.cpp:
+        (WebCore::DumpRenderTree::processLine):
+        * DumpRenderTree/qt/DumpRenderTreeQt.h:
+        (WebCore::DumpRenderTree::setShouldDumpPixelsForAllTests):
+        (DumpRenderTree):
+        * DumpRenderTree/win/DumpRenderTree.cpp:
+        (runTest):
+        (dllLauncherEntryPoint):
+        * DumpRenderTree/wx/DumpRenderTreeWx.cpp:
+        (runTest):
+        (MyApp::OnInit):
+        * WebKitTestRunner/TestController.cpp:
+        (WTR::TestController::TestController):
+        (WTR::TestController::initialize):
+        (WTR::TestController::runTest):
+        * WebKitTestRunner/TestController.h:
+        (TestController):
+
+2012-11-05  Dirk Pranke  <dpranke@chromium.org>
+
+        webkit-patch rebaseline*: fix typo for --results-directory
+        https://bugs.webkit.org/show_bug.cgi?id=101295
+
+        Reviewed by Ojan Vafai.
+
+        Had --results_directory instead of --results-directory in both the
+        code and the unit test.
+
+        * Scripts/webkitpy/tool/commands/rebaseline.py:
+        (AbstractParallelRebaselineCommand._rebaseline_commands):
+        * Scripts/webkitpy/tool/commands/rebaseline_unittest.py:
+        (TestRebaselineJson.test_results_directory):
+
+2012-11-05  Dirk Pranke  <dpranke@chromium.org>
+
+        webkit-patch rebaseline*: fix handling of local file urls
+        https://bugs.webkit.org/show_bug.cgi?id=101296
+
+        Reviewed by Ojan Vafai.
+
+        When using --results-directory, we need to make sure we're converting
+        paths to file:/// urls for urllib to work correctly. Also, this
+        patch reworks the unit tests to get better coverage (of the execute()
+        command) and reduce copy/pasting of mock options.
+
+        * Scripts/webkitpy/tool/commands/rebaseline.py:
+        (RebaselineTest._rebaseline_test_and_update_expectations):
+        (RebaselineTest.execute):
+        * Scripts/webkitpy/tool/commands/rebaseline_unittest.py:
+        (TestRebaselineTest.setUp):
+        (test_rebaseline_updates_expectations_file):
+        (test_rebaseline_does_not_include_overrides):
+        (test_rebaseline_test_with_results_directory):
+        (test_rebaseline_test_internal_with_move_overwritten_baselines_to):
+
+2012-11-05  Kenneth Russell  <kbr@google.com>
+
+        Added secondary email address and IRC nick.
+        https://bugs.webkit.org/show_bug.cgi?id=101290
+
+        Unreviewed change to committers.py.
+
+        * Scripts/webkitpy/common/config/committers.py:
+
+2012-11-05  Glenn Adams  <glenn@skynav.com>
+
+        Add IRC alias for Glenn Adams
+        https://bugs.webkit.org/show_bug.cgi?id=101262
+
+        Reviewed by Eric Seidel.
+
+        Add IRC alias for Glenn Adams.
+
+        * Scripts/webkitpy/common/config/committers.py:
+
+2012-11-05  Dima Gorbik  <dgorbik@apple.com>
+
+        Back out controversial changes from Bug 98665.
+        https://bugs.webkit.org/show_bug.cgi?id=101244
+
+        Reviewed by David Kilzer.
+
+        Backing out changes from Bug 98665 until further discussions take place on rules for including Platform.h in Assertions.h.
+
+        * DumpRenderTree/mac/MockGeolocationProvider.mm:
+
+2012-11-05  Dirk Pranke  <dpranke@chromium.org>
+
+        webkitpy: lint, clean up rebaseline.py
+        https://bugs.webkit.org/show_bug.cgi?id=101240
+
+        Reviewed by Ojan Vafai.
+
+        Miscellaneous cleanup of lint errors and warnings.
+
+        * Scripts/webkitpy/tool/commands/rebaseline.py:
+        (AbstractRebaseliningCommand):
+        (RebaselineTest._test_root):
+        (OptimizeBaselines._optimize_baseline):
+        (OptimizeBaselines.execute):
+        (AnalyzeBaselines.__init__):
+        (AbstractParallelRebaselineCommand):
+        (AbstractParallelRebaselineCommand._builders_to_fetch_from):
+        (AbstractParallelRebaselineCommand._files_to_add):
+        (AbstractParallelRebaselineCommand._rebaseline):
+        (RebaselineExpectations.__init__):
+        (Rebaseline.execute):
+        * Scripts/webkitpy/tool/commands/rebaseline_unittest.py:
+        (_BaseTestCase.setUp):
+        (TestAnalyzeBaselines.setUp):
+
+2012-11-05  Dirk Pranke  <dpranke@chromium.org>
+
+        webkit-patch optimize-baselines should take a --platform arg
+        https://bugs.webkit.org/show_bug.cgi?id=97623
+
+        Reviewed by Ojan Vafai.
+
+        So that we can optionally limit/control which platforms' results
+        are affected.
+
+        This patch adds --platform to analyze-baselines as well.
+
+        * Scripts/webkitpy/common/checkout/baselineoptimizer.py:
+        (_baseline_search_hypergraph):
+        (BaselineOptimizer.__init__):
+        * Scripts/webkitpy/common/checkout/baselineoptimizer_unittest.py:
+        (TestBaselineOptimizer.__init__):
+        (BaselineOptimizerTest.test_move_baselines):
+        * Scripts/webkitpy/tool/commands/rebaseline.py:
+        (OptimizeBaselines.__init__):
+        (OptimizeBaselines.execute):
+        (AnalyzeBaselines.__init__):
+        (AnalyzeBaselines.execute):
+        * Scripts/webkitpy/tool/commands/rebaseline_unittest.py:
+        (TestAnalyzeBaselines.test_default):
+        (TestAnalyzeBaselines.test_missing_baselines):
+
+2012-11-05  Dirk Pranke  <dpranke@chromium.org>
+
+        webkit-patch rebaseline-expectations should take a --platform arg
+        https://bugs.webkit.org/show_bug.cgi?id=97621
+
+        Reviewed by Ojan Vafai.
+
+        So that we can limit which platforms we attempt to rebaseline;
+        this can reduce the noise the command produces if some ports
+        have errors or warnings in their TestExpectations files and/or
+        help produce more predictable results.
+
+        In testing this patch, I realized that the rebaseline-in-parallel
+        commands (rebaseline-json, rebaseline-expectations, etc.) can
+        cause multiple rebaseline-test-internal commands to attempt to
+        modify the TestExpectations files concurrently, and that we needed
+        to lock the files to prevent corruption; it would be nice if
+        we can split the updating-the-expectations-files out separately
+        from updating the filesystem (much like we do with the scm updates)
+        to avoid this concurrency.
+
+        * Scripts/webkitpy/common/system/file_lock_mock.py: Added.
+        (MockFileLock):
+        (MockFileLock.__init__):
+        (MockFileLock.acquire_lock):
+        (MockFileLock.release_lock):
+        * Scripts/webkitpy/common/system/systemhost.py:
+        (SystemHost.copy_current_environment):
+        (SystemHost):
+        (SystemHost.make_file_lock):
+        * Scripts/webkitpy/common/system/systemhost_mock.py:
+        (MockSystemHost.copy_current_environment):
+        (MockSystemHost):
+        (MockSystemHost.make_file_lock):
+        * Scripts/webkitpy/tool/commands/rebaseline.py:
+        (RebaselineTest._update_expectations_file):
+        (RebaselineExpectations.__init__):
+        (RebaselineExpectations._add_tests_to_rebaseline_for_port):
+        (RebaselineExpectations.execute):
+
+2012-11-05  Dirk Pranke  <dpranke@chromium.org>
+
+        webkitpy: clean up options for specifying multiple platforms at once
+        https://bugs.webkit.org/show_bug.cgi?id=101140
+
+        Reviewed by Ojan Vafai.
+
+        This patch reworks how we display the help strings for --platform
+        options and how we filter out platforms matching a glob. This will
+        be useful as I add patches to ensure that all the webkit-patch
+        commands are using --platform consistently to filter ports.
+
+        There should be no functional changes resulting from this patch.
+
+        * Scripts/webkitpy/layout_tests/port/factory.py:
+        (platform_options):
+        (PortFactory.all_port_names):
+        (PortFactory.get_from_builder_name):
+        * Scripts/webkitpy/tool/commands/queries.py:
+        (PrintExpectations.__init__):
+        (PrintBaselines.__init__):
+        * Scripts/webkitpy/tool/commands/rebaseline.py:
+        (AbstractRebaseliningCommand):
+        (RebaselineJson.__init__):
+        * Scripts/webkitpy/tool/commands/rebaseline_unittest.py:
+        (TestRebaselineExpectations.setUp):
+        (TestRebaselineExpectations.test_rebaseline_expectations):
+
+2012-11-05  Peter Beverloo  <peter@chromium.org>
+
+        The layout test runner shouldn't wait for data if stdout/stderr have been closed
+        https://bugs.webkit.org/show_bug.cgi?id=101233
+
+        Reviewed by Dirk Pranke.
+
+        Trying to read the file descriptor for the stdout or stderr pipes when DumpRenderTree
+        has crashed during a Chromium Android layout test-run, which uses FIFOs for
+        communication, causes the File.fileno() method to raise a ValueError. Return early
+        if either of the pipes has already been closed.
+
+        * Scripts/webkitpy/layout_tests/port/server_process.py:
+        (ServerProcess._wait_for_data_and_update_buffers_using_select):
+
+2012-11-05  Dirk Pranke  <dpranke@chromium.org>
+
+        webkit-patch rebaseline is broken
+        https://bugs.webkit.org/show_bug.cgi?id=101235
+
+        Reviewed by Ojan Vafai.
+
+        It didn't get updated to handle the change in parsing --suffixes
+        properly, and the unit test didn't get updated either, masking the
+        problem.
+
+        * Scripts/webkitpy/tool/commands/rebaseline.py:
+        (Rebaseline._tests_to_update):
+        (Rebaseline.execute):
+        * Scripts/webkitpy/tool/commands/rebaseline_unittest.py:
+        (TestRebaseline.test_rebaseline):
+
+2012-11-05  Dirk Pranke  <dpranke@chromium.org>
+
+        lint-webkitpy doesn't autoinstall pylint properly.
+        https://bugs.webkit.org/show_bug.cgi?id=101106
+
+        Reviewed by Ojan Vafai.
+
+        Re-land r133381 with fix; ironically, lint-webkitpy would've
+        complained about the problem. Also modify pylintrc and clean up
+        any other lint errors in the modified files.
+
+        * Scripts/webkitpy/common/system/autoinstall.py:
+        (AutoInstaller._set_up_target_dir):
+        (AutoInstaller):
+        (AutoInstaller._make_package):
+        (AutoInstaller._create_scratch_directory):
+        (AutoInstaller._install):
+        (AutoInstaller.install):
+        * Scripts/webkitpy/pylintrc:
+        * Scripts/webkitpy/thirdparty/__init__.py:
+        (AutoinstallImportHook._ensure_autoinstalled_dir_is_in_sys_path):
+        (AutoinstallImportHook):
+        (AutoinstallImportHook.find_module):
+        (AutoinstallImportHook._install_pylint):
+        (AutoinstallImportHook._install_coverage):
+        (AutoinstallImportHook._install_eliza):
+        (AutoinstallImportHook._install_webpagereplay):
+        (AutoinstallImportHook._install):
+        * Scripts/webkitpy/thirdparty/__init___unittest.py:
+        (ThirdpartyTest.test_import_hook.MockImportHook.__init__):
+        (ThirdpartyTest.test_import_hook):
+        (ThirdpartyTest.test_imports):
+
+2012-11-05  KyungTae Kim  <ktf.kim@samsung.com>
+
+        [EFL] Fix build warning in EWebLauncher/main.c
+        https://bugs.webkit.org/show_bug.cgi?id=101197
+
+        Reviewed by Kentaro Hara.
+
+        Because the strp of _Ecore_Getopt_Value is char** (Ecore_Getopt.h),
+        The parameter of ECORE_GETOPT_VALUE_STR should be char*
+
+        * EWebLauncher/main.c:
+        (_User_Arguments):
+
+2012-11-05  Mikhail Pozdnyakov  <mikhail.pozdnyakov@intel.com>
+
+        [EFL][WK2] Add --window-size command line option to EFL MiniBrowser
+        https://bugs.webkit.org/show_bug.cgi?id=100942
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Added window-size (-s) command line option to EFL MiniBrowser.
+
+        * MiniBrowser/efl/main.c:
+        (window_create):
+        (parse_window_size):
+        (elm_main):
+
+2012-11-05  Christophe Dumez  <christophe.dumez@intel.com>
+
+        [EFL][WK2] The icon database path should be set by the client
+        https://bugs.webkit.org/show_bug.cgi?id=101182
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Enable favicon database functionality in MiniBrowser since
+        it is used and it is no longer enabled by default.
+
+        * MiniBrowser/efl/main.c:
+        (elm_main):
+
+2012-11-03  Balazs Kelemen  <kbalazs@webkit.org>
+
+        [Qt][WK2] setPlatformStrategies always asserts after r132744
+        https://bugs.webkit.org/show_bug.cgi?id=100838
+
+        Reviewed by Simon Hausmann.
+
+        Reland with build fixes.
+
+        Turned test runners to use the new QtTestSupport.
+
+        * DumpRenderTree/qt/DumpRenderTree.pro:
+        * DumpRenderTree/qt/DumpRenderTreeMain.cpp:
+        (main):
+        * DumpRenderTree/qt/DumpRenderTreeQt.cpp:
+        (WebCore::DumpRenderTree::open):
+        * DumpRenderTree/qt/QtInitializeTestFonts.h: Removed.
+        * MiniBrowser/qt/MiniBrowser.pro:
+        * QtTestBrowser/QtTestBrowser.pro:
+        * QtTestBrowser/qttestbrowser.cpp:
+        (LauncherApplication::handleUserOptions):
+        * WebKitTestRunner/InjectedBundle/Target.pri:
+        * WebKitTestRunner/InjectedBundle/qt/ActivateFontsQt.cpp:
+        (WTR::activateFonts):
+        * WebKitTestRunner/InjectedBundle/qt/QtInitializeTestFonts.cpp: Removed.
+        * WebKitTestRunner/InjectedBundle/qt/QtInitializeTestFonts.h: Removed.
+        * WebKitTestRunner/InjectedBundle/qt/TestRunnerQt.cpp:
+        (WTR::TestRunner::platformInitialize):  Removed the comment from here
+        because it was just lying, apparently two times. First, it is not incorrect
+        to reinitialize our font set and clear font caches, it is what the tests
+        expect. Second, the use of QRawFont has nothing to do with the font cache.
+        * WebKitTestRunner/Target.pri:
+        * WebKitTestRunner/qt/main.cpp:
+        (main):
+
+2012-11-04  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r133381.
+        http://trac.webkit.org/changeset/133381
+        https://bugs.webkit.org/show_bug.cgi?id=101161
+
+        It made webkit-patch useless (Requested by Ossy_weekend on
+        #webkit).
+
+        * Scripts/webkitpy/common/system/autoinstall.py:
+        (AutoInstaller._create_scratch_directory):
+        (AutoInstaller._install):
+        (AutoInstaller.install):
+        * Scripts/webkitpy/thirdparty/__init__.py:
+        (AutoinstallImportHook.__init__):
+        (AutoinstallImportHook._install_pylint):
+        (AutoinstallImportHook._install_coverage):
+        (AutoinstallImportHook._install_eliza):
+        (AutoinstallImportHook._install):
+        * Scripts/webkitpy/thirdparty/__init___unittest.py:
+        (ThirdpartyTest.test_import_hook.MockImportHook.__init__):
+        (ThirdpartyTest.test_import_hook):
+
+2012-11-03  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r133403, r133404, and r133409.
+        http://trac.webkit.org/changeset/133403
+        http://trac.webkit.org/changeset/133404
+        http://trac.webkit.org/changeset/133409
+        https://bugs.webkit.org/show_bug.cgi?id=101158
+
+        "Broke tests" (Requested by kbalazs on #webkit).
+
+        * DumpRenderTree/qt/DumpRenderTree.pro:
+        * DumpRenderTree/qt/DumpRenderTreeMain.cpp:
+        (main):
+        * DumpRenderTree/qt/DumpRenderTreeQt.cpp:
+        (WebCore::DumpRenderTree::open):
+        * DumpRenderTree/qt/QtInitializeTestFonts.cpp: Renamed from Source/WebCore/platform/qt/QtTestSupport.cpp.
+        (WebKit):
+        (WebKit::initializeTestFonts):
+        * DumpRenderTree/qt/QtInitializeTestFonts.h: Copied from Tools/WebKitTestRunner/InjectedBundle/qt/ActivateFontsQt.cpp.
+        (WebKit):
+        * MiniBrowser/qt/MiniBrowser.pro:
+        * MiniBrowser/qt/MiniBrowserApplication.cpp:
+        (MiniBrowserApplication::handleUserOptions):
+        * QtTestBrowser/QtTestBrowser.pro:
+        * QtTestBrowser/qttestbrowser.cpp:
+        (LauncherApplication::handleUserOptions):
+        * WebKitTestRunner/InjectedBundle/Target.pri:
+        * WebKitTestRunner/InjectedBundle/qt/ActivateFontsQt.cpp:
+        (WTR::activateFonts):
+        * WebKitTestRunner/InjectedBundle/qt/QtInitializeTestFonts.cpp: Copied from Tools/WebKitTestRunner/InjectedBundle/qt/ActivateFontsQt.cpp.
+        * WebKitTestRunner/InjectedBundle/qt/QtInitializeTestFonts.h: Copied from Tools/WebKitTestRunner/InjectedBundle/qt/ActivateFontsQt.cpp.
+        * WebKitTestRunner/InjectedBundle/qt/TestRunnerQt.cpp:
+        (WTR::TestRunner::platformInitialize):
+        * WebKitTestRunner/Target.pri:
+        * WebKitTestRunner/qt/main.cpp:
+        (main):
+
+2012-11-03  Balazs Kelemen  <kbalazs@webkit.org>
+
+        [Qt][WK2] setPlatformStrategies always asserts after r132744
+        https://bugs.webkit.org/show_bug.cgi?id=100838
+
+        2nd unreviewed buildfix.
+
+        * MiniBrowser/qt/MiniBrowserApplication.cpp:
+
+2012-11-03  Balazs Kelemen  <kbalazs@webkit.org>
+
+        [Qt][WK2] setPlatformStrategies always asserts after r132744
+        https://bugs.webkit.org/show_bug.cgi?id=100838
+
+        Unreviewed buildfix.
+
+        * WebKitTestRunner/Target.pri:
+
+2012-11-03  Balazs Kelemen  <kbalazs@webkit.org>
+
+        [Qt][WK2] setPlatformStrategies always asserts after r132744
+        https://bugs.webkit.org/show_bug.cgi?id=100838
+
+        Reviewed by Simon Hausmann.
+
+        Reland with build fix.
+
+        Turned test runners to use the new QtTestSupport.
+
+        * DumpRenderTree/qt/DumpRenderTree.pro:
+        * DumpRenderTree/qt/DumpRenderTreeMain.cpp:
+        (main):
+        * DumpRenderTree/qt/DumpRenderTreeQt.cpp:
+        (WebCore::DumpRenderTree::open):
+        * DumpRenderTree/qt/QtInitializeTestFonts.h: Removed.
+        * MiniBrowser/qt/MiniBrowser.pro:
+        * QtTestBrowser/QtTestBrowser.pro:
+        * QtTestBrowser/qttestbrowser.cpp:
+        (LauncherApplication::handleUserOptions):
+        * WebKitTestRunner/InjectedBundle/Target.pri:
+        * WebKitTestRunner/InjectedBundle/qt/ActivateFontsQt.cpp:
+        (WTR::activateFonts):
+        * WebKitTestRunner/InjectedBundle/qt/QtInitializeTestFonts.cpp: Removed.
+        * WebKitTestRunner/InjectedBundle/qt/QtInitializeTestFonts.h: Removed.
+        * WebKitTestRunner/InjectedBundle/qt/TestRunnerQt.cpp:
+        (WTR::TestRunner::platformInitialize):  Removed the comment from here
+        because it was just lying, apparently two times. First, it is not incorrect
+        to reinitialize our font set and clear font caches, it is what the tests
+        expect. Second, the use of QRawFont has nothing to do with the font cache.
+        * WebKitTestRunner/Target.pri:
+        * WebKitTestRunner/qt/main.cpp:
+        (main):
+
+2012-11-03  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r133397.
+        http://trac.webkit.org/changeset/133397
+        https://bugs.webkit.org/show_bug.cgi?id=101155
+
+        "Broke Qt. No way to force the damn bots to do a clean build.
+        I'm giving up." (Requested by kbalazs on #webkit).
+
+        * DumpRenderTree/qt/DumpRenderTree.pro:
+        * DumpRenderTree/qt/DumpRenderTreeMain.cpp:
+        (main):
+        * DumpRenderTree/qt/DumpRenderTreeQt.cpp:
+        (WebCore::DumpRenderTree::open):
+        * DumpRenderTree/qt/QtInitializeTestFonts.cpp: Renamed from Source/WebCore/platform/qt/QtTestSupport.cpp.
+        (WebKit):
+        (WebKit::initializeTestFonts):
+        * DumpRenderTree/qt/QtInitializeTestFonts.h: Copied from Tools/WebKitTestRunner/InjectedBundle/qt/ActivateFontsQt.cpp.
+        (WebKit):
+        * QtTestBrowser/QtTestBrowser.pro:
+        * QtTestBrowser/qttestbrowser.cpp:
+        (LauncherApplication::handleUserOptions):
+        * WebKitTestRunner/InjectedBundle/Target.pri:
+        * WebKitTestRunner/InjectedBundle/qt/ActivateFontsQt.cpp:
+        (WTR::activateFonts):
+        * WebKitTestRunner/InjectedBundle/qt/QtInitializeTestFonts.cpp: Copied from Tools/WebKitTestRunner/InjectedBundle/qt/ActivateFontsQt.cpp.
+        * WebKitTestRunner/InjectedBundle/qt/QtInitializeTestFonts.h: Copied from Tools/WebKitTestRunner/InjectedBundle/qt/ActivateFontsQt.cpp.
+        * WebKitTestRunner/InjectedBundle/qt/TestRunnerQt.cpp:
+        (WTR::TestRunner::platformInitialize):
+        * WebKitTestRunner/Target.pri:
+        * WebKitTestRunner/qt/main.cpp:
+        (main):
+
+2012-11-03  Balazs Kelemen  <kbalazs@webkit.org>
+
+        [Qt][WK2] setPlatformStrategies always asserts after r132744
+        https://bugs.webkit.org/show_bug.cgi?id=100838
+
+        Reviewed by Simon Hausmann.
+
+        Turned test runners to use the new QtTestSupport.
+
+        * DumpRenderTree/qt/DumpRenderTree.pro:
+        * DumpRenderTree/qt/DumpRenderTreeMain.cpp:
+        (main):
+        * DumpRenderTree/qt/DumpRenderTreeQt.cpp:
+        (WebCore::DumpRenderTree::open):
+        * QtTestBrowser/QtTestBrowser.pro:
+        * QtTestBrowser/qttestbrowser.cpp:
+        (LauncherApplication::handleUserOptions):
+        * WebKitTestRunner/InjectedBundle/Target.pri:
+        * WebKitTestRunner/InjectedBundle/qt/ActivateFontsQt.cpp:
+        (WTR::activateFonts):
+        * WebKitTestRunner/InjectedBundle/qt/QtInitializeTestFonts.cpp: Removed.
+        * WebKitTestRunner/InjectedBundle/qt/QtInitializeTestFonts.h: Removed.
+        * WebKitTestRunner/InjectedBundle/qt/InjectedBundleQt.cpp:
+        * WebKitTestRunner/InjectedBundle/qt/TestRunnerQt.cpp:
+        (WTR::TestRunner::platformInitialize): Removed the comment from here
+        because it was just lying, apparently two times. First, it is not incorrect
+        to reinitialize our font set and clear font caches, it is what the tests
+        expect. Second, the use of QRawFont has nothing to do with the font cache.
+        * WebKitTestRunner/Target.pri:
+        * WebKitTestRunner/qt/main.cpp:
+        (main):
+
+2012-11-02  Dirk Pranke  <dpranke@chromium.org>
+
+        webkit-patch rebaseline is broken
+        https://bugs.webkit.org/show_bug.cgi?id=101081
+
+        Reviewed by Ojan Vafai.
+
+        I broke this in r133061 and the unit tests weren't covering this
+        code path. Fixed the issue and the tests. --results-directory
+        doesn't make sense for either 'webkit-patch rebaseline' or
+        'webkit-patch rebaseline-expectations', so we don't want to expose
+        that as a command line option, but they all call a common
+        _rebaseline() routine that references options.results_directory,
+        so we need to set a default value.
+
+        * Scripts/webkitpy/tool/commands/rebaseline.py:
+        (RebaselineExpectations.execute):
+        (Rebaseline.execute):
+        * Scripts/webkitpy/tool/commands/rebaseline_unittest.py:
+        (TestRebaseline):
+        (TestRebaseline.test_rebaseline):
+
+2012-11-02  Dirk Pranke  <dpranke@chromium.org>
+
+        lint-webkitpy doesn't autoinstall pylint properly
+        https://bugs.webkit.org/show_bug.cgi?id=101106
+
+        Reviewed by Ojan Vafai.
+
+        Turns out the autoinstalling code for pylint didn't install
+        pylint's dependencies, and the autoinstaller code didn't work
+        using nested directories (e.g., "logilab/astng"). Fix those issues,
+        clean up the autoinstaller code, and add tests to make sure everything
+        imports successfully.
+
+        * Scripts/webkitpy/common/system/autoinstall.py:
+        (AutoInstaller._create_scratch_directory):
+        (AutoInstaller._install):
+        (AutoInstaller.install):
+        * Scripts/webkitpy/thirdparty/__init__.py:
+        (AutoinstallImportHook._ensure_autoinstalled_dir_is_in_sys_path):
+        (AutoinstallImportHook._install_pylint):
+        (AutoinstallImportHook._install_coverage):
+        (AutoinstallImportHook._install_eliza):
+        (AutoinstallImportHook._install):
+        * Scripts/webkitpy/thirdparty/__init___unittest.py:
+        (ThirdpartyTest.test_import_hook.MockImportHook.__init__):
+        (ThirdpartyTest.test_import_hook):
+        (ThirdpartyTest.test_imports):
+
+2012-11-02  Dirk Pranke  <dpranke@chromium.org>
+
+        nrwt prints an awkward result message for missing results
+        https://bugs.webkit.org/show_bug.cgi?id=100915
+
+        Reviewed by Ojan Vafai.
+
+        Completely rework how we print out the description of
+        each tests's result - we now will print either "passed" or "failed",
+        followed by " unexpectedly" if we weren't expecting the result,
+        followed by a short description of each type of failure that happened
+        (in parentheses). Also reworked the description of each type of
+        failure slightly to be clearer.
+
+        Also rework the tests to make sure we have coverage of all of the
+        messages. Examples of the new output are posted as an attachment to
+        the bug.
+
+        * Scripts/webkitpy/layout_tests/models/test_expectations.py:
+        (TestExpectations):
+        * Scripts/webkitpy/layout_tests/models/test_failures.py:
+        (FailureTimeout.message):
+        (FailureMissingResult.message):
+        (FailureTextMismatch.message):
+        (FailureMissingImageHash.message):
+        (FailureMissingImage.message):
+        (FailureImageHashMismatch.message):
+        (FailureImageHashIncorrect.message):
+        (FailureReftestMismatch.message):
+        (FailureReftestMismatchDidNotOccur.message):
+        (FailureReftestNoImagesGenerated.message):
+        (FailureMissingAudio.message):
+        (FailureAudioMismatch.message):
+        (FailureEarlyExit.message):
+        * Scripts/webkitpy/layout_tests/port/test.py:
+        * Scripts/webkitpy/layout_tests/run_webkit_tests_integrationtest.py:
+        (MainTest.test_run_singly_actually_runs_tests):
+        (MainTest.test_missing_and_unexpected_results):
+        * Scripts/webkitpy/layout_tests/views/printing.py:
+        (Printer._print_result_summary_entry):
+        (Printer.print_finished_test):
+        (Printer._result_message):
+        (Printer._print_unexpected_results):
+        * Scripts/webkitpy/tool/bot/flakytestreporter_unittest.py:
+        * Scripts/webkitpy/tool/commands/queues_unittest.py:
+
+2012-11-02  Dirk Pranke  <dpranke@chromium.org>
+
+        webkitpy: clean up logging in common.system.autoinstall
+        https://bugs.webkit.org/show_bug.cgi?id=101090
+
+        Reviewed by Ojan Vafai.
+
+        This module logged way too much, much of which was logging that
+        was either really redundant or useful only during initial development.
+        This patch deletes a lot of code and tweaks the remaining log messages
+        to be more useful now.
+
+        Also, clean up a bunch of lint errors and warnings.
+
+        * Scripts/webkitpy/common/system/autoinstall.py:
+        (AutoInstaller.__init__):
+        (AutoInstaller._write_file):
+        (AutoInstaller._set_up_target_dir):
+        (AutoInstaller._create_scratch_directory):
+        (AutoInstaller._url_downloaded_path):
+        (AutoInstaller._is_downloaded):
+        (AutoInstaller._record_url_downloaded):
+        (AutoInstaller._extract_targz):
+        (AutoInstaller._extract_all):
+        (AutoInstaller._unzip):
+        (AutoInstaller._download_to_stream):
+        (AutoInstaller._download):
+        (AutoInstaller._install):
+        (AutoInstaller.install):
+
+2012-11-02  Dirk Pranke  <dpranke@chromium.org>
+
+        webkit-patch analyze-baselines output is weak
+        https://bugs.webkit.org/show_bug.cgi?id=100998
+
+        Reviewed by Ojan Vafai.
+
+        Currently analyze-baselines prints a list of baselines that have
+        the same checksum per line, but the format is hard to read;
+        this patch cleans up the output to print by directory instead
+        and use the same format I recently added for debugging optimize-baselines,
+        then refactors the code so that we share and adds tests for
+        analyze-baselines (which was untested).
+
+        Also, I got rid of a couple of unnecessarily-hardcoded port names,
+        and modified the baseline optimizer to log the current world when
+        optimize fails.
+
+        * Scripts/webkitpy/common/checkout/baselineoptimizer.py:
+        (BaselineOptimizer.read_results_by_directory):
+        (BaselineOptimizer.write_by_directory):
+        (BaselineOptimizer.optimize):
+        * Scripts/webkitpy/tool/commands/rebaseline.py:
+        (OptimizeBaselines.execute):
+        (AnalyzeBaselines.__init__):
+        (AnalyzeBaselines._write):
+        (AnalyzeBaselines._analyze_baseline):
+        (AnalyzeBaselines.execute):
+        * Scripts/webkitpy/tool/commands/rebaseline_unittest.py:
+        (_FakeOptimizer):
+        (_FakeOptimizer.read_results_by_directory):
+        (TestAnalyzeBaselines):
+        (TestAnalyzeBaselines.setUp):
+        (TestAnalyzeBaselines.test_default):
+        (TestAnalyzeBaselines.test_missing_baselines):
+
+2012-11-02  Adam Barth  <abarth@webkit.org>
+
+        ENABLE(UNDO_MANAGER) is disabled everywhere and is not under active development
+        https://bugs.webkit.org/show_bug.cgi?id=100711
+
+        Reviewed by Eric Seidel.
+
+        * Scripts/webkitperl/FeatureList.pm:
+        * qmake/mkspecs/features/features.pri:
+
+2012-11-02  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r133303.
+        http://trac.webkit.org/changeset/133303
+        https://bugs.webkit.org/show_bug.cgi?id=101068
+
+        "Broke qt wk2 build (seems like bots fails to rerun qmake if
+        needed)" (Requested by kbalazs on #webkit).
+
+        * DumpRenderTree/qt/DumpRenderTree.pro:
+        * DumpRenderTree/qt/DumpRenderTreeMain.cpp:
+        (main):
+        * DumpRenderTree/qt/DumpRenderTreeQt.cpp:
+        (WebCore::DumpRenderTree::open):
+        * DumpRenderTree/qt/QtInitializeTestFonts.cpp: Renamed from Source/WebCore/platform/qt/QtTestSupport.cpp.
+        (WebKit):
+        (WebKit::initializeTestFonts):
+        * DumpRenderTree/qt/QtInitializeTestFonts.h: Copied from Tools/WebKitTestRunner/InjectedBundle/qt/ActivateFontsQt.cpp.
+        (WebKit):
+        * QtTestBrowser/QtTestBrowser.pro:
+        * QtTestBrowser/qttestbrowser.cpp:
+        (LauncherApplication::handleUserOptions):
+        * WebKitTestRunner/InjectedBundle/Target.pri:
+        * WebKitTestRunner/InjectedBundle/qt/ActivateFontsQt.cpp:
+        (WTR::activateFonts):
+        * WebKitTestRunner/InjectedBundle/qt/QtInitializeTestFonts.cpp: Copied from Tools/WebKitTestRunner/InjectedBundle/qt/ActivateFontsQt.cpp.
+        * WebKitTestRunner/InjectedBundle/qt/QtInitializeTestFonts.h: Copied from Tools/WebKitTestRunner/InjectedBundle/qt/ActivateFontsQt.cpp.
+        * WebKitTestRunner/InjectedBundle/qt/TestRunnerQt.cpp:
+        (WTR::TestRunner::platformInitialize):
+        * WebKitTestRunner/Target.pri:
+        * WebKitTestRunner/qt/main.cpp:
+        (main):
+
+2012-11-02  Balazs Kelemen  <kbalazs@webkit.org>
+
+        [Qt][WK2] setPlatformStrategies always asserts after r132744
+        https://bugs.webkit.org/show_bug.cgi?id=100838
+
+        Reviewed by Simon Hausmann.
+
+        Turned test runners to use the new QtTestSupport.
+
+        * DumpRenderTree/qt/DumpRenderTree.pro:
+        * DumpRenderTree/qt/DumpRenderTreeMain.cpp:
+        (main):
+        * DumpRenderTree/qt/DumpRenderTreeQt.cpp:
+        (WebCore::DumpRenderTree::open):
+        * QtTestBrowser/QtTestBrowser.pro:
+        * QtTestBrowser/qttestbrowser.cpp:
+        (LauncherApplication::handleUserOptions):
+        * WebKitTestRunner/InjectedBundle/Target.pri:
+        * WebKitTestRunner/InjectedBundle/qt/ActivateFontsQt.cpp:
+        (WTR::activateFonts):
+        * WebKitTestRunner/InjectedBundle/qt/QtInitializeTestFonts.cpp: Removed.
+        * WebKitTestRunner/InjectedBundle/qt/QtInitializeTestFonts.h: Removed.
+        * WebKitTestRunner/InjectedBundle/qt/InjectedBundleQt.cpp:
+        * WebKitTestRunner/InjectedBundle/qt/TestRunnerQt.cpp:
+        (WTR::TestRunner::platformInitialize): Removed the comment from here
+        because it was just lying, apparently two times. First, it is not incorrect
+        to reinitialize our font set and clear font caches, it is what the tests
+        expect. Second, the use of QRawFont has nothing to do with the font cache.
+        * WebKitTestRunner/Target.pri:
+        * WebKitTestRunner/qt/main.cpp:
+        (main):
+
+2012-11-02  Peter Beverloo  <peter@chromium.org>
+
+        Output Android's device status before running tests on the bots
+        https://bugs.webkit.org/show_bug.cgi?id=100944
+
+        Reviewed by Dirk Pranke.
+
+        This adds a new step to the build master which will be run prior to the
+        actual tests-suites on the Chromium Android tester, and soon the Chromium
+        Android Perf bot. For each attached device, it outputs the build
+        information, battery level, battery temperature and username.
+
+        The Android tester currently is very flaky, and this will help tremendously
+        in being able to figure out what's wrong with the bot.
+
+        * BuildSlaveSupport/build.webkit.org-config/master.cfg:
+        (OutputAndroidDeviceStatus):
+        (TestFactory.__init__):
+        * BuildSlaveSupport/chromium/output-android-device-status: Added.
+        (GetAttachedDevices):
+        (AndroidDeviceStatus):
+        (AndroidDeviceStatus.__init__):
+        (AndroidDeviceStatus._run_adb_command):
+        (AndroidDeviceStatus.device_type):
+        (AndroidDeviceStatus.device_build):
+        (AndroidDeviceStatus.device_fingerprint):
+        (AndroidDeviceStatus.battery_level):
+        (AndroidDeviceStatus.battery_temperature):
+        (AndroidDeviceStatus.username):
+        (main):
+
+2012-11-02  Jocelyn Turcotte  <jocelyn.turcotte@digia.com>
+
+        [Qt] WTR: Make sure that eventSender.mouseDown sends a press event for the second press
+        https://bugs.webkit.org/show_bug.cgi?id=101033
+
+        Reviewed by Simon Hausmann.
+
+        eventSender.mouseDown doesn't work properly since r133153 where
+        MouseButtonDblClick events aren't interpreted as Press events anymore.
+        The problem is that mouseDown sends a DblClick event instead of a Press,
+        while the correct way is to send both events.
+
+        Since QQuickWebView isn't doing anything with DblClick events anymore,
+        simply send Press events all the time and let WebCore figure out
+        where the double clicks are.
+
+        * WebKitTestRunner/qt/EventSenderProxyQt.cpp:
+        (WTR::EventSenderProxy::updateClickCountForButton):
+        (WTR::EventSenderProxy::mouseDown):
+
+2012-11-02  Christophe Dumez  <christophe.dumez@intel.com>
+
+        [EFL][WK2] Add HTTP authentication support to MiniBrowser
+        https://bugs.webkit.org/show_bug.cgi?id=100953
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Add HTTP authentication support to MiniBrowser. An authentication
+        dialog now pops up to ask the user for credentials whenever
+        a Web site requires authentication.
+
+        * MiniBrowser/efl/main.c:
+        (auth_popup_close):
+        (on_auth_cancel):
+        (on_auth_ok):
+        (on_authentication_request):
+        (window_create):
+
+2012-11-01  Yury Semikhatsky  <yurys@chromium.org>
+
+        Memory instrumentation: do not call checkCountedObject with wrong pointers
+        https://bugs.webkit.org/show_bug.cgi?id=100958
+
+        Reviewed by Alexander Pavlov.
+
+        * TestWebKitAPI/Tests/WTF/MemoryInstrumentationTest.cpp: test that if there
+        if there is class A derived from classes B and C and we have pointer B* to an
+        object of class A then MemoryInstrumentationClient::checkoutCountedObject won't
+        be called for B* but only for A*
+
+        Also MemoryInstrumentation implementation used in the test was refactored to
+        allow passing client as a parameter. The client implementation was extracted into
+        a top-level class MemoryInstrumentationTestClient.
+
+2012-11-01  Christophe Dumez  <christophe.dumez@intel.com>
+
+        [EFL][WK2] Make File Chooser dialog modal in MiniBrowser
+        https://bugs.webkit.org/show_bug.cgi?id=100962
+
+        Reviewed by Gyuyoung Kim.
+
+        Make File Chooser dialog modal in MiniBrowser and make
+        sure it is closed and freed when its parent window is
+        closed.
+
+        * MiniBrowser/efl/main.c:
+        (close_file_picker):
+        (on_filepicker_parent_deletion):
+        (on_file_chooser_request):
+
+2012-11-01  Seonae Kim  <sunaeluv.kim@samsung.com>
+
+        [EFL][DRT] Support Geolocation
+        https://bugs.webkit.org/show_bug.cgi?id=97427
+
+        Reviewed by Gyuyoung Kim. 
+
+        Implement methods to use GeolocationClientMock in DumpRenderTree.
+        This client attaches to the page whenever a view is created.
+
+        * DumpRenderTree/efl/DumpRenderTreeChrome.cpp:
+        (DumpRenderTreeChrome::createView):
+        (DumpRenderTreeChrome::resetDefaultsToConsistentValues):
+        * DumpRenderTree/efl/TestRunnerEfl.cpp:
+        (TestRunner::setMockGeolocationPosition):
+        (TestRunner::setMockGeolocationPositionUnavailableError):
+        (TestRunner::setGeolocationPermission):
+        (TestRunner::numberOfPendingGeolocationPermissionRequests):
+
+2012-11-01  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Remove tests no longer needed after r133229.
+
+        * Scripts/webkitpy/performance_tests/perftest_unittest.py:
+        (TestPerfTestFactory.test_inspector_test):
+        * Scripts/webkitpy/performance_tests/perftestsrunner_unittest.py:
+        (test_collect_tests_with_skipped_list):
+
+2012-11-01  Nico Weber  <thakis@chromium.org>
+
+        [chromium] Try to find ninja if it's not in the path already
+        https://bugs.webkit.org/show_bug.cgi?id=100988
+
+        Reviewed by Ryosuke Niwa.
+
+        Similar to the gclient detection logic in update-webkit-chromium
+
+        * Scripts/webkitdirs.pm:
+        (buildChromiumNinja):
+
+2012-11-01  Eric Seidel  <eric@webkit.org>
+
+        Add Glenn Adams to the Contributor list
+        https://bugs.webkit.org/show_bug.cgi?id=100982
+
+        Reviewed by Adam Barth.
+
+        I CC him enough on bugs it would help me to have him listed here.
+
+        * Scripts/webkitpy/common/config/committers.py:
+
+2012-11-01  Jer Noble  <jer.noble@apple.com>
+
+        Add Python-LLDB support for WTF::Vector types.
+        https://bugs.webkit.org/show_bug.cgi?id=100980
+
+        Reviewed by Anders Carlsson.
+
+        Add a synthetic child provider for WTF::Vector types.
+
+        * lldb/lldb_webkit.py:
+        (__lldb_init_module): Add both the summary and synthetic providers for WTF::Vector
+        (WTFVector_SummaryProvider): Wrapper around WTFVectorProvider
+        (WTFVectorProvider):
+        (WTFVectorProvider.__init__):
+        (WTFVectorProvider.num_children): Return m_size+2 children to account for synthesized children.
+        (WTFVectorProvider.get_child_index): Synthesize child indexes for each entry in the Vector.
+        (WTFVectorProvider.get_child_at_index): Synthesize children for each entry in the Vector.
+        (WTFVectorProvider.update): Retrieve state from the underlying Vector.
+        (WTFVectorProvider.has_children): Vectors always have children.
+
+2012-11-01  Zoltan Horvath  <zoltan@webkit.org>
+
+        Remove PageLoad directory entry from PerformanceTests pattern_map
+        https://bugs.webkit.org/show_bug.cgi?id=100989
+
+        Reviewed by Ryosuke Niwa.
+
+        Since we removed PageLoad directory from PerformanceTests we don't need this entry in pattern_map.
+
+        * Scripts/webkitpy/performance_tests/perftest.py:
+        (PerfTestFactory):
+
+2012-11-01  Jer Noble  <jer.noble@apple.com>
+
+        Add LLDB-Python scripts to support WebKit data types.
+        https://bugs.webkit.org/show_bug.cgi?id=100898
+
+        Reviewed by Anders Carlsson.
+
+        Add Summary providers for common WebKit string types.
+
+        * lldb/lldb_webkit.py: Added.
+        (__lldb_init_module): Register these providers with the debugger.
+        (WTFString_SummaryProvider): Wrapper around WTFStringProvider.
+        (WTFStringImpl_SummaryProvider): Wrapper around WTFStringImplProvider.
+        (WTFAtomicString_SummaryProvider): Ditto.
+        (guess_string_length): Walk through the string looking for a null-byte(s).
+        (ustring_to_string): Walk through the string, extracting two-byte values, and concatenate them.
+        (lstring_to_string): Walk through the string, extracting byte values, and concatenate them.
+        (WTFStringImplProvider): 
+        (WTFStringImplProvider.__init__):
+        (WTFStringImplProvider.get_length): Extract the m_length variable.
+        (WTFStringImplProvider.get_data8): Extract the m_data8 variable.
+        (WTFStringImplProvider.get_data16): Extract the m_data16 variable.
+        (WTFStringImplProvider.to_string): Pass the appropriate data variable to {u,l}string_to_string.
+        (WTFStringImplProvider.is_8bit): Check the m_hashAndFlags variable.
+        (WTFStringProvider):
+        (WTFStringProvider.__init__):
+        (WTFStringProvider.stringimpl): Extract the m_impl variable.
+        (WTFStringProvider.get_length): Pass through to WTFStringImplProvider.
+        (WTFStringProvider.to_string): Ditto.
+
+2012-11-01  Peter Beverloo  <peter@chromium.org>
+
+        [Chromium-Android] Apache doesn't properly clean up ipc semaphores after a layout test run
+        https://bugs.webkit.org/show_bug.cgi?id=100950
+
+        Reviewed by Dirk Pranke.
+
+        When a test run would fail to complete due to an exception in one of
+        the workers, the HTTP server wouldn't get a chance to gracefully shut
+        down. This caused too much IPC semaphores to be left on the server,
+        causing Apache to fail to start in subsequent runs.
+
+        By unifying the Android-specific code with other ports, we no longer
+        fail to call the ChromiumPort/Base setup_test_run() and clean_up_test_run()
+        methods either. Furthermore, the number_of_servers argument for starting
+        the HTTP server is now available as well.
+
+        Because not all tests require an HTTP server, it's not guaranteed that
+        it will be started. Android depends on this, so add a new method to Port
+        and override it for Android: requires_http_server().
+
+        * Scripts/webkitpy/layout_tests/controllers/layout_test_runner.py:
+        (LayoutTestRunner.run_tests):
+        * Scripts/webkitpy/layout_tests/controllers/manager.py:
+        (Manager._run_tests):
+        * Scripts/webkitpy/layout_tests/port/base.py:
+        (Port.to.requires_http_server):
+        * Scripts/webkitpy/layout_tests/port/base_unittest.py:
+        (PortTest.test_dont_require_http_server):
+        * Scripts/webkitpy/layout_tests/port/chromium_android.py:
+        (ChromiumAndroidPort.requires_http_server):
+        (ChromiumAndroidPort.start_http_server):
+        * Scripts/webkitpy/layout_tests/port/chromium_android_unittest.py:
+        (ChromiumAndroidPortTest.test_must_require_http_server):
+
+2012-11-01  Adam Roben  <aroben@webkit.org>
+
+        Crash beneath WKRelease after failed load in MiniBrowser
+        https://bugs.webkit.org/show_bug.cgi?id=100954
+
+        Reviewed by Sam Weinig.
+
+        There were just some simple retain/release bugs.
+
+        * MiniBrowser/mac/WK2BrowserWindowController.m:
+        (-[WK2BrowserWindowController updateTextFieldFromURL:]):
+        (-[WK2BrowserWindowController updateProvisionalURLForFrame:]):
+        Don't try to release null URLs.
+
+        (-[WK2BrowserWindowController updateCommittedURLForFrame:]): Don't
+        release a URL for which we don't have ownership.
+
+2012-10-31  Rob Buis  <rbuis@rim.com>
+
+        [BlackBerry] Fix editing/text-iterator/findString-expected.html fail
+        https://bugs.webkit.org/show_bug.cgi?id=100902
+
+        Reviewed by Yong Li.
+
+        PR 210039
+
+        Fix the test my using the Page::findString method instead of our own in-page searcher.
+        This also syncs some of the changes we did regarding String usage.
+
+        * DumpRenderTree/blackberry/DumpRenderTree.cpp:
+        (BlackBerry::WebKit::DumpRenderTree::dumpFramesAsText):
+        (BlackBerry::WebKit::dumpHistoryItem):
+        (BlackBerry::WebKit::dumpBackForwardListForWebView):
+        (BlackBerry::WebKit::DumpRenderTree::dump):
+        (BlackBerry::WebKit::DumpRenderTree::didFinishDocumentLoadForFrame):
+        (BlackBerry::WebKit::DumpRenderTree::didReceiveTitleForFrame):
+        (BlackBerry::WebKit::DumpRenderTree::runJavaScriptAlert):
+        * DumpRenderTree/blackberry/DumpRenderTreeBlackBerry.h:
+        (DumpRenderTree):
+        * DumpRenderTree/blackberry/TestRunnerBlackBerry.cpp:
+        (TestRunner::setMockGeolocationError):
+        (TestRunner::layerTreeAsText):
+        (TestRunner::findString):
+        (TestRunner::setStorageDatabaseIdleInterval):
+
+2012-11-01  Christophe Dumez  <christophe.dumez@intel.com>
+
+        [EFL][WK2] Add File Chooser dialog support to MiniBrowser
+        https://bugs.webkit.org/show_bug.cgi?id=100822
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Add very basic file picker dialog to MiniBrowser so that
+        the user can select a file from the file system when
+        clicking an input element of type "file".
+
+        * MiniBrowser/efl/main.c:
+        (close_file_picker):
+        (on_filepicker_deletion):
+        (on_fileselector_done):
+        (on_file_chooser_request):
+        (window_create):
+
+2012-11-01  Yael Aharon  <yael.aharon@intel.com>
+
+        Unreviewed. Change my email address.
+
+        * Scripts/webkitpy/common/config/committers.py:
+
+2012-11-01  Jocelyn Turcotte  <jocelyn.turcotte@digia.com>
+
+        [Qt] Double clicks/taps aren't passed down to the page
+        https://bugs.webkit.org/show_bug.cgi?id=100949
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Touch mocking shouldn't transform double click events as well,
+        this adds an extra touch update between clicks which prevents
+        double-tap detection from triggering on web pages.
+
+        Tested on the mobile version of Google maps.
+
+        * MiniBrowser/qt/MiniBrowserApplication.cpp:
+        (MiniBrowserApplication::notify):
+
+2012-10-31  Dirk Pranke  <dpranke@chromium.org>
+
+        NRWT: lint warnings don't show up by default
+        https://bugs.webkit.org/show_bug.cgi?id=100914
+
+        Reviewed by Ryosuke Niwa.
+
+        NRWT wasn't printing any warnings if you had errors in your
+        TestExpectations files; this means you would only notice this
+        with --lint-test-files, which is probably bad. I'm not sure
+        when this requested, but perhaps when we changed the
+        warnings to not be fatal if you weren't linting the files.
+
+        Now they're still not fatal, but at least we print them.
+
+        Also fix one warning message where we were printing the test name twice.
+
+        * Scripts/webkitpy/layout_tests/models/test_expectations.py:
+        (TestExpectationsModel._already_seen_better_match):
+        (TestExpectations._report_warnings):
+        * Scripts/webkitpy/layout_tests/models/test_expectations_unittest.py:
+        (MiscTests.test_parse_warnings_are_logged_if_not_in_lint_mode(self): Added.
+
+2012-10-31  Terry Anderson  <tdanderson@chromium.org>
+
+        Missing stderr output when using run-webkit-tests
+        https://bugs.webkit.org/show_bug.cgi?id=100709
+
+        Reviewed by Dirk Pranke.
+
+        Appends #EOF to the end of the stderr output only at the end of a test,
+        not possibly part-way through. This will allow all of the stderr output 
+        to appear on the results page after running run-webkit-tests.
+
+        * DumpRenderTree/chromium/TestEventPrinter.cpp:
+        (TestEventPrinter::handleTextFooter):
+        (TestEventPrinter::handleTestFooter):
+
+2012-10-30  Mark Lam  <mark.lam@apple.com>
+
+        A JSC printf (support for %J+s and %b).
+        https://bugs.webkit.org/show_bug.cgi?id=100566.
+
+        Reviewed by Michael Saboff.
+
+        Added regression tests for VMInspector::fprintf() sprintf() and snprintf().
+
+        * TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj:
+        * TestWebKitAPI/Tests/JavaScriptCore: Added.
+        * TestWebKitAPI/Tests/JavaScriptCore/VMInspector.cpp: Added.
+
+2012-10-31  Thiago Marcos P. Santos  <thiago.santos@intel.com>
+
+        Added viewport at-rule to the CSS parser and tokenizer
+        https://bugs.webkit.org/show_bug.cgi?id=95961
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Enable CSS Device Adaptation by default on EFL.
+
+        * Scripts/webkitperl/FeatureList.pm:
+
+2012-10-31  Terry Anderson  <tdanderson@chromium.org>
+
+        [touchadjustment] touch-links-two-finger-tap test pass incorrectly
+        https://bugs.webkit.org/show_bug.cgi?id=100619
+
+        Reviewed by Antonio Gomes.
+
+        Store the touch area when sending a GestureTwoFingerTap event.
+
+        * DumpRenderTree/chromium/TestRunner/src/EventSender.cpp:
+        (WebTestRunner):
+        (WebTestRunner::EventSender::gestureEvent):
+
+2012-10-31  Dirk Pranke  <dpranke@chromium.org>
+
+        nrwt is not killing stuck DRTs on chromium win
+        https://bugs.webkit.org/show_bug.cgi?id=100886
+
+        Unreviewed, build fix.
+
+        In the original implementation of NRWT for Chromium, we used
+        to assume that DRT would always manage to exit on its own and
+        so NRWT wouldn't attempt to kill DRT if it was stuck (this was the
+        "hung worker" problem, and meant that if DRT hung, NRWT would hang).
+
+        Eventually, we merged the chromium code with the other ports and
+        now will always try to shut down DRTs if a test times out, but as
+        part of that merge we left in a code path where we wouldn't
+        shut the driver down on windows. This was resulting in stray
+        DRTs being left around, and NRWT sometimes not exiting cleanly as
+        a result.
+
+        No unit tests added because this was a windows-only code path (hence
+        hard to test) and that is now gone.
+
+        * Scripts/webkitpy/layout_tests/port/server_process.py:
+        (ServerProcess.stop):
+
+2012-10-31  Ami Fischman  <fischman@chromium.org>
+
+        [chromium] DRT and WTR should clear the cache between tests
+        https://bugs.webkit.org/show_bug.cgi?id=93195
+
+        Reviewed by Tony Chang.
+
+        This change makes chromium DRT match the GTK+, Qt, and EFL ports.
+
+        * DumpRenderTree/chromium/TestShell.cpp:
+        (TestShell::resetTestController): added a WebCache::clear() call to achieve the goal of the bug.
+
+2012-10-31  Dirk Pranke  <dpranke@chromium.org>
+
+        Fix typos introduced in r133061.
+        Unreviewed, build fix.
+
+        * BuildSlaveSupport/build.webkit.org-config/public_html/TestFailures/scripts/results.js:
+        * Scripts/webkitpy/tool/servers/reflectionhandler.py:
+        (ReflectionHandler._serve_file):
+
+2012-10-31  Dirk Pranke  <dpranke@chromium.org>
+
+        garden-o-matic should work for local results
+        https://bugs.webkit.org/show_bug.cgi?id=100805
+
+        Reviewed by Adam Barth.
+
+        This is the next step in making garden-o-matic replace
+        'webkit-patch rebaseline-server' and be able to deal with local
+        results. garden-o-matic now accepts a '--results-directory' option
+        that will point to a layout-test-results directory. At the moment
+        this will only work if you are also filtering to a single bot/
+        platform at a time (we can't handle multiple bots' worth of local
+        results, but that is a logical next step).
+
+        * BuildSlaveSupport/build.webkit.org-config/public_html/TestFailures/garden-o-matic.html:
+        * BuildSlaveSupport/build.webkit.org-config/public_html/TestFailures/scripts/config.js:
+        * BuildSlaveSupport/build.webkit.org-config/public_html/TestFailures/scripts/results.js:
+        * Scripts/webkitpy/tool/commands/gardenomatic.py:
+        (GardenOMatic.__init__):
+        (GardenOMatic.execute):
+        * Scripts/webkitpy/tool/commands/rebaseline.py:
+        (AbstractRebaseliningCommand):
+        (RebaselineTest.__init__):
+        (RebaselineTest._rebaseline_test):
+        (RebaselineTest._rebaseline_test_and_update_expectations):
+        (RebaselineTest.execute):
+        (AbstractParallelRebaselineCommand._rebaseline_commands):
+        (AbstractParallelRebaselineCommand._rebaseline):
+        (RebaselineJson.__init__):
+        * Scripts/webkitpy/tool/commands/rebaseline_unittest.py:
+        (_BaseTestCase):
+        (test_rebaseline_updates_expectations_file):
+        (test_rebaseline_does_not_include_overrides):
+        (test_rebaseline_test):
+        (test_rebaseline_test_and_print_scm_changes):
+        (test_rebaseline_and_copy_test):
+        (test_rebaseline_and_copy_test_no_existing_result):
+        (test_rebaseline_and_copy_test_with_lion_result):
+        (test_rebaseline_and_copy_no_overwrite_test):
+        (test_rebaseline_test_internal_with_move_overwritten_baselines_to):
+        (TestRebaselineJson.test_rebaseline_all):
+        (TestRebaselineJson.test_rebaseline_debug):
+        (TestRebaselineJson.test_move_overwritten):
+        (TestRebaselineJson.test_no_optimize):
+        (TestRebaselineExpectations.test_rebaseline_expectations):
+        * Scripts/webkitpy/tool/servers/gardeningserver.py:
+        (GardeningHTTPRequestHandler.rebaselineall):
+        (GardeningHTTPRequestHandler):
+        (GardeningHTTPRequestHandler.localresult):
+        * Scripts/webkitpy/tool/servers/reflectionhandler.py:
+        (ReflectionHandler.do_POST):
+        (ReflectionHandler):
+        (ReflectionHandler.do_HEAD):
+
+2012-10-31  Dirk Pranke  <dpranke@chromium.org>
+
+        garden-o-matic should support gardening a single port and specifying how to deal with overwritten baselines
+        https://bugs.webkit.org/show_bug.cgi?id=100563
+
+        Reviewed by Ojan Vafai.
+
+        This patch starts the process of making garden-o-matic more useful for
+        bringing up a single new port in two ways. The goal is to fully
+        obsolete webkit-patch rebaseline-server.
+        
+        First, it adds support for the --platform arguments to garden-o-matic
+        (so that the UI will default to the right cluster of bots), and if the platform arg
+        specifies a single bot, filters the results down to just that bot.
+
+        Second, it adds support for --move-overwritten-baselines and changes
+        the implementation of the move_overwritten_baselines setting in builders.py
+        so that it is only used if this flag is provided.
+
+        Future patches will make it possible to use local copies of the build
+        results (rather than going to the bots) and other optimizations to make
+        it faster to review lots of changes on a single bot.
+
+        * BuildSlaveSupport/build.webkit.org-config/public_html/TestFailures/garden-o-matic.html:
+        * BuildSlaveSupport/build.webkit.org-config/public_html/TestFailures/scripts/config.js:
+        (.):
+        * Scripts/webkitpy/layout_tests/port/builders.py:
+        * Scripts/webkitpy/tool/commands/gardenomatic.py:
+        (GardenOMatic):
+        (GardenOMatic.execute):
+        * Scripts/webkitpy/tool/commands/rebaseline.py:
+        (AbstractRebaseliningCommand):
+        (AbstractRebaseliningCommand.__init__):
+        (RebaselineTest):
+        (OptimizeBaselines):
+        (AnalyzeBaselines):
+        (AbstractParallelRebaselineCommand):
+        (AbstractParallelRebaselineCommand._rebaseline_commands):
+        (AbstractParallelRebaselineCommand._rebaseline):
+        (Rebaseline.__init__):
+        * Scripts/webkitpy/tool/servers/gardeningserver.py:
+        (GardeningHTTPServer.url):
+        (GardeningHTTPRequestHandler.rebaselineall):
+
+2012-10-31  Dirk Pranke  <dpranke@chromium.org>
+
+        test-webkitpy: fix running modules and classes on the command line
+        https://bugs.webkit.org/show_bug.cgi?id=100787
+
+        Reviewed by Eric Seidel.
+
+        Handling modules and classes are arguments on the command line
+        was broken due to the way we were parsing test names looking for
+        parallel and serial tests.
+
+        * Scripts/webkitpy/test/main.py:
+        (Tester._test_names):
+        (_Loader):
+        * Scripts/webkitpy/test/main_unittest.py:
+        (TestStubs.integration_test_empty):
+        (TestStubs):
+        (TestStubs.serial_test_empty):
+        (TestStubs.serial_integration_test_empty):
+        (TesterTest._find_test_names):
+        (TesterTest):
+        (TesterTest.test_individual_names_are_not_run_twice):
+        (TesterTest.test_integration_tests_are_not_found_by_default):
+        (TesterTest.test_integration_tests_are_found):
+
+2012-10-31  Dirk Pranke  <dpranke@chromium.org>
+
+        webkitpy: refactor common command line arguments for --platform, rebaseline commands
+        https://bugs.webkit.org/show_bug.cgi?id=100800
+
+        Reviewed by Ojan Vafai.
+
+        This change shuffles around how we share command-line options
+        between NRWT and the various webkit-patch rebaselining commands.
+
+        There are no functional changes in this patch but it should make
+        things clearer and will be useful in a couple of upcoming patches.
+
+        * Scripts/webkitpy/layout_tests/port/__init__.py:
+        * Scripts/webkitpy/layout_tests/port/factory.py:
+        (platform_options):
+        (configuration_options):
+        * Scripts/webkitpy/layout_tests/run_webkit_tests.py:
+        (parse_args):
+        * Scripts/webkitpy/tool/commands/queries.py:
+        (PrintExpectations.__init__):
+        (PrintBaselines.__init__):
+        * Scripts/webkitpy/tool/commands/rebaseline.py:
+        (AbstractRebaseliningCommand):
+        (AbstractRebaseliningCommand.__init__):
+        (RebaselineTest.__init__):
+        (OptimizeBaselines.__init__):
+        (AnalyzeBaselines.__init__):
+        (AbstractParallelRebaselineCommand):
+        (RebaselineJson.__init__):
+        (RebaselineExpectations.__init__):
+        (Rebaseline.__init__):
+
+2012-10-31  Thiago Marcos P. Santos  <thiago.santos@intel.com>
+
+        [NRWT] Xvfb driver is leaking application cache files
+        https://bugs.webkit.org/show_bug.cgi?id=100864
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Application Cache looks for XDG_CACHE_HOME which is now
+        prepended with DUMPRENDERTREE_TEMP and cleaned up when
+        the test worker finishes his job.
+
+        * Scripts/webkitpy/layout_tests/port/xvfbdriver.py:
+        (XvfbDriver._start):
+
+2012-10-31  Thiago Marcos P. Santos  <thiago.santos@intel.com>
+
+        [EFL] DRT doesn't clean up after itself
+        https://bugs.webkit.org/show_bug.cgi?id=100346
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        The test driver exports an environment variable DUMPRENDERTREE_TEMP
+        which is used by both DRT and WTR as the folder for storing icons,
+        databases, application cache, etc, overriding the default XDG_* path.
+
+        We don't need to create these folders because in fact, they are never
+        used and also never cleaned. Things created inside DUMPRENDERTREE_TEMP
+        are automatically removed after the test run.
+
+        * Scripts/webkitpy/layout_tests/port/efl.py:
+        (EflPort.setup_environ_for_server):
+
+2012-10-31  Thiago Marcos P. Santos  <thiago.santos@intel.com>
+
+        [WTR] WebKitTestRunner is not cleaning up the icon database
+        https://bugs.webkit.org/show_bug.cgi?id=100678
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        The icon database was not being set to the temporary folder created for
+        the test runner by the test driver, which is removed automatically
+        after the run.
+
+        * WebKitTestRunner/TestController.cpp:
+        (WTR::TestController::initialize):
+
+2012-10-31  Mike West  <mkwst@chromium.org>
+
+        Script run from an isolated world should bypass a page's CSP.
+        https://bugs.webkit.org/show_bug.cgi?id=97398
+
+        Reviewed by Adam Barth.
+
+        * DumpRenderTree/chromium/DRTTestRunner.cpp:
+        (DRTTestRunner::DRTTestRunner):
+        (DRTTestRunner::setIsolatedWorldContentSecurityPolicy):
+        * DumpRenderTree/chromium/DRTTestRunner.h:
+        (DRTTestRunner):
+            Adding a mechanism to set the Content Security Policy for an
+            isolated world to Chromium's testRunner.
+
+2012-10-31  Michał Pakuła vel Rutka  <m.pakula@samsung.com>
+
+        [EFL][DRT] EventSender requires contextClick implementation
+        https://bugs.webkit.org/show_bug.cgi?id=86091
+
+        Reviewed by Gyuyoung Kim.
+
+        Add contextClick for DumpRenderTreeEventSender basing on WebKit GTK
+        implementation.
+
+        * DumpRenderTree/efl/EventSender.cpp:
+        (getMenuItemTitleCallback):
+        (setMenuItemTitleCallback):
+        (menuItemClickCallback):
+        (contextClickCallback):
+
+2012-10-30  Sudarsana Nagineni  <sudarsana.nagineni@intel.com>
+
+        [WTR] Memory leaks in TestWebKitAPI::didReceiveMessageFromInjectedBundle()
+        https://bugs.webkit.org/show_bug.cgi?id=100770
+
+        Reviewed by Sam Weinig.
+
+        Adopt strings returned by WKStringCreateWithUTF8CString() in
+        didReceiveMessageFromInjectedBundle() to avoid memory leaks.
+
+        * TestWebKitAPI/Tests/WebKit2/WillSendSubmitEvent.cpp:
+        (TestWebKitAPI::didReceiveMessageFromInjectedBundle):
+
+2012-10-30  Kangil Han  <kangil.han@samsung.com>
+
+        Fix broken python unit test
+        https://bugs.webkit.org/show_bug.cgi?id=100810
+
+        Reviewed by Dirk Pranke.
+
+        BUG 100755 has broken python unit test, e.g. assertion fail, since it modified baseline path.
+        Therefore, this patch fixes it.
+
+        * Scripts/webkitpy/tool/commands/rebaseline_unittest.py:
+        (TestRebaselineTest.test_baseline_directory):
+
+2012-10-30  Dirk Pranke  <dpranke@chromium.org>
+
+        webkit-patch rebaseline*: add more helpful logging
+        https://bugs.webkit.org/show_bug.cgi?id=100562
+
+        Reviewed by Ojan Vafai.
+
+        This change rewires the garden-o-matic and rebaseline* commands
+        in webkit-patch so that --verbose propagates through all the
+        subcommand invocations properly, and cleans up the logging so
+        that you can actually tell what is happening. For now, we
+        leave all of the logging at the logging.DEBUG level, which
+        means that it gets mixed in will all the other debug logging noise
+        and is harder to read, but we'll fix that in subsequent patches.
+
+        * Scripts/webkitpy/common/checkout/baselineoptimizer.py:
+        (BaselineOptimizer._platform):
+        (BaselineOptimizer._move_baselines):
+        (BaselineOptimizer.optimize):
+        * Scripts/webkitpy/tool/commands/gardenomatic.py:
+        (GardenOMatic.execute):
+        * Scripts/webkitpy/tool/commands/rebaseline.py:
+        (RebaselineTest._copy_existing_baseline):
+        (RebaselineTest._rebaseline_test):
+        (OptimizeBaselines._optimize_baseline):
+        (OptimizeBaselines.execute):
+        (AbstractParallelRebaselineCommand._run_webkit_patch):
+        (AbstractParallelRebaselineCommand._rebaseline_commands):
+        (AbstractParallelRebaselineCommand._files_to_add):
+        (AbstractParallelRebaselineCommand._optimize_baselines):
+        (AbstractParallelRebaselineCommand._rebaseline):
+        (RebaselineExpectations._add_tests_to_rebaseline_for_port):
+        (Rebaseline.execute):
+        * Scripts/webkitpy/tool/servers/gardeningserver.py:
+        (GardeningHTTPServer.__init__):
+        (GardeningHTTPRequestHandler):
+        (GardeningHTTPRequestHandler._run_webkit_patch):
+        (GardeningHTTPRequestHandler.rebaselineall):
+
+2012-10-30  Dirk Pranke  <dpranke@chromium.org>
+
+        clean up tests for webkit-patch rebaseline* commands
+        https://bugs.webkit.org/show_bug.cgi?id=100793
+
+        Reviewed by Ojan Vafai.
+
+        The tests in rebaseline_unittest.py had a lot of code cloning,
+        and many of the tests tested whether things passed or failed by
+        looking at what was logged instead of what was actually done;
+        as a result the tests were kinda hard to understand and harder to
+        maintain.
+
+        This patch adds hooks to MockWeb() and MockExecutive() so we can
+        directly see which URLs were fetched and calls invoked, and
+        then reworks all of the unit tests to be easier to follow and
+        maintain and not sensitive to the logging. Also there were a
+        couple of tests that were redundant.
+
+        There are no functional changes in this patch, and I verified that
+        the coverage remains the same.
+
+        * Scripts/webkitpy/common/net/web_mock.py:
+        (MockWeb.__init__):
+        (MockWeb.get_binary):
+        * Scripts/webkitpy/common/system/executive_mock.py:
+        (MockExecutive.__init__):
+        (MockExecutive.run_command):
+        (MockExecutive.kill_all):
+        (MockExecutive):
+        (MockExecutive.kill_process):
+        (MockExecutive.popen):
+        (MockExecutive.run_in_parallel):
+        (MockExecutive2):
+        (MockExecutive2.__init__):
+        (MockExecutive2.run_command):
+        * Scripts/webkitpy/tool/commands/rebaseline_unittest.py:
+        (_BaseTestCase):
+        (_BaseTestCase.setUp):
+        (_BaseTestCase._expand):
+        (_BaseTestCase._read):
+        (_BaseTestCase._write):
+        (_BaseTestCase._zero_out_test_expectations):
+        (TestRebaselineTest):
+        (TestRebaselineTest.test_baseline_directory):
+        (TestRebaselineTest.test_rebaseline_updates_expectations_file_noop):
+        (test_rebaseline_updates_expectations_file):
+        (test_rebaseline_does_not_include_overrides):
+        (test_rebaseline_test):
+        (test_rebaseline_test_and_print_scm_changes):
+        (test_rebaseline_and_copy_test):
+        (test_rebaseline_and_copy_test_no_existing_result):
+        (test_rebaseline_and_copy_test_with_lion_result):
+        (test_rebaseline_and_copy_no_overwrite_test):
+        (test_rebaseline_test_internal_with_move_overwritten_baselines_to):
+        (TestRebaselineJson):
+        (TestRebaselineJson.setUp):
+        (TestRebaselineJson.tearDown):
+        (TestRebaselineJson.test_rebaseline_all):
+        (TestRebaselineJson.test_rebaseline_debug):
+        (TestRebaseline):
+        (TestRebaseline.test_tests_to_update):
+        (TestRebaseline.test_rebaseline):
+        (TestRebaseline.test_rebaseline.rebaseline_stub):
+        (TestRebaselineExpectations):
+        (TestRebaselineExpectations.setUp):
+        (TestRebaselineExpectations.test_rebaseline_expectations):
+        (TestRebaselineExpectations.test_rebaseline_expectations_noop):
+        (TestRebaselineExpectations.disabled_test_overrides_are_included_correctly):
+
+2012-10-30  Dirk Pranke  <dpranke@chromium.org>
+
+        test-webkitpy: fix import of coverage so that it works in a clean install
+        https://bugs.webkit.org/show_bug.cgi?id=100780
+
+        Reviewed by Tony Chang.
+
+        The coverage module is written so that the parent directory needs
+        to be in PYTHONPATH; work around that ...
+
+        * Scripts/webkitpy/test/main_unittest.py:
+        (TestStubs.test_empty):
+        (TesterTest.test_individual_names_are_not_run_twice):
+        (TesterTest):
+        (TesterTest.integration_test_coverage_works):
+        * Scripts/webkitpy/thirdparty/__init__.py:
+        (AutoinstallImportHook._install_coverage):
+
+2012-10-30  Anders Carlsson  <andersca@apple.com>
+
+        Another build fix.
+
+        * TestWebKitAPI/Tests/WebKit2/WebArchive.cpp:
+        (TestWebKitAPI::didReceiveMessageFromInjectedBundle):
+
+2012-10-30  Anders Carlsson  <andersca@apple.com>
+
+        Build fix.
+
+        * WebKitTestRunner/mac/EventSenderProxy.mm:
+        (WTR::EventSenderProxy::mouseScrollBy):
+
+2012-10-30  Rick Byers  <rbyers@chromium.org>
+
+        [touchadjustment] touch-links-longpress tests passes incorrectly
+        https://bugs.webkit.org/show_bug.cgi?id=96810
+
+        Reviewed by Antonio Gomes.
+
+        Add support for suppling width/height information for longpress
+        gesture (as for other gestures like tapDown) for the purposes
+        of touch adjustment.
+
+        * DumpRenderTree/chromium/TestRunner/src/EventSender.cpp:
+        (WebTestRunner):
+        (WebTestRunner::EventSender::gestureEvent):
+
+2012-10-29  Anders Carlsson  <andersca@apple.com>
+
+        Build WebKit as C++11 on Mac
+        https://bugs.webkit.org/show_bug.cgi?id=100720
+
+        Reviewed by Daniel Bates.
+
+        * DumpRenderTree/mac/Configurations/Base.xcconfig:
+        * MiniBrowser/Configurations/Base.xcconfig:
+        * TestWebKitAPI/Configurations/Base.xcconfig:
+        * WebKitTestRunner/Configurations/Base.xcconfig:
+        Add CLANG_CXX_LANGUAGE_STANDARD=gnu++0x.
+
+2012-10-30  Christophe Dumez  <christophe.dumez@intel.com>
+
+        [EFL][JHBUILD] Update EFL libraries to v1.7.1 stable release
+        https://bugs.webkit.org/show_bug.cgi?id=100759
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Update Bump EFL libraries to the new stable release (v1.7.1)
+        in JHBuild to pull the latest bug fixes.
+
+        * efl/jhbuild.modules:
+
+2012-10-29  Anders Carlsson  <andersca@apple.com>
+
+        String::createCFString should return a RetainPtr
+        https://bugs.webkit.org/show_bug.cgi?id=100419
+
+        Reviewed by Andreas Kling.
+
+        Update callers of String::createCFString.
+
+        * WebKitTestRunner/InjectedBundle/mac/InjectedBundlePageMac.mm:
+        (WTR::InjectedBundlePage::platformDidStartProvisionalLoadForFrame):
+
+2012-10-30  Mikhail Pozdnyakov  <mikhail.pozdnyakov@intel.com>
+
+        [WK2][WTR] WebKitTestRunner needs testRunner.queueLoadHTMLString
+        https://bugs.webkit.org/show_bug.cgi?id=100747
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Added testRunner.queueLoadHTMLString implementation.
+
+        * WebKitTestRunner/InjectedBundle/Bindings/TestRunner.idl:
+        * WebKitTestRunner/InjectedBundle/InjectedBundle.cpp:
+        (WTR::InjectedBundle::queueLoadHTMLString):
+        (WTR):
+        * WebKitTestRunner/InjectedBundle/InjectedBundle.h:
+        (InjectedBundle):
+        * WebKitTestRunner/InjectedBundle/TestRunner.cpp:
+        (WTR::TestRunner::queueLoadHTMLString):
+        (WTR):
+        * WebKitTestRunner/InjectedBundle/TestRunner.h:
+        (TestRunner):
+        * WebKitTestRunner/TestInvocation.cpp:
+        (WTR::TestInvocation::didReceiveMessageFromInjectedBundle):
+        * WebKitTestRunner/WorkQueueManager.cpp:
+        (WTR::WorkQueueManager::queueLoadHTMLString):
+        (WTR):
+        * WebKitTestRunner/WorkQueueManager.h:
+        (WorkQueueManager):
+
+2012-10-30  Kangil Han  <kangil.han@samsung.com>
+
+        [EFL] Baseline search path should consider both WK1 and WK2 on layout test.
+        https://bugs.webkit.org/show_bug.cgi?id=100755
+
+        Reviewed by Gyuyoung Kim.
+
+        Current implementation doesn't consider WK1 case in baseline search path.
+        Therefore, this patch fixes it.
+
+        * Scripts/webkitpy/layout_tests/port/efl.py:
+        (EflPort.default_baseline_search_path):
+
+2012-10-30  Mikhail Pozdnyakov  <mikhail.pozdnyakov@intel.com>
+
+        [QT][DRT] Remove unneeded testRunner.setMediaType() implementation
+        https://bugs.webkit.org/show_bug.cgi?id=100740
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Removed unneeded testRunner.setMediaType() implementation, as tests use
+        cross-platform window.internals.settings.setMediaTypeOverride instead.
+
+        * DumpRenderTree/qt/TestRunnerQt.cpp:
+        * DumpRenderTree/qt/TestRunnerQt.h:
+        (TestRunner):
+
+2012-10-30  Kangil Han  <kangil.han@samsung.com>
+
+        [EFL][DRT] Bitmap should show whole view area.
+        https://bugs.webkit.org/show_bug.cgi?id=100642
+
+        Reviewed by Gyuyoung Kim.
+
+        css sticky position test cases haven't been passed even though implementation has been landed by BUG 95182.
+        This is because current create bitmap implementation refers to geometry position that considers scroll movement even though
+        paint does it. Therefore, this patch always reflects current view size and remove duplicated graphic operation to dump correct bitmap image.
+
+        * DumpRenderTree/efl/PixelDumpSupportEfl.cpp:
+        (createBitmapContextFromWebView):
+
+2012-10-30  Jinwoo Song  <jinwoo7.song@samsung.com>
+
+        [EFL] Refactor tooltip callback signal in WebKit1
+        https://bugs.webkit.org/show_bug.cgi?id=100571
+
+        Reviewed by Gyuyoung Kim.
+
+        Separate tooltip callback signal into 'tooltip,text,set'
+        and 'tooltip,text,unset' to be consistent with WebKit2.
+
+        * EWebLauncher/main.c:
+        (on_tooltip_text_set):
+        (on_tooltip_text_unset):
+        (browserCreate):
+
+2012-10-29  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Unreviewed, rolling out r132819.
+        http://trac.webkit.org/changeset/132819
+        https://bugs.webkit.org/show_bug.cgi?id=100388
+
+        It made layout testing 40% slower and storage tests assert
+
+        * DumpRenderTree/qt/DumpRenderTreeQt.cpp:
+        (WebCore::DumpRenderTree::DumpRenderTree):
+        (WebCore::DumpRenderTree::resetToConsistentStateBeforeTesting):
+        (WebCore::DumpRenderTree::dump):
+        * DumpRenderTree/qt/DumpRenderTreeQt.h:
+        (DumpRenderTree):
+        * DumpRenderTree/qt/TestRunnerQt.cpp:
+        (TestRunner::reset):
+        * DumpRenderTree/qt/TestRunnerQt.h:
+        (TestRunner):
+
+2012-10-29  Jochen Eisinger  <jochen@chromium.org>
+
+        [chromium] TestRunner needs to compile ChromiumCurrentTime and ChromiumThreading in components build
+        https://bugs.webkit.org/show_bug.cgi?id=100658
+
+        Reviewed by Tony Chang.
+
+        Before, this was compiled into DumpRenderTree. I also dropped the
+        include_dirs and dependencies block as TestRunner already has them.
+
+        * DumpRenderTree/DumpRenderTree.gyp/DumpRenderTree.gyp:
+
+2012-10-29  Takashi Sakamoto  <tasak@google.com>
+
+        Unreviewed. Adding myself as a committer.
+
+        * Scripts/webkitpy/common/config/committers.py:
+
+2012-10-28  Mark Rowe  <mrowe@apple.com>
+
+        Simplify Xcode configuration settings that used to vary between OS versions.
+
+        Reviewed by Dan Bernstein.
+
+        * DumpRenderTree/mac/Configurations/Base.xcconfig:
+        * DumpRenderTree/mac/Configurations/DebugRelease.xcconfig:
+        * MiniBrowser/Configurations/Base.xcconfig:
+        * MiniBrowser/Configurations/DebugRelease.xcconfig:
+        * TestWebKitAPI/Configurations/Base.xcconfig:
+        * TestWebKitAPI/Configurations/DebugRelease.xcconfig:
+        * WebKitTestRunner/Configurations/Base.xcconfig:
+        * WebKitTestRunner/Configurations/DebugRelease.xcconfig:
+
+2012-10-28  Mark Rowe  <mrowe@apple.com>
+
+        Remove references to unsupported OS and Xcode versions.
+
+        Reviewed by Anders Carlsson.
+
+        * DumpRenderTree/DumpRenderTree.xcodeproj/project.pbxproj:
+        * DumpRenderTree/mac/Configurations/Base.xcconfig:
+        * DumpRenderTree/mac/Configurations/CompilerVersion.xcconfig: Removed.
+        * DumpRenderTree/mac/Configurations/DebugRelease.xcconfig:
+        * MiniBrowser/Configurations/Base.xcconfig:
+        * MiniBrowser/Configurations/CompilerVersion.xcconfig: Removed.
+        * MiniBrowser/Configurations/DebugRelease.xcconfig:
+        * TestWebKitAPI/Configurations/Base.xcconfig:
+        * TestWebKitAPI/Configurations/CompilerVersion.xcconfig: Removed.
+        * TestWebKitAPI/Configurations/DebugRelease.xcconfig:
+        * TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj:
+        * WebKitTestRunner/Configurations/Base.xcconfig:
+        * WebKitTestRunner/Configurations/CompilerVersion.xcconfig: Removed.
+        * WebKitTestRunner/Configurations/DebugRelease.xcconfig:
+        * WebKitTestRunner/WebKitTestRunner.xcodeproj/project.pbxproj:
+
+2012-10-26  Dirk Pranke  <dpranke@chromium.org>
+
+        webkitpy: change non-verbose log format for webkit-patch
+        https://bugs.webkit.org/show_bug.cgi?id=100561
+
+        Reviewed by Ojan Vafai.
+
+        Logging the module name and the log level is annoying and nearly useless.
+        For starters, this change removes that unless you are doing verbose/
+        debug logging. In the future we should split out the concepts of
+        verbose and debug logging (like we did in test-webkitpy and
+        run-webkit-tests) so that you could get this in debug logging.
+
+        * Scripts/webkitpy/common/system/logutils.py:
+        (_default_handlers):
+        (configure_logging):
+        * Scripts/webkitpy/common/system/logutils_unittest.py:
+        (ConfigureLoggingTest.test_info_message):
+        (ConfigureLoggingTest):
+        (ConfigureLoggingTest.test_debug_message):
+        (ConfigureLoggingTest.test_two_messages):
+        (ConfigureLoggingVerboseTest):
+        (ConfigureLoggingVerboseTest._logging_level):
+        (ConfigureLoggingVerboseTest.test_info_message):
+        (ConfigureLoggingVerboseTest.test_debug_message):
+        (ConfigureLoggingCustomLevelTest.test_logged_message):
+
+2012-10-29  Christophe Dumez  <christophe.dumez@intel.com>
+
+        [CMAKE] Add TestNetscapePlugIn/Tests/NPRuntimeCallsWithNullNPP.cpp to CMakeLists.txt
+        https://bugs.webkit.org/show_bug.cgi?id=100681
+
+        Reviewed by Anders Carlsson.
+
+        Add TestNetscapePlugIn/Tests/NPRuntimeCallsWithNullNPP.cpp to CMake since
+        it is needed by plugins/npruntime/npruntime-calls-with-null-npp.html
+        layout test.
+
+        * DumpRenderTree/TestNetscapePlugIn/CMakeLists.txt:
+
+2012-10-29  Allan Sandfeld Jensen  <allan.jensen@digia.com>
+
+        [Qt] Flaky security tests
+        https://bugs.webkit.org/show_bug.cgi?id=100388
+
+        Reviewed by Jocelyn Turcotte.
+
+        Disable text dumping and load a blank URL to ensure the documentLoader is cleared 
+        before we start dumping text for the new page. Otherwise messages from the old page
+        may end up in the text output of the new test.
+
+        This matches what WebKitTestRunner does, and reuses the Qt code for waiting for flag.
+
+        * DumpRenderTree/qt/DumpRenderTreeQt.cpp:
+        (WebCore::DumpRenderTree::DumpRenderTree):
+        (WebCore::runUntil):
+        (WebCore::DumpRenderTree::resetToConsistentStateBeforeTesting):
+        (WebCore::DumpRenderTree::finishedResetting):
+        (WebCore::DumpRenderTree::dump):
+        * DumpRenderTree/qt/DumpRenderTreeQt.h:
+        (DumpRenderTree):
+        * DumpRenderTree/qt/TestRunnerQt.cpp:
+        (TestRunner::resetDumping):
+        (TestRunner::reset):
+        * DumpRenderTree/qt/TestRunnerQt.h:
+        (TestRunner):
+
+2012-10-29  Christophe Dumez  <christophe.dumez@intel.com>
+
+        [WK2][WKTR] Enable Shadow DOM at runtime if compiled with SHADOW_DOM support
+        https://bugs.webkit.org/show_bug.cgi?id=100668
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Enable Shadow DOM functionality at run time in WebKitTestRunner
+        if compiled with SHADOW_DOM flag set. This is needed to run
+        the Shadow DOM layout tests.
+
+        * WebKitTestRunner/InjectedBundle/InjectedBundle.cpp:
+        (WTR::InjectedBundle::beginTesting):
+
+2012-10-29  Yael Aharon  <yael.aharon@intel.com>
+
+        [EFL][AC] Fix bugs preventing us from running layout tests with AC turned on
+        https://bugs.webkit.org/show_bug.cgi?id=100598
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Make sure to use opengl_x11 engine when AC is turned on and X11 is in use.
+        We cannot create a gl context otherwise.
+
+        * MiniBrowser/efl/main.c:
+        (elm_main):
+        * WebKitTestRunner/efl/PlatformWebViewEfl.cpp:
+        (WTR::initEcoreEvas):
+        * DumpRenderTree/efl/DumpRenderTree.cpp:
+        (initEcoreEvas):
+        * EWebLauncher/efl/main.c:
+        (windowCreate):
+
+2012-10-29  Raphael Kubo da Costa  <raphael.kubo.da.costa@intel.com>
+
+        [EFL][WK2] REGRESSION(r132342): fast/events/frame-tab-focus.html fails
+        https://bugs.webkit.org/show_bug.cgi?id=100646
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        * WebKitTestRunner/efl/PlatformWebViewEfl.cpp:
+        (WTR::PlatformWebView::focus): Improve the check we perform to
+        decide whether the focus should be taken out of the view before
+        focusing it again so that we do not unnecessarily unfocus it and
+        cause blur/focus events to be triggered. Instead of just verifying
+        if the Evas_Object representing the view has focus, use the WK C
+        API to check that the currently focused frame is not the main
+        frame.
+
+2012-10-29  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r132782.
+        http://trac.webkit.org/changeset/132782
+        https://bugs.webkit.org/show_bug.cgi?id=100653
+
+        It made 400+ tests fail and 180 tests flakey on Qt (Requested
+        by Ossy on #webkit).
+
+        * DumpRenderTree/qt/DumpRenderTreeQt.cpp:
+        (WebCore::DumpRenderTree::resetToConsistentStateBeforeTesting):
+
+2012-10-29  Allan Sandfeld Jensen  <allan.jensen@digia.com>
+
+        [Qt] Flaky security tests
+        https://bugs.webkit.org/show_bug.cgi?id=100388
+
+        Reviewed by Jocelyn Turcotte.
+
+        Disable text output and load a blank URL to ensure the documentLoader is cleared
+        before we start dumping text for the new page. Otherwise messages from the old page
+        may end up in the text output of the new test.
+
+        * DumpRenderTree/qt/DumpRenderTreeQt.cpp:
+        (WebCore::DumpRenderTree::resetToConsistentStateBeforeTesting):
+
+2012-10-29  Jochen Eisinger  <jochen@chromium.org>
+
+        [chromium] remove remaining usages of webkit_support from the TestRunner library
+        https://bugs.webkit.org/show_bug.cgi?id=100344
+
+        Reviewed by Adam Barth.
+
+        The most important part is to not rely on calling out to gdk/X11 to
+        translate keycodes to hardware keycodes, as this is not possible inside
+        the sandbox.
+
+        * DumpRenderTree/DumpRenderTree.gypi:
+        * DumpRenderTree/chromium/DRTTestRunner.h:
+        (WebKit):
+        (webkit_support):
+        * DumpRenderTree/chromium/TestRunner/public/WebTestDelegate.h:
+        (WebTestDelegate):
+        * DumpRenderTree/chromium/TestRunner/src/CppVariant.h:
+        * DumpRenderTree/chromium/TestRunner/src/EventSender.cpp:
+        (WebTestRunner):
+        (WebTestRunner::EventSender::doDragDrop):
+        (WebTestRunner::EventSender::updateClickCountForButton):
+        (WebTestRunner::EventSender::mouseDown):
+        (WebTestRunner::EventSender::mouseUp):
+        (WebTestRunner::EventSender::mouseMoveTo):
+        (WebTestRunner::EventSender::keyDown):
+        (WebTestRunner::EventSender::replaySavedEvents):
+        (WebTestRunner::EventSender::contextClick):
+        (WebTestRunner::EventSender::beginDragWithFiles):
+        (WebTestRunner::EventSender::sendCurrentTouchEvent):
+        (WebTestRunner::EventSender::handleMouseWheel):
+        (WebTestRunner::EventSender::gestureEvent):
+        (WebTestRunner::EventSender::gestureFlingCancel):
+        (WebTestRunner::EventSender::gestureFlingStart):
+        * DumpRenderTree/chromium/TestRunner/src/KeyCodeMapping.cpp: Added.
+        (WebTestRunner):
+        (WebTestRunner::NativeKeyCodeForWindowsKeyCode):
+        * DumpRenderTree/chromium/TestRunner/src/KeyCodeMapping.h: Copied from Tools/DumpRenderTree/chromium/TestRunner/src/TestRunner.h.
+        (WebTestRunner):
+        * DumpRenderTree/chromium/TestRunner/src/TestDelegate.h:
+        (TestDelegate):
+        * DumpRenderTree/chromium/TestRunner/src/TestRunner.cpp:
+        * DumpRenderTree/chromium/TestRunner/src/TestRunner.h:
+        * DumpRenderTree/chromium/TestRunner/src/WebTestInterfaces.cpp:
+        (WebTestInterfaces::Internal):
+        (WebTestRunner::WebTestInterfaces::Internal::getCurrentTimeInMillisecond):
+        (WebTestRunner):
+        (WebTestRunner::WebTestInterfaces::Internal::getAbsoluteWebStringFromUTF8Path):
+        * DumpRenderTree/chromium/WebViewHost.cpp:
+        (WebViewHost::getCurrentTimeInMillisecond):
+        (WebViewHost::getAbsoluteWebStringFromUTF8Path):
+        * DumpRenderTree/chromium/WebViewHost.h:
+        (WebViewHost):
+
+2012-10-29  Jonathan Dong  <jonathan.dong@torchmobile.com.cn>
+
+        Unreviewed. Add jonathan.dong@torchmobile.com.cn as a committer.
+        https://bugs.webkit.org/show_bug.cgi?id=100629
+
+        * Scripts/webkitpy/common/config/committers.py:
+
+2012-10-27  Dan Bernstein  <mitz@apple.com>
+
+        REAL_PLATFORM_NAME build setting is no longer needed
+        https://bugs.webkit.org/show_bug.cgi?id=100587
+
+        Reviewed by Mark Rowe.
+
+        Removed the definition of REAL_PLATFORM_NAME and replaced references to it with references
+        to PLATFORM_NAME.
+
+        * DumpRenderTree/mac/Configurations/Base.xcconfig:
+        * DumpRenderTree/mac/Configurations/CompilerVersion.xcconfig:
+        * DumpRenderTree/mac/Configurations/DebugRelease.xcconfig:
+        * MiniBrowser/Configurations/Base.xcconfig:
+        * MiniBrowser/Configurations/CompilerVersion.xcconfig:
+        * TestWebKitAPI/Configurations/Base.xcconfig:
+        * TestWebKitAPI/Configurations/CompilerVersion.xcconfig:
+        * WebKitTestRunner/Configurations/Base.xcconfig:
+        * WebKitTestRunner/Configurations/CompilerVersion.xcconfig:
+        * WebKitTestRunner/Configurations/DebugRelease.xcconfig:
+
+2012-10-26  Anders Carlsson  <andersca@apple.com>
+
+        Crash when making NPRuntime calls with a null NPP pointer
+        https://bugs.webkit.org/show_bug.cgi?id=100569
+
+        Reviewed by Darin Adler.
+
+        Add new NPRuntimeCallsWithNullNPP plug-in test.
+
+        * DumpRenderTree/DumpRenderTree.gypi:
+        * DumpRenderTree/DumpRenderTree.xcodeproj/project.pbxproj:
+        * DumpRenderTree/TestNetscapePlugIn/PluginTest.cpp:
+        (PluginTest::NPN_ReleaseVariantValue):
+        (PluginTest::netscapeFuncs):
+        * DumpRenderTree/TestNetscapePlugIn/PluginTest.h:
+        (PluginTest):
+        * DumpRenderTree/TestNetscapePlugIn/Tests/NPRuntimeCallsWithNullNPP.cpp: Added.
+        (NPRuntimeCallsWithNullNPP):
+        (NPRuntimeCallsWithNullNPP::NPRuntimeCallsWithNullNPP):
+        (NPRuntimeCallsWithNullNPP::NPP_New):
+        * DumpRenderTree/TestNetscapePlugIn/win/TestNetscapePlugin.vcproj:
+        * DumpRenderTree/qt/TestNetscapePlugin/TestNetscapePlugin.pro:
+        * GNUmakefile.am:
+
+2012-10-26  Dominic Mazzoni  <dmazzoni@google.com>
+
+        AX: Notification should be sent when accessibilityIsIgnored changes
+        https://bugs.webkit.org/show_bug.cgi?id=99547
+
+        Reviewed by Chris Fleizach.
+
+        Add additional accessibility notifications.
+
+        * DumpRenderTree/chromium/WebViewHost.cpp:
+        (WebViewHost::postAccessibilityNotification):
+
+2012-10-25  Roger Fong  <roger_fong@apple.com>
+
+        Get rid of (<X%) failing output for old-run-webkit-tests.
+        https://bugs.webkit.org/show_bug.cgi?id=100447
+
+        Reviewed by Jessie Berlin.
+
+        Not a particularly useful piece of information. It's pretty much never above 1%.
+        new-run-webkit-tests does not output this either.
+
+        * Scripts/old-run-webkit-tests:
+        (printResults):
+
+2012-10-26  Xianzhu Wang  <wangxianzhu@chromium.org>
+
+        Build bot gives incorrect link to EWS build failure
+        https://bugs.webkit.org/show_bug.cgi?id=100436
+
+        Reviewed by Adam Barth.
+
+        * Scripts/webkitpy/tool/bot/commitqueuetask_unittest.py:
+        (MockCommitQueue.__init__):
+        (MockCommitQueue.command_failed): Return incremental failure_status_id
+        (CommitQueueTaskTest.test_red_tree_patch_rejection): Check failure_status_id
+        * Scripts/webkitpy/tool/bot/patchanalysistask.py:
+        (PatchAnalysisTask._test_patch): Use the failure_status_id of test with patch when test without patch fails and test with patch has unexpected failures.
+
+2012-10-26  Raphael Kubo da Costa  <raphael.kubo.da.costa@intel.com>
+
+        webkitpy: Pass the `Listen' Apache directive from webkitpy, not the httpd.conf files.
+        https://bugs.webkit.org/show_bug.cgi?id=98602
+
+        Reviewed by Dirk Pranke.
+
+        Unify all the different `Listen' directives present in the several
+        httpd.conf files we have in LayoutTests/http/conf. For one, we
+        were already passing `Listen 127.0.0.1:8000' via webkitpy before,
+        and opening the other ports from the conf files.
+
+        The configuration files differed mostly in the way they handled
+        IPV6 ports. Some of them did not listen to IPV6 ports because the
+        systems which used them sometimes did not have IPV6 support. The
+        `http_server_supports_ipv6' method has been added to Port to
+        address that. cygwin, on its turn, still seems to use Apache 1.3,
+        which does not support IPV6 at all; the newly-added method has a
+        special case for that. Plus, perform a socket.getaddrinfo() call
+        the same way Apache itself does so we are sure we only enable IPV6
+        when setting that up in the httpd server is not going to fail.
+
+        * Scripts/webkitpy/common/system/platforminfo_mock.py:
+        (MockPlatformInfo.is_cygwin):
+        * Scripts/webkitpy/layout_tests/port/base.py:
+        (Port.baseline_version_dir):
+        (Port.to.start_websocket_server):
+        (Port.to):
+        (Port.to.http_server_supports_ipv6):
+        * Scripts/webkitpy/layout_tests/port/base_unittest.py:
+        (PortTest.test_http_server_supports_ipv6):
+        (PortTest.test_build_path):
+        * Scripts/webkitpy/layout_tests/servers/apache_http_server.py:
+        (LayoutTestApacheHttpd):
+        (LayoutTestApacheHttpd.__init__):
+
+2012-10-26  David Barton  <dbarton@mathscribe.com>
+
+        Unreviewed. Update my IRC nickname to a registered one.
+
+        * Scripts/webkitpy/common/config/committers.py:
+
+2012-10-26  Simon Hausmann  <simon.hausmann@digia.com>
 
         [Qt] Fix the LLInt build on Windows
         https://bugs.webkit.org/show_bug.cgi?id=97648
 
-        Reviewed by NOBODY (OOPS!).
+        Reviewed by Tor Arne Vestbø.
 
-        Added EXEEXT variable - similar to automake - that expands to .exe as suffix for
-        executable programs on Windows. Empty otherwise.
+        Added BIN_EXTENSION variable - similar to automake - that expands to .exe as suffix for
+        executable programs on Windows. Empty otherwise. Also added support for force_build_all
+        to allow overriding us disabling build_all for TEMPLATE = app.
 
         * qmake/mkspecs/features/default_pre.prf:
 
+2012-10-26  Xiaobo Wang  <xbwang@torchmobile.com.cn>
+
+        [BlackBerry] Support pixel tests for BlackBerry DRT
+        https://bugs.webkit.org/show_bug.cgi?id=100210
+
+        Reviewed by Rob Buis.
+
+        (The following 2 files are missed in previous patch(r132582), adding them
+        again.)
+
+        * DumpRenderTree/blackberry/build: Added.
+        * DumpRenderTree/blackberry/src.pro: Added.
+        Adds 2 files for building ImageDiff, by Christopher Wells.
+
+2012-10-26  Thiago Marcos P. Santos  <thiago.santos@intel.com>
+
+        Add feature flags for CSS Device Adaptation
+        https://bugs.webkit.org/show_bug.cgi?id=95960
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        * Scripts/webkitperl/FeatureList.pm:
+
+2012-10-26  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r132552.
+        http://trac.webkit.org/changeset/132552
+        https://bugs.webkit.org/show_bug.cgi?id=100486
+
+        Makes typeahead tests crash in debug. (Requested by pfeldman
+        on #webkit).
+
+        * DumpRenderTree/DumpRenderTree.gypi:
+        * DumpRenderTree/chromium/DRTTestRunner.h:
+        * DumpRenderTree/chromium/TestRunner/public/WebTestDelegate.h:
+        (WebTestDelegate):
+        * DumpRenderTree/chromium/TestRunner/src/CppVariant.h:
+        * DumpRenderTree/chromium/TestRunner/src/EventSender.cpp:
+        (WebTestRunner):
+        (WebTestRunner::EventSender::doDragDrop):
+        (WebTestRunner::EventSender::updateClickCountForButton):
+        (WebTestRunner::EventSender::mouseDown):
+        (WebTestRunner::EventSender::mouseUp):
+        (WebTestRunner::EventSender::mouseMoveTo):
+        (WebTestRunner::EventSender::keyDown):
+        (WebTestRunner::EventSender::replaySavedEvents):
+        (WebTestRunner::EventSender::contextClick):
+        (WebTestRunner::EventSender::beginDragWithFiles):
+        (WebTestRunner::EventSender::sendCurrentTouchEvent):
+        (WebTestRunner::EventSender::handleMouseWheel):
+        (WebTestRunner::EventSender::gestureEvent):
+        (WebTestRunner::EventSender::gestureFlingCancel):
+        (WebTestRunner::EventSender::gestureFlingStart):
+        * DumpRenderTree/chromium/TestRunner/src/KeyCodeMapping.cpp: Removed.
+        * DumpRenderTree/chromium/TestRunner/src/KeyCodeMapping.h: Removed.
+        * DumpRenderTree/chromium/TestRunner/src/TestDelegate.h:
+        (TestDelegate):
+        * DumpRenderTree/chromium/TestRunner/src/TestRunner.cpp:
+        * DumpRenderTree/chromium/TestRunner/src/TestRunner.h:
+        (WebKit):
+        (webkit_support):
+        * DumpRenderTree/chromium/TestRunner/src/WebTestInterfaces.cpp:
+        (WebTestInterfaces::Internal):
+        * DumpRenderTree/chromium/WebViewHost.cpp:
+        * DumpRenderTree/chromium/WebViewHost.h:
+        (WebViewHost):
+
+2012-10-26  Xiaobo Wang  <xbwang@torchmobile.com.cn>
+
+        [BlackBerry] Support pixel tests for BlackBerry DRT
+        https://bugs.webkit.org/show_bug.cgi?id=100210
+
+        Reviewed by Rob Buis.
+
+        The implementation is based on the patch from Christopher Wells.
+
+        * DumpRenderTree/blackberry/DumpRenderTree.cpp:
+        (BlackBerry::WebKit::DumpRenderTree::DumpRenderTree):
+        (BlackBerry::WebKit::DumpRenderTree::runTest):
+        (BlackBerry::WebKit::DumpRenderTree::runCurrentTest):
+        (BlackBerry::WebKit::DumpRenderTree::resetToConsistentStateBeforeTesting):
+        (BlackBerry::WebKit::DumpRenderTree::runTests):
+        (BlackBerry::WebKit::DumpRenderTree::dump):
+        * DumpRenderTree/blackberry/DumpRenderTreeBlackBerry.h:
+        (DumpRenderTree):
+
+        * DumpRenderTree/blackberry/PNGImageEncoder.cpp:
+        (BGRAtoRGBA):
+        (encodeBitmapToPNG):
+        * DumpRenderTree/blackberry/PNGImageEncoder.h:
+        The changes to PNGImageEncoder files are from master_40, patched by Tyler
+        Abbott and Rob Buis.
+
+        * DumpRenderTree/blackberry/PixelDumpSupportBlackBerry.cpp:
+        (createBitmapContextFromWebView):
+        (computeMD5HashStringForBitmapContext):
+        (printPNG):
+        (dumpBitmap):
+        * DumpRenderTree/blackberry/PixelDumpSupportBlackBerry.h:
+        (BitmapContext::createByAdoptingData):
+        (BitmapContext::~BitmapContext):
+        (BitmapContext):
+        (BitmapContext::BitmapContext):
+
+        * DumpRenderTree/blackberry/build: Added.
+        * DumpRenderTree/blackberry/src.pro: Added.
+        Adds 2 files for building ImageDiff, by Christopher Wells.
+
+2012-10-25  Min Qin  <qinmin@chromium.org>
+
+        Fix a layout test crash if a TestWebkitPlugin is put inside an iframe
+        https://bugs.webkit.org/show_bug.cgi?id=100406
+
+        Reviewed by Adam Barth.
+
+        Resize the context with an empty rect will cause a gl_error in gles2_cmd_decoder.cc.
+        Don't paint the plugin if m_rect is empty.
+
+        * DumpRenderTree/chromium/TestWebPlugin.cpp:
+        (TestWebPlugin::updateGeometry):
+
+2012-10-25  Jinwoo Song  <jinwoo7.song@samsung.com>
+
+        [EFL][WK2] Display tooltip in MiniBrowser
+        https://bugs.webkit.org/show_bug.cgi?id=99322
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Display tooltip in MiniBrowser using elm_object_tooltip_text_set().
+
+        * MiniBrowser/efl/main.c:
+        (on_tooltip_text_set):
+        (on_tooltip_text_unset):
+        (window_create):
+
+2012-10-25  Jochen Eisinger  <jochen@chromium.org>
+
+        [chromium] remove remaining usages of webkit_support from the TestRunner library
+        https://bugs.webkit.org/show_bug.cgi?id=100344
+
+        Reviewed by Adam Barth.
+
+        The most important part is to not rely on calling out to gdk/X11 to
+        translate keycodes to hardware keycodes, as this is not possible inside
+        the sandbox.
+
+        * DumpRenderTree/DumpRenderTree.gypi:
+        * DumpRenderTree/chromium/DRTTestRunner.h:
+        (WebKit):
+        (webkit_support):
+        * DumpRenderTree/chromium/TestRunner/public/WebTestDelegate.h:
+        (WebTestDelegate):
+        * DumpRenderTree/chromium/TestRunner/src/CppVariant.h:
+        * DumpRenderTree/chromium/TestRunner/src/EventSender.cpp:
+        (WebTestRunner):
+        (WebTestRunner::EventSender::doDragDrop):
+        (WebTestRunner::EventSender::updateClickCountForButton):
+        (WebTestRunner::EventSender::mouseDown):
+        (WebTestRunner::EventSender::mouseUp):
+        (WebTestRunner::EventSender::mouseMoveTo):
+        (WebTestRunner::EventSender::keyDown):
+        (WebTestRunner::EventSender::replaySavedEvents):
+        (WebTestRunner::EventSender::contextClick):
+        (WebTestRunner::EventSender::beginDragWithFiles):
+        (WebTestRunner::EventSender::sendCurrentTouchEvent):
+        (WebTestRunner::EventSender::handleMouseWheel):
+        (WebTestRunner::EventSender::gestureEvent):
+        (WebTestRunner::EventSender::gestureFlingCancel):
+        (WebTestRunner::EventSender::gestureFlingStart):
+        * DumpRenderTree/chromium/TestRunner/src/KeyCodeMapping.cpp: Added.
+        (WebTestRunner):
+        (WebTestRunner::NativeKeyCodeForWindowsKeyCode):
+        * DumpRenderTree/chromium/TestRunner/src/KeyCodeMapping.h: Copied from Tools/DumpRenderTree/chromium/TestRunner/src/TestRunner.h.
+        (WebTestRunner):
+        * DumpRenderTree/chromium/TestRunner/src/TestDelegate.h:
+        (TestDelegate):
+        * DumpRenderTree/chromium/TestRunner/src/TestRunner.cpp:
+        * DumpRenderTree/chromium/TestRunner/src/TestRunner.h:
+        * DumpRenderTree/chromium/TestRunner/src/WebTestInterfaces.cpp:
+        (WebTestInterfaces::Internal):
+        (WebTestRunner::WebTestInterfaces::Internal::getCurrentTimeInMillisecond):
+        (WebTestRunner):
+        (WebTestRunner::WebTestInterfaces::Internal::getAbsoluteWebStringFromUTF8Path):
+        * DumpRenderTree/chromium/WebViewHost.cpp:
+        (WebViewHost::getCurrentTimeInMillisecond):
+        (WebViewHost::getAbsoluteWebStringFromUTF8Path):
+        * DumpRenderTree/chromium/WebViewHost.h:
+        (WebViewHost):
+
+2012-10-25  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r132514.
+        http://trac.webkit.org/changeset/132514
+        https://bugs.webkit.org/show_bug.cgi?id=100440
+
+        "Broke chromium content_browsertests AccessibilityAriaMenu
+        AccessibilityInputRange AccessibilityListMarkers" (Requested
+        by scheib on #webkit).
+
+        * DumpRenderTree/chromium/WebViewHost.cpp:
+        (WebViewHost::postAccessibilityNotification):
+
+2012-10-25  Dirk Pranke  <dpranke@chromium.org>
+
+        rwt --lint-test-files doesn't handle the cascade properly
+        https://bugs.webkit.org/show_bug.cgi?id=100315
+
+        Reviewed by Ojan Vafai.
+
+        We were only linting the first file in each port's list of
+        expectations.
+
+        This change pushes more of the logic for linting files into
+        the TestExpectations classes themselves, but it's still a bit of
+        a hack. A better solution will require splitting out the actual
+        parsing of the files from the TestExpectations constructor.
+
+        * Scripts/webkitpy/layout_tests/models/test_expectations.py:
+        (TestExpectations):
+        (TestExpectations.__init__):
+        * Scripts/webkitpy/layout_tests/models/test_expectations_unittest.py:
+        (parse_exp):
+        (SkippedTests.check):
+        * Scripts/webkitpy/layout_tests/run_webkit_tests.py:
+        (lint):
+        * Scripts/webkitpy/layout_tests/run_webkit_tests_integrationtest.py:
+        (LintTest.test_all_configurations.FakePort.__init__):
+        (LintTest.test_all_configurations):
+        (LintTest.test_lint_test_files__errors):
+        * Scripts/webkitpy/style/checkers/test_expectations.py:
+        (TestExpectationsChecker.check_test_expectations):
+
+2012-10-25  Zan Dobersek  <zandobersek@gmail.com>
+
+        Unreviewed GTK gardening.
+
+        Skipping the atspi-basic-hierarchy test case in the TestWebKitAccessibility
+        WebKit2 API test since the test is currently failing.
+
+        * Scripts/run-gtk-tests:
+        (TestRunner):
+
+2012-10-25  Dominic Mazzoni  <dmazzoni@google.com>
+
+        AX: Notification should be sent when accessibilityIsIgnored changes
+        https://bugs.webkit.org/show_bug.cgi?id=99547
+
+        Reviewed by Chris Fleizach.
+
+        Add additional accessibility notifications.
+
+        * DumpRenderTree/chromium/WebViewHost.cpp:
+        (WebViewHost::postAccessibilityNotification):
+
+2012-10-25  Dominik Röttsches  <dominik.rottsches@intel.com>
+
+        Conditionalize XHR timeout support
+        https://bugs.webkit.org/show_bug.cgi?id=100356
+
+        Reviewed by Adam Barth.
+
+        Adding XHR_TIMEOUT feature in perl and qmake files.
+
+        * Scripts/webkitperl/FeatureList.pm:
+        * qmake/mkspecs/features/features.pri:
+
+2012-10-25  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Unreviewed. Update my contact info.
+
+        * Scripts/webkitpy/common/config/committers.py:
+
+2012-10-25  Terry Anderson  <tdanderson@chromium.org>
+
+        Unreviewed. Adding myself as a committer.
+
+        * Scripts/webkitpy/common/config/committers.py:
+
+2012-10-25  Zeno Albisser  <zeno@webkit.org>
+
+        [Qt] Adjust library name in webkitdirs.pm after r131300.
+        https://bugs.webkit.org/show_bug.cgi?id=100376
+
+        The library was renamed from QtWebKit to QtWebKitWidgets.
+        run-launcher was still looking for QtWebKit.
+
+        Reviewed by Simon Hausmann.
+
+        * Scripts/webkitdirs.pm:
+        (builtDylibPathForName):
+
+2012-10-22  Mikhail Naganov  <mnaganov@chromium.org>
+
+        [Chromium] Add supportMultipleWindows setting, needed for Android
+        https://bugs.webkit.org/show_bug.cgi?id=99716
+
+        Reviewed by Adam Barth.
+
+        Add supportMultipleWindows settings for reusing the same view when
+        opening popups. This is required for emulating the behavior of
+        Android WebView. Adding into WebCore, as other ports might want to
+        use this setting in the future.
+
+        * DumpRenderTree/chromium/DRTTestRunner.cpp:
+        (DRTTestRunner::overridePreference):
+        * DumpRenderTree/chromium/WebPreferences.cpp:
+        (WebPreferences::reset):
+        (WebPreferences::applyTo):
+        * DumpRenderTree/chromium/WebPreferences.h:
+        (WebPreferences):
+
+2012-10-25  Sudarsana Nagineni  <sudarsana.nagineni@intel.com>
+
+        [EFL][WK2] JavaScript popups are not focused when opened
+        https://bugs.webkit.org/show_bug.cgi?id=100354
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Move focus to the JavaScript popups when opened so that the key events
+        are forwarded to the popups instead of web view.
+
+        * MiniBrowser/efl/main.c:
+        (on_javascript_alert):
+        (on_javascript_confirm):
+        (on_javascript_prompt):
+
+2012-10-25  Eugene Klyuchnikov  <eustas.bug@gmail.com>
+
+        Web Inspector: Fix "check-inspector-strings" script and fix localized strings.
+        https://bugs.webkit.org/show_bug.cgi?id=100090
+
+        Reviewed by Vsevolod Vlasov.
+
+        Script "check-inspector-strings" seems to be broken.
+        Fixed it, refined search algorithm.
+
+        * Scripts/check-inspector-strings: Fixed and refined.
+
+2012-10-24  Dirk Pranke  <dpranke@chromium.org>
+
+        nrwt: fix a couple of minor crashing issues under cygwin
+        https://bugs.webkit.org/show_bug.cgi?id=100309
+
+        Reviewed by Ojan Vafai.
+
+        Cygwin was crashing on a null object reference and then
+        an oserror in kill().
+
+        * Scripts/webkitpy/common/system/executive.py:
+        (Executive.kill_process):
+        * Scripts/webkitpy/layout_tests/port/server_process.py:
+        (ServerProcess.stop):
+
+2012-10-24  Dirk Pranke  <dpranke@chromium.org>
+
+        nrwt: truncate meter lines properly on windows
+        https://bugs.webkit.org/show_bug.cgi?id=100062
+
+        Reviewed by Tony Chang.
+
+        This change adds the code to figure out the terminal width
+        on windows (it was already there for Unixen) and moves it
+        to a platform-specific object.
+
+        * Scripts/webkitpy/common/system/platforminfo.py:
+        (PlatformInfo.terminal_width):
+        * Scripts/webkitpy/common/system/platforminfo_mock.py:
+        (MockPlatformInfo.total_bytes_memory):
+        (MockPlatformInfo):
+        (MockPlatformInfo.terminal_width):
+        * Scripts/webkitpy/layout_tests/views/metered_stream.py:
+        (MeteredStream.__init__):
+        (MeteredStream.number_of_columns):
+        (MeteredStream.flush):
+        * Scripts/webkitpy/layout_tests/views/printing.py:
+        (Printer.__init__):
+        (Printer._test_status_line):
+
+2012-10-24  Dirk Pranke  <dpranke@chromium.org>
+
+        tweak debug logging in webkit-patch optimize-baselines
+        https://bugs.webkit.org/show_bug.cgi?id=100294
+
+        Reviewed by Ojan Vafai.
+
+        This changes the logging to print out the baselines found
+        (and their checksums) even when we don't do anything.
+
+        * Scripts/webkitpy/common/checkout/baselineoptimizer.py:
+        (BaselineOptimizer.optimize):
+
+2012-10-24  Sailesh Agrawal  <sail@chromium.org>
+
+        Incorrect keycodes for numpad /, -, +, .
+        https://bugs.webkit.org/show_bug.cgi?id=99188
+
+        Reviewed by Tony Chang.
+
+        Add key mappings for all numpad keys.
+
+        * DumpRenderTree/mac/EventSendingController.mm:
+        (KeyMappingEntry):
+        (-[EventSendingController keyDown:withModifiers:withLocation:]): Added all numpad keys.
+
+2012-10-24  Dirk Pranke  <dpranke@chromium.org>
+
+        webkitpy: clean up references to Skipped files
+        https://bugs.webkit.org/show_bug.cgi?id=100045
+
+        Reviewed by Ojan Vafai.
+
+        Since they are no longer used or needed ...
+
+        * Scripts/webkitpy/layout_tests/port/apple.py:
+        (ApplePort._generate_all_test_configurations):
+        * Scripts/webkitpy/layout_tests/port/base.py:
+        (Port.skipped_layout_tests):
+        (Port.expectations_files):
+        (Port._wk2_port_name):
+        * Scripts/webkitpy/layout_tests/port/gtk.py:
+        (GtkPort):
+        * Scripts/webkitpy/layout_tests/port/mac_unittest.py:
+        (MacTest.test_default_timeout_ms):
+        * Scripts/webkitpy/layout_tests/port/port_testcase.py:
+        (test_expectations_files):
+        (test_expectations_files.platform_dirs):
+        * Scripts/webkitpy/layout_tests/port/qt.py:
+        (QtPort.__init__):
+
+2012-10-24  Jochen Eisinger  <jochen@chromium.org>
+
+        [chromium] Use include paths relative to Source/ in the TestRunner's public API
+        https://bugs.webkit.org/show_bug.cgi?id=100079
+
+        Reviewed by Adam Barth.
+
+        For a inside-chromium build, we usually don't add the WebKit API paths
+        as include paths, so including files by name only does not work.
+
+        Eventually we might want to move to a model where all includes are
+        relative to Source/, so we're using that here already now.
+
+        * DumpRenderTree/DumpRenderTree.gyp/DumpRenderTree.gyp:
+        * DumpRenderTree/chromium/TestRunner/public/WebEventSender.h:
+        * DumpRenderTree/chromium/TestRunner/public/WebTestDelegate.h:
+
+2012-10-24  Ojan Vafai  <ojan@chromium.org>
+
+        Show an error when there are no completed builds in the past 20 runs
+        https://bugs.webkit.org/show_bug.cgi?id=100266
+
+        Reviewed by Dimitri Glazkov.
+
+        Right now we get a cryptic JS error in the console when loading the gtk port. This at least gives an error in
+        the notification stream. We should probably tweak this UI to make it so we can make
+        errors in the notification stream stick out (e.g. make the text red).
+
+        We should also consider making the number of runs to load dynamic (e.g. if 20 runs don't work,
+        try 40).
+
+        * BuildSlaveSupport/build.webkit.org-config/public_html/TestFailures/scripts/garden-o-matic.js:
+        * BuildSlaveSupport/build.webkit.org-config/public_html/TestFailures/scripts/results.js:
+        * BuildSlaveSupport/build.webkit.org-config/public_html/TestFailures/scripts/results_unittests.js:
+
+2012-10-24  Ian Vollick  <vollick@chromium.org>
+
+        [chromium] Explicitly disable accelerated animations in DRT
+        https://bugs.webkit.org/show_bug.cgi?id=100241
+
+        Reviewed by Adrienne Walker.
+
+        Disable accelerated animations by default in DRT.        
+
+        * DumpRenderTree/chromium/DumpRenderTree.cpp:
+        (main):
+        * DumpRenderTree/chromium/TestShell.cpp:
+        (TestShell::setAcceleratedAnimationEnabled):
+        * DumpRenderTree/chromium/TestShell.h:
+        (TestShell):
+
+2012-10-24  Jocelyn Turcotte  <jocelyn.turcotte@digia.com>
+
+        [Qt] Move the QQuickWebViewExperimental pointer to QQuickWebViewPrivate
+        https://bugs.webkit.org/show_bug.cgi?id=100253
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        * WebKitTestRunner/qt/PlatformWebViewQt.cpp:
+        (WTR::WrapperWindow::handleStatusChanged):
+        Use QQuickWebView::experimental rather than creating a new instance.
+
+2012-10-24  Thiago Marcos P. Santos  <thiago.santos@intel.com>
+
+        [EFL] run-webkit-tests writes garbage on stderr when running on Xvfb
+        https://bugs.webkit.org/show_bug.cgi?id=100243
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        These errors generate noise on the reports and in some cases, like when
+        running perf tests, makes the test fail. By using Xext, we can add a
+        dummy handler to ignore these errors.
+
+        We could have added this handler on the top level EWK API, but that
+        would be intrusive and could override handlers defined by the user.
+
+        * WebKitTestRunner/PlatformEfl.cmake:
+        * WebKitTestRunner/efl/main.cpp:
+        (dummyExtensionErrorHandler):
+        (main):
+
+2012-10-24  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        Unreviewed. Fix the GTK+ build.
+
+        * TestWebKitAPI/GNUmakefile.am: Add GTK_FLAGS to
+        libTestWebKitAPIMain and webcore cflags to TestGtk.
+
+2012-10-24  Zeno Albisser  <zeno@webkit.org>
+
+        Implement GraphicsSurface for Windows.
+        https://bugs.webkit.org/show_bug.cgi?id=98147
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        * qmake/mkspecs/features/features.prf:
+                Activate GraphicsSurface on windows in case opengles2 (ANGLE)
+                is available in QT_CONFIG.
+
+2012-10-24  Raphael Kubo da Costa  <raphael.kubo.da.costa@intel.com>
+
+        [EFL][WK2] fast/repaint/delete-into-nested-block.html and fast/repaint/4776765.html are flaky
+        https://bugs.webkit.org/show_bug.cgi?id=100010
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Force the main view to receive focus even if Evas already
+        considers it to be focused.
+
+        It might happen that a different frame is focused by a page and
+        the focus change notification does not reach Evas. When another
+        test is run, the main frame is then not considered to be focused
+        by WebCore, and things such as focus rings are not drawn as
+        expected.
+
+        * WebKitTestRunner/efl/PlatformWebViewEfl.cpp:
+        (WTR::PlatformWebView::focus):
+
+2012-10-24  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r132333.
+        http://trac.webkit.org/changeset/132333
+        https://bugs.webkit.org/show_bug.cgi?id=100234
+
+        Crashes many tests on the EFL-WK2 bot. (Requested by rakuco on
+        #webkit).
+
+        * WebKitTestRunner/TestController.cpp:
+        (WTR::TestController::resetStateToConsistentValues):
+        * WebKitTestRunner/efl/TestControllerEfl.cpp:
+        (WTR::TestController::platformInitializeContext):
+
+2012-10-24  Dongwoo Joshua Im  <dw.im@samsung.com>
+
+        [GTK] Fix build break - undefined reference to 'gtk_init'
+        https://bugs.webkit.org/show_bug.cgi?id=100221
+
+        Unreviewed build fix.
+
+        GTK_LIBS is needed for TestWTF.
+
+        * TestWebKitAPI/GNUmakefile.am:
+
+2012-10-24  Grzegorz Czajkowski  <g.czajkowski@samsung.com>
+
+        WebKitTestRunner needs to turn on 'setContinuousSpellCheckingEnabled'
+        https://bugs.webkit.org/show_bug.cgi?id=93611
+
+        Reviewed by Hajime Morita.
+
+        WebKitTestRunner enables spelling feature to pass the layout tests from editing/spelling.
+
+        * WebKitTestRunner/TestController.cpp:
+        (WTR::TestController::resetStateToConsistentValues):
+        Enables spelling by WebKit2 C API.
+
+        * WebKitTestRunner/efl/TestControllerEfl.cpp:
+        (WTR::TestController::platformInitializeContext):
+        Attaches WKTextChecker's client and sets default language for WebKit2-EFL port.
+
+2012-10-24  Mario Sanchez Prada  <mario@webkit.org>
+
+        [WK2] [GTK] TestWebKitAccessibility is not being run
+        https://bugs.webkit.org/show_bug.cgi?id=100102
+
+        Reviewed by Carlos Garcia Campos.
+
+        Removed wrong early return in _start_accessibility_daemons().
+
+        * Scripts/run-gtk-tests:
+        (TestRunner._lookup_atspi2_binary): Removed wrong line.
+
+2012-10-24  Noel Gordon  <noel.gordon@gmail.com>
+
+        [chromium] Plumb DRT WebkitShouldRespectImageOrientation through to page settings 
+        https://bugs.webkit.org/show_bug.cgi?id=100197
+
+        Reviewed by Kent Tamura.
+
+        fast/images/exif-orientation.html and fast/images/exif-orientation-css.html require a DRT
+        WebkitShouldRespectImageOrientation preference.  Add the chromium implementation for this
+        preference and plumb it through to page settings.
+
+        * DumpRenderTree/chromium/DRTTestRunner.cpp:
+        (DRTTestRunner::overridePreference): Update the tests WebkitShouldRespectImageOrientation
+        setting in DRT prefs.
+        * DumpRenderTree/chromium/WebPreferences.cpp:
+        (WebPreferences::reset): Disable the preference before and after each test.
+        (WebPreferences::applyTo): Apply the preference to the page settings of each test.
+        * DumpRenderTree/chromium/WebPreferences.h:
+        (WebPreferences):
+
+2012-10-23  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        [GTK] TestWebKitAPI/TestWebKit2 and TestWebKitAPI/TestGtk link to the installed libs
+        https://bugs.webkit.org/show_bug.cgi?id=100134
+
+        Reviewed by Martin Robinson.
+
+        Do not share the LDADD variable among TestWTF, TestWebKit2 and
+        TestGtk.
+
+        * TestWebKitAPI/GNUmakefile.am:
+
+2012-10-23  Kihong Kwon  <kihong.kwon@samsung.com>
+
+        Unreviewed. Adding myself as committer.
+
+        * Scripts/webkitpy/common/config/committers.py:
+
+2012-10-23  Dan Bernstein  <mitz@apple.com>
+
+        Tools changes for <rdar://problem/2966974> [mac] Kerning and ligatures are not enabled by default
+        https://bugs.webkit.org/show_bug.cgi?id=100188
+
+        Reviewed by Sam Weinig.
+
+        Disable kerning and ligatures by default when running the tests.
+
+        * DumpRenderTree/mac/DumpRenderTree.mm:
+        (resetDefaultsToConsistentValues): Set a value of NO for the
+        WebKitKerningAndLigaturesEnabledByDefault user default.
+        * WebKitTestRunner/mac/main.mm:
+        (main): Register a value of NO for the WebKitKerningAndLigaturesEnabledByDefault user
+        default.
+
+2012-10-23  Simon Fraser  <simon.fraser@apple.com>
+
+        Allow tests to run with a tile cache, and optionally dump the tile cache via layerTreeAsText()
+        https://bugs.webkit.org/show_bug.cgi?id=100159
+
+        Reviewed by Tim Horton.
+
+        Make WebKitTestRunner use a WKView with a tile cache for tests run in a directory
+        whose path includes "tiled-drawing". It does this by passing around a WKDictionary 
+        of options, and if the current PlatformWebView doesn't support those options, it will
+        create a new one.
+
+        * WebKitTestRunner/PlatformWebView.h:
+        (PlatformWebView): Add a WKDictionaryRef options dictionary argument.
+        (WTR::PlatformWebView::viewSupportsOptions): Returns true if the view
+        supports the options in the WKDictionaryRef.
+        * WebKitTestRunner/TestController.cpp:
+        (WTR::TestController::initialize): Call createWebViewWithOptions() with
+        no options in the normal case.
+        (WTR::TestController::createWebViewWithOptions): Moved code into this fuction
+        so we can call it in two places.
+        (WTR::TestController::ensureViewSupportsOptions): If the current view
+        doesn't support the given options, throw it away and makea  new one that does.
+        * WebKitTestRunner/TestController.h:
+        * WebKitTestRunner/TestInvocation.cpp:
+        (WTR::shouldUseTiledDrawing): Return true if the directory contains "tiled-drawing".
+        (WTR::updateTiledDrawingForCurrentTest): Tell the TestController to check whether
+        the view supports the given options. No-op for non-Mac platforms.
+        (WTR::TestInvocation::invoke): Call updateTiledDrawingForCurrentTest().
+        * WebKitTestRunner/efl/PlatformWebViewEfl.cpp:
+        (WTR::PlatformWebView::PlatformWebView): New constructor parameter.
+        * WebKitTestRunner/gtk/PlatformWebViewGtk.cpp:
+        (WTR::PlatformWebView::PlatformWebView):  New constructor parameter.
+        * WebKitTestRunner/mac/PlatformWebViewMac.mm:
+        (-[TestRunnerWKView initWithFrame:contextRef:pageGroupRef:useTiledDrawing:]):
+        (-[TestRunnerWKView _shouldUseTiledDrawingArea]): Subclass the WKView so we can return
+        a custom value from this method.
+        (WTR::PlatformWebView::PlatformWebView):
+        (WTR::PlatformWebView::viewSupportsOptions):
+        * WebKitTestRunner/qt/PlatformWebViewQt.cpp:
+        (WTR::PlatformWebView::PlatformWebView): New constructor parameter.
+        * WebKitTestRunner/win/PlatformWebViewWin.cpp:
+        (WTR::PlatformWebView::PlatformWebView): New constructor parameter.
+
+2012-10-23  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r132276.
+        http://trac.webkit.org/changeset/132276
+        https://bugs.webkit.org/show_bug.cgi?id=100189
+
+        It broke the Qt-WK2 build intentionally (Requested by
+        Ossy_night on #webkit).
+
+        * WebKitTestRunner/PlatformWebView.h:
+        (PlatformWebView):
+        * WebKitTestRunner/TestController.cpp:
+        (WTR::TestController::initialize):
+        * WebKitTestRunner/TestController.h:
+        (TestController):
+        * WebKitTestRunner/TestInvocation.cpp:
+        (WTR):
+        (WTR::TestInvocation::invoke):
+        * WebKitTestRunner/efl/PlatformWebViewEfl.cpp:
+        (WTR::PlatformWebView::PlatformWebView):
+        * WebKitTestRunner/gtk/PlatformWebViewGtk.cpp:
+        (WTR::PlatformWebView::PlatformWebView):
+        * WebKitTestRunner/mac/PlatformWebViewMac.mm:
+        (WTR::PlatformWebView::PlatformWebView):
+        * WebKitTestRunner/qt/PlatformWebViewQt.cpp:
+        (WTR::PlatformWebView::PlatformWebView):
+        * WebKitTestRunner/win/PlatformWebViewWin.cpp:
+        (WTR::PlatformWebView::PlatformWebView):
+
+2012-10-23  Martin Robinson  <mrobinson@igalia.com>
+
+        [GTK][Soup] Implement the default authentication dialog via WebCoreSupport
+        https://bugs.webkit.org/show_bug.cgi?id=99351
+
+        Reviewed by Carlos Garcia Campos.
+
+        We no longer need to turn off the soup authentication dialog soup feature,
+        because it's not installed.
+
+        * DumpRenderTree/gtk/DumpRenderTree.cpp:
+        (setDefaultsToConsistentStateValuesForTesting): Don't turn off the feature any longer.
+
+2012-10-23  Simon Fraser  <simon.fraser@apple.com>
+
+        Allow tests to run with a tile cache, and optionally dump the tile cache via layerTreeAsText()
+        https://bugs.webkit.org/show_bug.cgi?id=100159
+
+        Reviewed by Tim Horton.
+
+        Make WebKitTestRunner use a WKView with a tile cache for tests run in a directory
+        whose path includes "tiled-drawing". It does this by passing around a WKDictionary 
+        of options, and if the current PlatformWebView doesn't support those options, it will
+        create a new one.
+
+        * WebKitTestRunner/PlatformWebView.h:
+        (PlatformWebView): Add a WKDictionaryRef options dictionary argument.
+        (WTR::PlatformWebView::viewSupportsOptions): Returns true if the view
+        supports the options in the WKDictionaryRef.
+        * WebKitTestRunner/TestController.cpp:
+        (WTR::TestController::initialize): Call createWebViewWithOptions() with
+        no options in the normal case.
+        (WTR::TestController::createWebViewWithOptions): Moved code into this fuction
+        so we can call it in two places.
+        (WTR::TestController::ensureViewSupportsOptions): If the current view
+        doesn't support the given options, throw it away and makea  new one that does.
+        * WebKitTestRunner/TestController.h:
+        * WebKitTestRunner/TestInvocation.cpp:
+        (WTR::shouldUseTiledDrawing): Return true if the directory contains "tiled-drawing".
+        (WTR::updateTiledDrawingForCurrentTest): Tell the TestController to check whether
+        the view supports the given options. No-op for non-Mac platforms.
+        (WTR::TestInvocation::invoke): Call updateTiledDrawingForCurrentTest().
+        * WebKitTestRunner/efl/PlatformWebViewEfl.cpp:
+        (WTR::PlatformWebView::PlatformWebView): New constructor parameter.
+        * WebKitTestRunner/gtk/PlatformWebViewGtk.cpp:
+        (WTR::PlatformWebView::PlatformWebView):  New constructor parameter.
+        * WebKitTestRunner/mac/PlatformWebViewMac.mm:
+        (-[TestRunnerWKView initWithFrame:contextRef:pageGroupRef:useTiledDrawing:]):
+        (-[TestRunnerWKView _shouldUseTiledDrawingArea]): Subclass the WKView so we can return
+        a custom value from this method.
+        (WTR::PlatformWebView::PlatformWebView):
+        (WTR::PlatformWebView::viewSupportsOptions):
+        * WebKitTestRunner/qt/PlatformWebViewQt.cpp:
+        (WTR::PlatformWebView::PlatformWebView): New constructor parameter.
+        * WebKitTestRunner/win/PlatformWebViewWin.cpp:
+        (WTR::PlatformWebView::PlatformWebView): New constructor parameter.
+
+2012-10-23  David Barton  <dbarton@mathscribe.com>
+
+        [MathML] Symbol font uses greek letters for roman ones on linux and Windows
+        https://bugs.webkit.org/show_bug.cgi?id=99921
+
+        Reviewed by Eric Seidel.
+
+        Enable the STIXSizeOneSym font for testing.
+
+        * DumpRenderTree/mac/DumpRenderTree.mm:
+        (allowedFontFamilySet):
+        * WebKitTestRunner/InjectedBundle/mac/ActivateFonts.mm:
+        (WTR::allowedFontFamilySet):
+
+2012-10-23  Tony Chang  <tony@chromium.org>
+
+        [chromium] Chromium window build system does not rebuild correctly when enabling/disabling a feature
+        https://bugs.webkit.org/show_bug.cgi?id=38926
+
+        Reviewed by Eric Seidel.
+
+        Remove hack for clobbering build when features.gypi changes. Now that
+        Chromium requires VS2010 or newer, this bug has gone away.
+
+        * Scripts/update-webkit:
+
+2012-10-23  Jochen Eisinger  <jochen@chromium.org>
+
+        [chromium] remove the const qualifier from WebTestDelegate::printMessage
+        https://bugs.webkit.org/show_bug.cgi?id=100082
+
+        Reviewed by Adam Barth.
+
+        There's no reason the method should be const, and indeed for
+        content_shell we want to send an IPC which is a non-const operation.
+
+        * DumpRenderTree/chromium/TestRunner/public/WebTestDelegate.h:
+        (WebTestDelegate):
+        * DumpRenderTree/chromium/TestRunner/src/TestDelegate.h:
+        (TestDelegate):
+        * DumpRenderTree/chromium/TestRunner/src/WebTestInterfaces.cpp:
+        (WebTestInterfaces::Internal):
+        (WebTestRunner::WebTestInterfaces::Internal::printMessage):
+        * DumpRenderTree/chromium/WebViewHost.cpp:
+        (WebViewHost::printMessage):
+        * DumpRenderTree/chromium/WebViewHost.h:
+        (WebViewHost):
+
+2012-10-23  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Add support for resolution media query
+        https://bugs.webkit.org/show_bug.cgi?id=99077
+
+        Reviewed by Antti Koivisto.
+
+        Add support for the RESOLUTION_MEDIA_QUERY feature flag.
+
+        * Scripts/webkitperl/FeatureList.pm:
+        * qmake/mkspecs/features/features.pri:
+
+2012-10-23  Bruno de Oliveira Abinader  <bruno.abinader@basyskom.com>
+
+        Adding myself to commiters.py
+        https://bugs.webkit.org/show_bug.cgi?id=100122
+
+        Unreviewed update to commiters.py.
+
+        * Scripts/webkitpy/common/config/committers.py:
+
+2012-10-23  Timothy Hatcher  <timothy@apple.com>
+
+        Unreviewed watchlist change to monitor Inspector IDLs.
+
+        * Scripts/webkitpy/common/config/watchlist:
+
+2012-10-23  Mikhail Pozdnyakov  <mikhail.pozdnyakov@intel.com>
+
+        [WK2] [WTR] WebKitTestRunner needs testRunner.queueForwardNavigation
+        https://bugs.webkit.org/show_bug.cgi?id=99700
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Implemented testRunner.queueForwardNavigation, made little refactoring in Work Queue
+        to obviate code duplication.
+
+        * WebKitTestRunner/InjectedBundle/Bindings/TestRunner.idl:
+        * WebKitTestRunner/InjectedBundle/InjectedBundle.cpp:
+        (WTR::InjectedBundle::queueBackNavigation):
+        (WTR):
+        (WTR::InjectedBundle::queueForwardNavigation):
+        * WebKitTestRunner/InjectedBundle/InjectedBundle.h:
+        (InjectedBundle):
+        * WebKitTestRunner/InjectedBundle/TestRunner.cpp:
+        (WTR::TestRunner::queueForwardNavigation):
+        (WTR):
+        * WebKitTestRunner/InjectedBundle/TestRunner.h:
+        (TestRunner):
+        * WebKitTestRunner/TestInvocation.cpp:
+        (WTR::TestInvocation::didReceiveMessageFromInjectedBundle):
+        * WebKitTestRunner/WorkQueueManager.cpp:
+        (NavigationItem):
+        (WTR::NavigationItem::NavigationItem):
+        (WTR::NavigationItem::invoke):
+        (WTR):
+        (WTR::WorkQueueManager::queueBackNavigation):
+        (WTR::WorkQueueManager::queueForwardNavigation):
+        * WebKitTestRunner/WorkQueueManager.h:
+        (WorkQueueManager):
+
 2012-10-23  Simon Hausmann  <simon.hausmann@digia.com>
 
         Unreviewed trivial Qt build fix: Fix build without USE_3D_GRAPHICS
diff --git a/Tools/DumpRenderTree/DumpRenderTree.gyp/DumpRenderTree.gyp b/Tools/DumpRenderTree/DumpRenderTree.gyp/DumpRenderTree.gyp
index a81284b0b..56aeab732 100644
--- a/Tools/DumpRenderTree/DumpRenderTree.gyp/DumpRenderTree.gyp
+++ b/Tools/DumpRenderTree/DumpRenderTree.gyp/DumpRenderTree.gyp
@@ -93,10 +93,12 @@
                 '<(DEPTH)',
                 '../chromium/TestRunner/public',
                 '../chromium/TestRunner/src',
+                '../../../Source',
             ],
             'direct_dependent_settings': {
                 'include_dirs': [
                     '../chromium/TestRunner/public',
+                    '../../../Source',
                 ],
             },
             'sources': [
@@ -114,6 +116,12 @@
                         '<(source_dir)/WebKit/chromium/public/gtk',
                     ],
                 }],
+                ['inside_chromium_build==1 and component=="shared_library"', {
+                    'sources': [
+                        '<(source_dir)/WebKit/chromium/src/ChromiumCurrentTime.cpp',
+                        '<(source_dir)/WebKit/chromium/src/ChromiumThreading.cpp',
+                    ],
+                }],
             ],
         },
         {
@@ -346,18 +354,6 @@
                         ['exclude', 'Android\\.cpp$'],
                     ],
                 }],
-                ['inside_chromium_build==1 and component=="shared_library"', {
-                    'sources': [
-                        '<(source_dir)/WebKit/chromium/src/ChromiumCurrentTime.cpp',
-                        '<(source_dir)/WebKit/chromium/src/ChromiumThreading.cpp',
-                    ],
-                    'include_dirs': [
-                        '<(source_dir)/WebKit/chromium/public',
-                    ],
-                    'dependencies': [
-                        '<(source_dir)/WTF/WTF.gyp/WTF.gyp:wtf',
-                    ],
-                }],
                 ['inside_chromium_build==0', {
                     'dependencies': [
                         '<(chromium_src_dir)/webkit/support/setup_third_party.gyp:third_party_headers',
diff --git a/Tools/DumpRenderTree/DumpRenderTree.gypi b/Tools/DumpRenderTree/DumpRenderTree.gypi
index 26722ece7..dd768d049 100644
--- a/Tools/DumpRenderTree/DumpRenderTree.gypi
+++ b/Tools/DumpRenderTree/DumpRenderTree.gypi
@@ -83,6 +83,8 @@
             'chromium/TestRunner/src/EventSender.h',
             'chromium/TestRunner/src/GamepadController.cpp',
             'chromium/TestRunner/src/GamepadController.h',
+            'chromium/TestRunner/src/KeyCodeMapping.cpp',
+            'chromium/TestRunner/src/KeyCodeMapping.h',
             'chromium/TestRunner/src/TestInterfaces.cpp',
             'chromium/TestRunner/src/TestInterfaces.h',
             'chromium/TestRunner/src/TextInputController.cpp',
@@ -110,6 +112,7 @@
             'TestNetscapePlugIn/Tests/GetURLWithJavaScriptURLDestroyingPlugin.cpp',
             'TestNetscapePlugIn/Tests/GetUserAgentWithNullNPPFromNPPNew.cpp',
             'TestNetscapePlugIn/Tests/NPPNewFails.cpp',
+            'TestNetscapePlugIn/Tests/NPRuntimeCallsWithNullNPP.cpp',
             'TestNetscapePlugIn/Tests/NPRuntimeObjectFromDestroyedPlugin.cpp',
             'TestNetscapePlugIn/Tests/NPRuntimeRemoveProperty.cpp',
             'TestNetscapePlugIn/Tests/NullNPPGetValuePointer.cpp',
diff --git a/Tools/DumpRenderTree/DumpRenderTree.xcodeproj/project.pbxproj b/Tools/DumpRenderTree/DumpRenderTree.xcodeproj/project.pbxproj
index 0c6b8049e..f35ebccdf 100644
--- a/Tools/DumpRenderTree/DumpRenderTree.xcodeproj/project.pbxproj
+++ b/Tools/DumpRenderTree/DumpRenderTree.xcodeproj/project.pbxproj
@@ -50,6 +50,7 @@
 		1AC77DCF120605B6005C19EF /* NPRuntimeRemoveProperty.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1AC77DCE120605B6005C19EF /* NPRuntimeRemoveProperty.cpp */; };
 		1ACF898D132EF41C00E915D4 /* NPDeallocateCalledBeforeNPShutdown.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1ACF898B132EF41C00E915D4 /* NPDeallocateCalledBeforeNPShutdown.cpp */; };
 		1AD4CB2212A6D1350027A7AF /* GetUserAgentWithNullNPPFromNPPNew.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1AD4CB2012A6D1350027A7AF /* GetUserAgentWithNullNPPFromNPPNew.cpp */; };
+		1AD8683F163B2FD000A28583 /* NPRuntimeCallsWithNullNPP.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1AD8683D163B2FD000A28583 /* NPRuntimeCallsWithNullNPP.cpp */; };
 		1AD9D2FE12028409001A70D1 /* PluginScriptableNPObjectInvokeDefault.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1AD9D2FD12028409001A70D1 /* PluginScriptableNPObjectInvokeDefault.cpp */; };
 		1AFF66BC137DEFD200791696 /* GetURLNotifyWithURLThatFailsToLoad.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1AFF66BB137DEA8300791696 /* GetURLNotifyWithURLThatFailsToLoad.cpp */; };
 		23BCB8900EA57623003C6289 /* OpenGL.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = 23BCB88F0EA57623003C6289 /* OpenGL.framework */; };
@@ -116,7 +117,6 @@
 		BC0E24E00E2D9451001B6BC2 /* AccessibilityUIElement.h in Headers */ = {isa = PBXBuildFile; fileRef = BC0E24DE0E2D9451001B6BC2 /* AccessibilityUIElement.h */; };
 		BC0E24E10E2D9451001B6BC2 /* AccessibilityUIElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC0E24DF0E2D9451001B6BC2 /* AccessibilityUIElement.cpp */; };
 		BC0E26150E2DA4C6001B6BC2 /* AccessibilityUIElementMac.mm in Sources */ = {isa = PBXBuildFile; fileRef = BC0E26140E2DA4C6001B6BC2 /* AccessibilityUIElementMac.mm */; };
-		BC0E24E00E2D9451001B6BC3 /* AccessibilityCommonMac.h in Headers */ = {isa = PBXBuildFile; fileRef = BC0E24DE0E2D9451001B6BC3 /* AccessibilityCommonMac.h */; };
 		BC0E26150E2DA4C6001B6BC3 /* AccessibilityCommonMac.mm in Sources */ = {isa = PBXBuildFile; fileRef = BC0E26140E2DA4C6001B6BC3 /* AccessibilityCommonMac.mm */; };
 		BC47412A0D038A4C0072B006 /* JavaScriptThreading.h in Headers */ = {isa = PBXBuildFile; fileRef = BC4741290D038A4C0072B006 /* JavaScriptThreading.h */; };
 		BC4741410D038A570072B006 /* JavaScriptThreadingPthreads.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC4741400D038A570072B006 /* JavaScriptThreadingPthreads.cpp */; };
@@ -262,6 +262,7 @@
 		1AC77DCE120605B6005C19EF /* NPRuntimeRemoveProperty.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = NPRuntimeRemoveProperty.cpp; sourceTree = "<group>"; };
 		1ACF898B132EF41C00E915D4 /* NPDeallocateCalledBeforeNPShutdown.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = NPDeallocateCalledBeforeNPShutdown.cpp; sourceTree = "<group>"; };
 		1AD4CB2012A6D1350027A7AF /* GetUserAgentWithNullNPPFromNPPNew.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = GetUserAgentWithNullNPPFromNPPNew.cpp; sourceTree = "<group>"; };
+		1AD8683D163B2FD000A28583 /* NPRuntimeCallsWithNullNPP.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = NPRuntimeCallsWithNullNPP.cpp; sourceTree = "<group>"; };
 		1AD9D2FD12028409001A70D1 /* PluginScriptableNPObjectInvokeDefault.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = PluginScriptableNPObjectInvokeDefault.cpp; sourceTree = "<group>"; };
 		1AFF66BB137DEA8300791696 /* GetURLNotifyWithURLThatFailsToLoad.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = GetURLNotifyWithURLThatFailsToLoad.cpp; sourceTree = "<group>"; };
 		23BCB88F0EA57623003C6289 /* OpenGL.framework */ = {isa = PBXFileReference; lastKnownFileType = wrapper.framework; name = OpenGL.framework; path = /System/Library/Frameworks/OpenGL.framework; sourceTree = "<absolute>"; };
@@ -325,13 +326,11 @@
 		BC0131D80C9772010087317D /* TestRunner.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = TestRunner.cpp; sourceTree = "<group>"; };
 		BC0131D90C9772010087317D /* TestRunner.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = TestRunner.h; sourceTree = "<group>"; };
 		BC0E24DE0E2D9451001B6BC2 /* AccessibilityUIElement.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = AccessibilityUIElement.h; sourceTree = "<group>"; };
-		BC0E24DE0E2D9451001B6BC3 /* AccessibilityCommonMac.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = mac/AccessibilityCommonMac.h; sourceTree = "<group>"; };
 		BC0E24DF0E2D9451001B6BC2 /* AccessibilityUIElement.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = AccessibilityUIElement.cpp; sourceTree = "<group>"; };
 		BC0E26140E2DA4C6001B6BC2 /* AccessibilityUIElementMac.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; name = AccessibilityUIElementMac.mm; path = mac/AccessibilityUIElementMac.mm; sourceTree = "<group>"; };
 		BC0E26140E2DA4C6001B6BC3 /* AccessibilityCommonMac.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; name = AccessibilityCommonMac.mm; path = mac/AccessibilityCommonMac.mm; sourceTree = "<group>"; };
 		BC4741290D038A4C0072B006 /* JavaScriptThreading.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JavaScriptThreading.h; sourceTree = "<group>"; };
 		BC4741400D038A570072B006 /* JavaScriptThreadingPthreads.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = JavaScriptThreadingPthreads.cpp; path = pthreads/JavaScriptThreadingPthreads.cpp; sourceTree = "<group>"; };
-		BC646A4B136905DE00B35DED /* CompilerVersion.xcconfig */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.xcconfig; name = CompilerVersion.xcconfig; path = mac/Configurations/CompilerVersion.xcconfig; sourceTree = "<group>"; };
 		BC9D90210C97472D0099A4A3 /* WorkQueue.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = WorkQueue.cpp; sourceTree = "<group>"; };
 		BC9D90220C97472E0099A4A3 /* WorkQueue.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = WorkQueue.h; sourceTree = "<group>"; };
 		BC9D90230C97472E0099A4A3 /* WorkQueueItem.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = WorkQueueItem.h; sourceTree = "<group>"; };
@@ -507,7 +506,7 @@
 				BC0E24DF0E2D9451001B6BC2 /* AccessibilityUIElement.cpp */,
 				BC0E24DE0E2D9451001B6BC2 /* AccessibilityUIElement.h */,
 				BC0E26140E2DA4C6001B6BC2 /* AccessibilityUIElementMac.mm */,
-				BC0E26140E2DA4C6001B6BC3 /* AccessibilityCommonMac.h */,
+				BC0E26140E2DA4C6001B6BC3 /* AccessibilityCommonMac.mm */,
 				BC0E26140E2DA4C6001B6BC3 /* AccessibilityCommonMac.mm */,
 				BCA18B360C9B021900114369 /* AppleScriptController.h */,
 				BCA18B370C9B021900114369 /* AppleScriptController.m */,
@@ -572,6 +571,7 @@
 				1ACF898B132EF41C00E915D4 /* NPDeallocateCalledBeforeNPShutdown.cpp */,
 				5113DE6615F6CBE5005EC8B3 /* NPPNewFails.cpp */,
 				C031182A134E4A2B00919757 /* NPPSetWindowCalledDuringDestruction.cpp */,
+				1AD8683D163B2FD000A28583 /* NPRuntimeCallsWithNullNPP.cpp */,
 				1A24BAA8120734EE00FBB059 /* NPRuntimeObjectFromDestroyedPlugin.cpp */,
 				1AC77DCE120605B6005C19EF /* NPRuntimeRemoveProperty.cpp */,
 				C0EC3C9B12787F0500939164 /* NullNPPGetValuePointer.cpp */,
@@ -681,7 +681,6 @@
 			isa = PBXGroup;
 			children = (
 				BCB281EE0CFA713D007E533E /* Base.xcconfig */,
-				BC646A4B136905DE00B35DED /* CompilerVersion.xcconfig */,
 				BCB282F40CFA7450007E533E /* DebugRelease.xcconfig */,
 				BCB281F00CFA713D007E533E /* DumpRenderTree.xcconfig */,
 				BCB283D80CFA7AFD007E533E /* ImageDiff.xcconfig */,
@@ -935,6 +934,7 @@
 				515C0CD015EE785700F5A613 /* LogNPPSetWindow.cpp in Sources */,
 				5113DE6715F6CBE5005EC8B3 /* NPPNewFails.cpp in Sources */,
 				51134C9916014FDC001AA513 /* InvokeDestroysPluginWithinNPP_New.cpp in Sources */,
+				1AD8683F163B2FD000A28583 /* NPRuntimeCallsWithNullNPP.cpp in Sources */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
diff --git a/Tools/DumpRenderTree/TestNetscapePlugIn/CMakeLists.txt b/Tools/DumpRenderTree/TestNetscapePlugIn/CMakeLists.txt
index 65a7427cd..384b5bfb0 100644
--- a/Tools/DumpRenderTree/TestNetscapePlugIn/CMakeLists.txt
+++ b/Tools/DumpRenderTree/TestNetscapePlugIn/CMakeLists.txt
@@ -16,6 +16,7 @@ SET(WebKitTestNetscapePlugin_SOURCES
     ${WEBKIT_TESTNETSCAPEPLUGIN_DIR}/Tests/NPDeallocateCalledBeforeNPShutdown.cpp
     ${WEBKIT_TESTNETSCAPEPLUGIN_DIR}/Tests/NPPNewFails.cpp
     ${WEBKIT_TESTNETSCAPEPLUGIN_DIR}/Tests/NPPSetWindowCalledDuringDestruction.cpp
+    ${WEBKIT_TESTNETSCAPEPLUGIN_DIR}/Tests/NPRuntimeCallsWithNullNPP.cpp
     ${WEBKIT_TESTNETSCAPEPLUGIN_DIR}/Tests/NPRuntimeObjectFromDestroyedPlugin.cpp
     ${WEBKIT_TESTNETSCAPEPLUGIN_DIR}/Tests/NPRuntimeRemoveProperty.cpp
     ${WEBKIT_TESTNETSCAPEPLUGIN_DIR}/Tests/NullNPPGetValuePointer.cpp
diff --git a/Tools/DumpRenderTree/TestNetscapePlugIn/PluginTest.cpp b/Tools/DumpRenderTree/TestNetscapePlugIn/PluginTest.cpp
index b884503af..c2195c5b1 100644
--- a/Tools/DumpRenderTree/TestNetscapePlugIn/PluginTest.cpp
+++ b/Tools/DumpRenderTree/TestNetscapePlugIn/PluginTest.cpp
@@ -223,6 +223,11 @@ bool PluginTest::NPN_RemoveProperty(NPObject* npObject, NPIdentifier propertyNam
     return browser->removeproperty(m_npp, npObject, propertyName);
 }
 
+void PluginTest::NPN_ReleaseVariantValue(NPVariant* variant)
+{
+    browser->releasevariantvalue(variant);
+}
+
 #ifdef XP_MACOSX
 bool PluginTest::NPN_ConvertPoint(double sourceX, double sourceY, NPCoordinateSpace sourceSpace, double *destX, double *destY, NPCoordinateSpace destSpace)
 {
@@ -257,6 +262,11 @@ void PluginTest::log(const char* format, ...)
     va_end(args);
 }
 
+NPNetscapeFuncs* PluginTest::netscapeFuncs()
+{
+    return browser;
+}
+
 void PluginTest::waitUntilDone()
 {
     executeScript("testRunner.waitUntilDone()");
diff --git a/Tools/DumpRenderTree/TestNetscapePlugIn/PluginTest.h b/Tools/DumpRenderTree/TestNetscapePlugIn/PluginTest.h
index ab64f2521..f8a9aaee3 100644
--- a/Tools/DumpRenderTree/TestNetscapePlugIn/PluginTest.h
+++ b/Tools/DumpRenderTree/TestNetscapePlugIn/PluginTest.h
@@ -90,6 +90,7 @@ public:
     NPObject* NPN_RetainObject(NPObject*);
     void NPN_ReleaseObject(NPObject*);
     bool NPN_RemoveProperty(NPObject*, NPIdentifier propertyName);
+    void NPN_ReleaseVariantValue(NPVariant*);
 
 #ifdef XP_MACOSX
     bool NPN_ConvertPoint(double sourceX, double sourceY, NPCoordinateSpace sourceSpace, double *destX, double *destY, NPCoordinateSpace destSpace);
@@ -125,6 +126,8 @@ protected:
 
     const std::string& identifier() const { return m_identifier; }
 
+    static NPNetscapeFuncs* netscapeFuncs();
+
     void waitUntilDone();
     void notifyDone();
 
diff --git a/Tools/DumpRenderTree/TestNetscapePlugIn/Tests/NPRuntimeCallsWithNullNPP.cpp b/Tools/DumpRenderTree/TestNetscapePlugIn/Tests/NPRuntimeCallsWithNullNPP.cpp
new file mode 100644
index 000000000..84e9714df
--- /dev/null
+++ b/Tools/DumpRenderTree/TestNetscapePlugIn/Tests/NPRuntimeCallsWithNullNPP.cpp
@@ -0,0 +1,66 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "PluginTest.h"
+
+class NPRuntimeCallsWithNullNPP : public PluginTest {
+public:
+    NPRuntimeCallsWithNullNPP(NPP npp, const std::string& identifier)
+        : PluginTest(npp, identifier)
+    {
+    }
+
+private:
+    virtual NPError NPP_New(NPMIMEType pluginType, uint16_t mode, int16_t argc, char* argn[], char* argv[], NPSavedData *saved)
+    {
+        NPObject* windowObject = 0;
+        if (NPN_GetValue(NPNVWindowNPObject, &windowObject) != NPERR_NO_ERROR || !windowObject)
+            return NPERR_GENERIC_ERROR;
+
+        NPIdentifier alertIdentifier = NPN_GetStringIdentifier("alert");
+        if (!PluginTest::netscapeFuncs()->hasmethod(0, windowObject, alertIdentifier)) {
+            NPN_ReleaseObject(windowObject);
+            return NPERR_GENERIC_ERROR;
+        }
+
+        NPIdentifier documentIdentifier = NPN_GetStringIdentifier("document");
+        NPVariant variant;
+        if (!PluginTest::netscapeFuncs()->getproperty(0, windowObject, documentIdentifier, &variant)) {
+            NPN_ReleaseObject(windowObject);
+            return NPERR_GENERIC_ERROR;
+        }
+        NPN_ReleaseVariantValue(&variant);
+
+        NPN_ReleaseObject(windowObject);
+
+        executeScript("document.getElementById('result').innerHTML = 'SUCCESS!'");
+        notifyDone();
+        return NPERR_NO_ERROR;
+    }
+};
+
+static PluginTest::Register<NPRuntimeCallsWithNullNPP> npRuntimeCallsWithNullNPP("npruntime-calls-with-null-npp");
+
+
diff --git a/Tools/DumpRenderTree/TestNetscapePlugIn/win/TestNetscapePlugin.vcproj b/Tools/DumpRenderTree/TestNetscapePlugIn/win/TestNetscapePlugin.vcproj
index 43229839f..86414e21f 100644
--- a/Tools/DumpRenderTree/TestNetscapePlugIn/win/TestNetscapePlugin.vcproj
+++ b/Tools/DumpRenderTree/TestNetscapePlugIn/win/TestNetscapePlugin.vcproj
@@ -434,6 +434,10 @@
 				>

 			</File>

 			<File

+				RelativePath="..\Tests\NPRuntimeCallsWithNullNPP.cpp"

+				>

+			</File>            

+			<File

 				RelativePath="..\Tests\NPRuntimeObjectFromDestroyedPlugin.cpp"

 				>

 			</File>

diff --git a/Tools/DumpRenderTree/blackberry/DumpRenderTree.cpp b/Tools/DumpRenderTree/blackberry/DumpRenderTree.cpp
index ebc5c396b..a62083fa9 100644
--- a/Tools/DumpRenderTree/blackberry/DumpRenderTree.cpp
+++ b/Tools/DumpRenderTree/blackberry/DumpRenderTree.cpp
@@ -66,7 +66,6 @@
 #include <wtf/NonCopyingSort.h>
 #include <wtf/OwnArrayPtr.h>
 #include <wtf/Vector.h>
-#include <wtf/text/CString.h>
 
 #define SDCARD_PATH "/developer"
 
@@ -154,7 +153,7 @@ DumpRenderTree::DumpRenderTree(BlackBerry::WebKit::WebPage* page)
     : m_gcController(0)
     , m_accessibilityController(0)
     , m_page(page)
-    , m_dumpPixels(false)
+    , m_enablePixelTests(getenv("pixelTests"))
     , m_waitToDumpWatchdogTimer(this, &DumpRenderTree::waitToDumpWatchdogTimerFired)
     , m_workTimer(this, &DumpRenderTree::processWork)
     , m_acceptsEditing(true)
@@ -175,10 +174,10 @@ DumpRenderTree::~DumpRenderTree()
     delete m_accessibilityController;
 }
 
-void DumpRenderTree::runTest(const String& url)
+void DumpRenderTree::runTest(const String& url, const String& imageHash)
 {
     mainFrame->loader()->stopForUserCancel();
-    resetToConsistentStateBeforeTesting();
+    resetToConsistentStateBeforeTesting(url, imageHash);
     if (shouldLogFrameLoadDelegates(url))
         gTestRunner->setDumpFrameLoadCallbacks(true);
     if (!runFromCommandLine) {
@@ -211,12 +210,18 @@ void DumpRenderTree::doneDrt()
 
 void DumpRenderTree::runCurrentTest()
 {
+    String imageHash = "";
+    int posSplitter = m_currentTest->find('?');
+    if (posSplitter > 1 && (unsigned)posSplitter < m_currentTest->length() - 1) {
+        imageHash = m_currentTest->substring(posSplitter + 1);
+        m_currentTest->truncate(posSplitter);
+    }
     if (isHTTPTest(m_currentTest->utf8().data())) {
         m_currentHttpTest = m_currentTest->utf8().data();
         m_currentHttpTest.remove(0, strlen(httpTestSyntax));
-        runTest(httpPrefixURL + m_currentHttpTest);
+        runTest(httpPrefixURL + m_currentHttpTest, imageHash);
     } else
-        runTest(kSDCLayoutTestsURI + *m_currentTest);
+        runTest(kSDCLayoutTestsURI + *m_currentTest, imageHash);
 }
 
 void DumpRenderTree::runRemainingTests()
@@ -245,12 +250,9 @@ void DumpRenderTree::runRemainingTests()
     runCurrentTest();
 }
 
-void DumpRenderTree::resetToConsistentStateBeforeTesting()
+void DumpRenderTree::resetToConsistentStateBeforeTesting(const String& url, const String& imageHash)
 {
-    if (isHTTPTest(m_currentTest->utf8().data()))
-        gTestRunner = TestRunner::create(String(httpPrefixURL + *m_currentTest).utf8().data(), "");
-    else
-        gTestRunner = TestRunner::create(String(kSDCLayoutTestsURI + *m_currentTest).utf8().data(), "");
+    gTestRunner = TestRunner::create(url.utf8().data(), imageHash.utf8().data());
 
     gTestRunner->setIconDatabaseEnabled(false);
 
@@ -335,7 +337,7 @@ void DumpRenderTree::runTests()
 
     mainFrame = DumpRenderTreeSupport::corePage(m_page)->mainFrame();
 
-    if (getenv("drtTestFile")) {
+    if (const char* testFile = getenv("drtTestFile")) {
         runFromCommandLine = true;
         addTest(testFile);
     } else {
@@ -371,12 +373,12 @@ String DumpRenderTree::dumpFramesAsText(WebCore::Frame* frame)
     if (frame->tree()->parent())
         s = String::format("\n--------\nFrame: '%s'\n--------\n", frame->tree()->uniqueName().string().utf8().data());
 
-    s += documentElement->innerText() + "\n";
+    s = s + documentElement->innerText() + "\n";
 
     if (gTestRunner->dumpChildFramesAsText()) {
         WebCore::FrameTree* tree = frame->tree();
         for (WebCore::Frame* child = tree->firstChild(); child; child = child->tree()->nextSibling())
-            s += dumpFramesAsText(child);
+            s = s + dumpFramesAsText(child);
     }
     return s;
 }
@@ -424,11 +426,11 @@ static String dumpHistoryItem(PassRefPtr<WebCore::HistoryItem> item, int indent,
 
     int start = 0;
     if (current) {
-        result += "curr->";
+        result = result + "curr->";
         start = 6;
     }
     for (int i = start; i < indent; i++)
-        result += " ";
+        result = result + " ";
 
     String url = item->urlString();
     if (url.contains("file://")) {
@@ -439,25 +441,25 @@ static String dumpHistoryItem(PassRefPtr<WebCore::HistoryItem> item, int indent,
         if (res.isEmpty())
             return result;
 
-        result += fileTestString;
-        result += res;
+        result = result + fileTestString;
+        result = result + res;
     } else
-        result += url;
+        result = result + url;
 
     String target = item->target();
     if (!target.isEmpty())
-        result += " (in frame \"" + target + "\")";
+        result = result + " (in frame \"" + target + "\")";
 
     if (item->isTargetItem())
-        result += "  **nav target**";
-    result += "\n";
+        result = result + "  **nav target**";
+    result = result + "\n";
 
     WebCore::HistoryItemVector children = item->children();
     // Must sort to eliminate arbitrary result ordering which defeats reproducible testing.
     nonCopyingSort(children.begin(), children.end(), historyItemCompare);
     unsigned resultSize = children.size();
     for (unsigned i = 0; i < resultSize; ++i)
-        result += dumpHistoryItem(children[i], indent + 4, false);
+        result = result + dumpHistoryItem(children[i], indent + 4, false);
 
     return result;
 }
@@ -474,16 +476,16 @@ static String dumpBackForwardListForWebView()
     bfList->backListWithLimit(maxItems, entries);
     unsigned resultSize = entries.size();
     for (unsigned i = 0; i < resultSize; ++i)
-        result += dumpHistoryItem(entries[i], 8, false);
+        result = result + dumpHistoryItem(entries[i], 8, false);
 
-    result += dumpHistoryItem(bfList->currentItem(), 8, true);
+    result = result + dumpHistoryItem(bfList->currentItem(), 8, true);
 
     bfList->forwardListWithLimit(maxItems, entries);
     resultSize = entries.size();
     for (unsigned i = 0; i < resultSize; ++i)
-        result += dumpHistoryItem(entries[i], 8, false);
+        result = result + dumpHistoryItem(entries[i], 8, false);
 
-    result += "===============================================\n";
+    result = result +  "===============================================\n";
 
     return result;
 }
@@ -504,15 +506,27 @@ void DumpRenderTree::dump()
     String data = dumpAsText ? dumpFramesAsText(mainFrame) : renderTreeDump();
 
     if (gTestRunner->dumpBackForwardList())
-        data += dumpBackForwardListForWebView();
+        data = data + dumpBackForwardListForWebView();
 
     String result = "Content-Type: " + resultMimeType + "\n" + data;
 
     dumpToFile(result);
-    if (m_dumpPixels && !dumpAsText && gTestRunner->generatePixelResults())
-        dumpWebViewAsPixelsAndCompareWithExpected(gTestRunner->expectedPixelHash());
 
     if (!runFromCommandLine) {
+        // signal end of text block
+        fputs("#EOF\n", stdout);
+
+        // There are two scenarios for dumping pixels:
+        // 1. When the test case explicitly asks for it by calling dumpAsText(true) with that extra true passed as a parameter value, from JavaScript
+        bool explicitPixelResults = gTestRunner->dumpAsText() && gTestRunner->generatePixelResults();
+        // 2. When the test case implicitly allows it by not calling dumpAsText() at all (with no parameters).
+        bool implicitPixelResults = !gTestRunner->dumpAsText();
+
+        // But only if m_enablePixelTests is set, to say that the user wants to run pixel tests at all.
+        bool generatePixelResults = m_enablePixelTests && (explicitPixelResults || implicitPixelResults);
+        if (generatePixelResults)
+            dumpWebViewAsPixelsAndCompareWithExpected(gTestRunner->expectedPixelHash());
+
         String crashFile = dumpFile + ".crash";
         unlink(crashFile.utf8().data());
 
@@ -617,7 +631,7 @@ void DumpRenderTree::didFinishDocumentLoadForFrame(WebCore::Frame* frame)
         if (gTestRunner->dumpFrameLoadCallbacks())
             printf("%s - didFinishDocumentLoadForFrame\n", drtFrameDescription(frame).utf8().data());
         else {
-            unsigned pendingFrameUnloadEvents = frame->domWindow()->pendingUnloadEventListeners();
+            unsigned pendingFrameUnloadEvents = frame->document()->domWindow()->pendingUnloadEventListeners();
             if (pendingFrameUnloadEvents)
                 printf("%s - has %u onunload handler(s)\n", drtFrameDescription(frame).utf8().data(), pendingFrameUnloadEvents);
         }
@@ -650,7 +664,7 @@ void DumpRenderTree::didReceiveTitleForFrame(const String& title, WebCore::Frame
         printf("%s - didReceiveTitle: %s\n", drtFrameDescription(frame).utf8().data(), title.utf8().data());
 
     if (gTestRunner->dumpTitleChanges())
-        printf("TITLE CHANGED: '%s'\n", title.utf8().data());
+        printf("TITLE CHANGED: %s\n", title.utf8().data());
 }
 
 // ChromeClient delegates.
@@ -677,10 +691,8 @@ void DumpRenderTree::addMessageToConsole(const String& message, unsigned lineNum
 
 void DumpRenderTree::runJavaScriptAlert(const String& message)
 {
-    if (!testDone) {
+    if (!testDone)
         printf("ALERT: %s\n", message.utf8().data());
-        fflush(stdout);
-    }
 }
 
 bool DumpRenderTree::runJavaScriptConfirm(const String& message)
@@ -753,12 +765,6 @@ void DumpRenderTree::didChangeSelection()
         printf("EDITING DELEGATE: webViewDidChangeSelection:%s\n", "WebViewDidChangeSelectionNotification");
 }
 
-bool DumpRenderTree::findString(const String& string, WebCore::FindOptions options)
-{
-    WebCore::Page* page = mainFrame ? mainFrame->page() : 0;
-    return page && page->findString(string, options);
-}
-
 bool DumpRenderTree::shouldBeginEditingInDOMRange(WebCore::Range* range)
 {
     if (!testDone && gTestRunner->dumpEditingCallbacks())
diff --git a/Tools/DumpRenderTree/blackberry/DumpRenderTreeBlackBerry.h b/Tools/DumpRenderTree/blackberry/DumpRenderTreeBlackBerry.h
index dfcf7c86c..daca112c9 100644
--- a/Tools/DumpRenderTree/blackberry/DumpRenderTreeBlackBerry.h
+++ b/Tools/DumpRenderTree/blackberry/DumpRenderTreeBlackBerry.h
@@ -23,11 +23,11 @@
 
 
 #include "DumpRenderTreeClient.h"
-#include "PlatformString.h"
 #include "Timer.h"
 #include <BlackBerryPlatformLayoutTest.h>
 #include <FindOptions.h>
 #include <wtf/Vector.h>
+#include <wtf/text/WTFString.h>
 
 namespace WebCore {
 class Credential;
@@ -94,7 +94,6 @@ public:
     void didEndEditing();
     void didChange();
     void didChangeSelection();
-    bool findString(const String&, WebCore::FindOptions);
     bool shouldBeginEditingInDOMRange(WebCore::Range*);
     bool shouldEndEditingInDOMRange(WebCore::Range*);
     bool shouldDeleteDOMRange(WebCore::Range*);
@@ -109,7 +108,7 @@ public:
     // BlackBerry::Platform::BlackBerryPlatformLayoutTestClient method
     virtual void addTest(const char* testFile);
 private:
-    void runTest(const String& url);
+    void runTest(const String& url, const String& imageHash);
     void runTests();
     void runCurrentTest();
 
@@ -124,7 +123,7 @@ private:
     void doneDrt();
     bool isHTTPTest(const String& test);
     String renderTreeDump() const;
-    void resetToConsistentStateBeforeTesting();
+    void resetToConsistentStateBeforeTesting(const String& url, const String& imageHash);
     void runRemainingTests();
     void invalidateAnyPreviousWaitToDumpWatchdog();
     void waitToDumpWatchdogTimerFired(WebCore::Timer<DumpRenderTree>*);
@@ -141,7 +140,7 @@ private:
     GCController* m_gcController;
     AccessibilityController* m_accessibilityController;
     WebPage* m_page;
-    bool m_dumpPixels;
+    bool m_enablePixelTests;
     WebCore::Timer<DumpRenderTree> m_waitToDumpWatchdogTimer;
     WebCore::Timer<DumpRenderTree> m_workTimer;
 
diff --git a/Tools/DumpRenderTree/blackberry/PNGImageEncoder.cpp b/Tools/DumpRenderTree/blackberry/PNGImageEncoder.cpp
index 22f202c90..bc4e7ab85 100644
--- a/Tools/DumpRenderTree/blackberry/PNGImageEncoder.cpp
+++ b/Tools/DumpRenderTree/blackberry/PNGImageEncoder.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2011 Research In Motion Limited. All rights reserved.
+ * Copyright (C) 2011, 2012 Research In Motion Limited. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Lesser General Public
@@ -21,8 +21,6 @@
 #include "config.h"
 #include "PNGImageEncoder.h"
 
-#include "SkBitmap.h"
-#include "SkUnPreMultiply.h"
 
 extern "C" {
 #include "png.h"
@@ -33,20 +31,16 @@ extern "C" {
 // This code is almost a mirror of the code in WebCore/platform/image-encoders/skia/PNGImageEncoder.cpp
 // since we can't include this private WebCore file in a WebKit-client application.
 
-// Converts BGRA->RGBA and RGBA->BGRA and undoes alpha premultiplication.
-static void preMultipliedBGRAtoRGBA(const unsigned char* input, int numberOfPixels, unsigned char* output)
+// Keep the premultipied for as it is the most faithful information
+static void BGRAtoRGBA(const unsigned char* input, int numberOfPixels, unsigned char* output)
 {
-    SkBitmap inputBitmap;
-    inputBitmap.setConfig(SkBitmap::kARGB_8888_Config, numberOfPixels, 1);
-    inputBitmap.setPixels(const_cast<unsigned char*>(input));
     for (int x = 0; x < numberOfPixels; x++) {
-        uint32_t srcPixel = *inputBitmap.getAddr32(x, 0);
-        SkColor unmultiplied = SkUnPreMultiply::PMColorToColor(srcPixel);
-        unsigned char* pixelOut = &output[x * 4];
-        pixelOut[0] = SkColorGetR(unmultiplied);
-        pixelOut[1] = SkColorGetG(unmultiplied);
-        pixelOut[2] = SkColorGetB(unmultiplied);
-        pixelOut[3] = SkColorGetA(unmultiplied);
+        output[0] = input[2];
+        output[1] = input[1];
+        output[2] = input[0];
+        output[3] = input[3];
+        input += 4;
+        output += 4;
     }
 }
 
@@ -130,8 +124,8 @@ static bool encodeImpl(const unsigned char* input, int imageWidth, int imageHeig
     png_set_write_fn(pngPtr, &state, encoderWriteCallback, 0);
 
     png_set_IHDR(pngPtr, infoPtr, imageWidth, imageHeight, 8, pngOutputColorType,
-                 PNG_INTERLACE_NONE, PNG_COMPRESSION_TYPE_DEFAULT,
-                 PNG_FILTER_TYPE_DEFAULT);
+        PNG_INTERLACE_NONE, PNG_COMPRESSION_TYPE_DEFAULT,
+        PNG_FILTER_TYPE_DEFAULT);
     png_write_info(pngPtr, infoPtr);
 
     OwnArrayPtr<unsigned char> rowPixels = adoptArrayPtr(new unsigned char[imageWidth * outputColorComponents]);
@@ -144,13 +138,8 @@ static bool encodeImpl(const unsigned char* input, int imageWidth, int imageHeig
     return true;
 }
 
-bool encodeSkBitmapToPNG(const SkBitmap& image, Vector<unsigned char>* output)
+bool encodeBitmapToPNG(unsigned char* data, int width, int height, Vector<unsigned char>* output)
 {
-    if (image.config() != SkBitmap::kARGB_8888_Config)
-        return false; // Only support ARGB at 8 bpp now.
-
-    image.lockPixels();
-    bool result = encodeImpl(static_cast<unsigned char*>(image.getPixels()), image.width(), image.height(), image.rowBytes(), output, preMultipliedBGRAtoRGBA);
-    image.unlockPixels();
+    bool result = encodeImpl(data, width, height, width * 4, output, BGRAtoRGBA);
     return result;
 }
diff --git a/Tools/DumpRenderTree/blackberry/PNGImageEncoder.h b/Tools/DumpRenderTree/blackberry/PNGImageEncoder.h
index 779f7a0f9..7a320a757 100644
--- a/Tools/DumpRenderTree/blackberry/PNGImageEncoder.h
+++ b/Tools/DumpRenderTree/blackberry/PNGImageEncoder.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2011 Research In Motion Limited. All rights reserved.
+ * Copyright (C) 2011, 2012 Research In Motion Limited. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Lesser General Public
@@ -21,8 +21,6 @@
 
 #include <wtf/Vector.h>
 
-class SkBitmap;
-
-bool encodeSkBitmapToPNG(const SkBitmap&, WTF::Vector<unsigned char>* output);
+bool encodeBitmapToPNG(unsigned char* data, int width, int height, WTF::Vector<unsigned char>* output);
 
 #endif // PNGImageEncoder_h
diff --git a/Tools/DumpRenderTree/blackberry/PixelDumpSupportBlackBerry.cpp b/Tools/DumpRenderTree/blackberry/PixelDumpSupportBlackBerry.cpp
index 0bb4a0c27..420cdfbb8 100644
--- a/Tools/DumpRenderTree/blackberry/PixelDumpSupportBlackBerry.cpp
+++ b/Tools/DumpRenderTree/blackberry/PixelDumpSupportBlackBerry.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2011 Research In Motion Limited. All rights reserved.
+ * Copyright (C) 2011, 2012 Research In Motion Limited. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Lesser General Public
@@ -19,6 +19,7 @@
 #include "config.h"
 #include "PixelDumpSupportBlackBerry.h"
 
+#include "BackingStore.h"
 #include "DumpRenderTreeBlackBerry.h"
 #include "PNGImageEncoder.h"
 #include "PixelDumpSupport.h"
@@ -26,7 +27,9 @@
 #include "WebPageClient.h"
 
 #include <BlackBerryPlatformWindow.h>
-#include <skia/SkDevice.h>
+#if USE(SKIA)
+#include <SkDevice.h>
+#endif
 #include <wtf/MD5.h>
 #include <wtf/Vector.h>
 
@@ -39,34 +42,52 @@ PassRefPtr<BitmapContext> createBitmapContextFromWebView(bool /*onscreen*/, bool
     Platform::Graphics::Window* window = DumpRenderTree::currentInstance()->page()->client()->window();
     ASSERT(window);
 
-    const Platform::IntRect& windowRect = window->viewportRect();
-
-    SkBitmap* bitmap = new SkBitmap;
-    bitmap->setConfig(SkBitmap::kARGB_8888_Config, windowRect.width(), windowRect.height()); // We use 32-bit RGBA since that is the pixel format that ImageDiff expects.
-    bitmap->allocPixels();
+    // The BackingStore has a queue of pending jobs, which are run on idle
+    // and which may not have been run yet.
+    BackingStore* backingStore = DumpRenderTree::currentInstance()->page()->backingStore();
+    while (backingStore->hasBlitJobs())
+        backingStore->blitOnIdle();
 
-    SkCanvas* canvas = new SkCanvas;
-    canvas->setBitmapDevice(*bitmap);
+    const Platform::IntRect& windowRect = window->viewportRect();
+    const Platform::IntSize& windowSize = window->viewportSize();
+    unsigned char* data = new unsigned char[windowSize.width() * windowSize.height() * 4];
 
     // We need to force a synchronous update to the window or we may get an empty bitmap.
     // For example, running DRT with one test case that finishes before the screen is updated.
     window->post(windowRect);
 
-    const SkBitmap* windowBitmap = static_cast<const SkBitmap*>(lockBufferBackingImage(window->buffer(), Platform::Graphics::ReadAccess));
-    canvas->drawBitmap(*windowBitmap, 0, 0); // Draw the bitmap at (0, 0).
+#if USE(SKIA)
+    SkBitmap bitmap;
+    bitmap.setConfig(SkBitmap::kARGB_8888_Config, windowSize.width(), windowSize.height());
+    bitmap.allocPixels();
+    bitmap.eraseARGB(0, 0, 0, 0);
+
+    SkCanvas canvas(bitmap);
+    backingStore->drawContents(&canvas, windowRect, windowSize);
+
+    // Read that SkBitmap rather than change it. So use false on accessBitmap.
+    const SkBitmap& contentsBitmap = canvas.getDevice()->accessBitmap(false/*changePixels*/);
+    contentsBitmap.lockPixels();
+
+    const unsigned char* windowPixels = 0;
+    if (!contentsBitmap.empty()) {
+        SkAutoLockPixels lock(contentsBitmap);
+        windowPixels = static_cast<const unsigned char*>(contentsBitmap.getPixels());
+    }
+#else
+    const unsigned char* windowPixels = lockBufferBackingImage(window->buffer(), Platform::Graphics::ReadAccess);
+#endif
+    memcpy(data, windowPixels, windowSize.width() * windowSize.height() * 4);
     Platform::Graphics::releaseBufferBackingImage(window->buffer());
-    return BitmapContext::createByAdoptingBitmapAndContext(bitmap, canvas);
+    return BitmapContext::createByAdoptingData(data, windowSize.width(), windowSize.height());
 }
 
 void computeMD5HashStringForBitmapContext(BitmapContext* context, char hashString[33])
 {
-    const SkBitmap& bitmap = context->canvas()->getDevice()->accessBitmap(false);
-    ASSERT(bitmap.bytesPerPixel() == 4); // 32-bit RGBA
-
-    int pixelsWide = bitmap.width();
-    int pixelsHigh = bitmap.height();
-    int bytesPerRow = bitmap.rowBytes();
-    unsigned char* pixelData = (unsigned char*)bitmap.getPixels();
+    int pixelsWide = context->m_width;
+    int pixelsHigh = context->m_height;
+    int bytesPerRow = context->m_width * 4;
+    unsigned char* pixelData = context->m_data;
 
     MD5 md5;
     for (int i = 0; i < pixelsHigh; ++i) {
@@ -82,14 +103,14 @@ void computeMD5HashStringForBitmapContext(BitmapContext* context, char hashStrin
         snprintf(hashString, 33, "%s%02x", hashString, hash[i]);
 }
 
-static void printPNG(SkCanvas* canvas, const char* checksum)
+static void printPNG(BitmapContext* context, const char* checksum)
 {
     Vector<unsigned char> pngData;
-    encodeSkBitmapToPNG(canvas->getDevice()->accessBitmap(false), &pngData);
+    encodeBitmapToPNG(context->m_data, context->m_width, context->m_height, &pngData);
     printPNG(pngData.data(), pngData.size(), checksum);
 }
 
 void dumpBitmap(BitmapContext* context, const char* checksum)
 {
-    printPNG(context->canvas(), checksum);
+    printPNG(context, checksum);
 }
diff --git a/Tools/DumpRenderTree/blackberry/PixelDumpSupportBlackBerry.h b/Tools/DumpRenderTree/blackberry/PixelDumpSupportBlackBerry.h
index e8ae786c7..87c6bf08a 100644
--- a/Tools/DumpRenderTree/blackberry/PixelDumpSupportBlackBerry.h
+++ b/Tools/DumpRenderTree/blackberry/PixelDumpSupportBlackBerry.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2011 Research In Motion Limited. All rights reserved.
+ * Copyright (C) 2011, 2012 Research In Motion Limited. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Lesser General Public
@@ -19,38 +19,34 @@
 #ifndef PixelDumpSupportBlackBerry_h
 #define PixelDumpSupportBlackBerry_h
 
-#include <skia/SkBitmap.h>
-#include <skia/SkCanvas.h>
+#include <stdio.h>
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefCounted.h>
 
 class BitmapContext : public RefCounted<BitmapContext> {
 public:
 
-    static PassRefPtr<BitmapContext> createByAdoptingBitmapAndContext(SkBitmap* bitmap, SkCanvas* canvas)
+    static PassRefPtr<BitmapContext> createByAdoptingData(unsigned char* data, int width, int height)
     {
-        return adoptRef(new BitmapContext(bitmap, canvas));
+        return adoptRef(new BitmapContext(data, width, height));
     }
 
     ~BitmapContext()
     {
-        delete m_bitmap;
-        delete m_canvas;
+        delete m_data;
     }
 
-    SkCanvas* canvas() { return m_canvas; }
+    unsigned char* m_data;
+    int m_width, m_height;
 
 private:
 
-    BitmapContext(SkBitmap* bitmap, SkCanvas* canvas)
-        : m_bitmap(bitmap)
-        , m_canvas(canvas)
+    BitmapContext(unsigned char* data, int width, int height)
+        : m_data(data)
+        , m_width(width)
+        , m_height(height)
     {
     }
-
-    SkBitmap* m_bitmap;
-    SkCanvas* m_canvas;
-
 };
 
 #endif // PixelDumpSupportBlackBerry_h
diff --git a/Tools/DumpRenderTree/blackberry/TestRunnerBlackBerry.cpp b/Tools/DumpRenderTree/blackberry/TestRunnerBlackBerry.cpp
index c9d013775..c80a96ddb 100644
--- a/Tools/DumpRenderTree/blackberry/TestRunnerBlackBerry.cpp
+++ b/Tools/DumpRenderTree/blackberry/TestRunnerBlackBerry.cpp
@@ -1,6 +1,5 @@
 /*
  * Copyright (C) 2009, 2010, 2012 Research In Motion Limited. All rights reserved.
- * Copyright (C) 2012 Apple Inc. All Rights Reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Lesser General Public
@@ -20,7 +19,6 @@
 #include "config.h"
 #include "TestRunner.h"
 
-#include "CString.h"
 #include "DatabaseTracker.h"
 #include "Document.h"
 #include "DocumentLoader.h"
@@ -36,14 +34,12 @@
 #include "JSElement.h"
 #include "KURL.h"
 #include "NotImplemented.h"
-#include "OwnArrayPtr.h"
 #include "Page.h"
 #include "RenderTreeAsText.h"
 #include "SchemeRegistry.h"
 #include "SecurityOrigin.h"
 #include "SecurityPolicy.h"
 #include "Settings.h"
-#include "UnusedParam.h"
 #include "WorkQueue.h"
 #include "WorkQueueItem.h"
 #include "WorkerThread.h"
@@ -53,6 +49,10 @@
 #include <WebPage.h>
 #include <WebSettings.h>
 
+#include <wtf/OwnArrayPtr.h>
+#include <wtf/UnusedParam.h>
+#include <wtf/text/CString.h>
+
 using WebCore::toElement;
 using WebCore::toJS;
 
@@ -452,10 +452,10 @@ void TestRunner::setMockGeolocationPosition(double latitude, double longitude, d
     DumpRenderTreeSupport::setMockGeolocationPosition(BlackBerry::WebKit::DumpRenderTree::currentInstance()->page(), latitude, longitude, accuracy);
 }
 
-void TestRunner::setMockGeolocationPositionUnavailableError(JSStringRef message)
+void TestRunner::setMockGeolocationError(int code, JSStringRef message)
 {
     String messageStr = jsStringRefToWebCoreString(message);
-    DumpRenderTreeSupport::setMockGeolocationPositionUnavailableError(BlackBerry::WebKit::DumpRenderTree::currentInstance()->page(), messageStr);
+    DumpRenderTreeSupport::setMockGeolocationError(BlackBerry::WebKit::DumpRenderTree::currentInstance()->page(), code, messageStr);
 }
 
 void TestRunner::showWebInspector()
@@ -587,6 +587,12 @@ JSValueRef TestRunner::computedStyleIncludingVisitedInfo(JSContextRef context, J
     return DumpRenderTreeSupport::computedStyleIncludingVisitedInfo(context, value);
 }
 
+JSRetainPtr<JSStringRef> TestRunner::layerTreeAsText() const
+{
+    notImplemented();
+    return 0;
+}
+
 JSRetainPtr<JSStringRef> TestRunner::markerTextForListItem(JSContextRef context, JSValueRef nodeObject) const
 {
     WebCore::Element* element = toElement(toJS(toJS(context), nodeObject));
@@ -746,9 +752,7 @@ bool TestRunner::findString(JSContextRef context, JSStringRef target, JSObjectRe
             options |= WebCore::StartInSelection;
     }
 
-    // Our layout tests assume find will wrap and highlight all matches.
-    return BlackBerry::WebKit::DumpRenderTree::currentInstance()->page()->findNextString(nameStr.utf8().data(),
-        !(options & WebCore::Backwards), !(options & WebCore::CaseInsensitive), true /* wrap */, true /* highlightAllMatches */);
+    return mainFrame->page()->findString(nameStr, options);
 }
 
 void TestRunner::deleteLocalStorageForOrigin(JSStringRef URL)
@@ -839,3 +843,9 @@ void TestRunner::deliverWebIntent(JSStringRef, JSStringRef, JSStringRef)
 {
     notImplemented();
 }
+
+void TestRunner::setStorageDatabaseIdleInterval(double)
+{
+    // FIXME: Implement this.
+    notImplemented();
+}
diff --git a/Tools/DumpRenderTree/blackberry/build b/Tools/DumpRenderTree/blackberry/build
new file mode 100755
index 000000000..fb8dce473
--- /dev/null
+++ b/Tools/DumpRenderTree/blackberry/build
@@ -0,0 +1,12 @@
+#!/bin/sh
+
+# This file builds the ImageDiff executable, to run
+# on the host machine.
+
+which qmake-qt4 > /dev/null
+if [ $? -eq 0 ] ; then
+    qmake-qt4
+else
+    qmake
+fi
+make
diff --git a/Tools/DumpRenderTree/blackberry/src.pro b/Tools/DumpRenderTree/blackberry/src.pro
new file mode 100644
index 000000000..10967958e
--- /dev/null
+++ b/Tools/DumpRenderTree/blackberry/src.pro
@@ -0,0 +1,16 @@
+lessThan(QT_VERSION, 4.5) {
+    error("Qt 4.5 or greater is required.")
+}
+
+TEMPLATE = app
+TARGET = ImageDiff
+
+SOURCES += ../qt/ImageDiff.cpp
+DESTDIR = .
+
+unix:CONFIG += debug_and_release
+mac:CONFIG -= app_bundle
+win32: CONFIG += console
+
+QT = core gui
+
diff --git a/Tools/DumpRenderTree/chromium/DRTTestRunner.cpp b/Tools/DumpRenderTree/chromium/DRTTestRunner.cpp
index b31d7da70..dafafa181 100644
--- a/Tools/DumpRenderTree/chromium/DRTTestRunner.cpp
+++ b/Tools/DumpRenderTree/chromium/DRTTestRunner.cpp
@@ -157,6 +157,7 @@ DRTTestRunner::DRTTestRunner(TestShell* shell)
     bindMethod("evaluateScriptInIsolatedWorld", &DRTTestRunner::evaluateScriptInIsolatedWorld);
     bindMethod("evaluateScriptInIsolatedWorldAndReturnValue", &DRTTestRunner::evaluateScriptInIsolatedWorldAndReturnValue);
     bindMethod("setIsolatedWorldSecurityOrigin", &DRTTestRunner::setIsolatedWorldSecurityOrigin);
+    bindMethod("setIsolatedWorldContentSecurityPolicy", &DRTTestRunner::setIsolatedWorldContentSecurityPolicy);
     bindMethod("execCommand", &DRTTestRunner::execCommand);
     bindMethod("forceRedSelectionColors", &DRTTestRunner::forceRedSelectionColors);
 #if ENABLE(NOTIFICATIONS)
@@ -1403,6 +1404,16 @@ void DRTTestRunner::setIsolatedWorldSecurityOrigin(const CppArgumentList& argume
     m_shell->webView()->focusedFrame()->setIsolatedWorldSecurityOrigin(arguments[0].toInt32(), origin);
 }
 
+void DRTTestRunner::setIsolatedWorldContentSecurityPolicy(const CppArgumentList& arguments, CppVariant* result)
+{
+    result->setNull();
+
+    if (arguments.size() != 2 || !arguments[0].isNumber() || !arguments[1].isString())
+        return;
+
+    m_shell->webView()->focusedFrame()->setIsolatedWorldContentSecurityPolicy(arguments[0].toInt32(), cppVariantToWebString(arguments[1]));
+}
+
 void DRTTestRunner::setAllowUniversalAccessFromFileURLs(const CppArgumentList& arguments, CppVariant* result)
 {
     if (arguments.size() > 0 && arguments[0].isBool()) {
@@ -1560,6 +1571,8 @@ void DRTTestRunner::overridePreference(const CppArgumentList& arguments, CppVari
         prefs->webSecurityEnabled = cppVariantToBool(value);
     else if (key == "WebKitJavaScriptCanOpenWindowsAutomatically")
         prefs->javaScriptCanOpenWindowsAutomatically = cppVariantToBool(value);
+    else if (key == "WebKitSupportsMultipleWindows")
+        prefs->supportsMultipleWindows = cppVariantToBool(value);
     else if (key == "WebKitDisplayImagesKey")
         prefs->loadsImagesAutomatically = cppVariantToBool(value);
     else if (key == "WebKitPluginsEnabled")
@@ -1604,6 +1617,8 @@ void DRTTestRunner::overridePreference(const CppArgumentList& arguments, CppVari
         prefs->allowRunningOfInsecureContent = cppVariantToBool(value);
     else if (key == "WebKitCSSCustomFilterEnabled")
         prefs->cssCustomFilterEnabled = cppVariantToBool(value);
+    else if (key == "WebKitShouldRespectImageOrientation")
+        prefs->shouldRespectImageOrientation = cppVariantToBool(value);
     else if (key == "WebKitWebAudioEnabled") {
         ASSERT(cppVariantToBool(value));
     } else {
diff --git a/Tools/DumpRenderTree/chromium/DRTTestRunner.h b/Tools/DumpRenderTree/chromium/DRTTestRunner.h
index ec4778fd5..c4cb7ace8 100644
--- a/Tools/DumpRenderTree/chromium/DRTTestRunner.h
+++ b/Tools/DumpRenderTree/chromium/DRTTestRunner.h
@@ -43,7 +43,23 @@
 #define DRTTestRunner_h
 
 #include "TestRunner/src/TestRunner.h"
+#include "WebDeliveredIntentClient.h"
 #include "WebTask.h"
+#include "WebTextDirection.h"
+#include "platform/WebArrayBufferView.h"
+#include "platform/WebString.h"
+#include "platform/WebURL.h"
+#include <wtf/Deque.h>
+#include <wtf/OwnPtr.h>
+
+namespace WebKit {
+class WebGeolocationClientMock;
+}
+
+namespace webkit_support {
+class ScopedTempDirectory;
+}
+
 
 class TestShell;
 
@@ -281,6 +297,7 @@ public:
     void evaluateScriptInIsolatedWorldAndReturnValue(const CppArgumentList&, CppVariant*);
     void evaluateScriptInIsolatedWorld(const CppArgumentList&, CppVariant*);
     void setIsolatedWorldSecurityOrigin(const CppArgumentList&, CppVariant*);
+    void setIsolatedWorldContentSecurityPolicy(const CppArgumentList&, CppVariant*);
 
     // The fallback method is called when a nonexistent method is called on
     // the layout test controller object.
diff --git a/Tools/DumpRenderTree/chromium/DumpRenderTree.cpp b/Tools/DumpRenderTree/chromium/DumpRenderTree.cpp
index 5a3210449..bbd16af32 100644
--- a/Tools/DumpRenderTree/chromium/DumpRenderTree.cpp
+++ b/Tools/DumpRenderTree/chromium/DumpRenderTree.cpp
@@ -62,6 +62,7 @@ static const char optionEnableAccelerated2DCanvas[] = "--enable-accelerated-2d-c
 static const char optionEnableDeferred2DCanvas[] = "--enable-deferred-2d-canvas";
 static const char optionEnableAcceleratedPainting[] = "--enable-accelerated-painting";
 static const char optionEnableAcceleratedCompositingForVideo[] = "--enable-accelerated-video";
+static const char optionEnableAcceleratedFixedPosition[] = "--enable-accelerated-fixed-position";
 static const char optionUseGraphicsContext3DImplementation[] = "--use-graphics-context-3d-implementation=";
 static const char optionEnablePerTilePainting[] = "--enable-per-tile-painting";
 static const char optionEnableDeferredImageDecoding[] = "--enable-deferred-image-decoding";
@@ -127,6 +128,7 @@ int main(int argc, char* argv[])
     bool allowExternalPages = false;
     bool startupDialog = false;
     bool acceleratedCompositingForVideoEnabled = false;
+    bool acceleratedCompositingForFixedPositionEnabled = false;
     bool softwareCompositingEnabled = false;
     bool threadedCompositingEnabled = false;
     bool forceCompositingMode = false;
@@ -141,6 +143,7 @@ int main(int argc, char* argv[])
     string javaScriptFlags;
     bool encodeBinary = false;
     bool noTimeout = false;
+    bool acceleratedAnimationEnabled = false;
     for (int i = 1; i < argc; ++i) {
         string argument(argv[i]);
         if (argument == "-")
@@ -163,6 +166,8 @@ int main(int argc, char* argv[])
             hardwareAcceleratedGL = true;
         else if (argument == optionEnableAcceleratedCompositingForVideo)
             acceleratedCompositingForVideoEnabled = true;
+        else if (argument == optionEnableAcceleratedFixedPosition)
+            acceleratedCompositingForFixedPositionEnabled = true;
         else if (argument == optionEnableSoftwareCompositing)
             softwareCompositingEnabled = true;
         else if (argument == optionEnableThreadedCompositing)
@@ -219,12 +224,14 @@ int main(int argc, char* argv[])
         TestShell shell;
         shell.setAllowExternalPages(allowExternalPages);
         shell.setAcceleratedCompositingForVideoEnabled(acceleratedCompositingForVideoEnabled);
+        shell.setAcceleratedCompositingForFixedPositionEnabled(acceleratedCompositingForFixedPositionEnabled);
         shell.setSoftwareCompositingEnabled(softwareCompositingEnabled);
         shell.setThreadedCompositingEnabled(threadedCompositingEnabled);
         shell.setForceCompositingMode(forceCompositingMode);
         shell.setAccelerated2dCanvasEnabled(accelerated2DCanvasEnabled);
         shell.setDeferred2dCanvasEnabled(deferred2DCanvasEnabled);
         shell.setAcceleratedPaintingEnabled(acceleratedPaintingEnabled);
+        shell.setAcceleratedAnimationEnabled(acceleratedAnimationEnabled);
         shell.setPerTilePaintingEnabled(perTilePaintingEnabled);
         shell.setDeferredImageDecodingEnabled(deferredImageDecodingEnabled);
         shell.setJavaScriptFlags(javaScriptFlags);
diff --git a/Tools/DumpRenderTree/chromium/MockWebRTCPeerConnectionHandler.cpp b/Tools/DumpRenderTree/chromium/MockWebRTCPeerConnectionHandler.cpp
index 6eaf9d603..ca1e6043f 100644
--- a/Tools/DumpRenderTree/chromium/MockWebRTCPeerConnectionHandler.cpp
+++ b/Tools/DumpRenderTree/chromium/MockWebRTCPeerConnectionHandler.cpp
@@ -161,7 +161,7 @@ public:
     virtual void runIfValid() OVERRIDE
     {
         m_dataChannel.dataArrived(m_data, m_length);
-        delete m_data;
+        delete [] m_data;
     }
 
 private:
diff --git a/Tools/DumpRenderTree/chromium/TestEventPrinter.cpp b/Tools/DumpRenderTree/chromium/TestEventPrinter.cpp
index b8aecf100..aa2bf830f 100644
--- a/Tools/DumpRenderTree/chromium/TestEventPrinter.cpp
+++ b/Tools/DumpRenderTree/chromium/TestEventPrinter.cpp
@@ -65,7 +65,6 @@ void TestEventPrinter::handleTextHeader() const
 void TestEventPrinter::handleTextFooter() const
 {
     printf("#EOF\n");
-    fprintf(stderr, "#EOF\n");
 }
 
 void TestEventPrinter::handleAudio(const void* audioData, size_t audioSize) const
@@ -95,6 +94,7 @@ void TestEventPrinter::handleImage(const char* actualHash, const char* expectedH
 void TestEventPrinter::handleTestFooter(bool) const
 {
     printf("#EOF\n");
+    fprintf(stderr, "#EOF\n");
 }
 
 void TestEventPrinter::handleBinary(const void* data, size_t size) const
diff --git a/Tools/DumpRenderTree/chromium/TestRunner/public/WebEventSender.h b/Tools/DumpRenderTree/chromium/TestRunner/public/WebEventSender.h
index 0df88a77d..47c59efe6 100644
--- a/Tools/DumpRenderTree/chromium/TestRunner/public/WebEventSender.h
+++ b/Tools/DumpRenderTree/chromium/TestRunner/public/WebEventSender.h
@@ -31,7 +31,7 @@
 #ifndef WebEventSender_h
 #define WebEventSender_h
 
-#include "WebDragOperation.h"
+#include "WebKit/chromium/public/WebDragOperation.h"
 
 namespace WebKit {
 class WebDragData;
diff --git a/Tools/DumpRenderTree/chromium/TestRunner/public/WebTestDelegate.h b/Tools/DumpRenderTree/chromium/TestRunner/public/WebTestDelegate.h
index dd3303352..ab47d4f9d 100644
--- a/Tools/DumpRenderTree/chromium/TestRunner/public/WebTestDelegate.h
+++ b/Tools/DumpRenderTree/chromium/TestRunner/public/WebTestDelegate.h
@@ -31,8 +31,8 @@
 #ifndef WebTestDelegate_h
 #define WebTestDelegate_h
 
-#include "platform/WebString.h"
-#include "platform/WebVector.h"
+#include "Platform/chromium/public/WebString.h"
+#include "Platform/chromium/public/WebVector.h"
 
 namespace WebKit {
 struct WebContextMenuData;
@@ -51,7 +51,7 @@ public:
     virtual void setEditCommand(const std::string& name, const std::string& value) = 0;
     virtual WebKit::WebContextMenuData* lastContextMenuData() const = 0;
     virtual void setGamepadData(const WebKit::WebGamepads&) = 0;
-    virtual void printMessage(const std::string& message) const = 0;
+    virtual void printMessage(const std::string& message) = 0;
 
     // The delegate takes ownership of the WebTask objects and is responsible
     // for deleting them.
@@ -59,6 +59,8 @@ public:
     virtual void postDelayedTask(WebTask*, long long ms) = 0;
 
     virtual WebKit::WebString registerIsolatedFileSystem(const WebKit::WebVector<WebKit::WebString>& absoluteFilenames) = 0;
+    virtual long long getCurrentTimeInMillisecond() = 0;
+    virtual WebKit::WebString getAbsoluteWebStringFromUTF8Path(const std::string& path) = 0;
 };
 
 }
diff --git a/Tools/DumpRenderTree/chromium/TestRunner/src/CppVariant.h b/Tools/DumpRenderTree/chromium/TestRunner/src/CppVariant.h
index 60cc6271e..47fd466af 100644
--- a/Tools/DumpRenderTree/chromium/TestRunner/src/CppVariant.h
+++ b/Tools/DumpRenderTree/chromium/TestRunner/src/CppVariant.h
@@ -43,7 +43,6 @@
 #define CppVariant_h
 
 #include "WebBindings.h"
-#include "webkit/support/webkit_support.h"
 #include <string>
 #include <wtf/Vector.h>
 
diff --git a/Tools/DumpRenderTree/chromium/TestRunner/src/EventSender.cpp b/Tools/DumpRenderTree/chromium/TestRunner/src/EventSender.cpp
index 2f4a0554c..77fcb76e8 100644
--- a/Tools/DumpRenderTree/chromium/TestRunner/src/EventSender.cpp
+++ b/Tools/DumpRenderTree/chromium/TestRunner/src/EventSender.cpp
@@ -43,16 +43,17 @@
 #include "config.h"
 #include "EventSender.h"
 
+#include "KeyCodeMapping.h"
 #include "TestDelegate.h"
 #include "WebContextMenuData.h"
 #include "WebDragOperation.h"
+#include "WebEventSender.h"
 #include "WebTouchPoint.h"
 #include "WebView.h"
 #include "platform/WebDragData.h"
 #include "platform/WebPoint.h"
 #include "platform/WebString.h"
 #include "platform/WebVector.h"
-#include "webkit/support/webkit_support.h"
 #include <wtf/Deque.h>
 #include <wtf/StringExtras.h>
 
@@ -125,9 +126,9 @@ inline bool outsideMultiClickRadius(const WebPoint& a, const WebPoint& b)
 // dependent (e.g., dragging has a timeout vs selection).
 uint32 timeOffsetMs = 0;
 
-double getCurrentEventTimeSec()
+double getCurrentEventTimeSec(TestDelegate* delegate)
 {
-    return (webkit_support::GetCurrentTimeInMillisecond() + timeOffsetMs) / 1000.0;
+    return (delegate->getCurrentTimeInMillisecond() + timeOffsetMs) / 1000.0;
 }
 
 void advanceEventTime(int32_t deltaMs)
@@ -135,7 +136,7 @@ void advanceEventTime(int32_t deltaMs)
     timeOffsetMs += deltaMs;
 }
 
-void initMouseEvent(WebInputEvent::Type t, WebMouseEvent::Button b, const WebPoint& pos, WebMouseEvent* e)
+void initMouseEvent(WebInputEvent::Type t, WebMouseEvent::Button b, const WebPoint& pos, WebMouseEvent* e, double ts)
 {
     e->type = t;
     e->button = b;
@@ -144,7 +145,7 @@ void initMouseEvent(WebInputEvent::Type t, WebMouseEvent::Button b, const WebPoi
     e->y = pos.y;
     e->globalX = pos.x;
     e->globalY = pos.y;
-    e->timeStampSeconds = getCurrentEventTimeSec();
+    e->timeStampSeconds = ts;
     e->clickCount = clickCount;
 }
 
@@ -214,16 +215,16 @@ bool getEditCommand(const WebKeyboardEvent& event, string* name)
         return false;
 
     switch (event.windowsKeyCode) {
-    case webkit_support::VKEY_LEFT:
+    case VKEY_LEFT:
         *name = "MoveToBeginningOfLine";
         break;
-    case webkit_support::VKEY_RIGHT:
+    case VKEY_RIGHT:
         *name = "MoveToEndOfLine";
         break;
-    case webkit_support::VKEY_UP:
+    case VKEY_UP:
         *name = "MoveToBeginningOfDocument";
         break;
-    case webkit_support::VKEY_DOWN:
+    case VKEY_DOWN:
         *name = "MoveToEndOfDocument";
         break;
     default:
@@ -349,7 +350,7 @@ void EventSender::reset()
 void EventSender::doDragDrop(const WebDragData& dragData, WebDragOperationsMask mask)
 {
     WebMouseEvent event;
-    initMouseEvent(WebInputEvent::MouseDown, pressedButton, lastMousePos, &event);
+    initMouseEvent(WebInputEvent::MouseDown, pressedButton, lastMousePos, &event, getCurrentEventTimeSec(m_delegate));
     WebPoint clientPoint(event.x, event.y);
     WebPoint screenPoint(event.globalX, event.globalY);
     currentDragData = dragData;
@@ -392,7 +393,7 @@ int EventSender::getButtonNumberFromSingleArg(const CppArgumentList& arguments)
 
 void EventSender::updateClickCountForButton(WebMouseEvent::Button buttonType)
 {
-    if ((getCurrentEventTimeSec() - lastClickTimeSec < multipleClickTimeSec)
+    if ((getCurrentEventTimeSec(m_delegate) - lastClickTimeSec < multipleClickTimeSec)
         && (!outsideMultiClickRadius(lastMousePos, lastClickPos))
         && (buttonType == lastButtonType))
         ++clickCount;
@@ -422,7 +423,7 @@ void EventSender::mouseDown(const CppArgumentList& arguments, CppVariant* result
 
     WebMouseEvent event;
     pressedButton = buttonType;
-    initMouseEvent(WebInputEvent::MouseDown, buttonType, lastMousePos, &event);
+    initMouseEvent(WebInputEvent::MouseDown, buttonType, lastMousePos, &event, getCurrentEventTimeSec(m_delegate));
     if (arguments.size() >= 2 && (arguments[1].isObject() || arguments[1].isString()))
         applyKeyModifiers(&(arguments[1]), &event);
     webview()->handleInputEvent(event);
@@ -448,7 +449,7 @@ void EventSender::mouseUp(const CppArgumentList& arguments, CppVariant* result)
         replaySavedEvents();
     } else {
         WebMouseEvent event;
-        initMouseEvent(WebInputEvent::MouseUp, buttonType, lastMousePos, &event);
+        initMouseEvent(WebInputEvent::MouseUp, buttonType, lastMousePos, &event, getCurrentEventTimeSec(m_delegate));
         if (arguments.size() >= 2 && (arguments[1].isObject() || arguments[1].isString()))
             applyKeyModifiers(&(arguments[1]), &event);
         doMouseUp(event);
@@ -497,7 +498,7 @@ void EventSender::mouseMoveTo(const CppArgumentList& arguments, CppVariant* resu
         mouseEventQueue.append(savedEvent);
     } else {
         WebMouseEvent event;
-        initMouseEvent(WebInputEvent::MouseMove, pressedButton, mousePos, &event);
+        initMouseEvent(WebInputEvent::MouseMove, pressedButton, mousePos, &event, getCurrentEventTimeSec(m_delegate));
         doMouseMove(event);
     }
 }
@@ -535,50 +536,43 @@ void EventSender::keyDown(const CppArgumentList& arguments, CppVariant* result)
     bool needsShiftKeyModifier = false;
     if ("\n" == codeStr) {
         generateChar = true;
-        text = code = webkit_support::VKEY_RETURN;
+        text = code = VKEY_RETURN;
     } else if ("rightArrow" == codeStr)
-        code = webkit_support::VKEY_RIGHT;
+        code = VKEY_RIGHT;
     else if ("downArrow" == codeStr)
-        code = webkit_support::VKEY_DOWN;
+        code = VKEY_DOWN;
     else if ("leftArrow" == codeStr)
-        code = webkit_support::VKEY_LEFT;
+        code = VKEY_LEFT;
     else if ("upArrow" == codeStr)
-        code = webkit_support::VKEY_UP;
+        code = VKEY_UP;
     else if ("insert" == codeStr)
-        code = webkit_support::VKEY_INSERT;
+        code = VKEY_INSERT;
     else if ("delete" == codeStr)
-        code = webkit_support::VKEY_DELETE;
+        code = VKEY_DELETE;
     else if ("pageUp" == codeStr)
-        code = webkit_support::VKEY_PRIOR;
+        code = VKEY_PRIOR;
     else if ("pageDown" == codeStr)
-        code = webkit_support::VKEY_NEXT;
+        code = VKEY_NEXT;
     else if ("home" == codeStr)
-        code = webkit_support::VKEY_HOME;
+        code = VKEY_HOME;
     else if ("end" == codeStr)
-        code = webkit_support::VKEY_END;
+        code = VKEY_END;
     else if ("printScreen" == codeStr)
-        code = webkit_support::VKEY_SNAPSHOT;
+        code = VKEY_SNAPSHOT;
     else if ("menu" == codeStr)
-        // FIXME: Change this to webkit_support::VKEY_APPS.
-        code = 0x5D;
+        code = VKEY_APPS;
     else if ("leftControl" == codeStr)
-        // FIXME: Change this to webkit_support::VKEY_LCONTROL.
-        code = 0xA2;
+        code = VKEY_LCONTROL;
     else if ("rightControl" == codeStr)
-        // FIXME: Change this to webkit_support::VKEY_RCONTROL.
-        code = 0xA3;
+        code = VKEY_RCONTROL;
     else if ("leftShift" == codeStr)
-        // FIXME: Change this to webkit_support::VKEY_LSHIFT.
-        code = 0xA0;
+        code = VKEY_LSHIFT;
     else if ("rightShift" == codeStr)
-        // FIXME: Change this to webkit_support::VKEY_RSHIFT.
-        code = 0xA1;
+        code = VKEY_RSHIFT;
     else if ("leftAlt" == codeStr)
-        // FIXME: Change this to webkit_support::VKEY_LMENU.
-        code = 0xA4;
+        code = VKEY_LMENU;
     else if ("rightAlt" == codeStr)
-        // FIXME: Change this to webkit_support::VKEY_RMENU.
-        code = 0xA5;
+        code = VKEY_RMENU;
     else {
         // Compare the input string with the function-key names defined by the
         // DOM spec (i.e. "F1",...,"F24"). If the input string is a function-key
@@ -588,7 +582,7 @@ void EventSender::keyDown(const CppArgumentList& arguments, CppVariant* result)
             snprintf(functionChars, 10, "F%d", i);
             string functionKeyName(functionChars);
             if (functionKeyName == codeStr) {
-                code = webkit_support::VKEY_F1 + (i - 1);
+                code = VKEY_F1 + (i - 1);
                 break;
             }
         }
@@ -613,7 +607,7 @@ void EventSender::keyDown(const CppArgumentList& arguments, CppVariant* result)
     eventDown.modifiers = 0;
     eventDown.windowsKeyCode = code;
 #if OS(LINUX) && USE(GTK)
-    eventDown.nativeKeyCode = webkit_support::NativeKeyCodeForWindowsKeyCode(code, needsShiftKeyModifier);
+    eventDown.nativeKeyCode = NativeKeyCodeForWindowsKeyCode(code);
 #endif
 
     if (generateChar) {
@@ -775,7 +769,7 @@ void EventSender::replaySavedEvents()
         switch (e.type) {
         case SavedEvent::MouseMove: {
             WebMouseEvent event;
-            initMouseEvent(WebInputEvent::MouseMove, pressedButton, e.pos, &event);
+            initMouseEvent(WebInputEvent::MouseMove, pressedButton, e.pos, &event, getCurrentEventTimeSec(m_delegate));
             doMouseMove(event);
             break;
         }
@@ -784,7 +778,7 @@ void EventSender::replaySavedEvents()
             break;
         case SavedEvent::MouseUp: {
             WebMouseEvent event;
-            initMouseEvent(WebInputEvent::MouseUp, e.buttonType, lastMousePos, &event);
+            initMouseEvent(WebInputEvent::MouseUp, e.buttonType, lastMousePos, &event, getCurrentEventTimeSec(m_delegate));
             doMouseUp(event);
             break;
         }
@@ -843,10 +837,10 @@ void EventSender::contextClick(const CppArgumentList& arguments, CppVariant* res
     // Generate right mouse down and up.
     WebMouseEvent event;
     pressedButton = WebMouseEvent::ButtonRight;
-    initMouseEvent(WebInputEvent::MouseDown, WebMouseEvent::ButtonRight, lastMousePos, &event);
+    initMouseEvent(WebInputEvent::MouseDown, WebMouseEvent::ButtonRight, lastMousePos, &event, getCurrentEventTimeSec(m_delegate));
     webview()->handleInputEvent(event);
 
-    initMouseEvent(WebInputEvent::MouseUp, WebMouseEvent::ButtonRight, lastMousePos, &event);
+    initMouseEvent(WebInputEvent::MouseUp, WebMouseEvent::ButtonRight, lastMousePos, &event, getCurrentEventTimeSec(m_delegate));
     webview()->handleInputEvent(event);
 
     pressedButton = WebMouseEvent::ButtonNone;
@@ -906,7 +900,7 @@ void EventSender::beginDragWithFiles(const CppArgumentList& arguments, CppVarian
     for (size_t i = 0; i < files.size(); ++i) {
         WebDragData::Item item;
         item.storageType = WebDragData::Item::StorageTypeFilename;
-        item.filenameData = webkit_support::GetAbsoluteWebStringFromUTF8Path(files[i]);
+        item.filenameData = m_delegate->getAbsoluteWebStringFromUTF8Path(files[i]);
         currentDragData.addItem(item);
         absoluteFilenames[i] = item.filenameData;
     }
@@ -1014,7 +1008,7 @@ void EventSender::sendCurrentTouchEvent(const WebInputEvent::Type type)
     WebTouchEvent touchEvent;
     touchEvent.type = type;
     touchEvent.modifiers = touchModifiers;
-    touchEvent.timeStampSeconds = getCurrentEventTimeSec();
+    touchEvent.timeStampSeconds = getCurrentEventTimeSec(m_delegate);
     touchEvent.touchesLength = touchPoints.size();
     for (unsigned i = 0; i < touchPoints.size(); ++i)
         touchEvent.touches[i] = touchPoints[i];
@@ -1054,7 +1048,7 @@ void EventSender::handleMouseWheel(const CppArgumentList& arguments, CppVariant*
         hasPreciseScrollingDeltas = arguments[3].toBoolean();
 
     WebMouseWheelEvent event;
-    initMouseEvent(WebInputEvent::MouseWheel, pressedButton, lastMousePos, &event);
+    initMouseEvent(WebInputEvent::MouseWheel, pressedButton, lastMousePos, &event, getCurrentEventTimeSec(m_delegate));
     event.wheelTicksX = static_cast<float>(horizontal);
     event.wheelTicksY = static_cast<float>(vertical);
     event.deltaX = event.wheelTicksX;
@@ -1206,10 +1200,18 @@ void EventSender::gestureEvent(WebInputEvent::Type type, const CppArgumentList&
     case WebInputEvent::GestureLongPress:
         event.x = point.x;
         event.y = point.y;
+        if (arguments.size() >= 4) {
+            event.data.tapDown.width = static_cast<float>(arguments[2].toDouble());
+            event.data.tapDown.height = static_cast<float>(arguments[3].toDouble());
+        }
         break;
     case WebInputEvent::GestureTwoFingerTap:
         event.x = point.x;
         event.y = point.y;
+        if (arguments.size() >= 4) {
+            event.data.twoFingerTap.firstFingerWidth = static_cast<float>(arguments[2].toDouble());
+            event.data.twoFingerTap.firstFingerHeight = static_cast<float>(arguments[3].toDouble());
+        }
         break;
     default:
         ASSERT_NOT_REACHED();
@@ -1217,7 +1219,7 @@ void EventSender::gestureEvent(WebInputEvent::Type type, const CppArgumentList&
 
     event.globalX = event.x;
     event.globalY = event.y;
-    event.timeStampSeconds = getCurrentEventTimeSec();
+    event.timeStampSeconds = getCurrentEventTimeSec(m_delegate);
     webview()->handleInputEvent(event);
 }
 
@@ -1229,7 +1231,7 @@ void EventSender::gestureFlingCancel(const CppArgumentList& arguments, CppVarian
 
     WebGestureEvent event;
     event.type = WebInputEvent::GestureFlingCancel;
-    event.timeStampSeconds = getCurrentEventTimeSec();
+    event.timeStampSeconds = getCurrentEventTimeSec(m_delegate);
     webview()->handleInputEvent(event);
 }
 
@@ -1253,7 +1255,7 @@ void EventSender::gestureFlingStart(const CppArgumentList& arguments, CppVariant
 
     event.data.flingStart.velocityX = static_cast<float>(arguments[2].toDouble());
     event.data.flingStart.velocityY = static_cast<float>(arguments[3].toDouble());
-    event.timeStampSeconds = getCurrentEventTimeSec();
+    event.timeStampSeconds = getCurrentEventTimeSec(m_delegate);
     webview()->handleInputEvent(event);
 }
 
diff --git a/Tools/DumpRenderTree/chromium/TestRunner/src/KeyCodeMapping.cpp b/Tools/DumpRenderTree/chromium/TestRunner/src/KeyCodeMapping.cpp
new file mode 100644
index 000000000..c339f2f2b
--- /dev/null
+++ b/Tools/DumpRenderTree/chromium/TestRunner/src/KeyCodeMapping.cpp
@@ -0,0 +1,248 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "KeyCodeMapping.h"
+
+#include <wtf/UnusedParam.h>
+
+namespace WebTestRunner {
+
+int NativeKeyCodeForWindowsKeyCode(int keysym)
+{
+#if OS(LINUX) && USE(GTK)
+    // See /usr/share/X11/xkb/keycodes/*
+    static const int asciiToKeyCode[] = {
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        22,
+        23,
+        0,
+        0,
+        0,
+        36,
+        0,
+        0,
+        50,
+        37,
+        64,
+        127,
+        66,
+        0,
+        0,
+        0,
+        0,
+        131,
+        0,
+        9,
+        100,
+        102,
+        0,
+        0,
+        65, // ' '
+        112, // '!'
+        117, // '"'
+        115, // '#'
+        110, // '$'
+        113, // '%'
+        111, // '&'
+        114, // '''
+        116, // '('
+        0, // ')'
+        107, // '*'
+        0, // '+'
+        0, // ','
+        118, // '-'
+        119, // '.'
+        146, // '/'
+        19, // '0'
+        10, // '1'
+        11, // '2'
+        12, // '3'
+        13, // '4'
+        14, // '5'
+        15, // '6'
+        16, // '7'
+        17, // '8'
+        18, // '9'
+        0, // ':'
+        0, // ';'
+        0, // '<'
+        0, // '='
+        0, // '>'
+        0, // '?'
+        0, // '@'
+        38, // 'A'
+        56, // 'B'
+        54, // 'C'
+        40, // 'D'
+        26, // 'E'
+        41, // 'F'
+        42, // 'G'
+        43, // 'H'
+        31, // 'I'
+        44, // 'J'
+        45, // 'K'
+        46, // 'L'
+        58, // 'M'
+        57, // 'N'
+        32, // 'O'
+        33, // 'P'
+        24, // 'Q'
+        27, // 'R'
+        39, // 'S'
+        28, // 'T'
+        30, // 'U'
+        55, // 'V'
+        25, // 'W'
+        53, // 'X'
+        29, // 'Y'
+        52, // 'Z'
+        133, // '['
+        134, // '\'
+        135, // ']'
+        0, // '^'
+        0, // '_'
+        90, // '`'
+        38, // 'a'
+        56, // 'b'
+        54, // 'c'
+        40, // 'd'
+        26, // 'e'
+        41, // 'f'
+        42, // 'g'
+        43, // 'h'
+        31, // 'i'
+        44, // 'j'
+        45, // 'k'
+        46, // 'l'
+        58, // 'm'
+        57, // 'n'
+        32, // 'o'
+        33, // 'p'
+        24, // 'q'
+        27, // 'r'
+        39, // 's'
+        28, // 't'
+        30, // 'u'
+        55, // 'v'
+        25, // 'w'
+        53, // 'x'
+        29, // 'y'
+        52, // 'z'
+        96, // '{'
+        0, // '|'
+        0, // '}'
+        0, // '~'
+        0, // DEL
+    };
+
+    if (keysym <= 127)
+        return asciiToKeyCode[keysym];
+
+    switch (keysym) {
+    case VKEY_PRIOR:
+        return 112;
+    case VKEY_NEXT:
+        return 117;
+    case VKEY_END:
+        return 115;
+    case VKEY_HOME:
+        return 110;
+    case VKEY_LEFT:
+        return 113;
+    case VKEY_UP:
+        return 111;
+    case VKEY_RIGHT:
+        return 114;
+    case VKEY_DOWN:
+        return 116;
+    case VKEY_SNAPSHOT:
+        return 107;
+    case VKEY_INSERT:
+        return 118;
+    case VKEY_DELETE:
+        return 119;
+    case VKEY_APPS:
+        return 135;
+    case VKEY_F1:
+    case VKEY_F1 + 1:
+    case VKEY_F1 + 2:
+    case VKEY_F1 + 3:
+    case VKEY_F1 + 4:
+    case VKEY_F1 + 5:
+    case VKEY_F1 + 6:
+    case VKEY_F1 + 7:
+    case VKEY_F1 + 8:
+    case VKEY_F1 + 9:
+    case VKEY_F1 + 10:
+    case VKEY_F1 + 11:
+    case VKEY_F1 + 12:
+    case VKEY_F1 + 13:
+    case VKEY_F1 + 14:
+    case VKEY_F1 + 15:
+    case VKEY_F1 + 16:
+    case VKEY_F1 + 17:
+    case VKEY_F1 + 18:
+    case VKEY_F1 + 19:
+    case VKEY_F1 + 20:
+    case VKEY_F1 + 21:
+    case VKEY_F1 + 22:
+    case VKEY_F1 + 23:
+        return 67 + (keysym - VKEY_F1);
+    case VKEY_LSHIFT:
+        return 50;
+    case VKEY_RSHIFT:
+        return 62;
+    case VKEY_LCONTROL:
+        return 37;
+    case VKEY_RCONTROL:
+        return 105;
+    case VKEY_LMENU:
+        return 64;
+    case VKEY_RMENU:
+        return 108;
+
+    default:
+        return 0;
+    }
+#else
+    UNUSED_PARAM(keysym);
+    return 0;
+#endif
+}
+
+}
diff --git a/Source/WebCore/bindings/v8/StaticDOMDataStore.h b/Tools/DumpRenderTree/chromium/TestRunner/src/KeyCodeMapping.h
index f9c57fc0f..87469fac4 100644
--- a/Source/WebCore/bindings/v8/StaticDOMDataStore.h
+++ b/Tools/DumpRenderTree/chromium/TestRunner/src/KeyCodeMapping.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2009 Google Inc. All rights reserved.
+ * Copyright (C) 2012 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -28,36 +28,38 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef StaticDOMDataStore_h
-#define StaticDOMDataStore_h
+#ifndef KeyCodeMapping_h
+#define KeyCodeMapping_h
 
-#include "DOMDataStore.h"
-#include "IntrusiveDOMWrapperMap.h"
+namespace WebTestRunner {
 
-namespace WebCore {
-
-// StaticDOMDataStore
-//
-// StaticDOMDataStore is a DOMDataStore that manages the lifetime of the store
-// statically.  This encapsulates thread-specific DOM data for the main
-// thread.  All the maps in it are static.  This is because we are unable to
-// rely on WTF::ThreadSpecificThreadExit to do the cleanup since the place that
-// tears down the main thread can not call any WTF functions.
-//
-class StaticDOMDataStore : public DOMDataStore {
-public:
-    StaticDOMDataStore();
-    virtual ~StaticDOMDataStore();
-
-    virtual void reportMemoryUsage(MemoryObjectInfo*) const OVERRIDE;
-
-private:
-    IntrusiveDOMWrapperMap m_staticDomNodeMap;
-    IntrusiveDOMWrapperMap m_staticActiveDomNodeMap;
-    DOMWrapperMap<void> m_staticDomObjectMap;
-    DOMWrapperMap<void> m_staticActiveDomObjectMap;
+// The keycodes match the values of the virtual keycodes found here http://msdn.microsoft.com/en-us/library/windows/desktop/dd375731(v=vs.85).aspx
+enum {
+    VKEY_RETURN   = 0x0D,
+    VKEY_PRIOR    = 0x21,
+    VKEY_NEXT     = 0x22,
+    VKEY_END      = 0x23,
+    VKEY_HOME     = 0x24,
+    VKEY_LEFT     = 0x25,
+    VKEY_UP       = 0x26,
+    VKEY_RIGHT    = 0x27,
+    VKEY_DOWN     = 0x28,
+    VKEY_SNAPSHOT = 0x2C,
+    VKEY_INSERT   = 0x2D,
+    VKEY_DELETE   = 0x2E,
+    VKEY_APPS     = 0x5D,
+    VKEY_F1       = 0x70,
+    VKEY_LSHIFT   = 0xA0,
+    VKEY_RSHIFT   = 0xA1,
+    VKEY_LCONTROL = 0xA2,
+    VKEY_RCONTROL = 0xA3,
+    VKEY_LMENU    = 0xA4,
+    VKEY_RMENU    = 0xA5,
 };
 
-} // namespace WebCore
+// Map a windows keycode to a native keycode on OS(LINUX) && USE(GTK).
+int NativeKeyCodeForWindowsKeyCode(int keysym);
+
+}
 
-#endif // StaticDOMDataStore_h
+#endif // KeyCodeMapping_h
diff --git a/Tools/DumpRenderTree/chromium/TestRunner/src/TestDelegate.h b/Tools/DumpRenderTree/chromium/TestRunner/src/TestDelegate.h
index 218bbdf42..0498fcb3f 100644
--- a/Tools/DumpRenderTree/chromium/TestRunner/src/TestDelegate.h
+++ b/Tools/DumpRenderTree/chromium/TestRunner/src/TestDelegate.h
@@ -51,10 +51,12 @@ public:
     virtual void setEditCommand(const std::string& name, const std::string& value) = 0;
     virtual WebKit::WebContextMenuData* lastContextMenuData() const = 0;
     virtual void setGamepadData(const WebKit::WebGamepads&) = 0;
-    virtual void printMessage(const std::string& message) const = 0;
+    virtual void printMessage(const std::string& message) = 0;
     virtual void postTask(WebTestRunner::WebTask*) = 0;
     virtual void postDelayedTask(WebTestRunner::WebTask*, long long ms) = 0;
     virtual WebKit::WebString registerIsolatedFileSystem(const WebKit::WebVector<WebKit::WebString>& absoluteFilenames) = 0;
+    virtual long long getCurrentTimeInMillisecond() = 0;
+    virtual WebKit::WebString getAbsoluteWebStringFromUTF8Path(const std::string& path) = 0;
 };
 
 #endif // TestDelegate_h
diff --git a/Tools/DumpRenderTree/chromium/TestRunner/src/TestRunner.cpp b/Tools/DumpRenderTree/chromium/TestRunner/src/TestRunner.cpp
index e6ead1551..f0da79831 100644
--- a/Tools/DumpRenderTree/chromium/TestRunner/src/TestRunner.cpp
+++ b/Tools/DumpRenderTree/chromium/TestRunner/src/TestRunner.cpp
@@ -32,51 +32,6 @@
 #include "config.h"
 #include "TestRunner.h"
 
-#include "WebAnimationController.h"
-#include "WebBindings.h"
-#include "WebConsoleMessage.h"
-#include "WebDeviceOrientation.h"
-#include "WebDeviceOrientationClientMock.h"
-#include "WebDocument.h"
-#include "WebElement.h"
-#include "WebFindOptions.h"
-#include "WebFrame.h"
-#include "WebGeolocationClientMock.h"
-#include "WebIDBFactory.h"
-#include "WebInputElement.h"
-#include "WebIntent.h"
-#include "WebIntentRequest.h"
-#include "WebKit.h"
-#include "WebNotificationPresenter.h"
-#include "WebPrintParams.h"
-#include "WebScriptSource.h"
-#include "WebSecurityPolicy.h"
-#include "WebSettings.h"
-#include "WebSurroundingText.h"
-#include "WebView.h"
-#include "WebWorkerInfo.h"
-#include "platform/WebData.h"
-#include "platform/WebSerializedScriptValue.h"
-#include "platform/WebSize.h"
-#include "platform/WebURL.h"
-#include "v8/include/v8.h"
-#include "webkit/support/webkit_support.h"
-#include <algorithm>
-#include <clocale>
-#include <cstdlib>
-#include <limits>
-#include <sstream>
-#include <wtf/OwnArrayPtr.h>
-#include <wtf/text/WTFString.h>
-
-#if OS(LINUX) || OS(ANDROID)
-#include "linux/WebFontRendering.h"
-#endif
-
-using namespace WebCore;
-using namespace WebKit;
-using namespace std;
-
 TestRunner::TestRunner()
 {
 }
diff --git a/Tools/DumpRenderTree/chromium/TestRunner/src/TestRunner.h b/Tools/DumpRenderTree/chromium/TestRunner/src/TestRunner.h
index 39e19d573..503271b5d 100644
--- a/Tools/DumpRenderTree/chromium/TestRunner/src/TestRunner.h
+++ b/Tools/DumpRenderTree/chromium/TestRunner/src/TestRunner.h
@@ -33,21 +33,6 @@
 #define TestRunner_h
 
 #include "CppBoundClass.h"
-#include "WebDeliveredIntentClient.h"
-#include "WebTextDirection.h"
-#include "platform/WebArrayBufferView.h"
-#include "platform/WebString.h"
-#include "platform/WebURL.h"
-#include <wtf/Deque.h>
-#include <wtf/OwnPtr.h>
-
-namespace WebKit {
-class WebGeolocationClientMock;
-}
-
-namespace webkit_support {
-class ScopedTempDirectory;
-}
 
 class TestRunner : public CppBoundClass {
 public:
diff --git a/Tools/DumpRenderTree/chromium/TestRunner/src/WebTestInterfaces.cpp b/Tools/DumpRenderTree/chromium/TestRunner/src/WebTestInterfaces.cpp
index 632d9664b..9a86953c3 100644
--- a/Tools/DumpRenderTree/chromium/TestRunner/src/WebTestInterfaces.cpp
+++ b/Tools/DumpRenderTree/chromium/TestRunner/src/WebTestInterfaces.cpp
@@ -63,10 +63,12 @@ public:
     virtual void setEditCommand(const std::string& name, const std::string& value);
     virtual WebContextMenuData* lastContextMenuData() const;
     virtual void setGamepadData(const WebGamepads&);
-    virtual void printMessage(const std::string& message) const;
+    virtual void printMessage(const std::string& message);
     virtual void postTask(WebTask*);
     virtual void postDelayedTask(WebTask*, long long ms);
     virtual WebString registerIsolatedFileSystem(const WebVector<WebString>& absoluteFilenames);
+    virtual long long getCurrentTimeInMillisecond();
+    virtual WebKit::WebString getAbsoluteWebStringFromUTF8Path(const std::string& path);
 
 private:
     TestInterfaces m_interfaces;
@@ -127,7 +129,7 @@ void WebTestInterfaces::Internal::setGamepadData(const WebGamepads& pads)
     m_delegate->setGamepadData(pads);
 }
 
-void WebTestInterfaces::Internal::printMessage(const std::string& message) const
+void WebTestInterfaces::Internal::printMessage(const std::string& message)
 {
     m_delegate->printMessage(message);
 }
@@ -147,6 +149,16 @@ WebString WebTestInterfaces::Internal::registerIsolatedFileSystem(const WebVecto
     return m_delegate->registerIsolatedFileSystem(absoluteFilenames);
 }
 
+long long WebTestInterfaces::Internal::getCurrentTimeInMillisecond()
+{
+    return m_delegate->getCurrentTimeInMillisecond();
+}
+
+WebKit::WebString WebTestInterfaces::Internal::getAbsoluteWebStringFromUTF8Path(const std::string& path)
+{
+    return m_delegate->getAbsoluteWebStringFromUTF8Path(path);
+}
+
 WebTestInterfaces::WebTestInterfaces()
 {
     m_internal = new Internal;
diff --git a/Tools/DumpRenderTree/chromium/TestShell.cpp b/Tools/DumpRenderTree/chromium/TestShell.cpp
index 2692e7458..4c42dc0dd 100644
--- a/Tools/DumpRenderTree/chromium/TestShell.cpp
+++ b/Tools/DumpRenderTree/chromium/TestShell.cpp
@@ -35,6 +35,7 @@
 #include "DRTDevToolsClient.h"
 #include "DRTTestRunner.h"
 #include "MockWebPrerenderingSupport.h"
+#include "WebCache.h"
 #include "WebDataSource.h"
 #include "WebDocument.h"
 #include "WebElement.h"
@@ -109,6 +110,7 @@ TestShell::TestShell()
     , m_dumpPixelsForCurrentTest(false)
     , m_allowExternalPages(false)
     , m_acceleratedCompositingForVideoEnabled(false)
+    , m_acceleratedCompositingForFixedPositionEnabled(false)
     , m_softwareCompositingEnabled(false)
     , m_threadedCompositingEnabled(false)
     , m_forceCompositingMode(false)
@@ -144,6 +146,7 @@ TestShell::TestShell()
     WebRuntimeFeatures::enableShadowDOM(true);
     WebRuntimeFeatures::enableStyleScoped(true);
     WebRuntimeFeatures::enableScriptedSpeech(true);
+    WebRuntimeFeatures::enableRequestAutocomplete(true);
 
     // 30 second is the same as the value in Mac DRT.
     // If we use a value smaller than the timeout value of
@@ -228,6 +231,7 @@ void TestShell::resetWebSettings(WebView& webView)
     m_prefs.reset();
     m_prefs.acceleratedCompositingEnabled = true;
     m_prefs.acceleratedCompositingForVideoEnabled = m_acceleratedCompositingForVideoEnabled;
+    m_prefs.acceleratedCompositingForFixedPositionEnabled = m_acceleratedCompositingForFixedPositionEnabled;
     m_prefs.forceCompositingMode = m_forceCompositingMode;
     m_prefs.accelerated2dCanvasEnabled = m_accelerated2dCanvasEnabled;
     m_prefs.deferred2dCanvasEnabled = m_deferred2dCanvasEnabled;
@@ -318,6 +322,7 @@ void TestShell::resetTestController()
     webView()->setFixedLayoutSize(WebSize(0, 0));
     webView()->mainFrame()->clearOpener();
     WebTestingSupport::resetInternalsObject(webView()->mainFrame());
+    WebCache::clear();
 }
 
 void TestShell::loadURL(const WebURL& url)
@@ -387,6 +392,11 @@ void TestShell::setPerTilePaintingEnabled(bool enabled)
     Platform::current()->compositorSupport()->setPerTilePaintingEnabled(enabled);
 }
 
+void TestShell::setAcceleratedAnimationEnabled(bool enabled)
+{
+    Platform::current()->compositorSupport()->setAcceleratedAnimationEnabled(enabled);
+}
+
 static string dumpDocumentText(WebFrame* frame)
 {
     // We use the document element's text instead of the body text here because
diff --git a/Tools/DumpRenderTree/chromium/TestShell.h b/Tools/DumpRenderTree/chromium/TestShell.h
index 03315690e..12e1dbbef 100644
--- a/Tools/DumpRenderTree/chromium/TestShell.h
+++ b/Tools/DumpRenderTree/chromium/TestShell.h
@@ -128,6 +128,7 @@ public:
     void setAllowExternalPages(bool allowExternalPages) { m_allowExternalPages = allowExternalPages; }
 
     void setAcceleratedCompositingForVideoEnabled(bool enabled) { m_acceleratedCompositingForVideoEnabled = enabled; }
+    void setAcceleratedCompositingForFixedPositionEnabled(bool enabled) { m_acceleratedCompositingForFixedPositionEnabled = enabled; }
     bool softwareCompositingEnabled() { return m_softwareCompositingEnabled; }
     void setSoftwareCompositingEnabled(bool enabled) { m_softwareCompositingEnabled = enabled; }
     void setThreadedCompositingEnabled(bool enabled) { m_threadedCompositingEnabled = enabled; }
@@ -136,6 +137,7 @@ public:
     void setDeferred2dCanvasEnabled(bool enabled) { m_deferred2dCanvasEnabled = enabled; }
     void setAcceleratedPaintingEnabled(bool enabled) { m_acceleratedPaintingEnabled = enabled; }
     void setPerTilePaintingEnabled(bool);
+    void setAcceleratedAnimationEnabled(bool);
     void setDeferredImageDecodingEnabled(bool enabled) { m_deferredImageDecodingEnabled = enabled; }
 #if defined(OS_WIN)
     // Access to the finished event. Used by the static WatchDog thread.
@@ -227,6 +229,7 @@ private:
     int m_timeout; // timeout value in millisecond
     bool m_allowExternalPages;
     bool m_acceleratedCompositingForVideoEnabled;
+    bool m_acceleratedCompositingForFixedPositionEnabled;
     bool m_softwareCompositingEnabled;
     bool m_threadedCompositingEnabled;
     bool m_forceCompositingMode;
diff --git a/Tools/DumpRenderTree/chromium/TestWebPlugin.cpp b/Tools/DumpRenderTree/chromium/TestWebPlugin.cpp
index 7080bef18..414db2c1c 100644
--- a/Tools/DumpRenderTree/chromium/TestWebPlugin.cpp
+++ b/Tools/DumpRenderTree/chromium/TestWebPlugin.cpp
@@ -206,6 +206,8 @@ void TestWebPlugin::updateGeometry(const WebRect& frameRect,
     if (clipRect == m_rect)
         return;
     m_rect = clipRect;
+    if (m_rect.isEmpty())
+        return;
 
     m_context->reshape(m_rect.width, m_rect.height);
     m_context->viewport(0, 0, m_rect.width, m_rect.height);
diff --git a/Tools/DumpRenderTree/chromium/WebPreferences.cpp b/Tools/DumpRenderTree/chromium/WebPreferences.cpp
index 5c8c92c99..46afbbdb2 100644
--- a/Tools/DumpRenderTree/chromium/WebPreferences.cpp
+++ b/Tools/DumpRenderTree/chromium/WebPreferences.cpp
@@ -85,6 +85,7 @@ void WebPreferences::reset()
     javaEnabled = false;
     javaScriptCanAccessClipboard = true;
     javaScriptCanOpenWindowsAutomatically = true;
+    supportsMultipleWindows = true;
     javaScriptEnabled = true;
     loadsImagesAutomatically = true;
     localStorageEnabled = true;
@@ -111,6 +112,7 @@ void WebPreferences::reset()
     tabsToLinks = false;
     hyperlinkAuditingEnabled = false;
     acceleratedCompositingForVideoEnabled = false;
+    acceleratedCompositingForFixedPositionEnabled = false;
     acceleratedCompositingEnabled = false;
     accelerated2dCanvasEnabled = false;
     deferred2dCanvasEnabled = false;
@@ -120,6 +122,7 @@ void WebPreferences::reset()
     mediaPlaybackRequiresUserGesture = false;
     mockScrollbarsEnabled = false;
     cssCustomFilterEnabled = false;
+    shouldRespectImageOrientation = false;
 }
 
 static void setStandardFontFamilyWrapper(WebSettings* settings, const WebKit::WebString& font, UScriptCode script)
@@ -201,6 +204,7 @@ void WebPreferences::applyTo(WebView* webView)
     settings->setJavaEnabled(javaEnabled);
     settings->setJavaScriptCanAccessClipboard(javaScriptCanAccessClipboard);
     settings->setJavaScriptCanOpenWindowsAutomatically(javaScriptCanOpenWindowsAutomatically);
+    settings->setSupportsMultipleWindows(supportsMultipleWindows);
     settings->setJavaScriptEnabled(javaScriptEnabled);
     settings->setLoadsImagesAutomatically(loadsImagesAutomatically);
     settings->setLocalStorageEnabled(localStorageEnabled);
@@ -221,6 +225,8 @@ void WebPreferences::applyTo(WebView* webView)
     settings->setCaretBrowsingEnabled(caretBrowsingEnabled);
     settings->setAcceleratedCompositingEnabled(acceleratedCompositingEnabled);
     settings->setAcceleratedCompositingForVideoEnabled(acceleratedCompositingForVideoEnabled);
+    settings->setAcceleratedCompositingForFixedPositionEnabled(acceleratedCompositingForFixedPositionEnabled);
+    settings->setFixedPositionCreatesStackingContext(acceleratedCompositingForFixedPositionEnabled);
     settings->setForceCompositingMode(forceCompositingMode);
     settings->setAccelerated2dCanvasEnabled(accelerated2dCanvasEnabled);
     settings->setDeferred2dCanvasEnabled(deferred2dCanvasEnabled);
@@ -229,6 +235,7 @@ void WebPreferences::applyTo(WebView* webView)
     settings->setMediaPlaybackRequiresUserGesture(mediaPlaybackRequiresUserGesture);
     settings->setMockScrollbarsEnabled(mockScrollbarsEnabled);
     settings->setApplyDefaultDeviceScaleFactorInCompositor(forceCompositingMode);
+    settings->setShouldRespectImageOrientation(shouldRespectImageOrientation);
 
     // Fixed values.
     settings->setTextDirectionSubmenuInclusionBehaviorNeverIncluded();
diff --git a/Tools/DumpRenderTree/chromium/WebPreferences.h b/Tools/DumpRenderTree/chromium/WebPreferences.h
index e0315f2d0..36fcd196f 100644
--- a/Tools/DumpRenderTree/chromium/WebPreferences.h
+++ b/Tools/DumpRenderTree/chromium/WebPreferences.h
@@ -87,6 +87,7 @@ struct WebPreferences {
     bool javaEnabled;
     bool javaScriptCanAccessClipboard;
     bool javaScriptCanOpenWindowsAutomatically;
+    bool supportsMultipleWindows;
     bool javaScriptEnabled;
     bool loadsImagesAutomatically;
     bool localStorageEnabled;
@@ -104,6 +105,7 @@ struct WebPreferences {
     bool hyperlinkAuditingEnabled;
     bool caretBrowsingEnabled;
     bool acceleratedCompositingForVideoEnabled;
+    bool acceleratedCompositingForFixedPositionEnabled;
     bool acceleratedCompositingEnabled;
     bool forceCompositingMode;
     bool accelerated2dCanvasEnabled;
@@ -113,6 +115,7 @@ struct WebPreferences {
     bool mediaPlaybackRequiresUserGesture;
     bool mockScrollbarsEnabled;
     bool cssCustomFilterEnabled;
+    bool shouldRespectImageOrientation;
 
     WebPreferences() { reset(); }
     void reset();
diff --git a/Tools/DumpRenderTree/chromium/WebViewHost.cpp b/Tools/DumpRenderTree/chromium/WebViewHost.cpp
index 18422db58..98b87bf8e 100644
--- a/Tools/DumpRenderTree/chromium/WebViewHost.cpp
+++ b/Tools/DumpRenderTree/chromium/WebViewHost.cpp
@@ -696,6 +696,12 @@ void WebViewHost::postAccessibilityNotification(const WebAccessibilityObject& ob
     case WebAccessibilityNotificationInvalidStatusChanged:
         notificationName = "InvalidStatusChanged";
         break;
+    case WebAccessibilityNotificationTextChanged:
+        notificationName = "TextChanged";
+        break;
+    case WebAccessibilityNotificationAriaAttributeChanged:
+        notificationName = "AriaAttributeChanged";
+        break;
     default:
         notificationName = "UnknownNotification";
         break;
@@ -1480,7 +1486,7 @@ void WebViewHost::setGamepadData(const WebGamepads& pads)
     webkit_support::SetGamepadData(pads);
 }
 
-void WebViewHost::printMessage(const std::string& message) const
+void WebViewHost::printMessage(const std::string& message)
 {
     printf("%s", message.c_str());
 }
@@ -1500,6 +1506,16 @@ WebString WebViewHost::registerIsolatedFileSystem(const WebVector<WebString>& ab
     return webkit_support::RegisterIsolatedFileSystem(absoluteFilenames);
 }
 
+long long WebViewHost::getCurrentTimeInMillisecond()
+{
+    return webkit_support::GetCurrentTimeInMillisecond();
+}
+
+WebKit::WebString WebViewHost::getAbsoluteWebStringFromUTF8Path(const std::string& path)
+{
+    return webkit_support::GetAbsoluteWebStringFromUTF8Path(path);
+}
+
 // Public functions -----------------------------------------------------------
 
 WebViewHost::WebViewHost(TestShell* shell)
diff --git a/Tools/DumpRenderTree/chromium/WebViewHost.h b/Tools/DumpRenderTree/chromium/WebViewHost.h
index 41237cba9..86007194b 100644
--- a/Tools/DumpRenderTree/chromium/WebViewHost.h
+++ b/Tools/DumpRenderTree/chromium/WebViewHost.h
@@ -135,10 +135,12 @@ class WebViewHost : public WebKit::WebViewClient, public WebKit::WebFrameClient,
     virtual void clearEditCommand() OVERRIDE;
     virtual void fillSpellingSuggestionList(const WebKit::WebString& word, WebKit::WebVector<WebKit::WebString>* suggestions) OVERRIDE;
     virtual void setGamepadData(const WebKit::WebGamepads&) OVERRIDE;
-    virtual void printMessage(const std::string& message) const OVERRIDE;
+    virtual void printMessage(const std::string& message) OVERRIDE;
     virtual void postTask(WebTestRunner::WebTask*) OVERRIDE;
     virtual void postDelayedTask(WebTestRunner::WebTask*, long long ms) OVERRIDE;
     virtual WebKit::WebString registerIsolatedFileSystem(const WebKit::WebVector<WebKit::WebString>& absoluteFilenames) OVERRIDE;
+    virtual long long getCurrentTimeInMillisecond() OVERRIDE;
+    virtual WebKit::WebString getAbsoluteWebStringFromUTF8Path(const std::string& path) OVERRIDE;
 
     // NavigationHost
     virtual bool navigate(const TestNavigationEntry&, bool reload);
diff --git a/Tools/DumpRenderTree/efl/DumpRenderTree.cpp b/Tools/DumpRenderTree/efl/DumpRenderTree.cpp
index a0dec4e7a..3d1c112e0 100644
--- a/Tools/DumpRenderTree/efl/DumpRenderTree.cpp
+++ b/Tools/DumpRenderTree/efl/DumpRenderTree.cpp
@@ -66,6 +66,7 @@ RefPtr<TestRunner> gTestRunner;
 volatile bool done = false;
 
 static bool dumpPixelsForCurrentTest;
+static int dumpPixelsForAllTests = false;
 static int dumpTree = true;
 static int printSeparators = true;
 
@@ -192,6 +193,7 @@ static bool parseCommandLineOptions(int argc, char** argv)
 {
     static const option options[] = {
         {"notree", no_argument, &dumpTree, false},
+        {"pixel-tests", no_argument, &dumpPixelsForAllTests, true},
         {"tree", no_argument, &dumpTree, true},
         {0, 0, 0, 0}
     };
@@ -258,7 +260,7 @@ static void runTest(const char* inputLine)
     TestCommand command = parseInputLine(inputLine);
     const String testPathOrURL(command.pathOrURL.c_str());
     ASSERT(!testPathOrURL.isEmpty());
-    dumpPixelsForCurrentTest = command.shouldDumpPixels;
+    dumpPixelsForCurrentTest = command.shouldDumpPixels || dumpPixelsForAllTests;
     const String expectedPixelHash(command.expectedPixelHash.c_str());
 
     // Convert the path into a full file URL if it does not look
@@ -419,7 +421,11 @@ void dump()
 
 static Ecore_Evas* initEcoreEvas()
 {
-    Ecore_Evas* ecoreEvas = ecore_evas_new(0, 0, 0, 800, 600, 0);
+    const char* engine = 0;
+#if defined(WTF_USE_ACCELERATED_COMPOSITING) && defined(HAVE_ECORE_X)
+    engine = "opengl_x11";
+#endif
+    Ecore_Evas* ecoreEvas = ecore_evas_new(engine, 0, 0, 800, 600, 0);
     if (!ecoreEvas) {
         shutdownEfl();
         exit(EXIT_FAILURE);
diff --git a/Tools/DumpRenderTree/efl/DumpRenderTreeChrome.cpp b/Tools/DumpRenderTree/efl/DumpRenderTreeChrome.cpp
index d1ba5ff8f..fb9c717e2 100644
--- a/Tools/DumpRenderTree/efl/DumpRenderTreeChrome.cpp
+++ b/Tools/DumpRenderTree/efl/DumpRenderTreeChrome.cpp
@@ -196,6 +196,8 @@ void DumpRenderTreeChrome::removeWindow(Evas_Object* view)
 
 bool DumpRenderTreeChrome::initialize()
 {
+    // Notifies that DRT is running for ewkView to create testable objects.
+    DumpRenderTreeSupportEfl::setDumpRenderTreeModeEnabled(true);
     DumpRenderTreeSupportEfl::setMockScrollbarsEnabled(true);
 
     m_mainView = createView();
@@ -308,6 +310,7 @@ void DumpRenderTreeChrome::resetDefaultsToConsistentValues()
     DumpRenderTreeSupportEfl::clearOpener(mainFrame());
     DumpRenderTreeSupportEfl::clearUserScripts(mainView());
     DumpRenderTreeSupportEfl::clearUserStyleSheets(mainView());
+    DumpRenderTreeSupportEfl::resetGeolocationClientMock(mainView());
     DumpRenderTreeSupportEfl::setInteractiveFormValidationEnabled(mainView(), true);
     DumpRenderTreeSupportEfl::setValidationMessageTimerMagnification(mainView(), -1);
     DumpRenderTreeSupportEfl::setAuthorAndUserStylesEnabled(mainView(), true);
diff --git a/Tools/DumpRenderTree/efl/EventSender.cpp b/Tools/DumpRenderTree/efl/EventSender.cpp
index 78d2dbcf3..e2ff5e1f6 100644
--- a/Tools/DumpRenderTree/efl/EventSender.cpp
+++ b/Tools/DumpRenderTree/efl/EventSender.cpp
@@ -269,6 +269,102 @@ static unsigned modifiersFromJSValue(JSContextRef context, const JSValueRef modi
     return modifier;
 }
 
+static JSValueRef getMenuItemTitleCallback(JSContextRef context, JSObjectRef object, JSStringRef propertyName, JSValueRef* exception)
+{
+    Ewk_Context_Menu_Item* item = static_cast<Ewk_Context_Menu_Item*>(JSObjectGetPrivate(object));
+    CString label;
+    if (ewk_context_menu_item_type_get(item) == EWK_SEPARATOR_TYPE)
+        label = "<separator>";
+    else
+        label = ewk_context_menu_item_title_get(item);
+
+    return JSValueMakeString(context, JSStringCreateWithUTF8CString(label.data()));
+}
+
+static bool setMenuItemTitleCallback(JSContextRef context, JSObjectRef object, JSStringRef propertyName, JSValueRef value, JSValueRef* exception)
+{
+    return true;
+}
+
+static JSValueRef menuItemClickCallback(JSContextRef context, JSObjectRef function, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
+{
+    Ewk_Context_Menu_Item* item = static_cast<Ewk_Context_Menu_Item*>(JSObjectGetPrivate(thisObject));
+    ewk_context_menu_item_select(ewk_context_menu_item_parent_get(item), item);
+    return JSValueMakeUndefined(context);
+}
+
+static JSStaticFunction staticMenuItemFunctions[] = {
+    { "click", menuItemClickCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
+    { 0, 0, 0 }
+};
+
+static JSStaticValue staticMenuItemValues[] = {
+    { "title", getMenuItemTitleCallback, setMenuItemTitleCallback, kJSPropertyAttributeNone },
+    { 0, 0, 0, 0 }
+};
+
+static JSClassRef getMenuItemClass()
+{
+    static JSClassRef menuItemClass = 0;
+
+    if (!menuItemClass) {
+        JSClassDefinition classDefinition = {
+            0, 0, 0, 0, 0, 0,
+            0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0};
+        classDefinition.staticFunctions = staticMenuItemFunctions;
+        classDefinition.staticValues = staticMenuItemValues;
+
+        menuItemClass = JSClassCreate(&classDefinition);
+    }
+
+    return menuItemClass;
+}
+
+static JSValueRef contextClickCallback(JSContextRef context, JSObjectRef function, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
+{
+    Evas_Object* view = ewk_frame_view_get(browser->mainFrame());
+    if (!view)
+        return JSValueMakeUndefined(context);
+
+    Evas* evas = evas_object_evas_get(view);
+    if (!evas)
+        return JSValueMakeUndefined(context);
+
+    Evas_Event_Mouse_Down mouseDown;
+    mouseDown.button = 3;
+    mouseDown.output.x = gLastMousePositionX;
+    mouseDown.output.y = gLastMousePositionY;
+    mouseDown.canvas.x = gLastMousePositionX;
+    mouseDown.canvas.y = gLastMousePositionY;
+    mouseDown.data = 0;
+    mouseDown.modifiers = const_cast<Evas_Modifier*>(evas_key_modifier_get(evas));
+    mouseDown.locks = const_cast<Evas_Lock*>(evas_key_lock_get(evas));
+    mouseDown.flags = EVAS_BUTTON_NONE;
+    mouseDown.timestamp = ecore_loop_time_get();
+    mouseDown.event_flags = EVAS_EVENT_FLAG_NONE;
+    mouseDown.dev = 0;
+
+    ewk_view_context_menu_forward_event(view, &mouseDown);
+    Ewk_Context_Menu* ewkMenu = ewk_view_context_menu_get(view);
+
+    JSValueRef valueRef = JSObjectMakeArray(context, 0, 0, 0);
+    if (ewkMenu) {
+        const Eina_List* ewkMenuItems = ewk_context_menu_item_list_get(ewkMenu);
+        JSValueRef arrayValues[eina_list_count(ewkMenuItems)];
+
+        const Eina_List* listIterator;
+        void* data;
+        int index = 0;
+        EINA_LIST_FOREACH(ewkMenuItems, listIterator, data)
+            arrayValues[index++] = JSObjectMake(context, getMenuItemClass(), data);
+
+        if (index)
+            valueRef = JSObjectMakeArray(context, index - 1, arrayValues, 0);
+    }
+
+    return valueRef;
+}
+
 static JSValueRef mouseDownCallback(JSContextRef context, JSObjectRef function, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
 {
     int button = 0;
@@ -803,6 +899,7 @@ static JSValueRef setTouchModifierCallback(JSContextRef context, JSObjectRef fun
 }
 
 static JSStaticFunction staticFunctions[] = {
+    { "contextClick", contextClickCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
     { "mouseScrollBy", mouseScrollByCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
     { "continuousMouseScrollBy", continuousMouseScrollByCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
     { "mouseDown", mouseDownCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
diff --git a/Tools/DumpRenderTree/efl/PixelDumpSupportEfl.cpp b/Tools/DumpRenderTree/efl/PixelDumpSupportEfl.cpp
index efc506160..446483652 100644
--- a/Tools/DumpRenderTree/efl/PixelDumpSupportEfl.cpp
+++ b/Tools/DumpRenderTree/efl/PixelDumpSupportEfl.cpp
@@ -47,13 +47,12 @@ PassRefPtr<BitmapContext> createBitmapContextFromWebView(bool, bool, bool, bool
     const Evas_Object* mainFrame = browser->mainFrame();
 
     int x, y, width, height;
-    if (!ewk_frame_visible_content_geometry_get(mainFrame, EINA_TRUE, &x, &y, &width, &height))
-        return 0;
+    evas_object_geometry_get(browser->mainFrame(), &x, &y, &width, &height);
+    const Eina_Rectangle rect = { x, y, width, height };
 
-    RefPtr<cairo_surface_t> surface = adoptRef(cairo_image_surface_create(CAIRO_FORMAT_ARGB32, width, height));
+    RefPtr<cairo_surface_t> surface = adoptRef(cairo_image_surface_create(CAIRO_FORMAT_ARGB32, rect.w, rect.h));
     RefPtr<cairo_t> context = adoptRef(cairo_create(surface.get()));
 
-    const Eina_Rectangle rect = { x, y, width, height };
     if (!ewk_view_paint(privateData, context.get(), &rect))
         return 0;
 
diff --git a/Tools/DumpRenderTree/efl/TestRunnerEfl.cpp b/Tools/DumpRenderTree/efl/TestRunnerEfl.cpp
index 19703aee6..cd78b10aa 100644
--- a/Tools/DumpRenderTree/efl/TestRunnerEfl.cpp
+++ b/Tools/DumpRenderTree/efl/TestRunnerEfl.cpp
@@ -365,30 +365,41 @@ void TestRunner::setMockDeviceOrientation(bool, double, bool, double, bool, doub
     notImplemented();
 }
 
-void TestRunner::setMockGeolocationPosition(double, double, double, bool, double, bool, double, bool, double, bool, double)
+void TestRunner::setMockGeolocationPosition(double latitude, double longitude, double accuracy, bool canProvideAltitude, double altitude, bool canProvideAltitudeAccuracy, double altitudeAccuracy, bool canProvideHeading, double heading, bool canProvideSpeed, double speed)
 {
-    // FIXME: Implement for Geolocation layout tests.
-    // See https://bugs.webkit.org/show_bug.cgi?id=28264.
-    notImplemented();
+    Evas_Object* view = browser->mainView();
+    if (browser->extraViews().size() > 0)
+        view = browser->extraViews().last();
+
+    DumpRenderTreeSupportEfl::setMockGeolocationPosition(view, latitude, longitude, accuracy, canProvideAltitude, altitude, canProvideAltitudeAccuracy, altitudeAccuracy, canProvideHeading, heading, canProvideSpeed, speed);
 }
 
-void TestRunner::setMockGeolocationPositionUnavailableError(JSStringRef)
+void TestRunner::setMockGeolocationPositionUnavailableError(JSStringRef message)
 {
-    // FIXME: Implement for Geolocation layout tests.
-    // See https://bugs.webkit.org/show_bug.cgi?id=28264.
-    notImplemented();
+    Evas_Object* view = browser->mainView();
+    if (browser->extraViews().size() > 0)
+        view = browser->extraViews().last();
+
+    DumpRenderTreeSupportEfl::setMockGeolocationPositionUnavailableError(view, message->string().utf8().data());
 }
 
 void TestRunner::setGeolocationPermission(bool allow)
 {
-    // FIXME: Implement for Geolocation layout tests.
     setGeolocationPermissionCommon(allow);
+    Evas_Object* view = browser->mainView();
+    if (browser->extraViews().size() > 0)
+        view = browser->extraViews().last();
+
+    DumpRenderTreeSupportEfl::setMockGeolocationPermission(view, allow);
 }
 
 int TestRunner::numberOfPendingGeolocationPermissionRequests()
 {
-    // FIXME: Implement for Geolocation layout tests.
-    return -1;
+    Evas_Object* view = browser->mainView();
+    if (browser->extraViews().size() > 0)
+        view = browser->extraViews().last();
+
+    return DumpRenderTreeSupportEfl::numberOfPendingGeolocationPermissionRequests(view);
 }
 
 void TestRunner::addMockSpeechInputResult(JSStringRef, double, JSStringRef)
diff --git a/Tools/DumpRenderTree/gtk/DumpRenderTree.cpp b/Tools/DumpRenderTree/gtk/DumpRenderTree.cpp
index f574c11e8..bf687b2d3 100644
--- a/Tools/DumpRenderTree/gtk/DumpRenderTree.cpp
+++ b/Tools/DumpRenderTree/gtk/DumpRenderTree.cpp
@@ -73,6 +73,7 @@ extern gchar* webkit_web_frame_get_response_mime_type(WebKitWebFrame* frame);
 
 volatile bool done;
 static bool printSeparators;
+static int dumpPixelsForAllTests = false;
 static bool dumpPixelsForCurrentTest;
 static int dumpTree = 1;
 static int useTimeoutWatchdog = 1;
@@ -548,6 +549,7 @@ static void initializeGlobalsFromCommandLineOptions(int argc, char *argv[])
 {
     struct option options[] = {
         {"notree", no_argument, &dumpTree, false},
+        {"pixel-tests", no_argument, &dumpPixelsForAllTests, true},
         {"tree", no_argument, &dumpTree, true},
         {"no-timeout", no_argument, &useTimeoutWatchdog, false},
         {NULL, 0, NULL, 0}
@@ -645,10 +647,6 @@ static void setDefaultsToConsistentStateValuesForTesting()
 {
     resetDefaultsToConsistentValues();
 
-    /* Disable the default auth dialog for testing */
-    SoupSession* session = webkit_get_default_session();
-    soup_session_remove_feature_by_type(session, WEBKIT_TYPE_SOUP_AUTH_DIALOG);
-
 #if PLATFORM(X11)
     webkit_web_settings_add_extra_plugin_directory(webView, TEST_PLUGIN_DIR);
 #endif
@@ -696,7 +694,7 @@ static void runTest(const string& inputLine)
 
     TestCommand command = parseInputLine(inputLine);
     string& testURL = command.pathOrURL;
-    dumpPixelsForCurrentTest = command.shouldDumpPixels;
+    dumpPixelsForCurrentTest = command.shouldDumpPixels || dumpPixelsForAllTests;
 
     // Convert the path into a full file URL if it does not look
     // like an HTTP/S URL (doesn't start with http:// or https://).
diff --git a/Tools/DumpRenderTree/mac/Configurations/Base.xcconfig b/Tools/DumpRenderTree/mac/Configurations/Base.xcconfig
index 3bc7a2a84..be91f5e50 100644
--- a/Tools/DumpRenderTree/mac/Configurations/Base.xcconfig
+++ b/Tools/DumpRenderTree/mac/Configurations/Base.xcconfig
@@ -21,8 +21,8 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 
-#include "CompilerVersion.xcconfig"
-
+CLANG_CXX_LANGUAGE_STANDARD = gnu++0x;
+CLANG_CXX_LIBRARY = libc++;
 CLANG_WARN_CXX0X_EXTENSIONS = NO;
 HEADER_SEARCH_PATHS = $(BUILT_PRODUCTS_DIR)/usr/local/include ForwardingHeaders mac/InternalHeaders $(NEXT_ROOT)/usr/local/include/WebCoreTestSupport ${SRCROOT}/../../Source/JavaScriptCore/icu;
 FRAMEWORK_SEARCH_PATHS = $(SYSTEM_LIBRARY_DIR)/Frameworks/Quartz.framework/Frameworks $(SYSTEM_LIBRARY_DIR)/Frameworks/ApplicationServices.framework/Frameworks $(SYSTEM_LIBRARY_DIR)/Frameworks/CoreServices.framework/Frameworks;
@@ -34,29 +34,17 @@ GCC_ENABLE_CPP_RTTI = NO;
 GCC_OBJC_CALL_CXX_CDTORS = YES
 GCC_PRECOMPILE_PREFIX_HEADER = YES
 GCC_TREAT_WARNINGS_AS_ERRORS = YES
+GCC_VERSION = com.apple.compilers.llvm.clang.1_0;
 GCC_WARN_ABOUT_DEPRECATED_FUNCTIONS = NO
 GCC_WARN_UNUSED_FUNCTION = YES
 GCC_WARN_UNUSED_VARIABLE = YES
 WARNING_CFLAGS = -Wall -W -Wno-unused-parameter -Wundef
 LINKER_DISPLAYS_MANGLED_NAMES = YES;
 
-CLANG_CXX_LIBRARY = $(CLANG_CXX_LIBRARY_$(TARGET_MAC_OS_X_VERSION_MAJOR));
-CLANG_CXX_LIBRARY_1060 = libstdc++;
-CLANG_CXX_LIBRARY_1070 = libc++;
-CLANG_CXX_LIBRARY_1080 = libc++;
-CLANG_CXX_LIBRARY_1090 = libc++;
-
-REAL_PLATFORM_NAME = $(REAL_PLATFORM_NAME_$(PLATFORM_NAME));
-REAL_PLATFORM_NAME_ = $(REAL_PLATFORM_NAME_macosx);
-REAL_PLATFORM_NAME_iphoneos = iphoneos;
-REAL_PLATFORM_NAME_iphonesimulator = iphonesimulator;
-REAL_PLATFORM_NAME_macosx = macosx;
-
 TARGET_MAC_OS_X_VERSION_MAJOR = $(MAC_OS_X_VERSION_MAJOR);
 
 
 TARGETING_SAME_OS_X_VERSION = $(TARGETING_SAME_OS_X_VERSION_$(MAC_OS_X_VERSION_MAJOR)_$(TARGET_MAC_OS_X_VERSION_MAJOR));
-TARGETING_SAME_OS_X_VERSION_1060_1060 = YES;
 TARGETING_SAME_OS_X_VERSION_1070_1070 = YES;
 TARGETING_SAME_OS_X_VERSION_1080_1080 = YES;
 TARGETING_SAME_OS_X_VERSION_1090_1090 = YES;
diff --git a/Tools/DumpRenderTree/mac/Configurations/CompilerVersion.xcconfig b/Tools/DumpRenderTree/mac/Configurations/CompilerVersion.xcconfig
deleted file mode 100644
index a8c7f75a0..000000000
--- a/Tools/DumpRenderTree/mac/Configurations/CompilerVersion.xcconfig
+++ /dev/null
@@ -1,84 +0,0 @@
-// Copyright (C) 2009, 2010, 2011 Apple Inc. All rights reserved.
-//
-// Redistribution and use in source and binary forms, with or without
-// modification, are permitted provided that the following conditions
-// are met:
-// 1. Redistributions of source code must retain the above copyright
-//    notice, this list of conditions and the following disclaimer.
-// 2. Redistributions in binary form must reproduce the above copyright
-//    notice, this list of conditions and the following disclaimer in the
-//    documentation and/or other materials provided with the distribution.
-//
-// THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
-// EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
-// IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
-// PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
-// CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
-// EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
-// PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
-// PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
-// OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
-
-IS_XCODE_0400 = $(IS_XCODE_0400_$(XCODE_VERSION_MINOR));
-IS_XCODE_0400_0400 = YES;
-
-IS_XCODE_0400_OR_0410 = $(IS_XCODE_0400_OR_0410_$(XCODE_VERSION_MINOR));
-IS_XCODE_0400_OR_0410_0400 = YES;
-IS_XCODE_0400_OR_0410_0410 = YES;
-
-// The version of the LLVM Compiler in Xcode 4.0 and earlier have difficulty compiling our code.
-LLVM_COMPILER_UNSUITABLE_FOR_DEBUG_BUILDS = $(LLVM_COMPILER_UNSUITABLE_FOR_DEBUG_BUILDS_$(XCODE_VERSION_MAJOR));
-LLVM_COMPILER_UNSUITABLE_FOR_DEBUG_BUILDS_0300 = YES;
-LLVM_COMPILER_UNSUITABLE_FOR_DEBUG_BUILDS_0400 = $(LLVM_COMPILER_UNSUITABLE_FOR_DEBUG_BUILDS_IS_XCODE_0400_$(IS_XCODE_0400));
-LLVM_COMPILER_UNSUITABLE_FOR_DEBUG_BUILDS_IS_XCODE_0400_YES = YES;
-
-// The version of the LLVM Compiler in Xcode 4.1 and earlier do not generate fast enough code.
-LLVM_COMPILER_UNSUITABLE_FOR_OPTIMIZED_BUILDS = $(LLVM_COMPILER_UNSUITABLE_FOR_OPTIMIZED_BUILDS_$(XCODE_VERSION_MAJOR));
-LLVM_COMPILER_UNSUITABLE_FOR_OPTIMIZED_BUILDS_0300 = YES;
-LLVM_COMPILER_UNSUITABLE_FOR_OPTIMIZED_BUILDS_0400 = $(LLVM_COMPILER_UNSUITABLE_FOR_OPTIMIZED_BUILDS_IS_XCODE_0400_OR_0410_$(IS_XCODE_0400_OR_0410));
-LLVM_COMPILER_UNSUITABLE_FOR_OPTIMIZED_BUILDS_IS_XCODE_0400_OR_0410_YES = YES;
-
-LLVM_COMPILER_SUITABLE_FOR_DEBUG_BUILDS = $(LLVM_COMPILER_SUITABLE_FOR_DEBUG_BUILDS_$(LLVM_COMPILER_UNSUITABLE_FOR_DEBUG_BUILDS));
-LLVM_COMPILER_SUITABLE_FOR_DEBUG_BUILDS_ = YES;
-LLVM_COMPILER_SUITABLE_FOR_DEBUG_BUILDS_YES = NO;
-
-LLVM_COMPILER_SUITABLE_FOR_OPTIMIZED_BUILDS = $(LLVM_COMPILER_SUITABLE_FOR_OPTIMIZED_BUILDS_$(LLVM_COMPILER_UNSUITABLE_FOR_OPTIMIZED_BUILDS));
-LLVM_COMPILER_SUITABLE_FOR_OPTIMIZED_BUILDS_ = YES;
-LLVM_COMPILER_SUITABLE_FOR_OPTIMIZED_BUILDS_YES = NO;
-
-
-// Use GCC 4.2 with Xcode 3.1, which includes GCC 4.2 but defaults to GCC 4.0.
-// Note that Xcode versions as new as 3.1.2 use XCODE_VERSION_ACTUAL for the minor version
-// number.  Newer versions of Xcode use XCODE_VERSION_MINOR for the minor version, and
-// XCODE_VERSION_ACTUAL for the full version number.
-TARGET_GCC_VERSION = $(TARGET_GCC_VERSION_$(REAL_PLATFORM_NAME));
-TARGET_GCC_VERSION_iphoneos = LLVM_GCC_42;
-TARGET_GCC_VERSION_iphonesimulator = GCC_42;
-TARGET_GCC_VERSION_macosx = $(TARGET_GCC_VERSION_macosx_$(TARGET_MAC_OS_X_VERSION_MAJOR));
-
-TARGET_GCC_VERSION_macosx_1050 = $(TARGET_GCC_VERSION_macosx_1050_$(XCODE_VERSION_MINOR));
-TARGET_GCC_VERSION_macosx_1050_ = $(TARGET_GCC_VERSION_macosx_1050_$(XCODE_VERSION_ACTUAL));
-TARGET_GCC_VERSION_macosx_1050_0310 = GCC_42;
-TARGET_GCC_VERSION_macosx_1050_0320 = GCC_42;
-
-TARGET_GCC_VERSION_macosx_1060 = $(TARGET_GCC_VERSION_macosx_1060_AND_1070_$(CONFIGURATION));
-TARGET_GCC_VERSION_macosx_1070 = $(TARGET_GCC_VERSION_macosx_1060_AND_1070_$(CONFIGURATION));
-TARGET_GCC_VERSION_macosx_1060_AND_1070_Debug = $(TARGET_GCC_VERSION_macosx_USE_LLVM_COMPILER_$(LLVM_COMPILER_SUITABLE_FOR_DEBUG_BUILDS));
-TARGET_GCC_VERSION_macosx_1060_AND_1070_Release = $(TARGET_GCC_VERSION_macosx_USE_LLVM_COMPILER_$(LLVM_COMPILER_SUITABLE_FOR_OPTIMIZED_BUILDS));
-TARGET_GCC_VERSION_macosx_1060_AND_1070_Production = $(TARGET_GCC_VERSION_macosx_USE_LLVM_COMPILER_$(LLVM_COMPILER_SUITABLE_FOR_OPTIMIZED_BUILDS));
-TARGET_GCC_VERSION_macosx_1060_NON_LLVM_FALLBACK = GCC_42;
-TARGET_GCC_VERSION_macosx_1070_NON_LLVM_FALLBACK = LLVM_GCC_42;
-
-TARGET_GCC_VERSION_macosx_USE_LLVM_COMPILER_YES = LLVM_COMPILER;
-TARGET_GCC_VERSION_macosx_USE_LLVM_COMPILER_NO = $(TARGET_GCC_VERSION_macosx_$(TARGET_MAC_OS_X_VERSION_MAJOR)_NON_LLVM_FALLBACK);
-
-TARGET_GCC_VERSION_macosx_1080 = LLVM_COMPILER;
-TARGET_GCC_VERSION_macosx_1090 = LLVM_COMPILER;
-
-GCC_VERSION = $(GCC_VERSION_$(TARGET_GCC_VERSION));
-GCC_VERSION_GCC_40 = 4.0;
-GCC_VERSION_GCC_42 = 4.2;
-GCC_VERSION_LLVM_GCC_42 = com.apple.compilers.llvmgcc42;
-GCC_VERSION_LLVM_COMPILER = com.apple.compilers.llvm.clang.1_0;
diff --git a/Tools/DumpRenderTree/mac/Configurations/DebugRelease.xcconfig b/Tools/DumpRenderTree/mac/Configurations/DebugRelease.xcconfig
index 8e3528d2d..fd5ebdbd1 100644
--- a/Tools/DumpRenderTree/mac/Configurations/DebugRelease.xcconfig
+++ b/Tools/DumpRenderTree/mac/Configurations/DebugRelease.xcconfig
@@ -23,28 +23,19 @@
 
 #include "Base.xcconfig"
 
-ARCHS = $(ARCHS_$(TARGET_MAC_OS_X_VERSION_MAJOR));
-ARCHS_1050 = $(NATIVE_ARCH);
-ARCHS_1060 = $(ARCHS_STANDARD_32_64_BIT);
-ARCHS_1070 = $(ARCHS_STANDARD_32_64_BIT);
-ARCHS_1080 = $(ARCHS_STANDARD_32_64_BIT);
-ARCHS_1090 = $(ARCHS_STANDARD_32_64_BIT);
+ARCHS = $(ARCHS_STANDARD_32_64_BIT);
 
 ONLY_ACTIVE_ARCH = YES;
 
 MACOSX_DEPLOYMENT_TARGET = $(MACOSX_DEPLOYMENT_TARGET_$(TARGET_MAC_OS_X_VERSION_MAJOR))
-MACOSX_DEPLOYMENT_TARGET_1050 = 10.5;
-MACOSX_DEPLOYMENT_TARGET_1060 = 10.6;
 MACOSX_DEPLOYMENT_TARGET_1070 = 10.7;
 MACOSX_DEPLOYMENT_TARGET_1080 = 10.8;
 MACOSX_DEPLOYMENT_TARGET_1090 = 10.9;
 
-WEBKIT_SYSTEM_INTERFACE_LIBRARY = $(WEBKIT_SYSTEM_INTERFACE_LIBRARY_$(REAL_PLATFORM_NAME));
+WEBKIT_SYSTEM_INTERFACE_LIBRARY = $(WEBKIT_SYSTEM_INTERFACE_LIBRARY_$(PLATFORM_NAME));
 WEBKIT_SYSTEM_INTERFACE_LIBRARY_iphoneos = WebKitSystemInterface;
 WEBKIT_SYSTEM_INTERFACE_LIBRARY_iphonesimulator = $(WEBKIT_SYSTEM_INTERFACE_LIBRARY_iphoneos);
 WEBKIT_SYSTEM_INTERFACE_LIBRARY_macosx = $(WEBKIT_SYSTEM_INTERFACE_LIBRARY_macosx_$(TARGET_MAC_OS_X_VERSION_MAJOR));
-WEBKIT_SYSTEM_INTERFACE_LIBRARY_macosx_1050 = WebKitSystemInterfaceLeopard;
-WEBKIT_SYSTEM_INTERFACE_LIBRARY_macosx_1060 = WebKitSystemInterfaceSnowLeopard;
 WEBKIT_SYSTEM_INTERFACE_LIBRARY_macosx_1070 = WebKitSystemInterfaceLion;
 WEBKIT_SYSTEM_INTERFACE_LIBRARY_macosx_1080 = WebKitSystemInterfaceMountainLion;
 WEBKIT_SYSTEM_INTERFACE_LIBRARY_macosx_1090 = WebKitSystemInterfaceMountainLion;
diff --git a/Tools/DumpRenderTree/mac/DumpRenderTree.mm b/Tools/DumpRenderTree/mac/DumpRenderTree.mm
index 029b358a0..3cd121488 100644
--- a/Tools/DumpRenderTree/mac/DumpRenderTree.mm
+++ b/Tools/DumpRenderTree/mac/DumpRenderTree.mm
@@ -145,6 +145,7 @@ static HistoryDelegate *historyDelegate;
 PolicyDelegate *policyDelegate;
 StorageTrackerDelegate *storageDelegate;
 
+static int dumpPixelsForAllTests = NO;
 static bool dumpPixelsForCurrentTest;
 static int threaded;
 static int dumpTree = YES;
@@ -328,6 +329,7 @@ static NSSet *allowedFontFamilySet()
         @"STFangsong",
         @"STHeiti",
         @"STIXGeneral",
+        @"STIXSizeOneSym",
         @"STKaiti",
         @"STSong",
         @"Symbol",
@@ -614,6 +616,8 @@ static void resetDefaultsToConsistentValues()
     [defaults setObject:[path stringByAppendingPathComponent:@"LocalStorage"] forKey:WebStorageDirectoryDefaultsKey];
     [defaults setObject:[path stringByAppendingPathComponent:@"LocalCache"] forKey:WebKitLocalCacheDefaultsKey];
 
+    [defaults setBool:NO forKey:@"WebKitKerningAndLigaturesEnabledByDefault"];
+
     WebPreferences *preferences = [WebPreferences standardPreferences];
 
     [preferences setAllowUniversalAccessFromFileURLs:YES];
@@ -789,6 +793,7 @@ static void initializeGlobalsFromCommandLineOptions(int argc, const char *argv[]
 {
     struct option options[] = {
         {"notree", no_argument, &dumpTree, NO},
+        {"pixel-tests", no_argument, &dumpPixelsForAllTests, YES},
         {"tree", no_argument, &dumpTree, YES},
         {"threaded", no_argument, &threaded, YES},
         {"complex-text", no_argument, &forceComplexText, YES},
@@ -1297,7 +1302,7 @@ static void runTest(const string& inputLine)
 
     TestCommand command = parseInputLine(inputLine);
     const string& pathOrURL = command.pathOrURL;
-    dumpPixelsForCurrentTest = command.shouldDumpPixels;
+    dumpPixelsForCurrentTest = command.shouldDumpPixels || dumpPixelsForAllTests;
 
     NSString *pathOrURLString = [NSString stringWithUTF8String:pathOrURL.c_str()];
     if (!pathOrURLString) {
diff --git a/Tools/DumpRenderTree/mac/EventSendingController.mm b/Tools/DumpRenderTree/mac/EventSendingController.mm
index 482bf93db..6f328a566 100644
--- a/Tools/DumpRenderTree/mac/EventSendingController.mm
+++ b/Tools/DumpRenderTree/mac/EventSendingController.mm
@@ -57,6 +57,13 @@ enum MouseButton {
     NoMouseButton = -1
 };
 
+struct KeyMappingEntry {
+    int macKeyCode;
+    int macNumpadKeyCode;
+    unichar character;
+    NSString* characterName;
+};
+
 NSPoint lastMousePosition;
 NSPoint lastClickPosition;
 int lastClickButton = NoMouseButton;
@@ -699,14 +706,6 @@ static int buildModifierFlags(const WebScriptObject* modifiers)
         keyCode = 0x4C;
     else if ([character isEqualToString:@"\x8"])
         keyCode = 0x33;
-    else if ([character isEqualToString:@"7"])
-        keyCode = 0x1A;
-    else if ([character isEqualToString:@"5"])
-        keyCode = 0x17;
-    else if ([character isEqualToString:@"9"])
-        keyCode = 0x19;
-    else if ([character isEqualToString:@"0"])
-        keyCode = 0x1D;
     else if ([character isEqualToString:@"a"])
         keyCode = 0x00;
     else if ([character isEqualToString:@"b"])
@@ -716,6 +715,38 @@ static int buildModifierFlags(const WebScriptObject* modifiers)
     else if ([character isEqualToString:@"e"])
         keyCode = 0x0E;
 
+    KeyMappingEntry table[] = {
+        {0x2F, 0x41, '.', nil},
+        {0,    0x43, '*', nil},
+        {0,    0x45, '+', nil},
+        {0,    0x47, NSClearLineFunctionKey, @"clear"},
+        {0x2C, 0x4B, '/', nil},
+        {0,    0x4C, 3, @"enter" },
+        {0x1B, 0x4E, '-', nil},
+        {0x18, 0x51, '=', nil},
+        {0x1D, 0x52, '0', nil},
+        {0x12, 0x53, '1', nil},
+        {0x13, 0x54, '2', nil},
+        {0x14, 0x55, '3', nil},
+        {0x15, 0x56, '4', nil},
+        {0x17, 0x57, '5', nil},
+        {0x16, 0x58, '6', nil},
+        {0x1A, 0x59, '7', nil},
+        {0x1C, 0x5B, '8', nil},
+        {0x19, 0x5C, '9', nil},
+    };
+    for (unsigned i = 0; i < WTF_ARRAY_LENGTH(table); ++i) {
+        NSString* currentCharacterString = [NSString stringWithCharacters:&table[i].character length:1];
+        if ([character isEqualToString:currentCharacterString] || [character isEqualToString:table[i].characterName]) {
+            if (keyLocation == DOM_KEY_LOCATION_NUMPAD)
+                keyCode = table[i].macNumpadKeyCode;
+            else
+                keyCode = table[i].macKeyCode;
+            eventCharacter = currentCharacterString;
+            break;
+        }
+    }
+
     NSString *charactersIgnoringModifiers = eventCharacter;
 
     int modifierFlags = 0;
diff --git a/Tools/DumpRenderTree/mac/MockGeolocationProvider.mm b/Tools/DumpRenderTree/mac/MockGeolocationProvider.mm
index 6f75b7e16..4acaac04b 100644
--- a/Tools/DumpRenderTree/mac/MockGeolocationProvider.mm
+++ b/Tools/DumpRenderTree/mac/MockGeolocationProvider.mm
@@ -23,7 +23,7 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
-#include <wtf/Platform.h>
+#import "config.h"
 #import "MockGeolocationProvider.h"
 
 @implementation MockGeolocationProvider
diff --git a/Tools/DumpRenderTree/qt/DumpRenderTree.pro b/Tools/DumpRenderTree/qt/DumpRenderTree.pro
index 1b8d8d3d7..0bd0b16a6 100644
--- a/Tools/DumpRenderTree/qt/DumpRenderTree.pro
+++ b/Tools/DumpRenderTree/qt/DumpRenderTree.pro
@@ -14,6 +14,7 @@ WEBKIT += wtf javascriptcore webcore
 INCLUDEPATH += \
     $$PWD/ \
     $$PWD/.. \
+    $${ROOT_WEBKIT_DIR}/Source/WebCore/platform/qt \
     $${ROOT_WEBKIT_DIR}/Source/WebKit/qt/WebCoreSupport \
     $${ROOT_WEBKIT_DIR}/Source/WTF
 
@@ -21,8 +22,6 @@ QT = core gui network testlib webkitwidgets widgets
 have?(QTPRINTSUPPORT): QT += printsupport
 macx: QT += xml
 
-have?(FONTCONFIG): PKGCONFIG += fontconfig
-
 HEADERS += \
     $$PWD/../WorkQueue.h \
     $$PWD/../DumpRenderTree.h \
@@ -32,7 +31,6 @@ HEADERS += \
     WorkQueueItemQt.h \
     TestRunnerQt.h \
     GCControllerQt.h \
-    QtInitializeTestFonts.h \
     testplugin.h
 
 SOURCES += \
@@ -44,7 +42,6 @@ SOURCES += \
     WorkQueueItemQt.cpp \
     TestRunnerQt.cpp \
     GCControllerQt.cpp \
-    QtInitializeTestFonts.cpp \
     testplugin.cpp \
     DumpRenderTreeMain.cpp
 
diff --git a/Tools/DumpRenderTree/qt/DumpRenderTreeMain.cpp b/Tools/DumpRenderTree/qt/DumpRenderTreeMain.cpp
index 260360142..70b5d14e6 100644
--- a/Tools/DumpRenderTree/qt/DumpRenderTreeMain.cpp
+++ b/Tools/DumpRenderTree/qt/DumpRenderTreeMain.cpp
@@ -29,8 +29,7 @@
 
 #include "DumpRenderTreeQt.h"
 
-#include "QtInitializeTestFonts.h"
-
+#include "QtTestSupport.h"
 #include <qapplication.h>
 #include <qdebug.h>
 #include <qdir.h>
@@ -66,11 +65,11 @@ void messageHandler(QtMsgType type, const QMessageLogContext&, const QString &me
     // do nothing
 }
 
-// We only support -v or --stdout or --stderr or -, all the others will be
+// We only support -v, -p, --pixel-tests, --stdout, --stderr and -, all the others will be
 // pass as test case name (even -abc.html is a valid test case name)
 bool isOption(const QString& str)
 {
-    return str == QString("-v")
+    return str == QString("-v") || str == QString("-p") || str == QString("--pixel-tests")
            || str == QString("--stdout") || str == QString("--stderr")
            || str == QString("--timeout") || str == QString("--no-timeout")
            || str == QString("-");
@@ -89,8 +88,8 @@ QString takeOptionValue(QStringList& arguments, int index)
 
 void printUsage()
 {
-    fprintf(stderr, "Usage: DumpRenderTree [-v] [--stdout output_filename] [-stderr error_filename] [--no-timeout] [--timeout timeout_MS] filename [filename2..n]\n");
-    fprintf(stderr, "Or folder containing test files: DumpRenderTree [-v] dirpath\n");
+    fprintf(stderr, "Usage: DumpRenderTree [-v|-p|--pixel-tests] [--stdout output_filename] [-stderr error_filename] [--no-timeout] [--timeout timeout_MS] filename [filename2..n]\n");
+    fprintf(stderr, "Or folder containing test files: DumpRenderTree [-v|--pixel-tests] dirpath\n");
     fflush(stderr);
 }
 
@@ -115,7 +114,7 @@ int main(int argc, char* argv[])
     if (suppressQtDebugOutput)
         qInstallMessageHandler(messageHandler);
 
-    WebKit::initializeTestFonts();
+    WebKit::QtTestSupport::initializeTestFonts();
 
     QApplication::setStyle(new QWindowsStyle);
     QApplication::setDesktopSettingsAware(false);
@@ -156,6 +155,14 @@ int main(int argc, char* argv[])
             exit(1);
         }
     }
+    index = args.indexOf("--pixel-tests");
+    if (index == -1)
+        index = args.indexOf("-p");
+    if (index != -1) {
+        dumper.setShouldDumpPixelsForAllTests();
+        args.removeAt(index);
+    }
+
     QWebDatabase::removeAllDatabases();
 
     index = args.indexOf(QLatin1String("--timeout"));
diff --git a/Tools/DumpRenderTree/qt/DumpRenderTreeQt.cpp b/Tools/DumpRenderTree/qt/DumpRenderTreeQt.cpp
index 0d28cbcc1..ea114e6e0 100755
--- a/Tools/DumpRenderTree/qt/DumpRenderTreeQt.cpp
+++ b/Tools/DumpRenderTree/qt/DumpRenderTreeQt.cpp
@@ -36,9 +36,9 @@
 #include "DumpRenderTreeSupportQt.h"
 #include "EventSenderQt.h"
 #include "GCControllerQt.h"
+#include "QtTestSupport.h"
 #include "TestRunnerQt.h"
 #include "TextInputControllerQt.h"
-#include "QtInitializeTestFonts.h"
 #include "testplugin.h"
 #include "WorkQueue.h"
 
@@ -49,7 +49,6 @@
 #include <QFile>
 #include <QFileInfo>
 #include <QFocusEvent>
-#include <QFontDatabase>
 #include <QLabel>
 #include <QLocale>
 #include <QNetworkAccessManager>
@@ -389,7 +388,8 @@ WebViewGraphicsBased::WebViewGraphicsBased(QWidget* parent)
 }
 
 DumpRenderTree::DumpRenderTree()
-    : m_stdin(0)
+    : m_dumpPixelsForAllTests(false)
+    , m_stdin(0)
     , m_enableTextOutput(false)
     , m_standAloneMode(false)
     , m_graphicsBased(false)
@@ -623,9 +623,9 @@ void DumpRenderTree::open(const QUrl& url)
     QFocusEvent ev(QEvent::FocusIn);
     m_page->event(&ev);
 
-    QWebSettings::clearMemoryCaches();
-    QFontDatabase::removeAllApplicationFonts();
-    WebKit::initializeTestFonts();
+    WebKit::QtTestSupport::clearMemoryCaches();
+
+    WebKit::QtTestSupport::initializeTestFonts();
 
     DumpRenderTreeSupportQt::dumpFrameLoader(url.toString().contains("loading/"));
     setTextOutputEnabled(true);
@@ -692,7 +692,7 @@ void DumpRenderTree::processLine(const QString &input)
 {
     TestCommand command = parseInputLine(std::string(input.toLatin1().constData()));
     QString pathOrURL = QLatin1String(command.pathOrURL.c_str());
-    m_dumpPixelsForCurrentTest = command.shouldDumpPixels;
+    m_dumpPixelsForCurrentTest = command.shouldDumpPixels || m_dumpPixelsForAllTests;
     m_expectedHash = QLatin1String(command.expectedPixelHash.c_str());
 
     if (pathOrURL.startsWith(QLatin1String("http:"))
diff --git a/Tools/DumpRenderTree/qt/DumpRenderTreeQt.h b/Tools/DumpRenderTree/qt/DumpRenderTreeQt.h
index 710f17343..98429c44e 100644
--- a/Tools/DumpRenderTree/qt/DumpRenderTreeQt.h
+++ b/Tools/DumpRenderTree/qt/DumpRenderTreeQt.h
@@ -105,6 +105,7 @@ public:
 
     void setTimeout(int);
     void setShouldTimeout(bool flag);
+    void setShouldDumpPixelsForAllTests() { m_dumpPixelsForAllTests = true; }
 
 public Q_SLOTS:
     void initJSObjects();
@@ -141,6 +142,7 @@ private:
     TestRunner *m_controller;
 
     bool m_dumpPixelsForCurrentTest;
+    bool m_dumpPixelsForAllTests;
     QString m_expectedHash;
     QStringList m_standAloneModeTestList;
 
diff --git a/Tools/DumpRenderTree/qt/TestNetscapePlugin/TestNetscapePlugin.pro b/Tools/DumpRenderTree/qt/TestNetscapePlugin/TestNetscapePlugin.pro
index f7b638dfc..f962ee18b 100644
--- a/Tools/DumpRenderTree/qt/TestNetscapePlugin/TestNetscapePlugin.pro
+++ b/Tools/DumpRenderTree/qt/TestNetscapePlugin/TestNetscapePlugin.pro
@@ -24,6 +24,7 @@ SOURCES += \
     Tests/NPDeallocateCalledBeforeNPShutdown.cpp \
     Tests/NPPNewFails.cpp \
     Tests/NPPSetWindowCalledDuringDestruction.cpp \
+    Tests/NPRuntimeCallsWithNullNPP.cpp \
     Tests/NPRuntimeObjectFromDestroyedPlugin.cpp \
     Tests/NPRuntimeRemoveProperty.cpp \
     Tests/NullNPPGetValuePointer.cpp \
diff --git a/Tools/DumpRenderTree/qt/TestRunnerQt.cpp b/Tools/DumpRenderTree/qt/TestRunnerQt.cpp
index 81f781430..98fa7100b 100644
--- a/Tools/DumpRenderTree/qt/TestRunnerQt.cpp
+++ b/Tools/DumpRenderTree/qt/TestRunnerQt.cpp
@@ -408,11 +408,6 @@ QString TestRunner::decodeHostName(const QString& host)
     return decoded;
 }
 
-void TestRunner::setMediaType(const QString& type)
-{
-    DumpRenderTreeSupportQt::setMediaType(m_drt->webPage()->mainFrame(), type);
-}
-
 void TestRunner::closeWebInspector()
 {
     DumpRenderTreeSupportQt::webInspectorClose(m_drt->webPage());
diff --git a/Tools/DumpRenderTree/qt/TestRunnerQt.h b/Tools/DumpRenderTree/qt/TestRunnerQt.h
index 9c58f1d83..e54fde09e 100644
--- a/Tools/DumpRenderTree/qt/TestRunnerQt.h
+++ b/Tools/DumpRenderTree/qt/TestRunnerQt.h
@@ -155,7 +155,6 @@ public Q_SLOTS:
     void closeWebInspector();
     void evaluateInWebInspector(long callId, const QString& script);
     void removeAllVisitedLinks();
-    void setMediaType(const QString&);
     void setFrameFlatteningEnabled(bool);
     void setAllowUniversalAccessFromFileURLs(bool enable);
     void setAllowFileAccessFromFileURLs(bool enable);
diff --git a/Tools/DumpRenderTree/win/DumpRenderTree.cpp b/Tools/DumpRenderTree/win/DumpRenderTree.cpp
index ad1726dc9..173f34574 100644
--- a/Tools/DumpRenderTree/win/DumpRenderTree.cpp
+++ b/Tools/DumpRenderTree/win/DumpRenderTree.cpp
@@ -80,6 +80,7 @@ static LPCWSTR fontsEnvironmentVariable = L"WEBKIT_TESTFONTS";
 const LPCWSTR kDumpRenderTreeClassName = L"DumpRenderTreeWindow";
 
 static bool dumpTree = true;
+static bool dumpPixelsForAllTests = false;
 static bool dumpPixelsForCurrentTest;
 static bool dumpAllPixels;
 static bool printSeparators;
@@ -952,7 +953,7 @@ static void runTest(const string& inputLine)
 {
     TestCommand command = parseInputLine(inputLine);
     const string& pathOrURL = command.pathOrURL;
-    dumpPixelsForCurrentTest = command.shouldDumpPixels;
+    dumpPixelsForCurrentTest = command.shouldDumpPixels || dumpPixelsForAllTests;
 
     static BSTR methodBStr = SysAllocString(TEXT("GET"));
 
@@ -1341,6 +1342,11 @@ extern "C" __declspec(dllexport) int WINAPI dllLauncherEntryPoint(int argc, cons
             continue;
         }
 
+        if (!stricmp(argv[i], "--pixel-tests")) {
+            dumpPixelsForAllTests = true;
+            continue;
+        }
+
         tests.append(argv[i]);
     }
 
diff --git a/Tools/DumpRenderTree/wx/DumpRenderTreeWx.cpp b/Tools/DumpRenderTree/wx/DumpRenderTreeWx.cpp
index 538ff249d..cadecaf8f 100644
--- a/Tools/DumpRenderTree/wx/DumpRenderTreeWx.cpp
+++ b/Tools/DumpRenderTree/wx/DumpRenderTreeWx.cpp
@@ -50,6 +50,7 @@
 volatile bool done = true;
 volatile bool notified = false;
 static bool printSeparators = true;
+static int dumpPixelsForAllTests = false;
 static int dumpPixelsForCurrentTest;
 static int dumpTree = 1;
 time_t startTime; // to detect timeouts / failed tests
@@ -225,7 +226,7 @@ static void runTest(const wxString inputLine)
 
     TestCommand command = parseInputLine(std::string(inputLine.ToAscii()));
     string& pathOrURL = command.pathOrURL;
-    dumpPixelsForCurrentTest = command.shouldDumpPixels;
+    dumpPixelsForCurrentTest = command.shouldDumpPixels || dumpPixelsForAllTests;
     
     // CURL isn't happy if we don't have a protocol.
     size_t http = pathOrURL.find("http://");
@@ -281,6 +282,11 @@ bool MyApp::OnInit()
             dumpTree = true;
             continue;
         }
+
+        if (!option.CmpNoCase(_T("--pixel-tests"))) {
+            dumpPixelsForAllTests = true;
+            continue;
+        }
     }
     wxInitAllImageHandlers();
         
diff --git a/Tools/EWebLauncher/main.c b/Tools/EWebLauncher/main.c
index e17c8cc85..b1192435f 100644
--- a/Tools/EWebLauncher/main.c
+++ b/Tools/EWebLauncher/main.c
@@ -143,16 +143,16 @@ static const Ecore_Getopt options = {
 };
 
 typedef struct _User_Arguments {
-    const char *engine;
+    char *engine;
     Eina_Bool quitOption;
-    const char *backingStore;
+    char *backingStore;
     Eina_Bool enableEncodingDetector;
     Eina_Bool isFlattening;
     Eina_Bool isFullscreen;
     Eina_Rectangle geometry;
-    const char *theme;
-    const char *userAgent;
-    const char *databasePath;
+    char *theme;
+    char *userAgent;
+    char *databasePath;
 } User_Arguments;
 
 typedef struct _ELauncher {
@@ -426,8 +426,13 @@ static void
 on_tooltip_text_set(void* user_data, Evas_Object* webview, void* event_info)
 {
     const char *text = (const char *)event_info;
-    if (text && *text != '\0')
-        info("%s\n", text);
+    info("Tooltip is set: %s\n", text);
+}
+
+static void
+on_tooltip_text_unset(void* user_data, Evas_Object* webview, void* event_info)
+{
+    info("Tooltip is unset\n");
 }
 
 static void
@@ -571,14 +576,18 @@ on_key_down(void *data, Evas *e, Evas_Object *obj, void *event_info)
         Eina_Bool status = ewk_view_setting_spatial_navigation_get(obj);
         ewk_view_setting_spatial_navigation_set(obj, !status);
         info("Command::keyboard navigation toggle\n");
-    } else if (!strcmp(ev->key, "F7")) {
-        info("Zoom out (F7) was pressed.\n");
+    } else if ((!strcmp(ev->key, "minus") || !strcmp(ev->key, "KP_Subtract")) && ctrlPressed) {
         if (currentZoomLevel > MIN_ZOOM_LEVEL && zoom_level_set(obj, currentZoomLevel - 1))
             currentZoomLevel--;
-    } else if (!strcmp(ev->key, "F8")) {
-        info("Zoom in (F8) was pressed.\n");
+        info("Zoom out (Ctrl + '-') was pressed, zoom level became %.2f\n", zoomLevels[currentZoomLevel] / 100.0);
+    } else if ((!strcmp(ev->key, "equal") || !strcmp(ev->key, "KP_Add")) && ctrlPressed) {
         if (currentZoomLevel < MAX_ZOOM_LEVEL && zoom_level_set(obj, currentZoomLevel + 1))
             currentZoomLevel++;
+        info("Zoom in (Ctrl + '+') was pressed, zoom level became %.2f\n", zoomLevels[currentZoomLevel] / 100.0);
+    } else if (!strcmp(ev->key, "0") && ctrlPressed) {
+        if (zoom_level_set(obj, DEFAULT_ZOOM_LEVEL))
+            currentZoomLevel = DEFAULT_ZOOM_LEVEL;
+        info("Zoom to default (Ctrl + '0') was pressed, zoom level became %.2f\n", zoomLevels[currentZoomLevel] / 100.0);
     } else if (!strcmp(ev->key, "n") && ctrlPressed) {
         info("Create new window (Ctrl+n) was pressed.\n");
         browserCreate("http://www.google.com", app->userArgs);
@@ -747,6 +756,7 @@ browserCreate(const char *url, User_Arguments *userArgs)
     evas_object_smart_callback_add(appBrowser->browser, "toolbars,visible,get", on_toolbars_visible_get, appBrowser);
     evas_object_smart_callback_add(appBrowser->browser, "toolbars,visible,set", on_toolbars_visible_set, appBrowser);
     evas_object_smart_callback_add(appBrowser->browser, "tooltip,text,set", on_tooltip_text_set, appBrowser);
+    evas_object_smart_callback_add(appBrowser->browser, "tooltip,text,unset", on_tooltip_text_unset, appBrowser);
     evas_object_smart_callback_add(appBrowser->browser, "uri,changed", on_url_changed, appBrowser);
 
     evas_object_event_callback_add(appBrowser->browser, EVAS_CALLBACK_DEL, on_browser_del, appBrowser);
@@ -807,7 +817,16 @@ windowCreate(User_Arguments *userArgs)
         return NULL;
     }
 
-    app->ee = ecore_evas_new(userArgs->engine, 0, 0, userArgs->geometry.w, userArgs->geometry.h, NULL);
+#if defined(WTF_USE_ACCELERATED_COMPOSITING) && defined(HAVE_ECORE_X)
+    if (userArgs->engine)
+#endif
+        app->ee = ecore_evas_new(userArgs->engine, 0, 0, userArgs->geometry.w, userArgs->geometry.h, NULL);
+#if defined(WTF_USE_ACCELERATED_COMPOSITING) && defined(HAVE_ECORE_X)
+    else {
+        const char* engine = "opengl_x11";
+        app->ee = ecore_evas_new(engine, 0, 0, userArgs->geometry.w, userArgs->geometry.h, NULL);
+    }
+#endif
     if (!app->ee) {
         quit(EINA_FALSE, "ERROR: could not construct evas-ecore\n");
         return NULL;
diff --git a/Tools/GNUmakefile.am b/Tools/GNUmakefile.am
index a8d944dcf..87b8f6a52 100644
--- a/Tools/GNUmakefile.am
+++ b/Tools/GNUmakefile.am
@@ -224,6 +224,7 @@ TestNetscapePlugin_libtestnetscapeplugin_la_SOURCES = \
 	Tools/DumpRenderTree/TestNetscapePlugIn/Tests/NPDeallocateCalledBeforeNPShutdown.cpp \
 	Tools/DumpRenderTree/TestNetscapePlugIn/Tests/NPPNewFails.cpp \
 	Tools/DumpRenderTree/TestNetscapePlugIn/Tests/NPPSetWindowCalledDuringDestruction.cpp \
+    Tools/DumpRenderTree/TestNetscapePlugIn/Tests/NPRuntimeCallsWithNullNPP.cpp \
 	Tools/DumpRenderTree/TestNetscapePlugIn/Tests/NPRuntimeObjectFromDestroyedPlugin.cpp \
 	Tools/DumpRenderTree/TestNetscapePlugIn/Tests/NPRuntimeRemoveProperty.cpp \
 	Tools/DumpRenderTree/TestNetscapePlugIn/Tests/NullNPPGetValuePointer.cpp \
diff --git a/Tools/MiniBrowser/Configurations/Base.xcconfig b/Tools/MiniBrowser/Configurations/Base.xcconfig
index 85d987d39..c801d582f 100644
--- a/Tools/MiniBrowser/Configurations/Base.xcconfig
+++ b/Tools/MiniBrowser/Configurations/Base.xcconfig
@@ -21,14 +21,15 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 
-#include "CompilerVersion.xcconfig"
-
+CLANG_CXX_LANGUAGE_STANDARD = gnu++0x;
+CLANG_CXX_LIBRARY = libc++;
 DEBUG_INFORMATION_FORMAT = dwarf-with-dsym;
 PREBINDING = NO
 GCC_C_LANGUAGE_STANDARD = gnu99
 GCC_ENABLE_CPP_EXCEPTIONS = NO;
 GCC_PRECOMPILE_PREFIX_HEADER = YES
 GCC_TREAT_WARNINGS_AS_ERRORS = YES
+GCC_VERSION = com.apple.compilers.llvm.clang.1_0;
 GCC_WARN_UNUSED_FUNCTION = YES
 GCC_WARN_UNUSED_VARIABLE = YES
 GCC_WARN_ABOUT_DEPRECATED_FUNCTIONS = NO
@@ -36,22 +37,9 @@ WARNING_CFLAGS = -Wall -W -Wno-unused-parameter
 LINKER_DISPLAYS_MANGLED_NAMES = YES;
 VALID_ARCHS = i386 x86_64;
 
-CLANG_CXX_LIBRARY = $(CLANG_CXX_LIBRARY_$(TARGET_MAC_OS_X_VERSION_MAJOR));
-CLANG_CXX_LIBRARY_1060 = libstdc++;
-CLANG_CXX_LIBRARY_1070 = libc++;
-CLANG_CXX_LIBRARY_1080 = libc++;
-CLANG_CXX_LIBRARY_1090 = libc++;
-
-REAL_PLATFORM_NAME = $(REAL_PLATFORM_NAME_$(PLATFORM_NAME));
-REAL_PLATFORM_NAME_ = $(REAL_PLATFORM_NAME_macosx);
-REAL_PLATFORM_NAME_iphoneos = iphoneos;
-REAL_PLATFORM_NAME_iphonesimulator = iphonesimulator;
-REAL_PLATFORM_NAME_macosx = macosx;
-
 TARGET_MAC_OS_X_VERSION_MAJOR = $(MAC_OS_X_VERSION_MAJOR);
 
 TARGETING_SAME_OS_X_VERSION = $(TARGETING_SAME_OS_X_VERSION_$(MAC_OS_X_VERSION_MAJOR)_$(TARGET_MAC_OS_X_VERSION_MAJOR));
-TARGETING_SAME_OS_X_VERSION_1060_1060 = YES;
 TARGETING_SAME_OS_X_VERSION_1070_1070 = YES;
 TARGETING_SAME_OS_X_VERSION_1080_1080 = YES;
 TARGETING_SAME_OS_X_VERSION_1090_1090 = YES;
diff --git a/Tools/MiniBrowser/Configurations/CompilerVersion.xcconfig b/Tools/MiniBrowser/Configurations/CompilerVersion.xcconfig
deleted file mode 100644
index a8c7f75a0..000000000
--- a/Tools/MiniBrowser/Configurations/CompilerVersion.xcconfig
+++ /dev/null
@@ -1,84 +0,0 @@
-// Copyright (C) 2009, 2010, 2011 Apple Inc. All rights reserved.
-//
-// Redistribution and use in source and binary forms, with or without
-// modification, are permitted provided that the following conditions
-// are met:
-// 1. Redistributions of source code must retain the above copyright
-//    notice, this list of conditions and the following disclaimer.
-// 2. Redistributions in binary form must reproduce the above copyright
-//    notice, this list of conditions and the following disclaimer in the
-//    documentation and/or other materials provided with the distribution.
-//
-// THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
-// EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
-// IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
-// PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
-// CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
-// EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
-// PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
-// PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
-// OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
-
-IS_XCODE_0400 = $(IS_XCODE_0400_$(XCODE_VERSION_MINOR));
-IS_XCODE_0400_0400 = YES;
-
-IS_XCODE_0400_OR_0410 = $(IS_XCODE_0400_OR_0410_$(XCODE_VERSION_MINOR));
-IS_XCODE_0400_OR_0410_0400 = YES;
-IS_XCODE_0400_OR_0410_0410 = YES;
-
-// The version of the LLVM Compiler in Xcode 4.0 and earlier have difficulty compiling our code.
-LLVM_COMPILER_UNSUITABLE_FOR_DEBUG_BUILDS = $(LLVM_COMPILER_UNSUITABLE_FOR_DEBUG_BUILDS_$(XCODE_VERSION_MAJOR));
-LLVM_COMPILER_UNSUITABLE_FOR_DEBUG_BUILDS_0300 = YES;
-LLVM_COMPILER_UNSUITABLE_FOR_DEBUG_BUILDS_0400 = $(LLVM_COMPILER_UNSUITABLE_FOR_DEBUG_BUILDS_IS_XCODE_0400_$(IS_XCODE_0400));
-LLVM_COMPILER_UNSUITABLE_FOR_DEBUG_BUILDS_IS_XCODE_0400_YES = YES;
-
-// The version of the LLVM Compiler in Xcode 4.1 and earlier do not generate fast enough code.
-LLVM_COMPILER_UNSUITABLE_FOR_OPTIMIZED_BUILDS = $(LLVM_COMPILER_UNSUITABLE_FOR_OPTIMIZED_BUILDS_$(XCODE_VERSION_MAJOR));
-LLVM_COMPILER_UNSUITABLE_FOR_OPTIMIZED_BUILDS_0300 = YES;
-LLVM_COMPILER_UNSUITABLE_FOR_OPTIMIZED_BUILDS_0400 = $(LLVM_COMPILER_UNSUITABLE_FOR_OPTIMIZED_BUILDS_IS_XCODE_0400_OR_0410_$(IS_XCODE_0400_OR_0410));
-LLVM_COMPILER_UNSUITABLE_FOR_OPTIMIZED_BUILDS_IS_XCODE_0400_OR_0410_YES = YES;
-
-LLVM_COMPILER_SUITABLE_FOR_DEBUG_BUILDS = $(LLVM_COMPILER_SUITABLE_FOR_DEBUG_BUILDS_$(LLVM_COMPILER_UNSUITABLE_FOR_DEBUG_BUILDS));
-LLVM_COMPILER_SUITABLE_FOR_DEBUG_BUILDS_ = YES;
-LLVM_COMPILER_SUITABLE_FOR_DEBUG_BUILDS_YES = NO;
-
-LLVM_COMPILER_SUITABLE_FOR_OPTIMIZED_BUILDS = $(LLVM_COMPILER_SUITABLE_FOR_OPTIMIZED_BUILDS_$(LLVM_COMPILER_UNSUITABLE_FOR_OPTIMIZED_BUILDS));
-LLVM_COMPILER_SUITABLE_FOR_OPTIMIZED_BUILDS_ = YES;
-LLVM_COMPILER_SUITABLE_FOR_OPTIMIZED_BUILDS_YES = NO;
-
-
-// Use GCC 4.2 with Xcode 3.1, which includes GCC 4.2 but defaults to GCC 4.0.
-// Note that Xcode versions as new as 3.1.2 use XCODE_VERSION_ACTUAL for the minor version
-// number.  Newer versions of Xcode use XCODE_VERSION_MINOR for the minor version, and
-// XCODE_VERSION_ACTUAL for the full version number.
-TARGET_GCC_VERSION = $(TARGET_GCC_VERSION_$(REAL_PLATFORM_NAME));
-TARGET_GCC_VERSION_iphoneos = LLVM_GCC_42;
-TARGET_GCC_VERSION_iphonesimulator = GCC_42;
-TARGET_GCC_VERSION_macosx = $(TARGET_GCC_VERSION_macosx_$(TARGET_MAC_OS_X_VERSION_MAJOR));
-
-TARGET_GCC_VERSION_macosx_1050 = $(TARGET_GCC_VERSION_macosx_1050_$(XCODE_VERSION_MINOR));
-TARGET_GCC_VERSION_macosx_1050_ = $(TARGET_GCC_VERSION_macosx_1050_$(XCODE_VERSION_ACTUAL));
-TARGET_GCC_VERSION_macosx_1050_0310 = GCC_42;
-TARGET_GCC_VERSION_macosx_1050_0320 = GCC_42;
-
-TARGET_GCC_VERSION_macosx_1060 = $(TARGET_GCC_VERSION_macosx_1060_AND_1070_$(CONFIGURATION));
-TARGET_GCC_VERSION_macosx_1070 = $(TARGET_GCC_VERSION_macosx_1060_AND_1070_$(CONFIGURATION));
-TARGET_GCC_VERSION_macosx_1060_AND_1070_Debug = $(TARGET_GCC_VERSION_macosx_USE_LLVM_COMPILER_$(LLVM_COMPILER_SUITABLE_FOR_DEBUG_BUILDS));
-TARGET_GCC_VERSION_macosx_1060_AND_1070_Release = $(TARGET_GCC_VERSION_macosx_USE_LLVM_COMPILER_$(LLVM_COMPILER_SUITABLE_FOR_OPTIMIZED_BUILDS));
-TARGET_GCC_VERSION_macosx_1060_AND_1070_Production = $(TARGET_GCC_VERSION_macosx_USE_LLVM_COMPILER_$(LLVM_COMPILER_SUITABLE_FOR_OPTIMIZED_BUILDS));
-TARGET_GCC_VERSION_macosx_1060_NON_LLVM_FALLBACK = GCC_42;
-TARGET_GCC_VERSION_macosx_1070_NON_LLVM_FALLBACK = LLVM_GCC_42;
-
-TARGET_GCC_VERSION_macosx_USE_LLVM_COMPILER_YES = LLVM_COMPILER;
-TARGET_GCC_VERSION_macosx_USE_LLVM_COMPILER_NO = $(TARGET_GCC_VERSION_macosx_$(TARGET_MAC_OS_X_VERSION_MAJOR)_NON_LLVM_FALLBACK);
-
-TARGET_GCC_VERSION_macosx_1080 = LLVM_COMPILER;
-TARGET_GCC_VERSION_macosx_1090 = LLVM_COMPILER;
-
-GCC_VERSION = $(GCC_VERSION_$(TARGET_GCC_VERSION));
-GCC_VERSION_GCC_40 = 4.0;
-GCC_VERSION_GCC_42 = 4.2;
-GCC_VERSION_LLVM_GCC_42 = com.apple.compilers.llvmgcc42;
-GCC_VERSION_LLVM_COMPILER = com.apple.compilers.llvm.clang.1_0;
diff --git a/Tools/MiniBrowser/Configurations/DebugRelease.xcconfig b/Tools/MiniBrowser/Configurations/DebugRelease.xcconfig
index 0d6374f3b..084cdf91e 100644
--- a/Tools/MiniBrowser/Configurations/DebugRelease.xcconfig
+++ b/Tools/MiniBrowser/Configurations/DebugRelease.xcconfig
@@ -23,18 +23,11 @@
 
 #include "Base.xcconfig"
 
-ARCHS = $(ARCHS_$(TARGET_MAC_OS_X_VERSION_MAJOR));
-ARCHS_1050 = $(NATIVE_ARCH);
-ARCHS_1060 = $(ARCHS_STANDARD_32_64_BIT);
-ARCHS_1070 = $(ARCHS_STANDARD_32_64_BIT);
-ARCHS_1080 = $(ARCHS_STANDARD_32_64_BIT);
-ARCHS_1090 = $(ARCHS_STANDARD_32_64_BIT);
+ARCHS = $(ARCHS_STANDARD_32_64_BIT);
 
 ONLY_ACTIVE_ARCH = YES;
 
 MACOSX_DEPLOYMENT_TARGET = $(MACOSX_DEPLOYMENT_TARGET_$(TARGET_MAC_OS_X_VERSION_MAJOR))
-MACOSX_DEPLOYMENT_TARGET_1050 = 10.5;
-MACOSX_DEPLOYMENT_TARGET_1060 = 10.6;
 MACOSX_DEPLOYMENT_TARGET_1070 = 10.7;
 MACOSX_DEPLOYMENT_TARGET_1080 = 10.8;
 MACOSX_DEPLOYMENT_TARGET_1090 = 10.9;
diff --git a/Tools/MiniBrowser/efl/main.c b/Tools/MiniBrowser/efl/main.c
index c5dc495a2..23193eb5f 100644
--- a/Tools/MiniBrowser/efl/main.c
+++ b/Tools/MiniBrowser/efl/main.c
@@ -25,8 +25,6 @@
 #include <Elementary.h>
 #include <Evas.h>
 
-static const int DEFAULT_WIDTH = 800;
-static const int DEFAULT_HEIGHT = 600;
 static const char DEFAULT_URL[] = "http://www.google.com/";
 static const char APP_NAME[] = "EFL MiniBrowser";
 static const int TOOL_BAR_ICON_SIZE = 24;
@@ -42,6 +40,8 @@ static int verbose = 1;
 static Eina_List *windows = NULL;
 static char *evas_engine_name = NULL;
 static Eina_Bool frame_flattening_enabled = EINA_FALSE;
+static int window_width = 800;
+static int window_height = 600;
 
 static Ewk_View_Smart_Class* miniBrowserViewSmartClass()
 {
@@ -67,6 +67,8 @@ static const Ecore_Getopt options = {
     EINA_TRUE, {
         ECORE_GETOPT_STORE_STR
             ('e', "engine", "ecore-evas engine to use."),
+        ECORE_GETOPT_STORE_STR
+            ('s', "window-size", "window size in following format (width)x(height)."),
         ECORE_GETOPT_CALLBACK_NOARGS
             ('E', "list-engines", "list ecore-evas engines.",
              ecore_getopt_callback_ecore_evas_list_engines, NULL),
@@ -163,6 +165,13 @@ on_key_down(void *data, Evas *e, Evas_Object *obj, void *event_info)
     } else if (!strcmp(ev->key, "F6")) {
         info("Stop (F6) was pressed, stop loading.\n");
         ewk_view_stop(obj);
+    } else if  (!strcmp(ev->key, "F7")) {
+        Ewk_Pagination_Mode mode =  ewk_view_pagination_mode_get(obj);
+        mode = (++mode) % (EWK_PAGINATION_MODE_BOTTOM_TO_TOP + 1);
+        if (ewk_view_pagination_mode_set(obj, mode))
+            info("Change Pagination Mode (F7) was pressed, changed to: %d\n", mode);
+        else
+            info("Change Pagination Mode (F7) was pressed, but NOT changed!");
     } else if (!strcmp(ev->key, "n") && ctrlPressed) {
         info("Create new window (Ctrl+n) was pressed.\n");
         Browser_Window *window = window_create(DEFAULT_URL);
@@ -231,7 +240,11 @@ static void
 on_url_changed(void *user_data, Evas_Object *webview, void *event_info)
 {
     Browser_Window *window = (Browser_Window *)user_data;
-    elm_entry_entry_set(window->url_bar, ewk_view_url_get(window->webview));
+
+    char *url = elm_entry_utf8_to_markup(ewk_view_url_get(window->webview));
+    elm_entry_entry_set(window->url_bar, url);
+
+    free(url);
 }
 
 static void
@@ -308,6 +321,79 @@ on_download_request(void *user_data, Evas_Object *webview, void *event_info)
     eina_strbuf_free(destination_path);
 }
 
+typedef struct {
+    Evas_Object *parent;
+    Evas_Object *window;
+    Ewk_File_Chooser_Request *request;
+} FileSelectorData;
+
+static void on_filepicker_parent_deletion(void *user_data, Evas *evas, Evas_Object *window, void *event);
+
+static void close_file_picker(FileSelectorData* fs_data)
+{
+    evas_object_event_callback_del(fs_data->parent, EVAS_CALLBACK_DEL, on_filepicker_parent_deletion);
+    evas_object_del(fs_data->window);
+    ewk_file_chooser_request_unref(fs_data->request);
+    free(fs_data);
+}
+
+static void
+on_filepicker_parent_deletion(void *user_data, Evas *evas, Evas_Object *window, void *event)
+{
+    close_file_picker((FileSelectorData *)user_data);
+}
+
+static void
+on_filepicker_deletion(void *user_data, Evas_Object *window, void *event_info)
+{
+    close_file_picker((FileSelectorData *)user_data);
+}
+
+static void
+on_fileselector_done(void *user_data, Evas_Object *file_selector, void *event_info)
+{
+    FileSelectorData *fs_data = (FileSelectorData *)user_data;
+
+    const char *selected = (const char *)event_info;
+    if (selected && *selected)
+        ewk_file_chooser_request_file_choose(fs_data->request, selected);
+
+    close_file_picker(fs_data);
+}
+
+static void
+on_file_chooser_request(void *user_data, Evas_Object *webview, void *event_info)
+{
+    Browser_Window *app_data = (Browser_Window *)user_data;
+    Ewk_File_Chooser_Request *request = (Ewk_File_Chooser_Request *)event_info;
+
+    // Show basic file picker which does not currently support multiple files
+    // or MIME type filtering.
+    Evas_Object *window = elm_win_add(app_data->window, "file-picker-window", ELM_WIN_DIALOG_BASIC);
+    elm_win_title_set(window, "File picker");
+    elm_win_modal_set(window, EINA_TRUE);
+
+    FileSelectorData* fs_data = (FileSelectorData*)malloc(sizeof(FileSelectorData));
+    fs_data->parent = app_data->window;
+    fs_data->window = window;
+    fs_data->request = ewk_file_chooser_request_ref(request);
+    evas_object_smart_callback_add(window, "delete,request", on_filepicker_deletion, fs_data);
+    evas_object_event_callback_add(app_data->window, EVAS_CALLBACK_DEL, on_filepicker_parent_deletion, fs_data);
+
+    Evas_Object *file_selector = elm_fileselector_add(window);
+    const char *home_path = getenv("HOME");
+    elm_fileselector_path_set(file_selector, home_path ? home_path : "/home");
+    evas_object_size_hint_weight_set(file_selector, EVAS_HINT_EXPAND, EVAS_HINT_EXPAND);
+    elm_win_resize_object_add(window, file_selector);
+    evas_object_show(file_selector);
+
+    evas_object_smart_callback_add(file_selector, "done", on_fileselector_done, fs_data);
+
+    evas_object_resize(window, 400, 400);
+    elm_win_center(window, EINA_TRUE, EINA_TRUE);
+    evas_object_show(window);
+}
+
 static void
 on_download_finished(void *user_data, Evas_Object *webview, void *event_info)
 {
@@ -380,9 +466,12 @@ on_url_bar_activated(void *user_data, Evas_Object *url_bar, void *event_info)
 {
     Browser_Window *app_data = (Browser_Window *)user_data;
 
-    const char *user_url = elm_entry_entry_get(url_bar);
+    const char *markup_url = elm_entry_entry_get(url_bar);
+    char *user_url = elm_entry_markup_to_utf8(markup_url);
     char *url = url_from_user_input(user_url);
     ewk_view_url_set(app_data->webview, url);
+
+    free(user_url);
     free(url);
 
     /* Give focus back to the view */
@@ -465,6 +554,7 @@ on_javascript_alert(Ewk_View_Smart_Data *smartData, const char *message)
     elm_object_text_set(button, "OK");
     elm_object_part_content_set(alert_popup, "button1", button);
     evas_object_smart_callback_add(button, "clicked", quit_event_loop, NULL);
+    elm_object_focus_set(button, EINA_TRUE);
     evas_object_show(alert_popup);
 
     /* Make modal */
@@ -494,6 +584,7 @@ on_javascript_confirm(Ewk_View_Smart_Data *smartData, const char *message)
     elm_object_text_set(ok_button, "OK");
     elm_object_part_content_set(confirm_popup, "button2", ok_button);
     evas_object_smart_callback_add(ok_button, "clicked", on_ok_clicked, &ok);
+    elm_object_focus_set(ok_button, EINA_TRUE);
     evas_object_show(confirm_popup);
 
     /* Make modal */
@@ -534,9 +625,11 @@ on_javascript_prompt(Ewk_View_Smart_Data *smartData, const char *message, const
     elm_entry_single_line_set(entry, EINA_TRUE);
     elm_entry_text_style_user_push(entry, "DEFAULT='font_size=18'");
     elm_entry_entry_set(entry, default_value ? default_value : "");
+    elm_entry_select_all(entry);
     evas_object_size_hint_weight_set(entry, EVAS_HINT_EXPAND, 0.0);
     evas_object_size_hint_align_set(entry, EVAS_HINT_FILL, 0.5);
     elm_box_pack_end(box, entry);
+    elm_object_focus_set(entry, EINA_TRUE);
     evas_object_show(entry);
 
     elm_object_content_set(prompt_popup, box);
@@ -562,6 +655,158 @@ on_javascript_prompt(Ewk_View_Smart_Data *smartData, const char *message, const
     return prompt_text;
 }
 
+typedef struct {
+    Evas_Object *popup;
+    Ewk_Auth_Request *request;
+    Evas_Object *username_entry;
+    Evas_Object *password_entry;
+} AuthData;
+
+static void
+auth_popup_close(AuthData *auth_data)
+{
+    ewk_object_unref(auth_data->request);
+    evas_object_del(auth_data->popup);
+    free(auth_data);
+}
+
+static void
+on_auth_cancel(void *user_data, Evas_Object *obj, void *event_info)
+{
+    AuthData *auth_data = (AuthData *)user_data;
+
+    ewk_auth_request_cancel(auth_data->request);
+
+    auth_popup_close(auth_data);
+}
+
+static void
+on_auth_ok(void *user_data, Evas_Object *obj, void *event_info)
+{
+    AuthData *auth_data = (AuthData *)user_data;
+
+    const char *username = elm_entry_entry_get(auth_data->username_entry);
+    const char *password = elm_entry_entry_get(auth_data->password_entry);
+    ewk_auth_request_authenticate(auth_data->request, username, password);
+
+    auth_popup_close(auth_data);
+}
+
+static void
+on_authentication_request(void *user_data, Evas_Object *obj, void *event_info)
+{
+    Browser_Window *window = (Browser_Window *)user_data;
+    Ewk_Auth_Request *request = ewk_object_ref((Ewk_Auth_Request *)event_info);
+
+    AuthData *auth_data = (AuthData *)malloc(sizeof(AuthData));
+    auth_data->request = request;
+
+    Evas_Object *auth_popup = elm_popup_add(window->window);
+    auth_data->popup = auth_popup;
+    evas_object_size_hint_weight_set(auth_popup, EVAS_HINT_EXPAND, EVAS_HINT_EXPAND);
+    elm_object_part_text_set(auth_popup, "title,text", "Authentication Required");
+
+    /* Popup Content */
+    Evas_Object *vbox = elm_box_add(auth_popup);
+    elm_box_padding_set(vbox, 0, 4);
+    evas_object_size_hint_weight_set(vbox, EVAS_HINT_EXPAND, EVAS_HINT_EXPAND);
+    evas_object_size_hint_align_set(vbox, EVAS_HINT_FILL, EVAS_HINT_FILL);
+    elm_object_content_set(auth_popup, vbox);
+    evas_object_show(vbox);
+
+    /* Authentication message */
+    Evas_Object *label = elm_label_add(auth_popup);
+    elm_label_line_wrap_set(label, ELM_WRAP_WORD);
+    Eina_Strbuf *auth_text = eina_strbuf_new();
+    const char* host = ewk_auth_request_host_get(request);
+    const char* realm = ewk_auth_request_realm_get(request);
+    eina_strbuf_append_printf(auth_text, "A username and password are being requested by %s. The site says: \"%s\"", host, realm ? realm : "");
+    elm_object_text_set(label, eina_strbuf_string_get(auth_text));
+    eina_strbuf_free(auth_text);
+    evas_object_size_hint_weight_set(label, EVAS_HINT_EXPAND, EVAS_HINT_EXPAND);
+    evas_object_size_hint_align_set(label, EVAS_HINT_FILL, EVAS_HINT_FILL);
+    elm_box_pack_end(vbox, label);
+    evas_object_show(label);
+
+    /* Credential table */
+    Evas_Object *table = elm_table_add(auth_popup);
+    elm_table_padding_set(table, 2, 2);
+    elm_table_homogeneous_set(table, EINA_TRUE);
+    evas_object_size_hint_weight_set(table, EVAS_HINT_EXPAND, EVAS_HINT_EXPAND);
+    evas_object_size_hint_align_set(table, EVAS_HINT_FILL, EVAS_HINT_FILL);
+    elm_box_pack_end(vbox, table);
+    evas_object_show(table);
+
+    /* Username row */
+    Evas_Object *username_label = elm_label_add(auth_popup);
+    elm_object_text_set(username_label, "Username:");
+    evas_object_size_hint_weight_set(username_label, EVAS_HINT_EXPAND, EVAS_HINT_EXPAND);
+    evas_object_size_hint_align_set(username_label, 1, EVAS_HINT_FILL);
+    elm_table_pack(table, username_label, 0, 0, 1, 1);
+    evas_object_show(username_label);
+
+    Evas_Object *username_entry = elm_entry_add(auth_popup);
+    auth_data->username_entry = username_entry;
+    elm_entry_scrollable_set(username_entry, EINA_TRUE);
+    elm_entry_single_line_set(username_entry, EINA_TRUE);
+    elm_entry_text_style_user_push(username_entry, "DEFAULT='font_size=18'");
+    const char *suggested_username = ewk_auth_request_suggested_username_get(request);
+    elm_entry_entry_set(username_entry, suggested_username ? suggested_username : "");
+    evas_object_size_hint_weight_set(username_entry, EVAS_HINT_EXPAND, EVAS_HINT_EXPAND);
+    evas_object_size_hint_align_set(username_entry, EVAS_HINT_FILL, EVAS_HINT_FILL);
+    elm_table_pack(table, username_entry, 1, 0, 2, 1);
+    elm_object_focus_set(username_entry, EINA_TRUE);
+    evas_object_show(username_entry);
+
+    /* Password row */
+    Evas_Object *password_label = elm_label_add(auth_popup);
+    elm_object_text_set(password_label, "Password:");
+    evas_object_size_hint_weight_set(password_label, EVAS_HINT_EXPAND, EVAS_HINT_EXPAND);
+    evas_object_size_hint_align_set(password_label, 1, EVAS_HINT_FILL);
+    elm_table_pack(table, password_label, 0, 1, 1, 1);
+    evas_object_show(password_label);
+
+    Evas_Object *password_entry = elm_entry_add(auth_popup);
+    auth_data->password_entry = password_entry;
+    elm_entry_scrollable_set(password_entry, EINA_TRUE);
+    elm_entry_single_line_set(password_entry, EINA_TRUE);
+    elm_entry_password_set(password_entry, EINA_TRUE);
+    elm_entry_text_style_user_push(password_entry, "DEFAULT='font_size=18'");
+    evas_object_size_hint_weight_set(password_entry, EVAS_HINT_EXPAND, EVAS_HINT_EXPAND);
+    evas_object_size_hint_align_set(password_entry, EVAS_HINT_FILL, EVAS_HINT_FILL);
+    elm_table_pack(table, password_entry, 1, 1, 2, 1);
+    evas_object_show(password_entry);
+
+    /* Popup buttons */
+    Evas_Object *cancel_button = elm_button_add(auth_popup);
+    elm_object_text_set(cancel_button, "Cancel");
+    elm_object_part_content_set(auth_popup, "button1", cancel_button);
+    evas_object_smart_callback_add(cancel_button, "clicked", on_auth_cancel, auth_data);
+    Evas_Object *ok_button = elm_button_add(auth_popup);
+    elm_object_text_set(ok_button, "OK");
+    elm_object_part_content_set(auth_popup, "button2", ok_button);
+    evas_object_smart_callback_add(ok_button, "clicked", on_auth_ok, auth_data);
+    evas_object_show(auth_popup);
+}
+
+static void
+on_tooltip_text_set(void *user_data, Evas_Object *obj, void *event_info)
+{
+    Browser_Window *window = (Browser_Window *)user_data;
+    const char* message = (const char*)event_info;
+
+    elm_object_tooltip_text_set(window->webview, message);
+    elm_object_tooltip_show(window->webview);
+}
+
+static void
+on_tooltip_text_unset(void *user_data, Evas_Object *obj, void *event_info)
+{
+    Browser_Window *window = (Browser_Window *)user_data;
+
+    elm_object_tooltip_unset(window->webview);
+}
+
 static void
 on_home_button_clicked(void *user_data, Evas_Object *home_button, void *event_info)
 {
@@ -691,17 +936,21 @@ static Browser_Window *window_create(const char *url)
     ewk_settings_frame_flattening_enabled_set(settings, frame_flattening_enabled);
     ewk_settings_developer_extras_enabled_set(settings, EINA_TRUE);
 
+    evas_object_smart_callback_add(app_data->webview, "authentication,request", on_authentication_request, app_data);
     evas_object_smart_callback_add(app_data->webview, "close,window", on_close_window, app_data);
     evas_object_smart_callback_add(app_data->webview, "create,window", on_new_window, app_data);
     evas_object_smart_callback_add(app_data->webview, "download,failed", on_download_failed, app_data);
     evas_object_smart_callback_add(app_data->webview, "download,finished", on_download_finished, app_data);
     evas_object_smart_callback_add(app_data->webview, "download,request", on_download_request, app_data);
+    evas_object_smart_callback_add(app_data->webview, "file,chooser,request", on_file_chooser_request, app_data);
     evas_object_smart_callback_add(app_data->webview, "icon,changed", on_view_icon_changed, app_data);
     evas_object_smart_callback_add(app_data->webview, "load,error", on_error, app_data);
     evas_object_smart_callback_add(app_data->webview, "load,progress", on_progress, app_data);
     evas_object_smart_callback_add(app_data->webview, "title,changed", on_title_changed, app_data);
     evas_object_smart_callback_add(app_data->webview, "url,changed", on_url_changed, app_data);
     evas_object_smart_callback_add(app_data->webview, "back,forward,list,changed", on_back_forward_list_changed, app_data);
+    evas_object_smart_callback_add(app_data->webview, "tooltip,text,set", on_tooltip_text_set, app_data);
+    evas_object_smart_callback_add(app_data->webview, "tooltip,text,unset", on_tooltip_text_unset, app_data);
 
     evas_object_event_callback_add(app_data->webview, EVAS_CALLBACK_KEY_DOWN, on_key_down, app_data);
     evas_object_event_callback_add(app_data->webview, EVAS_CALLBACK_MOUSE_DOWN, on_mouse_down, app_data);
@@ -714,7 +963,7 @@ static Browser_Window *window_create(const char *url)
     if (url)
         ewk_view_url_set(app_data->webview, url);
 
-    evas_object_resize(app_data->window, DEFAULT_WIDTH, DEFAULT_HEIGHT);
+    evas_object_resize(app_data->window, window_width, window_height);
     evas_object_show(app_data->window);
 
     view_focus_set(app_data, EINA_TRUE);
@@ -722,15 +971,42 @@ static Browser_Window *window_create(const char *url)
     return app_data;
 }
 
+static void
+parse_window_size(const char *input_string, int *width, int *height)
+{
+    static const unsigned max_length = 4;
+    int parsed_width;
+    int parsed_height;
+    char **arr;
+    unsigned elements;
+
+    arr = eina_str_split_full(input_string, "x", 0, &elements);
+
+    if (elements == 2 && (strlen(arr[0]) <= max_length) && (strlen(arr[1]) <= max_length)) {
+        parsed_width = atoi(arr[0]);
+        if (width && parsed_width)
+            *width = parsed_width;
+
+        parsed_height = atoi(arr[1]);
+        if (height && parsed_height)
+            *height = parsed_height;
+    }
+
+    free(arr[0]);
+    free(arr);
+}
+
 EAPI_MAIN int
 elm_main(int argc, char *argv[])
 {
     int args = 1;
     unsigned char quitOption = 0;
     Browser_Window *window;
+    char *window_size_string = NULL;
 
     Ecore_Getopt_Value values[] = {
         ECORE_GETOPT_VALUE_STR(evas_engine_name),
+        ECORE_GETOPT_VALUE_STR(window_size_string),
         ECORE_GETOPT_VALUE_BOOL(quitOption),
         ECORE_GETOPT_VALUE_BOOL(frame_flattening_enabled),
         ECORE_GETOPT_VALUE_BOOL(quitOption),
@@ -755,6 +1031,19 @@ elm_main(int argc, char *argv[])
 
     if (evas_engine_name)
         elm_config_preferred_engine_set(evas_engine_name);
+#if defined(WTF_USE_ACCELERATED_COMPOSITING) && defined(HAVE_ECORE_X)
+    else {
+        evas_engine_name = "opengl_x11";
+        elm_config_preferred_engine_set(evas_engine_name);
+    }
+#endif
+
+    // Enable favicon database.
+    Ewk_Context *context = ewk_context_default_get();
+    ewk_context_favicon_database_directory_set(context, NULL);
+
+    if (window_size_string)
+        parse_window_size(window_size_string, &window_width, &window_height);
 
     if (args < argc) {
         char *url = url_from_user_input(argv[args]);
diff --git a/Tools/MiniBrowser/mac/WK2BrowserWindowController.m b/Tools/MiniBrowser/mac/WK2BrowserWindowController.m
index b30b7ff9f..1731eb650 100644
--- a/Tools/MiniBrowser/mac/WK2BrowserWindowController.m
+++ b/Tools/MiniBrowser/mac/WK2BrowserWindowController.m
@@ -733,10 +733,8 @@ static void runOpenPanel(WKPageRef page, WKFrameRef frame, WKOpenPanelParameters
     if (!emptyURL)
         emptyURL = WKURLCreateWithUTF8CString("");
 
-    if (WKURLIsEqual(URLRef, emptyURL)) {
-        WKRelease(URLRef);
+    if (WKURLIsEqual(URLRef, emptyURL))
         return;
-    }
 
     CFURLRef cfSourceURL = WKURLCopyCFURL(0, URLRef);
     [urlText setStringValue:(NSString*)CFURLGetString(cfSourceURL)];
@@ -746,6 +744,8 @@ static void runOpenPanel(WKPageRef page, WKFrameRef frame, WKOpenPanelParameters
 - (void)updateProvisionalURLForFrame:(WKFrameRef)frame
 {
     WKURLRef url = WKFrameCopyProvisionalURL(frame);
+    if (!url)
+        return;
     [self updateTextFieldFromURL:url];
     WKRelease(url);
 }
@@ -753,6 +753,8 @@ static void runOpenPanel(WKPageRef page, WKFrameRef frame, WKOpenPanelParameters
 - (void)updateCommittedURLForFrame:(WKFrameRef)frame
 {
     WKURLRef url = WKFrameCopyURL(frame);
+    if (!url)
+        return;
     [self updateTextFieldFromURL:url];
     WKRelease(url);
 }
diff --git a/Tools/MiniBrowser/qt/MiniBrowser.pro b/Tools/MiniBrowser/qt/MiniBrowser.pro
index f5c1803fa..0fbddbe13 100644
--- a/Tools/MiniBrowser/qt/MiniBrowser.pro
+++ b/Tools/MiniBrowser/qt/MiniBrowser.pro
@@ -9,10 +9,10 @@ TEMPLATE = app
 WEBKIT += wtf
 
 INCLUDEPATH += \
+    $${ROOT_WEBKIT_DIR}/Source/WebCore/platform/qt \
     $${ROOT_WEBKIT_DIR}/Tools/DumpRenderTree/qt/
 
 SOURCES += \
-    $${ROOT_WEBKIT_DIR}/Tools/DumpRenderTree/qt/QtInitializeTestFonts.cpp \
     BrowserWindow.cpp \
     main.cpp \
     MiniBrowserApplication.cpp \
@@ -20,7 +20,6 @@ SOURCES += \
     utils.cpp \
 
 HEADERS += \
-    $${ROOT_WEBKIT_DIR}/Tools/DumpRenderTree/qt/QtInitializeTestFonts.h \
     BrowserWindow.h \
     MiniBrowserApplication.h \
     UrlLoader.h \
diff --git a/Tools/MiniBrowser/qt/MiniBrowserApplication.cpp b/Tools/MiniBrowser/qt/MiniBrowserApplication.cpp
index 68307c351..ec919a6a7 100644
--- a/Tools/MiniBrowser/qt/MiniBrowserApplication.cpp
+++ b/Tools/MiniBrowser/qt/MiniBrowserApplication.cpp
@@ -29,7 +29,7 @@
 #include "MiniBrowserApplication.h"
 
 #include "BrowserWindow.h"
-#include "QtInitializeTestFonts.h"
+#include "QtTestSupport.h"
 #include "private/qquickwebview_p.h"
 #include "utils.h"
 #include <QRegExp>
@@ -140,7 +140,6 @@ bool MiniBrowserApplication::notify(QObject* target, QEvent* event)
 
         switch (mouseEvent->type()) {
         case QEvent::MouseButtonPress:
-        case QEvent::MouseButtonDblClick:
             touchPoint.setId(mouseEvent->button());
             if (m_touchPoints.contains(touchPoint.id())) {
                 touchPoint.setState(Qt::TouchPointMoved);
@@ -176,6 +175,10 @@ bool MiniBrowserApplication::notify(QObject* target, QEvent* event)
             touchPoint.setId(mouseEvent->button());
             touchPoint.setState(Qt::TouchPointReleased);
             break;
+        case QEvent::MouseButtonDblClick:
+            // Eat double-clicks, their accompanying press event is all we need.
+            event->accept();
+            return true;
         default:
             Q_ASSERT_X(false, "multi-touch mocking", "unhandled event type");
         }
@@ -332,7 +335,7 @@ void MiniBrowserApplication::handleUserOptions()
     }
 
     if (takeOptionFlag(&args, QStringLiteral("--use-test-fonts")))
-        WebKit::initializeTestFonts();
+        WebKit::QtTestSupport::initializeTestFonts();
 
     if (args.contains("-r")) {
         QString listFile = takeOptionValue(&args, "-r");
diff --git a/Tools/QtTestBrowser/QtTestBrowser.pro b/Tools/QtTestBrowser/QtTestBrowser.pro
index f69606ab9..2fa9086d9 100644
--- a/Tools/QtTestBrowser/QtTestBrowser.pro
+++ b/Tools/QtTestBrowser/QtTestBrowser.pro
@@ -7,12 +7,12 @@
 TEMPLATE = app
 
 INCLUDEPATH += \
+    $${ROOT_WEBKIT_DIR}/Source/WebCore/platform/qt \
     $${ROOT_WEBKIT_DIR}/Source/WebKit/qt/WebCoreSupport \
     $${ROOT_WEBKIT_DIR}/Tools/DumpRenderTree/qt/ \
     $${ROOT_WEBKIT_DIR}/Source/WTF
 
 SOURCES += \
-    $${ROOT_WEBKIT_DIR}/Tools/DumpRenderTree/qt/QtInitializeTestFonts.cpp \
     locationedit.cpp \
     launcherwindow.cpp \
     qttestbrowser.cpp \
@@ -25,7 +25,6 @@ SOURCES += \
     cookiejar.cpp
 
 HEADERS += \
-    $${ROOT_WEBKIT_DIR}/Tools/DumpRenderTree/qt/QtInitializeTestFonts.h \
     locationedit.h \
     launcherwindow.h \
     mainwindow.h \
diff --git a/Tools/QtTestBrowser/qttestbrowser.cpp b/Tools/QtTestBrowser/qttestbrowser.cpp
index 64cb26153..fcd13a204 100644
--- a/Tools/QtTestBrowser/qttestbrowser.cpp
+++ b/Tools/QtTestBrowser/qttestbrowser.cpp
@@ -31,7 +31,7 @@
  */
 
 #include "DumpRenderTreeSupportQt.h"
-#include "QtInitializeTestFonts.h"
+#include "QtTestSupport.h"
 #include "launcherwindow.h"
 #include "urlloader.h"
 
@@ -241,7 +241,7 @@ void LauncherApplication::handleUserOptions()
 #endif
 
     if (args.contains("-use-test-fonts"))
-        WebKit::initializeTestFonts();
+        WebKit::QtTestSupport::initializeTestFonts();
 
     if (args.contains("-print-loaded-urls"))
         windowOptions.printLoadedUrls = true;
diff --git a/Tools/Scripts/check-inspector-strings b/Tools/Scripts/check-inspector-strings
index 48e5809f5..267c03a68 100755
--- a/Tools/Scripts/check-inspector-strings
+++ b/Tools/Scripts/check-inspector-strings
@@ -35,7 +35,9 @@ import os.path
 import re
 import sys
 
-from webkitpy.common.checkout.scm import detect_scm_system
+from webkitpy.common.checkout.scm import SCMDetector
+from webkitpy.common.system.filesystem import FileSystem
+from webkitpy.common.system.executive import Executive
 from webkitpy.common.system.logutils import configure_logging
 from webkitpy.style.checker import ProcessorBase
 from webkitpy.style.filereader import TextFileReader
@@ -47,10 +49,6 @@ _localized_strings = "Source/WebCore/English.lproj/localizedStrings.js"
 
 _log = logging.getLogger("check-inspector-strings")
 
-def decode_unicode_escapes(s):
-    xNN_converted_to_u00NN = s.replace("\\x", "\\u00")
-    return eval("ur\"" + xNN_converted_to_u00NN + "\"")
-
 class StringsExtractor(ProcessorBase):
     def __init__(self, patterns):
         self._patterns = patterns
@@ -70,7 +68,7 @@ class StringsExtractor(ProcessorBase):
             for pattern in self._patterns:
                 line_strings = re.findall(pattern, line)
                 for string in line_strings:
-                    self.strings[index].append(decode_unicode_escapes(string))
+                    self.strings[index].append(string)
                 index += 1
 
 class LocalizedStringsExtractor:
@@ -78,22 +76,60 @@ class LocalizedStringsExtractor:
         self.localized_strings = []
 
     def process_file(self, file_path):
-        localized_strings_file = codecs.open(file_path, encoding="utf-16", mode="r")
+        localized_strings_file = codecs.open(file_path, encoding="utf-8", mode="r")
         try:
             contents = localized_strings_file.read()
             lines = contents.split("\n")
             for line in lines:
                 match = re.match(r"localizedStrings\[\"((?:[^\"\\]|\\.)*?)\"", line)
                 if match:
-                    self.localized_strings.append(decode_unicode_escapes(match.group(1)))
+                    self.localized_strings.append(match.group(1))
         finally:
             localized_strings_file.close()
 
+def extract_ui_strings(str, out):
+    line_unrecognized = False
+    idx = 0
+    while idx < len(str):
+        idx = str.find("WebInspector.UIString(", idx)
+        if idx == -1:
+            break
+        idx = idx + len("WebInspector.UIString(")
+        balance = 1
+        item_recognized = False
+        while idx < len(str):
+            if str[idx] == ')':
+                balance = balance - 1
+                if balance == 0:
+                    break
+            elif str[idx] == '(':
+                balance = balance + 1
+            elif balance == 1:
+                if str[idx] == ',':
+                    break
+                elif str[idx] == '"':
+                    str_idx = idx + 1
+                    while str_idx < len(str):
+                        if str[str_idx] == '\\':
+                            str_idx = str_idx + 1
+                        elif str[str_idx] == '"':
+                            out.add(str[idx + 1 : str_idx])
+                            idx = str_idx
+                            item_recognized = True
+                            break
+                        str_idx = str_idx + 1
+            idx = idx + 1
+        if not item_recognized:
+            line_unrecognized = True
+    if line_unrecognized:
+        _log.info("Unrecognized: %s" % str)
+
 if __name__ == "__main__":
     configure_logging()
 
     cwd = os.path.abspath(os.curdir)
-    scm = detect_scm_system(cwd)
+    filesystem = FileSystem()
+    scm = SCMDetector(filesystem, Executive()).detect_scm_system(cwd)
 
     if scm is None:
         _log.error("WebKit checkout not found: You must run this script "
@@ -102,14 +138,17 @@ if __name__ == "__main__":
 
     checkout_root = scm.checkout_root
     _log.debug("WebKit checkout found with root: %s" % checkout_root)
-    change_directory(checkout_root=checkout_root, paths=None)
+    change_directory(filesystem, checkout_root=checkout_root, paths=None)
 
-    strings_extractor = StringsExtractor([r"WebInspector\.(?:UIString|formatLocalized)\(\"((?:[^\"\\]|\\.)*?)\"", r"\"((?:[^\"\\]|\\.)*?)\""])
-    file_reader = TextFileReader(strings_extractor)
+    strings_extractor = StringsExtractor([r"(WebInspector\.UIString\(.*)", r"\"((?:[^\"\\]|\\.)*?)\""])
+    file_reader = TextFileReader(filesystem, strings_extractor)
     file_reader.process_paths([_inspector_directory, _devtools_directory])
     localized_strings_extractor = LocalizedStringsExtractor()
     localized_strings_extractor.process_file(_localized_strings)
-    ui_strings = frozenset(strings_extractor.strings[0])
+    raw_ui_strings = frozenset(strings_extractor.strings[0])
+    ui_strings = set()
+    for s in raw_ui_strings:
+        extract_ui_strings(s, ui_strings)
     strings = frozenset(strings_extractor.strings[1])
     localized_strings = frozenset(localized_strings_extractor.localized_strings)
 
diff --git a/Tools/Scripts/old-run-webkit-tests b/Tools/Scripts/old-run-webkit-tests
index 89e4abcb2..ef3b197d4 100755
--- a/Tools/Scripts/old-run-webkit-tests
+++ b/Tools/Scripts/old-run-webkit-tests
@@ -2746,9 +2746,9 @@ sub printResults
         my $message;
         if ($typeCount == 1) {
             $typeText =~ s/were/was/;
-            $message = sprintf "1 test case (%d%%) %s\n", 1 * 100 / $count, $typeText;
+            $message = sprintf "1 test case %s\n", $typeText;
         } else {
-            $message = sprintf "%d test cases (%d%%) %s\n", $typeCount, $typeCount * 100 / $count, $typeText;
+            $message = sprintf "%d test cases %s\n", $typeCount, $typeText;
         }
         $message =~ s-\(0%\)-(<1%)-;
         print $message;
diff --git a/Tools/Scripts/run-gtk-tests b/Tools/Scripts/run-gtk-tests
index 1276596f1..b24cb24e7 100755
--- a/Tools/Scripts/run-gtk-tests
+++ b/Tools/Scripts/run-gtk-tests
@@ -67,7 +67,8 @@ class TestRunner:
         SkippedTest("unittests/testwebinspector", "/webkit/webinspector/close-and-inspect", "Test is flaky in GTK Linux 32-bit Release bot", 82869),
         SkippedTest("WebKit2APITests/TestWebKitWebView", "/webkit2/WebKitWebView/mouse-target", "Test is flaky in GTK Linux 32-bit Release bot", 82866),
         SkippedTest("WebKit2APITests/TestResources", "/webkit2/WebKitWebView/resources", "Test is flaky in GTK Linux 32-bit Release bot", 82868),
-        SkippedTest("WebKit2APITests/TestWebKitFindController", "/webkit2/WebKitFindController/hide", "Test  always fails in Xvfb", 89810),
+        SkippedTest("WebKit2APITests/TestWebKitFindController", "/webkit2/WebKitFindController/hide", "Test always fails in Xvfb", 89810),
+        SkippedTest("WebKit2APITests/TestWebKitAccessibility", "/webkit2/WebKitAccessibility/atspi-basic-hierarchy", "Test fails", 100408),
         SkippedTest("TestWebKitAPI/TestWebKit2", "WebKit2.WKConnection", "Tests fail and time out out", 84959),
         SkippedTest("TestWebKitAPI/TestWebKit2", "WebKit2.RestoreSessionStateContainingFormData", "Session State is not implemented in GTK+ port", 84960),
         SkippedTest("TestWebKitAPI/TestWebKit2", "WebKit2.SpacebarScrolling", "Test fails", 84961),
@@ -119,7 +120,6 @@ class TestRunner:
         return None
 
     def _start_accessibility_daemons(self):
-        return False
         spi_bus_launcher_path = self._lookup_atspi2_binary('at-spi-bus-launcher')
         spi_registryd_path = self._lookup_atspi2_binary('at-spi2-registryd')
         if not spi_bus_launcher_path or not spi_registryd_path:
diff --git a/Tools/Scripts/update-webkit b/Tools/Scripts/update-webkit
index eb94f165b..6ba8044f4 100755
--- a/Tools/Scripts/update-webkit
+++ b/Tools/Scripts/update-webkit
@@ -34,7 +34,6 @@ use strict;
 use FindBin;
 use lib $FindBin::Bin;
 use File::Basename;
-use File::Path;
 use File::Spec;
 use Getopt::Long;
 use VCSUtils;
@@ -87,8 +86,6 @@ if ($useNinja) {
     $ENV{"GYP_GENERATORS"} = "ninja";
 }
 
-my $startTime = time();
-
 my @svnOptions = ();
 push @svnOptions, '-q' if $quiet;
 
@@ -105,13 +102,6 @@ if (-d "../Internal") {
     runSvnUpdate() if isSVNDirectory(".");
     runGitUpdate() if isGitDirectory(".");
 } elsif (isChromium()) {
-    # Workaround for https://bugs.webkit.org/show_bug.cgi?id=38926
-    # We should remove the following "if" block when we find a right fix.
-    if ((isCygwin() || isWindows()) && (stat("WebKit/chromium/features.gypi"))[9] >= $startTime) {
-        print "features.gypi has been updated. Cleaning the build directories.\n";
-        rmtree(["WebKit/chromium/Debug", "WebKit/chromium/Release"]);
-    }
-
     my @chromiumUpdateArgs = ("perl", "Tools/Scripts/update-webkit-chromium");
     push @chromiumUpdateArgs, "--chromium-android" if isChromiumAndroid();
     push @chromiumUpdateArgs, "--force" if forceChromiumUpdate();
diff --git a/Tools/Scripts/webkitdirs.pm b/Tools/Scripts/webkitdirs.pm
index 0291c4776..c0e73c246 100755
--- a/Tools/Scripts/webkitdirs.pm
+++ b/Tools/Scripts/webkitdirs.pm
@@ -723,7 +723,7 @@ sub builtDylibPathForName
     }
     if (isQt()) {
         my $isSearchingForWebCore = $libraryName =~ "WebCore";
-        $libraryName = "QtWebKit";
+        $libraryName = "QtWebKitWidgets";
         my $result;
         if (isDarwin() and -d "$configurationProductDir/lib/$libraryName.framework") {
             $result = "$configurationProductDir/lib/$libraryName.framework/$libraryName";
@@ -2429,7 +2429,17 @@ sub buildChromiumNinja($$@)
     }
     my $command = "";
 
-    $command .= "ninja -C out/$config $target $makeArgs";
+    # Find ninja.
+    my $ninjaPath;
+    if (commandExists('ninja')) {
+        $ninjaPath = 'ninja';
+    } elsif (-e 'Source/WebKit/chromium/depot_tools/ninja') {
+        $ninjaPath = 'Source/WebKit/chromium/depot_tools/ninja';
+    } else {
+        die "ninja not found. Install chromium's depot_tools by running update-webkit first\n";
+    }
+
+    $command .= "$ninjaPath -C out/$config $target $makeArgs";
 
     print "$command\n";
     return system $command;
diff --git a/Tools/Scripts/webkitperl/FeatureList.pm b/Tools/Scripts/webkitperl/FeatureList.pm
index 5a77bf117..b34aec74b 100644
--- a/Tools/Scripts/webkitperl/FeatureList.pm
+++ b/Tools/Scripts/webkitperl/FeatureList.pm
@@ -52,6 +52,7 @@ my (
     $css3ConditionalRulesSupport,
     $css3TextSupport,
     $cssBoxDecorationBreakSupport,
+    $cssDeviceAdaptation,
     $cssExclusionsSupport,
     $cssFiltersSupport,
     $cssHierarchiesSupport,
@@ -111,6 +112,7 @@ my (
     $pageVisibilityAPISupport,
     $progressTagSupport,
     $quotaSupport,
+    $resolutionMediaQuerySupport,
     $registerProtocolHandlerSupport,
     $requestAnimationFrameSupport,
     $scriptedSpeechSupport,
@@ -126,7 +128,6 @@ my (
     $tiledBackingStoreSupport,
     $touchEventsSupport,
     $touchIconLoadingSupport,
-    $undoManagerSupport,
     $vibrationSupport,
     $videoSupport,
     $videoTrackSupport,
@@ -138,6 +139,7 @@ my (
     $webTimingSupport,
     $workersSupport,
     $xhrResponseBlobSupport,
+    $xhrTimeoutSupport,
     $xsltSupport,
 );
 
@@ -163,6 +165,9 @@ my @features = (
     { option => "csp-next", desc => "Toggle Content Security Policy 1.1 support",
       define => "ENABLE_CSP_NEXT", default => 0, value => \$cspNextSupport },
 
+    { option => "css-device-adaptation", desc => "Toggle CSS Device Adaptation support",
+      define => "ENABLE_CSS_DEVICE_ADAPTATION", default => isEfl(), value => \$cssDeviceAdaptation },
+
     { option => "css-exclusions", desc => "Toggle CSS Exclusions support",
       define => "ENABLE_CSS_EXCLUSIONS", default => 1, value => \$cssExclusionsSupport },
 
@@ -349,6 +354,9 @@ my @features = (
     { option => "quota", desc => "Toggle Quota support",
       define => "ENABLE_QUOTA", default => 0, value => \$quotaSupport },
 
+    { option => "resolution-media-query", desc => "Toggle resolution media query support",
+      define => "ENABLE_RESOLUTION_MEDIA_QUERY", default => (isEfl() || isQt()), value => \$resolutionMediaQuerySupport },
+
     { option => "request-animation-frame", desc => "Toggle Request Animation Frame support",
       define => "ENABLE_REQUEST_ANIMATION_FRAME", default => (isAppleMacWebKit() || isGtk() || isEfl() || isBlackBerry()), value => \$requestAnimationFrameSupport },
 
@@ -391,9 +399,6 @@ my @features = (
     { option => "touch-icon-loading", desc => "Toggle Touch Icon Loading Support",
       define => "ENABLE_TOUCH_ICON_LOADING", default => 0, value => \$touchIconLoadingSupport },
 
-    { option => "undo-manager", desc => "Toggle Undo Manager support",
-      define => "ENABLE_UNDO_MANAGER", default => 0, value => \$undoManagerSupport },
-
     { option => "vibration", desc => "Toggle Vibration support",
       define => "ENABLE_VIBRATION", default => (isEfl() || isBlackBerry()), value => \$vibrationSupport },
 
@@ -427,6 +432,9 @@ my @features = (
     { option => "xhr-response-blob", desc => "Toggle XHR Response BLOB support",
       define => "ENABLE_XHR_RESPONSE_BLOB", default => isBlackBerry(), value => \$xhrResponseBlobSupport },
 
+    { option => "xhr-timeout", desc => "Toggle XHR Timeout support",
+      define => "ENABLE_XHR_TIMEOUT", default => (isEfl() || isGtk() || isAppleMacWebKit()), value => \$xhrTimeoutSupport },
+
     { option => "xslt", desc => "Toggle XSLT support",
       define => "ENABLE_XSLT", default => 1, value => \$xsltSupport },
 );
diff --git a/Tools/Scripts/webkitpy/common/checkout/baselineoptimizer.py b/Tools/Scripts/webkitpy/common/checkout/baselineoptimizer.py
index 562d19ec8..d2d53a568 100644
--- a/Tools/Scripts/webkitpy/common/checkout/baselineoptimizer.py
+++ b/Tools/Scripts/webkitpy/common/checkout/baselineoptimizer.py
@@ -32,10 +32,11 @@ import logging
 
 _log = logging.getLogger(__name__)
 
+
 # Yes, it's a hypergraph.
 # FIXME: Should this function live with the ports somewhere?
 # Perhaps this should move onto PortFactory?
-def _baseline_search_hypergraph(host):
+def _baseline_search_hypergraph(host, port_names):
     hypergraph = {}
 
     # These edges in the hypergraph aren't visible on build.webkit.org,
@@ -46,7 +47,7 @@ def _baseline_search_hypergraph(host):
     fallback_path = ['LayoutTests']
 
     port_factory = host.port_factory
-    for port_name in port_factory.all_port_names():
+    for port_name in port_names:
         port = port_factory.get(port_name)
         webkit_base = port.webkit_base()
         search_path = port.baseline_search_path()
@@ -74,14 +75,14 @@ def _invert_dictionary(dictionary):
 
 
 class BaselineOptimizer(object):
-    def __init__(self, host):
+    def __init__(self, host, port_names):
         self._host = host
         self._filesystem = self._host.filesystem
         self._scm = self._host.scm()
-        self._hypergraph = _baseline_search_hypergraph(host)
+        self._hypergraph = _baseline_search_hypergraph(host, port_names)
         self._directories = reduce(set.union, map(set, self._hypergraph.values()))
 
-    def _read_results_by_directory(self, baseline_name):
+    def read_results_by_directory(self, baseline_name):
         results_by_directory = {}
         for directory in self._directories:
             path = self._filesystem.join(self._scm.checkout_root, directory, baseline_name)
@@ -122,7 +123,7 @@ class BaselineOptimizer(object):
             results_by_directory[directory] = result
 
     def _find_optimal_result_placement(self, baseline_name):
-        results_by_directory = self._read_results_by_directory(baseline_name)
+        results_by_directory = self.read_results_by_directory(baseline_name)
         results_by_port_name = self._results_by_port_name(results_by_directory)
         port_names_by_result = _invert_dictionary(results_by_port_name)
 
@@ -181,7 +182,7 @@ class BaselineOptimizer(object):
             return best_so_far
         except KeyError as e:
             # FIXME: KeyErrors get raised if we're missing baselines. We should handle this better.
-            return results_by_directory
+            return {}
 
     def _find_in_fallbackpath(self, fallback_path, current_result, results_by_directory):
         for index, directory in enumerate(fallback_path):
@@ -196,6 +197,15 @@ class BaselineOptimizer(object):
                 del results_by_port_name[port_name]
         return results_by_port_name
 
+    def _platform(self, filename):
+        platform_dir = 'LayoutTests' + self._filesystem.sep + 'platform' + self._filesystem.sep
+        if filename.startswith(platform_dir):
+            return filename.replace(platform_dir, '').split(self._filesystem.sep)[0]
+        platform_dir = self._filesystem.join(self._scm.checkout_root, platform_dir)
+        if filename.startswith(platform_dir):
+            return filename.replace(platform_dir, '').split(self._filesystem.sep)[0]
+        return '(generic)'
+
     def _move_baselines(self, baseline_name, results_by_directory, new_results_by_directory):
         data_for_result = {}
         for directory, result in results_by_directory.items():
@@ -208,12 +218,12 @@ class BaselineOptimizer(object):
             if new_results_by_directory.get(directory) != result:
                 file_names.append(self._filesystem.join(self._scm.checkout_root, directory, baseline_name))
         if file_names:
-            _log.debug("deleting:")
-            for filename in file_names:
-                _log.debug("  " + self._filesystem.relpath(filename, self._scm.checkout_root).replace(baseline_name, ''))
+            _log.debug("    Deleting:")
+            for platform_dir in sorted(self._platform(filename) for filename in file_names):
+                _log.debug("      " + platform_dir)
             self._scm.delete_list(file_names)
         else:
-            _log.debug("nothing to delete")
+            _log.debug("    (Nothing to delete)")
 
         file_names = []
         for directory, result in new_results_by_directory.items():
@@ -223,33 +233,42 @@ class BaselineOptimizer(object):
                 self._filesystem.write_binary_file(destination, data_for_result[result])
                 file_names.append(destination)
         if file_names:
-            _log.debug("adding:")
-            for filename in file_names:
-                _log.debug("  " + self._filesystem.relpath(filename, self._scm.checkout_root).replace(baseline_name, ''))
+            _log.debug("    Adding:")
+            for platform_dir in sorted(self._platform(filename) for filename in file_names):
+                _log.debug("      " + platform_dir)
             self._scm.add_list(file_names)
         else:
-            _log.debug("nothing to add")
+            _log.debug("    (Nothing to add)")
 
     def directories_by_result(self, baseline_name):
-        results_by_directory = self._read_results_by_directory(baseline_name)
+        results_by_directory = self.read_results_by_directory(baseline_name)
         return _invert_dictionary(results_by_directory)
 
+    def write_by_directory(self, results_by_directory, writer, indent):
+        for path in sorted(results_by_directory):
+            writer("%s%s: %s" % (indent, self._platform(path), results_by_directory[path][0:6]))
+
     def optimize(self, baseline_name):
+        basename = self._filesystem.basename(baseline_name)
         results_by_directory, new_results_by_directory = self._find_optimal_result_placement(baseline_name)
         self.new_results_by_directory = new_results_by_directory
         if new_results_by_directory == results_by_directory:
-            _log.debug("No optimization found, optimal?")
+            if new_results_by_directory:
+                _log.debug("  %s: (already optimal)" % basename)
+                self.write_by_directory(results_by_directory, _log.debug, "    ")
+            else:
+                _log.debug("  %s: (no baselines found)" % basename)
             return True
         if self._filtered_results_by_port_name(results_by_directory) != self._filtered_results_by_port_name(new_results_by_directory):
-            _log.warning("Optimization failed")
+            _log.warning("  %s: optimization failed" % basename)
+            self.write_by_directory(results_by_directory, _log.warning, "      ")
             return False
 
-        _log.debug("before: ")
-        for path, result in results_by_directory.items():
-            _log.debug("  %s: %s" % (self._filesystem.relpath(path, self._scm.checkout_root).replace(baseline_name, ''), result[0:6]))
-        _log.debug("after: ")
-        for path, result in new_results_by_directory.items():
-            _log.debug("  %s: %s" % (self._filesystem.relpath(path, self._scm.checkout_root).replace(baseline_name, ''), result[0:6]))
+        _log.debug("  %s:" % basename)
+        _log.debug("    Before: ")
+        self.write_by_directory(results_by_directory, _log.debug, "      ")
+        _log.debug("    After: ")
+        self.write_by_directory(new_results_by_directory, _log.debug, "      ")
 
         self._move_baselines(baseline_name, results_by_directory, new_results_by_directory)
         return True
diff --git a/Tools/Scripts/webkitpy/common/checkout/baselineoptimizer_unittest.py b/Tools/Scripts/webkitpy/common/checkout/baselineoptimizer_unittest.py
index d44f71e91..a5fd06568 100644
--- a/Tools/Scripts/webkitpy/common/checkout/baselineoptimizer_unittest.py
+++ b/Tools/Scripts/webkitpy/common/checkout/baselineoptimizer_unittest.py
@@ -37,12 +37,12 @@ from webkitpy.common.host_mock import MockHost
 class TestBaselineOptimizer(BaselineOptimizer):
     def __init__(self, mock_results_by_directory):
         host = MockHost()
-        BaselineOptimizer.__init__(self, host)
+        BaselineOptimizer.__init__(self, host, host.port_factory.all_port_names())
         self._mock_results_by_directory = mock_results_by_directory
 
     # We override this method for testing so we don't have to construct an
     # elaborate mock file system.
-    def _read_results_by_directory(self, baseline_name):
+    def read_results_by_directory(self, baseline_name):
         return self._mock_results_by_directory
 
     def _move_baselines(self, baseline_name, results_by_directory, new_results_by_directory):
@@ -64,7 +64,7 @@ class BaselineOptimizerTest(unittest.TestCase):
         host.filesystem.write_binary_file('/mock-checkout/LayoutTests/platform/chromium-win/another/test-expected.txt', 'result A')
         host.filesystem.write_binary_file('/mock-checkout/LayoutTests/platform/chromium-mac/another/test-expected.txt', 'result A')
         host.filesystem.write_binary_file('/mock-checkout/LayoutTests/platform/chromium/another/test-expected.txt', 'result B')
-        baseline_optimizer = BaselineOptimizer(host)
+        baseline_optimizer = BaselineOptimizer(host, host.port_factory.all_port_names())
         baseline_optimizer._move_baselines('another/test-expected.txt', {
             'LayoutTests/platform/chromium-win': 'aaa',
             'LayoutTests/platform/chromium-mac': 'aaa',
diff --git a/Tools/Scripts/webkitpy/common/config/committers.py b/Tools/Scripts/webkitpy/common/config/committers.py
index 5396024a0..3931c5c39 100644
--- a/Tools/Scripts/webkitpy/common/config/committers.py
+++ b/Tools/Scripts/webkitpy/common/config/committers.py
@@ -107,6 +107,7 @@ watchers_who_are_not_contributors = [
 
 
 contributors_who_are_not_committers = [
+    Contributor("Adobe Bug Tracker", "WebkitBugTracker@adobe.com"),
     Contributor("Aharon Lanin", "aharon@google.com"),
     Contributor("Alan Stearns", "stearns@adobe.com", "astearns"),
     Contributor("Alejandro Pineiro", "apinheiro@igalia.com"),
@@ -130,6 +131,7 @@ contributors_who_are_not_committers = [
     Contributor("Felician Marton", ["felician@inf.u-szeged.hu", "marton.felician.zoltan@stud.u-szeged.hu"], "Felician"),
     Contributor("Finnur Thorarinsson", ["finnur@chromium.org", "finnur.webkit@gmail.com"], "finnur"),
     Contributor("Forms Bugs", "forms-bugs@chromium.org"),
+    Contributor("Glenn Adams", "glenn@skynav.com", "gasubic"),
     Contributor("Gabor Ballabas", "gaborb@inf.u-szeged.hu", "bgabor"),
     Contributor("Grace Kloba", "klobag@chromium.org", "klobag"),
     Contributor("Greg Simon", "gregsimon@chromium.org", "gregsimon"),
@@ -161,7 +163,6 @@ contributors_who_are_not_committers = [
     Contributor("Szilard Ledan-Muntean", "szledan@inf.u-szeged.hu", "szledan"),
     Contributor("Tab Atkins", ["tabatkins@google.com", "jackalmage@gmail.com"], "tabatkins"),
     Contributor("Tamas Czene", ["tczene@inf.u-szeged.hu", "Czene.Tamas@stud.u-szeged.hu"], "tczene"),
-    Contributor("Terry Anderson", "tdanderson@chromium.org", "tdanderson"),
     Contributor("Tien-Ren Chen", "trchen@chromium.org", "trchen"),
     Contributor("WebKit Review Bot", "webkit.review.bot@gmail.com", "sheriff-bot"),
     Contributor("Web Components Team", "webcomponents-bugzilla@chromium.org"),
@@ -218,6 +219,7 @@ committers_unable_to_review = [
     Committer("Benjamin Otte", ["otte@gnome.org", "otte@webkit.org"], "otte"),
     Committer("Bill Budge", ["bbudge@chromium.org", "bbudge@gmail.com"], "bbudge"),
     Committer("Brett Wilson", "brettw@chromium.org", "brettx"),
+    Committer("Bruno de Oliveira Abinader", ["bruno.abinader@basyskom.com", "brunoabinader@gmail.com"], "abinader"),
     Committer("Cameron McCormack", ["cam@mcc.id.au", "cam@webkit.org"], "heycam"),
     Committer("Carol Szabo", ["carol@webkit.org", "carol.szabo@nokia.com"], "cszabo1"),
     Committer("Cary Clark", ["caryclark@google.com", "caryclark@chromium.org"], "caryclark"),
@@ -232,7 +234,7 @@ committers_unable_to_review = [
     Committer("Dan Winship", "danw@gnome.org", "danw"),
     Committer("Dana Jansens", "danakj@chromium.org", "danakj"),
     Committer("Daniel Cheng", "dcheng@chromium.org", "dcheng"),
-    Committer("Dave Barton", "dbarton@mathscribe.com", "dbarton"),
+    Committer("Dave Barton", "dbarton@mathscribe.com", "davebarton"),
     Committer("Dave Tharp", "dtharp@codeaurora.org", "dtharp"),
     Committer("David Michael Barr", ["davidbarr@chromium.org", "davidbarr@google.com", "b@rr-dav.id.au"], "barrbrain"),
     Committer("David Grogan", ["dgrogan@chromium.org", "dgrogan@google.com"], "dgrogan"),
@@ -296,6 +298,7 @@ committers_unable_to_review = [
     Committer("John Knottenbelt", "jknotten@chromium.org", "jknotten"),
     Committer("Johnny Ding", ["jnd@chromium.org", "johnnyding.webkit@gmail.com"], "johnnyding"),
     Committer("Jon Lee", "jonlee@apple.com", "jonlee"),
+    Committer("Jonathan Dong", ["jonathan.dong@torchmobile.com.cn"], "jondong"),
     Committer("Joone Hur", ["joone@webkit.org", "joone.hur@intel.com"], "joone"),
     Committer("Joost de Valk", ["joost@webkit.org", "webkit-dev@joostdevalk.nl"], "Altha"),
     Committer("Joshua Bell", ["jsbell@chromium.org", "jsbell@google.com"], "jsbell"),
@@ -310,6 +313,7 @@ committers_unable_to_review = [
     Committer("Kenichi Ishibashi", "bashi@chromium.org", "bashi"),
     Committer("Kenji Imasaki", "imasaki@chromium.org", "imasaki"),
     Committer("Kent Hansen", "kent.hansen@nokia.com", "khansen"),
+    Committer("Kihong Kwon", "kihong.kwon@samsung.com", "kihong"),
     Committer(u"Kim Gr\u00f6nholm", "kim.1.gronholm@nokia.com"),
     Committer("Kimmo Kinnunen", ["kimmo.t.kinnunen@nokia.com", "kimmok@iki.fi", "ktkinnun@webkit.org"], "kimmok"),
     Committer("Kinuko Yasuda", "kinuko@chromium.org", "kinuko"),
@@ -383,7 +387,9 @@ committers_unable_to_review = [
     Committer("Stephen Chenney", "schenney@chromium.org", "schenney"),
     Committer("Steve Lacey", "sjl@chromium.org", "stevela"),
     Committer("Taiju Tsuiki", "tzik@chromium.org", "tzik"),
+    Committer("Takashi Sakamoto", "tasak@google.com", "tasak"),
     Committer("Takashi Toyoshima", "toyoshim@chromium.org", "toyoshim"),
+    Committer("Terry Anderson", "tdanderson@chromium.org", "tdanderson"),
     Committer("Thomas Sepez", "tsepez@chromium.org", "tsepez"),
     Committer("Tom Hudson", ["tomhudson@google.com", "tomhudson@chromium.org"], "tomhudson"),
     Committer("Tom Zakrajsek", "tomz@codeaurora.org", "tomz"),
@@ -401,7 +407,7 @@ committers_unable_to_review = [
     Committer("W. James MacLean", "wjmaclean@chromium.org", "seumas"),
     Committer("Xianzhu Wang", ["wangxianzhu@chromium.org", "phnixwxz@gmail.com", "wangxianzhu@google.com"], "wangxianzhu"),
     Committer("Xiaomei Ji", "xji@chromium.org", "xji"),
-    Committer("Yael Aharon", "yael.aharon@nokia.com", "yael"),
+    Committer("Yael Aharon", ["yael.aharon.m@gmail.com", "yael@webkit.org"], "yael"),
     Committer("Yaar Schnitman", ["yaar@chromium.org", "yaar@google.com"]),
     Committer("Yi Shen", ["yi.4.shen@nokia.com", "shenyi2006@gmail.com"]),
     Committer("Yongjun Zhang", ["yongjun.zhang@nokia.com", "yongjun_zhang@apple.com"]),
@@ -496,8 +502,8 @@ reviewers_list = [
     Reviewer("Julien Chaffraix", ["jchaffraix@webkit.org", "julien.chaffraix@gmail.com", "jchaffraix@google.com", "jchaffraix@codeaurora.org"], "jchaffraix"),
     Reviewer("Justin Garcia", "justin.garcia@apple.com", "justing"),
     Reviewer("Ken Kocienda", "kocienda@apple.com"),
-    Reviewer("Kenneth Rohde Christiansen", ["kenneth@webkit.org", "kenneth.christiansen@openbossa.org", "kenneth.christiansen@gmail.com"], ["kenne", "kenneth"]),
-    Reviewer("Kenneth Russell", "kbr@google.com", "kbr_google"),
+    Reviewer("Kenneth Rohde Christiansen", ["kenneth@webkit.org", "kenneth.r.christiansen@intel.com", "kenneth.christiansen@gmail.com"], ["kenneth_", "kenneth", "kenne"]),
+    Reviewer("Kenneth Russell", ["kbr@google.com", "kbr@chromium.org"], ["kbr_google", "kbrgg"]),
     Reviewer("Kent Tamura", ["tkent@chromium.org", "tkent@google.com"], "tkent"),
     Reviewer("Kentaro Hara", ["haraken@chromium.org"], "haraken"),
     Reviewer("Kevin Decker", "kdecker@apple.com", "superkevin"),
diff --git a/Tools/Scripts/webkitpy/common/config/watchlist b/Tools/Scripts/webkitpy/common/config/watchlist
index ac2270004..c3c9c9a2c 100755
--- a/Tools/Scripts/webkitpy/common/config/watchlist
+++ b/Tools/Scripts/webkitpy/common/config/watchlist
@@ -259,8 +259,9 @@
             "filename": r"Source/WebCore/svg"
                         r"|Source/WebCore/rendering/svg",
         },
-        "WebInspectorProtocol": {
-            "filename": r"Source/WebCore/inspector/Inspector.json",
+        "WebInspectorAPI": {
+            "filename": r"Source/WebCore/inspector/*.json"
+                        r"|Source/WebCore/inspector/*.idl",
         },
         "WebSocket": {
             "filename": r"Source/WebCore/Modules/websockets"
@@ -334,7 +335,7 @@
         "WatchListScript": [ "levin+watchlist@chromium.org", ],
         "WebGL": [ "dino@apple.com" ],
         "WebIDL": [ "abarth@webkit.org", "ojan@chromium.org" ],
-        "WebInspectorProtocol": [ "timothy@apple.com", "joepeck@webkit.org" ],
+        "WebInspectorAPI": [ "timothy@apple.com", "joepeck@webkit.org" ],
         "WebKitGTKTranslations": [ "gns@gnome.org", "mrobinson@webkit.org" ],
         "WebSocket": [ "yutak@chromium.org" ],
         "XSS": [ "dbates@webkit.org" ],
diff --git a/Tools/Scripts/webkitpy/common/net/web_mock.py b/Tools/Scripts/webkitpy/common/net/web_mock.py
index 596dd0a41..423573c60 100644
--- a/Tools/Scripts/webkitpy/common/net/web_mock.py
+++ b/Tools/Scripts/webkitpy/common/net/web_mock.py
@@ -30,7 +30,11 @@ import StringIO
 
 
 class MockWeb(object):
+    def __init__(self):
+        self.urls_fetched = []
+
     def get_binary(self, url, convert_404_to_None=False):
+        self.urls_fetched.append(url)
         return "MOCK Web result, convert 404 to None=%s" % convert_404_to_None
 
 
diff --git a/Tools/Scripts/webkitpy/common/system/autoinstall.py b/Tools/Scripts/webkitpy/common/system/autoinstall.py
index 00aff83ff..f3045f86b 100755
--- a/Tools/Scripts/webkitpy/common/system/autoinstall.py
+++ b/Tools/Scripts/webkitpy/common/system/autoinstall.py
@@ -33,7 +33,6 @@
 
 import codecs
 import logging
-import new
 import os
 import shutil
 import sys
@@ -42,7 +41,6 @@ import tempfile
 import urllib
 import urlparse
 import zipfile
-import zipimport
 
 _log = logging.getLogger(__name__)
 
@@ -97,35 +95,9 @@ class AutoInstaller(object):
         self._target_dir = target_dir
         self._temp_dir = temp_dir
 
-    def _log_transfer(self, message, source, target, log_method=None):
-        """Log a debug message that involves a source and target."""
-        if log_method is None:
-            log_method = _log.debug
-
-        log_method("%s" % message)
-        log_method('    From: "%s"' % source)
-        log_method('      To: "%s"' % target)
-
-    def _create_directory(self, path, name=None):
-        """Create a directory."""
-        log = _log.debug
-
-        name = name + " " if name is not None else ""
-        log('Creating %sdirectory...' % name)
-        log('    "%s"' % path)
-
-        os.makedirs(path)
-
     def _write_file(self, path, text, encoding):
-        """Create a file at the given path with given text.
-
-        This method overwrites any existing file.
-
-        """
-        _log.debug("Creating file...")
-        _log.debug('    "%s"' % path)
-        with codecs.open(path, "w", encoding) as file:
-            file.write(text)
+        with codecs.open(path, "w", encoding) as filehandle:
+            filehandle.write(text)
 
     def _set_up_target_dir(self, target_dir, append_to_search_path,
                            make_package):
@@ -143,17 +115,20 @@ class AutoInstaller(object):
 
         """
         if not os.path.exists(target_dir):
-            self._create_directory(target_dir, "autoinstall target")
+            os.makedirs(target_dir)
 
         if append_to_search_path:
             sys.path.append(target_dir)
 
         if make_package:
-            init_path = os.path.join(target_dir, "__init__.py")
-            if not os.path.exists(init_path):
-                text = ("# This file is required for Python to search this "
-                        "directory for modules.\n")
-                self._write_file(init_path, text, "ascii")
+            self._make_package(target_dir)
+
+    def _make_package(self, target_dir):
+        init_path = os.path.join(target_dir, "__init__.py")
+        if not os.path.exists(init_path):
+            text = ("# This file is required for Python to search this "
+                    "directory for modules.\n")
+            self._write_file(init_path, text, "ascii")
 
     def _create_scratch_directory_inner(self, prefix):
         """Create a scratch directory without exception handling.
@@ -182,7 +157,7 @@ class AutoInstaller(object):
         temp directory if it does not already exist.
 
         """
-        prefix = target_name + "_"
+        prefix = target_name.replace(os.sep, "_") + "_"
         try:
             scratch_dir = self._create_scratch_directory_inner(prefix)
         except OSError:
@@ -192,51 +167,32 @@ class AutoInstaller(object):
             if temp_dir is None or os.path.exists(temp_dir):
                 raise
             # Else try again after creating the temp directory.
-            self._create_directory(temp_dir, "autoinstall temp")
+            os.makedirs(temp_dir)
             scratch_dir = self._create_scratch_directory_inner(prefix)
 
         return scratch_dir
 
     def _url_downloaded_path(self, target_name):
-        """Return the path to the file containing the URL downloaded."""
-        filename = ".%s.url" % target_name
-        path = os.path.join(self._target_dir, filename)
-        return path
+        return os.path.join(self._target_dir, ".%s.url" % target_name)
 
     def _is_downloaded(self, target_name, url):
-        """Return whether a package version has been downloaded."""
         version_path = self._url_downloaded_path(target_name)
 
-        _log.debug('Checking %s URL downloaded...' % target_name)
-        _log.debug('    "%s"' % version_path)
-
         if not os.path.exists(version_path):
-            # Then no package version has been downloaded.
-            _log.debug("No URL file found.")
             return False
 
-        with codecs.open(version_path, "r", "utf-8") as file:
-            version = file.read()
-
-        return version.strip() == url.strip()
+        with codecs.open(version_path, "r", "utf-8") as filehandle:
+            return filehandle.read().strip() == url.strip()
 
     def _record_url_downloaded(self, target_name, url):
-        """Record the URL downloaded to a file."""
         version_path = self._url_downloaded_path(target_name)
-        _log.debug("Recording URL downloaded...")
-        _log.debug('    URL: "%s"' % url)
-        _log.debug('     To: "%s"' % version_path)
-
         self._write_file(version_path, url, "utf-8")
 
     def _extract_targz(self, path, scratch_dir):
-        # tarfile.extractall() extracts to a path without the
-        # trailing ".tar.gz".
+        # tarfile.extractall() extracts to a path without the trailing ".tar.gz".
         target_basename = os.path.basename(path[:-len(".tar.gz")])
         target_path = os.path.join(scratch_dir, target_basename)
 
-        self._log_transfer("Starting gunzip/extract...", path, target_path)
-
         try:
             tar_file = tarfile.open(path)
         except tarfile.ReadError, err:
@@ -248,11 +204,6 @@ class AutoInstaller(object):
             raise Exception(message)
 
         try:
-            # This is helpful for debugging purposes.
-            _log.debug("Listing tar file contents...")
-            for name in tar_file.getnames():
-                _log.debug('    * "%s"' % name)
-            _log.debug("Extracting gzipped tar file...")
             tar_file.extractall(target_path)
         finally:
             tar_file.close()
@@ -263,33 +214,23 @@ class AutoInstaller(object):
     # available in Python 2.6 but not in earlier versions.
     # NOTE: The version in 2.6.1 (which shipped on Snow Leopard) is broken!
     def _extract_all(self, zip_file, target_dir):
-        self._log_transfer("Extracting zip file...", zip_file, target_dir)
-
-        # This is helpful for debugging purposes.
-        _log.debug("Listing zip file contents...")
-        for name in zip_file.namelist():
-            _log.debug('    * "%s"' % name)
-
         for name in zip_file.namelist():
             path = os.path.join(target_dir, name)
-            self._log_transfer("Extracting...", name, path)
-
             if not os.path.basename(path):
                 # Then the path ends in a slash, so it is a directory.
-                self._create_directory(path)
+                os.makedirs(path)
                 continue
-            # Otherwise, it is a file.
 
             try:
                 # We open this file w/o encoding, as we're reading/writing
                 # the raw byte-stream from the zip file.
                 outfile = open(path, 'wb')
-            except IOError, err:
+            except IOError:
                 # Not all zip files seem to list the directories explicitly,
                 # so try again after creating the containing directory.
                 _log.debug("Got IOError: retrying after creating directory...")
-                dir = os.path.dirname(path)
-                self._create_directory(dir)
+                dirname = os.path.dirname(path)
+                os.makedirs(dirname)
                 outfile = open(path, 'wb')
 
             try:
@@ -298,13 +239,10 @@ class AutoInstaller(object):
                 outfile.close()
 
     def _unzip(self, path, scratch_dir):
-        # zipfile.extractall() extracts to a path without the
-        # trailing ".zip".
+        # zipfile.extractall() extracts to a path without the trailing ".zip".
         target_basename = os.path.basename(path[:-len(".zip")])
         target_path = os.path.join(scratch_dir, target_basename)
 
-        self._log_transfer("Starting unzip...", path, target_path)
-
         try:
             zip_file = zipfile.ZipFile(path, "r")
         except zipfile.BadZipfile, err:
@@ -345,7 +283,6 @@ class AutoInstaller(object):
         return new_path
 
     def _download_to_stream(self, url, stream):
-        """Download an URL to a stream, and return the number of bytes."""
         try:
             netstream = urllib.urlopen(url)
         except IOError, err:
@@ -364,29 +301,21 @@ class AutoInstaller(object):
             raise ValueError("HTTP Error code %s" % code)
 
         BUFSIZE = 2**13  # 8KB
-        bytes = 0
         while True:
             data = netstream.read(BUFSIZE)
             if not data:
                 break
             stream.write(data)
-            bytes += len(data)
         netstream.close()
-        return bytes
 
     def _download(self, url, scratch_dir):
-        """Download URL contents, and return the download path."""
         url_path = urlparse.urlsplit(url)[2]
         url_path = os.path.normpath(url_path)  # Removes trailing slash.
         target_filename = os.path.basename(url_path)
         target_path = os.path.join(scratch_dir, target_filename)
 
-        self._log_transfer("Starting download...", url, target_path)
-
         with open(target_path, "wb") as stream:
-            bytes = self._download_to_stream(url, stream)
-
-        _log.debug("Downloaded %s bytes." % bytes)
+            self._download_to_stream(url, stream)
 
         return target_path
 
@@ -407,19 +336,21 @@ class AutoInstaller(object):
             source_path = os.path.join(path, url_subpath)
 
         if os.path.exists(target_path):
-            _log.debug('Refreshing install: deleting "%s".' % target_path)
             if os.path.isdir(target_path):
                 shutil.rmtree(target_path)
             else:
                 os.remove(target_path)
 
-        self._log_transfer("Moving files into place...", source_path, target_path)
-
-        # The shutil.move() command creates intermediate directories if they
-        # do not exist, but we do not rely on this behavior since we
-        # need to create the __init__.py file anyway.
+        # shutil.move() command creates intermediate directories if they do not exist.
         shutil.move(source_path, target_path)
 
+        # ensure all the new directories are importable.
+        intermediate_dirs = os.path.dirname(os.path.relpath(target_path, self._target_dir))
+        parent_dirname = self._target_dir
+        for dirname in intermediate_dirs.split(os.sep):
+            parent_dirname = os.path.join(parent_dirname, dirname)
+            self._make_package(parent_dirname)
+
         self._record_url_downloaded(package_name, url)
 
     def install(self, url, should_refresh=False, target_name=None,
@@ -453,13 +384,10 @@ class AutoInstaller(object):
 
         target_path = os.path.join(self._target_dir, target_name)
         if not should_refresh and self._is_downloaded(target_name, url):
-            _log.debug('URL for %s already downloaded.  Skipping...'
-                       % target_name)
-            _log.debug('    "%s"' % url)
             return False
 
-        self._log_transfer("Auto-installing package: %s" % target_name,
-                            url, target_path, log_method=_log.info)
+        package_name = target_name.replace(os.sep, '.')
+        _log.info("Auto-installing package: %s" % package_name)
 
         # The scratch directory is where we will download and prepare
         # files specific to this install until they are ready to move
@@ -467,7 +395,7 @@ class AutoInstaller(object):
         scratch_dir = self._create_scratch_directory(target_name)
 
         try:
-            self._install(package_name=target_name,
+            self._install(package_name=package_name,
                           target_path=target_path,
                           scratch_dir=scratch_dir,
                           url=url,
@@ -480,38 +408,7 @@ class AutoInstaller(object):
                        % (target_name, target_path, err))
             raise Exception(message)
         finally:
-            _log.debug('Cleaning up: deleting "%s".' % scratch_dir)
             shutil.rmtree(scratch_dir)
-        _log.debug('Auto-installed %s to:' % target_name)
+        _log.debug('Auto-installed %s to:' % url)
         _log.debug('    "%s"' % target_path)
         return True
-
-
-if __name__=="__main__":
-
-    # Configure the autoinstall logger to log DEBUG messages for
-    # development testing purposes.
-    console = logging.StreamHandler()
-
-    formatter = logging.Formatter('%(name)s: %(levelname)-8s %(message)s')
-    console.setFormatter(formatter)
-    _log.addHandler(console)
-    _log.setLevel(logging.DEBUG)
-
-    # Use a more visible temp directory for debug purposes.
-    this_dir = os.path.dirname(__file__)
-    target_dir = os.path.join(this_dir, "autoinstalled")
-    temp_dir = os.path.join(target_dir, "Temp")
-
-    installer = AutoInstaller(target_dir=target_dir,
-                              temp_dir=temp_dir)
-
-    installer.install(should_refresh=False,
-                      target_name="pep8.py",
-                      url="http://pypi.python.org/packages/source/p/pep8/pep8-0.5.0.tar.gz#md5=512a818af9979290cd619cce8e9c2e2b",
-                      url_subpath="pep8-0.5.0/pep8.py")
-    installer.install(should_refresh=False,
-                      target_name="mechanize",
-                      url="http://pypi.python.org/packages/source/m/mechanize/mechanize-0.2.4.zip",
-                      url_subpath="mechanize")
-
diff --git a/Tools/Scripts/webkitpy/common/system/executive.py b/Tools/Scripts/webkitpy/common/system/executive.py
index f1a401268..b1d239090 100644
--- a/Tools/Scripts/webkitpy/common/system/executive.py
+++ b/Tools/Scripts/webkitpy/common/system/executive.py
@@ -215,6 +215,9 @@ class Executive(object):
                 if e.errno == errno.ECHILD:
                     # Can't wait on a non-child process, but the kill worked.
                     return
+                if e.errno == errno.EACCES and sys.platform == 'cygwin':
+                    # Cygwin python sometimes can't kill native processes.
+                    return
                 raise
 
     def _win32_check_running_pid(self, pid):
diff --git a/Tools/Scripts/webkitpy/common/system/executive_mock.py b/Tools/Scripts/webkitpy/common/system/executive_mock.py
index cce21b233..c2613530b 100644
--- a/Tools/Scripts/webkitpy/common/system/executive_mock.py
+++ b/Tools/Scripts/webkitpy/common/system/executive_mock.py
@@ -60,6 +60,7 @@ class MockExecutive(object):
         # FIXME: Once executive wraps os.getpid() we can just use a static pid for "this" process.
         self._running_pids = {'test-webkitpy': os.getpid()}
         self._proc = None
+        self.calls = []
 
     def check_running_pid(self, pid):
         return pid in self._running_pids.values()
@@ -92,6 +93,9 @@ class MockExecutive(object):
                     return_stderr=True,
                     decode_output=False,
                     env=None):
+
+        self.calls.append(args)
+
         assert(isinstance(args, list) or isinstance(args, tuple))
         if self._should_log:
             env_string = ""
@@ -109,7 +113,14 @@ class MockExecutive(object):
     def cpu_count(self):
         return 2
 
+    def kill_all(self, process_name):
+        pass
+
+    def kill_process(self, pid):
+        pass
+
     def popen(self, args, cwd=None, env=None, **kwargs):
+        self.calls.append(args)
         if self._should_log:
             cwd_string = ""
             if cwd:
@@ -123,32 +134,27 @@ class MockExecutive(object):
         return self._proc
 
     def run_in_parallel(self, commands):
+        num_previous_calls = len(self.calls)
         command_outputs = []
         for cmd_line, cwd in commands:
             command_outputs.append([0, self.run_command(cmd_line, cwd=cwd), ''])
+
+        new_calls = self.calls[num_previous_calls:]
+        self.calls = self.calls[:num_previous_calls]
+        self.calls.append(new_calls)
         return command_outputs
 
-class MockExecutive2(object):
-    @staticmethod
-    def ignore_error(error):
-        pass
 
-    def __init__(self, output='', exit_code=0, exception=None,
-                 run_command_fn=None, stderr=''):
+class MockExecutive2(MockExecutive):
+    """MockExecutive2 is like MockExecutive except it doesn't log anything."""
+
+    def __init__(self, output='', exit_code=0, exception=None, run_command_fn=None, stderr=''):
         self._output = output
         self._stderr = stderr
         self._exit_code = exit_code
         self._exception = exception
         self._run_command_fn = run_command_fn
-
-    def cpu_count(self):
-        return 2
-
-    def kill_all(self, process_name):
-        pass
-
-    def kill_process(self, pid):
-        pass
+        self.calls = []
 
     def run_command(self,
                     args,
@@ -159,6 +165,7 @@ class MockExecutive2(object):
                     return_stderr=True,
                     decode_output=False,
                     env=None):
+        self.calls.append(args)
         assert(isinstance(args, list) or isinstance(args, tuple))
         if self._exception:
             raise self._exception
diff --git a/Tools/Scripts/webkitpy/common/system/file_lock_mock.py b/Tools/Scripts/webkitpy/common/system/file_lock_mock.py
new file mode 100644
index 000000000..e2c1d5cdf
--- /dev/null
+++ b/Tools/Scripts/webkitpy/common/system/file_lock_mock.py
@@ -0,0 +1,36 @@
+#!/usr/bin/env python
+# Copyright (c) 2012 Google Inc. All rights reserved.
+#
+# All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+# 1. Redistributions of source code must retain the above copyright
+#    notice, this list of conditions and the following disclaimer.
+# 2. Redistributions in binary form must reproduce the above copyright
+#    notice, this list of conditions and the following disclaimer in the
+#    documentation and/or other materials provided with the distribution.
+#
+# THIS SOFTWARE IS PROVIDED BY UNIVERSITY OF SZEGED ``AS IS'' AND ANY
+# EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+# PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL UNIVERSITY OF SZEGED OR
+# CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+# EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+# PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+# PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+# OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+
+class MockFileLock(object):
+    def __init__(self, lock_file_path, max_wait_time_sec=20):
+        pass
+
+    def acquire_lock(self):
+        pass
+
+    def release_lock(self):
+        pass
diff --git a/Tools/Scripts/webkitpy/common/system/logutils.py b/Tools/Scripts/webkitpy/common/system/logutils.py
index eef463693..def3bec4e 100644
--- a/Tools/Scripts/webkitpy/common/system/logutils.py
+++ b/Tools/Scripts/webkitpy/common/system/logutils.py
@@ -125,7 +125,7 @@ def get_logger(path):
     return logging.getLogger(logger_name)
 
 
-def _default_handlers(stream):
+def _default_handlers(stream, logging_level):
     """Return a list of the default logging handlers to use.
 
     Args:
@@ -148,7 +148,11 @@ def _default_handlers(stream):
 
     # Create the handler.
     handler = logging.StreamHandler(stream)
-    formatter = logging.Formatter("%(name)s: [%(levelname)s] %(message)s")
+    if logging_level == logging.DEBUG:
+        formatter = logging.Formatter("%(name)s: [%(levelname)s] %(message)s")
+    else:
+        formatter = logging.Formatter("%(message)s")
+
     handler.setFormatter(formatter)
     handler.addFilter(logging_filter)
 
@@ -195,7 +199,7 @@ def configure_logging(logging_level=None, logger=None, stream=None,
     if stream is None:
         stream = sys.stderr
     if handlers is None:
-        handlers = _default_handlers(stream)
+        handlers = _default_handlers(stream, logging_level)
 
     logger.setLevel(logging_level)
 
diff --git a/Tools/Scripts/webkitpy/common/system/logutils_unittest.py b/Tools/Scripts/webkitpy/common/system/logutils_unittest.py
index f1b494d4d..72789eb37 100644
--- a/Tools/Scripts/webkitpy/common/system/logutils_unittest.py
+++ b/Tools/Scripts/webkitpy/common/system/logutils_unittest.py
@@ -107,7 +107,11 @@ class ConfigureLoggingTest(ConfigureLoggingTestBase):
 
     def test_info_message(self):
         self._log.info("test message")
-        self._assert_log_messages(["unittest: [INFO] test message\n"])
+        self._assert_log_messages(["test message\n"])
+
+    def test_debug_message(self):
+        self._log.debug("test message")
+        self._assert_log_messages([])
 
     def test_below_threshold_message(self):
         # We test the boundary case of a logging level equal to 19.
@@ -120,9 +124,21 @@ class ConfigureLoggingTest(ConfigureLoggingTestBase):
     def test_two_messages(self):
         self._log.info("message1")
         self._log.info("message2")
-        self._assert_log_messages(["unittest: [INFO] message1\n",
-                                   "unittest: [INFO] message2\n"])
+        self._assert_log_messages(["message1\n",
+                                   "message2\n"])
+
+
+class ConfigureLoggingVerboseTest(ConfigureLoggingTestBase):
+    def _logging_level(self):
+        return logging.DEBUG
+
+    def test_info_message(self):
+        self._log.info("test message")
+        self._assert_log_messages(["unittest: [INFO] test message\n"])
 
+    def test_debug_message(self):
+        self._log.debug("test message")
+        self._assert_log_messages(["unittest: [DEBUG] test message\n"])
 
 class ConfigureLoggingCustomLevelTest(ConfigureLoggingTestBase):
 
@@ -135,7 +151,7 @@ class ConfigureLoggingCustomLevelTest(ConfigureLoggingTestBase):
 
     def test_logged_message(self):
         self._log.log(self._level, "test message")
-        self._assert_log_messages(["unittest: [Level 36] test message\n"])
+        self._assert_log_messages(["test message\n"])
 
     def test_below_threshold_message(self):
         self._log.log(self._level - 1, "test message")
diff --git a/Tools/Scripts/webkitpy/common/system/platforminfo.py b/Tools/Scripts/webkitpy/common/system/platforminfo.py
index a9717cc84..b2451f5f9 100644
--- a/Tools/Scripts/webkitpy/common/system/platforminfo.py
+++ b/Tools/Scripts/webkitpy/common/system/platforminfo.py
@@ -27,6 +27,7 @@
 # OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 import re
+import sys
 
 
 class PlatformInfo(object):
@@ -86,6 +87,31 @@ class PlatformInfo(object):
             return long(self._executive.run_command(["sysctl", "-n", "hw.memsize"]))
         return None
 
+    def terminal_width(self):
+        """Returns sys.maxint if the width cannot be determined."""
+        try:
+            if self.is_win():
+                # From http://code.activestate.com/recipes/440694-determine-size-of-console-window-on-windows/
+                from ctypes import windll, create_string_buffer
+                handle = windll.kernel32.GetStdHandle(-12)  # -12 == stderr
+                console_screen_buffer_info = create_string_buffer(22)  # 22 == sizeof(console_screen_buffer_info)
+                if windll.kernel32.GetConsoleScreenBufferInfo(handle, console_screen_buffer_info):
+                    import struct
+                    _, _, _, _, _, left, _, right, _, _, _ = struct.unpack("hhhhHhhhhhh", console_screen_buffer_info.raw)
+                    # Note that we return 1 less than the width since writing into the rightmost column
+                    # automatically performs a line feed.
+                    return right - left
+                return sys.maxint
+            else:
+                import fcntl
+                import struct
+                import termios
+                packed = fcntl.ioctl(sys.stderr.fileno(), termios.TIOCGWINSZ, '\0' * 8)
+                _, columns, _, _ = struct.unpack('HHHH', packed)
+                return columns
+        except:
+            return sys.maxint
+
     def _determine_os_name(self, sys_platform):
         if sys_platform == 'darwin':
             return 'mac'
diff --git a/Tools/Scripts/webkitpy/common/system/platforminfo_mock.py b/Tools/Scripts/webkitpy/common/system/platforminfo_mock.py
index 34fa97fb4..bc72810cf 100644
--- a/Tools/Scripts/webkitpy/common/system/platforminfo_mock.py
+++ b/Tools/Scripts/webkitpy/common/system/platforminfo_mock.py
@@ -42,7 +42,7 @@ class MockPlatformInfo(object):
         return self.os_name == 'win'
 
     def is_cygwin(self):
-        return False
+        return self.os_name == 'cygwin'
 
     def is_freebsd(self):
         return self.os_name == 'freebsd'
@@ -52,3 +52,6 @@ class MockPlatformInfo(object):
 
     def total_bytes_memory(self):
         return 3 * 1024 * 1024 * 1024  # 3GB is a reasonable amount of ram to mock.
+
+    def terminal_width(self):
+        return 80
diff --git a/Tools/Scripts/webkitpy/common/system/platforminfo_unittest.py b/Tools/Scripts/webkitpy/common/system/platforminfo_unittest.py
index 445ef5f7d..a2b4255b7 100644
--- a/Tools/Scripts/webkitpy/common/system/platforminfo_unittest.py
+++ b/Tools/Scripts/webkitpy/common/system/platforminfo_unittest.py
@@ -79,6 +79,7 @@ class TestPlatformInfo(unittest.TestCase):
         self.assertNotEquals(info.os_version, '')
         self.assertNotEquals(info.display_name(), '')
         self.assertTrue(info.is_mac() or info.is_win() or info.is_linux() or info.is_freebsd())
+        self.assertNotEquals(info.terminal_width(), None)
 
         if info.is_mac():
             self.assertTrue(info.total_bytes_memory() > 0)
diff --git a/Tools/Scripts/webkitpy/common/system/systemhost.py b/Tools/Scripts/webkitpy/common/system/systemhost.py
index 3b4439ee4..dfec68bc1 100644
--- a/Tools/Scripts/webkitpy/common/system/systemhost.py
+++ b/Tools/Scripts/webkitpy/common/system/systemhost.py
@@ -30,7 +30,7 @@ import os
 import platform
 import sys
 
-from webkitpy.common.system import environment, executive, filesystem, platforminfo, user, workspace
+from webkitpy.common.system import environment, executive, file_lock, filesystem, platforminfo, user, workspace
 
 
 class SystemHost(object):
@@ -43,3 +43,6 @@ class SystemHost(object):
 
     def copy_current_environment(self):
         return environment.Environment(os.environ.copy())
+
+    def make_file_lock(self, path):
+        return file_lock.FileLock(path)
diff --git a/Tools/Scripts/webkitpy/common/system/systemhost_mock.py b/Tools/Scripts/webkitpy/common/system/systemhost_mock.py
index 4667b08b9..a529f3483 100644
--- a/Tools/Scripts/webkitpy/common/system/systemhost_mock.py
+++ b/Tools/Scripts/webkitpy/common/system/systemhost_mock.py
@@ -29,6 +29,7 @@
 from webkitpy.common.system.environment import Environment
 from webkitpy.common.system.executive_mock import MockExecutive
 from webkitpy.common.system.filesystem_mock import MockFileSystem
+from webkitpy.common.system.file_lock_mock import MockFileLock
 from webkitpy.common.system.platforminfo_mock import MockPlatformInfo
 from webkitpy.common.system.user_mock import MockUser
 from webkitpy.common.system.workspace_mock import MockWorkspace
@@ -50,3 +51,6 @@ class MockSystemHost(object):
 
     def copy_current_environment(self):
         return Environment({"MOCK_ENVIRON_COPY": '1'})
+
+    def make_file_lock(self, path):
+        return MockFileLock(path)
diff --git a/Tools/Scripts/webkitpy/layout_tests/controllers/layout_test_runner.py b/Tools/Scripts/webkitpy/layout_tests/controllers/layout_test_runner.py
index 420128619..17cbe3125 100644
--- a/Tools/Scripts/webkitpy/layout_tests/controllers/layout_test_runner.py
+++ b/Tools/Scripts/webkitpy/layout_tests/controllers/layout_test_runner.py
@@ -126,7 +126,7 @@ class LayoutTestRunner(object):
 
         all_shards = locked_shards + unlocked_shards
         self._remaining_locked_shards = locked_shards
-        if locked_shards and self._options.http:
+        if self._port.requires_http_server() or (locked_shards and self._options.http):
             self.start_servers_with_lock(2 * min(num_workers, len(locked_shards)))
 
         num_workers = min(num_workers, len(all_shards))
@@ -252,7 +252,7 @@ class LayoutTestRunner(object):
         index = find(list_name, self._remaining_locked_shards)
         if index >= 0:
             self._remaining_locked_shards.pop(index)
-            if not self._remaining_locked_shards:
+            if not self._remaining_locked_shards and not self._port.requires_http_server():
                 self.stop_servers_with_lock()
 
     def _handle_finished_test(self, worker_name, result, elapsed_time, log_messages=[]):
diff --git a/Tools/Scripts/webkitpy/layout_tests/controllers/manager.py b/Tools/Scripts/webkitpy/layout_tests/controllers/manager.py
index c0a70e615..636edd2be 100644
--- a/Tools/Scripts/webkitpy/layout_tests/controllers/manager.py
+++ b/Tools/Scripts/webkitpy/layout_tests/controllers/manager.py
@@ -459,7 +459,7 @@ class Manager(object):
 
     def _run_tests(self, tests, result_summary, num_workers):
         test_inputs = [self._test_input_for_file(test) for test in tests]
-        needs_http = any(self._is_http_test(test) for test in tests)
+        needs_http = self._port.requires_http_server() or any(self._is_http_test(test) for test in tests)
         needs_websockets = any(self._is_websocket_test(test) for test in tests)
         return self._runner.run_tests(test_inputs, self._expectations, result_summary, num_workers, needs_http, needs_websockets, self._retrying)
 
diff --git a/Tools/Scripts/webkitpy/layout_tests/models/test_expectations.py b/Tools/Scripts/webkitpy/layout_tests/models/test_expectations.py
index b48c5b933..234259657 100644
--- a/Tools/Scripts/webkitpy/layout_tests/models/test_expectations.py
+++ b/Tools/Scripts/webkitpy/layout_tests/models/test_expectations.py
@@ -689,7 +689,7 @@ class TestExpectationsModel(object):
         # to be warnings and return False".
 
         if prev_expectation_line.matching_configurations == expectation_line.matching_configurations:
-            expectation_line.warnings.append('Duplicate or ambiguous entry for %s on lines %s:%d and %s:%d.' % (expectation_line.name,
+            expectation_line.warnings.append('Duplicate or ambiguous entry lines %s:%d and %s:%d.' % (
                 self._shorten_filename(prev_expectation_line.filename), prev_expectation_line.line_number,
                 self._shorten_filename(expectation_line.filename), expectation_line.line_number))
             return True
@@ -758,16 +758,16 @@ class TestExpectations(object):
                     'missing': MISSING}
 
     # (aggregated by category, pass/fail/skip, type)
-    EXPECTATION_DESCRIPTIONS = {SKIP: ('skipped', 'skipped', ''),
-                                PASS: ('passes', 'passed', ''),
-                                FAIL: ('failures', 'failed', ''),
-                                IMAGE: ('image-only failures', 'failed', ' (image diff)'),
-                                TEXT: ('text-only failures', 'failed', ' (text diff)'),
-                                IMAGE_PLUS_TEXT: ('image and text failures', 'failed', ' (image and text diff)'),
-                                AUDIO: ('audio failures', 'failed', ' (audio diff)'),
-                                CRASH: ('crashes', 'crashed', ''),
-                                TIMEOUT: ('timeouts', 'timed out', ''),
-                                MISSING: ('no expected results found', 'no expected result found', '')}
+    EXPECTATION_DESCRIPTIONS = {SKIP: 'skipped',
+                                PASS: 'passes',
+                                FAIL: 'failures',
+                                IMAGE: 'image-only failures',
+                                TEXT: 'text-only failures',
+                                IMAGE_PLUS_TEXT: 'image and text failures',
+                                AUDIO: 'audio failures',
+                                CRASH: 'crashes',
+                                TIMEOUT: 'timeouts',
+                                MISSING: 'missing results'}
 
     EXPECTATION_ORDER = (PASS, CRASH, TIMEOUT, MISSING, FAIL, IMAGE, SKIP)
 
@@ -837,16 +837,19 @@ class TestExpectations(object):
             suffixes.add('wav')
         return set(suffixes)
 
-    def __init__(self, port, tests=None, is_lint_mode=False, include_overrides=True):
+    # FIXME: This constructor does too much work. We should move the actual parsing of
+    # the expectations into separate routines so that linting and handling overrides
+    # can be controlled separately, and the constructor can be more of a no-op.
+    def __init__(self, port, tests=None, include_overrides=True, expectations_to_lint=None):
         self._full_test_list = tests
         self._test_config = port.test_configuration()
-        self._is_lint_mode = is_lint_mode
+        self._is_lint_mode = expectations_to_lint is not None
         self._model = TestExpectationsModel(self._shorten_filename)
-        self._parser = TestExpectationParser(port, tests, is_lint_mode)
+        self._parser = TestExpectationParser(port, tests, self._is_lint_mode)
         self._port = port
         self._skipped_tests_warnings = []
 
-        expectations_dict = port.expectations_dict()
+        expectations_dict = expectations_to_lint or port.expectations_dict()
         self._expectations = self._parser.parse(expectations_dict.keys()[0], expectations_dict.values()[0])
         self._add_expectations(self._expectations)
 
@@ -929,6 +932,10 @@ class TestExpectations(object):
             self._has_warnings = True
             if self._is_lint_mode:
                 raise ParseError(warnings)
+            _log.warning('--lint-test-files warnings:')
+            for warning in warnings:
+                _log.warning(warning)
+            _log.warning('')
 
     def _process_tests_without_expectations(self):
         if self._full_test_list:
diff --git a/Tools/Scripts/webkitpy/layout_tests/models/test_expectations_unittest.py b/Tools/Scripts/webkitpy/layout_tests/models/test_expectations_unittest.py
index c3fc02658..d78ae3f2b 100644
--- a/Tools/Scripts/webkitpy/layout_tests/models/test_expectations_unittest.py
+++ b/Tools/Scripts/webkitpy/layout_tests/models/test_expectations_unittest.py
@@ -80,7 +80,8 @@ Bug(test) failures/expected/image.html [ WontFix Mac ]
         if overrides:
             expectations_dict['overrides'] = overrides
         self._port.expectations_dict = lambda: expectations_dict
-        self._exp = TestExpectations(self._port, self.get_basic_tests(), is_lint_mode)
+        expectations_to_lint = expectations_dict if is_lint_mode else None
+        self._exp = TestExpectations(self._port, self.get_basic_tests(), expectations_to_lint=expectations_to_lint)
 
     def assert_exp(self, test, result):
         self.assertEquals(self._exp.get_expectations(self.get_test(test)),
@@ -183,6 +184,15 @@ class MiscTests(Base):
                         "expectations:2 Path does not exist. non-existent-test.html")
             self.assertEqual(str(e), warnings)
 
+    def test_parse_warnings_are_logged_if_not_in_lint_mode(self):
+        oc = OutputCapture()
+        try:
+            oc.capture_output()
+            self.parse_exp('-- this should be a syntax error', is_lint_mode=False)
+        finally:
+            _, _, logs = oc.restore_output()
+            self.assertNotEquals(logs, '')
+
     def test_error_on_different_platform(self):
         # parse_exp uses a Windows port. Assert errors on Mac show up in lint mode.
         self.assertRaises(ParseError, self.parse_exp,
@@ -247,7 +257,8 @@ class SkippedTests(Base):
             expectations_dict['overrides'] = overrides
         port.expectations_dict = lambda: expectations_dict
         port.skipped_layout_tests = lambda tests: set(skips)
-        exp = TestExpectations(port, ['failures/expected/text.html'], lint)
+        expectations_to_lint = expectations_dict if lint else None
+        exp = TestExpectations(port, ['failures/expected/text.html'], expectations_to_lint=expectations_to_lint)
 
         # Check that the expectation is for BUG_DUMMY SKIP : ... [ Pass ]
         self.assertEquals(exp.get_modifiers('failures/expected/text.html'),
diff --git a/Tools/Scripts/webkitpy/layout_tests/models/test_failures.py b/Tools/Scripts/webkitpy/layout_tests/models/test_failures.py
index 13d4001b5..402b30aea 100644
--- a/Tools/Scripts/webkitpy/layout_tests/models/test_failures.py
+++ b/Tools/Scripts/webkitpy/layout_tests/models/test_failures.py
@@ -110,20 +110,18 @@ class TestFailure(object):
 
 
 class FailureTimeout(TestFailure):
-    """Test timed out.  We also want to restart DumpRenderTree if this happens."""
     def __init__(self, is_reftest=False):
         super(FailureTimeout, self).__init__()
         self.is_reftest = is_reftest
 
     def message(self):
-        return "Test timed out"
+        return "test timed out"
 
     def driver_needs_restart(self):
         return True
 
 
 class FailureCrash(TestFailure):
-    """DumpRenderTree/WebKitTestRunner crashed."""
     def __init__(self, is_reftest=False, process_name='DumpRenderTree', pid=None):
         super(FailureCrash, self).__init__()
         self.process_name = process_name
@@ -132,7 +130,7 @@ class FailureCrash(TestFailure):
 
     def message(self):
         if self.pid:
-            return "%s (pid %d) crashed" % (self.process_name, self.pid)
+            return "%s crashed [pid=%d]" % (self.process_name, self.pid)
         return self.process_name + " crashed"
 
     def driver_needs_restart(self):
@@ -140,101 +138,79 @@ class FailureCrash(TestFailure):
 
 
 class FailureMissingResult(TestFailure):
-    """Expected result was missing."""
-
     def message(self):
-        return "No expected results found"
+        return "-expected.txt was missing"
 
 
 class FailureTextMismatch(TestFailure):
-    """Text diff output failed."""
-
     def message(self):
-        return "Text diff mismatch"
-
+        return "text diff"
 
 class FailureMissingImageHash(TestFailure):
-    """Actual result hash was missing."""
-
     def message(self):
-        return "No expected image hash found"
+        return "-expected.png was missing an embedded checksum"
 
 
 class FailureMissingImage(TestFailure):
-    """Actual result image was missing."""
-
     def message(self):
-        return "No expected image found"
+        return "-expected.png was missing"
 
 
 class FailureImageHashMismatch(TestFailure):
-    """Image hashes didn't match."""
     def __init__(self, diff_percent=0):
         super(FailureImageHashMismatch, self).__init__()
         self.diff_percent = diff_percent
 
     def message(self):
-        return "Image mismatch"
+        return "image diff"
 
 
 class FailureImageHashIncorrect(TestFailure):
-    """Actual result hash is incorrect."""
-
     def message(self):
-        return "Images match, expected image hash incorrect. "
+        return "-expected.png embedded checksum is incorrect"
 
 
 class FailureReftestMismatch(TestFailure):
-    """The result didn't match the reference rendering."""
-
     def __init__(self, reference_filename=None):
         super(FailureReftestMismatch, self).__init__()
         self.reference_filename = reference_filename
         self.diff_percent = None
 
     def message(self):
-        return "Mismatch with reference"
+        return "reference mismatch"
 
 
 class FailureReftestMismatchDidNotOccur(TestFailure):
-    """Unexpected match between the result and the reference rendering."""
-
     def __init__(self, reference_filename=None):
         super(FailureReftestMismatchDidNotOccur, self).__init__()
         self.reference_filename = reference_filename
 
     def message(self):
-        return "Mismatch with the reference did not occur"
+        return "reference mismatch didn't happen"
 
 
 class FailureReftestNoImagesGenerated(TestFailure):
-    """Both the reftest and the -expected html file didn't generate pixel results."""
-
     def __init__(self, reference_filename=None):
         super(FailureReftestNoImagesGenerated, self).__init__()
         self.reference_filename = reference_filename
 
     def message(self):
-        return "Reftest didn't generate pixel results."
+        return "reference didn't generate pixel results."
 
 
 class FailureMissingAudio(TestFailure):
-    """Actual result image was missing."""
-
     def message(self):
-        return "No expected audio found"
+        return "expected audio result was missing"
 
 
 class FailureAudioMismatch(TestFailure):
-    """Audio files didn't match."""
-
     def message(self):
-        return "Audio mismatch"
+        return "audio mismatch"
 
 
 class FailureEarlyExit(TestFailure):
     def message(self):
-        return "Skipped due to early exit"
+        return "skipped due to early exit"
 
 
 # Convenient collection of all failure classes for anything that might
diff --git a/Tools/Scripts/webkitpy/layout_tests/models/test_failures_unittest.py b/Tools/Scripts/webkitpy/layout_tests/models/test_failures_unittest.py
index e096b171f..1c8f029a6 100644
--- a/Tools/Scripts/webkitpy/layout_tests/models/test_failures_unittest.py
+++ b/Tools/Scripts/webkitpy/layout_tests/models/test_failures_unittest.py
@@ -70,4 +70,4 @@ class TestFailuresTest(unittest.TestCase):
 
     def test_crashes(self):
         self.assertEquals(FailureCrash().message(), 'DumpRenderTree crashed')
-        self.assertEquals(FailureCrash(process_name='foo', pid=1234).message(), 'foo (pid 1234) crashed')
+        self.assertEquals(FailureCrash(process_name='foo', pid=1234).message(), 'foo crashed [pid=1234]')
diff --git a/Tools/Scripts/webkitpy/layout_tests/port/__init__.py b/Tools/Scripts/webkitpy/layout_tests/port/__init__.py
index 93bda9f56..6365b4ce8 100644
--- a/Tools/Scripts/webkitpy/layout_tests/port/__init__.py
+++ b/Tools/Scripts/webkitpy/layout_tests/port/__init__.py
@@ -33,4 +33,4 @@ import builders  # Why is this in port?
 
 from base import Port  # It's possible we don't need to export this virtual baseclass outside the module.
 from driver import Driver, DriverInput, DriverOutput
-from factory import port_options
+from factory import platform_options, configuration_options
diff --git a/Tools/Scripts/webkitpy/layout_tests/port/apple.py b/Tools/Scripts/webkitpy/layout_tests/port/apple.py
index 055419a14..4b97f419b 100644
--- a/Tools/Scripts/webkitpy/layout_tests/port/apple.py
+++ b/Tools/Scripts/webkitpy/layout_tests/port/apple.py
@@ -98,6 +98,3 @@ class ApplePort(Port):
                 for architecture in self.ARCHITECTURES:
                     configurations.append(TestConfiguration(version=self._strip_port_name_prefix(port_name), architecture=architecture, build_type=build_type))
         return configurations
-
-    def expectations_files(self):
-        return [self._filesystem.join(self._webkit_baseline_path(d), 'TestExpectations') for d in self._skipped_file_search_paths()]
diff --git a/Tools/Scripts/webkitpy/layout_tests/port/base.py b/Tools/Scripts/webkitpy/layout_tests/port/base.py
index ae55c684d..ea1e9d033 100755
--- a/Tools/Scripts/webkitpy/layout_tests/port/base.py
+++ b/Tools/Scripts/webkitpy/layout_tests/port/base.py
@@ -207,7 +207,6 @@ class Port(object):
         baseline_search_paths = self.baseline_search_path()
         return baseline_search_paths[0]
 
-
     def baseline_search_path(self):
         return self.get_option('additional_platform_directory', []) + self._compare_baseline() + self.default_baseline_search_path()
 
@@ -697,11 +696,8 @@ class Port(object):
         return self._filesystem.abspath(self.path_from_webkit_base('.'))
 
     def skipped_layout_tests(self, test_list):
-        """Returns the set of tests found in Skipped files. Does *not* include tests marked as SKIP in expectations files."""
-        tests_to_skip = set(self._expectations_from_skipped_files(self._skipped_file_search_paths()))
-        tests_to_skip.update(self._tests_for_other_platforms())
-        tests_to_skip.update(self._skipped_tests_for_unsupported_features(test_list))
-        return tests_to_skip
+        """Returns tests skipped outside of the TestExpectations files."""
+        return set(self._tests_for_other_platforms()).union(self._skipped_tests_for_unsupported_features(test_list))
 
     def _tests_from_skipped_file_contents(self, skipped_file_contents):
         tests_to_skip = []
@@ -903,6 +899,11 @@ class Port(object):
         method."""
         pass
 
+    def requires_http_server(self):
+        """Does the port require an HTTP server for running tests? This could
+        be the case when the tests aren't run on the host platform."""
+        return False
+
     def start_http_server(self, additional_dirs=None, number_of_servers=None):
         """Start a web server. Raise an error if it can't start or is already running.
 
@@ -927,6 +928,13 @@ class Port(object):
         server.start()
         self._websocket_server = server
 
+    def http_server_supports_ipv6(self):
+        # Cygwin is the only platform to still use Apache 1.3, which only supports IPV4.
+        # Once it moves to Apache 2, we can drop this method altogether.
+        if self.host.platform.is_cygwin():
+            return False
+        return True
+
     def acquire_http_lock(self):
         self._http_lock = http_lock.HttpLock(None, filesystem=self._filesystem, executive=self._executive)
         self._http_lock.wait_for_httpd_lock()
@@ -1030,8 +1038,20 @@ class Port(object):
         return expectations
 
     def expectations_files(self):
-        # FIXME: see comment in path_to_expectations_file().
-        return [self.path_to_test_expectations_file()]
+        # Unlike baseline_search_path, we only want to search [WK2-PORT, PORT-VERSION, PORT] and any directories
+        # included via --additional-platform-directory, not the full casade.
+        search_paths = [self.port_name]
+        if self.name() != self.port_name:
+            search_paths.append(self.name())
+
+        if self.get_option('webkit_test_runner'):
+            # Because nearly all of the skipped tests for WebKit 2 are due to cross-platform
+            # issues, all wk2 ports share a skipped list under platform/wk2.
+            search_paths.extend([self._wk2_port_name(), "wk2"])
+
+        search_paths.extend(self.get_option("additional_platform_directory", []))
+
+        return [self._filesystem.join(self._webkit_baseline_path(d), 'TestExpectations') for d in search_paths]
 
     def repository_paths(self):
         """Returns a list of (repository_name, repository_path) tuples of its depending code base.
@@ -1488,26 +1508,6 @@ class Port(object):
         # except for Qt because WebKit2 is only supported by Qt 5.0 (therefore: qt-5.0-wk2).
         return "%s-wk2" % self.port_name
 
-    def _skipped_file_search_paths(self):
-        # Unlike baseline_search_path, we only want to search [WK2-PORT, PORT-VERSION, PORT] and any directories
-        # included via --additional-platform-directory, not the full casade.
-        # Note order doesn't matter since the Skipped file contents are all combined; however
-        # we use this order explicitly so we can re-use it for TestExpectations files.
-        # FIXME: Update this when we get rid of Skipped files altogether.
-
-        search_paths = set([self.port_name])
-        if 'future' not in self.name():
-            search_paths.add(self.name())
-
-        if self.get_option('webkit_test_runner'):
-            # Because nearly all of the skipped tests for WebKit 2 are due to cross-platform
-            # issues, all wk2 ports share a skipped list under platform/wk2.
-            search_paths.update([self._wk2_port_name(), "wk2"])
-
-        search_paths.update(self.get_option("additional_platform_directory", []))
-
-        return search_paths
-
 
 class VirtualTestSuite(object):
     def __init__(self, name, base, args, tests=None):
diff --git a/Tools/Scripts/webkitpy/layout_tests/port/base_unittest.py b/Tools/Scripts/webkitpy/layout_tests/port/base_unittest.py
index e9b2f060d..1fe75ccd4 100644
--- a/Tools/Scripts/webkitpy/layout_tests/port/base_unittest.py
+++ b/Tools/Scripts/webkitpy/layout_tests/port/base_unittest.py
@@ -379,6 +379,14 @@ class PortTest(unittest.TestCase):
     def test_operating_system(self):
         self.assertEqual('mac', self.make_port().operating_system())
 
+    def test_http_server_supports_ipv6(self):
+        port = self.make_port()
+        self.assertTrue(port.http_server_supports_ipv6())
+        port.host.platform.os_name = 'cygwin'
+        self.assertFalse(port.http_server_supports_ipv6())
+        port.host.platform.os_name = 'win'
+        self.assertTrue(port.http_server_supports_ipv6())
+
     def test_check_httpd_success(self):
         port = self.make_port(executive=MockExecutive2())
         port._path_to_apache = lambda: '/usr/sbin/httpd'
@@ -451,6 +459,9 @@ class PortTest(unittest.TestCase):
         port = self.make_port(options=optparse.Values({'build_directory': '/my-build-directory/'}))
         self.assertEqual(port._build_path(), '/my-build-directory/Release')
 
+    def test_dont_require_http_server(self):
+        port = self.make_port()
+        self.assertEqual(port.requires_http_server(), False)
 
 if __name__ == '__main__':
     unittest.main()
diff --git a/Tools/Scripts/webkitpy/layout_tests/port/builders.py b/Tools/Scripts/webkitpy/layout_tests/port/builders.py
index c2ab8d212..155ac898b 100644
--- a/Tools/Scripts/webkitpy/layout_tests/port/builders.py
+++ b/Tools/Scripts/webkitpy/layout_tests/port/builders.py
@@ -58,7 +58,8 @@ _exact_matches = {
     "WebKit Mac10.6 (dbg)": {"port_name": "chromium-mac-snowleopard", "specifiers": set(["snowleopard", "debug"])},
     "WebKit Mac10.7": {"port_name": "chromium-mac-lion", "specifiers": set(["lion", "release"])},
     "WebKit Mac10.7 (dbg)": {"port_name": "chromium-mac-lion", "specifiers": set(["lion", "debug"])},
-    "WebKit Mac10.8": {"port_name": "chromium-mac-mountainlion", "specifiers": set(["mountainlion", "release"])},
+    "WebKit Mac10.8": {"port_name": "chromium-mac-mountainlion", "specifiers": set(["mountainlion", "release"]),
+                       "move_overwritten_baselines_to": ["chromium-mac-lion"]},
 
     # These builders are on build.webkit.org.
     "Apple MountainLion Release WK1 (Tests)": {"port_name": "mac-mountainlion", "specifiers": set(["mountainlion"]), "rebaseline_override_dir": "mac"},
diff --git a/Tools/Scripts/webkitpy/layout_tests/port/chromium_android.py b/Tools/Scripts/webkitpy/layout_tests/port/chromium_android.py
index 6389feb63..b8ac55ac1 100644
--- a/Tools/Scripts/webkitpy/layout_tests/port/chromium_android.py
+++ b/Tools/Scripts/webkitpy/layout_tests/port/chromium_android.py
@@ -180,7 +180,9 @@ class ChromiumAndroidPort(chromium.ChromiumPort):
 
     def additional_drt_flag(self):
         # The Chromium port for Android always uses the hardware GPU path.
-        return ['--encode-binary', '--enable-hardware-gpu']
+        return ['--encode-binary', '--enable-hardware-gpu',
+                '--force-compositing-mode',
+                '--enable-accelerated-fixed-position']
 
     def default_timeout_ms(self):
         # Android platform has less computing power than desktop platforms.
@@ -232,20 +234,16 @@ class ChromiumAndroidPort(chromium.ChromiumPort):
         android_expectations_file = self.path_from_webkit_base('LayoutTests', 'platform', 'chromium-android', 'TestExpectations')
         return super(ChromiumAndroidPort, self).expectations_files() + [android_expectations_file]
 
-    def start_http_server(self, additional_dirs=None, number_of_servers=0):
-        # The http server runs during the whole testing period, so ignore this call.
-        pass
-
-    def stop_http_server(self):
-        # Same as start_http_server().
-        pass
-
-    def setup_test_run(self):
-        # Start the HTTP server so that the device can access the test cases.
-        super(ChromiumAndroidPort, self).start_http_server(additional_dirs={TEST_PATH_PREFIX: self.layout_tests_dir()})
+    def requires_http_server(self):
+        """Chromium Android runs tests on devices, and uses the HTTP server to
+        serve the actual layout tests to DumpRenderTree."""
+        return True
 
-    def clean_up_test_run(self):
-        super(ChromiumAndroidPort, self).stop_http_server()
+    def start_http_server(self, additional_dirs=None, number_of_servers=0):
+        if not additional_dirs:
+            additional_dirs = {}
+        additional_dirs[TEST_PATH_PREFIX] = self.layout_tests_dir()
+        super(ChromiumAndroidPort, self).start_http_server(additional_dirs, number_of_servers)
 
     def create_driver(self, worker_number, no_timeout=False):
         # We don't want the default DriverProxy which is not compatible with our driver.
diff --git a/Tools/Scripts/webkitpy/layout_tests/port/chromium_android_unittest.py b/Tools/Scripts/webkitpy/layout_tests/port/chromium_android_unittest.py
index bb4229e65..fce69c67d 100644
--- a/Tools/Scripts/webkitpy/layout_tests/port/chromium_android_unittest.py
+++ b/Tools/Scripts/webkitpy/layout_tests/port/chromium_android_unittest.py
@@ -165,6 +165,10 @@ class ChromiumAndroidPortTest(chromium_port_testcase.ChromiumPortTestCase):
         self.assertEquals(self.mock_run_command._mock_devices[1], port._get_device_serial(1))
         self.assertRaises(AssertionError, port._get_device_serial, 2)
 
+    def test_must_require_http_server(self):
+        port = self.make_port()
+        self.assertEquals(port.requires_http_server(), True)
+
 
 class ChromiumAndroidDriverTest(unittest.TestCase):
     def setUp(self):
diff --git a/Tools/Scripts/webkitpy/layout_tests/port/efl.py b/Tools/Scripts/webkitpy/layout_tests/port/efl.py
index 1022cd7b7..0c9acd8d8 100644
--- a/Tools/Scripts/webkitpy/layout_tests/port/efl.py
+++ b/Tools/Scripts/webkitpy/layout_tests/port/efl.py
@@ -62,8 +62,6 @@ class EflPort(Port, PulseAudioSanitizer):
         if self.webprocess_cmd_prefix:
             env['WEB_PROCESS_CMD_PREFIX'] = self.webprocess_cmd_prefix
 
-        env['XDG_CACHE_HOME'] = str(self._filesystem.mkdtemp(prefix='%s-Efl-CacheDir-' % self.driver_name()))
-        env['XDG_DATA_HOME'] = str(self._filesystem.mkdtemp(prefix='%s-Efl-DataDir-' % self.driver_name()))
         return env
 
     def default_timeout_ms(self):
@@ -107,6 +105,9 @@ class EflPort(Port, PulseAudioSanitizer):
         search_paths.append(self.port_name)
         return search_paths
 
+    def default_baseline_search_path(self):
+        return map(self._webkit_baseline_path, self._search_paths())
+
     def expectations_files(self):
         # FIXME: We should be able to use the default algorithm here.
         return list(reversed([self._filesystem.join(self._webkit_baseline_path(p), 'TestExpectations') for p in self._search_paths()]))
diff --git a/Tools/Scripts/webkitpy/layout_tests/port/factory.py b/Tools/Scripts/webkitpy/layout_tests/port/factory.py
index 7e4750219..ad7c64454 100644
--- a/Tools/Scripts/webkitpy/layout_tests/port/factory.py
+++ b/Tools/Scripts/webkitpy/layout_tests/port/factory.py
@@ -29,35 +29,47 @@
 
 """Factory method to retrieve the appropriate port implementation."""
 
+import fnmatch
 import optparse
 import re
 
 from webkitpy.layout_tests.port import builders
 
 
-def port_options(**help_strings):
+def platform_options(use_globs=False):
     return [
-        optparse.make_option("-t", "--target", dest="configuration",
-            help="(DEPRECATED)"),
+        optparse.make_option('--platform', action='store',
+            help=('Glob-style list of platform/ports to use (e.g., "mac*")' if use_globs else 'Platform to use (e.g., "mac-lion")')),
+        optparse.make_option('--chromium', action='store_const', dest='platform',
+            const=('chromium*' if use_globs else 'chromium'),
+            help=('Alias for --platform=chromium*' if use_globs else 'Alias for --platform=chromium')),
+        optparse.make_option('--chromium-android', action='store_const', dest='platform',
+            const=('chromium-android*' if use_globs else 'chromium-android'),
+            help=('Alias for --platform=chromium-android*' if use_globs else 'Alias for --platform=chromium')),
+        optparse.make_option('--efl', action='store_const', dest='platform',
+            const=('efl*' if use_globs else 'efl'),
+            help=('Alias for --platform=efl*' if use_globs else 'Alias for --platform=efl')),
+        optparse.make_option('--gtk', action='store_const', dest='platform',
+            const=('gtk*' if use_globs else 'gtk'),
+            help=('Alias for --platform=gtk*' if use_globs else 'Alias for --platform=gtk')),
+        optparse.make_option('--qt', action='store_const', dest="platform",
+            const=('qt*' if use_globs else 'qt'),
+            help=('Alias for --platform=qt' if use_globs else 'Alias for --platform=qt')),
+        ]
+
+
+def configuration_options():
+    return [
+        optparse.make_option("-t", "--target", dest="configuration", help="(DEPRECATED)"),
         # FIXME: --help should display which configuration is default.
         optparse.make_option('--debug', action='store_const', const='Debug', dest="configuration",
             help='Set the configuration to Debug'),
         optparse.make_option('--release', action='store_const', const='Release', dest="configuration",
             help='Set the configuration to Release'),
-        optparse.make_option('--platform', action='store',
-            help=help_strings.get('platform', 'Platform/Port being tested (e.g., "mac-lion")')),
-        optparse.make_option('--chromium', action='store_const', const='chromium', dest='platform',
-            help='Alias for --platform=chromium'),
-        optparse.make_option('--chromium-android', action='store_const', const='chromium-android', dest='platform',
-            help='Alias for --platform=chromium-android'),
-        optparse.make_option('--efl', action='store_const', const='efl', dest="platform",
-            help='Alias for --platform=efl'),
-        optparse.make_option('--gtk', action='store_const', const='gtk', dest="platform",
-            help='Alias for --platform=gtk'),
-        optparse.make_option('--qt', action='store_const', const='qt', dest="platform",
-            help='Alias for --platform=qt'),
         optparse.make_option('--32-bit', action='store_const', const='x86', default=None, dest="architecture",
-            help='use 32-bit binaries by default (x86 instead of x86_64)')]
+            help='use 32-bit binaries by default (x86 instead of x86_64)'),
+        ]
+
 
 
 def _builder_options(builder_name):
@@ -116,18 +128,18 @@ class PortFactory(object):
                 return cls(self._host, port_name, options=options, **kwargs)
         raise NotImplementedError('unsupported platform: "%s"' % port_name)
 
-    def all_port_names(self):
+    def all_port_names(self, platform=None):
         """Return a list of all valid, fully-specified, "real" port names.
 
         This is the list of directories that are used as actual baseline_paths()
         by real ports. This does not include any "fake" names like "test"
-        or "mock-mac", and it does not include any directories that are not ."""
-        # FIXME: There's probably a better way to generate this list ...
-        return builders.all_port_names()
+        or "mock-mac", and it does not include any directories that are not.
+
+        If platform is not specified, we will glob-match all ports"""
+        platform = platform or '*'
+        return fnmatch.filter(builders.all_port_names(), platform)
 
     def get_from_builder_name(self, builder_name):
         port_name = builders.port_name_for_builder_name(builder_name)
-        assert(port_name)  # Need to update port_name_for_builder_name
-        port = self.get(port_name, _builder_options(builder_name))
-        assert(port)  # Need to update port_name_for_builder_name
-        return port
+        assert port_name, "unrecognized builder name '%s'" % builder_name
+        return self.get(port_name, _builder_options(builder_name))
diff --git a/Tools/Scripts/webkitpy/layout_tests/port/gtk.py b/Tools/Scripts/webkitpy/layout_tests/port/gtk.py
index 6c57b5363..3d820274e 100644
--- a/Tools/Scripts/webkitpy/layout_tests/port/gtk.py
+++ b/Tools/Scripts/webkitpy/layout_tests/port/gtk.py
@@ -38,9 +38,6 @@ from webkitpy.layout_tests.port.xvfbdriver import XvfbDriver
 class GtkPort(Port, PulseAudioSanitizer):
     port_name = "gtk"
 
-    def expectations_files(self):
-        return [self._filesystem.join(self._webkit_baseline_path(d), 'TestExpectations') for d in self._skipped_file_search_paths()]
-
     def warn_if_bug_missing_in_test_expectations(self):
         return True
 
diff --git a/Tools/Scripts/webkitpy/layout_tests/port/mac_unittest.py b/Tools/Scripts/webkitpy/layout_tests/port/mac_unittest.py
index d0289ade5..c2b26b2f7 100644
--- a/Tools/Scripts/webkitpy/layout_tests/port/mac_unittest.py
+++ b/Tools/Scripts/webkitpy/layout_tests/port/mac_unittest.py
@@ -49,23 +49,6 @@ class MacTest(port_testcase.PortTestCase):
         super(MacTest, self).test_default_timeout_ms()
         self.assertEquals(self.make_port(options=MockOptions(guard_malloc=True)).default_timeout_ms(), 350000)
 
-    def test_expectations_files(self):
-        self.assertEquals(len(self.make_port().expectations_files()), 2)
-        self.assertEquals(len(self.make_port(options=MockOptions(webkit_test_runner=True)).expectations_files()), 4)
-
-    def test_skipped_file_search_paths(self):
-        # We should have two skipped files - platform+version and platform; however, we don't
-        # have platform+version for either the most recent version or mac-future.
-        self.assert_skipped_file_search_paths('mac-snowleopard', set(['mac-snowleopard', 'mac']))
-        self.assert_skipped_file_search_paths('mac-lion', set(['mac-lion', 'mac']))
-        self.assert_skipped_file_search_paths('mac-mountainlion', set(['mac']))
-        self.assert_skipped_file_search_paths('mac-future', set(['mac']))
-
-        self.assert_skipped_file_search_paths('mac-snowleopard', set(['mac-snowleopard', 'mac', 'mac-wk2', 'wk2']), use_webkit2=True)
-        self.assert_skipped_file_search_paths('mac-lion', set(['mac', 'mac-lion', 'mac-wk2', 'wk2']), use_webkit2=True)
-        self.assert_skipped_file_search_paths('mac-future', set(['mac', 'mac-wk2', 'wk2']), use_webkit2=True)
-
-
 
     example_skipped_file = u"""
 # <rdar://problem/5647952> fast/events/mouseout-on-window.html needs mac DRT to issue mouse out events
diff --git a/Tools/Scripts/webkitpy/layout_tests/port/port_testcase.py b/Tools/Scripts/webkitpy/layout_tests/port/port_testcase.py
index f704a7a13..b036f4b0d 100755
--- a/Tools/Scripts/webkitpy/layout_tests/port/port_testcase.py
+++ b/Tools/Scripts/webkitpy/layout_tests/port/port_testcase.py
@@ -502,15 +502,22 @@ class PortTestCase(unittest.TestCase):
     def test_skipped_layout_tests(self):
         self.assertEqual(TestWebKitPort(None, None).skipped_layout_tests(test_list=[]), set(['media']))
 
-    def test_skipped_file_search_paths(self):
+    def test_expectations_files(self):
         port = TestWebKitPort()
-        self.assertEqual(port._skipped_file_search_paths(), set(['testwebkitport']))
+
+        def platform_dirs(port):
+            return [port.host.filesystem.basename(port.host.filesystem.dirname(f)) for f in port.expectations_files()]
+
+        self.assertEqual(platform_dirs(port), ['testwebkitport'])
+
         port._name = "testwebkitport-version"
-        self.assertEqual(port._skipped_file_search_paths(), set(['testwebkitport', 'testwebkitport-version']))
+        self.assertEqual(platform_dirs(port), ['testwebkitport', 'testwebkitport-version'])
+
         port._options = MockOptions(webkit_test_runner=True)
-        self.assertEqual(port._skipped_file_search_paths(), set(['testwebkitport', 'testwebkitport-version', 'testwebkitport-wk2', 'wk2']))
+        self.assertEqual(platform_dirs(port), ['testwebkitport', 'testwebkitport-version', 'testwebkitport-wk2', 'wk2'])
+
         port._options = MockOptions(additional_platform_directory=["internal-testwebkitport"])
-        self.assertEqual(port._skipped_file_search_paths(), set(['testwebkitport', 'testwebkitport-version', 'internal-testwebkitport']))
+        self.assertEqual(platform_dirs(port), ['testwebkitport', 'testwebkitport-version', 'internal-testwebkitport'])
 
     def test_root_option(self):
         port = TestWebKitPort()
diff --git a/Tools/Scripts/webkitpy/layout_tests/port/qt.py b/Tools/Scripts/webkitpy/layout_tests/port/qt.py
index 76aadef2a..55f13ee8c 100644
--- a/Tools/Scripts/webkitpy/layout_tests/port/qt.py
+++ b/Tools/Scripts/webkitpy/layout_tests/port/qt.py
@@ -62,7 +62,7 @@ class QtPort(Port):
     def __init__(self, host, port_name, **kwargs):
         super(QtPort, self).__init__(host, port_name, **kwargs)
 
-        # FIXME: This will allow Port.baseline_search_path and Port._skipped_file_search_paths
+        # FIXME: This will allow Port.baseline_search_path
         # to do the right thing, but doesn't include support for qt-4.8 or qt-arm (seen in LayoutTests/platform) yet.
         self._operating_system = port_name.replace('qt-', '')
 
@@ -115,8 +115,6 @@ class QtPort(Port):
         return version
 
     def _search_paths(self):
-        # Qt port uses same paths for baseline_search_path and _skipped_file_search_paths
-        #
         # qt-5.0-wk1    qt-5.0-wk2
         #            \/
         #         qt-5.0    qt-4.8
diff --git a/Tools/Scripts/webkitpy/layout_tests/port/server_process.py b/Tools/Scripts/webkitpy/layout_tests/port/server_process.py
index bfdf8301b..8f0cda9ba 100644
--- a/Tools/Scripts/webkitpy/layout_tests/port/server_process.py
+++ b/Tools/Scripts/webkitpy/layout_tests/port/server_process.py
@@ -226,6 +226,11 @@ class ServerProcess(object):
         return output
 
     def _wait_for_data_and_update_buffers_using_select(self, deadline, stopping=False):
+        if self._proc.stdout.closed or self._proc.stderr.closed:
+            # If the process crashed and is using FIFOs, like Chromium Android, the
+            # stdout and stderr pipes will be closed.
+            return
+
         out_fd = self._proc.stdout.fileno()
         err_fd = self._proc.stderr.fileno()
         select_fds = (out_fd, err_fd)
@@ -331,22 +336,21 @@ class ServerProcess(object):
             self._port.check_for_leaks(self.name(), self.pid())
 
         now = time.time()
-        self._proc.stdin.close()
-        self._proc.stdin = None
+        if self._proc.stdin:
+            self._proc.stdin.close()
+            self._proc.stdin = None
         killed = False
-        if not timeout_secs:
-            self._kill()
-            killed = True
-        elif not self._host.platform.is_win():
-            # FIXME: Why aren't we calling this on win?
+        if timeout_secs:
             deadline = now + timeout_secs
             while self._proc.poll() is None and time.time() < deadline:
                 time.sleep(0.01)
             if self._proc.poll() is None:
-                _log.warning('stopping %s timed out, killing it' % self._name)
-                self._kill()
-                killed = True
-                _log.warning('killed')
+                _log.warning('stopping %s(pid %d) timed out, killing it' % (self._name, self._proc.pid))
+
+        if self._proc.poll() is None:
+            self._kill()
+            killed = True
+            _log.debug('killed pid %d' % self._proc.pid)
 
         # read any remaining data on the pipes and return it.
         if not killed:
diff --git a/Tools/Scripts/webkitpy/layout_tests/port/test.py b/Tools/Scripts/webkitpy/layout_tests/port/test.py
index 726575614..f7dd2919e 100644
--- a/Tools/Scripts/webkitpy/layout_tests/port/test.py
+++ b/Tools/Scripts/webkitpy/layout_tests/port/test.py
@@ -64,7 +64,6 @@ class TestInstance(object):
         self.actual_image = self.base + '\x8a' + '-png' + 'tEXtchecksum\x00' + self.actual_checksum
 
         self.expected_text = self.actual_text
-        self.expected_checksum = self.actual_checksum
         self.expected_image = self.actual_image
 
         self.actual_audio = None
@@ -117,16 +116,15 @@ def unit_test_list():
               actual_audio=base64.b64encode('audio_fail-wav'), expected_audio='audio-wav',
               actual_text=None, expected_text=None,
               actual_image=None, expected_image=None,
-              actual_checksum=None, expected_checksum=None)
+              actual_checksum=None)
     tests.add('failures/expected/keyboard.html', keyboard=True)
     tests.add('failures/expected/missing_check.html',
-              expected_checksum=None,
-              expected_image=None)
+              expected_image='missing_check-png')
     tests.add('failures/expected/missing_image.html', expected_image=None)
     tests.add('failures/expected/missing_audio.html', expected_audio=None,
               actual_text=None, expected_text=None,
               actual_image=None, expected_image=None,
-              actual_checksum=None, expected_checksum=None)
+              actual_checksum=None)
     tests.add('failures/expected/missing_text.html', expected_text=None)
     tests.add('failures/expected/newlines_leading.html',
               expected_text="\nfoo\n", actual_text="foo\n")
@@ -138,6 +136,7 @@ def unit_test_list():
     tests.add('failures/expected/skip_text.html', actual_text='text diff')
     tests.add('failures/flaky/text.html')
     tests.add('failures/unexpected/missing_text.html', expected_text=None)
+    tests.add('failures/unexpected/missing_check.html', expected_image='missing-check-png')
     tests.add('failures/unexpected/missing_image.html', expected_image=None)
     tests.add('failures/unexpected/missing_render_tree_dump.html', actual_text="""layer at (0,0) size 800x600
   RenderView at (0,0) size 800x600
@@ -152,12 +151,18 @@ layer at (0,0) size 800x34
               error="mock-std-error-output")
     tests.add('failures/unexpected/web-process-crash-with-stderr.html', web_process_crash=True,
               error="mock-std-error-output")
+    tests.add('failures/unexpected/pass.html')
+    tests.add('failures/unexpected/text-checksum.html',
+              actual_text='text-checksum_fail-txt',
+              actual_checksum='text-checksum_fail-checksum')
     tests.add('failures/unexpected/text-image-checksum.html',
               actual_text='text-image-checksum_fail-txt',
+              actual_image='text-image-checksum_fail-pngtEXtchecksum\x00checksum_fail',
               actual_checksum='text-image-checksum_fail-checksum')
     tests.add('failures/unexpected/checksum-with-matching-image.html',
               actual_checksum='text-image-checksum_fail-checksum')
     tests.add('failures/unexpected/skip_pass.html')
+    tests.add('failures/unexpected/text.html', actual_text='text_fail-txt')
     tests.add('failures/unexpected/timeout.html', timeout=True)
     tests.add('http/tests/passes/text.html')
     tests.add('http/tests/passes/image.html')
@@ -169,10 +174,9 @@ layer at (0,0) size 800x34
               actual_audio=base64.b64encode('audio-wav'), expected_audio='audio-wav',
               actual_text=None, expected_text=None,
               actual_image=None, expected_image=None,
-              actual_checksum=None, expected_checksum=None)
+              actual_checksum=None)
     tests.add('passes/platform_image.html')
     tests.add('passes/checksum_in_image.html',
-              expected_checksum=None,
               expected_image='tEXtchecksum\x00checksum_in_image-checksum')
     tests.add('passes/skipped/skip.html')
 
@@ -281,6 +285,7 @@ Bug(test) failures/expected/timeout.html [ Timeout ]
 Bug(test) failures/expected/hang.html [ WontFix ]
 Bug(test) failures/expected/keyboard.html [ WontFix ]
 Bug(test) failures/expected/exception.html [ WontFix ]
+Bug(test) failures/unexpected/pass.html [ Failure ]
 Bug(test) passes/skipped/skip.html [ Skip ]
 """)
 
diff --git a/Tools/Scripts/webkitpy/layout_tests/port/xvfbdriver.py b/Tools/Scripts/webkitpy/layout_tests/port/xvfbdriver.py
index b927720db..b98c0392e 100644
--- a/Tools/Scripts/webkitpy/layout_tests/port/xvfbdriver.py
+++ b/Tools/Scripts/webkitpy/layout_tests/port/xvfbdriver.py
@@ -77,12 +77,16 @@ class XvfbDriver(Driver):
         environment = self._port.setup_environ_for_server(server_name)
         # We must do this here because the DISPLAY number depends on _worker_number
         environment['DISPLAY'] = ":%d" % display_id
-        # Drivers should use separate application cache locations
-        environment['XDG_CACHE_HOME'] = self._port.host.filesystem.join(self._port.results_directory(), '%s-appcache-%d' % (server_name, self._worker_number))
         self._driver_tempdir = self._port._filesystem.mkdtemp(prefix='%s-' % self._port.driver_name())
         environment['DUMPRENDERTREE_TEMP'] = str(self._driver_tempdir)
         environment['LOCAL_RESOURCE_ROOT'] = self._port.layout_tests_dir()
 
+        # Currently on WebKit2, there is no API for setting the application
+        # cache directory. Each worker should have it's own and it should be
+        # cleaned afterwards, so we set it to inside the temporary folder by
+        # prepending XDG_CACHE_HOME with DUMPRENDERTREE_TEMP.
+        environment['XDG_CACHE_HOME'] = self._port.host.filesystem.join(str(self._driver_tempdir), 'appcache')
+
         self._crashed_process_name = None
         self._crashed_pid = None
         self._server_process = self._port._server_process_constructor(self._port, server_name, self.cmd_line(pixel_tests, per_test_args), environment)
diff --git a/Tools/Scripts/webkitpy/layout_tests/run_webkit_tests.py b/Tools/Scripts/webkitpy/layout_tests/run_webkit_tests.py
index 89522079c..1c8e7321a 100755
--- a/Tools/Scripts/webkitpy/layout_tests/run_webkit_tests.py
+++ b/Tools/Scripts/webkitpy/layout_tests/run_webkit_tests.py
@@ -41,7 +41,7 @@ from webkitpy.common.host import Host
 from webkitpy.common.system import stack_utils
 from webkitpy.layout_tests.controllers.manager import Manager, WorkerException, TestRunInterruptedException
 from webkitpy.layout_tests.models import test_expectations
-from webkitpy.layout_tests.port import port_options
+from webkitpy.layout_tests.port import configuration_options, platform_options
 from webkitpy.layout_tests.views import printing
 
 
@@ -67,19 +67,20 @@ def lint(port, options):
     lint_failed = False
 
     for port_to_lint in ports_to_lint:
-        expectations_file = port_to_lint.path_to_test_expectations_file()
-        if expectations_file in files_linted:
-            continue
-
-        try:
-            test_expectations.TestExpectations(port_to_lint, is_lint_mode=True)
-        except test_expectations.ParseError, e:
-            lint_failed = True
-            _log.error('')
-            for warning in e.warnings:
-                _log.error(warning)
-            _log.error('')
-        files_linted.add(expectations_file)
+        expectations_dict = port_to_lint.expectations_dict()
+        for expectations_file in expectations_dict.keys():
+            if expectations_file in files_linted:
+                continue
+
+            try:
+                test_expectations.TestExpectations(port_to_lint, expectations_to_lint={expectations_file: expectations_dict[expectations_file]})
+            except test_expectations.ParseError, e:
+                lint_failed = True
+                _log.error('')
+                for warning in e.warnings:
+                    _log.error(warning)
+                _log.error('')
+            files_linted.add(expectations_file)
 
     if lint_failed:
         _log.error('Lint failed.')
@@ -200,7 +201,8 @@ def parse_args(args=None):
 
     option_group_definitions = []
 
-    option_group_definitions.append(("Configuration options", port_options()))
+    option_group_definitions.append(("Platform options", platform_options()))
+    option_group_definitions.append(("Configuration options", configuration_options()))
     option_group_definitions.append(("Printing Options", printing.print_options()))
 
     # FIXME: These options should move onto the ChromiumPort.
diff --git a/Tools/Scripts/webkitpy/layout_tests/run_webkit_tests_integrationtest.py b/Tools/Scripts/webkitpy/layout_tests/run_webkit_tests_integrationtest.py
index 85437449b..0cf42d0ee 100755
--- a/Tools/Scripts/webkitpy/layout_tests/run_webkit_tests_integrationtest.py
+++ b/Tools/Scripts/webkitpy/layout_tests/run_webkit_tests_integrationtest.py
@@ -176,7 +176,8 @@ def get_tests_run(extra_args=None, tests_included=False, flatten_batches=False,
 
 # Update this magic number if you add an unexpected test to webkitpy.layout_tests.port.test
 # FIXME: It's nice to have a routine in port/test.py that returns this number.
-unexpected_tests_count = 14
+unexpected_failures = 12
+unexpected_tests_count = unexpected_failures + 4
 
 
 class StreamTestingMixin(object):
@@ -199,9 +200,6 @@ class LintTest(unittest.TestCase, StreamTestingMixin):
                 self.name = name
                 self.path = path
 
-            def path_to_test_expectations_file(self):
-                return self.path
-
             def test_configuration(self):
                 return None
 
@@ -244,7 +242,7 @@ class LintTest(unittest.TestCase, StreamTestingMixin):
                                                FakePort(host, 'b-win', 'path-to-b')))
 
         self.assertEquals(run_webkit_tests.lint(host.port_factory.ports['a'], MockOptions(platform=None)), 0)
-        self.assertEquals(host.ports_parsed, ['a', 'b'])
+        self.assertEquals(host.ports_parsed, ['a', 'b', 'b-win'])
 
         host.ports_parsed = []
         self.assertEquals(run_webkit_tests.lint(host.port_factory.ports['a'], MockOptions(platform='a')), 0)
@@ -267,6 +265,15 @@ class LintTest(unittest.TestCase, StreamTestingMixin):
         self.assertEmpty(out)
         self.assertTrue(any(['Lint failed' in msg for msg in err.buflist]))
 
+        # ensure we lint *all* of the files in the cascade.
+        port_obj.expectations_dict = lambda: {'foo': '-- syntax error1', 'bar': '-- syntax error2'}
+        res, out, err = run_and_capture(port_obj, options, parsed_args)
+
+        self.assertEqual(res, -1)
+        self.assertEmpty(out)
+        self.assertTrue(any(['foo:1' in msg for msg in err.buflist]))
+        self.assertTrue(any(['bar:1' in msg for msg in err.buflist]))
+
 
 class MainTest(unittest.TestCase, StreamTestingMixin):
     def setUp(self):
@@ -496,7 +503,7 @@ class MainTest(unittest.TestCase, StreamTestingMixin):
 
     def test_run_singly_actually_runs_tests(self):
         res, _, _, _ = logging_run(['--run-singly', 'failures/unexpected'])
-        self.assertEquals(res, 10)
+        self.assertEquals(res, unexpected_failures)
 
     def test_single_file(self):
         # FIXME: We should consider replacing more of the get_tests_run()-style tests
@@ -561,7 +568,7 @@ class MainTest(unittest.TestCase, StreamTestingMixin):
         file_list = host.filesystem.written_files.keys()
         file_list.remove('/tmp/layout-test-results/tests_run0.txt')
         self.assertEquals(res, 1)
-        expected_token = '"unexpected":{"text-image-checksum.html":{"expected":"PASS","actual":"TEXT"},"missing_text.html":{"expected":"PASS","is_missing_text":true,"actual":"MISSING"}'
+        expected_token = '"unexpected":{"text-image-checksum.html":{"expected":"PASS","actual":"IMAGE+TEXT","image_diff_percent":1},"missing_text.html":{"expected":"PASS","is_missing_text":true,"actual":"MISSING"}'
         json_string = host.filesystem.read_text_file('/tmp/layout-test-results/full_results.json')
         self.assertTrue(json_string.find(expected_token) != -1)
         self.assertTrue(json_string.find('"num_regressions":1') != -1)
diff --git a/Tools/Scripts/webkitpy/layout_tests/servers/apache_http_server.py b/Tools/Scripts/webkitpy/layout_tests/servers/apache_http_server.py
index a616fab5b..7dede92a6 100644
--- a/Tools/Scripts/webkitpy/layout_tests/servers/apache_http_server.py
+++ b/Tools/Scripts/webkitpy/layout_tests/servers/apache_http_server.py
@@ -33,6 +33,7 @@
 import logging
 import os
 import re
+import socket
 import sys
 
 from webkitpy.layout_tests.servers import http_server_base
@@ -42,7 +43,6 @@ _log = logging.getLogger(__name__)
 
 
 class LayoutTestApacheHttpd(http_server_base.HttpServerBase):
-
     def __init__(self, port_obj, output_dir, additional_dirs=None, number_of_servers=None):
         """Args:
           port_obj: handle to the platform-specific routines
@@ -77,7 +77,6 @@ class LayoutTestApacheHttpd(http_server_base.HttpServerBase):
             '-C', "\'DocumentRoot \"%s\"\'" % document_root,
             '-c', "\'Alias /js-test-resources \"%s\"'" % js_test_resources_dir,
             '-c', "\'Alias /media-resources \"%s\"'" % media_resources_dir,
-            '-C', "\'Listen %s\'" % "127.0.0.1:8000",
             '-c', "\'TypesConfig \"%s\"\'" % mime_types_path,
             '-c', "\'CustomLog \"%s\" common\'" % access_log,
             '-c', "\'ErrorLog \"%s\"\'" % error_log,
@@ -85,6 +84,30 @@ class LayoutTestApacheHttpd(http_server_base.HttpServerBase):
             '-c', "\'PidFile %s'" % self._pid_file,
             '-k', "start"]
 
+        enable_ipv6 = self._port_obj.http_server_supports_ipv6()
+        # Perform part of the checks Apache's APR does when trying to listen to
+        # a specific host/port. This allows us to avoid trying to listen to
+        # IPV6 addresses when it fails on Apache. APR itself tries to call
+        # getaddrinfo() again without AI_ADDRCONFIG if the first call fails
+        # with EBADFLAGS, but that is not how it normally fails in our use
+        # cases, so ignore that for now.
+        # See https://bugs.webkit.org/show_bug.cgi?id=98602#c7
+        try:
+            socket.getaddrinfo('::1', 0, 0, 0, 0, socket.AI_ADDRCONFIG)
+        except:
+            enable_ipv6 = False
+
+        for mapping in self._mappings:
+            port = mapping['port']
+
+            start_cmd += ['-C', "\'Listen 127.0.0.1:%d\'" % port]
+
+            # We listen to both IPv4 and IPv6 loop-back addresses, but ignore
+            # requests to 8000 from random users on network.
+            # See https://bugs.webkit.org/show_bug.cgi?id=37104
+            if enable_ipv6:
+                start_cmd += ['-C', "\'Listen [::1]:%d\'" % port]
+
         if additional_dirs:
             for alias, path in additional_dirs.iteritems():
                 start_cmd += ['-c', "\'Alias %s \"%s\"\'" % (alias, path),
@@ -98,7 +121,6 @@ class LayoutTestApacheHttpd(http_server_base.HttpServerBase):
                           '-c', "\'MinSpareServers %d\'" % self._number_of_servers,
                           '-c', "\'MaxSpareServers %d\'" % self._number_of_servers]
 
-
         stop_cmd = [executable,
             '-f', "\"%s\"" % self._get_apache_config_file_path(test_dir, output_dir),
             '-c', "\'PidFile %s'" % self._pid_file,
diff --git a/Tools/Scripts/webkitpy/layout_tests/views/metered_stream.py b/Tools/Scripts/webkitpy/layout_tests/views/metered_stream.py
index 7a36391fa..acea93ea4 100644
--- a/Tools/Scripts/webkitpy/layout_tests/views/metered_stream.py
+++ b/Tools/Scripts/webkitpy/layout_tests/views/metered_stream.py
@@ -32,9 +32,6 @@ import os
 import sys
 import time
 
-from webkitpy.common.memoized import memoized
-
-
 LOG_HANDLER_NAME = 'MeteredStreamLogHandler'
 
 
@@ -55,7 +52,7 @@ class MeteredStream(object):
     def _ensure_newline(txt):
         return txt if txt.endswith('\n') else txt + '\n'
 
-    def __init__(self, stream=None, verbose=False, logger=None, time_fn=None, pid=None):
+    def __init__(self, stream=None, verbose=False, logger=None, time_fn=None, pid=None, number_of_columns=None):
         self._stream = stream or sys.stderr
         self._verbose = verbose
         self._time_fn = time_fn or time.time
@@ -65,6 +62,9 @@ class MeteredStream(object):
         self._last_partial_line = ''
         self._last_write_time = 0.0
         self._throttle_delay_in_secs = 0.066 if self._erasing else 10.0
+        self._number_of_columns = sys.maxint
+        if self._isatty and number_of_columns:
+            self._number_of_columns = number_of_columns
 
         self._logger = logger
         self._log_handler = None
@@ -122,19 +122,8 @@ class MeteredStream(object):
             self._last_partial_line = ''
             self._stream.flush()
 
-    @memoized
     def number_of_columns(self):
-        if not self._isatty:
-            return sys.maxint
-        try:
-            import fcntl
-            import struct
-            import termios
-            packed = fcntl.ioctl(self._stream.fileno(), termios.TIOCGWINSZ, '\0' * 8)
-            _, columns, _, _ = struct.unpack('HHHH', packed)
-            return columns
-        except:
-            return sys.maxint
+        return self._number_of_columns
 
 
 class _LogHandler(logging.Handler):
diff --git a/Tools/Scripts/webkitpy/layout_tests/views/printing.py b/Tools/Scripts/webkitpy/layout_tests/views/printing.py
index 44500ecc7..b7a9195a8 100644
--- a/Tools/Scripts/webkitpy/layout_tests/views/printing.py
+++ b/Tools/Scripts/webkitpy/layout_tests/views/printing.py
@@ -73,7 +73,8 @@ class Printer(object):
         self._port = port
         self._options = options
         self._buildbot_stream = buildbot_output
-        self._meter = MeteredStream(regular_output, options.debug_rwt_logging, logger=logger)
+        self._meter = MeteredStream(regular_output, options.debug_rwt_logging, logger=logger,
+                                    number_of_columns=self._port.host.platform.terminal_width())
         self._running_tests = []
         self._completed_tests = []
 
@@ -298,7 +299,7 @@ class Printer(object):
             desc = TestExpectations.EXPECTATION_DESCRIPTIONS[result]
             if not_passing and len(results):
                 pct = len(results) * 100.0 / not_passing
-                self._print_for_bot("  %5d %-24s (%4.1f%%)" % (len(results), desc[0], pct))
+                self._print_for_bot("  %5d %-24s (%4.1f%%)" % (len(results), desc, pct))
 
     def _print_one_line_summary(self, total, expected, unexpected):
         incomplete = total - expected - unexpected
@@ -356,29 +357,34 @@ class Printer(object):
     def print_finished_test(self, result, expected, exp_str, got_str):
         self.num_completed += 1
         test_name = result.test_name
+
+        result_message = self._result_message(result.type, result.failures, expected, self._options.verbose)
+
         if self._options.details:
             self._print_test_trace(result, exp_str, got_str)
         elif (self._options.verbose and not self._options.debug_rwt_logging) or not expected:
-            desc = TestExpectations.EXPECTATION_DESCRIPTIONS[result.type]
-            suffix = ' ' + desc[1]
-            if not expected:
-                suffix += ' unexpectedly' + desc[2]
-            self.writeln(self._test_status_line(test_name, suffix))
+            self.writeln(self._test_status_line(test_name, result_message))
         elif self.num_completed == self.num_tests:
             self._meter.write_update('')
         else:
-            desc = TestExpectations.EXPECTATION_DESCRIPTIONS[result.type]
-            suffix = ' ' + desc[1]
             if test_name == self._running_tests[0]:
-                self._completed_tests.insert(0, [test_name, suffix])
+                self._completed_tests.insert(0, [test_name, result_message])
             else:
-                self._completed_tests.append([test_name, suffix])
+                self._completed_tests.append([test_name, result_message])
 
-            for test_name, suffix in self._completed_tests:
-                self._meter.write_throttled_update(self._test_status_line(test_name, suffix))
+            for test_name, result_message in self._completed_tests:
+                self._meter.write_throttled_update(self._test_status_line(test_name, result_message))
             self._completed_tests = []
         self._running_tests.remove(test_name)
 
+    def _result_message(self, result_type, failures, expected, verbose):
+        exp_string = ' unexpectedly' if not expected else ''
+        if result_type == test_expectations.PASS:
+            return ' passed%s' % exp_string
+        else:
+            return ' failed%s (%s)' % (exp_string, ', '.join(failure.message() for failure in failures))
+
+
     def _print_test_trace(self, result, exp_str, got_str):
         test_name = result.test_name
         self._print_default(self._test_status_line(test_name, ''))
@@ -447,7 +453,7 @@ class Printer(object):
             descriptions = TestExpectations.EXPECTATION_DESCRIPTIONS
             for key, tests in flaky.iteritems():
                 result = TestExpectations.EXPECTATIONS[key.lower()]
-                self._print_for_bot("Unexpected flakiness: %s (%d)" % (descriptions[result][0], len(tests)))
+                self._print_for_bot("Unexpected flakiness: %s (%d)" % (descriptions[result], len(tests)))
                 tests.sort()
 
                 for test in tests:
@@ -465,10 +471,10 @@ class Printer(object):
             descriptions = TestExpectations.EXPECTATION_DESCRIPTIONS
             for key, tests in regressions.iteritems():
                 result = TestExpectations.EXPECTATIONS[key.lower()]
-                self._print_for_bot("Regressions: Unexpected %s : (%d)" % (descriptions[result][0], len(tests)))
+                self._print_for_bot("Regressions: Unexpected %s (%d)" % (descriptions[result], len(tests)))
                 tests.sort()
                 for test in tests:
-                    self._print_for_bot("  %s [ %s ] " % (test, TestExpectationParser._inverted_expectation_tokens[key]))
+                    self._print_for_bot("  %s [ %s ]" % (test, TestExpectationParser._inverted_expectation_tokens[key]))
                 self._print_for_bot("")
 
         if len(unexpected_results['tests']) and self._options.debug_rwt_logging:
diff --git a/Tools/Scripts/webkitpy/performance_tests/perftest.py b/Tools/Scripts/webkitpy/performance_tests/perftest.py
index 32b9d8bc6..9e2f87d47 100644
--- a/Tools/Scripts/webkitpy/performance_tests/perftest.py
+++ b/Tools/Scripts/webkitpy/performance_tests/perftest.py
@@ -381,7 +381,6 @@ class PerfTestFactory(object):
 
     _pattern_map = [
         (re.compile(r'^inspector/'), ChromiumStylePerfTest),
-        (re.compile(r'^PageLoad/'), PageLoadingPerfTest),
         (re.compile(r'(.+)\.replay$'), ReplayPerfTest),
     ]
 
diff --git a/Tools/Scripts/webkitpy/performance_tests/perftest_unittest.py b/Tools/Scripts/webkitpy/performance_tests/perftest_unittest.py
index 4410903e9..259fc7854 100755
--- a/Tools/Scripts/webkitpy/performance_tests/perftest_unittest.py
+++ b/Tools/Scripts/webkitpy/performance_tests/perftest_unittest.py
@@ -362,10 +362,6 @@ class TestPerfTestFactory(unittest.TestCase):
         test = PerfTestFactory.create_perf_test(MockPort(), 'inspector/some-test', '/path/inspector/some-test')
         self.assertEqual(test.__class__, ChromiumStylePerfTest)
 
-    def test_page_loading_test(self):
-        test = PerfTestFactory.create_perf_test(MockPort(), 'PageLoad/some-test', '/path/PageLoad/some-test')
-        self.assertEqual(test.__class__, PageLoadingPerfTest)
-
 
 if __name__ == '__main__':
     unittest.main()
diff --git a/Tools/Scripts/webkitpy/performance_tests/perftestsrunner_unittest.py b/Tools/Scripts/webkitpy/performance_tests/perftestsrunner_unittest.py
index 6119c61d3..9c9295f63 100755
--- a/Tools/Scripts/webkitpy/performance_tests/perftestsrunner_unittest.py
+++ b/Tools/Scripts/webkitpy/performance_tests/perftestsrunner_unittest.py
@@ -598,13 +598,6 @@ max 548000 bytes
         port.skipped_perf_tests = lambda: ['inspector/unsupported_test1.html', 'unsupported']
         self.assertEqual(self._collect_tests_and_sort_test_name(runner), ['inspector/test1.html', 'inspector/test2.html', 'inspector/unsupported_test1.html', 'unsupported/unsupported_test2.html'])
 
-    def test_collect_tests_with_page_load_svg(self):
-        runner, port = self.create_runner()
-        self._add_file(runner, 'PageLoad', 'some-svg-test.svg')
-        tests = runner._collect_tests()
-        self.assertEqual(len(tests), 1)
-        self.assertEqual(tests[0].__class__.__name__, 'PageLoadingPerfTest')
-
     def test_collect_tests_should_ignore_replay_tests_by_default(self):
         runner, port = self.create_runner()
         self._add_file(runner, 'Replay', 'www.webkit.org.replay')
diff --git a/Tools/Scripts/webkitpy/pylintrc b/Tools/Scripts/webkitpy/pylintrc
index bdd040415..caadcfbe6 100644
--- a/Tools/Scripts/webkitpy/pylintrc
+++ b/Tools/Scripts/webkitpy/pylintrc
@@ -64,6 +64,7 @@ load-plugins=
 # CHANGED:
 # C0103: Invalid name ""
 # C0111: Missing docstring
+# C0301: Line too long
 # C0302: Too many lines in module (N)
 # I0010: Unable to consider inline option ''
 # I0011: Locally disabling WNNNN
@@ -93,7 +94,7 @@ load-plugins=
 # W0614: Unused import X from wildcard import
 # W0703: Catch "Exception"
 # W1201: Specify string format arguments as logging function parameters
-disable=C0103,C0111,C0302,I0010,I0011,R0201,R0801,R0901,R0902,R0903,R0904,R0911,R0912,R0913,R0914,R0915,R0921,R0922,W0122,W0141,W0142,W0212,W0401,W0402,W0404,W0511,W0603,W0614,W0703,W1201
+disable=C0103,C0111,C0301,C0302,I0010,I0011,R0201,R0801,R0901,R0902,R0903,R0904,R0911,R0912,R0913,R0914,R0915,R0921,R0922,W0122,W0141,W0142,W0212,W0401,W0402,W0404,W0511,W0603,W0614,W0703,W1201
 
 
 [REPORTS]
diff --git a/Tools/Scripts/webkitpy/style/checkers/cpp.py b/Tools/Scripts/webkitpy/style/checkers/cpp.py
index ebbd1ad2f..a1447e2fb 100644
--- a/Tools/Scripts/webkitpy/style/checkers/cpp.py
+++ b/Tools/Scripts/webkitpy/style/checkers/cpp.py
@@ -1594,7 +1594,7 @@ def check_function_definition_and_pass_ptr(type_text, row, location_description,
     """
     match_ref_or_own_ptr = '(?=\W|^)(Ref|Own)Ptr(?=\W)'
     bad_type_usage = search(match_ref_or_own_ptr, type_text)
-    if not bad_type_usage or type_text.endswith('&'):
+    if not bad_type_usage or type_text.endswith('&') or type_text.endswith('*'):
         return
     type_name = bad_type_usage.group(0)
     error(row, 'readability/pass_ptr', 5,
diff --git a/Tools/Scripts/webkitpy/style/checkers/cpp_unittest.py b/Tools/Scripts/webkitpy/style/checkers/cpp_unittest.py
index 6f001e0cb..552220101 100644
--- a/Tools/Scripts/webkitpy/style/checkers/cpp_unittest.py
+++ b/Tools/Scripts/webkitpy/style/checkers/cpp_unittest.py
@@ -3421,6 +3421,11 @@ class PassPtrTest(CppStyleTestBase):
             '{\n'
             '}',
             '')
+        self.assert_pass_ptr_check(
+            'int myFunction(RefPtr<Type1>*)\n'
+            '{\n'
+            '}',
+            '')
 
     def test_own_ptr_parameter_value(self):
         self.assert_pass_ptr_check(
diff --git a/Tools/Scripts/webkitpy/style/checkers/test_expectations.py b/Tools/Scripts/webkitpy/style/checkers/test_expectations.py
index 1ce40cd39..51b97bec5 100644
--- a/Tools/Scripts/webkitpy/style/checkers/test_expectations.py
+++ b/Tools/Scripts/webkitpy/style/checkers/test_expectations.py
@@ -79,7 +79,7 @@ class TestExpectationsChecker(object):
         pass
 
     def check_test_expectations(self, expectations_str, tests=None):
-        parser = TestExpectationParser(self._port_obj, tests, False)
+        parser = TestExpectationParser(self._port_obj, tests, allow_rebaseline_modifier=False)
         expectations = parser.parse('expectations', expectations_str)
 
         level = 5
diff --git a/Tools/Scripts/webkitpy/test/main.py b/Tools/Scripts/webkitpy/test/main.py
index 852413299..e639a4578 100644
--- a/Tools/Scripts/webkitpy/test/main.py
+++ b/Tools/Scripts/webkitpy/test/main.py
@@ -178,17 +178,19 @@ class Tester(object):
         return True
 
     def _test_names(self, loader, names):
+        parallel_test_method_prefixes = ['test_']
+        serial_test_method_prefixes = ['serial_test_']
         if self._options.integration_tests:
-            loader.test_method_prefixes.append('integration_test_')
+            parallel_test_method_prefixes.append('integration_test_')
+            serial_test_method_prefixes.append('serial_integration_test_')
 
         parallel_tests = []
-        if self._options.child_processes > 1:
-            for name in names:
-                parallel_tests.extend(self._all_test_names(loader.loadTestsFromName(name, None)))
-            loader.test_method_prefixes = []
+        loader.test_method_prefixes = parallel_test_method_prefixes
+        for name in names:
+            parallel_tests.extend(self._all_test_names(loader.loadTestsFromName(name, None)))
 
         serial_tests = []
-        loader.test_method_prefixes = ['serial_test_', 'serial_integration_test_']
+        loader.test_method_prefixes = serial_test_method_prefixes
         for name in names:
             serial_tests.extend(self._all_test_names(loader.loadTestsFromName(name, None)))
 
@@ -216,7 +218,7 @@ class Tester(object):
 
 
 class _Loader(unittest.TestLoader):
-    test_method_prefixes = ['test_']
+    test_method_prefixes = []
 
     def getTestCaseNames(self, testCaseClass):
         def isTestMethod(attrname, testCaseClass=testCaseClass):
diff --git a/Tools/Scripts/webkitpy/test/main_unittest.py b/Tools/Scripts/webkitpy/test/main_unittest.py
index 2020f5b60..4fa6ef384 100644
--- a/Tools/Scripts/webkitpy/test/main_unittest.py
+++ b/Tools/Scripts/webkitpy/test/main_unittest.py
@@ -21,13 +21,33 @@
 # OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 import logging
+import sys
 import unittest
 import StringIO
 
+from webkitpy.common.system.filesystem import FileSystem
+from webkitpy.common.system.executive import Executive
 from webkitpy.common.system.outputcapture import OutputCapture
 from webkitpy.test.main import Tester, _Loader
 
 
+STUBS_CLASS = __name__ + ".TestStubs"
+
+
+class TestStubs(unittest.TestCase):
+    def test_empty(self):
+        pass
+
+    def integration_test_empty(self):
+        pass
+
+    def serial_test_empty(self):
+        pass
+
+    def serial_integration_test_empty(self):
+        pass
+
+
 class TesterTest(unittest.TestCase):
 
     def test_no_tests_found(self):
@@ -53,9 +73,45 @@ class TesterTest(unittest.TestCase):
         self.assertTrue('No tests to run' in errors.getvalue())
         self.assertTrue('No tests to run' in logs)
 
-    def test_individual_names_are_not_run_twice(self):
+    def _find_test_names(self, args):
         tester = Tester()
-        tester._options, args = tester._parse_args(["webkitpy.test.main_unittest.TesterTest.test_no_tests_found"])
-        parallel_tests, serial_tests = tester._test_names(_Loader(), args)
+        tester._options, args = tester._parse_args(args)
+        return tester._test_names(_Loader(), args)
+
+    def test_individual_names_are_not_run_twice(self):
+        args = [STUBS_CLASS + '.test_empty']
+        parallel_tests, serial_tests = self._find_test_names(args)
         self.assertEquals(parallel_tests, args)
         self.assertEquals(serial_tests, [])
+
+    def test_integration_tests_are_not_found_by_default(self):
+        parallel_tests, serial_tests = self._find_test_names([STUBS_CLASS])
+        self.assertEquals(parallel_tests, [
+            STUBS_CLASS + '.test_empty',
+            ])
+        self.assertEquals(serial_tests, [
+            STUBS_CLASS + '.serial_test_empty',
+            ])
+
+    def test_integration_tests_are_found(self):
+        parallel_tests, serial_tests = self._find_test_names(['--integration-tests', STUBS_CLASS])
+        self.assertEquals(parallel_tests, [
+            STUBS_CLASS + '.integration_test_empty',
+            STUBS_CLASS + '.test_empty',
+            ])
+        self.assertEquals(serial_tests, [
+            STUBS_CLASS + '.serial_integration_test_empty',
+            STUBS_CLASS + '.serial_test_empty',
+            ])
+
+    def integration_test_coverage_works(self):
+        filesystem = FileSystem()
+        executive = Executive()
+        module_path = filesystem.path_to_module(self.__module__)
+        script_dir = module_path[0:module_path.find('webkitpy') - 1]
+        proc = executive.popen([sys.executable, filesystem.join(script_dir, 'test-webkitpy'), '-c', STUBS_CLASS + '.test_empty'],
+                               stdout=executive.PIPE, stderr=executive.PIPE)
+        out, _ = proc.communicate()
+        retcode = proc.returncode
+        self.assertEquals(retcode, 0)
+        self.assertTrue('Cover' in out)
diff --git a/Tools/Scripts/webkitpy/thirdparty/__init__.py b/Tools/Scripts/webkitpy/thirdparty/__init__.py
index 17ae62a07..74ea5f601 100644
--- a/Tools/Scripts/webkitpy/thirdparty/__init__.py
+++ b/Tools/Scripts/webkitpy/thirdparty/__init__.py
@@ -65,7 +65,12 @@ class AutoinstallImportHook(object):
     def __init__(self, filesystem=None):
         self._fs = filesystem or FileSystem()
 
-    def find_module(self, fullname, path):
+    def _ensure_autoinstalled_dir_is_in_sys_path(self):
+        # Some packages require that the are being put somewhere under a directory in sys.path.
+        if not _AUTOINSTALLED_DIR in sys.path:
+            sys.path.append(_AUTOINSTALLED_DIR)
+
+    def find_module(self, fullname, _):
         # This method will run before each import. See http://www.python.org/dev/peps/pep-0302/
         if '.autoinstalled' not in fullname:
             return
@@ -98,11 +103,14 @@ class AutoinstallImportHook(object):
                              "pep8-0.5.0/pep8.py")
 
     def _install_pylint(self):
-        installed_something = False
+        self._ensure_autoinstalled_dir_is_in_sys_path()
+        did_install_something = False
         if not self._fs.exists(self._fs.join(_AUTOINSTALLED_DIR, "pylint")):
-            installed_something = self._install('http://pypi.python.org/packages/source/p/pylint/pylint-0.25.1.tar.gz#md5=728bbc2b339bc3749af013709a7f87a5', 'pylint-0.25.1')
-            self._fs.move(self._fs.join(_AUTOINSTALLED_DIR, "pylint-0.25.1"), self._fs.join(_AUTOINSTALLED_DIR, "pylint"))
-        return installed_something
+            installer = AutoInstaller(target_dir=_AUTOINSTALLED_DIR)
+            did_install_something = installer.install("http://pypi.python.org/packages/source/l/logilab-common/logilab-common-0.58.1.tar.gz#md5=77298ab2d8bb8b4af9219791e7cee8ce", url_subpath="logilab-common-0.58.1", target_name="logilab/common")
+            did_install_something |= installer.install("http://pypi.python.org/packages/source/l/logilab-astng/logilab-astng-0.24.1.tar.gz#md5=ddaf66e4d85714d9c47a46d4bed406de", url_subpath="logilab-astng-0.24.1", target_name="logilab/astng")
+            did_install_something |= installer.install('http://pypi.python.org/packages/source/p/pylint/pylint-0.25.1.tar.gz#md5=728bbc2b339bc3749af013709a7f87a5', url_subpath="pylint-0.25.1", target_name="pylint")
+        return did_install_something
 
     # autoinstalled.buildbot is used by BuildSlaveSupport/build.webkit.org-config/mastercfg_unittest.py
     # and should ideally match the version of BuildBot used at build.webkit.org.
@@ -114,24 +122,23 @@ class AutoinstallImportHook(object):
         # without including other modules as a side effect.
         jinja_dir = self._fs.join(_AUTOINSTALLED_DIR, "jinja2")
         installer = AutoInstaller(append_to_search_path=True, target_dir=jinja_dir)
-        installed_something = installer.install(url="http://pypi.python.org/packages/source/J/Jinja2/Jinja2-2.6.tar.gz#md5=1c49a8825c993bfdcf55bb36897d28a2",
+        did_install_something = installer.install(url="http://pypi.python.org/packages/source/J/Jinja2/Jinja2-2.6.tar.gz#md5=1c49a8825c993bfdcf55bb36897d28a2",
                                                 url_subpath="Jinja2-2.6/jinja2")
 
         SQLAlchemy_dir = self._fs.join(_AUTOINSTALLED_DIR, "sqlalchemy")
         installer = AutoInstaller(append_to_search_path=True, target_dir=SQLAlchemy_dir)
-        installed_something |= installer.install(url="http://pypi.python.org/packages/source/S/SQLAlchemy/SQLAlchemy-0.7.7.tar.gz#md5=ddf6df7e014cea318fa981364f3f93b9",
+        did_install_something |= installer.install(url="http://pypi.python.org/packages/source/S/SQLAlchemy/SQLAlchemy-0.7.7.tar.gz#md5=ddf6df7e014cea318fa981364f3f93b9",
                                                  url_subpath="SQLAlchemy-0.7.7/lib/sqlalchemy")
 
-        installed_something |= self._install("http://pypi.python.org/packages/source/b/buildbot/buildbot-0.8.6p1.tar.gz#md5=b6727d2810c692062c657492bcbeac6a", "buildbot-0.8.6p1/buildbot")
-        return installed_something
+        did_install_something |= self._install("http://pypi.python.org/packages/source/b/buildbot/buildbot-0.8.6p1.tar.gz#md5=b6727d2810c692062c657492bcbeac6a", "buildbot-0.8.6p1/buildbot")
+        return did_install_something
 
     def _install_coverage(self):
-        installer = AutoInstaller(target_dir=_AUTOINSTALLED_DIR)
-        return installer.install(url="http://pypi.python.org/packages/source/c/coverage/coverage-3.5.1.tar.gz#md5=410d4c8155a4dab222f2bc51212d4a24", url_subpath="coverage-3.5.1/coverage")
+        self._ensure_autoinstalled_dir_is_in_sys_path()
+        return self._install(url="http://pypi.python.org/packages/source/c/coverage/coverage-3.5.1.tar.gz#md5=410d4c8155a4dab222f2bc51212d4a24", url_subpath="coverage-3.5.1/coverage")
 
     def _install_eliza(self):
-        installer = AutoInstaller(target_dir=_AUTOINSTALLED_DIR)
-        return installer.install(url="http://www.adambarth.com/webkit/eliza", target_name="eliza.py")
+        return self._install(url="http://www.adambarth.com/webkit/eliza", target_name="eliza.py")
 
     def _install_irc(self):
         # Since irclib and ircbot are two top-level packages, we need to import
@@ -139,26 +146,26 @@ class AutoinstallImportHook(object):
         # organization purposes.
         irc_dir = self._fs.join(_AUTOINSTALLED_DIR, "irc")
         installer = AutoInstaller(target_dir=irc_dir)
-        installed_something = installer.install(url="http://downloads.sourceforge.net/project/python-irclib/python-irclib/0.4.8/python-irclib-0.4.8.zip",
+        did_install_something = installer.install(url="http://downloads.sourceforge.net/project/python-irclib/python-irclib/0.4.8/python-irclib-0.4.8.zip",
                                                 url_subpath="irclib.py")
-        installed_something |= installer.install(url="http://downloads.sourceforge.net/project/python-irclib/python-irclib/0.4.8/python-irclib-0.4.8.zip",
+        did_install_something |= installer.install(url="http://downloads.sourceforge.net/project/python-irclib/python-irclib/0.4.8/python-irclib-0.4.8.zip",
                           url_subpath="ircbot.py")
-        return installed_something
+        return did_install_something
 
     def _install_webpagereplay(self):
-        installed_something = False
+        did_install_something = False
         if not self._fs.exists(self._fs.join(_AUTOINSTALLED_DIR, "webpagereplay")):
-            installed_something = self._install("http://web-page-replay.googlecode.com/files/webpagereplay-1.1.2.tar.gz", "webpagereplay-1.1.2")
+            did_install_something = self._install("http://web-page-replay.googlecode.com/files/webpagereplay-1.1.2.tar.gz", "webpagereplay-1.1.2")
             self._fs.move(self._fs.join(_AUTOINSTALLED_DIR, "webpagereplay-1.1.2"), self._fs.join(_AUTOINSTALLED_DIR, "webpagereplay"))
 
-        init_path = self._fs.join(_AUTOINSTALLED_DIR, "webpagereplay", "__init__.py")
-        if not self._fs.exists(init_path):
-            self._fs.write_text_file(init_path, "")
-        return installed_something
+        module_init_path = self._fs.join(_AUTOINSTALLED_DIR, "webpagereplay", "__init__.py")
+        if not self._fs.exists(module_init_path):
+            self._fs.write_text_file(module_init_path, "")
+        return did_install_something
 
-    def _install(self, url, url_subpath):
+    def _install(self, url, url_subpath=None, target_name=None):
         installer = AutoInstaller(target_dir=_AUTOINSTALLED_DIR)
-        return installer.install(url=url, url_subpath=url_subpath)
+        return installer.install(url=url, url_subpath=url_subpath, target_name=target_name)
 
 
 _hook = AutoinstallImportHook()
@@ -167,7 +174,7 @@ sys.meta_path.append(_hook)
 
 def autoinstall_everything():
     install_methods = [method for method in dir(_hook.__class__) if method.startswith('_install_')]
-    installed_something = False
+    did_install_something = False
     for method in install_methods:
-        installed_something |= getattr(_hook, method)()
-    return installed_something
+        did_install_something |= getattr(_hook, method)()
+    return did_install_something
diff --git a/Tools/Scripts/webkitpy/thirdparty/__init___unittest.py b/Tools/Scripts/webkitpy/thirdparty/__init___unittest.py
index 3583ab432..b3eb75f98 100644
--- a/Tools/Scripts/webkitpy/thirdparty/__init___unittest.py
+++ b/Tools/Scripts/webkitpy/thirdparty/__init___unittest.py
@@ -32,13 +32,14 @@ import unittest
 
 from webkitpy.thirdparty import AutoinstallImportHook
 
+
 class ThirdpartyTest(unittest.TestCase):
     def test_import_hook(self):
         # Add another import hook and make sure we get called.
         class MockImportHook(AutoinstallImportHook):
             def __init__(self):
                 AutoinstallImportHook.__init__(self)
-                self._eliza_installed = False
+                self.eliza_installed = False
 
             def _install_eliza(self):
                 self.eliza_installed = True
@@ -48,11 +49,26 @@ class ThirdpartyTest(unittest.TestCase):
             # The actual AutoinstallImportHook should be installed before us,
             # so these modules will get installed before MockImportHook runs.
             sys.meta_path.append(mock_import_hook)
+            # unused-variable, import failures - pylint: disable-msg=W0612,E0611,F0401
             from webkitpy.thirdparty.autoinstalled import eliza
             self.assertTrue(mock_import_hook.eliza_installed)
 
         finally:
             sys.meta_path.remove(mock_import_hook)
 
+    def test_imports(self):
+        # This method tests that we can actually import everything.
+        # unused-variable, import failures - pylint: disable-msg=W0612,E0611,F0401
+        import webkitpy.thirdparty.autoinstalled.buildbot
+        import webkitpy.thirdparty.autoinstalled.coverage
+        import webkitpy.thirdparty.autoinstalled.eliza
+        import webkitpy.thirdparty.autoinstalled.irc.ircbot
+        import webkitpy.thirdparty.autoinstalled.irc.irclib
+        import webkitpy.thirdparty.autoinstalled.mechanize
+        import webkitpy.thirdparty.autoinstalled.pylint
+        import webkitpy.thirdparty.autoinstalled.webpagereplay
+        import webkitpy.thirdparty.autoinstalled.pep8
+
+
 if __name__ == '__main__':
     unittest.main()
diff --git a/Tools/Scripts/webkitpy/tool/bot/commitqueuetask_unittest.py b/Tools/Scripts/webkitpy/tool/bot/commitqueuetask_unittest.py
index 0cef8c867..8b3341623 100644
--- a/Tools/Scripts/webkitpy/tool/bot/commitqueuetask_unittest.py
+++ b/Tools/Scripts/webkitpy/tool/bot/commitqueuetask_unittest.py
@@ -45,6 +45,7 @@ from webkitpy.tool.mocktool import MockTool
 class MockCommitQueue(CommitQueueTaskDelegate):
     def __init__(self, error_plan):
         self._error_plan = error_plan
+        self._failure_status_id = 0
 
     def run_command(self, command):
         log("run_webkit_patch: %s" % command)
@@ -60,7 +61,8 @@ class MockCommitQueue(CommitQueueTaskDelegate):
     def command_failed(self, failure_message, script_error, patch):
         log("command_failed: failure_message='%s' script_error='%s' patch='%s'" % (
             failure_message, script_error, patch.id()))
-        return 3947
+        self._failure_status_id += 1
+        return self._failure_status_id
 
     def refetch_patch(self, patch):
         return patch
@@ -522,6 +524,8 @@ command_failed: failure_message='Unable to pass tests without patch (tree is red
 """
         task = self._run_through_task(commit_queue, expected_stderr, GoldenScriptError)
         self.assertEqual(task.results_from_patch_test_run(task._patch).failing_tests(), ["foo.html", "bar.html"])
+        # failure_status_id should be of the test with patch (1), not the test without patch (2).
+        self.assertEqual(task.failure_status_id, 1)
 
     def test_land_failure(self):
         commit_queue = MockCommitQueue([
diff --git a/Tools/Scripts/webkitpy/tool/bot/flakytestreporter_unittest.py b/Tools/Scripts/webkitpy/tool/bot/flakytestreporter_unittest.py
index 7c1487d7e..eeb06c3af 100644
--- a/Tools/Scripts/webkitpy/tool/bot/flakytestreporter_unittest.py
+++ b/Tools/Scripts/webkitpy/tool/bot/flakytestreporter_unittest.py
@@ -113,7 +113,7 @@ foo/bar.html has been flaky on the dummy-queue.
 foo/bar.html was authored by abarth@webkit.org.
 http://trac.webkit.org/browser/trunk/LayoutTests/foo/bar.html
 
-The dummy-queue just saw foo/bar.html flake (Text diff mismatch) while processing attachment 10000 on bug 50000.
+The dummy-queue just saw foo/bar.html flake (text diff) while processing attachment 10000 on bug 50000.
 Bot: mock-bot-id  Port: MockPort  Platform: MockPlatform 1.0
 
 The bots will update this with information from each new failure.
diff --git a/Tools/Scripts/webkitpy/tool/bot/patchanalysistask.py b/Tools/Scripts/webkitpy/tool/bot/patchanalysistask.py
index 05ba73798..cde1c842e 100644
--- a/Tools/Scripts/webkitpy/tool/bot/patchanalysistask.py
+++ b/Tools/Scripts/webkitpy/tool/bot/patchanalysistask.py
@@ -186,6 +186,7 @@ class PatchAnalysisTask(object):
         first_results = self._delegate.test_results()
         first_results_archive = self._delegate.archive_last_test_results(self._patch)
         first_script_error = self._script_error
+        first_failure_status_id = self.failure_status_id
 
         if self._expected_failures.failures_were_expected(first_results):
             return True
@@ -223,6 +224,7 @@ class PatchAnalysisTask(object):
         # Now that we have updated information about failing tests with a clean checkout, we can
         # tell if our original failures were unexpected and fail the patch if necessary.
         if self._expected_failures.unexpected_failures_observed(first_results):
+            self.failure_status_id = first_failure_status_id
             return self.report_failure(first_results_archive, first_results, first_script_error)
 
         # We don't know what's going on.  The tree is likely very red (beyond our layout-test-results
diff --git a/Tools/Scripts/webkitpy/tool/commands/gardenomatic.py b/Tools/Scripts/webkitpy/tool/commands/gardenomatic.py
index 7da96e4bc..6cb1519ef 100644
--- a/Tools/Scripts/webkitpy/tool/commands/gardenomatic.py
+++ b/Tools/Scripts/webkitpy/tool/commands/gardenomatic.py
@@ -22,20 +22,38 @@
 # (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 # OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-from webkitpy.tool.multicommandtool import AbstractDeclarativeCommand
+from webkitpy.layout_tests.port import builders
+from webkitpy.tool.commands.rebaseline import AbstractRebaseliningCommand
 from webkitpy.tool.servers.gardeningserver import GardeningHTTPServer
 
 
-class GardenOMatic(AbstractDeclarativeCommand):
+class GardenOMatic(AbstractRebaseliningCommand):
     name = "garden-o-matic"
-    help_text = "Experimental command for gardening the WebKit tree."
+    help_text = "Command for gardening the WebKit tree."
+
+    def __init__(self):
+        return super(AbstractRebaseliningCommand, self).__init__(options=(self.platform_options + [
+            self.move_overwritten_baselines_option,
+            self.results_directory_option,
+            self.no_optimize_option,
+            ]))
 
     def execute(self, options, args, tool):
         print "This command runs a local HTTP server that changes your working copy"
         print "based on the actions you take in the web-based UI."
 
-        httpd = GardeningHTTPServer(httpd_port=8127, config={'tool': tool})
-        self._tool.user.open_url(httpd.url())
+        args = {}
+        if options.platform:
+            # FIXME: This assumes that the port implementation (chromium-, gtk-, etc.) is the first part of options.platform.
+            args['platform'] = options.platform.split('-')[0]
+            builder = builders.builder_name_for_port_name(options.platform)
+            if builder:
+                args['builder'] = builder
+        if options.results_directory:
+            args['useLocalResults'] = "true"
+
+        httpd = GardeningHTTPServer(httpd_port=8127, config={'tool': tool, 'options': options})
+        self._tool.user.open_url(httpd.url(args))
 
         print "Local HTTP server started."
         httpd.serve_forever()
diff --git a/Tools/Scripts/webkitpy/tool/commands/queries.py b/Tools/Scripts/webkitpy/tool/commands/queries.py
index 9fe8ef353..b7e4a8588 100644
--- a/Tools/Scripts/webkitpy/tool/commands/queries.py
+++ b/Tools/Scripts/webkitpy/tool/commands/queries.py
@@ -47,7 +47,7 @@ from webkitpy.tool.grammar import pluralize
 from webkitpy.tool.multicommandtool import AbstractDeclarativeCommand
 from webkitpy.common.system.deprecated_logging import log
 from webkitpy.layout_tests.models.test_expectations import TestExpectations
-from webkitpy.layout_tests.port import port_options
+from webkitpy.layout_tests.port import platform_options, configuration_options
 
 
 class SuggestReviewers(AbstractDeclarativeCommand):
@@ -440,7 +440,7 @@ class PrintExpectations(AbstractDeclarativeCommand):
                         help='Print a CSV-style report that includes the port name, modifiers, tests, and expectations'),
             make_option('-f', '--full', action='store_true', default=False,
                         help='Print a full TestExpectations-style line for every match'),
-        ] + port_options(platform='port/platform to use. Use glob-style wildcards for multiple ports (implies --csv)')
+        ] + platform_options(use_globs=True)
 
         AbstractDeclarativeCommand.__init__(self, options=options)
         self._expectation_models = {}
@@ -519,7 +519,7 @@ class PrintBaselines(AbstractDeclarativeCommand):
                         help='Print a CSV-style report that includes the port name, test_name, test platform, baseline type, baseline location, and baseline platform'),
             make_option('--include-virtual-tests', action='store_true',
                         help='Include virtual tests'),
-        ] + port_options(platform='port/platform to use. Use glob-style wildcards for multiple ports (implies --csv)')
+        ] + platform_options(use_globs=True)
         AbstractDeclarativeCommand.__init__(self, options=options)
         self._platform_regexp = re.compile('platform/([^\/]+)/(.+)')
 
diff --git a/Tools/Scripts/webkitpy/tool/commands/queues_unittest.py b/Tools/Scripts/webkitpy/tool/commands/queues_unittest.py
index b2243566a..6301fea0b 100644
--- a/Tools/Scripts/webkitpy/tool/commands/queues_unittest.py
+++ b/Tools/Scripts/webkitpy/tool/commands/queues_unittest.py
@@ -403,14 +403,14 @@ MOCK: release_work_item: commit-queue 10000
         queue = TestCommitQueue(MockTool())
         expected_stderr = """MOCK bug comment: bug_id=50002, cc=None
 --- Begin comment ---
-The commit-queue just saw foo/bar.html flake (Text diff mismatch) while processing attachment 10000 on bug 50000.
+The commit-queue just saw foo/bar.html flake (text diff) while processing attachment 10000 on bug 50000.
 Port: MockPort  Platform: MockPlatform 1.0
 --- End comment ---
 
 MOCK add_attachment_to_bug: bug_id=50002, description=Failure diff from bot filename=failure.diff mimetype=None
 MOCK bug comment: bug_id=50002, cc=None
 --- Begin comment ---
-The commit-queue just saw bar/baz.html flake (Text diff mismatch) while processing attachment 10000 on bug 50000.
+The commit-queue just saw bar/baz.html flake (text diff) while processing attachment 10000 on bug 50000.
 Port: MockPort  Platform: MockPlatform 1.0
 --- End comment ---
 
diff --git a/Tools/Scripts/webkitpy/tool/commands/rebaseline.py b/Tools/Scripts/webkitpy/tool/commands/rebaseline.py
index 859963261..d9209b118 100644
--- a/Tools/Scripts/webkitpy/tool/commands/rebaseline.py
+++ b/Tools/Scripts/webkitpy/tool/commands/rebaseline.py
@@ -29,41 +29,45 @@
 import json
 import logging
 import optparse
-import os.path
-import re
-import shutil
 import sys
-import urllib
 
-import webkitpy.common.config.urls as config_urls
 from webkitpy.common.checkout.baselineoptimizer import BaselineOptimizer
-from webkitpy.common.net.buildbot import BuildBot
-from webkitpy.common.net.layouttestresults import LayoutTestResults
 from webkitpy.common.system.executive import ScriptError
-from webkitpy.common.system.user import User
 from webkitpy.layout_tests.controllers.test_result_writer import TestResultWriter
 from webkitpy.layout_tests.models import test_failures
-from webkitpy.layout_tests.models.test_configuration import TestConfiguration
 from webkitpy.layout_tests.models.test_expectations import TestExpectations, BASELINE_SUFFIX_LIST
 from webkitpy.layout_tests.port import builders
-from webkitpy.tool.grammar import pluralize
+from webkitpy.layout_tests.port import factory
 from webkitpy.tool.multicommandtool import AbstractDeclarativeCommand
 
 
 _log = logging.getLogger(__name__)
 
+
 # FIXME: Should TestResultWriter know how to compute this string?
 def _baseline_name(fs, test_name, suffix):
     return fs.splitext(test_name)[0] + TestResultWriter.FILENAME_SUFFIX_EXPECTED + "." + suffix
 
 
 class AbstractRebaseliningCommand(AbstractDeclarativeCommand):
+    # not overriding execute() - pylint: disable-msg=W0223
+
+    move_overwritten_baselines_option = optparse.make_option("--move-overwritten-baselines", action="store_true", default=False,
+        help="Move overwritten baselines elsewhere in the baseline path. This is for bringing up new ports.")
+
+    no_optimize_option = optparse.make_option('--no-optimize', dest='optimize', action='store_false', default=True,
+        help=('Do not optimize/de-dup the expectations after rebaselining (default is to de-dup automatically). '
+              'You can use "webkit-patch optimize-baselines" to optimize separately.'))
+
+    platform_options = factory.platform_options(use_globs=True)
+
+    results_directory_option = optparse.make_option("--results-directory", help="Local results directory to use")
+
+    suffixes_option = optparse.make_option("--suffixes", default=','.join(BASELINE_SUFFIX_LIST), action="store",
+        help="Comma-separated-list of file types to rebaseline")
+
     def __init__(self, options=None):
-        options = options or []
-        options.extend([
-            optparse.make_option('--suffixes', default=','.join(BASELINE_SUFFIX_LIST), action='store',
-                                 help='file types to rebaseline')])
-        AbstractDeclarativeCommand.__init__(self, options=options)
+        super(AbstractRebaseliningCommand, self).__init__(options=options)
         self._baseline_suffix_list = BASELINE_SUFFIX_LIST
 
 
@@ -72,13 +76,15 @@ class RebaselineTest(AbstractRebaseliningCommand):
     help_text = "Rebaseline a single test from a buildbot. Only intended for use by other webkit-patch commands."
 
     def __init__(self):
-        options = [
+        super(RebaselineTest, self).__init__(options=[
+            self.no_optimize_option,
+            self.results_directory_option,
+            self.suffixes_option,
             optparse.make_option("--builder", help="Builder to pull new baselines from"),
             optparse.make_option("--move-overwritten-baselines-to", action="append", default=[],
                 help="Platform to move existing baselines to before rebaselining. This is for bringing up new ports."),
             optparse.make_option("--test", help="Test to rebaseline"),
-        ]
-        AbstractRebaseliningCommand.__init__(self, options=options)
+            ])
         self._scm_changes = {'add': []}
 
     def _results_url(self, builder_name):
@@ -101,12 +107,12 @@ class RebaselineTest(AbstractRebaseliningCommand):
             port = self._tool.port_factory.get(platform)
             old_baseline = port.expected_filename(test_name, "." + suffix)
             if not self._tool.filesystem.exists(old_baseline):
-                _log.info("No existing baseline for %s." % test_name)
+                _log.debug("No existing baseline for %s." % test_name)
                 continue
 
             new_baseline = self._tool.filesystem.join(port.baseline_path(), self._file_name_for_expected_result(test_name, suffix))
             if self._tool.filesystem.exists(new_baseline):
-                _log.info("Existing baseline at %s, not copying over it." % new_baseline)
+                _log.debug("Existing baseline at %s, not copying over it." % new_baseline)
                 continue
 
             old_baselines.append(old_baseline)
@@ -116,7 +122,7 @@ class RebaselineTest(AbstractRebaseliningCommand):
             old_baseline = old_baselines[i]
             new_baseline = new_baselines[i]
 
-            _log.info("Copying baseline from %s to %s." % (old_baseline, new_baseline))
+            _log.debug("Copying baseline from %s to %s." % (old_baseline, new_baseline))
             self._tool.filesystem.maybe_make_directory(self._tool.filesystem.dirname(new_baseline))
             self._tool.filesystem.copyfile(old_baseline, new_baseline)
             if not self._tool.scm().exists(new_baseline):
@@ -136,16 +142,27 @@ class RebaselineTest(AbstractRebaseliningCommand):
 
     def _update_expectations_file(self, builder_name, test_name):
         port = self._tool.port_factory.get_from_builder_name(builder_name)
-        expectations = TestExpectations(port, include_overrides=False)
-
-        for test_configuration in port.all_test_configurations():
-            if test_configuration.version == port.test_configuration().version:
-                expectationsString = expectations.remove_configuration_from_test(test_name, test_configuration)
 
-        self._tool.filesystem.write_text_file(port.path_to_test_expectations_file(), expectationsString)
+        # Since rebaseline-test-internal can be called multiple times in parallel,
+        # we need to ensure that we're not trying to update the expectations file
+        # concurrently as well.
+        # FIXME: We should rework the code to not need this; maybe just download
+        # the files in parallel and rebaseline local files serially?
+        try:
+            path = port.path_to_test_expectations_file()
+            lock = self._tool.make_file_lock(path + '.lock')
+            lock.acquire_lock()
+            expectations = TestExpectations(port, include_overrides=False)
+            for test_configuration in port.all_test_configurations():
+                if test_configuration.version == port.test_configuration().version:
+                    expectationsString = expectations.remove_configuration_from_test(test_name, test_configuration)
+
+            self._tool.filesystem.write_text_file(path, expectationsString)
+        finally:
+            lock.release_lock()
 
     def _test_root(self, test_name):
-        return os.path.splitext(test_name)[0]
+        return self._tool.filesystem.splitext(test_name)[0]
 
     def _file_name_for_actual_result(self, test_name, suffix):
         return "%s-actual.%s" % (self._test_root(test_name), suffix)
@@ -153,8 +170,7 @@ class RebaselineTest(AbstractRebaseliningCommand):
     def _file_name_for_expected_result(self, test_name, suffix):
         return "%s-expected.%s" % (self._test_root(test_name), suffix)
 
-    def _rebaseline_test(self, builder_name, test_name, move_overwritten_baselines_to, suffix):
-        results_url = self._results_url(builder_name)
+    def _rebaseline_test(self, builder_name, test_name, move_overwritten_baselines_to, suffix, results_url):
         baseline_directory = self._baseline_directory(builder_name)
 
         source_baseline = "%s/%s" % (results_url, self._file_name_for_actual_result(test_name, suffix))
@@ -163,17 +179,21 @@ class RebaselineTest(AbstractRebaseliningCommand):
         if move_overwritten_baselines_to:
             self._copy_existing_baseline(move_overwritten_baselines_to, test_name, suffix)
 
-        _log.info("Retrieving %s." % source_baseline)
+        _log.debug("Retrieving %s." % source_baseline)
         self._save_baseline(self._tool.web.get_binary(source_baseline, convert_404_to_None=True), target_baseline)
 
-    def _rebaseline_test_and_update_expectations(self, builder_name, test_name, platforms_to_move_existing_baselines_to):
+    def _rebaseline_test_and_update_expectations(self, options):
+        if options.results_directory:
+            results_url = 'file://' + options.results_directory
+        else:
+            results_url = self._results_url(options.builder)
+        self._baseline_suffix_list = options.suffixes.split(',')
         for suffix in self._baseline_suffix_list:
-            self._rebaseline_test(builder_name, test_name, platforms_to_move_existing_baselines_to, suffix)
-        self._update_expectations_file(builder_name, test_name)
+            self._rebaseline_test(options.builder, options.test, options.move_overwritten_baselines_to, suffix, results_url)
+        self._update_expectations_file(options.builder, options.test)
 
     def execute(self, options, args, tool):
-        self._baseline_suffix_list = options.suffixes.split(',')
-        self._rebaseline_test_and_update_expectations(options.builder, options.test, options.move_overwritten_baselines_to)
+        self._rebaseline_test_and_update_expectations(options)
         print json.dumps(self._scm_changes)
 
 
@@ -182,20 +202,27 @@ class OptimizeBaselines(AbstractRebaseliningCommand):
     help_text = "Reshuffles the baselines for the given tests to use as litte space on disk as possible."
     argument_names = "TEST_NAMES"
 
-    def _optimize_baseline(self, test_name):
+    def __init__(self):
+        super(OptimizeBaselines, self).__init__(options=[self.suffixes_option] + self.platform_options)
+
+    def _optimize_baseline(self, optimizer, test_name):
         for suffix in self._baseline_suffix_list:
             baseline_name = _baseline_name(self._tool.filesystem, test_name, suffix)
-            if not self._baseline_optimizer.optimize(baseline_name):
-                print "Hueristics failed to optimize %s" % baseline_name
+            if not optimizer.optimize(baseline_name):
+                print "Heuristics failed to optimize %s" % baseline_name
 
     def execute(self, options, args, tool):
         self._baseline_suffix_list = options.suffixes.split(',')
-        self._baseline_optimizer = BaselineOptimizer(tool)
-        self._port = tool.port_factory.get("chromium-win-win7")  # FIXME: This should be selectable.
+        port_names = tool.port_factory.all_port_names(options.platform)
+        if not port_names:
+            print "No port names match '%s'" % options.platform
+            return
 
-        for test_name in self._port.tests(args):
-            print "Optimizing %s." % test_name
-            self._optimize_baseline(test_name)
+        optimizer = BaselineOptimizer(tool, port_names)
+        port = tool.port_factory.get(port_names[0])
+        for test_name in port.tests(args):
+            _log.info("Optimizing %s" % test_name)
+            self._optimize_baseline(optimizer, test_name)
 
 
 class AnalyzeBaselines(AbstractRebaseliningCommand):
@@ -203,45 +230,54 @@ class AnalyzeBaselines(AbstractRebaseliningCommand):
     help_text = "Analyzes the baselines for the given tests and prints results that are identical."
     argument_names = "TEST_NAMES"
 
-    def _print(self, baseline_name, directories_by_result):
-        for result, directories in directories_by_result.items():
-            if len(directories) <= 1:
-                continue
-            results_names = [self._tool.filesystem.join(directory, baseline_name) for directory in directories]
-            print ' '.join(results_names)
-
-    def _analyze_baseline(self, test_name):
+    def __init__(self):
+        super(AnalyzeBaselines, self).__init__(options=[
+            self.suffixes_option,
+            optparse.make_option('--missing', action='store_true', default=False, help='show missing baselines as well'),
+            ] + self.platform_options)
+        self._optimizer_class = BaselineOptimizer  # overridable for testing
+        self._baseline_optimizer = None
+        self._port = None
+
+    def _write(self, msg):
+        print msg
+
+    def _analyze_baseline(self, options, test_name):
         for suffix in self._baseline_suffix_list:
             baseline_name = _baseline_name(self._tool.filesystem, test_name, suffix)
-            directories_by_result = self._baseline_optimizer.directories_by_result(baseline_name)
-            self._print(baseline_name, directories_by_result)
+            results_by_directory = self._baseline_optimizer.read_results_by_directory(baseline_name)
+            if results_by_directory:
+                self._write("%s:" % baseline_name)
+                self._baseline_optimizer.write_by_directory(results_by_directory, self._write, "  ")
+            elif options.missing:
+                self._write("%s: (no baselines found)" % baseline_name)
 
     def execute(self, options, args, tool):
         self._baseline_suffix_list = options.suffixes.split(',')
-        self._baseline_optimizer = BaselineOptimizer(tool)
-        self._port = tool.port_factory.get("chromium-win-win7")  # FIXME: This should be selectable.
+        port_names = tool.port_factory.all_port_names(options.platform)
+        if not port_names:
+            print "No port names match '%s'" % options.platform
+            return
 
+        self._baseline_optimizer = self._optimizer_class(tool, port_names)
+        self._port = tool.port_factory.get(port_names[0])
         for test_name in self._port.tests(args):
-            self._analyze_baseline(test_name)
+            self._analyze_baseline(options, test_name)
 
 
-class AbstractParallelRebaselineCommand(AbstractDeclarativeCommand):
-    def __init__(self, options=None):
-        options = options or []
-        options.extend([
-            optparse.make_option('--no-optimize', dest='optimize', action='store_false', default=True,
-                help=('Do not optimize/de-dup the expectations after rebaselining '
-                      '(default is to de-dup automatically). '
-                      'You can use "webkit-patch optimize-baselines" to optimize separately.'))])
-        AbstractDeclarativeCommand.__init__(self, options=options)
-
-    def _run_webkit_patch(self, args):
+class AbstractParallelRebaselineCommand(AbstractRebaseliningCommand):
+    # not overriding execute() - pylint: disable-msg=W0223
+
+    def _run_webkit_patch(self, args, verbose):
         try:
-            self._tool.executive.run_command([self._tool.path()] + args, cwd=self._tool.scm().checkout_root)
+            verbose_args = ['--verbose'] if verbose else []
+            stderr = self._tool.executive.run_command([self._tool.path()] + verbose_args + args, cwd=self._tool.scm().checkout_root, return_stderr=True)
+            for line in stderr.splitlines():
+                print >> sys.stderr, line
         except ScriptError, e:
             _log.error(e)
 
-    def _builders_to_fetch_from(self, builders):
+    def _builders_to_fetch_from(self, builders_to_check):
         # This routine returns the subset of builders that will cover all of the baseline search paths
         # used in the input list. In particular, if the input list contains both Release and Debug
         # versions of a configuration, we *only* return the Release version (since we don't save
@@ -249,7 +285,7 @@ class AbstractParallelRebaselineCommand(AbstractDeclarativeCommand):
         release_builders = set()
         debug_builders = set()
         builders_to_fallback_paths = {}
-        for builder in builders:
+        for builder in builders_to_check:
             port = self._tool.port_factory.get_from_builder_name(builder)
             if port.test_configuration().build_type == 'Release':
                 release_builders.add(builder)
@@ -262,7 +298,8 @@ class AbstractParallelRebaselineCommand(AbstractDeclarativeCommand):
                 builders_to_fallback_paths[builder] = fallback_path
         return builders_to_fallback_paths.keys()
 
-    def _rebaseline_commands(self, test_list):
+    def _rebaseline_commands(self, test_list, options):
+
         path_to_webkit_patch = self._tool.path()
         cwd = self._tool.scm().checkout_root
         commands = []
@@ -270,9 +307,14 @@ class AbstractParallelRebaselineCommand(AbstractDeclarativeCommand):
             for builder in self._builders_to_fetch_from(test_list[test]):
                 suffixes = ','.join(test_list[test][builder])
                 cmd_line = [path_to_webkit_patch, 'rebaseline-test-internal', '--suffixes', suffixes, '--builder', builder, '--test', test]
-                move_overwritten_baselines_to = builders.move_overwritten_baselines_to(builder)
-                for platform in move_overwritten_baselines_to:
-                    cmd_line.extend(['--move-overwritten-baselines-to', platform])
+                if options.move_overwritten_baselines:
+                    move_overwritten_baselines_to = builders.move_overwritten_baselines_to(builder)
+                    for platform in move_overwritten_baselines_to:
+                        cmd_line.extend(['--move-overwritten-baselines-to', platform])
+                if options.results_directory:
+                    cmd_line.extend(['--results-directory', options.results_directory])
+                if options.verbose:
+                    cmd_line.append('--verbose')
                 commands.append(tuple([cmd_line, cwd]))
         return commands
 
@@ -282,9 +324,10 @@ class AbstractParallelRebaselineCommand(AbstractDeclarativeCommand):
             file_added = False
             for line in output:
                 try:
-                    files_to_add.update(json.loads(line)['add'])
-                    file_added = True
-                except ValueError, e:
+                    if line:
+                        files_to_add.update(json.loads(line)['add'])
+                        file_added = True
+                except ValueError:
                     _log.debug('"%s" is not a JSON object, ignoring' % line)
 
             if not file_added:
@@ -293,30 +336,48 @@ class AbstractParallelRebaselineCommand(AbstractDeclarativeCommand):
 
         return list(files_to_add)
 
-    def _optimize_baselines(self, test_list):
+    def _optimize_baselines(self, test_list, verbose=False):
         # We don't run this in parallel because modifying the SCM in parallel is unreliable.
         for test in test_list:
             all_suffixes = set()
             for builder in self._builders_to_fetch_from(test_list[test]):
                 all_suffixes.update(test_list[test][builder])
-            self._run_webkit_patch(['optimize-baselines', '--suffixes', ','.join(all_suffixes), test])
+            # FIXME: We should propagate the platform options as well.
+            self._run_webkit_patch(['optimize-baselines', '--suffixes', ','.join(all_suffixes), test], verbose)
 
     def _rebaseline(self, options, test_list):
-        commands = self._rebaseline_commands(test_list)
+        for test, builders_to_check in sorted(test_list.items()):
+            _log.info("Rebaselining %s" % test)
+            for builder, suffixes in sorted(builders_to_check.items()):
+                _log.debug("  %s: %s" % (builder, ",".join(suffixes)))
+
+        commands = self._rebaseline_commands(test_list, options)
         command_results = self._tool.executive.run_in_parallel(commands)
 
+        log_output = '\n'.join(result[2] for result in command_results).replace('\n\n', '\n')
+        for line in log_output.split('\n'):
+            if line:
+                print >> sys.stderr, line  # FIXME: Figure out how to log properly.
+
         files_to_add = self._files_to_add(command_results)
         if files_to_add:
             self._tool.scm().add_list(list(files_to_add))
 
         if options.optimize:
-            self._optimize_baselines(test_list)
+            self._optimize_baselines(test_list, options.verbose)
 
 
 class RebaselineJson(AbstractParallelRebaselineCommand):
     name = "rebaseline-json"
     help_text = "Rebaseline based off JSON passed to stdin. Intended to only be called from other scripts."
 
+    def __init__(self,):
+        super(RebaselineJson, self).__init__(options=[
+            self.move_overwritten_baselines_option,
+            self.no_optimize_option,
+            self.results_directory_option,
+            ])
+
     def execute(self, options, args, tool):
         self._rebaseline(options, json.loads(sys.stdin.read()))
 
@@ -325,6 +386,13 @@ class RebaselineExpectations(AbstractParallelRebaselineCommand):
     name = "rebaseline-expectations"
     help_text = "Rebaselines the tests indicated in TestExpectations."
 
+    def __init__(self):
+        super(RebaselineExpectations, self).__init__(options=[
+            self.move_overwritten_baselines_option,
+            self.no_optimize_option,
+            ] + self.platform_options)
+        self._test_list = None
+
     def _update_expectations_files(self, port_name):
         port = self._tool.port_factory.get(port_name)
 
@@ -356,8 +424,10 @@ class RebaselineExpectations(AbstractParallelRebaselineCommand):
             self._test_list[test_name][builder_name] = suffixes
 
     def execute(self, options, args, tool):
+        options.results_directory = None
         self._test_list = {}
-        for port_name in tool.port_factory.all_port_names():
+        port_names = tool.port_factory.all_port_names(options.platform)
+        for port_name in port_names:
             self._add_tests_to_rebaseline_for_port(port_name)
         if not self._test_list:
             _log.warning("Did not find any tests marked Rebaseline.")
@@ -365,7 +435,7 @@ class RebaselineExpectations(AbstractParallelRebaselineCommand):
 
         self._rebaseline(options, self._test_list)
 
-        for port_name in tool.port_factory.all_port_names():
+        for port_name in port_names:
             self._update_expectations_files(port_name)
 
 
@@ -375,11 +445,13 @@ class Rebaseline(AbstractParallelRebaselineCommand):
     argument_names = "[TEST_NAMES]"
 
     def __init__(self):
-        options = [
+        super(Rebaseline, self).__init__(options=[
+            self.move_overwritten_baselines_option,
+            self.no_optimize_option,
+            # FIXME: should we support the platform options in addition to (or instead of) --builders?
+            self.suffixes_option,
             optparse.make_option("--builders", default=None, action="append", help="Comma-separated-list of builders to pull new baselines from (can also be provided multiple times)"),
-            optparse.make_option("--suffixes", default=BASELINE_SUFFIX_LIST, action="append", help="Comma-separated-list of file types to rebaseline (can also be provided multiple times)"),
-        ]
-        AbstractParallelRebaselineCommand.__init__(self, options=options)
+            ])
 
     def _builders_to_pull_from(self):
         chromium_buildbot_builder_names = []
@@ -403,30 +475,26 @@ class Rebaseline(AbstractParallelRebaselineCommand):
         failing_tests = builder.latest_layout_test_results().tests_matching_failure_types([test_failures.FailureTextMismatch])
         return self._tool.user.prompt_with_list("Which test(s) to rebaseline for %s:" % builder.name(), failing_tests, can_choose_multiple=True)
 
-    def _suffixes_to_update(self, options):
-        suffixes = set()
-        for suffix_list in options.suffixes:
-            suffixes |= set(suffix_list.split(","))
-        return list(suffixes)
-
     def execute(self, options, args, tool):
+        options.results_directory = None
         if options.builders:
-            builders = []
+            builders_to_check = []
             for builder_names in options.builders:
-                builders += [self._builder_with_name(name) for name in builder_names.split(",")]
+                builders_to_check += [self._builder_with_name(name) for name in builder_names.split(",")]
         else:
-            builders = self._builders_to_pull_from()
+            builders_to_check = self._builders_to_pull_from()
 
         test_list = {}
+        suffixes_to_update = options.suffixes.split(",")
 
-        for builder in builders:
+        for builder in builders_to_check:
             tests = args or self._tests_to_update(builder)
             for test in tests:
                 if test not in test_list:
                     test_list[test] = {}
-                test_list[test][builder.name()] = self._suffixes_to_update(options)
+                test_list[test][builder.name()] = suffixes_to_update
 
         if options.verbose:
-            print "rebaseline-json: " + str(test_list)
+            _log.debug("rebaseline-json: " + str(test_list))
 
         self._rebaseline(options, test_list)
diff --git a/Tools/Scripts/webkitpy/tool/commands/rebaseline_unittest.py b/Tools/Scripts/webkitpy/tool/commands/rebaseline_unittest.py
index 35394245f..d7dafb91c 100644
--- a/Tools/Scripts/webkitpy/tool/commands/rebaseline_unittest.py
+++ b/Tools/Scripts/webkitpy/tool/commands/rebaseline_unittest.py
@@ -29,487 +29,373 @@
 import unittest
 
 from webkitpy.common.system.outputcapture import OutputCapture
+from webkitpy.common.checkout.baselineoptimizer import BaselineOptimizer
+from webkitpy.common.net.buildbot.buildbot_mock import MockBuilder
+from webkitpy.common.system.executive_mock import MockExecutive2
 from webkitpy.thirdparty.mock import Mock
 from webkitpy.tool.commands.rebaseline import *
 from webkitpy.tool.mocktool import MockTool, MockOptions
-from webkitpy.common.net.buildbot.buildbot_mock import MockBuilder
-from webkitpy.common.system.executive_mock import MockExecutive
 
 
-class TestRebaseline(unittest.TestCase):
-    def test_tests_to_update(self):
-        command = Rebaseline()
-        command.bind_to_tool(MockTool())
-        build = Mock()
-        OutputCapture().assert_outputs(self, command._tests_to_update, [build])
+class _BaseTestCase(unittest.TestCase):
+    MOCK_WEB_RESULT = 'MOCK Web result, convert 404 to None=True'
+    WEB_PREFIX = 'http://example.com/f/builders/WebKit Mac10.7/results/layout-test-results'
+
+    command_constructor = None
+
+    def setUp(self):
+        self.tool = MockTool()
+        self.command = self.command_constructor()  # lint warns that command_constructor might not be set, but this is intentional; pylint: disable-msg=E1102
+        self.command.bind_to_tool(self.tool)
+        self.lion_port = self.tool.port_factory.get_from_builder_name("WebKit Mac10.7")
+        self.lion_expectations_path = self.lion_port.path_to_test_expectations_file()
+
+        # FIXME: we should override builders._exact_matches here to point to a set
+        # of test ports and restore the value in tearDown(), and that way the
+        # individual tests wouldn't have to worry about it.
+
+    def _expand(self, path):
+        if self.tool.filesystem.isabs(path):
+            return path
+        return self.tool.filesystem.join(self.lion_port.layout_tests_dir(), path)
+
+    def _read(self, path):
+        return self.tool.filesystem.read_text_file(self._expand(path))
+
+    def _write(self, path, contents):
+        self.tool.filesystem.write_text_file(self._expand(path), contents)
+
+    def _zero_out_test_expectations(self):
+        for port_name in self.tool.port_factory.all_port_names():
+            port = self.tool.port_factory.get(port_name)
+            for path in port.expectations_files():
+                self._write(path, '')
+        self.tool.filesystem.written_files = {}
+
+
+class TestRebaselineTest(_BaseTestCase):
+    command_constructor = RebaselineTest  # AKA webkit-patch rebaseline-test-internal
+
+    def setUp(self):
+        super(TestRebaselineTest, self).setUp()
+        self.options = MockOptions(builder="WebKit Mac10.7", test="userscripts/another-test.html", suffixes="txt",
+                                   move_overwritten_baselines_to=None, results_directory=None)
 
     def test_baseline_directory(self):
-        command = RebaselineTest()
-        tool = MockTool()
-        command.bind_to_tool(tool)
+        command = self.command
         self.assertEqual(command._baseline_directory("Apple Win XP Debug (Tests)"), "/mock-checkout/LayoutTests/platform/win-xp")
         self.assertEqual(command._baseline_directory("Apple Win 7 Release (Tests)"), "/mock-checkout/LayoutTests/platform/win")
         self.assertEqual(command._baseline_directory("Apple Lion Release WK1 (Tests)"), "/mock-checkout/LayoutTests/platform/mac-lion")
         self.assertEqual(command._baseline_directory("Apple Lion Release WK2 (Tests)"), "/mock-checkout/LayoutTests/platform/mac-wk2")
         self.assertEqual(command._baseline_directory("GTK Linux 32-bit Release"), "/mock-checkout/LayoutTests/platform/gtk")
-        self.assertEqual(command._baseline_directory("EFL Linux 64-bit Debug"), "/mock-checkout/LayoutTests/platform/efl")
+        self.assertEqual(command._baseline_directory("EFL Linux 64-bit Debug"), "/mock-checkout/LayoutTests/platform/efl-wk1")
         self.assertEqual(command._baseline_directory("Qt Linux Release"), "/mock-checkout/LayoutTests/platform/qt")
         self.assertEqual(command._baseline_directory("WebKit Mac10.7"), "/mock-checkout/LayoutTests/platform/chromium-mac-lion")
         self.assertEqual(command._baseline_directory("WebKit Mac10.6"), "/mock-checkout/LayoutTests/platform/chromium-mac-snowleopard")
 
     def test_rebaseline_updates_expectations_file_noop(self):
-        command = RebaselineTest()
-        tool = MockTool()
-        command.bind_to_tool(tool)
-
-        lion_port = tool.port_factory.get_from_builder_name("WebKit Mac10.7")
-        for path in lion_port.expectations_files():
-            tool.filesystem.write_text_file(path, '')
-        tool.filesystem.write_text_file(lion_port.path_to_test_expectations_file(), """Bug(B) [ Mac Linux XP Debug ] fast/dom/Window/window-postmessage-clone-really-deep-array.html [ Pass ]
+        self._zero_out_test_expectations()
+        self._write(self.lion_expectations_path, """Bug(B) [ Mac Linux XP Debug ] fast/dom/Window/window-postmessage-clone-really-deep-array.html [ Pass ]
 Bug(A) [ Debug ] : fast/css/large-list-of-rules-crash.html [ Failure ]
 """)
-        tool.filesystem.write_text_file(os.path.join(lion_port.layout_tests_dir(), "fast/dom/Window/window-postmessage-clone-really-deep-array.html"), "Dummy test contents")
-        tool.filesystem.write_text_file(os.path.join(lion_port.layout_tests_dir(), "fast/css/large-list-of-rules-crash.html"), "Dummy test contents")
-        tool.filesystem.write_text_file(os.path.join(lion_port.layout_tests_dir(), "userscripts/another-test.html"), "Dummy test contents")
-
-        expected_logs = """Retrieving http://example.com/f/builders/WebKit Mac10.7/results/layout-test-results/userscripts/another-test-actual.png.
-Retrieving http://example.com/f/builders/WebKit Mac10.7/results/layout-test-results/userscripts/another-test-actual.wav.
-Retrieving http://example.com/f/builders/WebKit Mac10.7/results/layout-test-results/userscripts/another-test-actual.txt.
-"""
-        OutputCapture().assert_outputs(self, command._rebaseline_test_and_update_expectations, ["WebKit Mac10.7", "userscripts/another-test.html", None], expected_logs=expected_logs)
-
-        new_expectations = tool.filesystem.read_text_file(lion_port.path_to_test_expectations_file())
+        self._write("fast/dom/Window/window-postmessage-clone-really-deep-array.html", "Dummy test contents")
+        self._write("fast/css/large-list-of-rules-crash.html", "Dummy test contents")
+        self._write("userscripts/another-test.html", "Dummy test contents")
+
+        self.options.suffixes = "png,wav,txt"
+        self.command._rebaseline_test_and_update_expectations(self.options)
+
+        self.assertEquals(self.tool.web.urls_fetched,
+            [self.WEB_PREFIX + '/userscripts/another-test-actual.png',
+             self.WEB_PREFIX + '/userscripts/another-test-actual.wav',
+             self.WEB_PREFIX + '/userscripts/another-test-actual.txt'])
+        new_expectations = self._read(self.lion_expectations_path)
         self.assertEqual(new_expectations, """Bug(B) [ Mac Linux XP Debug ] fast/dom/Window/window-postmessage-clone-really-deep-array.html [ Pass ]
 Bug(A) [ Debug ] : fast/css/large-list-of-rules-crash.html [ Failure ]
 """)
 
     def test_rebaseline_updates_expectations_file(self):
-        command = RebaselineTest()
-        tool = MockTool()
-        command.bind_to_tool(tool)
+        self._write(self.lion_expectations_path, "Bug(x) [ Mac ] userscripts/another-test.html [ ImageOnlyFailure ]\nbug(z) [ Linux ] userscripts/another-test.html [ ImageOnlyFailure ]\n")
+        self._write("userscripts/another-test.html", "Dummy test contents")
 
-        lion_port = tool.port_factory.get_from_builder_name("WebKit Mac10.7")
-        tool.filesystem.write_text_file(lion_port.path_to_test_expectations_file(), "Bug(x) [ Mac ] userscripts/another-test.html [ ImageOnlyFailure ]\nbug(z) [ Linux ] userscripts/another-test.html [ ImageOnlyFailure ]\n")
-        tool.filesystem.write_text_file(os.path.join(lion_port.layout_tests_dir(), "userscripts/another-test.html"), "Dummy test contents")
+        self.options.suffixes = 'png,wav,txt'
+        self.command._rebaseline_test_and_update_expectations(self.options)
 
-        expected_logs = """Retrieving http://example.com/f/builders/WebKit Mac10.7/results/layout-test-results/userscripts/another-test-actual.png.
-Retrieving http://example.com/f/builders/WebKit Mac10.7/results/layout-test-results/userscripts/another-test-actual.wav.
-Retrieving http://example.com/f/builders/WebKit Mac10.7/results/layout-test-results/userscripts/another-test-actual.txt.
-"""
-        OutputCapture().assert_outputs(self, command._rebaseline_test_and_update_expectations, ["WebKit Mac10.7", "userscripts/another-test.html", None], expected_logs=expected_logs)
-
-        new_expectations = tool.filesystem.read_text_file(lion_port.path_to_test_expectations_file())
+        self.assertEquals(self.tool.web.urls_fetched,
+            [self.WEB_PREFIX + '/userscripts/another-test-actual.png',
+             self.WEB_PREFIX + '/userscripts/another-test-actual.wav',
+             self.WEB_PREFIX + '/userscripts/another-test-actual.txt'])
+        new_expectations = self._read(self.lion_expectations_path)
         self.assertEqual(new_expectations, "Bug(x) [ MountainLion SnowLeopard ] userscripts/another-test.html [ ImageOnlyFailure ]\nbug(z) [ Linux ] userscripts/another-test.html [ ImageOnlyFailure ]\n")
 
     def test_rebaseline_does_not_include_overrides(self):
-        command = RebaselineTest()
-        tool = MockTool()
-        command.bind_to_tool(tool)
-
-        lion_port = tool.port_factory.get_from_builder_name("WebKit Mac10.7")
-        tool.filesystem.write_text_file(lion_port.path_to_test_expectations_file(), "Bug(x) [ Mac ] userscripts/another-test.html [ ImageOnlyFailure ]\nBug(z) [ Linux ] userscripts/another-test.html [ ImageOnlyFailure ]\n")
-        tool.filesystem.write_text_file(lion_port.path_from_chromium_base('skia', 'skia_test_expectations.txt'), "Bug(y) [ Mac ] other-test.html [ Failure ]\n")
-        tool.filesystem.write_text_file(os.path.join(lion_port.layout_tests_dir(), "userscripts/another-test.html"), "Dummy test contents")
-
-        expected_logs = """Retrieving http://example.com/f/builders/WebKit Mac10.7/results/layout-test-results/userscripts/another-test-actual.png.
-Retrieving http://example.com/f/builders/WebKit Mac10.7/results/layout-test-results/userscripts/another-test-actual.wav.
-Retrieving http://example.com/f/builders/WebKit Mac10.7/results/layout-test-results/userscripts/another-test-actual.txt.
-"""
-        OutputCapture().assert_outputs(self, command._rebaseline_test_and_update_expectations, ["WebKit Mac10.7", "userscripts/another-test.html", None], expected_logs=expected_logs)
-
-        new_expectations = tool.filesystem.read_text_file(lion_port.path_to_test_expectations_file())
+        self._write(self.lion_expectations_path, "Bug(x) [ Mac ] userscripts/another-test.html [ ImageOnlyFailure ]\nBug(z) [ Linux ] userscripts/another-test.html [ ImageOnlyFailure ]\n")
+        self._write(self.lion_port.path_from_chromium_base('skia', 'skia_test_expectations.txt'), "Bug(y) [ Mac ] other-test.html [ Failure ]\n")
+        self._write("userscripts/another-test.html", "Dummy test contents")
+
+        self.options.suffixes = 'png,wav,txt'
+        self.command._rebaseline_test_and_update_expectations(self.options)
+
+        self.assertEquals(self.tool.web.urls_fetched,
+            [self.WEB_PREFIX + '/userscripts/another-test-actual.png',
+             self.WEB_PREFIX + '/userscripts/another-test-actual.wav',
+             self.WEB_PREFIX + '/userscripts/another-test-actual.txt'])
+
+        new_expectations = self._read(self.lion_expectations_path)
         self.assertEqual(new_expectations, "Bug(x) [ MountainLion SnowLeopard ] userscripts/another-test.html [ ImageOnlyFailure ]\nBug(z) [ Linux ] userscripts/another-test.html [ ImageOnlyFailure ]\n")
 
     def test_rebaseline_test(self):
-        command = RebaselineTest()
-        command.bind_to_tool(MockTool())
-        expected_logs = "Retrieving http://example.com/f/builders/WebKit Linux/results/layout-test-results/userscripts/another-test-actual.txt.\n"
-        OutputCapture().assert_outputs(self, command._rebaseline_test, ["WebKit Linux", "userscripts/another-test.html", None, "txt"], expected_logs=expected_logs)
+        self.command._rebaseline_test("WebKit Linux", "userscripts/another-test.html", None, "txt", self.WEB_PREFIX)
+        self.assertEquals(self.tool.web.urls_fetched, [self.WEB_PREFIX + '/userscripts/another-test-actual.txt'])
+
+    def test_rebaseline_test_with_results_directory(self):
+        self._write(self.lion_expectations_path, "Bug(x) [ Mac ] userscripts/another-test.html [ ImageOnlyFailure ]\nbug(z) [ Linux ] userscripts/another-test.html [ ImageOnlyFailure ]\n")
+        self.options.results_directory = '/tmp'
+        self.command._rebaseline_test_and_update_expectations(self.options)
+        self.assertEquals(self.tool.web.urls_fetched, ['file:///tmp/userscripts/another-test-actual.txt'])
 
     def test_rebaseline_test_and_print_scm_changes(self):
-        command = RebaselineTest()
-        command.bind_to_tool(MockTool())
-        expected_logs = "Retrieving http://example.com/f/builders/WebKit Linux/results/layout-test-results/userscripts/another-test-actual.txt.\n"
-        command._print_scm_changes = True
-        command._scm_changes = {'add': [], 'delete': []}
-        command._tool._scm.exists = lambda x: False
-        OutputCapture().assert_outputs(self, command._rebaseline_test, ["WebKit Linux", "userscripts/another-test.html", None, "txt"], expected_logs=expected_logs)
-        self.assertEquals(command._scm_changes, {'add': ['/mock-checkout/LayoutTests/platform/chromium-linux/userscripts/another-test-expected.txt'], 'delete': []})
+        self.command._print_scm_changes = True
+        self.command._scm_changes = {'add': [], 'delete': []}
+        self.tool._scm.exists = lambda x: False
+
+        self.command._rebaseline_test("WebKit Linux", "userscripts/another-test.html", None, "txt", None)
+
+        self.assertEquals(self.command._scm_changes, {'add': ['/mock-checkout/LayoutTests/platform/chromium-linux/userscripts/another-test-expected.txt'], 'delete': []})
 
     def test_rebaseline_and_copy_test(self):
-        command = RebaselineTest()
-        tool = MockTool()
-        command.bind_to_tool(tool)
+        self._write("userscripts/another-test-expected.txt", "generic result")
 
-        lion_port = tool.port_factory.get_from_builder_name("WebKit Mac10.7")
-        tool.filesystem.write_text_file(os.path.join(lion_port.layout_tests_dir(), "userscripts/another-test-expected.txt"), "Dummy expected result")
+        self.command._rebaseline_test("WebKit Mac10.7", "userscripts/another-test.html", ["chromium-mac-snowleopard"], "txt", None)
 
-        expected_logs = """Copying baseline from /mock-checkout/LayoutTests/userscripts/another-test-expected.txt to /mock-checkout/LayoutTests/platform/chromium-mac-snowleopard/userscripts/another-test-expected.txt.
-Retrieving http://example.com/f/builders/WebKit Mac10.7/results/layout-test-results/userscripts/another-test-actual.txt.
-"""
-        OutputCapture().assert_outputs(self, command._rebaseline_test, ["WebKit Mac10.7", "userscripts/another-test.html", ["chromium-mac-snowleopard"], "txt"], expected_logs=expected_logs)
+        self.assertEquals(self._read('platform/chromium-mac-lion/userscripts/another-test-expected.txt'), self.MOCK_WEB_RESULT)
+        self.assertEquals(self._read('platform/chromium-mac-snowleopard/userscripts/another-test-expected.txt'), 'generic result')
 
     def test_rebaseline_and_copy_test_no_existing_result(self):
-        command = RebaselineTest()
-        tool = MockTool()
-        command.bind_to_tool(tool)
+        self.command._rebaseline_test("WebKit Mac10.7", "userscripts/another-test.html", ["chromium-mac-snowleopard"], "txt", None)
 
-        expected_logs = """No existing baseline for userscripts/another-test.html.
-Retrieving http://example.com/f/builders/WebKit Mac10.7/results/layout-test-results/userscripts/another-test-actual.txt.
-"""
-        OutputCapture().assert_outputs(self, command._rebaseline_test, ["WebKit Mac10.7", "userscripts/another-test.html", ["chromium-mac-snowleopard"], "txt"], expected_logs=expected_logs)
+        self.assertEquals(self._read('platform/chromium-mac-lion/userscripts/another-test-expected.txt'), self.MOCK_WEB_RESULT)
+        self.assertFalse(self.tool.filesystem.exists(self._expand('platform/chromium-mac-snowleopard/userscripts/another-test-expected.txt')))
 
     def test_rebaseline_and_copy_test_with_lion_result(self):
-        command = RebaselineTest()
-        tool = MockTool()
-        command.bind_to_tool(tool)
+        self._write("platform/chromium-mac-lion/userscripts/another-test-expected.txt", "original lion result")
 
-        lion_port = tool.port_factory.get_from_builder_name("WebKit Mac10.7")
-        tool.filesystem.write_text_file(os.path.join(lion_port.baseline_path(), "userscripts/another-test-expected.txt"), "Dummy expected result")
+        self.command._rebaseline_test("WebKit Mac10.7", "userscripts/another-test.html", ["chromium-mac-snowleopard"], "txt", self.WEB_PREFIX)
 
-        expected_logs = "Copying baseline from /mock-checkout/LayoutTests/platform/chromium-mac-lion/userscripts/another-test-expected.txt to /mock-checkout/LayoutTests/platform/chromium-mac-snowleopard/userscripts/another-test-expected.txt.\nRetrieving http://example.com/f/builders/WebKit Mac10.7/results/layout-test-results/userscripts/another-test-actual.txt.\n"
-        OutputCapture().assert_outputs(self, command._rebaseline_test, ["WebKit Mac10.7", "userscripts/another-test.html", ["chromium-mac-snowleopard"], "txt"], expected_logs=expected_logs)
+        self.assertEquals(self.tool.web.urls_fetched, [self.WEB_PREFIX + '/userscripts/another-test-actual.txt'])
+        self.assertEquals(self._read("platform/chromium-mac-snowleopard/userscripts/another-test-expected.txt"), "original lion result")
+        self.assertEquals(self._read("platform/chromium-mac-lion/userscripts/another-test-expected.txt"), self.MOCK_WEB_RESULT)
 
     def test_rebaseline_and_copy_no_overwrite_test(self):
-        command = RebaselineTest()
-        tool = MockTool()
-        command.bind_to_tool(tool)
-
-        lion_port = tool.port_factory.get_from_builder_name("WebKit Mac10.7")
-        tool.filesystem.write_text_file(os.path.join(lion_port.baseline_path(), "userscripts/another-test-expected.txt"), "Dummy expected result")
-
-        snowleopard_port = tool.port_factory.get_from_builder_name("WebKit Mac10.6")
-        tool.filesystem.write_text_file(os.path.join(snowleopard_port.baseline_path(), "userscripts/another-test-expected.txt"), "Dummy expected result")
-
-        expected_logs = """Existing baseline at /mock-checkout/LayoutTests/platform/chromium-mac-snowleopard/userscripts/another-test-expected.txt, not copying over it.
-Retrieving http://example.com/f/builders/WebKit Mac10.7/results/layout-test-results/userscripts/another-test-actual.txt.
-"""
-        OutputCapture().assert_outputs(self, command._rebaseline_test, ["WebKit Mac10.7", "userscripts/another-test.html", ["chromium-mac-snowleopard"], "txt"], expected_logs=expected_logs)
-
-    def test_rebaseline_all(self):
-        old_exact_matches = builders._exact_matches
-        builders._exact_matches = {
-            "MOCK builder": {"port_name": "test-mac-leopard", "specifiers": set(["mock-specifier"])},
-            "MOCK builder (Debug)": {"port_name": "test-mac-leopard", "specifiers": set(["mock-specifier", "debug"])},
-        }
-
-        command = RebaselineJson()
-        tool = MockTool()
-        options = MockOptions()
-        options.optimize = True
-        command.bind_to_tool(tool)
-        tool.executive = MockExecutive(should_log=True)
+        self._write("platform/chromium-mac-lion/userscripts/another-test-expected.txt", "original lion result")
+        self._write("platform/chromium-mac-snowleopard/userscripts/another-test-expected.txt", "original snowleopard result")
 
-        expected_stderr = """MOCK run_command: ['echo', 'rebaseline-test-internal', '--suffixes', 'txt,png', '--builder', 'MOCK builder', '--test', 'user-scripts/another-test.html'], cwd=/mock-checkout
-MOCK run_command: ['echo', 'optimize-baselines', '--suffixes', 'txt,png', 'user-scripts/another-test.html'], cwd=/mock-checkout
-"""
-        OutputCapture().assert_outputs(self, command._rebaseline, [options, {"user-scripts/another-test.html":{"MOCK builder": ["txt", "png"]}}], expected_stderr=expected_stderr)
+        self.command._rebaseline_test("WebKit Mac10.7", "userscripts/another-test.html", ["chromium-mac-snowleopard"], "txt", None)
 
-        expected_stderr = """MOCK run_command: ['echo', 'rebaseline-test-internal', '--suffixes', 'txt,png', '--builder', 'MOCK builder (Debug)', '--test', 'user-scripts/another-test.html'], cwd=/mock-checkout
-MOCK run_command: ['echo', 'optimize-baselines', '--suffixes', 'txt,png', 'user-scripts/another-test.html'], cwd=/mock-checkout
-"""
-        OutputCapture().assert_outputs(self, command._rebaseline, [options, {"user-scripts/another-test.html":{"MOCK builder (Debug)": ["txt", "png"]}}], expected_stderr=expected_stderr)
+        self.assertEquals(self._read("platform/chromium-mac-snowleopard/userscripts/another-test-expected.txt"), "original snowleopard result")
+        self.assertEquals(self._read("platform/chromium-mac-lion/userscripts/another-test-expected.txt"), self.MOCK_WEB_RESULT)
 
-        expected_stderr = """MOCK run_command: ['echo', 'rebaseline-test-internal', '--suffixes', 'txt', '--builder', 'MOCK builder', '--test', 'user-scripts/another-test.html'], cwd=/mock-checkout
-MOCK run_command: ['echo', 'optimize-baselines', '--suffixes', 'txt', 'user-scripts/another-test.html'], cwd=/mock-checkout
-"""
-        OutputCapture().assert_outputs(self, command._rebaseline, [options, {"user-scripts/another-test.html":{"MOCK builder (Debug)": ["txt", "png"], "MOCK builder": ["txt"]}}], expected_stderr=expected_stderr)
-
-        builders._exact_matches = old_exact_matches
-
-    def test_rebaseline_expectations(self):
-        command = RebaselineExpectations()
-        tool = MockTool()
-        command.bind_to_tool(tool)
-
-        lion_port = tool.port_factory.get_from_builder_name("WebKit Mac10.7")
-        for port_name in tool.port_factory.all_port_names():
-            port = tool.port_factory.get(port_name)
-            for path in port.expectations_files():
-                tool.filesystem.write_text_file(path, '')
-
-        # Don't enable logging until after we create the mock expectation files as some Port.__init__'s run subcommands.
-        tool.executive = MockExecutive(should_log=True)
-
-        def run_in_parallel(commands):
-            print commands
-            return ""
-
-        tool.executive.run_in_parallel = run_in_parallel
-
-        expected_logs = "Retrieving results for chromium-linux-x86 from WebKit Linux 32.\n    userscripts/another-test.html (txt)\n    userscripts/images.svg (png)\nRetrieving results for chromium-linux-x86_64 from WebKit Linux.\n    userscripts/another-test.html (txt)\n    userscripts/images.svg (png)\nRetrieving results for chromium-mac-lion from WebKit Mac10.7.\n    userscripts/another-test.html (txt)\n    userscripts/images.svg (png)\nRetrieving results for chromium-mac-mountainlion from WebKit Mac10.8.\n    userscripts/another-test.html (txt)\n    userscripts/images.svg (png)\nRetrieving results for chromium-mac-snowleopard from WebKit Mac10.6.\n    userscripts/another-test.html (txt)\n    userscripts/images.svg (png)\nRetrieving results for chromium-win-win7 from WebKit Win7.\n    userscripts/another-test.html (txt)\n    userscripts/images.svg (png)\nRetrieving results for chromium-win-xp from WebKit XP.\n    userscripts/another-test.html (txt)\n    userscripts/images.svg (png)\nRetrieving results for efl from EFL Linux 64-bit Release.\n    userscripts/another-test.html (txt)\n    userscripts/images.svg (png)\nRetrieving results for gtk from GTK Linux 64-bit Release.\n    userscripts/another-test.html (txt)\n    userscripts/images.svg (png)\nRetrieving results for mac-lion from Apple Lion Release WK1 (Tests).\n    userscripts/another-test.html (txt)\n    userscripts/images.svg (png)\nRetrieving results for mac-mountainlion from Apple MountainLion Release WK1 (Tests).\n    userscripts/another-test.html (txt)\n    userscripts/images.svg (png)\nRetrieving results for qt-linux from Qt Linux Release.\n    userscripts/another-test.html (txt)\n    userscripts/images.svg (png)\nRetrieving results for win-7sp0 from Apple Win 7 Release (Tests).\n    userscripts/another-test.html (txt)\n    userscripts/images.svg (png)\n"
-
-        expected_stdout = "[(['echo', 'rebaseline-test-internal', '--suffixes', 'txt', '--builder', 'WebKit Linux 32', '--test', 'userscripts/another-test.html'], '/mock-checkout'), (['echo', 'rebaseline-test-internal', '--suffixes', 'txt', '--builder', 'WebKit Linux', '--test', 'userscripts/another-test.html'], '/mock-checkout'), (['echo', 'rebaseline-test-internal', '--suffixes', 'txt', '--builder', 'WebKit Mac10.6', '--test', 'userscripts/another-test.html'], '/mock-checkout'), (['echo', 'rebaseline-test-internal', '--suffixes', 'txt', '--builder', 'WebKit Mac10.7', '--test', 'userscripts/another-test.html'], '/mock-checkout'), (['echo', 'rebaseline-test-internal', '--suffixes', 'txt', '--builder', 'WebKit Win7', '--test', 'userscripts/another-test.html'], '/mock-checkout'), (['echo', 'rebaseline-test-internal', '--suffixes', 'txt', '--builder', 'Apple Win 7 Release (Tests)', '--test', 'userscripts/another-test.html'], '/mock-checkout'), (['echo', 'rebaseline-test-internal', '--suffixes', 'txt', '--builder', 'EFL Linux 64-bit Release', '--test', 'userscripts/another-test.html'], '/mock-checkout'), (['echo', 'rebaseline-test-internal', '--suffixes', 'txt', '--builder', 'WebKit Mac10.8', '--test', 'userscripts/another-test.html'], '/mock-checkout'), (['echo', 'rebaseline-test-internal', '--suffixes', 'txt', '--builder', 'GTK Linux 64-bit Release', '--test', 'userscripts/another-test.html'], '/mock-checkout'), (['echo', 'rebaseline-test-internal', '--suffixes', 'txt', '--builder', 'Qt Linux Release', '--test', 'userscripts/another-test.html'], '/mock-checkout'), (['echo', 'rebaseline-test-internal', '--suffixes', 'txt', '--builder', 'Apple Lion Release WK1 (Tests)', '--test', 'userscripts/another-test.html'], '/mock-checkout'), (['echo', 'rebaseline-test-internal', '--suffixes', 'txt', '--builder', 'WebKit XP', '--test', 'userscripts/another-test.html'], '/mock-checkout'), (['echo', 'rebaseline-test-internal', '--suffixes', 'txt', '--builder', 'Apple MountainLion Release WK1 (Tests)', '--test', 'userscripts/another-test.html'], '/mock-checkout'), (['echo', 'rebaseline-test-internal', '--suffixes', 'png', '--builder', 'WebKit Linux 32', '--test', 'userscripts/images.svg'], '/mock-checkout'), (['echo', 'rebaseline-test-internal', '--suffixes', 'png', '--builder', 'WebKit Linux', '--test', 'userscripts/images.svg'], '/mock-checkout'), (['echo', 'rebaseline-test-internal', '--suffixes', 'png', '--builder', 'WebKit Mac10.6', '--test', 'userscripts/images.svg'], '/mock-checkout'), (['echo', 'rebaseline-test-internal', '--suffixes', 'png', '--builder', 'WebKit Mac10.7', '--test', 'userscripts/images.svg'], '/mock-checkout'), (['echo', 'rebaseline-test-internal', '--suffixes', 'png', '--builder', 'WebKit Win7', '--test', 'userscripts/images.svg'], '/mock-checkout'), (['echo', 'rebaseline-test-internal', '--suffixes', 'png', '--builder', 'Apple Win 7 Release (Tests)', '--test', 'userscripts/images.svg'], '/mock-checkout'), (['echo', 'rebaseline-test-internal', '--suffixes', 'png', '--builder', 'EFL Linux 64-bit Release', '--test', 'userscripts/images.svg'], '/mock-checkout'), (['echo', 'rebaseline-test-internal', '--suffixes', 'png', '--builder', 'WebKit Mac10.8', '--test', 'userscripts/images.svg'], '/mock-checkout'), (['echo', 'rebaseline-test-internal', '--suffixes', 'png', '--builder', 'GTK Linux 64-bit Release', '--test', 'userscripts/images.svg'], '/mock-checkout'), (['echo', 'rebaseline-test-internal', '--suffixes', 'png', '--builder', 'Qt Linux Release', '--test', 'userscripts/images.svg'], '/mock-checkout'), (['echo', 'rebaseline-test-internal', '--suffixes', 'png', '--builder', 'Apple Lion Release WK1 (Tests)', '--test', 'userscripts/images.svg'], '/mock-checkout'), (['echo', 'rebaseline-test-internal', '--suffixes', 'png', '--builder', 'WebKit XP', '--test', 'userscripts/images.svg'], '/mock-checkout'), (['echo', 'rebaseline-test-internal', '--suffixes', 'png', '--builder', 'Apple MountainLion Release WK1 (Tests)', '--test', 'userscripts/images.svg'], '/mock-checkout')]\n"
-
-        expected_stderr = """MOCK run_command: ['qmake', '-v'], cwd=None
-MOCK run_command: ['qmake', '-v'], cwd=None
-MOCK run_command: ['qmake', '-v'], cwd=None
-MOCK run_command: ['qmake', '-v'], cwd=None
-MOCK run_command: ['qmake', '-v'], cwd=None
-MOCK run_command: ['qmake', '-v'], cwd=None
-"""
-
-        command._tests_to_rebaseline = lambda port: {'userscripts/another-test.html': set(['txt']), 'userscripts/images.svg': set(['png'])}
-        OutputCapture().assert_outputs(self, command.execute, [MockOptions(optimize=False), [], tool], expected_logs=expected_logs, expected_stdout=expected_stdout, expected_stderr=expected_stderr)
-
-        expected_stderr_with_optimize = """MOCK run_command: ['qmake', '-v'], cwd=None
-MOCK run_command: ['qmake', '-v'], cwd=None
-MOCK run_command: ['qmake', '-v'], cwd=None
-MOCK run_command: ['echo', 'optimize-baselines', '--suffixes', 'txt', 'userscripts/another-test.html'], cwd=/mock-checkout
-MOCK run_command: ['qmake', '-v'], cwd=None
-MOCK run_command: ['echo', 'optimize-baselines', '--suffixes', 'png', 'userscripts/images.svg'], cwd=/mock-checkout
-MOCK run_command: ['qmake', '-v'], cwd=None
-MOCK run_command: ['qmake', '-v'], cwd=None
-MOCK run_command: ['qmake', '-v'], cwd=None
-MOCK run_command: ['qmake', '-v'], cwd=None
-"""
-
-        command._tests_to_rebaseline = lambda port: {'userscripts/another-test.html': set(['txt']), 'userscripts/images.svg': set(['png'])}
-        OutputCapture().assert_outputs(self, command.execute, [MockOptions(optimize=True), [], tool], expected_logs=expected_logs, expected_stdout=expected_stdout, expected_stderr=expected_stderr_with_optimize)
-
-    def _assert_command(self, command, options=None, args=None, expected_stdout='', expected_stderr='', expected_logs=''):
-        # FIXME: generalize so more tests use this to get rid of boilerplate.
-        options = options or MockOptions(optimize=True, builders=None, suffixes=['txt'], verbose=False)
-        args = args or []
-
-        tool = MockTool()
-        command.bind_to_tool(tool)
-
-        port = tool.port_factory.get('chromium-mac-lion')
-
-        for port_name in tool.port_factory.all_port_names():
-            port = tool.port_factory.get(port_name)
-            for path in port.expectations_files():
-                tool.filesystem.write_text_file(path, '')
-
-        OutputCapture().assert_outputs(self, command.execute, [options, args, tool], expected_stdout=expected_stdout, expected_stderr=expected_stderr, expected_logs=expected_logs)
-
-    def test_rebaseline_expectations_noop(self):
-        self._assert_command(RebaselineExpectations(), expected_logs='Did not find any tests marked Rebaseline.\n')
-
-    def test_overrides_are_included_correctly(self):
-        command = RebaselineExpectations()
-        tool = MockTool()
-        command.bind_to_tool(tool)
-        port = tool.port_factory.get('chromium-mac-lion')
-
-        # This tests that the any tests marked as REBASELINE in the overrides are found, but
-        # that the overrides do not get written into the main file.
-        expectations_path = port.expectations_files()[0]
-        expectations_contents = ''
-        port._filesystem.write_text_file(expectations_path, expectations_contents)
-        port.expectations_dict = lambda: {
-            expectations_path: expectations_contents,
-            'overrides': ('Bug(x) userscripts/another-test.html [ Failure Rebaseline ]\n'
-                          'Bug(y) userscripts/test.html [ Crash ]\n')}
+    def test_rebaseline_test_internal_with_move_overwritten_baselines_to(self):
+        self.tool.executive = MockExecutive2()
 
-        for path in port.expectations_files():
-            port._filesystem.write_text_file(path, '')
-        port._filesystem.write_text_file(port.layout_tests_dir() + '/userscripts/another-test.html', '')
-        self.assertEquals(command._tests_to_rebaseline(port), {'userscripts/another-test.html': set(['png', 'txt', 'wav'])})
-        self.assertEquals(port._filesystem.read_text_file(expectations_path), expectations_contents)
+        # FIXME: it's confusing that this is the test- port, and not the regular lion port. Really all of the tests should be using the test ports.
+        port = self.tool.port_factory.get('test-mac-snowleopard')
+        self._write(port._filesystem.join(port.layout_tests_dir(), 'platform/test-mac-snowleopard/failures/expected/image-expected.txt'), 'original snowleopard result')
 
-    def test_rebaseline(self):
         old_exact_matches = builders._exact_matches
+        oc = OutputCapture()
         try:
             builders._exact_matches = {
-                "MOCK builder": {"port_name": "test-mac-leopard", "specifiers": set(["mock-specifier"])},
+                "MOCK Leopard": {"port_name": "test-mac-leopard", "specifiers": set(["mock-specifier"])},
+                "MOCK SnowLeopard": {"port_name": "test-mac-snowleopard", "specifiers": set(["mock-specifier"])},
             }
 
-            command = Rebaseline()
-            tool = MockTool()
-            command.bind_to_tool(tool)
-
-            for port_name in tool.port_factory.all_port_names():
-                port = tool.port_factory.get(port_name)
-                for path in port.expectations_files():
-                    tool.filesystem.write_text_file(path, '')
-
-            tool.executive = MockExecutive(should_log=True)
-
-            def mock_builders_to_pull_from():
-                return [MockBuilder('MOCK builder')]
-
-            def mock_tests_to_update(build):
-                return ['mock/path/to/test.html']
-
-            command._builders_to_pull_from = mock_builders_to_pull_from
-            command._tests_to_update = mock_tests_to_update
-
-            expected_stdout = """rebaseline-json: {'mock/path/to/test.html': {'MOCK builder': ['txt']}}
-"""
-
-            expected_stderr = """MOCK run_command: ['echo', 'rebaseline-test-internal', '--suffixes', 'txt', '--builder', 'MOCK builder', '--test', 'mock/path/to/test.html'], cwd=/mock-checkout
-MOCK run_command: ['echo', 'optimize-baselines', '--suffixes', 'txt', 'mock/path/to/test.html'], cwd=/mock-checkout
-"""
-
-            OutputCapture().assert_outputs(self, command.execute, [MockOptions(optimize=True, builders=None, suffixes=["txt"], verbose=True), [], tool], expected_stdout=expected_stdout, expected_stderr=expected_stderr)
+            options = MockOptions(optimize=True, builder="MOCK SnowLeopard", suffixes="txt",
+                move_overwritten_baselines_to=["test-mac-leopard"], verbose=True, test="failures/expected/image.html",
+                results_directory=None)
 
+            oc.capture_output()
+            self.command.execute(options, [], self.tool)
         finally:
+            out, _, _ = oc.restore_output()
             builders._exact_matches = old_exact_matches
 
-    def test_rebaseline_command_line_flags(self):
-        old_exact_matches = builders._exact_matches
-        try:
-            builders._exact_matches = {
-                "MOCK builder": {"port_name": "test-mac-leopard", "specifiers": set(["mock-specifier"])},
-            }
+        self.assertEquals(self._read(self.tool.filesystem.join(port.layout_tests_dir(), 'platform/test-mac-leopard/failures/expected/image-expected.txt')), 'original snowleopard result')
+        self.assertEquals(out, '{"add": []}\n')
 
-            command = Rebaseline()
-            tool = MockTool()
-            command.bind_to_tool(tool)
 
-            for port_name in tool.port_factory.all_port_names():
-                port = tool.port_factory.get(port_name)
-                for path in port.expectations_files():
-                    tool.filesystem.write_text_file(path, '')
+class TestRebaselineJson(_BaseTestCase):
+    command_constructor = RebaselineJson
 
-            tool.executive = MockExecutive(should_log=True)
+    def setUp(self):
+        super(TestRebaselineJson, self).setUp()
+        self.tool.executive = MockExecutive2()
+        self.old_exact_matches = builders._exact_matches
+        builders._exact_matches = {
+            "MOCK builder": {"port_name": "test-mac-snowleopard", "specifiers": set(["mock-specifier"]),
+                             "move_overwritten_baselines_to": ["test-mac-leopard"]},
+            "MOCK builder (Debug)": {"port_name": "test-mac-snowleopard", "specifiers": set(["mock-specifier", "debug"])},
+        }
 
-            expected_stdout = """rebaseline-json: {'mock/path/to/test.html': {'MOCK builder': ['txt']}}
-"""
+    def tearDown(self):
+        builders._exact_matches = self.old_exact_matches
+        super(TestRebaselineJson, self).tearDown()
 
-            expected_stderr = """MOCK run_command: ['echo', 'rebaseline-test-internal', '--suffixes', 'txt', '--builder', 'MOCK builder', '--test', 'mock/path/to/test.html'], cwd=/mock-checkout
-MOCK run_command: ['echo', 'optimize-baselines', '--suffixes', 'txt', 'mock/path/to/test.html'], cwd=/mock-checkout
-"""
+    def test_rebaseline_all(self):
+        options = MockOptions(optimize=True, verbose=True, move_overwritten_baselines=False, results_directory=None)
+        self.command._rebaseline(options,  {"user-scripts/another-test.html": {"MOCK builder": ["txt", "png"]}})
 
-            builder = "MOCK builder"
-            test = "mock/path/to/test.html"
-            OutputCapture().assert_outputs(self, command.execute, [MockOptions(optimize=True, builders=[builder], suffixes=["txt"], verbose=True), [test], tool], expected_stdout=expected_stdout, expected_stderr=expected_stderr)
+        # Note that we have one run_in_parallel() call followed by a run_command()
+        self.assertEquals(self.tool.executive.calls,
+            [[['echo', 'rebaseline-test-internal', '--suffixes', 'txt,png', '--builder', 'MOCK builder', '--test', 'user-scripts/another-test.html', '--verbose']],
+             ['echo', '--verbose', 'optimize-baselines', '--suffixes', 'txt,png', 'user-scripts/another-test.html']])
 
-        finally:
-            builders._exact_matches = old_exact_matches
+    def test_rebaseline_debug(self):
+        options = MockOptions(optimize=True, verbose=True, move_overwritten_baselines=False, results_directory=None)
+        self.command._rebaseline(options,  {"user-scripts/another-test.html": {"MOCK builder (Debug)": ["txt", "png"]}})
 
-    def test_rebaseline_multiple_builders(self):
-        old_exact_matches = builders._exact_matches
-        try:
-            builders._exact_matches = {
-                "MOCK builder": {"port_name": "test-mac-leopard", "specifiers": set(["mock-specifier"])},
-                "MOCK builder2": {"port_name": "test-mac-snowleopard", "specifiers": set(["mock-specifier2"])},
-            }
+        # Note that we have one run_in_parallel() call followed by a run_command()
+        self.assertEquals(self.tool.executive.calls,
+            [[['echo', 'rebaseline-test-internal', '--suffixes', 'txt,png', '--builder', 'MOCK builder (Debug)', '--test', 'user-scripts/another-test.html', '--verbose']],
+             ['echo', '--verbose', 'optimize-baselines', '--suffixes', 'txt,png', 'user-scripts/another-test.html']])
 
-            command = Rebaseline()
-            tool = MockTool()
-            command.bind_to_tool(tool)
+    def test_move_overwritten(self):
+        options = MockOptions(optimize=True, verbose=True, move_overwritten_baselines=True, results_directory=None)
+        self.command._rebaseline(options,  {"user-scripts/another-test.html": {"MOCK builder": ["txt", "png"]}})
 
-            for port_name in tool.port_factory.all_port_names():
-                port = tool.port_factory.get(port_name)
-                for path in port.expectations_files():
-                    tool.filesystem.write_text_file(path, '')
+        # Note that we have one run_in_parallel() call followed by a run_command()
+        self.assertEquals(self.tool.executive.calls,
+            [[['echo', 'rebaseline-test-internal', '--suffixes', 'txt,png', '--builder', 'MOCK builder', '--test', 'user-scripts/another-test.html', '--move-overwritten-baselines-to', 'test-mac-leopard', '--verbose']],
+             ['echo', '--verbose', 'optimize-baselines', '--suffixes', 'txt,png', 'user-scripts/another-test.html']])
 
-            tool.executive = MockExecutive(should_log=True)
+    def test_no_optimize(self):
+        options = MockOptions(optimize=False, verbose=True, move_overwritten_baselines=False, results_directory=None)
+        self.command._rebaseline(options,  {"user-scripts/another-test.html": {"MOCK builder (Debug)": ["txt", "png"]}})
 
-            def mock_builders_to_pull_from():
-                return [MockBuilder('MOCK builder'), MockBuilder('MOCK builder2')]
+        # Note that we have only one run_in_parallel() call
+        self.assertEquals(self.tool.executive.calls,
+            [[['echo', 'rebaseline-test-internal', '--suffixes', 'txt,png', '--builder', 'MOCK builder (Debug)', '--test', 'user-scripts/another-test.html', '--verbose']]])
 
-            def mock_tests_to_update(build):
-                return ['mock/path/to/test.html']
+    def test_results_directory(self):
+        options = MockOptions(optimize=False, verbose=True, move_overwritten_baselines=False, results_directory='/tmp')
+        self.command._rebaseline(options,  {"user-scripts/another-test.html": {"MOCK builder": ["txt", "png"]}})
 
-            command._builders_to_pull_from = mock_builders_to_pull_from
-            command._tests_to_update = mock_tests_to_update
+        # Note that we have only one run_in_parallel() call
+        self.assertEquals(self.tool.executive.calls,
+            [[['echo', 'rebaseline-test-internal', '--suffixes', 'txt,png', '--builder', 'MOCK builder', '--test', 'user-scripts/another-test.html', '--results-directory', '/tmp', '--verbose']]])
 
-            expected_stdout = """rebaseline-json: {'mock/path/to/test.html': {'MOCK builder2': ['txt'], 'MOCK builder': ['txt']}}
-"""
 
-            expected_stderr = """MOCK run_command: ['echo', 'rebaseline-test-internal', '--suffixes', 'txt', '--builder', 'MOCK builder2', '--test', 'mock/path/to/test.html'], cwd=/mock-checkout
-MOCK run_command: ['echo', 'rebaseline-test-internal', '--suffixes', 'txt', '--builder', 'MOCK builder', '--test', 'mock/path/to/test.html'], cwd=/mock-checkout
-MOCK run_command: ['echo', 'optimize-baselines', '--suffixes', 'txt', 'mock/path/to/test.html'], cwd=/mock-checkout
-"""
+class TestRebaseline(_BaseTestCase):
+    # This command shares most of its logic with RebaselineJson, so these tests just test what is different.
 
-            OutputCapture().assert_outputs(self, command.execute, [MockOptions(optimize=True, builders=None, suffixes=["txt"], verbose=True), [], tool], expected_stdout=expected_stdout, expected_stderr=expected_stderr)
+    command_constructor = Rebaseline  # AKA webkit-patch rebaseline
 
-        finally:
-            builders._exact_matches = old_exact_matches
+    def test_tests_to_update(self):
+        build = Mock()
+        OutputCapture().assert_outputs(self, self.command._tests_to_update, [build])
+
+    def test_rebaseline(self):
+        self.command._builders_to_pull_from = lambda: [MockBuilder('MOCK builder')]
+        self.command._tests_to_update = lambda builder: ['mock/path/to/test.html']
+
+        self._zero_out_test_expectations()
 
-    def test_rebaseline_multiple_builders_and_tests_command_line(self):
         old_exact_matches = builders._exact_matches
+        oc = OutputCapture()
         try:
             builders._exact_matches = {
                 "MOCK builder": {"port_name": "test-mac-leopard", "specifiers": set(["mock-specifier"])},
-                "MOCK builder2": {"port_name": "test-mac-snowleopard", "specifiers": set(["mock-specifier2"])},
-                "MOCK builder3": {"port_name": "test-mac-snowleopard", "specifiers": set(["mock-specifier2"])},
             }
-
-            command = Rebaseline()
-            tool = MockTool()
-            command.bind_to_tool(tool)
-
-            for port_name in tool.port_factory.all_port_names():
-                port = tool.port_factory.get(port_name)
-                for path in port.expectations_files():
-                    tool.filesystem.write_text_file(path, '')
-
-            tool.executive = MockExecutive(should_log=True)
-
-            expected_stdout = """rebaseline-json: {'mock/path/to/test.html': {'MOCK builder2': ['wav', 'txt', 'png'], 'MOCK builder': ['wav', 'txt', 'png'], 'MOCK builder3': ['wav', 'txt', 'png']}, 'mock/path/to/test2.html': {'MOCK builder2': ['wav', 'txt', 'png'], 'MOCK builder': ['wav', 'txt', 'png'], 'MOCK builder3': ['wav', 'txt', 'png']}}
-"""
-
-            expected_stderr = """MOCK run_command: ['echo', 'rebaseline-test-internal', '--suffixes', 'wav,txt,png', '--builder', 'MOCK builder2', '--test', 'mock/path/to/test.html'], cwd=/mock-checkout
-MOCK run_command: ['echo', 'rebaseline-test-internal', '--suffixes', 'wav,txt,png', '--builder', 'MOCK builder', '--test', 'mock/path/to/test.html'], cwd=/mock-checkout
-MOCK run_command: ['echo', 'rebaseline-test-internal', '--suffixes', 'wav,txt,png', '--builder', 'MOCK builder2', '--test', 'mock/path/to/test2.html'], cwd=/mock-checkout
-MOCK run_command: ['echo', 'rebaseline-test-internal', '--suffixes', 'wav,txt,png', '--builder', 'MOCK builder', '--test', 'mock/path/to/test2.html'], cwd=/mock-checkout
-MOCK run_command: ['echo', 'optimize-baselines', '--suffixes', 'wav,txt,png', 'mock/path/to/test.html'], cwd=/mock-checkout
-MOCK run_command: ['echo', 'optimize-baselines', '--suffixes', 'wav,txt,png', 'mock/path/to/test2.html'], cwd=/mock-checkout
-"""
-
-            OutputCapture().assert_outputs(self, command.execute, [MockOptions(optimize=True, builders=["MOCK builder,MOCK builder2", "MOCK builder3"], suffixes=["txt,png", "png,wav,txt"], verbose=True), ["mock/path/to/test.html", "mock/path/to/test2.html"], tool], expected_stdout=expected_stdout, expected_stderr=expected_stderr)
-
+            oc.capture_output()
+            self.command.execute(MockOptions(optimize=False, builders=None, suffixes="txt,png", verbose=True, move_overwritten_baselines=False), [], self.tool)
         finally:
+            oc.restore_output()
             builders._exact_matches = old_exact_matches
 
-    def test_rebaseline_json_with_move_overwritten_baselines_to(self):
-        old_exact_matches = builders._exact_matches
-        try:
-            builders._exact_matches = {
-                "MOCK builder": {"port_name": "test-mac-leopard", "specifiers": set(["mock-specifier"])},
-                "MOCK builder2": {"port_name": "test-mac-snowleopard", "specifiers": set(["mock-specifier2"]),
-                                  "move_overwritten_baselines_to": ["test-mac-leopard"]},
-            }
+        calls = filter(lambda x: x != ['qmake', '-v'] and x[0] != 'perl', self.tool.executive.calls)
+        self.assertEquals(calls,
+            [[['echo', 'rebaseline-test-internal', '--suffixes', 'txt,png', '--builder', 'MOCK builder', '--test', 'mock/path/to/test.html', '--verbose']]])
 
-            command = Rebaseline()
-            tool = MockTool()
-            tool.executive = MockExecutive(should_log=True)
-            command.bind_to_tool(tool)
 
-            expected_stdout = """rebaseline-json: {'mock/path/to/test.html': {'MOCK builder2': ['txt', 'png']}}\n"""
-            expected_stderr = """MOCK run_command: ['echo', 'rebaseline-test-internal', '--suffixes', 'txt,png', '--builder', 'MOCK builder2', '--test', 'mock/path/to/test.html', '--move-overwritten-baselines-to', 'test-mac-leopard'], cwd=/mock-checkout
-MOCK run_command: ['echo', 'optimize-baselines', '--suffixes', 'txt,png', 'mock/path/to/test.html'], cwd=/mock-checkout
-"""
+class TestRebaselineExpectations(_BaseTestCase):
+    command_constructor = RebaselineExpectations
 
-            options = MockOptions(optimize=True, builders=["MOCK builder2"], suffixes=["txt,png"], verbose=True)
-            OutputCapture().assert_outputs(self, command.execute, [options, ["mock/path/to/test.html"], tool],
-                expected_stdout=expected_stdout, expected_stderr=expected_stderr)
-        finally:
-            builders._exact_matches = old_exact_matches
+    def setUp(self):
+        super(TestRebaselineExpectations, self).setUp()
+        self.options = MockOptions(optimize=False, builders=None, suffixes=['txt'], verbose=False, platform=None,
+                                   move_overwritten_baselines=False, results_directory=None)
 
-    def test_rebaseline_test_internal_with_move_overwritten_baselines_to(self):
-        old_exact_matches = builders._exact_matches
-        try:
-            builders._exact_matches = {
-                "MOCK Leopard": {"port_name": "test-mac-leopard", "specifiers": set(["mock-specifier"])},
-                "MOCK SnowLeopard": {"port_name": "test-mac-snowleopard", "specifiers": set(["mock-specifier"])},
-            }
+    def test_rebaseline_expectations(self):
+        self._zero_out_test_expectations()
 
-            command = RebaselineTest()
-            tool = MockTool()
-            tool.executive = MockExecutive(should_log=True)
-            command.bind_to_tool(tool)
+        self.tool.executive = MockExecutive2()
 
-            port = tool.port_factory.get('test-mac-snowleopard')
-            tool.filesystem.write_text_file(tool.filesystem.join(port.baseline_version_dir(), 'failures', 'expected', 'image-expected.txt'), '')
+        self.command._tests_to_rebaseline = lambda port: {'userscripts/another-test.html': set(['txt']), 'userscripts/images.svg': set(['png'])}
+        self.command.execute(self.options, [], self.tool)
 
-            options = MockOptions(optimize=True, builder="MOCK SnowLeopard", suffixes="txt",
-                move_overwritten_baselines_to=["test-mac-leopard"], verbose=True, test="failures/expected/image.html")
+        # FIXME: change this to use the test- ports.
+        calls = filter(lambda x: x != ['qmake', '-v'], self.tool.executive.calls)
+        self.assertTrue(len(calls) == 1)
+        self.assertTrue(len(calls[0]) == 26)
+
+    def test_rebaseline_expectations_noop(self):
+        self._zero_out_test_expectations()
 
-            oc = OutputCapture()
+        oc = OutputCapture()
+        try:
             oc.capture_output()
-            try:
-                logs = ''
-                command.execute(options, [], tool)
-            finally:
-                _, _, logs = oc.restore_output()
+            self.command.execute(self.options, [], self.tool)
+        finally:
+            _, _, logs = oc.restore_output()
+            self.assertEquals(self.tool.filesystem.written_files, {})
+            self.assertEquals(logs, 'Did not find any tests marked Rebaseline.\n')
 
-            self.assertTrue("Copying baseline from /test.checkout/LayoutTests/platform/test-mac-snowleopard/failures/expected/image-expected.txt to /test.checkout/LayoutTests/platform/test-mac-leopard/failures/expected/image-expected.txt.\n" in logs)
+    def disabled_test_overrides_are_included_correctly(self):
+        # This tests that the any tests marked as REBASELINE in the overrides are found, but
+        # that the overrides do not get written into the main file.
+        self._zero_out_test_expectations()
 
-        finally:
-            builders._exact_matches = old_exact_matches
+        self._write(self.lion_expectations_path, '')
+        self.lion_port.expectations_dict = lambda: {
+            self.lion_expectations_path: '',
+            'overrides': ('Bug(x) userscripts/another-test.html [ Failure Rebaseline ]\n'
+                          'Bug(y) userscripts/test.html [ Crash ]\n')}
+        self._write('/userscripts/another-test.html', '')
+
+        self.assertEquals(self.command._tests_to_rebaseline(self.lion_port), {'userscripts/another-test.html': set(['png', 'txt', 'wav'])})
+        self.assertEquals(self._read(self.lion_expectations_path), '')
+
+
+class _FakeOptimizer(BaselineOptimizer):
+    def read_results_by_directory(self, baseline_name):
+        if baseline_name.endswith('txt'):
+            return {'LayoutTests/passes/text.html': '123456',
+                    'LayoutTests/platform/test-mac-leopard/passes/text.html': 'abcdef'}
+        return {}
+
+
+class TestAnalyzeBaselines(_BaseTestCase):
+    command_constructor = AnalyzeBaselines
+
+    def setUp(self):
+        super(TestAnalyzeBaselines, self).setUp()
+        self.port = self.tool.port_factory.get('test')
+        self.tool.port_factory.get = (lambda port_name=None, options=None: self.port)
+        self.lines = []
+        self.command._optimizer_class = _FakeOptimizer
+        self.command._write = (lambda msg: self.lines.append(msg))  # pylint bug warning about unnecessary lambda? pylint: disable-msg=W0108
+
+    def test_default(self):
+        self.command.execute(MockOptions(suffixes='txt', missing=False, platform=None), ['passes/text.html'], self.tool)
+        self.assertEquals(self.lines,
+            ['passes/text-expected.txt:',
+             '  (generic): 123456',
+             '  test-mac-leopard: abcdef'])
+
+    def test_missing_baselines(self):
+        self.command.execute(MockOptions(suffixes='png,txt', missing=True, platform=None), ['passes/text.html'], self.tool)
+        self.assertEquals(self.lines,
+            ['passes/text-expected.png: (no baselines found)',
+             'passes/text-expected.txt:',
+             '  (generic): 123456',
+             '  test-mac-leopard: abcdef'])
diff --git a/Tools/Scripts/webkitpy/tool/servers/gardeningserver.py b/Tools/Scripts/webkitpy/tool/servers/gardeningserver.py
index 817d92058..e57aff119 100644
--- a/Tools/Scripts/webkitpy/tool/servers/gardeningserver.py
+++ b/Tools/Scripts/webkitpy/tool/servers/gardeningserver.py
@@ -26,6 +26,8 @@ import BaseHTTPServer
 import logging
 import json
 import os
+import sys
+import urllib
 
 from webkitpy.common.memoized import memoized
 from webkitpy.tool.servers.reflectionhandler import ReflectionHandler
@@ -54,10 +56,13 @@ class GardeningHTTPServer(BaseHTTPServer.HTTPServer):
     def __init__(self, httpd_port, config):
         server_name = ''
         self.tool = config['tool']
+        self.options = config['options']
         BaseHTTPServer.HTTPServer.__init__(self, (server_name, httpd_port), GardeningHTTPRequestHandler)
 
-    def url(self):
-        return 'file://' + os.path.join(GardeningHTTPRequestHandler.STATIC_FILE_DIRECTORY, 'garden-o-matic.html')
+    def url(self, args=None):
+        # We can't use urllib.encode() here because that encodes spaces as plus signs and the buildbots don't decode those properly.
+        arg_string = ('?' + '&'.join("%s=%s" % (key, urllib.quote(value)) for (key, value) in args.items())) if args else ''
+        return 'file://' + os.path.join(GardeningHTTPRequestHandler.STATIC_FILE_DIRECTORY, 'garden-o-matic.html' + arg_string)
 
 
 class GardeningHTTPRequestHandler(ReflectionHandler):
@@ -75,6 +80,7 @@ class GardeningHTTPRequestHandler(ReflectionHandler):
         'TestFailures')
 
     allow_cross_origin_requests = True
+    debug_output = ''
 
     def _run_webkit_patch(self, args):
         return self.server.tool.executive.run_command([self.server.tool.path()] + args, cwd=self.server.tool.scm().checkout_root)
@@ -94,13 +100,45 @@ class GardeningHTTPRequestHandler(ReflectionHandler):
     def ping(self):
         self._serve_text('pong')
 
+    def _run_webkit_patch(self, command, input_string):
+        PIPE = self.server.tool.executive.PIPE
+        process = self.server.tool.executive.popen([self.server.tool.path()] + command, cwd=self.server.tool.scm().checkout_root, stdin=PIPE, stdout=PIPE, stderr=PIPE)
+        process.stdin.write(input_string)
+        output, error = process.communicate()
+        return (process.returncode, output, error)
+
     def rebaselineall(self):
         command = ['rebaseline-json']
+        if self.server.options.move_overwritten_baselines:
+            command.append('--move-overwritten-baselines')
+        if self.server.options.results_directory:
+            command.extend(['--results-directory', self.server.options.results_directory])
+        if not self.server.options.optimize:
+            command.append('--no-optimize')
+        if self.server.options.verbose:
+            command.append('--verbose')
         json_input = self.read_entity_body()
-        _log.debug("rebaselining using '%s'" % json_input)
 
-        def error_handler(script_error):
-            _log.error("error from rebaseline-json: %s, input='%s', output='%s'" % (str(script_error), json_input, script_error.output))
+        _log.debug("calling %s, input='%s'", command, json_input)
+        return_code, output, error = self._run_webkit_patch(command, json_input)
+        print >> sys.stderr, error
+        if return_code:
+            _log.error("rebaseline-json failed: %d, output='%s'" % (return_code, output))
+        else:
+            _log.debug("rebaseline-json succeeded")
 
-        self.server.tool.executive.run_command([self.server.tool.path()] + command, input=json_input, cwd=self.server.tool.scm().checkout_root, return_stderr=True, error_handler=error_handler)
+        # FIXME: propagate error and/or log messages back to the UI.
         self._serve_text('success')
+
+    def localresult(self):
+        path = self.query['path'][0]
+        filesystem = self.server.tool.filesystem
+
+        # Ensure that we're only serving files from inside the results directory.
+        if not filesystem.isabs(path) and self.server.options.results_directory:
+            fullpath = filesystem.abspath(filesystem.join(self.server.options.results_directory, path))
+            if fullpath.startswith(filesystem.abspath(self.server.options.results_directory)):
+                self._serve_file(fullpath, headers_only=(self.command == 'HEAD'))
+                return
+
+        self._send_response(403)
diff --git a/Tools/Scripts/webkitpy/tool/servers/gardeningserver_unittest.py b/Tools/Scripts/webkitpy/tool/servers/gardeningserver_unittest.py
index a2f3fabc8..9961648de 100644
--- a/Tools/Scripts/webkitpy/tool/servers/gardeningserver_unittest.py
+++ b/Tools/Scripts/webkitpy/tool/servers/gardeningserver_unittest.py
@@ -101,12 +101,12 @@ class GardeningServerTest(unittest.TestCase):
         handler.body = body
         OutputCapture().assert_outputs(self, handler.do_POST, expected_stderr=expected_stderr, expected_stdout=expected_stdout)
 
-    def test_rollout(self):
+    def disabled_test_rollout(self):
         expected_stderr = "MOCK run_command: ['echo', 'rollout', '--force-clean', '--non-interactive', '2314', 'MOCK rollout reason'], cwd=/mock-checkout\n"
         expected_stdout = "== Begin Response ==\nsuccess\n== End Response ==\n"
         self._post_to_path("/rollout?revision=2314&reason=MOCK+rollout+reason", expected_stderr=expected_stderr, expected_stdout=expected_stdout)
 
-    def test_rebaselineall(self):
+    def disabled_test_rebaselineall(self):
         expected_stderr = "MOCK run_command: ['echo', 'rebaseline-json'], cwd=/mock-checkout, input={\"user-scripts/another-test.html\":{\"%s\": [%s]}}\n"
         expected_stdout = "== Begin Response ==\nsuccess\n== End Response ==\n"
         server = MockServer()
diff --git a/Tools/Scripts/webkitpy/tool/servers/reflectionhandler.py b/Tools/Scripts/webkitpy/tool/servers/reflectionhandler.py
index 24bb2771a..930870961 100644
--- a/Tools/Scripts/webkitpy/tool/servers/reflectionhandler.py
+++ b/Tools/Scripts/webkitpy/tool/servers/reflectionhandler.py
@@ -59,6 +59,9 @@ class ReflectionHandler(BaseHTTPServer.BaseHTTPRequestHandler):
     def do_POST(self):
         self._handle_request()
 
+    def do_HEAD(self):
+        self._handle_request()
+
     def read_entity_body(self):
         length = int(self.headers.getheader('content-length'))
         return self.rfile.read(length)
@@ -116,7 +119,7 @@ class ReflectionHandler(BaseHTTPServer.BaseHTTPRequestHandler):
         self.end_headers()
         json.dump(json_object, self.wfile)
 
-    def _serve_file(self, file_path, cacheable_seconds=0):
+    def _serve_file(self, file_path, cacheable_seconds=0, headers_only=False):
         if not os.path.exists(file_path):
             self.send_error(404, "File not found")
             return
@@ -136,4 +139,5 @@ class ReflectionHandler(BaseHTTPServer.BaseHTTPRequestHandler):
                 self.send_header("Expires", expires_formatted)
             self.end_headers()
 
-            shutil.copyfileobj(static_file, self.wfile)
+            if not headers_only:
+                shutil.copyfileobj(static_file, self.wfile)
diff --git a/Tools/TestWebKitAPI/CMakeLists.txt b/Tools/TestWebKitAPI/CMakeLists.txt
index c4e427e1d..163edc753 100644
--- a/Tools/TestWebKitAPI/CMakeLists.txt
+++ b/Tools/TestWebKitAPI/CMakeLists.txt
@@ -84,6 +84,7 @@ ADD_EXECUTABLE(test_wtf
     ${TESTWEBKITAPI_DIR}/Tests/WTF/Vector.cpp
     ${TESTWEBKITAPI_DIR}/Tests/WTF/VectorBasic.cpp
     ${TESTWEBKITAPI_DIR}/Tests/WTF/VectorReverse.cpp
+    ${TESTWEBKITAPI_DIR}/Tests/WTF/WTFString.cpp
 )
 
 TARGET_LINK_LIBRARIES(test_wtf ${test_wtf_LIBRARIES})
diff --git a/Tools/TestWebKitAPI/Configurations/Base.xcconfig b/Tools/TestWebKitAPI/Configurations/Base.xcconfig
index 412c440d9..1e029d4eb 100644
--- a/Tools/TestWebKitAPI/Configurations/Base.xcconfig
+++ b/Tools/TestWebKitAPI/Configurations/Base.xcconfig
@@ -21,8 +21,8 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-#include "CompilerVersion.xcconfig"
-
+CLANG_CXX_LANGUAGE_STANDARD = gnu++0x;
+CLANG_CXX_LIBRARY = libc++;
 CLANG_WARN_CXX0X_EXTENSIONS = NO;
 HEADER_SEARCH_PATHS = ${BUILT_PRODUCTS_DIR}/usr/local/include $(WEBCORE_PRIVATE_HEADERS_DIR)/ForwardingHeaders $(WEBCORE_PRIVATE_HEADERS_DIR)/icu;
 FRAMEWORK_SEARCH_PATHS = $(SYSTEM_LIBRARY_DIR)/Frameworks/Quartz.framework/Frameworks $(SYSTEM_LIBRARY_DIR)/Frameworks/ApplicationServices.framework/Frameworks $(SYSTEM_LIBRARY_DIR)/Frameworks/CoreServices.framework/Frameworks;
@@ -34,6 +34,7 @@ GCC_ENABLE_CPP_EXCEPTIONS = NO;
 GCC_ENABLE_CPP_RTTI = NO;
 GCC_PRECOMPILE_PREFIX_HEADER = YES
 GCC_TREAT_WARNINGS_AS_ERRORS = YES
+GCC_VERSION = com.apple.compilers.llvm.clang.1_0;
 GCC_WARN_ABOUT_DEPRECATED_FUNCTIONS = NO
 GCC_WARN_UNUSED_FUNCTION = YES
 GCC_WARN_UNUSED_VARIABLE = YES
@@ -41,12 +42,6 @@ WARNING_CFLAGS = -Wall -W -Wno-unused-parameter
 LINKER_DISPLAYS_MANGLED_NAMES = YES;
 VALID_ARCHS = i386 x86_64;
 
-CLANG_CXX_LIBRARY = $(CLANG_CXX_LIBRARY_$(TARGET_MAC_OS_X_VERSION_MAJOR));
-CLANG_CXX_LIBRARY_1060 = libstdc++;
-CLANG_CXX_LIBRARY_1070 = libc++;
-CLANG_CXX_LIBRARY_1080 = libc++;
-CLANG_CXX_LIBRARY_1090 = libc++;
-
 // DEBUG_DEFINES, GCC_OPTIMIZATION_LEVEL, STRIP_INSTALLED_PRODUCT and DEAD_CODE_STRIPPING vary between the debug and normal variants.
 // We set up the values for each variant here, and have the Debug configuration in the Xcode project use the _debug variant.
 DEBUG_DEFINES_debug = ;
@@ -54,17 +49,10 @@ DEBUG_DEFINES_normal = NDEBUG;
 DEBUG_DEFINES = $(DEBUG_DEFINES_$(CURRENT_VARIANT));
 
 
-REAL_PLATFORM_NAME = $(REAL_PLATFORM_NAME_$(PLATFORM_NAME));
-REAL_PLATFORM_NAME_ = $(REAL_PLATFORM_NAME_macosx);
-REAL_PLATFORM_NAME_iphoneos = iphoneos;
-REAL_PLATFORM_NAME_iphonesimulator = iphonesimulator;
-REAL_PLATFORM_NAME_macosx = macosx;
-
 TARGET_MAC_OS_X_VERSION_MAJOR = $(MAC_OS_X_VERSION_MAJOR);
 
 
 TARGETING_SAME_OS_X_VERSION = $(TARGETING_SAME_OS_X_VERSION_$(MAC_OS_X_VERSION_MAJOR)_$(TARGET_MAC_OS_X_VERSION_MAJOR));
-TARGETING_SAME_OS_X_VERSION_1060_1060 = YES;
 TARGETING_SAME_OS_X_VERSION_1070_1070 = YES;
 TARGETING_SAME_OS_X_VERSION_1080_1080 = YES;
 TARGETING_SAME_OS_X_VERSION_1090_1090 = YES;
diff --git a/Tools/TestWebKitAPI/Configurations/CompilerVersion.xcconfig b/Tools/TestWebKitAPI/Configurations/CompilerVersion.xcconfig
deleted file mode 100644
index a8c7f75a0..000000000
--- a/Tools/TestWebKitAPI/Configurations/CompilerVersion.xcconfig
+++ /dev/null
@@ -1,84 +0,0 @@
-// Copyright (C) 2009, 2010, 2011 Apple Inc. All rights reserved.
-//
-// Redistribution and use in source and binary forms, with or without
-// modification, are permitted provided that the following conditions
-// are met:
-// 1. Redistributions of source code must retain the above copyright
-//    notice, this list of conditions and the following disclaimer.
-// 2. Redistributions in binary form must reproduce the above copyright
-//    notice, this list of conditions and the following disclaimer in the
-//    documentation and/or other materials provided with the distribution.
-//
-// THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
-// EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
-// IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
-// PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
-// CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
-// EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
-// PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
-// PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
-// OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
-
-IS_XCODE_0400 = $(IS_XCODE_0400_$(XCODE_VERSION_MINOR));
-IS_XCODE_0400_0400 = YES;
-
-IS_XCODE_0400_OR_0410 = $(IS_XCODE_0400_OR_0410_$(XCODE_VERSION_MINOR));
-IS_XCODE_0400_OR_0410_0400 = YES;
-IS_XCODE_0400_OR_0410_0410 = YES;
-
-// The version of the LLVM Compiler in Xcode 4.0 and earlier have difficulty compiling our code.
-LLVM_COMPILER_UNSUITABLE_FOR_DEBUG_BUILDS = $(LLVM_COMPILER_UNSUITABLE_FOR_DEBUG_BUILDS_$(XCODE_VERSION_MAJOR));
-LLVM_COMPILER_UNSUITABLE_FOR_DEBUG_BUILDS_0300 = YES;
-LLVM_COMPILER_UNSUITABLE_FOR_DEBUG_BUILDS_0400 = $(LLVM_COMPILER_UNSUITABLE_FOR_DEBUG_BUILDS_IS_XCODE_0400_$(IS_XCODE_0400));
-LLVM_COMPILER_UNSUITABLE_FOR_DEBUG_BUILDS_IS_XCODE_0400_YES = YES;
-
-// The version of the LLVM Compiler in Xcode 4.1 and earlier do not generate fast enough code.
-LLVM_COMPILER_UNSUITABLE_FOR_OPTIMIZED_BUILDS = $(LLVM_COMPILER_UNSUITABLE_FOR_OPTIMIZED_BUILDS_$(XCODE_VERSION_MAJOR));
-LLVM_COMPILER_UNSUITABLE_FOR_OPTIMIZED_BUILDS_0300 = YES;
-LLVM_COMPILER_UNSUITABLE_FOR_OPTIMIZED_BUILDS_0400 = $(LLVM_COMPILER_UNSUITABLE_FOR_OPTIMIZED_BUILDS_IS_XCODE_0400_OR_0410_$(IS_XCODE_0400_OR_0410));
-LLVM_COMPILER_UNSUITABLE_FOR_OPTIMIZED_BUILDS_IS_XCODE_0400_OR_0410_YES = YES;
-
-LLVM_COMPILER_SUITABLE_FOR_DEBUG_BUILDS = $(LLVM_COMPILER_SUITABLE_FOR_DEBUG_BUILDS_$(LLVM_COMPILER_UNSUITABLE_FOR_DEBUG_BUILDS));
-LLVM_COMPILER_SUITABLE_FOR_DEBUG_BUILDS_ = YES;
-LLVM_COMPILER_SUITABLE_FOR_DEBUG_BUILDS_YES = NO;
-
-LLVM_COMPILER_SUITABLE_FOR_OPTIMIZED_BUILDS = $(LLVM_COMPILER_SUITABLE_FOR_OPTIMIZED_BUILDS_$(LLVM_COMPILER_UNSUITABLE_FOR_OPTIMIZED_BUILDS));
-LLVM_COMPILER_SUITABLE_FOR_OPTIMIZED_BUILDS_ = YES;
-LLVM_COMPILER_SUITABLE_FOR_OPTIMIZED_BUILDS_YES = NO;
-
-
-// Use GCC 4.2 with Xcode 3.1, which includes GCC 4.2 but defaults to GCC 4.0.
-// Note that Xcode versions as new as 3.1.2 use XCODE_VERSION_ACTUAL for the minor version
-// number.  Newer versions of Xcode use XCODE_VERSION_MINOR for the minor version, and
-// XCODE_VERSION_ACTUAL for the full version number.
-TARGET_GCC_VERSION = $(TARGET_GCC_VERSION_$(REAL_PLATFORM_NAME));
-TARGET_GCC_VERSION_iphoneos = LLVM_GCC_42;
-TARGET_GCC_VERSION_iphonesimulator = GCC_42;
-TARGET_GCC_VERSION_macosx = $(TARGET_GCC_VERSION_macosx_$(TARGET_MAC_OS_X_VERSION_MAJOR));
-
-TARGET_GCC_VERSION_macosx_1050 = $(TARGET_GCC_VERSION_macosx_1050_$(XCODE_VERSION_MINOR));
-TARGET_GCC_VERSION_macosx_1050_ = $(TARGET_GCC_VERSION_macosx_1050_$(XCODE_VERSION_ACTUAL));
-TARGET_GCC_VERSION_macosx_1050_0310 = GCC_42;
-TARGET_GCC_VERSION_macosx_1050_0320 = GCC_42;
-
-TARGET_GCC_VERSION_macosx_1060 = $(TARGET_GCC_VERSION_macosx_1060_AND_1070_$(CONFIGURATION));
-TARGET_GCC_VERSION_macosx_1070 = $(TARGET_GCC_VERSION_macosx_1060_AND_1070_$(CONFIGURATION));
-TARGET_GCC_VERSION_macosx_1060_AND_1070_Debug = $(TARGET_GCC_VERSION_macosx_USE_LLVM_COMPILER_$(LLVM_COMPILER_SUITABLE_FOR_DEBUG_BUILDS));
-TARGET_GCC_VERSION_macosx_1060_AND_1070_Release = $(TARGET_GCC_VERSION_macosx_USE_LLVM_COMPILER_$(LLVM_COMPILER_SUITABLE_FOR_OPTIMIZED_BUILDS));
-TARGET_GCC_VERSION_macosx_1060_AND_1070_Production = $(TARGET_GCC_VERSION_macosx_USE_LLVM_COMPILER_$(LLVM_COMPILER_SUITABLE_FOR_OPTIMIZED_BUILDS));
-TARGET_GCC_VERSION_macosx_1060_NON_LLVM_FALLBACK = GCC_42;
-TARGET_GCC_VERSION_macosx_1070_NON_LLVM_FALLBACK = LLVM_GCC_42;
-
-TARGET_GCC_VERSION_macosx_USE_LLVM_COMPILER_YES = LLVM_COMPILER;
-TARGET_GCC_VERSION_macosx_USE_LLVM_COMPILER_NO = $(TARGET_GCC_VERSION_macosx_$(TARGET_MAC_OS_X_VERSION_MAJOR)_NON_LLVM_FALLBACK);
-
-TARGET_GCC_VERSION_macosx_1080 = LLVM_COMPILER;
-TARGET_GCC_VERSION_macosx_1090 = LLVM_COMPILER;
-
-GCC_VERSION = $(GCC_VERSION_$(TARGET_GCC_VERSION));
-GCC_VERSION_GCC_40 = 4.0;
-GCC_VERSION_GCC_42 = 4.2;
-GCC_VERSION_LLVM_GCC_42 = com.apple.compilers.llvmgcc42;
-GCC_VERSION_LLVM_COMPILER = com.apple.compilers.llvm.clang.1_0;
diff --git a/Tools/TestWebKitAPI/Configurations/DebugRelease.xcconfig b/Tools/TestWebKitAPI/Configurations/DebugRelease.xcconfig
index 54ad20d82..f681015b8 100644
--- a/Tools/TestWebKitAPI/Configurations/DebugRelease.xcconfig
+++ b/Tools/TestWebKitAPI/Configurations/DebugRelease.xcconfig
@@ -23,18 +23,11 @@
 
 #include "Base.xcconfig"
 
-ARCHS = $(ARCHS_$(TARGET_MAC_OS_X_VERSION_MAJOR));
-ARCHS_1050 = $(NATIVE_ARCH);
-ARCHS_1060 = $(ARCHS_STANDARD_32_64_BIT);
-ARCHS_1070 = $(ARCHS_STANDARD_32_64_BIT);
-ARCHS_1080 = $(ARCHS_STANDARD_32_64_BIT);
-ARCHS_1090 = $(ARCHS_STANDARD_32_64_BIT);
+ARCHS = $(ARCHS_STANDARD_32_64_BIT);
 
 ONLY_ACTIVE_ARCH = YES;
 
 MACOSX_DEPLOYMENT_TARGET = $(MACOSX_DEPLOYMENT_TARGET_$(TARGET_MAC_OS_X_VERSION_MAJOR))
-MACOSX_DEPLOYMENT_TARGET_1050 = 10.5;
-MACOSX_DEPLOYMENT_TARGET_1060 = 10.6;
 MACOSX_DEPLOYMENT_TARGET_1070 = 10.7;
 MACOSX_DEPLOYMENT_TARGET_1080 = 10.8;
 MACOSX_DEPLOYMENT_TARGET_1090 = 10.9;
diff --git a/Tools/TestWebKitAPI/GNUmakefile.am b/Tools/TestWebKitAPI/GNUmakefile.am
index d294d0629..759ccb9e0 100644
--- a/Tools/TestWebKitAPI/GNUmakefile.am
+++ b/Tools/TestWebKitAPI/GNUmakefile.am
@@ -24,7 +24,6 @@ Libraries_libTestWebKitAPIMain_la_CPPFLAGS = \
 	-I$(top_builddir)/DerivedSources/WebKit2/include \
 	$(global_cppflags) \
 	$(javascriptcore_cppflags) \
-	$(GLIB_CFLAGS) \
 	$(GTK_CFLAGS)
 
 noinst_PROGRAMS += \
@@ -33,17 +32,14 @@ noinst_PROGRAMS += \
 Programs_TestWebKitAPI_TestWTF_CPPFLAGS = \
 	$(Libraries_libTestWebKitAPIMain_la_CPPFLAGS) \
 	$(GLIB_LIBS) \
-	$(CAIRO_CFLAGS) \
-	$(LIBSOUP_CFLAGS)
+	$(CAIRO_CFLAGS)
 
 Programs_TestWebKitAPI_TestWTF_LDADD = \
 	Libraries/libTestWebKitAPIMain.la \
 	Libraries/libgtest.la \
 	libWTF.la \
-	$(CAIRO_LIBS) \
-	$(GLIB_LIBS) \
 	$(GTK_LIBS) \
-	$(LIBSOUP_LIBS)
+	$(GLIB_LIBS)
 
 Programs_TestWebKitAPI_TestWTF_LDFLAGS = \
 	-no-install \
@@ -77,13 +73,18 @@ Programs_TestWebKitAPI_TestGtk_CPPFLAGS = \
 	$(Programs_TestWebKitAPI_TestWTF_CPPFLAGS) \
 	$(webcore_cppflags) \
 	$(webcoregtk_cppflags) \
-	$(CAIRO_CFLAGS) \
+	$(GLIB_CFLAGS) \
+	$(GTK_CFLAGS) \
 	$(LIBSOUP_CFLAGS)
 
 Programs_TestWebKitAPI_TestGtk_LDADD = \
-	$(Programs_TestWebKitAPI_TestWTF_LDADD) \
+	Libraries/libTestWebKitAPIMain.la \
+	Libraries/libgtest.la \
 	libjavascriptcoregtk-@WEBKITGTK_API_MAJOR_VERSION@.@WEBKITGTK_API_MINOR_VERSION@.la \
-	libwebkitgtk-@WEBKITGTK_API_MAJOR_VERSION@.@WEBKITGTK_API_MINOR_VERSION@.la
+	libwebkitgtk-@WEBKITGTK_API_MAJOR_VERSION@.@WEBKITGTK_API_MINOR_VERSION@.la \
+	$(GLIB_LIBS) \
+	$(GTK_LIBS) \
+	$(LIBSOUP_LIBS)
 
 Programs_TestWebKitAPI_TestGtk_LDFLAGS = \
 	$(Programs_TestWebKitAPI_TestWTF_LDFLAGS)
@@ -102,12 +103,19 @@ noinst_PROGRAMS += \
 
 Programs_TestWebKitAPI_TestWebKit2_CPPFLAGS = \
 	$(Programs_TestWebKitAPI_TestWTF_CPPFLAGS) \
-	-I$(top_builddir)/DerivedSources/WebKit2/include
+	-I$(top_builddir)/DerivedSources/WebKit2/include \
+	$(GLIB_CFLAGS) \
+	$(GTK_CFLAGS) \
+	$(LIBSOUP_CFLAGS)
 
 Programs_TestWebKitAPI_TestWebKit2_LDADD = \
-	$(Programs_TestWebKitAPI_TestWTF_LDADD) \
+	Libraries/libTestWebKitAPIMain.la \
+	Libraries/libgtest.la \
 	libjavascriptcoregtk-@WEBKITGTK_API_MAJOR_VERSION@.@WEBKITGTK_API_MINOR_VERSION@.la \
-	libwebkit2gtk-@WEBKITGTK_API_MAJOR_VERSION@.@WEBKITGTK_API_MINOR_VERSION@.la
+	libwebkit2gtk-@WEBKITGTK_API_MAJOR_VERSION@.@WEBKITGTK_API_MINOR_VERSION@.la \
+	$(GLIB_LIBS) \
+	$(GTK_LIBS) \
+	$(LIBSOUP_LIBS)
 
 Programs_TestWebKitAPI_TestWebKit2_LDFLAGS = \
 	$(Programs_TestWebKitAPI_TestWTF_LDFLAGS)
diff --git a/Tools/TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj b/Tools/TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj
index 973a6d0fa..dc256b47d 100644
--- a/Tools/TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj
+++ b/Tools/TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj
@@ -183,6 +183,7 @@
 		F6F49C6B15545CA70007F39D /* DOMWindowExtensionNoCache_Bundle.cpp in Sources */ = {isa = PBXBuildFile; fileRef = F6F49C6615545C8D0007F39D /* DOMWindowExtensionNoCache_Bundle.cpp */; };
 		F6FDDDD314241AD4004F1729 /* PrivateBrowsingPushStateNoHistoryCallback.cpp in Sources */ = {isa = PBXBuildFile; fileRef = F6FDDDD214241AD4004F1729 /* PrivateBrowsingPushStateNoHistoryCallback.cpp */; };
 		F6FDDDD614241C6F004F1729 /* push-state.html in Copy Resources */ = {isa = PBXBuildFile; fileRef = F6FDDDD514241C48004F1729 /* push-state.html */; };
+		FE217ECD1640A54A0052988B /* VMInspector.cpp in Sources */ = {isa = PBXBuildFile; fileRef = FE217ECC1640A54A0052988B /* VMInspector.cpp */; };
 /* End PBXBuildFile section */
 
 /* Begin PBXContainerItemProxy section */
@@ -395,7 +396,6 @@
 		BCBD372E125ABBE600D2C29F /* icon.png */ = {isa = PBXFileReference; lastKnownFileType = image.png; path = icon.png; sourceTree = "<group>"; };
 		BCBD3760125ABCFE00D2C29F /* FrameMIMETypePNG.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = FrameMIMETypePNG.cpp; sourceTree = "<group>"; };
 		BCC8B95A12611F4700DE46A4 /* FailedLoad.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = FailedLoad.cpp; sourceTree = "<group>"; };
-		BCF0F9391381C25B008361AC /* CompilerVersion.xcconfig */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.xcconfig; path = CompilerVersion.xcconfig; sourceTree = "<group>"; };
 		C01363C713C3997300EF3964 /* StringOperators.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = StringOperators.cpp; path = WTF/StringOperators.cpp; sourceTree = "<group>"; };
 		C02B77F1126612140026BF0F /* SpacebarScrolling.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SpacebarScrolling.cpp; sourceTree = "<group>"; };
 		C02B7853126613AE0026BF0F /* Carbon.framework */ = {isa = PBXFileReference; explicitFileType = wrapper.framework; name = Carbon.framework; sourceTree = SDKROOT; };
@@ -439,6 +439,7 @@
 		F6F49C6715545C8D0007F39D /* DOMWindowExtensionNoCache.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = DOMWindowExtensionNoCache.cpp; sourceTree = "<group>"; };
 		F6FDDDD214241AD4004F1729 /* PrivateBrowsingPushStateNoHistoryCallback.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = PrivateBrowsingPushStateNoHistoryCallback.cpp; sourceTree = "<group>"; };
 		F6FDDDD514241C48004F1729 /* push-state.html */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.html; path = "push-state.html"; sourceTree = "<group>"; };
+		FE217ECC1640A54A0052988B /* VMInspector.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = VMInspector.cpp; sourceTree = "<group>"; };
 /* End PBXFileReference section */
 
 /* Begin PBXFrameworksBuildPhase section */
@@ -563,7 +564,6 @@
 			isa = PBXGroup;
 			children = (
 				BC90957E12554CF900083756 /* Base.xcconfig */,
-				BCF0F9391381C25B008361AC /* CompilerVersion.xcconfig */,
 				BC90957F12554CF900083756 /* DebugRelease.xcconfig */,
 				BC575AE2126E88B1006F0F12 /* InjectedBundle.xcconfig */,
 				BC90958012554CF900083756 /* TestWebKitAPI.xcconfig */,
@@ -720,6 +720,7 @@
 		BCB9EB66112366D800A137E0 /* Tests */ = {
 			isa = PBXGroup;
 			children = (
+				FE217ECB1640A54A0052988B /* JavaScriptCore */,
 				C08587F913FEC39B001EF4E5 /* TestWebKitAPI */,
 				C07E6CAD13FD67650038B22B /* mac */,
 				440A1D3614A01000008A66F2 /* WebCore */,
@@ -818,6 +819,14 @@
 			path = mac;
 			sourceTree = "<group>";
 		};
+		FE217ECB1640A54A0052988B /* JavaScriptCore */ = {
+			isa = PBXGroup;
+			children = (
+				FE217ECC1640A54A0052988B /* VMInspector.cpp */,
+			);
+			path = JavaScriptCore;
+			sourceTree = "<group>";
+		};
 /* End PBXGroup section */
 
 /* Begin PBXNativeTarget section */
@@ -1006,6 +1015,7 @@
 				2943BE86161DFEB800999E3D /* UserContentTest.mm in Sources */,
 				4F4D2C0E1626FE2700320FE1 /* MemoryInstrumentationTest.cpp in Sources */,
 				378E64731632646D00B6C676 /* InjectedBundleFrameHitTest.cpp in Sources */,
+				FE217ECD1640A54A0052988B /* VMInspector.cpp in Sources */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
diff --git a/Tools/TestWebKitAPI/Tests/JavaScriptCore/VMInspector.cpp b/Tools/TestWebKitAPI/Tests/JavaScriptCore/VMInspector.cpp
new file mode 100644
index 000000000..b1c1bacf3
--- /dev/null
+++ b/Tools/TestWebKitAPI/Tests/JavaScriptCore/VMInspector.cpp
@@ -0,0 +1,689 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#include <interpreter/VMInspector.h>
+#include <stdarg.h>
+#include <stdio.h>
+
+using namespace JSC;
+
+// There's not much we can test for the VMInspector::printf() case except to
+// make sure it does not crash. Unfortunately, we also don't want all the
+// test strings crowding out stdout. So, we forego the printf tests.
+// NOTE that the most interesting part of VMInspector::printf() is the
+// formatting functionality, and it is are already being tested by the
+// fprintf() and sprintf() cases.
+
+
+// The VMInspector::fprintf() test works by printing the string to a temp file,
+// and then reading the file content back into a buffer, which we, in turn,
+// compare against the expected string.
+
+TEST(JSC, VMInspectorFprintf)
+{
+#if ENABLE(VMINSPECTOR)
+    char actual[1024];
+    char expected[1024];
+    const char* format;
+    const char* expectedLiteral;
+    FILE* file;
+    const char* filename = "/tmp/VMInspectorFprintfTest.txt";
+    size_t size;
+
+#define OPEN_FILE(file)                         \
+    do {                                        \
+        file = fopen(filename, "w");            \
+    } while (false)
+
+#define READ_AND_CLOSE_FILE(file, actual)       \
+    do {                                        \
+        fclose(file);                           \
+        file = fopen(filename, "r");            \
+        fseek(file, 0, SEEK_END);               \
+        size = ftell(file);                     \
+        rewind(file);                           \
+        fread(actual, 1, size, file);           \
+        actual[size] = '\0';                    \
+        fclose(file);                           \
+    } while (false)
+
+    // Testing standard default format specifiers:
+    // Note: should work just like sprintf. So, we just compare against that.
+    memset(actual, 'z', sizeof(actual));
+    // The compiler warning flags are configured to expect a literal string for
+    // ::sprintf below. So, use a #define for this one case to keep the
+    // compiler happy.
+#undef LITERAL_FORMAT
+#define LITERAL_FORMAT "'%%%%'                         ==> '%%'\n"
+
+    OPEN_FILE(file);
+    VMInspector::fprintf(file, LITERAL_FORMAT);
+    READ_AND_CLOSE_FILE(file, actual);
+    ::sprintf(expected, LITERAL_FORMAT);
+
+#undef LITERAL_FORMAT
+    ASSERT_EQ(strcmp(actual, expected), 0);
+
+    memset(actual, 'z', sizeof(actual));
+    format = "'%%c', 'x'                    ==> '%c'\n";
+    OPEN_FILE(file);
+    VMInspector::fprintf(file, format, 'x');
+    READ_AND_CLOSE_FILE(file, actual);
+    ::sprintf(expected, format, 'x');
+    ASSERT_EQ(strcmp(actual, expected), 0);
+
+    memset(actual, 'z', sizeof(actual));
+    format = "'%%*c', 8, 'x'                ==> '%*c'\n";
+    OPEN_FILE(file);
+    VMInspector::fprintf(file, format, 8, 'x');
+    READ_AND_CLOSE_FILE(file, actual);
+    ::sprintf(expected, format, 8, 'x');
+    ASSERT_EQ(strcmp(actual, expected), 0);
+
+    memset(actual, 'z', sizeof(actual));
+    format = "'%%s', \"hello world\"          ==> '%s'\n";
+    OPEN_FILE(file);
+    VMInspector::fprintf(file, format, "hello world");
+    READ_AND_CLOSE_FILE(file, actual);
+    ::sprintf(expected, format, "hello world");
+    ASSERT_EQ(strcmp(actual, expected), 0);
+
+    memset(actual, 'z', sizeof(actual));
+    format = "'%%*s', 8, \"hello world\"      ==> '%*s'\n";
+    OPEN_FILE(file);
+    VMInspector::fprintf(file, format, 8, "hello world");
+    READ_AND_CLOSE_FILE(file, actual);
+    ::sprintf(expected, format, 8, "hello world");
+    ASSERT_EQ(strcmp(actual, expected), 0);
+
+    memset(actual, 'z', sizeof(actual));
+    format = "'%%*s', 8, \"hello\"            ==> '%*s'\n";
+    OPEN_FILE(file);
+    VMInspector::fprintf(file, format, 8, "hello");
+    READ_AND_CLOSE_FILE(file, actual);
+    ::sprintf(expected, format, 8, "hello");
+    ASSERT_EQ(strcmp(actual, expected), 0);
+
+    memset(actual, 'z', sizeof(actual));
+    format = "'%%d', 987654321              ==> '%d'\n";
+    OPEN_FILE(file);
+    VMInspector::fprintf(file, format, 987654321);
+    READ_AND_CLOSE_FILE(file, actual);
+    ::sprintf(expected, format, 987654321);
+    ASSERT_EQ(strcmp(actual, expected), 0);
+
+    memset(actual, 'z', sizeof(actual));
+    format = "'%%u', 4276543210u            ==> '%u'\n";
+    OPEN_FILE(file);
+    VMInspector::fprintf(file, format, 4276543210u);
+    READ_AND_CLOSE_FILE(file, actual);
+    ::sprintf(expected, format, 4276543210u);
+    ASSERT_EQ(strcmp(actual, expected), 0);
+
+    memset(actual, 'z', sizeof(actual));
+    format = "'%%u', 0xffffffff             ==> '%u'\n";
+    OPEN_FILE(file);
+    VMInspector::fprintf(file, format, 0xffffffff);
+    READ_AND_CLOSE_FILE(file, actual);
+    ::sprintf(expected, format, 0xffffffff);
+    ASSERT_EQ(strcmp(actual, expected), 0);
+
+    memset(actual, 'z', sizeof(actual));
+    format = "'%%x', 0xffffffff             ==> '%x'\n";
+    OPEN_FILE(file);
+    VMInspector::fprintf(file, format, 0xffffffff);
+    READ_AND_CLOSE_FILE(file, actual);
+    ::sprintf(expected, format, 0xffffffff);
+    ASSERT_EQ(strcmp(actual, expected), 0);
+
+    memset(actual, 'z', sizeof(actual));
+    format = "'%%p', (void*)0xabcdbabe      ==> '%p'\n";
+    OPEN_FILE(file);
+    VMInspector::fprintf(file, format, (void*)0xabcdbabe);
+    READ_AND_CLOSE_FILE(file, actual);
+    ::sprintf(expected, format, (void*)0xabcdbabe);
+    ASSERT_EQ(strcmp(actual, expected), 0);
+
+    memset(actual, 'z', sizeof(actual));
+    format = "'%%lu', 1234567890987654321ul ==> '%lu'\n";
+    OPEN_FILE(file);
+    VMInspector::fprintf(file, format, 1234567890987654321ul);
+    READ_AND_CLOSE_FILE(file, actual);
+    ::sprintf(expected, format, 1234567890987654321ul);
+    ASSERT_EQ(strcmp(actual, expected), 0);
+
+    memset(actual, 'z', sizeof(actual));
+    format = "'%%f', 1234.567               ==> '%f'\n";
+    OPEN_FILE(file);
+    VMInspector::fprintf(file, format, 1234.567);
+    READ_AND_CLOSE_FILE(file, actual);
+    ::sprintf(expected, format, 1234.567);
+    ASSERT_EQ(strcmp(actual, expected), 0);
+
+    memset(actual, 'z', sizeof(actual));
+    format = "'%%.2f', 1234.567             ==> '%.2f'\n";
+    OPEN_FILE(file);
+    VMInspector::fprintf(file, format, 1234.567);
+    READ_AND_CLOSE_FILE(file, actual);
+    ::sprintf(expected, format, 1234.567);
+    ASSERT_EQ(strcmp(actual, expected), 0);
+
+    memset(actual, 'z', sizeof(actual));
+    format = "'%%10.2f', 1234.567           ==> '%10.2f'\n";
+    OPEN_FILE(file);
+    VMInspector::fprintf(file, format, 1234.567);
+    READ_AND_CLOSE_FILE(file, actual);
+    ::sprintf(expected, format, 1234.567);
+    ASSERT_EQ(strcmp(actual, expected), 0);
+
+    memset(actual, 'z', sizeof(actual));
+    format = "'%%010.2f', 1234.567          ==> '%010.2f'\n";
+    OPEN_FILE(file);
+    VMInspector::fprintf(file, format, 1234.567);
+    READ_AND_CLOSE_FILE(file, actual);
+    ::sprintf(expected, format, 1234.567);
+    ASSERT_EQ(strcmp(actual, expected), 0);
+
+    // Bad / weird formats:
+    memset(actual, 'z', sizeof(actual));
+    format = "'%%5.4', 987654321            ==> '%5.4'\n";
+    OPEN_FILE(file);
+    VMInspector::fprintf(file, format, 987654321);
+    READ_AND_CLOSE_FILE(file, actual);
+    expectedLiteral = "'%5.4', 987654321            ==> 'ERROR @ \"%5.4' \"\n";
+    ASSERT_EQ(strcmp(actual, expectedLiteral), 0);
+
+    memset(actual, 'z', sizeof(actual));
+    format = "'%%5.4' '%%d', 987654321, 4    ==> '%5.4' '%d'\n";
+    OPEN_FILE(file);
+    VMInspector::fprintf(file, format, 987654321, 4);
+    READ_AND_CLOSE_FILE(file, actual);
+    ::sprintf(expected, format, 987654321, 4);
+    ASSERT_EQ(strcmp(actual, expected), 0);
+
+    memset(actual, 'z', sizeof(actual));
+    format = "'%%w' '%%d', 987654321, 6      ==> '%w' '%d'\n";
+    OPEN_FILE(file);
+    VMInspector::fprintf(file, format, 987654321, 6);
+    READ_AND_CLOSE_FILE(file, actual);
+    ::sprintf(expected, format, 987654321, 6);
+    ASSERT_EQ(strcmp(actual, expected), 0);
+
+
+    // Testing the %b extension:
+    memset(actual, 'z', sizeof(actual));
+    OPEN_FILE(file);
+    VMInspector::fprintf(file, "'%%b', 0          ==> '%b'\n", 0);
+    READ_AND_CLOSE_FILE(file, actual);
+    ASSERT_EQ(strcmp(actual, "'%b', 0          ==> 'FALSE'\n"), 0);
+
+    memset(actual, 'z', sizeof(actual));
+    OPEN_FILE(file);
+    VMInspector::fprintf(file, "'%%b', 1          ==> '%b'\n", 1);
+    READ_AND_CLOSE_FILE(file, actual);
+    ASSERT_EQ(strcmp(actual, "'%b', 1          ==> 'TRUE'\n"), 0);
+
+    memset(actual, 'z', sizeof(actual));
+    OPEN_FILE(file);
+    VMInspector::fprintf(file, "'%%b', -123456789 ==> '%b'\n", -123456789);
+    READ_AND_CLOSE_FILE(file, actual);
+    ASSERT_EQ(strcmp(actual, "'%b', -123456789 ==> 'TRUE'\n"), 0);
+
+    memset(actual, 'z', sizeof(actual));
+    OPEN_FILE(file);
+    VMInspector::fprintf(file, "'%%b', 123456789  ==> '%b'\n", 123456789);
+    READ_AND_CLOSE_FILE(file, actual);
+    ASSERT_EQ(strcmp(actual, "'%b', 123456789  ==> 'TRUE'\n"), 0);
+
+
+    // Testing the %J<x> extensions:
+    String str1("Test WTF String");
+    String str2("");
+
+    memset(actual, 'z', sizeof(actual));
+    OPEN_FILE(file);
+    VMInspector::fprintf(file, "'%%Js' is %%s, &str1, str1.isEmpty()?\"EMPTY\":\"NOT EMPTY\"  ==> '%Js' is %s\n",
+        &str1, str1.isEmpty() ? "EMPTY" : "NOT EMPTY");
+    READ_AND_CLOSE_FILE(file, actual);
+    expectedLiteral = "'%Js' is %s, &str1, str1.isEmpty()?\"EMPTY\":\"NOT EMPTY\"  ==> 'Test WTF String' is NOT EMPTY\n";
+    ASSERT_EQ(strcmp(actual, expectedLiteral), 0);
+
+    memset(actual, 'z', sizeof(actual));
+    OPEN_FILE(file);
+    VMInspector::fprintf(file, "'%%Js' is %%s, &str2, str2.isEmpty()?\"EMPTY\":\"NOT EMPTY\"  ==> '%Js' is %s\n",
+        &str2, str2.isEmpty() ? "EMPTY" : "NOT EMPTY");
+    READ_AND_CLOSE_FILE(file, actual);
+    expectedLiteral = "'%Js' is %s, &str2, str2.isEmpty()?\"EMPTY\":\"NOT EMPTY\"  ==> '' is EMPTY\n";
+    ASSERT_EQ(strcmp(actual, expectedLiteral), 0);
+
+    memset(actual, 'z', sizeof(actual));
+    OPEN_FILE(file);
+    VMInspector::fprintf(file, "'%%J+s' is %%s, &str1, str1.isEmpty()?\"EMPTY\":\"NOT EMPTY\" ==> '%J+s' is %s\n",
+        &str1, str1.isEmpty() ? "EMPTY" : "NOT EMPTY");
+    READ_AND_CLOSE_FILE(file, actual);
+    expectedLiteral = "'%J+s' is %s, &str1, str1.isEmpty()?\"EMPTY\":\"NOT EMPTY\" ==> 'WTF::String \"Test WTF String\"' is NOT EMPTY\n";
+    ASSERT_EQ(strcmp(actual, expectedLiteral), 0);
+
+    memset(actual, 'z', sizeof(actual));
+    OPEN_FILE(file);
+    VMInspector::fprintf(file, "'%%J+s' is %%s, &str2, str2.isEmpty()?\"EMPTY\":\"NOT EMPTY\" ==> '%J+s' is %s\n",
+        &str2, str2.isEmpty() ? "EMPTY" : "NOT EMPTY");
+    READ_AND_CLOSE_FILE(file, actual);
+    expectedLiteral = "'%J+s' is %s, &str2, str2.isEmpty()?\"EMPTY\":\"NOT EMPTY\" ==> 'WTF::String \"\"' is EMPTY\n";
+    ASSERT_EQ(strcmp(actual, expectedLiteral), 0);
+
+#undef OPEN_FILE
+#undef READ_AND_CLOSE_FILE
+
+#endif
+}
+
+
+TEST(JSC, VMInspectorSprintf)
+{
+#if ENABLE(VMINSPECTOR)
+    char actual[1024];
+    char expected[1024];
+    const char* format;
+    const char* expectedLiteral;
+
+    // Testing standard default format specifiers:
+    // Note: should work just like sprintf. So, we just compare against that.
+    memset(actual, 'z', sizeof(actual));
+    // The compiler warning flags are configured to expect a literal string for
+    // ::sprintf below. So, use a #define for this one case to keep the
+    // compiler happy.
+#undef LITERAL_FORMAT
+#define LITERAL_FORMAT "'%%%%'                         ==> '%%'\n"
+    VMInspector::sprintf(actual, LITERAL_FORMAT);
+    ::sprintf(expected, LITERAL_FORMAT);
+#undef LITERAL_FORMAT
+    ASSERT_EQ(strcmp(actual, expected), 0);
+
+    memset(actual, 'z', sizeof(actual));
+    format = "'%%c', 'x'                    ==> '%c'\n";
+    VMInspector::sprintf(actual, format, 'x');
+    ::sprintf(expected, format, 'x');
+    ASSERT_EQ(strcmp(actual, expected), 0);
+
+    memset(actual, 'z', sizeof(actual));
+    format = "'%%*c', 8, 'x'                ==> '%*c'\n";
+    VMInspector::sprintf(actual, format, 8, 'x');
+    ::sprintf(expected, format, 8, 'x');
+    ASSERT_EQ(strcmp(actual, expected), 0);
+
+    memset(actual, 'z', sizeof(actual));
+    format = "'%%s', \"hello world\"          ==> '%s'\n";
+    VMInspector::sprintf(actual, format, "hello world");
+    ::sprintf(expected, format, "hello world");
+    ASSERT_EQ(strcmp(actual, expected), 0);
+
+    memset(actual, 'z', sizeof(actual));
+    format = "'%%*s', 8, \"hello world\"      ==> '%*s'\n";
+    VMInspector::sprintf(actual, format, 8, "hello world");
+    ::sprintf(expected, format, 8, "hello world");
+    ASSERT_EQ(strcmp(actual, expected), 0);
+
+    memset(actual, 'z', sizeof(actual));
+    format = "'%%*s', 8, \"hello\"            ==> '%*s'\n";
+    VMInspector::sprintf(actual, format, 8, "hello");
+    ::sprintf(expected, format, 8, "hello");
+    ASSERT_EQ(strcmp(actual, expected), 0);
+
+    memset(actual, 'z', sizeof(actual));
+    format = "'%%d', 987654321              ==> '%d'\n";
+    VMInspector::sprintf(actual, format, 987654321);
+    ::sprintf(expected, format, 987654321);
+    ASSERT_EQ(strcmp(actual, expected), 0);
+
+    memset(actual, 'z', sizeof(actual));
+    format = "'%%u', 4276543210u            ==> '%u'\n";
+    VMInspector::sprintf(actual, format, 4276543210u);
+    ::sprintf(expected, format, 4276543210u);
+    ASSERT_EQ(strcmp(actual, expected), 0);
+
+    memset(actual, 'z', sizeof(actual));
+    format = "'%%u', 0xffffffff             ==> '%u'\n";
+    VMInspector::sprintf(actual, format, 0xffffffff);
+    ::sprintf(expected, format, 0xffffffff);
+    ASSERT_EQ(strcmp(actual, expected), 0);
+
+    memset(actual, 'z', sizeof(actual));
+    format = "'%%x', 0xffffffff             ==> '%x'\n";
+    VMInspector::sprintf(actual, format, 0xffffffff);
+    ::sprintf(expected, format, 0xffffffff);
+    ASSERT_EQ(strcmp(actual, expected), 0);
+
+    memset(actual, 'z', sizeof(actual));
+    format = "'%%p', (void*)0xabcdbabe      ==> '%p'\n";
+    VMInspector::sprintf(actual, format, (void*)0xabcdbabe);
+    ::sprintf(expected, format, (void*)0xabcdbabe);
+    ASSERT_EQ(strcmp(actual, expected), 0);
+
+    memset(actual, 'z', sizeof(actual));
+    format = "'%%lu', 1234567890987654321ul ==> '%lu'\n";
+    VMInspector::sprintf(actual, format, 1234567890987654321ul);
+    ::sprintf(expected, format, 1234567890987654321ul);
+    ASSERT_EQ(strcmp(actual, expected), 0);
+
+    memset(actual, 'z', sizeof(actual));
+    format = "'%%f', 1234.567               ==> '%f'\n";
+    VMInspector::sprintf(actual, format, 1234.567);
+    ::sprintf(expected, format, 1234.567);
+    ASSERT_EQ(strcmp(actual, expected), 0);
+
+    memset(actual, 'z', sizeof(actual));
+    format = "'%%.2f', 1234.567             ==> '%.2f'\n";
+    VMInspector::sprintf(actual, format, 1234.567);
+    ::sprintf(expected, format, 1234.567);
+    ASSERT_EQ(strcmp(actual, expected), 0);
+
+    memset(actual, 'z', sizeof(actual));
+    format = "'%%10.2f', 1234.567           ==> '%10.2f'\n";
+    VMInspector::sprintf(actual, format, 1234.567);
+    ::sprintf(expected, format, 1234.567);
+    ASSERT_EQ(strcmp(actual, expected), 0);
+
+    memset(actual, 'z', sizeof(actual));
+    format = "'%%010.2f', 1234.567          ==> '%010.2f'\n";
+    VMInspector::sprintf(actual, format, 1234.567);
+    ::sprintf(expected, format, 1234.567);
+    ASSERT_EQ(strcmp(actual, expected), 0);
+
+    // Bad / weird formats:
+    memset(actual, 'z', sizeof(actual));
+    format = "'%%5.4', 987654321            ==> '%5.4'\n";
+    VMInspector::sprintf(actual, format, 987654321);
+    expectedLiteral = "'%5.4', 987654321            ==> 'ERROR @ \"%5.4' \"\n";
+    ASSERT_EQ(strcmp(actual, expectedLiteral), 0);
+
+    memset(actual, 'z', sizeof(actual));
+    format = "'%%5.4' '%%d', 987654321, 4    ==> '%5.4' '%d'\n";
+    VMInspector::sprintf(actual, format, 987654321, 4);
+    ::sprintf(expected, format, 987654321, 4);
+    ASSERT_EQ(strcmp(actual, expected), 0);
+
+    memset(actual, 'z', sizeof(actual));
+    format = "'%%w' '%%d', 987654321, 6      ==> '%w' '%d'\n";
+    VMInspector::sprintf(actual, format, 987654321, 6);
+    ::sprintf(expected, format, 987654321, 6);
+    ASSERT_EQ(strcmp(actual, expected), 0);
+
+
+    // Testing the %b extension:
+    memset(actual, 'z', sizeof(actual));
+    VMInspector::sprintf(actual, "'%%b', 0          ==> '%b'\n", 0);
+    ASSERT_EQ(strcmp(actual, "'%b', 0          ==> 'FALSE'\n"), 0);
+
+    memset(actual, 'z', sizeof(actual));
+    VMInspector::sprintf(actual, "'%%b', 1          ==> '%b'\n", 1);
+    ASSERT_EQ(strcmp(actual, "'%b', 1          ==> 'TRUE'\n"), 0);
+
+    memset(actual, 'z', sizeof(actual));
+    VMInspector::sprintf(actual, "'%%b', -123456789 ==> '%b'\n", -123456789);
+    ASSERT_EQ(strcmp(actual, "'%b', -123456789 ==> 'TRUE'\n"), 0);
+
+    memset(actual, 'z', sizeof(actual));
+    VMInspector::sprintf(actual, "'%%b', 123456789  ==> '%b'\n", 123456789);
+    ASSERT_EQ(strcmp(actual, "'%b', 123456789  ==> 'TRUE'\n"), 0);
+
+
+    // Testing the %J<x> extensions:
+    String str1("Test WTF String");
+    String str2("");
+
+    memset(actual, 'z', sizeof(actual));
+    VMInspector::sprintf(actual, "'%%Js' is %%s, &str1, str1.isEmpty()?\"EMPTY\":\"NOT EMPTY\"  ==> '%Js' is %s\n",
+        &str1, str1.isEmpty() ? "EMPTY" : "NOT EMPTY");
+    expectedLiteral = "'%Js' is %s, &str1, str1.isEmpty()?\"EMPTY\":\"NOT EMPTY\"  ==> 'Test WTF String' is NOT EMPTY\n";
+    ASSERT_EQ(strcmp(actual, expectedLiteral), 0);
+
+    memset(actual, 'z', sizeof(actual));
+    VMInspector::sprintf(actual, "'%%Js' is %%s, &str2, str2.isEmpty()?\"EMPTY\":\"NOT EMPTY\"  ==> '%Js' is %s\n",
+        &str2, str2.isEmpty() ? "EMPTY" : "NOT EMPTY");
+    expectedLiteral = "'%Js' is %s, &str2, str2.isEmpty()?\"EMPTY\":\"NOT EMPTY\"  ==> '' is EMPTY\n";
+    ASSERT_EQ(strcmp(actual, expectedLiteral), 0);
+
+    memset(actual, 'z', sizeof(actual));
+    VMInspector::sprintf(actual, "'%%J+s' is %%s, &str1, str1.isEmpty()?\"EMPTY\":\"NOT EMPTY\" ==> '%J+s' is %s\n",
+        &str1, str1.isEmpty() ? "EMPTY" : "NOT EMPTY");
+    expectedLiteral = "'%J+s' is %s, &str1, str1.isEmpty()?\"EMPTY\":\"NOT EMPTY\" ==> 'WTF::String \"Test WTF String\"' is NOT EMPTY\n";
+    ASSERT_EQ(strcmp(actual, expectedLiteral), 0);
+
+    memset(actual, 'z', sizeof(actual));
+    VMInspector::sprintf(actual, "'%%J+s' is %%s, &str2, str2.isEmpty()?\"EMPTY\":\"NOT EMPTY\" ==> '%J+s' is %s\n",
+        &str2, str2.isEmpty() ? "EMPTY" : "NOT EMPTY");
+    expectedLiteral = "'%J+s' is %s, &str2, str2.isEmpty()?\"EMPTY\":\"NOT EMPTY\" ==> 'WTF::String \"\"' is EMPTY\n";
+    ASSERT_EQ(strcmp(actual, expectedLiteral), 0);
+#endif
+}
+
+
+TEST(JSC, VMInspectorSnprintf)
+{
+#if ENABLE(VMINSPECTOR)
+    char actual[1024];
+    char expected[1024];
+    const char* format;
+    const char* expectedLiteral;
+
+    size_t size = 1;
+    while (size <= 100) {
+
+        // Testing standard default format specifiers:
+        // Note: should work just like snprintf. So, we just compare against that.
+        memset(actual, 'z', sizeof(actual));
+        // The compiler warning flags are configured to expect a literal string for
+        // ::snprintf below. So, use a #define for this one case to keep the
+        // compiler happy.
+#undef LITERAL_FORMAT
+#define LITERAL_FORMAT "'%%%%'                         ==> '%%'\n"
+        VMInspector::snprintf(actual, size, LITERAL_FORMAT);
+        ::snprintf(expected, size, LITERAL_FORMAT);
+#undef LITERAL_FORMAT
+        ASSERT_EQ(strcmp(actual, expected), 0);
+
+        memset(actual, 'z', sizeof(actual));
+        format = "'%%c', 'x'                    ==> '%c'\n";
+        VMInspector::snprintf(actual, size, format, 'x');
+        ::snprintf(expected, size, format, 'x');
+        ASSERT_EQ(strcmp(actual, expected), 0);
+
+        memset(actual, 'z', sizeof(actual));
+        format = "'%%*c', 8, 'x'                ==> '%*c'\n";
+        VMInspector::snprintf(actual, size, format, 8, 'x');
+        ::snprintf(expected, size, format, 8, 'x');
+        ASSERT_EQ(strcmp(actual, expected), 0);
+
+        memset(actual, 'z', sizeof(actual));
+        format = "'%%s', \"hello world\"          ==> '%s'\n";
+        VMInspector::snprintf(actual, size, format, "hello world");
+        ::snprintf(expected, size, format, "hello world");
+        ASSERT_EQ(strcmp(actual, expected), 0);
+
+        memset(actual, 'z', sizeof(actual));
+        format = "'%%*s', 8, \"hello world\"      ==> '%*s'\n";
+        VMInspector::snprintf(actual, size, format, 8, "hello world");
+        ::snprintf(expected, size, format, 8, "hello world");
+        ASSERT_EQ(strcmp(actual, expected), 0);
+
+        memset(actual, 'z', sizeof(actual));
+        format = "'%%*s', 8, \"hello\"            ==> '%*s'\n";
+        VMInspector::snprintf(actual, size, format, 8, "hello");
+        ::snprintf(expected, size, format, 8, "hello");
+        ASSERT_EQ(strcmp(actual, expected), 0);
+
+        memset(actual, 'z', sizeof(actual));
+        format = "'%%d', 987654321              ==> '%d'\n";
+        VMInspector::snprintf(actual, size, format, 987654321);
+        ::snprintf(expected, size, format, 987654321);
+        ASSERT_EQ(strcmp(actual, expected), 0);
+
+        memset(actual, 'z', sizeof(actual));
+        format = "'%%u', 4276543210u            ==> '%u'\n";
+        VMInspector::snprintf(actual, size, format, 4276543210u);
+        ::snprintf(expected, size, format, 4276543210u);
+        ASSERT_EQ(strcmp(actual, expected), 0);
+
+        memset(actual, 'z', sizeof(actual));
+        format = "'%%u', 0xffffffff             ==> '%u'\n";
+        VMInspector::snprintf(actual, size, format, 0xffffffff);
+        ::snprintf(expected, size, format, 0xffffffff);
+        ASSERT_EQ(strcmp(actual, expected), 0);
+
+        memset(actual, 'z', sizeof(actual));
+        format = "'%%x', 0xffffffff             ==> '%x'\n";
+        VMInspector::snprintf(actual, size, format, 0xffffffff);
+        ::snprintf(expected, size, format, 0xffffffff);
+        ASSERT_EQ(strcmp(actual, expected), 0);
+
+        memset(actual, 'z', sizeof(actual));
+        format = "'%%p', (void*)0xabcdbabe      ==> '%p'\n";
+        VMInspector::snprintf(actual, size, format, (void*)0xabcdbabe);
+        ::snprintf(expected, size, format, (void*)0xabcdbabe);
+        ASSERT_EQ(strcmp(actual, expected), 0);
+
+        memset(actual, 'z', sizeof(actual));
+        format = "'%%lu', 1234567890987654321ul ==> '%lu'\n";
+        VMInspector::snprintf(actual, size, format, 1234567890987654321ul);
+        ::snprintf(expected, size, format, 1234567890987654321ul);
+        ASSERT_EQ(strcmp(actual, expected), 0);
+
+        memset(actual, 'z', sizeof(actual));
+        format = "'%%f', 1234.567               ==> '%f'\n";
+        VMInspector::snprintf(actual, size, format, 1234.567);
+        ::snprintf(expected, size, format, 1234.567);
+        ASSERT_EQ(strcmp(actual, expected), 0);
+
+        memset(actual, 'z', sizeof(actual));
+        format = "'%%.2f', 1234.567             ==> '%.2f'\n";
+        VMInspector::snprintf(actual, size, format, 1234.567);
+        ::snprintf(expected, size, format, 1234.567);
+        ASSERT_EQ(strcmp(actual, expected), 0);
+
+        memset(actual, 'z', sizeof(actual));
+        format = "'%%10.2f', 1234.567           ==> '%10.2f'\n";
+        VMInspector::snprintf(actual, size, format, 1234.567);
+        ::snprintf(expected, size, format, 1234.567);
+        ASSERT_EQ(strcmp(actual, expected), 0);
+
+        memset(actual, 'z', sizeof(actual));
+        format = "'%%010.2f', 1234.567          ==> '%010.2f'\n";
+        VMInspector::snprintf(actual, size, format, 1234.567);
+        ::snprintf(expected, size, format, 1234.567);
+        ASSERT_EQ(strcmp(actual, expected), 0);
+
+        // Bad / weird formats:
+        memset(actual, 'z', sizeof(actual));
+        format = "'%%5.4', 987654321            ==> '%5.4'\n";
+        VMInspector::snprintf(actual, size, format, 987654321);
+        expectedLiteral = "'%5.4', 987654321            ==> 'ERROR @ \"%5.4' \"\n";
+        ::snprintf(expected, size, "%s", expectedLiteral);
+        ASSERT_EQ(strcmp(actual, expected), 0);
+
+        memset(actual, 'z', sizeof(actual));
+        format = "'%%5.4' '%%d', 987654321, 4    ==> '%5.4' '%d'\n";
+        VMInspector::snprintf(actual, size, format, 987654321, 4);
+        ::snprintf(expected, size, format, 987654321, 4);
+        ASSERT_EQ(strcmp(actual, expected), 0);
+
+        memset(actual, 'z', sizeof(actual));
+        format = "'%%w' '%%d', 987654321, 6      ==> '%w' '%d'\n";
+        VMInspector::snprintf(actual, size, format, 987654321, 6);
+        ::snprintf(expected, size, format, 987654321, 6);
+        ASSERT_EQ(strcmp(actual, expected), 0);
+
+
+        // Testing the %b extension:
+        memset(actual, 'z', sizeof(actual));
+        VMInspector::snprintf(actual, size, "'%%b', 0          ==> '%b'\n", 0);
+        expectedLiteral = "'%b', 0          ==> 'FALSE'\n";
+        ::snprintf(expected, size, "%s", expectedLiteral);
+        ASSERT_EQ(strcmp(actual, expected), 0);
+
+        memset(actual, 'z', sizeof(actual));
+        VMInspector::snprintf(actual, size, "'%%b', 1          ==> '%b'\n", 1);
+        expectedLiteral = "'%b', 1          ==> 'TRUE'\n";
+        ::snprintf(expected, size, "%s", expectedLiteral);
+        ASSERT_EQ(strcmp(actual, expected), 0);
+
+        memset(actual, 'z', sizeof(actual));
+        VMInspector::snprintf(actual, size, "'%%b', -123456789 ==> '%b'\n", -123456789);
+        expectedLiteral = "'%b', -123456789 ==> 'TRUE'\n";
+        ::snprintf(expected, size, "%s", expectedLiteral);
+        ASSERT_EQ(strcmp(actual, expected), 0);
+
+        memset(actual, 'z', sizeof(actual));
+        VMInspector::snprintf(actual, size, "'%%b', 123456789  ==> '%b'\n", 123456789);
+        expectedLiteral = "'%b', 123456789  ==> 'TRUE'\n";
+        ::snprintf(expected, size, "%s", expectedLiteral);
+        ASSERT_EQ(strcmp(actual, expected), 0);
+
+        // Testing the %J<x> extensions:
+        String str1("Test WTF String");
+        String str2("");
+
+        memset(actual, 'z', sizeof(actual));
+        VMInspector::snprintf(actual, size, "'%%Js' is %%s, &str1, str1.isEmpty()?\"EMPTY\":\"NOT EMPTY\"  ==> '%Js' is %s\n",
+            &str1, str1.isEmpty() ? "EMPTY" : "NOT EMPTY");
+        expectedLiteral = "'%Js' is %s, &str1, str1.isEmpty()?\"EMPTY\":\"NOT EMPTY\"  ==> 'Test WTF String' is NOT EMPTY\n";
+        ::snprintf(expected, size, "%s", expectedLiteral);
+        ASSERT_EQ(strcmp(actual, expected), 0);
+
+        memset(actual, 'z', sizeof(actual));
+        VMInspector::snprintf(actual, size, "'%%Js' is %%s, &str2, str2.isEmpty()?\"EMPTY\":\"NOT EMPTY\"  ==> '%Js' is %s\n",
+            &str2, str2.isEmpty() ? "EMPTY" : "NOT EMPTY");
+        expectedLiteral = "'%Js' is %s, &str2, str2.isEmpty()?\"EMPTY\":\"NOT EMPTY\"  ==> '' is EMPTY\n";
+        ::snprintf(expected, size, "%s", expectedLiteral);
+        ASSERT_EQ(strcmp(actual, expected), 0);
+
+        memset(actual, 'z', sizeof(actual));
+        VMInspector::snprintf(actual, size, "'%%J+s' is %%s, &str1, str1.isEmpty()?\"EMPTY\":\"NOT EMPTY\" ==> '%J+s' is %s\n",
+            &str1, str1.isEmpty() ? "EMPTY" : "NOT EMPTY");
+        expectedLiteral = "'%J+s' is %s, &str1, str1.isEmpty()?\"EMPTY\":\"NOT EMPTY\" ==> 'WTF::String \"Test WTF String\"' is NOT EMPTY\n";
+        ::snprintf(expected, size, "%s", expectedLiteral);
+        ASSERT_EQ(strcmp(actual, expected), 0);
+
+        memset(actual, 'z', sizeof(actual));
+        VMInspector::snprintf(actual, size, "'%%J+s' is %%s, &str2, str2.isEmpty()?\"EMPTY\":\"NOT EMPTY\" ==> '%J+s' is %s\n",
+            &str2, str2.isEmpty() ? "EMPTY" : "NOT EMPTY");
+        expectedLiteral = "'%J+s' is %s, &str2, str2.isEmpty()?\"EMPTY\":\"NOT EMPTY\" ==> 'WTF::String \"\"' is EMPTY\n";
+        ::snprintf(expected, size, "%s", expectedLiteral);
+        ASSERT_EQ(strcmp(actual, expected), 0);
+
+        // Test lower sizes more densely, and then space out to larger sizes.
+        // We're doing this because the lower sizes might be interesting, but
+        // for expediency, we don't want to test at this fine grain resolution
+        // for all possible sizes. Hence, we accelerate the rate once we're
+        // pass the interesting small sizes.
+        if (size <= 5)
+            size++;
+        else
+            size += 4;
+    }
+#endif
+}
diff --git a/Tools/TestWebKitAPI/Tests/WTF/MemoryInstrumentationTest.cpp b/Tools/TestWebKitAPI/Tests/WTF/MemoryInstrumentationTest.cpp
index 9a998da03..1ac26a0be 100644
--- a/Tools/TestWebKitAPI/Tests/WTF/MemoryInstrumentationTest.cpp
+++ b/Tools/TestWebKitAPI/Tests/WTF/MemoryInstrumentationTest.cpp
@@ -36,11 +36,13 @@
 #include <wtf/HashCountedSet.h>
 #include <wtf/HashMap.h>
 #include <wtf/HashSet.h>
+#include <wtf/ListHashSet.h>
 #include <wtf/MemoryInstrumentation.h>
 #include <wtf/MemoryInstrumentationArrayBufferView.h>
 #include <wtf/MemoryInstrumentationHashCountedSet.h>
 #include <wtf/MemoryInstrumentationHashMap.h>
 #include <wtf/MemoryInstrumentationHashSet.h>
+#include <wtf/MemoryInstrumentationListHashSet.h>
 #include <wtf/MemoryInstrumentationString.h>
 #include <wtf/MemoryInstrumentationVector.h>
 #include <wtf/RefCounted.h>
@@ -79,57 +81,65 @@ using WTF::MemoryObjectType;
 
 MemoryObjectType TestType = "TestType";
 
-class InstrumentationTestHelper : public WTF::MemoryInstrumentation {
+class MemoryInstrumentationTestClient : public WTF::MemoryInstrumentationClient {
 public:
-    InstrumentationTestHelper()
-        : MemoryInstrumentation(&m_client)
-    { }
+    virtual void countObjectSize(const void*, MemoryObjectType objectType, size_t size)
+    {
+        TypeToSizeMap::AddResult result = m_totalSizes.add(objectType, size);
+        if (!result.isNewEntry)
+            result.iterator->value += size;
+    }
+    virtual bool visited(const void* object) { return !m_visitedObjects.add(object).isNewEntry; }
+    virtual void checkCountedObject(const void*) { }
+
+    size_t visitedObjects() const { return m_visitedObjects.size(); }
+    size_t totalSize(const MemoryObjectType objectType) const
+    {
+        TypeToSizeMap::const_iterator i = m_totalSizes.find(objectType);
+        return i == m_totalSizes.end() ? 0 : i->value;
+    }
+
+    size_t reportedSizeForAllTypes() const
+    {
+        size_t size = 0;
+        for (TypeToSizeMap::const_iterator i = m_totalSizes.begin(); i != m_totalSizes.end(); ++i)
+            size += i->value;
+        return size;
+    }
+
+private:
+    typedef HashMap<MemoryObjectType, size_t> TypeToSizeMap;
+    TypeToSizeMap m_totalSizes;
+    WTF::HashSet<const void*> m_visitedObjects;
+};
+
+class InstrumentationTestImpl : public WTF::MemoryInstrumentation {
+public:
+    explicit InstrumentationTestImpl(MemoryInstrumentationTestClient* client)
+        : MemoryInstrumentation(client)
+        , m_client(client) { }
 
     virtual void processDeferredInstrumentedPointers();
     virtual void deferInstrumentedPointer(PassOwnPtr<InstrumentedPointerBase>);
 
-    size_t visitedObjects() const { return m_client.visitedObjects(); }
-    size_t reportedSizeForAllTypes() const { return m_client.reportedSizeForAllTypes(); }
-    size_t totalSize(const MemoryObjectType objectType) const { return m_client.totalSize(objectType); }
+    size_t visitedObjects() const { return m_client->visitedObjects(); }
+    size_t reportedSizeForAllTypes() const { return m_client->reportedSizeForAllTypes(); }
+    size_t totalSize(const MemoryObjectType objectType) const { return m_client->totalSize(objectType); }
 
 private:
-    class Client : public WTF::MemoryInstrumentationClient {
-    public:
-        virtual void countObjectSize(const void*, MemoryObjectType objectType, size_t size)
-        {
-            TypeToSizeMap::AddResult result = m_totalSizes.add(objectType, size);
-            if (!result.isNewEntry)
-                result.iterator->value += size;
-        }
-        virtual bool visited(const void* object) { return !m_visitedObjects.add(object).isNewEntry; }
-        virtual void checkCountedObject(const void*) { }
-
-        size_t visitedObjects() const { return m_visitedObjects.size(); }
-        size_t totalSize(const MemoryObjectType objectType) const
-        {
-            TypeToSizeMap::const_iterator i = m_totalSizes.find(objectType);
-            return i == m_totalSizes.end() ? 0 : i->value;
-        }
-
-        size_t reportedSizeForAllTypes() const
-        {
-            size_t size = 0;
-            for (TypeToSizeMap::const_iterator i = m_totalSizes.begin(); i != m_totalSizes.end(); ++i)
-                size += i->value;
-            return size;
-        }
-
-    private:
-        typedef HashMap<MemoryObjectType, size_t> TypeToSizeMap;
-        TypeToSizeMap m_totalSizes;
-        WTF::HashSet<const void*> m_visitedObjects;
-    };
-
-    Client m_client;
+    MemoryInstrumentationTestClient* m_client;
     Vector<OwnPtr<InstrumentedPointerBase> > m_deferredInstrumentedPointers;
 };
 
-void InstrumentationTestHelper::processDeferredInstrumentedPointers()
+class InstrumentationTestHelper : public InstrumentationTestImpl {
+public:
+    InstrumentationTestHelper() : InstrumentationTestImpl(&m_client) { }
+
+private:
+    MemoryInstrumentationTestClient m_client;
+};
+
+void InstrumentationTestImpl::processDeferredInstrumentedPointers()
 {
     while (!m_deferredInstrumentedPointers.isEmpty()) {
         OwnPtr<InstrumentedPointerBase> pointer = m_deferredInstrumentedPointers.last().release();
@@ -138,7 +148,7 @@ void InstrumentationTestHelper::processDeferredInstrumentedPointers()
     }
 }
 
-void InstrumentationTestHelper::deferInstrumentedPointer(PassOwnPtr<InstrumentedPointerBase> pointer)
+void InstrumentationTestImpl::deferInstrumentedPointer(PassOwnPtr<InstrumentedPointerBase> pointer)
 {
     m_deferredInstrumentedPointers.append(pointer);
 }
@@ -648,6 +658,43 @@ TEST(MemoryInstrumentationTest, hashMapWithInstrumentedPointerKeysAndPointerValu
     EXPECT_EQ(2u * 2u * count + 1, helper.visitedObjects());
 }
 
+TEST(MemoryInstrumentationTest, listHashSetWithInstrumentedType)
+{
+    InstrumentationTestHelper helper;
+
+    typedef ListHashSet<String, 8> TestSet;
+    OwnPtr<TestSet> value = adoptPtr(new TestSet());
+    size_t count = 10;
+    for (size_t i = 0; i < count; ++i)
+        value->add(String::number(i));
+    InstrumentedOwner<TestSet* > root(value.get());
+    helper.addRootObject(root);
+    EXPECT_EQ(sizeof(TestSet) + sizeof(String) * value->capacity() + (sizeof(StringImpl) + 1 * sizeof(LChar)) * count +
+        sizeof(WTF::ListHashSetNodeAllocator<String, 8>) + sizeof(WTF::ListHashSetNode<String, 8>) * (count - 8),
+        helper.reportedSizeForAllTypes());
+    EXPECT_EQ(1 + count, helper.visitedObjects());
+}
+
+TEST(MemoryInstrumentationTest, listHashSetWithInstrumentedTypeAfterValuesRemoval)
+{
+    InstrumentationTestHelper helper;
+
+    typedef ListHashSet<String, 8> TestSet;
+    OwnPtr<TestSet> value = adoptPtr(new TestSet());
+    size_t count = 20;
+    for (size_t i = 0; i < count; ++i)
+        value->add(String::number(i));
+    // Remove 10 values, 8 of which were allocated in the internal buffer.
+    for (size_t i = 0; i < 10; ++i)
+        value->remove(String::number(i));
+    InstrumentedOwner<TestSet* > root(value.get());
+    helper.addRootObject(root);
+    EXPECT_EQ(sizeof(TestSet) + sizeof(String) * value->capacity() + (sizeof(StringImpl) + 2 * sizeof(LChar)) * (count - 10) +
+        sizeof(WTF::ListHashSetNodeAllocator<String, 8>) + sizeof(WTF::ListHashSetNode<String, 8>) * (count - 10),
+        helper.reportedSizeForAllTypes());
+    EXPECT_EQ(1 + (count - 10), helper.visitedObjects());
+}
+
 class InstrumentedConvertibleToInt {
 public:
     InstrumentedConvertibleToInt() : m_notInstrumented(0) { }
@@ -750,7 +797,6 @@ public:
     }
 };
 
-
 TEST(MemoryInstrumentationTest, instrumentedWithMultipleAncestors)
 {
     InstrumentationTestHelper helper;
@@ -760,11 +806,43 @@ TEST(MemoryInstrumentationTest, instrumentedWithMultipleAncestors)
     Instrumented* ancestorPointer = descendantPointer;
     InstrumentedOwner<Instrumented*> ancestorPointerOwner(ancestorPointer);
     EXPECT_NE(static_cast<void*>(ancestorPointer), static_cast<void*>(descendantPointer));
+
     helper.addRootObject(descendantPointerOwner);
     helper.addRootObject(ancestorPointerOwner);
     EXPECT_EQ(sizeof(ClassWithTwoAncestors), helper.reportedSizeForAllTypes());
     EXPECT_EQ(2u, helper.visitedObjects());
 }
 
+class CheckCountedObjectsClient : public MemoryInstrumentationTestClient {
+public:
+    CheckCountedObjectsClient(const void* expectedPointer) : m_expectedPointer(expectedPointer), m_expectedPointerFound(false) { }
+    virtual void checkCountedObject(const void* pointer)
+    {
+        EXPECT_EQ(pointer, m_expectedPointer);
+        m_expectedPointerFound = true;
+    }
+    bool expectedPointerFound() { return m_expectedPointerFound; }
+
+private:
+    const void* m_expectedPointer;
+    bool m_expectedPointerFound;
+};
+
+TEST(MemoryInstrumentationTest, checkCountedObjectWithMultipleAncestors)
+{
+    OwnPtr<ClassWithTwoAncestors> instance = adoptPtr(new ClassWithTwoAncestors());
+    ClassWithTwoAncestors* descendantPointer = instance.get();
+    InstrumentedOwner<ClassWithTwoAncestors*> descendantPointerOwner(descendantPointer);
+    Instrumented* ancestorPointer = descendantPointer;
+    InstrumentedOwner<Instrumented*> ancestorPointerOwner(ancestorPointer);
+    EXPECT_NE(static_cast<void*>(ancestorPointer), static_cast<void*>(descendantPointer));
+
+    CheckCountedObjectsClient client(instance.get());
+    InstrumentationTestImpl instrumentation(&client);
+    instrumentation.addRootObject(descendantPointerOwner);
+    instrumentation.addRootObject(ancestorPointerOwner);
+    EXPECT_TRUE(client.expectedPointerFound());
+}
+
 } // namespace
 
diff --git a/Tools/TestWebKitAPI/Tests/WTF/StringImpl.cpp b/Tools/TestWebKitAPI/Tests/WTF/StringImpl.cpp
index 213a655aa..35d64844c 100644
--- a/Tools/TestWebKitAPI/Tests/WTF/StringImpl.cpp
+++ b/Tools/TestWebKitAPI/Tests/WTF/StringImpl.cpp
@@ -26,6 +26,7 @@
 #include "config.h"
 
 #include <wtf/text/StringImpl.h>
+#include <wtf/text/WTFString.h>
 
 namespace TestWebKitAPI {
 
@@ -68,4 +69,48 @@ TEST(WTF, StringImplFromLiteralLoop16BitConversion)
     }
 }
 
+TEST(WTF, StringImplReplaceWithLiteral)
+{
+    RefPtr<StringImpl> testStringImpl = StringImpl::createFromLiteral("1224");
+    ASSERT_TRUE(testStringImpl->is8Bit());
+
+    // Cases for 8Bit source.
+    testStringImpl = testStringImpl->replace('2', "", 0);
+    ASSERT_TRUE(equal(testStringImpl.get(), "14"));
+
+    testStringImpl = StringImpl::createFromLiteral("1224");
+    ASSERT_TRUE(testStringImpl->is8Bit());
+
+    testStringImpl = testStringImpl->replace('3', "NotFound", 8);
+    ASSERT_TRUE(equal(testStringImpl.get(), "1224"));
+
+    testStringImpl = testStringImpl->replace('2', "3", 1);
+    ASSERT_TRUE(equal(testStringImpl.get(), "1334"));
+
+    testStringImpl = StringImpl::createFromLiteral("1224");
+    ASSERT_TRUE(testStringImpl->is8Bit());
+    testStringImpl = testStringImpl->replace('2', "555", 3);
+    ASSERT_TRUE(equal(testStringImpl.get(), "15555554"));
+
+    // Cases for 16Bit source.
+    String testString = String::fromUTF8("résumé");
+    ASSERT_FALSE(testString.impl()->is8Bit());
+
+    testStringImpl = testString.impl()->replace('2', "NotFound", 8);
+    ASSERT_TRUE(equal(testStringImpl.get(), String::fromUTF8("résumé").impl()));
+
+    testStringImpl = testString.impl()->replace(UChar(0x00E9 /*U+00E9 is 'é'*/), "e", 1);
+    ASSERT_TRUE(equal(testStringImpl.get(), "resume"));
+
+    testString = String::fromUTF8("résumé");
+    ASSERT_FALSE(testString.impl()->is8Bit());
+    testStringImpl = testString.impl()->replace(UChar(0x00E9 /*U+00E9 is 'é'*/), "", 0);
+    ASSERT_TRUE(equal(testStringImpl.get(), "rsum"));
+
+    testString = String::fromUTF8("résumé");
+    ASSERT_FALSE(testString.impl()->is8Bit());
+    testStringImpl = testString.impl()->replace(UChar(0x00E9 /*U+00E9 is 'é'*/), "555", 3);
+    ASSERT_TRUE(equal(testStringImpl.get(), "r555sum555"));
+}
+
 } // namespace TestWebKitAPI
diff --git a/Tools/TestWebKitAPI/Tests/WTF/WTFString.cpp b/Tools/TestWebKitAPI/Tests/WTF/WTFString.cpp
index 155772f48..4a92cd4e8 100644
--- a/Tools/TestWebKitAPI/Tests/WTF/WTFString.cpp
+++ b/Tools/TestWebKitAPI/Tests/WTF/WTFString.cpp
@@ -115,7 +115,45 @@ TEST(WTF, StringNumberToStringECMAScriptRegularNumbers)
     testNumberToStringECMAScript(phi, "1.618033988749895");
 }
 
-
+TEST(WTF, StringReplaceWithLiteral)
+{
+    // Cases for 8Bit source.
+    String testString = "1224";
+    ASSERT_TRUE(testString.is8Bit());
+    testString.replaceWithLiteral('2', "");
+    ASSERT_STREQ("14", testString.utf8().data());
+
+    testString = "1224";
+    ASSERT_TRUE(testString.is8Bit());
+    testString.replaceWithLiteral('2', "3");
+    ASSERT_STREQ("1334", testString.utf8().data());
+
+    testString = "1224";
+    ASSERT_TRUE(testString.is8Bit());
+    testString.replaceWithLiteral('2', "555");
+    ASSERT_STREQ("15555554", testString.utf8().data());
+
+    testString = "1224";
+    ASSERT_TRUE(testString.is8Bit());
+    testString.replaceWithLiteral('3', "NotFound");
+    ASSERT_STREQ("1224", testString.utf8().data());
+
+    // Cases for 16Bit source.
+    testString = String::fromUTF8("résumé");
+    ASSERT_FALSE(testString.is8Bit());
+    testString.replaceWithLiteral(UChar(0x00E9 /*U+00E9 is 'é'*/), "e");
+    ASSERT_STREQ("resume", testString.utf8().data());
+
+    testString = String::fromUTF8("résumé");
+    ASSERT_FALSE(testString.is8Bit());
+    testString.replaceWithLiteral(UChar(0x00E9 /*U+00E9 is 'é'*/), "");
+    ASSERT_STREQ("rsum", testString.utf8().data());
+
+    testString = String::fromUTF8("résumé");
+    ASSERT_FALSE(testString.is8Bit());
+    testString.replaceWithLiteral('3', "NotFound");
+    ASSERT_STREQ("résumé", testString.utf8().data());
+}
 
 
 } // namespace TestWebKitAPI
diff --git a/Tools/TestWebKitAPI/Tests/WebKit2/WebArchive.cpp b/Tools/TestWebKitAPI/Tests/WebKit2/WebArchive.cpp
index 8ca13bc40..7dea31554 100644
--- a/Tools/TestWebKitAPI/Tests/WebKit2/WebArchive.cpp
+++ b/Tools/TestWebKitAPI/Tests/WebKit2/WebArchive.cpp
@@ -49,8 +49,7 @@ static void didReceiveMessageFromInjectedBundle(WKContextRef, WKStringRef messag
     size_t size = WKDataGetSize(receivedData);
     const unsigned char* bytes = WKDataGetBytes(receivedData);
     RetainPtr<CFDataRef> data(AdoptCF, CFDataCreate(0, bytes, size));
-    CFPropertyListFormat format = kCFPropertyListXMLFormat_v1_0 | kCFPropertyListBinaryFormat_v1_0;
-    RetainPtr<CFPropertyListRef> propertyList(AdoptCF, CFPropertyListCreateWithData(0, data.get(), kCFPropertyListImmutable, &format, 0));
+    RetainPtr<CFPropertyListRef> propertyList(AdoptCF, CFPropertyListCreateWithData(0, data.get(), kCFPropertyListImmutable, 0, 0));
     EXPECT_TRUE(propertyList);
     
     // It should be a dictionary.
diff --git a/Tools/TestWebKitAPI/Tests/WebKit2/WillSendSubmitEvent.cpp b/Tools/TestWebKitAPI/Tests/WebKit2/WillSendSubmitEvent.cpp
index 671c72943..1058cc1f3 100644
--- a/Tools/TestWebKitAPI/Tests/WebKit2/WillSendSubmitEvent.cpp
+++ b/Tools/TestWebKitAPI/Tests/WebKit2/WillSendSubmitEvent.cpp
@@ -41,14 +41,17 @@ static void didReceiveMessageFromInjectedBundle(WKContextRef, WKStringRef messag
     EXPECT_EQ(WKDictionaryGetTypeID(), WKGetTypeID(body));
     WKDictionaryRef values = static_cast<WKDictionaryRef>(body);
 
-    WKStringRef textFieldValueWK = static_cast<WKStringRef>(WKDictionaryGetItemForKey(values, WKStringCreateWithUTF8CString("textField")));
+    WKRetainPtr<WKStringRef> textFieldKey(AdoptWK, WKStringCreateWithUTF8CString("textField"));
+    WKStringRef textFieldValueWK = static_cast<WKStringRef>(WKDictionaryGetItemForKey(values, textFieldKey.get()));
     EXPECT_WK_STREQ("text field", textFieldValueWK);
 
-    WKStringRef passwordFieldValueWK = static_cast<WKStringRef>(WKDictionaryGetItemForKey(values, WKStringCreateWithUTF8CString("passwordField")));
+    WKRetainPtr<WKStringRef> passwordFieldKey(AdoptWK, WKStringCreateWithUTF8CString("passwordField"));
+    WKStringRef passwordFieldValueWK = static_cast<WKStringRef>(WKDictionaryGetItemForKey(values, passwordFieldKey.get()));
     EXPECT_WK_STREQ("password field", passwordFieldValueWK);
 
     // <input type="hidden"> fields are not sent.
-    WKStringRef hiddenFieldValueWK = static_cast<WKStringRef>(WKDictionaryGetItemForKey(values, WKStringCreateWithUTF8CString("hiddenField")));
+    WKRetainPtr<WKStringRef> hiddenFieldKey(AdoptWK, WKStringCreateWithUTF8CString("hiddenField"));
+    WKStringRef hiddenFieldValueWK = static_cast<WKStringRef>(WKDictionaryGetItemForKey(values, hiddenFieldKey.get()));
     EXPECT_NULL(hiddenFieldValueWK);
 }
 
diff --git a/Tools/WebKitTestRunner/Configurations/Base.xcconfig b/Tools/WebKitTestRunner/Configurations/Base.xcconfig
index 512104b17..ef87ffe66 100644
--- a/Tools/WebKitTestRunner/Configurations/Base.xcconfig
+++ b/Tools/WebKitTestRunner/Configurations/Base.xcconfig
@@ -21,8 +21,8 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 
-#include "CompilerVersion.xcconfig"
-
+CLANG_CXX_LANGUAGE_STANDARD = gnu++0x;
+CLANG_CXX_LIBRARY = libc++;
 CLANG_WARN_CXX0X_EXTENSIONS = NO;
 HEADER_SEARCH_PATHS = $(BUILT_PRODUCTS_DIR)/usr/local/include $(WEBCORE_PRIVATE_HEADERS_DIR)/ForwardingHeaders ${SRCROOT}/../../Source/JavaScriptCore/icu $(NEXT_ROOT)/usr/local/include/WebCoreTestSupport;
 FRAMEWORK_SEARCH_PATHS = $(SYSTEM_LIBRARY_DIR)/Frameworks/Quartz.framework/Frameworks $(SYSTEM_LIBRARY_DIR)/Frameworks/ApplicationServices.framework/Frameworks $(SYSTEM_LIBRARY_DIR)/Frameworks/CoreServices.framework/Frameworks;
@@ -34,6 +34,7 @@ GCC_ENABLE_CPP_EXCEPTIONS = NO;
 GCC_ENABLE_CPP_RTTI = NO;
 GCC_PRECOMPILE_PREFIX_HEADER = YES
 GCC_TREAT_WARNINGS_AS_ERRORS = YES
+GCC_VERSION = com.apple.compilers.llvm.clang.1_0;
 GCC_WARN_ABOUT_DEPRECATED_FUNCTIONS = NO
 GCC_WARN_UNUSED_FUNCTION = YES
 GCC_WARN_UNUSED_VARIABLE = YES
@@ -46,22 +47,9 @@ DEBUG_DEFINES_debug = ;
 DEBUG_DEFINES_normal = NDEBUG;
 DEBUG_DEFINES = $(DEBUG_DEFINES_$(CURRENT_VARIANT));
 
-CLANG_CXX_LIBRARY = $(CLANG_CXX_LIBRARY_$(TARGET_MAC_OS_X_VERSION_MAJOR));
-CLANG_CXX_LIBRARY_1060 = libstdc++;
-CLANG_CXX_LIBRARY_1070 = libc++;
-CLANG_CXX_LIBRARY_1080 = libc++;
-CLANG_CXX_LIBRARY_1090 = libc++;
-
-REAL_PLATFORM_NAME = $(REAL_PLATFORM_NAME_$(PLATFORM_NAME));
-REAL_PLATFORM_NAME_ = $(REAL_PLATFORM_NAME_macosx);
-REAL_PLATFORM_NAME_iphoneos = iphoneos;
-REAL_PLATFORM_NAME_iphonesimulator = iphonesimulator;
-REAL_PLATFORM_NAME_macosx = macosx;
-
 TARGET_MAC_OS_X_VERSION_MAJOR = $(MAC_OS_X_VERSION_MAJOR);
 
 TARGETING_SAME_OS_X_VERSION = $(TARGETING_SAME_OS_X_VERSION_$(MAC_OS_X_VERSION_MAJOR)_$(TARGET_MAC_OS_X_VERSION_MAJOR));
-TARGETING_SAME_OS_X_VERSION_1060_1060 = YES;
 TARGETING_SAME_OS_X_VERSION_1070_1070 = YES;
 TARGETING_SAME_OS_X_VERSION_1080_1080 = YES;
 TARGETING_SAME_OS_X_VERSION_1090_1090 = YES;
diff --git a/Tools/WebKitTestRunner/Configurations/CompilerVersion.xcconfig b/Tools/WebKitTestRunner/Configurations/CompilerVersion.xcconfig
deleted file mode 100644
index a8c7f75a0..000000000
--- a/Tools/WebKitTestRunner/Configurations/CompilerVersion.xcconfig
+++ /dev/null
@@ -1,84 +0,0 @@
-// Copyright (C) 2009, 2010, 2011 Apple Inc. All rights reserved.
-//
-// Redistribution and use in source and binary forms, with or without
-// modification, are permitted provided that the following conditions
-// are met:
-// 1. Redistributions of source code must retain the above copyright
-//    notice, this list of conditions and the following disclaimer.
-// 2. Redistributions in binary form must reproduce the above copyright
-//    notice, this list of conditions and the following disclaimer in the
-//    documentation and/or other materials provided with the distribution.
-//
-// THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
-// EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
-// IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
-// PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
-// CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
-// EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
-// PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
-// PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
-// OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
-
-IS_XCODE_0400 = $(IS_XCODE_0400_$(XCODE_VERSION_MINOR));
-IS_XCODE_0400_0400 = YES;
-
-IS_XCODE_0400_OR_0410 = $(IS_XCODE_0400_OR_0410_$(XCODE_VERSION_MINOR));
-IS_XCODE_0400_OR_0410_0400 = YES;
-IS_XCODE_0400_OR_0410_0410 = YES;
-
-// The version of the LLVM Compiler in Xcode 4.0 and earlier have difficulty compiling our code.
-LLVM_COMPILER_UNSUITABLE_FOR_DEBUG_BUILDS = $(LLVM_COMPILER_UNSUITABLE_FOR_DEBUG_BUILDS_$(XCODE_VERSION_MAJOR));
-LLVM_COMPILER_UNSUITABLE_FOR_DEBUG_BUILDS_0300 = YES;
-LLVM_COMPILER_UNSUITABLE_FOR_DEBUG_BUILDS_0400 = $(LLVM_COMPILER_UNSUITABLE_FOR_DEBUG_BUILDS_IS_XCODE_0400_$(IS_XCODE_0400));
-LLVM_COMPILER_UNSUITABLE_FOR_DEBUG_BUILDS_IS_XCODE_0400_YES = YES;
-
-// The version of the LLVM Compiler in Xcode 4.1 and earlier do not generate fast enough code.
-LLVM_COMPILER_UNSUITABLE_FOR_OPTIMIZED_BUILDS = $(LLVM_COMPILER_UNSUITABLE_FOR_OPTIMIZED_BUILDS_$(XCODE_VERSION_MAJOR));
-LLVM_COMPILER_UNSUITABLE_FOR_OPTIMIZED_BUILDS_0300 = YES;
-LLVM_COMPILER_UNSUITABLE_FOR_OPTIMIZED_BUILDS_0400 = $(LLVM_COMPILER_UNSUITABLE_FOR_OPTIMIZED_BUILDS_IS_XCODE_0400_OR_0410_$(IS_XCODE_0400_OR_0410));
-LLVM_COMPILER_UNSUITABLE_FOR_OPTIMIZED_BUILDS_IS_XCODE_0400_OR_0410_YES = YES;
-
-LLVM_COMPILER_SUITABLE_FOR_DEBUG_BUILDS = $(LLVM_COMPILER_SUITABLE_FOR_DEBUG_BUILDS_$(LLVM_COMPILER_UNSUITABLE_FOR_DEBUG_BUILDS));
-LLVM_COMPILER_SUITABLE_FOR_DEBUG_BUILDS_ = YES;
-LLVM_COMPILER_SUITABLE_FOR_DEBUG_BUILDS_YES = NO;
-
-LLVM_COMPILER_SUITABLE_FOR_OPTIMIZED_BUILDS = $(LLVM_COMPILER_SUITABLE_FOR_OPTIMIZED_BUILDS_$(LLVM_COMPILER_UNSUITABLE_FOR_OPTIMIZED_BUILDS));
-LLVM_COMPILER_SUITABLE_FOR_OPTIMIZED_BUILDS_ = YES;
-LLVM_COMPILER_SUITABLE_FOR_OPTIMIZED_BUILDS_YES = NO;
-
-
-// Use GCC 4.2 with Xcode 3.1, which includes GCC 4.2 but defaults to GCC 4.0.
-// Note that Xcode versions as new as 3.1.2 use XCODE_VERSION_ACTUAL for the minor version
-// number.  Newer versions of Xcode use XCODE_VERSION_MINOR for the minor version, and
-// XCODE_VERSION_ACTUAL for the full version number.
-TARGET_GCC_VERSION = $(TARGET_GCC_VERSION_$(REAL_PLATFORM_NAME));
-TARGET_GCC_VERSION_iphoneos = LLVM_GCC_42;
-TARGET_GCC_VERSION_iphonesimulator = GCC_42;
-TARGET_GCC_VERSION_macosx = $(TARGET_GCC_VERSION_macosx_$(TARGET_MAC_OS_X_VERSION_MAJOR));
-
-TARGET_GCC_VERSION_macosx_1050 = $(TARGET_GCC_VERSION_macosx_1050_$(XCODE_VERSION_MINOR));
-TARGET_GCC_VERSION_macosx_1050_ = $(TARGET_GCC_VERSION_macosx_1050_$(XCODE_VERSION_ACTUAL));
-TARGET_GCC_VERSION_macosx_1050_0310 = GCC_42;
-TARGET_GCC_VERSION_macosx_1050_0320 = GCC_42;
-
-TARGET_GCC_VERSION_macosx_1060 = $(TARGET_GCC_VERSION_macosx_1060_AND_1070_$(CONFIGURATION));
-TARGET_GCC_VERSION_macosx_1070 = $(TARGET_GCC_VERSION_macosx_1060_AND_1070_$(CONFIGURATION));
-TARGET_GCC_VERSION_macosx_1060_AND_1070_Debug = $(TARGET_GCC_VERSION_macosx_USE_LLVM_COMPILER_$(LLVM_COMPILER_SUITABLE_FOR_DEBUG_BUILDS));
-TARGET_GCC_VERSION_macosx_1060_AND_1070_Release = $(TARGET_GCC_VERSION_macosx_USE_LLVM_COMPILER_$(LLVM_COMPILER_SUITABLE_FOR_OPTIMIZED_BUILDS));
-TARGET_GCC_VERSION_macosx_1060_AND_1070_Production = $(TARGET_GCC_VERSION_macosx_USE_LLVM_COMPILER_$(LLVM_COMPILER_SUITABLE_FOR_OPTIMIZED_BUILDS));
-TARGET_GCC_VERSION_macosx_1060_NON_LLVM_FALLBACK = GCC_42;
-TARGET_GCC_VERSION_macosx_1070_NON_LLVM_FALLBACK = LLVM_GCC_42;
-
-TARGET_GCC_VERSION_macosx_USE_LLVM_COMPILER_YES = LLVM_COMPILER;
-TARGET_GCC_VERSION_macosx_USE_LLVM_COMPILER_NO = $(TARGET_GCC_VERSION_macosx_$(TARGET_MAC_OS_X_VERSION_MAJOR)_NON_LLVM_FALLBACK);
-
-TARGET_GCC_VERSION_macosx_1080 = LLVM_COMPILER;
-TARGET_GCC_VERSION_macosx_1090 = LLVM_COMPILER;
-
-GCC_VERSION = $(GCC_VERSION_$(TARGET_GCC_VERSION));
-GCC_VERSION_GCC_40 = 4.0;
-GCC_VERSION_GCC_42 = 4.2;
-GCC_VERSION_LLVM_GCC_42 = com.apple.compilers.llvmgcc42;
-GCC_VERSION_LLVM_COMPILER = com.apple.compilers.llvm.clang.1_0;
diff --git a/Tools/WebKitTestRunner/Configurations/DebugRelease.xcconfig b/Tools/WebKitTestRunner/Configurations/DebugRelease.xcconfig
index 1f5144554..5b97d1272 100644
--- a/Tools/WebKitTestRunner/Configurations/DebugRelease.xcconfig
+++ b/Tools/WebKitTestRunner/Configurations/DebugRelease.xcconfig
@@ -23,30 +23,21 @@
 
 #include "Base.xcconfig"
 
-ARCHS = $(ARCHS_$(TARGET_MAC_OS_X_VERSION_MAJOR));
-ARCHS_1050 = $(NATIVE_ARCH);
-ARCHS_1060 = $(ARCHS_STANDARD_32_64_BIT);
-ARCHS_1070 = $(ARCHS_STANDARD_32_64_BIT);
-ARCHS_1080 = $(ARCHS_STANDARD_32_64_BIT);
-ARCHS_1090 = $(ARCHS_STANDARD_32_64_BIT);
+ARCHS = $(ARCHS_STANDARD_32_64_BIT);
 
 ONLY_ACTIVE_ARCH = YES;
 
 MACOSX_DEPLOYMENT_TARGET = $(MACOSX_DEPLOYMENT_TARGET_$(TARGET_MAC_OS_X_VERSION_MAJOR))
-MACOSX_DEPLOYMENT_TARGET_1050 = 10.5;
-MACOSX_DEPLOYMENT_TARGET_1060 = 10.6;
 MACOSX_DEPLOYMENT_TARGET_1070 = 10.7;
 MACOSX_DEPLOYMENT_TARGET_1080 = 10.8;
 MACOSX_DEPLOYMENT_TARGET_1090 = 10.9;
 
 WEBKIT_UMBRELLA_FRAMEWORKS_DIR = $(BUILT_PRODUCTS_DIR);
 
-WEBKIT_SYSTEM_INTERFACE_LIBRARY = $(WEBKIT_SYSTEM_INTERFACE_LIBRARY_$(REAL_PLATFORM_NAME));
+WEBKIT_SYSTEM_INTERFACE_LIBRARY = $(WEBKIT_SYSTEM_INTERFACE_LIBRARY_$(PLATFORM_NAME));
 WEBKIT_SYSTEM_INTERFACE_LIBRARY_iphoneos = WebKitSystemInterface;
 WEBKIT_SYSTEM_INTERFACE_LIBRARY_iphonesimulator = $(WEBKIT_SYSTEM_INTERFACE_LIBRARY_iphoneos);
 WEBKIT_SYSTEM_INTERFACE_LIBRARY_macosx = $(WEBKIT_SYSTEM_INTERFACE_LIBRARY_macosx_$(TARGET_MAC_OS_X_VERSION_MAJOR));
-WEBKIT_SYSTEM_INTERFACE_LIBRARY_macosx_1050 = WebKitSystemInterfaceLeopard;
-WEBKIT_SYSTEM_INTERFACE_LIBRARY_macosx_1060 = WebKitSystemInterfaceSnowLeopard;
 WEBKIT_SYSTEM_INTERFACE_LIBRARY_macosx_1070 = WebKitSystemInterfaceLion;
 WEBKIT_SYSTEM_INTERFACE_LIBRARY_macosx_1080 = WebKitSystemInterfaceMountainLion;
 WEBKIT_SYSTEM_INTERFACE_LIBRARY_macosx_1090 = WebKitSystemInterfaceMountainLion;
diff --git a/Tools/WebKitTestRunner/EventSenderProxy.h b/Tools/WebKitTestRunner/EventSenderProxy.h
index ce2c1a612..92fe2d077 100644
--- a/Tools/WebKitTestRunner/EventSenderProxy.h
+++ b/Tools/WebKitTestRunner/EventSenderProxy.h
@@ -127,7 +127,7 @@ private:
 #endif
 #elif PLATFORM(EFL)
     Deque<WTREvent> m_eventQueue;
-    unsigned m_mouseButton;
+    WKEventMouseButton m_mouseButton;
 #if ENABLE(TOUCH_EVENTS)
     Eina_List* m_touchPoints;
 #endif
diff --git a/Tools/WebKitTestRunner/InjectedBundle/Bindings/TestRunner.idl b/Tools/WebKitTestRunner/InjectedBundle/Bindings/TestRunner.idl
index f9f619981..6dad1b2bd 100644
--- a/Tools/WebKitTestRunner/InjectedBundle/Bindings/TestRunner.idl
+++ b/Tools/WebKitTestRunner/InjectedBundle/Bindings/TestRunner.idl
@@ -184,7 +184,9 @@ interface TestRunner {
 
     // Work queue.
     void queueBackNavigation(in unsigned long howFarBackward);
+    void queueForwardNavigation(in unsigned long howFarForward);
     void queueLoad(in DOMString url, in DOMString target);
+    void queueLoadHTMLString(in DOMString content, in [Optional] DOMString baseURL, in [Optional] DOMString unreachableURL);
     void queueReload();
     void queueLoadingScript(in DOMString script);
     void queueNonLoadingScript(in DOMString script);
diff --git a/Tools/WebKitTestRunner/InjectedBundle/InjectedBundle.cpp b/Tools/WebKitTestRunner/InjectedBundle/InjectedBundle.cpp
index d64a734f0..9a5e8075c 100644
--- a/Tools/WebKitTestRunner/InjectedBundle/InjectedBundle.cpp
+++ b/Tools/WebKitTestRunner/InjectedBundle/InjectedBundle.cpp
@@ -253,6 +253,7 @@ void InjectedBundle::beginTesting(WKDictionaryRef settings)
     WKBundleSetPopupBlockingEnabled(m_bundle, m_pageGroup, false);
     WKBundleSetAlwaysAcceptCookies(m_bundle, false);
     WKBundleSetSerialLoadingEnabled(m_bundle, false);
+    WKBundleSetShadowDOMEnabled(m_bundle, true);
 
     WKBundleRemoveAllUserContent(m_bundle, m_pageGroup);
 
@@ -479,7 +480,16 @@ void InjectedBundle::queueBackNavigation(unsigned howFarBackward)
 
     WKRetainPtr<WKStringRef> messageName(AdoptWK, WKStringCreateWithUTF8CString("QueueBackNavigation"));
     WKRetainPtr<WKUInt64Ref> messageBody(AdoptWK, WKUInt64Create(howFarBackward));
-    WKBundlePostMessage(m_bundle, messageName.get(),  messageBody.get());
+    WKBundlePostMessage(m_bundle, messageName.get(), messageBody.get());
+}
+
+void InjectedBundle::queueForwardNavigation(unsigned howFarForward)
+{
+    m_useWorkQueue = true;
+
+    WKRetainPtr<WKStringRef> messageName(AdoptWK, WKStringCreateWithUTF8CString("QueueForwardNavigation"));
+    WKRetainPtr<WKUInt64Ref> messageBody(AdoptWK, WKUInt64Create(howFarForward));
+    WKBundlePostMessage(m_bundle, messageName.get(), messageBody.get());
 }
 
 void InjectedBundle::queueLoad(WKStringRef url, WKStringRef target)
@@ -499,6 +509,30 @@ void InjectedBundle::queueLoad(WKStringRef url, WKStringRef target)
     WKBundlePostMessage(m_bundle, messageName.get(), loadData.get());
 }
 
+void InjectedBundle::queueLoadHTMLString(WKStringRef content, WKStringRef baseURL, WKStringRef unreachableURL)
+{
+    m_useWorkQueue = true;
+
+    WKRetainPtr<WKStringRef> messageName(AdoptWK, WKStringCreateWithUTF8CString("QueueLoadHTMLString"));
+
+    WKRetainPtr<WKMutableDictionaryRef> loadData(AdoptWK, WKMutableDictionaryCreate());
+
+    WKRetainPtr<WKStringRef> contentKey(AdoptWK, WKStringCreateWithUTF8CString("content"));
+    WKDictionaryAddItem(loadData.get(), contentKey.get(), content);
+
+    if (baseURL) {
+        WKRetainPtr<WKStringRef> baseURLKey(AdoptWK, WKStringCreateWithUTF8CString("baseURL"));
+        WKDictionaryAddItem(loadData.get(), baseURLKey.get(), baseURL);
+    }
+
+    if (unreachableURL) {
+        WKRetainPtr<WKStringRef> unreachableURLKey(AdoptWK, WKStringCreateWithUTF8CString("unreachableURL"));
+        WKDictionaryAddItem(loadData.get(), unreachableURLKey.get(), unreachableURL);
+    }
+
+    WKBundlePostMessage(m_bundle, messageName.get(), loadData.get());
+}
+
 void InjectedBundle::queueReload()
 {
     m_useWorkQueue = true;
diff --git a/Tools/WebKitTestRunner/InjectedBundle/InjectedBundle.h b/Tools/WebKitTestRunner/InjectedBundle/InjectedBundle.h
index f3d2034ef..41469ec79 100644
--- a/Tools/WebKitTestRunner/InjectedBundle/InjectedBundle.h
+++ b/Tools/WebKitTestRunner/InjectedBundle/InjectedBundle.h
@@ -102,7 +102,9 @@ public:
     bool shouldProcessWorkQueue() const;
     void processWorkQueue();
     void queueBackNavigation(unsigned howFarBackward);
+    void queueForwardNavigation(unsigned howFarForward);
     void queueLoad(WKStringRef url, WKStringRef target);
+    void queueLoadHTMLString(WKStringRef content, WKStringRef baseURL = 0, WKStringRef unreachableURL = 0);
     void queueReload();
     void queueLoadingScript(WKStringRef script);
     void queueNonLoadingScript(WKStringRef script);
diff --git a/Tools/WebKitTestRunner/InjectedBundle/Target.pri b/Tools/WebKitTestRunner/InjectedBundle/Target.pri
index a46b9300d..d7305e3ac 100644
--- a/Tools/WebKitTestRunner/InjectedBundle/Target.pri
+++ b/Tools/WebKitTestRunner/InjectedBundle/Target.pri
@@ -28,7 +28,6 @@ SOURCES += \
     Bindings/JSWrapper.cpp \
     qt/ActivateFontsQt.cpp \
     qt/InjectedBundleQt.cpp \
-    qt/QtInitializeTestFonts.cpp \
     qt/TestRunnerQt.cpp
 
 # Adds the generated sources to SOURCES
@@ -46,7 +45,6 @@ HEADERS += \
     InjectedBundlePage.h \
     TestRunner.h \
     TextInputController.h \
-    qt/QtInitializeTestFonts.h
 
 DESTDIR = $${ROOT_BUILD_DIR}/lib
 
@@ -62,6 +60,7 @@ INCLUDEPATH += \
     $$PWD \
     $$PWD/.. \
     $$PWD/Bindings \
+    $${ROOT_WEBKIT_DIR}/Source/WebCore/platform/qt \
     $${ROOT_WEBKIT_DIR}/Source/WebCore/testing/js \
     $${ROOT_WEBKIT_DIR}/Source/WebKit/qt/WebCoreSupport
 
diff --git a/Tools/WebKitTestRunner/InjectedBundle/TestRunner.cpp b/Tools/WebKitTestRunner/InjectedBundle/TestRunner.cpp
index 23b5f34f2..a294da7d4 100644
--- a/Tools/WebKitTestRunner/InjectedBundle/TestRunner.cpp
+++ b/Tools/WebKitTestRunner/InjectedBundle/TestRunner.cpp
@@ -839,6 +839,11 @@ void TestRunner::queueBackNavigation(unsigned howFarBackward)
     InjectedBundle::shared().queueBackNavigation(howFarBackward);
 }
 
+void TestRunner::queueForwardNavigation(unsigned howFarForward)
+{
+    InjectedBundle::shared().queueForwardNavigation(howFarForward);
+}
+
 void TestRunner::queueLoad(JSStringRef url, JSStringRef target)
 {
     WKRetainPtr<WKURLRef> baseURLWK(AdoptWK, WKBundleFrameCopyURL(WKBundlePageGetMainFrame(InjectedBundle::shared().page()->page())));
@@ -848,6 +853,15 @@ void TestRunner::queueLoad(JSStringRef url, JSStringRef target)
     InjectedBundle::shared().queueLoad(urlStringWK.get(), toWK(target).get());
 }
 
+void TestRunner::queueLoadHTMLString(JSStringRef content, JSStringRef baseURL, JSStringRef unreachableURL)
+{
+    WKRetainPtr<WKStringRef> contentWK = toWK(content);
+    WKRetainPtr<WKStringRef> baseURLWK = baseURL ? toWK(baseURL) : WKRetainPtr<WKStringRef>();
+    WKRetainPtr<WKStringRef> unreachableURLWK = unreachableURL ? toWK(unreachableURL) : WKRetainPtr<WKStringRef>();
+
+    InjectedBundle::shared().queueLoadHTMLString(contentWK.get(), baseURLWK.get(), unreachableURLWK.get());
+}
+
 void TestRunner::queueReload()
 {
     InjectedBundle::shared().queueReload();
diff --git a/Tools/WebKitTestRunner/InjectedBundle/TestRunner.h b/Tools/WebKitTestRunner/InjectedBundle/TestRunner.h
index f92e34220..48b922c49 100644
--- a/Tools/WebKitTestRunner/InjectedBundle/TestRunner.h
+++ b/Tools/WebKitTestRunner/InjectedBundle/TestRunner.h
@@ -263,7 +263,9 @@ public:
 
     // Work queue.
     void queueBackNavigation(unsigned howFarBackward);
+    void queueForwardNavigation(unsigned howFarForward);
     void queueLoad(JSStringRef url, JSStringRef target);
+    void queueLoadHTMLString(JSStringRef content, JSStringRef baseURL, JSStringRef unreachableURL);
     void queueReload();
     void queueLoadingScript(JSStringRef script);
     void queueNonLoadingScript(JSStringRef script);
diff --git a/Tools/WebKitTestRunner/InjectedBundle/mac/ActivateFonts.mm b/Tools/WebKitTestRunner/InjectedBundle/mac/ActivateFonts.mm
index c49171a8c..f13dd9dab 100644
--- a/Tools/WebKitTestRunner/InjectedBundle/mac/ActivateFonts.mm
+++ b/Tools/WebKitTestRunner/InjectedBundle/mac/ActivateFonts.mm
@@ -141,6 +141,7 @@ static NSSet *allowedFontFamilySet()
         @"STFangsong",
         @"STHeiti",
         @"STIXGeneral",
+        @"STIXSizeOneSym",
         @"STKaiti",
         @"STSong",
         @"Symbol",
diff --git a/Tools/WebKitTestRunner/InjectedBundle/mac/InjectedBundlePageMac.mm b/Tools/WebKitTestRunner/InjectedBundle/mac/InjectedBundlePageMac.mm
index 46c273f1f..b0cb4e031 100644
--- a/Tools/WebKitTestRunner/InjectedBundle/mac/InjectedBundlePageMac.mm
+++ b/Tools/WebKitTestRunner/InjectedBundle/mac/InjectedBundlePageMac.mm
@@ -85,8 +85,7 @@ void InjectedBundlePage::platformDidStartProvisionalLoadForFrame(WKBundleFrameRe
         StringBuilder builder;
         builder.appendLiteral("CRASHING TEST: ");
         builder.append(testPath);
-        RetainPtr<CFStringRef> cfString(AdoptCF, builder.toString().createCFString());
-        WKSetCrashReportApplicationSpecificInformation(cfString.get());
+        WKSetCrashReportApplicationSpecificInformation(builder.toString().createCFString().get());
     }
 #endif
 }
diff --git a/Tools/WebKitTestRunner/InjectedBundle/qt/ActivateFontsQt.cpp b/Tools/WebKitTestRunner/InjectedBundle/qt/ActivateFontsQt.cpp
index 789e2177f..332ffcf02 100644
--- a/Tools/WebKitTestRunner/InjectedBundle/qt/ActivateFontsQt.cpp
+++ b/Tools/WebKitTestRunner/InjectedBundle/qt/ActivateFontsQt.cpp
@@ -30,14 +30,14 @@
 #include "config.h"
 #include "ActivateFonts.h"
 #include "DumpRenderTreeSupportQt.h"
-#include "QtInitializeTestFonts.h"
+#include "QtTestSupport.h"
 #include <QCoreApplication>
 
 namespace WTR {
 
 void activateFonts()
 {
-    WebKit::initializeTestFonts();
+    WebKit::QtTestSupport::initializeTestFonts();
     QCoreApplication::setAttribute(Qt::AA_Use96Dpi, true);
 }
 
diff --git a/Tools/WebKitTestRunner/InjectedBundle/qt/TestRunnerQt.cpp b/Tools/WebKitTestRunner/InjectedBundle/qt/TestRunnerQt.cpp
index f5d149b3d..1671ac73b 100644
--- a/Tools/WebKitTestRunner/InjectedBundle/qt/TestRunnerQt.cpp
+++ b/Tools/WebKitTestRunner/InjectedBundle/qt/TestRunnerQt.cpp
@@ -29,10 +29,12 @@
 
 #include "ActivateFonts.h"
 #include "InjectedBundle.h"
+#include "QtTestSupport.h"
 #include <QCoreApplication>
 #include <QDir>
 #include <QFontDatabase>
 #include <QObject>
+#include <QtCore/qglobal.h>
 #include <qwebsettings.h>
 
 namespace WTR {
@@ -59,13 +61,9 @@ private:
 
 void TestRunner::platformInitialize()
 {
-    // Make WebKit2 mimic the behaviour of DumpRenderTree, which is incorrect,
-    // but tests are successfully passed. On the long run, Qt will move to QRawFont,
-    // which makes the use of QFontDatabase unnecessary.
-    // See https://bugs.webkit.org/show_bug.cgi?id=53427
-    QWebSettings::clearMemoryCaches();
-    QFontDatabase::removeAllApplicationFonts();
+    WebKit::QtTestSupport::clearMemoryCaches();
     activateFonts();
+
     QObject::connect(&m_waitToDumpWatchdogTimer, SIGNAL(timeout()), WatchdogTimerHelper::instance(), SLOT(timerFired()));
 }
 
diff --git a/Tools/WebKitTestRunner/PlatformEfl.cmake b/Tools/WebKitTestRunner/PlatformEfl.cmake
index 4ab8966d2..1c6947258 100644
--- a/Tools/WebKitTestRunner/PlatformEfl.cmake
+++ b/Tools/WebKitTestRunner/PlatformEfl.cmake
@@ -25,7 +25,6 @@ LIST(APPEND WebKitTestRunner_INCLUDE_DIRECTORIES
     ${CAIRO_INCLUDE_DIRS}
     ${ECORE_INCLUDE_DIRS}
     ${ECORE_EVAS_INCLUDE_DIRS}
-    ${ECORE_X_INCLUDE_DIRS}
     ${EINA_INCLUDE_DIRS}
     ${EVAS_INCLUDE_DIRS}
     ${GLIB_INCLUDE_DIRS}
@@ -35,7 +34,6 @@ LIST(APPEND WebKitTestRunner_LIBRARIES
     ${CAIRO_LIBRARIES}
     ${ECORE_LIBRARIES}
     ${ECORE_EVAS_LIBRARIES}
-    ${ECORE_X_LIBRARIES}
     ${EINA_LIBRARIES}
     ${EVAS_LIBRARIES}
     ${GLIB_LIBRARIES}
@@ -43,6 +41,17 @@ LIST(APPEND WebKitTestRunner_LIBRARIES
     ${WTF_LIBRARY_NAME}
 )
 
+IF (ENABLE_ECORE_X)
+    LIST(APPEND WebKitTestRunner_INCLUDE_DIRECTORIES
+        ${ECORE_X_INCLUDE_DIRS}
+    )
+
+    LIST(APPEND WebKitTestRunner_LIBRARIES
+        ${ECORE_X_LIBRARIES}
+        ${X11_Xext_LIB}
+    )
+ENDIF ()
+
 LIST(APPEND WebKitTestRunnerInjectedBundle_SOURCES
     ${TOOLS_DIR}/DumpRenderTree/efl/FontManagement.cpp
 
diff --git a/Tools/WebKitTestRunner/PlatformWebView.h b/Tools/WebKitTestRunner/PlatformWebView.h
index 13859e143..60d2fc1d5 100644
--- a/Tools/WebKitTestRunner/PlatformWebView.h
+++ b/Tools/WebKitTestRunner/PlatformWebView.h
@@ -64,7 +64,7 @@ namespace WTR {
 
 class PlatformWebView {
 public:
-    PlatformWebView(WKContextRef, WKPageGroupRef);
+    PlatformWebView(WKContextRef, WKPageGroupRef, WKDictionaryRef options = 0);
     ~PlatformWebView();
 
     WKPageRef page();
@@ -88,7 +88,13 @@ public:
     void makeWebViewFirstResponder();
     void setWindowIsKey(bool isKey) { m_windowIsKey = isKey; }
     bool windowIsKey() const { return m_windowIsKey; }
-    
+
+#if PLATFORM(MAC)
+    bool viewSupportsOptions(WKDictionaryRef) const;
+#else
+    bool viewSupportsOptions(WKDictionaryRef) const { return true; }
+#endif
+
     WKRetainPtr<WKImageRef> windowSnapshotImage();
 
 private:
diff --git a/Tools/WebKitTestRunner/Target.pri b/Tools/WebKitTestRunner/Target.pri
index 120a027ce..39800ab8d 100644
--- a/Tools/WebKitTestRunner/Target.pri
+++ b/Tools/WebKitTestRunner/Target.pri
@@ -8,7 +8,6 @@ TEMPLATE = app
 TARGET = WebKitTestRunner
 
 HEADERS += \
-    $${ROOT_WEBKIT_DIR}/Tools/DumpRenderTree/qt/QtInitializeTestFonts.h \
     EventSenderProxy.h \
     GeolocationProviderMock.h \
     PlatformWebView.h \
@@ -19,7 +18,6 @@ HEADERS += \
     WorkQueueManager.h
 
 SOURCES += \
-    $${ROOT_WEBKIT_DIR}/Tools/DumpRenderTree/qt/QtInitializeTestFonts.cpp \
     qt/main.cpp \
     qt/EventSenderProxyQt.cpp \
     qt/PlatformWebViewQt.cpp \
@@ -39,10 +37,9 @@ WEBKIT += wtf javascriptcore webkit2
 
 DEFINES += USE_SYSTEM_MALLOC=1
 
-have?(FONTCONFIG): PKGCONFIG += fontconfig
-
 INCLUDEPATH += \
     $$PWD \
+    $${ROOT_WEBKIT_DIR}/Source/WebCore/platform/qt \
     $${ROOT_WEBKIT_DIR}/Tools/DumpRenderTree/qt
 
 PREFIX_HEADER = WebKitTestRunnerPrefix.h
diff --git a/Tools/WebKitTestRunner/TestController.cpp b/Tools/WebKitTestRunner/TestController.cpp
index e9ef0471d..07ff81bb7 100644
--- a/Tools/WebKitTestRunner/TestController.cpp
+++ b/Tools/WebKitTestRunner/TestController.cpp
@@ -81,6 +81,7 @@ TestController::TestController(int argc, const char* argv[])
     , m_printSeparators(false)
     , m_usingServerMode(false)
     , m_gcBetweenTests(false)
+    , m_shouldDumpPixelsForAllTests(false)
     , m_state(Initial)
     , m_doneResetting(false)
     , m_longTimeout(defaultLongTimeout)
@@ -95,9 +96,6 @@ TestController::TestController(int argc, const char* argv[])
     , m_isGeolocationPermissionAllowed(false)
     , m_policyDelegateEnabled(false)
     , m_policyDelegatePermissive(false)
-#if PLATFORM(MAC) || PLATFORM(QT) || PLATFORM(GTK) || PLATFORM(EFL)
-    , m_eventSenderProxy(new EventSenderProxy(this))
-#endif
 {
     initialize(argc, argv);
     controller = this;
@@ -283,11 +281,16 @@ void TestController::initialize(int argc, const char* argv[])
             m_gcBetweenTests = true;
             continue;
         }
+        if (argument == "--pixel-tests" || argument == "-p") {
+            m_shouldDumpPixelsForAllTests = true;
+            continue;
+        }
         if (argument == "--print-supported-features") {
             printSupportedFeatures = true;
             break;
         }
 
+
         // Skip any other arguments that begin with '--'.
         if (argument.length() >= 2 && argument[0] == '-' && argument[1] == '-')
             continue;
@@ -323,6 +326,18 @@ void TestController::initialize(int argc, const char* argv[])
         WKContextSetLocalStorageDirectory(m_context.get(), dumpRenderTreeTempWK.get());
         WKContextSetDiskCacheDirectory(m_context.get(), dumpRenderTreeTempWK.get());
         WKContextSetCookieStorageDirectory(m_context.get(), dumpRenderTreeTempWK.get());
+
+        std::string iconDatabaseFileTemp(dumpRenderTreeTemp);
+        // WebCore::pathByAppendingComponent is not used here because of the namespace,
+        // which leads us to this ugly #ifdef and file path concatenation.
+#if OS(WINDOWS)
+        const char separator = '\\';
+#else
+        const char separator = '/';
+#endif
+        iconDatabaseFileTemp = iconDatabaseFileTemp + separator + "WebpageIcons.db";
+        WKRetainPtr<WKStringRef> iconDatabaseFileTempWK = WKStringCreateWithUTF8CString(iconDatabaseFileTemp.c_str());
+        WKContextSetIconDatabasePath(m_context.get(), iconDatabaseFileTempWK.get());
     }
 
     platformInitializeContext();
@@ -343,8 +358,12 @@ void TestController::initialize(int argc, const char* argv[])
     if (testPluginDirectory())
         WKContextSetAdditionalPluginsDirectory(m_context.get(), testPluginDirectory());
 
-    m_mainWebView = adoptPtr(new PlatformWebView(m_context.get(), m_pageGroup.get()));
+    createWebViewWithOptions(0);
+}
 
+void TestController::createWebViewWithOptions(WKDictionaryRef options)
+{
+    m_mainWebView = adoptPtr(new PlatformWebView(m_context.get(), m_pageGroup.get(), options));
     WKPageUIClient pageUIClient = {
         kWKPageUIClientCurrentVersion,
         m_mainWebView.get(),
@@ -446,6 +465,21 @@ void TestController::initialize(int argc, const char* argv[])
     WKPageSetPagePolicyClient(m_mainWebView->page(), &pagePolicyClient);
 }
 
+void TestController::ensureViewSupportsOptions(WKDictionaryRef options)
+{
+    if (m_mainWebView && !m_mainWebView->viewSupportsOptions(options)) {
+        WKPageSetPageUIClient(m_mainWebView->page(), 0);
+        WKPageSetPageLoaderClient(m_mainWebView->page(), 0);
+        WKPageSetPagePolicyClient(m_mainWebView->page(), 0);
+        WKPageClose(m_mainWebView->page());
+        
+        m_mainWebView = nullptr;
+
+        createWebViewWithOptions(options);
+        resetStateToConsistentValues();
+    }
+}
+
 bool TestController::resetStateToConsistentValues()
 {
     m_state = Resetting;
@@ -467,6 +501,11 @@ bool TestController::resetStateToConsistentValues()
 
     // FIXME: This function should also ensure that there is only one page open.
 
+    // Reset the EventSender for each test.
+#if PLATFORM(MAC) || PLATFORM(QT) || PLATFORM(GTK) || PLATFORM(EFL)
+    m_eventSenderProxy = adoptPtr(new EventSenderProxy(this));
+#endif
+
     // Reset preferences
     WKPreferencesRef preferences = WKPageGroupGetPreferences(m_pageGroup.get());
     WKPreferencesResetTestRunnerOverrides(preferences);
@@ -629,7 +668,7 @@ bool TestController::runTest(const char* inputLine)
     m_state = RunningTest;
 
     m_currentInvocation = adoptPtr(new TestInvocation(command.pathOrURL));
-    if (command.shouldDumpPixels)
+    if (command.shouldDumpPixels || m_shouldDumpPixelsForAllTests)
         m_currentInvocation->setIsPixelTest(command.expectedPixelHash);
 
     m_currentInvocation->invoke();
diff --git a/Tools/WebKitTestRunner/TestController.h b/Tools/WebKitTestRunner/TestController.h
index 7081acdaa..56c3c4702 100644
--- a/Tools/WebKitTestRunner/TestController.h
+++ b/Tools/WebKitTestRunner/TestController.h
@@ -57,6 +57,8 @@ public:
     PlatformWebView* mainWebView() { return m_mainWebView.get(); }
     WKContextRef context() { return m_context.get(); }
 
+    void ensureViewSupportsOptions(WKDictionaryRef options);
+    
     // Runs the run loop until `done` is true or the timeout elapses.
     enum TimeoutDuration { ShortTimeout, LongTimeout, NoTimeout };
     bool useWaitToDumpWatchdogTimer() { return m_useWaitToDumpWatchdogTimer; }
@@ -83,6 +85,7 @@ public:
 
 private:
     void initialize(int argc, const char* argv[]);
+    void createWebViewWithOptions(WKDictionaryRef);
     void run();
 
     void runTestingServerLoop();
@@ -137,6 +140,7 @@ private:
     bool m_printSeparators;
     bool m_usingServerMode;
     bool m_gcBetweenTests;
+    bool m_shouldDumpPixelsForAllTests;
     std::vector<std::string> m_paths;
     WKRetainPtr<WKStringRef> m_injectedBundlePath;
     WKRetainPtr<WKStringRef> m_testPluginDirectory;
@@ -174,7 +178,9 @@ private:
     bool m_policyDelegateEnabled;
     bool m_policyDelegatePermissive;
 
-    EventSenderProxy* m_eventSenderProxy;
+#if PLATFORM(MAC) || PLATFORM(QT) || PLATFORM(GTK) || PLATFORM(EFL)
+    OwnPtr<EventSenderProxy> m_eventSenderProxy;
+#endif
 
     WorkQueueManager m_workQueueManager;
 };
diff --git a/Tools/WebKitTestRunner/TestInvocation.cpp b/Tools/WebKitTestRunner/TestInvocation.cpp
index fd9423220..1cb56bb71 100644
--- a/Tools/WebKitTestRunner/TestInvocation.cpp
+++ b/Tools/WebKitTestRunner/TestInvocation.cpp
@@ -143,9 +143,31 @@ static bool shouldOpenWebInspector(const char* pathOrURL)
 }
 #endif
 
+#if PLATFORM(MAC)
+static bool shouldUseTiledDrawing(const char* pathOrURL)
+{
+    return strstr(pathOrURL, "tiled-drawing/") || strstr(pathOrURL, "tiled-drawing\\");
+}
+#endif
+
+static void updateTiledDrawingForCurrentTest(const char* pathOrURL)
+{
+#if PLATFORM(MAC)
+    WKRetainPtr<WKMutableDictionaryRef> viewOptions = adoptWK(WKMutableDictionaryCreate());
+    WKRetainPtr<WKStringRef> useTiledDrawingKey = adoptWK(WKStringCreateWithUTF8CString("TiledDrawing"));
+    WKRetainPtr<WKBooleanRef> useTiledDrawingValue = adoptWK(WKBooleanCreate(shouldUseTiledDrawing(pathOrURL)));
+    WKDictionaryAddItem(viewOptions.get(), useTiledDrawingKey.get(), useTiledDrawingValue.get());
+
+    TestController::shared().ensureViewSupportsOptions(viewOptions.get());
+#else
+    UNUSED_PARAM(pathOrURL);
+#endif
+}
+
 void TestInvocation::invoke()
 {
     sizeWebViewForCurrentTest(m_pathOrURL.c_str());
+    updateTiledDrawingForCurrentTest(m_pathOrURL.c_str());
 
     WKRetainPtr<WKStringRef> messageName = adoptWK(WKStringCreateWithUTF8CString("BeginTest"));
     WKRetainPtr<WKMutableDictionaryRef> beginTestMessageBody = adoptWK(WKMutableDictionaryCreate());
@@ -447,6 +469,13 @@ void TestInvocation::didReceiveMessageFromInjectedBundle(WKStringRef messageName
         return;
     }
 
+    if (WKStringIsEqualToUTF8CString(messageName, "QueueForwardNavigation")) {
+        ASSERT(WKGetTypeID(messageBody) == WKUInt64GetTypeID());
+        uint64_t stepCount = WKUInt64GetValue(static_cast<WKUInt64Ref>(messageBody));
+        TestController::shared().workQueueManager().queueForwardNavigation(stepCount);
+        return;
+    }
+
     if (WKStringIsEqualToUTF8CString(messageName, "QueueLoad")) {
         ASSERT(WKGetTypeID(messageBody) == WKDictionaryGetTypeID());
         WKDictionaryRef loadDataDictionary = static_cast<WKDictionaryRef>(messageBody);
@@ -461,6 +490,23 @@ void TestInvocation::didReceiveMessageFromInjectedBundle(WKStringRef messageName
         return;
     }
 
+    if (WKStringIsEqualToUTF8CString(messageName, "QueueLoadHTMLString")) {
+        ASSERT(WKGetTypeID(messageBody) == WKDictionaryGetTypeID());
+        WKDictionaryRef loadDataDictionary = static_cast<WKDictionaryRef>(messageBody);
+
+        WKRetainPtr<WKStringRef> contentKey(AdoptWK, WKStringCreateWithUTF8CString("content"));
+        WKStringRef contentWK = static_cast<WKStringRef>(WKDictionaryGetItemForKey(loadDataDictionary, contentKey.get()));
+
+        WKRetainPtr<WKStringRef> baseURLKey(AdoptWK, WKStringCreateWithUTF8CString("baseURL"));
+        WKStringRef baseURLWK = static_cast<WKStringRef>(WKDictionaryGetItemForKey(loadDataDictionary, baseURLKey.get()));
+
+        WKRetainPtr<WKStringRef> unreachableURLKey(AdoptWK, WKStringCreateWithUTF8CString("unreachableURL"));
+        WKStringRef unreachableURLWK = static_cast<WKStringRef>(WKDictionaryGetItemForKey(loadDataDictionary, unreachableURLKey.get()));
+
+        TestController::shared().workQueueManager().queueLoadHTMLString(toWTFString(contentWK), baseURLWK ? toWTFString(baseURLWK) : String(), unreachableURLWK ? toWTFString(unreachableURLWK) : String());
+        return;
+    }
+
     if (WKStringIsEqualToUTF8CString(messageName, "QueueReload")) {
         TestController::shared().workQueueManager().queueReload();
         return;
diff --git a/Tools/WebKitTestRunner/WebKitTestRunner.xcodeproj/project.pbxproj b/Tools/WebKitTestRunner/WebKitTestRunner.xcodeproj/project.pbxproj
index 75ce94e63..530347b39 100644
--- a/Tools/WebKitTestRunner/WebKitTestRunner.xcodeproj/project.pbxproj
+++ b/Tools/WebKitTestRunner/WebKitTestRunner.xcodeproj/project.pbxproj
@@ -570,7 +570,7 @@
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 			shellPath = /bin/sh;
-			shellScript = "mkdir -p \"${BUILT_PRODUCTS_DIR}/DerivedSources/WebKitTestRunner\"\ncd \"${BUILT_PRODUCTS_DIR}/DerivedSources/WebKitTestRunner\"\n\nexport WebKitTestRunner=\"${SRCROOT}\"\nexport WebCoreScripts=\"${WEBCORE_PRIVATE_HEADERS_DIR}\"\n\nif [ ! $CC ]; then\n    case $TARGET_GCC_VERSION in\n        (GCC_42)\n            export CC=\"`xcrun -find gcc-4.2`\";;\n        (LLVM_GCC_42)\n            export CC=\"`xcrun -find llvm-gcc-4.2`\";;\n        (LLVM_COMPILER)\n            export CC=\"`xcrun -find clang`\";;\n    esac\nfi\n\nif [ \"${ACTION}\" = \"build\" -o \"${ACTION}\" = \"install\" -o \"${ACTION}\" = \"installhdrs\" ]; then\n    make -f \"${WebKitTestRunner}/DerivedSources.make\" -j `/usr/sbin/sysctl -n hw.availcpu`\nfi\n";
+			shellScript = "mkdir -p \"${BUILT_PRODUCTS_DIR}/DerivedSources/WebKitTestRunner\"\ncd \"${BUILT_PRODUCTS_DIR}/DerivedSources/WebKitTestRunner\"\n\nexport WebKitTestRunner=\"${SRCROOT}\"\nexport WebCoreScripts=\"${WEBCORE_PRIVATE_HEADERS_DIR}\"\n\nif [ ! $CC ]; then\n    export CC=\"`xcrun -find clang`\"\nfi\n\nif [ \"${ACTION}\" = \"build\" -o \"${ACTION}\" = \"install\" -o \"${ACTION}\" = \"installhdrs\" ]; then\n    make -f \"${WebKitTestRunner}/DerivedSources.make\" -j `/usr/sbin/sysctl -n hw.availcpu`\nfi\n";
 		};
 /* End PBXShellScriptBuildPhase section */
 
diff --git a/Tools/WebKitTestRunner/WorkQueueManager.cpp b/Tools/WebKitTestRunner/WorkQueueManager.cpp
index 738357908..84792303f 100644
--- a/Tools/WebKitTestRunner/WorkQueueManager.cpp
+++ b/Tools/WebKitTestRunner/WorkQueueManager.cpp
@@ -87,6 +87,18 @@ public:
     WKRetainPtr<WKStringRef> m_script;
 };
 
+class NavigationItem : public WorkQueueItem {
+public:
+    explicit NavigationItem(int index) : m_index(index) { }
+
+    WorkQueueItem::Type invoke() const
+    {
+        return goToItemAtIndex(m_index) ? WorkQueueItem::Loading : WorkQueueItem::NonLoading;
+    }
+
+    unsigned m_index;
+};
+
 WorkQueueManager::WorkQueueManager()
     : m_processing(false)
 {
@@ -141,18 +153,39 @@ void WorkQueueManager::queueLoad(const String& url, const String& target)
     enqueue(new LoadItem(url, target));
 }
 
-void WorkQueueManager::queueBackNavigation(unsigned howFarBackward)
+void WorkQueueManager::queueLoadHTMLString(const String& content, const String& baseURL, const String& unreachableURL)
 {
-    class BackNavigationItem : public WorkQueueItem {
+    class LoadHTMLStringItem : public WorkQueueItem {
     public:
-        explicit BackNavigationItem(unsigned howFarBackward) : m_howFarBackward(howFarBackward) { }
+        LoadHTMLStringItem(const String& content, const String& baseURL, const String& unreachableURL)
+            : m_content(AdoptWK, WKStringCreateWithUTF8CString(content.utf8().data()))
+            , m_baseURL(AdoptWK, WKURLCreateWithUTF8CString(baseURL.utf8().data()))
+            , m_unreachableURL(AdoptWK, WKURLCreateWithUTF8CString(unreachableURL.utf8().data()))
+        {
+        }
 
-        WorkQueueItem::Type invoke() const { return goToItemAtIndex(-m_howFarBackward) ? WorkQueueItem::Loading : WorkQueueItem::NonLoading; }
+        WorkQueueItem::Type invoke() const
+        {
+            WKPageLoadAlternateHTMLString(mainPage(), m_content.get(), m_baseURL.get(), m_unreachableURL.get());
+            return WorkQueueItem::Loading;
+        }
 
-        unsigned m_howFarBackward;
+        WKRetainPtr<WKStringRef> m_content;
+        WKRetainPtr<WKURLRef> m_baseURL;
+        WKRetainPtr<WKURLRef> m_unreachableURL;
     };
 
-    enqueue(new BackNavigationItem(howFarBackward));
+    enqueue(new LoadHTMLStringItem(content, baseURL, unreachableURL));
+}
+
+void WorkQueueManager::queueBackNavigation(unsigned howFarBackward)
+{
+    enqueue(new NavigationItem(-howFarBackward));
+}
+
+void WorkQueueManager::queueForwardNavigation(unsigned howFarForward)
+{
+    enqueue(new NavigationItem(howFarForward));
 }
 
 void WorkQueueManager::queueReload()
diff --git a/Tools/WebKitTestRunner/WorkQueueManager.h b/Tools/WebKitTestRunner/WorkQueueManager.h
index b9a22dde3..21d5ebb88 100644
--- a/Tools/WebKitTestRunner/WorkQueueManager.h
+++ b/Tools/WebKitTestRunner/WorkQueueManager.h
@@ -43,7 +43,9 @@ public:
     bool processWorkQueue(); // Returns 'true' if queue is processed (no new loading is started), returns 'false' otherwise.
 
     void queueLoad(const String& url, const String& target);
+    void queueLoadHTMLString(const String& content, const String& baseURL, const String& unreachableURL);
     void queueBackNavigation(unsigned howFarBackward);
+    void queueForwardNavigation(unsigned howFarForward);
     void queueReload();
     void queueLoadingScript(const String& script);
     void queueNonLoadingScript(const String& script);
diff --git a/Tools/WebKitTestRunner/efl/EventSenderProxyEfl.cpp b/Tools/WebKitTestRunner/efl/EventSenderProxyEfl.cpp
index fc225e3f4..f2829a96c 100644
--- a/Tools/WebKitTestRunner/efl/EventSenderProxyEfl.cpp
+++ b/Tools/WebKitTestRunner/efl/EventSenderProxyEfl.cpp
@@ -56,14 +56,6 @@ enum WTREventType {
     WTREventTypeLeapForward
 };
 
-enum WTRMouseButton {
-    WTRMouseButtonNone = -1,
-    WTRMouseButtonLeft,
-    WTRMouseButtonMiddle,
-    WTRMouseButtonRight,
-    WTRMouseButtonMiddleDuplicated,
-};
-
 enum EvasMouseButton {
     EvasMouseButtonNone = 0,
     EvasMouseButtonLeft,
@@ -121,15 +113,14 @@ struct KeyEventInfo : public RefCounted<KeyEventInfo> {
 
 static unsigned evasMouseButton(unsigned button)
 {
-    if (button == WTRMouseButtonLeft)
-        return EvasMouseButtonLeft;
-    if (button == WTRMouseButtonMiddle)
+    // The common case involves converting from a WKEventMouseButton (which
+    // starts at -1) to an EvasMouseButton (which a starts at 0). The special
+    // case for button 3 exists because of fast/events/mouse-click-events.html,
+    // which tests whether a 4th mouse button behaves as the middle one.
+    if (button <= kWKEventMouseButtonRightButton)
+        return button + 1;
+    if (button == kWKEventMouseButtonRightButton + 1)
         return EvasMouseButtonMiddle;
-    if (button == WTRMouseButtonRight)
-        return EvasMouseButtonRight;
-    if (button == WTRMouseButtonMiddleDuplicated)
-        return EvasMouseButtonMiddle;
-
     return EvasMouseButtonNone;
 }
 
@@ -292,8 +283,8 @@ EventSenderProxy::EventSenderProxy(TestController* testController)
     , m_leftMouseButtonDown(false)
     , m_clickCount(0)
     , m_clickTime(0)
-    , m_clickButton(WTRMouseButtonNone)
-    , m_mouseButton(WTRMouseButtonNone)
+    , m_clickButton(kWKEventMouseButtonNoButton)
+    , m_mouseButton(kWKEventMouseButtonNoButton)
 #if ENABLE(TOUCH_EVENTS)
     , m_touchPoints(0)
 #endif
@@ -371,7 +362,7 @@ void EventSenderProxy::mouseUp(unsigned button, WKEventModifiers wkModifiers)
     sendOrQueueEvent(WTREvent(WTREventTypeMouseUp, 0, wkModifiers, evasMouseButton(button)));
 
     if (m_mouseButton == button)
-        m_mouseButton = WTRMouseButtonNone;
+        m_mouseButton = kWKEventMouseButtonNoButton;
 
     m_clickPosition = m_position;
     m_clickTime = ecore_time_get();
@@ -382,12 +373,12 @@ void EventSenderProxy::mouseMoveTo(double x, double y)
     m_position.x = x;
     m_position.y = y;
 
-    sendOrQueueEvent(WTREvent(WTREventTypeMouseMove, 0, 0, WTRMouseButtonNone));
+    sendOrQueueEvent(WTREvent(WTREventTypeMouseMove, 0, 0, kWKEventMouseButtonNoButton));
 }
 
 void EventSenderProxy::mouseScrollBy(int horizontal, int vertical)
 {
-    WTREvent event(WTREventTypeMouseScrollBy, 0, 0, WTRMouseButtonNone);
+    WTREvent event(WTREventTypeMouseScrollBy, 0, 0, kWKEventMouseButtonNoButton);
     // We need to invert scrolling values since in EFL negative z value means that
     // canvas is scrolling down
     event.horizontal = -horizontal;
@@ -403,7 +394,7 @@ void EventSenderProxy::continuousMouseScrollBy(int horizontal, int vertical, boo
 void EventSenderProxy::leapForward(int milliseconds)
 {
     if (m_eventQueue.isEmpty())
-        m_eventQueue.append(WTREvent(WTREventTypeLeapForward, milliseconds, 0, WTRMouseButtonNone));
+        m_eventQueue.append(WTREvent(WTREventTypeLeapForward, milliseconds, 0, kWKEventMouseButtonNoButton));
 
     m_time += milliseconds / 1000.0;
 }
diff --git a/Tools/WebKitTestRunner/efl/PlatformWebViewEfl.cpp b/Tools/WebKitTestRunner/efl/PlatformWebViewEfl.cpp
index 06187a066..cb957d5d9 100644
--- a/Tools/WebKitTestRunner/efl/PlatformWebViewEfl.cpp
+++ b/Tools/WebKitTestRunner/efl/PlatformWebViewEfl.cpp
@@ -30,7 +30,11 @@ namespace WTR {
 
 static Ecore_Evas* initEcoreEvas()
 {
-    Ecore_Evas* ecoreEvas = ecore_evas_new(0, 0, 0, 800, 600, 0);
+    const char* engine = 0;
+#if defined(WTF_USE_ACCELERATED_COMPOSITING) && defined(HAVE_ECORE_X)
+    engine = "opengl_x11";
+#endif
+    Ecore_Evas* ecoreEvas = ecore_evas_new(engine, 0, 0, 800, 600, 0);
     if (!ecoreEvas)
         return 0;
 
@@ -40,7 +44,7 @@ static Ecore_Evas* initEcoreEvas()
     return ecoreEvas;
 }
 
-PlatformWebView::PlatformWebView(WKContextRef context, WKPageGroupRef pageGroup)
+PlatformWebView::PlatformWebView(WKContextRef context, WKPageGroupRef pageGroup, WKDictionaryRef /*options*/)
 {
     m_window = initEcoreEvas();
     Evas* evas = ecore_evas_get(m_window);
@@ -69,6 +73,11 @@ WKPageRef PlatformWebView::page()
 
 void PlatformWebView::focus()
 {
+    // In a few cases, an iframe might receive focus from JavaScript and Evas is not aware of it at all
+    // (WebCoreSupport::focusedFrameChanged() does not emit any notification). We then manually remove the
+    // focus from the view to make the call give focus to evas_object_focus_set(..., true) to be effectful.
+    if (WKPageGetFocusedFrame(page()) != WKPageGetMainFrame(page()))
+        evas_object_focus_set(m_view, false);
     evas_object_focus_set(m_view, true);
 }
 
diff --git a/Tools/WebKitTestRunner/efl/main.cpp b/Tools/WebKitTestRunner/efl/main.cpp
index 70b2a4485..b02ff357d 100644
--- a/Tools/WebKitTestRunner/efl/main.cpp
+++ b/Tools/WebKitTestRunner/efl/main.cpp
@@ -24,10 +24,24 @@
 #include <wtf/Assertions.h>
 #include <stdlib.h>
 
+#ifdef HAVE_ECORE_X
+#include <X11/Xlib.h>
+#include <X11/extensions/Xext.h>
+
+static int dummyExtensionErrorHandler(Display*, _Xconst char*, _Xconst char*)
+{
+    return 0;
+}
+#endif
+
 int main(int argc, char** argv)
 {
     WTFInstallReportBacktraceOnCrashHook();
 
+#ifdef HAVE_ECORE_X
+    XSetExtensionErrorHandler(dummyExtensionErrorHandler);
+#endif
+
     if (!ewk_init())
         return 1;
 
diff --git a/Tools/WebKitTestRunner/gtk/EventSenderProxyGtk.cpp b/Tools/WebKitTestRunner/gtk/EventSenderProxyGtk.cpp
index 7c7d590e9..cdbaec5b2 100644
--- a/Tools/WebKitTestRunner/gtk/EventSenderProxyGtk.cpp
+++ b/Tools/WebKitTestRunner/gtk/EventSenderProxyGtk.cpp
@@ -83,6 +83,10 @@ EventSenderProxy::EventSenderProxy(TestController* testController)
 {
 }
 
+EventSenderProxy::~EventSenderProxy()
+{
+}
+
 static guint getMouseButtonModifiers(int gdkButton)
 {
     if (gdkButton == 1)
diff --git a/Tools/WebKitTestRunner/gtk/PlatformWebViewGtk.cpp b/Tools/WebKitTestRunner/gtk/PlatformWebViewGtk.cpp
index f1615d4ac..bbef04ead 100644
--- a/Tools/WebKitTestRunner/gtk/PlatformWebViewGtk.cpp
+++ b/Tools/WebKitTestRunner/gtk/PlatformWebViewGtk.cpp
@@ -33,7 +33,7 @@
 
 namespace WTR {
 
-PlatformWebView::PlatformWebView(WKContextRef context, WKPageGroupRef pageGroup)
+PlatformWebView::PlatformWebView(WKContextRef context, WKPageGroupRef pageGroup, WKDictionaryRef /*options*/)
     : m_view(WKViewCreate(context, pageGroup))
     , m_window(gtk_window_new(GTK_WINDOW_POPUP))
     , m_windowIsKey(true)
diff --git a/Tools/WebKitTestRunner/mac/EventSenderProxy.mm b/Tools/WebKitTestRunner/mac/EventSenderProxy.mm
index dfe10745d..ece5b523e 100644
--- a/Tools/WebKitTestRunner/mac/EventSenderProxy.mm
+++ b/Tools/WebKitTestRunner/mac/EventSenderProxy.mm
@@ -111,6 +111,10 @@ EventSenderProxy::EventSenderProxy(TestController* testController)
 {
 }
 
+EventSenderProxy::~EventSenderProxy()
+{
+}
+
 void EventSenderProxy::updateClickCountForButton(int button)
 {
     if (m_time - m_clickTime < 1 && m_position == m_clickPosition && button == m_clickButton) {
@@ -385,15 +389,11 @@ void EventSenderProxy::mouseScrollBy(int x, int y)
     RetainPtr<CGEventRef> cgScrollEvent(AdoptCF, CGEventCreateScrollWheelEvent(0, kCGScrollEventUnitLine, 2, y, x));
 
     // CGEvent locations are in global display coordinates.
-    CGPoint lastGlobalMousePosition = {
-        m_position.x,
-        [[NSScreen mainScreen] frame].size.height - m_position.y
-    };
+    CGPoint lastGlobalMousePosition = CGPointMake(m_position.x, [[NSScreen mainScreen] frame].size.height - m_position.y);
     CGEventSetLocation(cgScrollEvent.get(), lastGlobalMousePosition);
 
     NSEvent *event = [NSEvent eventWithCGEvent:cgScrollEvent.get()];
-    NSView *targetView = [m_testController->mainWebView()->platformView() hitTest:[event locationInWindow]];
-    if (targetView)
+    if (NSView *targetView = [m_testController->mainWebView()->platformView() hitTest:[event locationInWindow]])
         [targetView scrollWheel:event];
 }
 
diff --git a/Tools/WebKitTestRunner/mac/PlatformWebViewMac.mm b/Tools/WebKitTestRunner/mac/PlatformWebViewMac.mm
index db5d1197c..4c7b15f58 100644
--- a/Tools/WebKitTestRunner/mac/PlatformWebViewMac.mm
+++ b/Tools/WebKitTestRunner/mac/PlatformWebViewMac.mm
@@ -25,6 +25,7 @@
 
 #include "config.h"
 #include "PlatformWebView.h"
+#include "TestController.h"
 
 #import <WebKit2/WKImageCG.h>
 #import <WebKit2/WKViewPrivate.h>
@@ -37,6 +38,32 @@
 @property (nonatomic, assign) WTR::PlatformWebView* platformWebView;
 @end
 
+@interface TestRunnerWKView : WKView {
+    BOOL _useTiledDrawing;
+}
+
+- (id)initWithFrame:(NSRect)frame contextRef:(WKContextRef)context pageGroupRef:(WKPageGroupRef)pageGroup useTiledDrawing:(BOOL)useTiledDrawing;
+
+@property (nonatomic, assign) BOOL useTiledDrawing;
+@end
+
+@implementation TestRunnerWKView
+
+@synthesize useTiledDrawing = _useTiledDrawing;
+
+- (id)initWithFrame:(NSRect)frame contextRef:(WKContextRef)context pageGroupRef:(WKPageGroupRef)pageGroup useTiledDrawing:(BOOL)useTiledDrawing
+{
+    _useTiledDrawing = useTiledDrawing;
+    return [super initWithFrame:frame contextRef:context pageGroupRef:pageGroup];
+}
+
+- (BOOL)_shouldUseTiledDrawingArea
+{
+    return _useTiledDrawing;
+}
+
+@end
+
 @implementation WebKitTestRunnerWindow
 @synthesize platformWebView = _platformWebView;
 
@@ -78,11 +105,14 @@
 
 namespace WTR {
 
-PlatformWebView::PlatformWebView(WKContextRef contextRef, WKPageGroupRef pageGroupRef)
+PlatformWebView::PlatformWebView(WKContextRef contextRef, WKPageGroupRef pageGroupRef, WKDictionaryRef options)
     : m_windowIsKey(true)
 {
+    WKRetainPtr<WKStringRef> useTiledDrawingKey(AdoptWK, WKStringCreateWithUTF8CString("TiledDrawing"));
+    bool useTiledDrawing = options ? WKBooleanGetValue(static_cast<WKBooleanRef>(WKDictionaryGetItemForKey(options, useTiledDrawingKey.get()))) : false;
+
     NSRect rect = NSMakeRect(0, 0, 800, 600);
-    m_view = [[WKView alloc] initWithFrame:rect contextRef:contextRef pageGroupRef:pageGroupRef];
+    m_view = [[TestRunnerWKView alloc] initWithFrame:rect contextRef:contextRef pageGroupRef:pageGroupRef useTiledDrawing:useTiledDrawing];
 
     NSRect windowRect = NSOffsetRect(rect, -10000, [(NSScreen *)[[NSScreen screens] objectAtIndex:0] frame].size.height - rect.size.height + 10000);
     m_window = [[WebKitTestRunnerWindow alloc] initWithContentRect:windowRect styleMask:NSBorderlessWindowMask backing:NSBackingStoreBuffered defer:YES];
@@ -168,4 +198,12 @@ WKRetainPtr<WKImageRef> PlatformWebView::windowSnapshotImage()
     return adoptWK(WKImageCreateFromCGImage(windowSnapshotImage.get(), 0));
 }
 
+bool PlatformWebView::viewSupportsOptions(WKDictionaryRef options) const
+{
+    WKRetainPtr<WKStringRef> useTiledDrawingKey(AdoptWK, WKStringCreateWithUTF8CString("TiledDrawing"));
+    bool useTiledDrawing = WKBooleanGetValue(static_cast<WKBooleanRef>(WKDictionaryGetItemForKey(options, useTiledDrawingKey.get())));
+
+    return useTiledDrawing == [(TestRunnerWKView *)m_view useTiledDrawing];
+}
+
 } // namespace WTR
diff --git a/Tools/WebKitTestRunner/mac/main.mm b/Tools/WebKitTestRunner/mac/main.mm
index 12326a4d3..b5c34f769 100644
--- a/Tools/WebKitTestRunner/mac/main.mm
+++ b/Tools/WebKitTestRunner/mac/main.mm
@@ -31,6 +31,7 @@ int main(int argc, const char* argv[])
 {
     NSAutoreleasePool *pool = [[NSAutoreleasePool alloc] init];
     [NSApplication sharedApplication];
+    [[NSUserDefaults standardUserDefaults] setVolatileDomain:[NSDictionary dictionaryWithObject:[NSNumber numberWithBool:NO] forKey:@"WebKitKerningAndLigaturesEnabledByDefault"] forName:NSArgumentDomain];
     {
         WTR::TestController controller(argc, argv);
     }
diff --git a/Tools/WebKitTestRunner/qt/EventSenderProxyQt.cpp b/Tools/WebKitTestRunner/qt/EventSenderProxyQt.cpp
index 7619d3160..e16e3efe0 100644
--- a/Tools/WebKitTestRunner/qt/EventSenderProxyQt.cpp
+++ b/Tools/WebKitTestRunner/qt/EventSenderProxyQt.cpp
@@ -72,6 +72,10 @@ EventSenderProxy::EventSenderProxy(TestController* testController)
     isReplayingEvents = false;
 }
 
+EventSenderProxy::~EventSenderProxy()
+{
+}
+
 static Qt::MouseButton getMouseButton(unsigned button)
 {
     Qt::MouseButton mouseButton;
@@ -246,12 +250,10 @@ void EventSenderProxy::keyDown(WKStringRef keyRef, WKEventModifiers modifiersRef
 void EventSenderProxy::updateClickCountForButton(int button)
 {
     if (m_time - m_clickTime < QApplication::doubleClickInterval() && m_position == m_clickPosition && button == m_clickButton) {
-        ++m_clickCount;
         m_clickTime = m_time;
         return;
     }
 
-    m_clickCount = 1;
     m_clickTime = m_time;
     m_clickPosition = m_position;
     m_clickButton = button;
@@ -267,9 +269,10 @@ void EventSenderProxy::mouseDown(unsigned button, WKEventModifiers wkModifiers)
     m_mouseButtons |= mouseButton;
 
     QPoint mousePos(m_position.x, m_position.y);
-    QMouseEvent* event = new QMouseEvent((m_clickCount == 2) ? QEvent::MouseButtonDblClick : QEvent::MouseButtonPress,
+    QMouseEvent* event = new QMouseEvent(QEvent::MouseButtonPress,
         mousePos, mousePos, mouseButton, m_mouseButtons, modifiers);
 
+    // We aren't generating MouseButtonDblClick events as they aren't used.
     sendOrQueueEvent(event);
 }
 
diff --git a/Tools/WebKitTestRunner/qt/PlatformWebViewQt.cpp b/Tools/WebKitTestRunner/qt/PlatformWebViewQt.cpp
index 00177db81..e1cce48a5 100644
--- a/Tools/WebKitTestRunner/qt/PlatformWebViewQt.cpp
+++ b/Tools/WebKitTestRunner/qt/PlatformWebViewQt.cpp
@@ -66,10 +66,8 @@ private Q_SLOTS:
             setSurfaceType(OpenGLSurface);
             create();
             QQuickWindowPrivate::get(this)->setRenderWithoutShowing(true);
-        } else {
-            QQuickWebViewExperimental experimental(m_view);
-            experimental.setRenderToOffscreenBuffer(true);
-        }
+        } else
+            m_view->experimental()->setRenderToOffscreenBuffer(true);
 
         QWindowSystemInterface::handleWindowActivated(this);
         m_view->page()->setFocus(true);
@@ -79,7 +77,7 @@ private:
     QQuickWebView* m_view;
 };
 
-PlatformWebView::PlatformWebView(WKContextRef contextRef, WKPageGroupRef pageGroupRef)
+PlatformWebView::PlatformWebView(WKContextRef contextRef, WKPageGroupRef pageGroupRef, WKDictionaryRef /*options*/)
     : m_view(new QQuickWebView(contextRef, pageGroupRef))
     , m_window(new WrapperWindow(m_view))
     , m_windowIsKey(true)
diff --git a/Tools/WebKitTestRunner/qt/main.cpp b/Tools/WebKitTestRunner/qt/main.cpp
index 31b750681..3c9d311c9 100644
--- a/Tools/WebKitTestRunner/qt/main.cpp
+++ b/Tools/WebKitTestRunner/qt/main.cpp
@@ -26,7 +26,7 @@
 
 #include "config.h"
 
-#include "QtInitializeTestFonts.h"
+#include "QtTestSupport.h"
 #include "TestController.h"
 #include "qquickwebview_p.h"
 
@@ -119,7 +119,7 @@ int main(int argc, char** argv)
 
     qputenv("QT_WEBKIT_THEME_NAME", "qstyle");
 
-    WebKit::initializeTestFonts();
+    WebKit::QtTestSupport::initializeTestFonts();
     QCoreApplication::setAttribute(Qt::AA_Use96Dpi, true);
 
     QQuickWebViewExperimental::setFlickableViewportEnabled(false);
diff --git a/Tools/WebKitTestRunner/win/PlatformWebViewWin.cpp b/Tools/WebKitTestRunner/win/PlatformWebViewWin.cpp
index 2fbcef922..91a03d2a3 100644
--- a/Tools/WebKitTestRunner/win/PlatformWebViewWin.cpp
+++ b/Tools/WebKitTestRunner/win/PlatformWebViewWin.cpp
@@ -48,7 +48,7 @@ static void registerWindowClass()
     RegisterClassExW(&wndClass);
 }
 
-PlatformWebView::PlatformWebView(WKContextRef contextRef, WKPageGroupRef pageGroupRef)
+PlatformWebView::PlatformWebView(WKContextRef contextRef, WKPageGroupRef pageGroupRef, WKDictionaryRef /*options*/)
     : m_windowIsKey(true)
 {
     registerWindowClass();
diff --git a/Tools/efl/jhbuild.modules b/Tools/efl/jhbuild.modules
index a3c0fd320..55287880d 100644
--- a/Tools/efl/jhbuild.modules
+++ b/Tools/efl/jhbuild.modules
@@ -162,20 +162,20 @@
  </autotools>
 
   <autotools id="eina">
-    <branch module="releases/eina-1.7.0.tar.gz" version="1.7.0"
-            checkoutdir="eina-1.7.0"
+    <branch module="releases/eina-1.7.1.tar.bz2" version="1.7.1"
+            checkoutdir="eina-1.7.1"
             repo="download.enlightenment.org"
-            hash="sha256:6aacededb08aa1090a1beecbf62acf3e2ce0676ac87d21c787c07983f801166f"
-            md5sum="303b81bbfff684eef0e5be70ba977012">
+            hash="sha256:af0b316734ba72d92fa7716005efd380f28677c76f0e0b6a3c5a9b524575a6ce"
+            md5sum="552c5e9042d9cb3dbdebbc0e211ef30b">
     </branch>
   </autotools>
 
   <autotools id="embryo">
-    <branch module="releases/embryo-1.7.0.tar.gz" version="1.7.0"
-            checkoutdir="embryo-1.7.0"
+    <branch module="releases/embryo-1.7.1.tar.bz2" version="1.7.1"
+            checkoutdir="embryo-1.7.1"
             repo="download.enlightenment.org"
-            hash="sha256:290b452e6cb87f64b11b529c7f67c40192f87a73cc4c5be93a95f17b76f65063"
-            md5sum="f46bb8ab1699cd7acb8463e50a3ffb4b">
+            hash="sha256:043563b8c1a66de117cfaaf76a4d9736e111007ce5c0cdcf2b1d83dd8b4df575"
+            md5sum="d66a0e91dfc37eeb4c362b2c46bd91ab">
     </branch>
     <dependencies>
       <dep package="eina"/>
@@ -183,20 +183,20 @@
   </autotools>
 
   <autotools id="evas">
-    <branch module="releases/evas-1.7.0.tar.gz" version="1.7.0"
-            checkoutdir="evas-1.7.0"
+    <branch module="releases/evas-1.7.1.tar.bz2" version="1.7.1"
+            checkoutdir="evas-1.7.1"
             repo="download.enlightenment.org"
-            hash="sha256:2d7a33d02d2da37647e4c0127fedebe00eeea14560d6c1b6ca9b0cccdae0de84"
-            md5sum="3359918f8e60c778b861cf1cde02d3a9">
+            hash="sha256:57966a16fdb20e94deefe83ec0f990607413f7952f9755ed23ce81aea49b670c"
+            md5sum="e33c1d270b16e45c2337424aa2faaaa0">
     </branch>
   </autotools>
 
   <autotools id="ecore">
-    <branch module="releases/ecore-1.7.0.tar.gz" version="1.7.0"
-            checkoutdir="ecore-1.7.0"
+    <branch module="releases/ecore-1.7.1.tar.bz2" version="1.7.1"
+            checkoutdir="ecore-1.7.1"
             repo="download.enlightenment.org"
-            hash="sha256:f009e17376b7f3fb6ce6b45648d2a0131a152943b502fa34cc4bd018f67da8bb"
-            md5sum="cf0b5e980a77dc0d1bdedf2bcc60e862">
+            hash="sha256:fb5f547a0a6556b5f0e274b65cfbe42f4eb8371f20d00005cd4f5a78a6b6a5d8"
+            md5sum="94fd264e478323a1100b3cfff833d28d">
     </branch>
     <dependencies>
       <dep package="eina"/>
@@ -205,11 +205,11 @@
   </autotools>
 
   <autotools id="eet">
-    <branch module="releases/eet-1.7.0.tar.gz" version="1.7.0"
-            checkoutdir="eet-1.7.0"
+    <branch module="releases/eet-1.7.1.tar.bz2" version="1.7.1"
+            checkoutdir="eet-1.7.1"
             repo="download.enlightenment.org"
-            hash="sha256:9bca5becaaa5abf4b7ac0f80de68d3b9a8f1abce7eca4175e1ad82953783d209"
-            md5sum="46e989eb4dddd942b4564299e19d9f64">
+            hash="sha256:3e5679c06792f0a1c4b5b158468afbcec3b510c60345055d5964fdbe2abba3eb"
+            md5sum="2974f892e2be5e2fa08296714e97c407">
     </branch>
     <dependencies>
       <dep package="libgcrypt"/>
@@ -218,11 +218,11 @@
   </autotools>
 
   <autotools id="edje">
-    <branch module="releases/edje-1.7.0.tar.gz" version="1.7.0"
-            checkoutdir="edje-1.7.0"
+    <branch module="releases/edje-1.7.1.tar.bz2" version="1.7.1"
+            checkoutdir="edje-1.7.1"
             repo="download.enlightenment.org"
-            hash="sha256:d6df9a7bf11c4605f55a2e7c209210044f8dc4f3332135f6256676d2f937621b"
-            md5sum="37e15c5d6e7c2676728bda75109b2218">
+            hash="sha256:d924d7ade92055a5c83d3c43171982b7f006db9f5c923fb39e0523405ec4534c"
+            md5sum="766747bc1b8a1755952e275b6058cf30">
     </branch>
     <dependencies>
       <dep package="eet"/>
@@ -233,11 +233,11 @@
   </autotools>
 
   <autotools id="e_dbus">
-    <branch module="releases/e_dbus-1.7.0.tar.gz" version="1.7.0"
-            checkoutdir="e_dbus-1.7.0"
+    <branch module="releases/e_dbus-1.7.1.tar.bz2" version="1.7.1"
+            checkoutdir="e_dbus-1.7.1"
             repo="download.enlightenment.org"
-            hash="sha256:6ee303bd0e2f91a6be08433df474377494ba6815441e5e6b79a5d284ead2a768"
-            md5sum="3d59bfb00763a61976a976be925e1cbf">
+            hash="sha256:d3a3e0b81f6bb69d2fc3886c9885dad27ebf14b60c4a0bbd5a2a510b5a5ff2d1"
+            md5sum="3fa25de2880c2ff9d78d070d4792f570">
     </branch>
     <dependencies>
       <dep package="ecore"/>
@@ -246,11 +246,11 @@
   </autotools>
 
   <autotools id="eeze">
-    <branch module="releases/eeze-1.7.0.tar.gz" version="1.7.0"
-            checkoutdir="eeze-1.7.0"
+    <branch module="releases/eeze-1.7.1.tar.bz2" version="1.7.1"
+            checkoutdir="eeze-1.7.1"
             repo="download.enlightenment.org"
-            hash="sha256:7db8709445114d1fe1c3609cf79a06e13a3d584a5a3dfd557642ddc65ac3a202"
-            md5sum="60a8bb62e3d2cc7dfac14f1cd62343e2">
+            hash="sha256:6a696e2fe1ad14983ca7555eed2c50dd39f9a084e04475f0d25fd31d32e3cd58"
+            md5sum="0e9d008a9ae17de2aea82a34ee62691e">
     </branch>
     <dependencies>
       <dep package="ecore"/>
@@ -259,11 +259,11 @@
   </autotools>
 
   <autotools id="efreet">
-    <branch module="releases/efreet-1.7.0.tar.gz" version="1.7.0"
-            checkoutdir="efreet-1.7.0"
+    <branch module="releases/efreet-1.7.1.tar.bz2" version="1.7.1"
+            checkoutdir="efreet-1.7.1"
             repo="download.enlightenment.org"
-            hash="sha256:16a41a03d55febf30f2dd786b51be3e370fc563f3335dd26832e0eaa88516c79"
-            md5sum="f039197e14288ecef94eeab040cbbdb4">
+            hash="sha256:c844ed545f1c9438c73af4e4d037401a653babaab0a4e4b69377a2de49431eea"
+            md5sum="0fc2b3bf93dc3a9f293c348339163ba3">
     </branch>
     <dependencies>
         <deb package="ecore"/>
@@ -274,11 +274,11 @@
 
   <autotools id="elementary"
              autogenargs="--disable-web">
-    <branch module="releases/elementary-1.7.0.tar.gz" version="1.7.0"
-            checkoutdir="elementary-1.7.0"
+    <branch module="releases/elementary-1.7.1.tar.bz2" version="1.7.1"
+            checkoutdir="elementary-1.7.1"
             repo="download.enlightenment.org"
-            hash="sha256:7e7deeb4e3a9bbb9c7b7a89c2efbe269a1a6a44ef380bf91c1066d128163e2d3"
-            md5sum="45263c5d107981a44d28734c82e9fae1">
+            hash="sha256:54dd82ca156f024de91e375ae9f7ad9579cb0d8fb0bcbf9b16e5b4165d5ac483"
+            md5sum="9f43658594d8e837773c8b6573b654dd">
     </branch>
     <dependencies>
         <deb package="edje"/>
diff --git a/Tools/lldb/lldb_webkit.py b/Tools/lldb/lldb_webkit.py
new file mode 100644
index 000000000..37844f89b
--- /dev/null
+++ b/Tools/lldb/lldb_webkit.py
@@ -0,0 +1,192 @@
+# Copyright (C) 2012 Apple. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+# 1.  Redistributions of source code must retain the above copyright
+#     notice, this list of conditions and the following disclaimer.
+# 2.  Redistributions in binary form must reproduce the above copyright
+#     notice, this list of conditions and the following disclaimer in the
+#     documentation and/or other materials provided with the distribution.
+#
+# THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+# EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+# WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+# DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+# DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+# (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+# LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+# ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+# SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+"""
+    LLDB Support for WebKit Types
+
+    Add the following to your .lldbinit file to add WebKit Type summaries in LLDB and Xcode:
+
+    command script import {Path to WebKit Root}/Tools/lldb/lldb_webkit.py
+
+"""
+
+import lldb
+
+
+def __lldb_init_module(debugger, dict):
+    debugger.HandleCommand('type summary add --expand -F lldb_webkit.WTFString_SummaryProvider WTF::String')
+    debugger.HandleCommand('type summary add --expand -F lldb_webkit.WTFStringImpl_SummaryProvider WTF::StringImpl')
+    debugger.HandleCommand('type summary add --expand -F lldb_webkit.WTFAtomicString_SummaryProvider WTF::AtomicString')
+    debugger.HandleCommand('type summary add --expand -F lldb_webkit.WTFVector_SummaryProvider -x "WTF::Vector<.+>$"')
+    debugger.HandleCommand('type synthetic add -x "WTF::Vector<.+>$" --python-class lldb_webkit.WTFVectorProvider')
+
+
+def WTFString_SummaryProvider(valobj, dict):
+    provider = WTFStringProvider(valobj, dict)
+    return "{ length = %d, contents = '%s' }" % (provider.get_length(), provider.to_string())
+
+
+def WTFStringImpl_SummaryProvider(valobj, dict):
+    provider = WTFStringImplProvider(valobj, dict)
+    return "{ length = %d, is8bit = %d, contents = '%s' }" % (provider.get_length(), provider.is_8bit(), provider.to_string())
+
+
+def WTFAtomicString_SummaryProvider(valobj, dict):
+    return WTFString_SummaryProvider(valobj.GetChildMemberWithName('m_string'), dict)
+
+
+def WTFVector_SummaryProvider(valobj, dict):
+    provider = WTFVectorProvider(valobj, dict)
+    return "{ size = %d, capacity = %d }" % (provider.size, provider.capacity)
+
+# FIXME: Provide support for the following types:
+# def WTFVector_SummaryProvider(valobj, dict):
+# def WTFCString_SummaryProvider(valobj, dict):
+# def WebCoreKURLGooglePrivate_SummaryProvider(valobj, dict):
+# def WebCoreQualifiedName_SummaryProvider(valobj, dict):
+# def JSCIdentifier_SummaryProvider(valobj, dict):
+# def JSCJSString_SummaryProvider(valobj, dict):
+
+
+def guess_string_length(valobj, error):
+    if not valobj.GetValue():
+        return 0
+
+    for i in xrange(0, 2048):
+        if valobj.GetPointeeData(i, 1).GetUnsignedInt16(error, 0) == 0:
+            return i
+
+    return 256
+
+
+def ustring_to_string(valobj, error, length=None):
+    if length is None:
+        length = guess_string_length(valobj, error)
+    else:
+        length = int(length)
+
+    out_string = u""
+    for i in xrange(0, length):
+        char_value = valobj.GetPointeeData(i, 1).GetUnsignedInt16(error, 0)
+        out_string = out_string + unichr(char_value)
+
+    return out_string.encode('utf-8')
+
+
+def lstring_to_string(valobj, error, length=None):
+    if length is None:
+        length = guess_string_length(valobj, error)
+    else:
+        length = int(length)
+
+    out_string = u""
+    for i in xrange(0, length):
+        char_value = valobj.GetPointeeData(i, 1).GetUnsignedInt8(error, 0)
+        out_string = out_string + unichr(char_value)
+
+    return out_string.encode('utf-8')
+
+
+class WTFStringImplProvider:
+    def __init__(self, valobj, dict):
+        self.valobj = valobj
+
+    def get_length(self):
+        return self.valobj.GetChildMemberWithName('m_length').GetValueAsUnsigned(0)
+
+    def get_data8(self):
+        return self.valobj.GetChildAtIndex(2).GetChildMemberWithName('m_data8')
+
+    def get_data16(self):
+        return self.valobj.GetChildAtIndex(2).GetChildMemberWithName('m_data16')
+
+    def to_string(self):
+        error = lldb.SBError()
+        if self.is_8bit():
+            return lstring_to_string(self.get_data8(), error, self.get_length())
+        return ustring_to_string(self.get_data16(), error, self.get_length())
+
+    def is_8bit(self):
+        # FIXME: find a way to access WTF::StringImpl::s_hashFlag8BitBuffer
+        return bool(self.valobj.GetChildMemberWithName('m_hashAndFlags').GetValueAsUnsigned(0) \
+            & 1 << 6)
+
+
+class WTFStringProvider:
+    def __init__(self, valobj, dict):
+        self.valobj = valobj
+
+    def stringimpl(self):
+        impl_ptr = self.valobj.GetChildMemberWithName('m_impl').GetChildMemberWithName('m_ptr')
+        return WTFStringImplProvider(impl_ptr, dict)
+
+    def get_length(self):
+        impl = self.stringimpl()
+        if not impl:
+            return 0
+        return impl.get_length()
+
+    def to_string(self):
+        impl = self.stringimpl()
+        if not impl:
+            return u""
+        return impl.to_string()
+
+
+class WTFVectorProvider:
+    def __init__(self, valobj, internal_dict):
+        self.valobj = valobj
+        self.update()
+
+    def num_children(self):
+        return self.size + 2
+
+    def get_child_index(self, name):
+        if name == "m_size":
+            return self.size
+        elif name == "m_buffer":
+            return self.size + 1
+        else:
+            return int(name.lstrip('[').rstrip(']'))
+
+    def get_child_at_index(self, index):
+        if index == self.size:
+            return self.valobj.GetChildMemberWithName("m_size")
+        elif index == self.size + 1:
+            return self.vector_buffer
+        elif index < self.size:
+            offset = index * self.data_size
+            child = self.buffer.CreateChildAtOffset('[' + str(index) + ']', offset, self.data_type)
+            return child
+        else:
+            return None
+
+    def update(self):
+        self.vector_buffer = self.valobj.GetChildMemberWithName('m_buffer')
+        self.buffer = self.vector_buffer.GetChildMemberWithName('m_buffer')
+        self.size = self.valobj.GetChildMemberWithName('m_size').GetValueAsUnsigned(0)
+        self.capacity = self.vector_buffer.GetChildMemberWithName('m_capacity').GetValueAsUnsigned(0)
+        self.data_type = self.buffer.GetType().GetPointeeType()
+        self.data_size = self.data_type.GetByteSize()
+
+    def has_children(self):
+        return True
diff --git a/Tools/qmake/mkspecs/features/default_pre.prf b/Tools/qmake/mkspecs/features/default_pre.prf
index a827f0edc..39eec9bb5 100644
--- a/Tools/qmake/mkspecs/features/default_pre.prf
+++ b/Tools/qmake/mkspecs/features/default_pre.prf
@@ -115,5 +115,5 @@ isEmpty(SQLITE3SRCDIR) {
 FLEX = flex
 win32: FLEX = win_flex
 
-EXEEXT =
-win32: EXEEXT = .exe
+BIN_EXTENSION =
+win32: BIN_EXTENSION = .exe
diff --git a/Tools/qmake/mkspecs/features/features.prf b/Tools/qmake/mkspecs/features/features.prf
index d7f0301d6..bc285a28e 100644
--- a/Tools/qmake/mkspecs/features/features.prf
+++ b/Tools/qmake/mkspecs/features/features.prf
@@ -127,6 +127,7 @@ defineTest(detectFeatures) {
     # GraphicsSurface requires GraphicsContext3D and hence use_3d_graphics
     use?(3d_graphics) {
         mac: WEBKIT_CONFIG += use_graphics_surface
+        win32:contains(QT_CONFIG, opengles2): WEBKIT_CONFIG += use_graphics_surface
         linux-*:contains(WEBKIT_CONFIG, have_glx):contains(WEBKIT_CONFIG, have_xcomposite):contains(WEBKIT_CONFIG, have_xrender): WEBKIT_CONFIG += use_graphics_surface
     }
 
diff --git a/Tools/qmake/mkspecs/features/features.pri b/Tools/qmake/mkspecs/features/features.pri
index 33cc0409f..1272ece02 100644
--- a/Tools/qmake/mkspecs/features/features.pri
+++ b/Tools/qmake/mkspecs/features/features.pri
@@ -88,6 +88,7 @@ FEATURE_DEFAULTS = \
     ENABLE_PAGE_VISIBILITY_API=1 \
     ENABLE_PROGRESS_ELEMENT=1 \
     ENABLE_QUOTA=0 \
+    ENABLE_RESOLUTION_MEDIA_QUERY=1 \
     ENABLE_REQUEST_ANIMATION_FRAME=1 \
     ENABLE_SCRIPTED_SPEECH=0 \
     ENABLE_SHADOW_DOM=0 \
@@ -103,7 +104,6 @@ FEATURE_DEFAULTS = \
     ENABLE_TOUCH_ADJUSTMENT=1 \
     ENABLE_TOUCH_EVENTS=1 \
     ENABLE_TOUCH_ICON_LOADING=0 \
-    ENABLE_UNDO_MANAGER=0 \
     ENABLE_VIBRATION=0 \
     ENABLE_VIDEO=0 \
     ENABLE_VIDEO_TRACK=0 \
@@ -112,4 +112,5 @@ FEATURE_DEFAULTS = \
     ENABLE_WEB_SOCKETS=1 \
     ENABLE_WEB_TIMING=1 \
     ENABLE_WORKERS=1 \
+    ENABLE_XHR_TIMEOUT = 0 \
     ENABLE_XSLT=0 \
diff --git a/WebKitLibraries/ChangeLog b/WebKitLibraries/ChangeLog
index 090e056ef..3a345a4af 100644
--- a/WebKitLibraries/ChangeLog
+++ b/WebKitLibraries/ChangeLog
@@ -1,3 +1,94 @@
+2012-11-06  Anders Carlsson  <andersca@apple.com>
+
+        Build fix.
+
+        * WebKitSystemInterface.h:
+
+2012-11-06  Anders Carlsson  <andersca@apple.com>
+
+        Update Java related WKSI function names
+        https://bugs.webkit.org/show_bug.cgi?id=101414
+
+        Reviewed by Sam Weinig.
+
+        Roll WebKitSystemInterface DEPS.
+
+        * WebKitSystemInterface.h:
+        * libWebKitSystemInterfaceLion.a:
+        * libWebKitSystemInterfaceMountainLion.a:
+
+2012-11-06  Alexey Proskuryakov  <ap@apple.com>
+
+        Clean up which storage cookie jar functions use
+        https://bugs.webkit.org/show_bug.cgi?id=101395
+
+        Reviewed by Brady Eidson.
+
+        * WebKitSystemInterface.h:
+        * libWebKitSystemInterfaceLion.a:
+        * libWebKitSystemInterfaceMountainLion.a:
+        Added WKHTTPCookies() and WKDeleteAllHTTPCookies(). Updated ifdefs for currently
+        supported OS versions.
+
+2012-11-06  Alexey Proskuryakov  <ap@apple.com>
+
+        Delete Leopard and Snow Leopard versions of WKSI. These have not been updated in ages.
+
+        Rubber-stampted by Mark Rowe.
+
+        * libWebKitSystemInterfaceLeopard.a: Removed.
+        * libWebKitSystemInterfaceSnowLeopard.a: Removed.
+
+2012-11-05  Alexey Proskuryakov  <ap@apple.com>
+
+        Get rid of setCookieStoragePrivateBrowsingEnabled.
+        https://bugs.webkit.org/show_bug.cgi?id=101247
+
+        Reviewed by Brady Eidson.
+
+        * WebKitSystemInterface.h: Removed the function.
+
+2012-11-02  Anders Carlsson  <andersca@apple.com>
+
+        Don't instantiate the Java plug-in if it's inactive
+        https://bugs.webkit.org/show_bug.cgi?id=101102
+        <rdar://problem/12595679>
+
+        Reviewed by Andreas Kling.
+
+        Update WebKitSystemInterface to a version that has WKJLReportWebComponentsUsed.
+
+        * WebKitSystemInterface.h:
+        * libWebKitSystemInterfaceLion.a:
+        * libWebKitSystemInterfaceMountainLion.a:
+        Roll WebKitSystemInterface DERPS.
+
+2012-10-25  Dominik Röttsches  <dominik.rottsches@intel.com>
+
+        Conditionalize XHR timeout support
+        https://bugs.webkit.org/show_bug.cgi?id=100356
+
+        Reviewed by Adam Barth.
+
+        Adding ENABLE_XHR_TIMEOUT feature, which is default off for Apple Win.
+        See also https://bugs.webkit.org/show_bug.cgi?id=100349 for an attempt
+        to fix timeout support for CF Network.
+
+        * win/tools/vsprops/FeatureDefines.vsprops:
+        * win/tools/vsprops/FeatureDefinesCairo.vsprops:
+
+2012-10-24  Eric Carlson  <eric.carlson@apple.com>
+
+        Allow ports to override text track rendering style
+        https://bugs.webkit.org/show_bug.cgi?id=97800
+        <rdar://problem/12044964>
+
+        Reviewed by Maciej Stachowiak.
+
+        Update WKSI header with SPI for getting the user caption appearance preferences.
+
+        * WebKitSystemInterface.h:
+
 2012-10-19  Dongwoo Joshua Im  <dw.im@samsung.com>
 
         Rename ENABLE_CSS3_TEXT_DECORATION to ENABLE_CSS3_TEXT
diff --git a/WebKitLibraries/WebKitSystemInterface.h b/WebKitLibraries/WebKitSystemInterface.h
index acf4061bc..1ee58338b 100644
--- a/WebKitLibraries/WebKitSystemInterface.h
+++ b/WebKitLibraries/WebKitSystemInterface.h
@@ -1,12 +1,13 @@
 /*      
     WebKitSystemInterface.h
-    Copyright (C) 2005, 2006, 2007, 2008, 2009, 2010, 2011 Apple Inc. All rights reserved.
+    Copyright (C) 2005, 2006, 2007, 2008, 2009, 2010, 2011, 2012 Apple Inc. All rights reserved.
 
     Public header file.
 */
 
 #import <Cocoa/Cocoa.h>
 #import <Carbon/Carbon.h>
+#import <dispatch/dispatch.h>
 
 @class AVAsset;
 @class QTMovie;
@@ -68,8 +69,6 @@ void WKDisableCGDeferredUpdates(void);
 Class WKNSURLProtocolClassForRequest(NSURLRequest *request);
 void WKSetNSURLRequestShouldContentSniff(NSMutableURLRequest *request, BOOL shouldContentSniff);
 
-void WKSetCookieStoragePrivateBrowsingEnabled(BOOL enabled);
-
 unsigned WKGetNSAutoreleasePoolCount(void);
 
 void WKAdvanceDefaultButtonPulseAnimation(NSButtonCell *button);
@@ -153,12 +152,22 @@ void WKGetGlyphsForCharacters(CGFontRef, const UniChar[], CGGlyph[], size_t);
 bool WKGetVerticalGlyphsForCharacters(CTFontRef, const UniChar[], CGGlyph[], size_t);
 
 CTLineRef WKCreateCTLineWithUniCharProvider(const UniChar* (*provide)(CFIndex stringIndex, CFIndex* charCount, CFDictionaryRef* attributes, void*), void (*dispose)(const UniChar* chars, void*), void*);
-#if MAC_OS_X_VERSION_MIN_REQUIRED >= 1070
+
+#if MAC_OS_X_VERSION_MIN_REQUIRED >= 1090
+enum {
+    WKCTFontTransformApplyShaping = (1 << 0),
+    WKCTFontTransformApplyPositioning = (1 << 1)
+};
+
+typedef int WKCTFontTransformOptions;
+
+bool WKCTFontTransformGlyphs(CTFontRef font, CGGlyph glyphs[], CGSize advances[], CFIndex count, WKCTFontTransformOptions options);
+#endif
+
 CTTypesetterRef WKCreateCTTypesetterWithUniCharProviderAndOptions(const UniChar* (*provide)(CFIndex stringIndex, CFIndex* charCount, CFDictionaryRef* attributes, void*), void (*dispose)(const UniChar* chars, void*), void*, CFDictionaryRef options);
 
 CGContextRef WKIOSurfaceContextCreate(IOSurfaceRef, unsigned width, unsigned height, CGColorSpaceRef);
 CGImageRef WKIOSurfaceContextCreateImage(CGContextRef context);
-#endif
 
 typedef enum {
     WKPatternTilingNoDistortion,
@@ -227,11 +236,7 @@ NSURL *WKQTMovieResolvedURL(QTMovie* movie);
 
 CFStringRef WKCopyFoundationCacheDirectory(void);
 
-#if MAC_OS_X_VERSION_MIN_REQUIRED == 1060
-typedef struct __CFURLStorageSession* CFURLStorageSessionRef;
-#else
 typedef const struct __CFURLStorageSession* CFURLStorageSessionRef;
-#endif
 CFURLStorageSessionRef WKCreatePrivateStorageSession(CFStringRef);
 NSURLRequest *WKCopyRequestWithStorageSession(CFURLStorageSessionRef, NSURLRequest*);
 NSCachedURLResponse *WKCachedResponseForRequest(CFURLStorageSessionRef, NSURLRequest*);
@@ -241,8 +246,10 @@ typedef struct OpaqueCFHTTPCookieStorage* CFHTTPCookieStorageRef;
 CFHTTPCookieStorageRef WKCopyHTTPCookieStorage(CFURLStorageSessionRef);
 unsigned WKGetHTTPCookieAcceptPolicy(CFHTTPCookieStorageRef);
 void WKSetHTTPCookieAcceptPolicy(CFHTTPCookieStorageRef, unsigned policy);
+NSArray *WKHTTPCookies(CFHTTPCookieStorageRef);
 NSArray *WKHTTPCookiesForURL(CFHTTPCookieStorageRef, NSURL *);
 void WKSetHTTPCookiesForURL(CFHTTPCookieStorageRef, NSArray *, NSURL *, NSURL *);
+void WKDeleteAllHTTPCookies(CFHTTPCookieStorageRef);
 void WKDeleteHTTPCookie(CFHTTPCookieStorageRef, NSHTTPCookie *);
 
 CFHTTPCookieStorageRef WKGetDefaultHTTPCookieStorage(void);
@@ -352,9 +359,7 @@ CALayer *WKCAContextGetLayer(WKCAContextRef);
 void WKCAContextSetColorSpace(WKCAContextRef, CGColorSpaceRef);
 CGColorSpaceRef WKCAContextGetColorSpace(WKCAContextRef);
 
-#if MAC_OS_X_VERSION_MIN_REQUIRED >= 1070
 void WKCALayerEnumerateRectsBeingDrawnWithBlock(CALayer *layer, CGContextRef context, void (^block)(CGRect rect));
-#endif
 
 @class CARenderer;
 
@@ -390,17 +395,6 @@ void WKSetCONNECTProxyForStream(CFReadStreamRef, CFStringRef proxyHost, CFNumber
 void WKSetCONNECTProxyAuthorizationForStream(CFReadStreamRef, CFStringRef proxyAuthorizationString);
 CFHTTPMessageRef WKCopyCONNECTProxyResponse(CFReadStreamRef, CFURLRef responseURL);
 
-#if MAC_OS_X_VERSION_MIN_REQUIRED == 1060
-typedef enum {
-    WKEventPhaseNone = 0,
-    WKEventPhaseBegan = 1,
-    WKEventPhaseChanged = 2,
-    WKEventPhaseEnded = 3,
-} WKEventPhase;
-
-int WKGetNSEventMomentumPhase(NSEvent *);
-#endif
-
 void WKWindowSetAlpha(NSWindow *window, float alphaValue);
 void WKWindowSetScaledFrame(NSWindow *window, NSRect scaleFrame, NSRect nonScaledFrame);
 
@@ -418,10 +412,6 @@ NSURLResponse *WKNSURLResponseFromSerializableRepresentation(CFDictionaryRef rep
 ScriptCode WKGetScriptCodeFromCurrentKeyboardInputSource(void);
 #endif
 
-#if MAC_OS_X_VERSION_MIN_REQUIRED == 1060
-CFIndex WKGetHyphenationLocationBeforeIndex(CFStringRef string, CFIndex index);
-#endif
-
 CFArrayRef WKCFURLCacheCopyAllHostNamesInPersistentStore(void);
 void WKCFURLCacheDeleteHostNamesInPersistentStore(CFArrayRef hostArray);    
 
@@ -433,8 +423,6 @@ void WKSetCFURLResponseMIMEType(CFURLResponseRef, CFStringRef mimeType);
 
 CIFormat WKCIGetRGBA8Format(void);
 
-#if MAC_OS_X_VERSION_MIN_REQUIRED >= 1070
-
 typedef enum {
     WKSandboxExtensionTypeReadOnly,
     WKSandboxExtensionTypeWriteOnly,    
@@ -471,28 +459,16 @@ NSURL* WKAVAssetResolvedURL(AVAsset*);
 
 NSCursor *WKCursor(const char *name);
 
-#endif
-
-#if MAC_OS_X_VERSION_MIN_REQUIRED >= 1070
-
-#import <dispatch/dispatch.h>
-
 dispatch_source_t WKCreateVMPressureDispatchOnMainQueue(void);
 
-#endif
-
 #if MAC_OS_X_VERSION_MIN_REQUIRED >= 1080
 NSString *WKGetMacOSXVersionString(void);
 bool WKExecutableWasLinkedOnOrBeforeLion(void);
 #endif
 
-#if MAC_OS_X_VERSION_MIN_REQUIRED >= 1070
 void WKCGPathAddRoundedRect(CGMutablePathRef path, const CGAffineTransform* matrix, CGRect rect, CGFloat cornerWidth, CGFloat cornerHeight);
-#endif
 
-#if MAC_OS_X_VERSION_MIN_REQUIRED >= 1070
 void WKCFURLRequestAllowAllPostCaching(CFURLRequestRef);
-#endif
 
 #if MAC_OS_X_VERSION_MIN_REQUIRED >= 1080
 @class WebFilterEvaluator;
@@ -509,10 +485,56 @@ CGFloat WKNSElasticDeltaForReboundDelta(CGFloat delta);
 CGFloat WKNSReboundDeltaForElasticDelta(CGFloat delta);
 #endif
 
-#if MAC_OS_X_VERSION_MIN_REQUIRED >= 1070
-Boolean WKJLIsRuntimeAndWebComponentsInstalled(void);
+typedef enum {
+    WKCaptionFontStyleDefault = 0,
+    WKCaptionFontStyleMonospacedWithSerif,
+    WKCaptionFontStyleProportionalWithSerif,
+    WKCaptionFontStyleMonospacedWithoutSerif,
+    WKCaptionFontStyleProportionalWithoutSerif,
+    WKCaptionFontStyleCasual,
+    WKCaptionFontStyleCursive,
+    WKCaptionFontStyleSmallCapital,
+    WKCaptionFontStyleMax
+} WKCaptionFontStyle;
+
+typedef enum {
+    WKCaptionTextEdgeStyleUndefined = 0,
+    WKCaptionTextEdgeStyleNone,
+    WKCaptionTextEdgeStyleRaised,
+    WKCaptionTextEdgeStyleDepressed,
+    WKCaptionTextEdgeStyleUniform,
+    WKCaptionTextEdgeStyleDropShadow,
+    WKCaptionTextEdgeStyleMax
+} WKCaptionTextEdgeStyle;
+
+bool WKCaptionAppearanceHasUserPreferences(void);
+bool WKCaptionAppearanceShowCaptionsWhenAvailable(void);
+CGColorRef WKCaptionAppearanceCopyForegroundColor(void);
+CGColorRef WKCaptionAppearanceCopyBackgroundColor(void);
+CGColorRef WKCaptionAppearanceCopyWindowColor(void);
+bool WKCaptionAppearanceGetForegroundOpacity(CGFloat*);
+bool WKCaptionAppearanceGetBackgroundOpacity(CGFloat*);
+bool WKCaptionAppearanceGetWindowOpacity(CGFloat*);
+CGFontRef WKCaptionAppearanceCopyFontForStyle(int fontStyle);
+bool WKCaptionAppearanceGetRelativeCharacterSize(CGFloat*);
+int WKCaptionAppearanceGetTextEdgeStyle(void);
+CFStringRef WKCaptionAppearanceGetSettingsChangedNotification(void);
+
+#if MAC_OS_X_VERSION_MIN_REQUIRED >= 1090
+typedef enum {
+    WKOcclusionNotificationTypeApplicationBecameVisible,
+    WKOcclusionNotificationTypeApplicationBecameOccluded
+} WKOcclusionNotificationType;
+
+typedef void (*WKOcclusionNotificationHandler)(uint32_t, void*, uint32_t, void*, uint32_t);
+
+bool WKRegisterOcclusionNotificationHandler(WKOcclusionNotificationType, WKOcclusionNotificationHandler);
+bool WKUnregisterOcclusionNotificationHandler(WKOcclusionNotificationType, WKOcclusionNotificationHandler);
 #endif
 
+bool WKIsJavaPlugInActive(void);
+void WKActivateJavaPlugIn(void);
+
 #ifdef __cplusplus
 }
 #endif
diff --git a/WebKitLibraries/libWebKitSystemInterfaceLeopard.a b/WebKitLibraries/libWebKitSystemInterfaceLeopard.a
deleted file mode 100644
index 33116d844..000000000
--- a/WebKitLibraries/libWebKitSystemInterfaceLeopard.a
+++ /dev/null
diff --git a/WebKitLibraries/libWebKitSystemInterfaceLion.a b/WebKitLibraries/libWebKitSystemInterfaceLion.a
index db8b46c78..c21d74551 100644
--- a/WebKitLibraries/libWebKitSystemInterfaceLion.a
+++ b/WebKitLibraries/libWebKitSystemInterfaceLion.a
diff --git a/WebKitLibraries/libWebKitSystemInterfaceMountainLion.a b/WebKitLibraries/libWebKitSystemInterfaceMountainLion.a
index de95e9694..9b0f83796 100644
--- a/WebKitLibraries/libWebKitSystemInterfaceMountainLion.a
+++ b/WebKitLibraries/libWebKitSystemInterfaceMountainLion.a
diff --git a/WebKitLibraries/libWebKitSystemInterfaceSnowLeopard.a b/WebKitLibraries/libWebKitSystemInterfaceSnowLeopard.a
deleted file mode 100644
index cb3088ca3..000000000
--- a/WebKitLibraries/libWebKitSystemInterfaceSnowLeopard.a
+++ /dev/null
diff --git a/WebKitLibraries/win/tools/vsprops/FeatureDefines.vsprops b/WebKitLibraries/win/tools/vsprops/FeatureDefines.vsprops
index 8880ab765..d271e4b27 100644
--- a/WebKitLibraries/win/tools/vsprops/FeatureDefines.vsprops
+++ b/WebKitLibraries/win/tools/vsprops/FeatureDefines.vsprops
@@ -372,6 +372,11 @@
 		PerformEnvironmentSet="true"

 	/>

   <UserMacro

+		Name="ENABLE_XHR_TIMEOUT"

+		Value="ENABLE_XHR_TIMEOUT"

+		PerformEnvironmentSet="true"

+	/>

+  <UserMacro

 		Name="ENABLE_XSLT"

 		Value="ENABLE_XSLT"

 		PerformEnvironmentSet="true"

diff --git a/WebKitLibraries/win/tools/vsprops/FeatureDefinesCairo.vsprops b/WebKitLibraries/win/tools/vsprops/FeatureDefinesCairo.vsprops
index ca18aed7a..33527a6eb 100644
--- a/WebKitLibraries/win/tools/vsprops/FeatureDefinesCairo.vsprops
+++ b/WebKitLibraries/win/tools/vsprops/FeatureDefinesCairo.vsprops
@@ -367,6 +367,11 @@
 		PerformEnvironmentSet="true"

 	/>

   <UserMacro

+		Name="ENABLE_XHR_TIMEOUT"

+		Value="ENABLE_XHR_TIMEOUT"

+		PerformEnvironmentSet="true"

+	/>

+  <UserMacro

 		Name="ENABLE_XSLT"

 		Value="ENABLE_XSLT"

 		PerformEnvironmentSet="true"

diff --git a/configure.ac b/configure.ac
index 37663e28c..593e01471 100644
--- a/configure.ac
+++ b/configure.ac
@@ -2,14 +2,14 @@ AC_PREREQ(2.60)
 
 m4_define([webkit_major_version], [1])
 m4_define([webkit_minor_version], [11])
-m4_define([webkit_micro_version], [0])
+m4_define([webkit_micro_version], [1])
 
 # This is the version we'll be using as part of our User-Agent string
 # e.g., AppleWebKit/$(webkit_user_agent_version) ...
 #
 # Sourced from Source/WebCore/Configurations/Version.xcconfig
 m4_define([webkit_user_agent_major_version], [537])
-m4_define([webkit_user_agent_minor_version], [4])
+m4_define([webkit_user_agent_minor_version], [16])
 
 AC_INIT([WebKitGTK],[webkit_major_version.webkit_minor_version.webkit_micro_version],[http://bugs.webkit.org/])
 
@@ -35,13 +35,13 @@ AC_CONFIG_SRCDIR([Source/WebCore/config.h])
 
 dnl # Libtool library version, not to confuse with API version
 dnl # see http://www.gnu.org/software/libtool/manual/html_node/Libtool-versioning.html
-LIBWEBKITGTK_VERSION=16:0:16
+LIBWEBKITGTK_VERSION=17:0:17
 AC_SUBST([LIBWEBKITGTK_VERSION])
 
-LIBJAVASCRIPTCOREGTK_VERSION=13:5:13
+LIBJAVASCRIPTCOREGTK_VERSION=13:6:13
 AC_SUBST([LIBJAVASCRIPTCOREGTK_VERSION])
 
-LIBWEBKIT2GTK_VERSION=17:0:17
+LIBWEBKIT2GTK_VERSION=18:0:18
 AC_SUBST([LIBWEBKIT2GTK_VERSION])
 
 AM_INIT_AUTOMAKE([foreign subdir-objects dist-xz no-dist-gzip tar-ustar])
@@ -725,6 +725,14 @@ AC_ARG_ENABLE(media_stream,
               [],[enable_media_stream=$enable_unstable_features])
 AC_MSG_RESULT([$enable_media_stream])
 
+# check whether to enable XHR timeout support
+AC_MSG_CHECKING([whether to enable XHR timeout support])
+AC_ARG_ENABLE(xhr_timeout,
+              AC_HELP_STRING([--enable-xhr-timeout],
+                             [enable support for XHR timeout [default=yes]]),
+              [],[enable_xhr_timeout="yes"])
+AC_MSG_RESULT([$enable_xhr_timeout])
+
 # check whether to enable XSLT support
 AC_MSG_CHECKING([whether to enable XSLT support])
 AC_ARG_ENABLE(xslt,
@@ -819,9 +827,15 @@ AC_MSG_RESULT([$enable_fast_malloc])
 # check whether to enable debug symbols
 AC_MSG_CHECKING([whether to enable debug symbols])
 AC_ARG_ENABLE(debug_symbols,
-              AC_HELP_STRING([--enable-debug-symbols],
+              AC_HELP_STRING([--enable-debug-symbols=yes|no|min|full],
                              [enable debug symbols default=no, default=yes for debug builds]),
               [],[if test "$enable_debug" = "yes"; then enable_debug_symbols="yes"; else enable_debug_symbols="no"; fi])
+
+case "$enable_debug_symbols" in
+  yes) enable_debug_symbols="full" ;;
+  no|min|full) ;;
+  *) AC_MSG_ERROR([Invalid debug symbols option: must be yes, no, min or full.]) ;;
+esac
 AC_MSG_RESULT([$enable_debug_symbols])
 
 # check whether to enable debug features
@@ -865,15 +879,23 @@ AC_ARG_ENABLE([introspection],
   [],[enable_introspection=no])
 AC_MSG_RESULT([$enable_introspection])
 
-# Enable css shaders if unstable_features, css_filters and
-# accelerated_compositing are turned on.
-AC_MSG_CHECKING([whether to enable CSS Shaders])
+# Enable CSS Filters and Shaders if unstable_features and accelerated_compositing are turned on.
+enable_css_filters=no;
+enable_css_shaders=no;
+AC_MSG_CHECKING([whether to enable CSS Filters and Shaders])
 if test "$enable_unstable_features" = "yes" && test "$enable_accelerated_compositing" = "yes" && test "$with_acceleration_backend" = "opengl"; then
-    enable_css_shaders=yes;
     enable_css_filters=yes;
+    enable_css_shaders=yes;
 fi
 AC_MSG_RESULT([$enable_css_filters])
-AC_MSG_RESULT([$enable_css_shaders])
+
+# CSS Device Adaptation
+AC_MSG_CHECKING([whether to enable CSS Device Adaptation])
+AC_ARG_ENABLE(css_device_adaptation,
+              AC_HELP_STRING([--enable-css-device-adaptation],
+                             [enable support for CSS Device Adaptation [default=no]]),
+              [],[enable_css_device_adaptation="no"])
+AC_MSG_RESULT([$enable_css_device_adaptation])
 
 G_IR_SCANNER=
 G_IR_COMPILER=
@@ -914,7 +936,10 @@ if test "$host_cpu" = "sh4"; then
 fi
 
 # Add '-g' flag to gcc to build with debug symbols
-if test "$enable_debug_symbols" = "yes"; then
+if test "$enable_debug_symbols" = "min"; then
+   CXXFLAGS="$CXXFLAGS -g1"
+   CFLAGS="$CFLAGS -g1"
+elif test "$enable_debug_symbols" != "no"; then
    CXXFLAGS="$CXXFLAGS -g"
    CFLAGS="$CFLAGS -g"
 fi
@@ -937,6 +962,10 @@ PKG_CHECK_MODULES([LIBSOUP],
 AC_SUBST([LIBSOUP_CFLAGS])
 AC_SUBST([LIBSOUP_LIBS])
 
+PKG_CHECK_MODULES([LIBSECRET], [libsecret-1])
+AC_SUBST([LIBSECRET_CFLAGS])
+AC_SUBST([LIBSECRET_LIBS])
+
 # check if FreeType/FontConfig are available
 if test "$with_font_backend" = "freetype"; then
    if test "$with_target" = "directfb"; then
@@ -1044,16 +1073,6 @@ if test "$with_acceleration_backend" = "opengl"; then
 fi
 AC_SUBST([OPENGL_LIBS])
 
-# check if atspi2 is available (only needed for Webkit2 unit tests)
-if test "$enable_webkit2" = "yes"; then
-   PKG_CHECK_MODULES([ATSPI2],
-                     [atspi-2 >= $ATSPI2_REQUIRED_VERSION],
-                     [have_atspi2=yes], [have_atspi2=no])
-
-   AC_SUBST([ATSPI2_CFLAGS])
-   AC_SUBST([ATSPI2_LIBS])
-fi
-
 if test "$enable_gamepad" = "yes"; then
    PKG_CHECK_MODULES([GAMEPAD], [gio-unix-2.0 gudev-1.0])
 
@@ -1114,6 +1133,16 @@ AC_SUBST(GTK2_LIBS)
 
 GTK_DOC_CHECK([1.10])
 
+# We need atspi2 for Webkit2 unit tests
+if test "$enable_webkit2" = "yes"; then
+   PKG_CHECK_MODULES([ATSPI2],
+                     [atspi-2 >= $ATSPI2_REQUIRED_VERSION],
+                     [have_atspi2=yes], [have_atspi2=no])
+
+   AC_SUBST([ATSPI2_CFLAGS])
+   AC_SUBST([ATSPI2_LIBS])
+fi
+
 # OS conditionals
 AM_CONDITIONAL([OS_WIN32],[test "$os_win32" = "yes"])
 AM_CONDITIONAL([OS_UNIX],[test "$os_win32" = "no"])
@@ -1166,6 +1195,7 @@ AM_CONDITIONAL([ENABLE_DEBUG],[test "$enable_debug_features" = "yes"])
 AM_CONDITIONAL([ENABLE_UNSTABLE_FEATURES],[test "$enable_unstable_features" = "yes"])
 AM_CONDITIONAL([ENABLE_WEBGL],[test "$enable_webgl" = "yes"])
 AM_CONDITIONAL([ENABLE_GAMEPAD],[test "$enable_gamepad" = "yes"])
+AM_CONDITIONAL([ENABLE_XHR_TIMEOUT],[test "$enable_xhr_timeout" = "yes"])
 AM_CONDITIONAL([ENABLE_XSLT],[test "$enable_xslt" = "yes"])
 AM_CONDITIONAL([ENABLE_FILTERS],[test "$enable_filters" = "yes"])
 AM_CONDITIONAL([ENABLE_GEOLOCATION], [test "$enable_geolocation" = "yes"])
@@ -1181,6 +1211,7 @@ AM_CONDITIONAL([ENABLE_OPCODE_STATS],[test "$enable_opcode_stats" = "yes"])
 AM_CONDITIONAL([ENABLE_WEBKIT2],[test "$enable_webkit2" = "yes"])
 AM_CONDITIONAL([ENABLE_PLUGIN_PROCESS],[test "$enable_plugin_process" = "yes"])
 AM_CONDITIONAL([ENABLE_SPELLCHECK],[test "$enable_spellcheck" = "yes"])
+AM_CONDITIONAL([ENABLE_CSS_DEVICE_ADAPTATION],[test "$enable_css_device_adaptation" = "yes"])
 AM_CONDITIONAL([ENABLE_CSS_FILTERS],[test "$enable_css_filters" = "yes"])
 AM_CONDITIONAL([ENABLE_CSS_SHADERS],[test "$enable_css_shaders" = "yes"])
 
@@ -1194,6 +1225,7 @@ GNUmakefile
 
 AC_CONFIG_FILES([
 Source/WebKit/gtk/webkit/webkitversion.h
+Source/WebKit/gtk/po/POTFILES
 DerivedSources/WebCore/UserAgentGtk.h:Source/WebCore/platform/gtk/UserAgentGtk.h.in
 ])
 
@@ -1250,6 +1282,7 @@ Features:
  Spellcheck support                                       : $enable_spellcheck
  Web Audio support                                        : $enable_web_audio
  WebGL                                                    : $enable_webgl
+ XHR timeout support                                      : $enable_xhr_timeout
  XSLT support                                             : $enable_xslt
 
 WebKit2 support: